Adding upstream version 3.7.9.upstream/3.7.9upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 693 insertions, 0 deletions

diff --git a/src/socket.c b/src/socket.c
new file mode 100644
index 0000000..36ac292
--- /dev/null
+++ b/src/socket.c
@@ -0,0 +1,693 @@
+/*
+ * Copyright (C) 2000-2016 Free Software Foundation, Inc.
+ * Copyright (C) 2015-2016 Red Hat, Inc.
+ *
+ * This file is part of GnuTLS.
+ *
+ * GnuTLS is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GnuTLS is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#include <config.h>
+
+#if HAVE_SYS_SOCKET_H
+#include <sys/socket.h>
+#elif HAVE_WS2TCPIP_H
+#include <ws2tcpip.h>
+#endif
+#include <netdb.h>
+#include <string.h>
+#include <errno.h>
+#include <sys/select.h>
+#include <sys/types.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <arpa/inet.h>
+#include <socket.h>
+#include <c-ctype.h>
+#include "sockets.h"
+#include "common.h"
+
+#ifdef _WIN32
+# undef endservent
+# define endservent()
+#endif
+
+#define MAX_BUF 4096
+
+/* Functions to manipulate sockets
+ */
+
+ssize_t
+socket_recv(const socket_st * socket, void *buffer, int buffer_size)
+{
+	int ret;
+
+	if (socket->secure) {
+		do {
+			ret =
+			    gnutls_record_recv(socket->session, buffer,
+					       buffer_size);
+			if (ret == GNUTLS_E_HEARTBEAT_PING_RECEIVED)
+				gnutls_heartbeat_pong(socket->session, 0);
+		}
+		while (ret == GNUTLS_E_INTERRUPTED
+		       || ret == GNUTLS_E_HEARTBEAT_PING_RECEIVED);
+
+	} else
+		do {
+			ret = recv(socket->fd, buffer, buffer_size, 0);
+		}
+		while (ret == -1 && errno == EINTR);
+
+	return ret;
+}
+
+ssize_t
+socket_recv_timeout(const socket_st * socket, void *buffer, int buffer_size, unsigned ms)
+{
+	int ret;
+
+	if (socket->secure)
+		gnutls_record_set_timeout(socket->session, ms);
+	ret = socket_recv(socket, buffer, buffer_size);
+
+	if (socket->secure)
+		gnutls_record_set_timeout(socket->session, 0);
+
+	return ret;
+}
+
+ssize_t
+socket_send(const socket_st * socket, const void *buffer, int buffer_size)
+{
+	return socket_send_range(socket, buffer, buffer_size, NULL);
+}
+
+
+ssize_t
+socket_send_range(const socket_st * socket, const void *buffer,
+		  int buffer_size, gnutls_range_st * range)
+{
+	int ret;
+
+	if (socket->secure)
+		do {
+			if (range == NULL)
+				ret =
+				    gnutls_record_send(socket->session,
+						       buffer,
+						       buffer_size);
+			else
+				ret =
+				    gnutls_record_send_range(socket->
+							     session,
+							     buffer,
+							     buffer_size,
+							     range);
+		}
+		while (ret == GNUTLS_E_AGAIN
+		       || ret == GNUTLS_E_INTERRUPTED);
+	else
+		do {
+			ret = send(socket->fd, buffer, buffer_size, 0);
+		}
+		while (ret == -1 && errno == EINTR);
+
+	if (ret > 0 && ret != buffer_size && socket->verbose)
+		fprintf(stderr,
+			"*** Only sent %d bytes instead of %d.\n", ret,
+			buffer_size);
+
+	return ret;
+}
+
+static
+ssize_t send_line(socket_st * socket, const char *txt)
+{
+	int len = strlen(txt);
+	int ret;
+
+	if (socket->verbose)
+		fprintf(stderr, "starttls: sending: %s\n", txt);
+
+	ret = send(socket->fd, txt, len, 0);
+
+	if (ret == -1) {
+		fprintf(stderr, "error sending \"%s\"\n", txt);
+		exit(2);
+	}
+
+	return ret;
+}
+
+static
+ssize_t wait_for_text(socket_st * socket, const char *txt, unsigned txt_size)
+{
+	char buf[1024];
+	char *pbuf, *p;
+	int ret;
+	fd_set read_fds;
+	struct timeval tv;
+	size_t left, got;
+
+	if (txt_size > sizeof(buf))
+		abort();
+
+	if (socket->verbose && txt != NULL)
+		fprintf(stderr, "starttls: waiting for: \"%.*s\"\n", txt_size, txt);
+
+	pbuf = buf;
+	left = sizeof(buf)-1;
+	got = 0;
+
+	do {
+		FD_ZERO(&read_fds);
+		FD_SET(socket->fd, &read_fds);
+		tv.tv_sec = 10;
+		tv.tv_usec = 0;
+		ret = select(socket->fd + 1, &read_fds, NULL, NULL, &tv);
+		if (ret > 0)
+			ret = recv(socket->fd, pbuf, left, 0);
+		if (ret == -1) {
+			fprintf(stderr, "error receiving '%s': %s\n", txt, strerror(errno));
+			exit(2);
+		} else if (ret == 0) {
+			fprintf(stderr, "error receiving '%s': Timeout\n", txt);
+			exit(2);
+		}
+		pbuf[ret] = 0;
+
+		if (txt == NULL)
+			break;
+
+		if (socket->verbose)
+			fprintf(stderr, "starttls: received: %s\n", pbuf);
+
+		pbuf += ret;
+		left -= ret;
+		got += ret;
+
+
+		/* check for text after a newline in buffer */
+		if (got > txt_size) {
+			p = memmem(buf, got, txt, txt_size);
+			if (p != NULL && p != buf) {
+				p--;
+				if (*p == '\n' || *p == '\r' || (*txt == '<' && *p == '>')) // XMPP is not line oriented, uses XML format
+					break;
+			}
+		}
+	} while(got < txt_size || strncmp(buf, txt, txt_size) != 0);
+
+	return got;
+}
+
+static void
+socket_starttls(socket_st * socket)
+{
+	char buf[512];
+
+	if (socket->secure)
+		return;
+
+	if (socket->app_proto == NULL || strcasecmp(socket->app_proto, "https") == 0)
+		return;
+
+	if (strcasecmp(socket->app_proto, "smtp") == 0 || strcasecmp(socket->app_proto, "submission") == 0) {
+		if (socket->verbose)
+			log_msg(stdout, "Negotiating SMTP STARTTLS\n");
+
+		wait_for_text(socket, "220 ", 4);
+		snprintf(buf, sizeof(buf), "EHLO %s\r\n", socket->hostname);
+		send_line(socket, buf);
+		wait_for_text(socket, "250 ", 4);
+		send_line(socket, "STARTTLS\r\n");
+		wait_for_text(socket, "220 ", 4);
+	} else if (strcasecmp(socket->app_proto, "imap") == 0 || strcasecmp(socket->app_proto, "imap2") == 0) {
+		if (socket->verbose)
+			log_msg(stdout, "Negotiating IMAP STARTTLS\n");
+
+		send_line(socket, "a CAPABILITY\r\n");
+		wait_for_text(socket, "a OK", 4);
+		send_line(socket, "a STARTTLS\r\n");
+		wait_for_text(socket, "a OK", 4);
+	} else if (strcasecmp(socket->app_proto, "xmpp") == 0) {
+		if (socket->verbose)
+			log_msg(stdout, "Negotiating XMPP STARTTLS\n");
+
+		snprintf(buf, sizeof(buf), "<stream:stream xmlns:stream='http://etherx.jabber.org/streams' xmlns='jabber:client' to='%s' version='1.0'>\n", socket->hostname);
+		send_line(socket, buf);
+		wait_for_text(socket, "<?", 2);
+		send_line(socket, "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>");
+		wait_for_text(socket, "<proceed", 8);
+	} else if (strcasecmp(socket->app_proto, "ldap") == 0) {
+		if (socket->verbose)
+			log_msg(stdout, "Negotiating LDAP STARTTLS\n");
+#define LDAP_STR "\x30\x1d\x02\x01\x01\x77\x18\x80\x16\x31\x2e\x33\x2e\x36\x2e\x31\x2e\x34\x2e\x31\x2e\x31\x34\x36\x36\x2e\x32\x30\x30\x33\x37"
+		send(socket->fd, LDAP_STR, sizeof(LDAP_STR)-1, 0);
+		wait_for_text(socket, NULL, 0);
+	} else if (strcasecmp(socket->app_proto, "ftp") == 0 || strcasecmp(socket->app_proto, "ftps") == 0) {
+		if (socket->verbose)
+			log_msg(stdout, "Negotiating FTP STARTTLS\n");
+
+		send_line(socket, "FEAT\r\n");
+		wait_for_text(socket, "211 ", 4);
+		send_line(socket, "AUTH TLS\r\n");
+		wait_for_text(socket, "234", 3);
+	} else if (strcasecmp(socket->app_proto, "lmtp") == 0) {
+		if (socket->verbose)
+			log_msg(stdout, "Negotiating LMTP STARTTLS\n");
+
+		wait_for_text(socket, "220 ", 4);
+		snprintf(buf, sizeof(buf), "LHLO %s\r\n", socket->hostname);
+		send_line(socket, buf);
+		wait_for_text(socket, "250 ", 4);
+		send_line(socket, "STARTTLS\r\n");
+		wait_for_text(socket, "220 ", 4);
+	} else if (strcasecmp(socket->app_proto, "pop3") == 0) {
+		if (socket->verbose)
+			log_msg(stdout, "Negotiating POP3 STARTTLS\n");
+
+		wait_for_text(socket, "+OK", 3);
+		send_line(socket, "STLS\r\n");
+		wait_for_text(socket, "+OK", 3);
+	} else if (strcasecmp(socket->app_proto, "nntp") == 0) {
+		if (socket->verbose)
+			log_msg(stdout, "Negotiating NNTP STARTTLS\n");
+
+		wait_for_text(socket, "200 ", 4);
+		send_line(socket, "STARTTLS\r\n");
+		wait_for_text(socket, "382 ", 4);
+	} else if (strcasecmp(socket->app_proto, "sieve") == 0) {
+		if (socket->verbose)
+			log_msg(stdout, "Negotiating Sieve STARTTLS\n");
+
+		wait_for_text(socket, "OK ", 3);
+		send_line(socket, "STARTTLS\r\n");
+		wait_for_text(socket, "OK ", 3);
+	} else if (strcasecmp(socket->app_proto, "postgres") == 0 || strcasecmp(socket->app_proto, "postgresql") == 0) {
+		if (socket->verbose)
+			log_msg(stdout, "Negotiating PostgreSQL STARTTLS\n");
+
+#define POSTGRES_STR "\x00\x00\x00\x08\x04\xD2\x16\x2F"
+		send(socket->fd, POSTGRES_STR, sizeof(POSTGRES_STR)-1, 0);
+		wait_for_text(socket, NULL, 0);
+	} else {
+		if (!c_isdigit(socket->app_proto[0])) {
+			static int warned = 0;
+			if (warned == 0) {
+				fprintf(stderr, "unknown protocol '%s'\n", socket->app_proto);
+				warned = 1;
+			}
+		}
+	}
+
+	return;
+}
+
+#define CANON_SERVICE(app_proto) \
+	if (strcasecmp(app_proto, "xmpp") == 0) \
+		app_proto = "xmpp-server"; \
+
+int
+starttls_proto_to_port(const char *app_proto)
+{
+	struct servent *s;
+
+	CANON_SERVICE(app_proto);
+
+	s = getservbyname(app_proto, NULL);
+	if (s != NULL) {
+		return ntohs(s->s_port);
+	}
+
+	endservent();
+
+	return 443;
+}
+
+const char *starttls_proto_to_service(const char *app_proto)
+{
+	struct servent *s;
+
+	CANON_SERVICE(app_proto);
+
+	s = getservbyname(app_proto, NULL);
+	if (s != NULL) {
+		return s->s_name;
+	}
+	endservent();
+
+	return "443";
+}
+
+void socket_bye(socket_st * socket, unsigned polite)
+{
+	int ret;
+
+	if (socket->secure && socket->session) {
+		if (polite) {
+			do
+				ret = gnutls_bye(socket->session, GNUTLS_SHUT_WR);
+			while (ret == GNUTLS_E_INTERRUPTED
+			       || ret == GNUTLS_E_AGAIN);
+			if (socket->verbose && ret < 0)
+				fprintf(stderr, "*** gnutls_bye() error: %s\n",
+					gnutls_strerror(ret));
+		}
+	}
+
+	if (socket->session) {
+		gnutls_deinit(socket->session);
+		socket->session = NULL;
+	}
+
+	freeaddrinfo(socket->addr_info);
+	socket->addr_info = socket->ptr = NULL;
+	socket->connect_addrlen = 0;
+
+	free(socket->ip);
+	free(socket->hostname);
+	free(socket->service);
+
+	shutdown(socket->fd, SHUT_RDWR);	/* no more receptions */
+	close(socket->fd);
+
+	gnutls_free(socket->rdata.data);
+	socket->rdata.data = NULL;
+
+	if (socket->server_trace)
+		fclose(socket->server_trace);
+	if (socket->client_trace)
+		fclose(socket->client_trace);
+
+	socket->fd = -1;
+	socket->secure = 0;
+}
+
+/* Handle host:port format.
+ */
+void canonicalize_host(char *hostname, char *service, unsigned service_size)
+{
+	char *p;
+
+	if ((p = strchr(hostname, ':'))) {
+		unsigned char buf[64];
+
+		if (inet_pton(AF_INET6, hostname, buf) == 1)
+			return;
+
+		*p = 0;
+
+		if (service && service_size)
+			snprintf(service, service_size, "%s", p+1);
+	} else
+		p = hostname + strlen(hostname);
+
+	if (p > hostname && p[-1] == '.')
+		p[-1] = 0; // remove trailing dot on FQDN
+}
+
+static ssize_t
+wrap_pull(gnutls_transport_ptr_t ptr, void *data, size_t len)
+{
+	socket_st *hd = ptr;
+	ssize_t r;
+
+	r = recv(hd->fd, data, len, 0);
+	if (r > 0 && hd->server_trace) {
+		fwrite(data, 1, r, hd->server_trace);
+	}
+	return r;
+}
+
+static ssize_t
+wrap_push(gnutls_transport_ptr_t ptr, const void *data, size_t len)
+{
+	socket_st *hd = ptr;
+
+	if (hd->client_trace) {
+		fwrite(data, 1, len, hd->client_trace);
+	}
+
+	return send(hd->fd, data, len, 0);
+}
+
+/* inline is used to avoid a gcc warning if used in mini-eagain */
+inline static int wrap_pull_timeout_func(gnutls_transport_ptr_t ptr,
+					   unsigned int ms)
+{
+	socket_st *hd = ptr;
+
+	return gnutls_system_recv_timeout((gnutls_transport_ptr_t)(long)hd->fd, ms);
+}
+
+
+void
+socket_open2(socket_st * hd, const char *hostname, const char *service,
+	    const char *app_proto, int flags, const char *msg, gnutls_datum_t *rdata, gnutls_datum_t *edata,
+	    FILE *server_trace, FILE *client_trace)
+{
+	struct addrinfo hints, *res, *ptr;
+	int sd, err = 0;
+	int udp = flags & SOCKET_FLAG_UDP;
+	int ret;
+	int fastopen = flags & SOCKET_FLAG_FASTOPEN;
+	char buffer[MAX_BUF + 1];
+	char portname[16] = { 0 };
+	gnutls_datum_t idna;
+	char *a_hostname;
+
+	memset(hd, 0, sizeof(*hd));
+
+	if (flags & SOCKET_FLAG_VERBOSE)
+		hd->verbose = 1;
+
+	if (rdata) {
+		hd->rdata.data = rdata->data;
+		hd->rdata.size = rdata->size;
+	}
+
+	if (edata) {
+		hd->edata.data = edata->data;
+		hd->edata.size = edata->size;
+	}
+
+	ret = gnutls_idna_map(hostname, strlen(hostname), &idna, 0);
+	if (ret < 0) {
+		fprintf(stderr, "Cannot convert %s to IDNA: %s\n", hostname, gnutls_strerror(ret));
+		exit(1);
+	}
+
+	hd->hostname = strdup(hostname);
+	a_hostname = (char*)idna.data;
+
+	if (msg != NULL)
+		log_msg(stdout, "Resolving '%s:%s'...\n", a_hostname, service);
+
+	/* get server name */
+	memset(&hints, 0, sizeof(hints));
+	hints.ai_socktype = udp ? SOCK_DGRAM : SOCK_STREAM;
+	if ((err = getaddrinfo(a_hostname, service, &hints, &res))) {
+		fprintf(stderr, "Cannot resolve %s:%s: %s\n", hostname,
+			service, gai_strerror(err));
+		exit(1);
+	}
+
+	sd = -1;
+	for (ptr = res; ptr != NULL; ptr = ptr->ai_next) {
+		sd = socket(ptr->ai_family, ptr->ai_socktype,
+			    ptr->ai_protocol);
+		if (sd == -1)
+			continue;
+
+		if ((err =
+		     getnameinfo(ptr->ai_addr, ptr->ai_addrlen, buffer,
+				 MAX_BUF, portname, sizeof(portname),
+				 NI_NUMERICHOST | NI_NUMERICSERV)) != 0) {
+			fprintf(stderr, "getnameinfo(): %s\n",
+				gai_strerror(err));
+			close(sd);
+			continue;
+		}
+
+		if (hints.ai_socktype == SOCK_DGRAM) {
+#if defined(IP_DONTFRAG)
+			int yes = 1;
+			if (setsockopt(sd, IPPROTO_IP, IP_DONTFRAG,
+				       (const void *) &yes,
+				       sizeof(yes)) < 0)
+				perror("setsockopt(IP_DF) failed");
+#elif defined(IP_MTU_DISCOVER)
+			int yes = IP_PMTUDISC_DO;
+			if (setsockopt(sd, IPPROTO_IP, IP_MTU_DISCOVER,
+				       (const void *) &yes,
+				       sizeof(yes)) < 0)
+				perror("setsockopt(IP_DF) failed");
+#endif
+		}
+
+		if (fastopen && ptr->ai_socktype == SOCK_STREAM
+		    && (ptr->ai_family == AF_INET || ptr->ai_family == AF_INET6)) {
+			memcpy(&hd->connect_addr, ptr->ai_addr, ptr->ai_addrlen);
+			hd->connect_addrlen = ptr->ai_addrlen;
+
+			if (msg)
+				log_msg(stdout, "%s '%s:%s' (TFO)...\n", msg, buffer, portname);
+
+		} else {
+			if (msg)
+				log_msg(stdout, "%s '%s:%s'...\n", msg, buffer, portname);
+
+			if ((err = connect(sd, ptr->ai_addr, ptr->ai_addrlen)) < 0) {
+				close(sd);
+				continue;
+			}
+		}
+
+		hd->fd = sd;
+		if (flags & SOCKET_FLAG_STARTTLS) {
+			hd->app_proto = app_proto;
+			socket_starttls(hd);
+			hd->app_proto = NULL;
+		}
+
+		if (!(flags & SOCKET_FLAG_SKIP_INIT)) {
+			hd->session = init_tls_session(hostname);
+			if (hd->session == NULL) {
+				fprintf(stderr, "error initializing session\n");
+				close(sd);
+				exit(1);
+			}
+		}
+
+		if (hd->session) {
+			if (hd->edata.data) {
+				ret = gnutls_record_send_early_data(hd->session, hd->edata.data, hd->edata.size);
+				if (ret < 0) {
+					fprintf(stderr, "error sending early data\n");
+					close(sd);
+					exit(1);
+				}
+			}
+			if (hd->rdata.data) {
+				gnutls_session_set_data(hd->session, hd->rdata.data, hd->rdata.size);
+			}
+
+			if (client_trace || server_trace) {
+				hd->server_trace = server_trace;
+				hd->client_trace = client_trace;
+				gnutls_transport_set_push_function(hd->session, wrap_push);
+				gnutls_transport_set_pull_function(hd->session, wrap_pull);
+				gnutls_transport_set_pull_timeout_function(hd->session, wrap_pull_timeout_func);
+				gnutls_transport_set_ptr(hd->session, hd);
+			} else {
+				gnutls_transport_set_int(hd->session, hd->fd);
+			}
+		}
+
+		if (!(flags & SOCKET_FLAG_RAW) && !(flags & SOCKET_FLAG_SKIP_INIT)) {
+			err = do_handshake(hd);
+			if (err == GNUTLS_E_PUSH_ERROR) { /* failed connecting */
+				gnutls_deinit(hd->session);
+				hd->session = NULL;
+				close(sd);
+				continue;
+			}
+			else if (err < 0) {
+				if (!(flags & SOCKET_FLAG_DONT_PRINT_ERRORS))
+					fprintf(stderr, "*** handshake has failed: %s\n", gnutls_strerror(err));
+				close(sd);
+				exit(1);
+			}
+		}
+
+		break;
+	}
+
+	if (err != 0) {
+		int e = errno;
+		fprintf(stderr, "Could not connect to %s:%s: %s\n",
+				buffer, portname, strerror(e));
+		exit(1);
+	}
+
+	if (sd == -1) {
+		fprintf(stderr, "Could not find a supported socket\n");
+		exit(1);
+	}
+
+	if ((flags & SOCKET_FLAG_RAW) || (flags & SOCKET_FLAG_SKIP_INIT))
+		hd->secure = 0;
+	else
+		hd->secure = 1;
+
+	hd->fd = sd;
+	hd->ip = strdup(buffer);
+	hd->service = strdup(portname);
+	hd->ptr = ptr;
+	hd->addr_info = res;
+	gnutls_free(hd->rdata.data);
+	hd->rdata.data = NULL;
+	gnutls_free(hd->edata.data);
+	hd->edata.data = NULL;
+	gnutls_free(idna.data);
+	return;
+}
+
+/* converts a textual service or port to
+ * a service.
+ */
+const char *port_to_service(const char *sport, const char *proto)
+{
+	unsigned int port;
+	struct servent *sr;
+
+	if (!c_isdigit(sport[0]))
+		return sport;
+
+	port = atoi(sport);
+	if (port == 0)
+		return sport;
+
+	port = htons(port);
+
+	sr = getservbyport(port, proto);
+	if (sr == NULL) {
+		fprintf(stderr,
+			"Warning: getservbyport(%s) failed. Using port number as service.\n", sport);
+		return sport;
+	}
+
+	return sr->s_name;
+}
+
+int service_to_port(const char *service, const char *proto)
+{
+	unsigned int port;
+	struct servent *sr;
+
+	port = atoi(service);
+	if (port != 0)
+		return port;
+
+	sr = getservbyname(service, proto);
+	if (sr == NULL) {
+		fprintf(stderr, "Warning: getservbyname() failed for '%s/%s'.\n", service, proto);
+		exit(1);
+	}
+
+	return ntohs(sr->s_port);
+}