Check whether the TLS stack supports channel binding.

Add a runtime check per TLS stack which returns whether channel binding is
supported or not.

This fixes #270

Signed-off-by: Steffen Jaeckel <s@jaeckel.eu>

.github/ISSUE_TEMPLATE/01-bug_report.md

@@ -1,3 +1,12 @@
+---
+name: Bug report
+about: Create a bug report
+title: ''
+labels: bug
+assignees: ''
+
+---
+
 <!--
 
 Provide a general summary of the issue in the Title above

.github/workflows/main.yml

@@ -8,9 +8,13 @@ on:
   pull_request:
     branches: [master]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   linux-tests:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     strategy:
       matrix:
         valgrind:
@@ -46,15 +50,18 @@ jobs:
           cat test-suite*.log || true
 
   xssl-tests:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     strategy:
       matrix:
         xssl_versions:
            - { version: "master",          continue: true,  libressl: true }
+           - { version: "OPENBSD_7_8",     continue: true,  libressl: true }
+           - { version: "v4.2.1",          continue: true,  libressl: true }
+           - { version: "OPENBSD_7_7",     continue: true,  libressl: true }
+           - { version: "v4.1.2",          continue: true,  libressl: true }
+           - { version: "OPENBSD_7_6",     continue: true,  libressl: true }
            - { version: "OPENBSD_7_5",     continue: true,  libressl: true }
-           - { version: "v3.9.2",          continue: true,  libressl: true }
            - { version: "OPENBSD_7_4",     continue: true,  libressl: true }
-           - { version: "v3.8.4",          continue: true,  libressl: true }
            - { version: "OPENBSD_7_3",     continue: true,  libressl: true }
            - { version: "OPENBSD_7_2",     continue: true,  libressl: true }
            - { version: "OPENBSD_7_1",     continue: true,  libressl: true }
@@ -68,13 +75,17 @@ jobs:
            - { version: "v3.1.5",          continue: true,  libressl: true }
            - { version: "v2.1.10",         continue: true,  libressl: true }
            - { version: "openssl-3.0",     continue: true,  libressl: false }
-           - { version: "openssl-3.0.13",  continue: false, libressl: false }
-           - { version: "openssl-3.1",     continue: true,  libressl: false }
-           - { version: "openssl-3.1.5",   continue: false, libressl: false }
+           - { version: "openssl-3.0.18",  continue: false, libressl: false }
            - { version: "openssl-3.2",     continue: true,  libressl: false }
-           - { version: "openssl-3.2.1",   continue: false, libressl: false }
+           - { version: "openssl-3.2.6",   continue: false, libressl: false }
            - { version: "openssl-3.3",     continue: true,  libressl: false }
-           - { version: "openssl-3.3.0",   continue: false, libressl: false }
+           - { version: "openssl-3.3.5",   continue: false, libressl: false }
+           - { version: "openssl-3.4",     continue: true,  libressl: false }
+           - { version: "openssl-3.4.3",   continue: false, libressl: false }
+           - { version: "openssl-3.5",     continue: true,  libressl: false }
+           - { version: "openssl-3.5.3",   continue: false, libressl: false }
+           - { version: "openssl-3.6",     continue: true,  libressl: false }
+           - { version: "openssl-3.6.0",   continue: false, libressl: false }
     name: xSSL tests
     continue-on-error: ${{ matrix.xssl_versions.continue }}
     steps:
@@ -111,7 +122,7 @@ jobs:
           cat test-suite*.log || true
 
   release-test:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     name: Check if release would work
     steps:
       - uses: actions/checkout@v2
@@ -142,7 +153,7 @@ jobs:
           cat testerr.log || true
 
   code-style:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     name: Check coding style
     continue-on-error: true
     steps:

.gitignore

@@ -88,3 +88,4 @@ coverage/
 coverage.info
 configure~
 fuzz-*.log
+build*/

Makefile.am

@@ -17,7 +17,9 @@ if TLS_WITH_GNUTLS
 SSL_CFLAGS = @gnutls_CFLAGS@
 SSL_LIBS = @gnutls_LIBS@
 else
-if !TLS_WITH_SCHANNEL
+if TLS_WITH_SCHANNEL
+SSL_CFLAGS = -DSTROPHE_TLS_SCHANNEL
+else
 SSL_CFLAGS = @openssl_CFLAGS@
 SSL_LIBS = @openssl_LIBS@
 endif

_clang-format

@@ -1,8 +1,8 @@
 ---
 AlignConsecutiveAssignments: 'false'
 AlignEscapedNewlines: Left
-AllowShortBlocksOnASingleLine: 'true'
-AllowShortFunctionsOnASingleLine: Empty
+AllowShortBlocksOnASingleLine: Never
+AllowShortFunctionsOnASingleLine: None
 AllowShortIfStatementsOnASingleLine: 'false'
 BinPackParameters: 'false'
 BreakBeforeBraces: Linux

configure.ac

@@ -18,9 +18,10 @@ PKG_PROG_PKG_CONFIG
 
 AC_CANONICAL_HOST
 AS_CASE([$host_os],
+    [dragonfly*],  [PLATFORM="bsd"],
     [freebsd*],    [PLATFORM="bsd"],
-    [openbsd*],    [PLATFORM="bsd"],
     [netbsd*],     [PLATFORM="bsd"],
+    [openbsd*],    [PLATFORM="bsd"],
     [*nto*|*qnx*], [PLATFORM="qnx"],
     [*solaris*],   [PLATFORM="solaris"],
     [*android*],   [PLATFORM="android"],

examples/bot.c

@@ -20,11 +20,12 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <unistd.h>
 
 #ifdef _WIN32
 #include <conio.h>
 #include <ctype.h>
+#else
+#include <unistd.h>
 #endif
 
 #include <strophe.h>

examples/complex.c

@@ -13,7 +13,6 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <unistd.h>
 
 #ifdef _WIN32
 #include <conio.h>
@@ -23,6 +22,7 @@
 #include <iphlpapi.h>
 #include <mstcpip.h> /* tcp_keepalive */
 #else
+#include <unistd.h>
 #include <sys/socket.h>
 #include <netinet/in.h>
 #include <netinet/tcp.h>

examples/vcard.c

@@ -11,11 +11,16 @@
  */
 
 #include <assert.h>
-#include <libgen.h> /* basename */
 #include <string.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <strophe.h>
+#ifndef _WIN32
+#include <libgen.h> /* basename */
+#else
+#define strtok_r strtok_s
+#define basename(x) "vcard"
+#endif
 
 typedef struct {
     xmpp_ctx_t *ctx;

src/auth.c

@@ -602,8 +602,10 @@ static int _make_scram_init_msg(struct scram_user_data *scram)
         l = strophe_snprintf(message, message_len, "p=%s,,n=%s,r=%s",
                              binding_type, node, buf);
     } else {
-        l = strophe_snprintf(message, message_len, "%c,,n=%s,r=%s",
-                             is_secured ? 'y' : 'n', node, buf);
+        l = strophe_snprintf(
+            message, message_len, "%c,,n=%s,r=%s",
+            is_secured && tls_supports_channel_binding(conn->tls) ? 'y' : 'n',
+            node, buf);
     }
     if (l < 0 || (size_t)l >= message_len) {
         goto err_msg;

src/common.h

@@ -29,13 +29,29 @@
 #include "parser.h"
 #include "snprintf.h"
 
+/** Define your own `STROPHE_STATIC_ASSERT` if your compiler doesn't support one
+ * of the below ones or define as noop if your compiler provides no replacement.
+ */
+#if !defined(STROPHE_STATIC_ASSERT)
+#if (__STDC_VERSION__ >= 202000L)
+#define STROPHE_STATIC_ASSERT(cond, msg) static_assert(cond, msg)
+#else
+#define STROPHE_STATIC_ASSERT(cond, msg) _Static_assert(cond, msg)
+#endif
+#endif
+
 /** handlers **/
+#if (__STDC_VERSION__ >= 202000L)
+typedef void *xmpp_void_handler;
+#else
+typedef int (*xmpp_void_handler)();
+#endif
 
 typedef struct _xmpp_handlist_t xmpp_handlist_t;
 struct _xmpp_handlist_t {
     /* common members */
     int user_handler;
-    int (*handler)();
+    xmpp_void_handler handler;
     void *userdata;
     int enabled; /* handlers are added disabled and enabled after the
                   * handler chain is processed to prevent stanzas from

src/compression.c

@@ -18,6 +18,9 @@
 #include <errno.h>
 
 #include "common.h"
+#ifdef _MSC_VER
+#define strcasecmp _stricmp
+#endif
 
 #ifndef STROPHE_COMPRESSION_BUFFER_SIZE
 /** Max buffer size for compressed data (send & receive). */
@@ -110,7 +113,7 @@ static int
 _compression_write(xmpp_conn_t *conn, const void *buff, size_t len, int flush)
 {
     int ret;
-    const void *buff_end = buff + len;
+    const void *buff_end = (const char *)buff + len;
     struct xmpp_compression *comp = conn->compression.state;
     comp->compression.stream.next_in = (Bytef *)buff;
     comp->compression.stream.avail_in = len;
@@ -201,7 +204,7 @@ static void *_zlib_alloc(void *opaque, unsigned int items, unsigned int size)
 static void _init_zlib_compression(xmpp_ctx_t *ctx, struct zlib_compression *s)
 {
     s->buffer = strophe_alloc(ctx, STROPHE_COMPRESSION_BUFFER_SIZE);
-    s->buffer_end = s->buffer + STROPHE_COMPRESSION_BUFFER_SIZE;
+    s->buffer_end = (char *)s->buffer + STROPHE_COMPRESSION_BUFFER_SIZE;
 
     s->stream.opaque = ctx;
     s->stream.zalloc = _zlib_alloc;

src/conn.c

@@ -21,7 +21,9 @@
  */
 
 #include <errno.h>
+#if !defined(_MSC_VER) && !defined(_WIN32)
 #include <netinet/in.h>
+#endif
 #include <stdarg.h>
 #include <string.h>
 #include <limits.h>

src/event.c

@@ -39,7 +39,7 @@
 #include <sys/select.h>
 #include <errno.h>
 #include <unistd.h>
-#define _sleep(x) usleep((x)*1000)
+#define _sleep(x) usleep((x) * 1000)
 #else
 #include <winsock2.h>
 #ifndef ETIMEDOUT

src/handler.c

@@ -25,8 +25,6 @@
 #include "common.h"
 #include "ostypes.h"
 
-typedef int (*xmpp_void_handler)();
-
 /* Remove item from the list pointed by head, but don't free it.
  * There can be a situation when user's handler deletes another handler which
  * is the previous in the list. handler_fire_stanza() and handler_fire_timed()

src/md5.c

@@ -37,7 +37,7 @@
 
 #define PUT_32BIT_LSB_FIRST(cp, value)    \
     do {                                  \
-        (cp)[0] = (value)&0xFF;           \
+        (cp)[0] = (value) & 0xFF;         \
         (cp)[1] = ((value) >> 8) & 0xFF;  \
         (cp)[2] = ((value) >> 16) & 0xFF; \
         (cp)[3] = ((value) >> 24) & 0xFF; \

src/rand.c

@@ -68,9 +68,9 @@ struct _xmpp_rand_t {
 };
 
 /* returns smallest number mupliple of y that not less than x */
-#define round_up(x, y) (((x) + (y)-1) / (y) * (y))
+#define round_up(x, y) (((x) + (y) - 1) / (y) * (y))
 /* returns smallest integer number that not less than x/y */
-#define div_round_up(x, y) (((x) + (y)-1) / (y))
+#define div_round_up(x, y) (((x) + (y) - 1) / (y))
 
 /* adds two arrays as numbers in big-endian representation and stores
  * result in the first one.

src/resolver.c

@@ -630,7 +630,7 @@ static void netbuf_add_16bitnum(unsigned char *buf,
 
     /* assuming big endian */
     *p++ = (num >> 8) & 0xff;
-    *p++ = (num)&0xff;
+    *p++ = (num) & 0xff;
 
     *offset += 2;
 }
@@ -982,7 +982,7 @@ resolver_win32_srv_query(const char *fulldomain, unsigned char *buf, size_t len)
                     insize = recvfrom(sock, (char *)buf, (int)len, 0,
                                       (struct sockaddr *)&dnsaddr, &addrlen);
                     if (insize == SOCKET_ERROR) {
-                        if (sock_error() == WSAEWOULDBLOCK) {
+                        if (sock_error(NULL) == WSAEWOULDBLOCK) {
                             Sleep(100);
                         } else {
                             break;

src/scram.c

@@ -93,12 +93,14 @@ const struct hash_alg scram_sha512_plus = {
  * https://datatracker.ietf.org/doc/html/draft-ietf-kitten-password-storage
  */
 const struct hash_alg *scram_algs[] = {
+#if !defined(STROPHE_TLS_SCHANNEL)
     /* *1 */
     &scram_sha512_plus,
     /* *1 */
     &scram_sha256_plus,
     /* *1 */
     &scram_sha1_plus,
+#endif
     /* *1 */
     &scram_sha512,
     /* *1 */

src/sha.h

@@ -53,7 +53,7 @@ extern "C" {
         (y)[0] = (uint8_t)(((x) >> 24) & 255); \
         (y)[1] = (uint8_t)(((x) >> 16) & 255); \
         (y)[2] = (uint8_t)(((x) >> 8) & 255);  \
-        (y)[3] = (uint8_t)((x)&255);           \
+        (y)[3] = (uint8_t)((x) & 255);         \
     } while (0)
 
 #define LOAD32H(x, y)                                                     \
@@ -72,7 +72,7 @@ extern "C" {
         (y)[4] = (uint8_t)(((x) >> 24) & 255); \
         (y)[5] = (uint8_t)(((x) >> 16) & 255); \
         (y)[6] = (uint8_t)(((x) >> 8) & 255);  \
-        (y)[7] = (uint8_t)((x)&255);           \
+        (y)[7] = (uint8_t)((x) & 255);         \
     } while (0)
 
 #define LOAD64H(x, y)                                                         \
@@ -96,13 +96,13 @@ extern "C" {
 #define CONST64(n) n##ULL
 #endif
 
-#define RORc(x, y)                                           \
-    (((((uint32_t)(x)&0xFFFFFFFFUL) >> (uint32_t)((y)&31)) | \
-      ((uint32_t)(x) << (uint32_t)((32 - ((y)&31)) & 31))) & \
+#define RORc(x, y)                                               \
+    (((((uint32_t)(x) & 0xFFFFFFFFUL) >> (uint32_t)((y) & 31)) | \
+      ((uint32_t)(x) << (uint32_t)((32 - ((y) & 31)) & 31))) &   \
      0xFFFFFFFFUL)
-#define ROR64c(x, y)                                                       \
-    (((((x)&CONST64(0xFFFFFFFFFFFFFFFF)) >> ((uint64_t)(y)&CONST64(63))) | \
-      ((x) << (((uint64_t)64 - ((y)&63)) & 63))) &                         \
+#define ROR64c(x, y)                                                           \
+    (((((x) & CONST64(0xFFFFFFFFFFFFFFFF)) >> ((uint64_t)(y) & CONST64(63))) | \
+      ((x) << (((uint64_t)64 - ((y) & 63)) & 63))) &                           \
      CONST64(0xFFFFFFFFFFFFFFFF))
 
 #ifdef __cplusplus

src/sha256.c

@@ -9,7 +9,7 @@
 #define Ch(x, y, z) (z ^ (x & (y ^ z)))
 #define Maj(x, y, z) (((x | y) & z) | (x & y))
 #define S(x, n) RORc((x), (n))
-#define R(x, n) (((x)&0xFFFFFFFFUL) >> (n))
+#define R(x, n) (((x) & 0xFFFFFFFFUL) >> (n))
 #define Sigma0(x) (S(x, 2) ^ S(x, 13) ^ S(x, 22))
 #define Sigma1(x) (S(x, 6) ^ S(x, 11) ^ S(x, 25))
 #define Gamma0(x) (S(x, 7) ^ S(x, 18) ^ R(x, 3))

src/sha512.c

@@ -52,7 +52,7 @@ static const uint64_t K[80] = {
 #define Ch(x, y, z) (z ^ (x & (y ^ z)))
 #define Maj(x, y, z) (((x | y) & z) | (x & y))
 #define S(x, n) ROR64c(x, n)
-#define R(x, n) (((x)&CONST64(0xFFFFFFFFFFFFFFFF)) >> ((uint64_t)n))
+#define R(x, n) (((x) & CONST64(0xFFFFFFFFFFFFFFFF)) >> ((uint64_t)n))
 #define Sigma0(x) (S(x, 28) ^ S(x, 34) ^ S(x, 39))
 #define Sigma1(x) (S(x, 14) ^ S(x, 18) ^ S(x, 41))
 #define Gamma0(x) (S(x, 1) ^ S(x, 8) ^ R(x, 7))

src/tls.c

@@ -29,6 +29,10 @@
 #include "strophe.h"
 
 #include "common.h"
+#ifdef _MSC_VER
+#include <BaseTsd.h>
+typedef SSIZE_T ssize_t;
+#endif
 
 const struct conn_interface tls_intf = {
     tls_read,
@@ -74,6 +78,23 @@ xmpp_conn_t *xmpp_tlscert_get_conn(const xmpp_tlscert_t *cert)
     return cert->conn;
 }
 
+/** Get the userdata of a Strophe connection which is assigned to this
+ *  certificate.
+ *
+ *  @param cert a Strophe TLS certificate object
+ *
+ *  @return the userdata of a Strophe connection object where this certificate
+ *  originates from
+ *
+ *  @ingroup TLS
+ */
+void *xmpp_tlscert_get_userdata(const xmpp_tlscert_t *cert)
+{
+    if (cert->conn == NULL)
+        return NULL;
+    return cert->conn->userdata;
+}
+
 /** Get the complete PEM of this certificate.
  *
  *  @param cert a Strophe TLS certificate object
@@ -88,8 +109,6 @@ const char *xmpp_tlscert_get_pem(const xmpp_tlscert_t *cert)
 }
 
 /** Get the dnsName entries out of the SubjectAlternativeNames.
- *
- *  Note: Max. `MAX_NUM_DNSNAMES` are supported.
  *
  *  @param cert a Strophe TLS certificate object
  *  @param n which dnsName entry
@@ -145,9 +164,13 @@ const char *xmpp_tlscert_get_description(xmpp_cert_element_t elmnt)
         "Expires On",
         "Public Key Algorithm",
         "Certificate Signature Algorithm",
-        "Fingerprint SHA-1",
-        "Fingerprint SHA-256",
+        "Certificate Fingerprint SHA-1",
+        "Certificate Fingerprint SHA-256",
+        "Public Key Fingerprint SHA-256",
     };
+    STROPHE_STATIC_ASSERT(
+        ARRAY_SIZE(descriptions) == XMPP_CERT_ELEMENT_MAX,
+        "descriptions don't match the number of enum elements");
     if (elmnt < 0 || elmnt >= XMPP_CERT_ELEMENT_MAX)
         return NULL;
     return descriptions[elmnt];

src/tls.h

@@ -45,6 +45,7 @@ unsigned int tls_id_on_xmppaddr_num(xmpp_conn_t *conn);
 
 xmpp_tlscert_t *tls_peer_cert(xmpp_conn_t *conn);
 int tls_set_credentials(tls_t *tls, const char *cafilename);
+int tls_supports_channel_binding(tls_t *tls);
 int tls_init_channel_binding(tls_t *tls,
                              const char **binding_prefix,
                              size_t *binding_prefix_len);

src/tls_dummy.c

@@ -75,6 +75,12 @@ int tls_set_credentials(tls_t *tls, const char *cafilename)
     return -1;
 }
 
+int tls_supports_channel_binding(tls_t *tls)
+{
+    UNUSED(tls);
+    return 0;
+}
+
 int tls_init_channel_binding(tls_t *tls,
                              const char **binding_prefix,
                              size_t *binding_prefix_len)

src/tls_gnutls.c

@@ -334,6 +334,12 @@ static xmpp_tlscert_t *_x509_to_tlscert(xmpp_ctx_t *ctx, gnutls_x509_crt_t cert)
     gnutls_x509_crt_get_fingerprint(cert, GNUTLS_DIG_SHA256, smallbuf, &size);
     hex_encode(buf, smallbuf, size);
     tlscert->elements[XMPP_CERT_FINGERPRINT_SHA256] = strophe_strdup(ctx, buf);
+    size = sizeof(smallbuf);
+    gnutls_x509_crt_get_key_id(cert, GNUTLS_KEYID_USE_SHA256, (void *)smallbuf,
+                               &size);
+    hex_encode(buf, smallbuf, size);
+    tlscert->elements[XMPP_CERT_PUBKEY_FINGERPRINT_SHA256] =
+        strophe_strdup(ctx, buf);
 
     strophe_snprintf(buf, sizeof(buf), "%d", gnutls_x509_crt_get_version(cert));
     tlscert->elements[XMPP_CERT_VERSION] = strophe_strdup(ctx, buf);
@@ -422,6 +428,8 @@ static int _tls_verify(gnutls_session_t session)
             return -1;
         }
 
+        tlscert->conn = tls->conn;
+
         if (tls->conn->certfail_handler(tlscert, (char *)out.data) == 0) {
             xmpp_tlscert_free(tlscert);
             gnutls_x509_crt_deinit(cert);
@@ -569,6 +577,20 @@ int tls_set_credentials(tls_t *tls, const char *cafilename)
     return err == GNUTLS_E_SUCCESS;
 }
 
+int tls_supports_channel_binding(tls_t *tls)
+{
+    switch (gnutls_protocol_get_version(tls->session)) {
+    case GNUTLS_SSL3:
+    case GNUTLS_TLS1_0:
+    case GNUTLS_TLS1_1:
+    case GNUTLS_TLS1_2:
+    case GNUTLS_TLS1_3:
+        return 1;
+    default:
+        return 0;
+    }
+}
+
 int tls_init_channel_binding(tls_t *tls,
                              const char **binding_prefix,
                              size_t *binding_prefix_len)

src/tls_openssl.c

@@ -376,18 +376,26 @@ _get_fingerprint(const xmpp_ctx_t *ctx, X509 *err_cert, xmpp_cert_element_t el)
 {
     unsigned char buf[EVP_MAX_MD_SIZE];
     unsigned int len;
+    int (*digest_fn)(const X509 *data, const EVP_MD *type, unsigned char *md,
+                     unsigned int *len);
     const EVP_MD *digest;
     switch (el) {
     case XMPP_CERT_FINGERPRINT_SHA1:
+        digest_fn = X509_digest;
         digest = EVP_sha1();
         break;
     case XMPP_CERT_FINGERPRINT_SHA256:
+        digest_fn = X509_digest;
+        digest = EVP_sha256();
+        break;
+    case XMPP_CERT_PUBKEY_FINGERPRINT_SHA256:
+        digest_fn = X509_pubkey_digest;
         digest = EVP_sha256();
         break;
     default:
         return NULL;
     }
-    if (X509_digest(err_cert, digest, buf, &len) != 0) {
+    if (digest_fn(err_cert, digest, buf, &len) != 0) {
         char fingerprint[4 * EVP_MAX_MD_SIZE];
         hex_encode(fingerprint, buf, len);
         return strophe_strdup(ctx, fingerprint);
@@ -475,6 +483,8 @@ static xmpp_tlscert_t *_x509_to_tlscert(xmpp_ctx_t *ctx, X509 *cert)
         _get_fingerprint(ctx, cert, XMPP_CERT_FINGERPRINT_SHA1);
     tlscert->elements[XMPP_CERT_FINGERPRINT_SHA256] =
         _get_fingerprint(ctx, cert, XMPP_CERT_FINGERPRINT_SHA256);
+    tlscert->elements[XMPP_CERT_PUBKEY_FINGERPRINT_SHA256] =
+        _get_fingerprint(ctx, cert, XMPP_CERT_PUBKEY_FINGERPRINT_SHA256);
 
     strophe_snprintf(buf, sizeof(buf), "%ld", X509_get_version(cert) + 1);
     tlscert->elements[XMPP_CERT_VERSION] = strophe_strdup(ctx, buf);
@@ -540,6 +550,8 @@ static int _tls_verify(int preverify_ok, X509_STORE_CTX *x509_ctx)
     if (!tlscert)
         return 0;
 
+    tlscert->conn = conn;
+
     strophe_debug(conn->ctx, "tls", "preverify_ok:%d\nSubject: %s\nIssuer: %s",
                   preverify_ok, tlscert->elements[XMPP_CERT_SUBJECT],
                   tlscert->elements[XMPP_CERT_ISSUER]);
@@ -781,6 +793,22 @@ int tls_set_credentials(tls_t *tls, const char *cafilename)
     return -1;
 }
 
+int tls_supports_channel_binding(tls_t *tls)
+{
+    switch (SSL_version(tls->ssl)) {
+    case SSL3_VERSION:
+    case TLS1_VERSION:
+    case TLS1_1_VERSION:
+    case TLS1_2_VERSION:
+#ifdef TLS1_3_VERSION
+    case TLS1_3_VERSION:
+#endif
+        return 1;
+    default:
+        return 0;
+    }
+}
+
 int tls_init_channel_binding(tls_t *tls,
                              const char **binding_prefix,
                              size_t *binding_prefix_len)

src/tls_schannel.c

@@ -237,6 +237,12 @@ int tls_set_credentials(tls_t *tls, const char *cafilename)
     return -1;
 }
 
+int tls_supports_channel_binding(tls_t *tls)
+{
+    UNUSED(tls);
+    return 0;
+}
+
 int tls_init_channel_binding(tls_t *tls,
                              const char **binding_prefix,
                              size_t *binding_prefix_len)
@@ -266,7 +272,7 @@ int tls_start(tls_t *tls)
 
     /* use the domain there as our name */
     name = tls->conn->domain;
-    intf = tls->conn->intf;
+    intf = &tls->conn->intf;
 
     ctxtreq = ISC_REQ_SEQUENCE_DETECT | ISC_REQ_REPLAY_DETECT |
               ISC_REQ_CONFIDENTIALITY | ISC_RET_EXTENDED_ERROR |
@@ -479,7 +485,7 @@ int tls_read(struct conn_interface *intf, void *buff, size_t len)
             int read;
             tls->readybufferpos += bytes;
             newbuff += bytes;
-            read = tls_read(tls, newbuff, len - bytes);
+            read = tls_read(intf, newbuff, len - bytes);
 
             if (read == -1) {
                 if (tls_is_recoverable(intf, tls->lasterror)) {
@@ -553,7 +559,7 @@ int tls_read(struct conn_interface *intf, void *buff, size_t len)
                 tls->recvbufferpos = 0;
             }
 
-            return tls_read(tls, buff, len);
+            return tls_read(intf, buff, len);
         } else if (ret == SEC_E_INCOMPLETE_MESSAGE) {
             tls->lasterror = SEC_E_INCOMPLETE_MESSAGE;
             return -1;
@@ -611,7 +617,7 @@ int tls_write(struct conn_interface *intf, const void *buff, size_t len)
     int sent = 0, ret, remain = len;
     tls_t *tls = intf->conn->tls;
 
-    ret = tls_clear_pending_write(tls);
+    ret = tls_clear_pending_write(intf);
     if (ret <= 0) {
         return ret;
     }
@@ -667,9 +673,9 @@ int tls_write(struct conn_interface *intf, const void *buff, size_t len)
 
         tls->sendbufferpos = 0;
 
-        ret = tls_clear_pending_write(tls);
+        ret = tls_clear_pending_write(intf);
 
-        if (ret == -1 && !tls_is_recoverable(intf, tls_error(tls))) {
+        if (ret == -1 && !tls_is_recoverable(intf, tls_error(intf))) {
             return -1;
         }
 
@@ -682,7 +688,7 @@ int tls_write(struct conn_interface *intf, const void *buff, size_t len)
         }
 
         if (ret == 0 ||
-            (ret == -1 && tls_is_recoverable(intf, tls_error(tls)))) {
+            (ret == -1 && tls_is_recoverable(intf, tls_error(intf)))) {
             return sent;
         }
     }

strophe.h

@@ -188,6 +188,7 @@ typedef struct _xmpp_sm_t xmpp_sm_state_t;
 #define XMPP_CONN_FLAG_DISABLE_TLS (1UL << 0)
 #define XMPP_CONN_FLAG_MANDATORY_TLS (1UL << 1)
 #define XMPP_CONN_FLAG_LEGACY_SSL (1UL << 2)
+#define XMPP_CONN_FLAG_DIRECT_TLS XMPP_CONN_FLAG_LEGACY_SSL
 /** @def XMPP_CONN_FLAG_TRUST_TLS
  *  Trust server's certificate even if it is invalid.
  */
@@ -250,17 +251,18 @@ typedef enum {
  *  @ingroup TLS
  */
 typedef enum {
-    XMPP_CERT_VERSION,            /**< X.509 Version */
-    XMPP_CERT_SERIALNUMBER,       /**< SerialNumber */
-    XMPP_CERT_SUBJECT,            /**< Subject */
-    XMPP_CERT_ISSUER,             /**< Issuer */
-    XMPP_CERT_NOTBEFORE,          /**< Issued on */
-    XMPP_CERT_NOTAFTER,           /**< Expires on */
-    XMPP_CERT_KEYALG,             /**< Public Key Algorithm */
-    XMPP_CERT_SIGALG,             /**< Certificate Signature Algorithm */
-    XMPP_CERT_FINGERPRINT_SHA1,   /**< Fingerprint SHA-1 */
-    XMPP_CERT_FINGERPRINT_SHA256, /**< Fingerprint SHA-256 */
-    XMPP_CERT_ELEMENT_MAX         /**< Last element of the enum */
+    XMPP_CERT_VERSION,                   /**< X.509 Version */
+    XMPP_CERT_SERIALNUMBER,              /**< SerialNumber */
+    XMPP_CERT_SUBJECT,                   /**< Subject */
+    XMPP_CERT_ISSUER,                    /**< Issuer */
+    XMPP_CERT_NOTBEFORE,                 /**< Issued on */
+    XMPP_CERT_NOTAFTER,                  /**< Expires on */
+    XMPP_CERT_KEYALG,                    /**< Public Key Algorithm */
+    XMPP_CERT_SIGALG,                    /**< Certificate Signature Algorithm */
+    XMPP_CERT_FINGERPRINT_SHA1,          /**< Fingerprint SHA-1 */
+    XMPP_CERT_FINGERPRINT_SHA256,        /**< Fingerprint SHA-256 */
+    XMPP_CERT_PUBKEY_FINGERPRINT_SHA256, /**< SHA-256 fingerprint of pubkey */
+    XMPP_CERT_ELEMENT_MAX                /**< Last element of the enum */
 } xmpp_cert_element_t;
 
 typedef struct {
@@ -642,6 +644,7 @@ void xmpp_ctx_set_timeout(xmpp_ctx_t *ctx, unsigned long timeout);
 
 xmpp_ctx_t *xmpp_tlscert_get_ctx(const xmpp_tlscert_t *cert);
 xmpp_conn_t *xmpp_tlscert_get_conn(const xmpp_tlscert_t *cert);
+void *xmpp_tlscert_get_userdata(const xmpp_tlscert_t *cert);
 const char *xmpp_tlscert_get_pem(const xmpp_tlscert_t *cert);
 const char *xmpp_tlscert_get_dnsname(const xmpp_tlscert_t *cert, size_t n);
 const char *xmpp_tlscert_get_string(const xmpp_tlscert_t *cert,

tests/test_stanza.c

@@ -177,13 +177,9 @@ static void test_stanza_error(xmpp_ctx_t *ctx)
     mood = xmpp_stanza_new_from_string(ctx, str_mood);
     assert(mood != NULL);
 
-    assert(xmpp_stanza_get_to(error) != NULL);
     COMPARE("romeo@montague.lit/home", xmpp_stanza_get_to(error));
-    assert(xmpp_stanza_get_from(error) != NULL);
     COMPARE("juliet@capulet.lit/chamber", xmpp_stanza_get_from(error));
-    assert(xmpp_stanza_get_id(error) != NULL);
     COMPARE("e2e1", xmpp_stanza_get_id(error));
-    assert(xmpp_stanza_get_type(error) != NULL);
     COMPARE("error", xmpp_stanza_get_type(error));
 
     /* FAIL - no list given */
@@ -212,7 +208,6 @@ static void test_stanza_error(xmpp_ctx_t *ctx)
                                          "item", "mood", NULL);
     assert(item != NULL);
     assert(xmpp_stanza_get_children(item) != NULL);
-    assert(xmpp_stanza_get_name(xmpp_stanza_get_children(item)) != NULL);
     COMPARE("annoyed", xmpp_stanza_get_name(xmpp_stanza_get_children(item)));
 
     item = xmpp_stanza_get_child_by_path(
@@ -223,7 +218,6 @@ static void test_stanza_error(xmpp_ctx_t *ctx)
         NULL);
     assert(item != NULL);
     assert(xmpp_stanza_get_children(item) != NULL);
-    assert(xmpp_stanza_get_name(xmpp_stanza_get_children(item)) != NULL);
     COMPARE("annoyed", xmpp_stanza_get_name(xmpp_stanza_get_children(item)));
 
     ret = xmpp_stanza_get_attributes(error, attr, attrlen);
@@ -243,6 +237,50 @@ static void test_stanza_error(xmpp_ctx_t *ctx)
     xmpp_stanza_release(error);
 }
 
+static void test_stanza_bookmark(xmpp_ctx_t *ctx)
+{
+    // clang-format off
+   static const char *str =
+         "<item xmlns=\"http://jabber.org/protocol/pubsub\" id=\"\">"
+            "<conference autojoin=\"\" name=\"Symbol(lit-nothing)\" xmlns=\"urn:xmpp:bookmarks:1\" />"
+         "</item>";
+    // clang-format on
+
+    xmpp_stanza_t *stanza = xmpp_stanza_new_from_string(ctx, str);
+    assert(stanza != NULL);
+    const char *id = xmpp_stanza_get_id(stanza);
+    assert(id != NULL);
+    assert(strcmp(id, "") == 0);
+    xmpp_stanza_t *child = xmpp_stanza_get_children(stanza);
+    COMPARE("conference", xmpp_stanza_get_name(child));
+    const char *autojoin = xmpp_stanza_get_attribute(child, "autojoin");
+    assert(autojoin != NULL);
+    assert(strcmp(autojoin, "") == 0);
+    xmpp_stanza_release(stanza);
+}
+
+static void test_stanza_copy(xmpp_ctx_t *ctx)
+{
+    // clang-format off
+   static const char *str =
+         "<item xmlns=\"http://jabber.org/protocol/pubsub\" id=\"\">"
+            "<conference autojoin=\"\" name=\"Symbol(lit-nothing)\" xmlns=\"urn:xmpp:bookmarks:1\" />"
+         "</item>";
+    // clang-format on
+
+    xmpp_stanza_t *stanza = xmpp_stanza_new_from_string(ctx, str);
+    assert(stanza != NULL);
+    const char *id = xmpp_stanza_get_id(stanza);
+    assert(id != NULL);
+    assert(strcmp(id, "") == 0);
+    xmpp_stanza_t *child = xmpp_stanza_get_children(stanza);
+    COMPARE("conference", xmpp_stanza_get_name(child));
+    xmpp_stanza_t *copy = xmpp_stanza_copy(child);
+    xmpp_stanza_release(stanza);
+    COMPARE("conference", xmpp_stanza_get_name(copy));
+    xmpp_stanza_release(copy);
+}
+
 int main()
 {
     xmpp_ctx_t *ctx;
@@ -251,6 +289,8 @@ int main()
     ctx = xmpp_ctx_new(&stanza_mem, NULL);
     assert(ctx != NULL);
 
+    test_stanza_bookmark(ctx);
+    test_stanza_copy(ctx);
     test_stanza_add_child(ctx);
     test_stanza_from_string(ctx);
     test_stanza_error(ctx);