source4/lib/tls/tls_tstream.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Stefan Metzmacher 2010
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "system/network.h"
  22 #include "system/filesys.h"
  23 #include "../util/tevent_unix.h"
  24 #include "../lib/tsocket/tsocket.h"
  25 #include "../lib/tsocket/tsocket_internal.h"
  26 #include "lib/tls/tls.h"
  27
  28 #if ENABLE_GNUTLS
  29 #include <gnutls/gnutls.h>
  30
  31 #define DH_BITS 1024
  32
  33 #if defined(HAVE_GNUTLS_DATUM) && !defined(HAVE_GNUTLS_DATUM_T)
  34 typedef gnutls_datum gnutls_datum_t;
  35 #endif
  36
  37 #endif /* ENABLE_GNUTLS */
  38
  39 static const struct tstream_context_ops tstream_tls_ops;
  40
  41 struct tstream_tls {
  42         struct tstream_context *plain_stream;
  43         int error;
  44
  45 #if ENABLE_GNUTLS
  46         gnutls_session tls_session;
  47 #endif /* ENABLE_GNUTLS */
  48
  49         struct tevent_context *current_ev;
  50
  51         struct tevent_immediate *retry_im;
  52
  53         struct {
  54                 uint8_t *buf;
  55                 off_t ofs;
  56                 struct iovec iov;
  57                 struct tevent_req *subreq;
  58                 struct tevent_immediate *im;
  59         } push;
  60
  61         struct {
  62                 uint8_t *buf;
  63                 struct iovec iov;
  64                 struct tevent_req *subreq;
  65         } pull;
  66
  67         struct {
  68                 struct tevent_req *req;
  69         } handshake;
  70
  71         struct {
  72                 off_t ofs;
  73                 size_t left;
  74                 uint8_t buffer[1024];
  75                 struct tevent_req *req;
  76         } write;
  77
  78         struct {
  79                 off_t ofs;
  80                 size_t left;
  81                 uint8_t buffer[1024];
  82                 struct tevent_req *req;
  83         } read;
  84
  85         struct {
  86                 struct tevent_req *req;
  87         } disconnect;
  88 };
  89
  90 static void tstream_tls_retry_handshake(struct tstream_context *stream);
  91 static void tstream_tls_retry_read(struct tstream_context *stream);
  92 static void tstream_tls_retry_write(struct tstream_context *stream);
  93 static void tstream_tls_retry_disconnect(struct tstream_context *stream);
  94 static void tstream_tls_retry_trigger(struct tevent_context *ctx,
  95                                       struct tevent_immediate *im,
  96                                       void *private_data);
  97
  98 static void tstream_tls_retry(struct tstream_context *stream, bool deferred)
  99 {
 100
 101         struct tstream_tls *tlss =
 102                 tstream_context_data(stream,
 103                 struct tstream_tls);
 104
 105         if (tlss->disconnect.req) {
 106                 tstream_tls_retry_disconnect(stream);
 107                 return;
 108         }
 109
 110         if (tlss->handshake.req) {
 111                 tstream_tls_retry_handshake(stream);
 112                 return;
 113         }
 114
 115         if (tlss->write.req && tlss->read.req && !deferred) {
 116                 tevent_schedule_immediate(tlss->retry_im, tlss->current_ev,
 117                                           tstream_tls_retry_trigger,
 118                                           stream);
 119         }
 120
 121         if (tlss->write.req) {
 122                 tstream_tls_retry_write(stream);
 123                 return;
 124         }
 125
 126         if (tlss->read.req) {
 127                 tstream_tls_retry_read(stream);
 128                 return;
 129         }
 130 }
 131
 132 static void tstream_tls_retry_trigger(struct tevent_context *ctx,
 133                                       struct tevent_immediate *im,
 134                                       void *private_data)
 135 {
 136         struct tstream_context *stream =
 137                 talloc_get_type_abort(private_data,
 138                 struct tstream_context);
 139
 140         tstream_tls_retry(stream, true);
 141 }
 142
 143 #if ENABLE_GNUTLS
 144 static void tstream_tls_push_trigger_write(struct tevent_context *ev,
 145                                            struct tevent_immediate *im,
 146                                            void *private_data);
 147
 148 static ssize_t tstream_tls_push_function(gnutls_transport_ptr ptr,
 149                                          const void *buf, size_t size)
 150 {
 151         struct tstream_context *stream =
 152                 talloc_get_type_abort(ptr,
 153                 struct tstream_context);
 154         struct tstream_tls *tlss =
 155                 tstream_context_data(stream,
 156                 struct tstream_tls);
 157         uint8_t *nbuf;
 158         size_t len;
 159
 160         if (tlss->error != 0) {
 161                 errno = tlss->error;
 162                 return -1;
 163         }
 164
 165         if (tlss->push.subreq) {
 166                 errno = EAGAIN;
 167                 return -1;
 168         }
 169
 170         len = MIN(size, UINT16_MAX - tlss->push.ofs);
 171
 172         if (len == 0) {
 173                 errno = EAGAIN;
 174                 return -1;
 175         }
 176
 177         nbuf = talloc_realloc(tlss, tlss->push.buf,
 178                               uint8_t, tlss->push.ofs + len);
 179         if (nbuf == NULL) {
 180                 if (tlss->push.buf) {
 181                         errno = EAGAIN;
 182                         return -1;
 183                 }
 184
 185                 return -1;
 186         }
 187         tlss->push.buf = nbuf;
 188
 189         memcpy(tlss->push.buf + tlss->push.ofs, buf, len);
 190
 191         if (tlss->push.im == NULL) {
 192                 tlss->push.im = tevent_create_immediate(tlss);
 193                 if (tlss->push.im == NULL) {
 194                         errno = ENOMEM;
 195                         return -1;
 196                 }
 197         }
 198
 199         if (tlss->push.ofs == 0) {
 200                 /*
 201                  * We'll do start the tstream_writev
 202                  * in the next event cycle.
 203                  *
 204                  * This way we can batch all push requests,
 205                  * if they fit into a UINT16_MAX buffer.
 206                  *
 207                  * This is important as gnutls_handshake()
 208                  * had a bug in some versions e.g. 2.4.1
 209                  * and others (See bug #7218) and it doesn't
 210                  * handle EAGAIN.
 211                  */
 212                 tevent_schedule_immediate(tlss->push.im,
 213                                           tlss->current_ev,
 214                                           tstream_tls_push_trigger_write,
 215                                           stream);
 216         }
 217
 218         tlss->push.ofs += len;
 219         return len;
 220 }
 221
 222 static void tstream_tls_push_done(struct tevent_req *subreq);
 223
 224 static void tstream_tls_push_trigger_write(struct tevent_context *ev,
 225                                            struct tevent_immediate *im,
 226                                            void *private_data)
 227 {
 228         struct tstream_context *stream =
 229                 talloc_get_type_abort(private_data,
 230                 struct tstream_context);
 231         struct tstream_tls *tlss =
 232                 tstream_context_data(stream,
 233                 struct tstream_tls);
 234         struct tevent_req *subreq;
 235
 236         if (tlss->push.subreq) {
 237                 /* nothing todo */
 238                 return;
 239         }
 240
 241         tlss->push.iov.iov_base = (char *)tlss->push.buf;
 242         tlss->push.iov.iov_len = tlss->push.ofs;
 243
 244         subreq = tstream_writev_send(tlss,
 245                                      tlss->current_ev,
 246                                      tlss->plain_stream,
 247                                      &tlss->push.iov, 1);
 248         if (subreq == NULL) {
 249                 tlss->error = ENOMEM;
 250                 tstream_tls_retry(stream, false);
 251                 return;
 252         }
 253         tevent_req_set_callback(subreq, tstream_tls_push_done, stream);
 254
 255         tlss->push.subreq = subreq;
 256 }
 257
 258 static void tstream_tls_push_done(struct tevent_req *subreq)
 259 {
 260         struct tstream_context *stream =
 261                 tevent_req_callback_data(subreq,
 262                 struct tstream_context);
 263         struct tstream_tls *tlss =
 264                 tstream_context_data(stream,
 265                 struct tstream_tls);
 266         int ret;
 267         int sys_errno;
 268
 269         tlss->push.subreq = NULL;
 270         ZERO_STRUCT(tlss->push.iov);
 271         TALLOC_FREE(tlss->push.buf);
 272         tlss->push.ofs = 0;
 273
 274         ret = tstream_writev_recv(subreq, &sys_errno);
 275         TALLOC_FREE(subreq);
 276         if (ret == -1) {
 277                 tlss->error = sys_errno;
 278                 tstream_tls_retry(stream, false);
 279                 return;
 280         }
 281
 282         tstream_tls_retry(stream, false);
 283 }
 284
 285 static void tstream_tls_pull_done(struct tevent_req *subreq);
 286
 287 static ssize_t tstream_tls_pull_function(gnutls_transport_ptr ptr,
 288                                          void *buf, size_t size)
 289 {
 290         struct tstream_context *stream =
 291                 talloc_get_type_abort(ptr,
 292                 struct tstream_context);
 293         struct tstream_tls *tlss =
 294                 tstream_context_data(stream,
 295                 struct tstream_tls);
 296         struct tevent_req *subreq;
 297         size_t len;
 298
 299         if (tlss->error != 0) {
 300                 errno = tlss->error;
 301                 return -1;
 302         }
 303
 304         if (tlss->pull.subreq) {
 305                 errno = EAGAIN;
 306                 return -1;
 307         }
 308
 309         if (tlss->pull.iov.iov_base) {
 310                 uint8_t *b;
 311                 size_t n;
 312
 313                 b = (uint8_t *)tlss->pull.iov.iov_base;
 314
 315                 n = MIN(tlss->pull.iov.iov_len, size);
 316                 memcpy(buf, b, n);
 317
 318                 tlss->pull.iov.iov_len -= n;
 319                 b += n;
 320                 tlss->pull.iov.iov_base = (char *)b;
 321                 if (tlss->pull.iov.iov_len == 0) {
 322                         tlss->pull.iov.iov_base = NULL;
 323                         TALLOC_FREE(tlss->pull.buf);
 324                 }
 325
 326                 return n;
 327         }
 328
 329         if (size == 0) {
 330                 return 0;
 331         }
 332
 333         len = MIN(size, UINT16_MAX);
 334
 335         tlss->pull.buf = talloc_array(tlss, uint8_t, len);
 336         if (tlss->pull.buf == NULL) {
 337                 return -1;
 338         }
 339
 340         tlss->pull.iov.iov_base = (char *)tlss->pull.buf;
 341         tlss->pull.iov.iov_len = len;
 342
 343         subreq = tstream_readv_send(tlss,
 344                                     tlss->current_ev,
 345                                     tlss->plain_stream,
 346                                     &tlss->pull.iov, 1);
 347         if (subreq == NULL) {
 348                 errno = ENOMEM;
 349                 return -1;
 350         }
 351         tevent_req_set_callback(subreq, tstream_tls_pull_done, stream);
 352
 353         tlss->pull.subreq = subreq;
 354         errno = EAGAIN;
 355         return -1;
 356 }
 357
 358 static void tstream_tls_pull_done(struct tevent_req *subreq)
 359 {
 360         struct tstream_context *stream =
 361                 tevent_req_callback_data(subreq,
 362                 struct tstream_context);
 363         struct tstream_tls *tlss =
 364                 tstream_context_data(stream,
 365                 struct tstream_tls);
 366         int ret;
 367         int sys_errno;
 368
 369         tlss->pull.subreq = NULL;
 370
 371         ret = tstream_readv_recv(subreq, &sys_errno);
 372         TALLOC_FREE(subreq);
 373         if (ret == -1) {
 374                 tlss->error = sys_errno;
 375                 tstream_tls_retry(stream, false);
 376                 return;
 377         }
 378
 379         tstream_tls_retry(stream, false);
 380 }
 381 #endif /* ENABLE_GNUTLS */
 382
 383 static int tstream_tls_destructor(struct tstream_tls *tlss)
 384 {
 385 #if ENABLE_GNUTLS
 386         if (tlss->tls_session) {
 387                 gnutls_deinit(tlss->tls_session);
 388                 tlss->tls_session = NULL;
 389         }
 390 #endif /* ENABLE_GNUTLS */
 391         return 0;
 392 }
 393
 394 static ssize_t tstream_tls_pending_bytes(struct tstream_context *stream)
 395 {
 396         struct tstream_tls *tlss =
 397                 tstream_context_data(stream,
 398                 struct tstream_tls);
 399         size_t ret;
 400
 401         if (tlss->error != 0) {
 402                 errno = tlss->error;
 403                 return -1;
 404         }
 405
 406 #if ENABLE_GNUTLS
 407         ret = gnutls_record_check_pending(tlss->tls_session);
 408         ret += tlss->read.left;
 409 #else /* ENABLE_GNUTLS */
 410         errno = ENOSYS;
 411         ret = -1;
 412 #endif /* ENABLE_GNUTLS */
 413         return ret;
 414 }
 415
 416 struct tstream_tls_readv_state {
 417         struct tstream_context *stream;
 418
 419         struct iovec *vector;
 420         int count;
 421
 422         int ret;
 423 };
 424
 425 static void tstream_tls_readv_crypt_next(struct tevent_req *req);
 426
 427 static struct tevent_req *tstream_tls_readv_send(TALLOC_CTX *mem_ctx,
 428                                         struct tevent_context *ev,
 429                                         struct tstream_context *stream,
 430                                         struct iovec *vector,
 431                                         size_t count)
 432 {
 433         struct tstream_tls *tlss =
 434                 tstream_context_data(stream,
 435                 struct tstream_tls);
 436         struct tevent_req *req;
 437         struct tstream_tls_readv_state *state;
 438
 439         tlss->read.req = NULL;
 440         tlss->current_ev = ev;
 441
 442         req = tevent_req_create(mem_ctx, &state,
 443                                 struct tstream_tls_readv_state);
 444         if (req == NULL) {
 445                 return NULL;
 446         }
 447
 448         state->stream = stream;
 449         state->ret = 0;
 450
 451         if (tlss->error != 0) {
 452                 tevent_req_error(req, tlss->error);
 453                 return tevent_req_post(req, ev);
 454         }
 455
 456         /*
 457          * we make a copy of the vector so we can change the structure
 458          */
 459         state->vector = talloc_array(state, struct iovec, count);
 460         if (tevent_req_nomem(state->vector, req)) {
 461                 return tevent_req_post(req, ev);
 462         }
 463         memcpy(state->vector, vector, sizeof(struct iovec) * count);
 464         state->count = count;
 465
 466         tstream_tls_readv_crypt_next(req);
 467         if (!tevent_req_is_in_progress(req)) {
 468                 return tevent_req_post(req, ev);
 469         }
 470
 471         return req;
 472 }
 473
 474 static void tstream_tls_readv_crypt_next(struct tevent_req *req)
 475 {
 476         struct tstream_tls_readv_state *state =
 477                 tevent_req_data(req,
 478                 struct tstream_tls_readv_state);
 479         struct tstream_tls *tlss =
 480                 tstream_context_data(state->stream,
 481                 struct tstream_tls);
 482
 483         /*
 484          * copy the pending buffer first
 485          */
 486         while (tlss->read.left > 0 && state->count > 0) {
 487                 uint8_t *base = (uint8_t *)state->vector[0].iov_base;
 488                 size_t len = MIN(tlss->read.left, state->vector[0].iov_len);
 489
 490                 memcpy(base, tlss->read.buffer + tlss->read.ofs, len);
 491
 492                 base += len;
 493                 state->vector[0].iov_base = (char *) base;
 494                 state->vector[0].iov_len -= len;
 495
 496                 tlss->read.ofs += len;
 497                 tlss->read.left -= len;
 498
 499                 if (state->vector[0].iov_len == 0) {
 500                         state->vector += 1;
 501                         state->count -= 1;
 502                 }
 503
 504                 state->ret += len;
 505         }
 506
 507         if (state->count == 0) {
 508                 tevent_req_done(req);
 509                 return;
 510         }
 511
 512         tlss->read.req = req;
 513         tstream_tls_retry_read(state->stream);
 514 }
 515
 516 static void tstream_tls_retry_read(struct tstream_context *stream)
 517 {
 518         struct tstream_tls *tlss =
 519                 tstream_context_data(stream,
 520                 struct tstream_tls);
 521         struct tevent_req *req = tlss->read.req;
 522 #if ENABLE_GNUTLS
 523         int ret;
 524
 525         if (tlss->error != 0) {
 526                 tevent_req_error(req, tlss->error);
 527                 return;
 528         }
 529
 530         tlss->read.left = 0;
 531         tlss->read.ofs = 0;
 532
 533         ret = gnutls_record_recv(tlss->tls_session,
 534                                  tlss->read.buffer,
 535                                  sizeof(tlss->read.buffer));
 536         if (ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN) {
 537                 return;
 538         }
 539
 540         tlss->read.req = NULL;
 541
 542         if (gnutls_error_is_fatal(ret) != 0) {
 543                 DEBUG(1,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
 544                 tlss->error = EIO;
 545                 tevent_req_error(req, tlss->error);
 546                 return;
 547         }
 548
 549         if (ret == 0) {
 550                 tlss->error = EPIPE;
 551                 tevent_req_error(req, tlss->error);
 552                 return;
 553         }
 554
 555         tlss->read.left = ret;
 556         tstream_tls_readv_crypt_next(req);
 557 #else /* ENABLE_GNUTLS */
 558         tevent_req_error(req, ENOSYS);
 559 #endif /* ENABLE_GNUTLS */
 560 }
 561
 562 static int tstream_tls_readv_recv(struct tevent_req *req,
 563                                   int *perrno)
 564 {
 565         struct tstream_tls_readv_state *state =
 566                 tevent_req_data(req,
 567                 struct tstream_tls_readv_state);
 568         struct tstream_tls *tlss =
 569                 tstream_context_data(state->stream,
 570                 struct tstream_tls);
 571         int ret;
 572
 573         tlss->read.req = NULL;
 574
 575         ret = tsocket_simple_int_recv(req, perrno);
 576         if (ret == 0) {
 577                 ret = state->ret;
 578         }
 579
 580         tevent_req_received(req);
 581         return ret;
 582 }
 583
 584 struct tstream_tls_writev_state {
 585         struct tstream_context *stream;
 586
 587         struct iovec *vector;
 588         int count;
 589
 590         int ret;
 591 };
 592
 593 static void tstream_tls_writev_crypt_next(struct tevent_req *req);
 594
 595 static struct tevent_req *tstream_tls_writev_send(TALLOC_CTX *mem_ctx,
 596                                         struct tevent_context *ev,
 597                                         struct tstream_context *stream,
 598                                         const struct iovec *vector,
 599                                         size_t count)
 600 {
 601         struct tstream_tls *tlss =
 602                 tstream_context_data(stream,
 603                 struct tstream_tls);
 604         struct tevent_req *req;
 605         struct tstream_tls_writev_state *state;
 606
 607         tlss->write.req = NULL;
 608         tlss->current_ev = ev;
 609
 610         req = tevent_req_create(mem_ctx, &state,
 611                                 struct tstream_tls_writev_state);
 612         if (req == NULL) {
 613                 return NULL;
 614         }
 615
 616         state->stream = stream;
 617         state->ret = 0;
 618
 619         if (tlss->error != 0) {
 620                 tevent_req_error(req, tlss->error);
 621                 return tevent_req_post(req, ev);
 622         }
 623
 624         /*
 625          * we make a copy of the vector so we can change the structure
 626          */
 627         state->vector = talloc_array(state, struct iovec, count);
 628         if (tevent_req_nomem(state->vector, req)) {
 629                 return tevent_req_post(req, ev);
 630         }
 631         memcpy(state->vector, vector, sizeof(struct iovec) * count);
 632         state->count = count;
 633
 634         tstream_tls_writev_crypt_next(req);
 635         if (!tevent_req_is_in_progress(req)) {
 636                 return tevent_req_post(req, ev);
 637         }
 638
 639         return req;
 640 }
 641
 642 static void tstream_tls_writev_crypt_next(struct tevent_req *req)
 643 {
 644         struct tstream_tls_writev_state *state =
 645                 tevent_req_data(req,
 646                 struct tstream_tls_writev_state);
 647         struct tstream_tls *tlss =
 648                 tstream_context_data(state->stream,
 649                 struct tstream_tls);
 650
 651         tlss->write.left = sizeof(tlss->write.buffer);
 652         tlss->write.ofs = 0;
 653
 654         /*
 655          * first fill our buffer
 656          */
 657         while (tlss->write.left > 0 && state->count > 0) {
 658                 uint8_t *base = (uint8_t *)state->vector[0].iov_base;
 659                 size_t len = MIN(tlss->write.left, state->vector[0].iov_len);
 660
 661                 memcpy(tlss->write.buffer + tlss->write.ofs, base, len);
 662
 663                 base += len;
 664                 state->vector[0].iov_base = (char *) base;
 665                 state->vector[0].iov_len -= len;
 666
 667                 tlss->write.ofs += len;
 668                 tlss->write.left -= len;
 669
 670                 if (state->vector[0].iov_len == 0) {
 671                         state->vector += 1;
 672                         state->count -= 1;
 673                 }
 674
 675                 state->ret += len;
 676         }
 677
 678         if (tlss->write.ofs == 0) {
 679                 tevent_req_done(req);
 680                 return;
 681         }
 682
 683         tlss->write.left = tlss->write.ofs;
 684         tlss->write.ofs = 0;
 685
 686         tlss->write.req = req;
 687         tstream_tls_retry_write(state->stream);
 688 }
 689
 690 static void tstream_tls_retry_write(struct tstream_context *stream)
 691 {
 692         struct tstream_tls *tlss =
 693                 tstream_context_data(stream,
 694                 struct tstream_tls);
 695         struct tevent_req *req = tlss->write.req;
 696 #if ENABLE_GNUTLS
 697         int ret;
 698
 699         if (tlss->error != 0) {
 700                 tevent_req_error(req, tlss->error);
 701                 return;
 702         }
 703
 704         ret = gnutls_record_send(tlss->tls_session,
 705                                  tlss->write.buffer + tlss->write.ofs,
 706                                  tlss->write.left);
 707         if (ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN) {
 708                 return;
 709         }
 710
 711         tlss->write.req = NULL;
 712
 713         if (gnutls_error_is_fatal(ret) != 0) {
 714                 DEBUG(1,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
 715                 tlss->error = EIO;
 716                 tevent_req_error(req, tlss->error);
 717                 return;
 718         }
 719
 720         if (ret == 0) {
 721                 tlss->error = EPIPE;
 722                 tevent_req_error(req, tlss->error);
 723                 return;
 724         }
 725
 726         tlss->write.ofs += ret;
 727         tlss->write.left -= ret;
 728
 729         if (tlss->write.left > 0) {
 730                 tlss->write.req = req;
 731                 tstream_tls_retry_write(stream);
 732                 return;
 733         }
 734
 735         tstream_tls_writev_crypt_next(req);
 736 #else /* ENABLE_GNUTLS */
 737         tevent_req_error(req, ENOSYS);
 738 #endif /* ENABLE_GNUTLS */
 739 }
 740
 741 static int tstream_tls_writev_recv(struct tevent_req *req,
 742                                    int *perrno)
 743 {
 744         struct tstream_tls_writev_state *state =
 745                 tevent_req_data(req,
 746                 struct tstream_tls_writev_state);
 747         struct tstream_tls *tlss =
 748                 tstream_context_data(state->stream,
 749                 struct tstream_tls);
 750         int ret;
 751
 752         tlss->write.req = NULL;
 753
 754         ret = tsocket_simple_int_recv(req, perrno);
 755         if (ret == 0) {
 756                 ret = state->ret;
 757         }
 758
 759         tevent_req_received(req);
 760         return ret;
 761 }
 762
 763 struct tstream_tls_disconnect_state {
 764         uint8_t _dummy;
 765 };
 766
 767 static struct tevent_req *tstream_tls_disconnect_send(TALLOC_CTX *mem_ctx,
 768                                                 struct tevent_context *ev,
 769                                                 struct tstream_context *stream)
 770 {
 771         struct tstream_tls *tlss =
 772                 tstream_context_data(stream,
 773                 struct tstream_tls);
 774         struct tevent_req *req;
 775         struct tstream_tls_disconnect_state *state;
 776
 777         tlss->disconnect.req = NULL;
 778         tlss->current_ev = ev;
 779
 780         req = tevent_req_create(mem_ctx, &state,
 781                                 struct tstream_tls_disconnect_state);
 782         if (req == NULL) {
 783                 return NULL;
 784         }
 785
 786         if (tlss->error != 0) {
 787                 tevent_req_error(req, tlss->error);
 788                 return tevent_req_post(req, ev);
 789         }
 790
 791         tlss->disconnect.req = req;
 792         tstream_tls_retry_disconnect(stream);
 793         if (!tevent_req_is_in_progress(req)) {
 794                 return tevent_req_post(req, ev);
 795         }
 796
 797         return req;
 798 }
 799
 800 static void tstream_tls_retry_disconnect(struct tstream_context *stream)
 801 {
 802         struct tstream_tls *tlss =
 803                 tstream_context_data(stream,
 804                 struct tstream_tls);
 805         struct tevent_req *req = tlss->disconnect.req;
 806 #if ENABLE_GNUTLS
 807         int ret;
 808
 809         if (tlss->error != 0) {
 810                 tevent_req_error(req, tlss->error);
 811                 return;
 812         }
 813
 814         ret = gnutls_bye(tlss->tls_session, GNUTLS_SHUT_WR);
 815         if (ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN) {
 816                 return;
 817         }
 818
 819         tlss->disconnect.req = NULL;
 820
 821         if (gnutls_error_is_fatal(ret) != 0) {
 822                 DEBUG(1,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
 823                 tlss->error = EIO;
 824                 tevent_req_error(req, tlss->error);
 825                 return;
 826         }
 827
 828         if (ret != GNUTLS_E_SUCCESS) {
 829                 DEBUG(1,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
 830                 tlss->error = EIO;
 831                 tevent_req_error(req, tlss->error);
 832                 return;
 833         }
 834
 835         tevent_req_done(req);
 836 #else /* ENABLE_GNUTLS */
 837         tevent_req_error(req, ENOSYS);
 838 #endif /* ENABLE_GNUTLS */
 839 }
 840
 841 static int tstream_tls_disconnect_recv(struct tevent_req *req,
 842                                        int *perrno)
 843 {
 844         int ret;
 845
 846         ret = tsocket_simple_int_recv(req, perrno);
 847
 848         tevent_req_received(req);
 849         return ret;
 850 }
 851
 852 static const struct tstream_context_ops tstream_tls_ops = {
 853         .name                   = "tls",
 854
 855         .pending_bytes          = tstream_tls_pending_bytes,
 856
 857         .readv_send             = tstream_tls_readv_send,
 858         .readv_recv             = tstream_tls_readv_recv,
 859
 860         .writev_send            = tstream_tls_writev_send,
 861         .writev_recv            = tstream_tls_writev_recv,
 862
 863         .disconnect_send        = tstream_tls_disconnect_send,
 864         .disconnect_recv        = tstream_tls_disconnect_recv,
 865 };
 866
 867 struct tstream_tls_params {
 868 #if ENABLE_GNUTLS
 869         gnutls_certificate_credentials x509_cred;
 870         gnutls_dh_params dh_params;
 871 #endif /* ENABLE_GNUTLS */
 872         bool tls_enabled;
 873 };
 874
 875 static int tstream_tls_params_destructor(struct tstream_tls_params *tlsp)
 876 {
 877 #if ENABLE_GNUTLS
 878         if (tlsp->x509_cred) {
 879                 gnutls_certificate_free_credentials(tlsp->x509_cred);
 880                 tlsp->x509_cred = NULL;
 881         }
 882         if (tlsp->dh_params) {
 883                 gnutls_dh_params_deinit(tlsp->dh_params);
 884                 tlsp->dh_params = NULL;
 885         }
 886 #endif /* ENABLE_GNUTLS */
 887         return 0;
 888 }
 889
 890 bool tstream_tls_params_enabled(struct tstream_tls_params *tlsp)
 891 {
 892         return tlsp->tls_enabled;
 893 }
 894
 895 NTSTATUS tstream_tls_params_client(TALLOC_CTX *mem_ctx,
 896                                    const char *ca_file,
 897                                    const char *crl_file,
 898                                    struct tstream_tls_params **_tlsp)
 899 {
 900 #if ENABLE_GNUTLS
 901         struct tstream_tls_params *tlsp;
 902         int ret;
 903
 904         ret = gnutls_global_init();
 905         if (ret != GNUTLS_E_SUCCESS) {
 906                 DEBUG(0,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
 907                 return NT_STATUS_NOT_SUPPORTED;
 908         }
 909
 910         tlsp = talloc_zero(mem_ctx, struct tstream_tls_params);
 911         NT_STATUS_HAVE_NO_MEMORY(tlsp);
 912
 913         talloc_set_destructor(tlsp, tstream_tls_params_destructor);
 914
 915         ret = gnutls_certificate_allocate_credentials(&tlsp->x509_cred);
 916         if (ret != GNUTLS_E_SUCCESS) {
 917                 DEBUG(0,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
 918                 talloc_free(tlsp);
 919                 return NT_STATUS_NO_MEMORY;
 920         }
 921
 922         if (ca_file && *ca_file) {
 923                 ret = gnutls_certificate_set_x509_trust_file(tlsp->x509_cred,
 924                                                              ca_file,
 925                                                              GNUTLS_X509_FMT_PEM);
 926                 if (ret < 0) {
 927                         DEBUG(0,("TLS failed to initialise cafile %s - %s\n",
 928                                  ca_file, gnutls_strerror(ret)));
 929                         talloc_free(tlsp);
 930                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 931                 }
 932         }
 933
 934         if (crl_file && *crl_file) {
 935                 ret = gnutls_certificate_set_x509_crl_file(tlsp->x509_cred,
 936                                                            crl_file,
 937                                                            GNUTLS_X509_FMT_PEM);
 938                 if (ret < 0) {
 939                         DEBUG(0,("TLS failed to initialise crlfile %s - %s\n",
 940                                  crl_file, gnutls_strerror(ret)));
 941                         talloc_free(tlsp);
 942                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 943                 }
 944         }
 945
 946         tlsp->tls_enabled = true;
 947
 948         *_tlsp = tlsp;
 949         return NT_STATUS_OK;
 950 #else /* ENABLE_GNUTLS */
 951         return NT_STATUS_NOT_IMPLEMENTED;
 952 #endif /* ENABLE_GNUTLS */
 953 }
 954
 955 struct tstream_tls_connect_state {
 956         struct tstream_context *tls_stream;
 957 };
 958
 959 struct tevent_req *_tstream_tls_connect_send(TALLOC_CTX *mem_ctx,
 960                                              struct tevent_context *ev,
 961                                              struct tstream_context *plain_stream,
 962                                              struct tstream_tls_params *tls_params,
 963                                              const char *location)
 964 {
 965         struct tevent_req *req;
 966         struct tstream_tls_connect_state *state;
 967 #if ENABLE_GNUTLS
 968         struct tstream_tls *tlss;
 969         int ret;
 970 #endif /* ENABLE_GNUTLS */
 971
 972         req = tevent_req_create(mem_ctx, &state,
 973                                 struct tstream_tls_connect_state);
 974         if (req == NULL) {
 975                 return NULL;
 976         }
 977
 978 #if ENABLE_GNUTLS
 979         state->tls_stream = tstream_context_create(state,
 980                                                    &tstream_tls_ops,
 981                                                    &tlss,
 982                                                    struct tstream_tls,
 983                                                    location);
 984         if (tevent_req_nomem(state->tls_stream, req)) {
 985                 return tevent_req_post(req, ev);
 986         }
 987         ZERO_STRUCTP(tlss);
 988         talloc_set_destructor(tlss, tstream_tls_destructor);
 989
 990         tlss->plain_stream = plain_stream;
 991
 992         tlss->current_ev = ev;
 993         tlss->retry_im = tevent_create_immediate(tlss);
 994         if (tevent_req_nomem(tlss->retry_im, req)) {
 995                 return tevent_req_post(req, ev);
 996         }
 997
 998         ret = gnutls_init(&tlss->tls_session, GNUTLS_CLIENT);
 999         if (ret != GNUTLS_E_SUCCESS) {
1000                 DEBUG(0,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
1001                 tevent_req_error(req, EINVAL);
1002                 return tevent_req_post(req, ev);
1003         }
1004
1005         ret = gnutls_set_default_priority(tlss->tls_session);
1006         if (ret != GNUTLS_E_SUCCESS) {
1007                 DEBUG(0,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
1008                 tevent_req_error(req, EINVAL);
1009                 return tevent_req_post(req, ev);
1010         }
1011
1012         gnutls_priority_set_direct(tlss->tls_session, "NORMAL:+CTYPE-OPENPGP", NULL);
1013
1014         ret = gnutls_credentials_set(tlss->tls_session,
1015                                      GNUTLS_CRD_CERTIFICATE,
1016                                      tls_params->x509_cred);
1017         if (ret != GNUTLS_E_SUCCESS) {
1018                 DEBUG(0,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
1019                 tevent_req_error(req, EINVAL);
1020                 return tevent_req_post(req, ev);
1021         }
1022
1023         gnutls_transport_set_ptr(tlss->tls_session, (gnutls_transport_ptr)state->tls_stream);
1024         gnutls_transport_set_pull_function(tlss->tls_session,
1025                                            (gnutls_pull_func)tstream_tls_pull_function);
1026         gnutls_transport_set_push_function(tlss->tls_session,
1027                                            (gnutls_push_func)tstream_tls_push_function);
1028 #if GNUTLS_VERSION_MAJOR < 3
1029         gnutls_transport_set_lowat(tlss->tls_session, 0);
1030 #endif
1031
1032         tlss->handshake.req = req;
1033         tstream_tls_retry_handshake(state->tls_stream);
1034         if (!tevent_req_is_in_progress(req)) {
1035                 return tevent_req_post(req, ev);
1036         }
1037
1038         return req;
1039 #else /* ENABLE_GNUTLS */
1040         tevent_req_error(req, ENOSYS);
1041         return tevent_req_post(req, ev);
1042 #endif /* ENABLE_GNUTLS */
1043 }
1044
1045 int tstream_tls_connect_recv(struct tevent_req *req,
1046                              int *perrno,
1047                              TALLOC_CTX *mem_ctx,
1048                              struct tstream_context **tls_stream)
1049 {
1050         struct tstream_tls_connect_state *state =
1051                 tevent_req_data(req,
1052                 struct tstream_tls_connect_state);
1053
1054         if (tevent_req_is_unix_error(req, perrno)) {
1055                 tevent_req_received(req);
1056                 return -1;
1057         }
1058
1059         *tls_stream = talloc_move(mem_ctx, &state->tls_stream);
1060         tevent_req_received(req);
1061         return 0;
1062 }
1063
1064 /*
1065   initialise global tls state
1066 */
1067 NTSTATUS tstream_tls_params_server(TALLOC_CTX *mem_ctx,
1068                                    const char *dns_host_name,
1069                                    bool enabled,
1070                                    const char *key_file,
1071                                    const char *cert_file,
1072                                    const char *ca_file,
1073                                    const char *crl_file,
1074                                    const char *dhp_file,
1075                                    struct tstream_tls_params **_tlsp)
1076 {
1077         struct tstream_tls_params *tlsp;
1078 #if ENABLE_GNUTLS
1079         int ret;
1080         struct stat st;
1081
1082         if (!enabled || key_file == NULL || *key_file == 0) {
1083                 tlsp = talloc_zero(mem_ctx, struct tstream_tls_params);
1084                 NT_STATUS_HAVE_NO_MEMORY(tlsp);
1085                 talloc_set_destructor(tlsp, tstream_tls_params_destructor);
1086                 tlsp->tls_enabled = false;
1087
1088                 *_tlsp = tlsp;
1089                 return NT_STATUS_OK;
1090         }
1091
1092         ret = gnutls_global_init();
1093         if (ret != GNUTLS_E_SUCCESS) {
1094                 DEBUG(0,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
1095                 return NT_STATUS_NOT_SUPPORTED;
1096         }
1097
1098         tlsp = talloc_zero(mem_ctx, struct tstream_tls_params);
1099         NT_STATUS_HAVE_NO_MEMORY(tlsp);
1100
1101         talloc_set_destructor(tlsp, tstream_tls_params_destructor);
1102
1103         if (!file_exist(ca_file)) {
1104                 tls_cert_generate(tlsp, dns_host_name,
1105                                   key_file, cert_file, ca_file);
1106         }
1107
1108         if (file_exist(key_file) &&
1109             !file_check_permissions(key_file, geteuid(), 0600, &st))
1110         {
1111                 DEBUG(0, ("Invalid permissions on TLS private key file '%s':\n"
1112                           "owner uid %u should be %u, mode 0%o should be 0%o\n"
1113                           "This is known as CVE-2013-4476.\n"
1114                           "Removing all tls .pem files will cause an "
1115                           "auto-regeneration with the correct permissions.\n",
1116                           key_file,
1117                           (unsigned int)st.st_uid, geteuid(),
1118                           (unsigned int)(st.st_mode & 0777), 0600));
1119                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1120         }
1121
1122         ret = gnutls_certificate_allocate_credentials(&tlsp->x509_cred);
1123         if (ret != GNUTLS_E_SUCCESS) {
1124                 DEBUG(0,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
1125                 talloc_free(tlsp);
1126                 return NT_STATUS_NO_MEMORY;
1127         }
1128
1129         if (ca_file && *ca_file) {
1130                 ret = gnutls_certificate_set_x509_trust_file(tlsp->x509_cred,
1131                                                              ca_file,
1132                                                              GNUTLS_X509_FMT_PEM);
1133                 if (ret < 0) {
1134                         DEBUG(0,("TLS failed to initialise cafile %s - %s\n",
1135                                  ca_file, gnutls_strerror(ret)));
1136                         talloc_free(tlsp);
1137                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1138                 }
1139         }
1140
1141         if (crl_file && *crl_file) {
1142                 ret = gnutls_certificate_set_x509_crl_file(tlsp->x509_cred,
1143                                                            crl_file,
1144                                                            GNUTLS_X509_FMT_PEM);
1145                 if (ret < 0) {
1146                         DEBUG(0,("TLS failed to initialise crlfile %s - %s\n",
1147                                  crl_file, gnutls_strerror(ret)));
1148                         talloc_free(tlsp);
1149                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1150                 }
1151         }
1152
1153         ret = gnutls_certificate_set_x509_key_file(tlsp->x509_cred,
1154                                                    cert_file, key_file,
1155                                                    GNUTLS_X509_FMT_PEM);
1156         if (ret != GNUTLS_E_SUCCESS) {
1157                 DEBUG(0,("TLS failed to initialise certfile %s and keyfile %s - %s\n",
1158                          cert_file, key_file, gnutls_strerror(ret)));
1159                 talloc_free(tlsp);
1160                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1161         }
1162
1163         ret = gnutls_dh_params_init(&tlsp->dh_params);
1164         if (ret != GNUTLS_E_SUCCESS) {
1165                 DEBUG(0,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
1166                 talloc_free(tlsp);
1167                 return NT_STATUS_NO_MEMORY;
1168         }
1169
1170         if (dhp_file && *dhp_file) {
1171                 gnutls_datum_t dhparms;
1172                 size_t size;
1173
1174                 dhparms.data = (uint8_t *)file_load(dhp_file, &size, 0, tlsp);
1175
1176                 if (!dhparms.data) {
1177                         DEBUG(0,("TLS failed to read DH Parms from %s - %d:%s\n",
1178                                  dhp_file, errno, strerror(errno)));
1179                         talloc_free(tlsp);
1180                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1181                 }
1182                 dhparms.size = size;
1183
1184                 ret = gnutls_dh_params_import_pkcs3(tlsp->dh_params,
1185                                                     &dhparms,
1186                                                     GNUTLS_X509_FMT_PEM);
1187                 if (ret != GNUTLS_E_SUCCESS) {
1188                         DEBUG(0,("TLS failed to import pkcs3 %s - %s\n",
1189                                  dhp_file, gnutls_strerror(ret)));
1190                         talloc_free(tlsp);
1191                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1192                 }
1193         } else {
1194                 ret = gnutls_dh_params_generate2(tlsp->dh_params, DH_BITS);
1195                 if (ret != GNUTLS_E_SUCCESS) {
1196                         DEBUG(0,("TLS failed to generate dh_params - %s\n",
1197                                  gnutls_strerror(ret)));
1198                         talloc_free(tlsp);
1199                         return NT_STATUS_INTERNAL_ERROR;
1200                 }
1201         }
1202
1203         gnutls_certificate_set_dh_params(tlsp->x509_cred, tlsp->dh_params);
1204
1205         tlsp->tls_enabled = true;
1206
1207 #else /* ENABLE_GNUTLS */
1208         tlsp = talloc_zero(mem_ctx, struct tstream_tls_params);
1209         NT_STATUS_HAVE_NO_MEMORY(tlsp);
1210         talloc_set_destructor(tlsp, tstream_tls_params_destructor);
1211         tlsp->tls_enabled = false;
1212 #endif /* ENABLE_GNUTLS */
1213
1214         *_tlsp = tlsp;
1215         return NT_STATUS_OK;
1216 }
1217
1218 struct tstream_tls_accept_state {
1219         struct tstream_context *tls_stream;
1220 };
1221
1222 struct tevent_req *_tstream_tls_accept_send(TALLOC_CTX *mem_ctx,
1223                                             struct tevent_context *ev,
1224                                             struct tstream_context *plain_stream,
1225                                             struct tstream_tls_params *tlsp,
1226                                             const char *location)
1227 {
1228         struct tevent_req *req;
1229         struct tstream_tls_accept_state *state;
1230         struct tstream_tls *tlss;
1231 #if ENABLE_GNUTLS
1232         int ret;
1233 #endif /* ENABLE_GNUTLS */
1234
1235         req = tevent_req_create(mem_ctx, &state,
1236                                 struct tstream_tls_accept_state);
1237         if (req == NULL) {
1238                 return NULL;
1239         }
1240
1241         state->tls_stream = tstream_context_create(state,
1242                                                    &tstream_tls_ops,
1243                                                    &tlss,
1244                                                    struct tstream_tls,
1245                                                    location);
1246         if (tevent_req_nomem(state->tls_stream, req)) {
1247                 return tevent_req_post(req, ev);
1248         }
1249         ZERO_STRUCTP(tlss);
1250         talloc_set_destructor(tlss, tstream_tls_destructor);
1251
1252 #if ENABLE_GNUTLS
1253         tlss->plain_stream = plain_stream;
1254
1255         tlss->current_ev = ev;
1256         tlss->retry_im = tevent_create_immediate(tlss);
1257         if (tevent_req_nomem(tlss->retry_im, req)) {
1258                 return tevent_req_post(req, ev);
1259         }
1260
1261         ret = gnutls_init(&tlss->tls_session, GNUTLS_SERVER);
1262         if (ret != GNUTLS_E_SUCCESS) {
1263                 DEBUG(0,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
1264                 tevent_req_error(req, EINVAL);
1265                 return tevent_req_post(req, ev);
1266         }
1267
1268         ret = gnutls_set_default_priority(tlss->tls_session);
1269         if (ret != GNUTLS_E_SUCCESS) {
1270                 DEBUG(0,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
1271                 tevent_req_error(req, EINVAL);
1272                 return tevent_req_post(req, ev);
1273         }
1274
1275         ret = gnutls_credentials_set(tlss->tls_session, GNUTLS_CRD_CERTIFICATE,
1276                                      tlsp->x509_cred);
1277         if (ret != GNUTLS_E_SUCCESS) {
1278                 DEBUG(0,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
1279                 tevent_req_error(req, EINVAL);
1280                 return tevent_req_post(req, ev);
1281         }
1282
1283         gnutls_certificate_server_set_request(tlss->tls_session,
1284                                               GNUTLS_CERT_REQUEST);
1285         gnutls_dh_set_prime_bits(tlss->tls_session, DH_BITS);
1286
1287         gnutls_transport_set_ptr(tlss->tls_session, (gnutls_transport_ptr)state->tls_stream);
1288         gnutls_transport_set_pull_function(tlss->tls_session,
1289                                            (gnutls_pull_func)tstream_tls_pull_function);
1290         gnutls_transport_set_push_function(tlss->tls_session,
1291                                            (gnutls_push_func)tstream_tls_push_function);
1292 #if GNUTLS_VERSION_MAJOR < 3
1293         gnutls_transport_set_lowat(tlss->tls_session, 0);
1294 #endif
1295
1296         tlss->handshake.req = req;
1297         tstream_tls_retry_handshake(state->tls_stream);
1298         if (!tevent_req_is_in_progress(req)) {
1299                 return tevent_req_post(req, ev);
1300         }
1301
1302         return req;
1303 #else /* ENABLE_GNUTLS */
1304         tevent_req_error(req, ENOSYS);
1305         return tevent_req_post(req, ev);
1306 #endif /* ENABLE_GNUTLS */
1307 }
1308
1309 static void tstream_tls_retry_handshake(struct tstream_context *stream)
1310 {
1311         struct tstream_tls *tlss =
1312                 tstream_context_data(stream,
1313                 struct tstream_tls);
1314         struct tevent_req *req = tlss->handshake.req;
1315 #if ENABLE_GNUTLS
1316         int ret;
1317
1318         if (tlss->error != 0) {
1319                 tevent_req_error(req, tlss->error);
1320                 return;
1321         }
1322
1323         ret = gnutls_handshake(tlss->tls_session);
1324         if (ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN) {
1325                 return;
1326         }
1327
1328         tlss->handshake.req = NULL;
1329
1330         if (gnutls_error_is_fatal(ret) != 0) {
1331                 DEBUG(1,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
1332                 tlss->error = EIO;
1333                 tevent_req_error(req, tlss->error);
1334                 return;
1335         }
1336
1337         if (ret != GNUTLS_E_SUCCESS) {
1338                 DEBUG(1,("TLS %s - %s\n", __location__, gnutls_strerror(ret)));
1339                 tlss->error = EIO;
1340                 tevent_req_error(req, tlss->error);
1341                 return;
1342         }
1343
1344         tevent_req_done(req);
1345 #else /* ENABLE_GNUTLS */
1346         tevent_req_error(req, ENOSYS);
1347 #endif /* ENABLE_GNUTLS */
1348 }
1349
1350 int tstream_tls_accept_recv(struct tevent_req *req,
1351                             int *perrno,
1352                             TALLOC_CTX *mem_ctx,
1353                             struct tstream_context **tls_stream)
1354 {
1355         struct tstream_tls_accept_state *state =
1356                 tevent_req_data(req,
1357                 struct tstream_tls_accept_state);
1358
1359         if (tevent_req_is_unix_error(req, perrno)) {
1360                 tevent_req_received(req);
1361                 return -1;
1362         }
1363
1364         *tls_stream = talloc_move(mem_ctx, &state->tls_stream);
1365         tevent_req_received(req);
1366         return 0;
1367 }