Commit | Line | Data |
---|---|---|
9d1c15ef JH |
1 | /************************************************* |
2 | * Exim - an Internet mail transport agent * | |
3 | *************************************************/ | |
4 | ||
3386088d | 5 | /* Copyright (c) Jeremy Harris 2014 - 2015 */ |
9d1c15ef JH |
6 | |
7 | /* This file provides TLS/SSL support for Exim using the GnuTLS library, | |
8 | one of the available supported implementations. This file is #included into | |
9 | tls.c when USE_GNUTLS has been set. | |
10 | */ | |
11 | ||
12 | #include <gnutls/gnutls.h> | |
13 | /* needed for cert checks in verification and DN extraction: */ | |
14 | #include <gnutls/x509.h> | |
15 | /* needed to disable PKCS11 autoload unless requested */ | |
16 | #if GNUTLS_VERSION_NUMBER >= 0x020c00 | |
17 | # include <gnutls/pkcs11.h> | |
18 | #endif | |
19 | ||
20 | ||
21 | /***************************************************** | |
22 | * Export/import a certificate, binary/printable | |
23 | *****************************************************/ | |
24 | int | |
25 | tls_export_cert(uschar * buf, size_t buflen, void * cert) | |
26 | { | |
27 | size_t sz = buflen; | |
28 | void * reset_point = store_get(0); | |
c03fae8a | 29 | int fail; |
55414b25 | 30 | const uschar * cp; |
9d1c15ef | 31 | |
c03fae8a JH |
32 | if ((fail = gnutls_x509_crt_export((gnutls_x509_crt_t)cert, |
33 | GNUTLS_X509_FMT_PEM, buf, &sz))) | |
34 | { | |
35 | log_write(0, LOG_MAIN, "TLS error in certificate export: %s", | |
36 | gnutls_strerror(fail)); | |
9d1c15ef | 37 | return 1; |
c03fae8a | 38 | } |
9d1c15ef JH |
39 | if ((cp = string_printing(buf)) != buf) |
40 | { | |
41 | Ustrncpy(buf, cp, buflen); | |
42 | if (buf[buflen-1]) | |
43 | fail = 1; | |
44 | } | |
45 | store_reset(reset_point); | |
46 | return fail; | |
47 | } | |
48 | ||
49 | int | |
50 | tls_import_cert(const uschar * buf, void ** cert) | |
51 | { | |
52 | void * reset_point = store_get(0); | |
53 | gnutls_datum_t datum; | |
152e7604 | 54 | gnutls_x509_crt_t crt = *(gnutls_x509_crt_t *)cert; |
9d1c15ef JH |
55 | int fail = 0; |
56 | ||
152e7604 JH |
57 | if (crt) |
58 | gnutls_x509_crt_deinit(crt); | |
59 | else | |
60 | gnutls_global_init(); | |
61 | ||
9d1c15ef JH |
62 | gnutls_x509_crt_init(&crt); |
63 | ||
64 | datum.data = string_unprinting(US buf); | |
65 | datum.size = Ustrlen(datum.data); | |
c03fae8a JH |
66 | if ((fail = gnutls_x509_crt_import(crt, &datum, GNUTLS_X509_FMT_PEM))) |
67 | { | |
68 | log_write(0, LOG_MAIN, "TLS error in certificate import: %s", | |
69 | gnutls_strerror(fail)); | |
9d1c15ef | 70 | fail = 1; |
c03fae8a | 71 | } |
9d1c15ef JH |
72 | else |
73 | *cert = (void *)crt; | |
74 | ||
75 | store_reset(reset_point); | |
76 | return fail; | |
77 | } | |
78 | ||
79 | void | |
790fbb71 | 80 | tls_free_cert(void ** cert) |
9d1c15ef | 81 | { |
790fbb71 JH |
82 | gnutls_x509_crt_t crt = *(gnutls_x509_crt_t *)cert; |
83 | if (crt) | |
84 | { | |
85 | gnutls_x509_crt_deinit(crt); | |
86 | gnutls_global_deinit(); | |
87 | *cert = NULL; | |
88 | } | |
9d1c15ef JH |
89 | } |
90 | ||
91 | /***************************************************** | |
92 | * Certificate field extraction routines | |
93 | *****************************************************/ | |
c03fae8a JH |
94 | |
95 | /* First, some internal service functions */ | |
96 | ||
8a6eec04 JH |
97 | static uschar * |
98 | g_err(const char * tag, const char * from, int gnutls_err) | |
99 | { | |
812a6045 JH |
100 | expand_string_message = string_sprintf("%s: %s fail: %s\n", |
101 | from, tag, gnutls_strerror(gnutls_err)); | |
8a6eec04 JH |
102 | return NULL; |
103 | } | |
104 | ||
105 | ||
9d1c15ef | 106 | static uschar * |
25ba2544 | 107 | time_copy(time_t t, uschar * mod) |
9d1c15ef | 108 | { |
25ba2544 | 109 | uschar * cp; |
e9477a08 | 110 | size_t len = 32; |
25ba2544 JH |
111 | |
112 | if (mod && Ustrcmp(mod, "int") == 0) | |
113 | return string_sprintf("%u", (unsigned)t); | |
114 | ||
e9477a08 JH |
115 | cp = store_get(len); |
116 | if (timestamps_utc) | |
117 | { | |
45500060 | 118 | uschar * tz = to_tz(US"GMT0"); |
e9477a08 JH |
119 | len = strftime(CS cp, len, "%b %e %T %Y %Z", gmtime(&t)); |
120 | restore_tz(tz); | |
121 | } | |
122 | else | |
123 | len = strftime(CS cp, len, "%b %e %T %Y %Z", localtime(&t)); | |
9d1c15ef JH |
124 | return len > 0 ? cp : NULL; |
125 | } | |
126 | ||
c03fae8a | 127 | |
9d1c15ef | 128 | /**/ |
c03fae8a JH |
129 | /* Now the extractors, called from expand.c |
130 | Arguments: | |
131 | cert The certificate | |
132 | mod Optional modifiers for the operator | |
133 | ||
134 | Return: | |
135 | Allocated string with extracted value | |
136 | */ | |
9d1c15ef JH |
137 | |
138 | uschar * | |
9e4dddbd | 139 | tls_cert_issuer(void * cert, uschar * mod) |
9d1c15ef | 140 | { |
812a6045 JH |
141 | uschar * cp = NULL; |
142 | int ret; | |
143 | size_t siz = 0; | |
144 | ||
76075bb5 | 145 | if ((ret = gnutls_x509_crt_get_issuer_dn(cert, CS cp, &siz)) |
812a6045 JH |
146 | != GNUTLS_E_SHORT_MEMORY_BUFFER) |
147 | return g_err("gi0", __FUNCTION__, ret); | |
148 | ||
149 | cp = store_get(siz); | |
76075bb5 | 150 | if ((ret = gnutls_x509_crt_get_issuer_dn(cert, CS cp, &siz)) < 0) |
812a6045 JH |
151 | return g_err("gi1", __FUNCTION__, ret); |
152 | ||
153 | return mod ? tls_field_from_dn(cp, mod) : cp; | |
9d1c15ef JH |
154 | } |
155 | ||
156 | uschar * | |
9e4dddbd | 157 | tls_cert_not_after(void * cert, uschar * mod) |
9d1c15ef JH |
158 | { |
159 | return time_copy( | |
25ba2544 JH |
160 | gnutls_x509_crt_get_expiration_time((gnutls_x509_crt_t)cert), |
161 | mod); | |
9d1c15ef JH |
162 | } |
163 | ||
164 | uschar * | |
9e4dddbd | 165 | tls_cert_not_before(void * cert, uschar * mod) |
9d1c15ef JH |
166 | { |
167 | return time_copy( | |
25ba2544 JH |
168 | gnutls_x509_crt_get_activation_time((gnutls_x509_crt_t)cert), |
169 | mod); | |
9d1c15ef JH |
170 | } |
171 | ||
172 | uschar * | |
9e4dddbd | 173 | tls_cert_serial_number(void * cert, uschar * mod) |
9d1c15ef JH |
174 | { |
175 | uschar bin[50], txt[150]; | |
176 | size_t sz = sizeof(bin); | |
177 | uschar * sp; | |
178 | uschar * dp; | |
c03fae8a JH |
179 | int ret; |
180 | ||
181 | if ((ret = gnutls_x509_crt_get_serial((gnutls_x509_crt_t)cert, | |
182 | bin, &sz))) | |
183 | return g_err("gs0", __FUNCTION__, ret); | |
9d1c15ef | 184 | |
5976eb99 JH |
185 | for(dp = txt, sp = bin; sz; sz--) |
186 | dp += sprintf(CS dp, "%.2x", *sp++); | |
9d1c15ef JH |
187 | for(sp = txt; sp[0]=='0' && sp[1]; ) sp++; /* leading zeroes */ |
188 | return string_copy(sp); | |
189 | } | |
190 | ||
191 | uschar * | |
9e4dddbd | 192 | tls_cert_signature(void * cert, uschar * mod) |
9d1c15ef | 193 | { |
69cbeaec | 194 | uschar * cp1 = NULL; |
9d1c15ef JH |
195 | uschar * cp2; |
196 | uschar * cp3; | |
197 | size_t len = 0; | |
198 | int ret; | |
199 | ||
76075bb5 | 200 | if ((ret = gnutls_x509_crt_get_signature((gnutls_x509_crt_t)cert, CS cp1, &len)) |
812a6045 JH |
201 | != GNUTLS_E_SHORT_MEMORY_BUFFER) |
202 | return g_err("gs0", __FUNCTION__, ret); | |
9d1c15ef JH |
203 | |
204 | cp1 = store_get(len*4+1); | |
76075bb5 | 205 | if (gnutls_x509_crt_get_signature((gnutls_x509_crt_t)cert, CS cp1, &len) != 0) |
812a6045 | 206 | return g_err("gs1", __FUNCTION__, ret); |
9d1c15ef | 207 | |
5976eb99 JH |
208 | for(cp3 = cp2 = cp1+len; cp1 < cp2; cp1++) |
209 | cp3 += sprintf(CS cp3, "%.2x ", *cp1); | |
9d1c15ef JH |
210 | cp3[-1]= '\0'; |
211 | ||
212 | return cp2; | |
213 | } | |
214 | ||
215 | uschar * | |
9e4dddbd | 216 | tls_cert_signature_algorithm(void * cert, uschar * mod) |
9d1c15ef JH |
217 | { |
218 | gnutls_sign_algorithm_t algo = | |
219 | gnutls_x509_crt_get_signature_algorithm((gnutls_x509_crt_t)cert); | |
76075bb5 | 220 | return algo < 0 ? NULL : string_copy(US gnutls_sign_get_name(algo)); |
9d1c15ef JH |
221 | } |
222 | ||
223 | uschar * | |
9e4dddbd | 224 | tls_cert_subject(void * cert, uschar * mod) |
9d1c15ef | 225 | { |
8a6eec04 JH |
226 | uschar * cp = NULL; |
227 | int ret; | |
228 | size_t siz = 0; | |
229 | ||
76075bb5 | 230 | if ((ret = gnutls_x509_crt_get_dn(cert, CS cp, &siz)) |
812a6045 JH |
231 | != GNUTLS_E_SHORT_MEMORY_BUFFER) |
232 | return g_err("gs0", __FUNCTION__, ret); | |
8a6eec04 JH |
233 | |
234 | cp = store_get(siz); | |
76075bb5 | 235 | if ((ret = gnutls_x509_crt_get_dn(cert, CS cp, &siz)) < 0) |
812a6045 | 236 | return g_err("gs1", __FUNCTION__, ret); |
8a6eec04 | 237 | |
812a6045 | 238 | return mod ? tls_field_from_dn(cp, mod) : cp; |
9d1c15ef JH |
239 | } |
240 | ||
241 | uschar * | |
9e4dddbd | 242 | tls_cert_version(void * cert, uschar * mod) |
9d1c15ef JH |
243 | { |
244 | return string_sprintf("%d", gnutls_x509_crt_get_version(cert)); | |
245 | } | |
246 | ||
247 | uschar * | |
248 | tls_cert_ext_by_oid(void * cert, uschar * oid, int idx) | |
249 | { | |
250 | uschar * cp1 = NULL; | |
251 | uschar * cp2; | |
252 | uschar * cp3; | |
253 | size_t siz = 0; | |
254 | unsigned int crit; | |
255 | int ret; | |
256 | ||
257 | ret = gnutls_x509_crt_get_extension_by_oid ((gnutls_x509_crt_t)cert, | |
76075bb5 | 258 | oid, idx, CS cp1, &siz, &crit); |
9d1c15ef | 259 | if (ret != GNUTLS_E_SHORT_MEMORY_BUFFER) |
8a6eec04 | 260 | return g_err("ge0", __FUNCTION__, ret); |
9d1c15ef JH |
261 | |
262 | cp1 = store_get(siz*4 + 1); | |
263 | ||
264 | ret = gnutls_x509_crt_get_extension_by_oid ((gnutls_x509_crt_t)cert, | |
76075bb5 | 265 | oid, idx, CS cp1, &siz, &crit); |
9d1c15ef | 266 | if (ret < 0) |
8a6eec04 | 267 | return g_err("ge1", __FUNCTION__, ret); |
9d1c15ef JH |
268 | |
269 | /* binary data, DER encoded */ | |
270 | ||
271 | /* just dump for now */ | |
5976eb99 JH |
272 | for(cp3 = cp2 = cp1+siz; cp1 < cp2; cp1++) |
273 | cp3 += sprintf(CS cp3, "%.2x ", *cp1); | |
9d1c15ef JH |
274 | cp3[-1]= '\0'; |
275 | ||
276 | return cp2; | |
277 | } | |
278 | ||
279 | uschar * | |
9e4dddbd | 280 | tls_cert_subject_altname(void * cert, uschar * mod) |
9d1c15ef | 281 | { |
9e4dddbd | 282 | uschar * list = NULL; |
4226691b | 283 | int lsize = 0, llen = 0; |
9e4dddbd JH |
284 | int index; |
285 | size_t siz; | |
9d1c15ef | 286 | int ret; |
9e4dddbd JH |
287 | uschar sep = '\n'; |
288 | uschar * tag = US""; | |
289 | uschar * ele; | |
290 | int match = -1; | |
9d1c15ef | 291 | |
9e4dddbd | 292 | while (mod) |
9d1c15ef | 293 | { |
9e4dddbd JH |
294 | if (*mod == '>' && *++mod) sep = *mod++; |
295 | else if (Ustrcmp(mod, "dns")==0) { match = GNUTLS_SAN_DNSNAME; mod += 3; } | |
296 | else if (Ustrcmp(mod, "uri")==0) { match = GNUTLS_SAN_URI; mod += 3; } | |
297 | else if (Ustrcmp(mod, "mail")==0) { match = GNUTLS_SAN_RFC822NAME; mod += 4; } | |
298 | else continue; | |
299 | ||
300 | if (*mod++ != ',') | |
9d1c15ef | 301 | break; |
9d1c15ef JH |
302 | } |
303 | ||
9e4dddbd | 304 | for(index = 0;; index++) |
9d1c15ef | 305 | { |
9e4dddbd JH |
306 | siz = 0; |
307 | switch(ret = gnutls_x509_crt_get_subject_alt_name( | |
e51c7be2 | 308 | (gnutls_x509_crt_t)cert, index, NULL, &siz, NULL)) |
9e4dddbd JH |
309 | { |
310 | case GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE: | |
311 | return list; /* no more elements; normal exit */ | |
312 | ||
313 | case GNUTLS_E_SHORT_MEMORY_BUFFER: | |
314 | break; | |
315 | ||
316 | default: | |
8a6eec04 | 317 | return g_err("gs0", __FUNCTION__, ret); |
9e4dddbd JH |
318 | } |
319 | ||
320 | ele = store_get(siz+1); | |
321 | if ((ret = gnutls_x509_crt_get_subject_alt_name( | |
322 | (gnutls_x509_crt_t)cert, index, ele, &siz, NULL)) < 0) | |
8a6eec04 | 323 | return g_err("gs1", __FUNCTION__, ret); |
9e4dddbd JH |
324 | ele[siz] = '\0'; |
325 | ||
e51c7be2 JH |
326 | if ( match != -1 && match != ret /* wrong type of SAN */ |
327 | || Ustrlen(ele) != siz) /* contains a NUL */ | |
9e4dddbd JH |
328 | continue; |
329 | switch (ret) | |
330 | { | |
331 | case GNUTLS_SAN_DNSNAME: tag = US"DNS"; break; | |
94431adb | 332 | case GNUTLS_SAN_URI: tag = US"URI"; break; |
9e4dddbd JH |
333 | case GNUTLS_SAN_RFC822NAME: tag = US"MAIL"; break; |
334 | default: continue; /* ignore unrecognised types */ | |
335 | } | |
4226691b | 336 | list = string_append_listele(list, &lsize, &llen, sep, |
9e4dddbd | 337 | match == -1 ? string_sprintf("%s=%s", tag, ele) : ele); |
9d1c15ef | 338 | } |
9e4dddbd | 339 | /*NOTREACHED*/ |
9d1c15ef JH |
340 | } |
341 | ||
342 | uschar * | |
9e4dddbd | 343 | tls_cert_ocsp_uri(void * cert, uschar * mod) |
9d1c15ef JH |
344 | { |
345 | #if GNUTLS_VERSION_NUMBER >= 0x030000 | |
346 | gnutls_datum_t uri; | |
9e4dddbd JH |
347 | int ret; |
348 | uschar sep = '\n'; | |
349 | int index; | |
350 | uschar * list = NULL; | |
4226691b | 351 | int lsize = 0, llen = 0; |
9e4dddbd JH |
352 | |
353 | if (mod) | |
354 | if (*mod == '>' && *++mod) sep = *mod++; | |
9d1c15ef | 355 | |
9e4dddbd JH |
356 | for(index = 0;; index++) |
357 | { | |
358 | ret = gnutls_x509_crt_get_authority_info_access((gnutls_x509_crt_t)cert, | |
359 | index, GNUTLS_IA_OCSP_URI, &uri, NULL); | |
9d1c15ef | 360 | |
9e4dddbd JH |
361 | if (ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) |
362 | return list; | |
363 | if (ret < 0) | |
8a6eec04 | 364 | return g_err("gai", __FUNCTION__, ret); |
9d1c15ef | 365 | |
4226691b JH |
366 | list = string_append_listele_n(list, &lsize, &llen, sep, |
367 | uri.data, uri.size); | |
9e4dddbd JH |
368 | } |
369 | /*NOTREACHED*/ | |
9d1c15ef JH |
370 | |
371 | #else | |
372 | ||
94431adb | 373 | expand_string_message = |
9d1c15ef JH |
374 | string_sprintf("%s: OCSP support with GnuTLS requires version 3.0.0\n", |
375 | __FUNCTION__); | |
376 | return NULL; | |
377 | ||
378 | #endif | |
379 | } | |
380 | ||
381 | uschar * | |
9e4dddbd | 382 | tls_cert_crl_uri(void * cert, uschar * mod) |
9d1c15ef JH |
383 | { |
384 | int ret; | |
9e4dddbd JH |
385 | size_t siz; |
386 | uschar sep = '\n'; | |
387 | int index; | |
388 | uschar * list = NULL; | |
4226691b | 389 | int lsize = 0, llen = 0; |
9e4dddbd JH |
390 | uschar * ele; |
391 | ||
392 | if (mod) | |
393 | if (*mod == '>' && *++mod) sep = *mod++; | |
9d1c15ef | 394 | |
9e4dddbd | 395 | for(index = 0;; index++) |
9d1c15ef | 396 | { |
9e4dddbd JH |
397 | siz = 0; |
398 | switch(ret = gnutls_x509_crt_get_crl_dist_points( | |
399 | (gnutls_x509_crt_t)cert, index, NULL, &siz, NULL, NULL)) | |
400 | { | |
401 | case GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE: | |
402 | return list; | |
403 | case GNUTLS_E_SHORT_MEMORY_BUFFER: | |
404 | break; | |
405 | default: | |
8a6eec04 | 406 | return g_err("gc0", __FUNCTION__, ret); |
9e4dddbd JH |
407 | } |
408 | ||
4226691b | 409 | ele = store_get(siz); |
9e4dddbd | 410 | if ((ret = gnutls_x509_crt_get_crl_dist_points( |
8a6eec04 JH |
411 | (gnutls_x509_crt_t)cert, index, ele, &siz, NULL, NULL)) < 0) |
412 | return g_err("gc1", __FUNCTION__, ret); | |
413 | ||
4226691b | 414 | list = string_append_listele_n(list, &lsize, &llen, sep, ele, siz); |
9d1c15ef | 415 | } |
9e4dddbd | 416 | /*NOTREACHED*/ |
9d1c15ef JH |
417 | } |
418 | ||
419 | ||
6a8a60e0 JH |
420 | /***************************************************** |
421 | * Certificate operator routines | |
422 | *****************************************************/ | |
59b87190 JH |
423 | uschar * |
424 | tls_cert_der_b64(void * cert) | |
425 | { | |
426 | size_t len = 0; | |
427 | uschar * cp = NULL; | |
428 | int fail; | |
429 | ||
430 | if ( (fail = gnutls_x509_crt_export((gnutls_x509_crt_t)cert, | |
431 | GNUTLS_X509_FMT_DER, cp, &len)) != GNUTLS_E_SHORT_MEMORY_BUFFER | |
432 | || !(cp = store_get((int)len)) | |
433 | || (fail = gnutls_x509_crt_export((gnutls_x509_crt_t)cert, | |
434 | GNUTLS_X509_FMT_DER, cp, &len)) | |
435 | ) | |
436 | { | |
437 | log_write(0, LOG_MAIN, "TLS error in certificate export: %s", | |
438 | gnutls_strerror(fail)); | |
439 | return NULL; | |
440 | } | |
441 | return b64encode(cp, (int)len); | |
442 | } | |
443 | ||
444 | ||
6a8a60e0 JH |
445 | static uschar * |
446 | fingerprint(gnutls_x509_crt_t cert, gnutls_digest_algorithm_t algo) | |
447 | { | |
448 | int ret; | |
449 | size_t siz = 0; | |
450 | uschar * cp; | |
451 | uschar * cp2; | |
452 | uschar * cp3; | |
453 | ||
454 | if ((ret = gnutls_x509_crt_get_fingerprint(cert, algo, NULL, &siz)) | |
455 | != GNUTLS_E_SHORT_MEMORY_BUFFER) | |
8a6eec04 JH |
456 | return g_err("gf0", __FUNCTION__, ret); |
457 | ||
6a8a60e0 JH |
458 | cp = store_get(siz*3+1); |
459 | if ((ret = gnutls_x509_crt_get_fingerprint(cert, algo, cp, &siz)) < 0) | |
8a6eec04 JH |
460 | return g_err("gf1", __FUNCTION__, ret); |
461 | ||
5976eb99 JH |
462 | for (cp3 = cp2 = cp+siz; cp < cp2; cp++) |
463 | cp3 += sprintf(CS cp3, "%02X", *cp); | |
6a8a60e0 JH |
464 | return cp2; |
465 | } | |
466 | ||
467 | ||
468 | uschar * | |
469 | tls_cert_fprt_md5(void * cert) | |
470 | { | |
471 | return fingerprint((gnutls_x509_crt_t)cert, GNUTLS_DIG_MD5); | |
472 | } | |
473 | ||
474 | uschar * | |
475 | tls_cert_fprt_sha1(void * cert) | |
476 | { | |
477 | return fingerprint((gnutls_x509_crt_t)cert, GNUTLS_DIG_SHA1); | |
478 | } | |
479 | ||
9ef9101c JH |
480 | uschar * |
481 | tls_cert_fprt_sha256(void * cert) | |
482 | { | |
483 | return fingerprint((gnutls_x509_crt_t)cert, GNUTLS_DIG_SHA256); | |
484 | } | |
485 | ||
6a8a60e0 | 486 | |
9d1c15ef JH |
487 | /* vi: aw ai sw=2 |
488 | */ | |
489 | /* End of tlscert-gnu.c */ |