r7047: rearranged the tls code a bit, and improved the error messages when it fails
authorAndrew Tridgell <tridge@samba.org>
Sat, 28 May 2005 01:29:45 +0000 (01:29 +0000)
committerGerald (Jerry) Carter <jerry@samba.org>
Wed, 10 Oct 2007 18:17:08 +0000 (13:17 -0500)
source/web_server/tls.c

index 2d71ac0c376ad5bfda2e96d1655bce64d4a44021..656c5ee6d66f3c3e7ba8f92ca81d29a50fa4dea7 100644 (file)
@@ -44,74 +44,6 @@ struct tls_data {
        gnutls_dh_params dh_params;
 };
 
-/*
-  initialise global tls state
-*/
-void tls_initialise(struct task_server *task)
-{
-       struct esp_data *edata = talloc_get_type(task->private, struct esp_data);
-       struct tls_data *tls;
-       int ret;
-       const char *keyfile = lp_web_keyfile();
-       const char *certfile = lp_web_certfile();
-       const char *cafile = lp_web_cafile();
-       const char *crlfile = lp_web_crlfile();
-
-       if (!lp_web_tls() || keyfile == NULL || *keyfile == 0) {
-               return;
-       }
-
-       tls = talloc_zero(edata, struct tls_data);
-       edata->tls_data = tls;
-
-       ret = gnutls_global_init();
-       if (ret < 0) goto init_failed;
-
-       gnutls_certificate_allocate_credentials(&tls->x509_cred);
-       if (ret < 0) goto init_failed;
-
-       ret = gnutls_certificate_set_x509_trust_file(tls->x509_cred, cafile, 
-                                                    GNUTLS_X509_FMT_PEM);      
-       if (ret < 0) {
-               DEBUG(0,("TLS failed to initialise cafile %s\n", cafile));
-               goto init_failed;
-       }
-
-       if (crlfile && *crlfile) {
-               ret = gnutls_certificate_set_x509_crl_file(tls->x509_cred, 
-                                                          crlfile, 
-                                                          GNUTLS_X509_FMT_PEM);
-               if (ret < 0) {
-                       DEBUG(0,("TLS failed to initialise crlfile %s\n", cafile));
-                       goto init_failed;
-               }
-       }
-       
-       ret = gnutls_certificate_set_x509_key_file(tls->x509_cred, 
-                                                  certfile, keyfile,
-                                                  GNUTLS_X509_FMT_PEM);
-       if (ret < 0) {
-               DEBUG(0,("TLS failed to initialise certfile %s and keyfile %s\n", 
-                        lp_web_certfile(), lp_web_keyfile()));
-               goto init_failed;
-       }
-       
-       ret = gnutls_dh_params_init(&tls->dh_params);
-       if (ret < 0) goto init_failed;
-
-       ret = gnutls_dh_params_generate2(tls->dh_params, DH_BITS);
-       if (ret < 0) goto init_failed;
-
-       gnutls_certificate_set_dh_params(tls->x509_cred, tls->dh_params);
-       return;
-
-init_failed:
-       DEBUG(0,("GNUTLS failed to initialise with code %d - disabling\n", ret));
-       talloc_free(tls);
-       edata->tls_data = NULL;
-}
-
-
 /*
   callback for reading from a socket
 */
@@ -176,60 +108,15 @@ static ssize_t tls_push(gnutls_transport_ptr ptr, const void *buf, size_t size)
 static int tls_destructor(void *ptr)
 {
        struct tls_session *tls_session = talloc_get_type(ptr, struct tls_session);
-       gnutls_bye(tls_session->session, GNUTLS_SHUT_WR);
-       return 0;
-}
-
-
-/*
-  setup for a new connection
-*/
-NTSTATUS tls_init_connection(struct websrv_context *web)
-{
-       struct esp_data *edata = talloc_get_type(web->task->private, struct esp_data);
-       struct tls_data *tls_data = talloc_get_type(edata->tls_data, struct tls_data);
-       struct tls_session *tls_session;
        int ret;
-
-       if (edata->tls_data == NULL) {
-               web->tls_session = NULL;
-               return NT_STATUS_OK;
+       ret = gnutls_bye(tls_session->session, GNUTLS_SHUT_WR);
+       if (ret < 0) {
+               DEBUG(0,("TLS gnutls_bye failed - %s\n", gnutls_strerror(ret)));
        }
-
-#define TLSCHECK(call) do { \
-       ret = call; \
-       if (ret < 0) { \
-               DEBUG(0,("TLS failed with code %d - %s\n", ret, #call)); \
-               goto failed; \
-       } \
-} while (0)
-
-       tls_session = talloc_zero(web, struct tls_session);
-       web->tls_session = tls_session;
-
-       TLSCHECK(gnutls_init(&tls_session->session, GNUTLS_SERVER));
-
-       talloc_set_destructor(tls_session, tls_destructor);
-
-       TLSCHECK(gnutls_set_default_priority(tls_session->session));
-       TLSCHECK(gnutls_credentials_set(tls_session->session, GNUTLS_CRD_CERTIFICATE, tls_data->x509_cred));
-       gnutls_certificate_server_set_request(tls_session->session, GNUTLS_CERT_REQUEST);
-       gnutls_dh_set_prime_bits(tls_session->session, DH_BITS);
-       gnutls_transport_set_ptr(tls_session->session, (gnutls_transport_ptr)web);
-       gnutls_transport_set_pull_function(tls_session->session, (gnutls_pull_func)tls_pull);
-       gnutls_transport_set_push_function(tls_session->session, (gnutls_push_func)tls_push);
-       gnutls_transport_set_lowat(tls_session->session, 0);
-
-       web->input.tls_detect = True;
-       
-       return NT_STATUS_OK;
-
-failed:
-       web->tls_session = NULL;
-       talloc_free(tls_session);
-       return NT_STATUS_OK;
+       return 0;
 }
 
+
 /*
   possibly continue the handshake process
 */
@@ -246,6 +133,7 @@ static NTSTATUS tls_handshake(struct tls_session *tls_session)
                return STATUS_MORE_ENTRIES;
        }
        if (ret < 0) {
+               DEBUG(0,("TLS gnutls_handshake failed - %s\n", gnutls_strerror(ret)));
                return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
        }
        tls_session->done_handshake = True;
@@ -293,6 +181,7 @@ NTSTATUS tls_socket_recv(struct websrv_context *web, void *buf, size_t wantlen,
                return STATUS_MORE_ENTRIES;
        }
        if (ret < 0) {
+               DEBUG(0,("gnutls_record_recv failed - %s\n", gnutls_strerror(ret)));
                return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
        }
        *nread = ret;
@@ -323,14 +212,137 @@ NTSTATUS tls_socket_send(struct websrv_context *web, const DATA_BLOB *blob,
                return STATUS_MORE_ENTRIES;
        }
        if (ret < 0) {
+               DEBUG(0,("gnutls_record_send failed - %s\n", gnutls_strerror(ret)));
                return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
        }
        *sendlen = ret;
        return NT_STATUS_OK;
 }
+
+
+/*
+  initialise global tls state
+*/
+void tls_initialise(struct task_server *task)
+{
+       struct esp_data *edata = talloc_get_type(task->private, struct esp_data);
+       struct tls_data *tls;
+       int ret;
+       const char *keyfile = lp_web_keyfile();
+       const char *certfile = lp_web_certfile();
+       const char *cafile = lp_web_cafile();
+       const char *crlfile = lp_web_crlfile();
+
+       if (!lp_web_tls() || keyfile == NULL || *keyfile == 0) {
+               return;
+       }
+
+       tls = talloc_zero(edata, struct tls_data);
+       edata->tls_data = tls;
+
+       ret = gnutls_global_init();
+       if (ret < 0) goto init_failed;
+
+       gnutls_certificate_allocate_credentials(&tls->x509_cred);
+       if (ret < 0) goto init_failed;
+
+       ret = gnutls_certificate_set_x509_trust_file(tls->x509_cred, cafile, 
+                                                    GNUTLS_X509_FMT_PEM);      
+       if (ret < 0) {
+               DEBUG(0,("TLS failed to initialise cafile %s\n", cafile));
+               goto init_failed;
+       }
+
+       if (crlfile && *crlfile) {
+               ret = gnutls_certificate_set_x509_crl_file(tls->x509_cred, 
+                                                          crlfile, 
+                                                          GNUTLS_X509_FMT_PEM);
+               if (ret < 0) {
+                       DEBUG(0,("TLS failed to initialise crlfile %s\n", cafile));
+                       goto init_failed;
+               }
+       }
+       
+       ret = gnutls_certificate_set_x509_key_file(tls->x509_cred, 
+                                                  certfile, keyfile,
+                                                  GNUTLS_X509_FMT_PEM);
+       if (ret < 0) {
+               DEBUG(0,("TLS failed to initialise certfile %s and keyfile %s\n", 
+                        lp_web_certfile(), lp_web_keyfile()));
+               goto init_failed;
+       }
+       
+       ret = gnutls_dh_params_init(&tls->dh_params);
+       if (ret < 0) goto init_failed;
+
+       ret = gnutls_dh_params_generate2(tls->dh_params, DH_BITS);
+       if (ret < 0) goto init_failed;
+
+       gnutls_certificate_set_dh_params(tls->x509_cred, tls->dh_params);
+       return;
+
+init_failed:
+       DEBUG(0,("GNUTLS failed to initialise - %s\n", gnutls_strerror(ret)));
+       talloc_free(tls);
+       edata->tls_data = NULL;
+}
+
+
+/*
+  setup for a new connection
+*/
+NTSTATUS tls_init_connection(struct websrv_context *web)
+{
+       struct esp_data *edata = talloc_get_type(web->task->private, struct esp_data);
+       struct tls_data *tls_data = talloc_get_type(edata->tls_data, struct tls_data);
+       struct tls_session *tls_session;
+       int ret;
+
+       if (edata->tls_data == NULL) {
+               web->tls_session = NULL;
+               return NT_STATUS_OK;
+       }
+
+#define TLSCHECK(call) do { \
+       ret = call; \
+       if (ret < 0) { \
+               DEBUG(0,("TLS %s - %s\n", #call, gnutls_strerror(ret))); \
+               goto failed; \
+       } \
+} while (0)
+
+       tls_session = talloc_zero(web, struct tls_session);
+       web->tls_session = tls_session;
+
+       TLSCHECK(gnutls_init(&tls_session->session, GNUTLS_SERVER));
+
+       talloc_set_destructor(tls_session, tls_destructor);
+
+       TLSCHECK(gnutls_set_default_priority(tls_session->session));
+       TLSCHECK(gnutls_credentials_set(tls_session->session, GNUTLS_CRD_CERTIFICATE, tls_data->x509_cred));
+       gnutls_certificate_server_set_request(tls_session->session, GNUTLS_CERT_REQUEST);
+       gnutls_dh_set_prime_bits(tls_session->session, DH_BITS);
+       gnutls_transport_set_ptr(tls_session->session, (gnutls_transport_ptr)web);
+       gnutls_transport_set_pull_function(tls_session->session, (gnutls_pull_func)tls_pull);
+       gnutls_transport_set_push_function(tls_session->session, (gnutls_push_func)tls_push);
+       gnutls_transport_set_lowat(tls_session->session, 0);
+
+       web->input.tls_detect = True;
+       
+       return NT_STATUS_OK;
+
+failed:
+       DEBUG(0,("TLS init connection failed - %s\n", gnutls_strerror(ret)));
+       web->tls_session = NULL;
+       talloc_free(tls_session);
+       return NT_STATUS_OK;
+}
+
+
 #else
 
-/* for systems without tls */
+/* for systems without tls we just map the tls socket calls to the
+   normal socket calls */
 NTSTATUS tls_socket_recv(struct websrv_context *web, void *buf, size_t wantlen, 
                         size_t *nread)
 {