source4/lib/tls/tls.h

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    transport layer security handling code
   5
   6    Copyright (C) Andrew Tridgell 2005
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #ifndef _TLS_H_
  23 #define _TLS_H_
  24
  25 #include "lib/socket/socket.h"
  26
  27 struct loadparm_context;
  28
  29 void tls_cert_generate(TALLOC_CTX *mem_ctx,
  30                        const char *hostname,
  31                        const char *keyfile, const char *certfile,
  32                        const char *cafile);
  33
  34 struct tstream_context;
  35 struct tstream_tls_params;
  36
  37 enum tls_verify_peer_state {
  38         TLS_VERIFY_PEER_NO_CHECK = 0,
  39 #define TLS_VERIFY_PEER_NO_CHECK_STRING "no_check"
  40
  41         TLS_VERIFY_PEER_CA_ONLY = 10,
  42 #define TLS_VERIFY_PEER_CA_ONLY_STRING "ca_only"
  43
  44         TLS_VERIFY_PEER_CA_AND_NAME_IF_AVAILABLE = 20,
  45 #define TLS_VERIFY_PEER_CA_AND_NAME_IF_AVAILABLE_STRING \
  46                 "ca_and_name_if_available"
  47
  48         TLS_VERIFY_PEER_CA_AND_NAME = 30,
  49 #define TLS_VERIFY_PEER_CA_AND_NAME_STRING "ca_and_name"
  50
  51         TLS_VERIFY_PEER_AS_STRICT_AS_POSSIBLE = 9999,
  52 #define TLS_VERIFY_PEER_AS_STRICT_AS_POSSIBLE_STRING \
  53                 "as_strict_as_possible"
  54 };
  55
  56 const char *tls_verify_peer_string(enum tls_verify_peer_state verify_peer);
  57
  58 NTSTATUS tstream_tls_params_client(TALLOC_CTX *mem_ctx,
  59                                    const char *ca_file,
  60                                    const char *crl_file,
  61                                    const char *tls_priority,
  62                                    enum tls_verify_peer_state verify_peer,
  63                                    const char *peer_name,
  64                                    struct tstream_tls_params **_tlsp);
  65
  66 NTSTATUS tstream_tls_params_client_lpcfg(TALLOC_CTX *mem_ctx,
  67                                          struct loadparm_context *lp_ctx,
  68                                          const char *peer_name,
  69                                          struct tstream_tls_params **tlsp);
  70
  71 NTSTATUS tstream_tls_params_server(TALLOC_CTX *mem_ctx,
  72                                    const char *dns_host_name,
  73                                    bool enabled,
  74                                    const char *key_file,
  75                                    const char *cert_file,
  76                                    const char *ca_file,
  77                                    const char *crl_file,
  78                                    const char *dhp_file,
  79                                    const char *tls_priority,
  80                                    struct tstream_tls_params **_params);
  81
  82 bool tstream_tls_params_enabled(struct tstream_tls_params *params);
  83
  84 struct tevent_req *_tstream_tls_connect_send(TALLOC_CTX *mem_ctx,
  85                                              struct tevent_context *ev,
  86                                              struct tstream_context *plain_stream,
  87                                              struct tstream_tls_params *tls_params,
  88                                              const char *location);
  89 #define tstream_tls_connect_send(mem_ctx, ev, plain_stream, tls_params) \
  90         _tstream_tls_connect_send(mem_ctx, ev, plain_stream, tls_params, __location__)
  91
  92 int tstream_tls_connect_recv(struct tevent_req *req,
  93                              int *perrno,
  94                              TALLOC_CTX *mem_ctx,
  95                              struct tstream_context **tls_stream);
  96
  97 struct tevent_req *_tstream_tls_accept_send(TALLOC_CTX *mem_ctx,
  98                                             struct tevent_context *ev,
  99                                             struct tstream_context *plain_stream,
 100                                             struct tstream_tls_params *tls_params,
 101                                             const char *location);
 102 #define tstream_tls_accept_send(mem_ctx, ev, plain_stream, tls_params) \
 103         _tstream_tls_accept_send(mem_ctx, ev, plain_stream, tls_params, __location__)
 104
 105 int tstream_tls_accept_recv(struct tevent_req *req,
 106                             int *perrno,
 107                             TALLOC_CTX *mem_ctx,
 108                             struct tstream_context **tls_stream);
 109
 110 #endif /* _TLS_H_ */