summaryrefslogtreecommitdiff
path: root/source3/smbd
diff options
context:
space:
mode:
authorAndrew Bartlett <abartlet@samba.org>2002-05-17 12:42:39 +0000
committerAndrew Bartlett <abartlet@samba.org>2002-05-17 12:42:39 +0000
commiteed5094264945ca8ccf47030375cc56808ae8ea3 (patch)
tree4a39aca15191b1a857e60f5a4b761fce29867688 /source3/smbd
parenta64932dfc06af46d4a4eebd6fb537e229466b00b (diff)
downloadsamba-eed5094264945ca8ccf47030375cc56808ae8ea3.tar.gz
samba-eed5094264945ca8ccf47030375cc56808ae8ea3.tar.bz2
samba-eed5094264945ca8ccf47030375cc56808ae8ea3.zip
This removes --with-ssl from Samba.
This option was badly maintained, useless and confused our users and distirbutors. (its SSL, therfore it must be good...) No windows client uses this protocol without help from an SSL tunnel. I can't see any reason why setting up a unix-side SSL wrapper would be any more difficult than the > 10 config options this mess added to samba in any case. On the Samba client end, I think the LIBSMB_PROG hack should be sufficient to start stunnel on the unix side. We might extend this to take %i and %p (IP and port) if there is demand. Andrew Bartlett (This used to be commit b04561d3fd3ee732877790fb4193b20ad72a75f8)
Diffstat (limited to 'source3/smbd')
-rw-r--r--source3/smbd/build_options.c6
-rw-r--r--source3/smbd/process.c16
-rw-r--r--source3/smbd/server.c9
-rw-r--r--source3/smbd/ssl.c286
4 files changed, 0 insertions, 317 deletions
diff --git a/source3/smbd/build_options.c b/source3/smbd/build_options.c
index 2c33819fd6..48fcb1e990 100644
--- a/source3/smbd/build_options.c
+++ b/source3/smbd/build_options.c
@@ -113,12 +113,6 @@ void build_options(BOOL screen)
#ifdef WITH_NISPLUS_HOME
output(screen," WITH_NISPLUS_HOME\n");
#endif
-#ifdef WITH_SSL
- output(screen," WITH_SSL\n");
-#endif
-#ifdef SSL_DIR
- output(screen," SSL_DIR: %s\n",SSL_DIR);
-#endif
#ifdef WITH_SYSLOG
output(screen," WITH_SYSLOG\n");
#endif
diff --git a/source3/smbd/process.c b/source3/smbd/process.c
index 007621f6bb..67ceb98539 100644
--- a/source3/smbd/process.c
+++ b/source3/smbd/process.c
@@ -829,10 +829,6 @@ set. Ignoring max smbd restriction.\n"));
****************************************************************************/
void process_smb(char *inbuf, char *outbuf)
{
-#ifdef WITH_SSL
- extern BOOL sslEnabled; /* don't use function for performance reasons */
- static int sslConnected = 0;
-#endif /* WITH_SSL */
static int trans_num;
int msg_type = CVAL(inbuf,0);
int32 len = smb_len(inbuf);
@@ -860,18 +856,6 @@ void process_smb(char *inbuf, char *outbuf)
DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type, len ) );
DEBUG( 3, ( "Transaction %d of length %d\n", trans_num, nread ) );
-#ifdef WITH_SSL
- if(sslEnabled && !sslConnected){
- sslConnected = sslutil_negotiate_ssl(smbd_server_fd(), msg_type);
- if(sslConnected < 0){ /* an error occured */
- exit_server("SSL negotiation failed");
- }else if(sslConnected){
- trans_num++;
- return;
- }
- }
-#endif /* WITH_SSL */
-
if (msg_type == 0)
show_msg(inbuf);
else if(msg_type == SMBkeepalive)
diff --git a/source3/smbd/server.c b/source3/smbd/server.c
index c759f56e0c..db6caa0352 100644
--- a/source3/smbd/server.c
+++ b/source3/smbd/server.c
@@ -782,15 +782,6 @@ static void usage(char *pname)
}
#endif
-#ifdef WITH_SSL
- {
- extern BOOL sslEnabled;
- sslEnabled = lp_ssl_enabled();
- if(sslEnabled)
- sslutil_init(True);
- }
-#endif /* WITH_SSL */
-
fstrcpy(global_myworkgroup, lp_workgroup());
DEBUG(3,( "loaded services\n"));
diff --git a/source3/smbd/ssl.c b/source3/smbd/ssl.c
deleted file mode 100644
index 7fcb48a954..0000000000
--- a/source3/smbd/ssl.c
+++ /dev/null
@@ -1,286 +0,0 @@
-/*
- Unix SMB/CIFS implementation.
- SSLeay utility functions
- Copyright (C) Christian Starkjohann <cs@obdev.at> 1998
-
- This program is free software; you can redistribute it and/or modify
- it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
- (at your option) any later version.
-
- This program is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- GNU General Public License for more details.
-
- You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-*/
-
-/*
- * since includes.h pulls in config.h which is were WITH_SSL will be
- * defined, we want to include includes.h before testing for WITH_SSL
- * RJS 26-Jan-1999
- */
-
-#include "includes.h"
-
-#ifdef WITH_SSL /* should always be defined if this module is compiled */
-
-#include <openssl/ssl.h>
-#include <openssl/err.h>
-
-BOOL sslEnabled;
-SSL *ssl = NULL;
-int sslFd = -1;
-static SSL_CTX *sslContext = NULL;
-extern int DEBUGLEVEL;
-
-static int ssl_verify_cb(int ok, X509_STORE_CTX *ctx)
-{
-char buffer[256];
-
- X509_NAME_oneline(X509_get_issuer_name(ctx->current_cert),
- buffer, sizeof(buffer));
- if(ok){
- DEBUG(0, ("SSL: Certificate OK: %s\n", buffer));
- }else{
- switch (ctx->error){
- case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
- DEBUG(0, ("SSL: Cert error: CA not known: %s\n", buffer));
- break;
- case X509_V_ERR_CERT_NOT_YET_VALID:
- DEBUG(0, ("SSL: Cert error: Cert not yet valid: %s\n", buffer));
- break;
- case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
- DEBUG(0, ("SSL: Cert error: illegal \'not before\' field: %s\n",
- buffer));
- break;
- case X509_V_ERR_CERT_HAS_EXPIRED:
- DEBUG(0, ("SSL: Cert error: Cert expired: %s\n", buffer));
- break;
- case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
- DEBUG(0, ("SSL: Cert error: invalid \'not after\' field: %s\n",
- buffer));
- break;
- default:
- DEBUG(0, ("SSL: Cert error: unknown error %d in %s\n", ctx->error,
- buffer));
- break;
- }
- }
- return ok;
-}
-
-static RSA *ssl_temp_rsa_cb(SSL *ssl, int is_export, int keylength)
-{
-static RSA *rsa = NULL;
-
- if(rsa == NULL)
- rsa = RSA_generate_key(keylength, RSA_F4, NULL, NULL);
- return rsa;
-}
-
-/* This is called before we fork. It should ask the user for the pass phrase
- * if necessary. Error output can still go to stderr because the process
- * has a terminal.
- */
-int sslutil_init(int isServer)
-{
-int err, entropybytes;
-char *certfile, *keyfile, *ciphers, *cacertDir, *cacertFile;
-char *egdsocket, *entropyfile;
-
- SSL_load_error_strings();
- SSLeay_add_ssl_algorithms();
- egdsocket = lp_ssl_egdsocket();
- if (egdsocket != NULL && *egdsocket != 0)
- RAND_egd(egdsocket);
- entropyfile = lp_ssl_entropyfile();
- entropybytes = lp_ssl_entropybytes();
- if (entropyfile != NULL && *entropyfile != 0)
- RAND_load_file(entropyfile, entropybytes);
- switch(lp_ssl_version()){
- case SMB_SSL_V2: sslContext = SSL_CTX_new(SSLv2_method()); break;
- case SMB_SSL_V3: sslContext = SSL_CTX_new(SSLv3_method()); break;
- default:
- case SMB_SSL_V23: sslContext = SSL_CTX_new(SSLv23_method()); break;
- case SMB_SSL_TLS1: sslContext = SSL_CTX_new(TLSv1_method()); break;
- }
- if(sslContext == NULL){
- err = ERR_get_error();
- fprintf(stderr, "SSL: Error allocating context: %s\n",
- ERR_error_string(err, NULL));
- exit(1);
- }
- if(lp_ssl_compatibility()){
- SSL_CTX_set_options(sslContext, SSL_OP_ALL);
- }
- certfile = isServer ? lp_ssl_server_cert() : lp_ssl_client_cert();
- if((certfile == NULL || *certfile == 0) && isServer){
- fprintf(stderr, "SSL: No cert file specified in config file!\n");
- fprintf(stderr, "The server MUST have a certificate!\n");
- exit(1);
- }
- keyfile = isServer ? lp_ssl_server_privkey() : lp_ssl_client_privkey();
- if(keyfile == NULL || *keyfile == 0)
- keyfile = certfile;
- if(certfile != NULL && *certfile != 0){
- if(!SSL_CTX_use_certificate_chain_file(sslContext, certfile)){
- err = ERR_get_error();
- fprintf(stderr, "SSL: error reading certificate from file %s: %s\n",
- certfile, ERR_error_string(err, NULL));
- exit(1);
- }
- if(!SSL_CTX_use_PrivateKey_file(sslContext, keyfile, SSL_FILETYPE_PEM)){
- err = ERR_get_error();
- fprintf(stderr, "SSL: error reading private key from file %s: %s\n",
- keyfile, ERR_error_string(err, NULL));
- exit(1);
- }
- if(!SSL_CTX_check_private_key(sslContext)){
- err = ERR_get_error();
- fprintf(stderr, "SSL: Private key does not match public key in cert!\n");
- exit(1);
- }
- }
- cacertDir = lp_ssl_cacertdir();
- cacertFile = lp_ssl_cacertfile();
- if(cacertDir != NULL && *cacertDir == 0)
- cacertDir = NULL;
- if(cacertFile != NULL && *cacertFile == 0)
- cacertFile = NULL;
- if(!SSL_CTX_load_verify_locations(sslContext, cacertFile, cacertDir)){
- err = ERR_get_error();
- if (cacertFile || cacertDir) {
- fprintf(stderr, "SSL: Error error setting CA cert locations: %s\n",
- ERR_error_string(err, NULL));
- fprintf(stderr, "trying default locations.\n");
- }
- cacertFile = cacertDir = NULL;
- if(!SSL_CTX_set_default_verify_paths(sslContext)){
- err = ERR_get_error();
- fprintf(stderr, "SSL: Error error setting default CA cert location: %s\n",
- ERR_error_string(err, NULL));
- exit(1);
- }
- }
- SSL_CTX_set_tmp_rsa_callback(sslContext, ssl_temp_rsa_cb);
- if((ciphers = lp_ssl_ciphers()) != NULL && *ciphers != 0)
- SSL_CTX_set_cipher_list(sslContext, ciphers);
- if((isServer && lp_ssl_reqClientCert()) || (!isServer && lp_ssl_reqServerCert())){
- SSL_CTX_set_verify(sslContext,
- SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, ssl_verify_cb);
- }else{
- SSL_CTX_set_verify(sslContext, SSL_VERIFY_NONE, ssl_verify_cb);
- }
-#if 1 /* don't know what this is good for, but s_server in SSLeay does it, too */
- if(isServer){
- SSL_CTX_set_client_CA_list(sslContext, SSL_load_client_CA_file(certfile));
- }
-#endif
- return 0;
-}
-
-int sslutil_accept(int fd)
-{
-int err;
-
- if(ssl != NULL){
- DEBUG(0, ("SSL: internal error: more than one SSL connection (server)\n"));
- return -1;
- }
- if((ssl = SSL_new(sslContext)) == NULL){
- err = ERR_get_error();
- DEBUG(0, ("SSL: Error allocating handle: %s\n",
- ERR_error_string(err, NULL)));
- return -1;
- }
- SSL_set_fd(ssl, fd);
- sslFd = fd;
- if(SSL_accept(ssl) <= 0){
- err = ERR_get_error();
- DEBUG(0, ("SSL: Error accepting on socket: %s\n",
- ERR_error_string(err, NULL)));
- return -1;
- }
- DEBUG(0, ("SSL: negotiated cipher: %s\n", SSL_get_cipher(ssl)));
- return 0;
-}
-
-int sslutil_fd_is_ssl(int fd)
-{
- return fd == sslFd;
-}
-
-int sslutil_connect(int fd)
-{
-int err;
-
- if(ssl != NULL){
- DEBUG(0, ("SSL: internal error: more than one SSL connection (client)\n"));
- return -1;
- }
- if((ssl = SSL_new(sslContext)) == NULL){
- err = ERR_get_error();
- DEBUG(0, ("SSL: Error allocating handle: %s\n",
- ERR_error_string(err, NULL)));
- return -1;
- }
- SSL_set_fd(ssl, fd);
- sslFd = fd;
- if(SSL_connect(ssl) <= 0){
- err = ERR_get_error();
- DEBUG(0, ("SSL: Error conencting socket: %s\n",
- ERR_error_string(err, NULL)));
- return -1;
- }
- DEBUG(0, ("SSL: negotiated cipher: %s\n", SSL_get_cipher(ssl)));
- return 0;
-}
-
-int sslutil_disconnect(int fd)
-{
- if(fd == sslFd && ssl != NULL){
- SSL_free(ssl);
- ssl = NULL;
- sslFd = -1;
- }
- return 0;
-}
-
-int sslutil_negotiate_ssl(int fd, int msg_type)
-{
-unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
-char *reqHosts, *resignHosts;
-
- reqHosts = lp_ssl_hosts();
- resignHosts = lp_ssl_hosts_resign();
- if(!allow_access(resignHosts, reqHosts, get_socket_name(fd), get_socket_addr(fd))){
- sslEnabled = False;
- return 0;
- }
- if(msg_type != 0x81){ /* first packet must be a session request */
- DEBUG( 0, ( "Client %s did not use session setup; access denied\n",
- client_addr() ) );
- if (!send_smb(fd, (char *)buf))
- DEBUG(0, ("sslutil_negotiate_ssl: send_smb failed.\n"));
- return -1;
- }
- buf[4] = 0x8e; /* negative session response: use SSL */
- if (!send_smb(fd, (char *)buf)) {
- DEBUG(0,("sslutil_negotiate_ssl: send_smb failed.\n"));
- return -1;
- }
- if(sslutil_accept(fd) != 0){
- DEBUG( 0, ( "Client %s failed SSL negotiation!\n", client_addr() ) );
- return -1;
- }
- return 1;
-}
-
-#else /* WITH_SSL */
- void ssl_dummy(void);
- void ssl_dummy(void) {;} /* So some compilers don't complain. */
-#endif /* WITH_SSL */