src/src/tlscert-gnu.c

   1 /*************************************************
   2 *     Exim - an Internet mail transport agent    *
   3 *************************************************/
   4
   5 /* Copyright (c) Jeremy Harris 2014 */
   6
   7 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
   8 one of the available supported implementations.  This file is #included into
   9 tls.c when USE_GNUTLS has been set.
  10 */
  11
  12 #include <gnutls/gnutls.h>
  13 /* needed for cert checks in verification and DN extraction: */
  14 #include <gnutls/x509.h>
  15 /* needed to disable PKCS11 autoload unless requested */
  16 #if GNUTLS_VERSION_NUMBER >= 0x020c00
  17 # include <gnutls/pkcs11.h>
  18 #endif
  19
  20
  21 /*****************************************************
  22 *  Export/import a certificate, binary/printable
  23 *****************************************************/
  24 int
  25 tls_export_cert(uschar * buf, size_t buflen, void * cert)
  26 {
  27 size_t sz = buflen;
  28 void * reset_point = store_get(0);
  29 int fail = 0;
  30 uschar * cp;
  31
  32 if (gnutls_x509_crt_export((gnutls_x509_crt_t)cert,
  33     GNUTLS_X509_FMT_PEM, buf, &sz))
  34   return 1;
  35 if ((cp = string_printing(buf)) != buf)
  36   {
  37   Ustrncpy(buf, cp, buflen);
  38   if (buf[buflen-1])
  39     fail = 1;
  40   }
  41 store_reset(reset_point);
  42 return fail;
  43 }
  44
  45 int
  46 tls_import_cert(const uschar * buf, void ** cert)
  47 {
  48 void * reset_point = store_get(0);
  49 gnutls_datum_t datum;
  50 gnutls_x509_crt_t crt;
  51 int fail = 0;
  52
  53 gnutls_global_init();
  54 gnutls_x509_crt_init(&crt);
  55
  56 datum.data = string_unprinting(US buf);
  57 datum.size = Ustrlen(datum.data);
  58 if (gnutls_x509_crt_import(crt, &datum, GNUTLS_X509_FMT_PEM))
  59   fail = 1;
  60 else
  61   *cert = (void *)crt;
  62
  63 store_reset(reset_point);
  64 return fail;
  65 }
  66
  67 void
  68 tls_free_cert(void * cert)
  69 {
  70 gnutls_x509_crt_deinit((gnutls_x509_crt_t) cert);
  71 gnutls_global_deinit();
  72 }
  73
  74 /*****************************************************
  75 *  Certificate field extraction routines
  76 *****************************************************/
  77 static uschar *
  78 g_err(const char * tag, const char * from, int gnutls_err)
  79 {
  80 expand_string_message = string_sprintf("%s: %s fail: %s\n",
  81   from, tag, gnutls_strerror(gnutls_err));
  82 return NULL;
  83 }
  84
  85
  86 static uschar *
  87 time_copy(time_t t, uschar * mod)
  88 {
  89 uschar * cp;
  90 struct tm * tp;
  91 size_t len;
  92
  93 if (mod && Ustrcmp(mod, "int") == 0)
  94   return string_sprintf("%u", (unsigned)t);
  95
  96 cp = store_get(32);
  97 tp = gmtime(&t);
  98 len = strftime(CS cp, 32, "%b %e %T %Y %Z", tp);
  99 return len > 0 ? cp : NULL;
 100 }
 101
 102 /**/
 103
 104 uschar *
 105 tls_cert_issuer(void * cert, uschar * mod)
 106 {
 107 uschar * cp = NULL;
 108 int ret;
 109 size_t siz = 0;
 110
 111 if ((ret = gnutls_x509_crt_get_issuer_dn(cert, cp, &siz))
 112     != GNUTLS_E_SHORT_MEMORY_BUFFER)
 113   return g_err("gi0", __FUNCTION__, ret);
 114
 115 cp = store_get(siz);
 116 if ((ret = gnutls_x509_crt_get_issuer_dn(cert, cp, &siz)) < 0)
 117   return g_err("gi1", __FUNCTION__, ret);
 118
 119 return mod ? tls_field_from_dn(cp, mod) : cp;
 120 }
 121
 122 uschar *
 123 tls_cert_not_after(void * cert, uschar * mod)
 124 {
 125 return time_copy(
 126   gnutls_x509_crt_get_expiration_time((gnutls_x509_crt_t)cert),
 127   mod);
 128 }
 129
 130 uschar *
 131 tls_cert_not_before(void * cert, uschar * mod)
 132 {
 133 return time_copy(
 134   gnutls_x509_crt_get_activation_time((gnutls_x509_crt_t)cert),
 135   mod);
 136 }
 137
 138 uschar *
 139 tls_cert_serial_number(void * cert, uschar * mod)
 140 {
 141 uschar bin[50], txt[150];
 142 size_t sz = sizeof(bin);
 143 uschar * sp;
 144 uschar * dp;
 145
 146 if (gnutls_x509_crt_get_serial((gnutls_x509_crt_t)cert,
 147     bin, &sz) || sz > sizeof(bin))
 148   return NULL;
 149 for(dp = txt, sp = bin; sz; dp += 2, sp++, sz--)
 150   sprintf(dp, "%.2x", *sp);
 151 for(sp = txt; sp[0]=='0' && sp[1]; ) sp++;      /* leading zeroes */
 152 return string_copy(sp);
 153 }
 154
 155 uschar *
 156 tls_cert_signature(void * cert, uschar * mod)
 157 {
 158 uschar * cp1;
 159 uschar * cp2;
 160 uschar * cp3;
 161 size_t len = 0;
 162 int ret;
 163
 164 if ((ret = gnutls_x509_crt_get_signature((gnutls_x509_crt_t)cert, cp1, &len))
 165     != GNUTLS_E_SHORT_MEMORY_BUFFER)
 166   return g_err("gs0", __FUNCTION__, ret);
 167
 168 cp1 = store_get(len*4+1);
 169 if (gnutls_x509_crt_get_signature((gnutls_x509_crt_t)cert, cp1, &len) != 0)
 170   return g_err("gs1", __FUNCTION__, ret);
 171
 172 for(cp3 = cp2 = cp1+len; cp1 < cp2; cp3 += 3, cp1++)
 173   sprintf(cp3, "%.2x ", *cp1);
 174 cp3[-1]= '\0';
 175
 176 return cp2;
 177 }
 178
 179 uschar *
 180 tls_cert_signature_algorithm(void * cert, uschar * mod)
 181 {
 182 gnutls_sign_algorithm_t algo =
 183   gnutls_x509_crt_get_signature_algorithm((gnutls_x509_crt_t)cert);
 184 return algo < 0 ? NULL : string_copy(gnutls_sign_get_name(algo));
 185 }
 186
 187 uschar *
 188 tls_cert_subject(void * cert, uschar * mod)
 189 {
 190 uschar * cp = NULL;
 191 int ret;
 192 size_t siz = 0;
 193
 194 if ((ret = gnutls_x509_crt_get_dn(cert, cp, &siz))
 195     != GNUTLS_E_SHORT_MEMORY_BUFFER)
 196   return g_err("gs0", __FUNCTION__, ret);
 197
 198 cp = store_get(siz);
 199 if ((ret = gnutls_x509_crt_get_dn(cert, cp, &siz)) < 0)
 200   return g_err("gs1", __FUNCTION__, ret);
 201
 202 return mod ? tls_field_from_dn(cp, mod) : cp;
 203 }
 204
 205 uschar *
 206 tls_cert_version(void * cert, uschar * mod)
 207 {
 208 return string_sprintf("%d", gnutls_x509_crt_get_version(cert));
 209 }
 210
 211 uschar *
 212 tls_cert_ext_by_oid(void * cert, uschar * oid, int idx)
 213 {
 214 uschar * cp1 = NULL;
 215 uschar * cp2;
 216 uschar * cp3;
 217 size_t siz = 0;
 218 unsigned int crit;
 219 int ret;
 220
 221 ret = gnutls_x509_crt_get_extension_by_oid ((gnutls_x509_crt_t)cert,
 222   oid, idx, cp1, &siz, &crit);
 223 if (ret != GNUTLS_E_SHORT_MEMORY_BUFFER)
 224   return g_err("ge0", __FUNCTION__, ret);
 225
 226 cp1 = store_get(siz*4 + 1);
 227
 228 ret = gnutls_x509_crt_get_extension_by_oid ((gnutls_x509_crt_t)cert,
 229   oid, idx, cp1, &siz, &crit);
 230 if (ret < 0)
 231   return g_err("ge1", __FUNCTION__, ret);
 232
 233 /* binary data, DER encoded */
 234
 235 /* just dump for now */
 236 for(cp3 = cp2 = cp1+siz; cp1 < cp2; cp3 += 3, cp1++)
 237   sprintf(cp3, "%.2x ", *cp1);
 238 cp3[-1]= '\0';
 239
 240 return cp2;
 241 }
 242
 243 uschar *
 244 tls_cert_subject_altname(void * cert, uschar * mod)
 245 {
 246 uschar * list = NULL;
 247 int index;
 248 size_t siz;
 249 int ret;
 250 uschar sep = '\n';
 251 uschar * tag = US"";
 252 uschar * ele;
 253 int match = -1;
 254
 255 while (mod)
 256   {
 257   if (*mod == '>' && *++mod) sep = *mod++;
 258   else if (Ustrcmp(mod, "dns")==0) { match = GNUTLS_SAN_DNSNAME; mod += 3; }
 259   else if (Ustrcmp(mod, "uri")==0) { match = GNUTLS_SAN_URI; mod += 3; }
 260   else if (Ustrcmp(mod, "mail")==0) { match = GNUTLS_SAN_RFC822NAME; mod += 4; }
 261   else continue;
 262
 263   if (*mod++ != ',')
 264     break;
 265   }
 266
 267 for(index = 0;; index++)
 268   {
 269   siz = 0;
 270   switch(ret = gnutls_x509_crt_get_subject_alt_name(
 271       (gnutls_x509_crt_t)cert, index, NULL, &siz, NULL))
 272     {
 273     case GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE:
 274       return list;      /* no more elements; normal exit */
 275
 276     case GNUTLS_E_SHORT_MEMORY_BUFFER:
 277       break;
 278
 279     default:
 280       return g_err("gs0", __FUNCTION__, ret);
 281     }
 282
 283   ele = store_get(siz+1);
 284   if ((ret = gnutls_x509_crt_get_subject_alt_name(
 285     (gnutls_x509_crt_t)cert, index, ele, &siz, NULL)) < 0)
 286     return g_err("gs1", __FUNCTION__, ret);
 287   ele[siz] = '\0';
 288
 289   if (  match != -1 && match != ret     /* wrong type of SAN */
 290      || Ustrlen(ele) != siz)            /* contains a NUL */
 291     continue;
 292   switch (ret)
 293     {
 294     case GNUTLS_SAN_DNSNAME:    tag = US"DNS";  break;
 295     case GNUTLS_SAN_URI:        tag = US"URI";  break;
 296     case GNUTLS_SAN_RFC822NAME: tag = US"MAIL"; break;
 297     default: continue;        /* ignore unrecognised types */
 298     }
 299   list = string_append_listele(list, sep,
 300           match == -1 ? string_sprintf("%s=%s", tag, ele) : ele);
 301   }
 302 /*NOTREACHED*/
 303 }
 304
 305 uschar *
 306 tls_cert_ocsp_uri(void * cert, uschar * mod)
 307 {
 308 #if GNUTLS_VERSION_NUMBER >= 0x030000
 309 gnutls_datum_t uri;
 310 int ret;
 311 uschar sep = '\n';
 312 int index;
 313 uschar * list = NULL;
 314
 315 if (mod)
 316   if (*mod == '>' && *++mod) sep = *mod++;
 317
 318 for(index = 0;; index++)
 319   {
 320   ret = gnutls_x509_crt_get_authority_info_access((gnutls_x509_crt_t)cert,
 321           index, GNUTLS_IA_OCSP_URI, &uri, NULL);
 322
 323   if (ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
 324     return list;
 325   if (ret < 0)
 326     return g_err("gai", __FUNCTION__, ret);
 327
 328   list = string_append_listele(list, sep,
 329             string_copyn(uri.data, uri.size));
 330   }
 331 /*NOTREACHED*/
 332
 333 #else
 334
 335 expand_string_message =
 336   string_sprintf("%s: OCSP support with GnuTLS requires version 3.0.0\n",
 337     __FUNCTION__);
 338 return NULL;
 339
 340 #endif
 341 }
 342
 343 uschar *
 344 tls_cert_crl_uri(void * cert, uschar * mod)
 345 {
 346 int ret;
 347 size_t siz;
 348 uschar sep = '\n';
 349 int index;
 350 uschar * list = NULL;
 351 uschar * ele;
 352
 353 if (mod)
 354   if (*mod == '>' && *++mod) sep = *mod++;
 355
 356 for(index = 0;; index++)
 357   {
 358   siz = 0;
 359   switch(ret = gnutls_x509_crt_get_crl_dist_points(
 360     (gnutls_x509_crt_t)cert, index, NULL, &siz, NULL, NULL))
 361     {
 362     case GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE:
 363       return list;
 364     case GNUTLS_E_SHORT_MEMORY_BUFFER:
 365       break;
 366     default:
 367       return g_err("gc0", __FUNCTION__, ret);
 368     }
 369
 370   ele = store_get(siz+1);
 371   if ((ret = gnutls_x509_crt_get_crl_dist_points(
 372       (gnutls_x509_crt_t)cert, index, ele, &siz, NULL, NULL)) < 0)
 373     return g_err("gc1", __FUNCTION__, ret);
 374
 375   ele[siz] = '\0';
 376   list = string_append_listele(list, sep, ele);
 377   }
 378 /*NOTREACHED*/
 379 }
 380
 381
 382 /*****************************************************
 383 *  Certificate operator routines
 384 *****************************************************/
 385 static uschar *
 386 fingerprint(gnutls_x509_crt_t cert, gnutls_digest_algorithm_t algo)
 387 {
 388 int ret;
 389 size_t siz = 0;
 390 uschar * cp;
 391 uschar * cp2;
 392 uschar * cp3;
 393
 394 if ((ret = gnutls_x509_crt_get_fingerprint(cert, algo, NULL, &siz))
 395     != GNUTLS_E_SHORT_MEMORY_BUFFER)
 396   return g_err("gf0", __FUNCTION__, ret);
 397
 398 cp = store_get(siz*3+1);
 399 if ((ret = gnutls_x509_crt_get_fingerprint(cert, algo, cp, &siz)) < 0)
 400   return g_err("gf1", __FUNCTION__, ret);
 401
 402 for (cp3 = cp2 = cp+siz; cp < cp2; cp++, cp3+=2)
 403   sprintf(cp3, "%02X",*cp);
 404 return cp2;
 405 }
 406
 407
 408 uschar *
 409 tls_cert_fprt_md5(void * cert)
 410 {
 411 return fingerprint((gnutls_x509_crt_t)cert, GNUTLS_DIG_MD5);
 412 }
 413
 414 uschar *
 415 tls_cert_fprt_sha1(void * cert)
 416 {
 417 return fingerprint((gnutls_x509_crt_t)cert, GNUTLS_DIG_SHA1);
 418 }
 419
 420 uschar *
 421 tls_cert_fprt_sha256(void * cert)
 422 {
 423 return fingerprint((gnutls_x509_crt_t)cert, GNUTLS_DIG_SHA256);
 424 }
 425
 426
 427 /* vi: aw ai sw=2
 428 */
 429 /* End of tlscert-gnu.c */