xref: /minix3/usr.bin/ftp/ssl.c (revision 0a6a1f1d05b60e214de2f05a7310ddd1f0e590e7)
1*0a6a1f1dSLionel Sambuc /*	$NetBSD: ssl.c,v 1.5 2015/09/16 15:32:53 joerg Exp $	*/
204203a83SThomas Cort 
304203a83SThomas Cort /*-
404203a83SThomas Cort  * Copyright (c) 1998-2004 Dag-Erling Coïdan Smørgrav
504203a83SThomas Cort  * Copyright (c) 2008, 2010 Joerg Sonnenberger <joerg@NetBSD.org>
6*0a6a1f1dSLionel Sambuc  * Copyright (c) 2015 Thomas Klausner <wiz@NetBSD.org>
704203a83SThomas Cort  * All rights reserved.
804203a83SThomas Cort  *
904203a83SThomas Cort  * Redistribution and use in source and binary forms, with or without
1004203a83SThomas Cort  * modification, are permitted provided that the following conditions
1104203a83SThomas Cort  * are met:
1204203a83SThomas Cort  * 1. Redistributions of source code must retain the above copyright
1304203a83SThomas Cort  *    notice, this list of conditions and the following disclaimer
1404203a83SThomas Cort  *    in this position and unchanged.
1504203a83SThomas Cort  * 2. Redistributions in binary form must reproduce the above copyright
1604203a83SThomas Cort  *    notice, this list of conditions and the following disclaimer in the
1704203a83SThomas Cort  *    documentation and/or other materials provided with the distribution.
1804203a83SThomas Cort  * 3. The name of the author may not be used to endorse or promote products
1904203a83SThomas Cort  *    derived from this software without specific prior written permission
2004203a83SThomas Cort  *
2104203a83SThomas Cort  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
2204203a83SThomas Cort  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
2304203a83SThomas Cort  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
2404203a83SThomas Cort  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
2504203a83SThomas Cort  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
2604203a83SThomas Cort  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
2704203a83SThomas Cort  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
2804203a83SThomas Cort  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
2904203a83SThomas Cort  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
3004203a83SThomas Cort  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
3104203a83SThomas Cort  *
3204203a83SThomas Cort  * $FreeBSD: common.c,v 1.53 2007/12/19 00:26:36 des Exp $
3304203a83SThomas Cort  */
3404203a83SThomas Cort 
3504203a83SThomas Cort #include <sys/cdefs.h>
3604203a83SThomas Cort #ifndef lint
37*0a6a1f1dSLionel Sambuc __RCSID("$NetBSD: ssl.c,v 1.5 2015/09/16 15:32:53 joerg Exp $");
3804203a83SThomas Cort #endif
3904203a83SThomas Cort 
4004203a83SThomas Cort #include <time.h>
4104203a83SThomas Cort #include <unistd.h>
4204203a83SThomas Cort #include <fcntl.h>
4304203a83SThomas Cort 
4404203a83SThomas Cort #include <sys/param.h>
4504203a83SThomas Cort #include <sys/select.h>
4604203a83SThomas Cort #include <sys/uio.h>
4704203a83SThomas Cort 
4804203a83SThomas Cort #include <netinet/tcp.h>
4904203a83SThomas Cort #include <netinet/in.h>
5004203a83SThomas Cort #include <openssl/crypto.h>
5104203a83SThomas Cort #include <openssl/x509.h>
5204203a83SThomas Cort #include <openssl/pem.h>
5304203a83SThomas Cort #include <openssl/ssl.h>
5404203a83SThomas Cort #include <openssl/err.h>
5504203a83SThomas Cort 
5604203a83SThomas Cort #include "ssl.h"
5704203a83SThomas Cort 
5804203a83SThomas Cort extern int quit_time, verbose, ftp_debug;
5904203a83SThomas Cort extern FILE *ttyout;
6004203a83SThomas Cort 
6104203a83SThomas Cort struct fetch_connect {
6204203a83SThomas Cort 	int			 sd;		/* file/socket descriptor */
6304203a83SThomas Cort 	char			*buf;		/* buffer */
6404203a83SThomas Cort 	size_t			 bufsize;	/* buffer size */
6504203a83SThomas Cort 	size_t			 bufpos;	/* position of buffer */
6604203a83SThomas Cort 	size_t			 buflen;	/* length of buffer contents */
6704203a83SThomas Cort 	struct {				/* data cached after an
6804203a83SThomas Cort 						   interrupted read */
6904203a83SThomas Cort 		char	*buf;
7004203a83SThomas Cort 		size_t	 size;
7104203a83SThomas Cort 		size_t	 pos;
7204203a83SThomas Cort 		size_t	 len;
7304203a83SThomas Cort 	} cache;
7404203a83SThomas Cort 	int 			 issock;
7504203a83SThomas Cort 	int			 iserr;
7604203a83SThomas Cort 	int			 iseof;
7704203a83SThomas Cort 	SSL			*ssl;		/* SSL handle */
7804203a83SThomas Cort };
7904203a83SThomas Cort 
8004203a83SThomas Cort /*
8104203a83SThomas Cort  * Write a vector to a connection w/ timeout
8204203a83SThomas Cort  * Note: can modify the iovec.
8304203a83SThomas Cort  */
8404203a83SThomas Cort static ssize_t
fetch_writev(struct fetch_connect * conn,struct iovec * iov,int iovcnt)8504203a83SThomas Cort fetch_writev(struct fetch_connect *conn, struct iovec *iov, int iovcnt)
8604203a83SThomas Cort {
8704203a83SThomas Cort 	struct timeval now, timeout, delta;
8804203a83SThomas Cort 	fd_set writefds;
8904203a83SThomas Cort 	ssize_t len, total;
9004203a83SThomas Cort 	int r;
9104203a83SThomas Cort 
9204203a83SThomas Cort 	if (quit_time > 0) {
9304203a83SThomas Cort 		FD_ZERO(&writefds);
9404203a83SThomas Cort 		gettimeofday(&timeout, NULL);
9504203a83SThomas Cort 		timeout.tv_sec += quit_time;
9604203a83SThomas Cort 	}
9704203a83SThomas Cort 
9804203a83SThomas Cort 	total = 0;
9904203a83SThomas Cort 	while (iovcnt > 0) {
10004203a83SThomas Cort 		while (quit_time > 0 && !FD_ISSET(conn->sd, &writefds)) {
10104203a83SThomas Cort 			FD_SET(conn->sd, &writefds);
10204203a83SThomas Cort 			gettimeofday(&now, NULL);
10304203a83SThomas Cort 			delta.tv_sec = timeout.tv_sec - now.tv_sec;
10404203a83SThomas Cort 			delta.tv_usec = timeout.tv_usec - now.tv_usec;
10504203a83SThomas Cort 			if (delta.tv_usec < 0) {
10604203a83SThomas Cort 				delta.tv_usec += 1000000;
10704203a83SThomas Cort 				delta.tv_sec--;
10804203a83SThomas Cort 			}
10904203a83SThomas Cort 			if (delta.tv_sec < 0) {
11004203a83SThomas Cort 				errno = ETIMEDOUT;
11104203a83SThomas Cort 				return -1;
11204203a83SThomas Cort 			}
11304203a83SThomas Cort 			errno = 0;
11404203a83SThomas Cort 			r = select(conn->sd + 1, NULL, &writefds, NULL, &delta);
11504203a83SThomas Cort 			if (r == -1) {
11604203a83SThomas Cort 				if (errno == EINTR)
11704203a83SThomas Cort 					continue;
11804203a83SThomas Cort 				return -1;
11904203a83SThomas Cort 			}
12004203a83SThomas Cort 		}
12104203a83SThomas Cort 		errno = 0;
12204203a83SThomas Cort 		if (conn->ssl != NULL)
12304203a83SThomas Cort 			len = SSL_write(conn->ssl, iov->iov_base, iov->iov_len);
12404203a83SThomas Cort 		else
12504203a83SThomas Cort 			len = writev(conn->sd, iov, iovcnt);
12604203a83SThomas Cort 		if (len == 0) {
12704203a83SThomas Cort 			/* we consider a short write a failure */
12804203a83SThomas Cort 			/* XXX perhaps we shouldn't in the SSL case */
12904203a83SThomas Cort 			errno = EPIPE;
13004203a83SThomas Cort 			return -1;
13104203a83SThomas Cort 		}
13204203a83SThomas Cort 		if (len < 0) {
13304203a83SThomas Cort 			if (errno == EINTR)
13404203a83SThomas Cort 				continue;
13504203a83SThomas Cort 			return -1;
13604203a83SThomas Cort 		}
13704203a83SThomas Cort 		total += len;
13804203a83SThomas Cort 		while (iovcnt > 0 && len >= (ssize_t)iov->iov_len) {
13904203a83SThomas Cort 			len -= iov->iov_len;
14004203a83SThomas Cort 			iov++;
14104203a83SThomas Cort 			iovcnt--;
14204203a83SThomas Cort 		}
14304203a83SThomas Cort 		if (iovcnt > 0) {
14404203a83SThomas Cort 			iov->iov_len -= len;
14504203a83SThomas Cort 			iov->iov_base = (char *)iov->iov_base + len;
14604203a83SThomas Cort 		}
14704203a83SThomas Cort 	}
14804203a83SThomas Cort 	return total;
14904203a83SThomas Cort }
15004203a83SThomas Cort 
15104203a83SThomas Cort /*
15204203a83SThomas Cort  * Write to a connection w/ timeout
15304203a83SThomas Cort  */
15404203a83SThomas Cort static int
fetch_write(struct fetch_connect * conn,const char * str,size_t len)15504203a83SThomas Cort fetch_write(struct fetch_connect *conn, const char *str, size_t len)
15604203a83SThomas Cort {
15704203a83SThomas Cort 	struct iovec iov[1];
15804203a83SThomas Cort 
15904203a83SThomas Cort 	iov[0].iov_base = (char *)__UNCONST(str);
16004203a83SThomas Cort 	iov[0].iov_len = len;
16104203a83SThomas Cort 	return fetch_writev(conn, iov, 1);
16204203a83SThomas Cort }
16304203a83SThomas Cort 
16404203a83SThomas Cort /*
16504203a83SThomas Cort  * Send a formatted line; optionally echo to terminal
16604203a83SThomas Cort  */
16704203a83SThomas Cort int
fetch_printf(struct fetch_connect * conn,const char * fmt,...)16804203a83SThomas Cort fetch_printf(struct fetch_connect *conn, const char *fmt, ...)
16904203a83SThomas Cort {
17004203a83SThomas Cort 	va_list ap;
17104203a83SThomas Cort 	size_t len;
17204203a83SThomas Cort 	char *msg;
17304203a83SThomas Cort 	int r;
17404203a83SThomas Cort 
17504203a83SThomas Cort 	va_start(ap, fmt);
17604203a83SThomas Cort 	len = vasprintf(&msg, fmt, ap);
17704203a83SThomas Cort 	va_end(ap);
17804203a83SThomas Cort 
17904203a83SThomas Cort 	if (msg == NULL) {
18004203a83SThomas Cort 		errno = ENOMEM;
18104203a83SThomas Cort 		return -1;
18204203a83SThomas Cort 	}
18304203a83SThomas Cort 
18404203a83SThomas Cort 	r = fetch_write(conn, msg, len);
18504203a83SThomas Cort 	free(msg);
18604203a83SThomas Cort 	return r;
18704203a83SThomas Cort }
18804203a83SThomas Cort 
18904203a83SThomas Cort int
fetch_fileno(struct fetch_connect * conn)19004203a83SThomas Cort fetch_fileno(struct fetch_connect *conn)
19104203a83SThomas Cort {
19204203a83SThomas Cort 
19304203a83SThomas Cort 	return conn->sd;
19404203a83SThomas Cort }
19504203a83SThomas Cort 
19604203a83SThomas Cort int
fetch_error(struct fetch_connect * conn)19704203a83SThomas Cort fetch_error(struct fetch_connect *conn)
19804203a83SThomas Cort {
19904203a83SThomas Cort 
20004203a83SThomas Cort 	return conn->iserr;
20104203a83SThomas Cort }
20204203a83SThomas Cort 
20304203a83SThomas Cort static void
fetch_clearerr(struct fetch_connect * conn)20404203a83SThomas Cort fetch_clearerr(struct fetch_connect *conn)
20504203a83SThomas Cort {
20604203a83SThomas Cort 
20704203a83SThomas Cort 	conn->iserr = 0;
20804203a83SThomas Cort }
20904203a83SThomas Cort 
21004203a83SThomas Cort int
fetch_flush(struct fetch_connect * conn)21104203a83SThomas Cort fetch_flush(struct fetch_connect *conn)
21204203a83SThomas Cort {
21304203a83SThomas Cort 	int v;
21404203a83SThomas Cort 
21504203a83SThomas Cort 	if (conn->issock) {
21604203a83SThomas Cort #ifdef TCP_NOPUSH
21704203a83SThomas Cort 		v = 0;
21804203a83SThomas Cort 		setsockopt(conn->sd, IPPROTO_TCP, TCP_NOPUSH, &v, sizeof(v));
21904203a83SThomas Cort #endif
22004203a83SThomas Cort 		v = 1;
22104203a83SThomas Cort 		setsockopt(conn->sd, IPPROTO_TCP, TCP_NODELAY, &v, sizeof(v));
22204203a83SThomas Cort 	}
22304203a83SThomas Cort 	return 0;
22404203a83SThomas Cort }
22504203a83SThomas Cort 
22604203a83SThomas Cort /*ARGSUSED*/
22704203a83SThomas Cort struct fetch_connect *
fetch_open(const char * fname,const char * fmode)22804203a83SThomas Cort fetch_open(const char *fname, const char *fmode)
22904203a83SThomas Cort {
23004203a83SThomas Cort 	struct fetch_connect *conn;
23104203a83SThomas Cort 	int fd;
23204203a83SThomas Cort 
23304203a83SThomas Cort 	fd = open(fname, O_RDONLY); /* XXX: fmode */
23404203a83SThomas Cort 	if (fd < 0)
23504203a83SThomas Cort 		return NULL;
23604203a83SThomas Cort 
23704203a83SThomas Cort 	if ((conn = calloc(1, sizeof(*conn))) == NULL) {
23804203a83SThomas Cort 		close(fd);
23904203a83SThomas Cort 		return NULL;
24004203a83SThomas Cort 	}
24104203a83SThomas Cort 
24204203a83SThomas Cort 	conn->sd = fd;
24304203a83SThomas Cort 	conn->issock = 0;
24404203a83SThomas Cort 	return conn;
24504203a83SThomas Cort }
24604203a83SThomas Cort 
24704203a83SThomas Cort /*ARGSUSED*/
24804203a83SThomas Cort struct fetch_connect *
fetch_fdopen(int sd,const char * fmode)24904203a83SThomas Cort fetch_fdopen(int sd, const char *fmode)
25004203a83SThomas Cort {
25104203a83SThomas Cort 	struct fetch_connect *conn;
25204203a83SThomas Cort #if defined(SO_NOSIGPIPE) || defined(TCP_NOPUSH)
25304203a83SThomas Cort 	int opt = 1;
25404203a83SThomas Cort #endif
25504203a83SThomas Cort 
25604203a83SThomas Cort 	if ((conn = calloc(1, sizeof(*conn))) == NULL)
25704203a83SThomas Cort 		return NULL;
25804203a83SThomas Cort 
25904203a83SThomas Cort 	conn->sd = sd;
26004203a83SThomas Cort 	conn->issock = 1;
26104203a83SThomas Cort 	fcntl(sd, F_SETFD, FD_CLOEXEC);
26204203a83SThomas Cort #ifdef SO_NOSIGPIPE
26304203a83SThomas Cort 	setsockopt(sd, SOL_SOCKET, SO_NOSIGPIPE, &opt, sizeof(opt));
26404203a83SThomas Cort #endif
26504203a83SThomas Cort #ifdef TCP_NOPUSH
26604203a83SThomas Cort 	setsockopt(sd, IPPROTO_TCP, TCP_NOPUSH, &opt, sizeof(opt));
26704203a83SThomas Cort #endif
26804203a83SThomas Cort 	return conn;
26904203a83SThomas Cort }
27004203a83SThomas Cort 
27104203a83SThomas Cort int
fetch_close(struct fetch_connect * conn)27204203a83SThomas Cort fetch_close(struct fetch_connect *conn)
27304203a83SThomas Cort {
27404203a83SThomas Cort 	int rv = 0;
27504203a83SThomas Cort 
27604203a83SThomas Cort 	if (conn != NULL) {
27704203a83SThomas Cort 		fetch_flush(conn);
27804203a83SThomas Cort 		SSL_free(conn->ssl);
27904203a83SThomas Cort 		rv = close(conn->sd);
28004203a83SThomas Cort 		if (rv < 0) {
28104203a83SThomas Cort 			errno = rv;
28204203a83SThomas Cort 			rv = EOF;
28304203a83SThomas Cort 		}
28404203a83SThomas Cort 		free(conn->cache.buf);
28504203a83SThomas Cort 		free(conn->buf);
28604203a83SThomas Cort 		free(conn);
28704203a83SThomas Cort 	}
28804203a83SThomas Cort 	return rv;
28904203a83SThomas Cort }
29004203a83SThomas Cort 
29104203a83SThomas Cort #define FETCH_READ_WAIT		-2
29204203a83SThomas Cort #define FETCH_READ_ERROR	-1
29304203a83SThomas Cort 
29404203a83SThomas Cort static ssize_t
fetch_ssl_read(SSL * ssl,void * buf,size_t len)29504203a83SThomas Cort fetch_ssl_read(SSL *ssl, void *buf, size_t len)
29604203a83SThomas Cort {
29704203a83SThomas Cort 	ssize_t rlen;
29804203a83SThomas Cort 	int ssl_err;
29904203a83SThomas Cort 
30004203a83SThomas Cort 	rlen = SSL_read(ssl, buf, len);
30104203a83SThomas Cort 	if (rlen < 0) {
30204203a83SThomas Cort 		ssl_err = SSL_get_error(ssl, rlen);
30304203a83SThomas Cort 		if (ssl_err == SSL_ERROR_WANT_READ ||
30404203a83SThomas Cort 		    ssl_err == SSL_ERROR_WANT_WRITE) {
30504203a83SThomas Cort 			return FETCH_READ_WAIT;
30604203a83SThomas Cort 		}
30704203a83SThomas Cort 		ERR_print_errors_fp(ttyout);
30804203a83SThomas Cort 		return FETCH_READ_ERROR;
30904203a83SThomas Cort 	}
31004203a83SThomas Cort 	return rlen;
31104203a83SThomas Cort }
31204203a83SThomas Cort 
31304203a83SThomas Cort static ssize_t
fetch_nonssl_read(int sd,void * buf,size_t len)31404203a83SThomas Cort fetch_nonssl_read(int sd, void *buf, size_t len)
31504203a83SThomas Cort {
31604203a83SThomas Cort 	ssize_t rlen;
31704203a83SThomas Cort 
31804203a83SThomas Cort 	rlen = read(sd, buf, len);
31904203a83SThomas Cort 	if (rlen < 0) {
32004203a83SThomas Cort 		if (errno == EAGAIN || errno == EINTR)
32104203a83SThomas Cort 			return FETCH_READ_WAIT;
32204203a83SThomas Cort 		return FETCH_READ_ERROR;
32304203a83SThomas Cort 	}
32404203a83SThomas Cort 	return rlen;
32504203a83SThomas Cort }
32604203a83SThomas Cort 
32704203a83SThomas Cort /*
32804203a83SThomas Cort  * Cache some data that was read from a socket but cannot be immediately
32904203a83SThomas Cort  * returned because of an interrupted system call.
33004203a83SThomas Cort  */
33104203a83SThomas Cort static int
fetch_cache_data(struct fetch_connect * conn,char * src,size_t nbytes)33204203a83SThomas Cort fetch_cache_data(struct fetch_connect *conn, char *src, size_t nbytes)
33304203a83SThomas Cort {
33404203a83SThomas Cort 
33504203a83SThomas Cort 	if (conn->cache.size < nbytes) {
33604203a83SThomas Cort 		char *tmp = realloc(conn->cache.buf, nbytes);
33704203a83SThomas Cort 		if (tmp == NULL)
33804203a83SThomas Cort 			return -1;
33904203a83SThomas Cort 
34004203a83SThomas Cort 		conn->cache.buf = tmp;
34104203a83SThomas Cort 		conn->cache.size = nbytes;
34204203a83SThomas Cort 	}
34304203a83SThomas Cort 
34404203a83SThomas Cort 	memcpy(conn->cache.buf, src, nbytes);
34504203a83SThomas Cort 	conn->cache.len = nbytes;
34604203a83SThomas Cort 	conn->cache.pos = 0;
34704203a83SThomas Cort 	return 0;
34804203a83SThomas Cort }
34904203a83SThomas Cort 
35004203a83SThomas Cort ssize_t
fetch_read(void * ptr,size_t size,size_t nmemb,struct fetch_connect * conn)35104203a83SThomas Cort fetch_read(void *ptr, size_t size, size_t nmemb, struct fetch_connect *conn)
35204203a83SThomas Cort {
35304203a83SThomas Cort 	struct timeval now, timeout, delta;
35404203a83SThomas Cort 	fd_set readfds;
35504203a83SThomas Cort 	ssize_t rlen, total;
35604203a83SThomas Cort 	size_t len;
35704203a83SThomas Cort 	char *start, *buf;
35804203a83SThomas Cort 
35904203a83SThomas Cort 	if (quit_time > 0) {
36004203a83SThomas Cort 		gettimeofday(&timeout, NULL);
36104203a83SThomas Cort 		timeout.tv_sec += quit_time;
36204203a83SThomas Cort 	}
36304203a83SThomas Cort 
36404203a83SThomas Cort 	total = 0;
36504203a83SThomas Cort 	start = buf = ptr;
36604203a83SThomas Cort 	len = size * nmemb;
36704203a83SThomas Cort 
36804203a83SThomas Cort 	if (conn->cache.len > 0) {
36904203a83SThomas Cort 		/*
37004203a83SThomas Cort 		 * The last invocation of fetch_read was interrupted by a
37104203a83SThomas Cort 		 * signal after some data had been read from the socket. Copy
37204203a83SThomas Cort 		 * the cached data into the supplied buffer before trying to
37304203a83SThomas Cort 		 * read from the socket again.
37404203a83SThomas Cort 		 */
37504203a83SThomas Cort 		total = (conn->cache.len < len) ? conn->cache.len : len;
37604203a83SThomas Cort 		memcpy(buf, conn->cache.buf, total);
37704203a83SThomas Cort 
37804203a83SThomas Cort 		conn->cache.len -= total;
37904203a83SThomas Cort 		conn->cache.pos += total;
38004203a83SThomas Cort 		len -= total;
38104203a83SThomas Cort 		buf += total;
38204203a83SThomas Cort 	}
38304203a83SThomas Cort 
38404203a83SThomas Cort 	while (len > 0) {
38504203a83SThomas Cort 		/*
38604203a83SThomas Cort 		 * The socket is non-blocking.  Instead of the canonical
38704203a83SThomas Cort 		 * select() -> read(), we do the following:
38804203a83SThomas Cort 		 *
38904203a83SThomas Cort 		 * 1) call read() or SSL_read().
39004203a83SThomas Cort 		 * 2) if an error occurred, return -1.
39104203a83SThomas Cort 		 * 3) if we received data but we still expect more,
39204203a83SThomas Cort 		 *    update our counters and loop.
39304203a83SThomas Cort 		 * 4) if read() or SSL_read() signaled EOF, return.
39404203a83SThomas Cort 		 * 5) if we did not receive any data but we're not at EOF,
39504203a83SThomas Cort 		 *    call select().
39604203a83SThomas Cort 		 *
39704203a83SThomas Cort 		 * In the SSL case, this is necessary because if we
39804203a83SThomas Cort 		 * receive a close notification, we have to call
39904203a83SThomas Cort 		 * SSL_read() one additional time after we've read
40004203a83SThomas Cort 		 * everything we received.
40104203a83SThomas Cort 		 *
40204203a83SThomas Cort 		 * In the non-SSL case, it may improve performance (very
40304203a83SThomas Cort 		 * slightly) when reading small amounts of data.
40404203a83SThomas Cort 		 */
40504203a83SThomas Cort 		if (conn->ssl != NULL)
40604203a83SThomas Cort 			rlen = fetch_ssl_read(conn->ssl, buf, len);
40704203a83SThomas Cort 		else
40804203a83SThomas Cort 			rlen = fetch_nonssl_read(conn->sd, buf, len);
40904203a83SThomas Cort 		if (rlen == 0) {
41004203a83SThomas Cort 			break;
41104203a83SThomas Cort 		} else if (rlen > 0) {
41204203a83SThomas Cort 			len -= rlen;
41304203a83SThomas Cort 			buf += rlen;
41404203a83SThomas Cort 			total += rlen;
41504203a83SThomas Cort 			continue;
41604203a83SThomas Cort 		} else if (rlen == FETCH_READ_ERROR) {
41704203a83SThomas Cort 			if (errno == EINTR)
41804203a83SThomas Cort 				fetch_cache_data(conn, start, total);
41904203a83SThomas Cort 			return -1;
42004203a83SThomas Cort 		}
42104203a83SThomas Cort 		FD_ZERO(&readfds);
42204203a83SThomas Cort 		while (!FD_ISSET(conn->sd, &readfds)) {
42304203a83SThomas Cort 			FD_SET(conn->sd, &readfds);
42404203a83SThomas Cort 			if (quit_time > 0) {
42504203a83SThomas Cort 				gettimeofday(&now, NULL);
42604203a83SThomas Cort 				if (!timercmp(&timeout, &now, >)) {
42704203a83SThomas Cort 					errno = ETIMEDOUT;
42804203a83SThomas Cort 					return -1;
42904203a83SThomas Cort 				}
43004203a83SThomas Cort 				timersub(&timeout, &now, &delta);
43104203a83SThomas Cort 			}
43204203a83SThomas Cort 			errno = 0;
43304203a83SThomas Cort 			if (select(conn->sd + 1, &readfds, NULL, NULL,
43404203a83SThomas Cort 				quit_time > 0 ? &delta : NULL) < 0) {
43504203a83SThomas Cort 				if (errno == EINTR)
43604203a83SThomas Cort 					continue;
43704203a83SThomas Cort 				return -1;
43804203a83SThomas Cort 			}
43904203a83SThomas Cort 		}
44004203a83SThomas Cort 	}
44104203a83SThomas Cort 	return total;
44204203a83SThomas Cort }
44304203a83SThomas Cort 
44404203a83SThomas Cort #define MIN_BUF_SIZE 1024
44504203a83SThomas Cort 
44604203a83SThomas Cort /*
44704203a83SThomas Cort  * Read a line of text from a connection w/ timeout
44804203a83SThomas Cort  */
44904203a83SThomas Cort char *
fetch_getln(char * str,int size,struct fetch_connect * conn)45004203a83SThomas Cort fetch_getln(char *str, int size, struct fetch_connect *conn)
45104203a83SThomas Cort {
45204203a83SThomas Cort 	size_t tmpsize;
45304203a83SThomas Cort 	ssize_t len;
45404203a83SThomas Cort 	char c;
45504203a83SThomas Cort 
45604203a83SThomas Cort 	if (conn->buf == NULL) {
45704203a83SThomas Cort 		if ((conn->buf = malloc(MIN_BUF_SIZE)) == NULL) {
45804203a83SThomas Cort 			errno = ENOMEM;
45904203a83SThomas Cort 			conn->iserr = 1;
46004203a83SThomas Cort 			return NULL;
46104203a83SThomas Cort 		}
46204203a83SThomas Cort 		conn->bufsize = MIN_BUF_SIZE;
46304203a83SThomas Cort 	}
46404203a83SThomas Cort 
46504203a83SThomas Cort 	if (conn->iserr || conn->iseof)
46604203a83SThomas Cort 		return NULL;
46704203a83SThomas Cort 
46804203a83SThomas Cort 	if (conn->buflen - conn->bufpos > 0)
46904203a83SThomas Cort 		goto done;
47004203a83SThomas Cort 
47104203a83SThomas Cort 	conn->buf[0] = '\0';
47204203a83SThomas Cort 	conn->bufpos = 0;
47304203a83SThomas Cort 	conn->buflen = 0;
47404203a83SThomas Cort 	do {
47504203a83SThomas Cort 		len = fetch_read(&c, sizeof(c), 1, conn);
47604203a83SThomas Cort 		if (len == -1) {
47704203a83SThomas Cort 			conn->iserr = 1;
47804203a83SThomas Cort 			return NULL;
47904203a83SThomas Cort 		}
48004203a83SThomas Cort 		if (len == 0) {
48104203a83SThomas Cort 			conn->iseof = 1;
48204203a83SThomas Cort 			break;
48304203a83SThomas Cort 		}
48404203a83SThomas Cort 		conn->buf[conn->buflen++] = c;
48504203a83SThomas Cort 		if (conn->buflen == conn->bufsize) {
48604203a83SThomas Cort 			char *tmp = conn->buf;
48704203a83SThomas Cort 			tmpsize = conn->bufsize * 2 + 1;
48804203a83SThomas Cort 			if ((tmp = realloc(tmp, tmpsize)) == NULL) {
48904203a83SThomas Cort 				errno = ENOMEM;
49004203a83SThomas Cort 				conn->iserr = 1;
49104203a83SThomas Cort 				return NULL;
49204203a83SThomas Cort 			}
49304203a83SThomas Cort 			conn->buf = tmp;
49404203a83SThomas Cort 			conn->bufsize = tmpsize;
49504203a83SThomas Cort 		}
49604203a83SThomas Cort 	} while (c != '\n');
49704203a83SThomas Cort 
49804203a83SThomas Cort 	if (conn->buflen == 0)
49904203a83SThomas Cort 		return NULL;
50004203a83SThomas Cort  done:
50104203a83SThomas Cort 	tmpsize = MIN(size - 1, (int)(conn->buflen - conn->bufpos));
50204203a83SThomas Cort 	memcpy(str, conn->buf + conn->bufpos, tmpsize);
50304203a83SThomas Cort 	str[tmpsize] = '\0';
50404203a83SThomas Cort 	conn->bufpos += tmpsize;
50504203a83SThomas Cort 	return str;
50604203a83SThomas Cort }
50704203a83SThomas Cort 
50804203a83SThomas Cort int
fetch_getline(struct fetch_connect * conn,char * buf,size_t buflen,const char ** errormsg)50904203a83SThomas Cort fetch_getline(struct fetch_connect *conn, char *buf, size_t buflen,
51004203a83SThomas Cort     const char **errormsg)
51104203a83SThomas Cort {
51204203a83SThomas Cort 	size_t len;
51304203a83SThomas Cort 	int rv;
51404203a83SThomas Cort 
51504203a83SThomas Cort 	if (fetch_getln(buf, buflen, conn) == NULL) {
51604203a83SThomas Cort 		if (conn->iseof) {	/* EOF */
51704203a83SThomas Cort 			rv = -2;
51804203a83SThomas Cort 			if (errormsg)
51904203a83SThomas Cort 				*errormsg = "\nEOF received";
52004203a83SThomas Cort 		} else {		/* error */
52104203a83SThomas Cort 			rv = -1;
52204203a83SThomas Cort 			if (errormsg)
52304203a83SThomas Cort 				*errormsg = "Error encountered";
52404203a83SThomas Cort 		}
52504203a83SThomas Cort 		fetch_clearerr(conn);
52604203a83SThomas Cort 		return rv;
52704203a83SThomas Cort 	}
52804203a83SThomas Cort 	len = strlen(buf);
52904203a83SThomas Cort 	if (buf[len - 1] == '\n') {	/* clear any trailing newline */
53004203a83SThomas Cort 		buf[--len] = '\0';
53104203a83SThomas Cort 	} else if (len == buflen - 1) {	/* line too long */
53204203a83SThomas Cort 		while (1) {
53304203a83SThomas Cort 			char c;
53404203a83SThomas Cort 			ssize_t rlen = fetch_read(&c, sizeof(c), 1, conn);
53504203a83SThomas Cort 			if (rlen <= 0 || c == '\n')
53604203a83SThomas Cort 				break;
53704203a83SThomas Cort 		}
53804203a83SThomas Cort 		if (errormsg)
53904203a83SThomas Cort 			*errormsg = "Input line is too long";
54004203a83SThomas Cort 		fetch_clearerr(conn);
54104203a83SThomas Cort 		return -3;
54204203a83SThomas Cort 	}
54304203a83SThomas Cort 	if (errormsg)
54404203a83SThomas Cort 		*errormsg = NULL;
54504203a83SThomas Cort 	return len;
54604203a83SThomas Cort }
54704203a83SThomas Cort 
54804203a83SThomas Cort void *
fetch_start_ssl(int sock,const char * servername)549*0a6a1f1dSLionel Sambuc fetch_start_ssl(int sock, const char *servername)
55004203a83SThomas Cort {
55104203a83SThomas Cort 	SSL *ssl;
55204203a83SThomas Cort 	SSL_CTX *ctx;
55304203a83SThomas Cort 	int ret, ssl_err;
55404203a83SThomas Cort 
55504203a83SThomas Cort 	/* Init the SSL library and context */
55604203a83SThomas Cort 	if (!SSL_library_init()){
55704203a83SThomas Cort 		fprintf(ttyout, "SSL library init failed\n");
55804203a83SThomas Cort 		return NULL;
55904203a83SThomas Cort 	}
56004203a83SThomas Cort 
56104203a83SThomas Cort 	SSL_load_error_strings();
56204203a83SThomas Cort 
56304203a83SThomas Cort 	ctx = SSL_CTX_new(SSLv23_client_method());
56404203a83SThomas Cort 	SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
56504203a83SThomas Cort 
56604203a83SThomas Cort 	ssl = SSL_new(ctx);
56704203a83SThomas Cort 	if (ssl == NULL){
56804203a83SThomas Cort 		fprintf(ttyout, "SSL context creation failed\n");
56904203a83SThomas Cort 		SSL_CTX_free(ctx);
57004203a83SThomas Cort 		return NULL;
57104203a83SThomas Cort 	}
57204203a83SThomas Cort 	SSL_set_fd(ssl, sock);
573*0a6a1f1dSLionel Sambuc 	if (!SSL_set_tlsext_host_name(ssl, __UNCONST(servername))) {
574*0a6a1f1dSLionel Sambuc 		fprintf(ttyout, "SSL hostname setting failed\n");
575*0a6a1f1dSLionel Sambuc 		SSL_CTX_free(ctx);
576*0a6a1f1dSLionel Sambuc 		return NULL;
577*0a6a1f1dSLionel Sambuc 	}
57804203a83SThomas Cort 	while ((ret = SSL_connect(ssl)) == -1) {
57904203a83SThomas Cort 		ssl_err = SSL_get_error(ssl, ret);
58004203a83SThomas Cort 		if (ssl_err != SSL_ERROR_WANT_READ &&
58104203a83SThomas Cort 		    ssl_err != SSL_ERROR_WANT_WRITE) {
58204203a83SThomas Cort 			ERR_print_errors_fp(ttyout);
58304203a83SThomas Cort 			SSL_free(ssl);
58404203a83SThomas Cort 			return NULL;
58504203a83SThomas Cort 		}
58604203a83SThomas Cort 	}
58704203a83SThomas Cort 
58804203a83SThomas Cort 	if (ftp_debug && verbose) {
58904203a83SThomas Cort 		X509 *cert;
59004203a83SThomas Cort 		X509_NAME *name;
59104203a83SThomas Cort 		char *str;
59204203a83SThomas Cort 
59304203a83SThomas Cort 		fprintf(ttyout, "SSL connection established using %s\n",
59404203a83SThomas Cort 		    SSL_get_cipher(ssl));
59504203a83SThomas Cort 		cert = SSL_get_peer_certificate(ssl);
59604203a83SThomas Cort 		name = X509_get_subject_name(cert);
59704203a83SThomas Cort 		str = X509_NAME_oneline(name, 0, 0);
59804203a83SThomas Cort 		fprintf(ttyout, "Certificate subject: %s\n", str);
59904203a83SThomas Cort 		free(str);
60004203a83SThomas Cort 		name = X509_get_issuer_name(cert);
60104203a83SThomas Cort 		str = X509_NAME_oneline(name, 0, 0);
60204203a83SThomas Cort 		fprintf(ttyout, "Certificate issuer: %s\n", str);
60304203a83SThomas Cort 		free(str);
60404203a83SThomas Cort 	}
60504203a83SThomas Cort 
60604203a83SThomas Cort 	return ssl;
60704203a83SThomas Cort }
60804203a83SThomas Cort 
60904203a83SThomas Cort 
61004203a83SThomas Cort void
fetch_set_ssl(struct fetch_connect * conn,void * ssl)61104203a83SThomas Cort fetch_set_ssl(struct fetch_connect *conn, void *ssl)
61204203a83SThomas Cort {
61304203a83SThomas Cort 	conn->ssl = ssl;
61404203a83SThomas Cort }
615