GnuTLS: Move to more-modern stapling API
[exim.git] / src / src / tls-gnu.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
f9ba5e22 5/* Copyright (c) University of Cambridge 1995 - 2018 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
17c76198 8/* Copyright (c) Phil Pennock 2012 */
059ec3d9 9
17c76198
PP
10/* This file provides TLS/SSL support for Exim using the GnuTLS library,
11one of the available supported implementations. This file is #included into
12tls.c when USE_GNUTLS has been set.
059ec3d9 13
17c76198
PP
14The code herein is a revamp of GnuTLS integration using the current APIs; the
15original tls-gnu.c was based on a patch which was contributed by Nikos
6aa6fc9c 16Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
17c76198 17appropriate.
059ec3d9 18
17c76198
PP
19APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20which is not widely deployed by OS vendors. Will note issues below, which may
21assist in updating the code in the future. Another sources of hints is
22mod_gnutls for Apache (SNI callback registration and handling).
059ec3d9 23
17c76198
PP
24Keeping client and server variables more split than before and is currently
25the norm, in anticipation of TLS in ACL callouts.
059ec3d9 26
17c76198
PP
27I wanted to switch to gnutls_certificate_set_verify_function() so that
28certificate rejection could happen during handshake where it belongs, rather
29than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30(6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
059ec3d9 31
17c76198
PP
32(I wasn't looking for libraries quite that old, when updating to get rid of
33compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34require current GnuTLS, then we'll drop support for the ancient libraries).
35*/
b5aea5e1 36
17c76198
PP
37#include <gnutls/gnutls.h>
38/* needed for cert checks in verification and DN extraction: */
39#include <gnutls/x509.h>
40/* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41#include <gnutls/crypto.h>
184384c3 42
a5f239e4
PP
43/* needed to disable PKCS11 autoload unless requested */
44#if GNUTLS_VERSION_NUMBER >= 0x020c00
45# include <gnutls/pkcs11.h>
76075bb5 46# define SUPPORT_PARAM_TO_PK_BITS
a5f239e4 47#endif
7e07527a
JH
48#if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
49# warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
50# define DISABLE_OCSP
51#endif
0cbf2b82 52#if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
774ef2d7 53# warning "GnuTLS library version too old; tls:cert event unsupported"
0cbf2b82 54# define DISABLE_EVENT
a7538db1 55#endif
a7fec7a7
JH
56#if GNUTLS_VERSION_NUMBER >= 0x030306
57# define SUPPORT_CA_DIR
58#else
59# undef SUPPORT_CA_DIR
60#endif
11a04b5a 61#if GNUTLS_VERSION_NUMBER >= 0x030014
cb1d7830
JH
62# define SUPPORT_SYSDEFAULT_CABUNDLE
63#endif
184384c3
JH
64#if GNUTLS_VERSION_NUMBER >= 0x030104
65# define GNUTLS_CERT_VFY_STATUS_PRINT
66#endif
925ac8e4
JH
67#if GNUTLS_VERSION_NUMBER >= 0x030109
68# define SUPPORT_CORK
69#endif
f20cfa4a
JH
70#if GNUTLS_VERSION_NUMBER >= 0x03010a
71# define SUPPORT_GNUTLS_SESS_DESC
72#endif
73#if GNUTLS_VERSION_NUMBER >= 0x030500
74# define SUPPORT_GNUTLS_KEYLOG
75#endif
47195144
JH
76#if GNUTLS_VERSION_NUMBER >= 0x030506 && !defined(DISABLE_OCSP)
77# define SUPPORT_SRV_OCSP_STACK
78#endif
c0635b6d
JH
79
80#ifdef SUPPORT_DANE
81# if GNUTLS_VERSION_NUMBER >= 0x030000
82# define DANESSL_USAGE_DANE_TA 2
83# define DANESSL_USAGE_DANE_EE 3
84# else
85# error GnuTLS version too early for DANE
86# endif
87# if GNUTLS_VERSION_NUMBER < 0x999999
88# define GNUTLS_BROKEN_DANE_VALIDATION
89# endif
899b8bbc 90#endif
7e07527a 91
43e2db44
JH
92#ifdef EXPERIMENTAL_TLS_RESUME
93# if GNUTLS_VERSION_NUMBER < 0x030603
94# error GNUTLS version too early for session-resumption
95# endif
96#endif
97
f2de3a33 98#ifndef DISABLE_OCSP
2b4a568d
JH
99# include <gnutls/ocsp.h>
100#endif
899b8bbc
JH
101#ifdef SUPPORT_DANE
102# include <gnutls/dane.h>
103#endif
059ec3d9 104
f1be21cf
JH
105#include "tls-cipher-stdname.c"
106
107
b10c87b3
JH
108#ifdef MACRO_PREDEF
109void
110options_tls(void)
111{
112# ifdef EXPERIMENTAL_TLS_RESUME
113builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
114# endif
115}
116#else
117
118
17c76198 119/* GnuTLS 2 vs 3
059ec3d9 120
17c76198
PP
121GnuTLS 3 only:
122 gnutls_global_set_audit_log_function()
059ec3d9 123
17c76198
PP
124Changes:
125 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
126*/
059ec3d9 127
17c76198 128/* Local static variables for GnuTLS */
059ec3d9 129
17c76198 130/* Values for verify_requirement */
059ec3d9 131
e51c7be2 132enum peer_verify_requirement
899b8bbc 133 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED, VERIFY_DANE };
059ec3d9 134
17c76198
PP
135/* This holds most state for server or client; with this, we can set up an
136outbound TLS-enabled connection in an ACL callout, while not stomping all
137over the TLS variables available for expansion.
059ec3d9 138
17c76198
PP
139Some of these correspond to variables in globals.c; those variables will
140be set to point to content in one of these instances, as appropriate for
141the stage of the process lifetime.
059ec3d9 142
389ca47a 143Not handled here: global tls_channelbinding_b64.
17c76198 144*/
059ec3d9 145
17c76198 146typedef struct exim_gnutls_state {
9d1c15ef 147 gnutls_session_t session;
17c76198 148 gnutls_certificate_credentials_t x509_cred;
9d1c15ef 149 gnutls_priority_t priority_cache;
17c76198 150 enum peer_verify_requirement verify_requirement;
9d1c15ef
JH
151 int fd_in;
152 int fd_out;
153 BOOL peer_cert_verified;
899b8bbc 154 BOOL peer_dane_verified;
9d1c15ef
JH
155 BOOL trigger_sni_changes;
156 BOOL have_set_peerdn;
5fd28bb8 157 const struct host_item *host; /* NULL if server */
afdb5e9c 158 gnutls_x509_crt_t peercert;
9d1c15ef
JH
159 uschar *peerdn;
160 uschar *ciphersuite;
161 uschar *received_sni;
17c76198
PP
162
163 const uschar *tls_certificate;
164 const uschar *tls_privatekey;
165 const uschar *tls_sni; /* client send only, not received */
166 const uschar *tls_verify_certificates;
167 const uschar *tls_crl;
168 const uschar *tls_require_ciphers;
e51c7be2 169
17c76198
PP
170 uschar *exp_tls_certificate;
171 uschar *exp_tls_privatekey;
17c76198
PP
172 uschar *exp_tls_verify_certificates;
173 uschar *exp_tls_crl;
174 uschar *exp_tls_require_ciphers;
55414b25 175 const uschar *exp_tls_verify_cert_hostnames;
0cbf2b82 176#ifndef DISABLE_EVENT
a7538db1
JH
177 uschar *event_action;
178#endif
899b8bbc
JH
179#ifdef SUPPORT_DANE
180 char * const * dane_data;
181 const int * dane_data_len;
182#endif
17c76198 183
389ca47a 184 tls_support *tlsp; /* set in tls_init() */
817d9f57 185
17c76198
PP
186 uschar *xfer_buffer;
187 int xfer_buffer_lwm;
188 int xfer_buffer_hwm;
8b77d27a
JH
189 BOOL xfer_eof; /*XXX never gets set! */
190 BOOL xfer_error;
17c76198
PP
191} exim_gnutls_state_st;
192
193static const exim_gnutls_state_st exim_gnutls_state_init = {
b10c87b3 194 /* all elements not explicitly intialised here get 0/NULL/FALSE */
f2ed27cf
JH
195 .fd_in = -1,
196 .fd_out = -1,
17c76198 197};
83da1223 198
17c76198
PP
199/* Not only do we have our own APIs which don't pass around state, assuming
200it's held in globals, GnuTLS doesn't appear to let us register callback data
201for callbacks, or as part of the session, so we have to keep a "this is the
202context we're currently dealing with" pointer and rely upon being
203single-threaded to keep from processing data on an inbound TLS connection while
204talking to another TLS connection for an outbound check. This does mean that
205there's no way for heart-beats to be responded to, for the duration of the
a7538db1
JH
206second connection.
207XXX But see gnutls_session_get_ptr()
208*/
059ec3d9 209
74f1a423 210static exim_gnutls_state_st state_server;
059ec3d9 211
17c76198
PP
212/* dh_params are initialised once within the lifetime of a process using TLS;
213if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
214don't want to repeat this. */
83da1223 215
17c76198 216static gnutls_dh_params_t dh_server_params = NULL;
059ec3d9 217
dea4b568 218static int ssl_session_timeout = 7200; /* Two hours */
059ec3d9 219
fc243e94 220static const uschar * const exim_default_gnutls_priority = US"NORMAL";
83da1223 221
17c76198 222/* Guard library core initialisation */
83da1223 223
17c76198 224static BOOL exim_gnutls_base_init_done = FALSE;
059ec3d9 225
4fb7df6d 226#ifndef DISABLE_OCSP
9196d5bf 227static BOOL gnutls_buggy_ocsp = FALSE;
e5489333 228static BOOL exim_testharness_disable_ocsp_validity_check = FALSE;
4fb7df6d 229#endif
9196d5bf 230
b10c87b3
JH
231#ifdef EXPERIMENTAL_TLS_RESUME
232static gnutls_datum_t server_sessticket_key;
233#endif
059ec3d9 234
17c76198 235/* ------------------------------------------------------------------------ */
17c76198 236/* macros */
83da1223 237
17c76198 238#define MAX_HOST_LEN 255
83da1223 239
17c76198
PP
240/* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
241the library logging; a value less than 0 disables the calls to set up logging
dc6d1769
JH
242callbacks. GNuTLS also looks for an environment variable - except not for
243setuid binaries, making it useless - "GNUTLS_DEBUG_LEVEL".
244Allegedly the testscript line "GNUTLS_DEBUG_LEVEL=9 sudo exim ..." would work,
245but the env var must be added to /etc/sudoers too. */
2c17bb02 246#ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
b1a4f234 247# define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
2c17bb02 248#endif
83da1223 249
2c17bb02 250#ifndef EXIM_CLIENT_DH_MIN_BITS
a7538db1 251# define EXIM_CLIENT_DH_MIN_BITS 1024
2c17bb02 252#endif
83da1223 253
af3498d6
PP
254/* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
255can ask for a bit-strength. Without that, we stick to the constant we had
256before, for now. */
2c17bb02 257#ifndef EXIM_SERVER_DH_BITS_PRE2_12
a7538db1 258# define EXIM_SERVER_DH_BITS_PRE2_12 1024
2c17bb02 259#endif
af3498d6 260
cf0c6164
JH
261#define expand_check_tlsvar(Varname, errstr) \
262 expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr)
83da1223 263
17c76198 264#if GNUTLS_VERSION_NUMBER >= 0x020c00
e51c7be2
JH
265# define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
266# define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
267# define HAVE_GNUTLS_RND
2519e60d
TL
268/* The security fix we provide with the gnutls_allow_auto_pkcs11 option
269 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
270 * isn't available sometimes, so this needs to become a conditional
271 * compilation; the sanest way to deal with this being a problem on
272 * older OSes is to block it in the Local/Makefile with this compiler
273 * definition */
e51c7be2
JH
274# ifndef AVOID_GNUTLS_PKCS11
275# define HAVE_GNUTLS_PKCS11
276# endif /* AVOID_GNUTLS_PKCS11 */
17c76198 277#endif
83da1223 278
af3498d6
PP
279
280
281
282/* ------------------------------------------------------------------------ */
283/* Callback declarations */
284
285#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
286static void exim_gnutls_logger_cb(int level, const char *message);
287#endif
288
289static int exim_sni_handling_cb(gnutls_session_t session);
290
e5489333 291#if !defined(DISABLE_OCSP)
44662487
JH
292static int server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
293 gnutls_datum_t * ocsp_response);
294#endif
af3498d6 295
e5489333
JH
296#ifdef EXPERIMENTAL_TLS_RESUME
297static int
298tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
299 unsigned incoming, const gnutls_datum_t * msg);
300#endif
af3498d6
PP
301
302
b10c87b3
JH
303/* Daemon one-time initialisation */
304void
305tls_daemon_init(void)
306{
307#ifdef EXPERIMENTAL_TLS_RESUME
308/* We are dependent on the GnuTLS implementation of the Session Ticket
309encryption; both the strength and the key rotation period. We hope that
310the strength at least matches that of the ciphersuite (but GnuTLS does not
311document this). */
312
313static BOOL once = FALSE;
314if (once) return;
315once = TRUE;
316gnutls_session_ticket_key_generate(&server_sessticket_key); /* >= 2.10.0 */
317if (f.running_in_test_harness) ssl_session_timeout = 6;
318#endif
319}
320
17c76198
PP
321/* ------------------------------------------------------------------------ */
322/* Static functions */
059ec3d9
PH
323
324/*************************************************
325* Handle TLS error *
326*************************************************/
327
328/* Called from lots of places when errors occur before actually starting to do
329the TLS handshake, that is, while the session is still in clear. Always returns
330DEFER for a server and FAIL for a client so that most calls can use "return
331tls_error(...)" to do this processing and then give an appropriate return. A
332single function is used for both server and client, because it is called from
333some shared functions.
334
335Argument:
336 prefix text to include in the logged error
7199e1ee
TF
337 msg additional error string (may be NULL)
338 usually obtained from gnutls_strerror()
17c76198
PP
339 host NULL if setting up a server;
340 the connected host if setting up a client
cf0c6164 341 errstr pointer to returned error string
059ec3d9
PH
342
343Returns: OK/DEFER/FAIL
344*/
345
346static int
48224640 347tls_error(const uschar *prefix, const uschar *msg, const host_item *host,
cf0c6164 348 uschar ** errstr)
059ec3d9 349{
cf0c6164 350if (errstr)
48224640 351 *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : US"");
cf0c6164 352return host ? FAIL : DEFER;
059ec3d9
PH
353}
354
355
452a164f
JH
356static int
357tls_error_gnu(const uschar *prefix, int err, const host_item *host,
358 uschar ** errstr)
359{
360return tls_error(prefix, US gnutls_strerror(err), host, errstr);
361}
362
363static int
364tls_error_sys(const uschar *prefix, int err, const host_item *host,
365 uschar ** errstr)
366{
367return tls_error(prefix, US strerror(err), host, errstr);
368}
059ec3d9 369
17c76198 370
059ec3d9 371/*************************************************
17c76198 372* Deal with logging errors during I/O *
059ec3d9
PH
373*************************************************/
374
17c76198 375/* We have to get the identity of the peer from saved data.
059ec3d9 376
17c76198
PP
377Argument:
378 state the current GnuTLS exim state container
379 rc the GnuTLS error code, or 0 if it's a local error
380 when text identifying read or write
95f52235 381 text local error text when rc is 0
059ec3d9 382
17c76198 383Returns: nothing
059ec3d9
PH
384*/
385
17c76198
PP
386static void
387record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
059ec3d9 388{
48224640 389const uschar * msg;
cf0c6164 390uschar * errstr;
059ec3d9 391
17c76198 392if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
95f52235 393 msg = string_sprintf("A TLS fatal alert has been received: %s",
17c76198
PP
394 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
395else
48224640 396 msg = US gnutls_strerror(rc);
059ec3d9 397
cf0c6164
JH
398(void) tls_error(when, msg, state->host, &errstr);
399
400if (state->host)
401 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection %s",
402 state->host->name, state->host->address, errstr);
403else
404 {
405 uschar * conn_info = smtp_get_connection_info();
406 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0) conn_info += 5;
407 /* I'd like to get separated H= here, but too hard for now */
408 log_write(0, LOG_MAIN, "TLS error on %s %s", conn_info, errstr);
409 }
17c76198 410}
059ec3d9 411
059ec3d9 412
059ec3d9 413
059ec3d9 414
17c76198
PP
415/*************************************************
416* Set various Exim expansion vars *
417*************************************************/
059ec3d9 418
e51c7be2
JH
419#define exim_gnutls_cert_err(Label) \
420 do \
421 { \
422 if (rc != GNUTLS_E_SUCCESS) \
423 { \
424 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
425 (Label), gnutls_strerror(rc)); \
426 return rc; \
427 } \
428 } while (0)
9d1c15ef
JH
429
430static int
27f19eb4 431import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
9d1c15ef
JH
432{
433int rc;
434
435rc = gnutls_x509_crt_init(crtp);
436exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
437
438rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
439exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
440
441return rc;
442}
443
444#undef exim_gnutls_cert_err
445
446
17c76198
PP
447/* We set various Exim global variables from the state, once a session has
448been established. With TLS callouts, may need to change this to stack
449variables, or just re-call it with the server state after client callout
450has finished.
059ec3d9 451
9d1c15ef 452Make sure anything set here is unset in tls_getc().
17c76198
PP
453
454Sets:
455 tls_active fd
456 tls_bits strength indicator
457 tls_certificate_verified bool indicator
458 tls_channelbinding_b64 for some SASL mechanisms
459 tls_cipher a string
9d1c15ef 460 tls_peercert pointer to library internal
17c76198
PP
461 tls_peerdn a string
462 tls_sni a (UTF-8) string
9d1c15ef 463 tls_ourcert pointer to library internal
17c76198
PP
464
465Argument:
466 state the relevant exim_gnutls_state_st *
467*/
468
469static void
9d1c15ef 470extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
17c76198 471{
17c76198
PP
472#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
473int old_pool;
474int rc;
475gnutls_datum_t channel;
476#endif
9d1c15ef 477tls_support * tlsp = state->tlsp;
17c76198 478
74f1a423
JH
479tlsp->active.sock = state->fd_out;
480tlsp->active.tls_ctx = state;
17c76198 481
817d9f57 482DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
17c76198 483
9d1c15ef 484tlsp->certificate_verified = state->peer_cert_verified;
899b8bbc
JH
485#ifdef SUPPORT_DANE
486tlsp->dane_verified = state->peer_dane_verified;
487#endif
059ec3d9 488
17c76198
PP
489/* note that tls_channelbinding_b64 is not saved to the spool file, since it's
490only available for use for authenticators while this TLS session is running. */
491
492tls_channelbinding_b64 = NULL;
493#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
494channel.data = NULL;
495channel.size = 0;
1f20760b
JH
496if ((rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel)))
497 { DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc)); }
498else
499 {
17c76198
PP
500 old_pool = store_pool;
501 store_pool = POOL_PERM;
1f20760b 502 tls_channelbinding_b64 = b64encode(CUS channel.data, (int)channel.size);
17c76198
PP
503 store_pool = old_pool;
504 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
1f20760b 505 }
17c76198
PP
506#endif
507
9d1c15ef
JH
508/* peercert is set in peer_status() */
509tlsp->peerdn = state->peerdn;
510tlsp->sni = state->received_sni;
511
512/* record our certificate */
513 {
27f19eb4 514 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
9d1c15ef
JH
515 gnutls_x509_crt_t crt;
516
517 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
518 }
059ec3d9
PH
519}
520
521
522
17c76198 523
059ec3d9 524/*************************************************
575643cd 525* Setup up DH parameters *
059ec3d9
PH
526*************************************************/
527
575643cd 528/* Generating the D-H parameters may take a long time. They only need to
059ec3d9
PH
529be re-generated every so often, depending on security policy. What we do is to
530keep these parameters in a file in the spool directory. If the file does not
531exist, we generate them. This means that it is easy to cause a regeneration.
532
533The new file is written as a temporary file and renamed, so that an incomplete
534file is never present. If two processes both compute some new parameters, you
535waste a bit of effort, but it doesn't seem worth messing around with locking to
536prevent this.
537
059ec3d9
PH
538Returns: OK/DEFER/FAIL
539*/
540
541static int
cf0c6164 542init_server_dh(uschar ** errstr)
059ec3d9 543{
17c76198
PP
544int fd, rc;
545unsigned int dh_bits;
27f19eb4 546gnutls_datum_t m;
a799883d
PP
547uschar filename_buf[PATH_MAX];
548uschar *filename = NULL;
17c76198 549size_t sz;
a799883d
PP
550uschar *exp_tls_dhparam;
551BOOL use_file_in_spool = FALSE;
17c76198 552host_item *host = NULL; /* dummy for macros */
059ec3d9 553
17c76198 554DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
059ec3d9 555
452a164f
JH
556if ((rc = gnutls_dh_params_init(&dh_server_params)))
557 return tls_error_gnu(US"gnutls_dh_params_init", rc, host, errstr);
059ec3d9 558
a799883d
PP
559m.data = NULL;
560m.size = 0;
561
cf0c6164 562if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam, errstr))
a799883d
PP
563 return DEFER;
564
565if (!exp_tls_dhparam)
566 {
567 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
568 m.data = US std_dh_prime_default();
569 m.size = Ustrlen(m.data);
570 }
571else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
572 use_file_in_spool = TRUE;
573else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
574 {
575 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
576 return OK;
577 }
578else if (exp_tls_dhparam[0] != '/')
579 {
f5d25c2b 580 if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
48224640 581 return tls_error(US"No standard prime named", exp_tls_dhparam, NULL, errstr);
a799883d
PP
582 m.size = Ustrlen(m.data);
583 }
584else
a799883d 585 filename = exp_tls_dhparam;
a799883d
PP
586
587if (m.data)
588 {
452a164f
JH
589 if ((rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM)))
590 return tls_error_gnu(US"gnutls_dh_params_import_pkcs3", rc, host, errstr);
a799883d
PP
591 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
592 return OK;
593 }
594
af3498d6
PP
595#ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
596/* If you change this constant, also change dh_param_fn_ext so that we can use a
17c76198 597different filename and ensure we have sufficient bits. */
452a164f
JH
598
599if (!(dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL)))
cf0c6164 600 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL, errstr);
af3498d6 601DEBUG(D_tls)
b34fc30c 602 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
af3498d6
PP
603 dh_bits);
604#else
605dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
606DEBUG(D_tls)
607 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
608 dh_bits);
609#endif
059ec3d9 610
3375e053
PP
611/* Some clients have hard-coded limits. */
612if (dh_bits > tls_dh_max_bits)
613 {
614 DEBUG(D_tls)
615 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
616 tls_dh_max_bits);
617 dh_bits = tls_dh_max_bits;
618 }
619
a799883d
PP
620if (use_file_in_spool)
621 {
622 if (!string_format(filename_buf, sizeof(filename_buf),
623 "%s/gnutls-params-%d", spool_directory, dh_bits))
cf0c6164 624 return tls_error(US"overlong filename", NULL, NULL, errstr);
a799883d
PP
625 filename = filename_buf;
626 }
059ec3d9 627
b5aea5e1 628/* Open the cache file for reading and if successful, read it and set up the
575643cd 629parameters. */
059ec3d9 630
f5d25c2b 631if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
059ec3d9 632 {
b5aea5e1 633 struct stat statbuf;
17c76198
PP
634 FILE *fp;
635 int saved_errno;
636
637 if (fstat(fd, &statbuf) < 0) /* EIO */
638 {
639 saved_errno = errno;
640 (void)close(fd);
452a164f 641 return tls_error_sys(US"TLS cache stat failed", saved_errno, NULL, errstr);
17c76198
PP
642 }
643 if (!S_ISREG(statbuf.st_mode))
b5aea5e1
PH
644 {
645 (void)close(fd);
cf0c6164 646 return tls_error(US"TLS cache not a file", NULL, NULL, errstr);
17c76198 647 }
40c90bca 648 if (!(fp = fdopen(fd, "rb")))
17c76198
PP
649 {
650 saved_errno = errno;
651 (void)close(fd);
452a164f
JH
652 return tls_error_sys(US"fdopen(TLS cache stat fd) failed",
653 saved_errno, NULL, errstr);
b5aea5e1 654 }
059ec3d9 655
b5aea5e1 656 m.size = statbuf.st_size;
f3ebb786 657 if (!(m.data = store_malloc(m.size)))
17c76198
PP
658 {
659 fclose(fp);
452a164f 660 return tls_error_sys(US"malloc failed", errno, NULL, errstr);
17c76198 661 }
40c90bca 662 if (!(sz = fread(m.data, m.size, 1, fp)))
17c76198
PP
663 {
664 saved_errno = errno;
665 fclose(fp);
f3ebb786 666 store_free(m.data);
452a164f 667 return tls_error_sys(US"fread failed", saved_errno, NULL, errstr);
17c76198
PP
668 }
669 fclose(fp);
b5aea5e1 670
17c76198 671 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
f3ebb786 672 store_free(m.data);
452a164f
JH
673 if (rc)
674 return tls_error_gnu(US"gnutls_dh_params_import_pkcs3", rc, host, errstr);
17c76198 675 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
b5aea5e1
PH
676 }
677
678/* If the file does not exist, fall through to compute new data and cache it.
679If there was any other opening error, it is serious. */
680
182ad5cf
PH
681else if (errno == ENOENT)
682 {
17c76198 683 rc = -1;
182ad5cf 684 DEBUG(D_tls)
17c76198 685 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
182ad5cf
PH
686 }
687else
17c76198 688 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
cf0c6164 689 NULL, NULL, errstr);
b5aea5e1
PH
690
691/* If ret < 0, either the cache file does not exist, or the data it contains
692is not useful. One particular case of this is when upgrading from an older
693release of Exim in which the data was stored in a different format. We don't
694try to be clever and support both formats; we just regenerate new data in this
695case. */
696
17c76198 697if (rc < 0)
b5aea5e1 698 {
17c76198 699 uschar *temp_fn;
201f5254 700 unsigned int dh_bits_gen = dh_bits;
059ec3d9 701
17c76198
PP
702 if ((PATH_MAX - Ustrlen(filename)) < 10)
703 return tls_error(US"Filename too long to generate replacement",
48224640 704 filename, NULL, errstr);
059ec3d9 705
48224640 706 temp_fn = string_copy(US"%s.XXXXXXX");
f5d25c2b 707 if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */
452a164f 708 return tls_error_sys(US"Unable to open temp file", errno, NULL, errstr);
b66fecb4 709 (void)exim_chown(temp_fn, exim_uid, exim_gid); /* Probably not necessary */
059ec3d9 710
201f5254
PP
711 /* GnuTLS overshoots!
712 * If we ask for 2236, we might get 2237 or more.
713 * But there's no way to ask GnuTLS how many bits there really are.
714 * We can ask how many bits were used in a TLS session, but that's it!
715 * The prime itself is hidden behind too much abstraction.
716 * So we ask for less, and proceed on a wing and a prayer.
717 * First attempt, subtracted 3 for 2233 and got 2240.
718 */
cae6e576 719 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
201f5254
PP
720 {
721 dh_bits_gen = dh_bits - 10;
722 DEBUG(D_tls)
723 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
724 dh_bits_gen);
725 }
726
727 DEBUG(D_tls)
728 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
729 dh_bits_gen);
452a164f
JH
730 if ((rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen)))
731 return tls_error_gnu(US"gnutls_dh_params_generate2", rc, host, errstr);
17c76198
PP
732
733 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
734 and I confirmed that a NULL call to get the size first is how the GnuTLS
735 sample apps handle this. */
736
737 sz = 0;
738 m.data = NULL;
452a164f
JH
739 if ( (rc = gnutls_dh_params_export_pkcs3(dh_server_params,
740 GNUTLS_X509_FMT_PEM, m.data, &sz))
741 && rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
742 return tls_error_gnu(US"gnutls_dh_params_export_pkcs3(NULL) sizing",
743 rc, host, errstr);
17c76198 744 m.size = sz;
f3ebb786 745 if (!(m.data = store_malloc(m.size)))
452a164f 746 return tls_error_sys(US"memory allocation failed", errno, NULL, errstr);
40c90bca 747
1f00591e 748 /* this will return a size 1 less than the allocation size above */
452a164f
JH
749 if ((rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
750 m.data, &sz)))
17c76198 751 {
f3ebb786 752 store_free(m.data);
452a164f 753 return tls_error_gnu(US"gnutls_dh_params_export_pkcs3() real", rc, host, errstr);
17c76198 754 }
1f00591e 755 m.size = sz; /* shrink by 1, probably */
059ec3d9 756
f5d25c2b 757 if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
17c76198 758 {
f3ebb786 759 store_free(m.data);
452a164f
JH
760 return tls_error_sys(US"TLS cache write D-H params failed",
761 errno, NULL, errstr);
17c76198 762 }
f3ebb786 763 store_free(m.data);
f5d25c2b 764 if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
452a164f
JH
765 return tls_error_sys(US"TLS cache write D-H params final newline failed",
766 errno, NULL, errstr);
17c76198 767
f5d25c2b 768 if ((rc = close(fd)))
452a164f 769 return tls_error_sys(US"TLS cache write close() failed", errno, NULL, errstr);
059ec3d9 770
17c76198 771 if (Urename(temp_fn, filename) < 0)
452a164f
JH
772 return tls_error_sys(string_sprintf("failed to rename \"%s\" as \"%s\"",
773 temp_fn, filename), errno, NULL, errstr);
059ec3d9 774
17c76198 775 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
059ec3d9
PH
776 }
777
17c76198 778DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
059ec3d9
PH
779return OK;
780}
781
782
783
784
23bb6982
JH
785/* Create and install a selfsigned certificate, for use in server mode */
786
787static int
cf0c6164 788tls_install_selfsign(exim_gnutls_state_st * state, uschar ** errstr)
23bb6982
JH
789{
790gnutls_x509_crt_t cert = NULL;
791time_t now;
792gnutls_x509_privkey_t pkey = NULL;
793const uschar * where;
794int rc;
795
796where = US"initialising pkey";
797if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
798
799where = US"initialising cert";
800if ((rc = gnutls_x509_crt_init(&cert))) goto err;
801
802where = US"generating pkey";
803if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
76075bb5 804#ifdef SUPPORT_PARAM_TO_PK_BITS
4312da48
JH
805# ifndef GNUTLS_SEC_PARAM_MEDIUM
806# define GNUTLS_SEC_PARAM_MEDIUM GNUTLS_SEC_PARAM_HIGH
807# endif
6aac3239 808 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_MEDIUM),
76075bb5 809#else
6aac3239 810 2048,
76075bb5
JH
811#endif
812 0)))
23bb6982
JH
813 goto err;
814
815where = US"configuring cert";
1613fd68 816now = 1;
23bb6982
JH
817if ( (rc = gnutls_x509_crt_set_version(cert, 3))
818 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
819 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
820 || (rc = gnutls_x509_crt_set_expiration_time(cert, now + 60 * 60)) /* 1 hr */
821 || (rc = gnutls_x509_crt_set_key(cert, pkey))
822
823 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
824 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
825 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
826 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
827 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
828 GNUTLS_OID_X520_COMMON_NAME, 0,
829 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
830 )
831 goto err;
832
833where = US"signing cert";
834if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
835
836where = US"installing selfsign cert";
837 /* Since: 2.4.0 */
838if ((rc = gnutls_certificate_set_x509_key(state->x509_cred, &cert, 1, pkey)))
839 goto err;
840
841rc = OK;
842
843out:
844 if (cert) gnutls_x509_crt_deinit(cert);
845 if (pkey) gnutls_x509_privkey_deinit(pkey);
846 return rc;
847
848err:
452a164f 849 rc = tls_error_gnu(where, rc, NULL, errstr);
23bb6982
JH
850 goto out;
851}
852
853
854
855
47195144
JH
856/* Add certificate and key, from files.
857
858Return:
859 Zero or negative: good. Negate value for certificate index if < 0.
860 Greater than zero: FAIL or DEFER code.
861*/
862
ba86e143
JH
863static int
864tls_add_certfile(exim_gnutls_state_st * state, const host_item * host,
865 uschar * certfile, uschar * keyfile, uschar ** errstr)
866{
e5489333
JH
867/*XXX returns certs index for gnutls_certificate_set_x509_key_file(),
868given suitable flags set */
869
ba86e143
JH
870int rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
871 CS certfile, CS keyfile, GNUTLS_X509_FMT_PEM);
47195144 872if (rc < 0)
452a164f 873 return tls_error_gnu(
47195144 874 string_sprintf("cert/key setup: cert=%s key=%s", certfile, keyfile),
452a164f 875 rc, host, errstr);
47195144 876return -rc;
ba86e143
JH
877}
878
879
e5489333
JH
880/* Make a note that we saw a status-request */
881static int
882tls_server_clienthello_ext(void * ctx, unsigned tls_id,
883 const unsigned char *data, unsigned size)
884{
885/* https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
886if (tls_id == 5) /* status_request */
887 {
888 DEBUG(D_tls) debug_printf("Seen status_request extension\n");
889 tls_in.ocsp = OCSP_NOT_RESP;
890 }
891return 0;
892}
893
894/* Callback for client-hello, on server, if we think we might serve stapled-OCSP */
895static int
896tls_server_clienthello_cb(gnutls_session_t session, unsigned int htype,
897 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
898{
899/* Call fn for each extension seen. 3.6.3 onwards */
900return gnutls_ext_raw_parse(NULL, tls_server_clienthello_ext, msg,
901 GNUTLS_EXT_RAW_FLAG_TLS_CLIENT_HELLO);
902}
903
904/* Callback for certificate-status, on server. We sent stapled OCSP. */
905static int
906tls_server_certstatus_cb(gnutls_session_t session, unsigned int htype,
907 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
908{
909DEBUG(D_tls) debug_printf("Sending certificate-status\n");
910#ifdef SUPPORT_SRV_OCSP_STACK
911tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
912 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
913#else
914tls_in.ocsp = OCSP_VFY_NOT_TRIED;
915#endif
916return 0;
917}
918
919/* Callback for handshake messages, on server */
920static int
921tls_server_hook_cb(gnutls_session_t sess, u_int htype, unsigned when,
922 unsigned incoming, const gnutls_datum_t * msg)
923{
924switch (htype)
925 {
926 case GNUTLS_HANDSHAKE_CLIENT_HELLO:
927 return tls_server_clienthello_cb(sess, htype, when, incoming, msg);
928 case GNUTLS_HANDSHAKE_CERTIFICATE_STATUS:
929 return tls_server_certstatus_cb(sess, htype, when, incoming, msg);
930#ifdef EXPERIMENTAL_TLS_RESUME
931 case GNUTLS_HANDSHAKE_NEW_SESSION_TICKET:
932 return tls_server_ticket_cb(sess, htype, when, incoming, msg);
933#endif
934 default:
935 return 0;
936 }
937}
938
939
940static void
941tls_server_testharness_ocsp_fiddle(void)
942{
943extern char ** environ;
944if (environ) for (uschar ** p = USS environ; *p; p++)
945 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
946 {
947 DEBUG(D_tls) debug_printf("Permitting known bad OCSP response\n");
948 exim_testharness_disable_ocsp_validity_check = TRUE;
949 }
950}
951
059ec3d9 952/*************************************************
17c76198 953* Variables re-expanded post-SNI *
059ec3d9
PH
954*************************************************/
955
17c76198
PP
956/* Called from both server and client code, via tls_init(), and also from
957the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
958
959We can tell the two apart by state->received_sni being non-NULL in callback.
960
961The callback should not call us unless state->trigger_sni_changes is true,
962which we are responsible for setting on the first pass through.
059ec3d9
PH
963
964Arguments:
17c76198 965 state exim_gnutls_state_st *
cf0c6164 966 errstr error string pointer
059ec3d9
PH
967
968Returns: OK/DEFER/FAIL
969*/
970
971static int
ba86e143 972tls_expand_session_files(exim_gnutls_state_st * state, uschar ** errstr)
059ec3d9 973{
1365611d 974struct stat statbuf;
059ec3d9 975int rc;
17c76198
PP
976const host_item *host = state->host; /* macro should be reconsidered? */
977uschar *saved_tls_certificate = NULL;
978uschar *saved_tls_privatekey = NULL;
979uschar *saved_tls_verify_certificates = NULL;
980uschar *saved_tls_crl = NULL;
981int cert_count;
982
983/* We check for tls_sni *before* expansion. */
2b4a568d 984if (!host) /* server */
17c76198
PP
985 if (!state->received_sni)
986 {
ba86e143
JH
987 if ( state->tls_certificate
988 && ( Ustrstr(state->tls_certificate, US"tls_sni")
989 || Ustrstr(state->tls_certificate, US"tls_in_sni")
990 || Ustrstr(state->tls_certificate, US"tls_out_sni")
991 ) )
17c76198
PP
992 {
993 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
994 state->trigger_sni_changes = TRUE;
995 }
996 }
997 else
998 {
1365611d 999 /* useful for debugging */
17c76198
PP
1000 saved_tls_certificate = state->exp_tls_certificate;
1001 saved_tls_privatekey = state->exp_tls_privatekey;
1002 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
1003 saved_tls_crl = state->exp_tls_crl;
1004 }
059ec3d9 1005
452a164f
JH
1006if ((rc = gnutls_certificate_allocate_credentials(&state->x509_cred)))
1007 return tls_error_gnu(US"gnutls_certificate_allocate_credentials",
1008 rc, host, errstr);
47195144
JH
1009
1010#ifdef SUPPORT_SRV_OCSP_STACK
1011gnutls_certificate_set_flags(state->x509_cred, GNUTLS_CERTIFICATE_API_V2);
1012#endif
1365611d 1013
17c76198
PP
1014/* remember: expand_check_tlsvar() is expand_check() but fiddling with
1015state members, assuming consistent naming; and expand_check() returns
1016false if expansion failed, unless expansion was forced to fail. */
059ec3d9 1017
17c76198
PP
1018/* check if we at least have a certificate, before doing expensive
1019D-H generation. */
059ec3d9 1020
cf0c6164 1021if (!expand_check_tlsvar(tls_certificate, errstr))
17c76198 1022 return DEFER;
059ec3d9 1023
17c76198 1024/* certificate is mandatory in server, optional in client */
059ec3d9 1025
23bb6982
JH
1026if ( !state->exp_tls_certificate
1027 || !*state->exp_tls_certificate
1028 )
2b4a568d 1029 if (!host)
cf0c6164 1030 return tls_install_selfsign(state, errstr);
17c76198
PP
1031 else
1032 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
059ec3d9 1033
cf0c6164 1034if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey, errstr))
059ec3d9
PH
1035 return DEFER;
1036
17c76198
PP
1037/* tls_privatekey is optional, defaulting to same file as certificate */
1038
1039if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
059ec3d9 1040 {
17c76198
PP
1041 state->tls_privatekey = state->tls_certificate;
1042 state->exp_tls_privatekey = state->exp_tls_certificate;
059ec3d9 1043 }
c91535f3 1044
059ec3d9 1045
17c76198 1046if (state->exp_tls_certificate && *state->exp_tls_certificate)
059ec3d9
PH
1047 {
1048 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
17c76198
PP
1049 state->exp_tls_certificate, state->exp_tls_privatekey);
1050
1051 if (state->received_sni)
23bb6982
JH
1052 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
1053 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
1054 )
17c76198 1055 {
b34fc30c 1056 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
17c76198
PP
1057 }
1058 else
1059 {
b34fc30c 1060 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
17c76198 1061 }
059ec3d9 1062
ba86e143
JH
1063 if (!host) /* server */
1064 {
1065 const uschar * clist = state->exp_tls_certificate;
1066 const uschar * klist = state->exp_tls_privatekey;
47195144
JH
1067 const uschar * olist;
1068 int csep = 0, ksep = 0, osep = 0, cnt = 0;
1069 uschar * cfile, * kfile, * ofile;
1070
1071#ifndef DISABLE_OCSP
1072 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file", &ofile, errstr))
1073 return DEFER;
1074 olist = ofile;
1075#endif
ba86e143
JH
1076
1077 while (cfile = string_nextinlist(&clist, &csep, NULL, 0))
47195144 1078
ba86e143
JH
1079 if (!(kfile = string_nextinlist(&klist, &ksep, NULL, 0)))
1080 return tls_error(US"cert/key setup: out of keys", NULL, host, errstr);
47195144 1081 else if (0 < (rc = tls_add_certfile(state, host, cfile, kfile, errstr)))
ba86e143
JH
1082 return rc;
1083 else
47195144
JH
1084 {
1085 int gnutls_cert_index = -rc;
e5489333 1086 DEBUG(D_tls) debug_printf("TLS: cert/key %d %s registered\n", gnutls_cert_index, cfile);
47195144
JH
1087
1088 /* Set the OCSP stapling server info */
1089
1090#ifndef DISABLE_OCSP
1091 if (tls_ocsp_file)
e5489333 1092 {
47195144
JH
1093 if (gnutls_buggy_ocsp)
1094 {
1095 DEBUG(D_tls)
1096 debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
1097 }
1098 else if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1099 {
e5489333 1100 DEBUG(D_tls) debug_printf("OCSP response file = %s\n", ofile);
47195144
JH
1101
1102# ifdef SUPPORT_SRV_OCSP_STACK
e5489333
JH
1103 if (f.running_in_test_harness) tls_server_testharness_ocsp_fiddle();
1104
1105 if (!exim_testharness_disable_ocsp_validity_check)
47195144 1106 {
e5489333
JH
1107 if ((rc = gnutls_certificate_set_ocsp_status_request_file2(
1108 state->x509_cred, CCS ofile, gnutls_cert_index,
1109 GNUTLS_X509_FMT_DER)) < 0)
1110 return tls_error_gnu(
1111 US"gnutls_certificate_set_ocsp_status_request_file2",
1112 rc, host, errstr);
1113
1114 /* Arrange callbacks for OCSP request observability */
1115
1116 gnutls_handshake_set_hook_function(state->session,
1117 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
47195144 1118 }
e5489333 1119 else
47195144 1120# endif
e5489333
JH
1121 {
1122 if (cnt++ > 0)
1123 {
1124 DEBUG(D_tls)
1125 debug_printf("oops; multiple OCSP files not supported\n");
1126 break;
1127 }
1128 gnutls_certificate_set_ocsp_status_request_function(
1129 state->x509_cred, server_ocsp_stapling_cb, ofile);
1130 }
47195144
JH
1131 }
1132 else
1133 DEBUG(D_tls) debug_printf("ran out of OCSP response files in list\n");
1134#endif
e5489333 1135 }
47195144 1136 }
ba86e143 1137 }
e5489333 1138 else /* client */
ba86e143 1139 {
47195144 1140 if (0 < (rc = tls_add_certfile(state, host,
ba86e143
JH
1141 state->exp_tls_certificate, state->exp_tls_privatekey, errstr)))
1142 return rc;
1143 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
1144 }
1145
b34fc30c 1146 } /* tls_certificate */
059ec3d9 1147
2b4a568d 1148
059ec3d9
PH
1149/* Set the trusted CAs file if one is provided, and then add the CRL if one is
1150provided. Experiment shows that, if the certificate file is empty, an unhelpful
1151error message is provided. However, if we just refrain from setting anything up
1152in that case, certificate verification fails, which seems to be the correct
1153behaviour. */
1154
610ff438 1155if (state->tls_verify_certificates && *state->tls_verify_certificates)
059ec3d9 1156 {
cf0c6164 1157 if (!expand_check_tlsvar(tls_verify_certificates, errstr))
059ec3d9 1158 return DEFER;
610ff438
JH
1159#ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1160 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1161 state->exp_tls_verify_certificates = NULL;
1162#endif
17c76198 1163 if (state->tls_crl && *state->tls_crl)
cf0c6164 1164 if (!expand_check_tlsvar(tls_crl, errstr))
17c76198 1165 return DEFER;
059ec3d9 1166
1365611d
PP
1167 if (!(state->exp_tls_verify_certificates &&
1168 *state->exp_tls_verify_certificates))
b34fc30c
PP
1169 {
1170 DEBUG(D_tls)
1365611d
PP
1171 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
1172 /* With no tls_verify_certificates, we ignore tls_crl too */
17c76198 1173 return OK;
b34fc30c 1174 }
1365611d 1175 }
83e2f8a2
PP
1176else
1177 {
1178 DEBUG(D_tls)
1179 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
1180 return OK;
1181 }
17c76198 1182
cb1d7830
JH
1183#ifdef SUPPORT_SYSDEFAULT_CABUNDLE
1184if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1185 cert_count = gnutls_certificate_set_x509_system_trust(state->x509_cred);
1186else
1187#endif
1365611d 1188 {
cb1d7830
JH
1189 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
1190 {
1191 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
1192 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
1193 strerror(errno));
1194 return DEFER;
1195 }
17c76198 1196
a7fec7a7 1197#ifndef SUPPORT_CA_DIR
cb1d7830
JH
1198 /* The test suite passes in /dev/null; we could check for that path explicitly,
1199 but who knows if someone has some weird FIFO which always dumps some certs, or
1200 other weirdness. The thing we really want to check is that it's not a
1201 directory, since while OpenSSL supports that, GnuTLS does not.
60f914bc 1202 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
cb1d7830
JH
1203 if (S_ISDIR(statbuf.st_mode))
1204 {
1205 DEBUG(D_tls)
1206 debug_printf("verify certificates path is a dir: \"%s\"\n",
1207 state->exp_tls_verify_certificates);
1208 log_write(0, LOG_MAIN|LOG_PANIC,
1209 "tls_verify_certificates \"%s\" is a directory",
1210 state->exp_tls_verify_certificates);
1211 return DEFER;
1212 }
a7fec7a7 1213#endif
059ec3d9 1214
cb1d7830
JH
1215 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
1216 state->exp_tls_verify_certificates, statbuf.st_size);
059ec3d9 1217
cb1d7830
JH
1218 if (statbuf.st_size == 0)
1219 {
1220 DEBUG(D_tls)
1221 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
1222 return OK;
1223 }
059ec3d9 1224
cb1d7830 1225 cert_count =
a7fec7a7
JH
1226
1227#ifdef SUPPORT_CA_DIR
cb1d7830
JH
1228 (statbuf.st_mode & S_IFMT) == S_IFDIR
1229 ?
1230 gnutls_certificate_set_x509_trust_dir(state->x509_cred,
1231 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM)
1232 :
a7fec7a7 1233#endif
cb1d7830
JH
1234 gnutls_certificate_set_x509_trust_file(state->x509_cred,
1235 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
12d95aa6
JH
1236
1237#ifdef SUPPORT_CA_DIR
1238 /* Mimic the behaviour with OpenSSL of not advertising a usable-cert list
1239 when using the directory-of-certs config model. */
1240
1241 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1242 gnutls_certificate_send_x509_rdn_sequence(state->session, 1);
1243#endif
cb1d7830 1244 }
a7fec7a7 1245
1365611d 1246if (cert_count < 0)
452a164f
JH
1247 return tls_error_gnu(US"setting certificate trust", cert_count, host, errstr);
1248DEBUG(D_tls)
1249 debug_printf("Added %d certificate authorities.\n", cert_count);
059ec3d9 1250
5c8cda3a
PP
1251if (state->tls_crl && *state->tls_crl &&
1252 state->exp_tls_crl && *state->exp_tls_crl)
1365611d 1253 {
5c8cda3a 1254 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
452a164f
JH
1255 if ((cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
1256 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM)) < 0)
1257 return tls_error_gnu(US"gnutls_certificate_set_x509_crl_file",
1258 cert_count, host, errstr);
1259
5c8cda3a 1260 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1365611d 1261 }
059ec3d9 1262
059ec3d9
PH
1263return OK;
1264}
1265
1266
1267
1268
1269/*************************************************
1365611d
PP
1270* Set X.509 state variables *
1271*************************************************/
1272
1273/* In GnuTLS, the registered cert/key are not replaced by a later
1274set of a cert/key, so for SNI support we need a whole new x509_cred
1275structure. Which means various other non-re-expanded pieces of state
1276need to be re-set in the new struct, so the setting logic is pulled
1277out to this.
1278
1279Arguments:
1280 state exim_gnutls_state_st *
cf0c6164 1281 errstr error string pointer
1365611d
PP
1282
1283Returns: OK/DEFER/FAIL
1284*/
1285
1286static int
cf0c6164 1287tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr)
1365611d
PP
1288{
1289int rc;
1290const host_item *host = state->host; /* macro should be reconsidered? */
1291
1292/* Create D-H parameters, or read them from the cache file. This function does
1293its own SMTP error messaging. This only happens for the server, TLS D-H ignores
1294client-side params. */
1295
1296if (!state->host)
1297 {
1298 if (!dh_server_params)
452a164f 1299 if ((rc = init_server_dh(errstr)) != OK) return rc;
1365611d
PP
1300 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
1301 }
1302
1303/* Link the credentials to the session. */
1304
452a164f
JH
1305if ((rc = gnutls_credentials_set(state->session,
1306 GNUTLS_CRD_CERTIFICATE, state->x509_cred)))
1307 return tls_error_gnu(US"gnutls_credentials_set", rc, host, errstr);
1365611d
PP
1308
1309return OK;
1310}
1311
1312/*************************************************
17c76198 1313* Initialize for GnuTLS *
059ec3d9
PH
1314*************************************************/
1315
9196d5bf 1316
4fb7df6d
JH
1317#ifndef DISABLE_OCSP
1318
9196d5bf
JH
1319static BOOL
1320tls_is_buggy_ocsp(void)
1321{
1322const uschar * s;
1323uschar maj, mid, mic;
1324
1325s = CUS gnutls_check_version(NULL);
1326maj = atoi(CCS s);
1327if (maj == 3)
1328 {
1329 while (*s && *s != '.') s++;
1330 mid = atoi(CCS ++s);
1331 if (mid <= 2)
1332 return TRUE;
1333 else if (mid >= 5)
1334 return FALSE;
1335 else
1336 {
1337 while (*s && *s != '.') s++;
1338 mic = atoi(CCS ++s);
1339 return mic <= (mid == 3 ? 16 : 3);
1340 }
1341 }
1342return FALSE;
1343}
1344
4fb7df6d 1345#endif
9196d5bf
JH
1346
1347
17c76198
PP
1348/* Called from both server and client code. In the case of a server, errors
1349before actual TLS negotiation return DEFER.
059ec3d9
PH
1350
1351Arguments:
17c76198
PP
1352 host connected host, if client; NULL if server
1353 certificate certificate file
1354 privatekey private key file
1355 sni TLS SNI to send, sometimes when client; else NULL
1356 cas CA certs file
1357 crl CRL file
1358 require_ciphers tls_require_ciphers setting
817d9f57 1359 caller_state returned state-info structure
cf0c6164 1360 errstr error string pointer
059ec3d9 1361
17c76198 1362Returns: OK/DEFER/FAIL
059ec3d9
PH
1363*/
1364
17c76198
PP
1365static int
1366tls_init(
1367 const host_item *host,
1368 const uschar *certificate,
1369 const uschar *privatekey,
1370 const uschar *sni,
1371 const uschar *cas,
1372 const uschar *crl,
1373 const uschar *require_ciphers,
cf0c6164 1374 exim_gnutls_state_st **caller_state,
74f1a423 1375 tls_support * tlsp,
cf0c6164 1376 uschar ** errstr)
059ec3d9 1377{
00c0dd4e 1378exim_gnutls_state_st * state;
17c76198
PP
1379int rc;
1380size_t sz;
00c0dd4e
JH
1381const char * errpos;
1382const uschar * p;
17c76198
PP
1383
1384if (!exim_gnutls_base_init_done)
059ec3d9 1385 {
17c76198
PP
1386 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1387
a5f239e4
PP
1388#ifdef HAVE_GNUTLS_PKCS11
1389 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1390 which loads modules from a config file, which sounds good and may be wanted
1391 by some sysadmin, but also means in common configurations that GNOME keyring
1392 environment variables are used and so breaks for users calling mailq.
1393 To prevent this, we init PKCS11 first, which is the documented approach. */
2519e60d 1394 if (!gnutls_allow_auto_pkcs11)
452a164f
JH
1395 if ((rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL)))
1396 return tls_error_gnu(US"gnutls_pkcs11_init", rc, host, errstr);
a5f239e4
PP
1397#endif
1398
452a164f
JH
1399 if ((rc = gnutls_global_init()))
1400 return tls_error_gnu(US"gnutls_global_init", rc, host, errstr);
17c76198
PP
1401
1402#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1403 DEBUG(D_tls)
059ec3d9 1404 {
17c76198 1405 gnutls_global_set_log_function(exim_gnutls_logger_cb);
aded2255 1406 /* arbitrarily chosen level; bump up to 9 for more */
17c76198 1407 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
059ec3d9 1408 }
17c76198
PP
1409#endif
1410
4fb7df6d
JH
1411#ifndef DISABLE_OCSP
1412 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
9196d5bf 1413 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
4fb7df6d 1414#endif
9196d5bf 1415
17c76198 1416 exim_gnutls_base_init_done = TRUE;
059ec3d9 1417 }
059ec3d9 1418
17c76198
PP
1419if (host)
1420 {
74f1a423
JH
1421 /* For client-side sessions we allocate a context. This lets us run
1422 several in parallel. */
1423 int old_pool = store_pool;
1424 store_pool = POOL_PERM;
f3ebb786 1425 state = store_get(sizeof(exim_gnutls_state_st), FALSE);
74f1a423
JH
1426 store_pool = old_pool;
1427
17c76198 1428 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
74f1a423 1429 state->tlsp = tlsp;
17c76198
PP
1430 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1431 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1432 }
1433else
1434 {
1435 state = &state_server;
1436 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
74f1a423 1437 state->tlsp = tlsp;
17c76198
PP
1438 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1439 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1440 }
452a164f
JH
1441if (rc)
1442 return tls_error_gnu(US"gnutls_init", rc, host, errstr);
059ec3d9 1443
17c76198 1444state->host = host;
059ec3d9 1445
17c76198
PP
1446state->tls_certificate = certificate;
1447state->tls_privatekey = privatekey;
5779e6aa 1448state->tls_require_ciphers = require_ciphers;
17c76198
PP
1449state->tls_sni = sni;
1450state->tls_verify_certificates = cas;
1451state->tls_crl = crl;
059ec3d9 1452
17c76198
PP
1453/* This handles the variables that might get re-expanded after TLS SNI;
1454that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
059ec3d9 1455
17c76198
PP
1456DEBUG(D_tls)
1457 debug_printf("Expanding various TLS configuration options for session credentials.\n");
cf0c6164 1458if ((rc = tls_expand_session_files(state, errstr)) != OK) return rc;
059ec3d9 1459
1365611d
PP
1460/* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1461requires a new structure afterwards. */
83da1223 1462
cf0c6164 1463if ((rc = tls_set_remaining_x509(state, errstr)) != OK) return rc;
83da1223 1464
17c76198
PP
1465/* set SNI in client, only */
1466if (host)
1467 {
cf0c6164 1468 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni, errstr))
17c76198 1469 return DEFER;
0df4ab80 1470 if (state->tlsp->sni && *state->tlsp->sni)
17c76198
PP
1471 {
1472 DEBUG(D_tls)
0df4ab80
JH
1473 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1474 sz = Ustrlen(state->tlsp->sni);
452a164f
JH
1475 if ((rc = gnutls_server_name_set(state->session,
1476 GNUTLS_NAME_DNS, state->tlsp->sni, sz)))
1477 return tls_error_gnu(US"gnutls_server_name_set", rc, host, errstr);
17c76198
PP
1478 }
1479 }
1480else if (state->tls_sni)
1481 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
ba86e143 1482 "have an SNI set for a server [%s]\n", state->tls_sni);
83da1223 1483
17c76198 1484/* This is the priority string support,
42bfef1e 1485http://www.gnutls.org/manual/html_node/Priority-Strings.html
17c76198
PP
1486and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1487This was backwards incompatible, but means Exim no longer needs to track
1488all algorithms and provide string forms for them. */
83da1223 1489
fc243e94 1490p = NULL;
17c76198 1491if (state->tls_require_ciphers && *state->tls_require_ciphers)
83da1223 1492 {
cf0c6164 1493 if (!expand_check_tlsvar(tls_require_ciphers, errstr))
17c76198
PP
1494 return DEFER;
1495 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
83da1223 1496 {
17c76198 1497 p = state->exp_tls_require_ciphers;
fc243e94 1498 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n", p);
83da1223
PH
1499 }
1500 }
fc243e94 1501if (!p)
17c76198 1502 {
fc243e94 1503 p = exim_default_gnutls_priority;
83e2f8a2 1504 DEBUG(D_tls)
fc243e94 1505 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n", p);
17c76198 1506 }
83da1223 1507
452a164f
JH
1508if ((rc = gnutls_priority_init(&state->priority_cache, CCS p, &errpos)))
1509 return tls_error_gnu(string_sprintf(
1510 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1511 p, errpos - CS p, errpos),
1512 rc, host, errstr);
17c76198 1513
452a164f
JH
1514if ((rc = gnutls_priority_set(state->session, state->priority_cache)))
1515 return tls_error_gnu(US"gnutls_priority_set", rc, host, errstr);
17c76198 1516
b10c87b3
JH
1517/* This also sets the server ticket expiration time to the same, and
1518the STEK rotation time to 3x. */
1519
17c76198
PP
1520gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1521
1522/* Reduce security in favour of increased compatibility, if the admin
1523decides to make that trade-off. */
1524if (gnutls_compat_mode)
83da1223 1525 {
17c76198
PP
1526#if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1527 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1528 gnutls_session_enable_compatibility_mode(state->session);
1529#else
1530 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1531#endif
83da1223
PH
1532 }
1533
17c76198 1534*caller_state = state;
17c76198 1535return OK;
83da1223
PH
1536}
1537
1538
1539
83da1223 1540/*************************************************
17c76198 1541* Extract peer information *
059ec3d9
PH
1542*************************************************/
1543
f1be21cf
JH
1544static const uschar *
1545cipher_stdname_kcm(gnutls_kx_algorithm_t kx, gnutls_cipher_algorithm_t cipher,
1546 gnutls_mac_algorithm_t mac)
1547{
1548uschar cs_id[2];
1549gnutls_kx_algorithm_t kx_i;
1550gnutls_cipher_algorithm_t cipher_i;
1551gnutls_mac_algorithm_t mac_i;
1552
1553for (size_t i = 0;
1554 gnutls_cipher_suite_info(i, cs_id, &kx_i, &cipher_i, &mac_i, NULL);
1555 i++)
1556 if (kx_i == kx && cipher_i == cipher && mac_i == mac)
1557 return cipher_stdname(cs_id[0], cs_id[1]);
1558return NULL;
1559}
1560
1561
1562
17c76198 1563/* Called from both server and client code.
4fe99a6c
PP
1564Only this is allowed to set state->peerdn and state->have_set_peerdn
1565and we use that to detect double-calls.
059ec3d9 1566
75fe387d
PP
1567NOTE: the state blocks last while the TLS connection is up, which is fine
1568for logging in the server side, but for the client side, we log after teardown
1569in src/deliver.c. While the session is up, we can twist about states and
1570repoint tls_* globals, but those variables used for logging or other variable
1571expansion that happens _after_ delivery need to have a longer life-time.
1572
1573So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1574doing this more than once per generation of a state context. We set them in
1575the state context, and repoint tls_* to them. After the state goes away, the
1576tls_* copies of the pointers remain valid and client delivery logging is happy.
1577
1578tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1579don't apply.
1580
059ec3d9 1581Arguments:
17c76198 1582 state exim_gnutls_state_st *
cf0c6164 1583 errstr pointer to error string
059ec3d9 1584
17c76198 1585Returns: OK/DEFER/FAIL
059ec3d9
PH
1586*/
1587
17c76198 1588static int
b10c87b3 1589peer_status(exim_gnutls_state_st * state, uschar ** errstr)
059ec3d9 1590{
b10c87b3
JH
1591gnutls_session_t session = state->session;
1592const gnutls_datum_t * cert_list;
75fe387d 1593int old_pool, rc;
17c76198 1594unsigned int cert_list_size = 0;
4fe99a6c
PP
1595gnutls_protocol_t protocol;
1596gnutls_cipher_algorithm_t cipher;
1597gnutls_kx_algorithm_t kx;
1598gnutls_mac_algorithm_t mac;
17c76198
PP
1599gnutls_certificate_type_t ct;
1600gnutls_x509_crt_t crt;
b10c87b3 1601uschar * dn_buf;
17c76198 1602size_t sz;
059ec3d9 1603
4fe99a6c 1604if (state->have_set_peerdn)
17c76198 1605 return OK;
4fe99a6c 1606state->have_set_peerdn = TRUE;
059ec3d9 1607
4fe99a6c 1608state->peerdn = NULL;
059ec3d9 1609
4fe99a6c 1610/* tls_cipher */
b10c87b3
JH
1611cipher = gnutls_cipher_get(session);
1612protocol = gnutls_protocol_get_version(session);
1613mac = gnutls_mac_get(session);
b9c6f63c
JH
1614kx =
1615#ifdef GNUTLS_TLS1_3
1616 protocol >= GNUTLS_TLS1_3 ? 0 :
1617#endif
b10c87b3 1618 gnutls_kx_get(session);
4fe99a6c 1619
75fe387d 1620old_pool = store_pool;
f1be21cf 1621 {
b10c87b3 1622 tls_support * tlsp = state->tlsp;
f1be21cf 1623 store_pool = POOL_PERM;
d9acfc1c
JH
1624
1625#ifdef SUPPORT_GNUTLS_SESS_DESC
1626 {
1627 gstring * g = NULL;
b10c87b3 1628 uschar * s = US gnutls_session_get_desc(session), c;
d9acfc1c
JH
1629
1630 /* Nikos M suggests we use this by preference. It returns like:
1631 (TLS1.3)-(ECDHE-SECP256R1)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM)
1632
1633 For partial back-compat, put a colon after the TLS version, replace the
1634 )-( grouping with __, replace in-group - with _ and append the :keysize. */
1635
1636 /* debug_printf("peer_status: gnutls_session_get_desc %s\n", s); */
1637
1638 for (s++; (c = *s) && c != ')'; s++) g = string_catn(g, s, 1);
1639 g = string_catn(g, US":", 1);
1640 if (*s) s++; /* now on _ between groups */
1641 while ((c = *s))
1642 {
1643 for (*++s && ++s; (c = *s) && c != ')'; s++) g = string_catn(g, c == '-' ? US"_" : s, 1);
1644 /* now on ) closing group */
1645 if ((c = *s) && *++s == '-') g = string_catn(g, US"__", 2);
1646 /* now on _ between groups */
1647 }
1648 g = string_catn(g, US":", 1);
1649 g = string_cat(g, string_sprintf("%d", (int) gnutls_cipher_get_key_size(cipher) * 8));
1650 state->ciphersuite = string_from_gstring(g);
1651 }
1652#else
f1be21cf
JH
1653 state->ciphersuite = string_sprintf("%s:%s:%d",
1654 gnutls_protocol_get_name(protocol),
1655 gnutls_cipher_suite_get_name(kx, cipher, mac),
1656 (int) gnutls_cipher_get_key_size(cipher) * 8);
1657
1658 /* I don't see a way that spaces could occur, in the current GnuTLS
1659 code base, but it was a concern in the old code and perhaps older GnuTLS
1660 releases did return "TLS 1.0"; play it safe, just in case. */
1661
1662 for (uschar * p = state->ciphersuite; *p; p++) if (isspace(*p)) *p = '-';
d9acfc1c
JH
1663#endif
1664
1665/* debug_printf("peer_status: ciphersuite %s\n", state->ciphersuite); */
1666
b10c87b3
JH
1667 tlsp->cipher = state->ciphersuite;
1668 tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
f1be21cf 1669
b10c87b3 1670 tlsp->cipher_stdname = cipher_stdname_kcm(kx, cipher, mac);
f1be21cf 1671 }
75fe387d 1672store_pool = old_pool;
4fe99a6c
PP
1673
1674/* tls_peerdn */
b10c87b3 1675cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
83da1223 1676
f1be21cf 1677if (!cert_list || cert_list_size == 0)
17c76198 1678 {
17c76198
PP
1679 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1680 cert_list, cert_list_size);
e51c7be2 1681 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198 1682 return tls_error(US"certificate verification failed",
48224640 1683 US"no certificate received from peer", state->host, errstr);
17c76198
PP
1684 return OK;
1685 }
059ec3d9 1686
b10c87b3 1687if ((ct = gnutls_certificate_type_get(session)) != GNUTLS_CRT_X509)
059ec3d9 1688 {
95f52235 1689 const uschar * ctn = US gnutls_certificate_type_get_name(ct);
17c76198
PP
1690 DEBUG(D_tls)
1691 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
e51c7be2 1692 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198 1693 return tls_error(US"certificate verification not possible, unhandled type",
cf0c6164 1694 ctn, state->host, errstr);
17c76198 1695 return OK;
83da1223 1696 }
059ec3d9 1697
e51c7be2
JH
1698#define exim_gnutls_peer_err(Label) \
1699 do { \
1700 if (rc != GNUTLS_E_SUCCESS) \
1701 { \
1702 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1703 (Label), gnutls_strerror(rc)); \
1704 if (state->verify_requirement >= VERIFY_REQUIRED) \
452a164f 1705 return tls_error_gnu((Label), rc, state->host, errstr); \
e51c7be2
JH
1706 return OK; \
1707 } \
1708 } while (0)
17c76198 1709
9d1c15ef
JH
1710rc = import_cert(&cert_list[0], &crt);
1711exim_gnutls_peer_err(US"cert 0");
1712
1713state->tlsp->peercert = state->peercert = crt;
17c76198 1714
17c76198
PP
1715sz = 0;
1716rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1717if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
83da1223 1718 {
17c76198
PP
1719 exim_gnutls_peer_err(US"getting size for cert DN failed");
1720 return FAIL; /* should not happen */
059ec3d9 1721 }
f3ebb786 1722dn_buf = store_get_perm(sz, TRUE); /* tainted */
17c76198
PP
1723rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1724exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
9d1c15ef 1725
17c76198
PP
1726state->peerdn = dn_buf;
1727
1728return OK;
1729#undef exim_gnutls_peer_err
1730}
059ec3d9 1731
059ec3d9 1732
059ec3d9 1733
059ec3d9 1734
17c76198
PP
1735/*************************************************
1736* Verify peer certificate *
1737*************************************************/
059ec3d9 1738
17c76198
PP
1739/* Called from both server and client code.
1740*Should* be using a callback registered with
1741gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1742the peer information, but that's too new for some OSes.
059ec3d9 1743
17c76198 1744Arguments:
899b8bbc
JH
1745 state exim_gnutls_state_st *
1746 errstr where to put an error message
059ec3d9 1747
17c76198
PP
1748Returns:
1749 FALSE if the session should be rejected
1750 TRUE if the cert is okay or we just don't care
1751*/
059ec3d9 1752
17c76198 1753static BOOL
28646fa9 1754verify_certificate(exim_gnutls_state_st * state, uschar ** errstr)
17c76198
PP
1755{
1756int rc;
899b8bbc
JH
1757uint verify;
1758
8008accd 1759DEBUG(D_tls) debug_printf("TLS: checking peer certificate\n");
cf0c6164 1760*errstr = NULL;
b10c87b3 1761rc = peer_status(state, errstr);
17c76198 1762
b10c87b3
JH
1763if (state->verify_requirement == VERIFY_NONE)
1764 return TRUE;
1765
1766if (rc != OK || !state->peerdn)
e6060e2c 1767 {
17c76198 1768 verify = GNUTLS_CERT_INVALID;
cf0c6164 1769 *errstr = US"certificate not supplied";
17c76198
PP
1770 }
1771else
899b8bbc
JH
1772
1773 {
1774#ifdef SUPPORT_DANE
1775 if (state->verify_requirement == VERIFY_DANE && state->host)
1776 {
1777 /* Using dane_verify_session_crt() would be easy, as it does it all for us
1778 including talking to a DNS resolver. But we want to do that bit ourselves
1779 as the testsuite intercepts and fakes its own DNS environment. */
1780
1781 dane_state_t s;
1782 dane_query_t r;
899b8bbc 1783 uint lsize;
94c13285
JH
1784 const gnutls_datum_t * certlist =
1785 gnutls_certificate_get_peers(state->session, &lsize);
1786 int usage = tls_out.tlsa_usage;
1787
1788# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1789 /* Split the TLSA records into two sets, TA and EE selectors. Run the
1790 dane-verification separately so that we know which selector verified;
570cb1bd 1791 then we know whether to do name-verification (needed for TA but not EE). */
94c13285
JH
1792
1793 if (usage == ((1<<DANESSL_USAGE_DANE_TA) | (1<<DANESSL_USAGE_DANE_EE)))
bd5b3f3c 1794 { /* a mixed-usage bundle */
94c13285
JH
1795 int i, j, nrec;
1796 const char ** dd;
1797 int * ddl;
1798
1799 for(nrec = 0; state->dane_data_len[nrec]; ) nrec++;
1800 nrec++;
1801
f3ebb786
JH
1802 dd = store_get(nrec * sizeof(uschar *), FALSE);
1803 ddl = store_get(nrec * sizeof(int), FALSE);
94c13285
JH
1804 nrec--;
1805
1806 if ((rc = dane_state_init(&s, 0)))
1807 goto tlsa_prob;
1808
1809 for (usage = DANESSL_USAGE_DANE_EE;
1810 usage >= DANESSL_USAGE_DANE_TA; usage--)
1811 { /* take records with this usage */
1812 for (j = i = 0; i < nrec; i++)
1813 if (state->dane_data[i][0] == usage)
1814 {
1815 dd[j] = state->dane_data[i];
1816 ddl[j++] = state->dane_data_len[i];
1817 }
1818 if (j)
1819 {
1820 dd[j] = NULL;
1821 ddl[j] = 0;
1822
1823 if ((rc = dane_raw_tlsa(s, &r, (char * const *)dd, ddl, 1, 0)))
1824 goto tlsa_prob;
1825
1826 if ((rc = dane_verify_crt_raw(s, certlist, lsize,
1827 gnutls_certificate_type_get(state->session),
1828 r, 0,
1829 usage == DANESSL_USAGE_DANE_EE
1830 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1831 &verify)))
1832 {
1833 DEBUG(D_tls)
1834 debug_printf("TLSA record problem: %s\n", dane_strerror(rc));
1835 }
1836 else if (verify == 0) /* verification passed */
1837 {
1838 usage = 1 << usage;
1839 break;
1840 }
1841 }
1842 }
899b8bbc 1843
94c13285
JH
1844 if (rc) goto tlsa_prob;
1845 }
1846 else
1847# endif
899b8bbc 1848 {
94c13285
JH
1849 if ( (rc = dane_state_init(&s, 0))
1850 || (rc = dane_raw_tlsa(s, &r, state->dane_data, state->dane_data_len,
1851 1, 0))
1852 || (rc = dane_verify_crt_raw(s, certlist, lsize,
1853 gnutls_certificate_type_get(state->session),
5ec37a55 1854 r, 0,
94c13285
JH
1855# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1856 usage == (1 << DANESSL_USAGE_DANE_EE)
1857 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1858# else
1859 0,
1860# endif
1861 &verify))
1862 )
1863 goto tlsa_prob;
899b8bbc 1864 }
94c13285
JH
1865
1866 if (verify != 0) /* verification failed */
899b8bbc
JH
1867 {
1868 gnutls_datum_t str;
1869 (void) dane_verification_status_print(verify, &str, 0);
1870 *errstr = US str.data; /* don't bother to free */
1871 goto badcert;
1872 }
28646fa9 1873
94c13285
JH
1874# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1875 /* If a TA-mode TLSA record was used for verification we must additionally
570cb1bd 1876 verify the cert name (but not the CA chain). For EE-mode, skip it. */
28646fa9 1877
94c13285
JH
1878 if (usage & (1 << DANESSL_USAGE_DANE_EE))
1879# endif
28646fa9 1880 {
570cb1bd 1881 state->peer_dane_verified = state->peer_cert_verified = TRUE;
28646fa9
JH
1882 goto goodcert;
1883 }
570cb1bd
JH
1884# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1885 /* Assume that the name on the A-record is the one that should be matching
1886 the cert. An alternate view is that the domain part of the email address
1887 is also permissible. */
1888
1889 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert,
1890 CS state->host->name))
1891 {
1892 state->peer_dane_verified = state->peer_cert_verified = TRUE;
1893 goto goodcert;
1894 }
1895# endif
899b8bbc 1896 }
570cb1bd 1897#endif /*SUPPORT_DANE*/
899b8bbc 1898
17c76198 1899 rc = gnutls_certificate_verify_peers2(state->session, &verify);
899b8bbc 1900 }
e6060e2c 1901
899b8bbc 1902/* Handle the result of verification. INVALID is set if any others are. */
059ec3d9 1903
28646fa9 1904if (rc < 0 || verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED))
17c76198
PP
1905 {
1906 state->peer_cert_verified = FALSE;
cf0c6164 1907 if (!*errstr)
184384c3
JH
1908 {
1909#ifdef GNUTLS_CERT_VFY_STATUS_PRINT
1910 DEBUG(D_tls)
1911 {
1912 gnutls_datum_t txt;
1913
1914 if (gnutls_certificate_verification_status_print(verify,
1915 gnutls_certificate_type_get(state->session), &txt, 0)
1916 == GNUTLS_E_SUCCESS)
1917 {
1918 debug_printf("%s\n", txt.data);
1919 gnutls_free(txt.data);
1920 }
1921 }
1922#endif
cf0c6164
JH
1923 *errstr = verify & GNUTLS_CERT_REVOKED
1924 ? US"certificate revoked" : US"certificate invalid";
184384c3 1925 }
059ec3d9 1926
17c76198 1927 DEBUG(D_tls)
e51c7be2 1928 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
cf0c6164 1929 *errstr, state->peerdn ? state->peerdn : US"<unset>");
059ec3d9 1930
e51c7be2 1931 if (state->verify_requirement >= VERIFY_REQUIRED)
899b8bbc 1932 goto badcert;
17c76198 1933 DEBUG(D_tls)
4789da3a 1934 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
17c76198 1935 }
e51c7be2 1936
17c76198
PP
1937else
1938 {
5fd28bb8
JH
1939 /* Client side, check the server's certificate name versus the name on the
1940 A-record for the connection we made. What to do for server side - what name
1941 to use for client? We document that there is no such checking for server
1942 side. */
1943
1944 if ( state->exp_tls_verify_cert_hostnames
1945 && !gnutls_x509_crt_check_hostname(state->tlsp->peercert,
1946 CS state->exp_tls_verify_cert_hostnames)
1947 )
e51c7be2 1948 {
5fd28bb8
JH
1949 DEBUG(D_tls)
1950 debug_printf("TLS certificate verification failed: cert name mismatch\n");
1951 if (state->verify_requirement >= VERIFY_REQUIRED)
1952 goto badcert;
1953 return TRUE;
e51c7be2 1954 }
5fd28bb8 1955
17c76198 1956 state->peer_cert_verified = TRUE;
e51c7be2 1957 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
4fe99a6c 1958 state->peerdn ? state->peerdn : US"<unset>");
17c76198 1959 }
059ec3d9 1960
28646fa9
JH
1961goodcert:
1962 state->tlsp->peerdn = state->peerdn;
1963 return TRUE;
899b8bbc 1964
b83314e3 1965#ifdef SUPPORT_DANE
94c13285 1966tlsa_prob:
624f33df
JH
1967 *errstr = string_sprintf("TLSA record problem: %s",
1968 rc == DANE_E_REQUESTED_DATA_NOT_AVAILABLE ? "none usable" : dane_strerror(rc));
b83314e3
JH
1969#endif
1970
899b8bbc
JH
1971badcert:
1972 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1973 return FALSE;
17c76198 1974}
059ec3d9 1975
17c76198
PP
1976
1977
1978
1979/* ------------------------------------------------------------------------ */
1980/* Callbacks */
1981
1982/* Logging function which can be registered with
1983 * gnutls_global_set_log_function()
1984 * gnutls_global_set_log_level() 0..9
1985 */
af3498d6 1986#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
059ec3d9 1987static void
17c76198 1988exim_gnutls_logger_cb(int level, const char *message)
059ec3d9 1989{
8c79eebf
PP
1990 size_t len = strlen(message);
1991 if (len < 1)
1992 {
1993 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1994 return;
1995 }
1996 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1997 message[len-1] == '\n' ? "" : "\n");
17c76198 1998}
af3498d6 1999#endif
059ec3d9 2000
059ec3d9 2001
17c76198
PP
2002/* Called after client hello, should handle SNI work.
2003This will always set tls_sni (state->received_sni) if available,
2004and may trigger presenting different certificates,
2005if state->trigger_sni_changes is TRUE.
059ec3d9 2006
17c76198
PP
2007Should be registered with
2008 gnutls_handshake_set_post_client_hello_function()
059ec3d9 2009
17c76198
PP
2010"This callback must return 0 on success or a gnutls error code to terminate the
2011handshake.".
059ec3d9 2012
17c76198
PP
2013For inability to get SNI information, we return 0.
2014We only return non-zero if re-setup failed.
817d9f57 2015Only used for server-side TLS.
17c76198 2016*/
44bbabb5 2017
17c76198
PP
2018static int
2019exim_sni_handling_cb(gnutls_session_t session)
2020{
2021char sni_name[MAX_HOST_LEN];
2022size_t data_len = MAX_HOST_LEN;
817d9f57 2023exim_gnutls_state_st *state = &state_server;
17c76198
PP
2024unsigned int sni_type;
2025int rc, old_pool;
cf0c6164 2026uschar * dummy_errstr;
17c76198
PP
2027
2028rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
b34fc30c
PP
2029if (rc != GNUTLS_E_SUCCESS)
2030 {
8775d84f 2031 DEBUG(D_tls)
b34fc30c
PP
2032 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
2033 debug_printf("TLS: no SNI presented in handshake.\n");
2034 else
2035 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
2036 gnutls_strerror(rc), rc);
b34fc30c
PP
2037 return 0;
2038 }
2039
17c76198
PP
2040if (sni_type != GNUTLS_NAME_DNS)
2041 {
2042 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
2043 return 0;
2044 }
44bbabb5 2045
17c76198
PP
2046/* We now have a UTF-8 string in sni_name */
2047old_pool = store_pool;
2048store_pool = POOL_PERM;
89a80675 2049state->received_sni = string_copy_taint(US sni_name, TRUE);
17c76198
PP
2050store_pool = old_pool;
2051
2052/* We set this one now so that variable expansions below will work */
817d9f57 2053state->tlsp->sni = state->received_sni;
17c76198
PP
2054
2055DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
2056 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
2057
2058if (!state->trigger_sni_changes)
2059 return 0;
2060
cf0c6164 2061if ((rc = tls_expand_session_files(state, &dummy_errstr)) != OK)
17c76198
PP
2062 {
2063 /* If the setup of certs/etc failed before handshake, TLS would not have
2064 been offered. The best we can do now is abort. */
2065 return GNUTLS_E_APPLICATION_ERROR_MIN;
2066 }
2067
cf0c6164 2068rc = tls_set_remaining_x509(state, &dummy_errstr);
1365611d
PP
2069if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
2070
2071return 0;
059ec3d9
PH
2072}
2073
2074
2075
e5489333 2076#if !defined(DISABLE_OCSP)
44662487
JH
2077
2078static int
2079server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
2080 gnutls_datum_t * ocsp_response)
2081{
2082int ret;
47195144 2083DEBUG(D_tls) debug_printf("OCSP stapling callback: %s\n", US ptr);
44662487 2084
44662487
JH
2085if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
2086 {
2087 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
5903c6ff 2088 CS ptr);
018058b2 2089 tls_in.ocsp = OCSP_NOT_RESP;
44662487
JH
2090 return GNUTLS_E_NO_CERTIFICATE_STATUS;
2091 }
2092
018058b2 2093tls_in.ocsp = OCSP_VFY_NOT_TRIED;
44662487
JH
2094return 0;
2095}
2096
2097#endif
2098
2099
0cbf2b82 2100#ifndef DISABLE_EVENT
a7538db1
JH
2101/*
2102We use this callback to get observability and detail-level control
723fe533
JH
2103for an exim TLS connection (either direction), raising a tls:cert event
2104for each cert in the chain presented by the peer. Any event
a7538db1
JH
2105can deny verification.
2106
2107Return 0 for the handshake to continue or non-zero to terminate.
2108*/
2109
2110static int
723fe533 2111verify_cb(gnutls_session_t session)
a7538db1 2112{
27f19eb4 2113const gnutls_datum_t * cert_list;
a7538db1
JH
2114unsigned int cert_list_size = 0;
2115gnutls_x509_crt_t crt;
2116int rc;
b30275b8 2117uschar * yield;
a7538db1
JH
2118exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
2119
bd5b3f3c 2120if ((cert_list = gnutls_certificate_get_peers(session, &cert_list_size)))
a7538db1
JH
2121 while (cert_list_size--)
2122 {
bd5b3f3c 2123 if ((rc = import_cert(&cert_list[cert_list_size], &crt)) != GNUTLS_E_SUCCESS)
a7538db1
JH
2124 {
2125 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
2126 cert_list_size, gnutls_strerror(rc));
2127 break;
2128 }
2129
2130 state->tlsp->peercert = crt;
b30275b8
JH
2131 if ((yield = event_raise(state->event_action,
2132 US"tls:cert", string_sprintf("%d", cert_list_size))))
a7538db1
JH
2133 {
2134 log_write(0, LOG_MAIN,
b30275b8
JH
2135 "SSL verify denied by event-action: depth=%d: %s",
2136 cert_list_size, yield);
a7538db1
JH
2137 return 1; /* reject */
2138 }
2139 state->tlsp->peercert = NULL;
2140 }
2141
2142return 0;
2143}
2144
2145#endif
44662487
JH
2146
2147
f20cfa4a
JH
2148static gstring *
2149ddump(gnutls_datum_t * d)
2150{
2151gstring * g = string_get((d->size+1) * 2);
2152uschar * s = d->data;
2153for (unsigned i = d->size; i > 0; i--, s++)
2154 {
2155 g = string_catn(g, US "0123456789abcdef" + (*s >> 4), 1);
2156 g = string_catn(g, US "0123456789abcdef" + (*s & 0xf), 1);
2157 }
2158return g;
2159}
17c76198 2160
dc6d1769
JH
2161static void
2162post_handshake_debug(exim_gnutls_state_st * state)
2163{
dc6d1769
JH
2164#ifdef SUPPORT_GNUTLS_SESS_DESC
2165debug_printf("%s\n", gnutls_session_get_desc(state->session));
2166#endif
2167#ifdef SUPPORT_GNUTLS_KEYLOG
a8af957d 2168# ifdef GNUTLS_TLS1_3
dc6d1769 2169if (gnutls_protocol_get_version(state->session) < GNUTLS_TLS1_3)
a8af957d
JH
2170#else
2171if (TRUE)
2172#endif
dc6d1769
JH
2173 {
2174 gnutls_datum_t c, s;
2175 gstring * gc, * gs;
2176 /* we only want the client random and the master secret */
2177 gnutls_session_get_random(state->session, &c, &s);
2178 gnutls_session_get_master_secret(state->session, &s);
2179 gc = ddump(&c);
2180 gs = ddump(&s);
2181 debug_printf("CLIENT_RANDOM %.*s %.*s\n", (int)gc->ptr, gc->s, (int)gs->ptr, gs->s);
2182 }
2183else
2184 debug_printf("To get keying info for TLS1.3 is hard:\n"
2185 " set environment variable SSLKEYLOGFILE to a filename writable by uid exim\n"
2186 " add SSLKEYLOGFILE to keep_environment in the exim config\n"
2187 " run exim as root\n"
2188 " if using sudo, add SSLKEYLOGFILE to env_keep in /etc/sudoers\n");
2189#endif
2190}
2191
b10c87b3
JH
2192
2193#ifdef EXPERIMENTAL_TLS_RESUME
2194static int
2195tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
2196 unsigned incoming, const gnutls_datum_t * msg)
2197{
2198DEBUG(D_tls) debug_printf("newticket cb\n");
2199tls_in.resumption |= RESUME_CLIENT_REQUESTED;
2200return 0;
2201}
2202
2203static void
2204tls_server_resume_prehandshake(exim_gnutls_state_st * state)
2205{
2206/* Should the server offer session resumption? */
2207tls_in.resumption = RESUME_SUPPORTED;
2208if (verify_check_host(&tls_resumption_hosts) == OK)
2209 {
2210 int rc;
2211 /* GnuTLS appears to not do ticket overlap, but does emit a fresh ticket when
2212 an offered resumption is unacceptable. We lose one resumption per ticket
2213 lifetime, and sessions cannot be indefinitely re-used. There seems to be no
2214 way (3.6.7) of changing the default number of 2 TLS1.3 tickets issued, but at
2215 least they go out in a single packet. */
2216
2217 if (!(rc = gnutls_session_ticket_enable_server(state->session,
2218 &server_sessticket_key)))
2219 tls_in.resumption |= RESUME_SERVER_TICKET;
2220 else
2221 DEBUG(D_tls)
2222 debug_printf("enabling session tickets: %s\n", US gnutls_strerror(rc));
2223
2224 /* Try to tell if we see a ticket request */
2225 gnutls_handshake_set_hook_function(state->session,
e5489333 2226 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
b10c87b3
JH
2227 }
2228}
2229
2230static void
2231tls_server_resume_posthandshake(exim_gnutls_state_st * state)
2232{
2233if (gnutls_session_resumption_requested(state->session))
2234 {
2235 /* This tells us the client sent a full ticket. We use a
2236 callback on session-ticket request, elsewhere, to tell
2237 if a client asked for a ticket. */
2238
2239 tls_in.resumption |= RESUME_CLIENT_SUGGESTED;
2240 DEBUG(D_tls) debug_printf("client requested resumption\n");
2241 }
2242if (gnutls_session_is_resumed(state->session))
2243 {
2244 tls_in.resumption |= RESUME_USED;
2245 DEBUG(D_tls) debug_printf("Session resumed\n");
2246 }
2247}
2248#endif
17c76198
PP
2249/* ------------------------------------------------------------------------ */
2250/* Exported functions */
2251
2252
2253
2254
059ec3d9
PH
2255/*************************************************
2256* Start a TLS session in a server *
2257*************************************************/
2258
2259/* This is called when Exim is running as a server, after having received
2260the STARTTLS command. It must respond to that command, and then negotiate
2261a TLS session.
2262
2263Arguments:
83da1223 2264 require_ciphers list of allowed ciphers or NULL
cf0c6164 2265 errstr pointer to error string
059ec3d9
PH
2266
2267Returns: OK on success
2268 DEFER for errors before the start of the negotiation
4c04137d 2269 FAIL for errors during the negotiation; the server can't
059ec3d9
PH
2270 continue running.
2271*/
2272
2273int
cf0c6164 2274tls_server_start(const uschar * require_ciphers, uschar ** errstr)
059ec3d9
PH
2275{
2276int rc;
cf0c6164 2277exim_gnutls_state_st * state = NULL;
059ec3d9
PH
2278
2279/* Check for previous activation */
74f1a423 2280if (tls_in.active.sock >= 0)
059ec3d9 2281 {
48224640 2282 tls_error(US"STARTTLS received after TLS started", US "", NULL, errstr);
925ac8e4 2283 smtp_printf("554 Already in TLS\r\n", FALSE);
059ec3d9
PH
2284 return FAIL;
2285 }
2286
2287/* Initialize the library. If it fails, it will already have logged the error
2288and sent an SMTP response. */
2289
17c76198 2290DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
059ec3d9 2291
cf0c6164 2292if ((rc = tls_init(NULL, tls_certificate, tls_privatekey,
17c76198 2293 NULL, tls_verify_certificates, tls_crl,
74f1a423 2294 require_ciphers, &state, &tls_in, errstr)) != OK) return rc;
059ec3d9 2295
b10c87b3
JH
2296#ifdef EXPERIMENTAL_TLS_RESUME
2297tls_server_resume_prehandshake(state);
2298#endif
2299
059ec3d9
PH
2300/* If this is a host for which certificate verification is mandatory or
2301optional, set up appropriately. */
2302
059ec3d9 2303if (verify_check_host(&tls_verify_hosts) == OK)
17c76198 2304 {
e51c7be2
JH
2305 DEBUG(D_tls)
2306 debug_printf("TLS: a client certificate will be required.\n");
17c76198
PP
2307 state->verify_requirement = VERIFY_REQUIRED;
2308 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2309 }
059ec3d9 2310else if (verify_check_host(&tls_try_verify_hosts) == OK)
17c76198 2311 {
e51c7be2
JH
2312 DEBUG(D_tls)
2313 debug_printf("TLS: a client certificate will be requested but not required.\n");
17c76198
PP
2314 state->verify_requirement = VERIFY_OPTIONAL;
2315 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2316 }
2317else
2318 {
e51c7be2
JH
2319 DEBUG(D_tls)
2320 debug_printf("TLS: a client certificate will not be requested.\n");
17c76198
PP
2321 state->verify_requirement = VERIFY_NONE;
2322 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2323 }
059ec3d9 2324
0cbf2b82 2325#ifndef DISABLE_EVENT
723fe533
JH
2326if (event_action)
2327 {
2328 state->event_action = event_action;
2329 gnutls_session_set_ptr(state->session, state);
2330 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2331 }
2332#endif
2333
17c76198
PP
2334/* Register SNI handling; always, even if not in tls_certificate, so that the
2335expansion variable $tls_sni is always available. */
059ec3d9 2336
17c76198
PP
2337gnutls_handshake_set_post_client_hello_function(state->session,
2338 exim_sni_handling_cb);
059ec3d9
PH
2339
2340/* Set context and tell client to go ahead, except in the case of TLS startup
2341on connection, where outputting anything now upsets the clients and tends to
2342make them disconnect. We need to have an explicit fflush() here, to force out
2343the response. Other smtp_printf() calls do not need it, because in non-TLS
2344mode, the fflush() happens when smtp_getc() is called. */
2345
817d9f57 2346if (!state->tlsp->on_connect)
059ec3d9 2347 {
925ac8e4 2348 smtp_printf("220 TLS go ahead\r\n", FALSE);
9d1c15ef 2349 fflush(smtp_out);
059ec3d9
PH
2350 }
2351
2352/* Now negotiate the TLS session. We put our own timer on it, since it seems
8008accd
JH
2353that the GnuTLS library doesn't.
2354From 3.1.0 there is gnutls_handshake_set_timeout() - but it requires you
2355to set (and clear down afterwards) up a pull-timeout callback function that does
2356a select, so we're no better off unless avoiding signals becomes an issue. */
059ec3d9 2357
17c76198 2358gnutls_transport_set_ptr2(state->session,
27f19eb4
JH
2359 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
2360 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
17c76198
PP
2361state->fd_in = fileno(smtp_in);
2362state->fd_out = fileno(smtp_out);
059ec3d9
PH
2363
2364sigalrm_seen = FALSE;
c2a1bba0 2365if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
17c76198 2366do
17c76198 2367 rc = gnutls_handshake(state->session);
157a7880 2368while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
c2a1bba0 2369ALARM_CLR(0);
059ec3d9 2370
17c76198 2371if (rc != GNUTLS_E_SUCCESS)
059ec3d9 2372 {
059ec3d9
PH
2373 /* It seems that, except in the case of a timeout, we have to close the
2374 connection right here; otherwise if the other end is running OpenSSL it hangs
2375 until the server times out. */
2376
60d10ce7 2377 if (sigalrm_seen)
ad7fc6eb 2378 {
48224640 2379 tls_error(US"gnutls_handshake", US"timed out", NULL, errstr);
ad7fc6eb
JH
2380 gnutls_db_remove_session(state->session);
2381 }
60d10ce7 2382 else
059ec3d9 2383 {
452a164f 2384 tls_error_gnu(US"gnutls_handshake", rc, NULL, errstr);
f5d25c2b 2385 (void) gnutls_alert_send_appropriate(state->session, rc);
ad7fc6eb 2386 gnutls_deinit(state->session);
ed62aae3 2387 gnutls_certificate_free_credentials(state->x509_cred);
60d10ce7 2388 millisleep(500);
ad7fc6eb 2389 shutdown(state->fd_out, SHUT_WR);
d7978c0f 2390 for (int i = 1024; fgetc(smtp_in) != EOF && i > 0; ) i--; /* drain skt */
f1e894f3
PH
2391 (void)fclose(smtp_out);
2392 (void)fclose(smtp_in);
60d10ce7 2393 smtp_out = smtp_in = NULL;
059ec3d9
PH
2394 }
2395
2396 return FAIL;
2397 }
2398
b10c87b3
JH
2399#ifdef EXPERIMENTAL_TLS_RESUME
2400tls_server_resume_posthandshake(state);
2401#endif
2402
dc6d1769 2403DEBUG(D_tls) post_handshake_debug(state);
059ec3d9 2404
17c76198
PP
2405/* Verify after the fact */
2406
899b8bbc 2407if (!verify_certificate(state, errstr))
059ec3d9 2408 {
9d1c15ef 2409 if (state->verify_requirement != VERIFY_OPTIONAL)
17c76198 2410 {
cf0c6164 2411 (void) tls_error(US"certificate verification failed", *errstr, NULL, errstr);
9d1c15ef 2412 return FAIL;
17c76198 2413 }
9d1c15ef
JH
2414 DEBUG(D_tls)
2415 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
cf0c6164 2416 *errstr);
059ec3d9
PH
2417 }
2418
17c76198
PP
2419/* Sets various Exim expansion variables; always safe within server */
2420
9d1c15ef 2421extract_exim_vars_from_tls_state(state);
059ec3d9
PH
2422
2423/* TLS has been set up. Adjust the input functions to read via TLS,
2424and initialize appropriately. */
2425
17c76198 2426state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
059ec3d9
PH
2427
2428receive_getc = tls_getc;
0d81dabc 2429receive_getbuf = tls_getbuf;
584e96c6 2430receive_get_cache = tls_get_cache;
059ec3d9
PH
2431receive_ungetc = tls_ungetc;
2432receive_feof = tls_feof;
2433receive_ferror = tls_ferror;
58eb016e 2434receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 2435
059ec3d9
PH
2436return OK;
2437}
2438
2439
2440
2441
aa2a70ba
JH
2442static void
2443tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
2444 smtp_transport_options_block * ob)
2445{
3fb3231c 2446if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
aa2a70ba 2447 {
4af0d74a 2448 state->exp_tls_verify_cert_hostnames =
8c5d388a 2449#ifdef SUPPORT_I18N
4af0d74a
JH
2450 string_domain_utf8_to_alabel(host->name, NULL);
2451#else
2452 host->name;
2453#endif
aa2a70ba
JH
2454 DEBUG(D_tls)
2455 debug_printf("TLS: server cert verification includes hostname: \"%s\".\n",
2456 state->exp_tls_verify_cert_hostnames);
2457 }
2458}
aa2a70ba
JH
2459
2460
899b8bbc
JH
2461
2462
2463#ifdef SUPPORT_DANE
2464/* Given our list of RRs from the TLSA lookup, build a lookup block in
2465GnuTLS-DANE's preferred format. Hang it on the state str for later
2466use in DANE verification.
2467
2468We point at the dnsa data not copy it, so it must remain valid until
2469after verification is done.*/
2470
3674140c 2471static BOOL
899b8bbc
JH
2472dane_tlsa_load(exim_gnutls_state_st * state, dns_answer * dnsa)
2473{
899b8bbc
JH
2474dns_scan dnss;
2475int i;
2476const char ** dane_data;
2477int * dane_data_len;
2478
d7978c0f
JH
2479i = 1;
2480for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
899b8bbc
JH
2481 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2482 ) if (rr->type == T_TLSA) i++;
2483
f3ebb786
JH
2484dane_data = store_get(i * sizeof(uschar *), FALSE);
2485dane_data_len = store_get(i * sizeof(int), FALSE);
899b8bbc 2486
d7978c0f
JH
2487i = 0;
2488for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
899b8bbc 2489 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
1b76ad22 2490 ) if (rr->type == T_TLSA && rr->size > 3)
899b8bbc
JH
2491 {
2492 const uschar * p = rr->data;
f3ebb786 2493/*XXX need somehow to mark rr and its data as tainted. Doues this mean copying it? */
3674140c
JH
2494 uint8_t usage = p[0], sel = p[1], type = p[2];
2495
2496 DEBUG(D_tls)
2497 debug_printf("TLSA: %d %d %d size %d\n", usage, sel, type, rr->size);
2498
94c13285
JH
2499 if ( (usage != DANESSL_USAGE_DANE_TA && usage != DANESSL_USAGE_DANE_EE)
2500 || (sel != 0 && sel != 1)
2501 )
2502 continue;
3674140c
JH
2503 switch(type)
2504 {
2505 case 0: /* Full: cannot check at present */
2506 break;
2507 case 1: if (rr->size != 3 + 256/8) continue; /* sha2-256 */
2508 break;
2509 case 2: if (rr->size != 3 + 512/8) continue; /* sha2-512 */
2510 break;
2511 default: continue;
2512 }
899b8bbc
JH
2513
2514 tls_out.tlsa_usage |= 1<<usage;
48224640 2515 dane_data[i] = CS p;
899b8bbc
JH
2516 dane_data_len[i++] = rr->size;
2517 }
3674140c
JH
2518
2519if (!i) return FALSE;
2520
899b8bbc
JH
2521dane_data[i] = NULL;
2522dane_data_len[i] = 0;
2523
2524state->dane_data = (char * const *)dane_data;
2525state->dane_data_len = dane_data_len;
3674140c 2526return TRUE;
899b8bbc
JH
2527}
2528#endif
2529
2530
2531
b10c87b3
JH
2532#ifdef EXPERIMENTAL_TLS_RESUME
2533/* On the client, get any stashed session for the given IP from hints db
2534and apply it to the ssl-connection for attempted resumption. Although
2535there is a gnutls_session_ticket_enable_client() interface it is
2536documented as unnecessary (as of 3.6.7) as "session tickets are emabled
2537by deafult". There seems to be no way to disable them, so even hosts not
2538enabled by the transport option will be sent a ticket request. We will
2539however avoid storing and retrieving session information. */
2540
2541static void
2542tls_retrieve_session(tls_support * tlsp, gnutls_session_t session,
2543 host_item * host, smtp_transport_options_block * ob)
2544{
2545tlsp->resumption = RESUME_SUPPORTED;
2546if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
2547 {
2548 dbdata_tls_session * dt;
2549 int len, rc;
2550 open_db dbblock, * dbm_file;
2551
2552 DEBUG(D_tls)
2553 debug_printf("check for resumable session for %s\n", host->address);
2554 tlsp->host_resumable = TRUE;
2555 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
2556 if ((dbm_file = dbfn_open(US"tls", O_RDONLY, &dbblock, FALSE, FALSE)))
2557 {
dea4b568
JH
2558 /* Key for the db is the IP. We'd like to filter the retrieved session
2559 for ticket advisory expiry, but 3.6.1 seems to give no access to that */
2560
b10c87b3
JH
2561 if ((dt = dbfn_read_with_length(dbm_file, host->address, &len)))
2562 if (!(rc = gnutls_session_set_data(session,
2563 CUS dt->session, (size_t)len - sizeof(dbdata_tls_session))))
2564 {
2565 DEBUG(D_tls) debug_printf("good session\n");
2566 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
2567 }
2568 else DEBUG(D_tls) debug_printf("setting session resumption data: %s\n",
2569 US gnutls_strerror(rc));
2570 dbfn_close(dbm_file);
2571 }
2572 }
2573}
2574
2575
2576static void
2577tls_save_session(tls_support * tlsp, gnutls_session_t session, const host_item * host)
2578{
2579/* TLS 1.2 - we get both the callback and the direct posthandshake call,
2580but this flag is not set until the second. TLS 1.3 it's the other way about.
2581Keep both calls as the session data cannot be extracted before handshake
2582completes. */
2583
2584if (gnutls_session_get_flags(session) & GNUTLS_SFLAGS_SESSION_TICKET)
2585 {
2586 gnutls_datum_t tkt;
2587 int rc;
2588
2589 DEBUG(D_tls) debug_printf("server offered session ticket\n");
2590 tlsp->ticket_received = TRUE;
2591 tlsp->resumption |= RESUME_SERVER_TICKET;
2592
2593 if (tlsp->host_resumable)
2594 if (!(rc = gnutls_session_get_data2(session, &tkt)))
2595 {
2596 open_db dbblock, * dbm_file;
2597 int dlen = sizeof(dbdata_tls_session) + tkt.size;
f3ebb786 2598 dbdata_tls_session * dt = store_get(dlen, TRUE);
b10c87b3
JH
2599
2600 DEBUG(D_tls) debug_printf("session data size %u\n", (unsigned)tkt.size);
2601 memcpy(dt->session, tkt.data, tkt.size);
2602 gnutls_free(tkt.data);
2603
2604 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
2605 {
2606 /* key for the db is the IP */
2607 dbfn_delete(dbm_file, host->address);
2608 dbfn_write(dbm_file, host->address, dt, dlen);
2609 dbfn_close(dbm_file);
2610
2611 DEBUG(D_tls)
2612 debug_printf("wrote session db (len %u)\n", (unsigned)dlen);
2613 }
2614 }
2615 else DEBUG(D_tls)
2616 debug_printf("extract session data: %s\n", US gnutls_strerror(rc));
2617 }
2618}
2619
2620
2621/* With a TLS1.3 session, the ticket(s) are not seen until
2622the first data read is attempted. And there's often two of them.
2623Pick them up with this callback. We are also called for 1.2
2624but we do nothing.
2625*/
2626static int
2627tls_client_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
2628 unsigned incoming, const gnutls_datum_t * msg)
2629{
2630exim_gnutls_state_st * state = gnutls_session_get_ptr(sess);
2631tls_support * tlsp = state->tlsp;
2632
2633DEBUG(D_tls) debug_printf("newticket cb\n");
2634
2635if (!tlsp->ticket_received)
2636 tls_save_session(tlsp, sess, state->host);
2637return 0;
2638}
2639
2640
2641static void
2642tls_client_resume_prehandshake(exim_gnutls_state_st * state,
2643 tls_support * tlsp, host_item * host,
2644 smtp_transport_options_block * ob)
2645{
2646gnutls_session_set_ptr(state->session, state);
2647gnutls_handshake_set_hook_function(state->session,
2648 GNUTLS_HANDSHAKE_NEW_SESSION_TICKET, GNUTLS_HOOK_POST, tls_client_ticket_cb);
2649
2650tls_retrieve_session(tlsp, state->session, host, ob);
2651}
2652
2653static void
2654tls_client_resume_posthandshake(exim_gnutls_state_st * state,
2655 tls_support * tlsp, host_item * host)
2656{
2657if (gnutls_session_is_resumed(state->session))
2658 {
2659 DEBUG(D_tls) debug_printf("Session resumed\n");
2660 tlsp->resumption |= RESUME_USED;
2661 }
2662
2663tls_save_session(tlsp, state->session, host);
2664}
2665#endif /* EXPERIMENTAL_TLS_RESUME */
2666
2667
059ec3d9
PH
2668/*************************************************
2669* Start a TLS session in a client *
2670*************************************************/
2671
2672/* Called from the smtp transport after STARTTLS has been accepted.
2673
2674Arguments:
c05bdbd6
JH
2675 cctx connection context
2676 conn_args connection details
2677 cookie datum for randomness (not used)
2678 tlsp record details of channel configuration here; must be non-NULL
2679 errstr error string pointer
2680
2681Returns: TRUE for success with TLS session context set in smtp context,
2682 FALSE on error
059ec3d9
PH
2683*/
2684
c05bdbd6
JH
2685BOOL
2686tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
2687 void * cookie ARG_UNUSED,
2688 tls_support * tlsp, uschar ** errstr)
059ec3d9 2689{
c05bdbd6
JH
2690host_item * host = conn_args->host; /* for msgs and option-tests */
2691transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
2692smtp_transport_options_block * ob = tb
afdb5e9c
JH
2693 ? (smtp_transport_options_block *)tb->options_block
2694 : &smtp_transport_option_defaults;
059ec3d9 2695int rc;
899b8bbc 2696exim_gnutls_state_st * state = NULL;
c05bdbd6 2697uschar * cipher_list = NULL;
74f1a423 2698
f2de3a33 2699#ifndef DISABLE_OCSP
5130845b 2700BOOL require_ocsp =
3fb3231c 2701 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
44662487 2702BOOL request_ocsp = require_ocsp ? TRUE
3fb3231c 2703 : verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
2b4a568d 2704#endif
059ec3d9 2705
c05bdbd6 2706DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", cctx->sock);
059ec3d9 2707
5ec37a55 2708#ifdef SUPPORT_DANE
c05bdbd6
JH
2709/* If dane is flagged, have either request or require dane for this host, and
2710a TLSA record found. Therefore, dane verify required. Which implies cert must
2711be requested and supplied, dane verify must pass, and cert verify irrelevant
2712(incl. hostnames), and (caller handled) require_tls */
2713
2714if (conn_args->dane && ob->dane_require_tls_ciphers)
5ec37a55
PP
2715 {
2716 /* not using expand_check_tlsvar because not yet in state */
2717 if (!expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
2718 &cipher_list, errstr))
c05bdbd6 2719 return FALSE;
cf260049
JH
2720 cipher_list = cipher_list && *cipher_list
2721 ? ob->dane_require_tls_ciphers : ob->tls_require_ciphers;
5ec37a55
PP
2722 }
2723#endif
2724
2725if (!cipher_list)
2726 cipher_list = ob->tls_require_ciphers;
2727
74f1a423 2728if (tls_init(host, ob->tls_certificate, ob->tls_privatekey,
65867078 2729 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
74f1a423 2730 cipher_list, &state, tlsp, errstr) != OK)
c05bdbd6 2731 return FALSE;
059ec3d9 2732
54c90be1 2733 {
65867078
JH
2734 int dh_min_bits = ob->tls_dh_min_bits;
2735 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
2736 {
2737 DEBUG(D_tls)
2738 debug_printf("WARNING: tls_dh_min_bits far too low,"
2739 " clamping %d up to %d\n",
2740 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
2741 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
2742 }
54c90be1 2743
65867078
JH
2744 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
2745 " acceptable bits to %d\n",
2746 dh_min_bits);
2747 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
2748 }
83da1223 2749
94431adb 2750/* Stick to the old behaviour for compatibility if tls_verify_certificates is
2b4a568d
JH
2751set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
2752the specified host patterns if one of them is defined */
2753
899b8bbc 2754#ifdef SUPPORT_DANE
c05bdbd6 2755if (conn_args->dane && dane_tlsa_load(state, &conn_args->tlsa_dnsa))
899b8bbc
JH
2756 {
2757 DEBUG(D_tls)
2758 debug_printf("TLS: server certificate DANE required.\n");
2759 state->verify_requirement = VERIFY_DANE;
2760 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
899b8bbc
JH
2761 }
2762else
2763#endif
2764 if ( ( state->exp_tls_verify_certificates
2765 && !ob->tls_verify_hosts
2766 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2767 )
3fb3231c 2768 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
899b8bbc 2769 )
17c76198 2770 {
aa2a70ba 2771 tls_client_setup_hostname_checks(host, state, ob);
aa2a70ba
JH
2772 DEBUG(D_tls)
2773 debug_printf("TLS: server certificate verification required.\n");
2774 state->verify_requirement = VERIFY_REQUIRED;
52f93eed
WB
2775 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2776 }
3fb3231c 2777else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
52f93eed 2778 {
aa2a70ba 2779 tls_client_setup_hostname_checks(host, state, ob);
e51c7be2
JH
2780 DEBUG(D_tls)
2781 debug_printf("TLS: server certificate verification optional.\n");
52f93eed 2782 state->verify_requirement = VERIFY_OPTIONAL;
17c76198
PP
2783 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2784 }
2785else
2786 {
e51c7be2
JH
2787 DEBUG(D_tls)
2788 debug_printf("TLS: server certificate verification not required.\n");
52f93eed
WB
2789 state->verify_requirement = VERIFY_NONE;
2790 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
17c76198 2791 }
059ec3d9 2792
f2de3a33
JH
2793#ifndef DISABLE_OCSP
2794 /* supported since GnuTLS 3.1.3 */
44662487 2795if (request_ocsp)
9d1c15ef
JH
2796 {
2797 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
65867078
JH
2798 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
2799 NULL, 0, NULL)) != OK)
74f1a423 2800 {
452a164f 2801 tls_error_gnu(US"cert-status-req", rc, state->host, errstr);
c05bdbd6 2802 return FALSE;
74f1a423
JH
2803 }
2804 tlsp->ocsp = OCSP_NOT_RESP;
9d1c15ef 2805 }
2b4a568d
JH
2806#endif
2807
b10c87b3
JH
2808#ifdef EXPERIMENTAL_TLS_RESUME
2809tls_client_resume_prehandshake(state, tlsp, host, ob);
2810#endif
2811
0cbf2b82 2812#ifndef DISABLE_EVENT
afdb5e9c 2813if (tb && tb->event_action)
a7538db1 2814 {
774ef2d7 2815 state->event_action = tb->event_action;
a7538db1 2816 gnutls_session_set_ptr(state->session, state);
723fe533 2817 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
a7538db1
JH
2818 }
2819#endif
2820
c05bdbd6
JH
2821gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) cctx->sock);
2822state->fd_in = cctx->sock;
2823state->fd_out = cctx->sock;
059ec3d9 2824
9d1c15ef 2825DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
059ec3d9
PH
2826/* There doesn't seem to be a built-in timeout on connection. */
2827
2828sigalrm_seen = FALSE;
c2a1bba0 2829ALARM(ob->command_timeout);
17c76198 2830do
17c76198 2831 rc = gnutls_handshake(state->session);
f1fed05b 2832while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
c2a1bba0 2833ALARM_CLR(0);
059ec3d9 2834
4fe99a6c 2835if (rc != GNUTLS_E_SUCCESS)
74f1a423 2836 {
60d10ce7
JH
2837 if (sigalrm_seen)
2838 {
2839 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
48224640 2840 tls_error(US"gnutls_handshake", US"timed out", state->host, errstr);
60d10ce7
JH
2841 }
2842 else
452a164f 2843 tls_error_gnu(US"gnutls_handshake", rc, state->host, errstr);
c05bdbd6 2844 return FALSE;
74f1a423 2845 }
4fe99a6c 2846
dc6d1769 2847DEBUG(D_tls) post_handshake_debug(state);
059ec3d9 2848
17c76198 2849/* Verify late */
059ec3d9 2850
899b8bbc 2851if (!verify_certificate(state, errstr))
74f1a423
JH
2852 {
2853 tls_error(US"certificate verification failed", *errstr, state->host, errstr);
c05bdbd6 2854 return FALSE;
74f1a423 2855 }
059ec3d9 2856
f2de3a33 2857#ifndef DISABLE_OCSP
7a501c87 2858if (request_ocsp)
2b4a568d
JH
2859 {
2860 DEBUG(D_tls)
2861 {
2862 gnutls_datum_t stapling;
2863 gnutls_ocsp_resp_t resp;
2864 gnutls_datum_t printed;
2865 if ( (rc= gnutls_ocsp_status_request_get(state->session, &stapling)) == 0
2866 && (rc= gnutls_ocsp_resp_init(&resp)) == 0
2867 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
2868 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_FULL, &printed)) == 0
2869 )
2870 {
65867078 2871 debug_printf("%.4096s", printed.data);
2b4a568d
JH
2872 gnutls_free(printed.data);
2873 }
2874 else
452a164f 2875 (void) tls_error_gnu(US"ocsp decode", rc, state->host, errstr);
2b4a568d
JH
2876 }
2877
2b4a568d 2878 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
018058b2 2879 {
74f1a423
JH
2880 tlsp->ocsp = OCSP_FAILED;
2881 tls_error(US"certificate status check failed", NULL, state->host, errstr);
7a501c87
JH
2882 if (require_ocsp)
2883 return FALSE;
2884 }
2885 else
2886 {
2887 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
2888 tlsp->ocsp = OCSP_VFIED;
018058b2 2889 }
2b4a568d
JH
2890 }
2891#endif
2892
b10c87b3
JH
2893#ifdef EXPERIMENTAL_TLS_RESUME
2894tls_client_resume_posthandshake(state, tlsp, host);
2895#endif
059ec3d9 2896
4fe99a6c 2897/* Sets various Exim expansion variables; may need to adjust for ACL callouts */
059ec3d9 2898
9d1c15ef 2899extract_exim_vars_from_tls_state(state);
059ec3d9 2900
c05bdbd6
JH
2901cctx->tls_ctx = state;
2902return TRUE;
059ec3d9
PH
2903}
2904
2905
2906
17c76198 2907
059ec3d9 2908/*************************************************
17c76198 2909* Close down a TLS session *
059ec3d9
PH
2910*************************************************/
2911
17c76198
PP
2912/* This is also called from within a delivery subprocess forked from the
2913daemon, to shut down the TLS library, without actually doing a shutdown (which
2914would tamper with the TLS session in the parent process).
059ec3d9 2915
dec766a1 2916Arguments:
74f1a423 2917 ct_ctx client context pointer, or NULL for the one global server context
dec766a1 2918 shutdown 1 if TLS close-alert is to be sent,
afdb5e9c 2919 2 if also response to be waited for
dec766a1 2920
17c76198 2921Returns: nothing
059ec3d9
PH
2922*/
2923
17c76198 2924void
74f1a423 2925tls_close(void * ct_ctx, int shutdown)
059ec3d9 2926{
74f1a423 2927exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
bd231acd 2928tls_support * tlsp = state->tlsp;
059ec3d9 2929
bd231acd 2930if (!tlsp || tlsp->active.sock < 0) return; /* TLS was not active */
17c76198
PP
2931
2932if (shutdown)
2933 {
dec766a1
WB
2934 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
2935 shutdown > 1 ? " (with response-wait)" : "");
2936
c2a1bba0 2937 ALARM(2);
dec766a1 2938 gnutls_bye(state->session, shutdown > 1 ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR);
c2a1bba0 2939 ALARM_CLR(0);
17c76198
PP
2940 }
2941
bd231acd
JH
2942if (!ct_ctx) /* server */
2943 {
2944 receive_getc = smtp_getc;
2945 receive_getbuf = smtp_getbuf;
2946 receive_get_cache = smtp_get_cache;
2947 receive_ungetc = smtp_ungetc;
2948 receive_feof = smtp_feof;
2949 receive_ferror = smtp_ferror;
2950 receive_smtp_buffered = smtp_buffered;
2951 }
2952
17c76198 2953gnutls_deinit(state->session);
ed62aae3
HSHR
2954gnutls_certificate_free_credentials(state->x509_cred);
2955
bd231acd
JH
2956tlsp->active.sock = -1;
2957tlsp->active.tls_ctx = NULL;
2958/* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
2959tls_channelbinding_b64 = NULL;
2960
17c76198 2961
b808677c 2962if (state->xfer_buffer) store_free(state->xfer_buffer);
17c76198 2963memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
059ec3d9
PH
2964}
2965
2966
2967
17c76198 2968
0d81dabc
JH
2969static BOOL
2970tls_refill(unsigned lim)
2971{
2972exim_gnutls_state_st * state = &state_server;
2973ssize_t inbytes;
2974
2975DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
2976 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
2977
f1fed05b 2978sigalrm_seen = FALSE;
c2a1bba0 2979if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
4896a319
AM
2980
2981do
2982 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
2983 MIN(ssl_xfer_buffer_size, lim));
2984while (inbytes == GNUTLS_E_AGAIN);
2985
c2a1bba0 2986if (smtp_receive_timeout > 0) ALARM_CLR(0);
9723f966
JH
2987
2988if (had_command_timeout) /* set by signal handler */
2989 smtp_command_timeout_exit(); /* does not return */
2990if (had_command_sigterm)
2991 smtp_command_sigterm_exit();
2992if (had_data_timeout)
2993 smtp_data_timeout_exit();
2994if (had_data_sigint)
2995 smtp_data_sigint_exit();
2996
2997/* Timeouts do not get this far. A zero-byte return appears to mean that the
2998TLS session has been closed down, not that the socket itself has been closed
2999down. Revert to non-TLS handling. */
0d81dabc
JH
3000
3001if (sigalrm_seen)
3002 {
3003 DEBUG(D_tls) debug_printf("Got tls read timeout\n");
8b77d27a 3004 state->xfer_error = TRUE;
0d81dabc
JH
3005 return FALSE;
3006 }
3007
3008else if (inbytes == 0)
3009 {
3010 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
bd231acd 3011 tls_close(NULL, TLS_NO_SHUTDOWN);
0d81dabc
JH
3012 return FALSE;
3013 }
3014
3015/* Handle genuine errors */
3016
3017else if (inbytes < 0)
3018 {
95f52235 3019 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
0d81dabc 3020 record_io_error(state, (int) inbytes, US"recv", NULL);
8b77d27a 3021 state->xfer_error = TRUE;
0d81dabc
JH
3022 return FALSE;
3023 }
3024#ifndef DISABLE_DKIM
3025dkim_exim_verify_feed(state->xfer_buffer, inbytes);
3026#endif
3027state->xfer_buffer_hwm = (int) inbytes;
3028state->xfer_buffer_lwm = 0;
3029return TRUE;
3030}
3031
059ec3d9
PH
3032/*************************************************
3033* TLS version of getc *
3034*************************************************/
3035
3036/* This gets the next byte from the TLS input buffer. If the buffer is empty,
3037it refills the buffer via the GnuTLS reading function.
817d9f57 3038Only used by the server-side TLS.
059ec3d9 3039
17c76198
PP
3040This feeds DKIM and should be used for all message-body reads.
3041
aded2255 3042Arguments: lim Maximum amount to read/buffer
059ec3d9
PH
3043Returns: the next character or EOF
3044*/
3045
3046int
bd8fbe36 3047tls_getc(unsigned lim)
059ec3d9 3048{
0d81dabc 3049exim_gnutls_state_st * state = &state_server;
059ec3d9 3050
0d81dabc
JH
3051if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3052 if (!tls_refill(lim))
3053 return state->xfer_error ? EOF : smtp_getc(lim);
ed62aae3 3054
0d81dabc 3055/* Something in the buffer; return next uschar */
059ec3d9 3056
0d81dabc
JH
3057return state->xfer_buffer[state->xfer_buffer_lwm++];
3058}
059ec3d9 3059
0d81dabc
JH
3060uschar *
3061tls_getbuf(unsigned * len)
3062{
3063exim_gnutls_state_st * state = &state_server;
3064unsigned size;
3065uschar * buf;
059ec3d9 3066
0d81dabc
JH
3067if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3068 if (!tls_refill(*len))
059ec3d9 3069 {
0d81dabc
JH
3070 if (!state->xfer_error) return smtp_getbuf(len);
3071 *len = 0;
3072 return NULL;
059ec3d9 3073 }
059ec3d9 3074
0d81dabc
JH
3075if ((size = state->xfer_buffer_hwm - state->xfer_buffer_lwm) > *len)
3076 size = *len;
3077buf = &state->xfer_buffer[state->xfer_buffer_lwm];
3078state->xfer_buffer_lwm += size;
3079*len = size;
3080return buf;
059ec3d9
PH
3081}
3082
0d81dabc 3083
584e96c6
JH
3084void
3085tls_get_cache()
3086{
9960d1e5 3087#ifndef DISABLE_DKIM
584e96c6
JH
3088exim_gnutls_state_st * state = &state_server;
3089int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
3090if (n > 0)
3091 dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
584e96c6 3092#endif
9960d1e5 3093}
584e96c6 3094
059ec3d9 3095
925ac8e4
JH
3096BOOL
3097tls_could_read(void)
3098{
3099return state_server.xfer_buffer_lwm < state_server.xfer_buffer_hwm
3100 || gnutls_record_check_pending(state_server.session) > 0;
3101}
3102
3103
059ec3d9 3104
17c76198 3105
059ec3d9
PH
3106/*************************************************
3107* Read bytes from TLS channel *
3108*************************************************/
3109
17c76198
PP
3110/* This does not feed DKIM, so if the caller uses this for reading message body,
3111then the caller must feed DKIM.
817d9f57 3112
059ec3d9 3113Arguments:
74f1a423 3114 ct_ctx client context pointer, or NULL for the one global server context
059ec3d9
PH
3115 buff buffer of data
3116 len size of buffer
3117
3118Returns: the number of bytes read
afdb5e9c 3119 -1 after a failed read, including EOF
059ec3d9
PH
3120*/
3121
3122int
74f1a423 3123tls_read(void * ct_ctx, uschar *buff, size_t len)
059ec3d9 3124{
74f1a423 3125exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
17c76198 3126ssize_t inbytes;
059ec3d9 3127
17c76198
PP
3128if (len > INT_MAX)
3129 len = INT_MAX;
059ec3d9 3130
17c76198
PP
3131if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
3132 DEBUG(D_tls)
3133 debug_printf("*** PROBABLY A BUG *** " \
3134 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
3135 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
3136
3137DEBUG(D_tls)
3138 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
3139 state->session, buff, len);
3140
4896a319
AM
3141do
3142 inbytes = gnutls_record_recv(state->session, buff, len);
3143while (inbytes == GNUTLS_E_AGAIN);
3144
059ec3d9
PH
3145if (inbytes > 0) return inbytes;
3146if (inbytes == 0)
3147 {
3148 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
3149 }
5fd28bb8 3150else
4896a319 3151 {
95f52235 3152 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
4896a319
AM
3153 record_io_error(state, (int)inbytes, US"recv", NULL);
3154 }
059ec3d9
PH
3155
3156return -1;
3157}
3158
3159
3160
17c76198 3161
059ec3d9
PH
3162/*************************************************
3163* Write bytes down TLS channel *
3164*************************************************/
3165
3166/*
3167Arguments:
74f1a423 3168 ct_ctx client context pointer, or NULL for the one global server context
059ec3d9
PH
3169 buff buffer of data
3170 len number of bytes
925ac8e4 3171 more more data expected soon
059ec3d9
PH
3172
3173Returns: the number of bytes after a successful write,
3174 -1 after a failed write
3175*/
3176
3177int
74f1a423 3178tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
059ec3d9 3179{
17c76198
PP
3180ssize_t outbytes;
3181size_t left = len;
74f1a423 3182exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
925ac8e4
JH
3183#ifdef SUPPORT_CORK
3184static BOOL corked = FALSE;
3185
3186if (more && !corked) gnutls_record_cork(state->session);
3187#endif
3188
3189DEBUG(D_tls) debug_printf("%s(%p, " SIZE_T_FMT "%s)\n", __FUNCTION__,
3190 buff, left, more ? ", more" : "");
059ec3d9 3191
059ec3d9
PH
3192while (left > 0)
3193 {
17c76198
PP
3194 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
3195 buff, left);
4896a319
AM
3196
3197 do
3198 outbytes = gnutls_record_send(state->session, buff, left);
3199 while (outbytes == GNUTLS_E_AGAIN);
059ec3d9 3200
17c76198 3201 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
059ec3d9
PH
3202 if (outbytes < 0)
3203 {
1b76ad22 3204 DEBUG(D_tls) debug_printf("%s: gnutls_record_send err\n", __FUNCTION__);
17c76198 3205 record_io_error(state, outbytes, US"send", NULL);
059ec3d9
PH
3206 return -1;
3207 }
3208 if (outbytes == 0)
3209 {
17c76198 3210 record_io_error(state, 0, US"send", US"TLS channel closed on write");
059ec3d9
PH
3211 return -1;
3212 }
3213
3214 left -= outbytes;
3215 buff += outbytes;
3216 }
3217
17c76198
PP
3218if (len > INT_MAX)
3219 {
3220 DEBUG(D_tls)
3221 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
3222 len);
3223 len = INT_MAX;
3224 }
3225
925ac8e4
JH
3226#ifdef SUPPORT_CORK
3227if (more != corked)
3228 {
3229 if (!more) (void) gnutls_record_uncork(state->session, 0);
3230 corked = more;
3231 }
3232#endif
3233
17c76198 3234return (int) len;
059ec3d9
PH
3235}
3236
3237
3238
17c76198 3239
059ec3d9 3240/*************************************************
17c76198 3241* Random number generation *
059ec3d9
PH
3242*************************************************/
3243
17c76198
PP
3244/* Pseudo-random number generation. The result is not expected to be
3245cryptographically strong but not so weak that someone will shoot themselves
3246in the foot using it as a nonce in input in some email header scheme or
3247whatever weirdness they'll twist this into. The result should handle fork()
3248and avoid repeating sequences. OpenSSL handles that for us.
059ec3d9 3249
17c76198
PP
3250Arguments:
3251 max range maximum
3252Returns a random number in range [0, max-1]
059ec3d9
PH
3253*/
3254
af3498d6 3255#ifdef HAVE_GNUTLS_RND
17c76198
PP
3256int
3257vaguely_random_number(int max)
059ec3d9 3258{
17c76198
PP
3259unsigned int r;
3260int i, needed_len;
17c76198
PP
3261uschar smallbuf[sizeof(r)];
3262
3263if (max <= 1)
3264 return 0;
3265
3266needed_len = sizeof(r);
3267/* Don't take 8 times more entropy than needed if int is 8 octets and we were
d7978c0f
JH
3268asked for a number less than 10. */
3269
17c76198
PP
3270for (r = max, i = 0; r; ++i)
3271 r >>= 1;
3272i = (i + 7) / 8;
3273if (i < needed_len)
3274 needed_len = i;
3275
3276i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
3277if (i < 0)
059ec3d9 3278 {
17c76198
PP
3279 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
3280 return vaguely_random_number_fallback(max);
3281 }
3282r = 0;
d7978c0f
JH
3283for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
3284 r = r * 256 + *p;
059ec3d9 3285
17c76198
PP
3286/* We don't particularly care about weighted results; if someone wants
3287 * smooth distribution and cares enough then they should submit a patch then. */
3288return r % max;
059ec3d9 3289}
af3498d6
PP
3290#else /* HAVE_GNUTLS_RND */
3291int
3292vaguely_random_number(int max)
3293{
3294 return vaguely_random_number_fallback(max);
3295}
3296#endif /* HAVE_GNUTLS_RND */
059ec3d9 3297
36f12725
NM
3298
3299
3300
3301/*************************************************
3375e053
PP
3302* Let tls_require_ciphers be checked at startup *
3303*************************************************/
3304
3305/* The tls_require_ciphers option, if set, must be something which the
3306library can parse.
3307
3308Returns: NULL on success, or error message
3309*/
3310
3311uschar *
3312tls_validate_require_cipher(void)
3313{
3314int rc;
3315uschar *expciphers = NULL;
3316gnutls_priority_t priority_cache;
3317const char *errpos;
cf0c6164 3318uschar * dummy_errstr;
3375e053
PP
3319
3320#define validate_check_rc(Label) do { \
3321 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
3322 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
3323#define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
3324
3325if (exim_gnutls_base_init_done)
3326 log_write(0, LOG_MAIN|LOG_PANIC,
3327 "already initialised GnuTLS, Exim developer bug");
3328
a5f239e4 3329#ifdef HAVE_GNUTLS_PKCS11
2519e60d 3330if (!gnutls_allow_auto_pkcs11)
a5f239e4
PP
3331 {
3332 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
3333 validate_check_rc(US"gnutls_pkcs11_init");
3334 }
3335#endif
3375e053
PP
3336rc = gnutls_global_init();
3337validate_check_rc(US"gnutls_global_init()");
3338exim_gnutls_base_init_done = TRUE;
3339
3340if (!(tls_require_ciphers && *tls_require_ciphers))
3341 return_deinit(NULL);
3342
cf0c6164
JH
3343if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
3344 &dummy_errstr))
3375e053
PP
3345 return_deinit(US"failed to expand tls_require_ciphers");
3346
3347if (!(expciphers && *expciphers))
3348 return_deinit(NULL);
3349
3350DEBUG(D_tls)
3351 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
3352
3353rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
3354validate_check_rc(string_sprintf(
3355 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
3356 expciphers, errpos - CS expciphers, errpos));
3357
3358#undef return_deinit
3359#undef validate_check_rc
3360gnutls_global_deinit();