]> git.ipfire.org Git - thirdparty/cups.git/blob - cups/tls-darwin.c
projects / thirdparty / cups.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
More tweaks for cipher suite restrictions.
[thirdparty/cups.git] / cups / tls-darwin.c
1 /*
2 * "$Id$"
3 *
4 * TLS support code for CUPS on OS X.
5 *
6 * Copyright 2007-2015 by Apple Inc.
7 * Copyright 1997-2007 by Easy Software Products, all rights reserved.
8 *
9 * These coded instructions, statements, and computer programs are the
10 * property of Apple Inc. and are protected by Federal copyright
11 * law. Distribution and use rights are outlined in the file "LICENSE.txt"
12 * which should have been included with this file. If this file is
13 * file is missing or damaged, see the license at "http://www.cups.org/".
14 *
15 * This file is subject to the Apple OS-Developed Software exception.
16 */
17
18 /**** This file is included from tls.c ****/
19
20 /*
21 * Include necessary headers...
22 */
23
24 #include <spawn.h>
25
26 extern char **environ;
27
28
29 /*
30 * Local globals...
31 */
32
33 #ifdef HAVE_SECKEYCHAINOPEN
34 static int tls_auto_create = 0;
35 /* Auto-create self-signed certs? */
36 static char *tls_common_name = NULL;
37 /* Default common name */
38 static SecKeychainRef tls_keychain = NULL;
39 /* Server cert keychain */
40 static char *tls_keypath = NULL;
41 /* Server cert keychain path */
42 static _cups_mutex_t tls_mutex = _CUPS_MUTEX_INITIALIZER;
43 /* Mutex for keychain/certs */
44 static int tls_options = -1;/* Options for TLS connections */
45 #endif /* HAVE_SECKEYCHAINOPEN */
46
47
48 /*
49 * Local functions...
50 */
51
52 #ifdef HAVE_SECKEYCHAINOPEN
53 static CFArrayRef http_cdsa_copy_server(const char *common_name);
54 #endif /* HAVE_SECKEYCHAINOPEN */
55 static SecCertificateRef http_cdsa_create_credential(http_credential_t *credential);
56 static const char *http_cdsa_default_path(char *buffer, size_t bufsize);
57 static OSStatus http_cdsa_read(SSLConnectionRef connection, void *data, size_t *dataLength);
58 static int http_cdsa_set_credentials(http_t *http);
59 static OSStatus http_cdsa_write(SSLConnectionRef connection, const void *data, size_t *dataLength);
60
61
62 /*
63 * 'cupsMakeServerCredentials()' - Make a self-signed certificate and private key pair.
64 *
65 * @since CUPS 2.0/OS 10.10@
66 */
67
68 int /* O - 1 on success, 0 on failure */
69 cupsMakeServerCredentials(
70 const char *path, /* I - Keychain path or @code NULL@ for default */
71 const char *common_name, /* I - Common name */
72 int num_alt_names, /* I - Number of subject alternate names */
73 const char **alt_names, /* I - Subject Alternate Names */
74 time_t expiration_date) /* I - Expiration date */
75 {
76 #if defined(HAVE_SECGENERATESELFSIGNEDCERTIFICATE) && defined(HAVE_SECKEYCHAINOPEN)
77 char filename[1024]; /* Default keychain path */
78 int status = 0; /* Return status */
79 OSStatus err; /* Error code (if any) */
80 CFStringRef cfcommon_name = NULL;
81 /* CF string for server name */
82 SecIdentityRef ident = NULL; /* Identity */
83 SecKeyRef publicKey = NULL,
84 /* Public key */
85 privateKey = NULL;
86 /* Private key */
87 CFMutableDictionaryRef keyParams = NULL;
88 /* Key generation parameters */
89
90
91 DEBUG_printf(("cupsMakeServerCredentials(path=\"%s\", common_name=\"%s\", num_alt_names=%d, alt_names=%p, expiration_date=%d)", path, common_name, num_alt_names, alt_names, (int)expiration_date));
92
93 (void)num_alt_names;
94 (void)alt_names;
95 (void)expiration_date;
96
97 if (!path)
98 path = http_cdsa_default_path(filename, sizeof(filename));
99
100 cfcommon_name = CFStringCreateWithCString(kCFAllocatorDefault, common_name, kCFStringEncodingUTF8);
101 if (!cfcommon_name)
102 goto cleanup;
103
104 /*
105 * Create a public/private key pair...
106 */
107
108 keyParams = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
109 if (!keyParams)
110 goto cleanup;
111
112 CFDictionaryAddValue(keyParams, kSecAttrKeyType, kSecAttrKeyTypeRSA);
113 CFDictionaryAddValue(keyParams, kSecAttrKeySizeInBits, CFSTR("2048"));
114 CFDictionaryAddValue(keyParams, kSecAttrLabel, CFSTR("CUPS Self-Signed Certificate"));
115
116 err = SecKeyGeneratePair(keyParams, &publicKey, &privateKey);
117 if (err != noErr)
118 goto cleanup;
119
120 /*
121 * Create a self-signed certificate using the public/private key pair...
122 */
123
124 CFIndex usageInt = kSecKeyUsageAll;
125 CFNumberRef usage = CFNumberCreate(alloc, kCFNumberCFIndexType, &usageInt);
126 CFDictionaryRef certParams = CFDictionaryCreateMutable(kCFAllocatorDefault,
127 kSecCSRBasicContraintsPathLen, CFINT(0), kSecSubjectAltName, cfcommon_name, kSecCertificateKeyUsage, usage, NULL, NULL);
128 CFRelease(usage);
129
130 const void *ca_o[] = { kSecOidOrganization, CFSTR("") };
131 const void *ca_cn[] = { kSecOidCommonName, cfcommon_name };
132 CFArrayRef ca_o_dn = CFArrayCreate(kCFAllocatorDefault, ca_o, 2, NULL);
133 CFArrayRef ca_cn_dn = CFArrayCreate(kCFAllocatorDefault, ca_cn, 2, NULL);
134 const void *ca_dn_array[2];
135
136 ca_dn_array[0] = CFArrayCreate(kCFAllocatorDefault, (const void **)&ca_o_dn, 1, NULL);
137 ca_dn_array[1] = CFArrayCreate(kCFAllocatorDefault, (const void **)&ca_cn_dn, 1, NULL);
138
139 CFArrayRef subject = CFArrayCreate(kCFAllocatorDefault, ca_dn_array, 2, NULL);
140 SecCertificateRef cert = SecGenerateSelfSignedCertificate(subject, certParams, publicKey, privateKey);
141 CFRelease(subject);
142 CFRelease(certParams);
143
144 if (!cert)
145 goto cleanup;
146
147 ident = SecIdentityCreate(kCFAllocatorDefault, cert, privateKey);
148
149 if (ident)
150 status = 1;
151
152 /*
153 * Cleanup and return...
154 */
155
156 cleanup:
157
158 if (cfcommon_name)
159 CFRelease(cfcommon_name);
160
161 if (keyParams)
162 CFRelease(keyParams);
163
164 if (ident)
165 CFRelease(ident);
166
167 if (cert)
168 CFRelease(cert);
169
170 if (publicKey)
171 CFRelease(publicKey);
172
173 if (privateKey)
174 CFRelease(publicKey);
175
176 return (status);
177
178 #else /* !(HAVE_SECGENERATESELFSIGNEDCERTIFICATE && HAVE_SECKEYCHAINOPEN) */
179 int pid, /* Process ID of command */
180 status, /* Status of command */
181 i; /* Looping var */
182 char command[1024], /* Command */
183 *argv[4], /* Command-line arguments */
184 *envp[1000], /* Environment variables */
185 days[32], /* CERTTOOL_EXPIRATION_DAYS env var */
186 keychain[1024], /* Keychain argument */
187 infofile[1024], /* Type-in information for cert */
188 filename[1024]; /* Default keychain path */
189 cups_file_t *fp; /* Seed/info file */
190
191
192 DEBUG_printf(("cupsMakeServerCredentials(path=\"%s\", common_name=\"%s\", num_alt_names=%d, alt_names=%p, expiration_date=%d)", path, common_name, num_alt_names, alt_names, (int)expiration_date));
193
194 (void)num_alt_names;
195 (void)alt_names;
196
197 if (!path)
198 path = http_cdsa_default_path(filename, sizeof(filename));
199
200 /*
201 * Run the "certtool" command to generate a self-signed certificate...
202 */
203
204 if (!cupsFileFind("certtool", getenv("PATH"), 1, command, sizeof(command)))
205 return (-1);
206
207 /*
208 * Create a file with the certificate information fields...
209 *
210 * Note: This assumes that the default questions are asked by the certtool
211 * command...
212 */
213
214 if ((fp = cupsTempFile2(infofile, sizeof(infofile))) == NULL)
215 return (-1);
216
217 cupsFilePrintf(fp,
218 "CUPS Self-Signed Certificate\n"
219 /* Enter key and certificate label */
220 "r\n" /* Generate RSA key pair */
221 "2048\n" /* Key size in bits */
222 "y\n" /* OK (y = yes) */
223 "b\n" /* Usage (b=signing/encryption) */
224 "s\n" /* Sign with SHA1 */
225 "y\n" /* OK (y = yes) */
226 "%s\n" /* Common name */
227 "\n" /* Country (default) */
228 "\n" /* Organization (default) */
229 "\n" /* Organizational unit (default) */
230 "\n" /* State/Province (default) */
231 "\n" /* Email address */
232 "y\n", /* OK (y = yes) */
233 common_name);
234 cupsFileClose(fp);
235
236 snprintf(keychain, sizeof(keychain), "k=%s", path);
237
238 argv[0] = "certtool";
239 argv[1] = "c";
240 argv[2] = keychain;
241 argv[3] = NULL;
242
243 snprintf(days, sizeof(days), "CERTTOOL_EXPIRATION_DAYS=%d", (int)((expiration_date - time(NULL) + 86399) / 86400));
244 envp[0] = days;
245 for (i = 0; i < (int)(sizeof(envp) / sizeof(envp[0]) - 2) && environ[i]; i ++)
246 envp[i + 1] = environ[i];
247 envp[i] = NULL;
248
249 posix_spawn_file_actions_t actions; /* File actions */
250
251 posix_spawn_file_actions_init(&actions);
252 posix_spawn_file_actions_addclose(&actions, 0);
253 posix_spawn_file_actions_addopen(&actions, 0, infofile, O_RDONLY, 0);
254 posix_spawn_file_actions_addclose(&actions, 1);
255 posix_spawn_file_actions_addopen(&actions, 1, "/dev/null", O_WRONLY, 0);
256 posix_spawn_file_actions_addclose(&actions, 2);
257 posix_spawn_file_actions_addopen(&actions, 2, "/dev/null", O_WRONLY, 0);
258
259 if (posix_spawn(&pid, command, &actions, NULL, argv, envp))
260 {
261 unlink(infofile);
262 return (-1);
263 }
264
265 posix_spawn_file_actions_destroy(&actions);
266
267 unlink(infofile);
268
269 while (waitpid(pid, &status, 0) < 0)
270 if (errno != EINTR)
271 {
272 status = -1;
273 break;
274 }
275
276 return (!status);
277 #endif /* HAVE_SECGENERATESELFSIGNEDCERTIFICATE && HAVE_SECKEYCHAINOPEN */
278 }
279
280
281 /*
282 * 'cupsSetServerCredentials()' - Set the default server credentials.
283 *
284 * Note: The server credentials are used by all threads in the running process.
285 * This function is threadsafe.
286 *
287 * @since CUPS 2.0/OS X 10.10@
288 */
289
290 int /* O - 1 on success, 0 on failure */
291 cupsSetServerCredentials(
292 const char *path, /* I - Keychain path or @code NULL@ for default */
293 const char *common_name, /* I - Default common name for server */
294 int auto_create) /* I - 1 = automatically create self-signed certificates */
295 {
296 DEBUG_printf(("cupsSetServerCredentials(path=\"%s\", common_name=\"%s\", auto_create=%d)", path, common_name, auto_create));
297
298 #ifdef HAVE_SECKEYCHAINOPEN
299 char filename[1024]; /* Filename for keychain */
300 SecKeychainRef keychain = NULL;/* Temporary keychain */
301
302
303 if (!path)
304 path = http_cdsa_default_path(filename, sizeof(filename));
305
306 if (SecKeychainOpen(path, &keychain) != noErr)
307 {
308 /* TODO: Set cups last error string */
309 DEBUG_puts("1cupsSetServerCredentials: Unable to open keychain, returning 0.");
310 return (0);
311 }
312
313 _cupsMutexLock(&tls_mutex);
314
315 /*
316 * Close any keychain that is currently open...
317 */
318
319 if (tls_keychain)
320 CFRelease(tls_keychain);
321
322 if (tls_keypath)
323 _cupsStrFree(tls_keypath);
324
325 if (tls_common_name)
326 _cupsStrFree(tls_common_name);
327
328 /*
329 * Save the new keychain...
330 */
331
332 tls_keychain = keychain;
333 tls_keypath = _cupsStrAlloc(path);
334 tls_auto_create = auto_create;
335 tls_common_name = _cupsStrAlloc(common_name);
336
337 _cupsMutexUnlock(&tls_mutex);
338
339 DEBUG_puts("1cupsSetServerCredentials: Opened keychain, returning 1.");
340 return (1);
341
342 #else
343 DEBUG_puts("1cupsSetServerCredentials: No keychain support compiled in, returning 0.");
344 return (0);
345 #endif /* HAVE_SECKEYCHAINOPEN */
346 }
347
348
349 /*
350 * 'httpCopyCredentials()' - Copy the credentials associated with the peer in
351 * an encrypted connection.
352 *
353 * @since CUPS 1.5/OS X 10.7@
354 */
355
356 int /* O - Status of call (0 = success) */
357 httpCopyCredentials(
358 http_t *http, /* I - Connection to server */
359 cups_array_t **credentials) /* O - Array of credentials */
360 {
361 OSStatus error; /* Error code */
362 SecTrustRef peerTrust; /* Peer trust reference */
363 CFIndex count; /* Number of credentials */
364 SecCertificateRef secCert; /* Certificate reference */
365 CFDataRef data; /* Certificate data */
366 int i; /* Looping var */
367
368
369 DEBUG_printf(("httpCopyCredentials(http=%p, credentials=%p)", http, credentials));
370
371 if (credentials)
372 *credentials = NULL;
373
374 if (!http || !http->tls || !credentials)
375 return (-1);
376
377 if (!(error = SSLCopyPeerTrust(http->tls, &peerTrust)) && peerTrust)
378 {
379 DEBUG_printf(("2httpCopyCredentials: Peer provided %d certificates.", (int)SecTrustGetCertificateCount(peerTrust)));
380
381 if ((*credentials = cupsArrayNew(NULL, NULL)) != NULL)
382 {
383 count = SecTrustGetCertificateCount(peerTrust);
384
385 for (i = 0; i < count; i ++)
386 {
387 secCert = SecTrustGetCertificateAtIndex(peerTrust, i);
388
389 #ifdef DEBUG
390 CFStringRef cf_name = SecCertificateCopySubjectSummary(secCert);
391 char name[1024];
392 if (cf_name)
393 CFStringGetCString(cf_name, name, sizeof(name), kCFStringEncodingUTF8);
394 else
395 strlcpy(name, "unknown", sizeof(name));
396
397 DEBUG_printf(("2httpCopyCredentials: Certificate %d name is \"%s\".", i, name));
398 #endif /* DEBUG */
399
400 if ((data = SecCertificateCopyData(secCert)) != NULL)
401 {
402 DEBUG_printf(("2httpCopyCredentials: Adding %d byte certificate blob.", (int)CFDataGetLength(data)));
403
404 httpAddCredential(*credentials, CFDataGetBytePtr(data), (size_t)CFDataGetLength(data));
405 CFRelease(data);
406 }
407 }
408 }
409
410 CFRelease(peerTrust);
411 }
412
413 return (error);
414 }
415
416
417 /*
418 * '_httpCreateCredentials()' - Create credentials in the internal format.
419 */
420
421 http_tls_credentials_t /* O - Internal credentials */
422 _httpCreateCredentials(
423 cups_array_t *credentials) /* I - Array of credentials */
424 {
425 CFMutableArrayRef peerCerts; /* Peer credentials reference */
426 SecCertificateRef secCert; /* Certificate reference */
427 http_credential_t *credential; /* Credential data */
428
429
430 if (!credentials)
431 return (NULL);
432
433 if ((peerCerts = CFArrayCreateMutable(kCFAllocatorDefault,
434 cupsArrayCount(credentials),
435 &kCFTypeArrayCallBacks)) == NULL)
436 return (NULL);
437
438 for (credential = (http_credential_t *)cupsArrayFirst(credentials);
439 credential;
440 credential = (http_credential_t *)cupsArrayNext(credentials))
441 {
442 if ((secCert = http_cdsa_create_credential(credential)) != NULL)
443 {
444 CFArrayAppendValue(peerCerts, secCert);
445 CFRelease(secCert);
446 }
447 }
448
449 return (peerCerts);
450 }
451
452
453 /*
454 * 'httpCredentialsAreValidForName()' - Return whether the credentials are valid for the given name.
455 *
456 * @since CUPS 2.0/OS X 10.10@
457 */
458
459 int /* O - 1 if valid, 0 otherwise */
460 httpCredentialsAreValidForName(
461 cups_array_t *credentials, /* I - Credentials */
462 const char *common_name) /* I - Name to check */
463 {
464 SecCertificateRef secCert; /* Certificate reference */
465 CFStringRef cfcert_name = NULL;
466 /* Certificate's common name (CF string) */
467 char cert_name[256]; /* Certificate's common name (C string) */
468 int valid = 1; /* Valid name? */
469
470
471 if ((secCert = http_cdsa_create_credential((http_credential_t *)cupsArrayFirst(credentials))) == NULL)
472 return (0);
473
474 /*
475 * Compare the common names...
476 */
477
478 if ((cfcert_name = SecCertificateCopySubjectSummary(secCert)) == NULL)
479 {
480 /*
481 * Can't get common name, cannot be valid...
482 */
483
484 valid = 0;
485 }
486 else if (CFStringGetCString(cfcert_name, cert_name, sizeof(cert_name), kCFStringEncodingUTF8) &&
487 _cups_strcasecmp(common_name, cert_name))
488 {
489 /*
490 * Not an exact match for the common name, check for wildcard certs...
491 */
492
493 const char *domain = strchr(common_name, '.');
494 /* Domain in common name */
495
496 if (strncmp(cert_name, "*.", 2) || !domain || _cups_strcasecmp(domain, cert_name + 1))
497 {
498 /*
499 * Not a wildcard match.
500 */
501
502 /* TODO: Check subject alternate names */
503 valid = 0;
504 }
505 }
506
507 if (cfcert_name)
508 CFRelease(cfcert_name);
509
510 CFRelease(secCert);
511
512 return (valid);
513 }
514
515
516 /*
517 * 'httpCredentialsGetTrust()' - Return the trust of credentials.
518 *
519 * @since CUPS 2.0/OS X 10.10@
520 */
521
522 http_trust_t /* O - Level of trust */
523 httpCredentialsGetTrust(
524 cups_array_t *credentials, /* I - Credentials */
525 const char *common_name) /* I - Common name for trust lookup */
526 {
527 SecCertificateRef secCert; /* Certificate reference */
528 http_trust_t trust = HTTP_TRUST_OK;
529 /* Trusted? */
530 cups_array_t *tcreds = NULL; /* Trusted credentials */
531 _cups_globals_t *cg = _cupsGlobals();
532 /* Per-thread globals */
533
534
535 if (!common_name)
536 return (HTTP_TRUST_UNKNOWN);
537
538 if ((secCert = http_cdsa_create_credential((http_credential_t *)cupsArrayFirst(credentials))) == NULL)
539 return (HTTP_TRUST_UNKNOWN);
540
541 if (cg->any_root < 0)
542 _cupsSetDefaults();
543
544 /*
545 * Look this common name up in the default keychains...
546 */
547
548 httpLoadCredentials(NULL, &tcreds, common_name);
549
550 if (tcreds)
551 {
552 char credentials_str[1024], /* String for incoming credentials */
553 tcreds_str[1024]; /* String for saved credentials */
554
555 httpCredentialsString(credentials, credentials_str, sizeof(credentials_str));
556 httpCredentialsString(tcreds, tcreds_str, sizeof(tcreds_str));
557
558 if (strcmp(credentials_str, tcreds_str))
559 {
560 /*
561 * Credentials don't match, let's look at the expiration date of the new
562 * credentials and allow if the new ones have a later expiration...
563 */
564
565 if (httpCredentialsGetExpiration(credentials) <= httpCredentialsGetExpiration(tcreds) ||
566 !httpCredentialsAreValidForName(credentials, common_name))
567 {
568 /*
569 * Either the new credentials are not newly issued, or the common name
570 * does not match the issued certificate...
571 */
572
573 trust = HTTP_TRUST_INVALID;
574 }
575 else if (httpCredentialsGetExpiration(tcreds) < time(NULL))
576 {
577 /*
578 * Save the renewed credentials...
579 */
580
581 trust = HTTP_TRUST_RENEWED;
582
583 httpSaveCredentials(NULL, credentials, common_name);
584 }
585 }
586
587 httpFreeCredentials(tcreds);
588 }
589 else if (cg->validate_certs && !httpCredentialsAreValidForName(credentials, common_name))
590 trust = HTTP_TRUST_INVALID;
591
592 if (!cg->expired_certs && !SecCertificateIsValid(secCert, CFAbsoluteTimeGetCurrent()))
593 trust = HTTP_TRUST_EXPIRED;
594 else if (!cg->any_root && cupsArrayCount(credentials) == 1)
595 trust = HTTP_TRUST_INVALID;
596
597 CFRelease(secCert);
598
599 return (trust);
600 }
601
602
603 /*
604 * 'httpCredentialsGetExpiration()' - Return the expiration date of the credentials.
605 *
606 * @since CUPS 2.0/OS X 10.10@
607 */
608
609 time_t /* O - Expiration date of credentials */
610 httpCredentialsGetExpiration(
611 cups_array_t *credentials) /* I - Credentials */
612 {
613 SecCertificateRef secCert; /* Certificate reference */
614 time_t expiration; /* Expiration date */
615
616
617 if ((secCert = http_cdsa_create_credential((http_credential_t *)cupsArrayFirst(credentials))) == NULL)
618 return (0);
619
620 expiration = (time_t)(SecCertificateNotValidAfter(secCert) + kCFAbsoluteTimeIntervalSince1970);
621
622 CFRelease(secCert);
623
624 return (expiration);
625 }
626
627
628 /*
629 * 'httpCredentialsString()' - Return a string representing the credentials.
630 *
631 * @since CUPS 2.0/OS X 10.10@
632 */
633
634 size_t /* O - Total size of credentials string */
635 httpCredentialsString(
636 cups_array_t *credentials, /* I - Credentials */
637 char *buffer, /* I - Buffer or @code NULL@ */
638 size_t bufsize) /* I - Size of buffer */
639 {
640 http_credential_t *first; /* First certificate */
641 SecCertificateRef secCert; /* Certificate reference */
642
643
644 DEBUG_printf(("httpCredentialsString(credentials=%p, buffer=%p, bufsize=" CUPS_LLFMT ")", credentials, buffer, CUPS_LLCAST bufsize));
645
646 if (!buffer)
647 return (0);
648
649 if (buffer && bufsize > 0)
650 *buffer = '\0';
651
652 if ((first = (http_credential_t *)cupsArrayFirst(credentials)) != NULL &&
653 (secCert = http_cdsa_create_credential(first)) != NULL)
654 {
655 CFStringRef cf_name; /* CF common name string */
656 char name[256]; /* Common name associated with cert */
657 time_t expiration; /* Expiration date of cert */
658 _cups_md5_state_t md5_state; /* MD5 state */
659 unsigned char md5_digest[16]; /* MD5 result */
660
661 if ((cf_name = SecCertificateCopySubjectSummary(secCert)) != NULL)
662 {
663 CFStringGetCString(cf_name, name, (CFIndex)sizeof(name), kCFStringEncodingUTF8);
664 CFRelease(cf_name);
665 }
666 else
667 strlcpy(name, "unknown", sizeof(name));
668
669 expiration = (time_t)(SecCertificateNotValidAfter(secCert) + kCFAbsoluteTimeIntervalSince1970);
670
671 _cupsMD5Init(&md5_state);
672 _cupsMD5Append(&md5_state, first->data, (int)first->datalen);
673 _cupsMD5Finish(&md5_state, md5_digest);
674
675 snprintf(buffer, bufsize, "%s / %s / %02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X", name, httpGetDateString(expiration), md5_digest[0], md5_digest[1], md5_digest[2], md5_digest[3], md5_digest[4], md5_digest[5], md5_digest[6], md5_digest[7], md5_digest[8], md5_digest[9], md5_digest[10], md5_digest[11], md5_digest[12], md5_digest[13], md5_digest[14], md5_digest[15]);
676
677 CFRelease(secCert);
678 }
679
680 DEBUG_printf(("1httpCredentialsString: Returning \"%s\".", buffer));
681
682 return (strlen(buffer));
683 }
684
685
686 /*
687 * '_httpFreeCredentials()' - Free internal credentials.
688 */
689
690 void
691 _httpFreeCredentials(
692 http_tls_credentials_t credentials) /* I - Internal credentials */
693 {
694 if (!credentials)
695 return;
696
697 CFRelease(credentials);
698 }
699
700
701 /*
702 * 'httpLoadCredentials()' - Load X.509 credentials from a keychain file.
703 *
704 * @since CUPS 2.0/OS 10.10@
705 */
706
707 int /* O - 0 on success, -1 on error */
708 httpLoadCredentials(
709 const char *path, /* I - Keychain path or @code NULL@ for default */
710 cups_array_t **credentials, /* IO - Credentials */
711 const char *common_name) /* I - Common name for credentials */
712 {
713 #ifdef HAVE_SECKEYCHAINOPEN
714 OSStatus err; /* Error info */
715 char filename[1024]; /* Filename for keychain */
716 SecKeychainRef keychain = NULL;/* Keychain reference */
717 SecIdentitySearchRef search = NULL; /* Search reference */
718 SecCertificateRef cert = NULL; /* Certificate */
719 CFDataRef data; /* Certificate data */
720 SecPolicyRef policy = NULL; /* Policy ref */
721 CFStringRef cfcommon_name = NULL;
722 /* Server name */
723 CFMutableDictionaryRef query = NULL; /* Query qualifiers */
724 CFArrayRef list = NULL; /* Keychain list */
725
726
727 DEBUG_printf(("httpLoadCredentials(path=\"%s\", credentials=%p, common_name=\"%s\")", path, credentials, common_name));
728
729 if (!credentials)
730 return (-1);
731
732 *credentials = NULL;
733
734 if (!path)
735 path = http_cdsa_default_path(filename, sizeof(filename));
736
737 if ((err = SecKeychainOpen(path, &keychain)) != noErr)
738 goto cleanup;
739
740 cfcommon_name = CFStringCreateWithCString(kCFAllocatorDefault, common_name, kCFStringEncodingUTF8);
741
742 policy = SecPolicyCreateSSL(1, cfcommon_name);
743
744 if (cfcommon_name)
745 CFRelease(cfcommon_name);
746
747 if (!policy)
748 goto cleanup;
749
750 if (!(query = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks)))
751 goto cleanup;
752
753 list = CFArrayCreate(kCFAllocatorDefault, (const void **)&keychain, 1, &kCFTypeArrayCallBacks);
754
755 CFDictionaryAddValue(query, kSecClass, kSecClassCertificate);
756 CFDictionaryAddValue(query, kSecMatchPolicy, policy);
757 CFDictionaryAddValue(query, kSecReturnRef, kCFBooleanTrue);
758 CFDictionaryAddValue(query, kSecMatchLimit, kSecMatchLimitOne);
759 CFDictionaryAddValue(query, kSecMatchSearchList, list);
760
761 CFRelease(list);
762
763 err = SecItemCopyMatching(query, (CFTypeRef *)&cert);
764
765 if (err)
766 goto cleanup;
767
768 if (CFGetTypeID(cert) != SecCertificateGetTypeID())
769 goto cleanup;
770
771 if ((data = SecCertificateCopyData(cert)) != NULL)
772 {
773 DEBUG_printf(("1httpLoadCredentials: Adding %d byte certificate blob.", (int)CFDataGetLength(data)));
774
775 *credentials = cupsArrayNew(NULL, NULL);
776 httpAddCredential(*credentials, CFDataGetBytePtr(data), (size_t)CFDataGetLength(data));
777 CFRelease(data);
778 }
779
780 cleanup :
781
782 if (keychain)
783 CFRelease(keychain);
784 if (search)
785 CFRelease(search);
786 if (cert)
787 CFRelease(cert);
788 if (policy)
789 CFRelease(policy);
790 if (query)
791 CFRelease(query);
792
793 DEBUG_printf(("1httpLoadCredentials: Returning %d.", *credentials ? 0 : -1));
794
795 return (*credentials ? 0 : -1);
796
797 #else
798 (void)path;
799 (void)credentials;
800 (void)common_name;
801
802 return (-1);
803 #endif /* HAVE_SECKEYCHAINOPEN */
804 }
805
806
807 /*
808 * 'httpSaveCredentials()' - Save X.509 credentials to a keychain file.
809 *
810 * @since CUPS 2.0/OS 10.10@
811 */
812
813 int /* O - -1 on error, 0 on success */
814 httpSaveCredentials(
815 const char *path, /* I - Keychain path or @code NULL@ for default */
816 cups_array_t *credentials, /* I - Credentials */
817 const char *common_name) /* I - Common name for credentials */
818 {
819 #ifdef HAVE_SECKEYCHAINOPEN
820 int ret = -1; /* Return value */
821 OSStatus err; /* Error info */
822 char filename[1024]; /* Filename for keychain */
823 SecKeychainRef keychain = NULL;/* Keychain reference */
824 SecIdentitySearchRef search = NULL; /* Search reference */
825 SecCertificateRef cert = NULL; /* Certificate */
826 CFMutableDictionaryRef attrs = NULL; /* Attributes for add */
827 CFArrayRef list = NULL; /* Keychain list */
828
829
830 DEBUG_printf(("httpSaveCredentials(path=\"%s\", credentials=%p, common_name=\"%s\")", path, credentials, common_name));
831 if (!credentials)
832 goto cleanup;
833
834 if (!httpCredentialsAreValidForName(credentials, common_name))
835 {
836 DEBUG_puts("1httpSaveCredentials: Common name does not match.");
837 return (-1);
838 }
839
840 if ((cert = http_cdsa_create_credential((http_credential_t *)cupsArrayFirst(credentials))) == NULL)
841 {
842 DEBUG_puts("1httpSaveCredentials: Unable to create certificate.");
843 goto cleanup;
844 }
845
846 if (!path)
847 path = http_cdsa_default_path(filename, sizeof(filename));
848
849 if ((err = SecKeychainOpen(path, &keychain)) != noErr)
850 {
851 DEBUG_printf(("1httpSaveCredentials: SecKeychainOpen returned %d.", (int)err));
852 goto cleanup;
853 }
854
855 if ((list = CFArrayCreate(kCFAllocatorDefault, (const void **)&keychain, 1, &kCFTypeArrayCallBacks)) == NULL)
856 {
857 DEBUG_puts("1httpSaveCredentials: Unable to create list of keychains.");
858 goto cleanup;
859 }
860
861 if ((attrs = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks)) == NULL)
862 {
863 DEBUG_puts("1httpSaveCredentials: Unable to create dictionary.");
864 goto cleanup;
865 }
866
867 CFDictionaryAddValue(attrs, kSecClass, kSecClassCertificate);
868 CFDictionaryAddValue(attrs, kSecValueRef, cert);
869 CFDictionaryAddValue(attrs, kSecMatchSearchList, list);
870
871 /* Note: SecItemAdd consumes "attrs"... */
872 err = SecItemAdd(attrs, NULL);
873 DEBUG_printf(("1httpSaveCredentials: SecItemAdd returned %d.", (int)err));
874
875 cleanup :
876
877 if (list)
878 CFRelease(list);
879 if (keychain)
880 CFRelease(keychain);
881 if (search)
882 CFRelease(search);
883 if (cert)
884 CFRelease(cert);
885
886 DEBUG_printf(("1httpSaveCredentials: Returning %d.", ret));
887
888 return (ret);
889
890 #else
891 (void)path;
892 (void)credentials;
893 (void)common_name;
894
895 return (-1);
896 #endif /* HAVE_SECKEYCHAINOPEN */
897 }
898
899
900 /*
901 * '_httpTLSInitialize()' - Initialize the TLS stack.
902 */
903
904 void
905 _httpTLSInitialize(void)
906 {
907 /*
908 * Nothing to do...
909 */
910 }
911
912
913 /*
914 * '_httpTLSPending()' - Return the number of pending TLS-encrypted bytes.
915 */
916
917 size_t
918 _httpTLSPending(http_t *http) /* I - HTTP connection */
919 {
920 size_t bytes; /* Bytes that are available */
921
922
923 if (!SSLGetBufferedReadSize(http->tls, &bytes))
924 return (bytes);
925
926 return (0);
927 }
928
929
930 /*
931 * '_httpTLSRead()' - Read from a SSL/TLS connection.
932 */
933
934 int /* O - Bytes read */
935 _httpTLSRead(http_t *http, /* I - HTTP connection */
936 char *buf, /* I - Buffer to store data */
937 int len) /* I - Length of buffer */
938 {
939 int result; /* Return value */
940 OSStatus error; /* Error info */
941 size_t processed; /* Number of bytes processed */
942
943
944 error = SSLRead(http->tls, buf, (size_t)len, &processed);
945 DEBUG_printf(("6_httpTLSRead: error=%d, processed=%d", (int)error,
946 (int)processed));
947 switch (error)
948 {
949 case 0 :
950 result = (int)processed;
951 break;
952
953 case errSSLWouldBlock :
954 if (processed)
955 result = (int)processed;
956 else
957 {
958 result = -1;
959 errno = EINTR;
960 }
961 break;
962
963 case errSSLClosedGraceful :
964 default :
965 if (processed)
966 result = (int)processed;
967 else
968 {
969 result = -1;
970 errno = EPIPE;
971 }
972 break;
973 }
974
975 return (result);
976 }
977
978
979 /*
980 * '_httpTLSSetOptions()' - Set TLS protocol and cipher suite options.
981 */
982
983 void
984 _httpTLSSetOptions(int options) /* I - Options */
985 {
986 tls_options = options;
987 }
988
989
990 /*
991 * '_httpTLSStart()' - Set up SSL/TLS support on a connection.
992 */
993
994 int /* O - 0 on success, -1 on failure */
995 _httpTLSStart(http_t *http) /* I - HTTP connection */
996 {
997 char hostname[256], /* Hostname */
998 *hostptr; /* Pointer into hostname */
999 _cups_globals_t *cg = _cupsGlobals();
1000 /* Pointer to library globals */
1001 OSStatus error; /* Error code */
1002 const char *message = NULL;/* Error message */
1003 cups_array_t *credentials; /* Credentials array */
1004 cups_array_t *names; /* CUPS distinguished names */
1005 CFArrayRef dn_array; /* CF distinguished names array */
1006 CFIndex count; /* Number of credentials */
1007 CFDataRef data; /* Certificate data */
1008 int i; /* Looping var */
1009 http_credential_t *credential; /* Credential data */
1010
1011
1012 DEBUG_printf(("3_httpTLSStart(http=%p)", http));
1013
1014 if (tls_options < 0)
1015 {
1016 DEBUG_puts("4_httpTLSStart: Setting defaults.");
1017 _cupsSetDefaults();
1018 DEBUG_printf(("4_httpTLSStart: tls_options=%x", tls_options));
1019 }
1020
1021 #ifdef HAVE_SECKEYCHAINOPEN
1022 if (http->mode == _HTTP_MODE_SERVER && !tls_keychain)
1023 #else
1024 if (http->mode == _HTTP_MODE_SERVER)
1025 #endif /* HAVE_SECKEYCHAINOPEN */
1026 {
1027 DEBUG_puts("4_httpTLSStart: cupsSetServerCredentials not called.");
1028 http->error = errno = EINVAL;
1029 http->status = HTTP_STATUS_ERROR;
1030 _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Server credentials not set."), 1);
1031
1032 return (-1);
1033 }
1034
1035 if ((http->tls = SSLCreateContext(kCFAllocatorDefault, http->mode == _HTTP_MODE_CLIENT ? kSSLClientSide : kSSLServerSide, kSSLStreamType)) == NULL)
1036 {
1037 DEBUG_puts("4_httpTLSStart: SSLCreateContext failed.");
1038 http->error = errno = ENOMEM;
1039 http->status = HTTP_STATUS_ERROR;
1040 _cupsSetHTTPError(HTTP_STATUS_ERROR);
1041
1042 return (-1);
1043 }
1044
1045 error = SSLSetConnection(http->tls, http);
1046 DEBUG_printf(("4_httpTLSStart: SSLSetConnection, error=%d", (int)error));
1047
1048 if (!error)
1049 {
1050 error = SSLSetIOFuncs(http->tls, http_cdsa_read, http_cdsa_write);
1051 DEBUG_printf(("4_httpTLSStart: SSLSetIOFuncs, error=%d", (int)error));
1052 }
1053
1054 if (!error)
1055 {
1056 error = SSLSetSessionOption(http->tls, kSSLSessionOptionBreakOnServerAuth,
1057 true);
1058 DEBUG_printf(("4_httpTLSStart: SSLSetSessionOption, error=%d", (int)error));
1059 }
1060
1061 if (!error)
1062 {
1063 SSLProtocol minProtocol;
1064
1065 if (tls_options & _HTTP_TLS_DENY_TLS10)
1066 minProtocol = kTLSProtocol11;
1067 else if (tls_options & _HTTP_TLS_ALLOW_SSL3)
1068 minProtocol = kSSLProtocol3;
1069 else
1070 minProtocol = kTLSProtocol1;
1071
1072 error = SSLSetProtocolVersionMin(http->tls, minProtocol);
1073 DEBUG_printf(("4_httpTLSStart: SSLSetProtocolVersionMin(%d), error=%d", minProtocol, (int)error));
1074 }
1075
1076 # if HAVE_SSLSETENABLEDCIPHERS
1077 if (!error)
1078 {
1079 SSLCipherSuite supported[100]; /* Supported cipher suites */
1080 size_t num_supported; /* Number of supported cipher suites */
1081 SSLCipherSuite enabled[100]; /* Cipher suites to enable */
1082 size_t num_enabled; /* Number of cipher suites to enable */
1083
1084 num_supported = sizeof(supported) / sizeof(supported[0]);
1085 error = SSLGetSupportedCiphers(http->tls, supported, &num_supported);
1086
1087 if (!error)
1088 {
1089 DEBUG_printf(("4_httpTLSStart: %d cipher suites supported.", (int)num_supported));
1090
1091 for (i = 0, num_enabled = 0; i < (int)num_supported && num_enabled < (sizeof(enabled) / sizeof(enabled[0])); i ++)
1092 {
1093 switch (supported[i])
1094 {
1095 /* Obviously insecure cipher suites that we never want to use */
1096 case SSL_NULL_WITH_NULL_NULL :
1097 case SSL_RSA_WITH_NULL_MD5 :
1098 case SSL_RSA_WITH_NULL_SHA :
1099 case SSL_RSA_EXPORT_WITH_RC4_40_MD5 :
1100 case SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5 :
1101 case SSL_RSA_EXPORT_WITH_DES40_CBC_SHA :
1102 case SSL_RSA_WITH_DES_CBC_SHA :
1103 case SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA :
1104 case SSL_DH_DSS_WITH_DES_CBC_SHA :
1105 case SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA :
1106 case SSL_DH_RSA_WITH_DES_CBC_SHA :
1107 case SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA :
1108 case SSL_DHE_DSS_WITH_DES_CBC_SHA :
1109 case SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA :
1110 case SSL_DHE_RSA_WITH_DES_CBC_SHA :
1111 case SSL_DH_anon_EXPORT_WITH_RC4_40_MD5 :
1112 case SSL_DH_anon_WITH_RC4_128_MD5 :
1113 case SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA :
1114 case SSL_DH_anon_WITH_DES_CBC_SHA :
1115 case SSL_DH_anon_WITH_3DES_EDE_CBC_SHA :
1116 case SSL_FORTEZZA_DMS_WITH_NULL_SHA :
1117 case TLS_DH_anon_WITH_AES_128_CBC_SHA :
1118 case TLS_DH_anon_WITH_AES_256_CBC_SHA :
1119 case TLS_ECDH_ECDSA_WITH_NULL_SHA :
1120 case TLS_ECDHE_RSA_WITH_NULL_SHA :
1121 case TLS_ECDH_anon_WITH_NULL_SHA :
1122 case TLS_ECDH_anon_WITH_RC4_128_SHA :
1123 case TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA :
1124 case TLS_ECDH_anon_WITH_AES_128_CBC_SHA :
1125 case TLS_ECDH_anon_WITH_AES_256_CBC_SHA :
1126 case TLS_RSA_WITH_NULL_SHA256 :
1127 case TLS_DH_anon_WITH_AES_128_CBC_SHA256 :
1128 case TLS_DH_anon_WITH_AES_256_CBC_SHA256 :
1129 case TLS_PSK_WITH_NULL_SHA :
1130 case TLS_DHE_PSK_WITH_NULL_SHA :
1131 case TLS_RSA_PSK_WITH_NULL_SHA :
1132 case TLS_DH_anon_WITH_AES_128_GCM_SHA256 :
1133 case TLS_DH_anon_WITH_AES_256_GCM_SHA384 :
1134 case TLS_PSK_WITH_NULL_SHA256 :
1135 case TLS_PSK_WITH_NULL_SHA384 :
1136 case TLS_DHE_PSK_WITH_NULL_SHA256 :
1137 case TLS_DHE_PSK_WITH_NULL_SHA384 :
1138 case TLS_RSA_PSK_WITH_NULL_SHA256 :
1139 case TLS_RSA_PSK_WITH_NULL_SHA384 :
1140 case SSL_RSA_WITH_DES_CBC_MD5 :
1141 DEBUG_printf(("4_httpTLSStart: Excluding insecure cipher suite %d", supported[i]));
1142 break;
1143
1144 /* RC4 cipher suites that should only be used as a last resort */
1145 case SSL_RSA_WITH_RC4_128_MD5 :
1146 case SSL_RSA_WITH_RC4_128_SHA :
1147 case TLS_ECDH_ECDSA_WITH_RC4_128_SHA :
1148 case TLS_ECDHE_ECDSA_WITH_RC4_128_SHA :
1149 case TLS_ECDH_RSA_WITH_RC4_128_SHA :
1150 case TLS_ECDHE_RSA_WITH_RC4_128_SHA :
1151 case TLS_PSK_WITH_RC4_128_SHA :
1152 case TLS_DHE_PSK_WITH_RC4_128_SHA :
1153 case TLS_RSA_PSK_WITH_RC4_128_SHA :
1154 if (tls_options & _HTTP_TLS_ALLOW_RC4)
1155 enabled[num_enabled ++] = supported[i];
1156 else
1157 DEBUG_printf(("4_httpTLSStart: Excluding RC4 cipher suite %d", supported[i]));
1158 break;
1159
1160 /* DH/DHE cipher suites that are problematic with parameters < 1024 bits */
1161 case TLS_DH_DSS_WITH_AES_128_CBC_SHA :
1162 case TLS_DH_RSA_WITH_AES_128_CBC_SHA :
1163 case TLS_DHE_DSS_WITH_AES_128_CBC_SHA :
1164 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA :
1165 case TLS_DH_DSS_WITH_AES_256_CBC_SHA :
1166 case TLS_DH_RSA_WITH_AES_256_CBC_SHA :
1167 case TLS_DHE_DSS_WITH_AES_256_CBC_SHA :
1168 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA :
1169 case TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA :
1170 case TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA :
1171 case TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA :
1172 case TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA :
1173 case TLS_DH_DSS_WITH_AES_128_CBC_SHA256 :
1174 case TLS_DH_RSA_WITH_AES_128_CBC_SHA256 :
1175 case TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 :
1176 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 :
1177 case TLS_DH_DSS_WITH_AES_256_CBC_SHA256 :
1178 case TLS_DH_RSA_WITH_AES_256_CBC_SHA256 :
1179 case TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 :
1180 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 :
1181 case TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA :
1182 case TLS_DHE_PSK_WITH_AES_128_CBC_SHA :
1183 case TLS_DHE_PSK_WITH_AES_256_CBC_SHA :
1184 case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 :
1185 case TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 :
1186 case TLS_DH_RSA_WITH_AES_128_GCM_SHA256 :
1187 case TLS_DH_RSA_WITH_AES_256_GCM_SHA384 :
1188 case TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 :
1189 case TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 :
1190 case TLS_DH_DSS_WITH_AES_128_GCM_SHA256 :
1191 case TLS_DH_DSS_WITH_AES_256_GCM_SHA384 :
1192 case TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 :
1193 case TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 :
1194 case TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 :
1195 case TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 :
1196 if (tls_options & _HTTP_TLS_ALLOW_DH)
1197 enabled[num_enabled ++] = supported[i];
1198 else
1199 DEBUG_printf(("4_httpTLSStart: Excluding DH/DHE cipher suite %d", supported[i]));
1200 break;
1201
1202 /* Anything else we'll assume is secure */
1203 default :
1204 enabled[num_enabled ++] = supported[i];
1205 break;
1206 }
1207 }
1208
1209 DEBUG_printf(("4_httpTLSStart: %d cipher suites enabled.", (int)num_enabled));
1210 error = SSLSetEnabledCiphers(http->tls, enabled, num_enabled);
1211 }
1212 }
1213 #endif /* HAVE_SSLSETENABLEDCIPHERS */
1214
1215 if (!error && http->mode == _HTTP_MODE_CLIENT)
1216 {
1217 /*
1218 * Client: set client-side credentials, if any...
1219 */
1220
1221 if (cg->client_cert_cb)
1222 {
1223 error = SSLSetSessionOption(http->tls,
1224 kSSLSessionOptionBreakOnCertRequested, true);
1225 DEBUG_printf(("4_httpTLSStart: kSSLSessionOptionBreakOnCertRequested, "
1226 "error=%d", (int)error));
1227 }
1228 else
1229 {
1230 error = http_cdsa_set_credentials(http);
1231 DEBUG_printf(("4_httpTLSStart: http_cdsa_set_credentials, error=%d",
1232 (int)error));
1233 }
1234 }
1235 else if (!error)
1236 {
1237 /*
1238 * Server: find/create a certificate for TLS...
1239 */
1240
1241 if (http->fields[HTTP_FIELD_HOST][0])
1242 {
1243 /*
1244 * Use hostname for TLS upgrade...
1245 */
1246
1247 strlcpy(hostname, http->fields[HTTP_FIELD_HOST], sizeof(hostname));
1248 }
1249 else
1250 {
1251 /*
1252 * Resolve hostname from connection address...
1253 */
1254
1255 http_addr_t addr; /* Connection address */
1256 socklen_t addrlen; /* Length of address */
1257
1258 addrlen = sizeof(addr);
1259 if (getsockname(http->fd, (struct sockaddr *)&addr, &addrlen))
1260 {
1261 DEBUG_printf(("4_httpTLSStart: Unable to get socket address: %s", strerror(errno)));
1262 hostname[0] = '\0';
1263 }
1264 else if (httpAddrLocalhost(&addr))
1265 hostname[0] = '\0';
1266 else
1267 {
1268 httpAddrLookup(&addr, hostname, sizeof(hostname));
1269 DEBUG_printf(("4_httpTLSStart: Resolved socket address to \"%s\".", hostname));
1270 }
1271 }
1272
1273 #ifdef HAVE_SECKEYCHAINOPEN
1274 if (isdigit(hostname[0] & 255) || hostname[0] == '[')
1275 hostname[0] = '\0'; /* Don't allow numeric addresses */
1276
1277 if (hostname[0])
1278 http->tls_credentials = http_cdsa_copy_server(hostname);
1279 else if (tls_common_name)
1280 http->tls_credentials = http_cdsa_copy_server(tls_common_name);
1281
1282 if (!http->tls_credentials && tls_auto_create && (hostname[0] || tls_common_name))
1283 {
1284 DEBUG_printf(("4_httpTLSStart: Auto-create credentials for \"%s\".", hostname[0] ? hostname : tls_common_name));
1285
1286 if (!cupsMakeServerCredentials(tls_keypath, hostname[0] ? hostname : tls_common_name, 0, NULL, time(NULL) + 365 * 86400))
1287 {
1288 DEBUG_puts("4_httpTLSStart: cupsMakeServerCredentials failed.");
1289 http->error = errno = EINVAL;
1290 http->status = HTTP_STATUS_ERROR;
1291 _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create server credentials."), 1);
1292
1293 return (-1);
1294 }
1295
1296 http->tls_credentials = http_cdsa_copy_server(hostname[0] ? hostname : tls_common_name);
1297 }
1298 #endif /* HAVE_SECKEYCHAINOPEN */
1299
1300 if (!http->tls_credentials)
1301 {
1302 DEBUG_puts("4_httpTLSStart: Unable to find server credentials.");
1303 http->error = errno = EINVAL;
1304 http->status = HTTP_STATUS_ERROR;
1305 _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to find server credentials."), 1);
1306
1307 return (-1);
1308 }
1309
1310 error = SSLSetCertificate(http->tls, http->tls_credentials);
1311
1312 DEBUG_printf(("4_httpTLSStart: SSLSetCertificate, error=%d", (int)error));
1313 }
1314
1315 DEBUG_printf(("4_httpTLSStart: tls_credentials=%p", http->tls_credentials));
1316
1317 /*
1318 * Let the server know which hostname/domain we are trying to connect to
1319 * in case it wants to serve up a certificate with a matching common name.
1320 */
1321
1322 if (!error && http->mode == _HTTP_MODE_CLIENT)
1323 {
1324 /*
1325 * Client: get the hostname to use for TLS...
1326 */
1327
1328 if (httpAddrLocalhost(http->hostaddr))
1329 {
1330 strlcpy(hostname, "localhost", sizeof(hostname));
1331 }
1332 else
1333 {
1334 /*
1335 * Otherwise make sure the hostname we have does not end in a trailing dot.
1336 */
1337
1338 strlcpy(hostname, http->hostname, sizeof(hostname));
1339 if ((hostptr = hostname + strlen(hostname) - 1) >= hostname &&
1340 *hostptr == '.')
1341 *hostptr = '\0';
1342 }
1343
1344 error = SSLSetPeerDomainName(http->tls, hostname, strlen(hostname));
1345
1346 DEBUG_printf(("4_httpTLSStart: SSLSetPeerDomainName, error=%d", (int)error));
1347 }
1348
1349 if (!error)
1350 {
1351 int done = 0; /* Are we done yet? */
1352
1353 while (!error && !done)
1354 {
1355 error = SSLHandshake(http->tls);
1356
1357 DEBUG_printf(("4_httpTLSStart: SSLHandshake returned %d.", (int)error));
1358
1359 switch (error)
1360 {
1361 case noErr :
1362 done = 1;
1363 break;
1364
1365 case errSSLWouldBlock :
1366 error = noErr; /* Force a retry */
1367 usleep(1000); /* in 1 millisecond */
1368 break;
1369
1370 case errSSLServerAuthCompleted :
1371 error = 0;
1372 if (cg->server_cert_cb)
1373 {
1374 error = httpCopyCredentials(http, &credentials);
1375 if (!error)
1376 {
1377 error = (cg->server_cert_cb)(http, http->tls, credentials,
1378 cg->server_cert_data);
1379 httpFreeCredentials(credentials);
1380 }
1381
1382 DEBUG_printf(("4_httpTLSStart: Server certificate callback "
1383 "returned %d.", (int)error));
1384 }
1385 break;
1386
1387 case errSSLClientCertRequested :
1388 error = 0;
1389
1390 if (cg->client_cert_cb)
1391 {
1392 names = NULL;
1393 if (!(error = SSLCopyDistinguishedNames(http->tls, &dn_array)) &&
1394 dn_array)
1395 {
1396 if ((names = cupsArrayNew(NULL, NULL)) != NULL)
1397 {
1398 for (i = 0, count = CFArrayGetCount(dn_array); i < count; i++)
1399 {
1400 data = (CFDataRef)CFArrayGetValueAtIndex(dn_array, i);
1401
1402 if ((credential = malloc(sizeof(*credential))) != NULL)
1403 {
1404 credential->datalen = (size_t)CFDataGetLength(data);
1405 if ((credential->data = malloc(credential->datalen)))
1406 {
1407 memcpy((void *)credential->data, CFDataGetBytePtr(data),
1408 credential->datalen);
1409 cupsArrayAdd(names, credential);
1410 }
1411 else
1412 free(credential);
1413 }
1414 }
1415 }
1416
1417 CFRelease(dn_array);
1418 }
1419
1420 if (!error)
1421 {
1422 error = (cg->client_cert_cb)(http, http->tls, names,
1423 cg->client_cert_data);
1424
1425 DEBUG_printf(("4_httpTLSStart: Client certificate callback "
1426 "returned %d.", (int)error));
1427 }
1428
1429 httpFreeCredentials(names);
1430 }
1431 break;
1432
1433 case errSSLUnknownRootCert :
1434 message = _("Unable to establish a secure connection to host "
1435 "(untrusted certificate).");
1436 break;
1437
1438 case errSSLNoRootCert :
1439 message = _("Unable to establish a secure connection to host "
1440 "(self-signed certificate).");
1441 break;
1442
1443 case errSSLCertExpired :
1444 message = _("Unable to establish a secure connection to host "
1445 "(expired certificate).");
1446 break;
1447
1448 case errSSLCertNotYetValid :
1449 message = _("Unable to establish a secure connection to host "
1450 "(certificate not yet valid).");
1451 break;
1452
1453 case errSSLHostNameMismatch :
1454 message = _("Unable to establish a secure connection to host "
1455 "(host name mismatch).");
1456 break;
1457
1458 case errSSLXCertChainInvalid :
1459 message = _("Unable to establish a secure connection to host "
1460 "(certificate chain invalid).");
1461 break;
1462
1463 case errSSLConnectionRefused :
1464 message = _("Unable to establish a secure connection to host "
1465 "(peer dropped connection before responding).");
1466 break;
1467
1468 default :
1469 break;
1470 }
1471 }
1472 }
1473
1474 if (error)
1475 {
1476 http->error = error;
1477 http->status = HTTP_STATUS_ERROR;
1478 errno = ECONNREFUSED;
1479
1480 CFRelease(http->tls);
1481 http->tls = NULL;
1482
1483 /*
1484 * If an error string wasn't set by the callbacks use a generic one...
1485 */
1486
1487 if (!message)
1488 #ifdef HAVE_CSSMERRORSTRING
1489 message = cssmErrorString(error);
1490 #else
1491 message = _("Unable to establish a secure connection to host.");
1492 #endif /* HAVE_CSSMERRORSTRING */
1493
1494 _cupsSetError(IPP_STATUS_ERROR_CUPS_PKI, message, 1);
1495
1496 return (-1);
1497 }
1498
1499 return (0);
1500 }
1501
1502
1503 /*
1504 * '_httpTLSStop()' - Shut down SSL/TLS on a connection.
1505 */
1506
1507 void
1508 _httpTLSStop(http_t *http) /* I - HTTP connection */
1509 {
1510 while (SSLClose(http->tls) == errSSLWouldBlock)
1511 usleep(1000);
1512
1513 CFRelease(http->tls);
1514
1515 if (http->tls_credentials)
1516 CFRelease(http->tls_credentials);
1517
1518 http->tls = NULL;
1519 http->tls_credentials = NULL;
1520 }
1521
1522
1523 /*
1524 * '_httpTLSWrite()' - Write to a SSL/TLS connection.
1525 */
1526
1527 int /* O - Bytes written */
1528 _httpTLSWrite(http_t *http, /* I - HTTP connection */
1529 const char *buf, /* I - Buffer holding data */
1530 int len) /* I - Length of buffer */
1531 {
1532 ssize_t result; /* Return value */
1533 OSStatus error; /* Error info */
1534 size_t processed; /* Number of bytes processed */
1535
1536
1537 DEBUG_printf(("2_httpTLSWrite(http=%p, buf=%p, len=%d)", http, buf, len));
1538
1539 error = SSLWrite(http->tls, buf, (size_t)len, &processed);
1540
1541 switch (error)
1542 {
1543 case 0 :
1544 result = (int)processed;
1545 break;
1546
1547 case errSSLWouldBlock :
1548 if (processed)
1549 {
1550 result = (int)processed;
1551 }
1552 else
1553 {
1554 result = -1;
1555 errno = EINTR;
1556 }
1557 break;
1558
1559 case errSSLClosedGraceful :
1560 default :
1561 if (processed)
1562 {
1563 result = (int)processed;
1564 }
1565 else
1566 {
1567 result = -1;
1568 errno = EPIPE;
1569 }
1570 break;
1571 }
1572
1573 DEBUG_printf(("3_httpTLSWrite: Returning %d.", (int)result));
1574
1575 return ((int)result);
1576 }
1577
1578
1579 #ifdef HAVE_SECKEYCHAINOPEN
1580 /*
1581 * 'http_cdsa_copy_server()' - Find and copy server credentials from the keychain.
1582 */
1583
1584 static CFArrayRef /* O - Array of certificates or NULL */
1585 http_cdsa_copy_server(
1586 const char *common_name) /* I - Server's hostname */
1587 {
1588 OSStatus err; /* Error info */
1589 SecIdentitySearchRef search = NULL; /* Search reference */
1590 SecIdentityRef identity = NULL;/* Identity */
1591 CFArrayRef certificates = NULL;
1592 /* Certificate array */
1593 SecPolicyRef policy = NULL; /* Policy ref */
1594 CFStringRef cfcommon_name = NULL;
1595 /* Server name */
1596 CFMutableDictionaryRef query = NULL; /* Query qualifiers */
1597 CFArrayRef list = NULL; /* Keychain list */
1598
1599
1600 cfcommon_name = CFStringCreateWithCString(kCFAllocatorDefault, common_name, kCFStringEncodingUTF8);
1601
1602 policy = SecPolicyCreateSSL(1, cfcommon_name);
1603
1604 if (cfcommon_name)
1605 CFRelease(cfcommon_name);
1606
1607 if (!policy)
1608 goto cleanup;
1609
1610 if (!(query = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks)))
1611 goto cleanup;
1612
1613 _cupsMutexLock(&tls_mutex);
1614
1615 list = CFArrayCreate(kCFAllocatorDefault, (const void **)&tls_keychain, 1, &kCFTypeArrayCallBacks);
1616
1617 CFDictionaryAddValue(query, kSecClass, kSecClassIdentity);
1618 CFDictionaryAddValue(query, kSecMatchPolicy, policy);
1619 CFDictionaryAddValue(query, kSecReturnRef, kCFBooleanTrue);
1620 CFDictionaryAddValue(query, kSecMatchLimit, kSecMatchLimitOne);
1621 CFDictionaryAddValue(query, kSecMatchSearchList, list);
1622
1623 CFRelease(list);
1624
1625 err = SecItemCopyMatching(query, (CFTypeRef *)&identity);
1626
1627 _cupsMutexUnlock(&tls_mutex);
1628
1629 if (err)
1630 goto cleanup;
1631
1632 if (CFGetTypeID(identity) != SecIdentityGetTypeID())
1633 goto cleanup;
1634
1635 if ((certificates = CFArrayCreate(NULL, (const void **)&identity, 1, &kCFTypeArrayCallBacks)) == NULL)
1636 goto cleanup;
1637
1638 cleanup :
1639
1640 if (search)
1641 CFRelease(search);
1642 if (identity)
1643 CFRelease(identity);
1644
1645 if (policy)
1646 CFRelease(policy);
1647 if (query)
1648 CFRelease(query);
1649
1650 return (certificates);
1651 }
1652 #endif /* HAVE_SECKEYCHAINOPEN */
1653
1654
1655 /*
1656 * 'http_cdsa_create_credential()' - Create a single credential in the internal format.
1657 */
1658
1659 static SecCertificateRef /* O - Certificate */
1660 http_cdsa_create_credential(
1661 http_credential_t *credential) /* I - Credential */
1662 {
1663 if (!credential)
1664 return (NULL);
1665
1666 return (SecCertificateCreateWithBytes(kCFAllocatorDefault, credential->data, (CFIndex)credential->datalen));
1667 }
1668
1669
1670 /*
1671 * 'http_cdsa_default_path()' - Get the default keychain path.
1672 */
1673
1674 static const char * /* O - Keychain path */
1675 http_cdsa_default_path(char *buffer, /* I - Path buffer */
1676 size_t bufsize) /* I - Size of buffer */
1677 {
1678 const char *home = getenv("HOME"); /* HOME environment variable */
1679
1680
1681 if (getuid() && home)
1682 snprintf(buffer, bufsize, "%s/Library/Keychains/login.keychain", home);
1683 else
1684 strlcpy(buffer, "/Library/Keychains/System.keychain", bufsize);
1685
1686 DEBUG_printf(("1http_cdsa_default_path: Using default path \"%s\".", buffer));
1687
1688 return (buffer);
1689 }
1690
1691
1692 /*
1693 * 'http_cdsa_read()' - Read function for the CDSA library.
1694 */
1695
1696 static OSStatus /* O - -1 on error, 0 on success */
1697 http_cdsa_read(
1698 SSLConnectionRef connection, /* I - SSL/TLS connection */
1699 void *data, /* I - Data buffer */
1700 size_t *dataLength) /* IO - Number of bytes */
1701 {
1702 OSStatus result; /* Return value */
1703 ssize_t bytes; /* Number of bytes read */
1704 http_t *http; /* HTTP connection */
1705
1706
1707 http = (http_t *)connection;
1708
1709 if (!http->blocking)
1710 {
1711 /*
1712 * Make sure we have data before we read...
1713 */
1714
1715 while (!_httpWait(http, http->wait_value, 0))
1716 {
1717 if (http->timeout_cb && (*http->timeout_cb)(http, http->timeout_data))
1718 continue;
1719
1720 http->error = ETIMEDOUT;
1721 return (-1);
1722 }
1723 }
1724
1725 do
1726 {
1727 bytes = recv(http->fd, data, *dataLength, 0);
1728 }
1729 while (bytes == -1 && (errno == EINTR || errno == EAGAIN));
1730
1731 if ((size_t)bytes == *dataLength)
1732 {
1733 result = 0;
1734 }
1735 else if (bytes > 0)
1736 {
1737 *dataLength = (size_t)bytes;
1738 result = errSSLWouldBlock;
1739 }
1740 else
1741 {
1742 *dataLength = 0;
1743
1744 if (bytes == 0)
1745 result = errSSLClosedGraceful;
1746 else if (errno == EAGAIN)
1747 result = errSSLWouldBlock;
1748 else
1749 result = errSSLClosedAbort;
1750 }
1751
1752 return (result);
1753 }
1754
1755
1756 /*
1757 * 'http_cdsa_set_credentials()' - Set the TLS credentials.
1758 */
1759
1760 static int /* O - Status of connection */
1761 http_cdsa_set_credentials(http_t *http) /* I - HTTP connection */
1762 {
1763 _cups_globals_t *cg = _cupsGlobals(); /* Pointer to library globals */
1764 OSStatus error = 0; /* Error code */
1765 http_tls_credentials_t credentials = NULL;
1766 /* TLS credentials */
1767
1768
1769 DEBUG_printf(("7http_tls_set_credentials(%p)", http));
1770
1771 /*
1772 * Prefer connection specific credentials...
1773 */
1774
1775 if ((credentials = http->tls_credentials) == NULL)
1776 credentials = cg->tls_credentials;
1777
1778 if (credentials)
1779 {
1780 error = SSLSetCertificate(http->tls, credentials);
1781 DEBUG_printf(("4http_tls_set_credentials: SSLSetCertificate, error=%d",
1782 (int)error));
1783 }
1784 else
1785 DEBUG_puts("4http_tls_set_credentials: No credentials to set.");
1786
1787 return (error);
1788 }
1789
1790
1791 /*
1792 * 'http_cdsa_write()' - Write function for the CDSA library.
1793 */
1794
1795 static OSStatus /* O - -1 on error, 0 on success */
1796 http_cdsa_write(
1797 SSLConnectionRef connection, /* I - SSL/TLS connection */
1798 const void *data, /* I - Data buffer */
1799 size_t *dataLength) /* IO - Number of bytes */
1800 {
1801 OSStatus result; /* Return value */
1802 ssize_t bytes; /* Number of bytes read */
1803 http_t *http; /* HTTP connection */
1804
1805
1806 http = (http_t *)connection;
1807
1808 do
1809 {
1810 bytes = write(http->fd, data, *dataLength);
1811 }
1812 while (bytes == -1 && (errno == EINTR || errno == EAGAIN));
1813
1814 if ((size_t)bytes == *dataLength)
1815 {
1816 result = 0;
1817 }
1818 else if (bytes >= 0)
1819 {
1820 *dataLength = (size_t)bytes;
1821 result = errSSLWouldBlock;
1822 }
1823 else
1824 {
1825 *dataLength = 0;
1826
1827 if (errno == EAGAIN)
1828 result = errSSLWouldBlock;
1829 else
1830 result = errSSLClosedAbort;
1831 }
1832
1833 return (result);
1834 }
1835
1836
1837 /*
1838 * End of "$Id$".
1839 */
Unnamed repository; edit this file 'description' to name the repository.