/*
 * socket.c -- socket library functions
 *
 * Copyright 1998 - 2004 by Eric S. Raymond.
 * Copyright 2004 - 2024 by Matthias Andree.
 * Contributions by Alexander Bluhm, Earl Chew, John Beck.

 * For license terms, see the file COPYING in this directory.
 */

#include "config.h"
#include "fetchmail.h"

#include <stdio.h>
#include <errno.h>
#include <string.h>
#include <strings.h>
#include <ctype.h> /* isspace() */
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/socket.h>
#include <sys/un.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <stdlib.h>
#include <unistd.h>
#include <stdarg.h>
#include <sys/ioctl.h>
#include <sys/time.h>
#include <time.h>
#include <limits.h>
#include <assert.h>

#include "socket.h"
#include "i18n.h"
#include "sdump.h"
#include "uid_db.h"

#ifdef HAVE_SYS_FILIO_H
/* OpenIndiana requires this to find FIONREAD */
#include <sys/filio.h>
#endif

/* Defines, these used to be used to allow BeOS and Cygwin to play nice...
   these days, fetchmail requires a conforming system. */
#define fm_close(a)	close(a)
#define fm_write(a,b,c)	write(a,b,c)
#define fm_peek(a,b,c)	recv(a,b,c, MSG_PEEK)
#define fm_read(a,b,c)	read(a,b,c)

static void free_plugindata(char **argvec)
{
    if (argvec) {
	xfree(*argvec);
	xfree(argvec);
    }
}

/** parse plugin and interpolate %h and %p with single-quoted host and service.  
 * Returns a malloc()ed pointer to a NULL-terminated vector of pointers, of 
 * which the first is also malloc()ed and the 2nd and later ones (if present) 
 * are pointers into the same memory region - these serve as input for the 
 * argument vector of execvp() in handle_plugin. */
static char **parse_plugin(const char *plugin, const char *host, const char *service)
{
	char **argvec;
	const char *c, *p;
	char *cp, *plugin_copy;
	size_t plugin_copy_len;
	size_t plugin_offset = 0, plugin_copy_offset = 0;
	unsigned int i;
	size_t vecsiz = 2 * sizeof(char*);
	unsigned int host_count = 0, service_count = 0;
	size_t plugin_len = strlen(plugin);
	size_t host_len = strlen(host);
	size_t service_len = strlen(service);

	for (c = p = plugin; *c; c++)
	{	if (isspace((unsigned char)*c) && !isspace((unsigned char)*p))
			vecsiz += sizeof(char*);
		if (*p == '%' && *c == 'h')
			host_count++;
		if (*p == '%' && *c == 'p')
			service_count++;
		p = c;
	}

	/* we need to discount 2 bytes for each placeholder */
	plugin_copy_len = plugin_len + (host_len - 2) * host_count + (service_len - 2) * service_count;
	plugin_copy = (char *)xmalloc(plugin_copy_len + 1);

	while (plugin_offset < plugin_len && plugin_copy_offset < plugin_copy_len)
	{	if ((plugin[plugin_offset] == '%') && (plugin[plugin_offset + 1] == 'h'))
		{	strcpy(plugin_copy + plugin_copy_offset, host);
			plugin_offset += 2;
			plugin_copy_offset += host_len;
		}
		else if ((plugin[plugin_offset] == '%') && (plugin[plugin_offset + 1] == 'p'))
		{	strcpy(plugin_copy + plugin_copy_offset, service);
			plugin_offset += 2;
			plugin_copy_offset += service_len;
		}
		else
		{	plugin_copy[plugin_copy_offset] = plugin[plugin_offset];
			plugin_offset++;
			plugin_copy_offset++;
		}
	}
	plugin_copy[plugin_copy_offset] = 0;

	/* XXX FIXME - is this perhaps a bit too simplistic to chop down the argument strings without any respect to quoting?
	 * better write a generic function that tracks arguments instead... */
	argvec = (char **)malloc(vecsiz);
	if (!argvec)
	{
		free(plugin_copy);
		report(stderr, GT_("fetchmail: malloc failed\n"));
		return NULL;
	}
	memset(argvec, 0, vecsiz);
	argvec[0] = plugin_copy; /* make sure we can free() it in every case */
	for (p = cp = plugin_copy, i = 0; *cp; cp++)
	{	if ((!isspace((unsigned char)*cp)) && (cp == p ? 1 : isspace((unsigned char)*p))) {
			argvec[i] = cp;
			i++;
		}
		p = cp;
	}
	for (cp = plugin_copy; *cp; cp++)
	{	if (isspace((unsigned char)*cp))
			*cp = 0;
	}
	return argvec;
}

static int handle_plugin(const char *host,
			 const char *service, const char *plugin)
/* get a socket mediated through a given external command */
{
    int fds[2];
    char **argvec;

    /*
     * The author of this code, Felix von Leitner <felix@convergence.de>, says:
     * he chose socketpair() instead of pipe() because socketpair creates 
     * bidirectional sockets while allegedly some pipe() implementations don't.
     */
    argvec = parse_plugin(plugin,host,service);
    if (!argvec || !*argvec[0]) {
	free_plugindata(argvec);
	report(stderr, GT_("fetchmail: plugin for host %s service %s is empty, cannot run!\n"), host, service);
	return -1;
    }
    if (socketpair(AF_UNIX,SOCK_STREAM,0,fds))
    {
	report(stderr, GT_("fetchmail: socketpair failed\n"));
	free_plugindata(argvec);
	return -1;
    }
    switch (fork()) {
	case -1:
		/* error */
		free_plugindata(argvec);
		report(stderr, GT_("fetchmail: fork failed\n"));
		return -1;
	case 0:	/* child */
		/* fds[1] is the parent's end; close it for proper EOF
		** detection */
		(void) close(fds[1]);
		if ( (dup2(fds[0],0) == -1) || (dup2(fds[0],1) == -1) ) {
			report(stderr, GT_("dup2 failed\n"));
			_exit(EXIT_FAILURE);
		}
		/* fds[0] is now connected to 0 and 1; close it */
		(void) close(fds[0]);
		if (outlevel >= O_VERBOSE)
		    report(stderr, GT_("running %s (host %s service %s)\n"), plugin, host, service);
		execvp(*argvec, argvec);
		report(stderr, GT_("execvp(%s) failed\n"), *argvec);
		_exit(EXIT_FAILURE);
		break;
	default:	/* parent */
		free_plugindata(argvec);
		break;
    }
    /* fds[0] is the child's end; close it for proper EOF detection */
    (void) close(fds[0]);
    return fds[1];
}

/** Set socket to SO_KEEPALIVE. \return 0 for success. */
static int SockKeepalive(int sock) {
    int keepalive = 1;
    return setsockopt(sock, SOL_SOCKET, SO_KEEPALIVE, &keepalive, sizeof keepalive);
}

int UnixOpen(const char *path)
{
    int sock = -1;
    struct sockaddr_un ad;
    memset(&ad, 0, sizeof(ad));
    ad.sun_family = AF_UNIX;
    strlcpy(ad.sun_path, path, sizeof(ad.sun_path));

    sock = socket( AF_UNIX, SOCK_STREAM, 0 );
    if (sock < 0)
    {
	return -1;
    }

    /* Socket opened saved. Useful if connect timeout
     * because it can be closed.
     */
    mailserver_socket_temp = sock;

    if (connect(sock, (struct sockaddr *) &ad, sizeof(ad)) < 0)
    {
	int olderr = errno;
	fm_close(sock);	/* don't use SockClose, no traffic yet */
	errno = olderr;
	sock = -1;
    }

    /* No connect timeout, then no need to set mailserver_socket_temp */
    mailserver_socket_temp = -1;

    return sock;
}

int SockOpen(const char *host, const char *service,
	     const char *plugin, struct addrinfo **ai_in)
{
    struct addrinfo *ai, req;
    int i, acterr = 0;
    int ord;
    char errbuf[8192] = "";

    if (plugin)
	return handle_plugin(host,service,plugin);

    memset(&req, 0, sizeof(struct addrinfo));
    req.ai_socktype = SOCK_STREAM;
#ifdef AI_ADDRCONFIG
    req.ai_flags = AI_ADDRCONFIG;
#endif

    i = fm_getaddrinfo(host, service, &req, ai_in);
    if (i) {
	report(stderr, GT_("getaddrinfo(\"%s\",\"%s\") error: %s\n"),
		host, service, gai_strerror(i));
	if (i == EAI_SERVICE)
	    report(stderr, GT_("Try adding the --service option (see also FAQ item R12).\n"));
	return -1;
    }

    /* NOTE a Linux bug here - getaddrinfo will happily return 127.0.0.1
     * twice if no IPv6 is configured */
    i = -1;
    for (ord = 0, ai = *ai_in; ai; ord++, ai = ai->ai_next) {
	char buf[256]; /* hostname */
	char pb[256];  /* service name */
	int gnie;      /* getnameinfo result code */

	gnie = getnameinfo(ai->ai_addr, ai->ai_addrlen, buf, sizeof(buf), NULL, 0, NI_NUMERICHOST);
	if (gnie)
	    snprintf(buf, sizeof(buf), GT_("unknown (%s)"), gai_strerror(gnie));
	gnie = getnameinfo(ai->ai_addr, ai->ai_addrlen, NULL, 0, pb, sizeof(pb), NI_NUMERICSERV);
	if (gnie)
	    snprintf(pb, sizeof(pb), GT_("unknown (%s)"), gai_strerror(gnie));

	if (outlevel >= O_VERBOSE)
	    report_build(stdout, GT_("Trying to connect to %s/%s..."), buf, pb);
	i = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
	if (i < 0) {
	    int e = errno;
	    /* mask EAFNOSUPPORT errors, they confuse users for
	     * multihomed hosts */
	    if (errno != EAFNOSUPPORT)
		acterr = errno;
	    if (outlevel >= O_VERBOSE)
		report_complete(stdout, GT_("cannot create socket: %s\n"), strerror(e));
	    snprintf(errbuf+strlen(errbuf), sizeof(errbuf)-strlen(errbuf),\
		     GT_("name %d: cannot create socket family %d type %d: %s\n"), ord, ai->ai_family, ai->ai_socktype, strerror(e));
	    continue;
	}

	SockKeepalive(i);

	/* Save socket descriptor.
	 * Used to close the socket after connect timeout. */
	mailserver_socket_temp = i;

	if (connect(i, (struct sockaddr *) ai->ai_addr, ai->ai_addrlen) < 0) {
	    int e = errno;

	    /* additionally, suppress IPv4 network unreach errors */
	    if (e != EAFNOSUPPORT)
		acterr = errno;

	    if (outlevel >= O_VERBOSE) {
		report_complete(stdout, GT_("connection failed.\n"));
		report(stderr, GT_("connection to %s:%s [%s/%s] failed: %s.\n"), host, service, buf, pb, strerror(e));
	    }
	    snprintf(errbuf+strlen(errbuf), sizeof(errbuf)-strlen(errbuf), GT_("name %d: connection to %s:%s [%s/%s] failed: %s.\n"), ord, host, service, buf, pb, strerror(e));
	    fm_close(i);
	    i = -1;
	    continue;
	} else {
	    if (outlevel >= O_VERBOSE)
		report_complete(stdout, GT_("connected.\n"));
	}

	/* No connect timeout, then no need to set mailserver_socket_temp */
	mailserver_socket_temp = -1;

	break;
    }

    fm_freeaddrinfo(*ai_in);
    *ai_in = NULL;

    if (i == -1) {
	report(stderr, GT_("Connection errors for this poll:\n%s"), errbuf);
	errno = acterr;
    }

    return i;
}

static size_t fmtbufsize;
static char *fmtbuf;

void SockFreeFbuf(void) {
    if (fmtbuf) {
	xzerofree(fmtbuf);
	fmtbufsize = 0;
    }
}

/** round_pow2 rounds its argument up to the next power of 2.
 * Returns UINT_MAX on overflow. */
static unsigned int round_pow2(unsigned int v, bool *errorflag) {
    if (!v) return 1;  // 2^0 = 1
#ifndef NDEBUG
    unsigned int orig_v = v;
#endif
    v--;
    v |= v >> 1;
    v |= v >> 2;
    v |= v >> 4;
    v |= v >> 8;
    v |= v >> 16;
#if SIZEOF_INT > 4
    v |= v >> 32;
#endif
#if SIZEOF_INT > 8 // OK - that will get interesting
    v |= v >> 64;
#endif
    v++;
    if (!v) {
	v = UINT_MAX;
	if (errorflag) *errorflag = true;
    }
#ifndef NDEBUG
    assert(v >= orig_v);
#endif
    return v;
}

/** allocate a sufficiently sized fmtbuf, keep its size in fmtbufsize,
 * format the arguments as if by fprintf, and use SockWrite to ship them
 * to socket \sock.
 * Optionally clear the internal formatting buffer to not let secrets
 * around.
 * Will abort() if vsnprintf() malfunctions. */
__attribute__ ((format(printf, 3, 0)))
static ssize_t SockVPrintf(int sock, bool clearbuf /** if true, clear internal buffer after sending the data */, const char *format, va_list args)
{
    va_list args_save;
    va_copy(args_save, args);
    int somesize = vsnprintf(NULL, 0, format, args_save);
    va_end(args_save);
    if (somesize < 0) return somesize; /* ERROR */
    // we're now sure that somesize isn't negative
    ++somesize; // make room for NUL byte

    enum { MINFMTSIZE = 4096 };
    if (fmtbufsize < (unsigned)somesize) {
	// if (somesize < MINFMTSIZE) somesize = MINFMTSIZE;
	fmtbufsize = round_pow2(somesize, NULL);  // this shouldn't usually trigger
	fmtbuf = (char *)xrealloc(fmtbuf, fmtbufsize);
    }
    somesize = vsnprintf(fmtbuf, fmtbufsize, format, args);
    if (somesize < 0 || (unsigned)somesize >= fmtbufsize) {
	// paranoia - this indicates an error or an overflow
	// neither should happen because we should
	// have allocated sufficient memory and it's
	// implausible for vsnprintf to fail this time
	// if it succeeded the first time.
	fm_safe_clearmem(fmtbuf, fmtbufsize);
	return -1;
    }
    ssize_t retval = SockWrite(sock, fmtbuf, somesize);
    if (clearbuf) fm_safe_clearmem(fmtbuf, fmtbufsize);
    return retval;
}

ssize_t SockPrintfClear(int sock, const char* format, ...)
{
    va_list ap;

    va_start(ap, format);
    ssize_t result = SockVPrintf(sock, true, format, ap);
    va_end(ap);
    return result;
}

ssize_t SockPrintf(int sock, const char* format, ...)
{
    va_list ap;

    va_start(ap, format);
    ssize_t result = SockVPrintf(sock, false, format, ap);
    va_end(ap);
    return result;
}

#ifdef SSL_ENABLE
#ifndef __sun__
/* work around OpenIndiana's openssl-31 package being configured with 10101 as API level
and only #define this when not on such an OS */
# define OPENSSL_API_COMPAT 30000 // specify API compat level
#endif
#include "tls-aux.h"
#include <openssl/err.h>
#include <openssl/pem.h>
#include <openssl/x509v3.h>
#include <openssl/rand.h>

enum { SSL_min_security_level = 2 };

#define DO_SSL_VERSION_CHECK 1
#ifdef LIBRESSL_VERSION_NUMBER
# ifdef __OpenBSD__
#  define TLSprovider "LibreSSL(OpenBSD)"
#  undef  DO_SSL_VERSION_CHECK
#  define DO_SSL_VERSION_CHECK 0
# else
#  error "FAILED - LibreSSL cannot be used legally, for lack of GPL clause 2b exception, see COPYING." 
# endif
#endif

#ifdef USING_WOLFSSL
# define TLSprovider "wolfSSL"
# if LIBWOLFSSL_VERSION_HEX < 0x05007002L
#  error "FAILED - wolfSSL MUST be at least version 5.7.2. You have " LIBWOLFSSL_VERSION_STRING "."
# endif
# if LIBWOLFSSL_VERSION_HEX < 0x05007002L
#  pragma message "WARNING - wolfSSL SHOULD be at least version 5.7.2. You have " LIBWOLFSSL_VERSION_STRING "."
# endif
#else /* !USING_WOLFSSL */
# ifndef TLSprovider
#  define TLSprovider "OpenSSL"
# endif
# define fm_MIN_OPENSSL_VER 0x30000090L
/* do not warn about OpenSSL 3.2.0, the 3.2.1 fix is of low priority */
# if OPENSSL_VERSION_NUMBER >= 0x30100000L && OPENSSL_VERSION_NUMBER < 0x30200000L
#  if OPENSSL_VERSION_NUMBER < 0x30100040L
#   pragma message "WARNING - OpenSSL 3.1.n SHOULD be at least release version 3.1.4, using " OPENSSL_VERSION_TEXT "."
#  endif
# endif                     /* 0xMNN00PPSL */
# if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_VERSION_NUMBER < 0x30100000L
#  if OPENSSL_VERSION_NUMBER < 0x30000090L
#   pragma message "WARNING - OpenSSL 3.0.n SHOULD be at least release version 3.0.9, using " OPENSSL_VERSION_TEXT "."
#  endif
# endif                     /* 0xMNN00PPSL */
#  if OPENSSL_VERSION_NUMBER < 0x30000000L && !defined(__OpenBSD__)
#   pragma message "WARNING - OpenSSL before 3.0.0 is end-of-life and unsupported, using " OPENSSL_VERSION_TEXT "."
#  endif
# if DO_SSL_VERSION_CHECK && OPENSSL_VERSION_NUMBER < fm_MIN_OPENSSL_VER
#  error Your OpenSSL version must be at least 3.0.9 release. Older OpenSSL versions are unsupported.
# else /* OpenSSL too old */
/*
#define __fm_ossl_ver(x) #x
#define _fm_ossl_ver(x) __fm_ossl_ver(x)
#pragma message "Building with OpenSSL headers version " _fm_ossl_ver(OPENSSL_VERSION_NUMBER) ", " OPENSSL_VERSION_TEXT
*/
# endif /* OpenSSL too old */
#endif /* USING_WOLFSSL */

/* workaround for EVP_MD_fetch API - missing on wolfSSL and LibreSSL, both 
 * claim 1.x or 2.x OpenSSL versions, so make our lives easy: */
#if OPENSSL_VERSION_NUMBER < 0x30000000L
# define EVP_MD_fetch(x, digest, y) (EVP_get_digestbyname(digest))
# define EVP_MD_free(x) /* NOOP */
# define fm_EVP_MD_const const // compatibility const EVP_MD* from EVP_get_digestbyname()
#else
# define fm_EVP_MD_const // nothing, EVP_MD_fetch returns a mutable EVP_MD*
#endif

static void report_SSL_errors(FILE *stream)
{
    unsigned long err;
    char errbuf[512];

    while (0ul != (err = ERR_get_error())) {
	ERR_error_string_n(err, errbuf, sizeof errbuf);
	report(stream, GT_("%s reported: %s\n"), TLSprovider, errbuf);
    }
}

/* override ERR_print_errors_fp to our own implementation */
#undef ERR_print_errors_fp
#define ERR_print_errors_fp(stream) report_SSL_errors((stream))

static	SSL_CTX *_ctx[FD_SETSIZE];
static	SSL *_ssl_context[FD_SETSIZE];

static SSL *SSLGetContext(int);
static int check_sslfp(const X509 *x509_cert, char *text, size_t textsize, int *retFlag);
#endif /* SSL_ENABLE */

ssize_t SockWrite(int sock, const char *buf, size_t len)
{
    ssize_t n;
    ssize_t wrlen = 0;
    if (len > INT_MAX) len = INT_MAX;  // clamp to sane default
#ifdef	SSL_ENABLE
    SSL *ssl = SSLGetContext(sock);
#endif

    while (len)
    {
#ifdef SSL_ENABLE
	if (ssl) {
	    ERR_clear_error();
	    n = SSL_write(ssl, buf, (int)len);
	} else
#endif /* SSL_ENABLE */
	    n = (int)fm_write(sock, buf, len); // since len is an int, we can cast the return value to int
#ifdef SSL_ENABLE
        if (n <= 0 && ssl) {
	    int ssle = SSL_get_error(ssl, (int)n); // do this before flushing the error queue!
	    // map error code to n = 0 -> retryable or n = -1 -> true error
	    switch(ssle) {
		case SSL_ERROR_ZERO_RETURN:
		case SSL_ERROR_SYSCALL:
		case SSL_ERROR_SSL:
			n = -1; break;
		default:
			/* assume retryable */
			n = 0; break;
	    }
	    if (n)
		    ERR_print_errors_fp(stderr); // do this after SSL_get_error - and only on fatal errors
	}
#endif
	if (n < 0)
            return -1;
        len -= n;
	wrlen += n;
	buf += n;
    }
    return wrlen;
}

ssize_t SockRead(int sock, char *buf, size_t len)
{
    if (len > INT_MAX) len = INT_MAX;  // clamp to sane default
    // as for SockWrite, we cast some ssize_t return values to int
    // on the assumption that we can't possibly read more than INT_MAX
    // because our input type already is only an int.
    char *newline, *bp = buf;
    ssize_t n;
#ifdef	SSL_ENABLE
    SSL *ssl;
#endif

    if (--len < 1)
	return -1;
    do {
	/* 
	 * The reason for these gymnastics is that we want two things:
	 * (1) to read \n-terminated lines,
	 * (2) to return the true length of data read, even if the
	 *     data coming in has embedded NULS.
	 */
#ifdef	SSL_ENABLE
	if( NULL != ( ssl = SSLGetContext( sock ) ) ) {
		int e;
		/* Hack alert! */
		/* XXX FIXME: once we deprecate OpenSSL before 1.1.1, we can
		 * use SSL_peek_ex() and SSL_read_ex() and simplify this code
		 * quite a bit - but the compatibility interfaces to other
		 * libraries such as OpenBSD's LibreSSL, and wolfSSL, made
		 * this not happen yet. */
		/* OK...  SSL_peek works a little different from MSG_PEEK
			Problem is that SSL_peek can return 0 if there
			is no data currently available.  If, on the other
			hand, we lose the socket, we also get a zero, but
			the SSL_read then SEGFAULTS!  To deal with this,
			we'll check the error code any time we get a return
			of zero from SSL_peek.  If we have an error, we bail.
			If we don't, we read one character in SSL_read and
			loop.  This should continue to work even if they
			later change the behavior of SSL_peek
			to "fix" this problem...  :-(	*/
		ERR_clear_error();
		if ((n = SSL_peek(ssl, bp, (int)len)) <= 0) {
			/* SSL_peek says no data...  Does he mean no data
			or did the connection blow up?  If we got an error
			then bail! */
			e = SSL_get_error(ssl, (int)n);
			if (SSL_ERROR_NONE != e
#ifdef USING_WOLFSSL
			/* wolfSSL 5.0.0 may return SSL_ERROR_WANT_READ when
			 * receiving HANDSHAKE instead of app data on SSL_peek
			 * https://github.com/wolfSSL/wolfssl/issues/4593 */
					&& SSL_ERROR_WANT_READ != e
#endif
			   )
			{
				ERR_print_errors_fp(stderr);
				return -1;
			}
			/* We didn't get an error so read at least one
				character at this point and loop */
			n = 1;
			/* Make sure newline start out NULL!
			 * We don't have a string to pass through
			 * the strchr at this point yet */
			newline = NULL;
		} else if ((newline = (char *)memchr(bp, '\n', n)) != NULL)
			n = (int)(newline - bp + 1);
		/* Matthias Andree: SSL_read can return 0, in that case
		 * we must call SSL_get_error to figure if there was
		 * an error or just a "no data" condition */
		// OpenSSL 3 documents "Old documentation indicated a difference between 0 and -1, and that -1 was retryable.
                // You should instead call SSL_get_error() to find out if it's retryable."
                // However, we've set auto retry mode on the SSL_CTX so we needn't care about the
                // SSL_ERROR_WANT_READ SSL_ERROR_WANT_WRITE return codes.
		ERR_clear_error();
		if ((n = SSL_read(ssl, bp, (int)n)) <= 0) {
			e = SSL_get_error(ssl, (int)n);
			if (SSL_ERROR_NONE != e) {
				ERR_print_errors_fp(stderr);
				return -1;
			}
		}
		/* Check for case where our single character turned out to
		 * be a newline...  (It wasn't going to get caught by
		 * the strchr above if it came from the hack...  ). */
		if( NULL == newline && 1 == n && '\n' == *bp ) {
			/* Got our newline - this will break
				out of the loop now */
			newline = bp;
		}
	}
	else
#endif /* SSL_ENABLE */
	{
	    if (sock < 0)
		return -1;
	    if ((n = (int)fm_peek(sock, bp, len)) <= 0)
		return -1;
	    if ((newline = (char *)memchr(bp, '\n', n)) != NULL)
		n = (int)(newline - bp + 1);
	    if ((n = (int)fm_read(sock, bp, n)) == -1)
		return -1;
	}
	bp += n;
	len -= n;
    } while (!newline && len);
    *bp = '\0';

    return (int)(bp - buf);
}

int SockPeek(int sock)
/* peek at the next socket character without actually reading it */
{
    int n;
    char ch;
#ifdef	SSL_ENABLE
    SSL *ssl = SSLGetContext(sock);
#endif

#ifdef	SSL_ENABLE
	if (ssl) {
		ERR_clear_error();
		n = SSL_peek(ssl, &ch, 1);
		if (n <= 0) {
			/* SSL_peek says 0...  Does that mean no data
			or did the connection blow up?  If we got an error
			then bail! */
			int e = SSL_get_error(ssl, n);
			if (SSL_ERROR_NONE != e) {
				ERR_print_errors_fp(stderr);
				return -1;
			}

			/* Haven't seen this case actually occur, but...
			   if the problem in SockRead can occur, this should
			   be possible...  Just not sure what to do here.
			   This should be a safe "punt" the "peek" but don't
			   "punt" the "session"... */

			return 0;	/* Give him a '\0' character */
		}
	}
	else
#endif /* SSL_ENABLE */
	    /* casting to int is safe on the next line, 1 fits an int */
	       n = sock >= 0 ? (int)fm_peek(sock, &ch, 1) : -1;
	if (n == -1)
		return -1;

    return ch;
}

#ifdef SSL_ENABLE

static	char *_ssl_server_cname = NULL;
static	int _check_fp;
static	const char *_check_digest;
static	char *_server_label;
static	int _depth0ck;
static	int _firstrun;
static	int _prev_err;
static	int _verify_ok;

SSL *SSLGetContext( int sock )
{
	if( sock < 0 || (unsigned)sock > FD_SETSIZE )
		return NULL;
	if( _ctx[sock] == NULL )
		return NULL;
	return _ssl_context[sock];
}

/* ok_return is 1 if this stage of certificate verification
   passed, or 0 if it failed. This callback lets us display informative
   errors, and perform additional validation (e.g. CN matches) */
static int SSL_verify_callback(int ok_return, X509_STORE_CTX *ctx, const int strict)
{
#define SSLverbose (((outlevel) >= O_DEBUG) || ((outlevel) >= O_VERBOSE && (depth) == 0))
	char buf[257];
	X509 *x509_cert;
	int err, depth, i;
	X509_NAME *subj, *issuer;
	char *tt;

	x509_cert = X509_STORE_CTX_get_current_cert(ctx);
	if (!x509_cert) {
	    report(stderr, GT_("SSL verify callback error: current certificate NULL!\n"));
	    return 0;
	}
	err = X509_STORE_CTX_get_error(ctx);
	depth = X509_STORE_CTX_get_error_depth(ctx);

	subj = X509_get_subject_name(x509_cert);
	issuer = X509_get_issuer_name(x509_cert);

	if (outlevel >= O_DEBUG) {
		if (SSLverbose)
			report(stdout, GT_("SSL verify callback depth %d: verify_ok == %d, err = %d, %s\n"),
					depth, ok_return, err, X509_verify_cert_error_string(err));
	}

	if (outlevel >= O_VERBOSE) {
		if (depth == 0 && SSLverbose)
			report(stdout, GT_("Server certificate:\n"));
		else {
			if (_firstrun) {
				_firstrun = 0;
				if (SSLverbose)
					report(stdout, GT_("Certificate chain, from root to peer, starting at depth %d:\n"), depth);
			} else {
				if (SSLverbose)
					report(stdout, GT_("Certificate at depth %d:\n"), depth);
			}
		}

		if (SSLverbose) {
			if ((i = X509_NAME_get_text_by_NID(issuer, NID_organizationName, buf, sizeof(buf))) != -1) {
				report(stdout, GT_("Issuer Organization: %s\n"), (tt = sdump(buf, i)));
				xfree(tt);
				if ((size_t)i >= sizeof(buf) - 1)
					report(stdout, GT_("Warning: Issuer Organization Name too long (possibly truncated).\n"));
			} else
				report(stdout, GT_("Unknown Organization\n"));
			if ((i = X509_NAME_get_text_by_NID(issuer, NID_commonName, buf, sizeof(buf))) != -1) {
				report(stdout, GT_("Issuer CommonName: %s\n"), (tt = sdump(buf, i)));
				xfree(tt);
				if ((size_t)i >= sizeof(buf) - 1)
					report(stdout, GT_("Warning: Issuer CommonName too long (possibly truncated).\n"));
			} else
				report(stdout, GT_("Unknown Issuer CommonName\n"));
		}
	}

	if ((i = X509_NAME_get_text_by_NID(subj, NID_commonName, buf, sizeof(buf))) != -1) {
		if (SSLverbose) {
			report(stdout, GT_("Subject CommonName: %s\n"), (tt = sdump(buf, i)));
			xfree(tt);
		}
		if ((size_t)i >= sizeof(buf) - 1) {
			/* Possible truncation. In this case, this is a DNS name, so this
			 * is really bad. We do not tolerate this even in the non-strict case. */
			report(stderr, GT_("Bad certificate: Subject CommonName too long!\n"));
			return 0;
		}
		if ((size_t)i > strlen(buf)) {
			/* Name contains embedded NUL characters, so we complain. This is likely
			 * a certificate spoofing attack. */
			report(stderr, GT_("Bad certificate: Subject CommonName contains NUL, aborting!\n"));
			return 0;
		}
	}

	if (depth == 0) { /* peer certificate */
		if (!_depth0ck) {
			_depth0ck = 1;
		}

		if ((i = X509_NAME_get_text_by_NID(subj, NID_commonName, buf, sizeof(buf))) != -1) {
			if (_ssl_server_cname != NULL) {
				char *p1 = buf;
				char *p2 = _ssl_server_cname;
				int matched = 0;
				STACK_OF(GENERAL_NAME) *gens;

				/* RFC 2595 section 2.4: find a matching name
				 * first find a match among alternative names */
				gens = (STACK_OF(GENERAL_NAME) *)X509_get_ext_d2i(x509_cert, NID_subject_alt_name, NULL, NULL);
				if (gens) {
					int j, r;
					for (j = 0, r = sk_GENERAL_NAME_num(gens); j < r; ++j) {
						const GENERAL_NAME *gn = sk_GENERAL_NAME_value(gens, j);
						if (gn->type == GEN_DNS) {
							char *pp1 = (char *)gn->d.ia5->data;
							char *pp2 = _ssl_server_cname;
							if (outlevel >= O_VERBOSE) {
								report(stdout, GT_("Subject Alternative Name: %s\n"), (tt = sdump(pp1, (size_t)gn->d.ia5->length)));
								xfree(tt);
							}
							/* Name contains embedded NUL characters, so we complain. This
							 * is likely a certificate spoofing attack. */
							if ((size_t)gn->d.ia5->length != strlen(pp1)) {
								report(stderr, GT_("Bad certificate: Subject Alternative Name contains NUL, aborting!\n"));
								sk_GENERAL_NAME_free(gens);
								return 0;
							}
							if (name_match(pp1, pp2)) {
							    matched = 1;
							}
						}
					}
					GENERAL_NAMES_free(gens);
				}
				if (name_match(p1, p2)) {
					matched = 1;
				}
				if (!matched) {
					if (strict || SSLverbose) {
						report(stderr,
								GT_("Server CommonName mismatch: %s != %s\n"),
								(tt = sdump(buf, i)), _ssl_server_cname );
						xfree(tt);
					}
					ok_return = 0;
				}
			} else if (ok_return) {
				report(stderr, GT_("Server name not set, could not verify certificate!\n"));
				if (strict) return 0;
			}
		} else {
			if (outlevel >= O_VERBOSE)
				report(stdout, GT_("Unknown Server CommonName\n"));
			if (ok_return && strict) {
				report(stderr, GT_("Server name not specified in certificate!\n"));
				return 0;
			}
		}
		/* Print the finger print. Note that on errors, we might print it more than once
		 * normally; we kluge around that by using a global variable. */
		if (_check_fp == 1) {
                        int retFlag;
			char text[EVP_MAX_MD_SIZE * 3 + 1];
                        int retVal = check_sslfp(x509_cert, text, sizeof text, &retFlag);
                        if (retFlag == 1)
                                return retVal;
                } /* if (_check_fp) */
	} /* if (depth == 0 && !_depth0ck) */

	if (err != X509_V_OK && err != _prev_err && !(_check_fp != 0 && _check_digest && !strict)) {
		char *tmp;
		int did_rep_err = 0;
		_prev_err = err;

                report(stderr, GT_("Server certificate verification error: %s\n"), X509_verify_cert_error_string(err));
                /* We gave the error code, but maybe we can add some more details for debugging */

		switch (err) {
		/* actually we do not want to lump these together, but
		 * since OpenSSL flipped the meaning of these error
		 * codes in the past, and they do hardly make a
		 * practical difference because servers need not provide
		 * the root signing certificate, we don't bother telling
		 * users the difference:
		 */
		case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
		case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
			X509_NAME_oneline(issuer, buf, sizeof(buf));
			buf[sizeof(buf) - 1] = '\0';
			report(stderr, GT_("Broken certification chain at: %s\n"), (tmp = sdump(buf, strlen(buf))));
			xfree(tmp);
			report(stderr, GT_(	"This could mean that the server did not provide the intermediate CA's certificate(s), "
						"which is nothing fetchmail could do anything about.  For details, "
						"please see the README.SSL-SERVER document that ships with fetchmail.\n"));
			did_rep_err = 1;
			/* FALLTHROUGH */
		case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
		case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
			if (!did_rep_err) {
			    X509_NAME_oneline(issuer, buf, sizeof(buf));
			    buf[sizeof(buf) - 1] = '\0';
			    report(stderr, GT_("Missing trust anchor certificate: %s\n"), (tmp = sdump(buf, strlen(buf))));
			    xfree(tmp);
			}
			report(stderr, GT_(	"This could mean that the root CA's signing certificate is not in the "
						"trusted CA certificate location, or that c_rehash needs to be run "
						"on the certificate directory. For details, please "
						"see the documentation of --sslcertpath and --sslcertfile in the manual page. "
						"See README.SSL for details.\n"));
			break;
		default:
			break;
		}
	}
	/*
	 * If not in strict checking mode (--sslcertck), override this
	 * and pretend that verification had succeeded.
	 */
	_verify_ok &= ok_return;
	if (!strict)
		ok_return = 1;
	return ok_return;
}

int check_sslfp(const X509 *x509_cert, char *text, size_t textsize, int *retFlag)
{
        *retFlag = 1;
        unsigned dp;

        _check_fp = -1;
        fm_EVP_MD_const EVP_MD *digest_impl = NULL;
	unsigned char digest[EVP_MAX_MD_SIZE];
	char *dig = NULL;
	const char *expected_digest = _check_digest;

	if (_check_digest && 1 == regex_ere_search("^\\{[a-z0-9-]+\\}", _check_digest)) {
		size_t len = strcspn(_check_digest + 1, "}");
		dig = (char *)xmalloc(len + 1);
		memcpy(dig, _check_digest + 1, len);
		dig[len] = '\0';
		ERR_clear_error();
		digest_impl = EVP_MD_fetch(NULL, dig, NULL);
		if (!digest_impl) {
			report(stderr, GT_("Cannot fetch digest implementation %s for sslfingerprint!\n"), dig);
			report_SSL_errors(stderr);
			xfree(dig);
			return 0;
		}
		expected_digest += len + 2; // +2 for { }
	}

	// fall back to MD5 for compatibility with historic fetchmail versions
	if (!digest_impl) {
		dig = xstrdup("MD5");
		ERR_clear_error();
		digest_impl = EVP_MD_fetch(NULL, dig, NULL);
	}

        if (!digest_impl)
        {
                report(stderr, GT_("Cannot fetch digest implementation %s for sslfingerprint!\n"), dig);
		xfree(dig);
                return 0;
        }

	xfree(dig);
	dig = xstrdup(EVP_MD_name(digest_impl));

        unsigned int dsz;
        int success = X509_digest(x509_cert, digest_impl, digest, &dsz);
	EVP_MD_free(digest_impl);
	if (!success)
        {
                report(stderr, GT_("X509_digest(): Out of memory!\n"));
		xfree(dig);
                return 0;
        }

        char *tp = text;
        char *te = text + textsize;
	bool fp_printed = false;
        for (dp = 0; dp < dsz; dp++)
        {
                int esz = snprintf(tp, te - tp, dp > 0 ? ":%02X" : "%02X", (unsigned int)digest[dp]);
                if (esz >= te - tp)
                {
                        report(stderr, GT_("Digest text buffer too small!\n"));
                        return 0;
                }
                tp += esz;
        }
        if (outlevel > O_NORMAL) {
		report(stdout, GT_("%s fingerprint is: {%s}%s\n"), _server_label, dig, text);
		fp_printed = true;
	}
        if (_check_digest && expected_digest)
        {
                if (0 == strcmp(expected_digest, "*")) {
			if (!fp_printed) {
				report(stdout, GT_("%s fingerprint is: {%s}%s\n"), _server_label, dig, text);
				fp_printed = true;
			}
		}
		else if (0 == strcasecmp(text, expected_digest))
                {
                        if (outlevel > O_NORMAL)
                                report(stdout, GT_("%s fingerprint (%s) matches: %s\n"), _server_label, dig, expected_digest);
                }
                else
                {
                        report(stderr, GT_("%s fingerprint ({%s}%s) does not match expected %s!\n"), _server_label, dig, text, expected_digest);
			xfree(dig);
                        return 0;
                }
        } /* if (_check_digest != NULL) */
        *retFlag = 0;
	xfree(dig);
        return 1;
}

static int SSL_nock_verify_callback( int ok_return, X509_STORE_CTX *ctx )
{
	return SSL_verify_callback(ok_return, ctx, 0);
}

static int SSL_ck_verify_callback( int ok_return, X509_STORE_CTX *ctx )
{
	return SSL_verify_callback(ok_return, ctx, 1);
}


/* get commonName from certificate set in file.
 * commonName is stored in buffer namebuffer, limited with namebufferlen
 */
static const char *SSLCertGetCN(const char *mycert,
                                char *namebuffer, size_t namebufferlen)
{
	const char *ret       = NULL;
	BIO        *certBio   = NULL;
	X509       *x509_cert = NULL;
	X509_NAME  *certname  = NULL;

	// limit namebufferlen to what OpenSSL can handle
	// in X509_NAME_get_text_by_NID
	if (namebufferlen > INT_MAX) namebufferlen = INT_MAX;

	if (namebuffer && namebufferlen > 0) {
		namebuffer[0] = 0x00;
		certBio = BIO_new_file(mycert,"r");
		if (certBio) {
			x509_cert = PEM_read_bio_X509(certBio,NULL,NULL,NULL);
			BIO_free(certBio);
		}
		if (x509_cert) {
			certname = X509_get_subject_name(x509_cert);
			if (certname &&
			    X509_NAME_get_text_by_NID(certname, NID_commonName,
						      namebuffer, (int)namebufferlen) > 0)
				ret = namebuffer;
			X509_free(x509_cert);
		}
	}
	return ret;
}

/* implementation for OpenSSL 1.1.x and newer */
static int OSSL_proto_version_logic(int sock, const char **myproto)
{
	/* NOTE - this code MUST NOT set myproto to NULL, else the
	 * SSL_...set_..._proto_version() call becomes ineffective. */
	_ctx[sock] = SSL_CTX_new(TLS_client_method());
	// In line with RFC 7525, default to TLSv1.2+
	SSL_CTX_set_min_proto_version(_ctx[sock], TLS1_2_VERSION);
	SSL_CTX_set_max_proto_version(_ctx[sock], 0);

	if (!*myproto) {
	    *myproto = "auto";
	}

	if        (!strcasecmp("tls1", *myproto)) { // RFC 7525 SHOULD NOT
		SSL_CTX_set_min_proto_version(_ctx[sock], TLS1_VERSION);
		SSL_CTX_set_max_proto_version(_ctx[sock], TLS1_VERSION);
	} else if (!strcasecmp("tls1+", *myproto)) { // RFC 7525 SHOULD NOT
		SSL_CTX_set_min_proto_version(_ctx[sock], TLS1_VERSION);
		SSL_CTX_set_max_proto_version(_ctx[sock], 0);
	// undocumented convenience feature:
	} else if (!strcasecmp("tls1.0", *myproto)) { // RFC 7525 SHOULD NOT
		SSL_CTX_set_min_proto_version(_ctx[sock], TLS1_VERSION);
		SSL_CTX_set_max_proto_version(_ctx[sock], TLS1_VERSION);
	// undocumented convenience feature:
	} else if (!strcasecmp("tls1.0+", *myproto)) { // RFC 7525 SHOULD NOT
		SSL_CTX_set_min_proto_version(_ctx[sock], TLS1_VERSION);
		SSL_CTX_set_max_proto_version(_ctx[sock], 0);
	} else if (!strcasecmp("tls1.1", *myproto)) { // RFC 7525 SHOULD NOT
		SSL_CTX_set_min_proto_version(_ctx[sock], TLS1_1_VERSION);
		SSL_CTX_set_max_proto_version(_ctx[sock], TLS1_1_VERSION);
	} else if (!strcasecmp("tls1.1+", *myproto)) { // RFC 7525 SHOULD NOT
		SSL_CTX_set_min_proto_version(_ctx[sock], TLS1_1_VERSION);
		SSL_CTX_set_max_proto_version(_ctx[sock], 0);
	} else if (!strcasecmp("tls1.2", *myproto)) { // DISCOURAGED
		SSL_CTX_set_min_proto_version(_ctx[sock], TLS1_2_VERSION);
		SSL_CTX_set_max_proto_version(_ctx[sock], TLS1_2_VERSION);
	} else if (!strcasecmp("tls1.2+", *myproto)) {
		SSL_CTX_set_min_proto_version(_ctx[sock], TLS1_2_VERSION);
		SSL_CTX_set_max_proto_version(_ctx[sock], 0);
	} else if (!strcasecmp("tls1.3", *myproto)) {
		SSL_CTX_set_min_proto_version(_ctx[sock], TLS1_3_VERSION);
		SSL_CTX_set_max_proto_version(_ctx[sock], TLS1_3_VERSION);
	} else if (!strcasecmp("tls1.3+", *myproto)) {
		SSL_CTX_set_min_proto_version(_ctx[sock], TLS1_3_VERSION);
		SSL_CTX_set_max_proto_version(_ctx[sock], 0);
	} else if (!strcasecmp("ssl23", *myproto)
	        || 0 == strcasecmp("tls", *myproto)
	        || 0 == strcasecmp("auto", *myproto))
	{
		/* do nothing, default was set before the if/elseif block */
	} else {
		/* This should not happen. */
		report(stderr,
		        GT_("Invalid SSL protocol '%s' specified, using default autoselect (auto).\n"),
		        *myproto);
	}
	return 0;
}

/* flush (discard) pending input from socket
 * if this doesn't work with FIONREAD, we can instead rewrite to loop over 
 * select() and then read()/recv(). */
static void inputflush(int sock) {
	char buf[1024];
	int s;

	while((ioctl(sock, FIONREAD, &s) >= 0) && s > 0) {
		if (recv(sock, buf, sizeof buf, MSG_DONTWAIT) <= 0)
			break;
	}
}

static void fm_SSLCleanup(int sock) {
    if( NULL != SSLGetContext( sock ) ) {
        inputflush(sock);
	/* Clean up the SSL stack */
        SSL_free( _ssl_context[sock] );
        _ssl_context[sock] = NULL;
	SSL_CTX_free(_ctx[sock]);
	_ctx[sock] = NULL;
    }
}

#ifdef COMPILE_DEAD_CODE
static char *fm_ssl_all_errors(void) {
	/** obtains a malloc()d C-string containing all OpenSSL errors from the queue
	 * which will be an empty string if there are no errors
	 * you must call free() on the return value */
	BIO *bio = BIO_new(BIO_s_mem());
	ERR_print_errors(bio);

	char *buf = NULL;
	size_t len = BIO_get_mem_data(bio, &buf);
	char *errstr = (char *)xmalloc(len + /* room for NUL byte */ 1);
	memcpy(errstr, buf, len);
	errstr[len] = '\0'; /* add NUL byte */
	BIO_free(bio);
	return errstr;
}
#endif

/* performs initial SSL handshake over the connected socket
 * uses SSL *ssl global variable, which is currently defined
 * in this file
 */
int SSLOpen(int sock, char *mycert, char *mykey, const char *myproto, int certck,
    char *cacertfile, char *certpath,
    const char *fingerprint, char *servercname, char *label, char **remotename)
{
        struct stat randstat;
        int i;
	long sslopts = SSL_OP_ALL;
	int ssle_connect = 0;
	long ver;

	ver = OpenSSL_version_num();

#ifdef USING_WOLFSSL
	{ char *tmp;
	    if (NULL != (tmp = getenv("FETCHMAIL_WOLFSSL_DEBUG"))) {
		if (*tmp) wolfSSL_Debugging_ON();
	    }
	}
	{
		int wver = wolfSSL_lib_version_hex();
		if (wver < LIBWOLFSSL_VERSION_HEX) {
		    report(stderr, GT_("Loaded wolfSSL library %#lx older than headers %#lx, refusing to work.\n"), (long)wver, (long)(LIBWOLFSSL_VERSION_HEX));
		}
	}
#endif
/*
	if (ver < OPENSSL_VERSION_NUMBER) {
	    report(stderr, GT_("Loaded OpenSSL library %#lx older than headers %#lx, refusing to work.\n"), (long)ver, (long)(OPENSSL_VERSION_NUMBER));
	    return -1;
	}
*/
	if (ver > OPENSSL_VERSION_NUMBER && outlevel >= O_VERBOSE) {
	    report(stdout, GT_("Loaded OpenSSL library %#lx newer than headers %#lx, trying to continue.\n"), (long)ver, (long)(OPENSSL_VERSION_NUMBER));
	}

        if (stat("/dev/random", &randstat)  &&
            stat("/dev/urandom", &randstat)) {
          /* Neither /dev/random nor /dev/urandom are present, so add
             entropy to the SSL PRNG a hard way. */
          for (i = 0; i < 10000  &&  ! RAND_status (); ++i) {
            char buf[4];
            struct timeval tv;
            gettimeofday (&tv, 0);
            buf[0] = tv.tv_usec & 0xF;
            buf[2] = (tv.tv_usec & 0xF0) >> 4;
            buf[3] = (tv.tv_usec & 0xF00) >> 8;
            buf[1] = (tv.tv_usec & 0xF000) >> 12;
            RAND_add (buf, sizeof buf, 0.1);
          }
        }

	if( sock < 0 || (unsigned)sock > FD_SETSIZE ) {
		report(stderr, GT_("File descriptor out of range for SSL") );
		return  -1 ;
	}

	/* Make sure a connection referring to an older context is not left */
	_ssl_context[sock] = NULL;
	{
		int rc = OSSL_proto_version_logic(sock, &myproto);
		if (rc) return rc;
	}
	/* do not combine into an else { } as myproto may be nulled above! */
	if (!myproto) {
		_ctx[sock] = SSL_CTX_new(TLS_client_method());
		// Important: clear SSLv2 through avoid_ssl_versions!
	}

	if(_ctx[sock] == NULL) {
		unsigned long ec = ERR_peek_last_error();
		ERR_print_errors_fp(stderr);
#ifdef SSL_R_NULL_SSL_METHOD_PASSED /* wolfSSL does not define this error */
		if (ERR_GET_REASON(ec) == SSL_R_NULL_SSL_METHOD_PASSED) {
		    report(stderr, GT_("Note that some distributions disable older protocol versions in weird non-standard ways. Try a newer protocol version.\n"));
		}
#endif
		return -1;
	}

	{	// CIPHER LISTS for SSL and TLS <= 1.2
		const char *envn_ciphers = "FETCHMAIL_SSL_CIPHERS";
		const char *ciphers = getenv(envn_ciphers);
		if (!ciphers) {
			// Postfix nonprod 20200710, DEF_TLS_MEDIUM_CLIST from src/global/mail_params.h
			const char *default_ciphers = "aNULL:-aNULL:HIGH:MEDIUM:+RC4:@STRENGTH";
			if (outlevel >= O_DEBUG) {
				report(stdout, GT_("SSL/TLS <= 1.2: environment variable %s unset, using fetchmail built-in ciphers.\n"), envn_ciphers);
			}
			ciphers = default_ciphers;
			envn_ciphers = GT_("built-in defaults");
		}
		int r = SSL_CTX_set_cipher_list( _ctx[sock], ciphers); // <= TLS1.2
		if (1 == r) {
			if (outlevel >= O_DEBUG) {
				report(stdout, GT_("SSL/TLS <= 1.2: ciphers set from %s to \"%s\"\n"), envn_ciphers, ciphers);
			}
		} else {
			report(stderr, GT_("SSL/TLS: <= 1.2 failed to set ciphers from %s to \"%s\"\n"), envn_ciphers, ciphers);
			goto sslopen_bailout;
		}
	}

	{	// CIPHERSUITES for TLS >= 1.3
		const char *envn_ciphers = "FETCHMAIL_TLS13_CIPHERSUITES";
		const char *ciphers = getenv(envn_ciphers);
		int r = 0;
		if (ciphers) {
			r = SSL_CTX_set_ciphersuites(_ctx[sock], ciphers); // >= TLS1.3
			if (1 == r) {
				if (outlevel >= O_DEBUG) {
					report(stdout, GT_("TLS >= 1.3: ciphersuite set from %s to \"%s\"\n"), envn_ciphers, ciphers);
				}
			} else {
				report(stderr, GT_("TLS >= 1.3: failed to set ciphersuite from %s to \"%s\"\n"), envn_ciphers, ciphers);
				goto sslopen_bailout;
			}
		} else if (outlevel >= O_DEBUG) {
			report(stdout, GT_("TLS >= 1.3: environment variable %s unset, using OpenSSL built-in ciphersuites.\n"), envn_ciphers);
		}
	}
	{
	    char *tmp = getenv("FETCHMAIL_DISABLE_CBC_IV_COUNTERMEASURE");
	    if (tmp == NULL || *tmp == '\0' || strspn(tmp, " \t") == strlen(tmp))
		sslopts &= ~ SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
	}

	{
		long seclvl = SSL_min_security_level;
		const char *nseclv = "FETCHMAIL_SSL_SECLEVEL";
		const char *sseclv = getenv(nseclv);
		char *ep;
		if (sseclv) {
			errno = 0;
			seclvl = strtol(sseclv, &ep, 10);
			if (((LONG_MIN == seclvl || LONG_MAX == seclvl) && (ERANGE == errno))
					|| *ep != '\0' || ep == sseclv || seclvl < 0 || seclvl > INT_MAX)
			{
				seclvl = SSL_min_security_level;
				report(stderr, GT_("The %s environment variable must contain a non-negative integer - parsing failed, using default level %d.\n"), nseclv, (int)seclvl);
			} else if (outlevel >= O_DEBUG) {
				report(stdout, GT_("Parsed %s to set new security level %d\n"), nseclv, (int)seclvl);
			}
			SSL_CTX_set_security_level(_ctx[sock], (int)seclvl); // seclvl must be range-checked for INT_MAX above
		} else {
			if (SSL_CTX_get_security_level(_ctx[sock]) < SSL_min_security_level) {
				SSL_CTX_set_security_level(_ctx[sock], SSL_min_security_level); /* void function */
			}
		}
	}

	if (outlevel >= O_DEBUG) {
		report(stdout, GT_("DEBUG: SSL security level is %d\n"), SSL_CTX_get_security_level(_ctx[sock]));
	}

	(void)SSL_CTX_set_options(_ctx[sock], sslopts | SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3);

	(void)SSL_CTX_set_mode(_ctx[sock], SSL_MODE_AUTO_RETRY);

	if (certck) {
		SSL_CTX_set_verify(_ctx[sock], SSL_VERIFY_PEER, SSL_ck_verify_callback);
	} else {
		/* In this case, we do not fail if verification fails. However,
		 * we provide the callback for output and possible fingerprint
		 * checks. */
		SSL_CTX_set_verify(_ctx[sock], SSL_VERIFY_PEER, SSL_nock_verify_callback);
	}

	/* Check which trusted X.509 CA certificate store(s) to load */
	{
		char *tmp;
		int want_default_cacerts = 0;
		int r = 1;
		const char *l1 = 0, *l2 = 0;

		/* Load user locations if any is given */
		if (certpath || cacertfile) {
			l1 = cacertfile;
			l2 = certpath;
			r = SSL_CTX_load_verify_locations(_ctx[sock],
						cacertfile, certpath);
			if (1 != r) goto no_verify_load;
		} else {
			want_default_cacerts = 1;
		}

		tmp = getenv("FETCHMAIL_INCLUDE_DEFAULT_X509_CA_CERTS");
		if (want_default_cacerts || (tmp && tmp[0])) {
#ifdef USING_WOLFSSL
			/* wolfSSL 5.0.0 does not implement
			 * SSL_CTX_set_default_verify_paths(). Use something
			 * else: */
			const char *tmp = WOLFSSL_TRUST_FILE;
			l1 = tmp; l2=NULL;
			if (*tmp)
				r = SSL_CTX_load_verify_locations(_ctx[sock],
						tmp, NULL);
#else
			r = SSL_CTX_set_default_verify_paths(_ctx[sock]);
			if (1 != r) goto no_verify_load;
#endif
		}

		if (1 != r) {
no_verify_load:
			report(stderr, GT_("Cannot load verify locations (file=\"%s\", dir=\"%s\"), error %d:\n"),
					l1?l1:"(null)", l2?l2:"(null)", r);
			ERR_print_errors_fp(stderr);
			return -1;
		}
	}
	
	_ssl_context[sock] = SSL_new(_ctx[sock]);
	
	if(_ssl_context[sock] == NULL) {
sslopen_bailout:
		ERR_print_errors_fp(stderr);
		SSL_CTX_free(_ctx[sock]);
		_ctx[sock] = NULL;
		return -1;
	}
	
	/* This static is for the verify callback */
	_ssl_server_cname = servercname;
	_server_label = label;
	_check_fp = 1;
	_check_digest = fingerprint;
	_depth0ck = 0;
	_firstrun = 1;
	_verify_ok = 1;
	_prev_err = -1;

	/*
	 * Support SNI, some servers (googlemail) appear to require it.
	 */
	{
	    long r;
	    r = SSL_set_tlsext_host_name(_ssl_context[sock], servercname);

	    if (0 == r) {
		/* handle error */
		report(stderr, GT_("Warning: SSL_set_tlsext_host_name(%p, \"%s\") failed (code %#lx), trying to continue.\n"), (void *)_ssl_context[sock], servercname, r);
		ERR_print_errors_fp(stderr);
	    }
	}

#ifdef USING_WOLFSSL
	{
		/* workaround for WolfSSL 5.0.0 compatibility issue,
		 * which leaves errors in the X509 ctx passed to the
		 * SSL_verify_callback() in a preverify_ok==1 case,
		 * where OpenSSL will not return an error.
		 * https://github.com/wolfSSL/wolfssl/issues/4592 */
		int r = wolfSSL_check_domain_name(_ssl_context[sock], servercname);
		if (WOLFSSL_SUCCESS != r) {
			report(stderr, xstrdup(GT_("fetchmail: sock %d: wolfSSL_check_domain_name(%p, \"%s\") returned %d, trying to continue\n")), sock, _ssl_context[sock], servercname, r);
		}
	}
#else
	/* set host name for verification, only available since OpenSSL 1.0.2
	 * */
	/* XXX FIXME: do we need to change the function's signature and pass the akalist to
	 * permit the other hostnames through SSL? */
	/* https://wiki.openssl.org/index.php/Hostname_validation */
	{
	    int r;
	    X509_VERIFY_PARAM *param = SSL_get0_param(_ssl_context[sock]);

	    X509_VERIFY_PARAM_set_hostflags(param, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
	    if (0 == (r = X509_VERIFY_PARAM_set1_host(param, servercname, strlen(servercname)))) {
		report(stderr, GT_("Warning: X509_VERIFY_PARAM_set1_host(%p, \"%s\") failed (code %#x), trying to continue.\n"),
			(void *)_ssl_context[sock], servercname, r);
		ERR_print_errors_fp(stderr);
	    }

	    /* OpenSSL 1.x.y: 0xMNNFFPPSL: major minor fix patch status
	     * OpenSSL 3.0.z: 0xMNN00PPSL: synthesized */
	    /*                0xMNNFFPPsL     0xMNNFFPPsL  */
#if (OPENSSL_VERSION_NUMBER & 0xfffff000L) == 0x10002000L
#pragma message "enabling OpenSSL 1.0.2 X509_V_FLAG_TRUSTED_FIRST flag setter"
	    /* OpenSSL 1.0.2 and 1.0.2 only:
	     * work around Let's Encrypt Cross-Signing Certificate Expiry,
	     * https://www.openssl.org/blog/blog/2021/09/13/LetsEncryptRootCertExpire/
	     * Workaround #2 */
	    X509_VERIFY_PARAM_set_flags(param, X509_V_FLAG_TRUSTED_FIRST);
#endif

	    /* param is a pointer to internal OpenSSL data, must not be freed,
	     * and just goes out of scope */
	}
#endif

	if( mycert || mykey ) {

	/* Ok...  He has a certificate file defined, so lets declare it.  If
	 * he does NOT have a separate certificate and private key file then
	 * assume that it's a combined key and certificate file.
	 */
		char buffer[256];
		
		if( !mykey )
			mykey = mycert;
		if( !mycert )
			mycert = mykey;

		if ((!*remotename || !**remotename) && SSLCertGetCN(mycert, buffer, sizeof(buffer))) {
			free(*remotename);
			*remotename = xstrdup(buffer);
		}
		SSL_use_certificate_file(_ssl_context[sock], mycert, SSL_FILETYPE_PEM);
		SSL_use_PrivateKey_file(_ssl_context[sock], mykey, SSL_FILETYPE_PEM);
	}

	ERR_clear_error();
	errno = 0;
	if (SSL_set_fd(_ssl_context[sock], sock) == 0 // OpenSSL 3.0: 0 = error, 1 = success
	    || (ssle_connect = SSL_connect(_ssl_context[sock])) < 1) // OpenSSL 3.0: "1: The TLS/SSL handshake was successfully completed, a TLS/SSL connection has been established."
	{
		int e = errno;
		unsigned long ssle_err_from_get_error = SSL_get_error(_ssl_context[sock], ssle_connect);
		unsigned long ssle_err_from_queue = ERR_peek_error();

		if (0 == ssle_connect) { // OpenSSL 3.0: "0: The TLS/SSL handshake was not successful but was shut down controlled and by the specifications of the TLS/SSL protocol. Call SSL_get_error() with the return value ret to find out the reason."
			/* FIXME: the next line was hacked in 6.4.0-rc1 so the translation strings don't change.
			 * The %s could be merged to the inside of GT_(). */
			report(stderr, "%s: %s", servercname, GT_("Server shut down connection prematurely during SSL_connect().\n"));
			ERR_print_errors_fp(stderr);
		} else /* ssle_connect < 0 here */ if (SSL_ERROR_NONE != ssle_err_from_get_error) { // redundant, "SSL_ERROR_NONE returned if and only if [ssle_connect] > 0" - we trapped that above.
			/* OpenSSL 3.0: SSL_connect() return <0: The TLS/SSL handshake was not successful, because a fatal error occurred
			   either at the protocol level or a connection failure occurred. The shutdown was not clean.
			   It can also occur if action is needed to continue the operation for nonblocking BIOs.
			   Call SSL_get_error() with the return value ret to find out the reason. */
			/* SSL_get_error() states, as of OpenSSL 3.0:
			   On an unexpected EOF, versions before OpenSSL 3.0 returned SSL_ERROR_SYSCALL, nothing was added to the error stack, and errno was 0.
			   Since OpenSSL 3.0 the returned error is SSL_ERROR_SSL with a meaningful error on the error stack (SSL_R_UNEXPECTED_EOF_WHILE_READING).
			   This error reason code may be used for control flow decisions (see the man page for ERR_GET_REASON(3) for further details on this). */

			ERR_print_errors_fp(stderr);

			const char *errmsg = ERR_error_string(ssle_err_from_get_error, NULL);
			if (SSL_ERROR_SYSCALL == ssle_err_from_get_error) {
				if (!e) {
					if (!ssle_err_from_queue) {
						/* this is to map the OpenSSL < 3.0 API to something reasonable on unexpected EOF */
#ifdef SSL_R_UNEXPECTED_EOF_WHILE_READING
						errmsg = ERR_error_string(SSL_R_UNEXPECTED_EOF_WHILE_READING, NULL);

// #else - wolfSSL does not define this; so go with the original error message above
#endif
					} else {
						errmsg = ERR_error_string(ssle_err_from_queue, NULL);
					}
				} else {
					errmsg = strerror(e);
				}
				report_build(stderr, "%s: %s: ", servercname, TLSprovider);
				report_complete(stderr, GT_("System error during SSL_connect(): %s\n"), errmsg);
			} else if (!ssle_err_from_queue) {
				/* this fallback is for libraries that haven't put something on the error queue (wolfSSL),
				   but is best avoided if we have printed the error from the queue, because either
				   we print the same error twice, or we try to decode SSL_get_error() return values such as SSL_ERROR_SSL. */
				report_build(stderr, "%s: %s: ", servercname, TLSprovider);
				report_complete(stderr, GT_("System error during SSL_connect(): %s\n"), errmsg);
			}
		}
		fm_SSLCleanup(sock);
		return -1;
	}

	if (outlevel >= O_VERBOSE) {
	    SSL_CIPHER const *sc;
	    int bitsalg = -9999, bitsused; /* initialize bitsalg to avoid picking up random garbage with WolfSSL, which does not fill this, as of 5.6.6 */

	    const char *vers;

	    vers = SSL_get_version(_ssl_context[sock]);

	    sc = SSL_get_current_cipher(_ssl_context[sock]);
	    if (!sc) {
		report (stderr, GT_("Cannot obtain current SSL/TLS cipher - no session established?\n"));
	    } else {
		bitsused = SSL_CIPHER_get_bits(sc, &bitsalg);
		report(stdout, ("SSL/TLS: using protocol %s, cipher %s, %d/%d secret/processed bits\n"),
			vers, SSL_CIPHER_get_name(sc), bitsused, bitsalg);
	    }
	}

	/* Paranoia: was the callback not called as we expected? */
	if (!_depth0ck) {
		report(stderr, GT_("Certificate/fingerprint verification was somehow skipped!\n"));

		if (fingerprint != NULL || certck) {
		    SSL_shutdown( _ssl_context[sock] );
		    fm_SSLCleanup(sock);
		    return -1;
		}
	}

	if (!certck && !fingerprint &&
		(SSL_get_verify_result(_ssl_context[sock]) != X509_V_OK || !_verify_ok)) {
		report(stderr, GT_("Warning: the connection is insecure, continuing anyways. (Better use --sslcertck!)\n"));
	}

	return 0;
}
#endif

int SockClose(int sock)
/* close a socket gracefully */
{
#ifdef	SSL_ENABLE
    if (_ssl_context[sock]) {
	    SSL_shutdown( _ssl_context[sock] );
    }
    fm_SSLCleanup(sock);
#endif

    /* if there's an error closing at this point, not much we can do */
    return fm_close(sock);	/* this is guarded */
}