2 Unix SMB/CIFS implementation.
4 transport layer security handling code
6 Copyright (C) Andrew Tridgell 2005
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 2 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program; if not, write to the Free Software
20 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
24 #include "smbd/service_task.h"
25 #include "smbd/service_stream.h"
26 #include "web_server/web_server.h"
27 #include "lib/events/events.h"
28 #include "system/network.h"
31 #include "gnutls/gnutls.h"
35 /* hold per connection tls data */
37 gnutls_session session;
41 /* hold persistent tls data */
43 gnutls_certificate_credentials x509_cred;
44 gnutls_dh_params dh_params;
48 initialise global tls state
50 void tls_initialise(struct task_server *task)
52 struct esp_data *edata = talloc_get_type(task->private, struct esp_data);
55 const char *keyfile = lp_web_keyfile();
56 const char *certfile = lp_web_certfile();
57 const char *cafile = lp_web_cafile();
58 const char *crlfile = lp_web_crlfile();
60 if (!lp_parm_bool(-1, "web", "tls", False)) {
64 tls = talloc_zero(edata, struct tls_data);
65 edata->tls_data = tls;
67 ret = gnutls_global_init();
68 if (ret < 0) goto init_failed;
70 gnutls_certificate_allocate_credentials(&tls->x509_cred);
71 if (ret < 0) goto init_failed;
73 ret = gnutls_certificate_set_x509_trust_file(tls->x509_cred, cafile,
76 DEBUG(0,("TLS failed to initialise cafile %s\n", cafile));
80 if (crlfile && *crlfile) {
81 ret = gnutls_certificate_set_x509_crl_file(tls->x509_cred,
85 DEBUG(0,("TLS failed to initialise crlfile %s\n", cafile));
90 ret = gnutls_certificate_set_x509_key_file(tls->x509_cred,
94 DEBUG(0,("TLS failed to initialise certfile %s and keyfile %s\n",
95 lp_web_certfile(), lp_web_keyfile()));
99 ret = gnutls_dh_params_init(&tls->dh_params);
100 if (ret < 0) goto init_failed;
102 ret = gnutls_dh_params_generate2(tls->dh_params, DH_BITS);
103 if (ret < 0) goto init_failed;
105 gnutls_certificate_set_dh_params(tls->x509_cred, tls->dh_params);
109 DEBUG(0,("GNUTLS failed to initialise with code %d - disabling\n", ret));
111 edata->tls_data = NULL;
116 callback for reading from a socket
118 static ssize_t tls_pull(gnutls_transport_ptr ptr, void *buf, size_t size)
120 struct websrv_context *web = talloc_get_type(ptr, struct websrv_context);
124 if (web->input.tls_first_char) {
125 *(uint8_t *)buf = web->input.first_byte;
126 web->input.tls_first_char = False;
130 status = socket_recv(web->conn->socket, buf, size, &nread, 0);
131 if (!NT_STATUS_IS_OK(status)) {
132 EVENT_FD_READABLE(web->conn->event.fde);
133 EVENT_FD_NOT_WRITEABLE(web->conn->event.fde);
136 if (web->output.output_pending) {
137 EVENT_FD_WRITEABLE(web->conn->event.fde);
140 EVENT_FD_READABLE(web->conn->event.fde);
146 callback for writing to a socket
148 static ssize_t tls_push(gnutls_transport_ptr ptr, const void *buf, size_t size)
150 struct websrv_context *web = talloc_get_type(ptr, struct websrv_context);
155 if (web->tls_session == NULL) {
159 b.data = discard_const(buf);
162 status = socket_send(web->conn->socket, &b, &nwritten, 0);
163 if (!NT_STATUS_IS_OK(status)) {
164 EVENT_FD_WRITEABLE(web->conn->event.fde);
167 if (size != nwritten) {
168 EVENT_FD_WRITEABLE(web->conn->event.fde);
174 destroy a tls session
176 static int tls_destructor(void *ptr)
178 struct tls_session *tls_session = talloc_get_type(ptr, struct tls_session);
179 gnutls_bye(tls_session->session, GNUTLS_SHUT_WR);
185 setup for a new connection
187 NTSTATUS tls_init_connection(struct websrv_context *web)
189 struct esp_data *edata = talloc_get_type(web->task->private, struct esp_data);
190 struct tls_data *tls_data = talloc_get_type(edata->tls_data, struct tls_data);
191 struct tls_session *tls_session;
194 if (edata->tls_data == NULL) {
195 web->tls_session = NULL;
199 #define TLSCHECK(call) do { \
202 DEBUG(0,("TLS failed with code %d - %s\n", ret, #call)); \
207 tls_session = talloc_zero(web, struct tls_session);
208 web->tls_session = tls_session;
210 TLSCHECK(gnutls_init(&tls_session->session, GNUTLS_SERVER));
212 talloc_set_destructor(tls_session, tls_destructor);
214 TLSCHECK(gnutls_set_default_priority(tls_session->session));
215 TLSCHECK(gnutls_credentials_set(tls_session->session, GNUTLS_CRD_CERTIFICATE, tls_data->x509_cred));
216 gnutls_certificate_server_set_request(tls_session->session, GNUTLS_CERT_REQUEST);
217 gnutls_dh_set_prime_bits(tls_session->session, DH_BITS);
218 gnutls_transport_set_ptr(tls_session->session, (gnutls_transport_ptr)web);
219 gnutls_transport_set_pull_function(tls_session->session, (gnutls_pull_func)tls_pull);
220 gnutls_transport_set_push_function(tls_session->session, (gnutls_push_func)tls_push);
221 gnutls_transport_set_lowat(tls_session->session, 0);
223 web->input.tls_detect = True;
228 web->tls_session = NULL;
229 talloc_free(tls_session);
234 possibly continue the handshake process
236 static NTSTATUS tls_handshake(struct tls_session *tls_session)
240 if (tls_session->done_handshake) {
244 ret = gnutls_handshake(tls_session->session);
245 if (ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN) {
246 return STATUS_MORE_ENTRIES;
249 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
251 tls_session->done_handshake = True;
257 receive data either by tls or normal socket_recv
259 NTSTATUS tls_socket_recv(struct websrv_context *web, void *buf, size_t wantlen,
264 struct tls_session *tls_session = talloc_get_type(web->tls_session,
267 if (web->tls_session != NULL && web->input.tls_detect) {
268 status = socket_recv(web->conn->socket, &web->input.first_byte,
270 NT_STATUS_NOT_OK_RETURN(status);
271 if (*nread == 0) return NT_STATUS_OK;
272 web->input.tls_detect = False;
273 /* look for the first byte of a valid HTTP operation */
274 if (strchr("GPHO", web->input.first_byte)) {
276 web->tls_session = NULL;
277 talloc_free(tls_session);
278 *(uint8_t *)buf = web->input.first_byte;
281 web->input.tls_first_char = True;
284 if (web->tls_session == NULL) {
285 return socket_recv(web->conn->socket, buf, wantlen, nread, 0);
288 status = tls_handshake(tls_session);
289 NT_STATUS_NOT_OK_RETURN(status);
291 ret = gnutls_record_recv(tls_session->session, buf, wantlen);
292 if (ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN) {
293 return STATUS_MORE_ENTRIES;
296 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
304 send data either by tls or normal socket_recv
306 NTSTATUS tls_socket_send(struct websrv_context *web, const DATA_BLOB *blob,
311 struct tls_session *tls_session = talloc_get_type(web->tls_session,
314 if (web->tls_session == NULL) {
315 return socket_send(web->conn->socket, blob, sendlen, 0);
318 status = tls_handshake(tls_session);
319 NT_STATUS_NOT_OK_RETURN(status);
321 ret = gnutls_record_send(tls_session->session, blob->data, blob->length);
322 if (ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN) {
323 return STATUS_MORE_ENTRIES;
326 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
333 /* for systems without tls */
334 NTSTATUS tls_socket_recv(struct websrv_context *web, void *buf, size_t wantlen,
337 return socket_recv(web->conn->socket, buf, wantlen, nread, 0);
340 NTSTATUS tls_socket_send(struct websrv_context *web, const DATA_BLOB *blob,
343 return socket_send(web->conn->socket, blob, sendlen, 0);
346 NTSTATUS tls_init_connection(struct websrv_context *web)
348 web->tls_session = NULL;
352 void tls_initialise(struct task_server *task)
354 struct esp_data *edata = talloc_get_type(task->private, struct esp_data);
355 edata->tls_data = NULL;