1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) Jeremy Harris 2014 */
7 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
8 one of the available supported implementations. This file is #included into
9 tls.c when USE_GNUTLS has been set.
12 #include <gnutls/gnutls.h>
13 /* needed for cert checks in verification and DN extraction: */
14 #include <gnutls/x509.h>
15 /* needed to disable PKCS11 autoload unless requested */
16 #if GNUTLS_VERSION_NUMBER >= 0x020c00
17 # include <gnutls/pkcs11.h>
21 /*****************************************************
22 * Export/import a certificate, binary/printable
23 *****************************************************/
25 tls_export_cert(uschar * buf, size_t buflen, void * cert)
28 void * reset_point = store_get(0);
32 if (gnutls_x509_crt_export((gnutls_x509_crt_t)cert,
33 GNUTLS_X509_FMT_PEM, buf, &sz))
35 if ((cp = string_printing(buf)) != buf)
37 Ustrncpy(buf, cp, buflen);
41 store_reset(reset_point);
46 tls_import_cert(const uschar * buf, void ** cert)
48 void * reset_point = store_get(0);
50 gnutls_x509_crt_t crt;
54 gnutls_x509_crt_init(&crt);
56 datum.data = string_unprinting(US buf);
57 datum.size = Ustrlen(datum.data);
58 if (gnutls_x509_crt_import(crt, &datum, GNUTLS_X509_FMT_PEM))
63 store_reset(reset_point);
68 tls_free_cert(void * cert)
70 gnutls_x509_crt_deinit((gnutls_x509_crt_t) cert);
71 gnutls_global_deinit();
74 /*****************************************************
75 * Certificate field extraction routines
76 *****************************************************/
78 g_err(const char * tag, const char * from, int gnutls_err)
80 expand_string_message = string_sprintf("%s: %s fail: %s\n",
81 from, tag, gnutls_strerror(gnutls_err));
87 time_copy(time_t t, uschar * mod)
93 if (mod && Ustrcmp(mod, "int") == 0)
94 return string_sprintf("%u", (unsigned)t);
98 len = strftime(CS cp, 32, "%b %e %T %Y %Z", tp);
99 return len > 0 ? cp : NULL;
105 tls_cert_issuer(void * cert, uschar * mod)
111 if ((ret = gnutls_x509_crt_get_issuer_dn(cert, cp, &siz))
112 != GNUTLS_E_SHORT_MEMORY_BUFFER)
113 return g_err("gi0", __FUNCTION__, ret);
116 if ((ret = gnutls_x509_crt_get_issuer_dn(cert, cp, &siz)) < 0)
117 return g_err("gi1", __FUNCTION__, ret);
119 return mod ? tls_field_from_dn(cp, mod) : cp;
123 tls_cert_not_after(void * cert, uschar * mod)
126 gnutls_x509_crt_get_expiration_time((gnutls_x509_crt_t)cert),
131 tls_cert_not_before(void * cert, uschar * mod)
134 gnutls_x509_crt_get_activation_time((gnutls_x509_crt_t)cert),
139 tls_cert_serial_number(void * cert, uschar * mod)
141 uschar bin[50], txt[150];
142 size_t sz = sizeof(bin);
146 if (gnutls_x509_crt_get_serial((gnutls_x509_crt_t)cert,
147 bin, &sz) || sz > sizeof(bin))
149 for(dp = txt, sp = bin; sz; dp += 2, sp++, sz--)
150 sprintf(dp, "%.2x", *sp);
151 for(sp = txt; sp[0]=='0' && sp[1]; ) sp++; /* leading zeroes */
152 return string_copy(sp);
156 tls_cert_signature(void * cert, uschar * mod)
164 if ((ret = gnutls_x509_crt_get_signature((gnutls_x509_crt_t)cert, cp1, &len))
165 != GNUTLS_E_SHORT_MEMORY_BUFFER)
166 return g_err("gs0", __FUNCTION__, ret);
168 cp1 = store_get(len*4+1);
169 if (gnutls_x509_crt_get_signature((gnutls_x509_crt_t)cert, cp1, &len) != 0)
170 return g_err("gs1", __FUNCTION__, ret);
172 for(cp3 = cp2 = cp1+len; cp1 < cp2; cp3 += 3, cp1++)
173 sprintf(cp3, "%.2x ", *cp1);
180 tls_cert_signature_algorithm(void * cert, uschar * mod)
182 gnutls_sign_algorithm_t algo =
183 gnutls_x509_crt_get_signature_algorithm((gnutls_x509_crt_t)cert);
184 return algo < 0 ? NULL : string_copy(gnutls_sign_get_name(algo));
188 tls_cert_subject(void * cert, uschar * mod)
194 if ((ret = gnutls_x509_crt_get_dn(cert, cp, &siz))
195 != GNUTLS_E_SHORT_MEMORY_BUFFER)
196 return g_err("gs0", __FUNCTION__, ret);
199 if ((ret = gnutls_x509_crt_get_dn(cert, cp, &siz)) < 0)
200 return g_err("gs1", __FUNCTION__, ret);
202 return mod ? tls_field_from_dn(cp, mod) : cp;
206 tls_cert_version(void * cert, uschar * mod)
208 return string_sprintf("%d", gnutls_x509_crt_get_version(cert));
212 tls_cert_ext_by_oid(void * cert, uschar * oid, int idx)
221 ret = gnutls_x509_crt_get_extension_by_oid ((gnutls_x509_crt_t)cert,
222 oid, idx, cp1, &siz, &crit);
223 if (ret != GNUTLS_E_SHORT_MEMORY_BUFFER)
224 return g_err("ge0", __FUNCTION__, ret);
226 cp1 = store_get(siz*4 + 1);
228 ret = gnutls_x509_crt_get_extension_by_oid ((gnutls_x509_crt_t)cert,
229 oid, idx, cp1, &siz, &crit);
231 return g_err("ge1", __FUNCTION__, ret);
233 /* binary data, DER encoded */
235 /* just dump for now */
236 for(cp3 = cp2 = cp1+siz; cp1 < cp2; cp3 += 3, cp1++)
237 sprintf(cp3, "%.2x ", *cp1);
244 tls_cert_subject_altname(void * cert, uschar * mod)
246 uschar * list = NULL;
257 if (*mod == '>' && *++mod) sep = *mod++;
258 else if (Ustrcmp(mod, "dns")==0) { match = GNUTLS_SAN_DNSNAME; mod += 3; }
259 else if (Ustrcmp(mod, "uri")==0) { match = GNUTLS_SAN_URI; mod += 3; }
260 else if (Ustrcmp(mod, "mail")==0) { match = GNUTLS_SAN_RFC822NAME; mod += 4; }
267 for(index = 0;; index++)
270 switch(ret = gnutls_x509_crt_get_subject_alt_name(
271 (gnutls_x509_crt_t)cert, index, NULL, &siz, NULL))
273 case GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE:
274 return list; /* no more elements; normal exit */
276 case GNUTLS_E_SHORT_MEMORY_BUFFER:
280 return g_err("gs0", __FUNCTION__, ret);
283 ele = store_get(siz+1);
284 if ((ret = gnutls_x509_crt_get_subject_alt_name(
285 (gnutls_x509_crt_t)cert, index, ele, &siz, NULL)) < 0)
286 return g_err("gs1", __FUNCTION__, ret);
289 if ( match != -1 && match != ret /* wrong type of SAN */
290 || Ustrlen(ele) != siz) /* contains a NUL */
294 case GNUTLS_SAN_DNSNAME: tag = US"DNS"; break;
295 case GNUTLS_SAN_URI: tag = US"URI"; break;
296 case GNUTLS_SAN_RFC822NAME: tag = US"MAIL"; break;
297 default: continue; /* ignore unrecognised types */
299 list = string_append_listele(list, sep,
300 match == -1 ? string_sprintf("%s=%s", tag, ele) : ele);
306 tls_cert_ocsp_uri(void * cert, uschar * mod)
308 #if GNUTLS_VERSION_NUMBER >= 0x030000
313 uschar * list = NULL;
316 if (*mod == '>' && *++mod) sep = *mod++;
318 for(index = 0;; index++)
320 ret = gnutls_x509_crt_get_authority_info_access((gnutls_x509_crt_t)cert,
321 index, GNUTLS_IA_OCSP_URI, &uri, NULL);
323 if (ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
326 return g_err("gai", __FUNCTION__, ret);
328 list = string_append_listele(list, sep,
329 string_copyn(uri.data, uri.size));
335 expand_string_message =
336 string_sprintf("%s: OCSP support with GnuTLS requires version 3.0.0\n",
344 tls_cert_crl_uri(void * cert, uschar * mod)
350 uschar * list = NULL;
354 if (*mod == '>' && *++mod) sep = *mod++;
356 for(index = 0;; index++)
359 switch(ret = gnutls_x509_crt_get_crl_dist_points(
360 (gnutls_x509_crt_t)cert, index, NULL, &siz, NULL, NULL))
362 case GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE:
364 case GNUTLS_E_SHORT_MEMORY_BUFFER:
367 return g_err("gc0", __FUNCTION__, ret);
370 ele = store_get(siz+1);
371 if ((ret = gnutls_x509_crt_get_crl_dist_points(
372 (gnutls_x509_crt_t)cert, index, ele, &siz, NULL, NULL)) < 0)
373 return g_err("gc1", __FUNCTION__, ret);
376 list = string_append_listele(list, sep, ele);
382 /*****************************************************
383 * Certificate operator routines
384 *****************************************************/
386 fingerprint(gnutls_x509_crt_t cert, gnutls_digest_algorithm_t algo)
394 if ((ret = gnutls_x509_crt_get_fingerprint(cert, algo, NULL, &siz))
395 != GNUTLS_E_SHORT_MEMORY_BUFFER)
396 return g_err("gf0", __FUNCTION__, ret);
398 cp = store_get(siz*3+1);
399 if ((ret = gnutls_x509_crt_get_fingerprint(cert, algo, cp, &siz)) < 0)
400 return g_err("gf1", __FUNCTION__, ret);
402 for (cp3 = cp2 = cp+siz; cp < cp2; cp++, cp3+=2)
403 sprintf(cp3, "%02X",*cp);
409 tls_cert_fprt_md5(void * cert)
411 return fingerprint((gnutls_x509_crt_t)cert, GNUTLS_DIG_MD5);
415 tls_cert_fprt_sha1(void * cert)
417 return fingerprint((gnutls_x509_crt_t)cert, GNUTLS_DIG_SHA1);
421 tls_cert_fprt_sha256(void * cert)
423 return fingerprint((gnutls_x509_crt_t)cert, GNUTLS_DIG_SHA256);
429 /* End of tlscert-gnu.c */