TLS: variables $tls_(in,out)_tlsver
[exim.git] / src / src / tls-gnu.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Copyright (c) Phil Pennock 2012 */
9
10 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
11 one of the available supported implementations. This file is #included into
12 tls.c when USE_GNUTLS has been set.
13
14 The code herein is a revamp of GnuTLS integration using the current APIs; the
15 original tls-gnu.c was based on a patch which was contributed by Nikos
16 Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
17 appropriate.
18
19 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20 which is not widely deployed by OS vendors. Will note issues below, which may
21 assist in updating the code in the future. Another sources of hints is
22 mod_gnutls for Apache (SNI callback registration and handling).
23
24 Keeping client and server variables more split than before and is currently
25 the norm, in anticipation of TLS in ACL callouts.
26
27 I wanted to switch to gnutls_certificate_set_verify_function() so that
28 certificate rejection could happen during handshake where it belongs, rather
29 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
31
32 (I wasn't looking for libraries quite that old, when updating to get rid of
33 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34 require current GnuTLS, then we'll drop support for the ancient libraries).
35 */
36
37 #include <gnutls/gnutls.h>
38 /* needed for cert checks in verification and DN extraction: */
39 #include <gnutls/x509.h>
40 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41 #include <gnutls/crypto.h>
42
43 /* needed to disable PKCS11 autoload unless requested */
44 #if GNUTLS_VERSION_NUMBER >= 0x020c00
45 # include <gnutls/pkcs11.h>
46 # define SUPPORT_PARAM_TO_PK_BITS
47 #endif
48 #if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
49 # warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
50 # define DISABLE_OCSP
51 #endif
52 #if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
53 # warning "GnuTLS library version too old; tls:cert event unsupported"
54 # define DISABLE_EVENT
55 #endif
56 #if GNUTLS_VERSION_NUMBER >= 0x030306
57 # define SUPPORT_CA_DIR
58 #else
59 # undef SUPPORT_CA_DIR
60 #endif
61 #if GNUTLS_VERSION_NUMBER >= 0x030014
62 # define SUPPORT_SYSDEFAULT_CABUNDLE
63 #endif
64 #if GNUTLS_VERSION_NUMBER >= 0x030104
65 # define GNUTLS_CERT_VFY_STATUS_PRINT
66 #endif
67 #if GNUTLS_VERSION_NUMBER >= 0x030109
68 # define SUPPORT_CORK
69 #endif
70 #if GNUTLS_VERSION_NUMBER >= 0x03010a
71 # define SUPPORT_GNUTLS_SESS_DESC
72 #endif
73 #if GNUTLS_VERSION_NUMBER >= 0x030300
74 # define GNUTLS_AUTO_GLOBAL_INIT
75 # define GNUTLS_AUTO_PKCS11_MANUAL
76 #endif
77 #if GNUTLS_VERSION_NUMBER >= 0x030500
78 # define SUPPORT_GNUTLS_KEYLOG
79 #endif
80 #if GNUTLS_VERSION_NUMBER >= 0x030506 && !defined(DISABLE_OCSP)
81 # define SUPPORT_SRV_OCSP_STACK
82 #endif
83 #if GNUTLS_VERSION_NUMBER >= 0x030600
84 # define GNUTLS_AUTO_DHPARAMS
85 #endif
86 #if GNUTLS_VERSION_NUMBER >= 0x030603
87 # define EXIM_HAVE_TLS1_3
88 # define SUPPORT_GNUTLS_EXT_RAW_PARSE
89 # define GNUTLS_OCSP_STATUS_REQUEST_GET2
90 #endif
91
92 #ifdef SUPPORT_DANE
93 # if GNUTLS_VERSION_NUMBER >= 0x030000
94 # define DANESSL_USAGE_DANE_TA 2
95 # define DANESSL_USAGE_DANE_EE 3
96 # else
97 # error GnuTLS version too early for DANE
98 # endif
99 # if GNUTLS_VERSION_NUMBER < 0x999999
100 # define GNUTLS_BROKEN_DANE_VALIDATION
101 # endif
102 #endif
103
104 #ifdef EXPERIMENTAL_TLS_RESUME
105 # if GNUTLS_VERSION_NUMBER < 0x030603
106 # error GNUTLS version too early for session-resumption
107 # endif
108 #endif
109
110 #ifndef DISABLE_OCSP
111 # include <gnutls/ocsp.h>
112 #endif
113 #ifdef SUPPORT_DANE
114 # include <gnutls/dane.h>
115 #endif
116
117 #include "tls-cipher-stdname.c"
118
119
120 #ifdef MACRO_PREDEF
121 void
122 options_tls(void)
123 {
124 # ifdef EXPERIMENTAL_TLS_RESUME
125 builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
126 # endif
127 # ifdef EXIM_HAVE_TLS1_3
128 builtin_macro_create(US"_HAVE_TLS1_3");
129 # endif
130 }
131 #else
132
133
134 /* GnuTLS 2 vs 3
135
136 GnuTLS 3 only:
137 gnutls_global_set_audit_log_function()
138
139 Changes:
140 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
141 */
142
143 /* Local static variables for GnuTLS */
144
145 /* Values for verify_requirement */
146
147 enum peer_verify_requirement
148 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED, VERIFY_DANE };
149
150 /* This holds most state for server or client; with this, we can set up an
151 outbound TLS-enabled connection in an ACL callout, while not stomping all
152 over the TLS variables available for expansion.
153
154 Some of these correspond to variables in globals.c; those variables will
155 be set to point to content in one of these instances, as appropriate for
156 the stage of the process lifetime.
157
158 Not handled here: global tls_channelbinding_b64.
159 */
160
161 typedef struct exim_gnutls_state {
162 gnutls_session_t session;
163 gnutls_certificate_credentials_t x509_cred;
164 gnutls_priority_t priority_cache;
165 enum peer_verify_requirement verify_requirement;
166 int fd_in;
167 int fd_out;
168 BOOL peer_cert_verified;
169 BOOL peer_dane_verified;
170 BOOL trigger_sni_changes;
171 BOOL have_set_peerdn;
172 const struct host_item *host; /* NULL if server */
173 gnutls_x509_crt_t peercert;
174 uschar *peerdn;
175 uschar *ciphersuite;
176 uschar *received_sni;
177
178 const uschar *tls_certificate;
179 const uschar *tls_privatekey;
180 const uschar *tls_sni; /* client send only, not received */
181 const uschar *tls_verify_certificates;
182 const uschar *tls_crl;
183 const uschar *tls_require_ciphers;
184
185 uschar *exp_tls_certificate;
186 uschar *exp_tls_privatekey;
187 uschar *exp_tls_verify_certificates;
188 uschar *exp_tls_crl;
189 uschar *exp_tls_require_ciphers;
190 const uschar *exp_tls_verify_cert_hostnames;
191 #ifndef DISABLE_EVENT
192 uschar *event_action;
193 #endif
194 #ifdef SUPPORT_DANE
195 char * const * dane_data;
196 const int * dane_data_len;
197 #endif
198
199 tls_support *tlsp; /* set in tls_init() */
200
201 uschar *xfer_buffer;
202 int xfer_buffer_lwm;
203 int xfer_buffer_hwm;
204 BOOL xfer_eof; /*XXX never gets set! */
205 BOOL xfer_error;
206 } exim_gnutls_state_st;
207
208 static const exim_gnutls_state_st exim_gnutls_state_init = {
209 /* all elements not explicitly intialised here get 0/NULL/FALSE */
210 .fd_in = -1,
211 .fd_out = -1,
212 };
213
214 /* Not only do we have our own APIs which don't pass around state, assuming
215 it's held in globals, GnuTLS doesn't appear to let us register callback data
216 for callbacks, or as part of the session, so we have to keep a "this is the
217 context we're currently dealing with" pointer and rely upon being
218 single-threaded to keep from processing data on an inbound TLS connection while
219 talking to another TLS connection for an outbound check. This does mean that
220 there's no way for heart-beats to be responded to, for the duration of the
221 second connection.
222 XXX But see gnutls_session_get_ptr()
223 */
224
225 static exim_gnutls_state_st state_server;
226
227 #ifndef GNUTLS_AUTO_DHPARAMS
228 /* dh_params are initialised once within the lifetime of a process using TLS;
229 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
230 don't want to repeat this. */
231
232 static gnutls_dh_params_t dh_server_params = NULL;
233 #endif
234
235 static int ssl_session_timeout = 7200; /* Two hours */
236
237 static const uschar * const exim_default_gnutls_priority = US"NORMAL";
238
239 /* Guard library core initialisation */
240
241 static BOOL exim_gnutls_base_init_done = FALSE;
242
243 #ifndef DISABLE_OCSP
244 static BOOL gnutls_buggy_ocsp = FALSE;
245 static BOOL exim_testharness_disable_ocsp_validity_check = FALSE;
246 #endif
247
248 #ifdef EXPERIMENTAL_TLS_RESUME
249 static gnutls_datum_t server_sessticket_key;
250 #endif
251
252 /* ------------------------------------------------------------------------ */
253 /* macros */
254
255 #define MAX_HOST_LEN 255
256
257 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
258 the library logging; a value less than 0 disables the calls to set up logging
259 callbacks. GNuTLS also looks for an environment variable - except not for
260 setuid binaries, making it useless - "GNUTLS_DEBUG_LEVEL".
261 Allegedly the testscript line "GNUTLS_DEBUG_LEVEL=9 sudo exim ..." would work,
262 but the env var must be added to /etc/sudoers too. */
263 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
264 # define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
265 #endif
266
267 #ifndef EXIM_CLIENT_DH_MIN_BITS
268 # define EXIM_CLIENT_DH_MIN_BITS 1024
269 #endif
270
271 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
272 can ask for a bit-strength. Without that, we stick to the constant we had
273 before, for now. */
274 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
275 # define EXIM_SERVER_DH_BITS_PRE2_12 1024
276 #endif
277
278 #define expand_check_tlsvar(Varname, errstr) \
279 expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr)
280
281 #if GNUTLS_VERSION_NUMBER >= 0x020c00
282 # define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
283 # define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
284 # define HAVE_GNUTLS_RND
285 /* The security fix we provide with the gnutls_allow_auto_pkcs11 option
286 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
287 * isn't available sometimes, so this needs to become a conditional
288 * compilation; the sanest way to deal with this being a problem on
289 * older OSes is to block it in the Local/Makefile with this compiler
290 * definition */
291 # ifndef AVOID_GNUTLS_PKCS11
292 # define HAVE_GNUTLS_PKCS11
293 # endif /* AVOID_GNUTLS_PKCS11 */
294 #endif
295
296
297
298
299 /* ------------------------------------------------------------------------ */
300 /* Callback declarations */
301
302 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
303 static void exim_gnutls_logger_cb(int level, const char *message);
304 #endif
305
306 static int exim_sni_handling_cb(gnutls_session_t session);
307
308 #ifdef EXPERIMENTAL_TLS_RESUME
309 static int
310 tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
311 unsigned incoming, const gnutls_datum_t * msg);
312 #endif
313
314
315 /* Daemon one-time initialisation */
316 void
317 tls_daemon_init(void)
318 {
319 #ifdef EXPERIMENTAL_TLS_RESUME
320 /* We are dependent on the GnuTLS implementation of the Session Ticket
321 encryption; both the strength and the key rotation period. We hope that
322 the strength at least matches that of the ciphersuite (but GnuTLS does not
323 document this). */
324
325 static BOOL once = FALSE;
326 if (once) return;
327 once = TRUE;
328 gnutls_session_ticket_key_generate(&server_sessticket_key); /* >= 2.10.0 */
329 if (f.running_in_test_harness) ssl_session_timeout = 6;
330 #endif
331 }
332
333 /* ------------------------------------------------------------------------ */
334 /* Static functions */
335
336 /*************************************************
337 * Handle TLS error *
338 *************************************************/
339
340 /* Called from lots of places when errors occur before actually starting to do
341 the TLS handshake, that is, while the session is still in clear. Always returns
342 DEFER for a server and FAIL for a client so that most calls can use "return
343 tls_error(...)" to do this processing and then give an appropriate return. A
344 single function is used for both server and client, because it is called from
345 some shared functions.
346
347 Argument:
348 prefix text to include in the logged error
349 msg additional error string (may be NULL)
350 usually obtained from gnutls_strerror()
351 host NULL if setting up a server;
352 the connected host if setting up a client
353 errstr pointer to returned error string
354
355 Returns: OK/DEFER/FAIL
356 */
357
358 static int
359 tls_error(const uschar *prefix, const uschar *msg, const host_item *host,
360 uschar ** errstr)
361 {
362 if (errstr)
363 *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : US"");
364 return host ? FAIL : DEFER;
365 }
366
367
368 static int
369 tls_error_gnu(const uschar *prefix, int err, const host_item *host,
370 uschar ** errstr)
371 {
372 return tls_error(prefix, US gnutls_strerror(err), host, errstr);
373 }
374
375 static int
376 tls_error_sys(const uschar *prefix, int err, const host_item *host,
377 uschar ** errstr)
378 {
379 return tls_error(prefix, US strerror(err), host, errstr);
380 }
381
382
383 /*************************************************
384 * Deal with logging errors during I/O *
385 *************************************************/
386
387 /* We have to get the identity of the peer from saved data.
388
389 Argument:
390 state the current GnuTLS exim state container
391 rc the GnuTLS error code, or 0 if it's a local error
392 when text identifying read or write
393 text local error text when rc is 0
394
395 Returns: nothing
396 */
397
398 static void
399 record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
400 {
401 const uschar * msg;
402 uschar * errstr;
403
404 if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
405 msg = string_sprintf("A TLS fatal alert has been received: %s",
406 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
407 else
408 msg = US gnutls_strerror(rc);
409
410 (void) tls_error(when, msg, state->host, &errstr);
411
412 if (state->host)
413 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection %s",
414 state->host->name, state->host->address, errstr);
415 else
416 {
417 uschar * conn_info = smtp_get_connection_info();
418 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0) conn_info += 5;
419 /* I'd like to get separated H= here, but too hard for now */
420 log_write(0, LOG_MAIN, "TLS error on %s %s", conn_info, errstr);
421 }
422 }
423
424
425
426
427 /*************************************************
428 * Set various Exim expansion vars *
429 *************************************************/
430
431 #define exim_gnutls_cert_err(Label) \
432 do \
433 { \
434 if (rc != GNUTLS_E_SUCCESS) \
435 { \
436 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
437 (Label), gnutls_strerror(rc)); \
438 return rc; \
439 } \
440 } while (0)
441
442 static int
443 import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
444 {
445 int rc;
446
447 rc = gnutls_x509_crt_init(crtp);
448 exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
449
450 rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
451 exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
452
453 return rc;
454 }
455
456 #undef exim_gnutls_cert_err
457
458
459 /* We set various Exim global variables from the state, once a session has
460 been established. With TLS callouts, may need to change this to stack
461 variables, or just re-call it with the server state after client callout
462 has finished.
463
464 Make sure anything set here is unset in tls_getc().
465
466 Sets:
467 tls_active fd
468 tls_bits strength indicator
469 tls_certificate_verified bool indicator
470 tls_channelbinding_b64 for some SASL mechanisms
471 tls_ver a string
472 tls_cipher a string
473 tls_peercert pointer to library internal
474 tls_peerdn a string
475 tls_sni a (UTF-8) string
476 tls_ourcert pointer to library internal
477
478 Argument:
479 state the relevant exim_gnutls_state_st *
480 */
481
482 static void
483 extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
484 {
485 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
486 int old_pool;
487 int rc;
488 gnutls_datum_t channel;
489 #endif
490 tls_support * tlsp = state->tlsp;
491
492 tlsp->active.sock = state->fd_out;
493 tlsp->active.tls_ctx = state;
494
495 DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
496
497 tlsp->certificate_verified = state->peer_cert_verified;
498 #ifdef SUPPORT_DANE
499 tlsp->dane_verified = state->peer_dane_verified;
500 #endif
501
502 /* note that tls_channelbinding_b64 is not saved to the spool file, since it's
503 only available for use for authenticators while this TLS session is running. */
504
505 tls_channelbinding_b64 = NULL;
506 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
507 channel.data = NULL;
508 channel.size = 0;
509 if ((rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel)))
510 { DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc)); }
511 else
512 {
513 old_pool = store_pool;
514 store_pool = POOL_PERM;
515 tls_channelbinding_b64 = b64encode(CUS channel.data, (int)channel.size);
516 store_pool = old_pool;
517 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
518 }
519 #endif
520
521 /* peercert is set in peer_status() */
522 tlsp->peerdn = state->peerdn;
523 tlsp->sni = state->received_sni;
524
525 /* record our certificate */
526 {
527 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
528 gnutls_x509_crt_t crt;
529
530 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
531 }
532 }
533
534
535
536
537 #ifndef GNUTLS_AUTO_DHPARAMS
538 /*************************************************
539 * Setup up DH parameters *
540 *************************************************/
541
542 /* Generating the D-H parameters may take a long time. They only need to
543 be re-generated every so often, depending on security policy. What we do is to
544 keep these parameters in a file in the spool directory. If the file does not
545 exist, we generate them. This means that it is easy to cause a regeneration.
546
547 The new file is written as a temporary file and renamed, so that an incomplete
548 file is never present. If two processes both compute some new parameters, you
549 waste a bit of effort, but it doesn't seem worth messing around with locking to
550 prevent this.
551
552 Returns: OK/DEFER/FAIL
553 */
554
555 static int
556 init_server_dh(uschar ** errstr)
557 {
558 int fd, rc;
559 unsigned int dh_bits;
560 gnutls_datum_t m = {.data = NULL, .size = 0};
561 uschar filename_buf[PATH_MAX];
562 uschar *filename = NULL;
563 size_t sz;
564 uschar *exp_tls_dhparam;
565 BOOL use_file_in_spool = FALSE;
566 host_item *host = NULL; /* dummy for macros */
567
568 DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
569
570 if ((rc = gnutls_dh_params_init(&dh_server_params)))
571 return tls_error_gnu(US"gnutls_dh_params_init", rc, host, errstr);
572
573 if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam, errstr))
574 return DEFER;
575
576 if (!exp_tls_dhparam)
577 {
578 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
579 m.data = US std_dh_prime_default();
580 m.size = Ustrlen(m.data);
581 }
582 else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
583 use_file_in_spool = TRUE;
584 else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
585 {
586 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
587 return OK;
588 }
589 else if (exp_tls_dhparam[0] != '/')
590 {
591 if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
592 return tls_error(US"No standard prime named", exp_tls_dhparam, NULL, errstr);
593 m.size = Ustrlen(m.data);
594 }
595 else
596 filename = exp_tls_dhparam;
597
598 if (m.data)
599 {
600 if ((rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM)))
601 return tls_error_gnu(US"gnutls_dh_params_import_pkcs3", rc, host, errstr);
602 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
603 return OK;
604 }
605
606 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
607 /* If you change this constant, also change dh_param_fn_ext so that we can use a
608 different filename and ensure we have sufficient bits. */
609
610 if (!(dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL)))
611 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL, errstr);
612 DEBUG(D_tls)
613 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
614 dh_bits);
615 #else
616 dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
617 DEBUG(D_tls)
618 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
619 dh_bits);
620 #endif
621
622 /* Some clients have hard-coded limits. */
623 if (dh_bits > tls_dh_max_bits)
624 {
625 DEBUG(D_tls)
626 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
627 tls_dh_max_bits);
628 dh_bits = tls_dh_max_bits;
629 }
630
631 if (use_file_in_spool)
632 {
633 if (!string_format(filename_buf, sizeof(filename_buf),
634 "%s/gnutls-params-%d", spool_directory, dh_bits))
635 return tls_error(US"overlong filename", NULL, NULL, errstr);
636 filename = filename_buf;
637 }
638
639 /* Open the cache file for reading and if successful, read it and set up the
640 parameters. */
641
642 if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
643 {
644 struct stat statbuf;
645 FILE *fp;
646 int saved_errno;
647
648 if (fstat(fd, &statbuf) < 0) /* EIO */
649 {
650 saved_errno = errno;
651 (void)close(fd);
652 return tls_error_sys(US"TLS cache stat failed", saved_errno, NULL, errstr);
653 }
654 if (!S_ISREG(statbuf.st_mode))
655 {
656 (void)close(fd);
657 return tls_error(US"TLS cache not a file", NULL, NULL, errstr);
658 }
659 if (!(fp = fdopen(fd, "rb")))
660 {
661 saved_errno = errno;
662 (void)close(fd);
663 return tls_error_sys(US"fdopen(TLS cache stat fd) failed",
664 saved_errno, NULL, errstr);
665 }
666
667 m.size = statbuf.st_size;
668 if (!(m.data = store_malloc(m.size)))
669 {
670 fclose(fp);
671 return tls_error_sys(US"malloc failed", errno, NULL, errstr);
672 }
673 if (!(sz = fread(m.data, m.size, 1, fp)))
674 {
675 saved_errno = errno;
676 fclose(fp);
677 store_free(m.data);
678 return tls_error_sys(US"fread failed", saved_errno, NULL, errstr);
679 }
680 fclose(fp);
681
682 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
683 store_free(m.data);
684 if (rc)
685 return tls_error_gnu(US"gnutls_dh_params_import_pkcs3", rc, host, errstr);
686 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
687 }
688
689 /* If the file does not exist, fall through to compute new data and cache it.
690 If there was any other opening error, it is serious. */
691
692 else if (errno == ENOENT)
693 {
694 rc = -1;
695 DEBUG(D_tls)
696 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
697 }
698 else
699 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
700 NULL, NULL, errstr);
701
702 /* If ret < 0, either the cache file does not exist, or the data it contains
703 is not useful. One particular case of this is when upgrading from an older
704 release of Exim in which the data was stored in a different format. We don't
705 try to be clever and support both formats; we just regenerate new data in this
706 case. */
707
708 if (rc < 0)
709 {
710 uschar *temp_fn;
711 unsigned int dh_bits_gen = dh_bits;
712
713 if ((PATH_MAX - Ustrlen(filename)) < 10)
714 return tls_error(US"Filename too long to generate replacement",
715 filename, NULL, errstr);
716
717 temp_fn = string_copy(US"%s.XXXXXXX");
718 if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */
719 return tls_error_sys(US"Unable to open temp file", errno, NULL, errstr);
720 (void)exim_chown(temp_fn, exim_uid, exim_gid); /* Probably not necessary */
721
722 /* GnuTLS overshoots! If we ask for 2236, we might get 2237 or more. But
723 there's no way to ask GnuTLS how many bits there really are. We can ask
724 how many bits were used in a TLS session, but that's it! The prime itself
725 is hidden behind too much abstraction. So we ask for less, and proceed on
726 a wing and a prayer. First attempt, subtracted 3 for 2233 and got 2240. */
727
728 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
729 {
730 dh_bits_gen = dh_bits - 10;
731 DEBUG(D_tls)
732 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
733 dh_bits_gen);
734 }
735
736 DEBUG(D_tls)
737 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
738 dh_bits_gen);
739 if ((rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen)))
740 return tls_error_gnu(US"gnutls_dh_params_generate2", rc, host, errstr);
741
742 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
743 and I confirmed that a NULL call to get the size first is how the GnuTLS
744 sample apps handle this. */
745
746 sz = 0;
747 m.data = NULL;
748 if ( (rc = gnutls_dh_params_export_pkcs3(dh_server_params,
749 GNUTLS_X509_FMT_PEM, m.data, &sz))
750 && rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
751 return tls_error_gnu(US"gnutls_dh_params_export_pkcs3(NULL) sizing",
752 rc, host, errstr);
753 m.size = sz;
754 if (!(m.data = store_malloc(m.size)))
755 return tls_error_sys(US"memory allocation failed", errno, NULL, errstr);
756
757 /* this will return a size 1 less than the allocation size above */
758 if ((rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
759 m.data, &sz)))
760 {
761 store_free(m.data);
762 return tls_error_gnu(US"gnutls_dh_params_export_pkcs3() real", rc, host, errstr);
763 }
764 m.size = sz; /* shrink by 1, probably */
765
766 if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
767 {
768 store_free(m.data);
769 return tls_error_sys(US"TLS cache write D-H params failed",
770 errno, NULL, errstr);
771 }
772 store_free(m.data);
773 if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
774 return tls_error_sys(US"TLS cache write D-H params final newline failed",
775 errno, NULL, errstr);
776
777 if ((rc = close(fd)))
778 return tls_error_sys(US"TLS cache write close() failed", errno, NULL, errstr);
779
780 if (Urename(temp_fn, filename) < 0)
781 return tls_error_sys(string_sprintf("failed to rename \"%s\" as \"%s\"",
782 temp_fn, filename), errno, NULL, errstr);
783
784 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
785 }
786
787 DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
788 return OK;
789 }
790 #endif
791
792
793
794
795 /* Create and install a selfsigned certificate, for use in server mode */
796
797 static int
798 tls_install_selfsign(exim_gnutls_state_st * state, uschar ** errstr)
799 {
800 gnutls_x509_crt_t cert = NULL;
801 time_t now;
802 gnutls_x509_privkey_t pkey = NULL;
803 const uschar * where;
804 int rc;
805
806 where = US"initialising pkey";
807 if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
808
809 where = US"initialising cert";
810 if ((rc = gnutls_x509_crt_init(&cert))) goto err;
811
812 where = US"generating pkey";
813 if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
814 #ifdef SUPPORT_PARAM_TO_PK_BITS
815 # ifndef GNUTLS_SEC_PARAM_MEDIUM
816 # define GNUTLS_SEC_PARAM_MEDIUM GNUTLS_SEC_PARAM_HIGH
817 # endif
818 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_MEDIUM),
819 #else
820 2048,
821 #endif
822 0)))
823 goto err;
824
825 where = US"configuring cert";
826 now = 1;
827 if ( (rc = gnutls_x509_crt_set_version(cert, 3))
828 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
829 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
830 || (rc = gnutls_x509_crt_set_expiration_time(cert, now + 60 * 60)) /* 1 hr */
831 || (rc = gnutls_x509_crt_set_key(cert, pkey))
832
833 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
834 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
835 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
836 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
837 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
838 GNUTLS_OID_X520_COMMON_NAME, 0,
839 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
840 )
841 goto err;
842
843 where = US"signing cert";
844 if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
845
846 where = US"installing selfsign cert";
847 /* Since: 2.4.0 */
848 if ((rc = gnutls_certificate_set_x509_key(state->x509_cred, &cert, 1, pkey)))
849 goto err;
850
851 rc = OK;
852
853 out:
854 if (cert) gnutls_x509_crt_deinit(cert);
855 if (pkey) gnutls_x509_privkey_deinit(pkey);
856 return rc;
857
858 err:
859 rc = tls_error_gnu(where, rc, NULL, errstr);
860 goto out;
861 }
862
863
864
865
866 /* Add certificate and key, from files.
867
868 Return:
869 Zero or negative: good. Negate value for certificate index if < 0.
870 Greater than zero: FAIL or DEFER code.
871 */
872
873 static int
874 tls_add_certfile(exim_gnutls_state_st * state, const host_item * host,
875 uschar * certfile, uschar * keyfile, uschar ** errstr)
876 {
877 int rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
878 CS certfile, CS keyfile, GNUTLS_X509_FMT_PEM);
879 if (rc < 0)
880 return tls_error_gnu(
881 string_sprintf("cert/key setup: cert=%s key=%s", certfile, keyfile),
882 rc, host, errstr);
883 return -rc;
884 }
885
886
887 #if !defined(DISABLE_OCSP) && !defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
888 /* Load an OCSP proof from file for sending by the server. Called
889 on getting a status-request handshake message, for earlier versions
890 of GnuTLS. */
891
892 static int
893 server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
894 gnutls_datum_t * ocsp_response)
895 {
896 int ret;
897 DEBUG(D_tls) debug_printf("OCSP stapling callback: %s\n", US ptr);
898
899 if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
900 {
901 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
902 CS ptr);
903 tls_in.ocsp = OCSP_NOT_RESP;
904 return GNUTLS_E_NO_CERTIFICATE_STATUS;
905 }
906
907 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
908 return 0;
909 }
910 #endif
911
912
913 #ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
914 /* Make a note that we saw a status-request */
915 static int
916 tls_server_clienthello_ext(void * ctx, unsigned tls_id,
917 const unsigned char *data, unsigned size)
918 {
919 /* https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
920 if (tls_id == 5) /* status_request */
921 {
922 DEBUG(D_tls) debug_printf("Seen status_request extension from client\n");
923 tls_in.ocsp = OCSP_NOT_RESP;
924 }
925 return 0;
926 }
927
928 /* Callback for client-hello, on server, if we think we might serve stapled-OCSP */
929 static int
930 tls_server_clienthello_cb(gnutls_session_t session, unsigned int htype,
931 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
932 {
933 /* Call fn for each extension seen. 3.6.3 onwards */
934 return gnutls_ext_raw_parse(NULL, tls_server_clienthello_ext, msg,
935 GNUTLS_EXT_RAW_FLAG_TLS_CLIENT_HELLO);
936 }
937
938
939 /* Make a note that we saw a status-response */
940 static int
941 tls_server_servercerts_ext(void * ctx, unsigned tls_id,
942 const unsigned char *data, unsigned size)
943 {
944 /* debug_printf("%s %u\n", __FUNCTION__, tls_id); */
945 /* https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
946 if (FALSE && tls_id == 5) /* status_request */
947 {
948 DEBUG(D_tls) debug_printf("Seen status_request extension\n");
949 tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
950 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
951 }
952 return 0;
953 }
954
955 /* Callback for certificates packet, on server, if we think we might serve stapled-OCSP */
956 static int
957 tls_server_servercerts_cb(gnutls_session_t session, unsigned int htype,
958 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
959 {
960 /* Call fn for each extension seen. 3.6.3 onwards */
961 #ifdef notdef
962 /*XXX crashes */
963 return gnutls_ext_raw_parse(NULL, tls_server_servercerts_ext, msg, 0);
964 #endif
965 }
966 #endif
967
968 /*XXX in tls1.3 the cert-status travel as an extension next to the cert, in the
969 "Handshake Protocol: Certificate" record.
970 So we need to spot the Certificate handshake message, parse it and spot any status_request extension(s)
971
972 This is different to tls1.2 - where it is a separate record (wireshake term) / handshake message (gnutls term).
973 */
974
975 #if defined(EXPERIMENTAL_TLS_RESUME) || defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
976 /* Callback for certificate-status, on server. We sent stapled OCSP. */
977 static int
978 tls_server_certstatus_cb(gnutls_session_t session, unsigned int htype,
979 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
980 {
981 DEBUG(D_tls) debug_printf("Sending certificate-status\n"); /*XXX we get this for tls1.2 but not for 1.3 */
982 #ifdef SUPPORT_SRV_OCSP_STACK
983 tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
984 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
985 #else
986 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
987 #endif
988 return 0;
989 }
990
991 /* Callback for handshake messages, on server */
992 static int
993 tls_server_hook_cb(gnutls_session_t sess, u_int htype, unsigned when,
994 unsigned incoming, const gnutls_datum_t * msg)
995 {
996 /* debug_printf("%s: htype %u\n", __FUNCTION__, htype); */
997 switch (htype)
998 {
999 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1000 case GNUTLS_HANDSHAKE_CLIENT_HELLO:
1001 return tls_server_clienthello_cb(sess, htype, when, incoming, msg);
1002 case GNUTLS_HANDSHAKE_CERTIFICATE_PKT:
1003 return tls_server_servercerts_cb(sess, htype, when, incoming, msg);
1004 # endif
1005 case GNUTLS_HANDSHAKE_CERTIFICATE_STATUS:
1006 return tls_server_certstatus_cb(sess, htype, when, incoming, msg);
1007 # ifdef EXPERIMENTAL_TLS_RESUME
1008 case GNUTLS_HANDSHAKE_NEW_SESSION_TICKET:
1009 return tls_server_ticket_cb(sess, htype, when, incoming, msg);
1010 # endif
1011 default:
1012 return 0;
1013 }
1014 }
1015 #endif
1016
1017
1018 #if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1019 static void
1020 tls_server_testharness_ocsp_fiddle(void)
1021 {
1022 extern char ** environ;
1023 if (environ) for (uschar ** p = USS environ; *p; p++)
1024 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1025 {
1026 DEBUG(D_tls) debug_printf("Permitting known bad OCSP response\n");
1027 exim_testharness_disable_ocsp_validity_check = TRUE;
1028 }
1029 }
1030 #endif
1031
1032 /*************************************************
1033 * Variables re-expanded post-SNI *
1034 *************************************************/
1035
1036 /* Called from both server and client code, via tls_init(), and also from
1037 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
1038
1039 We can tell the two apart by state->received_sni being non-NULL in callback.
1040
1041 The callback should not call us unless state->trigger_sni_changes is true,
1042 which we are responsible for setting on the first pass through.
1043
1044 Arguments:
1045 state exim_gnutls_state_st *
1046 errstr error string pointer
1047
1048 Returns: OK/DEFER/FAIL
1049 */
1050
1051 static int
1052 tls_expand_session_files(exim_gnutls_state_st * state, uschar ** errstr)
1053 {
1054 struct stat statbuf;
1055 int rc;
1056 const host_item *host = state->host; /* macro should be reconsidered? */
1057 uschar *saved_tls_certificate = NULL;
1058 uschar *saved_tls_privatekey = NULL;
1059 uschar *saved_tls_verify_certificates = NULL;
1060 uschar *saved_tls_crl = NULL;
1061 int cert_count;
1062
1063 /* We check for tls_sni *before* expansion. */
1064 if (!host) /* server */
1065 if (!state->received_sni)
1066 {
1067 if ( state->tls_certificate
1068 && ( Ustrstr(state->tls_certificate, US"tls_sni")
1069 || Ustrstr(state->tls_certificate, US"tls_in_sni")
1070 || Ustrstr(state->tls_certificate, US"tls_out_sni")
1071 ) )
1072 {
1073 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
1074 state->trigger_sni_changes = TRUE;
1075 }
1076 }
1077 else
1078 {
1079 /* useful for debugging */
1080 saved_tls_certificate = state->exp_tls_certificate;
1081 saved_tls_privatekey = state->exp_tls_privatekey;
1082 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
1083 saved_tls_crl = state->exp_tls_crl;
1084 }
1085
1086 if ((rc = gnutls_certificate_allocate_credentials(&state->x509_cred)))
1087 return tls_error_gnu(US"gnutls_certificate_allocate_credentials",
1088 rc, host, errstr);
1089
1090 #ifdef SUPPORT_SRV_OCSP_STACK
1091 gnutls_certificate_set_flags(state->x509_cred, GNUTLS_CERTIFICATE_API_V2);
1092
1093 # if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1094 if (!host && tls_ocsp_file)
1095 {
1096 if (f.running_in_test_harness)
1097 tls_server_testharness_ocsp_fiddle();
1098
1099 if (exim_testharness_disable_ocsp_validity_check)
1100 gnutls_certificate_set_flags(state->x509_cred,
1101 GNUTLS_CERTIFICATE_API_V2 | GNUTLS_CERTIFICATE_SKIP_OCSP_RESPONSE_CHECK);
1102 }
1103 # endif
1104 #endif
1105
1106 /* remember: expand_check_tlsvar() is expand_check() but fiddling with
1107 state members, assuming consistent naming; and expand_check() returns
1108 false if expansion failed, unless expansion was forced to fail. */
1109
1110 /* check if we at least have a certificate, before doing expensive
1111 D-H generation. */
1112
1113 if (!expand_check_tlsvar(tls_certificate, errstr))
1114 return DEFER;
1115
1116 /* certificate is mandatory in server, optional in client */
1117
1118 if ( !state->exp_tls_certificate
1119 || !*state->exp_tls_certificate
1120 )
1121 if (!host)
1122 return tls_install_selfsign(state, errstr);
1123 else
1124 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
1125
1126 if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey, errstr))
1127 return DEFER;
1128
1129 /* tls_privatekey is optional, defaulting to same file as certificate */
1130
1131 if (!state->tls_privatekey || !*state->tls_privatekey)
1132 {
1133 state->tls_privatekey = state->tls_certificate;
1134 state->exp_tls_privatekey = state->exp_tls_certificate;
1135 }
1136
1137
1138 if (state->exp_tls_certificate && *state->exp_tls_certificate)
1139 {
1140 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
1141 state->exp_tls_certificate, state->exp_tls_privatekey);
1142
1143 if (state->received_sni)
1144 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
1145 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
1146 )
1147 {
1148 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
1149 }
1150 else
1151 {
1152 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
1153 }
1154
1155 if (!host) /* server */
1156 {
1157 const uschar * clist = state->exp_tls_certificate;
1158 const uschar * klist = state->exp_tls_privatekey;
1159 const uschar * olist;
1160 int csep = 0, ksep = 0, osep = 0, cnt = 0;
1161 uschar * cfile, * kfile, * ofile;
1162 #ifndef DISABLE_OCSP
1163 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1164 gnutls_x509_crt_fmt_t ocsp_fmt = GNUTLS_X509_FMT_DER;
1165 # endif
1166
1167 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file", &ofile, errstr))
1168 return DEFER;
1169 olist = ofile;
1170 #endif
1171
1172 while (cfile = string_nextinlist(&clist, &csep, NULL, 0))
1173
1174 if (!(kfile = string_nextinlist(&klist, &ksep, NULL, 0)))
1175 return tls_error(US"cert/key setup: out of keys", NULL, host, errstr);
1176 else if (0 < (rc = tls_add_certfile(state, host, cfile, kfile, errstr)))
1177 return rc;
1178 else
1179 {
1180 int gnutls_cert_index = -rc;
1181 DEBUG(D_tls) debug_printf("TLS: cert/key %d %s registered\n",
1182 gnutls_cert_index, cfile);
1183
1184 #ifndef DISABLE_OCSP
1185 if (tls_ocsp_file)
1186 {
1187 /* Set the OCSP stapling server info */
1188 if (gnutls_buggy_ocsp)
1189 {
1190 DEBUG(D_tls)
1191 debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
1192 }
1193 else if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1194 {
1195 DEBUG(D_tls) debug_printf("OCSP response file %d = %s\n",
1196 gnutls_cert_index, ofile);
1197 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1198 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
1199 {
1200 ocsp_fmt = GNUTLS_X509_FMT_PEM;
1201 ofile += 4;
1202 }
1203 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1204 {
1205 ocsp_fmt = GNUTLS_X509_FMT_DER;
1206 ofile += 4;
1207 }
1208
1209 if ((rc = gnutls_certificate_set_ocsp_status_request_file2(
1210 state->x509_cred, CCS ofile, gnutls_cert_index,
1211 ocsp_fmt)) < 0)
1212 return tls_error_gnu(
1213 US"gnutls_certificate_set_ocsp_status_request_file2",
1214 rc, host, errstr);
1215 DEBUG(D_tls)
1216 debug_printf(" %d response%s loaded\n", rc, rc>1 ? "s":"");
1217
1218 /* Arrange callbacks for OCSP request observability */
1219
1220 gnutls_handshake_set_hook_function(state->session,
1221 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
1222
1223 # else
1224 # if defined(SUPPORT_SRV_OCSP_STACK)
1225 if ((rc = gnutls_certificate_set_ocsp_status_request_function2(
1226 state->x509_cred, gnutls_cert_index,
1227 server_ocsp_stapling_cb, ofile)))
1228 return tls_error_gnu(
1229 US"gnutls_certificate_set_ocsp_status_request_function2",
1230 rc, host, errstr);
1231 else
1232 # endif
1233 {
1234 if (cnt++ > 0)
1235 {
1236 DEBUG(D_tls)
1237 debug_printf("oops; multiple OCSP files not supported\n");
1238 break;
1239 }
1240 gnutls_certificate_set_ocsp_status_request_function(
1241 state->x509_cred, server_ocsp_stapling_cb, ofile);
1242 }
1243 # endif /* SUPPORT_GNUTLS_EXT_RAW_PARSE */
1244 }
1245 else
1246 DEBUG(D_tls) debug_printf("ran out of OCSP response files in list\n");
1247 }
1248 #endif /* DISABLE_OCSP */
1249 }
1250 }
1251 else /* client */
1252 {
1253 if (0 < (rc = tls_add_certfile(state, host,
1254 state->exp_tls_certificate, state->exp_tls_privatekey, errstr)))
1255 return rc;
1256 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
1257 }
1258
1259 } /* tls_certificate */
1260
1261
1262 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
1263 provided. Experiment shows that, if the certificate file is empty, an unhelpful
1264 error message is provided. However, if we just refrain from setting anything up
1265 in that case, certificate verification fails, which seems to be the correct
1266 behaviour. */
1267
1268 if (state->tls_verify_certificates && *state->tls_verify_certificates)
1269 {
1270 if (!expand_check_tlsvar(tls_verify_certificates, errstr))
1271 return DEFER;
1272 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1273 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1274 state->exp_tls_verify_certificates = NULL;
1275 #endif
1276 if (state->tls_crl && *state->tls_crl)
1277 if (!expand_check_tlsvar(tls_crl, errstr))
1278 return DEFER;
1279
1280 if (!(state->exp_tls_verify_certificates &&
1281 *state->exp_tls_verify_certificates))
1282 {
1283 DEBUG(D_tls)
1284 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
1285 /* With no tls_verify_certificates, we ignore tls_crl too */
1286 return OK;
1287 }
1288 }
1289 else
1290 {
1291 DEBUG(D_tls)
1292 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
1293 return OK;
1294 }
1295
1296 #ifdef SUPPORT_SYSDEFAULT_CABUNDLE
1297 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1298 cert_count = gnutls_certificate_set_x509_system_trust(state->x509_cred);
1299 else
1300 #endif
1301 {
1302 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
1303 {
1304 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat '%s' "
1305 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
1306 strerror(errno));
1307 return DEFER;
1308 }
1309
1310 #ifndef SUPPORT_CA_DIR
1311 /* The test suite passes in /dev/null; we could check for that path explicitly,
1312 but who knows if someone has some weird FIFO which always dumps some certs, or
1313 other weirdness. The thing we really want to check is that it's not a
1314 directory, since while OpenSSL supports that, GnuTLS does not.
1315 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
1316 if (S_ISDIR(statbuf.st_mode))
1317 {
1318 DEBUG(D_tls)
1319 debug_printf("verify certificates path is a dir: \"%s\"\n",
1320 state->exp_tls_verify_certificates);
1321 log_write(0, LOG_MAIN|LOG_PANIC,
1322 "tls_verify_certificates \"%s\" is a directory",
1323 state->exp_tls_verify_certificates);
1324 return DEFER;
1325 }
1326 #endif
1327
1328 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
1329 state->exp_tls_verify_certificates, statbuf.st_size);
1330
1331 if (statbuf.st_size == 0)
1332 {
1333 DEBUG(D_tls)
1334 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
1335 return OK;
1336 }
1337
1338 cert_count =
1339
1340 #ifdef SUPPORT_CA_DIR
1341 (statbuf.st_mode & S_IFMT) == S_IFDIR
1342 ?
1343 gnutls_certificate_set_x509_trust_dir(state->x509_cred,
1344 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM)
1345 :
1346 #endif
1347 gnutls_certificate_set_x509_trust_file(state->x509_cred,
1348 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
1349
1350 #ifdef SUPPORT_CA_DIR
1351 /* Mimic the behaviour with OpenSSL of not advertising a usable-cert list
1352 when using the directory-of-certs config model. */
1353
1354 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1355 gnutls_certificate_send_x509_rdn_sequence(state->session, 1);
1356 #endif
1357 }
1358
1359 if (cert_count < 0)
1360 return tls_error_gnu(US"setting certificate trust", cert_count, host, errstr);
1361 DEBUG(D_tls)
1362 debug_printf("Added %d certificate authorities.\n", cert_count);
1363
1364 if (state->tls_crl && *state->tls_crl &&
1365 state->exp_tls_crl && *state->exp_tls_crl)
1366 {
1367 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
1368 if ((cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
1369 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM)) < 0)
1370 return tls_error_gnu(US"gnutls_certificate_set_x509_crl_file",
1371 cert_count, host, errstr);
1372
1373 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1374 }
1375
1376 return OK;
1377 }
1378
1379
1380
1381
1382 /*************************************************
1383 * Set X.509 state variables *
1384 *************************************************/
1385
1386 /* In GnuTLS, the registered cert/key are not replaced by a later
1387 set of a cert/key, so for SNI support we need a whole new x509_cred
1388 structure. Which means various other non-re-expanded pieces of state
1389 need to be re-set in the new struct, so the setting logic is pulled
1390 out to this.
1391
1392 Arguments:
1393 state exim_gnutls_state_st *
1394 errstr error string pointer
1395
1396 Returns: OK/DEFER/FAIL
1397 */
1398
1399 static int
1400 tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr)
1401 {
1402 int rc;
1403 const host_item *host = state->host; /* macro should be reconsidered? */
1404
1405 #ifndef GNUTLS_AUTO_DHPARAMS
1406 /* Create D-H parameters, or read them from the cache file. This function does
1407 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
1408 client-side params. */
1409
1410 if (!state->host)
1411 {
1412 if (!dh_server_params)
1413 if ((rc = init_server_dh(errstr)) != OK) return rc;
1414
1415 /* Unnecessary & discouraged with 3.6.0 or later */
1416 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
1417 }
1418 #endif
1419
1420 /* Link the credentials to the session. */
1421
1422 if ((rc = gnutls_credentials_set(state->session,
1423 GNUTLS_CRD_CERTIFICATE, state->x509_cred)))
1424 return tls_error_gnu(US"gnutls_credentials_set", rc, host, errstr);
1425
1426 return OK;
1427 }
1428
1429 /*************************************************
1430 * Initialize for GnuTLS *
1431 *************************************************/
1432
1433
1434 #ifndef DISABLE_OCSP
1435
1436 static BOOL
1437 tls_is_buggy_ocsp(void)
1438 {
1439 const uschar * s;
1440 uschar maj, mid, mic;
1441
1442 s = CUS gnutls_check_version(NULL);
1443 maj = atoi(CCS s);
1444 if (maj == 3)
1445 {
1446 while (*s && *s != '.') s++;
1447 mid = atoi(CCS ++s);
1448 if (mid <= 2)
1449 return TRUE;
1450 else if (mid >= 5)
1451 return FALSE;
1452 else
1453 {
1454 while (*s && *s != '.') s++;
1455 mic = atoi(CCS ++s);
1456 return mic <= (mid == 3 ? 16 : 3);
1457 }
1458 }
1459 return FALSE;
1460 }
1461
1462 #endif
1463
1464
1465 /* Called from both server and client code. In the case of a server, errors
1466 before actual TLS negotiation return DEFER.
1467
1468 Arguments:
1469 host connected host, if client; NULL if server
1470 certificate certificate file
1471 privatekey private key file
1472 sni TLS SNI to send, sometimes when client; else NULL
1473 cas CA certs file
1474 crl CRL file
1475 require_ciphers tls_require_ciphers setting
1476 caller_state returned state-info structure
1477 errstr error string pointer
1478
1479 Returns: OK/DEFER/FAIL
1480 */
1481
1482 static int
1483 tls_init(
1484 const host_item *host,
1485 const uschar *certificate,
1486 const uschar *privatekey,
1487 const uschar *sni,
1488 const uschar *cas,
1489 const uschar *crl,
1490 const uschar *require_ciphers,
1491 exim_gnutls_state_st **caller_state,
1492 tls_support * tlsp,
1493 uschar ** errstr)
1494 {
1495 exim_gnutls_state_st * state;
1496 int rc;
1497 size_t sz;
1498 const char * errpos;
1499 const uschar * p;
1500
1501 if (!exim_gnutls_base_init_done)
1502 {
1503 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1504
1505 #if defined(HAVE_GNUTLS_PKCS11) && !defined(GNUTLS_AUTO_PKCS11_MANUAL)
1506 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1507 which loads modules from a config file, which sounds good and may be wanted
1508 by some sysadmin, but also means in common configurations that GNOME keyring
1509 environment variables are used and so breaks for users calling mailq.
1510 To prevent this, we init PKCS11 first, which is the documented approach. */
1511 if (!gnutls_allow_auto_pkcs11)
1512 if ((rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL)))
1513 return tls_error_gnu(US"gnutls_pkcs11_init", rc, host, errstr);
1514 #endif
1515
1516 #ifndef GNUTLS_AUTO_GLOBAL_INIT
1517 if ((rc = gnutls_global_init()))
1518 return tls_error_gnu(US"gnutls_global_init", rc, host, errstr);
1519 #endif
1520
1521 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1522 DEBUG(D_tls)
1523 {
1524 gnutls_global_set_log_function(exim_gnutls_logger_cb);
1525 /* arbitrarily chosen level; bump up to 9 for more */
1526 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
1527 }
1528 #endif
1529
1530 #ifndef DISABLE_OCSP
1531 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
1532 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
1533 #endif
1534
1535 exim_gnutls_base_init_done = TRUE;
1536 }
1537
1538 if (host)
1539 {
1540 /* For client-side sessions we allocate a context. This lets us run
1541 several in parallel. */
1542 int old_pool = store_pool;
1543 store_pool = POOL_PERM;
1544 state = store_get(sizeof(exim_gnutls_state_st), FALSE);
1545 store_pool = old_pool;
1546
1547 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1548 state->tlsp = tlsp;
1549 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1550 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1551 }
1552 else
1553 {
1554 state = &state_server;
1555 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1556 state->tlsp = tlsp;
1557 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1558 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1559 }
1560 if (rc)
1561 return tls_error_gnu(US"gnutls_init", rc, host, errstr);
1562
1563 state->host = host;
1564
1565 state->tls_certificate = certificate;
1566 state->tls_privatekey = privatekey;
1567 state->tls_require_ciphers = require_ciphers;
1568 state->tls_sni = sni;
1569 state->tls_verify_certificates = cas;
1570 state->tls_crl = crl;
1571
1572 /* This handles the variables that might get re-expanded after TLS SNI;
1573 that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
1574
1575 DEBUG(D_tls)
1576 debug_printf("Expanding various TLS configuration options for session credentials.\n");
1577 if ((rc = tls_expand_session_files(state, errstr)) != OK) return rc;
1578
1579 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1580 requires a new structure afterwards. */
1581
1582 if ((rc = tls_set_remaining_x509(state, errstr)) != OK) return rc;
1583
1584 /* set SNI in client, only */
1585 if (host)
1586 {
1587 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni, errstr))
1588 return DEFER;
1589 if (state->tlsp->sni && *state->tlsp->sni)
1590 {
1591 DEBUG(D_tls)
1592 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1593 sz = Ustrlen(state->tlsp->sni);
1594 if ((rc = gnutls_server_name_set(state->session,
1595 GNUTLS_NAME_DNS, state->tlsp->sni, sz)))
1596 return tls_error_gnu(US"gnutls_server_name_set", rc, host, errstr);
1597 }
1598 }
1599 else if (state->tls_sni)
1600 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
1601 "have an SNI set for a server [%s]\n", state->tls_sni);
1602
1603 /* This is the priority string support,
1604 http://www.gnutls.org/manual/html_node/Priority-Strings.html
1605 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1606 This was backwards incompatible, but means Exim no longer needs to track
1607 all algorithms and provide string forms for them. */
1608
1609 p = NULL;
1610 if (state->tls_require_ciphers && *state->tls_require_ciphers)
1611 {
1612 if (!expand_check_tlsvar(tls_require_ciphers, errstr))
1613 return DEFER;
1614 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
1615 {
1616 p = state->exp_tls_require_ciphers;
1617 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n", p);
1618 }
1619 }
1620 if (!p)
1621 {
1622 p = exim_default_gnutls_priority;
1623 DEBUG(D_tls)
1624 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n", p);
1625 }
1626
1627 if ((rc = gnutls_priority_init(&state->priority_cache, CCS p, &errpos)))
1628 return tls_error_gnu(string_sprintf(
1629 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1630 p, errpos - CS p, errpos),
1631 rc, host, errstr);
1632
1633 if ((rc = gnutls_priority_set(state->session, state->priority_cache)))
1634 return tls_error_gnu(US"gnutls_priority_set", rc, host, errstr);
1635
1636 /* This also sets the server ticket expiration time to the same, and
1637 the STEK rotation time to 3x. */
1638
1639 gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1640
1641 /* Reduce security in favour of increased compatibility, if the admin
1642 decides to make that trade-off. */
1643 if (gnutls_compat_mode)
1644 {
1645 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1646 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1647 gnutls_session_enable_compatibility_mode(state->session);
1648 #else
1649 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1650 #endif
1651 }
1652
1653 *caller_state = state;
1654 return OK;
1655 }
1656
1657
1658
1659 /*************************************************
1660 * Extract peer information *
1661 *************************************************/
1662
1663 static const uschar *
1664 cipher_stdname_kcm(gnutls_kx_algorithm_t kx, gnutls_cipher_algorithm_t cipher,
1665 gnutls_mac_algorithm_t mac)
1666 {
1667 uschar cs_id[2];
1668 gnutls_kx_algorithm_t kx_i;
1669 gnutls_cipher_algorithm_t cipher_i;
1670 gnutls_mac_algorithm_t mac_i;
1671
1672 for (size_t i = 0;
1673 gnutls_cipher_suite_info(i, cs_id, &kx_i, &cipher_i, &mac_i, NULL);
1674 i++)
1675 if (kx_i == kx && cipher_i == cipher && mac_i == mac)
1676 return cipher_stdname(cs_id[0], cs_id[1]);
1677 return NULL;
1678 }
1679
1680
1681
1682 /* Called from both server and client code.
1683 Only this is allowed to set state->peerdn and state->have_set_peerdn
1684 and we use that to detect double-calls.
1685
1686 NOTE: the state blocks last while the TLS connection is up, which is fine
1687 for logging in the server side, but for the client side, we log after teardown
1688 in src/deliver.c. While the session is up, we can twist about states and
1689 repoint tls_* globals, but those variables used for logging or other variable
1690 expansion that happens _after_ delivery need to have a longer life-time.
1691
1692 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1693 doing this more than once per generation of a state context. We set them in
1694 the state context, and repoint tls_* to them. After the state goes away, the
1695 tls_* copies of the pointers remain valid and client delivery logging is happy.
1696
1697 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1698 don't apply.
1699
1700 Arguments:
1701 state exim_gnutls_state_st *
1702 errstr pointer to error string
1703
1704 Returns: OK/DEFER/FAIL
1705 */
1706
1707 static int
1708 peer_status(exim_gnutls_state_st * state, uschar ** errstr)
1709 {
1710 gnutls_session_t session = state->session;
1711 const gnutls_datum_t * cert_list;
1712 int old_pool, rc;
1713 unsigned int cert_list_size = 0;
1714 gnutls_protocol_t protocol;
1715 gnutls_cipher_algorithm_t cipher;
1716 gnutls_kx_algorithm_t kx;
1717 gnutls_mac_algorithm_t mac;
1718 gnutls_certificate_type_t ct;
1719 gnutls_x509_crt_t crt;
1720 uschar * dn_buf;
1721 size_t sz;
1722
1723 if (state->have_set_peerdn)
1724 return OK;
1725 state->have_set_peerdn = TRUE;
1726
1727 state->peerdn = NULL;
1728
1729 /* tls_cipher */
1730 cipher = gnutls_cipher_get(session);
1731 protocol = gnutls_protocol_get_version(session);
1732 mac = gnutls_mac_get(session);
1733 kx =
1734 #ifdef GNUTLS_TLS1_3
1735 protocol >= GNUTLS_TLS1_3 ? 0 :
1736 #endif
1737 gnutls_kx_get(session);
1738
1739 old_pool = store_pool;
1740 {
1741 tls_support * tlsp = state->tlsp;
1742 store_pool = POOL_PERM;
1743
1744 #ifdef SUPPORT_GNUTLS_SESS_DESC
1745 {
1746 gstring * g = NULL;
1747 uschar * s = US gnutls_session_get_desc(session), c;
1748
1749 /* Nikos M suggests we use this by preference. It returns like:
1750 (TLS1.3)-(ECDHE-SECP256R1)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM)
1751
1752 For partial back-compat, put a colon after the TLS version, replace the
1753 )-( grouping with __, replace in-group - with _ and append the :keysize. */
1754
1755 /* debug_printf("peer_status: gnutls_session_get_desc %s\n", s); */
1756
1757 for (s++; (c = *s) && c != ')'; s++) g = string_catn(g, s, 1);
1758 tlsp->ver = string_copyn(g->s, g->ptr);
1759 g = string_catn(g, US":", 1);
1760 if (*s) s++; /* now on _ between groups */
1761 while ((c = *s))
1762 {
1763 for (*++s && ++s; (c = *s) && c != ')'; s++) g = string_catn(g, c == '-' ? US"_" : s, 1);
1764 /* now on ) closing group */
1765 if ((c = *s) && *++s == '-') g = string_catn(g, US"__", 2);
1766 /* now on _ between groups */
1767 }
1768 g = string_catn(g, US":", 1);
1769 g = string_cat(g, string_sprintf("%d", (int) gnutls_cipher_get_key_size(cipher) * 8));
1770 state->ciphersuite = string_from_gstring(g);
1771 }
1772 #else
1773 state->ciphersuite = string_sprintf("%s:%s:%d",
1774 gnutls_protocol_get_name(protocol),
1775 gnutls_cipher_suite_get_name(kx, cipher, mac),
1776 (int) gnutls_cipher_get_key_size(cipher) * 8);
1777
1778 /* I don't see a way that spaces could occur, in the current GnuTLS
1779 code base, but it was a concern in the old code and perhaps older GnuTLS
1780 releases did return "TLS 1.0"; play it safe, just in case. */
1781
1782 for (uschar * p = state->ciphersuite; *p; p++) if (isspace(*p)) *p = '-';
1783 tlsp->ver = string_copyn(state->ciphersuite,
1784 Ustrchr(state->ciphersuite, ':') - state->ciphersuite);
1785 #endif
1786
1787 /* debug_printf("peer_status: ciphersuite %s\n", state->ciphersuite); */
1788
1789 tlsp->cipher = state->ciphersuite;
1790 tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
1791
1792 tlsp->cipher_stdname = cipher_stdname_kcm(kx, cipher, mac);
1793 }
1794 store_pool = old_pool;
1795
1796 /* tls_peerdn */
1797 cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
1798
1799 if (!cert_list || cert_list_size == 0)
1800 {
1801 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1802 cert_list, cert_list_size);
1803 if (state->verify_requirement >= VERIFY_REQUIRED)
1804 return tls_error(US"certificate verification failed",
1805 US"no certificate received from peer", state->host, errstr);
1806 return OK;
1807 }
1808
1809 if ((ct = gnutls_certificate_type_get(session)) != GNUTLS_CRT_X509)
1810 {
1811 const uschar * ctn = US gnutls_certificate_type_get_name(ct);
1812 DEBUG(D_tls)
1813 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
1814 if (state->verify_requirement >= VERIFY_REQUIRED)
1815 return tls_error(US"certificate verification not possible, unhandled type",
1816 ctn, state->host, errstr);
1817 return OK;
1818 }
1819
1820 #define exim_gnutls_peer_err(Label) \
1821 do { \
1822 if (rc != GNUTLS_E_SUCCESS) \
1823 { \
1824 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1825 (Label), gnutls_strerror(rc)); \
1826 if (state->verify_requirement >= VERIFY_REQUIRED) \
1827 return tls_error_gnu((Label), rc, state->host, errstr); \
1828 return OK; \
1829 } \
1830 } while (0)
1831
1832 rc = import_cert(&cert_list[0], &crt);
1833 exim_gnutls_peer_err(US"cert 0");
1834
1835 state->tlsp->peercert = state->peercert = crt;
1836
1837 sz = 0;
1838 rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1839 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
1840 {
1841 exim_gnutls_peer_err(US"getting size for cert DN failed");
1842 return FAIL; /* should not happen */
1843 }
1844 dn_buf = store_get_perm(sz, TRUE); /* tainted */
1845 rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1846 exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1847
1848 state->peerdn = dn_buf;
1849
1850 return OK;
1851 #undef exim_gnutls_peer_err
1852 }
1853
1854
1855
1856
1857 /*************************************************
1858 * Verify peer certificate *
1859 *************************************************/
1860
1861 /* Called from both server and client code.
1862 *Should* be using a callback registered with
1863 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1864 the peer information, but that's too new for some OSes.
1865
1866 Arguments:
1867 state exim_gnutls_state_st *
1868 errstr where to put an error message
1869
1870 Returns:
1871 FALSE if the session should be rejected
1872 TRUE if the cert is okay or we just don't care
1873 */
1874
1875 static BOOL
1876 verify_certificate(exim_gnutls_state_st * state, uschar ** errstr)
1877 {
1878 int rc;
1879 uint verify;
1880
1881 DEBUG(D_tls) debug_printf("TLS: checking peer certificate\n");
1882 *errstr = NULL;
1883 rc = peer_status(state, errstr);
1884
1885 if (state->verify_requirement == VERIFY_NONE)
1886 return TRUE;
1887
1888 if (rc != OK || !state->peerdn)
1889 {
1890 verify = GNUTLS_CERT_INVALID;
1891 *errstr = US"certificate not supplied";
1892 }
1893 else
1894
1895 {
1896 #ifdef SUPPORT_DANE
1897 if (state->verify_requirement == VERIFY_DANE && state->host)
1898 {
1899 /* Using dane_verify_session_crt() would be easy, as it does it all for us
1900 including talking to a DNS resolver. But we want to do that bit ourselves
1901 as the testsuite intercepts and fakes its own DNS environment. */
1902
1903 dane_state_t s;
1904 dane_query_t r;
1905 uint lsize;
1906 const gnutls_datum_t * certlist =
1907 gnutls_certificate_get_peers(state->session, &lsize);
1908 int usage = tls_out.tlsa_usage;
1909
1910 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
1911 /* Split the TLSA records into two sets, TA and EE selectors. Run the
1912 dane-verification separately so that we know which selector verified;
1913 then we know whether to do name-verification (needed for TA but not EE). */
1914
1915 if (usage == ((1<<DANESSL_USAGE_DANE_TA) | (1<<DANESSL_USAGE_DANE_EE)))
1916 { /* a mixed-usage bundle */
1917 int i, j, nrec;
1918 const char ** dd;
1919 int * ddl;
1920
1921 for(nrec = 0; state->dane_data_len[nrec]; ) nrec++;
1922 nrec++;
1923
1924 dd = store_get(nrec * sizeof(uschar *), FALSE);
1925 ddl = store_get(nrec * sizeof(int), FALSE);
1926 nrec--;
1927
1928 if ((rc = dane_state_init(&s, 0)))
1929 goto tlsa_prob;
1930
1931 for (usage = DANESSL_USAGE_DANE_EE;
1932 usage >= DANESSL_USAGE_DANE_TA; usage--)
1933 { /* take records with this usage */
1934 for (j = i = 0; i < nrec; i++)
1935 if (state->dane_data[i][0] == usage)
1936 {
1937 dd[j] = state->dane_data[i];
1938 ddl[j++] = state->dane_data_len[i];
1939 }
1940 if (j)
1941 {
1942 dd[j] = NULL;
1943 ddl[j] = 0;
1944
1945 if ((rc = dane_raw_tlsa(s, &r, (char * const *)dd, ddl, 1, 0)))
1946 goto tlsa_prob;
1947
1948 if ((rc = dane_verify_crt_raw(s, certlist, lsize,
1949 gnutls_certificate_type_get(state->session),
1950 r, 0,
1951 usage == DANESSL_USAGE_DANE_EE
1952 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1953 &verify)))
1954 {
1955 DEBUG(D_tls)
1956 debug_printf("TLSA record problem: %s\n", dane_strerror(rc));
1957 }
1958 else if (verify == 0) /* verification passed */
1959 {
1960 usage = 1 << usage;
1961 break;
1962 }
1963 }
1964 }
1965
1966 if (rc) goto tlsa_prob;
1967 }
1968 else
1969 # endif
1970 {
1971 if ( (rc = dane_state_init(&s, 0))
1972 || (rc = dane_raw_tlsa(s, &r, state->dane_data, state->dane_data_len,
1973 1, 0))
1974 || (rc = dane_verify_crt_raw(s, certlist, lsize,
1975 gnutls_certificate_type_get(state->session),
1976 r, 0,
1977 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
1978 usage == (1 << DANESSL_USAGE_DANE_EE)
1979 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1980 # else
1981 0,
1982 # endif
1983 &verify))
1984 )
1985 goto tlsa_prob;
1986 }
1987
1988 if (verify != 0) /* verification failed */
1989 {
1990 gnutls_datum_t str;
1991 (void) dane_verification_status_print(verify, &str, 0);
1992 *errstr = US str.data; /* don't bother to free */
1993 goto badcert;
1994 }
1995
1996 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
1997 /* If a TA-mode TLSA record was used for verification we must additionally
1998 verify the cert name (but not the CA chain). For EE-mode, skip it. */
1999
2000 if (usage & (1 << DANESSL_USAGE_DANE_EE))
2001 # endif
2002 {
2003 state->peer_dane_verified = state->peer_cert_verified = TRUE;
2004 goto goodcert;
2005 }
2006 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2007 /* Assume that the name on the A-record is the one that should be matching
2008 the cert. An alternate view is that the domain part of the email address
2009 is also permissible. */
2010
2011 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert,
2012 CS state->host->name))
2013 {
2014 state->peer_dane_verified = state->peer_cert_verified = TRUE;
2015 goto goodcert;
2016 }
2017 # endif
2018 }
2019 #endif /*SUPPORT_DANE*/
2020
2021 rc = gnutls_certificate_verify_peers2(state->session, &verify);
2022 }
2023
2024 /* Handle the result of verification. INVALID is set if any others are. */
2025
2026 if (rc < 0 || verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED))
2027 {
2028 state->peer_cert_verified = FALSE;
2029 if (!*errstr)
2030 {
2031 #ifdef GNUTLS_CERT_VFY_STATUS_PRINT
2032 DEBUG(D_tls)
2033 {
2034 gnutls_datum_t txt;
2035
2036 if (gnutls_certificate_verification_status_print(verify,
2037 gnutls_certificate_type_get(state->session), &txt, 0)
2038 == GNUTLS_E_SUCCESS)
2039 {
2040 debug_printf("%s\n", txt.data);
2041 gnutls_free(txt.data);
2042 }
2043 }
2044 #endif
2045 *errstr = verify & GNUTLS_CERT_REVOKED
2046 ? US"certificate revoked" : US"certificate invalid";
2047 }
2048
2049 DEBUG(D_tls)
2050 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
2051 *errstr, state->peerdn ? state->peerdn : US"<unset>");
2052
2053 if (state->verify_requirement >= VERIFY_REQUIRED)
2054 goto badcert;
2055 DEBUG(D_tls)
2056 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
2057 }
2058
2059 else
2060 {
2061 /* Client side, check the server's certificate name versus the name on the
2062 A-record for the connection we made. What to do for server side - what name
2063 to use for client? We document that there is no such checking for server
2064 side. */
2065
2066 if ( state->exp_tls_verify_cert_hostnames
2067 && !gnutls_x509_crt_check_hostname(state->tlsp->peercert,
2068 CS state->exp_tls_verify_cert_hostnames)
2069 )
2070 {
2071 DEBUG(D_tls)
2072 debug_printf("TLS certificate verification failed: cert name mismatch\n");
2073 if (state->verify_requirement >= VERIFY_REQUIRED)
2074 goto badcert;
2075 return TRUE;
2076 }
2077
2078 state->peer_cert_verified = TRUE;
2079 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
2080 state->peerdn ? state->peerdn : US"<unset>");
2081 }
2082
2083 goodcert:
2084 state->tlsp->peerdn = state->peerdn;
2085 return TRUE;
2086
2087 #ifdef SUPPORT_DANE
2088 tlsa_prob:
2089 *errstr = string_sprintf("TLSA record problem: %s",
2090 rc == DANE_E_REQUESTED_DATA_NOT_AVAILABLE ? "none usable" : dane_strerror(rc));
2091 #endif
2092
2093 badcert:
2094 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
2095 return FALSE;
2096 }
2097
2098
2099
2100
2101 /* ------------------------------------------------------------------------ */
2102 /* Callbacks */
2103
2104 /* Logging function which can be registered with
2105 * gnutls_global_set_log_function()
2106 * gnutls_global_set_log_level() 0..9
2107 */
2108 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
2109 static void
2110 exim_gnutls_logger_cb(int level, const char *message)
2111 {
2112 size_t len = strlen(message);
2113 if (len < 1)
2114 {
2115 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
2116 return;
2117 }
2118 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
2119 message[len-1] == '\n' ? "" : "\n");
2120 }
2121 #endif
2122
2123
2124 /* Called after client hello, should handle SNI work.
2125 This will always set tls_sni (state->received_sni) if available,
2126 and may trigger presenting different certificates,
2127 if state->trigger_sni_changes is TRUE.
2128
2129 Should be registered with
2130 gnutls_handshake_set_post_client_hello_function()
2131
2132 "This callback must return 0 on success or a gnutls error code to terminate the
2133 handshake.".
2134
2135 For inability to get SNI information, we return 0.
2136 We only return non-zero if re-setup failed.
2137 Only used for server-side TLS.
2138 */
2139
2140 static int
2141 exim_sni_handling_cb(gnutls_session_t session)
2142 {
2143 char sni_name[MAX_HOST_LEN];
2144 size_t data_len = MAX_HOST_LEN;
2145 exim_gnutls_state_st *state = &state_server;
2146 unsigned int sni_type;
2147 int rc, old_pool;
2148 uschar * dummy_errstr;
2149
2150 rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
2151 if (rc != GNUTLS_E_SUCCESS)
2152 {
2153 DEBUG(D_tls)
2154 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
2155 debug_printf("TLS: no SNI presented in handshake.\n");
2156 else
2157 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
2158 gnutls_strerror(rc), rc);
2159 return 0;
2160 }
2161
2162 if (sni_type != GNUTLS_NAME_DNS)
2163 {
2164 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
2165 return 0;
2166 }
2167
2168 /* We now have a UTF-8 string in sni_name */
2169 old_pool = store_pool;
2170 store_pool = POOL_PERM;
2171 state->received_sni = string_copy_taint(US sni_name, TRUE);
2172 store_pool = old_pool;
2173
2174 /* We set this one now so that variable expansions below will work */
2175 state->tlsp->sni = state->received_sni;
2176
2177 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
2178 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
2179
2180 if (!state->trigger_sni_changes)
2181 return 0;
2182
2183 if ((rc = tls_expand_session_files(state, &dummy_errstr)) != OK)
2184 {
2185 /* If the setup of certs/etc failed before handshake, TLS would not have
2186 been offered. The best we can do now is abort. */
2187 return GNUTLS_E_APPLICATION_ERROR_MIN;
2188 }
2189
2190 rc = tls_set_remaining_x509(state, &dummy_errstr);
2191 if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
2192
2193 return 0;
2194 }
2195
2196
2197
2198 #ifndef DISABLE_EVENT
2199 /*
2200 We use this callback to get observability and detail-level control
2201 for an exim TLS connection (either direction), raising a tls:cert event
2202 for each cert in the chain presented by the peer. Any event
2203 can deny verification.
2204
2205 Return 0 for the handshake to continue or non-zero to terminate.
2206 */
2207
2208 static int
2209 verify_cb(gnutls_session_t session)
2210 {
2211 const gnutls_datum_t * cert_list;
2212 unsigned int cert_list_size = 0;
2213 gnutls_x509_crt_t crt;
2214 int rc;
2215 uschar * yield;
2216 exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
2217
2218 if ((cert_list = gnutls_certificate_get_peers(session, &cert_list_size)))
2219 while (cert_list_size--)
2220 {
2221 if ((rc = import_cert(&cert_list[cert_list_size], &crt)) != GNUTLS_E_SUCCESS)
2222 {
2223 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
2224 cert_list_size, gnutls_strerror(rc));
2225 break;
2226 }
2227
2228 state->tlsp->peercert = crt;
2229 if ((yield = event_raise(state->event_action,
2230 US"tls:cert", string_sprintf("%d", cert_list_size))))
2231 {
2232 log_write(0, LOG_MAIN,
2233 "SSL verify denied by event-action: depth=%d: %s",
2234 cert_list_size, yield);
2235 return 1; /* reject */
2236 }
2237 state->tlsp->peercert = NULL;
2238 }
2239
2240 return 0;
2241 }
2242
2243 #endif
2244
2245
2246 static gstring *
2247 ddump(gnutls_datum_t * d)
2248 {
2249 gstring * g = string_get((d->size+1) * 2);
2250 uschar * s = d->data;
2251 for (unsigned i = d->size; i > 0; i--, s++)
2252 {
2253 g = string_catn(g, US "0123456789abcdef" + (*s >> 4), 1);
2254 g = string_catn(g, US "0123456789abcdef" + (*s & 0xf), 1);
2255 }
2256 return g;
2257 }
2258
2259 static void
2260 post_handshake_debug(exim_gnutls_state_st * state)
2261 {
2262 #ifdef SUPPORT_GNUTLS_SESS_DESC
2263 debug_printf("%s\n", gnutls_session_get_desc(state->session));
2264 #endif
2265 #ifdef SUPPORT_GNUTLS_KEYLOG
2266
2267 # ifdef EXIM_HAVE_TLS1_3
2268 if (gnutls_protocol_get_version(state->session) < GNUTLS_TLS1_3)
2269 #else
2270 if (TRUE)
2271 #endif
2272 {
2273 gnutls_datum_t c, s;
2274 gstring * gc, * gs;
2275 /* we only want the client random and the master secret */
2276 gnutls_session_get_random(state->session, &c, &s);
2277 gnutls_session_get_master_secret(state->session, &s);
2278 gc = ddump(&c);
2279 gs = ddump(&s);
2280 debug_printf("CLIENT_RANDOM %.*s %.*s\n", (int)gc->ptr, gc->s, (int)gs->ptr, gs->s);
2281 }
2282 else
2283 debug_printf("To get keying info for TLS1.3 is hard:\n"
2284 " set environment variable SSLKEYLOGFILE to a filename writable by uid exim\n"
2285 " add SSLKEYLOGFILE to keep_environment in the exim config\n"
2286 " run exim as root\n"
2287 " if using sudo, add SSLKEYLOGFILE to env_keep in /etc/sudoers\n"
2288 " (works for TLS1.2 also, and saves cut-paste into file)\n");
2289 #endif
2290 }
2291
2292
2293 #ifdef EXPERIMENTAL_TLS_RESUME
2294 static int
2295 tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
2296 unsigned incoming, const gnutls_datum_t * msg)
2297 {
2298 DEBUG(D_tls) debug_printf("newticket cb\n");
2299 tls_in.resumption |= RESUME_CLIENT_REQUESTED;
2300 return 0;
2301 }
2302
2303 static void
2304 tls_server_resume_prehandshake(exim_gnutls_state_st * state)
2305 {
2306 /* Should the server offer session resumption? */
2307 tls_in.resumption = RESUME_SUPPORTED;
2308 if (verify_check_host(&tls_resumption_hosts) == OK)
2309 {
2310 int rc;
2311 /* GnuTLS appears to not do ticket overlap, but does emit a fresh ticket when
2312 an offered resumption is unacceptable. We lose one resumption per ticket
2313 lifetime, and sessions cannot be indefinitely re-used. There seems to be no
2314 way (3.6.7) of changing the default number of 2 TLS1.3 tickets issued, but at
2315 least they go out in a single packet. */
2316
2317 if (!(rc = gnutls_session_ticket_enable_server(state->session,
2318 &server_sessticket_key)))
2319 tls_in.resumption |= RESUME_SERVER_TICKET;
2320 else
2321 DEBUG(D_tls)
2322 debug_printf("enabling session tickets: %s\n", US gnutls_strerror(rc));
2323
2324 /* Try to tell if we see a ticket request */
2325 gnutls_handshake_set_hook_function(state->session,
2326 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
2327 }
2328 }
2329
2330 static void
2331 tls_server_resume_posthandshake(exim_gnutls_state_st * state)
2332 {
2333 if (gnutls_session_resumption_requested(state->session))
2334 {
2335 /* This tells us the client sent a full ticket. We use a
2336 callback on session-ticket request, elsewhere, to tell
2337 if a client asked for a ticket. */
2338
2339 tls_in.resumption |= RESUME_CLIENT_SUGGESTED;
2340 DEBUG(D_tls) debug_printf("client requested resumption\n");
2341 }
2342 if (gnutls_session_is_resumed(state->session))
2343 {
2344 tls_in.resumption |= RESUME_USED;
2345 DEBUG(D_tls) debug_printf("Session resumed\n");
2346 }
2347 }
2348 #endif
2349 /* ------------------------------------------------------------------------ */
2350 /* Exported functions */
2351
2352
2353
2354
2355 /*************************************************
2356 * Start a TLS session in a server *
2357 *************************************************/
2358
2359 /* This is called when Exim is running as a server, after having received
2360 the STARTTLS command. It must respond to that command, and then negotiate
2361 a TLS session.
2362
2363 Arguments:
2364 require_ciphers list of allowed ciphers or NULL
2365 errstr pointer to error string
2366
2367 Returns: OK on success
2368 DEFER for errors before the start of the negotiation
2369 FAIL for errors during the negotiation; the server can't
2370 continue running.
2371 */
2372
2373 int
2374 tls_server_start(const uschar * require_ciphers, uschar ** errstr)
2375 {
2376 int rc;
2377 exim_gnutls_state_st * state = NULL;
2378
2379 /* Check for previous activation */
2380 if (tls_in.active.sock >= 0)
2381 {
2382 tls_error(US"STARTTLS received after TLS started", US "", NULL, errstr);
2383 smtp_printf("554 Already in TLS\r\n", FALSE);
2384 return FAIL;
2385 }
2386
2387 /* Initialize the library. If it fails, it will already have logged the error
2388 and sent an SMTP response. */
2389
2390 DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
2391
2392 {
2393 #ifdef MEASURE_TIMING
2394 struct timeval t0;
2395 gettimeofday(&t0, NULL);
2396 #endif
2397
2398 if ((rc = tls_init(NULL, tls_certificate, tls_privatekey,
2399 NULL, tls_verify_certificates, tls_crl,
2400 require_ciphers, &state, &tls_in, errstr)) != OK) return rc;
2401
2402 #ifdef MEASURE_TIMING
2403 report_time_since(&t0, US"server tls_init (delta)");
2404 #endif
2405 }
2406
2407 #ifdef EXPERIMENTAL_TLS_RESUME
2408 tls_server_resume_prehandshake(state);
2409 #endif
2410
2411 /* If this is a host for which certificate verification is mandatory or
2412 optional, set up appropriately. */
2413
2414 if (verify_check_host(&tls_verify_hosts) == OK)
2415 {
2416 DEBUG(D_tls)
2417 debug_printf("TLS: a client certificate will be required.\n");
2418 state->verify_requirement = VERIFY_REQUIRED;
2419 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2420 }
2421 else if (verify_check_host(&tls_try_verify_hosts) == OK)
2422 {
2423 DEBUG(D_tls)
2424 debug_printf("TLS: a client certificate will be requested but not required.\n");
2425 state->verify_requirement = VERIFY_OPTIONAL;
2426 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2427 }
2428 else
2429 {
2430 DEBUG(D_tls)
2431 debug_printf("TLS: a client certificate will not be requested.\n");
2432 state->verify_requirement = VERIFY_NONE;
2433 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2434 }
2435
2436 #ifndef DISABLE_EVENT
2437 if (event_action)
2438 {
2439 state->event_action = event_action;
2440 gnutls_session_set_ptr(state->session, state);
2441 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2442 }
2443 #endif
2444
2445 /* Register SNI handling; always, even if not in tls_certificate, so that the
2446 expansion variable $tls_sni is always available. */
2447
2448 gnutls_handshake_set_post_client_hello_function(state->session,
2449 exim_sni_handling_cb);
2450
2451 /* Set context and tell client to go ahead, except in the case of TLS startup
2452 on connection, where outputting anything now upsets the clients and tends to
2453 make them disconnect. We need to have an explicit fflush() here, to force out
2454 the response. Other smtp_printf() calls do not need it, because in non-TLS
2455 mode, the fflush() happens when smtp_getc() is called. */
2456
2457 if (!state->tlsp->on_connect)
2458 {
2459 smtp_printf("220 TLS go ahead\r\n", FALSE);
2460 fflush(smtp_out);
2461 }
2462
2463 /* Now negotiate the TLS session. We put our own timer on it, since it seems
2464 that the GnuTLS library doesn't.
2465 From 3.1.0 there is gnutls_handshake_set_timeout() - but it requires you
2466 to set (and clear down afterwards) up a pull-timeout callback function that does
2467 a select, so we're no better off unless avoiding signals becomes an issue. */
2468
2469 gnutls_transport_set_ptr2(state->session,
2470 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
2471 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
2472 state->fd_in = fileno(smtp_in);
2473 state->fd_out = fileno(smtp_out);
2474
2475 sigalrm_seen = FALSE;
2476 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
2477 do
2478 rc = gnutls_handshake(state->session);
2479 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
2480 ALARM_CLR(0);
2481
2482 if (rc != GNUTLS_E_SUCCESS)
2483 {
2484 /* It seems that, except in the case of a timeout, we have to close the
2485 connection right here; otherwise if the other end is running OpenSSL it hangs
2486 until the server times out. */
2487
2488 if (sigalrm_seen)
2489 {
2490 tls_error(US"gnutls_handshake", US"timed out", NULL, errstr);
2491 gnutls_db_remove_session(state->session);
2492 }
2493 else
2494 {
2495 tls_error_gnu(US"gnutls_handshake", rc, NULL, errstr);
2496 (void) gnutls_alert_send_appropriate(state->session, rc);
2497 gnutls_deinit(state->session);
2498 gnutls_certificate_free_credentials(state->x509_cred);
2499 millisleep(500);
2500 shutdown(state->fd_out, SHUT_WR);
2501 for (int i = 1024; fgetc(smtp_in) != EOF && i > 0; ) i--; /* drain skt */
2502 (void)fclose(smtp_out);
2503 (void)fclose(smtp_in);
2504 smtp_out = smtp_in = NULL;
2505 }
2506
2507 return FAIL;
2508 }
2509
2510 #ifdef EXPERIMENTAL_TLS_RESUME
2511 tls_server_resume_posthandshake(state);
2512 #endif
2513
2514 DEBUG(D_tls) post_handshake_debug(state);
2515
2516 /* Verify after the fact */
2517
2518 if (!verify_certificate(state, errstr))
2519 {
2520 if (state->verify_requirement != VERIFY_OPTIONAL)
2521 {
2522 (void) tls_error(US"certificate verification failed", *errstr, NULL, errstr);
2523 return FAIL;
2524 }
2525 DEBUG(D_tls)
2526 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
2527 *errstr);
2528 }
2529
2530 /* Sets various Exim expansion variables; always safe within server */
2531
2532 extract_exim_vars_from_tls_state(state);
2533
2534 /* TLS has been set up. Adjust the input functions to read via TLS,
2535 and initialize appropriately. */
2536
2537 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
2538
2539 receive_getc = tls_getc;
2540 receive_getbuf = tls_getbuf;
2541 receive_get_cache = tls_get_cache;
2542 receive_ungetc = tls_ungetc;
2543 receive_feof = tls_feof;
2544 receive_ferror = tls_ferror;
2545 receive_smtp_buffered = tls_smtp_buffered;
2546
2547 return OK;
2548 }
2549
2550
2551
2552
2553 static void
2554 tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
2555 smtp_transport_options_block * ob)
2556 {
2557 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
2558 {
2559 state->exp_tls_verify_cert_hostnames =
2560 #ifdef SUPPORT_I18N
2561 string_domain_utf8_to_alabel(host->name, NULL);
2562 #else
2563 host->name;
2564 #endif
2565 DEBUG(D_tls)
2566 debug_printf("TLS: server cert verification includes hostname: \"%s\".\n",
2567 state->exp_tls_verify_cert_hostnames);
2568 }
2569 }
2570
2571
2572
2573
2574 #ifdef SUPPORT_DANE
2575 /* Given our list of RRs from the TLSA lookup, build a lookup block in
2576 GnuTLS-DANE's preferred format. Hang it on the state str for later
2577 use in DANE verification.
2578
2579 We point at the dnsa data not copy it, so it must remain valid until
2580 after verification is done.*/
2581
2582 static BOOL
2583 dane_tlsa_load(exim_gnutls_state_st * state, dns_answer * dnsa)
2584 {
2585 dns_scan dnss;
2586 int i;
2587 const char ** dane_data;
2588 int * dane_data_len;
2589
2590 i = 1;
2591 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
2592 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2593 ) if (rr->type == T_TLSA) i++;
2594
2595 dane_data = store_get(i * sizeof(uschar *), FALSE);
2596 dane_data_len = store_get(i * sizeof(int), FALSE);
2597
2598 i = 0;
2599 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
2600 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2601 ) if (rr->type == T_TLSA && rr->size > 3)
2602 {
2603 const uschar * p = rr->data;
2604 /*XXX need somehow to mark rr and its data as tainted. Doues this mean copying it? */
2605 uint8_t usage = p[0], sel = p[1], type = p[2];
2606
2607 DEBUG(D_tls)
2608 debug_printf("TLSA: %d %d %d size %d\n", usage, sel, type, rr->size);
2609
2610 if ( (usage != DANESSL_USAGE_DANE_TA && usage != DANESSL_USAGE_DANE_EE)
2611 || (sel != 0 && sel != 1)
2612 )
2613 continue;
2614 switch(type)
2615 {
2616 case 0: /* Full: cannot check at present */
2617 break;
2618 case 1: if (rr->size != 3 + 256/8) continue; /* sha2-256 */
2619 break;
2620 case 2: if (rr->size != 3 + 512/8) continue; /* sha2-512 */
2621 break;
2622 default: continue;
2623 }
2624
2625 tls_out.tlsa_usage |= 1<<usage;
2626 dane_data[i] = CS p;
2627 dane_data_len[i++] = rr->size;
2628 }
2629
2630 if (!i) return FALSE;
2631
2632 dane_data[i] = NULL;
2633 dane_data_len[i] = 0;
2634
2635 state->dane_data = (char * const *)dane_data;
2636 state->dane_data_len = dane_data_len;
2637 return TRUE;
2638 }
2639 #endif
2640
2641
2642
2643 #ifdef EXPERIMENTAL_TLS_RESUME
2644 /* On the client, get any stashed session for the given IP from hints db
2645 and apply it to the ssl-connection for attempted resumption. Although
2646 there is a gnutls_session_ticket_enable_client() interface it is
2647 documented as unnecessary (as of 3.6.7) as "session tickets are emabled
2648 by deafult". There seems to be no way to disable them, so even hosts not
2649 enabled by the transport option will be sent a ticket request. We will
2650 however avoid storing and retrieving session information. */
2651
2652 static void
2653 tls_retrieve_session(tls_support * tlsp, gnutls_session_t session,
2654 host_item * host, smtp_transport_options_block * ob)
2655 {
2656 tlsp->resumption = RESUME_SUPPORTED;
2657 if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
2658 {
2659 dbdata_tls_session * dt;
2660 int len, rc;
2661 open_db dbblock, * dbm_file;
2662
2663 DEBUG(D_tls)
2664 debug_printf("check for resumable session for %s\n", host->address);
2665 tlsp->host_resumable = TRUE;
2666 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
2667 if ((dbm_file = dbfn_open(US"tls", O_RDONLY, &dbblock, FALSE, FALSE)))
2668 {
2669 /* Key for the db is the IP. We'd like to filter the retrieved session
2670 for ticket advisory expiry, but 3.6.1 seems to give no access to that */
2671
2672 if ((dt = dbfn_read_with_length(dbm_file, host->address, &len)))
2673 if (!(rc = gnutls_session_set_data(session,
2674 CUS dt->session, (size_t)len - sizeof(dbdata_tls_session))))
2675 {
2676 DEBUG(D_tls) debug_printf("good session\n");
2677 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
2678 }
2679 else DEBUG(D_tls) debug_printf("setting session resumption data: %s\n",
2680 US gnutls_strerror(rc));
2681 dbfn_close(dbm_file);
2682 }
2683 }
2684 }
2685
2686
2687 static void
2688 tls_save_session(tls_support * tlsp, gnutls_session_t session, const host_item * host)
2689 {
2690 /* TLS 1.2 - we get both the callback and the direct posthandshake call,
2691 but this flag is not set until the second. TLS 1.3 it's the other way about.
2692 Keep both calls as the session data cannot be extracted before handshake
2693 completes. */
2694
2695 if (gnutls_session_get_flags(session) & GNUTLS_SFLAGS_SESSION_TICKET)
2696 {
2697 gnutls_datum_t tkt;
2698 int rc;
2699
2700 DEBUG(D_tls) debug_printf("server offered session ticket\n");
2701 tlsp->ticket_received = TRUE;
2702 tlsp->resumption |= RESUME_SERVER_TICKET;
2703
2704 if (tlsp->host_resumable)
2705 if (!(rc = gnutls_session_get_data2(session, &tkt)))
2706 {
2707 open_db dbblock, * dbm_file;
2708 int dlen = sizeof(dbdata_tls_session) + tkt.size;
2709 dbdata_tls_session * dt = store_get(dlen, TRUE);
2710
2711 DEBUG(D_tls) debug_printf("session data size %u\n", (unsigned)tkt.size);
2712 memcpy(dt->session, tkt.data, tkt.size);
2713 gnutls_free(tkt.data);
2714
2715 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
2716 {
2717 /* key for the db is the IP */
2718 dbfn_delete(dbm_file, host->address);
2719 dbfn_write(dbm_file, host->address, dt, dlen);
2720 dbfn_close(dbm_file);
2721
2722 DEBUG(D_tls)
2723 debug_printf("wrote session db (len %u)\n", (unsigned)dlen);
2724 }
2725 }
2726 else DEBUG(D_tls)
2727 debug_printf("extract session data: %s\n", US gnutls_strerror(rc));
2728 }
2729 }
2730
2731
2732 /* With a TLS1.3 session, the ticket(s) are not seen until
2733 the first data read is attempted. And there's often two of them.
2734 Pick them up with this callback. We are also called for 1.2
2735 but we do nothing.
2736 */
2737 static int
2738 tls_client_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
2739 unsigned incoming, const gnutls_datum_t * msg)
2740 {
2741 exim_gnutls_state_st * state = gnutls_session_get_ptr(sess);
2742 tls_support * tlsp = state->tlsp;
2743
2744 DEBUG(D_tls) debug_printf("newticket cb\n");
2745
2746 if (!tlsp->ticket_received)
2747 tls_save_session(tlsp, sess, state->host);
2748 return 0;
2749 }
2750
2751
2752 static void
2753 tls_client_resume_prehandshake(exim_gnutls_state_st * state,
2754 tls_support * tlsp, host_item * host,
2755 smtp_transport_options_block * ob)
2756 {
2757 gnutls_session_set_ptr(state->session, state);
2758 gnutls_handshake_set_hook_function(state->session,
2759 GNUTLS_HANDSHAKE_NEW_SESSION_TICKET, GNUTLS_HOOK_POST, tls_client_ticket_cb);
2760
2761 tls_retrieve_session(tlsp, state->session, host, ob);
2762 }
2763
2764 static void
2765 tls_client_resume_posthandshake(exim_gnutls_state_st * state,
2766 tls_support * tlsp, host_item * host)
2767 {
2768 if (gnutls_session_is_resumed(state->session))
2769 {
2770 DEBUG(D_tls) debug_printf("Session resumed\n");
2771 tlsp->resumption |= RESUME_USED;
2772 }
2773
2774 tls_save_session(tlsp, state->session, host);
2775 }
2776 #endif /* EXPERIMENTAL_TLS_RESUME */
2777
2778
2779 /*************************************************
2780 * Start a TLS session in a client *
2781 *************************************************/
2782
2783 /* Called from the smtp transport after STARTTLS has been accepted.
2784
2785 Arguments:
2786 cctx connection context
2787 conn_args connection details
2788 cookie datum for randomness (not used)
2789 tlsp record details of channel configuration here; must be non-NULL
2790 errstr error string pointer
2791
2792 Returns: TRUE for success with TLS session context set in smtp context,
2793 FALSE on error
2794 */
2795
2796 BOOL
2797 tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
2798 void * cookie ARG_UNUSED,
2799 tls_support * tlsp, uschar ** errstr)
2800 {
2801 host_item * host = conn_args->host; /* for msgs and option-tests */
2802 transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
2803 smtp_transport_options_block * ob = tb
2804 ? (smtp_transport_options_block *)tb->options_block
2805 : &smtp_transport_option_defaults;
2806 int rc;
2807 exim_gnutls_state_st * state = NULL;
2808 uschar * cipher_list = NULL;
2809
2810 #ifndef DISABLE_OCSP
2811 BOOL require_ocsp =
2812 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
2813 BOOL request_ocsp = require_ocsp ? TRUE
2814 : verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
2815 #endif
2816
2817 DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", cctx->sock);
2818
2819 #ifdef SUPPORT_DANE
2820 /* If dane is flagged, have either request or require dane for this host, and
2821 a TLSA record found. Therefore, dane verify required. Which implies cert must
2822 be requested and supplied, dane verify must pass, and cert verify irrelevant
2823 (incl. hostnames), and (caller handled) require_tls */
2824
2825 if (conn_args->dane && ob->dane_require_tls_ciphers)
2826 {
2827 /* not using expand_check_tlsvar because not yet in state */
2828 if (!expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
2829 &cipher_list, errstr))
2830 return FALSE;
2831 cipher_list = cipher_list && *cipher_list
2832 ? ob->dane_require_tls_ciphers : ob->tls_require_ciphers;
2833 }
2834 #endif
2835
2836 if (!cipher_list)
2837 cipher_list = ob->tls_require_ciphers;
2838
2839 {
2840 #ifdef MEASURE_TIMING
2841 struct timeval t0;
2842 gettimeofday(&t0, NULL);
2843 #endif
2844
2845 if (tls_init(host, ob->tls_certificate, ob->tls_privatekey,
2846 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
2847 cipher_list, &state, tlsp, errstr) != OK)
2848 return FALSE;
2849
2850 #ifdef MEASURE_TIMING
2851 report_time_since(&t0, US"client tls_init (delta)");
2852 #endif
2853 }
2854
2855 {
2856 int dh_min_bits = ob->tls_dh_min_bits;
2857 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
2858 {
2859 DEBUG(D_tls)
2860 debug_printf("WARNING: tls_dh_min_bits far too low,"
2861 " clamping %d up to %d\n",
2862 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
2863 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
2864 }
2865
2866 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
2867 " acceptable bits to %d\n",
2868 dh_min_bits);
2869 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
2870 }
2871
2872 /* Stick to the old behaviour for compatibility if tls_verify_certificates is
2873 set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
2874 the specified host patterns if one of them is defined */
2875
2876 #ifdef SUPPORT_DANE
2877 if (conn_args->dane && dane_tlsa_load(state, &conn_args->tlsa_dnsa))
2878 {
2879 DEBUG(D_tls)
2880 debug_printf("TLS: server certificate DANE required.\n");
2881 state->verify_requirement = VERIFY_DANE;
2882 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2883 }
2884 else
2885 #endif
2886 if ( ( state->exp_tls_verify_certificates
2887 && !ob->tls_verify_hosts
2888 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2889 )
2890 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
2891 )
2892 {
2893 tls_client_setup_hostname_checks(host, state, ob);
2894 DEBUG(D_tls)
2895 debug_printf("TLS: server certificate verification required.\n");
2896 state->verify_requirement = VERIFY_REQUIRED;
2897 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2898 }
2899 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
2900 {
2901 tls_client_setup_hostname_checks(host, state, ob);
2902 DEBUG(D_tls)
2903 debug_printf("TLS: server certificate verification optional.\n");
2904 state->verify_requirement = VERIFY_OPTIONAL;
2905 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2906 }
2907 else
2908 {
2909 DEBUG(D_tls)
2910 debug_printf("TLS: server certificate verification not required.\n");
2911 state->verify_requirement = VERIFY_NONE;
2912 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2913 }
2914
2915 #ifndef DISABLE_OCSP
2916 /* supported since GnuTLS 3.1.3 */
2917 if (request_ocsp)
2918 {
2919 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
2920 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
2921 NULL, 0, NULL)) != OK)
2922 {
2923 tls_error_gnu(US"cert-status-req", rc, state->host, errstr);
2924 return FALSE;
2925 }
2926 tlsp->ocsp = OCSP_NOT_RESP;
2927 }
2928 #endif
2929
2930 #ifdef EXPERIMENTAL_TLS_RESUME
2931 tls_client_resume_prehandshake(state, tlsp, host, ob);
2932 #endif
2933
2934 #ifndef DISABLE_EVENT
2935 if (tb && tb->event_action)
2936 {
2937 state->event_action = tb->event_action;
2938 gnutls_session_set_ptr(state->session, state);
2939 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2940 }
2941 #endif
2942
2943 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) cctx->sock);
2944 state->fd_in = cctx->sock;
2945 state->fd_out = cctx->sock;
2946
2947 DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
2948 /* There doesn't seem to be a built-in timeout on connection. */
2949
2950 sigalrm_seen = FALSE;
2951 ALARM(ob->command_timeout);
2952 do
2953 rc = gnutls_handshake(state->session);
2954 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
2955 ALARM_CLR(0);
2956
2957 if (rc != GNUTLS_E_SUCCESS)
2958 {
2959 if (sigalrm_seen)
2960 {
2961 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
2962 tls_error(US"gnutls_handshake", US"timed out", state->host, errstr);
2963 }
2964 else
2965 tls_error_gnu(US"gnutls_handshake", rc, state->host, errstr);
2966 return FALSE;
2967 }
2968
2969 DEBUG(D_tls) post_handshake_debug(state);
2970
2971 /* Verify late */
2972
2973 if (!verify_certificate(state, errstr))
2974 {
2975 tls_error(US"certificate verification failed", *errstr, state->host, errstr);
2976 return FALSE;
2977 }
2978
2979 #ifndef DISABLE_OCSP
2980 if (request_ocsp)
2981 {
2982 DEBUG(D_tls)
2983 {
2984 gnutls_datum_t stapling;
2985 gnutls_ocsp_resp_t resp;
2986 gnutls_datum_t printed;
2987 unsigned idx = 0;
2988
2989 for (;
2990 # ifdef GNUTLS_OCSP_STATUS_REQUEST_GET2
2991 (rc = gnutls_ocsp_status_request_get2(state->session, idx, &stapling)) == 0;
2992 #else
2993 (rc = gnutls_ocsp_status_request_get(state->session, &stapling)) == 0;
2994 #endif
2995 idx++)
2996 if ( (rc= gnutls_ocsp_resp_init(&resp)) == 0
2997 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
2998 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_COMPACT, &printed)) == 0
2999 )
3000 {
3001 debug_printf("%.4096s", printed.data);
3002 gnutls_free(printed.data);
3003 }
3004 else
3005 (void) tls_error_gnu(US"ocsp decode", rc, state->host, errstr);
3006 if (idx == 0 && rc)
3007 (void) tls_error_gnu(US"ocsp decode", rc, state->host, errstr);
3008 }
3009
3010 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
3011 {
3012 tlsp->ocsp = OCSP_FAILED;
3013 tls_error(US"certificate status check failed", NULL, state->host, errstr);
3014 if (require_ocsp)
3015 return FALSE;
3016 }
3017 else
3018 {
3019 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
3020 tlsp->ocsp = OCSP_VFIED;
3021 }
3022 }
3023 #endif
3024
3025 #ifdef EXPERIMENTAL_TLS_RESUME
3026 tls_client_resume_posthandshake(state, tlsp, host);
3027 #endif
3028
3029 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
3030
3031 extract_exim_vars_from_tls_state(state);
3032
3033 cctx->tls_ctx = state;
3034 return TRUE;
3035 }
3036
3037
3038
3039
3040 /*************************************************
3041 * Close down a TLS session *
3042 *************************************************/
3043
3044 /* This is also called from within a delivery subprocess forked from the
3045 daemon, to shut down the TLS library, without actually doing a shutdown (which
3046 would tamper with the TLS session in the parent process).
3047
3048 Arguments:
3049 ct_ctx client context pointer, or NULL for the one global server context
3050 shutdown 1 if TLS close-alert is to be sent,
3051 2 if also response to be waited for
3052
3053 Returns: nothing
3054 */
3055
3056 void
3057 tls_close(void * ct_ctx, int shutdown)
3058 {
3059 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3060 tls_support * tlsp = state->tlsp;
3061
3062 if (!tlsp || tlsp->active.sock < 0) return; /* TLS was not active */
3063
3064 if (shutdown)
3065 {
3066 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
3067 shutdown > 1 ? " (with response-wait)" : "");
3068
3069 ALARM(2);
3070 gnutls_bye(state->session, shutdown > 1 ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR);
3071 ALARM_CLR(0);
3072 }
3073
3074 if (!ct_ctx) /* server */
3075 {
3076 receive_getc = smtp_getc;
3077 receive_getbuf = smtp_getbuf;
3078 receive_get_cache = smtp_get_cache;
3079 receive_ungetc = smtp_ungetc;
3080 receive_feof = smtp_feof;
3081 receive_ferror = smtp_ferror;
3082 receive_smtp_buffered = smtp_buffered;
3083 }
3084
3085 gnutls_deinit(state->session);
3086 gnutls_certificate_free_credentials(state->x509_cred);
3087
3088 tlsp->active.sock = -1;
3089 tlsp->active.tls_ctx = NULL;
3090 /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
3091 tls_channelbinding_b64 = NULL;
3092
3093
3094 if (state->xfer_buffer) store_free(state->xfer_buffer);
3095 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
3096 }
3097
3098
3099
3100
3101 static BOOL
3102 tls_refill(unsigned lim)
3103 {
3104 exim_gnutls_state_st * state = &state_server;
3105 ssize_t inbytes;
3106
3107 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
3108 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
3109
3110 sigalrm_seen = FALSE;
3111 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3112
3113 do
3114 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
3115 MIN(ssl_xfer_buffer_size, lim));
3116 while (inbytes == GNUTLS_E_AGAIN);
3117
3118 if (smtp_receive_timeout > 0) ALARM_CLR(0);
3119
3120 if (had_command_timeout) /* set by signal handler */
3121 smtp_command_timeout_exit(); /* does not return */
3122 if (had_command_sigterm)
3123 smtp_command_sigterm_exit();
3124 if (had_data_timeout)
3125 smtp_data_timeout_exit();
3126 if (had_data_sigint)
3127 smtp_data_sigint_exit();
3128
3129 /* Timeouts do not get this far. A zero-byte return appears to mean that the
3130 TLS session has been closed down, not that the socket itself has been closed
3131 down. Revert to non-TLS handling. */
3132
3133 if (sigalrm_seen)
3134 {
3135 DEBUG(D_tls) debug_printf("Got tls read timeout\n");
3136 state->xfer_error = TRUE;
3137 return FALSE;
3138 }
3139
3140 else if (inbytes == 0)
3141 {
3142 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
3143 tls_close(NULL, TLS_NO_SHUTDOWN);
3144 return FALSE;
3145 }
3146
3147 /* Handle genuine errors */
3148
3149 else if (inbytes < 0)
3150 {
3151 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
3152 record_io_error(state, (int) inbytes, US"recv", NULL);
3153 state->xfer_error = TRUE;
3154 return FALSE;
3155 }
3156 #ifndef DISABLE_DKIM
3157 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
3158 #endif
3159 state->xfer_buffer_hwm = (int) inbytes;
3160 state->xfer_buffer_lwm = 0;
3161 return TRUE;
3162 }
3163
3164 /*************************************************
3165 * TLS version of getc *
3166 *************************************************/
3167
3168 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
3169 it refills the buffer via the GnuTLS reading function.
3170 Only used by the server-side TLS.
3171
3172 This feeds DKIM and should be used for all message-body reads.
3173
3174 Arguments: lim Maximum amount to read/buffer
3175 Returns: the next character or EOF
3176 */
3177
3178 int
3179 tls_getc(unsigned lim)
3180 {
3181 exim_gnutls_state_st * state = &state_server;
3182
3183 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3184 if (!tls_refill(lim))
3185 return state->xfer_error ? EOF : smtp_getc(lim);
3186
3187 /* Something in the buffer; return next uschar */
3188
3189 return state->xfer_buffer[state->xfer_buffer_lwm++];
3190 }
3191
3192 uschar *
3193 tls_getbuf(unsigned * len)
3194 {
3195 exim_gnutls_state_st * state = &state_server;
3196 unsigned size;
3197 uschar * buf;
3198
3199 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3200 if (!tls_refill(*len))
3201 {
3202 if (!state->xfer_error) return smtp_getbuf(len);
3203 *len = 0;
3204 return NULL;
3205 }
3206
3207 if ((size = state->xfer_buffer_hwm - state->xfer_buffer_lwm) > *len)
3208 size = *len;
3209 buf = &state->xfer_buffer[state->xfer_buffer_lwm];
3210 state->xfer_buffer_lwm += size;
3211 *len = size;
3212 return buf;
3213 }
3214
3215
3216 void
3217 tls_get_cache()
3218 {
3219 #ifndef DISABLE_DKIM
3220 exim_gnutls_state_st * state = &state_server;
3221 int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
3222 if (n > 0)
3223 dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
3224 #endif
3225 }
3226
3227
3228 BOOL
3229 tls_could_read(void)
3230 {
3231 return state_server.xfer_buffer_lwm < state_server.xfer_buffer_hwm
3232 || gnutls_record_check_pending(state_server.session) > 0;
3233 }
3234
3235
3236
3237
3238 /*************************************************
3239 * Read bytes from TLS channel *
3240 *************************************************/
3241
3242 /* This does not feed DKIM, so if the caller uses this for reading message body,
3243 then the caller must feed DKIM.
3244
3245 Arguments:
3246 ct_ctx client context pointer, or NULL for the one global server context
3247 buff buffer of data
3248 len size of buffer
3249
3250 Returns: the number of bytes read
3251 -1 after a failed read, including EOF
3252 */
3253
3254 int
3255 tls_read(void * ct_ctx, uschar *buff, size_t len)
3256 {
3257 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3258 ssize_t inbytes;
3259
3260 if (len > INT_MAX)
3261 len = INT_MAX;
3262
3263 if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
3264 DEBUG(D_tls)
3265 debug_printf("*** PROBABLY A BUG *** " \
3266 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
3267 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
3268
3269 DEBUG(D_tls)
3270 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
3271 state->session, buff, len);
3272
3273 do
3274 inbytes = gnutls_record_recv(state->session, buff, len);
3275 while (inbytes == GNUTLS_E_AGAIN);
3276
3277 if (inbytes > 0) return inbytes;
3278 if (inbytes == 0)
3279 {
3280 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
3281 }
3282 else
3283 {
3284 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
3285 record_io_error(state, (int)inbytes, US"recv", NULL);
3286 }
3287
3288 return -1;
3289 }
3290
3291
3292
3293
3294 /*************************************************
3295 * Write bytes down TLS channel *
3296 *************************************************/
3297
3298 /*
3299 Arguments:
3300 ct_ctx client context pointer, or NULL for the one global server context
3301 buff buffer of data
3302 len number of bytes
3303 more more data expected soon
3304
3305 Returns: the number of bytes after a successful write,
3306 -1 after a failed write
3307 */
3308
3309 int
3310 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
3311 {
3312 ssize_t outbytes;
3313 size_t left = len;
3314 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3315 #ifdef SUPPORT_CORK
3316 static BOOL corked = FALSE;
3317
3318 if (more && !corked) gnutls_record_cork(state->session);
3319 #endif
3320
3321 DEBUG(D_tls) debug_printf("%s(%p, " SIZE_T_FMT "%s)\n", __FUNCTION__,
3322 buff, left, more ? ", more" : "");
3323
3324 while (left > 0)
3325 {
3326 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
3327 buff, left);
3328
3329 do
3330 outbytes = gnutls_record_send(state->session, buff, left);
3331 while (outbytes == GNUTLS_E_AGAIN);
3332
3333 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
3334 if (outbytes < 0)
3335 {
3336 DEBUG(D_tls) debug_printf("%s: gnutls_record_send err\n", __FUNCTION__);
3337 record_io_error(state, outbytes, US"send", NULL);
3338 return -1;
3339 }
3340 if (outbytes == 0)
3341 {
3342 record_io_error(state, 0, US"send", US"TLS channel closed on write");
3343 return -1;
3344 }
3345
3346 left -= outbytes;
3347 buff += outbytes;
3348 }
3349
3350 if (len > INT_MAX)
3351 {
3352 DEBUG(D_tls)
3353 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
3354 len);
3355 len = INT_MAX;
3356 }
3357
3358 #ifdef SUPPORT_CORK
3359 if (more != corked)
3360 {
3361 if (!more) (void) gnutls_record_uncork(state->session, 0);
3362 corked = more;
3363 }
3364 #endif
3365
3366 return (int) len;
3367 }
3368
3369
3370
3371
3372 /*************************************************
3373 * Random number generation *
3374 *************************************************/
3375
3376 /* Pseudo-random number generation. The result is not expected to be
3377 cryptographically strong but not so weak that someone will shoot themselves
3378 in the foot using it as a nonce in input in some email header scheme or
3379 whatever weirdness they'll twist this into. The result should handle fork()
3380 and avoid repeating sequences. OpenSSL handles that for us.
3381
3382 Arguments:
3383 max range maximum
3384 Returns a random number in range [0, max-1]
3385 */
3386
3387 #ifdef HAVE_GNUTLS_RND
3388 int
3389 vaguely_random_number(int max)
3390 {
3391 unsigned int r;
3392 int i, needed_len;
3393 uschar smallbuf[sizeof(r)];
3394
3395 if (max <= 1)
3396 return 0;
3397
3398 needed_len = sizeof(r);
3399 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
3400 asked for a number less than 10. */
3401
3402 for (r = max, i = 0; r; ++i)
3403 r >>= 1;
3404 i = (i + 7) / 8;
3405 if (i < needed_len)
3406 needed_len = i;
3407
3408 i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
3409 if (i < 0)
3410 {
3411 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
3412 return vaguely_random_number_fallback(max);
3413 }
3414 r = 0;
3415 for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
3416 r = r * 256 + *p;
3417
3418 /* We don't particularly care about weighted results; if someone wants
3419 * smooth distribution and cares enough then they should submit a patch then. */
3420 return r % max;
3421 }
3422 #else /* HAVE_GNUTLS_RND */
3423 int
3424 vaguely_random_number(int max)
3425 {
3426 return vaguely_random_number_fallback(max);
3427 }
3428 #endif /* HAVE_GNUTLS_RND */
3429
3430
3431
3432
3433 /*************************************************
3434 * Let tls_require_ciphers be checked at startup *
3435 *************************************************/
3436
3437 /* The tls_require_ciphers option, if set, must be something which the
3438 library can parse.
3439
3440 Returns: NULL on success, or error message
3441 */
3442
3443 uschar *
3444 tls_validate_require_cipher(void)
3445 {
3446 int rc;
3447 uschar *expciphers = NULL;
3448 gnutls_priority_t priority_cache;
3449 const char *errpos;
3450 uschar * dummy_errstr;
3451
3452 #ifdef GNUTLS_AUTO_GLOBAL_INIT
3453 # define validate_check_rc(Label) do { \
3454 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) \
3455 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
3456 # define return_deinit(Label) do { return (Label); } while (0)
3457 #else
3458 # define validate_check_rc(Label) do { \
3459 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
3460 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
3461 # define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
3462 #endif
3463
3464 if (exim_gnutls_base_init_done)
3465 log_write(0, LOG_MAIN|LOG_PANIC,
3466 "already initialised GnuTLS, Exim developer bug");
3467
3468