X-Git-Url: http://pileus.org/git/?a=blobdiff_plain;f=socket.c;h=58a8e15e807e4258a717933b5603da522c08473f;hb=53293ee30678d3db753e51820cc554c0b2b1bd97;hp=10cd5d99bbdcffc3834255ce9facfbed5ccd3380;hpb=c3e52ea6ca3178b7ecab4b389a9ba9269662b48f;p=~andy%2Ffetchmail diff --git a/socket.c b/socket.c index 10cd5d99..58a8e15e 100644 --- a/socket.c +++ b/socket.c @@ -52,6 +52,7 @@ #include "fetchmail.h" #include "getaddrinfo.h" #include "i18n.h" +#include "sdump.h" /* Defines to allow BeOS and Cygwin to play nice... */ #ifdef __BEOS__ @@ -74,20 +75,15 @@ static ssize_t cygwin_read(int sock, void *buf, size_t count); /* We need to define h_errno only if it is not already */ #ifndef h_errno - -#ifdef HAVE_RES_SEARCH -/* some versions of FreeBSD should declare this but don't */ +# if !HAVE_DECL_H_ERRNO extern int h_errno; -#else -/* pretend we have h_errno to avoid some #ifdef's later */ -static int h_errno; -#endif - +# endif #endif /* ndef h_errno */ #ifdef HAVE_SOCKETPAIR static char *const *parse_plugin(const char *plugin, const char *host, const char *service) -{ const char **argvec; +{ + char **argvec; const char *c, *p; char *cp, *plugin_copy; unsigned int plugin_copy_len; @@ -134,25 +130,26 @@ static char *const *parse_plugin(const char *plugin, const char *host, const cha } plugin_copy[plugin_copy_len] = 0; - argvec = (const char **)malloc(s); + argvec = (char **)malloc(s); if (!argvec) { + free(plugin_copy); report(stderr, GT_("fetchmail: malloc failed\n")); return NULL; } memset(argvec, 0, s); - for (c = p = plugin_copy, i = 0; *c; c++) - { if ((!isspace((unsigned char)*c)) && (c == p ? 1 : isspace((unsigned char)*p))) { - argvec[i] = c; + for (p = cp = plugin_copy, i = 0; *cp; cp++) + { if ((!isspace((unsigned char)*cp)) && (cp == p ? 1 : isspace((unsigned char)*p))) { + argvec[i] = cp; i++; } - p = c; + p = cp; } for (cp = plugin_copy; *cp; cp++) { if (isspace((unsigned char)*cp)) *cp = 0; } - return (char *const*)argvec; + return argvec; } static int handle_plugin(const char *host, @@ -183,16 +180,18 @@ static int handle_plugin(const char *host, (void) close(fds[1]); if ( (dup2(fds[0],0) == -1) || (dup2(fds[0],1) == -1) ) { report(stderr, GT_("dup2 failed\n")); - exit(1); + _exit(EXIT_FAILURE); } /* fds[0] is now connected to 0 and 1; close it */ (void) close(fds[0]); if (outlevel >= O_VERBOSE) report(stderr, GT_("running %s (host %s service %s)\n"), plugin, host, service); argvec = parse_plugin(plugin,host,service); + if (argvec == NULL) + _exit(EXIT_FAILURE); execvp(*argvec, argvec); report(stderr, GT_("execvp(%s) failed\n"), *argvec); - exit(0); + _exit(EXIT_FAILURE); break; default: /* parent */ /* NOP */ @@ -204,29 +203,11 @@ static int handle_plugin(const char *host, } #endif /* HAVE_SOCKETPAIR */ -#ifdef __UNUSED__ - -int SockCheckOpen(int fd) -/* poll given socket; is it selectable? */ -{ - fd_set r, w, e; - int rt; - struct timeval tv; - - for (;;) - { - FD_ZERO(&r); FD_ZERO(&w); FD_ZERO(&e); - FD_SET(fd, &e); - - tv.tv_sec = 0; tv.tv_usec = 0; - rt = select(fd+1, &r, &w, &e, &tv); - if (rt == -1 && (errno != EAGAIN && errno != EINTR)) - return 0; - if (rt != -1) - return 1; - } +/** Set socket to SO_KEEPALIVE. \return 0 for success. */ +int SockKeepalive(int sock) { + int keepalive = 1; + return setsockopt(sock, SOL_SOCKET, SO_KEEPALIVE, &keepalive, sizeof keepalive); } -#endif /* __UNUSED__ */ int UnixOpen(const char *path) { @@ -243,12 +224,12 @@ int UnixOpen(const char *path) return -1; } - /* Socket opened saved. Usefull if connect timeout - * because it can be closed. - */ - mailserver_socket_temp = sock; - - if (connect(sock, (struct sockaddr *) &ad, sizeof(ad)) < 0) + /* Socket opened saved. Usefull if connect timeout + * because it can be closed. + */ + mailserver_socket_temp = sock; + + if (connect(sock, (struct sockaddr *) &ad, sizeof(ad)) < 0) { int olderr = errno; fm_close(sock); /* don't use SockClose, no traffic yet */ @@ -256,27 +237,33 @@ int UnixOpen(const char *path) errno = olderr; sock = -1; } - - /* No connect timeout, then no need to set mailserver_socket_temp */ - mailserver_socket_temp = -1; + + /* No connect timeout, then no need to set mailserver_socket_temp */ + mailserver_socket_temp = -1; return sock; } int SockOpen(const char *host, const char *service, - const char *plugin) + const char *plugin, struct addrinfo **ai0) { - struct addrinfo *ai, *ai0, req; - int i; + struct addrinfo *ai, req; + int i, acterr = 0; + int ord; + char errbuf[8192] = ""; #ifdef HAVE_SOCKETPAIR if (plugin) return handle_plugin(host,service,plugin); #endif /* HAVE_SOCKETPAIR */ + memset(&req, 0, sizeof(struct addrinfo)); req.ai_socktype = SOCK_STREAM; +#ifdef AI_ADDRCONFIG + req.ai_flags = AI_ADDRCONFIG; +#endif - i = getaddrinfo(host, service, &req, &ai0); + i = fm_getaddrinfo(host, service, &req, ai0); if (i) { report(stderr, GT_("getaddrinfo(\"%s\",\"%s\") error: %s\n"), host, service, gai_strerror(i)); @@ -285,30 +272,76 @@ int SockOpen(const char *host, const char *service, return -1; } + /* NOTE a Linux bug here - getaddrinfo will happily return 127.0.0.1 + * twice if no IPv6 is configured */ i = -1; - for (ai = ai0; ai; ai = ai->ai_next) { - i = socket(ai->ai_family, ai->ai_socktype, 0); - if (i < 0) + for (ord = 0, ai = *ai0; ai; ord++, ai = ai->ai_next) { + char buf[256]; /* hostname */ + char pb[256]; /* service name */ + int gnie; /* getnameinfo result code */ + + gnie = getnameinfo(ai->ai_addr, ai->ai_addrlen, buf, sizeof(buf), NULL, 0, NI_NUMERICHOST); + if (gnie) + snprintf(buf, sizeof(buf), GT_("unknown (%s)"), gai_strerror(gnie)); + gnie = getnameinfo(ai->ai_addr, ai->ai_addrlen, NULL, 0, pb, sizeof(pb), NI_NUMERICSERV); + if (gnie) + snprintf(pb, sizeof(pb), GT_("unknown (%s)"), gai_strerror(gnie)); + + if (outlevel >= O_VERBOSE) + report_build(stdout, GT_("Trying to connect to %s/%s..."), buf, pb); + i = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol); + if (i < 0) { + int e = errno; + /* mask EAFNOSUPPORT errors, they confuse users for + * multihomed hosts */ + if (errno != EAFNOSUPPORT) + acterr = errno; + if (outlevel >= O_VERBOSE) + report_complete(stdout, GT_("cannot create socket: %s\n"), strerror(e)); + snprintf(errbuf+strlen(errbuf), sizeof(errbuf)-strlen(errbuf),\ + GT_("name %d: cannot create socket family %d type %d: %s\n"), ord, ai->ai_family, ai->ai_socktype, strerror(e)); continue; + } - /* Socket opened saved. Usefull if connect timeout - * because it can be closed. - */ + SockKeepalive(i); + + /* Save socket descriptor. + * Used to close the socket after connect timeout. */ mailserver_socket_temp = i; if (connect(i, (struct sockaddr *) ai->ai_addr, ai->ai_addrlen) < 0) { + int e = errno; + + /* additionally, suppress IPv4 network unreach errors */ + if (e != EAFNOSUPPORT) + acterr = errno; + + if (outlevel >= O_VERBOSE) + report_complete(stdout, GT_("connection failed.\n")); + if (outlevel >= O_VERBOSE) + report(stderr, GT_("connection to %s:%s [%s/%s] failed: %s.\n"), host, service, buf, pb, strerror(e)); + snprintf(errbuf+strlen(errbuf), sizeof(errbuf)-strlen(errbuf), GT_("name %d: connection to %s:%s [%s/%s] failed: %s.\n"), ord, host, service, buf, pb, strerror(e)); fm_close(i); i = -1; continue; + } else { + if (outlevel >= O_VERBOSE) + report_complete(stdout, GT_("connected.\n")); } - + /* No connect timeout, then no need to set mailserver_socket_temp */ mailserver_socket_temp = -1; - + break; } - freeaddrinfo(ai0); + fm_freeaddrinfo(*ai0); + *ai0 = NULL; + + if (i == -1) { + report(stderr, GT_("Connection errors for this poll:\n%s"), errbuf); + errno = acterr; + } return i; } @@ -345,13 +378,27 @@ va_dcl { #include #include -static SSL_CTX *_ctx = NULL; +static void report_SSL_errors(FILE *stream) +{ + unsigned long err; + + while (0ul != (err = ERR_get_error())) { + char *errstr = ERR_error_string(err, NULL); + report(stream, GT_("OpenSSL reported: %s\n"), errstr); + } +} + +/* override ERR_print_errors_fp to our own implementation */ +#undef ERR_print_errors_fp +#define ERR_print_errors_fp(stream) report_SSL_errors((stream)) + +static SSL_CTX *_ctx[FD_SETSIZE]; static SSL *_ssl_context[FD_SETSIZE]; static SSL *SSLGetContext( int ); #endif /* SSL_ENABLE */ -int SockWrite(int sock, char *buf, int len) +int SockWrite(int sock, const char *buf, int len) { int n, wrlen = 0; #ifdef SSL_ENABLE @@ -379,9 +426,6 @@ int SockRead(int sock, char *buf, int len) { char *newline, *bp = buf; int n; -#ifdef FORCE_STUFFING - int maxavailable = 0; -#endif #ifdef SSL_ENABLE SSL *ssl; #endif @@ -409,7 +453,7 @@ int SockRead(int sock, char *buf, int len) /* OK... SSL_peek works a little different from MSG_PEEK Problem is that SSL_peek can return 0 if there is no data currently available. If, on the other - hand, we loose the socket, we also get a zero, but + hand, we lose the socket, we also get a zero, but the SSL_read then SEGFAULTS! To deal with this, we'll check the error code any time we get a return of zero from SSL_peek. If we have an error, we bail. @@ -421,14 +465,11 @@ int SockRead(int sock, char *buf, int len) (void)SSL_get_error(ssl, n); return(-1); } -#ifdef FORCE_STUFFING - maxavailable = n; -#endif if( 0 == n ) { /* SSL_peek says no data... Does he mean no data or did the connection blow up? If we got an error then bail! */ - if( 0 != ( n = SSL_get_error(ssl, n) ) ) { + if (0 != SSL_get_error(ssl, n)) { return -1; } /* We didn't get an error so read at least one @@ -438,10 +479,10 @@ int SockRead(int sock, char *buf, int len) * We don't have a string to pass through * the strchr at this point yet */ newline = NULL; - } else if ((newline = memchr(bp, '\n', n)) != NULL) + } else if ((newline = (char *)memchr(bp, '\n', n)) != NULL) n = newline - bp + 1; /* Matthias Andree: SSL_read can return 0, in that case - * we must cal SSL_get_error to figure if there was + * we must call SSL_get_error to figure if there was * an error or just a "no data" condition */ if ((n = SSL_read(ssl, bp, n)) <= 0) { if ((n = SSL_get_error(ssl, n))) { @@ -467,9 +508,6 @@ int SockRead(int sock, char *buf, int len) if ((n = fm_peek(sock, bp, len)) <= 0) #endif return (-1); -#ifdef FORCE_STUFFING - maxavailable = n; -#endif if ((newline = (char *)memchr(bp, '\n', n)) != NULL) n = newline - bp + 1; #ifndef __BEOS__ @@ -483,46 +521,6 @@ int SockRead(int sock, char *buf, int len) (!newline && len); *bp = '\0'; -#ifdef FORCE_STUFFING /* too ugly to live -- besides, there's IMAP */ - /* OK, very weird hack coming up here: - * When POP3 servers send us a message, they're supposed to - * terminate the message with a line containing only a dot. To protect - * against lines in the real message that might contain only a dot, - * they're supposed to preface any line that starts with a dot with - * an additional dot, which will be removed on the client side. That - * process, called byte-stuffing (and unstuffing) is really not the - * concern of this low-level routine, ordinarily, but there are some - * POP servers (and maybe IMAP servers too, who knows) that fail to - * do the byte-stuffing, and this routine is the best place to try to - * identify and fix that fault. - * - * Since the DOT line is supposed to come only at the end of a - * message, the implication is that right after we see it, the server - * is supposed to go back to waiting for the next command. There - * isn't supposed to be any more data to read after we see the dot. - * THEREFORE, if we see more data to be read after something that - * looks like the dot line, then probably the server is failing to - * do byte-stuffing. In that case, we'll byte-pack it for them so - * that the higher-level routines see things as hunky-dorey. - * This is not a perfect test or fix by any means (it has an - * obvious race condition, for one thing), but it should at least - * reduce the nastiness that ensues when people don't know how - * to write POP servers. - */ - if ((maxavailable > (bp-buf)) && - ((((bp-buf) == 3) && - (buf[0] == '.') && - (buf[1] == '\r') && - (buf[2] == '\n')) || - (((bp-buf) == 2) && - (buf[0] == '.') && - (buf[1] == '\n')))) { - - memmove(buf+1, buf, (bp-buf)+1); - buf[0] = '.'; - bp++; - } -#endif /* FORCE_STUFFING */ return bp - buf; } @@ -551,7 +549,7 @@ int SockPeek(int sock) /* SSL_peek says 0... Does that mean no data or did the connection blow up? If we got an error then bail! */ - if( 0 != ( n = SSL_get_error(ssl, n) ) ) { + if(0 != SSL_get_error(ssl, n)) { return -1; } @@ -583,25 +581,25 @@ static int _check_fp; static char *_check_digest; static char *_server_label; static int _depth0ck; +static int _firstrun; static int _prev_err; +static int _verify_ok; SSL *SSLGetContext( int sock ) { - /* If SSLOpen has never initialized - just return NULL */ - if( NULL == _ctx ) + if( sock < 0 || (unsigned)sock > FD_SETSIZE ) return NULL; - - if( sock < 0 || sock > FD_SETSIZE ) + if( _ctx[sock] == NULL ) return NULL; return _ssl_context[sock]; } - /* ok_return (preverify_ok) is 1 if this stage of certificate verification passed, or 0 if it failed. This callback lets us display informative errors, and perform additional validation (e.g. CN matches) */ static int SSL_verify_callback( int ok_return, X509_STORE_CTX *ctx, int strict ) { +#define SSLverbose (((outlevel) >= O_DEBUG) || ((outlevel) >= O_VERBOSE && (depth) == 0)) char buf[257]; X509 *x509_cert; int err, depth, i; @@ -610,6 +608,7 @@ static int SSL_verify_callback( int ok_return, X509_STORE_CTX *ctx, int strict ) const EVP_MD *digest_tp; unsigned int dsz, esz; X509_NAME *subj, *issuer; + char *tt; x509_cert = X509_STORE_CTX_get_current_cert(ctx); err = X509_STORE_CTX_get_error(ctx); @@ -618,79 +617,108 @@ static int SSL_verify_callback( int ok_return, X509_STORE_CTX *ctx, int strict ) subj = X509_get_subject_name(x509_cert); issuer = X509_get_issuer_name(x509_cert); - if (depth == 0 && !_depth0ck) { - _depth0ck = 1; - - if (outlevel >= O_VERBOSE) { + if (outlevel >= O_VERBOSE) { + if (depth == 0 && SSLverbose) + report(stdout, GT_("Server certificate:\n")); + else { + if (_firstrun) { + _firstrun = 0; + if (SSLverbose) + report(stdout, GT_("Certificate chain, from root to peer, starting at depth %d:\n"), depth); + } else { + if (SSLverbose) + report(stdout, GT_("Certificate at depth %d:\n"), depth); + } + } + + if (SSLverbose) { if ((i = X509_NAME_get_text_by_NID(issuer, NID_organizationName, buf, sizeof(buf))) != -1) { - report(stdout, GT_("Issuer Organization: %s\n"), buf); + report(stdout, GT_("Issuer Organization: %s\n"), (tt = sdump(buf, i))); + xfree(tt); if ((size_t)i >= sizeof(buf) - 1) report(stdout, GT_("Warning: Issuer Organization Name too long (possibly truncated).\n")); } else report(stdout, GT_("Unknown Organization\n")); if ((i = X509_NAME_get_text_by_NID(issuer, NID_commonName, buf, sizeof(buf))) != -1) { - report(stdout, GT_("Issuer CommonName: %s\n"), buf); + report(stdout, GT_("Issuer CommonName: %s\n"), (tt = sdump(buf, i))); + xfree(tt); if ((size_t)i >= sizeof(buf) - 1) report(stdout, GT_("Warning: Issuer CommonName too long (possibly truncated).\n")); } else report(stdout, GT_("Unknown Issuer CommonName\n")); } + } + + if ((i = X509_NAME_get_text_by_NID(subj, NID_commonName, buf, sizeof(buf))) != -1) { + if (SSLverbose) { + report(stdout, GT_("Subject CommonName: %s\n"), (tt = sdump(buf, i))); + xfree(tt); + } + if ((size_t)i >= sizeof(buf) - 1) { + /* Possible truncation. In this case, this is a DNS name, so this + * is really bad. We do not tolerate this even in the non-strict case. */ + report(stderr, GT_("Bad certificate: Subject CommonName too long!\n")); + return (0); + } + if ((size_t)i > strlen(buf)) { + /* Name contains embedded NUL characters, so we complain. This is likely + * a certificate spoofing attack. */ + report(stderr, GT_("Bad certificate: Subject CommonName contains NUL, aborting!\n")); + return 0; + } + } + + if (depth == 0) { /* peer certificate */ + if (!_depth0ck) { + _depth0ck = 1; + } + if ((i = X509_NAME_get_text_by_NID(subj, NID_commonName, buf, sizeof(buf))) != -1) { - if (outlevel >= O_VERBOSE) - report(stdout, GT_("Server CommonName: %s\n"), buf); - if ((size_t)i >= sizeof(buf) - 1) { - /* Possible truncation. In this case, this is a DNS name, so this - * is really bad. We do not tolerate this even in the non-strict case. */ - report(stderr, GT_("Bad certificate: Subject CommonName too long!\n")); - return (0); - } if (_ssl_server_cname != NULL) { char *p1 = buf; char *p2 = _ssl_server_cname; - int n; int matched = 0; STACK_OF(GENERAL_NAME) *gens; - + /* RFC 2595 section 2.4: find a matching name * first find a match among alternative names */ - gens = X509_get_ext_d2i(x509_cert, NID_subject_alt_name, NULL, NULL); + gens = (STACK_OF(GENERAL_NAME) *)X509_get_ext_d2i(x509_cert, NID_subject_alt_name, NULL, NULL); if (gens) { - int i, r; - for (i = 0, r = sk_GENERAL_NAME_num(gens); i < r; ++i) { - const GENERAL_NAME *gn = sk_GENERAL_NAME_value(gens, i); + int j, r; + for (j = 0, r = sk_GENERAL_NAME_num(gens); j < r; ++j) { + const GENERAL_NAME *gn = sk_GENERAL_NAME_value(gens, j); if (gn->type == GEN_DNS) { - char *p1 = (char *)gn->d.ia5->data; - char *p2 = _ssl_server_cname; - if (outlevel >= O_VERBOSE) - report(stderr, "Subject Alternative Name: %s\n", p1); - if (*p1 == '*') { - ++p1; - n = strlen(p2) - strlen(p1); - if (n >= 0) - p2 += n; + char *pp1 = (char *)gn->d.ia5->data; + char *pp2 = _ssl_server_cname; + if (outlevel >= O_VERBOSE) { + report(stdout, GT_("Subject Alternative Name: %s\n"), (tt = sdump(pp1, (size_t)gn->d.ia5->length))); + xfree(tt); + } + /* Name contains embedded NUL characters, so we complain. This + * is likely a certificate spoofing attack. */ + if ((size_t)gn->d.ia5->length != strlen(pp1)) { + report(stderr, GT_("Bad certificate: Subject Alternative Name contains NUL, aborting!\n")); + sk_GENERAL_NAME_free(gens); + return 0; } - if (0 == strcasecmp(p1, p2)) { - matched = 1; + if (name_match(pp1, pp2)) { + matched = 1; } } } - sk_GENERAL_NAME_free(gens); + GENERAL_NAMES_free(gens); } - if (*p1 == '*') { - ++p1; - n = strlen(p2) - strlen(p1); - if (n >= 0) - p2 += n; - } - if (0 == strcasecmp(p1, p2)) { - matched = 1; + if (name_match(p1, p2)) { + matched = 1; } if (!matched) { - report(stderr, - GT_("Server CommonName mismatch: %s != %s\n"), - buf, _ssl_server_cname ); - if (ok_return && strict) - return (0); + if (strict || SSLverbose) { + report(stderr, + GT_("Server CommonName mismatch: %s != %s\n"), + (tt = sdump(buf, i)), _ssl_server_cname ); + xfree(tt); + } + ok_return = 0; } } else if (ok_return) { report(stderr, GT_("Server name not set, could not verify certificate!\n")); @@ -706,10 +734,10 @@ static int SSL_verify_callback( int ok_return, X509_STORE_CTX *ctx, int strict ) } /* Print the finger print. Note that on errors, we might print it more than once * normally; we kluge around that by using a global variable. */ - if (_check_fp) { + if (_check_fp == 1) { unsigned dp; - _check_fp = 0; + _check_fp = -1; digest_tp = EVP_md5(); if (digest_tp == NULL) { report(stderr, GT_("EVP_md5() failed!\n")); @@ -732,27 +760,58 @@ static int SSL_verify_callback( int ok_return, X509_STORE_CTX *ctx, int strict ) if (outlevel > O_NORMAL) report(stdout, GT_("%s key fingerprint: %s\n"), _server_label, text); if (_check_digest != NULL) { - if (strcmp(text, _check_digest) == 0) { + if (strcasecmp(text, _check_digest) == 0) { if (outlevel > O_NORMAL) report(stdout, GT_("%s fingerprints match.\n"), _server_label); } else { - if (outlevel > O_SILENT) - report(stderr, GT_("%s fingerprints do not match!\n"), _server_label); + report(stderr, GT_("%s fingerprints do not match!\n"), _server_label); return (0); } - } - } - } + } /* if (_check_digest != NULL) */ + } /* if (_check_fp) */ + } /* if (depth == 0 && !_depth0ck) */ + + if (err != X509_V_OK && err != _prev_err && !(_check_fp != 0 && _check_digest && !strict)) { + char *tmp; + int did_rep_err = 0; + _prev_err = err; + + report(stderr, GT_("Server certificate verification error: %s\n"), X509_verify_cert_error_string(err)); + /* We gave the error code, but maybe we can add some more details for debugging */ - if (err != X509_V_OK && err != _prev_err) { - _prev_err = err; - report(stderr, GT_("Server certificate verification error: %s\n"), X509_verify_cert_error_string(err)); - /* We gave the error code, but maybe we can add some more details for debugging */ switch (err) { + /* actually we do not want to lump these together, but + * since OpenSSL flipped the meaning of these error + * codes in the past, and they do hardly make a + * practical difference because servers need not provide + * the root signing certificate, we don't bother telling + * users the difference: + */ + case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY: case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT: X509_NAME_oneline(issuer, buf, sizeof(buf)); buf[sizeof(buf) - 1] = '\0'; - report(stderr, GT_("unknown issuer (first %d characters): %s\n"), sizeof(buf)-1, buf); + report(stderr, GT_("Broken certification chain at: %s\n"), (tmp = sdump(buf, strlen(buf)))); + xfree(tmp); + report(stderr, GT_( "This could mean that the server did not provide the intermediate CA's certificate(s), " + "which is nothing fetchmail could do anything about. For details, " + "please see the README.SSL-SERVER document that ships with fetchmail.\n")); + did_rep_err = 1; + /* FALLTHROUGH */ + case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT: + case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN: + if (!did_rep_err) { + X509_NAME_oneline(issuer, buf, sizeof(buf)); + buf[sizeof(buf) - 1] = '\0'; + report(stderr, GT_("Missing trust anchor certificate: %s\n"), (tmp = sdump(buf, strlen(buf)))); + xfree(tmp); + } + report(stderr, GT_( "This could mean that the root CA's signing certificate is not in the " + "trusted CA certificate location, or that c_rehash needs to be run " + "on the certificate directory. For details, please " + "see the documentation of --sslcertpath and --sslcertfile in the manual page.\n")); + break; + default: break; } } @@ -760,6 +819,7 @@ static int SSL_verify_callback( int ok_return, X509_STORE_CTX *ctx, int strict ) * If not in strict checking mode (--sslcertck), override this * and pretend that verification had succeeded. */ + _verify_ok &= ok_return; if (!strict) ok_return = 1; return (ok_return); @@ -775,20 +835,53 @@ static int SSL_ck_verify_callback( int ok_return, X509_STORE_CTX *ctx ) return SSL_verify_callback(ok_return, ctx, 1); } + +/* get commonName from certificate set in file. + * commonName is stored in buffer namebuffer, limited with namebufferlen + */ +static const char *SSLCertGetCN(const char *mycert, + char *namebuffer, size_t namebufferlen) +{ + const char *ret = NULL; + BIO *certBio = NULL; + X509 *x509_cert = NULL; + X509_NAME *certname = NULL; + + if (namebuffer && namebufferlen > 0) { + namebuffer[0] = 0x00; + certBio = BIO_new_file(mycert,"r"); + if (certBio) { + x509_cert = PEM_read_bio_X509(certBio,NULL,NULL,NULL); + BIO_free(certBio); + } + if (x509_cert) { + certname = X509_get_subject_name(x509_cert); + if (certname && + X509_NAME_get_text_by_NID(certname, NID_commonName, + namebuffer, namebufferlen) > 0) + ret = namebuffer; + X509_free(x509_cert); + } + } + return ret; +} + /* performs initial SSL handshake over the connected socket * uses SSL *ssl global variable, which is currently defined * in this file */ -int SSLOpen(int sock, char *mycert, char *mykey, char *myproto, int certck, char *certpath, - char *fingerprint, char *servercname, char *label) +int SSLOpen(int sock, char *mycert, char *mykey, const char *myproto, int certck, + char *cacertfile, char *certpath, + char *fingerprint, char *servercname, char *label, char **remotename) { struct stat randstat; int i; + long sslopts = SSL_OP_ALL; SSL_load_error_strings(); - SSLeay_add_ssl_algorithms(); - -#ifdef SSL_ENABLE + SSL_library_init(); + OpenSSL_add_all_algorithms(); /* see Debian Bug#576430 and manpage */ + if (stat("/dev/random", &randstat) && stat("/dev/urandom", &randstat)) { /* Neither /dev/random nor /dev/urandom are present, so add @@ -804,56 +897,82 @@ int SSLOpen(int sock, char *mycert, char *mykey, char *myproto, int certck, char RAND_add (buf, sizeof buf, 0.1); } } -#endif /* SSL_ENABLE */ - - if( sock < 0 || sock > FD_SETSIZE ) { + if( sock < 0 || (unsigned)sock > FD_SETSIZE ) { report(stderr, GT_("File descriptor out of range for SSL") ); return( -1 ); } - if( ! _ctx ) { - /* Be picky and make sure the memory is cleared */ - memset( _ssl_context, 0, sizeof( _ssl_context ) ); - if(myproto) { - if(!strcmp("ssl2",myproto)) { - _ctx = SSL_CTX_new(SSLv2_client_method()); - } else if(!strcmp("ssl3",myproto)) { - _ctx = SSL_CTX_new(SSLv3_client_method()); - } else if(!strcmp("tls1",myproto)) { - _ctx = SSL_CTX_new(TLSv1_client_method()); - } else if (!strcmp("ssl23",myproto)) { - myproto = NULL; - } else { - fprintf(stderr,GT_("Invalid SSL protocol '%s' specified, using default (SSLv23).\n"), myproto); - myproto = NULL; - } - } - if(!myproto) { - _ctx = SSL_CTX_new(SSLv23_client_method()); - } - if(_ctx == NULL) { - ERR_print_errors_fp(stderr); - return(-1); + /* Make sure a connection referring to an older context is not left */ + _ssl_context[sock] = NULL; + if(myproto) { + if(!strcasecmp("ssl2",myproto)) { +#if HAVE_DECL_SSLV2_CLIENT_METHOD + 0 > 0 + _ctx[sock] = SSL_CTX_new(SSLv2_client_method()); +#else + report(stderr, GT_("Your operating system does not support SSLv2.\n")); + return -1; +#endif + } else if(!strcasecmp("ssl3",myproto)) { + _ctx[sock] = SSL_CTX_new(SSLv3_client_method()); + } else if(!strcasecmp("tls1",myproto)) { + _ctx[sock] = SSL_CTX_new(TLSv1_client_method()); + } else if (!strcasecmp("ssl23",myproto)) { + myproto = NULL; + } else { + report(stderr,GT_("Invalid SSL protocol '%s' specified, using default (SSLv23).\n"), myproto); + myproto = NULL; } } + if(!myproto) { + _ctx[sock] = SSL_CTX_new(SSLv23_client_method()); + } + if(_ctx[sock] == NULL) { + ERR_print_errors_fp(stderr); + return(-1); + } + + { + char *tmp = getenv("FETCHMAIL_DISABLE_CBC_IV_COUNTERMEASURE"); + if (tmp == NULL || *tmp == '\0' || strspn(tmp, " \t") == strlen(tmp)) + sslopts &= ~ SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; + } + + SSL_CTX_set_options(_ctx[sock], sslopts); if (certck) { - SSL_CTX_set_verify(_ctx, SSL_VERIFY_PEER, SSL_ck_verify_callback); + SSL_CTX_set_verify(_ctx[sock], SSL_VERIFY_PEER, SSL_ck_verify_callback); } else { /* In this case, we do not fail if verification fails. However, - * we provide the callback for output and possible fingerprint checks. */ - SSL_CTX_set_verify(_ctx, SSL_VERIFY_PEER, SSL_nock_verify_callback); + * we provide the callback for output and possible fingerprint + * checks. */ + SSL_CTX_set_verify(_ctx[sock], SSL_VERIFY_PEER, SSL_nock_verify_callback); + } + + /* Check which trusted X.509 CA certificate store(s) to load */ + { + char *tmp; + int want_default_cacerts = 0; + + /* Load user locations if any is given */ + if (certpath || cacertfile) + SSL_CTX_load_verify_locations(_ctx[sock], + cacertfile, certpath); + else + want_default_cacerts = 1; + + tmp = getenv("FETCHMAIL_INCLUDE_DEFAULT_X509_CA_CERTS"); + if (want_default_cacerts || (tmp && tmp[0])) { + SSL_CTX_set_default_verify_paths(_ctx[sock]); + } } - if (certpath) - SSL_CTX_load_verify_locations(_ctx, NULL, certpath); - else - SSL_CTX_set_default_verify_paths(_ctx); - _ssl_context[sock] = SSL_new(_ctx); + _ssl_context[sock] = SSL_new(_ctx[sock]); if(_ssl_context[sock] == NULL) { ERR_print_errors_fp(stderr); + SSL_CTX_free(_ctx[sock]); + _ctx[sock] = NULL; return(-1); } @@ -863,6 +982,8 @@ int SSLOpen(int sock, char *mycert, char *mykey, char *myproto, int certck, char _check_fp = 1; _check_digest = fingerprint; _depth0ck = 0; + _firstrun = 1; + _verify_ok = 1; _prev_err = -1; if( mycert || mykey ) { @@ -871,18 +992,28 @@ int SSLOpen(int sock, char *mycert, char *mykey, char *myproto, int certck, char * he does NOT have a separate certificate and private key file then * assume that it's a combined key and certificate file. */ + char buffer[256]; + if( !mykey ) mykey = mycert; if( !mycert ) mycert = mykey; + + if ((!*remotename || !**remotename) && SSLCertGetCN(mycert, buffer, sizeof(buffer))) { + free(*remotename); + *remotename = xstrdup(buffer); + } SSL_use_certificate_file(_ssl_context[sock], mycert, SSL_FILETYPE_PEM); SSL_use_RSAPrivateKey_file(_ssl_context[sock], mykey, SSL_FILETYPE_PEM); } - SSL_set_fd(_ssl_context[sock], sock); - - if(SSL_connect(_ssl_context[sock]) < 1) { + if (SSL_set_fd(_ssl_context[sock], sock) == 0 + || SSL_connect(_ssl_context[sock]) < 1) { ERR_print_errors_fp(stderr); + SSL_free( _ssl_context[sock] ); + _ssl_context[sock] = NULL; + SSL_CTX_free(_ctx[sock]); + _ctx[sock] = NULL; return(-1); } @@ -896,11 +1027,18 @@ int SSLOpen(int sock, char *mycert, char *mykey, char *myproto, int certck, char SSL_shutdown( _ssl_context[sock] ); SSL_free( _ssl_context[sock] ); _ssl_context[sock] = NULL; + SSL_CTX_free(_ctx[sock]); + _ctx[sock] = NULL; } return(-1); } } + if (!certck && !fingerprint && + (SSL_get_verify_result(_ssl_context[sock]) != X509_V_OK || !_verify_ok)) { + report(stderr, GT_("Warning: the connection is insecure, continuing anyways. (Better use --sslcertck!)\n")); + } + return(0); } #endif @@ -914,33 +1052,11 @@ int SockClose(int sock) SSL_shutdown( _ssl_context[sock] ); SSL_free( _ssl_context[sock] ); _ssl_context[sock] = NULL; + SSL_CTX_free(_ctx[sock]); + _ctx[sock] = NULL; } #endif -#ifdef __UNUSED__ - /* - * This hangs in RedHat 6.2 after fetchmail runs for a while a - * FIN_WAIT2 comes up in netstat and fetchmail never returns from - * the recv system call. (Reported from jtnews - * , Wed, 24 May 2000 21:26:02.) - * - * Half-close the connection first so the other end gets notified. - * - * This stops sends but allows receives (effectively, it sends a - * TCP ). */ - if (shutdown(sock, 1) == 0) { - char ch; - /* If there is any data still waiting in the queue, discard it. - * Call recv() until either it returns 0 (meaning we received a FIN) - * or any error occurs. This makes sure all data sent by the other - * side is acknowledged at the TCP level. - */ - if (fm_peek(sock, &ch, 1) > 0) - while (fm_read(sock, &ch, 1) > 0) - continue; - } -#endif /* __UNUSED__ */ - /* if there's an error closing at this point, not much we can do */ return(fm_close(sock)); /* this is guarded */ } @@ -953,18 +1069,18 @@ int SockClose(int sock) */ static ssize_t cygwin_read(int sock, void *buf, size_t count) { - char *bp = buf; - int n = 0; + char *bp = (char *)buf; + size_t n = 0; - if ((n = read(sock, bp, count)) == -1) + if ((n = read(sock, bp, count)) == (size_t)-1) return(-1); if (n != count) { - int n2 = 0; + size_t n2 = 0; if (outlevel >= O_VERBOSE) report(stdout, GT_("Cygwin socket read retry\n")); n2 = read(sock, bp + n, count - n); - if (n2 == -1 || n + n2 != count) { + if (n2 == (size_t)-1 || n + n2 != count) { report(stderr, GT_("Cygwin socket read retry failed!\n")); return(-1); } @@ -973,21 +1089,3 @@ static ssize_t cygwin_read(int sock, void *buf, size_t count) return count; } #endif /* __CYGWIN__ */ - -#ifdef MAIN -/* - * Use the chargen service to test input buffering directly. - * You may have to uncomment the `chargen' service description in your - * inetd.conf (and then SIGHUP inetd) for this to work. */ -main() -{ - int sock = SockOpen("localhost", "chargen", NULL); - char buf[80]; - - while (SockRead(sock, buf, sizeof(buf)-1)) - SockWrite(1, buf, strlen(buf)); - SockClose(sock); -} -#endif /* MAIN */ - -/* socket.c ends here */