Fix Coverity issue #101127.
[libpwmd.git] / src / tls.c
blob797e8a56c9917ba1afc918f1a671517273dd82c4
1 /*
2 Copyright (C) 2012, 2013, 2014, 2015
3 Ben Kibbey <bjk@luxsci.net>
5 This file is part of libpwmd.
7 Libpwmd is free software: you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation, either version 2 of the License, or
10 (at your option) any later version.
12 Libpwmd is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with Libpwmd. If not, see <http://www.gnu.org/licenses/>.
20 #ifdef HAVE_CONFIG_H
21 #include <config.h>
22 #endif
24 #include <stdio.h>
25 #include <stdlib.h>
26 #include <unistd.h>
27 #include <errno.h>
28 #include <ctype.h>
29 #include <sys/types.h>
30 #include <sys/socket.h>
31 #include <fcntl.h>
33 #ifdef HAVE_STRINGS_H
34 #include <strings.h>
35 #endif
37 #include "types.h"
38 #include "misc.h"
40 #define WAIT_INTERVAL 50000
41 #define TEST_TIMEOUT(timeout, ret, start, rc) \
42 do { \
43 if (ret == GNUTLS_E_AGAIN) \
44 { \
45 time_t now = time (NULL); \
46 if (timeout && now - start >= timeout) \
47 { \
48 rc = gpg_error (GPG_ERR_ETIMEDOUT); \
49 break; \
50 } \
51 struct timeval tv = { 0, WAIT_INTERVAL }; \
52 select (0, NULL, NULL, NULL, &tv); \
53 } \
54 if (ret != GNUTLS_E_INTERRUPTED) \
55 break; \
56 } \
57 while (0)
59 void
60 tls_free (pwm_t *pwm)
62 struct tls_s *tls = pwm->tcp->tls;
63 int ret = 0;
65 if (!tls)
66 return;
68 pwmd_free (tls->ca);
69 pwmd_free (tls->cert);
70 pwmd_free (tls->key);
71 pwmd_free (tls->priority);
72 pwmd_free (tls->server_fp);
74 if (tls->session)
76 time_t start = time (NULL);
80 gpg_error_t rc = 0;
82 ret = gnutls_bye (tls->session, GNUTLS_SHUT_WR);
83 TEST_TIMEOUT (tls->timeout, ret, start, rc);
84 if (rc)
85 break;
87 while (ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED);
89 gnutls_deinit (tls->session);
91 else if (pwm->fd != -1)
93 close (pwm->fd);
94 pwm->fd = -1;
97 if (tls->x509)
98 gnutls_certificate_free_credentials (tls->x509);
100 tls->session = NULL;
101 tls->x509 = NULL;
102 pwmd_free (tls);
103 pwm->tls_error = ret;
106 ssize_t
107 read_hook_tls (pwm_t *pwm, assuan_fd_t fd, void *data, size_t len)
109 struct tls_s *tls = pwm->tcp->tls;
111 if (*tls->fd == -1)
112 return -1;
114 ssize_t ret;
115 time_t start = time (NULL);
117 rehandshake:
120 gpg_error_t rc = 0;
122 ret = gnutls_record_recv (tls->session, data, len);
123 if (ret == GNUTLS_E_REHANDSHAKE)
125 ret = gnutls_rehandshake (tls->session);
126 if (ret == GNUTLS_E_GOT_APPLICATION_DATA)
127 goto rehandshake;
128 else if (ret != GNUTLS_E_SUCCESS)
130 pwm->tls_error = ret;
131 ret = 0;
132 break;
137 ret = gnutls_handshake (tls->session);
138 rc = 0;
139 TEST_TIMEOUT (tls->timeout, ret, start, rc);
140 if (rc)
142 close (*tls->fd);
143 *tls->fd = -1;
144 errno = ETIMEDOUT;
145 return -1;
148 while (ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED);
150 pwm->tls_error = ret;
151 if (rc)
152 break;
154 continue;
157 TEST_TIMEOUT (tls->timeout, ret, start, rc);
158 if (rc)
160 close (*tls->fd);
161 *tls->fd = -1;
162 errno = ETIMEDOUT;
163 return -1;
166 while (ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED);
168 if (ret < 0)
169 pwm->tls_error = ret;
171 if (!ret)
172 return 0;
173 else if (ret == GNUTLS_E_PREMATURE_TERMINATION)
174 errno = EPIPE;
176 return ret < 0 ? -1 : ret;
179 ssize_t
180 write_hook_tls (pwm_t *pwm, assuan_fd_t fd, const void *data, size_t len)
182 struct tls_s *tls = pwm->tcp->tls;
184 /* This is probably the BYE command after a previous call timed
185 * out. If not done, the time(2) call seems to hang.*/
186 if (*tls->fd == -1)
187 return -1;
189 ssize_t ret;
190 time_t start = time (NULL);
194 gpg_error_t rc = 0;
196 ret = gnutls_record_send (tls->session, data, len);
197 TEST_TIMEOUT (tls->timeout, ret, start, rc);
198 if (rc)
200 close (*tls->fd);
201 *tls->fd = -1;
202 errno = ETIMEDOUT;
203 return -1;
206 while (ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED);
208 if (ret < 0)
209 pwm->tls_error = ret;
211 if (!ret)
212 return 0;
213 else if (ret == GNUTLS_E_PREMATURE_TERMINATION)
214 errno = EPIPE;
216 return ret < 0 ? -1 : ret;
219 static gpg_error_t
220 tls_fingerprint (pwm_t *pwm, char **result)
222 gnutls_session_t ses = pwm->tcp->tls->session;
223 gnutls_x509_crt_t crt;
224 const gnutls_datum_t *cert_list;
225 unsigned count;
226 unsigned char buf[32];
227 size_t len = sizeof (buf);
229 *result = NULL;
230 gnutls_x509_crt_init (&crt);
231 if (!crt)
232 return GPG_ERR_ENOMEM;
234 cert_list = gnutls_certificate_get_peers (ses, &count);
235 if (count)
237 pwm->tls_error = gnutls_x509_crt_import (crt, &cert_list[0],
238 GNUTLS_X509_FMT_DER);
239 if (!pwm->tls_error)
240 gnutls_x509_crt_get_fingerprint (crt, GNUTLS_DIG_SHA256, buf, &len);
243 gnutls_x509_crt_deinit (crt);
244 if (!pwm->tls_error)
245 *result = bin2hex (buf, len);
247 return !pwm->tls_error ? 0 : GPG_ERR_ENOMEM;
250 static gpg_error_t
251 verify_certificate (pwm_t *pwm)
253 unsigned int status;
254 const gnutls_datum_t *cert_list;
255 unsigned int cert_list_size;
256 int i;
257 gnutls_x509_crt_t cert;
258 gpg_error_t rc = 0;
260 i = gnutls_certificate_verify_peers2 (pwm->tcp->tls->session, &status);
261 if (i < 0)
263 pwm->tls_error = i;
264 return GPG_ERR_BAD_CERT;
267 if (status & GNUTLS_CERT_INVALID)
268 return GPG_ERR_BAD_CERT;
270 if (status & GNUTLS_CERT_SIGNER_NOT_FOUND)
271 return GPG_ERR_BAD_SIGNATURE;
273 if (status & GNUTLS_CERT_REVOKED)
274 return GPG_ERR_CERT_REVOKED;
276 if (gnutls_certificate_type_get (pwm->tcp->tls->session) != GNUTLS_CRT_X509)
277 return GPG_ERR_UNSUPPORTED_CERT;
279 if (gnutls_x509_crt_init (&cert) < 0)
280 return gpg_error_from_errno (ENOMEM);
282 cert_list = gnutls_certificate_get_peers (pwm->tcp->tls->session,
283 &cert_list_size);
284 if (!cert_list)
286 rc = GPG_ERR_MISSING_CERT;
287 goto done;
290 for (i = 0; i < cert_list_size; i++)
292 pwm->tls_error = gnutls_x509_crt_import (cert, &cert_list[i],
293 GNUTLS_X509_FMT_DER);
294 if (pwm->tls_error < 0)
296 rc = GPG_ERR_BAD_CERT_CHAIN;
297 goto done;
300 if (gnutls_x509_crt_get_expiration_time (cert) < time (0))
302 rc = GPG_ERR_CERT_EXPIRED;
303 goto done;
306 if (gnutls_x509_crt_get_activation_time (cert) > time (0))
308 rc = GPG_ERR_CERT_TOO_YOUNG;
309 goto done;
312 if (pwm->tcp->tls->verify)
314 if (!gnutls_x509_crt_check_hostname (cert, pwm->tcp->host))
316 rc = GPG_ERR_BAD_CERT_CHAIN;
317 goto done;
322 if (pwm->tcp->tls->server_fp)
324 char *result;
326 rc = tls_fingerprint (pwm, &result);
327 if (!rc)
329 if (!result || !*result ||
330 strcasecmp (result, pwm->tcp->tls->server_fp))
331 rc = GPG_ERR_BAD_CERT;
333 pwmd_free (result);
337 done:
338 gnutls_x509_crt_deinit (cert);
339 return rc;
342 static gpg_error_t
343 tls_init (pwm_t * pwm)
345 gpg_error_t rc;
346 int ret;
347 const char *errstr;
349 ret = gnutls_certificate_allocate_credentials (&pwm->tcp->tls->x509);
350 if (ret)
352 pwm->tls_error = ret;
353 return gpg_error_from_errno (ENOMEM);
356 /* The client certificate must be signed by the CA of the pwmd server
357 * certificate in order for the client to authenticate successfully. Man in
358 * the middle attacks are still possible if the attacker is running a pwmd
359 * that doesn't require client certificate authentication. So require the
360 * client to verify the server certificate.
362 ret = gnutls_certificate_set_x509_trust_file (pwm->tcp->tls->x509,
363 pwm->tcp->tls->ca,
364 GNUTLS_X509_FMT_PEM);
365 if (ret == -1)
367 rc = GPG_ERR_INV_CERT_OBJ;
368 goto fail;
371 ret = gnutls_certificate_set_x509_key_file (pwm->tcp->tls->x509,
372 pwm->tcp->tls->cert,
373 pwm->tcp->tls->key,
374 GNUTLS_X509_FMT_PEM);
375 if (ret != GNUTLS_E_SUCCESS)
377 pwm->tls_error = ret;
378 rc = GPG_ERR_INV_CERT_OBJ;
379 goto fail;
382 ret = gnutls_init (&pwm->tcp->tls->session, GNUTLS_CLIENT);
383 if (ret != GNUTLS_E_SUCCESS)
385 pwm->tls_error = ret;
386 rc = GPG_ERR_INV_CERT_OBJ;
387 goto fail;
390 ret = gnutls_priority_set_direct (pwm->tcp->tls->session,
391 pwm->tcp->tls->priority ? pwm->tcp->tls->
392 priority : "SECURE256", &errstr);
393 if (ret != GNUTLS_E_SUCCESS)
395 pwm->tls_error = ret;
396 rc = GPG_ERR_INV_CERT_OBJ;
397 goto fail;
400 ret = gnutls_credentials_set (pwm->tcp->tls->session, GNUTLS_CRD_CERTIFICATE,
401 pwm->tcp->tls->x509);
402 if (ret != GNUTLS_E_SUCCESS)
404 pwm->tls_error = ret;
405 rc = GPG_ERR_INV_CERT_OBJ;
406 goto fail;
409 gnutls_transport_set_ptr (pwm->tcp->tls->session,
410 (gnutls_transport_ptr_t) pwm->fd);
411 if (fcntl (pwm->fd, F_SETFL, O_NONBLOCK) == -1)
413 rc = gpg_error_from_errno (errno);
414 goto fail;
417 time_t start = time (NULL);
420 ret = gnutls_handshake (pwm->tcp->tls->session);
421 rc = 0;
422 TEST_TIMEOUT (pwm->tcp->tls->timeout, ret, start, rc);
423 if (rc)
424 goto fail;
426 while (ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED);
428 if (ret != GNUTLS_E_SUCCESS)
430 pwm->tls_error = ret;
431 rc = GPG_ERR_INV_CERT_OBJ;
432 goto fail;
435 rc = verify_certificate (pwm);
437 fail:
438 if (rc)
440 /* Keep the original error since it maybe overwritten during TLS
441 * shutdown. */
442 ret = pwm->tls_error;
443 free_tcp (pwm);
444 pwm->tls_error = ret;
447 return rc;
450 gpg_error_t
451 _do_tls_connect (pwm_t * pwm, const char *host, int port,
452 const char *cert, const char *key, const char *cacert,
453 const char *prio, const char *server_fp, int verify)
455 struct tcp_s *tcp = pwmd_calloc (1, sizeof (struct tcp_s));
456 gpg_error_t rc;
458 if (!tcp)
459 return GPG_ERR_ENOMEM;
461 if (!cert || !key || !cacert)
463 pwmd_free (tcp);
464 return GPG_ERR_INV_ARG;
467 pwm->tcp = tcp;
468 tcp->port = port;
469 tcp->host = pwmd_strdup (host);
470 if (!tcp->host)
472 rc = GPG_ERR_ENOMEM;
473 goto fail;
476 tcp->tls = pwmd_calloc (1, sizeof (struct tls_s));
477 if (!tcp->tls)
479 rc = GPG_ERR_ENOMEM;
480 goto fail;
483 tcp->tls->timeout = pwm->socket_timeout;
484 tcp->tls->verify = verify;
485 tcp->tls->cert = pwmd_strdup (cert);
486 if (!tcp->tls->cert)
488 rc = GPG_ERR_ENOMEM;
489 goto fail;
492 tcp->tls->key = pwmd_strdup (key);
493 if (!tcp->tls->key)
495 rc = GPG_ERR_ENOMEM;
496 goto fail;
499 tcp->tls->ca = pwmd_strdup (cacert);
500 if (!tcp->tls->ca)
502 rc = GPG_ERR_ENOMEM;
503 goto fail;
506 if (prio)
508 tcp->tls->priority = pwmd_strdup (prio);
509 if (!tcp->tls->priority)
511 rc = GPG_ERR_ENOMEM;
512 goto fail;
516 if (server_fp)
518 tcp->tls->server_fp = pwmd_strdup (server_fp);
519 if (!tcp->tls->server_fp)
521 rc = GPG_ERR_ENOMEM;
522 goto fail;
526 rc = tcp_connect_common (pwm);
527 if (!rc)
529 rc = tls_init (pwm);
530 if (!rc)
532 pwm->tcp->fd = pwm->tcp->tls->fd = &pwm->fd;
533 rc = assuan_socket_connect_fd (pwm->ctx, pwm->fd, 0);
537 fail:
538 if (rc)
539 free_tcp (pwm);
541 return rc;
545 * tls[46]://[hostname][:port]
547 gpg_error_t
548 _parse_tls_url (const char *str, char **host, int *port)
550 *port = 6466;
551 return parse_hostname_common (str, host, port);