constification
[exim.git] / src / src / tlscert-gnu.c
CommitLineData
9d1c15ef
JH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
f9ba5e22 5/* Copyright (c) Jeremy Harris 2014 - 2018 */
9d1c15ef
JH
6
7/* This file provides TLS/SSL support for Exim using the GnuTLS library,
8one of the available supported implementations. This file is #included into
9tls.c when USE_GNUTLS has been set.
10*/
11
12#include <gnutls/gnutls.h>
13/* needed for cert checks in verification and DN extraction: */
14#include <gnutls/x509.h>
15/* needed to disable PKCS11 autoload unless requested */
16#if GNUTLS_VERSION_NUMBER >= 0x020c00
17# include <gnutls/pkcs11.h>
18#endif
19
20
21/*****************************************************
22* Export/import a certificate, binary/printable
23*****************************************************/
24int
25tls_export_cert(uschar * buf, size_t buflen, void * cert)
26{
27size_t sz = buflen;
28void * reset_point = store_get(0);
c03fae8a 29int fail;
55414b25 30const uschar * cp;
9d1c15ef 31
c03fae8a
JH
32if ((fail = gnutls_x509_crt_export((gnutls_x509_crt_t)cert,
33 GNUTLS_X509_FMT_PEM, buf, &sz)))
34 {
35 log_write(0, LOG_MAIN, "TLS error in certificate export: %s",
36 gnutls_strerror(fail));
9d1c15ef 37 return 1;
c03fae8a 38 }
9d1c15ef
JH
39if ((cp = string_printing(buf)) != buf)
40 {
41 Ustrncpy(buf, cp, buflen);
42 if (buf[buflen-1])
43 fail = 1;
44 }
45store_reset(reset_point);
46return fail;
47}
48
49int
50tls_import_cert(const uschar * buf, void ** cert)
51{
52void * reset_point = store_get(0);
53gnutls_datum_t datum;
152e7604 54gnutls_x509_crt_t crt = *(gnutls_x509_crt_t *)cert;
9d1c15ef
JH
55int fail = 0;
56
152e7604
JH
57if (crt)
58 gnutls_x509_crt_deinit(crt);
59else
60 gnutls_global_init();
61
9d1c15ef
JH
62gnutls_x509_crt_init(&crt);
63
64datum.data = string_unprinting(US buf);
65datum.size = Ustrlen(datum.data);
c03fae8a
JH
66if ((fail = gnutls_x509_crt_import(crt, &datum, GNUTLS_X509_FMT_PEM)))
67 {
68 log_write(0, LOG_MAIN, "TLS error in certificate import: %s",
69 gnutls_strerror(fail));
9d1c15ef 70 fail = 1;
c03fae8a 71 }
9d1c15ef
JH
72else
73 *cert = (void *)crt;
74
75store_reset(reset_point);
76return fail;
77}
78
79void
790fbb71 80tls_free_cert(void ** cert)
9d1c15ef 81{
790fbb71
JH
82gnutls_x509_crt_t crt = *(gnutls_x509_crt_t *)cert;
83if (crt)
84 {
85 gnutls_x509_crt_deinit(crt);
86 gnutls_global_deinit();
87 *cert = NULL;
88 }
9d1c15ef
JH
89}
90
91/*****************************************************
92* Certificate field extraction routines
93*****************************************************/
c03fae8a
JH
94
95/* First, some internal service functions */
96
9d1c15ef 97static uschar *
8a6eec04
JH
98g_err(const char * tag, const char * from, int gnutls_err)
99{
812a6045
JH
100expand_string_message = string_sprintf("%s: %s fail: %s\n",
101 from, tag, gnutls_strerror(gnutls_err));
8a6eec04
JH
102return NULL;
103}
104
105
106static uschar *
25ba2544 107time_copy(time_t t, uschar * mod)
9d1c15ef 108{
25ba2544 109uschar * cp;
e9477a08 110size_t len = 32;
25ba2544
JH
111
112if (mod && Ustrcmp(mod, "int") == 0)
113 return string_sprintf("%u", (unsigned)t);
114
e9477a08 115cp = store_get(len);
8768d548 116if (f.timestamps_utc)
e9477a08 117 {
45500060 118 uschar * tz = to_tz(US"GMT0");
e9477a08
JH
119 len = strftime(CS cp, len, "%b %e %T %Y %Z", gmtime(&t));
120 restore_tz(tz);
121 }
122else
123 len = strftime(CS cp, len, "%b %e %T %Y %Z", localtime(&t));
9d1c15ef
JH
124return len > 0 ? cp : NULL;
125}
126
c03fae8a 127
9d1c15ef 128/**/
c03fae8a
JH
129/* Now the extractors, called from expand.c
130Arguments:
131 cert The certificate
132 mod Optional modifiers for the operator
133
134Return:
135 Allocated string with extracted value
136*/
9d1c15ef
JH
137
138uschar *
9e4dddbd 139tls_cert_issuer(void * cert, uschar * mod)
9d1c15ef 140{
812a6045
JH
141uschar * cp = NULL;
142int ret;
143size_t siz = 0;
144
76075bb5 145if ((ret = gnutls_x509_crt_get_issuer_dn(cert, CS cp, &siz))
812a6045
JH
146 != GNUTLS_E_SHORT_MEMORY_BUFFER)
147 return g_err("gi0", __FUNCTION__, ret);
148
149cp = store_get(siz);
76075bb5 150if ((ret = gnutls_x509_crt_get_issuer_dn(cert, CS cp, &siz)) < 0)
812a6045
JH
151 return g_err("gi1", __FUNCTION__, ret);
152
153return mod ? tls_field_from_dn(cp, mod) : cp;
9d1c15ef
JH
154}
155
156uschar *
9e4dddbd 157tls_cert_not_after(void * cert, uschar * mod)
9d1c15ef
JH
158{
159return time_copy(
25ba2544
JH
160 gnutls_x509_crt_get_expiration_time((gnutls_x509_crt_t)cert),
161 mod);
9d1c15ef
JH
162}
163
164uschar *
9e4dddbd 165tls_cert_not_before(void * cert, uschar * mod)
9d1c15ef
JH
166{
167return time_copy(
25ba2544
JH
168 gnutls_x509_crt_get_activation_time((gnutls_x509_crt_t)cert),
169 mod);
9d1c15ef
JH
170}
171
172uschar *
9e4dddbd 173tls_cert_serial_number(void * cert, uschar * mod)
9d1c15ef
JH
174{
175uschar bin[50], txt[150];
d7978c0f 176uschar * sp = bin;
9d1c15ef 177size_t sz = sizeof(bin);
c03fae8a
JH
178int ret;
179
180if ((ret = gnutls_x509_crt_get_serial((gnutls_x509_crt_t)cert,
181 bin, &sz)))
182 return g_err("gs0", __FUNCTION__, ret);
9d1c15ef 183
d7978c0f 184for(uschar * dp = txt; sz; sz--)
5976eb99 185 dp += sprintf(CS dp, "%.2x", *sp++);
9d1c15ef
JH
186for(sp = txt; sp[0]=='0' && sp[1]; ) sp++; /* leading zeroes */
187return string_copy(sp);
188}
189
190uschar *
9e4dddbd 191tls_cert_signature(void * cert, uschar * mod)
9d1c15ef 192{
69cbeaec 193uschar * cp1 = NULL;
9d1c15ef
JH
194uschar * cp2;
195uschar * cp3;
196size_t len = 0;
197int ret;
198
76075bb5 199if ((ret = gnutls_x509_crt_get_signature((gnutls_x509_crt_t)cert, CS cp1, &len))
812a6045
JH
200 != GNUTLS_E_SHORT_MEMORY_BUFFER)
201 return g_err("gs0", __FUNCTION__, ret);
9d1c15ef
JH
202
203cp1 = store_get(len*4+1);
76075bb5 204if (gnutls_x509_crt_get_signature((gnutls_x509_crt_t)cert, CS cp1, &len) != 0)
812a6045 205 return g_err("gs1", __FUNCTION__, ret);
9d1c15ef 206
5976eb99
JH
207for(cp3 = cp2 = cp1+len; cp1 < cp2; cp1++)
208 cp3 += sprintf(CS cp3, "%.2x ", *cp1);
9d1c15ef
JH
209cp3[-1]= '\0';
210
211return cp2;
212}
213
214uschar *
9e4dddbd 215tls_cert_signature_algorithm(void * cert, uschar * mod)
9d1c15ef
JH
216{
217gnutls_sign_algorithm_t algo =
218 gnutls_x509_crt_get_signature_algorithm((gnutls_x509_crt_t)cert);
76075bb5 219return algo < 0 ? NULL : string_copy(US gnutls_sign_get_name(algo));
9d1c15ef
JH
220}
221
222uschar *
9e4dddbd 223tls_cert_subject(void * cert, uschar * mod)
9d1c15ef 224{
8a6eec04
JH
225uschar * cp = NULL;
226int ret;
227size_t siz = 0;
228
76075bb5 229if ((ret = gnutls_x509_crt_get_dn(cert, CS cp, &siz))
812a6045
JH
230 != GNUTLS_E_SHORT_MEMORY_BUFFER)
231 return g_err("gs0", __FUNCTION__, ret);
8a6eec04
JH
232
233cp = store_get(siz);
76075bb5 234if ((ret = gnutls_x509_crt_get_dn(cert, CS cp, &siz)) < 0)
812a6045 235 return g_err("gs1", __FUNCTION__, ret);
8a6eec04 236
812a6045 237return mod ? tls_field_from_dn(cp, mod) : cp;
9d1c15ef
JH
238}
239
240uschar *
9e4dddbd 241tls_cert_version(void * cert, uschar * mod)
9d1c15ef
JH
242{
243return string_sprintf("%d", gnutls_x509_crt_get_version(cert));
244}
245
246uschar *
247tls_cert_ext_by_oid(void * cert, uschar * oid, int idx)
248{
249uschar * cp1 = NULL;
250uschar * cp2;
251uschar * cp3;
252size_t siz = 0;
253unsigned int crit;
254int ret;
255
256ret = gnutls_x509_crt_get_extension_by_oid ((gnutls_x509_crt_t)cert,
48224640 257 CS oid, idx, CS cp1, &siz, &crit);
9d1c15ef 258if (ret != GNUTLS_E_SHORT_MEMORY_BUFFER)
8a6eec04 259 return g_err("ge0", __FUNCTION__, ret);
9d1c15ef
JH
260
261cp1 = store_get(siz*4 + 1);
262
263ret = gnutls_x509_crt_get_extension_by_oid ((gnutls_x509_crt_t)cert,
48224640 264 CS oid, idx, CS cp1, &siz, &crit);
9d1c15ef 265if (ret < 0)
8a6eec04 266 return g_err("ge1", __FUNCTION__, ret);
9d1c15ef
JH
267
268/* binary data, DER encoded */
269
270/* just dump for now */
5976eb99
JH
271for(cp3 = cp2 = cp1+siz; cp1 < cp2; cp1++)
272 cp3 += sprintf(CS cp3, "%.2x ", *cp1);
9d1c15ef
JH
273cp3[-1]= '\0';
274
275return cp2;
276}
277
278uschar *
9e4dddbd 279tls_cert_subject_altname(void * cert, uschar * mod)
9d1c15ef 280{
acec9514 281gstring * list = NULL;
9e4dddbd 282size_t siz;
9d1c15ef 283int ret;
9e4dddbd
JH
284uschar sep = '\n';
285uschar * tag = US"";
286uschar * ele;
287int match = -1;
9d1c15ef 288
9e4dddbd 289while (mod)
9d1c15ef 290 {
9e4dddbd
JH
291 if (*mod == '>' && *++mod) sep = *mod++;
292 else if (Ustrcmp(mod, "dns")==0) { match = GNUTLS_SAN_DNSNAME; mod += 3; }
293 else if (Ustrcmp(mod, "uri")==0) { match = GNUTLS_SAN_URI; mod += 3; }
294 else if (Ustrcmp(mod, "mail")==0) { match = GNUTLS_SAN_RFC822NAME; mod += 4; }
295 else continue;
296
297 if (*mod++ != ',')
9d1c15ef 298 break;
9d1c15ef
JH
299 }
300
d7978c0f 301for (int index = 0;; index++)
9d1c15ef 302 {
9e4dddbd
JH
303 siz = 0;
304 switch(ret = gnutls_x509_crt_get_subject_alt_name(
e51c7be2 305 (gnutls_x509_crt_t)cert, index, NULL, &siz, NULL))
9e4dddbd
JH
306 {
307 case GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE:
acec9514 308 return string_from_gstring(list); /* no more elements; normal exit */
9e4dddbd
JH
309
310 case GNUTLS_E_SHORT_MEMORY_BUFFER:
311 break;
312
313 default:
8a6eec04 314 return g_err("gs0", __FUNCTION__, ret);
9e4dddbd
JH
315 }
316
317 ele = store_get(siz+1);
318 if ((ret = gnutls_x509_crt_get_subject_alt_name(
319 (gnutls_x509_crt_t)cert, index, ele, &siz, NULL)) < 0)
8a6eec04 320 return g_err("gs1", __FUNCTION__, ret);
9e4dddbd
JH
321 ele[siz] = '\0';
322
e51c7be2
JH
323 if ( match != -1 && match != ret /* wrong type of SAN */
324 || Ustrlen(ele) != siz) /* contains a NUL */
9e4dddbd
JH
325 continue;
326 switch (ret)
327 {
328 case GNUTLS_SAN_DNSNAME: tag = US"DNS"; break;
94431adb 329 case GNUTLS_SAN_URI: tag = US"URI"; break;
9e4dddbd
JH
330 case GNUTLS_SAN_RFC822NAME: tag = US"MAIL"; break;
331 default: continue; /* ignore unrecognised types */
332 }
acec9514 333 list = string_append_listele(list, sep,
9e4dddbd 334 match == -1 ? string_sprintf("%s=%s", tag, ele) : ele);
9d1c15ef 335 }
9e4dddbd 336/*NOTREACHED*/
9d1c15ef
JH
337}
338
339uschar *
9e4dddbd 340tls_cert_ocsp_uri(void * cert, uschar * mod)
9d1c15ef
JH
341{
342#if GNUTLS_VERSION_NUMBER >= 0x030000
343gnutls_datum_t uri;
9e4dddbd
JH
344int ret;
345uschar sep = '\n';
acec9514 346gstring * list = NULL;
9e4dddbd
JH
347
348if (mod)
349 if (*mod == '>' && *++mod) sep = *mod++;
9d1c15ef 350
d7978c0f 351for (int index = 0;; index++)
9e4dddbd
JH
352 {
353 ret = gnutls_x509_crt_get_authority_info_access((gnutls_x509_crt_t)cert,
354 index, GNUTLS_IA_OCSP_URI, &uri, NULL);
9d1c15ef 355
9e4dddbd 356 if (ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
acec9514 357 return string_from_gstring(list);
9e4dddbd 358 if (ret < 0)
8a6eec04 359 return g_err("gai", __FUNCTION__, ret);
9d1c15ef 360
acec9514 361 list = string_append_listele_n(list, sep, uri.data, uri.size);
9e4dddbd
JH
362 }
363/*NOTREACHED*/
9d1c15ef
JH
364
365#else
366
94431adb 367expand_string_message =
9d1c15ef
JH
368 string_sprintf("%s: OCSP support with GnuTLS requires version 3.0.0\n",
369 __FUNCTION__);
370return NULL;
371
372#endif
373}
374
375uschar *
9e4dddbd 376tls_cert_crl_uri(void * cert, uschar * mod)
9d1c15ef
JH
377{
378int ret;
9e4dddbd 379uschar sep = '\n';
acec9514 380gstring * list = NULL;
9e4dddbd
JH
381uschar * ele;
382
383if (mod)
384 if (*mod == '>' && *++mod) sep = *mod++;
9d1c15ef 385
d7978c0f 386for (int index = 0;; index++)
9d1c15ef 387 {
d7978c0f 388 size_t siz = 0;
9e4dddbd
JH
389 switch(ret = gnutls_x509_crt_get_crl_dist_points(
390 (gnutls_x509_crt_t)cert, index, NULL, &siz, NULL, NULL))
391 {
392 case GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE:
acec9514 393 return string_from_gstring(list);
9e4dddbd
JH
394 case GNUTLS_E_SHORT_MEMORY_BUFFER:
395 break;
396 default:
8a6eec04 397 return g_err("gc0", __FUNCTION__, ret);
9e4dddbd
JH
398 }
399
4226691b 400 ele = store_get(siz);
9e4dddbd 401 if ((ret = gnutls_x509_crt_get_crl_dist_points(
8a6eec04
JH
402 (gnutls_x509_crt_t)cert, index, ele, &siz, NULL, NULL)) < 0)
403 return g_err("gc1", __FUNCTION__, ret);
404
acec9514 405 list = string_append_listele_n(list, sep, ele, siz);
9d1c15ef 406 }
9e4dddbd 407/*NOTREACHED*/
9d1c15ef
JH
408}
409
410
6a8a60e0
JH
411/*****************************************************
412* Certificate operator routines
413*****************************************************/
59b87190
JH
414uschar *
415tls_cert_der_b64(void * cert)
416{
417size_t len = 0;
418uschar * cp = NULL;
419int fail;
420
421if ( (fail = gnutls_x509_crt_export((gnutls_x509_crt_t)cert,
422 GNUTLS_X509_FMT_DER, cp, &len)) != GNUTLS_E_SHORT_MEMORY_BUFFER
423 || !(cp = store_get((int)len))
424 || (fail = gnutls_x509_crt_export((gnutls_x509_crt_t)cert,
425 GNUTLS_X509_FMT_DER, cp, &len))
426 )
427 {
428 log_write(0, LOG_MAIN, "TLS error in certificate export: %s",
429 gnutls_strerror(fail));
430 return NULL;
431 }
1f20760b 432return b64encode(CUS cp, (int)len);
59b87190
JH
433}
434
435
6a8a60e0
JH
436static uschar *
437fingerprint(gnutls_x509_crt_t cert, gnutls_digest_algorithm_t algo)
438{
439int ret;
440size_t siz = 0;
441uschar * cp;
442uschar * cp2;
6a8a60e0
JH
443
444if ((ret = gnutls_x509_crt_get_fingerprint(cert, algo, NULL, &siz))
445 != GNUTLS_E_SHORT_MEMORY_BUFFER)
8a6eec04
JH
446 return g_err("gf0", __FUNCTION__, ret);
447
6a8a60e0
JH
448cp = store_get(siz*3+1);
449if ((ret = gnutls_x509_crt_get_fingerprint(cert, algo, cp, &siz)) < 0)
8a6eec04
JH
450 return g_err("gf1", __FUNCTION__, ret);
451
d7978c0f 452for (uschar * cp3 = cp2 = cp+siz; cp < cp2; cp++)
5976eb99 453 cp3 += sprintf(CS cp3, "%02X", *cp);
6a8a60e0
JH
454return cp2;
455}
456
457
458uschar *
459tls_cert_fprt_md5(void * cert)
460{
461return fingerprint((gnutls_x509_crt_t)cert, GNUTLS_DIG_MD5);
462}
463
464uschar *
465tls_cert_fprt_sha1(void * cert)
466{
467return fingerprint((gnutls_x509_crt_t)cert, GNUTLS_DIG_SHA1);
468}
469
9ef9101c
JH
470uschar *
471tls_cert_fprt_sha256(void * cert)
472{
473return fingerprint((gnutls_x509_crt_t)cert, GNUTLS_DIG_SHA256);
474}
475
6a8a60e0 476
9d1c15ef
JH
477/* vi: aw ai sw=2
478*/
479/* End of tlscert-gnu.c */