xmpp-certwatch

Patch applied to dane:From e2cd4b16559a4e6d42ceaf4db9123de61a59612a Mon Sep 17 00:00:00 2001 From: Eric Roberts <ericroberts@gmail.com> Date: Mon, 26 Oct 2026 14:40:49 -0400 Subject: [PATCH] Add deadline in DialStartTLS STARTTLS negotiation getSTARTTLSconn now applies TimeoutTCP as a connection deadline covering the whole STARTTLS exchange and TLS handshake, and startTLSHandshake clears it on success so the returned conn is not left with an absolute deadline, since previously only the TCP connect was bounded and a stalled server could hang DialStartTLS indefinitely. --- starttls.go | 27 +++++++++++++++++++-------- utils.go | 12 ++++++++++++ 2 files changed, 31 insertions(+), 8 deletions(-) diff --git a/starttls.go b/starttls.go index e3205b9..0b85021 100644 --- a/starttls.go +++ b/starttls.go @@ -4,9 +4,11 @@ import ( bufio crypto/tls fmt + net os strconv strings + time ) const bufsize = 2048 @@ -23,7 +25,7 @@ func DoXMPP(tlsconfig *tls.Config, daneconfig *Config) (*tls.Conn, error) { buf := make([]byte, bufsize) server := daneconfig.Server - conn, err := getTCPconn(server.Ipaddr, server.Port, daneconfig.TimeoutTCP) + conn, err := getSTARTTLSconn(server.Ipaddr, server.Port, daneconfig.TimeoutTCP) if err != nil { return nil, err } @@ -87,7 +89,7 @@ func DoXMPP(tlsconfig *tls.Config, daneconfig *Config) (*tls.Conn, error) { } daneconfig.Transcript = transcript - return TLShandshake(conn, tlsconfig) + return startTLSHandshake(conn, tlsconfig) } // @@ -99,7 +101,7 @@ func DoPOP3(tlsconfig *tls.Config, daneconfig *Config) (*tls.Conn, error) { var line, transcript string server := daneconfig.Server - conn, err := getTCPconn(server.Ipaddr, server.Port, daneconfig.TimeoutTCP) + conn, err := getSTARTTLSconn(server.Ipaddr, server.Port, daneconfig.TimeoutTCP) if err != nil { return nil, err } @@ -132,7 +134,7 @@ func DoPOP3(tlsconfig *tls.Config, daneconfig *Config) (*tls.Conn, error) { } daneconfig.Transcript = transcript - return TLShandshake(conn, tlsconfig) + return startTLSHandshake(conn, tlsconfig) } // @@ -145,7 +147,7 @@ func DoIMAP(tlsconfig *tls.Config, daneconfig *Config) (*tls.Conn, error) { var line, transcript string server := daneconfig.Server - conn, err := getTCPconn(server.Ipaddr, server.Port, daneconfig.TimeoutTCP) + conn, err := getSTARTTLSconn(server.Ipaddr, server.Port, daneconfig.TimeoutTCP) if err != nil { return nil, err } @@ -202,7 +204,7 @@ func DoIMAP(tlsconfig *tls.Config, daneconfig *Config) (*tls.Conn, error) { } daneconfig.Transcript = transcript - return TLShandshake(conn, tlsconfig) + return startTLSHandshake(conn, tlsconfig) } // @@ -236,7 +238,7 @@ func DoSMTP(tlsconfig *tls.Config, daneconfig *Config) (*tls.Conn, error) { var responseDone, gotSTARTTLS bool server := daneconfig.Server - conn, err := getTCPconn(server.Ipaddr, server.Port, daneconfig.TimeoutTCP) + conn, err := getSTARTTLSconn(server.Ipaddr, server.Port, daneconfig.TimeoutTCP) if err != nil { return nil, err } @@ -320,7 +322,16 @@ func DoSMTP(tlsconfig *tls.Config, daneconfig *Config) (*tls.Conn, error) { } daneconfig.Transcript = transcript - return TLShandshake(conn, tlsconfig) + return startTLSHandshake(conn, tlsconfig) +} + +func startTLSHandshake(conn net.Conn, tlsconfig *tls.Config) (*tls.Conn, error) { + + tlsconn, err := TLShandshake(conn, tlsconfig) + if err == nil { + _ = conn.SetDeadline(time.Time{}) + } + return tlsconn, err } // diff --git a/utils.go b/utils.go index 0fa4f20..ce4ef72 100644 --- a/utils.go +++ b/utils.go @@ -45,6 +45,18 @@ func getTCPconn(address net.IP, port int, timeout int) (net.Conn, error) { return conn, err } +func getSTARTTLSconn(address net.IP, port int, timeout int) (net.Conn, error) { + + conn, err := getTCPconn(address, port, timeout) + if err != nil { + return nil, err + } + if timeout > 0 { + _ = conn.SetDeadline(time.Now().Add(time.Second * time.Duration(timeout))) + } + return conn, nil +} + // // CertToPEMBytes returns PEM encoded bytes corresponding to the given // x.509 certificate. -- 2.55.0