[glib-networking/mcatanzaro/tls-thread: 14/26] progress



commit 40b100785fcab4fd32cdaa9a0df0cbb2aa34a12e
Author: Michael Catanzaro <mcatanzaro gnome org>
Date:   Sun Dec 22 14:10:07 2019 -0600

    progress

 tls/base/gtlsconnection-base.c           | 106 ++++++------------
 tls/base/gtlsconnection-base.h           |   3 +
 tls/base/gtlsoperationsthread-base.c     |  25 ++++-
 tls/base/gtlsoperationsthread-base.h     |   4 +
 tls/gnutls/gtlsclientconnection-gnutls.c |  38 +++----
 tls/gnutls/gtlsconnection-gnutls.c       | 147 +-----------------------
 tls/gnutls/gtlsoperationsthread-gnutls.c | 186 ++++++++++++++++++++++++++++---
 tls/gnutls/gtlsserverconnection-gnutls.c |   1 -
 8 files changed, 247 insertions(+), 263 deletions(-)
---
diff --git a/tls/base/gtlsconnection-base.c b/tls/base/gtlsconnection-base.c
index f2fe850..6a7edf8 100644
--- a/tls/base/gtlsconnection-base.c
+++ b/tls/base/gtlsconnection-base.c
@@ -135,7 +135,6 @@ typedef struct
   GMainContext  *handshake_context; /* FIXME remove */
   GTask         *async_implicit_handshake;
   GError        *handshake_error;
-  GByteArray    *app_data_buf;
 
   /* read_closed means the read direction has closed; write_closed similarly.
    * If (and only if) both are set, the entire GTlsConnection is closed. */
@@ -290,8 +289,6 @@ g_tls_connection_base_finalize (GObject *object)
   g_clear_object (&priv->waiting_for_op);
   g_mutex_clear (&priv->op_mutex);
 
-  g_clear_pointer (&priv->app_data_buf, g_byte_array_unref);
-
   g_clear_pointer (&priv->advertised_protocols, g_strfreev);
   g_clear_pointer (&priv->negotiated_protocol, g_free);
 
@@ -1427,6 +1424,15 @@ handshake (GTlsConnectionBase  *tls,
 {
   GTlsConnectionBasePrivate *priv = g_tls_connection_base_get_instance_private (tls);
   GTlsAuthenticationMode auth_mode = G_TLS_AUTHENTICATION_NONE;
+  gchar *original_negotiated_protocol;
+  GList *accepted_cas;
+
+  /* FIXME: in async codepaths, this function is still called on a secondary
+   * handshake thread. That means use of priv members here needs to be guarded
+   * by a mutex. Additionally, it is SUPER UNSAFE to notify negotiated-protocol
+   * on this thread. We need to either eliminate this extra thread, or tighten
+   * up the threadsafety of this function.
+   */
 
   g_tls_log_debug (tls, "TLS handshake starts");
 
@@ -1463,10 +1469,31 @@ handshake (GTlsConnectionBase  *tls,
                     NULL);
     }
 
+  original_negotiated_protocol = g_steal_pointer (&priv->negotiated_protocol);
+
   priv->started_handshake = TRUE;
-  g_tls_operations_thread_base_handshake (priv->thread, (const gchar **)priv->advertised_protocols, 
auth_mode, timeout, cancellable, error);
+
+  g_tls_operations_thread_base_handshake (priv->thread,
+                                          (const gchar **)priv->advertised_protocols,
+                                          auth_mode,
+                                          timeout,
+                                          &priv->negotiated_protocol,
+                                          &accepted_cas,
+                                          cancellable,
+                                          error);
+
   priv->need_handshake = FALSE;
 
+  /* FIXME: notify should be next to accepted-cas? */
+  if (g_strcmp0 (original_negotiated_protocol, priv->negotiated_protocol) != 0)
+    g_object_notify (G_OBJECT (tls), "negotiated-protocol");
+  g_free (original_negotiated_protocol);
+
+  if (G_IS_TLS_CLIENT_CONNECTION (tls))
+    G_TLS_CONNECTION_BASE_GET_CLASS (tls)->set_accepted_cas (tls, accepted_cas);
+  else
+    g_assert (!accepted_cas);
+
   if (error && *error)
     {
       g_tls_log_debug (tls, "TLS handshake failed: %s", (*error)->message);
@@ -1485,13 +1512,10 @@ finish_handshake (GTlsConnectionBase  *tls,
 {
   GTlsConnectionBasePrivate *priv = g_tls_connection_base_get_instance_private (tls);
   GTlsConnectionBaseClass *tls_class = G_TLS_CONNECTION_BASE_GET_CLASS (tls);
-  gchar *original_negotiated_protocol;
   GError *my_error = NULL;
 
   g_tls_log_debug (tls, "finishing TLS handshake");
 
-  original_negotiated_protocol = g_steal_pointer (&priv->negotiated_protocol);
-
   if (success)
     {
       if (tls_class->is_session_resumed && tls_class->is_session_resumed (tls))
@@ -1520,15 +1544,9 @@ finish_handshake (GTlsConnectionBase  *tls,
         }
     }
 
-  if (tls_class->complete_handshake)
-    {
-      /* If we already have an error, ignore further errors. */
-      tls_class->complete_handshake (tls, &priv->negotiated_protocol, my_error ? NULL : &my_error);
-
-      if (g_strcmp0 (original_negotiated_protocol, priv->negotiated_protocol) != 0)
-        g_object_notify (G_OBJECT (tls), "negotiated-protocol");
-    }
-  g_free (original_negotiated_protocol);
+  /* FIXME: notify only when accepted-cas has actually changed. */
+  if (G_IS_TLS_CLIENT_CONNECTION (tls))
+    g_object_notify (G_OBJECT (tls), "accepted-cas");
 
   if (my_error && priv->started_handshake)
     priv->handshake_error = g_error_copy (my_error);
@@ -1550,7 +1568,6 @@ g_tls_connection_base_handshake (GTlsConnection   *conn,
 {
   GTlsConnectionBase *tls = G_TLS_CONNECTION_BASE (conn);
   GTlsConnectionBasePrivate *priv = g_tls_connection_base_get_instance_private (tls);
-  GTlsConnectionBaseClass *tls_class = G_TLS_CONNECTION_BASE_GET_CLASS (tls);
   gboolean success;
   GError *my_error = NULL;
 
@@ -1868,20 +1885,7 @@ g_tls_connection_base_read (GTlsConnectionBase  *tls,
                      timeout, cancellable, error))
         return -1;
 
-      if (priv->app_data_buf && !priv->handshaking)
-        {
-          nread = MIN (size, priv->app_data_buf->len);
-          memcpy (buffer, priv->app_data_buf->data, nread);
-          if (nread == priv->app_data_buf->len)
-            g_clear_pointer (&priv->app_data_buf, g_byte_array_unref);
-          else
-            g_byte_array_remove_range (priv->app_data_buf, 0, nread);
-          status = G_TLS_CONNECTION_BASE_OK;
-        }
-      else
-        {
-          status = g_tls_operations_thread_base_read (priv->thread, buffer, size, timeout, &nread, 
cancellable, error);
-        }
+      status = g_tls_operations_thread_base_read (priv->thread, buffer, size, timeout, &nread, cancellable, 
error);
 
       yield_op (tls, G_TLS_CONNECTION_BASE_OP_READ, status);
     }
@@ -1917,32 +1921,7 @@ g_tls_connection_base_read_message (GTlsConnectionBase  *tls,
                    timeout, cancellable, error))
       return -1;
 
-    /* Copy data out of the app data buffer first. */
-    if (priv->app_data_buf && !priv->handshaking)
-      {
-        nread = 0;
-
-        for (guint i = 0; i < num_vectors; i++)
-          {
-            gsize count;
-            GInputVector *vec = &vectors[i];
-
-            count = MIN (vec->size, priv->app_data_buf->len);
-            nread += count;
-
-            memcpy (vec->buffer, priv->app_data_buf->data, count);
-            if (count == priv->app_data_buf->len)
-              g_clear_pointer (&priv->app_data_buf, g_byte_array_unref);
-            else
-              g_byte_array_remove_range (priv->app_data_buf, 0, count);
-            status = G_TLS_CONNECTION_BASE_OK;
-          }
-      }
-    else
-      {
-        status = g_tls_operations_thread_base_read_message (priv->thread, vectors, num_vectors, timeout, 
&nread, cancellable, error);
-      }
-
+    status = g_tls_operations_thread_base_read_message (priv->thread, vectors, num_vectors, timeout, &nread, 
cancellable, error);
     yield_op (tls, G_TLS_CONNECTION_BASE_OP_READ, status);
   } while (status == G_TLS_CONNECTION_BASE_REHANDSHAKE);
 
@@ -2482,19 +2461,6 @@ g_tls_connection_base_handshake_thread_request_certificate (GTlsConnectionBase *
   return res != G_TLS_INTERACTION_FAILED;
 }
 
-void
-g_tls_connection_base_handshake_thread_buffer_application_data (GTlsConnectionBase *tls,
-                                                                guint8             *data,
-                                                                gsize               length)
-{
-  GTlsConnectionBasePrivate *priv = g_tls_connection_base_get_instance_private (tls);
-
-  if (!priv->app_data_buf)
-    priv->app_data_buf = g_byte_array_new ();
-
-  g_byte_array_append (priv->app_data_buf, data, length);
-}
-
 GTlsOperationsThreadBase *
 g_tls_connection_base_get_op_thread (GTlsConnectionBase *tls)
 {
diff --git a/tls/base/gtlsconnection-base.h b/tls/base/gtlsconnection-base.h
index ea764c6..3f1f5bf 100644
--- a/tls/base/gtlsconnection-base.h
+++ b/tls/base/gtlsconnection-base.h
@@ -68,6 +68,9 @@ struct _GTlsConnectionBaseClass
                                                              GIOCondition          direction,
                                                              gboolean              success,
                                                              GError              **error);
+
+  void                        (*set_accepted_cas)           (GTlsConnectionBase    *tls,
+                                                             GList                 *accepted_cas);
 };
 
 gboolean                  g_tls_connection_base_handshake_thread_verify_certificate
diff --git a/tls/base/gtlsoperationsthread-base.c b/tls/base/gtlsoperationsthread-base.c
index 44975af..63910a9 100644
--- a/tls/base/gtlsoperationsthread-base.c
+++ b/tls/base/gtlsoperationsthread-base.c
@@ -101,9 +101,13 @@ typedef struct {
   GTlsConnectionBase *connection; /* FIXME: threadsafety nightmare, not OK */
 
   GTlsOperationsThreadBase *source; /* for copy client session state */
+
   gchar *server_identity;           /* for set server identity */
+
+  gchar *negotiated_protocol;       /* for handshake */
   gchar **advertised_protocols;     /* for handshake */
   GTlsAuthenticationMode auth_mode; /* for handshake */
+  GList *accepted_cas;              /* for handshake */
 
   union {
     void *data;                    /* for read/write */
@@ -173,7 +177,6 @@ g_tls_thread_copy_client_session_state_operation_new (GTlsOperationsThreadBase *
   return op;
 }
 
-/* FIXME: dumb, move this into handshake operation as is done for authentication mode */
 static GTlsThreadOperation *
 g_tls_thread_set_server_identity_operation_new (GTlsOperationsThreadBase *thread,
                                                 GTlsConnectionBase       *connection,
@@ -362,7 +365,11 @@ g_tls_thread_operation_free (GTlsThreadOperation *op)
     g_free (op->server_identity);
 
   if (op->type == G_TLS_THREAD_OP_HANDSHAKE)
-    g_strfreev (op->advertised_protocols);
+    {
+      g_strfreev (op->advertised_protocols);
+      g_assert (!op->accepted_cas);
+      g_assert (!op->negotiated_protocol);
+    }
 
   if (op->type != G_TLS_THREAD_OP_SHUTDOWN_THREAD)
     {
@@ -470,10 +477,13 @@ g_tls_operations_thread_base_handshake (GTlsOperationsThreadBase  *self,
                                         const gchar              **advertised_protocols,
                                         GTlsAuthenticationMode     auth_mode,
                                         gint64                     timeout,
+                                        gchar                    **negotiated_protocol,
+                                        GList                    **accepted_cas,
                                         GCancellable              *cancellable,
                                         GError                   **error)
 {
   GTlsOperationsThreadBasePrivate *priv = g_tls_operations_thread_base_get_instance_private (self);
+  GTlsConnectionBaseStatus status;
   GTlsThreadOperation *op;
 
   op = g_tls_thread_handshake_operation_new (self,
@@ -482,7 +492,10 @@ g_tls_operations_thread_base_handshake (GTlsOperationsThreadBase  *self,
                                              auth_mode,
                                              timeout,
                                              cancellable);
-  return execute_op (self, g_steal_pointer (&op), NULL, error);
+  status = execute_op (self, g_steal_pointer (&op), NULL, error);
+  *negotiated_protocol = g_steal_pointer (&op->negotiated_protocol);
+  *accepted_cas = g_steal_pointer (&op->accepted_cas);
+  return status;
 }
 
 GTlsConnectionBaseStatus
@@ -907,6 +920,8 @@ process_op (GAsyncQueue         *queue,
                                              (const gchar **)op->advertised_protocols,
                                              op->auth_mode,
                                              op->timeout,
+                                             &op->negotiated_protocol,
+                                             &op->accepted_cas,
                                              op->cancellable,
                                              &op->error);
       break;
@@ -1015,9 +1030,7 @@ tls_op_thread (gpointer data)
 
   g_main_loop_run (main_loop);
 
-  /* FIXME FIXME: what happens if there are still ops in progress?
-   * They should be cancelled somehow. Figure out how.
-   */
+  g_assert (!queue_has_pending_op (priv->queue));
 
   g_main_context_pop_thread_default (priv->op_thread_context);
 
diff --git a/tls/base/gtlsoperationsthread-base.h b/tls/base/gtlsoperationsthread-base.h
index 9e61055..5980b41 100644
--- a/tls/base/gtlsoperationsthread-base.h
+++ b/tls/base/gtlsoperationsthread-base.h
@@ -47,6 +47,8 @@ struct _GTlsOperationsThreadBaseClass
                                                              const gchar              **advertised_protocols,
                                                              GTlsAuthenticationMode     auth_mode,
                                                              gint64                     timeout,
+                                                             gchar                    **negotiated_protocol,
+                                                             GList                    **accepted_cas,
                                                              GCancellable              *cancellable,
                                                              GError                   **error);
 
@@ -109,6 +111,8 @@ GTlsConnectionBaseStatus  g_tls_operations_thread_base_handshake
                                                                                   const gchar              
**advertised_protocols,
                                                                                   GTlsAuthenticationMode     
auth_mode,
                                                                                   gint64                     
timeout,
+                                                                                  gchar                    
**negotiated_protocol,
+                                                                                  GList                    
**accepted_cas,
                                                                                   GCancellable              
*cancellable,
                                                                                   GError                   
**error);
 
diff --git a/tls/gnutls/gtlsclientconnection-gnutls.c b/tls/gnutls/gtlsclientconnection-gnutls.c
index 0a8a7f0..96d2893 100644
--- a/tls/gnutls/gtlsclientconnection-gnutls.c
+++ b/tls/gnutls/gtlsclientconnection-gnutls.c
@@ -54,7 +54,7 @@ struct _GTlsClientConnectionGnutls
   GSocketConnectable *server_identity;
   gboolean use_ssl3;
 
-  GPtrArray *accepted_cas;
+  GList *accepted_cas;
 };
 
 static void g_tls_client_connection_gnutls_initable_interface_init (GInitableIface  *iface);
@@ -94,7 +94,12 @@ g_tls_client_connection_gnutls_finalize (GObject *object)
   GTlsClientConnectionGnutls *gnutls = G_TLS_CLIENT_CONNECTION_GNUTLS (object);
 
   g_clear_object (&gnutls->server_identity);
-  g_clear_pointer (&gnutls->accepted_cas, g_ptr_array_unref);
+
+  if (gnutls->accepted_cas)
+    {
+      g_list_free_full (gnutls->accepted_cas, (GDestroyNotify)g_byte_array_unref);
+      gnutls->accepted_cas = NULL;
+    }
 
   G_OBJECT_CLASS (g_tls_client_connection_gnutls_parent_class)->finalize (object);
 }
@@ -125,8 +130,6 @@ g_tls_client_connection_gnutls_get_property (GObject    *object,
                                              GParamSpec *pspec)
 {
   GTlsClientConnectionGnutls *gnutls = G_TLS_CLIENT_CONNECTION_GNUTLS (object);
-  GList *accepted_cas;
-  gint i;
 
   switch (prop_id)
     {
@@ -143,16 +146,7 @@ g_tls_client_connection_gnutls_get_property (GObject    *object,
       break;
 
     case PROP_ACCEPTED_CAS:
-      accepted_cas = NULL;
-      if (gnutls->accepted_cas)
-        {
-          for (i = 0; i < gnutls->accepted_cas->len; ++i)
-            {
-              accepted_cas = g_list_prepend (accepted_cas, g_byte_array_ref 
(gnutls->accepted_cas->pdata[i]));
-            }
-          accepted_cas = g_list_reverse (accepted_cas);
-        }
-      g_value_set_pointer (value, accepted_cas);
+      g_value_set_pointer (value, g_list_copy (gnutls->accepted_cas));
       break;
 
     default:
@@ -200,19 +194,15 @@ g_tls_client_connection_gnutls_set_property (GObject      *object,
 }
 
 static void
-g_tls_client_connection_gnutls_complete_handshake (GTlsConnectionBase  *tls,
-                                                   gchar              **negotiated_protocol,
-                                                   GError             **error)
+g_tls_client_connection_gnutls_set_accepted_cas (GTlsConnectionBase *tls,
+                                                 GList              *accepted_cas)
 {
   GTlsClientConnectionGnutls *gnutls = G_TLS_CLIENT_CONNECTION_GNUTLS (tls);
 
-  G_TLS_CONNECTION_BASE_CLASS (g_tls_client_connection_gnutls_parent_class)->complete_handshake (tls, 
negotiated_protocol, error);
+  if (gnutls->accepted_cas)
+    g_list_free_full (gnutls->accepted_cas, (GDestroyNotify)g_byte_array_unref);
 
-  /* It may have changed during the handshake, but we have to wait until here
-   * because we can't emit notifies on the handshake thread.
-   */
-  if (gnutls->accepted_cas_changed)
-    g_object_notify (G_OBJECT (gnutls), "accepted-cas");
+  gnutls->accepted_cas = g_steal_pointer (&accepted_cas);
 }
 
 static void
@@ -235,7 +225,7 @@ g_tls_client_connection_gnutls_class_init (GTlsClientConnectionGnutlsClass *klas
   gobject_class->set_property = g_tls_client_connection_gnutls_set_property;
   gobject_class->finalize     = g_tls_client_connection_gnutls_finalize;
 
-  base_class->complete_handshake = g_tls_client_connection_gnutls_complete_handshake;
+  base_class->set_accepted_cas = g_tls_client_connection_gnutls_set_accepted_cas;
 
   g_object_class_override_property (gobject_class, PROP_VALIDATION_FLAGS, "validation-flags");
   g_object_class_override_property (gobject_class, PROP_SERVER_IDENTITY, "server-identity");
diff --git a/tls/gnutls/gtlsconnection-gnutls.c b/tls/gnutls/gtlsconnection-gnutls.c
index 3be6fed..6b8f88f 100644
--- a/tls/gnutls/gtlsconnection-gnutls.c
+++ b/tls/gnutls/gtlsconnection-gnutls.c
@@ -58,13 +58,10 @@ static GInitableIface *g_tls_connection_gnutls_parent_initable_iface;
 
 static void g_tls_connection_gnutls_initable_iface_init (GInitableIface *iface);
 
-static gnutls_priority_t priority;
-
 typedef struct
 {
   gnutls_session_t session; /* FIXME: should be used only by GTlsOperationsThreadGnutls */
-  gchar *interaction_id;
-  GCancellable *cancellable;
+
 } GTlsConnectionGnutlsPrivate;
 
 G_DEFINE_ABSTRACT_TYPE_WITH_CODE (GTlsConnectionGnutls, g_tls_connection_gnutls, G_TYPE_TLS_CONNECTION_BASE,
@@ -73,18 +70,9 @@ G_DEFINE_ABSTRACT_TYPE_WITH_CODE (GTlsConnectionGnutls, g_tls_connection_gnutls,
                                                          g_tls_connection_gnutls_initable_iface_init);
                                   );
 
-static gint unique_interaction_id = 0;
-
 static void
 g_tls_connection_gnutls_init (GTlsConnectionGnutls *gnutls)
 {
-  GTlsConnectionGnutlsPrivate *priv = g_tls_connection_gnutls_get_instance_private (gnutls);
-  int unique_id;
-
-  unique_id = g_atomic_int_add (&unique_interaction_id, 1);
-  priv->interaction_id = g_strdup_printf ("gtls:%d", unique_id);
-
-  priv->cancellable = g_cancellable_new ();
 }
 
 static gboolean
@@ -104,120 +92,6 @@ g_tls_connection_gnutls_initable_init (GInitable     *initable,
   return TRUE;
 }
 
-static void
-g_tls_connection_gnutls_finalize (GObject *object)
-{
-  GTlsConnectionGnutls *gnutls = G_TLS_CONNECTION_GNUTLS (object);
-  GTlsConnectionGnutlsPrivate *priv = g_tls_connection_gnutls_get_instance_private (gnutls);
-
-  if (priv->cancellable)
-    {
-      g_cancellable_cancel (priv->cancellable);
-      g_clear_object (&priv->cancellable);
-    }
-
-  g_free (priv->interaction_id);
-
-  G_OBJECT_CLASS (g_tls_connection_gnutls_parent_class)->finalize (object);
-}
-
-static int
-on_pin_request (void         *userdata,
-                int           attempt,
-                const char   *token_url,
-                const char   *token_label,
-                unsigned int  callback_flags,
-                char         *pin,
-                size_t        pin_max)
-{
-  GTlsConnection *connection = G_TLS_CONNECTION (userdata);
-  GTlsConnectionGnutlsPrivate *priv = g_tls_connection_gnutls_get_instance_private (G_TLS_CONNECTION_GNUTLS 
(connection));
-  GTlsInteraction *interaction = g_tls_connection_get_interaction (connection);
-  GTlsInteractionResult result;
-  GTlsPassword *password;
-  GTlsPasswordFlags password_flags = 0;
-  GError *error = NULL;
-  gchar *description;
-  int ret = -1;
-
-  if (!interaction)
-    return -1;
-
-  if (callback_flags & GNUTLS_PIN_WRONG)
-    password_flags |= G_TLS_PASSWORD_RETRY;
-  if (callback_flags & GNUTLS_PIN_COUNT_LOW)
-    password_flags |= G_TLS_PASSWORD_MANY_TRIES;
-  if (callback_flags & GNUTLS_PIN_FINAL_TRY || attempt > 5) /* Give up at some point */
-    password_flags |= G_TLS_PASSWORD_FINAL_TRY;
-
-  description = g_strdup_printf (" %s (%s)", token_label, token_url);
-  password = g_tls_password_new (password_flags, description);
-  result = g_tls_interaction_invoke_ask_password (interaction, password,
-                                                  priv->cancellable,
-                                                  &error);
-  g_free (description);
-
-  switch (result)
-    {
-    case G_TLS_INTERACTION_FAILED:
-      if (!g_error_matches (error, G_IO_ERROR, G_IO_ERROR_CANCELLED))
-        g_warning ("Error getting PIN: %s", error->message);
-      g_error_free (error);
-      break;
-    case G_TLS_INTERACTION_UNHANDLED:
-      break;
-    case G_TLS_INTERACTION_HANDLED:
-      {
-        gsize password_size;
-        const guchar *password_data = g_tls_password_get_value (password, &password_size);
-        if (password_size > pin_max)
-          g_warning ("PIN is larger than max PIN size");
-
-        memcpy (pin, password_data, MIN (password_size, pin_max));
-        ret = GNUTLS_E_SUCCESS;
-        break;
-      }
-    default:
-      g_assert_not_reached ();
-    }
-
-  g_object_unref (password);
-
-  return ret;
-}
-
-void
-g_tls_connection_gnutls_handshake_thread_get_certificate (GTlsConnectionGnutls  *gnutls,
-                                                          gnutls_pcert_st      **pcert,
-                                                          unsigned int          *pcert_length,
-                                                          gnutls_privkey_t      *pkey)
-{
-  GTlsConnectionGnutlsPrivate *priv = g_tls_connection_gnutls_get_instance_private (gnutls);
-  GTlsCertificate *cert;
-
-  cert = g_tls_connection_get_certificate (G_TLS_CONNECTION (gnutls));
-
-  if (cert)
-    {
-      /* Send along a pre-initialized privkey so we can handle the callback here. */
-      /* FIXME: this was never safe, we're not on the right thread here */
-      gnutls_privkey_t privkey;
-      gnutls_privkey_init (&privkey);
-      gnutls_privkey_set_pin_function (privkey, on_pin_request, gnutls);
-
-      g_tls_certificate_gnutls_copy (G_TLS_CERTIFICATE_GNUTLS (cert),
-                                     priv->interaction_id,
-                                     pcert, pcert_length, &privkey);
-      *pkey = privkey;
-    }
-  else
-    {
-      *pcert = NULL;
-      *pcert_length = 0;
-      *pkey = NULL;
-    }
-}
-
 static GTlsOperationsThreadBase *
 g_tls_connection_gnutls_create_op_thread (GTlsConnectionBase *tls)
 {
@@ -272,22 +146,6 @@ g_tls_connection_gnutls_retrieve_peer_certificate (GTlsConnectionBase *tls)
   return G_TLS_CERTIFICATE (chain);
 }
 
-static void
-g_tls_connection_gnutls_complete_handshake (GTlsConnectionBase  *tls,
-                                            gchar              **negotiated_protocol,
-                                            GError             **error)
-{
-  GTlsConnectionGnutls *gnutls = G_TLS_CONNECTION_GNUTLS (tls);
-  GTlsConnectionGnutlsPrivate *priv = g_tls_connection_gnutls_get_instance_private (gnutls);
-  gnutls_datum_t protocol;
-
-  if (gnutls_alpn_get_selected_protocol (priv->session, &protocol) == 0 && protocol.size > 0)
-    {
-      g_assert (!*negotiated_protocol);
-      *negotiated_protocol = g_strndup ((gchar *)protocol.data, protocol.size);
-    }
-}
-
 static gboolean
 g_tls_connection_gnutls_is_session_resumed (GTlsConnectionBase *tls)
 {
@@ -303,11 +161,8 @@ g_tls_connection_gnutls_class_init (GTlsConnectionGnutlsClass *klass)
   GObjectClass *gobject_class = G_OBJECT_CLASS (klass);
   GTlsConnectionBaseClass *base_class = G_TLS_CONNECTION_BASE_CLASS (klass);
 
-  gobject_class->finalize                                = g_tls_connection_gnutls_finalize;
-
   base_class->create_op_thread                           = g_tls_connection_gnutls_create_op_thread;
   base_class->retrieve_peer_certificate                  = g_tls_connection_gnutls_retrieve_peer_certificate;
-  base_class->complete_handshake                         = g_tls_connection_gnutls_complete_handshake;
   base_class->is_session_resumed                         = g_tls_connection_gnutls_is_session_resumed;
 }
 
diff --git a/tls/gnutls/gtlsoperationsthread-gnutls.c b/tls/gnutls/gtlsoperationsthread-gnutls.c
index 6688d58..aa98265 100644
--- a/tls/gnutls/gtlsoperationsthread-gnutls.c
+++ b/tls/gnutls/gtlsoperationsthread-gnutls.c
@@ -52,8 +52,6 @@ struct _GTlsOperationsThreadGnutls {
   GBytes                  *session_data;
   gboolean                 session_data_override; /* FIXME: sort this all out */
 
-  gchar                   *server_identity;
-
   gnutls_session_t         session;
 
   GIOStream               *base_iostream;
@@ -71,8 +69,13 @@ struct _GTlsOperationsThreadGnutls {
   unsigned int             pcert_length;
   gnutls_privkey_t         pkey;
 
-  GPtrArray               *accepted_cas;
-  gboolean                 accepted_cas_changed;
+  GList                   *accepted_cas;
+
+  gchar                   *server_identity;
+
+  gchar                   *interaction_id;
+
+  GByteArray              *application_data_buffer;
 };
 
 enum
@@ -531,12 +534,15 @@ g_tls_operations_thread_gnutls_handshake (GTlsOperationsThreadBase  *base,
                                           const gchar              **advertised_protocols,
                                           GTlsAuthenticationMode     auth_mode,
                                           gint64                     timeout,
+                                          gchar                    **negotiated_protocol,
+                                          GList                    **accepted_cas,
                                           GCancellable              *cancellable,
                                           GError                   **error)
 {
   GTlsOperationsThreadGnutls *self = G_TLS_OPERATIONS_THREAD_GNUTLS (base);
   GTlsConnectionBase *tls;
   GTlsConnectionBaseStatus status;
+  gnutls_datum_t protocol;
   int ret;
 
   tls = g_tls_operations_thread_base_get_connection (base);
@@ -568,8 +574,9 @@ g_tls_operations_thread_gnutls_handshake (GTlsOperationsThreadBase  *base,
       ret = gnutls_record_recv (self->session, buf, sizeof (buf));
       if (ret > -1)
         {
-          /* FIXME: no longer belongs in GTlsConnectionBase, don't use GTlsConnectionBase */
-          g_tls_connection_base_handshake_thread_buffer_application_data (tls, buf, ret);
+          if (!self->application_data_buffer)
+            self->application_data_buffer = g_byte_array_new ();
+          g_byte_array_append (self->application_data_buffer, buf, ret);
           ret = GNUTLS_E_AGAIN;
         }
     }
@@ -579,6 +586,11 @@ g_tls_operations_thread_gnutls_handshake (GTlsOperationsThreadBase  *base,
   self->handshaking = FALSE;
   self->ever_handshaked = TRUE;
 
+  if (gnutls_alpn_get_selected_protocol (self->session, &protocol) == 0 && protocol.size > 0)
+    *negotiated_protocol = g_strndup ((gchar *)protocol.data, protocol.size);
+
+  *accepted_cas = g_list_copy (self->accepted_cas);
+
   return status;
 }
 
@@ -594,6 +606,17 @@ g_tls_operations_thread_gnutls_read (GTlsOperationsThreadBase  *base,
   GTlsConnectionBaseStatus status;
   gssize ret;
 
+  if (self->application_data_buffer)
+    {
+      *nread = MIN (size, self->application_data_buffer->len);
+      memcpy (buffer, self->application_data_buffer->data, nread);
+      if (*nread == self->application_data_buffer->len)
+        g_clear_pointer (&self->application_data_buffer, g_byte_array_unref);
+      else
+        g_byte_array_remove_range (self->application_data_buffer, 0, *nread);
+      return G_TLS_CONNECTION_BASE_OK;
+    }
+
   BEGIN_GNUTLS_IO (self, G_IO_IN, cancellable);
   ret = gnutls_record_recv (self->session, buffer, size);
   END_GNUTLS_IO (self, G_IO_IN, ret, status, _("Error reading data from TLS socket"), error);
@@ -640,6 +663,28 @@ g_tls_operations_thread_gnutls_read_message (GTlsOperationsThreadBase  *base,
   gssize ret;
   gnutls_packet_t packet = { 0, };
 
+    /* Copy data out of the app data buffer first. */
+    if (self->application_data_buffer)
+      {
+        *nread = 0;
+
+        for (guint i = 0; i < num_vectors; i++)
+          {
+            gsize count;
+            GInputVector *vec = &vectors[i];
+
+            count = MIN (vec->size, self->application_data_buffer->len);
+            *nread += count;
+
+            memcpy (vec->buffer, self->application_data_buffer->data, count);
+            if (count == self->application_data_buffer->len)
+              g_clear_pointer (&self->application_data_buffer, g_byte_array_unref);
+            else
+              g_byte_array_remove_range (self->application_data_buffer, 0, count);
+            return G_TLS_CONNECTION_BASE_OK;
+          }
+      }
+
   BEGIN_GNUTLS_IO (self, G_IO_IN, cancellable);
 
   /* Receive the entire datagram (zero-copy). */
@@ -1045,6 +1090,70 @@ verify_certificate_cb (gnutls_session_t session)
   return !g_tls_connection_base_handshake_thread_verify_certificate (tls);
 }
 
+static int
+pin_request_cb (void         *userdata,
+                int           attempt,
+                const char   *token_url,
+                const char   *token_label,
+                unsigned int  callback_flags,
+                char         *pin,
+                size_t        pin_max)
+{
+  GTlsOperationsThreadGnutls *self = G_TLS_OPERATIONS_THREAD_GNUTLS (userdata);
+  GTlsInteraction *interaction = g_tls_connection_get_interaction (connection);
+  GTlsInteractionResult result;
+  GTlsPassword *password;
+  GTlsPasswordFlags password_flags = 0;
+  GError *error = NULL;
+  gchar *description;
+  int ret = -1;
+
+  if (!interaction)
+    return -1;
+
+  if (callback_flags & GNUTLS_PIN_WRONG)
+    password_flags |= G_TLS_PASSWORD_RETRY;
+  if (callback_flags & GNUTLS_PIN_COUNT_LOW)
+    password_flags |= G_TLS_PASSWORD_MANY_TRIES;
+  if (callback_flags & GNUTLS_PIN_FINAL_TRY || attempt > 5) /* Give up at some point */
+    password_flags |= G_TLS_PASSWORD_FINAL_TRY;
+
+  description = g_strdup_printf (" %s (%s)", token_label, token_url);
+  password = g_tls_password_new (password_flags, description);
+  result = g_tls_interaction_invoke_ask_password (interaction, password,
+                                                  self->op_cancellable,
+                                                  &error);
+  g_free (description);
+
+  switch (result)
+    {
+    case G_TLS_INTERACTION_FAILED:
+      if (!g_error_matches (error, G_IO_ERROR, G_IO_ERROR_CANCELLED))
+        g_warning ("Error getting PIN: %s", error->message);
+      g_error_free (error);
+      break;
+    case G_TLS_INTERACTION_UNHANDLED:
+      break;
+    case G_TLS_INTERACTION_HANDLED:
+      {
+        gsize password_size;
+        const guchar *password_data = g_tls_password_get_value (password, &password_size);
+        if (password_size > pin_max)
+          g_warning ("PIN is larger than max PIN size");
+
+        memcpy (pin, password_data, MIN (password_size, pin_max));
+        ret = GNUTLS_E_SUCCESS;
+        break;
+      }
+    default:
+      g_assert_not_reached ();
+    }
+
+  g_object_unref (password);
+
+  return ret;
+}
+
 static void
 clear_gnutls_certificate_copy (GTlsOperationsThreadGnutls *self)
 {
@@ -1055,6 +1164,41 @@ clear_gnutls_certificate_copy (GTlsOperationsThreadGnutls *self)
   self->pkey = NULL;
 }
 
+static void
+get_own_certificate (GTlsOperationsThreadGnutls  *self,
+                     gnutls_pcert_st            **pcert,
+                     unsigned int                *pcert_length,
+                     gnutls_privkey_t            *pkey)
+{
+  char *pem;
+  GTlsCertificate *cert = NULL;
+
+  pem = g_tls_operations_thread_base_get_own_certificate_pem (G_TLS_OPERATIONS_THREAD_BASE (self));
+  if (pem)
+    {
+      cert = g_tls_certificate_new_from_pem (pem, -1, NULL);
+      g_free (pem);
+    }
+
+  if (cert)
+    {
+      gnutls_privkey_t privkey;
+      gnutls_privkey_init (&privkey);
+      gnutls_privkey_set_pin_function (privkey, pin_request_cb, self);
+
+      g_tls_certificate_gnutls_copy (G_TLS_CERTIFICATE_GNUTLS (cert),
+                                     self->interaction_id,
+                                     pcert, pcert_length, &privkey);
+      *pkey = privkey;
+    }
+  else
+    {
+      *pcert = NULL;
+      *pcert_length = 0;
+      *pkey = NULL;
+    }
+}
+
 static int
 retrieve_certificate_cb (gnutls_session_t              session,
                          const gnutls_datum_t         *req_ca_rdn,
@@ -1066,7 +1210,6 @@ retrieve_certificate_cb (gnutls_session_t              session,
                          gnutls_privkey_t             *pkey)
 {
   GTlsOperationsThreadGnutls *self = gnutls_transport_get_ptr (session);
-  gboolean had_accepted_cas;
   GByteArray *dn;
   int i;
 
@@ -1076,22 +1219,24 @@ retrieve_certificate_cb (gnutls_session_t              session,
 
   if (is_client (self))
     {
-      had_accepted_cas = self->accepted_cas && self->accepted_cas->len != 0;
+      if (self->accepted_cas)
+        {
+          g_list_free_full (self->accepted_cas, (GDestroyNotify)g_byte_array_unref);
+          self->accepted_cas = NULL;
+        }
 
-      g_clear_pointer (&self->accepted_cas, g_ptr_array_unref);
-      self->accepted_cas = g_ptr_array_new_with_free_func ((GDestroyNotify)g_byte_array_unref);
       for (i = 0; i < nreqs; i++)
         {
           dn = g_byte_array_new ();
           g_byte_array_append (dn, req_ca_rdn[i].data, req_ca_rdn[i].size);
-          g_ptr_array_add (self->accepted_cas, dn);
+          self->accepted_cas = g_list_prepend (self->accepted_cas, dn);
         }
 
-      self->accepted_cas_changed = self->accepted_cas || had_accepted_cas;
+      self->accepted_cas = g_list_reverse (self->accepted_cas);
     }
 
   clear_gnutls_certificate_copy (self);
-  g_tls_connection_gnutls_handshake_thread_get_certificate (conn, pcert, pcert_length, pkey);
+  get_own_certificate (self, pcert, pcert_length, pkey);
 
   if (is_client (self))
     {
@@ -1100,7 +1245,7 @@ retrieve_certificate_cb (gnutls_session_t              session,
           g_tls_certificate_gnutls_copy_free (*pcert, *pcert_length, *pkey);
 
           if (g_tls_connection_base_handshake_thread_request_certificate (tls))
-            g_tls_connection_gnutls_handshake_thread_get_certificate (conn, pcert, pcert_length, pkey);
+            get_own_certificate (self, pcert, pcert_length, pkey);
 
           if (*pcert_length == 0)
             {
@@ -1226,15 +1371,21 @@ g_tls_operations_thread_gnutls_finalize (GObject *object)
   g_clear_pointer (&self->creds, gnutls_certificate_free_credentials);
   g_clear_pointer (&self->session_id, g_bytes_unref);
   g_clear_pointer (&self->session_data, g_bytes_unref);
-
+  g_clear_pointer (&self->application_data_buffer, g_byte_array_unref);
   g_clear_pointer (&self->server_identity, g_free);
-  g_clear_pointer (&self->accepted_cas, g_ptr_array_unref);
+  g_clear_pointer (&self->interaction_id, g_free);
 
   g_clear_object (&self->base_iostream);
   g_clear_object (&self->base_socket);
 
   clear_gnutls_certificate_copy (self);
 
+  if (self->accepted_cas)
+    {
+      g_list_free_full (self->accepted_cas, (GDestroyNotify)g_byte_array_unref);
+      self->accepted_cas = NULL;
+    }
+
   g_assert (!self->op_cancellable);
   g_assert (!self->op_error);
 
@@ -1310,6 +1461,9 @@ g_tls_operations_thread_gnutls_constructed (GObject *object)
 static void
 g_tls_operations_thread_gnutls_init (GTlsOperationsThreadGnutls *self)
 {
+  static int unique_interaction_id = 0;
+
+  self->interaction_id = g_strdup_printf ("gtls:%d", unique_interaction_id++);
 }
 
 static void
diff --git a/tls/gnutls/gtlsserverconnection-gnutls.c b/tls/gnutls/gtlsserverconnection-gnutls.c
index 7f54c84..1d834ca 100644
--- a/tls/gnutls/gtlsserverconnection-gnutls.c
+++ b/tls/gnutls/gtlsserverconnection-gnutls.c
@@ -73,7 +73,6 @@ g_tls_server_connection_gnutls_initable_init (GInitable       *initable,
                                               GError         **error)
 {
   GTlsCertificate *cert;
-  gnutls_certificate_credentials_t creds;
 
   if (!g_tls_server_connection_gnutls_parent_initable_iface->init (initable, cancellable, error))
     return FALSE;



[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]