summaryrefslogtreecommitdiff
path: root/source4/lib/tls
AgeCommit message (Collapse)AuthorFilesLines
2025-09-02lib: Fix Coverity ID 1509061 Use of 32-bit time_tVolker Lendecke1-1/+4
"man gnutls_x509_crt_set_serial" says that the serial number should be a big-endian positive integer of up to 20 bytes.... Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
2025-09-02tls: Reorder macro for easier readabilityVolker Lendecke1-5/+5
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
2025-09-02tls: Make tstream_tls_params_quic_enabled a bit easier to readVolker Lendecke1-3/+7
YMMV Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
2025-09-02tls: Fix a printf sign mismatchVolker Lendecke1-1/+1
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
2025-09-02tls: Fix whitespaceVolker Lendecke1-4/+4
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
2025-08-26s4:lib/tls: add additional dns hostnames as GNUTLS_SAN_DNSNAME for ↵Stefan Metzmacher3-0/+18
self-signed certificates It's better to include X509v3 Subject Alternative Name with DNS names also for additional dns hostnames. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15899 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Tue Aug 26 22:00:26 UTC 2025 on atb-devel-224
2025-08-26s4:lib/tls: set GNUTLS_SAN_DNSNAME for self-signed certificatesStefan Metzmacher1-0/+3
It's better to include X509v3 Subject Alternative Name with DNS names in the self-signed certificate... BUG: https://bugzilla.samba.org/show_bug.cgi?id=15899 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-08-26s4:lib/tls: let tstream_tls_params_server_lpcfg() use lpcfg_dns_hostname() ↵Stefan Metzmacher2-3/+1
internally This is simpler and the next step will also make use of lpcfg_additional_dns_hostnames() too... BUG: https://bugzilla.samba.org/show_bug.cgi?id=15899 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-08-22lib: tstream_tls_verify_peer_trusted()Volker Lendecke2-0/+6
We can only trust a tls connection if at connection setup we checked the certificates Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-08-22tls: Add tstream_tls_params_verify_peer()Volker Lendecke2-0/+18
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-07-17s4:lib/tls: add tstream_tls_ngtcp2_connect_send/recvStefan Metzmacher3-0/+2023
This implemented a tstream_context for a single QUIC stream using libngtcp2 over an udp socket. This will allow us to support the SMB over QUIC protocol on the client side even without quic.ko kernel support. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-07-17s4:lib/tls: add tstream_tls_params_quic_{prepare,enabled() and ↵Stefan Metzmacher3-3/+391
tstream_tls_quic_handshake[_{send,recv}]() This requires https://github.com/lxin/quic, which provides a kernel module quic.ko for Linux (tested with Linux 6.8 and 6.14). The userspace libquic is mirrored under third_party/quic for now. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-04-18s4:lib/tls: introduce tstream_tls_params_server_lpcfg()Stefan Metzmacher2-0/+27
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2024-11-11tstream_tls: Add tstream_tls_params_peer_name()Volker Lendecke2-0/+8
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-04-23s4:lib/tls: add tstream_tls_sync_setup()Stefan Metzmacher2-0/+195
This operates in a non-async fashion and may block in the push and pull function. It will be used to plug into openldap transport layer, this is needed in order to have access to the channel bindings. And also use the same configuration for all our gnutls based tls code. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-23s4:lib/tls: add support for ↵Stefan Metzmacher2-5/+58
gnutls_certificate_set_x509_{system_trust,trust_dir}() Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-23s4:lib/tls: add tstream_tls_channel_bindings()Stefan Metzmacher2-0/+68
This is based on GNUTLS_CB_TLS_SERVER_END_POINT and is the value that is required for channel bindings in LDAP of active directory domain controllers. For gnutls versions before 3.7.2 we basically copied the code from the GNUTLS_CB_TLS_SERVER_END_POINT implementation as it only uses public gnutls functions and it was easy to re-implement. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15621 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-23s4:lib/tls: add tstream_tls_params_client_lpcfg()Stefan Metzmacher2-0/+52
This will be able simplify the callers a lot... BUG: https://bugzilla.samba.org/show_bug.cgi?id=15621 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-23s4:lib/tls: split out tstream_tls_verify_peer() helperStefan Metzmacher1-66/+81
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15621 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-23s4:lib/tls: include a TLS server name indication in the client handshakeStefan Metzmacher1-0/+22
This is not strictly needed, but it might be useful for load balancers. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15621 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-23s4:lib/tls: we no longer need ifdef GNUTLS_NO_TICKETSStefan Metzmacher1-2/+0
We require gnutls 3.6.13 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-23s4:lib/tls: split out tstream_tls_prepare_gnutls()Stefan Metzmacher2-128/+106
Review with: git show --patience BUG: https://bugzilla.samba.org/show_bug.cgi?id=15621 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-23s4:lib/tls: assert that event contexts are not mixedStefan Metzmacher1-0/+18
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15621 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-23s3:lib/tls: we need to call tstream_tls_retry_handshake/disconnect() until ↵Stefan Metzmacher1-0/+25
all buffers are flushed Before the handshare or disconnect is over we need to wait until we delivered the lowlevel messages to the transport/kernel socket. Otherwise we'll have a problem if another tevent_context is used after the handshake. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15621 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-23s4:lib/tls: remove tstream_tls_push_trigger_write stepStefan Metzmacher1-56/+5
At the time of https://bugzilla.samba.org/show_bug.cgi?id=7218, we tested this versions: 2.4.1 -> broken 2.4.2 -> broken 2.6.0 -> broken 2.8.0 -> broken 2.8.1 -> broken 2.8.2 -> OK 2.8.3 -> OK 2.8.4 -> OK 2.8.5 -> OK 2.8.6 -> OK 2.10.0 -> broken 2.10.1 -> broken 2.10.2 -> OK These seemed to be the fixes in gnutls upstream. Change 2.8.1 -> 2.8.2: http://git.savannah.gnu.org/gitweb/?p=gnutls.git;a=commitdiff;h=28fb34099edaf62e5472cc6e5e2749fed369ea01 Change 2.10.1 -> 2.10.2: http://git.savannah.gnu.org/gitweb/?p=gnutls.git;a=commitdiff;h=0d07d8432d57805a8354ebd6c1e7829f3ab159cb This shouldn't be a problem with recent (>= 3.6) versions of gnutls. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15621 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-16lib: Give lib/util/util_file.c its own header fileVolker Lendecke2-0/+2
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Martin Schwenke <mschwenke@ddn.com>
2023-10-25s4:lib: Fix code spellingJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-25s4:tls_tstream: create tstream_tls_params_internalJule Anger1-36/+107
The following commits will implement the reloading of tls certificates. Therefore we need to overwrite the interal memory. Note we need to make sure x509_cred and dh_params from tstream_tls_params_internal stay alive for the whole lifetime of this session! See 'man gnutls_credentials_set' and 'man gnutls_certificate_set_dh_params'. Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Jule Anger <janger@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-11-16s4:lib:tls: Don't negotiate session resumption with session ticketsNoel Power1-1/+13
tls_tstream can't properly handle 'New Session Ticket' messages sent 'after' the client sends the 'Finished' message. This is needed because some servers (at least elasticsearch) wait till they get 'Finished' messgage from the client before sending the "New Ticket" message. Without this patch what typcially happens is when the application code sends data it then tries to read the response, but, instead of the response to the request it actually recieves the "New Session Ticket" instead. The "New Session Ticket" message gets processed by the upper layer logic e.g. tstream_tls_readv_send ->tstream_tls_readv_crypt_next ->tstream_tls_retry_read ->gnutls_record_recv instead of the core gnutls routines. This results in the response processing failing due to the currently 'unexpected' New Ticket message. In order to avoid this scenario we can ensure the client doesn't negotiate resumption with session tickets. Signed-off-by: Noel Power <noel.power@suse.com> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Wed Nov 16 09:58:45 UTC 2022 on sn-devel-184
2020-06-17s3:lib:tls: Use better priority lists for modern GnuTLSAndreas Schneider1-10/+30
We should use the default priority list. That is a good practice, because TLS protocol hardening and phasing out of legacy algorithms, is easier to co-ordinate when happens at a single place. See crypto policies of Fedora. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14408 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Wed Jun 17 17:42:02 UTC 2020 on sn-devel-184
2020-04-08s4:tls: Fix generating TLS RSA certs with FIPS140-2Andreas Schneider1-1/+3
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org>
2019-11-19s4:lib:tls: Fix cert and privkey typesAndreas Schneider1-2/+2
../../source4/lib/tls/tlscert.c:42:2: warning: ‘gnutls_x509_crt’ is deprecated [-Wdeprecated-declarations] 42 | gnutls_x509_crt cacrt, crt; | ^~~~~~~~~~~~~~~ ../../source4/lib/tls/tlscert.c:43:2: warning: ‘gnutls_x509_privkey’ is deprecated [-Wdeprecated-declarations] 43 | gnutls_x509_privkey key, cakey; | ^~~~~~~~~~~~~~~~~~~ Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-11-14s4:lib: Remove gnutls_global_(de)init() from libtlsAndreas Schneider2-15/+0
This is handled by the gnutls library constructor/destructor. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-06-26lib/tls: Remove unused header definitions from source4/lib/tls/tls.h (tls ↵Andrew Bartlett1-27/+0
socket wrapper) These were removed in eb15acdd35600878aba3319e070199200d9a1357 but the header declarations were not removed. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2019-05-06lib/tls: Remove unused source4/lib/tls/tls.c (tls socket wrapper)Andrew Bartlett2-611/+0
The last caller was removed in 72c79e30f07bcc98610cca878f5de50e7db239a0 to remove the web server as all other callers use tls_tstream. Found by callcatcher. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-04-30waf: Remove configure steps from source4/lib/tlsAndreas Schneider2-87/+17
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-04-30s3:tls: Remove #ifdef for GnuTLSAndreas Schneider3-241/+3
This is a requirement now. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-11-28s4:lib: Use #ifdef instead of #if for config.h definitionsAndreas Schneider1-2/+2
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2018-09-05source4/lib/tls/wscript: update to handle waf 2.0.4Alexander Bokovoy1-2/+2
Signed-off-by: Alexander Bokovoy <ab@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-01-10s4:lib/tls: fix the developer build without gnutls supportStefan Metzmacher1-0/+1
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2017-08-15s4/lib/tls: Use SHA256 to sign the TLS certificatesAndrew Bartlett1-3/+6
The use of SHA-1 has been on the "do not" list for a while now, so make our self-signed certificates use SHA256 using the new gnutls_x509_crt_sign2 provided since GNUTLS 1.2.0 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz> BUG: https://bugzilla.samba.org/show_bug.cgi?id=12953
2017-05-09s4:tls: Do not use deprecated GnuTLS typesAndreas Schneider2-14/+16
Those have been deprecated with GnuTLS 1.0.20 in 2004. I think it is safe to use them now ;) Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2017-02-21build:wafsamba: Remove ambiguous 'if x in conf.env' constructsThomas Nagy1-2/+2
Configuration values such as HAVE_STDDEF_H can be set to 0 to indicate a test failure. Waf 1.5 has a few bugs that prevent configuration tests from setting such values consistently on failures. Consequently, conditions such as 'if conf.env.VARNAME' must be used to indicate that config test successes are expected. Note that conf.env.VARNAME always returns an empty list (False value) when no variable is defined so there are no risk of raising AttributeError/KeyError exceptions. Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Uri Simchoni <uri@samba.org> Autobuild-User(master): Uri Simchoni <uri@samba.org> Autobuild-Date(master): Tue Feb 21 13:47:07 CET 2017 on sn-devel-144
2016-09-21tls: Fix warning Wunused-variableLukas Slebodnik1-2/+2
The variable error_pos is used only with enabled ENABLE_GNUTLS There are warnings if compiled witout gnutls ../source4/lib/tls/tls_tstream.c: In function ‘_tstream_tls_connect_send’: ../source4/lib/tls/tls_tstream.c:1053:14: warning: unused variable ‘error_pos’ [-Wunused-variable] const char *error_pos; ^~~~~~~~~ ../source4/lib/tls/tls_tstream.c: In function ‘_tstream_tls_accept_send’: ../source4/lib/tls/tls_tstream.c:1333:14: warning: unused variable ‘error_pos’ [-Wunused-variable] const char *error_pos; ^~~~~~~~~ Signed-off-by: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Wed Sep 21 00:01:09 CEST 2016 on sn-devel-144
2016-04-12CVE-2016-2113: s4:lib/tls: implement infrastructure to do peer verificationStefan Metzmacher3-0/+277
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11752 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
2016-04-12CVE-2016-2113: s4:lib/tls: create better certificates and sign the host cert ↵Stefan Metzmacher1-9/+9
with the ca cert The generated ca cert (in ca.pem) was completely useless, it could be replaced by cert.pem. BUG: https://bugzilla.samba.org/show_bug.cgi?id=11752 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
2015-12-10waf: Check for GnuTLS 3.4.7Andreas Schneider1-6/+20
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2015-09-03tls: increase Diffie-Hellman group size to 2048 bitsBjörn Jacke2-2/+2
1024 bits is already the minimum accepted size of current TLS libraries. 2048 is recommended for servers, see https://weakdh.org/ Signed-off-by: Bjoern Jacke <bj@sernet.de> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Thu Sep 3 03:47:48 CEST 2015 on sn-devel-104
2015-08-31lib/tls: Ensure SSLv3 is disabled in the web server by defaultAndrew Bartlett1-1/+14
By calling gnutls_priority_set_direct() the behaviour should now match the LDAP server BUG: https://bugzilla.samba.org/show_bug.cgi?id=11076 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
2015-08-31lib/tls: Remove unused tls_init_client codeAndrew Bartlett2-80/+0
This is unused as the callers have now been migrated to tls_tstream BUG: https://bugzilla.samba.org/show_bug.cgi?id=11076 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-07 04:32:32 +0000