Add a few more MacOS X valgrind suppressions

[nmh] / sbr / netsec.c

diff --git a/sbr/netsec.c b/sbr/netsec.c
index cb297cc1b9714c61f16026c6c7956aada8b3cde4..83d75631ac788afbd0d8c1dc2f3663d73c0a44d7 100644 (file)
--- a/sbr/netsec.c
+++ b/sbr/netsec.c
@@ -1,6 +1,4 @@
-
-/*
- * netsec.c -- Network security routines for handling protocols that
+/* netsec.c -- Network security routines for handling protocols that

  *            require SASL and/or TLS.
  *
  * This code is Copyright (c) 2016, by the authors of nmh.  See the
  *            require SASL and/or TLS.
  *
  * This code is Copyright (c) 2016, by the authors of nmh.  See the


@@ -8,11 +6,16 @@
  * complete copyright information.
  */
 
  * complete copyright information.
  */
 

-#include <h/mh.h>
-#include <h/utils.h>
-#include <h/netsec.h>
+#include "h/mh.h"
+#include "credentials.h"
+#include "getcpy.h"
+#include "brkstring.h"
+#include "h/utils.h"
+#include "h/netsec.h"
+#include "h/oauth.h"

 #include <stdarg.h>
 #include <sys/select.h>
 #include <stdarg.h>
 #include <sys/select.h>

+#include "base64.h"

 
 #ifdef CYRUS_SASL
 #include <sasl/sasl.h>
 
 #ifdef CYRUS_SASL
 #include <sasl/sasl.h>


@@ -30,7 +33,7 @@ static int netsec_get_user(void *context, int id, const char **result,
 static int netsec_get_password(sasl_conn_t *conn, void *context, int id,
                               sasl_secret_t **psecret);
 
 static int netsec_get_password(sasl_conn_t *conn, void *context, int id,
                               sasl_secret_t **psecret);
 

-static int sasl_initialized = 0;
+static bool sasl_initialized;

 
 #define SASL_MAXRECVBUF 65536
 #endif /* CYRUS_SASL */
 
 #define SASL_MAXRECVBUF 65536
 #endif /* CYRUS_SASL */


@@ -39,7 +42,7 @@ static int sasl_initialized = 0;
 #include <openssl/ssl.h>
 #include <openssl/err.h>
 
 #include <openssl/ssl.h>
 #include <openssl/err.h>
 

-static int tls_initialized = 0;
+static bool tls_initialized;

 static SSL_CTX *sslctx = NULL;         /* SSL Context */
 
 #endif /* TLS_SUPPORT */
 static SSL_CTX *sslctx = NULL;         /* SSL Context */
 
 #endif /* TLS_SUPPORT */


@@ -53,10 +56,16 @@ static SSL_CTX *sslctx = NULL;              /* SSL Context */
  */
 
 struct _netsec_context {
  */
 
 struct _netsec_context {

-    int ns_fd;                 /* Descriptor for network connection */
+    int ns_readfd;             /* Read descriptor for network connection */
+    int ns_writefd;            /* Write descriptor for network connection */
+    int ns_noclose;            /* Do not close file descriptors if set */

     int ns_snoop;              /* If true, display network data */
     int ns_snoop;              /* If true, display network data */

+    netsec_snoop_callback *ns_snoop_cb; /* Snoop output callback */
+    void *ns_snoop_context;    /* Context data for snoop function */
+    char *ns_snoop_savebuf;    /* Save buffer for snoop data */

     int ns_timeout;            /* Network read timeout, in seconds */
     char *ns_userid;           /* Userid for authentication */
     int ns_timeout;            /* Network read timeout, in seconds */
     char *ns_userid;           /* Userid for authentication */

+    char *ns_hostname;         /* Hostname we've connected to */

     unsigned char *ns_inbuffer;        /* Our read input buffer */
     unsigned char *ns_inptr;   /* Our read buffer input pointer */
     unsigned int ns_inbuflen;  /* Length of data in input buffer */
     unsigned char *ns_inbuffer;        /* Our read input buffer */
     unsigned char *ns_inptr;   /* Our read buffer input pointer */
     unsigned int ns_inbuflen;  /* Length of data in input buffer */


@@ -65,16 +74,19 @@ struct _netsec_context {
     unsigned char *ns_outptr;  /* Output buffer pointer */
     unsigned int ns_outbuflen; /* Output buffer data length */
     unsigned int ns_outbufsize;        /* Output buffer size */
     unsigned char *ns_outptr;  /* Output buffer pointer */
     unsigned int ns_outbuflen; /* Output buffer data length */
     unsigned int ns_outbufsize;        /* Output buffer size */

-#ifdef CYRUS_SASL
-    char *sasl_hostname;       /* Hostname we've connected to */

     char *sasl_mech;           /* User-requested mechanism */
     char *sasl_mech;           /* User-requested mechanism */

+    char *sasl_chosen_mech;    /* Mechanism chosen by SASL */
+    netsec_sasl_callback sasl_proto_cb; /* SASL callback we use */
+    void *sasl_proto_context;  /* Context to be used by SASL callback */
+#ifdef OAUTH_SUPPORT
+    char *oauth_service;       /* OAuth2 service name */
+#endif /* OAUTH_SUPPORT */
+#ifdef CYRUS_SASL

     sasl_conn_t *sasl_conn;    /* SASL connection context */
     sasl_ssf_t sasl_ssf;       /* SASL Security Strength Factor */
     sasl_conn_t *sasl_conn;    /* SASL connection context */
     sasl_ssf_t sasl_ssf;       /* SASL Security Strength Factor */

-    netsec_sasl_callback sasl_proto_cb; /* SASL callback we use */

     sasl_callback_t *sasl_cbs; /* Callbacks used by SASL */
     nmh_creds_t sasl_creds;    /* Credentials (username/password) */
     sasl_secret_t *sasl_secret;        /* SASL password structure */
     sasl_callback_t *sasl_cbs; /* Callbacks used by SASL */
     nmh_creds_t sasl_creds;    /* Credentials (username/password) */
     sasl_secret_t *sasl_secret;        /* SASL password structure */

-    char *sasl_chosen_mech;    /* Mechanism chosen by SASL */

     int sasl_seclayer;         /* If true, SASL security layer is enabled */
     char *sasl_tmpbuf;         /* Temporary read buffer for decodes */
     size_t sasl_maxbufsize;    /* Maximum negotiated SASL buffer size */
     int sasl_seclayer;         /* If true, SASL security layer is enabled */
     char *sasl_tmpbuf;         /* Temporary read buffer for decodes */
     size_t sasl_maxbufsize;    /* Maximum negotiated SASL buffer size */


@@ -86,31 +98,40 @@ struct _netsec_context {
 };
 
 /*
 };
 
 /*

- * Function to allocate error message strings
+ * Function to read data from the actual network socket

  */
 
  */
 

-static void netsec_err(char **errstr, const char *format, ...);
+static int netsec_fillread(netsec_context *ns_context, char **errstr);

 
 /*
 
 /*

- * Function to read data from the actual network socket
+ * Code to check the ASCII content of a byte array.

  */
 
  */
 

-static int netsec_fillread(netsec_context *ns_context, char **errstr);
+static int checkascii(const unsigned char *byte, size_t len);

 
 /*
  * How this code works, in general.
  *
 
 /*
  * How this code works, in general.
  *

- * _If_ we are using no encryption or SASL encryption, then we buffer the
- * network data through ns_inbuffer and ns_outbuffer.  That should be
- * relatively self-explanatory.
+ * _If_ we are using no encryption then we buffer the network data
+ * through ns_inbuffer and ns_outbuffer.  That should be relatively
+ * self-explanatory.

  *
  *

- * If we are using SSL for encryption, then use a buffering BIO for output
- * (that just easier).  Still do buffering for reads; when we need more
- * data we call the BIO_read() function to fill our local buffer.
+ * If we use encryption, then ns_inbuffer and ns_outbuffer contain the
+ * cleartext data.  When it comes time to send the encrypted data on the
+ * (either from a flush or the buffer is full) we either use BIO_write()
+ * for TLS or sasl_encode() (followed by a write() for Cyrus-SASL.  For
+ * reads we either use BIO_read() (TLS) or do a network read into a
+ * temporary buffer and use sasl_decode() (Cyrus-SASL).  Note that if
+ * negotiate TLS then we disable SASL encryption.

  *
  *

- * For SASL, we make use of (for now) the Cyrus-SASL library.  For some
- * mechanisms, we implement those mechanisms directly since the Cyrus SASL
- * library doesn't support them (like OAuth).
+ * We used to use a buffering BIO for the reads/writes for TLS, but it
+ * ended up being complicated to special-case the buffering for everything
+ * except TLS, so the buffering is now unified, no matter which encryption
+ * method is being used (even none).
+ *
+ * For SASL authentication, we make use of (for now) the Cyrus-SASL
+ * library.  For some mechanisms, we implement those mechanisms directly
+ * since the Cyrus SASL library doesn't support them (like OAuth).

  */
 
 /*
  */
 
 /*


@@ -120,11 +141,18 @@ static int netsec_fillread(netsec_context *ns_context, char **errstr);
 netsec_context *
 netsec_init(void)
 {
 netsec_context *
 netsec_init(void)
 {

-    netsec_context *nsc = mh_xmalloc(sizeof(*nsc));
+    netsec_context *nsc;

 
 

-    nsc->ns_fd = -1;
+    NEW(nsc);
+    nsc->ns_readfd = -1;
+    nsc->ns_writefd = -1;
+    nsc->ns_noclose = 0;

     nsc->ns_snoop = 0;
     nsc->ns_snoop = 0;

+    nsc->ns_snoop_cb = NULL;
+    nsc->ns_snoop_context = NULL;
+    nsc->ns_snoop_savebuf = NULL;

     nsc->ns_userid = NULL;
     nsc->ns_userid = NULL;

+    nsc->ns_hostname = NULL;

     nsc->ns_timeout = 60;      /* Our default */
     nsc->ns_inbufsize = NETSEC_BUFSIZE;
     nsc->ns_inbuffer = mh_xmalloc(nsc->ns_inbufsize);
     nsc->ns_timeout = 60;      /* Our default */
     nsc->ns_inbufsize = NETSEC_BUFSIZE;
     nsc->ns_inbuffer = mh_xmalloc(nsc->ns_inbufsize);


@@ -134,14 +162,18 @@ netsec_init(void)
     nsc->ns_outbuffer = mh_xmalloc(nsc->ns_outbufsize);
     nsc->ns_outptr = nsc->ns_outbuffer;
     nsc->ns_outbuflen = 0;
     nsc->ns_outbuffer = mh_xmalloc(nsc->ns_outbufsize);
     nsc->ns_outptr = nsc->ns_outbuffer;
     nsc->ns_outbuflen = 0;

+    nsc->sasl_mech = NULL;
+    nsc->sasl_chosen_mech = NULL;
+    nsc->sasl_proto_cb = NULL;
+    nsc->sasl_proto_context = NULL;
+#ifdef OAUTH_SUPPORT
+    nsc->oauth_service = NULL;
+#endif /* OAUTH_SUPPORT */

 #ifdef CYRUS_SASL
     nsc->sasl_conn = NULL;
 #ifdef CYRUS_SASL
     nsc->sasl_conn = NULL;

-    nsc->sasl_hostname = NULL;
-    nsc->sasl_mech = NULL;

     nsc->sasl_cbs = NULL;
     nsc->sasl_creds = NULL;
     nsc->sasl_secret = NULL;
     nsc->sasl_cbs = NULL;
     nsc->sasl_creds = NULL;
     nsc->sasl_secret = NULL;

-    nsc->sasl_chosen_mech = NULL;

     nsc->sasl_ssf = 0;
     nsc->sasl_seclayer = 0;
     nsc->sasl_tmpbuf = NULL;
     nsc->sasl_ssf = 0;
     nsc->sasl_seclayer = 0;
     nsc->sasl_tmpbuf = NULL;


@@ -156,43 +188,34 @@ netsec_init(void)
 
 /*
  * Shutdown the connection completely and free all resources.
 
 /*
  * Shutdown the connection completely and free all resources.

- * The connection is not closed, however.

  */
 
 void
 netsec_shutdown(netsec_context *nsc)
 {
  */
 
 void
 netsec_shutdown(netsec_context *nsc)
 {

-    if (nsc->ns_userid)
-       free(nsc->ns_userid);
-    if (nsc->ns_inbuffer)
-       free(nsc->ns_inbuffer);
-    if (nsc->ns_outbuffer)
-       free(nsc->ns_outbuffer);
+    free(nsc->ns_userid);
+    free(nsc->ns_hostname);
+    free(nsc->ns_inbuffer);
+    free(nsc->ns_outbuffer);
+    free(nsc->sasl_mech);
+    free(nsc->sasl_chosen_mech);
+    free(nsc->ns_snoop_savebuf);
+#ifdef OAUTH_SERVICE
+    free(nsc->oauth_service);
+#endif /* OAUTH_SERVICE */

 #ifdef CYRUS_SASL
     if (nsc->sasl_conn)
        sasl_dispose(&nsc->sasl_conn);
 #ifdef CYRUS_SASL
     if (nsc->sasl_conn)
        sasl_dispose(&nsc->sasl_conn);

-    if (nsc->sasl_hostname)
-       free(nsc->sasl_hostname);
-    if (nsc->sasl_mech)
-       free(nsc->sasl_mech);
-    if (nsc->sasl_cbs)
-       free(nsc->sasl_cbs);
-    if (nsc->sasl_creds) {
-       if (nsc->sasl_creds->password)
-           memset(nsc->sasl_creds->password, 0,
-                  strlen(nsc->sasl_creds->password));
-       free(nsc->sasl_creds);
-    }
+    free(nsc->sasl_cbs);
+    if (nsc->sasl_creds)
+       nmh_credentials_free(nsc->sasl_creds);

     if (nsc->sasl_secret) {
        if (nsc->sasl_secret->len > 0) {
            memset(nsc->sasl_secret->data, 0, nsc->sasl_secret->len);
        }
        free(nsc->sasl_secret);
     }
     if (nsc->sasl_secret) {
        if (nsc->sasl_secret->len > 0) {
            memset(nsc->sasl_secret->data, 0, nsc->sasl_secret->len);
        }
        free(nsc->sasl_secret);
     }

-    if (nsc->sasl_chosen_mech)
-       free(nsc->sasl_chosen_mech);
-    if (nsc->sasl_tmpbuf)
-       free(nsc->sasl_tmpbuf);
+    free(nsc->sasl_tmpbuf);

 #endif /* CYRUS_SASL */
 #ifdef TLS_SUPPORT
     if (nsc->ssl_io)
 #endif /* CYRUS_SASL */
 #ifdef TLS_SUPPORT
     if (nsc->ssl_io)


@@ -203,6 +226,13 @@ netsec_shutdown(netsec_context *nsc)
        BIO_free_all(nsc->ssl_io);
 #endif /* TLS_SUPPORT */
 
        BIO_free_all(nsc->ssl_io);
 #endif /* TLS_SUPPORT */
 

+    if (! nsc->ns_noclose) {
+       if (nsc->ns_readfd != -1)
+           close(nsc->ns_readfd);
+       if (nsc->ns_writefd != -1 && nsc->ns_writefd != nsc->ns_readfd)
+           close(nsc->ns_writefd);
+    }
+

     free(nsc);
 }
 
     free(nsc);
 }
 


@@ -211,9 +241,10 @@ netsec_shutdown(netsec_context *nsc)
  */
 
 void
  */
 
 void

-netsec_set_fd(netsec_context *nsc, int fd)
+netsec_set_fd(netsec_context *nsc, int readfd, int writefd)

 {
 {

-    nsc->ns_fd = fd;
+    nsc->ns_readfd = readfd;
+    nsc->ns_writefd = writefd;

 }
 
 /*
 }
 
 /*


@@ -226,6 +257,16 @@ netsec_set_userid(netsec_context *nsc, const char *userid)
     nsc->ns_userid = getcpy(userid);
 }
 
     nsc->ns_userid = getcpy(userid);
 }
 

+/*
+ * Set the hostname of the remote host we're connecting to.
+ */
+
+void
+netsec_set_hostname(netsec_context *nsc, const char *hostname)
+{
+    nsc->ns_hostname = mh_xstrdup(hostname);
+}
+

 /*
  * Get the snoop flag for this connection
  */
 /*
  * Get the snoop flag for this connection
  */


@@ -246,6 +287,85 @@ netsec_set_snoop(netsec_context *nsc, int snoop)
     nsc->ns_snoop = snoop;
 }
 
     nsc->ns_snoop = snoop;
 }
 

+/*
+ * Set the snoop callback for this connection.
+ */
+
+void
+netsec_set_snoop_callback(netsec_context *nsc,
+                              netsec_snoop_callback callback, void *context)
+{
+    nsc->ns_snoop_cb = callback;
+    nsc->ns_snoop_context = context;
+}
+
+/*
+ * A base64-decoding snoop callback
+ */
+
+void
+netsec_b64_snoop_decoder(netsec_context *nsc, const char *string, size_t len,
+                        void *context)
+{
+    unsigned char *decoded;
+    size_t decodedlen;
+    int offset;
+    NMH_UNUSED(nsc);
+
+    offset = context ? *((int *) context) : 0;
+
+    if (offset > 0) {
+       /*
+        * Output non-base64 data first.
+        */
+       fprintf(stderr, "%.*s", offset, string);
+       string += offset;
+       len -= offset;
+    }
+
+    if (decodeBase64(string, &decoded, &decodedlen, 1, NULL) == OK) {
+       /*
+        * Some mechanisms produce large binary tokens, which aren't really
+        * readable.  So let's do a simple heuristic.  If the token is greater
+        * than 100 characters _and_ the first 100 bytes are more than 50%
+        * non-ASCII, then don't print the decoded buffer, just the
+        * base64 text.
+        */
+       if (decodedlen > 100 && !checkascii(decoded, 100)) {
+           fprintf(stderr, "%.*s\n", (int) len, string);
+       } else {
+           char *hexified;
+           hexify(decoded, decodedlen, &hexified);
+           fprintf(stderr, "b64<%s>\n", hexified);
+           free(hexified);
+       }
+       free(decoded);
+    } else {
+       fprintf(stderr, "%.*s\n", (int) len, string);
+    }
+}
+
+/*
+ * If the ASCII content is > 50%, return 1
+ */
+
+static int
+checkascii(const unsigned char *bytes, size_t len)
+{
+    size_t count = 0, half = len / 2;
+
+    while (len-- > 0) {
+       if (isascii(*bytes) && isprint(*bytes) && ++count > half)
+           return 1;
+       bytes++;
+       /* No chance by this point */
+       if (count + len < half)
+           return 0;
+    }
+
+    return 0;
+}
+

 /*
  * Set the read timeout for this connection
  */
 /*
  * Set the read timeout for this connection
  */


@@ -280,7 +400,7 @@ netsec_read(netsec_context *nsc, void *buffer, size_t size, char **errstr)
      * assume here that this has something in it.
      */
 
      * assume here that this has something in it.
      */
 

-    retlen = size > nsc->ns_inbuflen ? nsc->ns_inbuflen : size;
+    retlen = min(size, nsc->ns_inbuflen);

 
     memcpy(buffer, nsc->ns_inptr, retlen);
 
 
     memcpy(buffer, nsc->ns_inptr, retlen);
 


@@ -305,15 +425,16 @@ netsec_read(netsec_context *nsc, void *buffer, size_t size, char **errstr)
  *
  * - Unlike every other function, we return a pointer to the
  *   existing buffer.  This pointer is valid until you call another
  *
  * - Unlike every other function, we return a pointer to the
  *   existing buffer.  This pointer is valid until you call another

- *   read functiona again.
- * - We NUL-terminated the buffer right at the end, before the terminator.
+ *   read function again.
+ * - We NUL-terminate the buffer right at the end, before the CR-LF terminator.

  * - Technically we look for a LF; if we find a CR right before it, then
  *   we back up one.
  * - Technically we look for a LF; if we find a CR right before it, then
  *   we back up one.

- * - If your data may contain embedded NULs, this won't work.
+ * - If your data may contain embedded NULs, this won't work.  You should
+ *   be using netsec_read() in that case.

  */
 
 char *
  */
 
 char *

-netsec_readline(netsec_context *nsc, char **errstr)
+netsec_readline(netsec_context *nsc, size_t *len, char **errstr)

 {
     unsigned char *ptr = nsc->ns_inptr;
     size_t count = 0, offset;
 {
     unsigned char *ptr = nsc->ns_inptr;
     size_t count = 0, offset;


@@ -326,12 +447,32 @@ retry:
     while (count < nsc->ns_inbuflen) {
        count++;
        if (*ptr++ == '\n') {
     while (count < nsc->ns_inbuflen) {
        count++;
        if (*ptr++ == '\n') {

-           char *sptr = nsc->ns_inptr;
+           char *sptr = (char *) nsc->ns_inptr;

            if (count > 1 && *(ptr - 2) == '\r')
                ptr--;
            *--ptr = '\0';
            if (count > 1 && *(ptr - 2) == '\r')
                ptr--;
            *--ptr = '\0';

+           if (len)
+               *len = ptr - nsc->ns_inptr;

            nsc->ns_inptr += count;
            nsc->ns_inbuflen -= count;
            nsc->ns_inptr += count;
            nsc->ns_inbuflen -= count;

+           if (nsc->ns_snoop) {
+#ifdef CYRUS_SASL
+               if (nsc->sasl_seclayer)
+                   fprintf(stderr, "(sasl-decrypted) ");
+#endif /* CYRUS_SASL */
+#ifdef TLS_SUPPORT
+               if (nsc->tls_active)
+                   fprintf(stderr, "(tls-decrypted) ");
+#endif /* TLS_SUPPORT */
+               fprintf(stderr, "<= ");
+               if (nsc->ns_snoop_cb)
+                   nsc->ns_snoop_cb(nsc, sptr, strlen(sptr),
+                                    nsc->ns_snoop_context);
+               else {
+                    fputs(sptr, stderr);
+                    putc('\n', stderr);
+                }
+           }

            return sptr;
        }
     }
            return sptr;
        }
     }


@@ -342,7 +483,7 @@ retry:
      */
 
     if (count >= nsc->ns_inbufsize / 2) {
      */
 
     if (count >= nsc->ns_inbufsize / 2) {

-       netsec_err(errstr, "Unable to find a line terminator after %d bytes",
+       netsec_err(errstr, "Unable to find a line terminator after %zu bytes",

                   count);
        return NULL;
     }
                   count);
        return NULL;
     }


@@ -355,7 +496,7 @@ retry:
     offset = ptr - nsc->ns_inptr;
 
     if (netsec_fillread(nsc, errstr) != OK)
     offset = ptr - nsc->ns_inptr;
 
     if (netsec_fillread(nsc, errstr) != OK)

-       return NOTOK;
+       return NULL;

 
     ptr = nsc->ns_inptr + offset;
 
 
     ptr = nsc->ns_inptr + offset;
 


@@ -385,7 +526,9 @@ netsec_fillread(netsec_context *nsc, char **errstr)
        nsc->ns_inptr = nsc->ns_inbuffer;
     }
 
        nsc->ns_inptr = nsc->ns_inbuffer;
     }
 

+#if defined(CYRUS_SASL) || defined(TLS_SUPPORT)

 retry:
 retry:

+#endif /* CYRUS_SASL || TLS_SUPPORT */

     /*
      * If we are using TLS and there's anything pending, then skip the
      * select call
     /*
      * If we are using TLS and there's anything pending, then skip the
      * select call


@@ -398,12 +541,12 @@ retry:
        fd_set rfds;
 
        FD_ZERO(&rfds);
        fd_set rfds;
 
        FD_ZERO(&rfds);

-       FD_SET(nsc->ns_fd, &rfds);
+       FD_SET(nsc->ns_readfd, &rfds);

 
        tv.tv_sec = nsc->ns_timeout;
        tv.tv_usec = 0;
 
 
        tv.tv_sec = nsc->ns_timeout;
        tv.tv_usec = 0;
 

-       rc = select(nsc->ns_fd + 1, &rfds, NULL, NULL, &tv);
+       rc = select(nsc->ns_readfd + 1, &rfds, NULL, NULL, &tv);

 
        if (rc == -1) {
            netsec_err(errstr, "select() while reading failed: %s",
 
        if (rc == -1) {
            netsec_err(errstr, "select() while reading failed: %s",


@@ -423,10 +566,38 @@ retry:
         */
     }
 
         */
     }
 

+    /*
+     * Some explanation:
+     *
+     * startoffset is the offset from the beginning of the input
+     * buffer to data that is in our input buffer, but has not yet
+     * been consumed.  This can be non-zero if functions like
+     * netsec_readline() leave leftover data.
+     *
+     * remaining is the remaining amount of unconsumed data in the input
+     * buffer.
+     *
+     * end is a pointer to the end of the valid data + 1; it's where
+     * the next read should go.
+     */
+

     startoffset = nsc->ns_inptr - nsc->ns_inbuffer;
     remaining = nsc->ns_inbufsize - (startoffset + nsc->ns_inbuflen);
     end = nsc->ns_inptr + nsc->ns_inbuflen;
 
     startoffset = nsc->ns_inptr - nsc->ns_inbuffer;
     remaining = nsc->ns_inbufsize - (startoffset + nsc->ns_inbuflen);
     end = nsc->ns_inptr + nsc->ns_inbuflen;
 

+    /*
+     * If we're past the halfway point in our read buffers, shuffle everything
+     * back to the beginning.
+     */
+
+    if (startoffset > nsc->ns_inbufsize / 2) {
+       memmove(nsc->ns_inbuffer, nsc->ns_inptr, nsc->ns_inbuflen);
+       nsc->ns_inptr = nsc->ns_inbuffer;
+       startoffset = 0;
+       remaining = nsc->ns_inbufsize - nsc->ns_inbuflen;
+       end = nsc->ns_inptr + nsc->ns_inbuflen;
+    }
+

     /*
      * If we are using TLS, then just read via the BIO.  But we still
      * use our local buffer.
     /*
      * If we are using TLS, then just read via the BIO.  But we still
      * use our local buffer.


@@ -435,13 +606,39 @@ retry:
     if (nsc->tls_active) {
        rc = BIO_read(nsc->ssl_io, end, remaining);
        if (rc == 0) {
     if (nsc->tls_active) {
        rc = BIO_read(nsc->ssl_io, end, remaining);
        if (rc == 0) {

+           SSL *ssl;
+           int errcode;
+
+           /*
+            * Check to see if we're supposed to retry; if so,
+            * then go back and read again.
+            */
+
+           if (BIO_should_retry(nsc->ssl_io))
+               goto retry;
+

            /*
            /*

-            * Either EOF, or possibly an error.  Either way, it was probably
-            * unexpected, so treat as error.
+            * Okay, fine.  Get the real error out of the SSL context.

             */
             */

-           netsec_err(errstr, "TLS peer aborted connection");
+
+           if (BIO_get_ssl(nsc->ssl_io, &ssl) < 1) {
+               netsec_err(errstr, "SSL_read() returned 0, but cannot "
+                          "retrieve SSL context");
+               return NOTOK;
+           }
+
+           errcode = SSL_get_error(ssl, rc);
+           if (errcode == SSL_ERROR_ZERO_RETURN) {
+               netsec_err(errstr, "TLS peer closed remote connection");
+           } else {
+               netsec_err(errstr, "TLS network read failed: %s",
+                          ERR_error_string(ERR_peek_last_error(), NULL));
+           }
+           if (nsc->ns_snoop)
+               ERR_print_errors_fp(stderr);

            return NOTOK;
            return NOTOK;

-       } else if (rc < 0) {
+       }
+        if (rc < 0) {

            /* Definitely an error */
            netsec_err(errstr, "Read on TLS connection failed: %s",
                       ERR_error_string(ERR_get_error(), NULL));
            /* Definitely an error */
            netsec_err(errstr, "Read on TLS connection failed: %s",
                       ERR_error_string(ERR_get_error(), NULL));


@@ -475,7 +672,7 @@ retry:
      * select() above) so this read SHOULDN'T block.  Hopefully.
      */
 
      * select() above) so this read SHOULDN'T block.  Hopefully.
      */
 

-    rc = read(nsc->ns_fd, readbuf, readbufsize);
+    rc = read(nsc->ns_readfd, readbuf, readbufsize);

 
     if (rc == 0) {
        netsec_err(errstr, "Received EOF on network read");
 
     if (rc == 0) {
        netsec_err(errstr, "Received EOF on network read");


@@ -527,16 +724,6 @@ retry:
 #endif /* CYRUS_SASL */
        nsc->ns_inbuflen += rc;
 
 #endif /* CYRUS_SASL */
        nsc->ns_inbuflen += rc;
 

-    /*
-     * If we're past the halfway point in our read buffers, shuffle everything
-     * back to the beginning.
-     */
-
-    if (startoffset > nsc->ns_inbufsize / 2) {
-       memmove(nsc->ns_inbuffer, nsc->ns_inptr, nsc->ns_inbuflen);
-       nsc->ns_inptr = nsc->ns_inbuffer;
-    }
-

     return OK;
 }
 
     return OK;
 }
 


@@ -553,24 +740,10 @@ netsec_write(netsec_context *nsc, const void *buffer, size_t size,
     const unsigned char *bufptr = buffer;
     int rc, remaining;
 
     const unsigned char *bufptr = buffer;
     int rc, remaining;
 

-    /*
-     * If TLS is active, then bypass all of our buffering logic; just
-     * write it directly to our BIO.  We have a buffering BIO first in
-     * our stack, so buffering will take place there.
-     */
-#ifdef TLS_SUPPORT
-    if (nsc->tls_active) {
-       rc = BIO_write(nsc->ssl_io, buffer, size);
-
-       if (rc <= 0) {
-           netsec_err(errstr, "Error writing to TLS connection: %s",
-                      ERR_error_string(ERR_get_error(), NULL));
-           return NOTOK;
-       }
+    /* Just in case */

 
 

+    if (size == 0)

        return OK;
        return OK;

-    }
-#endif /* TLS_SUPPORT */

 
     /*
      * Run a loop copying in data to our local buffer; when we're done with
 
     /*
      * Run a loop copying in data to our local buffer; when we're done with


@@ -609,10 +782,7 @@ netsec_write(netsec_context *nsc, const void *buffer, size_t size,
 }
 
 /*
 }
 
 /*

- * Write bytes to the network using printf()-style formatting.
- *
- * Again, for the most part copy stuff into our buffer to be flushed
- * out later.
+ * Our network printf() routine, which really just calls netsec_vprintf().

  */
 
 int
  */
 
 int


@@ -621,24 +791,26 @@ netsec_printf(netsec_context *nsc, char **errstr, const char *format, ...)
     va_list ap;
     int rc;
 
     va_list ap;
     int rc;
 

-    /*
-     * Again, if we're using TLS, then bypass our local buffering
-     */
-#ifdef TLS_SUPPORT
-    if (nsc->tls_active) {
-       va_start(ap, format);
-       rc = BIO_vprintf(nsc->ssl_io, format, ap);
-       va_end(ap);
+    va_start(ap, format);
+    rc = netsec_vprintf(nsc, errstr, format, ap);
+    va_end(ap);

 
 

-       if (rc <= 0) {
-           netsec_err(errstr, "Error writing to TLS connection: %s",
-                      ERR_error_string(ERR_get_error(), NULL));
-           return NOTOK;
-       }
+    return rc;
+}

 
 

-       return OK;
-    }
-#endif /* TLS_SUPPORT */
+/*
+ * Write bytes to the network using printf()-style formatting.
+ *
+ * Again, for the most part copy stuff into our buffer to be flushed
+ * out later.
+ */
+
+int
+netsec_vprintf(netsec_context *nsc, char **errstr, const char *format,
+              va_list ap)
+{
+    int rc;
+    va_list apcopy;

 
     /*
      * Cheat a little.  If we can fit the data into our outgoing buffer,
 
     /*
      * Cheat a little.  If we can fit the data into our outgoing buffer,


@@ -646,10 +818,10 @@ netsec_printf(netsec_context *nsc, char **errstr, const char *format, ...)
      */
 
 retry:
      */
 
 retry:

-    va_start(ap, format);
+    va_copy(apcopy, ap);

     rc = vsnprintf((char *) nsc->ns_outptr,
     rc = vsnprintf((char *) nsc->ns_outptr,

-                  nsc->ns_outbufsize - nsc->ns_outbuflen, format, ap);
-    va_end(ap);
+                  nsc->ns_outbufsize - nsc->ns_outbuflen, format, apcopy);
+    va_end(apcopy);

 
     if (rc >= (int) (nsc->ns_outbufsize - nsc->ns_outbuflen)) {
        /*
 
     if (rc >= (int) (nsc->ns_outbufsize - nsc->ns_outbuflen)) {
        /*


@@ -668,19 +840,18 @@ retry:
                       "%d bytes, but our buffer size was only %d bytes",
                       rc, nsc->ns_outbufsize);
            return NOTOK;
                       "%d bytes, but our buffer size was only %d bytes",
                       rc, nsc->ns_outbufsize);
            return NOTOK;

-       } else {
-           /*
-            * Generate a flush (which may be inefficient, but hopefully
-            * it isn't) and then try again.
-            */
-           if (netsec_flush(nsc, errstr) != OK)
-               return NOTOK;
-           /*
-            * After this, outbuffer should == outptr, so we shouldn't
-            * hit this next time around.
-            */
-           goto retry;

        }
        }

+        /*
+         * Generate a flush (which may be inefficient, but hopefully
+         * it isn't) and then try again.
+         */
+        if (netsec_flush(nsc, errstr) != OK)
+            return NOTOK;
+        /*
+         * After this, outbuffer should == outptr, so we shouldn't
+         * hit this next time around.
+         */
+        goto retry;

     }
 
     nsc->ns_outptr += rc;
     }
 
     nsc->ns_outptr += rc;


@@ -702,26 +873,104 @@ netsec_flush(netsec_context *nsc, char **errstr)
     int rc;
 
     /*
     int rc;
 
     /*

-     * For TLS connections, just call BIO_flush(); we'll let TLS handle
-     * all of our output buffering.
+     * Small optimization

      */
      */

+
+    if (netoutlen == 0)
+       return OK;
+
+    /*
+     * If we have snoop turned on, output the data.
+     *
+     * Note here; if we don't have a CR or LF at the end, save the data
+     * in ns_snoop_savebuf for later and print it next time.
+     */
+
+    if (nsc->ns_snoop) {
+       unsigned int snoopoutlen = netoutlen;
+       const char *snoopoutbuf = (const char *) nsc->ns_outbuffer;
+
+       while (snoopoutlen > 0) {
+           const char *end = strpbrk(snoopoutbuf, "\r\n");
+           unsigned int outlen;
+
+           if (! end) {
+               if (nsc->ns_snoop_savebuf) {
+                   nsc->ns_snoop_savebuf = mh_xrealloc(nsc->ns_snoop_savebuf,
+                                               strlen(nsc->ns_snoop_savebuf) +
+                                               snoopoutlen + 1);
+                   strncat(nsc->ns_snoop_savebuf, snoopoutbuf, snoopoutlen);
+               } else {
+                   nsc->ns_snoop_savebuf = mh_xmalloc(snoopoutlen + 1);
+                   strncpy(nsc->ns_snoop_savebuf, snoopoutbuf, snoopoutlen);
+                   nsc->ns_snoop_savebuf[snoopoutlen] = '\0';
+               }
+               break;
+           }
+
+           outlen = end - snoopoutbuf;
+
+#ifdef CYRUS_SASL
+           if (nsc->sasl_seclayer)
+               fprintf(stderr, "(sasl-encrypted) ");
+#endif /* CYRUS_SASL */

 #ifdef TLS_SUPPORT
 #ifdef TLS_SUPPORT

-    if (nsc->tls_active) {
-       rc = BIO_flush(nsc->ssl_io);
+           if (nsc->tls_active)
+               fprintf(stderr, "(tls-encrypted) ");
+#endif /* TLS_SUPPORT */
+           fprintf(stderr, "=> ");
+           if (nsc->ns_snoop_cb) {
+               const char *ptr;
+               unsigned int cb_len = outlen;
+
+               if (nsc->ns_snoop_savebuf) {
+                   cb_len += strlen(nsc->ns_snoop_savebuf);
+                   nsc->ns_snoop_savebuf = mh_xrealloc(nsc->ns_snoop_savebuf,
+                                               outlen);
+                   ptr = nsc->ns_snoop_savebuf;
+               } else {
+                   ptr = snoopoutbuf;
+               }
+
+               nsc->ns_snoop_cb(nsc, ptr, cb_len, nsc->ns_snoop_context);
+
+               if (nsc->ns_snoop_savebuf) {
+                   free(nsc->ns_snoop_savebuf);
+                   nsc->ns_snoop_savebuf = NULL;
+               }
+           } else {
+               if (nsc->ns_snoop_savebuf) {
+                   fprintf(stderr, "%s", nsc->ns_snoop_savebuf);
+                   free(nsc->ns_snoop_savebuf);
+                   nsc->ns_snoop_savebuf = NULL;
+               }
+               fprintf(stderr, "%.*s\n", outlen, snoopoutbuf);
+           }

 
 

-       if (rc <= 0) {
-           netsec_err(errstr, "Error flushing TLS connection: %s",
-                      ERR_error_string(ERR_get_error(), NULL));
-           return NOTOK;
-       }
+           /*
+            * Alright, hopefully any previous leftover data is done,
+            * and we have the current line output.  Move things past the
+            * next CR/LF.
+            */

 
 

-       return OK;
+           snoopoutlen -= outlen;
+           snoopoutbuf += outlen;
+
+           if (snoopoutlen > 0 && *snoopoutbuf == '\r') {
+               snoopoutlen--;
+               snoopoutbuf++;
+           }
+
+           if (snoopoutlen > 0 && *snoopoutbuf == '\n') {
+               snoopoutlen--;
+               snoopoutbuf++;
+           }
+       }

     }
     }

-#endif /* TLS_SUPPORT */

 
     /*
      * If SASL security layers are in effect, run the data through
 
     /*
      * If SASL security layers are in effect, run the data through

-     * sasl_encode() first and then write it.
+     * sasl_encode() first.

      */
 #ifdef CYRUS_SASL
     if (nsc->sasl_seclayer) {
      */
 #ifdef CYRUS_SASL
     if (nsc->sasl_seclayer) {


@@ -736,11 +985,27 @@ netsec_flush(netsec_context *nsc, char **errstr)
 
     }
 #endif /* CYRUS_SASL */
 
     }
 #endif /* CYRUS_SASL */

-    rc = write(nsc->ns_fd, netoutbuf, netoutlen);

 
 

-    if (rc < 0) {
-       netsec_err(errstr, "write() failed: %s", strerror(errno));
-       return NOTOK;
+    /*
+     * If TLS is active, then use those functions to write out the
+     * data.
+     */
+#ifdef TLS_SUPPORT
+    if (nsc->tls_active) {
+       if (BIO_write(nsc->ssl_io, netoutbuf, netoutlen) <= 0) {
+           netsec_err(errstr, "Error writing to TLS connection: %s",
+                      ERR_error_string(ERR_get_error(), NULL));
+           return NOTOK;
+       }
+    } else
+#endif /* TLS_SUPPORT */
+    {
+       rc = write(nsc->ns_writefd, netoutbuf, netoutlen);
+
+       if (rc < 0) {
+           netsec_err(errstr, "write() failed: %s", strerror(errno));
+           return NOTOK;
+       }

     }
 
     nsc->ns_outptr = nsc->ns_outbuffer;
     }
 
     nsc->ns_outptr = nsc->ns_outbuffer;


@@ -754,14 +1019,19 @@ netsec_flush(netsec_context *nsc, char **errstr)
  */
 
 int
  */
 
 int

-netsec_set_sasl_params(netsec_context *nsc, const char *hostname,
-                      const char *service, const char *mechanism,
-                      netsec_sasl_callback callback, char **errstr)
+netsec_set_sasl_params(netsec_context *nsc, const char *service,
+                      const char *mechanism, netsec_sasl_callback callback,
+                      void *context, char **errstr)

 {
 #ifdef CYRUS_SASL
     sasl_callback_t *sasl_cbs;
     int retval;
 
 {
 #ifdef CYRUS_SASL
     sasl_callback_t *sasl_cbs;
     int retval;
 

+    if (!nsc->ns_hostname) {
+       netsec_err(errstr, "Internal error: ns_hostname is NULL");
+       return NOTOK;
+    }
+

     if (! sasl_initialized) {
        retval = sasl_client_init(NULL);
        if (retval != SASL_OK) {
     if (! sasl_initialized) {
        retval = sasl_client_init(NULL);
        if (retval != SASL_OK) {


@@ -769,7 +1039,7 @@ netsec_set_sasl_params(netsec_context *nsc, const char *hostname,
                       sasl_errstring(retval, NULL, NULL));
            return NOTOK;
        }
                       sasl_errstring(retval, NULL, NULL));
            return NOTOK;
        }

-       sasl_initialized++;
+       sasl_initialized = true;

     }
 
     /*
     }
 
     /*


@@ -797,8 +1067,8 @@ netsec_set_sasl_params(netsec_context *nsc, const char *hostname,
 
     nsc->sasl_cbs = sasl_cbs;
 
 
     nsc->sasl_cbs = sasl_cbs;
 

-    retval = sasl_client_new(service, hostname, NULL, NULL, nsc->sasl_cbs, 0,
-                            &nsc->sasl_conn);
+    retval = sasl_client_new(service, nsc->ns_hostname, NULL, NULL,
+                            nsc->sasl_cbs, 0, &nsc->sasl_conn);

 
     if (retval) {
        netsec_err(errstr, "SASL new client allocation failed: %s",
 
     if (retval) {
        netsec_err(errstr, "SASL new client allocation failed: %s",


@@ -806,16 +1076,32 @@ netsec_set_sasl_params(netsec_context *nsc, const char *hostname,
        return NOTOK;
     }
 
        return NOTOK;
     }
 

-    nsc->sasl_mech = mechanism ? getcpy(mechanism) : NULL;
-    nsc->sasl_proto_cb = callback;
-    nsc->sasl_hostname = getcpy(hostname);
+    /*
+     * Set up our credentials
+     */

 
 

-    return OK;
-#else /* CYRUS_SASL */
-    netsec_err(errstr, "SASL is not supported");
+    nsc->sasl_creds = nmh_get_credentials(nsc->ns_hostname, nsc->ns_userid);

 
 

-    return NOTOK;
+#else /* CYRUS_SASL */
+    NMH_UNUSED(service);
+    NMH_UNUSED(errstr);

 #endif /* CYRUS_SASL */
 #endif /* CYRUS_SASL */

+
+    /*
+     * According to the RFC, mechanisms can only be uppercase letter, numbers,
+     * and a hyphen or underscore.  So make sure we uppercase any letters
+     * in case the user passed in lowercase.
+     */
+
+    if (mechanism) {
+       nsc->sasl_mech = mh_xstrdup(mechanism);
+       to_upper(nsc->sasl_mech);
+    }
+
+    nsc->sasl_proto_cb = callback;
+    nsc->sasl_proto_context = context;
+
+    return OK;

 }
 
 #ifdef CYRUS_SASL
 }
 
 #ifdef CYRUS_SASL


@@ -824,7 +1110,8 @@ netsec_set_sasl_params(netsec_context *nsc, const char *hostname,
  * library when asked.
  */
 
  * library when asked.
  */
 

-int netsec_get_user(void *context, int id, const char **result,
+int
+netsec_get_user(void *context, int id, const char **result,

                    unsigned int *len)
 {
     netsec_context *nsc = (netsec_context *) context;
                    unsigned int *len)
 {
     netsec_context *nsc = (netsec_context *) context;


@@ -832,35 +1119,10 @@ int netsec_get_user(void *context, int id, const char **result,
     if (! result || (id != SASL_CB_USER && id != SASL_CB_AUTHNAME))
        return SASL_BADPARAM;
 
     if (! result || (id != SASL_CB_USER && id != SASL_CB_AUTHNAME))
        return SASL_BADPARAM;
 

-    if (nsc->ns_userid == NULL) {
-       /*
-        * Pass the 1 third argument to nmh_get_credentials() so that
-        * a defauly user if the -user switch wasn't supplied, and so
-        * that a default password will be supplied.  That's used when
-        * those values really don't matter, and only with legacy/.netrc,
-        * i.e., with a credentials profile entry.
-        */
-
-       if (nsc->sasl_creds == NULL) {
-           nsc->sasl_creds = mh_xmalloc(sizeof(*nsc->sasl_creds));
-           nsc->sasl_creds->user = NULL;
-           nsc->sasl_creds->password = NULL;
-       }
+    *result = nmh_cred_get_user(nsc->sasl_creds);

 
 

-       if (nmh_get_credentials(nsc->sasl_hostname, nsc->ns_userid, 1,
-                               nsc->sasl_creds) != OK)
-           return SASL_BADPARAM;
-
-       if (nsc->ns_userid != nsc->sasl_creds->user) {
-           if (nsc->ns_userid)
-               free(nsc->ns_userid);
-           nsc->ns_userid = getcpy(nsc->sasl_creds->user);
-       }
-    }
-
-    *result = nsc->ns_userid;

     if (len)
     if (len)

-       *len = strlen(nsc->ns_userid);
+       *len = strlen(*result);

 
     return SASL_OK;
 }
 
     return SASL_OK;
 }


@@ -874,6 +1136,7 @@ netsec_get_password(sasl_conn_t *conn, void *context, int id,
                    sasl_secret_t **psecret)
 {
     netsec_context *nsc = (netsec_context *) context;
                    sasl_secret_t **psecret)
 {
     netsec_context *nsc = (netsec_context *) context;

+    const char *password;

     int len;
 
     NMH_UNUSED(conn);
     int len;
 
     NMH_UNUSED(conn);


@@ -881,40 +1144,22 @@ netsec_get_password(sasl_conn_t *conn, void *context, int id,
     if (! psecret || id != SASL_CB_PASS)
        return SASL_BADPARAM;
 
     if (! psecret || id != SASL_CB_PASS)
        return SASL_BADPARAM;
 

-    if (nsc->sasl_creds == NULL) {
-       nsc->sasl_creds = mh_xmalloc(sizeof(*nsc->sasl_creds));
-       nsc->sasl_creds->user = NULL;
-       nsc->sasl_creds->password = NULL;
-    }
-
-    if (nsc->sasl_creds->password == NULL) {
-       /*
-        * Pass the 0 third argument to nmh_get_credentials() so
-        * that the default password isn't used.  With legacy/.netrc
-        * credentials support, we'll only get here if the -user
-        * switch to send(1)/post(8) wasn't used.
-        */
-
-       if (nmh_get_credentials(nsc->sasl_hostname, nsc->ns_userid, 0,
-                               nsc->sasl_creds) != OK) {
-           return SASL_BADPARAM;
-       }
-    }
+    password = nmh_cred_get_password(nsc->sasl_creds);

 
 

-    len = strlen(nsc->sasl_creds->password);
+    len = strlen(password);

 
     /*
      * sasl_secret_t includes 1 bytes for "data" already, so that leaves
      * us room for a terminating NUL
      */
 
 
     /*
      * sasl_secret_t includes 1 bytes for "data" already, so that leaves
      * us room for a terminating NUL
      */
 

-    *psecret = (sasl_secret_t *) malloc(sizeof(sasl_secret_t) + len);
+    *psecret = malloc(sizeof(sasl_secret_t) + len);

 
     if (! *psecret)
        return SASL_NOMEM;
 
     (*psecret)->len = len;
 
     if (! *psecret)
        return SASL_NOMEM;
 
     (*psecret)->len = len;

-    strcpy((char *) (*psecret)->data, nsc->sasl_creds->password);
+    strcpy((char *) (*psecret)->data, password);

 
     nsc->sasl_secret = *psecret;
 
 
     nsc->sasl_secret = *psecret;
 


@@ -936,8 +1181,109 @@ netsec_negotiate_sasl(netsec_context *nsc, const char *mechlist, char **errstr)
     unsigned char *outbuf;
     unsigned int saslbuflen, outbuflen;
     sasl_ssf_t *ssf;
     unsigned char *outbuf;
     unsigned int saslbuflen, outbuflen;
     sasl_ssf_t *ssf;

-    int rc, *outbufmax;
+    int *outbufmax;
+#endif
+#ifdef OAUTH_SUPPORT
+    unsigned char *xoauth_client_res;
+    size_t xoauth_client_res_len;
+#endif /* OAUTH_SUPPORT */
+#if defined CYRUS_SASL || defined OAUTH_SUPPORT
+    int rc;
+#endif /* CYRUS_SASL || OAUTH_SUPPORT */
+
+    /*
+     * If we've been passed a requested mechanism, check our mechanism
+     * list from the protocol.  If it's not supported, return an error.
+     */
+
+    if (nsc->sasl_mech) {
+       char **str, *mlist = getcpy(mechlist);
+       int i;
+
+       str = brkstring(mlist, " ", NULL);
+
+       for (i = 0; str[i] != NULL; i++) {
+           if (strcasecmp(nsc->sasl_mech, str[i]) == 0) {
+               break;
+           }
+       }
+
+       i = (str[i] == NULL);
+
+       free(mlist);
+
+       if (i) {
+           netsec_err(errstr, "Chosen mechanism %s not supported by server",
+                      nsc->sasl_mech);
+           return NOTOK;
+       }
+    }
+
+#ifdef OAUTH_SUPPORT
+    if (nsc->sasl_mech && strcasecmp(nsc->sasl_mech, "XOAUTH2") == 0) {
+       /*
+        * This should be relatively straightforward, but requires some
+        * help from the plugin.  Basically, if XOAUTH2 is a success,
+        * the callback has to return success, but no output data.  If
+        * there is output data, it will be assumed that it is the JSON
+        * error message.
+        */
+
+       if (! nsc->oauth_service) {
+           netsec_err(errstr, "Internal error: OAuth2 service name not given");
+           return NOTOK;
+       }
+
+       nsc->sasl_chosen_mech = mh_xstrdup(nsc->sasl_mech);
+
+       if (mh_oauth_do_xoauth(nsc->ns_userid, nsc->oauth_service,
+                              &xoauth_client_res, &xoauth_client_res_len,
+                              nsc->ns_snoop ? stderr : NULL) != OK) {
+           netsec_err(errstr, "Internal error: Unable to get OAuth2 "
+                      "bearer token");
+           return NOTOK;
+       }
+
+       rc = nsc->sasl_proto_cb(NETSEC_SASL_START, xoauth_client_res,
+                               xoauth_client_res_len, NULL, 0,
+                               nsc->sasl_proto_context, errstr);
+       free(xoauth_client_res);
+
+       if (rc != OK)
+           return NOTOK;

 
 

+       /*
+        * Okay, we need to do a NETSEC_SASL_FINISH now.  If we return
+        * success, we indicate that with no output data.  But if we
+        * fail, then send a blank message and get the resulting
+        * error.
+        */
+
+       rc = nsc->sasl_proto_cb(NETSEC_SASL_FINISH, NULL, 0, NULL, 0,
+                               nsc->sasl_proto_context, errstr);
+
+       if (rc != OK) {
+           /*
+            * We're going to assume the error here is a JSON response;
+            * we ignore it and send a blank message in response.  We should
+            * then get a failure messages with a useful error.  We should
+            * NOT get a success message at this point.
+            */
+           free(*errstr);
+           nsc->sasl_proto_cb(NETSEC_SASL_WRITE, NULL, 0, NULL, 0,
+                              nsc->sasl_proto_context, NULL);
+           rc = nsc->sasl_proto_cb(NETSEC_SASL_FINISH, NULL, 0, NULL, 0,
+                                   nsc->sasl_proto_context, errstr);
+           if (rc == 0) {
+               netsec_err(errstr, "Unexpected success after OAuth failure!");
+           }
+           return NOTOK;
+       }
+       return OK;
+    }
+#endif /* OAUTH_SUPPORT */
+
+#ifdef CYRUS_SASL

     /*
      * In netsec_set_sasl_params, we've already done all of our setup with
      * sasl_client_init() and sasl_client_new().  So time to set security
     /*
      * In netsec_set_sasl_params, we've already done all of our setup with
      * sasl_client_init() and sasl_client_new().  So time to set security


@@ -945,7 +1291,7 @@ netsec_negotiate_sasl(netsec_context *nsc, const char *mechlist, char **errstr)
      * messages.
      */
 
      * messages.
      */
 

-    memset(&secprops, 0, sizeof(secprops));
+    ZERO(&secprops);

     secprops.maxbufsize = SASL_MAXRECVBUF;
 
     /*
     secprops.maxbufsize = SASL_MAXRECVBUF;
 
     /*


@@ -971,7 +1317,8 @@ netsec_negotiate_sasl(netsec_context *nsc, const char *mechlist, char **errstr)
      * sasl_client_step() loop (after sasl_client_start, of course).
      */
 
      * sasl_client_step() loop (after sasl_client_start, of course).
      */
 

-    rc = sasl_client_start(nsc->sasl_conn, mechlist, NULL,
+    rc = sasl_client_start(nsc->sasl_conn,
+                          nsc->sasl_mech ? nsc->sasl_mech : mechlist, NULL,

                           (const char **) &saslbuf, &saslbuflen,
                           &chosen_mech);
 
                           (const char **) &saslbuf, &saslbuflen,
                           &chosen_mech);
 


@@ -983,18 +1330,8 @@ netsec_negotiate_sasl(netsec_context *nsc, const char *mechlist, char **errstr)
 
     nsc->sasl_chosen_mech = getcpy(chosen_mech);
 
 
     nsc->sasl_chosen_mech = getcpy(chosen_mech);
 

-    if (nsc->sasl_proto_cb(NETSEC_SASL_START, saslbuf, saslbuflen, &outbuf,
-                          &outbuflen, errstr) != OK)
-       return NOTOK;
-
-    if (netsec_write(nsc, outbuf, outbuflen, errstr) != OK) {
-       free(outbuf);
-       return NOTOK;
-    }
-
-    free(outbuf);
-
-    if (netsec_flush(nsc, errstr) != OK)
+    if (nsc->sasl_proto_cb(NETSEC_SASL_START, saslbuf, saslbuflen, NULL, 0,
+                          nsc->sasl_proto_context, errstr) != OK)

        return NOTOK;
 
     /*
        return NOTOK;
 
     /*


@@ -1008,53 +1345,32 @@ netsec_negotiate_sasl(netsec_context *nsc, const char *mechlist, char **errstr)
         */
 
        if (nsc->sasl_proto_cb(NETSEC_SASL_READ, NULL, 0, &outbuf, &outbuflen,
         */
 
        if (nsc->sasl_proto_cb(NETSEC_SASL_READ, NULL, 0, &outbuf, &outbuflen,

-                              errstr) != OK) {
-           if (nsc->sasl_proto_cb(NETSEC_SASL_CANCEL, NULL, 0, &outbuf,
-                                  &outbuflen, NULL) == OK) {
-               netsec_write(nsc, outbuf, outbuflen, NULL);
-               netsec_flush(nsc, NULL);
-               free(outbuf);
-           }
+                              nsc->sasl_proto_context, errstr) != OK) {
+           nsc->sasl_proto_cb(NETSEC_SASL_CANCEL, NULL, 0, NULL, 0,
+                              nsc->sasl_proto_context, NULL);

            return NOTOK;
        }
 
        rc = sasl_client_step(nsc->sasl_conn, (char *) outbuf, outbuflen, NULL,
                              (const char **) &saslbuf, &saslbuflen);
 
            return NOTOK;
        }
 
        rc = sasl_client_step(nsc->sasl_conn, (char *) outbuf, outbuflen, NULL,
                              (const char **) &saslbuf, &saslbuflen);
 

-       free(outbuf);
+        free(outbuf);

 
        if (rc != SASL_OK && rc != SASL_CONTINUE) {
            netsec_err(errstr, "SASL client negotiation failed: %s",
                       sasl_errdetail(nsc->sasl_conn));
 
        if (rc != SASL_OK && rc != SASL_CONTINUE) {
            netsec_err(errstr, "SASL client negotiation failed: %s",
                       sasl_errdetail(nsc->sasl_conn));

-           if (nsc->sasl_proto_cb(NETSEC_SASL_CANCEL, NULL, 0, &outbuf,
-                                  &outbuflen, NULL) == OK) {
-               netsec_write(nsc, outbuf, outbuflen, NULL);
-               netsec_flush(nsc, NULL);
-               free(outbuf);
-           }
+           nsc->sasl_proto_cb(NETSEC_SASL_CANCEL, NULL, 0, NULL, 0,
+                              nsc->sasl_proto_context, NULL);

            return NOTOK;
        }
 
        if (nsc->sasl_proto_cb(NETSEC_SASL_WRITE, saslbuf, saslbuflen,
            return NOTOK;
        }
 
        if (nsc->sasl_proto_cb(NETSEC_SASL_WRITE, saslbuf, saslbuflen,

-                              &outbuf, &outbuflen, errstr) != OK) {
-           if (nsc->sasl_proto_cb(NETSEC_SASL_CANCEL, NULL, 0, &outbuf,
-                                  &outbuflen, NULL) == OK) {
-               netsec_write(nsc, outbuf, outbuflen, NULL);
-               netsec_flush(nsc, NULL);
-               free(outbuf);
-           }
-           return NOTOK;
-       }
-
-       if (netsec_write(nsc, outbuf, outbuflen, errstr) != OK) {
-           free(outbuf);
+                              NULL, 0, nsc->sasl_proto_context,
+                              errstr) != OK) {
+           nsc->sasl_proto_cb(NETSEC_SASL_CANCEL, NULL, 0, NULL, 0,
+                              nsc->sasl_proto_context, NULL);

            return NOTOK;
        }
            return NOTOK;
        }

-
-       free(outbuf);
-
-       if (netsec_flush(nsc, errstr) != OK)
-           return NOTOK;

     }
 
     /*
     }
 
     /*


@@ -1063,7 +1379,7 @@ netsec_negotiate_sasl(netsec_context *nsc, const char *mechlist, char **errstr)
      */
 
     if (nsc->sasl_proto_cb(NETSEC_SASL_FINISH, NULL, 0, NULL, 0,
      */
 
     if (nsc->sasl_proto_cb(NETSEC_SASL_FINISH, NULL, 0, NULL, 0,

-                          errstr) != OK) {
+                          nsc->sasl_proto_context, errstr) != OK) {

        /*
         * At this point we can't really send an abort since the SASL dialog
         * has completed, so just bubble back up the error message.
        /*
         * At this point we can't really send an abort since the SASL dialog
         * has completed, so just bubble back up the error message.


@@ -1144,7 +1460,18 @@ netsec_negotiate_sasl(netsec_context *nsc, const char *mechlist, char **errstr)
 
     return OK;
 #else
 
     return OK;
 #else

-    netsec_err(errstr, "SASL not supported");
+    /*
+     * If we're at this point, then either we have NEITHER OAuth2 or
+     * Cyrus-SASL compiled in, or have OAuth2 but didn't give the XOAUTH2
+     * mechanism on the command line.
+     */
+
+    if (! nsc->sasl_mech)
+       netsec_err(errstr, "SASL library support not available; please "
+                  "specify a SASL mechanism to use");
+    else
+       netsec_err(errstr, "No support for the %s SASL mechanism",
+                  nsc->sasl_mech);

 
     return NOTOK;
 #endif /* CYRUS_SASL */
 
     return NOTOK;
 #endif /* CYRUS_SASL */


@@ -1157,24 +1484,52 @@ netsec_negotiate_sasl(netsec_context *nsc, const char *mechlist, char **errstr)
 char *
 netsec_get_sasl_mechanism(netsec_context *nsc)
 {
 char *
 netsec_get_sasl_mechanism(netsec_context *nsc)
 {

-#ifdef CYRUS_SASL

     return nsc->sasl_chosen_mech;
     return nsc->sasl_chosen_mech;

+}
+
+/*
+ * Return the negotiated SASL strength security factor (SSF)
+ */
+
+int
+netsec_get_sasl_ssf(netsec_context *nsc)
+{
+#ifdef CYRUS_SASL
+    return nsc->sasl_ssf;

 #else /* CYRUS_SASL */
 #else /* CYRUS_SASL */

-    return NULL;
+    NMH_UNUSED(nsc);
+    return 0;

 #endif /* CYRUS_SASL */
 }
 
 #endif /* CYRUS_SASL */
 }
 

+/*
+ * Set an OAuth2 service name, if we support it.
+ */
+
+int
+netsec_set_oauth_service(netsec_context *nsc, const char *service)
+{
+#ifdef OAUTH_SUPPORT
+    nsc->oauth_service = getcpy(service);
+    return OK;
+#else /* OAUTH_SUPPORT */
+    NMH_UNUSED(nsc);
+    NMH_UNUSED(service);
+    return NOTOK;
+#endif /* OAUTH_SUPPORT */
+}
+

 /*
  * Initialize (and enable) TLS for this connection
  */
 
 int
 /*
  * Initialize (and enable) TLS for this connection
  */
 
 int

-netsec_set_tls(netsec_context *nsc, int tls, char **errstr)
+netsec_set_tls(netsec_context *nsc, int tls, int noverify, char **errstr)

 {
 {

-    if (tls) {

 #ifdef TLS_SUPPORT
 #ifdef TLS_SUPPORT

+    if (tls) {

        SSL *ssl;
        SSL *ssl;

-       BIO *sbio, *ssl_bio;;
+        BIO *rbio, *wbio, *ssl_bio;

 
        if (! tls_initialized) {
            SSL_library_init();
 
        if (! tls_initialized) {
            SSL_library_init();


@@ -1197,10 +1552,17 @@ netsec_set_tls(netsec_context *nsc, int tls, char **errstr)
            SSL_CTX_set_options(sslctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 |
                                SSL_OP_NO_TLSv1);
 
            SSL_CTX_set_options(sslctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 |
                                SSL_OP_NO_TLSv1);
 

-           tls_initialized++;
+           if (!SSL_CTX_set_default_verify_paths(sslctx)) {
+               netsec_err(errstr, "Unable to set default certificate "
+                          "verification paths: %s",
+                          ERR_error_string(ERR_get_error(), NULL));
+               return NOTOK;
+           }
+
+           tls_initialized = true;

        }
 
        }
 

-       if (nsc->ns_fd == -1) {
+       if (nsc->ns_readfd == -1 || nsc->ns_writefd == -1) {

            netsec_err(errstr, "Invalid file descriptor in netsec context");
            return NOTOK;
        }
            netsec_err(errstr, "Invalid file descriptor in netsec context");
            return NOTOK;
        }


@@ -1232,35 +1594,71 @@ netsec_set_tls(netsec_context *nsc, int tls, char **errstr)
         * supplied socket.
         *
         * Then we create an SSL BIO, and assign our current SSL connection
         * supplied socket.
         *
         * Then we create an SSL BIO, and assign our current SSL connection

-        * to it.  We then create a buffer BIO and push it in front of our
-        * SSL BIO.  So the chain looks like:
-        *
-        * buffer BIO -> SSL BIO -> socket BIO.
+        * to it.  This is done so our code stays simple if we want to use
+        * any buffering BIOs (right now we do our own buffering).
+        * So the chain looks like:

         *
         *

-        * So writes and reads are buffered (we mostly care about writes).
+        * SSL BIO -> socket BIO.

         */
 
         */
 

-       sbio = BIO_new_socket(nsc->ns_fd, BIO_NOCLOSE);
+       rbio = BIO_new_socket(nsc->ns_readfd, BIO_CLOSE);

 
 

-       if (! sbio) {
-           netsec_err(errstr, "Unable to create a socket BIO: %s",
+       if (! rbio) {
+           netsec_err(errstr, "Unable to create a read socket BIO: %s",

                       ERR_error_string(ERR_get_error(), NULL));
            SSL_free(ssl);
            return NOTOK;
        }
 
                       ERR_error_string(ERR_get_error(), NULL));
            SSL_free(ssl);
            return NOTOK;
        }
 

-       SSL_set_bio(ssl, sbio, sbio);
-       SSL_set_connect_state(ssl);
-
-       nsc->ssl_io = BIO_new(BIO_f_buffer());
+       wbio = BIO_new_socket(nsc->ns_writefd, BIO_CLOSE);

 
 

-       if (! nsc->ssl_io) {
-           netsec_err(errstr, "Unable to create a buffer BIO: %s",
+       if (! wbio) {
+           netsec_err(errstr, "Unable to create a write socket BIO: %s",

                       ERR_error_string(ERR_get_error(), NULL));
            SSL_free(ssl);
                       ERR_error_string(ERR_get_error(), NULL));
            SSL_free(ssl);

+           BIO_free(rbio);

            return NOTOK;
        }
 
            return NOTOK;
        }
 

+       SSL_set_bio(ssl, rbio, wbio);
+       SSL_set_connect_state(ssl);
+
+       /*
+        * If noverify is NOT set, then do certificate validation.
+        * Turning on SSL_VERIFY_PEER will verify the certificate chain
+        * against locally stored root certificates (the locations are
+        * set using SSL_CTX_set_default_verify_paths()), and we put
+        * the hostname in the X509 verification parameters so the OpenSSL
+        * code will verify that the hostname appears in the server
+        * certificate.
+        */
+
+       if (! noverify) {
+#ifdef HAVE_X509_VERIFY_PARAM_SET1_HOST
+           X509_VERIFY_PARAM *param;
+#endif /* HAVE_X509_VERIFY_PARAM_SET1_HOST */
+
+           SSL_set_verify(ssl, SSL_VERIFY_PEER, NULL);
+           if (! nsc->ns_hostname) {
+               netsec_err(errstr, "Internal error: hostname not set and "
+                          "certification verification enabled");
+               SSL_free(ssl);
+               return NOTOK;
+           }
+
+#ifdef HAVE_X509_VERIFY_PARAM_SET1_HOST
+           param = SSL_get0_param(ssl);
+
+           if (! X509_VERIFY_PARAM_set1_host(param, nsc->ns_hostname, 0)) {
+               netsec_err(errstr, "Unable to add hostname %s to cert "
+                          "verification parameters: %s", nsc->ns_hostname,
+                          ERR_error_string(ERR_get_error(), NULL));
+               SSL_free(ssl);
+               return NOTOK;
+           }
+#endif /* HAVE_X509_VERIFY_PARAM_SET1_HOST */
+       }
+

        ssl_bio = BIO_new(BIO_f_ssl());
 
        if (! ssl_bio) {
        ssl_bio = BIO_new(BIO_f_ssl());
 
        if (! ssl_bio) {


@@ -1271,21 +1669,31 @@ netsec_set_tls(netsec_context *nsc, int tls, char **errstr)
        }
 
        BIO_set_ssl(ssl_bio, ssl, BIO_CLOSE);
        }
 
        BIO_set_ssl(ssl_bio, ssl, BIO_CLOSE);

-       BIO_push(nsc->ssl_io, ssl_bio);
+       nsc->ssl_io = ssl_bio;

 
 

-       return OK;
-    } else {
-       BIO_free_all(nsc->ssl_io);
-       nsc->ssl_io = NULL;
+       /*
+        * Since SSL now owns these file descriptors, have it handle the
+        * closing of them instead of netsec_shutdown().
+        */
+
+       nsc->ns_noclose = 1;

 
        return OK;
     }
 
        return OK;
     }

+    BIO_free_all(nsc->ssl_io);
+    nsc->ssl_io = NULL;
+

 #else /* TLS_SUPPORT */
 #else /* TLS_SUPPORT */

-       netsec_err(errstr, "TLS is not supported");
+    NMH_UNUSED(nsc);
+    NMH_UNUSED(noverify);

 
 

+    if (tls) {
+       netsec_err(errstr, "TLS is not supported");

        return NOTOK;
     }
 #endif /* TLS_SUPPORT */
        return NOTOK;
     }
 #endif /* TLS_SUPPORT */

+
+    return OK;

 }
 
 /*
 }
 
 /*


@@ -1302,8 +1710,42 @@ netsec_negotiate_tls(netsec_context *nsc, char **errstr)
     }
 
     if (BIO_do_handshake(nsc->ssl_io) < 1) {
     }
 
     if (BIO_do_handshake(nsc->ssl_io) < 1) {

-       netsec_err(errstr, "TLS negotiation failed: %s",
-                  ERR_error_string(ERR_get_error(), NULL));
+       unsigned long errcode = ERR_get_error();
+
+       /*
+        * Print a more detailed message if it was certificate verification
+        * failure.
+        */
+
+       if (ERR_GET_LIB(errcode) == ERR_LIB_SSL &&
+               ERR_GET_REASON(errcode) == SSL_R_CERTIFICATE_VERIFY_FAILED) {
+           SSL *ssl;
+
+           if (BIO_get_ssl(nsc->ssl_io, &ssl) < 1) {
+               netsec_err(errstr, "Certificate verification failed, but "
+                          "cannot retrieve SSL handle: %s",
+                           ERR_error_string(ERR_get_error(), NULL));
+           } else {
+               netsec_err(errstr, "Server certificate verification failed: %s",
+                          X509_verify_cert_error_string(
+                                               SSL_get_verify_result(ssl)));
+           }
+       } else {
+           netsec_err(errstr, "TLS negotiation failed: %s",
+                       ERR_error_string(errcode, NULL));
+       }
+
+       /*
+        * Because negotiation failed, shut down TLS so we don't get any
+        * garbage on the connection.  Because of weirdness with SSL_shutdown,
+        * we end up calling it twice: once explicitly, once as part of
+        * BIO_free_all().
+        */
+
+       BIO_ssl_shutdown(nsc->ssl_io);
+       BIO_free_all(nsc->ssl_io);
+       nsc->ssl_io = NULL;
+

        return NOTOK;
     }
 
        return NOTOK;
     }
 


@@ -1314,27 +1756,19 @@ netsec_negotiate_tls(netsec_context *nsc, char **errstr)
            fprintf(stderr, "WARNING: cannot determine SSL ciphers\n");
        } else {
            const SSL_CIPHER *cipher = SSL_get_current_cipher(ssl);
            fprintf(stderr, "WARNING: cannot determine SSL ciphers\n");
        } else {
            const SSL_CIPHER *cipher = SSL_get_current_cipher(ssl);

-           fprintf(stderr, "TLS negotation successful: %s(%d) %s\n",
+           fprintf(stderr, "TLS negotiation successful: %s(%d) %s\n",

                    SSL_CIPHER_get_name(cipher),
                    SSL_CIPHER_get_bits(cipher, NULL),
                    SSL_CIPHER_get_version(cipher));
                    SSL_CIPHER_get_name(cipher),
                    SSL_CIPHER_get_bits(cipher, NULL),
                    SSL_CIPHER_get_version(cipher));

+           SSL_SESSION_print_fp(stderr, SSL_get_session(ssl));

        }
     }
 
     nsc->tls_active = 1;
 
        }
     }
 
     nsc->tls_active = 1;
 

-    /*
-     * At this point, TLS has been activated; we're not going to use
-     * the output buffer, so free it now to save a little bit of memory.
-     */
-
-    if (nsc->ns_outbuffer) {
-       free(nsc->ns_outbuffer);
-       nsc->ns_outbuffer = NULL;
-    }
-

     return OK;
 #else /* TLS_SUPPORT */
     return OK;
 #else /* TLS_SUPPORT */

+    NMH_UNUSED(nsc);

     netsec_err(errstr, "TLS not supported");
 
     return NOTOK;
     netsec_err(errstr, "TLS not supported");
 
     return NOTOK;


@@ -1345,7 +1779,7 @@ netsec_negotiate_tls(netsec_context *nsc, char **errstr)
  * Generate an (allocated) error string
  */
 
  * Generate an (allocated) error string
  */
 

-static void
+void

 netsec_err(char **errstr, const char *fmt, ...)
 {
     va_list ap;
 netsec_err(char **errstr, const char *fmt, ...)
 {
     va_list ap;