cups/tls-darwin.c

   1 /*
   2  * TLS support code for CUPS on macOS.
   3  *
   4  * Copyright © 2007-2018 by Apple Inc.
   5  * Copyright © 1997-2007 by Easy Software Products, all rights reserved.
   6  *
   7  * Licensed under Apache License v2.0.  See the file "LICENSE" for more information.
   8  */
   9
  10 /**** This file is included from tls.c ****/
  11
  12 /*
  13  * Include necessary headers...
  14  */
  15
  16 #include <spawn.h>
  17
  18 extern char **environ;
  19
  20
  21 #ifdef HAVE_SECURETRANSPORTPRIV_H
  22 #  include <Security/SecureTransportPriv.h>
  23 #endif /* HAVE_SECURETRANSPORTPRIV_H */
  24 #ifdef HAVE_SECBASEPRIV_H
  25 #  include <Security/SecBasePriv.h>
  26 #endif /* HAVE_SECBASEPRIV_H */
  27 #ifdef HAVE_SECCERTIFICATEPRIV_H
  28 #  include <Security/SecCertificatePriv.h>
  29 #else
  30 #  ifndef _SECURITY_VERSION_GREATER_THAN_57610_
  31 typedef CF_OPTIONS(uint32_t, SecKeyUsage) {
  32     kSecKeyUsageAll              = 0x7FFFFFFF
  33 };
  34 #  endif /* !_SECURITY_VERSION_GREATER_THAN_57610_ */
  35 extern const void * kSecCSRChallengePassword;
  36 extern const void * kSecSubjectAltName;
  37 extern const void * kSecCertificateKeyUsage;
  38 extern const void * kSecCSRBasicContraintsPathLen;
  39 extern const void * kSecCertificateExtensions;
  40 extern const void * kSecCertificateExtensionsEncoded;
  41 extern const void * kSecOidCommonName;
  42 extern const void * kSecOidCountryName;
  43 extern const void * kSecOidStateProvinceName;
  44 extern const void * kSecOidLocalityName;
  45 extern const void * kSecOidOrganization;
  46 extern const void * kSecOidOrganizationalUnit;
  47 extern SecCertificateRef SecCertificateCreateWithBytes(CFAllocatorRef allocator, const UInt8 *bytes, CFIndex length);
  48 extern bool SecCertificateIsValid(SecCertificateRef certificate, CFAbsoluteTime verifyTime);
  49 extern CFAbsoluteTime SecCertificateNotValidAfter(SecCertificateRef certificate);
  50 extern SecCertificateRef SecGenerateSelfSignedCertificate(CFArrayRef subject, CFDictionaryRef parameters, SecKeyRef publicKey, SecKeyRef privateKey);
  51 extern SecIdentityRef SecIdentityCreate(CFAllocatorRef allocator, SecCertificateRef certificate, SecKeyRef privateKey);
  52 #endif /* HAVE_SECCERTIFICATEPRIV_H */
  53 #ifdef HAVE_SECITEMPRIV_H
  54 #  include <Security/SecItemPriv.h>
  55 #endif /* HAVE_SECITEMPRIV_H */
  56 #ifdef HAVE_SECIDENTITYSEARCHPRIV_H
  57 #  include <Security/SecIdentitySearchPriv.h>
  58 #endif /* HAVE_SECIDENTITYSEARCHPRIV_H */
  59 #ifdef HAVE_SECPOLICYPRIV_H
  60 #  include <Security/SecPolicyPriv.h>
  61 #endif /* HAVE_SECPOLICYPRIV_H */
  62
  63 //extern SecCertificateRef SecGenerateSelfSignedCertificate(CFArrayRef subject, CFDictionaryRef parameters, SecKeyRef _Nullable publicKey, SecKeyRef privateKey);
  64
  65
  66 /*
  67  * Constants, very secure stuff...
  68  */
  69
  70 #define _CUPS_CDSA_PASSWORD     "42"    /* CUPS keychain password */
  71 #define _CUPS_CDSA_PASSLEN      2       /* Length of keychain password */
  72
  73
  74 /*
  75  * Local globals...
  76  */
  77
  78 static int              tls_auto_create = 0;
  79                                         /* Auto-create self-signed certs? */
  80 static char             *tls_common_name = NULL;
  81                                         /* Default common name */
  82 #if TARGET_OS_OSX
  83 static int              tls_cups_keychain = 0;
  84                                         /* Opened the CUPS keychain? */
  85 static SecKeychainRef   tls_keychain = NULL;
  86                                         /* Server cert keychain */
  87 #else
  88 static SecIdentityRef   tls_selfsigned = NULL;
  89                                         /* Temporary self-signed cert */
  90 #endif /* TARGET_OS_OSX */
  91 static char             *tls_keypath = NULL;
  92                                         /* Server cert keychain path */
  93 static _cups_mutex_t    tls_mutex = _CUPS_MUTEX_INITIALIZER;
  94                                         /* Mutex for keychain/certs */
  95 static int              tls_options = -1,/* Options for TLS connections */
  96                         tls_min_version = _HTTP_TLS_1_0,
  97                         tls_max_version = _HTTP_TLS_MAX;
  98
  99
 100 /*
 101  * Local functions...
 102  */
 103
 104 static CFArrayRef       http_cdsa_copy_server(const char *common_name);
 105 static SecCertificateRef http_cdsa_create_credential(http_credential_t *credential);
 106 #if TARGET_OS_OSX
 107 static const char       *http_cdsa_default_path(char *buffer, size_t bufsize);
 108 static SecKeychainRef   http_cdsa_open_keychain(const char *path, char *filename, size_t filesize);
 109 static SecKeychainRef   http_cdsa_open_system_keychain(void);
 110 #endif /* TARGET_OS_OSX */
 111 static OSStatus         http_cdsa_read(SSLConnectionRef connection, void *data, size_t *dataLength);
 112 static int              http_cdsa_set_credentials(http_t *http);
 113 static OSStatus         http_cdsa_write(SSLConnectionRef connection, const void *data, size_t *dataLength);
 114
 115
 116 /*
 117  * 'cupsMakeServerCredentials()' - Make a self-signed certificate and private key pair.
 118  *
 119  * @since CUPS 2.0/OS 10.10@
 120  */
 121
 122 int                                     /* O - 1 on success, 0 on failure */
 123 cupsMakeServerCredentials(
 124     const char *path,                   /* I - Keychain path or @code NULL@ for default */
 125     const char *common_name,            /* I - Common name */
 126     int        num_alt_names,           /* I - Number of subject alternate names */
 127     const char **alt_names,             /* I - Subject Alternate Names */
 128     time_t     expiration_date)         /* I - Expiration date */
 129 {
 130 #if TARGET_OS_IOS
 131   int                   status = 0;     /* Return status */
 132   OSStatus              err;            /* Error code (if any) */
 133   CFStringRef           cfcommon_name = NULL;
 134                                         /* CF string for server name */
 135   SecIdentityRef        ident = NULL;   /* Identity */
 136   SecKeyRef             publicKey = NULL,
 137                                         /* Public key */
 138                         privateKey = NULL;
 139                                         /* Private key */
 140   SecCertificateRef     cert = NULL;    /* Self-signed certificate */
 141   CFMutableDictionaryRef keyParams = NULL;
 142                                         /* Key generation parameters */
 143
 144
 145   DEBUG_printf(("cupsMakeServerCredentials(path=\"%s\", common_name=\"%s\", num_alt_names=%d, alt_names=%p, expiration_date=%d)", path, common_name, num_alt_names, alt_names, (int)expiration_date));
 146
 147   (void)path;
 148   (void)num_alt_names;
 149   (void)alt_names;
 150   (void)expiration_date;
 151
 152   if (path)
 153   {
 154     DEBUG_puts("1cupsMakeServerCredentials: No keychain support compiled in, returning 0.");
 155     return (0);
 156   }
 157
 158   if (tls_selfsigned)
 159   {
 160     DEBUG_puts("1cupsMakeServerCredentials: Using existing self-signed cert.");
 161     return (1);
 162   }
 163
 164   cfcommon_name = CFStringCreateWithCString(kCFAllocatorDefault, common_name, kCFStringEncodingUTF8);
 165   if (!cfcommon_name)
 166   {
 167     DEBUG_puts("1cupsMakeServerCredentials: Unable to create CF string of common name.");
 168     goto cleanup;
 169   }
 170
 171  /*
 172   * Create a public/private key pair...
 173   */
 174
 175   keyParams = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
 176   if (!keyParams)
 177   {
 178     DEBUG_puts("1cupsMakeServerCredentials: Unable to create key parameters dictionary.");
 179     goto cleanup;
 180   }
 181
 182   CFDictionaryAddValue(keyParams, kSecAttrKeyType, kSecAttrKeyTypeRSA);
 183   CFDictionaryAddValue(keyParams, kSecAttrKeySizeInBits, CFSTR("2048"));
 184   CFDictionaryAddValue(keyParams, kSecAttrLabel, cfcommon_name);
 185
 186   err = SecKeyGeneratePair(keyParams, &publicKey, &privateKey);
 187   if (err != noErr)
 188   {
 189     DEBUG_printf(("1cupsMakeServerCredentials: Unable to generate key pair: %d.", (int)err));
 190     goto cleanup;
 191   }
 192
 193  /*
 194   * Create a self-signed certificate using the public/private key pair...
 195   */
 196
 197   CFIndex       usageInt = kSecKeyUsageAll;
 198   CFNumberRef   usage = CFNumberCreate(kCFAllocatorDefault, kCFNumberCFIndexType, &usageInt);
 199   CFIndex       lenInt = 0;
 200   CFNumberRef   len = CFNumberCreate(kCFAllocatorDefault, kCFNumberCFIndexType, &lenInt);
 201   CFTypeRef certKeys[] = { kSecCSRBasicContraintsPathLen, kSecSubjectAltName, kSecCertificateKeyUsage };
 202   CFTypeRef certValues[] = { len, cfcommon_name, usage };
 203   CFDictionaryRef certParams = CFDictionaryCreate(kCFAllocatorDefault, certKeys, certValues, sizeof(certKeys) / sizeof(certKeys[0]), &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
 204   CFRelease(usage);
 205   CFRelease(len);
 206
 207   const void    *ca_o[] = { kSecOidOrganization, CFSTR("") };
 208   const void    *ca_cn[] = { kSecOidCommonName, cfcommon_name };
 209   CFArrayRef    ca_o_dn = CFArrayCreate(kCFAllocatorDefault, ca_o, 2, NULL);
 210   CFArrayRef    ca_cn_dn = CFArrayCreate(kCFAllocatorDefault, ca_cn, 2, NULL);
 211   const void    *ca_dn_array[2];
 212
 213   ca_dn_array[0] = CFArrayCreate(kCFAllocatorDefault, (const void **)&ca_o_dn, 1, NULL);
 214   ca_dn_array[1] = CFArrayCreate(kCFAllocatorDefault, (const void **)&ca_cn_dn, 1, NULL);
 215
 216   CFArrayRef    subject = CFArrayCreate(kCFAllocatorDefault, ca_dn_array, 2, NULL);
 217
 218   cert = SecGenerateSelfSignedCertificate(subject, certParams, publicKey, privateKey);
 219
 220   CFRelease(subject);
 221   CFRelease(certParams);
 222
 223   if (!cert)
 224   {
 225     DEBUG_puts("1cupsMakeServerCredentials: Unable to create self-signed certificate.");
 226     goto cleanup;
 227   }
 228
 229   ident = SecIdentityCreate(kCFAllocatorDefault, cert, privateKey);
 230
 231   if (ident)
 232   {
 233     _cupsMutexLock(&tls_mutex);
 234
 235     if (tls_selfsigned)
 236       CFRelease(ident);
 237     else
 238       tls_selfsigned = ident;
 239
 240     _cupsMutexLock(&tls_mutex);
 241
 242 #  if 0 /* Someday perhaps SecItemCopyMatching will work for identities, at which point  */
 243     CFTypeRef itemKeys[] = { kSecClass, kSecAttrLabel, kSecValueRef };
 244     CFTypeRef itemValues[] = { kSecClassIdentity, cfcommon_name, ident };
 245     CFDictionaryRef itemAttrs = CFDictionaryCreate(kCFAllocatorDefault, itemKeys, itemValues, sizeof(itemKeys) / sizeof(itemKeys[0]), &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
 246
 247     err = SecItemAdd(itemAttrs, NULL);
 248     /* SecItemAdd consumes itemAttrs... */
 249
 250     CFRelease(ident);
 251
 252     if (err != noErr)
 253     {
 254       DEBUG_printf(("1cupsMakeServerCredentials: Unable to add identity to keychain: %d.", (int)err));
 255       goto cleanup;
 256     }
 257 #  endif /* 0 */
 258
 259     status = 1;
 260   }
 261   else
 262     DEBUG_puts("1cupsMakeServerCredentials: Unable to create identity from cert and keys.");
 263
 264   /*
 265    * Cleanup and return...
 266    */
 267
 268 cleanup:
 269
 270   if (cfcommon_name)
 271     CFRelease(cfcommon_name);
 272
 273   if (keyParams)
 274     CFRelease(keyParams);
 275
 276   if (cert)
 277     CFRelease(cert);
 278
 279   if (publicKey)
 280     CFRelease(publicKey);
 281
 282   if (privateKey)
 283     CFRelease(privateKey);
 284
 285   DEBUG_printf(("1cupsMakeServerCredentials: Returning %d.", status));
 286
 287   return (status);
 288
 289 #else /* !TARGET_OS_IOS */
 290   int           pid,                    /* Process ID of command */
 291                 status,                 /* Status of command */
 292                 i;                      /* Looping var */
 293   char          command[1024],          /* Command */
 294                 *argv[5],               /* Command-line arguments */
 295                 *envp[1000],            /* Environment variables */
 296                 days[32],               /* CERTTOOL_EXPIRATION_DAYS env var */
 297                 keychain[1024],         /* Keychain argument */
 298                 infofile[1024],         /* Type-in information for cert */
 299                 filename[1024];         /* Default keychain path */
 300   cups_file_t   *fp;                    /* Seed/info file */
 301
 302
 303   DEBUG_printf(("cupsMakeServerCredentials(path=\"%s\", common_name=\"%s\", num_alt_names=%d, alt_names=%p, expiration_date=%d)", path, common_name, num_alt_names, (void *)alt_names, (int)expiration_date));
 304
 305   (void)num_alt_names;
 306   (void)alt_names;
 307
 308   if (!path)
 309     path = http_cdsa_default_path(filename, sizeof(filename));
 310
 311  /*
 312   * Run the "certtool" command to generate a self-signed certificate...
 313   */
 314
 315   if (!cupsFileFind("certtool", getenv("PATH"), 1, command, sizeof(command)))
 316     return (-1);
 317
 318  /*
 319   * Create a file with the certificate information fields...
 320   *
 321   * Note: This assumes that the default questions are asked by the certtool
 322   * command...
 323   */
 324
 325  if ((fp = cupsTempFile2(infofile, sizeof(infofile))) == NULL)
 326     return (-1);
 327
 328   cupsFilePrintf(fp,
 329                  "CUPS Self-Signed Certificate\n"
 330                                         /* Enter key and certificate label */
 331                  "r\n"                  /* Generate RSA key pair */
 332                  "2048\n"               /* 2048 bit encryption key */
 333                  "y\n"                  /* OK (y = yes) */
 334                  "b\n"                  /* Usage (b=signing/encryption) */
 335                  "2\n"                  /* Sign with SHA256 */
 336                  "y\n"                  /* OK (y = yes) */
 337                  "%s\n"                 /* Common name */
 338                  "\n"                   /* Country (default) */
 339                  "\n"                   /* Organization (default) */
 340                  "\n"                   /* Organizational unit (default) */
 341                  "\n"                   /* State/Province (default) */
 342                  "\n"                   /* Email address */
 343                  "y\n",                 /* OK (y = yes) */
 344                  common_name);
 345   cupsFileClose(fp);
 346
 347   snprintf(keychain, sizeof(keychain), "k=%s", path);
 348
 349   argv[0] = "certtool";
 350   argv[1] = "c";
 351   argv[2] = keychain;
 352   argv[3] = NULL;
 353
 354   snprintf(days, sizeof(days), "CERTTOOL_EXPIRATION_DAYS=%d", (int)((expiration_date - time(NULL) + 86399) / 86400));
 355   envp[0] = days;
 356   for (i = 0; i < (int)(sizeof(envp) / sizeof(envp[0]) - 2) && environ[i]; i ++)
 357     envp[i + 1] = environ[i];
 358   envp[i] = NULL;
 359
 360   posix_spawn_file_actions_t actions;   /* File actions */
 361
 362   posix_spawn_file_actions_init(&actions);
 363   posix_spawn_file_actions_addclose(&actions, 0);
 364   posix_spawn_file_actions_addopen(&actions, 0, infofile, O_RDONLY, 0);
 365   posix_spawn_file_actions_addclose(&actions, 1);
 366   posix_spawn_file_actions_addopen(&actions, 1, "/dev/null", O_WRONLY, 0);
 367   posix_spawn_file_actions_addclose(&actions, 2);
 368   posix_spawn_file_actions_addopen(&actions, 2, "/dev/null", O_WRONLY, 0);
 369
 370   if (posix_spawn(&pid, command, &actions, NULL, argv, envp))
 371   {
 372     unlink(infofile);
 373     return (-1);
 374   }
 375
 376   posix_spawn_file_actions_destroy(&actions);
 377
 378   unlink(infofile);
 379
 380   while (waitpid(pid, &status, 0) < 0)
 381     if (errno != EINTR)
 382     {
 383       status = -1;
 384       break;
 385     }
 386
 387   return (!status);
 388 #endif /* TARGET_OS_IOS */
 389 }
 390
 391
 392 /*
 393  * 'cupsSetServerCredentials()' - Set the default server credentials.
 394  *
 395  * Note: The server credentials are used by all threads in the running process.
 396  * This function is threadsafe.
 397  *
 398  * @since CUPS 2.0/macOS 10.10@
 399  */
 400
 401 int                                     /* O - 1 on success, 0 on failure */
 402 cupsSetServerCredentials(
 403     const char *path,                   /* I - Keychain path or @code NULL@ for default */
 404     const char *common_name,            /* I - Default common name for server */
 405     int        auto_create)             /* I - 1 = automatically create self-signed certificates */
 406 {
 407   DEBUG_printf(("cupsSetServerCredentials(path=\"%s\", common_name=\"%s\", auto_create=%d)", path, common_name, auto_create));
 408
 409 #if TARGET_OS_OSX
 410   char          filename[1024];         /* Keychain filename */
 411   SecKeychainRef keychain = http_cdsa_open_keychain(path, filename, sizeof(filename));
 412
 413   if (!keychain)
 414   {
 415     DEBUG_puts("1cupsSetServerCredentials: Unable to open keychain.");
 416     return (0);
 417   }
 418
 419   _cupsMutexLock(&tls_mutex);
 420
 421  /*
 422   * Close any keychain that is currently open...
 423   */
 424
 425   if (tls_keychain)
 426     CFRelease(tls_keychain);
 427
 428   if (tls_keypath)
 429     _cupsStrFree(tls_keypath);
 430
 431   if (tls_common_name)
 432     _cupsStrFree(tls_common_name);
 433
 434  /*
 435   * Save the new keychain...
 436   */
 437
 438   tls_keychain    = keychain;
 439   tls_keypath     = _cupsStrAlloc(filename);
 440   tls_auto_create = auto_create;
 441   tls_common_name = _cupsStrAlloc(common_name);
 442
 443   _cupsMutexUnlock(&tls_mutex);
 444
 445   DEBUG_puts("1cupsSetServerCredentials: Opened keychain, returning 1.");
 446   return (1);
 447
 448 #else
 449   if (path)
 450   {
 451     DEBUG_puts("1cupsSetServerCredentials: No keychain support compiled in, returning 0.");
 452     return (0);
 453   }
 454
 455   tls_auto_create = auto_create;
 456   tls_common_name = _cupsStrAlloc(common_name);
 457
 458   return (1);
 459 #endif /* TARGET_OS_OSX */
 460 }
 461
 462
 463 /*
 464  * 'httpCopyCredentials()' - Copy the credentials associated with the peer in
 465  *                           an encrypted connection.
 466  *
 467  * @since CUPS 1.5/macOS 10.7@
 468  */
 469
 470 int                                     /* O - Status of call (0 = success) */
 471 httpCopyCredentials(
 472     http_t       *http,                 /* I - Connection to server */
 473     cups_array_t **credentials)         /* O - Array of credentials */
 474 {
 475   OSStatus              error;          /* Error code */
 476   SecTrustRef           peerTrust;      /* Peer trust reference */
 477   CFIndex               count;          /* Number of credentials */
 478   SecCertificateRef     secCert;        /* Certificate reference */
 479   CFDataRef             data;           /* Certificate data */
 480   int                   i;              /* Looping var */
 481
 482
 483   DEBUG_printf(("httpCopyCredentials(http=%p, credentials=%p)", (void *)http, (void *)credentials));
 484
 485   if (credentials)
 486     *credentials = NULL;
 487
 488   if (!http || !http->tls || !credentials)
 489     return (-1);
 490
 491   if (!(error = SSLCopyPeerTrust(http->tls, &peerTrust)) && peerTrust)
 492   {
 493     DEBUG_printf(("2httpCopyCredentials: Peer provided %d certificates.", (int)SecTrustGetCertificateCount(peerTrust)));
 494
 495     if ((*credentials = cupsArrayNew(NULL, NULL)) != NULL)
 496     {
 497       count = SecTrustGetCertificateCount(peerTrust);
 498
 499       for (i = 0; i < count; i ++)
 500       {
 501         secCert = SecTrustGetCertificateAtIndex(peerTrust, i);
 502
 503 #ifdef DEBUG
 504         CFStringRef cf_name = SecCertificateCopySubjectSummary(secCert);
 505         char name[1024];
 506         if (cf_name)
 507           CFStringGetCString(cf_name, name, sizeof(name), kCFStringEncodingUTF8);
 508         else
 509           strlcpy(name, "unknown", sizeof(name));
 510
 511         DEBUG_printf(("2httpCopyCredentials: Certificate %d name is \"%s\".", i, name));
 512 #endif /* DEBUG */
 513
 514         if ((data = SecCertificateCopyData(secCert)) != NULL)
 515         {
 516           DEBUG_printf(("2httpCopyCredentials: Adding %d byte certificate blob.", (int)CFDataGetLength(data)));
 517
 518           httpAddCredential(*credentials, CFDataGetBytePtr(data), (size_t)CFDataGetLength(data));
 519           CFRelease(data);
 520         }
 521       }
 522     }
 523
 524     CFRelease(peerTrust);
 525   }
 526
 527   return (error);
 528 }
 529
 530
 531 /*
 532  * '_httpCreateCredentials()' - Create credentials in the internal format.
 533  */
 534
 535 http_tls_credentials_t                  /* O - Internal credentials */
 536 _httpCreateCredentials(
 537     cups_array_t *credentials)          /* I - Array of credentials */
 538 {
 539   CFMutableArrayRef     peerCerts;      /* Peer credentials reference */
 540   SecCertificateRef     secCert;        /* Certificate reference */
 541   http_credential_t     *credential;    /* Credential data */
 542
 543
 544   if (!credentials)
 545     return (NULL);
 546
 547   if ((peerCerts = CFArrayCreateMutable(kCFAllocatorDefault,
 548                                         cupsArrayCount(credentials),
 549                                         &kCFTypeArrayCallBacks)) == NULL)
 550     return (NULL);
 551
 552   for (credential = (http_credential_t *)cupsArrayFirst(credentials);
 553        credential;
 554        credential = (http_credential_t *)cupsArrayNext(credentials))
 555   {
 556     if ((secCert = http_cdsa_create_credential(credential)) != NULL)
 557     {
 558       CFArrayAppendValue(peerCerts, secCert);
 559       CFRelease(secCert);
 560     }
 561   }
 562
 563   return (peerCerts);
 564 }
 565
 566
 567 /*
 568  * 'httpCredentialsAreValidForName()' - Return whether the credentials are valid for the given name.
 569  *
 570  * @since CUPS 2.0/macOS 10.10@
 571  */
 572
 573 int                                     /* O - 1 if valid, 0 otherwise */
 574 httpCredentialsAreValidForName(
 575     cups_array_t *credentials,          /* I - Credentials */
 576     const char   *common_name)          /* I - Name to check */
 577 {
 578   SecCertificateRef     secCert;        /* Certificate reference */
 579   CFStringRef           cfcert_name = NULL;
 580                                         /* Certificate's common name (CF string) */
 581   char                  cert_name[256]; /* Certificate's common name (C string) */
 582   int                   valid = 1;      /* Valid name? */
 583
 584
 585   if ((secCert = http_cdsa_create_credential((http_credential_t *)cupsArrayFirst(credentials))) == NULL)
 586     return (0);
 587
 588  /*
 589   * Compare the common names...
 590   */
 591
 592   if ((cfcert_name = SecCertificateCopySubjectSummary(secCert)) == NULL)
 593   {
 594    /*
 595     * Can't get common name, cannot be valid...
 596     */
 597
 598     valid = 0;
 599   }
 600   else if (CFStringGetCString(cfcert_name, cert_name, sizeof(cert_name), kCFStringEncodingUTF8) &&
 601            _cups_strcasecmp(common_name, cert_name))
 602   {
 603    /*
 604     * Not an exact match for the common name, check for wildcard certs...
 605     */
 606
 607     const char  *domain = strchr(common_name, '.');
 608                                         /* Domain in common name */
 609
 610     if (strncmp(cert_name, "*.", 2) || !domain || _cups_strcasecmp(domain, cert_name + 1))
 611     {
 612      /*
 613       * Not a wildcard match.
 614       */
 615
 616       /* TODO: Check subject alternate names */
 617       valid = 0;
 618     }
 619   }
 620
 621   if (cfcert_name)
 622     CFRelease(cfcert_name);
 623
 624   CFRelease(secCert);
 625
 626   return (valid);
 627 }
 628
 629
 630 /*
 631  * 'httpCredentialsGetTrust()' - Return the trust of credentials.
 632  *
 633  * @since CUPS 2.0/macOS 10.10@
 634  */
 635
 636 http_trust_t                            /* O - Level of trust */
 637 httpCredentialsGetTrust(
 638     cups_array_t *credentials,          /* I - Credentials */
 639     const char   *common_name)          /* I - Common name for trust lookup */
 640 {
 641   SecCertificateRef     secCert;        /* Certificate reference */
 642   http_trust_t          trust = HTTP_TRUST_OK;
 643                                         /* Trusted? */
 644   cups_array_t          *tcreds = NULL; /* Trusted credentials */
 645   _cups_globals_t       *cg = _cupsGlobals();
 646                                         /* Per-thread globals */
 647
 648
 649   if (!common_name)
 650   {
 651     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("No common name specified."), 1);
 652     return (HTTP_TRUST_UNKNOWN);
 653   }
 654
 655   if ((secCert = http_cdsa_create_credential((http_credential_t *)cupsArrayFirst(credentials))) == NULL)
 656   {
 657     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create credentials from array."), 1);
 658     return (HTTP_TRUST_UNKNOWN);
 659   }
 660
 661   if (cg->any_root < 0)
 662     _cupsSetDefaults();
 663
 664  /*
 665   * Look this common name up in the default keychains...
 666   */
 667
 668   httpLoadCredentials(NULL, &tcreds, common_name);
 669
 670   if (tcreds)
 671   {
 672     char        credentials_str[1024],  /* String for incoming credentials */
 673                 tcreds_str[1024];       /* String for saved credentials */
 674
 675     httpCredentialsString(credentials, credentials_str, sizeof(credentials_str));
 676     httpCredentialsString(tcreds, tcreds_str, sizeof(tcreds_str));
 677
 678     if (strcmp(credentials_str, tcreds_str))
 679     {
 680      /*
 681       * Credentials don't match, let's look at the expiration date of the new
 682       * credentials and allow if the new ones have a later expiration...
 683       */
 684
 685       if (!cg->trust_first)
 686       {
 687        /*
 688         * Do not trust certificates on first use...
 689         */
 690
 691         _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Trust on first use is disabled."), 1);
 692
 693         trust = HTTP_TRUST_INVALID;
 694       }
 695       else if (httpCredentialsGetExpiration(credentials) <= httpCredentialsGetExpiration(tcreds))
 696       {
 697        /*
 698         * The new credentials are not newly issued...
 699         */
 700
 701         _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("New credentials are older than stored credentials."), 1);
 702
 703         trust = HTTP_TRUST_INVALID;
 704       }
 705       else if (!httpCredentialsAreValidForName(credentials, common_name))
 706       {
 707        /*
 708         * The common name does not match the issued certificate...
 709         */
 710
 711         _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("New credentials are not valid for name."), 1);
 712
 713         trust = HTTP_TRUST_INVALID;
 714       }
 715       else if (httpCredentialsGetExpiration(tcreds) < time(NULL))
 716       {
 717        /*
 718         * Save the renewed credentials...
 719         */
 720
 721         trust = HTTP_TRUST_RENEWED;
 722
 723         httpSaveCredentials(NULL, credentials, common_name);
 724       }
 725     }
 726
 727     httpFreeCredentials(tcreds);
 728   }
 729   else if (cg->validate_certs && !httpCredentialsAreValidForName(credentials, common_name))
 730   {
 731     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("No stored credentials, not valid for name."), 1);
 732     trust = HTTP_TRUST_INVALID;
 733   }
 734   else if (!cg->trust_first)
 735   {
 736    /*
 737     * See if we have a site CA certificate we can compare...
 738     */
 739
 740     if (!httpLoadCredentials(NULL, &tcreds, "site"))
 741     {
 742       if (cupsArrayCount(credentials) != (cupsArrayCount(tcreds) + 1))
 743       {
 744        /*
 745         * Certificate isn't directly generated from the CA cert...
 746         */
 747
 748         trust = HTTP_TRUST_INVALID;
 749       }
 750       else
 751       {
 752        /*
 753         * Do a tail comparison of the two certificates...
 754         */
 755
 756         http_credential_t       *a, *b;         /* Certificates */
 757
 758         for (a = (http_credential_t *)cupsArrayFirst(tcreds), b = (http_credential_t *)cupsArrayIndex(credentials, 1);
 759              a && b;
 760              a = (http_credential_t *)cupsArrayNext(tcreds), b = (http_credential_t *)cupsArrayNext(credentials))
 761           if (a->datalen != b->datalen || memcmp(a->data, b->data, a->datalen))
 762             break;
 763
 764         if (a || b)
 765           trust = HTTP_TRUST_INVALID;
 766       }
 767
 768       if (trust != HTTP_TRUST_OK)
 769         _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Credentials do not validate against site CA certificate."), 1);
 770     }
 771     else
 772     {
 773       _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Trust on first use is disabled."), 1);
 774       trust = HTTP_TRUST_INVALID;
 775     }
 776   }
 777
 778   if (trust == HTTP_TRUST_OK && !cg->expired_certs && !SecCertificateIsValid(secCert, CFAbsoluteTimeGetCurrent()))
 779   {
 780     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Credentials have expired."), 1);
 781     trust = HTTP_TRUST_EXPIRED;
 782   }
 783
 784   if (trust == HTTP_TRUST_OK && !cg->any_root && cupsArrayCount(credentials) == 1)
 785   {
 786     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Self-signed credentials are blocked."), 1);
 787     trust = HTTP_TRUST_INVALID;
 788   }
 789
 790   CFRelease(secCert);
 791
 792   return (trust);
 793 }
 794
 795
 796 /*
 797  * 'httpCredentialsGetExpiration()' - Return the expiration date of the credentials.
 798  *
 799  * @since CUPS 2.0/macOS 10.10@
 800  */
 801
 802 time_t                                  /* O - Expiration date of credentials */
 803 httpCredentialsGetExpiration(
 804     cups_array_t *credentials)          /* I - Credentials */
 805 {
 806   SecCertificateRef     secCert;        /* Certificate reference */
 807   time_t                expiration;     /* Expiration date */
 808
 809
 810   if ((secCert = http_cdsa_create_credential((http_credential_t *)cupsArrayFirst(credentials))) == NULL)
 811     return (0);
 812
 813   expiration = (time_t)(SecCertificateNotValidAfter(secCert) + kCFAbsoluteTimeIntervalSince1970);
 814
 815   CFRelease(secCert);
 816
 817   return (expiration);
 818 }
 819
 820
 821 /*
 822  * 'httpCredentialsString()' - Return a string representing the credentials.
 823  *
 824  * @since CUPS 2.0/macOS 10.10@
 825  */
 826
 827 size_t                                  /* O - Total size of credentials string */
 828 httpCredentialsString(
 829     cups_array_t *credentials,          /* I - Credentials */
 830     char         *buffer,               /* I - Buffer or @code NULL@ */
 831     size_t       bufsize)               /* I - Size of buffer */
 832 {
 833   http_credential_t     *first;         /* First certificate */
 834   SecCertificateRef     secCert;        /* Certificate reference */
 835
 836
 837   DEBUG_printf(("httpCredentialsString(credentials=%p, buffer=%p, bufsize=" CUPS_LLFMT ")", (void *)credentials, (void *)buffer, CUPS_LLCAST bufsize));
 838
 839   if (!buffer)
 840     return (0);
 841
 842   if (buffer && bufsize > 0)
 843     *buffer = '\0';
 844
 845   if ((first = (http_credential_t *)cupsArrayFirst(credentials)) != NULL &&
 846       (secCert = http_cdsa_create_credential(first)) != NULL)
 847   {
 848    /*
 849     * Copy certificate (string) values from the SecCertificateRef and produce
 850     * a one-line summary.  The API for accessing certificate values like the
 851     * issuer name is, um, "interesting"...
 852     */
 853
 854 #  if !TARGET_OS_IOS
 855     CFDictionaryRef     cf_dict;        /* Dictionary for certificate */
 856 #  endif /* !TARGET_OS_IOS */
 857     CFStringRef         cf_string;      /* CF string */
 858     char                commonName[256],/* Common name associated with cert */
 859                         issuer[256],    /* Issuer name */
 860                         sigalg[256];    /* Signature algorithm */
 861     time_t              expiration;     /* Expiration date of cert */
 862     unsigned char       md5_digest[16]; /* MD5 result */
 863
 864     if (SecCertificateCopyCommonName(secCert, &cf_string) == noErr)
 865     {
 866       CFStringGetCString(cf_string, commonName, (CFIndex)sizeof(commonName), kCFStringEncodingUTF8);
 867       CFRelease(cf_string);
 868     }
 869     else
 870     {
 871       strlcpy(commonName, "unknown", sizeof(commonName));
 872     }
 873
 874     strlcpy(issuer, "unknown", sizeof(issuer));
 875     strlcpy(sigalg, "UnknownSignature", sizeof(sigalg));
 876
 877 #  if !TARGET_OS_IOS
 878     if ((cf_dict = SecCertificateCopyValues(secCert, NULL, NULL)) != NULL)
 879     {
 880       CFDictionaryRef cf_issuer = CFDictionaryGetValue(cf_dict, kSecOIDX509V1IssuerName);
 881       CFDictionaryRef cf_sigalg = CFDictionaryGetValue(cf_dict, kSecOIDX509V1SignatureAlgorithm);
 882
 883       if (cf_issuer)
 884       {
 885         CFArrayRef cf_values = CFDictionaryGetValue(cf_issuer, kSecPropertyKeyValue);
 886         CFIndex i, count = CFArrayGetCount(cf_values);
 887         CFDictionaryRef cf_value;
 888
 889         for (i = 0; i < count; i ++)
 890         {
 891           cf_value = CFArrayGetValueAtIndex(cf_values, i);
 892
 893           if (!CFStringCompare(CFDictionaryGetValue(cf_value, kSecPropertyKeyLabel), kSecOIDOrganizationName, kCFCompareCaseInsensitive))
 894             CFStringGetCString(CFDictionaryGetValue(cf_value, kSecPropertyKeyValue), issuer, (CFIndex)sizeof(issuer), kCFStringEncodingUTF8);
 895         }
 896       }
 897
 898       if (cf_sigalg)
 899       {
 900         CFArrayRef cf_values = CFDictionaryGetValue(cf_sigalg, kSecPropertyKeyValue);
 901         CFIndex i, count = CFArrayGetCount(cf_values);
 902         CFDictionaryRef cf_value;
 903
 904         for (i = 0; i < count; i ++)
 905         {
 906           cf_value = CFArrayGetValueAtIndex(cf_values, i);
 907
 908           if (!CFStringCompare(CFDictionaryGetValue(cf_value, kSecPropertyKeyLabel), CFSTR("Algorithm"), kCFCompareCaseInsensitive))
 909           {
 910             CFStringRef cf_algorithm = CFDictionaryGetValue(cf_value, kSecPropertyKeyValue);
 911
 912             if (!CFStringCompare(cf_algorithm, CFSTR("1.2.840.113549.1.1.5"), kCFCompareCaseInsensitive))
 913               strlcpy(sigalg, "SHA1WithRSAEncryption", sizeof(sigalg));
 914             else if (!CFStringCompare(cf_algorithm, CFSTR("1.2.840.113549.1.1.11"), kCFCompareCaseInsensitive))
 915               strlcpy(sigalg, "SHA256WithRSAEncryption", sizeof(sigalg));
 916             else if (!CFStringCompare(cf_algorithm, CFSTR("1.2.840.113549.1.1.4"), kCFCompareCaseInsensitive))
 917               strlcpy(sigalg, "MD5WithRSAEncryption", sizeof(sigalg));
 918           }
 919         }
 920       }
 921
 922       CFRelease(cf_dict);
 923     }
 924 #  endif /* !TARGET_OS_IOS */
 925
 926     expiration = (time_t)(SecCertificateNotValidAfter(secCert) + kCFAbsoluteTimeIntervalSince1970);
 927
 928     cupsHashData("md5", first->data, first->datalen, md5_digest, sizeof(md5_digest));
 929
 930     snprintf(buffer, bufsize, "%s (issued by %s) / %s / %s / %02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X", commonName, issuer, httpGetDateString(expiration), sigalg, md5_digest[0], md5_digest[1], md5_digest[2], md5_digest[3], md5_digest[4], md5_digest[5], md5_digest[6], md5_digest[7], md5_digest[8], md5_digest[9], md5_digest[10], md5_digest[11], md5_digest[12], md5_digest[13], md5_digest[14], md5_digest[15]);
 931
 932     CFRelease(secCert);
 933   }
 934
 935   DEBUG_printf(("1httpCredentialsString: Returning \"%s\".", buffer));
 936
 937   return (strlen(buffer));
 938 }
 939
 940
 941 /*
 942  * '_httpFreeCredentials()' - Free internal credentials.
 943  */
 944
 945 void
 946 _httpFreeCredentials(
 947     http_tls_credentials_t credentials) /* I - Internal credentials */
 948 {
 949   if (!credentials)
 950     return;
 951
 952   CFRelease(credentials);
 953 }
 954
 955
 956 /*
 957  * 'httpLoadCredentials()' - Load X.509 credentials from a keychain file.
 958  *
 959  * @since CUPS 2.0/OS 10.10@
 960  */
 961
 962 int                                     /* O - 0 on success, -1 on error */
 963 httpLoadCredentials(
 964     const char   *path,                 /* I  - Keychain path or @code NULL@ for default */
 965     cups_array_t **credentials,         /* IO - Credentials */
 966     const char   *common_name)          /* I  - Common name for credentials */
 967 {
 968   OSStatus              err;            /* Error info */
 969 #if TARGET_OS_OSX
 970   char                  filename[1024]; /* Filename for keychain */
 971   SecKeychainRef        keychain = NULL,/* Keychain reference */
 972                         syschain = NULL;/* System keychain */
 973   CFArrayRef            list;           /* Keychain list */
 974 #endif /* TARGET_OS_OSX */
 975   SecCertificateRef     cert = NULL;    /* Certificate */
 976   CFDataRef             data;           /* Certificate data */
 977   SecPolicyRef          policy = NULL;  /* Policy ref */
 978   CFStringRef           cfcommon_name = NULL;
 979                                         /* Server name */
 980   CFMutableDictionaryRef query = NULL;  /* Query qualifiers */
 981
 982
 983   DEBUG_printf(("httpLoadCredentials(path=\"%s\", credentials=%p, common_name=\"%s\")", path, (void *)credentials, common_name));
 984
 985   if (!credentials)
 986     return (-1);
 987
 988   *credentials = NULL;
 989
 990 #if TARGET_OS_OSX
 991   keychain = http_cdsa_open_keychain(path, filename, sizeof(filename));
 992
 993   if (!keychain)
 994     goto cleanup;
 995
 996   syschain = http_cdsa_open_system_keychain();
 997
 998 #else
 999   if (path)
1000     return (-1);
1001 #endif /* TARGET_OS_OSX */
1002
1003   cfcommon_name = CFStringCreateWithCString(kCFAllocatorDefault, common_name, kCFStringEncodingUTF8);
1004
1005   policy = SecPolicyCreateSSL(1, cfcommon_name);
1006
1007   if (cfcommon_name)
1008     CFRelease(cfcommon_name);
1009
1010   if (!policy)
1011     goto cleanup;
1012
1013   if (!(query = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks)))
1014     goto cleanup;
1015
1016   CFDictionaryAddValue(query, kSecClass, kSecClassCertificate);
1017   CFDictionaryAddValue(query, kSecMatchPolicy, policy);
1018   CFDictionaryAddValue(query, kSecReturnRef, kCFBooleanTrue);
1019   CFDictionaryAddValue(query, kSecMatchLimit, kSecMatchLimitOne);
1020
1021 #if TARGET_OS_OSX
1022   if (syschain)
1023   {
1024     const void *values[2] = { syschain, keychain };
1025
1026     list = CFArrayCreate(kCFAllocatorDefault, (const void **)values, 2, &kCFTypeArrayCallBacks);
1027   }
1028   else
1029     list = CFArrayCreate(kCFAllocatorDefault, (const void **)&keychain, 1, &kCFTypeArrayCallBacks);
1030   CFDictionaryAddValue(query, kSecMatchSearchList, list);
1031   CFRelease(list);
1032 #endif /* TARGET_OS_OSX */
1033
1034   err = SecItemCopyMatching(query, (CFTypeRef *)&cert);
1035
1036   if (err)
1037     goto cleanup;
1038
1039   if (CFGetTypeID(cert) != SecCertificateGetTypeID())
1040     goto cleanup;
1041
1042   if ((data = SecCertificateCopyData(cert)) != NULL)
1043   {
1044     DEBUG_printf(("1httpLoadCredentials: Adding %d byte certificate blob.", (int)CFDataGetLength(data)));
1045
1046     *credentials = cupsArrayNew(NULL, NULL);
1047     httpAddCredential(*credentials, CFDataGetBytePtr(data), (size_t)CFDataGetLength(data));
1048     CFRelease(data);
1049   }
1050
1051   cleanup :
1052
1053 #if TARGET_OS_OSX
1054   if (keychain)
1055     CFRelease(keychain);
1056
1057   if (syschain)
1058     CFRelease(syschain);
1059 #endif /* TARGET_OS_OSX */
1060   if (cert)
1061     CFRelease(cert);
1062   if (policy)
1063     CFRelease(policy);
1064   if (query)
1065     CFRelease(query);
1066
1067   DEBUG_printf(("1httpLoadCredentials: Returning %d.", *credentials ? 0 : -1));
1068
1069   return (*credentials ? 0 : -1);
1070 }
1071
1072
1073 /*
1074  * 'httpSaveCredentials()' - Save X.509 credentials to a keychain file.
1075  *
1076  * @since CUPS 2.0/OS 10.10@
1077  */
1078
1079 int                                     /* O - -1 on error, 0 on success */
1080 httpSaveCredentials(
1081     const char   *path,                 /* I - Keychain path or @code NULL@ for default */
1082     cups_array_t *credentials,          /* I - Credentials */
1083     const char   *common_name)          /* I - Common name for credentials */
1084 {
1085   int                   ret = -1;       /* Return value */
1086   OSStatus              err;            /* Error info */
1087 #if TARGET_OS_OSX
1088   char                  filename[1024]; /* Filename for keychain */
1089   SecKeychainRef        keychain = NULL;/* Keychain reference */
1090   CFArrayRef            list;           /* Keychain list */
1091 #endif /* TARGET_OS_OSX */
1092   SecCertificateRef     cert = NULL;    /* Certificate */
1093   CFMutableDictionaryRef attrs = NULL;  /* Attributes for add */
1094
1095
1096   DEBUG_printf(("httpSaveCredentials(path=\"%s\", credentials=%p, common_name=\"%s\")", path, (void *)credentials, common_name));
1097   if (!credentials)
1098     goto cleanup;
1099
1100   if (!httpCredentialsAreValidForName(credentials, common_name))
1101   {
1102     DEBUG_puts("1httpSaveCredentials: Common name does not match.");
1103     return (-1);
1104   }
1105
1106   if ((cert = http_cdsa_create_credential((http_credential_t *)cupsArrayFirst(credentials))) == NULL)
1107   {
1108     DEBUG_puts("1httpSaveCredentials: Unable to create certificate.");
1109     goto cleanup;
1110   }
1111
1112 #if TARGET_OS_OSX
1113   keychain = http_cdsa_open_keychain(path, filename, sizeof(filename));
1114
1115   if (!keychain)
1116     goto cleanup;
1117
1118 #else
1119   if (path)
1120     return (-1);
1121 #endif /* TARGET_OS_OSX */
1122
1123   if ((attrs = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks)) == NULL)
1124   {
1125     DEBUG_puts("1httpSaveCredentials: Unable to create dictionary.");
1126     goto cleanup;
1127   }
1128
1129   CFDictionaryAddValue(attrs, kSecClass, kSecClassCertificate);
1130   CFDictionaryAddValue(attrs, kSecValueRef, cert);
1131
1132 #if TARGET_OS_OSX
1133   if ((list = CFArrayCreate(kCFAllocatorDefault, (const void **)&keychain, 1, &kCFTypeArrayCallBacks)) == NULL)
1134   {
1135     DEBUG_puts("1httpSaveCredentials: Unable to create list of keychains.");
1136     goto cleanup;
1137   }
1138   CFDictionaryAddValue(attrs, kSecMatchSearchList, list);
1139   CFRelease(list);
1140 #endif /* TARGET_OS_OSX */
1141
1142   /* Note: SecItemAdd consumes "attrs"... */
1143   err = SecItemAdd(attrs, NULL);
1144   DEBUG_printf(("1httpSaveCredentials: SecItemAdd returned %d.", (int)err));
1145
1146   cleanup :
1147
1148 #if TARGET_OS_OSX
1149   if (keychain)
1150     CFRelease(keychain);
1151 #endif /* TARGET_OS_OSX */
1152   if (cert)
1153     CFRelease(cert);
1154
1155   DEBUG_printf(("1httpSaveCredentials: Returning %d.", ret));
1156
1157   return (ret);
1158 }
1159
1160
1161 /*
1162  * '_httpTLSInitialize()' - Initialize the TLS stack.
1163  */
1164
1165 void
1166 _httpTLSInitialize(void)
1167 {
1168  /*
1169   * Nothing to do...
1170   */
1171 }
1172
1173
1174 /*
1175  * '_httpTLSPending()' - Return the number of pending TLS-encrypted bytes.
1176  */
1177
1178 size_t
1179 _httpTLSPending(http_t *http)           /* I - HTTP connection */
1180 {
1181   size_t bytes;                         /* Bytes that are available */
1182
1183
1184   if (!SSLGetBufferedReadSize(http->tls, &bytes))
1185     return (bytes);
1186
1187   return (0);
1188 }
1189
1190
1191 /*
1192  * '_httpTLSRead()' - Read from a SSL/TLS connection.
1193  */
1194
1195 int                                     /* O - Bytes read */
1196 _httpTLSRead(http_t *http,              /* I - HTTP connection */
1197               char   *buf,              /* I - Buffer to store data */
1198               int    len)               /* I - Length of buffer */
1199 {
1200   int           result;                 /* Return value */
1201   OSStatus      error;                  /* Error info */
1202   size_t        processed;              /* Number of bytes processed */
1203
1204
1205   error = SSLRead(http->tls, buf, (size_t)len, &processed);
1206   DEBUG_printf(("6_httpTLSRead: error=%d, processed=%d", (int)error,
1207                 (int)processed));
1208   switch (error)
1209   {
1210     case 0 :
1211         result = (int)processed;
1212         break;
1213
1214     case errSSLWouldBlock :
1215         if (processed)
1216           result = (int)processed;
1217         else
1218         {
1219           result = -1;
1220           errno  = EINTR;
1221         }
1222         break;
1223
1224     case errSSLClosedGraceful :
1225     default :
1226         if (processed)
1227           result = (int)processed;
1228         else
1229         {
1230           result = -1;
1231           errno  = EPIPE;
1232         }
1233         break;
1234   }
1235
1236   return (result);
1237 }
1238
1239
1240 /*
1241  * '_httpTLSSetOptions()' - Set TLS protocol and cipher suite options.
1242  */
1243
1244 void
1245 _httpTLSSetOptions(int options,         /* I - Options */
1246                    int min_version,     /* I - Minimum TLS version */
1247                    int max_version)     /* I - Maximum TLS version */
1248 {
1249   if (!(options & _HTTP_TLS_SET_DEFAULT) || tls_options < 0)
1250   {
1251     tls_options     = options;
1252     tls_min_version = min_version;
1253     tls_max_version = max_version;
1254   }
1255 }
1256
1257
1258 /*
1259  * '_httpTLSStart()' - Set up SSL/TLS support on a connection.
1260  */
1261
1262 int                                     /* O - 0 on success, -1 on failure */
1263 _httpTLSStart(http_t *http)             /* I - HTTP connection */
1264 {
1265   char                  hostname[256],  /* Hostname */
1266                         *hostptr;       /* Pointer into hostname */
1267   _cups_globals_t       *cg = _cupsGlobals();
1268                                         /* Pointer to library globals */
1269   OSStatus              error;          /* Error code */
1270   const char            *message = NULL;/* Error message */
1271   char                  msgbuf[1024];   /* Error message buffer */
1272   cups_array_t          *credentials;   /* Credentials array */
1273   cups_array_t          *names;         /* CUPS distinguished names */
1274   CFArrayRef            dn_array;       /* CF distinguished names array */
1275   CFIndex               count;          /* Number of credentials */
1276   CFDataRef             data;           /* Certificate data */
1277   int                   i;              /* Looping var */
1278   http_credential_t     *credential;    /* Credential data */
1279
1280
1281   DEBUG_printf(("3_httpTLSStart(http=%p)", (void *)http));
1282
1283   if (tls_options < 0)
1284   {
1285     DEBUG_puts("4_httpTLSStart: Setting defaults.");
1286     _cupsSetDefaults();
1287     DEBUG_printf(("4_httpTLSStart: tls_options=%x, tls_min_version=%d, tls_max_version=%d", tls_options, tls_min_version, tls_max_version));
1288   }
1289
1290 #if TARGET_OS_OSX
1291   if (http->mode == _HTTP_MODE_SERVER && !tls_keychain)
1292   {
1293     DEBUG_puts("4_httpTLSStart: cupsSetServerCredentials not called.");
1294     http->error  = errno = EINVAL;
1295     http->status = HTTP_STATUS_ERROR;
1296     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Server credentials not set."), 1);
1297
1298     return (-1);
1299   }
1300 #endif /* TARGET_OS_OSX */
1301
1302   if ((http->tls = SSLCreateContext(kCFAllocatorDefault, http->mode == _HTTP_MODE_CLIENT ? kSSLClientSide : kSSLServerSide, kSSLStreamType)) == NULL)
1303   {
1304     DEBUG_puts("4_httpTLSStart: SSLCreateContext failed.");
1305     http->error  = errno = ENOMEM;
1306     http->status = HTTP_STATUS_ERROR;
1307     _cupsSetHTTPError(HTTP_STATUS_ERROR);
1308
1309     return (-1);
1310   }
1311
1312   error = SSLSetConnection(http->tls, http);
1313   DEBUG_printf(("4_httpTLSStart: SSLSetConnection, error=%d", (int)error));
1314
1315   if (!error)
1316   {
1317     error = SSLSetIOFuncs(http->tls, http_cdsa_read, http_cdsa_write);
1318     DEBUG_printf(("4_httpTLSStart: SSLSetIOFuncs, error=%d", (int)error));
1319   }
1320
1321   if (!error)
1322   {
1323     error = SSLSetSessionOption(http->tls, kSSLSessionOptionBreakOnServerAuth,
1324                                 true);
1325     DEBUG_printf(("4_httpTLSStart: SSLSetSessionOption, error=%d", (int)error));
1326   }
1327
1328   if (!error)
1329   {
1330     static const SSLProtocol protocols[] =      /* Min/max protocol versions */
1331     {
1332       kSSLProtocol3,
1333       kTLSProtocol1,
1334       kTLSProtocol11,
1335       kTLSProtocol12,
1336       kTLSProtocol13
1337     };
1338
1339     if (tls_min_version < _HTTP_TLS_MAX)
1340     {
1341       error = SSLSetProtocolVersionMin(http->tls, protocols[tls_min_version]);
1342       DEBUG_printf(("4_httpTLSStart: SSLSetProtocolVersionMin(%d), error=%d", protocols[tls_min_version], (int)error));
1343     }
1344
1345     if (!error && tls_max_version < _HTTP_TLS_MAX)
1346     {
1347       error = SSLSetProtocolVersionMax(http->tls, protocols[tls_max_version]);
1348       DEBUG_printf(("4_httpTLSStart: SSLSetProtocolVersionMax(%d), error=%d", protocols[tls_max_version], (int)error));
1349     }
1350   }
1351
1352   if (!error)
1353   {
1354     SSLCipherSuite      supported[100]; /* Supported cipher suites */
1355     size_t              num_supported;  /* Number of supported cipher suites */
1356     SSLCipherSuite      enabled[100];   /* Cipher suites to enable */
1357     size_t              num_enabled;    /* Number of cipher suites to enable */
1358
1359     num_supported = sizeof(supported) / sizeof(supported[0]);
1360     error         = SSLGetSupportedCiphers(http->tls, supported, &num_supported);
1361
1362     if (!error)
1363     {
1364       DEBUG_printf(("4_httpTLSStart: %d cipher suites supported.", (int)num_supported));
1365
1366       for (i = 0, num_enabled = 0; i < (int)num_supported && num_enabled < (sizeof(enabled) / sizeof(enabled[0])); i ++)
1367       {
1368         switch (supported[i])
1369         {
1370           /* Obviously insecure cipher suites that we never want to use */
1371           case SSL_NULL_WITH_NULL_NULL :
1372           case SSL_RSA_WITH_NULL_MD5 :
1373           case SSL_RSA_WITH_NULL_SHA :
1374           case SSL_RSA_EXPORT_WITH_RC4_40_MD5 :
1375           case SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5 :
1376           case SSL_RSA_EXPORT_WITH_DES40_CBC_SHA :
1377           case SSL_RSA_WITH_DES_CBC_SHA :
1378           case SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA :
1379           case SSL_DH_DSS_WITH_DES_CBC_SHA :
1380           case SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA :
1381           case SSL_DH_RSA_WITH_DES_CBC_SHA :
1382           case SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA :
1383           case SSL_DHE_DSS_WITH_DES_CBC_SHA :
1384           case SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA :
1385           case SSL_DHE_RSA_WITH_DES_CBC_SHA :
1386           case SSL_DH_anon_EXPORT_WITH_RC4_40_MD5 :
1387           case SSL_DH_anon_WITH_RC4_128_MD5 :
1388           case SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA :
1389           case SSL_DH_anon_WITH_DES_CBC_SHA :
1390           case SSL_DH_anon_WITH_3DES_EDE_CBC_SHA :
1391           case SSL_FORTEZZA_DMS_WITH_NULL_SHA :
1392           case TLS_DH_anon_WITH_AES_128_CBC_SHA :
1393           case TLS_DH_anon_WITH_AES_256_CBC_SHA :
1394           case TLS_ECDH_ECDSA_WITH_NULL_SHA :
1395           case TLS_ECDHE_RSA_WITH_NULL_SHA :
1396           case TLS_ECDH_anon_WITH_NULL_SHA :
1397           case TLS_ECDH_anon_WITH_RC4_128_SHA :
1398           case TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA :
1399           case TLS_ECDH_anon_WITH_AES_128_CBC_SHA :
1400           case TLS_ECDH_anon_WITH_AES_256_CBC_SHA :
1401           case TLS_RSA_WITH_NULL_SHA256 :
1402           case TLS_DH_anon_WITH_AES_128_CBC_SHA256 :
1403           case TLS_DH_anon_WITH_AES_256_CBC_SHA256 :
1404           case TLS_PSK_WITH_NULL_SHA :
1405           case TLS_DHE_PSK_WITH_NULL_SHA :
1406           case TLS_RSA_PSK_WITH_NULL_SHA :
1407           case TLS_DH_anon_WITH_AES_128_GCM_SHA256 :
1408           case TLS_DH_anon_WITH_AES_256_GCM_SHA384 :
1409           case TLS_PSK_WITH_NULL_SHA256 :
1410           case TLS_PSK_WITH_NULL_SHA384 :
1411           case TLS_DHE_PSK_WITH_NULL_SHA256 :
1412           case TLS_DHE_PSK_WITH_NULL_SHA384 :
1413           case TLS_RSA_PSK_WITH_NULL_SHA256 :
1414           case TLS_RSA_PSK_WITH_NULL_SHA384 :
1415           case SSL_RSA_WITH_DES_CBC_MD5 :
1416               DEBUG_printf(("4_httpTLSStart: Excluding insecure cipher suite %d", supported[i]));
1417               break;
1418
1419           /* RC4 cipher suites that should only be used as a last resort */
1420           case SSL_RSA_WITH_RC4_128_MD5 :
1421           case SSL_RSA_WITH_RC4_128_SHA :
1422           case TLS_ECDH_ECDSA_WITH_RC4_128_SHA :
1423           case TLS_ECDHE_ECDSA_WITH_RC4_128_SHA :
1424           case TLS_ECDH_RSA_WITH_RC4_128_SHA :
1425           case TLS_ECDHE_RSA_WITH_RC4_128_SHA :
1426           case TLS_PSK_WITH_RC4_128_SHA :
1427           case TLS_DHE_PSK_WITH_RC4_128_SHA :
1428           case TLS_RSA_PSK_WITH_RC4_128_SHA :
1429               if (tls_options & _HTTP_TLS_ALLOW_RC4)
1430                 enabled[num_enabled ++] = supported[i];
1431               else
1432                 DEBUG_printf(("4_httpTLSStart: Excluding RC4 cipher suite %d", supported[i]));
1433               break;
1434
1435           /* DH/DHE cipher suites that are problematic with parameters < 1024 bits */
1436           case TLS_DH_DSS_WITH_AES_128_CBC_SHA :
1437           case TLS_DH_RSA_WITH_AES_128_CBC_SHA :
1438           case TLS_DHE_DSS_WITH_AES_128_CBC_SHA :
1439           case TLS_DHE_RSA_WITH_AES_128_CBC_SHA :
1440           case TLS_DH_DSS_WITH_AES_256_CBC_SHA :
1441           case TLS_DH_RSA_WITH_AES_256_CBC_SHA :
1442           case TLS_DHE_DSS_WITH_AES_256_CBC_SHA :
1443           case TLS_DHE_RSA_WITH_AES_256_CBC_SHA :
1444           case TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA :
1445           case TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA :
1446           case TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA :
1447           case TLS_DH_DSS_WITH_AES_128_CBC_SHA256 :
1448           case TLS_DH_RSA_WITH_AES_128_CBC_SHA256 :
1449           case TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 :
1450           case TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 :
1451           case TLS_DH_DSS_WITH_AES_256_CBC_SHA256 :
1452           case TLS_DH_RSA_WITH_AES_256_CBC_SHA256 :
1453           case TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 :
1454           case TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 :
1455           case TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA :
1456           case TLS_DHE_PSK_WITH_AES_128_CBC_SHA :
1457           case TLS_DHE_PSK_WITH_AES_256_CBC_SHA :
1458           case TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 :
1459           case TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 :
1460               if (tls_options & _HTTP_TLS_DENY_CBC)
1461               {
1462                 DEBUG_printf(("4_httpTLSStart: Excluding CBC cipher suite %d", supported[i]));
1463                 break;
1464               }
1465
1466 //          case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 :
1467 //          case TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 :
1468           case TLS_DH_RSA_WITH_AES_128_GCM_SHA256 :
1469           case TLS_DH_RSA_WITH_AES_256_GCM_SHA384 :
1470 //          case TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 :
1471 //          case TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 :
1472           case TLS_DH_DSS_WITH_AES_128_GCM_SHA256 :
1473           case TLS_DH_DSS_WITH_AES_256_GCM_SHA384 :
1474           case TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 :
1475           case TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 :
1476               if (tls_options & _HTTP_TLS_ALLOW_DH)
1477                 enabled[num_enabled ++] = supported[i];
1478               else
1479                 DEBUG_printf(("4_httpTLSStart: Excluding DH/DHE cipher suite %d", supported[i]));
1480               break;
1481
1482           case TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA :
1483           case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 :
1484           case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 :
1485           case TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 :
1486           case TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 :
1487           case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 :
1488           case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 :
1489           case TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 :
1490           case TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 :
1491           case TLS_RSA_WITH_3DES_EDE_CBC_SHA :
1492           case TLS_RSA_WITH_AES_128_CBC_SHA :
1493           case TLS_RSA_WITH_AES_256_CBC_SHA :
1494               if (tls_options & _HTTP_TLS_DENY_CBC)
1495               {
1496                 DEBUG_printf(("4_httpTLSStart: Excluding CBC cipher suite %d", supported[i]));
1497                 break;
1498               }
1499
1500           /* Anything else we'll assume is "secure" */
1501           default :
1502               enabled[num_enabled ++] = supported[i];
1503               break;
1504         }
1505       }
1506
1507       DEBUG_printf(("4_httpTLSStart: %d cipher suites enabled.", (int)num_enabled));
1508       error = SSLSetEnabledCiphers(http->tls, enabled, num_enabled);
1509     }
1510   }
1511
1512   if (!error && http->mode == _HTTP_MODE_CLIENT)
1513   {
1514    /*
1515     * Client: set client-side credentials, if any...
1516     */
1517
1518     if (cg->client_cert_cb)
1519     {
1520       error = SSLSetSessionOption(http->tls,
1521                                   kSSLSessionOptionBreakOnCertRequested, true);
1522       DEBUG_printf(("4_httpTLSStart: kSSLSessionOptionBreakOnCertRequested, "
1523                     "error=%d", (int)error));
1524     }
1525     else
1526     {
1527       error = http_cdsa_set_credentials(http);
1528       DEBUG_printf(("4_httpTLSStart: http_cdsa_set_credentials, error=%d",
1529                     (int)error));
1530     }
1531   }
1532   else if (!error)
1533   {
1534    /*
1535     * Server: find/create a certificate for TLS...
1536     */
1537
1538     if (http->fields[HTTP_FIELD_HOST])
1539     {
1540      /*
1541       * Use hostname for TLS upgrade...
1542       */
1543
1544       strlcpy(hostname, http->fields[HTTP_FIELD_HOST], sizeof(hostname));
1545     }
1546     else
1547     {
1548      /*
1549       * Resolve hostname from connection address...
1550       */
1551
1552       http_addr_t       addr;           /* Connection address */
1553       socklen_t         addrlen;        /* Length of address */
1554
1555       addrlen = sizeof(addr);
1556       if (getsockname(http->fd, (struct sockaddr *)&addr, &addrlen))
1557       {
1558         DEBUG_printf(("4_httpTLSStart: Unable to get socket address: %s", strerror(errno)));
1559         hostname[0] = '\0';
1560       }
1561       else if (httpAddrLocalhost(&addr))
1562         hostname[0] = '\0';
1563       else
1564       {
1565         httpAddrLookup(&addr, hostname, sizeof(hostname));
1566         DEBUG_printf(("4_httpTLSStart: Resolved socket address to \"%s\".", hostname));
1567       }
1568     }
1569
1570     if (isdigit(hostname[0] & 255) || hostname[0] == '[')
1571       hostname[0] = '\0';               /* Don't allow numeric addresses */
1572
1573     if (hostname[0])
1574       http->tls_credentials = http_cdsa_copy_server(hostname);
1575     else if (tls_common_name)
1576       http->tls_credentials = http_cdsa_copy_server(tls_common_name);
1577
1578     if (!http->tls_credentials && tls_auto_create && (hostname[0] || tls_common_name))
1579     {
1580       DEBUG_printf(("4_httpTLSStart: Auto-create credentials for \"%s\".", hostname[0] ? hostname : tls_common_name));
1581
1582       if (!cupsMakeServerCredentials(tls_keypath, hostname[0] ? hostname : tls_common_name, 0, NULL, time(NULL) + 365 * 86400))
1583       {
1584         DEBUG_puts("4_httpTLSStart: cupsMakeServerCredentials failed.");
1585         http->error  = errno = EINVAL;
1586         http->status = HTTP_STATUS_ERROR;
1587         _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create server credentials."), 1);
1588
1589         return (-1);
1590       }
1591
1592       http->tls_credentials = http_cdsa_copy_server(hostname[0] ? hostname : tls_common_name);
1593     }
1594
1595     if (!http->tls_credentials)
1596     {
1597       DEBUG_puts("4_httpTLSStart: Unable to find server credentials.");
1598       http->error  = errno = EINVAL;
1599       http->status = HTTP_STATUS_ERROR;
1600       _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to find server credentials."), 1);
1601
1602       return (-1);
1603     }
1604
1605     error = SSLSetCertificate(http->tls, http->tls_credentials);
1606
1607     DEBUG_printf(("4_httpTLSStart: SSLSetCertificate, error=%d", (int)error));
1608   }
1609
1610   DEBUG_printf(("4_httpTLSStart: tls_credentials=%p", (void *)http->tls_credentials));
1611
1612  /*
1613   * Let the server know which hostname/domain we are trying to connect to
1614   * in case it wants to serve up a certificate with a matching common name.
1615   */
1616
1617   if (!error && http->mode == _HTTP_MODE_CLIENT)
1618   {
1619    /*
1620     * Client: get the hostname to use for TLS...
1621     */
1622
1623     if (httpAddrLocalhost(http->hostaddr))
1624     {
1625       strlcpy(hostname, "localhost", sizeof(hostname));
1626     }
1627     else
1628     {
1629      /*
1630       * Otherwise make sure the hostname we have does not end in a trailing dot.
1631       */
1632
1633       strlcpy(hostname, http->hostname, sizeof(hostname));
1634       if ((hostptr = hostname + strlen(hostname) - 1) >= hostname &&
1635           *hostptr == '.')
1636         *hostptr = '\0';
1637     }
1638
1639     error = SSLSetPeerDomainName(http->tls, hostname, strlen(hostname));
1640
1641     DEBUG_printf(("4_httpTLSStart: SSLSetPeerDomainName, error=%d", (int)error));
1642   }
1643
1644   if (!error)
1645   {
1646     int                 done = 0;       /* Are we done yet? */
1647     double              old_timeout;    /* Old timeout value */
1648     http_timeout_cb_t   old_cb;         /* Old timeout callback */
1649     void                *old_data;      /* Old timeout data */
1650
1651    /*
1652     * Enforce a minimum timeout of 10 seconds for the TLS handshake...
1653     */
1654
1655     old_timeout  = http->timeout_value;
1656     old_cb       = http->timeout_cb;
1657     old_data     = http->timeout_data;
1658
1659     if (!old_cb || old_timeout < 10.0)
1660     {
1661       DEBUG_puts("4_httpTLSStart: Setting timeout to 10 seconds.");
1662       httpSetTimeout(http, 10.0, NULL, NULL);
1663     }
1664
1665    /*
1666     * Do the TLS handshake...
1667     */
1668
1669     while (!error && !done)
1670     {
1671       error = SSLHandshake(http->tls);
1672
1673       DEBUG_printf(("4_httpTLSStart: SSLHandshake returned %d.", (int)error));
1674
1675       switch (error)
1676       {
1677         case noErr :
1678             done = 1;
1679             break;
1680
1681         case errSSLWouldBlock :
1682             error = noErr;              /* Force a retry */
1683             usleep(1000);               /* in 1 millisecond */
1684             break;
1685
1686         case errSSLServerAuthCompleted :
1687             error = 0;
1688             if (cg->server_cert_cb)
1689             {
1690               error = httpCopyCredentials(http, &credentials);
1691               if (!error)
1692               {
1693                 error = (cg->server_cert_cb)(http, http->tls, credentials,
1694                                              cg->server_cert_data);
1695                 httpFreeCredentials(credentials);
1696               }
1697
1698               DEBUG_printf(("4_httpTLSStart: Server certificate callback "
1699                             "returned %d.", (int)error));
1700             }
1701             break;
1702
1703         case errSSLClientCertRequested :
1704             error = 0;
1705
1706             if (cg->client_cert_cb)
1707             {
1708               names = NULL;
1709               if (!(error = SSLCopyDistinguishedNames(http->tls, &dn_array)) &&
1710                   dn_array)
1711               {
1712                 if ((names = cupsArrayNew(NULL, NULL)) != NULL)
1713                 {
1714                   for (i = 0, count = CFArrayGetCount(dn_array); i < count; i++)
1715                   {
1716                     data = (CFDataRef)CFArrayGetValueAtIndex(dn_array, i);
1717
1718                     if ((credential = malloc(sizeof(*credential))) != NULL)
1719                     {
1720                       credential->datalen = (size_t)CFDataGetLength(data);
1721                       if ((credential->data = malloc(credential->datalen)))
1722                       {
1723                         memcpy((void *)credential->data, CFDataGetBytePtr(data),
1724                                credential->datalen);
1725                         cupsArrayAdd(names, credential);
1726                       }
1727                       else
1728                         free(credential);
1729                     }
1730                   }
1731                 }
1732
1733                 CFRelease(dn_array);
1734               }
1735
1736               if (!error)
1737               {
1738                 error = (cg->client_cert_cb)(http, http->tls, names,
1739                                              cg->client_cert_data);
1740
1741                 DEBUG_printf(("4_httpTLSStart: Client certificate callback "
1742                               "returned %d.", (int)error));
1743               }
1744
1745               httpFreeCredentials(names);
1746             }
1747             break;
1748
1749         case errSSLUnknownRootCert :
1750             message = _("Unable to establish a secure connection to host "
1751                         "(untrusted certificate).");
1752             break;
1753
1754         case errSSLNoRootCert :
1755             message = _("Unable to establish a secure connection to host "
1756                         "(self-signed certificate).");
1757             break;
1758
1759         case errSSLCertExpired :
1760             message = _("Unable to establish a secure connection to host "
1761                         "(expired certificate).");
1762             break;
1763
1764         case errSSLCertNotYetValid :
1765             message = _("Unable to establish a secure connection to host "
1766                         "(certificate not yet valid).");
1767             break;
1768
1769         case errSSLHostNameMismatch :
1770             message = _("Unable to establish a secure connection to host "
1771                         "(host name mismatch).");
1772             break;
1773
1774         case errSSLXCertChainInvalid :
1775             message = _("Unable to establish a secure connection to host "
1776                         "(certificate chain invalid).");
1777             break;
1778
1779         case errSSLConnectionRefused :
1780             message = _("Unable to establish a secure connection to host "
1781                         "(peer dropped connection before responding).");
1782             break;
1783
1784         default :
1785             break;
1786       }
1787     }
1788
1789    /*
1790     * Restore the previous timeout settings...
1791     */
1792
1793     httpSetTimeout(http, old_timeout, old_cb, old_data);
1794   }
1795
1796   if (error)
1797   {
1798     http->error  = error;
1799     http->status = HTTP_STATUS_ERROR;
1800     errno        = ECONNREFUSED;
1801
1802     CFRelease(http->tls);
1803     http->tls = NULL;
1804
1805    /*
1806     * If an error string wasn't set by the callbacks use a generic one...
1807     */
1808
1809     if (!message)
1810     {
1811       if (!cg->lang_default)
1812         cg->lang_default = cupsLangDefault();
1813
1814       snprintf(msgbuf, sizeof(msgbuf), _cupsLangString(cg->lang_default, _("Unable to establish a secure connection to host (%d).")), error);
1815       message = msgbuf;
1816     }
1817
1818     _cupsSetError(IPP_STATUS_ERROR_CUPS_PKI, message, 1);
1819
1820     return (-1);
1821   }
1822
1823   return (0);
1824 }
1825
1826
1827 /*
1828  * '_httpTLSStop()' - Shut down SSL/TLS on a connection.
1829  */
1830
1831 void
1832 _httpTLSStop(http_t *http)              /* I - HTTP connection */
1833 {
1834   while (SSLClose(http->tls) == errSSLWouldBlock)
1835     usleep(1000);
1836
1837   CFRelease(http->tls);
1838
1839   if (http->tls_credentials)
1840     CFRelease(http->tls_credentials);
1841
1842   http->tls             = NULL;
1843   http->tls_credentials = NULL;
1844 }
1845
1846
1847 /*
1848  * '_httpTLSWrite()' - Write to a SSL/TLS connection.
1849  */
1850
1851 int                                     /* O - Bytes written */
1852 _httpTLSWrite(http_t     *http,         /* I - HTTP connection */
1853                const char *buf,         /* I - Buffer holding data */
1854                int        len)          /* I - Length of buffer */
1855 {
1856   ssize_t       result;                 /* Return value */
1857   OSStatus      error;                  /* Error info */
1858   size_t        processed;              /* Number of bytes processed */
1859
1860
1861   DEBUG_printf(("2_httpTLSWrite(http=%p, buf=%p, len=%d)", (void *)http, (void *)buf, len));
1862
1863   error = SSLWrite(http->tls, buf, (size_t)len, &processed);
1864
1865   switch (error)
1866   {
1867     case 0 :
1868         result = (int)processed;
1869         break;
1870
1871     case errSSLWouldBlock :
1872         if (processed)
1873         {
1874           result = (int)processed;
1875         }
1876         else
1877         {
1878           result = -1;
1879           errno  = EINTR;
1880         }
1881         break;
1882
1883     case errSSLClosedGraceful :
1884     default :
1885         if (processed)
1886         {
1887           result = (int)processed;
1888         }
1889         else
1890         {
1891           result = -1;
1892           errno  = EPIPE;
1893         }
1894         break;
1895   }
1896
1897   DEBUG_printf(("3_httpTLSWrite: Returning %d.", (int)result));
1898
1899   return ((int)result);
1900 }
1901
1902
1903 /*
1904  * 'http_cdsa_copy_server()' - Find and copy server credentials from the keychain.
1905  */
1906
1907 static CFArrayRef                       /* O - Array of certificates or NULL */
1908 http_cdsa_copy_server(
1909     const char *common_name)            /* I - Server's hostname */
1910 {
1911 #if TARGET_OS_OSX
1912   OSStatus              err;            /* Error info */
1913   SecIdentityRef        identity = NULL;/* Identity */
1914   CFArrayRef            certificates = NULL;
1915                                         /* Certificate array */
1916   SecPolicyRef          policy = NULL;  /* Policy ref */
1917   CFStringRef           cfcommon_name = NULL;
1918                                         /* Server name */
1919   CFMutableDictionaryRef query = NULL;  /* Query qualifiers */
1920   CFArrayRef            list = NULL;    /* Keychain list */
1921   SecKeychainRef        syschain = NULL;/* System keychain */
1922   SecKeychainStatus     status = 0;     /* Keychain status */
1923
1924
1925   DEBUG_printf(("3http_cdsa_copy_server(common_name=\"%s\")", common_name));
1926
1927   cfcommon_name = CFStringCreateWithCString(kCFAllocatorDefault, common_name, kCFStringEncodingUTF8);
1928
1929   policy = SecPolicyCreateSSL(1, cfcommon_name);
1930
1931   if (!policy)
1932   {
1933     DEBUG_puts("4http_cdsa_copy_server: Unable to create SSL policy.");
1934     goto cleanup;
1935   }
1936
1937   if (!(query = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks)))
1938   {
1939     DEBUG_puts("4http_cdsa_copy_server: Unable to create query dictionary.");
1940     goto cleanup;
1941   }
1942
1943   _cupsMutexLock(&tls_mutex);
1944
1945   err = SecKeychainGetStatus(tls_keychain, &status);
1946
1947   if (err == noErr && !(status & kSecUnlockStateStatus) && tls_cups_keychain)
1948     SecKeychainUnlock(tls_keychain, _CUPS_CDSA_PASSLEN, _CUPS_CDSA_PASSWORD, TRUE);
1949
1950   CFDictionaryAddValue(query, kSecClass, kSecClassIdentity);
1951   CFDictionaryAddValue(query, kSecMatchPolicy, policy);
1952   CFDictionaryAddValue(query, kSecReturnRef, kCFBooleanTrue);
1953   CFDictionaryAddValue(query, kSecMatchLimit, kSecMatchLimitOne);
1954
1955   syschain = http_cdsa_open_system_keychain();
1956
1957   if (syschain)
1958   {
1959     const void *values[2] = { syschain, tls_keychain };
1960
1961     list = CFArrayCreate(kCFAllocatorDefault, (const void **)values, 2, &kCFTypeArrayCallBacks);
1962   }
1963   else
1964     list = CFArrayCreate(kCFAllocatorDefault, (const void **)&tls_keychain, 1, &kCFTypeArrayCallBacks);
1965
1966   CFDictionaryAddValue(query, kSecMatchSearchList, list);
1967   CFRelease(list);
1968
1969   err = SecItemCopyMatching(query, (CFTypeRef *)&identity);
1970
1971   _cupsMutexUnlock(&tls_mutex);
1972
1973   if (err != noErr)
1974   {
1975     DEBUG_printf(("4http_cdsa_copy_server: SecItemCopyMatching failed with status %d.", (int)err));
1976     goto cleanup;
1977   }
1978
1979   if (CFGetTypeID(identity) != SecIdentityGetTypeID())
1980   {
1981     DEBUG_puts("4http_cdsa_copy_server: Search returned something that is not an identity.");
1982     goto cleanup;
1983   }
1984
1985   if ((certificates = CFArrayCreate(NULL, (const void **)&identity, 1, &kCFTypeArrayCallBacks)) == NULL)
1986   {
1987     DEBUG_puts("4http_cdsa_copy_server: Unable to create array of certificates.");
1988     goto cleanup;
1989   }
1990
1991   cleanup :
1992
1993   if (syschain)
1994     CFRelease(syschain);
1995   if (identity)
1996     CFRelease(identity);
1997   if (policy)
1998     CFRelease(policy);
1999   if (cfcommon_name)
2000     CFRelease(cfcommon_name);
2001   if (query)
2002     CFRelease(query);
2003
2004   DEBUG_printf(("4http_cdsa_copy_server: Returning %p.", (void *)certificates));
2005
2006   return (certificates);
2007 #else
2008
2009   (void)common_name;
2010
2011   if (!tls_selfsigned)
2012     return (NULL);
2013
2014   return (CFArrayCreate(NULL, (const void **)&tls_selfsigned, 1, &kCFTypeArrayCallBacks));
2015 #endif /* TARGET_OS_OSX */
2016 }
2017
2018
2019 /*
2020  * 'http_cdsa_create_credential()' - Create a single credential in the internal format.
2021  */
2022
2023 static SecCertificateRef                        /* O - Certificate */
2024 http_cdsa_create_credential(
2025     http_credential_t *credential)              /* I - Credential */
2026 {
2027   if (!credential)
2028     return (NULL);
2029
2030   return (SecCertificateCreateWithBytes(kCFAllocatorDefault, credential->data, (CFIndex)credential->datalen));
2031 }
2032
2033
2034 #if TARGET_OS_OSX
2035 /*
2036  * 'http_cdsa_default_path()' - Get the default keychain path.
2037  */
2038
2039 static const char *                     /* O - Keychain path */
2040 http_cdsa_default_path(char   *buffer,  /* I - Path buffer */
2041                        size_t bufsize)  /* I - Size of buffer */
2042 {
2043   const char *home = getenv("HOME");    /* HOME environment variable */
2044
2045
2046  /*
2047   * Determine the default keychain path.  Note that the login and system
2048   * keychains are no longer accessible to user applications starting in macOS
2049   * 10.11.4 (!), so we need to create our own keychain just for CUPS.
2050   */
2051
2052   if (getuid() && home)
2053     snprintf(buffer, bufsize, "%s/.cups/ssl.keychain", home);
2054   else
2055     strlcpy(buffer, "/etc/cups/ssl.keychain", bufsize);
2056
2057   DEBUG_printf(("1http_cdsa_default_path: Using default path \"%s\".", buffer));
2058
2059   return (buffer);
2060 }
2061
2062
2063 /*
2064  * 'http_cdsa_open_keychain()' - Open (or create) a keychain.
2065  */
2066
2067 static SecKeychainRef                   /* O - Keychain or NULL */
2068 http_cdsa_open_keychain(
2069     const char *path,                   /* I - Path to keychain */
2070     char       *filename,               /* I - Keychain filename */
2071     size_t     filesize)                /* I - Size of filename buffer */
2072 {
2073   SecKeychainRef        keychain = NULL;/* Temporary keychain */
2074   OSStatus              err;            /* Error code */
2075   Boolean               interaction;    /* Interaction allowed? */
2076   SecKeychainStatus     status = 0;     /* Keychain status */
2077
2078
2079  /*
2080   * Get the keychain filename...
2081   */
2082
2083   if (!path)
2084   {
2085     path = http_cdsa_default_path(filename, filesize);
2086     tls_cups_keychain = 1;
2087   }
2088   else
2089   {
2090     strlcpy(filename, path, filesize);
2091     tls_cups_keychain = 0;
2092   }
2093
2094  /*
2095   * Save the interaction setting and disable while we open the keychain...
2096   */
2097
2098   SecKeychainGetUserInteractionAllowed(&interaction);
2099   SecKeychainSetUserInteractionAllowed(FALSE);
2100
2101   if (access(path, R_OK) && tls_cups_keychain)
2102   {
2103    /*
2104     * Create a new keychain at the given path...
2105     */
2106
2107     err = SecKeychainCreate(path, _CUPS_CDSA_PASSLEN, _CUPS_CDSA_PASSWORD, FALSE, NULL, &keychain);
2108   }
2109   else
2110   {
2111    /*
2112     * Open the existing keychain and unlock as needed...
2113     */
2114
2115     err = SecKeychainOpen(path, &keychain);
2116
2117     if (err == noErr)
2118       err = SecKeychainGetStatus(keychain, &status);
2119
2120     if (err == noErr && !(status & kSecUnlockStateStatus) && tls_cups_keychain)
2121       err = SecKeychainUnlock(keychain, _CUPS_CDSA_PASSLEN, _CUPS_CDSA_PASSWORD, TRUE);
2122   }
2123
2124  /*
2125   * Restore interaction setting...
2126   */
2127
2128   SecKeychainSetUserInteractionAllowed(interaction);
2129
2130  /*
2131   * Release the keychain if we had any errors...
2132   */
2133
2134   if (err != noErr)
2135   {
2136     /* TODO: Set cups last error string */
2137     DEBUG_printf(("4http_cdsa_open_keychain: Unable to open keychain (%d), returning NULL.", (int)err));
2138
2139     if (keychain)
2140     {
2141       CFRelease(keychain);
2142       keychain = NULL;
2143     }
2144   }
2145
2146  /*
2147   * Return the keychain or NULL...
2148   */
2149
2150   return (keychain);
2151 }
2152
2153
2154 /*
2155  * 'http_cdsa_open_system_keychain()' - Open the System keychain.
2156  */
2157
2158 static SecKeychainRef
2159 http_cdsa_open_system_keychain(void)
2160 {
2161   SecKeychainRef        keychain = NULL;/* Temporary keychain */
2162   OSStatus              err;            /* Error code */
2163   Boolean               interaction;    /* Interaction allowed? */
2164   SecKeychainStatus     status = 0;     /* Keychain status */
2165
2166
2167  /*
2168   * Save the interaction setting and disable while we open the keychain...
2169   */
2170
2171   SecKeychainGetUserInteractionAllowed(&interaction);
2172   SecKeychainSetUserInteractionAllowed(TRUE);
2173
2174   err = SecKeychainOpen("/Library/Keychains/System.keychain", &keychain);
2175
2176   if (err == noErr)
2177     err = SecKeychainGetStatus(keychain, &status);
2178
2179   if (err == noErr && !(status & kSecUnlockStateStatus))
2180     err = errSecInteractionNotAllowed;
2181
2182  /*
2183   * Restore interaction setting...
2184   */
2185
2186   SecKeychainSetUserInteractionAllowed(interaction);
2187
2188  /*
2189   * Release the keychain if we had any errors...
2190   */
2191
2192   if (err != noErr)
2193   {
2194     /* TODO: Set cups last error string */
2195     DEBUG_printf(("4http_cdsa_open_system_keychain: Unable to open keychain (%d), returning NULL.", (int)err));
2196
2197     if (keychain)
2198     {
2199       CFRelease(keychain);
2200       keychain = NULL;
2201     }
2202   }
2203
2204  /*
2205   * Return the keychain or NULL...
2206   */
2207
2208   return (keychain);
2209 }
2210 #endif /* TARGET_OS_OSX */
2211
2212
2213 /*
2214  * 'http_cdsa_read()' - Read function for the CDSA library.
2215  */
2216
2217 static OSStatus                         /* O  - -1 on error, 0 on success */
2218 http_cdsa_read(
2219     SSLConnectionRef connection,        /* I  - SSL/TLS connection */
2220     void             *data,             /* I  - Data buffer */
2221     size_t           *dataLength)       /* IO - Number of bytes */
2222 {
2223   OSStatus      result;                 /* Return value */
2224   ssize_t       bytes;                  /* Number of bytes read */
2225   http_t        *http;                  /* HTTP connection */
2226
2227
2228   http = (http_t *)connection;
2229
2230   if (!http->blocking || http->timeout_value > 0.0)
2231   {
2232    /*
2233     * Make sure we have data before we read...
2234     */
2235
2236     while (!_httpWait(http, http->wait_value, 0))
2237     {
2238       if (http->timeout_cb && (*http->timeout_cb)(http, http->timeout_data))
2239         continue;
2240
2241       http->error = ETIMEDOUT;
2242       return (-1);
2243     }
2244   }
2245
2246   do
2247   {
2248     bytes = recv(http->fd, data, *dataLength, 0);
2249   }
2250   while (bytes == -1 && (errno == EINTR || errno == EAGAIN));
2251
2252   if ((size_t)bytes == *dataLength)
2253   {
2254     result = 0;
2255   }
2256   else if (bytes > 0)
2257   {
2258     *dataLength = (size_t)bytes;
2259     result = errSSLWouldBlock;
2260   }
2261   else
2262   {
2263     *dataLength = 0;
2264
2265     if (bytes == 0)
2266       result = errSSLClosedGraceful;
2267     else if (errno == EAGAIN)
2268       result = errSSLWouldBlock;
2269     else
2270       result = errSSLClosedAbort;
2271   }
2272
2273   return (result);
2274 }
2275
2276
2277 /*
2278  * 'http_cdsa_set_credentials()' - Set the TLS credentials.
2279  */
2280
2281 static int                              /* O - Status of connection */
2282 http_cdsa_set_credentials(http_t *http) /* I - HTTP connection */
2283 {
2284   _cups_globals_t *cg = _cupsGlobals(); /* Pointer to library globals */
2285   OSStatus              error = 0;      /* Error code */
2286   http_tls_credentials_t credentials = NULL;
2287                                         /* TLS credentials */
2288
2289
2290   DEBUG_printf(("7http_tls_set_credentials(%p)", (void *)http));
2291
2292  /*
2293   * Prefer connection specific credentials...
2294   */
2295
2296   if ((credentials = http->tls_credentials) == NULL)
2297     credentials = cg->tls_credentials;
2298
2299   if (credentials)
2300   {
2301     error = SSLSetCertificate(http->tls, credentials);
2302     DEBUG_printf(("4http_tls_set_credentials: SSLSetCertificate, error=%d",
2303                   (int)error));
2304   }
2305   else
2306     DEBUG_puts("4http_tls_set_credentials: No credentials to set.");
2307
2308   return (error);
2309 }
2310
2311
2312 /*
2313  * 'http_cdsa_write()' - Write function for the CDSA library.
2314  */
2315
2316 static OSStatus                         /* O  - -1 on error, 0 on success */
2317 http_cdsa_write(
2318     SSLConnectionRef connection,        /* I  - SSL/TLS connection */
2319     const void       *data,             /* I  - Data buffer */
2320     size_t           *dataLength)       /* IO - Number of bytes */
2321 {
2322   OSStatus      result;                 /* Return value */
2323   ssize_t       bytes;                  /* Number of bytes read */
2324   http_t        *http;                  /* HTTP connection */
2325
2326
2327   http = (http_t *)connection;
2328
2329   do
2330   {
2331     bytes = write(http->fd, data, *dataLength);
2332   }
2333   while (bytes == -1 && (errno == EINTR || errno == EAGAIN));
2334
2335   if ((size_t)bytes == *dataLength)
2336   {
2337     result = 0;
2338   }
2339   else if (bytes >= 0)
2340   {
2341     *dataLength = (size_t)bytes;
2342     result = errSSLWouldBlock;
2343   }
2344   else
2345   {
2346     *dataLength = 0;
2347
2348     if (errno == EAGAIN)
2349       result = errSSLWouldBlock;
2350     else
2351       result = errSSLClosedAbort;
2352   }
2353
2354   return (result);
2355 }