Mercurial > ~mikael > mcabber > hg
annotate mcabber/connwrap/connwrap.c @ 955:6be62425dc38
Use current ssl_verify value in /connect
In delsock(), free the SSL_CTX object and reset the ctx pointer so that
a full initialization occurs the next time init() is called.
| author | Mikael Berthe <mikael@lilotux.net> |
|---|---|
| date | Sat, 02 Sep 2006 14:54:12 +0200 |
| parents | 40175f3dcef7 |
| children | 3225a1ba050d |
| rev | line source |
|---|---|
| 25 | 1 #include "connwrap.h" |
| 2 | |
|
302
8ca708a0d550
Remove compilation warnings in connwrap library
Mikael Berthe <mikael@lilotux.net>
parents:
235
diff
changeset
|
3 #include <stdio.h> |
|
8ca708a0d550
Remove compilation warnings in connwrap library
Mikael Berthe <mikael@lilotux.net>
parents:
235
diff
changeset
|
4 #include <stdlib.h> |
| 25 | 5 #include <netdb.h> |
| 6 #include <string.h> | |
| 7 #include <netinet/in.h> | |
| 8 #include <errno.h> | |
| 9 #include <arpa/inet.h> | |
| 10 #include <fcntl.h> | |
| 11 #include <sys/time.h> | |
| 112 | 12 #include <unistd.h> |
| 25 | 13 |
| 14 #define PROXY_TIMEOUT 10 | |
| 15 // HTTP proxy timeout in seconds (for the CONNECT method) | |
| 16 | |
| 17 #ifdef HAVE_OPENSSL | |
| 18 | |
| 19 #define OPENSSL_NO_KRB5 1 | |
| 20 #include <openssl/ssl.h> | |
| 21 #include <openssl/err.h> | |
| 22 | |
| 134 | 23 #else |
| 24 # ifdef HAVE_GNUTLS | |
| 25 # include <gnutls/openssl.h> | |
| 26 # define HAVE_OPENSSL | |
| 27 # endif | |
| 25 | 28 #endif |
| 29 | |
| 30 static int in_http_connect = 0; | |
| 31 | |
| 32 #ifdef HAVE_OPENSSL | |
| 33 | |
| 34 static SSL_CTX *ctx = 0; | |
| 35 | |
|
938
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
36 /* verify > 0 indicates verify depth as well */ |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
37 static int verify = -1; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
38 static const char *cafile = NULL; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
39 static const char *capath = NULL; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
40 static const char *cipherlist = NULL; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
41 static const char *peer = NULL; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
42 static const char *sslerror = NULL; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
43 |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
44 static int verify_cb(int preverify_ok, X509_STORE_CTX *cx) |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
45 { |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
46 X509 *cert; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
47 X509_NAME *nm; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
48 int lastpos; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
49 |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
50 if(!preverify_ok) { |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
51 long err = X509_STORE_CTX_get_error(cx); |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
52 |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
53 sslerror = X509_verify_cert_error_string(err); |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
54 return 0; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
55 } |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
56 |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
57 if (peer == NULL) |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
58 return 1; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
59 |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
60 if ((cert = X509_STORE_CTX_get_current_cert(cx)) == NULL) { |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
61 sslerror = "internal SSL error"; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
62 return 0; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
63 } |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
64 |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
65 /* We only want to look at the peername if we're working on the peer |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
66 * certificate. */ |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
67 if (cert != cx->cert) |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
68 return 1; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
69 |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
70 if ((nm = X509_get_subject_name (cert)) == NULL) { |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
71 sslerror = "internal SSL error"; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
72 return 0; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
73 } |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
74 |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
75 for(lastpos = -1; ; ) { |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
76 X509_NAME_ENTRY *e; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
77 ASN1_STRING *a; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
78 ASN1_STRING *p; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
79 int match; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
80 |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
81 lastpos = X509_NAME_get_index_by_NID(nm, NID_commonName, lastpos); |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
82 if (lastpos == -1) |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
83 break; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
84 if ((e = X509_NAME_get_entry(nm, lastpos)) == NULL) { |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
85 sslerror = "internal SSL error"; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
86 return 0; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
87 } |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
88 if ((a = X509_NAME_ENTRY_get_data(e)) == NULL) { |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
89 sslerror = "internal SSL error"; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
90 return 0; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
91 } |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
92 if ((p = ASN1_STRING_type_new(ASN1_STRING_type(a))) == NULL) { |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
93 sslerror = "internal SSL error"; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
94 return 0; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
95 } |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
96 (void) ASN1_STRING_set(p, peer, -1); |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
97 match = !ASN1_STRING_cmp(a, p); |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
98 ASN1_STRING_free(p); |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
99 if(match) |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
100 return 1; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
101 } |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
102 |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
103 sslerror = "server certificate cn mismatch"; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
104 return 0; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
105 } |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
106 |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
107 static void init(void) { |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
108 if(ctx) |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
109 return; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
110 |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
111 SSL_library_init(); |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
112 SSL_load_error_strings(); |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
113 |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
114 #ifdef HAVE_SSLEAY |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
115 SSLeay_add_all_algorithms(); |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
116 #else |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
117 OpenSSL_add_all_algorithms(); |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
118 #endif |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
119 |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
120 /* May need to use distinct SSLEAY bindings below... */ |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
121 |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
122 //ctx = SSL_CTX_new(SSLv23_method()); |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
123 ctx = SSL_CTX_new(SSLv23_client_method()); |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
124 if(cipherlist) |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
125 (void)SSL_CTX_set_cipher_list(ctx, cipherlist); |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
126 if(cafile || capath) |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
127 (void)SSL_CTX_load_verify_locations(ctx, cafile, capath); |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
128 if(verify) { |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
129 SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, verify_cb); |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
130 if(verify > 0) |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
131 SSL_CTX_set_verify_depth(ctx, verify); |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
132 } else |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
133 SSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, NULL); |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
134 } |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
135 |
| 25 | 136 typedef struct { int fd; SSL *ssl; } sslsock; |
| 137 | |
| 138 static sslsock *socks = 0; | |
| 139 static int sockcount = 0; | |
| 140 | |
| 141 static sslsock *getsock(int fd) { | |
| 142 int i; | |
| 143 | |
| 144 for(i = 0; i < sockcount; i++) | |
| 145 if(socks[i].fd == fd) | |
| 146 return &socks[i]; | |
| 147 | |
| 148 return 0; | |
| 149 } | |
| 150 | |
| 151 static sslsock *addsock(int fd) { | |
| 152 sslsock *p; | |
| 153 socks = (sslsock *) realloc(socks, sizeof(sslsock)*++sockcount); | |
| 154 | |
| 155 p = &socks[sockcount-1]; | |
| 156 | |
|
938
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
157 init (); |
| 25 | 158 |
| 159 p->ssl = SSL_new(ctx); | |
| 160 SSL_set_fd(p->ssl, p->fd = fd); | |
|
938
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
161 sslerror = NULL; |
| 25 | 162 |
| 163 return p; | |
| 164 } | |
| 165 | |
| 166 static void delsock(int fd) { | |
| 167 int i, nsockcount; | |
| 168 sslsock *nsocks; | |
| 169 | |
| 170 nsockcount = 0; | |
| 171 nsocks = (sslsock *) malloc(sizeof(sslsock)*(sockcount-1)); | |
| 172 | |
| 173 for(i = 0; i < sockcount; i++) { | |
| 174 if(socks[i].fd != fd) { | |
| 175 nsocks[nsockcount++] = socks[i]; | |
| 176 } else { | |
| 177 SSL_free(socks[i].ssl); | |
| 178 } | |
| 179 } | |
| 180 | |
| 181 free(socks); | |
| 182 | |
|
955
6be62425dc38
Use current ssl_verify value in /connect
Mikael Berthe <mikael@lilotux.net>
parents:
938
diff
changeset
|
183 SSL_CTX_free(ctx); |
|
6be62425dc38
Use current ssl_verify value in /connect
Mikael Berthe <mikael@lilotux.net>
parents:
938
diff
changeset
|
184 ctx = 0; |
|
6be62425dc38
Use current ssl_verify value in /connect
Mikael Berthe <mikael@lilotux.net>
parents:
938
diff
changeset
|
185 |
| 25 | 186 socks = nsocks; |
| 187 sockcount = nsockcount; | |
| 188 } | |
| 189 | |
|
938
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
190 void cw_set_ssl_options(int sslverify, const char *sslcafile, const char *sslcapath, const char *sslciphers, const char *sslpeer) { |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
191 verify = sslverify; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
192 cafile = sslcafile; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
193 capath = sslcapath; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
194 cipherlist = sslciphers; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
195 peer = sslpeer; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
196 } |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
197 |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
198 const char *cw_get_ssl_error(void) { |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
199 return sslerror; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
200 } |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
201 |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
202 #else |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
203 |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
204 void cw_set_ssl_options(int sslverify, const char *sslcafile, const char *sslcapath, const char *sslciphers, const char *sslpeer) { } |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
205 |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
206 const char *cw_get_ssl_error(void) { |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
207 return NULL; |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
208 } |
|
40175f3dcef7
SSL server certificate verification
Jefferson Ogata <ogata@antibozo.net>
parents:
431
diff
changeset
|
209 |
| 25 | 210 #endif |
| 211 | |
| 212 static char *bindaddr = 0, *proxyhost = 0, *proxyuser = 0, *proxypass = 0; | |
| 213 static int proxyport = 3128; | |
| 214 static int proxy_ssl = 0; | |
| 215 | |
| 216 #define SOCKOUT(s) write(sockfd, s, strlen(s)) | |
| 217 | |
| 218 int cw_http_connect(int sockfd, const struct sockaddr *serv_addr, int addrlen) { | |
| 219 int err, pos, fl; | |
| 220 struct hostent *server; | |
| 221 struct sockaddr_in paddr; | |
| 222 char buf[512]; | |
| 223 fd_set rfds; | |
| 224 | |
|
400
e536ab271584
Kill a warning in the connwrap library
Mikael Berthe <mikael@lilotux.net>
parents:
302
diff
changeset
|
225 fl = 0; |
| 25 | 226 err = 0; |
| 227 in_http_connect = 1; | |
| 228 | |
| 229 if(!(server = gethostbyname(proxyhost))) { | |
| 230 errno = h_errno; | |
| 231 err = -1; | |
| 232 } | |
| 233 | |
| 234 if(!err) { | |
| 235 memset(&paddr, 0, sizeof(paddr)); | |
| 236 paddr.sin_family = AF_INET; | |
| 237 memcpy(&paddr.sin_addr.s_addr, *server->h_addr_list, server->h_length); | |
| 238 paddr.sin_port = htons(proxyport); | |
| 239 | |
| 240 fl = fcntl(sockfd, F_GETFL); | |
| 241 fcntl(sockfd, F_SETFL, fl & ~O_NONBLOCK); | |
| 242 | |
| 243 buf[0] = 0; | |
| 244 | |
| 245 err = cw_connect(sockfd, (struct sockaddr *) &paddr, sizeof(paddr), proxy_ssl); | |
| 246 } | |
| 247 | |
| 248 errno = ECONNREFUSED; | |
| 249 | |
| 250 if(!err) { | |
| 251 struct sockaddr_in *sin = (struct sockaddr_in *) serv_addr; | |
| 252 char *ip = inet_ntoa(sin->sin_addr), c; | |
| 253 struct timeval tv; | |
| 254 | |
| 255 sprintf(buf, "%d", ntohs(sin->sin_port)); | |
| 256 SOCKOUT("CONNECT "); | |
| 257 SOCKOUT(ip); | |
| 258 SOCKOUT(":"); | |
| 259 SOCKOUT(buf); | |
| 260 SOCKOUT(" HTTP/1.0\r\n"); | |
| 261 | |
| 262 if(proxyuser) { | |
| 263 char *b; | |
| 264 SOCKOUT("Proxy-Authorization: Basic "); | |
| 265 | |
|
427
ac85ce87f539
Fix buffer overflow in cw_setproxy()
Mikael Berthe <mikael@lilotux.net>
parents:
414
diff
changeset
|
266 snprintf(buf, sizeof(buf), "%s:%s", proxyuser, proxypass); |
| 25 | 267 b = cw_base64_encode(buf); |
| 268 SOCKOUT(b); | |
| 269 free(b); | |
| 270 | |
| 271 SOCKOUT("\r\n"); | |
| 272 } | |
| 273 | |
| 274 SOCKOUT("\r\n"); | |
| 275 | |
| 276 buf[0] = 0; | |
| 277 | |
| 278 while(err != -1) { | |
| 279 FD_ZERO(&rfds); | |
| 280 FD_SET(sockfd, &rfds); | |
| 281 | |
| 282 tv.tv_sec = PROXY_TIMEOUT; | |
| 283 tv.tv_usec = 0; | |
| 284 | |
| 285 err = select(sockfd+1, &rfds, 0, 0, &tv); | |
| 286 | |
| 287 if(err < 1) err = -1; | |
| 288 | |
| 289 if(err != -1 && FD_ISSET(sockfd, &rfds)) { | |
| 290 err = read(sockfd, &c, 1); | |
| 291 if(!err) err = -1; | |
| 292 | |
| 293 if(err != -1) { | |
| 294 pos = strlen(buf); | |
| 295 buf[pos] = c; | |
| 296 buf[pos+1] = 0; | |
| 297 | |
| 298 if(strlen(buf) > 4) | |
| 299 if(!strcmp(buf+strlen(buf)-4, "\r\n\r\n")) | |
| 300 break; | |
| 301 } | |
| 302 } | |
| 303 } | |
| 304 } | |
| 305 | |
| 306 if(err != -1 && strlen(buf)) { | |
| 307 char *p = strstr(buf, " "); | |
| 308 | |
| 309 err = -1; | |
| 310 | |
| 311 if(p) | |
| 312 if(atoi(++p) == 200) | |
| 313 err = 0; | |
| 314 | |
| 315 fcntl(sockfd, F_SETFL, fl); | |
| 316 if(fl & O_NONBLOCK) { | |
| 317 errno = EINPROGRESS; | |
| 318 err = -1; | |
| 319 } | |
| 320 } | |
| 321 | |
| 322 in_http_connect = 0; | |
| 323 | |
| 324 return err; | |
| 325 } | |
| 326 | |
| 327 int cw_connect(int sockfd, const struct sockaddr *serv_addr, int addrlen, int ssl) { | |
| 328 int rc; | |
| 329 struct sockaddr_in ba; | |
| 330 | |
| 331 if(bindaddr) | |
| 332 if(strlen(bindaddr)) { | |
| 333 #ifdef HAVE_INET_ATON | |
| 334 struct in_addr addr; | |
| 335 rc = inet_aton(bindaddr, &addr); | |
| 336 ba.sin_addr.s_addr = addr.s_addr; | |
| 337 #else | |
| 338 rc = inet_pton(AF_INET, bindaddr, &ba); | |
| 339 #endif | |
| 340 | |
| 341 if(rc) { | |
| 342 ba.sin_port = 0; | |
| 343 rc = bind(sockfd, (struct sockaddr *) &ba, sizeof(ba)); | |
| 344 } else { | |
| 345 rc = -1; | |
| 346 } | |
| 347 | |
| 348 if(rc) return rc; | |
| 349 } | |
| 350 | |
| 351 if(proxyhost && !in_http_connect) rc = cw_http_connect(sockfd, serv_addr, addrlen); | |
| 352 else rc = connect(sockfd, serv_addr, addrlen); | |
| 353 | |
| 354 #ifdef HAVE_OPENSSL | |
| 355 if(ssl && !rc) { | |
| 356 sslsock *p = addsock(sockfd); | |
| 357 if(SSL_connect(p->ssl) != 1) | |
| 358 return -1; | |
| 359 } | |
| 360 #endif | |
| 361 | |
| 362 return rc; | |
| 363 } | |
| 364 | |
| 365 int cw_nb_connect(int sockfd, const struct sockaddr *serv_addr, int addrlen, int ssl, int *state) { | |
| 366 int rc = 0; | |
| 367 struct sockaddr_in ba; | |
| 368 | |
| 369 if(bindaddr) | |
| 370 if(strlen(bindaddr)) { | |
| 371 #ifdef HAVE_INET_ATON | |
| 372 struct in_addr addr; | |
| 373 rc = inet_aton(bindaddr, &addr); | |
| 374 ba.sin_addr.s_addr = addr.s_addr; | |
| 375 #else | |
| 376 rc = inet_pton(AF_INET, bindaddr, &ba); | |
| 377 #endif | |
| 378 | |
| 379 if(rc) { | |
| 380 ba.sin_port = 0; | |
| 381 rc = bind(sockfd, (struct sockaddr *) &ba, sizeof(ba)); | |
| 382 } else { | |
| 383 rc = -1; | |
| 384 } | |
| 385 | |
| 386 if(rc) return rc; | |
| 387 } | |
| 388 | |
| 389 #ifdef HAVE_OPENSSL | |
| 390 if(ssl) { | |
| 391 if ( !(*state & CW_CONNECT_WANT_SOMETHING)) | |
| 392 rc = cw_connect(sockfd, serv_addr, addrlen, 0); | |
| 393 else{ /* check if the socket is connected correctly */ | |
| 394 int optlen = sizeof(int), optval; | |
| 235 | 395 if (getsockopt(sockfd, SOL_SOCKET, SO_ERROR, &optval, (socklen_t*)&optlen) || optval) |
| 25 | 396 return -1; |
| 397 } | |
| 398 | |
| 399 if(!rc) { | |
| 400 sslsock *p; | |
| 401 if (*state & CW_CONNECT_SSL) | |
| 402 p = getsock(sockfd); | |
| 403 else | |
| 404 p = addsock(sockfd); | |
|
414
ec86d759ed54
Trailing whitespace cleanup
Mikael Berthe <mikael@lilotux.net>
parents:
409
diff
changeset
|
405 |
| 25 | 406 rc = SSL_connect(p->ssl); |
| 407 switch(rc){ | |
| 408 case 1: | |
| 409 *state = 0; | |
| 410 return 0; | |
| 411 case 0: | |
| 412 return -1; | |
| 413 default: | |
| 414 switch (SSL_get_error(p->ssl, rc)){ | |
| 415 case SSL_ERROR_WANT_READ: | |
| 416 *state = CW_CONNECT_SSL | CW_CONNECT_WANT_READ; | |
| 417 return 0; | |
| 418 case SSL_ERROR_WANT_WRITE: | |
| 419 *state = CW_CONNECT_SSL | CW_CONNECT_WANT_WRITE; | |
| 420 return 0; | |
| 421 default: | |
| 422 return -1; | |
| 423 } | |
| 424 } | |
| 425 } | |
| 426 else{ /* catch EINPROGRESS error from the connect call */ | |
| 427 if (errno == EINPROGRESS){ | |
| 428 *state = CW_CONNECT_STARTED | CW_CONNECT_WANT_WRITE; | |
| 429 return 0; | |
| 430 } | |
| 431 } | |
| 432 | |
| 433 return rc; | |
| 434 } | |
| 435 #endif | |
| 436 if ( !(*state & CW_CONNECT_WANT_SOMETHING)) | |
| 437 rc = connect(sockfd, serv_addr, addrlen); | |
| 438 else{ /* check if the socket is connected correctly */ | |
| 439 int optlen = sizeof(int), optval; | |
| 235 | 440 if (getsockopt(sockfd, SOL_SOCKET, SO_ERROR, &optval, (socklen_t*)&optlen) || optval) |
| 25 | 441 return -1; |
| 442 *state = 0; | |
| 443 return 0; | |
| 444 } | |
| 445 if (rc) | |
| 446 if (errno == EINPROGRESS){ | |
| 447 *state = CW_CONNECT_STARTED | CW_CONNECT_WANT_WRITE; | |
| 448 return 0; | |
| 449 } | |
| 450 return rc; | |
| 451 } | |
| 452 | |
| 453 int cw_accept(int s, struct sockaddr *addr, int *addrlen, int ssl) { | |
| 454 #ifdef HAVE_OPENSSL | |
| 455 int rc; | |
| 456 | |
| 457 if(ssl) { | |
| 235 | 458 rc = accept(s, addr, (socklen_t*)addrlen); |
| 25 | 459 |
| 460 if(!rc) { | |
| 461 sslsock *p = addsock(s); | |
| 462 if(SSL_accept(p->ssl) != 1) | |
| 463 return -1; | |
| 464 | |
| 465 } | |
| 466 | |
| 467 return rc; | |
| 468 } | |
| 469 #endif | |
| 235 | 470 return accept(s, addr, (socklen_t*)addrlen); |
| 25 | 471 } |
| 472 | |
| 473 int cw_write(int fd, const void *buf, int count, int ssl) { | |
| 474 #ifdef HAVE_OPENSSL | |
| 475 sslsock *p; | |
| 476 | |
| 477 if(ssl) | |
| 235 | 478 if((p = getsock(fd)) != NULL) |
| 25 | 479 return SSL_write(p->ssl, buf, count); |
| 480 #endif | |
| 481 return write(fd, buf, count); | |
| 482 } | |
| 483 | |
| 484 int cw_read(int fd, void *buf, int count, int ssl) { | |
| 485 #ifdef HAVE_OPENSSL | |
| 486 sslsock *p; | |
| 487 | |
| 488 if(ssl) | |
| 235 | 489 if((p = getsock(fd)) != NULL) |
| 25 | 490 return SSL_read(p->ssl, buf, count); |
| 491 #endif | |
| 492 return read(fd, buf, count); | |
| 493 } | |
| 494 | |
| 235 | 495 void cw_close(int fd) { |
| 25 | 496 #ifdef HAVE_OPENSSL |
| 497 delsock(fd); | |
| 498 #endif | |
| 499 close(fd); | |
| 500 } | |
| 501 | |
| 502 #define FREEVAR(v) if(v) free(v), v = 0; | |
| 503 | |
| 504 void cw_setbind(const char *abindaddr) { | |
| 505 FREEVAR(bindaddr); | |
| 506 bindaddr = strdup(abindaddr); | |
| 507 } | |
| 508 | |
| 509 void cw_setproxy(const char *aproxyhost, int aproxyport, const char *aproxyuser, const char *aproxypass) { | |
| 510 FREEVAR(proxyhost); | |
| 511 FREEVAR(proxyuser); | |
| 512 FREEVAR(proxypass); | |
| 513 | |
| 514 if(aproxyhost && strlen(aproxyhost)) proxyhost = strdup(aproxyhost); | |
| 515 if(aproxyuser && strlen(aproxyuser)) proxyuser = strdup(aproxyuser); | |
| 516 if(aproxypass && strlen(aproxypass)) proxypass = strdup(aproxypass); | |
| 517 proxyport = aproxyport; | |
| 518 } | |
| 519 | |
| 520 char *cw_base64_encode(const char *in) { | |
| 521 static char base64digits[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789._"; | |
| 522 | |
| 523 int j = 0; | |
| 524 int inlen = strlen(in); | |
| 525 char *out = (char *) malloc(inlen*4+1), c; | |
| 526 | |
| 527 for(out[0] = 0; inlen >= 3; inlen -= 3) { | |
| 528 strncat(out, &base64digits[ in[j] >> 2 ], 1); | |
| 529 strncat(out, &base64digits[ ((in[j] << 4) & 0x30) | (in[j+1] >> 4) ], 1); | |
| 530 strncat(out, &base64digits[ ((in[j+1] << 2) & 0x3c) | (in[j+2] >> 6) ], 1); | |
| 531 strncat(out, &base64digits[ in[j+2] & 0x3f ], 1); | |
| 532 j += 3; | |
| 533 } | |
| 534 | |
| 535 if(inlen > 0) { | |
| 536 unsigned char fragment; | |
| 537 | |
| 538 strncat(out, &base64digits[in[j] >> 2], 1); | |
| 539 fragment = (in[j] << 4) & 0x30; | |
| 540 | |
| 541 if(inlen > 1) | |
| 542 fragment |= in[j+1] >> 4; | |
| 543 | |
| 544 strncat(out, &base64digits[fragment], 1); | |
| 545 | |
| 546 c = (inlen < 2) ? '-' : base64digits[ (in[j+1] << 2) & 0x3c ]; | |
| 547 strncat(out, &c, 1); | |
| 548 c = '-'; | |
| 549 strncat(out, &c, 1); | |
| 550 } | |
|
414
ec86d759ed54
Trailing whitespace cleanup
Mikael Berthe <mikael@lilotux.net>
parents:
409
diff
changeset
|
551 |
| 25 | 552 return out; |
| 553 } |