libpurple/sslconn.c

   1 /* purple
   2  *
   3  * Purple is the legal property of its developers, whose names are too numerous
   4  * to list here.  Please refer to the COPYRIGHT file distributed with this
   5  * source distribution.
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License as published by
   9  * the Free Software Foundation; either version 2 of the License, or
  10  * (at your option) any later version.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU General Public License
  18  * along with this program; if not, write to the Free Software
  19  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02111-1301  USA
  20  */
  21 #define _PURPLE_SSLCONN_C_
  22
  23 #include "internal.h"
  24
  25 #include "debug.h"
  26 #include "plugins.h"
  27 #include "request.h"
  28 #include "sslconn.h"
  29 #include "tls-certificate.h"
  30
  31 #define CONNECTION_CLOSE_TIMEOUT 15
  32
  33 static void
  34 emit_error(PurpleSslConnection *gsc, int error_code)
  35 {
  36         if (gsc->error_cb != NULL)
  37                 gsc->error_cb(gsc, error_code, gsc->connect_cb_data);
  38 }
  39
  40 static void
  41 tls_handshake_cb(GObject *source, GAsyncResult *res, gpointer user_data)
  42 {
  43         PurpleSslConnection *gsc = user_data;
  44         GError *error = NULL;
  45
  46         if (!g_tls_connection_handshake_finish(G_TLS_CONNECTION(source), res,
  47                         &error)) {
  48                 if (g_error_matches(error, G_IO_ERROR, G_IO_ERROR_CANCELLED)) {
  49                         /* Connection already closed/freed. Escape. */
  50                         return;
  51                 } else if (g_error_matches(error, G_TLS_ERROR,
  52                                 G_TLS_ERROR_HANDSHAKE)) {
  53                         /* In Gio, a handshake error is because of the cert */
  54                         emit_error(gsc, PURPLE_SSL_CERTIFICATE_INVALID);
  55                 } else {
  56                         /* Report any other errors as handshake failing */
  57                         emit_error(gsc, PURPLE_SSL_HANDSHAKE_FAILED);
  58                 }
  59
  60                 purple_ssl_close(gsc);
  61                 return;
  62         }
  63
  64         gsc->connect_cb(gsc->connect_cb_data, gsc, PURPLE_INPUT_READ);
  65 }
  66
  67 static gboolean
  68 tls_connect(PurpleSslConnection *gsc)
  69 {
  70         GSocket *socket;
  71         GSocketConnection *conn;
  72         GSocketConnectable *identity;
  73         GIOStream *tls_conn;
  74         GError *error = NULL;
  75
  76         g_return_val_if_fail(gsc->conn == NULL, FALSE);
  77
  78         socket = g_socket_new_from_fd(gsc->fd, &error);
  79         if (socket == NULL) {
  80                 purple_debug_warning("sslconn",
  81                                 "Error creating socket from fd (%u): %s",
  82                                 gsc->fd, error->message);
  83                 g_clear_error(&error);
  84                 return FALSE;
  85         }
  86
  87         conn = g_socket_connection_factory_create_connection(socket);
  88         g_object_unref(socket);
  89
  90         identity = g_network_address_new(gsc->host, gsc->port);
  91         tls_conn = g_tls_client_connection_new(G_IO_STREAM(conn), identity,
  92                         &error);
  93         g_object_unref(identity);
  94         g_object_unref(conn);
  95
  96         if (tls_conn == NULL) {
  97                 purple_debug_warning("sslconn",
  98                                 "Error creating TLS client connection: %s",
  99                                 error->message);
 100                 g_clear_error(&error);
 101                 return FALSE;
 102         }
 103
 104         gsc->conn = G_TLS_CONNECTION(tls_conn);
 105         gsc->cancellable = g_cancellable_new();
 106
 107         purple_tls_certificate_attach_to_tls_connection(gsc->conn);
 108
 109         g_tls_connection_handshake_async(gsc->conn, G_PRIORITY_DEFAULT,
 110                         gsc->cancellable, tls_handshake_cb, gsc);
 111
 112         return TRUE;
 113 }
 114
 115 static void
 116 purple_ssl_connect_cb(gpointer data, gint source, const gchar *error_message)
 117 {
 118         PurpleSslConnection *gsc;
 119
 120         gsc = data;
 121         gsc->connect_data = NULL;
 122
 123         if (source < 0)
 124         {
 125                 emit_error(gsc, PURPLE_SSL_CONNECT_FAILED);
 126                 purple_ssl_close(gsc);
 127                 return;
 128         }
 129
 130         gsc->fd = source;
 131
 132         if (!tls_connect(gsc)) {
 133                 emit_error(gsc, PURPLE_SSL_CONNECT_FAILED);
 134                 purple_ssl_close(gsc);
 135         }
 136 }
 137
 138 PurpleSslConnection *
 139 purple_ssl_connect(PurpleAccount *account, const char *host, int port,
 140                                  PurpleSslInputFunction func, PurpleSslErrorFunction error_func,
 141                                  void *data)
 142 {
 143         return purple_ssl_connect_with_ssl_cn(account, host, port, func, error_func,
 144                                           NULL, data);
 145 }
 146
 147 PurpleSslConnection *
 148 purple_ssl_connect_with_ssl_cn(PurpleAccount *account, const char *host, int port,
 149                                  PurpleSslInputFunction func, PurpleSslErrorFunction error_func,
 150                                  const char *ssl_cn, void *data)
 151 {
 152         PurpleSslConnection *gsc;
 153
 154         g_return_val_if_fail(host != NULL,            NULL);
 155         g_return_val_if_fail(port != 0 && port != -1, NULL);
 156         g_return_val_if_fail(func != NULL,            NULL);
 157
 158         gsc = g_new0(PurpleSslConnection, 1);
 159
 160         gsc->fd              = -1;
 161         gsc->host            = ssl_cn ? g_strdup(ssl_cn) : g_strdup(host);
 162         gsc->port            = port;
 163         gsc->connect_cb_data = data;
 164         gsc->connect_cb      = func;
 165         gsc->error_cb        = error_func;
 166
 167         gsc->connect_data = purple_proxy_connect(NULL, account, host, port, purple_ssl_connect_cb, gsc);
 168
 169         if (gsc->connect_data == NULL)
 170         {
 171                 g_free(gsc->host);
 172                 g_free(gsc);
 173
 174                 return NULL;
 175         }
 176
 177         return (PurpleSslConnection *)gsc;
 178 }
 179
 180 static gboolean
 181 recv_cb(GObject *source, gpointer data)
 182 {
 183         PurpleSslConnection *gsc = data;
 184
 185         gsc->recv_cb(gsc->recv_cb_data, gsc, PURPLE_INPUT_READ);
 186
 187         return TRUE;
 188 }
 189
 190 void
 191 purple_ssl_input_add(PurpleSslConnection *gsc, PurpleSslInputFunction func,
 192                                    void *data)
 193 {
 194         GInputStream *input;
 195         GSource *source;
 196
 197         g_return_if_fail(func != NULL);
 198         g_return_if_fail(gsc->conn != NULL);
 199
 200         purple_ssl_input_remove(gsc);
 201
 202         gsc->recv_cb_data = data;
 203         gsc->recv_cb      = func;
 204
 205         input = g_io_stream_get_input_stream(G_IO_STREAM(gsc->conn));
 206         /* Pass NULL for cancellable as we don't want it notified on cancel */
 207         source = g_pollable_input_stream_create_source(
 208                         G_POLLABLE_INPUT_STREAM(input), NULL);
 209         g_source_set_callback(source, (GSourceFunc)recv_cb, gsc, NULL);
 210         gsc->inpa = g_source_attach(source, NULL);
 211         g_source_unref(source);
 212 }
 213
 214 void
 215 purple_ssl_input_remove(PurpleSslConnection *gsc)
 216 {
 217         if (gsc->inpa > 0) {
 218                 g_source_remove(gsc->inpa);
 219                 gsc->inpa = 0;
 220         }
 221 }
 222
 223 const gchar *
 224 purple_ssl_strerror(PurpleSslErrorType error)
 225 {
 226         switch(error) {
 227                 case PURPLE_SSL_CONNECT_FAILED:
 228                         return _("SSL Connection Failed");
 229                 case PURPLE_SSL_HANDSHAKE_FAILED:
 230                         return _("SSL Handshake Failed");
 231                 case PURPLE_SSL_CERTIFICATE_INVALID:
 232                         return _("SSL peer presented an invalid certificate");
 233                 default:
 234                         purple_debug_warning("sslconn", "Unknown SSL error code %d\n", error);
 235                         return _("Unknown SSL error");
 236         }
 237 }
 238
 239 PurpleSslConnection *
 240 purple_ssl_connect_with_host_fd(PurpleAccount *account, int fd,
 241                       PurpleSslInputFunction func,
 242                       PurpleSslErrorFunction error_func,
 243                       const char *host,
 244                       void *data)
 245 {
 246         PurpleSslConnection *gsc;
 247
 248         g_return_val_if_fail(fd != -1,                NULL);
 249         g_return_val_if_fail(func != NULL,            NULL);
 250
 251         gsc = g_new0(PurpleSslConnection, 1);
 252
 253         gsc->connect_cb_data = data;
 254         gsc->connect_cb      = func;
 255         gsc->error_cb        = error_func;
 256         gsc->fd              = fd;
 257         gsc->host            = g_strdup(host);
 258         gsc->cancellable     = g_cancellable_new();
 259
 260         if (!tls_connect(gsc)) {
 261                 emit_error(gsc, PURPLE_SSL_CONNECT_FAILED);
 262                 g_clear_pointer(&gsc, purple_ssl_close);
 263         }
 264
 265         return (PurpleSslConnection *)gsc;
 266 }
 267
 268 static void
 269 connection_closed_cb(GObject *stream, GAsyncResult *result,
 270                 gpointer timeout_id)
 271 {
 272         GError *error = NULL;
 273
 274         purple_timeout_remove(GPOINTER_TO_UINT(timeout_id));
 275
 276         g_io_stream_close_finish(G_IO_STREAM(stream), result, &error);
 277
 278         if (error) {
 279                 purple_debug_info("sslconn", "Connection close error: %s",
 280                                 error->message);
 281                 g_clear_error(&error);
 282         } else {
 283                 purple_debug_info("sslconn", "Connection closed.");
 284         }
 285 }
 286
 287 static void
 288 cleanup_cancellable_cb(gpointer data, GObject *where_the_object_was)
 289 {
 290         g_object_unref(G_CANCELLABLE(data));
 291 }
 292
 293 void
 294 purple_ssl_close(PurpleSslConnection *gsc)
 295 {
 296         g_return_if_fail(gsc != NULL);
 297
 298         purple_request_close_with_handle(gsc);
 299         purple_notify_close_with_handle(gsc);
 300
 301         if (gsc->connect_data != NULL)
 302                 purple_proxy_connect_cancel(gsc->connect_data);
 303
 304         if (gsc->inpa > 0)
 305                 purple_input_remove(gsc->inpa);
 306
 307         /* Stop any pending operations */
 308         if (G_IS_CANCELLABLE(gsc->cancellable)) {
 309                 g_cancellable_cancel(gsc->cancellable);
 310                 g_clear_object(&gsc->cancellable);
 311         }
 312
 313         if (gsc->conn != NULL) {
 314                 GCancellable *cancellable;
 315                 guint timer_id;
 316
 317                 cancellable = g_cancellable_new();
 318                 g_object_weak_ref(G_OBJECT(gsc->conn), cleanup_cancellable_cb,
 319                                 cancellable);
 320
 321                 timer_id = purple_timeout_add_seconds(CONNECTION_CLOSE_TIMEOUT,
 322                                 (GSourceFunc)g_cancellable_cancel, cancellable);
 323
 324                 g_io_stream_close_async(G_IO_STREAM(gsc->conn),
 325                                 G_PRIORITY_DEFAULT, cancellable,
 326                                 connection_closed_cb,
 327                                 GUINT_TO_POINTER(timer_id));
 328                 g_clear_object(&gsc->conn);
 329         }
 330
 331         g_free(gsc->host);
 332         g_free(gsc);
 333 }
 334
 335 size_t
 336 purple_ssl_read(PurpleSslConnection *gsc, void *data, size_t len)
 337 {
 338         GInputStream *input;
 339         gssize outlen;
 340         GError *error = NULL;
 341
 342         g_return_val_if_fail(gsc  != NULL, 0);
 343         g_return_val_if_fail(data != NULL, 0);
 344         g_return_val_if_fail(len  >  0,    0);
 345         g_return_val_if_fail(gsc->conn != NULL, 0);
 346
 347         input = g_io_stream_get_input_stream(G_IO_STREAM(gsc->conn));
 348         outlen = g_pollable_input_stream_read_nonblocking(
 349                         G_POLLABLE_INPUT_STREAM(input), data, len,
 350                         gsc->cancellable, &error);
 351
 352         if (outlen < 0) {
 353                 if (g_error_matches(error, G_IO_ERROR,
 354                                 G_IO_ERROR_WOULD_BLOCK)) {
 355                         errno = EAGAIN;
 356                 }
 357
 358                 g_clear_error(&error);
 359         }
 360
 361         return outlen;
 362 }
 363
 364 size_t
 365 purple_ssl_write(PurpleSslConnection *gsc, const void *data, size_t len)
 366 {
 367         GOutputStream *output;
 368         gssize outlen;
 369         GError *error = NULL;
 370
 371         g_return_val_if_fail(gsc  != NULL, 0);
 372         g_return_val_if_fail(data != NULL, 0);
 373         g_return_val_if_fail(len  >  0,    0);
 374         g_return_val_if_fail(gsc->conn != NULL, 0);
 375
 376         output = g_io_stream_get_output_stream(G_IO_STREAM(gsc->conn));
 377         outlen = g_pollable_output_stream_write_nonblocking(
 378                         G_POLLABLE_OUTPUT_STREAM(output), data, len,
 379                         gsc->cancellable, &error);
 380
 381         if (outlen < 0) {
 382                 if (g_error_matches(error, G_IO_ERROR,
 383                                 G_IO_ERROR_WOULD_BLOCK)) {
 384                         errno = EAGAIN;
 385                 }
 386
 387                 g_clear_error(&error);
 388         }
 389
 390         return outlen;
 391 }
 392
 393 GList *
 394 purple_ssl_get_peer_certificates(PurpleSslConnection *gsc)
 395 {
 396         GTlsCertificate *certificate;
 397
 398         g_return_val_if_fail(gsc != NULL, NULL);
 399         g_return_val_if_fail(gsc->conn != NULL, NULL);
 400
 401         certificate = g_tls_connection_get_peer_certificate(gsc->conn);
 402
 403         return certificate != NULL ? g_list_append(NULL, certificate) : NULL;
 404 }
 405