xref: /freebsd/lib/libfetch/common.c (revision 0f7f3352c8bc463607912e2463d13e52d44a4cae)
1 /*-
2  * Copyright (c) 1998-2016 Dag-Erling Smørgrav
3  * Copyright (c) 2013 Michael Gmelin <freebsd@grem.de>
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer
11  *    in this position and unchanged.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. The name of the author may not be used to endorse or promote products
16  *    derived from this software without specific prior written permission
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
19  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
20  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
21  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
22  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
23  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
24  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
25  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
27  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28  */
29 
30 #include <sys/cdefs.h>
31 __FBSDID("$FreeBSD$");
32 
33 #include <sys/param.h>
34 #include <sys/socket.h>
35 #include <sys/time.h>
36 #include <sys/uio.h>
37 
38 #include <netinet/in.h>
39 
40 #include <ctype.h>
41 #include <errno.h>
42 #include <fcntl.h>
43 #include <netdb.h>
44 #include <poll.h>
45 #include <pwd.h>
46 #include <stdarg.h>
47 #include <stdlib.h>
48 #include <stdio.h>
49 #include <string.h>
50 #include <unistd.h>
51 
52 #ifdef WITH_SSL
53 #include <openssl/x509v3.h>
54 #endif
55 
56 #include "fetch.h"
57 #include "common.h"
58 
59 
60 /*** Local data **************************************************************/
61 
62 /*
63  * Error messages for resolver errors
64  */
65 static struct fetcherr netdb_errlist[] = {
66 #ifdef EAI_NODATA
67 	{ EAI_NODATA,	FETCH_RESOLV,	"Host not found" },
68 #endif
69 	{ EAI_AGAIN,	FETCH_TEMP,	"Transient resolver failure" },
70 	{ EAI_FAIL,	FETCH_RESOLV,	"Non-recoverable resolver failure" },
71 	{ EAI_NONAME,	FETCH_RESOLV,	"No address record" },
72 	{ -1,		FETCH_UNKNOWN,	"Unknown resolver error" }
73 };
74 
75 /* End-of-Line */
76 static const char ENDL[2] = "\r\n";
77 
78 
79 /*** Error-reporting functions ***********************************************/
80 
81 /*
82  * Map error code to string
83  */
84 static struct fetcherr *
85 fetch_finderr(struct fetcherr *p, int e)
86 {
87 	while (p->num != -1 && p->num != e)
88 		p++;
89 	return (p);
90 }
91 
92 /*
93  * Set error code
94  */
95 void
96 fetch_seterr(struct fetcherr *p, int e)
97 {
98 	p = fetch_finderr(p, e);
99 	fetchLastErrCode = p->cat;
100 	snprintf(fetchLastErrString, MAXERRSTRING, "%s", p->string);
101 }
102 
103 /*
104  * Set error code according to errno
105  */
106 void
107 fetch_syserr(void)
108 {
109 	switch (errno) {
110 	case 0:
111 		fetchLastErrCode = FETCH_OK;
112 		break;
113 	case EPERM:
114 	case EACCES:
115 	case EROFS:
116 	case EAUTH:
117 	case ENEEDAUTH:
118 		fetchLastErrCode = FETCH_AUTH;
119 		break;
120 	case ENOENT:
121 	case EISDIR: /* XXX */
122 		fetchLastErrCode = FETCH_UNAVAIL;
123 		break;
124 	case ENOMEM:
125 		fetchLastErrCode = FETCH_MEMORY;
126 		break;
127 	case EBUSY:
128 	case EAGAIN:
129 		fetchLastErrCode = FETCH_TEMP;
130 		break;
131 	case EEXIST:
132 		fetchLastErrCode = FETCH_EXISTS;
133 		break;
134 	case ENOSPC:
135 		fetchLastErrCode = FETCH_FULL;
136 		break;
137 	case EADDRINUSE:
138 	case EADDRNOTAVAIL:
139 	case ENETDOWN:
140 	case ENETUNREACH:
141 	case ENETRESET:
142 	case EHOSTUNREACH:
143 		fetchLastErrCode = FETCH_NETWORK;
144 		break;
145 	case ECONNABORTED:
146 	case ECONNRESET:
147 		fetchLastErrCode = FETCH_ABORT;
148 		break;
149 	case ETIMEDOUT:
150 		fetchLastErrCode = FETCH_TIMEOUT;
151 		break;
152 	case ECONNREFUSED:
153 	case EHOSTDOWN:
154 		fetchLastErrCode = FETCH_DOWN;
155 		break;
156 default:
157 		fetchLastErrCode = FETCH_UNKNOWN;
158 	}
159 	snprintf(fetchLastErrString, MAXERRSTRING, "%s", strerror(errno));
160 }
161 
162 
163 /*
164  * Emit status message
165  */
166 void
167 fetch_info(const char *fmt, ...)
168 {
169 	va_list ap;
170 
171 	va_start(ap, fmt);
172 	vfprintf(stderr, fmt, ap);
173 	va_end(ap);
174 	fputc('\n', stderr);
175 }
176 
177 
178 /*** Network-related utility functions ***************************************/
179 
180 /*
181  * Return the default port for a scheme
182  */
183 int
184 fetch_default_port(const char *scheme)
185 {
186 	struct servent *se;
187 
188 	if ((se = getservbyname(scheme, "tcp")) != NULL)
189 		return (ntohs(se->s_port));
190 	if (strcasecmp(scheme, SCHEME_FTP) == 0)
191 		return (FTP_DEFAULT_PORT);
192 	if (strcasecmp(scheme, SCHEME_HTTP) == 0)
193 		return (HTTP_DEFAULT_PORT);
194 	return (0);
195 }
196 
197 /*
198  * Return the default proxy port for a scheme
199  */
200 int
201 fetch_default_proxy_port(const char *scheme)
202 {
203 	if (strcasecmp(scheme, SCHEME_FTP) == 0)
204 		return (FTP_DEFAULT_PROXY_PORT);
205 	if (strcasecmp(scheme, SCHEME_HTTP) == 0)
206 		return (HTTP_DEFAULT_PROXY_PORT);
207 	return (0);
208 }
209 
210 
211 /*
212  * Create a connection for an existing descriptor.
213  */
214 conn_t *
215 fetch_reopen(int sd)
216 {
217 	conn_t *conn;
218 	int opt = 1;
219 
220 	/* allocate and fill connection structure */
221 	if ((conn = calloc(1, sizeof(*conn))) == NULL)
222 		return (NULL);
223 	fcntl(sd, F_SETFD, FD_CLOEXEC);
224 	setsockopt(sd, SOL_SOCKET, SO_NOSIGPIPE, &opt, sizeof opt);
225 	conn->sd = sd;
226 	++conn->ref;
227 	return (conn);
228 }
229 
230 
231 /*
232  * Bump a connection's reference count.
233  */
234 conn_t *
235 fetch_ref(conn_t *conn)
236 {
237 
238 	++conn->ref;
239 	return (conn);
240 }
241 
242 
243 /*
244  * Resolve an address
245  */
246 struct addrinfo *
247 fetch_resolve(const char *addr, int port, int af)
248 {
249 	char hbuf[256], sbuf[8];
250 	struct addrinfo hints, *res;
251 	const char *sep, *host, *service;
252 	int err, len;
253 
254 	/* split address if necessary */
255 	err = EAI_SYSTEM;
256 	if ((sep = strchr(addr, ':')) != NULL) {
257 		len = snprintf(hbuf, sizeof(hbuf),
258 		    "%.*s", (int)(sep - addr), addr);
259 		if (len < 0)
260 			return (NULL);
261 		if (len >= (int)sizeof(hbuf)) {
262 			errno = ENAMETOOLONG;
263 			fetch_syserr();
264 			return (NULL);
265 		}
266 		host = hbuf;
267 		service = sep + 1;
268 	} else if (port != 0) {
269 		if (port < 1 || port > 65535) {
270 			errno = EINVAL;
271 			fetch_syserr();
272 			return (NULL);
273 		}
274 		if (snprintf(sbuf, sizeof(sbuf), "%d", port) < 0) {
275 			fetch_syserr();
276 			return (NULL);
277 		}
278 		host = addr;
279 		service = sbuf;
280 	} else {
281 		host = addr;
282 		service = NULL;
283 	}
284 
285 	/* resolve */
286 	fetch_info("resolving host = %s service = %s af = %d",
287 	    host, service, af);
288 	memset(&hints, 0, sizeof(hints));
289 	hints.ai_family = af;
290 	hints.ai_socktype = SOCK_STREAM;
291 	hints.ai_flags = AI_ADDRCONFIG;
292 	if ((err = getaddrinfo(host, service, &hints, &res)) != 0) {
293 		netdb_seterr(err);
294 		fetch_info("getaddrinfo() failed: %s", gai_strerror(err));
295 		return (NULL);
296 	}
297 	fetch_info("getaddrinfo() succeeded %p", res);
298 	return (res);
299 }
300 
301 
302 
303 /*
304  * Bind a socket to a specific local address
305  */
306 int
307 fetch_bind(int sd, int af, const char *addr)
308 {
309 	struct addrinfo *cliai, *ai;
310 	int err;
311 
312 	if ((cliai = fetch_resolve(addr, 0, af)) == NULL)
313 		return (-1);
314 	for (ai = cliai; ai != NULL; ai = ai->ai_next)
315 		if ((err = bind(sd, ai->ai_addr, ai->ai_addrlen)) == 0)
316 			break;
317 	if (err != 0)
318 		fetch_syserr();
319 	freeaddrinfo(cliai);
320 	return (err == 0 ? 0 : -1);
321 }
322 
323 
324 /*
325  * Establish a TCP connection to the specified port on the specified host.
326  */
327 conn_t *
328 fetch_connect(const char *host, int port, int af, int verbose)
329 {
330 	struct addrinfo *cais = NULL, *sais = NULL, *cai, *sai;
331 	const char *bindaddr;
332 	conn_t *conn = NULL;
333 	int err = 0, sd = -1;
334 
335 	DEBUG(fprintf(stderr, "---> %s:%d\n", host, port));
336 
337 	/* resolve server address */
338 	if (verbose)
339 		fetch_info("resolving server address: %s:%d", host, port);
340 	if ((sais = fetch_resolve(host, port, af)) == NULL)
341 		goto fail;
342 	fetch_info("resolved");
343 
344 	/* resolve client address */
345 	bindaddr = getenv("FETCH_BIND_ADDRESS");
346 	if (bindaddr != NULL && *bindaddr != '\0') {
347 		if (verbose)
348 			fetch_info("resolving client address: %s", bindaddr);
349 		if ((cais = fetch_resolve(bindaddr, 0, af)) == NULL)
350 			goto fail;
351 	}
352 
353 	/* try each server address in turn */
354 	for (err = 0, sai = sais; sai != NULL; sai = sai->ai_next) {
355 		/* open socket */
356 		if ((sd = socket(sai->ai_family, SOCK_STREAM, 0)) < 0)
357 			goto syserr;
358 		/* attempt to bind to client address */
359 		for (err = 0, cai = cais; cai != NULL; cai = cai->ai_next) {
360 			if (cai->ai_family != sai->ai_family)
361 				continue;
362 			if ((err = bind(sd, cai->ai_addr, cai->ai_addrlen)) == 0)
363 				break;
364 		}
365 		if (err != 0) {
366 			if (verbose)
367 				fetch_info("failed to bind to %s", bindaddr);
368 			goto syserr;
369 		}
370 		/* attempt to connect to server address */
371 		if ((err = connect(sd, sai->ai_addr, sai->ai_addrlen)) == 0)
372 			break;
373 		/* clean up before next attempt */
374 		close(sd);
375 		sd = -1;
376 	}
377 	if (err != 0) {
378 		if (verbose)
379 			fetch_info("failed to connect to %s:%s", host, port);
380 		goto syserr;
381 	}
382 
383 	if ((conn = fetch_reopen(sd)) == NULL)
384 		goto syserr;
385 	if (cais != NULL)
386 		freeaddrinfo(cais);
387 	if (sais != NULL)
388 		freeaddrinfo(sais);
389 	return (conn);
390 syserr:
391 	fetch_syserr();
392 	goto fail;
393 fail:
394 	if (sd >= 0)
395 		close(sd);
396 	if (cais != NULL)
397 		freeaddrinfo(cais);
398 	if (sais != NULL)
399 		freeaddrinfo(sais);
400 	return (NULL);
401 }
402 
403 #ifdef WITH_SSL
404 /*
405  * Convert characters A-Z to lowercase (intentionally avoid any locale
406  * specific conversions).
407  */
408 static char
409 fetch_ssl_tolower(char in)
410 {
411 	if (in >= 'A' && in <= 'Z')
412 		return (in + 32);
413 	else
414 		return (in);
415 }
416 
417 /*
418  * isalpha implementation that intentionally avoids any locale specific
419  * conversions.
420  */
421 static int
422 fetch_ssl_isalpha(char in)
423 {
424 	return ((in >= 'A' && in <= 'Z') || (in >= 'a' && in <= 'z'));
425 }
426 
427 /*
428  * Check if passed hostnames a and b are equal.
429  */
430 static int
431 fetch_ssl_hname_equal(const char *a, size_t alen, const char *b,
432     size_t blen)
433 {
434 	size_t i;
435 
436 	if (alen != blen)
437 		return (0);
438 	for (i = 0; i < alen; ++i) {
439 		if (fetch_ssl_tolower(a[i]) != fetch_ssl_tolower(b[i]))
440 			return (0);
441 	}
442 	return (1);
443 }
444 
445 /*
446  * Check if domain label is traditional, meaning that only A-Z, a-z, 0-9
447  * and '-' (hyphen) are allowed. Hyphens have to be surrounded by alpha-
448  * numeric characters. Double hyphens (like they're found in IDN a-labels
449  * 'xn--') are not allowed. Empty labels are invalid.
450  */
451 static int
452 fetch_ssl_is_trad_domain_label(const char *l, size_t len, int wcok)
453 {
454 	size_t i;
455 
456 	if (!len || l[0] == '-' || l[len-1] == '-')
457 		return (0);
458 	for (i = 0; i < len; ++i) {
459 		if (!isdigit(l[i]) &&
460 		    !fetch_ssl_isalpha(l[i]) &&
461 		    !(l[i] == '*' && wcok) &&
462 		    !(l[i] == '-' && l[i - 1] != '-'))
463 			return (0);
464 	}
465 	return (1);
466 }
467 
468 /*
469  * Check if host name consists only of numbers. This might indicate an IP
470  * address, which is not a good idea for CN wildcard comparison.
471  */
472 static int
473 fetch_ssl_hname_is_only_numbers(const char *hostname, size_t len)
474 {
475 	size_t i;
476 
477 	for (i = 0; i < len; ++i) {
478 		if (!((hostname[i] >= '0' && hostname[i] <= '9') ||
479 		    hostname[i] == '.'))
480 			return (0);
481 	}
482 	return (1);
483 }
484 
485 /*
486  * Check if the host name h passed matches the pattern passed in m which
487  * is usually part of subjectAltName or CN of a certificate presented to
488  * the client. This includes wildcard matching. The algorithm is based on
489  * RFC6125, sections 6.4.3 and 7.2, which clarifies RFC2818 and RFC3280.
490  */
491 static int
492 fetch_ssl_hname_match(const char *h, size_t hlen, const char *m,
493     size_t mlen)
494 {
495 	int delta, hdotidx, mdot1idx, wcidx;
496 	const char *hdot, *mdot1, *mdot2;
497 	const char *wc; /* wildcard */
498 
499 	if (!(h && *h && m && *m))
500 		return (0);
501 	if ((wc = strnstr(m, "*", mlen)) == NULL)
502 		return (fetch_ssl_hname_equal(h, hlen, m, mlen));
503 	wcidx = wc - m;
504 	/* hostname should not be just dots and numbers */
505 	if (fetch_ssl_hname_is_only_numbers(h, hlen))
506 		return (0);
507 	/* only one wildcard allowed in pattern */
508 	if (strnstr(wc + 1, "*", mlen - wcidx - 1) != NULL)
509 		return (0);
510 	/*
511 	 * there must be at least two more domain labels and
512 	 * wildcard has to be in the leftmost label (RFC6125)
513 	 */
514 	mdot1 = strnstr(m, ".", mlen);
515 	if (mdot1 == NULL || mdot1 < wc || (mlen - (mdot1 - m)) < 4)
516 		return (0);
517 	mdot1idx = mdot1 - m;
518 	mdot2 = strnstr(mdot1 + 1, ".", mlen - mdot1idx - 1);
519 	if (mdot2 == NULL || (mlen - (mdot2 - m)) < 2)
520 		return (0);
521 	/* hostname must contain a dot and not be the 1st char */
522 	hdot = strnstr(h, ".", hlen);
523 	if (hdot == NULL || hdot == h)
524 		return (0);
525 	hdotidx = hdot - h;
526 	/*
527 	 * host part of hostname must be at least as long as
528 	 * pattern it's supposed to match
529 	 */
530 	if (hdotidx < mdot1idx)
531 		return (0);
532 	/*
533 	 * don't allow wildcards in non-traditional domain names
534 	 * (IDN, A-label, U-label...)
535 	 */
536 	if (!fetch_ssl_is_trad_domain_label(h, hdotidx, 0) ||
537 	    !fetch_ssl_is_trad_domain_label(m, mdot1idx, 1))
538 		return (0);
539 	/* match domain part (part after first dot) */
540 	if (!fetch_ssl_hname_equal(hdot, hlen - hdotidx, mdot1,
541 	    mlen - mdot1idx))
542 		return (0);
543 	/* match part left of wildcard */
544 	if (!fetch_ssl_hname_equal(h, wcidx, m, wcidx))
545 		return (0);
546 	/* match part right of wildcard */
547 	delta = mdot1idx - wcidx - 1;
548 	if (!fetch_ssl_hname_equal(hdot - delta, delta,
549 	    mdot1 - delta, delta))
550 		return (0);
551 	/* all tests succeeded, it's a match */
552 	return (1);
553 }
554 
555 /*
556  * Get numeric host address info - returns NULL if host was not an IP
557  * address. The caller is responsible for deallocation using
558  * freeaddrinfo(3).
559  */
560 static struct addrinfo *
561 fetch_ssl_get_numeric_addrinfo(const char *hostname, size_t len)
562 {
563 	struct addrinfo hints, *res;
564 	char *host;
565 
566 	host = (char *)malloc(len + 1);
567 	memcpy(host, hostname, len);
568 	host[len] = '\0';
569 	memset(&hints, 0, sizeof(hints));
570 	hints.ai_family = PF_UNSPEC;
571 	hints.ai_socktype = SOCK_STREAM;
572 	hints.ai_protocol = 0;
573 	hints.ai_flags = AI_NUMERICHOST;
574 	/* port is not relevant for this purpose */
575 	if (getaddrinfo(host, "443", &hints, &res) != 0)
576 		res = NULL;
577 	free(host);
578 	return res;
579 }
580 
581 /*
582  * Compare ip address in addrinfo with address passes.
583  */
584 static int
585 fetch_ssl_ipaddr_match_bin(const struct addrinfo *lhost, const char *rhost,
586     size_t rhostlen)
587 {
588 	const void *left;
589 
590 	if (lhost->ai_family == AF_INET && rhostlen == 4) {
591 		left = (void *)&((struct sockaddr_in*)(void *)
592 		    lhost->ai_addr)->sin_addr.s_addr;
593 #ifdef INET6
594 	} else if (lhost->ai_family == AF_INET6 && rhostlen == 16) {
595 		left = (void *)&((struct sockaddr_in6 *)(void *)
596 		    lhost->ai_addr)->sin6_addr;
597 #endif
598 	} else
599 		return (0);
600 	return (!memcmp(left, (const void *)rhost, rhostlen) ? 1 : 0);
601 }
602 
603 /*
604  * Compare ip address in addrinfo with host passed. If host is not an IP
605  * address, comparison will fail.
606  */
607 static int
608 fetch_ssl_ipaddr_match(const struct addrinfo *laddr, const char *r,
609     size_t rlen)
610 {
611 	struct addrinfo *raddr;
612 	int ret;
613 	char *rip;
614 
615 	ret = 0;
616 	if ((raddr = fetch_ssl_get_numeric_addrinfo(r, rlen)) == NULL)
617 		return 0; /* not a numeric host */
618 
619 	if (laddr->ai_family == raddr->ai_family) {
620 		if (laddr->ai_family == AF_INET) {
621 			rip = (char *)&((struct sockaddr_in *)(void *)
622 			    raddr->ai_addr)->sin_addr.s_addr;
623 			ret = fetch_ssl_ipaddr_match_bin(laddr, rip, 4);
624 #ifdef INET6
625 		} else if (laddr->ai_family == AF_INET6) {
626 			rip = (char *)&((struct sockaddr_in6 *)(void *)
627 			    raddr->ai_addr)->sin6_addr;
628 			ret = fetch_ssl_ipaddr_match_bin(laddr, rip, 16);
629 #endif
630 		}
631 
632 	}
633 	freeaddrinfo(raddr);
634 	return (ret);
635 }
636 
637 /*
638  * Verify server certificate by subjectAltName.
639  */
640 static int
641 fetch_ssl_verify_altname(STACK_OF(GENERAL_NAME) *altnames,
642     const char *host, struct addrinfo *ip)
643 {
644 	const GENERAL_NAME *name;
645 	size_t nslen;
646 	int i;
647 	const char *ns;
648 
649 	for (i = 0; i < sk_GENERAL_NAME_num(altnames); ++i) {
650 #if OPENSSL_VERSION_NUMBER < 0x10000000L
651 		/*
652 		 * This is a workaround, since the following line causes
653 		 * alignment issues in clang:
654 		 * name = sk_GENERAL_NAME_value(altnames, i);
655 		 * OpenSSL explicitly warns not to use those macros
656 		 * directly, but there isn't much choice (and there
657 		 * shouldn't be any ill side effects)
658 		 */
659 		name = (GENERAL_NAME *)SKM_sk_value(void, altnames, i);
660 #else
661 		name = sk_GENERAL_NAME_value(altnames, i);
662 #endif
663 		ns = (const char *)ASN1_STRING_data(name->d.ia5);
664 		nslen = (size_t)ASN1_STRING_length(name->d.ia5);
665 
666 		if (name->type == GEN_DNS && ip == NULL &&
667 		    fetch_ssl_hname_match(host, strlen(host), ns, nslen))
668 			return (1);
669 		else if (name->type == GEN_IPADD && ip != NULL &&
670 		    fetch_ssl_ipaddr_match_bin(ip, ns, nslen))
671 			return (1);
672 	}
673 	return (0);
674 }
675 
676 /*
677  * Verify server certificate by CN.
678  */
679 static int
680 fetch_ssl_verify_cn(X509_NAME *subject, const char *host,
681     struct addrinfo *ip)
682 {
683 	ASN1_STRING *namedata;
684 	X509_NAME_ENTRY *nameentry;
685 	int cnlen, lastpos, loc, ret;
686 	unsigned char *cn;
687 
688 	ret = 0;
689 	lastpos = -1;
690 	loc = -1;
691 	cn = NULL;
692 	/* get most specific CN (last entry in list) and compare */
693 	while ((lastpos = X509_NAME_get_index_by_NID(subject,
694 	    NID_commonName, lastpos)) != -1)
695 		loc = lastpos;
696 
697 	if (loc > -1) {
698 		nameentry = X509_NAME_get_entry(subject, loc);
699 		namedata = X509_NAME_ENTRY_get_data(nameentry);
700 		cnlen = ASN1_STRING_to_UTF8(&cn, namedata);
701 		if (ip == NULL &&
702 		    fetch_ssl_hname_match(host, strlen(host), cn, cnlen))
703 			ret = 1;
704 		else if (ip != NULL && fetch_ssl_ipaddr_match(ip, cn, cnlen))
705 			ret = 1;
706 		OPENSSL_free(cn);
707 	}
708 	return (ret);
709 }
710 
711 /*
712  * Verify that server certificate subjectAltName/CN matches
713  * hostname. First check, if there are alternative subject names. If yes,
714  * those have to match. Only if those don't exist it falls back to
715  * checking the subject's CN.
716  */
717 static int
718 fetch_ssl_verify_hname(X509 *cert, const char *host)
719 {
720 	struct addrinfo *ip;
721 	STACK_OF(GENERAL_NAME) *altnames;
722 	X509_NAME *subject;
723 	int ret;
724 
725 	ret = 0;
726 	ip = fetch_ssl_get_numeric_addrinfo(host, strlen(host));
727 	altnames = X509_get_ext_d2i(cert, NID_subject_alt_name,
728 	    NULL, NULL);
729 
730 	if (altnames != NULL) {
731 		ret = fetch_ssl_verify_altname(altnames, host, ip);
732 	} else {
733 		subject = X509_get_subject_name(cert);
734 		if (subject != NULL)
735 			ret = fetch_ssl_verify_cn(subject, host, ip);
736 	}
737 
738 	if (ip != NULL)
739 		freeaddrinfo(ip);
740 	if (altnames != NULL)
741 		GENERAL_NAMES_free(altnames);
742 	return (ret);
743 }
744 
745 /*
746  * Configure transport security layer based on environment.
747  */
748 static void
749 fetch_ssl_setup_transport_layer(SSL_CTX *ctx, int verbose)
750 {
751 	long ssl_ctx_options;
752 
753 	ssl_ctx_options = SSL_OP_ALL | SSL_OP_NO_SSLv2 | SSL_OP_NO_TICKET;
754 	if (getenv("SSL_ALLOW_SSL3") == NULL)
755 		ssl_ctx_options |= SSL_OP_NO_SSLv3;
756 	if (getenv("SSL_NO_TLS1") != NULL)
757 		ssl_ctx_options |= SSL_OP_NO_TLSv1;
758 	if (getenv("SSL_NO_TLS1_1") != NULL)
759 		ssl_ctx_options |= SSL_OP_NO_TLSv1_1;
760 	if (getenv("SSL_NO_TLS1_2") != NULL)
761 		ssl_ctx_options |= SSL_OP_NO_TLSv1_2;
762 	if (verbose)
763 		fetch_info("SSL options: %lx", ssl_ctx_options);
764 	SSL_CTX_set_options(ctx, ssl_ctx_options);
765 }
766 
767 
768 /*
769  * Configure peer verification based on environment.
770  */
771 #define LOCAL_CERT_FILE	"/usr/local/etc/ssl/cert.pem"
772 #define BASE_CERT_FILE	"/etc/ssl/cert.pem"
773 static int
774 fetch_ssl_setup_peer_verification(SSL_CTX *ctx, int verbose)
775 {
776 	X509_LOOKUP *crl_lookup;
777 	X509_STORE *crl_store;
778 	const char *ca_cert_file, *ca_cert_path, *crl_file;
779 
780 	if (getenv("SSL_NO_VERIFY_PEER") == NULL) {
781 		ca_cert_file = getenv("SSL_CA_CERT_FILE");
782 		if (ca_cert_file == NULL &&
783 		    access(LOCAL_CERT_FILE, R_OK) == 0)
784 			ca_cert_file = LOCAL_CERT_FILE;
785 		if (ca_cert_file == NULL &&
786 		    access(BASE_CERT_FILE, R_OK) == 0)
787 			ca_cert_file = BASE_CERT_FILE;
788 		ca_cert_path = getenv("SSL_CA_CERT_PATH");
789 		if (verbose) {
790 			fetch_info("Peer verification enabled");
791 			if (ca_cert_file != NULL)
792 				fetch_info("Using CA cert file: %s",
793 				    ca_cert_file);
794 			if (ca_cert_path != NULL)
795 				fetch_info("Using CA cert path: %s",
796 				    ca_cert_path);
797 			if (ca_cert_file == NULL && ca_cert_path == NULL)
798 				fetch_info("Using OpenSSL default "
799 				    "CA cert file and path");
800 		}
801 		SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER,
802 		    fetch_ssl_cb_verify_crt);
803 		if (ca_cert_file != NULL || ca_cert_path != NULL)
804 			SSL_CTX_load_verify_locations(ctx, ca_cert_file,
805 			    ca_cert_path);
806 		else
807 			SSL_CTX_set_default_verify_paths(ctx);
808 		if ((crl_file = getenv("SSL_CRL_FILE")) != NULL) {
809 			if (verbose)
810 				fetch_info("Using CRL file: %s", crl_file);
811 			crl_store = SSL_CTX_get_cert_store(ctx);
812 			crl_lookup = X509_STORE_add_lookup(crl_store,
813 			    X509_LOOKUP_file());
814 			if (crl_lookup == NULL ||
815 			    !X509_load_crl_file(crl_lookup, crl_file,
816 				X509_FILETYPE_PEM)) {
817 				fprintf(stderr,
818 				    "Could not load CRL file %s\n",
819 				    crl_file);
820 				return (0);
821 			}
822 			X509_STORE_set_flags(crl_store,
823 			    X509_V_FLAG_CRL_CHECK |
824 			    X509_V_FLAG_CRL_CHECK_ALL);
825 		}
826 	}
827 	return (1);
828 }
829 
830 /*
831  * Configure client certificate based on environment.
832  */
833 static int
834 fetch_ssl_setup_client_certificate(SSL_CTX *ctx, int verbose)
835 {
836 	const char *client_cert_file, *client_key_file;
837 
838 	if ((client_cert_file = getenv("SSL_CLIENT_CERT_FILE")) != NULL) {
839 		client_key_file = getenv("SSL_CLIENT_KEY_FILE") != NULL ?
840 		    getenv("SSL_CLIENT_KEY_FILE") : client_cert_file;
841 		if (verbose) {
842 			fetch_info("Using client cert file: %s",
843 			    client_cert_file);
844 			fetch_info("Using client key file: %s",
845 			    client_key_file);
846 		}
847 		if (SSL_CTX_use_certificate_chain_file(ctx,
848 			client_cert_file) != 1) {
849 			fprintf(stderr,
850 			    "Could not load client certificate %s\n",
851 			    client_cert_file);
852 			return (0);
853 		}
854 		if (SSL_CTX_use_PrivateKey_file(ctx, client_key_file,
855 			SSL_FILETYPE_PEM) != 1) {
856 			fprintf(stderr,
857 			    "Could not load client key %s\n",
858 			    client_key_file);
859 			return (0);
860 		}
861 	}
862 	return (1);
863 }
864 
865 /*
866  * Callback for SSL certificate verification, this is called on server
867  * cert verification. It takes no decision, but informs the user in case
868  * verification failed.
869  */
870 int
871 fetch_ssl_cb_verify_crt(int verified, X509_STORE_CTX *ctx)
872 {
873 	X509 *crt;
874 	X509_NAME *name;
875 	char *str;
876 
877 	str = NULL;
878 	if (!verified) {
879 		if ((crt = X509_STORE_CTX_get_current_cert(ctx)) != NULL &&
880 		    (name = X509_get_subject_name(crt)) != NULL)
881 			str = X509_NAME_oneline(name, 0, 0);
882 		fprintf(stderr, "Certificate verification failed for %s\n",
883 		    str != NULL ? str : "no relevant certificate");
884 		OPENSSL_free(str);
885 	}
886 	return (verified);
887 }
888 
889 #endif
890 
891 /*
892  * Enable SSL on a connection.
893  */
894 int
895 fetch_ssl(conn_t *conn, const struct url *URL, int verbose)
896 {
897 #ifdef WITH_SSL
898 	int ret, ssl_err;
899 	X509_NAME *name;
900 	char *str;
901 
902 	/* Init the SSL library and context */
903 	if (!SSL_library_init()){
904 		fprintf(stderr, "SSL library init failed\n");
905 		return (-1);
906 	}
907 
908 	SSL_load_error_strings();
909 
910 	conn->ssl_meth = SSLv23_client_method();
911 	conn->ssl_ctx = SSL_CTX_new(conn->ssl_meth);
912 	SSL_CTX_set_mode(conn->ssl_ctx, SSL_MODE_AUTO_RETRY);
913 
914 	fetch_ssl_setup_transport_layer(conn->ssl_ctx, verbose);
915 	if (!fetch_ssl_setup_peer_verification(conn->ssl_ctx, verbose))
916 		return (-1);
917 	if (!fetch_ssl_setup_client_certificate(conn->ssl_ctx, verbose))
918 		return (-1);
919 
920 	conn->ssl = SSL_new(conn->ssl_ctx);
921 	if (conn->ssl == NULL) {
922 		fprintf(stderr, "SSL context creation failed\n");
923 		return (-1);
924 	}
925 	SSL_set_fd(conn->ssl, conn->sd);
926 
927 #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
928 	if (!SSL_set_tlsext_host_name(conn->ssl,
929 	    __DECONST(struct url *, URL)->host)) {
930 		fprintf(stderr,
931 		    "TLS server name indication extension failed for host %s\n",
932 		    URL->host);
933 		return (-1);
934 	}
935 #endif
936 	while ((ret = SSL_connect(conn->ssl)) == -1) {
937 		ssl_err = SSL_get_error(conn->ssl, ret);
938 		if (ssl_err != SSL_ERROR_WANT_READ &&
939 		    ssl_err != SSL_ERROR_WANT_WRITE) {
940 			ERR_print_errors_fp(stderr);
941 			return (-1);
942 		}
943 	}
944 	conn->ssl_cert = SSL_get_peer_certificate(conn->ssl);
945 
946 	if (conn->ssl_cert == NULL) {
947 		fprintf(stderr, "No server SSL certificate\n");
948 		return (-1);
949 	}
950 
951 	if (getenv("SSL_NO_VERIFY_HOSTNAME") == NULL) {
952 		if (verbose)
953 			fetch_info("Verify hostname");
954 		if (!fetch_ssl_verify_hname(conn->ssl_cert, URL->host)) {
955 			fprintf(stderr,
956 			    "SSL certificate subject doesn't match host %s\n",
957 			    URL->host);
958 			return (-1);
959 		}
960 	}
961 
962 	if (verbose) {
963 		fetch_info("%s connection established using %s",
964 		    SSL_get_version(conn->ssl), SSL_get_cipher(conn->ssl));
965 		name = X509_get_subject_name(conn->ssl_cert);
966 		str = X509_NAME_oneline(name, 0, 0);
967 		fetch_info("Certificate subject: %s", str);
968 		OPENSSL_free(str);
969 		name = X509_get_issuer_name(conn->ssl_cert);
970 		str = X509_NAME_oneline(name, 0, 0);
971 		fetch_info("Certificate issuer: %s", str);
972 		OPENSSL_free(str);
973 	}
974 
975 	return (0);
976 #else
977 	(void)conn;
978 	(void)verbose;
979 	fprintf(stderr, "SSL support disabled\n");
980 	return (-1);
981 #endif
982 }
983 
984 #define FETCH_READ_WAIT		-2
985 #define FETCH_READ_ERROR	-1
986 #define FETCH_READ_DONE		 0
987 
988 #ifdef WITH_SSL
989 static ssize_t
990 fetch_ssl_read(SSL *ssl, char *buf, size_t len)
991 {
992 	ssize_t rlen;
993 	int ssl_err;
994 
995 	rlen = SSL_read(ssl, buf, len);
996 	if (rlen < 0) {
997 		ssl_err = SSL_get_error(ssl, rlen);
998 		if (ssl_err == SSL_ERROR_WANT_READ ||
999 		    ssl_err == SSL_ERROR_WANT_WRITE) {
1000 			return (FETCH_READ_WAIT);
1001 		} else {
1002 			ERR_print_errors_fp(stderr);
1003 			return (FETCH_READ_ERROR);
1004 		}
1005 	}
1006 	return (rlen);
1007 }
1008 #endif
1009 
1010 static ssize_t
1011 fetch_socket_read(int sd, char *buf, size_t len)
1012 {
1013 	ssize_t rlen;
1014 
1015 	rlen = read(sd, buf, len);
1016 	if (rlen < 0) {
1017 		if (errno == EAGAIN || (errno == EINTR && fetchRestartCalls))
1018 			return (FETCH_READ_WAIT);
1019 		else
1020 			return (FETCH_READ_ERROR);
1021 	}
1022 	return (rlen);
1023 }
1024 
1025 /*
1026  * Read a character from a connection w/ timeout
1027  */
1028 ssize_t
1029 fetch_read(conn_t *conn, char *buf, size_t len)
1030 {
1031 	struct timeval now, timeout, delta;
1032 	struct pollfd pfd;
1033 	ssize_t rlen;
1034 	int deltams;
1035 
1036 	if (fetchTimeout > 0) {
1037 		gettimeofday(&timeout, NULL);
1038 		timeout.tv_sec += fetchTimeout;
1039 	}
1040 
1041 	deltams = INFTIM;
1042 	memset(&pfd, 0, sizeof pfd);
1043 	pfd.fd = conn->sd;
1044 	pfd.events = POLLIN | POLLERR;
1045 
1046 	for (;;) {
1047 		/*
1048 		 * The socket is non-blocking.  Instead of the canonical
1049 		 * poll() -> read(), we do the following:
1050 		 *
1051 		 * 1) call read() or SSL_read().
1052 		 * 2) if we received some data, return it.
1053 		 * 3) if an error occurred, return -1.
1054 		 * 4) if read() or SSL_read() signaled EOF, return.
1055 		 * 5) if we did not receive any data but we're not at EOF,
1056 		 *    call poll().
1057 		 *
1058 		 * In the SSL case, this is necessary because if we
1059 		 * receive a close notification, we have to call
1060 		 * SSL_read() one additional time after we've read
1061 		 * everything we received.
1062 		 *
1063 		 * In the non-SSL case, it may improve performance (very
1064 		 * slightly) when reading small amounts of data.
1065 		 */
1066 #ifdef WITH_SSL
1067 		if (conn->ssl != NULL)
1068 			rlen = fetch_ssl_read(conn->ssl, buf, len);
1069 		else
1070 #endif
1071 			rlen = fetch_socket_read(conn->sd, buf, len);
1072 		if (rlen >= 0) {
1073 			break;
1074 		} else if (rlen == FETCH_READ_ERROR) {
1075 			fetch_syserr();
1076 			return (-1);
1077 		}
1078 		// assert(rlen == FETCH_READ_WAIT);
1079 		if (fetchTimeout > 0) {
1080 			gettimeofday(&now, NULL);
1081 			if (!timercmp(&timeout, &now, >)) {
1082 				errno = ETIMEDOUT;
1083 				fetch_syserr();
1084 				return (-1);
1085 			}
1086 			timersub(&timeout, &now, &delta);
1087 			deltams = delta.tv_sec * 1000 +
1088 			    delta.tv_usec / 1000;;
1089 		}
1090 		errno = 0;
1091 		pfd.revents = 0;
1092 		if (poll(&pfd, 1, deltams) < 0) {
1093 			if (errno == EINTR && fetchRestartCalls)
1094 				continue;
1095 			fetch_syserr();
1096 			return (-1);
1097 		}
1098 	}
1099 	return (rlen);
1100 }
1101 
1102 
1103 /*
1104  * Read a line of text from a connection w/ timeout
1105  */
1106 #define MIN_BUF_SIZE 1024
1107 
1108 int
1109 fetch_getln(conn_t *conn)
1110 {
1111 	char *tmp;
1112 	size_t tmpsize;
1113 	ssize_t len;
1114 	char c;
1115 
1116 	if (conn->buf == NULL) {
1117 		if ((conn->buf = malloc(MIN_BUF_SIZE)) == NULL) {
1118 			errno = ENOMEM;
1119 			return (-1);
1120 		}
1121 		conn->bufsize = MIN_BUF_SIZE;
1122 	}
1123 
1124 	conn->buf[0] = '\0';
1125 	conn->buflen = 0;
1126 
1127 	do {
1128 		len = fetch_read(conn, &c, 1);
1129 		if (len == -1)
1130 			return (-1);
1131 		if (len == 0)
1132 			break;
1133 		conn->buf[conn->buflen++] = c;
1134 		if (conn->buflen == conn->bufsize) {
1135 			tmp = conn->buf;
1136 			tmpsize = conn->bufsize * 2 + 1;
1137 			if ((tmp = realloc(tmp, tmpsize)) == NULL) {
1138 				errno = ENOMEM;
1139 				return (-1);
1140 			}
1141 			conn->buf = tmp;
1142 			conn->bufsize = tmpsize;
1143 		}
1144 	} while (c != '\n');
1145 
1146 	conn->buf[conn->buflen] = '\0';
1147 	DEBUG(fprintf(stderr, "<<< %s", conn->buf));
1148 	return (0);
1149 }
1150 
1151 
1152 /*
1153  * Write to a connection w/ timeout
1154  */
1155 ssize_t
1156 fetch_write(conn_t *conn, const char *buf, size_t len)
1157 {
1158 	struct iovec iov;
1159 
1160 	iov.iov_base = __DECONST(char *, buf);
1161 	iov.iov_len = len;
1162 	return fetch_writev(conn, &iov, 1);
1163 }
1164 
1165 /*
1166  * Write a vector to a connection w/ timeout
1167  * Note: can modify the iovec.
1168  */
1169 ssize_t
1170 fetch_writev(conn_t *conn, struct iovec *iov, int iovcnt)
1171 {
1172 	struct timeval now, timeout, delta;
1173 	struct pollfd pfd;
1174 	ssize_t wlen, total;
1175 	int deltams;
1176 
1177 	memset(&pfd, 0, sizeof pfd);
1178 	if (fetchTimeout) {
1179 		pfd.fd = conn->sd;
1180 		pfd.events = POLLOUT | POLLERR;
1181 		gettimeofday(&timeout, NULL);
1182 		timeout.tv_sec += fetchTimeout;
1183 	}
1184 
1185 	total = 0;
1186 	while (iovcnt > 0) {
1187 		while (fetchTimeout && pfd.revents == 0) {
1188 			gettimeofday(&now, NULL);
1189 			if (!timercmp(&timeout, &now, >)) {
1190 				errno = ETIMEDOUT;
1191 				fetch_syserr();
1192 				return (-1);
1193 			}
1194 			timersub(&timeout, &now, &delta);
1195 			deltams = delta.tv_sec * 1000 +
1196 			    delta.tv_usec / 1000;
1197 			errno = 0;
1198 			pfd.revents = 0;
1199 			if (poll(&pfd, 1, deltams) < 0) {
1200 				/* POSIX compliance */
1201 				if (errno == EAGAIN)
1202 					continue;
1203 				if (errno == EINTR && fetchRestartCalls)
1204 					continue;
1205 				return (-1);
1206 			}
1207 		}
1208 		errno = 0;
1209 #ifdef WITH_SSL
1210 		if (conn->ssl != NULL)
1211 			wlen = SSL_write(conn->ssl,
1212 			    iov->iov_base, iov->iov_len);
1213 		else
1214 #endif
1215 			wlen = writev(conn->sd, iov, iovcnt);
1216 		if (wlen == 0) {
1217 			/* we consider a short write a failure */
1218 			/* XXX perhaps we shouldn't in the SSL case */
1219 			errno = EPIPE;
1220 			fetch_syserr();
1221 			return (-1);
1222 		}
1223 		if (wlen < 0) {
1224 			if (errno == EINTR && fetchRestartCalls)
1225 				continue;
1226 			return (-1);
1227 		}
1228 		total += wlen;
1229 		while (iovcnt > 0 && wlen >= (ssize_t)iov->iov_len) {
1230 			wlen -= iov->iov_len;
1231 			iov++;
1232 			iovcnt--;
1233 		}
1234 		if (iovcnt > 0) {
1235 			iov->iov_len -= wlen;
1236 			iov->iov_base = __DECONST(char *, iov->iov_base) + wlen;
1237 		}
1238 	}
1239 	return (total);
1240 }
1241 
1242 
1243 /*
1244  * Write a line of text to a connection w/ timeout
1245  */
1246 int
1247 fetch_putln(conn_t *conn, const char *str, size_t len)
1248 {
1249 	struct iovec iov[2];
1250 	int ret;
1251 
1252 	DEBUG(fprintf(stderr, ">>> %s\n", str));
1253 	iov[0].iov_base = __DECONST(char *, str);
1254 	iov[0].iov_len = len;
1255 	iov[1].iov_base = __DECONST(char *, ENDL);
1256 	iov[1].iov_len = sizeof(ENDL);
1257 	if (len == 0)
1258 		ret = fetch_writev(conn, &iov[1], 1);
1259 	else
1260 		ret = fetch_writev(conn, iov, 2);
1261 	if (ret == -1)
1262 		return (-1);
1263 	return (0);
1264 }
1265 
1266 
1267 /*
1268  * Close connection
1269  */
1270 int
1271 fetch_close(conn_t *conn)
1272 {
1273 	int ret;
1274 
1275 	if (--conn->ref > 0)
1276 		return (0);
1277 #ifdef WITH_SSL
1278 	if (conn->ssl) {
1279 		SSL_shutdown(conn->ssl);
1280 		SSL_set_connect_state(conn->ssl);
1281 		SSL_free(conn->ssl);
1282 		conn->ssl = NULL;
1283 	}
1284 	if (conn->ssl_ctx) {
1285 		SSL_CTX_free(conn->ssl_ctx);
1286 		conn->ssl_ctx = NULL;
1287 	}
1288 	if (conn->ssl_cert) {
1289 		X509_free(conn->ssl_cert);
1290 		conn->ssl_cert = NULL;
1291 	}
1292 #endif
1293 	ret = close(conn->sd);
1294 	free(conn->buf);
1295 	free(conn);
1296 	return (ret);
1297 }
1298 
1299 
1300 /*** Directory-related utility functions *************************************/
1301 
1302 int
1303 fetch_add_entry(struct url_ent **p, int *size, int *len,
1304     const char *name, struct url_stat *us)
1305 {
1306 	struct url_ent *tmp;
1307 
1308 	if (*p == NULL) {
1309 		*size = 0;
1310 		*len = 0;
1311 	}
1312 
1313 	if (*len >= *size - 1) {
1314 		tmp = realloc(*p, (*size * 2 + 1) * sizeof(**p));
1315 		if (tmp == NULL) {
1316 			errno = ENOMEM;
1317 			fetch_syserr();
1318 			return (-1);
1319 		}
1320 		*size = (*size * 2 + 1);
1321 		*p = tmp;
1322 	}
1323 
1324 	tmp = *p + *len;
1325 	snprintf(tmp->name, PATH_MAX, "%s", name);
1326 	memcpy(&tmp->stat, us, sizeof(*us));
1327 
1328 	(*len)++;
1329 	(++tmp)->name[0] = 0;
1330 
1331 	return (0);
1332 }
1333 
1334 
1335 /*** Authentication-related utility functions ********************************/
1336 
1337 static const char *
1338 fetch_read_word(FILE *f)
1339 {
1340 	static char word[1024];
1341 
1342 	if (fscanf(f, " %1023s ", word) != 1)
1343 		return (NULL);
1344 	return (word);
1345 }
1346 
1347 /*
1348  * Get authentication data for a URL from .netrc
1349  */
1350 int
1351 fetch_netrc_auth(struct url *url)
1352 {
1353 	char fn[PATH_MAX];
1354 	const char *word;
1355 	char *p;
1356 	FILE *f;
1357 
1358 	if ((p = getenv("NETRC")) != NULL) {
1359 		if (snprintf(fn, sizeof(fn), "%s", p) >= (int)sizeof(fn)) {
1360 			fetch_info("$NETRC specifies a file name "
1361 			    "longer than PATH_MAX");
1362 			return (-1);
1363 		}
1364 	} else {
1365 		if ((p = getenv("HOME")) != NULL) {
1366 			struct passwd *pwd;
1367 
1368 			if ((pwd = getpwuid(getuid())) == NULL ||
1369 			    (p = pwd->pw_dir) == NULL)
1370 				return (-1);
1371 		}
1372 		if (snprintf(fn, sizeof(fn), "%s/.netrc", p) >= (int)sizeof(fn))
1373 			return (-1);
1374 	}
1375 
1376 	if ((f = fopen(fn, "r")) == NULL)
1377 		return (-1);
1378 	while ((word = fetch_read_word(f)) != NULL) {
1379 		if (strcmp(word, "default") == 0) {
1380 			DEBUG(fetch_info("Using default .netrc settings"));
1381 			break;
1382 		}
1383 		if (strcmp(word, "machine") == 0 &&
1384 		    (word = fetch_read_word(f)) != NULL &&
1385 		    strcasecmp(word, url->host) == 0) {
1386 			DEBUG(fetch_info("Using .netrc settings for %s", word));
1387 			break;
1388 		}
1389 	}
1390 	if (word == NULL)
1391 		goto ferr;
1392 	while ((word = fetch_read_word(f)) != NULL) {
1393 		if (strcmp(word, "login") == 0) {
1394 			if ((word = fetch_read_word(f)) == NULL)
1395 				goto ferr;
1396 			if (snprintf(url->user, sizeof(url->user),
1397 				"%s", word) > (int)sizeof(url->user)) {
1398 				fetch_info("login name in .netrc is too long");
1399 				url->user[0] = '\0';
1400 			}
1401 		} else if (strcmp(word, "password") == 0) {
1402 			if ((word = fetch_read_word(f)) == NULL)
1403 				goto ferr;
1404 			if (snprintf(url->pwd, sizeof(url->pwd),
1405 				"%s", word) > (int)sizeof(url->pwd)) {
1406 				fetch_info("password in .netrc is too long");
1407 				url->pwd[0] = '\0';
1408 			}
1409 		} else if (strcmp(word, "account") == 0) {
1410 			if ((word = fetch_read_word(f)) == NULL)
1411 				goto ferr;
1412 			/* XXX not supported! */
1413 		} else {
1414 			break;
1415 		}
1416 	}
1417 	fclose(f);
1418 	return (0);
1419  ferr:
1420 	fclose(f);
1421 	return (-1);
1422 }
1423 
1424 /*
1425  * The no_proxy environment variable specifies a set of domains for
1426  * which the proxy should not be consulted; the contents is a comma-,
1427  * or space-separated list of domain names.  A single asterisk will
1428  * override all proxy variables and no transactions will be proxied
1429  * (for compatibility with lynx and curl, see the discussion at
1430  * <http://curl.haxx.se/mail/archive_pre_oct_99/0009.html>).
1431  */
1432 int
1433 fetch_no_proxy_match(const char *host)
1434 {
1435 	const char *no_proxy, *p, *q;
1436 	size_t h_len, d_len;
1437 
1438 	if ((no_proxy = getenv("NO_PROXY")) == NULL &&
1439 	    (no_proxy = getenv("no_proxy")) == NULL)
1440 		return (0);
1441 
1442 	/* asterisk matches any hostname */
1443 	if (strcmp(no_proxy, "*") == 0)
1444 		return (1);
1445 
1446 	h_len = strlen(host);
1447 	p = no_proxy;
1448 	do {
1449 		/* position p at the beginning of a domain suffix */
1450 		while (*p == ',' || isspace((unsigned char)*p))
1451 			p++;
1452 
1453 		/* position q at the first separator character */
1454 		for (q = p; *q; ++q)
1455 			if (*q == ',' || isspace((unsigned char)*q))
1456 				break;
1457 
1458 		d_len = q - p;
1459 		if (d_len > 0 && h_len >= d_len &&
1460 		    strncasecmp(host + h_len - d_len,
1461 			p, d_len) == 0) {
1462 			/* domain name matches */
1463 			return (1);
1464 		}
1465 
1466 		p = q + 1;
1467 	} while (*q);
1468 
1469 	return (0);
1470 }
1471