Testsuite: fix munging of now-indented date in stdout
[exim.git] / src / src / tls-gnu.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
3386088d 5/* Copyright (c) University of Cambridge 1995 - 2015 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
17c76198 8/* Copyright (c) Phil Pennock 2012 */
059ec3d9 9
17c76198
PP
10/* This file provides TLS/SSL support for Exim using the GnuTLS library,
11one of the available supported implementations. This file is #included into
12tls.c when USE_GNUTLS has been set.
059ec3d9 13
17c76198
PP
14The code herein is a revamp of GnuTLS integration using the current APIs; the
15original tls-gnu.c was based on a patch which was contributed by Nikos
6aa6fc9c 16Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
17c76198 17appropriate.
059ec3d9 18
17c76198
PP
19APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20which is not widely deployed by OS vendors. Will note issues below, which may
21assist in updating the code in the future. Another sources of hints is
22mod_gnutls for Apache (SNI callback registration and handling).
059ec3d9 23
17c76198
PP
24Keeping client and server variables more split than before and is currently
25the norm, in anticipation of TLS in ACL callouts.
059ec3d9 26
17c76198
PP
27I wanted to switch to gnutls_certificate_set_verify_function() so that
28certificate rejection could happen during handshake where it belongs, rather
29than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30(6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
059ec3d9 31
17c76198
PP
32(I wasn't looking for libraries quite that old, when updating to get rid of
33compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34require current GnuTLS, then we'll drop support for the ancient libraries).
35*/
b5aea5e1 36
17c76198
PP
37#include <gnutls/gnutls.h>
38/* needed for cert checks in verification and DN extraction: */
39#include <gnutls/x509.h>
40/* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41#include <gnutls/crypto.h>
a5f239e4
PP
42/* needed to disable PKCS11 autoload unless requested */
43#if GNUTLS_VERSION_NUMBER >= 0x020c00
44# include <gnutls/pkcs11.h>
76075bb5 45# define SUPPORT_PARAM_TO_PK_BITS
a5f239e4 46#endif
7e07527a
JH
47#if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
48# warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
49# define DISABLE_OCSP
50#endif
0cbf2b82 51#if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
774ef2d7 52# warning "GnuTLS library version too old; tls:cert event unsupported"
0cbf2b82 53# define DISABLE_EVENT
a7538db1 54#endif
a7fec7a7
JH
55#if GNUTLS_VERSION_NUMBER >= 0x030306
56# define SUPPORT_CA_DIR
57#else
58# undef SUPPORT_CA_DIR
59#endif
11a04b5a 60#if GNUTLS_VERSION_NUMBER >= 0x030014
cb1d7830
JH
61# define SUPPORT_SYSDEFAULT_CABUNDLE
62#endif
7e07527a 63
f2de3a33 64#ifndef DISABLE_OCSP
2b4a568d
JH
65# include <gnutls/ocsp.h>
66#endif
059ec3d9 67
17c76198 68/* GnuTLS 2 vs 3
059ec3d9 69
17c76198
PP
70GnuTLS 3 only:
71 gnutls_global_set_audit_log_function()
059ec3d9 72
17c76198
PP
73Changes:
74 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
75*/
059ec3d9 76
17c76198 77/* Local static variables for GnuTLS */
059ec3d9 78
17c76198 79/* Values for verify_requirement */
059ec3d9 80
e51c7be2 81enum peer_verify_requirement
aa2a70ba 82 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED };
059ec3d9 83
17c76198
PP
84/* This holds most state for server or client; with this, we can set up an
85outbound TLS-enabled connection in an ACL callout, while not stomping all
86over the TLS variables available for expansion.
059ec3d9 87
17c76198
PP
88Some of these correspond to variables in globals.c; those variables will
89be set to point to content in one of these instances, as appropriate for
90the stage of the process lifetime.
059ec3d9 91
389ca47a 92Not handled here: global tls_channelbinding_b64.
17c76198 93*/
059ec3d9 94
17c76198 95typedef struct exim_gnutls_state {
9d1c15ef 96 gnutls_session_t session;
17c76198 97 gnutls_certificate_credentials_t x509_cred;
9d1c15ef 98 gnutls_priority_t priority_cache;
17c76198 99 enum peer_verify_requirement verify_requirement;
9d1c15ef
JH
100 int fd_in;
101 int fd_out;
102 BOOL peer_cert_verified;
103 BOOL trigger_sni_changes;
104 BOOL have_set_peerdn;
17c76198 105 const struct host_item *host;
9d1c15ef
JH
106 gnutls_x509_crt_t peercert;
107 uschar *peerdn;
108 uschar *ciphersuite;
109 uschar *received_sni;
17c76198
PP
110
111 const uschar *tls_certificate;
112 const uschar *tls_privatekey;
113 const uschar *tls_sni; /* client send only, not received */
114 const uschar *tls_verify_certificates;
115 const uschar *tls_crl;
116 const uschar *tls_require_ciphers;
e51c7be2 117
17c76198
PP
118 uschar *exp_tls_certificate;
119 uschar *exp_tls_privatekey;
17c76198
PP
120 uschar *exp_tls_verify_certificates;
121 uschar *exp_tls_crl;
122 uschar *exp_tls_require_ciphers;
44662487 123 uschar *exp_tls_ocsp_file;
55414b25 124 const uschar *exp_tls_verify_cert_hostnames;
0cbf2b82 125#ifndef DISABLE_EVENT
a7538db1
JH
126 uschar *event_action;
127#endif
17c76198 128
389ca47a 129 tls_support *tlsp; /* set in tls_init() */
817d9f57 130
17c76198
PP
131 uschar *xfer_buffer;
132 int xfer_buffer_lwm;
133 int xfer_buffer_hwm;
134 int xfer_eof;
135 int xfer_error;
17c76198
PP
136} exim_gnutls_state_st;
137
138static const exim_gnutls_state_st exim_gnutls_state_init = {
4fe99a6c 139 NULL, NULL, NULL, VERIFY_NONE, -1, -1, FALSE, FALSE, FALSE,
75fe387d 140 NULL, NULL, NULL, NULL,
17c76198 141 NULL, NULL, NULL, NULL, NULL, NULL,
44662487 142 NULL, NULL, NULL, NULL, NULL, NULL, NULL,
01a4a5c5 143 NULL,
0cbf2b82 144#ifndef DISABLE_EVENT
a7538db1
JH
145 NULL,
146#endif
817d9f57 147 NULL,
17c76198 148 NULL, 0, 0, 0, 0,
17c76198 149};
83da1223 150
17c76198
PP
151/* Not only do we have our own APIs which don't pass around state, assuming
152it's held in globals, GnuTLS doesn't appear to let us register callback data
153for callbacks, or as part of the session, so we have to keep a "this is the
154context we're currently dealing with" pointer and rely upon being
155single-threaded to keep from processing data on an inbound TLS connection while
156talking to another TLS connection for an outbound check. This does mean that
157there's no way for heart-beats to be responded to, for the duration of the
a7538db1
JH
158second connection.
159XXX But see gnutls_session_get_ptr()
160*/
059ec3d9 161
17c76198 162static exim_gnutls_state_st state_server, state_client;
059ec3d9 163
17c76198
PP
164/* dh_params are initialised once within the lifetime of a process using TLS;
165if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
166don't want to repeat this. */
83da1223 167
17c76198 168static gnutls_dh_params_t dh_server_params = NULL;
059ec3d9 169
17c76198 170/* No idea how this value was chosen; preserving it. Default is 3600. */
059ec3d9 171
17c76198 172static const int ssl_session_timeout = 200;
059ec3d9 173
17c76198 174static const char * const exim_default_gnutls_priority = "NORMAL";
83da1223 175
17c76198 176/* Guard library core initialisation */
83da1223 177
17c76198 178static BOOL exim_gnutls_base_init_done = FALSE;
059ec3d9 179
4fb7df6d 180#ifndef DISABLE_OCSP
9196d5bf 181static BOOL gnutls_buggy_ocsp = FALSE;
4fb7df6d 182#endif
9196d5bf 183
059ec3d9 184
17c76198 185/* ------------------------------------------------------------------------ */
17c76198 186/* macros */
83da1223 187
17c76198 188#define MAX_HOST_LEN 255
83da1223 189
17c76198
PP
190/* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
191the library logging; a value less than 0 disables the calls to set up logging
192callbacks. */
2c17bb02 193#ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
a7538db1 194# define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
2c17bb02 195#endif
83da1223 196
2c17bb02 197#ifndef EXIM_CLIENT_DH_MIN_BITS
a7538db1 198# define EXIM_CLIENT_DH_MIN_BITS 1024
2c17bb02 199#endif
83da1223 200
af3498d6
PP
201/* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
202can ask for a bit-strength. Without that, we stick to the constant we had
203before, for now. */
2c17bb02 204#ifndef EXIM_SERVER_DH_BITS_PRE2_12
a7538db1 205# define EXIM_SERVER_DH_BITS_PRE2_12 1024
2c17bb02 206#endif
af3498d6 207
17c76198
PP
208#define exim_gnutls_err_check(Label) do { \
209 if (rc != GNUTLS_E_SUCCESS) { return tls_error((Label), gnutls_strerror(rc), host); } } while (0)
059ec3d9 210
17c76198 211#define expand_check_tlsvar(Varname) expand_check(state->Varname, US #Varname, &state->exp_##Varname)
83da1223 212
17c76198 213#if GNUTLS_VERSION_NUMBER >= 0x020c00
e51c7be2
JH
214# define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
215# define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
216# define HAVE_GNUTLS_RND
2519e60d
TL
217/* The security fix we provide with the gnutls_allow_auto_pkcs11 option
218 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
219 * isn't available sometimes, so this needs to become a conditional
220 * compilation; the sanest way to deal with this being a problem on
221 * older OSes is to block it in the Local/Makefile with this compiler
222 * definition */
e51c7be2
JH
223# ifndef AVOID_GNUTLS_PKCS11
224# define HAVE_GNUTLS_PKCS11
225# endif /* AVOID_GNUTLS_PKCS11 */
17c76198 226#endif
83da1223 227
af3498d6
PP
228
229
230
231/* ------------------------------------------------------------------------ */
232/* Callback declarations */
233
234#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
235static void exim_gnutls_logger_cb(int level, const char *message);
236#endif
237
238static int exim_sni_handling_cb(gnutls_session_t session);
239
f2de3a33 240#ifndef DISABLE_OCSP
44662487
JH
241static int server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
242 gnutls_datum_t * ocsp_response);
243#endif
af3498d6
PP
244
245
246
17c76198
PP
247/* ------------------------------------------------------------------------ */
248/* Static functions */
059ec3d9
PH
249
250/*************************************************
251* Handle TLS error *
252*************************************************/
253
254/* Called from lots of places when errors occur before actually starting to do
255the TLS handshake, that is, while the session is still in clear. Always returns
256DEFER for a server and FAIL for a client so that most calls can use "return
257tls_error(...)" to do this processing and then give an appropriate return. A
258single function is used for both server and client, because it is called from
259some shared functions.
260
261Argument:
262 prefix text to include in the logged error
7199e1ee
TF
263 msg additional error string (may be NULL)
264 usually obtained from gnutls_strerror()
17c76198
PP
265 host NULL if setting up a server;
266 the connected host if setting up a client
059ec3d9
PH
267
268Returns: OK/DEFER/FAIL
269*/
270
271static int
17c76198 272tls_error(const uschar *prefix, const char *msg, const host_item *host)
059ec3d9 273{
17c76198
PP
274if (host)
275 {
c562fd30 276 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection (%s)%s%s",
17c76198
PP
277 host->name, host->address, prefix, msg ? ": " : "", msg ? msg : "");
278 return FAIL;
279 }
280else
059ec3d9 281 {
7199e1ee 282 uschar *conn_info = smtp_get_connection_info();
17c76198 283 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
7199e1ee 284 conn_info += 5;
c562fd30 285 /* I'd like to get separated H= here, but too hard for now */
7199e1ee 286 log_write(0, LOG_MAIN, "TLS error on %s (%s)%s%s",
17c76198 287 conn_info, prefix, msg ? ": " : "", msg ? msg : "");
059ec3d9
PH
288 return DEFER;
289 }
059ec3d9
PH
290}
291
292
293
17c76198 294
059ec3d9 295/*************************************************
17c76198 296* Deal with logging errors during I/O *
059ec3d9
PH
297*************************************************/
298
17c76198 299/* We have to get the identity of the peer from saved data.
059ec3d9 300
17c76198
PP
301Argument:
302 state the current GnuTLS exim state container
303 rc the GnuTLS error code, or 0 if it's a local error
304 when text identifying read or write
305 text local error text when ec is 0
059ec3d9 306
17c76198 307Returns: nothing
059ec3d9
PH
308*/
309
17c76198
PP
310static void
311record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
059ec3d9 312{
17c76198 313const char *msg;
059ec3d9 314
17c76198
PP
315if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
316 msg = CS string_sprintf("%s: %s", US gnutls_strerror(rc),
317 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
318else
319 msg = gnutls_strerror(rc);
059ec3d9 320
17c76198
PP
321tls_error(when, msg, state->host);
322}
059ec3d9 323
059ec3d9 324
059ec3d9 325
059ec3d9 326
17c76198
PP
327/*************************************************
328* Set various Exim expansion vars *
329*************************************************/
059ec3d9 330
e51c7be2
JH
331#define exim_gnutls_cert_err(Label) \
332 do \
333 { \
334 if (rc != GNUTLS_E_SUCCESS) \
335 { \
336 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
337 (Label), gnutls_strerror(rc)); \
338 return rc; \
339 } \
340 } while (0)
9d1c15ef
JH
341
342static int
27f19eb4 343import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
9d1c15ef
JH
344{
345int rc;
346
347rc = gnutls_x509_crt_init(crtp);
348exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
349
350rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
351exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
352
353return rc;
354}
355
356#undef exim_gnutls_cert_err
357
358
17c76198
PP
359/* We set various Exim global variables from the state, once a session has
360been established. With TLS callouts, may need to change this to stack
361variables, or just re-call it with the server state after client callout
362has finished.
059ec3d9 363
9d1c15ef 364Make sure anything set here is unset in tls_getc().
17c76198
PP
365
366Sets:
367 tls_active fd
368 tls_bits strength indicator
369 tls_certificate_verified bool indicator
370 tls_channelbinding_b64 for some SASL mechanisms
371 tls_cipher a string
9d1c15ef 372 tls_peercert pointer to library internal
17c76198
PP
373 tls_peerdn a string
374 tls_sni a (UTF-8) string
9d1c15ef 375 tls_ourcert pointer to library internal
17c76198
PP
376
377Argument:
378 state the relevant exim_gnutls_state_st *
379*/
380
381static void
9d1c15ef 382extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
17c76198 383{
17c76198 384gnutls_cipher_algorithm_t cipher;
17c76198
PP
385#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
386int old_pool;
387int rc;
388gnutls_datum_t channel;
389#endif
9d1c15ef 390tls_support * tlsp = state->tlsp;
17c76198 391
9d1c15ef 392tlsp->active = state->fd_out;
17c76198
PP
393
394cipher = gnutls_cipher_get(state->session);
395/* returns size in "bytes" */
9d1c15ef 396tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
17c76198 397
9d1c15ef 398tlsp->cipher = state->ciphersuite;
17c76198 399
817d9f57 400DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
17c76198 401
9d1c15ef 402tlsp->certificate_verified = state->peer_cert_verified;
059ec3d9 403
17c76198
PP
404/* note that tls_channelbinding_b64 is not saved to the spool file, since it's
405only available for use for authenticators while this TLS session is running. */
406
407tls_channelbinding_b64 = NULL;
408#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
409channel.data = NULL;
410channel.size = 0;
411rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
412if (rc) {
413 DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
414} else {
415 old_pool = store_pool;
416 store_pool = POOL_PERM;
f4d091fb 417 tls_channelbinding_b64 = b64encode(channel.data, (int)channel.size);
17c76198
PP
418 store_pool = old_pool;
419 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
420}
421#endif
422
9d1c15ef
JH
423/* peercert is set in peer_status() */
424tlsp->peerdn = state->peerdn;
425tlsp->sni = state->received_sni;
426
427/* record our certificate */
428 {
27f19eb4 429 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
9d1c15ef
JH
430 gnutls_x509_crt_t crt;
431
432 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
433 }
059ec3d9
PH
434}
435
436
437
17c76198 438
059ec3d9 439/*************************************************
575643cd 440* Setup up DH parameters *
059ec3d9
PH
441*************************************************/
442
575643cd 443/* Generating the D-H parameters may take a long time. They only need to
059ec3d9
PH
444be re-generated every so often, depending on security policy. What we do is to
445keep these parameters in a file in the spool directory. If the file does not
446exist, we generate them. This means that it is easy to cause a regeneration.
447
448The new file is written as a temporary file and renamed, so that an incomplete
449file is never present. If two processes both compute some new parameters, you
450waste a bit of effort, but it doesn't seem worth messing around with locking to
451prevent this.
452
059ec3d9
PH
453Returns: OK/DEFER/FAIL
454*/
455
456static int
17c76198 457init_server_dh(void)
059ec3d9 458{
17c76198
PP
459int fd, rc;
460unsigned int dh_bits;
27f19eb4 461gnutls_datum_t m;
a799883d
PP
462uschar filename_buf[PATH_MAX];
463uschar *filename = NULL;
17c76198 464size_t sz;
a799883d
PP
465uschar *exp_tls_dhparam;
466BOOL use_file_in_spool = FALSE;
467BOOL use_fixed_file = FALSE;
17c76198 468host_item *host = NULL; /* dummy for macros */
059ec3d9 469
17c76198 470DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
059ec3d9 471
17c76198
PP
472rc = gnutls_dh_params_init(&dh_server_params);
473exim_gnutls_err_check(US"gnutls_dh_params_init");
059ec3d9 474
a799883d
PP
475m.data = NULL;
476m.size = 0;
477
478if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam))
479 return DEFER;
480
481if (!exp_tls_dhparam)
482 {
483 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
484 m.data = US std_dh_prime_default();
485 m.size = Ustrlen(m.data);
486 }
487else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
488 use_file_in_spool = TRUE;
489else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
490 {
491 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
492 return OK;
493 }
494else if (exp_tls_dhparam[0] != '/')
495 {
f5d25c2b 496 if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
a799883d
PP
497 return tls_error(US"No standard prime named", CS exp_tls_dhparam, NULL);
498 m.size = Ustrlen(m.data);
499 }
500else
501 {
502 use_fixed_file = TRUE;
503 filename = exp_tls_dhparam;
504 }
505
506if (m.data)
507 {
508 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
509 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
510 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
511 return OK;
512 }
513
af3498d6
PP
514#ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
515/* If you change this constant, also change dh_param_fn_ext so that we can use a
17c76198
PP
516different filename and ensure we have sufficient bits. */
517dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
518if (!dh_bits)
519 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL);
af3498d6 520DEBUG(D_tls)
b34fc30c 521 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
af3498d6
PP
522 dh_bits);
523#else
524dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
525DEBUG(D_tls)
526 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
527 dh_bits);
528#endif
059ec3d9 529
3375e053
PP
530/* Some clients have hard-coded limits. */
531if (dh_bits > tls_dh_max_bits)
532 {
533 DEBUG(D_tls)
534 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
535 tls_dh_max_bits);
536 dh_bits = tls_dh_max_bits;
537 }
538
a799883d
PP
539if (use_file_in_spool)
540 {
541 if (!string_format(filename_buf, sizeof(filename_buf),
542 "%s/gnutls-params-%d", spool_directory, dh_bits))
543 return tls_error(US"overlong filename", NULL, NULL);
544 filename = filename_buf;
545 }
059ec3d9 546
b5aea5e1 547/* Open the cache file for reading and if successful, read it and set up the
575643cd 548parameters. */
059ec3d9 549
f5d25c2b 550if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
059ec3d9 551 {
b5aea5e1 552 struct stat statbuf;
17c76198
PP
553 FILE *fp;
554 int saved_errno;
555
556 if (fstat(fd, &statbuf) < 0) /* EIO */
557 {
558 saved_errno = errno;
559 (void)close(fd);
560 return tls_error(US"TLS cache stat failed", strerror(saved_errno), NULL);
561 }
562 if (!S_ISREG(statbuf.st_mode))
b5aea5e1
PH
563 {
564 (void)close(fd);
17c76198
PP
565 return tls_error(US"TLS cache not a file", NULL, NULL);
566 }
40c90bca 567 if (!(fp = fdopen(fd, "rb")))
17c76198
PP
568 {
569 saved_errno = errno;
570 (void)close(fd);
571 return tls_error(US"fdopen(TLS cache stat fd) failed",
572 strerror(saved_errno), NULL);
b5aea5e1 573 }
059ec3d9 574
b5aea5e1 575 m.size = statbuf.st_size;
40c90bca 576 if (!(m.data = malloc(m.size)))
17c76198
PP
577 {
578 fclose(fp);
579 return tls_error(US"malloc failed", strerror(errno), NULL);
580 }
40c90bca 581 if (!(sz = fread(m.data, m.size, 1, fp)))
17c76198
PP
582 {
583 saved_errno = errno;
584 fclose(fp);
585 free(m.data);
586 return tls_error(US"fread failed", strerror(saved_errno), NULL);
587 }
588 fclose(fp);
b5aea5e1 589
17c76198 590 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
b5aea5e1 591 free(m.data);
17c76198
PP
592 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
593 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
b5aea5e1
PH
594 }
595
596/* If the file does not exist, fall through to compute new data and cache it.
597If there was any other opening error, it is serious. */
598
182ad5cf
PH
599else if (errno == ENOENT)
600 {
17c76198 601 rc = -1;
182ad5cf 602 DEBUG(D_tls)
17c76198 603 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
182ad5cf
PH
604 }
605else
17c76198
PP
606 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
607 NULL, NULL);
b5aea5e1
PH
608
609/* If ret < 0, either the cache file does not exist, or the data it contains
610is not useful. One particular case of this is when upgrading from an older
611release of Exim in which the data was stored in a different format. We don't
612try to be clever and support both formats; we just regenerate new data in this
613case. */
614
17c76198 615if (rc < 0)
b5aea5e1 616 {
17c76198 617 uschar *temp_fn;
201f5254 618 unsigned int dh_bits_gen = dh_bits;
059ec3d9 619
17c76198
PP
620 if ((PATH_MAX - Ustrlen(filename)) < 10)
621 return tls_error(US"Filename too long to generate replacement",
622 CS filename, NULL);
059ec3d9 623
17c76198 624 temp_fn = string_copy(US "%s.XXXXXXX");
f5d25c2b 625 if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */
17c76198 626 return tls_error(US"Unable to open temp file", strerror(errno), NULL);
059ec3d9
PH
627 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
628
201f5254
PP
629 /* GnuTLS overshoots!
630 * If we ask for 2236, we might get 2237 or more.
631 * But there's no way to ask GnuTLS how many bits there really are.
632 * We can ask how many bits were used in a TLS session, but that's it!
633 * The prime itself is hidden behind too much abstraction.
634 * So we ask for less, and proceed on a wing and a prayer.
635 * First attempt, subtracted 3 for 2233 and got 2240.
636 */
cae6e576 637 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
201f5254
PP
638 {
639 dh_bits_gen = dh_bits - 10;
640 DEBUG(D_tls)
641 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
642 dh_bits_gen);
643 }
644
645 DEBUG(D_tls)
646 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
647 dh_bits_gen);
648 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen);
17c76198
PP
649 exim_gnutls_err_check(US"gnutls_dh_params_generate2");
650
651 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
652 and I confirmed that a NULL call to get the size first is how the GnuTLS
653 sample apps handle this. */
654
655 sz = 0;
656 m.data = NULL;
657 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
658 m.data, &sz);
659 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
660 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3(NULL) sizing");
661 m.size = sz;
40c90bca 662 if (!(m.data = malloc(m.size)))
17c76198 663 return tls_error(US"memory allocation failed", strerror(errno), NULL);
40c90bca 664
1f00591e 665 /* this will return a size 1 less than the allocation size above */
17c76198 666 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
1f00591e 667 m.data, &sz);
17c76198
PP
668 if (rc != GNUTLS_E_SUCCESS)
669 {
670 free(m.data);
671 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3() real");
672 }
1f00591e 673 m.size = sz; /* shrink by 1, probably */
059ec3d9 674
f5d25c2b 675 if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
17c76198
PP
676 {
677 free(m.data);
678 return tls_error(US"TLS cache write D-H params failed",
679 strerror(errno), NULL);
680 }
b5aea5e1 681 free(m.data);
f5d25c2b 682 if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
17c76198
PP
683 return tls_error(US"TLS cache write D-H params final newline failed",
684 strerror(errno), NULL);
685
f5d25c2b
JH
686 if ((rc = close(fd)))
687 return tls_error(US"TLS cache write close() failed", strerror(errno), NULL);
059ec3d9 688
17c76198
PP
689 if (Urename(temp_fn, filename) < 0)
690 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
691 temp_fn, filename), strerror(errno), NULL);
059ec3d9 692
17c76198 693 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
059ec3d9
PH
694 }
695
17c76198 696DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
059ec3d9
PH
697return OK;
698}
699
700
701
702
23bb6982
JH
703/* Create and install a selfsigned certificate, for use in server mode */
704
705static int
706tls_install_selfsign(exim_gnutls_state_st * state)
707{
708gnutls_x509_crt_t cert = NULL;
709time_t now;
710gnutls_x509_privkey_t pkey = NULL;
711const uschar * where;
712int rc;
713
714where = US"initialising pkey";
715if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
716
717where = US"initialising cert";
718if ((rc = gnutls_x509_crt_init(&cert))) goto err;
719
720where = US"generating pkey";
721if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
76075bb5 722#ifdef SUPPORT_PARAM_TO_PK_BITS
23bb6982 723 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_LOW),
76075bb5
JH
724#else
725 1024,
726#endif
727 0)))
23bb6982
JH
728 goto err;
729
730where = US"configuring cert";
731now = 0;
732if ( (rc = gnutls_x509_crt_set_version(cert, 3))
733 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
734 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
735 || (rc = gnutls_x509_crt_set_expiration_time(cert, now + 60 * 60)) /* 1 hr */
736 || (rc = gnutls_x509_crt_set_key(cert, pkey))
737
738 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
739 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
740 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
741 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
742 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
743 GNUTLS_OID_X520_COMMON_NAME, 0,
744 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
745 )
746 goto err;
747
748where = US"signing cert";
749if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
750
751where = US"installing selfsign cert";
752 /* Since: 2.4.0 */
753if ((rc = gnutls_certificate_set_x509_key(state->x509_cred, &cert, 1, pkey)))
754 goto err;
755
756rc = OK;
757
758out:
759 if (cert) gnutls_x509_crt_deinit(cert);
760 if (pkey) gnutls_x509_privkey_deinit(pkey);
761 return rc;
762
763err:
764 rc = tls_error(where, gnutls_strerror(rc), NULL);
765 goto out;
766}
767
768
769
770
059ec3d9 771/*************************************************
17c76198 772* Variables re-expanded post-SNI *
059ec3d9
PH
773*************************************************/
774
17c76198
PP
775/* Called from both server and client code, via tls_init(), and also from
776the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
777
778We can tell the two apart by state->received_sni being non-NULL in callback.
779
780The callback should not call us unless state->trigger_sni_changes is true,
781which we are responsible for setting on the first pass through.
059ec3d9
PH
782
783Arguments:
17c76198 784 state exim_gnutls_state_st *
059ec3d9
PH
785
786Returns: OK/DEFER/FAIL
787*/
788
789static int
17c76198 790tls_expand_session_files(exim_gnutls_state_st *state)
059ec3d9 791{
1365611d 792struct stat statbuf;
059ec3d9 793int rc;
17c76198
PP
794const host_item *host = state->host; /* macro should be reconsidered? */
795uschar *saved_tls_certificate = NULL;
796uschar *saved_tls_privatekey = NULL;
797uschar *saved_tls_verify_certificates = NULL;
798uschar *saved_tls_crl = NULL;
799int cert_count;
800
801/* We check for tls_sni *before* expansion. */
2b4a568d 802if (!host) /* server */
17c76198
PP
803 if (!state->received_sni)
804 {
d9b2312b
JH
805 if (state->tls_certificate &&
806 (Ustrstr(state->tls_certificate, US"tls_sni") ||
807 Ustrstr(state->tls_certificate, US"tls_in_sni") ||
808 Ustrstr(state->tls_certificate, US"tls_out_sni")
809 ))
17c76198
PP
810 {
811 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
812 state->trigger_sni_changes = TRUE;
813 }
814 }
815 else
816 {
1365611d 817 /* useful for debugging */
17c76198
PP
818 saved_tls_certificate = state->exp_tls_certificate;
819 saved_tls_privatekey = state->exp_tls_privatekey;
820 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
821 saved_tls_crl = state->exp_tls_crl;
822 }
059ec3d9 823
1365611d
PP
824rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
825exim_gnutls_err_check(US"gnutls_certificate_allocate_credentials");
826
17c76198
PP
827/* remember: expand_check_tlsvar() is expand_check() but fiddling with
828state members, assuming consistent naming; and expand_check() returns
829false if expansion failed, unless expansion was forced to fail. */
059ec3d9 830
17c76198
PP
831/* check if we at least have a certificate, before doing expensive
832D-H generation. */
059ec3d9 833
17c76198
PP
834if (!expand_check_tlsvar(tls_certificate))
835 return DEFER;
059ec3d9 836
17c76198 837/* certificate is mandatory in server, optional in client */
059ec3d9 838
23bb6982
JH
839if ( !state->exp_tls_certificate
840 || !*state->exp_tls_certificate
841 )
2b4a568d 842 if (!host)
23bb6982 843 return tls_install_selfsign(state);
17c76198
PP
844 else
845 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
059ec3d9 846
17c76198 847if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey))
059ec3d9
PH
848 return DEFER;
849
17c76198
PP
850/* tls_privatekey is optional, defaulting to same file as certificate */
851
852if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
059ec3d9 853 {
17c76198
PP
854 state->tls_privatekey = state->tls_certificate;
855 state->exp_tls_privatekey = state->exp_tls_certificate;
059ec3d9 856 }
c91535f3 857
059ec3d9 858
17c76198 859if (state->exp_tls_certificate && *state->exp_tls_certificate)
059ec3d9
PH
860 {
861 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
17c76198
PP
862 state->exp_tls_certificate, state->exp_tls_privatekey);
863
864 if (state->received_sni)
23bb6982
JH
865 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
866 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
867 )
17c76198 868 {
b34fc30c 869 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
17c76198
PP
870 }
871 else
872 {
b34fc30c 873 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
17c76198 874 }
059ec3d9 875
1365611d
PP
876 rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
877 CS state->exp_tls_certificate, CS state->exp_tls_privatekey,
878 GNUTLS_X509_FMT_PEM);
879 exim_gnutls_err_check(
880 string_sprintf("cert/key setup: cert=%s key=%s",
881 state->exp_tls_certificate, state->exp_tls_privatekey));
882 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
b34fc30c 883 } /* tls_certificate */
059ec3d9 884
2b4a568d
JH
885
886/* Set the OCSP stapling server info */
887
f2de3a33 888#ifndef DISABLE_OCSP
2b4a568d
JH
889if ( !host /* server */
890 && tls_ocsp_file
891 )
892 {
9196d5bf
JH
893 if (gnutls_buggy_ocsp)
894 {
895 DEBUG(D_tls) debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
896 }
897 else
898 {
899 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file",
900 &state->exp_tls_ocsp_file))
901 return DEFER;
2b4a568d 902
9196d5bf
JH
903 /* Use the full callback method for stapling just to get observability.
904 More efficient would be to read the file once only, if it never changed
905 (due to SNI). Would need restart on file update, or watch datestamp. */
44662487 906
9196d5bf
JH
907 gnutls_certificate_set_ocsp_status_request_function(state->x509_cred,
908 server_ocsp_stapling_cb, state->exp_tls_ocsp_file);
2b4a568d 909
9196d5bf
JH
910 DEBUG(D_tls) debug_printf("OCSP response file = %s\n", state->exp_tls_ocsp_file);
911 }
2b4a568d
JH
912 }
913#endif
914
915
059ec3d9
PH
916/* Set the trusted CAs file if one is provided, and then add the CRL if one is
917provided. Experiment shows that, if the certificate file is empty, an unhelpful
918error message is provided. However, if we just refrain from setting anything up
919in that case, certificate verification fails, which seems to be the correct
920behaviour. */
921
610ff438 922if (state->tls_verify_certificates && *state->tls_verify_certificates)
059ec3d9 923 {
17c76198 924 if (!expand_check_tlsvar(tls_verify_certificates))
059ec3d9 925 return DEFER;
610ff438
JH
926#ifndef SUPPORT_SYSDEFAULT_CABUNDLE
927 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
928 state->exp_tls_verify_certificates = NULL;
929#endif
17c76198
PP
930 if (state->tls_crl && *state->tls_crl)
931 if (!expand_check_tlsvar(tls_crl))
932 return DEFER;
059ec3d9 933
1365611d
PP
934 if (!(state->exp_tls_verify_certificates &&
935 *state->exp_tls_verify_certificates))
b34fc30c
PP
936 {
937 DEBUG(D_tls)
1365611d
PP
938 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
939 /* With no tls_verify_certificates, we ignore tls_crl too */
17c76198 940 return OK;
b34fc30c 941 }
1365611d 942 }
83e2f8a2
PP
943else
944 {
945 DEBUG(D_tls)
946 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
947 return OK;
948 }
17c76198 949
cb1d7830
JH
950#ifdef SUPPORT_SYSDEFAULT_CABUNDLE
951if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
952 cert_count = gnutls_certificate_set_x509_system_trust(state->x509_cred);
953else
954#endif
1365611d 955 {
cb1d7830
JH
956 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
957 {
958 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
959 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
960 strerror(errno));
961 return DEFER;
962 }
17c76198 963
a7fec7a7 964#ifndef SUPPORT_CA_DIR
cb1d7830
JH
965 /* The test suite passes in /dev/null; we could check for that path explicitly,
966 but who knows if someone has some weird FIFO which always dumps some certs, or
967 other weirdness. The thing we really want to check is that it's not a
968 directory, since while OpenSSL supports that, GnuTLS does not.
60f914bc 969 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
cb1d7830
JH
970 if (S_ISDIR(statbuf.st_mode))
971 {
972 DEBUG(D_tls)
973 debug_printf("verify certificates path is a dir: \"%s\"\n",
974 state->exp_tls_verify_certificates);
975 log_write(0, LOG_MAIN|LOG_PANIC,
976 "tls_verify_certificates \"%s\" is a directory",
977 state->exp_tls_verify_certificates);
978 return DEFER;
979 }
a7fec7a7 980#endif
059ec3d9 981
cb1d7830
JH
982 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
983 state->exp_tls_verify_certificates, statbuf.st_size);
059ec3d9 984
cb1d7830
JH
985 if (statbuf.st_size == 0)
986 {
987 DEBUG(D_tls)
988 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
989 return OK;
990 }
059ec3d9 991
cb1d7830 992 cert_count =
a7fec7a7
JH
993
994#ifdef SUPPORT_CA_DIR
cb1d7830
JH
995 (statbuf.st_mode & S_IFMT) == S_IFDIR
996 ?
997 gnutls_certificate_set_x509_trust_dir(state->x509_cred,
998 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM)
999 :
a7fec7a7 1000#endif
cb1d7830
JH
1001 gnutls_certificate_set_x509_trust_file(state->x509_cred,
1002 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
1003 }
a7fec7a7 1004
1365611d
PP
1005if (cert_count < 0)
1006 {
1007 rc = cert_count;
cb1d7830 1008 exim_gnutls_err_check(US"setting certificate trust");
1365611d
PP
1009 }
1010DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
059ec3d9 1011
5c8cda3a
PP
1012if (state->tls_crl && *state->tls_crl &&
1013 state->exp_tls_crl && *state->exp_tls_crl)
1365611d 1014 {
5c8cda3a
PP
1015 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
1016 cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
1017 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
1018 if (cert_count < 0)
1365611d 1019 {
5c8cda3a 1020 rc = cert_count;
1365611d
PP
1021 exim_gnutls_err_check(US"gnutls_certificate_set_x509_crl_file");
1022 }
5c8cda3a 1023 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1365611d 1024 }
059ec3d9 1025
059ec3d9
PH
1026return OK;
1027}
1028
1029
1030
1031
1032/*************************************************
1365611d
PP
1033* Set X.509 state variables *
1034*************************************************/
1035
1036/* In GnuTLS, the registered cert/key are not replaced by a later
1037set of a cert/key, so for SNI support we need a whole new x509_cred
1038structure. Which means various other non-re-expanded pieces of state
1039need to be re-set in the new struct, so the setting logic is pulled
1040out to this.
1041
1042Arguments:
1043 state exim_gnutls_state_st *
1044
1045Returns: OK/DEFER/FAIL
1046*/
1047
1048static int
1049tls_set_remaining_x509(exim_gnutls_state_st *state)
1050{
1051int rc;
1052const host_item *host = state->host; /* macro should be reconsidered? */
1053
1054/* Create D-H parameters, or read them from the cache file. This function does
1055its own SMTP error messaging. This only happens for the server, TLS D-H ignores
1056client-side params. */
1057
1058if (!state->host)
1059 {
1060 if (!dh_server_params)
1061 {
1062 rc = init_server_dh();
1063 if (rc != OK) return rc;
1064 }
1065 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
1066 }
1067
1068/* Link the credentials to the session. */
1069
1070rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
1071exim_gnutls_err_check(US"gnutls_credentials_set");
1072
1073return OK;
1074}
1075
1076/*************************************************
17c76198 1077* Initialize for GnuTLS *
059ec3d9
PH
1078*************************************************/
1079
9196d5bf 1080
4fb7df6d
JH
1081#ifndef DISABLE_OCSP
1082
9196d5bf
JH
1083static BOOL
1084tls_is_buggy_ocsp(void)
1085{
1086const uschar * s;
1087uschar maj, mid, mic;
1088
1089s = CUS gnutls_check_version(NULL);
1090maj = atoi(CCS s);
1091if (maj == 3)
1092 {
1093 while (*s && *s != '.') s++;
1094 mid = atoi(CCS ++s);
1095 if (mid <= 2)
1096 return TRUE;
1097 else if (mid >= 5)
1098 return FALSE;
1099 else
1100 {
1101 while (*s && *s != '.') s++;
1102 mic = atoi(CCS ++s);
1103 return mic <= (mid == 3 ? 16 : 3);
1104 }
1105 }
1106return FALSE;
1107}
1108
4fb7df6d 1109#endif
9196d5bf
JH
1110
1111
17c76198
PP
1112/* Called from both server and client code. In the case of a server, errors
1113before actual TLS negotiation return DEFER.
059ec3d9
PH
1114
1115Arguments:
17c76198
PP
1116 host connected host, if client; NULL if server
1117 certificate certificate file
1118 privatekey private key file
1119 sni TLS SNI to send, sometimes when client; else NULL
1120 cas CA certs file
1121 crl CRL file
1122 require_ciphers tls_require_ciphers setting
817d9f57 1123 caller_state returned state-info structure
059ec3d9 1124
17c76198 1125Returns: OK/DEFER/FAIL
059ec3d9
PH
1126*/
1127
17c76198
PP
1128static int
1129tls_init(
1130 const host_item *host,
1131 const uschar *certificate,
1132 const uschar *privatekey,
1133 const uschar *sni,
1134 const uschar *cas,
1135 const uschar *crl,
1136 const uschar *require_ciphers,
1137 exim_gnutls_state_st **caller_state)
059ec3d9 1138{
17c76198
PP
1139exim_gnutls_state_st *state;
1140int rc;
1141size_t sz;
1142const char *errpos;
1143uschar *p;
1144BOOL want_default_priorities;
1145
1146if (!exim_gnutls_base_init_done)
059ec3d9 1147 {
17c76198
PP
1148 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1149
a5f239e4
PP
1150#ifdef HAVE_GNUTLS_PKCS11
1151 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1152 which loads modules from a config file, which sounds good and may be wanted
1153 by some sysadmin, but also means in common configurations that GNOME keyring
1154 environment variables are used and so breaks for users calling mailq.
1155 To prevent this, we init PKCS11 first, which is the documented approach. */
2519e60d 1156 if (!gnutls_allow_auto_pkcs11)
a5f239e4
PP
1157 {
1158 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
1159 exim_gnutls_err_check(US"gnutls_pkcs11_init");
1160 }
1161#endif
1162
17c76198
PP
1163 rc = gnutls_global_init();
1164 exim_gnutls_err_check(US"gnutls_global_init");
1165
1166#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1167 DEBUG(D_tls)
059ec3d9 1168 {
17c76198
PP
1169 gnutls_global_set_log_function(exim_gnutls_logger_cb);
1170 /* arbitrarily chosen level; bump upto 9 for more */
1171 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
059ec3d9 1172 }
17c76198
PP
1173#endif
1174
4fb7df6d
JH
1175#ifndef DISABLE_OCSP
1176 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
9196d5bf 1177 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
4fb7df6d 1178#endif
9196d5bf 1179
17c76198 1180 exim_gnutls_base_init_done = TRUE;
059ec3d9 1181 }
059ec3d9 1182
17c76198
PP
1183if (host)
1184 {
1185 state = &state_client;
1186 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
817d9f57 1187 state->tlsp = &tls_out;
17c76198
PP
1188 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1189 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1190 }
1191else
1192 {
1193 state = &state_server;
1194 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
817d9f57 1195 state->tlsp = &tls_in;
17c76198
PP
1196 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1197 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1198 }
1199exim_gnutls_err_check(US"gnutls_init");
059ec3d9 1200
17c76198 1201state->host = host;
059ec3d9 1202
17c76198
PP
1203state->tls_certificate = certificate;
1204state->tls_privatekey = privatekey;
5779e6aa 1205state->tls_require_ciphers = require_ciphers;
17c76198
PP
1206state->tls_sni = sni;
1207state->tls_verify_certificates = cas;
1208state->tls_crl = crl;
059ec3d9 1209
17c76198
PP
1210/* This handles the variables that might get re-expanded after TLS SNI;
1211that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
059ec3d9 1212
17c76198
PP
1213DEBUG(D_tls)
1214 debug_printf("Expanding various TLS configuration options for session credentials.\n");
1215rc = tls_expand_session_files(state);
1216if (rc != OK) return rc;
059ec3d9 1217
1365611d
PP
1218/* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1219requires a new structure afterwards. */
83da1223 1220
1365611d
PP
1221rc = tls_set_remaining_x509(state);
1222if (rc != OK) return rc;
83da1223 1223
17c76198
PP
1224/* set SNI in client, only */
1225if (host)
1226 {
0df4ab80 1227 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni))
17c76198 1228 return DEFER;
0df4ab80 1229 if (state->tlsp->sni && *state->tlsp->sni)
17c76198
PP
1230 {
1231 DEBUG(D_tls)
0df4ab80
JH
1232 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1233 sz = Ustrlen(state->tlsp->sni);
17c76198 1234 rc = gnutls_server_name_set(state->session,
0df4ab80 1235 GNUTLS_NAME_DNS, state->tlsp->sni, sz);
17c76198
PP
1236 exim_gnutls_err_check(US"gnutls_server_name_set");
1237 }
1238 }
1239else if (state->tls_sni)
1240 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
1241 "have an SNI set for a client [%s]\n", state->tls_sni);
83da1223 1242
17c76198 1243/* This is the priority string support,
42bfef1e 1244http://www.gnutls.org/manual/html_node/Priority-Strings.html
17c76198
PP
1245and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1246This was backwards incompatible, but means Exim no longer needs to track
1247all algorithms and provide string forms for them. */
83da1223 1248
17c76198 1249want_default_priorities = TRUE;
83da1223 1250
17c76198 1251if (state->tls_require_ciphers && *state->tls_require_ciphers)
83da1223 1252 {
17c76198
PP
1253 if (!expand_check_tlsvar(tls_require_ciphers))
1254 return DEFER;
1255 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
83da1223 1256 {
17c76198
PP
1257 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
1258 state->exp_tls_require_ciphers);
1259
1260 rc = gnutls_priority_init(&state->priority_cache,
1261 CS state->exp_tls_require_ciphers, &errpos);
1262 want_default_priorities = FALSE;
1263 p = state->exp_tls_require_ciphers;
83da1223
PH
1264 }
1265 }
17c76198
PP
1266if (want_default_priorities)
1267 {
83e2f8a2
PP
1268 DEBUG(D_tls)
1269 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
1270 exim_default_gnutls_priority);
17c76198
PP
1271 rc = gnutls_priority_init(&state->priority_cache,
1272 exim_default_gnutls_priority, &errpos);
1273 p = US exim_default_gnutls_priority;
1274 }
83da1223 1275
17c76198
PP
1276exim_gnutls_err_check(string_sprintf(
1277 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1278 p, errpos - CS p, errpos));
1279
1280rc = gnutls_priority_set(state->session, state->priority_cache);
1281exim_gnutls_err_check(US"gnutls_priority_set");
1282
1283gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1284
1285/* Reduce security in favour of increased compatibility, if the admin
1286decides to make that trade-off. */
1287if (gnutls_compat_mode)
83da1223 1288 {
17c76198
PP
1289#if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1290 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1291 gnutls_session_enable_compatibility_mode(state->session);
1292#else
1293 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1294#endif
83da1223
PH
1295 }
1296
17c76198 1297*caller_state = state;
17c76198 1298return OK;
83da1223
PH
1299}
1300
1301
1302
83da1223 1303/*************************************************
17c76198 1304* Extract peer information *
059ec3d9
PH
1305*************************************************/
1306
17c76198 1307/* Called from both server and client code.
4fe99a6c
PP
1308Only this is allowed to set state->peerdn and state->have_set_peerdn
1309and we use that to detect double-calls.
059ec3d9 1310
75fe387d
PP
1311NOTE: the state blocks last while the TLS connection is up, which is fine
1312for logging in the server side, but for the client side, we log after teardown
1313in src/deliver.c. While the session is up, we can twist about states and
1314repoint tls_* globals, but those variables used for logging or other variable
1315expansion that happens _after_ delivery need to have a longer life-time.
1316
1317So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1318doing this more than once per generation of a state context. We set them in
1319the state context, and repoint tls_* to them. After the state goes away, the
1320tls_* copies of the pointers remain valid and client delivery logging is happy.
1321
1322tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1323don't apply.
1324
059ec3d9 1325Arguments:
17c76198 1326 state exim_gnutls_state_st *
059ec3d9 1327
17c76198 1328Returns: OK/DEFER/FAIL
059ec3d9
PH
1329*/
1330
17c76198
PP
1331static int
1332peer_status(exim_gnutls_state_st *state)
059ec3d9 1333{
75fe387d 1334uschar cipherbuf[256];
27f19eb4 1335const gnutls_datum_t *cert_list;
75fe387d 1336int old_pool, rc;
17c76198 1337unsigned int cert_list_size = 0;
4fe99a6c
PP
1338gnutls_protocol_t protocol;
1339gnutls_cipher_algorithm_t cipher;
1340gnutls_kx_algorithm_t kx;
1341gnutls_mac_algorithm_t mac;
17c76198
PP
1342gnutls_certificate_type_t ct;
1343gnutls_x509_crt_t crt;
4fe99a6c 1344uschar *p, *dn_buf;
17c76198 1345size_t sz;
059ec3d9 1346
4fe99a6c 1347if (state->have_set_peerdn)
17c76198 1348 return OK;
4fe99a6c 1349state->have_set_peerdn = TRUE;
059ec3d9 1350
4fe99a6c 1351state->peerdn = NULL;
059ec3d9 1352
4fe99a6c
PP
1353/* tls_cipher */
1354cipher = gnutls_cipher_get(state->session);
1355protocol = gnutls_protocol_get_version(state->session);
1356mac = gnutls_mac_get(state->session);
1357kx = gnutls_kx_get(state->session);
1358
75fe387d 1359string_format(cipherbuf, sizeof(cipherbuf),
4fe99a6c
PP
1360 "%s:%s:%d",
1361 gnutls_protocol_get_name(protocol),
1362 gnutls_cipher_suite_get_name(kx, cipher, mac),
1363 (int) gnutls_cipher_get_key_size(cipher) * 8);
1364
1365/* I don't see a way that spaces could occur, in the current GnuTLS
1366code base, but it was a concern in the old code and perhaps older GnuTLS
1367releases did return "TLS 1.0"; play it safe, just in case. */
75fe387d 1368for (p = cipherbuf; *p != '\0'; ++p)
4fe99a6c
PP
1369 if (isspace(*p))
1370 *p = '-';
75fe387d
PP
1371old_pool = store_pool;
1372store_pool = POOL_PERM;
1373state->ciphersuite = string_copy(cipherbuf);
1374store_pool = old_pool;
817d9f57 1375state->tlsp->cipher = state->ciphersuite;
4fe99a6c
PP
1376
1377/* tls_peerdn */
17c76198 1378cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
83da1223 1379
17c76198
PP
1380if (cert_list == NULL || cert_list_size == 0)
1381 {
17c76198
PP
1382 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1383 cert_list, cert_list_size);
e51c7be2 1384 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198
PP
1385 return tls_error(US"certificate verification failed",
1386 "no certificate received from peer", state->host);
1387 return OK;
1388 }
059ec3d9 1389
17c76198
PP
1390ct = gnutls_certificate_type_get(state->session);
1391if (ct != GNUTLS_CRT_X509)
059ec3d9 1392 {
17c76198 1393 const char *ctn = gnutls_certificate_type_get_name(ct);
17c76198
PP
1394 DEBUG(D_tls)
1395 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
e51c7be2 1396 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198
PP
1397 return tls_error(US"certificate verification not possible, unhandled type",
1398 ctn, state->host);
1399 return OK;
83da1223 1400 }
059ec3d9 1401
e51c7be2
JH
1402#define exim_gnutls_peer_err(Label) \
1403 do { \
1404 if (rc != GNUTLS_E_SUCCESS) \
1405 { \
1406 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1407 (Label), gnutls_strerror(rc)); \
1408 if (state->verify_requirement >= VERIFY_REQUIRED) \
1409 return tls_error((Label), gnutls_strerror(rc), state->host); \
1410 return OK; \
1411 } \
1412 } while (0)
17c76198 1413
9d1c15ef
JH
1414rc = import_cert(&cert_list[0], &crt);
1415exim_gnutls_peer_err(US"cert 0");
1416
1417state->tlsp->peercert = state->peercert = crt;
17c76198 1418
17c76198
PP
1419sz = 0;
1420rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1421if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
83da1223 1422 {
17c76198
PP
1423 exim_gnutls_peer_err(US"getting size for cert DN failed");
1424 return FAIL; /* should not happen */
059ec3d9 1425 }
17c76198
PP
1426dn_buf = store_get_perm(sz);
1427rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1428exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
9d1c15ef 1429
17c76198
PP
1430state->peerdn = dn_buf;
1431
1432return OK;
1433#undef exim_gnutls_peer_err
1434}
059ec3d9 1435
059ec3d9 1436
059ec3d9 1437
059ec3d9 1438
17c76198
PP
1439/*************************************************
1440* Verify peer certificate *
1441*************************************************/
059ec3d9 1442
17c76198
PP
1443/* Called from both server and client code.
1444*Should* be using a callback registered with
1445gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1446the peer information, but that's too new for some OSes.
059ec3d9 1447
17c76198
PP
1448Arguments:
1449 state exim_gnutls_state_st *
1450 error where to put an error message
059ec3d9 1451
17c76198
PP
1452Returns:
1453 FALSE if the session should be rejected
1454 TRUE if the cert is okay or we just don't care
1455*/
059ec3d9 1456
17c76198
PP
1457static BOOL
1458verify_certificate(exim_gnutls_state_st *state, const char **error)
1459{
1460int rc;
1461unsigned int verify;
1462
1463*error = NULL;
1464
0a92f87f 1465if ((rc = peer_status(state)) != OK)
e6060e2c 1466 {
17c76198 1467 verify = GNUTLS_CERT_INVALID;
0a92f87f 1468 *error = "certificate not supplied";
17c76198
PP
1469 }
1470else
17c76198 1471 rc = gnutls_certificate_verify_peers2(state->session, &verify);
e6060e2c 1472
17c76198
PP
1473/* Handle the result of verification. INVALID seems to be set as well
1474as REVOKED, but leave the test for both. */
059ec3d9 1475
e51c7be2
JH
1476if (rc < 0 ||
1477 verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED)
1478 )
17c76198
PP
1479 {
1480 state->peer_cert_verified = FALSE;
0a92f87f
JH
1481 if (!*error)
1482 *error = verify & GNUTLS_CERT_REVOKED
1483 ? "certificate revoked" : "certificate invalid";
059ec3d9 1484
17c76198 1485 DEBUG(D_tls)
e51c7be2 1486 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
4fe99a6c 1487 *error, state->peerdn ? state->peerdn : US"<unset>");
059ec3d9 1488
e51c7be2 1489 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198 1490 {
e51c7be2
JH
1491 gnutls_alert_send(state->session,
1492 GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
17c76198
PP
1493 return FALSE;
1494 }
1495 DEBUG(D_tls)
4789da3a 1496 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
17c76198 1497 }
e51c7be2 1498
17c76198
PP
1499else
1500 {
aa2a70ba 1501 if (state->exp_tls_verify_cert_hostnames)
e51c7be2
JH
1502 {
1503 int sep = 0;
55414b25 1504 const uschar * list = state->exp_tls_verify_cert_hostnames;
e51c7be2 1505 uschar * name;
76075bb5 1506 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
e51c7be2
JH
1507 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert, CS name))
1508 break;
1509 if (!name)
1510 {
1511 DEBUG(D_tls)
1512 debug_printf("TLS certificate verification failed: cert name mismatch\n");
aa2a70ba
JH
1513 if (state->verify_requirement >= VERIFY_REQUIRED)
1514 {
1515 gnutls_alert_send(state->session,
1516 GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1517 return FALSE;
1518 }
1519 return TRUE;
e51c7be2
JH
1520 }
1521 }
17c76198 1522 state->peer_cert_verified = TRUE;
e51c7be2 1523 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
4fe99a6c 1524 state->peerdn ? state->peerdn : US"<unset>");
17c76198 1525 }
059ec3d9 1526
817d9f57 1527state->tlsp->peerdn = state->peerdn;
059ec3d9 1528
17c76198
PP
1529return TRUE;
1530}
059ec3d9 1531
17c76198
PP
1532
1533
1534
1535/* ------------------------------------------------------------------------ */
1536/* Callbacks */
1537
1538/* Logging function which can be registered with
1539 * gnutls_global_set_log_function()
1540 * gnutls_global_set_log_level() 0..9
1541 */
af3498d6 1542#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
059ec3d9 1543static void
17c76198 1544exim_gnutls_logger_cb(int level, const char *message)
059ec3d9 1545{
8c79eebf
PP
1546 size_t len = strlen(message);
1547 if (len < 1)
1548 {
1549 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1550 return;
1551 }
1552 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1553 message[len-1] == '\n' ? "" : "\n");
17c76198 1554}
af3498d6 1555#endif
059ec3d9 1556
059ec3d9 1557
17c76198
PP
1558/* Called after client hello, should handle SNI work.
1559This will always set tls_sni (state->received_sni) if available,
1560and may trigger presenting different certificates,
1561if state->trigger_sni_changes is TRUE.
059ec3d9 1562
17c76198
PP
1563Should be registered with
1564 gnutls_handshake_set_post_client_hello_function()
059ec3d9 1565
17c76198
PP
1566"This callback must return 0 on success or a gnutls error code to terminate the
1567handshake.".
059ec3d9 1568
17c76198
PP
1569For inability to get SNI information, we return 0.
1570We only return non-zero if re-setup failed.
817d9f57 1571Only used for server-side TLS.
17c76198 1572*/
44bbabb5 1573
17c76198
PP
1574static int
1575exim_sni_handling_cb(gnutls_session_t session)
1576{
1577char sni_name[MAX_HOST_LEN];
1578size_t data_len = MAX_HOST_LEN;
817d9f57 1579exim_gnutls_state_st *state = &state_server;
17c76198
PP
1580unsigned int sni_type;
1581int rc, old_pool;
1582
1583rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
b34fc30c
PP
1584if (rc != GNUTLS_E_SUCCESS)
1585 {
1586 DEBUG(D_tls) {
1587 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1588 debug_printf("TLS: no SNI presented in handshake.\n");
1589 else
1590 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1591 gnutls_strerror(rc), rc);
1592 };
1593 return 0;
1594 }
1595
17c76198
PP
1596if (sni_type != GNUTLS_NAME_DNS)
1597 {
1598 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1599 return 0;
1600 }
44bbabb5 1601
17c76198
PP
1602/* We now have a UTF-8 string in sni_name */
1603old_pool = store_pool;
1604store_pool = POOL_PERM;
1605state->received_sni = string_copyn(US sni_name, data_len);
1606store_pool = old_pool;
1607
1608/* We set this one now so that variable expansions below will work */
817d9f57 1609state->tlsp->sni = state->received_sni;
17c76198
PP
1610
1611DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1612 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1613
1614if (!state->trigger_sni_changes)
1615 return 0;
1616
1617rc = tls_expand_session_files(state);
1618if (rc != OK)
1619 {
1620 /* If the setup of certs/etc failed before handshake, TLS would not have
1621 been offered. The best we can do now is abort. */
1622 return GNUTLS_E_APPLICATION_ERROR_MIN;
1623 }
1624
1365611d
PP
1625rc = tls_set_remaining_x509(state);
1626if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1627
1628return 0;
059ec3d9
PH
1629}
1630
1631
1632
f2de3a33 1633#ifndef DISABLE_OCSP
44662487
JH
1634
1635static int
1636server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
1637 gnutls_datum_t * ocsp_response)
1638{
1639int ret;
1640
44662487
JH
1641if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
1642 {
1643 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
1644 (char *)ptr);
018058b2 1645 tls_in.ocsp = OCSP_NOT_RESP;
44662487
JH
1646 return GNUTLS_E_NO_CERTIFICATE_STATUS;
1647 }
1648
018058b2 1649tls_in.ocsp = OCSP_VFY_NOT_TRIED;
44662487
JH
1650return 0;
1651}
1652
1653#endif
1654
1655
0cbf2b82 1656#ifndef DISABLE_EVENT
a7538db1
JH
1657/*
1658We use this callback to get observability and detail-level control
723fe533
JH
1659for an exim TLS connection (either direction), raising a tls:cert event
1660for each cert in the chain presented by the peer. Any event
a7538db1
JH
1661can deny verification.
1662
1663Return 0 for the handshake to continue or non-zero to terminate.
1664*/
1665
1666static int
723fe533 1667verify_cb(gnutls_session_t session)
a7538db1 1668{
27f19eb4 1669const gnutls_datum_t * cert_list;
a7538db1
JH
1670unsigned int cert_list_size = 0;
1671gnutls_x509_crt_t crt;
1672int rc;
b30275b8 1673uschar * yield;
a7538db1
JH
1674exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
1675
1676cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
1677if (cert_list)
1678 while (cert_list_size--)
1679 {
1680 rc = import_cert(&cert_list[cert_list_size], &crt);
1681 if (rc != GNUTLS_E_SUCCESS)
1682 {
1683 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
1684 cert_list_size, gnutls_strerror(rc));
1685 break;
1686 }
1687
1688 state->tlsp->peercert = crt;
b30275b8
JH
1689 if ((yield = event_raise(state->event_action,
1690 US"tls:cert", string_sprintf("%d", cert_list_size))))
a7538db1
JH
1691 {
1692 log_write(0, LOG_MAIN,
b30275b8
JH
1693 "SSL verify denied by event-action: depth=%d: %s",
1694 cert_list_size, yield);
a7538db1
JH
1695 return 1; /* reject */
1696 }
1697 state->tlsp->peercert = NULL;
1698 }
1699
1700return 0;
1701}
1702
1703#endif
44662487
JH
1704
1705
17c76198
PP
1706
1707/* ------------------------------------------------------------------------ */
1708/* Exported functions */
1709
1710
1711
1712
059ec3d9
PH
1713/*************************************************
1714* Start a TLS session in a server *
1715*************************************************/
1716
1717/* This is called when Exim is running as a server, after having received
1718the STARTTLS command. It must respond to that command, and then negotiate
1719a TLS session.
1720
1721Arguments:
83da1223 1722 require_ciphers list of allowed ciphers or NULL
059ec3d9
PH
1723
1724Returns: OK on success
1725 DEFER for errors before the start of the negotiation
4c04137d 1726 FAIL for errors during the negotiation; the server can't
059ec3d9
PH
1727 continue running.
1728*/
1729
1730int
17c76198 1731tls_server_start(const uschar *require_ciphers)
059ec3d9
PH
1732{
1733int rc;
7199e1ee 1734const char *error;
17c76198 1735exim_gnutls_state_st *state = NULL;
059ec3d9
PH
1736
1737/* Check for previous activation */
817d9f57 1738if (tls_in.active >= 0)
059ec3d9 1739 {
17c76198 1740 tls_error(US"STARTTLS received after TLS started", "", NULL);
059ec3d9
PH
1741 smtp_printf("554 Already in TLS\r\n");
1742 return FAIL;
1743 }
1744
1745/* Initialize the library. If it fails, it will already have logged the error
1746and sent an SMTP response. */
1747
17c76198 1748DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
059ec3d9 1749
17c76198
PP
1750rc = tls_init(NULL, tls_certificate, tls_privatekey,
1751 NULL, tls_verify_certificates, tls_crl,
1752 require_ciphers, &state);
059ec3d9
PH
1753if (rc != OK) return rc;
1754
059ec3d9
PH
1755/* If this is a host for which certificate verification is mandatory or
1756optional, set up appropriately. */
1757
059ec3d9 1758if (verify_check_host(&tls_verify_hosts) == OK)
17c76198 1759 {
e51c7be2
JH
1760 DEBUG(D_tls)
1761 debug_printf("TLS: a client certificate will be required.\n");
17c76198
PP
1762 state->verify_requirement = VERIFY_REQUIRED;
1763 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1764 }
059ec3d9 1765else if (verify_check_host(&tls_try_verify_hosts) == OK)
17c76198 1766 {
e51c7be2
JH
1767 DEBUG(D_tls)
1768 debug_printf("TLS: a client certificate will be requested but not required.\n");
17c76198
PP
1769 state->verify_requirement = VERIFY_OPTIONAL;
1770 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1771 }
1772else
1773 {
e51c7be2
JH
1774 DEBUG(D_tls)
1775 debug_printf("TLS: a client certificate will not be requested.\n");
17c76198
PP
1776 state->verify_requirement = VERIFY_NONE;
1777 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
1778 }
059ec3d9 1779
0cbf2b82 1780#ifndef DISABLE_EVENT
723fe533
JH
1781if (event_action)
1782 {
1783 state->event_action = event_action;
1784 gnutls_session_set_ptr(state->session, state);
1785 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
1786 }
1787#endif
1788
17c76198
PP
1789/* Register SNI handling; always, even if not in tls_certificate, so that the
1790expansion variable $tls_sni is always available. */
059ec3d9 1791
17c76198
PP
1792gnutls_handshake_set_post_client_hello_function(state->session,
1793 exim_sni_handling_cb);
059ec3d9
PH
1794
1795/* Set context and tell client to go ahead, except in the case of TLS startup
1796on connection, where outputting anything now upsets the clients and tends to
1797make them disconnect. We need to have an explicit fflush() here, to force out
1798the response. Other smtp_printf() calls do not need it, because in non-TLS
1799mode, the fflush() happens when smtp_getc() is called. */
1800
817d9f57 1801if (!state->tlsp->on_connect)
059ec3d9
PH
1802 {
1803 smtp_printf("220 TLS go ahead\r\n");
9d1c15ef 1804 fflush(smtp_out);
059ec3d9
PH
1805 }
1806
1807/* Now negotiate the TLS session. We put our own timer on it, since it seems
1808that the GnuTLS library doesn't. */
1809
17c76198 1810gnutls_transport_set_ptr2(state->session,
27f19eb4
JH
1811 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
1812 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
17c76198
PP
1813state->fd_in = fileno(smtp_in);
1814state->fd_out = fileno(smtp_out);
059ec3d9
PH
1815
1816sigalrm_seen = FALSE;
1817if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
17c76198 1818do
17c76198 1819 rc = gnutls_handshake(state->session);
157a7880 1820while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
059ec3d9
PH
1821alarm(0);
1822
17c76198 1823if (rc != GNUTLS_E_SUCCESS)
059ec3d9 1824 {
059ec3d9
PH
1825 /* It seems that, except in the case of a timeout, we have to close the
1826 connection right here; otherwise if the other end is running OpenSSL it hangs
1827 until the server times out. */
1828
60d10ce7 1829 if (sigalrm_seen)
ad7fc6eb 1830 {
60d10ce7 1831 tls_error(US"gnutls_handshake", "timed out", NULL);
ad7fc6eb
JH
1832 gnutls_db_remove_session(state->session);
1833 }
60d10ce7 1834 else
059ec3d9 1835 {
60d10ce7 1836 tls_error(US"gnutls_handshake", gnutls_strerror(rc), NULL);
f5d25c2b 1837 (void) gnutls_alert_send_appropriate(state->session, rc);
ad7fc6eb 1838 gnutls_deinit(state->session);
ed62aae3 1839 gnutls_certificate_free_credentials(state->x509_cred);
60d10ce7 1840 millisleep(500);
ad7fc6eb 1841 shutdown(state->fd_out, SHUT_WR);
60d10ce7 1842 for (rc = 1024; fgetc(smtp_in) != EOF && rc > 0; ) rc--; /* drain skt */
f1e894f3
PH
1843 (void)fclose(smtp_out);
1844 (void)fclose(smtp_in);
60d10ce7 1845 smtp_out = smtp_in = NULL;
059ec3d9
PH
1846 }
1847
1848 return FAIL;
1849 }
1850
1851DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1852
17c76198
PP
1853/* Verify after the fact */
1854
9d1c15ef
JH
1855if ( state->verify_requirement != VERIFY_NONE
1856 && !verify_certificate(state, &error))
059ec3d9 1857 {
9d1c15ef 1858 if (state->verify_requirement != VERIFY_OPTIONAL)
17c76198 1859 {
9d1c15ef
JH
1860 tls_error(US"certificate verification failed", error, NULL);
1861 return FAIL;
17c76198 1862 }
9d1c15ef
JH
1863 DEBUG(D_tls)
1864 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
1865 error);
059ec3d9
PH
1866 }
1867
17c76198
PP
1868/* Figure out peer DN, and if authenticated, etc. */
1869
60d10ce7 1870if ((rc = peer_status(state)) != OK) return rc;
17c76198
PP
1871
1872/* Sets various Exim expansion variables; always safe within server */
1873
9d1c15ef 1874extract_exim_vars_from_tls_state(state);
059ec3d9
PH
1875
1876/* TLS has been set up. Adjust the input functions to read via TLS,
1877and initialize appropriately. */
1878
17c76198 1879state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
059ec3d9
PH
1880
1881receive_getc = tls_getc;
584e96c6 1882receive_get_cache = tls_get_cache;
059ec3d9
PH
1883receive_ungetc = tls_ungetc;
1884receive_feof = tls_feof;
1885receive_ferror = tls_ferror;
58eb016e 1886receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 1887
059ec3d9
PH
1888return OK;
1889}
1890
1891
1892
1893
aa2a70ba
JH
1894static void
1895tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
1896 smtp_transport_options_block * ob)
1897{
5130845b 1898if (verify_check_given_host(&ob->tls_verify_cert_hostnames, host) == OK)
aa2a70ba 1899 {
4af0d74a 1900 state->exp_tls_verify_cert_hostnames =
8c5d388a 1901#ifdef SUPPORT_I18N
4af0d74a
JH
1902 string_domain_utf8_to_alabel(host->name, NULL);
1903#else
1904 host->name;
1905#endif
aa2a70ba
JH
1906 DEBUG(D_tls)
1907 debug_printf("TLS: server cert verification includes hostname: \"%s\".\n",
1908 state->exp_tls_verify_cert_hostnames);
1909 }
1910}
aa2a70ba
JH
1911
1912
059ec3d9
PH
1913/*************************************************
1914* Start a TLS session in a client *
1915*************************************************/
1916
1917/* Called from the smtp transport after STARTTLS has been accepted.
1918
1919Arguments:
1920 fd the fd of the connection
1921 host connected host (for messages)
83da1223 1922 addr the first address (not used)
a7538db1 1923 tb transport (always smtp)
059ec3d9
PH
1924
1925Returns: OK/DEFER/FAIL (because using common functions),
1926 but for a client, DEFER and FAIL have the same meaning
1927*/
1928
1929int
17c76198 1930tls_client_start(int fd, host_item *host,
f5d78688 1931 address_item *addr ARG_UNUSED,
0e66b3b6
JH
1932 transport_instance *tb
1933#ifdef EXPERIMENTAL_DANE
b2ba1b4c 1934 , dns_answer * unused_tlsa_dnsa
0e66b3b6
JH
1935#endif
1936 )
059ec3d9 1937{
a7538db1
JH
1938smtp_transport_options_block *ob =
1939 (smtp_transport_options_block *)tb->options_block;
059ec3d9 1940int rc;
17c76198
PP
1941const char *error;
1942exim_gnutls_state_st *state = NULL;
f2de3a33 1943#ifndef DISABLE_OCSP
5130845b
JH
1944BOOL require_ocsp =
1945 verify_check_given_host(&ob->hosts_require_ocsp, host) == OK;
44662487 1946BOOL request_ocsp = require_ocsp ? TRUE
5130845b 1947 : verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
2b4a568d 1948#endif
059ec3d9 1949
17c76198 1950DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
059ec3d9 1951
65867078
JH
1952if ((rc = tls_init(host, ob->tls_certificate, ob->tls_privatekey,
1953 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
1954 ob->tls_require_ciphers, &state)) != OK)
2b4a568d 1955 return rc;
059ec3d9 1956
54c90be1 1957 {
65867078
JH
1958 int dh_min_bits = ob->tls_dh_min_bits;
1959 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
1960 {
1961 DEBUG(D_tls)
1962 debug_printf("WARNING: tls_dh_min_bits far too low,"
1963 " clamping %d up to %d\n",
1964 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
1965 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
1966 }
54c90be1 1967
65867078
JH
1968 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
1969 " acceptable bits to %d\n",
1970 dh_min_bits);
1971 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
1972 }
83da1223 1973
94431adb 1974/* Stick to the old behaviour for compatibility if tls_verify_certificates is
2b4a568d
JH
1975set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
1976the specified host patterns if one of them is defined */
1977
aa2a70ba
JH
1978if ( ( state->exp_tls_verify_certificates
1979 && !ob->tls_verify_hosts
610ff438 1980 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
aa2a70ba 1981 )
5130845b 1982 || verify_check_given_host(&ob->tls_verify_hosts, host) == OK
2b4a568d 1983 )
17c76198 1984 {
aa2a70ba 1985 tls_client_setup_hostname_checks(host, state, ob);
aa2a70ba
JH
1986 DEBUG(D_tls)
1987 debug_printf("TLS: server certificate verification required.\n");
1988 state->verify_requirement = VERIFY_REQUIRED;
52f93eed
WB
1989 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1990 }
5130845b 1991else if (verify_check_given_host(&ob->tls_try_verify_hosts, host) == OK)
52f93eed 1992 {
aa2a70ba 1993 tls_client_setup_hostname_checks(host, state, ob);
e51c7be2
JH
1994 DEBUG(D_tls)
1995 debug_printf("TLS: server certificate verification optional.\n");
52f93eed 1996 state->verify_requirement = VERIFY_OPTIONAL;
17c76198
PP
1997 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1998 }
1999else
2000 {
e51c7be2
JH
2001 DEBUG(D_tls)
2002 debug_printf("TLS: server certificate verification not required.\n");
52f93eed
WB
2003 state->verify_requirement = VERIFY_NONE;
2004 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
17c76198 2005 }
059ec3d9 2006
f2de3a33
JH
2007#ifndef DISABLE_OCSP
2008 /* supported since GnuTLS 3.1.3 */
44662487 2009if (request_ocsp)
9d1c15ef
JH
2010 {
2011 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
65867078
JH
2012 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
2013 NULL, 0, NULL)) != OK)
9d1c15ef
JH
2014 return tls_error(US"cert-status-req",
2015 gnutls_strerror(rc), state->host);
44662487 2016 tls_out.ocsp = OCSP_NOT_RESP;
9d1c15ef 2017 }
2b4a568d
JH
2018#endif
2019
0cbf2b82 2020#ifndef DISABLE_EVENT
774ef2d7 2021if (tb->event_action)
a7538db1 2022 {
774ef2d7 2023 state->event_action = tb->event_action;
a7538db1 2024 gnutls_session_set_ptr(state->session, state);
723fe533 2025 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
a7538db1
JH
2026 }
2027#endif
2028
27f19eb4 2029gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) fd);
17c76198
PP
2030state->fd_in = fd;
2031state->fd_out = fd;
059ec3d9 2032
9d1c15ef 2033DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
059ec3d9
PH
2034/* There doesn't seem to be a built-in timeout on connection. */
2035
2036sigalrm_seen = FALSE;
65867078 2037alarm(ob->command_timeout);
17c76198
PP
2038do
2039 {
2040 rc = gnutls_handshake(state->session);
619b2b25
PP
2041 } while ((rc == GNUTLS_E_AGAIN) ||
2042 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
059ec3d9
PH
2043alarm(0);
2044
4fe99a6c 2045if (rc != GNUTLS_E_SUCCESS)
60d10ce7
JH
2046 if (sigalrm_seen)
2047 {
2048 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
2049 return tls_error(US"gnutls_handshake", "timed out", state->host);
2050 }
2051 else
2052 return tls_error(US"gnutls_handshake", gnutls_strerror(rc), state->host);
4fe99a6c 2053
17c76198 2054DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
059ec3d9 2055
17c76198 2056/* Verify late */
059ec3d9 2057
17c76198
PP
2058if (state->verify_requirement != VERIFY_NONE &&
2059 !verify_certificate(state, &error))
2060 return tls_error(US"certificate verification failed", error, state->host);
059ec3d9 2061
f2de3a33 2062#ifndef DISABLE_OCSP
2b4a568d
JH
2063if (require_ocsp)
2064 {
2065 DEBUG(D_tls)
2066 {
2067 gnutls_datum_t stapling;
2068 gnutls_ocsp_resp_t resp;
2069 gnutls_datum_t printed;
2070 if ( (rc= gnutls_ocsp_status_request_get(state->session, &stapling)) == 0
2071 && (rc= gnutls_ocsp_resp_init(&resp)) == 0
2072 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
2073 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_FULL, &printed)) == 0
2074 )
2075 {
65867078 2076 debug_printf("%.4096s", printed.data);
2b4a568d
JH
2077 gnutls_free(printed.data);
2078 }
2079 else
2080 (void) tls_error(US"ocsp decode", gnutls_strerror(rc), state->host);
2081 }
2082
2b4a568d 2083 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
018058b2
JH
2084 {
2085 tls_out.ocsp = OCSP_FAILED;
2b4a568d 2086 return tls_error(US"certificate status check failed", NULL, state->host);
018058b2 2087 }
2b4a568d 2088 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
44662487 2089 tls_out.ocsp = OCSP_VFIED;
2b4a568d
JH
2090 }
2091#endif
2092
17c76198 2093/* Figure out peer DN, and if authenticated, etc. */
059ec3d9 2094
2b4a568d
JH
2095if ((rc = peer_status(state)) != OK)
2096 return rc;
059ec3d9 2097
4fe99a6c 2098/* Sets various Exim expansion variables; may need to adjust for ACL callouts */
059ec3d9 2099
9d1c15ef 2100extract_exim_vars_from_tls_state(state);
059ec3d9 2101
059ec3d9
PH
2102return OK;
2103}
2104
2105
2106
17c76198 2107
059ec3d9 2108/*************************************************
17c76198 2109* Close down a TLS session *
059ec3d9
PH
2110*************************************************/
2111
17c76198
PP
2112/* This is also called from within a delivery subprocess forked from the
2113daemon, to shut down the TLS library, without actually doing a shutdown (which
2114would tamper with the TLS session in the parent process).
059ec3d9 2115
17c76198
PP
2116Arguments: TRUE if gnutls_bye is to be called
2117Returns: nothing
059ec3d9
PH
2118*/
2119
17c76198 2120void
817d9f57 2121tls_close(BOOL is_server, BOOL shutdown)
059ec3d9 2122{
817d9f57 2123exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
059ec3d9 2124
389ca47a 2125if (!state->tlsp || state->tlsp->active < 0) return; /* TLS was not active */
17c76198
PP
2126
2127if (shutdown)
2128 {
f5723109 2129 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS\n");
17c76198
PP
2130 gnutls_bye(state->session, GNUTLS_SHUT_WR);
2131 }
2132
2133gnutls_deinit(state->session);
ed62aae3
HSHR
2134gnutls_certificate_free_credentials(state->x509_cred);
2135
17c76198 2136
389ca47a 2137state->tlsp->active = -1;
17c76198
PP
2138memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
2139
2140if ((state_server.session == NULL) && (state_client.session == NULL))
2141 {
2142 gnutls_global_deinit();
2143 exim_gnutls_base_init_done = FALSE;
2144 }
7199e1ee 2145
059ec3d9
PH
2146}
2147
2148
2149
17c76198 2150
059ec3d9
PH
2151/*************************************************
2152* TLS version of getc *
2153*************************************************/
2154
2155/* This gets the next byte from the TLS input buffer. If the buffer is empty,
2156it refills the buffer via the GnuTLS reading function.
817d9f57 2157Only used by the server-side TLS.
059ec3d9 2158
17c76198
PP
2159This feeds DKIM and should be used for all message-body reads.
2160
bd8fbe36 2161Arguments: lim Maximum amount to read/bufffer
059ec3d9
PH
2162Returns: the next character or EOF
2163*/
2164
2165int
bd8fbe36 2166tls_getc(unsigned lim)
059ec3d9 2167{
817d9f57 2168exim_gnutls_state_st *state = &state_server;
17c76198 2169if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
059ec3d9 2170 {
17c76198 2171 ssize_t inbytes;
059ec3d9 2172
17c76198
PP
2173 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
2174 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
059ec3d9
PH
2175
2176 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
17c76198 2177 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
bd8fbe36 2178 MIN(ssl_xfer_buffer_size, lim));
059ec3d9
PH
2179 alarm(0);
2180
60d10ce7
JH
2181 /* Timeouts do not get this far; see command_timeout_handler().
2182 A zero-byte return appears to mean that the TLS session has been
059ec3d9
PH
2183 closed down, not that the socket itself has been closed down. Revert to
2184 non-TLS handling. */
2185
60d10ce7
JH
2186 if (sigalrm_seen)
2187 {
2188 DEBUG(D_tls) debug_printf("Got tls read timeout\n");
2189 state->xfer_error = 1;
2190 return EOF;
2191 }
2192
2193 else if (inbytes == 0)
059ec3d9
PH
2194 {
2195 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2196
2197 receive_getc = smtp_getc;
584e96c6 2198 receive_get_cache = smtp_get_cache;
059ec3d9
PH
2199 receive_ungetc = smtp_ungetc;
2200 receive_feof = smtp_feof;
2201 receive_ferror = smtp_ferror;
58eb016e 2202 receive_smtp_buffered = smtp_buffered;
059ec3d9 2203
17c76198 2204 gnutls_deinit(state->session);
ed62aae3
HSHR
2205 gnutls_certificate_free_credentials(state->x509_cred);
2206
17c76198 2207 state->session = NULL;
817d9f57
JH
2208 state->tlsp->active = -1;
2209 state->tlsp->bits = 0;
2210 state->tlsp->certificate_verified = FALSE;
9d1c15ef 2211 tls_channelbinding_b64 = NULL;
817d9f57 2212 state->tlsp->cipher = NULL;
9d1c15ef 2213 state->tlsp->peercert = NULL;
817d9f57 2214 state->tlsp->peerdn = NULL;
059ec3d9 2215
bd8fbe36 2216 return smtp_getc(lim);
059ec3d9
PH
2217 }
2218
2219 /* Handle genuine errors */
2220
2221 else if (inbytes < 0)
2222 {
17c76198
PP
2223 record_io_error(state, (int) inbytes, US"recv", NULL);
2224 state->xfer_error = 1;
059ec3d9
PH
2225 return EOF;
2226 }
80a47a2c 2227#ifndef DISABLE_DKIM
17c76198 2228 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
80a47a2c 2229#endif
17c76198
PP
2230 state->xfer_buffer_hwm = (int) inbytes;
2231 state->xfer_buffer_lwm = 0;
059ec3d9
PH
2232 }
2233
059ec3d9
PH
2234/* Something in the buffer; return next uschar */
2235
17c76198 2236return state->xfer_buffer[state->xfer_buffer_lwm++];
059ec3d9
PH
2237}
2238
584e96c6
JH
2239void
2240tls_get_cache()
2241{
9960d1e5 2242#ifndef DISABLE_DKIM
584e96c6
JH
2243exim_gnutls_state_st * state = &state_server;
2244int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
2245if (n > 0)
2246 dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
584e96c6 2247#endif
9960d1e5 2248}
584e96c6 2249
059ec3d9
PH
2250
2251
17c76198 2252
059ec3d9
PH
2253/*************************************************
2254* Read bytes from TLS channel *
2255*************************************************/
2256
17c76198
PP
2257/* This does not feed DKIM, so if the caller uses this for reading message body,
2258then the caller must feed DKIM.
817d9f57 2259
059ec3d9
PH
2260Arguments:
2261 buff buffer of data
2262 len size of buffer
2263
2264Returns: the number of bytes read
2265 -1 after a failed read
2266*/
2267
2268int
817d9f57 2269tls_read(BOOL is_server, uschar *buff, size_t len)
059ec3d9 2270{
817d9f57 2271exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
17c76198 2272ssize_t inbytes;
059ec3d9 2273
17c76198
PP
2274if (len > INT_MAX)
2275 len = INT_MAX;
059ec3d9 2276
17c76198
PP
2277if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
2278 DEBUG(D_tls)
2279 debug_printf("*** PROBABLY A BUG *** " \
2280 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
2281 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
2282
2283DEBUG(D_tls)
2284 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
2285 state->session, buff, len);
2286
2287inbytes = gnutls_record_recv(state->session, buff, len);
059ec3d9
PH
2288if (inbytes > 0) return inbytes;
2289if (inbytes == 0)
2290 {
2291 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2292 }
17c76198 2293else record_io_error(state, (int)inbytes, US"recv", NULL);
059ec3d9
PH
2294
2295return -1;
2296}
2297
2298
2299
17c76198 2300
059ec3d9
PH
2301/*************************************************
2302* Write bytes down TLS channel *
2303*************************************************/
2304
2305/*
2306Arguments:
817d9f57 2307 is_server channel specifier
059ec3d9
PH
2308 buff buffer of data
2309 len number of bytes
2310
2311Returns: the number of bytes after a successful write,
2312 -1 after a failed write
2313*/
2314
2315int
817d9f57 2316tls_write(BOOL is_server, const uschar *buff, size_t len)
059ec3d9 2317{
17c76198
PP
2318ssize_t outbytes;
2319size_t left = len;
817d9f57 2320exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
059ec3d9 2321
17c76198 2322DEBUG(D_tls) debug_printf("tls_do_write(%p, " SIZE_T_FMT ")\n", buff, left);
059ec3d9
PH
2323while (left > 0)
2324 {
17c76198
PP
2325 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
2326 buff, left);
2327 outbytes = gnutls_record_send(state->session, buff, left);
059ec3d9 2328
17c76198 2329 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
059ec3d9
PH
2330 if (outbytes < 0)
2331 {
17c76198 2332 record_io_error(state, outbytes, US"send", NULL);
059ec3d9
PH
2333 return -1;
2334 }
2335 if (outbytes == 0)
2336 {
17c76198 2337 record_io_error(state, 0, US"send", US"TLS channel closed on write");
059ec3d9
PH
2338 return -1;
2339 }
2340
2341 left -= outbytes;
2342 buff += outbytes;
2343 }
2344
17c76198
PP
2345if (len > INT_MAX)
2346 {
2347 DEBUG(D_tls)
2348 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
2349 len);
2350 len = INT_MAX;
2351 }
2352
2353return (int) len;
059ec3d9
PH
2354}
2355
2356
2357
17c76198 2358
059ec3d9 2359/*************************************************
17c76198 2360* Random number generation *
059ec3d9
PH
2361*************************************************/
2362
17c76198
PP
2363/* Pseudo-random number generation. The result is not expected to be
2364cryptographically strong but not so weak that someone will shoot themselves
2365in the foot using it as a nonce in input in some email header scheme or
2366whatever weirdness they'll twist this into. The result should handle fork()
2367and avoid repeating sequences. OpenSSL handles that for us.
059ec3d9 2368
17c76198
PP
2369Arguments:
2370 max range maximum
2371Returns a random number in range [0, max-1]
059ec3d9
PH
2372*/
2373
af3498d6 2374#ifdef HAVE_GNUTLS_RND
17c76198
PP
2375int
2376vaguely_random_number(int max)
059ec3d9 2377{
17c76198
PP
2378unsigned int r;
2379int i, needed_len;
2380uschar *p;
2381uschar smallbuf[sizeof(r)];
2382
2383if (max <= 1)
2384 return 0;
2385
2386needed_len = sizeof(r);
2387/* Don't take 8 times more entropy than needed if int is 8 octets and we were
2388 * asked for a number less than 10. */
2389for (r = max, i = 0; r; ++i)
2390 r >>= 1;
2391i = (i + 7) / 8;
2392if (i < needed_len)
2393 needed_len = i;
2394
2395i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
2396if (i < 0)
059ec3d9 2397 {
17c76198
PP
2398 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
2399 return vaguely_random_number_fallback(max);
2400 }
2401r = 0;
2402for (p = smallbuf; needed_len; --needed_len, ++p)
2403 {
2404 r *= 256;
2405 r += *p;
059ec3d9
PH
2406 }
2407
17c76198
PP
2408/* We don't particularly care about weighted results; if someone wants
2409 * smooth distribution and cares enough then they should submit a patch then. */
2410return r % max;
059ec3d9 2411}
af3498d6
PP
2412#else /* HAVE_GNUTLS_RND */
2413int
2414vaguely_random_number(int max)
2415{
2416 return vaguely_random_number_fallback(max);
2417}
2418#endif /* HAVE_GNUTLS_RND */
059ec3d9 2419
36f12725
NM
2420
2421
2422
2423/*************************************************
3375e053
PP
2424* Let tls_require_ciphers be checked at startup *
2425*************************************************/
2426
2427/* The tls_require_ciphers option, if set, must be something which the
2428library can parse.
2429
2430Returns: NULL on success, or error message
2431*/
2432
2433uschar *
2434tls_validate_require_cipher(void)
2435{
2436int rc;
2437uschar *expciphers = NULL;
2438gnutls_priority_t priority_cache;
2439const char *errpos;
2440
2441#define validate_check_rc(Label) do { \
2442 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
2443 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
2444#define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
2445
2446if (exim_gnutls_base_init_done)
2447 log_write(0, LOG_MAIN|LOG_PANIC,
2448 "already initialised GnuTLS, Exim developer bug");
2449
a5f239e4 2450#ifdef HAVE_GNUTLS_PKCS11
2519e60d 2451if (!gnutls_allow_auto_pkcs11)
a5f239e4
PP
2452 {
2453 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
2454 validate_check_rc(US"gnutls_pkcs11_init");
2455 }
2456#endif
3375e053
PP
2457rc = gnutls_global_init();
2458validate_check_rc(US"gnutls_global_init()");
2459exim_gnutls_base_init_done = TRUE;
2460
2461if (!(tls_require_ciphers && *tls_require_ciphers))
2462 return_deinit(NULL);
2463
2464if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
2465 return_deinit(US"failed to expand tls_require_ciphers");
2466
2467if (!(expciphers && *expciphers))
2468 return_deinit(NULL);
2469
2470DEBUG(D_tls)
2471 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2472
2473rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
2474validate_check_rc(string_sprintf(
2475 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
2476 expciphers, errpos - CS expciphers, errpos));
2477
2478#undef return_deinit
2479#undef validate_check_rc
2480gnutls_global_deinit();
2481
2482return NULL;
2483}
2484
2485
2486
2487
2488/*************************************************
36f12725
NM
2489* Report the library versions. *
2490*************************************************/
2491
2492/* See a description in tls-openssl.c for an explanation of why this exists.
2493
2494Arguments: a FILE* to print the results to
2495Returns: nothing
2496*/
2497
2498void
2499tls_version_report(FILE *f)
2500{
754a0503
PP
2501fprintf(f, "Library version: GnuTLS: Compile: %s\n"
2502 " Runtime: %s\n",
2503 LIBGNUTLS_VERSION,
2504 gnutls_check_version(NULL));
36f12725
NM
2505}
2506
2b4a568d
JH
2507/* vi: aw ai sw=2
2508*/
059ec3d9 2509/* End of tls-gnu.c */