6cd9bf75bf1eb3e4963549b83545c92a243aa135
[exim.git] / src / src / tls-gnu.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Copyright (c) Phil Pennock 2012 */
9
10 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
11 one of the available supported implementations. This file is #included into
12 tls.c when USE_GNUTLS has been set.
13
14 The code herein is a revamp of GnuTLS integration using the current APIs; the
15 original tls-gnu.c was based on a patch which was contributed by Nikos
16 Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
17 appropriate.
18
19 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20 which is not widely deployed by OS vendors. Will note issues below, which may
21 assist in updating the code in the future. Another sources of hints is
22 mod_gnutls for Apache (SNI callback registration and handling).
23
24 Keeping client and server variables more split than before and is currently
25 the norm, in anticipation of TLS in ACL callouts.
26
27 I wanted to switch to gnutls_certificate_set_verify_function() so that
28 certificate rejection could happen during handshake where it belongs, rather
29 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
31
32 (I wasn't looking for libraries quite that old, when updating to get rid of
33 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34 require current GnuTLS, then we'll drop support for the ancient libraries).
35 */
36
37 #include <gnutls/gnutls.h>
38 /* needed for cert checks in verification and DN extraction: */
39 #include <gnutls/x509.h>
40 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41 #include <gnutls/crypto.h>
42
43 /* needed to disable PKCS11 autoload unless requested */
44 #if GNUTLS_VERSION_NUMBER >= 0x020c00
45 # include <gnutls/pkcs11.h>
46 # define SUPPORT_PARAM_TO_PK_BITS
47 #endif
48 #if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
49 # warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
50 # define DISABLE_OCSP
51 #endif
52 #if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
53 # warning "GnuTLS library version too old; tls:cert event unsupported"
54 # define DISABLE_EVENT
55 #endif
56 #if GNUTLS_VERSION_NUMBER >= 0x030306
57 # define SUPPORT_CA_DIR
58 #else
59 # undef SUPPORT_CA_DIR
60 #endif
61 #if GNUTLS_VERSION_NUMBER >= 0x030014
62 # define SUPPORT_SYSDEFAULT_CABUNDLE
63 #endif
64 #if GNUTLS_VERSION_NUMBER >= 0x030104
65 # define GNUTLS_CERT_VFY_STATUS_PRINT
66 #endif
67 #if GNUTLS_VERSION_NUMBER >= 0x030109
68 # define SUPPORT_CORK
69 #endif
70 #if GNUTLS_VERSION_NUMBER >= 0x03010a
71 # define SUPPORT_GNUTLS_SESS_DESC
72 #endif
73 #if GNUTLS_VERSION_NUMBER >= 0x030300
74 # define GNUTLS_AUTO_GLOBAL_INIT
75 # define GNUTLS_AUTO_PKCS11_MANUAL
76 #endif
77 #if GNUTLS_VERSION_NUMBER >= 0x030500
78 # define SUPPORT_GNUTLS_KEYLOG
79 #endif
80 #if GNUTLS_VERSION_NUMBER >= 0x030506 && !defined(DISABLE_OCSP)
81 # define SUPPORT_SRV_OCSP_STACK
82 #endif
83 #if GNUTLS_VERSION_NUMBER >= 0x030600
84 # define GNUTLS_AUTO_DHPARAMS
85 #endif
86 #if GNUTLS_VERSION_NUMBER >= 0x030603
87 # define EXIM_HAVE_TLS1_3
88 # define SUPPORT_GNUTLS_EXT_RAW_PARSE
89 # define GNUTLS_OCSP_STATUS_REQUEST_GET2
90 #endif
91
92 #ifdef SUPPORT_DANE
93 # if GNUTLS_VERSION_NUMBER >= 0x030000
94 # define DANESSL_USAGE_DANE_TA 2
95 # define DANESSL_USAGE_DANE_EE 3
96 # else
97 # error GnuTLS version too early for DANE
98 # endif
99 # if GNUTLS_VERSION_NUMBER < 0x999999
100 # define GNUTLS_BROKEN_DANE_VALIDATION
101 # endif
102 #endif
103
104 #ifdef EXPERIMENTAL_TLS_RESUME
105 # if GNUTLS_VERSION_NUMBER < 0x030603
106 # error GNUTLS version too early for session-resumption
107 # endif
108 #endif
109
110 #ifndef DISABLE_OCSP
111 # include <gnutls/ocsp.h>
112 #endif
113 #ifdef SUPPORT_DANE
114 # include <gnutls/dane.h>
115 #endif
116
117 #include "tls-cipher-stdname.c"
118
119
120 #ifdef MACRO_PREDEF
121 void
122 options_tls(void)
123 {
124 # ifdef EXPERIMENTAL_TLS_RESUME
125 builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
126 # endif
127 # ifdef EXIM_HAVE_TLS1_3
128 builtin_macro_create(US"_HAVE_TLS1_3");
129 # endif
130 }
131 #else
132
133
134 /* GnuTLS 2 vs 3
135
136 GnuTLS 3 only:
137 gnutls_global_set_audit_log_function()
138
139 Changes:
140 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
141 */
142
143 /* Local static variables for GnuTLS */
144
145 /* Values for verify_requirement */
146
147 enum peer_verify_requirement
148 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED, VERIFY_DANE };
149
150 /* This holds most state for server or client; with this, we can set up an
151 outbound TLS-enabled connection in an ACL callout, while not stomping all
152 over the TLS variables available for expansion.
153
154 Some of these correspond to variables in globals.c; those variables will
155 be set to point to content in one of these instances, as appropriate for
156 the stage of the process lifetime.
157
158 Not handled here: global tls_channelbinding_b64.
159 */
160
161 typedef struct exim_gnutls_state {
162 gnutls_session_t session;
163 gnutls_certificate_credentials_t x509_cred;
164 gnutls_priority_t priority_cache;
165 enum peer_verify_requirement verify_requirement;
166 int fd_in;
167 int fd_out;
168 BOOL peer_cert_verified;
169 BOOL peer_dane_verified;
170 BOOL trigger_sni_changes;
171 BOOL have_set_peerdn;
172 const struct host_item *host; /* NULL if server */
173 gnutls_x509_crt_t peercert;
174 uschar *peerdn;
175 uschar *ciphersuite;
176 uschar *received_sni;
177
178 const uschar *tls_certificate;
179 const uschar *tls_privatekey;
180 const uschar *tls_sni; /* client send only, not received */
181 const uschar *tls_verify_certificates;
182 const uschar *tls_crl;
183 const uschar *tls_require_ciphers;
184
185 uschar *exp_tls_certificate;
186 uschar *exp_tls_privatekey;
187 uschar *exp_tls_verify_certificates;
188 uschar *exp_tls_crl;
189 uschar *exp_tls_require_ciphers;
190 const uschar *exp_tls_verify_cert_hostnames;
191 #ifndef DISABLE_EVENT
192 uschar *event_action;
193 #endif
194 #ifdef SUPPORT_DANE
195 char * const * dane_data;
196 const int * dane_data_len;
197 #endif
198
199 tls_support *tlsp; /* set in tls_init() */
200
201 uschar *xfer_buffer;
202 int xfer_buffer_lwm;
203 int xfer_buffer_hwm;
204 BOOL xfer_eof; /*XXX never gets set! */
205 BOOL xfer_error;
206 } exim_gnutls_state_st;
207
208 static const exim_gnutls_state_st exim_gnutls_state_init = {
209 /* all elements not explicitly intialised here get 0/NULL/FALSE */
210 .fd_in = -1,
211 .fd_out = -1,
212 };
213
214 /* Not only do we have our own APIs which don't pass around state, assuming
215 it's held in globals, GnuTLS doesn't appear to let us register callback data
216 for callbacks, or as part of the session, so we have to keep a "this is the
217 context we're currently dealing with" pointer and rely upon being
218 single-threaded to keep from processing data on an inbound TLS connection while
219 talking to another TLS connection for an outbound check. This does mean that
220 there's no way for heart-beats to be responded to, for the duration of the
221 second connection.
222 XXX But see gnutls_session_get_ptr()
223 */
224
225 static exim_gnutls_state_st state_server;
226
227 #ifndef GNUTLS_AUTO_DHPARAMS
228 /* dh_params are initialised once within the lifetime of a process using TLS;
229 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
230 don't want to repeat this. */
231
232 static gnutls_dh_params_t dh_server_params = NULL;
233 #endif
234
235 static int ssl_session_timeout = 7200; /* Two hours */
236
237 static const uschar * const exim_default_gnutls_priority = US"NORMAL";
238
239 /* Guard library core initialisation */
240
241 static BOOL exim_gnutls_base_init_done = FALSE;
242
243 #ifndef DISABLE_OCSP
244 static BOOL gnutls_buggy_ocsp = FALSE;
245 static BOOL exim_testharness_disable_ocsp_validity_check = FALSE;
246 #endif
247
248 #ifdef EXPERIMENTAL_TLS_RESUME
249 static gnutls_datum_t server_sessticket_key;
250 #endif
251
252 /* ------------------------------------------------------------------------ */
253 /* macros */
254
255 #define MAX_HOST_LEN 255
256
257 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
258 the library logging; a value less than 0 disables the calls to set up logging
259 callbacks. GNuTLS also looks for an environment variable - except not for
260 setuid binaries, making it useless - "GNUTLS_DEBUG_LEVEL".
261 Allegedly the testscript line "GNUTLS_DEBUG_LEVEL=9 sudo exim ..." would work,
262 but the env var must be added to /etc/sudoers too. */
263 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
264 # define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
265 #endif
266
267 #ifndef EXIM_CLIENT_DH_MIN_BITS
268 # define EXIM_CLIENT_DH_MIN_BITS 1024
269 #endif
270
271 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
272 can ask for a bit-strength. Without that, we stick to the constant we had
273 before, for now. */
274 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
275 # define EXIM_SERVER_DH_BITS_PRE2_12 1024
276 #endif
277
278 #define expand_check_tlsvar(Varname, errstr) \
279 expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr)
280
281 #if GNUTLS_VERSION_NUMBER >= 0x020c00
282 # define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
283 # define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
284 # define HAVE_GNUTLS_RND
285 /* The security fix we provide with the gnutls_allow_auto_pkcs11 option
286 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
287 * isn't available sometimes, so this needs to become a conditional
288 * compilation; the sanest way to deal with this being a problem on
289 * older OSes is to block it in the Local/Makefile with this compiler
290 * definition */
291 # ifndef AVOID_GNUTLS_PKCS11
292 # define HAVE_GNUTLS_PKCS11
293 # endif /* AVOID_GNUTLS_PKCS11 */
294 #endif
295
296
297
298
299 /* ------------------------------------------------------------------------ */
300 /* Callback declarations */
301
302 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
303 static void exim_gnutls_logger_cb(int level, const char *message);
304 #endif
305
306 static int exim_sni_handling_cb(gnutls_session_t session);
307
308 #ifdef EXPERIMENTAL_TLS_RESUME
309 static int
310 tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
311 unsigned incoming, const gnutls_datum_t * msg);
312 #endif
313
314
315 /* Daemon one-time initialisation */
316 void
317 tls_daemon_init(void)
318 {
319 #ifdef EXPERIMENTAL_TLS_RESUME
320 /* We are dependent on the GnuTLS implementation of the Session Ticket
321 encryption; both the strength and the key rotation period. We hope that
322 the strength at least matches that of the ciphersuite (but GnuTLS does not
323 document this). */
324
325 static BOOL once = FALSE;
326 if (once) return;
327 once = TRUE;
328 gnutls_session_ticket_key_generate(&server_sessticket_key); /* >= 2.10.0 */
329 if (f.running_in_test_harness) ssl_session_timeout = 6;
330 #endif
331 }
332
333 /* ------------------------------------------------------------------------ */
334 /* Static functions */
335
336 /*************************************************
337 * Handle TLS error *
338 *************************************************/
339
340 /* Called from lots of places when errors occur before actually starting to do
341 the TLS handshake, that is, while the session is still in clear. Always returns
342 DEFER for a server and FAIL for a client so that most calls can use "return
343 tls_error(...)" to do this processing and then give an appropriate return. A
344 single function is used for both server and client, because it is called from
345 some shared functions.
346
347 Argument:
348 prefix text to include in the logged error
349 msg additional error string (may be NULL)
350 usually obtained from gnutls_strerror()
351 host NULL if setting up a server;
352 the connected host if setting up a client
353 errstr pointer to returned error string
354
355 Returns: OK/DEFER/FAIL
356 */
357
358 static int
359 tls_error(const uschar *prefix, const uschar *msg, const host_item *host,
360 uschar ** errstr)
361 {
362 if (errstr)
363 *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : US"");
364 return host ? FAIL : DEFER;
365 }
366
367
368 static int
369 tls_error_gnu(const uschar *prefix, int err, const host_item *host,
370 uschar ** errstr)
371 {
372 return tls_error(prefix, US gnutls_strerror(err), host, errstr);
373 }
374
375 static int
376 tls_error_sys(const uschar *prefix, int err, const host_item *host,
377 uschar ** errstr)
378 {
379 return tls_error(prefix, US strerror(err), host, errstr);
380 }
381
382
383 /*************************************************
384 * Deal with logging errors during I/O *
385 *************************************************/
386
387 /* We have to get the identity of the peer from saved data.
388
389 Argument:
390 state the current GnuTLS exim state container
391 rc the GnuTLS error code, or 0 if it's a local error
392 when text identifying read or write
393 text local error text when rc is 0
394
395 Returns: nothing
396 */
397
398 static void
399 record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
400 {
401 const uschar * msg;
402 uschar * errstr;
403
404 if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
405 msg = string_sprintf("A TLS fatal alert has been received: %s",
406 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
407 else
408 msg = US gnutls_strerror(rc);
409
410 (void) tls_error(when, msg, state->host, &errstr);
411
412 if (state->host)
413 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection %s",
414 state->host->name, state->host->address, errstr);
415 else
416 {
417 uschar * conn_info = smtp_get_connection_info();
418 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0) conn_info += 5;
419 /* I'd like to get separated H= here, but too hard for now */
420 log_write(0, LOG_MAIN, "TLS error on %s %s", conn_info, errstr);
421 }
422 }
423
424
425
426
427 /*************************************************
428 * Set various Exim expansion vars *
429 *************************************************/
430
431 #define exim_gnutls_cert_err(Label) \
432 do \
433 { \
434 if (rc != GNUTLS_E_SUCCESS) \
435 { \
436 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
437 (Label), gnutls_strerror(rc)); \
438 return rc; \
439 } \
440 } while (0)
441
442 static int
443 import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
444 {
445 int rc;
446
447 rc = gnutls_x509_crt_init(crtp);
448 exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
449
450 rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
451 exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
452
453 return rc;
454 }
455
456 #undef exim_gnutls_cert_err
457
458
459 /* We set various Exim global variables from the state, once a session has
460 been established. With TLS callouts, may need to change this to stack
461 variables, or just re-call it with the server state after client callout
462 has finished.
463
464 Make sure anything set here is unset in tls_getc().
465
466 Sets:
467 tls_active fd
468 tls_bits strength indicator
469 tls_certificate_verified bool indicator
470 tls_channelbinding_b64 for some SASL mechanisms
471 tls_cipher a string
472 tls_peercert pointer to library internal
473 tls_peerdn a string
474 tls_sni a (UTF-8) string
475 tls_ourcert pointer to library internal
476
477 Argument:
478 state the relevant exim_gnutls_state_st *
479 */
480
481 static void
482 extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
483 {
484 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
485 int old_pool;
486 int rc;
487 gnutls_datum_t channel;
488 #endif
489 tls_support * tlsp = state->tlsp;
490
491 tlsp->active.sock = state->fd_out;
492 tlsp->active.tls_ctx = state;
493
494 DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
495
496 tlsp->certificate_verified = state->peer_cert_verified;
497 #ifdef SUPPORT_DANE
498 tlsp->dane_verified = state->peer_dane_verified;
499 #endif
500
501 /* note that tls_channelbinding_b64 is not saved to the spool file, since it's
502 only available for use for authenticators while this TLS session is running. */
503
504 tls_channelbinding_b64 = NULL;
505 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
506 channel.data = NULL;
507 channel.size = 0;
508 if ((rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel)))
509 { DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc)); }
510 else
511 {
512 old_pool = store_pool;
513 store_pool = POOL_PERM;
514 tls_channelbinding_b64 = b64encode(CUS channel.data, (int)channel.size);
515 store_pool = old_pool;
516 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
517 }
518 #endif
519
520 /* peercert is set in peer_status() */
521 tlsp->peerdn = state->peerdn;
522 tlsp->sni = state->received_sni;
523
524 /* record our certificate */
525 {
526 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
527 gnutls_x509_crt_t crt;
528
529 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
530 }
531 }
532
533
534
535
536 #ifndef GNUTLS_AUTO_DHPARAMS
537 /*************************************************
538 * Setup up DH parameters *
539 *************************************************/
540
541 /* Generating the D-H parameters may take a long time. They only need to
542 be re-generated every so often, depending on security policy. What we do is to
543 keep these parameters in a file in the spool directory. If the file does not
544 exist, we generate them. This means that it is easy to cause a regeneration.
545
546 The new file is written as a temporary file and renamed, so that an incomplete
547 file is never present. If two processes both compute some new parameters, you
548 waste a bit of effort, but it doesn't seem worth messing around with locking to
549 prevent this.
550
551 Returns: OK/DEFER/FAIL
552 */
553
554 static int
555 init_server_dh(uschar ** errstr)
556 {
557 int fd, rc;
558 unsigned int dh_bits;
559 gnutls_datum_t m = {.data = NULL, .size = 0};
560 uschar filename_buf[PATH_MAX];
561 uschar *filename = NULL;
562 size_t sz;
563 uschar *exp_tls_dhparam;
564 BOOL use_file_in_spool = FALSE;
565 host_item *host = NULL; /* dummy for macros */
566
567 DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
568
569 if ((rc = gnutls_dh_params_init(&dh_server_params)))
570 return tls_error_gnu(US"gnutls_dh_params_init", rc, host, errstr);
571
572 if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam, errstr))
573 return DEFER;
574
575 if (!exp_tls_dhparam)
576 {
577 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
578 m.data = US std_dh_prime_default();
579 m.size = Ustrlen(m.data);
580 }
581 else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
582 use_file_in_spool = TRUE;
583 else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
584 {
585 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
586 return OK;
587 }
588 else if (exp_tls_dhparam[0] != '/')
589 {
590 if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
591 return tls_error(US"No standard prime named", exp_tls_dhparam, NULL, errstr);
592 m.size = Ustrlen(m.data);
593 }
594 else
595 filename = exp_tls_dhparam;
596
597 if (m.data)
598 {
599 if ((rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM)))
600 return tls_error_gnu(US"gnutls_dh_params_import_pkcs3", rc, host, errstr);
601 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
602 return OK;
603 }
604
605 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
606 /* If you change this constant, also change dh_param_fn_ext so that we can use a
607 different filename and ensure we have sufficient bits. */
608
609 if (!(dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL)))
610 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL, errstr);
611 DEBUG(D_tls)
612 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
613 dh_bits);
614 #else
615 dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
616 DEBUG(D_tls)
617 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
618 dh_bits);
619 #endif
620
621 /* Some clients have hard-coded limits. */
622 if (dh_bits > tls_dh_max_bits)
623 {
624 DEBUG(D_tls)
625 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
626 tls_dh_max_bits);
627 dh_bits = tls_dh_max_bits;
628 }
629
630 if (use_file_in_spool)
631 {
632 if (!string_format(filename_buf, sizeof(filename_buf),
633 "%s/gnutls-params-%d", spool_directory, dh_bits))
634 return tls_error(US"overlong filename", NULL, NULL, errstr);
635 filename = filename_buf;
636 }
637
638 /* Open the cache file for reading and if successful, read it and set up the
639 parameters. */
640
641 if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
642 {
643 struct stat statbuf;
644 FILE *fp;
645 int saved_errno;
646
647 if (fstat(fd, &statbuf) < 0) /* EIO */
648 {
649 saved_errno = errno;
650 (void)close(fd);
651 return tls_error_sys(US"TLS cache stat failed", saved_errno, NULL, errstr);
652 }
653 if (!S_ISREG(statbuf.st_mode))
654 {
655 (void)close(fd);
656 return tls_error(US"TLS cache not a file", NULL, NULL, errstr);
657 }
658 if (!(fp = fdopen(fd, "rb")))
659 {
660 saved_errno = errno;
661 (void)close(fd);
662 return tls_error_sys(US"fdopen(TLS cache stat fd) failed",
663 saved_errno, NULL, errstr);
664 }
665
666 m.size = statbuf.st_size;
667 if (!(m.data = store_malloc(m.size)))
668 {
669 fclose(fp);
670 return tls_error_sys(US"malloc failed", errno, NULL, errstr);
671 }
672 if (!(sz = fread(m.data, m.size, 1, fp)))
673 {
674 saved_errno = errno;
675 fclose(fp);
676 store_free(m.data);
677 return tls_error_sys(US"fread failed", saved_errno, NULL, errstr);
678 }
679 fclose(fp);
680
681 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
682 store_free(m.data);
683 if (rc)
684 return tls_error_gnu(US"gnutls_dh_params_import_pkcs3", rc, host, errstr);
685 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
686 }
687
688 /* If the file does not exist, fall through to compute new data and cache it.
689 If there was any other opening error, it is serious. */
690
691 else if (errno == ENOENT)
692 {
693 rc = -1;
694 DEBUG(D_tls)
695 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
696 }
697 else
698 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
699 NULL, NULL, errstr);
700
701 /* If ret < 0, either the cache file does not exist, or the data it contains
702 is not useful. One particular case of this is when upgrading from an older
703 release of Exim in which the data was stored in a different format. We don't
704 try to be clever and support both formats; we just regenerate new data in this
705 case. */
706
707 if (rc < 0)
708 {
709 uschar *temp_fn;
710 unsigned int dh_bits_gen = dh_bits;
711
712 if ((PATH_MAX - Ustrlen(filename)) < 10)
713 return tls_error(US"Filename too long to generate replacement",
714 filename, NULL, errstr);
715
716 temp_fn = string_copy(US"%s.XXXXXXX");
717 if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */
718 return tls_error_sys(US"Unable to open temp file", errno, NULL, errstr);
719 (void)exim_chown(temp_fn, exim_uid, exim_gid); /* Probably not necessary */
720
721 /* GnuTLS overshoots! If we ask for 2236, we might get 2237 or more. But
722 there's no way to ask GnuTLS how many bits there really are. We can ask
723 how many bits were used in a TLS session, but that's it! The prime itself
724 is hidden behind too much abstraction. So we ask for less, and proceed on
725 a wing and a prayer. First attempt, subtracted 3 for 2233 and got 2240. */
726
727 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
728 {
729 dh_bits_gen = dh_bits - 10;
730 DEBUG(D_tls)
731 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
732 dh_bits_gen);
733 }
734
735 DEBUG(D_tls)
736 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
737 dh_bits_gen);
738 if ((rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen)))
739 return tls_error_gnu(US"gnutls_dh_params_generate2", rc, host, errstr);
740
741 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
742 and I confirmed that a NULL call to get the size first is how the GnuTLS
743 sample apps handle this. */
744
745 sz = 0;
746 m.data = NULL;
747 if ( (rc = gnutls_dh_params_export_pkcs3(dh_server_params,
748 GNUTLS_X509_FMT_PEM, m.data, &sz))
749 && rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
750 return tls_error_gnu(US"gnutls_dh_params_export_pkcs3(NULL) sizing",
751 rc, host, errstr);
752 m.size = sz;
753 if (!(m.data = store_malloc(m.size)))
754 return tls_error_sys(US"memory allocation failed", errno, NULL, errstr);
755
756 /* this will return a size 1 less than the allocation size above */
757 if ((rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
758 m.data, &sz)))
759 {
760 store_free(m.data);
761 return tls_error_gnu(US"gnutls_dh_params_export_pkcs3() real", rc, host, errstr);
762 }
763 m.size = sz; /* shrink by 1, probably */
764
765 if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
766 {
767 store_free(m.data);
768 return tls_error_sys(US"TLS cache write D-H params failed",
769 errno, NULL, errstr);
770 }
771 store_free(m.data);
772 if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
773 return tls_error_sys(US"TLS cache write D-H params final newline failed",
774 errno, NULL, errstr);
775
776 if ((rc = close(fd)))
777 return tls_error_sys(US"TLS cache write close() failed", errno, NULL, errstr);
778
779 if (Urename(temp_fn, filename) < 0)
780 return tls_error_sys(string_sprintf("failed to rename \"%s\" as \"%s\"",
781 temp_fn, filename), errno, NULL, errstr);
782
783 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
784 }
785
786 DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
787 return OK;
788 }
789 #endif
790
791
792
793
794 /* Create and install a selfsigned certificate, for use in server mode */
795
796 static int
797 tls_install_selfsign(exim_gnutls_state_st * state, uschar ** errstr)
798 {
799 gnutls_x509_crt_t cert = NULL;
800 time_t now;
801 gnutls_x509_privkey_t pkey = NULL;
802 const uschar * where;
803 int rc;
804
805 where = US"initialising pkey";
806 if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
807
808 where = US"initialising cert";
809 if ((rc = gnutls_x509_crt_init(&cert))) goto err;
810
811 where = US"generating pkey";
812 if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
813 #ifdef SUPPORT_PARAM_TO_PK_BITS
814 # ifndef GNUTLS_SEC_PARAM_MEDIUM
815 # define GNUTLS_SEC_PARAM_MEDIUM GNUTLS_SEC_PARAM_HIGH
816 # endif
817 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_MEDIUM),
818 #else
819 2048,
820 #endif
821 0)))
822 goto err;
823
824 where = US"configuring cert";
825 now = 1;
826 if ( (rc = gnutls_x509_crt_set_version(cert, 3))
827 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
828 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
829 || (rc = gnutls_x509_crt_set_expiration_time(cert, now + 60 * 60)) /* 1 hr */
830 || (rc = gnutls_x509_crt_set_key(cert, pkey))
831
832 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
833 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
834 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
835 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
836 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
837 GNUTLS_OID_X520_COMMON_NAME, 0,
838 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
839 )
840 goto err;
841
842 where = US"signing cert";
843 if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
844
845 where = US"installing selfsign cert";
846 /* Since: 2.4.0 */
847 if ((rc = gnutls_certificate_set_x509_key(state->x509_cred, &cert, 1, pkey)))
848 goto err;
849
850 rc = OK;
851
852 out:
853 if (cert) gnutls_x509_crt_deinit(cert);
854 if (pkey) gnutls_x509_privkey_deinit(pkey);
855 return rc;
856
857 err:
858 rc = tls_error_gnu(where, rc, NULL, errstr);
859 goto out;
860 }
861
862
863
864
865 /* Add certificate and key, from files.
866
867 Return:
868 Zero or negative: good. Negate value for certificate index if < 0.
869 Greater than zero: FAIL or DEFER code.
870 */
871
872 static int
873 tls_add_certfile(exim_gnutls_state_st * state, const host_item * host,
874 uschar * certfile, uschar * keyfile, uschar ** errstr)
875 {
876 int rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
877 CS certfile, CS keyfile, GNUTLS_X509_FMT_PEM);
878 if (rc < 0)
879 return tls_error_gnu(
880 string_sprintf("cert/key setup: cert=%s key=%s", certfile, keyfile),
881 rc, host, errstr);
882 return -rc;
883 }
884
885
886 #if !defined(DISABLE_OCSP) && !defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
887 /* Load an OCSP proof from file for sending by the server. Called
888 on getting a status-request handshake message, for earlier versions
889 of GnuTLS. */
890
891 static int
892 server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
893 gnutls_datum_t * ocsp_response)
894 {
895 int ret;
896 DEBUG(D_tls) debug_printf("OCSP stapling callback: %s\n", US ptr);
897
898 if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
899 {
900 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
901 CS ptr);
902 tls_in.ocsp = OCSP_NOT_RESP;
903 return GNUTLS_E_NO_CERTIFICATE_STATUS;
904 }
905
906 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
907 return 0;
908 }
909 #endif
910
911
912 #ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
913 /* Make a note that we saw a status-request */
914 static int
915 tls_server_clienthello_ext(void * ctx, unsigned tls_id,
916 const unsigned char *data, unsigned size)
917 {
918 /* https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
919 if (tls_id == 5) /* status_request */
920 {
921 DEBUG(D_tls) debug_printf("Seen status_request extension from client\n");
922 tls_in.ocsp = OCSP_NOT_RESP;
923 }
924 return 0;
925 }
926
927 /* Callback for client-hello, on server, if we think we might serve stapled-OCSP */
928 static int
929 tls_server_clienthello_cb(gnutls_session_t session, unsigned int htype,
930 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
931 {
932 /* Call fn for each extension seen. 3.6.3 onwards */
933 return gnutls_ext_raw_parse(NULL, tls_server_clienthello_ext, msg,
934 GNUTLS_EXT_RAW_FLAG_TLS_CLIENT_HELLO);
935 }
936
937
938 /* Make a note that we saw a status-response */
939 static int
940 tls_server_servercerts_ext(void * ctx, unsigned tls_id,
941 const unsigned char *data, unsigned size)
942 {
943 /* debug_printf("%s %u\n", __FUNCTION__, tls_id); */
944 /* https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
945 if (FALSE && tls_id == 5) /* status_request */
946 {
947 DEBUG(D_tls) debug_printf("Seen status_request extension\n");
948 tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
949 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
950 }
951 return 0;
952 }
953
954 /* Callback for certificates packet, on server, if we think we might serve stapled-OCSP */
955 static int
956 tls_server_servercerts_cb(gnutls_session_t session, unsigned int htype,
957 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
958 {
959 /* Call fn for each extension seen. 3.6.3 onwards */
960 #ifdef notdef
961 /*XXX crashes */
962 return gnutls_ext_raw_parse(NULL, tls_server_servercerts_ext, msg, 0);
963 #endif
964 }
965 #endif
966
967 /*XXX in tls1.3 the cert-status travel as an extension next to the cert, in the
968 "Handshake Protocol: Certificate" record.
969 So we need to spot the Certificate handshake message, parse it and spot any status_request extension(s)
970
971 This is different to tls1.2 - where it is a separate record (wireshake term) / handshake message (gnutls term).
972 */
973
974 #if defined(EXPERIMENTAL_TLS_RESUME) || defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
975 /* Callback for certificate-status, on server. We sent stapled OCSP. */
976 static int
977 tls_server_certstatus_cb(gnutls_session_t session, unsigned int htype,
978 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
979 {
980 DEBUG(D_tls) debug_printf("Sending certificate-status\n"); /*XXX we get this for tls1.2 but not for 1.3 */
981 #ifdef SUPPORT_SRV_OCSP_STACK
982 tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
983 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
984 #else
985 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
986 #endif
987 return 0;
988 }
989
990 /* Callback for handshake messages, on server */
991 static int
992 tls_server_hook_cb(gnutls_session_t sess, u_int htype, unsigned when,
993 unsigned incoming, const gnutls_datum_t * msg)
994 {
995 /* debug_printf("%s: htype %u\n", __FUNCTION__, htype); */
996 switch (htype)
997 {
998 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
999 case GNUTLS_HANDSHAKE_CLIENT_HELLO:
1000 return tls_server_clienthello_cb(sess, htype, when, incoming, msg);
1001 case GNUTLS_HANDSHAKE_CERTIFICATE_PKT:
1002 return tls_server_servercerts_cb(sess, htype, when, incoming, msg);
1003 # endif
1004 case GNUTLS_HANDSHAKE_CERTIFICATE_STATUS:
1005 return tls_server_certstatus_cb(sess, htype, when, incoming, msg);
1006 # ifdef EXPERIMENTAL_TLS_RESUME
1007 case GNUTLS_HANDSHAKE_NEW_SESSION_TICKET:
1008 return tls_server_ticket_cb(sess, htype, when, incoming, msg);
1009 # endif
1010 default:
1011 return 0;
1012 }
1013 }
1014 #endif
1015
1016
1017 #if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1018 static void
1019 tls_server_testharness_ocsp_fiddle(void)
1020 {
1021 extern char ** environ;
1022 if (environ) for (uschar ** p = USS environ; *p; p++)
1023 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1024 {
1025 DEBUG(D_tls) debug_printf("Permitting known bad OCSP response\n");
1026 exim_testharness_disable_ocsp_validity_check = TRUE;
1027 }
1028 }
1029 #endif
1030
1031 /*************************************************
1032 * Variables re-expanded post-SNI *
1033 *************************************************/
1034
1035 /* Called from both server and client code, via tls_init(), and also from
1036 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
1037
1038 We can tell the two apart by state->received_sni being non-NULL in callback.
1039
1040 The callback should not call us unless state->trigger_sni_changes is true,
1041 which we are responsible for setting on the first pass through.
1042
1043 Arguments:
1044 state exim_gnutls_state_st *
1045 errstr error string pointer
1046
1047 Returns: OK/DEFER/FAIL
1048 */
1049
1050 static int
1051 tls_expand_session_files(exim_gnutls_state_st * state, uschar ** errstr)
1052 {
1053 struct stat statbuf;
1054 int rc;
1055 const host_item *host = state->host; /* macro should be reconsidered? */
1056 uschar *saved_tls_certificate = NULL;
1057 uschar *saved_tls_privatekey = NULL;
1058 uschar *saved_tls_verify_certificates = NULL;
1059 uschar *saved_tls_crl = NULL;
1060 int cert_count;
1061
1062 /* We check for tls_sni *before* expansion. */
1063 if (!host) /* server */
1064 if (!state->received_sni)
1065 {
1066 if ( state->tls_certificate
1067 && ( Ustrstr(state->tls_certificate, US"tls_sni")
1068 || Ustrstr(state->tls_certificate, US"tls_in_sni")
1069 || Ustrstr(state->tls_certificate, US"tls_out_sni")
1070 ) )
1071 {
1072 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
1073 state->trigger_sni_changes = TRUE;
1074 }
1075 }
1076 else
1077 {
1078 /* useful for debugging */
1079 saved_tls_certificate = state->exp_tls_certificate;
1080 saved_tls_privatekey = state->exp_tls_privatekey;
1081 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
1082 saved_tls_crl = state->exp_tls_crl;
1083 }
1084
1085 if ((rc = gnutls_certificate_allocate_credentials(&state->x509_cred)))
1086 return tls_error_gnu(US"gnutls_certificate_allocate_credentials",
1087 rc, host, errstr);
1088
1089 #ifdef SUPPORT_SRV_OCSP_STACK
1090 gnutls_certificate_set_flags(state->x509_cred, GNUTLS_CERTIFICATE_API_V2);
1091
1092 # if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1093 if (!host && tls_ocsp_file)
1094 {
1095 if (f.running_in_test_harness)
1096 tls_server_testharness_ocsp_fiddle();
1097
1098 if (exim_testharness_disable_ocsp_validity_check)
1099 gnutls_certificate_set_flags(state->x509_cred,
1100 GNUTLS_CERTIFICATE_API_V2 | GNUTLS_CERTIFICATE_SKIP_OCSP_RESPONSE_CHECK);
1101 }
1102 # endif
1103 #endif
1104
1105 /* remember: expand_check_tlsvar() is expand_check() but fiddling with
1106 state members, assuming consistent naming; and expand_check() returns
1107 false if expansion failed, unless expansion was forced to fail. */
1108
1109 /* check if we at least have a certificate, before doing expensive
1110 D-H generation. */
1111
1112 if (!expand_check_tlsvar(tls_certificate, errstr))
1113 return DEFER;
1114
1115 /* certificate is mandatory in server, optional in client */
1116
1117 if ( !state->exp_tls_certificate
1118 || !*state->exp_tls_certificate
1119 )
1120 if (!host)
1121 return tls_install_selfsign(state, errstr);
1122 else
1123 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
1124
1125 if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey, errstr))
1126 return DEFER;
1127
1128 /* tls_privatekey is optional, defaulting to same file as certificate */
1129
1130 if (!state->tls_privatekey || !*state->tls_privatekey)
1131 {
1132 state->tls_privatekey = state->tls_certificate;
1133 state->exp_tls_privatekey = state->exp_tls_certificate;
1134 }
1135
1136
1137 if (state->exp_tls_certificate && *state->exp_tls_certificate)
1138 {
1139 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
1140 state->exp_tls_certificate, state->exp_tls_privatekey);
1141
1142 if (state->received_sni)
1143 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
1144 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
1145 )
1146 {
1147 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
1148 }
1149 else
1150 {
1151 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
1152 }
1153
1154 if (!host) /* server */
1155 {
1156 const uschar * clist = state->exp_tls_certificate;
1157 const uschar * klist = state->exp_tls_privatekey;
1158 const uschar * olist;
1159 int csep = 0, ksep = 0, osep = 0, cnt = 0;
1160 uschar * cfile, * kfile, * ofile;
1161 #ifndef DISABLE_OCSP
1162 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1163 gnutls_x509_crt_fmt_t ocsp_fmt = GNUTLS_X509_FMT_DER;
1164 # endif
1165
1166 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file", &ofile, errstr))
1167 return DEFER;
1168 olist = ofile;
1169 #endif
1170
1171 while (cfile = string_nextinlist(&clist, &csep, NULL, 0))
1172
1173 if (!(kfile = string_nextinlist(&klist, &ksep, NULL, 0)))
1174 return tls_error(US"cert/key setup: out of keys", NULL, host, errstr);
1175 else if (0 < (rc = tls_add_certfile(state, host, cfile, kfile, errstr)))
1176 return rc;
1177 else
1178 {
1179 int gnutls_cert_index = -rc;
1180 DEBUG(D_tls) debug_printf("TLS: cert/key %d %s registered\n",
1181 gnutls_cert_index, cfile);
1182
1183 #ifndef DISABLE_OCSP
1184 if (tls_ocsp_file)
1185 {
1186 /* Set the OCSP stapling server info */
1187 if (gnutls_buggy_ocsp)
1188 {
1189 DEBUG(D_tls)
1190 debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
1191 }
1192 else if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1193 {
1194 DEBUG(D_tls) debug_printf("OCSP response file %d = %s\n",
1195 gnutls_cert_index, ofile);
1196 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1197 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
1198 {
1199 ocsp_fmt = GNUTLS_X509_FMT_PEM;
1200 ofile += 4;
1201 }
1202 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1203 {
1204 ocsp_fmt = GNUTLS_X509_FMT_DER;
1205 ofile += 4;
1206 }
1207
1208 if ((rc = gnutls_certificate_set_ocsp_status_request_file2(
1209 state->x509_cred, CCS ofile, gnutls_cert_index,
1210 ocsp_fmt)) < 0)
1211 return tls_error_gnu(
1212 US"gnutls_certificate_set_ocsp_status_request_file2",
1213 rc, host, errstr);
1214 DEBUG(D_tls)
1215 debug_printf(" %d response%s loaded\n", rc, rc>1 ? "s":"");
1216
1217 /* Arrange callbacks for OCSP request observability */
1218
1219 gnutls_handshake_set_hook_function(state->session,
1220 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
1221
1222 # else
1223 # if defined(SUPPORT_SRV_OCSP_STACK)
1224 if ((rc = gnutls_certificate_set_ocsp_status_request_function2(
1225 state->x509_cred, gnutls_cert_index,
1226 server_ocsp_stapling_cb, ofile)))
1227 return tls_error_gnu(
1228 US"gnutls_certificate_set_ocsp_status_request_function2",
1229 rc, host, errstr);
1230 else
1231 # endif
1232 {
1233 if (cnt++ > 0)
1234 {
1235 DEBUG(D_tls)
1236 debug_printf("oops; multiple OCSP files not supported\n");
1237 break;
1238 }
1239 gnutls_certificate_set_ocsp_status_request_function(
1240 state->x509_cred, server_ocsp_stapling_cb, ofile);
1241 }
1242 # endif /* SUPPORT_GNUTLS_EXT_RAW_PARSE */
1243 }
1244 else
1245 DEBUG(D_tls) debug_printf("ran out of OCSP response files in list\n");
1246 }
1247 #endif /* DISABLE_OCSP */
1248 }
1249 }
1250 else /* client */
1251 {
1252 if (0 < (rc = tls_add_certfile(state, host,
1253 state->exp_tls_certificate, state->exp_tls_privatekey, errstr)))
1254 return rc;
1255 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
1256 }
1257
1258 } /* tls_certificate */
1259
1260
1261 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
1262 provided. Experiment shows that, if the certificate file is empty, an unhelpful
1263 error message is provided. However, if we just refrain from setting anything up
1264 in that case, certificate verification fails, which seems to be the correct
1265 behaviour. */
1266
1267 if (state->tls_verify_certificates && *state->tls_verify_certificates)
1268 {
1269 if (!expand_check_tlsvar(tls_verify_certificates, errstr))
1270 return DEFER;
1271 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1272 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1273 state->exp_tls_verify_certificates = NULL;
1274 #endif
1275 if (state->tls_crl && *state->tls_crl)
1276 if (!expand_check_tlsvar(tls_crl, errstr))
1277 return DEFER;
1278
1279 if (!(state->exp_tls_verify_certificates &&
1280 *state->exp_tls_verify_certificates))
1281 {
1282 DEBUG(D_tls)
1283 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
1284 /* With no tls_verify_certificates, we ignore tls_crl too */
1285 return OK;
1286 }
1287 }
1288 else
1289 {
1290 DEBUG(D_tls)
1291 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
1292 return OK;
1293 }
1294
1295 #ifdef SUPPORT_SYSDEFAULT_CABUNDLE
1296 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1297 cert_count = gnutls_certificate_set_x509_system_trust(state->x509_cred);
1298 else
1299 #endif
1300 {
1301 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
1302 {
1303 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat '%s' "
1304 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
1305 strerror(errno));
1306 return DEFER;
1307 }
1308
1309 #ifndef SUPPORT_CA_DIR
1310 /* The test suite passes in /dev/null; we could check for that path explicitly,
1311 but who knows if someone has some weird FIFO which always dumps some certs, or
1312 other weirdness. The thing we really want to check is that it's not a
1313 directory, since while OpenSSL supports that, GnuTLS does not.
1314 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
1315 if (S_ISDIR(statbuf.st_mode))
1316 {
1317 DEBUG(D_tls)
1318 debug_printf("verify certificates path is a dir: \"%s\"\n",
1319 state->exp_tls_verify_certificates);
1320 log_write(0, LOG_MAIN|LOG_PANIC,
1321 "tls_verify_certificates \"%s\" is a directory",
1322 state->exp_tls_verify_certificates);
1323 return DEFER;
1324 }
1325 #endif
1326
1327 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
1328 state->exp_tls_verify_certificates, statbuf.st_size);
1329
1330 if (statbuf.st_size == 0)
1331 {
1332 DEBUG(D_tls)
1333 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
1334 return OK;
1335 }
1336
1337 cert_count =
1338
1339 #ifdef SUPPORT_CA_DIR
1340 (statbuf.st_mode & S_IFMT) == S_IFDIR
1341 ?
1342 gnutls_certificate_set_x509_trust_dir(state->x509_cred,
1343 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM)
1344 :
1345 #endif
1346 gnutls_certificate_set_x509_trust_file(state->x509_cred,
1347 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
1348
1349 #ifdef SUPPORT_CA_DIR
1350 /* Mimic the behaviour with OpenSSL of not advertising a usable-cert list
1351 when using the directory-of-certs config model. */
1352
1353 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1354 gnutls_certificate_send_x509_rdn_sequence(state->session, 1);
1355 #endif
1356 }
1357
1358 if (cert_count < 0)
1359 return tls_error_gnu(US"setting certificate trust", cert_count, host, errstr);
1360 DEBUG(D_tls)
1361 debug_printf("Added %d certificate authorities.\n", cert_count);
1362
1363 if (state->tls_crl && *state->tls_crl &&
1364 state->exp_tls_crl && *state->exp_tls_crl)
1365 {
1366 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
1367 if ((cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
1368 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM)) < 0)
1369 return tls_error_gnu(US"gnutls_certificate_set_x509_crl_file",
1370 cert_count, host, errstr);
1371
1372 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1373 }
1374
1375 return OK;
1376 }
1377
1378
1379
1380
1381 /*************************************************
1382 * Set X.509 state variables *
1383 *************************************************/
1384
1385 /* In GnuTLS, the registered cert/key are not replaced by a later
1386 set of a cert/key, so for SNI support we need a whole new x509_cred
1387 structure. Which means various other non-re-expanded pieces of state
1388 need to be re-set in the new struct, so the setting logic is pulled
1389 out to this.
1390
1391 Arguments:
1392 state exim_gnutls_state_st *
1393 errstr error string pointer
1394
1395 Returns: OK/DEFER/FAIL
1396 */
1397
1398 static int
1399 tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr)
1400 {
1401 int rc;
1402 const host_item *host = state->host; /* macro should be reconsidered? */
1403
1404 #ifndef GNUTLS_AUTO_DHPARAMS
1405 /* Create D-H parameters, or read them from the cache file. This function does
1406 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
1407 client-side params. */
1408
1409 if (!state->host)
1410 {
1411 if (!dh_server_params)
1412 if ((rc = init_server_dh(errstr)) != OK) return rc;
1413
1414 /* Unnecessary & discouraged with 3.6.0 or later */
1415 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
1416 }
1417 #endif
1418
1419 /* Link the credentials to the session. */
1420
1421 if ((rc = gnutls_credentials_set(state->session,
1422 GNUTLS_CRD_CERTIFICATE, state->x509_cred)))
1423 return tls_error_gnu(US"gnutls_credentials_set", rc, host, errstr);
1424
1425 return OK;
1426 }
1427
1428 /*************************************************
1429 * Initialize for GnuTLS *
1430 *************************************************/
1431
1432
1433 #ifndef DISABLE_OCSP
1434
1435 static BOOL
1436 tls_is_buggy_ocsp(void)
1437 {
1438 const uschar * s;
1439 uschar maj, mid, mic;
1440
1441 s = CUS gnutls_check_version(NULL);
1442 maj = atoi(CCS s);
1443 if (maj == 3)
1444 {
1445 while (*s && *s != '.') s++;
1446 mid = atoi(CCS ++s);
1447 if (mid <= 2)
1448 return TRUE;
1449 else if (mid >= 5)
1450 return FALSE;
1451 else
1452 {
1453 while (*s && *s != '.') s++;
1454 mic = atoi(CCS ++s);
1455 return mic <= (mid == 3 ? 16 : 3);
1456 }
1457 }
1458 return FALSE;
1459 }
1460
1461 #endif
1462
1463
1464 /* Called from both server and client code. In the case of a server, errors
1465 before actual TLS negotiation return DEFER.
1466
1467 Arguments:
1468 host connected host, if client; NULL if server
1469 certificate certificate file
1470 privatekey private key file
1471 sni TLS SNI to send, sometimes when client; else NULL
1472 cas CA certs file
1473 crl CRL file
1474 require_ciphers tls_require_ciphers setting
1475 caller_state returned state-info structure
1476 errstr error string pointer
1477
1478 Returns: OK/DEFER/FAIL
1479 */
1480
1481 static int
1482 tls_init(
1483 const host_item *host,
1484 const uschar *certificate,
1485 const uschar *privatekey,
1486 const uschar *sni,
1487 const uschar *cas,
1488 const uschar *crl,
1489 const uschar *require_ciphers,
1490 exim_gnutls_state_st **caller_state,
1491 tls_support * tlsp,
1492 uschar ** errstr)
1493 {
1494 exim_gnutls_state_st * state;
1495 int rc;
1496 size_t sz;
1497 const char * errpos;
1498 const uschar * p;
1499
1500 if (!exim_gnutls_base_init_done)
1501 {
1502 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1503
1504 #if defined(HAVE_GNUTLS_PKCS11) && !defined(GNUTLS_AUTO_PKCS11_MANUAL)
1505 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1506 which loads modules from a config file, which sounds good and may be wanted
1507 by some sysadmin, but also means in common configurations that GNOME keyring
1508 environment variables are used and so breaks for users calling mailq.
1509 To prevent this, we init PKCS11 first, which is the documented approach. */
1510 if (!gnutls_allow_auto_pkcs11)
1511 if ((rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL)))
1512 return tls_error_gnu(US"gnutls_pkcs11_init", rc, host, errstr);
1513 #endif
1514
1515 #ifndef GNUTLS_AUTO_GLOBAL_INIT
1516 if ((rc = gnutls_global_init()))
1517 return tls_error_gnu(US"gnutls_global_init", rc, host, errstr);
1518 #endif
1519
1520 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1521 DEBUG(D_tls)
1522 {
1523 gnutls_global_set_log_function(exim_gnutls_logger_cb);
1524 /* arbitrarily chosen level; bump up to 9 for more */
1525 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
1526 }
1527 #endif
1528
1529 #ifndef DISABLE_OCSP
1530 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
1531 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
1532 #endif
1533
1534 exim_gnutls_base_init_done = TRUE;
1535 }
1536
1537 if (host)
1538 {
1539 /* For client-side sessions we allocate a context. This lets us run
1540 several in parallel. */
1541 int old_pool = store_pool;
1542 store_pool = POOL_PERM;
1543 state = store_get(sizeof(exim_gnutls_state_st), FALSE);
1544 store_pool = old_pool;
1545
1546 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1547 state->tlsp = tlsp;
1548 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1549 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1550 }
1551 else
1552 {
1553 state = &state_server;
1554 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1555 state->tlsp = tlsp;
1556 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1557 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1558 }
1559 if (rc)
1560 return tls_error_gnu(US"gnutls_init", rc, host, errstr);
1561
1562 state->host = host;
1563
1564 state->tls_certificate = certificate;
1565 state->tls_privatekey = privatekey;
1566 state->tls_require_ciphers = require_ciphers;
1567 state->tls_sni = sni;
1568 state->tls_verify_certificates = cas;
1569 state->tls_crl = crl;
1570
1571 /* This handles the variables that might get re-expanded after TLS SNI;
1572 that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
1573
1574 DEBUG(D_tls)
1575 debug_printf("Expanding various TLS configuration options for session credentials.\n");
1576 if ((rc = tls_expand_session_files(state, errstr)) != OK) return rc;
1577
1578 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1579 requires a new structure afterwards. */
1580
1581 if ((rc = tls_set_remaining_x509(state, errstr)) != OK) return rc;
1582
1583 /* set SNI in client, only */
1584 if (host)
1585 {
1586 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni, errstr))
1587 return DEFER;
1588 if (state->tlsp->sni && *state->tlsp->sni)
1589 {
1590 DEBUG(D_tls)
1591 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1592 sz = Ustrlen(state->tlsp->sni);
1593 if ((rc = gnutls_server_name_set(state->session,
1594 GNUTLS_NAME_DNS, state->tlsp->sni, sz)))
1595 return tls_error_gnu(US"gnutls_server_name_set", rc, host, errstr);
1596 }
1597 }
1598 else if (state->tls_sni)
1599 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
1600 "have an SNI set for a server [%s]\n", state->tls_sni);
1601
1602 /* This is the priority string support,
1603 http://www.gnutls.org/manual/html_node/Priority-Strings.html
1604 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1605 This was backwards incompatible, but means Exim no longer needs to track
1606 all algorithms and provide string forms for them. */
1607
1608 p = NULL;
1609 if (state->tls_require_ciphers && *state->tls_require_ciphers)
1610 {
1611 if (!expand_check_tlsvar(tls_require_ciphers, errstr))
1612 return DEFER;
1613 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
1614 {
1615 p = state->exp_tls_require_ciphers;
1616 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n", p);
1617 }
1618 }
1619 if (!p)
1620 {
1621 p = exim_default_gnutls_priority;
1622 DEBUG(D_tls)
1623 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n", p);
1624 }
1625
1626 if ((rc = gnutls_priority_init(&state->priority_cache, CCS p, &errpos)))
1627 return tls_error_gnu(string_sprintf(
1628 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1629 p, errpos - CS p, errpos),
1630 rc, host, errstr);
1631
1632 if ((rc = gnutls_priority_set(state->session, state->priority_cache)))
1633 return tls_error_gnu(US"gnutls_priority_set", rc, host, errstr);
1634
1635 /* This also sets the server ticket expiration time to the same, and
1636 the STEK rotation time to 3x. */
1637
1638 gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1639
1640 /* Reduce security in favour of increased compatibility, if the admin
1641 decides to make that trade-off. */
1642 if (gnutls_compat_mode)
1643 {
1644 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1645 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1646 gnutls_session_enable_compatibility_mode(state->session);
1647 #else
1648 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1649 #endif
1650 }
1651
1652 *caller_state = state;
1653 return OK;
1654 }
1655
1656
1657
1658 /*************************************************
1659 * Extract peer information *
1660 *************************************************/
1661
1662 static const uschar *
1663 cipher_stdname_kcm(gnutls_kx_algorithm_t kx, gnutls_cipher_algorithm_t cipher,
1664 gnutls_mac_algorithm_t mac)
1665 {
1666 uschar cs_id[2];
1667 gnutls_kx_algorithm_t kx_i;
1668 gnutls_cipher_algorithm_t cipher_i;
1669 gnutls_mac_algorithm_t mac_i;
1670
1671 for (size_t i = 0;
1672 gnutls_cipher_suite_info(i, cs_id, &kx_i, &cipher_i, &mac_i, NULL);
1673 i++)
1674 if (kx_i == kx && cipher_i == cipher && mac_i == mac)
1675 return cipher_stdname(cs_id[0], cs_id[1]);
1676 return NULL;
1677 }
1678
1679
1680
1681 /* Called from both server and client code.
1682 Only this is allowed to set state->peerdn and state->have_set_peerdn
1683 and we use that to detect double-calls.
1684
1685 NOTE: the state blocks last while the TLS connection is up, which is fine
1686 for logging in the server side, but for the client side, we log after teardown
1687 in src/deliver.c. While the session is up, we can twist about states and
1688 repoint tls_* globals, but those variables used for logging or other variable
1689 expansion that happens _after_ delivery need to have a longer life-time.
1690
1691 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1692 doing this more than once per generation of a state context. We set them in
1693 the state context, and repoint tls_* to them. After the state goes away, the
1694 tls_* copies of the pointers remain valid and client delivery logging is happy.
1695
1696 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1697 don't apply.
1698
1699 Arguments:
1700 state exim_gnutls_state_st *
1701 errstr pointer to error string
1702
1703 Returns: OK/DEFER/FAIL
1704 */
1705
1706 static int
1707 peer_status(exim_gnutls_state_st * state, uschar ** errstr)
1708 {
1709 gnutls_session_t session = state->session;
1710 const gnutls_datum_t * cert_list;
1711 int old_pool, rc;
1712 unsigned int cert_list_size = 0;
1713 gnutls_protocol_t protocol;
1714 gnutls_cipher_algorithm_t cipher;
1715 gnutls_kx_algorithm_t kx;
1716 gnutls_mac_algorithm_t mac;
1717 gnutls_certificate_type_t ct;
1718 gnutls_x509_crt_t crt;
1719 uschar * dn_buf;
1720 size_t sz;
1721
1722 if (state->have_set_peerdn)
1723 return OK;
1724 state->have_set_peerdn = TRUE;
1725
1726 state->peerdn = NULL;
1727
1728 /* tls_cipher */
1729 cipher = gnutls_cipher_get(session);
1730 protocol = gnutls_protocol_get_version(session);
1731 mac = gnutls_mac_get(session);
1732 kx =
1733 #ifdef GNUTLS_TLS1_3
1734 protocol >= GNUTLS_TLS1_3 ? 0 :
1735 #endif
1736 gnutls_kx_get(session);
1737
1738 old_pool = store_pool;
1739 {
1740 tls_support * tlsp = state->tlsp;
1741 store_pool = POOL_PERM;
1742
1743 #ifdef SUPPORT_GNUTLS_SESS_DESC
1744 {
1745 gstring * g = NULL;
1746 uschar * s = US gnutls_session_get_desc(session), c;
1747
1748 /* Nikos M suggests we use this by preference. It returns like:
1749 (TLS1.3)-(ECDHE-SECP256R1)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM)
1750
1751 For partial back-compat, put a colon after the TLS version, replace the
1752 )-( grouping with __, replace in-group - with _ and append the :keysize. */
1753
1754 /* debug_printf("peer_status: gnutls_session_get_desc %s\n", s); */
1755
1756 for (s++; (c = *s) && c != ')'; s++) g = string_catn(g, s, 1);
1757 g = string_catn(g, US":", 1);
1758 if (*s) s++; /* now on _ between groups */
1759 while ((c = *s))
1760 {
1761 for (*++s && ++s; (c = *s) && c != ')'; s++) g = string_catn(g, c == '-' ? US"_" : s, 1);
1762 /* now on ) closing group */
1763 if ((c = *s) && *++s == '-') g = string_catn(g, US"__", 2);
1764 /* now on _ between groups */
1765 }
1766 g = string_catn(g, US":", 1);
1767 g = string_cat(g, string_sprintf("%d", (int) gnutls_cipher_get_key_size(cipher) * 8));
1768 state->ciphersuite = string_from_gstring(g);
1769 }
1770 #else
1771 state->ciphersuite = string_sprintf("%s:%s:%d",
1772 gnutls_protocol_get_name(protocol),
1773 gnutls_cipher_suite_get_name(kx, cipher, mac),
1774 (int) gnutls_cipher_get_key_size(cipher) * 8);
1775
1776 /* I don't see a way that spaces could occur, in the current GnuTLS
1777 code base, but it was a concern in the old code and perhaps older GnuTLS
1778 releases did return "TLS 1.0"; play it safe, just in case. */
1779
1780 for (uschar * p = state->ciphersuite; *p; p++) if (isspace(*p)) *p = '-';
1781 #endif
1782
1783 /* debug_printf("peer_status: ciphersuite %s\n", state->ciphersuite); */
1784
1785 tlsp->cipher = state->ciphersuite;
1786 tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
1787
1788 tlsp->cipher_stdname = cipher_stdname_kcm(kx, cipher, mac);
1789 }
1790 store_pool = old_pool;
1791
1792 /* tls_peerdn */
1793 cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
1794
1795 if (!cert_list || cert_list_size == 0)
1796 {
1797 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1798 cert_list, cert_list_size);
1799 if (state->verify_requirement >= VERIFY_REQUIRED)
1800 return tls_error(US"certificate verification failed",
1801 US"no certificate received from peer", state->host, errstr);
1802 return OK;
1803 }
1804
1805 if ((ct = gnutls_certificate_type_get(session)) != GNUTLS_CRT_X509)
1806 {
1807 const uschar * ctn = US gnutls_certificate_type_get_name(ct);
1808 DEBUG(D_tls)
1809 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
1810 if (state->verify_requirement >= VERIFY_REQUIRED)
1811 return tls_error(US"certificate verification not possible, unhandled type",
1812 ctn, state->host, errstr);
1813 return OK;
1814 }
1815
1816 #define exim_gnutls_peer_err(Label) \
1817 do { \
1818 if (rc != GNUTLS_E_SUCCESS) \
1819 { \
1820 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1821 (Label), gnutls_strerror(rc)); \
1822 if (state->verify_requirement >= VERIFY_REQUIRED) \
1823 return tls_error_gnu((Label), rc, state->host, errstr); \
1824 return OK; \
1825 } \
1826 } while (0)
1827
1828 rc = import_cert(&cert_list[0], &crt);
1829 exim_gnutls_peer_err(US"cert 0");
1830
1831 state->tlsp->peercert = state->peercert = crt;
1832
1833 sz = 0;
1834 rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1835 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
1836 {
1837 exim_gnutls_peer_err(US"getting size for cert DN failed");
1838 return FAIL; /* should not happen */
1839 }
1840 dn_buf = store_get_perm(sz, TRUE); /* tainted */
1841 rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1842 exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1843
1844 state->peerdn = dn_buf;
1845
1846 return OK;
1847 #undef exim_gnutls_peer_err
1848 }
1849
1850
1851
1852
1853 /*************************************************
1854 * Verify peer certificate *
1855 *************************************************/
1856
1857 /* Called from both server and client code.
1858 *Should* be using a callback registered with
1859 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1860 the peer information, but that's too new for some OSes.
1861
1862 Arguments:
1863 state exim_gnutls_state_st *
1864 errstr where to put an error message
1865
1866 Returns:
1867 FALSE if the session should be rejected
1868 TRUE if the cert is okay or we just don't care
1869 */
1870
1871 static BOOL
1872 verify_certificate(exim_gnutls_state_st * state, uschar ** errstr)
1873 {
1874 int rc;
1875 uint verify;
1876
1877 DEBUG(D_tls) debug_printf("TLS: checking peer certificate\n");
1878 *errstr = NULL;
1879 rc = peer_status(state, errstr);
1880
1881 if (state->verify_requirement == VERIFY_NONE)
1882 return TRUE;
1883
1884 if (rc != OK || !state->peerdn)
1885 {
1886 verify = GNUTLS_CERT_INVALID;
1887 *errstr = US"certificate not supplied";
1888 }
1889 else
1890
1891 {
1892 #ifdef SUPPORT_DANE
1893 if (state->verify_requirement == VERIFY_DANE && state->host)
1894 {
1895 /* Using dane_verify_session_crt() would be easy, as it does it all for us
1896 including talking to a DNS resolver. But we want to do that bit ourselves
1897 as the testsuite intercepts and fakes its own DNS environment. */
1898
1899 dane_state_t s;
1900 dane_query_t r;
1901 uint lsize;
1902 const gnutls_datum_t * certlist =
1903 gnutls_certificate_get_peers(state->session, &lsize);
1904 int usage = tls_out.tlsa_usage;
1905
1906 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
1907 /* Split the TLSA records into two sets, TA and EE selectors. Run the
1908 dane-verification separately so that we know which selector verified;
1909 then we know whether to do name-verification (needed for TA but not EE). */
1910
1911 if (usage == ((1<<DANESSL_USAGE_DANE_TA) | (1<<DANESSL_USAGE_DANE_EE)))
1912 { /* a mixed-usage bundle */
1913 int i, j, nrec;
1914 const char ** dd;
1915 int * ddl;
1916
1917 for(nrec = 0; state->dane_data_len[nrec]; ) nrec++;
1918 nrec++;
1919
1920 dd = store_get(nrec * sizeof(uschar *), FALSE);
1921 ddl = store_get(nrec * sizeof(int), FALSE);
1922 nrec--;
1923
1924 if ((rc = dane_state_init(&s, 0)))
1925 goto tlsa_prob;
1926
1927 for (usage = DANESSL_USAGE_DANE_EE;
1928 usage >= DANESSL_USAGE_DANE_TA; usage--)
1929 { /* take records with this usage */
1930 for (j = i = 0; i < nrec; i++)
1931 if (state->dane_data[i][0] == usage)
1932 {
1933 dd[j] = state->dane_data[i];
1934 ddl[j++] = state->dane_data_len[i];
1935 }
1936 if (j)
1937 {
1938 dd[j] = NULL;
1939 ddl[j] = 0;
1940
1941 if ((rc = dane_raw_tlsa(s, &r, (char * const *)dd, ddl, 1, 0)))
1942 goto tlsa_prob;
1943
1944 if ((rc = dane_verify_crt_raw(s, certlist, lsize,
1945 gnutls_certificate_type_get(state->session),
1946 r, 0,
1947 usage == DANESSL_USAGE_DANE_EE
1948 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1949 &verify)))
1950 {
1951 DEBUG(D_tls)
1952 debug_printf("TLSA record problem: %s\n", dane_strerror(rc));
1953 }
1954 else if (verify == 0) /* verification passed */
1955 {
1956 usage = 1 << usage;
1957 break;
1958 }
1959 }
1960 }
1961
1962 if (rc) goto tlsa_prob;
1963 }
1964 else
1965 # endif
1966 {
1967 if ( (rc = dane_state_init(&s, 0))
1968 || (rc = dane_raw_tlsa(s, &r, state->dane_data, state->dane_data_len,
1969 1, 0))
1970 || (rc = dane_verify_crt_raw(s, certlist, lsize,
1971 gnutls_certificate_type_get(state->session),
1972 r, 0,
1973 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
1974 usage == (1 << DANESSL_USAGE_DANE_EE)
1975 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1976 # else
1977 0,
1978 # endif
1979 &verify))
1980 )
1981 goto tlsa_prob;
1982 }
1983
1984 if (verify != 0) /* verification failed */
1985 {
1986 gnutls_datum_t str;
1987 (void) dane_verification_status_print(verify, &str, 0);
1988 *errstr = US str.data; /* don't bother to free */
1989 goto badcert;
1990 }
1991
1992 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
1993 /* If a TA-mode TLSA record was used for verification we must additionally
1994 verify the cert name (but not the CA chain). For EE-mode, skip it. */
1995
1996 if (usage & (1 << DANESSL_USAGE_DANE_EE))
1997 # endif
1998 {
1999 state->peer_dane_verified = state->peer_cert_verified = TRUE;
2000 goto goodcert;
2001 }
2002 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2003 /* Assume that the name on the A-record is the one that should be matching
2004 the cert. An alternate view is that the domain part of the email address
2005 is also permissible. */
2006
2007 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert,
2008 CS state->host->name))
2009 {
2010 state->peer_dane_verified = state->peer_cert_verified = TRUE;
2011 goto goodcert;
2012 }
2013 # endif
2014 }
2015 #endif /*SUPPORT_DANE*/
2016
2017 rc = gnutls_certificate_verify_peers2(state->session, &verify);
2018 }
2019
2020 /* Handle the result of verification. INVALID is set if any others are. */
2021
2022 if (rc < 0 || verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED))
2023 {
2024 state->peer_cert_verified = FALSE;
2025 if (!*errstr)
2026 {
2027 #ifdef GNUTLS_CERT_VFY_STATUS_PRINT
2028 DEBUG(D_tls)
2029 {
2030 gnutls_datum_t txt;
2031
2032 if (gnutls_certificate_verification_status_print(verify,
2033 gnutls_certificate_type_get(state->session), &txt, 0)
2034 == GNUTLS_E_SUCCESS)
2035 {
2036 debug_printf("%s\n", txt.data);
2037 gnutls_free(txt.data);
2038 }
2039 }
2040 #endif
2041 *errstr = verify & GNUTLS_CERT_REVOKED
2042 ? US"certificate revoked" : US"certificate invalid";
2043 }
2044
2045 DEBUG(D_tls)
2046 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
2047 *errstr, state->peerdn ? state->peerdn : US"<unset>");
2048
2049 if (state->verify_requirement >= VERIFY_REQUIRED)
2050 goto badcert;
2051 DEBUG(D_tls)
2052 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
2053 }
2054
2055 else
2056 {
2057 /* Client side, check the server's certificate name versus the name on the
2058 A-record for the connection we made. What to do for server side - what name
2059 to use for client? We document that there is no such checking for server
2060 side. */
2061
2062 if ( state->exp_tls_verify_cert_hostnames
2063 && !gnutls_x509_crt_check_hostname(state->tlsp->peercert,
2064 CS state->exp_tls_verify_cert_hostnames)
2065 )
2066 {
2067 DEBUG(D_tls)
2068 debug_printf("TLS certificate verification failed: cert name mismatch\n");
2069 if (state->verify_requirement >= VERIFY_REQUIRED)
2070 goto badcert;
2071 return TRUE;
2072 }
2073
2074 state->peer_cert_verified = TRUE;
2075 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
2076 state->peerdn ? state->peerdn : US"<unset>");
2077 }
2078
2079 goodcert:
2080 state->tlsp->peerdn = state->peerdn;
2081 return TRUE;
2082
2083 #ifdef SUPPORT_DANE
2084 tlsa_prob:
2085 *errstr = string_sprintf("TLSA record problem: %s",
2086 rc == DANE_E_REQUESTED_DATA_NOT_AVAILABLE ? "none usable" : dane_strerror(rc));
2087 #endif
2088
2089 badcert:
2090 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
2091 return FALSE;
2092 }
2093
2094
2095
2096
2097 /* ------------------------------------------------------------------------ */
2098 /* Callbacks */
2099
2100 /* Logging function which can be registered with
2101 * gnutls_global_set_log_function()
2102 * gnutls_global_set_log_level() 0..9
2103 */
2104 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
2105 static void
2106 exim_gnutls_logger_cb(int level, const char *message)
2107 {
2108 size_t len = strlen(message);
2109 if (len < 1)
2110 {
2111 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
2112 return;
2113 }
2114 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
2115 message[len-1] == '\n' ? "" : "\n");
2116 }
2117 #endif
2118
2119
2120 /* Called after client hello, should handle SNI work.
2121 This will always set tls_sni (state->received_sni) if available,
2122 and may trigger presenting different certificates,
2123 if state->trigger_sni_changes is TRUE.
2124
2125 Should be registered with
2126 gnutls_handshake_set_post_client_hello_function()
2127
2128 "This callback must return 0 on success or a gnutls error code to terminate the
2129 handshake.".
2130
2131 For inability to get SNI information, we return 0.
2132 We only return non-zero if re-setup failed.
2133 Only used for server-side TLS.
2134 */
2135
2136 static int
2137 exim_sni_handling_cb(gnutls_session_t session)
2138 {
2139 char sni_name[MAX_HOST_LEN];
2140 size_t data_len = MAX_HOST_LEN;
2141 exim_gnutls_state_st *state = &state_server;
2142 unsigned int sni_type;
2143 int rc, old_pool;
2144 uschar * dummy_errstr;
2145
2146 rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
2147 if (rc != GNUTLS_E_SUCCESS)
2148 {
2149 DEBUG(D_tls)
2150 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
2151 debug_printf("TLS: no SNI presented in handshake.\n");
2152 else
2153 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
2154 gnutls_strerror(rc), rc);
2155 return 0;
2156 }
2157
2158 if (sni_type != GNUTLS_NAME_DNS)
2159 {
2160 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
2161 return 0;
2162 }
2163
2164 /* We now have a UTF-8 string in sni_name */
2165 old_pool = store_pool;
2166 store_pool = POOL_PERM;
2167 state->received_sni = string_copy_taint(US sni_name, TRUE);
2168 store_pool = old_pool;
2169
2170 /* We set this one now so that variable expansions below will work */
2171 state->tlsp->sni = state->received_sni;
2172
2173 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
2174 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
2175
2176 if (!state->trigger_sni_changes)
2177 return 0;
2178
2179 if ((rc = tls_expand_session_files(state, &dummy_errstr)) != OK)
2180 {
2181 /* If the setup of certs/etc failed before handshake, TLS would not have
2182 been offered. The best we can do now is abort. */
2183 return GNUTLS_E_APPLICATION_ERROR_MIN;
2184 }
2185
2186 rc = tls_set_remaining_x509(state, &dummy_errstr);
2187 if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
2188
2189 return 0;
2190 }
2191
2192
2193
2194 #ifndef DISABLE_EVENT
2195 /*
2196 We use this callback to get observability and detail-level control
2197 for an exim TLS connection (either direction), raising a tls:cert event
2198 for each cert in the chain presented by the peer. Any event
2199 can deny verification.
2200
2201 Return 0 for the handshake to continue or non-zero to terminate.
2202 */
2203
2204 static int
2205 verify_cb(gnutls_session_t session)
2206 {
2207 const gnutls_datum_t * cert_list;
2208 unsigned int cert_list_size = 0;
2209 gnutls_x509_crt_t crt;
2210 int rc;
2211 uschar * yield;
2212 exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
2213
2214 if ((cert_list = gnutls_certificate_get_peers(session, &cert_list_size)))
2215 while (cert_list_size--)
2216 {
2217 if ((rc = import_cert(&cert_list[cert_list_size], &crt)) != GNUTLS_E_SUCCESS)
2218 {
2219 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
2220 cert_list_size, gnutls_strerror(rc));
2221 break;
2222 }
2223
2224 state->tlsp->peercert = crt;
2225 if ((yield = event_raise(state->event_action,
2226 US"tls:cert", string_sprintf("%d", cert_list_size))))
2227 {
2228 log_write(0, LOG_MAIN,
2229 "SSL verify denied by event-action: depth=%d: %s",
2230 cert_list_size, yield);
2231 return 1; /* reject */
2232 }
2233 state->tlsp->peercert = NULL;
2234 }
2235
2236 return 0;
2237 }
2238
2239 #endif
2240
2241
2242 static gstring *
2243 ddump(gnutls_datum_t * d)
2244 {
2245 gstring * g = string_get((d->size+1) * 2);
2246 uschar * s = d->data;
2247 for (unsigned i = d->size; i > 0; i--, s++)
2248 {
2249 g = string_catn(g, US "0123456789abcdef" + (*s >> 4), 1);
2250 g = string_catn(g, US "0123456789abcdef" + (*s & 0xf), 1);
2251 }
2252 return g;
2253 }
2254
2255 static void
2256 post_handshake_debug(exim_gnutls_state_st * state)
2257 {
2258 #ifdef SUPPORT_GNUTLS_SESS_DESC
2259 debug_printf("%s\n", gnutls_session_get_desc(state->session));
2260 #endif
2261 #ifdef SUPPORT_GNUTLS_KEYLOG
2262
2263 # ifdef EXIM_HAVE_TLS1_3
2264 if (gnutls_protocol_get_version(state->session) < GNUTLS_TLS1_3)
2265 #else
2266 if (TRUE)
2267 #endif
2268 {
2269 gnutls_datum_t c, s;
2270 gstring * gc, * gs;
2271 /* we only want the client random and the master secret */
2272 gnutls_session_get_random(state->session, &c, &s);
2273 gnutls_session_get_master_secret(state->session, &s);
2274 gc = ddump(&c);
2275 gs = ddump(&s);
2276 debug_printf("CLIENT_RANDOM %.*s %.*s\n", (int)gc->ptr, gc->s, (int)gs->ptr, gs->s);
2277 }
2278 else
2279 debug_printf("To get keying info for TLS1.3 is hard:\n"
2280 " set environment variable SSLKEYLOGFILE to a filename writable by uid exim\n"
2281 " add SSLKEYLOGFILE to keep_environment in the exim config\n"
2282 " run exim as root\n"
2283 " if using sudo, add SSLKEYLOGFILE to env_keep in /etc/sudoers\n"
2284 " (works for TLS1.2 also, and saves cut-paste into file)\n");
2285 #endif
2286 }
2287
2288
2289 #ifdef EXPERIMENTAL_TLS_RESUME
2290 static int
2291 tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
2292 unsigned incoming, const gnutls_datum_t * msg)
2293 {
2294 DEBUG(D_tls) debug_printf("newticket cb\n");
2295 tls_in.resumption |= RESUME_CLIENT_REQUESTED;
2296 return 0;
2297 }
2298
2299 static void
2300 tls_server_resume_prehandshake(exim_gnutls_state_st * state)
2301 {
2302 /* Should the server offer session resumption? */
2303 tls_in.resumption = RESUME_SUPPORTED;
2304 if (verify_check_host(&tls_resumption_hosts) == OK)
2305 {
2306 int rc;
2307 /* GnuTLS appears to not do ticket overlap, but does emit a fresh ticket when
2308 an offered resumption is unacceptable. We lose one resumption per ticket
2309 lifetime, and sessions cannot be indefinitely re-used. There seems to be no
2310 way (3.6.7) of changing the default number of 2 TLS1.3 tickets issued, but at
2311 least they go out in a single packet. */
2312
2313 if (!(rc = gnutls_session_ticket_enable_server(state->session,
2314 &server_sessticket_key)))
2315 tls_in.resumption |= RESUME_SERVER_TICKET;
2316 else
2317 DEBUG(D_tls)
2318 debug_printf("enabling session tickets: %s\n", US gnutls_strerror(rc));
2319
2320 /* Try to tell if we see a ticket request */
2321 gnutls_handshake_set_hook_function(state->session,
2322 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
2323 }
2324 }
2325
2326 static void
2327 tls_server_resume_posthandshake(exim_gnutls_state_st * state)
2328 {
2329 if (gnutls_session_resumption_requested(state->session))
2330 {
2331 /* This tells us the client sent a full ticket. We use a
2332 callback on session-ticket request, elsewhere, to tell
2333 if a client asked for a ticket. */
2334
2335 tls_in.resumption |= RESUME_CLIENT_SUGGESTED;
2336 DEBUG(D_tls) debug_printf("client requested resumption\n");
2337 }
2338 if (gnutls_session_is_resumed(state->session))
2339 {
2340 tls_in.resumption |= RESUME_USED;
2341 DEBUG(D_tls) debug_printf("Session resumed\n");
2342 }
2343 }
2344 #endif
2345 /* ------------------------------------------------------------------------ */
2346 /* Exported functions */
2347
2348
2349
2350
2351 /*************************************************
2352 * Start a TLS session in a server *
2353 *************************************************/
2354
2355 /* This is called when Exim is running as a server, after having received
2356 the STARTTLS command. It must respond to that command, and then negotiate
2357 a TLS session.
2358
2359 Arguments:
2360 require_ciphers list of allowed ciphers or NULL
2361 errstr pointer to error string
2362
2363 Returns: OK on success
2364 DEFER for errors before the start of the negotiation
2365 FAIL for errors during the negotiation; the server can't
2366 continue running.
2367 */
2368
2369 int
2370 tls_server_start(const uschar * require_ciphers, uschar ** errstr)
2371 {
2372 int rc;
2373 exim_gnutls_state_st * state = NULL;
2374
2375 /* Check for previous activation */
2376 if (tls_in.active.sock >= 0)
2377 {
2378 tls_error(US"STARTTLS received after TLS started", US "", NULL, errstr);
2379 smtp_printf("554 Already in TLS\r\n", FALSE);
2380 return FAIL;
2381 }
2382
2383 /* Initialize the library. If it fails, it will already have logged the error
2384 and sent an SMTP response. */
2385
2386 DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
2387
2388 {
2389 #ifdef MEASURE_TIMING
2390 struct timeval t0;
2391 gettimeofday(&t0, NULL);
2392 #endif
2393
2394 if ((rc = tls_init(NULL, tls_certificate, tls_privatekey,
2395 NULL, tls_verify_certificates, tls_crl,
2396 require_ciphers, &state, &tls_in, errstr)) != OK) return rc;
2397
2398 #ifdef MEASURE_TIMING
2399 report_time_since(&t0, US"server tls_init (delta)");
2400 #endif
2401 }
2402
2403 #ifdef EXPERIMENTAL_TLS_RESUME
2404 tls_server_resume_prehandshake(state);
2405 #endif
2406
2407 /* If this is a host for which certificate verification is mandatory or
2408 optional, set up appropriately. */
2409
2410 if (verify_check_host(&tls_verify_hosts) == OK)
2411 {
2412 DEBUG(D_tls)
2413 debug_printf("TLS: a client certificate will be required.\n");
2414 state->verify_requirement = VERIFY_REQUIRED;
2415 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2416 }
2417 else if (verify_check_host(&tls_try_verify_hosts) == OK)
2418 {
2419 DEBUG(D_tls)
2420 debug_printf("TLS: a client certificate will be requested but not required.\n");
2421 state->verify_requirement = VERIFY_OPTIONAL;
2422 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2423 }
2424 else
2425 {
2426 DEBUG(D_tls)
2427 debug_printf("TLS: a client certificate will not be requested.\n");
2428 state->verify_requirement = VERIFY_NONE;
2429 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2430 }
2431
2432 #ifndef DISABLE_EVENT
2433 if (event_action)
2434 {
2435 state->event_action = event_action;
2436 gnutls_session_set_ptr(state->session, state);
2437 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2438 }
2439 #endif
2440
2441 /* Register SNI handling; always, even if not in tls_certificate, so that the
2442 expansion variable $tls_sni is always available. */
2443
2444 gnutls_handshake_set_post_client_hello_function(state->session,
2445 exim_sni_handling_cb);
2446
2447 /* Set context and tell client to go ahead, except in the case of TLS startup
2448 on connection, where outputting anything now upsets the clients and tends to
2449 make them disconnect. We need to have an explicit fflush() here, to force out
2450 the response. Other smtp_printf() calls do not need it, because in non-TLS
2451 mode, the fflush() happens when smtp_getc() is called. */
2452
2453 if (!state->tlsp->on_connect)
2454 {
2455 smtp_printf("220 TLS go ahead\r\n", FALSE);
2456 fflush(smtp_out);
2457 }
2458
2459 /* Now negotiate the TLS session. We put our own timer on it, since it seems
2460 that the GnuTLS library doesn't.
2461 From 3.1.0 there is gnutls_handshake_set_timeout() - but it requires you
2462 to set (and clear down afterwards) up a pull-timeout callback function that does
2463 a select, so we're no better off unless avoiding signals becomes an issue. */
2464
2465 gnutls_transport_set_ptr2(state->session,
2466 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
2467 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
2468 state->fd_in = fileno(smtp_in);
2469 state->fd_out = fileno(smtp_out);
2470
2471 sigalrm_seen = FALSE;
2472 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
2473 do
2474 rc = gnutls_handshake(state->session);
2475 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
2476 ALARM_CLR(0);
2477
2478 if (rc != GNUTLS_E_SUCCESS)
2479 {
2480 /* It seems that, except in the case of a timeout, we have to close the
2481 connection right here; otherwise if the other end is running OpenSSL it hangs
2482 until the server times out. */
2483
2484 if (sigalrm_seen)
2485 {
2486 tls_error(US"gnutls_handshake", US"timed out", NULL, errstr);
2487 gnutls_db_remove_session(state->session);
2488 }
2489 else
2490 {
2491 tls_error_gnu(US"gnutls_handshake", rc, NULL, errstr);
2492 (void) gnutls_alert_send_appropriate(state->session, rc);
2493 gnutls_deinit(state->session);
2494 gnutls_certificate_free_credentials(state->x509_cred);
2495 millisleep(500);
2496 shutdown(state->fd_out, SHUT_WR);
2497 for (int i = 1024; fgetc(smtp_in) != EOF && i > 0; ) i--; /* drain skt */
2498 (void)fclose(smtp_out);
2499 (void)fclose(smtp_in);
2500 smtp_out = smtp_in = NULL;
2501 }
2502
2503 return FAIL;
2504 }
2505
2506 #ifdef EXPERIMENTAL_TLS_RESUME
2507 tls_server_resume_posthandshake(state);
2508 #endif
2509
2510 DEBUG(D_tls) post_handshake_debug(state);
2511
2512 /* Verify after the fact */
2513
2514 if (!verify_certificate(state, errstr))
2515 {
2516 if (state->verify_requirement != VERIFY_OPTIONAL)
2517 {
2518 (void) tls_error(US"certificate verification failed", *errstr, NULL, errstr);
2519 return FAIL;
2520 }
2521 DEBUG(D_tls)
2522 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
2523 *errstr);
2524 }
2525
2526 /* Sets various Exim expansion variables; always safe within server */
2527
2528 extract_exim_vars_from_tls_state(state);
2529
2530 /* TLS has been set up. Adjust the input functions to read via TLS,
2531 and initialize appropriately. */
2532
2533 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
2534
2535 receive_getc = tls_getc;
2536 receive_getbuf = tls_getbuf;
2537 receive_get_cache = tls_get_cache;
2538 receive_ungetc = tls_ungetc;
2539 receive_feof = tls_feof;
2540 receive_ferror = tls_ferror;
2541 receive_smtp_buffered = tls_smtp_buffered;
2542
2543 return OK;
2544 }
2545
2546
2547
2548
2549 static void
2550 tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
2551 smtp_transport_options_block * ob)
2552 {
2553 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
2554 {
2555 state->exp_tls_verify_cert_hostnames =
2556 #ifdef SUPPORT_I18N
2557 string_domain_utf8_to_alabel(host->name, NULL);
2558 #else
2559 host->name;
2560 #endif
2561 DEBUG(D_tls)
2562 debug_printf("TLS: server cert verification includes hostname: \"%s\".\n",
2563 state->exp_tls_verify_cert_hostnames);
2564 }
2565 }
2566
2567
2568
2569
2570 #ifdef SUPPORT_DANE
2571 /* Given our list of RRs from the TLSA lookup, build a lookup block in
2572 GnuTLS-DANE's preferred format. Hang it on the state str for later
2573 use in DANE verification.
2574
2575 We point at the dnsa data not copy it, so it must remain valid until
2576 after verification is done.*/
2577
2578 static BOOL
2579 dane_tlsa_load(exim_gnutls_state_st * state, dns_answer * dnsa)
2580 {
2581 dns_scan dnss;
2582 int i;
2583 const char ** dane_data;
2584 int * dane_data_len;
2585
2586 i = 1;
2587 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
2588 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2589 ) if (rr->type == T_TLSA) i++;
2590
2591 dane_data = store_get(i * sizeof(uschar *), FALSE);
2592 dane_data_len = store_get(i * sizeof(int), FALSE);
2593
2594 i = 0;
2595 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
2596 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2597 ) if (rr->type == T_TLSA && rr->size > 3)
2598 {
2599 const uschar * p = rr->data;
2600 /*XXX need somehow to mark rr and its data as tainted. Doues this mean copying it? */
2601 uint8_t usage = p[0], sel = p[1], type = p[2];
2602
2603 DEBUG(D_tls)
2604 debug_printf("TLSA: %d %d %d size %d\n", usage, sel, type, rr->size);
2605
2606 if ( (usage != DANESSL_USAGE_DANE_TA && usage != DANESSL_USAGE_DANE_EE)
2607 || (sel != 0 && sel != 1)
2608 )
2609 continue;
2610 switch(type)
2611 {
2612 case 0: /* Full: cannot check at present */
2613 break;
2614 case 1: if (rr->size != 3 + 256/8) continue; /* sha2-256 */
2615 break;
2616 case 2: if (rr->size != 3 + 512/8) continue; /* sha2-512 */
2617 break;
2618 default: continue;
2619 }
2620
2621 tls_out.tlsa_usage |= 1<<usage;
2622 dane_data[i] = CS p;
2623 dane_data_len[i++] = rr->size;
2624 }
2625
2626 if (!i) return FALSE;
2627
2628 dane_data[i] = NULL;
2629 dane_data_len[i] = 0;
2630
2631 state->dane_data = (char * const *)dane_data;
2632 state->dane_data_len = dane_data_len;
2633 return TRUE;
2634 }
2635 #endif
2636
2637
2638
2639 #ifdef EXPERIMENTAL_TLS_RESUME
2640 /* On the client, get any stashed session for the given IP from hints db
2641 and apply it to the ssl-connection for attempted resumption. Although
2642 there is a gnutls_session_ticket_enable_client() interface it is
2643 documented as unnecessary (as of 3.6.7) as "session tickets are emabled
2644 by deafult". There seems to be no way to disable them, so even hosts not
2645 enabled by the transport option will be sent a ticket request. We will
2646 however avoid storing and retrieving session information. */
2647
2648 static void
2649 tls_retrieve_session(tls_support * tlsp, gnutls_session_t session,
2650 host_item * host, smtp_transport_options_block * ob)
2651 {
2652 tlsp->resumption = RESUME_SUPPORTED;
2653 if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
2654 {
2655 dbdata_tls_session * dt;
2656 int len, rc;
2657 open_db dbblock, * dbm_file;
2658
2659 DEBUG(D_tls)
2660 debug_printf("check for resumable session for %s\n", host->address);
2661 tlsp->host_resumable = TRUE;
2662 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
2663 if ((dbm_file = dbfn_open(US"tls", O_RDONLY, &dbblock, FALSE, FALSE)))
2664 {
2665 /* Key for the db is the IP. We'd like to filter the retrieved session
2666 for ticket advisory expiry, but 3.6.1 seems to give no access to that */
2667
2668 if ((dt = dbfn_read_with_length(dbm_file, host->address, &len)))
2669 if (!(rc = gnutls_session_set_data(session,
2670 CUS dt->session, (size_t)len - sizeof(dbdata_tls_session))))
2671 {
2672 DEBUG(D_tls) debug_printf("good session\n");
2673 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
2674 }
2675 else DEBUG(D_tls) debug_printf("setting session resumption data: %s\n",
2676 US gnutls_strerror(rc));
2677 dbfn_close(dbm_file);
2678 }
2679 }
2680 }
2681
2682
2683 static void
2684 tls_save_session(tls_support * tlsp, gnutls_session_t session, const host_item * host)
2685 {
2686 /* TLS 1.2 - we get both the callback and the direct posthandshake call,
2687 but this flag is not set until the second. TLS 1.3 it's the other way about.
2688 Keep both calls as the session data cannot be extracted before handshake
2689 completes. */
2690
2691 if (gnutls_session_get_flags(session) & GNUTLS_SFLAGS_SESSION_TICKET)
2692 {
2693 gnutls_datum_t tkt;
2694 int rc;
2695
2696 DEBUG(D_tls) debug_printf("server offered session ticket\n");
2697 tlsp->ticket_received = TRUE;
2698 tlsp->resumption |= RESUME_SERVER_TICKET;
2699
2700 if (tlsp->host_resumable)
2701 if (!(rc = gnutls_session_get_data2(session, &tkt)))
2702 {
2703 open_db dbblock, * dbm_file;
2704 int dlen = sizeof(dbdata_tls_session) + tkt.size;
2705 dbdata_tls_session * dt = store_get(dlen, TRUE);
2706
2707 DEBUG(D_tls) debug_printf("session data size %u\n", (unsigned)tkt.size);
2708 memcpy(dt->session, tkt.data, tkt.size);
2709 gnutls_free(tkt.data);
2710
2711 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
2712 {
2713 /* key for the db is the IP */
2714 dbfn_delete(dbm_file, host->address);
2715 dbfn_write(dbm_file, host->address, dt, dlen);
2716 dbfn_close(dbm_file);
2717
2718 DEBUG(D_tls)
2719 debug_printf("wrote session db (len %u)\n", (unsigned)dlen);
2720 }
2721 }
2722 else DEBUG(D_tls)
2723 debug_printf("extract session data: %s\n", US gnutls_strerror(rc));
2724 }
2725 }
2726
2727
2728 /* With a TLS1.3 session, the ticket(s) are not seen until
2729 the first data read is attempted. And there's often two of them.
2730 Pick them up with this callback. We are also called for 1.2
2731 but we do nothing.
2732 */
2733 static int
2734 tls_client_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
2735 unsigned incoming, const gnutls_datum_t * msg)
2736 {
2737 exim_gnutls_state_st * state = gnutls_session_get_ptr(sess);
2738 tls_support * tlsp = state->tlsp;
2739
2740 DEBUG(D_tls) debug_printf("newticket cb\n");
2741
2742 if (!tlsp->ticket_received)
2743 tls_save_session(tlsp, sess, state->host);
2744 return 0;
2745 }
2746
2747
2748 static void
2749 tls_client_resume_prehandshake(exim_gnutls_state_st * state,
2750 tls_support * tlsp, host_item * host,
2751 smtp_transport_options_block * ob)
2752 {
2753 gnutls_session_set_ptr(state->session, state);
2754 gnutls_handshake_set_hook_function(state->session,
2755 GNUTLS_HANDSHAKE_NEW_SESSION_TICKET, GNUTLS_HOOK_POST, tls_client_ticket_cb);
2756
2757 tls_retrieve_session(tlsp, state->session, host, ob);
2758 }
2759
2760 static void
2761 tls_client_resume_posthandshake(exim_gnutls_state_st * state,
2762 tls_support * tlsp, host_item * host)
2763 {
2764 if (gnutls_session_is_resumed(state->session))
2765 {
2766 DEBUG(D_tls) debug_printf("Session resumed\n");
2767 tlsp->resumption |= RESUME_USED;
2768 }
2769
2770 tls_save_session(tlsp, state->session, host);
2771 }
2772 #endif /* EXPERIMENTAL_TLS_RESUME */
2773
2774
2775 /*************************************************
2776 * Start a TLS session in a client *
2777 *************************************************/
2778
2779 /* Called from the smtp transport after STARTTLS has been accepted.
2780
2781 Arguments:
2782 cctx connection context
2783 conn_args connection details
2784 cookie datum for randomness (not used)
2785 tlsp record details of channel configuration here; must be non-NULL
2786 errstr error string pointer
2787
2788 Returns: TRUE for success with TLS session context set in smtp context,
2789 FALSE on error
2790 */
2791
2792 BOOL
2793 tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
2794 void * cookie ARG_UNUSED,
2795 tls_support * tlsp, uschar ** errstr)
2796 {
2797 host_item * host = conn_args->host; /* for msgs and option-tests */
2798 transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
2799 smtp_transport_options_block * ob = tb
2800 ? (smtp_transport_options_block *)tb->options_block
2801 : &smtp_transport_option_defaults;
2802 int rc;
2803 exim_gnutls_state_st * state = NULL;
2804 uschar * cipher_list = NULL;
2805
2806 #ifndef DISABLE_OCSP
2807 BOOL require_ocsp =
2808 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
2809 BOOL request_ocsp = require_ocsp ? TRUE
2810 : verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
2811 #endif
2812
2813 DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", cctx->sock);
2814
2815 #ifdef SUPPORT_DANE
2816 /* If dane is flagged, have either request or require dane for this host, and
2817 a TLSA record found. Therefore, dane verify required. Which implies cert must
2818 be requested and supplied, dane verify must pass, and cert verify irrelevant
2819 (incl. hostnames), and (caller handled) require_tls */
2820
2821 if (conn_args->dane && ob->dane_require_tls_ciphers)
2822 {
2823 /* not using expand_check_tlsvar because not yet in state */
2824 if (!expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
2825 &cipher_list, errstr))
2826 return FALSE;
2827 cipher_list = cipher_list && *cipher_list
2828 ? ob->dane_require_tls_ciphers : ob->tls_require_ciphers;
2829 }
2830 #endif
2831
2832 if (!cipher_list)
2833 cipher_list = ob->tls_require_ciphers;
2834
2835 {
2836 #ifdef MEASURE_TIMING
2837 struct timeval t0;
2838 gettimeofday(&t0, NULL);
2839 #endif
2840
2841 if (tls_init(host, ob->tls_certificate, ob->tls_privatekey,
2842 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
2843 cipher_list, &state, tlsp, errstr) != OK)
2844 return FALSE;
2845
2846 #ifdef MEASURE_TIMING
2847 report_time_since(&t0, US"client tls_init (delta)");
2848 #endif
2849 }
2850
2851 {
2852 int dh_min_bits = ob->tls_dh_min_bits;
2853 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
2854 {
2855 DEBUG(D_tls)
2856 debug_printf("WARNING: tls_dh_min_bits far too low,"
2857 " clamping %d up to %d\n",
2858 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
2859 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
2860 }
2861
2862 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
2863 " acceptable bits to %d\n",
2864 dh_min_bits);
2865 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
2866 }
2867
2868 /* Stick to the old behaviour for compatibility if tls_verify_certificates is
2869 set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
2870 the specified host patterns if one of them is defined */
2871
2872 #ifdef SUPPORT_DANE
2873 if (conn_args->dane && dane_tlsa_load(state, &conn_args->tlsa_dnsa))
2874 {
2875 DEBUG(D_tls)
2876 debug_printf("TLS: server certificate DANE required.\n");
2877 state->verify_requirement = VERIFY_DANE;
2878 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2879 }
2880 else
2881 #endif
2882 if ( ( state->exp_tls_verify_certificates
2883 && !ob->tls_verify_hosts
2884 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2885 )
2886 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
2887 )
2888 {
2889 tls_client_setup_hostname_checks(host, state, ob);
2890 DEBUG(D_tls)
2891 debug_printf("TLS: server certificate verification required.\n");
2892 state->verify_requirement = VERIFY_REQUIRED;
2893 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2894 }
2895 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
2896 {
2897 tls_client_setup_hostname_checks(host, state, ob);
2898 DEBUG(D_tls)
2899 debug_printf("TLS: server certificate verification optional.\n");
2900 state->verify_requirement = VERIFY_OPTIONAL;
2901 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2902 }
2903 else
2904 {
2905 DEBUG(D_tls)
2906 debug_printf("TLS: server certificate verification not required.\n");
2907 state->verify_requirement = VERIFY_NONE;
2908 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2909 }
2910
2911 #ifndef DISABLE_OCSP
2912 /* supported since GnuTLS 3.1.3 */
2913 if (request_ocsp)
2914 {
2915 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
2916 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
2917 NULL, 0, NULL)) != OK)
2918 {
2919 tls_error_gnu(US"cert-status-req", rc, state->host, errstr);
2920 return FALSE;
2921 }
2922 tlsp->ocsp = OCSP_NOT_RESP;
2923 }
2924 #endif
2925
2926 #ifdef EXPERIMENTAL_TLS_RESUME
2927 tls_client_resume_prehandshake(state, tlsp, host, ob);
2928 #endif
2929
2930 #ifndef DISABLE_EVENT
2931 if (tb && tb->event_action)
2932 {
2933 state->event_action = tb->event_action;
2934 gnutls_session_set_ptr(state->session, state);
2935 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2936 }
2937 #endif
2938
2939 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) cctx->sock);
2940 state->fd_in = cctx->sock;
2941 state->fd_out = cctx->sock;
2942
2943 DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
2944 /* There doesn't seem to be a built-in timeout on connection. */
2945
2946 sigalrm_seen = FALSE;
2947 ALARM(ob->command_timeout);
2948 do
2949 rc = gnutls_handshake(state->session);
2950 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
2951 ALARM_CLR(0);
2952
2953 if (rc != GNUTLS_E_SUCCESS)
2954 {
2955 if (sigalrm_seen)
2956 {
2957 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
2958 tls_error(US"gnutls_handshake", US"timed out", state->host, errstr);
2959 }
2960 else
2961 tls_error_gnu(US"gnutls_handshake", rc, state->host, errstr);
2962 return FALSE;
2963 }
2964
2965 DEBUG(D_tls) post_handshake_debug(state);
2966
2967 /* Verify late */
2968
2969 if (!verify_certificate(state, errstr))
2970 {
2971 tls_error(US"certificate verification failed", *errstr, state->host, errstr);
2972 return FALSE;
2973 }
2974
2975 #ifndef DISABLE_OCSP
2976 if (request_ocsp)
2977 {
2978 DEBUG(D_tls)
2979 {
2980 gnutls_datum_t stapling;
2981 gnutls_ocsp_resp_t resp;
2982 gnutls_datum_t printed;
2983 unsigned idx = 0;
2984
2985 for (;
2986 # ifdef GNUTLS_OCSP_STATUS_REQUEST_GET2
2987 (rc = gnutls_ocsp_status_request_get2(state->session, idx, &stapling)) == 0;
2988 #else
2989 (rc = gnutls_ocsp_status_request_get(state->session, &stapling)) == 0;
2990 #endif
2991 idx++)
2992 if ( (rc= gnutls_ocsp_resp_init(&resp)) == 0
2993 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
2994 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_COMPACT, &printed)) == 0
2995 )
2996 {
2997 debug_printf("%.4096s", printed.data);
2998 gnutls_free(printed.data);
2999 }
3000 else
3001 (void) tls_error_gnu(US"ocsp decode", rc, state->host, errstr);
3002 if (idx == 0 && rc)
3003 (void) tls_error_gnu(US"ocsp decode", rc, state->host, errstr);
3004 }
3005
3006 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
3007 {
3008 tlsp->ocsp = OCSP_FAILED;
3009 tls_error(US"certificate status check failed", NULL, state->host, errstr);
3010 if (require_ocsp)
3011 return FALSE;
3012 }
3013 else
3014 {
3015 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
3016 tlsp->ocsp = OCSP_VFIED;
3017 }
3018 }
3019 #endif
3020
3021 #ifdef EXPERIMENTAL_TLS_RESUME
3022 tls_client_resume_posthandshake(state, tlsp, host);
3023 #endif
3024
3025 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
3026
3027 extract_exim_vars_from_tls_state(state);
3028
3029 cctx->tls_ctx = state;
3030 return TRUE;
3031 }
3032
3033
3034
3035
3036 /*************************************************
3037 * Close down a TLS session *
3038 *************************************************/
3039
3040 /* This is also called from within a delivery subprocess forked from the
3041 daemon, to shut down the TLS library, without actually doing a shutdown (which
3042 would tamper with the TLS session in the parent process).
3043
3044 Arguments:
3045 ct_ctx client context pointer, or NULL for the one global server context
3046 shutdown 1 if TLS close-alert is to be sent,
3047 2 if also response to be waited for
3048
3049 Returns: nothing
3050 */
3051
3052 void
3053 tls_close(void * ct_ctx, int shutdown)
3054 {
3055 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3056 tls_support * tlsp = state->tlsp;
3057
3058 if (!tlsp || tlsp->active.sock < 0) return; /* TLS was not active */
3059
3060 if (shutdown)
3061 {
3062 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
3063 shutdown > 1 ? " (with response-wait)" : "");
3064
3065 ALARM(2);
3066 gnutls_bye(state->session, shutdown > 1 ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR);
3067 ALARM_CLR(0);
3068 }
3069
3070 if (!ct_ctx) /* server */
3071 {
3072 receive_getc = smtp_getc;
3073 receive_getbuf = smtp_getbuf;
3074 receive_get_cache = smtp_get_cache;
3075 receive_ungetc = smtp_ungetc;
3076 receive_feof = smtp_feof;
3077 receive_ferror = smtp_ferror;
3078 receive_smtp_buffered = smtp_buffered;
3079 }
3080
3081 gnutls_deinit(state->session);
3082 gnutls_certificate_free_credentials(state->x509_cred);
3083
3084 tlsp->active.sock = -1;
3085 tlsp->active.tls_ctx = NULL;
3086 /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
3087 tls_channelbinding_b64 = NULL;
3088
3089
3090 if (state->xfer_buffer) store_free(state->xfer_buffer);
3091 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
3092 }
3093
3094
3095
3096
3097 static BOOL
3098 tls_refill(unsigned lim)
3099 {
3100 exim_gnutls_state_st * state = &state_server;
3101 ssize_t inbytes;
3102
3103 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
3104 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
3105
3106 sigalrm_seen = FALSE;
3107 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3108
3109 do
3110 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
3111 MIN(ssl_xfer_buffer_size, lim));
3112 while (inbytes == GNUTLS_E_AGAIN);
3113
3114 if (smtp_receive_timeout > 0) ALARM_CLR(0);
3115
3116 if (had_command_timeout) /* set by signal handler */
3117 smtp_command_timeout_exit(); /* does not return */
3118 if (had_command_sigterm)
3119 smtp_command_sigterm_exit();
3120 if (had_data_timeout)
3121 smtp_data_timeout_exit();
3122 if (had_data_sigint)
3123 smtp_data_sigint_exit();
3124
3125 /* Timeouts do not get this far. A zero-byte return appears to mean that the
3126 TLS session has been closed down, not that the socket itself has been closed
3127 down. Revert to non-TLS handling. */
3128
3129 if (sigalrm_seen)
3130 {
3131 DEBUG(D_tls) debug_printf("Got tls read timeout\n");
3132 state->xfer_error = TRUE;
3133 return FALSE;
3134 }
3135
3136 else if (inbytes == 0)
3137 {
3138 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
3139 tls_close(NULL, TLS_NO_SHUTDOWN);
3140 return FALSE;
3141 }
3142
3143 /* Handle genuine errors */
3144
3145 else if (inbytes < 0)
3146 {
3147 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
3148 record_io_error(state, (int) inbytes, US"recv", NULL);
3149 state->xfer_error = TRUE;
3150 return FALSE;
3151 }
3152 #ifndef DISABLE_DKIM
3153 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
3154 #endif
3155 state->xfer_buffer_hwm = (int) inbytes;
3156 state->xfer_buffer_lwm = 0;
3157 return TRUE;
3158 }
3159
3160 /*************************************************
3161 * TLS version of getc *
3162 *************************************************/
3163
3164 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
3165 it refills the buffer via the GnuTLS reading function.
3166 Only used by the server-side TLS.
3167
3168 This feeds DKIM and should be used for all message-body reads.
3169
3170 Arguments: lim Maximum amount to read/buffer
3171 Returns: the next character or EOF
3172 */
3173
3174 int
3175 tls_getc(unsigned lim)
3176 {
3177 exim_gnutls_state_st * state = &state_server;
3178
3179 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3180 if (!tls_refill(lim))
3181 return state->xfer_error ? EOF : smtp_getc(lim);
3182
3183 /* Something in the buffer; return next uschar */
3184
3185 return state->xfer_buffer[state->xfer_buffer_lwm++];
3186 }
3187
3188 uschar *
3189 tls_getbuf(unsigned * len)
3190 {
3191 exim_gnutls_state_st * state = &state_server;
3192 unsigned size;
3193 uschar * buf;
3194
3195 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3196 if (!tls_refill(*len))
3197 {
3198 if (!state->xfer_error) return smtp_getbuf(len);
3199 *len = 0;
3200 return NULL;
3201 }
3202
3203 if ((size = state->xfer_buffer_hwm - state->xfer_buffer_lwm) > *len)
3204 size = *len;
3205 buf = &state->xfer_buffer[state->xfer_buffer_lwm];
3206 state->xfer_buffer_lwm += size;
3207 *len = size;
3208 return buf;
3209 }
3210
3211
3212 void
3213 tls_get_cache()
3214 {
3215 #ifndef DISABLE_DKIM
3216 exim_gnutls_state_st * state = &state_server;
3217 int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
3218 if (n > 0)
3219 dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
3220 #endif
3221 }
3222
3223
3224 BOOL
3225 tls_could_read(void)
3226 {
3227 return state_server.xfer_buffer_lwm < state_server.xfer_buffer_hwm
3228 || gnutls_record_check_pending(state_server.session) > 0;
3229 }
3230
3231
3232
3233
3234 /*************************************************
3235 * Read bytes from TLS channel *
3236 *************************************************/
3237
3238 /* This does not feed DKIM, so if the caller uses this for reading message body,
3239 then the caller must feed DKIM.
3240
3241 Arguments:
3242 ct_ctx client context pointer, or NULL for the one global server context
3243 buff buffer of data
3244 len size of buffer
3245
3246 Returns: the number of bytes read
3247 -1 after a failed read, including EOF
3248 */
3249
3250 int
3251 tls_read(void * ct_ctx, uschar *buff, size_t len)
3252 {
3253 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3254 ssize_t inbytes;
3255
3256 if (len > INT_MAX)
3257 len = INT_MAX;
3258
3259 if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
3260 DEBUG(D_tls)
3261 debug_printf("*** PROBABLY A BUG *** " \
3262 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
3263 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
3264
3265 DEBUG(D_tls)
3266 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
3267 state->session, buff, len);
3268
3269 do
3270 inbytes = gnutls_record_recv(state->session, buff, len);
3271 while (inbytes == GNUTLS_E_AGAIN);
3272
3273 if (inbytes > 0) return inbytes;
3274 if (inbytes == 0)
3275 {
3276 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
3277 }
3278 else
3279 {
3280 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
3281 record_io_error(state, (int)inbytes, US"recv", NULL);
3282 }
3283
3284 return -1;
3285 }
3286
3287
3288
3289
3290 /*************************************************
3291 * Write bytes down TLS channel *
3292 *************************************************/
3293
3294 /*
3295 Arguments:
3296 ct_ctx client context pointer, or NULL for the one global server context
3297 buff buffer of data
3298 len number of bytes
3299 more more data expected soon
3300
3301 Returns: the number of bytes after a successful write,
3302 -1 after a failed write
3303 */
3304
3305 int
3306 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
3307 {
3308 ssize_t outbytes;
3309 size_t left = len;
3310 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3311 #ifdef SUPPORT_CORK
3312 static BOOL corked = FALSE;
3313
3314 if (more && !corked) gnutls_record_cork(state->session);
3315 #endif
3316
3317 DEBUG(D_tls) debug_printf("%s(%p, " SIZE_T_FMT "%s)\n", __FUNCTION__,
3318 buff, left, more ? ", more" : "");
3319
3320 while (left > 0)
3321 {
3322 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
3323 buff, left);
3324
3325 do
3326 outbytes = gnutls_record_send(state->session, buff, left);
3327 while (outbytes == GNUTLS_E_AGAIN);
3328
3329 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
3330 if (outbytes < 0)
3331 {
3332 DEBUG(D_tls) debug_printf("%s: gnutls_record_send err\n", __FUNCTION__);
3333 record_io_error(state, outbytes, US"send", NULL);
3334 return -1;
3335 }
3336 if (outbytes == 0)
3337 {
3338 record_io_error(state, 0, US"send", US"TLS channel closed on write");
3339 return -1;
3340 }
3341
3342 left -= outbytes;
3343 buff += outbytes;
3344 }
3345
3346 if (len > INT_MAX)
3347 {
3348 DEBUG(D_tls)
3349 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
3350 len);
3351 len = INT_MAX;
3352 }
3353
3354 #ifdef SUPPORT_CORK
3355 if (more != corked)
3356 {
3357 if (!more) (void) gnutls_record_uncork(state->session, 0);
3358 corked = more;
3359 }
3360 #endif
3361
3362 return (int) len;
3363 }
3364
3365
3366
3367
3368 /*************************************************
3369 * Random number generation *
3370 *************************************************/
3371
3372 /* Pseudo-random number generation. The result is not expected to be
3373 cryptographically strong but not so weak that someone will shoot themselves
3374 in the foot using it as a nonce in input in some email header scheme or
3375 whatever weirdness they'll twist this into. The result should handle fork()
3376 and avoid repeating sequences. OpenSSL handles that for us.
3377
3378 Arguments:
3379 max range maximum
3380 Returns a random number in range [0, max-1]
3381 */
3382
3383 #ifdef HAVE_GNUTLS_RND
3384 int
3385 vaguely_random_number(int max)
3386 {
3387 unsigned int r;
3388 int i, needed_len;
3389 uschar smallbuf[sizeof(r)];
3390
3391 if (max <= 1)
3392 return 0;
3393
3394 needed_len = sizeof(r);
3395 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
3396 asked for a number less than 10. */
3397
3398 for (r = max, i = 0; r; ++i)
3399 r >>= 1;
3400 i = (i + 7) / 8;
3401 if (i < needed_len)
3402 needed_len = i;
3403
3404 i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
3405 if (i < 0)
3406 {
3407 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
3408 return vaguely_random_number_fallback(max);
3409 }
3410 r = 0;
3411 for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
3412 r = r * 256 + *p;
3413
3414 /* We don't particularly care about weighted results; if someone wants
3415 * smooth distribution and cares enough then they should submit a patch then. */
3416 return r % max;
3417 }
3418 #else /* HAVE_GNUTLS_RND */
3419 int
3420 vaguely_random_number(int max)
3421 {
3422 return vaguely_random_number_fallback(max);
3423 }
3424 #endif /* HAVE_GNUTLS_RND */
3425
3426
3427
3428
3429 /*************************************************
3430 * Let tls_require_ciphers be checked at startup *
3431 *************************************************/
3432
3433 /* The tls_require_ciphers option, if set, must be something which the
3434 library can parse.
3435
3436 Returns: NULL on success, or error message
3437 */
3438
3439 uschar *
3440 tls_validate_require_cipher(void)
3441 {
3442 int rc;
3443 uschar *expciphers = NULL;
3444 gnutls_priority_t priority_cache;
3445 const char *errpos;
3446 uschar * dummy_errstr;
3447
3448 #ifdef GNUTLS_AUTO_GLOBAL_INIT
3449 # define validate_check_rc(Label) do { \
3450 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) \
3451 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
3452 # define return_deinit(Label) do { return (Label); } while (0)
3453 #else
3454 # define validate_check_rc(Label) do { \
3455 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
3456 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
3457 # define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
3458 #endif
3459
3460 if (exim_gnutls_base_init_done)
3461 log_write(0, LOG_MAIN|LOG_PANIC,
3462 "already initialised GnuTLS, Exim developer bug");
3463
3464 #if defined(HAVE_GNUTLS_PKCS11) && !defined(GNUTLS_AUTO_PKCS11_MANUAL)
3465 if (!gnutls_allow_auto_pkcs11)
3466 {
3467 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
3468 validate_check_rc(US"gnutls_pkcs11_init");
3469 }
3470 #endif
3471 #ifndef GNUTLS_AUTO_GLOBAL_INIT
3472 rc = gnutls_global_init();
3473 validate_check_rc(US"gnutls_global_init()");
3474 #endif
3475 exim_gnutls_base_init_done = TRUE;
3476
3477 if (!(tls_require_ciphers && *tls_require_ciphers))
3478 return_deinit(NULL);
3479
3480 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
3481 &dummy_errstr))
3482 return_deinit(US"failed to expand tls_require_ciphers");
3483
3484 if (!(expciphers && *expciphers))
3485 return_deinit(NULL);
3486
3487 DEBUG(D_tls)
3488 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
3489
3490 rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
3491 validate_check_rc(string_sprintf(
3492 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
3493 expciphers, errpos - CS expciphers, errpos));
3494
3495 #undef return_deinit
3496 #undef validate_check_rc
3497 #ifndef GNUTLS_AUTO_GLOBAL_INIT
3498 gnutls_global_deinit();
3499 #endif
3500
3501 return NULL;
3502 }
3503
3504
3505
3506
3507 /*************************************************
3508 * Report the library versions. *
3509 *************************************************/
3510
3511 /* See a description in tls-openssl.c for an explanation of why this exists.
3512
3513 Arguments: a FILE* to print the results to
3514 Returns: nothing
3515 */
3516
3517 void
3518 tls_version_report(FILE *f)
3519 {
3520 fprintf(f, "Library version: GnuTLS: Compile: %s\n"
3521 " Runtime: %s\n",
3522 LIBGNUTLS_VERSION,
3523 gnutls_check_version(NULL));
3524 }
3525
3526 #endif /*!MACRO_PREDEF*/
3527 /* vi: aw ai sw=2
3528 */
3529 /* End of tls-gnu.c */