test/src/client.c

   1 /* A little hacked up program that makes a TCP/IP call and reads a script to
   2 drive it, for testing Exim server code running as a daemon. It's got a bit
   3 messy with the addition of support for either OpenSSL or GnuTLS. The code for
   4 those was hacked out of Exim itself, then code for OpenSSL OCSP stapling was
   5 ripped from the openssl ocsp and s_client utilities. */
   6
   7 /* ANSI C standard includes */
   8
   9 #include <ctype.h>
  10 #include <signal.h>
  11 #include <stdarg.h>
  12 #include <stddef.h>
  13 #include <stdio.h>
  14 #include <stdlib.h>
  15 #include <string.h>
  16 #include <time.h>
  17
  18 /* Unix includes */
  19
  20 #include <errno.h>
  21 #include <dirent.h>
  22 #include <sys/types.h>
  23
  24 #include <netinet/in_systm.h>
  25 #include <netinet/in.h>
  26 #include <netinet/ip.h>
  27
  28 #include <netdb.h>
  29 #include <arpa/inet.h>
  30 #include <sys/time.h>
  31 #include <sys/resource.h>
  32 #include <sys/socket.h>
  33 #include <sys/stat.h>
  34 #include <fcntl.h>
  35 #include <unistd.h>
  36 #include <utime.h>
  37
  38 #ifdef AF_INET6
  39 #define HAVE_IPV6 1
  40 #endif
  41
  42 #ifndef S_ADDR_TYPE
  43 #define S_ADDR_TYPE u_long
  44 #endif
  45
  46 typedef unsigned char uschar;
  47
  48 #define CS   (char *)
  49 #define US   (unsigned char *)
  50
  51 #define FALSE         0
  52 #define TRUE          1
  53
  54
  55
  56 static int sigalrm_seen = 0;
  57
  58
  59 /* TLS support can be optionally included, either for OpenSSL or GnuTLS. The
  60 latter needs a whole pile of tables. */
  61 #ifdef HAVE_OPENSSL
  62 # define HAVE_TLS
  63 # include <openssl/crypto.h>
  64 # include <openssl/x509.h>
  65 # include <openssl/pem.h>
  66 # include <openssl/ssl.h>
  67 # include <openssl/err.h>
  68 # include <openssl/rand.h>
  69
  70 # if OPENSSL_VERSION_NUMBER < 0x0090806fL && !defined(DISABLE_OCSP) && !defined(OPENSSL_NO_TLSEXT)
  71 #  warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
  72 #  define DISABLE_OCSP
  73 # endif
  74 # ifndef DISABLE_OCSP
  75 #  include <openssl/ocsp.h>
  76 # endif
  77 #endif
  78
  79
  80 #ifdef HAVE_GNUTLS
  81 # define HAVE_TLS
  82 # include <gnutls/gnutls.h>
  83 # include <gnutls/x509.h>
  84 # if GNUTLS_VERSION_NUMBER >= 0x030103
  85 #  define HAVE_OCSP
  86 #  include <gnutls/ocsp.h>
  87 # endif
  88 # ifndef GNUTLS_NO_EXTENSIONS
  89 #  define GNUTLS_NO_EXTENSIONS 0
  90 # endif
  91
  92 # define DH_BITS      768
  93
  94 /* Local static variables for GNUTLS */
  95
  96 static gnutls_dh_params dh_params = NULL;
  97
  98 static gnutls_certificate_credentials_t x509_cred = NULL;
  99 static gnutls_session tls_session = NULL;
 100
 101 static int  ssl_session_timeout = 200;
 102
 103 /* Priorities for TLS algorithms to use. */
 104
 105 static const int protocol_priority[16] = { GNUTLS_TLS1, GNUTLS_SSL3, 0 };
 106
 107 static const int kx_priority[16] = {
 108   GNUTLS_KX_RSA,
 109   GNUTLS_KX_DHE_DSS,
 110   GNUTLS_KX_DHE_RSA,
 111   0 };
 112
 113 static int default_cipher_priority[16] = {
 114   GNUTLS_CIPHER_AES_256_CBC,
 115   GNUTLS_CIPHER_AES_128_CBC,
 116   GNUTLS_CIPHER_3DES_CBC,
 117   GNUTLS_CIPHER_ARCFOUR_128,
 118   0 };
 119
 120 static const int mac_priority[16] = {
 121   GNUTLS_MAC_SHA,
 122   GNUTLS_MAC_MD5,
 123   0 };
 124
 125 static const int comp_priority[16] = { GNUTLS_COMP_NULL, 0 };
 126 static const int cert_type_priority[16] = { GNUTLS_CRT_X509, 0 };
 127
 128 #endif  /*HAVE_GNUTLS*/
 129
 130
 131
 132 #ifdef HAVE_TLS
 133 char * ocsp_stapling = NULL;
 134 #endif
 135
 136
 137 /*************************************************
 138 *            SIGALRM handler - crash out         *
 139 *************************************************/
 140
 141 static void
 142 sigalrm_handler_crash(int sig)
 143 {
 144 sig = sig;    /* Keep picky compilers happy */
 145 printf("\nClient timed out\n");
 146 exit(99);
 147 }
 148
 149
 150 /*************************************************
 151 *            SIGALRM handler - set flag          *
 152 *************************************************/
 153
 154 static void
 155 sigalrm_handler_flag(int sig)
 156 {
 157 sig = sig;    /* Keep picky compilers happy */
 158 sigalrm_seen = 1;
 159 }
 160
 161
 162
 163 /****************************************************************************/
 164 /****************************************************************************/
 165
 166 #ifdef HAVE_OPENSSL
 167
 168 X509_STORE *
 169 setup_verify(BIO *bp, char *CAfile, char *CApath)
 170 {
 171         X509_STORE *store;
 172         X509_LOOKUP *lookup;
 173         if(!(store = X509_STORE_new())) goto end;
 174         lookup=X509_STORE_add_lookup(store,X509_LOOKUP_file());
 175         if (lookup == NULL) goto end;
 176         if (CAfile) {
 177                 if(!X509_LOOKUP_load_file(lookup,CAfile,X509_FILETYPE_PEM)) {
 178                         BIO_printf(bp, "Error loading file %s\n", CAfile);
 179                         goto end;
 180                 }
 181         } else X509_LOOKUP_load_file(lookup,NULL,X509_FILETYPE_DEFAULT);
 182
 183         lookup=X509_STORE_add_lookup(store,X509_LOOKUP_hash_dir());
 184         if (lookup == NULL) goto end;
 185         if (CApath) {
 186                 if(!X509_LOOKUP_add_dir(lookup,CApath,X509_FILETYPE_PEM)) {
 187                         BIO_printf(bp, "Error loading directory %s\n", CApath);
 188                         goto end;
 189                 }
 190         } else X509_LOOKUP_add_dir(lookup,NULL,X509_FILETYPE_DEFAULT);
 191
 192         ERR_clear_error();
 193         return store;
 194         end:
 195         X509_STORE_free(store);
 196         return NULL;
 197 }
 198
 199
 200 #ifndef DISABLE_OCSP
 201 static int
 202 tls_client_stapling_cb(SSL *s, void *arg)
 203 {
 204 const unsigned char *p;
 205 int len;
 206 OCSP_RESPONSE *rsp;
 207 OCSP_BASICRESP *bs;
 208 char *CAfile = NULL;
 209 X509_STORE *store = NULL;
 210 int ret = 1;
 211
 212 len = SSL_get_tlsext_status_ocsp_resp(s, &p);
 213 /*BIO_printf(arg, "OCSP response: ");*/
 214 if (!p)
 215         {
 216         BIO_printf(arg, "no response received\n");
 217         return 1;
 218         }
 219 if(!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
 220         {
 221         BIO_printf(arg, "response parse error\n");
 222         BIO_dump_indent(arg, (char *)p, len, 4);
 223         return 0;
 224         }
 225 if(!(bs = OCSP_response_get1_basic(rsp)))
 226   {
 227   BIO_printf(arg, "error parsing response\n");
 228   return 0;
 229   }
 230
 231 CAfile = ocsp_stapling;
 232 if(!(store = setup_verify(arg, CAfile, NULL)))
 233   {
 234   BIO_printf(arg, "error in cert setup\n");
 235   return 0;
 236   }
 237
 238 /* No file of alternate certs, no options */
 239 if(OCSP_basic_verify(bs, NULL, store, 0) <= 0)
 240   {
 241   BIO_printf(arg, "Response Verify Failure\n");
 242   ERR_print_errors(arg);
 243   ret = 0;
 244   }
 245 else
 246   BIO_printf(arg, "Response verify OK\n");
 247
 248 X509_STORE_free(store);
 249 return ret;
 250 }
 251 #endif
 252
 253
 254 /*************************************************
 255 *         Start an OpenSSL TLS session           *
 256 *************************************************/
 257
 258 int
 259 tls_start(int sock, SSL **ssl, SSL_CTX *ctx)
 260 {
 261 int rc;
 262 static const unsigned char *sid_ctx = US"exim";
 263
 264 RAND_load_file("client.c", -1);   /* Not *very* random! */
 265
 266 *ssl = SSL_new (ctx);
 267 SSL_set_session_id_context(*ssl, sid_ctx, strlen(CS sid_ctx));
 268 SSL_set_fd (*ssl, sock);
 269 SSL_set_connect_state(*ssl);
 270
 271 #ifndef DISABLE_OCSP
 272 if (ocsp_stapling)
 273   {
 274   SSL_CTX_set_tlsext_status_cb(ctx, tls_client_stapling_cb);
 275   SSL_CTX_set_tlsext_status_arg(ctx, BIO_new_fp(stdout, BIO_NOCLOSE));
 276   SSL_set_tlsext_status_type(*ssl, TLSEXT_STATUSTYPE_ocsp);
 277   }
 278 #endif
 279
 280 signal(SIGALRM, sigalrm_handler_flag);
 281 sigalrm_seen = 0;
 282 alarm(5);
 283 rc = SSL_connect (*ssl);
 284 alarm(0);
 285
 286 if (sigalrm_seen)
 287   {
 288   printf("SSL_connect timed out\n");
 289   return 0;
 290   }
 291
 292 if (rc <= 0)
 293   {
 294   ERR_print_errors_fp(stdout);
 295   return 0;
 296   }
 297
 298 printf("SSL connection using %s\n", SSL_get_cipher (*ssl));
 299 return 1;
 300 }
 301
 302
 303 /*************************************************
 304 *           SSL Information callback             *
 305 *************************************************/
 306
 307 static void
 308 info_callback(SSL *s, int where, int ret)
 309 {
 310 where = where;
 311 ret = ret;
 312 printf("SSL info: %s\n", SSL_state_string_long(s));
 313 }
 314 #endif
 315
 316
 317 /****************************************************************************/
 318 /****************************************************************************/
 319
 320
 321 #ifdef HAVE_GNUTLS
 322 /*************************************************
 323 *            Handle GnuTLS error                 *
 324 *************************************************/
 325
 326 /* Called from lots of places when errors occur before actually starting to do
 327 the TLS handshake, that is, while the session is still in clear.
 328
 329 Argument:
 330   prefix    prefix text
 331   err       a GnuTLS error number, or 0 if local error
 332
 333 Returns:    doesn't - it dies
 334 */
 335
 336 static void
 337 gnutls_error(uschar *prefix, int err)
 338 {
 339 fprintf(stderr, "GnuTLS connection error: %s:", prefix);
 340 if (err != 0) fprintf(stderr, " %s", gnutls_strerror(err));
 341 fprintf(stderr, "\n");
 342 exit(98);
 343 }
 344
 345
 346
 347 /*************************************************
 348 *             Setup up DH parameters             *
 349 *************************************************/
 350
 351 /* For the test suite, the parameters should always be available in the spool
 352 directory. */
 353
 354 static void
 355 init_dh(void)
 356 {
 357 int fd;
 358 int ret;
 359 gnutls_datum m;
 360 uschar filename[200];
 361 struct stat statbuf;
 362
 363 /* Initialize the data structures for holding the parameters */
 364
 365 ret = gnutls_dh_params_init(&dh_params);
 366 if (ret < 0) gnutls_error(US"init dh_params", ret);
 367
 368 /* Open the cache file for reading and if successful, read it and set up the
 369 parameters. */
 370
 371 fd = open("aux-fixed/gnutls-params", O_RDONLY, 0);
 372 if (fd < 0)
 373   {
 374   fprintf(stderr, "Failed to open spool/gnutls-params: %s\n", strerror(errno));
 375   exit(97);
 376   }
 377
 378 if (fstat(fd, &statbuf) < 0)
 379   {
 380   (void)close(fd);
 381   return gnutls_error(US"TLS cache stat failed", 0);
 382   }
 383
 384 m.size = statbuf.st_size;
 385 m.data = malloc(m.size);
 386 if (m.data == NULL)
 387   return gnutls_error(US"memory allocation failed", 0);
 388 if (read(fd, m.data, m.size) != m.size)
 389   return gnutls_error(US"TLS cache read failed", 0);
 390 (void)close(fd);
 391
 392 ret = gnutls_dh_params_import_pkcs3(dh_params, &m, GNUTLS_X509_FMT_PEM);
 393 if (ret < 0) return gnutls_error(US"DH params import", ret);
 394 free(m.data);
 395 }
 396
 397
 398
 399
 400 /*************************************************
 401 *            Initialize for GnuTLS               *
 402 *************************************************/
 403
 404 /*
 405 Arguments:
 406   certificate     certificate file
 407   privatekey      private key file
 408 */
 409
 410 static void
 411 tls_init(uschar *certificate, uschar *privatekey)
 412 {
 413 int rc;
 414
 415 rc = gnutls_global_init();
 416 if (rc < 0) gnutls_error(US"gnutls_global_init", rc);
 417
 418 /* Read D-H parameters from the cache file. */
 419
 420 init_dh();
 421
 422 /* Create the credentials structure */
 423
 424 rc = gnutls_certificate_allocate_credentials(&x509_cred);
 425 if (rc < 0) gnutls_error(US"certificate_allocate_credentials", rc);
 426
 427 /* Set the certificate and private keys */
 428
 429 if (certificate != NULL)
 430   {
 431   rc = gnutls_certificate_set_x509_key_file(x509_cred, CS certificate,
 432     CS privatekey, GNUTLS_X509_FMT_PEM);
 433   if (rc < 0) gnutls_error("gnutls_certificate", rc);
 434   }
 435
 436 /* Associate the parameters with the x509 credentials structure. */
 437
 438 gnutls_certificate_set_dh_params(x509_cred, dh_params);
 439
 440 /* set the CA info for server-cert verify */
 441 if (ocsp_stapling)
 442   gnutls_certificate_set_x509_trust_file(x509_cred, ocsp_stapling,
 443         GNUTLS_X509_FMT_PEM);
 444 }
 445
 446
 447
 448 /*************************************************
 449 *        Initialize a single GNUTLS session      *
 450 *************************************************/
 451
 452 static gnutls_session
 453 tls_session_init(void)
 454 {
 455 gnutls_session session;
 456
 457 gnutls_init(&session, GNUTLS_CLIENT | GNUTLS_NO_EXTENSIONS);
 458
 459 gnutls_cipher_set_priority(session, default_cipher_priority);
 460 gnutls_compression_set_priority(session, comp_priority);
 461 gnutls_kx_set_priority(session, kx_priority);
 462 gnutls_protocol_set_priority(session, protocol_priority);
 463 gnutls_mac_set_priority(session, mac_priority);
 464
 465 gnutls_cred_set(session, GNUTLS_CRD_CERTIFICATE, x509_cred);
 466
 467 gnutls_dh_set_prime_bits(session, DH_BITS);
 468 gnutls_db_set_cache_expiration(session, ssl_session_timeout);
 469
 470 return session;
 471 }
 472 #endif
 473
 474
 475 /****************************************************************************/
 476 /****************************************************************************/
 477
 478
 479
 480
 481 /*************************************************
 482 *                 Main Program                   *
 483 *************************************************/
 484
 485 const char * const HELP_MESSAGE = "\n\
 486 Usage: client\n"
 487 #ifdef HAVE_TLS
 488 "\
 489           [-tls-on-connect]\n\
 490           [-ocsp]\n"
 491 #endif
 492 "\
 493           [-tn] n seconds timeout\n\
 494           <IP address>\n\
 495           <port>\n\
 496           [<outgoing interface>]\n\
 497           [<cert file>]\n\
 498           [<key file>]\n\
 499 \n";
 500
 501 int main(int argc, char **argv)
 502 {
 503 struct sockaddr *s_ptr;
 504 struct sockaddr_in s_in4;
 505 char *interface = NULL;
 506 char *address = NULL;
 507 char *certfile = NULL;
 508 char *keyfile = NULL;
 509 char *end = NULL;
 510 int argi = 1;
 511 int host_af, port, s_len, rc, sock, save_errno;
 512 int timeout = 5;
 513 int tls_active = 0;
 514 int sent_starttls = 0;
 515 int tls_on_connect = 0;
 516 long tmplong;
 517
 518 #if HAVE_IPV6
 519 struct sockaddr_in6 s_in6;
 520 #endif
 521
 522 #ifdef HAVE_OPENSSL
 523 SSL_CTX* ctx;
 524 SSL*     ssl;
 525 #endif
 526
 527 unsigned char outbuffer[10240];
 528 unsigned char inbuffer[10240];
 529 unsigned char *inptr = inbuffer;
 530
 531 *inptr = 0;   /* Buffer empty */
 532
 533 /* Options */
 534
 535 while (argc >= argi + 1 && argv[argi][0] == '-')
 536   {
 537   if (strcmp(argv[argi], "-help") == 0 ||
 538       strcmp(argv[argi], "--help") == 0 ||
 539       strcmp(argv[argi], "-h") == 0)
 540     {
 541     puts(HELP_MESSAGE);
 542     exit(0);
 543     }
 544   if (strcmp(argv[argi], "-tls-on-connect") == 0)
 545     {
 546     tls_on_connect = 1;
 547     argi++;
 548     }
 549 #ifdef HAVE_TLS
 550   else if (strcmp(argv[argi], "-ocsp") == 0)
 551     {
 552     if (argc < ++argi + 1)
 553       {
 554       fprintf(stderr, "Missing required certificate file for ocsp option\n");
 555       exit(96);
 556       }
 557     ocsp_stapling = argv[argi++];
 558     }
 559
 560 #endif
 561   else if (argv[argi][1] == 't' && isdigit(argv[argi][2]))
 562     {
 563     tmplong = strtol(argv[argi]+2, &end, 10);
 564     if (end == argv[argi]+2 || *end)
 565       {
 566       fprintf(stderr, "Failed to parse seconds from option <%s>\n",
 567         argv[argi]);
 568       exit(95);
 569       }
 570     if (tmplong > 10000L)
 571       {
 572       fprintf(stderr, "Unreasonably long wait of %ld seconds requested\n",
 573         tmplong);
 574       exit(94);
 575       }
 576     if (tmplong < 0L)
 577       {
 578       fprintf(stderr, "Timeout must not be negative (%ld)\n", tmplong);
 579       exit(93);
 580       }
 581     timeout = (int) tmplong;
 582     argi++;
 583     }
 584   else
 585     {
 586     fprintf(stderr, "Unrecognized option %s\n", argv[argi]);
 587     exit(92);
 588     }
 589   }
 590
 591 /* Mandatory 1st arg is IP address */
 592
 593 if (argc < argi+1)
 594   {
 595   fprintf(stderr, "No IP address given\n");
 596   exit(91);
 597   }
 598
 599 address = argv[argi++];
 600 host_af = (strchr(address, ':') != NULL)? AF_INET6 : AF_INET;
 601
 602 /* Mandatory 2nd arg is port */
 603
 604 if (argc < argi+1)
 605   {
 606   fprintf(stderr, "No port number given\n");
 607   exit(90);
 608   }
 609
 610 port = atoi(argv[argi++]);
 611
 612 /* Optional next arg is interface */
 613
 614 if (argc > argi &&
 615   (isdigit((unsigned char)argv[argi][0]) || argv[argi][0] == ':'))
 616     interface = argv[argi++];
 617
 618 /* Any more arguments are the name of a certificate file and key file */
 619
 620 if (argc > argi) certfile = argv[argi++];
 621 if (argc > argi) keyfile = argv[argi++];
 622
 623
 624 #if HAVE_IPV6
 625 /* For an IPv6 address, use an IPv6 sockaddr structure. */
 626
 627 if (host_af == AF_INET6)
 628   {
 629   s_ptr = (struct sockaddr *)&s_in6;
 630   s_len = sizeof(s_in6);
 631   }
 632 else
 633 #endif
 634
 635 /* For an IPv4 address, use an IPv4 sockaddr structure,
 636 even on an IPv6 system. */
 637
 638   {
 639   s_ptr = (struct sockaddr *)&s_in4;
 640   s_len = sizeof(s_in4);
 641   }
 642
 643 printf("Connecting to %s port %d ... ", address, port);
 644
 645 sock = socket(host_af, SOCK_STREAM, 0);
 646 if (sock < 0)
 647   {
 648   printf("socket creation failed: %s\n", strerror(errno));
 649   exit(89);
 650   }
 651
 652 /* Bind to a specific interface if requested. On an IPv6 system, this has
 653 to be of the same family as the address we are calling. On an IPv4 system the
 654 test is redundant, but it keeps the code tidier. */
 655
 656 if (interface != NULL)
 657   {
 658   int interface_af = (strchr(interface, ':') != NULL)? AF_INET6 : AF_INET;
 659
 660   if (interface_af == host_af)
 661     {
 662     #if HAVE_IPV6
 663
 664     /* Set up for IPv6 binding */
 665
 666     if (host_af == AF_INET6)
 667       {
 668       memset(&s_in6, 0, sizeof(s_in6));
 669       s_in6.sin6_family = AF_INET6;
 670       s_in6.sin6_port = 0;
 671       if (inet_pton(AF_INET6, interface, &s_in6.sin6_addr) != 1)
 672         {
 673         printf("Unable to parse \"%s\"", interface);
 674         exit(88);
 675         }
 676       }
 677     else
 678     #endif
 679
 680     /* Set up for IPv4 binding */
 681
 682       {
 683       memset(&s_in4, 0, sizeof(s_in4));
 684       s_in4.sin_family = AF_INET;
 685       s_in4.sin_port = 0;
 686       s_in4.sin_addr.s_addr = (S_ADDR_TYPE)inet_addr(interface);
 687       }
 688
 689     /* Bind */
 690
 691     if (bind(sock, s_ptr, s_len) < 0)
 692       {
 693       printf("Unable to bind outgoing SMTP call to %s: %s",
 694         interface, strerror(errno));
 695       exit(87);
 696       }
 697     }
 698   }
 699
 700 /* Set up a remote IPv6 address */
 701
 702 #if HAVE_IPV6
 703 if (host_af == AF_INET6)
 704   {
 705   memset(&s_in6, 0, sizeof(s_in6));
 706   s_in6.sin6_family = AF_INET6;
 707   s_in6.sin6_port = htons(port);
 708   if (inet_pton(host_af, address, &s_in6.sin6_addr) != 1)
 709     {
 710     printf("Unable to parse \"%s\"", address);
 711     exit(86);
 712     }
 713   }
 714 else
 715 #endif
 716
 717 /* Set up a remote IPv4 address */
 718
 719   {
 720   memset(&s_in4, 0, sizeof(s_in4));
 721   s_in4.sin_family = AF_INET;
 722   s_in4.sin_port = htons(port);
 723   s_in4.sin_addr.s_addr = (S_ADDR_TYPE)inet_addr(address);
 724   }
 725
 726 /* SIGALRM handler crashes out */
 727
 728 signal(SIGALRM, sigalrm_handler_crash);
 729 alarm(timeout);
 730 rc = connect(sock, s_ptr, s_len);
 731 save_errno = errno;
 732 alarm(0);
 733
 734 /* A failure whose error code is "Interrupted system call" is in fact
 735 an externally applied timeout if the signal handler has been run. */
 736
 737 if (rc < 0)
 738   {
 739   close(sock);
 740   printf("connect failed: %s\n", strerror(save_errno));
 741   exit(85);
 742   }
 743
 744 printf("connected\n");
 745
 746
 747 /* --------------- Set up for OpenSSL --------------- */
 748
 749 #ifdef HAVE_OPENSSL
 750 SSL_library_init();
 751 SSL_load_error_strings();
 752
 753 ctx = SSL_CTX_new(SSLv23_method());
 754 if (ctx == NULL)
 755   {
 756   printf ("SSL_CTX_new failed\n");
 757   exit(84);
 758   }
 759
 760 if (certfile != NULL)
 761   {
 762   if (!SSL_CTX_use_certificate_file(ctx, certfile, SSL_FILETYPE_PEM))
 763     {
 764     printf("SSL_CTX_use_certificate_file failed\n");
 765     exit(83);
 766     }
 767   printf("Certificate file = %s\n", certfile);
 768   }
 769
 770 if (keyfile != NULL)
 771   {
 772   if (!SSL_CTX_use_PrivateKey_file(ctx, keyfile, SSL_FILETYPE_PEM))
 773     {
 774     printf("SSL_CTX_use_PrivateKey_file failed\n");
 775     exit(82);
 776     }
 777   printf("Key file = %s\n", keyfile);
 778   }
 779
 780 SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_BOTH);
 781 SSL_CTX_set_timeout(ctx, 200);
 782 SSL_CTX_set_info_callback(ctx, (void (*)())info_callback);
 783 #endif
 784
 785
 786 /* --------------- Set up for GnuTLS --------------- */
 787
 788 #ifdef HAVE_GNUTLS
 789 if (certfile != NULL) printf("Certificate file = %s\n", certfile);
 790 if (keyfile != NULL) printf("Key file = %s\n", keyfile);
 791 tls_init(certfile, keyfile);
 792 tls_session = tls_session_init();
 793 #ifdef HAVE_OCSP
 794 if (ocsp_stapling)
 795   gnutls_ocsp_status_request_enable_client(tls_session, NULL, 0, NULL);
 796 #endif
 797 gnutls_transport_set_ptr(tls_session, (gnutls_transport_ptr)sock);
 798
 799 /* When the server asks for a certificate and the client does not have one,
 800 there is a SIGPIPE error in the gnutls_handshake() function for some reason
 801 that is not understood. As luck would have it, this has never hit Exim itself
 802 because it ignores SIGPIPE errors. Doing the same here allows it all to work as
 803 one wants. */
 804
 805 signal(SIGPIPE, SIG_IGN);
 806 #endif
 807
 808 /* ---------------------------------------------- */
 809
 810
 811 /* Start TLS session if configured to do so without STARTTLS */
 812
 813 #ifdef HAVE_TLS
 814 if (tls_on_connect)
 815   {
 816   printf("Attempting to start TLS\n");
 817
 818   #ifdef HAVE_OPENSSL
 819   tls_active = tls_start(sock, &ssl, ctx);
 820   #endif
 821
 822   #ifdef HAVE_GNUTLS
 823   sigalrm_seen = FALSE;
 824   alarm(timeout);
 825   tls_active = gnutls_handshake(tls_session) >= 0;
 826   alarm(0);
 827   #endif
 828
 829   if (!tls_active)
 830     printf("Failed to start TLS\n");
 831   #if defined(HAVE_GNUTLS) && defined(HAVE_OCSP)
 832   else if (  ocsp_stapling
 833           && gnutls_ocsp_status_request_is_checked(tls_session, 0) == 0)
 834     printf("Failed to verify certificate status\n");
 835   #endif
 836   else
 837     printf("Succeeded in starting TLS\n");
 838   }
 839 #endif
 840
 841 while (fgets(CS outbuffer, sizeof(outbuffer), stdin) != NULL)
 842   {
 843   int n = (int)strlen(CS outbuffer);
 844   while (n > 0 && isspace(outbuffer[n-1])) n--;
 845   outbuffer[n] = 0;
 846
 847   /* Expect incoming */
 848
 849   if (strncmp(CS outbuffer, "??? ", 4) == 0)
 850     {
 851     unsigned char *lineptr;
 852     printf("%s\n", outbuffer);
 853
 854     if (*inptr == 0)   /* Refill input buffer */
 855       {
 856       if (tls_active)
 857         {
 858         #ifdef HAVE_OPENSSL
 859         rc = SSL_read (ssl, inbuffer, sizeof(inbuffer) - 1);
 860         #endif
 861         #ifdef HAVE_GNUTLS
 862         rc = gnutls_record_recv(tls_session, CS inbuffer, sizeof(inbuffer) - 1);
 863         #endif
 864         }
 865       else
 866         {
 867         alarm(timeout);
 868         rc = read(sock, inbuffer, sizeof(inbuffer));
 869         alarm(0);
 870         }
 871
 872       if (rc < 0)
 873         {
 874         printf("Read error %s\n", strerror(errno));
 875         exit(81)  ;
 876         }
 877       else if (rc == 0)
 878         {
 879         printf("Unexpected EOF read\n");
 880         close(sock);
 881         exit(80);
 882         }
 883       else
 884         {
 885         inbuffer[rc] = 0;
 886         inptr = inbuffer;
 887         }
 888       }
 889
 890     lineptr = inptr;
 891     while (*inptr != 0 && *inptr != '\r' && *inptr != '\n') inptr++;
 892     if (*inptr != 0)
 893       {
 894       *inptr++ = 0;
 895       if (*inptr == '\n') inptr++;
 896       }
 897
 898     printf("<<< %s\n", lineptr);
 899     if (strncmp(CS lineptr, CS outbuffer + 4, (int)strlen(CS outbuffer) - 4) != 0)
 900       {
 901       printf("\n******** Input mismatch ********\n");
 902       exit(79);
 903       }
 904
 905     #ifdef HAVE_TLS
 906     if (sent_starttls)
 907       {
 908       if (lineptr[0] == '2')
 909         {
 910 int rc;
 911         unsigned int verify;
 912
 913         printf("Attempting to start TLS\n");
 914         fflush(stdout);
 915
 916         #ifdef HAVE_OPENSSL
 917         tls_active = tls_start(sock, &ssl, ctx);
 918         #endif
 919
 920         #ifdef HAVE_GNUTLS
 921         sigalrm_seen = FALSE;
 922         alarm(timeout);
 923         tls_active = gnutls_handshake(tls_session) >= 0;
 924         alarm(0);
 925         #endif
 926
 927         if (!tls_active)
 928           {
 929           printf("Failed to start TLS\n");
 930           fflush(stdout);
 931           }
 932         #ifdef HAVE_GNUTLS
 933         else if (ocsp_stapling)
 934           {
 935           if ((rc= gnutls_certificate_verify_peers2(tls_session, &verify)) < 0)
 936             {
 937             printf("Failed to verify certificate: %s\n", gnutls_strerror(rc));
 938             fflush(stdout);
 939             }
 940           else if (verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED))
 941             {
 942             printf("Bad certificate\n");
 943             fflush(stdout);
 944             }
 945           #ifdef HAVE_OCSP
 946           else if (gnutls_ocsp_status_request_is_checked(tls_session, 0) == 0)
 947             {
 948             printf("Failed to verify certificate status\n");
 949               {
 950               gnutls_datum_t stapling;
 951               gnutls_ocsp_resp_t resp;
 952               gnutls_datum_t printed;
 953               if (  (rc= gnutls_ocsp_status_request_get(tls_session, &stapling)) == 0
 954                  && (rc= gnutls_ocsp_resp_init(&resp)) == 0
 955                  && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
 956                  && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_FULL, &printed)) == 0
 957                  )
 958                 {
 959                 fprintf(stderr, "%.4096s", printed.data);
 960                 gnutls_free(printed.data);
 961                 }
 962               else
 963                 (void) fprintf(stderr,"ocsp decode: %s", gnutls_strerror(rc));
 964               }
 965             fflush(stdout);
 966             }
 967           #endif
 968           }
 969         #endif
 970         else
 971           printf("Succeeded in starting TLS\n");
 972         }
 973       else printf("Abandoning TLS start attempt\n");
 974       }
 975     sent_starttls = 0;
 976     #endif
 977     }
 978
 979   /* Wait for a bit before proceeding */
 980
 981   else if (strncmp(CS outbuffer, "+++ ", 4) == 0)
 982     {
 983     printf("%s\n", outbuffer);
 984     sleep(atoi(CS outbuffer + 4));
 985     }
 986
 987   /* Send outgoing, but barf if unconsumed incoming */
 988
 989   else
 990     {
 991     unsigned char *escape;
 992
 993     if (*inptr != 0)
 994       {
 995       printf("Unconsumed input: %s", inptr);
 996       printf("   About to send: %s\n", outbuffer);
 997       exit(78);
 998       }
 999
1000     #ifdef HAVE_TLS
1001
1002     /* Shutdown TLS */
1003
1004     if (strcmp(CS outbuffer, "stoptls") == 0 ||
1005         strcmp(CS outbuffer, "STOPTLS") == 0)
1006       {
1007       if (!tls_active)
1008         {
1009         printf("STOPTLS read when TLS not active\n");
1010         exit(77);
1011         }
1012       printf("Shutting down TLS encryption\n");
1013
1014       #ifdef HAVE_OPENSSL
1015       SSL_shutdown(ssl);
1016       SSL_free(ssl);
1017       #endif
1018
1019       #ifdef HAVE_GNUTLS
1020       gnutls_bye(tls_session, GNUTLS_SHUT_WR);
1021       gnutls_deinit(tls_session);
1022       tls_session = NULL;
1023       gnutls_global_deinit();
1024       #endif
1025
1026       tls_active = 0;
1027       continue;
1028       }
1029
1030     /* Remember that we sent STARTTLS */
1031
1032     sent_starttls = (strcmp(CS outbuffer, "starttls") == 0 ||
1033                      strcmp(CS outbuffer, "STARTTLS") == 0);
1034
1035     /* Fudge: if the command is "starttls_wait", we send the starttls bit,
1036     but we haven't set the flag, so that there is no negotiation. This is for
1037     testing the server's timeout. */
1038
1039     if (strcmp(CS outbuffer, "starttls_wait") == 0)
1040       {
1041       outbuffer[8] = 0;
1042       n = 8;
1043       }
1044     #endif
1045
1046     printf(">>> %s\n", outbuffer);
1047     strcpy(CS outbuffer + n, "\r\n");
1048
1049     /* Turn "\n" and "\r" into the relevant characters. This is a hack. */
1050
1051     while ((escape = US strstr(CS outbuffer, "\\r")) != NULL)
1052       {
1053       *escape = '\r';
1054       memmove(escape + 1, escape + 2,  (n + 2) - (escape - outbuffer) - 2);
1055       n--;
1056       }
1057
1058     while ((escape = US strstr(CS outbuffer, "\\n")) != NULL)
1059       {
1060       *escape = '\n';
1061       memmove(escape + 1, escape + 2,  (n + 2) - (escape - outbuffer) - 2);
1062       n--;
1063       }
1064
1065     /* OK, do it */
1066
1067     alarm(timeout);
1068     if (tls_active)
1069       {
1070       #ifdef HAVE_OPENSSL
1071         rc = SSL_write (ssl, outbuffer, n + 2);
1072       #endif
1073       #ifdef HAVE_GNUTLS
1074         rc = gnutls_record_send(tls_session, CS outbuffer, n + 2);
1075         if (rc < 0)
1076           {
1077           printf("GnuTLS write error: %s\n", gnutls_strerror(rc));
1078           exit(76);
1079           }
1080       #endif
1081       }
1082     else
1083       {
1084       rc = write(sock, outbuffer, n + 2);
1085       }
1086     alarm(0);
1087
1088     if (rc < 0)
1089       {
1090       printf("Write error: %s\n", strerror(errno));
1091       exit(75);
1092       }
1093     }
1094   }
1095
1096 printf("End of script\n");
1097 close(sock);
1098
1099 exit(0);
1100 }
1101
1102 /* End of client.c */