0406a10f98787f72caabb8a54983141ad43e2dbc
[exim.git] / src / src / tls.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2015 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* This module provides TLS (aka SSL) support for Exim. The code for OpenSSL is
9 based on a patch that was originally contributed by Steve Haslam. It was
10 adapted from stunnel, a GPL program by Michal Trojnara. The code for GNU TLS is
11 based on a patch contributed by Nikos Mavroyanopoulos. Because these packages
12 are so very different, the functions for each are kept in separate files. The
13 relevant file is #included as required, after any any common functions.
14
15 No cryptographic code is included in Exim. All this module does is to call
16 functions from the OpenSSL or GNU TLS libraries. */
17
18
19 #include "exim.h"
20 #include "transports/smtp.h"
21
22 /* This module is compiled only when it is specifically requested in the
23 build-time configuration. However, some compilers don't like compiling empty
24 modules, so keep them happy with a dummy when skipping the rest. Make it
25 reference itself to stop picky compilers complaining that it is unused, and put
26 in a dummy argument to stop even pickier compilers complaining about infinite
27 loops. */
28
29 #ifndef SUPPORT_TLS
30 static void dummy(int x) { dummy(x-1); }
31 #else
32
33 /* Static variables that are used for buffering data by both sets of
34 functions and the common functions below.
35
36 We're moving away from this; GnuTLS is already using a state, which
37 can switch, so we can do TLS callouts during ACLs. */
38
39 static const int ssl_xfer_buffer_size = 4096;
40 #ifndef USE_GNUTLS
41 static uschar *ssl_xfer_buffer = NULL;
42 static int ssl_xfer_buffer_lwm = 0;
43 static int ssl_xfer_buffer_hwm = 0;
44 static int ssl_xfer_eof = 0;
45 static int ssl_xfer_error = 0;
46 #endif
47
48 uschar *tls_channelbinding_b64 = NULL;
49
50
51 /*************************************************
52 * Expand string; give error on failure *
53 *************************************************/
54
55 /* If expansion is forced to fail, set the result NULL and return TRUE.
56 Other failures return FALSE. For a server, an SMTP response is given.
57
58 Arguments:
59 s the string to expand; if NULL just return TRUE
60 name name of string being expanded (for error)
61 result where to put the result
62
63 Returns: TRUE if OK; result may still be NULL after forced failure
64 */
65
66 static BOOL
67 expand_check(const uschar *s, const uschar *name, uschar **result)
68 {
69 if (s == NULL) *result = NULL; else
70 {
71 *result = expand_string(US s); /* need to clean up const some more */
72 if (*result == NULL && !expand_string_forcedfail)
73 {
74 log_write(0, LOG_MAIN|LOG_PANIC, "expansion of %s failed: %s", name,
75 expand_string_message);
76 return FALSE;
77 }
78 }
79 return TRUE;
80 }
81
82
83 /*************************************************
84 * Timezone environment flipping *
85 *************************************************/
86
87 static uschar *
88 to_tz(uschar * tz)
89 {
90 uschar * old = US getenv("TZ");
91 (void) setenv("TZ", CCS tz, 1);
92 tzset();
93 return old;
94 }
95
96 static void
97 restore_tz(uschar * tz)
98 {
99 if (tz)
100 (void) setenv("TZ", CCS tz, 1);
101 else
102 (void) unsetenv("TZ");
103 tzset();
104 }
105
106 /*************************************************
107 * Many functions are package-specific *
108 *************************************************/
109
110 #ifdef USE_GNUTLS
111 # include "tls-gnu.c"
112 # include "tlscert-gnu.c"
113
114 # define ssl_xfer_buffer (state_server.xfer_buffer)
115 # define ssl_xfer_buffer_lwm (state_server.xfer_buffer_lwm)
116 # define ssl_xfer_buffer_hwm (state_server.xfer_buffer_hwm)
117 # define ssl_xfer_eof (state_server.xfer_eof)
118 # define ssl_xfer_error (state_server.xfer_error)
119
120 #else
121 # include "tls-openssl.c"
122 # include "tlscert-openssl.c"
123 #endif
124
125
126
127 /*************************************************
128 * TLS version of ungetc *
129 *************************************************/
130
131 /* Puts a character back in the input buffer. Only ever
132 called once.
133 Only used by the server-side TLS.
134
135 Arguments:
136 ch the character
137
138 Returns: the character
139 */
140
141 int
142 tls_ungetc(int ch)
143 {
144 ssl_xfer_buffer[--ssl_xfer_buffer_lwm] = ch;
145 return ch;
146 }
147
148
149
150 /*************************************************
151 * TLS version of feof *
152 *************************************************/
153
154 /* Tests for a previous EOF
155 Only used by the server-side TLS.
156
157 Arguments: none
158 Returns: non-zero if the eof flag is set
159 */
160
161 int
162 tls_feof(void)
163 {
164 return ssl_xfer_eof;
165 }
166
167
168
169 /*************************************************
170 * TLS version of ferror *
171 *************************************************/
172
173 /* Tests for a previous read error, and returns with errno
174 restored to what it was when the error was detected.
175 Only used by the server-side TLS.
176
177 >>>>> Hmm. Errno not handled yet. Where do we get it from? >>>>>
178
179 Arguments: none
180 Returns: non-zero if the error flag is set
181 */
182
183 int
184 tls_ferror(void)
185 {
186 return ssl_xfer_error;
187 }
188
189
190 /*************************************************
191 * TLS version of smtp_buffered *
192 *************************************************/
193
194 /* Tests for unused chars in the TLS input buffer.
195 Only used by the server-side TLS.
196
197 Arguments: none
198 Returns: TRUE/FALSE
199 */
200
201 BOOL
202 tls_smtp_buffered(void)
203 {
204 return ssl_xfer_buffer_lwm < ssl_xfer_buffer_hwm;
205 }
206
207
208 #endif /* SUPPORT_TLS */
209
210 void
211 tls_modify_variables(tls_support * dest_tsp)
212 {
213 modify_variable(US"tls_bits", &dest_tsp->bits);
214 modify_variable(US"tls_certificate_verified", &dest_tsp->certificate_verified);
215 modify_variable(US"tls_cipher", &dest_tsp->cipher);
216 modify_variable(US"tls_peerdn", &dest_tsp->peerdn);
217 #if defined(SUPPORT_TLS) && !defined(USE_GNUTLS)
218 modify_variable(US"tls_sni", &dest_tsp->sni);
219 #endif
220 }
221
222
223 #ifdef SUPPORT_TLS
224 /************************************************
225 * TLS certificate name operations *
226 ************************************************/
227
228 /* Convert an rfc4514 DN to an exim comma-sep list.
229 Backslashed commas need to be replaced by doublecomma
230 for Exim's list quoting. We modify the given string
231 inplace.
232 */
233
234 static void
235 dn_to_list(uschar * dn)
236 {
237 uschar * cp;
238 for (cp = dn; *cp; cp++)
239 if (cp[0] == '\\' && cp[1] == ',')
240 *cp++ = ',';
241 }
242
243
244 /* Extract fields of a given type from an RFC4514-
245 format Distinguished Name. Return an Exim list.
246 NOTE: We modify the supplied dn string during operation.
247
248 Arguments:
249 dn Distinguished Name string
250 mod list containing optional output list-sep and
251 field selector match, comma-separated
252 Return:
253 allocated string with list of matching fields,
254 field type stripped
255 */
256
257 uschar *
258 tls_field_from_dn(uschar * dn, const uschar * mod)
259 {
260 int insep = ',';
261 uschar outsep = '\n';
262 uschar * ele;
263 uschar * match = NULL;
264 int len;
265 uschar * list = NULL;
266
267 while ((ele = string_nextinlist(&mod, &insep, NULL, 0)))
268 if (ele[0] != '>')
269 match = ele; /* field tag to match */
270 else if (ele[1])
271 outsep = ele[1]; /* nondefault output separator */
272
273 dn_to_list(dn);
274 insep = ',';
275 len = match ? Ustrlen(match) : -1;
276 while ((ele = string_nextinlist(CUSS &dn, &insep, NULL, 0)))
277 if ( !match
278 || Ustrncmp(ele, match, len) == 0 && ele[len] == '='
279 )
280 list = string_append_listele(list, outsep, ele+len+1);
281 return list;
282 }
283
284
285 /* Compare a domain name with a possibly-wildcarded name. Wildcards
286 are restricted to a single one, as the first element of patterns
287 having at least three dot-separated elements. Case-independent.
288 Return TRUE for a match
289 */
290 static BOOL
291 is_name_match(const uschar * name, const uschar * pat)
292 {
293 uschar * cp;
294 return *pat == '*' /* possible wildcard match */
295 ? *++pat == '.' /* starts star, dot */
296 && !Ustrchr(++pat, '*') /* has no more stars */
297 && Ustrchr(pat, '.') /* and has another dot. */
298 && (cp = Ustrchr(name, '.'))/* The name has at least one dot */
299 && strcmpic(++cp, pat) == 0 /* and we only compare after it. */
300 : !Ustrchr(pat+1, '*')
301 && strcmpic(name, pat) == 0;
302 }
303
304 /* Compare a list of names with the dnsname elements
305 of the Subject Alternate Name, if any, and the
306 Subject otherwise.
307
308 Arguments:
309 namelist names to compare
310 cert certificate
311
312 Returns:
313 TRUE/FALSE
314 */
315
316 BOOL
317 tls_is_name_for_cert(const uschar * namelist, void * cert)
318 {
319 uschar * altnames = tls_cert_subject_altname(cert, US"dns");
320 uschar * subjdn;
321 uschar * certname;
322 int cmp_sep = 0;
323 uschar * cmpname;
324
325 if ((altnames = tls_cert_subject_altname(cert, US"dns")))
326 {
327 int alt_sep = '\n';
328 while ((cmpname = string_nextinlist(&namelist, &cmp_sep, NULL, 0)))
329 {
330 const uschar * an = altnames;
331 while ((certname = string_nextinlist(&an, &alt_sep, NULL, 0)))
332 if (is_name_match(cmpname, certname))
333 return TRUE;
334 }
335 }
336
337 else if ((subjdn = tls_cert_subject(cert, NULL)))
338 {
339 int sn_sep = ',';
340
341 dn_to_list(subjdn);
342 while ((cmpname = string_nextinlist(&namelist, &cmp_sep, NULL, 0)))
343 {
344 const uschar * sn = subjdn;
345 while ((certname = string_nextinlist(&sn, &sn_sep, NULL, 0)))
346 if ( *certname++ == 'C'
347 && *certname++ == 'N'
348 && *certname++ == '='
349 && is_name_match(cmpname, certname)
350 )
351 return TRUE;
352 }
353 }
354 return FALSE;
355 }
356 #endif /*SUPPORT_TLS*/
357
358 /* vi: aw ai sw=2
359 */
360 /* End of tls.c */