/*
- * "$Id$"
- *
* TLS support code for CUPS using GNU TLS.
*
- * Copyright 2007-2014 by Apple Inc.
+ * Copyright 2007-2015 by Apple Inc.
* Copyright 1997-2007 by Easy Software Products, all rights reserved.
*
* These coded instructions, statements, and computer programs are the
* This file is subject to the Apple OS-Developed Software exception.
*/
+/**** This file is included from tls.c ****/
+
+/*
+ * Include necessary headers...
+ */
+
+#include <sys/stat.h>
+
/*
* Local globals...
/* Server cert keychain path */
static _cups_mutex_t tls_mutex = _CUPS_MUTEX_INITIALIZER;
/* Mutex for keychain/certs */
+static int tls_options = -1;/* Options for TLS connections */
/*
* Local functions...
*/
-//static int make_certificate(cupsd_client_t *con);
-static ssize_t http_gnutls_read(gnutls_transport_ptr_t ptr, void *data, size_t length);
-static ssize_t http_gnutls_write(gnutls_transport_ptr_t ptr, const void *data, size_t length);
+static gnutls_x509_crt_t http_gnutls_create_credential(http_credential_t *credential);
+static const char *http_gnutls_default_path(char *buffer, size_t bufsize);
+static const char *http_gnutls_make_path(char *buffer, size_t bufsize, const char *dirname, const char *filename, const char *ext);
+static ssize_t http_gnutls_read(gnutls_transport_ptr_t ptr, void *data, size_t length);
+static ssize_t http_gnutls_write(gnutls_transport_ptr_t ptr, const void *data, size_t length);
/*
* 'cupsMakeServerCredentials()' - Make a self-signed certificate and private key pair.
*
- * @since CUPS 2.0@
+ * @since CUPS 2.0/OS 10.10@
*/
int /* O - 1 on success, 0 on failure */
const char **alt_names, /* I - Subject Alternate Names */
time_t expiration_date) /* I - Expiration date */
{
- gnutls_x509_crt crt; /* Self-signed certificate */
- gnutls_x509_privkey key; /* Encryption private key */
- char crtfile[1024], /* Certificate filename */
+ gnutls_x509_crt_t crt; /* Self-signed certificate */
+ gnutls_x509_privkey_t key; /* Encryption private key */
+ char temp[1024], /* Temporary directory name */
+ crtfile[1024], /* Certificate filename */
keyfile[1024]; /* Private key filename */
cups_lang_t *language; /* Default language info */
cups_file_t *fp; /* Key/cert file */
*/
if (!path)
- {
- const char *home = getenv("HOME"); /* HOME environment variable */
-
- if (getuid() && home)
- snprintf(buffer, sizeof(buffer), "%s/.cups/ssl", home);
- else
- snprintf(buffer, sizeof(buffer), "%s/ssl", CUPS_SERVERROOT);
-
- path = buffer;
+ path = http_gnutls_default_path(temp, sizeof(temp));
- DEBUG_printf(("1cupsMakeServerCredentials: Using default path \"%s\".", path));
+ if (!path || !common_name)
+ {
+ _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(EINVAL), 0);
+ return (0);
}
- snprintf(crtfile, sizeof(crtfile), "%s/%s.crt", path, common_name);
- snprintf(keyfile, sizeof(keyfile), "%s/%s.key", path, common_name);
+ http_gnutls_make_path(crtfile, sizeof(crtfile), path, common_name, "crt");
+ http_gnutls_make_path(keyfile, sizeof(keyfile), path, common_name, "key");
/*
* Create the encryption key...
*/
+ DEBUG_puts("1cupsMakeServerCredentials: Creating key pair.");
+
gnutls_x509_privkey_init(&key);
gnutls_x509_privkey_generate(key, GNUTLS_PK_RSA, 2048, 0);
+ DEBUG_puts("1cupsMakeServerCredentials: Key pair created.");
+
/*
* Save it...
*/
bytes = sizeof(buffer);
- if ((result = gnutls_x509_privkey_export(key, GNUTLS_X509_FMT_PEM,
- buffer, &bytes)) < 0)
+ if ((result = gnutls_x509_privkey_export(key, GNUTLS_X509_FMT_PEM, buffer, &bytes)) < 0)
{
+ DEBUG_printf(("1cupsMakeServerCredentials: Unable to export private key: %s", gnutls_strerror(result)));
_cupsSetError(IPP_STATUS_ERROR_INTERNAL, gnutls_strerror(result), 0);
gnutls_x509_privkey_deinit(key);
return (0);
}
else if ((fp = cupsFileOpen(keyfile, "w")) != NULL)
{
+ DEBUG_printf(("1cupsMakeServerCredentials: Writing private key to \"%s\".", keyfile));
cupsFileWrite(fp, (char *)buffer, bytes);
cupsFileClose(fp);
}
else
{
+ DEBUG_printf(("1cupsMakeServerCredentials: Unable to create private key file \"%s\": %s", keyfile, strerror(errno)));
_cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(errno), 0);
gnutls_x509_privkey_deinit(key);
return (0);
* Create the self-signed certificate...
*/
- DEBUG_puts("1cupsMakeServerCredentials: Generating self-signed SSL certificate.");
+ DEBUG_puts("1cupsMakeServerCredentials: Generating self-signed X.509 certificate.");
language = cupsLangDefault();
curtime = time(NULL);
bytes = sizeof(buffer);
if ((result = gnutls_x509_crt_export(crt, GNUTLS_X509_FMT_PEM, buffer, &bytes)) < 0)
{
+ DEBUG_printf(("1cupsMakeServerCredentials: Unable to export public key and X.509 certificate: %s", gnutls_strerror(result)));
_cupsSetError(IPP_STATUS_ERROR_INTERNAL, gnutls_strerror(result), 0);
gnutls_x509_crt_deinit(crt);
gnutls_x509_privkey_deinit(key);
}
else if ((fp = cupsFileOpen(crtfile, "w")) != NULL)
{
+ DEBUG_printf(("1cupsMakeServerCredentials: Writing public key and X.509 certificate to \"%s\".", crtfile));
cupsFileWrite(fp, (char *)buffer, bytes);
cupsFileClose(fp);
}
else
{
+ DEBUG_printf(("1cupsMakeServerCredentials: Unable to create public key and X.509 certificate file \"%s\": %s", crtfile, strerror(errno)));
_cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(errno), 0);
gnutls_x509_crt_deinit(crt);
gnutls_x509_privkey_deinit(key);
gnutls_x509_crt_deinit(crt);
gnutls_x509_privkey_deinit(key);
+ DEBUG_puts("1cupsMakeServerCredentials: Successfully created credentials.");
+
return (1);
}
* Note: The server credentials are used by all threads in the running process.
* This function is threadsafe.
*
- * @since CUPS 2.0@
+ * @since CUPS 2.0/OS 10.10@
*/
int /* O - 1 on success, 0 on failure */
const char *common_name, /* I - Default common name for server */
int auto_create) /* I - 1 = automatically create self-signed certificates */
{
- char buffer[1024]; /* Default path buffer */
+ char temp[1024]; /* Default path buffer */
DEBUG_printf(("cupsSetServerCredentials(path=\"%s\", common_name=\"%s\", auto_create=%d)", path, common_name, auto_create));
- _cupsMutexLock(&tls_mutex);
-
/*
- * Free old values...
+ * Use defaults as needed...
*/
- if (tls_keypath)
- _cupsStrFree(tls_keypath);
-
- if (tls_common_name)
- _cupsStrFree(tls_common_name);
+ if (!path)
+ path = http_gnutls_default_path(temp, sizeof(temp));
/*
- * Use defaults as needed...
+ * Range check input...
*/
- if (!path)
+ if (!path || !common_name)
{
- const char *home = getenv("HOME"); /* HOME environment variable */
+ _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(EINVAL), 0);
+ return (0);
+ }
- if (getuid() && home)
- snprintf(buffer, sizeof(buffer), "%s/.cups/ssl", home);
- else
- snprintf(buffer, sizeof(buffer), "%s/ssl", CUPS_SERVERROOT);
+ _cupsMutexLock(&tls_mutex);
+
+ /*
+ * Free old values...
+ */
- path = buffer;
+ if (tls_keypath)
+ _cupsStrFree(tls_keypath);
- DEBUG_printf(("1cupsSetServerCredentials: Using default path \"%s\".", path));
- }
+ if (tls_common_name)
+ _cupsStrFree(tls_common_name);
/*
* Save the new values...
http_t *http, /* I - Connection to server */
cups_array_t **credentials) /* O - Array of credentials */
{
+ unsigned count; /* Number of certificates */
+ const gnutls_datum_t *certs; /* Certificates */
+
+
+ DEBUG_printf(("httpCopyCredentials(http=%p, credentials=%p)", http, credentials));
+
if (credentials)
*credentials = NULL;
if (!http || !http->tls || !credentials)
return (-1);
+ *credentials = cupsArrayNew(NULL, NULL);
+ certs = gnutls_certificate_get_peers(http->tls, &count);
+
+ DEBUG_printf(("1httpCopyCredentials: certs=%p, count=%u", certs, count));
+
+ if (certs && count)
+ {
+ while (count > 0)
+ {
+ httpAddCredential(*credentials, certs->data, certs->size);
+ certs ++;
+ count --;
+ }
+ }
+
return (0);
}
}
+/*
+ * 'httpCredentialsAreValidForName()' - Return whether the credentials are valid for the given name.
+ *
+ * @since CUPS 2.0/OS 10.10@
+ */
+
+int /* O - 1 if valid, 0 otherwise */
+httpCredentialsAreValidForName(
+ cups_array_t *credentials, /* I - Credentials */
+ const char *common_name) /* I - Name to check */
+{
+ gnutls_x509_crt_t cert; /* Certificate */
+ int result = 0; /* Result */
+
+
+ cert = http_gnutls_create_credential((http_credential_t *)cupsArrayFirst(credentials));
+ if (cert)
+ {
+ result = gnutls_x509_crt_check_hostname(cert, common_name) != 0;
+ gnutls_x509_crt_deinit(cert);
+ }
+
+ return (result);
+}
+
+
+/*
+ * 'httpCredentialsGetTrust()' - Return the trust of credentials.
+ *
+ * @since CUPS 2.0/OS 10.10@
+ */
+
+http_trust_t /* O - Level of trust */
+httpCredentialsGetTrust(
+ cups_array_t *credentials, /* I - Credentials */
+ const char *common_name) /* I - Common name for trust lookup */
+{
+ http_trust_t trust = HTTP_TRUST_OK;
+ /* Trusted? */
+ gnutls_x509_crt_t cert; /* Certificate */
+ cups_array_t *tcreds = NULL; /* Trusted credentials */
+ _cups_globals_t *cg = _cupsGlobals();
+ /* Per-thread globals */
+
+
+ if (!common_name)
+ return (HTTP_TRUST_UNKNOWN);
+
+ if ((cert = http_gnutls_create_credential((http_credential_t *)cupsArrayFirst(credentials))) == NULL)
+ return (HTTP_TRUST_UNKNOWN);
+
+ if (cg->any_root < 0)
+ _cupsSetDefaults();
+
+ /*
+ * Look this common name up in the default keychains...
+ */
+
+ httpLoadCredentials(NULL, &tcreds, common_name);
+
+ if (tcreds)
+ {
+ char credentials_str[1024], /* String for incoming credentials */
+ tcreds_str[1024]; /* String for saved credentials */
+
+ httpCredentialsString(credentials, credentials_str, sizeof(credentials_str));
+ httpCredentialsString(tcreds, tcreds_str, sizeof(tcreds_str));
+
+ if (strcmp(credentials_str, tcreds_str))
+ {
+ /*
+ * Credentials don't match, let's look at the expiration date of the new
+ * credentials and allow if the new ones have a later expiration...
+ */
+
+ if (httpCredentialsGetExpiration(credentials) <= httpCredentialsGetExpiration(tcreds) ||
+ !httpCredentialsAreValidForName(credentials, common_name))
+ {
+ /*
+ * Either the new credentials are not newly issued, or the common name
+ * does not match the issued certificate...
+ */
+
+ trust = HTTP_TRUST_INVALID;
+ }
+ else if (httpCredentialsGetExpiration(tcreds) < time(NULL))
+ {
+ /*
+ * Save the renewed credentials...
+ */
+
+ trust = HTTP_TRUST_RENEWED;
+
+ httpSaveCredentials(NULL, credentials, common_name);
+ }
+ }
+
+ httpFreeCredentials(tcreds);
+ }
+ else if (cg->validate_certs && !httpCredentialsAreValidForName(credentials, common_name))
+ trust = HTTP_TRUST_INVALID;
+
+ if (trust == HTTP_TRUST_OK && !cg->expired_certs)
+ {
+ time_t curtime; /* Current date/time */
+
+ time(&curtime);
+ if (curtime < gnutls_x509_crt_get_activation_time(cert) ||
+ curtime > gnutls_x509_crt_get_expiration_time(cert))
+ trust = HTTP_TRUST_EXPIRED;
+ }
+
+ if (trust == HTTP_TRUST_OK && !cg->any_root && cupsArrayCount(credentials) == 1)
+ trust = HTTP_TRUST_INVALID;
+
+ gnutls_x509_crt_deinit(cert);
+
+ return (trust);
+}
+
+
+/*
+ * 'httpCredentialsGetExpiration()' - Return the expiration date of the credentials.
+ *
+ * @since CUPS 2.0/OS 10.10@
+ */
+
+time_t /* O - Expiration date of credentials */
+httpCredentialsGetExpiration(
+ cups_array_t *credentials) /* I - Credentials */
+{
+ gnutls_x509_crt_t cert; /* Certificate */
+ time_t result = 0; /* Result */
+
+
+ cert = http_gnutls_create_credential((http_credential_t *)cupsArrayFirst(credentials));
+ if (cert)
+ {
+ result = gnutls_x509_crt_get_expiration_time(cert);
+ gnutls_x509_crt_deinit(cert);
+ }
+
+ return (result);
+}
+
+
+/*
+ * 'httpCredentialsString()' - Return a string representing the credentials.
+ *
+ * @since CUPS 2.0/OS 10.10@
+ */
+
+size_t /* O - Total size of credentials string */
+httpCredentialsString(
+ cups_array_t *credentials, /* I - Credentials */
+ char *buffer, /* I - Buffer or @code NULL@ */
+ size_t bufsize) /* I - Size of buffer */
+{
+ http_credential_t *first; /* First certificate */
+ gnutls_x509_crt_t cert; /* Certificate */
+
+
+ DEBUG_printf(("httpCredentialsString(credentials=%p, buffer=%p, bufsize=" CUPS_LLFMT ")", credentials, buffer, CUPS_LLCAST bufsize));
+
+ if (!buffer)
+ return (0);
+
+ if (buffer && bufsize > 0)
+ *buffer = '\0';
+
+ if ((first = (http_credential_t *)cupsArrayFirst(credentials)) != NULL &&
+ (cert = http_gnutls_create_credential(first)) != NULL)
+ {
+ char name[256]; /* Common name associated with cert */
+ size_t namelen; /* Length of name */
+ time_t expiration; /* Expiration date of cert */
+ _cups_md5_state_t md5_state; /* MD5 state */
+ unsigned char md5_digest[16]; /* MD5 result */
+
+ namelen = sizeof(name) - 1;
+ if (gnutls_x509_crt_get_dn_by_oid(cert, GNUTLS_OID_X520_COMMON_NAME, 0, 0, name, &namelen) >= 0)
+ name[namelen] = '\0';
+ else
+ strlcpy(name, "unknown", sizeof(name));
+
+ expiration = gnutls_x509_crt_get_expiration_time(cert);
+
+ _cupsMD5Init(&md5_state);
+ _cupsMD5Append(&md5_state, first->data, (int)first->datalen);
+ _cupsMD5Finish(&md5_state, md5_digest);
+
+ snprintf(buffer, bufsize, "%s / %s / %02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X", name, httpGetDateString(expiration), md5_digest[0], md5_digest[1], md5_digest[2], md5_digest[3], md5_digest[4], md5_digest[5], md5_digest[6], md5_digest[7], md5_digest[8], md5_digest[9], md5_digest[10], md5_digest[11], md5_digest[12], md5_digest[13], md5_digest[14], md5_digest[15]);
+
+ gnutls_x509_crt_deinit(cert);
+ }
+
+ DEBUG_printf(("1httpCredentialsString: Returning \"%s\".", buffer));
+
+ return (strlen(buffer));
+}
+
+
+/*
+ * 'httpLoadCredentials()' - Load X.509 credentials from a keychain file.
+ *
+ * @since CUPS 2.0/OS 10.10@
+ */
+
+int /* O - 0 on success, -1 on error */
+httpLoadCredentials(
+ const char *path, /* I - Keychain/PKCS#12 path */
+ cups_array_t **credentials, /* IO - Credentials */
+ const char *common_name) /* I - Common name for credentials */
+{
+ cups_file_t *fp; /* Certificate file */
+ char filename[1024], /* filename.crt */
+ temp[1024], /* Temporary string */
+ line[256]; /* Base64-encoded line */
+ unsigned char *data = NULL; /* Buffer for cert data */
+ size_t alloc_data = 0, /* Bytes allocated */
+ num_data = 0; /* Bytes used */
+ int decoded; /* Bytes decoded */
+
+
+ if (!credentials || !common_name)
+ return (-1);
+
+ if (!path)
+ path = http_gnutls_default_path(temp, sizeof(temp));
+ if (!path)
+ return (-1);
+
+ http_gnutls_make_path(filename, sizeof(filename), path, common_name, "crt");
+
+ if ((fp = cupsFileOpen(filename, "r")) == NULL)
+ return (-1);
+
+ while (cupsFileGets(fp, line, sizeof(line)))
+ {
+ if (!strcmp(line, "-----BEGIN CERTIFICATE-----"))
+ {
+ if (num_data)
+ {
+ /*
+ * Missing END CERTIFICATE...
+ */
+
+ httpFreeCredentials(*credentials);
+ *credentials = NULL;
+ break;
+ }
+ }
+ else if (!strcmp(line, "-----END CERTIFICATE-----"))
+ {
+ if (!num_data)
+ {
+ /*
+ * Missing data...
+ */
+
+ httpFreeCredentials(*credentials);
+ *credentials = NULL;
+ break;
+ }
+
+ if (!*credentials)
+ *credentials = cupsArrayNew(NULL, NULL);
+
+ if (httpAddCredential(*credentials, data, num_data))
+ {
+ httpFreeCredentials(*credentials);
+ *credentials = NULL;
+ break;
+ }
+
+ num_data = 0;
+ }
+ else
+ {
+ if (alloc_data == 0)
+ {
+ data = malloc(2048);
+ alloc_data = 2048;
+
+ if (!data)
+ break;
+ }
+ else if ((num_data + strlen(line)) >= alloc_data)
+ {
+ unsigned char *tdata = realloc(data, alloc_data + 1024);
+ /* Expanded buffer */
+
+ if (!tdata)
+ {
+ httpFreeCredentials(*credentials);
+ *credentials = NULL;
+ break;
+ }
+
+ data = tdata;
+ alloc_data += 1024;
+ }
+
+ decoded = alloc_data - num_data;
+ httpDecode64_2((char *)data + num_data, &decoded, line);
+ num_data += (size_t)decoded;
+ }
+ }
+
+ cupsFileClose(fp);
+
+ if (num_data)
+ {
+ /*
+ * Missing END CERTIFICATE...
+ */
+
+ httpFreeCredentials(*credentials);
+ *credentials = NULL;
+ }
+
+ if (data)
+ free(data);
+
+ return (*credentials ? 0 : -1);
+}
+
+
+/*
+ * 'httpSaveCredentials()' - Save X.509 credentials to a keychain file.
+ *
+ * @since CUPS 2.0/OS 10.10@
+ */
+
+int /* O - -1 on error, 0 on success */
+httpSaveCredentials(
+ const char *path, /* I - Keychain/PKCS#12 path */
+ cups_array_t *credentials, /* I - Credentials */
+ const char *common_name) /* I - Common name for credentials */
+{
+ cups_file_t *fp; /* Certificate file */
+ char filename[1024], /* filename.crt */
+ nfilename[1024],/* filename.crt.N */
+ temp[1024], /* Temporary string */
+ line[256]; /* Base64-encoded line */
+ const unsigned char *ptr; /* Pointer into certificate */
+ ssize_t remaining; /* Bytes left */
+ http_credential_t *cred; /* Current credential */
+
+
+ if (!credentials || !common_name)
+ return (-1);
+
+ if (!path)
+ path = http_gnutls_default_path(temp, sizeof(temp));
+ if (!path)
+ return (-1);
+
+ http_gnutls_make_path(filename, sizeof(filename), path, common_name, "crt");
+ snprintf(nfilename, sizeof(nfilename), "%s.N", filename);
+
+ if ((fp = cupsFileOpen(nfilename, "w")) == NULL)
+ return (-1);
+
+ fchmod(cupsFileNumber(fp), 0600);
+
+ for (cred = (http_credential_t *)cupsArrayFirst(credentials);
+ cred;
+ cred = (http_credential_t *)cupsArrayNext(credentials))
+ {
+ cupsFilePuts(fp, "-----BEGIN CERTIFICATE-----\n");
+ for (ptr = cred->data, remaining = (ssize_t)cred->datalen; remaining > 0; remaining -= 45, ptr += 45)
+ {
+ httpEncode64_2(line, sizeof(line), (char *)ptr, remaining > 45 ? 45 : remaining);
+ cupsFilePrintf(fp, "%s\n", line);
+ }
+ cupsFilePuts(fp, "-----END CERTIFICATE-----\n");
+ }
+
+ cupsFileClose(fp);
+
+ return (rename(nfilename, filename));
+}
+
+
+/*
+ * 'http_gnutls_create_credential()' - Create a single credential in the internal format.
+ */
+
+static gnutls_x509_crt_t /* O - Certificate */
+http_gnutls_create_credential(
+ http_credential_t *credential) /* I - Credential */
+{
+ int result; /* Result from GNU TLS */
+ gnutls_x509_crt_t cert; /* Certificate */
+ gnutls_datum_t datum; /* Data record */
+
+
+ DEBUG_printf(("3http_gnutls_create_credential(credential=%p)", credential));
+
+ if (!credential)
+ return (NULL);
+
+ if ((result = gnutls_x509_crt_init(&cert)) < 0)
+ {
+ DEBUG_printf(("4http_gnutls_create_credential: init error: %s", gnutls_strerror(result)));
+ return (NULL);
+ }
+
+ datum.data = credential->data;
+ datum.size = credential->datalen;
+
+ if ((result = gnutls_x509_crt_import(cert, &datum, GNUTLS_X509_FMT_DER)) < 0)
+ {
+ DEBUG_printf(("4http_gnutls_create_credential: import error: %s", gnutls_strerror(result)));
+
+ gnutls_x509_crt_deinit(cert);
+ return (NULL);
+ }
+
+ return (cert);
+}
+
+
+/*
+ * 'http_gnutls_default_path()' - Get the default credential store path.
+ */
+
+static const char * /* O - Path or NULL on error */
+http_gnutls_default_path(char *buffer,/* I - Path buffer */
+ size_t bufsize)/* I - Size of path buffer */
+{
+ const char *home = getenv("HOME"); /* HOME environment variable */
+
+
+ if (getuid() && home)
+ {
+ snprintf(buffer, bufsize, "%s/.cups", home);
+ if (access(buffer, 0))
+ {
+ DEBUG_printf(("1http_gnutls_default_path: Making directory \"%s\".", buffer));
+ if (mkdir(buffer, 0700))
+ {
+ DEBUG_printf(("1http_gnutls_default_path: Failed to make directory: %s", strerror(errno)));
+ return (NULL);
+ }
+ }
+
+ snprintf(buffer, bufsize, "%s/.cups/ssl", home);
+ if (access(buffer, 0))
+ {
+ DEBUG_printf(("1http_gnutls_default_path: Making directory \"%s\".", buffer));
+ if (mkdir(buffer, 0700))
+ {
+ DEBUG_printf(("1http_gnutls_default_path: Failed to make directory: %s", strerror(errno)));
+ return (NULL);
+ }
+ }
+ }
+ else
+ strlcpy(buffer, CUPS_SERVERROOT "/ssl", bufsize);
+
+ DEBUG_printf(("1http_gnutls_default_path: Using default path \"%s\".", buffer));
+
+ return (buffer);
+}
+
+
+/*
+ * 'http_gnutls_make_path()' - Format a filename for a certificate or key file.
+ */
+
+static const char * /* O - Filename */
+http_gnutls_make_path(
+ char *buffer, /* I - Filename buffer */
+ size_t bufsize, /* I - Size of buffer */
+ const char *dirname, /* I - Directory */
+ const char *filename, /* I - Filename (usually hostname) */
+ const char *ext) /* I - Extension */
+{
+ char *bufptr, /* Pointer into buffer */
+ *bufend = buffer + bufsize - 1; /* End of buffer */
+
+
+ snprintf(buffer, bufsize, "%s/", dirname);
+ bufptr = buffer + strlen(buffer);
+
+ while (*filename && bufptr < bufend)
+ {
+ if (_cups_isalnum(*filename) || *filename == '-' || *filename == '.')
+ *bufptr++ = *filename;
+ else
+ *bufptr++ = '_';
+
+ filename ++;
+ }
+
+ if (bufptr < bufend)
+ *bufptr++ = '.';
+
+ strlcpy(bufptr, ext, (size_t)(bufend - bufptr + 1));
+
+ return (buffer);
+}
+
+
/*
* 'http_gnutls_read()' - Read function for the GNU TLS library.
*/
DEBUG_printf(("6http_gnutls_write(ptr=%p, data=%p, length=%d)", ptr, data,
(int)length));
-#ifdef DEBUG
- http_debug_hex("http_gnutls_write", data, (int)length);
-#endif /* DEBUG */
-
bytes = send(((http_t *)ptr)->fd, data, length, 0);
DEBUG_printf(("http_gnutls_write: bytes=%d", (int)bytes));
}
+/*
+ * '_httpTLSSetOptions()' - Set TLS protocol and cipher suite options.
+ */
+
+void
+_httpTLSSetOptions(int options) /* I - Options */
+{
+ tls_options = options;
+}
+
+
/*
* '_httpTLSStart()' - Set up SSL/TLS support on a connection.
*/
int status; /* Status of handshake */
gnutls_certificate_credentials_t *credentials;
/* TLS credentials */
+ char priority_string[1024];
+ /* Priority string */
+
+ DEBUG_printf(("3_httpTLSStart(http=%p)", http));
- DEBUG_printf(("7_httpTLSStart(http=%p)", http));
+ if (tls_options < 0)
+ {
+ DEBUG_puts("4_httpTLSStart: Setting defaults.");
+ _cupsSetDefaults();
+ DEBUG_printf(("4_httpTLSStart: tls_options=%x", tls_options));
+ }
if (http->mode == _HTTP_MODE_SERVER && !tls_keypath)
{
}
gnutls_certificate_allocate_credentials(credentials);
- gnutls_init(&http->tls, http->mode == _HTTP_MODE_CLIENT ? GNUTLS_CLIENT : GNUTLS_SERVER);
- gnutls_set_default_priority(http->tls);
- gnutls_transport_set_ptr(http->tls, (gnutls_transport_ptr_t)http);
- gnutls_transport_set_pull_function(http->tls, http_gnutls_read);
- gnutls_transport_set_push_function(http->tls, http_gnutls_write);
+ status = gnutls_init(&http->tls, http->mode == _HTTP_MODE_CLIENT ? GNUTLS_CLIENT : GNUTLS_SERVER);
+ if (!status)
+ status = gnutls_set_default_priority(http->tls);
+
+ if (status)
+ {
+ http->error = EIO;
+ http->status = HTTP_STATUS_ERROR;
- if (http->mode == _HTTP_CLIENT)
+ DEBUG_printf(("4_httpTLSStart: Unable to initialize common TLS parameters: %s", gnutls_strerror(status)));
+ _cupsSetError(IPP_STATUS_ERROR_CUPS_PKI, gnutls_strerror(status), 0);
+
+ gnutls_deinit(http->tls);
+ gnutls_certificate_free_credentials(*credentials);
+ free(credentials);
+ http->tls = NULL;
+
+ return (-1);
+ }
+
+ if (http->mode == _HTTP_MODE_CLIENT)
{
/*
* Client: get the hostname to use for TLS...
*hostptr = '\0';
}
- gnutls_server_name_set(http->tls, GNUTLS_NAME_DNS, hostname, strlen(hostname));
- gnutls_credentials_set(http->tls, GNUTLS_CRD_CERTIFICATE, *credentials);
+ status = gnutls_server_name_set(http->tls, GNUTLS_NAME_DNS, hostname, strlen(hostname));
}
else
{
keyfile[1024]; /* Private key file */
int have_creds = 0; /* Have credentials? */
-
if (http->fields[HTTP_FIELD_HOST][0])
{
/*
if (hostname[0])
{
- snprintf(crtfile, sizeof(crtfile), "%s/%s.crt", tls_keypath, hostname);
- snprintf(keyfile, sizeof(keyfile), "%s/%s.key", tls_keypath, hostname);
+ http_gnutls_make_path(crtfile, sizeof(crtfile), tls_keypath, hostname, "crt");
+ http_gnutls_make_path(keyfile, sizeof(keyfile), tls_keypath, hostname, "key");
have_creds = !access(crtfile, 0) && !access(keyfile, 0);
}
else if (tls_common_name)
{
- snprintf(crtfile, sizeof(crtfile), "%s/%s.crt", tls_keypath, tls_common_name);
- snprintf(keyfile, sizeof(keyfile), "%s/%s.key", tls_keypath, tls_common_name);
+ http_gnutls_make_path(crtfile, sizeof(crtfile), tls_keypath, tls_common_name, "crt");
+ http_gnutls_make_path(keyfile, sizeof(keyfile), tls_keypath, tls_common_name, "key");
have_creds = !access(crtfile, 0) && !access(keyfile, 0);
}
}
}
- gnutls_certificate_set_x509_key_file(*credentials, crtfile, keyfile, GNUTLS_X509_FMT_PEM);
+ DEBUG_printf(("4_httpTLSStart: Using certificate \"%s\" and private key \"%s\".", crtfile, keyfile));
+
+ status = gnutls_certificate_set_x509_key_file(*credentials, crtfile, keyfile, GNUTLS_X509_FMT_PEM);
+ }
+
+ if (!status)
+ status = gnutls_credentials_set(http->tls, GNUTLS_CRD_CERTIFICATE, *credentials);
+
+ if (status)
+ {
+ http->error = EIO;
+ http->status = HTTP_STATUS_ERROR;
+
+ DEBUG_printf(("4_httpTLSStart: Unable to complete client/server setup: %s", gnutls_strerror(status)));
+ _cupsSetError(IPP_STATUS_ERROR_CUPS_PKI, gnutls_strerror(status), 0);
+
+ gnutls_deinit(http->tls);
+ gnutls_certificate_free_credentials(*credentials);
+ free(credentials);
+ http->tls = NULL;
+
+ return (-1);
}
+ strlcpy(priority_string, "NORMAL", sizeof(priority_string));
+
+ if (tls_options & _HTTP_TLS_DENY_TLS10)
+ strlcat(priority_string, ":+VERS-TLS-ALL:-VERS-TLS1.0:-VERS-SSL3.0", sizeof(priority_string));
+ else if (tls_options & _HTTP_TLS_ALLOW_SSL3)
+ strlcat(priority_string, ":+VERS-TLS-ALL", sizeof(priority_string));
+ else
+ strlcat(priority_string, ":+VERS-TLS-ALL:-VERS-SSL3.0", sizeof(priority_string));
+
+ if (!(tls_options & _HTTP_TLS_ALLOW_RC4))
+ strlcat(priority_string, ":-ARCFOUR-128", sizeof(priority_string));
+
+ if (!(tls_options & _HTTP_TLS_ALLOW_DH))
+ strlcat(priority_string, ":!ANON-DH", sizeof(priority_string));
+
+#ifdef HAVE_GNUTLS_PRIORITY_SET_DIRECT
+ gnutls_priority_set_direct(http->tls, priority_string, NULL);
+
+#else
+ gnutls_priority_t priority; /* Priority */
+
+ gnutls_priority_init(&priority, priority_string, NULL);
+ gnutls_priority_set(http->tls, priority);
+ gnutls_priority_deinit(priority);
+#endif /* HAVE_GNUTLS_PRIORITY_SET_DIRECT */
+
+ gnutls_transport_set_ptr(http->tls, (gnutls_transport_ptr_t)http);
+ gnutls_transport_set_pull_function(http->tls, http_gnutls_read);
+#ifdef HAVE_GNUTLS_TRANSPORT_SET_PULL_TIMEOUT_FUNCTION
+ gnutls_transport_set_pull_timeout_function(http->tls, (gnutls_pull_timeout_func)httpWait);
+#endif /* HAVE_GNUTLS_TRANSPORT_SET_PULL_TIMEOUT_FUNCTION */
+ gnutls_transport_set_push_function(http->tls, http_gnutls_write);
+
while ((status = gnutls_handshake(http->tls)) != GNUTLS_E_SUCCESS)
{
- DEBUG_printf(("8_httpStartTLS: gnutls_handshake returned %d (%s)",
+ DEBUG_printf(("5_httpStartTLS: gnutls_handshake returned %d (%s)",
status, gnutls_strerror(status)));
if (gnutls_error_is_fatal(status))
http->tls_credentials = credentials;
- // TODO: Put this in the right place; no-op for now, this to get things to compile
-// http_tls_set_credentials(http);
-
return (0);
}
int error; /* Error code */
- error = gnutls_bye(http->tls, http->mode == _HTTP_CLIENT ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR);
+ error = gnutls_bye(http->tls, http->mode == _HTTP_MODE_CLIENT ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR);
if (error != GNUTLS_E_SUCCESS)
- _cupsSetError(IPP_STATUS_ERROR, gnutls_strerror(errno), 0);
+ _cupsSetError(IPP_STATUS_ERROR_INTERNAL, gnutls_strerror(errno), 0);
gnutls_deinit(http->tls);
http->tls = NULL;
- gnutls_certificate_free_credentials(*(http->tls_credentials));
- free(http->tls_credentials);
- http->tls_credentials = NULL;
+ if (http->tls_credentials)
+ {
+ gnutls_certificate_free_credentials(*(http->tls_credentials));
+ free(http->tls_credentials);
+ http->tls_credentials = NULL;
+ }
}
return ((int)result);
}
-
-
-#if 0
-/*
- * 'cupsdEndTLS()' - Shutdown a secure session with the client.
- */
-
-int /* O - 1 on success, 0 on error */
-cupsdEndTLS(cupsd_client_t *con) /* I - Client connection */
-{
- int error; /* Error code */
- gnutls_certificate_server_credentials *credentials;
- /* TLS credentials */
-
-
- credentials = (gnutls_certificate_server_credentials *)
- (con->http.tls_credentials);
-
- error = gnutls_bye(con->http.tls, GNUTLS_SHUT_WR);
- switch (error)
- {
- case GNUTLS_E_SUCCESS:
- cupsdLogMessage(CUPSD_LOG_DEBUG,
- "SSL shutdown successful!");
- break;
- default:
- cupsdLogMessage(CUPSD_LOG_ERROR,
- "SSL shutdown failed: %s", gnutls_strerror(error));
- break;
- }
-
- gnutls_deinit(con->http.tls);
- con->http.tls = NULL;
-
- gnutls_certificate_free_credentials(*credentials);
- free(credentials);
-
- return (1);
-}
-
-
-/*
- * 'cupsdStartTLS()' - Start a secure session with the client.
- */
-
-int /* O - 1 on success, 0 on error */
-cupsdStartTLS(cupsd_client_t *con) /* I - Client connection */
-{
- int status; /* Error code */
- gnutls_certificate_credentials_t *credentials;
- /* TLS credentials */
-
-
- cupsdLogMessage(CUPSD_LOG_DEBUG, "[Client %d] Encrypting connection.",
- con->http.fd);
-
- /*
- * Verify that we have a certificate...
- */
-
- if (access(ServerKey, 0) || access(ServerCertificate, 0))
- {
- /*
- * Nope, make a self-signed certificate...
- */
-
- if (!make_certificate(con))
- return (0);
- }
-
- /*
- * Create the SSL object and perform the SSL handshake...
- */
-
- credentials = (gnutls_certificate_credentials_t *)
- malloc(sizeof(gnutls_certificate_credentials_t));
- if (credentials == NULL)
- {
- cupsdLogMessage(CUPSD_LOG_ERROR,
- "Unable to encrypt connection from %s - %s",
- con->http.hostname, strerror(errno));
-
- return (0);
- }
-
- gnutls_certificate_allocate_credentials(credentials);
- gnutls_certificate_set_x509_key_file(*credentials, ServerCertificate,
- ServerKey, GNUTLS_X509_FMT_PEM);
-
- gnutls_init(&con->http.tls, GNUTLS_SERVER);
- gnutls_set_default_priority(con->http.tls);
-
- gnutls_credentials_set(con->http.tls, GNUTLS_CRD_CERTIFICATE, *credentials);
- gnutls_transport_set_ptr(con->http.tls, (gnutls_transport_ptr_t)HTTP(con));
- gnutls_transport_set_pull_function(con->http.tls, http_gnutls_read);
- gnutls_transport_set_push_function(con->http.tls, http_gnutls_write);
-
- while ((status = gnutls_handshake(con->http.tls)) != GNUTLS_E_SUCCESS)
- {
- if (gnutls_error_is_fatal(status))
- {
- cupsdLogMessage(CUPSD_LOG_ERROR,
- "Unable to encrypt connection from %s - %s",
- con->http.hostname, gnutls_strerror(status));
-
- gnutls_deinit(con->http.tls);
- gnutls_certificate_free_credentials(*credentials);
- con->http.tls = NULL;
- free(credentials);
- return (0);
- }
- }
-
- cupsdLogMessage(CUPSD_LOG_DEBUG, "Connection from %s now encrypted.",
- con->http.hostname);
-
- con->http.tls_credentials = credentials;
- return (1);
-}
-
-
-/*
- * 'make_certificate()' - Make a self-signed SSL/TLS certificate.
- */
-
-static int /* O - 1 on success, 0 on failure */
-make_certificate(cupsd_client_t *con) /* I - Client connection */
-{
- gnutls_x509_crt crt; /* Self-signed certificate */
- gnutls_x509_privkey key; /* Encryption key */
- cups_lang_t *language; /* Default language info */
- cups_file_t *fp; /* Key/cert file */
- unsigned char buffer[8192]; /* Buffer for x509 data */
- size_t bytes; /* Number of bytes of data */
- unsigned char serial[4]; /* Serial number buffer */
- time_t curtime; /* Current time */
- int result; /* Result of GNU TLS calls */
-
-
- /*
- * Create the encryption key...
- */
-
- cupsdLogMessage(CUPSD_LOG_INFO, "Generating SSL server key...");
-
- gnutls_x509_privkey_init(&key);
- gnutls_x509_privkey_generate(key, GNUTLS_PK_RSA, 2048, 0);
-
- /*
- * Save it...
- */
-
- bytes = sizeof(buffer);
-
- if ((result = gnutls_x509_privkey_export(key, GNUTLS_X509_FMT_PEM,
- buffer, &bytes)) < 0)
- {
- cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to export SSL server key - %s",
- gnutls_strerror(result));
- gnutls_x509_privkey_deinit(key);
- return (0);
- }
- else if ((fp = cupsFileOpen(ServerKey, "w")) != NULL)
- {
- cupsFileWrite(fp, (char *)buffer, bytes);
- cupsFileClose(fp);
-
- cupsdLogMessage(CUPSD_LOG_INFO, "Created SSL server key file \"%s\"...",
- ServerKey);
- }
- else
- {
- cupsdLogMessage(CUPSD_LOG_ERROR,
- "Unable to create SSL server key file \"%s\" - %s",
- ServerKey, strerror(errno));
- gnutls_x509_privkey_deinit(key);
- return (0);
- }
-
- /*
- * Create the self-signed certificate...
- */
-
- cupsdLogMessage(CUPSD_LOG_INFO, "Generating self-signed SSL certificate...");
-
- language = cupsLangDefault();
- curtime = time(NULL);
- serial[0] = curtime >> 24;
- serial[1] = curtime >> 16;
- serial[2] = curtime >> 8;
- serial[3] = curtime;
-
- gnutls_x509_crt_init(&crt);
- if (strlen(language->language) == 5)
- gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_COUNTRY_NAME, 0,
- language->language + 3, 2);
- else
- gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_COUNTRY_NAME, 0,
- "US", 2);
- gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_COMMON_NAME, 0,
- ServerName, strlen(ServerName));
- gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_ORGANIZATION_NAME, 0,
- ServerName, strlen(ServerName));
- gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_ORGANIZATIONAL_UNIT_NAME,
- 0, "Unknown", 7);
- gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_STATE_OR_PROVINCE_NAME, 0,
- "Unknown", 7);
- gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_LOCALITY_NAME, 0,
- "Unknown", 7);
- gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_PKCS9_EMAIL, 0,
- ServerAdmin, strlen(ServerAdmin));
- gnutls_x509_crt_set_key(crt, key);
- gnutls_x509_crt_set_serial(crt, serial, sizeof(serial));
- gnutls_x509_crt_set_activation_time(crt, curtime);
- gnutls_x509_crt_set_expiration_time(crt, curtime + 10 * 365 * 86400);
- gnutls_x509_crt_set_ca_status(crt, 0);
- gnutls_x509_crt_set_subject_alternative_name(crt, GNUTLS_SAN_DNSNAME,
- ServerName);
- gnutls_x509_crt_set_key_purpose_oid(crt, GNUTLS_KP_TLS_WWW_SERVER, 0);
- gnutls_x509_crt_set_key_usage(crt, GNUTLS_KEY_KEY_ENCIPHERMENT);
- gnutls_x509_crt_set_version(crt, 3);
-
- bytes = sizeof(buffer);
- if (gnutls_x509_crt_get_key_id(crt, 0, buffer, &bytes) >= 0)
- gnutls_x509_crt_set_subject_key_id(crt, buffer, bytes);
-
- gnutls_x509_crt_sign(crt, crt, key);
-
- /*
- * Save it...
- */
-
- bytes = sizeof(buffer);
- if ((result = gnutls_x509_crt_export(crt, GNUTLS_X509_FMT_PEM,
- buffer, &bytes)) < 0)
- cupsdLogMessage(CUPSD_LOG_ERROR,
- "Unable to export SSL server certificate - %s",
- gnutls_strerror(result));
- else if ((fp = cupsFileOpen(ServerCertificate, "w")) != NULL)
- {
- cupsFileWrite(fp, (char *)buffer, bytes);
- cupsFileClose(fp);
-
- cupsdLogMessage(CUPSD_LOG_INFO,
- "Created SSL server certificate file \"%s\"...",
- ServerCertificate);
- }
- else
- cupsdLogMessage(CUPSD_LOG_ERROR,
- "Unable to create SSL server certificate file \"%s\" - %s",
- ServerCertificate, strerror(errno));
-
- /*
- * Cleanup...
- */
-
- gnutls_x509_crt_deinit(crt);
- gnutls_x509_privkey_deinit(key);
-
- return (1);
-}
-#endif /* 0 */
-
-
-/*
- * End of "$Id$".
- */
projects / thirdparty / cups.git / blobdiff