X-Git-Url: http://pileus.org/git/?a=blobdiff_plain;f=socket.c;h=5de220f56b9fb08e9060ae64ab7c2e57fbdb2550;hb=a23a8cf8ee1da51c4392b9f52e6b72b0c01e3b5e;hp=1da4d4c1a513f3ac8059f4f7b23881b28021031d;hpb=d740b0dff5a29de4c46c3a9405add70660e6fd93;p=~andy%2Ffetchmail diff --git a/socket.c b/socket.c index 1da4d4c1..5de220f5 100644 --- a/socket.c +++ b/socket.c @@ -1,7 +1,9 @@ /* * socket.c -- socket library functions * - * Copyright 1998 by Eric S. Raymond. + * Copyright 1998, 2004 by Eric S. Raymond. + * Copyright 2004, 2013 by Matthias Andree. + * * For license terms, see the file COPYING in this directory. */ @@ -10,40 +12,23 @@ #include #include #include /* isspace() */ -#ifdef HAVE_MEMORY_H -#include -#endif /* HAVE_MEMORY_H */ #include #include -#ifndef HAVE_NET_SOCKET_H #include -#else -#include -#endif #include #include -#ifdef HAVE_ARPA_INET_H #include -#endif #include #include #include #include -#if TIME_WITH_SYS_TIME -# include -# include -#else -# if HAVE_SYS_TIME_H -# include -# else -# include -# endif -#endif +#include +#include #include "socket.h" #include "fetchmail.h" #include "getaddrinfo.h" -#include "i18n.h" +#include "gettext.h" #include "sdump.h" /* Defines to allow Cygwin to play nice... */ @@ -65,7 +50,10 @@ extern int h_errno; # endif #endif /* ndef h_errno */ -#ifdef HAVE_SOCKETPAIR +/* used by SSL_get_ex_new_index, SSL_set_ex_data, SSL_get_ex_data, to communicate + options and state with the verify callback */ +static int global_mydata_index = -2; + static char *const *parse_plugin(const char *plugin, const char *host, const char *service) { char **argvec; @@ -118,6 +106,7 @@ static char *const *parse_plugin(const char *plugin, const char *host, const cha argvec = (char **)malloc(s); if (!argvec) { + free(plugin_copy); report(stderr, GT_("fetchmail: malloc failed\n")); return NULL; } @@ -164,16 +153,18 @@ static int handle_plugin(const char *host, (void) close(fds[1]); if ( (dup2(fds[0],0) == -1) || (dup2(fds[0],1) == -1) ) { report(stderr, GT_("dup2 failed\n")); - exit(1); + _exit(EXIT_FAILURE); } /* fds[0] is now connected to 0 and 1; close it */ (void) close(fds[0]); if (outlevel >= O_VERBOSE) report(stderr, GT_("running %s (host %s service %s)\n"), plugin, host, service); argvec = parse_plugin(plugin,host,service); + if (argvec == NULL) + _exit(EXIT_FAILURE); execvp(*argvec, argvec); report(stderr, GT_("execvp(%s) failed\n"), *argvec); - exit(0); + _exit(EXIT_FAILURE); break; default: /* parent */ /* NOP */ @@ -183,31 +174,12 @@ static int handle_plugin(const char *host, (void) close(fds[0]); return fds[1]; } -#endif /* HAVE_SOCKETPAIR */ -#ifdef __UNUSED__ - -int SockCheckOpen(int fd) -/* poll given socket; is it selectable? */ -{ - fd_set r, w, e; - int rt; - struct timeval tv; - - for (;;) - { - FD_ZERO(&r); FD_ZERO(&w); FD_ZERO(&e); - FD_SET(fd, &e); - - tv.tv_sec = 0; tv.tv_usec = 0; - rt = select(fd+1, &r, &w, &e, &tv); - if (rt == -1 && (errno != EAGAIN && errno != EINTR)) - return 0; - if (rt != -1) - return 1; - } +/** Set socket to SO_KEEPALIVE. \return 0 for success. */ +int SockKeepalive(int sock) { + int keepalive = 1; + return setsockopt(sock, SOL_SOCKET, SO_KEEPALIVE, &keepalive, sizeof keepalive); } -#endif /* __UNUSED__ */ int UnixOpen(const char *path) { @@ -224,12 +196,12 @@ int UnixOpen(const char *path) return -1; } - /* Socket opened saved. Usefull if connect timeout - * because it can be closed. - */ - mailserver_socket_temp = sock; - - if (connect(sock, (struct sockaddr *) &ad, sizeof(ad)) < 0) + /* Socket opened saved. Useful if connect timeout + * because it can be closed. + */ + mailserver_socket_temp = sock; + + if (connect(sock, (struct sockaddr *) &ad, sizeof(ad)) < 0) { int olderr = errno; fm_close(sock); /* don't use SockClose, no traffic yet */ @@ -237,9 +209,9 @@ int UnixOpen(const char *path) errno = olderr; sock = -1; } - - /* No connect timeout, then no need to set mailserver_socket_temp */ - mailserver_socket_temp = -1; + + /* No connect timeout, then no need to set mailserver_socket_temp */ + mailserver_socket_temp = -1; return sock; } @@ -252,10 +224,8 @@ int SockOpen(const char *host, const char *service, int ord; char errbuf[8192] = ""; -#ifdef HAVE_SOCKETPAIR if (plugin) return handle_plugin(host,service,plugin); -#endif /* HAVE_SOCKETPAIR */ memset(&req, 0, sizeof(struct addrinfo)); req.ai_socktype = SOCK_STREAM; @@ -303,6 +273,8 @@ int SockOpen(const char *host, const char *service, continue; } + SockKeepalive(i); + /* Save socket descriptor. * Used to close the socket after connect timeout. */ mailserver_socket_temp = i; @@ -344,7 +316,6 @@ int SockOpen(const char *host, const char *service, return i; } - int SockPrintf(int sock, const char* format, ...) { va_list ap; @@ -357,12 +328,27 @@ int SockPrintf(int sock, const char* format, ...) } #ifdef SSL_ENABLE +#define OPENSSL_NO_SSL_INTERN 1 #include #include #include #include #include +static void report_SSL_errors(FILE *stream) +{ + unsigned long err; + + while (0ul != (err = ERR_get_error())) { + char *errstr = ERR_error_string(err, NULL); + report(stream, GT_("OpenSSL reported: %s\n"), errstr); + } +} + +/* override ERR_print_errors_fp to our own implementation */ +#undef ERR_print_errors_fp +#define ERR_print_errors_fp(stream) report_SSL_errors((stream)) + static SSL_CTX *_ctx[FD_SETSIZE]; static SSL *_ssl_context[FD_SETSIZE]; @@ -416,7 +402,7 @@ int SockRead(int sock, char *buf, int len) /* OK... SSL_peek works a little different from MSG_PEEK Problem is that SSL_peek can return 0 if there is no data currently available. If, on the other - hand, we loose the socket, we also get a zero, but + hand, we lose the socket, we also get a zero, but the SSL_read then SEGFAULTS! To deal with this, we'll check the error code any time we get a return of zero from SSL_peek. If we have an error, we bail. @@ -530,14 +516,19 @@ int SockPeek(int sock) #ifdef SSL_ENABLE -static char *_ssl_server_cname = NULL; -static int _check_fp; -static char *_check_digest; -static char *_server_label; -static int _depth0ck; -static int _firstrun; -static int _prev_err; -static int _verify_ok; +struct ssl_callback_data { + char *ssl_server_cname; + char *check_digest; + char *server_label; + int check_fp; + int depth0ck; + int firstrun; + int prev_err; + int verify_ok; + int strict_mode; +}; + +typedef struct ssl_callback_data t_ssl_callback_data; SSL *SSLGetContext( int sock ) { @@ -551,7 +542,7 @@ SSL *SSLGetContext( int sock ) /* ok_return (preverify_ok) is 1 if this stage of certificate verification passed, or 0 if it failed. This callback lets us display informative errors, and perform additional validation (e.g. CN matches) */ -static int SSL_verify_callback( int ok_return, X509_STORE_CTX *ctx, int strict ) +static int SSL_verify_callback( int ok_return, X509_STORE_CTX *ctx) { #define SSLverbose (((outlevel) >= O_DEBUG) || ((outlevel) >= O_VERBOSE && (depth) == 0)) char buf[257]; @@ -563,7 +554,11 @@ static int SSL_verify_callback( int ok_return, X509_STORE_CTX *ctx, int strict ) unsigned int dsz, esz; X509_NAME *subj, *issuer; char *tt; + t_ssl_callback_data *mydata; + SSL *ssl; + ssl = (SSL *)X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx()); + mydata = (t_ssl_callback_data *)SSL_get_ex_data(ssl, global_mydata_index); x509_cert = X509_STORE_CTX_get_current_cert(ctx); err = X509_STORE_CTX_get_error(ctx); depth = X509_STORE_CTX_get_error_depth(ctx); @@ -573,10 +568,10 @@ static int SSL_verify_callback( int ok_return, X509_STORE_CTX *ctx, int strict ) if (outlevel >= O_VERBOSE) { if (depth == 0 && SSLverbose) - report(stderr, GT_("Server certificate:\n")); + report(stdout, GT_("Server certificate:\n")); else { - if (_firstrun) { - _firstrun = 0; + if (mydata->firstrun) { + mydata->firstrun = 0; if (SSLverbose) report(stdout, GT_("Certificate chain, from root to peer, starting at depth %d:\n"), depth); } else { @@ -623,14 +618,14 @@ static int SSL_verify_callback( int ok_return, X509_STORE_CTX *ctx, int strict ) } if (depth == 0) { /* peer certificate */ - if (!_depth0ck) { - _depth0ck = 1; + if (!mydata->depth0ck) { + mydata->depth0ck = 1; } if ((i = X509_NAME_get_text_by_NID(subj, NID_commonName, buf, sizeof(buf))) != -1) { - if (_ssl_server_cname != NULL) { + if (mydata->ssl_server_cname != NULL) { char *p1 = buf; - char *p2 = _ssl_server_cname; + char *p2 = mydata->ssl_server_cname; int matched = 0; STACK_OF(GENERAL_NAME) *gens; @@ -643,7 +638,7 @@ static int SSL_verify_callback( int ok_return, X509_STORE_CTX *ctx, int strict ) const GENERAL_NAME *gn = sk_GENERAL_NAME_value(gens, j); if (gn->type == GEN_DNS) { char *pp1 = (char *)gn->d.ia5->data; - char *pp2 = _ssl_server_cname; + char *pp2 = mydata->ssl_server_cname; if (outlevel >= O_VERBOSE) { report(stdout, GT_("Subject Alternative Name: %s\n"), (tt = sdump(pp1, (size_t)gn->d.ia5->length))); xfree(tt); @@ -660,38 +655,38 @@ static int SSL_verify_callback( int ok_return, X509_STORE_CTX *ctx, int strict ) } } } - sk_GENERAL_NAME_free(gens); + GENERAL_NAMES_free(gens); } if (name_match(p1, p2)) { matched = 1; } if (!matched) { - if (strict || SSLverbose) { + if (mydata->strict_mode || SSLverbose) { report(stderr, GT_("Server CommonName mismatch: %s != %s\n"), - (tt = sdump(buf, i)), _ssl_server_cname ); + (tt = sdump(buf, i)), mydata->ssl_server_cname); xfree(tt); } ok_return = 0; } } else if (ok_return) { report(stderr, GT_("Server name not set, could not verify certificate!\n")); - if (strict) return (0); + if (mydata->strict_mode) return (0); } } else { if (outlevel >= O_VERBOSE) report(stdout, GT_("Unknown Server CommonName\n")); - if (ok_return && strict) { + if (ok_return && mydata->strict_mode) { report(stderr, GT_("Server name not specified in certificate!\n")); return (0); } } /* Print the finger print. Note that on errors, we might print it more than once * normally; we kluge around that by using a global variable. */ - if (_check_fp == 1) { + if (1 == mydata->check_fp) { unsigned dp; - _check_fp = -1; + mydata->check_fp = -1; digest_tp = EVP_md5(); if (digest_tp == NULL) { report(stderr, GT_("EVP_md5() failed!\n")); @@ -712,43 +707,58 @@ static int SSL_verify_callback( int ok_return, X509_STORE_CTX *ctx, int strict ) tp += esz; } if (outlevel > O_NORMAL) - report(stdout, GT_("%s key fingerprint: %s\n"), _server_label, text); - if (_check_digest != NULL) { - if (strcasecmp(text, _check_digest) == 0) { + report(stdout, GT_("%s certificate MD5 fingerprint: %s\n"), mydata->server_label, text); + if (mydata->check_digest != NULL) { + if (strcasecmp(text, mydata->check_digest) == 0) { if (outlevel > O_NORMAL) - report(stdout, GT_("%s fingerprints match.\n"), _server_label); + report(stdout, GT_("%s fingerprints match.\n"), mydata->server_label); } else { - report(stderr, GT_("%s fingerprints do not match!\n"), _server_label); + report(stderr, GT_("%s fingerprints do not match!\n"), mydata->server_label); return (0); } } /* if (_check_digest != NULL) */ } /* if (_check_fp) */ } /* if (depth == 0 && !_depth0ck) */ - if (err != X509_V_OK && err != _prev_err && !(_check_fp != 0 && _check_digest && !strict)) { - _prev_err = err; - + if (err != X509_V_OK && err != mydata->prev_err && !(mydata->check_fp != 0 && mydata->check_digest && !mydata->strict_mode)) { + char *tmp; + int did_rep_err = 0; + mydata->prev_err = err; + report(stderr, GT_("Server certificate verification error: %s\n"), X509_verify_cert_error_string(err)); /* We gave the error code, but maybe we can add some more details for debugging */ switch (err) { + /* actually we do not want to lump these together, but + * since OpenSSL flipped the meaning of these error + * codes in the past, and they do hardly make a + * practical difference because servers need not provide + * the root signing certificate, we don't bother telling + * users the difference: + */ + case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY: case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT: X509_NAME_oneline(issuer, buf, sizeof(buf)); buf[sizeof(buf) - 1] = '\0'; - report(stderr, GT_("unknown issuer (first %d characters): %s\n"), (int)(sizeof(buf)-1), buf); - report(stderr, GT_("This error usually happens when the server provides an incomplete certificate " - "chain, which is nothing fetchmail could do anything about. For details, " - "please see the README.SSL-SERVER document that comes with fetchmail.\n")); - break; + report(stderr, GT_("Broken certification chain at: %s\n"), (tmp = sdump(buf, strlen(buf)))); + xfree(tmp); + report(stderr, GT_( "This could mean that the server did not provide the intermediate CA's certificate(s), " + "which is nothing fetchmail could do anything about. For details, " + "please see the README.SSL-SERVER document that ships with fetchmail.\n")); + did_rep_err = 1; + /* FALLTHROUGH */ case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT: - case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY: case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN: - X509_NAME_oneline(subj, buf, sizeof(buf)); - buf[sizeof(buf) - 1] = '\0'; - report(stderr, GT_("This means that the root signing certificate (issued for %s) is not in the " - "trusted CA certificate locations, or that c_rehash needs to be run " + if (!did_rep_err) { + X509_NAME_oneline(issuer, buf, sizeof(buf)); + buf[sizeof(buf) - 1] = '\0'; + report(stderr, GT_("Missing trust anchor certificate: %s\n"), (tmp = sdump(buf, strlen(buf)))); + xfree(tmp); + } + report(stderr, GT_( "This could mean that the root CA's signing certificate is not in the " + "trusted CA certificate location, or that c_rehash needs to be run " "on the certificate directory. For details, please " - "see the documentation of --sslcertpath and --sslcertfile in the manual page.\n"), buf); + "see the documentation of --sslcertpath and --sslcertfile in the manual page.\n")); break; default: break; @@ -758,23 +768,12 @@ static int SSL_verify_callback( int ok_return, X509_STORE_CTX *ctx, int strict ) * If not in strict checking mode (--sslcertck), override this * and pretend that verification had succeeded. */ - _verify_ok &= ok_return; - if (!strict) + mydata->verify_ok &= ok_return; + if (!mydata->strict_mode) ok_return = 1; - return (ok_return); -} - -static int SSL_nock_verify_callback( int ok_return, X509_STORE_CTX *ctx ) -{ - return SSL_verify_callback(ok_return, ctx, 0); + return ok_return; } -static int SSL_ck_verify_callback( int ok_return, X509_STORE_CTX *ctx ) -{ - return SSL_verify_callback(ok_return, ctx, 1); -} - - /* get commonName from certificate set in file. * commonName is stored in buffer namebuffer, limited with namebufferlen */ @@ -816,9 +815,20 @@ int SSLOpen(int sock, char *mycert, char *mykey, const char *myproto, int certck struct stat randstat; int i; - SSL_load_error_strings(); - SSL_library_init(); - OpenSSL_add_all_algorithms(); /* see Debian Bug#576430 and manpage */ + static int ssl_lib_init = 0; + + if (!ssl_lib_init) { + SSL_load_error_strings(); + SSL_library_init(); + OpenSSL_add_all_algorithms(); /* see Debian Bug#576430 and manpage */ + ssl_lib_init = 1; + } + + if (-2 == global_mydata_index) { + char tmp[] = "fetchmail SSL callback data"; + global_mydata_index = SSL_get_ex_new_index(0, tmp, NULL, NULL, NULL); + if (-1 == global_mydata_index) return PS_UNDEFINED; + } if (stat("/dev/random", &randstat) && stat("/dev/urandom", &randstat)) { @@ -844,16 +854,14 @@ int SSLOpen(int sock, char *mycert, char *mykey, const char *myproto, int certck /* Make sure a connection referring to an older context is not left */ _ssl_context[sock] = NULL; if(myproto) { - if(!strcasecmp("ssl2",myproto)) { - _ctx[sock] = SSL_CTX_new(SSLv2_client_method()); - } else if(!strcasecmp("ssl3",myproto)) { + if(!strcasecmp("ssl3",myproto)) { _ctx[sock] = SSL_CTX_new(SSLv3_client_method()); } else if(!strcasecmp("tls1",myproto)) { _ctx[sock] = SSL_CTX_new(TLSv1_client_method()); } else if (!strcasecmp("ssl23",myproto)) { myproto = NULL; } else { - fprintf(stderr,GT_("Invalid SSL protocol '%s' specified, using default (SSLv23).\n"), myproto); + report(stderr,GT_("Invalid SSL protocol '%s' specified, using default (SSLv23).\n"), myproto); myproto = NULL; } } @@ -865,16 +873,8 @@ int SSLOpen(int sock, char *mycert, char *mykey, const char *myproto, int certck return(-1); } - SSL_CTX_set_options(_ctx[sock], SSL_OP_ALL); - - if (certck) { - SSL_CTX_set_verify(_ctx[sock], SSL_VERIFY_PEER, SSL_ck_verify_callback); - } else { - /* In this case, we do not fail if verification fails. However, - * we provide the callback for output and possible fingerprint - * checks. */ - SSL_CTX_set_verify(_ctx[sock], SSL_VERIFY_PEER, SSL_nock_verify_callback); - } + SSL_CTX_set_options(_ctx[sock], (SSL_OP_ALL | SSL_OP_NO_SSLv2) & ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS); + SSL_CTX_set_verify(_ctx[sock], SSL_VERIFY_PEER, SSL_verify_callback); /* Check which trusted X.509 CA certificate store(s) to load */ { @@ -903,15 +903,19 @@ int SSLOpen(int sock, char *mycert, char *mykey, const char *myproto, int certck return(-1); } - /* This static is for the verify callback */ - _ssl_server_cname = servercname; - _server_label = label; - _check_fp = 1; - _check_digest = fingerprint; - _depth0ck = 0; - _firstrun = 1; - _verify_ok = 1; - _prev_err = -1; + t_ssl_callback_data mydata; + memset(&mydata, 0, sizeof(mydata)); + + /* This data is for the verify callback */ + mydata.ssl_server_cname = servercname; + mydata.server_label = label; + mydata.check_fp = 1; + mydata.check_digest = fingerprint; + mydata.depth0ck = 0; + mydata.firstrun = 1; + mydata.verify_ok = 1; + mydata.prev_err = -1; + mydata.strict_mode = certck; if( mycert || mykey ) { @@ -934,6 +938,8 @@ int SSLOpen(int sock, char *mycert, char *mykey, const char *myproto, int certck SSL_use_RSAPrivateKey_file(_ssl_context[sock], mykey, SSL_FILETYPE_PEM); } + SSL_set_ex_data(_ssl_context[sock], global_mydata_index, &mydata); + if (SSL_set_fd(_ssl_context[sock], sock) == 0 || SSL_connect(_ssl_context[sock]) < 1) { ERR_print_errors_fp(stderr); @@ -945,7 +951,7 @@ int SSLOpen(int sock, char *mycert, char *mykey, const char *myproto, int certck } /* Paranoia: was the callback not called as we expected? */ - if (!_depth0ck) { + if (!mydata.depth0ck) { report(stderr, GT_("Certificate/fingerprint verification was somehow skipped!\n")); if (fingerprint != NULL || certck) { @@ -962,7 +968,7 @@ int SSLOpen(int sock, char *mycert, char *mykey, const char *myproto, int certck } if (!certck && !fingerprint && - (SSL_get_verify_result(_ssl_context[sock]) != X509_V_OK || !_verify_ok)) { + (SSL_get_verify_result(_ssl_context[sock]) != X509_V_OK || !mydata.verify_ok)) { report(stderr, GT_("Warning: the connection is insecure, continuing anyways. (Better use --sslcertck!)\n")); } @@ -984,30 +990,6 @@ int SockClose(int sock) } #endif -#ifdef __UNUSED__ - /* - * This hangs in RedHat 6.2 after fetchmail runs for a while a - * FIN_WAIT2 comes up in netstat and fetchmail never returns from - * the recv system call. (Reported from jtnews - * , Wed, 24 May 2000 21:26:02.) - * - * Half-close the connection first so the other end gets notified. - * - * This stops sends but allows receives (effectively, it sends a - * TCP ). */ - if (shutdown(sock, 1) == 0) { - char ch; - /* If there is any data still waiting in the queue, discard it. - * Call recv() until either it returns 0 (meaning we received a FIN) - * or any error occurs. This makes sure all data sent by the other - * side is acknowledged at the TCP level. - */ - if (fm_peek(sock, &ch, 1) > 0) - while (fm_read(sock, &ch, 1) > 0) - continue; - } -#endif /* __UNUSED__ */ - /* if there's an error closing at this point, not much we can do */ return(fm_close(sock)); /* this is guarded */ } @@ -1020,7 +1002,7 @@ int SockClose(int sock) */ static ssize_t cygwin_read(int sock, void *buf, size_t count) { - char *bp = buf; + char *bp = (char *)buf; size_t n = 0; if ((n = read(sock, bp, count)) == (size_t)-1) @@ -1040,21 +1022,3 @@ static ssize_t cygwin_read(int sock, void *buf, size_t count) return count; } #endif /* __CYGWIN__ */ - -#ifdef MAIN -/* - * Use the chargen service to test input buffering directly. - * You may have to uncomment the `chargen' service description in your - * inetd.conf (and then SIGHUP inetd) for this to work. */ -main() -{ - int sock = SockOpen("localhost", "chargen", NULL); - char buf[80]; - - while (SockRead(sock, buf, sizeof(buf)-1)) - SockWrite(1, buf, strlen(buf)); - SockClose(sock); -} -#endif /* MAIN */ - -/* socket.c ends here */