4 * TLS support code for the CUPS scheduler using GNU TLS.
6 * Copyright 2007-2012 by Apple Inc.
7 * Copyright 1997-2007 by Easy Software Products, all rights reserved.
9 * These coded instructions, statements, and computer programs are the
10 * property of Apple Inc. and are protected by Federal copyright
11 * law. Distribution and use rights are outlined in the file "LICENSE.txt"
12 * which should have been included with this file. If this file is
13 * file is missing or damaged, see the license at "http://www.cups.org/".
17 * cupsdEndTLS() - Shutdown a secure session with the client.
18 * cupsdStartTLS() - Start a secure session with the client.
19 * make_certificate() - Make a self-signed SSL/TLS certificate.
27 static int make_certificate(cupsd_client_t
*con
);
31 * 'cupsdEndTLS()' - Shutdown a secure session with the client.
34 int /* O - 1 on success, 0 on error */
35 cupsdEndTLS(cupsd_client_t
*con
) /* I - Client connection */
37 int error
; /* Error code */
38 gnutls_certificate_server_credentials
*credentials
;
42 credentials
= (gnutls_certificate_server_credentials
*)
43 (con
->http
.tls_credentials
);
45 error
= gnutls_bye(con
->http
.tls
, GNUTLS_SHUT_WR
);
48 case GNUTLS_E_SUCCESS
:
49 cupsdLogMessage(CUPSD_LOG_DEBUG
,
50 "SSL shutdown successful!");
53 cupsdLogMessage(CUPSD_LOG_ERROR
,
54 "SSL shutdown failed: %s", gnutls_strerror(error
));
58 gnutls_deinit(con
->http
.tls
);
61 gnutls_certificate_free_credentials(*credentials
);
69 * 'cupsdStartTLS()' - Start a secure session with the client.
72 int /* O - 1 on success, 0 on error */
73 cupsdStartTLS(cupsd_client_t
*con
) /* I - Client connection */
75 int status
; /* Error code */
76 gnutls_certificate_server_credentials
*credentials
;
80 cupsdLogMessage(CUPSD_LOG_DEBUG
, "[Client %d] Encrypting connection.",
84 * Verify that we have a certificate...
87 if (access(ServerKey
, 0) || access(ServerCertificate
, 0))
90 * Nope, make a self-signed certificate...
93 if (!make_certificate(con
))
98 * Create the SSL object and perform the SSL handshake...
101 credentials
= (gnutls_certificate_server_credentials
*)
102 malloc(sizeof(gnutls_certificate_server_credentials
));
103 if (credentials
== NULL
)
105 cupsdLogMessage(CUPSD_LOG_ERROR
,
106 "Unable to encrypt connection from %s - %s",
107 con
->http
.hostname
, strerror(errno
));
112 gnutls_certificate_allocate_credentials(credentials
);
113 gnutls_certificate_set_x509_key_file(*credentials
, ServerCertificate
,
114 ServerKey
, GNUTLS_X509_FMT_PEM
);
116 gnutls_init(&con
->http
.tls
, GNUTLS_SERVER
);
117 gnutls_set_default_priority(con
->http
.tls
);
119 gnutls_credentials_set(con
->http
.tls
, GNUTLS_CRD_CERTIFICATE
, *credentials
);
120 gnutls_transport_set_ptr(con
->http
.tls
, (gnutls_transport_ptr
)HTTP(con
));
121 gnutls_transport_set_pull_function(con
->http
.tls
, _httpReadGNUTLS
);
122 gnutls_transport_set_push_function(con
->http
.tls
, _httpWriteGNUTLS
);
124 while ((status
= gnutls_handshake(con
->http
.tls
)) != GNUTLS_E_SUCCESS
)
126 if (gnutls_error_is_fatal(status
))
128 cupsdLogMessage(CUPSD_LOG_ERROR
,
129 "Unable to encrypt connection from %s - %s",
130 con
->http
.hostname
, gnutls_strerror(status
));
132 gnutls_deinit(con
->http
.tls
);
133 gnutls_certificate_free_credentials(*credentials
);
134 con
->http
.tls
= NULL
;
140 cupsdLogMessage(CUPSD_LOG_DEBUG
, "Connection from %s now encrypted.",
143 con
->http
.tls_credentials
= credentials
;
149 * 'make_certificate()' - Make a self-signed SSL/TLS certificate.
152 static int /* O - 1 on success, 0 on failure */
153 make_certificate(cupsd_client_t
*con
) /* I - Client connection */
155 gnutls_x509_crt crt
; /* Self-signed certificate */
156 gnutls_x509_privkey key
; /* Encryption key */
157 cups_lang_t
*language
; /* Default language info */
158 cups_file_t
*fp
; /* Key/cert file */
159 unsigned char buffer
[8192]; /* Buffer for x509 data */
160 size_t bytes
; /* Number of bytes of data */
161 unsigned char serial
[4]; /* Serial number buffer */
162 time_t curtime
; /* Current time */
163 int result
; /* Result of GNU TLS calls */
167 * Create the encryption key...
170 cupsdLogMessage(CUPSD_LOG_INFO
, "Generating SSL server key...");
172 gnutls_x509_privkey_init(&key
);
173 gnutls_x509_privkey_generate(key
, GNUTLS_PK_RSA
, 2048, 0);
179 bytes
= sizeof(buffer
);
181 if ((result
= gnutls_x509_privkey_export(key
, GNUTLS_X509_FMT_PEM
,
182 buffer
, &bytes
)) < 0)
184 cupsdLogMessage(CUPSD_LOG_ERROR
, "Unable to export SSL server key - %s",
185 gnutls_strerror(result
));
186 gnutls_x509_privkey_deinit(key
);
189 else if ((fp
= cupsFileOpen(ServerKey
, "w")) != NULL
)
191 cupsFileWrite(fp
, (char *)buffer
, bytes
);
194 cupsdLogMessage(CUPSD_LOG_INFO
, "Created SSL server key file \"%s\"...",
199 cupsdLogMessage(CUPSD_LOG_ERROR
,
200 "Unable to create SSL server key file \"%s\" - %s",
201 ServerKey
, strerror(errno
));
202 gnutls_x509_privkey_deinit(key
);
207 * Create the self-signed certificate...
210 cupsdLogMessage(CUPSD_LOG_INFO
, "Generating self-signed SSL certificate...");
212 language
= cupsLangDefault();
213 curtime
= time(NULL
);
214 serial
[0] = curtime
>> 24;
215 serial
[1] = curtime
>> 16;
216 serial
[2] = curtime
>> 8;
219 gnutls_x509_crt_init(&crt
);
220 if (strlen(language
->language
) == 5)
221 gnutls_x509_crt_set_dn_by_oid(crt
, GNUTLS_OID_X520_COUNTRY_NAME
, 0,
222 language
->language
+ 3, 2);
224 gnutls_x509_crt_set_dn_by_oid(crt
, GNUTLS_OID_X520_COUNTRY_NAME
, 0,
226 gnutls_x509_crt_set_dn_by_oid(crt
, GNUTLS_OID_X520_COMMON_NAME
, 0,
227 ServerName
, strlen(ServerName
));
228 gnutls_x509_crt_set_dn_by_oid(crt
, GNUTLS_OID_X520_ORGANIZATION_NAME
, 0,
229 ServerName
, strlen(ServerName
));
230 gnutls_x509_crt_set_dn_by_oid(crt
, GNUTLS_OID_X520_ORGANIZATIONAL_UNIT_NAME
,
232 gnutls_x509_crt_set_dn_by_oid(crt
, GNUTLS_OID_X520_STATE_OR_PROVINCE_NAME
, 0,
234 gnutls_x509_crt_set_dn_by_oid(crt
, GNUTLS_OID_X520_LOCALITY_NAME
, 0,
236 gnutls_x509_crt_set_dn_by_oid(crt
, GNUTLS_OID_PKCS9_EMAIL
, 0,
237 ServerAdmin
, strlen(ServerAdmin
));
238 gnutls_x509_crt_set_key(crt
, key
);
239 gnutls_x509_crt_set_serial(crt
, serial
, sizeof(serial
));
240 gnutls_x509_crt_set_activation_time(crt
, curtime
);
241 gnutls_x509_crt_set_expiration_time(crt
, curtime
+ 10 * 365 * 86400);
242 gnutls_x509_crt_set_ca_status(crt
, 0);
243 gnutls_x509_crt_set_subject_alternative_name(crt
, GNUTLS_SAN_DNSNAME
,
245 gnutls_x509_crt_set_key_purpose_oid(crt
, GNUTLS_KP_TLS_WWW_SERVER
, 0);
246 gnutls_x509_crt_set_key_usage(crt
, GNUTLS_KEY_KEY_ENCIPHERMENT
);
247 gnutls_x509_crt_set_version(crt
, 3);
249 bytes
= sizeof(buffer
);
250 if (gnutls_x509_crt_get_key_id(crt
, 0, buffer
, &bytes
) >= 0)
251 gnutls_x509_crt_set_subject_key_id(crt
, buffer
, bytes
);
253 gnutls_x509_crt_sign(crt
, crt
, key
);
259 bytes
= sizeof(buffer
);
260 if ((result
= gnutls_x509_crt_export(crt
, GNUTLS_X509_FMT_PEM
,
261 buffer
, &bytes
)) < 0)
262 cupsdLogMessage(CUPSD_LOG_ERROR
,
263 "Unable to export SSL server certificate - %s",
264 gnutls_strerror(result
));
265 else if ((fp
= cupsFileOpen(ServerCertificate
, "w")) != NULL
)
267 cupsFileWrite(fp
, (char *)buffer
, bytes
);
270 cupsdLogMessage(CUPSD_LOG_INFO
,
271 "Created SSL server certificate file \"%s\"...",
275 cupsdLogMessage(CUPSD_LOG_ERROR
,
276 "Unable to create SSL server certificate file \"%s\" - %s",
277 ServerCertificate
, strerror(errno
));
283 gnutls_x509_crt_deinit(crt
);
284 gnutls_x509_privkey_deinit(key
);