cups/tls-darwin.c

   1 /*
   2  * TLS support code for CUPS on macOS.
   3  *
   4  * Copyright 2007-2017 by Apple Inc.
   5  * Copyright 1997-2007 by Easy Software Products, all rights reserved.
   6  *
   7  * These coded instructions, statements, and computer programs are the
   8  * property of Apple Inc. and are protected by Federal copyright
   9  * law.  Distribution and use rights are outlined in the file "LICENSE.txt"
  10  * which should have been included with this file.  If this file is
  11  * missing or damaged, see the license at "http://www.cups.org/".
  12  *
  13  * This file is subject to the Apple OS-Developed Software exception.
  14  */
  15
  16 /**** This file is included from tls.c ****/
  17
  18 /*
  19  * Include necessary headers...
  20  */
  21
  22 #include <spawn.h>
  23
  24 extern char **environ; /* @private@ */
  25
  26
  27 /*
  28  * Constants, very secure stuff...
  29  */
  30
  31 #define _CUPS_CDSA_PASSWORD     "42"    /* CUPS keychain password */
  32 #define _CUPS_CDSA_PASSLEN      2       /* Length of keychain password */
  33
  34
  35 /*
  36  * Local globals...
  37  */
  38
  39 static int              tls_auto_create = 0;
  40                                         /* Auto-create self-signed certs? */
  41 static char             *tls_common_name = NULL;
  42                                         /* Default common name */
  43 #ifdef HAVE_SECKEYCHAINOPEN
  44 static int              tls_cups_keychain = 0;
  45                                         /* Opened the CUPS keychain? */
  46 static SecKeychainRef   tls_keychain = NULL;
  47                                         /* Server cert keychain */
  48 #else
  49 static SecIdentityRef   tls_selfsigned = NULL;
  50                                         /* Temporary self-signed cert */
  51 #endif /* HAVE_SECKEYCHAINOPEN */
  52 static char             *tls_keypath = NULL;
  53                                         /* Server cert keychain path */
  54 static _cups_mutex_t    tls_mutex = _CUPS_MUTEX_INITIALIZER;
  55                                         /* Mutex for keychain/certs */
  56 static int              tls_options = -1;/* Options for TLS connections */
  57
  58
  59 /*
  60  * Local functions...
  61  */
  62
  63 static CFArrayRef       http_cdsa_copy_server(const char *common_name);
  64 static SecCertificateRef http_cdsa_create_credential(http_credential_t *credential);
  65 #ifdef HAVE_SECKEYCHAINOPEN
  66 static const char       *http_cdsa_default_path(char *buffer, size_t bufsize);
  67 static SecKeychainRef   http_cdsa_open_keychain(const char *path, char *filename, size_t filesize);
  68 static SecKeychainRef   http_cdsa_open_system_keychain(void);
  69 #endif /* HAVE_SECKEYCHAINOPEN */
  70 static OSStatus         http_cdsa_read(SSLConnectionRef connection, void *data, size_t *dataLength);
  71 static int              http_cdsa_set_credentials(http_t *http);
  72 static OSStatus         http_cdsa_write(SSLConnectionRef connection, const void *data, size_t *dataLength);
  73
  74
  75 /*
  76  * 'cupsMakeServerCredentials()' - Make a self-signed certificate and private key pair.
  77  *
  78  * @since CUPS 2.0/OS 10.10@
  79  */
  80
  81 int                                     /* O - 1 on success, 0 on failure */
  82 cupsMakeServerCredentials(
  83     const char *path,                   /* I - Keychain path or @code NULL@ for default */
  84     const char *common_name,            /* I - Common name */
  85     int        num_alt_names,           /* I - Number of subject alternate names */
  86     const char **alt_names,             /* I - Subject Alternate Names */
  87     time_t     expiration_date)         /* I - Expiration date */
  88 {
  89 #if defined(HAVE_SECGENERATESELFSIGNEDCERTIFICATE)
  90   int                   status = 0;     /* Return status */
  91   OSStatus              err;            /* Error code (if any) */
  92   CFStringRef           cfcommon_name = NULL;
  93                                         /* CF string for server name */
  94   SecIdentityRef        ident = NULL;   /* Identity */
  95   SecKeyRef             publicKey = NULL,
  96                                         /* Public key */
  97                         privateKey = NULL;
  98                                         /* Private key */
  99   SecCertificateRef     cert = NULL;    /* Self-signed certificate */
 100   CFMutableDictionaryRef keyParams = NULL;
 101                                         /* Key generation parameters */
 102
 103
 104   DEBUG_printf(("cupsMakeServerCredentials(path=\"%s\", common_name=\"%s\", num_alt_names=%d, alt_names=%p, expiration_date=%d)", path, common_name, num_alt_names, alt_names, (int)expiration_date));
 105
 106   (void)path;
 107   (void)num_alt_names;
 108   (void)alt_names;
 109   (void)expiration_date;
 110
 111   if (path)
 112   {
 113     DEBUG_puts("1cupsMakeServerCredentials: No keychain support compiled in, returning 0.");
 114     return (0);
 115   }
 116
 117   if (tls_selfsigned)
 118   {
 119     DEBUG_puts("1cupsMakeServerCredentials: Using existing self-signed cert.");
 120     return (1);
 121   }
 122
 123   cfcommon_name = CFStringCreateWithCString(kCFAllocatorDefault, common_name, kCFStringEncodingUTF8);
 124   if (!cfcommon_name)
 125   {
 126     DEBUG_puts("1cupsMakeServerCredentials: Unable to create CF string of common name.");
 127     goto cleanup;
 128   }
 129
 130  /*
 131   * Create a public/private key pair...
 132   */
 133
 134   keyParams = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
 135   if (!keyParams)
 136   {
 137     DEBUG_puts("1cupsMakeServerCredentials: Unable to create key parameters dictionary.");
 138     goto cleanup;
 139   }
 140
 141   CFDictionaryAddValue(keyParams, kSecAttrKeyType, kSecAttrKeyTypeRSA);
 142   CFDictionaryAddValue(keyParams, kSecAttrKeySizeInBits, CFSTR("2048"));
 143   CFDictionaryAddValue(keyParams, kSecAttrLabel, cfcommon_name);
 144
 145   err = SecKeyGeneratePair(keyParams, &publicKey, &privateKey);
 146   if (err != noErr)
 147   {
 148     DEBUG_printf(("1cupsMakeServerCredentials: Unable to generate key pair: %d.", (int)err));
 149     goto cleanup;
 150   }
 151
 152  /*
 153   * Create a self-signed certificate using the public/private key pair...
 154   */
 155
 156   CFIndex       usageInt = kSecKeyUsageAll;
 157   CFNumberRef   usage = CFNumberCreate(kCFAllocatorDefault, kCFNumberCFIndexType, &usageInt);
 158   CFIndex       lenInt = 0;
 159   CFNumberRef   len = CFNumberCreate(kCFAllocatorDefault, kCFNumberCFIndexType, &lenInt);
 160   CFTypeRef certKeys[] = { kSecCSRBasicContraintsPathLen, kSecSubjectAltName, kSecCertificateKeyUsage };
 161   CFTypeRef certValues[] = { len, cfcommon_name, usage };
 162   CFDictionaryRef certParams = CFDictionaryCreate(kCFAllocatorDefault, certKeys, certValues, sizeof(certKeys) / sizeof(certKeys[0]), &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
 163   CFRelease(usage);
 164   CFRelease(len);
 165
 166   const void    *ca_o[] = { kSecOidOrganization, CFSTR("") };
 167   const void    *ca_cn[] = { kSecOidCommonName, cfcommon_name };
 168   CFArrayRef    ca_o_dn = CFArrayCreate(kCFAllocatorDefault, ca_o, 2, NULL);
 169   CFArrayRef    ca_cn_dn = CFArrayCreate(kCFAllocatorDefault, ca_cn, 2, NULL);
 170   const void    *ca_dn_array[2];
 171
 172   ca_dn_array[0] = CFArrayCreate(kCFAllocatorDefault, (const void **)&ca_o_dn, 1, NULL);
 173   ca_dn_array[1] = CFArrayCreate(kCFAllocatorDefault, (const void **)&ca_cn_dn, 1, NULL);
 174
 175   CFArrayRef    subject = CFArrayCreate(kCFAllocatorDefault, ca_dn_array, 2, NULL);
 176
 177   cert = SecGenerateSelfSignedCertificate(subject, certParams, publicKey, privateKey);
 178
 179   CFRelease(subject);
 180   CFRelease(certParams);
 181
 182   if (!cert)
 183   {
 184     DEBUG_puts("1cupsMakeServerCredentials: Unable to create self-signed certificate.");
 185     goto cleanup;
 186   }
 187
 188   ident = SecIdentityCreate(kCFAllocatorDefault, cert, privateKey);
 189
 190   if (ident)
 191   {
 192     _cupsMutexLock(&tls_mutex);
 193
 194     if (tls_selfsigned)
 195       CFRelease(ident);
 196     else
 197       tls_selfsigned = ident;
 198
 199     _cupsMutexLock(&tls_mutex);
 200
 201 #  if 0 /* Someday perhaps SecItemCopyMatching will work for identities, at which point  */
 202     CFTypeRef itemKeys[] = { kSecClass, kSecAttrLabel, kSecValueRef };
 203     CFTypeRef itemValues[] = { kSecClassIdentity, cfcommon_name, ident };
 204     CFDictionaryRef itemAttrs = CFDictionaryCreate(kCFAllocatorDefault, itemKeys, itemValues, sizeof(itemKeys) / sizeof(itemKeys[0]), &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
 205
 206     err = SecItemAdd(itemAttrs, NULL);
 207     /* SecItemAdd consumes itemAttrs... */
 208
 209     CFRelease(ident);
 210
 211     if (err != noErr)
 212     {
 213       DEBUG_printf(("1cupsMakeServerCredentials: Unable to add identity to keychain: %d.", (int)err));
 214       goto cleanup;
 215     }
 216 #  endif /* 0 */
 217
 218     status = 1;
 219   }
 220   else
 221     DEBUG_puts("1cupsMakeServerCredentials: Unable to create identity from cert and keys.");
 222
 223   /*
 224    * Cleanup and return...
 225    */
 226
 227 cleanup:
 228
 229   if (cfcommon_name)
 230     CFRelease(cfcommon_name);
 231
 232   if (keyParams)
 233     CFRelease(keyParams);
 234
 235   if (cert)
 236     CFRelease(cert);
 237
 238   if (publicKey)
 239     CFRelease(publicKey);
 240
 241   if (privateKey)
 242     CFRelease(privateKey);
 243
 244   DEBUG_printf(("1cupsMakeServerCredentials: Returning %d.", status));
 245
 246   return (status);
 247
 248 #else /* !HAVE_SECGENERATESELFSIGNEDCERTIFICATE */
 249   int           pid,                    /* Process ID of command */
 250                 status,                 /* Status of command */
 251                 i;                      /* Looping var */
 252   char          command[1024],          /* Command */
 253                 *argv[5],               /* Command-line arguments */
 254                 *envp[1000],            /* Environment variables */
 255                 days[32],               /* CERTTOOL_EXPIRATION_DAYS env var */
 256                 keychain[1024],         /* Keychain argument */
 257                 infofile[1024],         /* Type-in information for cert */
 258                 filename[1024];         /* Default keychain path */
 259   cups_file_t   *fp;                    /* Seed/info file */
 260
 261
 262   DEBUG_printf(("cupsMakeServerCredentials(path=\"%s\", common_name=\"%s\", num_alt_names=%d, alt_names=%p, expiration_date=%d)", path, common_name, num_alt_names, (void *)alt_names, (int)expiration_date));
 263
 264   (void)num_alt_names;
 265   (void)alt_names;
 266
 267   if (!path)
 268     path = http_cdsa_default_path(filename, sizeof(filename));
 269
 270  /*
 271   * Run the "certtool" command to generate a self-signed certificate...
 272   */
 273
 274   if (!cupsFileFind("certtool", getenv("PATH"), 1, command, sizeof(command)))
 275     return (-1);
 276
 277  /*
 278   * Create a file with the certificate information fields...
 279   *
 280   * Note: This assumes that the default questions are asked by the certtool
 281   * command...
 282   */
 283
 284  if ((fp = cupsTempFile2(infofile, sizeof(infofile))) == NULL)
 285     return (-1);
 286
 287   cupsFilePrintf(fp,
 288                  "CUPS Self-Signed Certificate\n"
 289                                         /* Enter key and certificate label */
 290                  "r\n"                  /* Generate RSA key pair */
 291                  "2048\n"               /* 2048 bit encryption key */
 292                  "y\n"                  /* OK (y = yes) */
 293                  "b\n"                  /* Usage (b=signing/encryption) */
 294                  "2\n"                  /* Sign with SHA256 */
 295                  "y\n"                  /* OK (y = yes) */
 296                  "%s\n"                 /* Common name */
 297                  "\n"                   /* Country (default) */
 298                  "\n"                   /* Organization (default) */
 299                  "\n"                   /* Organizational unit (default) */
 300                  "\n"                   /* State/Province (default) */
 301                  "\n"                   /* Email address */
 302                  "y\n",                 /* OK (y = yes) */
 303                  common_name);
 304   cupsFileClose(fp);
 305
 306   snprintf(keychain, sizeof(keychain), "k=%s", path);
 307
 308   argv[0] = "certtool";
 309   argv[1] = "c";
 310   argv[2] = keychain;
 311   argv[3] = NULL;
 312
 313   snprintf(days, sizeof(days), "CERTTOOL_EXPIRATION_DAYS=%d", (int)((expiration_date - time(NULL) + 86399) / 86400));
 314   envp[0] = days;
 315   for (i = 0; i < (int)(sizeof(envp) / sizeof(envp[0]) - 2) && environ[i]; i ++)
 316     envp[i + 1] = environ[i];
 317   envp[i] = NULL;
 318
 319   posix_spawn_file_actions_t actions;   /* File actions */
 320
 321   posix_spawn_file_actions_init(&actions);
 322   posix_spawn_file_actions_addclose(&actions, 0);
 323   posix_spawn_file_actions_addopen(&actions, 0, infofile, O_RDONLY, 0);
 324   posix_spawn_file_actions_addclose(&actions, 1);
 325   posix_spawn_file_actions_addopen(&actions, 1, "/dev/null", O_WRONLY, 0);
 326   posix_spawn_file_actions_addclose(&actions, 2);
 327   posix_spawn_file_actions_addopen(&actions, 2, "/dev/null", O_WRONLY, 0);
 328
 329   if (posix_spawn(&pid, command, &actions, NULL, argv, envp))
 330   {
 331     unlink(infofile);
 332     return (-1);
 333   }
 334
 335   posix_spawn_file_actions_destroy(&actions);
 336
 337   unlink(infofile);
 338
 339   while (waitpid(pid, &status, 0) < 0)
 340     if (errno != EINTR)
 341     {
 342       status = -1;
 343       break;
 344     }
 345
 346   return (!status);
 347 #endif /* HAVE_SECGENERATESELFSIGNEDCERTIFICATE && HAVE_SECKEYCHAINOPEN */
 348 }
 349
 350
 351 /*
 352  * 'cupsSetServerCredentials()' - Set the default server credentials.
 353  *
 354  * Note: The server credentials are used by all threads in the running process.
 355  * This function is threadsafe.
 356  *
 357  * @since CUPS 2.0/macOS 10.10@
 358  */
 359
 360 int                                     /* O - 1 on success, 0 on failure */
 361 cupsSetServerCredentials(
 362     const char *path,                   /* I - Keychain path or @code NULL@ for default */
 363     const char *common_name,            /* I - Default common name for server */
 364     int        auto_create)             /* I - 1 = automatically create self-signed certificates */
 365 {
 366   DEBUG_printf(("cupsSetServerCredentials(path=\"%s\", common_name=\"%s\", auto_create=%d)", path, common_name, auto_create));
 367
 368 #ifdef HAVE_SECKEYCHAINOPEN
 369   char          filename[1024];         /* Keychain filename */
 370   SecKeychainRef keychain = http_cdsa_open_keychain(path, filename, sizeof(filename));
 371
 372   if (!keychain)
 373   {
 374     DEBUG_puts("1cupsSetServerCredentials: Unable to open keychain.");
 375     return (0);
 376   }
 377
 378   _cupsMutexLock(&tls_mutex);
 379
 380  /*
 381   * Close any keychain that is currently open...
 382   */
 383
 384   if (tls_keychain)
 385     CFRelease(tls_keychain);
 386
 387   if (tls_keypath)
 388     _cupsStrFree(tls_keypath);
 389
 390   if (tls_common_name)
 391     _cupsStrFree(tls_common_name);
 392
 393  /*
 394   * Save the new keychain...
 395   */
 396
 397   tls_keychain    = keychain;
 398   tls_keypath     = _cupsStrAlloc(filename);
 399   tls_auto_create = auto_create;
 400   tls_common_name = _cupsStrAlloc(common_name);
 401
 402   _cupsMutexUnlock(&tls_mutex);
 403
 404   DEBUG_puts("1cupsSetServerCredentials: Opened keychain, returning 1.");
 405   return (1);
 406
 407 #else
 408   if (path)
 409   {
 410     DEBUG_puts("1cupsSetServerCredentials: No keychain support compiled in, returning 0.");
 411     return (0);
 412   }
 413
 414   tls_auto_create = auto_create;
 415   tls_common_name = _cupsStrAlloc(common_name);
 416
 417   return (1);
 418 #endif /* HAVE_SECKEYCHAINOPEN */
 419 }
 420
 421
 422 /*
 423  * 'httpCopyCredentials()' - Copy the credentials associated with the peer in
 424  *                           an encrypted connection.
 425  *
 426  * @since CUPS 1.5/macOS 10.7@
 427  */
 428
 429 int                                     /* O - Status of call (0 = success) */
 430 httpCopyCredentials(
 431     http_t       *http,                 /* I - Connection to server */
 432     cups_array_t **credentials)         /* O - Array of credentials */
 433 {
 434   OSStatus              error;          /* Error code */
 435   SecTrustRef           peerTrust;      /* Peer trust reference */
 436   CFIndex               count;          /* Number of credentials */
 437   SecCertificateRef     secCert;        /* Certificate reference */
 438   CFDataRef             data;           /* Certificate data */
 439   int                   i;              /* Looping var */
 440
 441
 442   DEBUG_printf(("httpCopyCredentials(http=%p, credentials=%p)", (void *)http, (void *)credentials));
 443
 444   if (credentials)
 445     *credentials = NULL;
 446
 447   if (!http || !http->tls || !credentials)
 448     return (-1);
 449
 450   if (!(error = SSLCopyPeerTrust(http->tls, &peerTrust)) && peerTrust)
 451   {
 452     DEBUG_printf(("2httpCopyCredentials: Peer provided %d certificates.", (int)SecTrustGetCertificateCount(peerTrust)));
 453
 454     if ((*credentials = cupsArrayNew(NULL, NULL)) != NULL)
 455     {
 456       count = SecTrustGetCertificateCount(peerTrust);
 457
 458       for (i = 0; i < count; i ++)
 459       {
 460         secCert = SecTrustGetCertificateAtIndex(peerTrust, i);
 461
 462 #ifdef DEBUG
 463         CFStringRef cf_name = SecCertificateCopySubjectSummary(secCert);
 464         char name[1024];
 465         if (cf_name)
 466           CFStringGetCString(cf_name, name, sizeof(name), kCFStringEncodingUTF8);
 467         else
 468           strlcpy(name, "unknown", sizeof(name));
 469
 470         DEBUG_printf(("2httpCopyCredentials: Certificate %d name is \"%s\".", i, name));
 471 #endif /* DEBUG */
 472
 473         if ((data = SecCertificateCopyData(secCert)) != NULL)
 474         {
 475           DEBUG_printf(("2httpCopyCredentials: Adding %d byte certificate blob.", (int)CFDataGetLength(data)));
 476
 477           httpAddCredential(*credentials, CFDataGetBytePtr(data), (size_t)CFDataGetLength(data));
 478           CFRelease(data);
 479         }
 480       }
 481     }
 482
 483     CFRelease(peerTrust);
 484   }
 485
 486   return (error);
 487 }
 488
 489
 490 /*
 491  * '_httpCreateCredentials()' - Create credentials in the internal format.
 492  */
 493
 494 http_tls_credentials_t                  /* O - Internal credentials */
 495 _httpCreateCredentials(
 496     cups_array_t *credentials)          /* I - Array of credentials */
 497 {
 498   CFMutableArrayRef     peerCerts;      /* Peer credentials reference */
 499   SecCertificateRef     secCert;        /* Certificate reference */
 500   http_credential_t     *credential;    /* Credential data */
 501
 502
 503   if (!credentials)
 504     return (NULL);
 505
 506   if ((peerCerts = CFArrayCreateMutable(kCFAllocatorDefault,
 507                                         cupsArrayCount(credentials),
 508                                         &kCFTypeArrayCallBacks)) == NULL)
 509     return (NULL);
 510
 511   for (credential = (http_credential_t *)cupsArrayFirst(credentials);
 512        credential;
 513        credential = (http_credential_t *)cupsArrayNext(credentials))
 514   {
 515     if ((secCert = http_cdsa_create_credential(credential)) != NULL)
 516     {
 517       CFArrayAppendValue(peerCerts, secCert);
 518       CFRelease(secCert);
 519     }
 520   }
 521
 522   return (peerCerts);
 523 }
 524
 525
 526 /*
 527  * 'httpCredentialsAreValidForName()' - Return whether the credentials are valid for the given name.
 528  *
 529  * @since CUPS 2.0/macOS 10.10@
 530  */
 531
 532 int                                     /* O - 1 if valid, 0 otherwise */
 533 httpCredentialsAreValidForName(
 534     cups_array_t *credentials,          /* I - Credentials */
 535     const char   *common_name)          /* I - Name to check */
 536 {
 537   SecCertificateRef     secCert;        /* Certificate reference */
 538   CFStringRef           cfcert_name = NULL;
 539                                         /* Certificate's common name (CF string) */
 540   char                  cert_name[256]; /* Certificate's common name (C string) */
 541   int                   valid = 1;      /* Valid name? */
 542
 543
 544   if ((secCert = http_cdsa_create_credential((http_credential_t *)cupsArrayFirst(credentials))) == NULL)
 545     return (0);
 546
 547  /*
 548   * Compare the common names...
 549   */
 550
 551   if ((cfcert_name = SecCertificateCopySubjectSummary(secCert)) == NULL)
 552   {
 553    /*
 554     * Can't get common name, cannot be valid...
 555     */
 556
 557     valid = 0;
 558   }
 559   else if (CFStringGetCString(cfcert_name, cert_name, sizeof(cert_name), kCFStringEncodingUTF8) &&
 560            _cups_strcasecmp(common_name, cert_name))
 561   {
 562    /*
 563     * Not an exact match for the common name, check for wildcard certs...
 564     */
 565
 566     const char  *domain = strchr(common_name, '.');
 567                                         /* Domain in common name */
 568
 569     if (strncmp(cert_name, "*.", 2) || !domain || _cups_strcasecmp(domain, cert_name + 1))
 570     {
 571      /*
 572       * Not a wildcard match.
 573       */
 574
 575       /* TODO: Check subject alternate names */
 576       valid = 0;
 577     }
 578   }
 579
 580   if (cfcert_name)
 581     CFRelease(cfcert_name);
 582
 583   CFRelease(secCert);
 584
 585   return (valid);
 586 }
 587
 588
 589 /*
 590  * 'httpCredentialsGetTrust()' - Return the trust of credentials.
 591  *
 592  * @since CUPS 2.0/macOS 10.10@
 593  */
 594
 595 http_trust_t                            /* O - Level of trust */
 596 httpCredentialsGetTrust(
 597     cups_array_t *credentials,          /* I - Credentials */
 598     const char   *common_name)          /* I - Common name for trust lookup */
 599 {
 600   SecCertificateRef     secCert;        /* Certificate reference */
 601   http_trust_t          trust = HTTP_TRUST_OK;
 602                                         /* Trusted? */
 603   cups_array_t          *tcreds = NULL; /* Trusted credentials */
 604   _cups_globals_t       *cg = _cupsGlobals();
 605                                         /* Per-thread globals */
 606
 607
 608   if (!common_name)
 609   {
 610     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("No common name specified."), 1);
 611     return (HTTP_TRUST_UNKNOWN);
 612   }
 613
 614   if ((secCert = http_cdsa_create_credential((http_credential_t *)cupsArrayFirst(credentials))) == NULL)
 615   {
 616     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create credentials from array."), 1);
 617     return (HTTP_TRUST_UNKNOWN);
 618   }
 619
 620   if (cg->any_root < 0)
 621     _cupsSetDefaults();
 622
 623  /*
 624   * Look this common name up in the default keychains...
 625   */
 626
 627   httpLoadCredentials(NULL, &tcreds, common_name);
 628
 629   if (tcreds)
 630   {
 631     char        credentials_str[1024],  /* String for incoming credentials */
 632                 tcreds_str[1024];       /* String for saved credentials */
 633
 634     httpCredentialsString(credentials, credentials_str, sizeof(credentials_str));
 635     httpCredentialsString(tcreds, tcreds_str, sizeof(tcreds_str));
 636
 637     if (strcmp(credentials_str, tcreds_str))
 638     {
 639      /*
 640       * Credentials don't match, let's look at the expiration date of the new
 641       * credentials and allow if the new ones have a later expiration...
 642       */
 643
 644       if (!cg->trust_first)
 645       {
 646        /*
 647         * Do not trust certificates on first use...
 648         */
 649
 650         _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Trust on first use is disabled."), 1);
 651
 652         trust = HTTP_TRUST_INVALID;
 653       }
 654       else if (httpCredentialsGetExpiration(credentials) <= httpCredentialsGetExpiration(tcreds))
 655       {
 656        /*
 657         * The new credentials are not newly issued...
 658         */
 659
 660         _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("New credentials are older than stored credentials."), 1);
 661
 662         trust = HTTP_TRUST_INVALID;
 663       }
 664       else if (!httpCredentialsAreValidForName(credentials, common_name))
 665       {
 666        /*
 667         * The common name does not match the issued certificate...
 668         */
 669
 670         _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("New credentials are not valid for name."), 1);
 671
 672         trust = HTTP_TRUST_INVALID;
 673       }
 674       else if (httpCredentialsGetExpiration(tcreds) < time(NULL))
 675       {
 676        /*
 677         * Save the renewed credentials...
 678         */
 679
 680         trust = HTTP_TRUST_RENEWED;
 681
 682         httpSaveCredentials(NULL, credentials, common_name);
 683       }
 684     }
 685
 686     httpFreeCredentials(tcreds);
 687   }
 688   else if (cg->validate_certs && !httpCredentialsAreValidForName(credentials, common_name))
 689   {
 690     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("No stored credentials, not valid for name."), 1);
 691     trust = HTTP_TRUST_INVALID;
 692   }
 693   else if (!cg->trust_first)
 694   {
 695    /*
 696     * See if we have a site CA certificate we can compare...
 697     */
 698
 699     if (!httpLoadCredentials(NULL, &tcreds, "site"))
 700     {
 701       if (cupsArrayCount(credentials) != (cupsArrayCount(tcreds) + 1))
 702       {
 703        /*
 704         * Certificate isn't directly generated from the CA cert...
 705         */
 706
 707         trust = HTTP_TRUST_INVALID;
 708       }
 709       else
 710       {
 711        /*
 712         * Do a tail comparison of the two certificates...
 713         */
 714
 715         http_credential_t       *a, *b;         /* Certificates */
 716
 717         for (a = (http_credential_t *)cupsArrayFirst(tcreds), b = (http_credential_t *)cupsArrayIndex(credentials, 1);
 718              a && b;
 719              a = (http_credential_t *)cupsArrayNext(tcreds), b = (http_credential_t *)cupsArrayNext(credentials))
 720           if (a->datalen != b->datalen || memcmp(a->data, b->data, a->datalen))
 721             break;
 722
 723         if (a || b)
 724           trust = HTTP_TRUST_INVALID;
 725       }
 726
 727       if (trust != HTTP_TRUST_OK)
 728         _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Credentials do not validate against site CA certificate."), 1);
 729     }
 730     else
 731     {
 732       _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Trust on first use is disabled."), 1);
 733       trust = HTTP_TRUST_INVALID;
 734     }
 735   }
 736
 737   if (trust == HTTP_TRUST_OK && !cg->expired_certs && !SecCertificateIsValid(secCert, CFAbsoluteTimeGetCurrent()))
 738   {
 739     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Credentials have expired."), 1);
 740     trust = HTTP_TRUST_EXPIRED;
 741   }
 742
 743   if (trust == HTTP_TRUST_OK && !cg->any_root && cupsArrayCount(credentials) == 1)
 744   {
 745     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Self-signed credentials are blocked."), 1);
 746     trust = HTTP_TRUST_INVALID;
 747   }
 748
 749   CFRelease(secCert);
 750
 751   return (trust);
 752 }
 753
 754
 755 /*
 756  * 'httpCredentialsGetExpiration()' - Return the expiration date of the credentials.
 757  *
 758  * @since CUPS 2.0/macOS 10.10@
 759  */
 760
 761 time_t                                  /* O - Expiration date of credentials */
 762 httpCredentialsGetExpiration(
 763     cups_array_t *credentials)          /* I - Credentials */
 764 {
 765   SecCertificateRef     secCert;        /* Certificate reference */
 766   time_t                expiration;     /* Expiration date */
 767
 768
 769   if ((secCert = http_cdsa_create_credential((http_credential_t *)cupsArrayFirst(credentials))) == NULL)
 770     return (0);
 771
 772   expiration = (time_t)(SecCertificateNotValidAfter(secCert) + kCFAbsoluteTimeIntervalSince1970);
 773
 774   CFRelease(secCert);
 775
 776   return (expiration);
 777 }
 778
 779
 780 /*
 781  * 'httpCredentialsString()' - Return a string representing the credentials.
 782  *
 783  * @since CUPS 2.0/macOS 10.10@
 784  */
 785
 786 size_t                                  /* O - Total size of credentials string */
 787 httpCredentialsString(
 788     cups_array_t *credentials,          /* I - Credentials */
 789     char         *buffer,               /* I - Buffer or @code NULL@ */
 790     size_t       bufsize)               /* I - Size of buffer */
 791 {
 792   http_credential_t     *first;         /* First certificate */
 793   SecCertificateRef     secCert;        /* Certificate reference */
 794
 795
 796   DEBUG_printf(("httpCredentialsString(credentials=%p, buffer=%p, bufsize=" CUPS_LLFMT ")", (void *)credentials, (void *)buffer, CUPS_LLCAST bufsize));
 797
 798   if (!buffer)
 799     return (0);
 800
 801   if (buffer && bufsize > 0)
 802     *buffer = '\0';
 803
 804   if ((first = (http_credential_t *)cupsArrayFirst(credentials)) != NULL &&
 805       (secCert = http_cdsa_create_credential(first)) != NULL)
 806   {
 807     CFStringRef         cf_name;        /* CF common name string */
 808     char                name[256];      /* Common name associated with cert */
 809     time_t              expiration;     /* Expiration date of cert */
 810     _cups_md5_state_t   md5_state;      /* MD5 state */
 811     unsigned char       md5_digest[16]; /* MD5 result */
 812
 813     if ((cf_name = SecCertificateCopySubjectSummary(secCert)) != NULL)
 814     {
 815       CFStringGetCString(cf_name, name, (CFIndex)sizeof(name), kCFStringEncodingUTF8);
 816       CFRelease(cf_name);
 817     }
 818     else
 819       strlcpy(name, "unknown", sizeof(name));
 820
 821     expiration = (time_t)(SecCertificateNotValidAfter(secCert) + kCFAbsoluteTimeIntervalSince1970);
 822
 823     _cupsMD5Init(&md5_state);
 824     _cupsMD5Append(&md5_state, first->data, (int)first->datalen);
 825     _cupsMD5Finish(&md5_state, md5_digest);
 826
 827     snprintf(buffer, bufsize, "%s / %s / %02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X", name, httpGetDateString(expiration), md5_digest[0], md5_digest[1], md5_digest[2], md5_digest[3], md5_digest[4], md5_digest[5], md5_digest[6], md5_digest[7], md5_digest[8], md5_digest[9], md5_digest[10], md5_digest[11], md5_digest[12], md5_digest[13], md5_digest[14], md5_digest[15]);
 828
 829     CFRelease(secCert);
 830   }
 831
 832   DEBUG_printf(("1httpCredentialsString: Returning \"%s\".", buffer));
 833
 834   return (strlen(buffer));
 835 }
 836
 837
 838 /*
 839  * '_httpFreeCredentials()' - Free internal credentials.
 840  */
 841
 842 void
 843 _httpFreeCredentials(
 844     http_tls_credentials_t credentials) /* I - Internal credentials */
 845 {
 846   if (!credentials)
 847     return;
 848
 849   CFRelease(credentials);
 850 }
 851
 852
 853 /*
 854  * 'httpLoadCredentials()' - Load X.509 credentials from a keychain file.
 855  *
 856  * @since CUPS 2.0/OS 10.10@
 857  */
 858
 859 int                                     /* O - 0 on success, -1 on error */
 860 httpLoadCredentials(
 861     const char   *path,                 /* I  - Keychain path or @code NULL@ for default */
 862     cups_array_t **credentials,         /* IO - Credentials */
 863     const char   *common_name)          /* I  - Common name for credentials */
 864 {
 865   OSStatus              err;            /* Error info */
 866 #ifdef HAVE_SECKEYCHAINOPEN
 867   char                  filename[1024]; /* Filename for keychain */
 868   SecKeychainRef        keychain = NULL,/* Keychain reference */
 869                         syschain = NULL;/* System keychain */
 870   CFArrayRef            list;           /* Keychain list */
 871 #endif /* HAVE_SECKEYCHAINOPEN */
 872   SecCertificateRef     cert = NULL;    /* Certificate */
 873   CFDataRef             data;           /* Certificate data */
 874   SecPolicyRef          policy = NULL;  /* Policy ref */
 875   CFStringRef           cfcommon_name = NULL;
 876                                         /* Server name */
 877   CFMutableDictionaryRef query = NULL;  /* Query qualifiers */
 878
 879
 880   DEBUG_printf(("httpLoadCredentials(path=\"%s\", credentials=%p, common_name=\"%s\")", path, (void *)credentials, common_name));
 881
 882   if (!credentials)
 883     return (-1);
 884
 885   *credentials = NULL;
 886
 887 #ifdef HAVE_SECKEYCHAINOPEN
 888   keychain = http_cdsa_open_keychain(path, filename, sizeof(filename));
 889
 890   if (!keychain)
 891     goto cleanup;
 892
 893   syschain = http_cdsa_open_system_keychain();
 894
 895 #else
 896   if (path)
 897     return (-1);
 898 #endif /* HAVE_SECKEYCHAINOPEN */
 899
 900   cfcommon_name = CFStringCreateWithCString(kCFAllocatorDefault, common_name, kCFStringEncodingUTF8);
 901
 902   policy = SecPolicyCreateSSL(1, cfcommon_name);
 903
 904   if (cfcommon_name)
 905     CFRelease(cfcommon_name);
 906
 907   if (!policy)
 908     goto cleanup;
 909
 910   if (!(query = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks)))
 911     goto cleanup;
 912
 913   CFDictionaryAddValue(query, kSecClass, kSecClassCertificate);
 914   CFDictionaryAddValue(query, kSecMatchPolicy, policy);
 915   CFDictionaryAddValue(query, kSecReturnRef, kCFBooleanTrue);
 916   CFDictionaryAddValue(query, kSecMatchLimit, kSecMatchLimitOne);
 917
 918 #ifdef HAVE_SECKEYCHAINOPEN
 919   if (syschain)
 920   {
 921     const void *values[2] = { syschain, keychain };
 922
 923     list = CFArrayCreate(kCFAllocatorDefault, (const void **)values, 2, &kCFTypeArrayCallBacks);
 924   }
 925   else
 926     list = CFArrayCreate(kCFAllocatorDefault, (const void **)&keychain, 1, &kCFTypeArrayCallBacks);
 927   CFDictionaryAddValue(query, kSecMatchSearchList, list);
 928   CFRelease(list);
 929 #endif /* HAVE_SECKEYCHAINOPEN */
 930
 931   err = SecItemCopyMatching(query, (CFTypeRef *)&cert);
 932
 933   if (err)
 934     goto cleanup;
 935
 936   if (CFGetTypeID(cert) != SecCertificateGetTypeID())
 937     goto cleanup;
 938
 939   if ((data = SecCertificateCopyData(cert)) != NULL)
 940   {
 941     DEBUG_printf(("1httpLoadCredentials: Adding %d byte certificate blob.", (int)CFDataGetLength(data)));
 942
 943     *credentials = cupsArrayNew(NULL, NULL);
 944     httpAddCredential(*credentials, CFDataGetBytePtr(data), (size_t)CFDataGetLength(data));
 945     CFRelease(data);
 946   }
 947
 948   cleanup :
 949
 950 #ifdef HAVE_SECKEYCHAINOPEN
 951   if (keychain)
 952     CFRelease(keychain);
 953
 954   if (syschain)
 955     CFRelease(syschain);
 956 #endif /* HAVE_SECKEYCHAINOPEN */
 957   if (cert)
 958     CFRelease(cert);
 959   if (policy)
 960     CFRelease(policy);
 961   if (query)
 962     CFRelease(query);
 963
 964   DEBUG_printf(("1httpLoadCredentials: Returning %d.", *credentials ? 0 : -1));
 965
 966   return (*credentials ? 0 : -1);
 967 }
 968
 969
 970 /*
 971  * 'httpSaveCredentials()' - Save X.509 credentials to a keychain file.
 972  *
 973  * @since CUPS 2.0/OS 10.10@
 974  */
 975
 976 int                                     /* O - -1 on error, 0 on success */
 977 httpSaveCredentials(
 978     const char   *path,                 /* I - Keychain path or @code NULL@ for default */
 979     cups_array_t *credentials,          /* I - Credentials */
 980     const char   *common_name)          /* I - Common name for credentials */
 981 {
 982   int                   ret = -1;       /* Return value */
 983   OSStatus              err;            /* Error info */
 984 #ifdef HAVE_SECKEYCHAINOPEN
 985   char                  filename[1024]; /* Filename for keychain */
 986   SecKeychainRef        keychain = NULL;/* Keychain reference */
 987   CFArrayRef            list;           /* Keychain list */
 988 #endif /* HAVE_SECKEYCHAINOPEN */
 989   SecCertificateRef     cert = NULL;    /* Certificate */
 990   CFMutableDictionaryRef attrs = NULL;  /* Attributes for add */
 991
 992
 993   DEBUG_printf(("httpSaveCredentials(path=\"%s\", credentials=%p, common_name=\"%s\")", path, (void *)credentials, common_name));
 994   if (!credentials)
 995     goto cleanup;
 996
 997   if (!httpCredentialsAreValidForName(credentials, common_name))
 998   {
 999     DEBUG_puts("1httpSaveCredentials: Common name does not match.");
1000     return (-1);
1001   }
1002
1003   if ((cert = http_cdsa_create_credential((http_credential_t *)cupsArrayFirst(credentials))) == NULL)
1004   {
1005     DEBUG_puts("1httpSaveCredentials: Unable to create certificate.");
1006     goto cleanup;
1007   }
1008
1009 #ifdef HAVE_SECKEYCHAINOPEN
1010   keychain = http_cdsa_open_keychain(path, filename, sizeof(filename));
1011
1012   if (!keychain)
1013     goto cleanup;
1014
1015 #else
1016   if (path)
1017     return (-1);
1018 #endif /* HAVE_SECKEYCHAINOPEN */
1019
1020   if ((attrs = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks)) == NULL)
1021   {
1022     DEBUG_puts("1httpSaveCredentials: Unable to create dictionary.");
1023     goto cleanup;
1024   }
1025
1026   CFDictionaryAddValue(attrs, kSecClass, kSecClassCertificate);
1027   CFDictionaryAddValue(attrs, kSecValueRef, cert);
1028
1029 #ifdef HAVE_SECKEYCHAINOPEN
1030   if ((list = CFArrayCreate(kCFAllocatorDefault, (const void **)&keychain, 1, &kCFTypeArrayCallBacks)) == NULL)
1031   {
1032     DEBUG_puts("1httpSaveCredentials: Unable to create list of keychains.");
1033     goto cleanup;
1034   }
1035   CFDictionaryAddValue(attrs, kSecMatchSearchList, list);
1036   CFRelease(list);
1037 #endif /* HAVE_SECKEYCHAINOPEN */
1038
1039   /* Note: SecItemAdd consumes "attrs"... */
1040   err = SecItemAdd(attrs, NULL);
1041   DEBUG_printf(("1httpSaveCredentials: SecItemAdd returned %d.", (int)err));
1042
1043   cleanup :
1044
1045 #ifdef HAVE_SECKEYCHAINOPEN
1046   if (keychain)
1047     CFRelease(keychain);
1048 #endif /* HAVE_SECKEYCHAINOPEN */
1049   if (cert)
1050     CFRelease(cert);
1051
1052   DEBUG_printf(("1httpSaveCredentials: Returning %d.", ret));
1053
1054   return (ret);
1055 }
1056
1057
1058 /*
1059  * '_httpTLSInitialize()' - Initialize the TLS stack.
1060  */
1061
1062 void
1063 _httpTLSInitialize(void)
1064 {
1065  /*
1066   * Nothing to do...
1067   */
1068 }
1069
1070
1071 /*
1072  * '_httpTLSPending()' - Return the number of pending TLS-encrypted bytes.
1073  */
1074
1075 size_t
1076 _httpTLSPending(http_t *http)           /* I - HTTP connection */
1077 {
1078   size_t bytes;                         /* Bytes that are available */
1079
1080
1081   if (!SSLGetBufferedReadSize(http->tls, &bytes))
1082     return (bytes);
1083
1084   return (0);
1085 }
1086
1087
1088 /*
1089  * '_httpTLSRead()' - Read from a SSL/TLS connection.
1090  */
1091
1092 int                                     /* O - Bytes read */
1093 _httpTLSRead(http_t *http,              /* I - HTTP connection */
1094               char   *buf,              /* I - Buffer to store data */
1095               int    len)               /* I - Length of buffer */
1096 {
1097   int           result;                 /* Return value */
1098   OSStatus      error;                  /* Error info */
1099   size_t        processed;              /* Number of bytes processed */
1100
1101
1102   error = SSLRead(http->tls, buf, (size_t)len, &processed);
1103   DEBUG_printf(("6_httpTLSRead: error=%d, processed=%d", (int)error,
1104                 (int)processed));
1105   switch (error)
1106   {
1107     case 0 :
1108         result = (int)processed;
1109         break;
1110
1111     case errSSLWouldBlock :
1112         if (processed)
1113           result = (int)processed;
1114         else
1115         {
1116           result = -1;
1117           errno  = EINTR;
1118         }
1119         break;
1120
1121     case errSSLClosedGraceful :
1122     default :
1123         if (processed)
1124           result = (int)processed;
1125         else
1126         {
1127           result = -1;
1128           errno  = EPIPE;
1129         }
1130         break;
1131   }
1132
1133   return (result);
1134 }
1135
1136
1137 /*
1138  * '_httpTLSSetOptions()' - Set TLS protocol and cipher suite options.
1139  */
1140
1141 void
1142 _httpTLSSetOptions(int options)         /* I - Options */
1143 {
1144   if (!(options & _HTTP_TLS_SET_DEFAULT) || tls_options < 0)
1145     tls_options = options;
1146 }
1147
1148
1149 /*
1150  * '_httpTLSStart()' - Set up SSL/TLS support on a connection.
1151  */
1152
1153 int                                     /* O - 0 on success, -1 on failure */
1154 _httpTLSStart(http_t *http)             /* I - HTTP connection */
1155 {
1156   char                  hostname[256],  /* Hostname */
1157                         *hostptr;       /* Pointer into hostname */
1158   _cups_globals_t       *cg = _cupsGlobals();
1159                                         /* Pointer to library globals */
1160   OSStatus              error;          /* Error code */
1161   const char            *message = NULL;/* Error message */
1162   cups_array_t          *credentials;   /* Credentials array */
1163   cups_array_t          *names;         /* CUPS distinguished names */
1164   CFArrayRef            dn_array;       /* CF distinguished names array */
1165   CFIndex               count;          /* Number of credentials */
1166   CFDataRef             data;           /* Certificate data */
1167   int                   i;              /* Looping var */
1168   http_credential_t     *credential;    /* Credential data */
1169
1170
1171   DEBUG_printf(("3_httpTLSStart(http=%p)", (void *)http));
1172
1173   if (tls_options < 0)
1174   {
1175     DEBUG_puts("4_httpTLSStart: Setting defaults.");
1176     _cupsSetDefaults();
1177     DEBUG_printf(("4_httpTLSStart: tls_options=%x", tls_options));
1178   }
1179
1180 #ifdef HAVE_SECKEYCHAINOPEN
1181   if (http->mode == _HTTP_MODE_SERVER && !tls_keychain)
1182   {
1183     DEBUG_puts("4_httpTLSStart: cupsSetServerCredentials not called.");
1184     http->error  = errno = EINVAL;
1185     http->status = HTTP_STATUS_ERROR;
1186     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Server credentials not set."), 1);
1187
1188     return (-1);
1189   }
1190 #endif /* HAVE_SECKEYCHAINOPEN */
1191
1192   if ((http->tls = SSLCreateContext(kCFAllocatorDefault, http->mode == _HTTP_MODE_CLIENT ? kSSLClientSide : kSSLServerSide, kSSLStreamType)) == NULL)
1193   {
1194     DEBUG_puts("4_httpTLSStart: SSLCreateContext failed.");
1195     http->error  = errno = ENOMEM;
1196     http->status = HTTP_STATUS_ERROR;
1197     _cupsSetHTTPError(HTTP_STATUS_ERROR);
1198
1199     return (-1);
1200   }
1201
1202   error = SSLSetConnection(http->tls, http);
1203   DEBUG_printf(("4_httpTLSStart: SSLSetConnection, error=%d", (int)error));
1204
1205   if (!error)
1206   {
1207     error = SSLSetIOFuncs(http->tls, http_cdsa_read, http_cdsa_write);
1208     DEBUG_printf(("4_httpTLSStart: SSLSetIOFuncs, error=%d", (int)error));
1209   }
1210
1211   if (!error)
1212   {
1213     error = SSLSetSessionOption(http->tls, kSSLSessionOptionBreakOnServerAuth,
1214                                 true);
1215     DEBUG_printf(("4_httpTLSStart: SSLSetSessionOption, error=%d", (int)error));
1216   }
1217
1218   if (!error)
1219   {
1220     SSLProtocol minProtocol;
1221
1222     if (tls_options & _HTTP_TLS_DENY_TLS10)
1223       minProtocol = kTLSProtocol11;
1224     else if (tls_options & _HTTP_TLS_ALLOW_SSL3)
1225       minProtocol = kSSLProtocol3;
1226     else
1227       minProtocol = kTLSProtocol1;
1228
1229     error = SSLSetProtocolVersionMin(http->tls, minProtocol);
1230     DEBUG_printf(("4_httpTLSStart: SSLSetProtocolVersionMin(%d), error=%d", minProtocol, (int)error));
1231
1232     if (!error && (tls_options & _HTTP_TLS_ONLY_TLS10))
1233     {
1234       error = SSLSetProtocolVersionMax(http->tls, kTLSProtocol1);
1235       DEBUG_printf(("4_httpTLSStart: SSLSetProtocolVersionMax(kTLSProtocol1), error=%d", (int)error));
1236     }
1237   }
1238
1239 #  if HAVE_SSLSETENABLEDCIPHERS
1240   if (!error)
1241   {
1242     SSLCipherSuite      supported[100]; /* Supported cipher suites */
1243     size_t              num_supported;  /* Number of supported cipher suites */
1244     SSLCipherSuite      enabled[100];   /* Cipher suites to enable */
1245     size_t              num_enabled;    /* Number of cipher suites to enable */
1246
1247     num_supported = sizeof(supported) / sizeof(supported[0]);
1248     error         = SSLGetSupportedCiphers(http->tls, supported, &num_supported);
1249
1250     if (!error)
1251     {
1252       DEBUG_printf(("4_httpTLSStart: %d cipher suites supported.", (int)num_supported));
1253
1254       for (i = 0, num_enabled = 0; i < (int)num_supported && num_enabled < (sizeof(enabled) / sizeof(enabled[0])); i ++)
1255       {
1256         switch (supported[i])
1257         {
1258           /* Obviously insecure cipher suites that we never want to use */
1259           case SSL_NULL_WITH_NULL_NULL :
1260           case SSL_RSA_WITH_NULL_MD5 :
1261           case SSL_RSA_WITH_NULL_SHA :
1262           case SSL_RSA_EXPORT_WITH_RC4_40_MD5 :
1263           case SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5 :
1264           case SSL_RSA_EXPORT_WITH_DES40_CBC_SHA :
1265           case SSL_RSA_WITH_DES_CBC_SHA :
1266           case SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA :
1267           case SSL_DH_DSS_WITH_DES_CBC_SHA :
1268           case SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA :
1269           case SSL_DH_RSA_WITH_DES_CBC_SHA :
1270           case SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA :
1271           case SSL_DHE_DSS_WITH_DES_CBC_SHA :
1272           case SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA :
1273           case SSL_DHE_RSA_WITH_DES_CBC_SHA :
1274           case SSL_DH_anon_EXPORT_WITH_RC4_40_MD5 :
1275           case SSL_DH_anon_WITH_RC4_128_MD5 :
1276           case SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA :
1277           case SSL_DH_anon_WITH_DES_CBC_SHA :
1278           case SSL_DH_anon_WITH_3DES_EDE_CBC_SHA :
1279           case SSL_FORTEZZA_DMS_WITH_NULL_SHA :
1280           case TLS_DH_anon_WITH_AES_128_CBC_SHA :
1281           case TLS_DH_anon_WITH_AES_256_CBC_SHA :
1282           case TLS_ECDH_ECDSA_WITH_NULL_SHA :
1283           case TLS_ECDHE_RSA_WITH_NULL_SHA :
1284           case TLS_ECDH_anon_WITH_NULL_SHA :
1285           case TLS_ECDH_anon_WITH_RC4_128_SHA :
1286           case TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA :
1287           case TLS_ECDH_anon_WITH_AES_128_CBC_SHA :
1288           case TLS_ECDH_anon_WITH_AES_256_CBC_SHA :
1289           case TLS_RSA_WITH_NULL_SHA256 :
1290           case TLS_DH_anon_WITH_AES_128_CBC_SHA256 :
1291           case TLS_DH_anon_WITH_AES_256_CBC_SHA256 :
1292           case TLS_PSK_WITH_NULL_SHA :
1293           case TLS_DHE_PSK_WITH_NULL_SHA :
1294           case TLS_RSA_PSK_WITH_NULL_SHA :
1295           case TLS_DH_anon_WITH_AES_128_GCM_SHA256 :
1296           case TLS_DH_anon_WITH_AES_256_GCM_SHA384 :
1297           case TLS_PSK_WITH_NULL_SHA256 :
1298           case TLS_PSK_WITH_NULL_SHA384 :
1299           case TLS_DHE_PSK_WITH_NULL_SHA256 :
1300           case TLS_DHE_PSK_WITH_NULL_SHA384 :
1301           case TLS_RSA_PSK_WITH_NULL_SHA256 :
1302           case TLS_RSA_PSK_WITH_NULL_SHA384 :
1303           case SSL_RSA_WITH_DES_CBC_MD5 :
1304               DEBUG_printf(("4_httpTLSStart: Excluding insecure cipher suite %d", supported[i]));
1305               break;
1306
1307           /* RC4 cipher suites that should only be used as a last resort */
1308           case SSL_RSA_WITH_RC4_128_MD5 :
1309           case SSL_RSA_WITH_RC4_128_SHA :
1310           case TLS_ECDH_ECDSA_WITH_RC4_128_SHA :
1311           case TLS_ECDHE_ECDSA_WITH_RC4_128_SHA :
1312           case TLS_ECDH_RSA_WITH_RC4_128_SHA :
1313           case TLS_ECDHE_RSA_WITH_RC4_128_SHA :
1314           case TLS_PSK_WITH_RC4_128_SHA :
1315           case TLS_DHE_PSK_WITH_RC4_128_SHA :
1316           case TLS_RSA_PSK_WITH_RC4_128_SHA :
1317               if (tls_options & _HTTP_TLS_ALLOW_RC4)
1318                 enabled[num_enabled ++] = supported[i];
1319               else
1320                 DEBUG_printf(("4_httpTLSStart: Excluding RC4 cipher suite %d", supported[i]));
1321               break;
1322
1323           /* DH/DHE cipher suites that are problematic with parameters < 1024 bits */
1324           case TLS_DH_DSS_WITH_AES_128_CBC_SHA :
1325           case TLS_DH_RSA_WITH_AES_128_CBC_SHA :
1326           case TLS_DHE_DSS_WITH_AES_128_CBC_SHA :
1327           case TLS_DHE_RSA_WITH_AES_128_CBC_SHA :
1328           case TLS_DH_DSS_WITH_AES_256_CBC_SHA :
1329           case TLS_DH_RSA_WITH_AES_256_CBC_SHA :
1330           case TLS_DHE_DSS_WITH_AES_256_CBC_SHA :
1331           case TLS_DHE_RSA_WITH_AES_256_CBC_SHA :
1332           case TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA :
1333           case TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA :
1334           case TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA :
1335           case TLS_DH_DSS_WITH_AES_128_CBC_SHA256 :
1336           case TLS_DH_RSA_WITH_AES_128_CBC_SHA256 :
1337           case TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 :
1338           case TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 :
1339           case TLS_DH_DSS_WITH_AES_256_CBC_SHA256 :
1340           case TLS_DH_RSA_WITH_AES_256_CBC_SHA256 :
1341           case TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 :
1342           case TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 :
1343           case TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA :
1344           case TLS_DHE_PSK_WITH_AES_128_CBC_SHA :
1345           case TLS_DHE_PSK_WITH_AES_256_CBC_SHA :
1346           case TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 :
1347           case TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 :
1348               if (tls_options & _HTTP_TLS_DENY_CBC)
1349               {
1350                 DEBUG_printf(("4_httpTLSStart: Excluding CBC cipher suite %d", supported[i]));
1351                 break;
1352               }
1353
1354 //          case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 :
1355 //          case TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 :
1356           case TLS_DH_RSA_WITH_AES_128_GCM_SHA256 :
1357           case TLS_DH_RSA_WITH_AES_256_GCM_SHA384 :
1358 //          case TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 :
1359 //          case TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 :
1360           case TLS_DH_DSS_WITH_AES_128_GCM_SHA256 :
1361           case TLS_DH_DSS_WITH_AES_256_GCM_SHA384 :
1362           case TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 :
1363           case TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 :
1364               if (tls_options & _HTTP_TLS_ALLOW_DH)
1365                 enabled[num_enabled ++] = supported[i];
1366               else
1367                 DEBUG_printf(("4_httpTLSStart: Excluding DH/DHE cipher suite %d", supported[i]));
1368               break;
1369
1370           case TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA :
1371           case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 :
1372           case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 :
1373           case TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 :
1374           case TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 :
1375           case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 :
1376           case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 :
1377           case TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 :
1378           case TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 :
1379           case TLS_RSA_WITH_3DES_EDE_CBC_SHA :
1380           case TLS_RSA_WITH_AES_128_CBC_SHA :
1381           case TLS_RSA_WITH_AES_256_CBC_SHA :
1382               if (tls_options & _HTTP_TLS_DENY_CBC)
1383               {
1384                 DEBUG_printf(("4_httpTLSStart: Excluding CBC cipher suite %d", supported[i]));
1385                 break;
1386               }
1387
1388           /* Anything else we'll assume is "secure" */
1389           default :
1390               enabled[num_enabled ++] = supported[i];
1391               break;
1392         }
1393       }
1394
1395       DEBUG_printf(("4_httpTLSStart: %d cipher suites enabled.", (int)num_enabled));
1396       error = SSLSetEnabledCiphers(http->tls, enabled, num_enabled);
1397     }
1398   }
1399 #endif /* HAVE_SSLSETENABLEDCIPHERS */
1400
1401   if (!error && http->mode == _HTTP_MODE_CLIENT)
1402   {
1403    /*
1404     * Client: set client-side credentials, if any...
1405     */
1406
1407     if (cg->client_cert_cb)
1408     {
1409       error = SSLSetSessionOption(http->tls,
1410                                   kSSLSessionOptionBreakOnCertRequested, true);
1411       DEBUG_printf(("4_httpTLSStart: kSSLSessionOptionBreakOnCertRequested, "
1412                     "error=%d", (int)error));
1413     }
1414     else
1415     {
1416       error = http_cdsa_set_credentials(http);
1417       DEBUG_printf(("4_httpTLSStart: http_cdsa_set_credentials, error=%d",
1418                     (int)error));
1419     }
1420   }
1421   else if (!error)
1422   {
1423    /*
1424     * Server: find/create a certificate for TLS...
1425     */
1426
1427     if (http->fields[HTTP_FIELD_HOST][0])
1428     {
1429      /*
1430       * Use hostname for TLS upgrade...
1431       */
1432
1433       strlcpy(hostname, http->fields[HTTP_FIELD_HOST], sizeof(hostname));
1434     }
1435     else
1436     {
1437      /*
1438       * Resolve hostname from connection address...
1439       */
1440
1441       http_addr_t       addr;           /* Connection address */
1442       socklen_t         addrlen;        /* Length of address */
1443
1444       addrlen = sizeof(addr);
1445       if (getsockname(http->fd, (struct sockaddr *)&addr, &addrlen))
1446       {
1447         DEBUG_printf(("4_httpTLSStart: Unable to get socket address: %s", strerror(errno)));
1448         hostname[0] = '\0';
1449       }
1450       else if (httpAddrLocalhost(&addr))
1451         hostname[0] = '\0';
1452       else
1453       {
1454         httpAddrLookup(&addr, hostname, sizeof(hostname));
1455         DEBUG_printf(("4_httpTLSStart: Resolved socket address to \"%s\".", hostname));
1456       }
1457     }
1458
1459     if (isdigit(hostname[0] & 255) || hostname[0] == '[')
1460       hostname[0] = '\0';               /* Don't allow numeric addresses */
1461
1462     if (hostname[0])
1463       http->tls_credentials = http_cdsa_copy_server(hostname);
1464     else if (tls_common_name)
1465       http->tls_credentials = http_cdsa_copy_server(tls_common_name);
1466
1467     if (!http->tls_credentials && tls_auto_create && (hostname[0] || tls_common_name))
1468     {
1469       DEBUG_printf(("4_httpTLSStart: Auto-create credentials for \"%s\".", hostname[0] ? hostname : tls_common_name));
1470
1471       if (!cupsMakeServerCredentials(tls_keypath, hostname[0] ? hostname : tls_common_name, 0, NULL, time(NULL) + 365 * 86400))
1472       {
1473         DEBUG_puts("4_httpTLSStart: cupsMakeServerCredentials failed.");
1474         http->error  = errno = EINVAL;
1475         http->status = HTTP_STATUS_ERROR;
1476         _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create server credentials."), 1);
1477
1478         return (-1);
1479       }
1480
1481       http->tls_credentials = http_cdsa_copy_server(hostname[0] ? hostname : tls_common_name);
1482     }
1483
1484     if (!http->tls_credentials)
1485     {
1486       DEBUG_puts("4_httpTLSStart: Unable to find server credentials.");
1487       http->error  = errno = EINVAL;
1488       http->status = HTTP_STATUS_ERROR;
1489       _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to find server credentials."), 1);
1490
1491       return (-1);
1492     }
1493
1494     error = SSLSetCertificate(http->tls, http->tls_credentials);
1495
1496     DEBUG_printf(("4_httpTLSStart: SSLSetCertificate, error=%d", (int)error));
1497   }
1498
1499   DEBUG_printf(("4_httpTLSStart: tls_credentials=%p", (void *)http->tls_credentials));
1500
1501  /*
1502   * Let the server know which hostname/domain we are trying to connect to
1503   * in case it wants to serve up a certificate with a matching common name.
1504   */
1505
1506   if (!error && http->mode == _HTTP_MODE_CLIENT)
1507   {
1508    /*
1509     * Client: get the hostname to use for TLS...
1510     */
1511
1512     if (httpAddrLocalhost(http->hostaddr))
1513     {
1514       strlcpy(hostname, "localhost", sizeof(hostname));
1515     }
1516     else
1517     {
1518      /*
1519       * Otherwise make sure the hostname we have does not end in a trailing dot.
1520       */
1521
1522       strlcpy(hostname, http->hostname, sizeof(hostname));
1523       if ((hostptr = hostname + strlen(hostname) - 1) >= hostname &&
1524           *hostptr == '.')
1525         *hostptr = '\0';
1526     }
1527
1528     error = SSLSetPeerDomainName(http->tls, hostname, strlen(hostname));
1529
1530     DEBUG_printf(("4_httpTLSStart: SSLSetPeerDomainName, error=%d", (int)error));
1531   }
1532
1533   if (!error)
1534   {
1535     int done = 0;                       /* Are we done yet? */
1536
1537     while (!error && !done)
1538     {
1539       error = SSLHandshake(http->tls);
1540
1541       DEBUG_printf(("4_httpTLSStart: SSLHandshake returned %d.", (int)error));
1542
1543       switch (error)
1544       {
1545         case noErr :
1546             done = 1;
1547             break;
1548
1549         case errSSLWouldBlock :
1550             error = noErr;              /* Force a retry */
1551             usleep(1000);               /* in 1 millisecond */
1552             break;
1553
1554         case errSSLServerAuthCompleted :
1555             error = 0;
1556             if (cg->server_cert_cb)
1557             {
1558               error = httpCopyCredentials(http, &credentials);
1559               if (!error)
1560               {
1561                 error = (cg->server_cert_cb)(http, http->tls, credentials,
1562                                              cg->server_cert_data);
1563                 httpFreeCredentials(credentials);
1564               }
1565
1566               DEBUG_printf(("4_httpTLSStart: Server certificate callback "
1567                             "returned %d.", (int)error));
1568             }
1569             break;
1570
1571         case errSSLClientCertRequested :
1572             error = 0;
1573
1574             if (cg->client_cert_cb)
1575             {
1576               names = NULL;
1577               if (!(error = SSLCopyDistinguishedNames(http->tls, &dn_array)) &&
1578                   dn_array)
1579               {
1580                 if ((names = cupsArrayNew(NULL, NULL)) != NULL)
1581                 {
1582                   for (i = 0, count = CFArrayGetCount(dn_array); i < count; i++)
1583                   {
1584                     data = (CFDataRef)CFArrayGetValueAtIndex(dn_array, i);
1585
1586                     if ((credential = malloc(sizeof(*credential))) != NULL)
1587                     {
1588                       credential->datalen = (size_t)CFDataGetLength(data);
1589                       if ((credential->data = malloc(credential->datalen)))
1590                       {
1591                         memcpy((void *)credential->data, CFDataGetBytePtr(data),
1592                                credential->datalen);
1593                         cupsArrayAdd(names, credential);
1594                       }
1595                       else
1596                         free(credential);
1597                     }
1598                   }
1599                 }
1600
1601                 CFRelease(dn_array);
1602               }
1603
1604               if (!error)
1605               {
1606                 error = (cg->client_cert_cb)(http, http->tls, names,
1607                                              cg->client_cert_data);
1608
1609                 DEBUG_printf(("4_httpTLSStart: Client certificate callback "
1610                               "returned %d.", (int)error));
1611               }
1612
1613               httpFreeCredentials(names);
1614             }
1615             break;
1616
1617         case errSSLUnknownRootCert :
1618             message = _("Unable to establish a secure connection to host "
1619                         "(untrusted certificate).");
1620             break;
1621
1622         case errSSLNoRootCert :
1623             message = _("Unable to establish a secure connection to host "
1624                         "(self-signed certificate).");
1625             break;
1626
1627         case errSSLCertExpired :
1628             message = _("Unable to establish a secure connection to host "
1629                         "(expired certificate).");
1630             break;
1631
1632         case errSSLCertNotYetValid :
1633             message = _("Unable to establish a secure connection to host "
1634                         "(certificate not yet valid).");
1635             break;
1636
1637         case errSSLHostNameMismatch :
1638             message = _("Unable to establish a secure connection to host "
1639                         "(host name mismatch).");
1640             break;
1641
1642         case errSSLXCertChainInvalid :
1643             message = _("Unable to establish a secure connection to host "
1644                         "(certificate chain invalid).");
1645             break;
1646
1647         case errSSLConnectionRefused :
1648             message = _("Unable to establish a secure connection to host "
1649                         "(peer dropped connection before responding).");
1650             break;
1651
1652         default :
1653             break;
1654       }
1655     }
1656   }
1657
1658   if (error)
1659   {
1660     http->error  = error;
1661     http->status = HTTP_STATUS_ERROR;
1662     errno        = ECONNREFUSED;
1663
1664     CFRelease(http->tls);
1665     http->tls = NULL;
1666
1667    /*
1668     * If an error string wasn't set by the callbacks use a generic one...
1669     */
1670
1671     if (!message)
1672 #ifdef HAVE_CSSMERRORSTRING
1673       message = cssmErrorString(error);
1674 #else
1675       message = _("Unable to establish a secure connection to host.");
1676 #endif /* HAVE_CSSMERRORSTRING */
1677
1678     _cupsSetError(IPP_STATUS_ERROR_CUPS_PKI, message, 1);
1679
1680     return (-1);
1681   }
1682
1683   return (0);
1684 }
1685
1686
1687 /*
1688  * '_httpTLSStop()' - Shut down SSL/TLS on a connection.
1689  */
1690
1691 void
1692 _httpTLSStop(http_t *http)              /* I - HTTP connection */
1693 {
1694   while (SSLClose(http->tls) == errSSLWouldBlock)
1695     usleep(1000);
1696
1697   CFRelease(http->tls);
1698
1699   if (http->tls_credentials)
1700     CFRelease(http->tls_credentials);
1701
1702   http->tls             = NULL;
1703   http->tls_credentials = NULL;
1704 }
1705
1706
1707 /*
1708  * '_httpTLSWrite()' - Write to a SSL/TLS connection.
1709  */
1710
1711 int                                     /* O - Bytes written */
1712 _httpTLSWrite(http_t     *http,         /* I - HTTP connection */
1713                const char *buf,         /* I - Buffer holding data */
1714                int        len)          /* I - Length of buffer */
1715 {
1716   ssize_t       result;                 /* Return value */
1717   OSStatus      error;                  /* Error info */
1718   size_t        processed;              /* Number of bytes processed */
1719
1720
1721   DEBUG_printf(("2_httpTLSWrite(http=%p, buf=%p, len=%d)", (void *)http, (void *)buf, len));
1722
1723   error = SSLWrite(http->tls, buf, (size_t)len, &processed);
1724
1725   switch (error)
1726   {
1727     case 0 :
1728         result = (int)processed;
1729         break;
1730
1731     case errSSLWouldBlock :
1732         if (processed)
1733         {
1734           result = (int)processed;
1735         }
1736         else
1737         {
1738           result = -1;
1739           errno  = EINTR;
1740         }
1741         break;
1742
1743     case errSSLClosedGraceful :
1744     default :
1745         if (processed)
1746         {
1747           result = (int)processed;
1748         }
1749         else
1750         {
1751           result = -1;
1752           errno  = EPIPE;
1753         }
1754         break;
1755   }
1756
1757   DEBUG_printf(("3_httpTLSWrite: Returning %d.", (int)result));
1758
1759   return ((int)result);
1760 }
1761
1762
1763 /*
1764  * 'http_cdsa_copy_server()' - Find and copy server credentials from the keychain.
1765  */
1766
1767 static CFArrayRef                       /* O - Array of certificates or NULL */
1768 http_cdsa_copy_server(
1769     const char *common_name)            /* I - Server's hostname */
1770 {
1771 #ifdef HAVE_SECKEYCHAINOPEN
1772   OSStatus              err;            /* Error info */
1773   SecIdentityRef        identity = NULL;/* Identity */
1774   CFArrayRef            certificates = NULL;
1775                                         /* Certificate array */
1776   SecPolicyRef          policy = NULL;  /* Policy ref */
1777   CFStringRef           cfcommon_name = NULL;
1778                                         /* Server name */
1779   CFMutableDictionaryRef query = NULL;  /* Query qualifiers */
1780   CFArrayRef            list = NULL;    /* Keychain list */
1781   SecKeychainRef        syschain = NULL;/* System keychain */
1782   SecKeychainStatus     status = 0;     /* Keychain status */
1783
1784
1785   DEBUG_printf(("3http_cdsa_copy_server(common_name=\"%s\")", common_name));
1786
1787   cfcommon_name = CFStringCreateWithCString(kCFAllocatorDefault, common_name, kCFStringEncodingUTF8);
1788
1789   policy = SecPolicyCreateSSL(1, cfcommon_name);
1790
1791   if (!policy)
1792   {
1793     DEBUG_puts("4http_cdsa_copy_server: Unable to create SSL policy.");
1794     goto cleanup;
1795   }
1796
1797   if (!(query = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks)))
1798   {
1799     DEBUG_puts("4http_cdsa_copy_server: Unable to create query dictionary.");
1800     goto cleanup;
1801   }
1802
1803   _cupsMutexLock(&tls_mutex);
1804
1805   err = SecKeychainGetStatus(tls_keychain, &status);
1806
1807   if (err == noErr && !(status & kSecUnlockStateStatus) && tls_cups_keychain)
1808     SecKeychainUnlock(tls_keychain, _CUPS_CDSA_PASSLEN, _CUPS_CDSA_PASSWORD, TRUE);
1809
1810   CFDictionaryAddValue(query, kSecClass, kSecClassIdentity);
1811   CFDictionaryAddValue(query, kSecMatchPolicy, policy);
1812   CFDictionaryAddValue(query, kSecReturnRef, kCFBooleanTrue);
1813   CFDictionaryAddValue(query, kSecMatchLimit, kSecMatchLimitOne);
1814
1815   syschain = http_cdsa_open_system_keychain();
1816
1817   if (syschain)
1818   {
1819     const void *values[2] = { syschain, tls_keychain };
1820
1821     list = CFArrayCreate(kCFAllocatorDefault, (const void **)values, 2, &kCFTypeArrayCallBacks);
1822   }
1823   else
1824     list = CFArrayCreate(kCFAllocatorDefault, (const void **)&tls_keychain, 1, &kCFTypeArrayCallBacks);
1825
1826   CFDictionaryAddValue(query, kSecMatchSearchList, list);
1827   CFRelease(list);
1828
1829   err = SecItemCopyMatching(query, (CFTypeRef *)&identity);
1830
1831   _cupsMutexUnlock(&tls_mutex);
1832
1833   if (err != noErr)
1834   {
1835     DEBUG_printf(("4http_cdsa_copy_server: SecItemCopyMatching failed with status %d.", (int)err));
1836     goto cleanup;
1837   }
1838
1839   if (CFGetTypeID(identity) != SecIdentityGetTypeID())
1840   {
1841     DEBUG_puts("4http_cdsa_copy_server: Search returned something that is not an identity.");
1842     goto cleanup;
1843   }
1844
1845   if ((certificates = CFArrayCreate(NULL, (const void **)&identity, 1, &kCFTypeArrayCallBacks)) == NULL)
1846   {
1847     DEBUG_puts("4http_cdsa_copy_server: Unable to create array of certificates.");
1848     goto cleanup;
1849   }
1850
1851   cleanup :
1852
1853   if (syschain)
1854     CFRelease(syschain);
1855   if (identity)
1856     CFRelease(identity);
1857   if (policy)
1858     CFRelease(policy);
1859   if (cfcommon_name)
1860     CFRelease(cfcommon_name);
1861   if (query)
1862     CFRelease(query);
1863
1864   DEBUG_printf(("4http_cdsa_copy_server: Returning %p.", (void *)certificates));
1865
1866   return (certificates);
1867 #else
1868
1869   if (!tls_selfsigned)
1870     return (NULL);
1871
1872   return (CFArrayCreate(NULL, (const void **)&tls_selfsigned, 1, &kCFTypeArrayCallBacks));
1873 #endif /* HAVE_SECKEYCHAINOPEN */
1874 }
1875
1876
1877 /*
1878  * 'http_cdsa_create_credential()' - Create a single credential in the internal format.
1879  */
1880
1881 static SecCertificateRef                        /* O - Certificate */
1882 http_cdsa_create_credential(
1883     http_credential_t *credential)              /* I - Credential */
1884 {
1885   if (!credential)
1886     return (NULL);
1887
1888   return (SecCertificateCreateWithBytes(kCFAllocatorDefault, credential->data, (CFIndex)credential->datalen));
1889 }
1890
1891
1892 #ifdef HAVE_SECKEYCHAINOPEN
1893 /*
1894  * 'http_cdsa_default_path()' - Get the default keychain path.
1895  */
1896
1897 static const char *                     /* O - Keychain path */
1898 http_cdsa_default_path(char   *buffer,  /* I - Path buffer */
1899                        size_t bufsize)  /* I - Size of buffer */
1900 {
1901   const char *home = getenv("HOME");    /* HOME environment variable */
1902
1903
1904  /*
1905   * Determine the default keychain path.  Note that the login and system
1906   * keychains are no longer accessible to user applications starting in macOS
1907   * 10.11.4 (!), so we need to create our own keychain just for CUPS.
1908   */
1909
1910   if (getuid() && home)
1911     snprintf(buffer, bufsize, "%s/.cups/ssl.keychain", home);
1912   else
1913     strlcpy(buffer, "/etc/cups/ssl.keychain", bufsize);
1914
1915   DEBUG_printf(("1http_cdsa_default_path: Using default path \"%s\".", buffer));
1916
1917   return (buffer);
1918 }
1919
1920
1921 /*
1922  * 'http_cdsa_open_keychain()' - Open (or create) a keychain.
1923  */
1924
1925 static SecKeychainRef                   /* O - Keychain or NULL */
1926 http_cdsa_open_keychain(
1927     const char *path,                   /* I - Path to keychain */
1928     char       *filename,               /* I - Keychain filename */
1929     size_t     filesize)                /* I - Size of filename buffer */
1930 {
1931   SecKeychainRef        keychain = NULL;/* Temporary keychain */
1932   OSStatus              err;            /* Error code */
1933   Boolean               interaction;    /* Interaction allowed? */
1934   SecKeychainStatus     status = 0;     /* Keychain status */
1935
1936
1937  /*
1938   * Get the keychain filename...
1939   */
1940
1941   if (!path)
1942   {
1943     path = http_cdsa_default_path(filename, filesize);
1944     tls_cups_keychain = 1;
1945   }
1946   else
1947   {
1948     strlcpy(filename, path, filesize);
1949     tls_cups_keychain = 0;
1950   }
1951
1952  /*
1953   * Save the interaction setting and disable while we open the keychain...
1954   */
1955
1956   SecKeychainGetUserInteractionAllowed(&interaction);
1957   SecKeychainSetUserInteractionAllowed(FALSE);
1958
1959   if (access(path, R_OK) && tls_cups_keychain)
1960   {
1961    /*
1962     * Create a new keychain at the given path...
1963     */
1964
1965     err = SecKeychainCreate(path, _CUPS_CDSA_PASSLEN, _CUPS_CDSA_PASSWORD, FALSE, NULL, &keychain);
1966   }
1967   else
1968   {
1969    /*
1970     * Open the existing keychain and unlock as needed...
1971     */
1972
1973     err = SecKeychainOpen(path, &keychain);
1974
1975     if (err == noErr)
1976       err = SecKeychainGetStatus(keychain, &status);
1977
1978     if (err == noErr && !(status & kSecUnlockStateStatus) && tls_cups_keychain)
1979       err = SecKeychainUnlock(keychain, _CUPS_CDSA_PASSLEN, _CUPS_CDSA_PASSWORD, TRUE);
1980   }
1981
1982  /*
1983   * Restore interaction setting...
1984   */
1985
1986   SecKeychainSetUserInteractionAllowed(interaction);
1987
1988  /*
1989   * Release the keychain if we had any errors...
1990   */
1991
1992   if (err != noErr)
1993   {
1994     /* TODO: Set cups last error string */
1995     DEBUG_printf(("4http_cdsa_open_keychain: Unable to open keychain (%d), returning NULL.", (int)err));
1996
1997     if (keychain)
1998     {
1999       CFRelease(keychain);
2000       keychain = NULL;
2001     }
2002   }
2003
2004  /*
2005   * Return the keychain or NULL...
2006   */
2007
2008   return (keychain);
2009 }
2010
2011
2012 /*
2013  * 'http_cdsa_open_system_keychain()' - Open the System keychain.
2014  */
2015
2016 static SecKeychainRef
2017 http_cdsa_open_system_keychain(void)
2018 {
2019   SecKeychainRef        keychain = NULL;/* Temporary keychain */
2020   OSStatus              err;            /* Error code */
2021   Boolean               interaction;    /* Interaction allowed? */
2022   SecKeychainStatus     status = 0;     /* Keychain status */
2023
2024
2025  /*
2026   * Save the interaction setting and disable while we open the keychain...
2027   */
2028
2029   SecKeychainGetUserInteractionAllowed(&interaction);
2030   SecKeychainSetUserInteractionAllowed(TRUE);
2031
2032   err = SecKeychainOpen("/Library/Keychains/System.keychain", &keychain);
2033
2034   if (err == noErr)
2035     err = SecKeychainGetStatus(keychain, &status);
2036
2037   if (err == noErr && !(status & kSecUnlockStateStatus))
2038     err = errSecInteractionNotAllowed;
2039
2040  /*
2041   * Restore interaction setting...
2042   */
2043
2044   SecKeychainSetUserInteractionAllowed(interaction);
2045
2046  /*
2047   * Release the keychain if we had any errors...
2048   */
2049
2050   if (err != noErr)
2051   {
2052     /* TODO: Set cups last error string */
2053     DEBUG_printf(("4http_cdsa_open_system_keychain: Unable to open keychain (%d), returning NULL.", (int)err));
2054
2055     if (keychain)
2056     {
2057       CFRelease(keychain);
2058       keychain = NULL;
2059     }
2060   }
2061
2062  /*
2063   * Return the keychain or NULL...
2064   */
2065
2066   return (keychain);
2067 }
2068 #endif /* HAVE_SECKEYCHAINOPEN */
2069
2070
2071 /*
2072  * 'http_cdsa_read()' - Read function for the CDSA library.
2073  */
2074
2075 static OSStatus                         /* O  - -1 on error, 0 on success */
2076 http_cdsa_read(
2077     SSLConnectionRef connection,        /* I  - SSL/TLS connection */
2078     void             *data,             /* I  - Data buffer */
2079     size_t           *dataLength)       /* IO - Number of bytes */
2080 {
2081   OSStatus      result;                 /* Return value */
2082   ssize_t       bytes;                  /* Number of bytes read */
2083   http_t        *http;                  /* HTTP connection */
2084
2085
2086   http = (http_t *)connection;
2087
2088   if (!http->blocking)
2089   {
2090    /*
2091     * Make sure we have data before we read...
2092     */
2093
2094     while (!_httpWait(http, http->wait_value, 0))
2095     {
2096       if (http->timeout_cb && (*http->timeout_cb)(http, http->timeout_data))
2097         continue;
2098
2099       http->error = ETIMEDOUT;
2100       return (-1);
2101     }
2102   }
2103
2104   do
2105   {
2106     bytes = recv(http->fd, data, *dataLength, 0);
2107   }
2108   while (bytes == -1 && (errno == EINTR || errno == EAGAIN));
2109
2110   if ((size_t)bytes == *dataLength)
2111   {
2112     result = 0;
2113   }
2114   else if (bytes > 0)
2115   {
2116     *dataLength = (size_t)bytes;
2117     result = errSSLWouldBlock;
2118   }
2119   else
2120   {
2121     *dataLength = 0;
2122
2123     if (bytes == 0)
2124       result = errSSLClosedGraceful;
2125     else if (errno == EAGAIN)
2126       result = errSSLWouldBlock;
2127     else
2128       result = errSSLClosedAbort;
2129   }
2130
2131   return (result);
2132 }
2133
2134
2135 /*
2136  * 'http_cdsa_set_credentials()' - Set the TLS credentials.
2137  */
2138
2139 static int                              /* O - Status of connection */
2140 http_cdsa_set_credentials(http_t *http) /* I - HTTP connection */
2141 {
2142   _cups_globals_t *cg = _cupsGlobals(); /* Pointer to library globals */
2143   OSStatus              error = 0;      /* Error code */
2144   http_tls_credentials_t credentials = NULL;
2145                                         /* TLS credentials */
2146
2147
2148   DEBUG_printf(("7http_tls_set_credentials(%p)", (void *)http));
2149
2150  /*
2151   * Prefer connection specific credentials...
2152   */
2153
2154   if ((credentials = http->tls_credentials) == NULL)
2155     credentials = cg->tls_credentials;
2156
2157   if (credentials)
2158   {
2159     error = SSLSetCertificate(http->tls, credentials);
2160     DEBUG_printf(("4http_tls_set_credentials: SSLSetCertificate, error=%d",
2161                   (int)error));
2162   }
2163   else
2164     DEBUG_puts("4http_tls_set_credentials: No credentials to set.");
2165
2166   return (error);
2167 }
2168
2169
2170 /*
2171  * 'http_cdsa_write()' - Write function for the CDSA library.
2172  */
2173
2174 static OSStatus                         /* O  - -1 on error, 0 on success */
2175 http_cdsa_write(
2176     SSLConnectionRef connection,        /* I  - SSL/TLS connection */
2177     const void       *data,             /* I  - Data buffer */
2178     size_t           *dataLength)       /* IO - Number of bytes */
2179 {
2180   OSStatus      result;                 /* Return value */
2181   ssize_t       bytes;                  /* Number of bytes read */
2182   http_t        *http;                  /* HTTP connection */
2183
2184
2185   http = (http_t *)connection;
2186
2187   do
2188   {
2189     bytes = write(http->fd, data, *dataLength);
2190   }
2191   while (bytes == -1 && (errno == EINTR || errno == EAGAIN));
2192
2193   if ((size_t)bytes == *dataLength)
2194   {
2195     result = 0;
2196   }
2197   else if (bytes >= 0)
2198   {
2199     *dataLength = (size_t)bytes;
2200     result = errSSLWouldBlock;
2201   }
2202   else
2203   {
2204     *dataLength = 0;
2205
2206     if (errno == EAGAIN)
2207       result = errSSLWouldBlock;
2208     else
2209       result = errSSLClosedAbort;
2210   }
2211
2212   return (result);
2213 }