trunk/Src/wptKeyserver.cpp

/* wptKeyserver.cpp - W32 Keyserver Access
 *      Copyright (C) 2000-2006 Timo Schulz
 *      Copyright (C) 2001 Marco Cunha
 *
 * This file is part of WinPT.
 *
 * WinPT is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License 
 * as published by the Free Software Foundation; either version 2 
 * of the License, or (at your option) any later version.
 *  
 * WinPT is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 * General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License 
 * along with WinPT; if not, write to the Free Software Foundation, 
 * Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 
 */

#ifdef HAVE_CONFIG_H
#include <config.h>
#endif

#include <windows.h>
#include <shlobj.h>
#include <stdio.h>
#include <sys/stat.h>
#include <ctype.h>

#include "wptKeyserver.h"
#include "wptErrors.h"
#include "wptTypes.h"
#include "wptNLS.h"
#include "wptW32API.h"
#include "wptGPG.h"
#include "wptRegistry.h"
#include "wptUTF8.h"

/* Map net_errno to a winsock error. */
#define net_errno ((int)WSAGetLastError ())


keyserver server[MAX_KEYSERVERS] = {0};
keyserver_proxy_s proxy = {0};
static const char *server_list[] = {
    "hkp://sks.keyserver.penguin.de",
    "hkp://subkeys.pgp.net",
    "ldap://keyserver.pgp.com",
    NULL
};


static char  hkp_errmsg[1024];  /* Holds the error message from the server */
static int   hkp_err = 0;       /* != 0 indicates an error occurred. */

/* Default keyserver and port. */
char *default_keyserver = NULL;
WORD default_keyserver_port = 0;

/* Default socket timeout. */
static int default_socket_timeout = 6;


/* Wrapper for safe memory allocation. */
static char*
safe_alloc (DWORD n)
{
    char *p;

    p = new char[n+1];
    if (!p)
        BUG (0);
    memset (p, 0, n);
    return p;
}

/* Basic64 encode the input @inbuf to @outbuf. */
static void
base64_encode (const char *inbuf, char *outbuf)
{
    char base64code[] =
        "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
    int index = 0, temp = 0, res = 0;
    int i = 0, inputlen = 0, len = 0;
    
    inputlen = strlen (inbuf);
    for (i = 0; i < inputlen; i++) {
        res = temp;
        res = (res << 8) | (inbuf[i] & 0xFF);
        switch (index++) {
        case 0: 
            outbuf[len++] = base64code[res >> 2 & 0x3F]; 
            res &= 0x3; 
            break;
        case 1: 
            outbuf[len++] = base64code[res >> 4 & 0x3F]; 
            res &= 0xF; 
            break;
        case 2:
            outbuf[len++] = base64code[res >> 6 & 0x3F];
            outbuf[len++] = base64code[res & 0x3F]; 
            res = index = 0; 
            break;
        }
        temp = res;
    }
    
    if (index == 2) {      
        outbuf[len++] = base64code[temp << 2 & 0x3F];   
        outbuf[len++] = '=';
    }
    else if (index == 1) {
        outbuf[len++] = base64code[temp << 4 & 0x3F];
        outbuf[len++] = '=';
        outbuf[len++] = '=';
    }

    outbuf[len] = '\0';
}


/* Check that the given buffer contains a valid keyserver URL
   and return the prefix length, 0 in case of an error. */
static int
check_URL (const char *buf)
{
    const char *proto[] = {
        "ldap://", 
        "http://", 
        "finger://", 
        "hkp://", 
        NULL};
    int i;

    if (strlen (buf) < 7)
        return 0;

    for (i=0; proto[i] != NULL; i++) {
        if (strstr (buf, proto[i]))
            return strlen (proto[i]);
    }
    return 0;
}


/* Skip the URL schema and return only the host part of it. */
static const char*
skip_type_prefix (const char *hostname)
{
    int pos;

    if (!hostname)
        return hostname;

    pos = check_URL (hostname);
    if (pos > 0)
        hostname += pos;
    return hostname;
}


/* Check that the keyserver response indicates an OK.
   Return 0 on success. */
static int
check_hkp_response (const char *resp, int recv)
{    
    char *p, *end;
    int ec, len;

    log_debug ("check_hkp_response: '%s'\r\n", resp);
    ec = recv ? WPTERR_WINSOCK_RECVKEY : WPTERR_WINSOCK_SENDKEY;
    if (!strstr (resp, "HTTP/1.0 200 OK") &&
        !strstr (resp, "HTTP/1.1 200 OK")) /* http error */
        return ec;
    if (strstr (resp, "Public Key Server -- Error")
        || strstr (resp, "Public Key Server -- Error")
        || strstr (resp, "No matching keys in database")) {
        p = strstr (resp, "<p>");
        if (p && strlen (p) < sizeof (hkp_errmsg)-1) {
            end = strstr (p, "</p>");
            len = end? (end - p + 1) : strlen (p);
            memset (hkp_errmsg, 0, sizeof (hkp_errmsg));
            strncpy (hkp_errmsg, p, len);
            hkp_err = 1;
        }
        return ec;
    }
    return 0;
}


/* Read a single line (\r\n) from a socket.
   Return 0 on success. */
static int
sock_getline (int fd, char *buf, int buflen, int *nbytes)
{
    char ch;
    int nread = 0;      
    
    if (nbytes)
        *nbytes = 0;
    *buf = 0;
    while (recv (fd, &ch, 1, 0) > 0) {
        *buf++ = ch;
        nread++;
        if (ch == '\r')
            continue; /* remove this char. */
        if (ch == '\n' || nread == (buflen - 1)) {
            *buf = 0;
            if (nbytes)
                *nbytes = nread;
            return 0;
        }
    }

    return -1;
}


/* Perform a select() on the given fd to find out
   is there is data for reading. Wait at least @nsecs seconds. */
static int
sock_select (int fd, int nsecs)
{
    FD_SET rfd;
    timeval tv = {nsecs, 0};

    FD_ZERO (&rfd);
    FD_SET (fd, &rfd);
    if (select (fd + 1, &rfd, NULL, NULL, &tv) == SOCKET_ERROR) {
        log_debug ("sock_select: select() failed ec=%d.\r\n", net_errno);
        return SOCKET_ERROR;
    }
    if (FD_ISSET (fd, &rfd))
        return 1;
    return 0;
}


/* Read from a socket @fd to buffer @buf with a fixed timeout 
   of 10 seconds. The amount of bytes which were read are 
   returned in @nbytes.
   Return value: 0 on success. */
static int
sock_read (int fd, char *buf, int buflen, int *nbytes)
{
    DWORD nread;
    int nleft = buflen;
    int rc, n = 0;
    
    if (nbytes)
        *nbytes = 0;
    while (nleft > 0) {
        if (n >= default_socket_timeout)
            return WPTERR_WINSOCK_TIMEOUT;
        rc = sock_select (fd, 1);
        if (rc == SOCKET_ERROR)
            return rc;
        else if (!rc)
            n++;
        else {
            nread = recv (fd, buf, nleft, 0);
            if (nread == SOCKET_ERROR) {
                log_debug ("sock_read: recv() failed ec=%d.\r\n", net_errno);
                return SOCKET_ERROR;
            }
            else if (!nread)
                break;
            nleft -= nread;
            buf += nread;
        }       
    }
    if (nbytes)
        *nbytes = buflen - nleft;
        
    return 0;
}


/* Helper to create a string from the gpgme data and
   then release the gpgme data object. */
char*
data_release_and_get_mem (gpgme_data_t in, int *r_bufferlen)
{
    size_t n;
    char *buffer, *p;

    gpg_data_putc (in, '\0');
    p = gpgme_data_release_and_get_mem (in, &n);
    buffer = m_strdup (p);
    if (r_bufferlen)
        *r_bufferlen = (int)n;
    gpgme_free (p);
    return buffer;
}


/* Read much data as possible from the socket @fd and
   return the data in @buffer. Caller must free data.
   Return value: 0 on success. */
int
sock_read_ext (int fd, char **buffer, int *r_bufferlen)
{
    gpgme_data_t dh;
    char buf[1024];
    size_t n=0;
    int nread, rc;

    if (gpgme_data_new (&dh))
        BUG (0);
    while (n < 10) {
        rc = sock_select (fd, 1);
        if (rc == SOCKET_ERROR) {
            gpgme_data_release (dh);
            return rc;
        }
        else if (!rc)
            n++;
        else {
            nread = recv (fd, buf, sizeof (buf), 0);
            if (nread == SOCKET_ERROR)
                return SOCKET_ERROR;
            else if (!nread)
                break;
            gpgme_data_write (dh, buf, nread);
        }
    }

    *buffer = data_release_and_get_mem (dh, r_bufferlen);
    return 0;
}


/* Write the buffer @buf with the length @buflen to a socket @fd. */
static int
sock_write (int fd, const char *buf, int buflen)
{
    DWORD nwritten;
    int nleft = buflen;

    while (nleft > 0) {
        nwritten = send (fd, buf, nleft, 0);
        if (nwritten == SOCKET_ERROR) {
            log_debug ("sock_write: send() failed ec=%d\r\n", net_errno);
            return SOCKET_ERROR;
        }
        nleft -= nwritten;
        buf += nwritten;
    }

    return 0;
}


/* Initialize the Winsock2 interface.*/
int
wsock_init (void)
{
    WSADATA wsa;

    if (WSAStartup (0x202, &wsa)) {
        log_debug ("wsock_init: WSAStartup failed ec=%d\r\n", net_errno);
        return WPTERR_WINSOCK_INIT;
    }
    return 0;
}


/* Cleanup the Winsock2 interface. */
void
wsock_end (void)
{
    char *p;
    int i;

    p = make_special_filename (CSIDL_APPDATA, "winpt\\keyserver.conf", NULL);
    kserver_save_conf (p);
    free_if_alloc (p);
    free_if_alloc (default_keyserver);
    for (i=0; i < MAX_KEYSERVERS; i++) {
        if (server[i].used && server[i].name != NULL)
            free_if_alloc (server[i].name);
    }
    kserver_proxy_release (&proxy);
    WSACleanup ();
    log_debug ("wsock_end: cleanup finished.\r\n");
}


/* Return a string representation of a winsock error. */
const char*
wsock_strerror (void)
{
    int ec = WSAGetLastError ();
    
    if (!ec)
        return "";
    switch (ec) {
    case WSAENETDOWN:
        return _("Network unreachable");

    case WSAEHOSTUNREACH:
        return _("Host unreachable");

    case WSAHOST_NOT_FOUND:
        return _("Could not resolve host name");

    case WSAECONNREFUSED:
        return _("Connection refused");

    case WSAETIMEDOUT:
    case WSAECONNABORTED:
        return _("Connection timeout");

    case WSAENETRESET:
    case WSAECONNRESET:    
        return _("Connection resetted by peer");

    case WSAESHUTDOWN:
        return _("Socket has been shutdown");

    default:
        break;
    }

    return "";
}


/* Set default socket timeout for all reading operations. */
void
kserver_set_socket_timeout (int nsec)
{
    if (nsec < 0 || nsec > 3600)
        nsec = 0;
    default_socket_timeout = nsec;
}


/* Return the last keyserver error as a string. */
const char*
kserver_strerror (void)
{       
    if (hkp_err)
        return hkp_errmsg;
    return NULL;
}


/* Read a keyserver from the list at index @idx.
   Return value: keyserver name at the given position. */
const char*
kserver_get_hostname (int idx, int type, WORD *port)
{
    if (type == -1) {
        *port = default_keyserver_port;
        return default_keyserver;
    }
    else if (!type && idx < DIM (server_list)) {
        /* XXX: handle non HKP servers. */
        *port = HKP_PORT;
        return server_list[idx];
    }
    return NULL;
}


/* Check if the computer is connected to the internet.
   Return 0 on success -1 otherwise. */
int
kserver_check_inet_connection (void)
{
    int fd;

    if (!kserver_connect (default_keyserver, default_keyserver_port, &fd)) {
        closesocket (fd);
        return 0;
    }
    log_debug ("kserver_check_inet_connection: no inet connection.\r\n");
    return -1;
}


/* If the request contains the keyid, it have to be
   always postfix with '0x'+keyid. This code checks
   if the keyid is a decimal value and if so if it contains
   the '0x'. If not it is inserted. */
const char*
kserver_check_keyid (const char *keyid)
{       
    static char id[22];

    if (strstr (keyid, "@"))
        return keyid; /* email address */
    if (strncmp (keyid, "0x", 2)) {
        memset (&id, 0, sizeof (id));
        _snprintf (id, sizeof (id)-1, "0x%s", keyid);
        return id;
    }
    return keyid;
}


/* Update the keyserver proxy user. */
static void
update_proxy_user (const char *proxy_user, const char *proxy_pass)
{
    char t[257]; /* user:pass = 127+1+127+1 = 257 */
    int n = 0;

    n = 4*strlen (proxy_user) / 3 + 32 + strlen (proxy_pass) + 2;
    free_if_alloc (proxy.base64_user);
    proxy.base64_user = safe_alloc (n+1);
    _snprintf (t, sizeof (t)-1, "%s:%s", proxy_user, proxy_pass);
    base64_encode (t, proxy.base64_user);
    free_if_alloc (proxy.user);
    free_if_alloc (proxy.pass);
    proxy.user = m_strdup (proxy_user);
    proxy.pass = m_strdup (proxy_pass);
}
    

/* Get the port number from the given protocol. */
static int
port_from_proto (int proto)
{
    switch (proto) {
    case KSPROTO_LDAP:   return LDAP_PORT;
    case KSPROTO_FINGER: return FINGER_PORT;
    case KSPROTO_HTTP:   return HKP_PORT;
    }
    return 0;
}


/* Get the port number from the given URL. */
static int
proto_from_URL (const char *buf)
{
    if (strstr (buf, "ldap"))
        return KSPROTO_LDAP;
    else if (strstr (buf, "finger"))
        return KSPROTO_FINGER;
    return KSPROTO_HKP;
}


/* Set the default keyserver. 
   If @hostname is NULL, use the predefined keyserver. */
void
keyserver_set_default (const char *hostname, WORD port)
{
    if (!port)
        port = HKP_PORT;
    if (hostname != NULL) {
        free_if_alloc (default_keyserver);
        default_keyserver = m_strdup (hostname);
        default_keyserver_port = port;
    }
    if (!default_keyserver) {
        default_keyserver = m_strdup (DEF_HKP_KEYSERVER);
        default_keyserver_port = HKP_PORT;
    }
    server[0].name =  m_strdup (default_keyserver);
    server[0].used = 1;
    server[0].port = port;
    server[0].proto = proto_from_URL (default_keyserver);
}


/* Skip all kind of whitespace chars in @str. */
static const char*
skip_whitespace (const char *str)
{
    while (str && *str) {
        if (*str == ' ' ||
            *str == '\t' ||
            *str == '\n' ||
            *str == '\r') {
            str++;
            continue;
        }
        break;
    }
    return str;
}


/* Save the keyserver config file in @conf. */
int
kserver_save_conf (const char *conf)
{
    FILE *fp;
    int pos;

    fp = fopen (conf, "wb");
    if (!fp) {
        msg_box (NULL, _("Could not save keyserver.conf file"), 
                 _("Keyserver"), MB_ERR);
        return -1;
    }

    fprintf (fp, "# do NOT manually modify this file, it will be "
                 "generated automatically!!\r\n");
    for (pos = 0; pos < MAX_KEYSERVERS; pos++) {
        if (!server[pos].used)
            continue;
        fprintf (fp, "%s:%d\r\n", server[pos].name, server[pos].port);
    }
    fclose (fp);
    return 0;
}


/* Load the keyserver config file @conf. */
int
kserver_load_conf (const char *conf)
{    
    FILE *fp;
    char buf[1024], *s, *p;
    char *user = NULL, *pass = NULL;    
    int no_config=0, chk_pos=0;
    int pos;
    
    for (pos = 0; pos < MAX_KEYSERVERS; pos++) {
        server[pos].used = 0;
        server[pos].port = HKP_PORT;
    }
    
    fp = fopen (conf, "rb");
    if (!fp) {
        for (pos = 0; server_list[pos]; pos++) {
            server[pos].used = 1;
            server[pos].name = m_strdup (server_list[pos]);
            server[pos].proto = proto_from_URL (server_list[pos]);
        }
        no_config=1;
    }
    get_reg_proxy_prefs (&proxy);
    if (user && pass)
        update_proxy_user (user, pass); 
    else if (user && !pass || !user && pass) {
        msg_box (NULL, _("Invalid proxy configuration."
                         "You need to set a user and a password"
                         "to use proxy authentication!"), 
                         _("Proxy Error"), MB_ERR);
    }
    /* check if the host has a http:// prefix and skip it */
    if (proxy.host && !strncmp (proxy.host, "http://", 7)) {
        char *host = m_strdup (proxy.host+7);
        free_if_alloc (proxy.host);
        proxy.host = host;
    }
    free_if_alloc (user);
    free_if_alloc (pass);
    
    pos = 0;
    while (fp && !feof (fp)) {
        s = fgets (buf, sizeof (buf)-1, fp);
        if (!s)
            break;
        if (strstr (buf, "\r\n"))
            buf[strlen (buf)-2] = '\0';
        if (strstr (buf, "\n"))
            buf[strlen (buf)-1] = '\0';
        s = (char *)skip_whitespace (buf);
        if (*s == '#' || strlen (s) < 7)
            continue;
        chk_pos = check_URL (s);
        if (!chk_pos) {
            msg_box (NULL, _("All entries of this file must have a valid prefix.\n"
                             "Currently HKP/HTTP, LDAP and FINGER are supported.\n"), 
                             _("Keyserver Error"), MB_ERR);
            continue;
        }
        p = strchr (s+chk_pos, ':');
        server[pos].used = 1;
        server[pos].proto = proto_from_URL (s); 
        server[pos].port = port_from_proto (server[pos].proto);
        if (!p)
            server[pos].name = m_strdup (s);
        else {      
            server[pos].port = atol (p+1);
            if (server[pos].port < 0 || server[pos].port > 65536)
                server[pos].port = HKP_PORT;
            server[pos].name = safe_alloc ((p-s)+2);
            memset (server[pos].name, 0, (p-s)+2);
            memcpy (server[pos].name, s, (p-s));
        }
        pos++;
        if (pos > MAX_KEYSERVERS) {
            msg_box (NULL, _("The keyserver limit is exceeded"), 
                     _("Keyserver Warning"), MB_INFO);
            break;
        }
    }
    if (fp)
        fclose (fp);
    if (!pos) {
        /* only issue an error if the config file exist but 
           it has no valid entries. */
        keyserver_set_default (NULL, HKP_PORT);
        if (!no_config)
            return WPTERR_CONFIG_FILE;
    }

    return 0;
}


/* Connect to the keyserver @hostname (port @port).
   Return value: 0 on success */
int
kserver_connect (const char *hostname, WORD port, int *conn_fd)
{         
    struct hostent *hp;
    struct sockaddr_in sock;
    char host[128] = {0};
    DWORD iaddr;
    int rc, fd;

    log_debug ("kserver_connect: %s:%d\r\n", hostname, port);

    if (!port)
        port = HKP_PORT;
    if (conn_fd)
        *conn_fd = 0;
    hostname = skip_type_prefix (hostname);
    
    if (proxy.host && proxy.proto == PROXY_PROTO_HTTP)
        port = proxy.port;
    memset (&sock, 0, sizeof (sock));
    sock.sin_family = AF_INET;
    sock.sin_port = htons (port);
    if (proxy.host)
        strncpy (host, proxy.host, 127);
    else
        strncpy (host, hostname, 127);

    if ((iaddr = inet_addr (host)) != INADDR_NONE)
        memcpy (&sock.sin_addr, &iaddr, sizeof (iaddr));
    else if ((hp = gethostbyname (host))) {
        if (hp->h_addrtype != AF_INET || hp->h_length != 4) {
            log_debug ("gethostbyname: unknown address type.\r\n");
            return WPTERR_WINSOCK_RESOLVE;
        }
        memcpy (&sock.sin_addr, hp->h_addr, hp->h_length);
    }
    else {
        log_debug ("gethostbyname: failed ec=%d.\r\n", net_errno);
        return WPTERR_WINSOCK_RESOLVE;
    }
    fd = socket (AF_INET, SOCK_STREAM, 0);
    if (fd == INVALID_SOCKET)   
        return WPTERR_WINSOCK_SOCKET;
    rc = connect (fd, (struct sockaddr *) &sock, sizeof (sock));
    if (rc == SOCKET_ERROR) {
        log_debug ("connect: failed ec=%d.\r\n", net_errno);
        closesocket (fd);
        return WPTERR_WINSOCK_CONNECT;
    }

    if (proxy.proto == PROXY_PROTO_SOCKS5) {
        rc = socks_handshake (&proxy, fd, hostname, port);
        if (rc) {
            closesocket (fd);
            return WPTERR_GENERAL; /* XXX: use better code. */
        }
    }

    if (conn_fd)
        *conn_fd = fd;
    WSASetLastError (0);
    return 0;
}


/* Check if the URL needs to be encoded or not. */
static bool
URL_must_encoded (const char *url)
{
    if (strchr (url, '.') || strchr (url, '@') || strchr (url, ' '))
        return true;
    return false;
}


/* Perform URL encoding of the given data. */
static char*
URL_encode (const char *url, DWORD ulen, DWORD *ret_nlen)
{
    gpgme_data_t hd;
    char numbuf[5], *p;
    size_t i;
    int nlen;

    if (gpgme_data_new (&hd))
        BUG (0);
    for (i=0; i < ulen; i++) {
        if (isalnum (url[i]) || url[i] == '-')
            gpg_data_putc (hd, url[i]);
        else if (url[i] == ' ')
            gpg_data_putc (hd, '+');
        else {
            sprintf (numbuf, "%%%02X", url[i]);
            gpgme_data_write (hd, numbuf, strlen (numbuf));
        }
    }

    p = data_release_and_get_mem (hd, &nlen);
    if (ret_nlen)
        *ret_nlen = nlen;
    return p;
}


/* Format a request for the given keyid (send). */
static char*
kserver_send_request (const char *hostname, WORD port, 
                      const char *pubkey, DWORD octets)
{
    const char *fmt;
    char *request;
    char *enc_pubkey;
    DWORD enc_octets;
    int reqlen;

    log_debug ("kserver_send_request: %s:%d\r\n", hostname, port);

    if (!port)
        port = HKP_PORT;
    enc_pubkey = URL_encode (pubkey, octets, &enc_octets);
    reqlen = 2*strlen (hostname) + 2*32/*port*/ + enc_octets + 32 /*len*/ + 1;
    
    if (proxy.user && proxy.proto == PROXY_PROTO_HTTP) {
        fmt = "POST http://%s:%d/pks/add HTTP/1.0\r\n"
              "Referer: \r\n"
              "User-Agent: WinPT/W32\r\n"
              "Host: %s:%d\r\n"
              "Proxy-Authorization: Basic %s\r\n"
              "Content-type: application/x-www-form-urlencoded\r\n"
              "Content-length: %d\r\n"
              "\r\n"
              "keytext=%s"
              "\r\n";
        reqlen += strlen (fmt) + strlen (proxy.base64_user) + 1;
        request = safe_alloc (reqlen+1);
        _snprintf (request, reqlen, fmt,
                   skip_type_prefix (hostname), port, hostname, port,
                   proxy.base64_user, enc_octets+9, enc_pubkey);
    }
    else {
        fmt = "POST /pks/add HTTP/1.0\r\n"
              "Referer: \r\n"
              "User-Agent: WinPT/W32\r\n"
              "Host: %s:%d\r\n"
              "Content-type: application/x-www-form-urlencoded\r\n"
              "Content-length: %d\r\n"
              "\r\n"
              "keytext=%s"
              "\r\n";
        reqlen += strlen (fmt)+1;
        request = safe_alloc (reqlen+1);
        _snprintf (request, reqlen, fmt,
                   skip_type_prefix (hostname), port,
                   enc_octets+9, enc_pubkey);
    }

    free_if_alloc (enc_pubkey);
    log_debug ("request:\r\n%s\r\n", request);
    return request;
}


/* Interface for receiving a public key. */
int
kserver_recvkey (const char *hostname, WORD port, const char *keyid,
                 char **r_key, int *r_keylen)
{
    const char *fmt;
    char *request = NULL;
    int conn_fd;
    int rc, reqlen;

    if (!port)
        port = HKP_PORT;
    hkp_err = 0; /* reset */
    rc = kserver_connect (hostname, port, &conn_fd);
    if (rc)
        goto leave;

    reqlen = strlen (hostname)+32+strlen (keyid)+1;
    if (proxy.host && proxy.user && proxy.proto == PROXY_PROTO_HTTP) {
        fmt = "GET http://%s:%d/pks/lookup?op=get&search=%s HTTP/1.0\r\n"
              "Proxy-Authorization: Basic %s\r\n\r\n";
        reqlen =+ strlen (fmt) + strlen (proxy.base64_user)+1;
        request = safe_alloc (reqlen+1);
        _snprintf (request, reqlen, fmt, skip_type_prefix (hostname), port,
                   keyid, proxy.base64_user);
    }
    else if (proxy.host && proxy.proto == PROXY_PROTO_HTTP) {
        fmt = "GET http://%s:%d/pks/lookup?op=get&search=%s HTTP/1.0\r\n\r\n";
        reqlen += strlen (fmt)+1;
        request = safe_alloc (reqlen+1);
        _snprintf (request, reqlen, fmt, skip_type_prefix (hostname), 
                                         port, keyid);
    }
    else {
        fmt = "GET /pks/lookup?op=get&search=%s HTTP/1.0\r\n\r\n";
        reqlen += strlen (fmt)+1;
        request = safe_alloc (reqlen+1);
        _snprintf (request, reqlen, fmt, keyid);
    }

    log_debug ("request:\r\n%s\r\n", request);
    
    rc = sock_write (conn_fd, request, strlen (request));
    if (rc == SOCKET_ERROR) {
        rc = WPTERR_WINSOCK_RECVKEY;
        goto leave;
    }
    
    rc = sock_read_ext (conn_fd, r_key, r_keylen);
    if (rc == SOCKET_ERROR) {
        rc = WPTERR_WINSOCK_RECVKEY;
        goto leave;
    }

    log_debug ("response:\r\n%s\r\n", *r_key);
    rc = check_hkp_response (*r_key, 1);
    if (rc)
        goto leave;
    
    WSASetLastError (0);
    
leave:
    closesocket (conn_fd);
    free_if_alloc (request);
    return rc;
}


/* Interface to send a public key. */
int
kserver_sendkey (const char *hostname, WORD port, const char *pubkey, int len )
{
    char *request = NULL;
    char log[2048] = {0};
    int conn_fd, n;
    int rc;
    
    hkp_err = 0; /* reset */
    rc = kserver_connect (hostname, port, &conn_fd);
    if (rc)
        goto leave;
    
    request = kserver_send_request (hostname, port, pubkey, len);
    if (request == NULL) {
        rc = WPTERR_GENERAL;
        goto leave;     
    }
    
    rc = sock_write (conn_fd, request, strlen (request));
    if (rc == SOCKET_ERROR) {
        rc = WPTERR_WINSOCK_SENDKEY;
        goto leave;     
    }
    
    rc = sock_read (conn_fd, log, sizeof (log)-1, &n);
    if (rc == SOCKET_ERROR) {
        rc = WPTERR_WINSOCK_SENDKEY;
        goto leave;
    }

    log_debug ("kserver_sendkey: read %d bytes\r\n%s\r\n", n, log);
    rc = check_hkp_response (log, 0);
    if (rc)
        goto leave;
    
    WSASetLastError (0);
    
leave:
    closesocket (conn_fd);
    free_if_alloc (request);
    return rc;
}


/* Check keyserver response. */
static int
kserver_search_chkresp (int fd)
{
    char buf[128];
    int n=0;
    
    /* parse response 'HTTP/1.0 500 OK' */
    if (sock_getline (fd, buf, sizeof (buf)-1, &n))
        return WPTERR_KEYSERVER_NOTFOUND;

    log_debug ("kserver_search_chkpresp: %s\r\n", buf);
    if (strncmp (buf, "HTTP/1.", 7))
        return WPTERR_KEYSERVER_NOTFOUND;
    if (strncmp (buf+(8+1), "200", 3))
        return WPTERR_KEYSERVER_NOTFOUND;
    return 0;
}


/* End the keyserver search procedure. */
void 
kserver_search_end (int conn_fd)
{
    log_debug ("kserver_search_end: fd=%d\r\n", conn_fd);
    closesocket (conn_fd);
}


/* Extract the amount of keys from the info record. */
static int
count_keys_in_response (char *buf)
{
    char *p;
    int recno = 0;
    int n = 0;

    /* info:1:4 */
    if (strncmp (buf, "info", 4))
        return 0;
    p = strtok (buf, ":");
    while (p != NULL) {
        recno++;
        if (recno == 3)
            n = atoi (p);
        p = strtok (NULL, ":");
    }
    return n;
}


/* Start the keyserver search.
   Connect to host @hostname and port @port.
   The pattern are given in @pattern.
   The socket is returned in @conn_fd and @nkeys contains
   the amount of keys which were found. */
int
kserver_search_begin (const char *hostname, WORD port, 
                      const char *pattern, int *conn_fd, int *nkeys)
{
    const char *fmt;
    char *request = NULL;
    char *enc_patt = NULL;
    char status[128];
    int rc, sock_fd;
    int reqlen;
    
    *conn_fd = 0;

    rc = kserver_connect (hostname, port, &sock_fd);
    if (rc)
        goto leave;

    enc_patt = URL_encode (pattern, strlen (pattern), NULL);
    reqlen = strlen (enc_patt) + strlen (hostname) + 32 + 1;

    if (proxy.host && proxy.user && proxy.proto == PROXY_PROTO_HTTP) {
        fmt = "GET http://%s:%d/pks/lookup?options=mr&op=index&search=%s HTTP/1.0\r\n"
              "Proxy-Authorization: Basic %s\r\n\r\n";
        reqlen += strlen (proxy.base64_user) + strlen (fmt) + 1;
        request = safe_alloc (reqlen+1);
        _snprintf (request, reqlen, fmt, skip_type_prefix (hostname), port, 
                   enc_patt, proxy.base64_user);
    }    
    else if (proxy.host && proxy.proto == PROXY_PROTO_HTTP) {
        fmt = "GET http://%s:%d/pks/lookup?options=mr&op=index&search=%s HTTP/1.0\r\n\r\n";
        reqlen += strlen (fmt)+1;
        request = safe_alloc (reqlen+1);
        _snprintf (request, reqlen, skip_type_prefix (hostname), port, 
                            enc_patt);
    }
    else {
        fmt = "GET /pks/lookup?options=mr&op=index&search=%s HTTP/1.0\r\n\r\n";
        reqlen += strlen (fmt)+1;
        request = safe_alloc (reqlen+1);
        _snprintf (request, reqlen, fmt, enc_patt);
    }

    log_debug ("kserver_search_begin:\r\n%s\r\n", request);
    if (sock_write (sock_fd, request, strlen (request)) == SOCKET_ERROR) {
        rc = WPTERR_GENERAL;
        goto leave;
    }
    
    rc = kserver_search_chkresp (sock_fd);
    if (rc) {
        closesocket (sock_fd);
        sock_fd = 0;
        goto leave;
    }

    /* Skip all lines until we reach the "info:" record. */
    for (;;) {
        if (sock_getline (sock_fd, status, sizeof (status)-1, &reqlen)) {       
            log_debug ("kserver_search_begin: retrieving status line failed.\r\n");
            closesocket (sock_fd);
            sock_fd = 0;
            rc = WPTERR_GENERAL;
            break;
        }
        if (!strncmp (status, "info:", 5))
            break;
    }

    if (!rc)
        *nkeys = count_keys_in_response (status);
    *conn_fd = sock_fd;
    
leave:
    free_if_alloc (request);
    free_if_alloc (enc_patt);
    return rc;
}


/* Parse a single pub record returned by the keyserver. */
static void
parse_pub_record (keyserver_key_s *key, char *buf)
{
    enum pub_rec_t {ID=1, KEYID, ALGO, SIZE, CREATE, EXPIRE};
    char *p;
    int recno = 0;

    /* pub:BF3DF9B4:17:1024:925411133:: */
    p = strtok (buf, ":");
    while (p != NULL) {
        recno++;
        switch (recno) {
        case ID: 
            break;

        case KEYID: 
            free_if_alloc (key->keyid);
            key->keyid = m_strdup (p);
            break;

        case ALGO:
            key->algo = atoi (p);
            break;
            
        case SIZE:
            key->bits = atoi (p);
            break;

        case CREATE:
            key->creation = strtoul (p, NULL, 10);
            break;

        case EXPIRE:
            key->expires = strtoul (p, NULL, 10);
            break;
        }
        p = strtok (NULL, ":");
    }
    
}


/* Parse a single user id returned by the keyserver. */
static void
parse_uid_record (keyserver_key_s *key, char *buf)
{
    enum uid_rec_t {ID=1, UID, CREATE, EXPIRE};
    keyserver_uid_s *u, *n;
    char *p, *raw;
    int recno = 0;

    /* uid:Timo Schulz <[email protected]>:1138440360:: */
    u = new keyserver_uid_s;
    memset (u, 0, sizeof *u);

    p = strtok (buf, ":");
    while (p != NULL) {
        recno++;

        switch (recno) {
        case ID:
            break;

        case UID:
            unhexify_buffer (p, &raw);
            u->uid = utf8_to_native (raw);
            free_if_alloc (raw);
            break;

        case CREATE:
            u->creation = strtoul (p, NULL, 10);
            break;

        case EXPIRE:
            u->expires = strtoul (p, NULL, 10);
            break;
        }

        p = strtok (NULL, ":");
    }
    if (!key->uids)
        key->uids = u;
    else {
        for (n = key->uids; n->next; n=n->next)
            ;
        n->next = u;
    }
}


/* Peek the next 3 bytes to check if the next line
   would be a new "pub" record. In this case, return
   -1 as an EOF indication, 0 otherwise. */
static int
is_key_eof (int fd)
{
    char buf[64];
    int n;

    n = recv (fd, buf, 3, MSG_PEEK);
    if (n < 3 || strncmp (buf, "pub", 3))
        return 0;
    return -1;
}


/* Return the next key from the search response. */
int
kserver_search_next (int fd, keyserver_key_s **r_key)
{
    keyserver_uid_s *uid, *u = NULL;
    keyserver_key_s *key;
    char buf[512];
    int n = 0;
    long max = 0;

    log_debug ("keyserver_search_next:\r\n");
    *r_key = NULL;

    key = new keyserver_key_s;
    memset (key, 0, sizeof *key);
    for (;;) {
        if (sock_getline (fd, buf, sizeof (buf)-1, &n))
            break;
        /*log_debug ("record: '%s'\r\n", buf); */
        if (!strncmp (buf, "pub", 3))
            parse_pub_record (key, buf);
        else
            parse_uid_record (key, buf);
        if (is_key_eof (fd))
            break;
    }

    /* the uid with the newest self sig is used as the
       primary user id. */
    for (uid = key->uids; uid; uid = uid->next) {
        if (uid->creation > max) {
            max = uid->creation;
            u = uid;
        }
    }

    key->main_uid = u? u : key->uids;
    *r_key = key;
    return 0;
}


/* Release the keyserver key @key and all its elements. */
void
kserver_release_key (keyserver_key_s *key)
{
    keyserver_uid_s *u;

    while (key->uids) {
        u = key->uids->next;
        free_if_alloc (key->uids->uid);
        free_if_alloc (key->uids);
        key->uids = u;
    }
    free_if_alloc (key->keyid);
    free_if_alloc (key);
}


/* Release mbmers in the proxy context @ctx. */
void
kserver_proxy_release (keyserver_proxy_t ctx)
{
    free_if_alloc (ctx->host);
    free_if_alloc (ctx->pass);
    free_if_alloc (ctx->user);
    ctx->port = ctx->proto = 0;
}


/* Spawn a process given by @cmdl. */
static int
spawn_application (char *cmdl)
{
    STARTUPINFO si;
    PROCESS_INFORMATION pi;
    int rc = 0;

    memset (&si, 0, sizeof (si));
    si.cb = sizeof (si);
    si.dwFlags = STARTF_USESHOWWINDOW;
    si.wShowWindow = SW_HIDE;
    memset (&pi, 0, sizeof (pi));

    if (!CreateProcess (NULL, cmdl, NULL, NULL, FALSE, 0, 
                        NULL, NULL, &si, &pi)) {
        log_box ("Keyserver Plugin", MB_ERR, "Could not spawn helper process");
        rc = -1;
    }

    CloseHandle (pi.hThread);
    WaitForSingleObject (pi.hProcess, INFINITE);
    CloseHandle (pi.hProcess);
    return rc;
}


static FILE*
do_spawn_ldap_helper (const char *host, const char *keyid)
{
    FILE *fp = NULL;
    char *p, *sep;
    char *ksprg;
    char outf[256], inf[256];
    size_t n;

    p = get_gnupg_prog ();
    n = strlen (p) + 1 + 128;
    ksprg = safe_alloc (n+1);
    if (!ksprg)
        BUG (0);
    sep = strrchr (p, '\\');
    if (sep != NULL)
        p[(sep-p)] = 0;

    _snprintf (ksprg, n, "%s\\gpgkeys_ldap.exe", p);
    free_if_alloc (p);
    if (file_exist_check (ksprg)) {
        log_box ("LDAP Keyserver Plugin", MB_ERR, 
                 "%s: could not find LDAP keyserver module!", ksprg);
        fp = NULL;
        goto leave;
    }
    get_temp_name (outf, sizeof (outf)-1, keyid);
    get_temp_name (inf, sizeof (inf)-1, NULL);
    fp = fopen (inf, "w+b");
    if (!fp) {
        log_box ("LDAP Keyserver Plugin", MB_ERR, "%s: %s", inf,
                 winpt_strerror (WPTERR_FILE_OPEN));
        goto leave;
    }
    fprintf (fp,
        "VERSION 1\n"
        "PROGRAM 1.4.3-cvs\n"
        "SCHEME ldap\n"
        "HOST %s\n"
        "COMMAND GET\n"
        "\n"
        "%s\n",
        host? skip_type_prefix (host): "64.94.85.200", keyid);
    fclose (fp);

    p = safe_alloc (strlen (ksprg) + strlen (inf) + strlen (outf) + 32);
    sprintf (p, "%s -o %s %s", ksprg, outf, inf);
    if (spawn_application (p)) {
        fp = NULL;
        goto leave;
    }
    fp = fopen (outf, "rb");
    if (!fp)
        log_box ("LDAP Keyserver Plugin", MB_ERR, "%s: %s", outf, 
                 winpt_strerror (WPTERR_FILE_OPEN));

leave:
    DeleteFile (inf);
    DeleteFile (outf);
    free_if_alloc (p);
    free_if_alloc (ksprg);
    return fp;
}

/* Receive an key via LDAP from host @host with the keyid @keyid.
   @key contains the key on success. */
int
ldap_recvkey (const char *host, const char *keyid, 
              char **r_key, int *r_keylen)
{   
    gpgme_data_t raw;
    FILE *fp;
    const char *s;
    char buf[512];
    int start_key = 0, failed = 0;
    int rc = 0;

    fp = do_spawn_ldap_helper (host, keyid);
    if (!fp)
        return WPTERR_GENERAL;

    if (gpgme_data_new (&raw))
        BUG (0);
    while (!feof (fp)) {
        s = fgets (buf, sizeof (buf)-1, fp);
        if (!s)
            break;
        if (strstr (s, "KEY") && strstr (s, "FAILED")) {
            failed = 1;
            break;
        }
        if (!start_key && strstr (s, "KEY") && strstr (s, "BEGIN")) {
            start_key = 1;
            continue;
        }
        if (!start_key)
            continue;
        gpgme_data_write (raw, buf, strlen (buf));
        if (strstr (s, "KEY") && strstr (s, "END"))
            break;
    }
    fclose (fp);

    if (failed)
        rc = WPTERR_WINSOCK_RECVKEY;
    *r_key = data_release_and_get_mem (raw, r_keylen);
    return rc;
}


/* Receive an key via FINGER from host @host with the user @user.
   On success @key contains the key. */
int
finger_recvkey (const char *host, const char *user, 
                char **r_key, int *r_keylen)
{
    gpgme_data_t raw;
    char buf[256];
    int fd, nread;
    int start_key = 0;
    int rc=0;

    rc = kserver_connect (host, FINGER_PORT, &fd);
    if (rc)
        return rc;

    sock_write (fd, user, strlen (user));
    sock_write (fd, "\r\n", 2);

    if (gpgme_data_new (&raw))
        BUG (0);

    for (;;) {
        if (sock_getline (fd, buf, sizeof (buf), &nread))
            break;
        strcat (buf, "\n");
        if (strstr (buf, "BEGIN PGP PUBLIC KEY BLOCK")) {
            gpgme_data_write (raw, buf, nread);
            start_key = 1;
        }
        else if (strstr (buf, "END PGP PUBLIC KEY BLOCK" ) && start_key) {
            gpgme_data_write (raw, buf, nread);
            start_key--;
            break;
        }
        else if (start_key)
            gpgme_data_write (raw, buf, nread);
    }

    closesocket (fd);
    if (start_key != 0)
        rc = WPTERR_WINSOCK_RECVKEY;
    *r_key = data_release_and_get_mem (raw, r_keylen);
    return rc;
}


/* Check if the given name @name is a valid hostname. */
int
check_IP_or_hostname (const char *name)
{
    const char *not_allowed = "=!§$%&@#*~\\/}][{<>|,;:'";
    size_t i, j;

    for (i=0; i < strlen (name); i++) {
        for (j =0; j < strlen (not_allowed); j++) {
            if (name[i] == not_allowed[j])
                return -1;
        }
    }
    return 0;
}


/* Split the URL @r_keyserver into the host and the port
   part if possible. */
gpgme_error_t
parse_keyserver_url (char **r_keyserver, unsigned short *r_port)
{
    char *p;
    char *url = *r_keyserver;
    int off = 0;

    /* no port is given so use the default port. */
    p = strrchr (url, ':');
    if (p == strchr (url, ':')) {
        int port = port_from_proto (proto_from_URL (url));
        if (!port)
            port = HKP_PORT;
        *r_port = port;
        return 0;
    }

    if (url[(p-url)-1] == '/') /* remove / in .de/:11371 */
        off = 1;

    *r_keyserver = substr (url, 0, (p-url)-off);
    *r_port = atoi (url+(p-url)+1);
    free_if_alloc (url);
    return 0;
}