cups/tls-darwin.c

   1 /*
   2  * TLS support code for CUPS on OS X.
   3  *
   4  * Copyright 2007-2016 by Apple Inc.
   5  * Copyright 1997-2007 by Easy Software Products, all rights reserved.
   6  *
   7  * These coded instructions, statements, and computer programs are the
   8  * property of Apple Inc. and are protected by Federal copyright
   9  * law.  Distribution and use rights are outlined in the file "LICENSE.txt"
  10  * which should have been included with this file.  If this file is
  11  * file is missing or damaged, see the license at "http://www.cups.org/".
  12  *
  13  * This file is subject to the Apple OS-Developed Software exception.
  14  */
  15
  16 /**** This file is included from tls.c ****/
  17
  18 /*
  19  * Include necessary headers...
  20  */
  21
  22 #include <spawn.h>
  23
  24 extern char **environ;
  25
  26
  27 /*
  28  * Local globals...
  29  */
  30
  31 #ifdef HAVE_SECKEYCHAINOPEN
  32 static int              tls_auto_create = 0;
  33                                         /* Auto-create self-signed certs? */
  34 static char             *tls_common_name = NULL;
  35                                         /* Default common name */
  36 static SecKeychainRef   tls_keychain = NULL;
  37                                         /* Server cert keychain */
  38 static char             *tls_keypath = NULL;
  39                                         /* Server cert keychain path */
  40 static _cups_mutex_t    tls_mutex = _CUPS_MUTEX_INITIALIZER;
  41                                         /* Mutex for keychain/certs */
  42 #endif /* HAVE_SECKEYCHAINOPEN */
  43 static int              tls_options = -1;/* Options for TLS connections */
  44
  45
  46 /*
  47  * Local functions...
  48  */
  49
  50 #ifdef HAVE_SECKEYCHAINOPEN
  51 static CFArrayRef       http_cdsa_copy_server(const char *common_name);
  52 #endif /* HAVE_SECKEYCHAINOPEN */
  53 static SecCertificateRef http_cdsa_create_credential(http_credential_t *credential);
  54 static const char       *http_cdsa_default_path(char *buffer, size_t bufsize);
  55 static OSStatus         http_cdsa_read(SSLConnectionRef connection, void *data, size_t *dataLength);
  56 static int              http_cdsa_set_credentials(http_t *http);
  57 static OSStatus         http_cdsa_write(SSLConnectionRef connection, const void *data, size_t *dataLength);
  58
  59
  60 /*
  61  * 'cupsMakeServerCredentials()' - Make a self-signed certificate and private key pair.
  62  *
  63  * @since CUPS 2.0/OS 10.10@
  64  */
  65
  66 int                                     /* O - 1 on success, 0 on failure */
  67 cupsMakeServerCredentials(
  68     const char *path,                   /* I - Keychain path or @code NULL@ for default */
  69     const char *common_name,            /* I - Common name */
  70     int        num_alt_names,           /* I - Number of subject alternate names */
  71     const char **alt_names,             /* I - Subject Alternate Names */
  72     time_t     expiration_date)         /* I - Expiration date */
  73 {
  74 #if defined(HAVE_SECGENERATESELFSIGNEDCERTIFICATE) && defined(HAVE_SECKEYCHAINOPEN)
  75   char                  filename[1024]; /* Default keychain path */
  76   int                   status = 0;     /* Return status */
  77   OSStatus              err;            /* Error code (if any) */
  78   CFStringRef           cfcommon_name = NULL;
  79                                         /* CF string for server name */
  80   SecIdentityRef        ident = NULL;   /* Identity */
  81   SecKeyRef             publicKey = NULL,
  82                                         /* Public key */
  83                         privateKey = NULL;
  84                                         /* Private key */
  85   CFMutableDictionaryRef keyParams = NULL;
  86                                         /* Key generation parameters */
  87
  88
  89   DEBUG_printf(("cupsMakeServerCredentials(path=\"%s\", common_name=\"%s\", num_alt_names=%d, alt_names=%p, expiration_date=%d)", path, common_name, num_alt_names, alt_names, (int)expiration_date));
  90
  91   (void)num_alt_names;
  92   (void)alt_names;
  93   (void)expiration_date;
  94
  95   if (!path)
  96     path = http_cdsa_default_path(filename, sizeof(filename));
  97
  98   cfcommon_name = CFStringCreateWithCString(kCFAllocatorDefault, common_name, kCFStringEncodingUTF8);
  99   if (!cfcommon_name)
 100     goto cleanup;
 101
 102  /*
 103   * Create a public/private key pair...
 104   */
 105
 106   keyParams = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
 107   if (!keyParams)
 108     goto cleanup;
 109
 110   CFDictionaryAddValue(keyParams, kSecAttrKeyType, kSecAttrKeyTypeRSA);
 111   CFDictionaryAddValue(keyParams, kSecAttrKeySizeInBits, CFSTR("2048"));
 112   CFDictionaryAddValue(keyParams, kSecAttrLabel, CFSTR("CUPS Self-Signed Certificate"));
 113
 114   err = SecKeyGeneratePair(keyParams, &publicKey, &privateKey);
 115   if (err != noErr)
 116     goto cleanup;
 117
 118  /*
 119   * Create a self-signed certificate using the public/private key pair...
 120   */
 121
 122   CFIndex       usageInt = kSecKeyUsageAll;
 123   CFNumberRef   usage = CFNumberCreate(alloc, kCFNumberCFIndexType, &usageInt);
 124   CFDictionaryRef certParams = CFDictionaryCreateMutable(kCFAllocatorDefault,
 125 kSecCSRBasicContraintsPathLen, CFINT(0), kSecSubjectAltName, cfcommon_name, kSecCertificateKeyUsage, usage, NULL, NULL);
 126   CFRelease(usage);
 127
 128   const void    *ca_o[] = { kSecOidOrganization, CFSTR("") };
 129   const void    *ca_cn[] = { kSecOidCommonName, cfcommon_name };
 130   CFArrayRef    ca_o_dn = CFArrayCreate(kCFAllocatorDefault, ca_o, 2, NULL);
 131   CFArrayRef    ca_cn_dn = CFArrayCreate(kCFAllocatorDefault, ca_cn, 2, NULL);
 132   const void    *ca_dn_array[2];
 133
 134   ca_dn_array[0] = CFArrayCreate(kCFAllocatorDefault, (const void **)&ca_o_dn, 1, NULL);
 135   ca_dn_array[1] = CFArrayCreate(kCFAllocatorDefault, (const void **)&ca_cn_dn, 1, NULL);
 136
 137   CFArrayRef    subject = CFArrayCreate(kCFAllocatorDefault, ca_dn_array, 2, NULL);
 138   SecCertificateRef cert = SecGenerateSelfSignedCertificate(subject, certParams, publicKey, privateKey);
 139   CFRelease(subject);
 140   CFRelease(certParams);
 141
 142   if (!cert)
 143     goto cleanup;
 144
 145   ident = SecIdentityCreate(kCFAllocatorDefault, cert, privateKey);
 146
 147   if (ident)
 148     status = 1;
 149
 150   /*
 151    * Cleanup and return...
 152    */
 153
 154 cleanup:
 155
 156   if (cfcommon_name)
 157     CFRelease(cfcommon_name);
 158
 159   if (keyParams)
 160     CFRelease(keyParams);
 161
 162   if (ident)
 163     CFRelease(ident);
 164
 165   if (cert)
 166     CFRelease(cert);
 167
 168   if (publicKey)
 169     CFRelease(publicKey);
 170
 171   if (privateKey)
 172     CFRelease(publicKey);
 173
 174   return (status);
 175
 176 #else /* !(HAVE_SECGENERATESELFSIGNEDCERTIFICATE && HAVE_SECKEYCHAINOPEN) */
 177   int           pid,                    /* Process ID of command */
 178                 status,                 /* Status of command */
 179                 i;                      /* Looping var */
 180   char          command[1024],          /* Command */
 181                 *argv[5],               /* Command-line arguments */
 182                 *envp[1000],            /* Environment variables */
 183                 days[32],               /* CERTTOOL_EXPIRATION_DAYS env var */
 184                 keychain[1024],         /* Keychain argument */
 185                 infofile[1024],         /* Type-in information for cert */
 186                 filename[1024];         /* Default keychain path */
 187   cups_file_t   *fp;                    /* Seed/info file */
 188
 189
 190   DEBUG_printf(("cupsMakeServerCredentials(path=\"%s\", common_name=\"%s\", num_alt_names=%d, alt_names=%p, expiration_date=%d)", path, common_name, num_alt_names, (void *)alt_names, (int)expiration_date));
 191
 192   (void)num_alt_names;
 193   (void)alt_names;
 194
 195   if (!path)
 196     path = http_cdsa_default_path(filename, sizeof(filename));
 197
 198  /*
 199   * Run the "certtool" command to generate a self-signed certificate...
 200   */
 201
 202   if (!cupsFileFind("certtool", getenv("PATH"), 1, command, sizeof(command)))
 203     return (-1);
 204
 205  /*
 206   * Create a file with the certificate information fields...
 207   *
 208   * Note: This assumes that the default questions are asked by the certtool
 209   * command...
 210   */
 211
 212  if ((fp = cupsTempFile2(infofile, sizeof(infofile))) == NULL)
 213     return (-1);
 214
 215   cupsFilePrintf(fp,
 216                  "CUPS Self-Signed Certificate\n"
 217                                         /* Enter key and certificate label */
 218                  "r\n"                  /* Generate RSA key pair */
 219                  "2048\n"               /* 2048 bit encryption key */
 220                  "y\n"                  /* OK (y = yes) */
 221                  "b\n"                  /* Usage (b=signing/encryption) */
 222                  "2\n"                  /* Sign with SHA256 */
 223                  "y\n"                  /* OK (y = yes) */
 224                  "%s\n"                 /* Common name */
 225                  "\n"                   /* Country (default) */
 226                  "\n"                   /* Organization (default) */
 227                  "\n"                   /* Organizational unit (default) */
 228                  "\n"                   /* State/Province (default) */
 229                  "\n"                   /* Email address */
 230                  "y\n",                 /* OK (y = yes) */
 231                  common_name);
 232   cupsFileClose(fp);
 233
 234   snprintf(keychain, sizeof(keychain), "k=%s", path);
 235
 236   argv[0] = "certtool";
 237   argv[1] = "c";
 238   argv[2] = keychain;
 239   argv[3] = NULL;
 240
 241   snprintf(days, sizeof(days), "CERTTOOL_EXPIRATION_DAYS=%d", (int)((expiration_date - time(NULL) + 86399) / 86400));
 242   envp[0] = days;
 243   for (i = 0; i < (int)(sizeof(envp) / sizeof(envp[0]) - 2) && environ[i]; i ++)
 244     envp[i + 1] = environ[i];
 245   envp[i] = NULL;
 246
 247   posix_spawn_file_actions_t actions;   /* File actions */
 248
 249   posix_spawn_file_actions_init(&actions);
 250   posix_spawn_file_actions_addclose(&actions, 0);
 251   posix_spawn_file_actions_addopen(&actions, 0, infofile, O_RDONLY, 0);
 252   posix_spawn_file_actions_addclose(&actions, 1);
 253   posix_spawn_file_actions_addopen(&actions, 1, "/dev/null", O_WRONLY, 0);
 254   posix_spawn_file_actions_addclose(&actions, 2);
 255   posix_spawn_file_actions_addopen(&actions, 2, "/dev/null", O_WRONLY, 0);
 256
 257   if (posix_spawn(&pid, command, &actions, NULL, argv, envp))
 258   {
 259     unlink(infofile);
 260     return (-1);
 261   }
 262
 263   posix_spawn_file_actions_destroy(&actions);
 264
 265   unlink(infofile);
 266
 267   while (waitpid(pid, &status, 0) < 0)
 268     if (errno != EINTR)
 269     {
 270       status = -1;
 271       break;
 272     }
 273
 274   return (!status);
 275 #endif /* HAVE_SECGENERATESELFSIGNEDCERTIFICATE && HAVE_SECKEYCHAINOPEN */
 276 }
 277
 278
 279 /*
 280  * 'cupsSetServerCredentials()' - Set the default server credentials.
 281  *
 282  * Note: The server credentials are used by all threads in the running process.
 283  * This function is threadsafe.
 284  *
 285  * @since CUPS 2.0/OS X 10.10@
 286  */
 287
 288 int                                     /* O - 1 on success, 0 on failure */
 289 cupsSetServerCredentials(
 290     const char *path,                   /* I - Keychain path or @code NULL@ for default */
 291     const char *common_name,            /* I - Default common name for server */
 292     int        auto_create)             /* I - 1 = automatically create self-signed certificates */
 293 {
 294   DEBUG_printf(("cupsSetServerCredentials(path=\"%s\", common_name=\"%s\", auto_create=%d)", path, common_name, auto_create));
 295
 296 #ifdef HAVE_SECKEYCHAINOPEN
 297   char                  filename[1024]; /* Filename for keychain */
 298   SecKeychainRef        keychain = NULL;/* Temporary keychain */
 299   OSStatus              status;         /* Status code */
 300
 301
 302   if (!path)
 303     path = http_cdsa_default_path(filename, sizeof(filename));
 304
 305   if ((status = SecKeychainOpen(path, &keychain)) != noErr)
 306   {
 307     /* TODO: Set cups last error string */
 308     DEBUG_printf(("1cupsSetServerCredentials: Unable to open keychain (%d), returning 0.", (int)status));
 309     return (0);
 310   }
 311
 312   _cupsMutexLock(&tls_mutex);
 313
 314  /*
 315   * Close any keychain that is currently open...
 316   */
 317
 318   if (tls_keychain)
 319     CFRelease(tls_keychain);
 320
 321   if (tls_keypath)
 322     _cupsStrFree(tls_keypath);
 323
 324   if (tls_common_name)
 325     _cupsStrFree(tls_common_name);
 326
 327  /*
 328   * Save the new keychain...
 329   */
 330
 331   tls_keychain    = keychain;
 332   tls_keypath     = _cupsStrAlloc(path);
 333   tls_auto_create = auto_create;
 334   tls_common_name = _cupsStrAlloc(common_name);
 335
 336   _cupsMutexUnlock(&tls_mutex);
 337
 338   DEBUG_puts("1cupsSetServerCredentials: Opened keychain, returning 1.");
 339   return (1);
 340
 341 #else
 342   DEBUG_puts("1cupsSetServerCredentials: No keychain support compiled in, returning 0.");
 343   return (0);
 344 #endif /* HAVE_SECKEYCHAINOPEN */
 345 }
 346
 347
 348 /*
 349  * 'httpCopyCredentials()' - Copy the credentials associated with the peer in
 350  *                           an encrypted connection.
 351  *
 352  * @since CUPS 1.5/OS X 10.7@
 353  */
 354
 355 int                                     /* O - Status of call (0 = success) */
 356 httpCopyCredentials(
 357     http_t       *http,                 /* I - Connection to server */
 358     cups_array_t **credentials)         /* O - Array of credentials */
 359 {
 360   OSStatus              error;          /* Error code */
 361   SecTrustRef           peerTrust;      /* Peer trust reference */
 362   CFIndex               count;          /* Number of credentials */
 363   SecCertificateRef     secCert;        /* Certificate reference */
 364   CFDataRef             data;           /* Certificate data */
 365   int                   i;              /* Looping var */
 366
 367
 368   DEBUG_printf(("httpCopyCredentials(http=%p, credentials=%p)", (void *)http, (void *)credentials));
 369
 370   if (credentials)
 371     *credentials = NULL;
 372
 373   if (!http || !http->tls || !credentials)
 374     return (-1);
 375
 376   if (!(error = SSLCopyPeerTrust(http->tls, &peerTrust)) && peerTrust)
 377   {
 378     DEBUG_printf(("2httpCopyCredentials: Peer provided %d certificates.", (int)SecTrustGetCertificateCount(peerTrust)));
 379
 380     if ((*credentials = cupsArrayNew(NULL, NULL)) != NULL)
 381     {
 382       count = SecTrustGetCertificateCount(peerTrust);
 383
 384       for (i = 0; i < count; i ++)
 385       {
 386         secCert = SecTrustGetCertificateAtIndex(peerTrust, i);
 387
 388 #ifdef DEBUG
 389         CFStringRef cf_name = SecCertificateCopySubjectSummary(secCert);
 390         char name[1024];
 391         if (cf_name)
 392           CFStringGetCString(cf_name, name, sizeof(name), kCFStringEncodingUTF8);
 393         else
 394           strlcpy(name, "unknown", sizeof(name));
 395
 396         DEBUG_printf(("2httpCopyCredentials: Certificate %d name is \"%s\".", i, name));
 397 #endif /* DEBUG */
 398
 399         if ((data = SecCertificateCopyData(secCert)) != NULL)
 400         {
 401           DEBUG_printf(("2httpCopyCredentials: Adding %d byte certificate blob.", (int)CFDataGetLength(data)));
 402
 403           httpAddCredential(*credentials, CFDataGetBytePtr(data), (size_t)CFDataGetLength(data));
 404           CFRelease(data);
 405         }
 406       }
 407     }
 408
 409     CFRelease(peerTrust);
 410   }
 411
 412   return (error);
 413 }
 414
 415
 416 /*
 417  * '_httpCreateCredentials()' - Create credentials in the internal format.
 418  */
 419
 420 http_tls_credentials_t                  /* O - Internal credentials */
 421 _httpCreateCredentials(
 422     cups_array_t *credentials)          /* I - Array of credentials */
 423 {
 424   CFMutableArrayRef     peerCerts;      /* Peer credentials reference */
 425   SecCertificateRef     secCert;        /* Certificate reference */
 426   http_credential_t     *credential;    /* Credential data */
 427
 428
 429   if (!credentials)
 430     return (NULL);
 431
 432   if ((peerCerts = CFArrayCreateMutable(kCFAllocatorDefault,
 433                                         cupsArrayCount(credentials),
 434                                         &kCFTypeArrayCallBacks)) == NULL)
 435     return (NULL);
 436
 437   for (credential = (http_credential_t *)cupsArrayFirst(credentials);
 438        credential;
 439        credential = (http_credential_t *)cupsArrayNext(credentials))
 440   {
 441     if ((secCert = http_cdsa_create_credential(credential)) != NULL)
 442     {
 443       CFArrayAppendValue(peerCerts, secCert);
 444       CFRelease(secCert);
 445     }
 446   }
 447
 448   return (peerCerts);
 449 }
 450
 451
 452 /*
 453  * 'httpCredentialsAreValidForName()' - Return whether the credentials are valid for the given name.
 454  *
 455  * @since CUPS 2.0/OS X 10.10@
 456  */
 457
 458 int                                     /* O - 1 if valid, 0 otherwise */
 459 httpCredentialsAreValidForName(
 460     cups_array_t *credentials,          /* I - Credentials */
 461     const char   *common_name)          /* I - Name to check */
 462 {
 463   SecCertificateRef     secCert;        /* Certificate reference */
 464   CFStringRef           cfcert_name = NULL;
 465                                         /* Certificate's common name (CF string) */
 466   char                  cert_name[256]; /* Certificate's common name (C string) */
 467   int                   valid = 1;      /* Valid name? */
 468
 469
 470   if ((secCert = http_cdsa_create_credential((http_credential_t *)cupsArrayFirst(credentials))) == NULL)
 471     return (0);
 472
 473  /*
 474   * Compare the common names...
 475   */
 476
 477   if ((cfcert_name = SecCertificateCopySubjectSummary(secCert)) == NULL)
 478   {
 479    /*
 480     * Can't get common name, cannot be valid...
 481     */
 482
 483     valid = 0;
 484   }
 485   else if (CFStringGetCString(cfcert_name, cert_name, sizeof(cert_name), kCFStringEncodingUTF8) &&
 486            _cups_strcasecmp(common_name, cert_name))
 487   {
 488    /*
 489     * Not an exact match for the common name, check for wildcard certs...
 490     */
 491
 492     const char  *domain = strchr(common_name, '.');
 493                                         /* Domain in common name */
 494
 495     if (strncmp(cert_name, "*.", 2) || !domain || _cups_strcasecmp(domain, cert_name + 1))
 496     {
 497      /*
 498       * Not a wildcard match.
 499       */
 500
 501       /* TODO: Check subject alternate names */
 502       valid = 0;
 503     }
 504   }
 505
 506   if (cfcert_name)
 507     CFRelease(cfcert_name);
 508
 509   CFRelease(secCert);
 510
 511   return (valid);
 512 }
 513
 514
 515 /*
 516  * 'httpCredentialsGetTrust()' - Return the trust of credentials.
 517  *
 518  * @since CUPS 2.0/OS X 10.10@
 519  */
 520
 521 http_trust_t                            /* O - Level of trust */
 522 httpCredentialsGetTrust(
 523     cups_array_t *credentials,          /* I - Credentials */
 524     const char   *common_name)          /* I - Common name for trust lookup */
 525 {
 526   SecCertificateRef     secCert;        /* Certificate reference */
 527   http_trust_t          trust = HTTP_TRUST_OK;
 528                                         /* Trusted? */
 529   cups_array_t          *tcreds = NULL; /* Trusted credentials */
 530   _cups_globals_t       *cg = _cupsGlobals();
 531                                         /* Per-thread globals */
 532
 533
 534   if (!common_name)
 535     return (HTTP_TRUST_UNKNOWN);
 536
 537   if ((secCert = http_cdsa_create_credential((http_credential_t *)cupsArrayFirst(credentials))) == NULL)
 538     return (HTTP_TRUST_UNKNOWN);
 539
 540   if (cg->any_root < 0)
 541     _cupsSetDefaults();
 542
 543  /*
 544   * Look this common name up in the default keychains...
 545   */
 546
 547   httpLoadCredentials(NULL, &tcreds, common_name);
 548
 549   if (tcreds)
 550   {
 551     char        credentials_str[1024],  /* String for incoming credentials */
 552                 tcreds_str[1024];       /* String for saved credentials */
 553
 554     httpCredentialsString(credentials, credentials_str, sizeof(credentials_str));
 555     httpCredentialsString(tcreds, tcreds_str, sizeof(tcreds_str));
 556
 557     if (strcmp(credentials_str, tcreds_str))
 558     {
 559      /*
 560       * Credentials don't match, let's look at the expiration date of the new
 561       * credentials and allow if the new ones have a later expiration...
 562       */
 563
 564       if (httpCredentialsGetExpiration(credentials) <= httpCredentialsGetExpiration(tcreds) ||
 565           !httpCredentialsAreValidForName(credentials, common_name))
 566       {
 567        /*
 568         * Either the new credentials are not newly issued, or the common name
 569         * does not match the issued certificate...
 570         */
 571
 572         trust = HTTP_TRUST_INVALID;
 573       }
 574       else if (httpCredentialsGetExpiration(tcreds) < time(NULL))
 575       {
 576        /*
 577         * Save the renewed credentials...
 578         */
 579
 580         trust = HTTP_TRUST_RENEWED;
 581
 582         httpSaveCredentials(NULL, credentials, common_name);
 583       }
 584     }
 585
 586     httpFreeCredentials(tcreds);
 587   }
 588   else if (cg->validate_certs && !httpCredentialsAreValidForName(credentials, common_name))
 589     trust = HTTP_TRUST_INVALID;
 590
 591   if (!cg->expired_certs && !SecCertificateIsValid(secCert, CFAbsoluteTimeGetCurrent()))
 592     trust = HTTP_TRUST_EXPIRED;
 593   else if (!cg->any_root && cupsArrayCount(credentials) == 1)
 594     trust = HTTP_TRUST_INVALID;
 595
 596   CFRelease(secCert);
 597
 598   return (trust);
 599 }
 600
 601
 602 /*
 603  * 'httpCredentialsGetExpiration()' - Return the expiration date of the credentials.
 604  *
 605  * @since CUPS 2.0/OS X 10.10@
 606  */
 607
 608 time_t                                  /* O - Expiration date of credentials */
 609 httpCredentialsGetExpiration(
 610     cups_array_t *credentials)          /* I - Credentials */
 611 {
 612   SecCertificateRef     secCert;        /* Certificate reference */
 613   time_t                expiration;     /* Expiration date */
 614
 615
 616   if ((secCert = http_cdsa_create_credential((http_credential_t *)cupsArrayFirst(credentials))) == NULL)
 617     return (0);
 618
 619   expiration = (time_t)(SecCertificateNotValidAfter(secCert) + kCFAbsoluteTimeIntervalSince1970);
 620
 621   CFRelease(secCert);
 622
 623   return (expiration);
 624 }
 625
 626
 627 /*
 628  * 'httpCredentialsString()' - Return a string representing the credentials.
 629  *
 630  * @since CUPS 2.0/OS X 10.10@
 631  */
 632
 633 size_t                                  /* O - Total size of credentials string */
 634 httpCredentialsString(
 635     cups_array_t *credentials,          /* I - Credentials */
 636     char         *buffer,               /* I - Buffer or @code NULL@ */
 637     size_t       bufsize)               /* I - Size of buffer */
 638 {
 639   http_credential_t     *first;         /* First certificate */
 640   SecCertificateRef     secCert;        /* Certificate reference */
 641
 642
 643   DEBUG_printf(("httpCredentialsString(credentials=%p, buffer=%p, bufsize=" CUPS_LLFMT ")", (void *)credentials, (void *)buffer, CUPS_LLCAST bufsize));
 644
 645   if (!buffer)
 646     return (0);
 647
 648   if (buffer && bufsize > 0)
 649     *buffer = '\0';
 650
 651   if ((first = (http_credential_t *)cupsArrayFirst(credentials)) != NULL &&
 652       (secCert = http_cdsa_create_credential(first)) != NULL)
 653   {
 654     CFStringRef         cf_name;        /* CF common name string */
 655     char                name[256];      /* Common name associated with cert */
 656     time_t              expiration;     /* Expiration date of cert */
 657     _cups_md5_state_t   md5_state;      /* MD5 state */
 658     unsigned char       md5_digest[16]; /* MD5 result */
 659
 660     if ((cf_name = SecCertificateCopySubjectSummary(secCert)) != NULL)
 661     {
 662       CFStringGetCString(cf_name, name, (CFIndex)sizeof(name), kCFStringEncodingUTF8);
 663       CFRelease(cf_name);
 664     }
 665     else
 666       strlcpy(name, "unknown", sizeof(name));
 667
 668     expiration = (time_t)(SecCertificateNotValidAfter(secCert) + kCFAbsoluteTimeIntervalSince1970);
 669
 670     _cupsMD5Init(&md5_state);
 671     _cupsMD5Append(&md5_state, first->data, (int)first->datalen);
 672     _cupsMD5Finish(&md5_state, md5_digest);
 673
 674     snprintf(buffer, bufsize, "%s / %s / %02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X", name, httpGetDateString(expiration), md5_digest[0], md5_digest[1], md5_digest[2], md5_digest[3], md5_digest[4], md5_digest[5], md5_digest[6], md5_digest[7], md5_digest[8], md5_digest[9], md5_digest[10], md5_digest[11], md5_digest[12], md5_digest[13], md5_digest[14], md5_digest[15]);
 675
 676     CFRelease(secCert);
 677   }
 678
 679   DEBUG_printf(("1httpCredentialsString: Returning \"%s\".", buffer));
 680
 681   return (strlen(buffer));
 682 }
 683
 684
 685 /*
 686  * '_httpFreeCredentials()' - Free internal credentials.
 687  */
 688
 689 void
 690 _httpFreeCredentials(
 691     http_tls_credentials_t credentials) /* I - Internal credentials */
 692 {
 693   if (!credentials)
 694     return;
 695
 696   CFRelease(credentials);
 697 }
 698
 699
 700 /*
 701  * 'httpLoadCredentials()' - Load X.509 credentials from a keychain file.
 702  *
 703  * @since CUPS 2.0/OS 10.10@
 704  */
 705
 706 int                                     /* O - 0 on success, -1 on error */
 707 httpLoadCredentials(
 708     const char   *path,                 /* I  - Keychain path or @code NULL@ for default */
 709     cups_array_t **credentials,         /* IO - Credentials */
 710     const char   *common_name)          /* I  - Common name for credentials */
 711 {
 712 #ifdef HAVE_SECKEYCHAINOPEN
 713   OSStatus              err;            /* Error info */
 714   char                  filename[1024]; /* Filename for keychain */
 715   SecKeychainRef        keychain = NULL;/* Keychain reference */
 716   SecIdentitySearchRef  search = NULL;  /* Search reference */
 717   SecCertificateRef     cert = NULL;    /* Certificate */
 718   CFDataRef             data;           /* Certificate data */
 719   SecPolicyRef          policy = NULL;  /* Policy ref */
 720   CFStringRef           cfcommon_name = NULL;
 721                                         /* Server name */
 722   CFMutableDictionaryRef query = NULL;  /* Query qualifiers */
 723   CFArrayRef            list = NULL;    /* Keychain list */
 724
 725
 726   DEBUG_printf(("httpLoadCredentials(path=\"%s\", credentials=%p, common_name=\"%s\")", path, (void *)credentials, common_name));
 727
 728   if (!credentials)
 729     return (-1);
 730
 731   *credentials = NULL;
 732
 733   if (!path)
 734     path = http_cdsa_default_path(filename, sizeof(filename));
 735
 736   if ((err = SecKeychainOpen(path, &keychain)) != noErr)
 737     goto cleanup;
 738
 739   cfcommon_name = CFStringCreateWithCString(kCFAllocatorDefault, common_name, kCFStringEncodingUTF8);
 740
 741   policy = SecPolicyCreateSSL(1, cfcommon_name);
 742
 743   if (cfcommon_name)
 744     CFRelease(cfcommon_name);
 745
 746   if (!policy)
 747     goto cleanup;
 748
 749   if (!(query = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks)))
 750     goto cleanup;
 751
 752   list = CFArrayCreate(kCFAllocatorDefault, (const void **)&keychain, 1, &kCFTypeArrayCallBacks);
 753
 754   CFDictionaryAddValue(query, kSecClass, kSecClassCertificate);
 755   CFDictionaryAddValue(query, kSecMatchPolicy, policy);
 756   CFDictionaryAddValue(query, kSecReturnRef, kCFBooleanTrue);
 757   CFDictionaryAddValue(query, kSecMatchLimit, kSecMatchLimitOne);
 758   CFDictionaryAddValue(query, kSecMatchSearchList, list);
 759
 760   CFRelease(list);
 761
 762   err = SecItemCopyMatching(query, (CFTypeRef *)&cert);
 763
 764   if (err)
 765     goto cleanup;
 766
 767   if (CFGetTypeID(cert) != SecCertificateGetTypeID())
 768     goto cleanup;
 769
 770   if ((data = SecCertificateCopyData(cert)) != NULL)
 771   {
 772     DEBUG_printf(("1httpLoadCredentials: Adding %d byte certificate blob.", (int)CFDataGetLength(data)));
 773
 774     *credentials = cupsArrayNew(NULL, NULL);
 775     httpAddCredential(*credentials, CFDataGetBytePtr(data), (size_t)CFDataGetLength(data));
 776     CFRelease(data);
 777   }
 778
 779   cleanup :
 780
 781   if (keychain)
 782     CFRelease(keychain);
 783   if (search)
 784     CFRelease(search);
 785   if (cert)
 786     CFRelease(cert);
 787   if (policy)
 788     CFRelease(policy);
 789   if (query)
 790     CFRelease(query);
 791
 792   DEBUG_printf(("1httpLoadCredentials: Returning %d.", *credentials ? 0 : -1));
 793
 794   return (*credentials ? 0 : -1);
 795
 796 #else
 797   (void)path;
 798   (void)credentials;
 799   (void)common_name;
 800
 801   return (-1);
 802 #endif /* HAVE_SECKEYCHAINOPEN */
 803 }
 804
 805
 806 /*
 807  * 'httpSaveCredentials()' - Save X.509 credentials to a keychain file.
 808  *
 809  * @since CUPS 2.0/OS 10.10@
 810  */
 811
 812 int                                     /* O - -1 on error, 0 on success */
 813 httpSaveCredentials(
 814     const char   *path,                 /* I - Keychain path or @code NULL@ for default */
 815     cups_array_t *credentials,          /* I - Credentials */
 816     const char   *common_name)          /* I - Common name for credentials */
 817 {
 818 #ifdef HAVE_SECKEYCHAINOPEN
 819   int                   ret = -1;       /* Return value */
 820   OSStatus              err;            /* Error info */
 821   char                  filename[1024]; /* Filename for keychain */
 822   SecKeychainRef        keychain = NULL;/* Keychain reference */
 823   SecIdentitySearchRef  search = NULL;  /* Search reference */
 824   SecCertificateRef     cert = NULL;    /* Certificate */
 825   CFMutableDictionaryRef attrs = NULL;  /* Attributes for add */
 826   CFArrayRef            list = NULL;    /* Keychain list */
 827
 828
 829   DEBUG_printf(("httpSaveCredentials(path=\"%s\", credentials=%p, common_name=\"%s\")", path, (void *)credentials, common_name));
 830   if (!credentials)
 831     goto cleanup;
 832
 833   if (!httpCredentialsAreValidForName(credentials, common_name))
 834   {
 835     DEBUG_puts("1httpSaveCredentials: Common name does not match.");
 836     return (-1);
 837   }
 838
 839   if ((cert = http_cdsa_create_credential((http_credential_t *)cupsArrayFirst(credentials))) == NULL)
 840   {
 841     DEBUG_puts("1httpSaveCredentials: Unable to create certificate.");
 842     goto cleanup;
 843   }
 844
 845   if (!path)
 846     path = http_cdsa_default_path(filename, sizeof(filename));
 847
 848   if ((err = SecKeychainOpen(path, &keychain)) != noErr)
 849   {
 850     DEBUG_printf(("1httpSaveCredentials: SecKeychainOpen returned %d.", (int)err));
 851     goto cleanup;
 852   }
 853
 854   if ((list = CFArrayCreate(kCFAllocatorDefault, (const void **)&keychain, 1, &kCFTypeArrayCallBacks)) == NULL)
 855   {
 856     DEBUG_puts("1httpSaveCredentials: Unable to create list of keychains.");
 857     goto cleanup;
 858   }
 859
 860   if ((attrs = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks)) == NULL)
 861   {
 862     DEBUG_puts("1httpSaveCredentials: Unable to create dictionary.");
 863     goto cleanup;
 864   }
 865
 866   CFDictionaryAddValue(attrs, kSecClass, kSecClassCertificate);
 867   CFDictionaryAddValue(attrs, kSecValueRef, cert);
 868   CFDictionaryAddValue(attrs, kSecMatchSearchList, list);
 869
 870   /* Note: SecItemAdd consumes "attrs"... */
 871   err = SecItemAdd(attrs, NULL);
 872   DEBUG_printf(("1httpSaveCredentials: SecItemAdd returned %d.", (int)err));
 873
 874   cleanup :
 875
 876   if (list)
 877     CFRelease(list);
 878   if (keychain)
 879     CFRelease(keychain);
 880   if (search)
 881     CFRelease(search);
 882   if (cert)
 883     CFRelease(cert);
 884
 885   DEBUG_printf(("1httpSaveCredentials: Returning %d.", ret));
 886
 887   return (ret);
 888
 889 #else
 890   (void)path;
 891   (void)credentials;
 892   (void)common_name;
 893
 894   return (-1);
 895 #endif /* HAVE_SECKEYCHAINOPEN */
 896 }
 897
 898
 899 /*
 900  * '_httpTLSInitialize()' - Initialize the TLS stack.
 901  */
 902
 903 void
 904 _httpTLSInitialize(void)
 905 {
 906  /*
 907   * Nothing to do...
 908   */
 909 }
 910
 911
 912 /*
 913  * '_httpTLSPending()' - Return the number of pending TLS-encrypted bytes.
 914  */
 915
 916 size_t
 917 _httpTLSPending(http_t *http)           /* I - HTTP connection */
 918 {
 919   size_t bytes;                         /* Bytes that are available */
 920
 921
 922   if (!SSLGetBufferedReadSize(http->tls, &bytes))
 923     return (bytes);
 924
 925   return (0);
 926 }
 927
 928
 929 /*
 930  * '_httpTLSRead()' - Read from a SSL/TLS connection.
 931  */
 932
 933 int                                     /* O - Bytes read */
 934 _httpTLSRead(http_t *http,              /* I - HTTP connection */
 935               char   *buf,              /* I - Buffer to store data */
 936               int    len)               /* I - Length of buffer */
 937 {
 938   int           result;                 /* Return value */
 939   OSStatus      error;                  /* Error info */
 940   size_t        processed;              /* Number of bytes processed */
 941
 942
 943   error = SSLRead(http->tls, buf, (size_t)len, &processed);
 944   DEBUG_printf(("6_httpTLSRead: error=%d, processed=%d", (int)error,
 945                 (int)processed));
 946   switch (error)
 947   {
 948     case 0 :
 949         result = (int)processed;
 950         break;
 951
 952     case errSSLWouldBlock :
 953         if (processed)
 954           result = (int)processed;
 955         else
 956         {
 957           result = -1;
 958           errno  = EINTR;
 959         }
 960         break;
 961
 962     case errSSLClosedGraceful :
 963     default :
 964         if (processed)
 965           result = (int)processed;
 966         else
 967         {
 968           result = -1;
 969           errno  = EPIPE;
 970         }
 971         break;
 972   }
 973
 974   return (result);
 975 }
 976
 977
 978 /*
 979  * '_httpTLSSetOptions()' - Set TLS protocol and cipher suite options.
 980  */
 981
 982 void
 983 _httpTLSSetOptions(int options)         /* I - Options */
 984 {
 985   tls_options = options;
 986 }
 987
 988
 989 /*
 990  * '_httpTLSStart()' - Set up SSL/TLS support on a connection.
 991  */
 992
 993 int                                     /* O - 0 on success, -1 on failure */
 994 _httpTLSStart(http_t *http)             /* I - HTTP connection */
 995 {
 996   char                  hostname[256],  /* Hostname */
 997                         *hostptr;       /* Pointer into hostname */
 998   _cups_globals_t       *cg = _cupsGlobals();
 999                                         /* Pointer to library globals */
1000   OSStatus              error;          /* Error code */
1001   const char            *message = NULL;/* Error message */
1002   cups_array_t          *credentials;   /* Credentials array */
1003   cups_array_t          *names;         /* CUPS distinguished names */
1004   CFArrayRef            dn_array;       /* CF distinguished names array */
1005   CFIndex               count;          /* Number of credentials */
1006   CFDataRef             data;           /* Certificate data */
1007   int                   i;              /* Looping var */
1008   http_credential_t     *credential;    /* Credential data */
1009
1010
1011   DEBUG_printf(("3_httpTLSStart(http=%p)", (void *)http));
1012
1013   if (tls_options < 0)
1014   {
1015     DEBUG_puts("4_httpTLSStart: Setting defaults.");
1016     _cupsSetDefaults();
1017     DEBUG_printf(("4_httpTLSStart: tls_options=%x", tls_options));
1018   }
1019
1020 #ifdef HAVE_SECKEYCHAINOPEN
1021   if (http->mode == _HTTP_MODE_SERVER && !tls_keychain)
1022 #else
1023   if (http->mode == _HTTP_MODE_SERVER)
1024 #endif /* HAVE_SECKEYCHAINOPEN */
1025   {
1026     DEBUG_puts("4_httpTLSStart: cupsSetServerCredentials not called.");
1027     http->error  = errno = EINVAL;
1028     http->status = HTTP_STATUS_ERROR;
1029     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Server credentials not set."), 1);
1030
1031     return (-1);
1032   }
1033
1034   if ((http->tls = SSLCreateContext(kCFAllocatorDefault, http->mode == _HTTP_MODE_CLIENT ? kSSLClientSide : kSSLServerSide, kSSLStreamType)) == NULL)
1035   {
1036     DEBUG_puts("4_httpTLSStart: SSLCreateContext failed.");
1037     http->error  = errno = ENOMEM;
1038     http->status = HTTP_STATUS_ERROR;
1039     _cupsSetHTTPError(HTTP_STATUS_ERROR);
1040
1041     return (-1);
1042   }
1043
1044   error = SSLSetConnection(http->tls, http);
1045   DEBUG_printf(("4_httpTLSStart: SSLSetConnection, error=%d", (int)error));
1046
1047   if (!error)
1048   {
1049     error = SSLSetIOFuncs(http->tls, http_cdsa_read, http_cdsa_write);
1050     DEBUG_printf(("4_httpTLSStart: SSLSetIOFuncs, error=%d", (int)error));
1051   }
1052
1053   if (!error)
1054   {
1055     error = SSLSetSessionOption(http->tls, kSSLSessionOptionBreakOnServerAuth,
1056                                 true);
1057     DEBUG_printf(("4_httpTLSStart: SSLSetSessionOption, error=%d", (int)error));
1058   }
1059
1060   if (!error)
1061   {
1062     SSLProtocol minProtocol;
1063
1064     if (tls_options & _HTTP_TLS_DENY_TLS10)
1065       minProtocol = kTLSProtocol11;
1066     else if (tls_options & _HTTP_TLS_ALLOW_SSL3)
1067       minProtocol = kSSLProtocol3;
1068     else
1069       minProtocol = kTLSProtocol1;
1070
1071     error = SSLSetProtocolVersionMin(http->tls, minProtocol);
1072     DEBUG_printf(("4_httpTLSStart: SSLSetProtocolVersionMin(%d), error=%d", minProtocol, (int)error));
1073   }
1074
1075 #  if HAVE_SSLSETENABLEDCIPHERS
1076   if (!error)
1077   {
1078     SSLCipherSuite      supported[100]; /* Supported cipher suites */
1079     size_t              num_supported;  /* Number of supported cipher suites */
1080     SSLCipherSuite      enabled[100];   /* Cipher suites to enable */
1081     size_t              num_enabled;    /* Number of cipher suites to enable */
1082
1083     num_supported = sizeof(supported) / sizeof(supported[0]);
1084     error         = SSLGetSupportedCiphers(http->tls, supported, &num_supported);
1085
1086     if (!error)
1087     {
1088       DEBUG_printf(("4_httpTLSStart: %d cipher suites supported.", (int)num_supported));
1089
1090       for (i = 0, num_enabled = 0; i < (int)num_supported && num_enabled < (sizeof(enabled) / sizeof(enabled[0])); i ++)
1091       {
1092         switch (supported[i])
1093         {
1094           /* Obviously insecure cipher suites that we never want to use */
1095           case SSL_NULL_WITH_NULL_NULL :
1096           case SSL_RSA_WITH_NULL_MD5 :
1097           case SSL_RSA_WITH_NULL_SHA :
1098           case SSL_RSA_EXPORT_WITH_RC4_40_MD5 :
1099           case SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5 :
1100           case SSL_RSA_EXPORT_WITH_DES40_CBC_SHA :
1101           case SSL_RSA_WITH_DES_CBC_SHA :
1102           case SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA :
1103           case SSL_DH_DSS_WITH_DES_CBC_SHA :
1104           case SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA :
1105           case SSL_DH_RSA_WITH_DES_CBC_SHA :
1106           case SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA :
1107           case SSL_DHE_DSS_WITH_DES_CBC_SHA :
1108           case SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA :
1109           case SSL_DHE_RSA_WITH_DES_CBC_SHA :
1110           case SSL_DH_anon_EXPORT_WITH_RC4_40_MD5 :
1111           case SSL_DH_anon_WITH_RC4_128_MD5 :
1112           case SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA :
1113           case SSL_DH_anon_WITH_DES_CBC_SHA :
1114           case SSL_DH_anon_WITH_3DES_EDE_CBC_SHA :
1115           case SSL_FORTEZZA_DMS_WITH_NULL_SHA :
1116           case TLS_DH_anon_WITH_AES_128_CBC_SHA :
1117           case TLS_DH_anon_WITH_AES_256_CBC_SHA :
1118           case TLS_ECDH_ECDSA_WITH_NULL_SHA :
1119           case TLS_ECDHE_RSA_WITH_NULL_SHA :
1120           case TLS_ECDH_anon_WITH_NULL_SHA :
1121           case TLS_ECDH_anon_WITH_RC4_128_SHA :
1122           case TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA :
1123           case TLS_ECDH_anon_WITH_AES_128_CBC_SHA :
1124           case TLS_ECDH_anon_WITH_AES_256_CBC_SHA :
1125           case TLS_RSA_WITH_NULL_SHA256 :
1126           case TLS_DH_anon_WITH_AES_128_CBC_SHA256 :
1127           case TLS_DH_anon_WITH_AES_256_CBC_SHA256 :
1128           case TLS_PSK_WITH_NULL_SHA :
1129           case TLS_DHE_PSK_WITH_NULL_SHA :
1130           case TLS_RSA_PSK_WITH_NULL_SHA :
1131           case TLS_DH_anon_WITH_AES_128_GCM_SHA256 :
1132           case TLS_DH_anon_WITH_AES_256_GCM_SHA384 :
1133           case TLS_PSK_WITH_NULL_SHA256 :
1134           case TLS_PSK_WITH_NULL_SHA384 :
1135           case TLS_DHE_PSK_WITH_NULL_SHA256 :
1136           case TLS_DHE_PSK_WITH_NULL_SHA384 :
1137           case TLS_RSA_PSK_WITH_NULL_SHA256 :
1138           case TLS_RSA_PSK_WITH_NULL_SHA384 :
1139           case SSL_RSA_WITH_DES_CBC_MD5 :
1140               DEBUG_printf(("4_httpTLSStart: Excluding insecure cipher suite %d", supported[i]));
1141               break;
1142
1143           /* RC4 cipher suites that should only be used as a last resort */
1144           case SSL_RSA_WITH_RC4_128_MD5 :
1145           case SSL_RSA_WITH_RC4_128_SHA :
1146           case TLS_ECDH_ECDSA_WITH_RC4_128_SHA :
1147           case TLS_ECDHE_ECDSA_WITH_RC4_128_SHA :
1148           case TLS_ECDH_RSA_WITH_RC4_128_SHA :
1149           case TLS_ECDHE_RSA_WITH_RC4_128_SHA :
1150           case TLS_PSK_WITH_RC4_128_SHA :
1151           case TLS_DHE_PSK_WITH_RC4_128_SHA :
1152           case TLS_RSA_PSK_WITH_RC4_128_SHA :
1153               if (tls_options & _HTTP_TLS_ALLOW_RC4)
1154                 enabled[num_enabled ++] = supported[i];
1155               else
1156                 DEBUG_printf(("4_httpTLSStart: Excluding RC4 cipher suite %d", supported[i]));
1157               break;
1158
1159           /* DH/DHE cipher suites that are problematic with parameters < 1024 bits */
1160           case TLS_DH_DSS_WITH_AES_128_CBC_SHA :
1161           case TLS_DH_RSA_WITH_AES_128_CBC_SHA :
1162           case TLS_DHE_DSS_WITH_AES_128_CBC_SHA :
1163           case TLS_DHE_RSA_WITH_AES_128_CBC_SHA :
1164           case TLS_DH_DSS_WITH_AES_256_CBC_SHA :
1165           case TLS_DH_RSA_WITH_AES_256_CBC_SHA :
1166           case TLS_DHE_DSS_WITH_AES_256_CBC_SHA :
1167           case TLS_DHE_RSA_WITH_AES_256_CBC_SHA :
1168           case TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA :
1169           case TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA :
1170 //          case TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA :
1171           case TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA :
1172           case TLS_DH_DSS_WITH_AES_128_CBC_SHA256 :
1173           case TLS_DH_RSA_WITH_AES_128_CBC_SHA256 :
1174           case TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 :
1175           case TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 :
1176           case TLS_DH_DSS_WITH_AES_256_CBC_SHA256 :
1177           case TLS_DH_RSA_WITH_AES_256_CBC_SHA256 :
1178           case TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 :
1179           case TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 :
1180           case TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA :
1181           case TLS_DHE_PSK_WITH_AES_128_CBC_SHA :
1182           case TLS_DHE_PSK_WITH_AES_256_CBC_SHA :
1183 //          case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 :
1184 //          case TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 :
1185           case TLS_DH_RSA_WITH_AES_128_GCM_SHA256 :
1186           case TLS_DH_RSA_WITH_AES_256_GCM_SHA384 :
1187 //          case TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 :
1188 //          case TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 :
1189           case TLS_DH_DSS_WITH_AES_128_GCM_SHA256 :
1190           case TLS_DH_DSS_WITH_AES_256_GCM_SHA384 :
1191           case TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 :
1192           case TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 :
1193           case TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 :
1194           case TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 :
1195               if (tls_options & _HTTP_TLS_ALLOW_DH)
1196                 enabled[num_enabled ++] = supported[i];
1197               else
1198                 DEBUG_printf(("4_httpTLSStart: Excluding DH/DHE cipher suite %d", supported[i]));
1199               break;
1200
1201           /* Anything else we'll assume is secure */
1202           default :
1203               enabled[num_enabled ++] = supported[i];
1204               break;
1205         }
1206       }
1207
1208       DEBUG_printf(("4_httpTLSStart: %d cipher suites enabled.", (int)num_enabled));
1209       error = SSLSetEnabledCiphers(http->tls, enabled, num_enabled);
1210     }
1211   }
1212 #endif /* HAVE_SSLSETENABLEDCIPHERS */
1213
1214   if (!error && http->mode == _HTTP_MODE_CLIENT)
1215   {
1216    /*
1217     * Client: set client-side credentials, if any...
1218     */
1219
1220     if (cg->client_cert_cb)
1221     {
1222       error = SSLSetSessionOption(http->tls,
1223                                   kSSLSessionOptionBreakOnCertRequested, true);
1224       DEBUG_printf(("4_httpTLSStart: kSSLSessionOptionBreakOnCertRequested, "
1225                     "error=%d", (int)error));
1226     }
1227     else
1228     {
1229       error = http_cdsa_set_credentials(http);
1230       DEBUG_printf(("4_httpTLSStart: http_cdsa_set_credentials, error=%d",
1231                     (int)error));
1232     }
1233   }
1234   else if (!error)
1235   {
1236    /*
1237     * Server: find/create a certificate for TLS...
1238     */
1239
1240     if (http->fields[HTTP_FIELD_HOST][0])
1241     {
1242      /*
1243       * Use hostname for TLS upgrade...
1244       */
1245
1246       strlcpy(hostname, http->fields[HTTP_FIELD_HOST], sizeof(hostname));
1247     }
1248     else
1249     {
1250      /*
1251       * Resolve hostname from connection address...
1252       */
1253
1254       http_addr_t       addr;           /* Connection address */
1255       socklen_t         addrlen;        /* Length of address */
1256
1257       addrlen = sizeof(addr);
1258       if (getsockname(http->fd, (struct sockaddr *)&addr, &addrlen))
1259       {
1260         DEBUG_printf(("4_httpTLSStart: Unable to get socket address: %s", strerror(errno)));
1261         hostname[0] = '\0';
1262       }
1263       else if (httpAddrLocalhost(&addr))
1264         hostname[0] = '\0';
1265       else
1266       {
1267         httpAddrLookup(&addr, hostname, sizeof(hostname));
1268         DEBUG_printf(("4_httpTLSStart: Resolved socket address to \"%s\".", hostname));
1269       }
1270     }
1271
1272 #ifdef HAVE_SECKEYCHAINOPEN
1273     if (isdigit(hostname[0] & 255) || hostname[0] == '[')
1274       hostname[0] = '\0';               /* Don't allow numeric addresses */
1275
1276     if (hostname[0])
1277       http->tls_credentials = http_cdsa_copy_server(hostname);
1278     else if (tls_common_name)
1279       http->tls_credentials = http_cdsa_copy_server(tls_common_name);
1280
1281     if (!http->tls_credentials && tls_auto_create && (hostname[0] || tls_common_name))
1282     {
1283       DEBUG_printf(("4_httpTLSStart: Auto-create credentials for \"%s\".", hostname[0] ? hostname : tls_common_name));
1284
1285       if (!cupsMakeServerCredentials(tls_keypath, hostname[0] ? hostname : tls_common_name, 0, NULL, time(NULL) + 365 * 86400))
1286       {
1287         DEBUG_puts("4_httpTLSStart: cupsMakeServerCredentials failed.");
1288         http->error  = errno = EINVAL;
1289         http->status = HTTP_STATUS_ERROR;
1290         _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create server credentials."), 1);
1291
1292         return (-1);
1293       }
1294
1295       http->tls_credentials = http_cdsa_copy_server(hostname[0] ? hostname : tls_common_name);
1296     }
1297 #endif /* HAVE_SECKEYCHAINOPEN */
1298
1299     if (!http->tls_credentials)
1300     {
1301       DEBUG_puts("4_httpTLSStart: Unable to find server credentials.");
1302       http->error  = errno = EINVAL;
1303       http->status = HTTP_STATUS_ERROR;
1304       _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to find server credentials."), 1);
1305
1306       return (-1);
1307     }
1308
1309     error = SSLSetCertificate(http->tls, http->tls_credentials);
1310
1311     DEBUG_printf(("4_httpTLSStart: SSLSetCertificate, error=%d", (int)error));
1312   }
1313
1314   DEBUG_printf(("4_httpTLSStart: tls_credentials=%p", (void *)http->tls_credentials));
1315
1316  /*
1317   * Let the server know which hostname/domain we are trying to connect to
1318   * in case it wants to serve up a certificate with a matching common name.
1319   */
1320
1321   if (!error && http->mode == _HTTP_MODE_CLIENT)
1322   {
1323    /*
1324     * Client: get the hostname to use for TLS...
1325     */
1326
1327     if (httpAddrLocalhost(http->hostaddr))
1328     {
1329       strlcpy(hostname, "localhost", sizeof(hostname));
1330     }
1331     else
1332     {
1333      /*
1334       * Otherwise make sure the hostname we have does not end in a trailing dot.
1335       */
1336
1337       strlcpy(hostname, http->hostname, sizeof(hostname));
1338       if ((hostptr = hostname + strlen(hostname) - 1) >= hostname &&
1339           *hostptr == '.')
1340         *hostptr = '\0';
1341     }
1342
1343     error = SSLSetPeerDomainName(http->tls, hostname, strlen(hostname));
1344
1345     DEBUG_printf(("4_httpTLSStart: SSLSetPeerDomainName, error=%d", (int)error));
1346   }
1347
1348   if (!error)
1349   {
1350     int done = 0;                       /* Are we done yet? */
1351
1352     while (!error && !done)
1353     {
1354       error = SSLHandshake(http->tls);
1355
1356       DEBUG_printf(("4_httpTLSStart: SSLHandshake returned %d.", (int)error));
1357
1358       switch (error)
1359       {
1360         case noErr :
1361             done = 1;
1362             break;
1363
1364         case errSSLWouldBlock :
1365             error = noErr;              /* Force a retry */
1366             usleep(1000);               /* in 1 millisecond */
1367             break;
1368
1369         case errSSLServerAuthCompleted :
1370             error = 0;
1371             if (cg->server_cert_cb)
1372             {
1373               error = httpCopyCredentials(http, &credentials);
1374               if (!error)
1375               {
1376                 error = (cg->server_cert_cb)(http, http->tls, credentials,
1377                                              cg->server_cert_data);
1378                 httpFreeCredentials(credentials);
1379               }
1380
1381               DEBUG_printf(("4_httpTLSStart: Server certificate callback "
1382                             "returned %d.", (int)error));
1383             }
1384             break;
1385
1386         case errSSLClientCertRequested :
1387             error = 0;
1388
1389             if (cg->client_cert_cb)
1390             {
1391               names = NULL;
1392               if (!(error = SSLCopyDistinguishedNames(http->tls, &dn_array)) &&
1393                   dn_array)
1394               {
1395                 if ((names = cupsArrayNew(NULL, NULL)) != NULL)
1396                 {
1397                   for (i = 0, count = CFArrayGetCount(dn_array); i < count; i++)
1398                   {
1399                     data = (CFDataRef)CFArrayGetValueAtIndex(dn_array, i);
1400
1401                     if ((credential = malloc(sizeof(*credential))) != NULL)
1402                     {
1403                       credential->datalen = (size_t)CFDataGetLength(data);
1404                       if ((credential->data = malloc(credential->datalen)))
1405                       {
1406                         memcpy((void *)credential->data, CFDataGetBytePtr(data),
1407                                credential->datalen);
1408                         cupsArrayAdd(names, credential);
1409                       }
1410                       else
1411                         free(credential);
1412                     }
1413                   }
1414                 }
1415
1416                 CFRelease(dn_array);
1417               }
1418
1419               if (!error)
1420               {
1421                 error = (cg->client_cert_cb)(http, http->tls, names,
1422                                              cg->client_cert_data);
1423
1424                 DEBUG_printf(("4_httpTLSStart: Client certificate callback "
1425                               "returned %d.", (int)error));
1426               }
1427
1428               httpFreeCredentials(names);
1429             }
1430             break;
1431
1432         case errSSLUnknownRootCert :
1433             message = _("Unable to establish a secure connection to host "
1434                         "(untrusted certificate).");
1435             break;
1436
1437         case errSSLNoRootCert :
1438             message = _("Unable to establish a secure connection to host "
1439                         "(self-signed certificate).");
1440             break;
1441
1442         case errSSLCertExpired :
1443             message = _("Unable to establish a secure connection to host "
1444                         "(expired certificate).");
1445             break;
1446
1447         case errSSLCertNotYetValid :
1448             message = _("Unable to establish a secure connection to host "
1449                         "(certificate not yet valid).");
1450             break;
1451
1452         case errSSLHostNameMismatch :
1453             message = _("Unable to establish a secure connection to host "
1454                         "(host name mismatch).");
1455             break;
1456
1457         case errSSLXCertChainInvalid :
1458             message = _("Unable to establish a secure connection to host "
1459                         "(certificate chain invalid).");
1460             break;
1461
1462         case errSSLConnectionRefused :
1463             message = _("Unable to establish a secure connection to host "
1464                         "(peer dropped connection before responding).");
1465             break;
1466
1467         default :
1468             break;
1469       }
1470     }
1471   }
1472
1473   if (error)
1474   {
1475     http->error  = error;
1476     http->status = HTTP_STATUS_ERROR;
1477     errno        = ECONNREFUSED;
1478
1479     CFRelease(http->tls);
1480     http->tls = NULL;
1481
1482    /*
1483     * If an error string wasn't set by the callbacks use a generic one...
1484     */
1485
1486     if (!message)
1487 #ifdef HAVE_CSSMERRORSTRING
1488       message = cssmErrorString(error);
1489 #else
1490       message = _("Unable to establish a secure connection to host.");
1491 #endif /* HAVE_CSSMERRORSTRING */
1492
1493     _cupsSetError(IPP_STATUS_ERROR_CUPS_PKI, message, 1);
1494
1495     return (-1);
1496   }
1497
1498   return (0);
1499 }
1500
1501
1502 /*
1503  * '_httpTLSStop()' - Shut down SSL/TLS on a connection.
1504  */
1505
1506 void
1507 _httpTLSStop(http_t *http)              /* I - HTTP connection */
1508 {
1509   while (SSLClose(http->tls) == errSSLWouldBlock)
1510     usleep(1000);
1511
1512   CFRelease(http->tls);
1513
1514   if (http->tls_credentials)
1515     CFRelease(http->tls_credentials);
1516
1517   http->tls             = NULL;
1518   http->tls_credentials = NULL;
1519 }
1520
1521
1522 /*
1523  * '_httpTLSWrite()' - Write to a SSL/TLS connection.
1524  */
1525
1526 int                                     /* O - Bytes written */
1527 _httpTLSWrite(http_t     *http,         /* I - HTTP connection */
1528                const char *buf,         /* I - Buffer holding data */
1529                int        len)          /* I - Length of buffer */
1530 {
1531   ssize_t       result;                 /* Return value */
1532   OSStatus      error;                  /* Error info */
1533   size_t        processed;              /* Number of bytes processed */
1534
1535
1536   DEBUG_printf(("2_httpTLSWrite(http=%p, buf=%p, len=%d)", (void *)http, (void *)buf, len));
1537
1538   error = SSLWrite(http->tls, buf, (size_t)len, &processed);
1539
1540   switch (error)
1541   {
1542     case 0 :
1543         result = (int)processed;
1544         break;
1545
1546     case errSSLWouldBlock :
1547         if (processed)
1548         {
1549           result = (int)processed;
1550         }
1551         else
1552         {
1553           result = -1;
1554           errno  = EINTR;
1555         }
1556         break;
1557
1558     case errSSLClosedGraceful :
1559     default :
1560         if (processed)
1561         {
1562           result = (int)processed;
1563         }
1564         else
1565         {
1566           result = -1;
1567           errno  = EPIPE;
1568         }
1569         break;
1570   }
1571
1572   DEBUG_printf(("3_httpTLSWrite: Returning %d.", (int)result));
1573
1574   return ((int)result);
1575 }
1576
1577
1578 #ifdef HAVE_SECKEYCHAINOPEN
1579 /*
1580  * 'http_cdsa_copy_server()' - Find and copy server credentials from the keychain.
1581  */
1582
1583 static CFArrayRef                       /* O - Array of certificates or NULL */
1584 http_cdsa_copy_server(
1585     const char *common_name)            /* I - Server's hostname */
1586 {
1587   OSStatus              err;            /* Error info */
1588   SecIdentitySearchRef  search = NULL;  /* Search reference */
1589   SecIdentityRef        identity = NULL;/* Identity */
1590   CFArrayRef            certificates = NULL;
1591                                         /* Certificate array */
1592   SecPolicyRef          policy = NULL;  /* Policy ref */
1593   CFStringRef           cfcommon_name = NULL;
1594                                         /* Server name */
1595   CFMutableDictionaryRef query = NULL;  /* Query qualifiers */
1596   CFArrayRef            list = NULL;    /* Keychain list */
1597
1598
1599   cfcommon_name = CFStringCreateWithCString(kCFAllocatorDefault, common_name, kCFStringEncodingUTF8);
1600
1601   policy = SecPolicyCreateSSL(1, cfcommon_name);
1602
1603   if (cfcommon_name)
1604     CFRelease(cfcommon_name);
1605
1606   if (!policy)
1607     goto cleanup;
1608
1609   if (!(query = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks)))
1610     goto cleanup;
1611
1612   _cupsMutexLock(&tls_mutex);
1613
1614   list = CFArrayCreate(kCFAllocatorDefault, (const void **)&tls_keychain, 1, &kCFTypeArrayCallBacks);
1615
1616   CFDictionaryAddValue(query, kSecClass, kSecClassIdentity);
1617   CFDictionaryAddValue(query, kSecMatchPolicy, policy);
1618   CFDictionaryAddValue(query, kSecReturnRef, kCFBooleanTrue);
1619   CFDictionaryAddValue(query, kSecMatchLimit, kSecMatchLimitOne);
1620   CFDictionaryAddValue(query, kSecMatchSearchList, list);
1621
1622   CFRelease(list);
1623
1624   err = SecItemCopyMatching(query, (CFTypeRef *)&identity);
1625
1626   _cupsMutexUnlock(&tls_mutex);
1627
1628   if (err)
1629     goto cleanup;
1630
1631   if (CFGetTypeID(identity) != SecIdentityGetTypeID())
1632     goto cleanup;
1633
1634   if ((certificates = CFArrayCreate(NULL, (const void **)&identity, 1, &kCFTypeArrayCallBacks)) == NULL)
1635     goto cleanup;
1636
1637   cleanup :
1638
1639   if (search)
1640     CFRelease(search);
1641   if (identity)
1642     CFRelease(identity);
1643
1644   if (policy)
1645     CFRelease(policy);
1646   if (query)
1647     CFRelease(query);
1648
1649   return (certificates);
1650 }
1651 #endif /* HAVE_SECKEYCHAINOPEN */
1652
1653
1654 /*
1655  * 'http_cdsa_create_credential()' - Create a single credential in the internal format.
1656  */
1657
1658 static SecCertificateRef                        /* O - Certificate */
1659 http_cdsa_create_credential(
1660     http_credential_t *credential)              /* I - Credential */
1661 {
1662   if (!credential)
1663     return (NULL);
1664
1665   return (SecCertificateCreateWithBytes(kCFAllocatorDefault, credential->data, (CFIndex)credential->datalen));
1666 }
1667
1668
1669 /*
1670  * 'http_cdsa_default_path()' - Get the default keychain path.
1671  */
1672
1673 static const char *                     /* O - Keychain path */
1674 http_cdsa_default_path(char   *buffer,  /* I - Path buffer */
1675                        size_t bufsize)  /* I - Size of buffer */
1676 {
1677   const char *home = getenv("HOME");    /* HOME environment variable */
1678
1679
1680   if (getuid() && home)
1681     snprintf(buffer, bufsize, "%s/Library/Keychains/login.keychain", home);
1682   else
1683     strlcpy(buffer, "/Library/Keychains/System.keychain", bufsize);
1684
1685   DEBUG_printf(("1http_cdsa_default_path: Using default path \"%s\".", buffer));
1686
1687   return (buffer);
1688 }
1689
1690
1691 /*
1692  * 'http_cdsa_read()' - Read function for the CDSA library.
1693  */
1694
1695 static OSStatus                         /* O  - -1 on error, 0 on success */
1696 http_cdsa_read(
1697     SSLConnectionRef connection,        /* I  - SSL/TLS connection */
1698     void             *data,             /* I  - Data buffer */
1699     size_t           *dataLength)       /* IO - Number of bytes */
1700 {
1701   OSStatus      result;                 /* Return value */
1702   ssize_t       bytes;                  /* Number of bytes read */
1703   http_t        *http;                  /* HTTP connection */
1704
1705
1706   http = (http_t *)connection;
1707
1708   if (!http->blocking)
1709   {
1710    /*
1711     * Make sure we have data before we read...
1712     */
1713
1714     while (!_httpWait(http, http->wait_value, 0))
1715     {
1716       if (http->timeout_cb && (*http->timeout_cb)(http, http->timeout_data))
1717         continue;
1718
1719       http->error = ETIMEDOUT;
1720       return (-1);
1721     }
1722   }
1723
1724   do
1725   {
1726     bytes = recv(http->fd, data, *dataLength, 0);
1727   }
1728   while (bytes == -1 && (errno == EINTR || errno == EAGAIN));
1729
1730   if ((size_t)bytes == *dataLength)
1731   {
1732     result = 0;
1733   }
1734   else if (bytes > 0)
1735   {
1736     *dataLength = (size_t)bytes;
1737     result = errSSLWouldBlock;
1738   }
1739   else
1740   {
1741     *dataLength = 0;
1742
1743     if (bytes == 0)
1744       result = errSSLClosedGraceful;
1745     else if (errno == EAGAIN)
1746       result = errSSLWouldBlock;
1747     else
1748       result = errSSLClosedAbort;
1749   }
1750
1751   return (result);
1752 }
1753
1754
1755 /*
1756  * 'http_cdsa_set_credentials()' - Set the TLS credentials.
1757  */
1758
1759 static int                              /* O - Status of connection */
1760 http_cdsa_set_credentials(http_t *http) /* I - HTTP connection */
1761 {
1762   _cups_globals_t *cg = _cupsGlobals(); /* Pointer to library globals */
1763   OSStatus              error = 0;      /* Error code */
1764   http_tls_credentials_t credentials = NULL;
1765                                         /* TLS credentials */
1766
1767
1768   DEBUG_printf(("7http_tls_set_credentials(%p)", (void *)http));
1769
1770  /*
1771   * Prefer connection specific credentials...
1772   */
1773
1774   if ((credentials = http->tls_credentials) == NULL)
1775     credentials = cg->tls_credentials;
1776
1777   if (credentials)
1778   {
1779     error = SSLSetCertificate(http->tls, credentials);
1780     DEBUG_printf(("4http_tls_set_credentials: SSLSetCertificate, error=%d",
1781                   (int)error));
1782   }
1783   else
1784     DEBUG_puts("4http_tls_set_credentials: No credentials to set.");
1785
1786   return (error);
1787 }
1788
1789
1790 /*
1791  * 'http_cdsa_write()' - Write function for the CDSA library.
1792  */
1793
1794 static OSStatus                         /* O  - -1 on error, 0 on success */
1795 http_cdsa_write(
1796     SSLConnectionRef connection,        /* I  - SSL/TLS connection */
1797     const void       *data,             /* I  - Data buffer */
1798     size_t           *dataLength)       /* IO - Number of bytes */
1799 {
1800   OSStatus      result;                 /* Return value */
1801   ssize_t       bytes;                  /* Number of bytes read */
1802   http_t        *http;                  /* HTTP connection */
1803
1804
1805   http = (http_t *)connection;
1806
1807   do
1808   {
1809     bytes = write(http->fd, data, *dataLength);
1810   }
1811   while (bytes == -1 && (errno == EINTR || errno == EAGAIN));
1812
1813   if ((size_t)bytes == *dataLength)
1814   {
1815     result = 0;
1816   }
1817   else if (bytes >= 0)
1818   {
1819     *dataLength = (size_t)bytes;
1820     result = errSSLWouldBlock;
1821   }
1822   else
1823   {
1824     *dataLength = 0;
1825
1826     if (errno == EAGAIN)
1827       result = errSSLWouldBlock;
1828     else
1829       result = errSSLClosedAbort;
1830   }
1831
1832   return (result);
1833 }