TDE
/
tdelibs
mirror of https://mirror.git.trinitydesktop.org/gitea/TDE/tdelibs
0
0
Fork 0
Code Issues Releases Wiki Activity
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '5551f81376'
${ noResults }
tdelibs/tdeio/tdeio/tcpslavebase.cpp

1356 lines
40 KiB
Raw Blame History

/*
* $Id$
*
* Copyright (C) 2000 Alex Zepeda <zipzippy@sonic.net
* Copyright (C) 2001-2003 George Staikos <staikos@kde.org>
* Copyright (C) 2001 Dawit Alemayehu <adawit@kde.org>
*
* This file is part of the KDE project
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Library General Public
* License as published by the Free Software Foundation; either
* version 2 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Library General Public License for more details.
*
* You should have received a copy of the GNU Library General Public License
* along with this library; see the file COPYING.LIB. If not, write to
* the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
* Boston, MA 02110-1301, USA.
*/
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
#include <sys/types.h>
#include <sys/uio.h>
#include <sys/time.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <time.h>
#include <netdb.h>
#include <unistd.h>
#include <errno.h>
#include <ksocks.h>
#include <kdebug.h>
#include <ksslall.h>
#include <ksslcertdlg.h>
#include <tdemessagebox.h>
#ifndef Q_WS_WIN //temporary
#include <kresolver.h>
#endif
#include <tdelocale.h>
#include <dcopclient.h>
#include <tqcstring.h>
#include <tqdatastream.h>
#include <tdeapplication.h>
#include <tdeprotocolmanager.h>
#include <kde_file.h>
#include "tdeio/tcpslavebase.h"
using namespace TDEIO;
class TCPSlaveBase::TcpSlaveBasePrivate
{
public:
TcpSlaveBasePrivate() : rblockSz(256), militantSSL(false), userAborted(false) {}
~TcpSlaveBasePrivate() {}
KSSL *kssl;
bool usingTLS;
KSSLCertificateCache *cc;
TQString host;
TQString realHost;
TQString ip;
DCOPClient *dcc;
KSSLPKCS12 *pkcs;
int status;
int timeout;
int rblockSz; // Size for reading blocks in readLine()
bool block;
bool useSSLTunneling;
bool needSSLHandShake;
bool militantSSL; // If true, we just drop a connection silently
// if SSL certificate check fails in any way.
bool userAborted;
MetaData savedMetaData;
};
TCPSlaveBase::TCPSlaveBase(unsigned short int defaultPort,
const TQCString &protocol,
const TQCString &poolSocket,
const TQCString &appSocket)
:SlaveBase (protocol, poolSocket, appSocket),
m_iSock(-1),
m_iDefaultPort(defaultPort),
m_sServiceName(protocol),
fp(0)
{
// We have to have two constructors, so don't add anything
// else in here. Put it in doConstructorStuff() instead.
doConstructorStuff();
m_bIsSSL = false;
}
TCPSlaveBase::TCPSlaveBase(unsigned short int defaultPort,
const TQCString &protocol,
const TQCString &poolSocket,
const TQCString &appSocket,
bool useSSL)
:SlaveBase (protocol, poolSocket, appSocket),
m_iSock(-1),
m_bIsSSL(useSSL),
m_iDefaultPort(defaultPort),
m_sServiceName(protocol),
fp(0)
{
doConstructorStuff();
if (useSSL)
m_bIsSSL = initializeSSL();
}
// The constructor procedures go here now.
void TCPSlaveBase::doConstructorStuff()
{
d = new TcpSlaveBasePrivate;
d->kssl = 0L;
d->ip = "";
d->cc = 0L;
d->usingTLS = false;
d->dcc = 0L;
d->pkcs = 0L;
d->status = -1;
d->timeout = KProtocolManager::connectTimeout();
d->block = false;
d->useSSLTunneling = false;
}
TCPSlaveBase::~TCPSlaveBase()
{
cleanSSL();
if (d->usingTLS) delete d->kssl;
if (d->dcc) delete d->dcc;
if (d->pkcs) delete d->pkcs;
delete d;
}
ssize_t TCPSlaveBase::write(const void *data, ssize_t len)
{
#ifdef Q_OS_UNIX
if ( (m_bIsSSL || d->usingTLS) && !d->useSSLTunneling )
{
if ( d->needSSLHandShake )
(void) doSSLHandShake( true );
return d->kssl->write(data, len);
}
return KSocks::self()->write(m_iSock, data, len);
#else
return 0;
#endif
}
ssize_t TCPSlaveBase::read(void *data, ssize_t len)
{
#ifdef Q_OS_UNIX
if ( (m_bIsSSL || d->usingTLS) && !d->useSSLTunneling )
{
if ( d->needSSLHandShake )
(void) doSSLHandShake( true );
return d->kssl->read(data, len);
}
return KSocks::self()->read(m_iSock, data, len);
#else
return 0;
#endif
}
void TCPSlaveBase::setBlockSize(int sz)
{
if (sz <= 0)
sz = 1;
d->rblockSz = sz;
}
ssize_t TCPSlaveBase::readLine(char *data, ssize_t len)
{
// Optimization:
// It's small, but it probably results in a gain on very high
// speed connections. I moved 3 if statements out of the while loop
// so that the while loop is as small as possible. (GS)
// let's not segfault!
if (!data)
return -1;
char tmpbuf[1024]; // 1kb temporary buffer for peeking
*data = 0;
ssize_t clen = 0;
char *buf = data;
int rc = 0;
if ((m_bIsSSL || d->usingTLS) && !d->useSSLTunneling) { // SSL CASE
if ( d->needSSLHandShake )
(void) doSSLHandShake( true );
while (clen < len-1) {
rc = d->kssl->pending();
if (rc > 0) { // Read a chunk
int bytes = rc;
if (bytes > d->rblockSz)
bytes = d->rblockSz;
rc = d->kssl->peek(tmpbuf, bytes);
if (rc <= 0) {
// FIXME: this doesn't cover rc == 0 case
return -1;
}
bytes = rc; // in case it contains no \n
for (int i = 0; i < rc; i++) {
if (tmpbuf[i] == '\n') {
bytes = i+1;
break;
}
}
if (bytes+clen >= len) // don't read too much!
bytes = len - clen - 1;
rc = d->kssl->read(buf, bytes);
if (rc > 0) {
clen += rc;
buf += (rc-1);
if (*buf++ == '\n')
break;
} else {
// FIXME: different case if rc == 0;
return -1;
}
} else { // Read a byte
rc = d->kssl->read(buf, 1);
if (rc <= 0) {
return -1;
// hm rc = 0 then
// SSL_read says to call SSL_get_error to see if
// this was an error. FIXME
} else {
clen++;
if (*buf++ == '\n')
break;
}
}
}
} else { // NON SSL CASE
while (clen < len-1) {
#ifdef Q_OS_UNIX
rc = KSocks::self()->read(m_iSock, buf, 1);
#else
rc = 0;
#endif
if (rc <= 0) {
// FIXME: this doesn't cover rc == 0 case
return -1;
} else {
clen++;
if (*buf++ == '\n')
break;
}
}
}
// Both cases fall through to here
*buf = 0;
return clen;
}
unsigned short int TCPSlaveBase::port(unsigned short int _p)
{
unsigned short int p = _p;
if (_p <= 0)
{
p = m_iDefaultPort;
}
return p;
}
// This function is simply a wrapper to establish the connection
// to the server. It's a bit more complicated than ::connect
// because we first have to check to see if the user specified
// a port, and if so use it, otherwise we check to see if there
// is a port specified in /etc/services, and if so use that
// otherwise as a last resort use the supplied default port.
bool TCPSlaveBase::connectToHost( const TQString &host,
unsigned int _port,
bool sendError )
{
#ifdef Q_OS_UNIX
unsigned short int p;
KExtendedSocket ks;
d->userAborted = false;
// - leaving SSL - warn before we even connect
if (metaData("main_frame_request") == "TRUE" &&
metaData("ssl_activate_warnings") == "TRUE" &&
metaData("ssl_was_in_use") == "TRUE" &&
!m_bIsSSL) {
KSSLSettings kss;
if (kss.warnOnLeave()) {
int result = messageBox( i18n("You are about to leave secure "
"mode. Transmissions will no "
"longer be encrypted.\nThis "
"means that a third party could "
"observe your data in transit."),
WarningContinueCancel,
i18n("Security Information"),
i18n("C&ontinue Loading"), TQString::null,
"WarnOnLeaveSSLMode" );
// Move this setting into KSSL instead
TDEConfig *config = new TDEConfig("tdeioslaverc");
config->setGroup("Notification Messages");
if (!config->readBoolEntry("WarnOnLeaveSSLMode", true)) {
config->deleteEntry("WarnOnLeaveSSLMode");
config->sync();
kss.setWarnOnLeave(false);
kss.save();
}
delete config;
if ( result == KMessageBox::Cancel ) {
d->userAborted = true;
return false;
}
}
}
d->status = -1;
d->host = host;
d->needSSLHandShake = m_bIsSSL;
p = port(_port);
ks.setAddress(host, p);
if ( d->timeout > -1 )
ks.setTimeout( d->timeout );
if (ks.connect() < 0)
{
d->status = ks.status();
if ( sendError )
{
if (d->status == IO_LookupError)
error( ERR_UNKNOWN_HOST, host);
else if ( d->status != -1 )
error( ERR_COULD_NOT_CONNECT, host);
}
return false;
}
m_iSock = ks.fd();
// store the IP for later
const TDESocketAddress *sa = ks.peerAddress();
if (sa)
d->ip = sa->nodeName();
else
d->ip = "";
ks.release(); // KExtendedSocket no longer applicable
if ( d->block != ks.blockingMode() )
ks.setBlockingMode( d->block );
m_iPort=p;
if (m_bIsSSL && !d->useSSLTunneling) {
if ( !doSSLHandShake( sendError ) )
return false;
}
else
setMetaData("ssl_in_use", "FALSE");
// Since we want to use stdio on the socket,
// we must fdopen it to get a file pointer,
// if it fails, close everything up
if ((fp = KDE_fdopen(m_iSock, "w+")) == 0) {
closeDescriptor();
return false;
}
return true;
#else //!Q_OS_UNIX
return false;
#endif //Q_OS_UNIX
}
void TCPSlaveBase::closeDescriptor()
{
stopTLS();
if (fp) {
fclose(fp);
fp=0;
m_iSock=-1;
if (m_bIsSSL)
d->kssl->close();
}
if (m_iSock != -1) {
close(m_iSock);
m_iSock=-1;
}
d->ip = "";
d->host = "";
}
bool TCPSlaveBase::initializeSSL()
{
if (m_bIsSSL) {
if (KSSL::doesSSLWork()) {
d->kssl = new KSSL;
return true;
}
}
return false;
}
void TCPSlaveBase::cleanSSL()
{
delete d->cc;
if (m_bIsSSL) {
delete d->kssl;
d->kssl = 0;
}
d->militantSSL = false;
}
bool TCPSlaveBase::atEnd()
{
return feof(fp);
}
int TCPSlaveBase::startTLS()
{
if (d->usingTLS || d->useSSLTunneling || m_bIsSSL || !KSSL::doesSSLWork())
return false;
d->kssl = new KSSL(false);
if (!d->kssl->TLSInit()) {
delete d->kssl;
return -1;
}
if ( !d->realHost.isEmpty() )
{
kdDebug(7029) << "Setting real hostname: " << d->realHost << endl;
d->kssl->setPeerHost(d->realHost);
} else {
kdDebug(7029) << "Setting real hostname: " << d->host << endl;
d->kssl->setPeerHost(d->host);
}
if (hasMetaData("ssl_session_id")) {
KSSLSession *s = KSSLSession::fromString(metaData("ssl_session_id"));
if (s) {
d->kssl->takeSession(s);
delete s;
}
}
certificatePrompt();
int rc = d->kssl->connect(m_iSock);
if (rc < 0) {
delete d->kssl;
return -2;
}
setMetaData("ssl_session_id", d->kssl->session()->toString());
d->usingTLS = true;
setMetaData("ssl_in_use", "TRUE");
if (!d->kssl->reusingSession()) {
rc = verifyCertificate();
if (rc != 1) {
setMetaData("ssl_in_use", "FALSE");
d->usingTLS = false;
delete d->kssl;
return -3;
}
}
d->savedMetaData = mOutgoingMetaData;
return (d->usingTLS ? 1 : 0);
}
void TCPSlaveBase::stopTLS()
{
if (d->usingTLS) {
delete d->kssl;
d->usingTLS = false;
setMetaData("ssl_in_use", "FALSE");
}
}
void TCPSlaveBase::setSSLMetaData() {
if (!(d->usingTLS || d->useSSLTunneling || m_bIsSSL))
return;
mOutgoingMetaData = d->savedMetaData;
}
bool TCPSlaveBase::canUseTLS()
{
if (m_bIsSSL || d->needSSLHandShake || !KSSL::doesSSLWork())
return false;
KSSLSettings kss;
return kss.tlsv1();
}
void TCPSlaveBase::certificatePrompt()
{
TQString certname; // the cert to use this session
bool send = false, prompt = false, save = false, forcePrompt = false;
KSSLCertificateHome::KSSLAuthAction aa;
setMetaData("ssl_using_client_cert", "FALSE"); // we change this if needed
if (metaData("ssl_no_client_cert") == "TRUE") return;
forcePrompt = (metaData("ssl_force_cert_prompt") == "TRUE");
// Delete the old cert since we're certainly done with it now
if (d->pkcs) {
delete d->pkcs;
d->pkcs = NULL;
}
if (!d->kssl) return;
// Look for a general certificate
if (!forcePrompt) {
certname = KSSLCertificateHome::getDefaultCertificateName(&aa);
switch(aa) {
case KSSLCertificateHome::AuthSend:
send = true; prompt = false;
break;
case KSSLCertificateHome::AuthDont:
send = false; prompt = false;
certname = TQString::null;
break;
case KSSLCertificateHome::AuthPrompt:
send = false; prompt = true;
break;
default:
break;
}
}
TQString ourHost;
if (!d->realHost.isEmpty()) {
ourHost = d->realHost;
} else {
ourHost = d->host;
}
// Look for a certificate on a per-host basis as an override
TQString tmpcn = KSSLCertificateHome::getDefaultCertificateName(ourHost, &aa);
if (aa != KSSLCertificateHome::AuthNone) { // we must override
switch (aa) {
case KSSLCertificateHome::AuthSend:
send = true;
prompt = false;
certname = tmpcn;
break;
case KSSLCertificateHome::AuthDont:
send = false;
prompt = false;
certname = TQString::null;
break;
case KSSLCertificateHome::AuthPrompt:
send = false;
prompt = true;
certname = tmpcn;
break;
default:
break;
}
}
// Finally, we allow the application to override anything.
if (hasMetaData("ssl_demand_certificate")) {
certname = metaData("ssl_demand_certificate");
if (!certname.isEmpty()) {
forcePrompt = false;
prompt = false;
send = true;
}
}
if (certname.isEmpty() && !prompt && !forcePrompt) return;
// Ok, we're supposed to prompt the user....
if (prompt || forcePrompt) {
TQStringList certs = KSSLCertificateHome::getCertificateList();
for (TQStringList::Iterator it = certs.begin(); it != certs.end(); ++it) {
KSSLPKCS12 *pkcs = KSSLCertificateHome::getCertificateByName(*it);
if (pkcs && (!pkcs->getCertificate() ||
!pkcs->getCertificate()->x509V3Extensions().certTypeSSLClient())) {
certs.remove(*it);
}
delete pkcs;
}
if (certs.isEmpty()) return; // we had nothing else, and prompt failed
if (!d->dcc) {
d->dcc = new DCOPClient;
d->dcc->attach();
if (!d->dcc->isApplicationRegistered("tdeio_uiserver")) {
TDEApplication::startServiceByDesktopPath("tdeio_uiserver.desktop",
TQStringList() );
}
}
TQByteArray data, retval;
TQCString rettype;
TQDataStream arg(data, IO_WriteOnly);
arg << ourHost;
arg << certs;
arg << metaData("window-id").toInt();
bool rc = d->dcc->call("tdeio_uiserver", "UIServer",
"showSSLCertDialog(TQString, TQStringList,int)",
data, rettype, retval);
if (rc && rettype == "KSSLCertDlgRet") {
TQDataStream retStream(retval, IO_ReadOnly);
KSSLCertDlgRet drc;
retStream >> drc;
if (drc.ok) {
send = drc.send;
save = drc.save;
certname = drc.choice;
}
}
}
// The user may have said to not send the certificate,
// but to save the choice
if (!send) {
if (save) {
KSSLCertificateHome::setDefaultCertificate(certname, ourHost,
false, false);
}
return;
}
// We're almost committed. If we can read the cert, we'll send it now.
KSSLPKCS12 *pkcs = KSSLCertificateHome::getCertificateByName(certname);
if (!pkcs && KSSLCertificateHome::hasCertificateByName(certname)) { // We need the password
TDEIO::AuthInfo ai;
bool first = true;
do {
ai.prompt = i18n("Enter the certificate password:");
ai.caption = i18n("SSL Certificate Password");
ai.url.setProtocol("kssl");
ai.url.setHost(certname);
ai.username = certname;
ai.keepPassword = true;
bool showprompt;
if (first)
showprompt = !checkCachedAuthentication(ai);
else
showprompt = true;
if (showprompt) {
if (!openPassDlg(ai, first ? TQString::null :
i18n("Unable to open the certificate. Try a new password?")))
break;
}
first = false;
pkcs = KSSLCertificateHome::getCertificateByName(certname, ai.password);
} while (!pkcs);
}
// If we could open the certificate, let's send it
if (pkcs) {
if (!d->kssl->setClientCertificate(pkcs)) {
messageBox(Information, i18n("The procedure to set the "
"client certificate for the session "
"failed."), i18n("SSL"));
delete pkcs; // we don't need this anymore
pkcs = 0L;
} else {
kdDebug(7029) << "Client SSL certificate is being used." << endl;
setMetaData("ssl_using_client_cert", "TRUE");
if (save) {
KSSLCertificateHome::setDefaultCertificate(certname, ourHost,
true, false);
}
}
d->pkcs = pkcs;
}
}
bool TCPSlaveBase::usingTLS() const
{
return d->usingTLS;
}
// ### remove this for KDE4 (misses const):
bool TCPSlaveBase::usingTLS()
{
return d->usingTLS;
}
// Returns 0 for failed verification, -1 for rejected cert and 1 for ok
int TCPSlaveBase::verifyCertificate()
{
int rc = 0;
bool permacache = false;
bool isChild = false;
bool _IPmatchesCN = false;
int result;
bool doAddHost = false;
TQString ourHost;
if (!d->realHost.isEmpty())
ourHost = d->realHost;
else ourHost = d->host;
TQString theurl = TQString(m_sServiceName)+"://"+ourHost+":"+TQString::number(m_iPort);
if (!hasMetaData("ssl_militant") || metaData("ssl_militant") == "FALSE")
d->militantSSL = false;
else if (metaData("ssl_militant") == "TRUE")
d->militantSSL = true;
if (!d->cc) d->cc = new KSSLCertificateCache;
KSSLCertificate& pc = d->kssl->peerInfo().getPeerCertificate();
KSSLCertificate::KSSLValidationList ksvl = pc.validateVerbose(KSSLCertificate::SSLServer);
_IPmatchesCN = d->kssl->peerInfo().certMatchesAddress();
if (!_IPmatchesCN) {
#ifndef Q_WS_WIN //temporary
KNetwork::KResolverResults res = KNetwork::KResolver::resolve(d->kssl->peerInfo().peerHost(), "80", KNetwork::KResolver::CanonName);
if (!res.isEmpty()) {
TQString old = d->kssl->peerInfo().peerHost();
d->kssl->peerInfo().setPeerHost(res[0].canonicalName());
_IPmatchesCN = d->kssl->peerInfo().certMatchesAddress();
if (!_IPmatchesCN) {
d->kssl->peerInfo().setPeerHost(old);
}
}
#endif
if (!_IPmatchesCN && !d->militantSSL) { // force this if the user wants it
if (d->cc->getHostList(pc).contains(ourHost)) {
_IPmatchesCN = true;
}
}
}
if (!_IPmatchesCN) {
ksvl << KSSLCertificate::InvalidHost;
}
KSSLCertificate::KSSLValidation ksv = KSSLCertificate::Ok;
if (!ksvl.isEmpty())
ksv = ksvl.first();
/* Setting the various bits of meta-info that will be needed. */
setMetaData("ssl_cipher", d->kssl->connectionInfo().getCipher());
setMetaData("ssl_cipher_desc",
d->kssl->connectionInfo().getCipherDescription());
setMetaData("ssl_cipher_version",
d->kssl->connectionInfo().getCipherVersion());
setMetaData("ssl_cipher_used_bits",
TQString::number(d->kssl->connectionInfo().getCipherUsedBits()));
setMetaData("ssl_cipher_bits",
TQString::number(d->kssl->connectionInfo().getCipherBits()));
setMetaData("ssl_peer_ip", d->ip);
if (!d->realHost.isEmpty()) {
setMetaData("ssl_proxied", "true");
}
TQString errorStr;
for(KSSLCertificate::KSSLValidationList::ConstIterator it = ksvl.begin();
it != ksvl.end(); ++it)
{
errorStr += TQString::number(*it)+":";
}
setMetaData("ssl_cert_errors", errorStr);
setMetaData("ssl_peer_certificate", pc.toString());
if (pc.chain().isValid() && pc.chain().depth() > 1) {
TQString theChain;
TQPtrList<KSSLCertificate> chain = pc.chain().getChain();
chain.setAutoDelete(true);
for (KSSLCertificate *c = chain.first(); c; c = chain.next()) {
theChain += c->toString();
theChain += "\n";
}
setMetaData("ssl_peer_chain", theChain);
} else setMetaData("ssl_peer_chain", "");
setMetaData("ssl_cert_state", TQString::number(ksv));
if (ksv == KSSLCertificate::Ok) {
rc = 1;
setMetaData("ssl_action", "accept");
}
kdDebug(7029) << "SSL HTTP frame the parent? " << metaData("main_frame_request") << endl;
if (!hasMetaData("main_frame_request") || metaData("main_frame_request") == "TRUE") {
// Since we're the parent, we need to teach the child.
setMetaData("ssl_parent_ip", d->ip);
setMetaData("ssl_parent_cert", pc.toString());
// - Read from cache and see if there is a policy for this
KSSLCertificateCache::KSSLCertificatePolicy cp =
d->cc->getPolicyByCertificate(pc);
// - validation code
if (ksv != KSSLCertificate::Ok) {
if (d->militantSSL) {
return -1;
}
if (cp == KSSLCertificateCache::Unknown ||
cp == KSSLCertificateCache::Ambiguous) {
cp = KSSLCertificateCache::Prompt;
} else {
// A policy was already set so let's honor that.
permacache = d->cc->isPermanent(pc);
}
/*
if (!_IPmatchesCN && cp == KSSLCertificateCache::Accept) {
cp = KSSLCertificateCache::Prompt;
// ksv = KSSLCertificate::Ok;
}
*/
// Precondition: cp is one of Reject, Accept or Prompt
switch (cp) {
case KSSLCertificateCache::Accept:
rc = 1;
setMetaData("ssl_action", "accept");
break;
case KSSLCertificateCache::Reject:
rc = -1;
setMetaData("ssl_action", "reject");
break;
case KSSLCertificateCache::Prompt:
{
do {
if (ksv == KSSLCertificate::InvalidHost) {
TQString msg = i18n("The IP address of the host %1 "
"does not match the one the "
"certificate was issued to.");
result = messageBox( WarningYesNoCancel,
msg.arg(ourHost),
i18n("Server Authentication"),
i18n("&Details"),
i18n("Co&ntinue") );
} else {
TQString msg = i18n("The server certificate failed the "
"authenticity test (%1).");
result = messageBox( WarningYesNoCancel,
msg.arg(ourHost),
i18n("Server Authentication"),
i18n("&Details"),
i18n("Co&ntinue") );
}
if (result == KMessageBox::Yes) {
if (!d->dcc) {
d->dcc = new DCOPClient;
d->dcc->attach();
if (!d->dcc->isApplicationRegistered("tdeio_uiserver")) {
TDEApplication::startServiceByDesktopPath("tdeio_uiserver.desktop",
TQStringList() );
}
}
TQByteArray data, ignore;
TQCString ignoretype;
TQDataStream arg(data, IO_WriteOnly);
arg << theurl << mOutgoingMetaData;
arg << metaData("window-id").toInt();
d->dcc->call("tdeio_uiserver", "UIServer",
"showSSLInfoDialog(TQString,TDEIO::MetaData,int)",
data, ignoretype, ignore);
}
} while (result == KMessageBox::Yes);
if (result == KMessageBox::No) {
setMetaData("ssl_action", "accept");
rc = 1;
cp = KSSLCertificateCache::Accept;
doAddHost = true;
result = messageBox( WarningYesNo,
i18n("Would you like to accept this "
"certificate forever without "
"being prompted?"),
i18n("Server Authentication"),
i18n("&Forever"),
i18n("&Current Sessions Only"));
if (result == KMessageBox::Yes)
permacache = true;
else
permacache = false;
} else {
setMetaData("ssl_action", "reject");
rc = -1;
cp = KSSLCertificateCache::Prompt;
}
break;
}
default:
kdDebug(7029) << "TCPSlaveBase/SSL error in cert code."
<< "Please report this to kfm-devel@kde.org."
<< endl;
break;
}
}
// - cache the results
d->cc->addCertificate(pc, cp, permacache);
if (doAddHost) d->cc->addHost(pc, ourHost);
} else { // Child frame
// - Read from cache and see if there is a policy for this
KSSLCertificateCache::KSSLCertificatePolicy cp =
d->cc->getPolicyByCertificate(pc);
isChild = true;
// Check the cert and IP to make sure they're the same
// as the parent frame
bool certAndIPTheSame = (d->ip == metaData("ssl_parent_ip") &&
pc.toString() == metaData("ssl_parent_cert"));
if (ksv == KSSLCertificate::Ok) {
if (certAndIPTheSame) { // success
rc = 1;
setMetaData("ssl_action", "accept");
} else {
/*
if (d->militantSSL) {
return -1;
}
result = messageBox(WarningYesNo,
i18n("The certificate is valid but does not appear to have been assigned to this server. Do you wish to continue loading?"),
i18n("Server Authentication"));
if (result == KMessageBox::Yes) { // success
rc = 1;
setMetaData("ssl_action", "accept");
} else { // fail
rc = -1;
setMetaData("ssl_action", "reject");
}
*/
setMetaData("ssl_action", "accept");
rc = 1; // Let's accept this now. It's bad, but at least the user
// will see potential attacks in KDE3 with the pseudo-lock
// icon on the toolbar, and can investigate with the RMB
}
} else {
if (d->militantSSL) {
return -1;
}
if (cp == KSSLCertificateCache::Accept) {
if (certAndIPTheSame) { // success
rc = 1;
setMetaData("ssl_action", "accept");
} else { // fail
result = messageBox(WarningYesNo,
i18n("You have indicated that you wish to accept this certificate, but it is not issued to the server who is presenting it. Do you wish to continue loading?"),
i18n("Server Authentication"));
if (result == KMessageBox::Yes) {
rc = 1;
setMetaData("ssl_action", "accept");
d->cc->addHost(pc, ourHost);
} else {
rc = -1;
setMetaData("ssl_action", "reject");
}
}
} else if (cp == KSSLCertificateCache::Reject) { // fail
messageBox(Information, i18n("SSL certificate is being rejected as requested. You can disable this in the Trinity Control Center."),
i18n("Server Authentication"));
rc = -1;
setMetaData("ssl_action", "reject");
} else {
do {
TQString msg = i18n("The server certificate failed the "
"authenticity test (%1).");
result = messageBox(WarningYesNoCancel,
msg.arg(ourHost),
i18n("Server Authentication"),
i18n("&Details"),
i18n("Co&nnect"));
if (result == KMessageBox::Yes) {
if (!d->dcc) {
d->dcc = new DCOPClient;
d->dcc->attach();
if (!d->dcc->isApplicationRegistered("tdeio_uiserver")) {
TDEApplication::startServiceByDesktopPath("tdeio_uiserver.desktop",
TQStringList() );
}
}
TQByteArray data, ignore;
TQCString ignoretype;
TQDataStream arg(data, IO_WriteOnly);
arg << theurl << mOutgoingMetaData;
arg << metaData("window-id").toInt();
d->dcc->call("tdeio_uiserver", "UIServer",
"showSSLInfoDialog(TQString,TDEIO::MetaData,int)",
data, ignoretype, ignore);
}
} while (result == KMessageBox::Yes);
if (result == KMessageBox::No) {
setMetaData("ssl_action", "accept");
rc = 1;
cp = KSSLCertificateCache::Accept;
result = messageBox(WarningYesNo,
i18n("Would you like to accept this "
"certificate forever without "
"being prompted?"),
i18n("Server Authentication"),
i18n("&Forever"),
i18n("&Current Sessions Only"));
permacache = (result == KMessageBox::Yes);
d->cc->addCertificate(pc, cp, permacache);
d->cc->addHost(pc, ourHost);
} else {
setMetaData("ssl_action", "reject");
rc = -1;
cp = KSSLCertificateCache::Prompt;
d->cc->addCertificate(pc, cp, permacache);
}
}
}
}
if (rc == -1) {
return rc;
}
if (metaData("ssl_activate_warnings") == "TRUE") {
// - entering SSL
if (!isChild && metaData("ssl_was_in_use") == "FALSE" &&
d->kssl->settings()->warnOnEnter()) {
int result;
do {
result = messageBox( i18n("You are about to "
"enter secure mode. "
"All transmissions "
"will be encrypted "
"unless otherwise "
"noted.\nThis means "
"that no third party "
"will be able to "
"easily observe your "
"data in transit."),
WarningYesNo,
i18n("Security Information"),
i18n("Display SSL "
"&Information"),
i18n("C&onnect"),
"WarnOnEnterSSLMode" );
// Move this setting into KSSL instead
TDEConfig *config = new TDEConfig("tdeioslaverc");
config->setGroup("Notification Messages");
bool dialogBoxStatus = false;
if( config->hasKey("WarnOnEnterSSLMode") ) {
dialogBoxStatus = true;
}
bool keyStatus = config->readBoolEntry("WarnOnEnterSSLMode", true);
dialogBoxStatus = dialogBoxStatus && keyStatus;
if (!keyStatus) {
config->deleteEntry("WarnOnEnterSSLMode");
config->sync();
d->kssl->settings()->setWarnOnEnter(false);
d->kssl->settings()->save();
}
delete config;
if ( result == KMessageBox::Yes )
{
if (!d->dcc) {
d->dcc = new DCOPClient;
d->dcc->attach();
if (!d->dcc->isApplicationRegistered("tdeio_uiserver")) {
TDEApplication::startServiceByDesktopPath("tdeio_uiserver.desktop",
TQStringList() );
}
}
TQByteArray data, ignore;
TQCString ignoretype;
TQDataStream arg(data, IO_WriteOnly);
arg << theurl << mOutgoingMetaData;
arg << metaData("window-id").toInt();
d->dcc->call("tdeio_uiserver", "UIServer",
"showSSLInfoDialog(TQString,TDEIO::MetaData,int)",
data, ignoretype, ignore);
}
//Laurent: If we disable message box we can't click on KMessageBox::No
if(dialogBoxStatus) {
break;
}
} while (result != KMessageBox::No);
}
} // if ssl_activate_warnings
kdDebug(7029) << "SSL connection information follows:" << endl
<< "+-----------------------------------------------" << endl
<< "| Cipher: " << d->kssl->connectionInfo().getCipher() << endl
<< "| Description: " << d->kssl->connectionInfo().getCipherDescription() << endl
<< "| Version: " << d->kssl->connectionInfo().getCipherVersion() << endl
<< "| Strength: " << d->kssl->connectionInfo().getCipherUsedBits()
<< " of " << d->kssl->connectionInfo().getCipherBits()
<< " bits used." << endl
<< "| PEER:" << endl
<< "| Subject: " << d->kssl->peerInfo().getPeerCertificate().getSubject() << endl
<< "| Issuer: " << d->kssl->peerInfo().getPeerCertificate().getIssuer() << endl
<< "| Validation: " << (int)ksv << endl
<< "| Certificate matches IP: " << _IPmatchesCN << endl
<< "+-----------------------------------------------"
<< endl;
// sendMetaData(); Do not call this function!!
return rc;
}
bool TCPSlaveBase::isConnectionValid()
{
if ( m_iSock == -1 )
return false;
fd_set rdfs;
FD_ZERO(&rdfs);
FD_SET(m_iSock , &rdfs);
struct timeval tv;
tv.tv_usec = 0;
tv.tv_sec = 0;
int retval;
#ifdef Q_OS_UNIX
do {
retval = KSocks::self()->select(m_iSock+1, &rdfs, NULL, NULL, &tv);
if (wasKilled())
return false; // Beam us out of here
} while ((retval == -1) && (errno == EAGAIN));
#else
retval = -1;
#endif
// retval == -1 ==> Error
// retval == 0 ==> Connection Idle
// retval >= 1 ==> Connection Active
//kdDebug(7029) << "TCPSlaveBase::isConnectionValid: select returned: "
// << retval << endl;
if (retval == -1)
return false;
if (retval == 0)
return true;
// Connection is active, check if it has closed.
char buffer[100];
#ifdef Q_OS_UNIX
do {
retval = KSocks::self()->recv(m_iSock, buffer, 80, MSG_PEEK);
} while ((retval == -1) && (errno == EAGAIN));
#else
retval = -1;
#endif
//kdDebug(7029) << "TCPSlaveBase::isConnectionValid: recv returned: "
// << retval << endl;
if (retval <= 0)
return false; // Error or connection closed.
return true; // Connection still valid.
}
bool TCPSlaveBase::waitForResponse( int t )
{
fd_set rd;
struct timeval timeout;
if ( (m_bIsSSL || d->usingTLS) && !d->useSSLTunneling && d->kssl )
if (d->kssl->pending() > 0)
return true;
FD_ZERO(&rd);
FD_SET(m_iSock, &rd);
timeout.tv_usec = 0;
timeout.tv_sec = t;
time_t startTime;
int rc;
int n = t;
reSelect:
startTime = time(NULL);
#ifdef Q_OS_UNIX
rc = KSocks::self()->select(m_iSock+1, &rd, NULL, NULL, &timeout);
#else
rc = -1;
#endif
if (wasKilled())
return false; // We're dead.
if (rc == -1)
return false;
if (FD_ISSET(m_iSock, &rd))
return true;
// Well it returned but it wasn't set. Let's see if it
// returned too early (perhaps from an errant signal) and
// start over with the remaining time
int timeDone = time(NULL) - startTime;
if (timeDone < n)
{
n -= timeDone;
timeout.tv_sec = n;
goto reSelect;
}
return false; // Timed out!
}
int TCPSlaveBase::connectResult()
{
return d->status;
}
void TCPSlaveBase::setBlockConnection( bool b )
{
d->block = b;
}
void TCPSlaveBase::setConnectTimeout( int t )
{
d->timeout = t;
}
bool TCPSlaveBase::isSSLTunnelEnabled()
{
return d->useSSLTunneling;
}
void TCPSlaveBase::setEnableSSLTunnel( bool enable )
{
d->useSSLTunneling = enable;
}
void TCPSlaveBase::setRealHost( const TQString& realHost )
{
d->realHost = realHost;
}
bool TCPSlaveBase::doSSLHandShake( bool sendError )
{
kdDebug(7029) << "TCPSlaveBase::doSSLHandShake: " << endl;
TQString msgHost = d->host;
d->kssl->reInitialize();
if (hasMetaData("ssl_session_id")) {
KSSLSession *s = KSSLSession::fromString(metaData("ssl_session_id"));
if (s) {
d->kssl->takeSession(s);
delete s;
}
}
certificatePrompt();
if ( !d->realHost.isEmpty() )
{
msgHost = d->realHost;
}
kdDebug(7029) << "Setting real hostname: " << msgHost << endl;
d->kssl->setPeerHost(msgHost);
d->status = d->kssl->connect(m_iSock);
if (d->status < 0)
{
closeDescriptor();
if ( sendError )
error( ERR_COULD_NOT_CONNECT, msgHost);
return false;
}
setMetaData("ssl_session_id", d->kssl->session()->toString());
setMetaData("ssl_in_use", "TRUE");
if (!d->kssl->reusingSession()) {
int rc = verifyCertificate();
if ( rc != 1 ) {
d->status = -1;
closeDescriptor();
if ( sendError )
error( ERR_COULD_NOT_CONNECT, msgHost);
return false;
}
}
d->needSSLHandShake = false;
d->savedMetaData = mOutgoingMetaData;
return true;
}
bool TCPSlaveBase::userAborted() const
{
return d->userAborted;
}
void TCPSlaveBase::virtual_hook( int id, void* data )
{ SlaveBase::virtual_hook( id, data ); }
View Git Blame Copy Permalink