Copyright updates:
[exim.git] / src / src / tls-gnu.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* Copyright (c) The Exim Maintainers 2020 */
7 /* See the file NOTICE for conditions of use and distribution. */
8
9 /* Copyright (c) Phil Pennock 2012 */
10
11 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
12 one of the available supported implementations. This file is #included into
13 tls.c when USE_GNUTLS has been set.
14
15 The code herein is a revamp of GnuTLS integration using the current APIs; the
16 original tls-gnu.c was based on a patch which was contributed by Nikos
17 Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
18 appropriate.
19
20 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
21 which is not widely deployed by OS vendors. Will note issues below, which may
22 assist in updating the code in the future. Another sources of hints is
23 mod_gnutls for Apache (SNI callback registration and handling).
24
25 Keeping client and server variables more split than before and is currently
26 the norm, in anticipation of TLS in ACL callouts.
27
28 I wanted to switch to gnutls_certificate_set_verify_function() so that
29 certificate rejection could happen during handshake where it belongs, rather
30 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
31 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
32
33 (I wasn't looking for libraries quite that old, when updating to get rid of
34 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
35 require current GnuTLS, then we'll drop support for the ancient libraries).
36 */
37
38 #include <gnutls/gnutls.h>
39 /* needed for cert checks in verification and DN extraction: */
40 #include <gnutls/x509.h>
41 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
42 #include <gnutls/crypto.h>
43
44 /* needed to disable PKCS11 autoload unless requested */
45 #if GNUTLS_VERSION_NUMBER >= 0x020c00
46 # include <gnutls/pkcs11.h>
47 # define SUPPORT_PARAM_TO_PK_BITS
48 #endif
49 #if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
50 # warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
51 # define DISABLE_OCSP
52 #endif
53 #if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
54 # warning "GnuTLS library version too old; tls:cert event unsupported"
55 # define DISABLE_EVENT
56 #endif
57 #if GNUTLS_VERSION_NUMBER >= 0x030000
58 # define SUPPORT_SELFSIGN /* Uncertain what version is first usable but 2.12.23 is not */
59 #endif
60 #if GNUTLS_VERSION_NUMBER >= 0x030306
61 # define SUPPORT_CA_DIR
62 #else
63 # undef SUPPORT_CA_DIR
64 #endif
65 #if GNUTLS_VERSION_NUMBER >= 0x030014
66 # define SUPPORT_SYSDEFAULT_CABUNDLE
67 #endif
68 #if GNUTLS_VERSION_NUMBER >= 0x030104
69 # define GNUTLS_CERT_VFY_STATUS_PRINT
70 #endif
71 #if GNUTLS_VERSION_NUMBER >= 0x030109
72 # define SUPPORT_CORK
73 #endif
74 #if GNUTLS_VERSION_NUMBER >= 0x03010a
75 # define SUPPORT_GNUTLS_SESS_DESC
76 #endif
77 #if GNUTLS_VERSION_NUMBER >= 0x030300
78 # define GNUTLS_AUTO_GLOBAL_INIT
79 # define GNUTLS_AUTO_PKCS11_MANUAL
80 #endif
81 #if (GNUTLS_VERSION_NUMBER >= 0x030404) \
82 || (GNUTLS_VERSION_NUMBER >= 0x030311) && (GNUTLS_VERSION_NUMBER & 0xffff00 == 0x030300)
83 # ifndef DISABLE_OCSP
84 # define EXIM_HAVE_OCSP
85 # endif
86 #endif
87 #if GNUTLS_VERSION_NUMBER >= 0x030500
88 # define SUPPORT_GNUTLS_KEYLOG
89 #endif
90 #if GNUTLS_VERSION_NUMBER >= 0x030506 && !defined(DISABLE_OCSP)
91 # define SUPPORT_SRV_OCSP_STACK
92 #endif
93 #if GNUTLS_VERSION_NUMBER >= 0x030600
94 # define GNUTLS_AUTO_DHPARAMS
95 #endif
96 #if GNUTLS_VERSION_NUMBER >= 0x030603
97 # define EXIM_HAVE_TLS1_3
98 # define SUPPORT_GNUTLS_EXT_RAW_PARSE
99 # define GNUTLS_OCSP_STATUS_REQUEST_GET2
100 #endif
101
102 #ifdef SUPPORT_DANE
103 # if GNUTLS_VERSION_NUMBER >= 0x030000
104 # define DANESSL_USAGE_DANE_TA 2
105 # define DANESSL_USAGE_DANE_EE 3
106 # else
107 # error GnuTLS version too early for DANE
108 # endif
109 # if GNUTLS_VERSION_NUMBER < 0x999999
110 # define GNUTLS_BROKEN_DANE_VALIDATION
111 # endif
112 #endif
113
114 #ifdef EXPERIMENTAL_TLS_RESUME
115 # if GNUTLS_VERSION_NUMBER < 0x030603
116 # error GNUTLS version too early for session-resumption
117 # endif
118 #endif
119
120 #ifndef DISABLE_OCSP
121 # include <gnutls/ocsp.h>
122 #endif
123 #ifdef SUPPORT_DANE
124 # include <gnutls/dane.h>
125 #endif
126
127 #include "tls-cipher-stdname.c"
128
129
130 #ifdef MACRO_PREDEF
131 void
132 options_tls(void)
133 {
134 # ifdef EXPERIMENTAL_TLS_RESUME
135 builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
136 # endif
137 # ifdef EXIM_HAVE_TLS1_3
138 builtin_macro_create(US"_HAVE_TLS1_3");
139 # endif
140 # ifdef EXIM_HAVE_OCSP
141 builtin_macro_create(US"_HAVE_TLS_OCSP");
142 # endif
143 # ifdef SUPPORT_SRV_OCSP_STACK
144 builtin_macro_create(US"_HAVE_TLS_OCSP_LIST");
145 # endif
146 }
147 #else
148
149
150 /* GnuTLS 2 vs 3
151
152 GnuTLS 3 only:
153 gnutls_global_set_audit_log_function()
154
155 Changes:
156 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
157 */
158
159 /* Local static variables for GnuTLS */
160
161 /* Values for verify_requirement */
162
163 enum peer_verify_requirement
164 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED, VERIFY_DANE };
165
166 /* This holds most state for server or client; with this, we can set up an
167 outbound TLS-enabled connection in an ACL callout, while not stomping all
168 over the TLS variables available for expansion.
169
170 Some of these correspond to variables in globals.c; those variables will
171 be set to point to content in one of these instances, as appropriate for
172 the stage of the process lifetime.
173
174 Not handled here: global tlsp->tls_channelbinding.
175 */
176
177 typedef struct exim_gnutls_state {
178 gnutls_session_t session;
179 gnutls_certificate_credentials_t x509_cred;
180 gnutls_priority_t priority_cache;
181 enum peer_verify_requirement verify_requirement;
182 int fd_in;
183 int fd_out;
184
185 BOOL peer_cert_verified:1;
186 BOOL peer_dane_verified:1;
187 BOOL trigger_sni_changes:1;
188 BOOL have_set_peerdn:1;
189 BOOL xfer_eof:1; /*XXX never gets set! */
190 BOOL xfer_error:1;
191 #ifdef SUPPORT_CORK
192 BOOL corked:1;
193 #endif
194
195 const struct host_item *host; /* NULL if server */
196 gnutls_x509_crt_t peercert;
197 uschar *peerdn;
198 uschar *ciphersuite;
199 uschar *received_sni;
200
201 const uschar *tls_certificate;
202 const uschar *tls_privatekey;
203 const uschar *tls_sni; /* client send only, not received */
204 const uschar *tls_verify_certificates;
205 const uschar *tls_crl;
206 const uschar *tls_require_ciphers;
207
208 uschar *exp_tls_certificate;
209 uschar *exp_tls_privatekey;
210 uschar *exp_tls_verify_certificates;
211 uschar *exp_tls_crl;
212 uschar *exp_tls_require_ciphers;
213 const uschar *exp_tls_verify_cert_hostnames;
214 #ifndef DISABLE_EVENT
215 uschar *event_action;
216 #endif
217 #ifdef SUPPORT_DANE
218 char * const * dane_data;
219 const int * dane_data_len;
220 #endif
221
222 tls_support *tlsp; /* set in tls_init() */
223
224 uschar *xfer_buffer;
225 int xfer_buffer_lwm;
226 int xfer_buffer_hwm;
227 } exim_gnutls_state_st;
228
229 static const exim_gnutls_state_st exim_gnutls_state_init = {
230 /* all elements not explicitly intialised here get 0/NULL/FALSE */
231 .fd_in = -1,
232 .fd_out = -1,
233 };
234
235 /* Not only do we have our own APIs which don't pass around state, assuming
236 it's held in globals, GnuTLS doesn't appear to let us register callback data
237 for callbacks, or as part of the session, so we have to keep a "this is the
238 context we're currently dealing with" pointer and rely upon being
239 single-threaded to keep from processing data on an inbound TLS connection while
240 talking to another TLS connection for an outbound check. This does mean that
241 there's no way for heart-beats to be responded to, for the duration of the
242 second connection.
243 XXX But see gnutls_session_get_ptr()
244 */
245
246 static exim_gnutls_state_st state_server;
247
248 #ifndef GNUTLS_AUTO_DHPARAMS
249 /* dh_params are initialised once within the lifetime of a process using TLS;
250 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
251 don't want to repeat this. */
252
253 static gnutls_dh_params_t dh_server_params = NULL;
254 #endif
255
256 static int ssl_session_timeout = 7200; /* Two hours */
257
258 static const uschar * const exim_default_gnutls_priority = US"NORMAL";
259
260 /* Guard library core initialisation */
261
262 static BOOL exim_gnutls_base_init_done = FALSE;
263
264 #ifndef DISABLE_OCSP
265 static BOOL gnutls_buggy_ocsp = FALSE;
266 static BOOL exim_testharness_disable_ocsp_validity_check = FALSE;
267 #endif
268
269 #ifdef EXPERIMENTAL_TLS_RESUME
270 static gnutls_datum_t server_sessticket_key;
271 #endif
272
273 /* ------------------------------------------------------------------------ */
274 /* macros */
275
276 #define MAX_HOST_LEN 255
277
278 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
279 the library logging; a value less than 0 disables the calls to set up logging
280 callbacks. GNuTLS also looks for an environment variable - except not for
281 setuid binaries, making it useless - "GNUTLS_DEBUG_LEVEL".
282 Allegedly the testscript line "GNUTLS_DEBUG_LEVEL=9 sudo exim ..." would work,
283 but the env var must be added to /etc/sudoers too. */
284 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
285 # define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
286 #endif
287
288 #ifndef EXIM_CLIENT_DH_MIN_BITS
289 # define EXIM_CLIENT_DH_MIN_BITS 1024
290 #endif
291
292 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
293 can ask for a bit-strength. Without that, we stick to the constant we had
294 before, for now. */
295 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
296 # define EXIM_SERVER_DH_BITS_PRE2_12 1024
297 #endif
298
299 #define expand_check_tlsvar(Varname, errstr) \
300 expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr)
301
302 #if GNUTLS_VERSION_NUMBER >= 0x020c00
303 # define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
304 # define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
305 # define HAVE_GNUTLS_RND
306 /* The security fix we provide with the gnutls_allow_auto_pkcs11 option
307 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
308 * isn't available sometimes, so this needs to become a conditional
309 * compilation; the sanest way to deal with this being a problem on
310 * older OSes is to block it in the Local/Makefile with this compiler
311 * definition */
312 # ifndef AVOID_GNUTLS_PKCS11
313 # define HAVE_GNUTLS_PKCS11
314 # endif /* AVOID_GNUTLS_PKCS11 */
315 #endif
316
317
318
319
320 /* ------------------------------------------------------------------------ */
321 /* Callback declarations */
322
323 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
324 static void exim_gnutls_logger_cb(int level, const char *message);
325 #endif
326
327 static int exim_sni_handling_cb(gnutls_session_t session);
328
329 #ifdef EXPERIMENTAL_TLS_RESUME
330 static int
331 tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
332 unsigned incoming, const gnutls_datum_t * msg);
333 #endif
334
335
336 /* Daemon one-time initialisation */
337 void
338 tls_daemon_init(void)
339 {
340 #ifdef EXPERIMENTAL_TLS_RESUME
341 /* We are dependent on the GnuTLS implementation of the Session Ticket
342 encryption; both the strength and the key rotation period. We hope that
343 the strength at least matches that of the ciphersuite (but GnuTLS does not
344 document this). */
345
346 static BOOL once = FALSE;
347 if (once) return;
348 once = TRUE;
349 gnutls_session_ticket_key_generate(&server_sessticket_key); /* >= 2.10.0 */
350 if (f.running_in_test_harness) ssl_session_timeout = 6;
351 #endif
352 }
353
354 /* ------------------------------------------------------------------------ */
355 /* Static functions */
356
357 /*************************************************
358 * Handle TLS error *
359 *************************************************/
360
361 /* Called from lots of places when errors occur before actually starting to do
362 the TLS handshake, that is, while the session is still in clear. Always returns
363 DEFER for a server and FAIL for a client so that most calls can use "return
364 tls_error(...)" to do this processing and then give an appropriate return. A
365 single function is used for both server and client, because it is called from
366 some shared functions.
367
368 Argument:
369 prefix text to include in the logged error
370 msg additional error string (may be NULL)
371 usually obtained from gnutls_strerror()
372 host NULL if setting up a server;
373 the connected host if setting up a client
374 errstr pointer to returned error string
375
376 Returns: OK/DEFER/FAIL
377 */
378
379 static int
380 tls_error(const uschar *prefix, const uschar *msg, const host_item *host,
381 uschar ** errstr)
382 {
383 if (errstr)
384 *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : US"");
385 return host ? FAIL : DEFER;
386 }
387
388
389 static int
390 tls_error_gnu(const uschar *prefix, int err, const host_item *host,
391 uschar ** errstr)
392 {
393 return tls_error(prefix, US gnutls_strerror(err), host, errstr);
394 }
395
396 static int
397 tls_error_sys(const uschar *prefix, int err, const host_item *host,
398 uschar ** errstr)
399 {
400 return tls_error(prefix, US strerror(err), host, errstr);
401 }
402
403
404 /*************************************************
405 * Deal with logging errors during I/O *
406 *************************************************/
407
408 /* We have to get the identity of the peer from saved data.
409
410 Argument:
411 state the current GnuTLS exim state container
412 rc the GnuTLS error code, or 0 if it's a local error
413 when text identifying read or write
414 text local error text when rc is 0
415
416 Returns: nothing
417 */
418
419 static void
420 record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
421 {
422 const uschar * msg;
423 uschar * errstr;
424
425 if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
426 msg = string_sprintf("A TLS fatal alert has been received: %s",
427 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
428 else
429 msg = US gnutls_strerror(rc);
430
431 (void) tls_error(when, msg, state->host, &errstr);
432
433 if (state->host)
434 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection %s",
435 state->host->name, state->host->address, errstr);
436 else
437 {
438 uschar * conn_info = smtp_get_connection_info();
439 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0) conn_info += 5;
440 /* I'd like to get separated H= here, but too hard for now */
441 log_write(0, LOG_MAIN, "TLS error on %s %s", conn_info, errstr);
442 }
443 }
444
445
446
447
448 /*************************************************
449 * Set various Exim expansion vars *
450 *************************************************/
451
452 #define exim_gnutls_cert_err(Label) \
453 do \
454 { \
455 if (rc != GNUTLS_E_SUCCESS) \
456 { \
457 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
458 (Label), gnutls_strerror(rc)); \
459 return rc; \
460 } \
461 } while (0)
462
463 static int
464 import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
465 {
466 int rc;
467
468 rc = gnutls_x509_crt_init(crtp);
469 exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
470
471 rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
472 exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
473
474 return rc;
475 }
476
477 #undef exim_gnutls_cert_err
478
479
480 /* We set various Exim global variables from the state, once a session has
481 been established. With TLS callouts, may need to change this to stack
482 variables, or just re-call it with the server state after client callout
483 has finished.
484
485 Make sure anything set here is unset in tls_getc().
486
487 Sets:
488 tls_active fd
489 tls_bits strength indicator
490 tls_certificate_verified bool indicator
491 tls_channelbinding for some SASL mechanisms
492 tls_ver a string
493 tls_cipher a string
494 tls_peercert pointer to library internal
495 tls_peerdn a string
496 tls_sni a (UTF-8) string
497 tls_ourcert pointer to library internal
498
499 Argument:
500 state the relevant exim_gnutls_state_st *
501 */
502
503 static void
504 extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
505 {
506 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
507 int old_pool;
508 int rc;
509 gnutls_datum_t channel;
510 #endif
511 tls_support * tlsp = state->tlsp;
512
513 tlsp->active.sock = state->fd_out;
514 tlsp->active.tls_ctx = state;
515
516 DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
517
518 tlsp->certificate_verified = state->peer_cert_verified;
519 #ifdef SUPPORT_DANE
520 tlsp->dane_verified = state->peer_dane_verified;
521 #endif
522
523 /* note that tls_channelbinding is not saved to the spool file, since it's
524 only available for use for authenticators while this TLS session is running. */
525
526 tlsp->channelbinding = NULL;
527 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
528 channel.data = NULL;
529 channel.size = 0;
530 if ((rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel)))
531 { DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc)); }
532 else
533 {
534 /* Declare the taintedness of the binding info. On server, untainted; on
535 client, tainted - being the Finish msg from the server. */
536
537 old_pool = store_pool;
538 store_pool = POOL_PERM;
539 tlsp->channelbinding = b64encode_taint(CUS channel.data, (int)channel.size,
540 !!state->host);
541 store_pool = old_pool;
542 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage\n");
543 }
544 #endif
545
546 /* peercert is set in peer_status() */
547 tlsp->peerdn = state->peerdn;
548 tlsp->sni = state->received_sni;
549
550 /* record our certificate */
551 {
552 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
553 gnutls_x509_crt_t crt;
554
555 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
556 }
557 }
558
559
560
561
562 #ifndef GNUTLS_AUTO_DHPARAMS
563 /*************************************************
564 * Setup up DH parameters *
565 *************************************************/
566
567 /* Generating the D-H parameters may take a long time. They only need to
568 be re-generated every so often, depending on security policy. What we do is to
569 keep these parameters in a file in the spool directory. If the file does not
570 exist, we generate them. This means that it is easy to cause a regeneration.
571
572 The new file is written as a temporary file and renamed, so that an incomplete
573 file is never present. If two processes both compute some new parameters, you
574 waste a bit of effort, but it doesn't seem worth messing around with locking to
575 prevent this.
576
577 Returns: OK/DEFER/FAIL
578 */
579
580 static int
581 init_server_dh(uschar ** errstr)
582 {
583 int fd, rc;
584 unsigned int dh_bits;
585 gnutls_datum_t m = {.data = NULL, .size = 0};
586 uschar filename_buf[PATH_MAX];
587 uschar *filename = NULL;
588 size_t sz;
589 uschar *exp_tls_dhparam;
590 BOOL use_file_in_spool = FALSE;
591 host_item *host = NULL; /* dummy for macros */
592
593 DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
594
595 if ((rc = gnutls_dh_params_init(&dh_server_params)))
596 return tls_error_gnu(US"gnutls_dh_params_init", rc, host, errstr);
597
598 if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam, errstr))
599 return DEFER;
600
601 if (!exp_tls_dhparam)
602 {
603 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
604 m.data = US std_dh_prime_default();
605 m.size = Ustrlen(m.data);
606 }
607 else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
608 use_file_in_spool = TRUE;
609 else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
610 {
611 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
612 return OK;
613 }
614 else if (exp_tls_dhparam[0] != '/')
615 {
616 if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
617 return tls_error(US"No standard prime named", exp_tls_dhparam, NULL, errstr);
618 m.size = Ustrlen(m.data);
619 }
620 else
621 filename = exp_tls_dhparam;
622
623 if (m.data)
624 {
625 if ((rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM)))
626 return tls_error_gnu(US"gnutls_dh_params_import_pkcs3", rc, host, errstr);
627 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
628 return OK;
629 }
630
631 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
632 /* If you change this constant, also change dh_param_fn_ext so that we can use a
633 different filename and ensure we have sufficient bits. */
634
635 if (!(dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL)))
636 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL, errstr);
637 DEBUG(D_tls)
638 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
639 dh_bits);
640 #else
641 dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
642 DEBUG(D_tls)
643 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
644 dh_bits);
645 #endif
646
647 /* Some clients have hard-coded limits. */
648 if (dh_bits > tls_dh_max_bits)
649 {
650 DEBUG(D_tls)
651 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
652 tls_dh_max_bits);
653 dh_bits = tls_dh_max_bits;
654 }
655
656 if (use_file_in_spool)
657 {
658 if (!string_format(filename_buf, sizeof(filename_buf),
659 "%s/gnutls-params-%d", spool_directory, dh_bits))
660 return tls_error(US"overlong filename", NULL, NULL, errstr);
661 filename = filename_buf;
662 }
663
664 /* Open the cache file for reading and if successful, read it and set up the
665 parameters. */
666
667 if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
668 {
669 struct stat statbuf;
670 FILE *fp;
671 int saved_errno;
672
673 if (fstat(fd, &statbuf) < 0) /* EIO */
674 {
675 saved_errno = errno;
676 (void)close(fd);
677 return tls_error_sys(US"TLS cache stat failed", saved_errno, NULL, errstr);
678 }
679 if (!S_ISREG(statbuf.st_mode))
680 {
681 (void)close(fd);
682 return tls_error(US"TLS cache not a file", NULL, NULL, errstr);
683 }
684 if (!(fp = fdopen(fd, "rb")))
685 {
686 saved_errno = errno;
687 (void)close(fd);
688 return tls_error_sys(US"fdopen(TLS cache stat fd) failed",
689 saved_errno, NULL, errstr);
690 }
691
692 m.size = statbuf.st_size;
693 if (!(m.data = store_malloc(m.size)))
694 {
695 fclose(fp);
696 return tls_error_sys(US"malloc failed", errno, NULL, errstr);
697 }
698 if (!(sz = fread(m.data, m.size, 1, fp)))
699 {
700 saved_errno = errno;
701 fclose(fp);
702 store_free(m.data);
703 return tls_error_sys(US"fread failed", saved_errno, NULL, errstr);
704 }
705 fclose(fp);
706
707 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
708 store_free(m.data);
709 if (rc)
710 return tls_error_gnu(US"gnutls_dh_params_import_pkcs3", rc, host, errstr);
711 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
712 }
713
714 /* If the file does not exist, fall through to compute new data and cache it.
715 If there was any other opening error, it is serious. */
716
717 else if (errno == ENOENT)
718 {
719 rc = -1;
720 DEBUG(D_tls)
721 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
722 }
723 else
724 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
725 NULL, NULL, errstr);
726
727 /* If ret < 0, either the cache file does not exist, or the data it contains
728 is not useful. One particular case of this is when upgrading from an older
729 release of Exim in which the data was stored in a different format. We don't
730 try to be clever and support both formats; we just regenerate new data in this
731 case. */
732
733 if (rc < 0)
734 {
735 uschar *temp_fn;
736 unsigned int dh_bits_gen = dh_bits;
737
738 if ((PATH_MAX - Ustrlen(filename)) < 10)
739 return tls_error(US"Filename too long to generate replacement",
740 filename, NULL, errstr);
741
742 temp_fn = string_copy(US"%s.XXXXXXX");
743 if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */
744 return tls_error_sys(US"Unable to open temp file", errno, NULL, errstr);
745 (void)exim_chown(temp_fn, exim_uid, exim_gid); /* Probably not necessary */
746
747 /* GnuTLS overshoots! If we ask for 2236, we might get 2237 or more. But
748 there's no way to ask GnuTLS how many bits there really are. We can ask
749 how many bits were used in a TLS session, but that's it! The prime itself
750 is hidden behind too much abstraction. So we ask for less, and proceed on
751 a wing and a prayer. First attempt, subtracted 3 for 2233 and got 2240. */
752
753 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
754 {
755 dh_bits_gen = dh_bits - 10;
756 DEBUG(D_tls)
757 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
758 dh_bits_gen);
759 }
760
761 DEBUG(D_tls)
762 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
763 dh_bits_gen);
764 if ((rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen)))
765 return tls_error_gnu(US"gnutls_dh_params_generate2", rc, host, errstr);
766
767 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
768 and I confirmed that a NULL call to get the size first is how the GnuTLS
769 sample apps handle this. */
770
771 sz = 0;
772 m.data = NULL;
773 if ( (rc = gnutls_dh_params_export_pkcs3(dh_server_params,
774 GNUTLS_X509_FMT_PEM, m.data, &sz))
775 && rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
776 return tls_error_gnu(US"gnutls_dh_params_export_pkcs3(NULL) sizing",
777 rc, host, errstr);
778 m.size = sz;
779 if (!(m.data = store_malloc(m.size)))
780 return tls_error_sys(US"memory allocation failed", errno, NULL, errstr);
781
782 /* this will return a size 1 less than the allocation size above */
783 if ((rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
784 m.data, &sz)))
785 {
786 store_free(m.data);
787 return tls_error_gnu(US"gnutls_dh_params_export_pkcs3() real", rc, host, errstr);
788 }
789 m.size = sz; /* shrink by 1, probably */
790
791 if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
792 {
793 store_free(m.data);
794 return tls_error_sys(US"TLS cache write D-H params failed",
795 errno, NULL, errstr);
796 }
797 store_free(m.data);
798 if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
799 return tls_error_sys(US"TLS cache write D-H params final newline failed",
800 errno, NULL, errstr);
801
802 if ((rc = close(fd)))
803 return tls_error_sys(US"TLS cache write close() failed", errno, NULL, errstr);
804
805 if (Urename(temp_fn, filename) < 0)
806 return tls_error_sys(string_sprintf("failed to rename \"%s\" as \"%s\"",
807 temp_fn, filename), errno, NULL, errstr);
808
809 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
810 }
811
812 DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
813 return OK;
814 }
815 #endif
816
817
818
819
820 /* Create and install a selfsigned certificate, for use in server mode */
821
822 static int
823 tls_install_selfsign(exim_gnutls_state_st * state, uschar ** errstr)
824 {
825 gnutls_x509_crt_t cert = NULL;
826 time_t now;
827 gnutls_x509_privkey_t pkey = NULL;
828 const uschar * where;
829 int rc;
830
831 #ifndef SUPPORT_SELFSIGN
832 where = US"library too old";
833 rc = GNUTLS_E_NO_CERTIFICATE_FOUND;
834 if (TRUE) goto err;
835 #endif
836
837 where = US"initialising pkey";
838 if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
839
840 where = US"initialising cert";
841 if ((rc = gnutls_x509_crt_init(&cert))) goto err;
842
843 where = US"generating pkey"; /* Hangs on 2.12.23 */
844 if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
845 #ifdef SUPPORT_PARAM_TO_PK_BITS
846 # ifndef GNUTLS_SEC_PARAM_MEDIUM
847 # define GNUTLS_SEC_PARAM_MEDIUM GNUTLS_SEC_PARAM_HIGH
848 # endif
849 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_MEDIUM),
850 #else
851 2048,
852 #endif
853 0)))
854 goto err;
855
856 where = US"configuring cert";
857 now = 1;
858 if ( (rc = gnutls_x509_crt_set_version(cert, 3))
859 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
860 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
861 || (rc = gnutls_x509_crt_set_expiration_time(cert, now + 60 * 60)) /* 1 hr */
862 || (rc = gnutls_x509_crt_set_key(cert, pkey))
863
864 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
865 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
866 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
867 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
868 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
869 GNUTLS_OID_X520_COMMON_NAME, 0,
870 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
871 )
872 goto err;
873
874 where = US"signing cert";
875 if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
876
877 where = US"installing selfsign cert";
878 /* Since: 2.4.0 */
879 if ((rc = gnutls_certificate_set_x509_key(state->x509_cred, &cert, 1, pkey)))
880 goto err;
881
882 rc = OK;
883
884 out:
885 if (cert) gnutls_x509_crt_deinit(cert);
886 if (pkey) gnutls_x509_privkey_deinit(pkey);
887 return rc;
888
889 err:
890 rc = tls_error_gnu(where, rc, NULL, errstr);
891 goto out;
892 }
893
894
895
896
897 /* Add certificate and key, from files.
898
899 Return:
900 Zero or negative: good. Negate value for certificate index if < 0.
901 Greater than zero: FAIL or DEFER code.
902 */
903
904 static int
905 tls_add_certfile(exim_gnutls_state_st * state, const host_item * host,
906 uschar * certfile, uschar * keyfile, uschar ** errstr)
907 {
908 int rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
909 CS certfile, CS keyfile, GNUTLS_X509_FMT_PEM);
910 if (rc < 0)
911 return tls_error_gnu(
912 string_sprintf("cert/key setup: cert=%s key=%s", certfile, keyfile),
913 rc, host, errstr);
914 return -rc;
915 }
916
917
918 #if !defined(DISABLE_OCSP) && !defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
919 /* Load an OCSP proof from file for sending by the server. Called
920 on getting a status-request handshake message, for earlier versions
921 of GnuTLS. */
922
923 static int
924 server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
925 gnutls_datum_t * ocsp_response)
926 {
927 int ret;
928 DEBUG(D_tls) debug_printf("OCSP stapling callback: %s\n", US ptr);
929
930 if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
931 {
932 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
933 CS ptr);
934 tls_in.ocsp = OCSP_NOT_RESP;
935 return GNUTLS_E_NO_CERTIFICATE_STATUS;
936 }
937
938 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
939 return 0;
940 }
941 #endif
942
943
944 #ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
945 /* Make a note that we saw a status-request */
946 static int
947 tls_server_clienthello_ext(void * ctx, unsigned tls_id,
948 const unsigned char *data, unsigned size)
949 {
950 /* https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
951 if (tls_id == 5) /* status_request */
952 {
953 DEBUG(D_tls) debug_printf("Seen status_request extension from client\n");
954 tls_in.ocsp = OCSP_NOT_RESP;
955 }
956 return 0;
957 }
958
959 /* Callback for client-hello, on server, if we think we might serve stapled-OCSP */
960 static int
961 tls_server_clienthello_cb(gnutls_session_t session, unsigned int htype,
962 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
963 {
964 /* Call fn for each extension seen. 3.6.3 onwards */
965 return gnutls_ext_raw_parse(NULL, tls_server_clienthello_ext, msg,
966 GNUTLS_EXT_RAW_FLAG_TLS_CLIENT_HELLO);
967 }
968
969
970 /* Make a note that we saw a status-response */
971 static int
972 tls_server_servercerts_ext(void * ctx, unsigned tls_id,
973 const unsigned char *data, unsigned size)
974 {
975 /* debug_printf("%s %u\n", __FUNCTION__, tls_id); */
976 /* https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
977 if (FALSE && tls_id == 5) /* status_request */
978 {
979 DEBUG(D_tls) debug_printf("Seen status_request extension\n");
980 tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
981 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
982 }
983 return 0;
984 }
985
986 /* Callback for certificates packet, on server, if we think we might serve stapled-OCSP */
987 static int
988 tls_server_servercerts_cb(gnutls_session_t session, unsigned int htype,
989 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
990 {
991 /* Call fn for each extension seen. 3.6.3 onwards */
992 #ifdef notdef
993 /*XXX crashes */
994 return gnutls_ext_raw_parse(NULL, tls_server_servercerts_ext, msg, 0);
995 #endif
996 }
997 #endif
998
999 /*XXX in tls1.3 the cert-status travel as an extension next to the cert, in the
1000 "Handshake Protocol: Certificate" record.
1001 So we need to spot the Certificate handshake message, parse it and spot any status_request extension(s)
1002
1003 This is different to tls1.2 - where it is a separate record (wireshake term) / handshake message (gnutls term).
1004 */
1005
1006 #if defined(EXPERIMENTAL_TLS_RESUME) || defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1007 /* Callback for certificate-status, on server. We sent stapled OCSP. */
1008 static int
1009 tls_server_certstatus_cb(gnutls_session_t session, unsigned int htype,
1010 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
1011 {
1012 DEBUG(D_tls) debug_printf("Sending certificate-status\n"); /*XXX we get this for tls1.2 but not for 1.3 */
1013 #ifdef SUPPORT_SRV_OCSP_STACK
1014 tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
1015 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
1016 #else
1017 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1018 #endif
1019 return 0;
1020 }
1021
1022 /* Callback for handshake messages, on server */
1023 static int
1024 tls_server_hook_cb(gnutls_session_t sess, u_int htype, unsigned when,
1025 unsigned incoming, const gnutls_datum_t * msg)
1026 {
1027 /* debug_printf("%s: htype %u\n", __FUNCTION__, htype); */
1028 switch (htype)
1029 {
1030 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1031 case GNUTLS_HANDSHAKE_CLIENT_HELLO:
1032 return tls_server_clienthello_cb(sess, htype, when, incoming, msg);
1033 case GNUTLS_HANDSHAKE_CERTIFICATE_PKT:
1034 return tls_server_servercerts_cb(sess, htype, when, incoming, msg);
1035 # endif
1036 case GNUTLS_HANDSHAKE_CERTIFICATE_STATUS:
1037 return tls_server_certstatus_cb(sess, htype, when, incoming, msg);
1038 # ifdef EXPERIMENTAL_TLS_RESUME
1039 case GNUTLS_HANDSHAKE_NEW_SESSION_TICKET:
1040 return tls_server_ticket_cb(sess, htype, when, incoming, msg);
1041 # endif
1042 default:
1043 return 0;
1044 }
1045 }
1046 #endif
1047
1048
1049 #if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1050 static void
1051 tls_server_testharness_ocsp_fiddle(void)
1052 {
1053 extern char ** environ;
1054 if (environ) for (uschar ** p = USS environ; *p; p++)
1055 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1056 {
1057 DEBUG(D_tls) debug_printf("Permitting known bad OCSP response\n");
1058 exim_testharness_disable_ocsp_validity_check = TRUE;
1059 }
1060 }
1061 #endif
1062
1063 /*************************************************
1064 * Variables re-expanded post-SNI *
1065 *************************************************/
1066
1067 /* Called from both server and client code, via tls_init(), and also from
1068 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
1069
1070 We can tell the two apart by state->received_sni being non-NULL in callback.
1071
1072 The callback should not call us unless state->trigger_sni_changes is true,
1073 which we are responsible for setting on the first pass through.
1074
1075 Arguments:
1076 state exim_gnutls_state_st *
1077 errstr error string pointer
1078
1079 Returns: OK/DEFER/FAIL
1080 */
1081
1082 static int
1083 tls_expand_session_files(exim_gnutls_state_st * state, uschar ** errstr)
1084 {
1085 struct stat statbuf;
1086 int rc;
1087 const host_item *host = state->host; /* macro should be reconsidered? */
1088 uschar *saved_tls_certificate = NULL;
1089 uschar *saved_tls_privatekey = NULL;
1090 uschar *saved_tls_verify_certificates = NULL;
1091 uschar *saved_tls_crl = NULL;
1092 int cert_count;
1093
1094 /* We check for tls_sni *before* expansion. */
1095 if (!host) /* server */
1096 if (!state->received_sni)
1097 {
1098 if ( state->tls_certificate
1099 && ( Ustrstr(state->tls_certificate, US"tls_sni")
1100 || Ustrstr(state->tls_certificate, US"tls_in_sni")
1101 || Ustrstr(state->tls_certificate, US"tls_out_sni")
1102 ) )
1103 {
1104 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
1105 state->trigger_sni_changes = TRUE;
1106 }
1107 }
1108 else
1109 {
1110 /* useful for debugging */
1111 saved_tls_certificate = state->exp_tls_certificate;
1112 saved_tls_privatekey = state->exp_tls_privatekey;
1113 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
1114 saved_tls_crl = state->exp_tls_crl;
1115 }
1116
1117 if ((rc = gnutls_certificate_allocate_credentials(&state->x509_cred)))
1118 return tls_error_gnu(US"gnutls_certificate_allocate_credentials",
1119 rc, host, errstr);
1120
1121 #ifdef SUPPORT_SRV_OCSP_STACK
1122 gnutls_certificate_set_flags(state->x509_cred, GNUTLS_CERTIFICATE_API_V2);
1123
1124 # if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1125 if (!host && tls_ocsp_file)
1126 {
1127 if (f.running_in_test_harness)
1128 tls_server_testharness_ocsp_fiddle();
1129
1130 if (exim_testharness_disable_ocsp_validity_check)
1131 gnutls_certificate_set_flags(state->x509_cred,
1132 GNUTLS_CERTIFICATE_API_V2 | GNUTLS_CERTIFICATE_SKIP_OCSP_RESPONSE_CHECK);
1133 }
1134 # endif
1135 #endif
1136
1137 /* remember: expand_check_tlsvar() is expand_check() but fiddling with
1138 state members, assuming consistent naming; and expand_check() returns
1139 false if expansion failed, unless expansion was forced to fail. */
1140
1141 /* check if we at least have a certificate, before doing expensive
1142 D-H generation. */
1143
1144 if (!expand_check_tlsvar(tls_certificate, errstr))
1145 return DEFER;
1146
1147 /* certificate is mandatory in server, optional in client */
1148
1149 if ( !state->exp_tls_certificate
1150 || !*state->exp_tls_certificate
1151 )
1152 if (!host)
1153 return tls_install_selfsign(state, errstr);
1154 else
1155 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
1156
1157 if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey, errstr))
1158 return DEFER;
1159
1160 /* tls_privatekey is optional, defaulting to same file as certificate */
1161
1162 if (!state->tls_privatekey || !*state->tls_privatekey)
1163 {
1164 state->tls_privatekey = state->tls_certificate;
1165 state->exp_tls_privatekey = state->exp_tls_certificate;
1166 }
1167
1168
1169 if (state->exp_tls_certificate && *state->exp_tls_certificate)
1170 {
1171 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
1172 state->exp_tls_certificate, state->exp_tls_privatekey);
1173
1174 if (state->received_sni)
1175 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
1176 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
1177 )
1178 {
1179 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
1180 }
1181 else
1182 {
1183 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
1184 }
1185
1186 if (!host) /* server */
1187 {
1188 const uschar * clist = state->exp_tls_certificate;
1189 const uschar * klist = state->exp_tls_privatekey;
1190 const uschar * olist;
1191 int csep = 0, ksep = 0, osep = 0, cnt = 0;
1192 uschar * cfile, * kfile, * ofile;
1193 #ifndef DISABLE_OCSP
1194 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1195 gnutls_x509_crt_fmt_t ocsp_fmt = GNUTLS_X509_FMT_DER;
1196 # endif
1197
1198 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file", &ofile, errstr))
1199 return DEFER;
1200 olist = ofile;
1201 #endif
1202
1203 while (cfile = string_nextinlist(&clist, &csep, NULL, 0))
1204
1205 if (!(kfile = string_nextinlist(&klist, &ksep, NULL, 0)))
1206 return tls_error(US"cert/key setup: out of keys", NULL, host, errstr);
1207 else if (0 < (rc = tls_add_certfile(state, host, cfile, kfile, errstr)))
1208 return rc;
1209 else
1210 {
1211 int gnutls_cert_index = -rc;
1212 DEBUG(D_tls) debug_printf("TLS: cert/key %d %s registered\n",
1213 gnutls_cert_index, cfile);
1214
1215 #ifndef DISABLE_OCSP
1216 if (tls_ocsp_file)
1217 {
1218 /* Set the OCSP stapling server info */
1219 if (gnutls_buggy_ocsp)
1220 {
1221 DEBUG(D_tls)
1222 debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
1223 }
1224 else if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1225 {
1226 DEBUG(D_tls) debug_printf("OCSP response file %d = %s\n",
1227 gnutls_cert_index, ofile);
1228 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1229 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
1230 {
1231 ocsp_fmt = GNUTLS_X509_FMT_PEM;
1232 ofile += 4;
1233 }
1234 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1235 {
1236 ocsp_fmt = GNUTLS_X509_FMT_DER;
1237 ofile += 4;
1238 }
1239
1240 if ((rc = gnutls_certificate_set_ocsp_status_request_file2(
1241 state->x509_cred, CCS ofile, gnutls_cert_index,
1242 ocsp_fmt)) < 0)
1243 return tls_error_gnu(
1244 US"gnutls_certificate_set_ocsp_status_request_file2",
1245 rc, host, errstr);
1246 DEBUG(D_tls)
1247 debug_printf(" %d response%s loaded\n", rc, rc>1 ? "s":"");
1248
1249 /* Arrange callbacks for OCSP request observability */
1250
1251 gnutls_handshake_set_hook_function(state->session,
1252 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
1253
1254 # else
1255 # if defined(SUPPORT_SRV_OCSP_STACK)
1256 if ((rc = gnutls_certificate_set_ocsp_status_request_function2(
1257 state->x509_cred, gnutls_cert_index,
1258 server_ocsp_stapling_cb, ofile)))
1259 return tls_error_gnu(
1260 US"gnutls_certificate_set_ocsp_status_request_function2",
1261 rc, host, errstr);
1262 else
1263 # endif
1264 {
1265 if (cnt++ > 0)
1266 {
1267 DEBUG(D_tls)
1268 debug_printf("oops; multiple OCSP files not supported\n");
1269 break;
1270 }
1271 gnutls_certificate_set_ocsp_status_request_function(
1272 state->x509_cred, server_ocsp_stapling_cb, ofile);
1273 }
1274 # endif /* SUPPORT_GNUTLS_EXT_RAW_PARSE */
1275 }
1276 else
1277 DEBUG(D_tls) debug_printf("ran out of OCSP response files in list\n");
1278 }
1279 #endif /* DISABLE_OCSP */
1280 }
1281 }
1282 else /* client */
1283 {
1284 if (0 < (rc = tls_add_certfile(state, host,
1285 state->exp_tls_certificate, state->exp_tls_privatekey, errstr)))
1286 return rc;
1287 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
1288 }
1289
1290 } /* tls_certificate */
1291
1292
1293 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
1294 provided. Experiment shows that, if the certificate file is empty, an unhelpful
1295 error message is provided. However, if we just refrain from setting anything up
1296 in that case, certificate verification fails, which seems to be the correct
1297 behaviour. */
1298
1299 if (state->tls_verify_certificates && *state->tls_verify_certificates)
1300 {
1301 if (!expand_check_tlsvar(tls_verify_certificates, errstr))
1302 return DEFER;
1303 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1304 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1305 state->exp_tls_verify_certificates = NULL;
1306 #endif
1307 if (state->tls_crl && *state->tls_crl)
1308 if (!expand_check_tlsvar(tls_crl, errstr))
1309 return DEFER;
1310
1311 if (!(state->exp_tls_verify_certificates &&
1312 *state->exp_tls_verify_certificates))
1313 {
1314 DEBUG(D_tls)
1315 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
1316 /* With no tls_verify_certificates, we ignore tls_crl too */
1317 return OK;
1318 }
1319 }
1320 else
1321 {
1322 DEBUG(D_tls)
1323 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
1324 return OK;
1325 }
1326
1327 #ifdef SUPPORT_SYSDEFAULT_CABUNDLE
1328 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1329 cert_count = gnutls_certificate_set_x509_system_trust(state->x509_cred);
1330 else
1331 #endif
1332 {
1333 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
1334 {
1335 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat '%s' "
1336 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
1337 strerror(errno));
1338 return DEFER;
1339 }
1340
1341 #ifndef SUPPORT_CA_DIR
1342 /* The test suite passes in /dev/null; we could check for that path explicitly,
1343 but who knows if someone has some weird FIFO which always dumps some certs, or
1344 other weirdness. The thing we really want to check is that it's not a
1345 directory, since while OpenSSL supports that, GnuTLS does not.
1346 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
1347 if (S_ISDIR(statbuf.st_mode))
1348 {
1349 DEBUG(D_tls)
1350 debug_printf("verify certificates path is a dir: \"%s\"\n",
1351 state->exp_tls_verify_certificates);
1352 log_write(0, LOG_MAIN|LOG_PANIC,
1353 "tls_verify_certificates \"%s\" is a directory",
1354 state->exp_tls_verify_certificates);
1355 return DEFER;
1356 }
1357 #endif
1358
1359 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
1360 state->exp_tls_verify_certificates, statbuf.st_size);
1361
1362 if (statbuf.st_size == 0)
1363 {
1364 DEBUG(D_tls)
1365 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
1366 return OK;
1367 }
1368
1369 cert_count =
1370
1371 #ifdef SUPPORT_CA_DIR
1372 (statbuf.st_mode & S_IFMT) == S_IFDIR
1373 ?
1374 gnutls_certificate_set_x509_trust_dir(state->x509_cred,
1375 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM)
1376 :
1377 #endif
1378 gnutls_certificate_set_x509_trust_file(state->x509_cred,
1379 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
1380
1381 #ifdef SUPPORT_CA_DIR
1382 /* Mimic the behaviour with OpenSSL of not advertising a usable-cert list
1383 when using the directory-of-certs config model. */
1384
1385 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1386 gnutls_certificate_send_x509_rdn_sequence(state->session, 1);
1387 #endif
1388 }
1389
1390 if (cert_count < 0)
1391 return tls_error_gnu(US"setting certificate trust", cert_count, host, errstr);
1392 DEBUG(D_tls)
1393 debug_printf("Added %d certificate authorities.\n", cert_count);
1394
1395 if (state->tls_crl && *state->tls_crl &&
1396 state->exp_tls_crl && *state->exp_tls_crl)
1397 {
1398 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
1399 if ((cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
1400 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM)) < 0)
1401 return tls_error_gnu(US"gnutls_certificate_set_x509_crl_file",
1402 cert_count, host, errstr);
1403
1404 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1405 }
1406
1407 return OK;
1408 }
1409
1410
1411
1412
1413 /*************************************************
1414 * Set X.509 state variables *
1415 *************************************************/
1416
1417 /* In GnuTLS, the registered cert/key are not replaced by a later
1418 set of a cert/key, so for SNI support we need a whole new x509_cred
1419 structure. Which means various other non-re-expanded pieces of state
1420 need to be re-set in the new struct, so the setting logic is pulled
1421 out to this.
1422
1423 Arguments:
1424 state exim_gnutls_state_st *
1425 errstr error string pointer
1426
1427 Returns: OK/DEFER/FAIL
1428 */
1429
1430 static int
1431 tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr)
1432 {
1433 int rc;
1434 const host_item *host = state->host; /* macro should be reconsidered? */
1435
1436 #ifndef GNUTLS_AUTO_DHPARAMS
1437 /* Create D-H parameters, or read them from the cache file. This function does
1438 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
1439 client-side params. */
1440
1441 if (!state->host)
1442 {
1443 if (!dh_server_params)
1444 if ((rc = init_server_dh(errstr)) != OK) return rc;
1445
1446 /* Unnecessary & discouraged with 3.6.0 or later */
1447 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
1448 }
1449 #endif
1450
1451 /* Link the credentials to the session. */
1452
1453 if ((rc = gnutls_credentials_set(state->session,
1454 GNUTLS_CRD_CERTIFICATE, state->x509_cred)))
1455 return tls_error_gnu(US"gnutls_credentials_set", rc, host, errstr);
1456
1457 return OK;
1458 }
1459
1460 /*************************************************
1461 * Initialize for GnuTLS *
1462 *************************************************/
1463
1464
1465 #ifndef DISABLE_OCSP
1466
1467 static BOOL
1468 tls_is_buggy_ocsp(void)
1469 {
1470 const uschar * s;
1471 uschar maj, mid, mic;
1472
1473 s = CUS gnutls_check_version(NULL);
1474 maj = atoi(CCS s);
1475 if (maj == 3)
1476 {
1477 while (*s && *s != '.') s++;
1478 mid = atoi(CCS ++s);
1479 if (mid <= 2)
1480 return TRUE;
1481 else if (mid >= 5)
1482 return FALSE;
1483 else
1484 {
1485 while (*s && *s != '.') s++;
1486 mic = atoi(CCS ++s);
1487 return mic <= (mid == 3 ? 16 : 3);
1488 }
1489 }
1490 return FALSE;
1491 }
1492
1493 #endif
1494
1495
1496 /* Called from both server and client code. In the case of a server, errors
1497 before actual TLS negotiation return DEFER.
1498
1499 Arguments:
1500 host connected host, if client; NULL if server
1501 certificate certificate file
1502 privatekey private key file
1503 sni TLS SNI to send, sometimes when client; else NULL
1504 cas CA certs file
1505 crl CRL file
1506 require_ciphers tls_require_ciphers setting
1507 caller_state returned state-info structure
1508 errstr error string pointer
1509
1510 Returns: OK/DEFER/FAIL
1511 */
1512
1513 static int
1514 tls_init(
1515 const host_item *host,
1516 const uschar *certificate,
1517 const uschar *privatekey,
1518 const uschar *sni,
1519 const uschar *cas,
1520 const uschar *crl,
1521 const uschar *require_ciphers,
1522 exim_gnutls_state_st **caller_state,
1523 tls_support * tlsp,
1524 uschar ** errstr)
1525 {
1526 exim_gnutls_state_st * state;
1527 int rc;
1528 size_t sz;
1529 const char * errpos;
1530 const uschar * p;
1531
1532 if (!exim_gnutls_base_init_done)
1533 {
1534 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1535
1536 #if defined(HAVE_GNUTLS_PKCS11) && !defined(GNUTLS_AUTO_PKCS11_MANUAL)
1537 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1538 which loads modules from a config file, which sounds good and may be wanted
1539 by some sysadmin, but also means in common configurations that GNOME keyring
1540 environment variables are used and so breaks for users calling mailq.
1541 To prevent this, we init PKCS11 first, which is the documented approach. */
1542 if (!gnutls_allow_auto_pkcs11)
1543 if ((rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL)))
1544 return tls_error_gnu(US"gnutls_pkcs11_init", rc, host, errstr);
1545 #endif
1546
1547 #ifndef GNUTLS_AUTO_GLOBAL_INIT
1548 if ((rc = gnutls_global_init()))
1549 return tls_error_gnu(US"gnutls_global_init", rc, host, errstr);
1550 #endif
1551
1552 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1553 DEBUG(D_tls)
1554 {
1555 gnutls_global_set_log_function(exim_gnutls_logger_cb);
1556 /* arbitrarily chosen level; bump up to 9 for more */
1557 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
1558 }
1559 #endif
1560
1561 #ifndef DISABLE_OCSP
1562 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
1563 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
1564 #endif
1565
1566 exim_gnutls_base_init_done = TRUE;
1567 }
1568
1569 if (host)
1570 {
1571 /* For client-side sessions we allocate a context. This lets us run
1572 several in parallel. */
1573 int old_pool = store_pool;
1574 store_pool = POOL_PERM;
1575 state = store_get(sizeof(exim_gnutls_state_st), FALSE);
1576 store_pool = old_pool;
1577
1578 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1579 state->tlsp = tlsp;
1580 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1581 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1582 }
1583 else
1584 {
1585 state = &state_server;
1586 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1587 state->tlsp = tlsp;
1588 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1589 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1590 }
1591 if (rc)
1592 return tls_error_gnu(US"gnutls_init", rc, host, errstr);
1593
1594 state->host = host;
1595
1596 state->tls_certificate = certificate;
1597 state->tls_privatekey = privatekey;
1598 state->tls_require_ciphers = require_ciphers;
1599 state->tls_sni = sni;
1600 state->tls_verify_certificates = cas;
1601 state->tls_crl = crl;
1602
1603 /* This handles the variables that might get re-expanded after TLS SNI;
1604 that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
1605
1606 DEBUG(D_tls)
1607 debug_printf("Expanding various TLS configuration options for session credentials.\n");
1608 if ((rc = tls_expand_session_files(state, errstr)) != OK) return rc;
1609
1610 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1611 requires a new structure afterwards. */
1612
1613 if ((rc = tls_set_remaining_x509(state, errstr)) != OK) return rc;
1614
1615 /* set SNI in client, only */
1616 if (host)
1617 {
1618 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni, errstr))
1619 return DEFER;
1620 if (state->tlsp->sni && *state->tlsp->sni)
1621 {
1622 DEBUG(D_tls)
1623 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1624 sz = Ustrlen(state->tlsp->sni);
1625 if ((rc = gnutls_server_name_set(state->session,
1626 GNUTLS_NAME_DNS, state->tlsp->sni, sz)))
1627 return tls_error_gnu(US"gnutls_server_name_set", rc, host, errstr);
1628 }
1629 }
1630 else if (state->tls_sni)
1631 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
1632 "have an SNI set for a server [%s]\n", state->tls_sni);
1633
1634 /* This is the priority string support,
1635 http://www.gnutls.org/manual/html_node/Priority-Strings.html
1636 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1637 This was backwards incompatible, but means Exim no longer needs to track
1638 all algorithms and provide string forms for them. */
1639
1640 p = NULL;
1641 if (state->tls_require_ciphers && *state->tls_require_ciphers)
1642 {
1643 if (!expand_check_tlsvar(tls_require_ciphers, errstr))
1644 return DEFER;
1645 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
1646 {
1647 p = state->exp_tls_require_ciphers;
1648 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n", p);
1649 }
1650 }
1651 if (!p)
1652 {
1653 p = exim_default_gnutls_priority;
1654 DEBUG(D_tls)
1655 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n", p);
1656 }
1657
1658 if ((rc = gnutls_priority_init(&state->priority_cache, CCS p, &errpos)))
1659 return tls_error_gnu(string_sprintf(
1660 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1661 p, errpos - CS p, errpos),
1662 rc, host, errstr);
1663
1664 if ((rc = gnutls_priority_set(state->session, state->priority_cache)))
1665 return tls_error_gnu(US"gnutls_priority_set", rc, host, errstr);
1666
1667 /* This also sets the server ticket expiration time to the same, and
1668 the STEK rotation time to 3x. */
1669
1670 gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1671
1672 /* Reduce security in favour of increased compatibility, if the admin
1673 decides to make that trade-off. */
1674 if (gnutls_compat_mode)
1675 {
1676 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1677 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1678 gnutls_session_enable_compatibility_mode(state->session);
1679 #else
1680 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1681 #endif
1682 }
1683
1684 *caller_state = state;
1685 return OK;
1686 }
1687
1688
1689
1690 /*************************************************
1691 * Extract peer information *
1692 *************************************************/
1693
1694 static const uschar *
1695 cipher_stdname_kcm(gnutls_kx_algorithm_t kx, gnutls_cipher_algorithm_t cipher,
1696 gnutls_mac_algorithm_t mac)
1697 {
1698 uschar cs_id[2];
1699 gnutls_kx_algorithm_t kx_i;
1700 gnutls_cipher_algorithm_t cipher_i;
1701 gnutls_mac_algorithm_t mac_i;
1702
1703 for (size_t i = 0;
1704 gnutls_cipher_suite_info(i, cs_id, &kx_i, &cipher_i, &mac_i, NULL);
1705 i++)
1706 if (kx_i == kx && cipher_i == cipher && mac_i == mac)
1707 return cipher_stdname(cs_id[0], cs_id[1]);
1708 return NULL;
1709 }
1710
1711
1712
1713 /* Called from both server and client code.
1714 Only this is allowed to set state->peerdn and state->have_set_peerdn
1715 and we use that to detect double-calls.
1716
1717 NOTE: the state blocks last while the TLS connection is up, which is fine
1718 for logging in the server side, but for the client side, we log after teardown
1719 in src/deliver.c. While the session is up, we can twist about states and
1720 repoint tls_* globals, but those variables used for logging or other variable
1721 expansion that happens _after_ delivery need to have a longer life-time.
1722
1723 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1724 doing this more than once per generation of a state context. We set them in
1725 the state context, and repoint tls_* to them. After the state goes away, the
1726 tls_* copies of the pointers remain valid and client delivery logging is happy.
1727
1728 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1729 don't apply.
1730
1731 Arguments:
1732 state exim_gnutls_state_st *
1733 errstr pointer to error string
1734
1735 Returns: OK/DEFER/FAIL
1736 */
1737
1738 static int
1739 peer_status(exim_gnutls_state_st * state, uschar ** errstr)
1740 {
1741 gnutls_session_t session = state->session;
1742 const gnutls_datum_t * cert_list;
1743 int old_pool, rc;
1744 unsigned int cert_list_size = 0;
1745 gnutls_protocol_t protocol;
1746 gnutls_cipher_algorithm_t cipher;
1747 gnutls_kx_algorithm_t kx;
1748 gnutls_mac_algorithm_t mac;
1749 gnutls_certificate_type_t ct;
1750 gnutls_x509_crt_t crt;
1751 uschar * dn_buf;
1752 size_t sz;
1753
1754 if (state->have_set_peerdn)
1755 return OK;
1756 state->have_set_peerdn = TRUE;
1757
1758 state->peerdn = NULL;
1759
1760 /* tls_cipher */
1761 cipher = gnutls_cipher_get(session);
1762 protocol = gnutls_protocol_get_version(session);
1763 mac = gnutls_mac_get(session);
1764 kx =
1765 #ifdef GNUTLS_TLS1_3
1766 protocol >= GNUTLS_TLS1_3 ? 0 :
1767 #endif
1768 gnutls_kx_get(session);
1769
1770 old_pool = store_pool;
1771 {
1772 tls_support * tlsp = state->tlsp;
1773 store_pool = POOL_PERM;
1774
1775 #ifdef SUPPORT_GNUTLS_SESS_DESC
1776 {
1777 gstring * g = NULL;
1778 uschar * s = US gnutls_session_get_desc(session), c;
1779
1780 /* Nikos M suggests we use this by preference. It returns like:
1781 (TLS1.3)-(ECDHE-SECP256R1)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM)
1782
1783 For partial back-compat, put a colon after the TLS version, replace the
1784 )-( grouping with __, replace in-group - with _ and append the :keysize. */
1785
1786 /* debug_printf("peer_status: gnutls_session_get_desc %s\n", s); */
1787
1788 for (s++; (c = *s) && c != ')'; s++) g = string_catn(g, s, 1);
1789
1790 tlsp->ver = string_copyn(g->s, g->ptr);
1791 for (uschar * p = US tlsp->ver; *p; p++)
1792 if (*p == '-') { *p = '\0'; break; } /* TLS1.0-PKIX -> TLS1.0 */
1793
1794 g = string_catn(g, US":", 1);
1795 if (*s) s++; /* now on _ between groups */
1796 while ((c = *s))
1797 {
1798 for (*++s && ++s; (c = *s) && c != ')'; s++)
1799 g = string_catn(g, c == '-' ? US"_" : s, 1);
1800 /* now on ) closing group */
1801 if ((c = *s) && *++s == '-') g = string_catn(g, US"__", 2);
1802 /* now on _ between groups */
1803 }
1804 g = string_catn(g, US":", 1);
1805 g = string_cat(g, string_sprintf("%d", (int) gnutls_cipher_get_key_size(cipher) * 8));
1806 state->ciphersuite = string_from_gstring(g);
1807 }
1808 #else
1809 state->ciphersuite = string_sprintf("%s:%s:%d",
1810 gnutls_protocol_get_name(protocol),
1811 gnutls_cipher_suite_get_name(kx, cipher, mac),
1812 (int) gnutls_cipher_get_key_size(cipher) * 8);
1813
1814 /* I don't see a way that spaces could occur, in the current GnuTLS
1815 code base, but it was a concern in the old code and perhaps older GnuTLS
1816 releases did return "TLS 1.0"; play it safe, just in case. */
1817
1818 for (uschar * p = state->ciphersuite; *p; p++) if (isspace(*p)) *p = '-';
1819 tlsp->ver = string_copyn(state->ciphersuite,
1820 Ustrchr(state->ciphersuite, ':') - state->ciphersuite);
1821 #endif
1822
1823 /* debug_printf("peer_status: ciphersuite %s\n", state->ciphersuite); */
1824
1825 tlsp->cipher = state->ciphersuite;
1826 tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
1827
1828 tlsp->cipher_stdname = cipher_stdname_kcm(kx, cipher, mac);
1829 }
1830 store_pool = old_pool;
1831
1832 /* tls_peerdn */
1833 cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
1834
1835 if (!cert_list || cert_list_size == 0)
1836 {
1837 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1838 cert_list, cert_list_size);
1839 if (state->verify_requirement >= VERIFY_REQUIRED)
1840 return tls_error(US"certificate verification failed",
1841 US"no certificate received from peer", state->host, errstr);
1842 return OK;
1843 }
1844
1845 if ((ct = gnutls_certificate_type_get(session)) != GNUTLS_CRT_X509)
1846 {
1847 const uschar * ctn = US gnutls_certificate_type_get_name(ct);
1848 DEBUG(D_tls)
1849 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
1850 if (state->verify_requirement >= VERIFY_REQUIRED)
1851 return tls_error(US"certificate verification not possible, unhandled type",
1852 ctn, state->host, errstr);
1853 return OK;
1854 }
1855
1856 #define exim_gnutls_peer_err(Label) \
1857 do { \
1858 if (rc != GNUTLS_E_SUCCESS) \
1859 { \
1860 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1861 (Label), gnutls_strerror(rc)); \
1862 if (state->verify_requirement >= VERIFY_REQUIRED) \
1863 return tls_error_gnu((Label), rc, state->host, errstr); \
1864 return OK; \
1865 } \
1866 } while (0)
1867
1868 rc = import_cert(&cert_list[0], &crt);
1869 exim_gnutls_peer_err(US"cert 0");
1870
1871 state->tlsp->peercert = state->peercert = crt;
1872
1873 sz = 0;
1874 rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1875 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
1876 {
1877 exim_gnutls_peer_err(US"getting size for cert DN failed");
1878 return FAIL; /* should not happen */
1879 }
1880 dn_buf = store_get_perm(sz, TRUE); /* tainted */
1881 rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1882 exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1883
1884 state->peerdn = dn_buf;
1885
1886 return OK;
1887 #undef exim_gnutls_peer_err
1888 }
1889
1890
1891
1892
1893 /*************************************************
1894 * Verify peer certificate *
1895 *************************************************/
1896
1897 /* Called from both server and client code.
1898 *Should* be using a callback registered with
1899 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1900 the peer information, but that's too new for some OSes.
1901
1902 Arguments:
1903 state exim_gnutls_state_st *
1904 errstr where to put an error message
1905
1906 Returns:
1907 FALSE if the session should be rejected
1908 TRUE if the cert is okay or we just don't care
1909 */
1910
1911 static BOOL
1912 verify_certificate(exim_gnutls_state_st * state, uschar ** errstr)
1913 {
1914 int rc;
1915 uint verify;
1916
1917 DEBUG(D_tls) debug_printf("TLS: checking peer certificate\n");
1918 *errstr = NULL;
1919 rc = peer_status(state, errstr);
1920
1921 if (state->verify_requirement == VERIFY_NONE)
1922 return TRUE;
1923
1924 if (rc != OK || !state->peerdn)
1925 {
1926 verify = GNUTLS_CERT_INVALID;
1927 *errstr = US"certificate not supplied";
1928 }
1929 else
1930
1931 {
1932 #ifdef SUPPORT_DANE
1933 if (state->verify_requirement == VERIFY_DANE && state->host)
1934 {
1935 /* Using dane_verify_session_crt() would be easy, as it does it all for us
1936 including talking to a DNS resolver. But we want to do that bit ourselves
1937 as the testsuite intercepts and fakes its own DNS environment. */
1938
1939 dane_state_t s;
1940 dane_query_t r;
1941 uint lsize;
1942 const gnutls_datum_t * certlist =
1943 gnutls_certificate_get_peers(state->session, &lsize);
1944 int usage = tls_out.tlsa_usage;
1945
1946 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
1947 /* Split the TLSA records into two sets, TA and EE selectors. Run the
1948 dane-verification separately so that we know which selector verified;
1949 then we know whether to do name-verification (needed for TA but not EE). */
1950
1951 if (usage == ((1<<DANESSL_USAGE_DANE_TA) | (1<<DANESSL_USAGE_DANE_EE)))
1952 { /* a mixed-usage bundle */
1953 int i, j, nrec;
1954 const char ** dd;
1955 int * ddl;
1956
1957 for (nrec = 0; state->dane_data_len[nrec]; ) nrec++;
1958 nrec++;
1959
1960 dd = store_get(nrec * sizeof(uschar *), FALSE);
1961 ddl = store_get(nrec * sizeof(int), FALSE);
1962 nrec--;
1963
1964 if ((rc = dane_state_init(&s, 0)))
1965 goto tlsa_prob;
1966
1967 for (usage = DANESSL_USAGE_DANE_EE;
1968 usage >= DANESSL_USAGE_DANE_TA; usage--)
1969 { /* take records with this usage */
1970 for (j = i = 0; i < nrec; i++)
1971 if (state->dane_data[i][0] == usage)
1972 {
1973 dd[j] = state->dane_data[i];
1974 ddl[j++] = state->dane_data_len[i];
1975 }
1976 if (j)
1977 {
1978 dd[j] = NULL;
1979 ddl[j] = 0;
1980
1981 if ((rc = dane_raw_tlsa(s, &r, (char * const *)dd, ddl, 1, 0)))
1982 goto tlsa_prob;
1983
1984 if ((rc = dane_verify_crt_raw(s, certlist, lsize,
1985 gnutls_certificate_type_get(state->session),
1986 r, 0,
1987 usage == DANESSL_USAGE_DANE_EE
1988 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1989 &verify)))
1990 {
1991 DEBUG(D_tls)
1992 debug_printf("TLSA record problem: %s\n", dane_strerror(rc));
1993 }
1994 else if (verify == 0) /* verification passed */
1995 {
1996 usage = 1 << usage;
1997 break;
1998 }
1999 }
2000 }
2001
2002 if (rc) goto tlsa_prob;
2003 }
2004 else
2005 # endif
2006 {
2007 if ( (rc = dane_state_init(&s, 0))
2008 || (rc = dane_raw_tlsa(s, &r, state->dane_data, state->dane_data_len,
2009 1, 0))
2010 || (rc = dane_verify_crt_raw(s, certlist, lsize,
2011 gnutls_certificate_type_get(state->session),
2012 r, 0,
2013 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2014 usage == (1 << DANESSL_USAGE_DANE_EE)
2015 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
2016 # else
2017 0,
2018 # endif
2019 &verify))
2020 )
2021 goto tlsa_prob;
2022 }
2023
2024 if (verify != 0) /* verification failed */
2025 {
2026 gnutls_datum_t str;
2027 (void) dane_verification_status_print(verify, &str, 0);
2028 *errstr = US str.data; /* don't bother to free */
2029 goto badcert;
2030 }
2031
2032 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2033 /* If a TA-mode TLSA record was used for verification we must additionally
2034 verify the cert name (but not the CA chain). For EE-mode, skip it. */
2035
2036 if (usage & (1 << DANESSL_USAGE_DANE_EE))
2037 # endif
2038 {
2039 state->peer_dane_verified = state->peer_cert_verified = TRUE;
2040 goto goodcert;
2041 }
2042 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2043 /* Assume that the name on the A-record is the one that should be matching
2044 the cert. An alternate view is that the domain part of the email address
2045 is also permissible. */
2046
2047 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert,
2048 CS state->host->name))
2049 {
2050 state->peer_dane_verified = state->peer_cert_verified = TRUE;
2051 goto goodcert;
2052 }
2053 # endif
2054 }
2055 #endif /*SUPPORT_DANE*/
2056
2057 rc = gnutls_certificate_verify_peers2(state->session, &verify);
2058 }
2059
2060 /* Handle the result of verification. INVALID is set if any others are. */
2061
2062 if (rc < 0 || verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED))
2063 {
2064 state->peer_cert_verified = FALSE;
2065 if (!*errstr)
2066 {
2067 #ifdef GNUTLS_CERT_VFY_STATUS_PRINT
2068 DEBUG(D_tls)
2069 {
2070 gnutls_datum_t txt;
2071
2072 if (gnutls_certificate_verification_status_print(verify,
2073 gnutls_certificate_type_get(state->session), &txt, 0)
2074 == GNUTLS_E_SUCCESS)
2075 {
2076 debug_printf("%s\n", txt.data);
2077 gnutls_free(txt.data);
2078 }
2079 }
2080 #endif
2081 *errstr = verify & GNUTLS_CERT_REVOKED
2082 ? US"certificate revoked" : US"certificate invalid";
2083 }
2084
2085 DEBUG(D_tls)
2086 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
2087 *errstr, state->peerdn ? state->peerdn : US"<unset>");
2088
2089 if (state->verify_requirement >= VERIFY_REQUIRED)
2090 goto badcert;
2091 DEBUG(D_tls)
2092 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
2093 }
2094
2095 else
2096 {
2097 /* Client side, check the server's certificate name versus the name on the
2098 A-record for the connection we made. What to do for server side - what name
2099 to use for client? We document that there is no such checking for server
2100 side. */
2101
2102 if ( state->exp_tls_verify_cert_hostnames
2103 && !gnutls_x509_crt_check_hostname(state->tlsp->peercert,
2104 CS state->exp_tls_verify_cert_hostnames)
2105 )
2106 {
2107 DEBUG(D_tls)
2108 debug_printf("TLS certificate verification failed: cert name mismatch\n");
2109 if (state->verify_requirement >= VERIFY_REQUIRED)
2110 goto badcert;
2111 return TRUE;
2112 }
2113
2114 state->peer_cert_verified = TRUE;
2115 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
2116 state->peerdn ? state->peerdn : US"<unset>");
2117 }
2118
2119 goodcert:
2120 state->tlsp->peerdn = state->peerdn;
2121 return TRUE;
2122
2123 #ifdef SUPPORT_DANE
2124 tlsa_prob:
2125 *errstr = string_sprintf("TLSA record problem: %s",
2126 rc == DANE_E_REQUESTED_DATA_NOT_AVAILABLE ? "none usable" : dane_strerror(rc));
2127 #endif
2128
2129 badcert:
2130 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
2131 return FALSE;
2132 }
2133
2134
2135
2136
2137 /* ------------------------------------------------------------------------ */
2138 /* Callbacks */
2139
2140 /* Logging function which can be registered with
2141 * gnutls_global_set_log_function()
2142 * gnutls_global_set_log_level() 0..9
2143 */
2144 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
2145 static void
2146 exim_gnutls_logger_cb(int level, const char *message)
2147 {
2148 size_t len = strlen(message);
2149 if (len < 1)
2150 {
2151 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
2152 return;
2153 }
2154 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
2155 message[len-1] == '\n' ? "" : "\n");
2156 }
2157 #endif
2158
2159
2160 /* Called after client hello, should handle SNI work.
2161 This will always set tls_sni (state->received_sni) if available,
2162 and may trigger presenting different certificates,
2163 if state->trigger_sni_changes is TRUE.
2164
2165 Should be registered with
2166 gnutls_handshake_set_post_client_hello_function()
2167
2168 "This callback must return 0 on success or a gnutls error code to terminate the
2169 handshake.".
2170
2171 For inability to get SNI information, we return 0.
2172 We only return non-zero if re-setup failed.
2173 Only used for server-side TLS.
2174 */
2175
2176 static int
2177 exim_sni_handling_cb(gnutls_session_t session)
2178 {
2179 char sni_name[MAX_HOST_LEN];
2180 size_t data_len = MAX_HOST_LEN;
2181 exim_gnutls_state_st *state = &state_server;
2182 unsigned int sni_type;
2183 int rc, old_pool;
2184 uschar * dummy_errstr;
2185
2186 rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
2187 if (rc != GNUTLS_E_SUCCESS)
2188 {
2189 DEBUG(D_tls)
2190 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
2191 debug_printf("TLS: no SNI presented in handshake.\n");
2192 else
2193 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
2194 gnutls_strerror(rc), rc);
2195 return 0;
2196 }
2197
2198 if (sni_type != GNUTLS_NAME_DNS)
2199 {
2200 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
2201 return 0;
2202 }
2203
2204 /* We now have a UTF-8 string in sni_name */
2205 old_pool = store_pool;
2206 store_pool = POOL_PERM;
2207 state->received_sni = string_copy_taint(US sni_name, TRUE);
2208 store_pool = old_pool;
2209
2210 /* We set this one now so that variable expansions below will work */
2211 state->tlsp->sni = state->received_sni;
2212
2213 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
2214 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
2215
2216 if (!state->trigger_sni_changes)
2217 return 0;
2218
2219 if ((rc = tls_expand_session_files(state, &dummy_errstr)) != OK)
2220 {
2221 /* If the setup of certs/etc failed before handshake, TLS would not have
2222 been offered. The best we can do now is abort. */
2223 return GNUTLS_E_APPLICATION_ERROR_MIN;
2224 }
2225
2226 rc = tls_set_remaining_x509(state, &dummy_errstr);
2227 if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
2228
2229 return 0;
2230 }
2231
2232
2233
2234 #ifndef DISABLE_EVENT
2235 /*
2236 We use this callback to get observability and detail-level control
2237 for an exim TLS connection (either direction), raising a tls:cert event
2238 for each cert in the chain presented by the peer. Any event
2239 can deny verification.
2240
2241 Return 0 for the handshake to continue or non-zero to terminate.
2242 */
2243
2244 static int
2245 verify_cb(gnutls_session_t session)
2246 {
2247 const gnutls_datum_t * cert_list;
2248 unsigned int cert_list_size = 0;
2249 gnutls_x509_crt_t crt;
2250 int rc;
2251 uschar * yield;
2252 exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
2253
2254 if ((cert_list = gnutls_certificate_get_peers(session, &cert_list_size)))
2255 while (cert_list_size--)
2256 {
2257 if ((rc = import_cert(&cert_list[cert_list_size], &crt)) != GNUTLS_E_SUCCESS)
2258 {
2259 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
2260 cert_list_size, gnutls_strerror(rc));
2261 break;
2262 }
2263
2264 state->tlsp->peercert = crt;
2265 if ((yield = event_raise(state->event_action,
2266 US"tls:cert", string_sprintf("%d", cert_list_size))))
2267 {
2268 log_write(0, LOG_MAIN,
2269 "SSL verify denied by event-action: depth=%d: %s",
2270 cert_list_size, yield);
2271 return 1; /* reject */
2272 }
2273 state->tlsp->peercert = NULL;
2274 }
2275
2276 return 0;
2277 }
2278
2279 #endif
2280
2281
2282 static gstring *
2283 ddump(gnutls_datum_t * d)
2284 {
2285 gstring * g = string_get((d->size+1) * 2);
2286 uschar * s = d->data;
2287 for (unsigned i = d->size; i > 0; i--, s++)
2288 {
2289 g = string_catn(g, US "0123456789abcdef" + (*s >> 4), 1);
2290 g = string_catn(g, US "0123456789abcdef" + (*s & 0xf), 1);
2291 }
2292 return g;
2293 }
2294
2295 static void
2296 post_handshake_debug(exim_gnutls_state_st * state)
2297 {
2298 #ifdef SUPPORT_GNUTLS_SESS_DESC
2299 debug_printf("%s\n", gnutls_session_get_desc(state->session));
2300 #endif
2301
2302 #ifdef SUPPORT_GNUTLS_KEYLOG
2303 # ifdef EXIM_HAVE_TLS1_3
2304 if (gnutls_protocol_get_version(state->session) < GNUTLS_TLS1_3)
2305 # else
2306 if (TRUE)
2307 # endif
2308 {
2309 gnutls_datum_t c, s;
2310 gstring * gc, * gs;
2311 /* For TLS1.2 we only want the client random and the master secret */
2312 gnutls_session_get_random(state->session, &c, &s);
2313 gnutls_session_get_master_secret(state->session, &s);
2314 gc = ddump(&c);
2315 gs = ddump(&s);
2316 debug_printf("CLIENT_RANDOM %.*s %.*s\n", (int)gc->ptr, gc->s, (int)gs->ptr, gs->s);
2317 }
2318 else
2319 debug_printf("To get keying info for TLS1.3 is hard:\n"
2320 " Set environment variable SSLKEYLOGFILE to a filename relative to the spool directory,\n"
2321 " and make sure it is writable by the Exim runtime user.\n"
2322 " Add SSLKEYLOGFILE to keep_environment in the exim config.\n"
2323 " Start Exim as root.\n"
2324 " If using sudo, add SSLKEYLOGFILE to env_keep in /etc/sudoers\n"
2325 " (works for TLS1.2 also, and saves cut-paste into file).\n"
2326 " Trying to use add_environment for this will not work\n");
2327 #endif
2328 }
2329
2330
2331 #ifdef EXPERIMENTAL_TLS_RESUME
2332 static int
2333 tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
2334 unsigned incoming, const gnutls_datum_t * msg)
2335 {
2336 DEBUG(D_tls) debug_printf("newticket cb\n");
2337 tls_in.resumption |= RESUME_CLIENT_REQUESTED;
2338 return 0;
2339 }
2340
2341 static void
2342 tls_server_resume_prehandshake(exim_gnutls_state_st * state)
2343 {
2344 /* Should the server offer session resumption? */
2345 tls_in.resumption = RESUME_SUPPORTED;
2346 if (verify_check_host(&tls_resumption_hosts) == OK)
2347 {
2348 int rc;
2349 /* GnuTLS appears to not do ticket overlap, but does emit a fresh ticket when
2350 an offered resumption is unacceptable. We lose one resumption per ticket
2351 lifetime, and sessions cannot be indefinitely re-used. There seems to be no
2352 way (3.6.7) of changing the default number of 2 TLS1.3 tickets issued, but at
2353 least they go out in a single packet. */
2354
2355 if (!(rc = gnutls_session_ticket_enable_server(state->session,
2356 &server_sessticket_key)))
2357 tls_in.resumption |= RESUME_SERVER_TICKET;
2358 else
2359 DEBUG(D_tls)
2360 debug_printf("enabling session tickets: %s\n", US gnutls_strerror(rc));
2361
2362 /* Try to tell if we see a ticket request */
2363 gnutls_handshake_set_hook_function(state->session,
2364 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
2365 }
2366 }
2367
2368 static void
2369 tls_server_resume_posthandshake(exim_gnutls_state_st * state)
2370 {
2371 if (gnutls_session_resumption_requested(state->session))
2372 {
2373 /* This tells us the client sent a full ticket. We use a
2374 callback on session-ticket request, elsewhere, to tell
2375 if a client asked for a ticket. */
2376
2377 tls_in.resumption |= RESUME_CLIENT_SUGGESTED;
2378 DEBUG(D_tls) debug_printf("client requested resumption\n");
2379 }
2380 if (gnutls_session_is_resumed(state->session))
2381 {
2382 tls_in.resumption |= RESUME_USED;
2383 DEBUG(D_tls) debug_printf("Session resumed\n");
2384 }
2385 }
2386 #endif
2387 /* ------------------------------------------------------------------------ */
2388 /* Exported functions */
2389
2390
2391
2392
2393 /*************************************************
2394 * Start a TLS session in a server *
2395 *************************************************/
2396
2397 /* This is called when Exim is running as a server, after having received
2398 the STARTTLS command. It must respond to that command, and then negotiate
2399 a TLS session.
2400
2401 Arguments:
2402 require_ciphers list of allowed ciphers or NULL
2403 errstr pointer to error string
2404
2405 Returns: OK on success
2406 DEFER for errors before the start of the negotiation
2407 FAIL for errors during the negotiation; the server can't
2408 continue running.
2409 */
2410
2411 int
2412 tls_server_start(const uschar * require_ciphers, uschar ** errstr)
2413 {
2414 int rc;
2415 exim_gnutls_state_st * state = NULL;
2416
2417 /* Check for previous activation */
2418 if (tls_in.active.sock >= 0)
2419 {
2420 tls_error(US"STARTTLS received after TLS started", US "", NULL, errstr);
2421 smtp_printf("554 Already in TLS\r\n", FALSE);
2422 return FAIL;
2423 }
2424
2425 /* Initialize the library. If it fails, it will already have logged the error
2426 and sent an SMTP response. */
2427
2428 DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
2429
2430 {
2431 #ifdef MEASURE_TIMING
2432 struct timeval t0;
2433 gettimeofday(&t0, NULL);
2434 #endif
2435
2436 if ((rc = tls_init(NULL, tls_certificate, tls_privatekey,
2437 NULL, tls_verify_certificates, tls_crl,
2438 require_ciphers, &state, &tls_in, errstr)) != OK) return rc;
2439
2440 #ifdef MEASURE_TIMING
2441 report_time_since(&t0, US"server tls_init (delta)");
2442 #endif
2443 }
2444
2445 #ifdef EXPERIMENTAL_TLS_RESUME
2446 tls_server_resume_prehandshake(state);
2447 #endif
2448
2449 /* If this is a host for which certificate verification is mandatory or
2450 optional, set up appropriately. */
2451
2452 if (verify_check_host(&tls_verify_hosts) == OK)
2453 {
2454 DEBUG(D_tls)
2455 debug_printf("TLS: a client certificate will be required.\n");
2456 state->verify_requirement = VERIFY_REQUIRED;
2457 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2458 }
2459 else if (verify_check_host(&tls_try_verify_hosts) == OK)
2460 {
2461 DEBUG(D_tls)
2462 debug_printf("TLS: a client certificate will be requested but not required.\n");
2463 state->verify_requirement = VERIFY_OPTIONAL;
2464 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2465 }
2466 else
2467 {
2468 DEBUG(D_tls)
2469 debug_printf("TLS: a client certificate will not be requested.\n");
2470 state->verify_requirement = VERIFY_NONE;
2471 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2472 }
2473
2474 #ifndef DISABLE_EVENT
2475 if (event_action)
2476 {
2477 state->event_action = event_action;
2478 gnutls_session_set_ptr(state->session, state);
2479 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2480 }
2481 #endif
2482
2483 /* Register SNI handling; always, even if not in tls_certificate, so that the
2484 expansion variable $tls_sni is always available. */
2485
2486 gnutls_handshake_set_post_client_hello_function(state->session,
2487 exim_sni_handling_cb);
2488
2489 /* Set context and tell client to go ahead, except in the case of TLS startup
2490 on connection, where outputting anything now upsets the clients and tends to
2491 make them disconnect. We need to have an explicit fflush() here, to force out
2492 the response. Other smtp_printf() calls do not need it, because in non-TLS
2493 mode, the fflush() happens when smtp_getc() is called. */
2494
2495 if (!state->tlsp->on_connect)
2496 {
2497 smtp_printf("220 TLS go ahead\r\n", FALSE);
2498 fflush(smtp_out);
2499 }
2500
2501 /* Now negotiate the TLS session. We put our own timer on it, since it seems
2502 that the GnuTLS library doesn't.
2503 From 3.1.0 there is gnutls_handshake_set_timeout() - but it requires you
2504 to set (and clear down afterwards) up a pull-timeout callback function that does
2505 a select, so we're no better off unless avoiding signals becomes an issue. */
2506
2507 gnutls_transport_set_ptr2(state->session,
2508 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
2509 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
2510 state->fd_in = fileno(smtp_in);
2511 state->fd_out = fileno(smtp_out);
2512
2513 sigalrm_seen = FALSE;
2514 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
2515 do
2516 rc = gnutls_handshake(state->session);
2517 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
2518 ALARM_CLR(0);
2519
2520 if (rc != GNUTLS_E_SUCCESS)
2521 {
2522 /* It seems that, except in the case of a timeout, we have to close the
2523 connection right here; otherwise if the other end is running OpenSSL it hangs
2524 until the server times out. */
2525
2526 if (sigalrm_seen)
2527 {
2528 tls_error(US"gnutls_handshake", US"timed out", NULL, errstr);
2529 gnutls_db_remove_session(state->session);
2530 }
2531 else
2532 {
2533 tls_error_gnu(US"gnutls_handshake", rc, NULL, errstr);
2534 (void) gnutls_alert_send_appropriate(state->session, rc);
2535 gnutls_deinit(state->session);
2536 gnutls_certificate_free_credentials(state->x509_cred);
2537 millisleep(500);
2538 shutdown(state->fd_out, SHUT_WR);
2539 for (int i = 1024; fgetc(smtp_in) != EOF && i > 0; ) i--; /* drain skt */
2540 (void)fclose(smtp_out);
2541 (void)fclose(smtp_in);
2542 smtp_out = smtp_in = NULL;
2543 }
2544
2545 return FAIL;
2546 }
2547
2548 #ifdef GNUTLS_SFLAGS_EXT_MASTER_SECRET
2549 if (gnutls_session_get_flags(state->session) & GNUTLS_SFLAGS_EXT_MASTER_SECRET)
2550 tls_in.ext_master_secret = TRUE;
2551 #endif
2552
2553 #ifdef EXPERIMENTAL_TLS_RESUME
2554 tls_server_resume_posthandshake(state);
2555 #endif
2556
2557 DEBUG(D_tls) post_handshake_debug(state);
2558
2559 /* Verify after the fact */
2560
2561 if (!verify_certificate(state, errstr))
2562 {
2563 if (state->verify_requirement != VERIFY_OPTIONAL)
2564 {
2565 (void) tls_error(US"certificate verification failed", *errstr, NULL, errstr);
2566 return FAIL;
2567 }
2568 DEBUG(D_tls)
2569 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
2570 *errstr);
2571 }
2572
2573 /* Sets various Exim expansion variables; always safe within server */
2574
2575 extract_exim_vars_from_tls_state(state);
2576
2577 /* TLS has been set up. Adjust the input functions to read via TLS,
2578 and initialize appropriately. */
2579
2580 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
2581
2582 receive_getc = tls_getc;
2583 receive_getbuf = tls_getbuf;
2584 receive_get_cache = tls_get_cache;
2585 receive_ungetc = tls_ungetc;
2586 receive_feof = tls_feof;
2587 receive_ferror = tls_ferror;
2588 receive_smtp_buffered = tls_smtp_buffered;
2589
2590 return OK;
2591 }
2592
2593
2594
2595
2596 static void
2597 tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
2598 smtp_transport_options_block * ob)
2599 {
2600 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
2601 {
2602 state->exp_tls_verify_cert_hostnames =
2603 #ifdef SUPPORT_I18N
2604 string_domain_utf8_to_alabel(host->name, NULL);
2605 #else
2606 host->name;
2607 #endif
2608 DEBUG(D_tls)
2609 debug_printf("TLS: server cert verification includes hostname: \"%s\".\n",
2610 state->exp_tls_verify_cert_hostnames);
2611 }
2612 }
2613
2614
2615
2616
2617 #ifdef SUPPORT_DANE
2618 /* Given our list of RRs from the TLSA lookup, build a lookup block in
2619 GnuTLS-DANE's preferred format. Hang it on the state str for later
2620 use in DANE verification.
2621
2622 We point at the dnsa data not copy it, so it must remain valid until
2623 after verification is done.*/
2624
2625 static BOOL
2626 dane_tlsa_load(exim_gnutls_state_st * state, dns_answer * dnsa)
2627 {
2628 dns_scan dnss;
2629 int i;
2630 const char ** dane_data;
2631 int * dane_data_len;
2632
2633 i = 1;
2634 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
2635 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2636 ) if (rr->type == T_TLSA) i++;
2637
2638 dane_data = store_get(i * sizeof(uschar *), FALSE);
2639 dane_data_len = store_get(i * sizeof(int), FALSE);
2640
2641 i = 0;
2642 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
2643 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2644 ) if (rr->type == T_TLSA && rr->size > 3)
2645 {
2646 const uschar * p = rr->data;
2647 /*XXX need somehow to mark rr and its data as tainted. Doues this mean copying it? */
2648 uint8_t usage = p[0], sel = p[1], type = p[2];
2649
2650 DEBUG(D_tls)
2651 debug_printf("TLSA: %d %d %d size %d\n", usage, sel, type, rr->size);
2652
2653 if ( (usage != DANESSL_USAGE_DANE_TA && usage != DANESSL_USAGE_DANE_EE)
2654 || (sel != 0 && sel != 1)
2655 )
2656 continue;
2657 switch(type)
2658 {
2659 case 0: /* Full: cannot check at present */
2660 break;
2661 case 1: if (rr->size != 3 + 256/8) continue; /* sha2-256 */
2662 break;
2663 case 2: if (rr->size != 3 + 512/8) continue; /* sha2-512 */
2664 break;
2665 default: continue;
2666 }
2667
2668 tls_out.tlsa_usage |= 1<<usage;
2669 dane_data[i] = CS p;
2670 dane_data_len[i++] = rr->size;
2671 }
2672
2673 if (!i) return FALSE;
2674
2675 dane_data[i] = NULL;
2676 dane_data_len[i] = 0;
2677
2678 state->dane_data = (char * const *)dane_data;
2679 state->dane_data_len = dane_data_len;
2680 return TRUE;
2681 }
2682 #endif
2683
2684
2685
2686 #ifdef EXPERIMENTAL_TLS_RESUME
2687 /* On the client, get any stashed session for the given IP from hints db
2688 and apply it to the ssl-connection for attempted resumption. Although
2689 there is a gnutls_session_ticket_enable_client() interface it is
2690 documented as unnecessary (as of 3.6.7) as "session tickets are emabled
2691 by deafult". There seems to be no way to disable them, so even hosts not
2692 enabled by the transport option will be sent a ticket request. We will
2693 however avoid storing and retrieving session information. */
2694
2695 static void
2696 tls_retrieve_session(tls_support * tlsp, gnutls_session_t session,
2697 host_item * host, smtp_transport_options_block * ob)
2698 {
2699 tlsp->resumption = RESUME_SUPPORTED;
2700 if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
2701 {
2702 dbdata_tls_session * dt;
2703 int len, rc;
2704 open_db dbblock, * dbm_file;
2705
2706 DEBUG(D_tls)
2707 debug_printf("check for resumable session for %s\n", host->address);
2708 tlsp->host_resumable = TRUE;
2709 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
2710 if ((dbm_file = dbfn_open(US"tls", O_RDONLY, &dbblock, FALSE, FALSE)))
2711 {
2712 /* Key for the db is the IP. We'd like to filter the retrieved session
2713 for ticket advisory expiry, but 3.6.1 seems to give no access to that */
2714
2715 if ((dt = dbfn_read_with_length(dbm_file, host->address, &len)))
2716 if (!(rc = gnutls_session_set_data(session,
2717 CUS dt->session, (size_t)len - sizeof(dbdata_tls_session))))
2718 {
2719 DEBUG(D_tls) debug_printf("good session\n");
2720 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
2721 }
2722 else DEBUG(D_tls) debug_printf("setting session resumption data: %s\n",
2723 US gnutls_strerror(rc));
2724 dbfn_close(dbm_file);
2725 }
2726 }
2727 }
2728
2729
2730 static void
2731 tls_save_session(tls_support * tlsp, gnutls_session_t session, const host_item * host)
2732 {
2733 /* TLS 1.2 - we get both the callback and the direct posthandshake call,
2734 but this flag is not set until the second. TLS 1.3 it's the other way about.
2735 Keep both calls as the session data cannot be extracted before handshake
2736 completes. */
2737
2738 if (gnutls_session_get_flags(session) & GNUTLS_SFLAGS_SESSION_TICKET)
2739 {
2740 gnutls_datum_t tkt;
2741 int rc;
2742
2743 DEBUG(D_tls) debug_printf("server offered session ticket\n");
2744 tlsp->ticket_received = TRUE;
2745 tlsp->resumption |= RESUME_SERVER_TICKET;
2746
2747 if (tlsp->host_resumable)
2748 if (!(rc = gnutls_session_get_data2(session, &tkt)))
2749 {
2750 open_db dbblock, * dbm_file;
2751 int dlen = sizeof(dbdata_tls_session) + tkt.size;
2752 dbdata_tls_session * dt = store_get(dlen, TRUE);
2753
2754 DEBUG(D_tls) debug_printf("session data size %u\n", (unsigned)tkt.size);
2755 memcpy(dt->session, tkt.data, tkt.size);
2756 gnutls_free(tkt.data);
2757
2758 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
2759 {
2760 /* key for the db is the IP */
2761 dbfn_delete(dbm_file, host->address);
2762 dbfn_write(dbm_file, host->address, dt, dlen);
2763 dbfn_close(dbm_file);
2764
2765 DEBUG(D_tls)
2766 debug_printf("wrote session db (len %u)\n", (unsigned)dlen);
2767 }
2768 }
2769 else DEBUG(D_tls)
2770 debug_printf("extract session data: %s\n", US gnutls_strerror(rc));
2771 }
2772 }
2773
2774
2775 /* With a TLS1.3 session, the ticket(s) are not seen until
2776 the first data read is attempted. And there's often two of them.
2777 Pick them up with this callback. We are also called for 1.2
2778 but we do nothing.
2779 */
2780 static int
2781 tls_client_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
2782 unsigned incoming, const gnutls_datum_t * msg)
2783 {
2784 exim_gnutls_state_st * state = gnutls_session_get_ptr(sess);
2785 tls_support * tlsp = state->tlsp;
2786
2787 DEBUG(D_tls) debug_printf("newticket cb\n");
2788
2789 if (!tlsp->ticket_received)
2790 tls_save_session(tlsp, sess, state->host);
2791 return 0;
2792 }
2793
2794
2795 static void
2796 tls_client_resume_prehandshake(exim_gnutls_state_st * state,
2797 tls_support * tlsp, host_item * host,
2798 smtp_transport_options_block * ob)
2799 {
2800 gnutls_session_set_ptr(state->session, state);
2801 gnutls_handshake_set_hook_function(state->session,
2802 GNUTLS_HANDSHAKE_NEW_SESSION_TICKET, GNUTLS_HOOK_POST, tls_client_ticket_cb);
2803
2804 tls_retrieve_session(tlsp, state->session, host, ob);
2805 }
2806
2807 static void
2808 tls_client_resume_posthandshake(exim_gnutls_state_st * state,
2809 tls_support * tlsp, host_item * host)
2810 {
2811 if (gnutls_session_is_resumed(state->session))
2812 {
2813 DEBUG(D_tls) debug_printf("Session resumed\n");
2814 tlsp->resumption |= RESUME_USED;
2815 }
2816
2817 tls_save_session(tlsp, state->session, host);
2818 }
2819 #endif /* EXPERIMENTAL_TLS_RESUME */
2820
2821
2822 /*************************************************
2823 * Start a TLS session in a client *
2824 *************************************************/
2825
2826 /* Called from the smtp transport after STARTTLS has been accepted.
2827
2828 Arguments:
2829 cctx connection context
2830 conn_args connection details
2831 cookie datum for randomness (not used)
2832 tlsp record details of channel configuration here; must be non-NULL
2833 errstr error string pointer
2834
2835 Returns: TRUE for success with TLS session context set in smtp context,
2836 FALSE on error
2837 */
2838
2839 BOOL
2840 tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
2841 void * cookie ARG_UNUSED,
2842 tls_support * tlsp, uschar ** errstr)
2843 {
2844 host_item * host = conn_args->host; /* for msgs and option-tests */
2845 transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
2846 smtp_transport_options_block * ob = tb
2847 ? (smtp_transport_options_block *)tb->options_block
2848 : &smtp_transport_option_defaults;
2849 int rc;
2850 exim_gnutls_state_st * state = NULL;
2851 uschar * cipher_list = NULL;
2852
2853 #ifndef DISABLE_OCSP
2854 BOOL require_ocsp =
2855 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
2856 BOOL request_ocsp = require_ocsp ? TRUE
2857 : verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
2858 #endif
2859
2860 DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", cctx->sock);
2861
2862 #ifdef SUPPORT_DANE
2863 /* If dane is flagged, have either request or require dane for this host, and
2864 a TLSA record found. Therefore, dane verify required. Which implies cert must
2865 be requested and supplied, dane verify must pass, and cert verify irrelevant
2866 (incl. hostnames), and (caller handled) require_tls */
2867
2868 if (conn_args->dane && ob->dane_require_tls_ciphers)
2869 {
2870 /* not using expand_check_tlsvar because not yet in state */
2871 if (!expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
2872 &cipher_list, errstr))
2873 return FALSE;
2874 cipher_list = cipher_list && *cipher_list
2875 ? ob->dane_require_tls_ciphers : ob->tls_require_ciphers;
2876 }
2877 #endif
2878
2879 if (!cipher_list)
2880 cipher_list = ob->tls_require_ciphers;
2881
2882 {
2883 #ifdef MEASURE_TIMING
2884 struct timeval t0;
2885 gettimeofday(&t0, NULL);
2886 #endif
2887
2888 if (tls_init(host, ob->tls_certificate, ob->tls_privatekey,
2889 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
2890 cipher_list, &state, tlsp, errstr) != OK)
2891 return FALSE;
2892
2893 #ifdef MEASURE_TIMING
2894 report_time_since(&t0, US"client tls_init (delta)");
2895 #endif
2896 }
2897
2898 {
2899 int dh_min_bits = ob->tls_dh_min_bits;
2900 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
2901 {
2902 DEBUG(D_tls)
2903 debug_printf("WARNING: tls_dh_min_bits far too low,"
2904 " clamping %d up to %d\n",
2905 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
2906 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
2907 }
2908
2909 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
2910 " acceptable bits to %d\n",
2911 dh_min_bits);
2912 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
2913 }
2914
2915 /* Stick to the old behaviour for compatibility if tls_verify_certificates is
2916 set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
2917 the specified host patterns if one of them is defined */
2918
2919 #ifdef SUPPORT_DANE
2920 if (conn_args->dane && dane_tlsa_load(state, &conn_args->tlsa_dnsa))
2921 {
2922 DEBUG(D_tls)
2923 debug_printf("TLS: server certificate DANE required.\n");
2924 state->verify_requirement = VERIFY_DANE;
2925 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2926 }
2927 else
2928 #endif
2929 if ( ( state->exp_tls_verify_certificates
2930 && !ob->tls_verify_hosts
2931 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2932 )
2933 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
2934 )
2935 {
2936 tls_client_setup_hostname_checks(host, state, ob);
2937 DEBUG(D_tls)
2938 debug_printf("TLS: server certificate verification required.\n");
2939 state->verify_requirement = VERIFY_REQUIRED;
2940 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2941 }
2942 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
2943 {
2944 tls_client_setup_hostname_checks(host, state, ob);
2945 DEBUG(D_tls)
2946 debug_printf("TLS: server certificate verification optional.\n");
2947 state->verify_requirement = VERIFY_OPTIONAL;
2948 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2949 }
2950 else
2951 {
2952 DEBUG(D_tls)
2953 debug_printf("TLS: server certificate verification not required.\n");
2954 state->verify_requirement = VERIFY_NONE;
2955 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2956 }
2957
2958 #ifndef DISABLE_OCSP
2959 /* supported since GnuTLS 3.1.3 */
2960 if (request_ocsp)
2961 {
2962 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
2963 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
2964 NULL, 0, NULL)) != OK)
2965 {
2966 tls_error_gnu(US"cert-status-req", rc, state->host, errstr);
2967 return FALSE;
2968 }
2969 tlsp->ocsp = OCSP_NOT_RESP;
2970 }
2971 #endif
2972
2973 #ifdef EXPERIMENTAL_TLS_RESUME
2974 tls_client_resume_prehandshake(state, tlsp, host, ob);
2975 #endif
2976
2977 #ifndef DISABLE_EVENT
2978 if (tb && tb->event_action)
2979 {
2980 state->event_action = tb->event_action;
2981 gnutls_session_set_ptr(state->session, state);
2982 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2983 }
2984 #endif
2985
2986 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) cctx->sock);
2987 state->fd_in = cctx->sock;
2988 state->fd_out = cctx->sock;
2989
2990 DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
2991 /* There doesn't seem to be a built-in timeout on connection. */
2992
2993 sigalrm_seen = FALSE;
2994 ALARM(ob->command_timeout);
2995 do
2996 rc = gnutls_handshake(state->session);
2997 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
2998 ALARM_CLR(0);
2999
3000 if (rc != GNUTLS_E_SUCCESS)
3001 {
3002 if (sigalrm_seen)
3003 {
3004 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
3005 tls_error(US"gnutls_handshake", US"timed out", state->host, errstr);
3006 }
3007 else
3008 tls_error_gnu(US"gnutls_handshake", rc, state->host, errstr);
3009 return FALSE;
3010 }
3011
3012 DEBUG(D_tls) post_handshake_debug(state);
3013
3014 /* Verify late */
3015
3016 if (!verify_certificate(state, errstr))
3017 {
3018 tls_error(US"certificate verification failed", *errstr, state->host, errstr);
3019 return FALSE;
3020 }
3021
3022 #ifdef GNUTLS_SFLAGS_EXT_MASTER_SECRET
3023 if (gnutls_session_get_flags(state->session) & GNUTLS_SFLAGS_EXT_MASTER_SECRET)
3024 tlsp->ext_master_secret = TRUE;
3025 #endif
3026
3027 #ifndef DISABLE_OCSP
3028 if (request_ocsp)
3029 {
3030 DEBUG(D_tls)
3031 {
3032 gnutls_datum_t stapling;
3033 gnutls_ocsp_resp_t resp;
3034 gnutls_datum_t printed;
3035 unsigned idx = 0;
3036
3037 for (;
3038 # ifdef GNUTLS_OCSP_STATUS_REQUEST_GET2
3039 (rc = gnutls_ocsp_status_request_get2(state->session, idx, &stapling)) == 0;
3040 #else
3041 (rc = gnutls_ocsp_status_request_get(state->session, &stapling)) == 0;
3042 #endif
3043 idx++)
3044 if ( (rc= gnutls_ocsp_resp_init(&resp)) == 0
3045 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
3046 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_COMPACT, &printed)) == 0
3047 )
3048 {
3049 debug_printf("%.4096s", printed.data);
3050 gnutls_free(printed.data);
3051 }
3052 else
3053 (void) tls_error_gnu(US"ocsp decode", rc, state->host, errstr);
3054 if (idx == 0 && rc)
3055 (void) tls_error_gnu(US"ocsp decode", rc, state->host, errstr);
3056 }
3057
3058 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
3059 {
3060 tlsp->ocsp = OCSP_FAILED;
3061 tls_error(US"certificate status check failed", NULL, state->host, errstr);
3062 if (require_ocsp)
3063 return FALSE;
3064 }
3065 else
3066 {
3067 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
3068 tlsp->ocsp = OCSP_VFIED;
3069 }
3070 }
3071 #endif
3072
3073 #ifdef EXPERIMENTAL_TLS_RESUME
3074 tls_client_resume_posthandshake(state, tlsp, host);
3075 #endif
3076
3077 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
3078
3079 extract_exim_vars_from_tls_state(state);
3080
3081 cctx->tls_ctx = state;
3082 return TRUE;
3083 }
3084
3085
3086
3087
3088 /*************************************************
3089 * Close down a TLS session *
3090 *************************************************/
3091
3092 /* This is also called from within a delivery subprocess forked from the
3093 daemon, to shut down the TLS library, without actually doing a shutdown (which
3094 would tamper with the TLS session in the parent process).
3095
3096 Arguments:
3097 ct_ctx client context pointer, or NULL for the one global server context
3098 shutdown 1 if TLS close-alert is to be sent,
3099 2 if also response to be waited for
3100
3101 Returns: nothing
3102 */
3103
3104 void
3105 tls_close(void * ct_ctx, int shutdown)
3106 {
3107 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3108 tls_support * tlsp = state->tlsp;
3109
3110 if (!tlsp || tlsp->active.sock < 0) return; /* TLS was not active */
3111
3112 if (shutdown)
3113 {
3114 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
3115 shutdown > 1 ? " (with response-wait)" : "");
3116
3117 ALARM(2);
3118 gnutls_bye(state->session, shutdown > 1 ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR);
3119 ALARM_CLR(0);
3120 }
3121
3122 if (!ct_ctx) /* server */
3123 {
3124 receive_getc = smtp_getc;
3125 receive_getbuf = smtp_getbuf;
3126 receive_get_cache = smtp_get_cache;
3127 receive_ungetc = smtp_ungetc;
3128 receive_feof = smtp_feof;
3129 receive_ferror = smtp_ferror;
3130 receive_smtp_buffered = smtp_buffered;
3131 }
3132
3133 gnutls_deinit(state->session);
3134 gnutls_certificate_free_credentials(state->x509_cred);
3135
3136 tlsp->active.sock = -1;
3137 tlsp->active.tls_ctx = NULL;
3138 /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
3139 tlsp->channelbinding = NULL;
3140
3141
3142 if (state->xfer_buffer) store_free(state->xfer_buffer);
3143 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
3144 }
3145
3146
3147
3148
3149 static BOOL
3150 tls_refill(unsigned lim)
3151 {
3152 exim_gnutls_state_st * state = &state_server;
3153 ssize_t inbytes;
3154
3155 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(session=%p, buffer=%p, buffersize=%u)\n",
3156 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
3157
3158 sigalrm_seen = FALSE;
3159 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3160
3161 do
3162 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
3163 MIN(ssl_xfer_buffer_size, lim));
3164 while (inbytes == GNUTLS_E_AGAIN);
3165
3166 if (smtp_receive_timeout > 0) ALARM_CLR(0);
3167
3168 if (had_command_timeout) /* set by signal handler */
3169 smtp_command_timeout_exit(); /* does not return */
3170 if (had_command_sigterm)
3171 smtp_command_sigterm_exit();
3172 if (had_data_timeout)
3173 smtp_data_timeout_exit();
3174 if (had_data_sigint)
3175 smtp_data_sigint_exit();
3176
3177 /* Timeouts do not get this far. A zero-byte return appears to mean that the
3178 TLS session has been closed down, not that the socket itself has been closed
3179 down. Revert to non-TLS handling. */
3180
3181 if (sigalrm_seen)
3182 {
3183 DEBUG(D_tls) debug_printf("Got tls read timeout\n");
3184 state->xfer_error = TRUE;
3185 return FALSE;
3186 }
3187
3188 else if (inbytes == 0)
3189 {
3190 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
3191 tls_close(NULL, TLS_NO_SHUTDOWN);
3192 return FALSE;
3193 }
3194
3195 /* Handle genuine errors */
3196
3197 else if (inbytes < 0)
3198 {
3199 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
3200 record_io_error(state, (int) inbytes, US"recv", NULL);
3201 state->xfer_error = TRUE;
3202 return FALSE;
3203 }
3204 #ifndef DISABLE_DKIM
3205 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
3206 #endif
3207 state->xfer_buffer_hwm = (int) inbytes;
3208 state->xfer_buffer_lwm = 0;
3209 return TRUE;
3210 }
3211
3212 /*************************************************
3213 * TLS version of getc *
3214 *************************************************/
3215
3216 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
3217 it refills the buffer via the GnuTLS reading function.
3218 Only used by the server-side TLS.
3219
3220 This feeds DKIM and should be used for all message-body reads.
3221
3222 Arguments: lim Maximum amount to read/buffer
3223 Returns: the next character or EOF
3224 */
3225
3226 int
3227 tls_getc(unsigned lim)
3228 {
3229 exim_gnutls_state_st * state = &state_server;
3230
3231 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3232 if (!tls_refill(lim))
3233 return state->xfer_error ? EOF : smtp_getc(lim);
3234
3235 /* Something in the buffer; return next uschar */
3236
3237 return state->xfer_buffer[state->xfer_buffer_lwm++];
3238 }
3239
3240 uschar *
3241 tls_getbuf(unsigned * len)
3242 {
3243 exim_gnutls_state_st * state = &state_server;
3244 unsigned size;
3245 uschar * buf;
3246
3247 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3248 if (!tls_refill(*len))
3249 {
3250 if (!state->xfer_error) return smtp_getbuf(len);
3251 *len = 0;
3252 return NULL;
3253 }
3254
3255 if ((size = state->xfer_buffer_hwm - state->xfer_buffer_lwm) > *len)
3256 size = *len;
3257 buf = &state->xfer_buffer[state->xfer_buffer_lwm];
3258 state->xfer_buffer_lwm += size;
3259 *len = size;
3260 return buf;
3261 }
3262
3263
3264 void
3265 tls_get_cache()
3266 {
3267 #ifndef DISABLE_DKIM
3268 exim_gnutls_state_st * state = &state_server;
3269 int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
3270 if (n > 0)
3271 dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
3272 #endif
3273 }
3274
3275
3276 BOOL
3277 tls_could_read(void)
3278 {
3279 return state_server.xfer_buffer_lwm < state_server.xfer_buffer_hwm
3280 || gnutls_record_check_pending(state_server.session) > 0;
3281 }
3282
3283
3284
3285
3286 /*************************************************
3287 * Read bytes from TLS channel *
3288 *************************************************/
3289
3290 /* This does not feed DKIM, so if the caller uses this for reading message body,
3291 then the caller must feed DKIM.
3292
3293 Arguments:
3294 ct_ctx client context pointer, or NULL for the one global server context
3295 buff buffer of data
3296 len size of buffer
3297
3298 Returns: the number of bytes read
3299 -1 after a failed read, including EOF
3300 */
3301
3302 int
3303 tls_read(void * ct_ctx, uschar *buff, size_t len)
3304 {
3305 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3306 ssize_t inbytes;
3307
3308 if (len > INT_MAX)
3309 len = INT_MAX;
3310
3311 if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
3312 DEBUG(D_tls)
3313 debug_printf("*** PROBABLY A BUG *** " \
3314 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
3315 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
3316
3317 DEBUG(D_tls)
3318 debug_printf("Calling gnutls_record_recv(session=%p, buffer=%p, len=" SIZE_T_FMT ")\n",
3319 state->session, buff, len);
3320
3321 do
3322 inbytes = gnutls_record_recv(state->session, buff, len);
3323 while (inbytes == GNUTLS_E_AGAIN);
3324
3325 if (inbytes > 0) return inbytes;
3326 if (inbytes == 0)
3327 {
3328 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
3329 }
3330 else
3331 {
3332 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
3333 record_io_error(state, (int)inbytes, US"recv", NULL);
3334 }
3335
3336 return -1;
3337 }
3338
3339
3340
3341
3342 /*************************************************
3343 * Write bytes down TLS channel *
3344 *************************************************/
3345
3346 /*
3347 Arguments:
3348 ct_ctx client context pointer, or NULL for the one global server context
3349 buff buffer of data
3350 len number of bytes
3351 more more data expected soon
3352
3353 Calling with len zero and more unset will flush buffered writes. The buff
3354 argument can be null for that case.
3355
3356 Returns: the number of bytes after a successful write,
3357 -1 after a failed write
3358 */
3359
3360 int
3361 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
3362 {
3363 ssize_t outbytes;
3364 size_t left = len;
3365 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3366
3367 #ifdef SUPPORT_CORK
3368 if (more && !state->corked)
3369 {
3370 DEBUG(D_tls) debug_printf("gnutls_record_cork(session=%p)\n", state->session);
3371 gnutls_record_cork(state->session);
3372 state->corked = TRUE;
3373 }
3374 #endif
3375
3376 DEBUG(D_tls) debug_printf("%s(%p, " SIZE_T_FMT "%s)\n", __FUNCTION__,
3377 buff, left, more ? ", more" : "");
3378
3379 while (left > 0)
3380 {
3381 DEBUG(D_tls) debug_printf("gnutls_record_send(session=%p, buffer=%p, left=" SIZE_T_FMT ")\n",
3382 state->session, buff, left);
3383
3384 do
3385 outbytes = gnutls_record_send(state->session, buff, left);
3386 while (outbytes == GNUTLS_E_AGAIN);
3387
3388 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
3389
3390 if (outbytes < 0)
3391 {
3392 DEBUG(D_tls) debug_printf("%s: gnutls_record_send err\n", __FUNCTION__);
3393 record_io_error(state, outbytes, US"send", NULL);
3394 return -1;
3395 }
3396 if (outbytes == 0)
3397 {
3398 record_io_error(state, 0, US"send", US"TLS channel closed on write");
3399 return -1;
3400 }
3401
3402 left -= outbytes;
3403 buff += outbytes;
3404 }
3405
3406 if (len > INT_MAX)
3407 {
3408 DEBUG(D_tls)
3409 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
3410 len);
3411 len = INT_MAX;
3412 }
3413
3414 #ifdef SUPPORT_CORK
3415 if (!more && state->corked)
3416 {
3417 DEBUG(D_tls) debug_printf("gnutls_record_uncork(session=%p)\n", state->session);
3418 do
3419 /* We can't use GNUTLS_RECORD_WAIT here, as it retries on
3420 GNUTLS_E_AGAIN || GNUTLS_E_INTR, which would break our timeout set by alarm().
3421 The GNUTLS_E_AGAIN should not happen ever, as our sockets are blocking anyway.
3422 But who knows. (That all relies on the fact that GNUTLS_E_INTR and GNUTLS_E_AGAIN
3423 match the EINTR and EAGAIN errno values.) */
3424 outbytes = gnutls_record_uncork(state->session, 0);
3425 while (outbytes == GNUTLS_E_AGAIN);
3426
3427 if (outbytes < 0)
3428 {
3429 record_io_error(state, len, US"uncork", NULL);
3430 return -1;
3431 }
3432
3433 state->corked = FALSE;
3434 }
3435 #endif
3436
3437 return (int) len;
3438 }
3439
3440
3441
3442
3443 /*************************************************
3444 * Random number generation *
3445 *************************************************/
3446
3447 /* Pseudo-random number generation. The result is not expected to be
3448 cryptographically strong but not so weak that someone will shoot themselves
3449 in the foot using it as a nonce in input in some email header scheme or
3450 whatever weirdness they'll twist this into. The result should handle fork()
3451 and avoid repeating sequences. OpenSSL handles that for us.
3452
3453 Arguments:
3454 max range maximum
3455 Returns a random number in range [0, max-1]
3456 */
3457
3458 #ifdef HAVE_GNUTLS_RND
3459 int
3460 vaguely_random_number(int max)
3461 {
3462 unsigned int r;
3463 int i, needed_len;
3464 uschar smallbuf[