source4/lib/tls/tls_tstream.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Stefan Metzmacher 2010
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "system/network.h"
  22 #include "system/filesys.h"
  23 #include "system/time.h"
  24 #include "lib/util/util_file.h"
  25 #include "../util/tevent_unix.h"
  26 #include "../lib/tsocket/tsocket.h"
  27 #include "../lib/tsocket/tsocket_internal.h"
  28 #include "../lib/util/util_net.h"
  29 #include "lib/tls/tls.h"
  30
  31 #include <gnutls/gnutls.h>
  32 #include <gnutls/x509.h>
  33 #include "lib/crypto/gnutls_helpers.h"
  34
  35 #define DH_BITS 2048
  36
  37 const char *tls_verify_peer_string(enum tls_verify_peer_state verify_peer)
  38 {
  39         switch (verify_peer) {
  40         case TLS_VERIFY_PEER_NO_CHECK:
  41                 return TLS_VERIFY_PEER_NO_CHECK_STRING;
  42
  43         case TLS_VERIFY_PEER_CA_ONLY:
  44                 return TLS_VERIFY_PEER_CA_ONLY_STRING;
  45
  46         case TLS_VERIFY_PEER_CA_AND_NAME_IF_AVAILABLE:
  47                 return TLS_VERIFY_PEER_CA_AND_NAME_IF_AVAILABLE_STRING;
  48
  49         case TLS_VERIFY_PEER_CA_AND_NAME:
  50                 return TLS_VERIFY_PEER_CA_AND_NAME_STRING;
  51
  52         case TLS_VERIFY_PEER_AS_STRICT_AS_POSSIBLE:
  53                 return TLS_VERIFY_PEER_AS_STRICT_AS_POSSIBLE_STRING;
  54         }
  55
  56         return "unknown tls_verify_peer_state";
  57 }
  58
  59 static const struct tstream_context_ops tstream_tls_ops;
  60
  61 struct tstream_tls {
  62         struct tstream_context *plain_stream;
  63         int error;
  64
  65         gnutls_session_t tls_session;
  66
  67         bool is_server;
  68
  69         enum tls_verify_peer_state verify_peer;
  70         const char *peer_name;
  71
  72         struct tevent_context *current_ev;
  73
  74         struct tevent_immediate *retry_im;
  75
  76         struct {
  77                 struct tevent_req *mgmt_req;
  78         } waiting_flush;
  79
  80         struct {
  81                 uint8_t *buf;
  82                 off_t ofs;
  83                 struct iovec iov;
  84                 struct tevent_req *subreq;
  85         } push;
  86
  87         struct {
  88                 uint8_t *buf;
  89                 struct iovec iov;
  90                 struct tevent_req *subreq;
  91         } pull;
  92
  93         struct {
  94                 struct tevent_req *req;
  95         } handshake;
  96
  97         struct {
  98                 off_t ofs;
  99                 size_t left;
 100                 uint8_t buffer[1024];
 101                 struct tevent_req *req;
 102         } write;
 103
 104         struct {
 105                 off_t ofs;
 106                 size_t left;
 107                 uint8_t buffer[1024];
 108                 struct tevent_req *req;
 109         } read;
 110
 111         struct {
 112                 struct tevent_req *req;
 113         } disconnect;
 114 };
 115
 116 static void tstream_tls_retry_handshake(struct tstream_context *stream);
 117 static void tstream_tls_retry_read(struct tstream_context *stream);
 118 static void tstream_tls_retry_write(struct tstream_context *stream);
 119 static void tstream_tls_retry_disconnect(struct tstream_context *stream);
 120 static void tstream_tls_retry_trigger(struct tevent_context *ctx,
 121                                       struct tevent_immediate *im,
 122                                       void *private_data);
 123
 124 static void tstream_tls_retry(struct tstream_context *stream, bool deferred)
 125 {
 126
 127         struct tstream_tls *tlss =
 128                 tstream_context_data(stream,
 129                 struct tstream_tls);
 130
 131         if (tlss->push.subreq == NULL && tlss->pull.subreq == NULL) {
 132                 if (tlss->waiting_flush.mgmt_req != NULL) {
 133                         struct tevent_req *req = tlss->waiting_flush.mgmt_req;
 134
 135                         tlss->waiting_flush.mgmt_req = NULL;
 136
 137                         tevent_req_done(req);
 138                         return;
 139                 }
 140         }
 141
 142         if (tlss->disconnect.req) {
 143                 tstream_tls_retry_disconnect(stream);
 144                 return;
 145         }
 146
 147         if (tlss->handshake.req) {
 148                 tstream_tls_retry_handshake(stream);
 149                 return;
 150         }
 151
 152         if (tlss->write.req && tlss->read.req && !deferred) {
 153                 tevent_schedule_immediate(tlss->retry_im, tlss->current_ev,
 154                                           tstream_tls_retry_trigger,
 155                                           stream);
 156         }
 157
 158         if (tlss->write.req) {
 159                 tstream_tls_retry_write(stream);
 160                 return;
 161         }
 162
 163         if (tlss->read.req) {
 164                 tstream_tls_retry_read(stream);
 165                 return;
 166         }
 167 }
 168
 169 static void tstream_tls_retry_trigger(struct tevent_context *ctx,
 170                                       struct tevent_immediate *im,
 171                                       void *private_data)
 172 {
 173         struct tstream_context *stream =
 174                 talloc_get_type_abort(private_data,
 175                 struct tstream_context);
 176
 177         tstream_tls_retry(stream, true);
 178 }
 179
 180 static void tstream_tls_push_done(struct tevent_req *subreq);
 181
 182 static ssize_t tstream_tls_push_function(gnutls_transport_ptr_t ptr,
 183                                          const void *buf, size_t size)
 184 {
 185         struct tstream_context *stream =
 186                 talloc_get_type_abort(ptr,
 187                 struct tstream_context);
 188         struct tstream_tls *tlss =
 189                 tstream_context_data(stream,
 190                 struct tstream_tls);
 191         struct tevent_req *subreq = NULL;
 192         uint8_t *nbuf;
 193         size_t len;
 194
 195         if (tlss->error != 0) {
 196                 errno = tlss->error;
 197                 return -1;
 198         }
 199
 200         if (tlss->push.subreq) {
 201                 errno = EAGAIN;
 202                 return -1;
 203         }
 204
 205         len = MIN(size, UINT16_MAX - tlss->push.ofs);
 206
 207         if (len == 0) {
 208                 errno = EAGAIN;
 209                 return -1;
 210         }
 211
 212         nbuf = talloc_realloc(tlss, tlss->push.buf,
 213                               uint8_t, tlss->push.ofs + len);
 214         if (nbuf == NULL) {
 215                 if (tlss->push.buf) {
 216                         errno = EAGAIN;
 217                         return -1;
 218                 }
 219
 220                 return -1;
 221         }
 222         tlss->push.buf = nbuf;
 223
 224         memcpy(tlss->push.buf + tlss->push.ofs, buf, len);
 225         tlss->push.ofs += len;
 226
 227         tlss->push.iov.iov_base = (char *)tlss->push.buf;
 228         tlss->push.iov.iov_len = tlss->push.ofs;
 229
 230         subreq = tstream_writev_send(tlss,
 231                                      tlss->current_ev,
 232                                      tlss->plain_stream,
 233                                      &tlss->push.iov, 1);
 234         if (subreq == NULL) {
 235                 errno = ENOMEM;
 236                 return -1;
 237         }
 238         tevent_req_set_callback(subreq, tstream_tls_push_done, stream);
 239
 240         tlss->push.subreq = subreq;
 241         return len;
 242 }
 243
 244 static void tstream_tls_push_done(struct tevent_req *subreq)
 245 {
 246         struct tstream_context *stream =
 247                 tevent_req_callback_data(subreq,
 248                 struct tstream_context);
 249         struct tstream_tls *tlss =
 250                 tstream_context_data(stream,
 251                 struct tstream_tls);
 252         int ret;
 253         int sys_errno;
 254
 255         tlss->push.subreq = NULL;
 256         ZERO_STRUCT(tlss->push.iov);
 257         TALLOC_FREE(tlss->push.buf);
 258         tlss->push.ofs = 0;
 259
 260         ret = tstream_writev_recv(subreq, &sys_errno);
 261         TALLOC_FREE(subreq);
 262         if (ret == -1) {
 263                 tlss->error = sys_errno;
 264                 tstream_tls_retry(stream, false);
 265                 return;
 266         }
 267
 268         tstream_tls_retry(stream, false);
 269 }
 270
 271 static void tstream_tls_pull_done(struct tevent_req *subreq);
 272
 273 static ssize_t tstream_tls_pull_function(gnutls_transport_ptr_t ptr,
 274                                          void *buf, size_t size)
 275 {
 276         struct tstream_context *stream =
 277                 talloc_get_type_abort(ptr,
 278                 struct tstream_context);
 279         struct tstream_tls *tlss =
 280                 tstream_context_data(stream,
 281                 struct tstream_tls);
 282         struct tevent_req *subreq;
 283         size_t len;
 284
 285         if (tlss->error != 0) {
 286                 errno = tlss->error;
 287                 return -1;
 288         }
 289
 290         if (tlss->pull.subreq) {
 291                 errno = EAGAIN;
 292                 return -1;
 293         }
 294
 295         if (tlss->pull.iov.iov_base) {
 296                 uint8_t *b;
 297                 size_t n;
 298
 299                 b = (uint8_t *)tlss->pull.iov.iov_base;
 300
 301                 n = MIN(tlss->pull.iov.iov_len, size);
 302                 memcpy(buf, b, n);
 303
 304                 tlss->pull.iov.iov_len -= n;
 305                 b += n;
 306                 tlss->pull.iov.iov_base = (char *)b;
 307                 if (tlss->pull.iov.iov_len == 0) {
 308                         tlss->pull.iov.iov_base = NULL;
 309                         TALLOC_FREE(tlss->pull.buf);
 310                 }
 311
 312                 return n;
 313         }
 314
 315         if (size == 0) {
 316                 return 0;
 317         }
 318
 319         len = MIN(size, UINT16_MAX);
 320
 321         tlss->pull.buf = talloc_array(tlss, uint8_t, len);
 322         if (tlss->pull.buf == NULL) {
 323                 return -1;
 324         }
 325
 326         tlss->pull.iov.iov_base = (char *)tlss->pull.buf;
 327         tlss->pull.iov.iov_len = len;
 328
 329         subreq = tstream_readv_send(tlss,
 330                                     tlss->current_ev,
 331                                     tlss->plain_stream,
 332                                     &tlss->pull.iov, 1);
 333         if (subreq == NULL) {
 334                 errno = ENOMEM;
 335                 return -1;
 336         }
 337         tevent_req_set_callback(subreq, tstream_tls_pull_done, stream);
 338
 339         tlss->pull.subreq = subreq;
 340         errno = EAGAIN;
 341         return -1;
 342 }
 343
 344 static void tstream_tls_pull_done(struct tevent_req *subreq)
 345 {
 346         struct tstream_context *stream =
 347                 tevent_req_callback_data(subreq,
 348                 struct tstream_context);
 349         struct tstream_tls *tlss =
 350                 tstream_context_data(stream,
 351                 struct tstream_tls);
 352         int ret;
 353         int sys_errno;
 354
 355         tlss->pull.subreq = NULL;
 356
 357         ret = tstream_readv_recv(subreq, &sys_errno);
 358         TALLOC_FREE(subreq);
 359         if (ret == -1) {
 360                 tlss->error = sys_errno;
 361                 tstream_tls_retry(stream, false);
 362                 return;
 363         }
 364
 365         tstream_tls_retry(stream, false);
 366 }
 367
 368 static int tstream_tls_destructor(struct tstream_tls *tlss)
 369 {
 370         if (tlss->tls_session) {
 371                 gnutls_deinit(tlss->tls_session);
 372                 tlss->tls_session = NULL;
 373         }
 374
 375         return 0;
 376 }
 377
 378 static ssize_t tstream_tls_pending_bytes(struct tstream_context *stream)
 379 {
 380         struct tstream_tls *tlss =
 381                 tstream_context_data(stream,
 382                 struct tstream_tls);
 383         size_t ret;
 384
 385         if (tlss->error != 0) {
 386                 errno = tlss->error;
 387                 return -1;
 388         }
 389
 390         ret = gnutls_record_check_pending(tlss->tls_session);
 391         ret += tlss->read.left;
 392
 393         return ret;
 394 }
 395
 396 struct tstream_tls_readv_state {
 397         struct tstream_context *stream;
 398
 399         struct iovec *vector;
 400         int count;
 401
 402         int ret;
 403 };
 404
 405 static void tstream_tls_readv_crypt_next(struct tevent_req *req);
 406
 407 static struct tevent_req *tstream_tls_readv_send(TALLOC_CTX *mem_ctx,
 408                                         struct tevent_context *ev,
 409                                         struct tstream_context *stream,
 410                                         struct iovec *vector,
 411                                         size_t count)
 412 {
 413         struct tstream_tls *tlss =
 414                 tstream_context_data(stream,
 415                 struct tstream_tls);
 416         struct tevent_req *req;
 417         struct tstream_tls_readv_state *state;
 418
 419         tlss->read.req = NULL;
 420
 421         if (tlss->current_ev != ev) {
 422                 SMB_ASSERT(tlss->push.subreq == NULL);
 423                 SMB_ASSERT(tlss->pull.subreq == NULL);
 424         }
 425
 426         tlss->current_ev = ev;
 427
 428         req = tevent_req_create(mem_ctx, &state,
 429                                 struct tstream_tls_readv_state);
 430         if (req == NULL) {
 431                 return NULL;
 432         }
 433
 434         state->stream = stream;
 435         state->ret = 0;
 436
 437         if (tlss->error != 0) {
 438                 tevent_req_error(req, tlss->error);
 439                 return tevent_req_post(req, ev);
 440         }
 441
 442         /*
 443          * we make a copy of the vector so we can change the structure
 444          */
 445         state->vector = talloc_array(state, struct iovec, count);
 446         if (tevent_req_nomem(state->vector, req)) {
 447                 return tevent_req_post(req, ev);
 448         }
 449         memcpy(state->vector, vector, sizeof(struct iovec) * count);
 450         state->count = count;
 451
 452         tstream_tls_readv_crypt_next(req);
 453         if (!tevent_req_is_in_progress(req)) {
 454                 return tevent_req_post(req, ev);
 455         }
 456
 457         return req;
 458 }
 459
 460 static void tstream_tls_readv_crypt_next(struct tevent_req *req)
 461 {
 462         struct tstream_tls_readv_state *state =
 463                 tevent_req_data(req,
 464                 struct tstream_tls_readv_state);
 465         struct tstream_tls *tlss =
 466                 tstream_context_data(state->stream,
 467                 struct tstream_tls);
 468
 469         /*
 470          * copy the pending buffer first
 471          */
 472         while (tlss->read.left > 0 && state->count > 0) {
 473                 uint8_t *base = (uint8_t *)state->vector[0].iov_base;
 474                 size_t len = MIN(tlss->read.left, state->vector[0].iov_len);
 475
 476                 memcpy(base, tlss->read.buffer + tlss->read.ofs, len);
 477
 478                 base += len;
 479                 state->vector[0].iov_base = (char *) base;
 480                 state->vector[0].iov_len -= len;
 481
 482                 tlss->read.ofs += len;
 483                 tlss->read.left -= len;
 484
 485                 if (state->vector[0].iov_len == 0) {
 486                         state->vector += 1;
 487                         state->count -= 1;
 488                 }
 489
 490                 state->ret += len;
 491         }
 492
 493         if (state->count == 0) {
 494                 tevent_req_done(req);
 495                 return;
 496         }
 497
 498         tlss->read.req = req;
 499         tstream_tls_retry_read(state->stream);
 500 }
 501
 502 static void tstream_tls_retry_read(struct tstream_context *stream)
 503 {
 504         struct tstream_tls *tlss =
 505                 tstream_context_data(stream,
 506                 struct tstream_tls);
 507         struct tevent_req *req = tlss->read.req;
 508         int ret;
 509
 510         if (tlss->error != 0) {
 511                 tevent_req_error(req, tlss->error);
 512                 return;
 513         }
 514
 515         tlss->read.left = 0;
 516         tlss->read.ofs = 0;
 517
 518         ret = gnutls_record_recv(tlss->tls_session,
 519                                  tlss->read.buffer,
 520                                  sizeof(tlss->read.buffer));
 521         if (ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN) {
 522                 return;
 523         }
 524
 525         tlss->read.req = NULL;
 526
 527         if (gnutls_error_is_fatal(ret) != 0) {
 528                 DEBUG(1,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
 529                 tlss->error = EIO;
 530                 tevent_req_error(req, tlss->error);
 531                 return;
 532         }
 533
 534         if (ret == 0) {
 535                 tlss->error = EPIPE;
 536                 tevent_req_error(req, tlss->error);
 537                 return;
 538         }
 539
 540         tlss->read.left = ret;
 541         tstream_tls_readv_crypt_next(req);
 542 }
 543
 544 static int tstream_tls_readv_recv(struct tevent_req *req,
 545                                   int *perrno)
 546 {
 547         struct tstream_tls_readv_state *state =
 548                 tevent_req_data(req,
 549                 struct tstream_tls_readv_state);
 550         struct tstream_tls *tlss =
 551                 tstream_context_data(state->stream,
 552                 struct tstream_tls);
 553         int ret;
 554
 555         tlss->read.req = NULL;
 556
 557         ret = tsocket_simple_int_recv(req, perrno);
 558         if (ret == 0) {
 559                 ret = state->ret;
 560         }
 561
 562         tevent_req_received(req);
 563         return ret;
 564 }
 565
 566 struct tstream_tls_writev_state {
 567         struct tstream_context *stream;
 568
 569         struct iovec *vector;
 570         int count;
 571
 572         int ret;
 573 };
 574
 575 static void tstream_tls_writev_crypt_next(struct tevent_req *req);
 576
 577 static struct tevent_req *tstream_tls_writev_send(TALLOC_CTX *mem_ctx,
 578                                         struct tevent_context *ev,
 579                                         struct tstream_context *stream,
 580                                         const struct iovec *vector,
 581                                         size_t count)
 582 {
 583         struct tstream_tls *tlss =
 584                 tstream_context_data(stream,
 585                 struct tstream_tls);
 586         struct tevent_req *req;
 587         struct tstream_tls_writev_state *state;
 588
 589         tlss->write.req = NULL;
 590
 591         if (tlss->current_ev != ev) {
 592                 SMB_ASSERT(tlss->push.subreq == NULL);
 593                 SMB_ASSERT(tlss->pull.subreq == NULL);
 594         }
 595
 596         tlss->current_ev = ev;
 597
 598         req = tevent_req_create(mem_ctx, &state,
 599                                 struct tstream_tls_writev_state);
 600         if (req == NULL) {
 601                 return NULL;
 602         }
 603
 604         state->stream = stream;
 605         state->ret = 0;
 606
 607         if (tlss->error != 0) {
 608                 tevent_req_error(req, tlss->error);
 609                 return tevent_req_post(req, ev);
 610         }
 611
 612         /*
 613          * we make a copy of the vector so we can change the structure
 614          */
 615         state->vector = talloc_array(state, struct iovec, count);
 616         if (tevent_req_nomem(state->vector, req)) {
 617                 return tevent_req_post(req, ev);
 618         }
 619         memcpy(state->vector, vector, sizeof(struct iovec) * count);
 620         state->count = count;
 621
 622         tstream_tls_writev_crypt_next(req);
 623         if (!tevent_req_is_in_progress(req)) {
 624                 return tevent_req_post(req, ev);
 625         }
 626
 627         return req;
 628 }
 629
 630 static void tstream_tls_writev_crypt_next(struct tevent_req *req)
 631 {
 632         struct tstream_tls_writev_state *state =
 633                 tevent_req_data(req,
 634                 struct tstream_tls_writev_state);
 635         struct tstream_tls *tlss =
 636                 tstream_context_data(state->stream,
 637                 struct tstream_tls);
 638
 639         tlss->write.left = sizeof(tlss->write.buffer);
 640         tlss->write.ofs = 0;
 641
 642         /*
 643          * first fill our buffer
 644          */
 645         while (tlss->write.left > 0 && state->count > 0) {
 646                 uint8_t *base = (uint8_t *)state->vector[0].iov_base;
 647                 size_t len = MIN(tlss->write.left, state->vector[0].iov_len);
 648
 649                 memcpy(tlss->write.buffer + tlss->write.ofs, base, len);
 650
 651                 base += len;
 652                 state->vector[0].iov_base = (char *) base;
 653                 state->vector[0].iov_len -= len;
 654
 655                 tlss->write.ofs += len;
 656                 tlss->write.left -= len;
 657
 658                 if (state->vector[0].iov_len == 0) {
 659                         state->vector += 1;
 660                         state->count -= 1;
 661                 }
 662
 663                 state->ret += len;
 664         }
 665
 666         if (tlss->write.ofs == 0) {
 667                 tevent_req_done(req);
 668                 return;
 669         }
 670
 671         tlss->write.left = tlss->write.ofs;
 672         tlss->write.ofs = 0;
 673
 674         tlss->write.req = req;
 675         tstream_tls_retry_write(state->stream);
 676 }
 677
 678 static void tstream_tls_retry_write(struct tstream_context *stream)
 679 {
 680         struct tstream_tls *tlss =
 681                 tstream_context_data(stream,
 682                 struct tstream_tls);
 683         struct tevent_req *req = tlss->write.req;
 684         int ret;
 685
 686         if (tlss->error != 0) {
 687                 tevent_req_error(req, tlss->error);
 688                 return;
 689         }
 690
 691         ret = gnutls_record_send(tlss->tls_session,
 692                                  tlss->write.buffer + tlss->write.ofs,
 693                                  tlss->write.left);
 694         if (ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN) {
 695                 return;
 696         }
 697
 698         tlss->write.req = NULL;
 699
 700         if (gnutls_error_is_fatal(ret) != 0) {
 701                 DEBUG(1,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
 702                 tlss->error = EIO;
 703                 tevent_req_error(req, tlss->error);
 704                 return;
 705         }
 706
 707         if (ret == 0) {
 708                 tlss->error = EPIPE;
 709                 tevent_req_error(req, tlss->error);
 710                 return;
 711         }
 712
 713         tlss->write.ofs += ret;
 714         tlss->write.left -= ret;
 715
 716         if (tlss->write.left > 0) {
 717                 tlss->write.req = req;
 718                 tstream_tls_retry_write(stream);
 719                 return;
 720         }
 721
 722         tstream_tls_writev_crypt_next(req);
 723 }
 724
 725 static int tstream_tls_writev_recv(struct tevent_req *req,
 726                                    int *perrno)
 727 {
 728         struct tstream_tls_writev_state *state =
 729                 tevent_req_data(req,
 730                 struct tstream_tls_writev_state);
 731         struct tstream_tls *tlss =
 732                 tstream_context_data(state->stream,
 733                 struct tstream_tls);
 734         int ret;
 735
 736         tlss->write.req = NULL;
 737
 738         ret = tsocket_simple_int_recv(req, perrno);
 739         if (ret == 0) {
 740                 ret = state->ret;
 741         }
 742
 743         tevent_req_received(req);
 744         return ret;
 745 }
 746
 747 struct tstream_tls_disconnect_state {
 748         uint8_t _dummy;
 749 };
 750
 751 static struct tevent_req *tstream_tls_disconnect_send(TALLOC_CTX *mem_ctx,
 752                                                 struct tevent_context *ev,
 753                                                 struct tstream_context *stream)
 754 {
 755         struct tstream_tls *tlss =
 756                 tstream_context_data(stream,
 757                 struct tstream_tls);
 758         struct tevent_req *req;
 759         struct tstream_tls_disconnect_state *state;
 760
 761         tlss->disconnect.req = NULL;
 762
 763         if (tlss->current_ev != ev) {
 764                 SMB_ASSERT(tlss->push.subreq == NULL);
 765                 SMB_ASSERT(tlss->pull.subreq == NULL);
 766         }
 767
 768         tlss->current_ev = ev;
 769
 770         req = tevent_req_create(mem_ctx, &state,
 771                                 struct tstream_tls_disconnect_state);
 772         if (req == NULL) {
 773                 return NULL;
 774         }
 775
 776         if (tlss->error != 0) {
 777                 tevent_req_error(req, tlss->error);
 778                 return tevent_req_post(req, ev);
 779         }
 780
 781         tlss->disconnect.req = req;
 782         tstream_tls_retry_disconnect(stream);
 783         if (!tevent_req_is_in_progress(req)) {
 784                 return tevent_req_post(req, ev);
 785         }
 786
 787         return req;
 788 }
 789
 790 static void tstream_tls_retry_disconnect(struct tstream_context *stream)
 791 {
 792         struct tstream_tls *tlss =
 793                 tstream_context_data(stream,
 794                 struct tstream_tls);
 795         struct tevent_req *req = tlss->disconnect.req;
 796         int ret;
 797
 798         if (tlss->error != 0) {
 799                 tevent_req_error(req, tlss->error);
 800                 return;
 801         }
 802
 803         ret = gnutls_bye(tlss->tls_session, GNUTLS_SHUT_WR);
 804         if (ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN) {
 805                 return;
 806         }
 807
 808         tlss->disconnect.req = NULL;
 809
 810         if (gnutls_error_is_fatal(ret) != 0) {
 811                 DEBUG(1,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
 812                 tlss->error = EIO;
 813                 tevent_req_error(req, tlss->error);
 814                 return;
 815         }
 816
 817         if (ret != GNUTLS_E_SUCCESS) {
 818                 DEBUG(1,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
 819                 tlss->error = EIO;
 820                 tevent_req_error(req, tlss->error);
 821                 return;
 822         }
 823
 824         if (tlss->push.subreq != NULL || tlss->pull.subreq != NULL) {
 825                 tlss->waiting_flush.mgmt_req = req;
 826                 return;
 827         }
 828
 829         tevent_req_done(req);
 830 }
 831
 832 static int tstream_tls_disconnect_recv(struct tevent_req *req,
 833                                        int *perrno)
 834 {
 835         int ret;
 836
 837         ret = tsocket_simple_int_recv(req, perrno);
 838
 839         tevent_req_received(req);
 840         return ret;
 841 }
 842
 843 static const struct tstream_context_ops tstream_tls_ops = {
 844         .name                   = "tls",
 845
 846         .pending_bytes          = tstream_tls_pending_bytes,
 847
 848         .readv_send             = tstream_tls_readv_send,
 849         .readv_recv             = tstream_tls_readv_recv,
 850
 851         .writev_send            = tstream_tls_writev_send,
 852         .writev_recv            = tstream_tls_writev_recv,
 853
 854         .disconnect_send        = tstream_tls_disconnect_send,
 855         .disconnect_recv        = tstream_tls_disconnect_recv,
 856 };
 857
 858 struct tstream_tls_params_internal {
 859         gnutls_certificate_credentials_t x509_cred;
 860         gnutls_dh_params_t dh_params;
 861         const char *tls_priority;
 862         bool tls_enabled;
 863         enum tls_verify_peer_state verify_peer;
 864         const char *peer_name;
 865 };
 866
 867 struct tstream_tls_params {
 868         struct tstream_tls_params_internal *internal;
 869 };
 870
 871 static int tstream_tls_params_internal_destructor(struct tstream_tls_params_internal *tlsp)
 872 {
 873         if (tlsp->x509_cred) {
 874                 gnutls_certificate_free_credentials(tlsp->x509_cred);
 875                 tlsp->x509_cred = NULL;
 876         }
 877         if (tlsp->dh_params) {
 878                 gnutls_dh_params_deinit(tlsp->dh_params);
 879                 tlsp->dh_params = NULL;
 880         }
 881
 882         return 0;
 883 }
 884
 885 bool tstream_tls_params_enabled(struct tstream_tls_params *tls_params)
 886 {
 887         struct tstream_tls_params_internal *tlsp = tls_params->internal;
 888
 889         return tlsp->tls_enabled;
 890 }
 891
 892 NTSTATUS tstream_tls_params_client(TALLOC_CTX *mem_ctx,
 893                                    const char *ca_file,
 894                                    const char *crl_file,
 895                                    const char *tls_priority,
 896                                    enum tls_verify_peer_state verify_peer,
 897                                    const char *peer_name,
 898                                    struct tstream_tls_params **_tlsp)
 899 {
 900         struct tstream_tls_params *__tlsp = NULL;
 901         struct tstream_tls_params_internal *tlsp = NULL;
 902         int ret;
 903
 904         __tlsp = talloc_zero(mem_ctx, struct tstream_tls_params);
 905         if (__tlsp == NULL) {
 906                 return NT_STATUS_NO_MEMORY;
 907         }
 908
 909         tlsp = talloc_zero(__tlsp, struct tstream_tls_params_internal);
 910         if (tlsp == NULL) {
 911                 TALLOC_FREE(__tlsp);
 912                 return NT_STATUS_NO_MEMORY;
 913         }
 914         talloc_set_destructor(tlsp, tstream_tls_params_internal_destructor);
 915         __tlsp->internal = tlsp;
 916
 917         tlsp->verify_peer = verify_peer;
 918         if (peer_name != NULL) {
 919                 tlsp->peer_name = talloc_strdup(tlsp, peer_name);
 920                 if (tlsp->peer_name == NULL) {
 921                         TALLOC_FREE(__tlsp);
 922                         return NT_STATUS_NO_MEMORY;
 923                 }
 924         } else if (tlsp->verify_peer >= TLS_VERIFY_PEER_CA_AND_NAME) {
 925                 DEBUG(0,("TLS failed to missing peer_name - "
 926                          "with 'tls verify peer = %s'\n",
 927                          tls_verify_peer_string(tlsp->verify_peer)));
 928                 TALLOC_FREE(__tlsp);
 929                 return NT_STATUS_INVALID_PARAMETER_MIX;
 930         }
 931
 932         ret = gnutls_certificate_allocate_credentials(&tlsp->x509_cred);
 933         if (ret != GNUTLS_E_SUCCESS) {
 934                 DEBUG(0,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
 935                 TALLOC_FREE(__tlsp);
 936                 return NT_STATUS_NO_MEMORY;
 937         }
 938
 939         if (ca_file && *ca_file && file_exist(ca_file)) {
 940                 ret = gnutls_certificate_set_x509_trust_file(tlsp->x509_cred,
 941                                                              ca_file,
 942                                                              GNUTLS_X509_FMT_PEM);
 943                 if (ret < 0) {
 944                         DEBUG(0,("TLS failed to initialise cafile %s - %s\n",
 945                                  ca_file, gnutls_strerror(ret)));
 946                         TALLOC_FREE(__tlsp);
 947                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 948                 }
 949         } else if (tlsp->verify_peer >= TLS_VERIFY_PEER_CA_ONLY) {
 950                 DEBUG(0,("TLS failed to missing cafile %s - "
 951                          "with 'tls verify peer = %s'\n",
 952                          ca_file,
 953                          tls_verify_peer_string(tlsp->verify_peer)));
 954                 TALLOC_FREE(__tlsp);
 955                 return NT_STATUS_INVALID_PARAMETER_MIX;
 956         }
 957
 958         if (crl_file && *crl_file && file_exist(crl_file)) {
 959                 ret = gnutls_certificate_set_x509_crl_file(tlsp->x509_cred,
 960                                                            crl_file,
 961                                                            GNUTLS_X509_FMT_PEM);
 962                 if (ret < 0) {
 963                         DEBUG(0,("TLS failed to initialise crlfile %s - %s\n",
 964                                  crl_file, gnutls_strerror(ret)));
 965                         TALLOC_FREE(__tlsp);
 966                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 967                 }
 968         } else if (tlsp->verify_peer >= TLS_VERIFY_PEER_AS_STRICT_AS_POSSIBLE) {
 969                 DEBUG(0,("TLS failed to missing crlfile %s - "
 970                          "with 'tls verify peer = %s'\n",
 971                          crl_file,
 972                          tls_verify_peer_string(tlsp->verify_peer)));
 973                 TALLOC_FREE(__tlsp);
 974                 return NT_STATUS_INVALID_PARAMETER_MIX;
 975         }
 976
 977         tlsp->tls_priority = talloc_strdup(tlsp, tls_priority);
 978         if (tlsp->tls_priority == NULL) {
 979                 TALLOC_FREE(__tlsp);
 980                 return NT_STATUS_NO_MEMORY;
 981         }
 982
 983         tlsp->tls_enabled = true;
 984
 985         *_tlsp = __tlsp;
 986         return NT_STATUS_OK;
 987 }
 988
 989 static NTSTATUS tstream_tls_prepare_gnutls(struct tstream_tls_params *_tlsp,
 990                                            struct tstream_tls *tlss)
 991 {
 992         struct tstream_tls_params_internal *tlsp = NULL;
 993         int ret;
 994         unsigned int flags;
 995         const char *hostname = NULL;
 996
 997         if (tlss->is_server) {
 998                 flags = GNUTLS_SERVER;
 999         } else {
1000                 flags = GNUTLS_CLIENT;
1001                 /*
1002                  * tls_tstream can't properly handle 'New Session Ticket'
1003                  * messages sent 'after' the client sends the 'Finished'
1004                  * message.  GNUTLS_NO_TICKETS was introduced in GnuTLS 3.5.6.
1005                  * This flag is to indicate the session Flag session should not
1006                  * use resumption with session tickets.
1007                  */
1008                 flags |= GNUTLS_NO_TICKETS;
1009         }
1010
1011         /*
1012          * Note we need to make sure x509_cred and dh_params
1013          * from tstream_tls_params_internal stay alive for
1014          * the whole lifetime of this session!
1015          *
1016          * See 'man gnutls_credentials_set' and
1017          * 'man gnutls_certificate_set_dh_params'.
1018          *
1019          * Note: here we use talloc_reference() in a way
1020          *       that does not expose it to the caller.
1021          */
1022         tlsp = talloc_reference(tlss, _tlsp->internal);
1023         if (tlsp == NULL) {
1024                 return NT_STATUS_NO_MEMORY;
1025         }
1026
1027         tlss->verify_peer = tlsp->verify_peer;
1028         if (tlsp->peer_name != NULL) {
1029                 bool ip = is_ipaddress(tlsp->peer_name);
1030
1031                 tlss->peer_name = talloc_strdup(tlss, tlsp->peer_name);
1032                 if (tlss->peer_name == NULL) {
1033                         return NT_STATUS_NO_MEMORY;
1034                 }
1035
1036                 if (!ip) {
1037                         hostname = tlss->peer_name;
1038                 }
1039
1040                 if (tlss->verify_peer < TLS_VERIFY_PEER_CA_AND_NAME) {
1041                         hostname = NULL;
1042                 }
1043         }
1044
1045         if (tlss->current_ev != NULL) {
1046                 tlss->retry_im = tevent_create_immediate(tlss);
1047                 if (tlss->retry_im == NULL) {
1048                         return NT_STATUS_NO_MEMORY;
1049                 }
1050         }
1051
1052         ret = gnutls_init(&tlss->tls_session, flags);
1053         if (ret != GNUTLS_E_SUCCESS) {
1054                 return gnutls_error_to_ntstatus(ret,
1055                         NT_STATUS_CRYPTO_SYSTEM_INVALID);
1056         }
1057
1058         ret = gnutls_set_default_priority(tlss->tls_session);
1059         if (ret != GNUTLS_E_SUCCESS) {
1060                 return gnutls_error_to_ntstatus(ret,
1061                         NT_STATUS_CRYPTO_SYSTEM_INVALID);
1062         }
1063
1064         if (strlen(tlsp->tls_priority) > 0) {
1065                 const char *error_pos = NULL;
1066
1067                 ret = gnutls_priority_set_direct(tlss->tls_session,
1068                                                  tlsp->tls_priority,
1069                                                  &error_pos);
1070                 if (ret != GNUTLS_E_SUCCESS) {
1071                         return gnutls_error_to_ntstatus(ret,
1072                                 NT_STATUS_CRYPTO_SYSTEM_INVALID);
1073                 }
1074         }
1075
1076         ret = gnutls_credentials_set(tlss->tls_session,
1077                                      GNUTLS_CRD_CERTIFICATE,
1078                                      tlsp->x509_cred);
1079         if (ret != GNUTLS_E_SUCCESS) {
1080                 return gnutls_error_to_ntstatus(ret,
1081                                 NT_STATUS_CRYPTO_SYSTEM_INVALID);
1082         }
1083
1084         if (hostname != NULL) {
1085                 ret = gnutls_server_name_set(tlss->tls_session,
1086                                              GNUTLS_NAME_DNS,
1087                                              hostname,
1088                                              strlen(hostname));
1089                 if (ret != GNUTLS_E_SUCCESS) {
1090                         return gnutls_error_to_ntstatus(ret,
1091                                         NT_STATUS_CRYPTO_SYSTEM_INVALID);
1092                 }
1093         }
1094
1095         if (tlss->is_server) {
1096                 gnutls_certificate_server_set_request(tlss->tls_session,
1097                                                       GNUTLS_CERT_REQUEST);
1098                 gnutls_dh_set_prime_bits(tlss->tls_session, DH_BITS);
1099         }
1100
1101         return NT_STATUS_OK;
1102 }
1103
1104 struct tstream_tls_connect_state {
1105         struct tstream_context *tls_stream;
1106 };
1107
1108 struct tevent_req *_tstream_tls_connect_send(TALLOC_CTX *mem_ctx,
1109                                              struct tevent_context *ev,
1110                                              struct tstream_context *plain_stream,
1111                                              struct tstream_tls_params *_tls_params,
1112                                              const char *location)
1113 {
1114         struct tevent_req *req;
1115         struct tstream_tls_connect_state *state;
1116         struct tstream_tls *tlss;
1117         NTSTATUS status;
1118
1119         req = tevent_req_create(mem_ctx, &state,
1120                                 struct tstream_tls_connect_state);
1121         if (req == NULL) {
1122                 return NULL;
1123         }
1124
1125         state->tls_stream = tstream_context_create(state,
1126                                                    &tstream_tls_ops,
1127                                                    &tlss,
1128                                                    struct tstream_tls,
1129                                                    location);
1130         if (tevent_req_nomem(state->tls_stream, req)) {
1131                 return tevent_req_post(req, ev);
1132         }
1133         ZERO_STRUCTP(tlss);
1134         talloc_set_destructor(tlss, tstream_tls_destructor);
1135         tlss->plain_stream = plain_stream;
1136         tlss->is_server = false;
1137         tlss->current_ev = ev;
1138
1139         status = tstream_tls_prepare_gnutls(_tls_params, tlss);
1140         if (NT_STATUS_EQUAL(status, NT_STATUS_NO_MEMORY)) {
1141                 tevent_req_oom(req);
1142                 return tevent_req_post(req, ev);
1143         }
1144         if (!NT_STATUS_IS_OK(status)) {
1145                 tevent_req_error(req, EINVAL);
1146                 return tevent_req_post(req, ev);
1147         }
1148
1149         gnutls_transport_set_ptr(tlss->tls_session,
1150                                  (gnutls_transport_ptr_t)state->tls_stream);
1151         gnutls_transport_set_pull_function(tlss->tls_session,
1152                                            (gnutls_pull_func)tstream_tls_pull_function);
1153         gnutls_transport_set_push_function(tlss->tls_session,
1154                                            (gnutls_push_func)tstream_tls_push_function);
1155
1156         tlss->handshake.req = req;
1157         tstream_tls_retry_handshake(state->tls_stream);
1158         if (!tevent_req_is_in_progress(req)) {
1159                 return tevent_req_post(req, ev);
1160         }
1161
1162         return req;
1163 }
1164
1165 int tstream_tls_connect_recv(struct tevent_req *req,
1166                              int *perrno,
1167                              TALLOC_CTX *mem_ctx,
1168                              struct tstream_context **tls_stream)
1169 {
1170         struct tstream_tls_connect_state *state =
1171                 tevent_req_data(req,
1172                 struct tstream_tls_connect_state);
1173
1174         if (tevent_req_is_unix_error(req, perrno)) {
1175                 tevent_req_received(req);
1176                 return -1;
1177         }
1178
1179         *tls_stream = talloc_move(mem_ctx, &state->tls_stream);
1180         tevent_req_received(req);
1181         return 0;
1182 }
1183
1184 /*
1185   initialise global tls state
1186 */
1187 NTSTATUS tstream_tls_params_server(TALLOC_CTX *mem_ctx,
1188                                    const char *dns_host_name,
1189                                    bool enabled,
1190                                    const char *key_file,
1191                                    const char *cert_file,
1192                                    const char *ca_file,
1193                                    const char *crl_file,
1194                                    const char *dhp_file,
1195                                    const char *tls_priority,
1196                                    struct tstream_tls_params **_tlsp)
1197 {
1198         struct tstream_tls_params *__tlsp = NULL;
1199         struct tstream_tls_params_internal *tlsp = NULL;
1200         int ret;
1201         struct stat st;
1202
1203         if (!enabled || key_file == NULL || *key_file == 0) {
1204                 __tlsp = talloc_zero(mem_ctx, struct tstream_tls_params);
1205                 if (__tlsp == NULL) {
1206                         return NT_STATUS_NO_MEMORY;
1207                 }
1208
1209                 tlsp = talloc_zero(__tlsp, struct tstream_tls_params_internal);
1210                 if (tlsp == NULL) {
1211                         TALLOC_FREE(__tlsp);
1212                         return NT_STATUS_NO_MEMORY;
1213                 }
1214
1215                 talloc_set_destructor(tlsp, tstream_tls_params_internal_destructor);
1216                 __tlsp->internal = tlsp;
1217                 tlsp->tls_enabled = false;
1218
1219                 *_tlsp = __tlsp;
1220                 return NT_STATUS_OK;
1221         }
1222
1223         __tlsp = talloc_zero(mem_ctx, struct tstream_tls_params);
1224         if (__tlsp == NULL) {
1225                 return NT_STATUS_NO_MEMORY;
1226         }
1227
1228         tlsp = talloc_zero(__tlsp, struct tstream_tls_params_internal);
1229         if (tlsp == NULL) {
1230                 TALLOC_FREE(__tlsp);
1231                 return NT_STATUS_NO_MEMORY;
1232         }
1233
1234         talloc_set_destructor(tlsp, tstream_tls_params_internal_destructor);
1235         __tlsp->internal = tlsp;
1236
1237         if (!file_exist(ca_file)) {
1238                 tls_cert_generate(tlsp, dns_host_name,
1239                                   key_file, cert_file, ca_file);
1240         }
1241
1242         if (file_exist(key_file) &&
1243             !file_check_permissions(key_file, geteuid(), 0600, &st))
1244         {
1245                 DEBUG(0, ("Invalid permissions on TLS private key file '%s':\n"
1246                           "owner uid %u should be %u, mode 0%o should be 0%o\n"
1247                           "This is known as CVE-2013-4476.\n"
1248                           "Removing all tls .pem files will cause an "
1249                           "auto-regeneration with the correct permissions.\n",
1250                           key_file,
1251                           (unsigned int)st.st_uid, geteuid(),
1252                           (unsigned int)(st.st_mode & 0777), 0600));
1253                 TALLOC_FREE(__tlsp);
1254                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1255         }
1256
1257         ret = gnutls_certificate_allocate_credentials(&tlsp->x509_cred);
1258         if (ret != GNUTLS_E_SUCCESS) {
1259                 DEBUG(0,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
1260                 TALLOC_FREE(__tlsp);
1261                 return NT_STATUS_NO_MEMORY;
1262         }
1263
1264         if (ca_file && *ca_file) {
1265                 ret = gnutls_certificate_set_x509_trust_file(tlsp->x509_cred,
1266                                                              ca_file,
1267                                                              GNUTLS_X509_FMT_PEM);
1268                 if (ret < 0) {
1269                         DEBUG(0,("TLS failed to initialise cafile %s - %s\n",
1270                                  ca_file, gnutls_strerror(ret)));
1271                         TALLOC_FREE(__tlsp);
1272                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1273                 }
1274         }
1275
1276         if (crl_file && *crl_file) {
1277                 ret = gnutls_certificate_set_x509_crl_file(tlsp->x509_cred,
1278                                                            crl_file,
1279                                                            GNUTLS_X509_FMT_PEM);
1280                 if (ret < 0) {
1281                         DEBUG(0,("TLS failed to initialise crlfile %s - %s\n",
1282                                  crl_file, gnutls_strerror(ret)));
1283                         TALLOC_FREE(__tlsp);
1284                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1285                 }
1286         }
1287
1288         ret = gnutls_certificate_set_x509_key_file(tlsp->x509_cred,
1289                                                    cert_file, key_file,
1290                                                    GNUTLS_X509_FMT_PEM);
1291         if (ret != GNUTLS_E_SUCCESS) {
1292                 DEBUG(0,("TLS failed to initialise certfile %s and keyfile %s - %s\n",
1293                          cert_file, key_file, gnutls_strerror(ret)));
1294                 TALLOC_FREE(__tlsp);
1295                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1296         }
1297
1298         ret = gnutls_dh_params_init(&tlsp->dh_params);
1299         if (ret != GNUTLS_E_SUCCESS) {
1300                 DEBUG(0,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
1301                 TALLOC_FREE(__tlsp);
1302                 return NT_STATUS_NO_MEMORY;
1303         }
1304
1305         if (dhp_file && *dhp_file) {
1306                 gnutls_datum_t dhparms;
1307                 size_t size;
1308
1309                 dhparms.data = (uint8_t *)file_load(dhp_file, &size, 0, tlsp);
1310
1311                 if (!dhparms.data) {
1312                         DEBUG(0,("TLS failed to read DH Parms from %s - %d:%s\n",
1313                                  dhp_file, errno, strerror(errno)));
1314                         TALLOC_FREE(__tlsp);
1315                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1316                 }
1317                 dhparms.size = size;
1318
1319                 ret = gnutls_dh_params_import_pkcs3(tlsp->dh_params,
1320                                                     &dhparms,
1321                                                     GNUTLS_X509_FMT_PEM);
1322                 if (ret != GNUTLS_E_SUCCESS) {
1323                         DEBUG(0,("TLS failed to import pkcs3 %s - %s\n",
1324                                  dhp_file, gnutls_strerror(ret)));
1325                         TALLOC_FREE(__tlsp);
1326                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1327                 }
1328         } else {
1329                 ret = gnutls_dh_params_generate2(tlsp->dh_params, DH_BITS);
1330                 if (ret != GNUTLS_E_SUCCESS) {
1331                         DEBUG(0,("TLS failed to generate dh_params - %s\n",
1332                                  gnutls_strerror(ret)));
1333                         TALLOC_FREE(__tlsp);
1334                         return NT_STATUS_INTERNAL_ERROR;
1335                 }
1336         }
1337
1338         gnutls_certificate_set_dh_params(tlsp->x509_cred, tlsp->dh_params);
1339
1340         tlsp->tls_priority = talloc_strdup(tlsp, tls_priority);
1341         if (tlsp->tls_priority == NULL) {
1342                 TALLOC_FREE(__tlsp);
1343                 return NT_STATUS_NO_MEMORY;
1344         }
1345
1346         tlsp->tls_enabled = true;
1347
1348         *_tlsp = __tlsp;
1349         return NT_STATUS_OK;
1350 }
1351
1352 struct tstream_tls_accept_state {
1353         struct tstream_context *tls_stream;
1354 };
1355
1356 struct tevent_req *_tstream_tls_accept_send(TALLOC_CTX *mem_ctx,
1357                                             struct tevent_context *ev,
1358                                             struct tstream_context *plain_stream,
1359                                             struct tstream_tls_params *_tlsp,
1360                                             const char *location)
1361 {
1362         struct tevent_req *req;
1363         struct tstream_tls_accept_state *state;
1364         struct tstream_tls *tlss;
1365         NTSTATUS status;
1366
1367         req = tevent_req_create(mem_ctx, &state,
1368                                 struct tstream_tls_accept_state);
1369         if (req == NULL) {
1370                 return NULL;
1371         }
1372
1373         state->tls_stream = tstream_context_create(state,
1374                                                    &tstream_tls_ops,
1375                                                    &tlss,
1376                                                    struct tstream_tls,
1377                                                    location);
1378         if (tevent_req_nomem(state->tls_stream, req)) {
1379                 return tevent_req_post(req, ev);
1380         }
1381         ZERO_STRUCTP(tlss);
1382         talloc_set_destructor(tlss, tstream_tls_destructor);
1383         tlss->plain_stream = plain_stream;
1384         tlss->is_server = true;
1385         tlss->current_ev = ev;
1386
1387         status = tstream_tls_prepare_gnutls(_tlsp, tlss);
1388         if (NT_STATUS_EQUAL(status, NT_STATUS_NO_MEMORY)) {
1389                 tevent_req_oom(req);
1390                 return tevent_req_post(req, ev);
1391         }
1392         if (!NT_STATUS_IS_OK(status)) {
1393                 tevent_req_error(req, EINVAL);
1394                 return tevent_req_post(req, ev);
1395         }
1396
1397         gnutls_transport_set_ptr(tlss->tls_session,
1398                                  (gnutls_transport_ptr_t)state->tls_stream);
1399         gnutls_transport_set_pull_function(tlss->tls_session,
1400                                            (gnutls_pull_func)tstream_tls_pull_function);
1401         gnutls_transport_set_push_function(tlss->tls_session,
1402                                            (gnutls_push_func)tstream_tls_push_function);
1403
1404         tlss->handshake.req = req;
1405         tstream_tls_retry_handshake(state->tls_stream);
1406         if (!tevent_req_is_in_progress(req)) {
1407                 return tevent_req_post(req, ev);
1408         }
1409
1410         return req;
1411 }
1412
1413 static void tstream_tls_retry_handshake(struct tstream_context *stream)
1414 {
1415         struct tstream_tls *tlss =
1416                 tstream_context_data(stream,
1417                 struct tstream_tls);
1418         struct tevent_req *req = tlss->handshake.req;
1419         int ret;
1420
1421         if (tlss->error != 0) {
1422                 tevent_req_error(req, tlss->error);
1423                 return;
1424         }
1425
1426         ret = gnutls_handshake(tlss->tls_session);
1427         if (ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN) {
1428                 return;
1429         }
1430
1431         tlss->handshake.req = NULL;
1432
1433         if (gnutls_error_is_fatal(ret) != 0) {
1434                 DEBUG(1,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
1435                 tlss->error = EIO;
1436                 tevent_req_error(req, tlss->error);
1437                 return;
1438         }
1439
1440         if (ret != GNUTLS_E_SUCCESS) {
1441                 DEBUG(1,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
1442                 tlss->error = EIO;
1443                 tevent_req_error(req, tlss->error);
1444                 return;
1445         }
1446
1447         if (tlss->verify_peer >= TLS_VERIFY_PEER_CA_ONLY) {
1448                 unsigned int status = UINT32_MAX;
1449                 bool ip = true;
1450                 const char *hostname = NULL;
1451
1452                 if (tlss->peer_name != NULL) {
1453                         ip = is_ipaddress(tlss->peer_name);
1454                 }
1455
1456                 if (!ip) {
1457                         hostname = tlss->peer_name;
1458                 }
1459
1460                 if (tlss->verify_peer == TLS_VERIFY_PEER_CA_ONLY) {
1461                         hostname = NULL;
1462                 }
1463
1464                 if (tlss->verify_peer >= TLS_VERIFY_PEER_CA_AND_NAME) {
1465                         if (hostname == NULL) {
1466                                 DEBUG(1,("TLS %s - no hostname available for "
1467                                          "verify_peer[%s] and peer_name[%s]\n",
1468                                          __location__,
1469                                          tls_verify_peer_string(tlss->verify_peer),
1470                                          tlss->peer_name));
1471                                 tlss->error = EINVAL;
1472                                 tevent_req_error(req, tlss->error);
1473                                 return;
1474                         }
1475                 }
1476
1477                 ret = gnutls_certificate_verify_peers3(tlss->tls_session,
1478                                                        hostname,
1479                                                        &status);
1480                 if (ret != GNUTLS_E_SUCCESS) {
1481                         DEBUG(1,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
1482                         tlss->error = EIO;
1483                         tevent_req_error(req, tlss->error);
1484                         return;
1485                 }
1486
1487                 if (status != 0) {
1488                         DEBUG(1,("TLS %s - check failed for "
1489                                  "verify_peer[%s] and peer_name[%s] "
1490                                  "status 0x%x (%s%s%s%s%s%s%s%s)\n",
1491                                  __location__,
1492                                  tls_verify_peer_string(tlss->verify_peer),
1493                                  tlss->peer_name,
1494                                  status,
1495                                  status & GNUTLS_CERT_INVALID ? "invalid " : "",
1496                                  status & GNUTLS_CERT_REVOKED ? "revoked " : "",
1497                                  status & GNUTLS_CERT_SIGNER_NOT_FOUND ?
1498                                         "signer_not_found " : "",
1499                                  status & GNUTLS_CERT_SIGNER_NOT_CA ?
1500                                         "signer_not_ca " : "",
1501                                  status & GNUTLS_CERT_INSECURE_ALGORITHM ?
1502                                         "insecure_algorithm " : "",
1503                                  status & GNUTLS_CERT_NOT_ACTIVATED ?
1504                                         "not_activated " : "",
1505                                  status & GNUTLS_CERT_EXPIRED ?
1506                                         "expired " : "",
1507                                  status & GNUTLS_CERT_UNEXPECTED_OWNER ?
1508                                         "unexpected_owner " : ""));
1509                         tlss->error = EINVAL;
1510                         tevent_req_error(req, tlss->error);
1511                         return;
1512                 }
1513         }
1514
1515         if (tlss->push.subreq != NULL || tlss->pull.subreq != NULL) {
1516                 tlss->waiting_flush.mgmt_req = req;
1517                 return;
1518         }
1519
1520         tevent_req_done(req);
1521 }
1522
1523 int tstream_tls_accept_recv(struct tevent_req *req,
1524                             int *perrno,
1525                             TALLOC_CTX *mem_ctx,
1526                             struct tstream_context **tls_stream)
1527 {
1528         struct tstream_tls_accept_state *state =
1529                 tevent_req_data(req,
1530                 struct tstream_tls_accept_state);
1531
1532         if (tevent_req_is_unix_error(req, perrno)) {
1533                 tevent_req_received(req);
1534                 return -1;
1535         }
1536
1537         *tls_stream = talloc_move(mem_ctx, &state->tls_stream);
1538         tevent_req_received(req);
1539         return 0;
1540 }