/usr/src/usr.sbin/rpki-client/http.c

Bug Summary

File:	src/usr.sbin/rpki-client/http.c
Warning:	line 402, column 7 Potential leak of memory pointed to by 'cred'
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name http.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.sbin/rpki-client/obj -resource-dir /usr/local/lib/clang/13.0.0 -I /usr/src/usr.sbin/rpki-client -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.sbin/rpki-client/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/usr.sbin/rpki-client/http.c
1/*	$OpenBSD: http.c,v 1.51 2021/12/22 09:35:14 claudio Exp $  */
2/*
* Copyright (c) 2020 Nils Fisher <nils_fisher@hotmail.com>
* Copyright (c) 2020 Claudio Jeker <claudio@openbsd.org>
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/

19/*-
* Copyright (c) 1997 The NetBSD Foundation, Inc.
* All rights reserved.
*
* This code is derived from software contributed to The NetBSD Foundation
* by Jason Thorpe and Luke Mewburn.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
* TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
* BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
47#include <sys/types.h>
48#include <sys/queue.h>
49#include <sys/socket.h>

51#include <assert.h>
52#include <ctype.h>
53#include <err.h>
54#include <errno(*__errno()).h>
55#include <limits.h>
56#include <netdb.h>
57#include <poll.h>
58#include <signal.h>
59#include <stdio.h>
60#include <stdlib.h>
61#include <string.h>
62#include <unistd.h>
63#include <vis.h>
64#include <imsg.h>

66#include <tls.h>

68#include "extern.h"

70#define HTTP_USER_AGENT"OpenBSD rpki-client"		"OpenBSD rpki-client"
71#define HTTP_BUF_SIZE(32 * 1024)		(32 * 1024)
72#define HTTP_IDLE_TIMEOUT10	10
73#define HTTP_IO_TIMEOUT(3 * 60)		(3 * 60)
74#define MAX_CONNECTIONS64		64
75#define MAX_CONTENTLEN(2 * 1024 * 1024 * 1024LL)		(2 * 1024 * 1024 * 1024LL)
76#define NPFDS(64 + 1)			(MAX_CONNECTIONS64 + 1)

78enum res {
DONE,
WANT_POLLIN,
WANT_POLLOUT,
82};

84enum http_state {
STATE_FREE,
STATE_CONNECT,
STATE_TLSCONNECT,
STATE_PROXY_REQUEST,
STATE_PROXY_STATUS,
STATE_PROXY_RESPONSE,
STATE_REQUEST,
STATE_RESPONSE_STATUS,
STATE_RESPONSE_HEADER,
STATE_RESPONSE_DATA,
STATE_RESPONSE_CHUNKED_HEADER,
STATE_RESPONSE_CHUNKED_TRAILER,
STATE_WRITE_DATA,
STATE_IDLE,
STATE_CLOSE,
100};

102struct http_proxy {
char	*proxyhost;
char	*proxyport;
char	*proxyauth;
106} proxy;

108struct http_connection {
LIST_ENTRY(http_connection)struct { struct http_connection *le_next; struct http_connection
 **le_prev; }	entry;
char			*host;
char			*port;
char			*last_modified;
char			*redir_uri;
struct http_request	*req;
struct pollfd		*pfd;
struct addrinfo		*res0;
struct addrinfo		*res;
struct tls		*tls;
char			*buf;
size_t			bufsz;
size_t			bufpos;
off_t			iosz;
off_t			totalsz;
time_t			idle_time;
time_t			io_time;
int			status;
int			fd;
int			chunked;
int			keep_alive;
short			events;
enum http_state		state;
132};

134LIST_HEAD(http_conn_list, http_connection)struct http_conn_list { struct http_connection *lh_first; };

136struct http_request {
TAILQ_ENTRY(http_request)struct { struct http_request *tqe_next; struct http_request *
*tqe_prev; }	entry;
char			*uri;
char			*modified_since;
char			*host;
char			*port;
const char		*path;	/* points into uri */
unsigned int		 id;
int			 outfd;
int			 redirect_loop;
146};

148TAILQ_HEAD(http_req_queue, http_request)struct http_req_queue { struct http_request *tqh_first; struct
 http_request **tqh_last; };

150static struct http_conn_list	active = LIST_HEAD_INITIALIZER(active){ ((void*)0) };
151static struct http_conn_list	idle = LIST_HEAD_INITIALIZER(idle){ ((void*)0) };
152static struct http_req_queue	queue = TAILQ_HEAD_INITIALIZER(queue){ ((void*)0), &(queue).tqh_first };
153static unsigned int http_conn_count;

155static struct msgbuf msgq;
156static struct sockaddr_storage http_bindaddr;
157static struct tls_config *tls_config;
158static uint8_t *tls_ca_mem;
159static size_t tls_ca_size;

161/* HTTP request API */
162static void	http_req_new(unsigned int, char *, char *, int, int);
163static void	http_req_free(struct http_request *);
164static void	http_req_done(unsigned int, enum http_result, const char *);
165static void	http_req_fail(unsigned int);
166static int	http_req_schedule(struct http_request *);

168/* HTTP connection API */
169static void	http_new(struct http_request *);
170static void	http_free(struct http_connection *);

172static enum res http_done(struct http_connection *, enum http_result);
173static enum res http_failed(struct http_connection *);

175/* HTTP connection FSM functions */
176static void	http_do(struct http_connection *,
    enum res (*)(struct http_connection *));

179/* These functions can be used with http_do() */
180static enum res	http_connect(struct http_connection *);
181static enum res	http_request(struct http_connection *);
182static enum res	http_close(struct http_connection *);
183static enum res http_handle(struct http_connection *);

185/* Internal state functions used by the above functions */
186static enum res	http_finish_connect(struct http_connection *);
187static enum res	proxy_connect(struct http_connection *);
188static enum res	http_tls_connect(struct http_connection *);
189static enum res	http_tls_handshake(struct http_connection *);
190static enum res	http_read(struct http_connection *);
191static enum res	http_write(struct http_connection *);
192static enum res	proxy_read(struct http_connection *);
193static enum res	proxy_write(struct http_connection *);
194static enum res	data_write(struct http_connection *);

196/*
* Return a string that can be used in error message to identify the
* connection.
*/
200static const char *
201http_info(const char *uri)
202{
static char buf[80];

if (strnvis(buf, uri, sizeof buf, VIS_SAFE0x20) >= (int)sizeof buf) {
/* overflow, add indicator */
memcpy(buf + sizeof buf - 4, "...", 4);
}

return buf;
211}

213/*
* Determine whether the character needs encoding, per RFC2396.
*/
216static int
217to_encode(const char *c0)
218{
/* 2.4.3. Excluded US-ASCII Characters */
const char *excluded_chars =
   " "         /* space */
   "<>#\""     /* delims (modulo "%", see below) */
   "{}|\\^[]`" /* unwise */
   ;
const unsigned char *c = (const unsigned char *)c0;

/*
* No corresponding graphic US-ASCII.
* Control characters and octets not used in US-ASCII.
*/
return (iscntrl(*c) || !isascii(*c) ||

   /*
    * '%' is also reserved, if is not followed by two
    * hexadecimal digits.
    */
   strchr(excluded_chars, *c) != NULL((void*)0) ||
   (*c == '%' && (!isxdigit(c[1]) || !isxdigit(c[2]))));
239}

241/*
* Encode given URL, per RFC2396.
* Allocate and return string to the caller.
*/
245static char *
246url_encode(const char *path)
247{
size_t i, length, new_length;
char *epath, *epathp;

length = new_length = strlen(path);

/*
* First pass:
* Count unsafe characters, and determine length of the
* final URL.
*/
for (i = 0; i < length; i++)
if (to_encode(path + i))
	new_length += 2;

epath = epathp = malloc(new_length + 1);	/* One more for '\0'. */
if (epath == NULL((void*)0))
err(1, NULL((void*)0));

/*
* Second pass:
* Encode, and copy final URL.
*/
for (i = 0; i < length; i++)
if (to_encode(path + i)) {
	snprintf(epathp, 4, "%%" "%02x",
	    (unsigned char)path[i]);
	epathp += 3;
} else
	*(epathp++) = path[i];

*epathp = '\0';
return (epath);
280}

282static char
283hextochar(const char *str)
284{
unsigned char c, ret;

c = str[0];
ret = c;
if (isalpha(c))
ret -= isupper(c) ? 'A' - 10 : 'a' - 10;
else
ret -= '0';
ret *= 16;

c = str[1];
ret += c;
if (isalpha(c))
ret -= isupper(c) ? 'A' - 10 : 'a' - 10;
else
ret -= '0';
return ret;
302}

304static char *
305url_decode(const char *str)
306{
char *ret, c;
int i, reallen;

if (str == NULL((void*)0))
return NULL((void*)0);
if ((ret = malloc(strlen(str) + 1)) == NULL((void*)0))
err(1, "Can't allocate memory for URL decoding");
for (i = 0, reallen = 0; str[i] != '\0'; i++, reallen++, ret++) {
c = str[i];
if (c == '+') {
	*ret = ' ';
	continue;
}
/*
 * Cannot use strtol here because next char
 * after %xx may be a digit.
 */
if (c == '%' && isxdigit((unsigned char)str[i + 1]) &&
    isxdigit((unsigned char)str[i + 2])) {
	*ret = hextochar(&str[i + 1]);
	i += 2;
	continue;
}
*ret = c;
}
*ret = '\0';
return ret - reallen;
334}

336static char *
337recode_credentials(const char *userinfo)
338{
char *ui, *creds;
size_t ulen;

/* url-decode the user and pass */
ui = url_decode(userinfo);

ulen = strlen(ui);
if (base64_encode(ui, ulen, &creds) == -1)
errx(1, "error in base64 encoding");
free(ui);
return (creds);
350}

352/*
* Parse a proxy URI and split it up into host, port and userinfo.
*/
355static void
356proxy_parse_uri(char *uri)
357{
char *host, *port = NULL((void*)0), *cred, *cookie = NULL((void*)0);

if (uri11.1
'uri' is not equal to NULL
 == NULL((void*)0))
12
←
Taking false branch→
return;

if (strncasecmp(uri, "http://", 7) != 0)
13
←
Taking false branch→
errx(1, "%s: http_proxy not using http schema", http_info(uri));

host = uri + 7;
if ((host = strndup(host, strcspn(host, "/"))) == NULL((void*)0))
14
←
Memory is allocated→
15
←
Assuming the condition is false→
16
←
Taking false branch→
err(1, NULL((void*)0));

cred = host;
host = strchr(cred, '@');
if (host != NULL((void*)0))
17
←
Assuming 'host' is not equal to NULL→
18
←
Taking true branch→
*host++ = '\0';
else {
host = cred;
cred = NULL((void*)0);
}

if (*host == '[') {
19
←
Assuming the condition is false→
20
←
Taking false branch→
char *hosttail;

if ((hosttail = strrchr(host, ']')) == NULL((void*)0))
	errx(1, "%s: unmatched opening bracket",
	     http_info(uri));
if (hosttail[1] == '\0' || hosttail[1] == ':')
	host++;
if (hosttail[1] == ':')
	port = hosttail + 2;
*hosttail = '\0';
} else {
if ((port = strrchr(host, ':')) != NULL((void*)0))
21
←
Assuming the condition is false→
22
←
Taking false branch→
	*port++ = '\0';
}

if (port22.1
'port' is equal to NULL
 == NULL((void*)0))
23
←
Taking true branch→
port = "443";

if (cred23.1
'cred' is not equal to NULL
 != NULL((void*)0)) {
24
←
Taking true branch→
if (strchr(cred, ':') == NULL((void*)0))
25
←
Assuming the condition is false→
26
←
Taking false branch→
	errx(1, "%s: malformed proxy url", http_info(uri));
cred = recode_credentials(cred);
if (asprintf(&cookie, "Proxy-Authorization: Basic %s\r\n",
27
←
Potential leak of memory pointed to by 'cred'
    cred) == -1)
	err(1, NULL((void*)0));
free(cred);
} else
if ((cookie = strdup("")) == NULL((void*)0))
	err(1, NULL((void*)0));

proxy.proxyhost = host;
proxy.proxyport = port;
proxy.proxyauth = cookie;
413}

415/*
* Parse a URI and split it up into host, port and path.
* Does some basic URI validation. Both host and port need to be freed
* by the caller whereas path points into the uri.
*/
420static int
421http_parse_uri(char *uri, char **ohost, char **oport, char **opath)
422{
char *host, *port = NULL((void*)0), *path;
char *hosttail;

if (strncasecmp(uri, "https://", 8) != 0) {
warnx("%s: not using https schema", http_info(uri));
return -1;
}
host = uri + 8;
if ((path = strchr(host, '/')) == NULL((void*)0)) {
warnx("%s: missing https path", http_info(uri));
return -1;
}
if (path - uri > INT_MAX2147483647 - 1) {
warnx("%s: preposterous host length", http_info(uri));
return -1;
}

if (memchr(host, '@', path - host) != NULL((void*)0)) {
warnx("%s: URI with userinfo not supported", http_info(uri));
return -1;
}

if (*host == '[') {
if ((hosttail = memrchr(host, ']', path - host)) == NULL((void*)0)) {
	warnx("%s: unmatched opening bracket", http_info(uri));
	return -1;
}
if (hosttail[1] == '/' || hosttail[1] == ':')
	host++;
if (hosttail[1] == ':')
	port = hosttail + 2;
} else {
if ((hosttail = memrchr(host, ':', path - host)) != NULL((void*)0))
	port = hosttail + 1;
else
	hosttail = path;
}

if ((host = strndup(host, hosttail - host)) == NULL((void*)0))
err(1, NULL((void*)0));
if (port != NULL((void*)0)) {
if ((port = strndup(port, path - port)) == NULL((void*)0))
	err(1, NULL((void*)0));
} else {
if ((port = strdup("443")) == NULL((void*)0))
	err(1, NULL((void*)0));
}
/* do not include the initial / in path */
path++;

*ohost = host;
*oport = port;
*opath = path;

return 0;
478}

480/*
* Lookup the IP addresses for host:port.
* Returns 0 on success and -1 on failure.
*/
484static int
485http_resolv(struct addrinfo **res, const char *host, const char *port)
486{
struct addrinfo hints;
int error;

memset(&hints, 0, sizeof(hints));
hints.ai_family = PF_UNSPEC0;
hints.ai_socktype = SOCK_STREAM1;
error = getaddrinfo(host, port, &hints, res);
/*
* If the services file is corrupt/missing, fall back
* on our hard-coded defines.
*/
if (error == EAI_SERVICE-8)
error = getaddrinfo(host, "443", &hints, res);
if (error != 0) {
warnx("%s: %s", host, gai_strerror(error));
return -1;
}

return 0;
506}

508/*
* Create and queue a new request.
*/
511static void
512http_req_new(unsigned int id, char *uri, char *modified_since, int count,
  int outfd)
514{
struct http_request *req;
char *host, *port, *path;

if (http_parse_uri(uri, &host, &port, &path) == -1) {
free(uri);
free(modified_since);
close(outfd);
http_req_fail(id);
return;
}

if ((req = calloc(1, sizeof(*req))) == NULL((void*)0))
err(1, NULL((void*)0));

req->id = id;
req->outfd = outfd;
req->host = host;
req->port = port;
req->path = path;
req->uri = uri;
req->modified_since = modified_since;
req->redirect_loop = count;

TAILQ_INSERT_TAIL(&queue, req, entry)do { (req)->entry.tqe_next = ((void*)0); (req)->entry.tqe_prev
 = (&queue)->tqh_last; *(&queue)->tqh_last = (req
); (&queue)->tqh_last = &(req)->entry.tqe_next;
 } while (0);
539}

541/*
* Free a request, request is not allowed to be on the req queue.
*/
544static void
545http_req_free(struct http_request *req)
546{
if (req == NULL((void*)0))
return;

free(req->host);
free(req->port);
/* no need to free req->path it points into req->uri */
free(req->uri);
free(req->modified_since);

if (req->outfd != -1)
close(req->outfd);
558}

560/*
* Enqueue request response
*/
563static void
564http_req_done(unsigned int id, enum http_result res, const char *last_modified)
565{
struct ibuf *b;

b = io_new_buffer();
io_simple_buffer(b, &id, sizeof(id));
io_simple_buffer(b, &res, sizeof(res));
io_str_buffer(b, last_modified);
io_close_buffer(&msgq, b);
573}

575/*
* Enqueue request failure response
*/
578static void
579http_req_fail(unsigned int id)
580{
struct ibuf *b;
enum http_result res = HTTP_FAILED;

b = io_new_buffer();
io_simple_buffer(b, &id, sizeof(id));
io_simple_buffer(b, &res, sizeof(res));
io_str_buffer(b, NULL((void*)0));
io_close_buffer(&msgq, b);
589}

591/*
* Schedule new requests until maximum number of connections is reached.
* Try to reuse an idle connection if one exists that matches host and port.
*/
595static int
596http_req_schedule(struct http_request *req)
597{
struct http_connection *conn;

TAILQ_REMOVE(&queue, req, entry)do { if (((req)->entry.tqe_next) != ((void*)0)) (req)->
entry.tqe_next->entry.tqe_prev = (req)->entry.tqe_prev;
 else (&queue)->tqh_last = (req)->entry.tqe_prev; *
(req)->entry.tqe_prev = (req)->entry.tqe_next; ; ; } while
 (0);

/* check list of idle connections first */
LIST_FOREACH(conn, &idle, entry)for((conn) = ((&idle)->lh_first); (conn)!= ((void*)0);
 (conn) = ((conn)->entry.le_next)) {
if (strcmp(conn->host, req->host) != 0)
	continue;
if (strcmp(conn->port, req->port) != 0)
	continue;

LIST_REMOVE(conn, entry)do { if ((conn)->entry.le_next != ((void*)0)) (conn)->entry
.le_next->entry.le_prev = (conn)->entry.le_prev; *(conn
)->entry.le_prev = (conn)->entry.le_next; ; ; } while (
0);
LIST_INSERT_HEAD(&active, conn, entry)do { if (((conn)->entry.le_next = (&active)->lh_first
) != ((void*)0)) (&active)->lh_first->entry.le_prev
 = &(conn)->entry.le_next; (&active)->lh_first =
 (conn); (conn)->entry.le_prev = &(&active)->lh_first
; } while (0);

/* use established connection */
conn->req = req;
conn->idle_time = 0;

/* start request */
http_do(conn, http_request);
if (conn->state == STATE_FREE)
	http_free(conn);
return 1;
}

if (http_conn_count < MAX_CONNECTIONS64) {
http_new(req);
return 1;
}

/* no more slots free, requeue */
TAILQ_INSERT_HEAD(&queue, req, entry)do { if (((req)->entry.tqe_next = (&queue)->tqh_first
) != ((void*)0)) (&queue)->tqh_first->entry.tqe_prev
 = &(req)->entry.tqe_next; else (&queue)->tqh_last
 = &(req)->entry.tqe_next; (&queue)->tqh_first =
 (req); (req)->entry.tqe_prev = &(&queue)->tqh_first
; } while (0);
return 0;
631}

633/*
* Create a new HTTP connection which will be used for the HTTP request req.
* On errors a req faulure is issued and both connection and request are freed.
*/ 
637static void
638http_new(struct http_request *req)
639{
struct http_connection *conn;

if ((conn = calloc(1, sizeof(*conn))) == NULL((void*)0))
err(1, NULL((void*)0));

conn->fd = -1;
conn->req = req;
if ((conn->host = strdup(req->host)) == NULL((void*)0))
err(1, NULL((void*)0));
if ((conn->port = strdup(req->port)) == NULL((void*)0))
err(1, NULL((void*)0));

LIST_INSERT_HEAD(&active, conn, entry)do { if (((conn)->entry.le_next = (&active)->lh_first
) != ((void*)0)) (&active)->lh_first->entry.le_prev
 = &(conn)->entry.le_next; (&active)->lh_first =
 (conn); (conn)->entry.le_prev = &(&active)->lh_first
; } while (0);
http_conn_count++;

if (proxy.proxyhost != NULL((void*)0)) {
if (http_resolv(&conn->res0, proxy.proxyhost,
    proxy.proxyport) == -1) {
	http_req_fail(req->id);
	http_free(conn);
	return;
}
} else {
if (http_resolv(&conn->res0, conn->host, conn->port) == -1) {
	http_req_fail(req->id);
	http_free(conn);
	return;
}
}

/* connect and start request */
http_do(conn, http_connect);
if (conn->state == STATE_FREE)
http_free(conn);
674}

676/*
* Free a no longer active connection, releasing all memory and closing
* any open file descriptor.
*/
680static void
681http_free(struct http_connection *conn)
682{
assert(conn->state == STATE_FREE)((conn->state == STATE_FREE) ? (void)0 : __assert2("/usr/src/usr.sbin/rpki-client/http.c"
, 683, __func__, "conn->state == STATE_FREE"));

LIST_REMOVE(conn, entry)do { if ((conn)->entry.le_next != ((void*)0)) (conn)->entry
.le_next->entry.le_prev = (conn)->entry.le_prev; *(conn
)->entry.le_prev = (conn)->entry.le_next; ; ; } while (
0);
http_conn_count--;

http_req_free(conn->req);
free(conn->host);
free(conn->port);
free(conn->last_modified);
free(conn->redir_uri);
free(conn->buf);

if (conn->res0 != NULL((void*)0))
freeaddrinfo(conn->res0);

tls_free(conn->tls);

if (conn->fd != -1)
close(conn->fd);
free(conn);
703}

705/*
* Called when a request on this connection is finished.
* Move connection into idle state and onto idle queue.
* If there is a request connected to it send back a response
* with http_result res, else ignore the res.
*/
711static enum res
712http_done(struct http_connection *conn, enum http_result res)
713{
assert(conn->bufpos == 0)((conn->bufpos == 0) ? (void)0 : __assert2("/usr/src/usr.sbin/rpki-client/http.c"
, 714, __func__, "conn->bufpos == 0"));
assert(conn->iosz == 0)((conn->iosz == 0) ? (void)0 : __assert2("/usr/src/usr.sbin/rpki-client/http.c"
, 715, __func__, "conn->iosz == 0"));
assert(conn->chunked == 0)((conn->chunked == 0) ? (void)0 : __assert2("/usr/src/usr.sbin/rpki-client/http.c"
, 716, __func__, "conn->chunked == 0"));
assert(conn->redir_uri == NULL)((conn->redir_uri == ((void*)0)) ? (void)0 : __assert2("/usr/src/usr.sbin/rpki-client/http.c"
, 717, __func__, "conn->redir_uri == NULL"));

conn->state = STATE_IDLE;
conn->idle_time = getmonotime() + HTTP_IDLE_TIMEOUT10;

if (conn->req) {
http_req_done(conn->req->id, res, conn->last_modified);
http_req_free(conn->req);
conn->req = NULL((void*)0);
}

if (!conn->keep_alive)
return http_close(conn);

LIST_REMOVE(conn, entry)do { if ((conn)->entry.le_next != ((void*)0)) (conn)->entry
.le_next->entry.le_prev = (conn)->entry.le_prev; *(conn
)->entry.le_prev = (conn)->entry.le_next; ; ; } while (
0);
LIST_INSERT_HEAD(&idle, conn, entry)do { if (((conn)->entry.le_next = (&idle)->lh_first
) != ((void*)0)) (&idle)->lh_first->entry.le_prev =
 &(conn)->entry.le_next; (&idle)->lh_first = (conn
); (conn)->entry.le_prev = &(&idle)->lh_first; }
 while (0);

/* reset status and keep-alive for good measures */
conn->status = 0;
conn->keep_alive = 0;

return WANT_POLLIN;
739}

741/*
* Called in case of error, moves connection into free state.
* This will skip proper shutdown of the TLS session.
* If a request is pending fail and free the request.
*/
746static enum res
747http_failed(struct http_connection *conn)
748{
conn->state = STATE_FREE;

if (conn->req) {
http_req_fail(conn->req->id);
http_req_free(conn->req);
conn->req = NULL((void*)0);
}

return DONE;
758}

760/*
* Call the function f and update the connection events based
* on the return value.
*/
764static void
765http_do(struct http_connection *conn, enum res (*f)(struct http_connection *))
766{
switch (f(conn)) {
case DONE:
conn->events = 0;
break;
case WANT_POLLIN:
conn->events = POLLIN0x0001;
break;
case WANT_POLLOUT:
conn->events = POLLOUT0x0004;
break;
default:
errx(1, "%s: unexpected function return",
    http_info(conn->host));
}
781}

783/*
* Connection successfully establish, initiate TLS handshake or proxy request.
*/
786static enum res
787http_connect_done(struct http_connection *conn)
788{
freeaddrinfo(conn->res0);
conn->res0 = NULL((void*)0);
conn->res = NULL((void*)0);

if (proxy.proxyhost != NULL((void*)0))
return proxy_connect(conn);
return http_tls_connect(conn);
796}

798/*
* Start an asynchronous connect.
*/
801static enum res
802http_connect(struct http_connection *conn)
803{
const char *cause = NULL((void*)0);

assert(conn->fd == -1)((conn->fd == -1) ? (void)0 : __assert2("/usr/src/usr.sbin/rpki-client/http.c"
, 806, __func__, "conn->fd == -1")); 
conn->state = STATE_CONNECT;

/* start the loop below with first or next address */
if (conn->res == NULL((void*)0))
conn->res = conn->res0;
else
conn->res = conn->res->ai_next;
for (; conn->res != NULL((void*)0); conn->res = conn->res->ai_next) {
struct addrinfo *res = conn->res;
int fd, save_errno;

fd = socket(res->ai_family,
    res->ai_socktype | SOCK_NONBLOCK0x4000, res->ai_protocol);
if (fd == -1) {
	cause = "socket";
	continue;
}
conn->fd = fd;

if (http_bindaddr.ss_family == res->ai_family) {
	if (bind(conn->fd, (struct sockaddr *)&http_bindaddr,
	    res->ai_addrlen) == -1) {
		save_errno = errno(*__errno());
		close(conn->fd);
		conn->fd = -1;
		errno(*__errno()) = save_errno;
		cause = "bind";
		continue;
	}
}

if (connect(conn->fd, res->ai_addr, res->ai_addrlen) == -1) {
	if (errno(*__errno()) == EINPROGRESS36) {
		/* wait for async connect to finish. */
		return WANT_POLLOUT;
	} else {
		save_errno = errno(*__errno());
		close(conn->fd);
		conn->fd = -1;
		errno(*__errno()) = save_errno;
		cause = "connect";
		continue;
	}
}

break;	/* okay we got one */
}

if (conn->fd == -1) {
if (cause != NULL((void*)0))
	warn("%s: %s", http_info(conn->req->uri), cause);
return http_failed(conn);
}

return http_connect_done(conn);
862}

864/*
* Called once an asynchronus connect request finished.
*/
867static enum res
868http_finish_connect(struct http_connection *conn)
869{
int error = 0;
socklen_t len;

len = sizeof(error);
if (getsockopt(conn->fd, SOL_SOCKET0xffff, SO_ERROR0x1007, &error, &len) == -1) {
warn("%s: getsockopt SO_ERROR", http_info(conn->req->uri));
goto fail;
}
if (error != 0) {
errno(*__errno()) = error;
warn("%s: connect", http_info(conn->req->uri));
goto fail;
}

return http_connect_done(conn);

886fail:
close(conn->fd);
conn->fd = -1;

return http_connect(conn);
891}

893/*
* Initiate TLS session on a new connection.
*/
896static enum res
897http_tls_connect(struct http_connection *conn)
898{
assert(conn->state == STATE_CONNECT)((conn->state == STATE_CONNECT) ? (void)0 : __assert2("/usr/src/usr.sbin/rpki-client/http.c"
, 899, __func__, "conn->state == STATE_CONNECT"));
conn->state = STATE_TLSCONNECT;

if ((conn->tls = tls_client()) == NULL((void*)0)) {
warn("tls_client");
return http_failed(conn);
}
if (tls_configure(conn->tls, tls_config) == -1) {
warnx("%s: TLS configuration: %s\n", http_info(conn->req->uri),
    tls_error(conn->tls));
return http_failed(conn);
}
if (tls_connect_socket(conn->tls, conn->fd, conn->host) == -1) {
warnx("%s: TLS connect: %s\n", http_info(conn->req->uri),
    tls_error(conn->tls));
return http_failed(conn);
}

return http_tls_handshake(conn);
918}

920/*
* Do the tls_handshake and then send out the HTTP request.
*/
923static enum res
924http_tls_handshake(struct http_connection *conn)
925{
switch (tls_handshake(conn->tls)) {
case -1:
warnx("%s: TLS handshake: %s", http_info(conn->req->uri),
    tls_error(conn->tls));
return http_failed(conn);
case TLS_WANT_POLLIN-2:
return WANT_POLLIN;
case TLS_WANT_POLLOUT-3:
return WANT_POLLOUT;
}

return http_request(conn);
938}

940static enum res
941proxy_connect(struct http_connection *conn)
942{
char *host;
int r;

assert(conn->state == STATE_CONNECT)((conn->state == STATE_CONNECT) ? (void)0 : __assert2("/usr/src/usr.sbin/rpki-client/http.c"
, 946, __func__, "conn->state == STATE_CONNECT"));
conn->state = STATE_PROXY_REQUEST;

/* Construct the Host header from host and port info */
if (strchr(conn->host, ':')) {
if (asprintf(&host, "[%s]:%s", conn->host, conn->port) == -1)
	err(1, NULL((void*)0));

} else {
if (asprintf(&host, "%s:%s", conn->host, conn->port) == -1)
	err(1, NULL((void*)0));
}

free(conn->buf);
conn->bufpos = 0;
/* XXX handle auth */
if ((r = asprintf(&conn->buf, "CONNECT %s HTTP/1.1\r\n"
   "User-Agent: " HTTP_USER_AGENT"OpenBSD rpki-client" "\r\n%s\r\n", host,
   proxy.proxyauth)) == -1)
err(1, NULL((void*)0));
conn->bufsz = r;

free(host);

return proxy_write(conn);
971}

973/*
* Build the HTTP request and send it out.
*/
976static enum res
977http_request(struct http_connection *conn)
978{
char *host, *epath, *modified_since;
int r, with_port = 0;

assert(conn->state == STATE_IDLE || conn->state == STATE_TLSCONNECT)((conn->state == STATE_IDLE || conn->state == STATE_TLSCONNECT
) ? (void)0 : __assert2("/usr/src/usr.sbin/rpki-client/http.c"
, 982, __func__, "conn->state == STATE_IDLE || conn->state == STATE_TLSCONNECT"
));
conn->state = STATE_REQUEST;

/*
* Send port number only if it's specified and does not equal
* the default. Some broken HTTP servers get confused if you explicitly
* send them the port number.
*/
if (strcmp(conn->port, "443") != 0)
with_port = 1;

/* Construct the Host header from host and port info */
if (strchr(conn->host, ':')) {
if (asprintf(&host, "[%s]%s%s", conn->host,
    with_port ? ":" : "", with_port ? conn->port : "") == -1)
	err(1, NULL((void*)0));

} else {
if (asprintf(&host, "%s%s%s", conn->host,
    with_port ? ":" : "", with_port ? conn->port : "") == -1)
	err(1, NULL((void*)0));
}

/*
* Construct and send the request. Proxy requests don't want leading /.
*/
epath = url_encode(conn->req->path);

modified_since = NULL((void*)0);
if (conn->req->modified_since != NULL((void*)0)) {
if (asprintf(&modified_since, "If-Modified-Since: %s\r\n",
    conn->req->modified_since) == -1)
	err(1, NULL((void*)0));
}

free(conn->buf);
conn->bufpos = 0;
if ((r = asprintf(&conn->buf,
   "GET /%s HTTP/1.1\r\n"
   "Host: %s\r\n"
   "Accept-Encoding: identity\r\n"
   "User-Agent: " HTTP_USER_AGENT"OpenBSD rpki-client" "\r\n"
   "%s\r\n",
   epath, host,
   modified_since ? modified_since : "")) == -1)
err(1, NULL((void*)0));
conn->bufsz = r;

free(epath);
free(host);
free(modified_since);

return http_write(conn);
1035}

1037/*
* Parse the HTTP status line.
* Return 0 for status codes 100, 103, 200, 203, 301-304, 307-308.
* The other 1xx and 2xx status codes are explicitly not handled and are
* considered an error.
* Failure codes and other errors return -1.
* The redirect loop limit is enforced here.
*/
1045static int
1046http_parse_status(struct http_connection *conn, char *buf)
1047{
1048#define HTTP_11"HTTP/1.1 "	"HTTP/1.1 "
const char *errstr;
char *cp, ststr[4];
char gerror[200];
int status;

/* Check if the protocol is 1.1 and enable keep-alive in that case */
if (strncmp(buf, HTTP_11"HTTP/1.1 ", strlen(HTTP_11"HTTP/1.1 ")) == 0)
conn->keep_alive = 1;

cp = strchr(buf, ' ');
if (cp == NULL((void*)0)) {
warnx("Improper response from %s", http_info(conn->host));
return -1;
} else
cp++;

strlcpy(ststr, cp, sizeof(ststr));
status = strtonum(ststr, 100, 599, &errstr);
if (errstr != NULL((void*)0)) {
strnvis(gerror, cp, sizeof gerror, VIS_SAFE0x20);
warnx("Error retrieving %s: %s", http_info(conn->host),
    gerror);
return -1;
}

switch (status) {
case 301:	/* Redirect: moved permanently */
case 302:	/* Redirect: found / moved temporarily */
case 303:	/* Redirect: see other */
case 307:	/* Redirect: temporary redirect */
case 308:	/* Redirect: permanent redirect */
if (conn->req->redirect_loop++ > 10) {
	warnx("%s: Too many redirections requested",
	    http_info(conn->host));
	return -1;
}
/* FALLTHROUGH */
case 100:	/* Informational: continue (ignored) */
case 103:	/* Informational: early hints (ignored) */
/* FALLTHROUGH */
case 200:	/* Success: OK */
case 203:	/* Success: non-authoritative information (proxy) */
case 304:	/* Redirect: not modified */
conn->status = status;
break;
default:
strnvis(gerror, cp, sizeof gerror, VIS_SAFE0x20);
warnx("Error retrieving %s: %s", http_info(conn->host),
    gerror);
return -1;
}

return 0;
1102}

1104/*
* Returns true if the connection status is any of the redirect codes.
*/
1107static inline int
1108http_isredirect(struct http_connection *conn)
1109{
if ((conn->status >= 301 && conn->status <= 303) ||
   conn->status == 307 || conn->status == 308)
return 1;
return 0;
1114}

1116static inline int
1117http_isok(struct http_connection *conn)
1118{
if (conn->status >= 200 && conn->status < 300)
return 1;
return 0;
1122}

1124static void
1125http_redirect(struct http_connection *conn)
1126{
char *uri, *mod_since = NULL((void*)0);
int outfd;

/* move uri and fd out for new request */
outfd = conn->req->outfd;
conn->req->outfd = -1;

uri = conn->redir_uri;
conn->redir_uri = NULL((void*)0);

if (conn->req->modified_since)
if ((mod_since = strdup(conn->req->modified_since)) == NULL((void*)0))
	err(1, NULL((void*)0));

logx("redirect to %s", http_info(uri));
http_req_new(conn->req->id, uri, mod_since, conn->req->redirect_loop,
   outfd);	

/* clear request before moving connection to idle */
http_req_free(conn->req);
conn->req = NULL((void*)0);
1148}

1150static int
1151http_parse_header(struct http_connection *conn, char *buf)
1152{
1153#define CONTENTLEN"Content-Length: " "Content-Length: "
1154#define LOCATION"Location: " "Location: "
1155#define CONNECTION"Connection: " "Connection: "
1156#define TRANSFER_ENCODING"Transfer-Encoding: " "Transfer-Encoding: "
1157#define LAST_MODIFIED"Last-Modified: " "Last-Modified: "
const char *errstr;
char *cp, *redirurl;
char *locbase, *loctail;

cp = buf;
/* empty line, end of header */
if (*cp == '\0')
return 0;
else if (strncasecmp(cp, CONTENTLEN"Content-Length: ", sizeof(CONTENTLEN"Content-Length: ") - 1) == 0) {
size_t s;
cp += sizeof(CONTENTLEN"Content-Length: ") - 1;
if ((s = strcspn(cp, " \t")) != 0)
	*(cp+s) = 0;
conn->iosz = strtonum(cp, 0, MAX_CONTENTLEN(2 * 1024 * 1024 * 1024LL), &errstr);
if (errstr != NULL((void*)0)) {
	warnx("Content-Length of %s is %s",
	    http_info(conn->req->uri), errstr);
	return -1;
}
} else if (http_isredirect(conn) &&
   strncasecmp(cp, LOCATION"Location: ", sizeof(LOCATION"Location: ") - 1) == 0) {
cp += sizeof(LOCATION"Location: ") - 1;
/*
 * If there is a colon before the first slash, this URI
 * is not relative. RFC 3986 4.2
 */
if (cp[strcspn(cp, ":/")] != ':') {
	/* XXX doesn't handle protocol-relative URIs */
	if (*cp == '/') {
		locbase = NULL((void*)0);
		cp++;
	} else {
		locbase = strdup(conn->req->path);
		if (locbase == NULL((void*)0))
			err(1, NULL((void*)0));
		loctail = strchr(locbase, '#');
		if (loctail != NULL((void*)0))
			*loctail = '\0';
		loctail = strchr(locbase, '?');
		if (loctail != NULL((void*)0))
			*loctail = '\0';
		loctail = strrchr(locbase, '/');
		if (loctail == NULL((void*)0)) {
			free(locbase);
			locbase = NULL((void*)0);
		} else
			loctail[1] = '\0';
	}
	/* Construct URL from relative redirect */
	if (asprintf(&redirurl, "%.*s/%s%s",
	    (int)(conn->req->path - conn->req->uri),
	    conn->req->uri, locbase ? locbase : "", cp) == -1)
		err(1, "Cannot build redirect URL");
	free(locbase);
} else if ((redirurl = strdup(cp)) == NULL((void*)0))
	err(1, "Cannot build redirect URL");
loctail = strchr(redirurl, '#');
if (loctail != NULL((void*)0))
	*loctail = '\0';
conn->redir_uri = redirurl;
} else if (strncasecmp(cp, TRANSFER_ENCODING"Transfer-Encoding: ",
   sizeof(TRANSFER_ENCODING"Transfer-Encoding: ") - 1) == 0) {
cp += sizeof(TRANSFER_ENCODING"Transfer-Encoding: ") - 1;
cp[strcspn(cp, " \t")] = '\0';
if (strcasecmp(cp, "chunked") == 0)
	conn->chunked = 1;
} else if (strncasecmp(cp, CONNECTION"Connection: ", sizeof(CONNECTION"Connection: ") - 1) == 0) {
cp += sizeof(CONNECTION"Connection: ") - 1;
cp[strcspn(cp, " \t")] = '\0';
if (strcasecmp(cp, "close") == 0)
	conn->keep_alive = 0;
else if (strcasecmp(cp, "keep-alive") == 0)
	conn->keep_alive = 1;
} else if (strncasecmp(cp, LAST_MODIFIED"Last-Modified: ",
   sizeof(LAST_MODIFIED"Last-Modified: ") - 1) == 0) {
cp += sizeof(LAST_MODIFIED"Last-Modified: ") - 1;
if ((conn->last_modified = strdup(cp)) == NULL((void*)0))
	err(1, NULL((void*)0));
}

return 1;
1239}

1241/*
* Return one line from the HTTP response.
* The line returned has any possible '\r' and '\n' at the end stripped.
* The buffer is advanced to the start of the next line.
* If there is currently no full line in the buffer NULL is returned.
*/ 
1247static char *
1248http_get_line(struct http_connection *conn)
1249{
char *end, *line;
size_t len;

end = memchr(conn->buf, '\n', conn->bufpos);
if (end == NULL((void*)0))
return NULL((void*)0);

len = end - conn->buf;
while (len > 0 && conn->buf[len - 1] == '\r')
--len;
if ((line = strndup(conn->buf, len)) == NULL((void*)0))
err(1, NULL((void*)0));

/* consume line including \n */
end++;
conn->bufpos -= end - conn->buf;
memmove(conn->buf, end, conn->bufpos);

return line;
1269}

1271/*
* Parse the header between data chunks during chunked transfers.
* Returns 0 if a new chunk size could be correctly read.
* Returns 1 for the empty trailer lines.
* If the chuck size could not be converted properly -1 is returned.
*/
1277static int
1278http_parse_chunked(struct http_connection *conn, char *buf)
1279{
char *header = buf;
char *end;
unsigned long chunksize;

/* empty lines are used as trailer */
if (*header == '\0')
return 1;

/* strip CRLF and any optional chunk extension */
header[strcspn(header, ";\r\n")] = '\0';
errno(*__errno()) = 0;
chunksize = strtoul(header, &end, 16);
if (header[0] == '\0' || *end != '\0' || (errno(*__errno()) == ERANGE34 &&
   chunksize == ULONG_MAX(9223372036854775807L *2UL+1UL)) || chunksize > INT_MAX2147483647)
return -1;

conn->iosz = chunksize;
return 0;
1298}

1300static enum res
1301http_read(struct http_connection *conn)
1302{
ssize_t s;
char *buf;
int done;

if (conn->bufpos > 0)
goto again;

1310read_more:
s = tls_read(conn->tls, conn->buf + conn->bufpos,
   conn->bufsz - conn->bufpos);
if (s == -1) {
warnx("%s: TLS read: %s", http_info(conn->host),
    tls_error(conn->tls));
return http_failed(conn);
} else if (s == TLS_WANT_POLLIN-2) {
return WANT_POLLIN;
} else if (s == TLS_WANT_POLLOUT-3) {
return WANT_POLLOUT;
}

if (s == 0) {
if (conn->req)
	warnx("%s: short read, connection closed",
	    http_info(conn->req->uri));
return http_failed(conn);
}

conn->bufpos += s;

1332again:
switch (conn->state) {
case STATE_PROXY_STATUS:
buf = http_get_line(conn);
if (buf == NULL((void*)0))
	goto read_more;
if (http_parse_status(conn, buf) == -1) {
	free(buf);
	return http_failed(conn);
}
free(buf);
conn->state = STATE_PROXY_RESPONSE;
goto again;
case STATE_PROXY_RESPONSE:
while (1) {
	buf = http_get_line(conn);
	if (buf == NULL((void*)0))
		goto read_more;
	/* empty line, end of header */
	if (*buf == '\0') {
		free(buf);
		break;
	}
	free(buf);
}
/* proxy is ready to take connection */
if (conn->status == 200) {
	conn->state = STATE_CONNECT;
	return http_tls_connect(conn);
}
return http_failed(conn);
case STATE_RESPONSE_STATUS:
buf = http_get_line(conn);
if (buf == NULL((void*)0))
	goto read_more;

if (http_parse_status(conn, buf) == -1) {
	free(buf);
	return http_failed(conn);
}
free(buf);
conn->state = STATE_RESPONSE_HEADER;
goto again;
case STATE_RESPONSE_HEADER:
done = 0;
while (!done) {
	int rv;

	buf = http_get_line(conn);
	if (buf == NULL((void*)0))
		goto read_more;

	rv = http_parse_header(conn, buf);
	free(buf);

	if (rv == -1)
		return http_failed(conn);
	if (rv == 0)
		done = 1;
}

/* Check status header and decide what to do next */
if (http_isok(conn) || http_isredirect(conn)) {
	if (http_isredirect(conn))
		http_redirect(conn);

	conn->totalsz = 0;
	if (conn->chunked)
		conn->state = STATE_RESPONSE_CHUNKED_HEADER;
	else
		conn->state = STATE_RESPONSE_DATA;
	goto again;
} else if (conn->status == 100 || conn->status == 103) {
	conn->state = STATE_RESPONSE_STATUS;
} else if (conn->status == 304) {
	return http_done(conn, HTTP_NOT_MOD);
}

return http_failed(conn);
case STATE_RESPONSE_DATA:
if (conn->bufpos != conn->bufsz &&
    conn->iosz > (off_t)conn->bufpos)
	goto read_more;

/* got a full buffer full of data */
if (conn->req == NULL((void*)0)) {
	/*
	 * After redirects all data needs to be discarded.
	 */
	if (conn->iosz < (off_t)conn->bufpos) {
		conn->bufpos -= conn->iosz;
		conn->iosz = 0;
	} else {
		conn->iosz -= conn->bufpos;
		conn->bufpos = 0;
	}
	if (conn->chunked)
		conn->state = STATE_RESPONSE_CHUNKED_TRAILER;
	else
		conn->state = STATE_RESPONSE_DATA;
	goto read_more;
}

conn->state = STATE_WRITE_DATA;
return WANT_POLLOUT;
case STATE_RESPONSE_CHUNKED_HEADER:
assert(conn->iosz == 0)((conn->iosz == 0) ? (void)0 : __assert2("/usr/src/usr.sbin/rpki-client/http.c"
, 1438, __func__, "conn->iosz == 0"));

buf = http_get_line(conn);
if (buf == NULL((void*)0))
	goto read_more;
if (http_parse_chunked(conn, buf) != 0) {
	warnx("%s: bad chunk encoding", http_info(conn->host));
	free(buf);
	return http_failed(conn);
}
free(buf);

/*
 * check if transfer is done, in which case the last trailer
 * still needs to be processed.
 */
if (conn->iosz == 0) {
	conn->chunked = 0;
	conn->state = STATE_RESPONSE_CHUNKED_TRAILER;
	goto again;
}

conn->state = STATE_RESPONSE_DATA;
goto again;
case STATE_RESPONSE_CHUNKED_TRAILER:
buf = http_get_line(conn);
if (buf == NULL((void*)0))
	goto read_more;
if (http_parse_chunked(conn, buf) != 1) {
	warnx("%s: bad chunk encoding", http_info(conn->host));
	free(buf);
	return http_failed(conn);
}
free(buf);

/* if chunked got cleared then the transfer is over */
if (conn->chunked == 0)
	return http_done(conn, HTTP_OK);

conn->state = STATE_RESPONSE_CHUNKED_HEADER;
goto again;
default:
errx(1, "unexpected http state");
}
1482}

1484/*
* Send out the HTTP request. When done, replace buffer with the read buffer.
*/
1487static enum res
1488http_write(struct http_connection *conn)
1489{
ssize_t s;

assert(conn->state == STATE_REQUEST)((conn->state == STATE_REQUEST) ? (void)0 : __assert2("/usr/src/usr.sbin/rpki-client/http.c"
, 1492, __func__, "conn->state == STATE_REQUEST"));

while (conn->bufpos < conn->bufsz) {
s = tls_write(conn->tls, conn->buf + conn->bufpos,
    conn->bufsz - conn->bufpos);
if (s == -1) {
	warnx("%s: TLS write: %s", http_info(conn->host),
	    tls_error(conn->tls));
	return http_failed(conn);
} else if (s == TLS_WANT_POLLIN-2) {
	return WANT_POLLIN;
} else if (s == TLS_WANT_POLLOUT-3) {
	return WANT_POLLOUT;
}

conn->bufpos += s;
}

/* done writing, first thing we need the status */
conn->state = STATE_RESPONSE_STATUS;

/* free write buffer and allocate the read buffer */
free(conn->buf);
conn->bufpos = 0;
conn->bufsz = HTTP_BUF_SIZE(32 * 1024);
if ((conn->buf = malloc(conn->bufsz)) == NULL((void*)0))
err(1, NULL((void*)0));

return http_read(conn);
1521}

1523static enum res
1524proxy_read(struct http_connection *conn)
1525{
ssize_t s;
char *buf;
int done;

s = read(conn->fd, conn->buf + conn->bufpos,
   conn->bufsz - conn->bufpos);
if (s == -1) {
warn("%s: read", http_info(conn->host));
return http_failed(conn);
}

if (s == 0) {
if (conn->req)
	warnx("%s: short read, connection closed",
	    http_info(conn->host));
return http_failed(conn);
}

conn->bufpos += s;

1546again:
switch (conn->state) {
case STATE_PROXY_STATUS:
buf = http_get_line(conn);
if (buf == NULL((void*)0))
	return WANT_POLLIN;
if (http_parse_status(conn, buf) == -1) {
	free(buf);
	return http_failed(conn);
}
free(buf);
conn->state = STATE_PROXY_RESPONSE;
goto again;
case STATE_PROXY_RESPONSE:
done = 0;
while (!done) {
	buf = http_get_line(conn);
	if (buf == NULL((void*)0))
		return WANT_POLLIN;
	/* empty line, end of header */
	if (*buf == '\0')
		done = 1;
	free(buf);
}
/* proxy is ready, connect to remote */
if (conn->status == 200) {
	conn->state = STATE_CONNECT;
	return http_tls_connect(conn);
}
return http_failed(conn);
default:
errx(1, "unexpected http state");
}
1579}

1581/*
* Send out the proxy request. When done, replace buffer with the read buffer.
*/
1584static enum res
1585proxy_write(struct http_connection *conn)
1586{
ssize_t s;

assert(conn->state == STATE_PROXY_REQUEST)((conn->state == STATE_PROXY_REQUEST) ? (void)0 : __assert2
("/usr/src/usr.sbin/rpki-client/http.c", 1589, __func__, "conn->state == STATE_PROXY_REQUEST"
));

s = write(conn->fd, conn->buf + conn->bufpos,
    conn->bufsz - conn->bufpos);
if (s == -1) {
warn("%s: write", http_info(conn->host));
return http_failed(conn);
}
conn->bufpos += s;
if (conn->bufpos < conn->bufsz)
return WANT_POLLOUT;

/* done writing, first thing we need the status */
conn->state = STATE_PROXY_STATUS;

/* free write buffer and allocate the read buffer */
free(conn->buf);
conn->bufpos = 0;
conn->bufsz = HTTP_BUF_SIZE(32 * 1024);
if ((conn->buf = malloc(conn->bufsz)) == NULL((void*)0))
err(1, NULL((void*)0));

return WANT_POLLIN;
1612}

1614/*
* Properly shutdown the TLS session else move connection into free state.
*/
1617static enum res
1618http_close(struct http_connection *conn)
1619{
assert(conn->state == STATE_IDLE || conn->state == STATE_CLOSE)((conn->state == STATE_IDLE || conn->state == STATE_CLOSE
) ? (void)0 : __assert2("/usr/src/usr.sbin/rpki-client/http.c"
, 1620, __func__, "conn->state == STATE_IDLE || conn->state == STATE_CLOSE"
));

conn->state = STATE_CLOSE;

if (conn->tls != NULL((void*)0)) {
switch (tls_close(conn->tls)) {
case TLS_WANT_POLLIN-2:
	return WANT_POLLIN;
case TLS_WANT_POLLOUT-3:
	return WANT_POLLOUT;
case 0:
case -1:
	break;
}
}

conn->state = STATE_FREE;
return DONE;
1638}

1640/*
* Write data into provided file descriptor. If all data got written
* the connection may change into idle state.
*/
1644static enum res
1645data_write(struct http_connection *conn)
1646{
ssize_t s;
size_t bsz = conn->bufpos;

assert(conn->state == STATE_WRITE_DATA)((conn->state == STATE_WRITE_DATA) ? (void)0 : __assert2("/usr/src/usr.sbin/rpki-client/http.c"
, 1650, __func__, "conn->state == STATE_WRITE_DATA"));

if (conn->iosz < (off_t)bsz)
bsz = conn->iosz;

s = write(conn->req->outfd, conn->buf, bsz);
if (s == -1) {
warn("%s: data write", http_info(conn->req->uri));
return http_failed(conn);
}

conn->totalsz += s;
if (conn->totalsz > MAX_CONTENTLEN(2 * 1024 * 1024 * 1024LL)) {
warn("%s: too much data offered", http_info(conn->req->uri));
return http_failed(conn);
}

conn->bufpos -= s;
conn->iosz -= s;
memmove(conn->buf, conn->buf + s, conn->bufpos);

/* check if regular file transfer is finished */
if (!conn->chunked && conn->iosz == 0)
return http_done(conn, HTTP_OK);

/* all data written, switch back to read */
if (conn->bufpos == 0 || conn->iosz == 0) {
if (conn->chunked && conn->iosz == 0)
	conn->state = STATE_RESPONSE_CHUNKED_TRAILER;
else
	conn->state = STATE_RESPONSE_DATA;
return http_read(conn);
}

/* still more data to write in buffer */
return WANT_POLLOUT;
1686}

1688/*
* Do one IO call depending on the connection state.
* Return WANT_POLLIN or WANT_POLLOUT to poll for more data.
* If 0 is returned this stage is finished and the protocol should move
* to the next stage by calling http_nextstep(). On error return -1.
*/
1694static enum res
1695http_handle(struct http_connection *conn)
1696{
assert (conn->pfd != NULL && conn->pfd->revents != 0)((conn->pfd != ((void*)0) && conn->pfd->revents
 != 0) ? (void)0 : __assert2("/usr/src/usr.sbin/rpki-client/http.c"
, 1697, __func__, "conn->pfd != NULL && conn->pfd->revents != 0"
));

conn->io_time = 0;

switch (conn->state) {
case STATE_CONNECT:
return http_finish_connect(conn);
case STATE_TLSCONNECT:
return http_tls_handshake(conn);
case STATE_REQUEST:
return http_write(conn);
case STATE_PROXY_REQUEST:
return proxy_write(conn);
case STATE_PROXY_STATUS:
case STATE_PROXY_RESPONSE:
return proxy_read(conn);
case STATE_RESPONSE_STATUS:
case STATE_RESPONSE_HEADER:
case STATE_RESPONSE_DATA:
case STATE_RESPONSE_CHUNKED_HEADER:
case STATE_RESPONSE_CHUNKED_TRAILER:
return http_read(conn);
case STATE_WRITE_DATA:
return data_write(conn);
case STATE_CLOSE:
return http_close(conn);
case STATE_IDLE:
conn->state = STATE_RESPONSE_HEADER;
return http_read(conn);
case STATE_FREE:
errx(1, "bad http state");
}
errx(1, "unknown http state");
1730}

1732/*
* Initialisation done before pledge() call to load certificates.
*/
1735static void
1736http_setup(void)
1737{
char *httpproxy;

tls_config = tls_config_new();
if (tls_config == NULL((void*)0))
4
←
Assuming 'tls_config' is not equal to NULL→
5
←
Taking false branch→
errx(1, "tls config failed");

1744#if 0
/* TODO Should we allow extra protos and ciphers? */
if (tls_config_set_protocols(tls_config, TLS_PROTOCOLS_ALL((1 << 1)|(1 << 2)| (1 << 3)|(1 << 4)
)) == -1)
errx(1, "tls set protocols failed: %s",
    tls_config_error(tls_config));
if (tls_config_set_ciphers(tls_config, "legacy") == -1)
errx(1, "tls set ciphers failed: %s",
    tls_config_error(tls_config));
1752#endif

/* load cert file from disk now */
tls_ca_mem = tls_load_file(tls_default_ca_cert_file(),
   &tls_ca_size, NULL((void*)0));
if (tls_ca_mem == NULL((void*)0))
6
←
Assuming 'tls_ca_mem' is not equal to NULL→
7
←
Taking false branch→
err(1, "tls_load_file: %s", tls_default_ca_cert_file());
tls_config_set_ca_mem(tls_config, tls_ca_mem, tls_ca_size);

      if ((httpproxy = getenv("http_proxy")) != NULL((void*)0) && *httpproxy == '\0')
8
←
Assuming the condition is true→
9
←
Assuming the condition is false→
10
←
Taking false branch→
httpproxy = NULL((void*)0);

proxy_parse_uri(httpproxy);
11
←
Calling 'proxy_parse_uri'→
1765}

1767void
1768proc_http(char *bind_addr, int fd)
1769{
struct pollfd pfds[NPFDS(64 + 1)];
struct http_connection *conn, *nc;
struct http_request *req, *nr;
struct ibuf *b, *inbuf = NULL((void*)0);

if (bind_addr != NULL((void*)0)) {
1
Assuming 'bind_addr' is equal to NULL→
2
←
Taking false branch→
struct addrinfo hints, *res;

bzero(&hints, sizeof(hints));
hints.ai_family = AF_UNSPEC0;
hints.ai_socktype = SOCK_DGRAM2; /*dummy*/
hints.ai_flags = AI_NUMERICHOST4;
if (getaddrinfo(bind_addr, NULL((void*)0), &hints, &res) == 0) {
	memcpy(&http_bindaddr, res->ai_addr, res->ai_addrlen);
	freeaddrinfo(res);
}
}
http_setup();
3
←
Calling 'http_setup'→

if (pledge("stdio inet dns recvfd", NULL((void*)0)) == -1)
err(1, "pledge");

memset(&pfds, 0, sizeof(pfds));

msgbuf_init(&msgq);
msgq.fd = fd;

for (;;) {
time_t now;
int timeout;
size_t i;

pfds[0].fd = fd;
pfds[0].events = POLLIN0x0001;
if (msgq.queued)
	pfds[0].events |= POLLOUT0x0004;

i = 1;
timeout = INFTIM(-1);
now = getmonotime();
LIST_FOREACH(conn, &active, entry)for((conn) = ((&active)->lh_first); (conn)!= ((void*)0
); (conn) = ((conn)->entry.le_next)) {
	if (conn->io_time == 0)
		conn->io_time = now + HTTP_IO_TIMEOUT(3 * 60);

	if (conn->io_time <= now)
		timeout = 0;
	else {
		int diff = conn->io_time - now; 
		diff *= 1000;
		if (timeout == INFTIM(-1) || diff < timeout)
			timeout = diff;
	}
	if (conn->state == STATE_WRITE_DATA)
		pfds[i].fd = conn->req->outfd;
	else
		pfds[i].fd = conn->fd;

	pfds[i].events = conn->events;
	conn->pfd = &pfds[i];
	i++;
	if (i > NPFDS(64 + 1))
		errx(1, "too many connections");
}
LIST_FOREACH(conn, &idle, entry)for((conn) = ((&idle)->lh_first); (conn)!= ((void*)0);
 (conn) = ((conn)->entry.le_next)) {
	if (conn->idle_time <= now)
		timeout = 0;
	else {
		int diff = conn->idle_time - now; 
		diff *= 1000;
		if (timeout == INFTIM(-1) || diff < timeout)
			timeout = diff;
	}
	pfds[i].fd = conn->fd;
	pfds[i].events = POLLIN0x0001;
	conn->pfd = &pfds[i];
	i++;
	if (i > NPFDS(64 + 1))
		errx(1, "too many connections");
}

if (poll(pfds, i, timeout) == -1)
	err(1, "poll");

if (pfds[0].revents & POLLHUP0x0010)
	break;
if (pfds[0].revents & POLLOUT0x0004) {
	switch (msgbuf_write(&msgq)) {
	case 0:
		errx(1, "write: connection closed");
	case -1:
		err(1, "write");
	}
}
if (pfds[0].revents & POLLIN0x0001) {
	b = io_buf_recvfd(fd, &inbuf);
	if (b != NULL((void*)0)) {
		unsigned int id;
		char *uri;
		char *mod;

		io_read_buf(b, &id, sizeof(id));
		io_read_str(b, &uri);
		io_read_str(b, &mod);

		/* queue up new requests */
		http_req_new(id, uri, mod, 0, b->fd);
		ibuf_free(b);
	}
}

now = getmonotime();
/* process idle connections */
LIST_FOREACH_SAFE(conn, &idle, entry, nc)for ((conn) = ((&idle)->lh_first); (conn) && (
(nc) = ((conn)->entry.le_next), 1); (conn) = (nc)) {
	if (conn->pfd != NULL((void*)0) && conn->pfd->revents != 0)
		http_do(conn, http_handle);
	else if (conn->idle_time <= now)
		http_do(conn, http_close);

	if (conn->state == STATE_FREE)
		http_free(conn);
}

/* then active http requests */
LIST_FOREACH_SAFE(conn, &active, entry, nc)for ((conn) = ((&active)->lh_first); (conn) &&
 ((nc) = ((conn)->entry.le_next), 1); (conn) = (nc)) {
	/* check if event is ready */
	if (conn->pfd != NULL((void*)0) && conn->pfd->revents != 0)
		http_do(conn, http_handle);
	else if (conn->io_time <= now) {
		warnx("%s: timeout, connection closed",
		    http_info(conn->host));
		http_do(conn, http_failed);
	}

	if (conn->state == STATE_FREE)
		http_free(conn);
}


TAILQ_FOREACH_SAFE(req, &queue, entry, nr)for ((req) = ((&queue)->tqh_first); (req) != ((void*)0
) && ((nr) = ((req)->entry.tqe_next), 1); (req) = (
nr))
	if (!http_req_schedule(req))
		break;
}

exit(0);
1914}