TLS: add variables for the IETF standard name for the connection ciphersuite
[exim.git] / src / src / tls-gnu.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
f9ba5e22 5/* Copyright (c) University of Cambridge 1995 - 2018 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
17c76198 8/* Copyright (c) Phil Pennock 2012 */
059ec3d9 9
17c76198
PP
10/* This file provides TLS/SSL support for Exim using the GnuTLS library,
11one of the available supported implementations. This file is #included into
12tls.c when USE_GNUTLS has been set.
059ec3d9 13
17c76198
PP
14The code herein is a revamp of GnuTLS integration using the current APIs; the
15original tls-gnu.c was based on a patch which was contributed by Nikos
6aa6fc9c 16Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
17c76198 17appropriate.
059ec3d9 18
17c76198
PP
19APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20which is not widely deployed by OS vendors. Will note issues below, which may
21assist in updating the code in the future. Another sources of hints is
22mod_gnutls for Apache (SNI callback registration and handling).
059ec3d9 23
17c76198
PP
24Keeping client and server variables more split than before and is currently
25the norm, in anticipation of TLS in ACL callouts.
059ec3d9 26
17c76198
PP
27I wanted to switch to gnutls_certificate_set_verify_function() so that
28certificate rejection could happen during handshake where it belongs, rather
29than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30(6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
059ec3d9 31
17c76198
PP
32(I wasn't looking for libraries quite that old, when updating to get rid of
33compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34require current GnuTLS, then we'll drop support for the ancient libraries).
35*/
b5aea5e1 36
17c76198
PP
37#include <gnutls/gnutls.h>
38/* needed for cert checks in verification and DN extraction: */
39#include <gnutls/x509.h>
40/* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41#include <gnutls/crypto.h>
184384c3 42
a5f239e4
PP
43/* needed to disable PKCS11 autoload unless requested */
44#if GNUTLS_VERSION_NUMBER >= 0x020c00
45# include <gnutls/pkcs11.h>
76075bb5 46# define SUPPORT_PARAM_TO_PK_BITS
a5f239e4 47#endif
7e07527a
JH
48#if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
49# warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
50# define DISABLE_OCSP
51#endif
0cbf2b82 52#if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
774ef2d7 53# warning "GnuTLS library version too old; tls:cert event unsupported"
0cbf2b82 54# define DISABLE_EVENT
a7538db1 55#endif
a7fec7a7
JH
56#if GNUTLS_VERSION_NUMBER >= 0x030306
57# define SUPPORT_CA_DIR
58#else
59# undef SUPPORT_CA_DIR
60#endif
11a04b5a 61#if GNUTLS_VERSION_NUMBER >= 0x030014
cb1d7830
JH
62# define SUPPORT_SYSDEFAULT_CABUNDLE
63#endif
184384c3
JH
64#if GNUTLS_VERSION_NUMBER >= 0x030104
65# define GNUTLS_CERT_VFY_STATUS_PRINT
66#endif
925ac8e4
JH
67#if GNUTLS_VERSION_NUMBER >= 0x030109
68# define SUPPORT_CORK
69#endif
f20cfa4a
JH
70#if GNUTLS_VERSION_NUMBER >= 0x03010a
71# define SUPPORT_GNUTLS_SESS_DESC
72#endif
73#if GNUTLS_VERSION_NUMBER >= 0x030500
74# define SUPPORT_GNUTLS_KEYLOG
75#endif
47195144
JH
76#if GNUTLS_VERSION_NUMBER >= 0x030506 && !defined(DISABLE_OCSP)
77# define SUPPORT_SRV_OCSP_STACK
78#endif
c0635b6d
JH
79
80#ifdef SUPPORT_DANE
81# if GNUTLS_VERSION_NUMBER >= 0x030000
82# define DANESSL_USAGE_DANE_TA 2
83# define DANESSL_USAGE_DANE_EE 3
84# else
85# error GnuTLS version too early for DANE
86# endif
87# if GNUTLS_VERSION_NUMBER < 0x999999
88# define GNUTLS_BROKEN_DANE_VALIDATION
89# endif
899b8bbc 90#endif
7e07527a 91
f2de3a33 92#ifndef DISABLE_OCSP
2b4a568d
JH
93# include <gnutls/ocsp.h>
94#endif
899b8bbc
JH
95#ifdef SUPPORT_DANE
96# include <gnutls/dane.h>
97#endif
059ec3d9 98
f1be21cf
JH
99#include "tls-cipher-stdname.c"
100
101
17c76198 102/* GnuTLS 2 vs 3
059ec3d9 103
17c76198
PP
104GnuTLS 3 only:
105 gnutls_global_set_audit_log_function()
059ec3d9 106
17c76198
PP
107Changes:
108 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
109*/
059ec3d9 110
17c76198 111/* Local static variables for GnuTLS */
059ec3d9 112
17c76198 113/* Values for verify_requirement */
059ec3d9 114
e51c7be2 115enum peer_verify_requirement
899b8bbc 116 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED, VERIFY_DANE };
059ec3d9 117
17c76198
PP
118/* This holds most state for server or client; with this, we can set up an
119outbound TLS-enabled connection in an ACL callout, while not stomping all
120over the TLS variables available for expansion.
059ec3d9 121
17c76198
PP
122Some of these correspond to variables in globals.c; those variables will
123be set to point to content in one of these instances, as appropriate for
124the stage of the process lifetime.
059ec3d9 125
389ca47a 126Not handled here: global tls_channelbinding_b64.
17c76198 127*/
059ec3d9 128
17c76198 129typedef struct exim_gnutls_state {
9d1c15ef 130 gnutls_session_t session;
17c76198 131 gnutls_certificate_credentials_t x509_cred;
9d1c15ef 132 gnutls_priority_t priority_cache;
17c76198 133 enum peer_verify_requirement verify_requirement;
9d1c15ef
JH
134 int fd_in;
135 int fd_out;
136 BOOL peer_cert_verified;
899b8bbc 137 BOOL peer_dane_verified;
9d1c15ef
JH
138 BOOL trigger_sni_changes;
139 BOOL have_set_peerdn;
5fd28bb8 140 const struct host_item *host; /* NULL if server */
afdb5e9c 141 gnutls_x509_crt_t peercert;
9d1c15ef
JH
142 uschar *peerdn;
143 uschar *ciphersuite;
144 uschar *received_sni;
17c76198
PP
145
146 const uschar *tls_certificate;
147 const uschar *tls_privatekey;
148 const uschar *tls_sni; /* client send only, not received */
149 const uschar *tls_verify_certificates;
150 const uschar *tls_crl;
151 const uschar *tls_require_ciphers;
e51c7be2 152
17c76198
PP
153 uschar *exp_tls_certificate;
154 uschar *exp_tls_privatekey;
17c76198
PP
155 uschar *exp_tls_verify_certificates;
156 uschar *exp_tls_crl;
157 uschar *exp_tls_require_ciphers;
55414b25 158 const uschar *exp_tls_verify_cert_hostnames;
0cbf2b82 159#ifndef DISABLE_EVENT
a7538db1
JH
160 uschar *event_action;
161#endif
899b8bbc
JH
162#ifdef SUPPORT_DANE
163 char * const * dane_data;
164 const int * dane_data_len;
165#endif
17c76198 166
389ca47a 167 tls_support *tlsp; /* set in tls_init() */
817d9f57 168
17c76198
PP
169 uschar *xfer_buffer;
170 int xfer_buffer_lwm;
171 int xfer_buffer_hwm;
8b77d27a
JH
172 BOOL xfer_eof; /*XXX never gets set! */
173 BOOL xfer_error;
17c76198
PP
174} exim_gnutls_state_st;
175
176static const exim_gnutls_state_st exim_gnutls_state_init = {
f2ed27cf
JH
177 .session = NULL,
178 .x509_cred = NULL,
179 .priority_cache = NULL,
180 .verify_requirement = VERIFY_NONE,
181 .fd_in = -1,
182 .fd_out = -1,
183 .peer_cert_verified = FALSE,
899b8bbc 184 .peer_dane_verified = FALSE,
f2ed27cf
JH
185 .trigger_sni_changes =FALSE,
186 .have_set_peerdn = FALSE,
187 .host = NULL,
188 .peercert = NULL,
189 .peerdn = NULL,
190 .ciphersuite = NULL,
191 .received_sni = NULL,
192
193 .tls_certificate = NULL,
194 .tls_privatekey = NULL,
195 .tls_sni = NULL,
196 .tls_verify_certificates = NULL,
197 .tls_crl = NULL,
198 .tls_require_ciphers =NULL,
199
200 .exp_tls_certificate = NULL,
201 .exp_tls_privatekey = NULL,
202 .exp_tls_verify_certificates = NULL,
203 .exp_tls_crl = NULL,
204 .exp_tls_require_ciphers = NULL,
f2ed27cf 205 .exp_tls_verify_cert_hostnames = NULL,
0cbf2b82 206#ifndef DISABLE_EVENT
f2ed27cf 207 .event_action = NULL,
a7538db1 208#endif
f2ed27cf
JH
209 .tlsp = NULL,
210
211 .xfer_buffer = NULL,
212 .xfer_buffer_lwm = 0,
213 .xfer_buffer_hwm = 0,
8b77d27a
JH
214 .xfer_eof = FALSE,
215 .xfer_error = FALSE,
17c76198 216};
83da1223 217
17c76198
PP
218/* Not only do we have our own APIs which don't pass around state, assuming
219it's held in globals, GnuTLS doesn't appear to let us register callback data
220for callbacks, or as part of the session, so we have to keep a "this is the
221context we're currently dealing with" pointer and rely upon being
222single-threaded to keep from processing data on an inbound TLS connection while
223talking to another TLS connection for an outbound check. This does mean that
224there's no way for heart-beats to be responded to, for the duration of the
a7538db1
JH
225second connection.
226XXX But see gnutls_session_get_ptr()
227*/
059ec3d9 228
74f1a423 229static exim_gnutls_state_st state_server;
059ec3d9 230
17c76198
PP
231/* dh_params are initialised once within the lifetime of a process using TLS;
232if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
233don't want to repeat this. */
83da1223 234
17c76198 235static gnutls_dh_params_t dh_server_params = NULL;
059ec3d9 236
17c76198 237/* No idea how this value was chosen; preserving it. Default is 3600. */
059ec3d9 238
17c76198 239static const int ssl_session_timeout = 200;
059ec3d9 240
17c76198 241static const char * const exim_default_gnutls_priority = "NORMAL";
83da1223 242
17c76198 243/* Guard library core initialisation */
83da1223 244
17c76198 245static BOOL exim_gnutls_base_init_done = FALSE;
059ec3d9 246
4fb7df6d 247#ifndef DISABLE_OCSP
9196d5bf 248static BOOL gnutls_buggy_ocsp = FALSE;
4fb7df6d 249#endif
9196d5bf 250
059ec3d9 251
17c76198 252/* ------------------------------------------------------------------------ */
17c76198 253/* macros */
83da1223 254
17c76198 255#define MAX_HOST_LEN 255
83da1223 256
17c76198
PP
257/* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
258the library logging; a value less than 0 disables the calls to set up logging
ef9da2ee
JH
259callbacks. Possibly GNuTLS also looks for an environment variable
260"GNUTLS_DEBUG_LEVEL". */
2c17bb02 261#ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
a7538db1 262# define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
2c17bb02 263#endif
83da1223 264
2c17bb02 265#ifndef EXIM_CLIENT_DH_MIN_BITS
a7538db1 266# define EXIM_CLIENT_DH_MIN_BITS 1024
2c17bb02 267#endif
83da1223 268
af3498d6
PP
269/* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
270can ask for a bit-strength. Without that, we stick to the constant we had
271before, for now. */
2c17bb02 272#ifndef EXIM_SERVER_DH_BITS_PRE2_12
a7538db1 273# define EXIM_SERVER_DH_BITS_PRE2_12 1024
2c17bb02 274#endif
af3498d6 275
47195144
JH
276#define exim_gnutls_err_check(rc, Label) do { \
277 if ((rc) != GNUTLS_E_SUCCESS) \
48224640 278 return tls_error((Label), US gnutls_strerror(rc), host, errstr); \
cf0c6164 279 } while (0)
059ec3d9 280
cf0c6164
JH
281#define expand_check_tlsvar(Varname, errstr) \
282 expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr)
83da1223 283
17c76198 284#if GNUTLS_VERSION_NUMBER >= 0x020c00
e51c7be2
JH
285# define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
286# define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
287# define HAVE_GNUTLS_RND
2519e60d
TL
288/* The security fix we provide with the gnutls_allow_auto_pkcs11 option
289 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
290 * isn't available sometimes, so this needs to become a conditional
291 * compilation; the sanest way to deal with this being a problem on
292 * older OSes is to block it in the Local/Makefile with this compiler
293 * definition */
e51c7be2
JH
294# ifndef AVOID_GNUTLS_PKCS11
295# define HAVE_GNUTLS_PKCS11
296# endif /* AVOID_GNUTLS_PKCS11 */
17c76198 297#endif
83da1223 298
af3498d6
PP
299
300
301
302/* ------------------------------------------------------------------------ */
303/* Callback declarations */
304
305#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
306static void exim_gnutls_logger_cb(int level, const char *message);
307#endif
308
309static int exim_sni_handling_cb(gnutls_session_t session);
310
f2de3a33 311#ifndef DISABLE_OCSP
44662487
JH
312static int server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
313 gnutls_datum_t * ocsp_response);
314#endif
af3498d6
PP
315
316
317
17c76198
PP
318/* ------------------------------------------------------------------------ */
319/* Static functions */
059ec3d9
PH
320
321/*************************************************
322* Handle TLS error *
323*************************************************/
324
325/* Called from lots of places when errors occur before actually starting to do
326the TLS handshake, that is, while the session is still in clear. Always returns
327DEFER for a server and FAIL for a client so that most calls can use "return
328tls_error(...)" to do this processing and then give an appropriate return. A
329single function is used for both server and client, because it is called from
330some shared functions.
331
332Argument:
333 prefix text to include in the logged error
7199e1ee
TF
334 msg additional error string (may be NULL)
335 usually obtained from gnutls_strerror()
17c76198
PP
336 host NULL if setting up a server;
337 the connected host if setting up a client
cf0c6164 338 errstr pointer to returned error string
059ec3d9
PH
339
340Returns: OK/DEFER/FAIL
341*/
342
343static int
48224640 344tls_error(const uschar *prefix, const uschar *msg, const host_item *host,
cf0c6164 345 uschar ** errstr)
059ec3d9 346{
cf0c6164 347if (errstr)
48224640 348 *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : US"");
cf0c6164 349return host ? FAIL : DEFER;
059ec3d9
PH
350}
351
352
353
17c76198 354
059ec3d9 355/*************************************************
17c76198 356* Deal with logging errors during I/O *
059ec3d9
PH
357*************************************************/
358
17c76198 359/* We have to get the identity of the peer from saved data.
059ec3d9 360
17c76198
PP
361Argument:
362 state the current GnuTLS exim state container
363 rc the GnuTLS error code, or 0 if it's a local error
364 when text identifying read or write
365 text local error text when ec is 0
059ec3d9 366
17c76198 367Returns: nothing
059ec3d9
PH
368*/
369
17c76198
PP
370static void
371record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
059ec3d9 372{
48224640 373const uschar * msg;
cf0c6164 374uschar * errstr;
059ec3d9 375
17c76198 376if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
48224640 377 msg = string_sprintf("%s: %s", US gnutls_strerror(rc),
17c76198
PP
378 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
379else
48224640 380 msg = US gnutls_strerror(rc);
059ec3d9 381
cf0c6164
JH
382(void) tls_error(when, msg, state->host, &errstr);
383
384if (state->host)
385 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection %s",
386 state->host->name, state->host->address, errstr);
387else
388 {
389 uschar * conn_info = smtp_get_connection_info();
390 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0) conn_info += 5;
391 /* I'd like to get separated H= here, but too hard for now */
392 log_write(0, LOG_MAIN, "TLS error on %s %s", conn_info, errstr);
393 }
17c76198 394}
059ec3d9 395
059ec3d9 396
059ec3d9 397
059ec3d9 398
17c76198
PP
399/*************************************************
400* Set various Exim expansion vars *
401*************************************************/
059ec3d9 402
e51c7be2
JH
403#define exim_gnutls_cert_err(Label) \
404 do \
405 { \
406 if (rc != GNUTLS_E_SUCCESS) \
407 { \
408 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
409 (Label), gnutls_strerror(rc)); \
410 return rc; \
411 } \
412 } while (0)
9d1c15ef
JH
413
414static int
27f19eb4 415import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
9d1c15ef
JH
416{
417int rc;
418
419rc = gnutls_x509_crt_init(crtp);
420exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
421
422rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
423exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
424
425return rc;
426}
427
428#undef exim_gnutls_cert_err
429
430
17c76198
PP
431/* We set various Exim global variables from the state, once a session has
432been established. With TLS callouts, may need to change this to stack
433variables, or just re-call it with the server state after client callout
434has finished.
059ec3d9 435
9d1c15ef 436Make sure anything set here is unset in tls_getc().
17c76198
PP
437
438Sets:
439 tls_active fd
440 tls_bits strength indicator
441 tls_certificate_verified bool indicator
442 tls_channelbinding_b64 for some SASL mechanisms
443 tls_cipher a string
9d1c15ef 444 tls_peercert pointer to library internal
17c76198
PP
445 tls_peerdn a string
446 tls_sni a (UTF-8) string
9d1c15ef 447 tls_ourcert pointer to library internal
17c76198
PP
448
449Argument:
450 state the relevant exim_gnutls_state_st *
451*/
452
453static void
9d1c15ef 454extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
17c76198 455{
17c76198 456gnutls_cipher_algorithm_t cipher;
17c76198
PP
457#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
458int old_pool;
459int rc;
460gnutls_datum_t channel;
461#endif
9d1c15ef 462tls_support * tlsp = state->tlsp;
17c76198 463
74f1a423
JH
464tlsp->active.sock = state->fd_out;
465tlsp->active.tls_ctx = state;
17c76198
PP
466
467cipher = gnutls_cipher_get(state->session);
468/* returns size in "bytes" */
9d1c15ef 469tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
17c76198 470
9d1c15ef 471tlsp->cipher = state->ciphersuite;
17c76198 472
817d9f57 473DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
17c76198 474
9d1c15ef 475tlsp->certificate_verified = state->peer_cert_verified;
899b8bbc
JH
476#ifdef SUPPORT_DANE
477tlsp->dane_verified = state->peer_dane_verified;
478#endif
059ec3d9 479
17c76198
PP
480/* note that tls_channelbinding_b64 is not saved to the spool file, since it's
481only available for use for authenticators while this TLS session is running. */
482
483tls_channelbinding_b64 = NULL;
484#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
485channel.data = NULL;
486channel.size = 0;
1f20760b
JH
487if ((rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel)))
488 { DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc)); }
489else
490 {
17c76198
PP
491 old_pool = store_pool;
492 store_pool = POOL_PERM;
1f20760b 493 tls_channelbinding_b64 = b64encode(CUS channel.data, (int)channel.size);
17c76198
PP
494 store_pool = old_pool;
495 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
1f20760b 496 }
17c76198
PP
497#endif
498
9d1c15ef
JH
499/* peercert is set in peer_status() */
500tlsp->peerdn = state->peerdn;
501tlsp->sni = state->received_sni;
502
503/* record our certificate */
504 {
27f19eb4 505 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
9d1c15ef
JH
506 gnutls_x509_crt_t crt;
507
508 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
509 }
059ec3d9
PH
510}
511
512
513
17c76198 514
059ec3d9 515/*************************************************
575643cd 516* Setup up DH parameters *
059ec3d9
PH
517*************************************************/
518
575643cd 519/* Generating the D-H parameters may take a long time. They only need to
059ec3d9
PH
520be re-generated every so often, depending on security policy. What we do is to
521keep these parameters in a file in the spool directory. If the file does not
522exist, we generate them. This means that it is easy to cause a regeneration.
523
524The new file is written as a temporary file and renamed, so that an incomplete
525file is never present. If two processes both compute some new parameters, you
526waste a bit of effort, but it doesn't seem worth messing around with locking to
527prevent this.
528
059ec3d9
PH
529Returns: OK/DEFER/FAIL
530*/
531
532static int
cf0c6164 533init_server_dh(uschar ** errstr)
059ec3d9 534{
17c76198
PP
535int fd, rc;
536unsigned int dh_bits;
27f19eb4 537gnutls_datum_t m;
a799883d
PP
538uschar filename_buf[PATH_MAX];
539uschar *filename = NULL;
17c76198 540size_t sz;
a799883d
PP
541uschar *exp_tls_dhparam;
542BOOL use_file_in_spool = FALSE;
543BOOL use_fixed_file = FALSE;
17c76198 544host_item *host = NULL; /* dummy for macros */
059ec3d9 545
17c76198 546DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
059ec3d9 547
17c76198 548rc = gnutls_dh_params_init(&dh_server_params);
47195144 549exim_gnutls_err_check(rc, US"gnutls_dh_params_init");
059ec3d9 550
a799883d
PP
551m.data = NULL;
552m.size = 0;
553
cf0c6164 554if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam, errstr))
a799883d
PP
555 return DEFER;
556
557if (!exp_tls_dhparam)
558 {
559 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
560 m.data = US std_dh_prime_default();
561 m.size = Ustrlen(m.data);
562 }
563else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
564 use_file_in_spool = TRUE;
565else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
566 {
567 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
568 return OK;
569 }
570else if (exp_tls_dhparam[0] != '/')
571 {
f5d25c2b 572 if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
48224640 573 return tls_error(US"No standard prime named", exp_tls_dhparam, NULL, errstr);
a799883d
PP
574 m.size = Ustrlen(m.data);
575 }
576else
577 {
578 use_fixed_file = TRUE;
579 filename = exp_tls_dhparam;
580 }
581
582if (m.data)
583 {
584 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
47195144 585 exim_gnutls_err_check(rc, US"gnutls_dh_params_import_pkcs3");
a799883d
PP
586 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
587 return OK;
588 }
589
af3498d6
PP
590#ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
591/* If you change this constant, also change dh_param_fn_ext so that we can use a
17c76198
PP
592different filename and ensure we have sufficient bits. */
593dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
594if (!dh_bits)
cf0c6164 595 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL, errstr);
af3498d6 596DEBUG(D_tls)
b34fc30c 597 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
af3498d6
PP
598 dh_bits);
599#else
600dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
601DEBUG(D_tls)
602 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
603 dh_bits);
604#endif
059ec3d9 605
3375e053
PP
606/* Some clients have hard-coded limits. */
607if (dh_bits > tls_dh_max_bits)
608 {
609 DEBUG(D_tls)
610 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
611 tls_dh_max_bits);
612 dh_bits = tls_dh_max_bits;
613 }
614
a799883d
PP
615if (use_file_in_spool)
616 {
617 if (!string_format(filename_buf, sizeof(filename_buf),
618 "%s/gnutls-params-%d", spool_directory, dh_bits))
cf0c6164 619 return tls_error(US"overlong filename", NULL, NULL, errstr);
a799883d
PP
620 filename = filename_buf;
621 }
059ec3d9 622
b5aea5e1 623/* Open the cache file for reading and if successful, read it and set up the
575643cd 624parameters. */
059ec3d9 625
f5d25c2b 626if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
059ec3d9 627 {
b5aea5e1 628 struct stat statbuf;
17c76198
PP
629 FILE *fp;
630 int saved_errno;
631
632 if (fstat(fd, &statbuf) < 0) /* EIO */
633 {
634 saved_errno = errno;
635 (void)close(fd);
48224640 636 return tls_error(US"TLS cache stat failed", US strerror(saved_errno), NULL, errstr);
17c76198
PP
637 }
638 if (!S_ISREG(statbuf.st_mode))
b5aea5e1
PH
639 {
640 (void)close(fd);
cf0c6164 641 return tls_error(US"TLS cache not a file", NULL, NULL, errstr);
17c76198 642 }
40c90bca 643 if (!(fp = fdopen(fd, "rb")))
17c76198
PP
644 {
645 saved_errno = errno;
646 (void)close(fd);
647 return tls_error(US"fdopen(TLS cache stat fd) failed",
48224640 648 US strerror(saved_errno), NULL, errstr);
b5aea5e1 649 }
059ec3d9 650
b5aea5e1 651 m.size = statbuf.st_size;
40c90bca 652 if (!(m.data = malloc(m.size)))
17c76198
PP
653 {
654 fclose(fp);
48224640 655 return tls_error(US"malloc failed", US strerror(errno), NULL, errstr);
17c76198 656 }
40c90bca 657 if (!(sz = fread(m.data, m.size, 1, fp)))
17c76198
PP
658 {
659 saved_errno = errno;
660 fclose(fp);
661 free(m.data);
48224640 662 return tls_error(US"fread failed", US strerror(saved_errno), NULL, errstr);
17c76198
PP
663 }
664 fclose(fp);
b5aea5e1 665
17c76198 666 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
b5aea5e1 667 free(m.data);
47195144 668 exim_gnutls_err_check(rc, US"gnutls_dh_params_import_pkcs3");
17c76198 669 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
b5aea5e1
PH
670 }
671
672/* If the file does not exist, fall through to compute new data and cache it.
673If there was any other opening error, it is serious. */
674
182ad5cf
PH
675else if (errno == ENOENT)
676 {
17c76198 677 rc = -1;
182ad5cf 678 DEBUG(D_tls)
17c76198 679 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
182ad5cf
PH
680 }
681else
17c76198 682 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
cf0c6164 683 NULL, NULL, errstr);
b5aea5e1
PH
684
685/* If ret < 0, either the cache file does not exist, or the data it contains
686is not useful. One particular case of this is when upgrading from an older
687release of Exim in which the data was stored in a different format. We don't
688try to be clever and support both formats; we just regenerate new data in this
689case. */
690
17c76198 691if (rc < 0)
b5aea5e1 692 {
17c76198 693 uschar *temp_fn;
201f5254 694 unsigned int dh_bits_gen = dh_bits;
059ec3d9 695
17c76198
PP
696 if ((PATH_MAX - Ustrlen(filename)) < 10)
697 return tls_error(US"Filename too long to generate replacement",
48224640 698 filename, NULL, errstr);
059ec3d9 699
48224640 700 temp_fn = string_copy(US"%s.XXXXXXX");
f5d25c2b 701 if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */
48224640 702 return tls_error(US"Unable to open temp file", US strerror(errno), NULL, errstr);
059ec3d9
PH
703 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
704
201f5254
PP
705 /* GnuTLS overshoots!
706 * If we ask for 2236, we might get 2237 or more.
707 * But there's no way to ask GnuTLS how many bits there really are.
708 * We can ask how many bits were used in a TLS session, but that's it!
709 * The prime itself is hidden behind too much abstraction.
710 * So we ask for less, and proceed on a wing and a prayer.
711 * First attempt, subtracted 3 for 2233 and got 2240.
712 */
cae6e576 713 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
201f5254
PP
714 {
715 dh_bits_gen = dh_bits - 10;
716 DEBUG(D_tls)
717 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
718 dh_bits_gen);
719 }
720
721 DEBUG(D_tls)
722 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
723 dh_bits_gen);
724 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen);
47195144 725 exim_gnutls_err_check(rc, US"gnutls_dh_params_generate2");
17c76198
PP
726
727 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
728 and I confirmed that a NULL call to get the size first is how the GnuTLS
729 sample apps handle this. */
730
731 sz = 0;
732 m.data = NULL;
733 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
734 m.data, &sz);
735 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
47195144 736 exim_gnutls_err_check(rc, US"gnutls_dh_params_export_pkcs3(NULL) sizing");
17c76198 737 m.size = sz;
40c90bca 738 if (!(m.data = malloc(m.size)))
48224640 739 return tls_error(US"memory allocation failed", US strerror(errno), NULL, errstr);
40c90bca 740
1f00591e 741 /* this will return a size 1 less than the allocation size above */
17c76198 742 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
1f00591e 743 m.data, &sz);
17c76198
PP
744 if (rc != GNUTLS_E_SUCCESS)
745 {
746 free(m.data);
47195144 747 exim_gnutls_err_check(rc, US"gnutls_dh_params_export_pkcs3() real");
17c76198 748 }
1f00591e 749 m.size = sz; /* shrink by 1, probably */
059ec3d9 750
f5d25c2b 751 if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
17c76198
PP
752 {
753 free(m.data);
754 return tls_error(US"TLS cache write D-H params failed",
48224640 755 US strerror(errno), NULL, errstr);
17c76198 756 }
b5aea5e1 757 free(m.data);
f5d25c2b 758 if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
17c76198 759 return tls_error(US"TLS cache write D-H params final newline failed",
48224640 760 US strerror(errno), NULL, errstr);
17c76198 761
f5d25c2b 762 if ((rc = close(fd)))
48224640 763 return tls_error(US"TLS cache write close() failed", US strerror(errno), NULL, errstr);
059ec3d9 764
17c76198
PP
765 if (Urename(temp_fn, filename) < 0)
766 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
48224640 767 temp_fn, filename), US strerror(errno), NULL, errstr);
059ec3d9 768
17c76198 769 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
059ec3d9
PH
770 }
771
17c76198 772DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
059ec3d9
PH
773return OK;
774}
775
776
777
778
23bb6982
JH
779/* Create and install a selfsigned certificate, for use in server mode */
780
781static int
cf0c6164 782tls_install_selfsign(exim_gnutls_state_st * state, uschar ** errstr)
23bb6982
JH
783{
784gnutls_x509_crt_t cert = NULL;
785time_t now;
786gnutls_x509_privkey_t pkey = NULL;
787const uschar * where;
788int rc;
789
790where = US"initialising pkey";
791if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
792
793where = US"initialising cert";
794if ((rc = gnutls_x509_crt_init(&cert))) goto err;
795
796where = US"generating pkey";
797if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
76075bb5 798#ifdef SUPPORT_PARAM_TO_PK_BITS
4312da48
JH
799# ifndef GNUTLS_SEC_PARAM_MEDIUM
800# define GNUTLS_SEC_PARAM_MEDIUM GNUTLS_SEC_PARAM_HIGH
801# endif
6aac3239 802 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_MEDIUM),
76075bb5 803#else
6aac3239 804 2048,
76075bb5
JH
805#endif
806 0)))
23bb6982
JH
807 goto err;
808
809where = US"configuring cert";
1613fd68 810now = 1;
23bb6982
JH
811if ( (rc = gnutls_x509_crt_set_version(cert, 3))
812 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
813 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
814 || (rc = gnutls_x509_crt_set_expiration_time(cert, now + 60 * 60)) /* 1 hr */
815 || (rc = gnutls_x509_crt_set_key(cert, pkey))
816
817 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
818 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
819 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
820 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
821 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
822 GNUTLS_OID_X520_COMMON_NAME, 0,
823 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
824 )
825 goto err;
826
827where = US"signing cert";
828if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
829
830where = US"installing selfsign cert";
831 /* Since: 2.4.0 */
832if ((rc = gnutls_certificate_set_x509_key(state->x509_cred, &cert, 1, pkey)))
833 goto err;
834
835rc = OK;
836
837out:
838 if (cert) gnutls_x509_crt_deinit(cert);
839 if (pkey) gnutls_x509_privkey_deinit(pkey);
840 return rc;
841
842err:
48224640 843 rc = tls_error(where, US gnutls_strerror(rc), NULL, errstr);
23bb6982
JH
844 goto out;
845}
846
847
848
849
47195144
JH
850/* Add certificate and key, from files.
851
852Return:
853 Zero or negative: good. Negate value for certificate index if < 0.
854 Greater than zero: FAIL or DEFER code.
855*/
856
ba86e143
JH
857static int
858tls_add_certfile(exim_gnutls_state_st * state, const host_item * host,
859 uschar * certfile, uschar * keyfile, uschar ** errstr)
860{
861int rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
862 CS certfile, CS keyfile, GNUTLS_X509_FMT_PEM);
47195144
JH
863if (rc < 0)
864 return tls_error(
865 string_sprintf("cert/key setup: cert=%s key=%s", certfile, keyfile),
48224640 866 US gnutls_strerror(rc), host, errstr);
47195144 867return -rc;
ba86e143
JH
868}
869
870
059ec3d9 871/*************************************************
17c76198 872* Variables re-expanded post-SNI *
059ec3d9
PH
873*************************************************/
874
17c76198
PP
875/* Called from both server and client code, via tls_init(), and also from
876the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
877
878We can tell the two apart by state->received_sni being non-NULL in callback.
879
880The callback should not call us unless state->trigger_sni_changes is true,
881which we are responsible for setting on the first pass through.
059ec3d9
PH
882
883Arguments:
17c76198 884 state exim_gnutls_state_st *
cf0c6164 885 errstr error string pointer
059ec3d9
PH
886
887Returns: OK/DEFER/FAIL
888*/
889
890static int
ba86e143 891tls_expand_session_files(exim_gnutls_state_st * state, uschar ** errstr)
059ec3d9 892{
1365611d 893struct stat statbuf;
059ec3d9 894int rc;
17c76198
PP
895const host_item *host = state->host; /* macro should be reconsidered? */
896uschar *saved_tls_certificate = NULL;
897uschar *saved_tls_privatekey = NULL;
898uschar *saved_tls_verify_certificates = NULL;
899uschar *saved_tls_crl = NULL;
900int cert_count;
901
902/* We check for tls_sni *before* expansion. */
2b4a568d 903if (!host) /* server */
17c76198
PP
904 if (!state->received_sni)
905 {
ba86e143
JH
906 if ( state->tls_certificate
907 && ( Ustrstr(state->tls_certificate, US"tls_sni")
908 || Ustrstr(state->tls_certificate, US"tls_in_sni")
909 || Ustrstr(state->tls_certificate, US"tls_out_sni")
910 ) )
17c76198
PP
911 {
912 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
913 state->trigger_sni_changes = TRUE;
914 }
915 }
916 else
917 {
1365611d 918 /* useful for debugging */
17c76198
PP
919 saved_tls_certificate = state->exp_tls_certificate;
920 saved_tls_privatekey = state->exp_tls_privatekey;
921 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
922 saved_tls_crl = state->exp_tls_crl;
923 }
059ec3d9 924
1365611d 925rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
47195144
JH
926exim_gnutls_err_check(rc, US"gnutls_certificate_allocate_credentials");
927
928#ifdef SUPPORT_SRV_OCSP_STACK
929gnutls_certificate_set_flags(state->x509_cred, GNUTLS_CERTIFICATE_API_V2);
930#endif
1365611d 931
17c76198
PP
932/* remember: expand_check_tlsvar() is expand_check() but fiddling with
933state members, assuming consistent naming; and expand_check() returns
934false if expansion failed, unless expansion was forced to fail. */
059ec3d9 935
17c76198
PP
936/* check if we at least have a certificate, before doing expensive
937D-H generation. */
059ec3d9 938
cf0c6164 939if (!expand_check_tlsvar(tls_certificate, errstr))
17c76198 940 return DEFER;
059ec3d9 941
17c76198 942/* certificate is mandatory in server, optional in client */
059ec3d9 943
23bb6982
JH
944if ( !state->exp_tls_certificate
945 || !*state->exp_tls_certificate
946 )
2b4a568d 947 if (!host)
cf0c6164 948 return tls_install_selfsign(state, errstr);
17c76198
PP
949 else
950 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
059ec3d9 951
cf0c6164 952if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey, errstr))
059ec3d9
PH
953 return DEFER;
954
17c76198
PP
955/* tls_privatekey is optional, defaulting to same file as certificate */
956
957if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
059ec3d9 958 {
17c76198
PP
959 state->tls_privatekey = state->tls_certificate;
960 state->exp_tls_privatekey = state->exp_tls_certificate;
059ec3d9 961 }
c91535f3 962
059ec3d9 963
17c76198 964if (state->exp_tls_certificate && *state->exp_tls_certificate)
059ec3d9
PH
965 {
966 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
17c76198
PP
967 state->exp_tls_certificate, state->exp_tls_privatekey);
968
969 if (state->received_sni)
23bb6982
JH
970 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
971 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
972 )
17c76198 973 {
b34fc30c 974 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
17c76198
PP
975 }
976 else
977 {
b34fc30c 978 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
17c76198 979 }
059ec3d9 980
ba86e143
JH
981 if (!host) /* server */
982 {
983 const uschar * clist = state->exp_tls_certificate;
984 const uschar * klist = state->exp_tls_privatekey;
47195144
JH
985 const uschar * olist;
986 int csep = 0, ksep = 0, osep = 0, cnt = 0;
987 uschar * cfile, * kfile, * ofile;
988
989#ifndef DISABLE_OCSP
990 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file", &ofile, errstr))
991 return DEFER;
992 olist = ofile;
993#endif
ba86e143
JH
994
995 while (cfile = string_nextinlist(&clist, &csep, NULL, 0))
47195144 996
ba86e143
JH
997 if (!(kfile = string_nextinlist(&klist, &ksep, NULL, 0)))
998 return tls_error(US"cert/key setup: out of keys", NULL, host, errstr);
47195144 999 else if (0 < (rc = tls_add_certfile(state, host, cfile, kfile, errstr)))
ba86e143
JH
1000 return rc;
1001 else
47195144
JH
1002 {
1003 int gnutls_cert_index = -rc;
ba86e143 1004 DEBUG(D_tls) debug_printf("TLS: cert/key %s registered\n", cfile);
47195144
JH
1005
1006 /* Set the OCSP stapling server info */
1007
1008#ifndef DISABLE_OCSP
1009 if (tls_ocsp_file)
1010 if (gnutls_buggy_ocsp)
1011 {
1012 DEBUG(D_tls)
1013 debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
1014 }
1015 else if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1016 {
1017 /* Use the full callback method for stapling just to get
1018 observability. More efficient would be to read the file once only,
1019 if it never changed (due to SNI). Would need restart on file update,
1020 or watch datestamp. */
1021
1022# ifdef SUPPORT_SRV_OCSP_STACK
1023 rc = gnutls_certificate_set_ocsp_status_request_function2(
1024 state->x509_cred, gnutls_cert_index,
1025 server_ocsp_stapling_cb, ofile);
1026
1027 exim_gnutls_err_check(rc,
1028 US"gnutls_certificate_set_ocsp_status_request_function2");
1029# else
1030 if (cnt++ > 0)
1031 {
1032 DEBUG(D_tls)
1033 debug_printf("oops; multiple OCSP files not supported\n");
1034 break;
1035 }
1036 gnutls_certificate_set_ocsp_status_request_function(
1037 state->x509_cred, server_ocsp_stapling_cb, ofile);
1038# endif
1039
1040 DEBUG(D_tls) debug_printf("OCSP response file = %s\n", ofile);
1041 }
1042 else
1043 DEBUG(D_tls) debug_printf("ran out of OCSP response files in list\n");
1044#endif
1045 }
ba86e143
JH
1046 }
1047 else
1048 {
47195144 1049 if (0 < (rc = tls_add_certfile(state, host,
ba86e143
JH
1050 state->exp_tls_certificate, state->exp_tls_privatekey, errstr)))
1051 return rc;
1052 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
1053 }
1054
b34fc30c 1055 } /* tls_certificate */
059ec3d9 1056
2b4a568d 1057
059ec3d9
PH
1058/* Set the trusted CAs file if one is provided, and then add the CRL if one is
1059provided. Experiment shows that, if the certificate file is empty, an unhelpful
1060error message is provided. However, if we just refrain from setting anything up
1061in that case, certificate verification fails, which seems to be the correct
1062behaviour. */
1063
610ff438 1064if (state->tls_verify_certificates && *state->tls_verify_certificates)
059ec3d9 1065 {
cf0c6164 1066 if (!expand_check_tlsvar(tls_verify_certificates, errstr))
059ec3d9 1067 return DEFER;
610ff438
JH
1068#ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1069 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1070 state->exp_tls_verify_certificates = NULL;
1071#endif
17c76198 1072 if (state->tls_crl && *state->tls_crl)
cf0c6164 1073 if (!expand_check_tlsvar(tls_crl, errstr))
17c76198 1074 return DEFER;
059ec3d9 1075
1365611d
PP
1076 if (!(state->exp_tls_verify_certificates &&
1077 *state->exp_tls_verify_certificates))
b34fc30c
PP
1078 {
1079 DEBUG(D_tls)
1365611d
PP
1080 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
1081 /* With no tls_verify_certificates, we ignore tls_crl too */
17c76198 1082 return OK;
b34fc30c 1083 }
1365611d 1084 }
83e2f8a2
PP
1085else
1086 {
1087 DEBUG(D_tls)
1088 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
1089 return OK;
1090 }
17c76198 1091
cb1d7830
JH
1092#ifdef SUPPORT_SYSDEFAULT_CABUNDLE
1093if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1094 cert_count = gnutls_certificate_set_x509_system_trust(state->x509_cred);
1095else
1096#endif
1365611d 1097 {
cb1d7830
JH
1098 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
1099 {
1100 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
1101 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
1102 strerror(errno));
1103 return DEFER;
1104 }
17c76198 1105
a7fec7a7 1106#ifndef SUPPORT_CA_DIR
cb1d7830
JH
1107 /* The test suite passes in /dev/null; we could check for that path explicitly,
1108 but who knows if someone has some weird FIFO which always dumps some certs, or
1109 other weirdness. The thing we really want to check is that it's not a
1110 directory, since while OpenSSL supports that, GnuTLS does not.
60f914bc 1111 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
cb1d7830
JH
1112 if (S_ISDIR(statbuf.st_mode))
1113 {
1114 DEBUG(D_tls)
1115 debug_printf("verify certificates path is a dir: \"%s\"\n",
1116 state->exp_tls_verify_certificates);
1117 log_write(0, LOG_MAIN|LOG_PANIC,
1118 "tls_verify_certificates \"%s\" is a directory",
1119 state->exp_tls_verify_certificates);
1120 return DEFER;
1121 }
a7fec7a7 1122#endif
059ec3d9 1123
cb1d7830
JH
1124 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
1125 state->exp_tls_verify_certificates, statbuf.st_size);
059ec3d9 1126
cb1d7830
JH
1127 if (statbuf.st_size == 0)
1128 {
1129 DEBUG(D_tls)
1130 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
1131 return OK;
1132 }
059ec3d9 1133
cb1d7830 1134 cert_count =
a7fec7a7
JH
1135
1136#ifdef SUPPORT_CA_DIR
cb1d7830
JH
1137 (statbuf.st_mode & S_IFMT) == S_IFDIR
1138 ?
1139 gnutls_certificate_set_x509_trust_dir(state->x509_cred,
1140 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM)
1141 :
a7fec7a7 1142#endif
cb1d7830
JH
1143 gnutls_certificate_set_x509_trust_file(state->x509_cred,
1144 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
1145 }
a7fec7a7 1146
1365611d
PP
1147if (cert_count < 0)
1148 {
1149 rc = cert_count;
47195144 1150 exim_gnutls_err_check(rc, US"setting certificate trust");
1365611d
PP
1151 }
1152DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
059ec3d9 1153
5c8cda3a
PP
1154if (state->tls_crl && *state->tls_crl &&
1155 state->exp_tls_crl && *state->exp_tls_crl)
1365611d 1156 {
5c8cda3a
PP
1157 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
1158 cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
1159 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
1160 if (cert_count < 0)
1365611d 1161 {
5c8cda3a 1162 rc = cert_count;
47195144 1163 exim_gnutls_err_check(rc, US"gnutls_certificate_set_x509_crl_file");
1365611d 1164 }
5c8cda3a 1165 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1365611d 1166 }
059ec3d9 1167
059ec3d9
PH
1168return OK;
1169}
1170
1171
1172
1173
1174/*************************************************
1365611d
PP
1175* Set X.509 state variables *
1176*************************************************/
1177
1178/* In GnuTLS, the registered cert/key are not replaced by a later
1179set of a cert/key, so for SNI support we need a whole new x509_cred
1180structure. Which means various other non-re-expanded pieces of state
1181need to be re-set in the new struct, so the setting logic is pulled
1182out to this.
1183
1184Arguments:
1185 state exim_gnutls_state_st *
cf0c6164 1186 errstr error string pointer
1365611d
PP
1187
1188Returns: OK/DEFER/FAIL
1189*/
1190
1191static int
cf0c6164 1192tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr)
1365611d
PP
1193{
1194int rc;
1195const host_item *host = state->host; /* macro should be reconsidered? */
1196
1197/* Create D-H parameters, or read them from the cache file. This function does
1198its own SMTP error messaging. This only happens for the server, TLS D-H ignores
1199client-side params. */
1200
1201if (!state->host)
1202 {
1203 if (!dh_server_params)
1204 {
cf0c6164 1205 rc = init_server_dh(errstr);
1365611d
PP
1206 if (rc != OK) return rc;
1207 }
1208 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
1209 }
1210
1211/* Link the credentials to the session. */
1212
1213rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
47195144 1214exim_gnutls_err_check(rc, US"gnutls_credentials_set");
1365611d
PP
1215
1216return OK;
1217}
1218
1219/*************************************************
17c76198 1220* Initialize for GnuTLS *
059ec3d9
PH
1221*************************************************/
1222
9196d5bf 1223
4fb7df6d
JH
1224#ifndef DISABLE_OCSP
1225
9196d5bf
JH
1226static BOOL
1227tls_is_buggy_ocsp(void)
1228{
1229const uschar * s;
1230uschar maj, mid, mic;
1231
1232s = CUS gnutls_check_version(NULL);
1233maj = atoi(CCS s);
1234if (maj == 3)
1235 {
1236 while (*s && *s != '.') s++;
1237 mid = atoi(CCS ++s);
1238 if (mid <= 2)
1239 return TRUE;
1240 else if (mid >= 5)
1241 return FALSE;
1242 else
1243 {
1244 while (*s && *s != '.') s++;
1245 mic = atoi(CCS ++s);
1246 return mic <= (mid == 3 ? 16 : 3);
1247 }
1248 }
1249return FALSE;
1250}
1251
4fb7df6d 1252#endif
9196d5bf
JH
1253
1254
17c76198
PP
1255/* Called from both server and client code. In the case of a server, errors
1256before actual TLS negotiation return DEFER.
059ec3d9
PH
1257
1258Arguments:
17c76198
PP
1259 host connected host, if client; NULL if server
1260 certificate certificate file
1261 privatekey private key file
1262 sni TLS SNI to send, sometimes when client; else NULL
1263 cas CA certs file
1264 crl CRL file
1265 require_ciphers tls_require_ciphers setting
817d9f57 1266 caller_state returned state-info structure
cf0c6164 1267 errstr error string pointer
059ec3d9 1268
17c76198 1269Returns: OK/DEFER/FAIL
059ec3d9
PH
1270*/
1271
17c76198
PP
1272static int
1273tls_init(
1274 const host_item *host,
1275 const uschar *certificate,
1276 const uschar *privatekey,
1277 const uschar *sni,
1278 const uschar *cas,
1279 const uschar *crl,
1280 const uschar *require_ciphers,
cf0c6164 1281 exim_gnutls_state_st **caller_state,
74f1a423 1282 tls_support * tlsp,
cf0c6164 1283 uschar ** errstr)
059ec3d9 1284{
17c76198
PP
1285exim_gnutls_state_st *state;
1286int rc;
1287size_t sz;
1288const char *errpos;
1289uschar *p;
1290BOOL want_default_priorities;
1291
1292if (!exim_gnutls_base_init_done)
059ec3d9 1293 {
17c76198
PP
1294 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1295
a5f239e4
PP
1296#ifdef HAVE_GNUTLS_PKCS11
1297 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1298 which loads modules from a config file, which sounds good and may be wanted
1299 by some sysadmin, but also means in common configurations that GNOME keyring
1300 environment variables are used and so breaks for users calling mailq.
1301 To prevent this, we init PKCS11 first, which is the documented approach. */
2519e60d 1302 if (!gnutls_allow_auto_pkcs11)
a5f239e4
PP
1303 {
1304 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
47195144 1305 exim_gnutls_err_check(rc, US"gnutls_pkcs11_init");
a5f239e4
PP
1306 }
1307#endif
1308
17c76198 1309 rc = gnutls_global_init();
47195144 1310 exim_gnutls_err_check(rc, US"gnutls_global_init");
17c76198
PP
1311
1312#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1313 DEBUG(D_tls)
059ec3d9 1314 {
17c76198 1315 gnutls_global_set_log_function(exim_gnutls_logger_cb);
aded2255 1316 /* arbitrarily chosen level; bump up to 9 for more */
17c76198 1317 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
059ec3d9 1318 }
17c76198
PP
1319#endif
1320
4fb7df6d
JH
1321#ifndef DISABLE_OCSP
1322 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
9196d5bf 1323 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
4fb7df6d 1324#endif
9196d5bf 1325
17c76198 1326 exim_gnutls_base_init_done = TRUE;
059ec3d9 1327 }
059ec3d9 1328
17c76198
PP
1329if (host)
1330 {
74f1a423
JH
1331 /* For client-side sessions we allocate a context. This lets us run
1332 several in parallel. */
1333 int old_pool = store_pool;
1334 store_pool = POOL_PERM;
1335 state = store_get(sizeof(exim_gnutls_state_st));
1336 store_pool = old_pool;
1337
17c76198 1338 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
74f1a423 1339 state->tlsp = tlsp;
17c76198
PP
1340 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1341 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1342 }
1343else
1344 {
1345 state = &state_server;
1346 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
74f1a423 1347 state->tlsp = tlsp;
17c76198
PP
1348 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1349 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1350 }
47195144 1351exim_gnutls_err_check(rc, US"gnutls_init");
059ec3d9 1352
17c76198 1353state->host = host;
059ec3d9 1354
17c76198
PP
1355state->tls_certificate = certificate;
1356state->tls_privatekey = privatekey;
5779e6aa 1357state->tls_require_ciphers = require_ciphers;
17c76198
PP
1358state->tls_sni = sni;
1359state->tls_verify_certificates = cas;
1360state->tls_crl = crl;
059ec3d9 1361
17c76198
PP
1362/* This handles the variables that might get re-expanded after TLS SNI;
1363that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
059ec3d9 1364
17c76198
PP
1365DEBUG(D_tls)
1366 debug_printf("Expanding various TLS configuration options for session credentials.\n");
cf0c6164 1367if ((rc = tls_expand_session_files(state, errstr)) != OK) return rc;
059ec3d9 1368
1365611d
PP
1369/* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1370requires a new structure afterwards. */
83da1223 1371
cf0c6164 1372if ((rc = tls_set_remaining_x509(state, errstr)) != OK) return rc;
83da1223 1373
17c76198
PP
1374/* set SNI in client, only */
1375if (host)
1376 {
cf0c6164 1377 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni, errstr))
17c76198 1378 return DEFER;
0df4ab80 1379 if (state->tlsp->sni && *state->tlsp->sni)
17c76198
PP
1380 {
1381 DEBUG(D_tls)
0df4ab80
JH
1382 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1383 sz = Ustrlen(state->tlsp->sni);
17c76198 1384 rc = gnutls_server_name_set(state->session,
0df4ab80 1385 GNUTLS_NAME_DNS, state->tlsp->sni, sz);
47195144 1386 exim_gnutls_err_check(rc, US"gnutls_server_name_set");
17c76198
PP
1387 }
1388 }
1389else if (state->tls_sni)
1390 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
ba86e143 1391 "have an SNI set for a server [%s]\n", state->tls_sni);
83da1223 1392
17c76198 1393/* This is the priority string support,
42bfef1e 1394http://www.gnutls.org/manual/html_node/Priority-Strings.html
17c76198
PP
1395and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1396This was backwards incompatible, but means Exim no longer needs to track
1397all algorithms and provide string forms for them. */
83da1223 1398
17c76198 1399want_default_priorities = TRUE;
83da1223 1400
17c76198 1401if (state->tls_require_ciphers && *state->tls_require_ciphers)
83da1223 1402 {
cf0c6164 1403 if (!expand_check_tlsvar(tls_require_ciphers, errstr))
17c76198
PP
1404 return DEFER;
1405 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
83da1223 1406 {
17c76198
PP
1407 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
1408 state->exp_tls_require_ciphers);
1409
1410 rc = gnutls_priority_init(&state->priority_cache,
1411 CS state->exp_tls_require_ciphers, &errpos);
1412 want_default_priorities = FALSE;
1413 p = state->exp_tls_require_ciphers;
83da1223
PH
1414 }
1415 }
17c76198
PP
1416if (want_default_priorities)
1417 {
83e2f8a2
PP
1418 DEBUG(D_tls)
1419 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
1420 exim_default_gnutls_priority);
17c76198
PP
1421 rc = gnutls_priority_init(&state->priority_cache,
1422 exim_default_gnutls_priority, &errpos);
1423 p = US exim_default_gnutls_priority;
1424 }
83da1223 1425
47195144 1426exim_gnutls_err_check(rc, string_sprintf(
17c76198
PP
1427 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1428 p, errpos - CS p, errpos));
1429
1430rc = gnutls_priority_set(state->session, state->priority_cache);
47195144 1431exim_gnutls_err_check(rc, US"gnutls_priority_set");
17c76198
PP
1432
1433gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1434
1435/* Reduce security in favour of increased compatibility, if the admin
1436decides to make that trade-off. */
1437if (gnutls_compat_mode)
83da1223 1438 {
17c76198
PP
1439#if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1440 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1441 gnutls_session_enable_compatibility_mode(state->session);
1442#else
1443 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1444#endif
83da1223
PH
1445 }
1446
17c76198 1447*caller_state = state;
17c76198 1448return OK;
83da1223
PH
1449}
1450
1451
1452
83da1223 1453/*************************************************
17c76198 1454* Extract peer information *
059ec3d9
PH
1455*************************************************/
1456
f1be21cf
JH
1457static const uschar *
1458cipher_stdname_kcm(gnutls_kx_algorithm_t kx, gnutls_cipher_algorithm_t cipher,
1459 gnutls_mac_algorithm_t mac)
1460{
1461uschar cs_id[2];
1462gnutls_kx_algorithm_t kx_i;
1463gnutls_cipher_algorithm_t cipher_i;
1464gnutls_mac_algorithm_t mac_i;
1465
1466for (size_t i = 0;
1467 gnutls_cipher_suite_info(i, cs_id, &kx_i, &cipher_i, &mac_i, NULL);
1468 i++)
1469 if (kx_i == kx && cipher_i == cipher && mac_i == mac)
1470 return cipher_stdname(cs_id[0], cs_id[1]);
1471return NULL;
1472}
1473
1474
1475
17c76198 1476/* Called from both server and client code.
4fe99a6c
PP
1477Only this is allowed to set state->peerdn and state->have_set_peerdn
1478and we use that to detect double-calls.
059ec3d9 1479
75fe387d
PP
1480NOTE: the state blocks last while the TLS connection is up, which is fine
1481for logging in the server side, but for the client side, we log after teardown
1482in src/deliver.c. While the session is up, we can twist about states and
1483repoint tls_* globals, but those variables used for logging or other variable
1484expansion that happens _after_ delivery need to have a longer life-time.
1485
1486So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1487doing this more than once per generation of a state context. We set them in
1488the state context, and repoint tls_* to them. After the state goes away, the
1489tls_* copies of the pointers remain valid and client delivery logging is happy.
1490
1491tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1492don't apply.
1493
059ec3d9 1494Arguments:
17c76198 1495 state exim_gnutls_state_st *
cf0c6164 1496 errstr pointer to error string
059ec3d9 1497
17c76198 1498Returns: OK/DEFER/FAIL
059ec3d9
PH
1499*/
1500
17c76198 1501static int
cf0c6164 1502peer_status(exim_gnutls_state_st *state, uschar ** errstr)
059ec3d9 1503{
27f19eb4 1504const gnutls_datum_t *cert_list;
75fe387d 1505int old_pool, rc;
17c76198 1506unsigned int cert_list_size = 0;
4fe99a6c
PP
1507gnutls_protocol_t protocol;
1508gnutls_cipher_algorithm_t cipher;
1509gnutls_kx_algorithm_t kx;
1510gnutls_mac_algorithm_t mac;
17c76198
PP
1511gnutls_certificate_type_t ct;
1512gnutls_x509_crt_t crt;
d7978c0f 1513uschar *dn_buf;
17c76198 1514size_t sz;
059ec3d9 1515
4fe99a6c 1516if (state->have_set_peerdn)
17c76198 1517 return OK;
4fe99a6c 1518state->have_set_peerdn = TRUE;
059ec3d9 1519
4fe99a6c 1520state->peerdn = NULL;
059ec3d9 1521
4fe99a6c
PP
1522/* tls_cipher */
1523cipher = gnutls_cipher_get(state->session);
1524protocol = gnutls_protocol_get_version(state->session);
1525mac = gnutls_mac_get(state->session);
1526kx = gnutls_kx_get(state->session);
1527
75fe387d 1528old_pool = store_pool;
f1be21cf
JH
1529 {
1530 store_pool = POOL_PERM;
1531 state->ciphersuite = string_sprintf("%s:%s:%d",
1532 gnutls_protocol_get_name(protocol),
1533 gnutls_cipher_suite_get_name(kx, cipher, mac),
1534 (int) gnutls_cipher_get_key_size(cipher) * 8);
1535
1536 /* I don't see a way that spaces could occur, in the current GnuTLS
1537 code base, but it was a concern in the old code and perhaps older GnuTLS
1538 releases did return "TLS 1.0"; play it safe, just in case. */
1539
1540 for (uschar * p = state->ciphersuite; *p; p++) if (isspace(*p)) *p = '-';
1541 state->tlsp->cipher = state->ciphersuite;
1542
1543 state->tlsp->cipher_stdname = cipher_stdname_kcm(kx, cipher, mac);
1544 }
75fe387d 1545store_pool = old_pool;
4fe99a6c
PP
1546
1547/* tls_peerdn */
17c76198 1548cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
83da1223 1549
f1be21cf 1550if (!cert_list || cert_list_size == 0)
17c76198 1551 {
17c76198
PP
1552 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1553 cert_list, cert_list_size);
e51c7be2 1554 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198 1555 return tls_error(US"certificate verification failed",
48224640 1556 US"no certificate received from peer", state->host, errstr);
17c76198
PP
1557 return OK;
1558 }
059ec3d9 1559
17c76198
PP
1560ct = gnutls_certificate_type_get(state->session);
1561if (ct != GNUTLS_CRT_X509)
059ec3d9 1562 {
48224640 1563 const uschar *ctn = US gnutls_certificate_type_get_name(ct);
17c76198
PP
1564 DEBUG(D_tls)
1565 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
e51c7be2 1566 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198 1567 return tls_error(US"certificate verification not possible, unhandled type",
cf0c6164 1568 ctn, state->host, errstr);
17c76198 1569 return OK;
83da1223 1570 }
059ec3d9 1571
e51c7be2
JH
1572#define exim_gnutls_peer_err(Label) \
1573 do { \
1574 if (rc != GNUTLS_E_SUCCESS) \
1575 { \
1576 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1577 (Label), gnutls_strerror(rc)); \
1578 if (state->verify_requirement >= VERIFY_REQUIRED) \
48224640 1579 return tls_error((Label), US gnutls_strerror(rc), state->host, errstr); \
e51c7be2
JH
1580 return OK; \
1581 } \
1582 } while (0)
17c76198 1583
9d1c15ef
JH
1584rc = import_cert(&cert_list[0], &crt);
1585exim_gnutls_peer_err(US"cert 0");
1586
1587state->tlsp->peercert = state->peercert = crt;
17c76198 1588
17c76198
PP
1589sz = 0;
1590rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1591if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
83da1223 1592 {
17c76198
PP
1593 exim_gnutls_peer_err(US"getting size for cert DN failed");
1594 return FAIL; /* should not happen */
059ec3d9 1595 }
17c76198
PP
1596dn_buf = store_get_perm(sz);
1597rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1598exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
9d1c15ef 1599
17c76198
PP
1600state->peerdn = dn_buf;
1601
1602return OK;
1603#undef exim_gnutls_peer_err
1604}
059ec3d9 1605
059ec3d9 1606
059ec3d9 1607
059ec3d9 1608
17c76198
PP
1609/*************************************************
1610* Verify peer certificate *
1611*************************************************/
059ec3d9 1612
17c76198
PP
1613/* Called from both server and client code.
1614*Should* be using a callback registered with
1615gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1616the peer information, but that's too new for some OSes.
059ec3d9 1617
17c76198 1618Arguments:
899b8bbc
JH
1619 state exim_gnutls_state_st *
1620 errstr where to put an error message
059ec3d9 1621
17c76198
PP
1622Returns:
1623 FALSE if the session should be rejected
1624 TRUE if the cert is okay or we just don't care
1625*/
059ec3d9 1626
17c76198 1627static BOOL
28646fa9 1628verify_certificate(exim_gnutls_state_st * state, uschar ** errstr)
17c76198
PP
1629{
1630int rc;
899b8bbc
JH
1631uint verify;
1632
1633if (state->verify_requirement == VERIFY_NONE)
1634 return TRUE;
17c76198 1635
8008accd 1636DEBUG(D_tls) debug_printf("TLS: checking peer certificate\n");
cf0c6164 1637*errstr = NULL;
17c76198 1638
cf0c6164 1639if ((rc = peer_status(state, errstr)) != OK)
e6060e2c 1640 {
17c76198 1641 verify = GNUTLS_CERT_INVALID;
cf0c6164 1642 *errstr = US"certificate not supplied";
17c76198
PP
1643 }
1644else
899b8bbc
JH
1645
1646 {
1647#ifdef SUPPORT_DANE
1648 if (state->verify_requirement == VERIFY_DANE && state->host)
1649 {
1650 /* Using dane_verify_session_crt() would be easy, as it does it all for us
1651 including talking to a DNS resolver. But we want to do that bit ourselves
1652 as the testsuite intercepts and fakes its own DNS environment. */
1653
1654 dane_state_t s;
1655 dane_query_t r;
899b8bbc 1656 uint lsize;
94c13285
JH
1657 const gnutls_datum_t * certlist =
1658 gnutls_certificate_get_peers(state->session, &lsize);
1659 int usage = tls_out.tlsa_usage;
1660
1661# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1662 /* Split the TLSA records into two sets, TA and EE selectors. Run the
1663 dane-verification separately so that we know which selector verified;
570cb1bd 1664 then we know whether to do name-verification (needed for TA but not EE). */
94c13285
JH
1665
1666 if (usage == ((1<<DANESSL_USAGE_DANE_TA) | (1<<DANESSL_USAGE_DANE_EE)))
bd5b3f3c 1667 { /* a mixed-usage bundle */
94c13285
JH
1668 int i, j, nrec;
1669 const char ** dd;
1670 int * ddl;
1671
1672 for(nrec = 0; state->dane_data_len[nrec]; ) nrec++;
1673 nrec++;
1674
1675 dd = store_get(nrec * sizeof(uschar *));
1676 ddl = store_get(nrec * sizeof(int));
1677 nrec--;
1678
1679 if ((rc = dane_state_init(&s, 0)))
1680 goto tlsa_prob;
1681
1682 for (usage = DANESSL_USAGE_DANE_EE;
1683 usage >= DANESSL_USAGE_DANE_TA; usage--)
1684 { /* take records with this usage */
1685 for (j = i = 0; i < nrec; i++)
1686 if (state->dane_data[i][0] == usage)
1687 {
1688 dd[j] = state->dane_data[i];
1689 ddl[j++] = state->dane_data_len[i];
1690 }
1691 if (j)
1692 {
1693 dd[j] = NULL;
1694 ddl[j] = 0;
1695
1696 if ((rc = dane_raw_tlsa(s, &r, (char * const *)dd, ddl, 1, 0)))
1697 goto tlsa_prob;
1698
1699 if ((rc = dane_verify_crt_raw(s, certlist, lsize,
1700 gnutls_certificate_type_get(state->session),
1701 r, 0,
1702 usage == DANESSL_USAGE_DANE_EE
1703 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1704 &verify)))
1705 {
1706 DEBUG(D_tls)
1707 debug_printf("TLSA record problem: %s\n", dane_strerror(rc));
1708 }
1709 else if (verify == 0) /* verification passed */
1710 {
1711 usage = 1 << usage;
1712 break;
1713 }
1714 }
1715 }
899b8bbc 1716
94c13285
JH
1717 if (rc) goto tlsa_prob;
1718 }
1719 else
1720# endif
899b8bbc 1721 {
94c13285
JH
1722 if ( (rc = dane_state_init(&s, 0))
1723 || (rc = dane_raw_tlsa(s, &r, state->dane_data, state->dane_data_len,
1724 1, 0))
1725 || (rc = dane_verify_crt_raw(s, certlist, lsize,
1726 gnutls_certificate_type_get(state->session),
5ec37a55 1727 r, 0,
94c13285
JH
1728# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1729 usage == (1 << DANESSL_USAGE_DANE_EE)
1730 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1731# else
1732 0,
1733# endif
1734 &verify))
1735 )
1736 goto tlsa_prob;
899b8bbc 1737 }
94c13285
JH
1738
1739 if (verify != 0) /* verification failed */
899b8bbc
JH
1740 {
1741 gnutls_datum_t str;
1742 (void) dane_verification_status_print(verify, &str, 0);
1743 *errstr = US str.data; /* don't bother to free */
1744 goto badcert;
1745 }
28646fa9 1746
94c13285
JH
1747# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1748 /* If a TA-mode TLSA record was used for verification we must additionally
570cb1bd 1749 verify the cert name (but not the CA chain). For EE-mode, skip it. */
28646fa9 1750
94c13285
JH
1751 if (usage & (1 << DANESSL_USAGE_DANE_EE))
1752# endif
28646fa9 1753 {
570cb1bd 1754 state->peer_dane_verified = state->peer_cert_verified = TRUE;
28646fa9
JH
1755 goto goodcert;
1756 }
570cb1bd
JH
1757# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1758 /* Assume that the name on the A-record is the one that should be matching
1759 the cert. An alternate view is that the domain part of the email address
1760 is also permissible. */
1761
1762 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert,
1763 CS state->host->name))
1764 {
1765 state->peer_dane_verified = state->peer_cert_verified = TRUE;
1766 goto goodcert;
1767 }
1768# endif
899b8bbc 1769 }
570cb1bd 1770#endif /*SUPPORT_DANE*/
899b8bbc 1771
17c76198 1772 rc = gnutls_certificate_verify_peers2(state->session, &verify);
899b8bbc 1773 }
e6060e2c 1774
899b8bbc 1775/* Handle the result of verification. INVALID is set if any others are. */
059ec3d9 1776
28646fa9 1777if (rc < 0 || verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED))
17c76198
PP
1778 {
1779 state->peer_cert_verified = FALSE;
cf0c6164 1780 if (!*errstr)
184384c3
JH
1781 {
1782#ifdef GNUTLS_CERT_VFY_STATUS_PRINT
1783 DEBUG(D_tls)
1784 {
1785 gnutls_datum_t txt;
1786
1787 if (gnutls_certificate_verification_status_print(verify,
1788 gnutls_certificate_type_get(state->session), &txt, 0)
1789 == GNUTLS_E_SUCCESS)
1790 {
1791 debug_printf("%s\n", txt.data);
1792 gnutls_free(txt.data);
1793 }
1794 }
1795#endif
cf0c6164
JH
1796 *errstr = verify & GNUTLS_CERT_REVOKED
1797 ? US"certificate revoked" : US"certificate invalid";
184384c3 1798 }
059ec3d9 1799
17c76198 1800 DEBUG(D_tls)
e51c7be2 1801 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
cf0c6164 1802 *errstr, state->peerdn ? state->peerdn : US"<unset>");
059ec3d9 1803
e51c7be2 1804 if (state->verify_requirement >= VERIFY_REQUIRED)
899b8bbc 1805 goto badcert;
17c76198 1806 DEBUG(D_tls)
4789da3a 1807 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
17c76198 1808 }
e51c7be2 1809
17c76198
PP
1810else
1811 {
5fd28bb8
JH
1812 /* Client side, check the server's certificate name versus the name on the
1813 A-record for the connection we made. What to do for server side - what name
1814 to use for client? We document that there is no such checking for server
1815 side. */
1816
1817 if ( state->exp_tls_verify_cert_hostnames
1818 && !gnutls_x509_crt_check_hostname(state->tlsp->peercert,
1819 CS state->exp_tls_verify_cert_hostnames)
1820 )
e51c7be2 1821 {
5fd28bb8
JH
1822 DEBUG(D_tls)
1823 debug_printf("TLS certificate verification failed: cert name mismatch\n");
1824 if (state->verify_requirement >= VERIFY_REQUIRED)
1825 goto badcert;
1826 return TRUE;
e51c7be2 1827 }
5fd28bb8 1828
17c76198 1829 state->peer_cert_verified = TRUE;
e51c7be2 1830 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
4fe99a6c 1831 state->peerdn ? state->peerdn : US"<unset>");
17c76198 1832 }
059ec3d9 1833
28646fa9
JH
1834goodcert:
1835 state->tlsp->peerdn = state->peerdn;
1836 return TRUE;
899b8bbc 1837
b83314e3 1838#ifdef SUPPORT_DANE
94c13285 1839tlsa_prob:
624f33df
JH
1840 *errstr = string_sprintf("TLSA record problem: %s",
1841 rc == DANE_E_REQUESTED_DATA_NOT_AVAILABLE ? "none usable" : dane_strerror(rc));
b83314e3
JH
1842#endif
1843
899b8bbc
JH
1844badcert:
1845 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1846 return FALSE;
17c76198 1847}
059ec3d9 1848
17c76198
PP
1849
1850
1851
1852/* ------------------------------------------------------------------------ */
1853/* Callbacks */
1854
1855/* Logging function which can be registered with
1856 * gnutls_global_set_log_function()
1857 * gnutls_global_set_log_level() 0..9
1858 */
af3498d6 1859#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
059ec3d9 1860static void
17c76198 1861exim_gnutls_logger_cb(int level, const char *message)
059ec3d9 1862{
8c79eebf
PP
1863 size_t len = strlen(message);
1864 if (len < 1)
1865 {
1866 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1867 return;
1868 }
1869 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1870 message[len-1] == '\n' ? "" : "\n");
17c76198 1871}
af3498d6 1872#endif
059ec3d9 1873
059ec3d9 1874
17c76198
PP
1875/* Called after client hello, should handle SNI work.
1876This will always set tls_sni (state->received_sni) if available,
1877and may trigger presenting different certificates,
1878if state->trigger_sni_changes is TRUE.
059ec3d9 1879
17c76198
PP
1880Should be registered with
1881 gnutls_handshake_set_post_client_hello_function()
059ec3d9 1882
17c76198
PP
1883"This callback must return 0 on success or a gnutls error code to terminate the
1884handshake.".
059ec3d9 1885
17c76198
PP
1886For inability to get SNI information, we return 0.
1887We only return non-zero if re-setup failed.
817d9f57 1888Only used for server-side TLS.
17c76198 1889*/
44bbabb5 1890
17c76198
PP
1891static int
1892exim_sni_handling_cb(gnutls_session_t session)
1893{
1894char sni_name[MAX_HOST_LEN];
1895size_t data_len = MAX_HOST_LEN;
817d9f57 1896exim_gnutls_state_st *state = &state_server;
17c76198
PP
1897unsigned int sni_type;
1898int rc, old_pool;
cf0c6164 1899uschar * dummy_errstr;
17c76198
PP
1900
1901rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
b34fc30c
PP
1902if (rc != GNUTLS_E_SUCCESS)
1903 {
1904 DEBUG(D_tls) {
1905 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1906 debug_printf("TLS: no SNI presented in handshake.\n");
1907 else
1908 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1909 gnutls_strerror(rc), rc);
cf0c6164 1910 }
b34fc30c
PP
1911 return 0;
1912 }
1913
17c76198
PP
1914if (sni_type != GNUTLS_NAME_DNS)
1915 {
1916 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1917 return 0;
1918 }
44bbabb5 1919
17c76198
PP
1920/* We now have a UTF-8 string in sni_name */
1921old_pool = store_pool;
1922store_pool = POOL_PERM;
1923state->received_sni = string_copyn(US sni_name, data_len);
1924store_pool = old_pool;
1925
1926/* We set this one now so that variable expansions below will work */
817d9f57 1927state->tlsp->sni = state->received_sni;
17c76198
PP
1928
1929DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1930 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1931
1932if (!state->trigger_sni_changes)
1933 return 0;
1934
cf0c6164 1935if ((rc = tls_expand_session_files(state, &dummy_errstr)) != OK)
17c76198
PP
1936 {
1937 /* If the setup of certs/etc failed before handshake, TLS would not have
1938 been offered. The best we can do now is abort. */
1939 return GNUTLS_E_APPLICATION_ERROR_MIN;
1940 }
1941
cf0c6164 1942rc = tls_set_remaining_x509(state, &dummy_errstr);
1365611d
PP
1943if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1944
1945return 0;
059ec3d9
PH
1946}
1947
1948
1949
f2de3a33 1950#ifndef DISABLE_OCSP
44662487
JH
1951
1952static int
1953server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
1954 gnutls_datum_t * ocsp_response)
1955{
1956int ret;
47195144 1957DEBUG(D_tls) debug_printf("OCSP stapling callback: %s\n", US ptr);
44662487 1958
44662487
JH
1959if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
1960 {
1961 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
5903c6ff 1962 CS ptr);
018058b2 1963 tls_in.ocsp = OCSP_NOT_RESP;
44662487
JH
1964 return GNUTLS_E_NO_CERTIFICATE_STATUS;
1965 }
1966
018058b2 1967tls_in.ocsp = OCSP_VFY_NOT_TRIED;
44662487
JH
1968return 0;
1969}
1970
1971#endif
1972
1973
0cbf2b82 1974#ifndef DISABLE_EVENT
a7538db1
JH
1975/*
1976We use this callback to get observability and detail-level control
723fe533
JH
1977for an exim TLS connection (either direction), raising a tls:cert event
1978for each cert in the chain presented by the peer. Any event
a7538db1
JH
1979can deny verification.
1980
1981Return 0 for the handshake to continue or non-zero to terminate.
1982*/
1983
1984static int
723fe533 1985verify_cb(gnutls_session_t session)
a7538db1 1986{
27f19eb4 1987const gnutls_datum_t * cert_list;
a7538db1
JH
1988unsigned int cert_list_size = 0;
1989gnutls_x509_crt_t crt;
1990int rc;
b30275b8 1991uschar * yield;
a7538db1
JH
1992exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
1993
bd5b3f3c 1994if ((cert_list = gnutls_certificate_get_peers(session, &cert_list_size)))
a7538db1
JH
1995 while (cert_list_size--)
1996 {
bd5b3f3c 1997 if ((rc = import_cert(&cert_list[cert_list_size], &crt)) != GNUTLS_E_SUCCESS)
a7538db1
JH
1998 {
1999 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
2000 cert_list_size, gnutls_strerror(rc));
2001 break;
2002 }
2003
2004 state->tlsp->peercert = crt;
b30275b8
JH
2005 if ((yield = event_raise(state->event_action,
2006 US"tls:cert", string_sprintf("%d", cert_list_size))))
a7538db1
JH
2007 {
2008 log_write(0, LOG_MAIN,
b30275b8
JH
2009 "SSL verify denied by event-action: depth=%d: %s",
2010 cert_list_size, yield);
a7538db1
JH
2011 return 1; /* reject */
2012 }
2013 state->tlsp->peercert = NULL;
2014 }
2015
2016return 0;
2017}
2018
2019#endif
44662487
JH
2020
2021
f20cfa4a
JH
2022static gstring *
2023ddump(gnutls_datum_t * d)
2024{
2025gstring * g = string_get((d->size+1) * 2);
2026uschar * s = d->data;
2027for (unsigned i = d->size; i > 0; i--, s++)
2028 {
2029 g = string_catn(g, US "0123456789abcdef" + (*s >> 4), 1);
2030 g = string_catn(g, US "0123456789abcdef" + (*s & 0xf), 1);
2031 }
2032return g;
2033}
17c76198
PP
2034
2035/* ------------------------------------------------------------------------ */
2036/* Exported functions */
2037
2038
2039
2040
059ec3d9
PH
2041/*************************************************
2042* Start a TLS session in a server *
2043*************************************************/
2044
2045/* This is called when Exim is running as a server, after having received
2046the STARTTLS command. It must respond to that command, and then negotiate
2047a TLS session.
2048
2049Arguments:
83da1223 2050 require_ciphers list of allowed ciphers or NULL
cf0c6164 2051 errstr pointer to error string
059ec3d9
PH
2052
2053Returns: OK on success
2054 DEFER for errors before the start of the negotiation
4c04137d 2055 FAIL for errors during the negotiation; the server can't
059ec3d9
PH
2056 continue running.
2057*/
2058
2059int
cf0c6164 2060tls_server_start(const uschar * require_ciphers, uschar ** errstr)
059ec3d9
PH
2061{
2062int rc;
cf0c6164 2063exim_gnutls_state_st * state = NULL;
059ec3d9
PH
2064
2065/* Check for previous activation */
74f1a423 2066if (tls_in.active.sock >= 0)
059ec3d9 2067 {
48224640 2068 tls_error(US"STARTTLS received after TLS started", US "", NULL, errstr);
925ac8e4 2069 smtp_printf("554 Already in TLS\r\n", FALSE);
059ec3d9
PH
2070 return FAIL;
2071 }
2072
2073/* Initialize the library. If it fails, it will already have logged the error
2074and sent an SMTP response. */
2075
17c76198 2076DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
059ec3d9 2077
cf0c6164 2078if ((rc = tls_init(NULL, tls_certificate, tls_privatekey,
17c76198 2079 NULL, tls_verify_certificates, tls_crl,
74f1a423 2080 require_ciphers, &state, &tls_in, errstr)) != OK) return rc;
059ec3d9 2081
059ec3d9
PH
2082/* If this is a host for which certificate verification is mandatory or
2083optional, set up appropriately. */
2084
059ec3d9 2085if (verify_check_host(&tls_verify_hosts) == OK)
17c76198 2086 {
e51c7be2
JH
2087 DEBUG(D_tls)
2088 debug_printf("TLS: a client certificate will be required.\n");
17c76198
PP
2089 state->verify_requirement = VERIFY_REQUIRED;
2090 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2091 }
059ec3d9 2092else if (verify_check_host(&tls_try_verify_hosts) == OK)
17c76198 2093 {
e51c7be2
JH
2094 DEBUG(D_tls)
2095 debug_printf("TLS: a client certificate will be requested but not required.\n");
17c76198
PP
2096 state->verify_requirement = VERIFY_OPTIONAL;
2097 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2098 }
2099else
2100 {
e51c7be2
JH
2101 DEBUG(D_tls)
2102 debug_printf("TLS: a client certificate will not be requested.\n");
17c76198
PP
2103 state->verify_requirement = VERIFY_NONE;
2104 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2105 }
059ec3d9 2106
0cbf2b82 2107#ifndef DISABLE_EVENT
723fe533
JH
2108if (event_action)
2109 {
2110 state->event_action = event_action;
2111 gnutls_session_set_ptr(state->session, state);
2112 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2113 }
2114#endif
2115
17c76198
PP
2116/* Register SNI handling; always, even if not in tls_certificate, so that the
2117expansion variable $tls_sni is always available. */
059ec3d9 2118
17c76198
PP
2119gnutls_handshake_set_post_client_hello_function(state->session,
2120 exim_sni_handling_cb);
059ec3d9
PH
2121
2122/* Set context and tell client to go ahead, except in the case of TLS startup
2123on connection, where outputting anything now upsets the clients and tends to
2124make them disconnect. We need to have an explicit fflush() here, to force out
2125the response. Other smtp_printf() calls do not need it, because in non-TLS
2126mode, the fflush() happens when smtp_getc() is called. */
2127
817d9f57 2128if (!state->tlsp->on_connect)
059ec3d9 2129 {
925ac8e4 2130 smtp_printf("220 TLS go ahead\r\n", FALSE);
9d1c15ef 2131 fflush(smtp_out);
059ec3d9
PH
2132 }
2133
2134/* Now negotiate the TLS session. We put our own timer on it, since it seems
8008accd
JH
2135that the GnuTLS library doesn't.
2136From 3.1.0 there is gnutls_handshake_set_timeout() - but it requires you
2137to set (and clear down afterwards) up a pull-timeout callback function that does
2138a select, so we're no better off unless avoiding signals becomes an issue. */
059ec3d9 2139
17c76198 2140gnutls_transport_set_ptr2(state->session,
27f19eb4
JH
2141 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
2142 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
17c76198
PP
2143state->fd_in = fileno(smtp_in);
2144state->fd_out = fileno(smtp_out);
059ec3d9
PH
2145
2146sigalrm_seen = FALSE;
c2a1bba0 2147if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
17c76198 2148do
17c76198 2149 rc = gnutls_handshake(state->session);
157a7880 2150while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
c2a1bba0 2151ALARM_CLR(0);
059ec3d9 2152
17c76198 2153if (rc != GNUTLS_E_SUCCESS)
059ec3d9 2154 {
059ec3d9
PH
2155 /* It seems that, except in the case of a timeout, we have to close the
2156 connection right here; otherwise if the other end is running OpenSSL it hangs
2157 until the server times out. */
2158
60d10ce7 2159 if (sigalrm_seen)
ad7fc6eb 2160 {
48224640 2161 tls_error(US"gnutls_handshake", US"timed out", NULL, errstr);
ad7fc6eb
JH
2162 gnutls_db_remove_session(state->session);
2163 }
60d10ce7 2164 else
059ec3d9 2165 {
48224640 2166 tls_error(US"gnutls_handshake", US gnutls_strerror(rc), NULL, errstr);
f5d25c2b 2167 (void) gnutls_alert_send_appropriate(state->session, rc);
ad7fc6eb 2168 gnutls_deinit(state->session);
ed62aae3 2169 gnutls_certificate_free_credentials(state->x509_cred);
60d10ce7 2170 millisleep(500);
ad7fc6eb 2171 shutdown(state->fd_out, SHUT_WR);
d7978c0f 2172 for (int i = 1024; fgetc(smtp_in) != EOF && i > 0; ) i--; /* drain skt */
f1e894f3
PH
2173 (void)fclose(smtp_out);
2174 (void)fclose(smtp_in);
60d10ce7 2175 smtp_out = smtp_in = NULL;
059ec3d9
PH
2176 }
2177
2178 return FAIL;
2179 }
2180
f20cfa4a
JH
2181DEBUG(D_tls)
2182 {
2183 debug_printf("gnutls_handshake was successful\n");
2184#ifdef SUPPORT_GNUTLS_SESS_DESC
2185 debug_printf("%s\n", gnutls_session_get_desc(state->session));
2186#endif
2187#ifdef SUPPORT_GNUTLS_KEYLOG
2188 {
2189 gnutls_datum_t c, s;
2190 gstring * gc, * gs;
2191 gnutls_session_get_random(state->session, &c, &s);
2192 gnutls_session_get_master_secret(state->session, &s);
2193 gc = ddump(&c);
2194 gs = ddump(&s);
2195 debug_printf("CLIENT_RANDOM %.*s %.*s\n", (int)gc->ptr, gc->s, (int)gs->ptr, gs->s);
2196 }
2197#endif
2198 }
059ec3d9 2199
17c76198
PP
2200/* Verify after the fact */
2201
899b8bbc 2202if (!verify_certificate(state, errstr))
059ec3d9 2203 {
9d1c15ef 2204 if (state->verify_requirement != VERIFY_OPTIONAL)
17c76198 2205 {
cf0c6164 2206 (void) tls_error(US"certificate verification failed", *errstr, NULL, errstr);
9d1c15ef 2207 return FAIL;
17c76198 2208 }
9d1c15ef
JH
2209 DEBUG(D_tls)
2210 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
cf0c6164 2211 *errstr);
059ec3d9
PH
2212 }
2213
17c76198
PP
2214/* Figure out peer DN, and if authenticated, etc. */
2215
cf0c6164 2216if ((rc = peer_status(state, NULL)) != OK) return rc;
17c76198
PP
2217
2218/* Sets various Exim expansion variables; always safe within server */
2219
9d1c15ef 2220extract_exim_vars_from_tls_state(state);
059ec3d9
PH
2221
2222/* TLS has been set up. Adjust the input functions to read via TLS,
2223and initialize appropriately. */
2224
17c76198 2225state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
059ec3d9
PH
2226
2227receive_getc = tls_getc;
0d81dabc 2228receive_getbuf = tls_getbuf;
584e96c6 2229receive_get_cache = tls_get_cache;
059ec3d9
PH
2230receive_ungetc = tls_ungetc;
2231receive_feof = tls_feof;
2232receive_ferror = tls_ferror;
58eb016e 2233receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 2234
059ec3d9
PH
2235return OK;
2236}
2237
2238
2239
2240
aa2a70ba
JH
2241static void
2242tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
2243 smtp_transport_options_block * ob)
2244{
3fb3231c 2245if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
aa2a70ba 2246 {
4af0d74a 2247 state->exp_tls_verify_cert_hostnames =
8c5d388a 2248#ifdef SUPPORT_I18N
4af0d74a
JH
2249 string_domain_utf8_to_alabel(host->name, NULL);
2250#else
2251 host->name;
2252#endif
aa2a70ba
JH
2253 DEBUG(D_tls)
2254 debug_printf("TLS: server cert verification includes hostname: \"%s\".\n",
2255 state->exp_tls_verify_cert_hostnames);
2256 }
2257}
aa2a70ba
JH
2258
2259
899b8bbc
JH
2260
2261
2262#ifdef SUPPORT_DANE
2263/* Given our list of RRs from the TLSA lookup, build a lookup block in
2264GnuTLS-DANE's preferred format. Hang it on the state str for later
2265use in DANE verification.
2266
2267We point at the dnsa data not copy it, so it must remain valid until
2268after verification is done.*/
2269
3674140c 2270static BOOL
899b8bbc
JH
2271dane_tlsa_load(exim_gnutls_state_st * state, dns_answer * dnsa)
2272{
899b8bbc
JH
2273dns_scan dnss;
2274int i;
2275const char ** dane_data;
2276int * dane_data_len;
2277
d7978c0f
JH
2278i = 1;
2279for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
899b8bbc
JH
2280 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2281 ) if (rr->type == T_TLSA) i++;
2282
2283dane_data = store_get(i * sizeof(uschar *));
2284dane_data_len = store_get(i * sizeof(int));
2285
d7978c0f
JH
2286i = 0;
2287for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
899b8bbc 2288 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
1b76ad22 2289 ) if (rr->type == T_TLSA && rr->size > 3)
899b8bbc
JH
2290 {
2291 const uschar * p = rr->data;
3674140c
JH
2292 uint8_t usage = p[0], sel = p[1], type = p[2];
2293
2294 DEBUG(D_tls)
2295 debug_printf("TLSA: %d %d %d size %d\n", usage, sel, type, rr->size);
2296
94c13285
JH
2297 if ( (usage != DANESSL_USAGE_DANE_TA && usage != DANESSL_USAGE_DANE_EE)
2298 || (sel != 0 && sel != 1)
2299 )
2300 continue;
3674140c
JH
2301 switch(type)
2302 {
2303 case 0: /* Full: cannot check at present */
2304 break;
2305 case 1: if (rr->size != 3 + 256/8) continue; /* sha2-256 */
2306 break;
2307 case 2: if (rr->size != 3 + 512/8) continue; /* sha2-512 */
2308 break;
2309 default: continue;
2310 }
899b8bbc
JH
2311
2312 tls_out.tlsa_usage |= 1<<usage;
48224640 2313 dane_data[i] = CS p;
899b8bbc
JH
2314 dane_data_len[i++] = rr->size;
2315 }
3674140c
JH
2316
2317if (!i) return FALSE;
2318
899b8bbc
JH
2319dane_data[i] = NULL;
2320dane_data_len[i] = 0;
2321
2322state->dane_data = (char * const *)dane_data;
2323state->dane_data_len = dane_data_len;
3674140c 2324return TRUE;
899b8bbc
JH
2325}
2326#endif
2327
2328
2329
059ec3d9
PH
2330/*************************************************
2331* Start a TLS session in a client *
2332*************************************************/
2333
2334/* Called from the smtp transport after STARTTLS has been accepted.
2335
2336Arguments:
2337 fd the fd of the connection
afdb5e9c 2338 host connected host (for messages and option-tests)
83da1223 2339 addr the first address (not used)
a7538db1 2340 tb transport (always smtp)
899b8bbc
JH
2341 tlsa_dnsa non-NULL, either request or require dane for this host, and
2342 a TLSA record found. Therefore, dane verify required.
2343 Which implies cert must be requested and supplied, dane
2344 verify must pass, and cert verify irrelevant (incl.
2345 hostnames), and (caller handled) require_tls
74f1a423 2346 tlsp record details of channel configuration
cf0c6164
JH
2347 errstr error string pointer
2348
74f1a423 2349Returns: Pointer to TLS session context, or NULL on error
059ec3d9
PH
2350*/
2351
74f1a423 2352void *
17c76198 2353tls_client_start(int fd, host_item *host,
f5d78688 2354 address_item *addr ARG_UNUSED,
cf0c6164 2355 transport_instance * tb,
c0635b6d 2356#ifdef SUPPORT_DANE
899b8bbc 2357 dns_answer * tlsa_dnsa,
0e66b3b6 2358#endif
74f1a423 2359 tls_support * tlsp, uschar ** errstr)
059ec3d9 2360{
afdb5e9c
JH
2361smtp_transport_options_block *ob = tb
2362 ? (smtp_transport_options_block *)tb->options_block
2363 : &smtp_transport_option_defaults;
059ec3d9 2364int rc;
899b8bbc 2365exim_gnutls_state_st * state = NULL;
5ec37a55 2366uschar *cipher_list = NULL;
74f1a423 2367
f2de3a33 2368#ifndef DISABLE_OCSP
5130845b 2369BOOL require_ocsp =
3fb3231c 2370 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
44662487 2371BOOL request_ocsp = require_ocsp ? TRUE
3fb3231c 2372 : verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
2b4a568d 2373#endif
059ec3d9 2374
17c76198 2375DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
059ec3d9 2376
5ec37a55 2377#ifdef SUPPORT_DANE
cf260049 2378if (tlsa_dnsa && ob->dane_require_tls_ciphers)
5ec37a55
PP
2379 {
2380 /* not using expand_check_tlsvar because not yet in state */
2381 if (!expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
2382 &cipher_list, errstr))
74f1a423 2383 return NULL;
cf260049
JH
2384 cipher_list = cipher_list && *cipher_list
2385 ? ob->dane_require_tls_ciphers : ob->tls_require_ciphers;
5ec37a55
PP
2386 }
2387#endif
2388
2389if (!cipher_list)
2390 cipher_list = ob->tls_require_ciphers;
2391
74f1a423 2392if (tls_init(host, ob->tls_certificate, ob->tls_privatekey,
65867078 2393 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
74f1a423
JH
2394 cipher_list, &state, tlsp, errstr) != OK)
2395 return NULL;
059ec3d9 2396
54c90be1 2397 {
65867078
JH
2398 int dh_min_bits = ob->tls_dh_min_bits;
2399 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
2400 {
2401 DEBUG(D_tls)
2402 debug_printf("WARNING: tls_dh_min_bits far too low,"
2403 " clamping %d up to %d\n",
2404 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
2405 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
2406 }
54c90be1 2407
65867078
JH
2408 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
2409 " acceptable bits to %d\n",
2410 dh_min_bits);
2411 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
2412 }
83da1223 2413
94431adb 2414/* Stick to the old behaviour for compatibility if tls_verify_certificates is
2b4a568d
JH
2415set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
2416the specified host patterns if one of them is defined */
2417
899b8bbc 2418#ifdef SUPPORT_DANE
3674140c 2419if (tlsa_dnsa && dane_tlsa_load(state, tlsa_dnsa))
899b8bbc
JH
2420 {
2421 DEBUG(D_tls)
2422 debug_printf("TLS: server certificate DANE required.\n");
2423 state->verify_requirement = VERIFY_DANE;
2424 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
899b8bbc
JH
2425 }
2426else
2427#endif
2428 if ( ( state->exp_tls_verify_certificates
2429 && !ob->tls_verify_hosts
2430 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2431 )
3fb3231c 2432 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
899b8bbc 2433 )
17c76198 2434 {
aa2a70ba 2435 tls_client_setup_hostname_checks(host, state, ob);
aa2a70ba
JH
2436 DEBUG(D_tls)
2437 debug_printf("TLS: server certificate verification required.\n");
2438 state->verify_requirement = VERIFY_REQUIRED;
52f93eed
WB
2439 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2440 }
3fb3231c 2441else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
52f93eed 2442 {
aa2a70ba 2443 tls_client_setup_hostname_checks(host, state, ob);
e51c7be2
JH
2444 DEBUG(D_tls)
2445 debug_printf("TLS: server certificate verification optional.\n");
52f93eed 2446 state->verify_requirement = VERIFY_OPTIONAL;
17c76198
PP
2447 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2448 }
2449else
2450 {
e51c7be2
JH
2451 DEBUG(D_tls)
2452 debug_printf("TLS: server certificate verification not required.\n");
52f93eed
WB
2453 state->verify_requirement = VERIFY_NONE;
2454 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
17c76198 2455 }
059ec3d9 2456
f2de3a33
JH
2457#ifndef DISABLE_OCSP
2458 /* supported since GnuTLS 3.1.3 */
44662487 2459if (request_ocsp)
9d1c15ef
JH
2460 {
2461 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
65867078
JH
2462 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
2463 NULL, 0, NULL)) != OK)
74f1a423 2464 {
48224640 2465 tls_error(US"cert-status-req", US gnutls_strerror(rc), state->host, errstr);
74f1a423
JH
2466 return NULL;
2467 }
2468 tlsp->ocsp = OCSP_NOT_RESP;
9d1c15ef 2469 }
2b4a568d
JH
2470#endif
2471
0cbf2b82 2472#ifndef DISABLE_EVENT
afdb5e9c 2473if (tb && tb->event_action)
a7538db1 2474 {
774ef2d7 2475 state->event_action = tb->event_action;
a7538db1 2476 gnutls_session_set_ptr(state->session, state);
723fe533 2477 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
a7538db1
JH
2478 }
2479#endif
2480
27f19eb4 2481gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) fd);
17c76198
PP
2482state->fd_in = fd;
2483state->fd_out = fd;
059ec3d9 2484
9d1c15ef 2485DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
059ec3d9
PH
2486/* There doesn't seem to be a built-in timeout on connection. */
2487
2488sigalrm_seen = FALSE;
c2a1bba0 2489ALARM(ob->command_timeout);
17c76198 2490do
17c76198 2491 rc = gnutls_handshake(state->session);
f1fed05b 2492while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
c2a1bba0 2493ALARM_CLR(0);
059ec3d9 2494
4fe99a6c 2495if (rc != GNUTLS_E_SUCCESS)
74f1a423 2496 {
60d10ce7
JH
2497 if (sigalrm_seen)
2498 {
2499 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
48224640 2500 tls_error(US"gnutls_handshake", US"timed out", state->host, errstr);
60d10ce7
JH
2501 }
2502 else
48224640 2503 tls_error(US"gnutls_handshake", US gnutls_strerror(rc), state->host, errstr);
74f1a423
JH
2504 return NULL;
2505 }
4fe99a6c 2506
f20cfa4a
JH
2507DEBUG(D_tls)
2508 {
2509 debug_printf("gnutls_handshake was successful\n");
2510#ifdef SUPPORT_GNUTLS_SESS_DESC
2511 debug_printf("%s\n", gnutls_session_get_desc(state->session));
2512#endif
2513#ifdef SUPPORT_GNUTLS_KEYLOG
2514 {
2515 gnutls_datum_t c, s;
2516 gstring * gc, * gs;
2517 gnutls_session_get_random(state->session, &c, &s);
2518 gnutls_session_get_master_secret(state->session, &s);
2519 gc = ddump(&c);
2520 gs = ddump(&s);
2521 debug_printf("CLIENT_RANDOM %.*s %.*s\n", (int)gc->ptr, gc->s, (int)gs->ptr, gs->s);
2522 }
2523#endif
2524 }
059ec3d9 2525
17c76198 2526/* Verify late */
059ec3d9 2527
899b8bbc 2528if (!verify_certificate(state, errstr))
74f1a423
JH
2529 {
2530 tls_error(US"certificate verification failed", *errstr, state->host, errstr);
2531 return NULL;
2532 }
059ec3d9 2533
f2de3a33 2534#ifndef DISABLE_OCSP
2b4a568d
JH
2535if (require_ocsp)
2536 {
2537 DEBUG(D_tls)
2538 {
2539 gnutls_datum_t stapling;
2540 gnutls_ocsp_resp_t resp;
2541 gnutls_datum_t printed;
2542 if ( (rc= gnutls_ocsp_status_request_get(state->session, &stapling)) == 0
2543 && (rc= gnutls_ocsp_resp_init(&resp)) == 0
2544 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
2545 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_FULL, &printed)) == 0
2546 )
2547 {
65867078 2548 debug_printf("%.4096s", printed.data);
2b4a568d
JH
2549 gnutls_free(printed.data);
2550 }
2551 else
48224640 2552 (void) tls_error(US"ocsp decode", US gnutls_strerror(rc), state->host, errstr);
2b4a568d
JH
2553 }
2554
2b4a568d 2555 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
018058b2 2556 {
74f1a423
JH
2557 tlsp->ocsp = OCSP_FAILED;
2558 tls_error(US"certificate status check failed", NULL, state->host, errstr);
2559 return NULL;
018058b2 2560 }
2b4a568d 2561 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
74f1a423 2562 tlsp->ocsp = OCSP_VFIED;
2b4a568d
JH
2563 }
2564#endif
2565
17c76198 2566/* Figure out peer DN, and if authenticated, etc. */
059ec3d9 2567
74f1a423
JH
2568if (peer_status(state, errstr) != OK)
2569 return NULL;
059ec3d9 2570
4fe99a6c 2571/* Sets various Exim expansion variables; may need to adjust for ACL callouts */
059ec3d9 2572
9d1c15ef 2573extract_exim_vars_from_tls_state(state);
059ec3d9 2574
74f1a423 2575return state;
059ec3d9
PH
2576}
2577
2578
2579
17c76198 2580
059ec3d9 2581/*************************************************
17c76198 2582* Close down a TLS session *
059ec3d9
PH
2583*************************************************/
2584
17c76198
PP
2585/* This is also called from within a delivery subprocess forked from the
2586daemon, to shut down the TLS library, without actually doing a shutdown (which
2587would tamper with the TLS session in the parent process).
059ec3d9 2588
dec766a1 2589Arguments:
74f1a423 2590 ct_ctx client context pointer, or NULL for the one global server context
dec766a1 2591 shutdown 1 if TLS close-alert is to be sent,
afdb5e9c 2592 2 if also response to be waited for
dec766a1 2593
17c76198 2594Returns: nothing
059ec3d9
PH
2595*/
2596
17c76198 2597void
74f1a423 2598tls_close(void * ct_ctx, int shutdown)
059ec3d9 2599{
74f1a423 2600exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
059ec3d9 2601
74f1a423 2602if (!state->tlsp || state->tlsp->active.sock < 0) return; /* TLS was not active */
17c76198
PP
2603
2604if (shutdown)
2605 {
dec766a1
WB
2606 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
2607 shutdown > 1 ? " (with response-wait)" : "");
2608
c2a1bba0 2609 ALARM(2);
dec766a1 2610 gnutls_bye(state->session, shutdown > 1 ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR);
c2a1bba0 2611 ALARM_CLR(0);
17c76198
PP
2612 }
2613
2614gnutls_deinit(state->session);
ed62aae3
HSHR
2615gnutls_certificate_free_credentials(state->x509_cred);
2616
17c76198 2617
74f1a423
JH
2618state->tlsp->active.sock = -1;
2619state->tlsp->active.tls_ctx = NULL;
b808677c 2620if (state->xfer_buffer) store_free(state->xfer_buffer);
17c76198 2621memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
059ec3d9
PH
2622}
2623
2624
2625
17c76198 2626
0d81dabc
JH
2627static BOOL
2628tls_refill(unsigned lim)
2629{
2630exim_gnutls_state_st * state = &state_server;
2631ssize_t inbytes;
2632
2633DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
2634 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
2635
f1fed05b 2636sigalrm_seen = FALSE;
c2a1bba0 2637if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
4896a319
AM
2638
2639do
2640 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
2641 MIN(ssl_xfer_buffer_size, lim));
2642while (inbytes == GNUTLS_E_AGAIN);
2643
c2a1bba0 2644if (smtp_receive_timeout > 0) ALARM_CLR(0);
9723f966
JH
2645
2646if (had_command_timeout) /* set by signal handler */
2647 smtp_command_timeout_exit(); /* does not return */
2648if (had_command_sigterm)
2649 smtp_command_sigterm_exit();
2650if (had_data_timeout)
2651 smtp_data_timeout_exit();
2652if (had_data_sigint)
2653 smtp_data_sigint_exit();
2654
2655/* Timeouts do not get this far. A zero-byte return appears to mean that the
2656TLS session has been closed down, not that the socket itself has been closed
2657down. Revert to non-TLS handling. */
0d81dabc
JH
2658
2659if (sigalrm_seen)
2660 {
2661 DEBUG(D_tls) debug_printf("Got tls read timeout\n");
8b77d27a 2662 state->xfer_error = TRUE;
0d81dabc
JH
2663 return FALSE;
2664 }
2665
2666else if (inbytes == 0)
2667 {
2668 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2669
2670 receive_getc = smtp_getc;
2671 receive_getbuf = smtp_getbuf;
2672 receive_get_cache = smtp_get_cache;
2673 receive_ungetc = smtp_ungetc;
2674 receive_feof = smtp_feof;
2675 receive_ferror = smtp_ferror;
2676 receive_smtp_buffered = smtp_buffered;
2677
2678 gnutls_deinit(state->session);
2679 gnutls_certificate_free_credentials(state->x509_cred);
2680
2681 state->session = NULL;
74f1a423
JH
2682 state->tlsp->active.sock = -1;
2683 state->tlsp->active.tls_ctx = NULL;
0d81dabc
JH
2684 state->tlsp->bits = 0;
2685 state->tlsp->certificate_verified = FALSE;
2686 tls_channelbinding_b64 = NULL;
2687 state->tlsp->cipher = NULL;
2688 state->tlsp->peercert = NULL;
2689 state->tlsp->peerdn = NULL;
2690
2691 return FALSE;
2692 }
2693
2694/* Handle genuine errors */
2695
2696else if (inbytes < 0)
2697 {
4896a319 2698 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv(\n", __FUNCTION__);
0d81dabc 2699 record_io_error(state, (int) inbytes, US"recv", NULL);
8b77d27a 2700 state->xfer_error = TRUE;
0d81dabc
JH
2701 return FALSE;
2702 }
2703#ifndef DISABLE_DKIM
2704dkim_exim_verify_feed(state->xfer_buffer, inbytes);
2705#endif
2706state->xfer_buffer_hwm = (int) inbytes;
2707state->xfer_buffer_lwm = 0;
2708return TRUE;
2709}
2710
059ec3d9
PH
2711/*************************************************
2712* TLS version of getc *
2713*************************************************/
2714
2715/* This gets the next byte from the TLS input buffer. If the buffer is empty,
2716it refills the buffer via the GnuTLS reading function.
817d9f57 2717Only used by the server-side TLS.
059ec3d9 2718
17c76198
PP
2719This feeds DKIM and should be used for all message-body reads.
2720
aded2255 2721Arguments: lim Maximum amount to read/buffer
059ec3d9
PH
2722Returns: the next character or EOF
2723*/
2724
2725int
bd8fbe36 2726tls_getc(unsigned lim)
059ec3d9 2727{
0d81dabc 2728exim_gnutls_state_st * state = &state_server;
059ec3d9 2729
0d81dabc
JH
2730if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
2731 if (!tls_refill(lim))
2732 return state->xfer_error ? EOF : smtp_getc(lim);
ed62aae3 2733
0d81dabc 2734/* Something in the buffer; return next uschar */
059ec3d9 2735
0d81dabc
JH
2736return state->xfer_buffer[state->xfer_buffer_lwm++];
2737}
059ec3d9 2738
0d81dabc
JH
2739uschar *
2740tls_getbuf(unsigned * len)
2741{
2742exim_gnutls_state_st * state = &state_server;
2743unsigned size;
2744uschar * buf;
059ec3d9 2745
0d81dabc
JH
2746if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
2747 if (!tls_refill(*len))
059ec3d9 2748 {
0d81dabc
JH
2749 if (!state->xfer_error) return smtp_getbuf(len);
2750 *len = 0;
2751 return NULL;
059ec3d9 2752 }
059ec3d9 2753
0d81dabc
JH
2754if ((size = state->xfer_buffer_hwm - state->xfer_buffer_lwm) > *len)
2755 size = *len;
2756buf = &state->xfer_buffer[state->xfer_buffer_lwm];
2757state->xfer_buffer_lwm += size;
2758*len = size;
2759return buf;
059ec3d9
PH
2760}
2761
0d81dabc 2762
584e96c6
JH
2763void
2764tls_get_cache()
2765{
9960d1e5 2766#ifndef DISABLE_DKIM
584e96c6
JH
2767exim_gnutls_state_st * state = &state_server;
2768int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
2769if (n > 0)
2770 dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
584e96c6 2771#endif
9960d1e5 2772}
584e96c6 2773
059ec3d9 2774
925ac8e4
JH
2775BOOL
2776tls_could_read(void)
2777{
2778return state_server.xfer_buffer_lwm < state_server.xfer_buffer_hwm
2779 || gnutls_record_check_pending(state_server.session) > 0;
2780}
2781
2782
059ec3d9 2783
17c76198 2784
059ec3d9
PH
2785/*************************************************
2786* Read bytes from TLS channel *
2787*************************************************/
2788
17c76198
PP
2789/* This does not feed DKIM, so if the caller uses this for reading message body,
2790then the caller must feed DKIM.
817d9f57 2791
059ec3d9 2792Arguments:
74f1a423 2793 ct_ctx client context pointer, or NULL for the one global server context
059ec3d9
PH
2794 buff buffer of data
2795 len size of buffer
2796
2797Returns: the number of bytes read
afdb5e9c 2798 -1 after a failed read, including EOF
059ec3d9
PH
2799*/
2800
2801int
74f1a423 2802tls_read(void * ct_ctx, uschar *buff, size_t len)
059ec3d9 2803{
74f1a423 2804exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
17c76198 2805ssize_t inbytes;
059ec3d9 2806
17c76198
PP
2807if (len > INT_MAX)
2808 len = INT_MAX;
059ec3d9 2809
17c76198
PP
2810if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
2811 DEBUG(D_tls)
2812 debug_printf("*** PROBABLY A BUG *** " \
2813 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
2814 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
2815
2816DEBUG(D_tls)
2817 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
2818 state->session, buff, len);
2819
4896a319
AM
2820do
2821 inbytes = gnutls_record_recv(state->session, buff, len);
2822while (inbytes == GNUTLS_E_AGAIN);
2823
059ec3d9
PH
2824if (inbytes > 0) return inbytes;
2825if (inbytes == 0)
2826 {
2827 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2828 }
5fd28bb8 2829else
4896a319
AM
2830 {
2831 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv(\n", __FUNCTION__);
2832 record_io_error(state, (int)inbytes, US"recv", NULL);
2833 }
059ec3d9
PH
2834
2835return -1;
2836}
2837
2838
2839
17c76198 2840
059ec3d9
PH
2841/*************************************************
2842* Write bytes down TLS channel *
2843*************************************************/
2844
2845/*
2846Arguments:
74f1a423 2847 ct_ctx client context pointer, or NULL for the one global server context
059ec3d9
PH
2848 buff buffer of data
2849 len number of bytes
925ac8e4 2850 more more data expected soon
059ec3d9
PH
2851
2852Returns: the number of bytes after a successful write,
2853 -1 after a failed write
2854*/
2855
2856int
74f1a423 2857tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
059ec3d9 2858{
17c76198
PP
2859ssize_t outbytes;
2860size_t left = len;
74f1a423 2861exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
925ac8e4
JH
2862#ifdef SUPPORT_CORK
2863static BOOL corked = FALSE;
2864
2865if (more && !corked) gnutls_record_cork(state->session);
2866#endif
2867
2868DEBUG(D_tls) debug_printf("%s(%p, " SIZE_T_FMT "%s)\n", __FUNCTION__,
2869 buff, left, more ? ", more" : "");
059ec3d9 2870
059ec3d9
PH
2871while (left > 0)
2872 {
17c76198
PP
2873 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
2874 buff, left);
4896a319
AM
2875
2876 do
2877 outbytes = gnutls_record_send(state->session, buff, left);
2878 while (outbytes == GNUTLS_E_AGAIN);
059ec3d9 2879
17c76198 2880 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
059ec3d9
PH
2881 if (outbytes < 0)
2882 {
1b76ad22 2883 DEBUG(D_tls) debug_printf("%s: gnutls_record_send err\n", __FUNCTION__);
17c76198 2884 record_io_error(state, outbytes, US"send", NULL);
059ec3d9
PH
2885 return -1;
2886 }
2887 if (outbytes == 0)
2888 {
17c76198 2889 record_io_error(state, 0, US"send", US"TLS channel closed on write");
059ec3d9
PH
2890 return -1;
2891 }
2892
2893 left -= outbytes;
2894 buff += outbytes;
2895 }
2896
17c76198
PP
2897if (len > INT_MAX)
2898 {
2899 DEBUG(D_tls)
2900 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
2901 len);
2902 len = INT_MAX;
2903 }
2904
925ac8e4
JH
2905#ifdef SUPPORT_CORK
2906if (more != corked)
2907 {
2908 if (!more) (void) gnutls_record_uncork(state->session, 0);
2909 corked = more;
2910 }
2911#endif
2912
17c76198 2913return (int) len;
059ec3d9
PH
2914}
2915
2916
2917
17c76198 2918
059ec3d9 2919/*************************************************
17c76198 2920* Random number generation *
059ec3d9
PH
2921*************************************************/
2922
17c76198
PP
2923/* Pseudo-random number generation. The result is not expected to be
2924cryptographically strong but not so weak that someone will shoot themselves
2925in the foot using it as a nonce in input in some email header scheme or
2926whatever weirdness they'll twist this into. The result should handle fork()
2927and avoid repeating sequences. OpenSSL handles that for us.
059ec3d9 2928
17c76198
PP
2929Arguments:
2930 max range maximum
2931Returns a random number in range [0, max-1]
059ec3d9
PH
2932*/
2933
af3498d6 2934#ifdef HAVE_GNUTLS_RND
17c76198
PP
2935int
2936vaguely_random_number(int max)
059ec3d9 2937{
17c76198
PP
2938unsigned int r;
2939int i, needed_len;
17c76198
PP
2940uschar smallbuf[sizeof(r)];
2941
2942if (max <= 1)
2943 return 0;
2944
2945needed_len = sizeof(r);
2946/* Don't take 8 times more entropy than needed if int is 8 octets and we were
d7978c0f
JH
2947asked for a number less than 10. */
2948
17c76198
PP
2949for (r = max, i = 0; r; ++i)
2950 r >>= 1;
2951i = (i + 7) / 8;
2952if (i < needed_len)
2953 needed_len = i;
2954
2955i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
2956if (i < 0)
059ec3d9 2957 {
17c76198
PP
2958 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
2959 return vaguely_random_number_fallback(max);
2960 }
2961r = 0;
d7978c0f
JH
2962for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
2963 r = r * 256 + *p;
059ec3d9 2964
17c76198
PP
2965/* We don't particularly care about weighted results; if someone wants
2966 * smooth distribution and cares enough then they should submit a patch then. */
2967return r % max;
059ec3d9 2968}
af3498d6
PP
2969#else /* HAVE_GNUTLS_RND */
2970int
2971vaguely_random_number(int max)
2972{
2973 return vaguely_random_number_fallback(max);
2974}
2975#endif /* HAVE_GNUTLS_RND */
059ec3d9 2976
36f12725
NM
2977
2978
2979
2980/*************************************************
3375e053
PP
2981* Let tls_require_ciphers be checked at startup *
2982*************************************************/
2983
2984/* The tls_require_ciphers option, if set, must be something which the
2985library can parse.
2986
2987Returns: NULL on success, or error message
2988*/
2989
2990uschar *
2991tls_validate_require_cipher(void)
2992{
2993int rc;
2994uschar *expciphers = NULL;
2995gnutls_priority_t priority_cache;
2996const char *errpos;
cf0c6164 2997uschar * dummy_errstr;
3375e053
PP
2998
2999#define validate_check_rc(Label) do { \
3000 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
3001 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
3002#define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
3003
3004if (exim_gnutls_base_init_done)
3005 log_write(0, LOG_MAIN|LOG_PANIC,
3006 "already initialised GnuTLS, Exim developer bug");
3007
a5f239e4 3008#ifdef HAVE_GNUTLS_PKCS11
2519e60d 3009if (!gnutls_allow_auto_pkcs11)
a5f239e4
PP
3010 {
3011 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
3012 validate_check_rc(US"gnutls_pkcs11_init");
3013 }
3014#endif
3375e053
PP
3015rc = gnutls_global_init();
3016validate_check_rc(US"gnutls_global_init()");
3017exim_gnutls_base_init_done = TRUE;
3018
3019if (!(tls_require_ciphers && *tls_require_ciphers))
3020 return_deinit(NULL);
3021
cf0c6164
JH
3022if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
3023 &dummy_errstr))
3375e053
PP
3024 return_deinit(US"failed to expand tls_require_ciphers");
3025
3026if (!(expciphers && *expciphers))
3027 return_deinit(NULL);
3028
3029DEBUG(D_tls)
3030 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
3031
3032rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
3033validate_check_rc(string_sprintf(
3034 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
3035 expciphers, errpos - CS expciphers, errpos));
3036
3037#undef return_deinit
3038#undef validate_check_rc
3039gnutls_global_deinit();
3040
3041return NULL;
3042}
3043
3044
3045
3046
3047/*************************************************
36f12725
NM
3048* Report the library versions. *
3049*************************************************/
3050
3051/* See a description in tls-openssl.c for an explanation of why this exists.
3052
3053Arguments: a FILE* to print the results to
3054Returns: nothing
3055*/
3056
3057void
3058tls_version_report(FILE *f)
3059{
754a0503
PP
3060fprintf(f, "Library version: GnuTLS: Compile: %s\n"
3061 " Runtime: %s\n",
3062 LIBGNUTLS_VERSION,
3063 gnutls_check_version(NULL));
36f12725
NM
3064}
3065
2b4a568d
JH
3066/* vi: aw ai sw=2
3067*/
059ec3d9 3068/* End of tls-gnu.c */