source4/lib/tls/tls_tstream.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Stefan Metzmacher 2010
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "system/network.h"
  22 #include "system/filesys.h"
  23 #include "system/time.h"
  24 #include "../util/tevent_unix.h"
  25 #include "../lib/tsocket/tsocket.h"
  26 #include "../lib/tsocket/tsocket_internal.h"
  27 #include "../lib/util/util_net.h"
  28 #include "lib/tls/tls.h"
  29
  30 #include <gnutls/gnutls.h>
  31 #include <gnutls/x509.h>
  32
  33 #define DH_BITS 2048
  34
  35 const char *tls_verify_peer_string(enum tls_verify_peer_state verify_peer)
  36 {
  37         switch (verify_peer) {
  38         case TLS_VERIFY_PEER_NO_CHECK:
  39                 return TLS_VERIFY_PEER_NO_CHECK_STRING;
  40
  41         case TLS_VERIFY_PEER_CA_ONLY:
  42                 return TLS_VERIFY_PEER_CA_ONLY_STRING;
  43
  44         case TLS_VERIFY_PEER_CA_AND_NAME_IF_AVAILABLE:
  45                 return TLS_VERIFY_PEER_CA_AND_NAME_IF_AVAILABLE_STRING;
  46
  47         case TLS_VERIFY_PEER_CA_AND_NAME:
  48                 return TLS_VERIFY_PEER_CA_AND_NAME_STRING;
  49
  50         case TLS_VERIFY_PEER_AS_STRICT_AS_POSSIBLE:
  51                 return TLS_VERIFY_PEER_AS_STRICT_AS_POSSIBLE_STRING;
  52         }
  53
  54         return "unknown tls_verify_peer_state";
  55 }
  56
  57 static const struct tstream_context_ops tstream_tls_ops;
  58
  59 struct tstream_tls {
  60         struct tstream_context *plain_stream;
  61         int error;
  62
  63         gnutls_session_t tls_session;
  64
  65         enum tls_verify_peer_state verify_peer;
  66         const char *peer_name;
  67
  68         struct tevent_context *current_ev;
  69
  70         struct tevent_immediate *retry_im;
  71
  72         struct {
  73                 uint8_t *buf;
  74                 off_t ofs;
  75                 struct iovec iov;
  76                 struct tevent_req *subreq;
  77                 struct tevent_immediate *im;
  78         } push;
  79
  80         struct {
  81                 uint8_t *buf;
  82                 struct iovec iov;
  83                 struct tevent_req *subreq;
  84         } pull;
  85
  86         struct {
  87                 struct tevent_req *req;
  88         } handshake;
  89
  90         struct {
  91                 off_t ofs;
  92                 size_t left;
  93                 uint8_t buffer[1024];
  94                 struct tevent_req *req;
  95         } write;
  96
  97         struct {
  98                 off_t ofs;
  99                 size_t left;
 100                 uint8_t buffer[1024];
 101                 struct tevent_req *req;
 102         } read;
 103
 104         struct {
 105                 struct tevent_req *req;
 106         } disconnect;
 107 };
 108
 109 static void tstream_tls_retry_handshake(struct tstream_context *stream);
 110 static void tstream_tls_retry_read(struct tstream_context *stream);
 111 static void tstream_tls_retry_write(struct tstream_context *stream);
 112 static void tstream_tls_retry_disconnect(struct tstream_context *stream);
 113 static void tstream_tls_retry_trigger(struct tevent_context *ctx,
 114                                       struct tevent_immediate *im,
 115                                       void *private_data);
 116
 117 static void tstream_tls_retry(struct tstream_context *stream, bool deferred)
 118 {
 119
 120         struct tstream_tls *tlss =
 121                 tstream_context_data(stream,
 122                 struct tstream_tls);
 123
 124         if (tlss->disconnect.req) {
 125                 tstream_tls_retry_disconnect(stream);
 126                 return;
 127         }
 128
 129         if (tlss->handshake.req) {
 130                 tstream_tls_retry_handshake(stream);
 131                 return;
 132         }
 133
 134         if (tlss->write.req && tlss->read.req && !deferred) {
 135                 tevent_schedule_immediate(tlss->retry_im, tlss->current_ev,
 136                                           tstream_tls_retry_trigger,
 137                                           stream);
 138         }
 139
 140         if (tlss->write.req) {
 141                 tstream_tls_retry_write(stream);
 142                 return;
 143         }
 144
 145         if (tlss->read.req) {
 146                 tstream_tls_retry_read(stream);
 147                 return;
 148         }
 149 }
 150
 151 static void tstream_tls_retry_trigger(struct tevent_context *ctx,
 152                                       struct tevent_immediate *im,
 153                                       void *private_data)
 154 {
 155         struct tstream_context *stream =
 156                 talloc_get_type_abort(private_data,
 157                 struct tstream_context);
 158
 159         tstream_tls_retry(stream, true);
 160 }
 161
 162 static void tstream_tls_push_trigger_write(struct tevent_context *ev,
 163                                            struct tevent_immediate *im,
 164                                            void *private_data);
 165
 166 static ssize_t tstream_tls_push_function(gnutls_transport_ptr_t ptr,
 167                                          const void *buf, size_t size)
 168 {
 169         struct tstream_context *stream =
 170                 talloc_get_type_abort(ptr,
 171                 struct tstream_context);
 172         struct tstream_tls *tlss =
 173                 tstream_context_data(stream,
 174                 struct tstream_tls);
 175         uint8_t *nbuf;
 176         size_t len;
 177
 178         if (tlss->error != 0) {
 179                 errno = tlss->error;
 180                 return -1;
 181         }
 182
 183         if (tlss->push.subreq) {
 184                 errno = EAGAIN;
 185                 return -1;
 186         }
 187
 188         len = MIN(size, UINT16_MAX - tlss->push.ofs);
 189
 190         if (len == 0) {
 191                 errno = EAGAIN;
 192                 return -1;
 193         }
 194
 195         nbuf = talloc_realloc(tlss, tlss->push.buf,
 196                               uint8_t, tlss->push.ofs + len);
 197         if (nbuf == NULL) {
 198                 if (tlss->push.buf) {
 199                         errno = EAGAIN;
 200                         return -1;
 201                 }
 202
 203                 return -1;
 204         }
 205         tlss->push.buf = nbuf;
 206
 207         memcpy(tlss->push.buf + tlss->push.ofs, buf, len);
 208
 209         if (tlss->push.im == NULL) {
 210                 tlss->push.im = tevent_create_immediate(tlss);
 211                 if (tlss->push.im == NULL) {
 212                         errno = ENOMEM;
 213                         return -1;
 214                 }
 215         }
 216
 217         if (tlss->push.ofs == 0) {
 218                 /*
 219                  * We'll do start the tstream_writev
 220                  * in the next event cycle.
 221                  *
 222                  * This way we can batch all push requests,
 223                  * if they fit into a UINT16_MAX buffer.
 224                  *
 225                  * This is important as gnutls_handshake()
 226                  * had a bug in some versions e.g. 2.4.1
 227                  * and others (See bug #7218) and it doesn't
 228                  * handle EAGAIN.
 229                  */
 230                 tevent_schedule_immediate(tlss->push.im,
 231                                           tlss->current_ev,
 232                                           tstream_tls_push_trigger_write,
 233                                           stream);
 234         }
 235
 236         tlss->push.ofs += len;
 237         return len;
 238 }
 239
 240 static void tstream_tls_push_done(struct tevent_req *subreq);
 241
 242 static void tstream_tls_push_trigger_write(struct tevent_context *ev,
 243                                            struct tevent_immediate *im,
 244                                            void *private_data)
 245 {
 246         struct tstream_context *stream =
 247                 talloc_get_type_abort(private_data,
 248                 struct tstream_context);
 249         struct tstream_tls *tlss =
 250                 tstream_context_data(stream,
 251                 struct tstream_tls);
 252         struct tevent_req *subreq;
 253
 254         if (tlss->push.subreq) {
 255                 /* nothing todo */
 256                 return;
 257         }
 258
 259         tlss->push.iov.iov_base = (char *)tlss->push.buf;
 260         tlss->push.iov.iov_len = tlss->push.ofs;
 261
 262         subreq = tstream_writev_send(tlss,
 263                                      tlss->current_ev,
 264                                      tlss->plain_stream,
 265                                      &tlss->push.iov, 1);
 266         if (subreq == NULL) {
 267                 tlss->error = ENOMEM;
 268                 tstream_tls_retry(stream, false);
 269                 return;
 270         }
 271         tevent_req_set_callback(subreq, tstream_tls_push_done, stream);
 272
 273         tlss->push.subreq = subreq;
 274 }
 275
 276 static void tstream_tls_push_done(struct tevent_req *subreq)
 277 {
 278         struct tstream_context *stream =
 279                 tevent_req_callback_data(subreq,
 280                 struct tstream_context);
 281         struct tstream_tls *tlss =
 282                 tstream_context_data(stream,
 283                 struct tstream_tls);
 284         int ret;
 285         int sys_errno;
 286
 287         tlss->push.subreq = NULL;
 288         ZERO_STRUCT(tlss->push.iov);
 289         TALLOC_FREE(tlss->push.buf);
 290         tlss->push.ofs = 0;
 291
 292         ret = tstream_writev_recv(subreq, &sys_errno);
 293         TALLOC_FREE(subreq);
 294         if (ret == -1) {
 295                 tlss->error = sys_errno;
 296                 tstream_tls_retry(stream, false);
 297                 return;
 298         }
 299
 300         tstream_tls_retry(stream, false);
 301 }
 302
 303 static void tstream_tls_pull_done(struct tevent_req *subreq);
 304
 305 static ssize_t tstream_tls_pull_function(gnutls_transport_ptr_t ptr,
 306                                          void *buf, size_t size)
 307 {
 308         struct tstream_context *stream =
 309                 talloc_get_type_abort(ptr,
 310                 struct tstream_context);
 311         struct tstream_tls *tlss =
 312                 tstream_context_data(stream,
 313                 struct tstream_tls);
 314         struct tevent_req *subreq;
 315         size_t len;
 316
 317         if (tlss->error != 0) {
 318                 errno = tlss->error;
 319                 return -1;
 320         }
 321
 322         if (tlss->pull.subreq) {
 323                 errno = EAGAIN;
 324                 return -1;
 325         }
 326
 327         if (tlss->pull.iov.iov_base) {
 328                 uint8_t *b;
 329                 size_t n;
 330
 331                 b = (uint8_t *)tlss->pull.iov.iov_base;
 332
 333                 n = MIN(tlss->pull.iov.iov_len, size);
 334                 memcpy(buf, b, n);
 335
 336                 tlss->pull.iov.iov_len -= n;
 337                 b += n;
 338                 tlss->pull.iov.iov_base = (char *)b;
 339                 if (tlss->pull.iov.iov_len == 0) {
 340                         tlss->pull.iov.iov_base = NULL;
 341                         TALLOC_FREE(tlss->pull.buf);
 342                 }
 343
 344                 return n;
 345         }
 346
 347         if (size == 0) {
 348                 return 0;
 349         }
 350
 351         len = MIN(size, UINT16_MAX);
 352
 353         tlss->pull.buf = talloc_array(tlss, uint8_t, len);
 354         if (tlss->pull.buf == NULL) {
 355                 return -1;
 356         }
 357
 358         tlss->pull.iov.iov_base = (char *)tlss->pull.buf;
 359         tlss->pull.iov.iov_len = len;
 360
 361         subreq = tstream_readv_send(tlss,
 362                                     tlss->current_ev,
 363                                     tlss->plain_stream,
 364                                     &tlss->pull.iov, 1);
 365         if (subreq == NULL) {
 366                 errno = ENOMEM;
 367                 return -1;
 368         }
 369         tevent_req_set_callback(subreq, tstream_tls_pull_done, stream);
 370
 371         tlss->pull.subreq = subreq;
 372         errno = EAGAIN;
 373         return -1;
 374 }
 375
 376 static void tstream_tls_pull_done(struct tevent_req *subreq)
 377 {
 378         struct tstream_context *stream =
 379                 tevent_req_callback_data(subreq,
 380                 struct tstream_context);
 381         struct tstream_tls *tlss =
 382                 tstream_context_data(stream,
 383                 struct tstream_tls);
 384         int ret;
 385         int sys_errno;
 386
 387         tlss->pull.subreq = NULL;
 388
 389         ret = tstream_readv_recv(subreq, &sys_errno);
 390         TALLOC_FREE(subreq);
 391         if (ret == -1) {
 392                 tlss->error = sys_errno;
 393                 tstream_tls_retry(stream, false);
 394                 return;
 395         }
 396
 397         tstream_tls_retry(stream, false);
 398 }
 399
 400 static int tstream_tls_destructor(struct tstream_tls *tlss)
 401 {
 402         if (tlss->tls_session) {
 403                 gnutls_deinit(tlss->tls_session);
 404                 tlss->tls_session = NULL;
 405         }
 406
 407         return 0;
 408 }
 409
 410 static ssize_t tstream_tls_pending_bytes(struct tstream_context *stream)
 411 {
 412         struct tstream_tls *tlss =
 413                 tstream_context_data(stream,
 414                 struct tstream_tls);
 415         size_t ret;
 416
 417         if (tlss->error != 0) {
 418                 errno = tlss->error;
 419                 return -1;
 420         }
 421
 422         ret = gnutls_record_check_pending(tlss->tls_session);
 423         ret += tlss->read.left;
 424
 425         return ret;
 426 }
 427
 428 struct tstream_tls_readv_state {
 429         struct tstream_context *stream;
 430
 431         struct iovec *vector;
 432         int count;
 433
 434         int ret;
 435 };
 436
 437 static void tstream_tls_readv_crypt_next(struct tevent_req *req);
 438
 439 static struct tevent_req *tstream_tls_readv_send(TALLOC_CTX *mem_ctx,
 440                                         struct tevent_context *ev,
 441                                         struct tstream_context *stream,
 442                                         struct iovec *vector,
 443                                         size_t count)
 444 {
 445         struct tstream_tls *tlss =
 446                 tstream_context_data(stream,
 447                 struct tstream_tls);
 448         struct tevent_req *req;
 449         struct tstream_tls_readv_state *state;
 450
 451         tlss->read.req = NULL;
 452         tlss->current_ev = ev;
 453
 454         req = tevent_req_create(mem_ctx, &state,
 455                                 struct tstream_tls_readv_state);
 456         if (req == NULL) {
 457                 return NULL;
 458         }
 459
 460         state->stream = stream;
 461         state->ret = 0;
 462
 463         if (tlss->error != 0) {
 464                 tevent_req_error(req, tlss->error);
 465                 return tevent_req_post(req, ev);
 466         }
 467
 468         /*
 469          * we make a copy of the vector so we can change the structure
 470          */
 471         state->vector = talloc_array(state, struct iovec, count);
 472         if (tevent_req_nomem(state->vector, req)) {
 473                 return tevent_req_post(req, ev);
 474         }
 475         memcpy(state->vector, vector, sizeof(struct iovec) * count);
 476         state->count = count;
 477
 478         tstream_tls_readv_crypt_next(req);
 479         if (!tevent_req_is_in_progress(req)) {
 480                 return tevent_req_post(req, ev);
 481         }
 482
 483         return req;
 484 }
 485
 486 static void tstream_tls_readv_crypt_next(struct tevent_req *req)
 487 {
 488         struct tstream_tls_readv_state *state =
 489                 tevent_req_data(req,
 490                 struct tstream_tls_readv_state);
 491         struct tstream_tls *tlss =
 492                 tstream_context_data(state->stream,
 493                 struct tstream_tls);
 494
 495         /*
 496          * copy the pending buffer first
 497          */
 498         while (tlss->read.left > 0 && state->count > 0) {
 499                 uint8_t *base = (uint8_t *)state->vector[0].iov_base;
 500                 size_t len = MIN(tlss->read.left, state->vector[0].iov_len);
 501
 502                 memcpy(base, tlss->read.buffer + tlss->read.ofs, len);
 503
 504                 base += len;
 505                 state->vector[0].iov_base = (char *) base;
 506                 state->vector[0].iov_len -= len;
 507
 508                 tlss->read.ofs += len;
 509                 tlss->read.left -= len;
 510
 511                 if (state->vector[0].iov_len == 0) {
 512                         state->vector += 1;
 513                         state->count -= 1;
 514                 }
 515
 516                 state->ret += len;
 517         }
 518
 519         if (state->count == 0) {
 520                 tevent_req_done(req);
 521                 return;
 522         }
 523
 524         tlss->read.req = req;
 525         tstream_tls_retry_read(state->stream);
 526 }
 527
 528 static void tstream_tls_retry_read(struct tstream_context *stream)
 529 {
 530         struct tstream_tls *tlss =
 531                 tstream_context_data(stream,
 532                 struct tstream_tls);
 533         struct tevent_req *req = tlss->read.req;
 534         int ret;
 535
 536         if (tlss->error != 0) {
 537                 tevent_req_error(req, tlss->error);
 538                 return;
 539         }
 540
 541         tlss->read.left = 0;
 542         tlss->read.ofs = 0;
 543
 544         ret = gnutls_record_recv(tlss->tls_session,
 545                                  tlss->read.buffer,
 546                                  sizeof(tlss->read.buffer));
 547         if (ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN) {
 548                 return;
 549         }
 550
 551         tlss->read.req = NULL;
 552
 553         if (gnutls_error_is_fatal(ret) != 0) {
 554                 DEBUG(1,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
 555                 tlss->error = EIO;
 556                 tevent_req_error(req, tlss->error);
 557                 return;
 558         }
 559
 560         if (ret == 0) {
 561                 tlss->error = EPIPE;
 562                 tevent_req_error(req, tlss->error);
 563                 return;
 564         }
 565
 566         tlss->read.left = ret;
 567         tstream_tls_readv_crypt_next(req);
 568 }
 569
 570 static int tstream_tls_readv_recv(struct tevent_req *req,
 571                                   int *perrno)
 572 {
 573         struct tstream_tls_readv_state *state =
 574                 tevent_req_data(req,
 575                 struct tstream_tls_readv_state);
 576         struct tstream_tls *tlss =
 577                 tstream_context_data(state->stream,
 578                 struct tstream_tls);
 579         int ret;
 580
 581         tlss->read.req = NULL;
 582
 583         ret = tsocket_simple_int_recv(req, perrno);
 584         if (ret == 0) {
 585                 ret = state->ret;
 586         }
 587
 588         tevent_req_received(req);
 589         return ret;
 590 }
 591
 592 struct tstream_tls_writev_state {
 593         struct tstream_context *stream;
 594
 595         struct iovec *vector;
 596         int count;
 597
 598         int ret;
 599 };
 600
 601 static void tstream_tls_writev_crypt_next(struct tevent_req *req);
 602
 603 static struct tevent_req *tstream_tls_writev_send(TALLOC_CTX *mem_ctx,
 604                                         struct tevent_context *ev,
 605                                         struct tstream_context *stream,
 606                                         const struct iovec *vector,
 607                                         size_t count)
 608 {
 609         struct tstream_tls *tlss =
 610                 tstream_context_data(stream,
 611                 struct tstream_tls);
 612         struct tevent_req *req;
 613         struct tstream_tls_writev_state *state;
 614
 615         tlss->write.req = NULL;
 616         tlss->current_ev = ev;
 617
 618         req = tevent_req_create(mem_ctx, &state,
 619                                 struct tstream_tls_writev_state);
 620         if (req == NULL) {
 621                 return NULL;
 622         }
 623
 624         state->stream = stream;
 625         state->ret = 0;
 626
 627         if (tlss->error != 0) {
 628                 tevent_req_error(req, tlss->error);
 629                 return tevent_req_post(req, ev);
 630         }
 631
 632         /*
 633          * we make a copy of the vector so we can change the structure
 634          */
 635         state->vector = talloc_array(state, struct iovec, count);
 636         if (tevent_req_nomem(state->vector, req)) {
 637                 return tevent_req_post(req, ev);
 638         }
 639         memcpy(state->vector, vector, sizeof(struct iovec) * count);
 640         state->count = count;
 641
 642         tstream_tls_writev_crypt_next(req);
 643         if (!tevent_req_is_in_progress(req)) {
 644                 return tevent_req_post(req, ev);
 645         }
 646
 647         return req;
 648 }
 649
 650 static void tstream_tls_writev_crypt_next(struct tevent_req *req)
 651 {
 652         struct tstream_tls_writev_state *state =
 653                 tevent_req_data(req,
 654                 struct tstream_tls_writev_state);
 655         struct tstream_tls *tlss =
 656                 tstream_context_data(state->stream,
 657                 struct tstream_tls);
 658
 659         tlss->write.left = sizeof(tlss->write.buffer);
 660         tlss->write.ofs = 0;
 661
 662         /*
 663          * first fill our buffer
 664          */
 665         while (tlss->write.left > 0 && state->count > 0) {
 666                 uint8_t *base = (uint8_t *)state->vector[0].iov_base;
 667                 size_t len = MIN(tlss->write.left, state->vector[0].iov_len);
 668
 669                 memcpy(tlss->write.buffer + tlss->write.ofs, base, len);
 670
 671                 base += len;
 672                 state->vector[0].iov_base = (char *) base;
 673                 state->vector[0].iov_len -= len;
 674
 675                 tlss->write.ofs += len;
 676                 tlss->write.left -= len;
 677
 678                 if (state->vector[0].iov_len == 0) {
 679                         state->vector += 1;
 680                         state->count -= 1;
 681                 }
 682
 683                 state->ret += len;
 684         }
 685
 686         if (tlss->write.ofs == 0) {
 687                 tevent_req_done(req);
 688                 return;
 689         }
 690
 691         tlss->write.left = tlss->write.ofs;
 692         tlss->write.ofs = 0;
 693
 694         tlss->write.req = req;
 695         tstream_tls_retry_write(state->stream);
 696 }
 697
 698 static void tstream_tls_retry_write(struct tstream_context *stream)
 699 {
 700         struct tstream_tls *tlss =
 701                 tstream_context_data(stream,
 702                 struct tstream_tls);
 703         struct tevent_req *req = tlss->write.req;
 704         int ret;
 705
 706         if (tlss->error != 0) {
 707                 tevent_req_error(req, tlss->error);
 708                 return;
 709         }
 710
 711         ret = gnutls_record_send(tlss->tls_session,
 712                                  tlss->write.buffer + tlss->write.ofs,
 713                                  tlss->write.left);
 714         if (ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN) {
 715                 return;
 716         }
 717
 718         tlss->write.req = NULL;
 719
 720         if (gnutls_error_is_fatal(ret) != 0) {
 721                 DEBUG(1,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
 722                 tlss->error = EIO;
 723                 tevent_req_error(req, tlss->error);
 724                 return;
 725         }
 726
 727         if (ret == 0) {
 728                 tlss->error = EPIPE;
 729                 tevent_req_error(req, tlss->error);
 730                 return;
 731         }
 732
 733         tlss->write.ofs += ret;
 734         tlss->write.left -= ret;
 735
 736         if (tlss->write.left > 0) {
 737                 tlss->write.req = req;
 738                 tstream_tls_retry_write(stream);
 739                 return;
 740         }
 741
 742         tstream_tls_writev_crypt_next(req);
 743 }
 744
 745 static int tstream_tls_writev_recv(struct tevent_req *req,
 746                                    int *perrno)
 747 {
 748         struct tstream_tls_writev_state *state =
 749                 tevent_req_data(req,
 750                 struct tstream_tls_writev_state);
 751         struct tstream_tls *tlss =
 752                 tstream_context_data(state->stream,
 753                 struct tstream_tls);
 754         int ret;
 755
 756         tlss->write.req = NULL;
 757
 758         ret = tsocket_simple_int_recv(req, perrno);
 759         if (ret == 0) {
 760                 ret = state->ret;
 761         }
 762
 763         tevent_req_received(req);
 764         return ret;
 765 }
 766
 767 struct tstream_tls_disconnect_state {
 768         uint8_t _dummy;
 769 };
 770
 771 static struct tevent_req *tstream_tls_disconnect_send(TALLOC_CTX *mem_ctx,
 772                                                 struct tevent_context *ev,
 773                                                 struct tstream_context *stream)
 774 {
 775         struct tstream_tls *tlss =
 776                 tstream_context_data(stream,
 777                 struct tstream_tls);
 778         struct tevent_req *req;
 779         struct tstream_tls_disconnect_state *state;
 780
 781         tlss->disconnect.req = NULL;
 782         tlss->current_ev = ev;
 783
 784         req = tevent_req_create(mem_ctx, &state,
 785                                 struct tstream_tls_disconnect_state);
 786         if (req == NULL) {
 787                 return NULL;
 788         }
 789
 790         if (tlss->error != 0) {
 791                 tevent_req_error(req, tlss->error);
 792                 return tevent_req_post(req, ev);
 793         }
 794
 795         tlss->disconnect.req = req;
 796         tstream_tls_retry_disconnect(stream);
 797         if (!tevent_req_is_in_progress(req)) {
 798                 return tevent_req_post(req, ev);
 799         }
 800
 801         return req;
 802 }
 803
 804 static void tstream_tls_retry_disconnect(struct tstream_context *stream)
 805 {
 806         struct tstream_tls *tlss =
 807                 tstream_context_data(stream,
 808                 struct tstream_tls);
 809         struct tevent_req *req = tlss->disconnect.req;
 810         int ret;
 811
 812         if (tlss->error != 0) {
 813                 tevent_req_error(req, tlss->error);
 814                 return;
 815         }
 816
 817         ret = gnutls_bye(tlss->tls_session, GNUTLS_SHUT_WR);
 818         if (ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN) {
 819                 return;
 820         }
 821
 822         tlss->disconnect.req = NULL;
 823
 824         if (gnutls_error_is_fatal(ret) != 0) {
 825                 DEBUG(1,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
 826                 tlss->error = EIO;
 827                 tevent_req_error(req, tlss->error);
 828                 return;
 829         }
 830
 831         if (ret != GNUTLS_E_SUCCESS) {
 832                 DEBUG(1,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
 833                 tlss->error = EIO;
 834                 tevent_req_error(req, tlss->error);
 835                 return;
 836         }
 837
 838         tevent_req_done(req);
 839 }
 840
 841 static int tstream_tls_disconnect_recv(struct tevent_req *req,
 842                                        int *perrno)
 843 {
 844         int ret;
 845
 846         ret = tsocket_simple_int_recv(req, perrno);
 847
 848         tevent_req_received(req);
 849         return ret;
 850 }
 851
 852 static const struct tstream_context_ops tstream_tls_ops = {
 853         .name                   = "tls",
 854
 855         .pending_bytes          = tstream_tls_pending_bytes,
 856
 857         .readv_send             = tstream_tls_readv_send,
 858         .readv_recv             = tstream_tls_readv_recv,
 859
 860         .writev_send            = tstream_tls_writev_send,
 861         .writev_recv            = tstream_tls_writev_recv,
 862
 863         .disconnect_send        = tstream_tls_disconnect_send,
 864         .disconnect_recv        = tstream_tls_disconnect_recv,
 865 };
 866
 867 struct tstream_tls_params_internal {
 868         gnutls_certificate_credentials_t x509_cred;
 869         gnutls_dh_params_t dh_params;
 870         const char *tls_priority;
 871         bool tls_enabled;
 872         enum tls_verify_peer_state verify_peer;
 873         const char *peer_name;
 874 };
 875
 876 struct tstream_tls_params {
 877         struct tstream_tls_params_internal *internal;
 878 };
 879
 880 static int tstream_tls_params_internal_destructor(struct tstream_tls_params_internal *tlsp)
 881 {
 882         if (tlsp->x509_cred) {
 883                 gnutls_certificate_free_credentials(tlsp->x509_cred);
 884                 tlsp->x509_cred = NULL;
 885         }
 886         if (tlsp->dh_params) {
 887                 gnutls_dh_params_deinit(tlsp->dh_params);
 888                 tlsp->dh_params = NULL;
 889         }
 890
 891         return 0;
 892 }
 893
 894 bool tstream_tls_params_enabled(struct tstream_tls_params *tls_params)
 895 {
 896         struct tstream_tls_params_internal *tlsp = tls_params->internal;
 897
 898         return tlsp->tls_enabled;
 899 }
 900
 901 NTSTATUS tstream_tls_params_client(TALLOC_CTX *mem_ctx,
 902                                    const char *ca_file,
 903                                    const char *crl_file,
 904                                    const char *tls_priority,
 905                                    enum tls_verify_peer_state verify_peer,
 906                                    const char *peer_name,
 907                                    struct tstream_tls_params **_tlsp)
 908 {
 909         struct tstream_tls_params *__tlsp = NULL;
 910         struct tstream_tls_params_internal *tlsp = NULL;
 911         int ret;
 912
 913         __tlsp = talloc_zero(mem_ctx, struct tstream_tls_params);
 914         if (__tlsp == NULL) {
 915                 return NT_STATUS_NO_MEMORY;
 916         }
 917
 918         tlsp = talloc_zero(__tlsp, struct tstream_tls_params_internal);
 919         if (tlsp == NULL) {
 920                 TALLOC_FREE(__tlsp);
 921                 return NT_STATUS_NO_MEMORY;
 922         }
 923         talloc_set_destructor(tlsp, tstream_tls_params_internal_destructor);
 924         __tlsp->internal = tlsp;
 925
 926         tlsp->verify_peer = verify_peer;
 927         if (peer_name != NULL) {
 928                 tlsp->peer_name = talloc_strdup(tlsp, peer_name);
 929                 if (tlsp->peer_name == NULL) {
 930                         TALLOC_FREE(__tlsp);
 931                         return NT_STATUS_NO_MEMORY;
 932                 }
 933         } else if (tlsp->verify_peer >= TLS_VERIFY_PEER_CA_AND_NAME) {
 934                 DEBUG(0,("TLS failed to missing peer_name - "
 935                          "with 'tls verify peer = %s'\n",
 936                          tls_verify_peer_string(tlsp->verify_peer)));
 937                 TALLOC_FREE(__tlsp);
 938                 return NT_STATUS_INVALID_PARAMETER_MIX;
 939         }
 940
 941         ret = gnutls_certificate_allocate_credentials(&tlsp->x509_cred);
 942         if (ret != GNUTLS_E_SUCCESS) {
 943                 DEBUG(0,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
 944                 TALLOC_FREE(__tlsp);
 945                 return NT_STATUS_NO_MEMORY;
 946         }
 947
 948         if (ca_file && *ca_file && file_exist(ca_file)) {
 949                 ret = gnutls_certificate_set_x509_trust_file(tlsp->x509_cred,
 950                                                              ca_file,
 951                                                              GNUTLS_X509_FMT_PEM);
 952                 if (ret < 0) {
 953                         DEBUG(0,("TLS failed to initialise cafile %s - %s\n",
 954                                  ca_file, gnutls_strerror(ret)));
 955                         TALLOC_FREE(__tlsp);
 956                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 957                 }
 958         } else if (tlsp->verify_peer >= TLS_VERIFY_PEER_CA_ONLY) {
 959                 DEBUG(0,("TLS failed to missing cafile %s - "
 960                          "with 'tls verify peer = %s'\n",
 961                          ca_file,
 962                          tls_verify_peer_string(tlsp->verify_peer)));
 963                 TALLOC_FREE(__tlsp);
 964                 return NT_STATUS_INVALID_PARAMETER_MIX;
 965         }
 966
 967         if (crl_file && *crl_file && file_exist(crl_file)) {
 968                 ret = gnutls_certificate_set_x509_crl_file(tlsp->x509_cred,
 969                                                            crl_file,
 970                                                            GNUTLS_X509_FMT_PEM);
 971                 if (ret < 0) {
 972                         DEBUG(0,("TLS failed to initialise crlfile %s - %s\n",
 973                                  crl_file, gnutls_strerror(ret)));
 974                         TALLOC_FREE(__tlsp);
 975                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 976                 }
 977         } else if (tlsp->verify_peer >= TLS_VERIFY_PEER_AS_STRICT_AS_POSSIBLE) {
 978                 DEBUG(0,("TLS failed to missing crlfile %s - "
 979                          "with 'tls verify peer = %s'\n",
 980                          crl_file,
 981                          tls_verify_peer_string(tlsp->verify_peer)));
 982                 TALLOC_FREE(__tlsp);
 983                 return NT_STATUS_INVALID_PARAMETER_MIX;
 984         }
 985
 986         tlsp->tls_priority = talloc_strdup(tlsp, tls_priority);
 987         if (tlsp->tls_priority == NULL) {
 988                 TALLOC_FREE(__tlsp);
 989                 return NT_STATUS_NO_MEMORY;
 990         }
 991
 992         tlsp->tls_enabled = true;
 993
 994         *_tlsp = __tlsp;
 995         return NT_STATUS_OK;
 996 }
 997
 998 struct tstream_tls_connect_state {
 999         struct tstream_context *tls_stream;
1000 };
1001
1002 struct tevent_req *_tstream_tls_connect_send(TALLOC_CTX *mem_ctx,
1003                                              struct tevent_context *ev,
1004                                              struct tstream_context *plain_stream,
1005                                              struct tstream_tls_params *_tls_params,
1006                                              const char *location)
1007 {
1008         struct tevent_req *req;
1009         struct tstream_tls_connect_state *state;
1010         const char *error_pos;
1011         struct tstream_tls *tlss;
1012         struct tstream_tls_params_internal *tls_params = NULL;
1013         int ret;
1014         unsigned int flags = GNUTLS_CLIENT;
1015
1016         req = tevent_req_create(mem_ctx, &state,
1017                                 struct tstream_tls_connect_state);
1018         if (req == NULL) {
1019                 return NULL;
1020         }
1021
1022         state->tls_stream = tstream_context_create(state,
1023                                                    &tstream_tls_ops,
1024                                                    &tlss,
1025                                                    struct tstream_tls,
1026                                                    location);
1027         if (tevent_req_nomem(state->tls_stream, req)) {
1028                 return tevent_req_post(req, ev);
1029         }
1030         ZERO_STRUCTP(tlss);
1031         talloc_set_destructor(tlss, tstream_tls_destructor);
1032
1033         /*
1034          * Note we need to make sure x509_cred and dh_params
1035          * from tstream_tls_params_internal stay alive for
1036          * the whole lifetime of this session!
1037          *
1038          * See 'man gnutls_credentials_set' and
1039          * 'man gnutls_certificate_set_dh_params'.
1040          *
1041          * Note: here we use talloc_reference() in a way
1042          *       that does not expose it to the caller.
1043          *
1044          */
1045         tls_params = talloc_reference(tlss, _tls_params->internal);
1046         if (tevent_req_nomem(tls_params, req)) {
1047                 return tevent_req_post(req, ev);
1048         }
1049
1050         tlss->plain_stream = plain_stream;
1051         tlss->verify_peer = tls_params->verify_peer;
1052         if (tls_params->peer_name != NULL) {
1053                 tlss->peer_name = talloc_strdup(tlss, tls_params->peer_name);
1054                 if (tevent_req_nomem(tlss->peer_name, req)) {
1055                         return tevent_req_post(req, ev);
1056                 }
1057         }
1058
1059         tlss->current_ev = ev;
1060         tlss->retry_im = tevent_create_immediate(tlss);
1061         if (tevent_req_nomem(tlss->retry_im, req)) {
1062                 return tevent_req_post(req, ev);
1063         }
1064
1065 #ifdef GNUTLS_NO_TICKETS
1066         /*
1067          * tls_tstream can't properly handle 'New Session Ticket' messages
1068          * sent 'after' the client sends the 'Finished' message.
1069          * GNUTLS_NO_TICKETS was introduced in GnuTLS 3.5.6.  This flag is to
1070          * indicate the session Flag session should not use resumption with
1071          * session tickets.
1072          */
1073         flags |= GNUTLS_NO_TICKETS;
1074 #endif
1075
1076         ret = gnutls_init(&tlss->tls_session, flags);
1077         if (ret != GNUTLS_E_SUCCESS) {
1078                 DEBUG(0,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
1079                 tevent_req_error(req, EINVAL);
1080                 return tevent_req_post(req, ev);
1081         }
1082
1083         ret = gnutls_set_default_priority(tlss->tls_session);
1084         if (ret != GNUTLS_E_SUCCESS) {
1085                 DBG_ERR("TLS %s - %s. Failed to set default priorities\n",
1086                         __location__, gnutls_strerror(ret));
1087                 tevent_req_error(req, EINVAL);
1088                 return tevent_req_post(req, ev);
1089         }
1090
1091         if (strlen(tls_params->tls_priority) > 0) {
1092                 ret = gnutls_priority_set_direct(tlss->tls_session,
1093                                                  tls_params->tls_priority,
1094                                                  &error_pos);
1095                 if (ret != GNUTLS_E_SUCCESS) {
1096                         DEBUG(0,("TLS %s - %s.  Check 'tls priority' option at '%s'\n",
1097                                  __location__, gnutls_strerror(ret), error_pos));
1098                         tevent_req_error(req, EINVAL);
1099                         return tevent_req_post(req, ev);
1100                 }
1101         }
1102
1103         ret = gnutls_credentials_set(tlss->tls_session,
1104                                      GNUTLS_CRD_CERTIFICATE,
1105                                      tls_params->x509_cred);
1106         if (ret != GNUTLS_E_SUCCESS) {
1107                 DEBUG(0,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
1108                 tevent_req_error(req, EINVAL);
1109                 return tevent_req_post(req, ev);
1110         }
1111
1112         gnutls_transport_set_ptr(tlss->tls_session,
1113                                  (gnutls_transport_ptr_t)state->tls_stream);
1114         gnutls_transport_set_pull_function(tlss->tls_session,
1115                                            (gnutls_pull_func)tstream_tls_pull_function);
1116         gnutls_transport_set_push_function(tlss->tls_session,
1117                                            (gnutls_push_func)tstream_tls_push_function);
1118
1119         tlss->handshake.req = req;
1120         tstream_tls_retry_handshake(state->tls_stream);
1121         if (!tevent_req_is_in_progress(req)) {
1122                 return tevent_req_post(req, ev);
1123         }
1124
1125         return req;
1126 }
1127
1128 int tstream_tls_connect_recv(struct tevent_req *req,
1129                              int *perrno,
1130                              TALLOC_CTX *mem_ctx,
1131                              struct tstream_context **tls_stream)
1132 {
1133         struct tstream_tls_connect_state *state =
1134                 tevent_req_data(req,
1135                 struct tstream_tls_connect_state);
1136
1137         if (tevent_req_is_unix_error(req, perrno)) {
1138                 tevent_req_received(req);
1139                 return -1;
1140         }
1141
1142         *tls_stream = talloc_move(mem_ctx, &state->tls_stream);
1143         tevent_req_received(req);
1144         return 0;
1145 }
1146
1147 /*
1148   initialise global tls state
1149 */
1150 NTSTATUS tstream_tls_params_server(TALLOC_CTX *mem_ctx,
1151                                    const char *dns_host_name,
1152                                    bool enabled,
1153                                    const char *key_file,
1154                                    const char *cert_file,
1155                                    const char *ca_file,
1156                                    const char *crl_file,
1157                                    const char *dhp_file,
1158                                    const char *tls_priority,
1159                                    struct tstream_tls_params **_tlsp)
1160 {
1161         struct tstream_tls_params *__tlsp = NULL;
1162         struct tstream_tls_params_internal *tlsp = NULL;
1163         int ret;
1164         struct stat st;
1165
1166         if (!enabled || key_file == NULL || *key_file == 0) {
1167                 __tlsp = talloc_zero(mem_ctx, struct tstream_tls_params);
1168                 if (__tlsp == NULL) {
1169                         return NT_STATUS_NO_MEMORY;
1170                 }
1171
1172                 tlsp = talloc_zero(__tlsp, struct tstream_tls_params_internal);
1173                 if (tlsp == NULL) {
1174                         TALLOC_FREE(__tlsp);
1175                         return NT_STATUS_NO_MEMORY;
1176                 }
1177
1178                 talloc_set_destructor(tlsp, tstream_tls_params_internal_destructor);
1179                 __tlsp->internal = tlsp;
1180                 tlsp->tls_enabled = false;
1181
1182                 *_tlsp = __tlsp;
1183                 return NT_STATUS_OK;
1184         }
1185
1186         __tlsp = talloc_zero(mem_ctx, struct tstream_tls_params);
1187         if (__tlsp == NULL) {
1188                 return NT_STATUS_NO_MEMORY;
1189         }
1190
1191         tlsp = talloc_zero(__tlsp, struct tstream_tls_params_internal);
1192         if (tlsp == NULL) {
1193                 TALLOC_FREE(__tlsp);
1194                 return NT_STATUS_NO_MEMORY;
1195         }
1196
1197         talloc_set_destructor(tlsp, tstream_tls_params_internal_destructor);
1198         __tlsp->internal = tlsp;
1199
1200         if (!file_exist(ca_file)) {
1201                 tls_cert_generate(tlsp, dns_host_name,
1202                                   key_file, cert_file, ca_file);
1203         }
1204
1205         if (file_exist(key_file) &&
1206             !file_check_permissions(key_file, geteuid(), 0600, &st))
1207         {
1208                 DEBUG(0, ("Invalid permissions on TLS private key file '%s':\n"
1209                           "owner uid %u should be %u, mode 0%o should be 0%o\n"
1210                           "This is known as CVE-2013-4476.\n"
1211                           "Removing all tls .pem files will cause an "
1212                           "auto-regeneration with the correct permissions.\n",
1213                           key_file,
1214                           (unsigned int)st.st_uid, geteuid(),
1215                           (unsigned int)(st.st_mode & 0777), 0600));
1216                 TALLOC_FREE(__tlsp);
1217                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1218         }
1219
1220         ret = gnutls_certificate_allocate_credentials(&tlsp->x509_cred);
1221         if (ret != GNUTLS_E_SUCCESS) {
1222                 DEBUG(0,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
1223                 TALLOC_FREE(__tlsp);
1224                 return NT_STATUS_NO_MEMORY;
1225         }
1226
1227         if (ca_file && *ca_file) {
1228                 ret = gnutls_certificate_set_x509_trust_file(tlsp->x509_cred,
1229                                                              ca_file,
1230                                                              GNUTLS_X509_FMT_PEM);
1231                 if (ret < 0) {
1232                         DEBUG(0,("TLS failed to initialise cafile %s - %s\n",
1233                                  ca_file, gnutls_strerror(ret)));
1234                         TALLOC_FREE(__tlsp);
1235                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1236                 }
1237         }
1238
1239         if (crl_file && *crl_file) {
1240                 ret = gnutls_certificate_set_x509_crl_file(tlsp->x509_cred,
1241                                                            crl_file,
1242                                                            GNUTLS_X509_FMT_PEM);
1243                 if (ret < 0) {
1244                         DEBUG(0,("TLS failed to initialise crlfile %s - %s\n",
1245                                  crl_file, gnutls_strerror(ret)));
1246                         TALLOC_FREE(__tlsp);
1247                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1248                 }
1249         }
1250
1251         ret = gnutls_certificate_set_x509_key_file(tlsp->x509_cred,
1252                                                    cert_file, key_file,
1253                                                    GNUTLS_X509_FMT_PEM);
1254         if (ret != GNUTLS_E_SUCCESS) {
1255                 DEBUG(0,("TLS failed to initialise certfile %s and keyfile %s - %s\n",
1256                          cert_file, key_file, gnutls_strerror(ret)));
1257                 TALLOC_FREE(__tlsp);
1258                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1259         }
1260
1261         ret = gnutls_dh_params_init(&tlsp->dh_params);
1262         if (ret != GNUTLS_E_SUCCESS) {
1263                 DEBUG(0,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
1264                 TALLOC_FREE(__tlsp);
1265                 return NT_STATUS_NO_MEMORY;
1266         }
1267
1268         if (dhp_file && *dhp_file) {
1269                 gnutls_datum_t dhparms;
1270                 size_t size;
1271
1272                 dhparms.data = (uint8_t *)file_load(dhp_file, &size, 0, tlsp);
1273
1274                 if (!dhparms.data) {
1275                         DEBUG(0,("TLS failed to read DH Parms from %s - %d:%s\n",
1276                                  dhp_file, errno, strerror(errno)));
1277                         TALLOC_FREE(__tlsp);
1278                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1279                 }
1280                 dhparms.size = size;
1281
1282                 ret = gnutls_dh_params_import_pkcs3(tlsp->dh_params,
1283                                                     &dhparms,
1284                                                     GNUTLS_X509_FMT_PEM);
1285                 if (ret != GNUTLS_E_SUCCESS) {
1286                         DEBUG(0,("TLS failed to import pkcs3 %s - %s\n",
1287                                  dhp_file, gnutls_strerror(ret)));
1288                         TALLOC_FREE(__tlsp);
1289                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1290                 }
1291         } else {
1292                 ret = gnutls_dh_params_generate2(tlsp->dh_params, DH_BITS);
1293                 if (ret != GNUTLS_E_SUCCESS) {
1294                         DEBUG(0,("TLS failed to generate dh_params - %s\n",
1295                                  gnutls_strerror(ret)));
1296                         TALLOC_FREE(__tlsp);
1297                         return NT_STATUS_INTERNAL_ERROR;
1298                 }
1299         }
1300
1301         gnutls_certificate_set_dh_params(tlsp->x509_cred, tlsp->dh_params);
1302
1303         tlsp->tls_priority = talloc_strdup(tlsp, tls_priority);
1304         if (tlsp->tls_priority == NULL) {
1305                 TALLOC_FREE(__tlsp);
1306                 return NT_STATUS_NO_MEMORY;
1307         }
1308
1309         tlsp->tls_enabled = true;
1310
1311         *_tlsp = __tlsp;
1312         return NT_STATUS_OK;
1313 }
1314
1315 struct tstream_tls_accept_state {
1316         struct tstream_context *tls_stream;
1317 };
1318
1319 struct tevent_req *_tstream_tls_accept_send(TALLOC_CTX *mem_ctx,
1320                                             struct tevent_context *ev,
1321                                             struct tstream_context *plain_stream,
1322                                             struct tstream_tls_params *_tlsp,
1323                                             const char *location)
1324 {
1325         struct tevent_req *req;
1326         struct tstream_tls_accept_state *state;
1327         struct tstream_tls *tlss;
1328         const char *error_pos;
1329         struct tstream_tls_params_internal *tlsp = NULL;
1330         int ret;
1331
1332         req = tevent_req_create(mem_ctx, &state,
1333                                 struct tstream_tls_accept_state);
1334         if (req == NULL) {
1335                 return NULL;
1336         }
1337
1338         state->tls_stream = tstream_context_create(state,
1339                                                    &tstream_tls_ops,
1340                                                    &tlss,
1341                                                    struct tstream_tls,
1342                                                    location);
1343         if (tevent_req_nomem(state->tls_stream, req)) {
1344                 return tevent_req_post(req, ev);
1345         }
1346         ZERO_STRUCTP(tlss);
1347         talloc_set_destructor(tlss, tstream_tls_destructor);
1348
1349         /*
1350          * Note we need to make sure x509_cred and dh_params
1351          * from tstream_tls_params_internal stay alive for
1352          * the whole lifetime of this session!
1353          *
1354          * See 'man gnutls_credentials_set' and
1355          * 'man gnutls_certificate_set_dh_params'.
1356          *
1357          * Note: here we use talloc_reference() in a way
1358          *       that does not expose it to the caller.
1359          */
1360         tlsp = talloc_reference(tlss, _tlsp->internal);
1361         if (tevent_req_nomem(tlsp, req)) {
1362                 return tevent_req_post(req, ev);
1363         }
1364
1365         tlss->plain_stream = plain_stream;
1366
1367         tlss->current_ev = ev;
1368         tlss->retry_im = tevent_create_immediate(tlss);
1369         if (tevent_req_nomem(tlss->retry_im, req)) {
1370                 return tevent_req_post(req, ev);
1371         }
1372
1373         ret = gnutls_init(&tlss->tls_session, GNUTLS_SERVER);
1374         if (ret != GNUTLS_E_SUCCESS) {
1375                 DEBUG(0,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
1376                 tevent_req_error(req, EINVAL);
1377                 return tevent_req_post(req, ev);
1378         }
1379
1380         ret = gnutls_set_default_priority(tlss->tls_session);
1381         if (ret != GNUTLS_E_SUCCESS) {
1382                 DBG_ERR("TLS %s - %s. Failed to set default priorities\n",
1383                         __location__, gnutls_strerror(ret));
1384                 tevent_req_error(req, EINVAL);
1385                 return tevent_req_post(req, ev);
1386         }
1387
1388         if (strlen(tlsp->tls_priority) > 0) {
1389                 ret = gnutls_priority_set_direct(tlss->tls_session,
1390                                                  tlsp->tls_priority,
1391                                                  &error_pos);
1392                 if (ret != GNUTLS_E_SUCCESS) {
1393                         DEBUG(0,("TLS %s - %s.  Check 'tls priority' option at '%s'\n",
1394                                  __location__, gnutls_strerror(ret), error_pos));
1395                         tevent_req_error(req, EINVAL);
1396                         return tevent_req_post(req, ev);
1397                 }
1398         }
1399
1400         ret = gnutls_credentials_set(tlss->tls_session, GNUTLS_CRD_CERTIFICATE,
1401                                      tlsp->x509_cred);
1402         if (ret != GNUTLS_E_SUCCESS) {
1403                 DEBUG(0,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
1404                 tevent_req_error(req, EINVAL);
1405                 return tevent_req_post(req, ev);
1406         }
1407
1408         gnutls_certificate_server_set_request(tlss->tls_session,
1409                                               GNUTLS_CERT_REQUEST);
1410         gnutls_dh_set_prime_bits(tlss->tls_session, DH_BITS);
1411
1412         gnutls_transport_set_ptr(tlss->tls_session,
1413                                  (gnutls_transport_ptr_t)state->tls_stream);
1414         gnutls_transport_set_pull_function(tlss->tls_session,
1415                                            (gnutls_pull_func)tstream_tls_pull_function);
1416         gnutls_transport_set_push_function(tlss->tls_session,
1417                                            (gnutls_push_func)tstream_tls_push_function);
1418
1419         tlss->handshake.req = req;
1420         tstream_tls_retry_handshake(state->tls_stream);
1421         if (!tevent_req_is_in_progress(req)) {
1422                 return tevent_req_post(req, ev);
1423         }
1424
1425         return req;
1426 }
1427
1428 static void tstream_tls_retry_handshake(struct tstream_context *stream)
1429 {
1430         struct tstream_tls *tlss =
1431                 tstream_context_data(stream,
1432                 struct tstream_tls);
1433         struct tevent_req *req = tlss->handshake.req;
1434         int ret;
1435
1436         if (tlss->error != 0) {
1437                 tevent_req_error(req, tlss->error);
1438                 return;
1439         }
1440
1441         ret = gnutls_handshake(tlss->tls_session);
1442         if (ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN) {
1443                 return;
1444         }
1445
1446         tlss->handshake.req = NULL;
1447
1448         if (gnutls_error_is_fatal(ret) != 0) {
1449                 DEBUG(1,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
1450                 tlss->error = EIO;
1451                 tevent_req_error(req, tlss->error);
1452                 return;
1453         }
1454
1455         if (ret != GNUTLS_E_SUCCESS) {
1456                 DEBUG(1,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
1457                 tlss->error = EIO;
1458                 tevent_req_error(req, tlss->error);
1459                 return;
1460         }
1461
1462         if (tlss->verify_peer >= TLS_VERIFY_PEER_CA_ONLY) {
1463                 unsigned int status = UINT32_MAX;
1464                 bool ip = true;
1465                 const char *hostname = NULL;
1466
1467                 if (tlss->peer_name != NULL) {
1468                         ip = is_ipaddress(tlss->peer_name);
1469                 }
1470
1471                 if (!ip) {
1472                         hostname = tlss->peer_name;
1473                 }
1474
1475                 if (tlss->verify_peer == TLS_VERIFY_PEER_CA_ONLY) {
1476                         hostname = NULL;
1477                 }
1478
1479                 if (tlss->verify_peer >= TLS_VERIFY_PEER_CA_AND_NAME) {
1480                         if (hostname == NULL) {
1481                                 DEBUG(1,("TLS %s - no hostname available for "
1482                                          "verify_peer[%s] and peer_name[%s]\n",
1483                                          __location__,
1484                                          tls_verify_peer_string(tlss->verify_peer),
1485                                          tlss->peer_name));
1486                                 tlss->error = EINVAL;
1487                                 tevent_req_error(req, tlss->error);
1488                                 return;
1489                         }
1490                 }
1491
1492                 ret = gnutls_certificate_verify_peers3(tlss->tls_session,
1493                                                        hostname,
1494                                                        &status);
1495                 if (ret != GNUTLS_E_SUCCESS) {
1496                         DEBUG(1,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
1497                         tlss->error = EIO;
1498                         tevent_req_error(req, tlss->error);
1499                         return;
1500                 }
1501
1502                 if (status != 0) {
1503                         DEBUG(1,("TLS %s - check failed for "
1504                                  "verify_peer[%s] and peer_name[%s] "
1505                                  "status 0x%x (%s%s%s%s%s%s%s%s)\n",
1506                                  __location__,
1507                                  tls_verify_peer_string(tlss->verify_peer),
1508                                  tlss->peer_name,
1509                                  status,
1510                                  status & GNUTLS_CERT_INVALID ? "invalid " : "",
1511                                  status & GNUTLS_CERT_REVOKED ? "revoked " : "",
1512                                  status & GNUTLS_CERT_SIGNER_NOT_FOUND ?
1513                                         "signer_not_found " : "",
1514                                  status & GNUTLS_CERT_SIGNER_NOT_CA ?
1515                                         "signer_not_ca " : "",
1516                                  status & GNUTLS_CERT_INSECURE_ALGORITHM ?
1517                                         "insecure_algorithm " : "",
1518                                  status & GNUTLS_CERT_NOT_ACTIVATED ?
1519                                         "not_activated " : "",
1520                                  status & GNUTLS_CERT_EXPIRED ?
1521                                         "expired " : "",
1522                                  status & GNUTLS_CERT_UNEXPECTED_OWNER ?
1523                                         "unexpected_owner " : ""));
1524                         tlss->error = EINVAL;
1525                         tevent_req_error(req, tlss->error);
1526                         return;
1527                 }
1528         }
1529
1530         tevent_req_done(req);
1531 }
1532
1533 int tstream_tls_accept_recv(struct tevent_req *req,
1534                             int *perrno,
1535                             TALLOC_CTX *mem_ctx,
1536                             struct tstream_context **tls_stream)
1537 {
1538         struct tstream_tls_accept_state *state =
1539                 tevent_req_data(req,
1540                 struct tstream_tls_accept_state);
1541
1542         if (tevent_req_is_unix_error(req, perrno)) {
1543                 tevent_req_received(req);
1544                 return -1;
1545         }
1546
1547         *tls_stream = talloc_move(mem_ctx, &state->tls_stream);
1548         tevent_req_received(req);
1549         return 0;
1550 }