X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/5fd28bb83f80141b9f7671ed9ae3e1a4263134e3..77b58ab70be06dec805fbf1f638eb86dda0287ff:/src/src/tls-gnu.c diff --git a/src/src/tls-gnu.c b/src/src/tls-gnu.c index ff8064bab..71115edf5 100644 --- a/src/src/tls-gnu.c +++ b/src/src/tls-gnu.c @@ -3,6 +3,7 @@ *************************************************/ /* Copyright (c) University of Cambridge 1995 - 2018 */ +/* Copyright (c) The Exim Maintainers 2020 */ /* See the file NOTICE for conditions of use and distribution. */ /* Copyright (c) Phil Pennock 2012 */ @@ -39,6 +40,7 @@ require current GnuTLS, then we'll drop support for the ancient libraries). #include /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */ #include + /* needed to disable PKCS11 autoload unless requested */ #if GNUTLS_VERSION_NUMBER >= 0x020c00 # include @@ -52,6 +54,9 @@ require current GnuTLS, then we'll drop support for the ancient libraries). # warning "GnuTLS library version too old; tls:cert event unsupported" # define DISABLE_EVENT #endif +#if GNUTLS_VERSION_NUMBER >= 0x030000 +# define SUPPORT_SELFSIGN /* Uncertain what version is first usable but 2.12.23 is not */ +#endif #if GNUTLS_VERSION_NUMBER >= 0x030306 # define SUPPORT_CA_DIR #else @@ -60,12 +65,39 @@ require current GnuTLS, then we'll drop support for the ancient libraries). #if GNUTLS_VERSION_NUMBER >= 0x030014 # define SUPPORT_SYSDEFAULT_CABUNDLE #endif +#if GNUTLS_VERSION_NUMBER >= 0x030104 +# define GNUTLS_CERT_VFY_STATUS_PRINT +#endif #if GNUTLS_VERSION_NUMBER >= 0x030109 # define SUPPORT_CORK #endif +#if GNUTLS_VERSION_NUMBER >= 0x03010a +# define SUPPORT_GNUTLS_SESS_DESC +#endif +#if GNUTLS_VERSION_NUMBER >= 0x030300 +# define GNUTLS_AUTO_GLOBAL_INIT +# define GNUTLS_AUTO_PKCS11_MANUAL +#endif +#if (GNUTLS_VERSION_NUMBER >= 0x030404) \ + || (GNUTLS_VERSION_NUMBER >= 0x030311) && (GNUTLS_VERSION_NUMBER & 0xffff00 == 0x030300) +# ifndef DISABLE_OCSP +# define EXIM_HAVE_OCSP +# endif +#endif +#if GNUTLS_VERSION_NUMBER >= 0x030500 +# define SUPPORT_GNUTLS_KEYLOG +#endif #if GNUTLS_VERSION_NUMBER >= 0x030506 && !defined(DISABLE_OCSP) # define SUPPORT_SRV_OCSP_STACK #endif +#if GNUTLS_VERSION_NUMBER >= 0x030600 +# define GNUTLS_AUTO_DHPARAMS +#endif +#if GNUTLS_VERSION_NUMBER >= 0x030603 +# define EXIM_HAVE_TLS1_3 +# define SUPPORT_GNUTLS_EXT_RAW_PARSE +# define GNUTLS_OCSP_STATUS_REQUEST_GET2 +#endif #ifdef SUPPORT_DANE # if GNUTLS_VERSION_NUMBER >= 0x030000 @@ -79,6 +111,14 @@ require current GnuTLS, then we'll drop support for the ancient libraries). # endif #endif +#ifndef DISABLE_TLS_RESUME +# if GNUTLS_VERSION_NUMBER >= 0x030603 +# define EXIM_HAVE_TLS_RESUME +# else +# warning "GnuTLS library version too old; resumption unsupported" +# endif +#endif + #ifndef DISABLE_OCSP # include #endif @@ -86,6 +126,32 @@ require current GnuTLS, then we'll drop support for the ancient libraries). # include #endif +#include "tls-cipher-stdname.c" + + +#ifdef MACRO_PREDEF +void +options_tls(void) +{ +# ifndef DISABLE_TLS_RESUME +builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING ); +# endif +# ifdef EXIM_HAVE_TLS1_3 +builtin_macro_create(US"_HAVE_TLS1_3"); +# endif +# ifdef EXIM_HAVE_OCSP +builtin_macro_create(US"_HAVE_TLS_OCSP"); +# endif +# ifdef SUPPORT_SRV_OCSP_STACK +builtin_macro_create(US"_HAVE_TLS_OCSP_LIST"); +# endif +#ifdef EXIM_HAVE_INOTIFY +builtin_macro_create(US"_HAVE_TLS_CA_CACHE"); +# endif +} +#else + + /* GnuTLS 2 vs 3 GnuTLS 3 only: @@ -110,20 +176,30 @@ Some of these correspond to variables in globals.c; those variables will be set to point to content in one of these instances, as appropriate for the stage of the process lifetime. -Not handled here: global tls_channelbinding_b64. +Not handled here: global tlsp->tls_channelbinding. */ typedef struct exim_gnutls_state { gnutls_session_t session; - gnutls_certificate_credentials_t x509_cred; - gnutls_priority_t priority_cache; + + exim_tlslib_state lib_state; +#define x509_cred libdata0 +#define pri_cache libdata1 + enum peer_verify_requirement verify_requirement; int fd_in; int fd_out; - BOOL peer_cert_verified; - BOOL peer_dane_verified; - BOOL trigger_sni_changes; - BOOL have_set_peerdn; + + BOOL peer_cert_verified:1; + BOOL peer_dane_verified:1; + BOOL trigger_sni_changes:1; + BOOL have_set_peerdn:1; + BOOL xfer_eof:1; /*XXX never gets set! */ + BOOL xfer_error:1; +#ifdef SUPPORT_CORK + BOOL corked:1; +#endif + const struct host_item *host; /* NULL if server */ gnutls_x509_crt_t peercert; uschar *peerdn; @@ -156,50 +232,12 @@ typedef struct exim_gnutls_state { uschar *xfer_buffer; int xfer_buffer_lwm; int xfer_buffer_hwm; - BOOL xfer_eof; /*XXX never gets set! */ - BOOL xfer_error; } exim_gnutls_state_st; static const exim_gnutls_state_st exim_gnutls_state_init = { - .session = NULL, - .x509_cred = NULL, - .priority_cache = NULL, - .verify_requirement = VERIFY_NONE, + /* all elements not explicitly intialised here get 0/NULL/FALSE */ .fd_in = -1, .fd_out = -1, - .peer_cert_verified = FALSE, - .peer_dane_verified = FALSE, - .trigger_sni_changes =FALSE, - .have_set_peerdn = FALSE, - .host = NULL, - .peercert = NULL, - .peerdn = NULL, - .ciphersuite = NULL, - .received_sni = NULL, - - .tls_certificate = NULL, - .tls_privatekey = NULL, - .tls_sni = NULL, - .tls_verify_certificates = NULL, - .tls_crl = NULL, - .tls_require_ciphers =NULL, - - .exp_tls_certificate = NULL, - .exp_tls_privatekey = NULL, - .exp_tls_verify_certificates = NULL, - .exp_tls_crl = NULL, - .exp_tls_require_ciphers = NULL, - .exp_tls_verify_cert_hostnames = NULL, -#ifndef DISABLE_EVENT - .event_action = NULL, -#endif - .tlsp = NULL, - - .xfer_buffer = NULL, - .xfer_buffer_lwm = 0, - .xfer_buffer_hwm = 0, - .xfer_eof = FALSE, - .xfer_error = FALSE, }; /* Not only do we have our own APIs which don't pass around state, assuming @@ -213,19 +251,23 @@ second connection. XXX But see gnutls_session_get_ptr() */ -static exim_gnutls_state_st state_server; +static exim_gnutls_state_st state_server = { + /* all elements not explicitly intialised here get 0/NULL/FALSE */ + .fd_in = -1, + .fd_out = -1, +}; +#ifndef GNUTLS_AUTO_DHPARAMS /* dh_params are initialised once within the lifetime of a process using TLS; if we used TLS in a long-lived daemon, we'd have to reconsider this. But we don't want to repeat this. */ static gnutls_dh_params_t dh_server_params = NULL; +#endif -/* No idea how this value was chosen; preserving it. Default is 3600. */ - -static const int ssl_session_timeout = 200; +static int ssl_session_timeout = 7200; /* Two hours */ -static const char * const exim_default_gnutls_priority = "NORMAL"; +static const uschar * const exim_default_gnutls_priority = US"NORMAL"; /* Guard library core initialisation */ @@ -233,8 +275,12 @@ static BOOL exim_gnutls_base_init_done = FALSE; #ifndef DISABLE_OCSP static BOOL gnutls_buggy_ocsp = FALSE; +static BOOL exim_testharness_disable_ocsp_validity_check = FALSE; #endif +#ifdef EXIM_HAVE_TLS_RESUME +static gnutls_datum_t server_sessticket_key; +#endif /* ------------------------------------------------------------------------ */ /* macros */ @@ -243,8 +289,10 @@ static BOOL gnutls_buggy_ocsp = FALSE; /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup the library logging; a value less than 0 disables the calls to set up logging -callbacks. Possibly GNuTLS also looks for an environment variable -"GNUTLS_DEBUG_LEVEL". */ +callbacks. GNuTLS also looks for an environment variable - except not for +setuid binaries, making it useless - "GNUTLS_DEBUG_LEVEL". +Allegedly the testscript line "GNUTLS_DEBUG_LEVEL=9 sudo exim ..." would work, +but the env var must be added to /etc/sudoers too. */ #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL # define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1 #endif @@ -260,12 +308,7 @@ before, for now. */ # define EXIM_SERVER_DH_BITS_PRE2_12 1024 #endif -#define exim_gnutls_err_check(rc, Label) do { \ - if ((rc) != GNUTLS_E_SUCCESS) \ - return tls_error((Label), gnutls_strerror(rc), host, errstr); \ - } while (0) - -#define expand_check_tlsvar(Varname, errstr) \ +#define Expand_check_tlsvar(Varname, errstr) \ expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr) #if GNUTLS_VERSION_NUMBER >= 0x020c00 @@ -295,12 +338,122 @@ static void exim_gnutls_logger_cb(int level, const char *message); static int exim_sni_handling_cb(gnutls_session_t session); +#ifdef EXIM_HAVE_TLS_RESUME +static int +tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when, + unsigned incoming, const gnutls_datum_t * msg); +#endif + + +/* ------------------------------------------------------------------------ */ +/* Initialisation */ + +#ifndef DISABLE_OCSP + +static BOOL +tls_is_buggy_ocsp(void) +{ +const uschar * s; +uschar maj, mid, mic; + +s = CUS gnutls_check_version(NULL); +maj = atoi(CCS s); +if (maj == 3) + { + while (*s && *s != '.') s++; + mid = atoi(CCS ++s); + if (mid <= 2) + return TRUE; + else if (mid >= 5) + return FALSE; + else + { + while (*s && *s != '.') s++; + mic = atoi(CCS ++s); + return mic <= (mid == 3 ? 16 : 3); + } + } +return FALSE; +} + +#endif + + +static void +tls_g_init(void) +{ +DEBUG(D_tls) debug_printf("GnuTLS global init required\n"); + +#if defined(HAVE_GNUTLS_PKCS11) && !defined(GNUTLS_AUTO_PKCS11_MANUAL) +/* By default, gnutls_global_init will init PKCS11 support in auto mode, +which loads modules from a config file, which sounds good and may be wanted +by some sysadmin, but also means in common configurations that GNOME keyring +environment variables are used and so breaks for users calling mailq. +To prevent this, we init PKCS11 first, which is the documented approach. */ + +if (!gnutls_allow_auto_pkcs11) + if ((rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL))) + return tls_error_gnu(US"gnutls_pkcs11_init", rc, host, errstr); +#endif + +#ifndef GNUTLS_AUTO_GLOBAL_INIT +if ((rc = gnutls_global_init())) + return tls_error_gnu(US"gnutls_global_init", rc, host, errstr); +#endif + +#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0 +DEBUG(D_tls) + { + gnutls_global_set_log_function(exim_gnutls_logger_cb); + /* arbitrarily chosen level; bump up to 9 for more */ + gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL); + } +#endif + #ifndef DISABLE_OCSP -static int server_ocsp_stapling_cb(gnutls_session_t session, void * ptr, - gnutls_datum_t * ocsp_response); +if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp())) + log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version"); #endif +exim_gnutls_base_init_done = TRUE; +} + + + +/* Daemon-call before each connection. Nothing to do for GnuTLS. */ + +static void +tls_per_lib_daemon_tick(void) +{ +} + +/* Daemon one-time initialisation */ + +static void +tls_per_lib_daemon_init(void) +{ +static BOOL once = FALSE; + +if (!exim_gnutls_base_init_done) + tls_g_init(); + +if (!once) + { + once = TRUE; + +#ifdef EXIM_HAVE_TLS_RESUME + /* We are dependent on the GnuTLS implementation of the Session Ticket + encryption; both the strength and the key rotation period. We hope that + the strength at least matches that of the ciphersuite (but GnuTLS does not + document this). */ + + gnutls_session_ticket_key_generate(&server_sessticket_key); /* >= 2.10.0 */ + if (f.running_in_test_harness) ssl_session_timeout = 6; +#endif + tls_daemon_creds_reload(); + } +} /* ------------------------------------------------------------------------ */ /* Static functions */ @@ -328,15 +481,28 @@ Returns: OK/DEFER/FAIL */ static int -tls_error(const uschar *prefix, const char *msg, const host_item *host, +tls_error(const uschar *prefix, const uschar *msg, const host_item *host, uschar ** errstr) { if (errstr) - *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : ""); + *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : US""); return host ? FAIL : DEFER; } +static int +tls_error_gnu(const uschar *prefix, int err, const host_item *host, + uschar ** errstr) +{ +return tls_error(prefix, US gnutls_strerror(err), host, errstr); +} + +static int +tls_error_sys(const uschar *prefix, int err, const host_item *host, + uschar ** errstr) +{ +return tls_error(prefix, US strerror(err), host, errstr); +} /************************************************* @@ -349,7 +515,7 @@ Argument: state the current GnuTLS exim state container rc the GnuTLS error code, or 0 if it's a local error when text identifying read or write - text local error text when ec is 0 + text local error text when rc is 0 Returns: nothing */ @@ -357,14 +523,17 @@ Returns: nothing static void record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text) { -const char * msg; +const uschar * msg; uschar * errstr; -if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED) - msg = CS string_sprintf("%s: %s", US gnutls_strerror(rc), - US gnutls_alert_get_name(gnutls_alert_get(state->session))); -else - msg = gnutls_strerror(rc); +msg = rc == GNUTLS_E_FATAL_ALERT_RECEIVED + ? string_sprintf("A TLS fatal alert has been received: %s", + US gnutls_alert_get_name(gnutls_alert_get(state->session))) +#ifdef GNUTLS_E_PREMATURE_TERMINATION + : rc == GNUTLS_E_PREMATURE_TERMINATION && errno + ? string_sprintf("%s: syscall: %s", US gnutls_strerror(rc), strerror(errno)) +#endif + : US gnutls_strerror(rc); (void) tls_error(when, msg, state->host, &errstr); @@ -426,7 +595,8 @@ Sets: tls_active fd tls_bits strength indicator tls_certificate_verified bool indicator - tls_channelbinding_b64 for some SASL mechanisms + tls_channelbinding for some SASL mechanisms + tls_ver a string tls_cipher a string tls_peercert pointer to library internal tls_peerdn a string @@ -440,7 +610,6 @@ Argument: static void extract_exim_vars_from_tls_state(exim_gnutls_state_st * state) { -gnutls_cipher_algorithm_t cipher; #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING int old_pool; int rc; @@ -451,12 +620,6 @@ tls_support * tlsp = state->tlsp; tlsp->active.sock = state->fd_out; tlsp->active.tls_ctx = state; -cipher = gnutls_cipher_get(state->session); -/* returns size in "bytes" */ -tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8; - -tlsp->cipher = state->ciphersuite; - DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite); tlsp->certificate_verified = state->peer_cert_verified; @@ -464,28 +627,35 @@ tlsp->certificate_verified = state->peer_cert_verified; tlsp->dane_verified = state->peer_dane_verified; #endif -/* note that tls_channelbinding_b64 is not saved to the spool file, since it's +/* note that tls_channelbinding is not saved to the spool file, since it's only available for use for authenticators while this TLS session is running. */ -tls_channelbinding_b64 = NULL; +tlsp->channelbinding = NULL; #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING channel.data = NULL; channel.size = 0; -rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel); -if (rc) { - DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc)); -} else { +if ((rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel))) + { DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc)); } +else + { + /* Declare the taintedness of the binding info. On server, untainted; on + client, tainted - being the Finish msg from the server. */ + old_pool = store_pool; store_pool = POOL_PERM; - tls_channelbinding_b64 = b64encode(channel.data, (int)channel.size); + tlsp->channelbinding = b64encode_taint(CUS channel.data, (int)channel.size, + !!state->host); store_pool = old_pool; - DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n"); -} + DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage\n"); + } #endif /* peercert is set in peer_status() */ tlsp->peerdn = state->peerdn; -tlsp->sni = state->received_sni; + +/* do not corrupt sni sent by client; record sni rxd by server */ +if (!state->host) + tlsp->sni = state->received_sni; /* record our certificate */ { @@ -499,6 +669,7 @@ tlsp->sni = state->received_sni; +#ifndef GNUTLS_AUTO_DHPARAMS /************************************************* * Setup up DH parameters * *************************************************/ @@ -521,22 +692,18 @@ init_server_dh(uschar ** errstr) { int fd, rc; unsigned int dh_bits; -gnutls_datum_t m; +gnutls_datum_t m = {.data = NULL, .size = 0}; uschar filename_buf[PATH_MAX]; uschar *filename = NULL; size_t sz; uschar *exp_tls_dhparam; BOOL use_file_in_spool = FALSE; -BOOL use_fixed_file = FALSE; host_item *host = NULL; /* dummy for macros */ -DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n"); - -rc = gnutls_dh_params_init(&dh_server_params); -exim_gnutls_err_check(rc, US"gnutls_dh_params_init"); +DEBUG(D_tls) debug_printf("Initialising GnuTLS server params\n"); -m.data = NULL; -m.size = 0; +if ((rc = gnutls_dh_params_init(&dh_server_params))) + return tls_error_gnu(US"gnutls_dh_params_init", rc, host, errstr); if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam, errstr)) return DEFER; @@ -551,25 +718,22 @@ else if (Ustrcmp(exp_tls_dhparam, "historic") == 0) use_file_in_spool = TRUE; else if (Ustrcmp(exp_tls_dhparam, "none") == 0) { - DEBUG(D_tls) debug_printf("Requested no DH parameters.\n"); + DEBUG(D_tls) debug_printf("Requested no DH parameters\n"); return OK; } else if (exp_tls_dhparam[0] != '/') { if (!(m.data = US std_dh_prime_named(exp_tls_dhparam))) - return tls_error(US"No standard prime named", CS exp_tls_dhparam, NULL, errstr); + return tls_error(US"No standard prime named", exp_tls_dhparam, NULL, errstr); m.size = Ustrlen(m.data); } else - { - use_fixed_file = TRUE; filename = exp_tls_dhparam; - } if (m.data) { - rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM); - exim_gnutls_err_check(rc, US"gnutls_dh_params_import_pkcs3"); + if ((rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM))) + return tls_error_gnu(US"gnutls_dh_params_import_pkcs3", rc, host, errstr); DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n"); return OK; } @@ -577,16 +741,16 @@ if (m.data) #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS /* If you change this constant, also change dh_param_fn_ext so that we can use a different filename and ensure we have sufficient bits. */ -dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL); -if (!dh_bits) + +if (!(dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL))) return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL, errstr); DEBUG(D_tls) - debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n", + debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits\n", dh_bits); #else dh_bits = EXIM_SERVER_DH_BITS_PRE2_12; DEBUG(D_tls) - debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n", + debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits\n", dh_bits); #endif @@ -594,7 +758,7 @@ DEBUG(D_tls) if (dh_bits > tls_dh_max_bits) { DEBUG(D_tls) - debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n", + debug_printf("tls_dh_max_bits clamping override, using %d bits instead\n", tls_dh_max_bits); dh_bits = tls_dh_max_bits; } @@ -620,7 +784,7 @@ if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0) { saved_errno = errno; (void)close(fd); - return tls_error(US"TLS cache stat failed", strerror(saved_errno), NULL, errstr); + return tls_error_sys(US"TLS cache stat failed", saved_errno, NULL, errstr); } if (!S_ISREG(statbuf.st_mode)) { @@ -631,28 +795,29 @@ if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0) { saved_errno = errno; (void)close(fd); - return tls_error(US"fdopen(TLS cache stat fd) failed", - strerror(saved_errno), NULL, errstr); + return tls_error_sys(US"fdopen(TLS cache stat fd) failed", + saved_errno, NULL, errstr); } m.size = statbuf.st_size; - if (!(m.data = malloc(m.size))) + if (!(m.data = store_malloc(m.size))) { fclose(fp); - return tls_error(US"malloc failed", strerror(errno), NULL, errstr); + return tls_error_sys(US"malloc failed", errno, NULL, errstr); } if (!(sz = fread(m.data, m.size, 1, fp))) { saved_errno = errno; fclose(fp); - free(m.data); - return tls_error(US"fread failed", strerror(saved_errno), NULL, errstr); + store_free(m.data); + return tls_error_sys(US"fread failed", saved_errno, NULL, errstr); } fclose(fp); rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM); - free(m.data); - exim_gnutls_err_check(rc, US"gnutls_dh_params_import_pkcs3"); + store_free(m.data); + if (rc) + return tls_error_gnu(US"gnutls_dh_params_import_pkcs3", rc, host, errstr); DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename); } @@ -666,7 +831,7 @@ else if (errno == ENOENT) debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename); } else - return tls_error(string_open_failed(errno, "\"%s\" for reading", filename), + return tls_error(string_open_failed("\"%s\" for reading", filename), NULL, NULL, errstr); /* If ret < 0, either the cache file does not exist, or the data it contains @@ -682,21 +847,19 @@ if (rc < 0) if ((PATH_MAX - Ustrlen(filename)) < 10) return tls_error(US"Filename too long to generate replacement", - CS filename, NULL, errstr); + filename, NULL, errstr); - temp_fn = string_copy(US "%s.XXXXXXX"); + temp_fn = string_copy(US"%s.XXXXXXX"); if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */ - return tls_error(US"Unable to open temp file", strerror(errno), NULL, errstr); - (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */ - - /* GnuTLS overshoots! - * If we ask for 2236, we might get 2237 or more. - * But there's no way to ask GnuTLS how many bits there really are. - * We can ask how many bits were used in a TLS session, but that's it! - * The prime itself is hidden behind too much abstraction. - * So we ask for less, and proceed on a wing and a prayer. - * First attempt, subtracted 3 for 2233 and got 2240. - */ + return tls_error_sys(US"Unable to open temp file", errno, NULL, errstr); + (void)exim_chown(temp_fn, exim_uid, exim_gid); /* Probably not necessary */ + + /* GnuTLS overshoots! If we ask for 2236, we might get 2237 or more. But + there's no way to ask GnuTLS how many bits there really are. We can ask + how many bits were used in a TLS session, but that's it! The prime itself + is hidden behind too much abstraction. So we ask for less, and proceed on + a wing and a prayer. First attempt, subtracted 3 for 2233 and got 2240. */ + if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10) { dh_bits_gen = dh_bits - 10; @@ -708,8 +871,8 @@ if (rc < 0) DEBUG(D_tls) debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n", dh_bits_gen); - rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen); - exim_gnutls_err_check(rc, US"gnutls_dh_params_generate2"); + if ((rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen))) + return tls_error_gnu(US"gnutls_dh_params_generate2", rc, host, errstr); /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time, and I confirmed that a NULL call to get the size first is how the GnuTLS @@ -717,41 +880,41 @@ if (rc < 0) sz = 0; m.data = NULL; - rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM, - m.data, &sz); - if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER) - exim_gnutls_err_check(rc, US"gnutls_dh_params_export_pkcs3(NULL) sizing"); + if ( (rc = gnutls_dh_params_export_pkcs3(dh_server_params, + GNUTLS_X509_FMT_PEM, m.data, &sz)) + && rc != GNUTLS_E_SHORT_MEMORY_BUFFER) + return tls_error_gnu(US"gnutls_dh_params_export_pkcs3(NULL) sizing", + rc, host, errstr); m.size = sz; - if (!(m.data = malloc(m.size))) - return tls_error(US"memory allocation failed", strerror(errno), NULL, errstr); + if (!(m.data = store_malloc(m.size))) + return tls_error_sys(US"memory allocation failed", errno, NULL, errstr); /* this will return a size 1 less than the allocation size above */ - rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM, - m.data, &sz); - if (rc != GNUTLS_E_SUCCESS) + if ((rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM, + m.data, &sz))) { - free(m.data); - exim_gnutls_err_check(rc, US"gnutls_dh_params_export_pkcs3() real"); + store_free(m.data); + return tls_error_gnu(US"gnutls_dh_params_export_pkcs3() real", rc, host, errstr); } m.size = sz; /* shrink by 1, probably */ if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size) { - free(m.data); - return tls_error(US"TLS cache write D-H params failed", - strerror(errno), NULL, errstr); + store_free(m.data); + return tls_error_sys(US"TLS cache write D-H params failed", + errno, NULL, errstr); } - free(m.data); + store_free(m.data); if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1) - return tls_error(US"TLS cache write D-H params final newline failed", - strerror(errno), NULL, errstr); + return tls_error_sys(US"TLS cache write D-H params final newline failed", + errno, NULL, errstr); if ((rc = close(fd))) - return tls_error(US"TLS cache write close() failed", strerror(errno), NULL, errstr); + return tls_error_sys(US"TLS cache write close() failed", errno, NULL, errstr); if (Urename(temp_fn, filename) < 0) - return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"", - temp_fn, filename), strerror(errno), NULL, errstr); + return tls_error_sys(string_sprintf("failed to rename \"%s\" as \"%s\"", + temp_fn, filename), errno, NULL, errstr); DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename); } @@ -759,6 +922,7 @@ if (rc < 0) DEBUG(D_tls) debug_printf("initialized server D-H parameters\n"); return OK; } +#endif @@ -774,18 +938,27 @@ gnutls_x509_privkey_t pkey = NULL; const uschar * where; int rc; +#ifndef SUPPORT_SELFSIGN +where = US"library too old"; +rc = GNUTLS_E_NO_CERTIFICATE_FOUND; +if (TRUE) goto err; +#endif + where = US"initialising pkey"; if ((rc = gnutls_x509_privkey_init(&pkey))) goto err; where = US"initialising cert"; if ((rc = gnutls_x509_crt_init(&cert))) goto err; -where = US"generating pkey"; +where = US"generating pkey"; /* Hangs on 2.12.23 */ if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA, #ifdef SUPPORT_PARAM_TO_PK_BITS - gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_LOW), +# ifndef GNUTLS_SEC_PARAM_MEDIUM +# define GNUTLS_SEC_PARAM_MEDIUM GNUTLS_SEC_PARAM_HIGH +# endif + gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_MEDIUM), #else - 1024, + 2048, #endif 0))) goto err; @@ -813,7 +986,8 @@ if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err; where = US"installing selfsign cert"; /* Since: 2.4.0 */ -if ((rc = gnutls_certificate_set_x509_key(state->x509_cred, &cert, 1, pkey))) +if ((rc = gnutls_certificate_set_x509_key(state->lib_state.x509_cred, + &cert, 1, pkey))) goto err; rc = OK; @@ -824,7 +998,7 @@ out: return rc; err: - rc = tls_error(where, gnutls_strerror(rc), NULL, errstr); + rc = tls_error_gnu(where, rc, NULL, errstr); goto out; } @@ -840,250 +1014,320 @@ Return: static int tls_add_certfile(exim_gnutls_state_st * state, const host_item * host, - uschar * certfile, uschar * keyfile, uschar ** errstr) + const uschar * certfile, const uschar * keyfile, uschar ** errstr) { -int rc = gnutls_certificate_set_x509_key_file(state->x509_cred, - CS certfile, CS keyfile, GNUTLS_X509_FMT_PEM); +int rc = gnutls_certificate_set_x509_key_file(state->lib_state.x509_cred, + CCS certfile, CCS keyfile, GNUTLS_X509_FMT_PEM); if (rc < 0) - return tls_error( + return tls_error_gnu( string_sprintf("cert/key setup: cert=%s key=%s", certfile, keyfile), - gnutls_strerror(rc), host, errstr); + rc, host, errstr); return -rc; } -/************************************************* -* Variables re-expanded post-SNI * -*************************************************/ +#if !defined(DISABLE_OCSP) && !defined(SUPPORT_GNUTLS_EXT_RAW_PARSE) +/* Load an OCSP proof from file for sending by the server. Called +on getting a status-request handshake message, for earlier versions +of GnuTLS. */ -/* Called from both server and client code, via tls_init(), and also from -the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni". +static int +server_ocsp_stapling_cb(gnutls_session_t session, void * ptr, + gnutls_datum_t * ocsp_response) +{ +int ret; +DEBUG(D_tls) debug_printf("OCSP stapling callback: %s\n", US ptr); -We can tell the two apart by state->received_sni being non-NULL in callback. +if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0) + { + DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n", + CS ptr); + tls_in.ocsp = OCSP_NOT_RESP; + return GNUTLS_E_NO_CERTIFICATE_STATUS; + } -The callback should not call us unless state->trigger_sni_changes is true, -which we are responsible for setting on the first pass through. +tls_in.ocsp = OCSP_VFY_NOT_TRIED; +return 0; +} +#endif -Arguments: - state exim_gnutls_state_st * - errstr error string pointer -Returns: OK/DEFER/FAIL -*/ +#ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE +/* Make a note that we saw a status-request */ +static int +tls_server_clienthello_ext(void * ctx, unsigned tls_id, + const unsigned char *data, unsigned size) +{ +/* https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */ +if (tls_id == 5) /* status_request */ + { + DEBUG(D_tls) debug_printf("Seen status_request extension from client\n"); + tls_in.ocsp = OCSP_NOT_RESP; + } +return 0; +} +/* Callback for client-hello, on server, if we think we might serve stapled-OCSP */ static int -tls_expand_session_files(exim_gnutls_state_st * state, uschar ** errstr) +tls_server_clienthello_cb(gnutls_session_t session, unsigned int htype, + unsigned when, unsigned int incoming, const gnutls_datum_t * msg) { -struct stat statbuf; -int rc; -const host_item *host = state->host; /* macro should be reconsidered? */ -uschar *saved_tls_certificate = NULL; -uschar *saved_tls_privatekey = NULL; -uschar *saved_tls_verify_certificates = NULL; -uschar *saved_tls_crl = NULL; -int cert_count; +/* Call fn for each extension seen. 3.6.3 onwards */ +return gnutls_ext_raw_parse(NULL, tls_server_clienthello_ext, msg, + GNUTLS_EXT_RAW_FLAG_TLS_CLIENT_HELLO); +} -/* We check for tls_sni *before* expansion. */ -if (!host) /* server */ - if (!state->received_sni) - { - if ( state->tls_certificate - && ( Ustrstr(state->tls_certificate, US"tls_sni") - || Ustrstr(state->tls_certificate, US"tls_in_sni") - || Ustrstr(state->tls_certificate, US"tls_out_sni") - ) ) - { - DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n"); - state->trigger_sni_changes = TRUE; - } - } - else - { - /* useful for debugging */ - saved_tls_certificate = state->exp_tls_certificate; - saved_tls_privatekey = state->exp_tls_privatekey; - saved_tls_verify_certificates = state->exp_tls_verify_certificates; - saved_tls_crl = state->exp_tls_crl; - } -rc = gnutls_certificate_allocate_credentials(&state->x509_cred); -exim_gnutls_err_check(rc, US"gnutls_certificate_allocate_credentials"); +/* Make a note that we saw a status-response */ +static int +tls_server_servercerts_ext(void * ctx, unsigned tls_id, + const unsigned char *data, unsigned size) +{ +/* debug_printf("%s %u\n", __FUNCTION__, tls_id); */ +/* https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */ +if (FALSE && tls_id == 5) /* status_request */ + { + DEBUG(D_tls) debug_printf("Seen status_request extension\n"); + tls_in.ocsp = exim_testharness_disable_ocsp_validity_check + ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */ + } +return 0; +} -#ifdef SUPPORT_SRV_OCSP_STACK -gnutls_certificate_set_flags(state->x509_cred, GNUTLS_CERTIFICATE_API_V2); +/* Callback for certificates packet, on server, if we think we might serve stapled-OCSP */ +static int +tls_server_servercerts_cb(gnutls_session_t session, unsigned int htype, + unsigned when, unsigned int incoming, const gnutls_datum_t * msg) +{ +/* Call fn for each extension seen. 3.6.3 onwards */ +#ifdef notdef +/*XXX crashes */ +return gnutls_ext_raw_parse(NULL, tls_server_servercerts_ext, msg, 0); +#endif +} #endif -/* remember: expand_check_tlsvar() is expand_check() but fiddling with -state members, assuming consistent naming; and expand_check() returns -false if expansion failed, unless expansion was forced to fail. */ +/*XXX in tls1.3 the cert-status travel as an extension next to the cert, in the + "Handshake Protocol: Certificate" record. +So we need to spot the Certificate handshake message, parse it and spot any status_request extension(s) -/* check if we at least have a certificate, before doing expensive -D-H generation. */ +This is different to tls1.2 - where it is a separate record (wireshark term) / handshake message (gnutls term). +*/ -if (!expand_check_tlsvar(tls_certificate, errstr)) - return DEFER; +#if defined(EXIM_HAVE_TLS_RESUME) || defined(SUPPORT_GNUTLS_EXT_RAW_PARSE) +/* Callback for certificate-status, on server. We sent stapled OCSP. */ +static int +tls_server_certstatus_cb(gnutls_session_t session, unsigned int htype, + unsigned when, unsigned int incoming, const gnutls_datum_t * msg) +{ +DEBUG(D_tls) debug_printf("Sending certificate-status\n"); /*XXX we get this for tls1.2 but not for 1.3 */ +#ifdef SUPPORT_SRV_OCSP_STACK +tls_in.ocsp = exim_testharness_disable_ocsp_validity_check + ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */ +#else +tls_in.ocsp = OCSP_VFY_NOT_TRIED; +#endif +return 0; +} -/* certificate is mandatory in server, optional in client */ +/* Callback for handshake messages, on server */ +static int +tls_server_hook_cb(gnutls_session_t sess, u_int htype, unsigned when, + unsigned incoming, const gnutls_datum_t * msg) +{ +/* debug_printf("%s: htype %u\n", __FUNCTION__, htype); */ +switch (htype) + { +# ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE + case GNUTLS_HANDSHAKE_CLIENT_HELLO: + return tls_server_clienthello_cb(sess, htype, when, incoming, msg); + case GNUTLS_HANDSHAKE_CERTIFICATE_PKT: + return tls_server_servercerts_cb(sess, htype, when, incoming, msg); +# endif + case GNUTLS_HANDSHAKE_CERTIFICATE_STATUS: + return tls_server_certstatus_cb(sess, htype, when, incoming, msg); +# ifdef EXIM_HAVE_TLS_RESUME + case GNUTLS_HANDSHAKE_NEW_SESSION_TICKET: + return tls_server_ticket_cb(sess, htype, when, incoming, msg); +# endif + default: + return 0; + } +} +#endif -if ( !state->exp_tls_certificate - || !*state->exp_tls_certificate - ) - if (!host) - return tls_install_selfsign(state, errstr); - else - DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n"); -if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey, errstr)) - return DEFER; +#if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE) +static void +tls_server_testharness_ocsp_fiddle(void) +{ +extern char ** environ; +if (environ) for (uschar ** p = USS environ; *p; p++) + if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0) + { + DEBUG(D_tls) debug_printf("Permitting known bad OCSP response\n"); + exim_testharness_disable_ocsp_validity_check = TRUE; + } +} +#endif -/* tls_privatekey is optional, defaulting to same file as certificate */ - -if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0') - { - state->tls_privatekey = state->tls_certificate; - state->exp_tls_privatekey = state->exp_tls_certificate; - } +/************************************************** +* One-time init credentials for server and client * +**************************************************/ +static void +creds_basic_init(gnutls_certificate_credentials_t x509_cred, BOOL server) +{ +#ifdef SUPPORT_SRV_OCSP_STACK +gnutls_certificate_set_flags(x509_cred, GNUTLS_CERTIFICATE_API_V2); -if (state->exp_tls_certificate && *state->exp_tls_certificate) +# if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE) +if (server && tls_ocsp_file) { - DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n", - state->exp_tls_certificate, state->exp_tls_privatekey); + if (f.running_in_test_harness) + tls_server_testharness_ocsp_fiddle(); - if (state->received_sni) - if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0 - && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0 - ) - { - DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n"); - } - else - { - DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n"); - } - - if (!host) /* server */ - { - const uschar * clist = state->exp_tls_certificate; - const uschar * klist = state->exp_tls_privatekey; - const uschar * olist; - int csep = 0, ksep = 0, osep = 0, cnt = 0; - uschar * cfile, * kfile, * ofile; + if (exim_testharness_disable_ocsp_validity_check) + gnutls_certificate_set_flags(x509_cred, + GNUTLS_CERTIFICATE_API_V2 | GNUTLS_CERTIFICATE_SKIP_OCSP_RESPONSE_CHECK); + } +# endif +#endif +DEBUG(D_tls) + debug_printf("TLS: basic cred init, %s\n", server ? "server" : "client"); +} +static int +creds_load_server_certs(exim_gnutls_state_st * state, const uschar * cert, + const uschar * pkey, const uschar * ocsp, uschar ** errstr) +{ +const uschar * clist = cert; +const uschar * klist = pkey; +const uschar * olist; +int csep = 0, ksep = 0, osep = 0, cnt = 0, rc; +uschar * cfile, * kfile, * ofile; #ifndef DISABLE_OCSP - if (!expand_check(tls_ocsp_file, US"tls_ocsp_file", &ofile, errstr)) - return DEFER; - olist = ofile; +# ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE +gnutls_x509_crt_fmt_t ocsp_fmt = GNUTLS_X509_FMT_DER; +# endif + +if (!expand_check(ocsp, US"tls_ocsp_file", &ofile, errstr)) + return DEFER; +olist = ofile; #endif - while (cfile = string_nextinlist(&clist, &csep, NULL, 0)) +while (cfile = string_nextinlist(&clist, &csep, NULL, 0)) - if (!(kfile = string_nextinlist(&klist, &ksep, NULL, 0))) - return tls_error(US"cert/key setup: out of keys", NULL, host, errstr); - else if (0 < (rc = tls_add_certfile(state, host, cfile, kfile, errstr))) - return rc; - else + if (!(kfile = string_nextinlist(&klist, &ksep, NULL, 0))) + return tls_error(US"cert/key setup: out of keys", NULL, NULL, errstr); + else if ((rc = tls_add_certfile(state, NULL, cfile, kfile, errstr)) > 0) + return rc; + else + { + int gnutls_cert_index = -rc; + DEBUG(D_tls) debug_printf("TLS: cert/key %d %s registered\n", + gnutls_cert_index, cfile); + +#ifndef DISABLE_OCSP + if (ocsp) + { + /* Set the OCSP stapling server info */ + if (gnutls_buggy_ocsp) { - int gnutls_cert_index = -rc; - DEBUG(D_tls) debug_printf("TLS: cert/key %s registered\n", cfile); + DEBUG(D_tls) + debug_printf("GnuTLS library is buggy for OCSP; avoiding\n"); + } + else if ((ofile = string_nextinlist(&olist, &osep, NULL, 0))) + { + DEBUG(D_tls) debug_printf("OCSP response file %d = %s\n", + gnutls_cert_index, ofile); +# ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE + if (Ustrncmp(ofile, US"PEM ", 4) == 0) + { + ocsp_fmt = GNUTLS_X509_FMT_PEM; + ofile += 4; + } + else if (Ustrncmp(ofile, US"DER ", 4) == 0) + { + ocsp_fmt = GNUTLS_X509_FMT_DER; + ofile += 4; + } - /* Set the OCSP stapling server info */ + if ((rc = gnutls_certificate_set_ocsp_status_request_file2( + state->lib_state.x509_cred, CCS ofile, gnutls_cert_index, + ocsp_fmt)) < 0) + return tls_error_gnu( + US"gnutls_certificate_set_ocsp_status_request_file2", + rc, NULL, errstr); + DEBUG(D_tls) + debug_printf(" %d response%s loaded\n", rc, rc>1 ? "s":""); -#ifndef DISABLE_OCSP - if (tls_ocsp_file) - if (gnutls_buggy_ocsp) - { - DEBUG(D_tls) - debug_printf("GnuTLS library is buggy for OCSP; avoiding\n"); - } - else if ((ofile = string_nextinlist(&olist, &osep, NULL, 0))) - { - /* Use the full callback method for stapling just to get - observability. More efficient would be to read the file once only, - if it never changed (due to SNI). Would need restart on file update, - or watch datestamp. */ + /* Arrange callbacks for OCSP request observability */ -# ifdef SUPPORT_SRV_OCSP_STACK - rc = gnutls_certificate_set_ocsp_status_request_function2( - state->x509_cred, gnutls_cert_index, - server_ocsp_stapling_cb, ofile); + if (state->session) + gnutls_handshake_set_hook_function(state->session, + GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb); + else + state->lib_state.ocsp_hook = TRUE; - exim_gnutls_err_check(rc, - US"gnutls_certificate_set_ocsp_status_request_function2"); -# else - if (cnt++ > 0) - { - DEBUG(D_tls) - debug_printf("oops; multiple OCSP files not supported\n"); - break; - } - gnutls_certificate_set_ocsp_status_request_function( - state->x509_cred, server_ocsp_stapling_cb, ofile); -# endif - DEBUG(D_tls) debug_printf("OCSP response file = %s\n", ofile); +# else +# if defined(SUPPORT_SRV_OCSP_STACK) + if ((rc = gnutls_certificate_set_ocsp_status_request_function2( + state->lib_state.x509_cred, gnutls_cert_index, + server_ocsp_stapling_cb, ofile))) + return tls_error_gnu( + US"gnutls_certificate_set_ocsp_status_request_function2", + rc, NULL, errstr); + else +# endif + { + if (cnt++ > 0) + { + DEBUG(D_tls) + debug_printf("oops; multiple OCSP files not supported\n"); + break; } - else - DEBUG(D_tls) debug_printf("ran out of OCSP response files in list\n"); -#endif + gnutls_certificate_set_ocsp_status_request_function( + state->lib_state.x509_cred, server_ocsp_stapling_cb, ofile); + } +# endif /* SUPPORT_GNUTLS_EXT_RAW_PARSE */ } + else + DEBUG(D_tls) debug_printf("ran out of OCSP response files in list\n"); + } +#endif /* DISABLE_OCSP */ } - else - { - if (0 < (rc = tls_add_certfile(state, host, - state->exp_tls_certificate, state->exp_tls_privatekey, errstr))) - return rc; - DEBUG(D_tls) debug_printf("TLS: cert/key registered\n"); - } - - } /* tls_certificate */ - - -/* Set the trusted CAs file if one is provided, and then add the CRL if one is -provided. Experiment shows that, if the certificate file is empty, an unhelpful -error message is provided. However, if we just refrain from setting anything up -in that case, certificate verification fails, which seems to be the correct -behaviour. */ +return 0; +} -if (state->tls_verify_certificates && *state->tls_verify_certificates) - { - if (!expand_check_tlsvar(tls_verify_certificates, errstr)) - return DEFER; -#ifndef SUPPORT_SYSDEFAULT_CABUNDLE - if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0) - state->exp_tls_verify_certificates = NULL; -#endif - if (state->tls_crl && *state->tls_crl) - if (!expand_check_tlsvar(tls_crl, errstr)) - return DEFER; +static int +creds_load_client_certs(exim_gnutls_state_st * state, const host_item * host, + const uschar * cert, const uschar * pkey, uschar ** errstr) +{ +int rc = tls_add_certfile(state, host, cert, pkey, errstr); +if (rc > 0) return rc; +DEBUG(D_tls) debug_printf("TLS: cert/key registered\n"); +return 0; +} - if (!(state->exp_tls_verify_certificates && - *state->exp_tls_verify_certificates)) - { - DEBUG(D_tls) - debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n"); - /* With no tls_verify_certificates, we ignore tls_crl too */ - return OK; - } - } -else - { - DEBUG(D_tls) - debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n"); - return OK; - } +static int +creds_load_cabundle(exim_gnutls_state_st * state, const uschar * bundle, + const host_item * host, uschar ** errstr) +{ +int cert_count; +struct stat statbuf; #ifdef SUPPORT_SYSDEFAULT_CABUNDLE -if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0) - cert_count = gnutls_certificate_set_x509_system_trust(state->x509_cred); +if (Ustrcmp(bundle, "system") == 0 || Ustrncmp(bundle, "system,", 7) == 0) + cert_count = gnutls_certificate_set_x509_system_trust(state->lib_state.x509_cred); else #endif { - if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0) + if (Ustat(bundle, &statbuf) < 0) { - log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s " - "(tls_verify_certificates): %s", state->exp_tls_verify_certificates, - strerror(errno)); + log_write(0, LOG_MAIN|LOG_PANIC, "could not stat '%s' " + "(tls_verify_certificates): %s", bundle, strerror(errno)); return DEFER; } @@ -1095,18 +1339,14 @@ else So s/!S_ISREG/S_ISDIR/ and change some messaging ... */ if (S_ISDIR(statbuf.st_mode)) { - DEBUG(D_tls) - debug_printf("verify certificates path is a dir: \"%s\"\n", - state->exp_tls_verify_certificates); log_write(0, LOG_MAIN|LOG_PANIC, - "tls_verify_certificates \"%s\" is a directory", - state->exp_tls_verify_certificates); + "tls_verify_certificates \"%s\" is a directory", bundle); return DEFER; } #endif DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n", - state->exp_tls_verify_certificates, statbuf.st_size); + bundle, statbuf.st_size); if (statbuf.st_size == 0) { @@ -1120,33 +1360,481 @@ else #ifdef SUPPORT_CA_DIR (statbuf.st_mode & S_IFMT) == S_IFDIR ? - gnutls_certificate_set_x509_trust_dir(state->x509_cred, - CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM) + gnutls_certificate_set_x509_trust_dir(state->lib_state.x509_cred, + CS bundle, GNUTLS_X509_FMT_PEM) : #endif - gnutls_certificate_set_x509_trust_file(state->x509_cred, - CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM); + gnutls_certificate_set_x509_trust_file(state->lib_state.x509_cred, + CS bundle, GNUTLS_X509_FMT_PEM); + +#ifdef SUPPORT_CA_DIR + /* Mimic the behaviour with OpenSSL of not advertising a usable-cert list + when using the directory-of-certs config model. */ + + if ((statbuf.st_mode & S_IFMT) == S_IFDIR) + if (state->session) + gnutls_certificate_send_x509_rdn_sequence(state->session, 1); + else + state->lib_state.ca_rdn_emulate = TRUE; +#endif } if (cert_count < 0) + return tls_error_gnu(US"setting certificate trust", cert_count, host, errstr); +DEBUG(D_tls) + debug_printf("Added %d certificate authorities\n", cert_count); + +return OK; +} + + +static int +creds_load_crl(exim_gnutls_state_st * state, const uschar * crl, uschar ** errstr) +{ +int cert_count; +DEBUG(D_tls) debug_printf("loading CRL file = %s\n", crl); +if ((cert_count = gnutls_certificate_set_x509_crl_file(state->lib_state.x509_cred, + CS crl, GNUTLS_X509_FMT_PEM)) < 0) + return tls_error_gnu(US"gnutls_certificate_set_x509_crl_file", + cert_count, state->host, errstr); + +DEBUG(D_tls) debug_printf("Processed %d CRLs\n", cert_count); +return OK; +} + + +static int +creds_load_pristring(exim_gnutls_state_st * state, const uschar * p, + const char ** errpos) +{ +if (!p) + { + p = exim_default_gnutls_priority; + DEBUG(D_tls) + debug_printf("GnuTLS using default session cipher/priority \"%s\"\n", p); + } +return gnutls_priority_init( (gnutls_priority_t *) &state->lib_state.pri_cache, + CCS p, errpos); +} + +static void +tls_server_creds_init(void) +{ +uschar * dummy_errstr; + +state_server.lib_state = null_tls_preload; +if (gnutls_certificate_allocate_credentials( + (gnutls_certificate_credentials_t *) &state_server.lib_state.x509_cred)) + { + state_server.lib_state.x509_cred = NULL; + return; + } +creds_basic_init(state_server.lib_state.x509_cred, TRUE); + +#ifdef EXIM_HAVE_INOTIFY +/* If tls_certificate has any $ indicating expansions, it is not good. +If tls_privatekey is set but has $, not good. Likewise for tls_ocsp_file. +If all good (and tls_certificate set), load the cert(s). Do not try +to handle selfsign generation for now (tls_certificate null/empty; +XXX will want to do that later though) due to the lifetime/expiry issue. */ + +if ( opt_set_and_noexpand(tls_certificate) + && opt_unset_or_noexpand(tls_privatekey) + && opt_unset_or_noexpand(tls_ocsp_file)) + { + /* Set watches on the filenames. The implementation does de-duplication + so we can just blindly do them all. + */ + + if ( tls_set_watch(tls_certificate, TRUE) + && tls_set_watch(tls_privatekey, TRUE) + && tls_set_watch(tls_ocsp_file, TRUE) + ) + { + DEBUG(D_tls) debug_printf("TLS: preloading server certs\n"); + if (creds_load_server_certs(&state_server, tls_certificate, + tls_privatekey && *tls_privatekey ? tls_privatekey : tls_certificate, + tls_ocsp_file, &dummy_errstr) == 0) + state_server.lib_state.conn_certs = TRUE; + } + } +else + DEBUG(D_tls) debug_printf("TLS: not preloading server certs\n"); + +/* If tls_verify_certificates is non-empty and has no $, load CAs */ + +if (opt_set_and_noexpand(tls_verify_certificates)) + { + if (tls_set_watch(tls_verify_certificates, FALSE)) + { + DEBUG(D_tls) debug_printf("TLS: preloading CA bundle for server\n"); + if (creds_load_cabundle(&state_server, tls_verify_certificates, + NULL, &dummy_errstr) != OK) + return; + state_server.lib_state.cabundle = TRUE; + + /* If CAs loaded and tls_crl is non-empty and has no $, load it */ + + if (opt_set_and_noexpand(tls_crl)) + { + if (tls_set_watch(tls_crl, FALSE)) + { + DEBUG(D_tls) debug_printf("TLS: preloading CRL for server\n"); + if (creds_load_crl(&state_server, tls_crl, &dummy_errstr) != OK) + return; + state_server.lib_state.crl = TRUE; + } + } + else + DEBUG(D_tls) debug_printf("TLS: not preloading CRL for server\n"); + } + } +else + DEBUG(D_tls) debug_printf("TLS: not preloading CA bundle for server\n"); +#endif /* EXIM_HAVE_INOTIFY */ + +/* If tls_require_ciphers is non-empty and has no $, load the +ciphers priority cache. If unset, load with the default. +(server-only as the client one depends on non/DANE) */ + +if (!tls_require_ciphers || opt_set_and_noexpand(tls_require_ciphers)) + { + const char * dummy_errpos; + DEBUG(D_tls) debug_printf("TLS: preloading cipher list for server: %s\n", + tls_require_ciphers); + if ( creds_load_pristring(&state_server, tls_require_ciphers, &dummy_errpos) + == OK) + state_server.lib_state.pri_string = TRUE; + } +else + DEBUG(D_tls) debug_printf("TLS: not preloading cipher list for server\n"); +} + + +/* Preload whatever creds are static, onto a transport. The client can then +just copy the pointer as it starts up. */ + +static void +tls_client_creds_init(transport_instance * t, BOOL watch) +{ +smtp_transport_options_block * ob = t->options_block; +exim_gnutls_state_st tpt_dummy_state; +host_item * dummy_host = (host_item *)1; +uschar * dummy_errstr; + +if (!exim_gnutls_base_init_done) + tls_g_init(); + +ob->tls_preload = null_tls_preload; +if (gnutls_certificate_allocate_credentials( + (struct gnutls_certificate_credentials_st **)&ob->tls_preload.x509_cred)) + { + ob->tls_preload.x509_cred = NULL; + return; + } +creds_basic_init(ob->tls_preload.x509_cred, FALSE); + +tpt_dummy_state.session = NULL; +tpt_dummy_state.lib_state = ob->tls_preload; + +#ifdef EXIM_HAVE_INOTIFY +if ( opt_set_and_noexpand(ob->tls_certificate) + && opt_unset_or_noexpand(ob->tls_privatekey)) + { + if ( !watch + || ( tls_set_watch(ob->tls_certificate, FALSE) + && tls_set_watch(ob->tls_privatekey, FALSE) + ) ) + { + const uschar * pkey = ob->tls_privatekey; + + DEBUG(D_tls) + debug_printf("TLS: preloading client certs for transport '%s'\n", t->name); + + /* The state->lib_state.x509_cred is used for the certs load, and is the sole + structure element used. So we can set up a dummy. The hoat arg only + selects a retcode in case of fail, so any value */ + + if (creds_load_client_certs(&tpt_dummy_state, dummy_host, + ob->tls_certificate, pkey ? pkey : ob->tls_certificate, + &dummy_errstr) == OK) + ob->tls_preload.conn_certs = TRUE; + } + } +else + DEBUG(D_tls) + debug_printf("TLS: not preloading client certs, for transport '%s'\n", t->name); + +if (opt_set_and_noexpand(ob->tls_verify_certificates)) + { + if (!watch || tls_set_watch(ob->tls_verify_certificates, FALSE)) + { + DEBUG(D_tls) + debug_printf("TLS: preloading CA bundle for transport '%s'\n", t->name); + if (creds_load_cabundle(&tpt_dummy_state, ob->tls_verify_certificates, + dummy_host, &dummy_errstr) != OK) + return; + ob->tls_preload.cabundle = TRUE; + + if (opt_set_and_noexpand(ob->tls_crl)) + { + if (!watch || tls_set_watch(ob->tls_crl, FALSE)) + { + DEBUG(D_tls) debug_printf("TLS: preloading CRL for transport '%s'\n", t->name); + if (creds_load_crl(&tpt_dummy_state, ob->tls_crl, &dummy_errstr) != OK) + return; + ob->tls_preload.crl = TRUE; + } + } + else + DEBUG(D_tls) debug_printf("TLS: not preloading CRL, for transport '%s'\n", t->name); + } + } +else + DEBUG(D_tls) + debug_printf("TLS: not preloading CA bundle, for transport '%s'\n", t->name); + +/* We do not preload tls_require_ciphers to to the transport as it implicitly +depends on DANE or plain usage. */ + +#endif +} + + +#ifdef EXIM_HAVE_INOTIFY +/* Invalidate the creds cached, by dropping the current ones. +Call when we notice one of the source files has changed. */ + +static void +tls_server_creds_invalidate(void) +{ +if (state_server.lib_state.pri_cache) + gnutls_priority_deinit(state_server.lib_state.pri_cache); +state_server.lib_state.pri_cache = NULL; + +if (state_server.lib_state.x509_cred) + gnutls_certificate_free_credentials(state_server.lib_state.x509_cred); +state_server.lib_state = null_tls_preload; +} + + +static void +tls_client_creds_invalidate(transport_instance * t) +{ +smtp_transport_options_block * ob = t->options_block; +if (ob->tls_preload.x509_cred) + gnutls_certificate_free_credentials(ob->tls_preload.x509_cred); +ob->tls_preload = null_tls_preload; +} +#endif + + +/************************************************* +* Variables re-expanded post-SNI * +*************************************************/ + +/* Called from both server and client code, via tls_init(), and also from +the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni". + +We can tell the two apart by state->received_sni being non-NULL in callback. + +The callback should not call us unless state->trigger_sni_changes is true, +which we are responsible for setting on the first pass through. + +Arguments: + state exim_gnutls_state_st * + errstr error string pointer + +Returns: OK/DEFER/FAIL +*/ + +static int +tls_expand_session_files(exim_gnutls_state_st * state, uschar ** errstr) +{ +int rc; +const host_item *host = state->host; /* macro should be reconsidered? */ +const uschar *saved_tls_certificate = NULL; +const uschar *saved_tls_privatekey = NULL; +const uschar *saved_tls_verify_certificates = NULL; +const uschar *saved_tls_crl = NULL; +int cert_count; + +/* We check for tls_sni *before* expansion. */ +if (!host) /* server */ + if (!state->received_sni) + { + if ( state->tls_certificate + && ( Ustrstr(state->tls_certificate, US"tls_sni") + || Ustrstr(state->tls_certificate, US"tls_in_sni") + || Ustrstr(state->tls_certificate, US"tls_out_sni") + ) ) + { + DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI\n"); + state->trigger_sni_changes = TRUE; + } + } + else /* SNI callback case */ + { + /* useful for debugging */ + saved_tls_certificate = state->exp_tls_certificate; + saved_tls_privatekey = state->exp_tls_privatekey; + saved_tls_verify_certificates = state->exp_tls_verify_certificates; + saved_tls_crl = state->exp_tls_crl; + } + +if (!state->lib_state.x509_cred) + { + if ((rc = gnutls_certificate_allocate_credentials( + (gnutls_certificate_credentials_t *) &state->lib_state.x509_cred))) + return tls_error_gnu(US"gnutls_certificate_allocate_credentials", + rc, host, errstr); + creds_basic_init(state->lib_state.x509_cred, !host); + } + + +/* remember: Expand_check_tlsvar() is expand_check() but fiddling with +state members, assuming consistent naming; and expand_check() returns +false if expansion failed, unless expansion was forced to fail. */ + +/* check if we at least have a certificate, before doing expensive +D-H generation. */ + +if (!state->lib_state.conn_certs) + { + if (!Expand_check_tlsvar(tls_certificate, errstr)) + return DEFER; + + /* certificate is mandatory in server, optional in client */ + + if ( !state->exp_tls_certificate + || !*state->exp_tls_certificate + ) + if (!host) + return tls_install_selfsign(state, errstr); + else + DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n"); + + if (state->tls_privatekey && !Expand_check_tlsvar(tls_privatekey, errstr)) + return DEFER; + + /* tls_privatekey is optional, defaulting to same file as certificate */ + + if (!state->tls_privatekey || !*state->tls_privatekey) + { + state->tls_privatekey = state->tls_certificate; + state->exp_tls_privatekey = state->exp_tls_certificate; + } + + if (state->exp_tls_certificate && *state->exp_tls_certificate) + { + BOOL load = TRUE; + DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n", + state->exp_tls_certificate, state->exp_tls_privatekey); + + if (state->received_sni) + if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0 + && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0 + ) + { + DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n"); + load = FALSE; /* avoid re-loading the same certs */ + } + else /* unload the pre-SNI certs before loading new ones */ + { + DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair\n"); + gnutls_certificate_free_keys(state->lib_state.x509_cred); + } + + if ( load + && (rc = host + ? creds_load_client_certs(state, host, state->exp_tls_certificate, + state->exp_tls_privatekey, errstr) + : creds_load_server_certs(state, state->exp_tls_certificate, + state->exp_tls_privatekey, tls_ocsp_file, errstr) + ) ) return rc; + } + } +else { - rc = cert_count; - exim_gnutls_err_check(rc, US"setting certificate trust"); + DEBUG(D_tls) + debug_printf("%s certs were preloaded\n", host ? "client" : "server"); + + if (!state->tls_privatekey) state->tls_privatekey = state->tls_certificate; + state->exp_tls_certificate = US state->tls_certificate; + state->exp_tls_privatekey = US state->tls_privatekey; + +#ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE + if (state->lib_state.ocsp_hook) + gnutls_handshake_set_hook_function(state->session, + GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb); +#endif } -DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count); -if (state->tls_crl && *state->tls_crl && - state->exp_tls_crl && *state->exp_tls_crl) + +/* Set the trusted CAs file if one is provided, and then add the CRL if one is +provided. Experiment shows that, if the certificate file is empty, an unhelpful +error message is provided. However, if we just refrain from setting anything up +in that case, certificate verification fails, which seems to be the correct +behaviour. */ + +if (!state->lib_state.cabundle) { - DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl); - cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred, - CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM); - if (cert_count < 0) + if (state->tls_verify_certificates && *state->tls_verify_certificates) + { + if (!Expand_check_tlsvar(tls_verify_certificates, errstr)) + return DEFER; +#ifndef SUPPORT_SYSDEFAULT_CABUNDLE + if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0) + state->exp_tls_verify_certificates = NULL; +#endif + if (state->tls_crl && *state->tls_crl) + if (!Expand_check_tlsvar(tls_crl, errstr)) + return DEFER; + + if (!(state->exp_tls_verify_certificates && + *state->exp_tls_verify_certificates)) + { + DEBUG(D_tls) + debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n"); + /* With no tls_verify_certificates, we ignore tls_crl too */ + return OK; + } + } + else { - rc = cert_count; - exim_gnutls_err_check(rc, US"gnutls_certificate_set_x509_crl_file"); + DEBUG(D_tls) + debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n"); + return OK; } - DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count); + rc = creds_load_cabundle(state, state->exp_tls_verify_certificates, host, errstr); + if (rc != OK) return rc; + } +else + { + DEBUG(D_tls) + debug_printf("%s CA bundle was preloaded\n", host ? "client" : "server"); + state->exp_tls_verify_certificates = US state->tls_verify_certificates; + +#ifdef SUPPORT_CA_DIR +/* Mimic the behaviour with OpenSSL of not advertising a usable-cert list +when using the directory-of-certs config model. */ + if (state->lib_state.ca_rdn_emulate) + gnutls_certificate_send_x509_rdn_sequence(state->session, 1); +#endif + } + + +if (!state->lib_state.crl) + { + if ( state->tls_crl && *state->tls_crl + && state->exp_tls_crl && *state->exp_tls_crl) + return creds_load_crl(state, state->exp_tls_crl, errstr); + } +else + { + DEBUG(D_tls) + debug_printf("%s CRL was preloaded\n", host ? "client" : "server"); + state->exp_tls_crl = US state->tls_crl; } return OK; @@ -1178,6 +1866,7 @@ tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr) int rc; const host_item *host = state->host; /* macro should be reconsidered? */ +#ifndef GNUTLS_AUTO_DHPARAMS /* Create D-H parameters, or read them from the cache file. This function does its own SMTP error messaging. This only happens for the server, TLS D-H ignores client-side params. */ @@ -1185,17 +1874,18 @@ client-side params. */ if (!state->host) { if (!dh_server_params) - { - rc = init_server_dh(errstr); - if (rc != OK) return rc; - } - gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params); + if ((rc = init_server_dh(errstr)) != OK) return rc; + + /* Unnecessary & discouraged with 3.6.0 or later */ + gnutls_certificate_set_dh_params(state->lib_state.x509_cred, dh_server_params); } +#endif /* Link the credentials to the session. */ -rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred); -exim_gnutls_err_check(rc, US"gnutls_credentials_set"); +if ((rc = gnutls_credentials_set(state->session, + GNUTLS_CRD_CERTIFICATE, state->lib_state.x509_cred))) + return tls_error_gnu(US"gnutls_credentials_set", rc, host, errstr); return OK; } @@ -1205,47 +1895,12 @@ return OK; *************************************************/ -#ifndef DISABLE_OCSP - -static BOOL -tls_is_buggy_ocsp(void) -{ -const uschar * s; -uschar maj, mid, mic; - -s = CUS gnutls_check_version(NULL); -maj = atoi(CCS s); -if (maj == 3) - { - while (*s && *s != '.') s++; - mid = atoi(CCS ++s); - if (mid <= 2) - return TRUE; - else if (mid >= 5) - return FALSE; - else - { - while (*s && *s != '.') s++; - mic = atoi(CCS ++s); - return mic <= (mid == 3 ? 16 : 3); - } - } -return FALSE; -} - -#endif - - /* Called from both server and client code. In the case of a server, errors before actual TLS negotiation return DEFER. Arguments: host connected host, if client; NULL if server - certificate certificate file - privatekey private key file - sni TLS SNI to send, sometimes when client; else NULL - cas CA certs file - crl CRL file + ob tranport options block, if client; NULL if server require_ciphers tls_require_ciphers setting caller_state returned state-info structure errstr error string pointer @@ -1256,98 +1911,69 @@ Returns: OK/DEFER/FAIL static int tls_init( const host_item *host, - const uschar *certificate, - const uschar *privatekey, - const uschar *sni, - const uschar *cas, - const uschar *crl, - const uschar *require_ciphers, + smtp_transport_options_block * ob, + const uschar * require_ciphers, exim_gnutls_state_st **caller_state, tls_support * tlsp, uschar ** errstr) { -exim_gnutls_state_st *state; +exim_gnutls_state_st * state; int rc; size_t sz; -const char *errpos; -uschar *p; -BOOL want_default_priorities; if (!exim_gnutls_base_init_done) - { - DEBUG(D_tls) debug_printf("GnuTLS global init required.\n"); - -#ifdef HAVE_GNUTLS_PKCS11 - /* By default, gnutls_global_init will init PKCS11 support in auto mode, - which loads modules from a config file, which sounds good and may be wanted - by some sysadmin, but also means in common configurations that GNOME keyring - environment variables are used and so breaks for users calling mailq. - To prevent this, we init PKCS11 first, which is the documented approach. */ - if (!gnutls_allow_auto_pkcs11) - { - rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL); - exim_gnutls_err_check(rc, US"gnutls_pkcs11_init"); - } -#endif - - rc = gnutls_global_init(); - exim_gnutls_err_check(rc, US"gnutls_global_init"); - -#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0 - DEBUG(D_tls) - { - gnutls_global_set_log_function(exim_gnutls_logger_cb); - /* arbitrarily chosen level; bump upto 9 for more */ - gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL); - } -#endif - -#ifndef DISABLE_OCSP - if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp())) - log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version"); -#endif - - exim_gnutls_base_init_done = TRUE; - } + tls_g_init(); if (host) { /* For client-side sessions we allocate a context. This lets us run several in parallel. */ + int old_pool = store_pool; store_pool = POOL_PERM; - state = store_get(sizeof(exim_gnutls_state_st)); + state = store_get(sizeof(exim_gnutls_state_st), FALSE); store_pool = old_pool; memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init)); + state->lib_state = ob->tls_preload; state->tlsp = tlsp; DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n"); rc = gnutls_init(&state->session, GNUTLS_CLIENT); + + state->tls_certificate = ob->tls_certificate; + state->tls_privatekey = ob->tls_privatekey; + state->tls_sni = ob->tls_sni; + state->tls_verify_certificates = ob->tls_verify_certificates; + state->tls_crl = ob->tls_crl; } else { + /* Server operations always use the one state_server context. It is not + shared because we have forked a fresh process for every receive. However it + can get re-used for successive TLS sessions on a single TCP connection. */ + state = &state_server; - memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init)); state->tlsp = tlsp; DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n"); rc = gnutls_init(&state->session, GNUTLS_SERVER); + + state->tls_certificate = tls_certificate; + state->tls_privatekey = tls_privatekey; + state->tls_sni = NULL; + state->tls_verify_certificates = tls_verify_certificates; + state->tls_crl = tls_crl; } -exim_gnutls_err_check(rc, US"gnutls_init"); +if (rc) + return tls_error_gnu(US"gnutls_init", rc, host, errstr); +state->tls_require_ciphers = require_ciphers; state->host = host; -state->tls_certificate = certificate; -state->tls_privatekey = privatekey; -state->tls_require_ciphers = require_ciphers; -state->tls_sni = sni; -state->tls_verify_certificates = cas; -state->tls_crl = crl; - /* This handles the variables that might get re-expanded after TLS SNI; that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */ DEBUG(D_tls) - debug_printf("Expanding various TLS configuration options for session credentials.\n"); + debug_printf("Expanding various TLS configuration options for session credentials\n"); if ((rc = tls_expand_session_files(state, errstr)) != OK) return rc; /* These are all other parts of the x509_cred handling, since SNI in GnuTLS @@ -1358,61 +1984,62 @@ if ((rc = tls_set_remaining_x509(state, errstr)) != OK) return rc; /* set SNI in client, only */ if (host) { - if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni, errstr)) + if (!expand_check(state->tls_sni, US"tls_out_sni", &state->tlsp->sni, errstr)) return DEFER; if (state->tlsp->sni && *state->tlsp->sni) { DEBUG(D_tls) debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni); sz = Ustrlen(state->tlsp->sni); - rc = gnutls_server_name_set(state->session, - GNUTLS_NAME_DNS, state->tlsp->sni, sz); - exim_gnutls_err_check(rc, US"gnutls_server_name_set"); + if ((rc = gnutls_server_name_set(state->session, + GNUTLS_NAME_DNS, state->tlsp->sni, sz))) + return tls_error_gnu(US"gnutls_server_name_set", rc, host, errstr); } } else if (state->tls_sni) DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \ "have an SNI set for a server [%s]\n", state->tls_sni); -/* This is the priority string support, -http://www.gnutls.org/manual/html_node/Priority-Strings.html -and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols. -This was backwards incompatible, but means Exim no longer needs to track -all algorithms and provide string forms for them. */ +if (!state->lib_state.pri_string) + { + const uschar * p = NULL; + const char * errpos; -want_default_priorities = TRUE; + /* This is the priority string support, + http://www.gnutls.org/manual/html_node/Priority-Strings.html + and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols. + This was backwards incompatible, but means Exim no longer needs to track + all algorithms and provide string forms for them. */ -if (state->tls_require_ciphers && *state->tls_require_ciphers) - { - if (!expand_check_tlsvar(tls_require_ciphers, errstr)) - return DEFER; - if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers) + if (state->tls_require_ciphers && *state->tls_require_ciphers) { - DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n", - state->exp_tls_require_ciphers); - - rc = gnutls_priority_init(&state->priority_cache, - CS state->exp_tls_require_ciphers, &errpos); - want_default_priorities = FALSE; - p = state->exp_tls_require_ciphers; + if (!Expand_check_tlsvar(tls_require_ciphers, errstr)) + return DEFER; + if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers) + { + p = state->exp_tls_require_ciphers; + DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n", p); + } } + + if ((rc = creds_load_pristring(state, p, &errpos))) + return tls_error_gnu(string_sprintf( + "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"", + p, errpos - CS p, errpos), + rc, host, errstr); } -if (want_default_priorities) +else { - DEBUG(D_tls) - debug_printf("GnuTLS using default session cipher/priority \"%s\"\n", - exim_default_gnutls_priority); - rc = gnutls_priority_init(&state->priority_cache, - exim_default_gnutls_priority, &errpos); - p = US exim_default_gnutls_priority; + DEBUG(D_tls) debug_printf("cipher list preloaded\n"); + state->exp_tls_require_ciphers = US state->tls_require_ciphers; } -exim_gnutls_err_check(rc, string_sprintf( - "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"", - p, errpos - CS p, errpos)); -rc = gnutls_priority_set(state->session, state->priority_cache); -exim_gnutls_err_check(rc, US"gnutls_priority_set"); +if ((rc = gnutls_priority_set(state->session, state->lib_state.pri_cache))) + return tls_error_gnu(US"gnutls_priority_set", rc, host, errstr); + +/* This also sets the server ticket expiration time to the same, and +the STEK rotation time to 3x. */ gnutls_db_set_cache_expiration(state->session, ssl_session_timeout); @@ -1438,6 +2065,25 @@ return OK; * Extract peer information * *************************************************/ +static const uschar * +cipher_stdname_kcm(gnutls_kx_algorithm_t kx, gnutls_cipher_algorithm_t cipher, + gnutls_mac_algorithm_t mac) +{ +uschar cs_id[2]; +gnutls_kx_algorithm_t kx_i; +gnutls_cipher_algorithm_t cipher_i; +gnutls_mac_algorithm_t mac_i; + +for (size_t i = 0; + gnutls_cipher_suite_info(i, cs_id, &kx_i, &cipher_i, &mac_i, NULL); + i++) + if (kx_i == kx && cipher_i == cipher && mac_i == mac) + return cipher_stdname(cs_id[0], cs_id[1]); +return NULL; +} + + + /* Called from both server and client code. Only this is allowed to set state->peerdn and state->have_set_peerdn and we use that to detect double-calls. @@ -1464,10 +2110,10 @@ Returns: OK/DEFER/FAIL */ static int -peer_status(exim_gnutls_state_st *state, uschar ** errstr) +peer_status(exim_gnutls_state_st * state, uschar ** errstr) { -uschar cipherbuf[256]; -const gnutls_datum_t *cert_list; +gnutls_session_t session = state->session; +const gnutls_datum_t * cert_list; int old_pool, rc; unsigned int cert_list_size = 0; gnutls_protocol_t protocol; @@ -1476,56 +2122,103 @@ gnutls_kx_algorithm_t kx; gnutls_mac_algorithm_t mac; gnutls_certificate_type_t ct; gnutls_x509_crt_t crt; -uschar *p, *dn_buf; +uschar * dn_buf; size_t sz; -if (state->have_set_peerdn) - return OK; -state->have_set_peerdn = TRUE; +if (state->have_set_peerdn) + return OK; +state->have_set_peerdn = TRUE; + +state->peerdn = NULL; + +/* tls_cipher */ +cipher = gnutls_cipher_get(session); +protocol = gnutls_protocol_get_version(session); +mac = gnutls_mac_get(session); +kx = +#ifdef GNUTLS_TLS1_3 + protocol >= GNUTLS_TLS1_3 ? 0 : +#endif + gnutls_kx_get(session); + +old_pool = store_pool; + { + tls_support * tlsp = state->tlsp; + store_pool = POOL_PERM; + +#ifdef SUPPORT_GNUTLS_SESS_DESC + { + gstring * g = NULL; + uschar * s = US gnutls_session_get_desc(session), c; + + /* Nikos M suggests we use this by preference. It returns like: + (TLS1.3)-(ECDHE-SECP256R1)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM) -state->peerdn = NULL; + For partial back-compat, put a colon after the TLS version, replace the + )-( grouping with __, replace in-group - with _ and append the :keysize. */ -/* tls_cipher */ -cipher = gnutls_cipher_get(state->session); -protocol = gnutls_protocol_get_version(state->session); -mac = gnutls_mac_get(state->session); -kx = gnutls_kx_get(state->session); - -string_format(cipherbuf, sizeof(cipherbuf), - "%s:%s:%d", - gnutls_protocol_get_name(protocol), - gnutls_cipher_suite_get_name(kx, cipher, mac), - (int) gnutls_cipher_get_key_size(cipher) * 8); - -/* I don't see a way that spaces could occur, in the current GnuTLS -code base, but it was a concern in the old code and perhaps older GnuTLS -releases did return "TLS 1.0"; play it safe, just in case. */ -for (p = cipherbuf; *p != '\0'; ++p) - if (isspace(*p)) - *p = '-'; -old_pool = store_pool; -store_pool = POOL_PERM; -state->ciphersuite = string_copy(cipherbuf); + /* debug_printf("peer_status: gnutls_session_get_desc %s\n", s); */ + + for (s++; (c = *s) && c != ')'; s++) g = string_catn(g, s, 1); + + tlsp->ver = string_copyn(g->s, g->ptr); + for (uschar * p = US tlsp->ver; *p; p++) + if (*p == '-') { *p = '\0'; break; } /* TLS1.0-PKIX -> TLS1.0 */ + + g = string_catn(g, US":", 1); + if (*s) s++; /* now on _ between groups */ + while ((c = *s)) + { + for (*++s && ++s; (c = *s) && c != ')'; s++) + g = string_catn(g, c == '-' ? US"_" : s, 1); + /* now on ) closing group */ + if ((c = *s) && *++s == '-') g = string_catn(g, US"__", 2); + /* now on _ between groups */ + } + g = string_catn(g, US":", 1); + g = string_cat(g, string_sprintf("%d", (int) gnutls_cipher_get_key_size(cipher) * 8)); + state->ciphersuite = string_from_gstring(g); + } +#else + state->ciphersuite = string_sprintf("%s:%s:%d", + gnutls_protocol_get_name(protocol), + gnutls_cipher_suite_get_name(kx, cipher, mac), + (int) gnutls_cipher_get_key_size(cipher) * 8); + + /* I don't see a way that spaces could occur, in the current GnuTLS + code base, but it was a concern in the old code and perhaps older GnuTLS + releases did return "TLS 1.0"; play it safe, just in case. */ + + for (uschar * p = state->ciphersuite; *p; p++) if (isspace(*p)) *p = '-'; + tlsp->ver = string_copyn(state->ciphersuite, + Ustrchr(state->ciphersuite, ':') - state->ciphersuite); +#endif + +/* debug_printf("peer_status: ciphersuite %s\n", state->ciphersuite); */ + + tlsp->cipher = state->ciphersuite; + tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8; + + tlsp->cipher_stdname = cipher_stdname_kcm(kx, cipher, mac); + } store_pool = old_pool; -state->tlsp->cipher = state->ciphersuite; /* tls_peerdn */ -cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size); +cert_list = gnutls_certificate_get_peers(session, &cert_list_size); -if (cert_list == NULL || cert_list_size == 0) +if (!cert_list || cert_list_size == 0) { DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n", cert_list, cert_list_size); if (state->verify_requirement >= VERIFY_REQUIRED) return tls_error(US"certificate verification failed", - "no certificate received from peer", state->host, errstr); + US"no certificate received from peer", state->host, errstr); return OK; } -ct = gnutls_certificate_type_get(state->session); -if (ct != GNUTLS_CRT_X509) +if ((ct = gnutls_certificate_type_get(session)) != GNUTLS_CRT_X509) { - const char *ctn = gnutls_certificate_type_get_name(ct); + const uschar * ctn = US gnutls_certificate_type_get_name(ct); DEBUG(D_tls) debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn); if (state->verify_requirement >= VERIFY_REQUIRED) @@ -1541,7 +2234,7 @@ if (ct != GNUTLS_CRT_X509) DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \ (Label), gnutls_strerror(rc)); \ if (state->verify_requirement >= VERIFY_REQUIRED) \ - return tls_error((Label), gnutls_strerror(rc), state->host, errstr); \ + return tls_error_gnu((Label), rc, state->host, errstr); \ return OK; \ } \ } while (0) @@ -1558,7 +2251,7 @@ if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER) exim_gnutls_peer_err(US"getting size for cert DN failed"); return FAIL; /* should not happen */ } -dn_buf = store_get_perm(sz); +dn_buf = store_get_perm(sz, TRUE); /* tainted */ rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz); exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]"); @@ -1595,12 +2288,14 @@ verify_certificate(exim_gnutls_state_st * state, uschar ** errstr) int rc; uint verify; +DEBUG(D_tls) debug_printf("TLS: checking peer certificate\n"); +*errstr = NULL; +rc = peer_status(state, errstr); + if (state->verify_requirement == VERIFY_NONE) return TRUE; -*errstr = NULL; - -if ((rc = peer_status(state, errstr)) != OK) +if (rc != OK || !state->peerdn) { verify = GNUTLS_CERT_INVALID; *errstr = US"certificate not supplied"; @@ -1633,11 +2328,11 @@ else const char ** dd; int * ddl; - for(nrec = 0; state->dane_data_len[nrec]; ) nrec++; + for (nrec = 0; state->dane_data_len[nrec]; ) nrec++; nrec++; - dd = store_get(nrec * sizeof(uschar *)); - ddl = store_get(nrec * sizeof(int)); + dd = store_get(nrec * sizeof(uschar *), FALSE); + ddl = store_get(nrec * sizeof(int), FALSE); nrec--; if ((rc = dane_state_init(&s, 0))) @@ -1742,8 +2437,24 @@ if (rc < 0 || verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED)) { state->peer_cert_verified = FALSE; if (!*errstr) + { +#ifdef GNUTLS_CERT_VFY_STATUS_PRINT + DEBUG(D_tls) + { + gnutls_datum_t txt; + + if (gnutls_certificate_verification_status_print(verify, + gnutls_certificate_type_get(state->session), &txt, 0) + == GNUTLS_E_SUCCESS) + { + debug_printf("%s\n", txt.data); + gnutls_free(txt.data); + } + } +#endif *errstr = verify & GNUTLS_CERT_REVOKED ? US"certificate revoked" : US"certificate invalid"; + } DEBUG(D_tls) debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n", @@ -1849,13 +2560,12 @@ uschar * dummy_errstr; rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0); if (rc != GNUTLS_E_SUCCESS) { - DEBUG(D_tls) { + DEBUG(D_tls) if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) - debug_printf("TLS: no SNI presented in handshake.\n"); + debug_printf("TLS: no SNI presented in handshake\n"); else debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n", gnutls_strerror(rc), rc); - } return 0; } @@ -1868,7 +2578,7 @@ if (sni_type != GNUTLS_NAME_DNS) /* We now have a UTF-8 string in sni_name */ old_pool = store_pool; store_pool = POOL_PERM; -state->received_sni = string_copyn(US sni_name, data_len); +state->received_sni = string_copy_taint(US sni_name, TRUE); store_pool = old_pool; /* We set this one now so that variable expansions below will work */ @@ -1895,30 +2605,6 @@ return 0; -#ifndef DISABLE_OCSP - -static int -server_ocsp_stapling_cb(gnutls_session_t session, void * ptr, - gnutls_datum_t * ocsp_response) -{ -int ret; -DEBUG(D_tls) debug_printf("OCSP stapling callback: %s\n", US ptr); - -if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0) - { - DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n", - CS ptr); - tls_in.ocsp = OCSP_NOT_RESP; - return GNUTLS_E_NO_CERTIFICATE_STATUS; - } - -tls_in.ocsp = OCSP_VFY_NOT_TRIED; -return 0; -} - -#endif - - #ifndef DISABLE_EVENT /* We use this callback to get observability and detail-level control @@ -1967,7 +2653,111 @@ return 0; #endif +static gstring * +ddump(gnutls_datum_t * d) +{ +gstring * g = string_get((d->size+1) * 2); +uschar * s = d->data; +for (unsigned i = d->size; i > 0; i--, s++) + { + g = string_catn(g, US "0123456789abcdef" + (*s >> 4), 1); + g = string_catn(g, US "0123456789abcdef" + (*s & 0xf), 1); + } +return g; +} + +static void +post_handshake_debug(exim_gnutls_state_st * state) +{ +#ifdef SUPPORT_GNUTLS_SESS_DESC +debug_printf("%s\n", gnutls_session_get_desc(state->session)); +#endif + +#ifdef SUPPORT_GNUTLS_KEYLOG +# ifdef EXIM_HAVE_TLS1_3 +if (gnutls_protocol_get_version(state->session) < GNUTLS_TLS1_3) +# else +if (TRUE) +# endif + { + gnutls_datum_t c, s; + gstring * gc, * gs; + /* For TLS1.2 we only want the client random and the master secret */ + gnutls_session_get_random(state->session, &c, &s); + gnutls_session_get_master_secret(state->session, &s); + gc = ddump(&c); + gs = ddump(&s); + debug_printf("CLIENT_RANDOM %.*s %.*s\n", (int)gc->ptr, gc->s, (int)gs->ptr, gs->s); + } +else + debug_printf("To get keying info for TLS1.3 is hard:\n" + " Set environment variable SSLKEYLOGFILE to a filename relative to the spool directory,\n" + " and make sure it is writable by the Exim runtime user.\n" + " Add SSLKEYLOGFILE to keep_environment in the exim config.\n" + " Start Exim as root.\n" + " If using sudo, add SSLKEYLOGFILE to env_keep in /etc/sudoers\n" + " (works for TLS1.2 also, and saves cut-paste into file).\n" + " Trying to use add_environment for this will not work\n"); +#endif +} + + +#ifdef EXIM_HAVE_TLS_RESUME +static int +tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when, + unsigned incoming, const gnutls_datum_t * msg) +{ +DEBUG(D_tls) debug_printf("newticket cb\n"); +tls_in.resumption |= RESUME_CLIENT_REQUESTED; +return 0; +} + +static void +tls_server_resume_prehandshake(exim_gnutls_state_st * state) +{ +/* Should the server offer session resumption? */ +tls_in.resumption = RESUME_SUPPORTED; +if (verify_check_host(&tls_resumption_hosts) == OK) + { + int rc; + /* GnuTLS appears to not do ticket overlap, but does emit a fresh ticket when + an offered resumption is unacceptable. We lose one resumption per ticket + lifetime, and sessions cannot be indefinitely re-used. There seems to be no + way (3.6.7) of changing the default number of 2 TLS1.3 tickets issued, but at + least they go out in a single packet. */ + + if (!(rc = gnutls_session_ticket_enable_server(state->session, + &server_sessticket_key))) + tls_in.resumption |= RESUME_SERVER_TICKET; + else + DEBUG(D_tls) + debug_printf("enabling session tickets: %s\n", US gnutls_strerror(rc)); + + /* Try to tell if we see a ticket request */ + gnutls_handshake_set_hook_function(state->session, + GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb); + } +} + +static void +tls_server_resume_posthandshake(exim_gnutls_state_st * state) +{ +if (gnutls_session_resumption_requested(state->session)) + { + /* This tells us the client sent a full ticket. We use a + callback on session-ticket request, elsewhere, to tell + if a client asked for a ticket. */ + tls_in.resumption |= RESUME_CLIENT_SUGGESTED; + DEBUG(D_tls) debug_printf("client requested resumption\n"); + } +if (gnutls_session_is_resumed(state->session)) + { + tls_in.resumption |= RESUME_USED; + DEBUG(D_tls) debug_printf("Session resumed\n"); + } +} +#endif /* ------------------------------------------------------------------------ */ /* Exported functions */ @@ -1983,7 +2773,6 @@ the STARTTLS command. It must respond to that command, and then negotiate a TLS session. Arguments: - require_ciphers list of allowed ciphers or NULL errstr pointer to error string Returns: OK on success @@ -1993,7 +2782,7 @@ Returns: OK on success */ int -tls_server_start(const uschar * require_ciphers, uschar ** errstr) +tls_server_start(uschar ** errstr) { int rc; exim_gnutls_state_st * state = NULL; @@ -2001,7 +2790,7 @@ exim_gnutls_state_st * state = NULL; /* Check for previous activation */ if (tls_in.active.sock >= 0) { - tls_error(US"STARTTLS received after TLS started", "", NULL, errstr); + tls_error(US"STARTTLS received after TLS started", US "", NULL, errstr); smtp_printf("554 Already in TLS\r\n", FALSE); return FAIL; } @@ -2011,9 +2800,23 @@ and sent an SMTP response. */ DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n"); -if ((rc = tls_init(NULL, tls_certificate, tls_privatekey, - NULL, tls_verify_certificates, tls_crl, - require_ciphers, &state, &tls_in, errstr)) != OK) return rc; + { +#ifdef MEASURE_TIMING + struct timeval t0; + gettimeofday(&t0, NULL); +#endif + + if ((rc = tls_init(NULL, NULL, + tls_require_ciphers, &state, &tls_in, errstr)) != OK) return rc; + +#ifdef MEASURE_TIMING + report_time_since(&t0, US"server tls_init (delta)"); +#endif + } + +#ifdef EXIM_HAVE_TLS_RESUME +tls_server_resume_prehandshake(state); +#endif /* If this is a host for which certificate verification is mandatory or optional, set up appropriately. */ @@ -2021,21 +2824,21 @@ optional, set up appropriately. */ if (verify_check_host(&tls_verify_hosts) == OK) { DEBUG(D_tls) - debug_printf("TLS: a client certificate will be required.\n"); + debug_printf("TLS: a client certificate will be required\n"); state->verify_requirement = VERIFY_REQUIRED; gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE); } else if (verify_check_host(&tls_try_verify_hosts) == OK) { DEBUG(D_tls) - debug_printf("TLS: a client certificate will be requested but not required.\n"); + debug_printf("TLS: a client certificate will be requested but not required\n"); state->verify_requirement = VERIFY_OPTIONAL; gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST); } else { DEBUG(D_tls) - debug_printf("TLS: a client certificate will not be requested.\n"); + debug_printf("TLS: a client certificate will not be requested\n"); state->verify_requirement = VERIFY_NONE; gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE); } @@ -2045,7 +2848,7 @@ if (event_action) { state->event_action = event_action; gnutls_session_set_ptr(state->session, state); - gnutls_certificate_set_verify_function(state->x509_cred, verify_cb); + gnutls_certificate_set_verify_function(state->lib_state.x509_cred, verify_cb); } #endif @@ -2068,7 +2871,10 @@ if (!state->tlsp->on_connect) } /* Now negotiate the TLS session. We put our own timer on it, since it seems -that the GnuTLS library doesn't. */ +that the GnuTLS library doesn't. +From 3.1.0 there is gnutls_handshake_set_timeout() - but it requires you +to set (and clear down afterwards) up a pull-timeout callback function that does +a select, so we're no better off unless avoiding signals becomes an issue. */ gnutls_transport_set_ptr2(state->session, (gnutls_transport_ptr_t)(long) fileno(smtp_in), @@ -2077,11 +2883,11 @@ state->fd_in = fileno(smtp_in); state->fd_out = fileno(smtp_out); sigalrm_seen = FALSE; -if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout); +if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout); do rc = gnutls_handshake(state->session); while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen); -alarm(0); +ALARM_CLR(0); if (rc != GNUTLS_E_SUCCESS) { @@ -2091,18 +2897,19 @@ if (rc != GNUTLS_E_SUCCESS) if (sigalrm_seen) { - tls_error(US"gnutls_handshake", "timed out", NULL, errstr); + tls_error(US"gnutls_handshake", US"timed out", NULL, errstr); gnutls_db_remove_session(state->session); } else { - tls_error(US"gnutls_handshake", gnutls_strerror(rc), NULL, errstr); + tls_error_gnu(US"gnutls_handshake", rc, NULL, errstr); (void) gnutls_alert_send_appropriate(state->session, rc); gnutls_deinit(state->session); - gnutls_certificate_free_credentials(state->x509_cred); + gnutls_certificate_free_credentials(state->lib_state.x509_cred); + state->lib_state = null_tls_preload; millisleep(500); shutdown(state->fd_out, SHUT_WR); - for (rc = 1024; fgetc(smtp_in) != EOF && rc > 0; ) rc--; /* drain skt */ + for (int i = 1024; fgetc(smtp_in) != EOF && i > 0; ) i--; /* drain skt */ (void)fclose(smtp_out); (void)fclose(smtp_in); smtp_out = smtp_in = NULL; @@ -2111,7 +2918,16 @@ if (rc != GNUTLS_E_SUCCESS) return FAIL; } -DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n"); +#ifdef GNUTLS_SFLAGS_EXT_MASTER_SECRET +if (gnutls_session_get_flags(state->session) & GNUTLS_SFLAGS_EXT_MASTER_SECRET) + tls_in.ext_master_secret = TRUE; +#endif + +#ifdef EXIM_HAVE_TLS_RESUME +tls_server_resume_posthandshake(state); +#endif + +DEBUG(D_tls) post_handshake_debug(state); /* Verify after the fact */ @@ -2127,10 +2943,6 @@ if (!verify_certificate(state, errstr)) *errstr); } -/* Figure out peer DN, and if authenticated, etc. */ - -if ((rc = peer_status(state, NULL)) != OK) return rc; - /* Sets various Exim expansion variables; always safe within server */ extract_exim_vars_from_tls_state(state); @@ -2162,12 +2974,12 @@ if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK) { state->exp_tls_verify_cert_hostnames = #ifdef SUPPORT_I18N - string_domain_utf8_to_alabel(host->name, NULL); + string_domain_utf8_to_alabel(host->certname, NULL); #else - host->name; + host->certname; #endif DEBUG(D_tls) - debug_printf("TLS: server cert verification includes hostname: \"%s\".\n", + debug_printf("TLS: server cert verification includes hostname: \"%s\"\n", state->exp_tls_verify_cert_hostnames); } } @@ -2186,26 +2998,26 @@ after verification is done.*/ static BOOL dane_tlsa_load(exim_gnutls_state_st * state, dns_answer * dnsa) { -dns_record * rr; dns_scan dnss; int i; const char ** dane_data; int * dane_data_len; -for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS), i = 1; - rr; +i = 1; +for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT) ) if (rr->type == T_TLSA) i++; -dane_data = store_get(i * sizeof(uschar *)); -dane_data_len = store_get(i * sizeof(int)); +dane_data = store_get(i * sizeof(uschar *), FALSE); +dane_data_len = store_get(i * sizeof(int), FALSE); -for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS), i = 0; - rr; +i = 0; +for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT) - ) if (rr->type == T_TLSA) + ) if (rr->type == T_TLSA && rr->size > 3) { const uschar * p = rr->data; +/*XXX need somehow to mark rr and its data as tainted. Doues this mean copying it? */ uint8_t usage = p[0], sel = p[1], type = p[2]; DEBUG(D_tls) @@ -2227,7 +3039,7 @@ for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS), i = 0; } tls_out.tlsa_usage |= 1<size; } @@ -2244,6 +3056,142 @@ return TRUE; +#ifdef EXIM_HAVE_TLS_RESUME +/* On the client, get any stashed session for the given IP from hints db +and apply it to the ssl-connection for attempted resumption. Although +there is a gnutls_session_ticket_enable_client() interface it is +documented as unnecessary (as of 3.6.7) as "session tickets are emabled +by deafult". There seems to be no way to disable them, so even hosts not +enabled by the transport option will be sent a ticket request. We will +however avoid storing and retrieving session information. */ + +static void +tls_retrieve_session(tls_support * tlsp, gnutls_session_t session, + host_item * host, smtp_transport_options_block * ob) +{ +tlsp->resumption = RESUME_SUPPORTED; +if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK) + { + dbdata_tls_session * dt; + int len, rc; + open_db dbblock, * dbm_file; + + DEBUG(D_tls) + debug_printf("check for resumable session for %s\n", host->address); + tlsp->host_resumable = TRUE; + tlsp->resumption |= RESUME_CLIENT_REQUESTED; + if ((dbm_file = dbfn_open(US"tls", O_RDONLY, &dbblock, FALSE, FALSE))) + { + /* Key for the db is the IP. We'd like to filter the retrieved session + for ticket advisory expiry, but 3.6.1 seems to give no access to that */ + + if ((dt = dbfn_read_with_length(dbm_file, host->address, &len))) + if (!(rc = gnutls_session_set_data(session, + CUS dt->session, (size_t)len - sizeof(dbdata_tls_session)))) + { + DEBUG(D_tls) debug_printf("good session\n"); + tlsp->resumption |= RESUME_CLIENT_SUGGESTED; + } + else DEBUG(D_tls) debug_printf("setting session resumption data: %s\n", + US gnutls_strerror(rc)); + dbfn_close(dbm_file); + } + } +} + + +static void +tls_save_session(tls_support * tlsp, gnutls_session_t session, const host_item * host) +{ +/* TLS 1.2 - we get both the callback and the direct posthandshake call, +but this flag is not set until the second. TLS 1.3 it's the other way about. +Keep both calls as the session data cannot be extracted before handshake +completes. */ + +if (gnutls_session_get_flags(session) & GNUTLS_SFLAGS_SESSION_TICKET) + { + gnutls_datum_t tkt; + int rc; + + DEBUG(D_tls) debug_printf("server offered session ticket\n"); + tlsp->ticket_received = TRUE; + tlsp->resumption |= RESUME_SERVER_TICKET; + + if (tlsp->host_resumable) + if (!(rc = gnutls_session_get_data2(session, &tkt))) + { + open_db dbblock, * dbm_file; + int dlen = sizeof(dbdata_tls_session) + tkt.size; + dbdata_tls_session * dt = store_get(dlen, TRUE); + + DEBUG(D_tls) debug_printf("session data size %u\n", (unsigned)tkt.size); + memcpy(dt->session, tkt.data, tkt.size); + gnutls_free(tkt.data); + + if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE))) + { + /* key for the db is the IP */ + dbfn_delete(dbm_file, host->address); + dbfn_write(dbm_file, host->address, dt, dlen); + dbfn_close(dbm_file); + + DEBUG(D_tls) + debug_printf("wrote session db (len %u)\n", (unsigned)dlen); + } + } + else DEBUG(D_tls) + debug_printf("extract session data: %s\n", US gnutls_strerror(rc)); + } +} + + +/* With a TLS1.3 session, the ticket(s) are not seen until +the first data read is attempted. And there's often two of them. +Pick them up with this callback. We are also called for 1.2 +but we do nothing. +*/ +static int +tls_client_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when, + unsigned incoming, const gnutls_datum_t * msg) +{ +exim_gnutls_state_st * state = gnutls_session_get_ptr(sess); +tls_support * tlsp = state->tlsp; + +DEBUG(D_tls) debug_printf("newticket cb\n"); + +if (!tlsp->ticket_received) + tls_save_session(tlsp, sess, state->host); +return 0; +} + + +static void +tls_client_resume_prehandshake(exim_gnutls_state_st * state, + tls_support * tlsp, host_item * host, + smtp_transport_options_block * ob) +{ +gnutls_session_set_ptr(state->session, state); +gnutls_handshake_set_hook_function(state->session, + GNUTLS_HANDSHAKE_NEW_SESSION_TICKET, GNUTLS_HOOK_POST, tls_client_ticket_cb); + +tls_retrieve_session(tlsp, state->session, host, ob); +} + +static void +tls_client_resume_posthandshake(exim_gnutls_state_st * state, + tls_support * tlsp, host_item * host) +{ +if (gnutls_session_is_resumed(state->session)) + { + DEBUG(D_tls) debug_printf("Session resumed\n"); + tlsp->resumption |= RESUME_USED; + } + +tls_save_session(tlsp, state->session, host); +} +#endif /* !DISABLE_TLS_RESUME */ + + /************************************************* * Start a TLS session in a client * *************************************************/ @@ -2251,36 +3199,29 @@ return TRUE; /* Called from the smtp transport after STARTTLS has been accepted. Arguments: - fd the fd of the connection - host connected host (for messages and option-tests) - addr the first address (not used) - tb transport (always smtp) - tlsa_dnsa non-NULL, either request or require dane for this host, and - a TLSA record found. Therefore, dane verify required. - Which implies cert must be requested and supplied, dane - verify must pass, and cert verify irrelevant (incl. - hostnames), and (caller handled) require_tls - tlsp record details of channel configuration - errstr error string pointer - -Returns: Pointer to TLS session context, or NULL on error + cctx connection context + conn_args connection details + cookie datum for randomness (not used) + tlsp record details of channel configuration here; must be non-NULL + errstr error string pointer + +Returns: TRUE for success with TLS session context set in smtp context, + FALSE on error */ -void * -tls_client_start(int fd, host_item *host, - address_item *addr ARG_UNUSED, - transport_instance * tb, -#ifdef SUPPORT_DANE - dns_answer * tlsa_dnsa, -#endif - tls_support * tlsp, uschar ** errstr) +BOOL +tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args, + void * cookie ARG_UNUSED, + tls_support * tlsp, uschar ** errstr) { -smtp_transport_options_block *ob = tb +host_item * host = conn_args->host; /* for msgs and option-tests */ +transport_instance * tb = conn_args->tblock; /* always smtp or NULL */ +smtp_transport_options_block * ob = tb ? (smtp_transport_options_block *)tb->options_block : &smtp_transport_option_defaults; int rc; exim_gnutls_state_st * state = NULL; -uschar *cipher_list = NULL; +uschar * cipher_list = NULL; #ifndef DISABLE_OCSP BOOL require_ocsp = @@ -2289,15 +3230,20 @@ BOOL request_ocsp = require_ocsp ? TRUE : verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK; #endif -DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd); +DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", cctx->sock); #ifdef SUPPORT_DANE -if (tlsa_dnsa && ob->dane_require_tls_ciphers) +/* If dane is flagged, have either request or require dane for this host, and +a TLSA record found. Therefore, dane verify required. Which implies cert must +be requested and supplied, dane verify must pass, and cert verify irrelevant +(incl. hostnames), and (caller handled) require_tls and sni=$domain */ + +if (conn_args->dane && ob->dane_require_tls_ciphers) { - /* not using expand_check_tlsvar because not yet in state */ + /* not using Expand_check_tlsvar because not yet in state */ if (!expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers", &cipher_list, errstr)) - return NULL; + return FALSE; cipher_list = cipher_list && *cipher_list ? ob->dane_require_tls_ciphers : ob->tls_require_ciphers; } @@ -2306,10 +3252,19 @@ if (tlsa_dnsa && ob->dane_require_tls_ciphers) if (!cipher_list) cipher_list = ob->tls_require_ciphers; -if (tls_init(host, ob->tls_certificate, ob->tls_privatekey, - ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl, - cipher_list, &state, tlsp, errstr) != OK) - return NULL; + { +#ifdef MEASURE_TIMING + struct timeval t0; + gettimeofday(&t0, NULL); +#endif + + if (tls_init(host, ob, cipher_list, &state, tlsp, errstr) != OK) + return FALSE; + +#ifdef MEASURE_TIMING + report_time_since(&t0, US"client tls_init (delta)"); +#endif + } { int dh_min_bits = ob->tls_dh_min_bits; @@ -2333,10 +3288,10 @@ set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only the specified host patterns if one of them is defined */ #ifdef SUPPORT_DANE -if (tlsa_dnsa && dane_tlsa_load(state, tlsa_dnsa)) +if (conn_args->dane && dane_tlsa_load(state, &conn_args->tlsa_dnsa)) { DEBUG(D_tls) - debug_printf("TLS: server certificate DANE required.\n"); + debug_printf("TLS: server certificate DANE required\n"); state->verify_requirement = VERIFY_DANE; gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE); } @@ -2351,7 +3306,7 @@ else { tls_client_setup_hostname_checks(host, state, ob); DEBUG(D_tls) - debug_printf("TLS: server certificate verification required.\n"); + debug_printf("TLS: server certificate verification required\n"); state->verify_requirement = VERIFY_REQUIRED; gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE); } @@ -2359,14 +3314,14 @@ else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK) { tls_client_setup_hostname_checks(host, state, ob); DEBUG(D_tls) - debug_printf("TLS: server certificate verification optional.\n"); + debug_printf("TLS: server certificate verification optional\n"); state->verify_requirement = VERIFY_OPTIONAL; gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST); } else { DEBUG(D_tls) - debug_printf("TLS: server certificate verification not required.\n"); + debug_printf("TLS: server certificate verification not required\n"); state->verify_requirement = VERIFY_NONE; gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE); } @@ -2379,100 +3334,123 @@ if (request_ocsp) if ((rc = gnutls_ocsp_status_request_enable_client(state->session, NULL, 0, NULL)) != OK) { - tls_error(US"cert-status-req", gnutls_strerror(rc), state->host, errstr); - return NULL; + tls_error_gnu(US"cert-status-req", rc, state->host, errstr); + return FALSE; } tlsp->ocsp = OCSP_NOT_RESP; } #endif +#ifdef EXIM_HAVE_TLS_RESUME +tls_client_resume_prehandshake(state, tlsp, host, ob); +#endif + #ifndef DISABLE_EVENT if (tb && tb->event_action) { state->event_action = tb->event_action; gnutls_session_set_ptr(state->session, state); - gnutls_certificate_set_verify_function(state->x509_cred, verify_cb); + gnutls_certificate_set_verify_function(state->lib_state.x509_cred, verify_cb); } #endif -gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) fd); -state->fd_in = fd; -state->fd_out = fd; +gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) cctx->sock); +state->fd_in = cctx->sock; +state->fd_out = cctx->sock; DEBUG(D_tls) debug_printf("about to gnutls_handshake\n"); /* There doesn't seem to be a built-in timeout on connection. */ sigalrm_seen = FALSE; -alarm(ob->command_timeout); +ALARM(ob->command_timeout); do rc = gnutls_handshake(state->session); while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen); -alarm(0); +ALARM_CLR(0); if (rc != GNUTLS_E_SUCCESS) { if (sigalrm_seen) { gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED); - tls_error(US"gnutls_handshake", "timed out", state->host, errstr); + tls_error(US"gnutls_handshake", US"timed out", state->host, errstr); } else - tls_error(US"gnutls_handshake", gnutls_strerror(rc), state->host, errstr); - return NULL; + tls_error_gnu(US"gnutls_handshake", rc, state->host, errstr); + return FALSE; } -DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n"); +DEBUG(D_tls) post_handshake_debug(state); /* Verify late */ if (!verify_certificate(state, errstr)) { tls_error(US"certificate verification failed", *errstr, state->host, errstr); - return NULL; + return FALSE; } +#ifdef GNUTLS_SFLAGS_EXT_MASTER_SECRET +if (gnutls_session_get_flags(state->session) & GNUTLS_SFLAGS_EXT_MASTER_SECRET) + tlsp->ext_master_secret = TRUE; +#endif + #ifndef DISABLE_OCSP -if (require_ocsp) +if (request_ocsp) { DEBUG(D_tls) { gnutls_datum_t stapling; gnutls_ocsp_resp_t resp; gnutls_datum_t printed; - if ( (rc= gnutls_ocsp_status_request_get(state->session, &stapling)) == 0 - && (rc= gnutls_ocsp_resp_init(&resp)) == 0 - && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0 - && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_FULL, &printed)) == 0 - ) - { - debug_printf("%.4096s", printed.data); - gnutls_free(printed.data); - } - else - (void) tls_error(US"ocsp decode", gnutls_strerror(rc), state->host, errstr); + unsigned idx = 0; + + for (; +# ifdef GNUTLS_OCSP_STATUS_REQUEST_GET2 + (rc = gnutls_ocsp_status_request_get2(state->session, idx, &stapling)) == 0; +#else + (rc = gnutls_ocsp_status_request_get(state->session, &stapling)) == 0; +#endif + idx++) + if ( (rc= gnutls_ocsp_resp_init(&resp)) == 0 + && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0 + && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_COMPACT, &printed)) == 0 + ) + { + debug_printf("%.4096s", printed.data); + gnutls_free(printed.data); + } + else + (void) tls_error_gnu(US"ocsp decode", rc, state->host, errstr); + if (idx == 0 && rc) + (void) tls_error_gnu(US"ocsp decode", rc, state->host, errstr); } if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0) { tlsp->ocsp = OCSP_FAILED; tls_error(US"certificate status check failed", NULL, state->host, errstr); - return NULL; + if (require_ocsp) + return FALSE; + } + else + { + DEBUG(D_tls) debug_printf("Passed OCSP checking\n"); + tlsp->ocsp = OCSP_VFIED; } - DEBUG(D_tls) debug_printf("Passed OCSP checking\n"); - tlsp->ocsp = OCSP_VFIED; } #endif -/* Figure out peer DN, and if authenticated, etc. */ - -if (peer_status(state, errstr) != OK) - return NULL; +#ifdef EXIM_HAVE_TLS_RESUME +tls_client_resume_posthandshake(state, tlsp, host); +#endif /* Sets various Exim expansion variables; may need to adjust for ACL callouts */ extract_exim_vars_from_tls_state(state); -return state; +cctx->tls_ctx = state; +return TRUE; } @@ -2498,27 +3476,42 @@ void tls_close(void * ct_ctx, int shutdown) { exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server; +tls_support * tlsp = state->tlsp; -if (!state->tlsp || state->tlsp->active.sock < 0) return; /* TLS was not active */ +if (!tlsp || tlsp->active.sock < 0) return; /* TLS was not active */ if (shutdown) { DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n", shutdown > 1 ? " (with response-wait)" : ""); - alarm(2); + ALARM(2); gnutls_bye(state->session, shutdown > 1 ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR); - alarm(0); + ALARM_CLR(0); + } + +if (!ct_ctx) /* server */ + { + receive_getc = smtp_getc; + receive_getbuf = smtp_getbuf; + receive_get_cache = smtp_get_cache; + receive_ungetc = smtp_ungetc; + receive_feof = smtp_feof; + receive_ferror = smtp_ferror; + receive_smtp_buffered = smtp_buffered; } gnutls_deinit(state->session); -gnutls_certificate_free_credentials(state->x509_cred); +gnutls_certificate_free_credentials(state->lib_state.x509_cred); +state->lib_state = null_tls_preload; + +tlsp->active.sock = -1; +tlsp->active.tls_ctx = NULL; +/* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */ +tlsp->channelbinding = NULL; -state->tlsp->active.sock = -1; -state->tlsp->active.tls_ctx = NULL; if (state->xfer_buffer) store_free(state->xfer_buffer); -memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init)); } @@ -2530,14 +3523,19 @@ tls_refill(unsigned lim) exim_gnutls_state_st * state = &state_server; ssize_t inbytes; -DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n", +DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(session=%p, buffer=%p, buffersize=%u)\n", state->session, state->xfer_buffer, ssl_xfer_buffer_size); sigalrm_seen = FALSE; -if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout); -inbytes = gnutls_record_recv(state->session, state->xfer_buffer, - MIN(ssl_xfer_buffer_size, lim)); -if (smtp_receive_timeout > 0) alarm(0); +if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout); + +errno = 0; +do + inbytes = gnutls_record_recv(state->session, state->xfer_buffer, + MIN(ssl_xfer_buffer_size, lim)); +while (inbytes == GNUTLS_E_AGAIN); + +if (smtp_receive_timeout > 0) ALARM_CLR(0); if (had_command_timeout) /* set by signal handler */ smtp_command_timeout_exit(); /* does not return */ @@ -2562,28 +3560,7 @@ if (sigalrm_seen) else if (inbytes == 0) { DEBUG(D_tls) debug_printf("Got TLS_EOF\n"); - - receive_getc = smtp_getc; - receive_getbuf = smtp_getbuf; - receive_get_cache = smtp_get_cache; - receive_ungetc = smtp_ungetc; - receive_feof = smtp_feof; - receive_ferror = smtp_ferror; - receive_smtp_buffered = smtp_buffered; - - gnutls_deinit(state->session); - gnutls_certificate_free_credentials(state->x509_cred); - - state->session = NULL; - state->tlsp->active.sock = -1; - state->tlsp->active.tls_ctx = NULL; - state->tlsp->bits = 0; - state->tlsp->certificate_verified = FALSE; - tls_channelbinding_b64 = NULL; - state->tlsp->cipher = NULL; - state->tlsp->peercert = NULL; - state->tlsp->peerdn = NULL; - + tls_close(NULL, TLS_NO_SHUTDOWN); return FALSE; } @@ -2591,7 +3568,7 @@ else if (inbytes == 0) else if (inbytes < 0) { -debug_printf("%s: err from gnutls_record_recv(\n", __FUNCTION__); + DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__); record_io_error(state, (int) inbytes, US"recv", NULL); state->xfer_error = TRUE; return FALSE; @@ -2614,7 +3591,7 @@ Only used by the server-side TLS. This feeds DKIM and should be used for all message-body reads. -Arguments: lim Maximum amount to read/bufffer +Arguments: lim Maximum amount to read/buffer Returns: the next character or EOF */ @@ -2710,20 +3687,24 @@ if (state->xfer_buffer_lwm < state->xfer_buffer_hwm) state->xfer_buffer_hwm - state->xfer_buffer_lwm); DEBUG(D_tls) - debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n", + debug_printf("Calling gnutls_record_recv(session=%p, buffer=%p, len=" SIZE_T_FMT ")\n", state->session, buff, len); -inbytes = gnutls_record_recv(state->session, buff, len); +errno = 0; +do + inbytes = gnutls_record_recv(state->session, buff, len); +while (inbytes == GNUTLS_E_AGAIN); + if (inbytes > 0) return inbytes; if (inbytes == 0) { DEBUG(D_tls) debug_printf("Got TLS_EOF\n"); } else -{ -debug_printf("%s: err from gnutls_record_recv(\n", __FUNCTION__); -record_io_error(state, (int)inbytes, US"recv", NULL); -} + { + DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__); + record_io_error(state, (int)inbytes, US"recv", NULL); + } return -1; } @@ -2742,6 +3723,9 @@ Arguments: len number of bytes more more data expected soon +Calling with len zero and more unset will flush buffered writes. The buff +argument can be null for that case. + Returns: the number of bytes after a successful write, -1 after a failed write */ @@ -2752,10 +3736,14 @@ tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more) ssize_t outbytes; size_t left = len; exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server; -#ifdef SUPPORT_CORK -static BOOL corked = FALSE; -if (more && !corked) gnutls_record_cork(state->session); +#ifdef SUPPORT_CORK +if (more && !state->corked) + { + DEBUG(D_tls) debug_printf("gnutls_record_cork(session=%p)\n", state->session); + gnutls_record_cork(state->session); + state->corked = TRUE; + } #endif DEBUG(D_tls) debug_printf("%s(%p, " SIZE_T_FMT "%s)\n", __FUNCTION__, @@ -2763,15 +3751,36 @@ DEBUG(D_tls) debug_printf("%s(%p, " SIZE_T_FMT "%s)\n", __FUNCTION__, while (left > 0) { - DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n", - buff, left); - outbytes = gnutls_record_send(state->session, buff, left); + DEBUG(D_tls) debug_printf("gnutls_record_send(session=%p, buffer=%p, left=" SIZE_T_FMT ")\n", + state->session, buff, left); + + errno = 0; + do + outbytes = gnutls_record_send(state->session, buff, left); + while (outbytes == GNUTLS_E_AGAIN); DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes); + if (outbytes < 0) { -debug_printf("%s: err from gnutls_record_send(\n", __FUNCTION__); - record_io_error(state, outbytes, US"send", NULL); +#ifdef GNUTLS_E_PREMATURE_TERMINATION + if ( outbytes == GNUTLS_E_PREMATURE_TERMINATION && errno == ECONNRESET + && !ct_ctx && f.smtp_in_quit + ) + { /* Outlook, dammit */ + if (LOGGING(protocol_detail)) + log_write(0, LOG_MAIN, "[%s] after QUIT, client reset TCP before" + " SMTP response and TLS close\n", sender_host_address); + else + DEBUG(D_tls) debug_printf("[%s] SSL_write: after QUIT," + " client reset TCP before TLS close\n", sender_host_address); + } + else +#endif + { + DEBUG(D_tls) debug_printf("%s: gnutls_record_send err\n", __FUNCTION__); + record_io_error(state, outbytes, US"send", NULL); + } return -1; } if (outbytes == 0) @@ -2793,10 +3802,25 @@ if (len > INT_MAX) } #ifdef SUPPORT_CORK -if (more != corked) - { - if (!more) (void) gnutls_record_uncork(state->session, 0); - corked = more; +if (!more && state->corked) + { + DEBUG(D_tls) debug_printf("gnutls_record_uncork(session=%p)\n", state->session); + do + /* We can't use GNUTLS_RECORD_WAIT here, as it retries on + GNUTLS_E_AGAIN || GNUTLS_E_INTR, which would break our timeout set by alarm(). + The GNUTLS_E_AGAIN should not happen ever, as our sockets are blocking anyway. + But who knows. (That all relies on the fact that GNUTLS_E_INTR and GNUTLS_E_AGAIN + match the EINTR and EAGAIN errno values.) */ + outbytes = gnutls_record_uncork(state->session, 0); + while (outbytes == GNUTLS_E_AGAIN); + + if (outbytes < 0) + { + record_io_error(state, len, US"uncork", NULL); + return -1; + } + + state->corked = FALSE; } #endif @@ -2827,7 +3851,6 @@ vaguely_random_number(int max) { unsigned int r; int i, needed_len; -uschar *p; uschar smallbuf[sizeof(r)]; if (max <= 1) @@ -2835,7 +3858,8 @@ if (max <= 1) needed_len = sizeof(r); /* Don't take 8 times more entropy than needed if int is 8 octets and we were - * asked for a number less than 10. */ +asked for a number less than 10. */ + for (r = max, i = 0; r; ++i) r >>= 1; i = (i + 7) / 8; @@ -2845,15 +3869,12 @@ if (i < needed_len) i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len); if (i < 0) { - DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n"); + DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback\n"); return vaguely_random_number_fallback(max); } r = 0; -for (p = smallbuf; needed_len; --needed_len, ++p) - { - r *= 256; - r += *p; - } +for (uschar * p = smallbuf; needed_len; --needed_len, ++p) + r = r * 256 + *p; /* We don't particularly care about weighted results; if someone wants * smooth distribution and cares enough then they should submit a patch then. */ @@ -2889,24 +3910,33 @@ gnutls_priority_t priority_cache; const char *errpos; uschar * dummy_errstr; -#define validate_check_rc(Label) do { \ +#ifdef GNUTLS_AUTO_GLOBAL_INIT +# define validate_check_rc(Label) do { \ + if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) \ + return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0) +# define return_deinit(Label) do { return (Label); } while (0) +#else +# define validate_check_rc(Label) do { \ if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \ - return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0) -#define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0) + return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0) +# define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0) +#endif if (exim_gnutls_base_init_done) log_write(0, LOG_MAIN|LOG_PANIC, "already initialised GnuTLS, Exim developer bug"); -#ifdef HAVE_GNUTLS_PKCS11 +#if defined(HAVE_GNUTLS_PKCS11) && !defined(GNUTLS_AUTO_PKCS11_MANUAL) if (!gnutls_allow_auto_pkcs11) { rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL); validate_check_rc(US"gnutls_pkcs11_init"); } #endif +#ifndef GNUTLS_AUTO_GLOBAL_INIT rc = gnutls_global_init(); validate_check_rc(US"gnutls_global_init()"); +#endif exim_gnutls_base_init_done = TRUE; if (!(tls_require_ciphers && *tls_require_ciphers)) @@ -2929,7 +3959,9 @@ validate_check_rc(string_sprintf( #undef return_deinit #undef validate_check_rc +#ifndef GNUTLS_AUTO_GLOBAL_INIT gnutls_global_deinit(); +#endif return NULL; } @@ -2956,6 +3988,7 @@ fprintf(f, "Library version: GnuTLS: Compile: %s\n" gnutls_check_version(NULL)); } +#endif /*!MACRO_PREDEF*/ /* vi: aw ai sw=2 */ /* End of tls-gnu.c */