wdvi

http.c (11362B)

---

 /*
  * Copyright (c) 2020 Kyle Milz <krwmilz@gmail.com>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
 #include <sys/types.h>		/* getaddrinfo() */
 #include <sys/socket.h>		/* connect(), socket() */
 
 #include <netdb.h>		/* getaddrinfo() */
 
 #include <assert.h>
 #include <err.h>		/* err() */
 #include <string.h>		/* strtok(), strsep(), strstr() */
 #include <unistd.h>		/* close() */
 
 #include <openssl/err.h>	/* ERR_load_crypto_strings() */
 #include <openssl/evp.h>	/* OpenSSL_add_all_algorithms() */
 #include <openssl/ssl.h>	/* SSL_read(), SSL_write() */
 
 #include "http.h"
 #include "popups.h"		/* warning_popup_long() */
 #include "util.h"		/* xmalloc() */
 
 #define SSL_BUF_SIZE		16 * 1024
 #define HTTP_DELIM		"\r\n"
 
 
 struct http_headers {
 	char		ver[15];	/* Should be enough, RFC2616 3.1 */
 	int		stat;		/* 200, 404, etc */
 	char		stat_text[32];	/* 416 may be the longest? */
 	unsigned int	cont_len;	/* Content-Length: */
 };
 
 
 /*
  * Takes a struct url and finds all addresses related to url->hostname.
  * Then tries connecting to each of them, returning a connected socket on
  * success.
  *
  * Returns -1 on failure.
  */
 static int
 xconnect(struct url *url)
 {
 	struct addrinfo hints, *res, *res0;
 	int error;
 	int save_errno;
 	int s;
 	const char *cause = NULL;
 
 	memset(&hints, 0, sizeof(hints));
 	hints.ai_family = AF_UNSPEC;
 	hints.ai_socktype = SOCK_STREAM;
 
 	error = getaddrinfo(url->hostname, url->port, &hints, &res0);
 	if (error) {
 		warning_popup_long("%s: %s", "OK", NULL, url->hostname,
 			gai_strerror(error));
 		return -1;
 	}
 
 	s = -1;
 	for (res = res0; res; res = res->ai_next) {
 		s = socket(res->ai_family, res->ai_socktype, res->ai_protocol);
 		if (s == -1) {
 			cause = "socket";
 			continue;
 		}
 
 		if (connect(s, res->ai_addr, res->ai_addrlen) == -1) {
 			cause = "connect";
 			save_errno = errno;
 			close(s);
 			errno = save_errno;
 			s = -1;
 			continue;
 		}
 
 		/* connect() succeeded */
 		break;
 	}
 
 	freeaddrinfo(res0);
 
 	if (s == -1) {
 		warning_popup_long("%s %s: %s\n", "OK", NULL,
 			cause, url->hostname, strerror(errno));
 		return -1;
 	}
 
 	return s;
 }
 
 
 /*
  * Map some SSL error codes to real messages. This should exist somewhere
  * already?
  *
  * Returns a message and never fails.
  */
 static const char *
 SSL_strerror(const SSL *tls, int ret)
 {
 	switch (SSL_get_error(tls, ret)) {
 	case SSL_ERROR_NONE:
 		return "No error";
 	case SSL_ERROR_ZERO_RETURN:
 		return "TLS connection has been closed";
 	case SSL_ERROR_WANT_READ:
 	case SSL_ERROR_WANT_WRITE:
 	case SSL_ERROR_WANT_CONNECT:
 	case SSL_ERROR_WANT_ACCEPT:
 	case SSL_ERROR_WANT_X509_LOOKUP:
 		return "TLS operation did not complete";
 	case SSL_ERROR_SYSCALL:
 		return "I/O error occurred";
 	case SSL_ERROR_SSL:
 		return "Failure in SSL library";
 	}
 
 	return "Unknown TLS error";
 }
 
 
 /*
  * Connect to the host using TLS.
  *
  * Returns an SSL pointer on success or NULL on failure.
  */
 static SSL *
 tls_connect(int server, struct url *url)
 {
 	const SSL_METHOD	*method;
 	SSL_CTX			*ctx;
 	SSL			*tls;
 	X509			*cert = NULL;
 	unsigned int		 ret, fprint_size;
 	const EVP_MD		*fprint_type;
 	unsigned char		 fprint[EVP_MAX_MD_SIZE];
 	EVP_PKEY		*pkey = NULL;
 
 	/* According to LibreSSL manual pages none of these are necessary. */
 	OpenSSL_add_all_algorithms();
 	ERR_load_BIO_strings();
 	ERR_load_crypto_strings();
 	SSL_load_error_strings();
 
 	/* Not needed for newer (> 1.1.0) library versions? */
 	assert(SSL_library_init() == 1);
 
 	method = TLS_client_method();
 	if ((ctx = SSL_CTX_new(method)) == NULL)
 		errx(1, "Unable to create new SSL context structure.\n");
 	if ((tls = SSL_new(ctx)) == NULL)
 		errx(1, "Unable to create new SSL structure.\n");
 
 	SSL_set_fd(tls, server);
 	if ((ret = SSL_connect(tls)) != 1) {
 		warning_popup_long("%s:%s: Cannot make TLS connection",
 		                   "OK", NULL, url->hostname, url->port);
 
 		/* Print SSL_strerror(tls, ret)); too? */
 		return NULL;
 	}
 
 	if ((cert = SSL_get_peer_certificate(tls)) == NULL) {
 		warning_popup_long("%s:%s: No TLS certificate was presented by peer",
 		                   "OK", NULL, url->hostname, url->port);
 		return NULL;
 	}
 
 #ifdef notyet
 	X509_NAME		*certname = NULL;
 	certname = X509_NAME_new();
 	certname = X509_get_subject_name(cert);
 
 	BIO outbio = BIO_new_fp(stdout, BIO_NOCLOSE);
 	BIO_printf(outbio, "Certificate subject data: ");
 	X509_NAME_print_ex(outbio, certname, 0, 0);
 	BIO_printf(outbio, "\n");
 #endif
 
 	/* Calculate certificate fingerprint. */
 	fprint_type = EVP_sha256();
 
 	if (!X509_digest(cert, fprint_type, fprint, &fprint_size)) {
 		warning_popup_long("%s:%s: Cannot create TLS certificate fingerprint",
 		              "OK", NULL, url->hostname, url->port);
 		return NULL;
 	}
 
 #ifdef notyet
 	BIO_printf(outbio, "Fingerprint (method = %s, size = %d): ",
 		OBJ_nid2sn(EVP_MD_type(fprint_type)), fprint_size);
 
 	for (int j = 0; j < fprint_size; j++) {
 		BIO_printf(outbio, "%02X%c", fprint[j],
 			(j + 1 == fprint_size) ? '\n' : ':');
 	}
 	BIO_printf(outbio, "\n");
 #endif
 
 	/* Get certificate public key. */
 	if ((pkey = X509_get_pubkey(cert)) == NULL) {
 		warning_popup_long("%s:%s: No public key in certificate.",
 		              "OK", NULL, url->hostname, url->port);
 		return NULL;
 	}
 #ifdef notyet
 	PEM_write_bio_PUBKEY(outbio, pkey);
 	BIO_free_all(outbio);
 #endif
 
 	X509_free(cert);
 
 	return tls;
 }
 
 
 /*
  * Creates an HTTP GET request and writes it to tls.
  * Returns 0 on success and -1 on failure.
  */
 static int
 send_request(SSL *tls, struct url *url)
 {
 	const char	*req_fmt;
 	char		*req;
 	int	 	 ret;
 
 	/* RFC7230 3.1.1 */
 	req_fmt = "GET /%s HTTP/1.1" HTTP_DELIM
 	          "Host: %s" HTTP_DELIM
 	          HTTP_DELIM;
 
 	if (asprintf(&req, req_fmt, url->document, url->hostname) == -1)
 		err(1, "asprintf");
 
 	if ((ret = SSL_write(tls, req, strlen(req))) < 1) {
 		warning_popup_long("%s: %s", "OK", NULL, url->hostname,
 		                   SSL_strerror(tls, ret));
 		free(req);
 		return -1;
 	}
 
 	free(req);
 	return 0;
 }
 
 
 /*
  * Parse a buffer that supposedly contains HTTP headers.
  *
  * On success:
  * - *hdr_len contains the length of the header found in hdr
  * - return a pointer to an allocated struct http_headers that the caller
  *   must free
  *
  * Return NULL on failure.
  */
 static struct http_headers *
 parse_headers(char *hdr, int *hdr_len)
 {
 	struct http_headers	*res;
 	char			*hdr_end;
 	char			*line;
 
 	if ((hdr_end = strstr(hdr, HTTP_DELIM HTTP_DELIM)) == NULL)
 		return NULL;
 	*hdr_len = hdr_end - hdr + strlen(HTTP_DELIM HTTP_DELIM);
 
 	if ((res = calloc(1, sizeof(struct http_headers))) == NULL)
 		err(1, NULL);
 
 	/* Let our string processing functions below know when they're done */
 	*(hdr_end + strlen(HTTP_DELIM)) = '\0';
 
 	if ((line = strtok(hdr, HTTP_DELIM)) == NULL)
 		goto free_res;
 
 	/* Status line of response is 'HTTP/1.1 200 OK' for example. */
 	if (sscanf(line, "%15s %i %31[^\n]", res->ver, &res->stat,
 	    res->stat_text) != 3)
 		goto free_res;
 
 	/* We only care about Content-Length right now. */
 	while ((line = strtok(NULL, HTTP_DELIM)) != NULL)
 		sscanf(line, "Content-Length: %u", &res->cont_len);
 
 	return res;
 
 free_res:
 	free(res);
 	return NULL;
 }
 
 
 /*
  * Read tls for the response sent by the server after url was requested.
  * The read is split in two parts:
  * 1) the first gets the header, parses it and sizes recieve buffers
  * 2) read at max Content-Length: into the receive buffers
  * 
  * Returns a FILE* containing the response body on success or NULL on failure.
  */
 static FILE *
 read_response(SSL *tls, struct url *url)
 {
 	char		*buf;
 	struct http_headers *resp;
 	int		 nbytes;
 	int		 bytes_left;
 	int		 hdr_len;
 	FILE		*dvi = NULL;
 
 	if ((buf = calloc(1, SSL_BUF_SIZE)) == NULL)
 		err(1, "calloc");
 
 	/*
 	 * The first read should yield AT LEAST the HTTP header. The following
 	 * code does not handle the case where it does not.
 	 */
 	if ((nbytes = SSL_read(tls, buf, SSL_BUF_SIZE)) < 1) {
 		warning_popup_long("SSL_read: %s: %s", "OK", NULL,
 		                   url->hostname, SSL_strerror(tls, nbytes));
 		goto free_buf;
 	}
 
 	if ((resp = parse_headers(buf, &hdr_len)) == NULL) {
 		warning_popup_long("%s: Malformed HTTP header", "OK", NULL,
 		                   url->hostname);
 		goto free_buf;
 	}
 
 	/*
 	 * Do not handle anything other than 200. We must have
 	 * Content-Length: as well.
 	 */
 	if (resp->stat != 200) {
 		warning_popup_long("%s: %i %s", "OK", NULL, url->orig_url,
 		    resp->stat, resp->stat_text);
 		goto free_resp;
 	}
 	else if (resp->cont_len < 1) {
 		warning_popup_long("%s: Content-Length invalid", "OK", NULL,
 		    url->orig_url);
 		goto free_resp;
 	}
 
 	/*
 	 * XDvi is set up to do all its processing on FILE's, so we use that
 	 * here to minimize changes over there.
 	 */
 	if ((dvi = fmemopen(NULL, resp->cont_len, "r+")) == NULL)
 		err(1, "fmemopen");
 
 	/* Write out any remaining data in buf from the first SSL_read(). */
 	if (hdr_len < nbytes) {
 		bytes_left = nbytes - hdr_len;
 
 		/* Check for buffer overflow. */
 		if (bytes_left > resp->cont_len) {
 			warnx("truncating extra http data");
 			bytes_left = resp->cont_len;
 		}
 
 		if (fwrite(buf + hdr_len, bytes_left, 1, dvi) < 1)
 			err(1, "fwrite");
 	}
 
 	/* Second (or more) reads are the HTTP response body. */
 	while (ftell(dvi) < resp->cont_len) {
 		if ((nbytes = SSL_read(tls, buf, SSL_BUF_SIZE)) < 1) {
 			warning_popup_long("SSL_read: %s: %s", "OK", NULL,
 				url->hostname, SSL_strerror(tls, nbytes));
 			fclose(dvi);
 			dvi = NULL;
 			goto free_resp;
 		}
 
 		/* Check for buffer overflow. */
 		if (ftell(dvi) + nbytes > resp->cont_len) {
 			warnx("truncating extra http data");
 			nbytes = resp->cont_len - ftell(dvi);
 		}
 
 		if (fwrite(buf, nbytes, 1, dvi) < 1)
 			err(1, "fwrite");
 	}
 
 	if (ftell(dvi) != resp->cont_len)
 		warning_popup_long("HTTP body len: expected %i but read %i\n",
 		                   "OK", NULL, resp->cont_len, ftell(dvi));
 
 	if (fseek(dvi, 0L, SEEK_SET) < 0)
 		err(1, "fseek");
 
 free_resp:
 	free(resp);
 free_buf:
 	free(buf);
 
 	return dvi;
 }
 
 
 /*
  * Parses the url, resolves and connects to the host, creates a tls
  * connection to the host, sends an HTTP GET request then reads the
  * response.
  *
  * Returns a FILE* buffer containing a DVI file on success, or NULL on
  * failure.
  */
 FILE *
 http_get(const char dest_url[])
 {
 	struct url	*url;
 	int		 server;
 	SSL		*tls;
 	FILE		*dvi = NULL;
 
 	if ((url = parse_url(dest_url)) == NULL)
 		return NULL;
 
 	if ((server = xconnect(url)) < 0)
 		goto free_url;
 
 	if ((tls = tls_connect(server, url)) == NULL)
 		goto free_server;
 
 	if (send_request(tls, url) != 0)
 		goto free_tls;
 
 	if ((dvi = read_response(tls, url)) == NULL)
 		goto free_tls;
 
 free_tls:
 	SSL_CTX_free(SSL_get_SSL_CTX(tls));
 	SSL_free(tls);
 free_server:
 	close(server);
 free_url:
 	free(url);
 
 	return dvi;
 }