Stash peer certificate before fetching HTTP response
[platform/upstream/openconnect.git] / openconnect-internal.h
1 /*
2  * OpenConnect (SSL + DTLS) VPN client
3  *
4  * Copyright © 2008-2012 Intel Corporation.
5  * Copyright © 2008 Nick Andrew <nick@nick-andrew.net>
6  *
7  * Author: David Woodhouse <dwmw2@infradead.org>
8  *
9  * This program is free software; you can redistribute it and/or
10  * modify it under the terms of the GNU Lesser General Public License
11  * version 2.1, as published by the Free Software Foundation.
12  *
13  * This program is distributed in the hope that it will be useful, but
14  * WITHOUT ANY WARRANTY; without even the implied warranty of
15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
16  * Lesser General Public License for more details.
17  *
18  * You should have received a copy of the GNU Lesser General Public
19  * License along with this library; if not, write to:
20  *
21  *   Free Software Foundation, Inc.
22  *   51 Franklin Street, Fifth Floor,
23  *   Boston, MA 02110-1301 USA
24  */
25
26 #ifndef __OPENCONNECT_INTERNAL_H__
27 #define __OPENCONNECT_INTERNAL_H__
28
29 #include "openconnect.h"
30
31 #include <openssl/ssl.h>
32 #include <zlib.h>
33 #include <stdint.h>
34 #include <sys/socket.h>
35 #include <sys/select.h>
36 #include <sys/time.h>
37 #include <sys/types.h>
38 #include <unistd.h>
39 #ifdef LIBPROXY_HDR
40 #include LIBPROXY_HDR
41 #endif
42 #ifdef ENABLE_NLS
43 #include <locale.h>
44 #include <libintl.h>
45 #define _(s) dgettext("openconnect", s)
46 #else
47 #define _(s) s
48 #endif
49 #define N_(s) s
50
51 /****************************************************************************/
52
53 struct pkt {
54         int len;
55         struct pkt *next;
56         unsigned char hdr[8];
57         unsigned char data[];
58 };
59
60 struct vpn_option {
61         char *option;
62         char *value;
63         struct vpn_option *next;
64 };
65
66 #define KA_NONE         0
67 #define KA_DPD          1
68 #define KA_DPD_DEAD     2
69 #define KA_KEEPALIVE    3
70 #define KA_REKEY        4
71
72 struct keepalive_info {
73         int dpd;
74         int keepalive;
75         int rekey;
76         time_t last_rekey;
77         time_t last_tx;
78         time_t last_rx;
79         time_t last_dpd;
80 };
81
82 struct split_include {
83         char *route;
84         struct split_include *next;
85 };
86
87 #define RECONNECT_INTERVAL_MIN  10
88 #define RECONNECT_INTERVAL_MAX  100
89
90 #define CERT_TYPE_UNKNOWN       0
91 #define CERT_TYPE_PEM           1
92 #define CERT_TYPE_PKCS12        2
93 #define CERT_TYPE_TPM           3
94
95 struct openconnect_info {
96         char *redirect_url;
97
98         char *csd_token;
99         char *csd_ticket;
100         char *csd_stuburl;
101         char *csd_starturl;
102         char *csd_waiturl;
103         char *csd_preurl;
104
105         char *csd_scriptname;
106
107 #ifdef LIBPROXY_HDR
108         pxProxyFactory *proxy_factory;
109 #endif
110         char *proxy_type;
111         char *proxy;
112         int proxy_port;
113
114         const char *localname;
115         char *hostname;
116         int port;
117         char *urlpath;
118         int cert_expire_warning;
119         const char *cert;
120         const char *sslkey;
121         X509 *cert_x509;
122         int cert_type;
123         char *cert_password;
124         const char *cafile;
125         const char *servercert;
126         const char *xmlconfig;
127         char xmlsha1[(SHA_DIGEST_LENGTH * 2) + 1];
128         char *username;
129         char *password;
130         char *authgroup;
131         int nopasswd;
132         char *dtls_ciphers;
133         uid_t uid_csd;
134         char *csd_wrapper;
135         int uid_csd_given;
136         int no_http_keepalive;
137
138         X509 *peer_cert;
139
140         char *cookie; /* Pointer to within cookies list */
141         struct vpn_option *cookies;
142         struct vpn_option *cstp_options;
143         struct vpn_option *dtls_options;
144
145         SSL_CTX *https_ctx;
146         SSL *https_ssl;
147         struct keepalive_info ssl_times;
148         int owe_ssl_dpd_response;
149         struct pkt *deflate_pkt;
150         struct pkt *current_ssl_pkt;
151         struct pkt *pending_deflated_pkt;
152
153         z_stream inflate_strm;
154         uint32_t inflate_adler32;
155         z_stream deflate_strm;
156         uint32_t deflate_adler32;
157
158         int disable_ipv6;
159         int reconnect_timeout;
160         int reconnect_interval;
161         int dtls_attempt_period;
162         time_t new_dtls_started;
163         SSL_CTX *dtls_ctx;
164         SSL *dtls_ssl;
165         SSL *new_dtls_ssl;
166         SSL_SESSION *dtls_session;
167         struct keepalive_info dtls_times;
168         unsigned char dtls_session_id[32];
169         unsigned char dtls_secret[48];
170
171         char *dtls_cipher;
172         const char *vpnc_script;
173         int script_tun;
174         char *ifname;
175
176         int mtu;
177         const char *banner;
178         const char *vpn_addr;
179         const char *vpn_netmask;
180         const char *vpn_addr6;
181         const char *vpn_netmask6;
182         const char *vpn_dns[3];
183         const char *vpn_nbns[3];
184         const char *vpn_domain;
185         const char *vpn_proxy_pac;
186         struct split_include *split_includes;
187         struct split_include *split_excludes;
188
189         int select_nfds;
190         fd_set select_rfds;
191         fd_set select_wfds;
192         fd_set select_efds;
193
194 #ifdef __sun__
195         int ip_fd;
196         int ip6_fd;
197 #endif
198         int tun_fd;
199         int ssl_fd;
200         int dtls_fd;
201         int new_dtls_fd;
202         int cancel_fd;
203
204         struct pkt *incoming_queue;
205         struct pkt *outgoing_queue;
206         int outgoing_qlen;
207         int max_qlen;
208
209         socklen_t peer_addrlen;
210         struct sockaddr *peer_addr;
211         struct sockaddr *dtls_addr;
212
213         int deflate;
214         char *useragent;
215
216         const char *quit_reason;
217
218         void *cbdata;
219         openconnect_validate_peer_cert_vfn validate_peer_cert;
220         openconnect_write_new_config_vfn write_new_config;
221         openconnect_process_auth_form_vfn process_auth_form;
222         openconnect_progress_vfn progress;
223 };
224
225 /* Packet types */
226
227 #define AC_PKT_DATA             0       /* Uncompressed data */
228 #define AC_PKT_DPD_OUT          3       /* Dead Peer Detection */
229 #define AC_PKT_DPD_RESP         4       /* DPD response */
230 #define AC_PKT_DISCONN          5       /* Client disconnection notice */
231 #define AC_PKT_KEEPALIVE        7       /* Keepalive */
232 #define AC_PKT_COMPRESSED       8       /* Compressed data */
233 #define AC_PKT_TERM_SERVER      9       /* Server kick */
234
235 /* Ick */
236 #if OPENSSL_VERSION_NUMBER >= 0x00909000L
237 #define method_const const
238 #else
239 #define method_const
240 #endif
241
242 #define vpn_progress(vpninfo, ...) (vpninfo)->progress ((vpninfo)->cbdata, __VA_ARGS__)
243
244 /****************************************************************************/
245 /* Oh Solaris how we hate thee! */
246 #ifdef __sun__
247 #define time(x) openconnect__time(x)
248 time_t openconnect__time(time_t *t);
249 #endif
250 #ifndef HAVE_ASPRINTF
251 #define asprintf openconnect__asprintf
252 int openconnect__asprintf(char **strp, const char *fmt, ...);
253 #endif
254 #ifndef HAVE_GETLINE
255 #define getline openconnect__getline
256 ssize_t openconnect__getline(char **lineptr, size_t *n, FILE *stream);
257 #endif
258
259 /****************************************************************************/
260
261 /* tun.c */
262 int setup_tun(struct openconnect_info *vpninfo);
263 int tun_mainloop(struct openconnect_info *vpninfo, int *timeout);
264 void shutdown_tun(struct openconnect_info *vpninfo);
265 int script_config_tun (struct openconnect_info *vpninfo, const char *reason);
266
267 /* dtls.c */
268 unsigned char unhex(const char *data);
269 int setup_dtls(struct openconnect_info *vpninfo);
270 int dtls_mainloop(struct openconnect_info *vpninfo, int *timeout);
271 int dtls_try_handshake(struct openconnect_info *vpninfo);
272 int connect_dtls_socket(struct openconnect_info *vpninfo);
273
274 /* cstp.c */
275 int make_cstp_connection(struct openconnect_info *vpninfo);
276 int cstp_mainloop(struct openconnect_info *vpninfo, int *timeout);
277 int cstp_bye(struct openconnect_info *vpninfo, const char *reason);
278 int cstp_reconnect(struct openconnect_info *vpninfo);
279
280 /* ssl.c */
281 int  __attribute__ ((format (printf, 2, 3)))
282     openconnect_SSL_printf(struct openconnect_info *vpninfo, const char *fmt, ...);
283 int openconnect_SSL_gets(struct openconnect_info *vpninfo, char *buf, size_t len);
284 int openconnect_SSL_write(struct openconnect_info *vpninfo, char *buf, size_t len);
285 int openconnect_SSL_read(struct openconnect_info *vpninfo, char *buf, size_t len);
286 int openconnect_open_https(struct openconnect_info *vpninfo);
287 void openconnect_close_https(struct openconnect_info *vpninfo);
288 int get_cert_md5_fingerprint(struct openconnect_info *vpninfo, X509 *cert,
289                              char *buf);
290 void openconnect_report_ssl_errors(struct openconnect_info *vpninfo);
291
292 /* mainloop.c */
293 int vpn_add_pollfd(struct openconnect_info *vpninfo, int fd, short events);
294 int vpn_mainloop(struct openconnect_info *vpninfo);
295 int queue_new_packet(struct pkt **q, void *buf, int len);
296 void queue_packet(struct pkt **q, struct pkt *new);
297 int keepalive_action(struct keepalive_info *ka, int *timeout);
298 int ka_stalled_dpd_time(struct keepalive_info *ka, int *timeout);
299
300 extern int killed;
301
302 /* xml.c */
303 int config_lookup_host(struct openconnect_info *vpninfo, const char *host);
304
305 /* auth.c */
306 int parse_xml_response(struct openconnect_info *vpninfo, char *response,
307                        char *request_body, int req_len, const char **method,
308                        const char **request_body_type);
309
310 /* http.c */
311 char *openconnect_create_useragent(const char *base);
312 int process_proxy(struct openconnect_info *vpninfo, int ssl_sock);
313 int internal_parse_url(char *url, char **res_proto, char **res_host,
314                        int *res_port, char **res_path, int default_port);
315
316 /* ssl_ui.c */
317 int set_openssl_ui(void);
318
319 /* securid.c */
320 int generate_securid_tokencodes(struct openconnect_info *vpninfo);
321 int add_securid_pin(char *token, char *pin);
322
323 /* version.c */
324 extern const char *openconnect_version_str;
325
326 #endif /* __OPENCONNECT_INTERNAL_H__ */