source4/lib/tls/tls.h

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    transport layer security handling code
   5
   6    Copyright (C) Andrew Tridgell 2005
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #ifndef _TLS_H_
  23 #define _TLS_H_
  24
  25 #include "lib/socket/socket.h"
  26
  27 struct loadparm_context;
  28
  29 void tls_cert_generate(TALLOC_CTX *mem_ctx,
  30                        const char *hostname,
  31                        const char *keyfile, const char *certfile,
  32                        const char *cafile);
  33
  34 struct tstream_context;
  35 struct tstream_tls_params;
  36
  37 enum tls_verify_peer_state {
  38         TLS_VERIFY_PEER_NO_CHECK = 0,
  39 #define TLS_VERIFY_PEER_NO_CHECK_STRING "no_check"
  40
  41         TLS_VERIFY_PEER_CA_ONLY = 10,
  42 #define TLS_VERIFY_PEER_CA_ONLY_STRING "ca_only"
  43
  44         TLS_VERIFY_PEER_CA_AND_NAME_IF_AVAILABLE = 20,
  45 #define TLS_VERIFY_PEER_CA_AND_NAME_IF_AVAILABLE_STRING \
  46                 "ca_and_name_if_available"
  47
  48         TLS_VERIFY_PEER_CA_AND_NAME = 30,
  49 #define TLS_VERIFY_PEER_CA_AND_NAME_STRING "ca_and_name"
  50
  51         TLS_VERIFY_PEER_AS_STRICT_AS_POSSIBLE = 9999,
  52 #define TLS_VERIFY_PEER_AS_STRICT_AS_POSSIBLE_STRING \
  53                 "as_strict_as_possible"
  54 };
  55
  56 const char *tls_verify_peer_string(enum tls_verify_peer_state verify_peer);
  57
  58 NTSTATUS tstream_tls_params_client(TALLOC_CTX *mem_ctx,
  59                                    const char *ca_file,
  60                                    const char *crl_file,
  61                                    const char *tls_priority,
  62                                    enum tls_verify_peer_state verify_peer,
  63                                    const char *peer_name,
  64                                    struct tstream_tls_params **_tlsp);
  65
  66 NTSTATUS tstream_tls_params_server(TALLOC_CTX *mem_ctx,
  67                                    const char *dns_host_name,
  68                                    bool enabled,
  69                                    const char *key_file,
  70                                    const char *cert_file,
  71                                    const char *ca_file,
  72                                    const char *crl_file,
  73                                    const char *dhp_file,
  74                                    const char *tls_priority,
  75                                    struct tstream_tls_params **_params);
  76
  77 bool tstream_tls_params_enabled(struct tstream_tls_params *params);
  78
  79 struct tevent_req *_tstream_tls_connect_send(TALLOC_CTX *mem_ctx,
  80                                              struct tevent_context *ev,
  81                                              struct tstream_context *plain_stream,
  82                                              struct tstream_tls_params *tls_params,
  83                                              const char *location);
  84 #define tstream_tls_connect_send(mem_ctx, ev, plain_stream, tls_params) \
  85         _tstream_tls_connect_send(mem_ctx, ev, plain_stream, tls_params, __location__)
  86
  87 int tstream_tls_connect_recv(struct tevent_req *req,
  88                              int *perrno,
  89                              TALLOC_CTX *mem_ctx,
  90                              struct tstream_context **tls_stream);
  91
  92 struct tevent_req *_tstream_tls_accept_send(TALLOC_CTX *mem_ctx,
  93                                             struct tevent_context *ev,
  94                                             struct tstream_context *plain_stream,
  95                                             struct tstream_tls_params *tls_params,
  96                                             const char *location);
  97 #define tstream_tls_accept_send(mem_ctx, ev, plain_stream, tls_params) \
  98         _tstream_tls_accept_send(mem_ctx, ev, plain_stream, tls_params, __location__)
  99
 100 int tstream_tls_accept_recv(struct tevent_req *req,
 101                             int *perrno,
 102                             TALLOC_CTX *mem_ctx,
 103                             struct tstream_context **tls_stream);
 104
 105 #endif /* _TLS_H_ */