bceb5739563bf35a7699dca3d7bb943955cb9d31
[exim.git] / src / src / tls-gnu.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Copyright (c) Phil Pennock 2012 */
9
10 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
11 one of the available supported implementations. This file is #included into
12 tls.c when USE_GNUTLS has been set.
13
14 The code herein is a revamp of GnuTLS integration using the current APIs; the
15 original tls-gnu.c was based on a patch which was contributed by Nikos
16 Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
17 appropriate.
18
19 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20 which is not widely deployed by OS vendors. Will note issues below, which may
21 assist in updating the code in the future. Another sources of hints is
22 mod_gnutls for Apache (SNI callback registration and handling).
23
24 Keeping client and server variables more split than before and is currently
25 the norm, in anticipation of TLS in ACL callouts.
26
27 I wanted to switch to gnutls_certificate_set_verify_function() so that
28 certificate rejection could happen during handshake where it belongs, rather
29 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
31
32 (I wasn't looking for libraries quite that old, when updating to get rid of
33 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34 require current GnuTLS, then we'll drop support for the ancient libraries).
35 */
36
37 #include <gnutls/gnutls.h>
38 /* needed for cert checks in verification and DN extraction: */
39 #include <gnutls/x509.h>
40 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41 #include <gnutls/crypto.h>
42
43 /* needed to disable PKCS11 autoload unless requested */
44 #if GNUTLS_VERSION_NUMBER >= 0x020c00
45 # include <gnutls/pkcs11.h>
46 # define SUPPORT_PARAM_TO_PK_BITS
47 #endif
48 #if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
49 # warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
50 # define DISABLE_OCSP
51 #endif
52 #if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
53 # warning "GnuTLS library version too old; tls:cert event unsupported"
54 # define DISABLE_EVENT
55 #endif
56 #if GNUTLS_VERSION_NUMBER >= 0x030306
57 # define SUPPORT_CA_DIR
58 #else
59 # undef SUPPORT_CA_DIR
60 #endif
61 #if GNUTLS_VERSION_NUMBER >= 0x030014
62 # define SUPPORT_SYSDEFAULT_CABUNDLE
63 #endif
64 #if GNUTLS_VERSION_NUMBER >= 0x030104
65 # define GNUTLS_CERT_VFY_STATUS_PRINT
66 #endif
67 #if GNUTLS_VERSION_NUMBER >= 0x030109
68 # define SUPPORT_CORK
69 #endif
70 #if GNUTLS_VERSION_NUMBER >= 0x030506 && !defined(DISABLE_OCSP)
71 # define SUPPORT_SRV_OCSP_STACK
72 #endif
73
74 #ifdef SUPPORT_DANE
75 # if GNUTLS_VERSION_NUMBER >= 0x030000
76 # define DANESSL_USAGE_DANE_TA 2
77 # define DANESSL_USAGE_DANE_EE 3
78 # else
79 # error GnuTLS version too early for DANE
80 # endif
81 # if GNUTLS_VERSION_NUMBER < 0x999999
82 # define GNUTLS_BROKEN_DANE_VALIDATION
83 # endif
84 #endif
85
86 #ifndef DISABLE_OCSP
87 # include <gnutls/ocsp.h>
88 #endif
89 #ifdef SUPPORT_DANE
90 # include <gnutls/dane.h>
91 #endif
92
93 /* GnuTLS 2 vs 3
94
95 GnuTLS 3 only:
96 gnutls_global_set_audit_log_function()
97
98 Changes:
99 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
100 */
101
102 /* Local static variables for GnuTLS */
103
104 /* Values for verify_requirement */
105
106 enum peer_verify_requirement
107 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED, VERIFY_DANE };
108
109 /* This holds most state for server or client; with this, we can set up an
110 outbound TLS-enabled connection in an ACL callout, while not stomping all
111 over the TLS variables available for expansion.
112
113 Some of these correspond to variables in globals.c; those variables will
114 be set to point to content in one of these instances, as appropriate for
115 the stage of the process lifetime.
116
117 Not handled here: global tls_channelbinding_b64.
118 */
119
120 typedef struct exim_gnutls_state {
121 gnutls_session_t session;
122 gnutls_certificate_credentials_t x509_cred;
123 gnutls_priority_t priority_cache;
124 enum peer_verify_requirement verify_requirement;
125 int fd_in;
126 int fd_out;
127 BOOL peer_cert_verified;
128 BOOL peer_dane_verified;
129 BOOL trigger_sni_changes;
130 BOOL have_set_peerdn;
131 const struct host_item *host; /* NULL if server */
132 gnutls_x509_crt_t peercert;
133 uschar *peerdn;
134 uschar *ciphersuite;
135 uschar *received_sni;
136
137 const uschar *tls_certificate;
138 const uschar *tls_privatekey;
139 const uschar *tls_sni; /* client send only, not received */
140 const uschar *tls_verify_certificates;
141 const uschar *tls_crl;
142 const uschar *tls_require_ciphers;
143
144 uschar *exp_tls_certificate;
145 uschar *exp_tls_privatekey;
146 uschar *exp_tls_verify_certificates;
147 uschar *exp_tls_crl;
148 uschar *exp_tls_require_ciphers;
149 const uschar *exp_tls_verify_cert_hostnames;
150 #ifndef DISABLE_EVENT
151 uschar *event_action;
152 #endif
153 #ifdef SUPPORT_DANE
154 char * const * dane_data;
155 const int * dane_data_len;
156 #endif
157
158 tls_support *tlsp; /* set in tls_init() */
159
160 uschar *xfer_buffer;
161 int xfer_buffer_lwm;
162 int xfer_buffer_hwm;
163 BOOL xfer_eof; /*XXX never gets set! */
164 BOOL xfer_error;
165 } exim_gnutls_state_st;
166
167 static const exim_gnutls_state_st exim_gnutls_state_init = {
168 .session = NULL,
169 .x509_cred = NULL,
170 .priority_cache = NULL,
171 .verify_requirement = VERIFY_NONE,
172 .fd_in = -1,
173 .fd_out = -1,
174 .peer_cert_verified = FALSE,
175 .peer_dane_verified = FALSE,
176 .trigger_sni_changes =FALSE,
177 .have_set_peerdn = FALSE,
178 .host = NULL,
179 .peercert = NULL,
180 .peerdn = NULL,
181 .ciphersuite = NULL,
182 .received_sni = NULL,
183
184 .tls_certificate = NULL,
185 .tls_privatekey = NULL,
186 .tls_sni = NULL,
187 .tls_verify_certificates = NULL,
188 .tls_crl = NULL,
189 .tls_require_ciphers =NULL,
190
191 .exp_tls_certificate = NULL,
192 .exp_tls_privatekey = NULL,
193 .exp_tls_verify_certificates = NULL,
194 .exp_tls_crl = NULL,
195 .exp_tls_require_ciphers = NULL,
196 .exp_tls_verify_cert_hostnames = NULL,
197 #ifndef DISABLE_EVENT
198 .event_action = NULL,
199 #endif
200 .tlsp = NULL,
201
202 .xfer_buffer = NULL,
203 .xfer_buffer_lwm = 0,
204 .xfer_buffer_hwm = 0,
205 .xfer_eof = FALSE,
206 .xfer_error = FALSE,
207 };
208
209 /* Not only do we have our own APIs which don't pass around state, assuming
210 it's held in globals, GnuTLS doesn't appear to let us register callback data
211 for callbacks, or as part of the session, so we have to keep a "this is the
212 context we're currently dealing with" pointer and rely upon being
213 single-threaded to keep from processing data on an inbound TLS connection while
214 talking to another TLS connection for an outbound check. This does mean that
215 there's no way for heart-beats to be responded to, for the duration of the
216 second connection.
217 XXX But see gnutls_session_get_ptr()
218 */
219
220 static exim_gnutls_state_st state_server;
221
222 /* dh_params are initialised once within the lifetime of a process using TLS;
223 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
224 don't want to repeat this. */
225
226 static gnutls_dh_params_t dh_server_params = NULL;
227
228 /* No idea how this value was chosen; preserving it. Default is 3600. */
229
230 static const int ssl_session_timeout = 200;
231
232 static const char * const exim_default_gnutls_priority = "NORMAL";
233
234 /* Guard library core initialisation */
235
236 static BOOL exim_gnutls_base_init_done = FALSE;
237
238 #ifndef DISABLE_OCSP
239 static BOOL gnutls_buggy_ocsp = FALSE;
240 #endif
241
242
243 /* ------------------------------------------------------------------------ */
244 /* macros */
245
246 #define MAX_HOST_LEN 255
247
248 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
249 the library logging; a value less than 0 disables the calls to set up logging
250 callbacks. Possibly GNuTLS also looks for an environment variable
251 "GNUTLS_DEBUG_LEVEL". */
252 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
253 # define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
254 #endif
255
256 #ifndef EXIM_CLIENT_DH_MIN_BITS
257 # define EXIM_CLIENT_DH_MIN_BITS 1024
258 #endif
259
260 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
261 can ask for a bit-strength. Without that, we stick to the constant we had
262 before, for now. */
263 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
264 # define EXIM_SERVER_DH_BITS_PRE2_12 1024
265 #endif
266
267 #define exim_gnutls_err_check(rc, Label) do { \
268 if ((rc) != GNUTLS_E_SUCCESS) \
269 return tls_error((Label), US gnutls_strerror(rc), host, errstr); \
270 } while (0)
271
272 #define expand_check_tlsvar(Varname, errstr) \
273 expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr)
274
275 #if GNUTLS_VERSION_NUMBER >= 0x020c00
276 # define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
277 # define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
278 # define HAVE_GNUTLS_RND
279 /* The security fix we provide with the gnutls_allow_auto_pkcs11 option
280 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
281 * isn't available sometimes, so this needs to become a conditional
282 * compilation; the sanest way to deal with this being a problem on
283 * older OSes is to block it in the Local/Makefile with this compiler
284 * definition */
285 # ifndef AVOID_GNUTLS_PKCS11
286 # define HAVE_GNUTLS_PKCS11
287 # endif /* AVOID_GNUTLS_PKCS11 */
288 #endif
289
290
291
292
293 /* ------------------------------------------------------------------------ */
294 /* Callback declarations */
295
296 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
297 static void exim_gnutls_logger_cb(int level, const char *message);
298 #endif
299
300 static int exim_sni_handling_cb(gnutls_session_t session);
301
302 #ifndef DISABLE_OCSP
303 static int server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
304 gnutls_datum_t * ocsp_response);
305 #endif
306
307
308
309 /* ------------------------------------------------------------------------ */
310 /* Static functions */
311
312 /*************************************************
313 * Handle TLS error *
314 *************************************************/
315
316 /* Called from lots of places when errors occur before actually starting to do
317 the TLS handshake, that is, while the session is still in clear. Always returns
318 DEFER for a server and FAIL for a client so that most calls can use "return
319 tls_error(...)" to do this processing and then give an appropriate return. A
320 single function is used for both server and client, because it is called from
321 some shared functions.
322
323 Argument:
324 prefix text to include in the logged error
325 msg additional error string (may be NULL)
326 usually obtained from gnutls_strerror()
327 host NULL if setting up a server;
328 the connected host if setting up a client
329 errstr pointer to returned error string
330
331 Returns: OK/DEFER/FAIL
332 */
333
334 static int
335 tls_error(const uschar *prefix, const uschar *msg, const host_item *host,
336 uschar ** errstr)
337 {
338 if (errstr)
339 *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : US"");
340 return host ? FAIL : DEFER;
341 }
342
343
344
345
346 /*************************************************
347 * Deal with logging errors during I/O *
348 *************************************************/
349
350 /* We have to get the identity of the peer from saved data.
351
352 Argument:
353 state the current GnuTLS exim state container
354 rc the GnuTLS error code, or 0 if it's a local error
355 when text identifying read or write
356 text local error text when ec is 0
357
358 Returns: nothing
359 */
360
361 static void
362 record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
363 {
364 const uschar * msg;
365 uschar * errstr;
366
367 if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
368 msg = string_sprintf("%s: %s", US gnutls_strerror(rc),
369 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
370 else
371 msg = US gnutls_strerror(rc);
372
373 (void) tls_error(when, msg, state->host, &errstr);
374
375 if (state->host)
376 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection %s",
377 state->host->name, state->host->address, errstr);
378 else
379 {
380 uschar * conn_info = smtp_get_connection_info();
381 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0) conn_info += 5;
382 /* I'd like to get separated H= here, but too hard for now */
383 log_write(0, LOG_MAIN, "TLS error on %s %s", conn_info, errstr);
384 }
385 }
386
387
388
389
390 /*************************************************
391 * Set various Exim expansion vars *
392 *************************************************/
393
394 #define exim_gnutls_cert_err(Label) \
395 do \
396 { \
397 if (rc != GNUTLS_E_SUCCESS) \
398 { \
399 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
400 (Label), gnutls_strerror(rc)); \
401 return rc; \
402 } \
403 } while (0)
404
405 static int
406 import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
407 {
408 int rc;
409
410 rc = gnutls_x509_crt_init(crtp);
411 exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
412
413 rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
414 exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
415
416 return rc;
417 }
418
419 #undef exim_gnutls_cert_err
420
421
422 /* We set various Exim global variables from the state, once a session has
423 been established. With TLS callouts, may need to change this to stack
424 variables, or just re-call it with the server state after client callout
425 has finished.
426
427 Make sure anything set here is unset in tls_getc().
428
429 Sets:
430 tls_active fd
431 tls_bits strength indicator
432 tls_certificate_verified bool indicator
433 tls_channelbinding_b64 for some SASL mechanisms
434 tls_cipher a string
435 tls_peercert pointer to library internal
436 tls_peerdn a string
437 tls_sni a (UTF-8) string
438 tls_ourcert pointer to library internal
439
440 Argument:
441 state the relevant exim_gnutls_state_st *
442 */
443
444 static void
445 extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
446 {
447 gnutls_cipher_algorithm_t cipher;
448 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
449 int old_pool;
450 int rc;
451 gnutls_datum_t channel;
452 #endif
453 tls_support * tlsp = state->tlsp;
454
455 tlsp->active.sock = state->fd_out;
456 tlsp->active.tls_ctx = state;
457
458 cipher = gnutls_cipher_get(state->session);
459 /* returns size in "bytes" */
460 tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
461
462 tlsp->cipher = state->ciphersuite;
463
464 DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
465
466 tlsp->certificate_verified = state->peer_cert_verified;
467 #ifdef SUPPORT_DANE
468 tlsp->dane_verified = state->peer_dane_verified;
469 #endif
470
471 /* note that tls_channelbinding_b64 is not saved to the spool file, since it's
472 only available for use for authenticators while this TLS session is running. */
473
474 tls_channelbinding_b64 = NULL;
475 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
476 channel.data = NULL;
477 channel.size = 0;
478 rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
479 if (rc) {
480 DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
481 } else {
482 old_pool = store_pool;
483 store_pool = POOL_PERM;
484 tls_channelbinding_b64 = b64encode(channel.data, (int)channel.size);
485 store_pool = old_pool;
486 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
487 }
488 #endif
489
490 /* peercert is set in peer_status() */
491 tlsp->peerdn = state->peerdn;
492 tlsp->sni = state->received_sni;
493
494 /* record our certificate */
495 {
496 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
497 gnutls_x509_crt_t crt;
498
499 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
500 }
501 }
502
503
504
505
506 /*************************************************
507 * Setup up DH parameters *
508 *************************************************/
509
510 /* Generating the D-H parameters may take a long time. They only need to
511 be re-generated every so often, depending on security policy. What we do is to
512 keep these parameters in a file in the spool directory. If the file does not
513 exist, we generate them. This means that it is easy to cause a regeneration.
514
515 The new file is written as a temporary file and renamed, so that an incomplete
516 file is never present. If two processes both compute some new parameters, you
517 waste a bit of effort, but it doesn't seem worth messing around with locking to
518 prevent this.
519
520 Returns: OK/DEFER/FAIL
521 */
522
523 static int
524 init_server_dh(uschar ** errstr)
525 {
526 int fd, rc;
527 unsigned int dh_bits;
528 gnutls_datum_t m;
529 uschar filename_buf[PATH_MAX];
530 uschar *filename = NULL;
531 size_t sz;
532 uschar *exp_tls_dhparam;
533 BOOL use_file_in_spool = FALSE;
534 BOOL use_fixed_file = FALSE;
535 host_item *host = NULL; /* dummy for macros */
536
537 DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
538
539 rc = gnutls_dh_params_init(&dh_server_params);
540 exim_gnutls_err_check(rc, US"gnutls_dh_params_init");
541
542 m.data = NULL;
543 m.size = 0;
544
545 if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam, errstr))
546 return DEFER;
547
548 if (!exp_tls_dhparam)
549 {
550 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
551 m.data = US std_dh_prime_default();
552 m.size = Ustrlen(m.data);
553 }
554 else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
555 use_file_in_spool = TRUE;
556 else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
557 {
558 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
559 return OK;
560 }
561 else if (exp_tls_dhparam[0] != '/')
562 {
563 if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
564 return tls_error(US"No standard prime named", exp_tls_dhparam, NULL, errstr);
565 m.size = Ustrlen(m.data);
566 }
567 else
568 {
569 use_fixed_file = TRUE;
570 filename = exp_tls_dhparam;
571 }
572
573 if (m.data)
574 {
575 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
576 exim_gnutls_err_check(rc, US"gnutls_dh_params_import_pkcs3");
577 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
578 return OK;
579 }
580
581 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
582 /* If you change this constant, also change dh_param_fn_ext so that we can use a
583 different filename and ensure we have sufficient bits. */
584 dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
585 if (!dh_bits)
586 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL, errstr);
587 DEBUG(D_tls)
588 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
589 dh_bits);
590 #else
591 dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
592 DEBUG(D_tls)
593 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
594 dh_bits);
595 #endif
596
597 /* Some clients have hard-coded limits. */
598 if (dh_bits > tls_dh_max_bits)
599 {
600 DEBUG(D_tls)
601 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
602 tls_dh_max_bits);
603 dh_bits = tls_dh_max_bits;
604 }
605
606 if (use_file_in_spool)
607 {
608 if (!string_format(filename_buf, sizeof(filename_buf),
609 "%s/gnutls-params-%d", spool_directory, dh_bits))
610 return tls_error(US"overlong filename", NULL, NULL, errstr);
611 filename = filename_buf;
612 }
613
614 /* Open the cache file for reading and if successful, read it and set up the
615 parameters. */
616
617 if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
618 {
619 struct stat statbuf;
620 FILE *fp;
621 int saved_errno;
622
623 if (fstat(fd, &statbuf) < 0) /* EIO */
624 {
625 saved_errno = errno;
626 (void)close(fd);
627 return tls_error(US"TLS cache stat failed", US strerror(saved_errno), NULL, errstr);
628 }
629 if (!S_ISREG(statbuf.st_mode))
630 {
631 (void)close(fd);
632 return tls_error(US"TLS cache not a file", NULL, NULL, errstr);
633 }
634 if (!(fp = fdopen(fd, "rb")))
635 {
636 saved_errno = errno;
637 (void)close(fd);
638 return tls_error(US"fdopen(TLS cache stat fd) failed",
639 US strerror(saved_errno), NULL, errstr);
640 }
641
642 m.size = statbuf.st_size;
643 if (!(m.data = malloc(m.size)))
644 {
645 fclose(fp);
646 return tls_error(US"malloc failed", US strerror(errno), NULL, errstr);
647 }
648 if (!(sz = fread(m.data, m.size, 1, fp)))
649 {
650 saved_errno = errno;
651 fclose(fp);
652 free(m.data);
653 return tls_error(US"fread failed", US strerror(saved_errno), NULL, errstr);
654 }
655 fclose(fp);
656
657 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
658 free(m.data);
659 exim_gnutls_err_check(rc, US"gnutls_dh_params_import_pkcs3");
660 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
661 }
662
663 /* If the file does not exist, fall through to compute new data and cache it.
664 If there was any other opening error, it is serious. */
665
666 else if (errno == ENOENT)
667 {
668 rc = -1;
669 DEBUG(D_tls)
670 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
671 }
672 else
673 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
674 NULL, NULL, errstr);
675
676 /* If ret < 0, either the cache file does not exist, or the data it contains
677 is not useful. One particular case of this is when upgrading from an older
678 release of Exim in which the data was stored in a different format. We don't
679 try to be clever and support both formats; we just regenerate new data in this
680 case. */
681
682 if (rc < 0)
683 {
684 uschar *temp_fn;
685 unsigned int dh_bits_gen = dh_bits;
686
687 if ((PATH_MAX - Ustrlen(filename)) < 10)
688 return tls_error(US"Filename too long to generate replacement",
689 filename, NULL, errstr);
690
691 temp_fn = string_copy(US"%s.XXXXXXX");
692 if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */
693 return tls_error(US"Unable to open temp file", US strerror(errno), NULL, errstr);
694 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
695
696 /* GnuTLS overshoots!
697 * If we ask for 2236, we might get 2237 or more.
698 * But there's no way to ask GnuTLS how many bits there really are.
699 * We can ask how many bits were used in a TLS session, but that's it!
700 * The prime itself is hidden behind too much abstraction.
701 * So we ask for less, and proceed on a wing and a prayer.
702 * First attempt, subtracted 3 for 2233 and got 2240.
703 */
704 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
705 {
706 dh_bits_gen = dh_bits - 10;
707 DEBUG(D_tls)
708 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
709 dh_bits_gen);
710 }
711
712 DEBUG(D_tls)
713 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
714 dh_bits_gen);
715 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen);
716 exim_gnutls_err_check(rc, US"gnutls_dh_params_generate2");
717
718 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
719 and I confirmed that a NULL call to get the size first is how the GnuTLS
720 sample apps handle this. */
721
722 sz = 0;
723 m.data = NULL;
724 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
725 m.data, &sz);
726 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
727 exim_gnutls_err_check(rc, US"gnutls_dh_params_export_pkcs3(NULL) sizing");
728 m.size = sz;
729 if (!(m.data = malloc(m.size)))
730 return tls_error(US"memory allocation failed", US strerror(errno), NULL, errstr);
731
732 /* this will return a size 1 less than the allocation size above */
733 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
734 m.data, &sz);
735 if (rc != GNUTLS_E_SUCCESS)
736 {
737 free(m.data);
738 exim_gnutls_err_check(rc, US"gnutls_dh_params_export_pkcs3() real");
739 }
740 m.size = sz; /* shrink by 1, probably */
741
742 if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
743 {
744 free(m.data);
745 return tls_error(US"TLS cache write D-H params failed",
746 US strerror(errno), NULL, errstr);
747 }
748 free(m.data);
749 if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
750 return tls_error(US"TLS cache write D-H params final newline failed",
751 US strerror(errno), NULL, errstr);
752
753 if ((rc = close(fd)))
754 return tls_error(US"TLS cache write close() failed", US strerror(errno), NULL, errstr);
755
756 if (Urename(temp_fn, filename) < 0)
757 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
758 temp_fn, filename), US strerror(errno), NULL, errstr);
759
760 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
761 }
762
763 DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
764 return OK;
765 }
766
767
768
769
770 /* Create and install a selfsigned certificate, for use in server mode */
771
772 static int
773 tls_install_selfsign(exim_gnutls_state_st * state, uschar ** errstr)
774 {
775 gnutls_x509_crt_t cert = NULL;
776 time_t now;
777 gnutls_x509_privkey_t pkey = NULL;
778 const uschar * where;
779 int rc;
780
781 where = US"initialising pkey";
782 if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
783
784 where = US"initialising cert";
785 if ((rc = gnutls_x509_crt_init(&cert))) goto err;
786
787 where = US"generating pkey";
788 if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
789 #ifdef SUPPORT_PARAM_TO_PK_BITS
790 # ifndef GNUTLS_SEC_PARAM_MEDIUM
791 # define GNUTLS_SEC_PARAM_MEDIUM GNUTLS_SEC_PARAM_HIGH
792 # endif
793 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_MEDIUM),
794 #else
795 2048,
796 #endif
797 0)))
798 goto err;
799
800 where = US"configuring cert";
801 now = 1;
802 if ( (rc = gnutls_x509_crt_set_version(cert, 3))
803 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
804 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
805 || (rc = gnutls_x509_crt_set_expiration_time(cert, now + 60 * 60)) /* 1 hr */
806 || (rc = gnutls_x509_crt_set_key(cert, pkey))
807
808 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
809 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
810 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
811 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
812 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
813 GNUTLS_OID_X520_COMMON_NAME, 0,
814 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
815 )
816 goto err;
817
818 where = US"signing cert";
819 if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
820
821 where = US"installing selfsign cert";
822 /* Since: 2.4.0 */
823 if ((rc = gnutls_certificate_set_x509_key(state->x509_cred, &cert, 1, pkey)))
824 goto err;
825
826 rc = OK;
827
828 out:
829 if (cert) gnutls_x509_crt_deinit(cert);
830 if (pkey) gnutls_x509_privkey_deinit(pkey);
831 return rc;
832
833 err:
834 rc = tls_error(where, US gnutls_strerror(rc), NULL, errstr);
835 goto out;
836 }
837
838
839
840
841 /* Add certificate and key, from files.
842
843 Return:
844 Zero or negative: good. Negate value for certificate index if < 0.
845 Greater than zero: FAIL or DEFER code.
846 */
847
848 static int
849 tls_add_certfile(exim_gnutls_state_st * state, const host_item * host,
850 uschar * certfile, uschar * keyfile, uschar ** errstr)
851 {
852 int rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
853 CS certfile, CS keyfile, GNUTLS_X509_FMT_PEM);
854 if (rc < 0)
855 return tls_error(
856 string_sprintf("cert/key setup: cert=%s key=%s", certfile, keyfile),
857 US gnutls_strerror(rc), host, errstr);
858 return -rc;
859 }
860
861
862 /*************************************************
863 * Variables re-expanded post-SNI *
864 *************************************************/
865
866 /* Called from both server and client code, via tls_init(), and also from
867 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
868
869 We can tell the two apart by state->received_sni being non-NULL in callback.
870
871 The callback should not call us unless state->trigger_sni_changes is true,
872 which we are responsible for setting on the first pass through.
873
874 Arguments:
875 state exim_gnutls_state_st *
876 errstr error string pointer
877
878 Returns: OK/DEFER/FAIL
879 */
880
881 static int
882 tls_expand_session_files(exim_gnutls_state_st * state, uschar ** errstr)
883 {
884 struct stat statbuf;
885 int rc;
886 const host_item *host = state->host; /* macro should be reconsidered? */
887 uschar *saved_tls_certificate = NULL;
888 uschar *saved_tls_privatekey = NULL;
889 uschar *saved_tls_verify_certificates = NULL;
890 uschar *saved_tls_crl = NULL;
891 int cert_count;
892
893 /* We check for tls_sni *before* expansion. */
894 if (!host) /* server */
895 if (!state->received_sni)
896 {
897 if ( state->tls_certificate
898 && ( Ustrstr(state->tls_certificate, US"tls_sni")
899 || Ustrstr(state->tls_certificate, US"tls_in_sni")
900 || Ustrstr(state->tls_certificate, US"tls_out_sni")
901 ) )
902 {
903 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
904 state->trigger_sni_changes = TRUE;
905 }
906 }
907 else
908 {
909 /* useful for debugging */
910 saved_tls_certificate = state->exp_tls_certificate;
911 saved_tls_privatekey = state->exp_tls_privatekey;
912 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
913 saved_tls_crl = state->exp_tls_crl;
914 }
915
916 rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
917 exim_gnutls_err_check(rc, US"gnutls_certificate_allocate_credentials");
918
919 #ifdef SUPPORT_SRV_OCSP_STACK
920 gnutls_certificate_set_flags(state->x509_cred, GNUTLS_CERTIFICATE_API_V2);
921 #endif
922
923 /* remember: expand_check_tlsvar() is expand_check() but fiddling with
924 state members, assuming consistent naming; and expand_check() returns
925 false if expansion failed, unless expansion was forced to fail. */
926
927 /* check if we at least have a certificate, before doing expensive
928 D-H generation. */
929
930 if (!expand_check_tlsvar(tls_certificate, errstr))
931 return DEFER;
932
933 /* certificate is mandatory in server, optional in client */
934
935 if ( !state->exp_tls_certificate
936 || !*state->exp_tls_certificate
937 )
938 if (!host)
939 return tls_install_selfsign(state, errstr);
940 else
941 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
942
943 if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey, errstr))
944 return DEFER;
945
946 /* tls_privatekey is optional, defaulting to same file as certificate */
947
948 if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
949 {
950 state->tls_privatekey = state->tls_certificate;
951 state->exp_tls_privatekey = state->exp_tls_certificate;
952 }
953
954
955 if (state->exp_tls_certificate && *state->exp_tls_certificate)
956 {
957 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
958 state->exp_tls_certificate, state->exp_tls_privatekey);
959
960 if (state->received_sni)
961 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
962 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
963 )
964 {
965 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
966 }
967 else
968 {
969 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
970 }
971
972 if (!host) /* server */
973 {
974 const uschar * clist = state->exp_tls_certificate;
975 const uschar * klist = state->exp_tls_privatekey;
976 const uschar * olist;
977 int csep = 0, ksep = 0, osep = 0, cnt = 0;
978 uschar * cfile, * kfile, * ofile;
979
980 #ifndef DISABLE_OCSP
981 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file", &ofile, errstr))
982 return DEFER;
983 olist = ofile;
984 #endif
985
986 while (cfile = string_nextinlist(&clist, &csep, NULL, 0))
987
988 if (!(kfile = string_nextinlist(&klist, &ksep, NULL, 0)))
989 return tls_error(US"cert/key setup: out of keys", NULL, host, errstr);
990 else if (0 < (rc = tls_add_certfile(state, host, cfile, kfile, errstr)))
991 return rc;
992 else
993 {
994 int gnutls_cert_index = -rc;
995 DEBUG(D_tls) debug_printf("TLS: cert/key %s registered\n", cfile);
996
997 /* Set the OCSP stapling server info */
998
999 #ifndef DISABLE_OCSP
1000 if (tls_ocsp_file)
1001 if (gnutls_buggy_ocsp)
1002 {
1003 DEBUG(D_tls)
1004 debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
1005 }
1006 else if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1007 {
1008 /* Use the full callback method for stapling just to get
1009 observability. More efficient would be to read the file once only,
1010 if it never changed (due to SNI). Would need restart on file update,
1011 or watch datestamp. */
1012
1013 # ifdef SUPPORT_SRV_OCSP_STACK
1014 rc = gnutls_certificate_set_ocsp_status_request_function2(
1015 state->x509_cred, gnutls_cert_index,
1016 server_ocsp_stapling_cb, ofile);
1017
1018 exim_gnutls_err_check(rc,
1019 US"gnutls_certificate_set_ocsp_status_request_function2");
1020 # else
1021 if (cnt++ > 0)
1022 {
1023 DEBUG(D_tls)
1024 debug_printf("oops; multiple OCSP files not supported\n");
1025 break;
1026 }
1027 gnutls_certificate_set_ocsp_status_request_function(
1028 state->x509_cred, server_ocsp_stapling_cb, ofile);
1029 # endif
1030
1031 DEBUG(D_tls) debug_printf("OCSP response file = %s\n", ofile);
1032 }
1033 else
1034 DEBUG(D_tls) debug_printf("ran out of OCSP response files in list\n");
1035 #endif
1036 }
1037 }
1038 else
1039 {
1040 if (0 < (rc = tls_add_certfile(state, host,
1041 state->exp_tls_certificate, state->exp_tls_privatekey, errstr)))
1042 return rc;
1043 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
1044 }
1045
1046 } /* tls_certificate */
1047
1048
1049 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
1050 provided. Experiment shows that, if the certificate file is empty, an unhelpful
1051 error message is provided. However, if we just refrain from setting anything up
1052 in that case, certificate verification fails, which seems to be the correct
1053 behaviour. */
1054
1055 if (state->tls_verify_certificates && *state->tls_verify_certificates)
1056 {
1057 if (!expand_check_tlsvar(tls_verify_certificates, errstr))
1058 return DEFER;
1059 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1060 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1061 state->exp_tls_verify_certificates = NULL;
1062 #endif
1063 if (state->tls_crl && *state->tls_crl)
1064 if (!expand_check_tlsvar(tls_crl, errstr))
1065 return DEFER;
1066
1067 if (!(state->exp_tls_verify_certificates &&
1068 *state->exp_tls_verify_certificates))
1069 {
1070 DEBUG(D_tls)
1071 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
1072 /* With no tls_verify_certificates, we ignore tls_crl too */
1073 return OK;
1074 }
1075 }
1076 else
1077 {
1078 DEBUG(D_tls)
1079 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
1080 return OK;
1081 }
1082
1083 #ifdef SUPPORT_SYSDEFAULT_CABUNDLE
1084 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1085 cert_count = gnutls_certificate_set_x509_system_trust(state->x509_cred);
1086 else
1087 #endif
1088 {
1089 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
1090 {
1091 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
1092 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
1093 strerror(errno));
1094 return DEFER;
1095 }
1096
1097 #ifndef SUPPORT_CA_DIR
1098 /* The test suite passes in /dev/null; we could check for that path explicitly,
1099 but who knows if someone has some weird FIFO which always dumps some certs, or
1100 other weirdness. The thing we really want to check is that it's not a
1101 directory, since while OpenSSL supports that, GnuTLS does not.
1102 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
1103 if (S_ISDIR(statbuf.st_mode))
1104 {
1105 DEBUG(D_tls)
1106 debug_printf("verify certificates path is a dir: \"%s\"\n",
1107 state->exp_tls_verify_certificates);
1108 log_write(0, LOG_MAIN|LOG_PANIC,
1109 "tls_verify_certificates \"%s\" is a directory",
1110 state->exp_tls_verify_certificates);
1111 return DEFER;
1112 }
1113 #endif
1114
1115 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
1116 state->exp_tls_verify_certificates, statbuf.st_size);
1117
1118 if (statbuf.st_size == 0)
1119 {
1120 DEBUG(D_tls)
1121 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
1122 return OK;
1123 }
1124
1125 cert_count =
1126
1127 #ifdef SUPPORT_CA_DIR
1128 (statbuf.st_mode & S_IFMT) == S_IFDIR
1129 ?
1130 gnutls_certificate_set_x509_trust_dir(state->x509_cred,
1131 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM)
1132 :
1133 #endif
1134 gnutls_certificate_set_x509_trust_file(state->x509_cred,
1135 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
1136 }
1137
1138 if (cert_count < 0)
1139 {
1140 rc = cert_count;
1141 exim_gnutls_err_check(rc, US"setting certificate trust");
1142 }
1143 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
1144
1145 if (state->tls_crl && *state->tls_crl &&
1146 state->exp_tls_crl && *state->exp_tls_crl)
1147 {
1148 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
1149 cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
1150 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
1151 if (cert_count < 0)
1152 {
1153 rc = cert_count;
1154 exim_gnutls_err_check(rc, US"gnutls_certificate_set_x509_crl_file");
1155 }
1156 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1157 }
1158
1159 return OK;
1160 }
1161
1162
1163
1164
1165 /*************************************************
1166 * Set X.509 state variables *
1167 *************************************************/
1168
1169 /* In GnuTLS, the registered cert/key are not replaced by a later
1170 set of a cert/key, so for SNI support we need a whole new x509_cred
1171 structure. Which means various other non-re-expanded pieces of state
1172 need to be re-set in the new struct, so the setting logic is pulled
1173 out to this.
1174
1175 Arguments:
1176 state exim_gnutls_state_st *
1177 errstr error string pointer
1178
1179 Returns: OK/DEFER/FAIL
1180 */
1181
1182 static int
1183 tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr)
1184 {
1185 int rc;
1186 const host_item *host = state->host; /* macro should be reconsidered? */
1187
1188 /* Create D-H parameters, or read them from the cache file. This function does
1189 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
1190 client-side params. */
1191
1192 if (!state->host)
1193 {
1194 if (!dh_server_params)
1195 {
1196 rc = init_server_dh(errstr);
1197 if (rc != OK) return rc;
1198 }
1199 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
1200 }
1201
1202 /* Link the credentials to the session. */
1203
1204 rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
1205 exim_gnutls_err_check(rc, US"gnutls_credentials_set");
1206
1207 return OK;
1208 }
1209
1210 /*************************************************
1211 * Initialize for GnuTLS *
1212 *************************************************/
1213
1214
1215 #ifndef DISABLE_OCSP
1216
1217 static BOOL
1218 tls_is_buggy_ocsp(void)
1219 {
1220 const uschar * s;
1221 uschar maj, mid, mic;
1222
1223 s = CUS gnutls_check_version(NULL);
1224 maj = atoi(CCS s);
1225 if (maj == 3)
1226 {
1227 while (*s && *s != '.') s++;
1228 mid = atoi(CCS ++s);
1229 if (mid <= 2)
1230 return TRUE;
1231 else if (mid >= 5)
1232 return FALSE;
1233 else
1234 {
1235 while (*s && *s != '.') s++;
1236 mic = atoi(CCS ++s);
1237 return mic <= (mid == 3 ? 16 : 3);
1238 }
1239 }
1240 return FALSE;
1241 }
1242
1243 #endif
1244
1245
1246 /* Called from both server and client code. In the case of a server, errors
1247 before actual TLS negotiation return DEFER.
1248
1249 Arguments:
1250 host connected host, if client; NULL if server
1251 certificate certificate file
1252 privatekey private key file
1253 sni TLS SNI to send, sometimes when client; else NULL
1254 cas CA certs file
1255 crl CRL file
1256 require_ciphers tls_require_ciphers setting
1257 caller_state returned state-info structure
1258 errstr error string pointer
1259
1260 Returns: OK/DEFER/FAIL
1261 */
1262
1263 static int
1264 tls_init(
1265 const host_item *host,
1266 const uschar *certificate,
1267 const uschar *privatekey,
1268 const uschar *sni,
1269 const uschar *cas,
1270 const uschar *crl,
1271 const uschar *require_ciphers,
1272 exim_gnutls_state_st **caller_state,
1273 tls_support * tlsp,
1274 uschar ** errstr)
1275 {
1276 exim_gnutls_state_st *state;
1277 int rc;
1278 size_t sz;
1279 const char *errpos;
1280 uschar *p;
1281 BOOL want_default_priorities;
1282
1283 if (!exim_gnutls_base_init_done)
1284 {
1285 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1286
1287 #ifdef HAVE_GNUTLS_PKCS11
1288 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1289 which loads modules from a config file, which sounds good and may be wanted
1290 by some sysadmin, but also means in common configurations that GNOME keyring
1291 environment variables are used and so breaks for users calling mailq.
1292 To prevent this, we init PKCS11 first, which is the documented approach. */
1293 if (!gnutls_allow_auto_pkcs11)
1294 {
1295 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
1296 exim_gnutls_err_check(rc, US"gnutls_pkcs11_init");
1297 }
1298 #endif
1299
1300 rc = gnutls_global_init();
1301 exim_gnutls_err_check(rc, US"gnutls_global_init");
1302
1303 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1304 DEBUG(D_tls)
1305 {
1306 gnutls_global_set_log_function(exim_gnutls_logger_cb);
1307 /* arbitrarily chosen level; bump up to 9 for more */
1308 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
1309 }
1310 #endif
1311
1312 #ifndef DISABLE_OCSP
1313 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
1314 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
1315 #endif
1316
1317 exim_gnutls_base_init_done = TRUE;
1318 }
1319
1320 if (host)
1321 {
1322 /* For client-side sessions we allocate a context. This lets us run
1323 several in parallel. */
1324 int old_pool = store_pool;
1325 store_pool = POOL_PERM;
1326 state = store_get(sizeof(exim_gnutls_state_st));
1327 store_pool = old_pool;
1328
1329 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1330 state->tlsp = tlsp;
1331 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1332 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1333 }
1334 else
1335 {
1336 state = &state_server;
1337 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1338 state->tlsp = tlsp;
1339 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1340 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1341 }
1342 exim_gnutls_err_check(rc, US"gnutls_init");
1343
1344 state->host = host;
1345
1346 state->tls_certificate = certificate;
1347 state->tls_privatekey = privatekey;
1348 state->tls_require_ciphers = require_ciphers;
1349 state->tls_sni = sni;
1350 state->tls_verify_certificates = cas;
1351 state->tls_crl = crl;
1352
1353 /* This handles the variables that might get re-expanded after TLS SNI;
1354 that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
1355
1356 DEBUG(D_tls)
1357 debug_printf("Expanding various TLS configuration options for session credentials.\n");
1358 if ((rc = tls_expand_session_files(state, errstr)) != OK) return rc;
1359
1360 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1361 requires a new structure afterwards. */
1362
1363 if ((rc = tls_set_remaining_x509(state, errstr)) != OK) return rc;
1364
1365 /* set SNI in client, only */
1366 if (host)
1367 {
1368 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni, errstr))
1369 return DEFER;
1370 if (state->tlsp->sni && *state->tlsp->sni)
1371 {
1372 DEBUG(D_tls)
1373 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1374 sz = Ustrlen(state->tlsp->sni);
1375 rc = gnutls_server_name_set(state->session,
1376 GNUTLS_NAME_DNS, state->tlsp->sni, sz);
1377 exim_gnutls_err_check(rc, US"gnutls_server_name_set");
1378 }
1379 }
1380 else if (state->tls_sni)
1381 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
1382 "have an SNI set for a server [%s]\n", state->tls_sni);
1383
1384 /* This is the priority string support,
1385 http://www.gnutls.org/manual/html_node/Priority-Strings.html
1386 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1387 This was backwards incompatible, but means Exim no longer needs to track
1388 all algorithms and provide string forms for them. */
1389
1390 want_default_priorities = TRUE;
1391
1392 if (state->tls_require_ciphers && *state->tls_require_ciphers)
1393 {
1394 if (!expand_check_tlsvar(tls_require_ciphers, errstr))
1395 return DEFER;
1396 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
1397 {
1398 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
1399 state->exp_tls_require_ciphers);
1400
1401 rc = gnutls_priority_init(&state->priority_cache,
1402 CS state->exp_tls_require_ciphers, &errpos);
1403 want_default_priorities = FALSE;
1404 p = state->exp_tls_require_ciphers;
1405 }
1406 }
1407 if (want_default_priorities)
1408 {
1409 DEBUG(D_tls)
1410 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
1411 exim_default_gnutls_priority);
1412 rc = gnutls_priority_init(&state->priority_cache,
1413 exim_default_gnutls_priority, &errpos);
1414 p = US exim_default_gnutls_priority;
1415 }
1416
1417 exim_gnutls_err_check(rc, string_sprintf(
1418 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1419 p, errpos - CS p, errpos));
1420
1421 rc = gnutls_priority_set(state->session, state->priority_cache);
1422 exim_gnutls_err_check(rc, US"gnutls_priority_set");
1423
1424 gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1425
1426 /* Reduce security in favour of increased compatibility, if the admin
1427 decides to make that trade-off. */
1428 if (gnutls_compat_mode)
1429 {
1430 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1431 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1432 gnutls_session_enable_compatibility_mode(state->session);
1433 #else
1434 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1435 #endif
1436 }
1437
1438 *caller_state = state;
1439 return OK;
1440 }
1441
1442
1443
1444 /*************************************************
1445 * Extract peer information *
1446 *************************************************/
1447
1448 /* Called from both server and client code.
1449 Only this is allowed to set state->peerdn and state->have_set_peerdn
1450 and we use that to detect double-calls.
1451
1452 NOTE: the state blocks last while the TLS connection is up, which is fine
1453 for logging in the server side, but for the client side, we log after teardown
1454 in src/deliver.c. While the session is up, we can twist about states and
1455 repoint tls_* globals, but those variables used for logging or other variable
1456 expansion that happens _after_ delivery need to have a longer life-time.
1457
1458 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1459 doing this more than once per generation of a state context. We set them in
1460 the state context, and repoint tls_* to them. After the state goes away, the
1461 tls_* copies of the pointers remain valid and client delivery logging is happy.
1462
1463 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1464 don't apply.
1465
1466 Arguments:
1467 state exim_gnutls_state_st *
1468 errstr pointer to error string
1469
1470 Returns: OK/DEFER/FAIL
1471 */
1472
1473 static int
1474 peer_status(exim_gnutls_state_st *state, uschar ** errstr)
1475 {
1476 uschar cipherbuf[256];
1477 const gnutls_datum_t *cert_list;
1478 int old_pool, rc;
1479 unsigned int cert_list_size = 0;
1480 gnutls_protocol_t protocol;
1481 gnutls_cipher_algorithm_t cipher;
1482 gnutls_kx_algorithm_t kx;
1483 gnutls_mac_algorithm_t mac;
1484 gnutls_certificate_type_t ct;
1485 gnutls_x509_crt_t crt;
1486 uschar *p, *dn_buf;
1487 size_t sz;
1488
1489 if (state->have_set_peerdn)
1490 return OK;
1491 state->have_set_peerdn = TRUE;
1492
1493 state->peerdn = NULL;
1494
1495 /* tls_cipher */
1496 cipher = gnutls_cipher_get(state->session);
1497 protocol = gnutls_protocol_get_version(state->session);
1498 mac = gnutls_mac_get(state->session);
1499 kx = gnutls_kx_get(state->session);
1500
1501 string_format(cipherbuf, sizeof(cipherbuf),
1502 "%s:%s:%d",
1503 gnutls_protocol_get_name(protocol),
1504 gnutls_cipher_suite_get_name(kx, cipher, mac),
1505 (int) gnutls_cipher_get_key_size(cipher) * 8);
1506
1507 /* I don't see a way that spaces could occur, in the current GnuTLS
1508 code base, but it was a concern in the old code and perhaps older GnuTLS
1509 releases did return "TLS 1.0"; play it safe, just in case. */
1510 for (p = cipherbuf; *p != '\0'; ++p)
1511 if (isspace(*p))
1512 *p = '-';
1513 old_pool = store_pool;
1514 store_pool = POOL_PERM;
1515 state->ciphersuite = string_copy(cipherbuf);
1516 store_pool = old_pool;
1517 state->tlsp->cipher = state->ciphersuite;
1518
1519 /* tls_peerdn */
1520 cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
1521
1522 if (cert_list == NULL || cert_list_size == 0)
1523 {
1524 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1525 cert_list, cert_list_size);
1526 if (state->verify_requirement >= VERIFY_REQUIRED)
1527 return tls_error(US"certificate verification failed",
1528 US"no certificate received from peer", state->host, errstr);
1529 return OK;
1530 }
1531
1532 ct = gnutls_certificate_type_get(state->session);
1533 if (ct != GNUTLS_CRT_X509)
1534 {
1535 const uschar *ctn = US gnutls_certificate_type_get_name(ct);
1536 DEBUG(D_tls)
1537 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
1538 if (state->verify_requirement >= VERIFY_REQUIRED)
1539 return tls_error(US"certificate verification not possible, unhandled type",
1540 ctn, state->host, errstr);
1541 return OK;
1542 }
1543
1544 #define exim_gnutls_peer_err(Label) \
1545 do { \
1546 if (rc != GNUTLS_E_SUCCESS) \
1547 { \
1548 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1549 (Label), gnutls_strerror(rc)); \
1550 if (state->verify_requirement >= VERIFY_REQUIRED) \
1551 return tls_error((Label), US gnutls_strerror(rc), state->host, errstr); \
1552 return OK; \
1553 } \
1554 } while (0)
1555
1556 rc = import_cert(&cert_list[0], &crt);
1557 exim_gnutls_peer_err(US"cert 0");
1558
1559 state->tlsp->peercert = state->peercert = crt;
1560
1561 sz = 0;
1562 rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1563 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
1564 {
1565 exim_gnutls_peer_err(US"getting size for cert DN failed");
1566 return FAIL; /* should not happen */
1567 }
1568 dn_buf = store_get_perm(sz);
1569 rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1570 exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1571
1572 state->peerdn = dn_buf;
1573
1574 return OK;
1575 #undef exim_gnutls_peer_err
1576 }
1577
1578
1579
1580
1581 /*************************************************
1582 * Verify peer certificate *
1583 *************************************************/
1584
1585 /* Called from both server and client code.
1586 *Should* be using a callback registered with
1587 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1588 the peer information, but that's too new for some OSes.
1589
1590 Arguments:
1591 state exim_gnutls_state_st *
1592 errstr where to put an error message
1593
1594 Returns:
1595 FALSE if the session should be rejected
1596 TRUE if the cert is okay or we just don't care
1597 */
1598
1599 static BOOL
1600 verify_certificate(exim_gnutls_state_st * state, uschar ** errstr)
1601 {
1602 int rc;
1603 uint verify;
1604
1605 if (state->verify_requirement == VERIFY_NONE)
1606 return TRUE;
1607
1608 DEBUG(D_tls) debug_printf("TLS: checking peer certificate\n");
1609 *errstr = NULL;
1610
1611 if ((rc = peer_status(state, errstr)) != OK)
1612 {
1613 verify = GNUTLS_CERT_INVALID;
1614 *errstr = US"certificate not supplied";
1615 }
1616 else
1617
1618 {
1619 #ifdef SUPPORT_DANE
1620 if (state->verify_requirement == VERIFY_DANE && state->host)
1621 {
1622 /* Using dane_verify_session_crt() would be easy, as it does it all for us
1623 including talking to a DNS resolver. But we want to do that bit ourselves
1624 as the testsuite intercepts and fakes its own DNS environment. */
1625
1626 dane_state_t s;
1627 dane_query_t r;
1628 uint lsize;
1629 const gnutls_datum_t * certlist =
1630 gnutls_certificate_get_peers(state->session, &lsize);
1631 int usage = tls_out.tlsa_usage;
1632
1633 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
1634 /* Split the TLSA records into two sets, TA and EE selectors. Run the
1635 dane-verification separately so that we know which selector verified;
1636 then we know whether to do name-verification (needed for TA but not EE). */
1637
1638 if (usage == ((1<<DANESSL_USAGE_DANE_TA) | (1<<DANESSL_USAGE_DANE_EE)))
1639 { /* a mixed-usage bundle */
1640 int i, j, nrec;
1641 const char ** dd;
1642 int * ddl;
1643
1644 for(nrec = 0; state->dane_data_len[nrec]; ) nrec++;
1645 nrec++;
1646
1647 dd = store_get(nrec * sizeof(uschar *));
1648 ddl = store_get(nrec * sizeof(int));
1649 nrec--;
1650
1651 if ((rc = dane_state_init(&s, 0)))
1652 goto tlsa_prob;
1653
1654 for (usage = DANESSL_USAGE_DANE_EE;
1655 usage >= DANESSL_USAGE_DANE_TA; usage--)
1656 { /* take records with this usage */
1657 for (j = i = 0; i < nrec; i++)
1658 if (state->dane_data[i][0] == usage)
1659 {
1660 dd[j] = state->dane_data[i];
1661 ddl[j++] = state->dane_data_len[i];
1662 }
1663 if (j)
1664 {
1665 dd[j] = NULL;
1666 ddl[j] = 0;
1667
1668 if ((rc = dane_raw_tlsa(s, &r, (char * const *)dd, ddl, 1, 0)))
1669 goto tlsa_prob;
1670
1671 if ((rc = dane_verify_crt_raw(s, certlist, lsize,
1672 gnutls_certificate_type_get(state->session),
1673 r, 0,
1674 usage == DANESSL_USAGE_DANE_EE
1675 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1676 &verify)))
1677 {
1678 DEBUG(D_tls)
1679 debug_printf("TLSA record problem: %s\n", dane_strerror(rc));
1680 }
1681 else if (verify == 0) /* verification passed */
1682 {
1683 usage = 1 << usage;
1684 break;
1685 }
1686 }
1687 }
1688
1689 if (rc) goto tlsa_prob;
1690 }
1691 else
1692 # endif
1693 {
1694 if ( (rc = dane_state_init(&s, 0))
1695 || (rc = dane_raw_tlsa(s, &r, state->dane_data, state->dane_data_len,
1696 1, 0))
1697 || (rc = dane_verify_crt_raw(s, certlist, lsize,
1698 gnutls_certificate_type_get(state->session),
1699 r, 0,
1700 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
1701 usage == (1 << DANESSL_USAGE_DANE_EE)
1702 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1703 # else
1704 0,
1705 # endif
1706 &verify))
1707 )
1708 goto tlsa_prob;
1709 }
1710
1711 if (verify != 0) /* verification failed */
1712 {
1713 gnutls_datum_t str;
1714 (void) dane_verification_status_print(verify, &str, 0);
1715 *errstr = US str.data; /* don't bother to free */
1716 goto badcert;
1717 }
1718
1719 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
1720 /* If a TA-mode TLSA record was used for verification we must additionally
1721 verify the cert name (but not the CA chain). For EE-mode, skip it. */
1722
1723 if (usage & (1 << DANESSL_USAGE_DANE_EE))
1724 # endif
1725 {
1726 state->peer_dane_verified = state->peer_cert_verified = TRUE;
1727 goto goodcert;
1728 }
1729 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
1730 /* Assume that the name on the A-record is the one that should be matching
1731 the cert. An alternate view is that the domain part of the email address
1732 is also permissible. */
1733
1734 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert,
1735 CS state->host->name))
1736 {
1737 state->peer_dane_verified = state->peer_cert_verified = TRUE;
1738 goto goodcert;
1739 }
1740 # endif
1741 }
1742 #endif /*SUPPORT_DANE*/
1743
1744 rc = gnutls_certificate_verify_peers2(state->session, &verify);
1745 }
1746
1747 /* Handle the result of verification. INVALID is set if any others are. */
1748
1749 if (rc < 0 || verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED))
1750 {
1751 state->peer_cert_verified = FALSE;
1752 if (!*errstr)
1753 {
1754 #ifdef GNUTLS_CERT_VFY_STATUS_PRINT
1755 DEBUG(D_tls)
1756 {
1757 gnutls_datum_t txt;
1758
1759 if (gnutls_certificate_verification_status_print(verify,
1760 gnutls_certificate_type_get(state->session), &txt, 0)
1761 == GNUTLS_E_SUCCESS)
1762 {
1763 debug_printf("%s\n", txt.data);
1764 gnutls_free(txt.data);
1765 }
1766 }
1767 #endif
1768 *errstr = verify & GNUTLS_CERT_REVOKED
1769 ? US"certificate revoked" : US"certificate invalid";
1770 }
1771
1772 DEBUG(D_tls)
1773 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
1774 *errstr, state->peerdn ? state->peerdn : US"<unset>");
1775
1776 if (state->verify_requirement >= VERIFY_REQUIRED)
1777 goto badcert;
1778 DEBUG(D_tls)
1779 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
1780 }
1781
1782 else
1783 {
1784 /* Client side, check the server's certificate name versus the name on the
1785 A-record for the connection we made. What to do for server side - what name
1786 to use for client? We document that there is no such checking for server
1787 side. */
1788
1789 if ( state->exp_tls_verify_cert_hostnames
1790 && !gnutls_x509_crt_check_hostname(state->tlsp->peercert,
1791 CS state->exp_tls_verify_cert_hostnames)
1792 )
1793 {
1794 DEBUG(D_tls)
1795 debug_printf("TLS certificate verification failed: cert name mismatch\n");
1796 if (state->verify_requirement >= VERIFY_REQUIRED)
1797 goto badcert;
1798 return TRUE;
1799 }
1800
1801 state->peer_cert_verified = TRUE;
1802 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
1803 state->peerdn ? state->peerdn : US"<unset>");
1804 }
1805
1806 goodcert:
1807 state->tlsp->peerdn = state->peerdn;
1808 return TRUE;
1809
1810 #ifdef SUPPORT_DANE
1811 tlsa_prob:
1812 *errstr = string_sprintf("TLSA record problem: %s",
1813 rc == DANE_E_REQUESTED_DATA_NOT_AVAILABLE ? "none usable" : dane_strerror(rc));
1814 #endif
1815
1816 badcert:
1817 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1818 return FALSE;
1819 }
1820
1821
1822
1823
1824 /* ------------------------------------------------------------------------ */
1825 /* Callbacks */
1826
1827 /* Logging function which can be registered with
1828 * gnutls_global_set_log_function()
1829 * gnutls_global_set_log_level() 0..9
1830 */
1831 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1832 static void
1833 exim_gnutls_logger_cb(int level, const char *message)
1834 {
1835 size_t len = strlen(message);
1836 if (len < 1)
1837 {
1838 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1839 return;
1840 }
1841 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1842 message[len-1] == '\n' ? "" : "\n");
1843 }
1844 #endif
1845
1846
1847 /* Called after client hello, should handle SNI work.
1848 This will always set tls_sni (state->received_sni) if available,
1849 and may trigger presenting different certificates,
1850 if state->trigger_sni_changes is TRUE.
1851
1852 Should be registered with
1853 gnutls_handshake_set_post_client_hello_function()
1854
1855 "This callback must return 0 on success or a gnutls error code to terminate the
1856 handshake.".
1857
1858 For inability to get SNI information, we return 0.
1859 We only return non-zero if re-setup failed.
1860 Only used for server-side TLS.
1861 */
1862
1863 static int
1864 exim_sni_handling_cb(gnutls_session_t session)
1865 {
1866 char sni_name[MAX_HOST_LEN];
1867 size_t data_len = MAX_HOST_LEN;
1868 exim_gnutls_state_st *state = &state_server;
1869 unsigned int sni_type;
1870 int rc, old_pool;
1871 uschar * dummy_errstr;
1872
1873 rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
1874 if (rc != GNUTLS_E_SUCCESS)
1875 {
1876 DEBUG(D_tls) {
1877 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1878 debug_printf("TLS: no SNI presented in handshake.\n");
1879 else
1880 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1881 gnutls_strerror(rc), rc);
1882 }
1883 return 0;
1884 }
1885
1886 if (sni_type != GNUTLS_NAME_DNS)
1887 {
1888 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1889 return 0;
1890 }
1891
1892 /* We now have a UTF-8 string in sni_name */
1893 old_pool = store_pool;
1894 store_pool = POOL_PERM;
1895 state->received_sni = string_copyn(US sni_name, data_len);
1896 store_pool = old_pool;
1897
1898 /* We set this one now so that variable expansions below will work */
1899 state->tlsp->sni = state->received_sni;
1900
1901 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1902 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1903
1904 if (!state->trigger_sni_changes)
1905 return 0;
1906
1907 if ((rc = tls_expand_session_files(state, &dummy_errstr)) != OK)
1908 {
1909 /* If the setup of certs/etc failed before handshake, TLS would not have
1910 been offered. The best we can do now is abort. */
1911 return GNUTLS_E_APPLICATION_ERROR_MIN;
1912 }
1913
1914 rc = tls_set_remaining_x509(state, &dummy_errstr);
1915 if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1916
1917 return 0;
1918 }
1919
1920
1921
1922 #ifndef DISABLE_OCSP
1923
1924 static int
1925 server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
1926 gnutls_datum_t * ocsp_response)
1927 {
1928 int ret;
1929 DEBUG(D_tls) debug_printf("OCSP stapling callback: %s\n", US ptr);
1930
1931 if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
1932 {
1933 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
1934 CS ptr);
1935 tls_in.ocsp = OCSP_NOT_RESP;
1936 return GNUTLS_E_NO_CERTIFICATE_STATUS;
1937 }
1938
1939 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1940 return 0;
1941 }
1942
1943 #endif
1944
1945
1946 #ifndef DISABLE_EVENT
1947 /*
1948 We use this callback to get observability and detail-level control
1949 for an exim TLS connection (either direction), raising a tls:cert event
1950 for each cert in the chain presented by the peer. Any event
1951 can deny verification.
1952
1953 Return 0 for the handshake to continue or non-zero to terminate.
1954 */
1955
1956 static int
1957 verify_cb(gnutls_session_t session)
1958 {
1959 const gnutls_datum_t * cert_list;
1960 unsigned int cert_list_size = 0;
1961 gnutls_x509_crt_t crt;
1962 int rc;
1963 uschar * yield;
1964 exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
1965
1966 if ((cert_list = gnutls_certificate_get_peers(session, &cert_list_size)))
1967 while (cert_list_size--)
1968 {
1969 if ((rc = import_cert(&cert_list[cert_list_size], &crt)) != GNUTLS_E_SUCCESS)
1970 {
1971 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
1972 cert_list_size, gnutls_strerror(rc));
1973 break;
1974 }
1975
1976 state->tlsp->peercert = crt;
1977 if ((yield = event_raise(state->event_action,
1978 US"tls:cert", string_sprintf("%d", cert_list_size))))
1979 {
1980 log_write(0, LOG_MAIN,
1981 "SSL verify denied by event-action: depth=%d: %s",
1982 cert_list_size, yield);
1983 return 1; /* reject */
1984 }
1985 state->tlsp->peercert = NULL;
1986 }
1987
1988 return 0;
1989 }
1990
1991 #endif
1992
1993
1994
1995 /* ------------------------------------------------------------------------ */
1996 /* Exported functions */
1997
1998
1999
2000
2001 /*************************************************
2002 * Start a TLS session in a server *
2003 *************************************************/
2004
2005 /* This is called when Exim is running as a server, after having received
2006 the STARTTLS command. It must respond to that command, and then negotiate
2007 a TLS session.
2008
2009 Arguments:
2010 require_ciphers list of allowed ciphers or NULL
2011 errstr pointer to error string
2012
2013 Returns: OK on success
2014 DEFER for errors before the start of the negotiation
2015 FAIL for errors during the negotiation; the server can't
2016 continue running.
2017 */
2018
2019 int
2020 tls_server_start(const uschar * require_ciphers, uschar ** errstr)
2021 {
2022 int rc;
2023 exim_gnutls_state_st * state = NULL;
2024
2025 /* Check for previous activation */
2026 if (tls_in.active.sock >= 0)
2027 {
2028 tls_error(US"STARTTLS received after TLS started", US "", NULL, errstr);
2029 smtp_printf("554 Already in TLS\r\n", FALSE);
2030 return FAIL;
2031 }
2032
2033 /* Initialize the library. If it fails, it will already have logged the error
2034 and sent an SMTP response. */
2035
2036 DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
2037
2038 if ((rc = tls_init(NULL, tls_certificate, tls_privatekey,
2039 NULL, tls_verify_certificates, tls_crl,
2040 require_ciphers, &state, &tls_in, errstr)) != OK) return rc;
2041
2042 /* If this is a host for which certificate verification is mandatory or
2043 optional, set up appropriately. */
2044
2045 if (verify_check_host(&tls_verify_hosts) == OK)
2046 {
2047 DEBUG(D_tls)
2048 debug_printf("TLS: a client certificate will be required.\n");
2049 state->verify_requirement = VERIFY_REQUIRED;
2050 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2051 }
2052 else if (verify_check_host(&tls_try_verify_hosts) == OK)
2053 {
2054 DEBUG(D_tls)
2055 debug_printf("TLS: a client certificate will be requested but not required.\n");
2056 state->verify_requirement = VERIFY_OPTIONAL;
2057 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2058 }
2059 else
2060 {
2061 DEBUG(D_tls)
2062 debug_printf("TLS: a client certificate will not be requested.\n");
2063 state->verify_requirement = VERIFY_NONE;
2064 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2065 }
2066
2067 #ifndef DISABLE_EVENT
2068 if (event_action)
2069 {
2070 state->event_action = event_action;
2071 gnutls_session_set_ptr(state->session, state);
2072 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2073 }
2074 #endif
2075
2076 /* Register SNI handling; always, even if not in tls_certificate, so that the
2077 expansion variable $tls_sni is always available. */
2078
2079 gnutls_handshake_set_post_client_hello_function(state->session,
2080 exim_sni_handling_cb);
2081
2082 /* Set context and tell client to go ahead, except in the case of TLS startup
2083 on connection, where outputting anything now upsets the clients and tends to
2084 make them disconnect. We need to have an explicit fflush() here, to force out
2085 the response. Other smtp_printf() calls do not need it, because in non-TLS
2086 mode, the fflush() happens when smtp_getc() is called. */
2087
2088 if (!state->tlsp->on_connect)
2089 {
2090 smtp_printf("220 TLS go ahead\r\n", FALSE);
2091 fflush(smtp_out);
2092 }
2093
2094 /* Now negotiate the TLS session. We put our own timer on it, since it seems
2095 that the GnuTLS library doesn't.
2096 From 3.1.0 there is gnutls_handshake_set_timeout() - but it requires you
2097 to set (and clear down afterwards) up a pull-timeout callback function that does
2098 a select, so we're no better off unless avoiding signals becomes an issue. */
2099
2100 gnutls_transport_set_ptr2(state->session,
2101 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
2102 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
2103 state->fd_in = fileno(smtp_in);
2104 state->fd_out = fileno(smtp_out);
2105
2106 sigalrm_seen = FALSE;
2107 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
2108 do
2109 rc = gnutls_handshake(state->session);
2110 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
2111 ALARM_CLR(0);
2112
2113 if (rc != GNUTLS_E_SUCCESS)
2114 {
2115 /* It seems that, except in the case of a timeout, we have to close the
2116 connection right here; otherwise if the other end is running OpenSSL it hangs
2117 until the server times out. */
2118
2119 if (sigalrm_seen)
2120 {
2121 tls_error(US"gnutls_handshake", US"timed out", NULL, errstr);
2122 gnutls_db_remove_session(state->session);
2123 }
2124 else
2125 {
2126 tls_error(US"gnutls_handshake", US gnutls_strerror(rc), NULL, errstr);
2127 (void) gnutls_alert_send_appropriate(state->session, rc);
2128 gnutls_deinit(state->session);
2129 gnutls_certificate_free_credentials(state->x509_cred);
2130 millisleep(500);
2131 shutdown(state->fd_out, SHUT_WR);
2132 for (rc = 1024; fgetc(smtp_in) != EOF && rc > 0; ) rc--; /* drain skt */
2133 (void)fclose(smtp_out);
2134 (void)fclose(smtp_in);
2135 smtp_out = smtp_in = NULL;
2136 }
2137
2138 return FAIL;
2139 }
2140
2141 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
2142
2143 /* Verify after the fact */
2144
2145 if (!verify_certificate(state, errstr))
2146 {
2147 if (state->verify_requirement != VERIFY_OPTIONAL)
2148 {
2149 (void) tls_error(US"certificate verification failed", *errstr, NULL, errstr);
2150 return FAIL;
2151 }
2152 DEBUG(D_tls)
2153 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
2154 *errstr);
2155 }
2156
2157 /* Figure out peer DN, and if authenticated, etc. */
2158
2159 if ((rc = peer_status(state, NULL)) != OK) return rc;
2160
2161 /* Sets various Exim expansion variables; always safe within server */
2162
2163 extract_exim_vars_from_tls_state(state);
2164
2165 /* TLS has been set up. Adjust the input functions to read via TLS,
2166 and initialize appropriately. */
2167
2168 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
2169
2170 receive_getc = tls_getc;
2171 receive_getbuf = tls_getbuf;
2172 receive_get_cache = tls_get_cache;
2173 receive_ungetc = tls_ungetc;
2174 receive_feof = tls_feof;
2175 receive_ferror = tls_ferror;
2176 receive_smtp_buffered = tls_smtp_buffered;
2177
2178 return OK;
2179 }
2180
2181
2182
2183
2184 static void
2185 tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
2186 smtp_transport_options_block * ob)
2187 {
2188 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
2189 {
2190 state->exp_tls_verify_cert_hostnames =
2191 #ifdef SUPPORT_I18N
2192 string_domain_utf8_to_alabel(host->name, NULL);
2193 #else
2194 host->name;
2195 #endif
2196 DEBUG(D_tls)
2197 debug_printf("TLS: server cert verification includes hostname: \"%s\".\n",
2198 state->exp_tls_verify_cert_hostnames);
2199 }
2200 }
2201
2202
2203
2204
2205 #ifdef SUPPORT_DANE
2206 /* Given our list of RRs from the TLSA lookup, build a lookup block in
2207 GnuTLS-DANE's preferred format. Hang it on the state str for later
2208 use in DANE verification.
2209
2210 We point at the dnsa data not copy it, so it must remain valid until
2211 after verification is done.*/
2212
2213 static BOOL
2214 dane_tlsa_load(exim_gnutls_state_st * state, dns_answer * dnsa)
2215 {
2216 dns_record * rr;
2217 dns_scan dnss;
2218 int i;
2219 const char ** dane_data;
2220 int * dane_data_len;
2221
2222 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS), i = 1;
2223 rr;
2224 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2225 ) if (rr->type == T_TLSA) i++;
2226
2227 dane_data = store_get(i * sizeof(uschar *));
2228 dane_data_len = store_get(i * sizeof(int));
2229
2230 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS), i = 0;
2231 rr;
2232 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2233 ) if (rr->type == T_TLSA && rr->size > 3)
2234 {
2235 const uschar * p = rr->data;
2236 uint8_t usage = p[0], sel = p[1], type = p[2];
2237
2238 DEBUG(D_tls)
2239 debug_printf("TLSA: %d %d %d size %d\n", usage, sel, type, rr->size);
2240
2241 if ( (usage != DANESSL_USAGE_DANE_TA && usage != DANESSL_USAGE_DANE_EE)
2242 || (sel != 0 && sel != 1)
2243 )
2244 continue;
2245 switch(type)
2246 {
2247 case 0: /* Full: cannot check at present */
2248 break;
2249 case 1: if (rr->size != 3 + 256/8) continue; /* sha2-256 */
2250 break;
2251 case 2: if (rr->size != 3 + 512/8) continue; /* sha2-512 */
2252 break;
2253 default: continue;
2254 }
2255
2256 tls_out.tlsa_usage |= 1<<usage;
2257 dane_data[i] = CS p;
2258 dane_data_len[i++] = rr->size;
2259 }
2260
2261 if (!i) return FALSE;
2262
2263 dane_data[i] = NULL;
2264 dane_data_len[i] = 0;
2265
2266 state->dane_data = (char * const *)dane_data;
2267 state->dane_data_len = dane_data_len;
2268 return TRUE;
2269 }
2270 #endif
2271
2272
2273
2274 /*************************************************
2275 * Start a TLS session in a client *
2276 *************************************************/
2277
2278 /* Called from the smtp transport after STARTTLS has been accepted.
2279
2280 Arguments:
2281 fd the fd of the connection
2282 host connected host (for messages and option-tests)
2283 addr the first address (not used)
2284 tb transport (always smtp)
2285 tlsa_dnsa non-NULL, either request or require dane for this host, and
2286 a TLSA record found. Therefore, dane verify required.
2287 Which implies cert must be requested and supplied, dane
2288 verify must pass, and cert verify irrelevant (incl.
2289 hostnames), and (caller handled) require_tls
2290 tlsp record details of channel configuration
2291 errstr error string pointer
2292
2293 Returns: Pointer to TLS session context, or NULL on error
2294 */
2295
2296 void *
2297 tls_client_start(int fd, host_item *host,
2298 address_item *addr ARG_UNUSED,
2299 transport_instance * tb,
2300 #ifdef SUPPORT_DANE
2301 dns_answer * tlsa_dnsa,
2302 #endif
2303 tls_support * tlsp, uschar ** errstr)
2304 {
2305 smtp_transport_options_block *ob = tb
2306 ? (smtp_transport_options_block *)tb->options_block
2307 : &smtp_transport_option_defaults;
2308 int rc;
2309 exim_gnutls_state_st * state = NULL;
2310 uschar *cipher_list = NULL;
2311
2312 #ifndef DISABLE_OCSP
2313 BOOL require_ocsp =
2314 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
2315 BOOL request_ocsp = require_ocsp ? TRUE
2316 : verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
2317 #endif
2318
2319 DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
2320
2321 #ifdef SUPPORT_DANE
2322 if (tlsa_dnsa && ob->dane_require_tls_ciphers)
2323 {
2324 /* not using expand_check_tlsvar because not yet in state */
2325 if (!expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
2326 &cipher_list, errstr))
2327 return NULL;
2328 cipher_list = cipher_list && *cipher_list
2329 ? ob->dane_require_tls_ciphers : ob->tls_require_ciphers;
2330 }
2331 #endif
2332
2333 if (!cipher_list)
2334 cipher_list = ob->tls_require_ciphers;
2335
2336 if (tls_init(host, ob->tls_certificate, ob->tls_privatekey,
2337 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
2338 cipher_list, &state, tlsp, errstr) != OK)
2339 return NULL;
2340
2341 {
2342 int dh_min_bits = ob->tls_dh_min_bits;
2343 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
2344 {
2345 DEBUG(D_tls)
2346 debug_printf("WARNING: tls_dh_min_bits far too low,"
2347 " clamping %d up to %d\n",
2348 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
2349 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
2350 }
2351
2352 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
2353 " acceptable bits to %d\n",
2354 dh_min_bits);
2355 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
2356 }
2357
2358 /* Stick to the old behaviour for compatibility if tls_verify_certificates is
2359 set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
2360 the specified host patterns if one of them is defined */
2361
2362 #ifdef SUPPORT_DANE
2363 if (tlsa_dnsa && dane_tlsa_load(state, tlsa_dnsa))
2364 {
2365 DEBUG(D_tls)
2366 debug_printf("TLS: server certificate DANE required.\n");
2367 state->verify_requirement = VERIFY_DANE;
2368 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2369 }
2370 else
2371 #endif
2372 if ( ( state->exp_tls_verify_certificates
2373 && !ob->tls_verify_hosts
2374 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2375 )
2376 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
2377 )
2378 {
2379 tls_client_setup_hostname_checks(host, state, ob);
2380 DEBUG(D_tls)
2381 debug_printf("TLS: server certificate verification required.\n");
2382 state->verify_requirement = VERIFY_REQUIRED;
2383 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2384 }
2385 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
2386 {
2387 tls_client_setup_hostname_checks(host, state, ob);
2388 DEBUG(D_tls)
2389 debug_printf("TLS: server certificate verification optional.\n");
2390 state->verify_requirement = VERIFY_OPTIONAL;
2391 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2392 }
2393 else
2394 {
2395 DEBUG(D_tls)
2396 debug_printf("TLS: server certificate verification not required.\n");
2397 state->verify_requirement = VERIFY_NONE;
2398 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2399 }
2400
2401 #ifndef DISABLE_OCSP
2402 /* supported since GnuTLS 3.1.3 */
2403 if (request_ocsp)
2404 {
2405 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
2406 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
2407 NULL, 0, NULL)) != OK)
2408 {
2409 tls_error(US"cert-status-req", US gnutls_strerror(rc), state->host, errstr);
2410 return NULL;
2411 }
2412 tlsp->ocsp = OCSP_NOT_RESP;
2413 }
2414 #endif
2415
2416 #ifndef DISABLE_EVENT
2417 if (tb && tb->event_action)
2418 {
2419 state->event_action = tb->event_action;
2420 gnutls_session_set_ptr(state->session, state);
2421 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2422 }
2423 #endif
2424
2425 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) fd);
2426 state->fd_in = fd;
2427 state->fd_out = fd;
2428
2429 DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
2430 /* There doesn't seem to be a built-in timeout on connection. */
2431
2432 sigalrm_seen = FALSE;
2433 ALARM(ob->command_timeout);
2434 do
2435 rc = gnutls_handshake(state->session);
2436 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
2437 ALARM_CLR(0);
2438
2439 if (rc != GNUTLS_E_SUCCESS)
2440 {
2441 if (sigalrm_seen)
2442 {
2443 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
2444 tls_error(US"gnutls_handshake", US"timed out", state->host, errstr);
2445 }
2446 else
2447 tls_error(US"gnutls_handshake", US gnutls_strerror(rc), state->host, errstr);
2448 return NULL;
2449 }
2450
2451 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
2452
2453 /* Verify late */
2454
2455 if (!verify_certificate(state, errstr))
2456 {
2457 tls_error(US"certificate verification failed", *errstr, state->host, errstr);
2458 return NULL;
2459 }
2460
2461 #ifndef DISABLE_OCSP
2462 if (require_ocsp)
2463 {
2464 DEBUG(D_tls)
2465 {
2466 gnutls_datum_t stapling;
2467 gnutls_ocsp_resp_t resp;
2468 gnutls_datum_t printed;
2469 if ( (rc= gnutls_ocsp_status_request_get(state->session, &stapling)) == 0
2470 && (rc= gnutls_ocsp_resp_init(&resp)) == 0
2471 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
2472 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_FULL, &printed)) == 0
2473 )
2474 {
2475 debug_printf("%.4096s", printed.data);
2476 gnutls_free(printed.data);
2477 }
2478 else
2479 (void) tls_error(US"ocsp decode", US gnutls_strerror(rc), state->host, errstr);
2480 }
2481
2482 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
2483 {
2484 tlsp->ocsp = OCSP_FAILED;
2485 tls_error(US"certificate status check failed", NULL, state->host, errstr);
2486 return NULL;
2487 }
2488 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
2489 tlsp->ocsp = OCSP_VFIED;
2490 }
2491 #endif
2492
2493 /* Figure out peer DN, and if authenticated, etc. */
2494
2495 if (peer_status(state, errstr) != OK)
2496 return NULL;
2497
2498 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
2499
2500 extract_exim_vars_from_tls_state(state);
2501
2502 return state;
2503 }
2504
2505
2506
2507
2508 /*************************************************
2509 * Close down a TLS session *
2510 *************************************************/
2511
2512 /* This is also called from within a delivery subprocess forked from the
2513 daemon, to shut down the TLS library, without actually doing a shutdown (which
2514 would tamper with the TLS session in the parent process).
2515
2516 Arguments:
2517 ct_ctx client context pointer, or NULL for the one global server context
2518 shutdown 1 if TLS close-alert is to be sent,
2519 2 if also response to be waited for
2520
2521 Returns: nothing
2522 */
2523
2524 void
2525 tls_close(void * ct_ctx, int shutdown)
2526 {
2527 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
2528
2529 if (!state->tlsp || state->tlsp->active.sock < 0) return; /* TLS was not active */
2530
2531 if (shutdown)
2532 {
2533 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
2534 shutdown > 1 ? " (with response-wait)" : "");
2535
2536 ALARM(2);
2537 gnutls_bye(state->session, shutdown > 1 ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR);
2538 ALARM_CLR(0);
2539 }
2540
2541 gnutls_deinit(state->session);
2542 gnutls_certificate_free_credentials(state->x509_cred);
2543
2544
2545 state->tlsp->active.sock = -1;
2546 state->tlsp->active.tls_ctx = NULL;
2547 if (state->xfer_buffer) store_free(state->xfer_buffer);
2548 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
2549 }
2550
2551
2552
2553
2554 static BOOL
2555 tls_refill(unsigned lim)
2556 {
2557 exim_gnutls_state_st * state = &state_server;
2558 ssize_t inbytes;
2559
2560 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
2561 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
2562
2563 sigalrm_seen = FALSE;
2564 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
2565 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
2566 MIN(ssl_xfer_buffer_size, lim));
2567 if (smtp_receive_timeout > 0) ALARM_CLR(0);
2568
2569 if (had_command_timeout) /* set by signal handler */
2570 smtp_command_timeout_exit(); /* does not return */
2571 if (had_command_sigterm)
2572 smtp_command_sigterm_exit();
2573 if (had_data_timeout)
2574 smtp_data_timeout_exit();
2575 if (had_data_sigint)
2576 smtp_data_sigint_exit();
2577
2578 /* Timeouts do not get this far. A zero-byte return appears to mean that the
2579 TLS session has been closed down, not that the socket itself has been closed
2580 down. Revert to non-TLS handling. */
2581
2582 if (sigalrm_seen)
2583 {
2584 DEBUG(D_tls) debug_printf("Got tls read timeout\n");
2585 state->xfer_error = TRUE;
2586 return FALSE;
2587 }
2588
2589 else if (inbytes == 0)
2590 {
2591 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2592
2593 receive_getc = smtp_getc;
2594 receive_getbuf = smtp_getbuf;
2595 receive_get_cache = smtp_get_cache;
2596 receive_ungetc = smtp_ungetc;
2597 receive_feof = smtp_feof;
2598 receive_ferror = smtp_ferror;
2599 receive_smtp_buffered = smtp_buffered;
2600
2601 gnutls_deinit(state->session);
2602 gnutls_certificate_free_credentials(state->x509_cred);
2603
2604 state->session = NULL;
2605 state->tlsp->active.sock = -1;
2606 state->tlsp->active.tls_ctx = NULL;
2607 state->tlsp->bits = 0;
2608 state->tlsp->certificate_verified = FALSE;
2609 tls_channelbinding_b64 = NULL;
2610 state->tlsp->cipher = NULL;
2611 state->tlsp->peercert = NULL;
2612 state->tlsp->peerdn = NULL;
2613
2614 return FALSE;
2615 }
2616
2617 /* Handle genuine errors */
2618
2619 else if (inbytes < 0)
2620 {
2621 debug_printf("%s: err from gnutls_record_recv(\n", __FUNCTION__);
2622 record_io_error(state, (int) inbytes, US"recv", NULL);
2623 state->xfer_error = TRUE;
2624 return FALSE;
2625 }
2626 #ifndef DISABLE_DKIM
2627 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
2628 #endif
2629 state->xfer_buffer_hwm = (int) inbytes;
2630 state->xfer_buffer_lwm = 0;
2631 return TRUE;
2632 }
2633
2634 /*************************************************
2635 * TLS version of getc *
2636 *************************************************/
2637
2638 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
2639 it refills the buffer via the GnuTLS reading function.
2640 Only used by the server-side TLS.
2641
2642 This feeds DKIM and should be used for all message-body reads.
2643
2644 Arguments: lim Maximum amount to read/buffer
2645 Returns: the next character or EOF
2646 */
2647
2648 int
2649 tls_getc(unsigned lim)
2650 {
2651 exim_gnutls_state_st * state = &state_server;
2652
2653 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
2654 if (!tls_refill(lim))
2655 return state->xfer_error ? EOF : smtp_getc(lim);
2656
2657 /* Something in the buffer; return next uschar */
2658
2659 return state->xfer_buffer[state->xfer_buffer_lwm++];
2660 }
2661
2662 uschar *
2663 tls_getbuf(unsigned * len)
2664 {
2665 exim_gnutls_state_st * state = &state_server;
2666 unsigned size;
2667 uschar * buf;
2668
2669 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
2670 if (!tls_refill(*len))
2671 {
2672 if (!state->xfer_error) return smtp_getbuf(len);
2673 *len = 0;
2674 return NULL;
2675 }
2676
2677 if ((size = state->xfer_buffer_hwm - state->xfer_buffer_lwm) > *len)
2678 size = *len;
2679 buf = &state->xfer_buffer[state->xfer_buffer_lwm];
2680 state->xfer_buffer_lwm += size;
2681 *len = size;
2682 return buf;
2683 }
2684
2685
2686 void
2687 tls_get_cache()
2688 {
2689 #ifndef DISABLE_DKIM
2690 exim_gnutls_state_st * state = &state_server;
2691 int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
2692 if (n > 0)
2693 dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
2694 #endif
2695 }
2696
2697
2698 BOOL
2699 tls_could_read(void)
2700 {
2701 return state_server.xfer_buffer_lwm < state_server.xfer_buffer_hwm
2702 || gnutls_record_check_pending(state_server.session) > 0;
2703 }
2704
2705
2706
2707
2708 /*************************************************
2709 * Read bytes from TLS channel *
2710 *************************************************/
2711
2712 /* This does not feed DKIM, so if the caller uses this for reading message body,
2713 then the caller must feed DKIM.
2714
2715 Arguments:
2716 ct_ctx client context pointer, or NULL for the one global server context
2717 buff buffer of data
2718 len size of buffer
2719
2720 Returns: the number of bytes read
2721 -1 after a failed read, including EOF
2722 */
2723
2724 int
2725 tls_read(void * ct_ctx, uschar *buff, size_t len)
2726 {
2727 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
2728 ssize_t inbytes;
2729
2730 if (len > INT_MAX)
2731 len = INT_MAX;
2732
2733 if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
2734 DEBUG(D_tls)
2735 debug_printf("*** PROBABLY A BUG *** " \
2736 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
2737 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
2738
2739 DEBUG(D_tls)
2740 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
2741 state->session, buff, len);
2742
2743 inbytes = gnutls_record_recv(state->session, buff, len);
2744 if (inbytes > 0) return inbytes;
2745 if (inbytes == 0)
2746 {
2747 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2748 }
2749 else
2750 {
2751 debug_printf("%s: err from gnutls_record_recv(\n", __FUNCTION__);
2752 record_io_error(state, (int)inbytes, US"recv", NULL);
2753 }
2754
2755 return -1;
2756 }
2757
2758
2759
2760
2761 /*************************************************
2762 * Write bytes down TLS channel *
2763 *************************************************/
2764
2765 /*
2766 Arguments:
2767 ct_ctx client context pointer, or NULL for the one global server context
2768 buff buffer of data
2769 len number of bytes
2770 more more data expected soon
2771
2772 Returns: the number of bytes after a successful write,
2773 -1 after a failed write
2774 */
2775
2776 int
2777 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
2778 {
2779 ssize_t outbytes;
2780 size_t left = len;
2781 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
2782 #ifdef SUPPORT_CORK
2783 static BOOL corked = FALSE;
2784
2785 if (more && !corked) gnutls_record_cork(state->session);
2786 #endif
2787
2788 DEBUG(D_tls) debug_printf("%s(%p, " SIZE_T_FMT "%s)\n", __FUNCTION__,
2789 buff, left, more ? ", more" : "");
2790
2791 while (left > 0)
2792 {
2793 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
2794 buff, left);
2795 outbytes = gnutls_record_send(state->session, buff, left);
2796
2797 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
2798 if (outbytes < 0)
2799 {
2800 DEBUG(D_tls) debug_printf("%s: gnutls_record_send err\n", __FUNCTION__);
2801 record_io_error(state, outbytes, US"send", NULL);
2802 return -1;
2803 }
2804 if (outbytes == 0)
2805 {
2806 record_io_error(state, 0, US"send", US"TLS channel closed on write");
2807 return -1;
2808 }
2809
2810 left -= outbytes;
2811 buff += outbytes;
2812 }
2813
2814 if (len > INT_MAX)
2815 {
2816 DEBUG(D_tls)
2817 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
2818 len);
2819 len = INT_MAX;
2820 }
2821
2822 #ifdef SUPPORT_CORK
2823 if (more != corked)
2824 {
2825 if (!more) (void) gnutls_record_uncork(state->session, 0);
2826 corked = more;
2827 }
2828 #endif
2829
2830 return (int) len;
2831 }
2832
2833
2834
2835
2836 /*************************************************
2837 * Random number generation *
2838 *************************************************/
2839
2840 /* Pseudo-random number generation. The result is not expected to be
2841 cryptographically strong but not so weak that someone will shoot themselves
2842 in the foot using it as a nonce in input in some email header scheme or
2843 whatever weirdness they'll twist this into. The result should handle fork()
2844 and avoid repeating sequences. OpenSSL handles that for us.
2845
2846 Arguments:
2847 max range maximum
2848 Returns a random number in range [0, max-1]
2849 */
2850
2851 #ifdef HAVE_GNUTLS_RND
2852 int
2853 vaguely_random_number(int max)
2854 {
2855 unsigned int r;
2856 int i, needed_len;
2857 uschar *p;
2858 uschar smallbuf[sizeof(r)];
2859
2860 if (max <= 1)
2861 return 0;
2862
2863 needed_len = sizeof(r);
2864 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
2865 * asked for a number less than 10. */
2866 for (r = max, i = 0; r; ++i)
2867 r >>= 1;
2868 i = (i + 7) / 8;
2869 if (i < needed_len)
2870 needed_len = i;
2871
2872 i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
2873 if (i < 0)
2874 {
2875 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
2876 return vaguely_random_number_fallback(max);
2877 }
2878 r = 0;
2879 for (p = smallbuf; needed_len; --needed_len, ++p)
2880 {
2881 r *= 256;
2882 r += *p;
2883 }
2884
2885 /* We don't particularly care about weighted results; if someone wants
2886 * smooth distribution and cares enough then they should submit a patch then. */
2887 return r % max;
2888 }
2889 #else /* HAVE_GNUTLS_RND */
2890 int
2891 vaguely_random_number(int max)
2892 {
2893 return vaguely_random_number_fallback(max);
2894 }
2895 #endif /* HAVE_GNUTLS_RND */
2896
2897
2898
2899
2900 /*************************************************
2901 * Let tls_require_ciphers be checked at startup *
2902 *************************************************/
2903
2904 /* The tls_require_ciphers option, if set, must be something which the
2905 library can parse.
2906
2907 Returns: NULL on success, or error message
2908 */
2909
2910 uschar *
2911 tls_validate_require_cipher(void)
2912 {
2913 int rc;
2914 uschar *expciphers = NULL;
2915 gnutls_priority_t priority_cache;
2916 const char *errpos;
2917 uschar * dummy_errstr;
2918
2919 #define validate_check_rc(Label) do { \
2920 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
2921 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
2922 #define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
2923
2924 if (exim_gnutls_base_init_done)
2925 log_write(0, LOG_MAIN|LOG_PANIC,
2926 "already initialised GnuTLS, Exim developer bug");
2927
2928 #ifdef HAVE_GNUTLS_PKCS11
2929 if (!gnutls_allow_auto_pkcs11)
2930 {
2931 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
2932 validate_check_rc(US"gnutls_pkcs11_init");
2933 }
2934 #endif
2935 rc = gnutls_global_init();
2936 validate_check_rc(US"gnutls_global_init()");
2937 exim_gnutls_base_init_done = TRUE;
2938
2939 if (!(tls_require_ciphers && *tls_require_ciphers))
2940 return_deinit(NULL);
2941
2942 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
2943 &dummy_errstr))
2944 return_deinit(US"failed to expand tls_require_ciphers");
2945
2946 if (!(expciphers && *expciphers))
2947 return_deinit(NULL);
2948
2949 DEBUG(D_tls)
2950 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2951
2952 rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
2953 validate_check_rc(string_sprintf(
2954 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
2955 expciphers, errpos - CS expciphers, errpos));
2956
2957 #undef return_deinit
2958 #undef validate_check_rc
2959 gnutls_global_deinit();
2960
2961 return NULL;
2962 }
2963
2964
2965
2966
2967 /*************************************************
2968 * Report the library versions. *
2969 *************************************************/
2970
2971 /* See a description in tls-openssl.c for an explanation of why this exists.
2972
2973 Arguments: a FILE* to print the results to
2974 Returns: nothing
2975 */
2976
2977 void
2978 tls_version_report(FILE *f)
2979 {
2980 fprintf(f, "Library version: GnuTLS: Compile: %s\n"
2981 " Runtime: %s\n",
2982 LIBGNUTLS_VERSION,
2983 gnutls_check_version(NULL));
2984 }
2985
2986 /* vi: aw ai sw=2
2987 */
2988 /* End of tls-gnu.c */