Revert "GnuTLS: remove GNUTLS_E_AGAIN handling"
[exim.git] / src / src / tls-gnu.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Copyright (c) Phil Pennock 2012 */
9
10 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
11 one of the available supported implementations. This file is #included into
12 tls.c when USE_GNUTLS has been set.
13
14 The code herein is a revamp of GnuTLS integration using the current APIs; the
15 original tls-gnu.c was based on a patch which was contributed by Nikos
16 Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
17 appropriate.
18
19 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20 which is not widely deployed by OS vendors. Will note issues below, which may
21 assist in updating the code in the future. Another sources of hints is
22 mod_gnutls for Apache (SNI callback registration and handling).
23
24 Keeping client and server variables more split than before and is currently
25 the norm, in anticipation of TLS in ACL callouts.
26
27 I wanted to switch to gnutls_certificate_set_verify_function() so that
28 certificate rejection could happen during handshake where it belongs, rather
29 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
31
32 (I wasn't looking for libraries quite that old, when updating to get rid of
33 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34 require current GnuTLS, then we'll drop support for the ancient libraries).
35 */
36
37 #include <gnutls/gnutls.h>
38 /* needed for cert checks in verification and DN extraction: */
39 #include <gnutls/x509.h>
40 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41 #include <gnutls/crypto.h>
42
43 /* needed to disable PKCS11 autoload unless requested */
44 #if GNUTLS_VERSION_NUMBER >= 0x020c00
45 # include <gnutls/pkcs11.h>
46 # define SUPPORT_PARAM_TO_PK_BITS
47 #endif
48 #if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
49 # warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
50 # define DISABLE_OCSP
51 #endif
52 #if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
53 # warning "GnuTLS library version too old; tls:cert event unsupported"
54 # define DISABLE_EVENT
55 #endif
56 #if GNUTLS_VERSION_NUMBER >= 0x030000
57 # define SUPPORT_SELFSIGN /* Uncertain what version is first usable but 2.12.23 is not */
58 #endif
59 #if GNUTLS_VERSION_NUMBER >= 0x030306
60 # define SUPPORT_CA_DIR
61 #else
62 # undef SUPPORT_CA_DIR
63 #endif
64 #if GNUTLS_VERSION_NUMBER >= 0x030014
65 # define SUPPORT_SYSDEFAULT_CABUNDLE
66 #endif
67 #if GNUTLS_VERSION_NUMBER >= 0x030104
68 # define GNUTLS_CERT_VFY_STATUS_PRINT
69 #endif
70 #if GNUTLS_VERSION_NUMBER >= 0x030109
71 # define SUPPORT_CORK
72 #endif
73 #if GNUTLS_VERSION_NUMBER >= 0x03010a
74 # define SUPPORT_GNUTLS_SESS_DESC
75 #endif
76 #if GNUTLS_VERSION_NUMBER >= 0x030300
77 # define GNUTLS_AUTO_GLOBAL_INIT
78 # define GNUTLS_AUTO_PKCS11_MANUAL
79 #endif
80 #if (GNUTLS_VERSION_NUMBER >= 0x030404) \
81 || (GNUTLS_VERSION_NUMBER >= 0x030311) && (GNUTLS_VERSION_NUMBER & 0xffff00 == 0x030300)
82 # ifndef DISABLE_OCSP
83 # define EXIM_HAVE_OCSP
84 # endif
85 #endif
86 #if GNUTLS_VERSION_NUMBER >= 0x030500
87 # define SUPPORT_GNUTLS_KEYLOG
88 #endif
89 #if GNUTLS_VERSION_NUMBER >= 0x030506 && !defined(DISABLE_OCSP)
90 # define SUPPORT_SRV_OCSP_STACK
91 #endif
92 #if GNUTLS_VERSION_NUMBER >= 0x030600
93 # define GNUTLS_AUTO_DHPARAMS
94 #endif
95 #if GNUTLS_VERSION_NUMBER >= 0x030603
96 # define EXIM_HAVE_TLS1_3
97 # define SUPPORT_GNUTLS_EXT_RAW_PARSE
98 # define GNUTLS_OCSP_STATUS_REQUEST_GET2
99 #endif
100
101 #ifdef SUPPORT_DANE
102 # if GNUTLS_VERSION_NUMBER >= 0x030000
103 # define DANESSL_USAGE_DANE_TA 2
104 # define DANESSL_USAGE_DANE_EE 3
105 # else
106 # error GnuTLS version too early for DANE
107 # endif
108 # if GNUTLS_VERSION_NUMBER < 0x999999
109 # define GNUTLS_BROKEN_DANE_VALIDATION
110 # endif
111 #endif
112
113 #ifdef EXPERIMENTAL_TLS_RESUME
114 # if GNUTLS_VERSION_NUMBER < 0x030603
115 # error GNUTLS version too early for session-resumption
116 # endif
117 #endif
118
119 #ifndef DISABLE_OCSP
120 # include <gnutls/ocsp.h>
121 #endif
122 #ifdef SUPPORT_DANE
123 # include <gnutls/dane.h>
124 #endif
125
126 #include "tls-cipher-stdname.c"
127
128
129 #ifdef MACRO_PREDEF
130 void
131 options_tls(void)
132 {
133 # ifdef EXPERIMENTAL_TLS_RESUME
134 builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
135 # endif
136 # ifdef EXIM_HAVE_TLS1_3
137 builtin_macro_create(US"_HAVE_TLS1_3");
138 # endif
139 # ifdef EXIM_HAVE_OCSP
140 builtin_macro_create(US"_HAVE_TLS_OCSP");
141 # endif
142 # ifdef SUPPORT_SRV_OCSP_STACK
143 builtin_macro_create(US"_HAVE_TLS_OCSP_LIST");
144 # endif
145 }
146 #else
147
148
149 /* GnuTLS 2 vs 3
150
151 GnuTLS 3 only:
152 gnutls_global_set_audit_log_function()
153
154 Changes:
155 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
156 */
157
158 /* Local static variables for GnuTLS */
159
160 /* Values for verify_requirement */
161
162 enum peer_verify_requirement
163 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED, VERIFY_DANE };
164
165 /* This holds most state for server or client; with this, we can set up an
166 outbound TLS-enabled connection in an ACL callout, while not stomping all
167 over the TLS variables available for expansion.
168
169 Some of these correspond to variables in globals.c; those variables will
170 be set to point to content in one of these instances, as appropriate for
171 the stage of the process lifetime.
172
173 Not handled here: global tlsp->tls_channelbinding.
174 */
175
176 typedef struct exim_gnutls_state {
177 gnutls_session_t session;
178 gnutls_certificate_credentials_t x509_cred;
179 gnutls_priority_t priority_cache;
180 enum peer_verify_requirement verify_requirement;
181 int fd_in;
182 int fd_out;
183
184 BOOL peer_cert_verified:1;
185 BOOL peer_dane_verified:1;
186 BOOL trigger_sni_changes:1;
187 BOOL have_set_peerdn:1;
188 BOOL xfer_eof:1; /*XXX never gets set! */
189 BOOL xfer_error:1;
190 #ifdef SUPPORT_CORK
191 BOOL corked:1;
192 #endif
193
194 const struct host_item *host; /* NULL if server */
195 gnutls_x509_crt_t peercert;
196 uschar *peerdn;
197 uschar *ciphersuite;
198 uschar *received_sni;
199
200 const uschar *tls_certificate;
201 const uschar *tls_privatekey;
202 const uschar *tls_sni; /* client send only, not received */
203 const uschar *tls_verify_certificates;
204 const uschar *tls_crl;
205 const uschar *tls_require_ciphers;
206
207 uschar *exp_tls_certificate;
208 uschar *exp_tls_privatekey;
209 uschar *exp_tls_verify_certificates;
210 uschar *exp_tls_crl;
211 uschar *exp_tls_require_ciphers;
212 const uschar *exp_tls_verify_cert_hostnames;
213 #ifndef DISABLE_EVENT
214 uschar *event_action;
215 #endif
216 #ifdef SUPPORT_DANE
217 char * const * dane_data;
218 const int * dane_data_len;
219 #endif
220
221 tls_support *tlsp; /* set in tls_init() */
222
223 uschar *xfer_buffer;
224 int xfer_buffer_lwm;
225 int xfer_buffer_hwm;
226 } exim_gnutls_state_st;
227
228 static const exim_gnutls_state_st exim_gnutls_state_init = {
229 /* all elements not explicitly intialised here get 0/NULL/FALSE */
230 .fd_in = -1,
231 .fd_out = -1,
232 };
233
234 /* Not only do we have our own APIs which don't pass around state, assuming
235 it's held in globals, GnuTLS doesn't appear to let us register callback data
236 for callbacks, or as part of the session, so we have to keep a "this is the
237 context we're currently dealing with" pointer and rely upon being
238 single-threaded to keep from processing data on an inbound TLS connection while
239 talking to another TLS connection for an outbound check. This does mean that
240 there's no way for heart-beats to be responded to, for the duration of the
241 second connection.
242 XXX But see gnutls_session_get_ptr()
243 */
244
245 static exim_gnutls_state_st state_server;
246
247 #ifndef GNUTLS_AUTO_DHPARAMS
248 /* dh_params are initialised once within the lifetime of a process using TLS;
249 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
250 don't want to repeat this. */
251
252 static gnutls_dh_params_t dh_server_params = NULL;
253 #endif
254
255 static int ssl_session_timeout = 7200; /* Two hours */
256
257 static const uschar * const exim_default_gnutls_priority = US"NORMAL";
258
259 /* Guard library core initialisation */
260
261 static BOOL exim_gnutls_base_init_done = FALSE;
262
263 #ifndef DISABLE_OCSP
264 static BOOL gnutls_buggy_ocsp = FALSE;
265 static BOOL exim_testharness_disable_ocsp_validity_check = FALSE;
266 #endif
267
268 #ifdef EXPERIMENTAL_TLS_RESUME
269 static gnutls_datum_t server_sessticket_key;
270 #endif
271
272 /* ------------------------------------------------------------------------ */
273 /* macros */
274
275 #define MAX_HOST_LEN 255
276
277 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
278 the library logging; a value less than 0 disables the calls to set up logging
279 callbacks. GNuTLS also looks for an environment variable - except not for
280 setuid binaries, making it useless - "GNUTLS_DEBUG_LEVEL".
281 Allegedly the testscript line "GNUTLS_DEBUG_LEVEL=9 sudo exim ..." would work,
282 but the env var must be added to /etc/sudoers too. */
283 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
284 # define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
285 #endif
286
287 #ifndef EXIM_CLIENT_DH_MIN_BITS
288 # define EXIM_CLIENT_DH_MIN_BITS 1024
289 #endif
290
291 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
292 can ask for a bit-strength. Without that, we stick to the constant we had
293 before, for now. */
294 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
295 # define EXIM_SERVER_DH_BITS_PRE2_12 1024
296 #endif
297
298 #define expand_check_tlsvar(Varname, errstr) \
299 expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr)
300
301 #if GNUTLS_VERSION_NUMBER >= 0x020c00
302 # define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
303 # define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
304 # define HAVE_GNUTLS_RND
305 /* The security fix we provide with the gnutls_allow_auto_pkcs11 option
306 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
307 * isn't available sometimes, so this needs to become a conditional
308 * compilation; the sanest way to deal with this being a problem on
309 * older OSes is to block it in the Local/Makefile with this compiler
310 * definition */
311 # ifndef AVOID_GNUTLS_PKCS11
312 # define HAVE_GNUTLS_PKCS11
313 # endif /* AVOID_GNUTLS_PKCS11 */
314 #endif
315
316
317
318
319 /* ------------------------------------------------------------------------ */
320 /* Callback declarations */
321
322 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
323 static void exim_gnutls_logger_cb(int level, const char *message);
324 #endif
325
326 static int exim_sni_handling_cb(gnutls_session_t session);
327
328 #ifdef EXPERIMENTAL_TLS_RESUME
329 static int
330 tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
331 unsigned incoming, const gnutls_datum_t * msg);
332 #endif
333
334
335 /* Daemon one-time initialisation */
336 void
337 tls_daemon_init(void)
338 {
339 #ifdef EXPERIMENTAL_TLS_RESUME
340 /* We are dependent on the GnuTLS implementation of the Session Ticket
341 encryption; both the strength and the key rotation period. We hope that
342 the strength at least matches that of the ciphersuite (but GnuTLS does not
343 document this). */
344
345 static BOOL once = FALSE;
346 if (once) return;
347 once = TRUE;
348 gnutls_session_ticket_key_generate(&server_sessticket_key); /* >= 2.10.0 */
349 if (f.running_in_test_harness) ssl_session_timeout = 6;
350 #endif
351 }
352
353 /* ------------------------------------------------------------------------ */
354 /* Static functions */
355
356 /*************************************************
357 * Handle TLS error *
358 *************************************************/
359
360 /* Called from lots of places when errors occur before actually starting to do
361 the TLS handshake, that is, while the session is still in clear. Always returns
362 DEFER for a server and FAIL for a client so that most calls can use "return
363 tls_error(...)" to do this processing and then give an appropriate return. A
364 single function is used for both server and client, because it is called from
365 some shared functions.
366
367 Argument:
368 prefix text to include in the logged error
369 msg additional error string (may be NULL)
370 usually obtained from gnutls_strerror()
371 host NULL if setting up a server;
372 the connected host if setting up a client
373 errstr pointer to returned error string
374
375 Returns: OK/DEFER/FAIL
376 */
377
378 static int
379 tls_error(const uschar *prefix, const uschar *msg, const host_item *host,
380 uschar ** errstr)
381 {
382 if (errstr)
383 *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : US"");
384 return host ? FAIL : DEFER;
385 }
386
387
388 static int
389 tls_error_gnu(const uschar *prefix, int err, const host_item *host,
390 uschar ** errstr)
391 {
392 return tls_error(prefix, US gnutls_strerror(err), host, errstr);
393 }
394
395 static int
396 tls_error_sys(const uschar *prefix, int err, const host_item *host,
397 uschar ** errstr)
398 {
399 return tls_error(prefix, US strerror(err), host, errstr);
400 }
401
402
403 /*************************************************
404 * Deal with logging errors during I/O *
405 *************************************************/
406
407 /* We have to get the identity of the peer from saved data.
408
409 Argument:
410 state the current GnuTLS exim state container
411 rc the GnuTLS error code, or 0 if it's a local error
412 when text identifying read or write
413 text local error text when rc is 0
414
415 Returns: nothing
416 */
417
418 static void
419 record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
420 {
421 const uschar * msg;
422 uschar * errstr;
423
424 if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
425 msg = string_sprintf("A TLS fatal alert has been received: %s",
426 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
427 else
428 msg = US gnutls_strerror(rc);
429
430 (void) tls_error(when, msg, state->host, &errstr);
431
432 if (state->host)
433 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection %s",
434 state->host->name, state->host->address, errstr);
435 else
436 {
437 uschar * conn_info = smtp_get_connection_info();
438 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0) conn_info += 5;
439 /* I'd like to get separated H= here, but too hard for now */
440 log_write(0, LOG_MAIN, "TLS error on %s %s", conn_info, errstr);
441 }
442 }
443
444
445
446
447 /*************************************************
448 * Set various Exim expansion vars *
449 *************************************************/
450
451 #define exim_gnutls_cert_err(Label) \
452 do \
453 { \
454 if (rc != GNUTLS_E_SUCCESS) \
455 { \
456 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
457 (Label), gnutls_strerror(rc)); \
458 return rc; \
459 } \
460 } while (0)
461
462 static int
463 import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
464 {
465 int rc;
466
467 rc = gnutls_x509_crt_init(crtp);
468 exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
469
470 rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
471 exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
472
473 return rc;
474 }
475
476 #undef exim_gnutls_cert_err
477
478
479 /* We set various Exim global variables from the state, once a session has
480 been established. With TLS callouts, may need to change this to stack
481 variables, or just re-call it with the server state after client callout
482 has finished.
483
484 Make sure anything set here is unset in tls_getc().
485
486 Sets:
487 tls_active fd
488 tls_bits strength indicator
489 tls_certificate_verified bool indicator
490 tls_channelbinding for some SASL mechanisms
491 tls_ver a string
492 tls_cipher a string
493 tls_peercert pointer to library internal
494 tls_peerdn a string
495 tls_sni a (UTF-8) string
496 tls_ourcert pointer to library internal
497
498 Argument:
499 state the relevant exim_gnutls_state_st *
500 */
501
502 static void
503 extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
504 {
505 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
506 int old_pool;
507 int rc;
508 gnutls_datum_t channel;
509 #endif
510 tls_support * tlsp = state->tlsp;
511
512 tlsp->active.sock = state->fd_out;
513 tlsp->active.tls_ctx = state;
514
515 DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
516
517 tlsp->certificate_verified = state->peer_cert_verified;
518 #ifdef SUPPORT_DANE
519 tlsp->dane_verified = state->peer_dane_verified;
520 #endif
521
522 /* note that tls_channelbinding is not saved to the spool file, since it's
523 only available for use for authenticators while this TLS session is running. */
524
525 tlsp->channelbinding = NULL;
526 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
527 channel.data = NULL;
528 channel.size = 0;
529 if ((rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel)))
530 { DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc)); }
531 else
532 {
533 /* Declare the taintedness of the binding info. On server, untainted; on
534 client, tainted - being the Finish msg from the server. */
535
536 old_pool = store_pool;
537 store_pool = POOL_PERM;
538 tlsp->channelbinding = b64encode_taint(CUS channel.data, (int)channel.size,
539 !!state->host);
540 store_pool = old_pool;
541 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage\n");
542 }
543 #endif
544
545 /* peercert is set in peer_status() */
546 tlsp->peerdn = state->peerdn;
547 tlsp->sni = state->received_sni;
548
549 /* record our certificate */
550 {
551 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
552 gnutls_x509_crt_t crt;
553
554 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
555 }
556 }
557
558
559
560
561 #ifndef GNUTLS_AUTO_DHPARAMS
562 /*************************************************
563 * Setup up DH parameters *
564 *************************************************/
565
566 /* Generating the D-H parameters may take a long time. They only need to
567 be re-generated every so often, depending on security policy. What we do is to
568 keep these parameters in a file in the spool directory. If the file does not
569 exist, we generate them. This means that it is easy to cause a regeneration.
570
571 The new file is written as a temporary file and renamed, so that an incomplete
572 file is never present. If two processes both compute some new parameters, you
573 waste a bit of effort, but it doesn't seem worth messing around with locking to
574 prevent this.
575
576 Returns: OK/DEFER/FAIL
577 */
578
579 static int
580 init_server_dh(uschar ** errstr)
581 {
582 int fd, rc;
583 unsigned int dh_bits;
584 gnutls_datum_t m = {.data = NULL, .size = 0};
585 uschar filename_buf[PATH_MAX];
586 uschar *filename = NULL;
587 size_t sz;
588 uschar *exp_tls_dhparam;
589 BOOL use_file_in_spool = FALSE;
590 host_item *host = NULL; /* dummy for macros */
591
592 DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
593
594 if ((rc = gnutls_dh_params_init(&dh_server_params)))
595 return tls_error_gnu(US"gnutls_dh_params_init", rc, host, errstr);
596
597 if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam, errstr))
598 return DEFER;
599
600 if (!exp_tls_dhparam)
601 {
602 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
603 m.data = US std_dh_prime_default();
604 m.size = Ustrlen(m.data);
605 }
606 else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
607 use_file_in_spool = TRUE;
608 else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
609 {
610 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
611 return OK;
612 }
613 else if (exp_tls_dhparam[0] != '/')
614 {
615 if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
616 return tls_error(US"No standard prime named", exp_tls_dhparam, NULL, errstr);
617 m.size = Ustrlen(m.data);
618 }
619 else
620 filename = exp_tls_dhparam;
621
622 if (m.data)
623 {
624 if ((rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM)))
625 return tls_error_gnu(US"gnutls_dh_params_import_pkcs3", rc, host, errstr);
626 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
627 return OK;
628 }
629
630 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
631 /* If you change this constant, also change dh_param_fn_ext so that we can use a
632 different filename and ensure we have sufficient bits. */
633
634 if (!(dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL)))
635 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL, errstr);
636 DEBUG(D_tls)
637 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
638 dh_bits);
639 #else
640 dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
641 DEBUG(D_tls)
642 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
643 dh_bits);
644 #endif
645
646 /* Some clients have hard-coded limits. */
647 if (dh_bits > tls_dh_max_bits)
648 {
649 DEBUG(D_tls)
650 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
651 tls_dh_max_bits);
652 dh_bits = tls_dh_max_bits;
653 }
654
655 if (use_file_in_spool)
656 {
657 if (!string_format(filename_buf, sizeof(filename_buf),
658 "%s/gnutls-params-%d", spool_directory, dh_bits))
659 return tls_error(US"overlong filename", NULL, NULL, errstr);
660 filename = filename_buf;
661 }
662
663 /* Open the cache file for reading and if successful, read it and set up the
664 parameters. */
665
666 if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
667 {
668 struct stat statbuf;
669 FILE *fp;
670 int saved_errno;
671
672 if (fstat(fd, &statbuf) < 0) /* EIO */
673 {
674 saved_errno = errno;
675 (void)close(fd);
676 return tls_error_sys(US"TLS cache stat failed", saved_errno, NULL, errstr);
677 }
678 if (!S_ISREG(statbuf.st_mode))
679 {
680 (void)close(fd);
681 return tls_error(US"TLS cache not a file", NULL, NULL, errstr);
682 }
683 if (!(fp = fdopen(fd, "rb")))
684 {
685 saved_errno = errno;
686 (void)close(fd);
687 return tls_error_sys(US"fdopen(TLS cache stat fd) failed",
688 saved_errno, NULL, errstr);
689 }
690
691 m.size = statbuf.st_size;
692 if (!(m.data = store_malloc(m.size)))
693 {
694 fclose(fp);
695 return tls_error_sys(US"malloc failed", errno, NULL, errstr);
696 }
697 if (!(sz = fread(m.data, m.size, 1, fp)))
698 {
699 saved_errno = errno;
700 fclose(fp);
701 store_free(m.data);
702 return tls_error_sys(US"fread failed", saved_errno, NULL, errstr);
703 }
704 fclose(fp);
705
706 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
707 store_free(m.data);
708 if (rc)
709 return tls_error_gnu(US"gnutls_dh_params_import_pkcs3", rc, host, errstr);
710 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
711 }
712
713 /* If the file does not exist, fall through to compute new data and cache it.
714 If there was any other opening error, it is serious. */
715
716 else if (errno == ENOENT)
717 {
718 rc = -1;
719 DEBUG(D_tls)
720 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
721 }
722 else
723 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
724 NULL, NULL, errstr);
725
726 /* If ret < 0, either the cache file does not exist, or the data it contains
727 is not useful. One particular case of this is when upgrading from an older
728 release of Exim in which the data was stored in a different format. We don't
729 try to be clever and support both formats; we just regenerate new data in this
730 case. */
731
732 if (rc < 0)
733 {
734 uschar *temp_fn;
735 unsigned int dh_bits_gen = dh_bits;
736
737 if ((PATH_MAX - Ustrlen(filename)) < 10)
738 return tls_error(US"Filename too long to generate replacement",
739 filename, NULL, errstr);
740
741 temp_fn = string_copy(US"%s.XXXXXXX");
742 if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */
743 return tls_error_sys(US"Unable to open temp file", errno, NULL, errstr);
744 (void)exim_chown(temp_fn, exim_uid, exim_gid); /* Probably not necessary */
745
746 /* GnuTLS overshoots! If we ask for 2236, we might get 2237 or more. But
747 there's no way to ask GnuTLS how many bits there really are. We can ask
748 how many bits were used in a TLS session, but that's it! The prime itself
749 is hidden behind too much abstraction. So we ask for less, and proceed on
750 a wing and a prayer. First attempt, subtracted 3 for 2233 and got 2240. */
751
752 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
753 {
754 dh_bits_gen = dh_bits - 10;
755 DEBUG(D_tls)
756 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
757 dh_bits_gen);
758 }
759
760 DEBUG(D_tls)
761 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
762 dh_bits_gen);
763 if ((rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen)))
764 return tls_error_gnu(US"gnutls_dh_params_generate2", rc, host, errstr);
765
766 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
767 and I confirmed that a NULL call to get the size first is how the GnuTLS
768 sample apps handle this. */
769
770 sz = 0;
771 m.data = NULL;
772 if ( (rc = gnutls_dh_params_export_pkcs3(dh_server_params,
773 GNUTLS_X509_FMT_PEM, m.data, &sz))
774 && rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
775 return tls_error_gnu(US"gnutls_dh_params_export_pkcs3(NULL) sizing",
776 rc, host, errstr);
777 m.size = sz;
778 if (!(m.data = store_malloc(m.size)))
779 return tls_error_sys(US"memory allocation failed", errno, NULL, errstr);
780
781 /* this will return a size 1 less than the allocation size above */
782 if ((rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
783 m.data, &sz)))
784 {
785 store_free(m.data);
786 return tls_error_gnu(US"gnutls_dh_params_export_pkcs3() real", rc, host, errstr);
787 }
788 m.size = sz; /* shrink by 1, probably */
789
790 if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
791 {
792 store_free(m.data);
793 return tls_error_sys(US"TLS cache write D-H params failed",
794 errno, NULL, errstr);
795 }
796 store_free(m.data);
797 if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
798 return tls_error_sys(US"TLS cache write D-H params final newline failed",
799 errno, NULL, errstr);
800
801 if ((rc = close(fd)))
802 return tls_error_sys(US"TLS cache write close() failed", errno, NULL, errstr);
803
804 if (Urename(temp_fn, filename) < 0)
805 return tls_error_sys(string_sprintf("failed to rename \"%s\" as \"%s\"",
806 temp_fn, filename), errno, NULL, errstr);
807
808 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
809 }
810
811 DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
812 return OK;
813 }
814 #endif
815
816
817
818
819 /* Create and install a selfsigned certificate, for use in server mode */
820
821 static int
822 tls_install_selfsign(exim_gnutls_state_st * state, uschar ** errstr)
823 {
824 gnutls_x509_crt_t cert = NULL;
825 time_t now;
826 gnutls_x509_privkey_t pkey = NULL;
827 const uschar * where;
828 int rc;
829
830 #ifndef SUPPORT_SELFSIGN
831 where = US"library too old";
832 rc = GNUTLS_E_NO_CERTIFICATE_FOUND;
833 if (TRUE) goto err;
834 #endif
835
836 where = US"initialising pkey";
837 if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
838
839 where = US"initialising cert";
840 if ((rc = gnutls_x509_crt_init(&cert))) goto err;
841
842 where = US"generating pkey"; /* Hangs on 2.12.23 */
843 if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
844 #ifdef SUPPORT_PARAM_TO_PK_BITS
845 # ifndef GNUTLS_SEC_PARAM_MEDIUM
846 # define GNUTLS_SEC_PARAM_MEDIUM GNUTLS_SEC_PARAM_HIGH
847 # endif
848 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_MEDIUM),
849 #else
850 2048,
851 #endif
852 0)))
853 goto err;
854
855 where = US"configuring cert";
856 now = 1;
857 if ( (rc = gnutls_x509_crt_set_version(cert, 3))
858 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
859 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
860 || (rc = gnutls_x509_crt_set_expiration_time(cert, now + 60 * 60)) /* 1 hr */
861 || (rc = gnutls_x509_crt_set_key(cert, pkey))
862
863 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
864 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
865 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
866 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
867 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
868 GNUTLS_OID_X520_COMMON_NAME, 0,
869 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
870 )
871 goto err;
872
873 where = US"signing cert";
874 if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
875
876 where = US"installing selfsign cert";
877 /* Since: 2.4.0 */
878 if ((rc = gnutls_certificate_set_x509_key(state->x509_cred, &cert, 1, pkey)))
879 goto err;
880
881 rc = OK;
882
883 out:
884 if (cert) gnutls_x509_crt_deinit(cert);
885 if (pkey) gnutls_x509_privkey_deinit(pkey);
886 return rc;
887
888 err:
889 rc = tls_error_gnu(where, rc, NULL, errstr);
890 goto out;
891 }
892
893
894
895
896 /* Add certificate and key, from files.
897
898 Return:
899 Zero or negative: good. Negate value for certificate index if < 0.
900 Greater than zero: FAIL or DEFER code.
901 */
902
903 static int
904 tls_add_certfile(exim_gnutls_state_st * state, const host_item * host,
905 uschar * certfile, uschar * keyfile, uschar ** errstr)
906 {
907 int rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
908 CS certfile, CS keyfile, GNUTLS_X509_FMT_PEM);
909 if (rc < 0)
910 return tls_error_gnu(
911 string_sprintf("cert/key setup: cert=%s key=%s", certfile, keyfile),
912 rc, host, errstr);
913 return -rc;
914 }
915
916
917 #if !defined(DISABLE_OCSP) && !defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
918 /* Load an OCSP proof from file for sending by the server. Called
919 on getting a status-request handshake message, for earlier versions
920 of GnuTLS. */
921
922 static int
923 server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
924 gnutls_datum_t * ocsp_response)
925 {
926 int ret;
927 DEBUG(D_tls) debug_printf("OCSP stapling callback: %s\n", US ptr);
928
929 if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
930 {
931 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
932 CS ptr);
933 tls_in.ocsp = OCSP_NOT_RESP;
934 return GNUTLS_E_NO_CERTIFICATE_STATUS;
935 }
936
937 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
938 return 0;
939 }
940 #endif
941
942
943 #ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
944 /* Make a note that we saw a status-request */
945 static int
946 tls_server_clienthello_ext(void * ctx, unsigned tls_id,
947 const unsigned char *data, unsigned size)
948 {
949 /* https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
950 if (tls_id == 5) /* status_request */
951 {
952 DEBUG(D_tls) debug_printf("Seen status_request extension from client\n");
953 tls_in.ocsp = OCSP_NOT_RESP;
954 }
955 return 0;
956 }
957
958 /* Callback for client-hello, on server, if we think we might serve stapled-OCSP */
959 static int
960 tls_server_clienthello_cb(gnutls_session_t session, unsigned int htype,
961 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
962 {
963 /* Call fn for each extension seen. 3.6.3 onwards */
964 return gnutls_ext_raw_parse(NULL, tls_server_clienthello_ext, msg,
965 GNUTLS_EXT_RAW_FLAG_TLS_CLIENT_HELLO);
966 }
967
968
969 /* Make a note that we saw a status-response */
970 static int
971 tls_server_servercerts_ext(void * ctx, unsigned tls_id,
972 const unsigned char *data, unsigned size)
973 {
974 /* debug_printf("%s %u\n", __FUNCTION__, tls_id); */
975 /* https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
976 if (FALSE && tls_id == 5) /* status_request */
977 {
978 DEBUG(D_tls) debug_printf("Seen status_request extension\n");
979 tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
980 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
981 }
982 return 0;
983 }
984
985 /* Callback for certificates packet, on server, if we think we might serve stapled-OCSP */
986 static int
987 tls_server_servercerts_cb(gnutls_session_t session, unsigned int htype,
988 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
989 {
990 /* Call fn for each extension seen. 3.6.3 onwards */
991 #ifdef notdef
992 /*XXX crashes */
993 return gnutls_ext_raw_parse(NULL, tls_server_servercerts_ext, msg, 0);
994 #endif
995 }
996 #endif
997
998 /*XXX in tls1.3 the cert-status travel as an extension next to the cert, in the
999 "Handshake Protocol: Certificate" record.
1000 So we need to spot the Certificate handshake message, parse it and spot any status_request extension(s)
1001
1002 This is different to tls1.2 - where it is a separate record (wireshake term) / handshake message (gnutls term).
1003 */
1004
1005 #if defined(EXPERIMENTAL_TLS_RESUME) || defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1006 /* Callback for certificate-status, on server. We sent stapled OCSP. */
1007 static int
1008 tls_server_certstatus_cb(gnutls_session_t session, unsigned int htype,
1009 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
1010 {
1011 DEBUG(D_tls) debug_printf("Sending certificate-status\n"); /*XXX we get this for tls1.2 but not for 1.3 */
1012 #ifdef SUPPORT_SRV_OCSP_STACK
1013 tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
1014 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
1015 #else
1016 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1017 #endif
1018 return 0;
1019 }
1020
1021 /* Callback for handshake messages, on server */
1022 static int
1023 tls_server_hook_cb(gnutls_session_t sess, u_int htype, unsigned when,
1024 unsigned incoming, const gnutls_datum_t * msg)
1025 {
1026 /* debug_printf("%s: htype %u\n", __FUNCTION__, htype); */
1027 switch (htype)
1028 {
1029 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1030 case GNUTLS_HANDSHAKE_CLIENT_HELLO:
1031 return tls_server_clienthello_cb(sess, htype, when, incoming, msg);
1032 case GNUTLS_HANDSHAKE_CERTIFICATE_PKT:
1033 return tls_server_servercerts_cb(sess, htype, when, incoming, msg);
1034 # endif
1035 case GNUTLS_HANDSHAKE_CERTIFICATE_STATUS:
1036 return tls_server_certstatus_cb(sess, htype, when, incoming, msg);
1037 # ifdef EXPERIMENTAL_TLS_RESUME
1038 case GNUTLS_HANDSHAKE_NEW_SESSION_TICKET:
1039 return tls_server_ticket_cb(sess, htype, when, incoming, msg);
1040 # endif
1041 default:
1042 return 0;
1043 }
1044 }
1045 #endif
1046
1047
1048 #if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1049 static void
1050 tls_server_testharness_ocsp_fiddle(void)
1051 {
1052 extern char ** environ;
1053 if (environ) for (uschar ** p = USS environ; *p; p++)
1054 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1055 {
1056 DEBUG(D_tls) debug_printf("Permitting known bad OCSP response\n");
1057 exim_testharness_disable_ocsp_validity_check = TRUE;
1058 }
1059 }
1060 #endif
1061
1062 /*************************************************
1063 * Variables re-expanded post-SNI *
1064 *************************************************/
1065
1066 /* Called from both server and client code, via tls_init(), and also from
1067 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
1068
1069 We can tell the two apart by state->received_sni being non-NULL in callback.
1070
1071 The callback should not call us unless state->trigger_sni_changes is true,
1072 which we are responsible for setting on the first pass through.
1073
1074 Arguments:
1075 state exim_gnutls_state_st *
1076 errstr error string pointer
1077
1078 Returns: OK/DEFER/FAIL
1079 */
1080
1081 static int
1082 tls_expand_session_files(exim_gnutls_state_st * state, uschar ** errstr)
1083 {
1084 struct stat statbuf;
1085 int rc;
1086 const host_item *host = state->host; /* macro should be reconsidered? */
1087 uschar *saved_tls_certificate = NULL;
1088 uschar *saved_tls_privatekey = NULL;
1089 uschar *saved_tls_verify_certificates = NULL;
1090 uschar *saved_tls_crl = NULL;
1091 int cert_count;
1092
1093 /* We check for tls_sni *before* expansion. */
1094 if (!host) /* server */
1095 if (!state->received_sni)
1096 {
1097 if ( state->tls_certificate
1098 && ( Ustrstr(state->tls_certificate, US"tls_sni")
1099 || Ustrstr(state->tls_certificate, US"tls_in_sni")
1100 || Ustrstr(state->tls_certificate, US"tls_out_sni")
1101 ) )
1102 {
1103 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
1104 state->trigger_sni_changes = TRUE;
1105 }
1106 }
1107 else
1108 {
1109 /* useful for debugging */
1110 saved_tls_certificate = state->exp_tls_certificate;
1111 saved_tls_privatekey = state->exp_tls_privatekey;
1112 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
1113 saved_tls_crl = state->exp_tls_crl;
1114 }
1115
1116 if ((rc = gnutls_certificate_allocate_credentials(&state->x509_cred)))
1117 return tls_error_gnu(US"gnutls_certificate_allocate_credentials",
1118 rc, host, errstr);
1119
1120 #ifdef SUPPORT_SRV_OCSP_STACK
1121 gnutls_certificate_set_flags(state->x509_cred, GNUTLS_CERTIFICATE_API_V2);
1122
1123 # if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1124 if (!host && tls_ocsp_file)
1125 {
1126 if (f.running_in_test_harness)
1127 tls_server_testharness_ocsp_fiddle();
1128
1129 if (exim_testharness_disable_ocsp_validity_check)
1130 gnutls_certificate_set_flags(state->x509_cred,
1131 GNUTLS_CERTIFICATE_API_V2 | GNUTLS_CERTIFICATE_SKIP_OCSP_RESPONSE_CHECK);
1132 }
1133 # endif
1134 #endif
1135
1136 /* remember: expand_check_tlsvar() is expand_check() but fiddling with
1137 state members, assuming consistent naming; and expand_check() returns
1138 false if expansion failed, unless expansion was forced to fail. */
1139
1140 /* check if we at least have a certificate, before doing expensive
1141 D-H generation. */
1142
1143 if (!expand_check_tlsvar(tls_certificate, errstr))
1144 return DEFER;
1145
1146 /* certificate is mandatory in server, optional in client */
1147
1148 if ( !state->exp_tls_certificate
1149 || !*state->exp_tls_certificate
1150 )
1151 if (!host)
1152 return tls_install_selfsign(state, errstr);
1153 else
1154 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
1155
1156 if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey, errstr))
1157 return DEFER;
1158
1159 /* tls_privatekey is optional, defaulting to same file as certificate */
1160
1161 if (!state->tls_privatekey || !*state->tls_privatekey)
1162 {
1163 state->tls_privatekey = state->tls_certificate;
1164 state->exp_tls_privatekey = state->exp_tls_certificate;
1165 }
1166
1167
1168 if (state->exp_tls_certificate && *state->exp_tls_certificate)
1169 {
1170 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
1171 state->exp_tls_certificate, state->exp_tls_privatekey);
1172
1173 if (state->received_sni)
1174 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
1175 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
1176 )
1177 {
1178 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
1179 }
1180 else
1181 {
1182 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
1183 }
1184
1185 if (!host) /* server */
1186 {
1187 const uschar * clist = state->exp_tls_certificate;
1188 const uschar * klist = state->exp_tls_privatekey;
1189 const uschar * olist;
1190 int csep = 0, ksep = 0, osep = 0, cnt = 0;
1191 uschar * cfile, * kfile, * ofile;
1192 #ifndef DISABLE_OCSP
1193 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1194 gnutls_x509_crt_fmt_t ocsp_fmt = GNUTLS_X509_FMT_DER;
1195 # endif
1196
1197 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file", &ofile, errstr))
1198 return DEFER;
1199 olist = ofile;
1200 #endif
1201
1202 while (cfile = string_nextinlist(&clist, &csep, NULL, 0))
1203
1204 if (!(kfile = string_nextinlist(&klist, &ksep, NULL, 0)))
1205 return tls_error(US"cert/key setup: out of keys", NULL, host, errstr);
1206 else if (0 < (rc = tls_add_certfile(state, host, cfile, kfile, errstr)))
1207 return rc;
1208 else
1209 {
1210 int gnutls_cert_index = -rc;
1211 DEBUG(D_tls) debug_printf("TLS: cert/key %d %s registered\n",
1212 gnutls_cert_index, cfile);
1213
1214 #ifndef DISABLE_OCSP
1215 if (tls_ocsp_file)
1216 {
1217 /* Set the OCSP stapling server info */
1218 if (gnutls_buggy_ocsp)
1219 {
1220 DEBUG(D_tls)
1221 debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
1222 }
1223 else if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1224 {
1225 DEBUG(D_tls) debug_printf("OCSP response file %d = %s\n",
1226 gnutls_cert_index, ofile);
1227 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1228 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
1229 {
1230 ocsp_fmt = GNUTLS_X509_FMT_PEM;
1231 ofile += 4;
1232 }
1233 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1234 {
1235 ocsp_fmt = GNUTLS_X509_FMT_DER;
1236 ofile += 4;
1237 }
1238
1239 if ((rc = gnutls_certificate_set_ocsp_status_request_file2(
1240 state->x509_cred, CCS ofile, gnutls_cert_index,
1241 ocsp_fmt)) < 0)
1242 return tls_error_gnu(
1243 US"gnutls_certificate_set_ocsp_status_request_file2",
1244 rc, host, errstr);
1245 DEBUG(D_tls)
1246 debug_printf(" %d response%s loaded\n", rc, rc>1 ? "s":"");
1247
1248 /* Arrange callbacks for OCSP request observability */
1249
1250 gnutls_handshake_set_hook_function(state->session,
1251 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
1252
1253 # else
1254 # if defined(SUPPORT_SRV_OCSP_STACK)
1255 if ((rc = gnutls_certificate_set_ocsp_status_request_function2(
1256 state->x509_cred, gnutls_cert_index,
1257 server_ocsp_stapling_cb, ofile)))
1258 return tls_error_gnu(
1259 US"gnutls_certificate_set_ocsp_status_request_function2",
1260 rc, host, errstr);
1261 else
1262 # endif
1263 {
1264 if (cnt++ > 0)
1265 {
1266 DEBUG(D_tls)
1267 debug_printf("oops; multiple OCSP files not supported\n");
1268 break;
1269 }
1270 gnutls_certificate_set_ocsp_status_request_function(
1271 state->x509_cred, server_ocsp_stapling_cb, ofile);
1272 }
1273 # endif /* SUPPORT_GNUTLS_EXT_RAW_PARSE */
1274 }
1275 else
1276 DEBUG(D_tls) debug_printf("ran out of OCSP response files in list\n");
1277 }
1278 #endif /* DISABLE_OCSP */
1279 }
1280 }
1281 else /* client */
1282 {
1283 if (0 < (rc = tls_add_certfile(state, host,
1284 state->exp_tls_certificate, state->exp_tls_privatekey, errstr)))
1285 return rc;
1286 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
1287 }
1288
1289 } /* tls_certificate */
1290
1291
1292 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
1293 provided. Experiment shows that, if the certificate file is empty, an unhelpful
1294 error message is provided. However, if we just refrain from setting anything up
1295 in that case, certificate verification fails, which seems to be the correct
1296 behaviour. */
1297
1298 if (state->tls_verify_certificates && *state->tls_verify_certificates)
1299 {
1300 if (!expand_check_tlsvar(tls_verify_certificates, errstr))
1301 return DEFER;
1302 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1303 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1304 state->exp_tls_verify_certificates = NULL;
1305 #endif
1306 if (state->tls_crl && *state->tls_crl)
1307 if (!expand_check_tlsvar(tls_crl, errstr))
1308 return DEFER;
1309
1310 if (!(state->exp_tls_verify_certificates &&
1311 *state->exp_tls_verify_certificates))
1312 {
1313 DEBUG(D_tls)
1314 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
1315 /* With no tls_verify_certificates, we ignore tls_crl too */
1316 return OK;
1317 }
1318 }
1319 else
1320 {
1321 DEBUG(D_tls)
1322 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
1323 return OK;
1324 }
1325
1326 #ifdef SUPPORT_SYSDEFAULT_CABUNDLE
1327 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1328 cert_count = gnutls_certificate_set_x509_system_trust(state->x509_cred);
1329 else
1330 #endif
1331 {
1332 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
1333 {
1334 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat '%s' "
1335 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
1336 strerror(errno));
1337 return DEFER;
1338 }
1339
1340 #ifndef SUPPORT_CA_DIR
1341 /* The test suite passes in /dev/null; we could check for that path explicitly,
1342 but who knows if someone has some weird FIFO which always dumps some certs, or
1343 other weirdness. The thing we really want to check is that it's not a
1344 directory, since while OpenSSL supports that, GnuTLS does not.
1345 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
1346 if (S_ISDIR(statbuf.st_mode))
1347 {
1348 DEBUG(D_tls)
1349 debug_printf("verify certificates path is a dir: \"%s\"\n",
1350 state->exp_tls_verify_certificates);
1351 log_write(0, LOG_MAIN|LOG_PANIC,
1352 "tls_verify_certificates \"%s\" is a directory",
1353 state->exp_tls_verify_certificates);
1354 return DEFER;
1355 }
1356 #endif
1357
1358 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
1359 state->exp_tls_verify_certificates, statbuf.st_size);
1360
1361 if (statbuf.st_size == 0)
1362 {
1363 DEBUG(D_tls)
1364 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
1365 return OK;
1366 }
1367
1368 cert_count =
1369
1370 #ifdef SUPPORT_CA_DIR
1371 (statbuf.st_mode & S_IFMT) == S_IFDIR
1372 ?
1373 gnutls_certificate_set_x509_trust_dir(state->x509_cred,
1374 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM)
1375 :
1376 #endif
1377 gnutls_certificate_set_x509_trust_file(state->x509_cred,
1378 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
1379
1380 #ifdef SUPPORT_CA_DIR
1381 /* Mimic the behaviour with OpenSSL of not advertising a usable-cert list
1382 when using the directory-of-certs config model. */
1383
1384 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1385 gnutls_certificate_send_x509_rdn_sequence(state->session, 1);
1386 #endif
1387 }
1388
1389 if (cert_count < 0)
1390 return tls_error_gnu(US"setting certificate trust", cert_count, host, errstr);
1391 DEBUG(D_tls)
1392 debug_printf("Added %d certificate authorities.\n", cert_count);
1393
1394 if (state->tls_crl && *state->tls_crl &&
1395 state->exp_tls_crl && *state->exp_tls_crl)
1396 {
1397 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
1398 if ((cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
1399 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM)) < 0)
1400 return tls_error_gnu(US"gnutls_certificate_set_x509_crl_file",
1401 cert_count, host, errstr);
1402
1403 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1404 }
1405
1406 return OK;
1407 }
1408
1409
1410
1411
1412 /*************************************************
1413 * Set X.509 state variables *
1414 *************************************************/
1415
1416 /* In GnuTLS, the registered cert/key are not replaced by a later
1417 set of a cert/key, so for SNI support we need a whole new x509_cred
1418 structure. Which means various other non-re-expanded pieces of state
1419 need to be re-set in the new struct, so the setting logic is pulled
1420 out to this.
1421
1422 Arguments:
1423 state exim_gnutls_state_st *
1424 errstr error string pointer
1425
1426 Returns: OK/DEFER/FAIL
1427 */
1428
1429 static int
1430 tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr)
1431 {
1432 int rc;
1433 const host_item *host = state->host; /* macro should be reconsidered? */
1434
1435 #ifndef GNUTLS_AUTO_DHPARAMS
1436 /* Create D-H parameters, or read them from the cache file. This function does
1437 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
1438 client-side params. */
1439
1440 if (!state->host)
1441 {
1442 if (!dh_server_params)
1443 if ((rc = init_server_dh(errstr)) != OK) return rc;
1444
1445 /* Unnecessary & discouraged with 3.6.0 or later */
1446 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
1447 }
1448 #endif
1449
1450 /* Link the credentials to the session. */
1451
1452 if ((rc = gnutls_credentials_set(state->session,
1453 GNUTLS_CRD_CERTIFICATE, state->x509_cred)))
1454 return tls_error_gnu(US"gnutls_credentials_set", rc, host, errstr);
1455
1456 return OK;
1457 }
1458
1459 /*************************************************
1460 * Initialize for GnuTLS *
1461 *************************************************/
1462
1463
1464 #ifndef DISABLE_OCSP
1465
1466 static BOOL
1467 tls_is_buggy_ocsp(void)
1468 {
1469 const uschar * s;
1470 uschar maj, mid, mic;
1471
1472 s = CUS gnutls_check_version(NULL);
1473 maj = atoi(CCS s);
1474 if (maj == 3)
1475 {
1476 while (*s && *s != '.') s++;
1477 mid = atoi(CCS ++s);
1478 if (mid <= 2)
1479 return TRUE;
1480 else if (mid >= 5)
1481 return FALSE;
1482 else
1483 {
1484 while (*s && *s != '.') s++;
1485 mic = atoi(CCS ++s);
1486 return mic <= (mid == 3 ? 16 : 3);
1487 }
1488 }
1489 return FALSE;
1490 }
1491
1492 #endif
1493
1494
1495 /* Called from both server and client code. In the case of a server, errors
1496 before actual TLS negotiation return DEFER.
1497
1498 Arguments:
1499 host connected host, if client; NULL if server
1500 certificate certificate file
1501 privatekey private key file
1502 sni TLS SNI to send, sometimes when client; else NULL
1503 cas CA certs file
1504 crl CRL file
1505 require_ciphers tls_require_ciphers setting
1506 caller_state returned state-info structure
1507 errstr error string pointer
1508
1509 Returns: OK/DEFER/FAIL
1510 */
1511
1512 static int
1513 tls_init(
1514 const host_item *host,
1515 const uschar *certificate,
1516 const uschar *privatekey,
1517 const uschar *sni,
1518 const uschar *cas,
1519 const uschar *crl,
1520 const uschar *require_ciphers,
1521 exim_gnutls_state_st **caller_state,
1522 tls_support * tlsp,
1523 uschar ** errstr)
1524 {
1525 exim_gnutls_state_st * state;
1526 int rc;
1527 size_t sz;
1528 const char * errpos;
1529 const uschar * p;
1530
1531 if (!exim_gnutls_base_init_done)
1532 {
1533 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1534
1535 #if defined(HAVE_GNUTLS_PKCS11) && !defined(GNUTLS_AUTO_PKCS11_MANUAL)
1536 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1537 which loads modules from a config file, which sounds good and may be wanted
1538 by some sysadmin, but also means in common configurations that GNOME keyring
1539 environment variables are used and so breaks for users calling mailq.
1540 To prevent this, we init PKCS11 first, which is the documented approach. */
1541 if (!gnutls_allow_auto_pkcs11)
1542 if ((rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL)))
1543 return tls_error_gnu(US"gnutls_pkcs11_init", rc, host, errstr);
1544 #endif
1545
1546 #ifndef GNUTLS_AUTO_GLOBAL_INIT
1547 if ((rc = gnutls_global_init()))
1548 return tls_error_gnu(US"gnutls_global_init", rc, host, errstr);
1549 #endif
1550
1551 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1552 DEBUG(D_tls)
1553 {
1554 gnutls_global_set_log_function(exim_gnutls_logger_cb);
1555 /* arbitrarily chosen level; bump up to 9 for more */
1556 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
1557 }
1558 #endif
1559
1560 #ifndef DISABLE_OCSP
1561 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
1562 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
1563 #endif
1564
1565 exim_gnutls_base_init_done = TRUE;
1566 }
1567
1568 if (host)
1569 {
1570 /* For client-side sessions we allocate a context. This lets us run
1571 several in parallel. */
1572 int old_pool = store_pool;
1573 store_pool = POOL_PERM;
1574 state = store_get(sizeof(exim_gnutls_state_st), FALSE);
1575 store_pool = old_pool;
1576
1577 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1578 state->tlsp = tlsp;
1579 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1580 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1581 }
1582 else
1583 {
1584 state = &state_server;
1585 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1586 state->tlsp = tlsp;
1587 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1588 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1589 }
1590 if (rc)
1591 return tls_error_gnu(US"gnutls_init", rc, host, errstr);
1592
1593 state->host = host;
1594
1595 state->tls_certificate = certificate;
1596 state->tls_privatekey = privatekey;
1597 state->tls_require_ciphers = require_ciphers;
1598 state->tls_sni = sni;
1599 state->tls_verify_certificates = cas;
1600 state->tls_crl = crl;
1601
1602 /* This handles the variables that might get re-expanded after TLS SNI;
1603 that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
1604
1605 DEBUG(D_tls)
1606 debug_printf("Expanding various TLS configuration options for session credentials.\n");
1607 if ((rc = tls_expand_session_files(state, errstr)) != OK) return rc;
1608
1609 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1610 requires a new structure afterwards. */
1611
1612 if ((rc = tls_set_remaining_x509(state, errstr)) != OK) return rc;
1613
1614 /* set SNI in client, only */
1615 if (host)
1616 {
1617 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni, errstr))
1618 return DEFER;
1619 if (state->tlsp->sni && *state->tlsp->sni)
1620 {
1621 DEBUG(D_tls)
1622 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1623 sz = Ustrlen(state->tlsp->sni);
1624 if ((rc = gnutls_server_name_set(state->session,
1625 GNUTLS_NAME_DNS, state->tlsp->sni, sz)))
1626 return tls_error_gnu(US"gnutls_server_name_set", rc, host, errstr);
1627 }
1628 }
1629 else if (state->tls_sni)
1630 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
1631 "have an SNI set for a server [%s]\n", state->tls_sni);
1632
1633 /* This is the priority string support,
1634 http://www.gnutls.org/manual/html_node/Priority-Strings.html
1635 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1636 This was backwards incompatible, but means Exim no longer needs to track
1637 all algorithms and provide string forms for them. */
1638
1639 p = NULL;
1640 if (state->tls_require_ciphers && *state->tls_require_ciphers)
1641 {
1642 if (!expand_check_tlsvar(tls_require_ciphers, errstr))
1643 return DEFER;
1644 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
1645 {
1646 p = state->exp_tls_require_ciphers;
1647 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n", p);
1648 }
1649 }
1650 if (!p)
1651 {
1652 p = exim_default_gnutls_priority;
1653 DEBUG(D_tls)
1654 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n", p);
1655 }
1656
1657 if ((rc = gnutls_priority_init(&state->priority_cache, CCS p, &errpos)))
1658 return tls_error_gnu(string_sprintf(
1659 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1660 p, errpos - CS p, errpos),
1661 rc, host, errstr);
1662
1663 if ((rc = gnutls_priority_set(state->session, state->priority_cache)))
1664 return tls_error_gnu(US"gnutls_priority_set", rc, host, errstr);
1665
1666 /* This also sets the server ticket expiration time to the same, and
1667 the STEK rotation time to 3x. */
1668
1669 gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1670
1671 /* Reduce security in favour of increased compatibility, if the admin
1672 decides to make that trade-off. */
1673 if (gnutls_compat_mode)
1674 {
1675 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1676 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1677 gnutls_session_enable_compatibility_mode(state->session);
1678 #else
1679 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1680 #endif
1681 }
1682
1683 *caller_state = state;
1684 return OK;
1685 }
1686
1687
1688
1689 /*************************************************
1690 * Extract peer information *
1691 *************************************************/
1692
1693 static const uschar *
1694 cipher_stdname_kcm(gnutls_kx_algorithm_t kx, gnutls_cipher_algorithm_t cipher,
1695 gnutls_mac_algorithm_t mac)
1696 {
1697 uschar cs_id[2];
1698 gnutls_kx_algorithm_t kx_i;
1699 gnutls_cipher_algorithm_t cipher_i;
1700 gnutls_mac_algorithm_t mac_i;
1701
1702 for (size_t i = 0;
1703 gnutls_cipher_suite_info(i, cs_id, &kx_i, &cipher_i, &mac_i, NULL);
1704 i++)
1705 if (kx_i == kx && cipher_i == cipher && mac_i == mac)
1706 return cipher_stdname(cs_id[0], cs_id[1]);
1707 return NULL;
1708 }
1709
1710
1711
1712 /* Called from both server and client code.
1713 Only this is allowed to set state->peerdn and state->have_set_peerdn
1714 and we use that to detect double-calls.
1715
1716 NOTE: the state blocks last while the TLS connection is up, which is fine
1717 for logging in the server side, but for the client side, we log after teardown
1718 in src/deliver.c. While the session is up, we can twist about states and
1719 repoint tls_* globals, but those variables used for logging or other variable
1720 expansion that happens _after_ delivery need to have a longer life-time.
1721
1722 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1723 doing this more than once per generation of a state context. We set them in
1724 the state context, and repoint tls_* to them. After the state goes away, the
1725 tls_* copies of the pointers remain valid and client delivery logging is happy.
1726
1727 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1728 don't apply.
1729
1730 Arguments:
1731 state exim_gnutls_state_st *
1732 errstr pointer to error string
1733
1734 Returns: OK/DEFER/FAIL
1735 */
1736
1737 static int
1738 peer_status(exim_gnutls_state_st * state, uschar ** errstr)
1739 {
1740 gnutls_session_t session = state->session;
1741 const gnutls_datum_t * cert_list;
1742 int old_pool, rc;
1743 unsigned int cert_list_size = 0;
1744 gnutls_protocol_t protocol;
1745 gnutls_cipher_algorithm_t cipher;
1746 gnutls_kx_algorithm_t kx;
1747 gnutls_mac_algorithm_t mac;
1748 gnutls_certificate_type_t ct;
1749 gnutls_x509_crt_t crt;
1750 uschar * dn_buf;
1751 size_t sz;
1752
1753 if (state->have_set_peerdn)
1754 return OK;
1755 state->have_set_peerdn = TRUE;
1756
1757 state->peerdn = NULL;
1758
1759 /* tls_cipher */
1760 cipher = gnutls_cipher_get(session);
1761 protocol = gnutls_protocol_get_version(session);
1762 mac = gnutls_mac_get(session);
1763 kx =
1764 #ifdef GNUTLS_TLS1_3
1765 protocol >= GNUTLS_TLS1_3 ? 0 :
1766 #endif
1767 gnutls_kx_get(session);
1768
1769 old_pool = store_pool;
1770 {
1771 tls_support * tlsp = state->tlsp;
1772 store_pool = POOL_PERM;
1773
1774 #ifdef SUPPORT_GNUTLS_SESS_DESC
1775 {
1776 gstring * g = NULL;
1777 uschar * s = US gnutls_session_get_desc(session), c;
1778
1779 /* Nikos M suggests we use this by preference. It returns like:
1780 (TLS1.3)-(ECDHE-SECP256R1)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM)
1781
1782 For partial back-compat, put a colon after the TLS version, replace the
1783 )-( grouping with __, replace in-group - with _ and append the :keysize. */
1784
1785 /* debug_printf("peer_status: gnutls_session_get_desc %s\n", s); */
1786
1787 for (s++; (c = *s) && c != ')'; s++) g = string_catn(g, s, 1);
1788
1789 tlsp->ver = string_copyn(g->s, g->ptr);
1790 for (uschar * p = US tlsp->ver; *p; p++)
1791 if (*p == '-') { *p = '\0'; break; } /* TLS1.0-PKIX -> TLS1.0 */
1792
1793 g = string_catn(g, US":", 1);
1794 if (*s) s++; /* now on _ between groups */
1795 while ((c = *s))
1796 {
1797 for (*++s && ++s; (c = *s) && c != ')'; s++)
1798 g = string_catn(g, c == '-' ? US"_" : s, 1);
1799 /* now on ) closing group */
1800 if ((c = *s) && *++s == '-') g = string_catn(g, US"__", 2);
1801 /* now on _ between groups */
1802 }
1803 g = string_catn(g, US":", 1);
1804 g = string_cat(g, string_sprintf("%d", (int) gnutls_cipher_get_key_size(cipher) * 8));
1805 state->ciphersuite = string_from_gstring(g);
1806 }
1807 #else
1808 state->ciphersuite = string_sprintf("%s:%s:%d",
1809 gnutls_protocol_get_name(protocol),
1810 gnutls_cipher_suite_get_name(kx, cipher, mac),
1811 (int) gnutls_cipher_get_key_size(cipher) * 8);
1812
1813 /* I don't see a way that spaces could occur, in the current GnuTLS
1814 code base, but it was a concern in the old code and perhaps older GnuTLS
1815 releases did return "TLS 1.0"; play it safe, just in case. */
1816
1817 for (uschar * p = state->ciphersuite; *p; p++) if (isspace(*p)) *p = '-';
1818 tlsp->ver = string_copyn(state->ciphersuite,
1819 Ustrchr(state->ciphersuite, ':') - state->ciphersuite);
1820 #endif
1821
1822 /* debug_printf("peer_status: ciphersuite %s\n", state->ciphersuite); */
1823
1824 tlsp->cipher = state->ciphersuite;
1825 tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
1826
1827 tlsp->cipher_stdname = cipher_stdname_kcm(kx, cipher, mac);
1828 }
1829 store_pool = old_pool;
1830
1831 /* tls_peerdn */
1832 cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
1833
1834 if (!cert_list || cert_list_size == 0)
1835 {
1836 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1837 cert_list, cert_list_size);
1838 if (state->verify_requirement >= VERIFY_REQUIRED)
1839 return tls_error(US"certificate verification failed",
1840 US"no certificate received from peer", state->host, errstr);
1841 return OK;
1842 }
1843
1844 if ((ct = gnutls_certificate_type_get(session)) != GNUTLS_CRT_X509)
1845 {
1846 const uschar * ctn = US gnutls_certificate_type_get_name(ct);
1847 DEBUG(D_tls)
1848 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
1849 if (state->verify_requirement >= VERIFY_REQUIRED)
1850 return tls_error(US"certificate verification not possible, unhandled type",
1851 ctn, state->host, errstr);
1852 return OK;
1853 }
1854
1855 #define exim_gnutls_peer_err(Label) \
1856 do { \
1857 if (rc != GNUTLS_E_SUCCESS) \
1858 { \
1859 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1860 (Label), gnutls_strerror(rc)); \
1861 if (state->verify_requirement >= VERIFY_REQUIRED) \
1862 return tls_error_gnu((Label), rc, state->host, errstr); \
1863 return OK; \
1864 } \
1865 } while (0)
1866
1867 rc = import_cert(&cert_list[0], &crt);
1868 exim_gnutls_peer_err(US"cert 0");
1869
1870 state->tlsp->peercert = state->peercert = crt;
1871
1872 sz = 0;
1873 rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1874 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
1875 {
1876 exim_gnutls_peer_err(US"getting size for cert DN failed");
1877 return FAIL; /* should not happen */
1878 }
1879 dn_buf = store_get_perm(sz, TRUE); /* tainted */
1880 rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1881 exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1882
1883 state->peerdn = dn_buf;
1884
1885 return OK;
1886 #undef exim_gnutls_peer_err
1887 }
1888
1889
1890
1891
1892 /*************************************************
1893 * Verify peer certificate *
1894 *************************************************/
1895
1896 /* Called from both server and client code.
1897 *Should* be using a callback registered with
1898 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1899 the peer information, but that's too new for some OSes.
1900
1901 Arguments:
1902 state exim_gnutls_state_st *
1903 errstr where to put an error message
1904
1905 Returns:
1906 FALSE if the session should be rejected
1907 TRUE if the cert is okay or we just don't care
1908 */
1909
1910 static BOOL
1911 verify_certificate(exim_gnutls_state_st * state, uschar ** errstr)
1912 {
1913 int rc;
1914 uint verify;
1915
1916 DEBUG(D_tls) debug_printf("TLS: checking peer certificate\n");
1917 *errstr = NULL;
1918 rc = peer_status(state, errstr);
1919
1920 if (state->verify_requirement == VERIFY_NONE)
1921 return TRUE;
1922
1923 if (rc != OK || !state->peerdn)
1924 {
1925 verify = GNUTLS_CERT_INVALID;
1926 *errstr = US"certificate not supplied";
1927 }
1928 else
1929
1930 {
1931 #ifdef SUPPORT_DANE
1932 if (state->verify_requirement == VERIFY_DANE && state->host)
1933 {
1934 /* Using dane_verify_session_crt() would be easy, as it does it all for us
1935 including talking to a DNS resolver. But we want to do that bit ourselves
1936 as the testsuite intercepts and fakes its own DNS environment. */
1937
1938 dane_state_t s;
1939 dane_query_t r;
1940 uint lsize;
1941 const gnutls_datum_t * certlist =
1942 gnutls_certificate_get_peers(state->session, &lsize);
1943 int usage = tls_out.tlsa_usage;
1944
1945 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
1946 /* Split the TLSA records into two sets, TA and EE selectors. Run the
1947 dane-verification separately so that we know which selector verified;
1948 then we know whether to do name-verification (needed for TA but not EE). */
1949
1950 if (usage == ((1<<DANESSL_USAGE_DANE_TA) | (1<<DANESSL_USAGE_DANE_EE)))
1951 { /* a mixed-usage bundle */
1952 int i, j, nrec;
1953 const char ** dd;
1954 int * ddl;
1955
1956 for (nrec = 0; state->dane_data_len[nrec]; ) nrec++;
1957 nrec++;
1958
1959 dd = store_get(nrec * sizeof(uschar *), FALSE);
1960 ddl = store_get(nrec * sizeof(int), FALSE);
1961 nrec--;
1962
1963 if ((rc = dane_state_init(&s, 0)))
1964 goto tlsa_prob;
1965
1966 for (usage = DANESSL_USAGE_DANE_EE;
1967 usage >= DANESSL_USAGE_DANE_TA; usage--)
1968 { /* take records with this usage */
1969 for (j = i = 0; i < nrec; i++)
1970 if (state->dane_data[i][0] == usage)
1971 {
1972 dd[j] = state->dane_data[i];
1973 ddl[j++] = state->dane_data_len[i];
1974 }
1975 if (j)
1976 {
1977 dd[j] = NULL;
1978 ddl[j] = 0;
1979
1980 if ((rc = dane_raw_tlsa(s, &r, (char * const *)dd, ddl, 1, 0)))
1981 goto tlsa_prob;
1982
1983 if ((rc = dane_verify_crt_raw(s, certlist, lsize,
1984 gnutls_certificate_type_get(state->session),
1985 r, 0,
1986 usage == DANESSL_USAGE_DANE_EE
1987 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1988 &verify)))
1989 {
1990 DEBUG(D_tls)
1991 debug_printf("TLSA record problem: %s\n", dane_strerror(rc));
1992 }
1993 else if (verify == 0) /* verification passed */
1994 {
1995 usage = 1 << usage;
1996 break;
1997 }
1998 }
1999 }
2000
2001 if (rc) goto tlsa_prob;
2002 }
2003 else
2004 # endif
2005 {
2006 if ( (rc = dane_state_init(&s, 0))
2007 || (rc = dane_raw_tlsa(s, &r, state->dane_data, state->dane_data_len,
2008 1, 0))
2009 || (rc = dane_verify_crt_raw(s, certlist, lsize,
2010 gnutls_certificate_type_get(state->session),
2011 r, 0,
2012 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2013 usage == (1 << DANESSL_USAGE_DANE_EE)
2014 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
2015 # else
2016 0,
2017 # endif
2018 &verify))
2019 )
2020 goto tlsa_prob;
2021 }
2022
2023 if (verify != 0) /* verification failed */
2024 {
2025 gnutls_datum_t str;
2026 (void) dane_verification_status_print(verify, &str, 0);
2027 *errstr = US str.data; /* don't bother to free */
2028 goto badcert;
2029 }
2030
2031 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2032 /* If a TA-mode TLSA record was used for verification we must additionally
2033 verify the cert name (but not the CA chain). For EE-mode, skip it. */
2034
2035 if (usage & (1 << DANESSL_USAGE_DANE_EE))
2036 # endif
2037 {
2038 state->peer_dane_verified = state->peer_cert_verified = TRUE;
2039 goto goodcert;
2040 }
2041 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2042 /* Assume that the name on the A-record is the one that should be matching
2043 the cert. An alternate view is that the domain part of the email address
2044 is also permissible. */
2045
2046 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert,
2047 CS state->host->name))
2048 {
2049 state->peer_dane_verified = state->peer_cert_verified = TRUE;
2050 goto goodcert;
2051 }
2052 # endif
2053 }
2054 #endif /*SUPPORT_DANE*/
2055
2056 rc = gnutls_certificate_verify_peers2(state->session, &verify);
2057 }
2058
2059 /* Handle the result of verification. INVALID is set if any others are. */
2060
2061 if (rc < 0 || verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED))
2062 {
2063 state->peer_cert_verified = FALSE;
2064 if (!*errstr)
2065 {
2066 #ifdef GNUTLS_CERT_VFY_STATUS_PRINT
2067 DEBUG(D_tls)
2068 {
2069 gnutls_datum_t txt;
2070
2071 if (gnutls_certificate_verification_status_print(verify,
2072 gnutls_certificate_type_get(state->session), &txt, 0)
2073 == GNUTLS_E_SUCCESS)
2074 {
2075 debug_printf("%s\n", txt.data);
2076 gnutls_free(txt.data);
2077 }
2078 }
2079 #endif
2080 *errstr = verify & GNUTLS_CERT_REVOKED
2081 ? US"certificate revoked" : US"certificate invalid";
2082 }
2083
2084 DEBUG(D_tls)
2085 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
2086 *errstr, state->peerdn ? state->peerdn : US"<unset>");
2087
2088 if (state->verify_requirement >= VERIFY_REQUIRED)
2089 goto badcert;
2090 DEBUG(D_tls)
2091 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
2092 }
2093
2094 else
2095 {
2096 /* Client side, check the server's certificate name versus the name on the
2097 A-record for the connection we made. What to do for server side - what name
2098 to use for client? We document that there is no such checking for server
2099 side. */
2100
2101 if ( state->exp_tls_verify_cert_hostnames
2102 && !gnutls_x509_crt_check_hostname(state->tlsp->peercert,
2103 CS state->exp_tls_verify_cert_hostnames)
2104 )
2105 {
2106 DEBUG(D_tls)
2107 debug_printf("TLS certificate verification failed: cert name mismatch\n");
2108 if (state->verify_requirement >= VERIFY_REQUIRED)
2109 goto badcert;
2110 return TRUE;
2111 }
2112
2113 state->peer_cert_verified = TRUE;
2114 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
2115 state->peerdn ? state->peerdn : US"<unset>");
2116 }
2117
2118 goodcert:
2119 state->tlsp->peerdn = state->peerdn;
2120 return TRUE;
2121
2122 #ifdef SUPPORT_DANE
2123 tlsa_prob:
2124 *errstr = string_sprintf("TLSA record problem: %s",
2125 rc == DANE_E_REQUESTED_DATA_NOT_AVAILABLE ? "none usable" : dane_strerror(rc));
2126 #endif
2127
2128 badcert:
2129 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
2130 return FALSE;
2131 }
2132
2133
2134
2135
2136 /* ------------------------------------------------------------------------ */
2137 /* Callbacks */
2138
2139 /* Logging function which can be registered with
2140 * gnutls_global_set_log_function()
2141 * gnutls_global_set_log_level() 0..9
2142 */
2143 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
2144 static void
2145 exim_gnutls_logger_cb(int level, const char *message)
2146 {
2147 size_t len = strlen(message);
2148 if (len < 1)
2149 {
2150 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
2151 return;
2152 }
2153 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
2154 message[len-1] == '\n' ? "" : "\n");
2155 }
2156 #endif
2157
2158
2159 /* Called after client hello, should handle SNI work.
2160 This will always set tls_sni (state->received_sni) if available,
2161 and may trigger presenting different certificates,
2162 if state->trigger_sni_changes is TRUE.
2163
2164 Should be registered with
2165 gnutls_handshake_set_post_client_hello_function()
2166
2167 "This callback must return 0 on success or a gnutls error code to terminate the
2168 handshake.".
2169
2170 For inability to get SNI information, we return 0.
2171 We only return non-zero if re-setup failed.
2172 Only used for server-side TLS.
2173 */
2174
2175 static int
2176 exim_sni_handling_cb(gnutls_session_t session)
2177 {
2178 char sni_name[MAX_HOST_LEN];
2179 size_t data_len = MAX_HOST_LEN;
2180 exim_gnutls_state_st *state = &state_server;
2181 unsigned int sni_type;
2182 int rc, old_pool;
2183 uschar * dummy_errstr;
2184
2185 rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
2186 if (rc != GNUTLS_E_SUCCESS)
2187 {
2188 DEBUG(D_tls)
2189 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
2190 debug_printf("TLS: no SNI presented in handshake.\n");
2191 else
2192 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
2193 gnutls_strerror(rc), rc);
2194 return 0;
2195 }
2196
2197 if (sni_type != GNUTLS_NAME_DNS)
2198 {
2199 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
2200 return 0;
2201 }
2202
2203 /* We now have a UTF-8 string in sni_name */
2204 old_pool = store_pool;
2205 store_pool = POOL_PERM;
2206 state->received_sni = string_copy_taint(US sni_name, TRUE);
2207 store_pool = old_pool;
2208
2209 /* We set this one now so that variable expansions below will work */
2210 state->tlsp->sni = state->received_sni;
2211
2212 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
2213 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
2214
2215 if (!state->trigger_sni_changes)
2216 return 0;
2217
2218 if ((rc = tls_expand_session_files(state, &dummy_errstr)) != OK)
2219 {
2220 /* If the setup of certs/etc failed before handshake, TLS would not have
2221 been offered. The best we can do now is abort. */
2222 return GNUTLS_E_APPLICATION_ERROR_MIN;
2223 }
2224
2225 rc = tls_set_remaining_x509(state, &dummy_errstr);
2226 if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
2227
2228 return 0;
2229 }
2230
2231
2232
2233 #ifndef DISABLE_EVENT
2234 /*
2235 We use this callback to get observability and detail-level control
2236 for an exim TLS connection (either direction), raising a tls:cert event
2237 for each cert in the chain presented by the peer. Any event
2238 can deny verification.
2239
2240 Return 0 for the handshake to continue or non-zero to terminate.
2241 */
2242
2243 static int
2244 verify_cb(gnutls_session_t session)
2245 {
2246 const gnutls_datum_t * cert_list;
2247 unsigned int cert_list_size = 0;
2248 gnutls_x509_crt_t crt;
2249 int rc;
2250 uschar * yield;
2251 exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
2252
2253 if ((cert_list = gnutls_certificate_get_peers(session, &cert_list_size)))
2254 while (cert_list_size--)
2255 {
2256 if ((rc = import_cert(&cert_list[cert_list_size], &crt)) != GNUTLS_E_SUCCESS)
2257 {
2258 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
2259 cert_list_size, gnutls_strerror(rc));
2260 break;
2261 }
2262
2263 state->tlsp->peercert = crt;
2264 if ((yield = event_raise(state->event_action,
2265 US"tls:cert", string_sprintf("%d", cert_list_size))))
2266 {
2267 log_write(0, LOG_MAIN,
2268 "SSL verify denied by event-action: depth=%d: %s",
2269 cert_list_size, yield);
2270 return 1; /* reject */
2271 }
2272 state->tlsp->peercert = NULL;
2273 }
2274
2275 return 0;
2276 }
2277
2278 #endif
2279
2280
2281 static gstring *
2282 ddump(gnutls_datum_t * d)
2283 {
2284 gstring * g = string_get((d->size+1) * 2);
2285 uschar * s = d->data;
2286 for (unsigned i = d->size; i > 0; i--, s++)
2287 {
2288 g = string_catn(g, US "0123456789abcdef" + (*s >> 4), 1);
2289 g = string_catn(g, US "0123456789abcdef" + (*s & 0xf), 1);
2290 }
2291 return g;
2292 }
2293
2294 static void
2295 post_handshake_debug(exim_gnutls_state_st * state)
2296 {
2297 #ifdef SUPPORT_GNUTLS_SESS_DESC
2298 debug_printf("%s\n", gnutls_session_get_desc(state->session));
2299 #endif
2300
2301 #ifdef SUPPORT_GNUTLS_KEYLOG
2302 # ifdef EXIM_HAVE_TLS1_3
2303 if (gnutls_protocol_get_version(state->session) < GNUTLS_TLS1_3)
2304 # else
2305 if (TRUE)
2306 # endif
2307 {
2308 gnutls_datum_t c, s;
2309 gstring * gc, * gs;
2310 /* For TLS1.2 we only want the client random and the master secret */
2311 gnutls_session_get_random(state->session, &c, &s);
2312 gnutls_session_get_master_secret(state->session, &s);
2313 gc = ddump(&c);
2314 gs = ddump(&s);
2315 debug_printf("CLIENT_RANDOM %.*s %.*s\n", (int)gc->ptr, gc->s, (int)gs->ptr, gs->s);
2316 }
2317 else
2318 debug_printf("To get keying info for TLS1.3 is hard:\n"
2319 " Set environment variable SSLKEYLOGFILE to a filename relative to the spool directory,\n"
2320 " and make sure it is writable by the Exim runtime user.\n"
2321 " Add SSLKEYLOGFILE to keep_environment in the exim config.\n"
2322 " Start Exim as root.\n"
2323 " If using sudo, add SSLKEYLOGFILE to env_keep in /etc/sudoers\n"
2324 " (works for TLS1.2 also, and saves cut-paste into file).\n"
2325 " Trying to use add_environment for this will not work\n");
2326 #endif
2327 }
2328
2329
2330 #ifdef EXPERIMENTAL_TLS_RESUME
2331 static int
2332 tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
2333 unsigned incoming, const gnutls_datum_t * msg)
2334 {
2335 DEBUG(D_tls) debug_printf("newticket cb\n");
2336 tls_in.resumption |= RESUME_CLIENT_REQUESTED;
2337 return 0;
2338 }
2339
2340 static void
2341 tls_server_resume_prehandshake(exim_gnutls_state_st * state)
2342 {
2343 /* Should the server offer session resumption? */
2344 tls_in.resumption = RESUME_SUPPORTED;
2345 if (verify_check_host(&tls_resumption_hosts) == OK)
2346 {
2347 int rc;
2348 /* GnuTLS appears to not do ticket overlap, but does emit a fresh ticket when
2349 an offered resumption is unacceptable. We lose one resumption per ticket
2350 lifetime, and sessions cannot be indefinitely re-used. There seems to be no
2351 way (3.6.7) of changing the default number of 2 TLS1.3 tickets issued, but at
2352 least they go out in a single packet. */
2353
2354 if (!(rc = gnutls_session_ticket_enable_server(state->session,
2355 &server_sessticket_key)))
2356 tls_in.resumption |= RESUME_SERVER_TICKET;
2357 else
2358 DEBUG(D_tls)
2359 debug_printf("enabling session tickets: %s\n", US gnutls_strerror(rc));
2360
2361 /* Try to tell if we see a ticket request */
2362 gnutls_handshake_set_hook_function(state->session,
2363 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
2364 }
2365 }
2366
2367 static void
2368 tls_server_resume_posthandshake(exim_gnutls_state_st * state)
2369 {
2370 if (gnutls_session_resumption_requested(state->session))
2371 {
2372 /* This tells us the client sent a full ticket. We use a
2373 callback on session-ticket request, elsewhere, to tell
2374 if a client asked for a ticket. */
2375
2376 tls_in.resumption |= RESUME_CLIENT_SUGGESTED;
2377 DEBUG(D_tls) debug_printf("client requested resumption\n");
2378 }
2379 if (gnutls_session_is_resumed(state->session))
2380 {
2381 tls_in.resumption |= RESUME_USED;
2382 DEBUG(D_tls) debug_printf("Session resumed\n");
2383 }
2384 }
2385 #endif
2386 /* ------------------------------------------------------------------------ */
2387 /* Exported functions */
2388
2389
2390
2391
2392 /*************************************************
2393 * Start a TLS session in a server *
2394 *************************************************/
2395
2396 /* This is called when Exim is running as a server, after having received
2397 the STARTTLS command. It must respond to that command, and then negotiate
2398 a TLS session.
2399
2400 Arguments:
2401 require_ciphers list of allowed ciphers or NULL
2402 errstr pointer to error string
2403
2404 Returns: OK on success
2405 DEFER for errors before the start of the negotiation
2406 FAIL for errors during the negotiation; the server can't
2407 continue running.
2408 */
2409
2410 int
2411 tls_server_start(const uschar * require_ciphers, uschar ** errstr)
2412 {
2413 int rc;
2414 exim_gnutls_state_st * state = NULL;
2415
2416 /* Check for previous activation */
2417 if (tls_in.active.sock >= 0)
2418 {
2419 tls_error(US"STARTTLS received after TLS started", US "", NULL, errstr);
2420 smtp_printf("554 Already in TLS\r\n", FALSE);
2421 return FAIL;
2422 }
2423
2424 /* Initialize the library. If it fails, it will already have logged the error
2425 and sent an SMTP response. */
2426
2427 DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
2428
2429 {
2430 #ifdef MEASURE_TIMING
2431 struct timeval t0;
2432 gettimeofday(&t0, NULL);
2433 #endif
2434
2435 if ((rc = tls_init(NULL, tls_certificate, tls_privatekey,
2436 NULL, tls_verify_certificates, tls_crl,
2437 require_ciphers, &state, &tls_in, errstr)) != OK) return rc;
2438
2439 #ifdef MEASURE_TIMING
2440 report_time_since(&t0, US"server tls_init (delta)");
2441 #endif
2442 }
2443
2444 #ifdef EXPERIMENTAL_TLS_RESUME
2445 tls_server_resume_prehandshake(state);
2446 #endif
2447
2448 /* If this is a host for which certificate verification is mandatory or
2449 optional, set up appropriately. */
2450
2451 if (verify_check_host(&tls_verify_hosts) == OK)
2452 {
2453 DEBUG(D_tls)
2454 debug_printf("TLS: a client certificate will be required.\n");
2455 state->verify_requirement = VERIFY_REQUIRED;
2456 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2457 }
2458 else if (verify_check_host(&tls_try_verify_hosts) == OK)
2459 {
2460 DEBUG(D_tls)
2461 debug_printf("TLS: a client certificate will be requested but not required.\n");
2462 state->verify_requirement = VERIFY_OPTIONAL;
2463 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2464 }
2465 else
2466 {
2467 DEBUG(D_tls)
2468 debug_printf("TLS: a client certificate will not be requested.\n");
2469 state->verify_requirement = VERIFY_NONE;
2470 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2471 }
2472
2473 #ifndef DISABLE_EVENT
2474 if (event_action)
2475 {
2476 state->event_action = event_action;
2477 gnutls_session_set_ptr(state->session, state);
2478 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2479 }
2480 #endif
2481
2482 /* Register SNI handling; always, even if not in tls_certificate, so that the
2483 expansion variable $tls_sni is always available. */
2484
2485 gnutls_handshake_set_post_client_hello_function(state->session,
2486 exim_sni_handling_cb);
2487
2488 /* Set context and tell client to go ahead, except in the case of TLS startup
2489 on connection, where outputting anything now upsets the clients and tends to
2490 make them disconnect. We need to have an explicit fflush() here, to force out
2491 the response. Other smtp_printf() calls do not need it, because in non-TLS
2492 mode, the fflush() happens when smtp_getc() is called. */
2493
2494 if (!state->tlsp->on_connect)
2495 {
2496 smtp_printf("220 TLS go ahead\r\n", FALSE);
2497 fflush(smtp_out);
2498 }
2499
2500 /* Now negotiate the TLS session. We put our own timer on it, since it seems
2501 that the GnuTLS library doesn't.
2502 From 3.1.0 there is gnutls_handshake_set_timeout() - but it requires you
2503 to set (and clear down afterwards) up a pull-timeout callback function that does
2504 a select, so we're no better off unless avoiding signals becomes an issue. */
2505
2506 gnutls_transport_set_ptr2(state->session,
2507 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
2508 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
2509 state->fd_in = fileno(smtp_in);
2510 state->fd_out = fileno(smtp_out);
2511
2512 sigalrm_seen = FALSE;
2513 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
2514 do
2515 rc = gnutls_handshake(state->session);
2516 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
2517 ALARM_CLR(0);
2518
2519 if (rc != GNUTLS_E_SUCCESS)
2520 {
2521 /* It seems that, except in the case of a timeout, we have to close the
2522 connection right here; otherwise if the other end is running OpenSSL it hangs
2523 until the server times out. */
2524
2525 if (sigalrm_seen)
2526 {
2527 tls_error(US"gnutls_handshake", US"timed out", NULL, errstr);
2528 gnutls_db_remove_session(state->session);
2529 }
2530 else
2531 {
2532 tls_error_gnu(US"gnutls_handshake", rc, NULL, errstr);
2533 (void) gnutls_alert_send_appropriate(state->session, rc);
2534 gnutls_deinit(state->session);
2535 gnutls_certificate_free_credentials(state->x509_cred);
2536 millisleep(500);
2537 shutdown(state->fd_out, SHUT_WR);
2538 for (int i = 1024; fgetc(smtp_in) != EOF && i > 0; ) i--; /* drain skt */
2539 (void)fclose(smtp_out);
2540 (void)fclose(smtp_in);
2541 smtp_out = smtp_in = NULL;
2542 }
2543
2544 return FAIL;
2545 }
2546
2547 #ifdef GNUTLS_SFLAGS_EXT_MASTER_SECRET
2548 if (gnutls_session_get_flags(state->session) & GNUTLS_SFLAGS_EXT_MASTER_SECRET)
2549 tls_in.ext_master_secret = TRUE;
2550 #endif
2551
2552 #ifdef EXPERIMENTAL_TLS_RESUME
2553 tls_server_resume_posthandshake(state);
2554 #endif
2555
2556 DEBUG(D_tls) post_handshake_debug(state);
2557
2558 /* Verify after the fact */
2559
2560 if (!verify_certificate(state, errstr))
2561 {
2562 if (state->verify_requirement != VERIFY_OPTIONAL)
2563 {
2564 (void) tls_error(US"certificate verification failed", *errstr, NULL, errstr);
2565 return FAIL;
2566 }
2567 DEBUG(D_tls)
2568 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
2569 *errstr);
2570 }
2571
2572 /* Sets various Exim expansion variables; always safe within server */
2573
2574 extract_exim_vars_from_tls_state(state);
2575
2576 /* TLS has been set up. Adjust the input functions to read via TLS,
2577 and initialize appropriately. */
2578
2579 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
2580
2581 receive_getc = tls_getc;
2582 receive_getbuf = tls_getbuf;
2583 receive_get_cache = tls_get_cache;
2584 receive_ungetc = tls_ungetc;
2585 receive_feof = tls_feof;
2586 receive_ferror = tls_ferror;
2587 receive_smtp_buffered = tls_smtp_buffered;
2588
2589 return OK;
2590 }
2591
2592
2593
2594
2595 static void
2596 tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
2597 smtp_transport_options_block * ob)
2598 {
2599 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
2600 {
2601 state->exp_tls_verify_cert_hostnames =
2602 #ifdef SUPPORT_I18N
2603 string_domain_utf8_to_alabel(host->name, NULL);
2604 #else
2605 host->name;
2606 #endif
2607 DEBUG(D_tls)
2608 debug_printf("TLS: server cert verification includes hostname: \"%s\".\n",
2609 state->exp_tls_verify_cert_hostnames);
2610 }
2611 }
2612
2613
2614
2615
2616 #ifdef SUPPORT_DANE
2617 /* Given our list of RRs from the TLSA lookup, build a lookup block in
2618 GnuTLS-DANE's preferred format. Hang it on the state str for later
2619 use in DANE verification.
2620
2621 We point at the dnsa data not copy it, so it must remain valid until
2622 after verification is done.*/
2623
2624 static BOOL
2625 dane_tlsa_load(exim_gnutls_state_st * state, dns_answer * dnsa)
2626 {
2627 dns_scan dnss;
2628 int i;
2629 const char ** dane_data;
2630 int * dane_data_len;
2631
2632 i = 1;
2633 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
2634 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2635 ) if (rr->type == T_TLSA) i++;
2636
2637 dane_data = store_get(i * sizeof(uschar *), FALSE);
2638 dane_data_len = store_get(i * sizeof(int), FALSE);
2639
2640 i = 0;
2641 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
2642 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2643 ) if (rr->type == T_TLSA && rr->size > 3)
2644 {
2645 const uschar * p = rr->data;
2646 /*XXX need somehow to mark rr and its data as tainted. Doues this mean copying it? */
2647 uint8_t usage = p[0], sel = p[1], type = p[2];
2648
2649 DEBUG(D_tls)
2650 debug_printf("TLSA: %d %d %d size %d\n", usage, sel, type, rr->size);
2651
2652 if ( (usage != DANESSL_USAGE_DANE_TA && usage != DANESSL_USAGE_DANE_EE)
2653 || (sel != 0 && sel != 1)
2654 )
2655 continue;
2656 switch(type)
2657 {
2658 case 0: /* Full: cannot check at present */
2659 break;
2660 case 1: if (rr->size != 3 + 256/8) continue; /* sha2-256 */
2661 break;
2662 case 2: if (rr->size != 3 + 512/8) continue; /* sha2-512 */
2663 break;
2664 default: continue;
2665 }
2666
2667 tls_out.tlsa_usage |= 1<<usage;
2668 dane_data[i] = CS p;
2669 dane_data_len[i++] = rr->size;
2670 }
2671
2672 if (!i) return FALSE;
2673
2674 dane_data[i] = NULL;
2675 dane_data_len[i] = 0;
2676
2677 state->dane_data = (char * const *)dane_data;
2678 state->dane_data_len = dane_data_len;
2679 return TRUE;
2680 }
2681 #endif
2682
2683
2684
2685 #ifdef EXPERIMENTAL_TLS_RESUME
2686 /* On the client, get any stashed session for the given IP from hints db
2687 and apply it to the ssl-connection for attempted resumption. Although
2688 there is a gnutls_session_ticket_enable_client() interface it is
2689 documented as unnecessary (as of 3.6.7) as "session tickets are emabled
2690 by deafult". There seems to be no way to disable them, so even hosts not
2691 enabled by the transport option will be sent a ticket request. We will
2692 however avoid storing and retrieving session information. */
2693
2694 static void
2695 tls_retrieve_session(tls_support * tlsp, gnutls_session_t session,
2696 host_item * host, smtp_transport_options_block * ob)
2697 {
2698 tlsp->resumption = RESUME_SUPPORTED;
2699 if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
2700 {
2701 dbdata_tls_session * dt;
2702 int len, rc;
2703 open_db dbblock, * dbm_file;
2704
2705 DEBUG(D_tls)
2706 debug_printf("check for resumable session for %s\n", host->address);
2707 tlsp->host_resumable = TRUE;
2708 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
2709 if ((dbm_file = dbfn_open(US"tls", O_RDONLY, &dbblock, FALSE, FALSE)))
2710 {
2711 /* Key for the db is the IP. We'd like to filter the retrieved session
2712 for ticket advisory expiry, but 3.6.1 seems to give no access to that */
2713
2714 if ((dt = dbfn_read_with_length(dbm_file, host->address, &len)))
2715 if (!(rc = gnutls_session_set_data(session,
2716 CUS dt->session, (size_t)len - sizeof(dbdata_tls_session))))
2717 {
2718 DEBUG(D_tls) debug_printf("good session\n");
2719 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
2720 }
2721 else DEBUG(D_tls) debug_printf("setting session resumption data: %s\n",
2722 US gnutls_strerror(rc));
2723 dbfn_close(dbm_file);
2724 }
2725 }
2726 }
2727
2728
2729 static void
2730 tls_save_session(tls_support * tlsp, gnutls_session_t session, const host_item * host)
2731 {
2732 /* TLS 1.2 - we get both the callback and the direct posthandshake call,
2733 but this flag is not set until the second. TLS 1.3 it's the other way about.
2734 Keep both calls as the session data cannot be extracted before handshake
2735 completes. */
2736
2737 if (gnutls_session_get_flags(session) & GNUTLS_SFLAGS_SESSION_TICKET)
2738 {
2739 gnutls_datum_t tkt;
2740 int rc;
2741
2742 DEBUG(D_tls) debug_printf("server offered session ticket\n");
2743 tlsp->ticket_received = TRUE;
2744 tlsp->resumption |= RESUME_SERVER_TICKET;
2745
2746 if (tlsp->host_resumable)
2747 if (!(rc = gnutls_session_get_data2(session, &tkt)))
2748 {
2749 open_db dbblock, * dbm_file;
2750 int dlen = sizeof(dbdata_tls_session) + tkt.size;
2751 dbdata_tls_session * dt = store_get(dlen, TRUE);
2752
2753 DEBUG(D_tls) debug_printf("session data size %u\n", (unsigned)tkt.size);
2754 memcpy(dt->session, tkt.data, tkt.size);
2755 gnutls_free(tkt.data);
2756
2757 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
2758 {
2759 /* key for the db is the IP */
2760 dbfn_delete(dbm_file, host->address);
2761 dbfn_write(dbm_file, host->address, dt, dlen);
2762 dbfn_close(dbm_file);
2763
2764 DEBUG(D_tls)
2765 debug_printf("wrote session db (len %u)\n", (unsigned)dlen);
2766 }
2767 }
2768 else DEBUG(D_tls)
2769 debug_printf("extract session data: %s\n", US gnutls_strerror(rc));
2770 }
2771 }
2772
2773
2774 /* With a TLS1.3 session, the ticket(s) are not seen until
2775 the first data read is attempted. And there's often two of them.
2776 Pick them up with this callback. We are also called for 1.2
2777 but we do nothing.
2778 */
2779 static int
2780 tls_client_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
2781 unsigned incoming, const gnutls_datum_t * msg)
2782 {
2783 exim_gnutls_state_st * state = gnutls_session_get_ptr(sess);
2784 tls_support * tlsp = state->tlsp;
2785
2786 DEBUG(D_tls) debug_printf("newticket cb\n");
2787
2788 if (!tlsp->ticket_received)
2789 tls_save_session(tlsp, sess, state->host);
2790 return 0;
2791 }
2792
2793
2794 static void
2795 tls_client_resume_prehandshake(exim_gnutls_state_st * state,
2796 tls_support * tlsp, host_item * host,
2797 smtp_transport_options_block * ob)
2798 {
2799 gnutls_session_set_ptr(state->session, state);
2800 gnutls_handshake_set_hook_function(state->session,
2801 GNUTLS_HANDSHAKE_NEW_SESSION_TICKET, GNUTLS_HOOK_POST, tls_client_ticket_cb);
2802
2803 tls_retrieve_session(tlsp, state->session, host, ob);
2804 }
2805
2806 static void
2807 tls_client_resume_posthandshake(exim_gnutls_state_st * state,
2808 tls_support * tlsp, host_item * host)
2809 {
2810 if (gnutls_session_is_resumed(state->session))
2811 {
2812 DEBUG(D_tls) debug_printf("Session resumed\n");
2813 tlsp->resumption |= RESUME_USED;
2814 }
2815
2816 tls_save_session(tlsp, state->session, host);
2817 }
2818 #endif /* EXPERIMENTAL_TLS_RESUME */
2819
2820
2821 /*************************************************
2822 * Start a TLS session in a client *
2823 *************************************************/
2824
2825 /* Called from the smtp transport after STARTTLS has been accepted.
2826
2827 Arguments:
2828 cctx connection context
2829 conn_args connection details
2830 cookie datum for randomness (not used)
2831 tlsp record details of channel configuration here; must be non-NULL
2832 errstr error string pointer
2833
2834 Returns: TRUE for success with TLS session context set in smtp context,
2835 FALSE on error
2836 */
2837
2838 BOOL
2839 tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
2840 void * cookie ARG_UNUSED,
2841 tls_support * tlsp, uschar ** errstr)
2842 {
2843 host_item * host = conn_args->host; /* for msgs and option-tests */
2844 transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
2845 smtp_transport_options_block * ob = tb
2846 ? (smtp_transport_options_block *)tb->options_block
2847 : &smtp_transport_option_defaults;
2848 int rc;
2849 exim_gnutls_state_st * state = NULL;
2850 uschar * cipher_list = NULL;
2851
2852 #ifndef DISABLE_OCSP
2853 BOOL require_ocsp =
2854 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
2855 BOOL request_ocsp = require_ocsp ? TRUE
2856 : verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
2857 #endif
2858
2859 DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", cctx->sock);
2860
2861 #ifdef SUPPORT_DANE
2862 /* If dane is flagged, have either request or require dane for this host, and
2863 a TLSA record found. Therefore, dane verify required. Which implies cert must
2864 be requested and supplied, dane verify must pass, and cert verify irrelevant
2865 (incl. hostnames), and (caller handled) require_tls */
2866
2867 if (conn_args->dane && ob->dane_require_tls_ciphers)
2868 {
2869 /* not using expand_check_tlsvar because not yet in state */
2870 if (!expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
2871 &cipher_list, errstr))
2872 return FALSE;
2873 cipher_list = cipher_list && *cipher_list
2874 ? ob->dane_require_tls_ciphers : ob->tls_require_ciphers;
2875 }
2876 #endif
2877
2878 if (!cipher_list)
2879 cipher_list = ob->tls_require_ciphers;
2880
2881 {
2882 #ifdef MEASURE_TIMING
2883 struct timeval t0;
2884 gettimeofday(&t0, NULL);
2885 #endif
2886
2887 if (tls_init(host, ob->tls_certificate, ob->tls_privatekey,
2888 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
2889 cipher_list, &state, tlsp, errstr) != OK)
2890 return FALSE;
2891
2892 #ifdef MEASURE_TIMING
2893 report_time_since(&t0, US"client tls_init (delta)");
2894 #endif
2895 }
2896
2897 {
2898 int dh_min_bits = ob->tls_dh_min_bits;
2899 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
2900 {
2901 DEBUG(D_tls)
2902 debug_printf("WARNING: tls_dh_min_bits far too low,"
2903 " clamping %d up to %d\n",
2904 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
2905 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
2906 }
2907
2908 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
2909 " acceptable bits to %d\n",
2910 dh_min_bits);
2911 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
2912 }
2913
2914 /* Stick to the old behaviour for compatibility if tls_verify_certificates is
2915 set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
2916 the specified host patterns if one of them is defined */
2917
2918 #ifdef SUPPORT_DANE
2919 if (conn_args->dane && dane_tlsa_load(state, &conn_args->tlsa_dnsa))
2920 {
2921 DEBUG(D_tls)
2922 debug_printf("TLS: server certificate DANE required.\n");
2923 state->verify_requirement = VERIFY_DANE;
2924 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2925 }
2926 else
2927 #endif
2928 if ( ( state->exp_tls_verify_certificates
2929 && !ob->tls_verify_hosts
2930 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2931 )
2932 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
2933 )
2934 {
2935 tls_client_setup_hostname_checks(host, state, ob);
2936 DEBUG(D_tls)
2937 debug_printf("TLS: server certificate verification required.\n");
2938 state->verify_requirement = VERIFY_REQUIRED;
2939 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2940 }
2941 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
2942 {
2943 tls_client_setup_hostname_checks(host, state, ob);
2944 DEBUG(D_tls)
2945 debug_printf("TLS: server certificate verification optional.\n");
2946 state->verify_requirement = VERIFY_OPTIONAL;
2947 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2948 }
2949 else
2950 {
2951 DEBUG(D_tls)
2952 debug_printf("TLS: server certificate verification not required.\n");
2953 state->verify_requirement = VERIFY_NONE;
2954 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2955 }
2956
2957 #ifndef DISABLE_OCSP
2958 /* supported since GnuTLS 3.1.3 */
2959 if (request_ocsp)
2960 {
2961 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
2962 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
2963 NULL, 0, NULL)) != OK)
2964 {
2965 tls_error_gnu(US"cert-status-req", rc, state->host, errstr);
2966 return FALSE;
2967 }
2968 tlsp->ocsp = OCSP_NOT_RESP;
2969 }
2970 #endif
2971
2972 #ifdef EXPERIMENTAL_TLS_RESUME
2973 tls_client_resume_prehandshake(state, tlsp, host, ob);
2974 #endif
2975
2976 #ifndef DISABLE_EVENT
2977 if (tb && tb->event_action)
2978 {
2979 state->event_action = tb->event_action;
2980 gnutls_session_set_ptr(state->session, state);
2981 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2982 }
2983 #endif
2984
2985 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) cctx->sock);
2986 state->fd_in = cctx->sock;
2987 state->fd_out = cctx->sock;
2988
2989 DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
2990 /* There doesn't seem to be a built-in timeout on connection. */
2991
2992 sigalrm_seen = FALSE;
2993 ALARM(ob->command_timeout);
2994 do
2995 rc = gnutls_handshake(state->session);
2996 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
2997 ALARM_CLR(0);
2998
2999 if (rc != GNUTLS_E_SUCCESS)
3000 {
3001 if (sigalrm_seen)
3002 {
3003 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
3004 tls_error(US"gnutls_handshake", US"timed out", state->host, errstr);
3005 }
3006 else
3007 tls_error_gnu(US"gnutls_handshake", rc, state->host, errstr);
3008 return FALSE;
3009 }
3010
3011 DEBUG(D_tls) post_handshake_debug(state);
3012
3013 /* Verify late */
3014
3015 if (!verify_certificate(state, errstr))
3016 {
3017 tls_error(US"certificate verification failed", *errstr, state->host, errstr);
3018 return FALSE;
3019 }
3020
3021 #ifdef GNUTLS_SFLAGS_EXT_MASTER_SECRET
3022 if (gnutls_session_get_flags(state->session) & GNUTLS_SFLAGS_EXT_MASTER_SECRET)
3023 tlsp->ext_master_secret = TRUE;
3024 #endif
3025
3026 #ifndef DISABLE_OCSP
3027 if (request_ocsp)
3028 {
3029 DEBUG(D_tls)
3030 {
3031 gnutls_datum_t stapling;
3032 gnutls_ocsp_resp_t resp;
3033 gnutls_datum_t printed;
3034 unsigned idx = 0;
3035
3036 for (;
3037 # ifdef GNUTLS_OCSP_STATUS_REQUEST_GET2
3038 (rc = gnutls_ocsp_status_request_get2(state->session, idx, &stapling)) == 0;
3039 #else
3040 (rc = gnutls_ocsp_status_request_get(state->session, &stapling)) == 0;
3041 #endif
3042 idx++)
3043 if ( (rc= gnutls_ocsp_resp_init(&resp)) == 0
3044 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
3045 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_COMPACT, &printed)) == 0
3046 )
3047 {
3048 debug_printf("%.4096s", printed.data);
3049 gnutls_free(printed.data);
3050 }
3051 else
3052 (void) tls_error_gnu(US"ocsp decode", rc, state->host, errstr);
3053 if (idx == 0 && rc)
3054 (void) tls_error_gnu(US"ocsp decode", rc, state->host, errstr);
3055 }
3056
3057 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
3058 {
3059 tlsp->ocsp = OCSP_FAILED;
3060 tls_error(US"certificate status check failed", NULL, state->host, errstr);
3061 if (require_ocsp)
3062 return FALSE;
3063 }
3064 else
3065 {
3066 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
3067 tlsp->ocsp = OCSP_VFIED;
3068 }
3069 }
3070 #endif
3071
3072 #ifdef EXPERIMENTAL_TLS_RESUME
3073 tls_client_resume_posthandshake(state, tlsp, host);
3074 #endif
3075
3076 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
3077
3078 extract_exim_vars_from_tls_state(state);
3079
3080 cctx->tls_ctx = state;
3081 return TRUE;
3082 }
3083
3084
3085
3086
3087 /*************************************************
3088 * Close down a TLS session *
3089 *************************************************/
3090
3091 /* This is also called from within a delivery subprocess forked from the
3092 daemon, to shut down the TLS library, without actually doing a shutdown (which
3093 would tamper with the TLS session in the parent process).
3094
3095 Arguments:
3096 ct_ctx client context pointer, or NULL for the one global server context
3097 shutdown 1 if TLS close-alert is to be sent,
3098 2 if also response to be waited for
3099
3100 Returns: nothing
3101 */
3102
3103 void
3104 tls_close(void * ct_ctx, int shutdown)
3105 {
3106 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3107 tls_support * tlsp = state->tlsp;
3108
3109 if (!tlsp || tlsp->active.sock < 0) return; /* TLS was not active */
3110
3111 if (shutdown)
3112 {
3113 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
3114 shutdown > 1 ? " (with response-wait)" : "");
3115
3116 ALARM(2);
3117 gnutls_bye(state->session, shutdown > 1 ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR);
3118 ALARM_CLR(0);
3119 }
3120
3121 if (!ct_ctx) /* server */
3122 {
3123 receive_getc = smtp_getc;
3124 receive_getbuf = smtp_getbuf;
3125 receive_get_cache = smtp_get_cache;
3126 receive_ungetc = smtp_ungetc;
3127 receive_feof = smtp_feof;
3128 receive_ferror = smtp_ferror;
3129 receive_smtp_buffered = smtp_buffered;
3130 }
3131
3132 gnutls_deinit(state->session);
3133 gnutls_certificate_free_credentials(state->x509_cred);
3134
3135 tlsp->active.sock = -1;
3136 tlsp->active.tls_ctx = NULL;
3137 /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
3138 tlsp->channelbinding = NULL;
3139
3140
3141 if (state->xfer_buffer) store_free(state->xfer_buffer);
3142 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
3143 }
3144
3145
3146
3147
3148 static BOOL
3149 tls_refill(unsigned lim)
3150 {
3151 exim_gnutls_state_st * state = &state_server;
3152 ssize_t inbytes;
3153
3154 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(session=%p, buffer=%p, buffersize=%u)\n",
3155 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
3156
3157 sigalrm_seen = FALSE;
3158 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3159
3160 do
3161 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
3162 MIN(ssl_xfer_buffer_size, lim));
3163 while (inbytes == GNUTLS_E_AGAIN);
3164
3165 if (smtp_receive_timeout > 0) ALARM_CLR(0);
3166
3167 if (had_command_timeout) /* set by signal handler */
3168 smtp_command_timeout_exit(); /* does not return */
3169 if (had_command_sigterm)
3170 smtp_command_sigterm_exit();
3171 if (had_data_timeout)
3172 smtp_data_timeout_exit();
3173 if (had_data_sigint)
3174 smtp_data_sigint_exit();
3175
3176 /* Timeouts do not get this far. A zero-byte return appears to mean that the
3177 TLS session has been closed down, not that the socket itself has been closed
3178 down. Revert to non-TLS handling. */
3179
3180 if (sigalrm_seen)
3181 {
3182 DEBUG(D_tls) debug_printf("Got tls read timeout\n");
3183 state->xfer_error = TRUE;
3184 return FALSE;
3185 }
3186
3187 else if (inbytes == 0)
3188 {
3189 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
3190 tls_close(NULL, TLS_NO_SHUTDOWN);
3191 return FALSE;
3192 }
3193
3194 /* Handle genuine errors */
3195
3196 else if (inbytes < 0)
3197 {
3198 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
3199 record_io_error(state, (int) inbytes, US"recv", NULL);
3200 state->xfer_error = TRUE;
3201 return FALSE;
3202 }
3203 #ifndef DISABLE_DKIM
3204 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
3205 #endif
3206 state->xfer_buffer_hwm = (int) inbytes;
3207 state->xfer_buffer_lwm = 0;
3208 return TRUE;
3209 }
3210
3211 /*************************************************
3212 * TLS version of getc *
3213 *************************************************/
3214
3215 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
3216 it refills the buffer via the GnuTLS reading function.
3217 Only used by the server-side TLS.
3218
3219 This feeds DKIM and should be used for all message-body reads.
3220
3221 Arguments: lim Maximum amount to read/buffer
3222 Returns: the next character or EOF
3223 */
3224
3225 int
3226 tls_getc(unsigned lim)
3227 {
3228 exim_gnutls_state_st * state = &state_server;
3229
3230 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3231 if (!tls_refill(lim))
3232 return state->xfer_error ? EOF : smtp_getc(lim);
3233
3234 /* Something in the buffer; return next uschar */
3235
3236 return state->xfer_buffer[state->xfer_buffer_lwm++];
3237 }
3238
3239 uschar *
3240 tls_getbuf(unsigned * len)
3241 {
3242 exim_gnutls_state_st * state = &state_server;
3243 unsigned size;
3244 uschar * buf;
3245
3246 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3247 if (!tls_refill(*len))
3248 {
3249 if (!state->xfer_error) return smtp_getbuf(len);
3250 *len = 0;
3251 return NULL;
3252 }
3253
3254 if ((size = state->xfer_buffer_hwm - state->xfer_buffer_lwm) > *len)
3255 size = *len;
3256 buf = &state->xfer_buffer[state->xfer_buffer_lwm];
3257 state->xfer_buffer_lwm += size;
3258 *len = size;
3259 return buf;
3260 }
3261
3262
3263 void
3264 tls_get_cache()
3265 {
3266 #ifndef DISABLE_DKIM
3267 exim_gnutls_state_st * state = &state_server;
3268 int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
3269 if (n > 0)
3270 dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
3271 #endif
3272 }
3273
3274
3275 BOOL
3276 tls_could_read(void)
3277 {
3278 return state_server.xfer_buffer_lwm < state_server.xfer_buffer_hwm
3279 || gnutls_record_check_pending(state_server.session) > 0;
3280 }
3281
3282
3283
3284
3285 /*************************************************
3286 * Read bytes from TLS channel *
3287 *************************************************/
3288
3289 /* This does not feed DKIM, so if the caller uses this for reading message body,
3290 then the caller must feed DKIM.
3291
3292 Arguments:
3293 ct_ctx client context pointer, or NULL for the one global server context
3294 buff buffer of data
3295 len size of buffer
3296
3297 Returns: the number of bytes read
3298 -1 after a failed read, including EOF
3299 */
3300
3301 int
3302 tls_read(void * ct_ctx, uschar *buff, size_t len)
3303 {
3304 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3305 ssize_t inbytes;
3306
3307 if (len > INT_MAX)
3308 len = INT_MAX;
3309
3310 if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
3311 DEBUG(D_tls)
3312 debug_printf("*** PROBABLY A BUG *** " \
3313 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
3314 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
3315
3316 DEBUG(D_tls)
3317 debug_printf("Calling gnutls_record_recv(session=%p, buffer=%p, len=" SIZE_T_FMT ")\n",
3318 state->session, buff, len);
3319
3320 do
3321 inbytes = gnutls_record_recv(state->session, buff, len);
3322 while (inbytes == GNUTLS_E_AGAIN);
3323
3324 if (inbytes > 0) return inbytes;
3325 if (inbytes == 0)
3326 {
3327 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
3328 }
3329 else
3330 {
3331 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
3332 record_io_error(state, (int)inbytes, US"recv", NULL);
3333 }
3334
3335 return -1;
3336 }
3337
3338
3339
3340
3341 /*************************************************
3342 * Write bytes down TLS channel *
3343 *************************************************/
3344
3345 /*
3346 Arguments:
3347 ct_ctx client context pointer, or NULL for the one global server context
3348 buff buffer of data
3349 len number of bytes
3350 more more data expected soon
3351
3352 Calling with len zero and more unset will flush buffered writes. The buff
3353 argument can be null for that case.
3354
3355 Returns: the number of bytes after a successful write,
3356 -1 after a failed write
3357 */
3358
3359 int
3360 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
3361 {
3362 ssize_t outbytes;
3363 size_t left = len;
3364 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3365
3366 #ifdef SUPPORT_CORK
3367 if (more && !state->corked)
3368 {
3369 DEBUG(D_tls) debug_printf("gnutls_record_cork(session=%p)\n", state->session);
3370 gnutls_record_cork(state->session);
3371 state->corked = TRUE;
3372 }
3373 #endif
3374
3375 DEBUG(D_tls) debug_printf("%s(%p, " SIZE_T_FMT "%s)\n", __FUNCTION__,
3376 buff, left, more ? ", more" : "");
3377
3378 while (left > 0)
3379 {
3380 DEBUG(D_tls) debug_printf("gnutls_record_send(session=%p, buffer=%p, left=" SIZE_T_FMT ")\n",
3381 state->session, buff, left);
3382
3383 do
3384 outbytes = gnutls_record_send(state->session, buff, left);
3385 while (outbytes == GNUTLS_E_AGAIN);
3386
3387 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
3388
3389 if (outbytes < 0)
3390 {
3391 DEBUG(D_tls) debug_printf("%s: gnutls_record_send err\n", __FUNCTION__);
3392 record_io_error(state, outbytes, US"send", NULL);
3393 return -1;
3394 }
3395 if (outbytes == 0)
3396 {
3397 record_io_error(state, 0, US"send", US"TLS channel closed on write");
3398 return -1;
3399 }
3400
3401 left -= outbytes;
3402 buff += outbytes;
3403 }
3404
3405 if (len > INT_MAX)
3406 {
3407 DEBUG(D_tls)
3408 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
3409 len);
3410 len = INT_MAX;
3411 }
3412
3413 #ifdef SUPPORT_CORK
3414 if (!more && state->corked)
3415 {
3416 DEBUG(D_tls) debug_printf("gnutls_record_uncork(session=%p)\n", state->session);
3417 do
3418 /* We can't use GNUTLS_RECORD_WAIT here, as it retries on
3419 GNUTLS_E_AGAIN || GNUTLS_E_INTR, which would break our timeout set by alarm().
3420 The GNUTLS_E_AGAIN should not happen ever, as our sockets are blocking anyway.
3421 But who knows. (That all relies on the fact that GNUTLS_E_INTR and GNUTLS_E_AGAIN
3422 match the EINTR and EAGAIN errno values.) */
3423 outbytes = gnutls_record_uncork(state->session, 0);
3424 while (outbytes == GNUTLS_E_AGAIN);
3425
3426 if (outbytes < 0)
3427 {
3428 record_io_error(state, len, US"uncork", NULL);
3429 return -1;
3430 }
3431
3432 state->corked = FALSE;
3433 }
3434 #endif
3435
3436 return (int) len;
3437 }
3438
3439
3440
3441
3442 /*************************************************
3443 * Random number generation *
3444 *************************************************/
3445
3446 /* Pseudo-random number generation. The result is not expected to be
3447 cryptographically strong but not so weak that someone will shoot themselves
3448 in the foot using it as a nonce in input in some email header scheme or
3449 whatever weirdness they'll twist this into. The result should handle fork()
3450 and avoid repeating sequences. OpenSSL handles that for us.
3451
3452 Arguments:
3453 max range maximum
3454 Returns a random number in range [0, max-1]
3455 */
3456
3457 #ifdef HAVE_GNUTLS_RND
3458 int
3459 vaguely_random_number(int max)
3460 {
3461 unsigned int r;
3462 int i, needed_len;
3463 uschar smallbuf[sizeof(r)];