1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) Jeremy Harris 2014 - 2018 */
6 /* Copyright (c) The Exim Maintainers 2021 */
8 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
9 one of the available supported implementations. This file is #included into
10 tls.c when USE_GNUTLS has been set.
13 #include <gnutls/gnutls.h>
14 /* needed for cert checks in verification and DN extraction: */
15 #include <gnutls/x509.h>
16 /* needed to disable PKCS11 autoload unless requested */
17 #if GNUTLS_VERSION_NUMBER >= 0x020c00
18 # include <gnutls/pkcs11.h>
22 /*****************************************************
23 * Export/import a certificate, binary/printable
24 ******************************************************
25 Return: boolean success
29 tls_export_cert(uschar * buf, size_t buflen, void * cert)
32 rmark reset_point = store_mark();
36 if ((fail = gnutls_x509_crt_export((gnutls_x509_crt_t)cert,
37 GNUTLS_X509_FMT_PEM, buf, &sz)))
39 log_write(0, LOG_MAIN, "TLS error in certificate export: %s",
40 gnutls_strerror(fail));
43 if ((cp = string_printing(buf)) != buf)
45 Ustrncpy(buf, cp, buflen);
49 store_reset(reset_point);
53 /* On error, NULL out the destination */
55 tls_import_cert(const uschar * buf, void ** cert)
57 rmark reset_point = store_mark();
59 gnutls_x509_crt_t crt = *(gnutls_x509_crt_t *)cert;
63 gnutls_x509_crt_deinit(crt);
67 gnutls_x509_crt_init(&crt);
69 datum.data = string_unprinting(US buf);
70 datum.size = Ustrlen(datum.data);
71 if ((rc = gnutls_x509_crt_import(crt, &datum, GNUTLS_X509_FMT_PEM)))
73 log_write(0, LOG_MAIN, "TLS error in certificate import: %s",
78 store_reset(reset_point);
83 tls_free_cert(void ** cert)
85 gnutls_x509_crt_t crt = *(gnutls_x509_crt_t *)cert;
88 gnutls_x509_crt_deinit(crt);
89 gnutls_global_deinit();
94 /*****************************************************
95 * Certificate field extraction routines
96 *****************************************************/
98 /* First, some internal service functions */
101 g_err(const char * tag, const char * from, int gnutls_err)
103 expand_string_message = string_sprintf("%s: %s fail: %s\n",
104 from, tag, gnutls_strerror(gnutls_err));
110 time_copy(time_t t, uschar * mod)
115 if (mod && Ustrcmp(mod, "int") == 0)
116 return string_sprintf("%u", (unsigned)t);
118 cp = store_get(len, GET_UNTAINTED);
119 if (f.timestamps_utc)
121 uschar * tz = to_tz(US"GMT0");
122 len = strftime(CS cp, len, "%b %e %T %Y %Z", gmtime(&t));
126 len = strftime(CS cp, len, "%b %e %T %Y %Z", localtime(&t));
127 return len > 0 ? cp : NULL;
132 /* Now the extractors, called from expand.c
135 mod Optional modifiers for the operator
138 Allocated string with extracted value
142 tls_cert_issuer(void * cert, uschar * mod)
148 if ((ret = gnutls_x509_crt_get_issuer_dn(cert, CS cp, &siz))
149 != GNUTLS_E_SHORT_MEMORY_BUFFER)
150 return g_err("gi0", __FUNCTION__, ret);
152 cp = store_get(siz, GET_TAINTED);
153 if ((ret = gnutls_x509_crt_get_issuer_dn(cert, CS cp, &siz)) < 0)
154 return g_err("gi1", __FUNCTION__, ret);
156 return mod ? tls_field_from_dn(cp, mod) : cp;
160 tls_cert_not_after(void * cert, uschar * mod)
163 gnutls_x509_crt_get_expiration_time((gnutls_x509_crt_t)cert),
168 tls_cert_not_before(void * cert, uschar * mod)
171 gnutls_x509_crt_get_activation_time((gnutls_x509_crt_t)cert),
176 tls_cert_serial_number(void * cert, uschar * mod)
178 uschar bin[50], txt[150];
180 size_t sz = sizeof(bin);
183 if ((ret = gnutls_x509_crt_get_serial((gnutls_x509_crt_t)cert,
185 return g_err("gs0", __FUNCTION__, ret);
187 for(uschar * dp = txt; sz; sz--)
188 dp += sprintf(CS dp, "%.2x", *sp++);
189 for(sp = txt; sp[0]=='0' && sp[1]; ) sp++; /* leading zeroes */
190 return string_copy(sp);
194 tls_cert_signature(void * cert, uschar * mod)
202 if ((ret = gnutls_x509_crt_get_signature((gnutls_x509_crt_t)cert, CS cp1, &len))
203 != GNUTLS_E_SHORT_MEMORY_BUFFER)
204 return g_err("gs0", __FUNCTION__, ret);
206 cp1 = store_get(len*4+1, GET_TAINTED);
207 if (gnutls_x509_crt_get_signature((gnutls_x509_crt_t)cert, CS cp1, &len) != 0)
208 return g_err("gs1", __FUNCTION__, ret);
210 for(cp3 = cp2 = cp1+len; cp1 < cp2; cp1++)
211 cp3 += sprintf(CS cp3, "%.2x ", *cp1);
218 tls_cert_signature_algorithm(void * cert, uschar * mod)
220 gnutls_sign_algorithm_t algo =
221 gnutls_x509_crt_get_signature_algorithm((gnutls_x509_crt_t)cert);
222 return algo < 0 ? NULL : string_copy(US gnutls_sign_get_name(algo));
226 tls_cert_subject(void * cert, uschar * mod)
232 if ((ret = gnutls_x509_crt_get_dn(cert, CS cp, &siz))
233 != GNUTLS_E_SHORT_MEMORY_BUFFER)
234 return g_err("gs0", __FUNCTION__, ret);
236 cp = store_get(siz, GET_TAINTED);
237 if ((ret = gnutls_x509_crt_get_dn(cert, CS cp, &siz)) < 0)
238 return g_err("gs1", __FUNCTION__, ret);
240 return mod ? tls_field_from_dn(cp, mod) : cp;
244 tls_cert_version(void * cert, uschar * mod)
246 return string_sprintf("%d", gnutls_x509_crt_get_version(cert));
250 tls_cert_ext_by_oid(void * cert, uschar * oid, int idx)
259 ret = gnutls_x509_crt_get_extension_by_oid ((gnutls_x509_crt_t)cert,
260 CS oid, idx, CS cp1, &siz, &crit);
261 if (ret != GNUTLS_E_SHORT_MEMORY_BUFFER)
262 return g_err("ge0", __FUNCTION__, ret);
264 cp1 = store_get(siz*4 + 1, GET_TAINTED);
266 ret = gnutls_x509_crt_get_extension_by_oid ((gnutls_x509_crt_t)cert,
267 CS oid, idx, CS cp1, &siz, &crit);
269 return g_err("ge1", __FUNCTION__, ret);
271 /* binary data, DER encoded */
273 /* just dump for now */
274 for(cp3 = cp2 = cp1+siz; cp1 < cp2; cp1++)
275 cp3 += sprintf(CS cp3, "%.2x ", *cp1);
282 tls_cert_subject_altname(void * cert, uschar * mod)
284 gstring * list = NULL;
292 if (mod) while (*mod)
294 if (*mod == '>' && *++mod) sep = *mod++;
295 else if (Ustrncmp(mod, "dns", 3)==0) { match = GNUTLS_SAN_DNSNAME; mod += 3; }
296 else if (Ustrncmp(mod, "uri", 3)==0) { match = GNUTLS_SAN_URI; mod += 3; }
297 else if (Ustrncmp(mod, "mail", 4)==0) { match = GNUTLS_SAN_RFC822NAME; mod += 4; }
304 for (int index = 0;; index++)
307 switch(ret = gnutls_x509_crt_get_subject_alt_name(
308 (gnutls_x509_crt_t)cert, index, NULL, &siz, NULL))
310 case GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE:
311 return string_from_gstring(list); /* no more elements; normal exit */
313 case GNUTLS_E_SHORT_MEMORY_BUFFER:
317 return g_err("gs0", __FUNCTION__, ret);
320 ele = store_get(siz+1, GET_TAINTED);
321 if ((ret = gnutls_x509_crt_get_subject_alt_name(
322 (gnutls_x509_crt_t)cert, index, ele, &siz, NULL)) < 0)
323 return g_err("gs1", __FUNCTION__, ret);
326 if ( match != -1 && match != ret /* wrong type of SAN */
327 || Ustrlen(ele) != siz) /* contains a NUL */
331 case GNUTLS_SAN_DNSNAME: tag = US"DNS"; break;
332 case GNUTLS_SAN_URI: tag = US"URI"; break;
333 case GNUTLS_SAN_RFC822NAME: tag = US"MAIL"; break;
334 default: continue; /* ignore unrecognised types */
336 list = string_append_listele(list, sep,
337 match == -1 ? string_sprintf("%s=%s", tag, ele) : ele);
343 tls_cert_ocsp_uri(void * cert, uschar * mod)
345 #if GNUTLS_VERSION_NUMBER >= 0x030000
349 gstring * list = NULL;
352 if (*mod == '>' && *++mod) sep = *mod++;
354 for (int index = 0;; index++)
356 ret = gnutls_x509_crt_get_authority_info_access((gnutls_x509_crt_t)cert,
357 index, GNUTLS_IA_OCSP_URI, &uri, NULL);
359 if (ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
360 return string_from_gstring(list);
362 return g_err("gai", __FUNCTION__, ret);
364 list = string_append_listele_n(list, sep, uri.data, uri.size);
370 expand_string_message =
371 string_sprintf("%s: OCSP support with GnuTLS requires version 3.0.0\n",
379 tls_cert_crl_uri(void * cert, uschar * mod)
383 gstring * list = NULL;
387 if (*mod == '>' && *++mod) sep = *mod++;
389 for (int index = 0;; index++)
392 switch(ret = gnutls_x509_crt_get_crl_dist_points(
393 (gnutls_x509_crt_t)cert, index, NULL, &siz, NULL, NULL))
395 case GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE:
396 return string_from_gstring(list);
397 case GNUTLS_E_SHORT_MEMORY_BUFFER:
400 return g_err("gc0", __FUNCTION__, ret);
403 ele = store_get(siz, GET_TAINTED);
404 if ((ret = gnutls_x509_crt_get_crl_dist_points(
405 (gnutls_x509_crt_t)cert, index, ele, &siz, NULL, NULL)) < 0)
406 return g_err("gc1", __FUNCTION__, ret);
408 list = string_append_listele_n(list, sep, ele, siz);
414 /*****************************************************
415 * Certificate operator routines
416 *****************************************************/
418 tls_cert_der_b64(void * cert)
424 if ( (fail = gnutls_x509_crt_export((gnutls_x509_crt_t)cert,
425 GNUTLS_X509_FMT_DER, cp, &len)) != GNUTLS_E_SHORT_MEMORY_BUFFER
426 || !(cp = store_get((int)len, GET_TAINTED), TRUE) /* tainted */
427 || (fail = gnutls_x509_crt_export((gnutls_x509_crt_t)cert,
428 GNUTLS_X509_FMT_DER, cp, &len))
431 log_write(0, LOG_MAIN, "TLS error in certificate export: %s",
432 gnutls_strerror(fail));
435 return b64encode(CUS cp, (int)len);
440 fingerprint(gnutls_x509_crt_t cert, gnutls_digest_algorithm_t algo)
447 if ((ret = gnutls_x509_crt_get_fingerprint(cert, algo, NULL, &siz))
448 != GNUTLS_E_SHORT_MEMORY_BUFFER)
449 return g_err("gf0", __FUNCTION__, ret);
451 cp = store_get(siz*3+1, GET_TAINTED);
452 if ((ret = gnutls_x509_crt_get_fingerprint(cert, algo, cp, &siz)) < 0)
453 return g_err("gf1", __FUNCTION__, ret);
455 for (uschar * cp3 = cp2 = cp+siz; cp < cp2; cp++)
456 cp3 += sprintf(CS cp3, "%02X", *cp);
462 tls_cert_fprt_md5(void * cert)
464 return fingerprint((gnutls_x509_crt_t)cert, GNUTLS_DIG_MD5);
468 tls_cert_fprt_sha1(void * cert)
470 return fingerprint((gnutls_x509_crt_t)cert, GNUTLS_DIG_SHA1);
474 tls_cert_fprt_sha256(void * cert)
476 return fingerprint((gnutls_x509_crt_t)cert, GNUTLS_DIG_SHA256);
482 /* End of tlscert-gnu.c */