source4/lib/tls/tls.h

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    transport layer security handling code
   5
   6    Copyright (C) Andrew Tridgell 2005
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #ifndef _TLS_H_
  23 #define _TLS_H_
  24
  25 #include "lib/socket/socket.h"
  26
  27 struct loadparm_context;
  28
  29 void tls_cert_generate(TALLOC_CTX *mem_ctx,
  30                        const char *hostname,
  31                        const char *keyfile, const char *certfile,
  32                        const char *cafile);
  33
  34 struct tstream_context;
  35 struct tstream_tls_params;
  36 struct tstream_tls_sync;
  37
  38 enum tls_verify_peer_state {
  39         TLS_VERIFY_PEER_NO_CHECK = 0,
  40 #define TLS_VERIFY_PEER_NO_CHECK_STRING "no_check"
  41
  42         TLS_VERIFY_PEER_CA_ONLY = 10,
  43 #define TLS_VERIFY_PEER_CA_ONLY_STRING "ca_only"
  44
  45         TLS_VERIFY_PEER_CA_AND_NAME_IF_AVAILABLE = 20,
  46 #define TLS_VERIFY_PEER_CA_AND_NAME_IF_AVAILABLE_STRING \
  47                 "ca_and_name_if_available"
  48
  49         TLS_VERIFY_PEER_CA_AND_NAME = 30,
  50 #define TLS_VERIFY_PEER_CA_AND_NAME_STRING "ca_and_name"
  51
  52         TLS_VERIFY_PEER_AS_STRICT_AS_POSSIBLE = 9999,
  53 #define TLS_VERIFY_PEER_AS_STRICT_AS_POSSIBLE_STRING \
  54                 "as_strict_as_possible"
  55 };
  56
  57 const char *tls_verify_peer_string(enum tls_verify_peer_state verify_peer);
  58
  59 NTSTATUS tstream_tls_params_client(TALLOC_CTX *mem_ctx,
  60                                    bool system_cas,
  61                                    const char * const *ca_dirs,
  62                                    const char *ca_file,
  63                                    const char *crl_file,
  64                                    const char *tls_priority,
  65                                    enum tls_verify_peer_state verify_peer,
  66                                    const char *peer_name,
  67                                    struct tstream_tls_params **_tlsp);
  68
  69 NTSTATUS tstream_tls_params_client_lpcfg(TALLOC_CTX *mem_ctx,
  70                                          struct loadparm_context *lp_ctx,
  71                                          const char *peer_name,
  72                                          struct tstream_tls_params **tlsp);
  73
  74 NTSTATUS tstream_tls_params_server(TALLOC_CTX *mem_ctx,
  75                                    const char *dns_host_name,
  76                                    bool enabled,
  77                                    const char *key_file,
  78                                    const char *cert_file,
  79                                    const char *ca_file,
  80                                    const char *crl_file,
  81                                    const char *dhp_file,
  82                                    const char *tls_priority,
  83                                    struct tstream_tls_params **_params);
  84
  85 bool tstream_tls_params_enabled(struct tstream_tls_params *params);
  86
  87 const DATA_BLOB *tstream_tls_channel_bindings(struct tstream_context *tls_tstream);
  88
  89 struct tevent_req *_tstream_tls_connect_send(TALLOC_CTX *mem_ctx,
  90                                              struct tevent_context *ev,
  91                                              struct tstream_context *plain_stream,
  92                                              struct tstream_tls_params *tls_params,
  93                                              const char *location);
  94 #define tstream_tls_connect_send(mem_ctx, ev, plain_stream, tls_params) \
  95         _tstream_tls_connect_send(mem_ctx, ev, plain_stream, tls_params, __location__)
  96
  97 int tstream_tls_connect_recv(struct tevent_req *req,
  98                              int *perrno,
  99                              TALLOC_CTX *mem_ctx,
 100                              struct tstream_context **tls_stream);
 101
 102 struct tevent_req *_tstream_tls_accept_send(TALLOC_CTX *mem_ctx,
 103                                             struct tevent_context *ev,
 104                                             struct tstream_context *plain_stream,
 105                                             struct tstream_tls_params *tls_params,
 106                                             const char *location);
 107 #define tstream_tls_accept_send(mem_ctx, ev, plain_stream, tls_params) \
 108         _tstream_tls_accept_send(mem_ctx, ev, plain_stream, tls_params, __location__)
 109
 110 int tstream_tls_accept_recv(struct tevent_req *req,
 111                             int *perrno,
 112                             TALLOC_CTX *mem_ctx,
 113                             struct tstream_context **tls_stream);
 114
 115 ssize_t tstream_tls_sync_read(struct tstream_tls_sync *tlsss,
 116                               void *buf, size_t len);
 117 ssize_t tstream_tls_sync_write(struct tstream_tls_sync *tlsss,
 118                                const void *buf, size_t len);
 119 size_t tstream_tls_sync_pending(struct tstream_tls_sync *tlsss);
 120 NTSTATUS tstream_tls_sync_setup(struct tstream_tls_params *_tls_params,
 121                                 void *io_private,
 122                                 ssize_t (*io_send_fn)(void *io_private,
 123                                                       const uint8_t *buf,
 124                                                       size_t len),
 125                                 ssize_t (*io_recv_fn)(void *io_private,
 126                                                       uint8_t *buf,
 127                                                       size_t len),
 128                                 TALLOC_CTX *mem_ctx,
 129                                 struct tstream_tls_sync **_tlsss);
 130
 131 const DATA_BLOB *tstream_tls_sync_channel_bindings(struct tstream_tls_sync *tlsss);
 132
 133 #endif /* _TLS_H_ */