X-Git-Url: https://diplodocus.org/git/nmh/blobdiff_plain/8e0f9bd3daae9d05dec58026d5a5924367e4e874..9dbb49a38ef76acdaa1217d2f66af1c58449d6ff:/uip/popsbr.c

diff --git a/uip/popsbr.c b/uip/popsbr.c
index 5b99c8cf..b8e5a448 100644
--- a/uip/popsbr.c
+++ b/uip/popsbr.c
@@ -22,6 +22,11 @@
 # endif /* SASL_VERSION_FULL < 0x020125 */
 #endif /* CYRUS_SASL */
 
+#ifdef TLS_SUPPORT
+#include <openssl/ssl.h>
+#include <openssl/err.h>
+#endif /* TLS_SUPPORT */
+
 #include <h/popsbr.h>
 #include <h/signals.h>
 
@@ -59,8 +64,6 @@ static sasl_callback_t callbacks[] = {
 
 #define SASL_BUFFER_SIZE 262144
 };
-#else /* CYRUS_SASL */
-# define sasl_fgetc fgetc
 #endif /* CYRUS_SASL */
 
 /*
@@ -72,12 +75,24 @@ static int multiline(void);
 
 #ifdef CYRUS_SASL
 static int pop_auth_sasl(char *, char *, char *);
-static int sasl_fgetc(FILE *);
 #endif /* CYRUS_SASL */
 
+#ifdef TLS_SUPPORT
+static SSL_CTX *sslctx = NULL;
+static SSL *ssl = NULL;
+static BIO *sbior = NULL;
+static BIO *sbiow = NULL;
+static BIO *io = NULL;
+
+static int tls_negotiate(void);
+#endif /* TLS_SUPPORT */
+
+static int tls_active = 0;
+
 static int traverse (int (*)(char *), const char *, ...);
 static int vcommand(const char *, va_list);
 static int sasl_getline (char *, int, FILE *);
+static int sasl_fgetc(FILE *);
 static int putline (char *, FILE *);
 
 
@@ -203,7 +218,7 @@ pop_auth_sasl(char *user, char *host, char *mech)
 
     memset(&secprops, 0, sizeof(secprops));
     secprops.maxbufsize = SASL_BUFFER_SIZE;
-    secprops.max_ssf = UINT_MAX;
+    secprops.max_ssf = tls_active ? 0 : UINT_MAX;
 
     result = sasl_setprop(conn, SASL_SEC_PROPS, &secprops);
 
@@ -507,7 +522,7 @@ parse_proxy(char *proxy, char *host)
 
 int
 pop_init (char *host, char *port, char *user, char *pass, char *proxy,
-	  int snoop, int sasl, char *mech, const char *oauth_svc)
+	  int snoop, int sasl, char *mech, int tls, const char *oauth_svc)
 {
     int fd1, fd2;
     char buffer[BUFSIZ];
@@ -599,6 +614,9 @@ pop_init (char *host, char *port, char *user, char *pass, char *proxy,
 
     SIGNAL (SIGPIPE, SIG_IGN);
 
+    if (tls && tls_negotiate())
+	return NOTOK;
+
     switch (sasl_getline (response, sizeof response, input)) {
 	case OK: 
 	    if (poprint)
@@ -855,8 +873,12 @@ vcommand (const char *fmt, va_list ap)
     if (poprint) {
 #ifdef CYRUS_SASL
 	if (sasl_ssf)
-	    fprintf(stderr, "(encrypted) ");
+	    fprintf(stderr, "(sasl-encrypted) ");
 #endif /* CYRUS_SASL */
+#ifdef TLS_SUPPORT
+	if (tls_active)
+	    fprintf(stderr, "(tls-encrypted) ");
+#endif /* TLS_SUPPORT */
 	if (pophack) {
 	    if ((cp = strchr (buffer, ' ')))
 		*cp = 0;
@@ -965,8 +987,23 @@ putline (char *s, FILE *iop)
     int result;
     unsigned int buflen;
 
-    if (!sasl_complete) {
+    if (sasl_complete == 0 || sasl_ssf == 0) {
 #endif /* CYRUS_SASL */
+#ifdef TLS_SUPPORT
+	if (tls_active) {
+	    int ret;
+
+	    BIO_printf(io, "%s\r\n");
+	    ret = BIO_flush(io);
+
+	    if (ret != 1) {
+		strncpy(response, "lost connection", sizeof(response));
+		return NOTOK;
+	    else {
+	    	return OK;
+	    }
+	} else
+#endif /* TLS_SUPPORT */
 	fprintf (iop, "%s\r\n", s);
 #ifdef CYRUS_SASL
     } else {
@@ -1032,6 +1069,9 @@ sasl_fgetc(FILE *f)
 
     while (retbufsize == 0) {
 
+#ifdef TLS_SUPPORT
+	if (tls_active) {
+
 	cc = read(fileno(f), tmpbuf, sizeof(tmpbuf));
 
 	if (cc == 0)
@@ -1078,3 +1118,102 @@ sasl_fgetc(FILE *f)
     return (int) buffer[0];
 }
 #endif /* CYRUS_SASL */
+
+#ifdef TLS_SUPPORT
+/*
+ * Negotiate TLS at this point.  Will call pop_done() on failure.
+ */
+
+static int
+tls_negotiate(void)
+{
+    BIO *ssl_bio;
+
+    if (! sslctx) {
+	SSL_library_init();
+	SSL_load_error_strings();
+
+	sslctx = SSL_CTX_new(SSLv23_client_method());
+
+	if (! sslctx) {
+	    pop_done();
+	    advise(NULL, "Unable to initialize OpenSSL context: %s",
+		   ERR_error_string(ERR_get_error(), NULL));
+	    return NOTOK;
+	}
+
+	SSL_CTX_set_options(sslctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 |
+			    SSL_OP_NO_TLSv1);
+    }
+
+    ssl = SSL_new(sslctx);
+
+    if (! ssl) {
+	pop_done();
+	advise(NULL, "Unable to create SSL connection: %s",
+	       ERR_error_string(ERR_get_error(), NULL));
+	return NOTOK;
+    }
+
+    sbior = BIO_new_socket(fileno(input), BIO_NOCLOSE);
+    sbiow = BIO_new_socket(fileno(output), BIO_NOCLOSE);
+
+    if (sbior == NULL || sbiow == NULL) {
+	pop_done();
+	advise(NULL, "Unable to create BIO endpoints: %s",
+	       ERR_error_string(ERR_get_error(), NULL));
+	return NOTOK;
+    }
+
+    SSL_set_bio(ssl, sbior, sbiow);
+    SSL_set_connect_state(ssl);
+
+    /*
+     * Set up a BIO to do buffering for us
+     */
+
+    io = BIO_new(BIO_f_buffer());
+
+    if (! io) {
+	pop_done();
+	advise(NULL, "Unable to create a buffer BIO: %s",
+	       ERR_error_string(ERR_get_error(), NULL));
+	return NOTOK;
+    }
+     
+    ssl_bio = BIO_new(BIO_f_ssl());
+
+    if (! ssl_bio) {
+	pop_done();
+	advise(NULL, "Unable to create a SSL BIO: %s",
+	       ERR_error_string(ERR_get_error(), NULL));
+	return NOTOK;
+    }
+
+    BIO_set_ssl(ssl_bio, ssl, BIO_CLOSE);
+    BIO_push(io, ssl_bio);
+
+    /*
+     * Try doing the handshake now
+     */
+
+    if (BIO_do_handshake(io) < 1) {
+	pop_done();
+	advise(NULL, "Unable to negotiate SSL connection: %s",
+	       ERR_error_string(ERR_get_error(), NULL));
+	return NOTOK;
+    }
+
+    if (poprint) {
+	const SSL_CIPHER *cipher = SSL_get_current_cipher(ssl);
+	printf("SSL negotiation successful: %s(%d) %s\n",
+	       SSL_CIPHER_get_name(cipher),
+	       SSL_CIPHER_get_bits(cipher, NULL),
+	       SSL_CIPHER_get_version(cipher));
+    }
+
+    tls_active = 1;
+
+    return OK;
+}
+#endif /* TLS_SUPPORT */