X-Git-Url: http://sjero.net/git/?a=blobdiff_plain;f=src%2Fgnutls.c;h=06f90200c514ca303c8dd3739c7c59c7cbcafe52;hb=eee1589ef3d198a21635d15c9086df2b99f9013d;hp=34d27ec34e43635ea85f5f8862c2a4136d366c04;hpb=c6cf57d2159796f2068b8366f1de81ae2a695629;p=wget diff --git a/src/gnutls.c b/src/gnutls.c index 34d27ec3..06f90200 100644 --- a/src/gnutls.c +++ b/src/gnutls.c @@ -1,5 +1,5 @@ /* SSL support via GnuTLS library. - Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010, 2011 Free Software + Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012 Free Software Foundation, Inc. This file is part of GNU Wget. @@ -45,22 +45,47 @@ as that of the covered work. */ #include "utils.h" #include "connect.h" #include "url.h" +#include "ptimer.h" #include "ssl.h" +#include + #ifdef WIN32 # include "w32sock.h" #endif +#include "host.h" + +static int +key_type_to_gnutls_type (enum keyfile_type type) +{ + switch (type) + { + case keyfile_pem: + return GNUTLS_X509_FMT_PEM; + case keyfile_asn1: + return GNUTLS_X509_FMT_DER; + default: + abort (); + } +} + /* Note: some of the functions private to this file have names that begin with "wgnutls_" (e.g. wgnutls_read) so that they wouldn't be confused with actual gnutls functions -- such as the gnutls_read preprocessor macro. */ -static gnutls_certificate_credentials credentials; - +static gnutls_certificate_credentials_t credentials; bool -ssl_init () +ssl_init (void) { + /* Becomes true if GnuTLS is initialized. */ + static bool ssl_initialized = false; + + /* GnuTLS should be initialized only once. */ + if (ssl_initialized) + return true; + const char *ca_directory; DIR *dir; @@ -74,7 +99,7 @@ ssl_init () dir = opendir (ca_directory); if (dir == NULL) { - if (opt.ca_directory) + if (opt.ca_directory && *opt.ca_directory) logprintf (LOG_NOTQUIET, _("ERROR: Cannot open directory %s.\n"), opt.ca_directory); } @@ -99,15 +124,48 @@ ssl_init () closedir (dir); } + /* Use the private key from the cert file unless otherwise specified. */ + if (opt.cert_file && !opt.private_key) + { + opt.private_key = opt.cert_file; + opt.private_key_type = opt.cert_type; + } + /* Use the cert from the private key file unless otherwise specified. */ + if (!opt.cert_file && opt.private_key) + { + opt.cert_file = opt.private_key; + opt.cert_type = opt.private_key_type; + } + + if (opt.cert_file && opt.private_key) + { + int type; + if (opt.private_key_type != opt.cert_type) + { + /* GnuTLS can't handle this */ + logprintf (LOG_NOTQUIET, _("ERROR: GnuTLS requires the key and the \ +cert to be of the same type.\n")); + } + + type = key_type_to_gnutls_type (opt.private_key_type); + + gnutls_certificate_set_x509_key_file (credentials, opt.cert_file, + opt.private_key, + type); + } + if (opt.ca_cert) gnutls_certificate_set_x509_trust_file (credentials, opt.ca_cert, GNUTLS_X509_FMT_PEM); + + ssl_initialized = true; + return true; } struct wgnutls_transport_context { - gnutls_session session; /* GnuTLS session handle */ + gnutls_session_t session; /* GnuTLS session handle */ int last_error; /* last error returned by read/write/... */ /* Since GnuTLS doesn't support the equivalent to recv(..., @@ -122,6 +180,78 @@ struct wgnutls_transport_context # define MIN(i, j) ((i) <= (j) ? (i) : (j)) #endif + +static int +wgnutls_read_timeout (int fd, char *buf, int bufsize, void *arg, double timeout) +{ +#ifdef F_GETFL + int flags = 0; +#endif + int ret = 0; + struct ptimer *timer = NULL; + struct wgnutls_transport_context *ctx = arg; + int timed_out = 0; + + if (timeout) + { +#ifdef F_GETFL + flags = fcntl (fd, F_GETFL, 0); + if (flags < 0) + return flags; + if (fcntl (fd, F_SETFL, flags | O_NONBLOCK)) + return -1; +#else + /* XXX: Assume it was blocking before. */ + const int one = 1; + if (ioctl (fd, FIONBIO, &one) < 0) + return -1; +#endif + + timer = ptimer_new (); + if (timer == NULL) + return -1; + } + + do + { + double next_timeout = 0; + if (timeout) + { + next_timeout = timeout - ptimer_measure (timer); + if (next_timeout < 0) + break; + } + + ret = GNUTLS_E_AGAIN; + if (timeout == 0 || gnutls_record_check_pending (ctx->session) + || select_fd (fd, next_timeout, WAIT_FOR_READ)) + { + ret = gnutls_record_recv (ctx->session, buf, bufsize); + timed_out = timeout && ptimer_measure (timer) >= timeout; + } + } + while (ret == GNUTLS_E_INTERRUPTED || (ret == GNUTLS_E_AGAIN && !timed_out)); + + if (timeout) + { + ptimer_destroy (timer); + +#ifdef F_GETFL + if (fcntl (fd, F_SETFL, flags) < 0) + return -1; +#else + const int zero = 0; + if (ioctl (fd, FIONBIO, &zero) < 0) + return -1; +#endif + + if (timed_out && ret == GNUTLS_E_AGAIN) + errno = ETIMEDOUT; + } + + return ret; +} + static int wgnutls_read (int fd, char *buf, int bufsize, void *arg) { @@ -140,10 +270,7 @@ wgnutls_read (int fd, char *buf, int bufsize, void *arg) return copysize; } - do - ret = gnutls_record_recv (ctx->session, buf, bufsize); - while (ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN); - + ret = wgnutls_read_timeout (fd, buf, bufsize, arg, opt.read_timeout); if (ret < 0) ctx->last_error = ret; @@ -167,8 +294,12 @@ static int wgnutls_poll (int fd, double timeout, int wait_for, void *arg) { struct wgnutls_transport_context *ctx = arg; - return ctx->peeklen || gnutls_record_check_pending (ctx->session) - || select_fd (fd, timeout, wait_for); + + if (timeout) + return ctx->peeklen || gnutls_record_check_pending (ctx->session) + || select_fd (fd, timeout, wait_for); + else + return ctx->peeklen || gnutls_record_check_pending (ctx->session); } static int @@ -177,21 +308,24 @@ wgnutls_peek (int fd, char *buf, int bufsize, void *arg) int read = 0; struct wgnutls_transport_context *ctx = arg; int offset = MIN (bufsize, ctx->peeklen); - if (bufsize > sizeof ctx->peekbuf) - bufsize = sizeof ctx->peekbuf; if (ctx->peeklen) - memcpy (buf, ctx->peekbuf, offset); + { + memcpy (buf, ctx->peekbuf, offset); + return offset; + } + + if (bufsize > sizeof ctx->peekbuf) + bufsize = sizeof ctx->peekbuf; if (bufsize > offset) { - if (gnutls_record_check_pending (ctx->session) <= 0 + if (opt.read_timeout && gnutls_record_check_pending (ctx->session) == 0 && select_fd (fd, 0.0, WAIT_FOR_READ) <= 0) read = 0; else - read = gnutls_record_recv (ctx->session, buf + offset, - bufsize - offset); - + read = wgnutls_read_timeout (fd, buf + offset, bufsize - offset, + ctx, opt.read_timeout); if (read < 0) { if (offset) @@ -238,31 +372,40 @@ static struct transport_implementation wgnutls_transport = }; bool -ssl_connect_wget (int fd) +ssl_connect_wget (int fd, const char *hostname) { - static const int cert_type_priority[] = { - GNUTLS_CRT_X509, GNUTLS_CRT_OPENPGP, 0 - }; +#ifdef F_GETFL + int flags = 0; +#endif struct wgnutls_transport_context *ctx; - gnutls_session session; - int err; + gnutls_session_t session; + int err,alert; gnutls_init (&session, GNUTLS_CLIENT); + const char *str; + + /* We set the server name but only if it's not an IP address. */ + if (! is_valid_ip_address (hostname)) + { + gnutls_server_name_set (session, GNUTLS_NAME_DNS, hostname, + strlen (hostname)); + } + gnutls_set_default_priority (session); - gnutls_certificate_type_set_priority (session, cert_type_priority); gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, credentials); #ifndef FD_TO_SOCKET # define FD_TO_SOCKET(X) (X) #endif - gnutls_transport_set_ptr (session, (gnutls_transport_ptr) FD_TO_SOCKET (fd)); + gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) FD_TO_SOCKET (fd)); err = 0; +#if HAVE_GNUTLS_PRIORITY_SET_DIRECT switch (opt.secure_protocol) { case secure_protocol_auto: break; case secure_protocol_sslv2: case secure_protocol_sslv3: - err = gnutls_priority_set_direct (session, "NORMAL:-VERS-TLS-ALL", NULL); + err = gnutls_priority_set_direct (session, "NORMAL:-VERS-TLS-ALL:+VERS-SSL3.0", NULL); break; case secure_protocol_tlsv1: err = gnutls_priority_set_direct (session, "NORMAL:-VERS-SSL3.0", NULL); @@ -270,6 +413,30 @@ ssl_connect_wget (int fd) default: abort (); } +#else + int allowed_protocols[4] = {0, 0, 0, 0}; + switch (opt.secure_protocol) + { + case secure_protocol_auto: + break; + case secure_protocol_sslv2: + case secure_protocol_sslv3: + allowed_protocols[0] = GNUTLS_SSL3; + err = gnutls_protocol_set_priority (session, allowed_protocols); + break; + + case secure_protocol_tlsv1: + allowed_protocols[0] = GNUTLS_TLS1_0; + allowed_protocols[1] = GNUTLS_TLS1_1; + allowed_protocols[2] = GNUTLS_TLS1_2; + err = gnutls_protocol_set_priority (session, allowed_protocols); + break; + + default: + abort (); + } +#endif + if (err < 0) { logprintf (LOG_NOTQUIET, "GnuTLS: %s\n", gnutls_strerror (err)); @@ -277,10 +444,83 @@ ssl_connect_wget (int fd) return false; } - err = gnutls_handshake (session); + if (opt.connect_timeout) + { +#ifdef F_GETFL + flags = fcntl (fd, F_GETFL, 0); + if (flags < 0) + return flags; + if (fcntl (fd, F_SETFL, flags | O_NONBLOCK)) + return -1; +#else + /* XXX: Assume it was blocking before. */ + const int one = 1; + if (ioctl (fd, FIONBIO, &one) < 0) + return -1; +#endif + } + + /* We don't stop the handshake process for non-fatal errors */ + do + { + err = gnutls_handshake (session); + + if (opt.connect_timeout && err == GNUTLS_E_AGAIN) + { + if (gnutls_record_get_direction (session)) + { + /* wait for writeability */ + err = select_fd (fd, opt.connect_timeout, WAIT_FOR_WRITE); + } + else + { + /* wait for readability */ + err = select_fd (fd, opt.connect_timeout, WAIT_FOR_READ); + } + + if (err <= 0) + { + if (err == 0) + { + errno = ETIMEDOUT; + err = -1; + } + break; + } + + if (err <= 0) + break; + } + else if (err < 0) + { + logprintf (LOG_NOTQUIET, "GnuTLS: %s\n", gnutls_strerror (err)); + if (err == GNUTLS_E_WARNING_ALERT_RECEIVED || + err == GNUTLS_E_FATAL_ALERT_RECEIVED) + { + alert = gnutls_alert_get (session); + str = gnutls_alert_get_name (alert); + if (str == NULL) + str = "(unknown)"; + logprintf (LOG_NOTQUIET, "GnuTLS: received alert [%d]: %s\n", alert, str); + } + } + } + while (err == GNUTLS_E_WARNING_ALERT_RECEIVED && gnutls_error_is_fatal (err) == 0); + + if (opt.connect_timeout) + { +#ifdef F_GETFL + if (fcntl (fd, F_SETFL, flags) < 0) + return -1; +#else + const int zero = 0; + if (ioctl (fd, FIONBIO, &zero) < 0) + return -1; +#endif + } + if (err < 0) { - logprintf (LOG_NOTQUIET, "GnuTLS: %s\n", gnutls_strerror (err)); gnutls_deinit (session); return false; } @@ -335,8 +575,8 @@ ssl_check_certificate (int fd, const char *host) if (gnutls_certificate_type_get (ctx->session) == GNUTLS_CRT_X509) { time_t now = time (NULL); - gnutls_x509_crt cert; - const gnutls_datum *cert_list; + gnutls_x509_crt_t cert; + const gnutls_datum_t *cert_list; unsigned int cert_list_size; if ((err = gnutls_x509_crt_init (&cert)) < 0) @@ -352,7 +592,7 @@ ssl_check_certificate (int fd, const char *host) { logprintf (LOG_NOTQUIET, _("No certificate found\n")); success = false; - goto out; + goto crt_deinit; } err = gnutls_x509_crt_import (cert, cert_list, GNUTLS_X509_FMT_DER); if (err < 0) @@ -360,7 +600,7 @@ ssl_check_certificate (int fd, const char *host) logprintf (LOG_NOTQUIET, _("Error parsing certificate: %s\n"), gnutls_strerror (err)); success = false; - goto out; + goto crt_deinit; } if (now < gnutls_x509_crt_get_activation_time (cert)) { @@ -379,6 +619,7 @@ ssl_check_certificate (int fd, const char *host) quote (host)); success = false; } + crt_deinit: gnutls_x509_crt_deinit (cert); }