X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/d7978c0f8af20ff4c3f770589b1bb81568aecff3..bd95ffc2ba87fbd3c752df17bc8fd9c01586d45a:/src/src/tls.c diff --git a/src/src/tls.c b/src/src/tls.c index 23e9d4111..f95091218 100644 --- a/src/src/tls.c +++ b/src/src/tls.c @@ -19,9 +19,16 @@ functions from the OpenSSL or GNU TLS libraries. */ #include "exim.h" #include "transports/smtp.h" -#if defined(MACRO_PREDEF) && defined(SUPPORT_TLS) -# ifndef USE_GNUTLS -# include "macro_predef.h" +#if !defined(DISABLE_TLS) && !defined(USE_OPENSSL) && !defined(USE_GNUTLS) +# error One of USE_OPENSSL or USE_GNUTLS must be defined for a TLS build +#endif + + +#if defined(MACRO_PREDEF) && !defined(DISABLE_TLS) +# include "macro_predef.h" +# ifdef USE_GNUTLS +# include "tls-gnu.c" +# else # include "tls-openssl.c" # endif #endif @@ -35,7 +42,7 @@ reference itself to stop picky compilers complaining that it is unused, and put in a dummy argument to stop even pickier compilers complaining about infinite loops. */ -#ifndef SUPPORT_TLS +#ifdef DISABLE_TLS static void dummy(int x) { dummy(x-1); } #else @@ -46,7 +53,7 @@ We're moving away from this; GnuTLS is already using a state, which can switch, so we can do TLS callouts during ACLs. */ static const int ssl_xfer_buffer_size = 4096; -#ifndef USE_GNUTLS +#ifdef USE_OPENSSL static uschar *ssl_xfer_buffer = NULL; static int ssl_xfer_buffer_lwm = 0; static int ssl_xfer_buffer_hwm = 0; @@ -54,8 +61,6 @@ static int ssl_xfer_eof = FALSE; static BOOL ssl_xfer_error = FALSE; #endif -uschar *tls_channelbinding_b64 = NULL; - /************************************************* * Expand string; give error on failure * @@ -120,14 +125,14 @@ tzset(); #ifdef USE_GNUTLS # include "tls-gnu.c" # include "tlscert-gnu.c" - # define ssl_xfer_buffer (state_server.xfer_buffer) # define ssl_xfer_buffer_lwm (state_server.xfer_buffer_lwm) # define ssl_xfer_buffer_hwm (state_server.xfer_buffer_hwm) # define ssl_xfer_eof (state_server.xfer_eof) # define ssl_xfer_error (state_server.xfer_error) +#endif -#else +#ifdef USE_OPENSSL # include "tls-openssl.c" # include "tlscert-openssl.c" #endif @@ -215,7 +220,7 @@ return ssl_xfer_buffer_lwm < ssl_xfer_buffer_hwm; } -#endif /* SUPPORT_TLS */ +#endif /*DISABLE_TLS*/ void tls_modify_variables(tls_support * dest_tsp) @@ -224,13 +229,13 @@ modify_variable(US"tls_bits", &dest_tsp->bits); modify_variable(US"tls_certificate_verified", &dest_tsp->certificate_verified); modify_variable(US"tls_cipher", &dest_tsp->cipher); modify_variable(US"tls_peerdn", &dest_tsp->peerdn); -#if defined(SUPPORT_TLS) && !defined(USE_GNUTLS) +#ifdef USE_OPENSSL modify_variable(US"tls_sni", &dest_tsp->sni); #endif } -#ifdef SUPPORT_TLS +#ifndef DISABLE_TLS /************************************************ * TLS certificate name operations * ************************************************/ @@ -362,7 +367,114 @@ else if ((subjdn = tls_cert_subject(cert, NULL))) } return FALSE; } -#endif /*SUPPORT_TLS*/ + + +/* Environment cleanup: The GnuTLS library uses SSLKEYLOGFILE in the environment +and writes a file by that name. Our OpenSSL code does the same, using keying +info from the library API. +The GnuTLS support only works if exim is run by root, not taking advantage of +the setuid bit. +You can use either the external environment (modulo the keep_environment config) +or the add_environment config option for SSLKEYLOGFILE; the latter takes +precedence. + +If the path is absolute, require it starts with the spooldir; otherwise delete +the env variable. If relative, prefix the spooldir. +*/ +void +tls_clean_env(void) +{ +uschar * path = US getenv("SSLKEYLOGFILE"); +if (path) + if (!*path) + unsetenv("SSLKEYLOGFILE"); + else if (*path != '/') + { + DEBUG(D_tls) + debug_printf("prepending spooldir to env SSLKEYLOGFILE\n"); + setenv("SSLKEYLOGFILE", CCS string_sprintf("%s/%s", spool_directory, path), 1); + } + else if (Ustrncmp(path, spool_directory, Ustrlen(spool_directory)) != 0) + { + DEBUG(D_tls) + debug_printf("removing env SSLKEYLOGFILE=%s: not under spooldir\n", path); + unsetenv("SSLKEYLOGFILE"); + } +} + +/************************************************* +* Drop privs for checking TLS config * +*************************************************/ + +/* We want to validate TLS options during readconf, but do not want to be +root when we call into the TLS library, in case of library linkage errors +which cause segfaults; before this check, those were always done as the Exim +runtime user and it makes sense to continue with that. + +Assumes: tls_require_ciphers has been set, if it will be + exim_user has been set, if it will be + exim_group has been set, if it will be + +Returns: bool for "okay"; false will cause caller to immediately exit. +*/ + +BOOL +tls_dropprivs_validate_require_cipher(BOOL nowarn) +{ +const uschar *errmsg; +pid_t pid; +int rc, status; +void (*oldsignal)(int); + +/* If TLS will never be used, no point checking ciphers */ + +if ( !tls_advertise_hosts + || !*tls_advertise_hosts + || Ustrcmp(tls_advertise_hosts, ":") == 0 + ) + return TRUE; +else if (!nowarn && !tls_certificate) + log_write(0, LOG_MAIN, + "Warning: No server certificate defined; will use a selfsigned one.\n" + " Suggested action: either install a certificate or change tls_advertise_hosts option"); + +oldsignal = signal(SIGCHLD, SIG_DFL); + +fflush(NULL); +if ((pid = fork()) < 0) + log_write(0, LOG_MAIN|LOG_PANIC_DIE, "fork failed for TLS check"); + +if (pid == 0) + { + /* in some modes, will have dropped privilege already */ + if (!geteuid()) + exim_setugid(exim_uid, exim_gid, FALSE, + US"calling tls_validate_require_cipher"); + + if ((errmsg = tls_validate_require_cipher())) + log_write(0, LOG_PANIC_DIE|LOG_CONFIG, + "tls_require_ciphers invalid: %s", errmsg); + fflush(NULL); + exim_underbar_exit(0); + } + +do { + rc = waitpid(pid, &status, 0); +} while (rc < 0 && errno == EINTR); + +DEBUG(D_tls) + debug_printf("tls_validate_require_cipher child %d ended: status=0x%x\n", + (int)pid, status); + +signal(SIGCHLD, oldsignal); + +return status == 0; +} + + + + +#endif /*!DISABLE_TLS*/ #endif /*!MACRO_PREDEF*/ /* vi: aw ai sw=2