8a133c5af6538ce57095b6aa4e78957c515a4f2d
[exim.git] / src / src / tls-gnu.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2012 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Copyright (c) Phil Pennock 2012 */
9
10 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
11 one of the available supported implementations. This file is #included into
12 tls.c when USE_GNUTLS has been set.
13
14 The code herein is a revamp of GnuTLS integration using the current APIs; the
15 original tls-gnu.c was based on a patch which was contributed by Nikos
16 Mavroyanopoulos. The revamp is partially a rewrite, partially cut&paste as
17 appropriate.
18
19 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20 which is not widely deployed by OS vendors. Will note issues below, which may
21 assist in updating the code in the future. Another sources of hints is
22 mod_gnutls for Apache (SNI callback registration and handling).
23
24 Keeping client and server variables more split than before and is currently
25 the norm, in anticipation of TLS in ACL callouts.
26
27 I wanted to switch to gnutls_certificate_set_verify_function() so that
28 certificate rejection could happen during handshake where it belongs, rather
29 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
31
32 (I wasn't looking for libraries quite that old, when updating to get rid of
33 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34 require current GnuTLS, then we'll drop support for the ancient libraries).
35 */
36
37 #include <gnutls/gnutls.h>
38 /* needed for cert checks in verification and DN extraction: */
39 #include <gnutls/x509.h>
40 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41 #include <gnutls/crypto.h>
42
43 /* GnuTLS 2 vs 3
44
45 GnuTLS 3 only:
46 gnutls_global_set_audit_log_function()
47
48 Changes:
49 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
50 */
51
52 /* Local static variables for GnuTLS */
53
54 /* Values for verify_requirement */
55
56 enum peer_verify_requirement { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED };
57
58 /* This holds most state for server or client; with this, we can set up an
59 outbound TLS-enabled connection in an ACL callout, while not stomping all
60 over the TLS variables available for expansion.
61
62 Some of these correspond to variables in globals.c; those variables will
63 be set to point to content in one of these instances, as appropriate for
64 the stage of the process lifetime.
65
66 Not handled here: global tls_channelbinding_b64. /*XXX JGH */
67 */
68
69 typedef struct exim_gnutls_state {
70 gnutls_session_t session;
71 gnutls_certificate_credentials_t x509_cred;
72 gnutls_priority_t priority_cache;
73 enum peer_verify_requirement verify_requirement;
74 int fd_in;
75 int fd_out;
76 BOOL peer_cert_verified;
77 BOOL trigger_sni_changes;
78 BOOL have_set_peerdn;
79 const struct host_item *host;
80 uschar *peerdn;
81 uschar *ciphersuite;
82 uschar *received_sni;
83
84 const uschar *tls_certificate;
85 const uschar *tls_privatekey;
86 const uschar *tls_sni; /* client send only, not received */
87 const uschar *tls_verify_certificates;
88 const uschar *tls_crl;
89 const uschar *tls_require_ciphers;
90 uschar *exp_tls_certificate;
91 uschar *exp_tls_privatekey;
92 uschar *exp_tls_sni;
93 uschar *exp_tls_verify_certificates;
94 uschar *exp_tls_crl;
95 uschar *exp_tls_require_ciphers;
96
97 tls_support *tlsp;
98
99 uschar *xfer_buffer;
100 int xfer_buffer_lwm;
101 int xfer_buffer_hwm;
102 int xfer_eof;
103 int xfer_error;
104 } exim_gnutls_state_st;
105
106 static const exim_gnutls_state_st exim_gnutls_state_init = {
107 NULL, NULL, NULL, VERIFY_NONE, -1, -1, FALSE, FALSE, FALSE,
108 NULL, NULL, NULL, NULL,
109 NULL, NULL, NULL, NULL, NULL, NULL,
110 NULL, NULL, NULL, NULL, NULL, NULL,
111 NULL,
112 NULL, 0, 0, 0, 0,
113 };
114
115 /* Not only do we have our own APIs which don't pass around state, assuming
116 it's held in globals, GnuTLS doesn't appear to let us register callback data
117 for callbacks, or as part of the session, so we have to keep a "this is the
118 context we're currently dealing with" pointer and rely upon being
119 single-threaded to keep from processing data on an inbound TLS connection while
120 talking to another TLS connection for an outbound check. This does mean that
121 there's no way for heart-beats to be responded to, for the duration of the
122 second connection. */
123
124 static exim_gnutls_state_st state_server, state_client;
125
126 /* dh_params are initialised once within the lifetime of a process using TLS;
127 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
128 don't want to repeat this. */
129
130 static gnutls_dh_params_t dh_server_params = NULL;
131
132 /* No idea how this value was chosen; preserving it. Default is 3600. */
133
134 static const int ssl_session_timeout = 200;
135
136 static const char * const exim_default_gnutls_priority = "NORMAL";
137
138 /* Guard library core initialisation */
139
140 static BOOL exim_gnutls_base_init_done = FALSE;
141
142
143 /* ------------------------------------------------------------------------ */
144 /* macros */
145
146 #define MAX_HOST_LEN 255
147
148 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
149 the library logging; a value less than 0 disables the calls to set up logging
150 callbacks. */
151 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
152 #define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
153 #endif
154
155 #ifndef EXIM_CLIENT_DH_MIN_BITS
156 #define EXIM_CLIENT_DH_MIN_BITS 1024
157 #endif
158
159 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
160 can ask for a bit-strength. Without that, we stick to the constant we had
161 before, for now. */
162 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
163 #define EXIM_SERVER_DH_BITS_PRE2_12 1024
164 #endif
165
166 #define exim_gnutls_err_check(Label) do { \
167 if (rc != GNUTLS_E_SUCCESS) { return tls_error((Label), gnutls_strerror(rc), host); } } while (0)
168
169 #define expand_check_tlsvar(Varname) expand_check(state->Varname, US #Varname, &state->exp_##Varname)
170
171 #if GNUTLS_VERSION_NUMBER >= 0x020c00
172 #define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
173 #define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
174 #define HAVE_GNUTLS_RND
175 #endif
176
177
178
179
180 /* ------------------------------------------------------------------------ */
181 /* Callback declarations */
182
183 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
184 static void exim_gnutls_logger_cb(int level, const char *message);
185 #endif
186
187 static int exim_sni_handling_cb(gnutls_session_t session);
188
189
190
191
192 /* ------------------------------------------------------------------------ */
193 /* Static functions */
194
195 /*************************************************
196 * Handle TLS error *
197 *************************************************/
198
199 /* Called from lots of places when errors occur before actually starting to do
200 the TLS handshake, that is, while the session is still in clear. Always returns
201 DEFER for a server and FAIL for a client so that most calls can use "return
202 tls_error(...)" to do this processing and then give an appropriate return. A
203 single function is used for both server and client, because it is called from
204 some shared functions.
205
206 Argument:
207 prefix text to include in the logged error
208 msg additional error string (may be NULL)
209 usually obtained from gnutls_strerror()
210 host NULL if setting up a server;
211 the connected host if setting up a client
212
213 Returns: OK/DEFER/FAIL
214 */
215
216 static int
217 tls_error(const uschar *prefix, const char *msg, const host_item *host)
218 {
219 if (host)
220 {
221 log_write(0, LOG_MAIN, "TLS error on connection to %s [%s] (%s)%s%s",
222 host->name, host->address, prefix, msg ? ": " : "", msg ? msg : "");
223 return FAIL;
224 }
225 else
226 {
227 uschar *conn_info = smtp_get_connection_info();
228 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
229 conn_info += 5;
230 log_write(0, LOG_MAIN, "TLS error on %s (%s)%s%s",
231 conn_info, prefix, msg ? ": " : "", msg ? msg : "");
232 return DEFER;
233 }
234 }
235
236
237
238
239 /*************************************************
240 * Deal with logging errors during I/O *
241 *************************************************/
242
243 /* We have to get the identity of the peer from saved data.
244
245 Argument:
246 state the current GnuTLS exim state container
247 rc the GnuTLS error code, or 0 if it's a local error
248 when text identifying read or write
249 text local error text when ec is 0
250
251 Returns: nothing
252 */
253
254 static void
255 record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
256 {
257 const char *msg;
258
259 if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
260 msg = CS string_sprintf("%s: %s", US gnutls_strerror(rc),
261 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
262 else
263 msg = gnutls_strerror(rc);
264
265 tls_error(when, msg, state->host);
266 }
267
268
269
270
271 /*************************************************
272 * Set various Exim expansion vars *
273 *************************************************/
274
275 /* We set various Exim global variables from the state, once a session has
276 been established. With TLS callouts, may need to change this to stack
277 variables, or just re-call it with the server state after client callout
278 has finished.
279
280 Make sure anything set here is inset in tls_getc().
281
282 Sets:
283 tls_active fd
284 tls_bits strength indicator
285 tls_certificate_verified bool indicator
286 tls_channelbinding_b64 for some SASL mechanisms
287 tls_cipher a string
288 tls_peerdn a string
289 tls_sni a (UTF-8) string
290
291 Argument:
292 state the relevant exim_gnutls_state_st *
293 */
294
295 static void
296 extract_exim_vars_from_tls_state(exim_gnutls_state_st *state, BOOL is_server)
297 {
298 gnutls_cipher_algorithm_t cipher;
299 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
300 int old_pool;
301 int rc;
302 gnutls_datum_t channel;
303 #endif
304
305 state->tlsp->active = state->fd_out;
306
307 cipher = gnutls_cipher_get(state->session);
308 /* returns size in "bytes" */
309 state->tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
310
311 state->tlsp->cipher = state->ciphersuite;
312
313 DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
314
315 state->tlsp->certificate_verified = state->peer_cert_verified;
316
317 /* note that tls_channelbinding_b64 is not saved to the spool file, since it's
318 only available for use for authenticators while this TLS session is running. */
319
320 tls_channelbinding_b64 = NULL;
321 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
322 channel.data = NULL;
323 channel.size = 0;
324 rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
325 if (rc) {
326 DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
327 } else {
328 old_pool = store_pool;
329 store_pool = POOL_PERM;
330 tls_channelbinding_b64 = auth_b64encode(channel.data, (int)channel.size);
331 store_pool = old_pool;
332 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
333 }
334 #endif
335
336 state->tlsp->peerdn = state->peerdn;
337 state->tlsp->sni = state->received_sni;
338 }
339
340
341
342
343 /*************************************************
344 * Setup up DH parameters *
345 *************************************************/
346
347 /* Generating the D-H parameters may take a long time. They only need to
348 be re-generated every so often, depending on security policy. What we do is to
349 keep these parameters in a file in the spool directory. If the file does not
350 exist, we generate them. This means that it is easy to cause a regeneration.
351
352 The new file is written as a temporary file and renamed, so that an incomplete
353 file is never present. If two processes both compute some new parameters, you
354 waste a bit of effort, but it doesn't seem worth messing around with locking to
355 prevent this.
356
357 Returns: OK/DEFER/FAIL
358 */
359
360 static int
361 init_server_dh(void)
362 {
363 int fd, rc;
364 unsigned int dh_bits;
365 gnutls_datum m;
366 uschar filename_buf[PATH_MAX];
367 uschar *filename = NULL;
368 size_t sz;
369 uschar *exp_tls_dhparam;
370 BOOL use_file_in_spool = FALSE;
371 BOOL use_fixed_file = FALSE;
372 host_item *host = NULL; /* dummy for macros */
373
374 DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
375
376 rc = gnutls_dh_params_init(&dh_server_params);
377 exim_gnutls_err_check(US"gnutls_dh_params_init");
378
379 m.data = NULL;
380 m.size = 0;
381
382 if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam))
383 return DEFER;
384
385 if (!exp_tls_dhparam)
386 {
387 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
388 m.data = US std_dh_prime_default();
389 m.size = Ustrlen(m.data);
390 }
391 else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
392 use_file_in_spool = TRUE;
393 else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
394 {
395 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
396 return OK;
397 }
398 else if (exp_tls_dhparam[0] != '/')
399 {
400 m.data = US std_dh_prime_named(exp_tls_dhparam);
401 if (m.data == NULL)
402 return tls_error(US"No standard prime named", CS exp_tls_dhparam, NULL);
403 m.size = Ustrlen(m.data);
404 }
405 else
406 {
407 use_fixed_file = TRUE;
408 filename = exp_tls_dhparam;
409 }
410
411 if (m.data)
412 {
413 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
414 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
415 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
416 return OK;
417 }
418
419 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
420 /* If you change this constant, also change dh_param_fn_ext so that we can use a
421 different filename and ensure we have sufficient bits. */
422 dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
423 if (!dh_bits)
424 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL);
425 DEBUG(D_tls)
426 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
427 dh_bits);
428 #else
429 dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
430 DEBUG(D_tls)
431 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
432 dh_bits);
433 #endif
434
435 /* Some clients have hard-coded limits. */
436 if (dh_bits > tls_dh_max_bits)
437 {
438 DEBUG(D_tls)
439 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
440 tls_dh_max_bits);
441 dh_bits = tls_dh_max_bits;
442 }
443
444 if (use_file_in_spool)
445 {
446 if (!string_format(filename_buf, sizeof(filename_buf),
447 "%s/gnutls-params-%d", spool_directory, dh_bits))
448 return tls_error(US"overlong filename", NULL, NULL);
449 filename = filename_buf;
450 }
451
452 /* Open the cache file for reading and if successful, read it and set up the
453 parameters. */
454
455 fd = Uopen(filename, O_RDONLY, 0);
456 if (fd >= 0)
457 {
458 struct stat statbuf;
459 FILE *fp;
460 int saved_errno;
461
462 if (fstat(fd, &statbuf) < 0) /* EIO */
463 {
464 saved_errno = errno;
465 (void)close(fd);
466 return tls_error(US"TLS cache stat failed", strerror(saved_errno), NULL);
467 }
468 if (!S_ISREG(statbuf.st_mode))
469 {
470 (void)close(fd);
471 return tls_error(US"TLS cache not a file", NULL, NULL);
472 }
473 fp = fdopen(fd, "rb");
474 if (!fp)
475 {
476 saved_errno = errno;
477 (void)close(fd);
478 return tls_error(US"fdopen(TLS cache stat fd) failed",
479 strerror(saved_errno), NULL);
480 }
481
482 m.size = statbuf.st_size;
483 m.data = malloc(m.size);
484 if (m.data == NULL)
485 {
486 fclose(fp);
487 return tls_error(US"malloc failed", strerror(errno), NULL);
488 }
489 sz = fread(m.data, m.size, 1, fp);
490 if (!sz)
491 {
492 saved_errno = errno;
493 fclose(fp);
494 free(m.data);
495 return tls_error(US"fread failed", strerror(saved_errno), NULL);
496 }
497 fclose(fp);
498
499 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
500 free(m.data);
501 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
502 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
503 }
504
505 /* If the file does not exist, fall through to compute new data and cache it.
506 If there was any other opening error, it is serious. */
507
508 else if (errno == ENOENT)
509 {
510 rc = -1;
511 DEBUG(D_tls)
512 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
513 }
514 else
515 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
516 NULL, NULL);
517
518 /* If ret < 0, either the cache file does not exist, or the data it contains
519 is not useful. One particular case of this is when upgrading from an older
520 release of Exim in which the data was stored in a different format. We don't
521 try to be clever and support both formats; we just regenerate new data in this
522 case. */
523
524 if (rc < 0)
525 {
526 uschar *temp_fn;
527 unsigned int dh_bits_gen = dh_bits;
528
529 if ((PATH_MAX - Ustrlen(filename)) < 10)
530 return tls_error(US"Filename too long to generate replacement",
531 CS filename, NULL);
532
533 temp_fn = string_copy(US "%s.XXXXXXX");
534 fd = mkstemp(CS temp_fn); /* modifies temp_fn */
535 if (fd < 0)
536 return tls_error(US"Unable to open temp file", strerror(errno), NULL);
537 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
538
539 /* GnuTLS overshoots!
540 * If we ask for 2236, we might get 2237 or more.
541 * But there's no way to ask GnuTLS how many bits there really are.
542 * We can ask how many bits were used in a TLS session, but that's it!
543 * The prime itself is hidden behind too much abstraction.
544 * So we ask for less, and proceed on a wing and a prayer.
545 * First attempt, subtracted 3 for 2233 and got 2240.
546 */
547 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
548 {
549 dh_bits_gen = dh_bits - 10;
550 DEBUG(D_tls)
551 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
552 dh_bits_gen);
553 }
554
555 DEBUG(D_tls)
556 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
557 dh_bits_gen);
558 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen);
559 exim_gnutls_err_check(US"gnutls_dh_params_generate2");
560
561 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
562 and I confirmed that a NULL call to get the size first is how the GnuTLS
563 sample apps handle this. */
564
565 sz = 0;
566 m.data = NULL;
567 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
568 m.data, &sz);
569 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
570 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3(NULL) sizing");
571 m.size = sz;
572 m.data = malloc(m.size);
573 if (m.data == NULL)
574 return tls_error(US"memory allocation failed", strerror(errno), NULL);
575 /* this will return a size 1 less than the allocation size above */
576 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
577 m.data, &sz);
578 if (rc != GNUTLS_E_SUCCESS)
579 {
580 free(m.data);
581 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3() real");
582 }
583 m.size = sz; /* shrink by 1, probably */
584
585 sz = write_to_fd_buf(fd, m.data, (size_t) m.size);
586 if (sz != m.size)
587 {
588 free(m.data);
589 return tls_error(US"TLS cache write D-H params failed",
590 strerror(errno), NULL);
591 }
592 free(m.data);
593 sz = write_to_fd_buf(fd, US"\n", 1);
594 if (sz != 1)
595 return tls_error(US"TLS cache write D-H params final newline failed",
596 strerror(errno), NULL);
597
598 rc = close(fd);
599 if (rc)
600 return tls_error(US"TLS cache write close() failed",
601 strerror(errno), NULL);
602
603 if (Urename(temp_fn, filename) < 0)
604 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
605 temp_fn, filename), strerror(errno), NULL);
606
607 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
608 }
609
610 DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
611 return OK;
612 }
613
614
615
616
617 /*************************************************
618 * Variables re-expanded post-SNI *
619 *************************************************/
620
621 /* Called from both server and client code, via tls_init(), and also from
622 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
623
624 We can tell the two apart by state->received_sni being non-NULL in callback.
625
626 The callback should not call us unless state->trigger_sni_changes is true,
627 which we are responsible for setting on the first pass through.
628
629 Arguments:
630 state exim_gnutls_state_st *
631
632 Returns: OK/DEFER/FAIL
633 */
634
635 static int
636 tls_expand_session_files(exim_gnutls_state_st *state)
637 {
638 struct stat statbuf;
639 int rc;
640 const host_item *host = state->host; /* macro should be reconsidered? */
641 uschar *saved_tls_certificate = NULL;
642 uschar *saved_tls_privatekey = NULL;
643 uschar *saved_tls_verify_certificates = NULL;
644 uschar *saved_tls_crl = NULL;
645 int cert_count;
646
647 /* We check for tls_sni *before* expansion. */
648 if (!state->host)
649 {
650 if (!state->received_sni)
651 {
652 if (state->tls_certificate && Ustrstr(state->tls_certificate, US"tls_sni"))
653 {
654 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
655 state->trigger_sni_changes = TRUE;
656 }
657 }
658 else
659 {
660 /* useful for debugging */
661 saved_tls_certificate = state->exp_tls_certificate;
662 saved_tls_privatekey = state->exp_tls_privatekey;
663 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
664 saved_tls_crl = state->exp_tls_crl;
665 }
666 }
667
668 rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
669 exim_gnutls_err_check(US"gnutls_certificate_allocate_credentials");
670
671 /* remember: expand_check_tlsvar() is expand_check() but fiddling with
672 state members, assuming consistent naming; and expand_check() returns
673 false if expansion failed, unless expansion was forced to fail. */
674
675 /* check if we at least have a certificate, before doing expensive
676 D-H generation. */
677
678 if (!expand_check_tlsvar(tls_certificate))
679 return DEFER;
680
681 /* certificate is mandatory in server, optional in client */
682
683 if ((state->exp_tls_certificate == NULL) ||
684 (*state->exp_tls_certificate == '\0'))
685 {
686 if (state->host == NULL)
687 return tls_error(US"no TLS server certificate is specified", NULL, NULL);
688 else
689 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
690 }
691
692 if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey))
693 return DEFER;
694
695 /* tls_privatekey is optional, defaulting to same file as certificate */
696
697 if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
698 {
699 state->tls_privatekey = state->tls_certificate;
700 state->exp_tls_privatekey = state->exp_tls_certificate;
701 }
702
703
704 if (state->exp_tls_certificate && *state->exp_tls_certificate)
705 {
706 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
707 state->exp_tls_certificate, state->exp_tls_privatekey);
708
709 if (state->received_sni)
710 {
711 if ((Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0) &&
712 (Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0))
713 {
714 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
715 }
716 else
717 {
718 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
719 }
720 }
721
722 rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
723 CS state->exp_tls_certificate, CS state->exp_tls_privatekey,
724 GNUTLS_X509_FMT_PEM);
725 exim_gnutls_err_check(
726 string_sprintf("cert/key setup: cert=%s key=%s",
727 state->exp_tls_certificate, state->exp_tls_privatekey));
728 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
729 } /* tls_certificate */
730
731 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
732 provided. Experiment shows that, if the certificate file is empty, an unhelpful
733 error message is provided. However, if we just refrain from setting anything up
734 in that case, certificate verification fails, which seems to be the correct
735 behaviour. */
736
737 if (state->tls_verify_certificates && *state->tls_verify_certificates)
738 {
739 if (!expand_check_tlsvar(tls_verify_certificates))
740 return DEFER;
741 if (state->tls_crl && *state->tls_crl)
742 if (!expand_check_tlsvar(tls_crl))
743 return DEFER;
744
745 if (!(state->exp_tls_verify_certificates &&
746 *state->exp_tls_verify_certificates))
747 {
748 DEBUG(D_tls)
749 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
750 /* With no tls_verify_certificates, we ignore tls_crl too */
751 return OK;
752 }
753 }
754 else
755 {
756 DEBUG(D_tls)
757 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
758 return OK;
759 }
760
761 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
762 {
763 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
764 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
765 strerror(errno));
766 return DEFER;
767 }
768
769 /* The test suite passes in /dev/null; we could check for that path explicitly,
770 but who knows if someone has some weird FIFO which always dumps some certs, or
771 other weirdness. The thing we really want to check is that it's not a
772 directory, since while OpenSSL supports that, GnuTLS does not.
773 So s/!S_ISREG/S_ISDIR/ and change some messsaging ... */
774 if (S_ISDIR(statbuf.st_mode))
775 {
776 DEBUG(D_tls)
777 debug_printf("verify certificates path is a dir: \"%s\"\n",
778 state->exp_tls_verify_certificates);
779 log_write(0, LOG_MAIN|LOG_PANIC,
780 "tls_verify_certificates \"%s\" is a directory",
781 state->exp_tls_verify_certificates);
782 return DEFER;
783 }
784
785 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
786 state->exp_tls_verify_certificates, statbuf.st_size);
787
788 if (statbuf.st_size == 0)
789 {
790 DEBUG(D_tls)
791 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
792 return OK;
793 }
794
795 cert_count = gnutls_certificate_set_x509_trust_file(state->x509_cred,
796 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
797 if (cert_count < 0)
798 {
799 rc = cert_count;
800 exim_gnutls_err_check(US"gnutls_certificate_set_x509_trust_file");
801 }
802 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
803
804 if (state->tls_crl && *state->tls_crl &&
805 state->exp_tls_crl && *state->exp_tls_crl)
806 {
807 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
808 cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
809 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
810 if (cert_count < 0)
811 {
812 rc = cert_count;
813 exim_gnutls_err_check(US"gnutls_certificate_set_x509_crl_file");
814 }
815 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
816 }
817
818 return OK;
819 }
820
821
822
823
824 /*************************************************
825 * Set X.509 state variables *
826 *************************************************/
827
828 /* In GnuTLS, the registered cert/key are not replaced by a later
829 set of a cert/key, so for SNI support we need a whole new x509_cred
830 structure. Which means various other non-re-expanded pieces of state
831 need to be re-set in the new struct, so the setting logic is pulled
832 out to this.
833
834 Arguments:
835 state exim_gnutls_state_st *
836
837 Returns: OK/DEFER/FAIL
838 */
839
840 static int
841 tls_set_remaining_x509(exim_gnutls_state_st *state)
842 {
843 int rc;
844 const host_item *host = state->host; /* macro should be reconsidered? */
845
846 /* Create D-H parameters, or read them from the cache file. This function does
847 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
848 client-side params. */
849
850 if (!state->host)
851 {
852 if (!dh_server_params)
853 {
854 rc = init_server_dh();
855 if (rc != OK) return rc;
856 }
857 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
858 }
859
860 /* Link the credentials to the session. */
861
862 rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
863 exim_gnutls_err_check(US"gnutls_credentials_set");
864
865 return OK;
866 }
867
868 /*************************************************
869 * Initialize for GnuTLS *
870 *************************************************/
871
872 /* Called from both server and client code. In the case of a server, errors
873 before actual TLS negotiation return DEFER.
874
875 Arguments:
876 host connected host, if client; NULL if server
877 certificate certificate file
878 privatekey private key file
879 sni TLS SNI to send, sometimes when client; else NULL
880 cas CA certs file
881 crl CRL file
882 require_ciphers tls_require_ciphers setting
883 caller_state returned state-info structure
884
885 Returns: OK/DEFER/FAIL
886 */
887
888 static int
889 tls_init(
890 const host_item *host,
891 const uschar *certificate,
892 const uschar *privatekey,
893 const uschar *sni,
894 const uschar *cas,
895 const uschar *crl,
896 const uschar *require_ciphers,
897 exim_gnutls_state_st **caller_state)
898 {
899 exim_gnutls_state_st *state;
900 int rc;
901 size_t sz;
902 const char *errpos;
903 uschar *p;
904 BOOL want_default_priorities;
905
906 if (!exim_gnutls_base_init_done)
907 {
908 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
909
910 rc = gnutls_global_init();
911 exim_gnutls_err_check(US"gnutls_global_init");
912
913 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
914 DEBUG(D_tls)
915 {
916 gnutls_global_set_log_function(exim_gnutls_logger_cb);
917 /* arbitrarily chosen level; bump upto 9 for more */
918 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
919 }
920 #endif
921
922 exim_gnutls_base_init_done = TRUE;
923 }
924
925 if (host)
926 {
927 state = &state_client;
928 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
929 state->tlsp = &tls_out;
930 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
931 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
932 }
933 else
934 {
935 state = &state_server;
936 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
937 state->tlsp = &tls_in;
938 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
939 rc = gnutls_init(&state->session, GNUTLS_SERVER);
940 }
941 exim_gnutls_err_check(US"gnutls_init");
942
943 state->host = host;
944
945 state->tls_certificate = certificate;
946 state->tls_privatekey = privatekey;
947 state->tls_require_ciphers = require_ciphers;
948 state->tls_sni = sni;
949 state->tls_verify_certificates = cas;
950 state->tls_crl = crl;
951
952 /* This handles the variables that might get re-expanded after TLS SNI;
953 that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
954
955 DEBUG(D_tls)
956 debug_printf("Expanding various TLS configuration options for session credentials.\n");
957 rc = tls_expand_session_files(state);
958 if (rc != OK) return rc;
959
960 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
961 requires a new structure afterwards. */
962
963 rc = tls_set_remaining_x509(state);
964 if (rc != OK) return rc;
965
966 /* set SNI in client, only */
967 if (host)
968 {
969 if (!expand_check_tlsvar(state->tlsp->sni))
970 return DEFER;
971 if (state->exp_tls_sni && *state->exp_tls_sni)
972 {
973 DEBUG(D_tls)
974 debug_printf("Setting TLS client SNI to \"%s\"\n", state->exp_tls_sni);
975 sz = Ustrlen(state->exp_tls_sni);
976 rc = gnutls_server_name_set(state->session,
977 GNUTLS_NAME_DNS, state->exp_tls_sni, sz);
978 exim_gnutls_err_check(US"gnutls_server_name_set");
979 }
980 }
981 else if (state->tls_sni)
982 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
983 "have an SNI set for a client [%s]\n", state->tls_sni);
984
985 /* This is the priority string support,
986 http://www.gnu.org/software/gnutls/manual/html_node/Priority-Strings.html
987 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
988 This was backwards incompatible, but means Exim no longer needs to track
989 all algorithms and provide string forms for them. */
990
991 want_default_priorities = TRUE;
992
993 if (state->tls_require_ciphers && *state->tls_require_ciphers)
994 {
995 if (!expand_check_tlsvar(tls_require_ciphers))
996 return DEFER;
997 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
998 {
999 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
1000 state->exp_tls_require_ciphers);
1001
1002 rc = gnutls_priority_init(&state->priority_cache,
1003 CS state->exp_tls_require_ciphers, &errpos);
1004 want_default_priorities = FALSE;
1005 p = state->exp_tls_require_ciphers;
1006 }
1007 }
1008 if (want_default_priorities)
1009 {
1010 DEBUG(D_tls)
1011 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
1012 exim_default_gnutls_priority);
1013 rc = gnutls_priority_init(&state->priority_cache,
1014 exim_default_gnutls_priority, &errpos);
1015 p = US exim_default_gnutls_priority;
1016 }
1017
1018 exim_gnutls_err_check(string_sprintf(
1019 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1020 p, errpos - CS p, errpos));
1021
1022 rc = gnutls_priority_set(state->session, state->priority_cache);
1023 exim_gnutls_err_check(US"gnutls_priority_set");
1024
1025 gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1026
1027 /* Reduce security in favour of increased compatibility, if the admin
1028 decides to make that trade-off. */
1029 if (gnutls_compat_mode)
1030 {
1031 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1032 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1033 gnutls_session_enable_compatibility_mode(state->session);
1034 #else
1035 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1036 #endif
1037 }
1038
1039 *caller_state = state;
1040 return OK;
1041 }
1042
1043
1044
1045
1046 /*************************************************
1047 * Extract peer information *
1048 *************************************************/
1049
1050 /* Called from both server and client code.
1051 Only this is allowed to set state->peerdn and state->have_set_peerdn
1052 and we use that to detect double-calls.
1053
1054 NOTE: the state blocks last while the TLS connection is up, which is fine
1055 for logging in the server side, but for the client side, we log after teardown
1056 in src/deliver.c. While the session is up, we can twist about states and
1057 repoint tls_* globals, but those variables used for logging or other variable
1058 expansion that happens _after_ delivery need to have a longer life-time.
1059
1060 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1061 doing this more than once per generation of a state context. We set them in
1062 the state context, and repoint tls_* to them. After the state goes away, the
1063 tls_* copies of the pointers remain valid and client delivery logging is happy.
1064
1065 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1066 don't apply.
1067
1068 Arguments:
1069 state exim_gnutls_state_st *
1070
1071 Returns: OK/DEFER/FAIL
1072 */
1073
1074 static int
1075 peer_status(exim_gnutls_state_st *state)
1076 {
1077 uschar cipherbuf[256];
1078 const gnutls_datum *cert_list;
1079 int old_pool, rc;
1080 unsigned int cert_list_size = 0;
1081 gnutls_protocol_t protocol;
1082 gnutls_cipher_algorithm_t cipher;
1083 gnutls_kx_algorithm_t kx;
1084 gnutls_mac_algorithm_t mac;
1085 gnutls_certificate_type_t ct;
1086 gnutls_x509_crt_t crt;
1087 uschar *p, *dn_buf;
1088 size_t sz;
1089
1090 if (state->have_set_peerdn)
1091 return OK;
1092 state->have_set_peerdn = TRUE;
1093
1094 state->peerdn = NULL;
1095
1096 /* tls_cipher */
1097 cipher = gnutls_cipher_get(state->session);
1098 protocol = gnutls_protocol_get_version(state->session);
1099 mac = gnutls_mac_get(state->session);
1100 kx = gnutls_kx_get(state->session);
1101
1102 string_format(cipherbuf, sizeof(cipherbuf),
1103 "%s:%s:%d",
1104 gnutls_protocol_get_name(protocol),
1105 gnutls_cipher_suite_get_name(kx, cipher, mac),
1106 (int) gnutls_cipher_get_key_size(cipher) * 8);
1107
1108 /* I don't see a way that spaces could occur, in the current GnuTLS
1109 code base, but it was a concern in the old code and perhaps older GnuTLS
1110 releases did return "TLS 1.0"; play it safe, just in case. */
1111 for (p = cipherbuf; *p != '\0'; ++p)
1112 if (isspace(*p))
1113 *p = '-';
1114 old_pool = store_pool;
1115 store_pool = POOL_PERM;
1116 state->ciphersuite = string_copy(cipherbuf);
1117 store_pool = old_pool;
1118 state->tlsp->cipher = state->ciphersuite;
1119
1120 /* tls_peerdn */
1121 cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
1122
1123 if (cert_list == NULL || cert_list_size == 0)
1124 {
1125 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1126 cert_list, cert_list_size);
1127 if (state->verify_requirement == VERIFY_REQUIRED)
1128 return tls_error(US"certificate verification failed",
1129 "no certificate received from peer", state->host);
1130 return OK;
1131 }
1132
1133 ct = gnutls_certificate_type_get(state->session);
1134 if (ct != GNUTLS_CRT_X509)
1135 {
1136 const char *ctn = gnutls_certificate_type_get_name(ct);
1137 DEBUG(D_tls)
1138 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
1139 if (state->verify_requirement == VERIFY_REQUIRED)
1140 return tls_error(US"certificate verification not possible, unhandled type",
1141 ctn, state->host);
1142 return OK;
1143 }
1144
1145 #define exim_gnutls_peer_err(Label) do { \
1146 if (rc != GNUTLS_E_SUCCESS) { \
1147 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", (Label), gnutls_strerror(rc)); \
1148 if (state->verify_requirement == VERIFY_REQUIRED) { return tls_error((Label), gnutls_strerror(rc), state->host); } \
1149 return OK; } } while (0)
1150
1151 rc = gnutls_x509_crt_init(&crt);
1152 exim_gnutls_peer_err(US"gnutls_x509_crt_init (crt)");
1153
1154 rc = gnutls_x509_crt_import(crt, &cert_list[0], GNUTLS_X509_FMT_DER);
1155 exim_gnutls_peer_err(US"failed to import certificate [gnutls_x509_crt_import(cert 0)]");
1156 sz = 0;
1157 rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1158 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
1159 {
1160 exim_gnutls_peer_err(US"getting size for cert DN failed");
1161 return FAIL; /* should not happen */
1162 }
1163 dn_buf = store_get_perm(sz);
1164 rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1165 exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1166 state->peerdn = dn_buf;
1167
1168 return OK;
1169 #undef exim_gnutls_peer_err
1170 }
1171
1172
1173
1174
1175 /*************************************************
1176 * Verify peer certificate *
1177 *************************************************/
1178
1179 /* Called from both server and client code.
1180 *Should* be using a callback registered with
1181 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1182 the peer information, but that's too new for some OSes.
1183
1184 Arguments:
1185 state exim_gnutls_state_st *
1186 error where to put an error message
1187
1188 Returns:
1189 FALSE if the session should be rejected
1190 TRUE if the cert is okay or we just don't care
1191 */
1192
1193 static BOOL
1194 verify_certificate(exim_gnutls_state_st *state, const char **error)
1195 {
1196 int rc;
1197 unsigned int verify;
1198
1199 *error = NULL;
1200
1201 rc = peer_status(state);
1202 if (rc != OK)
1203 {
1204 verify = GNUTLS_CERT_INVALID;
1205 *error = "not supplied";
1206 }
1207 else
1208 {
1209 rc = gnutls_certificate_verify_peers2(state->session, &verify);
1210 }
1211
1212 /* Handle the result of verification. INVALID seems to be set as well
1213 as REVOKED, but leave the test for both. */
1214
1215 if ((rc < 0) || (verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED)) != 0)
1216 {
1217 state->peer_cert_verified = FALSE;
1218 if (*error == NULL)
1219 *error = ((verify & GNUTLS_CERT_REVOKED) != 0) ? "revoked" : "invalid";
1220
1221 DEBUG(D_tls)
1222 debug_printf("TLS certificate verification failed (%s): peerdn=%s\n",
1223 *error, state->peerdn ? state->peerdn : US"<unset>");
1224
1225 if (state->verify_requirement == VERIFY_REQUIRED)
1226 {
1227 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1228 return FALSE;
1229 }
1230 DEBUG(D_tls)
1231 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
1232 }
1233 else
1234 {
1235 state->peer_cert_verified = TRUE;
1236 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=%s\n",
1237 state->peerdn ? state->peerdn : US"<unset>");
1238 }
1239
1240 state->tlsp->peerdn = state->peerdn;
1241
1242 return TRUE;
1243 }
1244
1245
1246
1247
1248 /* ------------------------------------------------------------------------ */
1249 /* Callbacks */
1250
1251 /* Logging function which can be registered with
1252 * gnutls_global_set_log_function()
1253 * gnutls_global_set_log_level() 0..9
1254 */
1255 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1256 static void
1257 exim_gnutls_logger_cb(int level, const char *message)
1258 {
1259 size_t len = strlen(message);
1260 if (len < 1)
1261 {
1262 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1263 return;
1264 }
1265 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1266 message[len-1] == '\n' ? "" : "\n");
1267 }
1268 #endif
1269
1270
1271 /* Called after client hello, should handle SNI work.
1272 This will always set tls_sni (state->received_sni) if available,
1273 and may trigger presenting different certificates,
1274 if state->trigger_sni_changes is TRUE.
1275
1276 Should be registered with
1277 gnutls_handshake_set_post_client_hello_function()
1278
1279 "This callback must return 0 on success or a gnutls error code to terminate the
1280 handshake.".
1281
1282 For inability to get SNI information, we return 0.
1283 We only return non-zero if re-setup failed.
1284 Only used for server-side TLS.
1285 */
1286
1287 static int
1288 exim_sni_handling_cb(gnutls_session_t session)
1289 {
1290 char sni_name[MAX_HOST_LEN];
1291 size_t data_len = MAX_HOST_LEN;
1292 exim_gnutls_state_st *state = &state_server;
1293 unsigned int sni_type;
1294 int rc, old_pool;
1295
1296 rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
1297 if (rc != GNUTLS_E_SUCCESS)
1298 {
1299 DEBUG(D_tls) {
1300 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1301 debug_printf("TLS: no SNI presented in handshake.\n");
1302 else
1303 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1304 gnutls_strerror(rc), rc);
1305 };
1306 return 0;
1307 }
1308
1309 if (sni_type != GNUTLS_NAME_DNS)
1310 {
1311 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1312 return 0;
1313 }
1314
1315 /* We now have a UTF-8 string in sni_name */
1316 old_pool = store_pool;
1317 store_pool = POOL_PERM;
1318 state->received_sni = string_copyn(US sni_name, data_len);
1319 store_pool = old_pool;
1320
1321 /* We set this one now so that variable expansions below will work */
1322 state->tlsp->sni = state->received_sni;
1323
1324 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1325 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1326
1327 if (!state->trigger_sni_changes)
1328 return 0;
1329
1330 rc = tls_expand_session_files(state);
1331 if (rc != OK)
1332 {
1333 /* If the setup of certs/etc failed before handshake, TLS would not have
1334 been offered. The best we can do now is abort. */
1335 return GNUTLS_E_APPLICATION_ERROR_MIN;
1336 }
1337
1338 rc = tls_set_remaining_x509(state);
1339 if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1340
1341 return 0;
1342 }
1343
1344
1345
1346
1347 /* ------------------------------------------------------------------------ */
1348 /* Exported functions */
1349
1350
1351
1352
1353 /*************************************************
1354 * Start a TLS session in a server *
1355 *************************************************/
1356
1357 /* This is called when Exim is running as a server, after having received
1358 the STARTTLS command. It must respond to that command, and then negotiate
1359 a TLS session.
1360
1361 Arguments:
1362 require_ciphers list of allowed ciphers or NULL
1363
1364 Returns: OK on success
1365 DEFER for errors before the start of the negotiation
1366 FAIL for errors during the negotation; the server can't
1367 continue running.
1368 */
1369
1370 int
1371 tls_server_start(const uschar *require_ciphers)
1372 {
1373 int rc;
1374 const char *error;
1375 exim_gnutls_state_st *state = NULL;
1376
1377 /* Check for previous activation */
1378 if (tls_in.active >= 0)
1379 {
1380 tls_error(US"STARTTLS received after TLS started", "", NULL);
1381 smtp_printf("554 Already in TLS\r\n");
1382 return FAIL;
1383 }
1384
1385 /* Initialize the library. If it fails, it will already have logged the error
1386 and sent an SMTP response. */
1387
1388 DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
1389
1390 rc = tls_init(NULL, tls_certificate, tls_privatekey,
1391 NULL, tls_verify_certificates, tls_crl,
1392 require_ciphers, &state);
1393 if (rc != OK) return rc;
1394
1395 /* If this is a host for which certificate verification is mandatory or
1396 optional, set up appropriately. */
1397
1398 if (verify_check_host(&tls_verify_hosts) == OK)
1399 {
1400 DEBUG(D_tls) debug_printf("TLS: a client certificate will be required.\n");
1401 state->verify_requirement = VERIFY_REQUIRED;
1402 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1403 }
1404 else if (verify_check_host(&tls_try_verify_hosts) == OK)
1405 {
1406 DEBUG(D_tls) debug_printf("TLS: a client certificate will be requested but not required.\n");
1407 state->verify_requirement = VERIFY_OPTIONAL;
1408 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1409 }
1410 else
1411 {
1412 DEBUG(D_tls) debug_printf("TLS: a client certificate will not be requested.\n");
1413 state->verify_requirement = VERIFY_NONE;
1414 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
1415 }
1416
1417 /* Register SNI handling; always, even if not in tls_certificate, so that the
1418 expansion variable $tls_sni is always available. */
1419
1420 gnutls_handshake_set_post_client_hello_function(state->session,
1421 exim_sni_handling_cb);
1422
1423 /* Set context and tell client to go ahead, except in the case of TLS startup
1424 on connection, where outputting anything now upsets the clients and tends to
1425 make them disconnect. We need to have an explicit fflush() here, to force out
1426 the response. Other smtp_printf() calls do not need it, because in non-TLS
1427 mode, the fflush() happens when smtp_getc() is called. */
1428
1429 if (!state->tlsp->on_connect)
1430 {
1431 smtp_printf("220 TLS go ahead\r\n");
1432 fflush(smtp_out); /*XXX JGH */
1433 }
1434
1435 /* Now negotiate the TLS session. We put our own timer on it, since it seems
1436 that the GnuTLS library doesn't. */
1437
1438 gnutls_transport_set_ptr2(state->session,
1439 (gnutls_transport_ptr)fileno(smtp_in),
1440 (gnutls_transport_ptr)fileno(smtp_out));
1441 state->fd_in = fileno(smtp_in);
1442 state->fd_out = fileno(smtp_out);
1443
1444 sigalrm_seen = FALSE;
1445 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1446 do
1447 {
1448 rc = gnutls_handshake(state->session);
1449 } while ((rc == GNUTLS_E_AGAIN) ||
1450 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
1451 alarm(0);
1452
1453 if (rc != GNUTLS_E_SUCCESS)
1454 {
1455 tls_error(US"gnutls_handshake",
1456 sigalrm_seen ? "timed out" : gnutls_strerror(rc), NULL);
1457 /* It seems that, except in the case of a timeout, we have to close the
1458 connection right here; otherwise if the other end is running OpenSSL it hangs
1459 until the server times out. */
1460
1461 if (!sigalrm_seen)
1462 {
1463 (void)fclose(smtp_out);
1464 (void)fclose(smtp_in);
1465 }
1466
1467 return FAIL;
1468 }
1469
1470 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1471
1472 /* Verify after the fact */
1473
1474 if (state->verify_requirement != VERIFY_NONE)
1475 {
1476 if (!verify_certificate(state, &error))
1477 {
1478 if (state->verify_requirement == VERIFY_OPTIONAL)
1479 {
1480 DEBUG(D_tls)
1481 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
1482 error);
1483 }
1484 else
1485 {
1486 tls_error(US"certificate verification failed", error, NULL);
1487 return FAIL;
1488 }
1489 }
1490 }
1491
1492 /* Figure out peer DN, and if authenticated, etc. */
1493
1494 rc = peer_status(state);
1495 if (rc != OK) return rc;
1496
1497 /* Sets various Exim expansion variables; always safe within server */
1498
1499 extract_exim_vars_from_tls_state(state, TRUE);
1500
1501 /* TLS has been set up. Adjust the input functions to read via TLS,
1502 and initialize appropriately. */
1503
1504 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
1505
1506 receive_getc = tls_getc;
1507 receive_ungetc = tls_ungetc;
1508 receive_feof = tls_feof;
1509 receive_ferror = tls_ferror;
1510 receive_smtp_buffered = tls_smtp_buffered;
1511
1512 return OK;
1513 }
1514
1515
1516
1517
1518 /*************************************************
1519 * Start a TLS session in a client *
1520 *************************************************/
1521
1522 /* Called from the smtp transport after STARTTLS has been accepted.
1523
1524 Arguments:
1525 fd the fd of the connection
1526 host connected host (for messages)
1527 addr the first address (not used)
1528 dhparam DH parameter file (ignored, we're a client)
1529 certificate certificate file
1530 privatekey private key file
1531 sni TLS SNI to send to remote host
1532 verify_certs file for certificate verify
1533 verify_crl CRL for verify
1534 require_ciphers list of allowed ciphers or NULL
1535 dh_min_bits minimum number of bits acceptable in server's DH prime
1536 timeout startup timeout
1537
1538 Returns: OK/DEFER/FAIL (because using common functions),
1539 but for a client, DEFER and FAIL have the same meaning
1540 */
1541
1542 int
1543 tls_client_start(int fd, host_item *host,
1544 address_item *addr ARG_UNUSED, uschar *dhparam ARG_UNUSED,
1545 uschar *certificate, uschar *privatekey, uschar *sni,
1546 uschar *verify_certs, uschar *verify_crl,
1547 uschar *require_ciphers, int dh_min_bits, int timeout)
1548 {
1549 int rc;
1550 const char *error;
1551 exim_gnutls_state_st *state = NULL;
1552
1553 DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
1554
1555 rc = tls_init(host, certificate, privatekey,
1556 sni, verify_certs, verify_crl, require_ciphers, &state);
1557 if (rc != OK) return rc;
1558
1559 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
1560 {
1561 DEBUG(D_tls)
1562 debug_printf("WARNING: tls_dh_min_bits far too low, clamping %d up to %d\n",
1563 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
1564 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
1565 }
1566
1567 DEBUG(D_tls) debug_printf("Setting D-H prime minimum acceptable bits to %d\n",
1568 dh_min_bits);
1569 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
1570
1571 if (verify_certs == NULL)
1572 {
1573 DEBUG(D_tls) debug_printf("TLS: server certificate verification not required\n");
1574 state->verify_requirement = VERIFY_NONE;
1575 /* we still ask for it, to log it, etc */
1576 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1577 }
1578 else
1579 {
1580 DEBUG(D_tls) debug_printf("TLS: server certificate verification required\n");
1581 state->verify_requirement = VERIFY_REQUIRED;
1582 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1583 }
1584
1585 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr)fd);
1586 state->fd_in = fd;
1587 state->fd_out = fd;
1588
1589 /* There doesn't seem to be a built-in timeout on connection. */
1590
1591 sigalrm_seen = FALSE;
1592 alarm(timeout);
1593 do
1594 {
1595 rc = gnutls_handshake(state->session);
1596 } while ((rc == GNUTLS_E_AGAIN) ||
1597 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
1598 alarm(0);
1599
1600 if (rc != GNUTLS_E_SUCCESS)
1601 return tls_error(US"gnutls_handshake",
1602 sigalrm_seen ? "timed out" : gnutls_strerror(rc), state->host);
1603
1604 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1605
1606 /* Verify late */
1607
1608 if (state->verify_requirement != VERIFY_NONE &&
1609 !verify_certificate(state, &error))
1610 return tls_error(US"certificate verification failed", error, state->host);
1611
1612 /* Figure out peer DN, and if authenticated, etc. */
1613
1614 rc = peer_status(state);
1615 if (rc != OK) return rc;
1616
1617 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
1618
1619 extract_exim_vars_from_tls_state(state, FALSE);
1620
1621 return OK;
1622 }
1623
1624
1625
1626
1627 /*************************************************
1628 * Close down a TLS session *
1629 *************************************************/
1630
1631 /* This is also called from within a delivery subprocess forked from the
1632 daemon, to shut down the TLS library, without actually doing a shutdown (which
1633 would tamper with the TLS session in the parent process).
1634
1635 Arguments: TRUE if gnutls_bye is to be called
1636 Returns: nothing
1637 */
1638
1639 void
1640 tls_close(BOOL is_server, BOOL shutdown)
1641 {
1642 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
1643
1644 if (state->tlsp->active < 0) return; /* TLS was not active */
1645
1646 if (shutdown)
1647 {
1648 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS\n");
1649 gnutls_bye(state->session, GNUTLS_SHUT_WR);
1650 }
1651
1652 gnutls_deinit(state->session);
1653
1654 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1655
1656 if ((state_server.session == NULL) && (state_client.session == NULL))
1657 {
1658 gnutls_global_deinit();
1659 exim_gnutls_base_init_done = FALSE;
1660 }
1661
1662 state->tlsp->active = -1;
1663 }
1664
1665
1666
1667
1668 /*************************************************
1669 * TLS version of getc *
1670 *************************************************/
1671
1672 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
1673 it refills the buffer via the GnuTLS reading function.
1674 Only used by the server-side TLS.
1675
1676 This feeds DKIM and should be used for all message-body reads.
1677
1678 Arguments: none
1679 Returns: the next character or EOF
1680 */
1681
1682 int
1683 tls_getc(void)
1684 {
1685 exim_gnutls_state_st *state = &state_server;
1686 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
1687 {
1688 ssize_t inbytes;
1689
1690 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
1691 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
1692
1693 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1694 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
1695 ssl_xfer_buffer_size);
1696 alarm(0);
1697
1698 /* A zero-byte return appears to mean that the TLS session has been
1699 closed down, not that the socket itself has been closed down. Revert to
1700 non-TLS handling. */
1701
1702 if (inbytes == 0)
1703 {
1704 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
1705
1706 receive_getc = smtp_getc;
1707 receive_ungetc = smtp_ungetc;
1708 receive_feof = smtp_feof;
1709 receive_ferror = smtp_ferror;
1710 receive_smtp_buffered = smtp_buffered;
1711
1712 gnutls_deinit(state->session);
1713 state->session = NULL;
1714 state->tlsp->active = -1;
1715 state->tlsp->bits = 0;
1716 state->tlsp->certificate_verified = FALSE;
1717 tls_channelbinding_b64 = NULL; /*XXX JGH */
1718 state->tlsp->cipher = NULL;
1719 state->tlsp->peerdn = NULL;
1720
1721 return smtp_getc();
1722 }
1723
1724 /* Handle genuine errors */
1725
1726 else if (inbytes < 0)
1727 {
1728 record_io_error(state, (int) inbytes, US"recv", NULL);
1729 state->xfer_error = 1;
1730 return EOF;
1731 }
1732 #ifndef DISABLE_DKIM
1733 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
1734 #endif
1735 state->xfer_buffer_hwm = (int) inbytes;
1736 state->xfer_buffer_lwm = 0;
1737 }
1738
1739 /* Something in the buffer; return next uschar */
1740
1741 return state->xfer_buffer[state->xfer_buffer_lwm++];
1742 }
1743
1744
1745
1746
1747 /*************************************************
1748 * Read bytes from TLS channel *
1749 *************************************************/
1750
1751 /* This does not feed DKIM, so if the caller uses this for reading message body,
1752 then the caller must feed DKIM.
1753
1754 Arguments:
1755 buff buffer of data
1756 len size of buffer
1757
1758 Returns: the number of bytes read
1759 -1 after a failed read
1760 */
1761
1762 int
1763 tls_read(BOOL is_server, uschar *buff, size_t len)
1764 {
1765 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
1766 ssize_t inbytes;
1767
1768 if (len > INT_MAX)
1769 len = INT_MAX;
1770
1771 if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
1772 DEBUG(D_tls)
1773 debug_printf("*** PROBABLY A BUG *** " \
1774 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
1775 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
1776
1777 DEBUG(D_tls)
1778 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
1779 state->session, buff, len);
1780
1781 inbytes = gnutls_record_recv(state->session, buff, len);
1782 if (inbytes > 0) return inbytes;
1783 if (inbytes == 0)
1784 {
1785 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
1786 }
1787 else record_io_error(state, (int)inbytes, US"recv", NULL);
1788
1789 return -1;
1790 }
1791
1792
1793
1794
1795 /*************************************************
1796 * Write bytes down TLS channel *
1797 *************************************************/
1798
1799 /*
1800 Arguments:
1801 is_server channel specifier
1802 buff buffer of data
1803 len number of bytes
1804
1805 Returns: the number of bytes after a successful write,
1806 -1 after a failed write
1807 */
1808
1809 int
1810 tls_write(BOOL is_server, const uschar *buff, size_t len)
1811 {
1812 ssize_t outbytes;
1813 size_t left = len;
1814 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
1815
1816 DEBUG(D_tls) debug_printf("tls_do_write(%p, " SIZE_T_FMT ")\n", buff, left);
1817 while (left > 0)
1818 {
1819 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
1820 buff, left);
1821 outbytes = gnutls_record_send(state->session, buff, left);
1822
1823 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
1824 if (outbytes < 0)
1825 {
1826 record_io_error(state, outbytes, US"send", NULL);
1827 return -1;
1828 }
1829 if (outbytes == 0)
1830 {
1831 record_io_error(state, 0, US"send", US"TLS channel closed on write");
1832 return -1;
1833 }
1834
1835 left -= outbytes;
1836 buff += outbytes;
1837 }
1838
1839 if (len > INT_MAX)
1840 {
1841 DEBUG(D_tls)
1842 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
1843 len);
1844 len = INT_MAX;
1845 }
1846
1847 return (int) len;
1848 }
1849
1850
1851
1852
1853 /*************************************************
1854 * Random number generation *
1855 *************************************************/
1856
1857 /* Pseudo-random number generation. The result is not expected to be
1858 cryptographically strong but not so weak that someone will shoot themselves
1859 in the foot using it as a nonce in input in some email header scheme or
1860 whatever weirdness they'll twist this into. The result should handle fork()
1861 and avoid repeating sequences. OpenSSL handles that for us.
1862
1863 Arguments:
1864 max range maximum
1865 Returns a random number in range [0, max-1]
1866 */
1867
1868 #ifdef HAVE_GNUTLS_RND
1869 int
1870 vaguely_random_number(int max)
1871 {
1872 unsigned int r;
1873 int i, needed_len;
1874 uschar *p;
1875 uschar smallbuf[sizeof(r)];
1876
1877 if (max <= 1)
1878 return 0;
1879
1880 needed_len = sizeof(r);
1881 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
1882 * asked for a number less than 10. */
1883 for (r = max, i = 0; r; ++i)
1884 r >>= 1;
1885 i = (i + 7) / 8;
1886 if (i < needed_len)
1887 needed_len = i;
1888
1889 i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
1890 if (i < 0)
1891 {
1892 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
1893 return vaguely_random_number_fallback(max);
1894 }
1895 r = 0;
1896 for (p = smallbuf; needed_len; --needed_len, ++p)
1897 {
1898 r *= 256;
1899 r += *p;
1900 }
1901
1902 /* We don't particularly care about weighted results; if someone wants
1903 * smooth distribution and cares enough then they should submit a patch then. */
1904 return r % max;
1905 }
1906 #else /* HAVE_GNUTLS_RND */
1907 int
1908 vaguely_random_number(int max)
1909 {
1910 return vaguely_random_number_fallback(max);
1911 }
1912 #endif /* HAVE_GNUTLS_RND */
1913
1914
1915
1916
1917 /*************************************************
1918 * Let tls_require_ciphers be checked at startup *
1919 *************************************************/
1920
1921 /* The tls_require_ciphers option, if set, must be something which the
1922 library can parse.
1923
1924 Returns: NULL on success, or error message
1925 */
1926
1927 uschar *
1928 tls_validate_require_cipher(void)
1929 {
1930 int rc;
1931 uschar *expciphers = NULL;
1932 gnutls_priority_t priority_cache;
1933 const char *errpos;
1934
1935 #define validate_check_rc(Label) do { \
1936 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
1937 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
1938 #define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
1939
1940 if (exim_gnutls_base_init_done)
1941 log_write(0, LOG_MAIN|LOG_PANIC,
1942 "already initialised GnuTLS, Exim developer bug");
1943
1944 rc = gnutls_global_init();
1945 validate_check_rc(US"gnutls_global_init()");
1946 exim_gnutls_base_init_done = TRUE;
1947
1948 if (!(tls_require_ciphers && *tls_require_ciphers))
1949 return_deinit(NULL);
1950
1951 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
1952 return_deinit(US"failed to expand tls_require_ciphers");
1953
1954 if (!(expciphers && *expciphers))
1955 return_deinit(NULL);
1956
1957 DEBUG(D_tls)
1958 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
1959
1960 rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
1961 validate_check_rc(string_sprintf(
1962 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
1963 expciphers, errpos - CS expciphers, errpos));
1964
1965 #undef return_deinit
1966 #undef validate_check_rc
1967 gnutls_global_deinit();
1968
1969 return NULL;
1970 }
1971
1972
1973
1974
1975 /*************************************************
1976 * Report the library versions. *
1977 *************************************************/
1978
1979 /* See a description in tls-openssl.c for an explanation of why this exists.
1980
1981 Arguments: a FILE* to print the results to
1982 Returns: nothing
1983 */
1984
1985 void
1986 tls_version_report(FILE *f)
1987 {
1988 fprintf(f, "Library version: GnuTLS: Compile: %s\n"
1989 " Runtime: %s\n",
1990 LIBGNUTLS_VERSION,
1991 gnutls_check_version(NULL));
1992 }
1993
1994 /* End of tls-gnu.c */