cups/tls-gnutls.c

   1 /*
   2  * TLS support code for CUPS using GNU TLS.
   3  *
   4  * Copyright © 2007-2018 by Apple Inc.
   5  * Copyright © 1997-2007 by Easy Software Products, all rights reserved.
   6  *
   7  * These coded instructions, statements, and computer programs are the
   8  * property of Apple Inc. and are protected by Federal copyright
   9  * law.  Distribution and use rights are outlined in the file "LICENSE.txt"
  10  * which should have been included with this file.  If this file is
  11  * missing or damaged, see the license at "http://www.cups.org/".
  12  *
  13  * This file is subject to the Apple OS-Developed Software exception.
  14  */
  15
  16 /**** This file is included from tls.c ****/
  17
  18 /*
  19  * Include necessary headers...
  20  */
  21
  22 #include <sys/stat.h>
  23
  24
  25 /*
  26  * Local globals...
  27  */
  28
  29 static int              tls_auto_create = 0;
  30                                         /* Auto-create self-signed certs? */
  31 static char             *tls_common_name = NULL;
  32                                         /* Default common name */
  33 static gnutls_x509_crl_t tls_crl = NULL;/* Certificate revocation list */
  34 static char             *tls_keypath = NULL;
  35                                         /* Server cert keychain path */
  36 static _cups_mutex_t    tls_mutex = _CUPS_MUTEX_INITIALIZER;
  37                                         /* Mutex for keychain/certs */
  38 static int              tls_options = -1,/* Options for TLS connections */
  39                         tls_min_version = _HTTP_TLS_1_0,
  40                         tls_max_version = _HTTP_TLS_MAX;
  41
  42
  43 /*
  44  * Local functions...
  45  */
  46
  47 static gnutls_x509_crt_t http_gnutls_create_credential(http_credential_t *credential);
  48 static const char       *http_gnutls_default_path(char *buffer, size_t bufsize);
  49 static void             http_gnutls_load_crl(void);
  50 static const char       *http_gnutls_make_path(char *buffer, size_t bufsize, const char *dirname, const char *filename, const char *ext);
  51 static ssize_t          http_gnutls_read(gnutls_transport_ptr_t ptr, void *data, size_t length);
  52 static ssize_t          http_gnutls_write(gnutls_transport_ptr_t ptr, const void *data, size_t length);
  53
  54
  55 /*
  56  * 'cupsMakeServerCredentials()' - Make a self-signed certificate and private key pair.
  57  *
  58  * @since CUPS 2.0/OS 10.10@
  59  */
  60
  61 int                                     /* O - 1 on success, 0 on failure */
  62 cupsMakeServerCredentials(
  63     const char *path,                   /* I - Path to keychain/directory */
  64     const char *common_name,            /* I - Common name */
  65     int        num_alt_names,           /* I - Number of subject alternate names */
  66     const char **alt_names,             /* I - Subject Alternate Names */
  67     time_t     expiration_date)         /* I - Expiration date */
  68 {
  69   gnutls_x509_crt_t     crt;            /* Self-signed certificate */
  70   gnutls_x509_privkey_t key;            /* Encryption private key */
  71   char                  temp[1024],     /* Temporary directory name */
  72                         crtfile[1024],  /* Certificate filename */
  73                         keyfile[1024];  /* Private key filename */
  74   cups_lang_t           *language;      /* Default language info */
  75   cups_file_t           *fp;            /* Key/cert file */
  76   unsigned char         buffer[8192];   /* Buffer for x509 data */
  77   size_t                bytes;          /* Number of bytes of data */
  78   unsigned char         serial[4];      /* Serial number buffer */
  79   time_t                curtime;        /* Current time */
  80   int                   result;         /* Result of GNU TLS calls */
  81
  82
  83   DEBUG_printf(("cupsMakeServerCredentials(path=\"%s\", common_name=\"%s\", num_alt_names=%d, alt_names=%p, expiration_date=%d)", path, common_name, num_alt_names, alt_names, (int)expiration_date));
  84
  85  /*
  86   * Filenames...
  87   */
  88
  89   if (!path)
  90     path = http_gnutls_default_path(temp, sizeof(temp));
  91
  92   if (!path || !common_name)
  93   {
  94     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(EINVAL), 0);
  95     return (0);
  96   }
  97
  98   http_gnutls_make_path(crtfile, sizeof(crtfile), path, common_name, "crt");
  99   http_gnutls_make_path(keyfile, sizeof(keyfile), path, common_name, "key");
 100
 101  /*
 102   * Create the encryption key...
 103   */
 104
 105   DEBUG_puts("1cupsMakeServerCredentials: Creating key pair.");
 106
 107   gnutls_x509_privkey_init(&key);
 108   gnutls_x509_privkey_generate(key, GNUTLS_PK_RSA, 2048, 0);
 109
 110   DEBUG_puts("1cupsMakeServerCredentials: Key pair created.");
 111
 112  /*
 113   * Save it...
 114   */
 115
 116   bytes = sizeof(buffer);
 117
 118   if ((result = gnutls_x509_privkey_export(key, GNUTLS_X509_FMT_PEM, buffer, &bytes)) < 0)
 119   {
 120     DEBUG_printf(("1cupsMakeServerCredentials: Unable to export private key: %s", gnutls_strerror(result)));
 121     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, gnutls_strerror(result), 0);
 122     gnutls_x509_privkey_deinit(key);
 123     return (0);
 124   }
 125   else if ((fp = cupsFileOpen(keyfile, "w")) != NULL)
 126   {
 127     DEBUG_printf(("1cupsMakeServerCredentials: Writing private key to \"%s\".", keyfile));
 128     cupsFileWrite(fp, (char *)buffer, bytes);
 129     cupsFileClose(fp);
 130   }
 131   else
 132   {
 133     DEBUG_printf(("1cupsMakeServerCredentials: Unable to create private key file \"%s\": %s", keyfile, strerror(errno)));
 134     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(errno), 0);
 135     gnutls_x509_privkey_deinit(key);
 136     return (0);
 137   }
 138
 139  /*
 140   * Create the self-signed certificate...
 141   */
 142
 143   DEBUG_puts("1cupsMakeServerCredentials: Generating self-signed X.509 certificate.");
 144
 145   language  = cupsLangDefault();
 146   curtime   = time(NULL);
 147   serial[0] = curtime >> 24;
 148   serial[1] = curtime >> 16;
 149   serial[2] = curtime >> 8;
 150   serial[3] = curtime;
 151
 152   gnutls_x509_crt_init(&crt);
 153   if (strlen(language->language) == 5)
 154     gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_COUNTRY_NAME, 0,
 155                                   language->language + 3, 2);
 156   else
 157     gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_COUNTRY_NAME, 0,
 158                                   "US", 2);
 159   gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_COMMON_NAME, 0,
 160                                 common_name, strlen(common_name));
 161   gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_ORGANIZATION_NAME, 0,
 162                                 common_name, strlen(common_name));
 163   gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_ORGANIZATIONAL_UNIT_NAME,
 164                                 0, "Unknown", 7);
 165   gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_STATE_OR_PROVINCE_NAME, 0,
 166                                 "Unknown", 7);
 167   gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_LOCALITY_NAME, 0,
 168                                 "Unknown", 7);
 169 /*  gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_PKCS9_EMAIL, 0,
 170                                 ServerAdmin, strlen(ServerAdmin));*/
 171   gnutls_x509_crt_set_key(crt, key);
 172   gnutls_x509_crt_set_serial(crt, serial, sizeof(serial));
 173   gnutls_x509_crt_set_activation_time(crt, curtime);
 174   gnutls_x509_crt_set_expiration_time(crt, curtime + 10 * 365 * 86400);
 175   gnutls_x509_crt_set_ca_status(crt, 0);
 176   if (num_alt_names > 0)
 177     gnutls_x509_crt_set_subject_alternative_name(crt, GNUTLS_SAN_DNSNAME, alt_names[0]);
 178   gnutls_x509_crt_set_key_purpose_oid(crt, GNUTLS_KP_TLS_WWW_SERVER, 0);
 179   gnutls_x509_crt_set_key_usage(crt, GNUTLS_KEY_KEY_ENCIPHERMENT);
 180   gnutls_x509_crt_set_version(crt, 3);
 181
 182   bytes = sizeof(buffer);
 183   if (gnutls_x509_crt_get_key_id(crt, 0, buffer, &bytes) >= 0)
 184     gnutls_x509_crt_set_subject_key_id(crt, buffer, bytes);
 185
 186   gnutls_x509_crt_sign(crt, crt, key);
 187
 188  /*
 189   * Save it...
 190   */
 191
 192   bytes = sizeof(buffer);
 193   if ((result = gnutls_x509_crt_export(crt, GNUTLS_X509_FMT_PEM, buffer, &bytes)) < 0)
 194   {
 195     DEBUG_printf(("1cupsMakeServerCredentials: Unable to export public key and X.509 certificate: %s", gnutls_strerror(result)));
 196     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, gnutls_strerror(result), 0);
 197     gnutls_x509_crt_deinit(crt);
 198     gnutls_x509_privkey_deinit(key);
 199     return (0);
 200   }
 201   else if ((fp = cupsFileOpen(crtfile, "w")) != NULL)
 202   {
 203     DEBUG_printf(("1cupsMakeServerCredentials: Writing public key and X.509 certificate to \"%s\".", crtfile));
 204     cupsFileWrite(fp, (char *)buffer, bytes);
 205     cupsFileClose(fp);
 206   }
 207   else
 208   {
 209     DEBUG_printf(("1cupsMakeServerCredentials: Unable to create public key and X.509 certificate file \"%s\": %s", crtfile, strerror(errno)));
 210     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(errno), 0);
 211     gnutls_x509_crt_deinit(crt);
 212     gnutls_x509_privkey_deinit(key);
 213     return (0);
 214   }
 215
 216  /*
 217   * Cleanup...
 218   */
 219
 220   gnutls_x509_crt_deinit(crt);
 221   gnutls_x509_privkey_deinit(key);
 222
 223   DEBUG_puts("1cupsMakeServerCredentials: Successfully created credentials.");
 224
 225   return (1);
 226 }
 227
 228
 229 /*
 230  * 'cupsSetServerCredentials()' - Set the default server credentials.
 231  *
 232  * Note: The server credentials are used by all threads in the running process.
 233  * This function is threadsafe.
 234  *
 235  * @since CUPS 2.0/OS 10.10@
 236  */
 237
 238 int                                     /* O - 1 on success, 0 on failure */
 239 cupsSetServerCredentials(
 240     const char *path,                   /* I - Path to keychain/directory */
 241     const char *common_name,            /* I - Default common name for server */
 242     int        auto_create)             /* I - 1 = automatically create self-signed certificates */
 243 {
 244   char  temp[1024];                     /* Default path buffer */
 245
 246
 247   DEBUG_printf(("cupsSetServerCredentials(path=\"%s\", common_name=\"%s\", auto_create=%d)", path, common_name, auto_create));
 248
 249  /*
 250   * Use defaults as needed...
 251   */
 252
 253   if (!path)
 254     path = http_gnutls_default_path(temp, sizeof(temp));
 255
 256  /*
 257   * Range check input...
 258   */
 259
 260   if (!path || !common_name)
 261   {
 262     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(EINVAL), 0);
 263     return (0);
 264   }
 265
 266   _cupsMutexLock(&tls_mutex);
 267
 268  /*
 269   * Free old values...
 270   */
 271
 272   if (tls_keypath)
 273     _cupsStrFree(tls_keypath);
 274
 275   if (tls_common_name)
 276     _cupsStrFree(tls_common_name);
 277
 278  /*
 279   * Save the new values...
 280   */
 281
 282   tls_keypath     = _cupsStrAlloc(path);
 283   tls_auto_create = auto_create;
 284   tls_common_name = _cupsStrAlloc(common_name);
 285
 286   _cupsMutexUnlock(&tls_mutex);
 287
 288   return (1);
 289 }
 290
 291
 292 /*
 293  * 'httpCopyCredentials()' - Copy the credentials associated with the peer in
 294  *                           an encrypted connection.
 295  *
 296  * @since CUPS 1.5/macOS 10.7@
 297  */
 298
 299 int                                     /* O - Status of call (0 = success) */
 300 httpCopyCredentials(
 301     http_t       *http,                 /* I - Connection to server */
 302     cups_array_t **credentials)         /* O - Array of credentials */
 303 {
 304   unsigned              count;          /* Number of certificates */
 305   const gnutls_datum_t *certs;          /* Certificates */
 306
 307
 308   DEBUG_printf(("httpCopyCredentials(http=%p, credentials=%p)", http, credentials));
 309
 310   if (credentials)
 311     *credentials = NULL;
 312
 313   if (!http || !http->tls || !credentials)
 314     return (-1);
 315
 316   *credentials = cupsArrayNew(NULL, NULL);
 317   certs        = gnutls_certificate_get_peers(http->tls, &count);
 318
 319   DEBUG_printf(("1httpCopyCredentials: certs=%p, count=%u", certs, count));
 320
 321   if (certs && count)
 322   {
 323     while (count > 0)
 324     {
 325       httpAddCredential(*credentials, certs->data, certs->size);
 326       certs ++;
 327       count --;
 328     }
 329   }
 330
 331   return (0);
 332 }
 333
 334
 335 /*
 336  * '_httpCreateCredentials()' - Create credentials in the internal format.
 337  */
 338
 339 http_tls_credentials_t                  /* O - Internal credentials */
 340 _httpCreateCredentials(
 341     cups_array_t *credentials)          /* I - Array of credentials */
 342 {
 343   (void)credentials;
 344
 345   return (NULL);
 346 }
 347
 348
 349 /*
 350  * '_httpFreeCredentials()' - Free internal credentials.
 351  */
 352
 353 void
 354 _httpFreeCredentials(
 355     http_tls_credentials_t credentials) /* I - Internal credentials */
 356 {
 357   (void)credentials;
 358 }
 359
 360
 361 /*
 362  * 'httpCredentialsAreValidForName()' - Return whether the credentials are valid for the given name.
 363  *
 364  * @since CUPS 2.0/OS 10.10@
 365  */
 366
 367 int                                     /* O - 1 if valid, 0 otherwise */
 368 httpCredentialsAreValidForName(
 369     cups_array_t *credentials,          /* I - Credentials */
 370     const char   *common_name)          /* I - Name to check */
 371 {
 372   gnutls_x509_crt_t     cert;           /* Certificate */
 373   int                   result = 0;     /* Result */
 374
 375
 376   cert = http_gnutls_create_credential((http_credential_t *)cupsArrayFirst(credentials));
 377   if (cert)
 378   {
 379     result = gnutls_x509_crt_check_hostname(cert, common_name) != 0;
 380
 381     if (result)
 382     {
 383       int               i,              /* Looping var */
 384                         count;          /* Number of revoked certificates */
 385       unsigned char     cserial[1024],  /* Certificate serial number */
 386                         rserial[1024];  /* Revoked serial number */
 387       size_t            cserial_size,   /* Size of cert serial number */
 388                         rserial_size;   /* Size of revoked serial number */
 389
 390       _cupsMutexLock(&tls_mutex);
 391
 392       count = gnutls_x509_crl_get_crt_count(tls_crl);
 393
 394       if (count > 0)
 395       {
 396         cserial_size = sizeof(cserial);
 397         gnutls_x509_crt_get_serial(cert, cserial, &cserial_size);
 398
 399         for (i = 0; i < count; i ++)
 400         {
 401           rserial_size = sizeof(rserial);
 402           if (!gnutls_x509_crl_get_crt_serial(tls_crl, (unsigned)i, rserial, &rserial_size, NULL) && cserial_size == rserial_size && !memcmp(cserial, rserial, (int)rserial_size))
 403           {
 404             result = 0;
 405             break;
 406           }
 407         }
 408       }
 409
 410       _cupsMutexUnlock(&tls_mutex);
 411     }
 412
 413     gnutls_x509_crt_deinit(cert);
 414   }
 415
 416   return (result);
 417 }
 418
 419
 420 /*
 421  * 'httpCredentialsGetTrust()' - Return the trust of credentials.
 422  *
 423  * @since CUPS 2.0/OS 10.10@
 424  */
 425
 426 http_trust_t                            /* O - Level of trust */
 427 httpCredentialsGetTrust(
 428     cups_array_t *credentials,          /* I - Credentials */
 429     const char   *common_name)          /* I - Common name for trust lookup */
 430 {
 431   http_trust_t          trust = HTTP_TRUST_OK;
 432                                         /* Trusted? */
 433   gnutls_x509_crt_t     cert;           /* Certificate */
 434   cups_array_t          *tcreds = NULL; /* Trusted credentials */
 435   _cups_globals_t       *cg = _cupsGlobals();
 436                                         /* Per-thread globals */
 437
 438
 439   if (!common_name)
 440   {
 441     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("No common name specified."), 1);
 442     return (HTTP_TRUST_UNKNOWN);
 443   }
 444
 445   if ((cert = http_gnutls_create_credential((http_credential_t *)cupsArrayFirst(credentials))) == NULL)
 446   {
 447     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create credentials from array."), 1);
 448     return (HTTP_TRUST_UNKNOWN);
 449   }
 450
 451   if (cg->any_root < 0)
 452   {
 453     _cupsSetDefaults();
 454     http_gnutls_load_crl();
 455   }
 456
 457  /*
 458   * Look this common name up in the default keychains...
 459   */
 460
 461   httpLoadCredentials(NULL, &tcreds, common_name);
 462
 463   if (tcreds)
 464   {
 465     char        credentials_str[1024],  /* String for incoming credentials */
 466                 tcreds_str[1024];       /* String for saved credentials */
 467
 468     httpCredentialsString(credentials, credentials_str, sizeof(credentials_str));
 469     httpCredentialsString(tcreds, tcreds_str, sizeof(tcreds_str));
 470
 471     if (strcmp(credentials_str, tcreds_str))
 472     {
 473      /*
 474       * Credentials don't match, let's look at the expiration date of the new
 475       * credentials and allow if the new ones have a later expiration...
 476       */
 477
 478       if (!cg->trust_first)
 479       {
 480        /*
 481         * Do not trust certificates on first use...
 482         */
 483
 484         _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Trust on first use is disabled."), 1);
 485
 486         trust = HTTP_TRUST_INVALID;
 487       }
 488       else if (httpCredentialsGetExpiration(credentials) <= httpCredentialsGetExpiration(tcreds))
 489       {
 490        /*
 491         * The new credentials are not newly issued...
 492         */
 493
 494         _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("New credentials are older than stored credentials."), 1);
 495
 496         trust = HTTP_TRUST_INVALID;
 497       }
 498       else if (!httpCredentialsAreValidForName(credentials, common_name))
 499       {
 500        /*
 501         * The common name does not match the issued certificate...
 502         */
 503
 504         _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("New credentials are not valid for name."), 1);
 505
 506         trust = HTTP_TRUST_INVALID;
 507       }
 508       else if (httpCredentialsGetExpiration(tcreds) < time(NULL))
 509       {
 510        /*
 511         * Save the renewed credentials...
 512         */
 513
 514         trust = HTTP_TRUST_RENEWED;
 515
 516         httpSaveCredentials(NULL, credentials, common_name);
 517       }
 518     }
 519
 520     httpFreeCredentials(tcreds);
 521   }
 522   else if (cg->validate_certs && !httpCredentialsAreValidForName(credentials, common_name))
 523   {
 524     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("No stored credentials, not valid for name."), 1);
 525     trust = HTTP_TRUST_INVALID;
 526   }
 527   else if (!cg->trust_first)
 528   {
 529    /*
 530     * See if we have a site CA certificate we can compare...
 531     */
 532
 533     if (!httpLoadCredentials(NULL, &tcreds, "site"))
 534     {
 535       if (cupsArrayCount(credentials) != (cupsArrayCount(tcreds) + 1))
 536       {
 537        /*
 538         * Certificate isn't directly generated from the CA cert...
 539         */
 540
 541         trust = HTTP_TRUST_INVALID;
 542       }
 543       else
 544       {
 545        /*
 546         * Do a tail comparison of the two certificates...
 547         */
 548
 549         http_credential_t       *a, *b;         /* Certificates */
 550
 551         for (a = (http_credential_t *)cupsArrayFirst(tcreds), b = (http_credential_t *)cupsArrayIndex(credentials, 1);
 552              a && b;
 553              a = (http_credential_t *)cupsArrayNext(tcreds), b = (http_credential_t *)cupsArrayNext(credentials))
 554           if (a->datalen != b->datalen || memcmp(a->data, b->data, a->datalen))
 555             break;
 556
 557         if (a || b)
 558           trust = HTTP_TRUST_INVALID;
 559       }
 560
 561       if (trust != HTTP_TRUST_OK)
 562         _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Credentials do not validate against site CA certificate."), 1);
 563     }
 564     else
 565     {
 566       _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Trust on first use is disabled."), 1);
 567       trust = HTTP_TRUST_INVALID;
 568     }
 569   }
 570
 571   if (trust == HTTP_TRUST_OK && !cg->expired_certs)
 572   {
 573     time_t      curtime;                /* Current date/time */
 574
 575     time(&curtime);
 576     if (curtime < gnutls_x509_crt_get_activation_time(cert) ||
 577         curtime > gnutls_x509_crt_get_expiration_time(cert))
 578     {
 579       _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Credentials have expired."), 1);
 580       trust = HTTP_TRUST_EXPIRED;
 581     }
 582   }
 583
 584   if (trust == HTTP_TRUST_OK && !cg->any_root && cupsArrayCount(credentials) == 1)
 585   {
 586     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Self-signed credentials are blocked."), 1);
 587     trust = HTTP_TRUST_INVALID;
 588   }
 589
 590   gnutls_x509_crt_deinit(cert);
 591
 592   return (trust);
 593 }
 594
 595
 596 /*
 597  * 'httpCredentialsGetExpiration()' - Return the expiration date of the credentials.
 598  *
 599  * @since CUPS 2.0/OS 10.10@
 600  */
 601
 602 time_t                                  /* O - Expiration date of credentials */
 603 httpCredentialsGetExpiration(
 604     cups_array_t *credentials)          /* I - Credentials */
 605 {
 606   gnutls_x509_crt_t     cert;           /* Certificate */
 607   time_t                result = 0;     /* Result */
 608
 609
 610   cert = http_gnutls_create_credential((http_credential_t *)cupsArrayFirst(credentials));
 611   if (cert)
 612   {
 613     result = gnutls_x509_crt_get_expiration_time(cert);
 614     gnutls_x509_crt_deinit(cert);
 615   }
 616
 617   return (result);
 618 }
 619
 620
 621 /*
 622  * 'httpCredentialsString()' - Return a string representing the credentials.
 623  *
 624  * @since CUPS 2.0/OS 10.10@
 625  */
 626
 627 size_t                                  /* O - Total size of credentials string */
 628 httpCredentialsString(
 629     cups_array_t *credentials,          /* I - Credentials */
 630     char         *buffer,               /* I - Buffer or @code NULL@ */
 631     size_t       bufsize)               /* I - Size of buffer */
 632 {
 633   http_credential_t     *first;         /* First certificate */
 634   gnutls_x509_crt_t     cert;           /* Certificate */
 635
 636
 637   DEBUG_printf(("httpCredentialsString(credentials=%p, buffer=%p, bufsize=" CUPS_LLFMT ")", credentials, buffer, CUPS_LLCAST bufsize));
 638
 639   if (!buffer)
 640     return (0);
 641
 642   if (buffer && bufsize > 0)
 643     *buffer = '\0';
 644
 645   if ((first = (http_credential_t *)cupsArrayFirst(credentials)) != NULL &&
 646       (cert = http_gnutls_create_credential(first)) != NULL)
 647   {
 648     char                name[256];      /* Common name associated with cert */
 649     size_t              namelen;        /* Length of name */
 650     time_t              expiration;     /* Expiration date of cert */
 651     unsigned char       md5_digest[16]; /* MD5 result */
 652
 653     namelen = sizeof(name) - 1;
 654     if (gnutls_x509_crt_get_dn_by_oid(cert, GNUTLS_OID_X520_COMMON_NAME, 0, 0, name, &namelen) >= 0)
 655       name[namelen] = '\0';
 656     else
 657       strlcpy(name, "unknown", sizeof(name));
 658
 659     expiration = gnutls_x509_crt_get_expiration_time(cert);
 660
 661     cupsHashData("md5", first->data, first->datalen, md5_digest, sizeof(md5_digest));
 662
 663     snprintf(buffer, bufsize, "%s / %s / %02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X", name, httpGetDateString(expiration), md5_digest[0], md5_digest[1], md5_digest[2], md5_digest[3], md5_digest[4], md5_digest[5], md5_digest[6], md5_digest[7], md5_digest[8], md5_digest[9], md5_digest[10], md5_digest[11], md5_digest[12], md5_digest[13], md5_digest[14], md5_digest[15]);
 664
 665     gnutls_x509_crt_deinit(cert);
 666   }
 667
 668   DEBUG_printf(("1httpCredentialsString: Returning \"%s\".", buffer));
 669
 670   return (strlen(buffer));
 671 }
 672
 673
 674 /*
 675  * 'httpLoadCredentials()' - Load X.509 credentials from a keychain file.
 676  *
 677  * @since CUPS 2.0/OS 10.10@
 678  */
 679
 680 int                                     /* O - 0 on success, -1 on error */
 681 httpLoadCredentials(
 682     const char   *path,                 /* I  - Keychain/PKCS#12 path */
 683     cups_array_t **credentials,         /* IO - Credentials */
 684     const char   *common_name)          /* I  - Common name for credentials */
 685 {
 686   cups_file_t           *fp;            /* Certificate file */
 687   char                  filename[1024], /* filename.crt */
 688                         temp[1024],     /* Temporary string */
 689                         line[256];      /* Base64-encoded line */
 690   unsigned char         *data = NULL;   /* Buffer for cert data */
 691   size_t                alloc_data = 0, /* Bytes allocated */
 692                         num_data = 0;   /* Bytes used */
 693   int                   decoded;        /* Bytes decoded */
 694   int                   in_certificate = 0;
 695                                         /* In a certificate? */
 696
 697
 698   if (!credentials || !common_name)
 699     return (-1);
 700
 701   if (!path)
 702     path = http_gnutls_default_path(temp, sizeof(temp));
 703   if (!path)
 704     return (-1);
 705
 706   http_gnutls_make_path(filename, sizeof(filename), path, common_name, "crt");
 707
 708   if ((fp = cupsFileOpen(filename, "r")) == NULL)
 709     return (-1);
 710
 711   while (cupsFileGets(fp, line, sizeof(line)))
 712   {
 713     if (!strcmp(line, "-----BEGIN CERTIFICATE-----"))
 714     {
 715       if (in_certificate)
 716       {
 717        /*
 718         * Missing END CERTIFICATE...
 719         */
 720
 721         httpFreeCredentials(*credentials);
 722         *credentials = NULL;
 723         break;
 724       }
 725
 726       in_certificate = 1;
 727     }
 728     else if (!strcmp(line, "-----END CERTIFICATE-----"))
 729     {
 730       if (!in_certificate || !num_data)
 731       {
 732        /*
 733         * Missing data...
 734         */
 735
 736         httpFreeCredentials(*credentials);
 737         *credentials = NULL;
 738         break;
 739       }
 740
 741       if (!*credentials)
 742         *credentials = cupsArrayNew(NULL, NULL);
 743
 744       if (httpAddCredential(*credentials, data, num_data))
 745       {
 746         httpFreeCredentials(*credentials);
 747         *credentials = NULL;
 748         break;
 749       }
 750
 751       num_data       = 0;
 752       in_certificate = 0;
 753     }
 754     else if (in_certificate)
 755     {
 756       if (alloc_data == 0)
 757       {
 758         data       = malloc(2048);
 759         alloc_data = 2048;
 760
 761         if (!data)
 762           break;
 763       }
 764       else if ((num_data + strlen(line)) >= alloc_data)
 765       {
 766         unsigned char *tdata = realloc(data, alloc_data + 1024);
 767                                         /* Expanded buffer */
 768
 769         if (!tdata)
 770         {
 771           httpFreeCredentials(*credentials);
 772           *credentials = NULL;
 773           break;
 774         }
 775
 776         data       = tdata;
 777         alloc_data += 1024;
 778       }
 779
 780       decoded = alloc_data - num_data;
 781       httpDecode64_2((char *)data + num_data, &decoded, line);
 782       num_data += (size_t)decoded;
 783     }
 784   }
 785
 786   cupsFileClose(fp);
 787
 788   if (in_certificate)
 789   {
 790    /*
 791     * Missing END CERTIFICATE...
 792     */
 793
 794     httpFreeCredentials(*credentials);
 795     *credentials = NULL;
 796   }
 797
 798   if (data)
 799     free(data);
 800
 801   return (*credentials ? 0 : -1);
 802 }
 803
 804
 805 /*
 806  * 'httpSaveCredentials()' - Save X.509 credentials to a keychain file.
 807  *
 808  * @since CUPS 2.0/OS 10.10@
 809  */
 810
 811 int                                     /* O - -1 on error, 0 on success */
 812 httpSaveCredentials(
 813     const char   *path,                 /* I - Keychain/PKCS#12 path */
 814     cups_array_t *credentials,          /* I - Credentials */
 815     const char   *common_name)          /* I - Common name for credentials */
 816 {
 817   cups_file_t           *fp;            /* Certificate file */
 818   char                  filename[1024], /* filename.crt */
 819                         nfilename[1024],/* filename.crt.N */
 820                         temp[1024],     /* Temporary string */
 821                         line[256];      /* Base64-encoded line */
 822   const unsigned char   *ptr;           /* Pointer into certificate */
 823   ssize_t               remaining;      /* Bytes left */
 824   http_credential_t     *cred;          /* Current credential */
 825
 826
 827   if (!credentials || !common_name)
 828     return (-1);
 829
 830   if (!path)
 831     path = http_gnutls_default_path(temp, sizeof(temp));
 832   if (!path)
 833     return (-1);
 834
 835   http_gnutls_make_path(filename, sizeof(filename), path, common_name, "crt");
 836   snprintf(nfilename, sizeof(nfilename), "%s.N", filename);
 837
 838   if ((fp = cupsFileOpen(nfilename, "w")) == NULL)
 839     return (-1);
 840
 841   fchmod(cupsFileNumber(fp), 0600);
 842
 843   for (cred = (http_credential_t *)cupsArrayFirst(credentials);
 844        cred;
 845        cred = (http_credential_t *)cupsArrayNext(credentials))
 846   {
 847     cupsFilePuts(fp, "-----BEGIN CERTIFICATE-----\n");
 848     for (ptr = cred->data, remaining = (ssize_t)cred->datalen; remaining > 0; remaining -= 45, ptr += 45)
 849     {
 850       httpEncode64_2(line, sizeof(line), (char *)ptr, remaining > 45 ? 45 : remaining);
 851       cupsFilePrintf(fp, "%s\n", line);
 852     }
 853     cupsFilePuts(fp, "-----END CERTIFICATE-----\n");
 854   }
 855
 856   cupsFileClose(fp);
 857
 858   return (rename(nfilename, filename));
 859 }
 860
 861
 862 /*
 863  * 'http_gnutls_create_credential()' - Create a single credential in the internal format.
 864  */
 865
 866 static gnutls_x509_crt_t                        /* O - Certificate */
 867 http_gnutls_create_credential(
 868     http_credential_t *credential)              /* I - Credential */
 869 {
 870   int                   result;                 /* Result from GNU TLS */
 871   gnutls_x509_crt_t     cert;                   /* Certificate */
 872   gnutls_datum_t        datum;                  /* Data record */
 873
 874
 875   DEBUG_printf(("3http_gnutls_create_credential(credential=%p)", credential));
 876
 877   if (!credential)
 878     return (NULL);
 879
 880   if ((result = gnutls_x509_crt_init(&cert)) < 0)
 881   {
 882     DEBUG_printf(("4http_gnutls_create_credential: init error: %s", gnutls_strerror(result)));
 883     return (NULL);
 884   }
 885
 886   datum.data = credential->data;
 887   datum.size = credential->datalen;
 888
 889   if ((result = gnutls_x509_crt_import(cert, &datum, GNUTLS_X509_FMT_DER)) < 0)
 890   {
 891     DEBUG_printf(("4http_gnutls_create_credential: import error: %s", gnutls_strerror(result)));
 892
 893     gnutls_x509_crt_deinit(cert);
 894     return (NULL);
 895   }
 896
 897   return (cert);
 898 }
 899
 900
 901 /*
 902  * 'http_gnutls_default_path()' - Get the default credential store path.
 903  */
 904
 905 static const char *                     /* O - Path or NULL on error */
 906 http_gnutls_default_path(char   *buffer,/* I - Path buffer */
 907                          size_t bufsize)/* I - Size of path buffer */
 908 {
 909   const char *home = getenv("HOME");    /* HOME environment variable */
 910
 911
 912   if (getuid() && home)
 913   {
 914     snprintf(buffer, bufsize, "%s/.cups", home);
 915     if (access(buffer, 0))
 916     {
 917       DEBUG_printf(("1http_gnutls_default_path: Making directory \"%s\".", buffer));
 918       if (mkdir(buffer, 0700))
 919       {
 920         DEBUG_printf(("1http_gnutls_default_path: Failed to make directory: %s", strerror(errno)));
 921         return (NULL);
 922       }
 923     }
 924
 925     snprintf(buffer, bufsize, "%s/.cups/ssl", home);
 926     if (access(buffer, 0))
 927     {
 928       DEBUG_printf(("1http_gnutls_default_path: Making directory \"%s\".", buffer));
 929       if (mkdir(buffer, 0700))
 930       {
 931         DEBUG_printf(("1http_gnutls_default_path: Failed to make directory: %s", strerror(errno)));
 932         return (NULL);
 933       }
 934     }
 935   }
 936   else
 937     strlcpy(buffer, CUPS_SERVERROOT "/ssl", bufsize);
 938
 939   DEBUG_printf(("1http_gnutls_default_path: Using default path \"%s\".", buffer));
 940
 941   return (buffer);
 942 }
 943
 944
 945 /*
 946  * 'http_gnutls_load_crl()' - Load the certificate revocation list, if any.
 947  */
 948
 949 static void
 950 http_gnutls_load_crl(void)
 951 {
 952   _cupsMutexLock(&tls_mutex);
 953
 954   if (!gnutls_x509_crl_init(&tls_crl))
 955   {
 956     cups_file_t         *fp;            /* CRL file */
 957     char                filename[1024], /* site.crl */
 958                         line[256];      /* Base64-encoded line */
 959     unsigned char       *data = NULL;   /* Buffer for cert data */
 960     size_t              alloc_data = 0, /* Bytes allocated */
 961                         num_data = 0;   /* Bytes used */
 962     int                 decoded;        /* Bytes decoded */
 963     gnutls_datum_t      datum;          /* Data record */
 964
 965
 966     http_gnutls_make_path(filename, sizeof(filename), CUPS_SERVERROOT, "site", "crl");
 967
 968     if ((fp = cupsFileOpen(filename, "r")) != NULL)
 969     {
 970       while (cupsFileGets(fp, line, sizeof(line)))
 971       {
 972         if (!strcmp(line, "-----BEGIN X509 CRL-----"))
 973         {
 974           if (num_data)
 975           {
 976            /*
 977             * Missing END X509 CRL...
 978             */
 979
 980             break;
 981           }
 982         }
 983         else if (!strcmp(line, "-----END X509 CRL-----"))
 984         {
 985           if (!num_data)
 986           {
 987            /*
 988             * Missing data...
 989             */
 990
 991             break;
 992           }
 993
 994           datum.data = data;
 995           datum.size = num_data;
 996
 997           gnutls_x509_crl_import(tls_crl, &datum, GNUTLS_X509_FMT_PEM);
 998
 999           num_data = 0;
1000         }
1001         else
1002         {
1003           if (alloc_data == 0)
1004           {
1005             data       = malloc(2048);
1006             alloc_data = 2048;
1007
1008             if (!data)
1009               break;
1010           }
1011           else if ((num_data + strlen(line)) >= alloc_data)
1012           {
1013             unsigned char *tdata = realloc(data, alloc_data + 1024);
1014                                             /* Expanded buffer */
1015
1016             if (!tdata)
1017               break;
1018
1019             data       = tdata;
1020             alloc_data += 1024;
1021           }
1022
1023           decoded = alloc_data - num_data;
1024           httpDecode64_2((char *)data + num_data, &decoded, line);
1025           num_data += (size_t)decoded;
1026         }
1027       }
1028
1029       cupsFileClose(fp);
1030
1031       if (data)
1032         free(data);
1033     }
1034   }
1035
1036   _cupsMutexUnlock(&tls_mutex);
1037 }
1038
1039
1040 /*
1041  * 'http_gnutls_make_path()' - Format a filename for a certificate or key file.
1042  */
1043
1044 static const char *                     /* O - Filename */
1045 http_gnutls_make_path(
1046     char       *buffer,                 /* I - Filename buffer */
1047     size_t     bufsize,                 /* I - Size of buffer */
1048     const char *dirname,                /* I - Directory */
1049     const char *filename,               /* I - Filename (usually hostname) */
1050     const char *ext)                    /* I - Extension */
1051 {
1052   char  *bufptr,                        /* Pointer into buffer */
1053         *bufend = buffer + bufsize - 1; /* End of buffer */
1054
1055
1056   snprintf(buffer, bufsize, "%s/", dirname);
1057   bufptr = buffer + strlen(buffer);
1058
1059   while (*filename && bufptr < bufend)
1060   {
1061     if (_cups_isalnum(*filename) || *filename == '-' || *filename == '.')
1062       *bufptr++ = *filename;
1063     else
1064       *bufptr++ = '_';
1065
1066     filename ++;
1067   }
1068
1069   if (bufptr < bufend)
1070     *bufptr++ = '.';
1071
1072   strlcpy(bufptr, ext, (size_t)(bufend - bufptr + 1));
1073
1074   return (buffer);
1075 }
1076
1077
1078 /*
1079  * 'http_gnutls_read()' - Read function for the GNU TLS library.
1080  */
1081
1082 static ssize_t                          /* O - Number of bytes read or -1 on error */
1083 http_gnutls_read(
1084     gnutls_transport_ptr_t ptr,         /* I - Connection to server */
1085     void                   *data,       /* I - Buffer */
1086     size_t                 length)      /* I - Number of bytes to read */
1087 {
1088   http_t        *http;                  /* HTTP connection */
1089   ssize_t       bytes;                  /* Bytes read */
1090
1091
1092   DEBUG_printf(("6http_gnutls_read(ptr=%p, data=%p, length=%d)", ptr, data, (int)length));
1093
1094   http = (http_t *)ptr;
1095
1096   if (!http->blocking || http->timeout_value > 0.0)
1097   {
1098    /*
1099     * Make sure we have data before we read...
1100     */
1101
1102     while (!_httpWait(http, http->wait_value, 0))
1103     {
1104       if (http->timeout_cb && (*http->timeout_cb)(http, http->timeout_data))
1105         continue;
1106
1107       http->error = ETIMEDOUT;
1108       return (-1);
1109     }
1110   }
1111
1112   bytes = recv(http->fd, data, length, 0);
1113   DEBUG_printf(("6http_gnutls_read: bytes=%d", (int)bytes));
1114   return (bytes);
1115 }
1116
1117
1118 /*
1119  * 'http_gnutls_write()' - Write function for the GNU TLS library.
1120  */
1121
1122 static ssize_t                          /* O - Number of bytes written or -1 on error */
1123 http_gnutls_write(
1124     gnutls_transport_ptr_t ptr,         /* I - Connection to server */
1125     const void             *data,       /* I - Data buffer */
1126     size_t                 length)      /* I - Number of bytes to write */
1127 {
1128   ssize_t bytes;                        /* Bytes written */
1129
1130
1131   DEBUG_printf(("6http_gnutls_write(ptr=%p, data=%p, length=%d)", ptr, data,
1132                 (int)length));
1133   bytes = send(((http_t *)ptr)->fd, data, length, 0);
1134   DEBUG_printf(("http_gnutls_write: bytes=%d", (int)bytes));
1135
1136   return (bytes);
1137 }
1138
1139
1140 /*
1141  * '_httpTLSInitialize()' - Initialize the TLS stack.
1142  */
1143
1144 void
1145 _httpTLSInitialize(void)
1146 {
1147  /*
1148   * Initialize GNU TLS...
1149   */
1150
1151   gnutls_global_init();
1152 }
1153
1154
1155 /*
1156  * '_httpTLSPending()' - Return the number of pending TLS-encrypted bytes.
1157  */
1158
1159 size_t                                  /* O - Bytes available */
1160 _httpTLSPending(http_t *http)           /* I - HTTP connection */
1161 {
1162   return (gnutls_record_check_pending(http->tls));
1163 }
1164
1165
1166 /*
1167  * '_httpTLSRead()' - Read from a SSL/TLS connection.
1168  */
1169
1170 int                                     /* O - Bytes read */
1171 _httpTLSRead(http_t *http,              /* I - Connection to server */
1172              char   *buf,               /* I - Buffer to store data */
1173              int    len)                /* I - Length of buffer */
1174 {
1175   ssize_t       result;                 /* Return value */
1176
1177
1178   result = gnutls_record_recv(http->tls, buf, (size_t)len);
1179
1180   if (result < 0 && !errno)
1181   {
1182    /*
1183     * Convert GNU TLS error to errno value...
1184     */
1185
1186     switch (result)
1187     {
1188       case GNUTLS_E_INTERRUPTED :
1189           errno = EINTR;
1190           break;
1191
1192       case GNUTLS_E_AGAIN :
1193           errno = EAGAIN;
1194           break;
1195
1196       default :
1197           errno = EPIPE;
1198           break;
1199     }
1200
1201     result = -1;
1202   }
1203
1204   return ((int)result);
1205 }
1206
1207
1208 /*
1209  * '_httpTLSSetCredentials()' - Set the TLS credentials.
1210  */
1211
1212 int                                     /* O - Status of connection */
1213 _httpTLSSetCredentials(http_t *http)    /* I - Connection to server */
1214 {
1215   (void)http;
1216
1217   return (0);
1218 }
1219
1220
1221 /*
1222  * '_httpTLSSetOptions()' - Set TLS protocol and cipher suite options.
1223  */
1224
1225 void
1226 _httpTLSSetOptions(int options,         /* I - Options */
1227                    int min_version,     /* I - Minimum TLS version */
1228                    int max_version)     /* I - Maximum TLS version */
1229 {
1230   if (!(options & _HTTP_TLS_SET_DEFAULT) || tls_options < 0)
1231   {
1232     tls_options     = options;
1233     tls_min_version = min_version;
1234     tls_max_version = max_version;
1235   }
1236 }
1237
1238
1239 /*
1240  * '_httpTLSStart()' - Set up SSL/TLS support on a connection.
1241  */
1242
1243 int                                     /* O - 0 on success, -1 on failure */
1244 _httpTLSStart(http_t *http)             /* I - Connection to server */
1245 {
1246   char                  hostname[256],  /* Hostname */
1247                         *hostptr;       /* Pointer into hostname */
1248   int                   status;         /* Status of handshake */
1249   gnutls_certificate_credentials_t *credentials;
1250                                         /* TLS credentials */
1251   char                  priority_string[2048];
1252                                         /* Priority string */
1253   int                   version;        /* Current version */
1254   double                old_timeout;    /* Old timeout value */
1255   http_timeout_cb_t     old_cb;         /* Old timeout callback */
1256   void                  *old_data;      /* Old timeout data */
1257   static const char * const versions[] =/* SSL/TLS versions */
1258   {
1259     "VERS-SSL3.0",
1260     "VERS-TLS1.0",
1261     "VERS-TLS1.1",
1262     "VERS-TLS1.2",
1263     "VERS-TLS1.3",
1264     "VERS-TLS-ALL"
1265   };
1266
1267
1268   DEBUG_printf(("3_httpTLSStart(http=%p)", http));
1269
1270   if (tls_options < 0)
1271   {
1272     DEBUG_puts("4_httpTLSStart: Setting defaults.");
1273     _cupsSetDefaults();
1274     DEBUG_printf(("4_httpTLSStart: tls_options=%x", tls_options));
1275   }
1276
1277   if (http->mode == _HTTP_MODE_SERVER && !tls_keypath)
1278   {
1279     DEBUG_puts("4_httpTLSStart: cupsSetServerCredentials not called.");
1280     http->error  = errno = EINVAL;
1281     http->status = HTTP_STATUS_ERROR;
1282     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Server credentials not set."), 1);
1283
1284     return (-1);
1285   }
1286
1287   credentials = (gnutls_certificate_credentials_t *)
1288                     malloc(sizeof(gnutls_certificate_credentials_t));
1289   if (credentials == NULL)
1290   {
1291     DEBUG_printf(("8_httpStartTLS: Unable to allocate credentials: %s",
1292                   strerror(errno)));
1293     http->error  = errno;
1294     http->status = HTTP_STATUS_ERROR;
1295     _cupsSetHTTPError(HTTP_STATUS_ERROR);
1296
1297     return (-1);
1298   }
1299
1300   gnutls_certificate_allocate_credentials(credentials);
1301   status = gnutls_init(&http->tls, http->mode == _HTTP_MODE_CLIENT ? GNUTLS_CLIENT : GNUTLS_SERVER);
1302   if (!status)
1303     status = gnutls_set_default_priority(http->tls);
1304
1305   if (status)
1306   {
1307     http->error  = EIO;
1308     http->status = HTTP_STATUS_ERROR;
1309
1310     DEBUG_printf(("4_httpTLSStart: Unable to initialize common TLS parameters: %s", gnutls_strerror(status)));
1311     _cupsSetError(IPP_STATUS_ERROR_CUPS_PKI, gnutls_strerror(status), 0);
1312
1313     gnutls_deinit(http->tls);
1314     gnutls_certificate_free_credentials(*credentials);
1315     free(credentials);
1316     http->tls = NULL;
1317
1318     return (-1);
1319   }
1320
1321   if (http->mode == _HTTP_MODE_CLIENT)
1322   {
1323    /*
1324     * Client: get the hostname to use for TLS...
1325     */
1326
1327     if (httpAddrLocalhost(http->hostaddr))
1328     {
1329       strlcpy(hostname, "localhost", sizeof(hostname));
1330     }
1331     else
1332     {
1333      /*
1334       * Otherwise make sure the hostname we have does not end in a trailing dot.
1335       */
1336
1337       strlcpy(hostname, http->hostname, sizeof(hostname));
1338       if ((hostptr = hostname + strlen(hostname) - 1) >= hostname &&
1339           *hostptr == '.')
1340         *hostptr = '\0';
1341     }
1342
1343     status = gnutls_server_name_set(http->tls, GNUTLS_NAME_DNS, hostname, strlen(hostname));
1344   }
1345   else
1346   {
1347    /*
1348     * Server: get certificate and private key...
1349     */
1350
1351     char        crtfile[1024],          /* Certificate file */
1352                 keyfile[1024];          /* Private key file */
1353     int         have_creds = 0;         /* Have credentials? */
1354
1355     if (http->fields[HTTP_FIELD_HOST][0])
1356     {
1357      /*
1358       * Use hostname for TLS upgrade...
1359       */
1360
1361       strlcpy(hostname, http->fields[HTTP_FIELD_HOST], sizeof(hostname));
1362     }
1363     else
1364     {
1365      /*
1366       * Resolve hostname from connection address...
1367       */
1368
1369       http_addr_t       addr;           /* Connection address */
1370       socklen_t         addrlen;        /* Length of address */
1371
1372       addrlen = sizeof(addr);
1373       if (getsockname(http->fd, (struct sockaddr *)&addr, &addrlen))
1374       {
1375         DEBUG_printf(("4_httpTLSStart: Unable to get socket address: %s", strerror(errno)));
1376         hostname[0] = '\0';
1377       }
1378       else if (httpAddrLocalhost(&addr))
1379         hostname[0] = '\0';
1380       else
1381       {
1382         httpAddrLookup(&addr, hostname, sizeof(hostname));
1383         DEBUG_printf(("4_httpTLSStart: Resolved socket address to \"%s\".", hostname));
1384       }
1385     }
1386
1387     if (isdigit(hostname[0] & 255) || hostname[0] == '[')
1388       hostname[0] = '\0';               /* Don't allow numeric addresses */
1389
1390     if (hostname[0])
1391     {
1392      /*
1393       * First look in the CUPS keystore...
1394       */
1395
1396       http_gnutls_make_path(crtfile, sizeof(crtfile), tls_keypath, hostname, "crt");
1397       http_gnutls_make_path(keyfile, sizeof(keyfile), tls_keypath, hostname, "key");
1398
1399       if (access(crtfile, R_OK) || access(keyfile, R_OK))
1400       {
1401        /*
1402         * No CUPS-managed certs, look for CA certs...
1403         */
1404
1405         char cacrtfile[1024], cakeyfile[1024];  /* CA cert files */
1406
1407         snprintf(cacrtfile, sizeof(cacrtfile), "/etc/letsencrypt/live/%s/fullchain.pem", hostname);
1408         snprintf(cakeyfile, sizeof(cakeyfile), "/etc/letsencrypt/live/%s/privkey.pem", hostname);
1409
1410         if ((access(cacrtfile, R_OK) || access(cakeyfile, R_OK)) && (hostptr = strchr(hostname, '.')) != NULL)
1411         {
1412          /*
1413           * Try just domain name...
1414           */
1415
1416           hostptr ++;
1417           if (strchr(hostptr, '.'))
1418           {
1419             snprintf(cacrtfile, sizeof(cacrtfile), "/etc/letsencrypt/live/%s/fullchain.pem", hostptr);
1420             snprintf(cakeyfile, sizeof(cakeyfile), "/etc/letsencrypt/live/%s/privkey.pem", hostptr);
1421           }
1422         }
1423
1424         if (!access(cacrtfile, R_OK) && !access(cakeyfile, R_OK))
1425         {
1426          /*
1427           * Use the CA certs...
1428           */
1429
1430           strlcpy(crtfile, cacrtfile, sizeof(crtfile));
1431           strlcpy(keyfile, cakeyfile, sizeof(keyfile));
1432         }
1433       }
1434
1435       have_creds = !access(crtfile, R_OK) && !access(keyfile, R_OK);
1436     }
1437     else if (tls_common_name)
1438     {
1439      /*
1440       * First look in the CUPS keystore...
1441       */
1442
1443       http_gnutls_make_path(crtfile, sizeof(crtfile), tls_keypath, tls_common_name, "crt");
1444       http_gnutls_make_path(keyfile, sizeof(keyfile), tls_keypath, tls_common_name, "key");
1445
1446       if (access(crtfile, R_OK) || access(keyfile, R_OK))
1447       {
1448        /*
1449         * No CUPS-managed certs, look for CA certs...
1450         */
1451
1452         char cacrtfile[1024], cakeyfile[1024];  /* CA cert files */
1453
1454         snprintf(cacrtfile, sizeof(cacrtfile), "/etc/letsencrypt/live/%s/fullchain.pem", tls_common_name);
1455         snprintf(cakeyfile, sizeof(cakeyfile), "/etc/letsencrypt/live/%s/privkey.pem", tls_common_name);
1456
1457         if ((access(cacrtfile, R_OK) || access(cakeyfile, R_OK)) && (hostptr = strchr(tls_common_name, '.')) != NULL)
1458         {
1459          /*
1460           * Try just domain name...
1461           */
1462
1463           hostptr ++;
1464           if (strchr(hostptr, '.'))
1465           {
1466             snprintf(cacrtfile, sizeof(cacrtfile), "/etc/letsencrypt/live/%s/fullchain.pem", hostptr);
1467             snprintf(cakeyfile, sizeof(cakeyfile), "/etc/letsencrypt/live/%s/privkey.pem", hostptr);
1468           }
1469         }
1470
1471         if (!access(cacrtfile, R_OK) && !access(cakeyfile, R_OK))
1472         {
1473          /*
1474           * Use the CA certs...
1475           */
1476
1477           strlcpy(crtfile, cacrtfile, sizeof(crtfile));
1478           strlcpy(keyfile, cakeyfile, sizeof(keyfile));
1479         }
1480       }
1481
1482       have_creds = !access(crtfile, R_OK) && !access(keyfile, R_OK);
1483     }
1484
1485     if (!have_creds && tls_auto_create && (hostname[0] || tls_common_name))
1486     {
1487       DEBUG_printf(("4_httpTLSStart: Auto-create credentials for \"%s\".", hostname[0] ? hostname : tls_common_name));
1488
1489       if (!cupsMakeServerCredentials(tls_keypath, hostname[0] ? hostname : tls_common_name, 0, NULL, time(NULL) + 365 * 86400))
1490       {
1491         DEBUG_puts("4_httpTLSStart: cupsMakeServerCredentials failed.");
1492         http->error  = errno = EINVAL;
1493         http->status = HTTP_STATUS_ERROR;
1494         _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create server credentials."), 1);
1495
1496         return (-1);
1497       }
1498     }
1499
1500     DEBUG_printf(("4_httpTLSStart: Using certificate \"%s\" and private key \"%s\".", crtfile, keyfile));
1501
1502     if (!status)
1503       status = gnutls_certificate_set_x509_key_file(*credentials, crtfile, keyfile, GNUTLS_X509_FMT_PEM);
1504   }
1505
1506   if (!status)
1507     status = gnutls_credentials_set(http->tls, GNUTLS_CRD_CERTIFICATE, *credentials);
1508
1509   if (status)
1510   {
1511     http->error  = EIO;
1512     http->status = HTTP_STATUS_ERROR;
1513
1514     DEBUG_printf(("4_httpTLSStart: Unable to complete client/server setup: %s", gnutls_strerror(status)));
1515     _cupsSetError(IPP_STATUS_ERROR_CUPS_PKI, gnutls_strerror(status), 0);
1516
1517     gnutls_deinit(http->tls);
1518     gnutls_certificate_free_credentials(*credentials);
1519     free(credentials);
1520     http->tls = NULL;
1521
1522     return (-1);
1523   }
1524
1525   strlcpy(priority_string, "NORMAL", sizeof(priority_string));
1526
1527   if (tls_max_version < _HTTP_TLS_MAX)
1528   {
1529    /*
1530     * Require specific TLS versions...
1531     */
1532
1533     strlcat(priority_string, ":-VERS-TLS-ALL", sizeof(priority_string));
1534     for (version = tls_min_version; version <= tls_max_version; version ++)
1535     {
1536       strlcat(priority_string, ":+", sizeof(priority_string));
1537       strlcat(priority_string, versions[version], sizeof(priority_string));
1538     }
1539   }
1540   else if (tls_min_version == _HTTP_TLS_SSL3)
1541   {
1542    /*
1543     * Allow all versions of TLS and SSL/3.0...
1544     */
1545
1546     strlcat(priority_string, ":+VERS-TLS-ALL:+VERS-SSL3.0", sizeof(priority_string));
1547   }
1548   else
1549   {
1550    /*
1551     * Require a minimum version...
1552     */
1553
1554     strlcat(priority_string, ":+VERS-TLS-ALL", sizeof(priority_string));
1555     for (version = 0; version < tls_min_version; version ++)
1556     {
1557       strlcat(priority_string, ":-", sizeof(priority_string));
1558       strlcat(priority_string, versions[version], sizeof(priority_string));
1559     }
1560   }
1561
1562   if (tls_options & _HTTP_TLS_ALLOW_RC4)
1563     strlcat(priority_string, ":+ARCFOUR-128", sizeof(priority_string));
1564   else
1565     strlcat(priority_string, ":!ARCFOUR-128", sizeof(priority_string));
1566
1567   strlcat(priority_string, ":!ANON-DH", sizeof(priority_string));
1568
1569   if (tls_options & _HTTP_TLS_DENY_CBC)
1570     strlcat(priority_string, ":!AES-128-CBC:!AES-256-CBC:!CAMELLIA-128-CBC:!CAMELLIA-256-CBC:!3DES-CBC", sizeof(priority_string));
1571
1572 #ifdef HAVE_GNUTLS_PRIORITY_SET_DIRECT
1573   gnutls_priority_set_direct(http->tls, priority_string, NULL);
1574
1575 #else
1576   gnutls_priority_t priority;           /* Priority */
1577
1578   gnutls_priority_init(&priority, priority_string, NULL);
1579   gnutls_priority_set(http->tls, priority);
1580   gnutls_priority_deinit(priority);
1581 #endif /* HAVE_GNUTLS_PRIORITY_SET_DIRECT */
1582
1583   gnutls_transport_set_ptr(http->tls, (gnutls_transport_ptr_t)http);
1584   gnutls_transport_set_pull_function(http->tls, http_gnutls_read);
1585 #ifdef HAVE_GNUTLS_TRANSPORT_SET_PULL_TIMEOUT_FUNCTION
1586   gnutls_transport_set_pull_timeout_function(http->tls, (gnutls_pull_timeout_func)httpWait);
1587 #endif /* HAVE_GNUTLS_TRANSPORT_SET_PULL_TIMEOUT_FUNCTION */
1588   gnutls_transport_set_push_function(http->tls, http_gnutls_write);
1589
1590  /*
1591   * Enforce a minimum timeout of 10 seconds for the TLS handshake...
1592   */
1593
1594   old_timeout  = http->timeout_value;
1595   old_cb       = http->timeout_cb;
1596   old_data     = http->timeout_data;
1597
1598   if (!old_cb || old_timeout < 10.0)
1599   {
1600     DEBUG_puts("4_httpTLSStart: Setting timeout to 10 seconds.");
1601     httpSetTimeout(http, 10.0, NULL, NULL);
1602   }
1603
1604  /*
1605   * Do the TLS handshake...
1606   */
1607
1608   while ((status = gnutls_handshake(http->tls)) != GNUTLS_E_SUCCESS)
1609   {
1610     DEBUG_printf(("5_httpStartTLS: gnutls_handshake returned %d (%s)",
1611                   status, gnutls_strerror(status)));
1612
1613     if (gnutls_error_is_fatal(status))
1614     {
1615       http->error  = EIO;
1616       http->status = HTTP_STATUS_ERROR;
1617
1618       _cupsSetError(IPP_STATUS_ERROR_CUPS_PKI, gnutls_strerror(status), 0);
1619
1620       gnutls_deinit(http->tls);
1621       gnutls_certificate_free_credentials(*credentials);
1622       free(credentials);
1623       http->tls = NULL;
1624
1625       httpSetTimeout(http, old_timeout, old_cb, old_data);
1626
1627       return (-1);
1628     }
1629   }
1630
1631  /*
1632   * Restore the previous timeout settings...
1633   */
1634
1635   httpSetTimeout(http, old_timeout, old_cb, old_data);
1636
1637   http->tls_credentials = credentials;
1638
1639   return (0);
1640 }
1641
1642
1643 /*
1644  * '_httpTLSStop()' - Shut down SSL/TLS on a connection.
1645  */
1646
1647 void
1648 _httpTLSStop(http_t *http)              /* I - Connection to server */
1649 {
1650   int   error;                          /* Error code */
1651
1652
1653   error = gnutls_bye(http->tls, http->mode == _HTTP_MODE_CLIENT ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR);
1654   if (error != GNUTLS_E_SUCCESS)
1655     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, gnutls_strerror(errno), 0);
1656
1657   gnutls_deinit(http->tls);
1658   http->tls = NULL;
1659
1660   if (http->tls_credentials)
1661   {
1662     gnutls_certificate_free_credentials(*(http->tls_credentials));
1663     free(http->tls_credentials);
1664     http->tls_credentials = NULL;
1665   }
1666 }
1667
1668
1669 /*
1670  * '_httpTLSWrite()' - Write to a SSL/TLS connection.
1671  */
1672
1673 int                                     /* O - Bytes written */
1674 _httpTLSWrite(http_t     *http,         /* I - Connection to server */
1675               const char *buf,          /* I - Buffer holding data */
1676               int        len)           /* I - Length of buffer */
1677 {
1678   ssize_t       result;                 /* Return value */
1679
1680
1681   DEBUG_printf(("2http_write_ssl(http=%p, buf=%p, len=%d)", http, buf, len));
1682
1683   result = gnutls_record_send(http->tls, buf, (size_t)len);
1684
1685   if (result < 0 && !errno)
1686   {
1687    /*
1688     * Convert GNU TLS error to errno value...
1689     */
1690
1691     switch (result)
1692     {
1693       case GNUTLS_E_INTERRUPTED :
1694           errno = EINTR;
1695           break;
1696
1697       case GNUTLS_E_AGAIN :
1698           errno = EAGAIN;
1699           break;
1700
1701       default :
1702           errno = EPIPE;
1703           break;
1704     }
1705
1706     result = -1;
1707   }
1708
1709   DEBUG_printf(("3http_write_ssl: Returning %d.", (int)result));
1710
1711   return ((int)result);
1712 }