Fix build with older GnuTLS
[exim.git] / src / src / tls-gnu.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
f9ba5e22 5/* Copyright (c) University of Cambridge 1995 - 2018 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
17c76198 8/* Copyright (c) Phil Pennock 2012 */
059ec3d9 9
17c76198
PP
10/* This file provides TLS/SSL support for Exim using the GnuTLS library,
11one of the available supported implementations. This file is #included into
12tls.c when USE_GNUTLS has been set.
059ec3d9 13
17c76198
PP
14The code herein is a revamp of GnuTLS integration using the current APIs; the
15original tls-gnu.c was based on a patch which was contributed by Nikos
6aa6fc9c 16Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
17c76198 17appropriate.
059ec3d9 18
17c76198
PP
19APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20which is not widely deployed by OS vendors. Will note issues below, which may
21assist in updating the code in the future. Another sources of hints is
22mod_gnutls for Apache (SNI callback registration and handling).
059ec3d9 23
17c76198
PP
24Keeping client and server variables more split than before and is currently
25the norm, in anticipation of TLS in ACL callouts.
059ec3d9 26
17c76198
PP
27I wanted to switch to gnutls_certificate_set_verify_function() so that
28certificate rejection could happen during handshake where it belongs, rather
29than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30(6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
059ec3d9 31
17c76198
PP
32(I wasn't looking for libraries quite that old, when updating to get rid of
33compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34require current GnuTLS, then we'll drop support for the ancient libraries).
35*/
b5aea5e1 36
17c76198
PP
37#include <gnutls/gnutls.h>
38/* needed for cert checks in verification and DN extraction: */
39#include <gnutls/x509.h>
40/* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41#include <gnutls/crypto.h>
184384c3 42
a5f239e4
PP
43/* needed to disable PKCS11 autoload unless requested */
44#if GNUTLS_VERSION_NUMBER >= 0x020c00
45# include <gnutls/pkcs11.h>
76075bb5 46# define SUPPORT_PARAM_TO_PK_BITS
a5f239e4 47#endif
7e07527a
JH
48#if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
49# warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
50# define DISABLE_OCSP
51#endif
0cbf2b82 52#if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
774ef2d7 53# warning "GnuTLS library version too old; tls:cert event unsupported"
0cbf2b82 54# define DISABLE_EVENT
a7538db1 55#endif
a7fec7a7
JH
56#if GNUTLS_VERSION_NUMBER >= 0x030306
57# define SUPPORT_CA_DIR
58#else
59# undef SUPPORT_CA_DIR
60#endif
11a04b5a 61#if GNUTLS_VERSION_NUMBER >= 0x030014
cb1d7830
JH
62# define SUPPORT_SYSDEFAULT_CABUNDLE
63#endif
184384c3
JH
64#if GNUTLS_VERSION_NUMBER >= 0x030104
65# define GNUTLS_CERT_VFY_STATUS_PRINT
66#endif
925ac8e4
JH
67#if GNUTLS_VERSION_NUMBER >= 0x030109
68# define SUPPORT_CORK
69#endif
f20cfa4a
JH
70#if GNUTLS_VERSION_NUMBER >= 0x03010a
71# define SUPPORT_GNUTLS_SESS_DESC
72#endif
73#if GNUTLS_VERSION_NUMBER >= 0x030500
74# define SUPPORT_GNUTLS_KEYLOG
75#endif
47195144
JH
76#if GNUTLS_VERSION_NUMBER >= 0x030506 && !defined(DISABLE_OCSP)
77# define SUPPORT_SRV_OCSP_STACK
78#endif
c0635b6d
JH
79
80#ifdef SUPPORT_DANE
81# if GNUTLS_VERSION_NUMBER >= 0x030000
82# define DANESSL_USAGE_DANE_TA 2
83# define DANESSL_USAGE_DANE_EE 3
84# else
85# error GnuTLS version too early for DANE
86# endif
87# if GNUTLS_VERSION_NUMBER < 0x999999
88# define GNUTLS_BROKEN_DANE_VALIDATION
89# endif
899b8bbc 90#endif
7e07527a 91
f2de3a33 92#ifndef DISABLE_OCSP
2b4a568d
JH
93# include <gnutls/ocsp.h>
94#endif
899b8bbc
JH
95#ifdef SUPPORT_DANE
96# include <gnutls/dane.h>
97#endif
059ec3d9 98
f1be21cf
JH
99#include "tls-cipher-stdname.c"
100
101
17c76198 102/* GnuTLS 2 vs 3
059ec3d9 103
17c76198
PP
104GnuTLS 3 only:
105 gnutls_global_set_audit_log_function()
059ec3d9 106
17c76198
PP
107Changes:
108 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
109*/
059ec3d9 110
17c76198 111/* Local static variables for GnuTLS */
059ec3d9 112
17c76198 113/* Values for verify_requirement */
059ec3d9 114
e51c7be2 115enum peer_verify_requirement
899b8bbc 116 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED, VERIFY_DANE };
059ec3d9 117
17c76198
PP
118/* This holds most state for server or client; with this, we can set up an
119outbound TLS-enabled connection in an ACL callout, while not stomping all
120over the TLS variables available for expansion.
059ec3d9 121
17c76198
PP
122Some of these correspond to variables in globals.c; those variables will
123be set to point to content in one of these instances, as appropriate for
124the stage of the process lifetime.
059ec3d9 125
389ca47a 126Not handled here: global tls_channelbinding_b64.
17c76198 127*/
059ec3d9 128
17c76198 129typedef struct exim_gnutls_state {
9d1c15ef 130 gnutls_session_t session;
17c76198 131 gnutls_certificate_credentials_t x509_cred;
9d1c15ef 132 gnutls_priority_t priority_cache;
17c76198 133 enum peer_verify_requirement verify_requirement;
9d1c15ef
JH
134 int fd_in;
135 int fd_out;
136 BOOL peer_cert_verified;
899b8bbc 137 BOOL peer_dane_verified;
9d1c15ef
JH
138 BOOL trigger_sni_changes;
139 BOOL have_set_peerdn;
5fd28bb8 140 const struct host_item *host; /* NULL if server */
afdb5e9c 141 gnutls_x509_crt_t peercert;
9d1c15ef
JH
142 uschar *peerdn;
143 uschar *ciphersuite;
144 uschar *received_sni;
17c76198
PP
145
146 const uschar *tls_certificate;
147 const uschar *tls_privatekey;
148 const uschar *tls_sni; /* client send only, not received */
149 const uschar *tls_verify_certificates;
150 const uschar *tls_crl;
151 const uschar *tls_require_ciphers;
e51c7be2 152
17c76198
PP
153 uschar *exp_tls_certificate;
154 uschar *exp_tls_privatekey;
17c76198
PP
155 uschar *exp_tls_verify_certificates;
156 uschar *exp_tls_crl;
157 uschar *exp_tls_require_ciphers;
55414b25 158 const uschar *exp_tls_verify_cert_hostnames;
0cbf2b82 159#ifndef DISABLE_EVENT
a7538db1
JH
160 uschar *event_action;
161#endif
899b8bbc
JH
162#ifdef SUPPORT_DANE
163 char * const * dane_data;
164 const int * dane_data_len;
165#endif
17c76198 166
389ca47a 167 tls_support *tlsp; /* set in tls_init() */
817d9f57 168
17c76198
PP
169 uschar *xfer_buffer;
170 int xfer_buffer_lwm;
171 int xfer_buffer_hwm;
8b77d27a
JH
172 BOOL xfer_eof; /*XXX never gets set! */
173 BOOL xfer_error;
17c76198
PP
174} exim_gnutls_state_st;
175
176static const exim_gnutls_state_st exim_gnutls_state_init = {
f2ed27cf
JH
177 .session = NULL,
178 .x509_cred = NULL,
179 .priority_cache = NULL,
180 .verify_requirement = VERIFY_NONE,
181 .fd_in = -1,
182 .fd_out = -1,
183 .peer_cert_verified = FALSE,
899b8bbc 184 .peer_dane_verified = FALSE,
f2ed27cf
JH
185 .trigger_sni_changes =FALSE,
186 .have_set_peerdn = FALSE,
187 .host = NULL,
188 .peercert = NULL,
189 .peerdn = NULL,
190 .ciphersuite = NULL,
191 .received_sni = NULL,
192
193 .tls_certificate = NULL,
194 .tls_privatekey = NULL,
195 .tls_sni = NULL,
196 .tls_verify_certificates = NULL,
197 .tls_crl = NULL,
198 .tls_require_ciphers =NULL,
199
200 .exp_tls_certificate = NULL,
201 .exp_tls_privatekey = NULL,
202 .exp_tls_verify_certificates = NULL,
203 .exp_tls_crl = NULL,
204 .exp_tls_require_ciphers = NULL,
f2ed27cf 205 .exp_tls_verify_cert_hostnames = NULL,
0cbf2b82 206#ifndef DISABLE_EVENT
f2ed27cf 207 .event_action = NULL,
a7538db1 208#endif
f2ed27cf
JH
209 .tlsp = NULL,
210
211 .xfer_buffer = NULL,
212 .xfer_buffer_lwm = 0,
213 .xfer_buffer_hwm = 0,
8b77d27a
JH
214 .xfer_eof = FALSE,
215 .xfer_error = FALSE,
17c76198 216};
83da1223 217
17c76198
PP
218/* Not only do we have our own APIs which don't pass around state, assuming
219it's held in globals, GnuTLS doesn't appear to let us register callback data
220for callbacks, or as part of the session, so we have to keep a "this is the
221context we're currently dealing with" pointer and rely upon being
222single-threaded to keep from processing data on an inbound TLS connection while
223talking to another TLS connection for an outbound check. This does mean that
224there's no way for heart-beats to be responded to, for the duration of the
a7538db1
JH
225second connection.
226XXX But see gnutls_session_get_ptr()
227*/
059ec3d9 228
74f1a423 229static exim_gnutls_state_st state_server;
059ec3d9 230
17c76198
PP
231/* dh_params are initialised once within the lifetime of a process using TLS;
232if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
233don't want to repeat this. */
83da1223 234
17c76198 235static gnutls_dh_params_t dh_server_params = NULL;
059ec3d9 236
17c76198 237/* No idea how this value was chosen; preserving it. Default is 3600. */
059ec3d9 238
17c76198 239static const int ssl_session_timeout = 200;
059ec3d9 240
fc243e94 241static const uschar * const exim_default_gnutls_priority = US"NORMAL";
83da1223 242
17c76198 243/* Guard library core initialisation */
83da1223 244
17c76198 245static BOOL exim_gnutls_base_init_done = FALSE;
059ec3d9 246
4fb7df6d 247#ifndef DISABLE_OCSP
9196d5bf 248static BOOL gnutls_buggy_ocsp = FALSE;
4fb7df6d 249#endif
9196d5bf 250
059ec3d9 251
17c76198 252/* ------------------------------------------------------------------------ */
17c76198 253/* macros */
83da1223 254
17c76198 255#define MAX_HOST_LEN 255
83da1223 256
17c76198
PP
257/* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
258the library logging; a value less than 0 disables the calls to set up logging
dc6d1769
JH
259callbacks. GNuTLS also looks for an environment variable - except not for
260setuid binaries, making it useless - "GNUTLS_DEBUG_LEVEL".
261Allegedly the testscript line "GNUTLS_DEBUG_LEVEL=9 sudo exim ..." would work,
262but the env var must be added to /etc/sudoers too. */
2c17bb02 263#ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
a7538db1 264# define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
2c17bb02 265#endif
83da1223 266
2c17bb02 267#ifndef EXIM_CLIENT_DH_MIN_BITS
a7538db1 268# define EXIM_CLIENT_DH_MIN_BITS 1024
2c17bb02 269#endif
83da1223 270
af3498d6
PP
271/* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
272can ask for a bit-strength. Without that, we stick to the constant we had
273before, for now. */
2c17bb02 274#ifndef EXIM_SERVER_DH_BITS_PRE2_12
a7538db1 275# define EXIM_SERVER_DH_BITS_PRE2_12 1024
2c17bb02 276#endif
af3498d6 277
cf0c6164
JH
278#define expand_check_tlsvar(Varname, errstr) \
279 expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr)
83da1223 280
17c76198 281#if GNUTLS_VERSION_NUMBER >= 0x020c00
e51c7be2
JH
282# define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
283# define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
284# define HAVE_GNUTLS_RND
2519e60d
TL
285/* The security fix we provide with the gnutls_allow_auto_pkcs11 option
286 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
287 * isn't available sometimes, so this needs to become a conditional
288 * compilation; the sanest way to deal with this being a problem on
289 * older OSes is to block it in the Local/Makefile with this compiler
290 * definition */
e51c7be2
JH
291# ifndef AVOID_GNUTLS_PKCS11
292# define HAVE_GNUTLS_PKCS11
293# endif /* AVOID_GNUTLS_PKCS11 */
17c76198 294#endif
83da1223 295
af3498d6
PP
296
297
298
299/* ------------------------------------------------------------------------ */
300/* Callback declarations */
301
302#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
303static void exim_gnutls_logger_cb(int level, const char *message);
304#endif
305
306static int exim_sni_handling_cb(gnutls_session_t session);
307
f2de3a33 308#ifndef DISABLE_OCSP
44662487
JH
309static int server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
310 gnutls_datum_t * ocsp_response);
311#endif
af3498d6
PP
312
313
314
17c76198
PP
315/* ------------------------------------------------------------------------ */
316/* Static functions */
059ec3d9
PH
317
318/*************************************************
319* Handle TLS error *
320*************************************************/
321
322/* Called from lots of places when errors occur before actually starting to do
323the TLS handshake, that is, while the session is still in clear. Always returns
324DEFER for a server and FAIL for a client so that most calls can use "return
325tls_error(...)" to do this processing and then give an appropriate return. A
326single function is used for both server and client, because it is called from
327some shared functions.
328
329Argument:
330 prefix text to include in the logged error
7199e1ee
TF
331 msg additional error string (may be NULL)
332 usually obtained from gnutls_strerror()
17c76198
PP
333 host NULL if setting up a server;
334 the connected host if setting up a client
cf0c6164 335 errstr pointer to returned error string
059ec3d9
PH
336
337Returns: OK/DEFER/FAIL
338*/
339
340static int
48224640 341tls_error(const uschar *prefix, const uschar *msg, const host_item *host,
cf0c6164 342 uschar ** errstr)
059ec3d9 343{
cf0c6164 344if (errstr)
48224640 345 *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : US"");
cf0c6164 346return host ? FAIL : DEFER;
059ec3d9
PH
347}
348
349
452a164f
JH
350static int
351tls_error_gnu(const uschar *prefix, int err, const host_item *host,
352 uschar ** errstr)
353{
354return tls_error(prefix, US gnutls_strerror(err), host, errstr);
355}
356
357static int
358tls_error_sys(const uschar *prefix, int err, const host_item *host,
359 uschar ** errstr)
360{
361return tls_error(prefix, US strerror(err), host, errstr);
362}
059ec3d9 363
17c76198 364
059ec3d9 365/*************************************************
17c76198 366* Deal with logging errors during I/O *
059ec3d9
PH
367*************************************************/
368
17c76198 369/* We have to get the identity of the peer from saved data.
059ec3d9 370
17c76198
PP
371Argument:
372 state the current GnuTLS exim state container
373 rc the GnuTLS error code, or 0 if it's a local error
374 when text identifying read or write
95f52235 375 text local error text when rc is 0
059ec3d9 376
17c76198 377Returns: nothing
059ec3d9
PH
378*/
379
17c76198
PP
380static void
381record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
059ec3d9 382{
48224640 383const uschar * msg;
cf0c6164 384uschar * errstr;
059ec3d9 385
17c76198 386if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
95f52235 387 msg = string_sprintf("A TLS fatal alert has been received: %s",
17c76198
PP
388 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
389else
48224640 390 msg = US gnutls_strerror(rc);
059ec3d9 391
cf0c6164
JH
392(void) tls_error(when, msg, state->host, &errstr);
393
394if (state->host)
395 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection %s",
396 state->host->name, state->host->address, errstr);
397else
398 {
399 uschar * conn_info = smtp_get_connection_info();
400 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0) conn_info += 5;
401 /* I'd like to get separated H= here, but too hard for now */
402 log_write(0, LOG_MAIN, "TLS error on %s %s", conn_info, errstr);
403 }
17c76198 404}
059ec3d9 405
059ec3d9 406
059ec3d9 407
059ec3d9 408
17c76198
PP
409/*************************************************
410* Set various Exim expansion vars *
411*************************************************/
059ec3d9 412
e51c7be2
JH
413#define exim_gnutls_cert_err(Label) \
414 do \
415 { \
416 if (rc != GNUTLS_E_SUCCESS) \
417 { \
418 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
419 (Label), gnutls_strerror(rc)); \
420 return rc; \
421 } \
422 } while (0)
9d1c15ef
JH
423
424static int
27f19eb4 425import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
9d1c15ef
JH
426{
427int rc;
428
429rc = gnutls_x509_crt_init(crtp);
430exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
431
432rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
433exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
434
435return rc;
436}
437
438#undef exim_gnutls_cert_err
439
440
17c76198
PP
441/* We set various Exim global variables from the state, once a session has
442been established. With TLS callouts, may need to change this to stack
443variables, or just re-call it with the server state after client callout
444has finished.
059ec3d9 445
9d1c15ef 446Make sure anything set here is unset in tls_getc().
17c76198
PP
447
448Sets:
449 tls_active fd
450 tls_bits strength indicator
451 tls_certificate_verified bool indicator
452 tls_channelbinding_b64 for some SASL mechanisms
453 tls_cipher a string
9d1c15ef 454 tls_peercert pointer to library internal
17c76198
PP
455 tls_peerdn a string
456 tls_sni a (UTF-8) string
9d1c15ef 457 tls_ourcert pointer to library internal
17c76198
PP
458
459Argument:
460 state the relevant exim_gnutls_state_st *
461*/
462
463static void
9d1c15ef 464extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
17c76198 465{
17c76198 466gnutls_cipher_algorithm_t cipher;
17c76198
PP
467#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
468int old_pool;
469int rc;
470gnutls_datum_t channel;
471#endif
9d1c15ef 472tls_support * tlsp = state->tlsp;
17c76198 473
74f1a423
JH
474tlsp->active.sock = state->fd_out;
475tlsp->active.tls_ctx = state;
17c76198
PP
476
477cipher = gnutls_cipher_get(state->session);
478/* returns size in "bytes" */
9d1c15ef 479tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
17c76198 480
9d1c15ef 481tlsp->cipher = state->ciphersuite;
17c76198 482
817d9f57 483DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
17c76198 484
9d1c15ef 485tlsp->certificate_verified = state->peer_cert_verified;
899b8bbc
JH
486#ifdef SUPPORT_DANE
487tlsp->dane_verified = state->peer_dane_verified;
488#endif
059ec3d9 489
17c76198
PP
490/* note that tls_channelbinding_b64 is not saved to the spool file, since it's
491only available for use for authenticators while this TLS session is running. */
492
493tls_channelbinding_b64 = NULL;
494#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
495channel.data = NULL;
496channel.size = 0;
1f20760b
JH
497if ((rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel)))
498 { DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc)); }
499else
500 {
17c76198
PP
501 old_pool = store_pool;
502 store_pool = POOL_PERM;
1f20760b 503 tls_channelbinding_b64 = b64encode(CUS channel.data, (int)channel.size);
17c76198
PP
504 store_pool = old_pool;
505 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
1f20760b 506 }
17c76198
PP
507#endif
508
9d1c15ef
JH
509/* peercert is set in peer_status() */
510tlsp->peerdn = state->peerdn;
511tlsp->sni = state->received_sni;
512
513/* record our certificate */
514 {
27f19eb4 515 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
9d1c15ef
JH
516 gnutls_x509_crt_t crt;
517
518 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
519 }
059ec3d9
PH
520}
521
522
523
17c76198 524
059ec3d9 525/*************************************************
575643cd 526* Setup up DH parameters *
059ec3d9
PH
527*************************************************/
528
575643cd 529/* Generating the D-H parameters may take a long time. They only need to
059ec3d9
PH
530be re-generated every so often, depending on security policy. What we do is to
531keep these parameters in a file in the spool directory. If the file does not
532exist, we generate them. This means that it is easy to cause a regeneration.
533
534The new file is written as a temporary file and renamed, so that an incomplete
535file is never present. If two processes both compute some new parameters, you
536waste a bit of effort, but it doesn't seem worth messing around with locking to
537prevent this.
538
059ec3d9
PH
539Returns: OK/DEFER/FAIL
540*/
541
542static int
cf0c6164 543init_server_dh(uschar ** errstr)
059ec3d9 544{
17c76198
PP
545int fd, rc;
546unsigned int dh_bits;
27f19eb4 547gnutls_datum_t m;
a799883d
PP
548uschar filename_buf[PATH_MAX];
549uschar *filename = NULL;
17c76198 550size_t sz;
a799883d
PP
551uschar *exp_tls_dhparam;
552BOOL use_file_in_spool = FALSE;
17c76198 553host_item *host = NULL; /* dummy for macros */
059ec3d9 554
17c76198 555DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
059ec3d9 556
452a164f
JH
557if ((rc = gnutls_dh_params_init(&dh_server_params)))
558 return tls_error_gnu(US"gnutls_dh_params_init", rc, host, errstr);
059ec3d9 559
a799883d
PP
560m.data = NULL;
561m.size = 0;
562
cf0c6164 563if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam, errstr))
a799883d
PP
564 return DEFER;
565
566if (!exp_tls_dhparam)
567 {
568 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
569 m.data = US std_dh_prime_default();
570 m.size = Ustrlen(m.data);
571 }
572else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
573 use_file_in_spool = TRUE;
574else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
575 {
576 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
577 return OK;
578 }
579else if (exp_tls_dhparam[0] != '/')
580 {
f5d25c2b 581 if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
48224640 582 return tls_error(US"No standard prime named", exp_tls_dhparam, NULL, errstr);
a799883d
PP
583 m.size = Ustrlen(m.data);
584 }
585else
a799883d 586 filename = exp_tls_dhparam;
a799883d
PP
587
588if (m.data)
589 {
452a164f
JH
590 if ((rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM)))
591 return tls_error_gnu(US"gnutls_dh_params_import_pkcs3", rc, host, errstr);
a799883d
PP
592 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
593 return OK;
594 }
595
af3498d6
PP
596#ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
597/* If you change this constant, also change dh_param_fn_ext so that we can use a
17c76198 598different filename and ensure we have sufficient bits. */
452a164f
JH
599
600if (!(dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL)))
cf0c6164 601 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL, errstr);
af3498d6 602DEBUG(D_tls)
b34fc30c 603 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
af3498d6
PP
604 dh_bits);
605#else
606dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
607DEBUG(D_tls)
608 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
609 dh_bits);
610#endif
059ec3d9 611
3375e053
PP
612/* Some clients have hard-coded limits. */
613if (dh_bits > tls_dh_max_bits)
614 {
615 DEBUG(D_tls)
616 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
617 tls_dh_max_bits);
618 dh_bits = tls_dh_max_bits;
619 }
620
a799883d
PP
621if (use_file_in_spool)
622 {
623 if (!string_format(filename_buf, sizeof(filename_buf),
624 "%s/gnutls-params-%d", spool_directory, dh_bits))
cf0c6164 625 return tls_error(US"overlong filename", NULL, NULL, errstr);
a799883d
PP
626 filename = filename_buf;
627 }
059ec3d9 628
b5aea5e1 629/* Open the cache file for reading and if successful, read it and set up the
575643cd 630parameters. */
059ec3d9 631
f5d25c2b 632if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
059ec3d9 633 {
b5aea5e1 634 struct stat statbuf;
17c76198
PP
635 FILE *fp;
636 int saved_errno;
637
638 if (fstat(fd, &statbuf) < 0) /* EIO */
639 {
640 saved_errno = errno;
641 (void)close(fd);
452a164f 642 return tls_error_sys(US"TLS cache stat failed", saved_errno, NULL, errstr);
17c76198
PP
643 }
644 if (!S_ISREG(statbuf.st_mode))
b5aea5e1
PH
645 {
646 (void)close(fd);
cf0c6164 647 return tls_error(US"TLS cache not a file", NULL, NULL, errstr);
17c76198 648 }
40c90bca 649 if (!(fp = fdopen(fd, "rb")))
17c76198
PP
650 {
651 saved_errno = errno;
652 (void)close(fd);
452a164f
JH
653 return tls_error_sys(US"fdopen(TLS cache stat fd) failed",
654 saved_errno, NULL, errstr);
b5aea5e1 655 }
059ec3d9 656
b5aea5e1 657 m.size = statbuf.st_size;
40c90bca 658 if (!(m.data = malloc(m.size)))
17c76198
PP
659 {
660 fclose(fp);
452a164f 661 return tls_error_sys(US"malloc failed", errno, NULL, errstr);
17c76198 662 }
40c90bca 663 if (!(sz = fread(m.data, m.size, 1, fp)))
17c76198
PP
664 {
665 saved_errno = errno;
666 fclose(fp);
667 free(m.data);
452a164f 668 return tls_error_sys(US"fread failed", saved_errno, NULL, errstr);
17c76198
PP
669 }
670 fclose(fp);
b5aea5e1 671
17c76198 672 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
b5aea5e1 673 free(m.data);
452a164f
JH
674 if (rc)
675 return tls_error_gnu(US"gnutls_dh_params_import_pkcs3", rc, host, errstr);
17c76198 676 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
b5aea5e1
PH
677 }
678
679/* If the file does not exist, fall through to compute new data and cache it.
680If there was any other opening error, it is serious. */
681
182ad5cf
PH
682else if (errno == ENOENT)
683 {
17c76198 684 rc = -1;
182ad5cf 685 DEBUG(D_tls)
17c76198 686 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
182ad5cf
PH
687 }
688else
17c76198 689 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
cf0c6164 690 NULL, NULL, errstr);
b5aea5e1
PH
691
692/* If ret < 0, either the cache file does not exist, or the data it contains
693is not useful. One particular case of this is when upgrading from an older
694release of Exim in which the data was stored in a different format. We don't
695try to be clever and support both formats; we just regenerate new data in this
696case. */
697
17c76198 698if (rc < 0)
b5aea5e1 699 {
17c76198 700 uschar *temp_fn;
201f5254 701 unsigned int dh_bits_gen = dh_bits;
059ec3d9 702
17c76198
PP
703 if ((PATH_MAX - Ustrlen(filename)) < 10)
704 return tls_error(US"Filename too long to generate replacement",
48224640 705 filename, NULL, errstr);
059ec3d9 706
48224640 707 temp_fn = string_copy(US"%s.XXXXXXX");
f5d25c2b 708 if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */
452a164f 709 return tls_error_sys(US"Unable to open temp file", errno, NULL, errstr);
b66fecb4 710 (void)exim_chown(temp_fn, exim_uid, exim_gid); /* Probably not necessary */
059ec3d9 711
201f5254
PP
712 /* GnuTLS overshoots!
713 * If we ask for 2236, we might get 2237 or more.
714 * But there's no way to ask GnuTLS how many bits there really are.
715 * We can ask how many bits were used in a TLS session, but that's it!
716 * The prime itself is hidden behind too much abstraction.
717 * So we ask for less, and proceed on a wing and a prayer.
718 * First attempt, subtracted 3 for 2233 and got 2240.
719 */
cae6e576 720 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
201f5254
PP
721 {
722 dh_bits_gen = dh_bits - 10;
723 DEBUG(D_tls)
724 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
725 dh_bits_gen);
726 }
727
728 DEBUG(D_tls)
729 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
730 dh_bits_gen);
452a164f
JH
731 if ((rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen)))
732 return tls_error_gnu(US"gnutls_dh_params_generate2", rc, host, errstr);
17c76198
PP
733
734 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
735 and I confirmed that a NULL call to get the size first is how the GnuTLS
736 sample apps handle this. */
737
738 sz = 0;
739 m.data = NULL;
452a164f
JH
740 if ( (rc = gnutls_dh_params_export_pkcs3(dh_server_params,
741 GNUTLS_X509_FMT_PEM, m.data, &sz))
742 && rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
743 return tls_error_gnu(US"gnutls_dh_params_export_pkcs3(NULL) sizing",
744 rc, host, errstr);
17c76198 745 m.size = sz;
40c90bca 746 if (!(m.data = malloc(m.size)))
452a164f 747 return tls_error_sys(US"memory allocation failed", errno, NULL, errstr);
40c90bca 748
1f00591e 749 /* this will return a size 1 less than the allocation size above */
452a164f
JH
750 if ((rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
751 m.data, &sz)))
17c76198
PP
752 {
753 free(m.data);
452a164f 754 return tls_error_gnu(US"gnutls_dh_params_export_pkcs3() real", rc, host, errstr);
17c76198 755 }
1f00591e 756 m.size = sz; /* shrink by 1, probably */
059ec3d9 757
f5d25c2b 758 if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
17c76198
PP
759 {
760 free(m.data);
452a164f
JH
761 return tls_error_sys(US"TLS cache write D-H params failed",
762 errno, NULL, errstr);
17c76198 763 }
b5aea5e1 764 free(m.data);
f5d25c2b 765 if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
452a164f
JH
766 return tls_error_sys(US"TLS cache write D-H params final newline failed",
767 errno, NULL, errstr);
17c76198 768
f5d25c2b 769 if ((rc = close(fd)))
452a164f 770 return tls_error_sys(US"TLS cache write close() failed", errno, NULL, errstr);
059ec3d9 771
17c76198 772 if (Urename(temp_fn, filename) < 0)
452a164f
JH
773 return tls_error_sys(string_sprintf("failed to rename \"%s\" as \"%s\"",
774 temp_fn, filename), errno, NULL, errstr);
059ec3d9 775
17c76198 776 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
059ec3d9
PH
777 }
778
17c76198 779DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
059ec3d9
PH
780return OK;
781}
782
783
784
785
23bb6982
JH
786/* Create and install a selfsigned certificate, for use in server mode */
787
788static int
cf0c6164 789tls_install_selfsign(exim_gnutls_state_st * state, uschar ** errstr)
23bb6982
JH
790{
791gnutls_x509_crt_t cert = NULL;
792time_t now;
793gnutls_x509_privkey_t pkey = NULL;
794const uschar * where;
795int rc;
796
797where = US"initialising pkey";
798if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
799
800where = US"initialising cert";
801if ((rc = gnutls_x509_crt_init(&cert))) goto err;
802
803where = US"generating pkey";
804if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
76075bb5 805#ifdef SUPPORT_PARAM_TO_PK_BITS
4312da48
JH
806# ifndef GNUTLS_SEC_PARAM_MEDIUM
807# define GNUTLS_SEC_PARAM_MEDIUM GNUTLS_SEC_PARAM_HIGH
808# endif
6aac3239 809 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_MEDIUM),
76075bb5 810#else
6aac3239 811 2048,
76075bb5
JH
812#endif
813 0)))
23bb6982
JH
814 goto err;
815
816where = US"configuring cert";
1613fd68 817now = 1;
23bb6982
JH
818if ( (rc = gnutls_x509_crt_set_version(cert, 3))
819 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
820 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
821 || (rc = gnutls_x509_crt_set_expiration_time(cert, now + 60 * 60)) /* 1 hr */
822 || (rc = gnutls_x509_crt_set_key(cert, pkey))
823
824 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
825 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
826 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
827 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
828 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
829 GNUTLS_OID_X520_COMMON_NAME, 0,
830 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
831 )
832 goto err;
833
834where = US"signing cert";
835if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
836
837where = US"installing selfsign cert";
838 /* Since: 2.4.0 */
839if ((rc = gnutls_certificate_set_x509_key(state->x509_cred, &cert, 1, pkey)))
840 goto err;
841
842rc = OK;
843
844out:
845 if (cert) gnutls_x509_crt_deinit(cert);
846 if (pkey) gnutls_x509_privkey_deinit(pkey);
847 return rc;
848
849err:
452a164f 850 rc = tls_error_gnu(where, rc, NULL, errstr);
23bb6982
JH
851 goto out;
852}
853
854
855
856
47195144
JH
857/* Add certificate and key, from files.
858
859Return:
860 Zero or negative: good. Negate value for certificate index if < 0.
861 Greater than zero: FAIL or DEFER code.
862*/
863
ba86e143
JH
864static int
865tls_add_certfile(exim_gnutls_state_st * state, const host_item * host,
866 uschar * certfile, uschar * keyfile, uschar ** errstr)
867{
868int rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
869 CS certfile, CS keyfile, GNUTLS_X509_FMT_PEM);
47195144 870if (rc < 0)
452a164f 871 return tls_error_gnu(
47195144 872 string_sprintf("cert/key setup: cert=%s key=%s", certfile, keyfile),
452a164f 873 rc, host, errstr);
47195144 874return -rc;
ba86e143
JH
875}
876
877
059ec3d9 878/*************************************************
17c76198 879* Variables re-expanded post-SNI *
059ec3d9
PH
880*************************************************/
881
17c76198
PP
882/* Called from both server and client code, via tls_init(), and also from
883the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
884
885We can tell the two apart by state->received_sni being non-NULL in callback.
886
887The callback should not call us unless state->trigger_sni_changes is true,
888which we are responsible for setting on the first pass through.
059ec3d9
PH
889
890Arguments:
17c76198 891 state exim_gnutls_state_st *
cf0c6164 892 errstr error string pointer
059ec3d9
PH
893
894Returns: OK/DEFER/FAIL
895*/
896
897static int
ba86e143 898tls_expand_session_files(exim_gnutls_state_st * state, uschar ** errstr)
059ec3d9 899{
1365611d 900struct stat statbuf;
059ec3d9 901int rc;
17c76198
PP
902const host_item *host = state->host; /* macro should be reconsidered? */
903uschar *saved_tls_certificate = NULL;
904uschar *saved_tls_privatekey = NULL;
905uschar *saved_tls_verify_certificates = NULL;
906uschar *saved_tls_crl = NULL;
907int cert_count;
908
909/* We check for tls_sni *before* expansion. */
2b4a568d 910if (!host) /* server */
17c76198
PP
911 if (!state->received_sni)
912 {
ba86e143
JH
913 if ( state->tls_certificate
914 && ( Ustrstr(state->tls_certificate, US"tls_sni")
915 || Ustrstr(state->tls_certificate, US"tls_in_sni")
916 || Ustrstr(state->tls_certificate, US"tls_out_sni")
917 ) )
17c76198
PP
918 {
919 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
920 state->trigger_sni_changes = TRUE;
921 }
922 }
923 else
924 {
1365611d 925 /* useful for debugging */
17c76198
PP
926 saved_tls_certificate = state->exp_tls_certificate;
927 saved_tls_privatekey = state->exp_tls_privatekey;
928 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
929 saved_tls_crl = state->exp_tls_crl;
930 }
059ec3d9 931
452a164f
JH
932if ((rc = gnutls_certificate_allocate_credentials(&state->x509_cred)))
933 return tls_error_gnu(US"gnutls_certificate_allocate_credentials",
934 rc, host, errstr);
47195144
JH
935
936#ifdef SUPPORT_SRV_OCSP_STACK
937gnutls_certificate_set_flags(state->x509_cred, GNUTLS_CERTIFICATE_API_V2);
938#endif
1365611d 939
17c76198
PP
940/* remember: expand_check_tlsvar() is expand_check() but fiddling with
941state members, assuming consistent naming; and expand_check() returns
942false if expansion failed, unless expansion was forced to fail. */
059ec3d9 943
17c76198
PP
944/* check if we at least have a certificate, before doing expensive
945D-H generation. */
059ec3d9 946
cf0c6164 947if (!expand_check_tlsvar(tls_certificate, errstr))
17c76198 948 return DEFER;
059ec3d9 949
17c76198 950/* certificate is mandatory in server, optional in client */
059ec3d9 951
23bb6982
JH
952if ( !state->exp_tls_certificate
953 || !*state->exp_tls_certificate
954 )
2b4a568d 955 if (!host)
cf0c6164 956 return tls_install_selfsign(state, errstr);
17c76198
PP
957 else
958 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
059ec3d9 959
cf0c6164 960if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey, errstr))
059ec3d9
PH
961 return DEFER;
962
17c76198
PP
963/* tls_privatekey is optional, defaulting to same file as certificate */
964
965if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
059ec3d9 966 {
17c76198
PP
967 state->tls_privatekey = state->tls_certificate;
968 state->exp_tls_privatekey = state->exp_tls_certificate;
059ec3d9 969 }
c91535f3 970
059ec3d9 971
17c76198 972if (state->exp_tls_certificate && *state->exp_tls_certificate)
059ec3d9
PH
973 {
974 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
17c76198
PP
975 state->exp_tls_certificate, state->exp_tls_privatekey);
976
977 if (state->received_sni)
23bb6982
JH
978 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
979 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
980 )
17c76198 981 {
b34fc30c 982 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
17c76198
PP
983 }
984 else
985 {
b34fc30c 986 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
17c76198 987 }
059ec3d9 988
ba86e143
JH
989 if (!host) /* server */
990 {
991 const uschar * clist = state->exp_tls_certificate;
992 const uschar * klist = state->exp_tls_privatekey;
47195144
JH
993 const uschar * olist;
994 int csep = 0, ksep = 0, osep = 0, cnt = 0;
995 uschar * cfile, * kfile, * ofile;
996
997#ifndef DISABLE_OCSP
998 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file", &ofile, errstr))
999 return DEFER;
1000 olist = ofile;
1001#endif
ba86e143
JH
1002
1003 while (cfile = string_nextinlist(&clist, &csep, NULL, 0))
47195144 1004
ba86e143
JH
1005 if (!(kfile = string_nextinlist(&klist, &ksep, NULL, 0)))
1006 return tls_error(US"cert/key setup: out of keys", NULL, host, errstr);
47195144 1007 else if (0 < (rc = tls_add_certfile(state, host, cfile, kfile, errstr)))
ba86e143
JH
1008 return rc;
1009 else
47195144
JH
1010 {
1011 int gnutls_cert_index = -rc;
ba86e143 1012 DEBUG(D_tls) debug_printf("TLS: cert/key %s registered\n", cfile);
47195144
JH
1013
1014 /* Set the OCSP stapling server info */
1015
1016#ifndef DISABLE_OCSP
1017 if (tls_ocsp_file)
1018 if (gnutls_buggy_ocsp)
1019 {
1020 DEBUG(D_tls)
1021 debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
1022 }
1023 else if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1024 {
1025 /* Use the full callback method for stapling just to get
1026 observability. More efficient would be to read the file once only,
1027 if it never changed (due to SNI). Would need restart on file update,
1028 or watch datestamp. */
1029
1030# ifdef SUPPORT_SRV_OCSP_STACK
452a164f
JH
1031 if ((rc = gnutls_certificate_set_ocsp_status_request_function2(
1032 state->x509_cred, gnutls_cert_index,
1033 server_ocsp_stapling_cb, ofile)))
1034 return tls_error_gnu(
1035 US"gnutls_certificate_set_ocsp_status_request_function2",
1036 rc, host, errstr);
47195144
JH
1037# else
1038 if (cnt++ > 0)
1039 {
1040 DEBUG(D_tls)
1041 debug_printf("oops; multiple OCSP files not supported\n");
1042 break;
1043 }
1044 gnutls_certificate_set_ocsp_status_request_function(
1045 state->x509_cred, server_ocsp_stapling_cb, ofile);
1046# endif
1047
1048 DEBUG(D_tls) debug_printf("OCSP response file = %s\n", ofile);
1049 }
1050 else
1051 DEBUG(D_tls) debug_printf("ran out of OCSP response files in list\n");
1052#endif
1053 }
ba86e143
JH
1054 }
1055 else
1056 {
47195144 1057 if (0 < (rc = tls_add_certfile(state, host,
ba86e143
JH
1058 state->exp_tls_certificate, state->exp_tls_privatekey, errstr)))
1059 return rc;
1060 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
1061 }
1062
b34fc30c 1063 } /* tls_certificate */
059ec3d9 1064
2b4a568d 1065
059ec3d9
PH
1066/* Set the trusted CAs file if one is provided, and then add the CRL if one is
1067provided. Experiment shows that, if the certificate file is empty, an unhelpful
1068error message is provided. However, if we just refrain from setting anything up
1069in that case, certificate verification fails, which seems to be the correct
1070behaviour. */
1071
610ff438 1072if (state->tls_verify_certificates && *state->tls_verify_certificates)
059ec3d9 1073 {
cf0c6164 1074 if (!expand_check_tlsvar(tls_verify_certificates, errstr))
059ec3d9 1075 return DEFER;
610ff438
JH
1076#ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1077 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1078 state->exp_tls_verify_certificates = NULL;
1079#endif
17c76198 1080 if (state->tls_crl && *state->tls_crl)
cf0c6164 1081 if (!expand_check_tlsvar(tls_crl, errstr))
17c76198 1082 return DEFER;
059ec3d9 1083
1365611d
PP
1084 if (!(state->exp_tls_verify_certificates &&
1085 *state->exp_tls_verify_certificates))
b34fc30c
PP
1086 {
1087 DEBUG(D_tls)
1365611d
PP
1088 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
1089 /* With no tls_verify_certificates, we ignore tls_crl too */
17c76198 1090 return OK;
b34fc30c 1091 }
1365611d 1092 }
83e2f8a2
PP
1093else
1094 {
1095 DEBUG(D_tls)
1096 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
1097 return OK;
1098 }
17c76198 1099
cb1d7830
JH
1100#ifdef SUPPORT_SYSDEFAULT_CABUNDLE
1101if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1102 cert_count = gnutls_certificate_set_x509_system_trust(state->x509_cred);
1103else
1104#endif
1365611d 1105 {
cb1d7830
JH
1106 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
1107 {
1108 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
1109 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
1110 strerror(errno));
1111 return DEFER;
1112 }
17c76198 1113
a7fec7a7 1114#ifndef SUPPORT_CA_DIR
cb1d7830
JH
1115 /* The test suite passes in /dev/null; we could check for that path explicitly,
1116 but who knows if someone has some weird FIFO which always dumps some certs, or
1117 other weirdness. The thing we really want to check is that it's not a
1118 directory, since while OpenSSL supports that, GnuTLS does not.
60f914bc 1119 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
cb1d7830
JH
1120 if (S_ISDIR(statbuf.st_mode))
1121 {
1122 DEBUG(D_tls)
1123 debug_printf("verify certificates path is a dir: \"%s\"\n",
1124 state->exp_tls_verify_certificates);
1125 log_write(0, LOG_MAIN|LOG_PANIC,
1126 "tls_verify_certificates \"%s\" is a directory",
1127 state->exp_tls_verify_certificates);
1128 return DEFER;
1129 }
a7fec7a7 1130#endif
059ec3d9 1131
cb1d7830
JH
1132 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
1133 state->exp_tls_verify_certificates, statbuf.st_size);
059ec3d9 1134
cb1d7830
JH
1135 if (statbuf.st_size == 0)
1136 {
1137 DEBUG(D_tls)
1138 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
1139 return OK;
1140 }
059ec3d9 1141
cb1d7830 1142 cert_count =
a7fec7a7
JH
1143
1144#ifdef SUPPORT_CA_DIR
cb1d7830
JH
1145 (statbuf.st_mode & S_IFMT) == S_IFDIR
1146 ?
1147 gnutls_certificate_set_x509_trust_dir(state->x509_cred,
1148 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM)
1149 :
a7fec7a7 1150#endif
cb1d7830
JH
1151 gnutls_certificate_set_x509_trust_file(state->x509_cred,
1152 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
1153 }
a7fec7a7 1154
1365611d 1155if (cert_count < 0)
452a164f
JH
1156 return tls_error_gnu(US"setting certificate trust", cert_count, host, errstr);
1157DEBUG(D_tls)
1158 debug_printf("Added %d certificate authorities.\n", cert_count);
059ec3d9 1159
5c8cda3a
PP
1160if (state->tls_crl && *state->tls_crl &&
1161 state->exp_tls_crl && *state->exp_tls_crl)
1365611d 1162 {
5c8cda3a 1163 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
452a164f
JH
1164 if ((cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
1165 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM)) < 0)
1166 return tls_error_gnu(US"gnutls_certificate_set_x509_crl_file",
1167 cert_count, host, errstr);
1168
5c8cda3a 1169 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1365611d 1170 }
059ec3d9 1171
059ec3d9
PH
1172return OK;
1173}
1174
1175
1176
1177
1178/*************************************************
1365611d
PP
1179* Set X.509 state variables *
1180*************************************************/
1181
1182/* In GnuTLS, the registered cert/key are not replaced by a later
1183set of a cert/key, so for SNI support we need a whole new x509_cred
1184structure. Which means various other non-re-expanded pieces of state
1185need to be re-set in the new struct, so the setting logic is pulled
1186out to this.
1187
1188Arguments:
1189 state exim_gnutls_state_st *
cf0c6164 1190 errstr error string pointer
1365611d
PP
1191
1192Returns: OK/DEFER/FAIL
1193*/
1194
1195static int
cf0c6164 1196tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr)
1365611d
PP
1197{
1198int rc;
1199const host_item *host = state->host; /* macro should be reconsidered? */
1200
1201/* Create D-H parameters, or read them from the cache file. This function does
1202its own SMTP error messaging. This only happens for the server, TLS D-H ignores
1203client-side params. */
1204
1205if (!state->host)
1206 {
1207 if (!dh_server_params)
452a164f 1208 if ((rc = init_server_dh(errstr)) != OK) return rc;
1365611d
PP
1209 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
1210 }
1211
1212/* Link the credentials to the session. */
1213
452a164f
JH
1214if ((rc = gnutls_credentials_set(state->session,
1215 GNUTLS_CRD_CERTIFICATE, state->x509_cred)))
1216 return tls_error_gnu(US"gnutls_credentials_set", rc, host, errstr);
1365611d
PP
1217
1218return OK;
1219}
1220
1221/*************************************************
17c76198 1222* Initialize for GnuTLS *
059ec3d9
PH
1223*************************************************/
1224
9196d5bf 1225
4fb7df6d
JH
1226#ifndef DISABLE_OCSP
1227
9196d5bf
JH
1228static BOOL
1229tls_is_buggy_ocsp(void)
1230{
1231const uschar * s;
1232uschar maj, mid, mic;
1233
1234s = CUS gnutls_check_version(NULL);
1235maj = atoi(CCS s);
1236if (maj == 3)
1237 {
1238 while (*s && *s != '.') s++;
1239 mid = atoi(CCS ++s);
1240 if (mid <= 2)
1241 return TRUE;
1242 else if (mid >= 5)
1243 return FALSE;
1244 else
1245 {
1246 while (*s && *s != '.') s++;
1247 mic = atoi(CCS ++s);
1248 return mic <= (mid == 3 ? 16 : 3);
1249 }
1250 }
1251return FALSE;
1252}
1253
4fb7df6d 1254#endif
9196d5bf
JH
1255
1256
17c76198
PP
1257/* Called from both server and client code. In the case of a server, errors
1258before actual TLS negotiation return DEFER.
059ec3d9
PH
1259
1260Arguments:
17c76198
PP
1261 host connected host, if client; NULL if server
1262 certificate certificate file
1263 privatekey private key file
1264 sni TLS SNI to send, sometimes when client; else NULL
1265 cas CA certs file
1266 crl CRL file
1267 require_ciphers tls_require_ciphers setting
817d9f57 1268 caller_state returned state-info structure
cf0c6164 1269 errstr error string pointer
059ec3d9 1270
17c76198 1271Returns: OK/DEFER/FAIL
059ec3d9
PH
1272*/
1273
17c76198
PP
1274static int
1275tls_init(
1276 const host_item *host,
1277 const uschar *certificate,
1278 const uschar *privatekey,
1279 const uschar *sni,
1280 const uschar *cas,
1281 const uschar *crl,
1282 const uschar *require_ciphers,
cf0c6164 1283 exim_gnutls_state_st **caller_state,
74f1a423 1284 tls_support * tlsp,
cf0c6164 1285 uschar ** errstr)
059ec3d9 1286{
00c0dd4e 1287exim_gnutls_state_st * state;
17c76198
PP
1288int rc;
1289size_t sz;
00c0dd4e
JH
1290const char * errpos;
1291const uschar * p;
17c76198
PP
1292
1293if (!exim_gnutls_base_init_done)
059ec3d9 1294 {
17c76198
PP
1295 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1296
a5f239e4
PP
1297#ifdef HAVE_GNUTLS_PKCS11
1298 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1299 which loads modules from a config file, which sounds good and may be wanted
1300 by some sysadmin, but also means in common configurations that GNOME keyring
1301 environment variables are used and so breaks for users calling mailq.
1302 To prevent this, we init PKCS11 first, which is the documented approach. */
2519e60d 1303 if (!gnutls_allow_auto_pkcs11)
452a164f
JH
1304 if ((rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL)))
1305 return tls_error_gnu(US"gnutls_pkcs11_init", rc, host, errstr);
a5f239e4
PP
1306#endif
1307
452a164f
JH
1308 if ((rc = gnutls_global_init()))
1309 return tls_error_gnu(US"gnutls_global_init", rc, host, errstr);
17c76198
PP
1310
1311#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1312 DEBUG(D_tls)
059ec3d9 1313 {
17c76198 1314 gnutls_global_set_log_function(exim_gnutls_logger_cb);
aded2255 1315 /* arbitrarily chosen level; bump up to 9 for more */
17c76198 1316 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
059ec3d9 1317 }
17c76198
PP
1318#endif
1319
4fb7df6d
JH
1320#ifndef DISABLE_OCSP
1321 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
9196d5bf 1322 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
4fb7df6d 1323#endif
9196d5bf 1324
17c76198 1325 exim_gnutls_base_init_done = TRUE;
059ec3d9 1326 }
059ec3d9 1327
17c76198
PP
1328if (host)
1329 {
74f1a423
JH
1330 /* For client-side sessions we allocate a context. This lets us run
1331 several in parallel. */
1332 int old_pool = store_pool;
1333 store_pool = POOL_PERM;
1334 state = store_get(sizeof(exim_gnutls_state_st));
1335 store_pool = old_pool;
1336
17c76198 1337 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
74f1a423 1338 state->tlsp = tlsp;
17c76198
PP
1339 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1340 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1341 }
1342else
1343 {
1344 state = &state_server;
1345 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
74f1a423 1346 state->tlsp = tlsp;
17c76198
PP
1347 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1348 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1349 }
452a164f
JH
1350if (rc)
1351 return tls_error_gnu(US"gnutls_init", rc, host, errstr);
059ec3d9 1352
17c76198 1353state->host = host;
059ec3d9 1354
17c76198
PP
1355state->tls_certificate = certificate;
1356state->tls_privatekey = privatekey;
5779e6aa 1357state->tls_require_ciphers = require_ciphers;
17c76198
PP
1358state->tls_sni = sni;
1359state->tls_verify_certificates = cas;
1360state->tls_crl = crl;
059ec3d9 1361
17c76198
PP
1362/* This handles the variables that might get re-expanded after TLS SNI;
1363that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
059ec3d9 1364
17c76198
PP
1365DEBUG(D_tls)
1366 debug_printf("Expanding various TLS configuration options for session credentials.\n");
cf0c6164 1367if ((rc = tls_expand_session_files(state, errstr)) != OK) return rc;
059ec3d9 1368
1365611d
PP
1369/* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1370requires a new structure afterwards. */
83da1223 1371
cf0c6164 1372if ((rc = tls_set_remaining_x509(state, errstr)) != OK) return rc;
83da1223 1373
17c76198
PP
1374/* set SNI in client, only */
1375if (host)
1376 {
cf0c6164 1377 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni, errstr))
17c76198 1378 return DEFER;
0df4ab80 1379 if (state->tlsp->sni && *state->tlsp->sni)
17c76198
PP
1380 {
1381 DEBUG(D_tls)
0df4ab80
JH
1382 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1383 sz = Ustrlen(state->tlsp->sni);
452a164f
JH
1384 if ((rc = gnutls_server_name_set(state->session,
1385 GNUTLS_NAME_DNS, state->tlsp->sni, sz)))
1386 return tls_error_gnu(US"gnutls_server_name_set", rc, host, errstr);
17c76198
PP
1387 }
1388 }
1389else if (state->tls_sni)
1390 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
ba86e143 1391 "have an SNI set for a server [%s]\n", state->tls_sni);
83da1223 1392
17c76198 1393/* This is the priority string support,
42bfef1e 1394http://www.gnutls.org/manual/html_node/Priority-Strings.html
17c76198
PP
1395and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1396This was backwards incompatible, but means Exim no longer needs to track
1397all algorithms and provide string forms for them. */
83da1223 1398
fc243e94 1399p = NULL;
17c76198 1400if (state->tls_require_ciphers && *state->tls_require_ciphers)
83da1223 1401 {
cf0c6164 1402 if (!expand_check_tlsvar(tls_require_ciphers, errstr))
17c76198
PP
1403 return DEFER;
1404 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
83da1223 1405 {
17c76198 1406 p = state->exp_tls_require_ciphers;
fc243e94 1407 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n", p);
83da1223
PH
1408 }
1409 }
fc243e94 1410if (!p)
17c76198 1411 {
fc243e94 1412 p = exim_default_gnutls_priority;
83e2f8a2 1413 DEBUG(D_tls)
fc243e94 1414 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n", p);
17c76198 1415 }
83da1223 1416
452a164f
JH
1417if ((rc = gnutls_priority_init(&state->priority_cache, CCS p, &errpos)))
1418 return tls_error_gnu(string_sprintf(
1419 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1420 p, errpos - CS p, errpos),
1421 rc, host, errstr);
17c76198 1422
452a164f
JH
1423if ((rc = gnutls_priority_set(state->session, state->priority_cache)))
1424 return tls_error_gnu(US"gnutls_priority_set", rc, host, errstr);
17c76198
PP
1425
1426gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1427
1428/* Reduce security in favour of increased compatibility, if the admin
1429decides to make that trade-off. */
1430if (gnutls_compat_mode)
83da1223 1431 {
17c76198
PP
1432#if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1433 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1434 gnutls_session_enable_compatibility_mode(state->session);
1435#else
1436 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1437#endif
83da1223
PH
1438 }
1439
17c76198 1440*caller_state = state;
17c76198 1441return OK;
83da1223
PH
1442}
1443
1444
1445
83da1223 1446/*************************************************
17c76198 1447* Extract peer information *
059ec3d9
PH
1448*************************************************/
1449
f1be21cf
JH
1450static const uschar *
1451cipher_stdname_kcm(gnutls_kx_algorithm_t kx, gnutls_cipher_algorithm_t cipher,
1452 gnutls_mac_algorithm_t mac)
1453{
1454uschar cs_id[2];
1455gnutls_kx_algorithm_t kx_i;
1456gnutls_cipher_algorithm_t cipher_i;
1457gnutls_mac_algorithm_t mac_i;
1458
1459for (size_t i = 0;
1460 gnutls_cipher_suite_info(i, cs_id, &kx_i, &cipher_i, &mac_i, NULL);
1461 i++)
1462 if (kx_i == kx && cipher_i == cipher && mac_i == mac)
1463 return cipher_stdname(cs_id[0], cs_id[1]);
1464return NULL;
1465}
1466
1467
1468
17c76198 1469/* Called from both server and client code.
4fe99a6c
PP
1470Only this is allowed to set state->peerdn and state->have_set_peerdn
1471and we use that to detect double-calls.
059ec3d9 1472
75fe387d
PP
1473NOTE: the state blocks last while the TLS connection is up, which is fine
1474for logging in the server side, but for the client side, we log after teardown
1475in src/deliver.c. While the session is up, we can twist about states and
1476repoint tls_* globals, but those variables used for logging or other variable
1477expansion that happens _after_ delivery need to have a longer life-time.
1478
1479So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1480doing this more than once per generation of a state context. We set them in
1481the state context, and repoint tls_* to them. After the state goes away, the
1482tls_* copies of the pointers remain valid and client delivery logging is happy.
1483
1484tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1485don't apply.
1486
059ec3d9 1487Arguments:
17c76198 1488 state exim_gnutls_state_st *
cf0c6164 1489 errstr pointer to error string
059ec3d9 1490
17c76198 1491Returns: OK/DEFER/FAIL
059ec3d9
PH
1492*/
1493
17c76198 1494static int
cf0c6164 1495peer_status(exim_gnutls_state_st *state, uschar ** errstr)
059ec3d9 1496{
27f19eb4 1497const gnutls_datum_t *cert_list;
75fe387d 1498int old_pool, rc;
17c76198 1499unsigned int cert_list_size = 0;
4fe99a6c
PP
1500gnutls_protocol_t protocol;
1501gnutls_cipher_algorithm_t cipher;
1502gnutls_kx_algorithm_t kx;
1503gnutls_mac_algorithm_t mac;
17c76198
PP
1504gnutls_certificate_type_t ct;
1505gnutls_x509_crt_t crt;
d7978c0f 1506uschar *dn_buf;
17c76198 1507size_t sz;
059ec3d9 1508
4fe99a6c 1509if (state->have_set_peerdn)
17c76198 1510 return OK;
4fe99a6c 1511state->have_set_peerdn = TRUE;
059ec3d9 1512
4fe99a6c 1513state->peerdn = NULL;
059ec3d9 1514
4fe99a6c
PP
1515/* tls_cipher */
1516cipher = gnutls_cipher_get(state->session);
1517protocol = gnutls_protocol_get_version(state->session);
1518mac = gnutls_mac_get(state->session);
b9c6f63c
JH
1519kx =
1520#ifdef GNUTLS_TLS1_3
1521 protocol >= GNUTLS_TLS1_3 ? 0 :
1522#endif
1523 gnutls_kx_get(state->session);
4fe99a6c 1524
75fe387d 1525old_pool = store_pool;
f1be21cf
JH
1526 {
1527 store_pool = POOL_PERM;
d9acfc1c
JH
1528
1529#ifdef SUPPORT_GNUTLS_SESS_DESC
1530 {
1531 gstring * g = NULL;
1532 uschar * s = US gnutls_session_get_desc(state->session), c;
1533
1534 /* Nikos M suggests we use this by preference. It returns like:
1535 (TLS1.3)-(ECDHE-SECP256R1)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM)
1536
1537 For partial back-compat, put a colon after the TLS version, replace the
1538 )-( grouping with __, replace in-group - with _ and append the :keysize. */
1539
1540 /* debug_printf("peer_status: gnutls_session_get_desc %s\n", s); */
1541
1542 for (s++; (c = *s) && c != ')'; s++) g = string_catn(g, s, 1);
1543 g = string_catn(g, US":", 1);
1544 if (*s) s++; /* now on _ between groups */
1545 while ((c = *s))
1546 {
1547 for (*++s && ++s; (c = *s) && c != ')'; s++) g = string_catn(g, c == '-' ? US"_" : s, 1);
1548 /* now on ) closing group */
1549 if ((c = *s) && *++s == '-') g = string_catn(g, US"__", 2);
1550 /* now on _ between groups */
1551 }
1552 g = string_catn(g, US":", 1);
1553 g = string_cat(g, string_sprintf("%d", (int) gnutls_cipher_get_key_size(cipher) * 8));
1554 state->ciphersuite = string_from_gstring(g);
1555 }
1556#else
f1be21cf
JH
1557 state->ciphersuite = string_sprintf("%s:%s:%d",
1558 gnutls_protocol_get_name(protocol),
1559 gnutls_cipher_suite_get_name(kx, cipher, mac),
1560 (int) gnutls_cipher_get_key_size(cipher) * 8);
1561
1562 /* I don't see a way that spaces could occur, in the current GnuTLS
1563 code base, but it was a concern in the old code and perhaps older GnuTLS
1564 releases did return "TLS 1.0"; play it safe, just in case. */
1565
1566 for (uschar * p = state->ciphersuite; *p; p++) if (isspace(*p)) *p = '-';
d9acfc1c
JH
1567#endif
1568
1569/* debug_printf("peer_status: ciphersuite %s\n", state->ciphersuite); */
1570
f1be21cf 1571 state->tlsp->cipher = state->ciphersuite;
d9acfc1c 1572 state->tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
f1be21cf
JH
1573
1574 state->tlsp->cipher_stdname = cipher_stdname_kcm(kx, cipher, mac);
1575 }
75fe387d 1576store_pool = old_pool;
4fe99a6c
PP
1577
1578/* tls_peerdn */
17c76198 1579cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
83da1223 1580
f1be21cf 1581if (!cert_list || cert_list_size == 0)
17c76198 1582 {
17c76198
PP
1583 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1584 cert_list, cert_list_size);
e51c7be2 1585 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198 1586 return tls_error(US"certificate verification failed",
48224640 1587 US"no certificate received from peer", state->host, errstr);
17c76198
PP
1588 return OK;
1589 }
059ec3d9 1590
95f52235 1591if ((ct = gnutls_certificate_type_get(state->session)) != GNUTLS_CRT_X509)
059ec3d9 1592 {
95f52235 1593 const uschar * ctn = US gnutls_certificate_type_get_name(ct);
17c76198
PP
1594 DEBUG(D_tls)
1595 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
e51c7be2 1596 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198 1597 return tls_error(US"certificate verification not possible, unhandled type",
cf0c6164 1598 ctn, state->host, errstr);
17c76198 1599 return OK;
83da1223 1600 }
059ec3d9 1601
e51c7be2
JH
1602#define exim_gnutls_peer_err(Label) \
1603 do { \
1604 if (rc != GNUTLS_E_SUCCESS) \
1605 { \
1606 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1607 (Label), gnutls_strerror(rc)); \
1608 if (state->verify_requirement >= VERIFY_REQUIRED) \
452a164f 1609 return tls_error_gnu((Label), rc, state->host, errstr); \
e51c7be2
JH
1610 return OK; \
1611 } \
1612 } while (0)
17c76198 1613
9d1c15ef
JH
1614rc = import_cert(&cert_list[0], &crt);
1615exim_gnutls_peer_err(US"cert 0");
1616
1617state->tlsp->peercert = state->peercert = crt;
17c76198 1618
17c76198
PP
1619sz = 0;
1620rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1621if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
83da1223 1622 {
17c76198
PP
1623 exim_gnutls_peer_err(US"getting size for cert DN failed");
1624 return FAIL; /* should not happen */
059ec3d9 1625 }
17c76198
PP
1626dn_buf = store_get_perm(sz);
1627rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1628exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
9d1c15ef 1629
17c76198
PP
1630state->peerdn = dn_buf;
1631
1632return OK;
1633#undef exim_gnutls_peer_err
1634}
059ec3d9 1635
059ec3d9 1636
059ec3d9 1637
059ec3d9 1638
17c76198
PP
1639/*************************************************
1640* Verify peer certificate *
1641*************************************************/
059ec3d9 1642
17c76198
PP
1643/* Called from both server and client code.
1644*Should* be using a callback registered with
1645gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1646the peer information, but that's too new for some OSes.
059ec3d9 1647
17c76198 1648Arguments:
899b8bbc
JH
1649 state exim_gnutls_state_st *
1650 errstr where to put an error message
059ec3d9 1651
17c76198
PP
1652Returns:
1653 FALSE if the session should be rejected
1654 TRUE if the cert is okay or we just don't care
1655*/
059ec3d9 1656
17c76198 1657static BOOL
28646fa9 1658verify_certificate(exim_gnutls_state_st * state, uschar ** errstr)
17c76198
PP
1659{
1660int rc;
899b8bbc
JH
1661uint verify;
1662
1663if (state->verify_requirement == VERIFY_NONE)
1664 return TRUE;
17c76198 1665
8008accd 1666DEBUG(D_tls) debug_printf("TLS: checking peer certificate\n");
cf0c6164 1667*errstr = NULL;
17c76198 1668
95f52235 1669if ((rc = peer_status(state, errstr)) != OK || !state->peerdn)
e6060e2c 1670 {
17c76198 1671 verify = GNUTLS_CERT_INVALID;
cf0c6164 1672 *errstr = US"certificate not supplied";
17c76198
PP
1673 }
1674else
899b8bbc
JH
1675
1676 {
1677#ifdef SUPPORT_DANE
1678 if (state->verify_requirement == VERIFY_DANE && state->host)
1679 {
1680 /* Using dane_verify_session_crt() would be easy, as it does it all for us
1681 including talking to a DNS resolver. But we want to do that bit ourselves
1682 as the testsuite intercepts and fakes its own DNS environment. */
1683
1684 dane_state_t s;
1685 dane_query_t r;
899b8bbc 1686 uint lsize;
94c13285
JH
1687 const gnutls_datum_t * certlist =
1688 gnutls_certificate_get_peers(state->session, &lsize);
1689 int usage = tls_out.tlsa_usage;
1690
1691# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1692 /* Split the TLSA records into two sets, TA and EE selectors. Run the
1693 dane-verification separately so that we know which selector verified;
570cb1bd 1694 then we know whether to do name-verification (needed for TA but not EE). */
94c13285
JH
1695
1696 if (usage == ((1<<DANESSL_USAGE_DANE_TA) | (1<<DANESSL_USAGE_DANE_EE)))
bd5b3f3c 1697 { /* a mixed-usage bundle */
94c13285
JH
1698 int i, j, nrec;
1699 const char ** dd;
1700 int * ddl;
1701
1702 for(nrec = 0; state->dane_data_len[nrec]; ) nrec++;
1703 nrec++;
1704
1705 dd = store_get(nrec * sizeof(uschar *));
1706 ddl = store_get(nrec * sizeof(int));
1707 nrec--;
1708
1709 if ((rc = dane_state_init(&s, 0)))
1710 goto tlsa_prob;
1711
1712 for (usage = DANESSL_USAGE_DANE_EE;
1713 usage >= DANESSL_USAGE_DANE_TA; usage--)
1714 { /* take records with this usage */
1715 for (j = i = 0; i < nrec; i++)
1716 if (state->dane_data[i][0] == usage)
1717 {
1718 dd[j] = state->dane_data[i];
1719 ddl[j++] = state->dane_data_len[i];
1720 }
1721 if (j)
1722 {
1723 dd[j] = NULL;
1724 ddl[j] = 0;
1725
1726 if ((rc = dane_raw_tlsa(s, &r, (char * const *)dd, ddl, 1, 0)))
1727 goto tlsa_prob;
1728
1729 if ((rc = dane_verify_crt_raw(s, certlist, lsize,
1730 gnutls_certificate_type_get(state->session),
1731 r, 0,
1732 usage == DANESSL_USAGE_DANE_EE
1733 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1734 &verify)))
1735 {
1736 DEBUG(D_tls)
1737 debug_printf("TLSA record problem: %s\n", dane_strerror(rc));
1738 }
1739 else if (verify == 0) /* verification passed */
1740 {
1741 usage = 1 << usage;
1742 break;
1743 }
1744 }
1745 }
899b8bbc 1746
94c13285
JH
1747 if (rc) goto tlsa_prob;
1748 }
1749 else
1750# endif
899b8bbc 1751 {
94c13285
JH
1752 if ( (rc = dane_state_init(&s, 0))
1753 || (rc = dane_raw_tlsa(s, &r, state->dane_data, state->dane_data_len,
1754 1, 0))
1755 || (rc = dane_verify_crt_raw(s, certlist, lsize,
1756 gnutls_certificate_type_get(state->session),
5ec37a55 1757 r, 0,
94c13285
JH
1758# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1759 usage == (1 << DANESSL_USAGE_DANE_EE)
1760 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1761# else
1762 0,
1763# endif
1764 &verify))
1765 )
1766 goto tlsa_prob;
899b8bbc 1767 }
94c13285
JH
1768
1769 if (verify != 0) /* verification failed */
899b8bbc
JH
1770 {
1771 gnutls_datum_t str;
1772 (void) dane_verification_status_print(verify, &str, 0);
1773 *errstr = US str.data; /* don't bother to free */
1774 goto badcert;
1775 }
28646fa9 1776
94c13285
JH
1777# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1778 /* If a TA-mode TLSA record was used for verification we must additionally
570cb1bd 1779 verify the cert name (but not the CA chain). For EE-mode, skip it. */
28646fa9 1780
94c13285
JH
1781 if (usage & (1 << DANESSL_USAGE_DANE_EE))
1782# endif
28646fa9 1783 {
570cb1bd 1784 state->peer_dane_verified = state->peer_cert_verified = TRUE;
28646fa9
JH
1785 goto goodcert;
1786 }
570cb1bd
JH
1787# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1788 /* Assume that the name on the A-record is the one that should be matching
1789 the cert. An alternate view is that the domain part of the email address
1790 is also permissible. */
1791
1792 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert,
1793 CS state->host->name))
1794 {
1795 state->peer_dane_verified = state->peer_cert_verified = TRUE;
1796 goto goodcert;
1797 }
1798# endif
899b8bbc 1799 }
570cb1bd 1800#endif /*SUPPORT_DANE*/
899b8bbc 1801
17c76198 1802 rc = gnutls_certificate_verify_peers2(state->session, &verify);
899b8bbc 1803 }
e6060e2c 1804
899b8bbc 1805/* Handle the result of verification. INVALID is set if any others are. */
059ec3d9 1806
28646fa9 1807if (rc < 0 || verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED))
17c76198
PP
1808 {
1809 state->peer_cert_verified = FALSE;
cf0c6164 1810 if (!*errstr)
184384c3
JH
1811 {
1812#ifdef GNUTLS_CERT_VFY_STATUS_PRINT
1813 DEBUG(D_tls)
1814 {
1815 gnutls_datum_t txt;
1816
1817 if (gnutls_certificate_verification_status_print(verify,
1818 gnutls_certificate_type_get(state->session), &txt, 0)
1819 == GNUTLS_E_SUCCESS)
1820 {
1821 debug_printf("%s\n", txt.data);
1822 gnutls_free(txt.data);
1823 }
1824 }
1825#endif
cf0c6164
JH
1826 *errstr = verify & GNUTLS_CERT_REVOKED
1827 ? US"certificate revoked" : US"certificate invalid";
184384c3 1828 }
059ec3d9 1829
17c76198 1830 DEBUG(D_tls)
e51c7be2 1831 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
cf0c6164 1832 *errstr, state->peerdn ? state->peerdn : US"<unset>");
059ec3d9 1833
e51c7be2 1834 if (state->verify_requirement >= VERIFY_REQUIRED)
899b8bbc 1835 goto badcert;
17c76198 1836 DEBUG(D_tls)
4789da3a 1837 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
17c76198 1838 }
e51c7be2 1839
17c76198
PP
1840else
1841 {
5fd28bb8
JH
1842 /* Client side, check the server's certificate name versus the name on the
1843 A-record for the connection we made. What to do for server side - what name
1844 to use for client? We document that there is no such checking for server
1845 side. */
1846
1847 if ( state->exp_tls_verify_cert_hostnames
1848 && !gnutls_x509_crt_check_hostname(state->tlsp->peercert,
1849 CS state->exp_tls_verify_cert_hostnames)
1850 )
e51c7be2 1851 {
5fd28bb8
JH
1852 DEBUG(D_tls)
1853 debug_printf("TLS certificate verification failed: cert name mismatch\n");
1854 if (state->verify_requirement >= VERIFY_REQUIRED)
1855 goto badcert;
1856 return TRUE;
e51c7be2 1857 }
5fd28bb8 1858
17c76198 1859 state->peer_cert_verified = TRUE;
e51c7be2 1860 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
4fe99a6c 1861 state->peerdn ? state->peerdn : US"<unset>");
17c76198 1862 }
059ec3d9 1863
28646fa9
JH
1864goodcert:
1865 state->tlsp->peerdn = state->peerdn;
1866 return TRUE;
899b8bbc 1867
b83314e3 1868#ifdef SUPPORT_DANE
94c13285 1869tlsa_prob:
624f33df
JH
1870 *errstr = string_sprintf("TLSA record problem: %s",
1871 rc == DANE_E_REQUESTED_DATA_NOT_AVAILABLE ? "none usable" : dane_strerror(rc));
b83314e3
JH
1872#endif
1873
899b8bbc
JH
1874badcert:
1875 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1876 return FALSE;
17c76198 1877}
059ec3d9 1878
17c76198
PP
1879
1880
1881
1882/* ------------------------------------------------------------------------ */
1883/* Callbacks */
1884
1885/* Logging function which can be registered with
1886 * gnutls_global_set_log_function()
1887 * gnutls_global_set_log_level() 0..9
1888 */
af3498d6 1889#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
059ec3d9 1890static void
17c76198 1891exim_gnutls_logger_cb(int level, const char *message)
059ec3d9 1892{
8c79eebf
PP
1893 size_t len = strlen(message);
1894 if (len < 1)
1895 {
1896 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1897 return;
1898 }
1899 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1900 message[len-1] == '\n' ? "" : "\n");
17c76198 1901}
af3498d6 1902#endif
059ec3d9 1903
059ec3d9 1904
17c76198
PP
1905/* Called after client hello, should handle SNI work.
1906This will always set tls_sni (state->received_sni) if available,
1907and may trigger presenting different certificates,
1908if state->trigger_sni_changes is TRUE.
059ec3d9 1909
17c76198
PP
1910Should be registered with
1911 gnutls_handshake_set_post_client_hello_function()
059ec3d9 1912
17c76198
PP
1913"This callback must return 0 on success or a gnutls error code to terminate the
1914handshake.".
059ec3d9 1915
17c76198
PP
1916For inability to get SNI information, we return 0.
1917We only return non-zero if re-setup failed.
817d9f57 1918Only used for server-side TLS.
17c76198 1919*/
44bbabb5 1920
17c76198
PP
1921static int
1922exim_sni_handling_cb(gnutls_session_t session)
1923{
1924char sni_name[MAX_HOST_LEN];
1925size_t data_len = MAX_HOST_LEN;
817d9f57 1926exim_gnutls_state_st *state = &state_server;
17c76198
PP
1927unsigned int sni_type;
1928int rc, old_pool;
cf0c6164 1929uschar * dummy_errstr;
17c76198
PP
1930
1931rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
b34fc30c
PP
1932if (rc != GNUTLS_E_SUCCESS)
1933 {
1934 DEBUG(D_tls) {
1935 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1936 debug_printf("TLS: no SNI presented in handshake.\n");
1937 else
1938 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1939 gnutls_strerror(rc), rc);
cf0c6164 1940 }
b34fc30c
PP
1941 return 0;
1942 }
1943
17c76198
PP
1944if (sni_type != GNUTLS_NAME_DNS)
1945 {
1946 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1947 return 0;
1948 }
44bbabb5 1949
17c76198
PP
1950/* We now have a UTF-8 string in sni_name */
1951old_pool = store_pool;
1952store_pool = POOL_PERM;
1953state->received_sni = string_copyn(US sni_name, data_len);
1954store_pool = old_pool;
1955
1956/* We set this one now so that variable expansions below will work */
817d9f57 1957state->tlsp->sni = state->received_sni;
17c76198
PP
1958
1959DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1960 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1961
1962if (!state->trigger_sni_changes)
1963 return 0;
1964
cf0c6164 1965if ((rc = tls_expand_session_files(state, &dummy_errstr)) != OK)
17c76198
PP
1966 {
1967 /* If the setup of certs/etc failed before handshake, TLS would not have
1968 been offered. The best we can do now is abort. */
1969 return GNUTLS_E_APPLICATION_ERROR_MIN;
1970 }
1971
cf0c6164 1972rc = tls_set_remaining_x509(state, &dummy_errstr);
1365611d
PP
1973if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1974
1975return 0;
059ec3d9
PH
1976}
1977
1978
1979
f2de3a33 1980#ifndef DISABLE_OCSP
44662487
JH
1981
1982static int
1983server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
1984 gnutls_datum_t * ocsp_response)
1985{
1986int ret;
47195144 1987DEBUG(D_tls) debug_printf("OCSP stapling callback: %s\n", US ptr);
44662487 1988
44662487
JH
1989if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
1990 {
1991 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
5903c6ff 1992 CS ptr);
018058b2 1993 tls_in.ocsp = OCSP_NOT_RESP;
44662487
JH
1994 return GNUTLS_E_NO_CERTIFICATE_STATUS;
1995 }
1996
018058b2 1997tls_in.ocsp = OCSP_VFY_NOT_TRIED;
44662487
JH
1998return 0;
1999}
2000
2001#endif
2002
2003
0cbf2b82 2004#ifndef DISABLE_EVENT
a7538db1
JH
2005/*
2006We use this callback to get observability and detail-level control
723fe533
JH
2007for an exim TLS connection (either direction), raising a tls:cert event
2008for each cert in the chain presented by the peer. Any event
a7538db1
JH
2009can deny verification.
2010
2011Return 0 for the handshake to continue or non-zero to terminate.
2012*/
2013
2014static int
723fe533 2015verify_cb(gnutls_session_t session)
a7538db1 2016{
27f19eb4 2017const gnutls_datum_t * cert_list;
a7538db1
JH
2018unsigned int cert_list_size = 0;
2019gnutls_x509_crt_t crt;
2020int rc;
b30275b8 2021uschar * yield;
a7538db1
JH
2022exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
2023
bd5b3f3c 2024if ((cert_list = gnutls_certificate_get_peers(session, &cert_list_size)))
a7538db1
JH
2025 while (cert_list_size--)
2026 {
bd5b3f3c 2027 if ((rc = import_cert(&cert_list[cert_list_size], &crt)) != GNUTLS_E_SUCCESS)
a7538db1
JH
2028 {
2029 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
2030 cert_list_size, gnutls_strerror(rc));
2031 break;
2032 }
2033
2034 state->tlsp->peercert = crt;
b30275b8
JH
2035 if ((yield = event_raise(state->event_action,
2036 US"tls:cert", string_sprintf("%d", cert_list_size))))
a7538db1
JH
2037 {
2038 log_write(0, LOG_MAIN,
b30275b8
JH
2039 "SSL verify denied by event-action: depth=%d: %s",
2040 cert_list_size, yield);
a7538db1
JH
2041 return 1; /* reject */
2042 }
2043 state->tlsp->peercert = NULL;
2044 }
2045
2046return 0;
2047}
2048
2049#endif
44662487
JH
2050
2051
f20cfa4a
JH
2052static gstring *
2053ddump(gnutls_datum_t * d)
2054{
2055gstring * g = string_get((d->size+1) * 2);
2056uschar * s = d->data;
2057for (unsigned i = d->size; i > 0; i--, s++)
2058 {
2059 g = string_catn(g, US "0123456789abcdef" + (*s >> 4), 1);
2060 g = string_catn(g, US "0123456789abcdef" + (*s & 0xf), 1);
2061 }
2062return g;
2063}
17c76198 2064
dc6d1769
JH
2065static void
2066post_handshake_debug(exim_gnutls_state_st * state)
2067{
2068debug_printf("gnutls_handshake was successful\n");
2069#ifdef SUPPORT_GNUTLS_SESS_DESC
2070debug_printf("%s\n", gnutls_session_get_desc(state->session));
2071#endif
2072#ifdef SUPPORT_GNUTLS_KEYLOG
2073if (gnutls_protocol_get_version(state->session) < GNUTLS_TLS1_3)
2074 {
2075 gnutls_datum_t c, s;
2076 gstring * gc, * gs;
2077 /* we only want the client random and the master secret */
2078 gnutls_session_get_random(state->session, &c, &s);
2079 gnutls_session_get_master_secret(state->session, &s);
2080 gc = ddump(&c);
2081 gs = ddump(&s);
2082 debug_printf("CLIENT_RANDOM %.*s %.*s\n", (int)gc->ptr, gc->s, (int)gs->ptr, gs->s);
2083 }
2084else
2085 debug_printf("To get keying info for TLS1.3 is hard:\n"
2086 " set environment variable SSLKEYLOGFILE to a filename writable by uid exim\n"
2087 " add SSLKEYLOGFILE to keep_environment in the exim config\n"
2088 " run exim as root\n"
2089 " if using sudo, add SSLKEYLOGFILE to env_keep in /etc/sudoers\n");
2090#endif
2091}
2092
17c76198
PP
2093/* ------------------------------------------------------------------------ */
2094/* Exported functions */
2095
2096
2097
2098
059ec3d9
PH
2099/*************************************************
2100* Start a TLS session in a server *
2101*************************************************/
2102
2103/* This is called when Exim is running as a server, after having received
2104the STARTTLS command. It must respond to that command, and then negotiate
2105a TLS session.
2106
2107Arguments:
83da1223 2108 require_ciphers list of allowed ciphers or NULL
cf0c6164 2109 errstr pointer to error string
059ec3d9
PH
2110
2111Returns: OK on success
2112 DEFER for errors before the start of the negotiation
4c04137d 2113 FAIL for errors during the negotiation; the server can't
059ec3d9
PH
2114 continue running.
2115*/
2116
2117int
cf0c6164 2118tls_server_start(const uschar * require_ciphers, uschar ** errstr)
059ec3d9
PH
2119{
2120int rc;
cf0c6164 2121exim_gnutls_state_st * state = NULL;
059ec3d9
PH
2122
2123/* Check for previous activation */
74f1a423 2124if (tls_in.active.sock >= 0)
059ec3d9 2125 {
48224640 2126 tls_error(US"STARTTLS received after TLS started", US "", NULL, errstr);
925ac8e4 2127 smtp_printf("554 Already in TLS\r\n", FALSE);
059ec3d9
PH
2128 return FAIL;
2129 }
2130
2131/* Initialize the library. If it fails, it will already have logged the error
2132and sent an SMTP response. */
2133
17c76198 2134DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
059ec3d9 2135
cf0c6164 2136if ((rc = tls_init(NULL, tls_certificate, tls_privatekey,
17c76198 2137 NULL, tls_verify_certificates, tls_crl,
74f1a423 2138 require_ciphers, &state, &tls_in, errstr)) != OK) return rc;
059ec3d9 2139
059ec3d9
PH
2140/* If this is a host for which certificate verification is mandatory or
2141optional, set up appropriately. */
2142
059ec3d9 2143if (verify_check_host(&tls_verify_hosts) == OK)
17c76198 2144 {
e51c7be2
JH
2145 DEBUG(D_tls)
2146 debug_printf("TLS: a client certificate will be required.\n");
17c76198
PP
2147 state->verify_requirement = VERIFY_REQUIRED;
2148 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2149 }
059ec3d9 2150else if (verify_check_host(&tls_try_verify_hosts) == OK)
17c76198 2151 {
e51c7be2
JH
2152 DEBUG(D_tls)
2153 debug_printf("TLS: a client certificate will be requested but not required.\n");
17c76198
PP
2154 state->verify_requirement = VERIFY_OPTIONAL;
2155 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2156 }
2157else
2158 {
e51c7be2
JH
2159 DEBUG(D_tls)
2160 debug_printf("TLS: a client certificate will not be requested.\n");
17c76198
PP
2161 state->verify_requirement = VERIFY_NONE;
2162 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2163 }
059ec3d9 2164
0cbf2b82 2165#ifndef DISABLE_EVENT
723fe533
JH
2166if (event_action)
2167 {
2168 state->event_action = event_action;
2169 gnutls_session_set_ptr(state->session, state);
2170 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2171 }
2172#endif
2173
17c76198
PP
2174/* Register SNI handling; always, even if not in tls_certificate, so that the
2175expansion variable $tls_sni is always available. */
059ec3d9 2176
17c76198
PP
2177gnutls_handshake_set_post_client_hello_function(state->session,
2178 exim_sni_handling_cb);
059ec3d9
PH
2179
2180/* Set context and tell client to go ahead, except in the case of TLS startup
2181on connection, where outputting anything now upsets the clients and tends to
2182make them disconnect. We need to have an explicit fflush() here, to force out
2183the response. Other smtp_printf() calls do not need it, because in non-TLS
2184mode, the fflush() happens when smtp_getc() is called. */
2185
817d9f57 2186if (!state->tlsp->on_connect)
059ec3d9 2187 {
925ac8e4 2188 smtp_printf("220 TLS go ahead\r\n", FALSE);
9d1c15ef 2189 fflush(smtp_out);
059ec3d9
PH
2190 }
2191
2192/* Now negotiate the TLS session. We put our own timer on it, since it seems
8008accd
JH
2193that the GnuTLS library doesn't.
2194From 3.1.0 there is gnutls_handshake_set_timeout() - but it requires you
2195to set (and clear down afterwards) up a pull-timeout callback function that does
2196a select, so we're no better off unless avoiding signals becomes an issue. */
059ec3d9 2197
17c76198 2198gnutls_transport_set_ptr2(state->session,
27f19eb4
JH
2199 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
2200 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
17c76198
PP
2201state->fd_in = fileno(smtp_in);
2202state->fd_out = fileno(smtp_out);
059ec3d9
PH
2203
2204sigalrm_seen = FALSE;
c2a1bba0 2205if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
17c76198 2206do
17c76198 2207 rc = gnutls_handshake(state->session);
157a7880 2208while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
c2a1bba0 2209ALARM_CLR(0);
059ec3d9 2210
17c76198 2211if (rc != GNUTLS_E_SUCCESS)
059ec3d9 2212 {
059ec3d9
PH
2213 /* It seems that, except in the case of a timeout, we have to close the
2214 connection right here; otherwise if the other end is running OpenSSL it hangs
2215 until the server times out. */
2216
60d10ce7 2217 if (sigalrm_seen)
ad7fc6eb 2218 {
48224640 2219 tls_error(US"gnutls_handshake", US"timed out", NULL, errstr);
ad7fc6eb
JH
2220 gnutls_db_remove_session(state->session);
2221 }
60d10ce7 2222 else
059ec3d9 2223 {
452a164f 2224 tls_error_gnu(US"gnutls_handshake", rc, NULL, errstr);
f5d25c2b 2225 (void) gnutls_alert_send_appropriate(state->session, rc);
ad7fc6eb 2226 gnutls_deinit(state->session);
ed62aae3 2227 gnutls_certificate_free_credentials(state->x509_cred);
60d10ce7 2228 millisleep(500);
ad7fc6eb 2229 shutdown(state->fd_out, SHUT_WR);
d7978c0f 2230 for (int i = 1024; fgetc(smtp_in) != EOF && i > 0; ) i--; /* drain skt */
f1e894f3
PH
2231 (void)fclose(smtp_out);
2232 (void)fclose(smtp_in);
60d10ce7 2233 smtp_out = smtp_in = NULL;
059ec3d9
PH
2234 }
2235
2236 return FAIL;
2237 }
2238
dc6d1769 2239DEBUG(D_tls) post_handshake_debug(state);
059ec3d9 2240
17c76198
PP
2241/* Verify after the fact */
2242
899b8bbc 2243if (!verify_certificate(state, errstr))
059ec3d9 2244 {
9d1c15ef 2245 if (state->verify_requirement != VERIFY_OPTIONAL)
17c76198 2246 {
cf0c6164 2247 (void) tls_error(US"certificate verification failed", *errstr, NULL, errstr);
9d1c15ef 2248 return FAIL;
17c76198 2249 }
9d1c15ef
JH
2250 DEBUG(D_tls)
2251 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
cf0c6164 2252 *errstr);
059ec3d9
PH
2253 }
2254
17c76198
PP
2255/* Figure out peer DN, and if authenticated, etc. */
2256
cf0c6164 2257if ((rc = peer_status(state, NULL)) != OK) return rc;
17c76198
PP
2258
2259/* Sets various Exim expansion variables; always safe within server */
2260
9d1c15ef 2261extract_exim_vars_from_tls_state(state);
059ec3d9
PH
2262
2263/* TLS has been set up. Adjust the input functions to read via TLS,
2264and initialize appropriately. */
2265
17c76198 2266state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
059ec3d9
PH
2267
2268receive_getc = tls_getc;
0d81dabc 2269receive_getbuf = tls_getbuf;
584e96c6 2270receive_get_cache = tls_get_cache;
059ec3d9
PH
2271receive_ungetc = tls_ungetc;
2272receive_feof = tls_feof;
2273receive_ferror = tls_ferror;
58eb016e 2274receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 2275
059ec3d9
PH
2276return OK;
2277}
2278
2279
2280
2281
aa2a70ba
JH
2282static void
2283tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
2284 smtp_transport_options_block * ob)
2285{
3fb3231c 2286if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
aa2a70ba 2287 {
4af0d74a 2288 state->exp_tls_verify_cert_hostnames =
8c5d388a 2289#ifdef SUPPORT_I18N
4af0d74a
JH
2290 string_domain_utf8_to_alabel(host->name, NULL);
2291#else
2292 host->name;
2293#endif
aa2a70ba
JH
2294 DEBUG(D_tls)
2295 debug_printf("TLS: server cert verification includes hostname: \"%s\".\n",
2296 state->exp_tls_verify_cert_hostnames);
2297 }
2298}
aa2a70ba
JH
2299
2300
899b8bbc
JH
2301
2302
2303#ifdef SUPPORT_DANE
2304/* Given our list of RRs from the TLSA lookup, build a lookup block in
2305GnuTLS-DANE's preferred format. Hang it on the state str for later
2306use in DANE verification.
2307
2308We point at the dnsa data not copy it, so it must remain valid until
2309after verification is done.*/
2310
3674140c 2311static BOOL
899b8bbc
JH
2312dane_tlsa_load(exim_gnutls_state_st * state, dns_answer * dnsa)
2313{
899b8bbc
JH
2314dns_scan dnss;
2315int i;
2316const char ** dane_data;
2317int * dane_data_len;
2318
d7978c0f
JH
2319i = 1;
2320for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
899b8bbc
JH
2321 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2322 ) if (rr->type == T_TLSA) i++;
2323
2324dane_data = store_get(i * sizeof(uschar *));
2325dane_data_len = store_get(i * sizeof(int));
2326
d7978c0f
JH
2327i = 0;
2328for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
899b8bbc 2329 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
1b76ad22 2330 ) if (rr->type == T_TLSA && rr->size > 3)
899b8bbc
JH
2331 {
2332 const uschar * p = rr->data;
3674140c
JH
2333 uint8_t usage = p[0], sel = p[1], type = p[2];
2334
2335 DEBUG(D_tls)
2336 debug_printf("TLSA: %d %d %d size %d\n", usage, sel, type, rr->size);
2337
94c13285
JH
2338 if ( (usage != DANESSL_USAGE_DANE_TA && usage != DANESSL_USAGE_DANE_EE)
2339 || (sel != 0 && sel != 1)
2340 )
2341 continue;
3674140c
JH
2342 switch(type)
2343 {
2344 case 0: /* Full: cannot check at present */
2345 break;
2346 case 1: if (rr->size != 3 + 256/8) continue; /* sha2-256 */
2347 break;
2348 case 2: if (rr->size != 3 + 512/8) continue; /* sha2-512 */
2349 break;
2350 default: continue;
2351 }
899b8bbc
JH
2352
2353 tls_out.tlsa_usage |= 1<<usage;
48224640 2354 dane_data[i] = CS p;
899b8bbc
JH
2355 dane_data_len[i++] = rr->size;
2356 }
3674140c
JH
2357
2358if (!i) return FALSE;
2359
899b8bbc
JH
2360dane_data[i] = NULL;
2361dane_data_len[i] = 0;
2362
2363state->dane_data = (char * const *)dane_data;
2364state->dane_data_len = dane_data_len;
3674140c 2365return TRUE;
899b8bbc
JH
2366}
2367#endif
2368
2369
2370
059ec3d9
PH
2371/*************************************************
2372* Start a TLS session in a client *
2373*************************************************/
2374
2375/* Called from the smtp transport after STARTTLS has been accepted.
2376
2377Arguments:
c05bdbd6
JH
2378 cctx connection context
2379 conn_args connection details
2380 cookie datum for randomness (not used)
2381 tlsp record details of channel configuration here; must be non-NULL
2382 errstr error string pointer
2383
2384Returns: TRUE for success with TLS session context set in smtp context,
2385 FALSE on error
059ec3d9
PH
2386*/
2387
c05bdbd6
JH
2388BOOL
2389tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
2390 void * cookie ARG_UNUSED,
2391 tls_support * tlsp, uschar ** errstr)
059ec3d9 2392{
c05bdbd6
JH
2393host_item * host = conn_args->host; /* for msgs and option-tests */
2394transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
2395smtp_transport_options_block * ob = tb
afdb5e9c
JH
2396 ? (smtp_transport_options_block *)tb->options_block
2397 : &smtp_transport_option_defaults;
059ec3d9 2398int rc;
899b8bbc 2399exim_gnutls_state_st * state = NULL;
c05bdbd6 2400uschar * cipher_list = NULL;
74f1a423 2401
f2de3a33 2402#ifndef DISABLE_OCSP
5130845b 2403BOOL require_ocsp =
3fb3231c 2404 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
44662487 2405BOOL request_ocsp = require_ocsp ? TRUE
3fb3231c 2406 : verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
2b4a568d 2407#endif
059ec3d9 2408
c05bdbd6 2409DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", cctx->sock);
059ec3d9 2410
5ec37a55 2411#ifdef SUPPORT_DANE
c05bdbd6
JH
2412/* If dane is flagged, have either request or require dane for this host, and
2413a TLSA record found. Therefore, dane verify required. Which implies cert must
2414be requested and supplied, dane verify must pass, and cert verify irrelevant
2415(incl. hostnames), and (caller handled) require_tls */
2416
2417if (conn_args->dane && ob->dane_require_tls_ciphers)
5ec37a55
PP
2418 {
2419 /* not using expand_check_tlsvar because not yet in state */
2420 if (!expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
2421 &cipher_list, errstr))
c05bdbd6 2422 return FALSE;
cf260049
JH
2423 cipher_list = cipher_list && *cipher_list
2424 ? ob->dane_require_tls_ciphers : ob->tls_require_ciphers;
5ec37a55
PP
2425 }
2426#endif
2427
2428if (!cipher_list)
2429 cipher_list = ob->tls_require_ciphers;
2430
74f1a423 2431if (tls_init(host, ob->tls_certificate, ob->tls_privatekey,
65867078 2432 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
74f1a423 2433 cipher_list, &state, tlsp, errstr) != OK)
c05bdbd6 2434 return FALSE;
059ec3d9 2435
54c90be1 2436 {
65867078
JH
2437 int dh_min_bits = ob->tls_dh_min_bits;
2438 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
2439 {
2440 DEBUG(D_tls)
2441 debug_printf("WARNING: tls_dh_min_bits far too low,"
2442 " clamping %d up to %d\n",
2443 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
2444 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
2445 }
54c90be1 2446
65867078
JH
2447 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
2448 " acceptable bits to %d\n",
2449 dh_min_bits);
2450 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
2451 }
83da1223 2452
94431adb 2453/* Stick to the old behaviour for compatibility if tls_verify_certificates is
2b4a568d
JH
2454set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
2455the specified host patterns if one of them is defined */
2456
899b8bbc 2457#ifdef SUPPORT_DANE
c05bdbd6 2458if (conn_args->dane && dane_tlsa_load(state, &conn_args->tlsa_dnsa))
899b8bbc
JH
2459 {
2460 DEBUG(D_tls)
2461 debug_printf("TLS: server certificate DANE required.\n");
2462 state->verify_requirement = VERIFY_DANE;
2463 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
899b8bbc
JH
2464 }
2465else
2466#endif
2467 if ( ( state->exp_tls_verify_certificates
2468 && !ob->tls_verify_hosts
2469 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2470 )
3fb3231c 2471 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
899b8bbc 2472 )
17c76198 2473 {
aa2a70ba 2474 tls_client_setup_hostname_checks(host, state, ob);
aa2a70ba
JH
2475 DEBUG(D_tls)
2476 debug_printf("TLS: server certificate verification required.\n");
2477 state->verify_requirement = VERIFY_REQUIRED;
52f93eed
WB
2478 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2479 }
3fb3231c 2480else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
52f93eed 2481 {
aa2a70ba 2482 tls_client_setup_hostname_checks(host, state, ob);
e51c7be2
JH
2483 DEBUG(D_tls)
2484 debug_printf("TLS: server certificate verification optional.\n");
52f93eed 2485 state->verify_requirement = VERIFY_OPTIONAL;
17c76198
PP
2486 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2487 }
2488else
2489 {
e51c7be2
JH
2490 DEBUG(D_tls)
2491 debug_printf("TLS: server certificate verification not required.\n");
52f93eed
WB
2492 state->verify_requirement = VERIFY_NONE;
2493 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
17c76198 2494 }
059ec3d9 2495
f2de3a33
JH
2496#ifndef DISABLE_OCSP
2497 /* supported since GnuTLS 3.1.3 */
44662487 2498if (request_ocsp)
9d1c15ef
JH
2499 {
2500 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
65867078
JH
2501 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
2502 NULL, 0, NULL)) != OK)
74f1a423 2503 {
452a164f 2504 tls_error_gnu(US"cert-status-req", rc, state->host, errstr);
c05bdbd6 2505 return FALSE;
74f1a423
JH
2506 }
2507 tlsp->ocsp = OCSP_NOT_RESP;
9d1c15ef 2508 }
2b4a568d
JH
2509#endif
2510
0cbf2b82 2511#ifndef DISABLE_EVENT
afdb5e9c 2512if (tb && tb->event_action)
a7538db1 2513 {
774ef2d7 2514 state->event_action = tb->event_action;
a7538db1 2515 gnutls_session_set_ptr(state->session, state);
723fe533 2516 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
a7538db1
JH
2517 }
2518#endif
2519
c05bdbd6
JH
2520gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) cctx->sock);
2521state->fd_in = cctx->sock;
2522state->fd_out = cctx->sock;
059ec3d9 2523
9d1c15ef 2524DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
059ec3d9
PH
2525/* There doesn't seem to be a built-in timeout on connection. */
2526
2527sigalrm_seen = FALSE;
c2a1bba0 2528ALARM(ob->command_timeout);
17c76198 2529do
17c76198 2530 rc = gnutls_handshake(state->session);
f1fed05b 2531while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
c2a1bba0 2532ALARM_CLR(0);
059ec3d9 2533
4fe99a6c 2534if (rc != GNUTLS_E_SUCCESS)
74f1a423 2535 {
60d10ce7
JH
2536 if (sigalrm_seen)
2537 {
2538 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
48224640 2539 tls_error(US"gnutls_handshake", US"timed out", state->host, errstr);
60d10ce7
JH
2540 }
2541 else
452a164f 2542 tls_error_gnu(US"gnutls_handshake", rc, state->host, errstr);
c05bdbd6 2543 return FALSE;
74f1a423 2544 }
4fe99a6c 2545
dc6d1769 2546DEBUG(D_tls) post_handshake_debug(state);
059ec3d9 2547
17c76198 2548/* Verify late */
059ec3d9 2549
899b8bbc 2550if (!verify_certificate(state, errstr))
74f1a423
JH
2551 {
2552 tls_error(US"certificate verification failed", *errstr, state->host, errstr);
c05bdbd6 2553 return FALSE;
74f1a423 2554 }
059ec3d9 2555
f2de3a33 2556#ifndef DISABLE_OCSP
2b4a568d
JH
2557if (require_ocsp)
2558 {
2559 DEBUG(D_tls)
2560 {
2561 gnutls_datum_t stapling;
2562 gnutls_ocsp_resp_t resp;
2563 gnutls_datum_t printed;
2564 if ( (rc= gnutls_ocsp_status_request_get(state->session, &stapling)) == 0
2565 && (rc= gnutls_ocsp_resp_init(&resp)) == 0
2566 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
2567 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_FULL, &printed)) == 0
2568 )
2569 {
65867078 2570 debug_printf("%.4096s", printed.data);
2b4a568d
JH
2571 gnutls_free(printed.data);
2572 }
2573 else
452a164f 2574 (void) tls_error_gnu(US"ocsp decode", rc, state->host, errstr);
2b4a568d
JH
2575 }
2576
2b4a568d 2577 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
018058b2 2578 {
74f1a423
JH
2579 tlsp->ocsp = OCSP_FAILED;
2580 tls_error(US"certificate status check failed", NULL, state->host, errstr);
c05bdbd6 2581 return FALSE;
018058b2 2582 }
2b4a568d 2583 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
74f1a423 2584 tlsp->ocsp = OCSP_VFIED;
2b4a568d
JH
2585 }
2586#endif
2587
17c76198 2588/* Figure out peer DN, and if authenticated, etc. */
059ec3d9 2589
74f1a423 2590if (peer_status(state, errstr) != OK)
c05bdbd6 2591 return FALSE;
059ec3d9 2592
4fe99a6c 2593/* Sets various Exim expansion variables; may need to adjust for ACL callouts */
059ec3d9 2594
9d1c15ef 2595extract_exim_vars_from_tls_state(state);
059ec3d9 2596
c05bdbd6
JH
2597cctx->tls_ctx = state;
2598return TRUE;
059ec3d9
PH
2599}
2600
2601
2602
17c76198 2603
059ec3d9 2604/*************************************************
17c76198 2605* Close down a TLS session *
059ec3d9
PH
2606*************************************************/
2607
17c76198
PP
2608/* This is also called from within a delivery subprocess forked from the
2609daemon, to shut down the TLS library, without actually doing a shutdown (which
2610would tamper with the TLS session in the parent process).
059ec3d9 2611
dec766a1 2612Arguments:
74f1a423 2613 ct_ctx client context pointer, or NULL for the one global server context
dec766a1 2614 shutdown 1 if TLS close-alert is to be sent,
afdb5e9c 2615 2 if also response to be waited for
dec766a1 2616
17c76198 2617Returns: nothing
059ec3d9
PH
2618*/
2619
17c76198 2620void
74f1a423 2621tls_close(void * ct_ctx, int shutdown)
059ec3d9 2622{
74f1a423 2623exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
059ec3d9 2624
74f1a423 2625if (!state->tlsp || state->tlsp->active.sock < 0) return; /* TLS was not active */
17c76198
PP
2626
2627if (shutdown)
2628 {
dec766a1
WB
2629 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
2630 shutdown > 1 ? " (with response-wait)" : "");
2631
c2a1bba0 2632 ALARM(2);
dec766a1 2633 gnutls_bye(state->session, shutdown > 1 ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR);
c2a1bba0 2634 ALARM_CLR(0);
17c76198
PP
2635 }
2636
2637gnutls_deinit(state->session);
ed62aae3
HSHR
2638gnutls_certificate_free_credentials(state->x509_cred);
2639
17c76198 2640
74f1a423
JH
2641state->tlsp->active.sock = -1;
2642state->tlsp->active.tls_ctx = NULL;
b808677c 2643if (state->xfer_buffer) store_free(state->xfer_buffer);
17c76198 2644memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
059ec3d9
PH
2645}
2646
2647
2648
17c76198 2649
0d81dabc
JH
2650static BOOL
2651tls_refill(unsigned lim)
2652{
2653exim_gnutls_state_st * state = &state_server;
2654ssize_t inbytes;
2655
2656DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
2657 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
2658
f1fed05b 2659sigalrm_seen = FALSE;
c2a1bba0 2660if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
4896a319
AM
2661
2662do
2663 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
2664 MIN(ssl_xfer_buffer_size, lim));
2665while (inbytes == GNUTLS_E_AGAIN);
2666
c2a1bba0 2667if (smtp_receive_timeout > 0) ALARM_CLR(0);
9723f966
JH
2668
2669if (had_command_timeout) /* set by signal handler */
2670 smtp_command_timeout_exit(); /* does not return */
2671if (had_command_sigterm)
2672 smtp_command_sigterm_exit();
2673if (had_data_timeout)
2674 smtp_data_timeout_exit();
2675if (had_data_sigint)
2676 smtp_data_sigint_exit();
2677
2678/* Timeouts do not get this far. A zero-byte return appears to mean that the
2679TLS session has been closed down, not that the socket itself has been closed
2680down. Revert to non-TLS handling. */
0d81dabc
JH
2681
2682if (sigalrm_seen)
2683 {
2684 DEBUG(D_tls) debug_printf("Got tls read timeout\n");
8b77d27a 2685 state->xfer_error = TRUE;
0d81dabc
JH
2686 return FALSE;
2687 }
2688
2689else if (inbytes == 0)
2690 {
2691 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2692
2693 receive_getc = smtp_getc;
2694 receive_getbuf = smtp_getbuf;
2695 receive_get_cache = smtp_get_cache;
2696 receive_ungetc = smtp_ungetc;
2697 receive_feof = smtp_feof;
2698 receive_ferror = smtp_ferror;
2699 receive_smtp_buffered = smtp_buffered;
2700
2701 gnutls_deinit(state->session);
2702 gnutls_certificate_free_credentials(state->x509_cred);
2703
2704 state->session = NULL;
74f1a423
JH
2705 state->tlsp->active.sock = -1;
2706 state->tlsp->active.tls_ctx = NULL;
0d81dabc
JH
2707 state->tlsp->bits = 0;
2708 state->tlsp->certificate_verified = FALSE;
2709 tls_channelbinding_b64 = NULL;
2710 state->tlsp->cipher = NULL;
2711 state->tlsp->peercert = NULL;
2712 state->tlsp->peerdn = NULL;
2713
2714 return FALSE;
2715 }
2716
2717/* Handle genuine errors */
2718
2719else if (inbytes < 0)
2720 {
95f52235 2721 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
0d81dabc 2722 record_io_error(state, (int) inbytes, US"recv", NULL);
8b77d27a 2723 state->xfer_error = TRUE;
0d81dabc
JH
2724 return FALSE;
2725 }
2726#ifndef DISABLE_DKIM
2727dkim_exim_verify_feed(state->xfer_buffer, inbytes);
2728#endif
2729state->xfer_buffer_hwm = (int) inbytes;
2730state->xfer_buffer_lwm = 0;
2731return TRUE;
2732}
2733
059ec3d9
PH
2734/*************************************************
2735* TLS version of getc *
2736*************************************************/
2737
2738/* This gets the next byte from the TLS input buffer. If the buffer is empty,
2739it refills the buffer via the GnuTLS reading function.
817d9f57 2740Only used by the server-side TLS.
059ec3d9 2741
17c76198
PP
2742This feeds DKIM and should be used for all message-body reads.
2743
aded2255 2744Arguments: lim Maximum amount to read/buffer
059ec3d9
PH
2745Returns: the next character or EOF
2746*/
2747
2748int
bd8fbe36 2749tls_getc(unsigned lim)
059ec3d9 2750{
0d81dabc 2751exim_gnutls_state_st * state = &state_server;
059ec3d9 2752
0d81dabc
JH
2753if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
2754 if (!tls_refill(lim))
2755 return state->xfer_error ? EOF : smtp_getc(lim);
ed62aae3 2756
0d81dabc 2757/* Something in the buffer; return next uschar */
059ec3d9 2758
0d81dabc
JH
2759return state->xfer_buffer[state->xfer_buffer_lwm++];
2760}
059ec3d9 2761
0d81dabc
JH
2762uschar *
2763tls_getbuf(unsigned * len)
2764{
2765exim_gnutls_state_st * state = &state_server;
2766unsigned size;
2767uschar * buf;
059ec3d9 2768
0d81dabc
JH
2769if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
2770 if (!tls_refill(*len))
059ec3d9 2771 {
0d81dabc
JH
2772 if (!state->xfer_error) return smtp_getbuf(len);
2773 *len = 0;
2774 return NULL;
059ec3d9 2775 }
059ec3d9 2776
0d81dabc
JH
2777if ((size = state->xfer_buffer_hwm - state->xfer_buffer_lwm) > *len)
2778 size = *len;
2779buf = &state->xfer_buffer[state->xfer_buffer_lwm];
2780state->xfer_buffer_lwm += size;
2781*len = size;
2782return buf;
059ec3d9
PH
2783}
2784
0d81dabc 2785
584e96c6
JH
2786void
2787tls_get_cache()
2788{
9960d1e5 2789#ifndef DISABLE_DKIM
584e96c6
JH
2790exim_gnutls_state_st * state = &state_server;
2791int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
2792if (n > 0)
2793 dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
584e96c6 2794#endif
9960d1e5 2795}
584e96c6 2796
059ec3d9 2797
925ac8e4
JH
2798BOOL
2799tls_could_read(void)
2800{
2801return state_server.xfer_buffer_lwm < state_server.xfer_buffer_hwm
2802 || gnutls_record_check_pending(state_server.session) > 0;
2803}
2804
2805
059ec3d9 2806
17c76198 2807
059ec3d9
PH
2808/*************************************************
2809* Read bytes from TLS channel *
2810*************************************************/
2811
17c76198
PP
2812/* This does not feed DKIM, so if the caller uses this for reading message body,
2813then the caller must feed DKIM.
817d9f57 2814
059ec3d9 2815Arguments:
74f1a423 2816 ct_ctx client context pointer, or NULL for the one global server context
059ec3d9
PH
2817 buff buffer of data
2818 len size of buffer
2819
2820Returns: the number of bytes read
afdb5e9c 2821 -1 after a failed read, including EOF
059ec3d9
PH
2822*/
2823
2824int
74f1a423 2825tls_read(void * ct_ctx, uschar *buff, size_t len)
059ec3d9 2826{
74f1a423 2827exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
17c76198 2828ssize_t inbytes;
059ec3d9 2829
17c76198
PP
2830if (len > INT_MAX)
2831 len = INT_MAX;
059ec3d9 2832
17c76198
PP
2833if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
2834 DEBUG(D_tls)
2835 debug_printf("*** PROBABLY A BUG *** " \
2836 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
2837 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
2838
2839DEBUG(D_tls)
2840 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
2841 state->session, buff, len);
2842
4896a319
AM
2843do
2844 inbytes = gnutls_record_recv(state->session, buff, len);
2845while (inbytes == GNUTLS_E_AGAIN);
2846
059ec3d9
PH
2847if (inbytes > 0) return inbytes;
2848if (inbytes == 0)
2849 {
2850 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2851 }
5fd28bb8 2852else
4896a319 2853 {
95f52235 2854 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
4896a319
AM
2855 record_io_error(state, (int)inbytes, US"recv", NULL);
2856 }
059ec3d9
PH
2857
2858return -1;
2859}
2860
2861
2862
17c76198 2863
059ec3d9
PH
2864/*************************************************
2865* Write bytes down TLS channel *
2866*************************************************/
2867
2868/*
2869Arguments:
74f1a423 2870 ct_ctx client context pointer, or NULL for the one global server context
059ec3d9
PH
2871 buff buffer of data
2872 len number of bytes
925ac8e4 2873 more more data expected soon
059ec3d9
PH
2874
2875Returns: the number of bytes after a successful write,
2876 -1 after a failed write
2877*/
2878
2879int
74f1a423 2880tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
059ec3d9 2881{
17c76198
PP
2882ssize_t outbytes;
2883size_t left = len;
74f1a423 2884exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
925ac8e4
JH
2885#ifdef SUPPORT_CORK
2886static BOOL corked = FALSE;
2887
2888if (more && !corked) gnutls_record_cork(state->session);
2889#endif
2890
2891DEBUG(D_tls) debug_printf("%s(%p, " SIZE_T_FMT "%s)\n", __FUNCTION__,
2892 buff, left, more ? ", more" : "");
059ec3d9 2893
059ec3d9
PH
2894while (left > 0)
2895 {
17c76198
PP
2896 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
2897 buff, left);
4896a319
AM
2898
2899 do
2900 outbytes = gnutls_record_send(state->session, buff, left);
2901 while (outbytes == GNUTLS_E_AGAIN);
059ec3d9 2902
17c76198 2903 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
059ec3d9
PH
2904 if (outbytes < 0)
2905 {
1b76ad22 2906 DEBUG(D_tls) debug_printf("%s: gnutls_record_send err\n", __FUNCTION__);
17c76198 2907 record_io_error(state, outbytes, US"send", NULL);
059ec3d9
PH
2908 return -1;
2909 }
2910 if (outbytes == 0)
2911 {
17c76198 2912 record_io_error(state, 0, US"send", US"TLS channel closed on write");
059ec3d9
PH
2913 return -1;
2914 }
2915
2916 left -= outbytes;
2917 buff += outbytes;
2918 }
2919
17c76198
PP
2920if (len > INT_MAX)
2921 {
2922 DEBUG(D_tls)
2923 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
2924 len);
2925 len = INT_MAX;
2926 }
2927
925ac8e4
JH
2928#ifdef SUPPORT_CORK
2929if (more != corked)
2930 {
2931 if (!more) (void) gnutls_record_uncork(state->session, 0);
2932 corked = more;
2933 }
2934#endif
2935
17c76198 2936return (int) len;
059ec3d9
PH
2937}
2938
2939
2940
17c76198 2941
059ec3d9 2942/*************************************************
17c76198 2943* Random number generation *
059ec3d9
PH
2944*************************************************/
2945
17c76198
PP
2946/* Pseudo-random number generation. The result is not expected to be
2947cryptographically strong but not so weak that someone will shoot themselves
2948in the foot using it as a nonce in input in some email header scheme or
2949whatever weirdness they'll twist this into. The result should handle fork()
2950and avoid repeating sequences. OpenSSL handles that for us.
059ec3d9 2951
17c76198
PP
2952Arguments:
2953 max range maximum
2954Returns a random number in range [0, max-1]
059ec3d9
PH
2955*/
2956
af3498d6 2957#ifdef HAVE_GNUTLS_RND
17c76198
PP
2958int
2959vaguely_random_number(int max)
059ec3d9 2960{
17c76198
PP
2961unsigned int r;
2962int i, needed_len;
17c76198
PP
2963uschar smallbuf[sizeof(r)];
2964
2965if (max <= 1)
2966 return 0;
2967
2968needed_len = sizeof(r);
2969/* Don't take 8 times more entropy than needed if int is 8 octets and we were
d7978c0f
JH
2970asked for a number less than 10. */
2971
17c76198
PP
2972for (r = max, i = 0; r; ++i)
2973 r >>= 1;
2974i = (i + 7) / 8;
2975if (i < needed_len)
2976 needed_len = i;
2977
2978i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
2979if (i < 0)
059ec3d9 2980 {
17c76198
PP
2981 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
2982 return vaguely_random_number_fallback(max);
2983 }
2984r = 0;
d7978c0f
JH
2985for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
2986 r = r * 256 + *p;
059ec3d9 2987
17c76198
PP
2988/* We don't particularly care about weighted results; if someone wants
2989 * smooth distribution and cares enough then they should submit a patch then. */
2990return r % max;
059ec3d9 2991}
af3498d6
PP
2992#else /* HAVE_GNUTLS_RND */
2993int
2994vaguely_random_number(int max)
2995{
2996 return vaguely_random_number_fallback(max);
2997}
2998#endif /* HAVE_GNUTLS_RND */
059ec3d9 2999
36f12725
NM
3000
3001
3002
3003/*************************************************
3375e053
PP
3004* Let tls_require_ciphers be checked at startup *
3005*************************************************/
3006
3007/* The tls_require_ciphers option, if set, must be something which the
3008library can parse.
3009
3010Returns: NULL on success, or error message
3011*/
3012
3013uschar *
3014tls_validate_require_cipher(void)
3015{
3016int rc;
3017uschar *expciphers = NULL;
3018gnutls_priority_t priority_cache;
3019const char *errpos;
cf0c6164 3020uschar * dummy_errstr;
3375e053
PP
3021
3022#define validate_check_rc(Label) do { \
3023 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
3024 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
3025#define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
3026
3027if (exim_gnutls_base_init_done)
3028 log_write(0, LOG_MAIN|LOG_PANIC,
3029 "already initialised GnuTLS, Exim developer bug");
3030
a5f239e4 3031#ifdef HAVE_GNUTLS_PKCS11
2519e60d 3032if (!gnutls_allow_auto_pkcs11)
a5f239e4
PP
3033 {
3034 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
3035 validate_check_rc(US"gnutls_pkcs11_init");
3036 }
3037#endif
3375e053
PP
3038rc = gnutls_global_init();
3039validate_check_rc(US"gnutls_global_init()");
3040exim_gnutls_base_init_done = TRUE;
3041
3042if (!(tls_require_ciphers && *tls_require_ciphers))
3043 return_deinit(NULL);
3044
cf0c6164
JH
3045if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
3046 &dummy_errstr))
3375e053
PP
3047 return_deinit(US"failed to expand tls_require_ciphers");
3048
3049if (!(expciphers && *expciphers))
3050 return_deinit(NULL);
3051
3052DEBUG(D_tls)
3053 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
3054
3055rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
3056validate_check_rc(string_sprintf(
3057 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
3058 expciphers, errpos - CS expciphers, errpos));
3059
3060#undef return_deinit
3061#undef validate_check_rc
3062gnutls_global_deinit();
3063
3064return NULL;
3065}
3066
3067
3068
3069
3070/*************************************************
36f12725
NM
3071* Report the library versions. *
3072*************************************************/
3073
3074/* See a description in tls-openssl.c for an explanation of why this exists.
3075
3076Arguments: a FILE* to print the results to
3077Returns: nothing
3078*/
3079
3080void
3081tls_version_report(FILE *f)
3082{
754a0503
PP
3083fprintf(f, "Library version: GnuTLS: Compile: %s\n"
3084 " Runtime: %s\n",
3085 LIBGNUTLS_VERSION,
3086 gnutls_check_version(NULL));
36f12725
NM
3087}
3088
2b4a568d
JH
3089/* vi: aw ai sw=2
3090*/
059ec3d9 3091/* End of tls-gnu.c */