+
+
+/*************************************************
+* Set various Exim expansion vars *
+*************************************************/
+
+#define exim_gnutls_cert_err(Label) \
+ do \
+ { \
+ if (rc != GNUTLS_E_SUCCESS) \
+ { \
+ DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
+ (Label), gnutls_strerror(rc)); \
+ return rc; \
+ } \
+ } while (0)
+
+static int
+import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
+{
+int rc;
+
+rc = gnutls_x509_crt_init(crtp);
+exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
+
+rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
+exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
+
+return rc;
+}
+
+#undef exim_gnutls_cert_err
+
+
+/* We set various Exim global variables from the state, once a session has
+been established. With TLS callouts, may need to change this to stack
+variables, or just re-call it with the server state after client callout
+has finished.
+
+Make sure anything set here is unset in tls_getc().
+
+Sets:
+ tls_active fd
+ tls_bits strength indicator
+ tls_certificate_verified bool indicator
+ tls_channelbinding_b64 for some SASL mechanisms
+ tls_cipher a string
+ tls_peercert pointer to library internal
+ tls_peerdn a string
+ tls_sni a (UTF-8) string
+ tls_ourcert pointer to library internal
+
+Argument:
+ state the relevant exim_gnutls_state_st *
+*/
+
+static void
+extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
+{
+gnutls_cipher_algorithm_t cipher;
+#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
+int old_pool;
+int rc;
+gnutls_datum_t channel;
+#endif
+tls_support * tlsp = state->tlsp;
+
+tlsp->active = state->fd_out;
+
+cipher = gnutls_cipher_get(state->session);
+/* returns size in "bytes" */
+tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
+
+tlsp->cipher = state->ciphersuite;
+
+DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
+
+tlsp->certificate_verified = state->peer_cert_verified;
+
+/* note that tls_channelbinding_b64 is not saved to the spool file, since it's
+only available for use for authenticators while this TLS session is running. */
+
+tls_channelbinding_b64 = NULL;
+#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
+channel.data = NULL;
+channel.size = 0;
+rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
+if (rc) {
+ DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
+} else {
+ old_pool = store_pool;
+ store_pool = POOL_PERM;
+ tls_channelbinding_b64 = b64encode(channel.data, (int)channel.size);
+ store_pool = old_pool;
+ DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
+}
+#endif
+
+/* peercert is set in peer_status() */
+tlsp->peerdn = state->peerdn;
+tlsp->sni = state->received_sni;
+
+/* record our certificate */