source4/lib/tls/tls_tstream.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Stefan Metzmacher 2010
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "system/network.h"
  22 #include "system/filesys.h"
  23 #include "system/time.h"
  24 #include "lib/util/util_file.h"
  25 #include "../util/tevent_unix.h"
  26 #include "../lib/tsocket/tsocket.h"
  27 #include "../lib/tsocket/tsocket_internal.h"
  28 #include "../lib/util/util_net.h"
  29 #include "lib/tls/tls.h"
  30
  31 #include <gnutls/gnutls.h>
  32 #include <gnutls/x509.h>
  33 #include "lib/crypto/gnutls_helpers.h"
  34
  35 #define DH_BITS 2048
  36
  37 const char *tls_verify_peer_string(enum tls_verify_peer_state verify_peer)
  38 {
  39         switch (verify_peer) {
  40         case TLS_VERIFY_PEER_NO_CHECK:
  41                 return TLS_VERIFY_PEER_NO_CHECK_STRING;
  42
  43         case TLS_VERIFY_PEER_CA_ONLY:
  44                 return TLS_VERIFY_PEER_CA_ONLY_STRING;
  45
  46         case TLS_VERIFY_PEER_CA_AND_NAME_IF_AVAILABLE:
  47                 return TLS_VERIFY_PEER_CA_AND_NAME_IF_AVAILABLE_STRING;
  48
  49         case TLS_VERIFY_PEER_CA_AND_NAME:
  50                 return TLS_VERIFY_PEER_CA_AND_NAME_STRING;
  51
  52         case TLS_VERIFY_PEER_AS_STRICT_AS_POSSIBLE:
  53                 return TLS_VERIFY_PEER_AS_STRICT_AS_POSSIBLE_STRING;
  54         }
  55
  56         return "unknown tls_verify_peer_state";
  57 }
  58
  59 static const struct tstream_context_ops tstream_tls_ops;
  60
  61 struct tstream_tls {
  62         struct tstream_context *plain_stream;
  63         int error;
  64
  65         gnutls_session_t tls_session;
  66
  67         bool is_server;
  68
  69         enum tls_verify_peer_state verify_peer;
  70         const char *peer_name;
  71
  72         struct tevent_context *current_ev;
  73
  74         struct tevent_immediate *retry_im;
  75
  76         struct {
  77                 struct tevent_req *mgmt_req;
  78         } waiting_flush;
  79
  80         struct {
  81                 uint8_t *buf;
  82                 off_t ofs;
  83                 struct iovec iov;
  84                 struct tevent_req *subreq;
  85         } push;
  86
  87         struct {
  88                 uint8_t *buf;
  89                 struct iovec iov;
  90                 struct tevent_req *subreq;
  91         } pull;
  92
  93         struct {
  94                 struct tevent_req *req;
  95         } handshake;
  96
  97         struct {
  98                 off_t ofs;
  99                 size_t left;
 100                 uint8_t buffer[1024];
 101                 struct tevent_req *req;
 102         } write;
 103
 104         struct {
 105                 off_t ofs;
 106                 size_t left;
 107                 uint8_t buffer[1024];
 108                 struct tevent_req *req;
 109         } read;
 110
 111         struct {
 112                 struct tevent_req *req;
 113         } disconnect;
 114 };
 115
 116 static void tstream_tls_retry_handshake(struct tstream_context *stream);
 117 static void tstream_tls_retry_read(struct tstream_context *stream);
 118 static void tstream_tls_retry_write(struct tstream_context *stream);
 119 static void tstream_tls_retry_disconnect(struct tstream_context *stream);
 120 static void tstream_tls_retry_trigger(struct tevent_context *ctx,
 121                                       struct tevent_immediate *im,
 122                                       void *private_data);
 123
 124 static void tstream_tls_retry(struct tstream_context *stream, bool deferred)
 125 {
 126
 127         struct tstream_tls *tlss =
 128                 tstream_context_data(stream,
 129                 struct tstream_tls);
 130
 131         if (tlss->push.subreq == NULL && tlss->pull.subreq == NULL) {
 132                 if (tlss->waiting_flush.mgmt_req != NULL) {
 133                         struct tevent_req *req = tlss->waiting_flush.mgmt_req;
 134
 135                         tlss->waiting_flush.mgmt_req = NULL;
 136
 137                         tevent_req_done(req);
 138                         return;
 139                 }
 140         }
 141
 142         if (tlss->disconnect.req) {
 143                 tstream_tls_retry_disconnect(stream);
 144                 return;
 145         }
 146
 147         if (tlss->handshake.req) {
 148                 tstream_tls_retry_handshake(stream);
 149                 return;
 150         }
 151
 152         if (tlss->write.req && tlss->read.req && !deferred) {
 153                 tevent_schedule_immediate(tlss->retry_im, tlss->current_ev,
 154                                           tstream_tls_retry_trigger,
 155                                           stream);
 156         }
 157
 158         if (tlss->write.req) {
 159                 tstream_tls_retry_write(stream);
 160                 return;
 161         }
 162
 163         if (tlss->read.req) {
 164                 tstream_tls_retry_read(stream);
 165                 return;
 166         }
 167 }
 168
 169 static void tstream_tls_retry_trigger(struct tevent_context *ctx,
 170                                       struct tevent_immediate *im,
 171                                       void *private_data)
 172 {
 173         struct tstream_context *stream =
 174                 talloc_get_type_abort(private_data,
 175                 struct tstream_context);
 176
 177         tstream_tls_retry(stream, true);
 178 }
 179
 180 static void tstream_tls_push_done(struct tevent_req *subreq);
 181
 182 static ssize_t tstream_tls_push_function(gnutls_transport_ptr_t ptr,
 183                                          const void *buf, size_t size)
 184 {
 185         struct tstream_context *stream =
 186                 talloc_get_type_abort(ptr,
 187                 struct tstream_context);
 188         struct tstream_tls *tlss =
 189                 tstream_context_data(stream,
 190                 struct tstream_tls);
 191         struct tevent_req *subreq = NULL;
 192         uint8_t *nbuf;
 193         size_t len;
 194
 195         if (tlss->error != 0) {
 196                 errno = tlss->error;
 197                 return -1;
 198         }
 199
 200         if (tlss->push.subreq) {
 201                 errno = EAGAIN;
 202                 return -1;
 203         }
 204
 205         len = MIN(size, UINT16_MAX - tlss->push.ofs);
 206
 207         if (len == 0) {
 208                 errno = EAGAIN;
 209                 return -1;
 210         }
 211
 212         nbuf = talloc_realloc(tlss, tlss->push.buf,
 213                               uint8_t, tlss->push.ofs + len);
 214         if (nbuf == NULL) {
 215                 if (tlss->push.buf) {
 216                         errno = EAGAIN;
 217                         return -1;
 218                 }
 219
 220                 return -1;
 221         }
 222         tlss->push.buf = nbuf;
 223
 224         memcpy(tlss->push.buf + tlss->push.ofs, buf, len);
 225         tlss->push.ofs += len;
 226
 227         tlss->push.iov.iov_base = (char *)tlss->push.buf;
 228         tlss->push.iov.iov_len = tlss->push.ofs;
 229
 230         subreq = tstream_writev_send(tlss,
 231                                      tlss->current_ev,
 232                                      tlss->plain_stream,
 233                                      &tlss->push.iov, 1);
 234         if (subreq == NULL) {
 235                 errno = ENOMEM;
 236                 return -1;
 237         }
 238         tevent_req_set_callback(subreq, tstream_tls_push_done, stream);
 239
 240         tlss->push.subreq = subreq;
 241         return len;
 242 }
 243
 244 static void tstream_tls_push_done(struct tevent_req *subreq)
 245 {
 246         struct tstream_context *stream =
 247                 tevent_req_callback_data(subreq,
 248                 struct tstream_context);
 249         struct tstream_tls *tlss =
 250                 tstream_context_data(stream,
 251                 struct tstream_tls);
 252         int ret;
 253         int sys_errno;
 254
 255         tlss->push.subreq = NULL;
 256         ZERO_STRUCT(tlss->push.iov);
 257         TALLOC_FREE(tlss->push.buf);
 258         tlss->push.ofs = 0;
 259
 260         ret = tstream_writev_recv(subreq, &sys_errno);
 261         TALLOC_FREE(subreq);
 262         if (ret == -1) {
 263                 tlss->error = sys_errno;
 264                 tstream_tls_retry(stream, false);
 265                 return;
 266         }
 267
 268         tstream_tls_retry(stream, false);
 269 }
 270
 271 static void tstream_tls_pull_done(struct tevent_req *subreq);
 272
 273 static ssize_t tstream_tls_pull_function(gnutls_transport_ptr_t ptr,
 274                                          void *buf, size_t size)
 275 {
 276         struct tstream_context *stream =
 277                 talloc_get_type_abort(ptr,
 278                 struct tstream_context);
 279         struct tstream_tls *tlss =
 280                 tstream_context_data(stream,
 281                 struct tstream_tls);
 282         struct tevent_req *subreq;
 283         size_t len;
 284
 285         if (tlss->error != 0) {
 286                 errno = tlss->error;
 287                 return -1;
 288         }
 289
 290         if (tlss->pull.subreq) {
 291                 errno = EAGAIN;
 292                 return -1;
 293         }
 294
 295         if (tlss->pull.iov.iov_base) {
 296                 uint8_t *b;
 297                 size_t n;
 298
 299                 b = (uint8_t *)tlss->pull.iov.iov_base;
 300
 301                 n = MIN(tlss->pull.iov.iov_len, size);
 302                 memcpy(buf, b, n);
 303
 304                 tlss->pull.iov.iov_len -= n;
 305                 b += n;
 306                 tlss->pull.iov.iov_base = (char *)b;
 307                 if (tlss->pull.iov.iov_len == 0) {
 308                         tlss->pull.iov.iov_base = NULL;
 309                         TALLOC_FREE(tlss->pull.buf);
 310                 }
 311
 312                 return n;
 313         }
 314
 315         if (size == 0) {
 316                 return 0;
 317         }
 318
 319         len = MIN(size, UINT16_MAX);
 320
 321         tlss->pull.buf = talloc_array(tlss, uint8_t, len);
 322         if (tlss->pull.buf == NULL) {
 323                 return -1;
 324         }
 325
 326         tlss->pull.iov.iov_base = (char *)tlss->pull.buf;
 327         tlss->pull.iov.iov_len = len;
 328
 329         subreq = tstream_readv_send(tlss,
 330                                     tlss->current_ev,
 331                                     tlss->plain_stream,
 332                                     &tlss->pull.iov, 1);
 333         if (subreq == NULL) {
 334                 errno = ENOMEM;
 335                 return -1;
 336         }
 337         tevent_req_set_callback(subreq, tstream_tls_pull_done, stream);
 338
 339         tlss->pull.subreq = subreq;
 340         errno = EAGAIN;
 341         return -1;
 342 }
 343
 344 static void tstream_tls_pull_done(struct tevent_req *subreq)
 345 {
 346         struct tstream_context *stream =
 347                 tevent_req_callback_data(subreq,
 348                 struct tstream_context);
 349         struct tstream_tls *tlss =
 350                 tstream_context_data(stream,
 351                 struct tstream_tls);
 352         int ret;
 353         int sys_errno;
 354
 355         tlss->pull.subreq = NULL;
 356
 357         ret = tstream_readv_recv(subreq, &sys_errno);
 358         TALLOC_FREE(subreq);
 359         if (ret == -1) {
 360                 tlss->error = sys_errno;
 361                 tstream_tls_retry(stream, false);
 362                 return;
 363         }
 364
 365         tstream_tls_retry(stream, false);
 366 }
 367
 368 static int tstream_tls_destructor(struct tstream_tls *tlss)
 369 {
 370         if (tlss->tls_session) {
 371                 gnutls_deinit(tlss->tls_session);
 372                 tlss->tls_session = NULL;
 373         }
 374
 375         return 0;
 376 }
 377
 378 static ssize_t tstream_tls_pending_bytes(struct tstream_context *stream)
 379 {
 380         struct tstream_tls *tlss =
 381                 tstream_context_data(stream,
 382                 struct tstream_tls);
 383         size_t ret;
 384
 385         if (tlss->error != 0) {
 386                 errno = tlss->error;
 387                 return -1;
 388         }
 389
 390         ret = gnutls_record_check_pending(tlss->tls_session);
 391         ret += tlss->read.left;
 392
 393         return ret;
 394 }
 395
 396 struct tstream_tls_readv_state {
 397         struct tstream_context *stream;
 398
 399         struct iovec *vector;
 400         int count;
 401
 402         int ret;
 403 };
 404
 405 static void tstream_tls_readv_crypt_next(struct tevent_req *req);
 406
 407 static struct tevent_req *tstream_tls_readv_send(TALLOC_CTX *mem_ctx,
 408                                         struct tevent_context *ev,
 409                                         struct tstream_context *stream,
 410                                         struct iovec *vector,
 411                                         size_t count)
 412 {
 413         struct tstream_tls *tlss =
 414                 tstream_context_data(stream,
 415                 struct tstream_tls);
 416         struct tevent_req *req;
 417         struct tstream_tls_readv_state *state;
 418
 419         tlss->read.req = NULL;
 420
 421         if (tlss->current_ev != ev) {
 422                 SMB_ASSERT(tlss->push.subreq == NULL);
 423                 SMB_ASSERT(tlss->pull.subreq == NULL);
 424         }
 425
 426         tlss->current_ev = ev;
 427
 428         req = tevent_req_create(mem_ctx, &state,
 429                                 struct tstream_tls_readv_state);
 430         if (req == NULL) {
 431                 return NULL;
 432         }
 433
 434         state->stream = stream;
 435         state->ret = 0;
 436
 437         if (tlss->error != 0) {
 438                 tevent_req_error(req, tlss->error);
 439                 return tevent_req_post(req, ev);
 440         }
 441
 442         /*
 443          * we make a copy of the vector so we can change the structure
 444          */
 445         state->vector = talloc_array(state, struct iovec, count);
 446         if (tevent_req_nomem(state->vector, req)) {
 447                 return tevent_req_post(req, ev);
 448         }
 449         memcpy(state->vector, vector, sizeof(struct iovec) * count);
 450         state->count = count;
 451
 452         tstream_tls_readv_crypt_next(req);
 453         if (!tevent_req_is_in_progress(req)) {
 454                 return tevent_req_post(req, ev);
 455         }
 456
 457         return req;
 458 }
 459
 460 static void tstream_tls_readv_crypt_next(struct tevent_req *req)
 461 {
 462         struct tstream_tls_readv_state *state =
 463                 tevent_req_data(req,
 464                 struct tstream_tls_readv_state);
 465         struct tstream_tls *tlss =
 466                 tstream_context_data(state->stream,
 467                 struct tstream_tls);
 468
 469         /*
 470          * copy the pending buffer first
 471          */
 472         while (tlss->read.left > 0 && state->count > 0) {
 473                 uint8_t *base = (uint8_t *)state->vector[0].iov_base;
 474                 size_t len = MIN(tlss->read.left, state->vector[0].iov_len);
 475
 476                 memcpy(base, tlss->read.buffer + tlss->read.ofs, len);
 477
 478                 base += len;
 479                 state->vector[0].iov_base = (char *) base;
 480                 state->vector[0].iov_len -= len;
 481
 482                 tlss->read.ofs += len;
 483                 tlss->read.left -= len;
 484
 485                 if (state->vector[0].iov_len == 0) {
 486                         state->vector += 1;
 487                         state->count -= 1;
 488                 }
 489
 490                 state->ret += len;
 491         }
 492
 493         if (state->count == 0) {
 494                 tevent_req_done(req);
 495                 return;
 496         }
 497
 498         tlss->read.req = req;
 499         tstream_tls_retry_read(state->stream);
 500 }
 501
 502 static void tstream_tls_retry_read(struct tstream_context *stream)
 503 {
 504         struct tstream_tls *tlss =
 505                 tstream_context_data(stream,
 506                 struct tstream_tls);
 507         struct tevent_req *req = tlss->read.req;
 508         int ret;
 509
 510         if (tlss->error != 0) {
 511                 tevent_req_error(req, tlss->error);
 512                 return;
 513         }
 514
 515         tlss->read.left = 0;
 516         tlss->read.ofs = 0;
 517
 518         ret = gnutls_record_recv(tlss->tls_session,
 519                                  tlss->read.buffer,
 520                                  sizeof(tlss->read.buffer));
 521         if (ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN) {
 522                 return;
 523         }
 524
 525         tlss->read.req = NULL;
 526
 527         if (gnutls_error_is_fatal(ret) != 0) {
 528                 DEBUG(1,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
 529                 tlss->error = EIO;
 530                 tevent_req_error(req, tlss->error);
 531                 return;
 532         }
 533
 534         if (ret == 0) {
 535                 tlss->error = EPIPE;
 536                 tevent_req_error(req, tlss->error);
 537                 return;
 538         }
 539
 540         tlss->read.left = ret;
 541         tstream_tls_readv_crypt_next(req);
 542 }
 543
 544 static int tstream_tls_readv_recv(struct tevent_req *req,
 545                                   int *perrno)
 546 {
 547         struct tstream_tls_readv_state *state =
 548                 tevent_req_data(req,
 549                 struct tstream_tls_readv_state);
 550         struct tstream_tls *tlss =
 551                 tstream_context_data(state->stream,
 552                 struct tstream_tls);
 553         int ret;
 554
 555         tlss->read.req = NULL;
 556
 557         ret = tsocket_simple_int_recv(req, perrno);
 558         if (ret == 0) {
 559                 ret = state->ret;
 560         }
 561
 562         tevent_req_received(req);
 563         return ret;
 564 }
 565
 566 struct tstream_tls_writev_state {
 567         struct tstream_context *stream;
 568
 569         struct iovec *vector;
 570         int count;
 571
 572         int ret;
 573 };
 574
 575 static void tstream_tls_writev_crypt_next(struct tevent_req *req);
 576
 577 static struct tevent_req *tstream_tls_writev_send(TALLOC_CTX *mem_ctx,
 578                                         struct tevent_context *ev,
 579                                         struct tstream_context *stream,
 580                                         const struct iovec *vector,
 581                                         size_t count)
 582 {
 583         struct tstream_tls *tlss =
 584                 tstream_context_data(stream,
 585                 struct tstream_tls);
 586         struct tevent_req *req;
 587         struct tstream_tls_writev_state *state;
 588
 589         tlss->write.req = NULL;
 590
 591         if (tlss->current_ev != ev) {
 592                 SMB_ASSERT(tlss->push.subreq == NULL);
 593                 SMB_ASSERT(tlss->pull.subreq == NULL);
 594         }
 595
 596         tlss->current_ev = ev;
 597
 598         req = tevent_req_create(mem_ctx, &state,
 599                                 struct tstream_tls_writev_state);
 600         if (req == NULL) {
 601                 return NULL;
 602         }
 603
 604         state->stream = stream;
 605         state->ret = 0;
 606
 607         if (tlss->error != 0) {
 608                 tevent_req_error(req, tlss->error);
 609                 return tevent_req_post(req, ev);
 610         }
 611
 612         /*
 613          * we make a copy of the vector so we can change the structure
 614          */
 615         state->vector = talloc_array(state, struct iovec, count);
 616         if (tevent_req_nomem(state->vector, req)) {
 617                 return tevent_req_post(req, ev);
 618         }
 619         memcpy(state->vector, vector, sizeof(struct iovec) * count);
 620         state->count = count;
 621
 622         tstream_tls_writev_crypt_next(req);
 623         if (!tevent_req_is_in_progress(req)) {
 624                 return tevent_req_post(req, ev);
 625         }
 626
 627         return req;
 628 }
 629
 630 static void tstream_tls_writev_crypt_next(struct tevent_req *req)
 631 {
 632         struct tstream_tls_writev_state *state =
 633                 tevent_req_data(req,
 634                 struct tstream_tls_writev_state);
 635         struct tstream_tls *tlss =
 636                 tstream_context_data(state->stream,
 637                 struct tstream_tls);
 638
 639         tlss->write.left = sizeof(tlss->write.buffer);
 640         tlss->write.ofs = 0;
 641
 642         /*
 643          * first fill our buffer
 644          */
 645         while (tlss->write.left > 0 && state->count > 0) {
 646                 uint8_t *base = (uint8_t *)state->vector[0].iov_base;
 647                 size_t len = MIN(tlss->write.left, state->vector[0].iov_len);
 648
 649                 memcpy(tlss->write.buffer + tlss->write.ofs, base, len);
 650
 651                 base += len;
 652                 state->vector[0].iov_base = (char *) base;
 653                 state->vector[0].iov_len -= len;
 654
 655                 tlss->write.ofs += len;
 656                 tlss->write.left -= len;
 657
 658                 if (state->vector[0].iov_len == 0) {
 659                         state->vector += 1;
 660                         state->count -= 1;
 661                 }
 662
 663                 state->ret += len;
 664         }
 665
 666         if (tlss->write.ofs == 0) {
 667                 tevent_req_done(req);
 668                 return;
 669         }
 670
 671         tlss->write.left = tlss->write.ofs;
 672         tlss->write.ofs = 0;
 673
 674         tlss->write.req = req;
 675         tstream_tls_retry_write(state->stream);
 676 }
 677
 678 static void tstream_tls_retry_write(struct tstream_context *stream)
 679 {
 680         struct tstream_tls *tlss =
 681                 tstream_context_data(stream,
 682                 struct tstream_tls);
 683         struct tevent_req *req = tlss->write.req;
 684         int ret;
 685
 686         if (tlss->error != 0) {
 687                 tevent_req_error(req, tlss->error);
 688                 return;
 689         }
 690
 691         ret = gnutls_record_send(tlss->tls_session,
 692                                  tlss->write.buffer + tlss->write.ofs,
 693                                  tlss->write.left);
 694         if (ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN) {
 695                 return;
 696         }
 697
 698         tlss->write.req = NULL;
 699
 700         if (gnutls_error_is_fatal(ret) != 0) {
 701                 DEBUG(1,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
 702                 tlss->error = EIO;
 703                 tevent_req_error(req, tlss->error);
 704                 return;
 705         }
 706
 707         if (ret == 0) {
 708                 tlss->error = EPIPE;
 709                 tevent_req_error(req, tlss->error);
 710                 return;
 711         }
 712
 713         tlss->write.ofs += ret;
 714         tlss->write.left -= ret;
 715
 716         if (tlss->write.left > 0) {
 717                 tlss->write.req = req;
 718                 tstream_tls_retry_write(stream);
 719                 return;
 720         }
 721
 722         tstream_tls_writev_crypt_next(req);
 723 }
 724
 725 static int tstream_tls_writev_recv(struct tevent_req *req,
 726                                    int *perrno)
 727 {
 728         struct tstream_tls_writev_state *state =
 729                 tevent_req_data(req,
 730                 struct tstream_tls_writev_state);
 731         struct tstream_tls *tlss =
 732                 tstream_context_data(state->stream,
 733                 struct tstream_tls);
 734         int ret;
 735
 736         tlss->write.req = NULL;
 737
 738         ret = tsocket_simple_int_recv(req, perrno);
 739         if (ret == 0) {
 740                 ret = state->ret;
 741         }
 742
 743         tevent_req_received(req);
 744         return ret;
 745 }
 746
 747 struct tstream_tls_disconnect_state {
 748         uint8_t _dummy;
 749 };
 750
 751 static struct tevent_req *tstream_tls_disconnect_send(TALLOC_CTX *mem_ctx,
 752                                                 struct tevent_context *ev,
 753                                                 struct tstream_context *stream)
 754 {
 755         struct tstream_tls *tlss =
 756                 tstream_context_data(stream,
 757                 struct tstream_tls);
 758         struct tevent_req *req;
 759         struct tstream_tls_disconnect_state *state;
 760
 761         tlss->disconnect.req = NULL;
 762
 763         if (tlss->current_ev != ev) {
 764                 SMB_ASSERT(tlss->push.subreq == NULL);
 765                 SMB_ASSERT(tlss->pull.subreq == NULL);
 766         }
 767
 768         tlss->current_ev = ev;
 769
 770         req = tevent_req_create(mem_ctx, &state,
 771                                 struct tstream_tls_disconnect_state);
 772         if (req == NULL) {
 773                 return NULL;
 774         }
 775
 776         if (tlss->error != 0) {
 777                 tevent_req_error(req, tlss->error);
 778                 return tevent_req_post(req, ev);
 779         }
 780
 781         tlss->disconnect.req = req;
 782         tstream_tls_retry_disconnect(stream);
 783         if (!tevent_req_is_in_progress(req)) {
 784                 return tevent_req_post(req, ev);
 785         }
 786
 787         return req;
 788 }
 789
 790 static void tstream_tls_retry_disconnect(struct tstream_context *stream)
 791 {
 792         struct tstream_tls *tlss =
 793                 tstream_context_data(stream,
 794                 struct tstream_tls);
 795         struct tevent_req *req = tlss->disconnect.req;
 796         int ret;
 797
 798         if (tlss->error != 0) {
 799                 tevent_req_error(req, tlss->error);
 800                 return;
 801         }
 802
 803         ret = gnutls_bye(tlss->tls_session, GNUTLS_SHUT_WR);
 804         if (ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN) {
 805                 return;
 806         }
 807
 808         tlss->disconnect.req = NULL;
 809
 810         if (gnutls_error_is_fatal(ret) != 0) {
 811                 DEBUG(1,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
 812                 tlss->error = EIO;
 813                 tevent_req_error(req, tlss->error);
 814                 return;
 815         }
 816
 817         if (ret != GNUTLS_E_SUCCESS) {
 818                 DEBUG(1,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
 819                 tlss->error = EIO;
 820                 tevent_req_error(req, tlss->error);
 821                 return;
 822         }
 823
 824         if (tlss->push.subreq != NULL || tlss->pull.subreq != NULL) {
 825                 tlss->waiting_flush.mgmt_req = req;
 826                 return;
 827         }
 828
 829         tevent_req_done(req);
 830 }
 831
 832 static int tstream_tls_disconnect_recv(struct tevent_req *req,
 833                                        int *perrno)
 834 {
 835         int ret;
 836
 837         ret = tsocket_simple_int_recv(req, perrno);
 838
 839         tevent_req_received(req);
 840         return ret;
 841 }
 842
 843 static const struct tstream_context_ops tstream_tls_ops = {
 844         .name                   = "tls",
 845
 846         .pending_bytes          = tstream_tls_pending_bytes,
 847
 848         .readv_send             = tstream_tls_readv_send,
 849         .readv_recv             = tstream_tls_readv_recv,
 850
 851         .writev_send            = tstream_tls_writev_send,
 852         .writev_recv            = tstream_tls_writev_recv,
 853
 854         .disconnect_send        = tstream_tls_disconnect_send,
 855         .disconnect_recv        = tstream_tls_disconnect_recv,
 856 };
 857
 858 struct tstream_tls_params_internal {
 859         gnutls_certificate_credentials_t x509_cred;
 860         gnutls_dh_params_t dh_params;
 861         const char *tls_priority;
 862         bool tls_enabled;
 863         enum tls_verify_peer_state verify_peer;
 864         const char *peer_name;
 865 };
 866
 867 struct tstream_tls_params {
 868         struct tstream_tls_params_internal *internal;
 869 };
 870
 871 static int tstream_tls_params_internal_destructor(struct tstream_tls_params_internal *tlsp)
 872 {
 873         if (tlsp->x509_cred) {
 874                 gnutls_certificate_free_credentials(tlsp->x509_cred);
 875                 tlsp->x509_cred = NULL;
 876         }
 877         if (tlsp->dh_params) {
 878                 gnutls_dh_params_deinit(tlsp->dh_params);
 879                 tlsp->dh_params = NULL;
 880         }
 881
 882         return 0;
 883 }
 884
 885 bool tstream_tls_params_enabled(struct tstream_tls_params *tls_params)
 886 {
 887         struct tstream_tls_params_internal *tlsp = tls_params->internal;
 888
 889         return tlsp->tls_enabled;
 890 }
 891
 892 NTSTATUS tstream_tls_params_client(TALLOC_CTX *mem_ctx,
 893                                    const char *ca_file,
 894                                    const char *crl_file,
 895                                    const char *tls_priority,
 896                                    enum tls_verify_peer_state verify_peer,
 897                                    const char *peer_name,
 898                                    struct tstream_tls_params **_tlsp)
 899 {
 900         struct tstream_tls_params *__tlsp = NULL;
 901         struct tstream_tls_params_internal *tlsp = NULL;
 902         int ret;
 903
 904         __tlsp = talloc_zero(mem_ctx, struct tstream_tls_params);
 905         if (__tlsp == NULL) {
 906                 return NT_STATUS_NO_MEMORY;
 907         }
 908
 909         tlsp = talloc_zero(__tlsp, struct tstream_tls_params_internal);
 910         if (tlsp == NULL) {
 911                 TALLOC_FREE(__tlsp);
 912                 return NT_STATUS_NO_MEMORY;
 913         }
 914         talloc_set_destructor(tlsp, tstream_tls_params_internal_destructor);
 915         __tlsp->internal = tlsp;
 916
 917         tlsp->verify_peer = verify_peer;
 918         if (peer_name != NULL) {
 919                 tlsp->peer_name = talloc_strdup(tlsp, peer_name);
 920                 if (tlsp->peer_name == NULL) {
 921                         TALLOC_FREE(__tlsp);
 922                         return NT_STATUS_NO_MEMORY;
 923                 }
 924         } else if (tlsp->verify_peer >= TLS_VERIFY_PEER_CA_AND_NAME) {
 925                 DEBUG(0,("TLS failed to missing peer_name - "
 926                          "with 'tls verify peer = %s'\n",
 927                          tls_verify_peer_string(tlsp->verify_peer)));
 928                 TALLOC_FREE(__tlsp);
 929                 return NT_STATUS_INVALID_PARAMETER_MIX;
 930         }
 931
 932         ret = gnutls_certificate_allocate_credentials(&tlsp->x509_cred);
 933         if (ret != GNUTLS_E_SUCCESS) {
 934                 DEBUG(0,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
 935                 TALLOC_FREE(__tlsp);
 936                 return NT_STATUS_NO_MEMORY;
 937         }
 938
 939         if (ca_file && *ca_file && file_exist(ca_file)) {
 940                 ret = gnutls_certificate_set_x509_trust_file(tlsp->x509_cred,
 941                                                              ca_file,
 942                                                              GNUTLS_X509_FMT_PEM);
 943                 if (ret < 0) {
 944                         DEBUG(0,("TLS failed to initialise cafile %s - %s\n",
 945                                  ca_file, gnutls_strerror(ret)));
 946                         TALLOC_FREE(__tlsp);
 947                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 948                 }
 949         } else if (tlsp->verify_peer >= TLS_VERIFY_PEER_CA_ONLY) {
 950                 DEBUG(0,("TLS failed to missing cafile %s - "
 951                          "with 'tls verify peer = %s'\n",
 952                          ca_file,
 953                          tls_verify_peer_string(tlsp->verify_peer)));
 954                 TALLOC_FREE(__tlsp);
 955                 return NT_STATUS_INVALID_PARAMETER_MIX;
 956         }
 957
 958         if (crl_file && *crl_file && file_exist(crl_file)) {
 959                 ret = gnutls_certificate_set_x509_crl_file(tlsp->x509_cred,
 960                                                            crl_file,
 961                                                            GNUTLS_X509_FMT_PEM);
 962                 if (ret < 0) {
 963                         DEBUG(0,("TLS failed to initialise crlfile %s - %s\n",
 964                                  crl_file, gnutls_strerror(ret)));
 965                         TALLOC_FREE(__tlsp);
 966                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 967                 }
 968         } else if (tlsp->verify_peer >= TLS_VERIFY_PEER_AS_STRICT_AS_POSSIBLE) {
 969                 DEBUG(0,("TLS failed to missing crlfile %s - "
 970                          "with 'tls verify peer = %s'\n",
 971                          crl_file,
 972                          tls_verify_peer_string(tlsp->verify_peer)));
 973                 TALLOC_FREE(__tlsp);
 974                 return NT_STATUS_INVALID_PARAMETER_MIX;
 975         }
 976
 977         tlsp->tls_priority = talloc_strdup(tlsp, tls_priority);
 978         if (tlsp->tls_priority == NULL) {
 979                 TALLOC_FREE(__tlsp);
 980                 return NT_STATUS_NO_MEMORY;
 981         }
 982
 983         tlsp->tls_enabled = true;
 984
 985         *_tlsp = __tlsp;
 986         return NT_STATUS_OK;
 987 }
 988
 989 static NTSTATUS tstream_tls_prepare_gnutls(struct tstream_tls_params *_tlsp,
 990                                            struct tstream_tls *tlss)
 991 {
 992         struct tstream_tls_params_internal *tlsp = NULL;
 993         int ret;
 994         unsigned int flags;
 995
 996         if (tlss->is_server) {
 997                 flags = GNUTLS_SERVER;
 998         } else {
 999                 flags = GNUTLS_CLIENT;
1000 #ifdef GNUTLS_NO_TICKETS
1001                 /*
1002                  * tls_tstream can't properly handle 'New Session Ticket'
1003                  * messages sent 'after' the client sends the 'Finished'
1004                  * message.  GNUTLS_NO_TICKETS was introduced in GnuTLS 3.5.6.
1005                  * This flag is to indicate the session Flag session should not
1006                  * use resumption with session tickets.
1007                  */
1008                 flags |= GNUTLS_NO_TICKETS;
1009 #endif
1010         }
1011
1012         /*
1013          * Note we need to make sure x509_cred and dh_params
1014          * from tstream_tls_params_internal stay alive for
1015          * the whole lifetime of this session!
1016          *
1017          * See 'man gnutls_credentials_set' and
1018          * 'man gnutls_certificate_set_dh_params'.
1019          *
1020          * Note: here we use talloc_reference() in a way
1021          *       that does not expose it to the caller.
1022          */
1023         tlsp = talloc_reference(tlss, _tlsp->internal);
1024         if (tlsp == NULL) {
1025                 return NT_STATUS_NO_MEMORY;
1026         }
1027
1028         tlss->verify_peer = tlsp->verify_peer;
1029         if (tlsp->peer_name != NULL) {
1030                 tlss->peer_name = talloc_strdup(tlss, tlsp->peer_name);
1031                 if (tlss->peer_name == NULL) {
1032                         return NT_STATUS_NO_MEMORY;
1033                 }
1034         }
1035
1036         if (tlss->current_ev != NULL) {
1037                 tlss->retry_im = tevent_create_immediate(tlss);
1038                 if (tlss->retry_im == NULL) {
1039                         return NT_STATUS_NO_MEMORY;
1040                 }
1041         }
1042
1043         ret = gnutls_init(&tlss->tls_session, flags);
1044         if (ret != GNUTLS_E_SUCCESS) {
1045                 return gnutls_error_to_ntstatus(ret,
1046                         NT_STATUS_CRYPTO_SYSTEM_INVALID);
1047         }
1048
1049         ret = gnutls_set_default_priority(tlss->tls_session);
1050         if (ret != GNUTLS_E_SUCCESS) {
1051                 return gnutls_error_to_ntstatus(ret,
1052                         NT_STATUS_CRYPTO_SYSTEM_INVALID);
1053         }
1054
1055         if (strlen(tlsp->tls_priority) > 0) {
1056                 const char *error_pos = NULL;
1057
1058                 ret = gnutls_priority_set_direct(tlss->tls_session,
1059                                                  tlsp->tls_priority,
1060                                                  &error_pos);
1061                 if (ret != GNUTLS_E_SUCCESS) {
1062                         return gnutls_error_to_ntstatus(ret,
1063                                 NT_STATUS_CRYPTO_SYSTEM_INVALID);
1064                 }
1065         }
1066
1067         ret = gnutls_credentials_set(tlss->tls_session,
1068                                      GNUTLS_CRD_CERTIFICATE,
1069                                      tlsp->x509_cred);
1070         if (ret != GNUTLS_E_SUCCESS) {
1071                 return gnutls_error_to_ntstatus(ret,
1072                                 NT_STATUS_CRYPTO_SYSTEM_INVALID);
1073         }
1074
1075         if (tlss->is_server) {
1076                 gnutls_certificate_server_set_request(tlss->tls_session,
1077                                                       GNUTLS_CERT_REQUEST);
1078                 gnutls_dh_set_prime_bits(tlss->tls_session, DH_BITS);
1079         }
1080
1081         return NT_STATUS_OK;
1082 }
1083
1084 struct tstream_tls_connect_state {
1085         struct tstream_context *tls_stream;
1086 };
1087
1088 struct tevent_req *_tstream_tls_connect_send(TALLOC_CTX *mem_ctx,
1089                                              struct tevent_context *ev,
1090                                              struct tstream_context *plain_stream,
1091                                              struct tstream_tls_params *_tls_params,
1092                                              const char *location)
1093 {
1094         struct tevent_req *req;
1095         struct tstream_tls_connect_state *state;
1096         struct tstream_tls *tlss;
1097         NTSTATUS status;
1098
1099         req = tevent_req_create(mem_ctx, &state,
1100                                 struct tstream_tls_connect_state);
1101         if (req == NULL) {
1102                 return NULL;
1103         }
1104
1105         state->tls_stream = tstream_context_create(state,
1106                                                    &tstream_tls_ops,
1107                                                    &tlss,
1108                                                    struct tstream_tls,
1109                                                    location);
1110         if (tevent_req_nomem(state->tls_stream, req)) {
1111                 return tevent_req_post(req, ev);
1112         }
1113         ZERO_STRUCTP(tlss);
1114         talloc_set_destructor(tlss, tstream_tls_destructor);
1115         tlss->plain_stream = plain_stream;
1116         tlss->is_server = false;
1117         tlss->current_ev = ev;
1118
1119         status = tstream_tls_prepare_gnutls(_tls_params, tlss);
1120         if (NT_STATUS_EQUAL(status, NT_STATUS_NO_MEMORY)) {
1121                 tevent_req_oom(req);
1122                 return tevent_req_post(req, ev);
1123         }
1124         if (!NT_STATUS_IS_OK(status)) {
1125                 tevent_req_error(req, EINVAL);
1126                 return tevent_req_post(req, ev);
1127         }
1128
1129         gnutls_transport_set_ptr(tlss->tls_session,
1130                                  (gnutls_transport_ptr_t)state->tls_stream);
1131         gnutls_transport_set_pull_function(tlss->tls_session,
1132                                            (gnutls_pull_func)tstream_tls_pull_function);
1133         gnutls_transport_set_push_function(tlss->tls_session,
1134                                            (gnutls_push_func)tstream_tls_push_function);
1135
1136         tlss->handshake.req = req;
1137         tstream_tls_retry_handshake(state->tls_stream);
1138         if (!tevent_req_is_in_progress(req)) {
1139                 return tevent_req_post(req, ev);
1140         }
1141
1142         return req;
1143 }
1144
1145 int tstream_tls_connect_recv(struct tevent_req *req,
1146                              int *perrno,
1147                              TALLOC_CTX *mem_ctx,
1148                              struct tstream_context **tls_stream)
1149 {
1150         struct tstream_tls_connect_state *state =
1151                 tevent_req_data(req,
1152                 struct tstream_tls_connect_state);
1153
1154         if (tevent_req_is_unix_error(req, perrno)) {
1155                 tevent_req_received(req);
1156                 return -1;
1157         }
1158
1159         *tls_stream = talloc_move(mem_ctx, &state->tls_stream);
1160         tevent_req_received(req);
1161         return 0;
1162 }
1163
1164 /*
1165   initialise global tls state
1166 */
1167 NTSTATUS tstream_tls_params_server(TALLOC_CTX *mem_ctx,
1168                                    const char *dns_host_name,
1169                                    bool enabled,
1170                                    const char *key_file,
1171                                    const char *cert_file,
1172                                    const char *ca_file,
1173                                    const char *crl_file,
1174                                    const char *dhp_file,
1175                                    const char *tls_priority,
1176                                    struct tstream_tls_params **_tlsp)
1177 {
1178         struct tstream_tls_params *__tlsp = NULL;
1179         struct tstream_tls_params_internal *tlsp = NULL;
1180         int ret;
1181         struct stat st;
1182
1183         if (!enabled || key_file == NULL || *key_file == 0) {
1184                 __tlsp = talloc_zero(mem_ctx, struct tstream_tls_params);
1185                 if (__tlsp == NULL) {
1186                         return NT_STATUS_NO_MEMORY;
1187                 }
1188
1189                 tlsp = talloc_zero(__tlsp, struct tstream_tls_params_internal);
1190                 if (tlsp == NULL) {
1191                         TALLOC_FREE(__tlsp);
1192                         return NT_STATUS_NO_MEMORY;
1193                 }
1194
1195                 talloc_set_destructor(tlsp, tstream_tls_params_internal_destructor);
1196                 __tlsp->internal = tlsp;
1197                 tlsp->tls_enabled = false;
1198
1199                 *_tlsp = __tlsp;
1200                 return NT_STATUS_OK;
1201         }
1202
1203         __tlsp = talloc_zero(mem_ctx, struct tstream_tls_params);
1204         if (__tlsp == NULL) {
1205                 return NT_STATUS_NO_MEMORY;
1206         }
1207
1208         tlsp = talloc_zero(__tlsp, struct tstream_tls_params_internal);
1209         if (tlsp == NULL) {
1210                 TALLOC_FREE(__tlsp);
1211                 return NT_STATUS_NO_MEMORY;
1212         }
1213
1214         talloc_set_destructor(tlsp, tstream_tls_params_internal_destructor);
1215         __tlsp->internal = tlsp;
1216
1217         if (!file_exist(ca_file)) {
1218                 tls_cert_generate(tlsp, dns_host_name,
1219                                   key_file, cert_file, ca_file);
1220         }
1221
1222         if (file_exist(key_file) &&
1223             !file_check_permissions(key_file, geteuid(), 0600, &st))
1224         {
1225                 DEBUG(0, ("Invalid permissions on TLS private key file '%s':\n"
1226                           "owner uid %u should be %u, mode 0%o should be 0%o\n"
1227                           "This is known as CVE-2013-4476.\n"
1228                           "Removing all tls .pem files will cause an "
1229                           "auto-regeneration with the correct permissions.\n",
1230                           key_file,
1231                           (unsigned int)st.st_uid, geteuid(),
1232                           (unsigned int)(st.st_mode & 0777), 0600));
1233                 TALLOC_FREE(__tlsp);
1234                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1235         }
1236
1237         ret = gnutls_certificate_allocate_credentials(&tlsp->x509_cred);
1238         if (ret != GNUTLS_E_SUCCESS) {
1239                 DEBUG(0,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
1240                 TALLOC_FREE(__tlsp);
1241                 return NT_STATUS_NO_MEMORY;
1242         }
1243
1244         if (ca_file && *ca_file) {
1245                 ret = gnutls_certificate_set_x509_trust_file(tlsp->x509_cred,
1246                                                              ca_file,
1247                                                              GNUTLS_X509_FMT_PEM);
1248                 if (ret < 0) {
1249                         DEBUG(0,("TLS failed to initialise cafile %s - %s\n",
1250                                  ca_file, gnutls_strerror(ret)));
1251                         TALLOC_FREE(__tlsp);
1252                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1253                 }
1254         }
1255
1256         if (crl_file && *crl_file) {
1257                 ret = gnutls_certificate_set_x509_crl_file(tlsp->x509_cred,
1258                                                            crl_file,
1259                                                            GNUTLS_X509_FMT_PEM);
1260                 if (ret < 0) {
1261                         DEBUG(0,("TLS failed to initialise crlfile %s - %s\n",
1262                                  crl_file, gnutls_strerror(ret)));
1263                         TALLOC_FREE(__tlsp);
1264                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1265                 }
1266         }
1267
1268         ret = gnutls_certificate_set_x509_key_file(tlsp->x509_cred,
1269                                                    cert_file, key_file,
1270                                                    GNUTLS_X509_FMT_PEM);
1271         if (ret != GNUTLS_E_SUCCESS) {
1272                 DEBUG(0,("TLS failed to initialise certfile %s and keyfile %s - %s\n",
1273                          cert_file, key_file, gnutls_strerror(ret)));
1274                 TALLOC_FREE(__tlsp);
1275                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1276         }
1277
1278         ret = gnutls_dh_params_init(&tlsp->dh_params);
1279         if (ret != GNUTLS_E_SUCCESS) {
1280                 DEBUG(0,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
1281                 TALLOC_FREE(__tlsp);
1282                 return NT_STATUS_NO_MEMORY;
1283         }
1284
1285         if (dhp_file && *dhp_file) {
1286                 gnutls_datum_t dhparms;
1287                 size_t size;
1288
1289                 dhparms.data = (uint8_t *)file_load(dhp_file, &size, 0, tlsp);
1290
1291                 if (!dhparms.data) {
1292                         DEBUG(0,("TLS failed to read DH Parms from %s - %d:%s\n",
1293                                  dhp_file, errno, strerror(errno)));
1294                         TALLOC_FREE(__tlsp);
1295                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1296                 }
1297                 dhparms.size = size;
1298
1299                 ret = gnutls_dh_params_import_pkcs3(tlsp->dh_params,
1300                                                     &dhparms,
1301                                                     GNUTLS_X509_FMT_PEM);
1302                 if (ret != GNUTLS_E_SUCCESS) {
1303                         DEBUG(0,("TLS failed to import pkcs3 %s - %s\n",
1304                                  dhp_file, gnutls_strerror(ret)));
1305                         TALLOC_FREE(__tlsp);
1306                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1307                 }
1308         } else {
1309                 ret = gnutls_dh_params_generate2(tlsp->dh_params, DH_BITS);
1310                 if (ret != GNUTLS_E_SUCCESS) {
1311                         DEBUG(0,("TLS failed to generate dh_params - %s\n",
1312                                  gnutls_strerror(ret)));
1313                         TALLOC_FREE(__tlsp);
1314                         return NT_STATUS_INTERNAL_ERROR;
1315                 }
1316         }
1317
1318         gnutls_certificate_set_dh_params(tlsp->x509_cred, tlsp->dh_params);
1319
1320         tlsp->tls_priority = talloc_strdup(tlsp, tls_priority);
1321         if (tlsp->tls_priority == NULL) {
1322                 TALLOC_FREE(__tlsp);
1323                 return NT_STATUS_NO_MEMORY;
1324         }
1325
1326         tlsp->tls_enabled = true;
1327
1328         *_tlsp = __tlsp;
1329         return NT_STATUS_OK;
1330 }
1331
1332 struct tstream_tls_accept_state {
1333         struct tstream_context *tls_stream;
1334 };
1335
1336 struct tevent_req *_tstream_tls_accept_send(TALLOC_CTX *mem_ctx,
1337                                             struct tevent_context *ev,
1338                                             struct tstream_context *plain_stream,
1339                                             struct tstream_tls_params *_tlsp,
1340                                             const char *location)
1341 {
1342         struct tevent_req *req;
1343         struct tstream_tls_accept_state *state;
1344         struct tstream_tls *tlss;
1345         NTSTATUS status;
1346
1347         req = tevent_req_create(mem_ctx, &state,
1348                                 struct tstream_tls_accept_state);
1349         if (req == NULL) {
1350                 return NULL;
1351         }
1352
1353         state->tls_stream = tstream_context_create(state,
1354                                                    &tstream_tls_ops,
1355                                                    &tlss,
1356                                                    struct tstream_tls,
1357                                                    location);
1358         if (tevent_req_nomem(state->tls_stream, req)) {
1359                 return tevent_req_post(req, ev);
1360         }
1361         ZERO_STRUCTP(tlss);
1362         talloc_set_destructor(tlss, tstream_tls_destructor);
1363         tlss->plain_stream = plain_stream;
1364         tlss->is_server = true;
1365         tlss->current_ev = ev;
1366
1367         status = tstream_tls_prepare_gnutls(_tlsp, tlss);
1368         if (NT_STATUS_EQUAL(status, NT_STATUS_NO_MEMORY)) {
1369                 tevent_req_oom(req);
1370                 return tevent_req_post(req, ev);
1371         }
1372         if (!NT_STATUS_IS_OK(status)) {
1373                 tevent_req_error(req, EINVAL);
1374                 return tevent_req_post(req, ev);
1375         }
1376
1377         gnutls_transport_set_ptr(tlss->tls_session,
1378                                  (gnutls_transport_ptr_t)state->tls_stream);
1379         gnutls_transport_set_pull_function(tlss->tls_session,
1380                                            (gnutls_pull_func)tstream_tls_pull_function);
1381         gnutls_transport_set_push_function(tlss->tls_session,
1382                                            (gnutls_push_func)tstream_tls_push_function);
1383
1384         tlss->handshake.req = req;
1385         tstream_tls_retry_handshake(state->tls_stream);
1386         if (!tevent_req_is_in_progress(req)) {
1387                 return tevent_req_post(req, ev);
1388         }
1389
1390         return req;
1391 }
1392
1393 static void tstream_tls_retry_handshake(struct tstream_context *stream)
1394 {
1395         struct tstream_tls *tlss =
1396                 tstream_context_data(stream,
1397                 struct tstream_tls);
1398         struct tevent_req *req = tlss->handshake.req;
1399         int ret;
1400
1401         if (tlss->error != 0) {
1402                 tevent_req_error(req, tlss->error);
1403                 return;
1404         }
1405
1406         ret = gnutls_handshake(tlss->tls_session);
1407         if (ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN) {
1408                 return;
1409         }
1410
1411         tlss->handshake.req = NULL;
1412
1413         if (gnutls_error_is_fatal(ret) != 0) {
1414                 DEBUG(1,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
1415                 tlss->error = EIO;
1416                 tevent_req_error(req, tlss->error);
1417                 return;
1418         }
1419
1420         if (ret != GNUTLS_E_SUCCESS) {
1421                 DEBUG(1,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
1422                 tlss->error = EIO;
1423                 tevent_req_error(req, tlss->error);
1424                 return;
1425         }
1426
1427         if (tlss->verify_peer >= TLS_VERIFY_PEER_CA_ONLY) {
1428                 unsigned int status = UINT32_MAX;
1429                 bool ip = true;
1430                 const char *hostname = NULL;
1431
1432                 if (tlss->peer_name != NULL) {
1433                         ip = is_ipaddress(tlss->peer_name);
1434                 }
1435
1436                 if (!ip) {
1437                         hostname = tlss->peer_name;
1438                 }
1439
1440                 if (tlss->verify_peer == TLS_VERIFY_PEER_CA_ONLY) {
1441                         hostname = NULL;
1442                 }
1443
1444                 if (tlss->verify_peer >= TLS_VERIFY_PEER_CA_AND_NAME) {
1445                         if (hostname == NULL) {
1446                                 DEBUG(1,("TLS %s - no hostname available for "
1447                                          "verify_peer[%s] and peer_name[%s]\n",
1448                                          __location__,
1449                                          tls_verify_peer_string(tlss->verify_peer),
1450                                          tlss->peer_name));
1451                                 tlss->error = EINVAL;
1452                                 tevent_req_error(req, tlss->error);
1453                                 return;
1454                         }
1455                 }
1456
1457                 ret = gnutls_certificate_verify_peers3(tlss->tls_session,
1458                                                        hostname,
1459                                                        &status);
1460                 if (ret != GNUTLS_E_SUCCESS) {
1461                         DEBUG(1,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
1462                         tlss->error = EIO;
1463                         tevent_req_error(req, tlss->error);
1464                         return;
1465                 }
1466
1467                 if (status != 0) {
1468                         DEBUG(1,("TLS %s - check failed for "
1469                                  "verify_peer[%s] and peer_name[%s] "
1470                                  "status 0x%x (%s%s%s%s%s%s%s%s)\n",
1471                                  __location__,
1472                                  tls_verify_peer_string(tlss->verify_peer),
1473                                  tlss->peer_name,
1474                                  status,
1475                                  status & GNUTLS_CERT_INVALID ? "invalid " : "",
1476                                  status & GNUTLS_CERT_REVOKED ? "revoked " : "",
1477                                  status & GNUTLS_CERT_SIGNER_NOT_FOUND ?
1478                                         "signer_not_found " : "",
1479                                  status & GNUTLS_CERT_SIGNER_NOT_CA ?
1480                                         "signer_not_ca " : "",
1481                                  status & GNUTLS_CERT_INSECURE_ALGORITHM ?
1482                                         "insecure_algorithm " : "",
1483                                  status & GNUTLS_CERT_NOT_ACTIVATED ?
1484                                         "not_activated " : "",
1485                                  status & GNUTLS_CERT_EXPIRED ?
1486                                         "expired " : "",
1487                                  status & GNUTLS_CERT_UNEXPECTED_OWNER ?
1488                                         "unexpected_owner " : ""));
1489                         tlss->error = EINVAL;
1490                         tevent_req_error(req, tlss->error);
1491                         return;
1492                 }
1493         }
1494
1495         if (tlss->push.subreq != NULL || tlss->pull.subreq != NULL) {
1496                 tlss->waiting_flush.mgmt_req = req;
1497                 return;
1498         }
1499
1500         tevent_req_done(req);
1501 }
1502
1503 int tstream_tls_accept_recv(struct tevent_req *req,
1504                             int *perrno,
1505                             TALLOC_CTX *mem_ctx,
1506                             struct tstream_context **tls_stream)
1507 {
1508         struct tstream_tls_accept_state *state =
1509                 tevent_req_data(req,
1510                 struct tstream_tls_accept_state);
1511
1512         if (tevent_req_is_unix_error(req, perrno)) {
1513                 tevent_req_received(req);
1514                 return -1;
1515         }
1516
1517         *tls_stream = talloc_move(mem_ctx, &state->tls_stream);
1518         tevent_req_received(req);
1519         return 0;
1520 }