1 ;;; proto-stream.el --- negotiating TLS, STARTTLS and other connections
3 ;; Copyright (C) 2010-2011 Free Software Foundation, Inc.
5 ;; Author: Lars Magne Ingebrigtsen <larsi@gnus.org>
8 ;; This file is part of GNU Emacs.
10 ;; GNU Emacs is free software: you can redistribute it and/or modify
11 ;; it under the terms of the GNU General Public License as published by
12 ;; the Free Software Foundation, either version 3 of the License, or
13 ;; (at your option) any later version.
15 ;; GNU Emacs is distributed in the hope that it will be useful,
16 ;; but WITHOUT ANY WARRANTY; without even the implied warranty of
17 ;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 ;; GNU General Public License for more details.
20 ;; You should have received a copy of the GNU General Public License
21 ;; along with GNU Emacs. If not, see <http://www.gnu.org/licenses/>.
25 ;; This library is meant to provide the glue between modules that want
26 ;; to establish a network connection to a server for protocols such as
27 ;; IMAP, NNTP, SMTP and POP3.
29 ;; The main problem is that there's more than a couple of interfaces
30 ;; towards doing this. You have normal, plain connections, which are
31 ;; no trouble at all, but you also have TLS/SSL connections, and you
32 ;; have STARTTLS. Negotiating this for each protocol can be rather
33 ;; tedious, so this library provides a single entry point, and hides
34 ;; much of the ugliness.
38 ;; (open-protocol-stream
39 ;; "*nnimap*" buffer address port
41 ;; :capability-command "1 CAPABILITY\r\n"
44 ;; (lambda (capabilities)
45 ;; (if (not (string-match "STARTTLS" capabilities))
47 ;; "1 STARTTLS\r\n")))
55 (require 'format-spec)
57 (defcustom proto-stream-always-use-starttls (fboundp 'open-gnutls-stream)
58 "If non-nil, always try to upgrade network connections with STARTTLS."
63 (declare-function gnutls-negotiate "gnutls"
64 (proc type &optional priority-string trustfiles keyfiles))
67 (defun open-protocol-stream (name buffer host service &rest parameters)
68 "Open a network stream to HOST, upgrading to STARTTLS if possible.
69 The first four parameters have the same meaning as in
70 `open-network-stream'. The function returns a list where the
71 first element is the stream, the second element is the greeting
72 the server replied with after connecting, and the third element
73 is a string representing the capabilities of the server (if any).
75 The PARAMETERS is a keyword list that can have the following
78 :type -- either `network', `network-only, `tls', `shell' or
79 `starttls'. If omitted, the default is `network'. `network'
80 will be opportunistically upgraded to STARTTLS if both the server
81 and Emacs supports it. If you don't want STARTTLS upgrades, use
84 :end-of-command -- a regexp saying what the end of a command is.
85 This defaults to \"\\n\".
87 :success -- a regexp saying whether the STARTTLS command was
88 successful or not. For instance, for NNTP this is \"^3\".
90 :capability-command -- a string representing the command used to
91 query server for capabilities. For instance, for IMAP this is
92 \"1 CAPABILITY\\r\\n\".
94 :starttls-function -- a function that takes one parameter, which
95 is the response to the capaibility command. It should return nil
96 if it turns out that the server doesn't support STARTTLS, or the
97 command to switch on STARTTLS otherwise.
99 The return value from this function is a four-element list, where
100 the first element is the stream (if connection was successful);
101 the second element is the \"greeting\", i. e., the string the
102 server sent over on initial contact; the third element is the
103 capability string; and the fourth element is either `network' or
104 `tls', depending on whether the connection ended up being
106 (let ((type (or (cadr (memq :type parameters)) 'network)))
109 (setq type 'network))
113 (funcall (intern (format "proto-stream-open-%s" type) obarray)
114 name buffer host service parameters)))
115 (if (null open-result)
116 (list nil nil nil type)
117 (let ((stream (car open-result)))
119 (memq (process-status stream)
124 (nth 3 open-result)))))))
126 (defun proto-stream-open-network-only (name buffer host service parameters)
127 (let ((start (with-current-buffer buffer (point)))
128 (stream (open-network-stream name buffer host service)))
130 (proto-stream-get-response
131 stream start (proto-stream-eoc parameters))
135 (defun proto-stream-open-network (name buffer host service parameters)
136 (let* ((start (with-current-buffer buffer (point)))
137 (stream (open-network-stream name buffer host service))
138 (capability-command (cadr (memq :capability-command parameters)))
139 (eoc (proto-stream-eoc parameters))
140 (type (cadr (memq :type parameters)))
141 (greeting (proto-stream-get-response stream start eoc))
143 (if (not capability-command)
144 (list stream greeting nil 'network)
146 (proto-stream-command stream capability-command eoc))
148 (funcall (cadr (memq :starttls-function parameters))
151 ;; If this server doesn't support STARTTLS, but we have
152 ;; requested it explicitly, then close the connection and
154 ((or (not starttls-command)
155 (and (not (eq type 'starttls))
156 (not proto-stream-always-use-starttls)))
157 (if (eq type 'starttls)
159 (delete-process stream)
161 ;; Otherwise, just return this plain network connection.
162 (list stream greeting capabilities 'network)))
163 ;; We have some kind of STARTTLS support, so we try to
164 ;; upgrade the connection opportunistically.
165 ((or (fboundp 'open-gnutls-stream)
166 (executable-find "gnutls-cli"))
167 (unless (fboundp 'open-gnutls-stream)
168 (delete-process stream)
169 (setq start (with-current-buffer buffer (point-max)))
170 (let* ((starttls-use-gnutls t)
171 (starttls-extra-arguments
172 (if (not (eq type 'starttls))
173 ;; When doing opportunistic TLS upgrades we
174 ;; don't really care about the identity of the
176 (cons "--insecure" starttls-extra-arguments)
177 starttls-extra-arguments)))
178 (setq stream (starttls-open-stream name buffer host service)))
179 (proto-stream-get-response stream start eoc))
182 (cadr (memq :success parameters))
183 (proto-stream-command stream starttls-command eoc)))
184 ;; We got an error back from the STARTTLS command.
186 (if (eq type 'starttls)
188 (delete-process stream)
190 (list stream greeting capabilities 'network)))
191 ;; The server said it was OK to start doing STARTTLS negotiations.
192 (if (fboundp 'open-gnutls-stream)
193 (gnutls-negotiate stream nil)
194 (unless (starttls-negotiate stream)
195 (delete-process stream)
197 (when (or (null stream)
198 (not (memq (process-status stream)
200 ;; It didn't successfully negotiate STARTTLS, so we reopen
202 (setq stream (open-network-stream name buffer host service))
203 (proto-stream-get-response stream start eoc))
204 ;; Re-get the capabilities, since they may have changed
205 ;; after switching to TLS.
206 (list stream greeting
207 (proto-stream-command stream capability-command eoc) 'tls)))
208 ;; We don't have STARTTLS support available, but the caller
209 ;; requested a STARTTLS connection, so we give up.
210 ((eq (cadr (memq :type parameters)) 'starttls)
211 (delete-process stream)
213 ;; Fall back on using a plain network stream.
215 (list stream greeting capabilities 'network)))))))
217 (defun proto-stream-command (stream command eoc)
218 (let ((start (with-current-buffer (process-buffer stream) (point-max))))
219 (process-send-string stream command)
220 (proto-stream-get-response stream start eoc)))
222 (defun proto-stream-get-response (stream start end-of-command)
223 (with-current-buffer (process-buffer stream)
226 (while (and (memq (process-status stream)
228 (not (re-search-forward end-of-command nil t)))
229 (accept-process-output stream 0 50)
231 (if (= start (point))
232 ;; The process died; return nil.
234 ;; Return the data we got back.
235 (buffer-substring start (point))))))
237 (defun proto-stream-open-tls (name buffer host service parameters)
238 (with-current-buffer buffer
239 (let ((start (point-max))
241 (funcall (if (fboundp 'open-gnutls-stream)
244 name buffer host service)))
247 ;; If we're using tls.el, we have to delete the output from
248 ;; openssl/gnutls-cli.
249 (unless (fboundp 'open-gnutls-stream)
250 (proto-stream-get-response
251 stream start (proto-stream-eoc parameters))
252 (goto-char (point-min))
253 (when (re-search-forward (proto-stream-eoc parameters) nil t)
254 (goto-char (match-beginning 0))
255 (delete-region (point-min) (line-beginning-position))))
256 (proto-stream-capability-open start stream parameters 'tls)))))
258 (defun proto-stream-open-shell (name buffer host service parameters)
259 (proto-stream-capability-open
260 (with-current-buffer buffer (point))
261 (let ((process-connection-type nil))
262 (start-process name buffer shell-file-name
265 (cadr (memq :shell-command parameters))
269 parameters 'network))
271 (defun proto-stream-capability-open (start stream parameters stream-type)
272 (let ((capability-command (cadr (memq :capability-command parameters)))
273 (greeting (proto-stream-get-response
274 stream start (proto-stream-eoc parameters))))
275 (list stream greeting
276 (and capability-command
277 (proto-stream-command
278 stream capability-command (proto-stream-eoc parameters)))
281 (defun proto-stream-eoc (parameters)
282 (or (cadr (memq :end-of-command parameters))
285 (provide 'proto-stream)
287 ;;; proto-stream.el ends here