featurestarttls.cpp

/*
  Copyright (c) 2009 by Jakob Schroeter <js@camaya.net>
  This file is part of the glooxd library. http://camaya.net/glooxd

  This software is distributed under a license. The full license
  agreement can be found in the file LICENSE in this distribution.
  This software may not be copied, modified, sold or distributed
  other than expressed in the named license agreement.

  This software is distributed without any warranty.
*/


#include "certificateprovider.h"
#include "featurestarttls.h"
#include "streambase.h"

#include <gloox/connectiontlsserver.h>
#include <gloox/gloox.h>
#include <gloox/tag.h>

#include <cstdio>

namespace glooxd
{

  FeatureSTARTTLS::FeatureSTARTTLS( bool required,
                                    CertificateProvider* cp )
    : m_state( TLSCanceled ), m_cp( cp ),
      m_encryption( 0 ), m_required( required )
  {
  }

  FeatureSTARTTLS::~FeatureSTARTTLS()
  {
    delete m_encryption;
  }

  const std::string& FeatureSTARTTLS::filterString() const
  {
    static const std::string filter = "/starttls[@xmlns='" + gloox::XMLNS_STREAM_TLS + "']";
    return filter;
  }

  gloox::Tag* FeatureSTARTTLS::tag( int state, const std::string& /*domain*/ )
  {
    gloox::Tag* t = 0;

    if( m_state == TLSCanceled
        && !( state & ( StateTLS | StateAuthentication ) ) )
    {
      bool haveCert = false;
      if( m_cp )
      {
        m_key = m_cp->handleKeyRequest( m_parent->jid().server() );
        m_cert = m_cp->handleCertificateRequest( m_parent->jid().server() );
        haveCert = ( !m_key.empty() && !m_cert.empty() );
      }

      if( haveCert )
      {
        t = new gloox::Tag( "starttls" );
        t->setXmlns( gloox::XMLNS_STREAM_TLS );
        if( m_required )
          new gloox::Tag( t, "required" );
        else
          new gloox::Tag( t, "optional" );

        m_state = TLSOffered;
      }
      else if( m_required )
        m_parent->disconnect( gloox::ConnStreamError,
                              gloox::StreamErrorInternalServerError );
      else if( !m_required )
        m_parent->finishStreamFeature( StateTLS );
    }

    return t;
  }

  void FeatureSTARTTLS::handleTag( gloox::Tag* _tag )
  {
    if( !_tag || _tag->xmlns() != gloox::XMLNS_STREAM_TLS )
      return;

    const std::string& name = _tag->name();

    if( name == "starttls" && m_state == TLSOffered )
    {
      gloox::Tag* p = new gloox::Tag( "proceed" );
      p->setXmlns( gloox::XMLNS_STREAM_TLS );
      m_parent->send( p );

      m_encryption = new gloox::ConnectionTLSServer( m_parent, m_parent->connection(),
          m_parent->logInstance() );
      m_encryption->registerTLSHandler( this );
//       m_encryption->setCACerts( m_cacerts );
      m_encryption->setClientCert( m_key, m_cert );
      m_encryption->connect();
      m_parent->finishStreamFeature( StateTLS, m_encryption );
      m_state = TLSHandshake;
    }
    else if( name == "failure" )
    {
      m_state = TLSCanceled;
      m_parent->disconnect( gloox::ConnTlsFailed );
    }
  }

  void FeatureSTARTTLS::handleHandshakeResult( const gloox::TLSBase* /*base*/,
      bool success, gloox::CertInfo& certinfo )
  {
    printf( "handshake result: %d\n", success );

    m_encryption->registerTLSHandler( 0 );
    m_encryption = 0;

    if( success )
    {
      m_state = TLSEnabled;
      if( !certinfo.compression.empty() )
      {
#ifdef DEBUG
        printf( "TLS compression enabled, disabling stream compression (XEP-138)\n" );
#endif
        m_parent->finishStreamFeature( StateCompression );
      }
      m_parent->finishStreamFeature( StateReset );
    }
    else
    {
      m_state = TLSCanceled;
      gloox::Tag* f = new gloox::Tag( "failure" );
      f->setXmlns( gloox::XMLNS_STREAM_TLS );
      m_parent->send( f );
      m_parent->disconnect( gloox::ConnTlsFailed );
    }
  }

}