]> git.ipfire.org Git - thirdparty/cups.git/blob - cups/tls-darwin.c
projects / thirdparty / cups.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
SIGSEGV in CUPS web ui when adding a printer
[thirdparty/cups.git] / cups / tls-darwin.c
1 /*
2 * TLS support code for CUPS on macOS.
3 *
4 * Copyright © 2007-2019 by Apple Inc.
5 * Copyright © 1997-2007 by Easy Software Products, all rights reserved.
6 *
7 * Licensed under Apache License v2.0. See the file "LICENSE" for more
8 * information.
9 */
10
11 /**** This file is included from tls.c ****/
12
13 /*
14 * Include necessary headers...
15 */
16
17 #include <spawn.h>
18
19 extern char **environ;
20
21
22 #ifndef _SECURITY_VERSION_GREATER_THAN_57610_
23 typedef CF_OPTIONS(uint32_t, SecKeyUsage) {
24 kSecKeyUsageAll = 0x7FFFFFFF
25 };
26 #endif /* !_SECURITY_VERSION_GREATER_THAN_57610_ */
27 extern const void * kSecCSRChallengePassword;
28 extern const void * kSecSubjectAltName;
29 extern const void * kSecCertificateKeyUsage;
30 extern const void * kSecCSRBasicContraintsPathLen;
31 extern const void * kSecCertificateExtensions;
32 extern const void * kSecCertificateExtensionsEncoded;
33 extern const void * kSecOidCommonName;
34 extern const void * kSecOidCountryName;
35 extern const void * kSecOidStateProvinceName;
36 extern const void * kSecOidLocalityName;
37 extern const void * kSecOidOrganization;
38 extern const void * kSecOidOrganizationalUnit;
39 extern bool SecCertificateIsValid(SecCertificateRef certificate, CFAbsoluteTime verifyTime);
40 extern CFAbsoluteTime SecCertificateNotValidAfter(SecCertificateRef certificate);
41 extern SecCertificateRef SecGenerateSelfSignedCertificate(CFArrayRef subject, CFDictionaryRef parameters, SecKeyRef publicKey, SecKeyRef privateKey);
42 extern SecIdentityRef SecIdentityCreate(CFAllocatorRef allocator, SecCertificateRef certificate, SecKeyRef privateKey);
43
44
45 /*
46 * Constants, very secure stuff...
47 */
48
49 #define _CUPS_CDSA_PASSWORD "42" /* CUPS keychain password */
50 #define _CUPS_CDSA_PASSLEN 2 /* Length of keychain password */
51
52
53 /*
54 * Local globals...
55 */
56
57 static int tls_auto_create = 0;
58 /* Auto-create self-signed certs? */
59 static char *tls_common_name = NULL;
60 /* Default common name */
61 #if TARGET_OS_OSX
62 static int tls_cups_keychain = 0;
63 /* Opened the CUPS keychain? */
64 static SecKeychainRef tls_keychain = NULL;
65 /* Server cert keychain */
66 #else
67 static SecIdentityRef tls_selfsigned = NULL;
68 /* Temporary self-signed cert */
69 #endif /* TARGET_OS_OSX */
70 static char *tls_keypath = NULL;
71 /* Server cert keychain path */
72 static _cups_mutex_t tls_mutex = _CUPS_MUTEX_INITIALIZER;
73 /* Mutex for keychain/certs */
74 static int tls_options = -1,/* Options for TLS connections */
75 tls_min_version = _HTTP_TLS_1_0,
76 tls_max_version = _HTTP_TLS_MAX;
77
78
79 /*
80 * Local functions...
81 */
82
83 static CFArrayRef http_cdsa_copy_server(const char *common_name);
84 static SecCertificateRef http_cdsa_create_credential(http_credential_t *credential);
85 #if TARGET_OS_OSX
86 static const char *http_cdsa_default_path(char *buffer, size_t bufsize);
87 static SecKeychainRef http_cdsa_open_keychain(const char *path, char *filename, size_t filesize);
88 static SecKeychainRef http_cdsa_open_system_keychain(void);
89 #endif /* TARGET_OS_OSX */
90 static OSStatus http_cdsa_read(SSLConnectionRef connection, void *data, size_t *dataLength);
91 static int http_cdsa_set_credentials(http_t *http);
92 static OSStatus http_cdsa_write(SSLConnectionRef connection, const void *data, size_t *dataLength);
93
94
95 /*
96 * 'cupsMakeServerCredentials()' - Make a self-signed certificate and private key pair.
97 *
98 * @since CUPS 2.0/OS 10.10@
99 */
100
101 int /* O - 1 on success, 0 on failure */
102 cupsMakeServerCredentials(
103 const char *path, /* I - Keychain path or @code NULL@ for default */
104 const char *common_name, /* I - Common name */
105 int num_alt_names, /* I - Number of subject alternate names */
106 const char **alt_names, /* I - Subject Alternate Names */
107 time_t expiration_date) /* I - Expiration date */
108 {
109 #if TARGET_OS_OSX
110 int pid, /* Process ID of command */
111 status, /* Status of command */
112 i; /* Looping var */
113 char command[1024], /* Command */
114 *argv[5], /* Command-line arguments */
115 *envp[1000], /* Environment variables */
116 days[32], /* CERTTOOL_EXPIRATION_DAYS env var */
117 keychain[1024], /* Keychain argument */
118 infofile[1024], /* Type-in information for cert */
119 filename[1024]; /* Default keychain path */
120 cups_file_t *fp; /* Seed/info file */
121
122
123 DEBUG_printf(("cupsMakeServerCredentials(path=\"%s\", common_name=\"%s\", num_alt_names=%d, alt_names=%p, expiration_date=%d)", path, common_name, num_alt_names, (void *)alt_names, (int)expiration_date));
124
125 (void)num_alt_names;
126 (void)alt_names;
127
128 if (!path)
129 path = http_cdsa_default_path(filename, sizeof(filename));
130
131 /*
132 * Run the "certtool" command to generate a self-signed certificate...
133 */
134
135 if (!cupsFileFind("certtool", getenv("PATH"), 1, command, sizeof(command)))
136 return (-1);
137
138 /*
139 * Create a file with the certificate information fields...
140 *
141 * Note: This assumes that the default questions are asked by the certtool
142 * command...
143 */
144
145 if ((fp = cupsTempFile2(infofile, sizeof(infofile))) == NULL)
146 return (-1);
147
148 cupsFilePrintf(fp,
149 "CUPS Self-Signed Certificate\n"
150 /* Enter key and certificate label */
151 "r\n" /* Generate RSA key pair */
152 "2048\n" /* 2048 bit encryption key */
153 "y\n" /* OK (y = yes) */
154 "b\n" /* Usage (b=signing/encryption) */
155 "2\n" /* Sign with SHA256 */
156 "y\n" /* OK (y = yes) */
157 "%s\n" /* Common name */
158 "\n" /* Country (default) */
159 "\n" /* Organization (default) */
160 "\n" /* Organizational unit (default) */
161 "\n" /* State/Province (default) */
162 "\n" /* Email address */
163 "y\n", /* OK (y = yes) */
164 common_name);
165 cupsFileClose(fp);
166
167 snprintf(keychain, sizeof(keychain), "k=%s", path);
168
169 argv[0] = "certtool";
170 argv[1] = "c";
171 argv[2] = keychain;
172 argv[3] = NULL;
173
174 snprintf(days, sizeof(days), "CERTTOOL_EXPIRATION_DAYS=%d", (int)((expiration_date - time(NULL) + 86399) / 86400));
175 envp[0] = days;
176 for (i = 0; i < (int)(sizeof(envp) / sizeof(envp[0]) - 2) && environ[i]; i ++)
177 envp[i + 1] = environ[i];
178 envp[i] = NULL;
179
180 posix_spawn_file_actions_t actions; /* File actions */
181
182 posix_spawn_file_actions_init(&actions);
183 posix_spawn_file_actions_addclose(&actions, 0);
184 posix_spawn_file_actions_addopen(&actions, 0, infofile, O_RDONLY, 0);
185 posix_spawn_file_actions_addclose(&actions, 1);
186 posix_spawn_file_actions_addopen(&actions, 1, "/dev/null", O_WRONLY, 0);
187 posix_spawn_file_actions_addclose(&actions, 2);
188 posix_spawn_file_actions_addopen(&actions, 2, "/dev/null", O_WRONLY, 0);
189
190 if (posix_spawn(&pid, command, &actions, NULL, argv, envp))
191 {
192 unlink(infofile);
193 return (-1);
194 }
195
196 posix_spawn_file_actions_destroy(&actions);
197
198 unlink(infofile);
199
200 while (waitpid(pid, &status, 0) < 0)
201 if (errno != EINTR)
202 {
203 status = -1;
204 break;
205 }
206
207 return (!status);
208
209 #else
210 int status = 0; /* Return status */
211 OSStatus err; /* Error code (if any) */
212 CFStringRef cfcommon_name = NULL;
213 /* CF string for server name */
214 SecIdentityRef ident = NULL; /* Identity */
215 SecKeyRef publicKey = NULL,
216 /* Public key */
217 privateKey = NULL;
218 /* Private key */
219 SecCertificateRef cert = NULL; /* Self-signed certificate */
220 CFMutableDictionaryRef keyParams = NULL;
221 /* Key generation parameters */
222
223
224 DEBUG_printf(("cupsMakeServerCredentials(path=\"%s\", common_name=\"%s\", num_alt_names=%d, alt_names=%p, expiration_date=%d)", path, common_name, num_alt_names, alt_names, (int)expiration_date));
225
226 (void)path;
227 (void)num_alt_names;
228 (void)alt_names;
229 (void)expiration_date;
230
231 if (path)
232 {
233 DEBUG_puts("1cupsMakeServerCredentials: No keychain support compiled in, returning 0.");
234 return (0);
235 }
236
237 if (tls_selfsigned)
238 {
239 DEBUG_puts("1cupsMakeServerCredentials: Using existing self-signed cert.");
240 return (1);
241 }
242
243 cfcommon_name = CFStringCreateWithCString(kCFAllocatorDefault, common_name, kCFStringEncodingUTF8);
244 if (!cfcommon_name)
245 {
246 DEBUG_puts("1cupsMakeServerCredentials: Unable to create CF string of common name.");
247 goto cleanup;
248 }
249
250 /*
251 * Create a public/private key pair...
252 */
253
254 keyParams = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
255 if (!keyParams)
256 {
257 DEBUG_puts("1cupsMakeServerCredentials: Unable to create key parameters dictionary.");
258 goto cleanup;
259 }
260
261 CFDictionaryAddValue(keyParams, kSecAttrKeyType, kSecAttrKeyTypeRSA);
262 CFDictionaryAddValue(keyParams, kSecAttrKeySizeInBits, CFSTR("2048"));
263 CFDictionaryAddValue(keyParams, kSecAttrLabel, cfcommon_name);
264
265 err = SecKeyGeneratePair(keyParams, &publicKey, &privateKey);
266 if (err != noErr)
267 {
268 DEBUG_printf(("1cupsMakeServerCredentials: Unable to generate key pair: %d.", (int)err));
269 goto cleanup;
270 }
271
272 /*
273 * Create a self-signed certificate using the public/private key pair...
274 */
275
276 CFIndex usageInt = kSecKeyUsageAll;
277 CFNumberRef usage = CFNumberCreate(kCFAllocatorDefault, kCFNumberCFIndexType, &usageInt);
278 CFIndex lenInt = 0;
279 CFNumberRef len = CFNumberCreate(kCFAllocatorDefault, kCFNumberCFIndexType, &lenInt);
280 CFTypeRef certKeys[] = { kSecCSRBasicContraintsPathLen, kSecSubjectAltName, kSecCertificateKeyUsage };
281 CFTypeRef certValues[] = { len, cfcommon_name, usage };
282 CFDictionaryRef certParams = CFDictionaryCreate(kCFAllocatorDefault, certKeys, certValues, sizeof(certKeys) / sizeof(certKeys[0]), &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
283 CFRelease(usage);
284 CFRelease(len);
285
286 const void *ca_o[] = { kSecOidOrganization, CFSTR("") };
287 const void *ca_cn[] = { kSecOidCommonName, cfcommon_name };
288 CFArrayRef ca_o_dn = CFArrayCreate(kCFAllocatorDefault, ca_o, 2, NULL);
289 CFArrayRef ca_cn_dn = CFArrayCreate(kCFAllocatorDefault, ca_cn, 2, NULL);
290 const void *ca_dn_array[2];
291
292 ca_dn_array[0] = CFArrayCreate(kCFAllocatorDefault, (const void **)&ca_o_dn, 1, NULL);
293 ca_dn_array[1] = CFArrayCreate(kCFAllocatorDefault, (const void **)&ca_cn_dn, 1, NULL);
294
295 CFArrayRef subject = CFArrayCreate(kCFAllocatorDefault, ca_dn_array, 2, NULL);
296
297 cert = SecGenerateSelfSignedCertificate(subject, certParams, publicKey, privateKey);
298
299 CFRelease(subject);
300 CFRelease(certParams);
301
302 if (!cert)
303 {
304 DEBUG_puts("1cupsMakeServerCredentials: Unable to create self-signed certificate.");
305 goto cleanup;
306 }
307
308 ident = SecIdentityCreate(kCFAllocatorDefault, cert, privateKey);
309
310 if (ident)
311 {
312 _cupsMutexLock(&tls_mutex);
313
314 if (tls_selfsigned)
315 CFRelease(ident);
316 else
317 tls_selfsigned = ident;
318
319 _cupsMutexLock(&tls_mutex);
320
321 # if 0 /* Someday perhaps SecItemCopyMatching will work for identities, at which point */
322 CFTypeRef itemKeys[] = { kSecClass, kSecAttrLabel, kSecValueRef };
323 CFTypeRef itemValues[] = { kSecClassIdentity, cfcommon_name, ident };
324 CFDictionaryRef itemAttrs = CFDictionaryCreate(kCFAllocatorDefault, itemKeys, itemValues, sizeof(itemKeys) / sizeof(itemKeys[0]), &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
325
326 err = SecItemAdd(itemAttrs, NULL);
327 /* SecItemAdd consumes itemAttrs... */
328
329 CFRelease(ident);
330
331 if (err != noErr)
332 {
333 DEBUG_printf(("1cupsMakeServerCredentials: Unable to add identity to keychain: %d.", (int)err));
334 goto cleanup;
335 }
336 # endif /* 0 */
337
338 status = 1;
339 }
340 else
341 DEBUG_puts("1cupsMakeServerCredentials: Unable to create identity from cert and keys.");
342
343 /*
344 * Cleanup and return...
345 */
346
347 cleanup:
348
349 if (cfcommon_name)
350 CFRelease(cfcommon_name);
351
352 if (keyParams)
353 CFRelease(keyParams);
354
355 if (cert)
356 CFRelease(cert);
357
358 if (publicKey)
359 CFRelease(publicKey);
360
361 if (privateKey)
362 CFRelease(privateKey);
363
364 DEBUG_printf(("1cupsMakeServerCredentials: Returning %d.", status));
365
366 return (status);
367 #endif /* TARGET_OS_OSX */
368 }
369
370
371 /*
372 * 'cupsSetServerCredentials()' - Set the default server credentials.
373 *
374 * Note: The server credentials are used by all threads in the running process.
375 * This function is threadsafe.
376 *
377 * @since CUPS 2.0/macOS 10.10@
378 */
379
380 int /* O - 1 on success, 0 on failure */
381 cupsSetServerCredentials(
382 const char *path, /* I - Keychain path or @code NULL@ for default */
383 const char *common_name, /* I - Default common name for server */
384 int auto_create) /* I - 1 = automatically create self-signed certificates */
385 {
386 DEBUG_printf(("cupsSetServerCredentials(path=\"%s\", common_name=\"%s\", auto_create=%d)", path, common_name, auto_create));
387
388 #if TARGET_OS_OSX
389 char filename[1024]; /* Keychain filename */
390 SecKeychainRef keychain = http_cdsa_open_keychain(path, filename, sizeof(filename));
391
392 if (!keychain)
393 {
394 DEBUG_puts("1cupsSetServerCredentials: Unable to open keychain.");
395 return (0);
396 }
397
398 _cupsMutexLock(&tls_mutex);
399
400 /*
401 * Close any keychain that is currently open...
402 */
403
404 if (tls_keychain)
405 CFRelease(tls_keychain);
406
407 if (tls_keypath)
408 _cupsStrFree(tls_keypath);
409
410 if (tls_common_name)
411 _cupsStrFree(tls_common_name);
412
413 /*
414 * Save the new keychain...
415 */
416
417 tls_keychain = keychain;
418 tls_keypath = _cupsStrAlloc(filename);
419 tls_auto_create = auto_create;
420 tls_common_name = _cupsStrAlloc(common_name);
421
422 _cupsMutexUnlock(&tls_mutex);
423
424 DEBUG_puts("1cupsSetServerCredentials: Opened keychain, returning 1.");
425 return (1);
426
427 #else
428 if (path)
429 {
430 DEBUG_puts("1cupsSetServerCredentials: No keychain support compiled in, returning 0.");
431 return (0);
432 }
433
434 tls_auto_create = auto_create;
435 tls_common_name = _cupsStrAlloc(common_name);
436
437 return (1);
438 #endif /* TARGET_OS_OSX */
439 }
440
441
442 /*
443 * 'httpCopyCredentials()' - Copy the credentials associated with the peer in
444 * an encrypted connection.
445 *
446 * @since CUPS 1.5/macOS 10.7@
447 */
448
449 int /* O - Status of call (0 = success) */
450 httpCopyCredentials(
451 http_t *http, /* I - Connection to server */
452 cups_array_t **credentials) /* O - Array of credentials */
453 {
454 OSStatus error; /* Error code */
455 SecTrustRef peerTrust; /* Peer trust reference */
456 CFIndex count; /* Number of credentials */
457 SecCertificateRef secCert; /* Certificate reference */
458 CFDataRef data; /* Certificate data */
459 int i; /* Looping var */
460
461
462 DEBUG_printf(("httpCopyCredentials(http=%p, credentials=%p)", (void *)http, (void *)credentials));
463
464 if (credentials)
465 *credentials = NULL;
466
467 if (!http || !http->tls || !credentials)
468 return (-1);
469
470 if (!(error = SSLCopyPeerTrust(http->tls, &peerTrust)) && peerTrust)
471 {
472 DEBUG_printf(("2httpCopyCredentials: Peer provided %d certificates.", (int)SecTrustGetCertificateCount(peerTrust)));
473
474 if ((*credentials = cupsArrayNew(NULL, NULL)) != NULL)
475 {
476 count = SecTrustGetCertificateCount(peerTrust);
477
478 for (i = 0; i < count; i ++)
479 {
480 secCert = SecTrustGetCertificateAtIndex(peerTrust, i);
481
482 #ifdef DEBUG
483 CFStringRef cf_name = SecCertificateCopySubjectSummary(secCert);
484 char name[1024];
485 if (cf_name)
486 CFStringGetCString(cf_name, name, sizeof(name), kCFStringEncodingUTF8);
487 else
488 strlcpy(name, "unknown", sizeof(name));
489
490 DEBUG_printf(("2httpCopyCredentials: Certificate %d name is \"%s\".", i, name));
491 #endif /* DEBUG */
492
493 if ((data = SecCertificateCopyData(secCert)) != NULL)
494 {
495 DEBUG_printf(("2httpCopyCredentials: Adding %d byte certificate blob.", (int)CFDataGetLength(data)));
496
497 httpAddCredential(*credentials, CFDataGetBytePtr(data), (size_t)CFDataGetLength(data));
498 CFRelease(data);
499 }
500 }
501 }
502
503 CFRelease(peerTrust);
504 }
505
506 return (error);
507 }
508
509
510 /*
511 * '_httpCreateCredentials()' - Create credentials in the internal format.
512 */
513
514 http_tls_credentials_t /* O - Internal credentials */
515 _httpCreateCredentials(
516 cups_array_t *credentials) /* I - Array of credentials */
517 {
518 CFMutableArrayRef peerCerts; /* Peer credentials reference */
519 SecCertificateRef secCert; /* Certificate reference */
520 http_credential_t *credential; /* Credential data */
521
522
523 if (!credentials)
524 return (NULL);
525
526 if ((peerCerts = CFArrayCreateMutable(kCFAllocatorDefault,
527 cupsArrayCount(credentials),
528 &kCFTypeArrayCallBacks)) == NULL)
529 return (NULL);
530
531 for (credential = (http_credential_t *)cupsArrayFirst(credentials);
532 credential;
533 credential = (http_credential_t *)cupsArrayNext(credentials))
534 {
535 if ((secCert = http_cdsa_create_credential(credential)) != NULL)
536 {
537 CFArrayAppendValue(peerCerts, secCert);
538 CFRelease(secCert);
539 }
540 }
541
542 return (peerCerts);
543 }
544
545
546 /*
547 * 'httpCredentialsAreValidForName()' - Return whether the credentials are valid for the given name.
548 *
549 * @since CUPS 2.0/macOS 10.10@
550 */
551
552 int /* O - 1 if valid, 0 otherwise */
553 httpCredentialsAreValidForName(
554 cups_array_t *credentials, /* I - Credentials */
555 const char *common_name) /* I - Name to check */
556 {
557 SecCertificateRef secCert; /* Certificate reference */
558 CFStringRef cfcert_name = NULL;
559 /* Certificate's common name (CF string) */
560 char cert_name[256]; /* Certificate's common name (C string) */
561 int valid = 1; /* Valid name? */
562
563
564 if ((secCert = http_cdsa_create_credential((http_credential_t *)cupsArrayFirst(credentials))) == NULL)
565 return (0);
566
567 /*
568 * Compare the common names...
569 */
570
571 if ((cfcert_name = SecCertificateCopySubjectSummary(secCert)) == NULL)
572 {
573 /*
574 * Can't get common name, cannot be valid...
575 */
576
577 valid = 0;
578 }
579 else if (CFStringGetCString(cfcert_name, cert_name, sizeof(cert_name), kCFStringEncodingUTF8) &&
580 _cups_strcasecmp(common_name, cert_name))
581 {
582 /*
583 * Not an exact match for the common name, check for wildcard certs...
584 */
585
586 const char *domain = strchr(common_name, '.');
587 /* Domain in common name */
588
589 if (strncmp(cert_name, "*.", 2) || !domain || _cups_strcasecmp(domain, cert_name + 1))
590 {
591 /*
592 * Not a wildcard match.
593 */
594
595 /* TODO: Check subject alternate names */
596 valid = 0;
597 }
598 }
599
600 if (cfcert_name)
601 CFRelease(cfcert_name);
602
603 CFRelease(secCert);
604
605 return (valid);
606 }
607
608
609 /*
610 * 'httpCredentialsGetTrust()' - Return the trust of credentials.
611 *
612 * @since CUPS 2.0/macOS 10.10@
613 */
614
615 http_trust_t /* O - Level of trust */
616 httpCredentialsGetTrust(
617 cups_array_t *credentials, /* I - Credentials */
618 const char *common_name) /* I - Common name for trust lookup */
619 {
620 SecCertificateRef secCert; /* Certificate reference */
621 http_trust_t trust = HTTP_TRUST_OK;
622 /* Trusted? */
623 cups_array_t *tcreds = NULL; /* Trusted credentials */
624 _cups_globals_t *cg = _cupsGlobals();
625 /* Per-thread globals */
626
627
628 if (!common_name)
629 {
630 _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("No common name specified."), 1);
631 return (HTTP_TRUST_UNKNOWN);
632 }
633
634 if ((secCert = http_cdsa_create_credential((http_credential_t *)cupsArrayFirst(credentials))) == NULL)
635 {
636 _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create credentials from array."), 1);
637 return (HTTP_TRUST_UNKNOWN);
638 }
639
640 if (cg->any_root < 0)
641 _cupsSetDefaults();
642
643 /*
644 * Look this common name up in the default keychains...
645 */
646
647 httpLoadCredentials(NULL, &tcreds, common_name);
648
649 if (tcreds)
650 {
651 char credentials_str[1024], /* String for incoming credentials */
652 tcreds_str[1024]; /* String for saved credentials */
653
654 httpCredentialsString(credentials, credentials_str, sizeof(credentials_str));
655 httpCredentialsString(tcreds, tcreds_str, sizeof(tcreds_str));
656
657 if (strcmp(credentials_str, tcreds_str))
658 {
659 /*
660 * Credentials don't match, let's look at the expiration date of the new
661 * credentials and allow if the new ones have a later expiration...
662 */
663
664 if (!cg->trust_first)
665 {
666 /*
667 * Do not trust certificates on first use...
668 */
669
670 _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Trust on first use is disabled."), 1);
671
672 trust = HTTP_TRUST_INVALID;
673 }
674 else if (httpCredentialsGetExpiration(credentials) <= httpCredentialsGetExpiration(tcreds))
675 {
676 /*
677 * The new credentials are not newly issued...
678 */
679
680 _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("New credentials are older than stored credentials."), 1);
681
682 trust = HTTP_TRUST_INVALID;
683 }
684 else if (!httpCredentialsAreValidForName(credentials, common_name))
685 {
686 /*
687 * The common name does not match the issued certificate...
688 */
689
690 _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("New credentials are not valid for name."), 1);
691
692 trust = HTTP_TRUST_INVALID;
693 }
694 else if (httpCredentialsGetExpiration(tcreds) < time(NULL))
695 {
696 /*
697 * Save the renewed credentials...
698 */
699
700 trust = HTTP_TRUST_RENEWED;
701
702 httpSaveCredentials(NULL, credentials, common_name);
703 }
704 }
705
706 httpFreeCredentials(tcreds);
707 }
708 else if (cg->validate_certs && !httpCredentialsAreValidForName(credentials, common_name))
709 {
710 _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("No stored credentials, not valid for name."), 1);
711 trust = HTTP_TRUST_INVALID;
712 }
713 else if (!cg->trust_first)
714 {
715 /*
716 * See if we have a site CA certificate we can compare...
717 */
718
719 if (!httpLoadCredentials(NULL, &tcreds, "site"))
720 {
721 if (cupsArrayCount(credentials) != (cupsArrayCount(tcreds) + 1))
722 {
723 /*
724 * Certificate isn't directly generated from the CA cert...
725 */
726
727 trust = HTTP_TRUST_INVALID;
728 }
729 else
730 {
731 /*
732 * Do a tail comparison of the two certificates...
733 */
734
735 http_credential_t *a, *b; /* Certificates */
736
737 for (a = (http_credential_t *)cupsArrayFirst(tcreds), b = (http_credential_t *)cupsArrayIndex(credentials, 1);
738 a && b;
739 a = (http_credential_t *)cupsArrayNext(tcreds), b = (http_credential_t *)cupsArrayNext(credentials))
740 if (a->datalen != b->datalen || memcmp(a->data, b->data, a->datalen))
741 break;
742
743 if (a || b)
744 trust = HTTP_TRUST_INVALID;
745 }
746
747 if (trust != HTTP_TRUST_OK)
748 _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Credentials do not validate against site CA certificate."), 1);
749 }
750 else
751 {
752 _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Trust on first use is disabled."), 1);
753 trust = HTTP_TRUST_INVALID;
754 }
755 }
756
757 if (trust == HTTP_TRUST_OK && !cg->expired_certs && !SecCertificateIsValid(secCert, CFAbsoluteTimeGetCurrent()))
758 {
759 _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Credentials have expired."), 1);
760 trust = HTTP_TRUST_EXPIRED;
761 }
762
763 if (trust == HTTP_TRUST_OK && !cg->any_root && cupsArrayCount(credentials) == 1)
764 {
765 _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Self-signed credentials are blocked."), 1);
766 trust = HTTP_TRUST_INVALID;
767 }
768
769 CFRelease(secCert);
770
771 return (trust);
772 }
773
774
775 /*
776 * 'httpCredentialsGetExpiration()' - Return the expiration date of the credentials.
777 *
778 * @since CUPS 2.0/macOS 10.10@
779 */
780
781 time_t /* O - Expiration date of credentials */
782 httpCredentialsGetExpiration(
783 cups_array_t *credentials) /* I - Credentials */
784 {
785 SecCertificateRef secCert; /* Certificate reference */
786 time_t expiration; /* Expiration date */
787
788
789 if ((secCert = http_cdsa_create_credential((http_credential_t *)cupsArrayFirst(credentials))) == NULL)
790 return (0);
791
792 expiration = (time_t)(SecCertificateNotValidAfter(secCert) + kCFAbsoluteTimeIntervalSince1970);
793
794 CFRelease(secCert);
795
796 return (expiration);
797 }
798
799
800 /*
801 * 'httpCredentialsString()' - Return a string representing the credentials.
802 *
803 * @since CUPS 2.0/macOS 10.10@
804 */
805
806 size_t /* O - Total size of credentials string */
807 httpCredentialsString(
808 cups_array_t *credentials, /* I - Credentials */
809 char *buffer, /* I - Buffer or @code NULL@ */
810 size_t bufsize) /* I - Size of buffer */
811 {
812 http_credential_t *first; /* First certificate */
813 SecCertificateRef secCert; /* Certificate reference */
814
815
816 DEBUG_printf(("httpCredentialsString(credentials=%p, buffer=%p, bufsize=" CUPS_LLFMT ")", (void *)credentials, (void *)buffer, CUPS_LLCAST bufsize));
817
818 if (!buffer)
819 return (0);
820
821 if (buffer && bufsize > 0)
822 *buffer = '\0';
823
824 if ((first = (http_credential_t *)cupsArrayFirst(credentials)) != NULL &&
825 (secCert = http_cdsa_create_credential(first)) != NULL)
826 {
827 /*
828 * Copy certificate (string) values from the SecCertificateRef and produce
829 * a one-line summary. The API for accessing certificate values like the
830 * issuer name is, um, "interesting"...
831 */
832
833 # if TARGET_OS_OSX
834 CFDictionaryRef cf_dict; /* Dictionary for certificate */
835 # endif /* TARGET_OS_OSX */
836 CFStringRef cf_string; /* CF string */
837 char commonName[256],/* Common name associated with cert */
838 issuer[256], /* Issuer name */
839 sigalg[256]; /* Signature algorithm */
840 time_t expiration; /* Expiration date of cert */
841 unsigned char md5_digest[16]; /* MD5 result */
842
843 if (SecCertificateCopyCommonName(secCert, &cf_string) == noErr)
844 {
845 CFStringGetCString(cf_string, commonName, (CFIndex)sizeof(commonName), kCFStringEncodingUTF8);
846 CFRelease(cf_string);
847 }
848 else
849 {
850 strlcpy(commonName, "unknown", sizeof(commonName));
851 }
852
853 strlcpy(issuer, "unknown", sizeof(issuer));
854 strlcpy(sigalg, "UnknownSignature", sizeof(sigalg));
855
856 # if TARGET_OS_OSX
857 if ((cf_dict = SecCertificateCopyValues(secCert, NULL, NULL)) != NULL)
858 {
859 CFDictionaryRef cf_issuer = CFDictionaryGetValue(cf_dict, kSecOIDX509V1IssuerName);
860 CFDictionaryRef cf_sigalg = CFDictionaryGetValue(cf_dict, kSecOIDX509V1SignatureAlgorithm);
861
862 if (cf_issuer)
863 {
864 CFArrayRef cf_values = CFDictionaryGetValue(cf_issuer, kSecPropertyKeyValue);
865 CFIndex i, count = CFArrayGetCount(cf_values);
866 CFDictionaryRef cf_value;
867
868 for (i = 0; i < count; i ++)
869 {
870 cf_value = CFArrayGetValueAtIndex(cf_values, i);
871
872 if (!CFStringCompare(CFDictionaryGetValue(cf_value, kSecPropertyKeyLabel), kSecOIDOrganizationName, kCFCompareCaseInsensitive))
873 CFStringGetCString(CFDictionaryGetValue(cf_value, kSecPropertyKeyValue), issuer, (CFIndex)sizeof(issuer), kCFStringEncodingUTF8);
874 }
875 }
876
877 if (cf_sigalg)
878 {
879 CFArrayRef cf_values = CFDictionaryGetValue(cf_sigalg, kSecPropertyKeyValue);
880 CFIndex i, count = CFArrayGetCount(cf_values);
881 CFDictionaryRef cf_value;
882
883 for (i = 0; i < count; i ++)
884 {
885 cf_value = CFArrayGetValueAtIndex(cf_values, i);
886
887 if (!CFStringCompare(CFDictionaryGetValue(cf_value, kSecPropertyKeyLabel), CFSTR("Algorithm"), kCFCompareCaseInsensitive))
888 {
889 CFStringRef cf_algorithm = CFDictionaryGetValue(cf_value, kSecPropertyKeyValue);
890
891 if (!CFStringCompare(cf_algorithm, CFSTR("1.2.840.113549.1.1.5"), kCFCompareCaseInsensitive))
892 strlcpy(sigalg, "SHA1WithRSAEncryption", sizeof(sigalg));
893 else if (!CFStringCompare(cf_algorithm, CFSTR("1.2.840.113549.1.1.11"), kCFCompareCaseInsensitive))
894 strlcpy(sigalg, "SHA256WithRSAEncryption", sizeof(sigalg));
895 else if (!CFStringCompare(cf_algorithm, CFSTR("1.2.840.113549.1.1.4"), kCFCompareCaseInsensitive))
896 strlcpy(sigalg, "MD5WithRSAEncryption", sizeof(sigalg));
897 }
898 }
899 }
900
901 CFRelease(cf_dict);
902 }
903 # endif /* TARGET_OS_OSX */
904
905 expiration = (time_t)(SecCertificateNotValidAfter(secCert) + kCFAbsoluteTimeIntervalSince1970);
906
907 cupsHashData("md5", first->data, first->datalen, md5_digest, sizeof(md5_digest));
908
909 snprintf(buffer, bufsize, "%s (issued by %s) / %s / %s / %02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X", commonName, issuer, httpGetDateString(expiration), sigalg, md5_digest[0], md5_digest[1], md5_digest[2], md5_digest[3], md5_digest[4], md5_digest[5], md5_digest[6], md5_digest[7], md5_digest[8], md5_digest[9], md5_digest[10], md5_digest[11], md5_digest[12], md5_digest[13], md5_digest[14], md5_digest[15]);
910
911 CFRelease(secCert);
912 }
913
914 DEBUG_printf(("1httpCredentialsString: Returning \"%s\".", buffer));
915
916 return (strlen(buffer));
917 }
918
919
920 /*
921 * '_httpFreeCredentials()' - Free internal credentials.
922 */
923
924 void
925 _httpFreeCredentials(
926 http_tls_credentials_t credentials) /* I - Internal credentials */
927 {
928 if (!credentials)
929 return;
930
931 CFRelease(credentials);
932 }
933
934
935 /*
936 * 'httpLoadCredentials()' - Load X.509 credentials from a keychain file.
937 *
938 * @since CUPS 2.0/OS 10.10@
939 */
940
941 int /* O - 0 on success, -1 on error */
942 httpLoadCredentials(
943 const char *path, /* I - Keychain path or @code NULL@ for default */
944 cups_array_t **credentials, /* IO - Credentials */
945 const char *common_name) /* I - Common name for credentials */
946 {
947 OSStatus err; /* Error info */
948 #if TARGET_OS_OSX
949 char filename[1024]; /* Filename for keychain */
950 SecKeychainRef keychain = NULL,/* Keychain reference */
951 syschain = NULL;/* System keychain */
952 CFArrayRef list; /* Keychain list */
953 #endif /* TARGET_OS_OSX */
954 SecCertificateRef cert = NULL; /* Certificate */
955 CFDataRef data; /* Certificate data */
956 SecPolicyRef policy = NULL; /* Policy ref */
957 CFStringRef cfcommon_name = NULL;
958 /* Server name */
959 CFMutableDictionaryRef query = NULL; /* Query qualifiers */
960
961
962 DEBUG_printf(("httpLoadCredentials(path=\"%s\", credentials=%p, common_name=\"%s\")", path, (void *)credentials, common_name));
963
964 if (!credentials)
965 return (-1);
966
967 *credentials = NULL;
968
969 #if TARGET_OS_OSX
970 keychain = http_cdsa_open_keychain(path, filename, sizeof(filename));
971
972 if (!keychain)
973 goto cleanup;
974
975 syschain = http_cdsa_open_system_keychain();
976
977 #else
978 if (path)
979 return (-1);
980 #endif /* TARGET_OS_OSX */
981
982 cfcommon_name = CFStringCreateWithCString(kCFAllocatorDefault, common_name, kCFStringEncodingUTF8);
983
984 policy = SecPolicyCreateSSL(1, cfcommon_name);
985
986 if (cfcommon_name)
987 CFRelease(cfcommon_name);
988
989 if (!policy)
990 goto cleanup;
991
992 if (!(query = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks)))
993 goto cleanup;
994
995 CFDictionaryAddValue(query, kSecClass, kSecClassCertificate);
996 CFDictionaryAddValue(query, kSecMatchPolicy, policy);
997 CFDictionaryAddValue(query, kSecReturnRef, kCFBooleanTrue);
998 CFDictionaryAddValue(query, kSecMatchLimit, kSecMatchLimitOne);
999
1000 #if TARGET_OS_OSX
1001 if (syschain)
1002 {
1003 const void *values[2] = { syschain, keychain };
1004
1005 list = CFArrayCreate(kCFAllocatorDefault, (const void **)values, 2, &kCFTypeArrayCallBacks);
1006 }
1007 else
1008 list = CFArrayCreate(kCFAllocatorDefault, (const void **)&keychain, 1, &kCFTypeArrayCallBacks);
1009 CFDictionaryAddValue(query, kSecMatchSearchList, list);
1010 CFRelease(list);
1011 #endif /* TARGET_OS_OSX */
1012
1013 err = SecItemCopyMatching(query, (CFTypeRef *)&cert);
1014
1015 if (err)
1016 goto cleanup;
1017
1018 if (CFGetTypeID(cert) != SecCertificateGetTypeID())
1019 goto cleanup;
1020
1021 if ((data = SecCertificateCopyData(cert)) != NULL)
1022 {
1023 DEBUG_printf(("1httpLoadCredentials: Adding %d byte certificate blob.", (int)CFDataGetLength(data)));
1024
1025 *credentials = cupsArrayNew(NULL, NULL);
1026 httpAddCredential(*credentials, CFDataGetBytePtr(data), (size_t)CFDataGetLength(data));
1027 CFRelease(data);
1028 }
1029
1030 cleanup :
1031
1032 #if TARGET_OS_OSX
1033 if (keychain)
1034 CFRelease(keychain);
1035
1036 if (syschain)
1037 CFRelease(syschain);
1038 #endif /* TARGET_OS_OSX */
1039 if (cert)
1040 CFRelease(cert);
1041 if (policy)
1042 CFRelease(policy);
1043 if (query)
1044 CFRelease(query);
1045
1046 DEBUG_printf(("1httpLoadCredentials: Returning %d.", *credentials ? 0 : -1));
1047
1048 return (*credentials ? 0 : -1);
1049 }
1050
1051
1052 /*
1053 * 'httpSaveCredentials()' - Save X.509 credentials to a keychain file.
1054 *
1055 * @since CUPS 2.0/OS 10.10@
1056 */
1057
1058 int /* O - -1 on error, 0 on success */
1059 httpSaveCredentials(
1060 const char *path, /* I - Keychain path or @code NULL@ for default */
1061 cups_array_t *credentials, /* I - Credentials */
1062 const char *common_name) /* I - Common name for credentials */
1063 {
1064 int ret = -1; /* Return value */
1065 OSStatus err; /* Error info */
1066 #if TARGET_OS_OSX
1067 char filename[1024]; /* Filename for keychain */
1068 SecKeychainRef keychain = NULL;/* Keychain reference */
1069 CFArrayRef list; /* Keychain list */
1070 #endif /* TARGET_OS_OSX */
1071 SecCertificateRef cert = NULL; /* Certificate */
1072 CFMutableDictionaryRef attrs = NULL; /* Attributes for add */
1073
1074
1075 DEBUG_printf(("httpSaveCredentials(path=\"%s\", credentials=%p, common_name=\"%s\")", path, (void *)credentials, common_name));
1076 if (!credentials)
1077 goto cleanup;
1078
1079 if (!httpCredentialsAreValidForName(credentials, common_name))
1080 {
1081 DEBUG_puts("1httpSaveCredentials: Common name does not match.");
1082 return (-1);
1083 }
1084
1085 if ((cert = http_cdsa_create_credential((http_credential_t *)cupsArrayFirst(credentials))) == NULL)
1086 {
1087 DEBUG_puts("1httpSaveCredentials: Unable to create certificate.");
1088 goto cleanup;
1089 }
1090
1091 #if TARGET_OS_OSX
1092 keychain = http_cdsa_open_keychain(path, filename, sizeof(filename));
1093
1094 if (!keychain)
1095 goto cleanup;
1096
1097 #else
1098 if (path)
1099 return (-1);
1100 #endif /* TARGET_OS_OSX */
1101
1102 if ((attrs = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks)) == NULL)
1103 {
1104 DEBUG_puts("1httpSaveCredentials: Unable to create dictionary.");
1105 goto cleanup;
1106 }
1107
1108 CFDictionaryAddValue(attrs, kSecClass, kSecClassCertificate);
1109 CFDictionaryAddValue(attrs, kSecValueRef, cert);
1110
1111 #if TARGET_OS_OSX
1112 if ((list = CFArrayCreate(kCFAllocatorDefault, (const void **)&keychain, 1, &kCFTypeArrayCallBacks)) == NULL)
1113 {
1114 DEBUG_puts("1httpSaveCredentials: Unable to create list of keychains.");
1115 goto cleanup;
1116 }
1117 CFDictionaryAddValue(attrs, kSecMatchSearchList, list);
1118 CFRelease(list);
1119 #endif /* TARGET_OS_OSX */
1120
1121 /* Note: SecItemAdd consumes "attrs"... */
1122 err = SecItemAdd(attrs, NULL);
1123 DEBUG_printf(("1httpSaveCredentials: SecItemAdd returned %d.", (int)err));
1124
1125 cleanup :
1126
1127 #if TARGET_OS_OSX
1128 if (keychain)
1129 CFRelease(keychain);
1130 #endif /* TARGET_OS_OSX */
1131 if (cert)
1132 CFRelease(cert);
1133
1134 DEBUG_printf(("1httpSaveCredentials: Returning %d.", ret));
1135
1136 return (ret);
1137 }
1138
1139
1140 /*
1141 * '_httpTLSInitialize()' - Initialize the TLS stack.
1142 */
1143
1144 void
1145 _httpTLSInitialize(void)
1146 {
1147 /*
1148 * Nothing to do...
1149 */
1150 }
1151
1152
1153 /*
1154 * '_httpTLSPending()' - Return the number of pending TLS-encrypted bytes.
1155 */
1156
1157 size_t
1158 _httpTLSPending(http_t *http) /* I - HTTP connection */
1159 {
1160 size_t bytes; /* Bytes that are available */
1161
1162
1163 if (!SSLGetBufferedReadSize(http->tls, &bytes))
1164 return (bytes);
1165
1166 return (0);
1167 }
1168
1169
1170 /*
1171 * '_httpTLSRead()' - Read from a SSL/TLS connection.
1172 */
1173
1174 int /* O - Bytes read */
1175 _httpTLSRead(http_t *http, /* I - HTTP connection */
1176 char *buf, /* I - Buffer to store data */
1177 int len) /* I - Length of buffer */
1178 {
1179 int result; /* Return value */
1180 OSStatus error; /* Error info */
1181 size_t processed; /* Number of bytes processed */
1182
1183
1184 error = SSLRead(http->tls, buf, (size_t)len, &processed);
1185 DEBUG_printf(("6_httpTLSRead: error=%d, processed=%d", (int)error,
1186 (int)processed));
1187 switch (error)
1188 {
1189 case 0 :
1190 result = (int)processed;
1191 break;
1192
1193 case errSSLWouldBlock :
1194 if (processed)
1195 result = (int)processed;
1196 else
1197 {
1198 result = -1;
1199 errno = EINTR;
1200 }
1201 break;
1202
1203 case errSSLClosedGraceful :
1204 default :
1205 if (processed)
1206 result = (int)processed;
1207 else
1208 {
1209 result = -1;
1210 errno = EPIPE;
1211 }
1212 break;
1213 }
1214
1215 return (result);
1216 }
1217
1218
1219 /*
1220 * '_httpTLSSetOptions()' - Set TLS protocol and cipher suite options.
1221 */
1222
1223 void
1224 _httpTLSSetOptions(int options, /* I - Options */
1225 int min_version, /* I - Minimum TLS version */
1226 int max_version) /* I - Maximum TLS version */
1227 {
1228 if (!(options & _HTTP_TLS_SET_DEFAULT) || tls_options < 0)
1229 {
1230 tls_options = options;
1231 tls_min_version = min_version;
1232 tls_max_version = max_version;
1233 }
1234 }
1235
1236
1237 /*
1238 * '_httpTLSStart()' - Set up SSL/TLS support on a connection.
1239 */
1240
1241 int /* O - 0 on success, -1 on failure */
1242 _httpTLSStart(http_t *http) /* I - HTTP connection */
1243 {
1244 char hostname[256], /* Hostname */
1245 *hostptr; /* Pointer into hostname */
1246 _cups_globals_t *cg = _cupsGlobals();
1247 /* Pointer to library globals */
1248 OSStatus error; /* Error code */
1249 const char *message = NULL;/* Error message */
1250 char msgbuf[1024]; /* Error message buffer */
1251 cups_array_t *credentials; /* Credentials array */
1252 cups_array_t *names; /* CUPS distinguished names */
1253 CFArrayRef dn_array; /* CF distinguished names array */
1254 CFIndex count; /* Number of credentials */
1255 CFDataRef data; /* Certificate data */
1256 int i; /* Looping var */
1257 http_credential_t *credential; /* Credential data */
1258
1259
1260 DEBUG_printf(("3_httpTLSStart(http=%p)", (void *)http));
1261
1262 if (tls_options < 0)
1263 {
1264 DEBUG_puts("4_httpTLSStart: Setting defaults.");
1265 _cupsSetDefaults();
1266 DEBUG_printf(("4_httpTLSStart: tls_options=%x, tls_min_version=%d, tls_max_version=%d", tls_options, tls_min_version, tls_max_version));
1267 }
1268
1269 #if TARGET_OS_OSX
1270 if (http->mode == _HTTP_MODE_SERVER && !tls_keychain)
1271 {
1272 DEBUG_puts("4_httpTLSStart: cupsSetServerCredentials not called.");
1273 http->error = errno = EINVAL;
1274 http->status = HTTP_STATUS_ERROR;
1275 _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Server credentials not set."), 1);
1276
1277 return (-1);
1278 }
1279 #endif /* TARGET_OS_OSX */
1280
1281 if ((http->tls = SSLCreateContext(kCFAllocatorDefault, http->mode == _HTTP_MODE_CLIENT ? kSSLClientSide : kSSLServerSide, kSSLStreamType)) == NULL)
1282 {
1283 DEBUG_puts("4_httpTLSStart: SSLCreateContext failed.");
1284 http->error = errno = ENOMEM;
1285 http->status = HTTP_STATUS_ERROR;
1286 _cupsSetHTTPError(HTTP_STATUS_ERROR);
1287
1288 return (-1);
1289 }
1290
1291 error = SSLSetConnection(http->tls, http);
1292 DEBUG_printf(("4_httpTLSStart: SSLSetConnection, error=%d", (int)error));
1293
1294 if (!error)
1295 {
1296 error = SSLSetIOFuncs(http->tls, http_cdsa_read, http_cdsa_write);
1297 DEBUG_printf(("4_httpTLSStart: SSLSetIOFuncs, error=%d", (int)error));
1298 }
1299
1300 if (!error)
1301 {
1302 error = SSLSetSessionOption(http->tls, kSSLSessionOptionBreakOnServerAuth,
1303 true);
1304 DEBUG_printf(("4_httpTLSStart: SSLSetSessionOption, error=%d", (int)error));
1305 }
1306
1307 if (!error)
1308 {
1309 static const SSLProtocol protocols[] = /* Min/max protocol versions */
1310 {
1311 kSSLProtocol3,
1312 kTLSProtocol1,
1313 kTLSProtocol11,
1314 kTLSProtocol12,
1315 kTLSProtocol13
1316 };
1317
1318 if (tls_min_version < _HTTP_TLS_MAX)
1319 {
1320 error = SSLSetProtocolVersionMin(http->tls, protocols[tls_min_version]);
1321 DEBUG_printf(("4_httpTLSStart: SSLSetProtocolVersionMin(%d), error=%d", protocols[tls_min_version], (int)error));
1322 }
1323
1324 if (!error && tls_max_version < _HTTP_TLS_MAX)
1325 {
1326 error = SSLSetProtocolVersionMax(http->tls, protocols[tls_max_version]);
1327 DEBUG_printf(("4_httpTLSStart: SSLSetProtocolVersionMax(%d), error=%d", protocols[tls_max_version], (int)error));
1328 }
1329 }
1330
1331 if (!error)
1332 {
1333 SSLCipherSuite supported[100]; /* Supported cipher suites */
1334 size_t num_supported; /* Number of supported cipher suites */
1335 SSLCipherSuite enabled[100]; /* Cipher suites to enable */
1336 size_t num_enabled; /* Number of cipher suites to enable */
1337
1338 num_supported = sizeof(supported) / sizeof(supported[0]);
1339 error = SSLGetSupportedCiphers(http->tls, supported, &num_supported);
1340
1341 if (!error)
1342 {
1343 DEBUG_printf(("4_httpTLSStart: %d cipher suites supported.", (int)num_supported));
1344
1345 for (i = 0, num_enabled = 0; i < (int)num_supported && num_enabled < (sizeof(enabled) / sizeof(enabled[0])); i ++)
1346 {
1347 switch (supported[i])
1348 {
1349 /* Obviously insecure cipher suites that we never want to use */
1350 case SSL_NULL_WITH_NULL_NULL :
1351 case SSL_RSA_WITH_NULL_MD5 :
1352 case SSL_RSA_WITH_NULL_SHA :
1353 case SSL_RSA_EXPORT_WITH_RC4_40_MD5 :
1354 case SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5 :
1355 case SSL_RSA_EXPORT_WITH_DES40_CBC_SHA :
1356 case SSL_RSA_WITH_DES_CBC_SHA :
1357 case SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA :
1358 case SSL_DH_DSS_WITH_DES_CBC_SHA :
1359 case SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA :
1360 case SSL_DH_RSA_WITH_DES_CBC_SHA :
1361 case SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA :
1362 case SSL_DHE_DSS_WITH_DES_CBC_SHA :
1363 case SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA :
1364 case SSL_DHE_RSA_WITH_DES_CBC_SHA :
1365 case SSL_DH_anon_EXPORT_WITH_RC4_40_MD5 :
1366 case SSL_DH_anon_WITH_RC4_128_MD5 :
1367 case SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA :
1368 case SSL_DH_anon_WITH_DES_CBC_SHA :
1369 case SSL_DH_anon_WITH_3DES_EDE_CBC_SHA :
1370 case SSL_FORTEZZA_DMS_WITH_NULL_SHA :
1371 case TLS_DH_anon_WITH_AES_128_CBC_SHA :
1372 case TLS_DH_anon_WITH_AES_256_CBC_SHA :
1373 case TLS_ECDH_ECDSA_WITH_NULL_SHA :
1374 case TLS_ECDHE_RSA_WITH_NULL_SHA :
1375 case TLS_ECDH_anon_WITH_NULL_SHA :
1376 case TLS_ECDH_anon_WITH_RC4_128_SHA :
1377 case TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA :
1378 case TLS_ECDH_anon_WITH_AES_128_CBC_SHA :
1379 case TLS_ECDH_anon_WITH_AES_256_CBC_SHA :
1380 case TLS_RSA_WITH_NULL_SHA256 :
1381 case TLS_DH_anon_WITH_AES_128_CBC_SHA256 :
1382 case TLS_DH_anon_WITH_AES_256_CBC_SHA256 :
1383 case TLS_PSK_WITH_NULL_SHA :
1384 case TLS_DHE_PSK_WITH_NULL_SHA :
1385 case TLS_RSA_PSK_WITH_NULL_SHA :
1386 case TLS_DH_anon_WITH_AES_128_GCM_SHA256 :
1387 case TLS_DH_anon_WITH_AES_256_GCM_SHA384 :
1388 case TLS_PSK_WITH_NULL_SHA256 :
1389 case TLS_PSK_WITH_NULL_SHA384 :
1390 case TLS_DHE_PSK_WITH_NULL_SHA256 :
1391 case TLS_DHE_PSK_WITH_NULL_SHA384 :
1392 case TLS_RSA_PSK_WITH_NULL_SHA256 :
1393 case TLS_RSA_PSK_WITH_NULL_SHA384 :
1394 case SSL_RSA_WITH_DES_CBC_MD5 :
1395 DEBUG_printf(("4_httpTLSStart: Excluding insecure cipher suite %d", supported[i]));
1396 break;
1397
1398 /* RC4 cipher suites that should only be used as a last resort */
1399 case SSL_RSA_WITH_RC4_128_MD5 :
1400 case SSL_RSA_WITH_RC4_128_SHA :
1401 case TLS_ECDH_ECDSA_WITH_RC4_128_SHA :
1402 case TLS_ECDHE_ECDSA_WITH_RC4_128_SHA :
1403 case TLS_ECDH_RSA_WITH_RC4_128_SHA :
1404 case TLS_ECDHE_RSA_WITH_RC4_128_SHA :
1405 case TLS_PSK_WITH_RC4_128_SHA :
1406 case TLS_DHE_PSK_WITH_RC4_128_SHA :
1407 case TLS_RSA_PSK_WITH_RC4_128_SHA :
1408 if (tls_options & _HTTP_TLS_ALLOW_RC4)
1409 enabled[num_enabled ++] = supported[i];
1410 else
1411 DEBUG_printf(("4_httpTLSStart: Excluding RC4 cipher suite %d", supported[i]));
1412 break;
1413
1414 /* DH/DHE cipher suites that are problematic with parameters < 1024 bits */
1415 case TLS_DH_DSS_WITH_AES_128_CBC_SHA :
1416 case TLS_DH_RSA_WITH_AES_128_CBC_SHA :
1417 case TLS_DHE_DSS_WITH_AES_128_CBC_SHA :
1418 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA :
1419 case TLS_DH_DSS_WITH_AES_256_CBC_SHA :
1420 case TLS_DH_RSA_WITH_AES_256_CBC_SHA :
1421 case TLS_DHE_DSS_WITH_AES_256_CBC_SHA :
1422 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA :
1423 case TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA :
1424 case TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA :
1425 case TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA :
1426 case TLS_DH_DSS_WITH_AES_128_CBC_SHA256 :
1427 case TLS_DH_RSA_WITH_AES_128_CBC_SHA256 :
1428 case TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 :
1429 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 :
1430 case TLS_DH_DSS_WITH_AES_256_CBC_SHA256 :
1431 case TLS_DH_RSA_WITH_AES_256_CBC_SHA256 :
1432 case TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 :
1433 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 :
1434 case TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA :
1435 case TLS_DHE_PSK_WITH_AES_128_CBC_SHA :
1436 case TLS_DHE_PSK_WITH_AES_256_CBC_SHA :
1437 case TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 :
1438 case TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 :
1439 if (tls_options & _HTTP_TLS_DENY_CBC)
1440 {
1441 DEBUG_printf(("4_httpTLSStart: Excluding CBC cipher suite %d", supported[i]));
1442 break;
1443 }
1444
1445 // case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 :
1446 // case TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 :
1447 case TLS_DH_RSA_WITH_AES_128_GCM_SHA256 :
1448 case TLS_DH_RSA_WITH_AES_256_GCM_SHA384 :
1449 // case TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 :
1450 // case TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 :
1451 case TLS_DH_DSS_WITH_AES_128_GCM_SHA256 :
1452 case TLS_DH_DSS_WITH_AES_256_GCM_SHA384 :
1453 case TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 :
1454 case TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 :
1455 if (tls_options & _HTTP_TLS_ALLOW_DH)
1456 enabled[num_enabled ++] = supported[i];
1457 else
1458 DEBUG_printf(("4_httpTLSStart: Excluding DH/DHE cipher suite %d", supported[i]));
1459 break;
1460
1461 case TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA :
1462 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 :
1463 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 :
1464 case TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 :
1465 case TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 :
1466 case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 :
1467 case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 :
1468 case TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 :
1469 case TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 :
1470 case TLS_RSA_WITH_3DES_EDE_CBC_SHA :
1471 case TLS_RSA_WITH_AES_128_CBC_SHA :
1472 case TLS_RSA_WITH_AES_256_CBC_SHA :
1473 if (tls_options & _HTTP_TLS_DENY_CBC)
1474 {
1475 DEBUG_printf(("4_httpTLSStart: Excluding CBC cipher suite %d", supported[i]));
1476 break;
1477 }
1478
1479 /* Anything else we'll assume is "secure" */
1480 default :
1481 enabled[num_enabled ++] = supported[i];
1482 break;
1483 }
1484 }
1485
1486 DEBUG_printf(("4_httpTLSStart: %d cipher suites enabled.", (int)num_enabled));
1487 error = SSLSetEnabledCiphers(http->tls, enabled, num_enabled);
1488 }
1489 }
1490
1491 if (!error && http->mode == _HTTP_MODE_CLIENT)
1492 {
1493 /*
1494 * Client: set client-side credentials, if any...
1495 */
1496
1497 if (cg->client_cert_cb)
1498 {
1499 error = SSLSetSessionOption(http->tls,
1500 kSSLSessionOptionBreakOnCertRequested, true);
1501 DEBUG_printf(("4_httpTLSStart: kSSLSessionOptionBreakOnCertRequested, "
1502 "error=%d", (int)error));
1503 }
1504 else
1505 {
1506 error = http_cdsa_set_credentials(http);
1507 DEBUG_printf(("4_httpTLSStart: http_cdsa_set_credentials, error=%d",
1508 (int)error));
1509 }
1510 }
1511 else if (!error)
1512 {
1513 /*
1514 * Server: find/create a certificate for TLS...
1515 */
1516
1517 if (http->fields[HTTP_FIELD_HOST])
1518 {
1519 /*
1520 * Use hostname for TLS upgrade...
1521 */
1522
1523 strlcpy(hostname, http->fields[HTTP_FIELD_HOST], sizeof(hostname));
1524 }
1525 else
1526 {
1527 /*
1528 * Resolve hostname from connection address...
1529 */
1530
1531 http_addr_t addr; /* Connection address */
1532 socklen_t addrlen; /* Length of address */
1533
1534 addrlen = sizeof(addr);
1535 if (getsockname(http->fd, (struct sockaddr *)&addr, &addrlen))
1536 {
1537 DEBUG_printf(("4_httpTLSStart: Unable to get socket address: %s", strerror(errno)));
1538 hostname[0] = '\0';
1539 }
1540 else if (httpAddrLocalhost(&addr))
1541 hostname[0] = '\0';
1542 else
1543 {
1544 httpAddrLookup(&addr, hostname, sizeof(hostname));
1545 DEBUG_printf(("4_httpTLSStart: Resolved socket address to \"%s\".", hostname));
1546 }
1547 }
1548
1549 if (isdigit(hostname[0] & 255) || hostname[0] == '[')
1550 hostname[0] = '\0'; /* Don't allow numeric addresses */
1551
1552 if (hostname[0])
1553 http->tls_credentials = http_cdsa_copy_server(hostname);
1554 else if (tls_common_name)
1555 http->tls_credentials = http_cdsa_copy_server(tls_common_name);
1556
1557 if (!http->tls_credentials && tls_auto_create && (hostname[0] || tls_common_name))
1558 {
1559 DEBUG_printf(("4_httpTLSStart: Auto-create credentials for \"%s\".", hostname[0] ? hostname : tls_common_name));
1560
1561 if (!cupsMakeServerCredentials(tls_keypath, hostname[0] ? hostname : tls_common_name, 0, NULL, time(NULL) + 365 * 86400))
1562 {
1563 DEBUG_puts("4_httpTLSStart: cupsMakeServerCredentials failed.");
1564 http->error = errno = EINVAL;
1565 http->status = HTTP_STATUS_ERROR;
1566 _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create server credentials."), 1);
1567
1568 return (-1);
1569 }
1570
1571 http->tls_credentials = http_cdsa_copy_server(hostname[0] ? hostname : tls_common_name);
1572 }
1573
1574 if (!http->tls_credentials)
1575 {
1576 DEBUG_puts("4_httpTLSStart: Unable to find server credentials.");
1577 http->error = errno = EINVAL;
1578 http->status = HTTP_STATUS_ERROR;
1579 _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to find server credentials."), 1);
1580
1581 return (-1);
1582 }
1583
1584 error = SSLSetCertificate(http->tls, http->tls_credentials);
1585
1586 DEBUG_printf(("4_httpTLSStart: SSLSetCertificate, error=%d", (int)error));
1587 }
1588
1589 DEBUG_printf(("4_httpTLSStart: tls_credentials=%p", (void *)http->tls_credentials));
1590
1591 /*
1592 * Let the server know which hostname/domain we are trying to connect to
1593 * in case it wants to serve up a certificate with a matching common name.
1594 */
1595
1596 if (!error && http->mode == _HTTP_MODE_CLIENT)
1597 {
1598 /*
1599 * Client: get the hostname to use for TLS...
1600 */
1601
1602 if (httpAddrLocalhost(http->hostaddr))
1603 {
1604 strlcpy(hostname, "localhost", sizeof(hostname));
1605 }
1606 else
1607 {
1608 /*
1609 * Otherwise make sure the hostname we have does not end in a trailing dot.
1610 */
1611
1612 strlcpy(hostname, http->hostname, sizeof(hostname));
1613 if ((hostptr = hostname + strlen(hostname) - 1) >= hostname &&
1614 *hostptr == '.')
1615 *hostptr = '\0';
1616 }
1617
1618 error = SSLSetPeerDomainName(http->tls, hostname, strlen(hostname));
1619
1620 DEBUG_printf(("4_httpTLSStart: SSLSetPeerDomainName, error=%d", (int)error));
1621 }
1622
1623 if (!error)
1624 {
1625 int done = 0; /* Are we done yet? */
1626 double old_timeout; /* Old timeout value */
1627 http_timeout_cb_t old_cb; /* Old timeout callback */
1628 void *old_data; /* Old timeout data */
1629
1630 /*
1631 * Enforce a minimum timeout of 10 seconds for the TLS handshake...
1632 */
1633
1634 old_timeout = http->timeout_value;
1635 old_cb = http->timeout_cb;
1636 old_data = http->timeout_data;
1637
1638 if (!old_cb || old_timeout < 10.0)
1639 {
1640 DEBUG_puts("4_httpTLSStart: Setting timeout to 10 seconds.");
1641 httpSetTimeout(http, 10.0, NULL, NULL);
1642 }
1643
1644 /*
1645 * Do the TLS handshake...
1646 */
1647
1648 while (!error && !done)
1649 {
1650 error = SSLHandshake(http->tls);
1651
1652 DEBUG_printf(("4_httpTLSStart: SSLHandshake returned %d.", (int)error));
1653
1654 switch (error)
1655 {
1656 case noErr :
1657 done = 1;
1658 break;
1659
1660 case errSSLWouldBlock :
1661 error = noErr; /* Force a retry */
1662 usleep(1000); /* in 1 millisecond */
1663 break;
1664
1665 case errSSLServerAuthCompleted :
1666 error = 0;
1667 if (cg->server_cert_cb)
1668 {
1669 error = httpCopyCredentials(http, &credentials);
1670 if (!error)
1671 {
1672 error = (cg->server_cert_cb)(http, http->tls, credentials,
1673 cg->server_cert_data);
1674 httpFreeCredentials(credentials);
1675 }
1676
1677 DEBUG_printf(("4_httpTLSStart: Server certificate callback "
1678 "returned %d.", (int)error));
1679 }
1680 break;
1681
1682 case errSSLClientCertRequested :
1683 error = 0;
1684
1685 if (cg->client_cert_cb)
1686 {
1687 names = NULL;
1688 if (!(error = SSLCopyDistinguishedNames(http->tls, &dn_array)) &&
1689 dn_array)
1690 {
1691 if ((names = cupsArrayNew(NULL, NULL)) != NULL)
1692 {
1693 for (i = 0, count = CFArrayGetCount(dn_array); i < count; i++)
1694 {
1695 data = (CFDataRef)CFArrayGetValueAtIndex(dn_array, i);
1696
1697 if ((credential = malloc(sizeof(*credential))) != NULL)
1698 {
1699 credential->datalen = (size_t)CFDataGetLength(data);
1700 if ((credential->data = malloc(credential->datalen)))
1701 {
1702 memcpy((void *)credential->data, CFDataGetBytePtr(data),
1703 credential->datalen);
1704 cupsArrayAdd(names, credential);
1705 }
1706 else
1707 free(credential);
1708 }
1709 }
1710 }
1711
1712 CFRelease(dn_array);
1713 }
1714
1715 if (!error)
1716 {
1717 error = (cg->client_cert_cb)(http, http->tls, names,
1718 cg->client_cert_data);
1719
1720 DEBUG_printf(("4_httpTLSStart: Client certificate callback "
1721 "returned %d.", (int)error));
1722 }
1723
1724 httpFreeCredentials(names);
1725 }
1726 break;
1727
1728 case errSSLUnknownRootCert :
1729 message = _("Unable to establish a secure connection to host "
1730 "(untrusted certificate).");
1731 break;
1732
1733 case errSSLNoRootCert :
1734 message = _("Unable to establish a secure connection to host "
1735 "(self-signed certificate).");
1736 break;
1737
1738 case errSSLCertExpired :
1739 message = _("Unable to establish a secure connection to host "
1740 "(expired certificate).");
1741 break;
1742
1743 case errSSLCertNotYetValid :
1744 message = _("Unable to establish a secure connection to host "
1745 "(certificate not yet valid).");
1746 break;
1747
1748 case errSSLHostNameMismatch :
1749 message = _("Unable to establish a secure connection to host "
1750 "(host name mismatch).");
1751 break;
1752
1753 case errSSLXCertChainInvalid :
1754 message = _("Unable to establish a secure connection to host "
1755 "(certificate chain invalid).");
1756 break;
1757
1758 case errSSLConnectionRefused :
1759 message = _("Unable to establish a secure connection to host "
1760 "(peer dropped connection before responding).");
1761 break;
1762
1763 default :
1764 break;
1765 }
1766 }
1767
1768 /*
1769 * Restore the previous timeout settings...
1770 */
1771
1772 httpSetTimeout(http, old_timeout, old_cb, old_data);
1773 }
1774
1775 if (error)
1776 {
1777 http->error = error;
1778 http->status = HTTP_STATUS_ERROR;
1779 errno = ECONNREFUSED;
1780
1781 CFRelease(http->tls);
1782 http->tls = NULL;
1783
1784 /*
1785 * If an error string wasn't set by the callbacks use a generic one...
1786 */
1787
1788 if (!message)
1789 {
1790 if (!cg->lang_default)
1791 cg->lang_default = cupsLangDefault();
1792
1793 snprintf(msgbuf, sizeof(msgbuf), _cupsLangString(cg->lang_default, _("Unable to establish a secure connection to host (%d).")), error);
1794 message = msgbuf;
1795 }
1796
1797 _cupsSetError(IPP_STATUS_ERROR_CUPS_PKI, message, 1);
1798
1799 return (-1);
1800 }
1801
1802 return (0);
1803 }
1804
1805
1806 /*
1807 * '_httpTLSStop()' - Shut down SSL/TLS on a connection.
1808 */
1809
1810 void
1811 _httpTLSStop(http_t *http) /* I - HTTP connection */
1812 {
1813 while (SSLClose(http->tls) == errSSLWouldBlock)
1814 usleep(1000);
1815
1816 CFRelease(http->tls);
1817
1818 if (http->tls_credentials)
1819 CFRelease(http->tls_credentials);
1820
1821 http->tls = NULL;
1822 http->tls_credentials = NULL;
1823 }
1824
1825
1826 /*
1827 * '_httpTLSWrite()' - Write to a SSL/TLS connection.
1828 */
1829
1830 int /* O - Bytes written */
1831 _httpTLSWrite(http_t *http, /* I - HTTP connection */
1832 const char *buf, /* I - Buffer holding data */
1833 int len) /* I - Length of buffer */
1834 {
1835 ssize_t result; /* Return value */
1836 OSStatus error; /* Error info */
1837 size_t processed; /* Number of bytes processed */
1838
1839
1840 DEBUG_printf(("2_httpTLSWrite(http=%p, buf=%p, len=%d)", (void *)http, (void *)buf, len));
1841
1842 error = SSLWrite(http->tls, buf, (size_t)len, &processed);
1843
1844 switch (error)
1845 {
1846 case 0 :
1847 result = (int)processed;
1848 break;
1849
1850 case errSSLWouldBlock :
1851 if (processed)
1852 {
1853 result = (int)processed;
1854 }
1855 else
1856 {
1857 result = -1;
1858 errno = EINTR;
1859 }
1860 break;
1861
1862 case errSSLClosedGraceful :
1863 default :
1864 if (processed)
1865 {
1866 result = (int)processed;
1867 }
1868 else
1869 {
1870 result = -1;
1871 errno = EPIPE;
1872 }
1873 break;
1874 }
1875
1876 DEBUG_printf(("3_httpTLSWrite: Returning %d.", (int)result));
1877
1878 return ((int)result);
1879 }
1880
1881
1882 /*
1883 * 'http_cdsa_copy_server()' - Find and copy server credentials from the keychain.
1884 */
1885
1886 static CFArrayRef /* O - Array of certificates or NULL */
1887 http_cdsa_copy_server(
1888 const char *common_name) /* I - Server's hostname */
1889 {
1890 #if TARGET_OS_OSX
1891 OSStatus err; /* Error info */
1892 SecIdentityRef identity = NULL;/* Identity */
1893 CFArrayRef certificates = NULL;
1894 /* Certificate array */
1895 SecPolicyRef policy = NULL; /* Policy ref */
1896 CFStringRef cfcommon_name = NULL;
1897 /* Server name */
1898 CFMutableDictionaryRef query = NULL; /* Query qualifiers */
1899 CFArrayRef list = NULL; /* Keychain list */
1900 SecKeychainRef syschain = NULL;/* System keychain */
1901 SecKeychainStatus status = 0; /* Keychain status */
1902
1903
1904 DEBUG_printf(("3http_cdsa_copy_server(common_name=\"%s\")", common_name));
1905
1906 cfcommon_name = CFStringCreateWithCString(kCFAllocatorDefault, common_name, kCFStringEncodingUTF8);
1907
1908 policy = SecPolicyCreateSSL(1, cfcommon_name);
1909
1910 if (!policy)
1911 {
1912 DEBUG_puts("4http_cdsa_copy_server: Unable to create SSL policy.");
1913 goto cleanup;
1914 }
1915
1916 if (!(query = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks)))
1917 {
1918 DEBUG_puts("4http_cdsa_copy_server: Unable to create query dictionary.");
1919 goto cleanup;
1920 }
1921
1922 _cupsMutexLock(&tls_mutex);
1923
1924 err = SecKeychainGetStatus(tls_keychain, &status);
1925
1926 if (err == noErr && !(status & kSecUnlockStateStatus) && tls_cups_keychain)
1927 SecKeychainUnlock(tls_keychain, _CUPS_CDSA_PASSLEN, _CUPS_CDSA_PASSWORD, TRUE);
1928
1929 CFDictionaryAddValue(query, kSecClass, kSecClassIdentity);
1930 CFDictionaryAddValue(query, kSecMatchPolicy, policy);
1931 CFDictionaryAddValue(query, kSecReturnRef, kCFBooleanTrue);
1932 CFDictionaryAddValue(query, kSecMatchLimit, kSecMatchLimitOne);
1933
1934 syschain = http_cdsa_open_system_keychain();
1935
1936 if (syschain)
1937 {
1938 const void *values[2] = { syschain, tls_keychain };
1939
1940 list = CFArrayCreate(kCFAllocatorDefault, (const void **)values, 2, &kCFTypeArrayCallBacks);
1941 }
1942 else
1943 list = CFArrayCreate(kCFAllocatorDefault, (const void **)&tls_keychain, 1, &kCFTypeArrayCallBacks);
1944
1945 CFDictionaryAddValue(query, kSecMatchSearchList, list);
1946 CFRelease(list);
1947
1948 err = SecItemCopyMatching(query, (CFTypeRef *)&identity);
1949
1950 _cupsMutexUnlock(&tls_mutex);
1951
1952 if (err != noErr)
1953 {
1954 DEBUG_printf(("4http_cdsa_copy_server: SecItemCopyMatching failed with status %d.", (int)err));
1955 goto cleanup;
1956 }
1957
1958 if (CFGetTypeID(identity) != SecIdentityGetTypeID())
1959 {
1960 DEBUG_puts("4http_cdsa_copy_server: Search returned something that is not an identity.");
1961 goto cleanup;
1962 }
1963
1964 if ((certificates = CFArrayCreate(NULL, (const void **)&identity, 1, &kCFTypeArrayCallBacks)) == NULL)
1965 {
1966 DEBUG_puts("4http_cdsa_copy_server: Unable to create array of certificates.");
1967 goto cleanup;
1968 }
1969
1970 cleanup :
1971
1972 if (syschain)
1973 CFRelease(syschain);
1974 if (identity)
1975 CFRelease(identity);
1976 if (policy)
1977 CFRelease(policy);
1978 if (cfcommon_name)
1979 CFRelease(cfcommon_name);
1980 if (query)
1981 CFRelease(query);
1982
1983 DEBUG_printf(("4http_cdsa_copy_server: Returning %p.", (void *)certificates));
1984
1985 return (certificates);
1986 #else
1987
1988 (void)common_name;
1989
1990 if (!tls_selfsigned)
1991 return (NULL);
1992
1993 return (CFArrayCreate(NULL, (const void **)&tls_selfsigned, 1, &kCFTypeArrayCallBacks));
1994 #endif /* TARGET_OS_OSX */
1995 }
1996
1997
1998 /*
1999 * 'http_cdsa_create_credential()' - Create a single credential in the internal format.
2000 */
2001
2002 static SecCertificateRef /* O - Certificate */
2003 http_cdsa_create_credential(
2004 http_credential_t *credential) /* I - Credential */
2005 {
2006 SecCertificateRef cert; /* Certificate */
2007 CFDataRef data; /* Data object */
2008
2009
2010 if (!credential)
2011 return (NULL);
2012
2013 data = CFDataCreate(kCFAllocatorDefault, credential->data, (CFIndex)credential->datalen);
2014 cert = SecCertificateCreateWithData(kCFAllocatorDefault, data);
2015 CFRelease(data);
2016
2017 return (cert);
2018 }
2019
2020
2021 #if TARGET_OS_OSX
2022 /*
2023 * 'http_cdsa_default_path()' - Get the default keychain path.
2024 */
2025
2026 static const char * /* O - Keychain path */
2027 http_cdsa_default_path(char *buffer, /* I - Path buffer */
2028 size_t bufsize) /* I - Size of buffer */
2029 {
2030 const char *home = getenv("HOME"); /* HOME environment variable */
2031
2032
2033 /*
2034 * Determine the default keychain path. Note that the login and system
2035 * keychains are no longer accessible to user applications starting in macOS
2036 * 10.11.4 (!), so we need to create our own keychain just for CUPS.
2037 */
2038
2039 if (getuid() && home)
2040 snprintf(buffer, bufsize, "%s/.cups/ssl.keychain", home);
2041 else
2042 strlcpy(buffer, "/etc/cups/ssl.keychain", bufsize);
2043
2044 DEBUG_printf(("1http_cdsa_default_path: Using default path \"%s\".", buffer));
2045
2046 return (buffer);
2047 }
2048
2049
2050 /*
2051 * 'http_cdsa_open_keychain()' - Open (or create) a keychain.
2052 */
2053
2054 static SecKeychainRef /* O - Keychain or NULL */
2055 http_cdsa_open_keychain(
2056 const char *path, /* I - Path to keychain */
2057 char *filename, /* I - Keychain filename */
2058 size_t filesize) /* I - Size of filename buffer */
2059 {
2060 SecKeychainRef keychain = NULL;/* Temporary keychain */
2061 OSStatus err; /* Error code */
2062 Boolean interaction; /* Interaction allowed? */
2063 SecKeychainStatus status = 0; /* Keychain status */
2064
2065
2066 /*
2067 * Get the keychain filename...
2068 */
2069
2070 if (!path)
2071 {
2072 path = http_cdsa_default_path(filename, filesize);
2073 tls_cups_keychain = 1;
2074 }
2075 else
2076 {
2077 strlcpy(filename, path, filesize);
2078 tls_cups_keychain = 0;
2079 }
2080
2081 /*
2082 * Save the interaction setting and disable while we open the keychain...
2083 */
2084
2085 SecKeychainGetUserInteractionAllowed(&interaction);
2086 SecKeychainSetUserInteractionAllowed(FALSE);
2087
2088 if (access(path, R_OK) && tls_cups_keychain)
2089 {
2090 /*
2091 * Create a new keychain at the given path...
2092 */
2093
2094 err = SecKeychainCreate(path, _CUPS_CDSA_PASSLEN, _CUPS_CDSA_PASSWORD, FALSE, NULL, &keychain);
2095 }
2096 else
2097 {
2098 /*
2099 * Open the existing keychain and unlock as needed...
2100 */
2101
2102 err = SecKeychainOpen(path, &keychain);
2103
2104 if (err == noErr)
2105 err = SecKeychainGetStatus(keychain, &status);
2106
2107 if (err == noErr && !(status & kSecUnlockStateStatus) && tls_cups_keychain)
2108 err = SecKeychainUnlock(keychain, _CUPS_CDSA_PASSLEN, _CUPS_CDSA_PASSWORD, TRUE);
2109 }
2110
2111 /*
2112 * Restore interaction setting...
2113 */
2114
2115 SecKeychainSetUserInteractionAllowed(interaction);
2116
2117 /*
2118 * Release the keychain if we had any errors...
2119 */
2120
2121 if (err != noErr)
2122 {
2123 /* TODO: Set cups last error string */
2124 DEBUG_printf(("4http_cdsa_open_keychain: Unable to open keychain (%d), returning NULL.", (int)err));
2125
2126 if (keychain)
2127 {
2128 CFRelease(keychain);
2129 keychain = NULL;
2130 }
2131 }
2132
2133 /*
2134 * Return the keychain or NULL...
2135 */
2136
2137 return (keychain);
2138 }
2139
2140
2141 /*
2142 * 'http_cdsa_open_system_keychain()' - Open the System keychain.
2143 */
2144
2145 static SecKeychainRef
2146 http_cdsa_open_system_keychain(void)
2147 {
2148 SecKeychainRef keychain = NULL;/* Temporary keychain */
2149 OSStatus err; /* Error code */
2150 Boolean interaction; /* Interaction allowed? */
2151 SecKeychainStatus status = 0; /* Keychain status */
2152
2153
2154 /*
2155 * Save the interaction setting and disable while we open the keychain...
2156 */
2157
2158 SecKeychainGetUserInteractionAllowed(&interaction);
2159 SecKeychainSetUserInteractionAllowed(TRUE);
2160
2161 err = SecKeychainOpen("/Library/Keychains/System.keychain", &keychain);
2162
2163 if (err == noErr)
2164 err = SecKeychainGetStatus(keychain, &status);
2165
2166 if (err == noErr && !(status & kSecUnlockStateStatus))
2167 err = errSecInteractionNotAllowed;
2168
2169 /*
2170 * Restore interaction setting...
2171 */
2172
2173 SecKeychainSetUserInteractionAllowed(interaction);
2174
2175 /*
2176 * Release the keychain if we had any errors...
2177 */
2178
2179 if (err != noErr)
2180 {
2181 /* TODO: Set cups last error string */
2182 DEBUG_printf(("4http_cdsa_open_system_keychain: Unable to open keychain (%d), returning NULL.", (int)err));
2183
2184 if (keychain)
2185 {
2186 CFRelease(keychain);
2187 keychain = NULL;
2188 }
2189 }
2190
2191 /*
2192 * Return the keychain or NULL...
2193 */
2194
2195 return (keychain);
2196 }
2197 #endif /* TARGET_OS_OSX */
2198
2199
2200 /*
2201 * 'http_cdsa_read()' - Read function for the CDSA library.
2202 */
2203
2204 static OSStatus /* O - -1 on error, 0 on success */
2205 http_cdsa_read(
2206 SSLConnectionRef connection, /* I - SSL/TLS connection */
2207 void *data, /* I - Data buffer */
2208 size_t *dataLength) /* IO - Number of bytes */
2209 {
2210 OSStatus result; /* Return value */
2211 ssize_t bytes; /* Number of bytes read */
2212 http_t *http; /* HTTP connection */
2213
2214
2215 http = (http_t *)connection;
2216
2217 if (!http->blocking || http->timeout_value > 0.0)
2218 {
2219 /*
2220 * Make sure we have data before we read...
2221 */
2222
2223 while (!_httpWait(http, http->wait_value, 0))
2224 {
2225 if (http->timeout_cb && (*http->timeout_cb)(http, http->timeout_data))
2226 continue;
2227
2228 http->error = ETIMEDOUT;
2229 return (-1);
2230 }
2231 }
2232
2233 do
2234 {
2235 bytes = recv(http->fd, data, *dataLength, 0);
2236 }
2237 while (bytes == -1 && (errno == EINTR || errno == EAGAIN));
2238
2239 if ((size_t)bytes == *dataLength)
2240 {
2241 result = 0;
2242 }
2243 else if (bytes > 0)
2244 {
2245 *dataLength = (size_t)bytes;
2246 result = errSSLWouldBlock;
2247 }
2248 else
2249 {
2250 *dataLength = 0;
2251
2252 if (bytes == 0)
2253 result = errSSLClosedGraceful;
2254 else if (errno == EAGAIN)
2255 result = errSSLWouldBlock;
2256 else
2257 result = errSSLClosedAbort;
2258 }
2259
2260 return (result);
2261 }
2262
2263
2264 /*
2265 * 'http_cdsa_set_credentials()' - Set the TLS credentials.
2266 */
2267
2268 static int /* O - Status of connection */
2269 http_cdsa_set_credentials(http_t *http) /* I - HTTP connection */
2270 {
2271 _cups_globals_t *cg = _cupsGlobals(); /* Pointer to library globals */
2272 OSStatus error = 0; /* Error code */
2273 http_tls_credentials_t credentials = NULL;
2274 /* TLS credentials */
2275
2276
2277 DEBUG_printf(("7http_tls_set_credentials(%p)", (void *)http));
2278
2279 /*
2280 * Prefer connection specific credentials...
2281 */
2282
2283 if ((credentials = http->tls_credentials) == NULL)
2284 credentials = cg->tls_credentials;
2285
2286 if (credentials)
2287 {
2288 error = SSLSetCertificate(http->tls, credentials);
2289 DEBUG_printf(("4http_tls_set_credentials: SSLSetCertificate, error=%d",
2290 (int)error));
2291 }
2292 else
2293 DEBUG_puts("4http_tls_set_credentials: No credentials to set.");
2294
2295 return (error);
2296 }
2297
2298
2299 /*
2300 * 'http_cdsa_write()' - Write function for the CDSA library.
2301 */
2302
2303 static OSStatus /* O - -1 on error, 0 on success */
2304 http_cdsa_write(
2305 SSLConnectionRef connection, /* I - SSL/TLS connection */
2306 const void *data, /* I - Data buffer */
2307 size_t *dataLength) /* IO - Number of bytes */
2308 {
2309 OSStatus result; /* Return value */
2310 ssize_t bytes; /* Number of bytes read */
2311 http_t *http; /* HTTP connection */
2312
2313
2314 http = (http_t *)connection;
2315
2316 do
2317 {
2318 bytes = write(http->fd, data, *dataLength);
2319 }
2320 while (bytes == -1 && (errno == EINTR || errno == EAGAIN));
2321
2322 if ((size_t)bytes == *dataLength)
2323 {
2324 result = 0;
2325 }
2326 else if (bytes >= 0)
2327 {
2328 *dataLength = (size_t)bytes;
2329 result = errSSLWouldBlock;
2330 }
2331 else
2332 {
2333 *dataLength = 0;
2334
2335 if (errno == EAGAIN)
2336 result = errSSLWouldBlock;
2337 else
2338 result = errSSLClosedAbort;
2339 }
2340
2341 return (result);
2342 }
Unnamed repository; edit this file 'description' to name the repository.