Recently Written · git

io_tls.c (6002 bytes)

 #include <errno.h>
 #include <limits.h>
 #include <pwd.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
 #include <netdb.h>
 
 #include <sys/socket.h>
 #include <sys/stat.h>
 
 #include <tls.h>
 
 #include "common.h"
 #include "io.h"
 
 #define TLS_OFF 0
 #define TLS_ON  1
 #define TLS_PEM 2
 
 struct pem {
 	char path[PATH_MAX];
 	char *dir;
 	char *cert;
 	size_t certsz;
 };
 
 int tls;
 
 static struct pem pem = { .dir = ".share/sacc/cert" };
 
 static int
 mkpath(char *path, mode_t mode)
 {
 	char *s;
 	int r;
 
 	for (s = path+1; (s = strchr(s, '/')) != NULL; ++s) {
 		s[0] = '\0';
 		errno = 0;
 		r = mkdir(path, mode);
 		s[0] = '/';
 		if (r == -1 && errno != EEXIST)
 			return -1;
 	};
 	if (mkdir(path, S_IRWXU) == -1 && errno != EEXIST)
 		return -1;
 	return 0;
 }
 
 static int
 setup_tls(void)
 {
 	struct passwd *pw;
 	char *p;
 	int n;
 
 	if ((p = getenv("SACC_CERT_DIR")) != NULL) {
 		n = snprintf(pem.path, sizeof(pem.path), "%s/", p);
 		if (n < 0 || (unsigned)n >= sizeof(pem.path)) {
 			diag("PEM path too long: %s/", p);
 			return -1;
 		}
 	} else {
 		if ((pw = getpwuid(geteuid())) == NULL)
 			return -1;
 		n = snprintf(pem.path, sizeof(pem.path), "%s/%s/",
 		             pw->pw_dir, pem.dir);
 		if (n < 0 || (unsigned)n >= sizeof(pem.path)) {
 			diag("PEM path too long: %s/%s/", pw->pw_dir, pem.dir);
 			return -1;
 		}
 	}
 
 	if (mkpath(pem.path, S_IRWXU) == -1) {
 		diag("Can't create cert dir: %s: %s",
 		     pem.path, strerror(errno));
 	} else {
 		pem.cert = pem.path + n;
 		pem.certsz = sizeof(pem.path) - n;
 	}
 
 	return 0;
 }
 
 static int
 close_tls(struct cnx *c)
 {
 	int r;
 
 	if (tls != TLS_OFF && c->tls) {
 		do {
 			r = tls_close(c->tls);
 		} while (r == TLS_WANT_POLLIN || r == TLS_WANT_POLLOUT);
 
 		tls_free(c->tls);
 	}
 
 	return close(c->sock);
 }
 
 static int
 savepem(struct tls *t, char *path)
 {
 	FILE *f;
 	const char *s;
 	size_t ln;
 	int e = 0;
 
 	if (path == NULL)
 		return -1;
 	if ((s = tls_peer_cert_chain_pem(t, &ln)) == NULL)
 		return -1;
 	if ((f = fopen(path, "w")) == NULL)
 		return -1;
 
 	while (ln > 0)
 		ln = fwrite(s, 1, ln, f);
 
 	if (ferror(f))
 		e = -1;
 	if (fclose(f) != 0)
 		e = -1;
 	if (e == -1)
 		unlink(path);
 
 	return e;
 }
 
 static char *
 conftls(struct tls *t, const char *host)
 {
 	struct tls_config *tc;
 	char *p;
 	int n;
 
 	tc = NULL;
 	p = NULL;
 
 	if (pem.cert == NULL)
 		return NULL;
 
 	n = snprintf(pem.cert, pem.certsz, "%s", host);
 	if (n < 0 || (unsigned)n >= pem.certsz) {
 		diag("PEM path too long: %s/%s", pem.cert, host);
 		return NULL;
 	}
 
 	switch (tls) {
 	case TLS_ON:
 		/* check if there is a local certificate for target */
 		if (access(pem.path, R_OK) == 0) {
 			if ((tc = tls_config_new()) == NULL)
 				return NULL;
 			if (tls_config_set_ca_file(tc, pem.path) == -1)
 				goto end;
 			if (tls_configure(t, tc) == -1)
 				goto end;
 			p = pem.path;
 		}
 		break;
 	case TLS_PEM:
 		/* save target certificate to file */
 		if ((tc = tls_config_new()) == NULL)
 			return NULL;
 		tls_config_insecure_noverifycert(tc);
 		if (tls_configure(t, tc) == -1)
 			goto end;
 		p = pem.path;
 		break;
 	}
 end:
 	tls_config_free(tc);
 	return p;
 }
 
 static int
 connect_tls(struct cnx *c, struct addrinfo *ai, const char *host)
 {
 	struct tls *t;
 	char *s, *pempath;
 	int r;
 
 	c->tls = NULL;
 	s = NULL;
 	r = CONN_ERROR;
 
 	if (connect(c->sock, ai->ai_addr, ai->ai_addrlen) == -1)
 		return r;
 
 	if (!tls)
 		return CONN_VALID;
 
 	if ((t = tls_client()) == NULL)
 		return r;
 
 	pempath = conftls(t, host);
 
 	if (tls_connect_socket(t, c->sock, host) == -1)
 		goto end;
 
 	do {
 		r = tls_handshake(t);
 	} while (r == TLS_WANT_POLLIN || r == TLS_WANT_POLLOUT);
 
 	if (r == 0) {
 		switch (tls) {
 		case TLS_ON:
 			c->tls = t;
 			break;
 		case TLS_PEM:
 			r = savepem(t, pempath) == 0 ? CONN_RETRY : CONN_ERROR;
 			tls = TLS_ON;
 			break;
 		}
 	} else {
 		diag("Can't establish TLS with \"%s\": %s",
 		     host, tls_error(t));
 
 		if (!interactive) {
 			r = CONN_ABORT;
 			goto end;
 		}
 
 		if (pem.cert) {
 			s = uiprompt("Save certificate locally and retry? [yN]: ");
 			switch (*s) {
 			case 'Y':
 			case 'y':
 				tls = TLS_PEM;
 				r = CONN_RETRY;
 				goto end;
 			}
 		}
 
 		s = uiprompt("Retry on cleartext? [Yn]: ");
 		switch (*s) {
 		case 'Y':
 		case 'y':
 		case '\0':
 			tls = TLS_OFF;
 			r = CONN_RETRY;
 			break;
 		default:
 			r = CONN_ABORT;
 		}
 	}
 end:
 	free(s);
 	if (r != CONN_VALID)
 		tls_free(t);
 
 	return r;
 }
 
 static void
 connerr_tls(struct cnx *c, const char *host, const char *port, int err)
 {
 	if (c->sock == -1) {
 		diag("Can't open socket: %s", strerror(err));
 	} else {
 		if (tls != TLS_OFF && c->tls) {
 			diag("Can't establish TLS with \"%s\": %s",
 			     host, tls_error(c->tls));
 		} else {
 			diag("Can't connect to: %s:%s: %s", host, port,
 			     strerror(err));
 		}
 	}
 }
 
 static char *
 parseurl_tls(char *url)
 {
 	char *p;
 
 	if (p = strstr(url, "://")) {
 		if (!strncmp(url, "gopher", p - url)) {
 			if (tls)
 				diag("Switching from gophers to gopher");
 			tls = TLS_OFF;
 		} else if (!strncmp(url, "gophers", p - url)) {
 			tls = TLS_ON;
 		} else {
 			die("Protocol not supported: %.*s", p - url, url);
 		}
 		url = p + 3;
 	}
 
 	return url;
 }
 
 static ssize_t
 read_tls(struct cnx *c, void *buf, size_t bs)
 {
 	ssize_t n;
 
 	if (tls != TLS_OFF && c->tls) {
 		do {
 			n = tls_read(c->tls, buf, bs);
 		} while (n == TLS_WANT_POLLIN || n == TLS_WANT_POLLOUT);
 	} else {
 		n = read(c->sock, buf, bs);
 	}
 
 	return n;
 }
 
 static ssize_t
 write_tls(struct cnx *c, void *buf, size_t bs)
 {
 	ssize_t n;
 
 	if (tls) {
 		do {
 			n = tls_write(c->tls, buf, bs);
 		} while (n == TLS_WANT_POLLIN || n == TLS_WANT_POLLOUT);
 	} else {
 		n = write(c->sock, buf, bs);
 	}
 
 	return n;
 }
 
 int (*iosetup)(void) = setup_tls;
 int (*ioclose)(struct cnx *) = close_tls;
 int (*ioconnect)(struct cnx *, struct addrinfo *, const char *) = connect_tls;
 void (*ioconnerr)(struct cnx *, const char *, const char *, int) = connerr_tls;
 char *(*ioparseurl)(char *) = parseurl_tls;
 ssize_t (*ioread)(struct cnx *, void *, size_t) = read_tls;
 ssize_t (*iowrite)(struct cnx *, void *, size_t) = write_tls;