1 /* Copyright (C) 2000 Michael R. Elkins <me@mutt.org>
3 * This program is free software; you can redistribute it and/or modify
4 * it under the terms of the GNU General Public License as published by
5 * the Free Software Foundation; either version 2 of the License, or
6 * (at your option) any later version.
8 * This program is distributed in the hope that it will be useful,
9 * but WITHOUT ANY WARRANTY; without even the implied warranty of
10 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 * GNU General Public License for more details.
13 * You should have received a copy of the GNU General Public License
14 * along with this program; if not, write to the Free Software
15 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111, USA.
33 #include "mutt_socket.h"
34 #include "mutt_curses.h"
36 static int MuttNssInitialized = 0;
38 /* internal data struct we use with the CONNECTION. this is where NSS-specific
39 * data gets stuffed so that the main mutt_socket.h doesn't have to be
49 /* nss callback to grab the user's password. */
51 mutt_nss_password_func (PK11SlotInfo * slot, PRBool retry, void *arg)
57 mutt_nss_error (const char *call)
59 mutt_error (_("%s failed (error %d)"), call, PR_GetError ());
63 /* initialize the NSS library for use. must be called prior to any other
64 * functions in this module.
69 if (!MuttNssInitialized)
71 PK11_SetPasswordFunc (mutt_nss_password_func);
72 if (NSS_Init (SslCertFile) == SECFailure)
73 return mutt_nss_error ("NSS_Init");
75 /* always use strong crypto. */
76 if (NSS_SetDomesticPolicy () == SECFailure)
77 return mutt_nss_error ("NSS_SetDomesticPolicy");
79 /* intialize the session cache */
80 SSL_ClearSessionCache ();
82 MuttNssInitialized = 1;
87 /* convert from int64 to a readable string and print on the screen */
89 mutt_nss_pretty_time (int64 usecs)
95 PR_ExplodeTime (usecs, PR_LocalTimeParameters, &ex);
99 t.tm_hour = ex.tm_hour;
100 t.tm_mday = ex.tm_mday;
101 t.tm_mon = ex.tm_month;
102 t.tm_year = ex.tm_year - 1900; /* PRExplodedTime uses the absolute year */
103 t.tm_wday = ex.tm_wday;
104 t.tm_yday = ex.tm_yday;
106 strfcpy (timebuf, asctime (&t), sizeof (timebuf));
107 timebuf[strlen (timebuf) - 1] = 0;
112 /* this function is called by the default hook CERT_AuthCertificate when it
113 * can't verify a cert based upon the contents of the user's certificate
114 * database. we are given the option to override the decision and accept
118 mutt_nss_bad_cert (void *arg, PRFileDesc * fd)
121 CERTCertificate *cert, *issuer;
122 unsigned char hash[16];
125 int64 not_before, not_after;
129 /* first lets see why this certificate failed. we only want to override
130 * in the case where the cert was not found.
132 err = PR_GetError ();
133 mutt_error (_("SSL_AuthCertificate failed (error %d)"), err);
135 /* fetch the cert in question */
136 cert = SSL_PeerCertificate (fd);
143 addstr (CERT_NameToAscii (&cert->issuer));
146 addstr ("Subject: ");
147 addstr (CERT_NameToAscii (&cert->subject));
152 CERT_GetCertTimes (cert, ¬_before, ¬_after);
153 mutt_nss_pretty_time (not_before);
155 mutt_nss_pretty_time (not_after);
159 addstr ("Fingerprint: ");
161 /* calculate the MD5 hash of the raw certificate */
162 HASH_HashBuf (HASH_AlgMD5, hash, cert->derCert.data, cert->derCert.len);
163 for (i = 0; i < 16; i++)
165 printw ("%0x", hash[i]);
170 mvaddstr (LINES - 3, 0, "Signature: ");
173 /* find the cert which signed this cert */
174 issuer = CERT_FindCertByName ((CERTCertDBHandle *) arg, &cert->derIssuer);
176 /* verify the sig (only) if we have the issuer cert handy */
178 CERT_VerifySignedData (&cert->signatureWrap, issuer, PR_Now (), NULL)
185 SETCOLOR (MT_COLOR_STATUS);
186 memset (status, ' ', sizeof (status) - 1);
187 if (COLS < sizeof (status))
188 status[COLS - 1] = 0;
190 status[sizeof (status) - 1] = 0;
191 memcpy (status, "--- SSL Certificate Check",
192 sizeof ("--- SSL Certificate Check") - 1);
195 SETCOLOR (MT_COLOR_NORMAL);
199 mvaddstr (LINES - 1, 0, "(r)eject, accept (o)nce, (a)lways accept?");
207 else if (ascii_tolower (ch.ch) == 'r')
212 else if (ascii_tolower (ch.ch) == 'o')
217 else if (ascii_tolower (ch.ch) == 'a')
219 /* push this certificate onto the user's certificate store so it
220 * automatically becomes valid next time we see it
223 /* set this certificate as a valid peer for SSL-auth ONLY. */
224 CERT_DecodeTrustString (&trust, "P,,");
226 CERT_AddTempCertToPerm (cert, NULL, &trust);
233 /* SSL_PeerCertificate() returns a copy with an updated ref count, so
234 * we have to destroy our copy here.
236 CERT_DestroyCertificate (cert);
242 mutt_nss_socket_open (CONNECTION * con)
244 mutt_nss_t *sockdata;
248 memset (&addr, 0, sizeof (addr));
249 addr.inet.family = AF_INET;
250 addr.inet.port = PR_htons (con->account.port);
251 he = gethostbyname (con->account.host);
254 mutt_error (_("Unable to find ip for host %s"), con->account.host);
257 addr.inet.ip = *((int *) he->h_addr_list[0]);
259 sockdata = safe_calloc (1, sizeof (mutt_nss_t));
263 sockdata->fd = PR_NewTCPSocket ();
264 if (sockdata->fd == NULL)
266 mutt_error (_("PR_NewTCPSocket failed."));
269 /* make this a SSL socket */
270 sockdata->fd = SSL_ImportFD (NULL, sockdata->fd);
272 /* set SSL version options based upon user's preferences */
273 if (!option (OPTTLSV1))
274 SSL_OptionSet (sockdata->fd, SSL_ENABLE_TLS, PR_FALSE);
276 if (!option (OPTSSLV2))
277 SSL_OptionSet (sockdata->fd, SSL_ENABLE_SSL2, PR_FALSE);
279 if (!option (OPTSSLV3))
280 SSL_OptionSet (sockdata->fd, SSL_ENABLE_SSL3, PR_FALSE);
282 /* set the host we were attempting to connect to in order to verify
283 * the name in the certificate we get back.
285 if (SSL_SetURL (sockdata->fd, con->account.host))
287 mutt_nss_error ("SSL_SetURL");
291 /* we don't need no stinking pin. we don't authenticate ourself
294 SSL_SetPKCS11PinArg (sockdata->fd, 0);
296 sockdata->db = CERT_GetDefaultCertDB ();
298 /* use the default supplied hook. it takes an argument to our
299 * certificate database. the manual lies, you can't really specify
300 * NULL for the callback to get the default!
302 SSL_AuthCertificateHook (sockdata->fd, SSL_AuthCertificate,
304 /* set the callback to be used when SSL_AuthCertificate() fails. this
305 * allows us to override and insert the cert back into the db
307 SSL_BadCertHook (sockdata->fd, mutt_nss_bad_cert, sockdata->db);
309 if (PR_Connect (sockdata->fd, &addr, PR_INTERVAL_NO_TIMEOUT) ==
312 mutt_error (_("Unable to connect to host %s"), con->account.host);
316 /* store the extra info in the CONNECTION struct for later use. */
317 con->sockdata = sockdata;
319 /* HACK. some of the higher level calls in mutt_socket.c depend on this
320 * being >0 when we are in the connected state. we just set this to
321 * an arbitrary value to avoid hitting that bug, since we neve have the
331 /* we get here when we had an oops. clean up the mess. */
336 PR_Close (sockdata->fd);
338 CERT_ClosePermCertDB (sockdata->db);
345 mutt_nss_socket_close (CONNECTION * con)
347 mutt_nss_t *sockdata = (mutt_nss_t *) con->sockdata;
349 if (PR_Close (sockdata->fd) == PR_FAILURE)
353 CERT_ClosePermCertDB (sockdata->db);
354 /* free up the memory we used for this connection specific to NSS. */
355 FREE (&con->sockdata);
360 mutt_nss_socket_read (CONNECTION* conn, char* buf, size_t len)
362 return PR_Read (((mutt_nss_t*) conn->sockdata)->fd, buf, len);
366 mutt_nss_socket_write (CONNECTION * con, const char *buf, size_t count)
368 return PR_Write (((mutt_nss_t *) con->sockdata)->fd, buf, count);
371 /* initialize a new connection for use with NSS */
373 mutt_nss_socket_setup (CONNECTION * con)
375 if (mutt_nss_init ())
377 con->open = mutt_nss_socket_open;
378 con->read = mutt_nss_socket_read;
379 con->write = mutt_nss_socket_write;
380 con->close = mutt_nss_socket_close;