source4/lib/tls/tls.h

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    transport layer security handling code
   5
   6    Copyright (C) Andrew Tridgell 2005
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #ifndef _TLS_H_
  23 #define _TLS_H_
  24
  25 #include "lib/socket/socket.h"
  26
  27 struct loadparm_context;
  28
  29 /*
  30   call tls_initialise() once per task to startup the tls subsystem
  31 */
  32 struct tls_params *tls_initialise(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx);
  33
  34 /*
  35   call tls_init_server() on each new server connection
  36
  37   the 'plain_chars' parameter is a list of chars that when they occur
  38   as the first character from the client on the connection tell the
  39   tls code that this is a non-tls connection. This can be used to have
  40   tls and non-tls servers on the same port. If this is NULL then only
  41   tls connections will be allowed
  42 */
  43 struct socket_context *tls_init_server(struct tls_params *parms,
  44                                     struct socket_context *sock,
  45                                     struct tevent_fd *fde,
  46                                     const char *plain_chars);
  47
  48 void tls_cert_generate(TALLOC_CTX *mem_ctx,
  49                        const char *hostname,
  50                        const char *keyfile, const char *certfile,
  51                        const char *cafile);
  52
  53 /*
  54   call tls_init_client() on each new client connection
  55 */
  56 struct socket_context *tls_init_client(struct socket_context *sock,
  57                                     struct tevent_fd *fde,
  58                                     const char *cafile);
  59
  60 /*
  61   return True if a connection used tls
  62 */
  63 bool tls_enabled(struct socket_context *tls);
  64
  65
  66 const struct socket_ops *socket_tls_ops(enum socket_type type);
  67
  68 struct tstream_context;
  69 struct tstream_tls_params;
  70
  71 NTSTATUS tstream_tls_params_client(TALLOC_CTX *mem_ctx,
  72                                    const char *ca_file,
  73                                    const char *crl_file,
  74                                    struct tstream_tls_params **_tlsp);
  75
  76 NTSTATUS tstream_tls_params_server(TALLOC_CTX *mem_ctx,
  77                                    const char *dns_host_name,
  78                                    bool enabled,
  79                                    const char *key_file,
  80                                    const char *cert_file,
  81                                    const char *ca_file,
  82                                    const char *crl_file,
  83                                    const char *dhp_file,
  84                                    struct tstream_tls_params **_params);
  85
  86 bool tstream_tls_params_enabled(struct tstream_tls_params *params);
  87
  88 struct tevent_req *_tstream_tls_connect_send(TALLOC_CTX *mem_ctx,
  89                                              struct tevent_context *ev,
  90                                              struct tstream_context *plain_stream,
  91                                              struct tstream_tls_params *tls_params,
  92                                              const char *location);
  93 #define tstream_tls_connect_send(mem_ctx, ev, plain_stream, tls_params) \
  94         _tstream_tls_connect_send(mem_ctx, ev, plain_stream, tls_params, __location__)
  95
  96 int tstream_tls_connect_recv(struct tevent_req *req,
  97                              int *perrno,
  98                              TALLOC_CTX *mem_ctx,
  99                              struct tstream_context **tls_stream);
 100
 101 struct tevent_req *_tstream_tls_accept_send(TALLOC_CTX *mem_ctx,
 102                                             struct tevent_context *ev,
 103                                             struct tstream_context *plain_stream,
 104                                             struct tstream_tls_params *tls_params,
 105                                             const char *location);
 106 #define tstream_tls_accept_send(mem_ctx, ev, plain_stream, tls_params) \
 107         _tstream_tls_accept_send(mem_ctx, ev, plain_stream, tls_params, __location__)
 108
 109 int tstream_tls_accept_recv(struct tevent_req *req,
 110                             int *perrno,
 111                             TALLOC_CTX *mem_ctx,
 112                             struct tstream_context **tls_stream);
 113
 114 #endif /* _TLS_H_ */