+static int el_job_tlsing(job_t *w, int starttls)
+{
+ int err = gnutls_handshake(w->session);
+ if (err < 0 && !gnutls_error_is_fatal(err)) {
+ int wr = gnutls_record_get_direction(w->session);
+ return el_job_setemode(w, wr ? EL_WRITING : EL_READING);
+ }
+ if (err < 0)
+ return el_job_release(w, EL_RDHUP);
+
+#if 0
+ if (!tls_check_certificate (conn))
+ return -1;
+#endif
+
+ /* set Security Strength Factor (SSF) for SASL */
+ /* NB: gnutls_cipher_get_key_size() returns key length in bytes */
+ w->ssf = gnutls_cipher_get_key_size(gnutls_cipher_get(w->session)) * 8;
+ w->state = EL_LLP_READY;
+ if (starttls)
+ return el_job_setemode(w, w->mode);
+ return w->m->on_event(w, EL_EVT_RUNNING);
+}
+
+static int el_job_starttlsing(job_t *w)
+{
+ return el_job_tlsing(w, true);
+}
+
+static int el_job_connecting_ssl(job_t *w)
+{
+ return el_job_tlsing(w, false);
+}
+
+static int el_job_connecting(job_t *w)
+{
+ int err = 0;
+ socklen_t len = sizeof(err);
+
+ if (getsockopt(w->fd, SOL_SOCKET, SO_ERROR, (void *)&err, &len) || err)
+ return el_job_release(w, EL_ERROR);
+
+ if (w->session) {
+ w->llp = &el_job_connecting_ssl;
+ return w->llp(w);
+ }
+ w->state = EL_LLP_READY;
+ return w->m->on_event(w, EL_EVT_RUNNING);
+}
+
+static int tls_negotiate(job_t *w)
+{
+ static int protocol_priority[] = { GNUTLS_TLS1, GNUTLS_SSL3, 0 };
+
+ if (gnutls_certificate_allocate_credentials(&w->xcred) < 0)
+ return -1;
+
+ /* ignore errors, maybe file doesn't exist yet */
+ gnutls_certificate_set_x509_trust_file(w->xcred, mod_ssl.cert_file,
+ GNUTLS_X509_FMT_PEM);
+
+ if (mod_ssl.ca_certificates_file) {
+ gnutls_certificate_set_x509_trust_file(w->xcred,
+ mod_ssl.ca_certificates_file, GNUTLS_X509_FMT_PEM);
+ }
+ gnutls_init(&w->session, GNUTLS_CLIENT);
+
+ /* set socket */
+ gnutls_transport_set_ptr(w->session, (gnutls_transport_ptr)(intptr_t)w->fd);
+
+ /* disable TLS/SSL protocols as needed */
+ if (!mod_ssl.use_sslv3) {
+ protocol_priority[1] = 0;
+ }
+
+ /* We use default priorities (see gnutls documentation),
+ except for protocol version */
+ gnutls_set_default_priority(w->session);
+ gnutls_protocol_set_priority(w->session, protocol_priority);
+ gnutls_credentials_set(w->session, GNUTLS_CRD_CERTIFICATE, w->xcred);
+ return 0;
+}
+
+int el_job_connect(job_t *w, struct sockaddr *addr, socklen_t len,
+ int type, int proto, int ssl)
+{
+ int res, sock = socket(addr->sa_family, type, proto);
+
+ if (sock < 0)
+ goto error;
+
+ res = fcntl(sock, F_GETFL);
+ if (res < 0)
+ goto error;
+ if (fcntl(sock, F_SETFL, res | O_NONBLOCK) < 0)
+ goto error;
+ if (fcntl(sock, F_SETFD, FD_CLOEXEC) < 0)
+ goto error;
+ if (connect(sock, addr, len) < 0)
+ goto error;
+
+ w->fd = sock;
+ if (ssl && tls_negotiate(w) < 0)
+ goto error;
+
+ w->llp = &el_job_connecting;
+ return el_job_setmode(w, EL_WRITING);
+
+ error:
+ close(sock);
+ return el_job_release(w, EL_ERROR);
+}
+
+int el_job_connect2(job_t *w, const ACCOUNT *act)
+{
+ int rc;
+ char *host = NULL;
+ struct addrinfo *res;
+ struct addrinfo hints = {
+ .ai_family = AF_UNSPEC,
+ .ai_socktype = SOCK_STREAM,
+ };
+
+# ifdef HAVE_LIBIDN
+ if (idna_to_ascii_lz(act->host, &host, 1) != IDNA_SUCCESS) {
+ mutt_error(_("Bad IDN \"%s\"."), act->host);
+ return -1;
+ }
+# else
+ host = act->host;
+# endif
+ mutt_message(_("Looking up %s..."), act->host);
+ rc = getaddrinfo(host, NULL, &hints, &res);
+# ifdef HAVE_LIBIDN
+ p_delete(&host);
+# endif
+
+ if (rc) {
+ mutt_error(_("Could not find the host \"%s\""), act->host);
+ mutt_sleep(2);
+ return -1;
+ }
+ mutt_message(_("Connecting to %s..."), act->host);
+ rc = el_job_connect(w, res->ai_addr, res->ai_addrlen, res->ai_socktype,
+ res->ai_protocol, act->has_ssl);
+ freeaddrinfo (res);
+ if (rc) {
+ mutt_error(_("Could not connect to %s (%m)."), act->host);
+ mutt_sleep(2);
+ return -1;
+ }
+ return 0;
+}
+
+int el_job_starttls(job_t *w)
+{
+ if (tls_negotiate(w) < 0)
+ return el_job_release(w, EL_RDHUP);
+ w->state = EL_LLP_INIT;
+ w->llp = &el_job_starttlsing;
+ return w->llp(w);
+}
+
+ssize_t el_job_read(job_t *w, buffer_t *buf)
+{
+ ssize_t nr;
+
+ buffer_ensure(buf, BUFSIZ);
+
+ if (w->session) {
+ nr = gnutls_record_recv(w->session, buf->data + buf->len, BUFSIZ);
+ if (nr < 0 && !gnutls_error_is_fatal(nr)) {
+ int wr = gnutls_record_get_direction(w->session);
+ return el_job_setemode(w, wr ? EL_WRITING : EL_READING);
+ }
+ EL_JOB_CHECK(el_job_setemode(w, w->mode));
+ } else {
+ nr = read(w->fd, buf->data + buf->len, BUFSIZ);
+ if (nr < 0 && (errno == EINTR || errno == EAGAIN))
+ return 0;
+ }
+ if (nr <= 0)
+ return el_job_release(w, EL_RDHUP);
+ buffer_extend(buf, nr);
+ return nr;
+}
+
+ssize_t el_job_write(job_t *w, buffer_t *buf)
+{
+ ssize_t nr;
+
+ if (buf->len == 0)
+ return 0;
+
+ if (w->session) {
+ nr = gnutls_record_send(w->session, buf->data, buf->len);
+ if (nr < 0 && !gnutls_error_is_fatal(nr)) {
+ int wr = gnutls_record_get_direction(w->session);
+ return el_job_setemode(w, wr ? EL_WRITING : EL_READING);
+ }
+ EL_JOB_CHECK(el_job_setemode(w, w->mode));
+ } else {
+ nr = write(w->fd, buf->data, buf->len);
+ if (nr < 0 && (errno == EINTR || errno == EAGAIN))
+ return 0;
+ }
+ if (nr <= 0)
+ return el_job_release(w, EL_RDHUP);
+ buffer_splice(buf, 0, nr, NULL, 0);
+ return nr;
+}
+
+void el_lock(void)
+{
+ pthread_mutex_lock(&el_mx);
+}
+
+void el_unlock(void)
+{
+ pthread_mutex_unlock(&el_mx);
+}
+