2 Unix SMB/CIFS implementation.
4 transport layer security handling code
6 Copyright (C) Andrew Tridgell 2005
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 2 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program; if not, write to the Free Software
20 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
24 #include "smbd/service_task.h"
25 #include "smbd/service_stream.h"
26 #include "web_server/web_server.h"
27 #include "lib/events/events.h"
28 #include "system/network.h"
31 #include "gnutls/gnutls.h"
35 /* hold per connection tls data */
37 gnutls_session session;
41 /* hold persistent tls data */
43 gnutls_certificate_credentials x509_cred;
44 gnutls_dh_params dh_params;
48 callback for reading from a socket
50 static ssize_t tls_pull(gnutls_transport_ptr ptr, void *buf, size_t size)
52 struct websrv_context *web = talloc_get_type(ptr, struct websrv_context);
56 if (web->input.tls_first_char) {
57 *(uint8_t *)buf = web->input.first_byte;
58 web->input.tls_first_char = False;
62 status = socket_recv(web->conn->socket, buf, size, &nread, 0);
63 if (!NT_STATUS_IS_OK(status)) {
64 EVENT_FD_READABLE(web->conn->event.fde);
65 EVENT_FD_NOT_WRITEABLE(web->conn->event.fde);
68 if (web->output.output_pending) {
69 EVENT_FD_WRITEABLE(web->conn->event.fde);
72 EVENT_FD_READABLE(web->conn->event.fde);
78 callback for writing to a socket
80 static ssize_t tls_push(gnutls_transport_ptr ptr, const void *buf, size_t size)
82 struct websrv_context *web = talloc_get_type(ptr, struct websrv_context);
87 if (web->tls_session == NULL) {
91 b.data = discard_const(buf);
94 status = socket_send(web->conn->socket, &b, &nwritten, 0);
95 if (!NT_STATUS_IS_OK(status)) {
96 EVENT_FD_WRITEABLE(web->conn->event.fde);
99 if (size != nwritten) {
100 EVENT_FD_WRITEABLE(web->conn->event.fde);
106 destroy a tls session
108 static int tls_destructor(void *ptr)
110 struct tls_session *tls_session = talloc_get_type(ptr, struct tls_session);
112 ret = gnutls_bye(tls_session->session, GNUTLS_SHUT_WR);
114 DEBUG(0,("TLS gnutls_bye failed - %s\n", gnutls_strerror(ret)));
121 possibly continue the handshake process
123 static NTSTATUS tls_handshake(struct tls_session *tls_session)
127 if (tls_session->done_handshake) {
131 ret = gnutls_handshake(tls_session->session);
132 if (ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN) {
133 return STATUS_MORE_ENTRIES;
136 DEBUG(0,("TLS gnutls_handshake failed - %s\n", gnutls_strerror(ret)));
137 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
139 tls_session->done_handshake = True;
145 receive data either by tls or normal socket_recv
147 NTSTATUS tls_socket_recv(struct websrv_context *web, void *buf, size_t wantlen,
152 struct tls_session *tls_session = talloc_get_type(web->tls_session,
155 if (web->tls_session != NULL && web->input.tls_detect) {
156 status = socket_recv(web->conn->socket, &web->input.first_byte,
158 NT_STATUS_NOT_OK_RETURN(status);
159 if (*nread == 0) return NT_STATUS_OK;
160 web->input.tls_detect = False;
161 /* look for the first byte of a valid HTTP operation */
162 if (strchr("GPHO", web->input.first_byte)) {
164 web->tls_session = NULL;
165 talloc_free(tls_session);
166 *(uint8_t *)buf = web->input.first_byte;
169 web->input.tls_first_char = True;
172 if (web->tls_session == NULL) {
173 return socket_recv(web->conn->socket, buf, wantlen, nread, 0);
176 status = tls_handshake(tls_session);
177 NT_STATUS_NOT_OK_RETURN(status);
179 ret = gnutls_record_recv(tls_session->session, buf, wantlen);
180 if (ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN) {
181 return STATUS_MORE_ENTRIES;
184 DEBUG(0,("gnutls_record_recv failed - %s\n", gnutls_strerror(ret)));
185 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
193 send data either by tls or normal socket_recv
195 NTSTATUS tls_socket_send(struct websrv_context *web, const DATA_BLOB *blob,
200 struct tls_session *tls_session = talloc_get_type(web->tls_session,
203 if (web->tls_session == NULL) {
204 return socket_send(web->conn->socket, blob, sendlen, 0);
207 status = tls_handshake(tls_session);
208 NT_STATUS_NOT_OK_RETURN(status);
210 ret = gnutls_record_send(tls_session->session, blob->data, blob->length);
211 if (ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN) {
212 return STATUS_MORE_ENTRIES;
215 DEBUG(0,("gnutls_record_send failed - %s\n", gnutls_strerror(ret)));
216 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
224 initialise global tls state
226 void tls_initialise(struct task_server *task)
228 struct esp_data *edata = talloc_get_type(task->private, struct esp_data);
229 struct tls_data *tls;
231 const char *keyfile = lp_web_keyfile();
232 const char *certfile = lp_web_certfile();
233 const char *cafile = lp_web_cafile();
234 const char *crlfile = lp_web_crlfile();
236 if (!lp_web_tls() || keyfile == NULL || *keyfile == 0) {
240 tls = talloc_zero(edata, struct tls_data);
241 edata->tls_data = tls;
243 if (!file_exist(cafile)) {
244 tls_cert_generate(tls, keyfile, certfile, cafile);
247 ret = gnutls_global_init();
248 if (ret < 0) goto init_failed;
250 gnutls_certificate_allocate_credentials(&tls->x509_cred);
251 if (ret < 0) goto init_failed;
253 if (cafile && *cafile) {
254 ret = gnutls_certificate_set_x509_trust_file(tls->x509_cred, cafile,
255 GNUTLS_X509_FMT_PEM);
257 DEBUG(0,("TLS failed to initialise cafile %s\n", cafile));
262 if (crlfile && *crlfile) {
263 ret = gnutls_certificate_set_x509_crl_file(tls->x509_cred,
265 GNUTLS_X509_FMT_PEM);
267 DEBUG(0,("TLS failed to initialise crlfile %s\n", crlfile));
272 ret = gnutls_certificate_set_x509_key_file(tls->x509_cred,
274 GNUTLS_X509_FMT_PEM);
276 DEBUG(0,("TLS failed to initialise certfile %s and keyfile %s\n",
281 ret = gnutls_dh_params_init(&tls->dh_params);
282 if (ret < 0) goto init_failed;
284 ret = gnutls_dh_params_generate2(tls->dh_params, DH_BITS);
285 if (ret < 0) goto init_failed;
287 gnutls_certificate_set_dh_params(tls->x509_cred, tls->dh_params);
291 DEBUG(0,("GNUTLS failed to initialise - %s\n", gnutls_strerror(ret)));
293 edata->tls_data = NULL;
298 setup for a new connection
300 NTSTATUS tls_init_connection(struct websrv_context *web)
302 struct esp_data *edata = talloc_get_type(web->task->private, struct esp_data);
303 struct tls_data *tls_data = talloc_get_type(edata->tls_data, struct tls_data);
304 struct tls_session *tls_session;
307 if (edata->tls_data == NULL) {
308 web->tls_session = NULL;
312 #define TLSCHECK(call) do { \
315 DEBUG(0,("TLS %s - %s\n", #call, gnutls_strerror(ret))); \
320 tls_session = talloc_zero(web, struct tls_session);
321 web->tls_session = tls_session;
323 TLSCHECK(gnutls_init(&tls_session->session, GNUTLS_SERVER));
325 talloc_set_destructor(tls_session, tls_destructor);
327 TLSCHECK(gnutls_set_default_priority(tls_session->session));
328 TLSCHECK(gnutls_credentials_set(tls_session->session, GNUTLS_CRD_CERTIFICATE, tls_data->x509_cred));
329 gnutls_certificate_server_set_request(tls_session->session, GNUTLS_CERT_REQUEST);
330 gnutls_dh_set_prime_bits(tls_session->session, DH_BITS);
331 gnutls_transport_set_ptr(tls_session->session, (gnutls_transport_ptr)web);
332 gnutls_transport_set_pull_function(tls_session->session, (gnutls_pull_func)tls_pull);
333 gnutls_transport_set_push_function(tls_session->session, (gnutls_push_func)tls_push);
334 gnutls_transport_set_lowat(tls_session->session, 0);
336 web->input.tls_detect = True;
341 DEBUG(0,("TLS init connection failed - %s\n", gnutls_strerror(ret)));
342 web->tls_session = NULL;
343 talloc_free(tls_session);
350 /* for systems without tls we just map the tls socket calls to the
351 normal socket calls */
352 NTSTATUS tls_socket_recv(struct websrv_context *web, void *buf, size_t wantlen,
355 return socket_recv(web->conn->socket, buf, wantlen, nread, 0);
358 NTSTATUS tls_socket_send(struct websrv_context *web, const DATA_BLOB *blob,
361 return socket_send(web->conn->socket, blob, sendlen, 0);
364 NTSTATUS tls_init_connection(struct websrv_context *web)
366 web->tls_session = NULL;
370 void tls_initialise(struct task_server *task)
372 struct esp_data *edata = talloc_get_type(task->private, struct esp_data);
373 edata->tls_data = NULL;