imapfilter/imapfilter/socket.c

#include <string.h>
#include <errno.h>
#include <unistd.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>
#include <fcntl.h>

#include "config.h"
#include "imapfilter.h"

#ifdef SSL_TLS
#include <openssl/ssl.h>
#include <openssl/err.h>
#include <openssl/x509.h>
#endif


long timeout = -1;              /* Server non-response timeout in seconds. */

int sockpri = -1;               /* Main socket used mostly. */
int sockaux = -1;               /* Auxiliary socked used when another
                                   connection is needed. */
#ifdef SSL_TLS
static SSL *sslpri = NULL;
static SSL *sslaux = NULL;
#endif


/*
 * Connect to mail server.
 */
int init_connection(int *sock, char *serv, unsigned short int port,
                     unsigned int protocol)
{
    struct sockaddr_in sa;
    struct hostent *he;
#ifdef SSL_TLS
    SSL **ssl = (sock == &sockpri ? &sslpri : &sslaux);
#else
    if (protocol != SSL_DISABLED) {
        error("imapfilter: SSL not supported by this build\n");
        return ERROR_SSL;
    }
#endif

    memset((char *)&sa, 0, sizeof(struct sockaddr_in));

    *sock = socket(PF_INET, SOCK_STREAM, 0);

    if (*sock < 0) {
        error("imapfilter: create socket; %s\n", strerror(errno));
        return ERROR_NETWORK;
    }
    if (!(he = gethostbyname(serv))) {
        error("imapfilter: get network host entry of %s; %s\n", serv,
              strerror(errno));
        close_connection(sock);
        return ERROR_NETWORK;
    }
    sa.sin_family = AF_INET;
    sa.sin_port = htons(port);
    sa.sin_addr = *(struct in_addr *) he->h_addr;

    xstrncpy(serv, he->h_name, SERVER_LEN - 1);

    if (connect(*sock, (struct sockaddr *) & sa, sizeof(struct sockaddr))) {
        error("imapfilter: initiating connection to %s; %s\n", serv,
              strerror(errno));
        close_connection(sock);
        return ERROR_NETWORK;
    }
    log_info(LOG_SERVER, serv);

#ifdef SSL_TLS
    if (protocol != SSL_DISABLED)
        if (!ssl_init(sock, protocol)) {
            if (sock == &sockpri)
                info("Connected to %s using %s.\n", serv,
                     SSL_get_cipher(*ssl));
            return 0;
        } else
            return ERROR_SSL;
    else
        *ssl = NULL;
#endif

    if (sock == &sockpri)
        info("Connected to %s.\n", serv);

    return 0;
}


#ifdef SSL_TLS
/*
 * Initialize Secure Socket Layer connection.
 */
int ssl_init(int *sock, unsigned int protocol)
{
    int e;
    unsigned int i, n = 0;
    SSL_CTX *ctx;
    SSL_METHOD *method = NULL;
    X509 *cert;
    char *c;
    EVP_MD *evp;
    unsigned char digest[EVP_MAX_MD_SIZE];
    SSL **ssl = (sock == &sockpri ? &sslpri : &sslaux);

    SSL_library_init();

    switch (protocol) {
    case SSL_SSL_V2:
        method = SSLv2_client_method();
        break;
    case SSL_SSL_V3:
        method = SSLv3_client_method();
        break;
    case SSL_TLS_V1:
        method = TLSv1_client_method();
        break;
    }

    if (!(ctx = SSL_CTX_new(method)))
        return ERROR_SSL;

    if (!(*ssl = SSL_new(ctx)))
        return ERROR_SSL;

    SSL_set_fd(*ssl, *sock);

    e = SSL_connect(*ssl);

    if (e < 0) {
        error("imapfilter: initiating SSL connection; %s",
              ERR_error_string(e, NULL));
        return ERROR_SSL;
    }
    /* Get server's certificate. */
    if (!(cert = SSL_get_peer_certificate(*ssl)))
        return ERROR_SSL;

    if (!(c = X509_NAME_oneline(X509_get_subject_name(cert), 0, 0)))
        return ERROR_SSL;
    verbose("Server certificate subject: %s\n", c);
    xfree(c);

    if (!(c = X509_NAME_oneline(X509_get_issuer_name(cert), 0, 0)))
        return ERROR_SSL;
    verbose("Server certificate issuer: %s\n", c);
    xfree(c);

    if (!(evp = EVP_md5()))
        return ERROR_SSL;
    if (!(X509_digest(cert, evp, digest, &n)))
        return ERROR_SSL;

    verbose("Server key fingerprint: ");
    for (i = 0; i < n; i++)
        verbose(i != n - 1 ? "%02X:" : "%02X\n", digest[i]);

    X509_free(cert);
    SSL_CTX_free(ctx);

    return 0;
}

#endif


/*
 * Disconnect from mail server.
 */
int close_connection(int *sock)
{
#ifdef SSL_TLS
    SSL **ssl = (sock == &sockpri ? &sslpri : &sslaux);

    if (*ssl) {
        SSL_shutdown(*ssl);
        SSL_free(*ssl);
        *ssl = NULL;
    }
#endif

    if (*sock >= 0 && close(*sock)) {
        error("imapfilter: closing socket; %s\n", strerror(errno));
        return ERROR_NETWORK;
    } else {
        *sock = -1;
        return 0;
    }
}


/*
 * Read data from socket.
 */
int socket_read(int *sock, char *buf)
{
    int f, r, s;
    fd_set fds;
    struct timeval tv;
    struct timeval *tvp = NULL;
#ifdef SSL_TLS
    SSL **ssl = (sock == &sockpri ? &sslpri : &sslaux);
#endif

    r = 0;
    s = 1;

    memset(buf, 0, RESPONSE_BUF);

    if (timeout >= 0) {
        tv.tv_sec = timeout;
        tv.tv_usec = 0;
        tvp = &tv;
    }
    f = fcntl(*sock, F_GETFL, 0);
    fcntl(*sock, F_SETFL, f | O_NONBLOCK);

    FD_ZERO(&fds);
    FD_SET(*sock, &fds);

#ifdef SSL_TLS
    if (*ssl) {
        if (SSL_pending(*ssl)
            || ((s = select(*sock + 1, &fds, NULL, NULL, tvp)) > 0
                && FD_ISSET(*sock, &fds)))
            r = SSL_read(*ssl, buf, RESPONSE_BUF - 1);
    } else
#endif
        if ((s = select(*sock + 1, &fds, NULL, NULL, tvp)) > 0
            && FD_ISSET(*sock, &fds))
        r = read(*sock, buf, RESPONSE_BUF - 1);

    fcntl(*sock, F_SETFL, f);

    if (s == -1)
        fatal(ERROR_NETWORK, "imapfilter: waiting input from socket; %s\n",
              strerror(errno));
    else if (!s)
        fatal(ERROR_NETWORK,
              "imapfilter: timeout period expired while waiting data\n");

#ifdef SSL_TLS
    if (*ssl) {
        if (r < 0)
            fatal(ERROR_NETWORK, "imapfilter: reading data; %s",
                  ERR_error_string(r, NULL));
    } else
#endif
    if (r == -1)
        fatal(ERROR_NETWORK, "imapfilter: reading data; %s",
              strerror(errno));

    return 0;
}


/*
 * Write data to socket.
 */
int socket_write(int *sock, char *data)
{
#ifdef SSL_TLS
    int e;
    SSL **ssl = (sock == &sockpri ? &sslpri : &sslaux);

    if (*ssl) {
        e = SSL_write(*ssl, data, strlen(data));
        if (e <= 0)
            fatal(ERROR_NETWORK,
                  "imapfilter: sending data; %s",
                  ERR_error_string(e, NULL));
    } else
#endif
    if (write(*sock, data, strlen(data)) == -1)
        fatal(ERROR_NETWORK, "imapfilter: sending data; %s",
              strerror(errno));

    return 0;
}
1	lefcha	1.1	#include <string.h>
2			#include <errno.h>
3			#include <unistd.h>
4	lefcha	1.10	#include <sys/time.h>
5	lefcha	1.1	#include <sys/types.h>
6			#include <sys/socket.h>
7			#include <netinet/in.h>
8			#include <netdb.h>
9			#include <fcntl.h>
10
11			#include "config.h"
12			#include "imapfilter.h"
13
14			#ifdef SSL_TLS
15			#include <openssl/ssl.h>
16			#include <openssl/err.h>
17	lefcha	1.3	#include <openssl/x509.h>
18	lefcha	1.13	#endif
19
20	lefcha	1.1
21	lefcha	1.14	long timeout = -1; /* Server non-response timeout in seconds. */
22	lefcha	1.1
23	lefcha	1.18	int sockpri = -1; /* Main socket used mostly. */
24			int sockaux = -1; /* Auxiliary socked used when another
25			connection is needed. */
26	lefcha	1.13	#ifdef SSL_TLS
27	lefcha	1.19.2.1	static SSL *sslpri = NULL;
28			static SSL *sslaux = NULL;
29	lefcha	1.1	#endif
30
31
32			/*
33			* Connect to mail server.
34			*/
35	lefcha	1.18	int init_connection(int sock, char serv, unsigned short int port,
36	lefcha	1.14	unsigned int protocol)
37	lefcha	1.1	{
38			struct sockaddr_in sa;
39			struct hostent *he;
40	lefcha	1.19.2.1	#ifdef SSL_TLS
41			SSL **ssl = (sock == &sockpri ? &sslpri : &sslaux);
42			#else
43	lefcha	1.17	if (protocol != SSL_DISABLED) {
44			error("imapfilter: SSL not supported by this build\n");
45			return ERROR_SSL;
46			}
47			#endif
48	lefcha	1.1
49	lefcha	1.19	memset((char *)&sa, 0, sizeof(struct sockaddr_in));
50	lefcha	1.1
51	lefcha	1.18	*sock = socket(PF_INET, SOCK_STREAM, 0);
52	lefcha	1.1
53	lefcha	1.18	if (*sock < 0) {
54	lefcha	1.1	error("imapfilter: create socket; %s\n", strerror(errno));
55			return ERROR_NETWORK;
56			}
57			if (!(he = gethostbyname(serv))) {
58	lefcha	1.12	error("imapfilter: get network host entry of %s; %s\n", serv,
59			strerror(errno));
60	lefcha	1.18	close_connection(sock);
61	lefcha	1.1	return ERROR_NETWORK;
62			}
63			sa.sin_family = AF_INET;
64			sa.sin_port = htons(port);
65			sa.sin_addr = (struct in_addr ) he->h_addr;
66
67	lefcha	1.9	xstrncpy(serv, he->h_name, SERVER_LEN - 1);
68
69	lefcha	1.18	if (connect(sock, (struct sockaddr ) & sa, sizeof(struct sockaddr))) {
70	lefcha	1.14	error("imapfilter: initiating connection to %s; %s\n", serv,
71			strerror(errno));
72	lefcha	1.18	close_connection(sock);
73	lefcha	1.1	return ERROR_NETWORK;
74			}
75			log_info(LOG_SERVER, serv);
76	lefcha	1.2
77	lefcha	1.1	#ifdef SSL_TLS
78	lefcha	1.11	if (protocol != SSL_DISABLED)
79	lefcha	1.18	if (!ssl_init(sock, protocol)) {
80	lefcha	1.19	if (sock == &sockpri)
81			info("Connected to %s using %s.\n", serv,
82	lefcha	1.19.2.1	SSL_get_cipher(*ssl));
83	lefcha	1.11	return 0;
84			} else
85			return ERROR_SSL;
86			else
87	lefcha	1.19.2.1	*ssl = NULL;
88	lefcha	1.1	#endif
89
90	lefcha	1.19	if (sock == &sockpri)
91			info("Connected to %s.\n", serv);
92	lefcha	1.10
93	lefcha	1.1	return 0;
94			}
95
96
97			#ifdef SSL_TLS
98			/*
99			* Initialize Secure Socket Layer connection.
100			*/
101	lefcha	1.18	int ssl_init(int *sock, unsigned int protocol)
102	lefcha	1.1	{
103			int e;
104	lefcha	1.7	unsigned int i, n = 0;
105	lefcha	1.1	SSL_CTX *ctx;
106			SSL_METHOD *method = NULL;
107	lefcha	1.3	X509 *cert;
108			char *c;
109			EVP_MD *evp;
110			unsigned char digest[EVP_MAX_MD_SIZE];
111	lefcha	1.19.2.1	SSL **ssl = (sock == &sockpri ? &sslpri : &sslaux);
112	lefcha	1.2
113	lefcha	1.1	SSL_library_init();
114	lefcha	1.2
115	lefcha	1.1	switch (protocol) {
116			case SSL_SSL_V2:
117			method = SSLv2_client_method();
118			break;
119			case SSL_SSL_V3:
120			method = SSLv3_client_method();
121			break;
122			case SSL_TLS_V1:
123			method = TLSv1_client_method();
124			break;
125			}
126	lefcha	1.2
127	lefcha	1.1	if (!(ctx = SSL_CTX_new(method)))
128			return ERROR_SSL;
129	lefcha	1.2
130	lefcha	1.19.2.1	if (!(*ssl = SSL_new(ctx)))
131	lefcha	1.1	return ERROR_SSL;
132	lefcha	1.2
133	lefcha	1.19.2.1	SSL_set_fd(ssl, sock);
134	lefcha	1.1
135	lefcha	1.19.2.1	e = SSL_connect(*ssl);
136	lefcha	1.2
137	lefcha	1.13	if (e < 0) {
138	lefcha	1.1	error("imapfilter: initiating SSL connection; %s",
139			ERR_error_string(e, NULL));
140			return ERROR_SSL;
141			}
142	lefcha	1.3	/* Get server's certificate. */
143	lefcha	1.19.2.1	if (!(cert = SSL_get_peer_certificate(*ssl)))
144	lefcha	1.3	return ERROR_SSL;
145
146			if (!(c = X509_NAME_oneline(X509_get_subject_name(cert), 0, 0)))
147			return ERROR_SSL;
148			verbose("Server certificate subject: %s\n", c);
149	lefcha	1.15	xfree(c);
150	lefcha	1.3
151			if (!(c = X509_NAME_oneline(X509_get_issuer_name(cert), 0, 0)))
152			return ERROR_SSL;
153			verbose("Server certificate issuer: %s\n", c);
154	lefcha	1.15	xfree(c);
155	lefcha	1.3
156			if (!(evp = EVP_md5()))
157			return ERROR_SSL;
158	lefcha	1.7	if (!(X509_digest(cert, evp, digest, &n)))
159	lefcha	1.3	return ERROR_SSL;
160
161			verbose("Server key fingerprint: ");
162	lefcha	1.7	for (i = 0; i < n; i++)
163			verbose(i != n - 1 ? "%02X:" : "%02X\n", digest[i]);
164	lefcha	1.3
165			X509_free(cert);
166	lefcha	1.1	SSL_CTX_free(ctx);
167
168			return 0;
169			}
170	lefcha	1.19
171	lefcha	1.1	#endif
172
173
174			/*
175			* Disconnect from mail server.
176			*/
177	lefcha	1.18	int close_connection(int *sock)
178	lefcha	1.1	{
179			#ifdef SSL_TLS
180	lefcha	1.19.2.1	SSL **ssl = (sock == &sockpri ? &sslpri : &sslaux);
181
182			if (*ssl) {
183			SSL_shutdown(*ssl);
184			SSL_free(*ssl);
185			*ssl = NULL;
186	lefcha	1.1	}
187			#endif
188
189	lefcha	1.18	if (sock >= 0 && close(sock)) {
190	lefcha	1.1	error("imapfilter: closing socket; %s\n", strerror(errno));
191			return ERROR_NETWORK;
192	lefcha	1.16	} else {
193	lefcha	1.18	*sock = -1;
194	lefcha	1.1	return 0;
195	lefcha	1.16	}
196	lefcha	1.1	}
197
198
199			/*
200			* Read data from socket.
201			*/
202	lefcha	1.18	int socket_read(int sock, char buf)
203	lefcha	1.1	{
204	lefcha	1.18	int f, r, s;
205	lefcha	1.1	fd_set fds;
206			struct timeval tv;
207	lefcha	1.13	struct timeval *tvp = NULL;
208	lefcha	1.19.2.1	#ifdef SSL_TLS
209			SSL **ssl = (sock == &sockpri ? &sslpri : &sslaux);
210			#endif
211	lefcha	1.7
212	lefcha	1.8	r = 0;
213			s = 1;
214	lefcha	1.1
215	lefcha	1.5	memset(buf, 0, RESPONSE_BUF);
216	lefcha	1.1
217	lefcha	1.14	if (timeout >= 0) {
218	lefcha	1.13	tv.tv_sec = timeout;
219			tv.tv_usec = 0;
220			tvp = &tv;
221			}
222	lefcha	1.18	f = fcntl(*sock, F_GETFL, 0);
223			fcntl(*sock, F_SETFL, f \| O_NONBLOCK);
224	lefcha	1.1
225			FD_ZERO(&fds);
226	lefcha	1.18	FD_SET(*sock, &fds);
227	lefcha	1.1
228			#ifdef SSL_TLS
229	lefcha	1.19.2.1	if (*ssl) {
230			if (SSL_pending(*ssl)
231	lefcha	1.18	\|\| ((s = select(*sock + 1, &fds, NULL, NULL, tvp)) > 0
232			&& FD_ISSET(*sock, &fds)))
233	lefcha	1.19.2.1	r = SSL_read(*ssl, buf, RESPONSE_BUF - 1);
234	lefcha	1.6	} else
235	lefcha	1.1	#endif
236	lefcha	1.18	if ((s = select(*sock + 1, &fds, NULL, NULL, tvp)) > 0
237			&& FD_ISSET(*sock, &fds))
238			r = read(*sock, buf, RESPONSE_BUF - 1);
239	lefcha	1.6
240	lefcha	1.18	fcntl(*sock, F_SETFL, f);
241	lefcha	1.2
242	lefcha	1.8	if (s == -1)
243	lefcha	1.6	fatal(ERROR_NETWORK, "imapfilter: waiting input from socket; %s\n",
244			strerror(errno));
245	lefcha	1.8	else if (!s)
246			fatal(ERROR_NETWORK,
247			"imapfilter: timeout period expired while waiting data\n");
248	lefcha	1.1
249			#ifdef SSL_TLS
250	lefcha	1.19.2.1	if (*ssl) {
251	lefcha	1.8	if (r < 0)
252	lefcha	1.6	fatal(ERROR_NETWORK, "imapfilter: reading data; %s",
253			ERR_error_string(r, NULL));
254			} else
255	lefcha	1.1	#endif
256	lefcha	1.6	if (r == -1)
257			fatal(ERROR_NETWORK, "imapfilter: reading data; %s",
258			strerror(errno));
259	lefcha	1.1
260	lefcha	1.6	return 0;
261	lefcha	1.1	}
262
263
264			/*
265			* Write data to socket.
266			*/
267	lefcha	1.18	int socket_write(int sock, char data)
268	lefcha	1.1	{
269			#ifdef SSL_TLS
270			int e;
271	lefcha	1.19.2.1	SSL **ssl = (sock == &sockpri ? &sslpri : &sslaux);
272	lefcha	1.1
273	lefcha	1.19.2.1	if (*ssl) {
274			e = SSL_write(*ssl, data, strlen(data));
275	lefcha	1.1	if (e <= 0)
276			fatal(ERROR_NETWORK,
277			"imapfilter: sending data; %s",
278			ERR_error_string(e, NULL));
279			} else
280			#endif
281	lefcha	1.18	if (write(*sock, data, strlen(data)) == -1)
282	lefcha	1.1	fatal(ERROR_NETWORK, "imapfilter: sending data; %s",
283			strerror(errno));
284	lefcha	1.2
285	lefcha	1.1	return 0;
286			}