c582af79f0c43472c434e6881c1ae9e666005fbc
[exim.git] / src / src / tls-gnu.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2012 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Copyright (c) Phil Pennock 2012 */
9
10 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
11 one of the available supported implementations. This file is #included into
12 tls.c when USE_GNUTLS has been set.
13
14 The code herein is a revamp of GnuTLS integration using the current APIs; the
15 original tls-gnu.c was based on a patch which was contributed by Nikos
16 Mavroyanopoulos. The revamp is partially a rewrite, partially cut&paste as
17 appropriate.
18
19 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20 which is not widely deployed by OS vendors. Will note issues below, which may
21 assist in updating the code in the future. Another sources of hints is
22 mod_gnutls for Apache (SNI callback registration and handling).
23
24 Keeping client and server variables more split than before and is currently
25 the norm, in anticipation of TLS in ACL callouts.
26
27 I wanted to switch to gnutls_certificate_set_verify_function() so that
28 certificate rejection could happen during handshake where it belongs, rather
29 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
31
32 (I wasn't looking for libraries quite that old, when updating to get rid of
33 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34 require current GnuTLS, then we'll drop support for the ancient libraries).
35 */
36
37 #include <gnutls/gnutls.h>
38 /* needed for cert checks in verification and DN extraction: */
39 #include <gnutls/x509.h>
40 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41 #include <gnutls/crypto.h>
42
43 /* GnuTLS 2 vs 3
44
45 GnuTLS 3 only:
46 gnutls_global_set_audit_log_function()
47
48 Changes:
49 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
50 */
51
52 /* Local static variables for GnuTLS */
53
54 /* Values for verify_requirement */
55
56 enum peer_verify_requirement { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED };
57
58 /* This holds most state for server or client; with this, we can set up an
59 outbound TLS-enabled connection in an ACL callout, while not stomping all
60 over the TLS variables available for expansion.
61
62 Some of these correspond to variables in globals.c; those variables will
63 be set to point to content in one of these instances, as appropriate for
64 the stage of the process lifetime.
65
66 Not handled here: global tls_channelbinding_b64.
67 */
68
69 typedef struct exim_gnutls_state {
70 gnutls_session_t session;
71 gnutls_certificate_credentials_t x509_cred;
72 gnutls_priority_t priority_cache;
73 enum peer_verify_requirement verify_requirement;
74 int fd_in;
75 int fd_out;
76 BOOL peer_cert_verified;
77 BOOL trigger_sni_changes;
78 BOOL have_set_peerdn;
79 const struct host_item *host;
80 uschar *peerdn;
81 uschar *ciphersuite;
82 uschar *received_sni;
83
84 const uschar *tls_certificate;
85 const uschar *tls_privatekey;
86 const uschar *tls_sni; /* client send only, not received */
87 const uschar *tls_verify_certificates;
88 const uschar *tls_crl;
89 const uschar *tls_require_ciphers;
90 uschar *exp_tls_certificate;
91 uschar *exp_tls_privatekey;
92 uschar *exp_tls_sni;
93 uschar *exp_tls_verify_certificates;
94 uschar *exp_tls_crl;
95 uschar *exp_tls_require_ciphers;
96
97 tls_support *tlsp; /* set in tls_init() */
98
99 uschar *xfer_buffer;
100 int xfer_buffer_lwm;
101 int xfer_buffer_hwm;
102 int xfer_eof;
103 int xfer_error;
104 } exim_gnutls_state_st;
105
106 static const exim_gnutls_state_st exim_gnutls_state_init = {
107 NULL, NULL, NULL, VERIFY_NONE, -1, -1, FALSE, FALSE, FALSE,
108 NULL, NULL, NULL, NULL,
109 NULL, NULL, NULL, NULL, NULL, NULL,
110 NULL, NULL, NULL, NULL, NULL, NULL,
111 NULL,
112 NULL, 0, 0, 0, 0,
113 };
114
115 /* Not only do we have our own APIs which don't pass around state, assuming
116 it's held in globals, GnuTLS doesn't appear to let us register callback data
117 for callbacks, or as part of the session, so we have to keep a "this is the
118 context we're currently dealing with" pointer and rely upon being
119 single-threaded to keep from processing data on an inbound TLS connection while
120 talking to another TLS connection for an outbound check. This does mean that
121 there's no way for heart-beats to be responded to, for the duration of the
122 second connection. */
123
124 static exim_gnutls_state_st state_server, state_client;
125
126 /* dh_params are initialised once within the lifetime of a process using TLS;
127 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
128 don't want to repeat this. */
129
130 static gnutls_dh_params_t dh_server_params = NULL;
131
132 /* No idea how this value was chosen; preserving it. Default is 3600. */
133
134 static const int ssl_session_timeout = 200;
135
136 static const char * const exim_default_gnutls_priority = "NORMAL";
137
138 /* Guard library core initialisation */
139
140 static BOOL exim_gnutls_base_init_done = FALSE;
141
142
143 /* ------------------------------------------------------------------------ */
144 /* macros */
145
146 #define MAX_HOST_LEN 255
147
148 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
149 the library logging; a value less than 0 disables the calls to set up logging
150 callbacks. */
151 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
152 #define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
153 #endif
154
155 #ifndef EXIM_CLIENT_DH_MIN_BITS
156 #define EXIM_CLIENT_DH_MIN_BITS 1024
157 #endif
158
159 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
160 can ask for a bit-strength. Without that, we stick to the constant we had
161 before, for now. */
162 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
163 #define EXIM_SERVER_DH_BITS_PRE2_12 1024
164 #endif
165
166 #define exim_gnutls_err_check(Label) do { \
167 if (rc != GNUTLS_E_SUCCESS) { return tls_error((Label), gnutls_strerror(rc), host); } } while (0)
168
169 #define expand_check_tlsvar(Varname) expand_check(state->Varname, US #Varname, &state->exp_##Varname)
170
171 #if GNUTLS_VERSION_NUMBER >= 0x020c00
172 #define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
173 #define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
174 #define HAVE_GNUTLS_RND
175 #endif
176
177
178
179
180 /* ------------------------------------------------------------------------ */
181 /* Callback declarations */
182
183 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
184 static void exim_gnutls_logger_cb(int level, const char *message);
185 #endif
186
187 static int exim_sni_handling_cb(gnutls_session_t session);
188
189
190
191
192 /* ------------------------------------------------------------------------ */
193 /* Static functions */
194
195 /*************************************************
196 * Handle TLS error *
197 *************************************************/
198
199 /* Called from lots of places when errors occur before actually starting to do
200 the TLS handshake, that is, while the session is still in clear. Always returns
201 DEFER for a server and FAIL for a client so that most calls can use "return
202 tls_error(...)" to do this processing and then give an appropriate return. A
203 single function is used for both server and client, because it is called from
204 some shared functions.
205
206 Argument:
207 prefix text to include in the logged error
208 msg additional error string (may be NULL)
209 usually obtained from gnutls_strerror()
210 host NULL if setting up a server;
211 the connected host if setting up a client
212
213 Returns: OK/DEFER/FAIL
214 */
215
216 static int
217 tls_error(const uschar *prefix, const char *msg, const host_item *host)
218 {
219 if (host)
220 {
221 log_write(0, LOG_MAIN, "TLS error on connection to %s [%s] (%s)%s%s",
222 host->name, host->address, prefix, msg ? ": " : "", msg ? msg : "");
223 return FAIL;
224 }
225 else
226 {
227 uschar *conn_info = smtp_get_connection_info();
228 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
229 conn_info += 5;
230 log_write(0, LOG_MAIN, "TLS error on %s (%s)%s%s",
231 conn_info, prefix, msg ? ": " : "", msg ? msg : "");
232 return DEFER;
233 }
234 }
235
236
237
238
239 /*************************************************
240 * Deal with logging errors during I/O *
241 *************************************************/
242
243 /* We have to get the identity of the peer from saved data.
244
245 Argument:
246 state the current GnuTLS exim state container
247 rc the GnuTLS error code, or 0 if it's a local error
248 when text identifying read or write
249 text local error text when ec is 0
250
251 Returns: nothing
252 */
253
254 static void
255 record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
256 {
257 const char *msg;
258
259 if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
260 msg = CS string_sprintf("%s: %s", US gnutls_strerror(rc),
261 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
262 else
263 msg = gnutls_strerror(rc);
264
265 tls_error(when, msg, state->host);
266 }
267
268
269
270
271 /*************************************************
272 * Set various Exim expansion vars *
273 *************************************************/
274
275 /* We set various Exim global variables from the state, once a session has
276 been established. With TLS callouts, may need to change this to stack
277 variables, or just re-call it with the server state after client callout
278 has finished.
279
280 Make sure anything set here is inset in tls_getc().
281
282 Sets:
283 tls_active fd
284 tls_bits strength indicator
285 tls_certificate_verified bool indicator
286 tls_channelbinding_b64 for some SASL mechanisms
287 tls_cipher a string
288 tls_peerdn a string
289 tls_sni a (UTF-8) string
290
291 Argument:
292 state the relevant exim_gnutls_state_st *
293 */
294
295 static void
296 extract_exim_vars_from_tls_state(exim_gnutls_state_st *state, BOOL is_server)
297 {
298 gnutls_cipher_algorithm_t cipher;
299 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
300 int old_pool;
301 int rc;
302 gnutls_datum_t channel;
303 #endif
304
305 state->tlsp->active = state->fd_out;
306
307 cipher = gnutls_cipher_get(state->session);
308 /* returns size in "bytes" */
309 state->tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
310
311 state->tlsp->cipher = state->ciphersuite;
312
313 DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
314
315 state->tlsp->certificate_verified = state->peer_cert_verified;
316
317 /* note that tls_channelbinding_b64 is not saved to the spool file, since it's
318 only available for use for authenticators while this TLS session is running. */
319
320 tls_channelbinding_b64 = NULL;
321 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
322 channel.data = NULL;
323 channel.size = 0;
324 rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
325 if (rc) {
326 DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
327 } else {
328 old_pool = store_pool;
329 store_pool = POOL_PERM;
330 tls_channelbinding_b64 = auth_b64encode(channel.data, (int)channel.size);
331 store_pool = old_pool;
332 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
333 }
334 #endif
335
336 state->tlsp->peerdn = state->peerdn;
337 state->tlsp->sni = state->received_sni;
338 }
339
340
341
342
343 /*************************************************
344 * Setup up DH parameters *
345 *************************************************/
346
347 /* Generating the D-H parameters may take a long time. They only need to
348 be re-generated every so often, depending on security policy. What we do is to
349 keep these parameters in a file in the spool directory. If the file does not
350 exist, we generate them. This means that it is easy to cause a regeneration.
351
352 The new file is written as a temporary file and renamed, so that an incomplete
353 file is never present. If two processes both compute some new parameters, you
354 waste a bit of effort, but it doesn't seem worth messing around with locking to
355 prevent this.
356
357 Returns: OK/DEFER/FAIL
358 */
359
360 static int
361 init_server_dh(void)
362 {
363 int fd, rc;
364 unsigned int dh_bits;
365 gnutls_datum m;
366 uschar filename_buf[PATH_MAX];
367 uschar *filename = NULL;
368 size_t sz;
369 uschar *exp_tls_dhparam;
370 BOOL use_file_in_spool = FALSE;
371 BOOL use_fixed_file = FALSE;
372 host_item *host = NULL; /* dummy for macros */
373
374 DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
375
376 rc = gnutls_dh_params_init(&dh_server_params);
377 exim_gnutls_err_check(US"gnutls_dh_params_init");
378
379 m.data = NULL;
380 m.size = 0;
381
382 if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam))
383 return DEFER;
384
385 if (!exp_tls_dhparam)
386 {
387 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
388 m.data = US std_dh_prime_default();
389 m.size = Ustrlen(m.data);
390 }
391 else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
392 use_file_in_spool = TRUE;
393 else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
394 {
395 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
396 return OK;
397 }
398 else if (exp_tls_dhparam[0] != '/')
399 {
400 m.data = US std_dh_prime_named(exp_tls_dhparam);
401 if (m.data == NULL)
402 return tls_error(US"No standard prime named", CS exp_tls_dhparam, NULL);
403 m.size = Ustrlen(m.data);
404 }
405 else
406 {
407 use_fixed_file = TRUE;
408 filename = exp_tls_dhparam;
409 }
410
411 if (m.data)
412 {
413 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
414 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
415 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
416 return OK;
417 }
418
419 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
420 /* If you change this constant, also change dh_param_fn_ext so that we can use a
421 different filename and ensure we have sufficient bits. */
422 dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
423 if (!dh_bits)
424 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL);
425 DEBUG(D_tls)
426 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
427 dh_bits);
428 #else
429 dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
430 DEBUG(D_tls)
431 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
432 dh_bits);
433 #endif
434
435 /* Some clients have hard-coded limits. */
436 if (dh_bits > tls_dh_max_bits)
437 {
438 DEBUG(D_tls)
439 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
440 tls_dh_max_bits);
441 dh_bits = tls_dh_max_bits;
442 }
443
444 if (use_file_in_spool)
445 {
446 if (!string_format(filename_buf, sizeof(filename_buf),
447 "%s/gnutls-params-%d", spool_directory, dh_bits))
448 return tls_error(US"overlong filename", NULL, NULL);
449 filename = filename_buf;
450 }
451
452 /* Open the cache file for reading and if successful, read it and set up the
453 parameters. */
454
455 fd = Uopen(filename, O_RDONLY, 0);
456 if (fd >= 0)
457 {
458 struct stat statbuf;
459 FILE *fp;
460 int saved_errno;
461
462 if (fstat(fd, &statbuf) < 0) /* EIO */
463 {
464 saved_errno = errno;
465 (void)close(fd);
466 return tls_error(US"TLS cache stat failed", strerror(saved_errno), NULL);
467 }
468 if (!S_ISREG(statbuf.st_mode))
469 {
470 (void)close(fd);
471 return tls_error(US"TLS cache not a file", NULL, NULL);
472 }
473 fp = fdopen(fd, "rb");
474 if (!fp)
475 {
476 saved_errno = errno;
477 (void)close(fd);
478 return tls_error(US"fdopen(TLS cache stat fd) failed",
479 strerror(saved_errno), NULL);
480 }
481
482 m.size = statbuf.st_size;
483 m.data = malloc(m.size);
484 if (m.data == NULL)
485 {
486 fclose(fp);
487 return tls_error(US"malloc failed", strerror(errno), NULL);
488 }
489 sz = fread(m.data, m.size, 1, fp);
490 if (!sz)
491 {
492 saved_errno = errno;
493 fclose(fp);
494 free(m.data);
495 return tls_error(US"fread failed", strerror(saved_errno), NULL);
496 }
497 fclose(fp);
498
499 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
500 free(m.data);
501 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
502 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
503 }
504
505 /* If the file does not exist, fall through to compute new data and cache it.
506 If there was any other opening error, it is serious. */
507
508 else if (errno == ENOENT)
509 {
510 rc = -1;
511 DEBUG(D_tls)
512 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
513 }
514 else
515 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
516 NULL, NULL);
517
518 /* If ret < 0, either the cache file does not exist, or the data it contains
519 is not useful. One particular case of this is when upgrading from an older
520 release of Exim in which the data was stored in a different format. We don't
521 try to be clever and support both formats; we just regenerate new data in this
522 case. */
523
524 if (rc < 0)
525 {
526 uschar *temp_fn;
527 unsigned int dh_bits_gen = dh_bits;
528
529 if ((PATH_MAX - Ustrlen(filename)) < 10)
530 return tls_error(US"Filename too long to generate replacement",
531 CS filename, NULL);
532
533 temp_fn = string_copy(US "%s.XXXXXXX");
534 fd = mkstemp(CS temp_fn); /* modifies temp_fn */
535 if (fd < 0)
536 return tls_error(US"Unable to open temp file", strerror(errno), NULL);
537 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
538
539 /* GnuTLS overshoots!
540 * If we ask for 2236, we might get 2237 or more.
541 * But there's no way to ask GnuTLS how many bits there really are.
542 * We can ask how many bits were used in a TLS session, but that's it!
543 * The prime itself is hidden behind too much abstraction.
544 * So we ask for less, and proceed on a wing and a prayer.
545 * First attempt, subtracted 3 for 2233 and got 2240.
546 */
547 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
548 {
549 dh_bits_gen = dh_bits - 10;
550 DEBUG(D_tls)
551 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
552 dh_bits_gen);
553 }
554
555 DEBUG(D_tls)
556 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
557 dh_bits_gen);
558 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen);
559 exim_gnutls_err_check(US"gnutls_dh_params_generate2");
560
561 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
562 and I confirmed that a NULL call to get the size first is how the GnuTLS
563 sample apps handle this. */
564
565 sz = 0;
566 m.data = NULL;
567 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
568 m.data, &sz);
569 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
570 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3(NULL) sizing");
571 m.size = sz;
572 m.data = malloc(m.size);
573 if (m.data == NULL)
574 return tls_error(US"memory allocation failed", strerror(errno), NULL);
575 /* this will return a size 1 less than the allocation size above */
576 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
577 m.data, &sz);
578 if (rc != GNUTLS_E_SUCCESS)
579 {
580 free(m.data);
581 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3() real");
582 }
583 m.size = sz; /* shrink by 1, probably */
584
585 sz = write_to_fd_buf(fd, m.data, (size_t) m.size);
586 if (sz != m.size)
587 {
588 free(m.data);
589 return tls_error(US"TLS cache write D-H params failed",
590 strerror(errno), NULL);
591 }
592 free(m.data);
593 sz = write_to_fd_buf(fd, US"\n", 1);
594 if (sz != 1)
595 return tls_error(US"TLS cache write D-H params final newline failed",
596 strerror(errno), NULL);
597
598 rc = close(fd);
599 if (rc)
600 return tls_error(US"TLS cache write close() failed",
601 strerror(errno), NULL);
602
603 if (Urename(temp_fn, filename) < 0)
604 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
605 temp_fn, filename), strerror(errno), NULL);
606
607 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
608 }
609
610 DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
611 return OK;
612 }
613
614
615
616
617 /*************************************************
618 * Variables re-expanded post-SNI *
619 *************************************************/
620
621 /* Called from both server and client code, via tls_init(), and also from
622 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
623
624 We can tell the two apart by state->received_sni being non-NULL in callback.
625
626 The callback should not call us unless state->trigger_sni_changes is true,
627 which we are responsible for setting on the first pass through.
628
629 Arguments:
630 state exim_gnutls_state_st *
631
632 Returns: OK/DEFER/FAIL
633 */
634
635 static int
636 tls_expand_session_files(exim_gnutls_state_st *state)
637 {
638 struct stat statbuf;
639 int rc;
640 const host_item *host = state->host; /* macro should be reconsidered? */
641 uschar *saved_tls_certificate = NULL;
642 uschar *saved_tls_privatekey = NULL;
643 uschar *saved_tls_verify_certificates = NULL;
644 uschar *saved_tls_crl = NULL;
645 int cert_count;
646
647 /* We check for tls_sni *before* expansion. */
648 if (!state->host)
649 {
650 if (!state->received_sni)
651 {
652 if (state->tls_certificate &&
653 (Ustrstr(state->tls_certificate, US"tls_sni") ||
654 Ustrstr(state->tls_certificate, US"tls_in_sni") ||
655 Ustrstr(state->tls_certificate, US"tls_out_sni")
656 ))
657 {
658 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
659 state->trigger_sni_changes = TRUE;
660 }
661 }
662 else
663 {
664 /* useful for debugging */
665 saved_tls_certificate = state->exp_tls_certificate;
666 saved_tls_privatekey = state->exp_tls_privatekey;
667 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
668 saved_tls_crl = state->exp_tls_crl;
669 }
670 }
671
672 rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
673 exim_gnutls_err_check(US"gnutls_certificate_allocate_credentials");
674
675 /* remember: expand_check_tlsvar() is expand_check() but fiddling with
676 state members, assuming consistent naming; and expand_check() returns
677 false if expansion failed, unless expansion was forced to fail. */
678
679 /* check if we at least have a certificate, before doing expensive
680 D-H generation. */
681
682 if (!expand_check_tlsvar(tls_certificate))
683 return DEFER;
684
685 /* certificate is mandatory in server, optional in client */
686
687 if ((state->exp_tls_certificate == NULL) ||
688 (*state->exp_tls_certificate == '\0'))
689 {
690 if (state->host == NULL)
691 return tls_error(US"no TLS server certificate is specified", NULL, NULL);
692 else
693 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
694 }
695
696 if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey))
697 return DEFER;
698
699 /* tls_privatekey is optional, defaulting to same file as certificate */
700
701 if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
702 {
703 state->tls_privatekey = state->tls_certificate;
704 state->exp_tls_privatekey = state->exp_tls_certificate;
705 }
706
707
708 if (state->exp_tls_certificate && *state->exp_tls_certificate)
709 {
710 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
711 state->exp_tls_certificate, state->exp_tls_privatekey);
712
713 if (state->received_sni)
714 {
715 if ((Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0) &&
716 (Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0))
717 {
718 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
719 }
720 else
721 {
722 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
723 }
724 }
725
726 rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
727 CS state->exp_tls_certificate, CS state->exp_tls_privatekey,
728 GNUTLS_X509_FMT_PEM);
729 exim_gnutls_err_check(
730 string_sprintf("cert/key setup: cert=%s key=%s",
731 state->exp_tls_certificate, state->exp_tls_privatekey));
732 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
733 } /* tls_certificate */
734
735 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
736 provided. Experiment shows that, if the certificate file is empty, an unhelpful
737 error message is provided. However, if we just refrain from setting anything up
738 in that case, certificate verification fails, which seems to be the correct
739 behaviour. */
740
741 if (state->tls_verify_certificates && *state->tls_verify_certificates)
742 {
743 if (!expand_check_tlsvar(tls_verify_certificates))
744 return DEFER;
745 if (state->tls_crl && *state->tls_crl)
746 if (!expand_check_tlsvar(tls_crl))
747 return DEFER;
748
749 if (!(state->exp_tls_verify_certificates &&
750 *state->exp_tls_verify_certificates))
751 {
752 DEBUG(D_tls)
753 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
754 /* With no tls_verify_certificates, we ignore tls_crl too */
755 return OK;
756 }
757 }
758 else
759 {
760 DEBUG(D_tls)
761 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
762 return OK;
763 }
764
765 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
766 {
767 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
768 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
769 strerror(errno));
770 return DEFER;
771 }
772
773 /* The test suite passes in /dev/null; we could check for that path explicitly,
774 but who knows if someone has some weird FIFO which always dumps some certs, or
775 other weirdness. The thing we really want to check is that it's not a
776 directory, since while OpenSSL supports that, GnuTLS does not.
777 So s/!S_ISREG/S_ISDIR/ and change some messsaging ... */
778 if (S_ISDIR(statbuf.st_mode))
779 {
780 DEBUG(D_tls)
781 debug_printf("verify certificates path is a dir: \"%s\"\n",
782 state->exp_tls_verify_certificates);
783 log_write(0, LOG_MAIN|LOG_PANIC,
784 "tls_verify_certificates \"%s\" is a directory",
785 state->exp_tls_verify_certificates);
786 return DEFER;
787 }
788
789 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
790 state->exp_tls_verify_certificates, statbuf.st_size);
791
792 if (statbuf.st_size == 0)
793 {
794 DEBUG(D_tls)
795 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
796 return OK;
797 }
798
799 cert_count = gnutls_certificate_set_x509_trust_file(state->x509_cred,
800 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
801 if (cert_count < 0)
802 {
803 rc = cert_count;
804 exim_gnutls_err_check(US"gnutls_certificate_set_x509_trust_file");
805 }
806 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
807
808 if (state->tls_crl && *state->tls_crl &&
809 state->exp_tls_crl && *state->exp_tls_crl)
810 {
811 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
812 cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
813 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
814 if (cert_count < 0)
815 {
816 rc = cert_count;
817 exim_gnutls_err_check(US"gnutls_certificate_set_x509_crl_file");
818 }
819 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
820 }
821
822 return OK;
823 }
824
825
826
827
828 /*************************************************
829 * Set X.509 state variables *
830 *************************************************/
831
832 /* In GnuTLS, the registered cert/key are not replaced by a later
833 set of a cert/key, so for SNI support we need a whole new x509_cred
834 structure. Which means various other non-re-expanded pieces of state
835 need to be re-set in the new struct, so the setting logic is pulled
836 out to this.
837
838 Arguments:
839 state exim_gnutls_state_st *
840
841 Returns: OK/DEFER/FAIL
842 */
843
844 static int
845 tls_set_remaining_x509(exim_gnutls_state_st *state)
846 {
847 int rc;
848 const host_item *host = state->host; /* macro should be reconsidered? */
849
850 /* Create D-H parameters, or read them from the cache file. This function does
851 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
852 client-side params. */
853
854 if (!state->host)
855 {
856 if (!dh_server_params)
857 {
858 rc = init_server_dh();
859 if (rc != OK) return rc;
860 }
861 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
862 }
863
864 /* Link the credentials to the session. */
865
866 rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
867 exim_gnutls_err_check(US"gnutls_credentials_set");
868
869 return OK;
870 }
871
872 /*************************************************
873 * Initialize for GnuTLS *
874 *************************************************/
875
876 /* Called from both server and client code. In the case of a server, errors
877 before actual TLS negotiation return DEFER.
878
879 Arguments:
880 host connected host, if client; NULL if server
881 certificate certificate file
882 privatekey private key file
883 sni TLS SNI to send, sometimes when client; else NULL
884 cas CA certs file
885 crl CRL file
886 require_ciphers tls_require_ciphers setting
887 caller_state returned state-info structure
888
889 Returns: OK/DEFER/FAIL
890 */
891
892 static int
893 tls_init(
894 const host_item *host,
895 const uschar *certificate,
896 const uschar *privatekey,
897 const uschar *sni,
898 const uschar *cas,
899 const uschar *crl,
900 const uschar *require_ciphers,
901 exim_gnutls_state_st **caller_state)
902 {
903 exim_gnutls_state_st *state;
904 int rc;
905 size_t sz;
906 const char *errpos;
907 uschar *p;
908 BOOL want_default_priorities;
909
910 if (!exim_gnutls_base_init_done)
911 {
912 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
913
914 rc = gnutls_global_init();
915 exim_gnutls_err_check(US"gnutls_global_init");
916
917 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
918 DEBUG(D_tls)
919 {
920 gnutls_global_set_log_function(exim_gnutls_logger_cb);
921 /* arbitrarily chosen level; bump upto 9 for more */
922 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
923 }
924 #endif
925
926 exim_gnutls_base_init_done = TRUE;
927 }
928
929 if (host)
930 {
931 state = &state_client;
932 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
933 state->tlsp = &tls_out;
934 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
935 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
936 }
937 else
938 {
939 state = &state_server;
940 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
941 state->tlsp = &tls_in;
942 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
943 rc = gnutls_init(&state->session, GNUTLS_SERVER);
944 }
945 exim_gnutls_err_check(US"gnutls_init");
946
947 state->host = host;
948
949 state->tls_certificate = certificate;
950 state->tls_privatekey = privatekey;
951 state->tls_require_ciphers = require_ciphers;
952 state->tls_sni = sni;
953 state->tls_verify_certificates = cas;
954 state->tls_crl = crl;
955
956 /* This handles the variables that might get re-expanded after TLS SNI;
957 that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
958
959 DEBUG(D_tls)
960 debug_printf("Expanding various TLS configuration options for session credentials.\n");
961 rc = tls_expand_session_files(state);
962 if (rc != OK) return rc;
963
964 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
965 requires a new structure afterwards. */
966
967 rc = tls_set_remaining_x509(state);
968 if (rc != OK) return rc;
969
970 /* set SNI in client, only */
971 if (host)
972 {
973 if (!expand_check(state->tlsp->sni, "tls_out_sni", &state->exp_tls_sni))
974 return DEFER;
975 if (state->exp_tls_sni && *state->exp_tls_sni)
976 {
977 DEBUG(D_tls)
978 debug_printf("Setting TLS client SNI to \"%s\"\n", state->exp_tls_sni);
979 sz = Ustrlen(state->exp_tls_sni);
980 rc = gnutls_server_name_set(state->session,
981 GNUTLS_NAME_DNS, state->exp_tls_sni, sz);
982 exim_gnutls_err_check(US"gnutls_server_name_set");
983 }
984 }
985 else if (state->tls_sni)
986 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
987 "have an SNI set for a client [%s]\n", state->tls_sni);
988
989 /* This is the priority string support,
990 http://www.gnu.org/software/gnutls/manual/html_node/Priority-Strings.html
991 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
992 This was backwards incompatible, but means Exim no longer needs to track
993 all algorithms and provide string forms for them. */
994
995 want_default_priorities = TRUE;
996
997 if (state->tls_require_ciphers && *state->tls_require_ciphers)
998 {
999 if (!expand_check_tlsvar(tls_require_ciphers))
1000 return DEFER;
1001 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
1002 {
1003 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
1004 state->exp_tls_require_ciphers);
1005
1006 rc = gnutls_priority_init(&state->priority_cache,
1007 CS state->exp_tls_require_ciphers, &errpos);
1008 want_default_priorities = FALSE;
1009 p = state->exp_tls_require_ciphers;
1010 }
1011 }
1012 if (want_default_priorities)
1013 {
1014 DEBUG(D_tls)
1015 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
1016 exim_default_gnutls_priority);
1017 rc = gnutls_priority_init(&state->priority_cache,
1018 exim_default_gnutls_priority, &errpos);
1019 p = US exim_default_gnutls_priority;
1020 }
1021
1022 exim_gnutls_err_check(string_sprintf(
1023 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1024 p, errpos - CS p, errpos));
1025
1026 rc = gnutls_priority_set(state->session, state->priority_cache);
1027 exim_gnutls_err_check(US"gnutls_priority_set");
1028
1029 gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1030
1031 /* Reduce security in favour of increased compatibility, if the admin
1032 decides to make that trade-off. */
1033 if (gnutls_compat_mode)
1034 {
1035 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1036 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1037 gnutls_session_enable_compatibility_mode(state->session);
1038 #else
1039 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1040 #endif
1041 }
1042
1043 *caller_state = state;
1044 return OK;
1045 }
1046
1047
1048
1049
1050 /*************************************************
1051 * Extract peer information *
1052 *************************************************/
1053
1054 /* Called from both server and client code.
1055 Only this is allowed to set state->peerdn and state->have_set_peerdn
1056 and we use that to detect double-calls.
1057
1058 NOTE: the state blocks last while the TLS connection is up, which is fine
1059 for logging in the server side, but for the client side, we log after teardown
1060 in src/deliver.c. While the session is up, we can twist about states and
1061 repoint tls_* globals, but those variables used for logging or other variable
1062 expansion that happens _after_ delivery need to have a longer life-time.
1063
1064 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1065 doing this more than once per generation of a state context. We set them in
1066 the state context, and repoint tls_* to them. After the state goes away, the
1067 tls_* copies of the pointers remain valid and client delivery logging is happy.
1068
1069 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1070 don't apply.
1071
1072 Arguments:
1073 state exim_gnutls_state_st *
1074
1075 Returns: OK/DEFER/FAIL
1076 */
1077
1078 static int
1079 peer_status(exim_gnutls_state_st *state)
1080 {
1081 uschar cipherbuf[256];
1082 const gnutls_datum *cert_list;
1083 int old_pool, rc;
1084 unsigned int cert_list_size = 0;
1085 gnutls_protocol_t protocol;
1086 gnutls_cipher_algorithm_t cipher;
1087 gnutls_kx_algorithm_t kx;
1088 gnutls_mac_algorithm_t mac;
1089 gnutls_certificate_type_t ct;
1090 gnutls_x509_crt_t crt;
1091 uschar *p, *dn_buf;
1092 size_t sz;
1093
1094 if (state->have_set_peerdn)
1095 return OK;
1096 state->have_set_peerdn = TRUE;
1097
1098 state->peerdn = NULL;
1099
1100 /* tls_cipher */
1101 cipher = gnutls_cipher_get(state->session);
1102 protocol = gnutls_protocol_get_version(state->session);
1103 mac = gnutls_mac_get(state->session);
1104 kx = gnutls_kx_get(state->session);
1105
1106 string_format(cipherbuf, sizeof(cipherbuf),
1107 "%s:%s:%d",
1108 gnutls_protocol_get_name(protocol),
1109 gnutls_cipher_suite_get_name(kx, cipher, mac),
1110 (int) gnutls_cipher_get_key_size(cipher) * 8);
1111
1112 /* I don't see a way that spaces could occur, in the current GnuTLS
1113 code base, but it was a concern in the old code and perhaps older GnuTLS
1114 releases did return "TLS 1.0"; play it safe, just in case. */
1115 for (p = cipherbuf; *p != '\0'; ++p)
1116 if (isspace(*p))
1117 *p = '-';
1118 old_pool = store_pool;
1119 store_pool = POOL_PERM;
1120 state->ciphersuite = string_copy(cipherbuf);
1121 store_pool = old_pool;
1122 state->tlsp->cipher = state->ciphersuite;
1123
1124 /* tls_peerdn */
1125 cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
1126
1127 if (cert_list == NULL || cert_list_size == 0)
1128 {
1129 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1130 cert_list, cert_list_size);
1131 if (state->verify_requirement == VERIFY_REQUIRED)
1132 return tls_error(US"certificate verification failed",
1133 "no certificate received from peer", state->host);
1134 return OK;
1135 }
1136
1137 ct = gnutls_certificate_type_get(state->session);
1138 if (ct != GNUTLS_CRT_X509)
1139 {
1140 const char *ctn = gnutls_certificate_type_get_name(ct);
1141 DEBUG(D_tls)
1142 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
1143 if (state->verify_requirement == VERIFY_REQUIRED)
1144 return tls_error(US"certificate verification not possible, unhandled type",
1145 ctn, state->host);
1146 return OK;
1147 }
1148
1149 #define exim_gnutls_peer_err(Label) do { \
1150 if (rc != GNUTLS_E_SUCCESS) { \
1151 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", (Label), gnutls_strerror(rc)); \
1152 if (state->verify_requirement == VERIFY_REQUIRED) { return tls_error((Label), gnutls_strerror(rc), state->host); } \
1153 return OK; } } while (0)
1154
1155 rc = gnutls_x509_crt_init(&crt);
1156 exim_gnutls_peer_err(US"gnutls_x509_crt_init (crt)");
1157
1158 rc = gnutls_x509_crt_import(crt, &cert_list[0], GNUTLS_X509_FMT_DER);
1159 exim_gnutls_peer_err(US"failed to import certificate [gnutls_x509_crt_import(cert 0)]");
1160 sz = 0;
1161 rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1162 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
1163 {
1164 exim_gnutls_peer_err(US"getting size for cert DN failed");
1165 return FAIL; /* should not happen */
1166 }
1167 dn_buf = store_get_perm(sz);
1168 rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1169 exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1170 state->peerdn = dn_buf;
1171
1172 return OK;
1173 #undef exim_gnutls_peer_err
1174 }
1175
1176
1177
1178
1179 /*************************************************
1180 * Verify peer certificate *
1181 *************************************************/
1182
1183 /* Called from both server and client code.
1184 *Should* be using a callback registered with
1185 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1186 the peer information, but that's too new for some OSes.
1187
1188 Arguments:
1189 state exim_gnutls_state_st *
1190 error where to put an error message
1191
1192 Returns:
1193 FALSE if the session should be rejected
1194 TRUE if the cert is okay or we just don't care
1195 */
1196
1197 static BOOL
1198 verify_certificate(exim_gnutls_state_st *state, const char **error)
1199 {
1200 int rc;
1201 unsigned int verify;
1202
1203 *error = NULL;
1204
1205 rc = peer_status(state);
1206 if (rc != OK)
1207 {
1208 verify = GNUTLS_CERT_INVALID;
1209 *error = "not supplied";
1210 }
1211 else
1212 {
1213 rc = gnutls_certificate_verify_peers2(state->session, &verify);
1214 }
1215
1216 /* Handle the result of verification. INVALID seems to be set as well
1217 as REVOKED, but leave the test for both. */
1218
1219 if ((rc < 0) || (verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED)) != 0)
1220 {
1221 state->peer_cert_verified = FALSE;
1222 if (*error == NULL)
1223 *error = ((verify & GNUTLS_CERT_REVOKED) != 0) ? "revoked" : "invalid";
1224
1225 DEBUG(D_tls)
1226 debug_printf("TLS certificate verification failed (%s): peerdn=%s\n",
1227 *error, state->peerdn ? state->peerdn : US"<unset>");
1228
1229 if (state->verify_requirement == VERIFY_REQUIRED)
1230 {
1231 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1232 return FALSE;
1233 }
1234 DEBUG(D_tls)
1235 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
1236 }
1237 else
1238 {
1239 state->peer_cert_verified = TRUE;
1240 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=%s\n",
1241 state->peerdn ? state->peerdn : US"<unset>");
1242 }
1243
1244 state->tlsp->peerdn = state->peerdn;
1245
1246 return TRUE;
1247 }
1248
1249
1250
1251
1252 /* ------------------------------------------------------------------------ */
1253 /* Callbacks */
1254
1255 /* Logging function which can be registered with
1256 * gnutls_global_set_log_function()
1257 * gnutls_global_set_log_level() 0..9
1258 */
1259 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1260 static void
1261 exim_gnutls_logger_cb(int level, const char *message)
1262 {
1263 size_t len = strlen(message);
1264 if (len < 1)
1265 {
1266 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1267 return;
1268 }
1269 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1270 message[len-1] == '\n' ? "" : "\n");
1271 }
1272 #endif
1273
1274
1275 /* Called after client hello, should handle SNI work.
1276 This will always set tls_sni (state->received_sni) if available,
1277 and may trigger presenting different certificates,
1278 if state->trigger_sni_changes is TRUE.
1279
1280 Should be registered with
1281 gnutls_handshake_set_post_client_hello_function()
1282
1283 "This callback must return 0 on success or a gnutls error code to terminate the
1284 handshake.".
1285
1286 For inability to get SNI information, we return 0.
1287 We only return non-zero if re-setup failed.
1288 Only used for server-side TLS.
1289 */
1290
1291 static int
1292 exim_sni_handling_cb(gnutls_session_t session)
1293 {
1294 char sni_name[MAX_HOST_LEN];
1295 size_t data_len = MAX_HOST_LEN;
1296 exim_gnutls_state_st *state = &state_server;
1297 unsigned int sni_type;
1298 int rc, old_pool;
1299
1300 rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
1301 if (rc != GNUTLS_E_SUCCESS)
1302 {
1303 DEBUG(D_tls) {
1304 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1305 debug_printf("TLS: no SNI presented in handshake.\n");
1306 else
1307 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1308 gnutls_strerror(rc), rc);
1309 };
1310 return 0;
1311 }
1312
1313 if (sni_type != GNUTLS_NAME_DNS)
1314 {
1315 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1316 return 0;
1317 }
1318
1319 /* We now have a UTF-8 string in sni_name */
1320 old_pool = store_pool;
1321 store_pool = POOL_PERM;
1322 state->received_sni = string_copyn(US sni_name, data_len);
1323 store_pool = old_pool;
1324
1325 /* We set this one now so that variable expansions below will work */
1326 state->tlsp->sni = state->received_sni;
1327
1328 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1329 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1330
1331 if (!state->trigger_sni_changes)
1332 return 0;
1333
1334 rc = tls_expand_session_files(state);
1335 if (rc != OK)
1336 {
1337 /* If the setup of certs/etc failed before handshake, TLS would not have
1338 been offered. The best we can do now is abort. */
1339 return GNUTLS_E_APPLICATION_ERROR_MIN;
1340 }
1341
1342 rc = tls_set_remaining_x509(state);
1343 if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1344
1345 return 0;
1346 }
1347
1348
1349
1350
1351 /* ------------------------------------------------------------------------ */
1352 /* Exported functions */
1353
1354
1355
1356
1357 /*************************************************
1358 * Start a TLS session in a server *
1359 *************************************************/
1360
1361 /* This is called when Exim is running as a server, after having received
1362 the STARTTLS command. It must respond to that command, and then negotiate
1363 a TLS session.
1364
1365 Arguments:
1366 require_ciphers list of allowed ciphers or NULL
1367
1368 Returns: OK on success
1369 DEFER for errors before the start of the negotiation
1370 FAIL for errors during the negotation; the server can't
1371 continue running.
1372 */
1373
1374 int
1375 tls_server_start(const uschar *require_ciphers)
1376 {
1377 int rc;
1378 const char *error;
1379 exim_gnutls_state_st *state = NULL;
1380
1381 /* Check for previous activation */
1382 if (tls_in.active >= 0)
1383 {
1384 tls_error(US"STARTTLS received after TLS started", "", NULL);
1385 smtp_printf("554 Already in TLS\r\n");
1386 return FAIL;
1387 }
1388
1389 /* Initialize the library. If it fails, it will already have logged the error
1390 and sent an SMTP response. */
1391
1392 DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
1393
1394 rc = tls_init(NULL, tls_certificate, tls_privatekey,
1395 NULL, tls_verify_certificates, tls_crl,
1396 require_ciphers, &state);
1397 if (rc != OK) return rc;
1398
1399 /* If this is a host for which certificate verification is mandatory or
1400 optional, set up appropriately. */
1401
1402 if (verify_check_host(&tls_verify_hosts) == OK)
1403 {
1404 DEBUG(D_tls) debug_printf("TLS: a client certificate will be required.\n");
1405 state->verify_requirement = VERIFY_REQUIRED;
1406 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1407 }
1408 else if (verify_check_host(&tls_try_verify_hosts) == OK)
1409 {
1410 DEBUG(D_tls) debug_printf("TLS: a client certificate will be requested but not required.\n");
1411 state->verify_requirement = VERIFY_OPTIONAL;
1412 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1413 }
1414 else
1415 {
1416 DEBUG(D_tls) debug_printf("TLS: a client certificate will not be requested.\n");
1417 state->verify_requirement = VERIFY_NONE;
1418 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
1419 }
1420
1421 /* Register SNI handling; always, even if not in tls_certificate, so that the
1422 expansion variable $tls_sni is always available. */
1423
1424 gnutls_handshake_set_post_client_hello_function(state->session,
1425 exim_sni_handling_cb);
1426
1427 /* Set context and tell client to go ahead, except in the case of TLS startup
1428 on connection, where outputting anything now upsets the clients and tends to
1429 make them disconnect. We need to have an explicit fflush() here, to force out
1430 the response. Other smtp_printf() calls do not need it, because in non-TLS
1431 mode, the fflush() happens when smtp_getc() is called. */
1432
1433 if (!state->tlsp->on_connect)
1434 {
1435 smtp_printf("220 TLS go ahead\r\n");
1436 fflush(smtp_out); /*XXX JGH */
1437 }
1438
1439 /* Now negotiate the TLS session. We put our own timer on it, since it seems
1440 that the GnuTLS library doesn't. */
1441
1442 gnutls_transport_set_ptr2(state->session,
1443 (gnutls_transport_ptr)fileno(smtp_in),
1444 (gnutls_transport_ptr)fileno(smtp_out));
1445 state->fd_in = fileno(smtp_in);
1446 state->fd_out = fileno(smtp_out);
1447
1448 sigalrm_seen = FALSE;
1449 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1450 do
1451 {
1452 rc = gnutls_handshake(state->session);
1453 } while ((rc == GNUTLS_E_AGAIN) ||
1454 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
1455 alarm(0);
1456
1457 if (rc != GNUTLS_E_SUCCESS)
1458 {
1459 tls_error(US"gnutls_handshake",
1460 sigalrm_seen ? "timed out" : gnutls_strerror(rc), NULL);
1461 /* It seems that, except in the case of a timeout, we have to close the
1462 connection right here; otherwise if the other end is running OpenSSL it hangs
1463 until the server times out. */
1464
1465 if (!sigalrm_seen)
1466 {
1467 (void)fclose(smtp_out);
1468 (void)fclose(smtp_in);
1469 }
1470
1471 return FAIL;
1472 }
1473
1474 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1475
1476 /* Verify after the fact */
1477
1478 if (state->verify_requirement != VERIFY_NONE)
1479 {
1480 if (!verify_certificate(state, &error))
1481 {
1482 if (state->verify_requirement == VERIFY_OPTIONAL)
1483 {
1484 DEBUG(D_tls)
1485 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
1486 error);
1487 }
1488 else
1489 {
1490 tls_error(US"certificate verification failed", error, NULL);
1491 return FAIL;
1492 }
1493 }
1494 }
1495
1496 /* Figure out peer DN, and if authenticated, etc. */
1497
1498 rc = peer_status(state);
1499 if (rc != OK) return rc;
1500
1501 /* Sets various Exim expansion variables; always safe within server */
1502
1503 extract_exim_vars_from_tls_state(state, TRUE);
1504
1505 /* TLS has been set up. Adjust the input functions to read via TLS,
1506 and initialize appropriately. */
1507
1508 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
1509
1510 receive_getc = tls_getc;
1511 receive_ungetc = tls_ungetc;
1512 receive_feof = tls_feof;
1513 receive_ferror = tls_ferror;
1514 receive_smtp_buffered = tls_smtp_buffered;
1515
1516 return OK;
1517 }
1518
1519
1520
1521
1522 /*************************************************
1523 * Start a TLS session in a client *
1524 *************************************************/
1525
1526 /* Called from the smtp transport after STARTTLS has been accepted.
1527
1528 Arguments:
1529 fd the fd of the connection
1530 host connected host (for messages)
1531 addr the first address (not used)
1532 dhparam DH parameter file (ignored, we're a client)
1533 certificate certificate file
1534 privatekey private key file
1535 sni TLS SNI to send to remote host
1536 verify_certs file for certificate verify
1537 verify_crl CRL for verify
1538 require_ciphers list of allowed ciphers or NULL
1539 dh_min_bits minimum number of bits acceptable in server's DH prime
1540 timeout startup timeout
1541
1542 Returns: OK/DEFER/FAIL (because using common functions),
1543 but for a client, DEFER and FAIL have the same meaning
1544 */
1545
1546 int
1547 tls_client_start(int fd, host_item *host,
1548 address_item *addr ARG_UNUSED, uschar *dhparam ARG_UNUSED,
1549 uschar *certificate, uschar *privatekey, uschar *sni,
1550 uschar *verify_certs, uschar *verify_crl,
1551 uschar *require_ciphers, int dh_min_bits, int timeout)
1552 {
1553 int rc;
1554 const char *error;
1555 exim_gnutls_state_st *state = NULL;
1556
1557 DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
1558
1559 rc = tls_init(host, certificate, privatekey,
1560 sni, verify_certs, verify_crl, require_ciphers, &state);
1561 if (rc != OK) return rc;
1562
1563 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
1564 {
1565 DEBUG(D_tls)
1566 debug_printf("WARNING: tls_dh_min_bits far too low, clamping %d up to %d\n",
1567 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
1568 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
1569 }
1570
1571 DEBUG(D_tls) debug_printf("Setting D-H prime minimum acceptable bits to %d\n",
1572 dh_min_bits);
1573 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
1574
1575 if (verify_certs == NULL)
1576 {
1577 DEBUG(D_tls) debug_printf("TLS: server certificate verification not required\n");
1578 state->verify_requirement = VERIFY_NONE;
1579 /* we still ask for it, to log it, etc */
1580 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1581 }
1582 else
1583 {
1584 DEBUG(D_tls) debug_printf("TLS: server certificate verification required\n");
1585 state->verify_requirement = VERIFY_REQUIRED;
1586 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1587 }
1588
1589 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr)fd);
1590 state->fd_in = fd;
1591 state->fd_out = fd;
1592
1593 /* There doesn't seem to be a built-in timeout on connection. */
1594
1595 sigalrm_seen = FALSE;
1596 alarm(timeout);
1597 do
1598 {
1599 rc = gnutls_handshake(state->session);
1600 } while ((rc == GNUTLS_E_AGAIN) ||
1601 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
1602 alarm(0);
1603
1604 if (rc != GNUTLS_E_SUCCESS)
1605 return tls_error(US"gnutls_handshake",
1606 sigalrm_seen ? "timed out" : gnutls_strerror(rc), state->host);
1607
1608 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1609
1610 /* Verify late */
1611
1612 if (state->verify_requirement != VERIFY_NONE &&
1613 !verify_certificate(state, &error))
1614 return tls_error(US"certificate verification failed", error, state->host);
1615
1616 /* Figure out peer DN, and if authenticated, etc. */
1617
1618 rc = peer_status(state);
1619 if (rc != OK) return rc;
1620
1621 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
1622
1623 extract_exim_vars_from_tls_state(state, FALSE);
1624
1625 return OK;
1626 }
1627
1628
1629
1630
1631 /*************************************************
1632 * Close down a TLS session *
1633 *************************************************/
1634
1635 /* This is also called from within a delivery subprocess forked from the
1636 daemon, to shut down the TLS library, without actually doing a shutdown (which
1637 would tamper with the TLS session in the parent process).
1638
1639 Arguments: TRUE if gnutls_bye is to be called
1640 Returns: nothing
1641 */
1642
1643 void
1644 tls_close(BOOL is_server, BOOL shutdown)
1645 {
1646 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
1647
1648 if (!state->tlsp || state->tlsp->active < 0) return; /* TLS was not active */
1649
1650 if (shutdown)
1651 {
1652 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS\n");
1653 gnutls_bye(state->session, GNUTLS_SHUT_WR);
1654 }
1655
1656 gnutls_deinit(state->session);
1657
1658 state->tlsp->active = -1;
1659 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1660
1661 if ((state_server.session == NULL) && (state_client.session == NULL))
1662 {
1663 gnutls_global_deinit();
1664 exim_gnutls_base_init_done = FALSE;
1665 }
1666
1667 }
1668
1669
1670
1671
1672 /*************************************************
1673 * TLS version of getc *
1674 *************************************************/
1675
1676 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
1677 it refills the buffer via the GnuTLS reading function.
1678 Only used by the server-side TLS.
1679
1680 This feeds DKIM and should be used for all message-body reads.
1681
1682 Arguments: none
1683 Returns: the next character or EOF
1684 */
1685
1686 int
1687 tls_getc(void)
1688 {
1689 exim_gnutls_state_st *state = &state_server;
1690 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
1691 {
1692 ssize_t inbytes;
1693
1694 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
1695 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
1696
1697 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1698 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
1699 ssl_xfer_buffer_size);
1700 alarm(0);
1701
1702 /* A zero-byte return appears to mean that the TLS session has been
1703 closed down, not that the socket itself has been closed down. Revert to
1704 non-TLS handling. */
1705
1706 if (inbytes == 0)
1707 {
1708 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
1709
1710 receive_getc = smtp_getc;
1711 receive_ungetc = smtp_ungetc;
1712 receive_feof = smtp_feof;
1713 receive_ferror = smtp_ferror;
1714 receive_smtp_buffered = smtp_buffered;
1715
1716 gnutls_deinit(state->session);
1717 state->session = NULL;
1718 state->tlsp->active = -1;
1719 state->tlsp->bits = 0;
1720 state->tlsp->certificate_verified = FALSE;
1721 tls_channelbinding_b64 = NULL; /*XXX JGH */
1722 state->tlsp->cipher = NULL;
1723 state->tlsp->peerdn = NULL;
1724
1725 return smtp_getc();
1726 }
1727
1728 /* Handle genuine errors */
1729
1730 else if (inbytes < 0)
1731 {
1732 record_io_error(state, (int) inbytes, US"recv", NULL);
1733 state->xfer_error = 1;
1734 return EOF;
1735 }
1736 #ifndef DISABLE_DKIM
1737 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
1738 #endif
1739 state->xfer_buffer_hwm = (int) inbytes;
1740 state->xfer_buffer_lwm = 0;
1741 }
1742
1743 /* Something in the buffer; return next uschar */
1744
1745 return state->xfer_buffer[state->xfer_buffer_lwm++];
1746 }
1747
1748
1749
1750
1751 /*************************************************
1752 * Read bytes from TLS channel *
1753 *************************************************/
1754
1755 /* This does not feed DKIM, so if the caller uses this for reading message body,
1756 then the caller must feed DKIM.
1757
1758 Arguments:
1759 buff buffer of data
1760 len size of buffer
1761
1762 Returns: the number of bytes read
1763 -1 after a failed read
1764 */
1765
1766 int
1767 tls_read(BOOL is_server, uschar *buff, size_t len)
1768 {
1769 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
1770 ssize_t inbytes;
1771
1772 if (len > INT_MAX)
1773 len = INT_MAX;
1774
1775 if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
1776 DEBUG(D_tls)
1777 debug_printf("*** PROBABLY A BUG *** " \
1778 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
1779 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
1780
1781 DEBUG(D_tls)
1782 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
1783 state->session, buff, len);
1784
1785 inbytes = gnutls_record_recv(state->session, buff, len);
1786 if (inbytes > 0) return inbytes;
1787 if (inbytes == 0)
1788 {
1789 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
1790 }
1791 else record_io_error(state, (int)inbytes, US"recv", NULL);
1792
1793 return -1;
1794 }
1795
1796
1797
1798
1799 /*************************************************
1800 * Write bytes down TLS channel *
1801 *************************************************/
1802
1803 /*
1804 Arguments:
1805 is_server channel specifier
1806 buff buffer of data
1807 len number of bytes
1808
1809 Returns: the number of bytes after a successful write,
1810 -1 after a failed write
1811 */
1812
1813 int
1814 tls_write(BOOL is_server, const uschar *buff, size_t len)
1815 {
1816 ssize_t outbytes;
1817 size_t left = len;
1818 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
1819
1820 DEBUG(D_tls) debug_printf("tls_do_write(%p, " SIZE_T_FMT ")\n", buff, left);
1821 while (left > 0)
1822 {
1823 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
1824 buff, left);
1825 outbytes = gnutls_record_send(state->session, buff, left);
1826
1827 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
1828 if (outbytes < 0)
1829 {
1830 record_io_error(state, outbytes, US"send", NULL);
1831 return -1;
1832 }
1833 if (outbytes == 0)
1834 {
1835 record_io_error(state, 0, US"send", US"TLS channel closed on write");
1836 return -1;
1837 }
1838
1839 left -= outbytes;
1840 buff += outbytes;
1841 }
1842
1843 if (len > INT_MAX)
1844 {
1845 DEBUG(D_tls)
1846 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
1847 len);
1848 len = INT_MAX;
1849 }
1850
1851 return (int) len;
1852 }
1853
1854
1855
1856
1857 /*************************************************
1858 * Random number generation *
1859 *************************************************/
1860
1861 /* Pseudo-random number generation. The result is not expected to be
1862 cryptographically strong but not so weak that someone will shoot themselves
1863 in the foot using it as a nonce in input in some email header scheme or
1864 whatever weirdness they'll twist this into. The result should handle fork()
1865 and avoid repeating sequences. OpenSSL handles that for us.
1866
1867 Arguments:
1868 max range maximum
1869 Returns a random number in range [0, max-1]
1870 */
1871
1872 #ifdef HAVE_GNUTLS_RND
1873 int
1874 vaguely_random_number(int max)
1875 {
1876 unsigned int r;
1877 int i, needed_len;
1878 uschar *p;
1879 uschar smallbuf[sizeof(r)];
1880
1881 if (max <= 1)
1882 return 0;
1883
1884 needed_len = sizeof(r);
1885 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
1886 * asked for a number less than 10. */
1887 for (r = max, i = 0; r; ++i)
1888 r >>= 1;
1889 i = (i + 7) / 8;
1890 if (i < needed_len)
1891 needed_len = i;
1892
1893 i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
1894 if (i < 0)
1895 {
1896 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
1897 return vaguely_random_number_fallback(max);
1898 }
1899 r = 0;
1900 for (p = smallbuf; needed_len; --needed_len, ++p)
1901 {
1902 r *= 256;
1903 r += *p;
1904 }
1905
1906 /* We don't particularly care about weighted results; if someone wants
1907 * smooth distribution and cares enough then they should submit a patch then. */
1908 return r % max;
1909 }
1910 #else /* HAVE_GNUTLS_RND */
1911 int
1912 vaguely_random_number(int max)
1913 {
1914 return vaguely_random_number_fallback(max);
1915 }
1916 #endif /* HAVE_GNUTLS_RND */
1917
1918
1919
1920
1921 /*************************************************
1922 * Let tls_require_ciphers be checked at startup *
1923 *************************************************/
1924
1925 /* The tls_require_ciphers option, if set, must be something which the
1926 library can parse.
1927
1928 Returns: NULL on success, or error message
1929 */
1930
1931 uschar *
1932 tls_validate_require_cipher(void)
1933 {
1934 int rc;
1935 uschar *expciphers = NULL;
1936 gnutls_priority_t priority_cache;
1937 const char *errpos;
1938
1939 #define validate_check_rc(Label) do { \
1940 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
1941 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
1942 #define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
1943
1944 if (exim_gnutls_base_init_done)
1945 log_write(0, LOG_MAIN|LOG_PANIC,
1946 "already initialised GnuTLS, Exim developer bug");
1947
1948 rc = gnutls_global_init();
1949 validate_check_rc(US"gnutls_global_init()");
1950 exim_gnutls_base_init_done = TRUE;
1951
1952 if (!(tls_require_ciphers && *tls_require_ciphers))
1953 return_deinit(NULL);
1954
1955 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
1956 return_deinit(US"failed to expand tls_require_ciphers");
1957
1958 if (!(expciphers && *expciphers))
1959 return_deinit(NULL);
1960
1961 DEBUG(D_tls)
1962 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
1963
1964 rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
1965 validate_check_rc(string_sprintf(
1966 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
1967 expciphers, errpos - CS expciphers, errpos));
1968
1969 #undef return_deinit
1970 #undef validate_check_rc
1971 gnutls_global_deinit();
1972
1973 return NULL;
1974 }
1975
1976
1977
1978
1979 /*************************************************
1980 * Report the library versions. *
1981 *************************************************/
1982
1983 /* See a description in tls-openssl.c for an explanation of why this exists.
1984
1985 Arguments: a FILE* to print the results to
1986 Returns: nothing
1987 */
1988
1989 void
1990 tls_version_report(FILE *f)
1991 {
1992 fprintf(f, "Library version: GnuTLS: Compile: %s\n"
1993 " Runtime: %s\n",
1994 LIBGNUTLS_VERSION,
1995 gnutls_check_version(NULL));
1996 }
1997
1998 /* End of tls-gnu.c */