86d005d683a54d748a747fe8c5d68aaf9a03f2c5
[exim.git] / src / src / tls-gnu.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Copyright (c) Phil Pennock 2012 */
9
10 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
11 one of the available supported implementations. This file is #included into
12 tls.c when USE_GNUTLS has been set.
13
14 The code herein is a revamp of GnuTLS integration using the current APIs; the
15 original tls-gnu.c was based on a patch which was contributed by Nikos
16 Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
17 appropriate.
18
19 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20 which is not widely deployed by OS vendors. Will note issues below, which may
21 assist in updating the code in the future. Another sources of hints is
22 mod_gnutls for Apache (SNI callback registration and handling).
23
24 Keeping client and server variables more split than before and is currently
25 the norm, in anticipation of TLS in ACL callouts.
26
27 I wanted to switch to gnutls_certificate_set_verify_function() so that
28 certificate rejection could happen during handshake where it belongs, rather
29 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
31
32 (I wasn't looking for libraries quite that old, when updating to get rid of
33 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34 require current GnuTLS, then we'll drop support for the ancient libraries).
35 */
36
37 #include <gnutls/gnutls.h>
38 /* needed for cert checks in verification and DN extraction: */
39 #include <gnutls/x509.h>
40 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41 #include <gnutls/crypto.h>
42
43 /* needed to disable PKCS11 autoload unless requested */
44 #if GNUTLS_VERSION_NUMBER >= 0x020c00
45 # include <gnutls/pkcs11.h>
46 # define SUPPORT_PARAM_TO_PK_BITS
47 #endif
48 #if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
49 # warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
50 # define DISABLE_OCSP
51 #endif
52 #if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
53 # warning "GnuTLS library version too old; tls:cert event unsupported"
54 # define DISABLE_EVENT
55 #endif
56 #if GNUTLS_VERSION_NUMBER >= 0x030306
57 # define SUPPORT_CA_DIR
58 #else
59 # undef SUPPORT_CA_DIR
60 #endif
61 #if GNUTLS_VERSION_NUMBER >= 0x030014
62 # define SUPPORT_SYSDEFAULT_CABUNDLE
63 #endif
64 #if GNUTLS_VERSION_NUMBER >= 0x030104
65 # define GNUTLS_CERT_VFY_STATUS_PRINT
66 #endif
67 #if GNUTLS_VERSION_NUMBER >= 0x030109
68 # define SUPPORT_CORK
69 #endif
70 #if GNUTLS_VERSION_NUMBER >= 0x030506 && !defined(DISABLE_OCSP)
71 # define SUPPORT_SRV_OCSP_STACK
72 #endif
73
74 #ifdef SUPPORT_DANE
75 # if GNUTLS_VERSION_NUMBER >= 0x030000
76 # define DANESSL_USAGE_DANE_TA 2
77 # define DANESSL_USAGE_DANE_EE 3
78 # else
79 # error GnuTLS version too early for DANE
80 # endif
81 # if GNUTLS_VERSION_NUMBER < 0x999999
82 # define GNUTLS_BROKEN_DANE_VALIDATION
83 # endif
84 #endif
85
86 #ifndef DISABLE_OCSP
87 # include <gnutls/ocsp.h>
88 #endif
89 #ifdef SUPPORT_DANE
90 # include <gnutls/dane.h>
91 #endif
92
93 /* GnuTLS 2 vs 3
94
95 GnuTLS 3 only:
96 gnutls_global_set_audit_log_function()
97
98 Changes:
99 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
100 */
101
102 /* Local static variables for GnuTLS */
103
104 /* Values for verify_requirement */
105
106 enum peer_verify_requirement
107 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED, VERIFY_DANE };
108
109 /* This holds most state for server or client; with this, we can set up an
110 outbound TLS-enabled connection in an ACL callout, while not stomping all
111 over the TLS variables available for expansion.
112
113 Some of these correspond to variables in globals.c; those variables will
114 be set to point to content in one of these instances, as appropriate for
115 the stage of the process lifetime.
116
117 Not handled here: global tls_channelbinding_b64.
118 */
119
120 typedef struct exim_gnutls_state {
121 gnutls_session_t session;
122 gnutls_certificate_credentials_t x509_cred;
123 gnutls_priority_t priority_cache;
124 enum peer_verify_requirement verify_requirement;
125 int fd_in;
126 int fd_out;
127 BOOL peer_cert_verified;
128 BOOL peer_dane_verified;
129 BOOL trigger_sni_changes;
130 BOOL have_set_peerdn;
131 const struct host_item *host; /* NULL if server */
132 gnutls_x509_crt_t peercert;
133 uschar *peerdn;
134 uschar *ciphersuite;
135 uschar *received_sni;
136
137 const uschar *tls_certificate;
138 const uschar *tls_privatekey;
139 const uschar *tls_sni; /* client send only, not received */
140 const uschar *tls_verify_certificates;
141 const uschar *tls_crl;
142 const uschar *tls_require_ciphers;
143
144 uschar *exp_tls_certificate;
145 uschar *exp_tls_privatekey;
146 uschar *exp_tls_verify_certificates;
147 uschar *exp_tls_crl;
148 uschar *exp_tls_require_ciphers;
149 const uschar *exp_tls_verify_cert_hostnames;
150 #ifndef DISABLE_EVENT
151 uschar *event_action;
152 #endif
153 #ifdef SUPPORT_DANE
154 char * const * dane_data;
155 const int * dane_data_len;
156 #endif
157
158 tls_support *tlsp; /* set in tls_init() */
159
160 uschar *xfer_buffer;
161 int xfer_buffer_lwm;
162 int xfer_buffer_hwm;
163 BOOL xfer_eof; /*XXX never gets set! */
164 BOOL xfer_error;
165 } exim_gnutls_state_st;
166
167 static const exim_gnutls_state_st exim_gnutls_state_init = {
168 .session = NULL,
169 .x509_cred = NULL,
170 .priority_cache = NULL,
171 .verify_requirement = VERIFY_NONE,
172 .fd_in = -1,
173 .fd_out = -1,
174 .peer_cert_verified = FALSE,
175 .peer_dane_verified = FALSE,
176 .trigger_sni_changes =FALSE,
177 .have_set_peerdn = FALSE,
178 .host = NULL,
179 .peercert = NULL,
180 .peerdn = NULL,
181 .ciphersuite = NULL,
182 .received_sni = NULL,
183
184 .tls_certificate = NULL,
185 .tls_privatekey = NULL,
186 .tls_sni = NULL,
187 .tls_verify_certificates = NULL,
188 .tls_crl = NULL,
189 .tls_require_ciphers =NULL,
190
191 .exp_tls_certificate = NULL,
192 .exp_tls_privatekey = NULL,
193 .exp_tls_verify_certificates = NULL,
194 .exp_tls_crl = NULL,
195 .exp_tls_require_ciphers = NULL,
196 .exp_tls_verify_cert_hostnames = NULL,
197 #ifndef DISABLE_EVENT
198 .event_action = NULL,
199 #endif
200 .tlsp = NULL,
201
202 .xfer_buffer = NULL,
203 .xfer_buffer_lwm = 0,
204 .xfer_buffer_hwm = 0,
205 .xfer_eof = FALSE,
206 .xfer_error = FALSE,
207 };
208
209 /* Not only do we have our own APIs which don't pass around state, assuming
210 it's held in globals, GnuTLS doesn't appear to let us register callback data
211 for callbacks, or as part of the session, so we have to keep a "this is the
212 context we're currently dealing with" pointer and rely upon being
213 single-threaded to keep from processing data on an inbound TLS connection while
214 talking to another TLS connection for an outbound check. This does mean that
215 there's no way for heart-beats to be responded to, for the duration of the
216 second connection.
217 XXX But see gnutls_session_get_ptr()
218 */
219
220 static exim_gnutls_state_st state_server;
221
222 /* dh_params are initialised once within the lifetime of a process using TLS;
223 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
224 don't want to repeat this. */
225
226 static gnutls_dh_params_t dh_server_params = NULL;
227
228 /* No idea how this value was chosen; preserving it. Default is 3600. */
229
230 static const int ssl_session_timeout = 200;
231
232 static const char * const exim_default_gnutls_priority = "NORMAL";
233
234 /* Guard library core initialisation */
235
236 static BOOL exim_gnutls_base_init_done = FALSE;
237
238 #ifndef DISABLE_OCSP
239 static BOOL gnutls_buggy_ocsp = FALSE;
240 #endif
241
242
243 /* ------------------------------------------------------------------------ */
244 /* macros */
245
246 #define MAX_HOST_LEN 255
247
248 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
249 the library logging; a value less than 0 disables the calls to set up logging
250 callbacks. Possibly GNuTLS also looks for an environment variable
251 "GNUTLS_DEBUG_LEVEL". */
252 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
253 # define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
254 #endif
255
256 #ifndef EXIM_CLIENT_DH_MIN_BITS
257 # define EXIM_CLIENT_DH_MIN_BITS 1024
258 #endif
259
260 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
261 can ask for a bit-strength. Without that, we stick to the constant we had
262 before, for now. */
263 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
264 # define EXIM_SERVER_DH_BITS_PRE2_12 1024
265 #endif
266
267 #define exim_gnutls_err_check(rc, Label) do { \
268 if ((rc) != GNUTLS_E_SUCCESS) \
269 return tls_error((Label), gnutls_strerror(rc), host, errstr); \
270 } while (0)
271
272 #define expand_check_tlsvar(Varname, errstr) \
273 expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr)
274
275 #if GNUTLS_VERSION_NUMBER >= 0x020c00
276 # define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
277 # define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
278 # define HAVE_GNUTLS_RND
279 /* The security fix we provide with the gnutls_allow_auto_pkcs11 option
280 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
281 * isn't available sometimes, so this needs to become a conditional
282 * compilation; the sanest way to deal with this being a problem on
283 * older OSes is to block it in the Local/Makefile with this compiler
284 * definition */
285 # ifndef AVOID_GNUTLS_PKCS11
286 # define HAVE_GNUTLS_PKCS11
287 # endif /* AVOID_GNUTLS_PKCS11 */
288 #endif
289
290
291
292
293 /* ------------------------------------------------------------------------ */
294 /* Callback declarations */
295
296 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
297 static void exim_gnutls_logger_cb(int level, const char *message);
298 #endif
299
300 static int exim_sni_handling_cb(gnutls_session_t session);
301
302 #ifndef DISABLE_OCSP
303 static int server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
304 gnutls_datum_t * ocsp_response);
305 #endif
306
307
308
309 /* ------------------------------------------------------------------------ */
310 /* Static functions */
311
312 /*************************************************
313 * Handle TLS error *
314 *************************************************/
315
316 /* Called from lots of places when errors occur before actually starting to do
317 the TLS handshake, that is, while the session is still in clear. Always returns
318 DEFER for a server and FAIL for a client so that most calls can use "return
319 tls_error(...)" to do this processing and then give an appropriate return. A
320 single function is used for both server and client, because it is called from
321 some shared functions.
322
323 Argument:
324 prefix text to include in the logged error
325 msg additional error string (may be NULL)
326 usually obtained from gnutls_strerror()
327 host NULL if setting up a server;
328 the connected host if setting up a client
329 errstr pointer to returned error string
330
331 Returns: OK/DEFER/FAIL
332 */
333
334 static int
335 tls_error(const uschar *prefix, const char *msg, const host_item *host,
336 uschar ** errstr)
337 {
338 if (errstr)
339 *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : "");
340 return host ? FAIL : DEFER;
341 }
342
343
344
345
346 /*************************************************
347 * Deal with logging errors during I/O *
348 *************************************************/
349
350 /* We have to get the identity of the peer from saved data.
351
352 Argument:
353 state the current GnuTLS exim state container
354 rc the GnuTLS error code, or 0 if it's a local error
355 when text identifying read or write
356 text local error text when ec is 0
357
358 Returns: nothing
359 */
360
361 static void
362 record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
363 {
364 const char * msg;
365 uschar * errstr;
366
367 if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
368 msg = CS string_sprintf("%s: %s", US gnutls_strerror(rc),
369 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
370 else
371 msg = gnutls_strerror(rc);
372
373 (void) tls_error(when, msg, state->host, &errstr);
374
375 if (state->host)
376 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection %s",
377 state->host->name, state->host->address, errstr);
378 else
379 {
380 uschar * conn_info = smtp_get_connection_info();
381 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0) conn_info += 5;
382 /* I'd like to get separated H= here, but too hard for now */
383 log_write(0, LOG_MAIN, "TLS error on %s %s", conn_info, errstr);
384 }
385 }
386
387
388
389
390 /*************************************************
391 * Set various Exim expansion vars *
392 *************************************************/
393
394 #define exim_gnutls_cert_err(Label) \
395 do \
396 { \
397 if (rc != GNUTLS_E_SUCCESS) \
398 { \
399 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
400 (Label), gnutls_strerror(rc)); \
401 return rc; \
402 } \
403 } while (0)
404
405 static int
406 import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
407 {
408 int rc;
409
410 rc = gnutls_x509_crt_init(crtp);
411 exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
412
413 rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
414 exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
415
416 return rc;
417 }
418
419 #undef exim_gnutls_cert_err
420
421
422 /* We set various Exim global variables from the state, once a session has
423 been established. With TLS callouts, may need to change this to stack
424 variables, or just re-call it with the server state after client callout
425 has finished.
426
427 Make sure anything set here is unset in tls_getc().
428
429 Sets:
430 tls_active fd
431 tls_bits strength indicator
432 tls_certificate_verified bool indicator
433 tls_channelbinding_b64 for some SASL mechanisms
434 tls_cipher a string
435 tls_peercert pointer to library internal
436 tls_peerdn a string
437 tls_sni a (UTF-8) string
438 tls_ourcert pointer to library internal
439
440 Argument:
441 state the relevant exim_gnutls_state_st *
442 */
443
444 static void
445 extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
446 {
447 gnutls_cipher_algorithm_t cipher;
448 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
449 int old_pool;
450 int rc;
451 gnutls_datum_t channel;
452 #endif
453 tls_support * tlsp = state->tlsp;
454
455 tlsp->active.sock = state->fd_out;
456 tlsp->active.tls_ctx = state;
457
458 cipher = gnutls_cipher_get(state->session);
459 /* returns size in "bytes" */
460 tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
461
462 tlsp->cipher = state->ciphersuite;
463
464 DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
465
466 tlsp->certificate_verified = state->peer_cert_verified;
467 #ifdef SUPPORT_DANE
468 tlsp->dane_verified = state->peer_dane_verified;
469 #endif
470
471 /* note that tls_channelbinding_b64 is not saved to the spool file, since it's
472 only available for use for authenticators while this TLS session is running. */
473
474 tls_channelbinding_b64 = NULL;
475 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
476 channel.data = NULL;
477 channel.size = 0;
478 rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
479 if (rc) {
480 DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
481 } else {
482 old_pool = store_pool;
483 store_pool = POOL_PERM;
484 tls_channelbinding_b64 = b64encode(channel.data, (int)channel.size);
485 store_pool = old_pool;
486 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
487 }
488 #endif
489
490 /* peercert is set in peer_status() */
491 tlsp->peerdn = state->peerdn;
492 tlsp->sni = state->received_sni;
493
494 /* record our certificate */
495 {
496 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
497 gnutls_x509_crt_t crt;
498
499 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
500 }
501 }
502
503
504
505
506 /*************************************************
507 * Setup up DH parameters *
508 *************************************************/
509
510 /* Generating the D-H parameters may take a long time. They only need to
511 be re-generated every so often, depending on security policy. What we do is to
512 keep these parameters in a file in the spool directory. If the file does not
513 exist, we generate them. This means that it is easy to cause a regeneration.
514
515 The new file is written as a temporary file and renamed, so that an incomplete
516 file is never present. If two processes both compute some new parameters, you
517 waste a bit of effort, but it doesn't seem worth messing around with locking to
518 prevent this.
519
520 Returns: OK/DEFER/FAIL
521 */
522
523 static int
524 init_server_dh(uschar ** errstr)
525 {
526 int fd, rc;
527 unsigned int dh_bits;
528 gnutls_datum_t m;
529 uschar filename_buf[PATH_MAX];
530 uschar *filename = NULL;
531 size_t sz;
532 uschar *exp_tls_dhparam;
533 BOOL use_file_in_spool = FALSE;
534 BOOL use_fixed_file = FALSE;
535 host_item *host = NULL; /* dummy for macros */
536
537 DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
538
539 rc = gnutls_dh_params_init(&dh_server_params);
540 exim_gnutls_err_check(rc, US"gnutls_dh_params_init");
541
542 m.data = NULL;
543 m.size = 0;
544
545 if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam, errstr))
546 return DEFER;
547
548 if (!exp_tls_dhparam)
549 {
550 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
551 m.data = US std_dh_prime_default();
552 m.size = Ustrlen(m.data);
553 }
554 else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
555 use_file_in_spool = TRUE;
556 else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
557 {
558 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
559 return OK;
560 }
561 else if (exp_tls_dhparam[0] != '/')
562 {
563 if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
564 return tls_error(US"No standard prime named", CS exp_tls_dhparam, NULL, errstr);
565 m.size = Ustrlen(m.data);
566 }
567 else
568 {
569 use_fixed_file = TRUE;
570 filename = exp_tls_dhparam;
571 }
572
573 if (m.data)
574 {
575 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
576 exim_gnutls_err_check(rc, US"gnutls_dh_params_import_pkcs3");
577 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
578 return OK;
579 }
580
581 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
582 /* If you change this constant, also change dh_param_fn_ext so that we can use a
583 different filename and ensure we have sufficient bits. */
584 dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
585 if (!dh_bits)
586 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL, errstr);
587 DEBUG(D_tls)
588 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
589 dh_bits);
590 #else
591 dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
592 DEBUG(D_tls)
593 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
594 dh_bits);
595 #endif
596
597 /* Some clients have hard-coded limits. */
598 if (dh_bits > tls_dh_max_bits)
599 {
600 DEBUG(D_tls)
601 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
602 tls_dh_max_bits);
603 dh_bits = tls_dh_max_bits;
604 }
605
606 if (use_file_in_spool)
607 {
608 if (!string_format(filename_buf, sizeof(filename_buf),
609 "%s/gnutls-params-%d", spool_directory, dh_bits))
610 return tls_error(US"overlong filename", NULL, NULL, errstr);
611 filename = filename_buf;
612 }
613
614 /* Open the cache file for reading and if successful, read it and set up the
615 parameters. */
616
617 if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
618 {
619 struct stat statbuf;
620 FILE *fp;
621 int saved_errno;
622
623 if (fstat(fd, &statbuf) < 0) /* EIO */
624 {
625 saved_errno = errno;
626 (void)close(fd);
627 return tls_error(US"TLS cache stat failed", strerror(saved_errno), NULL, errstr);
628 }
629 if (!S_ISREG(statbuf.st_mode))
630 {
631 (void)close(fd);
632 return tls_error(US"TLS cache not a file", NULL, NULL, errstr);
633 }
634 if (!(fp = fdopen(fd, "rb")))
635 {
636 saved_errno = errno;
637 (void)close(fd);
638 return tls_error(US"fdopen(TLS cache stat fd) failed",
639 strerror(saved_errno), NULL, errstr);
640 }
641
642 m.size = statbuf.st_size;
643 if (!(m.data = malloc(m.size)))
644 {
645 fclose(fp);
646 return tls_error(US"malloc failed", strerror(errno), NULL, errstr);
647 }
648 if (!(sz = fread(m.data, m.size, 1, fp)))
649 {
650 saved_errno = errno;
651 fclose(fp);
652 free(m.data);
653 return tls_error(US"fread failed", strerror(saved_errno), NULL, errstr);
654 }
655 fclose(fp);
656
657 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
658 free(m.data);
659 exim_gnutls_err_check(rc, US"gnutls_dh_params_import_pkcs3");
660 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
661 }
662
663 /* If the file does not exist, fall through to compute new data and cache it.
664 If there was any other opening error, it is serious. */
665
666 else if (errno == ENOENT)
667 {
668 rc = -1;
669 DEBUG(D_tls)
670 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
671 }
672 else
673 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
674 NULL, NULL, errstr);
675
676 /* If ret < 0, either the cache file does not exist, or the data it contains
677 is not useful. One particular case of this is when upgrading from an older
678 release of Exim in which the data was stored in a different format. We don't
679 try to be clever and support both formats; we just regenerate new data in this
680 case. */
681
682 if (rc < 0)
683 {
684 uschar *temp_fn;
685 unsigned int dh_bits_gen = dh_bits;
686
687 if ((PATH_MAX - Ustrlen(filename)) < 10)
688 return tls_error(US"Filename too long to generate replacement",
689 CS filename, NULL, errstr);
690
691 temp_fn = string_copy(US "%s.XXXXXXX");
692 if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */
693 return tls_error(US"Unable to open temp file", strerror(errno), NULL, errstr);
694 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
695
696 /* GnuTLS overshoots!
697 * If we ask for 2236, we might get 2237 or more.
698 * But there's no way to ask GnuTLS how many bits there really are.
699 * We can ask how many bits were used in a TLS session, but that's it!
700 * The prime itself is hidden behind too much abstraction.
701 * So we ask for less, and proceed on a wing and a prayer.
702 * First attempt, subtracted 3 for 2233 and got 2240.
703 */
704 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
705 {
706 dh_bits_gen = dh_bits - 10;
707 DEBUG(D_tls)
708 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
709 dh_bits_gen);
710 }
711
712 DEBUG(D_tls)
713 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
714 dh_bits_gen);
715 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen);
716 exim_gnutls_err_check(rc, US"gnutls_dh_params_generate2");
717
718 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
719 and I confirmed that a NULL call to get the size first is how the GnuTLS
720 sample apps handle this. */
721
722 sz = 0;
723 m.data = NULL;
724 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
725 m.data, &sz);
726 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
727 exim_gnutls_err_check(rc, US"gnutls_dh_params_export_pkcs3(NULL) sizing");
728 m.size = sz;
729 if (!(m.data = malloc(m.size)))
730 return tls_error(US"memory allocation failed", strerror(errno), NULL, errstr);
731
732 /* this will return a size 1 less than the allocation size above */
733 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
734 m.data, &sz);
735 if (rc != GNUTLS_E_SUCCESS)
736 {
737 free(m.data);
738 exim_gnutls_err_check(rc, US"gnutls_dh_params_export_pkcs3() real");
739 }
740 m.size = sz; /* shrink by 1, probably */
741
742 if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
743 {
744 free(m.data);
745 return tls_error(US"TLS cache write D-H params failed",
746 strerror(errno), NULL, errstr);
747 }
748 free(m.data);
749 if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
750 return tls_error(US"TLS cache write D-H params final newline failed",
751 strerror(errno), NULL, errstr);
752
753 if ((rc = close(fd)))
754 return tls_error(US"TLS cache write close() failed", strerror(errno), NULL, errstr);
755
756 if (Urename(temp_fn, filename) < 0)
757 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
758 temp_fn, filename), strerror(errno), NULL, errstr);
759
760 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
761 }
762
763 DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
764 return OK;
765 }
766
767
768
769
770 /* Create and install a selfsigned certificate, for use in server mode */
771
772 static int
773 tls_install_selfsign(exim_gnutls_state_st * state, uschar ** errstr)
774 {
775 gnutls_x509_crt_t cert = NULL;
776 time_t now;
777 gnutls_x509_privkey_t pkey = NULL;
778 const uschar * where;
779 int rc;
780
781 where = US"initialising pkey";
782 if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
783
784 where = US"initialising cert";
785 if ((rc = gnutls_x509_crt_init(&cert))) goto err;
786
787 where = US"generating pkey";
788 if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
789 #ifdef SUPPORT_PARAM_TO_PK_BITS
790 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_LOW),
791 #else
792 1024,
793 #endif
794 0)))
795 goto err;
796
797 where = US"configuring cert";
798 now = 1;
799 if ( (rc = gnutls_x509_crt_set_version(cert, 3))
800 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
801 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
802 || (rc = gnutls_x509_crt_set_expiration_time(cert, now + 60 * 60)) /* 1 hr */
803 || (rc = gnutls_x509_crt_set_key(cert, pkey))
804
805 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
806 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
807 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
808 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
809 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
810 GNUTLS_OID_X520_COMMON_NAME, 0,
811 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
812 )
813 goto err;
814
815 where = US"signing cert";
816 if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
817
818 where = US"installing selfsign cert";
819 /* Since: 2.4.0 */
820 if ((rc = gnutls_certificate_set_x509_key(state->x509_cred, &cert, 1, pkey)))
821 goto err;
822
823 rc = OK;
824
825 out:
826 if (cert) gnutls_x509_crt_deinit(cert);
827 if (pkey) gnutls_x509_privkey_deinit(pkey);
828 return rc;
829
830 err:
831 rc = tls_error(where, gnutls_strerror(rc), NULL, errstr);
832 goto out;
833 }
834
835
836
837
838 /* Add certificate and key, from files.
839
840 Return:
841 Zero or negative: good. Negate value for certificate index if < 0.
842 Greater than zero: FAIL or DEFER code.
843 */
844
845 static int
846 tls_add_certfile(exim_gnutls_state_st * state, const host_item * host,
847 uschar * certfile, uschar * keyfile, uschar ** errstr)
848 {
849 int rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
850 CS certfile, CS keyfile, GNUTLS_X509_FMT_PEM);
851 if (rc < 0)
852 return tls_error(
853 string_sprintf("cert/key setup: cert=%s key=%s", certfile, keyfile),
854 gnutls_strerror(rc), host, errstr);
855 return -rc;
856 }
857
858
859 /*************************************************
860 * Variables re-expanded post-SNI *
861 *************************************************/
862
863 /* Called from both server and client code, via tls_init(), and also from
864 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
865
866 We can tell the two apart by state->received_sni being non-NULL in callback.
867
868 The callback should not call us unless state->trigger_sni_changes is true,
869 which we are responsible for setting on the first pass through.
870
871 Arguments:
872 state exim_gnutls_state_st *
873 errstr error string pointer
874
875 Returns: OK/DEFER/FAIL
876 */
877
878 static int
879 tls_expand_session_files(exim_gnutls_state_st * state, uschar ** errstr)
880 {
881 struct stat statbuf;
882 int rc;
883 const host_item *host = state->host; /* macro should be reconsidered? */
884 uschar *saved_tls_certificate = NULL;
885 uschar *saved_tls_privatekey = NULL;
886 uschar *saved_tls_verify_certificates = NULL;
887 uschar *saved_tls_crl = NULL;
888 int cert_count;
889
890 /* We check for tls_sni *before* expansion. */
891 if (!host) /* server */
892 if (!state->received_sni)
893 {
894 if ( state->tls_certificate
895 && ( Ustrstr(state->tls_certificate, US"tls_sni")
896 || Ustrstr(state->tls_certificate, US"tls_in_sni")
897 || Ustrstr(state->tls_certificate, US"tls_out_sni")
898 ) )
899 {
900 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
901 state->trigger_sni_changes = TRUE;
902 }
903 }
904 else
905 {
906 /* useful for debugging */
907 saved_tls_certificate = state->exp_tls_certificate;
908 saved_tls_privatekey = state->exp_tls_privatekey;
909 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
910 saved_tls_crl = state->exp_tls_crl;
911 }
912
913 rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
914 exim_gnutls_err_check(rc, US"gnutls_certificate_allocate_credentials");
915
916 #ifdef SUPPORT_SRV_OCSP_STACK
917 gnutls_certificate_set_flags(state->x509_cred, GNUTLS_CERTIFICATE_API_V2);
918 #endif
919
920 /* remember: expand_check_tlsvar() is expand_check() but fiddling with
921 state members, assuming consistent naming; and expand_check() returns
922 false if expansion failed, unless expansion was forced to fail. */
923
924 /* check if we at least have a certificate, before doing expensive
925 D-H generation. */
926
927 if (!expand_check_tlsvar(tls_certificate, errstr))
928 return DEFER;
929
930 /* certificate is mandatory in server, optional in client */
931
932 if ( !state->exp_tls_certificate
933 || !*state->exp_tls_certificate
934 )
935 if (!host)
936 return tls_install_selfsign(state, errstr);
937 else
938 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
939
940 if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey, errstr))
941 return DEFER;
942
943 /* tls_privatekey is optional, defaulting to same file as certificate */
944
945 if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
946 {
947 state->tls_privatekey = state->tls_certificate;
948 state->exp_tls_privatekey = state->exp_tls_certificate;
949 }
950
951
952 if (state->exp_tls_certificate && *state->exp_tls_certificate)
953 {
954 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
955 state->exp_tls_certificate, state->exp_tls_privatekey);
956
957 if (state->received_sni)
958 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
959 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
960 )
961 {
962 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
963 }
964 else
965 {
966 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
967 }
968
969 if (!host) /* server */
970 {
971 const uschar * clist = state->exp_tls_certificate;
972 const uschar * klist = state->exp_tls_privatekey;
973 const uschar * olist;
974 int csep = 0, ksep = 0, osep = 0, cnt = 0;
975 uschar * cfile, * kfile, * ofile;
976
977 #ifndef DISABLE_OCSP
978 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file", &ofile, errstr))
979 return DEFER;
980 olist = ofile;
981 #endif
982
983 while (cfile = string_nextinlist(&clist, &csep, NULL, 0))
984
985 if (!(kfile = string_nextinlist(&klist, &ksep, NULL, 0)))
986 return tls_error(US"cert/key setup: out of keys", NULL, host, errstr);
987 else if (0 < (rc = tls_add_certfile(state, host, cfile, kfile, errstr)))
988 return rc;
989 else
990 {
991 int gnutls_cert_index = -rc;
992 DEBUG(D_tls) debug_printf("TLS: cert/key %s registered\n", cfile);
993
994 /* Set the OCSP stapling server info */
995
996 #ifndef DISABLE_OCSP
997 if (tls_ocsp_file)
998 if (gnutls_buggy_ocsp)
999 {
1000 DEBUG(D_tls)
1001 debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
1002 }
1003 else if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1004 {
1005 /* Use the full callback method for stapling just to get
1006 observability. More efficient would be to read the file once only,
1007 if it never changed (due to SNI). Would need restart on file update,
1008 or watch datestamp. */
1009
1010 # ifdef SUPPORT_SRV_OCSP_STACK
1011 rc = gnutls_certificate_set_ocsp_status_request_function2(
1012 state->x509_cred, gnutls_cert_index,
1013 server_ocsp_stapling_cb, ofile);
1014
1015 exim_gnutls_err_check(rc,
1016 US"gnutls_certificate_set_ocsp_status_request_function2");
1017 # else
1018 if (cnt++ > 0)
1019 {
1020 DEBUG(D_tls)
1021 debug_printf("oops; multiple OCSP files not supported\n");
1022 break;
1023 }
1024 gnutls_certificate_set_ocsp_status_request_function(
1025 state->x509_cred, server_ocsp_stapling_cb, ofile);
1026 # endif
1027
1028 DEBUG(D_tls) debug_printf("OCSP response file = %s\n", ofile);
1029 }
1030 else
1031 DEBUG(D_tls) debug_printf("ran out of OCSP response files in list\n");
1032 #endif
1033 }
1034 }
1035 else
1036 {
1037 if (0 < (rc = tls_add_certfile(state, host,
1038 state->exp_tls_certificate, state->exp_tls_privatekey, errstr)))
1039 return rc;
1040 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
1041 }
1042
1043 } /* tls_certificate */
1044
1045
1046 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
1047 provided. Experiment shows that, if the certificate file is empty, an unhelpful
1048 error message is provided. However, if we just refrain from setting anything up
1049 in that case, certificate verification fails, which seems to be the correct
1050 behaviour. */
1051
1052 if (state->tls_verify_certificates && *state->tls_verify_certificates)
1053 {
1054 if (!expand_check_tlsvar(tls_verify_certificates, errstr))
1055 return DEFER;
1056 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1057 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1058 state->exp_tls_verify_certificates = NULL;
1059 #endif
1060 if (state->tls_crl && *state->tls_crl)
1061 if (!expand_check_tlsvar(tls_crl, errstr))
1062 return DEFER;
1063
1064 if (!(state->exp_tls_verify_certificates &&
1065 *state->exp_tls_verify_certificates))
1066 {
1067 DEBUG(D_tls)
1068 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
1069 /* With no tls_verify_certificates, we ignore tls_crl too */
1070 return OK;
1071 }
1072 }
1073 else
1074 {
1075 DEBUG(D_tls)
1076 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
1077 return OK;
1078 }
1079
1080 #ifdef SUPPORT_SYSDEFAULT_CABUNDLE
1081 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1082 cert_count = gnutls_certificate_set_x509_system_trust(state->x509_cred);
1083 else
1084 #endif
1085 {
1086 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
1087 {
1088 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
1089 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
1090 strerror(errno));
1091 return DEFER;
1092 }
1093
1094 #ifndef SUPPORT_CA_DIR
1095 /* The test suite passes in /dev/null; we could check for that path explicitly,
1096 but who knows if someone has some weird FIFO which always dumps some certs, or
1097 other weirdness. The thing we really want to check is that it's not a
1098 directory, since while OpenSSL supports that, GnuTLS does not.
1099 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
1100 if (S_ISDIR(statbuf.st_mode))
1101 {
1102 DEBUG(D_tls)
1103 debug_printf("verify certificates path is a dir: \"%s\"\n",
1104 state->exp_tls_verify_certificates);
1105 log_write(0, LOG_MAIN|LOG_PANIC,
1106 "tls_verify_certificates \"%s\" is a directory",
1107 state->exp_tls_verify_certificates);
1108 return DEFER;
1109 }
1110 #endif
1111
1112 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
1113 state->exp_tls_verify_certificates, statbuf.st_size);
1114
1115 if (statbuf.st_size == 0)
1116 {
1117 DEBUG(D_tls)
1118 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
1119 return OK;
1120 }
1121
1122 cert_count =
1123
1124 #ifdef SUPPORT_CA_DIR
1125 (statbuf.st_mode & S_IFMT) == S_IFDIR
1126 ?
1127 gnutls_certificate_set_x509_trust_dir(state->x509_cred,
1128 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM)
1129 :
1130 #endif
1131 gnutls_certificate_set_x509_trust_file(state->x509_cred,
1132 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
1133 }
1134
1135 if (cert_count < 0)
1136 {
1137 rc = cert_count;
1138 exim_gnutls_err_check(rc, US"setting certificate trust");
1139 }
1140 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
1141
1142 if (state->tls_crl && *state->tls_crl &&
1143 state->exp_tls_crl && *state->exp_tls_crl)
1144 {
1145 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
1146 cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
1147 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
1148 if (cert_count < 0)
1149 {
1150 rc = cert_count;
1151 exim_gnutls_err_check(rc, US"gnutls_certificate_set_x509_crl_file");
1152 }
1153 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1154 }
1155
1156 return OK;
1157 }
1158
1159
1160
1161
1162 /*************************************************
1163 * Set X.509 state variables *
1164 *************************************************/
1165
1166 /* In GnuTLS, the registered cert/key are not replaced by a later
1167 set of a cert/key, so for SNI support we need a whole new x509_cred
1168 structure. Which means various other non-re-expanded pieces of state
1169 need to be re-set in the new struct, so the setting logic is pulled
1170 out to this.
1171
1172 Arguments:
1173 state exim_gnutls_state_st *
1174 errstr error string pointer
1175
1176 Returns: OK/DEFER/FAIL
1177 */
1178
1179 static int
1180 tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr)
1181 {
1182 int rc;
1183 const host_item *host = state->host; /* macro should be reconsidered? */
1184
1185 /* Create D-H parameters, or read them from the cache file. This function does
1186 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
1187 client-side params. */
1188
1189 if (!state->host)
1190 {
1191 if (!dh_server_params)
1192 {
1193 rc = init_server_dh(errstr);
1194 if (rc != OK) return rc;
1195 }
1196 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
1197 }
1198
1199 /* Link the credentials to the session. */
1200
1201 rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
1202 exim_gnutls_err_check(rc, US"gnutls_credentials_set");
1203
1204 return OK;
1205 }
1206
1207 /*************************************************
1208 * Initialize for GnuTLS *
1209 *************************************************/
1210
1211
1212 #ifndef DISABLE_OCSP
1213
1214 static BOOL
1215 tls_is_buggy_ocsp(void)
1216 {
1217 const uschar * s;
1218 uschar maj, mid, mic;
1219
1220 s = CUS gnutls_check_version(NULL);
1221 maj = atoi(CCS s);
1222 if (maj == 3)
1223 {
1224 while (*s && *s != '.') s++;
1225 mid = atoi(CCS ++s);
1226 if (mid <= 2)
1227 return TRUE;
1228 else if (mid >= 5)
1229 return FALSE;
1230 else
1231 {
1232 while (*s && *s != '.') s++;
1233 mic = atoi(CCS ++s);
1234 return mic <= (mid == 3 ? 16 : 3);
1235 }
1236 }
1237 return FALSE;
1238 }
1239
1240 #endif
1241
1242
1243 /* Called from both server and client code. In the case of a server, errors
1244 before actual TLS negotiation return DEFER.
1245
1246 Arguments:
1247 host connected host, if client; NULL if server
1248 certificate certificate file
1249 privatekey private key file
1250 sni TLS SNI to send, sometimes when client; else NULL
1251 cas CA certs file
1252 crl CRL file
1253 require_ciphers tls_require_ciphers setting
1254 caller_state returned state-info structure
1255 errstr error string pointer
1256
1257 Returns: OK/DEFER/FAIL
1258 */
1259
1260 static int
1261 tls_init(
1262 const host_item *host,
1263 const uschar *certificate,
1264 const uschar *privatekey,
1265 const uschar *sni,
1266 const uschar *cas,
1267 const uschar *crl,
1268 const uschar *require_ciphers,
1269 exim_gnutls_state_st **caller_state,
1270 tls_support * tlsp,
1271 uschar ** errstr)
1272 {
1273 exim_gnutls_state_st *state;
1274 int rc;
1275 size_t sz;
1276 const char *errpos;
1277 uschar *p;
1278 BOOL want_default_priorities;
1279
1280 if (!exim_gnutls_base_init_done)
1281 {
1282 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1283
1284 #ifdef HAVE_GNUTLS_PKCS11
1285 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1286 which loads modules from a config file, which sounds good and may be wanted
1287 by some sysadmin, but also means in common configurations that GNOME keyring
1288 environment variables are used and so breaks for users calling mailq.
1289 To prevent this, we init PKCS11 first, which is the documented approach. */
1290 if (!gnutls_allow_auto_pkcs11)
1291 {
1292 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
1293 exim_gnutls_err_check(rc, US"gnutls_pkcs11_init");
1294 }
1295 #endif
1296
1297 rc = gnutls_global_init();
1298 exim_gnutls_err_check(rc, US"gnutls_global_init");
1299
1300 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1301 DEBUG(D_tls)
1302 {
1303 gnutls_global_set_log_function(exim_gnutls_logger_cb);
1304 /* arbitrarily chosen level; bump upto 9 for more */
1305 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
1306 }
1307 #endif
1308
1309 #ifndef DISABLE_OCSP
1310 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
1311 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
1312 #endif
1313
1314 exim_gnutls_base_init_done = TRUE;
1315 }
1316
1317 if (host)
1318 {
1319 /* For client-side sessions we allocate a context. This lets us run
1320 several in parallel. */
1321 int old_pool = store_pool;
1322 store_pool = POOL_PERM;
1323 state = store_get(sizeof(exim_gnutls_state_st));
1324 store_pool = old_pool;
1325
1326 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1327 state->tlsp = tlsp;
1328 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1329 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1330 }
1331 else
1332 {
1333 state = &state_server;
1334 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1335 state->tlsp = tlsp;
1336 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1337 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1338 }
1339 exim_gnutls_err_check(rc, US"gnutls_init");
1340
1341 state->host = host;
1342
1343 state->tls_certificate = certificate;
1344 state->tls_privatekey = privatekey;
1345 state->tls_require_ciphers = require_ciphers;
1346 state->tls_sni = sni;
1347 state->tls_verify_certificates = cas;
1348 state->tls_crl = crl;
1349
1350 /* This handles the variables that might get re-expanded after TLS SNI;
1351 that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
1352
1353 DEBUG(D_tls)
1354 debug_printf("Expanding various TLS configuration options for session credentials.\n");
1355 if ((rc = tls_expand_session_files(state, errstr)) != OK) return rc;
1356
1357 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1358 requires a new structure afterwards. */
1359
1360 if ((rc = tls_set_remaining_x509(state, errstr)) != OK) return rc;
1361
1362 /* set SNI in client, only */
1363 if (host)
1364 {
1365 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni, errstr))
1366 return DEFER;
1367 if (state->tlsp->sni && *state->tlsp->sni)
1368 {
1369 DEBUG(D_tls)
1370 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1371 sz = Ustrlen(state->tlsp->sni);
1372 rc = gnutls_server_name_set(state->session,
1373 GNUTLS_NAME_DNS, state->tlsp->sni, sz);
1374 exim_gnutls_err_check(rc, US"gnutls_server_name_set");
1375 }
1376 }
1377 else if (state->tls_sni)
1378 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
1379 "have an SNI set for a server [%s]\n", state->tls_sni);
1380
1381 /* This is the priority string support,
1382 http://www.gnutls.org/manual/html_node/Priority-Strings.html
1383 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1384 This was backwards incompatible, but means Exim no longer needs to track
1385 all algorithms and provide string forms for them. */
1386
1387 want_default_priorities = TRUE;
1388
1389 if (state->tls_require_ciphers && *state->tls_require_ciphers)
1390 {
1391 if (!expand_check_tlsvar(tls_require_ciphers, errstr))
1392 return DEFER;
1393 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
1394 {
1395 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
1396 state->exp_tls_require_ciphers);
1397
1398 rc = gnutls_priority_init(&state->priority_cache,
1399 CS state->exp_tls_require_ciphers, &errpos);
1400 want_default_priorities = FALSE;
1401 p = state->exp_tls_require_ciphers;
1402 }
1403 }
1404 if (want_default_priorities)
1405 {
1406 DEBUG(D_tls)
1407 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
1408 exim_default_gnutls_priority);
1409 rc = gnutls_priority_init(&state->priority_cache,
1410 exim_default_gnutls_priority, &errpos);
1411 p = US exim_default_gnutls_priority;
1412 }
1413
1414 exim_gnutls_err_check(rc, string_sprintf(
1415 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1416 p, errpos - CS p, errpos));
1417
1418 rc = gnutls_priority_set(state->session, state->priority_cache);
1419 exim_gnutls_err_check(rc, US"gnutls_priority_set");
1420
1421 gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1422
1423 /* Reduce security in favour of increased compatibility, if the admin
1424 decides to make that trade-off. */
1425 if (gnutls_compat_mode)
1426 {
1427 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1428 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1429 gnutls_session_enable_compatibility_mode(state->session);
1430 #else
1431 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1432 #endif
1433 }
1434
1435 *caller_state = state;
1436 return OK;
1437 }
1438
1439
1440
1441 /*************************************************
1442 * Extract peer information *
1443 *************************************************/
1444
1445 /* Called from both server and client code.
1446 Only this is allowed to set state->peerdn and state->have_set_peerdn
1447 and we use that to detect double-calls.
1448
1449 NOTE: the state blocks last while the TLS connection is up, which is fine
1450 for logging in the server side, but for the client side, we log after teardown
1451 in src/deliver.c. While the session is up, we can twist about states and
1452 repoint tls_* globals, but those variables used for logging or other variable
1453 expansion that happens _after_ delivery need to have a longer life-time.
1454
1455 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1456 doing this more than once per generation of a state context. We set them in
1457 the state context, and repoint tls_* to them. After the state goes away, the
1458 tls_* copies of the pointers remain valid and client delivery logging is happy.
1459
1460 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1461 don't apply.
1462
1463 Arguments:
1464 state exim_gnutls_state_st *
1465 errstr pointer to error string
1466
1467 Returns: OK/DEFER/FAIL
1468 */
1469
1470 static int
1471 peer_status(exim_gnutls_state_st *state, uschar ** errstr)
1472 {
1473 uschar cipherbuf[256];
1474 const gnutls_datum_t *cert_list;
1475 int old_pool, rc;
1476 unsigned int cert_list_size = 0;
1477 gnutls_protocol_t protocol;
1478 gnutls_cipher_algorithm_t cipher;
1479 gnutls_kx_algorithm_t kx;
1480 gnutls_mac_algorithm_t mac;
1481 gnutls_certificate_type_t ct;
1482 gnutls_x509_crt_t crt;
1483 uschar *p, *dn_buf;
1484 size_t sz;
1485
1486 if (state->have_set_peerdn)
1487 return OK;
1488 state->have_set_peerdn = TRUE;
1489
1490 state->peerdn = NULL;
1491
1492 /* tls_cipher */
1493 cipher = gnutls_cipher_get(state->session);
1494 protocol = gnutls_protocol_get_version(state->session);
1495 mac = gnutls_mac_get(state->session);
1496 kx = gnutls_kx_get(state->session);
1497
1498 string_format(cipherbuf, sizeof(cipherbuf),
1499 "%s:%s:%d",
1500 gnutls_protocol_get_name(protocol),
1501 gnutls_cipher_suite_get_name(kx, cipher, mac),
1502 (int) gnutls_cipher_get_key_size(cipher) * 8);
1503
1504 /* I don't see a way that spaces could occur, in the current GnuTLS
1505 code base, but it was a concern in the old code and perhaps older GnuTLS
1506 releases did return "TLS 1.0"; play it safe, just in case. */
1507 for (p = cipherbuf; *p != '\0'; ++p)
1508 if (isspace(*p))
1509 *p = '-';
1510 old_pool = store_pool;
1511 store_pool = POOL_PERM;
1512 state->ciphersuite = string_copy(cipherbuf);
1513 store_pool = old_pool;
1514 state->tlsp->cipher = state->ciphersuite;
1515
1516 /* tls_peerdn */
1517 cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
1518
1519 if (cert_list == NULL || cert_list_size == 0)
1520 {
1521 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1522 cert_list, cert_list_size);
1523 if (state->verify_requirement >= VERIFY_REQUIRED)
1524 return tls_error(US"certificate verification failed",
1525 "no certificate received from peer", state->host, errstr);
1526 return OK;
1527 }
1528
1529 ct = gnutls_certificate_type_get(state->session);
1530 if (ct != GNUTLS_CRT_X509)
1531 {
1532 const char *ctn = gnutls_certificate_type_get_name(ct);
1533 DEBUG(D_tls)
1534 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
1535 if (state->verify_requirement >= VERIFY_REQUIRED)
1536 return tls_error(US"certificate verification not possible, unhandled type",
1537 ctn, state->host, errstr);
1538 return OK;
1539 }
1540
1541 #define exim_gnutls_peer_err(Label) \
1542 do { \
1543 if (rc != GNUTLS_E_SUCCESS) \
1544 { \
1545 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1546 (Label), gnutls_strerror(rc)); \
1547 if (state->verify_requirement >= VERIFY_REQUIRED) \
1548 return tls_error((Label), gnutls_strerror(rc), state->host, errstr); \
1549 return OK; \
1550 } \
1551 } while (0)
1552
1553 rc = import_cert(&cert_list[0], &crt);
1554 exim_gnutls_peer_err(US"cert 0");
1555
1556 state->tlsp->peercert = state->peercert = crt;
1557
1558 sz = 0;
1559 rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1560 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
1561 {
1562 exim_gnutls_peer_err(US"getting size for cert DN failed");
1563 return FAIL; /* should not happen */
1564 }
1565 dn_buf = store_get_perm(sz);
1566 rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1567 exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1568
1569 state->peerdn = dn_buf;
1570
1571 return OK;
1572 #undef exim_gnutls_peer_err
1573 }
1574
1575
1576
1577
1578 /*************************************************
1579 * Verify peer certificate *
1580 *************************************************/
1581
1582 /* Called from both server and client code.
1583 *Should* be using a callback registered with
1584 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1585 the peer information, but that's too new for some OSes.
1586
1587 Arguments:
1588 state exim_gnutls_state_st *
1589 errstr where to put an error message
1590
1591 Returns:
1592 FALSE if the session should be rejected
1593 TRUE if the cert is okay or we just don't care
1594 */
1595
1596 static BOOL
1597 verify_certificate(exim_gnutls_state_st * state, uschar ** errstr)
1598 {
1599 int rc;
1600 uint verify;
1601
1602 if (state->verify_requirement == VERIFY_NONE)
1603 return TRUE;
1604
1605 DEBUG(D_tls) debug_printf("TLS: checking peer certificate\n");
1606 *errstr = NULL;
1607
1608 if ((rc = peer_status(state, errstr)) != OK)
1609 {
1610 verify = GNUTLS_CERT_INVALID;
1611 *errstr = US"certificate not supplied";
1612 }
1613 else
1614
1615 {
1616 #ifdef SUPPORT_DANE
1617 if (state->verify_requirement == VERIFY_DANE && state->host)
1618 {
1619 /* Using dane_verify_session_crt() would be easy, as it does it all for us
1620 including talking to a DNS resolver. But we want to do that bit ourselves
1621 as the testsuite intercepts and fakes its own DNS environment. */
1622
1623 dane_state_t s;
1624 dane_query_t r;
1625 uint lsize;
1626 const gnutls_datum_t * certlist =
1627 gnutls_certificate_get_peers(state->session, &lsize);
1628 int usage = tls_out.tlsa_usage;
1629
1630 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
1631 /* Split the TLSA records into two sets, TA and EE selectors. Run the
1632 dane-verification separately so that we know which selector verified;
1633 then we know whether to do name-verification (needed for TA but not EE). */
1634
1635 if (usage == ((1<<DANESSL_USAGE_DANE_TA) | (1<<DANESSL_USAGE_DANE_EE)))
1636 { /* a mixed-usage bundle */
1637 int i, j, nrec;
1638 const char ** dd;
1639 int * ddl;
1640
1641 for(nrec = 0; state->dane_data_len[nrec]; ) nrec++;
1642 nrec++;
1643
1644 dd = store_get(nrec * sizeof(uschar *));
1645 ddl = store_get(nrec * sizeof(int));
1646 nrec--;
1647
1648 if ((rc = dane_state_init(&s, 0)))
1649 goto tlsa_prob;
1650
1651 for (usage = DANESSL_USAGE_DANE_EE;
1652 usage >= DANESSL_USAGE_DANE_TA; usage--)
1653 { /* take records with this usage */
1654 for (j = i = 0; i < nrec; i++)
1655 if (state->dane_data[i][0] == usage)
1656 {
1657 dd[j] = state->dane_data[i];
1658 ddl[j++] = state->dane_data_len[i];
1659 }
1660 if (j)
1661 {
1662 dd[j] = NULL;
1663 ddl[j] = 0;
1664
1665 if ((rc = dane_raw_tlsa(s, &r, (char * const *)dd, ddl, 1, 0)))
1666 goto tlsa_prob;
1667
1668 if ((rc = dane_verify_crt_raw(s, certlist, lsize,
1669 gnutls_certificate_type_get(state->session),
1670 r, 0,
1671 usage == DANESSL_USAGE_DANE_EE
1672 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1673 &verify)))
1674 {
1675 DEBUG(D_tls)
1676 debug_printf("TLSA record problem: %s\n", dane_strerror(rc));
1677 }
1678 else if (verify == 0) /* verification passed */
1679 {
1680 usage = 1 << usage;
1681 break;
1682 }
1683 }
1684 }
1685
1686 if (rc) goto tlsa_prob;
1687 }
1688 else
1689 # endif
1690 {
1691 if ( (rc = dane_state_init(&s, 0))
1692 || (rc = dane_raw_tlsa(s, &r, state->dane_data, state->dane_data_len,
1693 1, 0))
1694 || (rc = dane_verify_crt_raw(s, certlist, lsize,
1695 gnutls_certificate_type_get(state->session),
1696 r, 0,
1697 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
1698 usage == (1 << DANESSL_USAGE_DANE_EE)
1699 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1700 # else
1701 0,
1702 # endif
1703 &verify))
1704 )
1705 goto tlsa_prob;
1706 }
1707
1708 if (verify != 0) /* verification failed */
1709 {
1710 gnutls_datum_t str;
1711 (void) dane_verification_status_print(verify, &str, 0);
1712 *errstr = US str.data; /* don't bother to free */
1713 goto badcert;
1714 }
1715
1716 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
1717 /* If a TA-mode TLSA record was used for verification we must additionally
1718 verify the cert name (but not the CA chain). For EE-mode, skip it. */
1719
1720 if (usage & (1 << DANESSL_USAGE_DANE_EE))
1721 # endif
1722 {
1723 state->peer_dane_verified = state->peer_cert_verified = TRUE;
1724 goto goodcert;
1725 }
1726 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
1727 /* Assume that the name on the A-record is the one that should be matching
1728 the cert. An alternate view is that the domain part of the email address
1729 is also permissible. */
1730
1731 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert,
1732 CS state->host->name))
1733 {
1734 state->peer_dane_verified = state->peer_cert_verified = TRUE;
1735 goto goodcert;
1736 }
1737 # endif
1738 }
1739 #endif /*SUPPORT_DANE*/
1740
1741 rc = gnutls_certificate_verify_peers2(state->session, &verify);
1742 }
1743
1744 /* Handle the result of verification. INVALID is set if any others are. */
1745
1746 if (rc < 0 || verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED))
1747 {
1748 state->peer_cert_verified = FALSE;
1749 if (!*errstr)
1750 {
1751 #ifdef GNUTLS_CERT_VFY_STATUS_PRINT
1752 DEBUG(D_tls)
1753 {
1754 gnutls_datum_t txt;
1755
1756 if (gnutls_certificate_verification_status_print(verify,
1757 gnutls_certificate_type_get(state->session), &txt, 0)
1758 == GNUTLS_E_SUCCESS)
1759 {
1760 debug_printf("%s\n", txt.data);
1761 gnutls_free(txt.data);
1762 }
1763 }
1764 #endif
1765 *errstr = verify & GNUTLS_CERT_REVOKED
1766 ? US"certificate revoked" : US"certificate invalid";
1767 }
1768
1769 DEBUG(D_tls)
1770 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
1771 *errstr, state->peerdn ? state->peerdn : US"<unset>");
1772
1773 if (state->verify_requirement >= VERIFY_REQUIRED)
1774 goto badcert;
1775 DEBUG(D_tls)
1776 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
1777 }
1778
1779 else
1780 {
1781 /* Client side, check the server's certificate name versus the name on the
1782 A-record for the connection we made. What to do for server side - what name
1783 to use for client? We document that there is no such checking for server
1784 side. */
1785
1786 if ( state->exp_tls_verify_cert_hostnames
1787 && !gnutls_x509_crt_check_hostname(state->tlsp->peercert,
1788 CS state->exp_tls_verify_cert_hostnames)
1789 )
1790 {
1791 DEBUG(D_tls)
1792 debug_printf("TLS certificate verification failed: cert name mismatch\n");
1793 if (state->verify_requirement >= VERIFY_REQUIRED)
1794 goto badcert;
1795 return TRUE;
1796 }
1797
1798 state->peer_cert_verified = TRUE;
1799 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
1800 state->peerdn ? state->peerdn : US"<unset>");
1801 }
1802
1803 goodcert:
1804 state->tlsp->peerdn = state->peerdn;
1805 return TRUE;
1806
1807 #ifdef SUPPORT_DANE
1808 tlsa_prob:
1809 *errstr = string_sprintf("TLSA record problem: %s",
1810 rc == DANE_E_REQUESTED_DATA_NOT_AVAILABLE ? "none usable" : dane_strerror(rc));
1811 #endif
1812
1813 badcert:
1814 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1815 return FALSE;
1816 }
1817
1818
1819
1820
1821 /* ------------------------------------------------------------------------ */
1822 /* Callbacks */
1823
1824 /* Logging function which can be registered with
1825 * gnutls_global_set_log_function()
1826 * gnutls_global_set_log_level() 0..9
1827 */
1828 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1829 static void
1830 exim_gnutls_logger_cb(int level, const char *message)
1831 {
1832 size_t len = strlen(message);
1833 if (len < 1)
1834 {
1835 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1836 return;
1837 }
1838 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1839 message[len-1] == '\n' ? "" : "\n");
1840 }
1841 #endif
1842
1843
1844 /* Called after client hello, should handle SNI work.
1845 This will always set tls_sni (state->received_sni) if available,
1846 and may trigger presenting different certificates,
1847 if state->trigger_sni_changes is TRUE.
1848
1849 Should be registered with
1850 gnutls_handshake_set_post_client_hello_function()
1851
1852 "This callback must return 0 on success or a gnutls error code to terminate the
1853 handshake.".
1854
1855 For inability to get SNI information, we return 0.
1856 We only return non-zero if re-setup failed.
1857 Only used for server-side TLS.
1858 */
1859
1860 static int
1861 exim_sni_handling_cb(gnutls_session_t session)
1862 {
1863 char sni_name[MAX_HOST_LEN];
1864 size_t data_len = MAX_HOST_LEN;
1865 exim_gnutls_state_st *state = &state_server;
1866 unsigned int sni_type;
1867 int rc, old_pool;
1868 uschar * dummy_errstr;
1869
1870 rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
1871 if (rc != GNUTLS_E_SUCCESS)
1872 {
1873 DEBUG(D_tls) {
1874 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1875 debug_printf("TLS: no SNI presented in handshake.\n");
1876 else
1877 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1878 gnutls_strerror(rc), rc);
1879 }
1880 return 0;
1881 }
1882
1883 if (sni_type != GNUTLS_NAME_DNS)
1884 {
1885 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1886 return 0;
1887 }
1888
1889 /* We now have a UTF-8 string in sni_name */
1890 old_pool = store_pool;
1891 store_pool = POOL_PERM;
1892 state->received_sni = string_copyn(US sni_name, data_len);
1893 store_pool = old_pool;
1894
1895 /* We set this one now so that variable expansions below will work */
1896 state->tlsp->sni = state->received_sni;
1897
1898 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1899 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1900
1901 if (!state->trigger_sni_changes)
1902 return 0;
1903
1904 if ((rc = tls_expand_session_files(state, &dummy_errstr)) != OK)
1905 {
1906 /* If the setup of certs/etc failed before handshake, TLS would not have
1907 been offered. The best we can do now is abort. */
1908 return GNUTLS_E_APPLICATION_ERROR_MIN;
1909 }
1910
1911 rc = tls_set_remaining_x509(state, &dummy_errstr);
1912 if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1913
1914 return 0;
1915 }
1916
1917
1918
1919 #ifndef DISABLE_OCSP
1920
1921 static int
1922 server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
1923 gnutls_datum_t * ocsp_response)
1924 {
1925 int ret;
1926 DEBUG(D_tls) debug_printf("OCSP stapling callback: %s\n", US ptr);
1927
1928 if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
1929 {
1930 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
1931 CS ptr);
1932 tls_in.ocsp = OCSP_NOT_RESP;
1933 return GNUTLS_E_NO_CERTIFICATE_STATUS;
1934 }
1935
1936 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1937 return 0;
1938 }
1939
1940 #endif
1941
1942
1943 #ifndef DISABLE_EVENT
1944 /*
1945 We use this callback to get observability and detail-level control
1946 for an exim TLS connection (either direction), raising a tls:cert event
1947 for each cert in the chain presented by the peer. Any event
1948 can deny verification.
1949
1950 Return 0 for the handshake to continue or non-zero to terminate.
1951 */
1952
1953 static int
1954 verify_cb(gnutls_session_t session)
1955 {
1956 const gnutls_datum_t * cert_list;
1957 unsigned int cert_list_size = 0;
1958 gnutls_x509_crt_t crt;
1959 int rc;
1960 uschar * yield;
1961 exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
1962
1963 if ((cert_list = gnutls_certificate_get_peers(session, &cert_list_size)))
1964 while (cert_list_size--)
1965 {
1966 if ((rc = import_cert(&cert_list[cert_list_size], &crt)) != GNUTLS_E_SUCCESS)
1967 {
1968 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
1969 cert_list_size, gnutls_strerror(rc));
1970 break;
1971 }
1972
1973 state->tlsp->peercert = crt;
1974 if ((yield = event_raise(state->event_action,
1975 US"tls:cert", string_sprintf("%d", cert_list_size))))
1976 {
1977 log_write(0, LOG_MAIN,
1978 "SSL verify denied by event-action: depth=%d: %s",
1979 cert_list_size, yield);
1980 return 1; /* reject */
1981 }
1982 state->tlsp->peercert = NULL;
1983 }
1984
1985 return 0;
1986 }
1987
1988 #endif
1989
1990
1991
1992 /* ------------------------------------------------------------------------ */
1993 /* Exported functions */
1994
1995
1996
1997
1998 /*************************************************
1999 * Start a TLS session in a server *
2000 *************************************************/
2001
2002 /* This is called when Exim is running as a server, after having received
2003 the STARTTLS command. It must respond to that command, and then negotiate
2004 a TLS session.
2005
2006 Arguments:
2007 require_ciphers list of allowed ciphers or NULL
2008 errstr pointer to error string
2009
2010 Returns: OK on success
2011 DEFER for errors before the start of the negotiation
2012 FAIL for errors during the negotiation; the server can't
2013 continue running.
2014 */
2015
2016 int
2017 tls_server_start(const uschar * require_ciphers, uschar ** errstr)
2018 {
2019 int rc;
2020 exim_gnutls_state_st * state = NULL;
2021
2022 /* Check for previous activation */
2023 if (tls_in.active.sock >= 0)
2024 {
2025 tls_error(US"STARTTLS received after TLS started", "", NULL, errstr);
2026 smtp_printf("554 Already in TLS\r\n", FALSE);
2027 return FAIL;
2028 }
2029
2030 /* Initialize the library. If it fails, it will already have logged the error
2031 and sent an SMTP response. */
2032
2033 DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
2034
2035 if ((rc = tls_init(NULL, tls_certificate, tls_privatekey,
2036 NULL, tls_verify_certificates, tls_crl,
2037 require_ciphers, &state, &tls_in, errstr)) != OK) return rc;
2038
2039 /* If this is a host for which certificate verification is mandatory or
2040 optional, set up appropriately. */
2041
2042 if (verify_check_host(&tls_verify_hosts) == OK)
2043 {
2044 DEBUG(D_tls)
2045 debug_printf("TLS: a client certificate will be required.\n");
2046 state->verify_requirement = VERIFY_REQUIRED;
2047 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2048 }
2049 else if (verify_check_host(&tls_try_verify_hosts) == OK)
2050 {
2051 DEBUG(D_tls)
2052 debug_printf("TLS: a client certificate will be requested but not required.\n");
2053 state->verify_requirement = VERIFY_OPTIONAL;
2054 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2055 }
2056 else
2057 {
2058 DEBUG(D_tls)
2059 debug_printf("TLS: a client certificate will not be requested.\n");
2060 state->verify_requirement = VERIFY_NONE;
2061 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2062 }
2063
2064 #ifndef DISABLE_EVENT
2065 if (event_action)
2066 {
2067 state->event_action = event_action;
2068 gnutls_session_set_ptr(state->session, state);
2069 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2070 }
2071 #endif
2072
2073 /* Register SNI handling; always, even if not in tls_certificate, so that the
2074 expansion variable $tls_sni is always available. */
2075
2076 gnutls_handshake_set_post_client_hello_function(state->session,
2077 exim_sni_handling_cb);
2078
2079 /* Set context and tell client to go ahead, except in the case of TLS startup
2080 on connection, where outputting anything now upsets the clients and tends to
2081 make them disconnect. We need to have an explicit fflush() here, to force out
2082 the response. Other smtp_printf() calls do not need it, because in non-TLS
2083 mode, the fflush() happens when smtp_getc() is called. */
2084
2085 if (!state->tlsp->on_connect)
2086 {
2087 smtp_printf("220 TLS go ahead\r\n", FALSE);
2088 fflush(smtp_out);
2089 }
2090
2091 /* Now negotiate the TLS session. We put our own timer on it, since it seems
2092 that the GnuTLS library doesn't.
2093 From 3.1.0 there is gnutls_handshake_set_timeout() - but it requires you
2094 to set (and clear down afterwards) up a pull-timeout callback function that does
2095 a select, so we're no better off unless avoiding signals becomes an issue. */
2096
2097 gnutls_transport_set_ptr2(state->session,
2098 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
2099 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
2100 state->fd_in = fileno(smtp_in);
2101 state->fd_out = fileno(smtp_out);
2102
2103 sigalrm_seen = FALSE;
2104 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
2105 do
2106 rc = gnutls_handshake(state->session);
2107 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
2108 alarm(0);
2109
2110 if (rc != GNUTLS_E_SUCCESS)
2111 {
2112 /* It seems that, except in the case of a timeout, we have to close the
2113 connection right here; otherwise if the other end is running OpenSSL it hangs
2114 until the server times out. */
2115
2116 if (sigalrm_seen)
2117 {
2118 tls_error(US"gnutls_handshake", "timed out", NULL, errstr);
2119 gnutls_db_remove_session(state->session);
2120 }
2121 else
2122 {
2123 tls_error(US"gnutls_handshake", gnutls_strerror(rc), NULL, errstr);
2124 (void) gnutls_alert_send_appropriate(state->session, rc);
2125 gnutls_deinit(state->session);
2126 gnutls_certificate_free_credentials(state->x509_cred);
2127 millisleep(500);
2128 shutdown(state->fd_out, SHUT_WR);
2129 for (rc = 1024; fgetc(smtp_in) != EOF && rc > 0; ) rc--; /* drain skt */
2130 (void)fclose(smtp_out);
2131 (void)fclose(smtp_in);
2132 smtp_out = smtp_in = NULL;
2133 }
2134
2135 return FAIL;
2136 }
2137
2138 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
2139
2140 /* Verify after the fact */
2141
2142 if (!verify_certificate(state, errstr))
2143 {
2144 if (state->verify_requirement != VERIFY_OPTIONAL)
2145 {
2146 (void) tls_error(US"certificate verification failed", *errstr, NULL, errstr);
2147 return FAIL;
2148 }
2149 DEBUG(D_tls)
2150 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
2151 *errstr);
2152 }
2153
2154 /* Figure out peer DN, and if authenticated, etc. */
2155
2156 if ((rc = peer_status(state, NULL)) != OK) return rc;
2157
2158 /* Sets various Exim expansion variables; always safe within server */
2159
2160 extract_exim_vars_from_tls_state(state);
2161
2162 /* TLS has been set up. Adjust the input functions to read via TLS,
2163 and initialize appropriately. */
2164
2165 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
2166
2167 receive_getc = tls_getc;
2168 receive_getbuf = tls_getbuf;
2169 receive_get_cache = tls_get_cache;
2170 receive_ungetc = tls_ungetc;
2171 receive_feof = tls_feof;
2172 receive_ferror = tls_ferror;
2173 receive_smtp_buffered = tls_smtp_buffered;
2174
2175 return OK;
2176 }
2177
2178
2179
2180
2181 static void
2182 tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
2183 smtp_transport_options_block * ob)
2184 {
2185 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
2186 {
2187 state->exp_tls_verify_cert_hostnames =
2188 #ifdef SUPPORT_I18N
2189 string_domain_utf8_to_alabel(host->name, NULL);
2190 #else
2191 host->name;
2192 #endif
2193 DEBUG(D_tls)
2194 debug_printf("TLS: server cert verification includes hostname: \"%s\".\n",
2195 state->exp_tls_verify_cert_hostnames);
2196 }
2197 }
2198
2199
2200
2201
2202 #ifdef SUPPORT_DANE
2203 /* Given our list of RRs from the TLSA lookup, build a lookup block in
2204 GnuTLS-DANE's preferred format. Hang it on the state str for later
2205 use in DANE verification.
2206
2207 We point at the dnsa data not copy it, so it must remain valid until
2208 after verification is done.*/
2209
2210 static BOOL
2211 dane_tlsa_load(exim_gnutls_state_st * state, dns_answer * dnsa)
2212 {
2213 dns_record * rr;
2214 dns_scan dnss;
2215 int i;
2216 const char ** dane_data;
2217 int * dane_data_len;
2218
2219 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS), i = 1;
2220 rr;
2221 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2222 ) if (rr->type == T_TLSA) i++;
2223
2224 dane_data = store_get(i * sizeof(uschar *));
2225 dane_data_len = store_get(i * sizeof(int));
2226
2227 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS), i = 0;
2228 rr;
2229 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2230 ) if (rr->type == T_TLSA && rr->size > 3)
2231 {
2232 const uschar * p = rr->data;
2233 uint8_t usage = p[0], sel = p[1], type = p[2];
2234
2235 DEBUG(D_tls)
2236 debug_printf("TLSA: %d %d %d size %d\n", usage, sel, type, rr->size);
2237
2238 if ( (usage != DANESSL_USAGE_DANE_TA && usage != DANESSL_USAGE_DANE_EE)
2239 || (sel != 0 && sel != 1)
2240 )
2241 continue;
2242 switch(type)
2243 {
2244 case 0: /* Full: cannot check at present */
2245 break;
2246 case 1: if (rr->size != 3 + 256/8) continue; /* sha2-256 */
2247 break;
2248 case 2: if (rr->size != 3 + 512/8) continue; /* sha2-512 */
2249 break;
2250 default: continue;
2251 }
2252
2253 tls_out.tlsa_usage |= 1<<usage;
2254 dane_data[i] = p;
2255 dane_data_len[i++] = rr->size;
2256 }
2257
2258 if (!i) return FALSE;
2259
2260 dane_data[i] = NULL;
2261 dane_data_len[i] = 0;
2262
2263 state->dane_data = (char * const *)dane_data;
2264 state->dane_data_len = dane_data_len;
2265 return TRUE;
2266 }
2267 #endif
2268
2269
2270
2271 /*************************************************
2272 * Start a TLS session in a client *
2273 *************************************************/
2274
2275 /* Called from the smtp transport after STARTTLS has been accepted.
2276
2277 Arguments:
2278 fd the fd of the connection
2279 host connected host (for messages and option-tests)
2280 addr the first address (not used)
2281 tb transport (always smtp)
2282 tlsa_dnsa non-NULL, either request or require dane for this host, and
2283 a TLSA record found. Therefore, dane verify required.
2284 Which implies cert must be requested and supplied, dane
2285 verify must pass, and cert verify irrelevant (incl.
2286 hostnames), and (caller handled) require_tls
2287 tlsp record details of channel configuration
2288 errstr error string pointer
2289
2290 Returns: Pointer to TLS session context, or NULL on error
2291 */
2292
2293 void *
2294 tls_client_start(int fd, host_item *host,
2295 address_item *addr ARG_UNUSED,
2296 transport_instance * tb,
2297 #ifdef SUPPORT_DANE
2298 dns_answer * tlsa_dnsa,
2299 #endif
2300 tls_support * tlsp, uschar ** errstr)
2301 {
2302 smtp_transport_options_block *ob = tb
2303 ? (smtp_transport_options_block *)tb->options_block
2304 : &smtp_transport_option_defaults;
2305 int rc;
2306 exim_gnutls_state_st * state = NULL;
2307 uschar *cipher_list = NULL;
2308
2309 #ifndef DISABLE_OCSP
2310 BOOL require_ocsp =
2311 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
2312 BOOL request_ocsp = require_ocsp ? TRUE
2313 : verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
2314 #endif
2315
2316 DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
2317
2318 #ifdef SUPPORT_DANE
2319 if (tlsa_dnsa && ob->dane_require_tls_ciphers)
2320 {
2321 /* not using expand_check_tlsvar because not yet in state */
2322 if (!expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
2323 &cipher_list, errstr))
2324 return NULL;
2325 cipher_list = cipher_list && *cipher_list
2326 ? ob->dane_require_tls_ciphers : ob->tls_require_ciphers;
2327 }
2328 #endif
2329
2330 if (!cipher_list)
2331 cipher_list = ob->tls_require_ciphers;
2332
2333 if (tls_init(host, ob->tls_certificate, ob->tls_privatekey,
2334 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
2335 cipher_list, &state, tlsp, errstr) != OK)
2336 return NULL;
2337
2338 {
2339 int dh_min_bits = ob->tls_dh_min_bits;
2340 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
2341 {
2342 DEBUG(D_tls)
2343 debug_printf("WARNING: tls_dh_min_bits far too low,"
2344 " clamping %d up to %d\n",
2345 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
2346 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
2347 }
2348
2349 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
2350 " acceptable bits to %d\n",
2351 dh_min_bits);
2352 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
2353 }
2354
2355 /* Stick to the old behaviour for compatibility if tls_verify_certificates is
2356 set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
2357 the specified host patterns if one of them is defined */
2358
2359 #ifdef SUPPORT_DANE
2360 if (tlsa_dnsa && dane_tlsa_load(state, tlsa_dnsa))
2361 {
2362 DEBUG(D_tls)
2363 debug_printf("TLS: server certificate DANE required.\n");
2364 state->verify_requirement = VERIFY_DANE;
2365 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2366 }
2367 else
2368 #endif
2369 if ( ( state->exp_tls_verify_certificates
2370 && !ob->tls_verify_hosts
2371 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2372 )
2373 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
2374 )
2375 {
2376 tls_client_setup_hostname_checks(host, state, ob);
2377 DEBUG(D_tls)
2378 debug_printf("TLS: server certificate verification required.\n");
2379 state->verify_requirement = VERIFY_REQUIRED;
2380 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2381 }
2382 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
2383 {
2384 tls_client_setup_hostname_checks(host, state, ob);
2385 DEBUG(D_tls)
2386 debug_printf("TLS: server certificate verification optional.\n");
2387 state->verify_requirement = VERIFY_OPTIONAL;
2388 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2389 }
2390 else
2391 {
2392 DEBUG(D_tls)
2393 debug_printf("TLS: server certificate verification not required.\n");
2394 state->verify_requirement = VERIFY_NONE;
2395 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2396 }
2397
2398 #ifndef DISABLE_OCSP
2399 /* supported since GnuTLS 3.1.3 */
2400 if (request_ocsp)
2401 {
2402 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
2403 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
2404 NULL, 0, NULL)) != OK)
2405 {
2406 tls_error(US"cert-status-req", gnutls_strerror(rc), state->host, errstr);
2407 return NULL;
2408 }
2409 tlsp->ocsp = OCSP_NOT_RESP;
2410 }
2411 #endif
2412
2413 #ifndef DISABLE_EVENT
2414 if (tb && tb->event_action)
2415 {
2416 state->event_action = tb->event_action;
2417 gnutls_session_set_ptr(state->session, state);
2418 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2419 }
2420 #endif
2421
2422 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) fd);
2423 state->fd_in = fd;
2424 state->fd_out = fd;
2425
2426 DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
2427 /* There doesn't seem to be a built-in timeout on connection. */
2428
2429 sigalrm_seen = FALSE;
2430 alarm(ob->command_timeout);
2431 do
2432 rc = gnutls_handshake(state->session);
2433 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
2434 alarm(0);
2435
2436 if (rc != GNUTLS_E_SUCCESS)
2437 {
2438 if (sigalrm_seen)
2439 {
2440 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
2441 tls_error(US"gnutls_handshake", "timed out", state->host, errstr);
2442 }
2443 else
2444 tls_error(US"gnutls_handshake", gnutls_strerror(rc), state->host, errstr);
2445 return NULL;
2446 }
2447
2448 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
2449
2450 /* Verify late */
2451
2452 if (!verify_certificate(state, errstr))
2453 {
2454 tls_error(US"certificate verification failed", *errstr, state->host, errstr);
2455 return NULL;
2456 }
2457
2458 #ifndef DISABLE_OCSP
2459 if (require_ocsp)
2460 {
2461 DEBUG(D_tls)
2462 {
2463 gnutls_datum_t stapling;
2464 gnutls_ocsp_resp_t resp;
2465 gnutls_datum_t printed;
2466 if ( (rc= gnutls_ocsp_status_request_get(state->session, &stapling)) == 0
2467 && (rc= gnutls_ocsp_resp_init(&resp)) == 0
2468 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
2469 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_FULL, &printed)) == 0
2470 )
2471 {
2472 debug_printf("%.4096s", printed.data);
2473 gnutls_free(printed.data);
2474 }
2475 else
2476 (void) tls_error(US"ocsp decode", gnutls_strerror(rc), state->host, errstr);
2477 }
2478
2479 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
2480 {
2481 tlsp->ocsp = OCSP_FAILED;
2482 tls_error(US"certificate status check failed", NULL, state->host, errstr);
2483 return NULL;
2484 }
2485 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
2486 tlsp->ocsp = OCSP_VFIED;
2487 }
2488 #endif
2489
2490 /* Figure out peer DN, and if authenticated, etc. */
2491
2492 if (peer_status(state, errstr) != OK)
2493 return NULL;
2494
2495 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
2496
2497 extract_exim_vars_from_tls_state(state);
2498
2499 return state;
2500 }
2501
2502
2503
2504
2505 /*************************************************
2506 * Close down a TLS session *
2507 *************************************************/
2508
2509 /* This is also called from within a delivery subprocess forked from the
2510 daemon, to shut down the TLS library, without actually doing a shutdown (which
2511 would tamper with the TLS session in the parent process).
2512
2513 Arguments:
2514 ct_ctx client context pointer, or NULL for the one global server context
2515 shutdown 1 if TLS close-alert is to be sent,
2516 2 if also response to be waited for
2517
2518 Returns: nothing
2519 */
2520
2521 void
2522 tls_close(void * ct_ctx, int shutdown)
2523 {
2524 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
2525
2526 if (!state->tlsp || state->tlsp->active.sock < 0) return; /* TLS was not active */
2527
2528 if (shutdown)
2529 {
2530 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
2531 shutdown > 1 ? " (with response-wait)" : "");
2532
2533 alarm(2);
2534 gnutls_bye(state->session, shutdown > 1 ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR);
2535 alarm(0);
2536 }
2537
2538 gnutls_deinit(state->session);
2539 gnutls_certificate_free_credentials(state->x509_cred);
2540
2541
2542 state->tlsp->active.sock = -1;
2543 state->tlsp->active.tls_ctx = NULL;
2544 if (state->xfer_buffer) store_free(state->xfer_buffer);
2545 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
2546 }
2547
2548
2549
2550
2551 static BOOL
2552 tls_refill(unsigned lim)
2553 {
2554 exim_gnutls_state_st * state = &state_server;
2555 ssize_t inbytes;
2556
2557 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
2558 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
2559
2560 sigalrm_seen = FALSE;
2561 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
2562 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
2563 MIN(ssl_xfer_buffer_size, lim));
2564 if (smtp_receive_timeout > 0) alarm(0);
2565
2566 if (had_command_timeout) /* set by signal handler */
2567 smtp_command_timeout_exit(); /* does not return */
2568 if (had_command_sigterm)
2569 smtp_command_sigterm_exit();
2570 if (had_data_timeout)
2571 smtp_data_timeout_exit();
2572 if (had_data_sigint)
2573 smtp_data_sigint_exit();
2574
2575 /* Timeouts do not get this far. A zero-byte return appears to mean that the
2576 TLS session has been closed down, not that the socket itself has been closed
2577 down. Revert to non-TLS handling. */
2578
2579 if (sigalrm_seen)
2580 {
2581 DEBUG(D_tls) debug_printf("Got tls read timeout\n");
2582 state->xfer_error = TRUE;
2583 return FALSE;
2584 }
2585
2586 else if (inbytes == 0)
2587 {
2588 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2589
2590 receive_getc = smtp_getc;
2591 receive_getbuf = smtp_getbuf;
2592 receive_get_cache = smtp_get_cache;
2593 receive_ungetc = smtp_ungetc;
2594 receive_feof = smtp_feof;
2595 receive_ferror = smtp_ferror;
2596 receive_smtp_buffered = smtp_buffered;
2597
2598 gnutls_deinit(state->session);
2599 gnutls_certificate_free_credentials(state->x509_cred);
2600
2601 state->session = NULL;
2602 state->tlsp->active.sock = -1;
2603 state->tlsp->active.tls_ctx = NULL;
2604 state->tlsp->bits = 0;
2605 state->tlsp->certificate_verified = FALSE;
2606 tls_channelbinding_b64 = NULL;
2607 state->tlsp->cipher = NULL;
2608 state->tlsp->peercert = NULL;
2609 state->tlsp->peerdn = NULL;
2610
2611 return FALSE;
2612 }
2613
2614 /* Handle genuine errors */
2615
2616 else if (inbytes < 0)
2617 {
2618 debug_printf("%s: err from gnutls_record_recv(\n", __FUNCTION__);
2619 record_io_error(state, (int) inbytes, US"recv", NULL);
2620 state->xfer_error = TRUE;
2621 return FALSE;
2622 }
2623 #ifndef DISABLE_DKIM
2624 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
2625 #endif
2626 state->xfer_buffer_hwm = (int) inbytes;
2627 state->xfer_buffer_lwm = 0;
2628 return TRUE;
2629 }
2630
2631 /*************************************************
2632 * TLS version of getc *
2633 *************************************************/
2634
2635 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
2636 it refills the buffer via the GnuTLS reading function.
2637 Only used by the server-side TLS.
2638
2639 This feeds DKIM and should be used for all message-body reads.
2640
2641 Arguments: lim Maximum amount to read/bufffer
2642 Returns: the next character or EOF
2643 */
2644
2645 int
2646 tls_getc(unsigned lim)
2647 {
2648 exim_gnutls_state_st * state = &state_server;
2649
2650 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
2651 if (!tls_refill(lim))
2652 return state->xfer_error ? EOF : smtp_getc(lim);
2653
2654 /* Something in the buffer; return next uschar */
2655
2656 return state->xfer_buffer[state->xfer_buffer_lwm++];
2657 }
2658
2659 uschar *
2660 tls_getbuf(unsigned * len)
2661 {
2662 exim_gnutls_state_st * state = &state_server;
2663 unsigned size;
2664 uschar * buf;
2665
2666 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
2667 if (!tls_refill(*len))
2668 {
2669 if (!state->xfer_error) return smtp_getbuf(len);
2670 *len = 0;
2671 return NULL;
2672 }
2673
2674 if ((size = state->xfer_buffer_hwm - state->xfer_buffer_lwm) > *len)
2675 size = *len;
2676 buf = &state->xfer_buffer[state->xfer_buffer_lwm];
2677 state->xfer_buffer_lwm += size;
2678 *len = size;
2679 return buf;
2680 }
2681
2682
2683 void
2684 tls_get_cache()
2685 {
2686 #ifndef DISABLE_DKIM
2687 exim_gnutls_state_st * state = &state_server;
2688 int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
2689 if (n > 0)
2690 dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
2691 #endif
2692 }
2693
2694
2695 BOOL
2696 tls_could_read(void)
2697 {
2698 return state_server.xfer_buffer_lwm < state_server.xfer_buffer_hwm
2699 || gnutls_record_check_pending(state_server.session) > 0;
2700 }
2701
2702
2703
2704
2705 /*************************************************
2706 * Read bytes from TLS channel *
2707 *************************************************/
2708
2709 /* This does not feed DKIM, so if the caller uses this for reading message body,
2710 then the caller must feed DKIM.
2711
2712 Arguments:
2713 ct_ctx client context pointer, or NULL for the one global server context
2714 buff buffer of data
2715 len size of buffer
2716
2717 Returns: the number of bytes read
2718 -1 after a failed read, including EOF
2719 */
2720
2721 int
2722 tls_read(void * ct_ctx, uschar *buff, size_t len)
2723 {
2724 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
2725 ssize_t inbytes;
2726
2727 if (len > INT_MAX)
2728 len = INT_MAX;
2729
2730 if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
2731 DEBUG(D_tls)
2732 debug_printf("*** PROBABLY A BUG *** " \
2733 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
2734 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
2735
2736 DEBUG(D_tls)
2737 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
2738 state->session, buff, len);
2739
2740 inbytes = gnutls_record_recv(state->session, buff, len);
2741 if (inbytes > 0) return inbytes;
2742 if (inbytes == 0)
2743 {
2744 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2745 }
2746 else
2747 {
2748 debug_printf("%s: err from gnutls_record_recv(\n", __FUNCTION__);
2749 record_io_error(state, (int)inbytes, US"recv", NULL);
2750 }
2751
2752 return -1;
2753 }
2754
2755
2756
2757
2758 /*************************************************
2759 * Write bytes down TLS channel *
2760 *************************************************/
2761
2762 /*
2763 Arguments:
2764 ct_ctx client context pointer, or NULL for the one global server context
2765 buff buffer of data
2766 len number of bytes
2767 more more data expected soon
2768
2769 Returns: the number of bytes after a successful write,
2770 -1 after a failed write
2771 */
2772
2773 int
2774 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
2775 {
2776 ssize_t outbytes;
2777 size_t left = len;
2778 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
2779 #ifdef SUPPORT_CORK
2780 static BOOL corked = FALSE;
2781
2782 if (more && !corked) gnutls_record_cork(state->session);
2783 #endif
2784
2785 DEBUG(D_tls) debug_printf("%s(%p, " SIZE_T_FMT "%s)\n", __FUNCTION__,
2786 buff, left, more ? ", more" : "");
2787
2788 while (left > 0)
2789 {
2790 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
2791 buff, left);
2792 outbytes = gnutls_record_send(state->session, buff, left);
2793
2794 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
2795 if (outbytes < 0)
2796 {
2797 DEBUG(D_tls) debug_printf("%s: gnutls_record_send err\n", __FUNCTION__);
2798 record_io_error(state, outbytes, US"send", NULL);
2799 return -1;
2800 }
2801 if (outbytes == 0)
2802 {
2803 record_io_error(state, 0, US"send", US"TLS channel closed on write");
2804 return -1;
2805 }
2806
2807 left -= outbytes;
2808 buff += outbytes;
2809 }
2810
2811 if (len > INT_MAX)
2812 {
2813 DEBUG(D_tls)
2814 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
2815 len);
2816 len = INT_MAX;
2817 }
2818
2819 #ifdef SUPPORT_CORK
2820 if (more != corked)
2821 {
2822 if (!more) (void) gnutls_record_uncork(state->session, 0);
2823 corked = more;
2824 }
2825 #endif
2826
2827 return (int) len;
2828 }
2829
2830
2831
2832
2833 /*************************************************
2834 * Random number generation *
2835 *************************************************/
2836
2837 /* Pseudo-random number generation. The result is not expected to be
2838 cryptographically strong but not so weak that someone will shoot themselves
2839 in the foot using it as a nonce in input in some email header scheme or
2840 whatever weirdness they'll twist this into. The result should handle fork()
2841 and avoid repeating sequences. OpenSSL handles that for us.
2842
2843 Arguments:
2844 max range maximum
2845 Returns a random number in range [0, max-1]
2846 */
2847
2848 #ifdef HAVE_GNUTLS_RND
2849 int
2850 vaguely_random_number(int max)
2851 {
2852 unsigned int r;
2853 int i, needed_len;
2854 uschar *p;
2855 uschar smallbuf[sizeof(r)];
2856
2857 if (max <= 1)
2858 return 0;
2859
2860 needed_len = sizeof(r);
2861 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
2862 * asked for a number less than 10. */
2863 for (r = max, i = 0; r; ++i)
2864 r >>= 1;
2865 i = (i + 7) / 8;
2866 if (i < needed_len)
2867 needed_len = i;
2868
2869 i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
2870 if (i < 0)
2871 {
2872 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
2873 return vaguely_random_number_fallback(max);
2874 }
2875 r = 0;
2876 for (p = smallbuf; needed_len; --needed_len, ++p)
2877 {
2878 r *= 256;
2879 r += *p;
2880 }
2881
2882 /* We don't particularly care about weighted results; if someone wants
2883 * smooth distribution and cares enough then they should submit a patch then. */
2884 return r % max;
2885 }
2886 #else /* HAVE_GNUTLS_RND */
2887 int
2888 vaguely_random_number(int max)
2889 {
2890 return vaguely_random_number_fallback(max);
2891 }
2892 #endif /* HAVE_GNUTLS_RND */
2893
2894
2895
2896
2897 /*************************************************
2898 * Let tls_require_ciphers be checked at startup *
2899 *************************************************/
2900
2901 /* The tls_require_ciphers option, if set, must be something which the
2902 library can parse.
2903
2904 Returns: NULL on success, or error message
2905 */
2906
2907 uschar *
2908 tls_validate_require_cipher(void)
2909 {
2910 int rc;
2911 uschar *expciphers = NULL;
2912 gnutls_priority_t priority_cache;
2913 const char *errpos;
2914 uschar * dummy_errstr;
2915
2916 #define validate_check_rc(Label) do { \
2917 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
2918 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
2919 #define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
2920
2921 if (exim_gnutls_base_init_done)
2922 log_write(0, LOG_MAIN|LOG_PANIC,
2923 "already initialised GnuTLS, Exim developer bug");
2924
2925 #ifdef HAVE_GNUTLS_PKCS11
2926 if (!gnutls_allow_auto_pkcs11)
2927 {
2928 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
2929 validate_check_rc(US"gnutls_pkcs11_init");
2930 }
2931 #endif
2932 rc = gnutls_global_init();
2933 validate_check_rc(US"gnutls_global_init()");
2934 exim_gnutls_base_init_done = TRUE;
2935
2936 if (!(tls_require_ciphers && *tls_require_ciphers))
2937 return_deinit(NULL);
2938
2939 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
2940 &dummy_errstr))
2941 return_deinit(US"failed to expand tls_require_ciphers");
2942
2943 if (!(expciphers && *expciphers))
2944 return_deinit(NULL);
2945
2946 DEBUG(D_tls)
2947 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2948
2949 rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
2950 validate_check_rc(string_sprintf(
2951 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
2952 expciphers, errpos - CS expciphers, errpos));
2953
2954 #undef return_deinit
2955 #undef validate_check_rc
2956 gnutls_global_deinit();
2957
2958 return NULL;
2959 }
2960
2961
2962
2963
2964 /*************************************************
2965 * Report the library versions. *
2966 *************************************************/
2967
2968 /* See a description in tls-openssl.c for an explanation of why this exists.
2969
2970 Arguments: a FILE* to print the results to
2971 Returns: nothing
2972 */
2973
2974 void
2975 tls_version_report(FILE *f)
2976 {
2977 fprintf(f, "Library version: GnuTLS: Compile: %s\n"
2978 " Runtime: %s\n",
2979 LIBGNUTLS_VERSION,
2980 gnutls_check_version(NULL));
2981 }
2982
2983 /* vi: aw ai sw=2
2984 */
2985 /* End of tls-gnu.c */