Fix typo opermoth -> opermotd. Thanks Ankit.

[user/henk/code/inspircd.git] / src / modules / extra / m_ssl_gnutls.cpp

diff --git a/src/modules/extra/m_ssl_gnutls.cpp b/src/modules/extra/m_ssl_gnutls.cpp
index 63d3d1a2d808e4e425d920de4823e2d2a2722e58..59397e000613b49860d68ff41619eb3d225b1bba 100644 (file)
--- a/src/modules/extra/m_ssl_gnutls.cpp
+++ b/src/modules/extra/m_ssl_gnutls.cpp
@@ -12,17 +12,8 @@
  */
 
 #include "inspircd.h"
-
 #include <gnutls/gnutls.h>
 #include <gnutls/x509.h>
-
-#include "inspircd_config.h"
-#include "configreader.h"
-#include "users.h"
-#include "channels.h"
-#include "modules.h"
-#include "socket.h"
-#include "hashcomp.h"
 #include "transport.h"
 #include "m_cap.h"
 
@@ -55,6 +46,11 @@ bool isin(const std::string &host, int port, const std::vector<std::string> &por
 class issl_session : public classbase
 {
 public:
+       issl_session()
+       {
+               sess = NULL;
+       }
+
        gnutls_session_t sess;
        issl_status status;
        std::string outbuf;
@@ -75,20 +71,24 @@ class CommandStartTLS : public Command
 
        CmdResult Handle (const std::vector<std::string> &parameters, User *user)
        {
-               if (user->registered == REG_ALL)
+               /* changed from == REG_ALL to catch clients sending STARTTLS
+                * after NICK and USER but before OnUserConnect completes and
+                * give a proper error message (see bug #645) - dz
+                */
+               if (user->registered != REG_NONE)
                {
-                       ServerInstance->Users->QuitUser(user, "STARTTLS not allowed after client registration");
+                       ServerInstance->Users->QuitUser(user, "STARTTLS is not permitted after client registration has started");
                }
                else
                {
-                       if (!user->io)
+                       if (!user->GetIOHook())
                        {
                                user->WriteNumeric(670, "%s :STARTTLS successful, go ahead with TLS handshake", user->nick.c_str());
-                               user->io = Caller;
+                               user->AddIOHook(Caller);
                                Caller->OnRawSocketAccept(user->GetFd(), user->GetIPString(), user->GetPort());
                        }
                        else
-                               user->WriteNumeric(671, "%s :STARTTLS failure", user->nick.c_str());
+                               user->WriteNumeric(691, "%s :STARTTLS failure", user->nick.c_str());
                }
 
                return CMD_FAILURE;
@@ -266,7 +266,7 @@ class ModuleSSLGnuTLS : public Module
                if((ret = gnutls_certificate_set_x509_key_file (x509_cred, certfile.c_str(), keyfile.c_str(), GNUTLS_X509_FMT_PEM)) < 0)
                {
                        // If this fails, no SSL port will work. At all. So, do the smart thing - throw a ModuleException
-                       throw ModuleException("Unable to load GnuTLS server certificate: " + std::string(gnutls_strerror(ret)));
+                       throw ModuleException("Unable to load GnuTLS server certificate (" + std::string(certfile) + ", key: " + keyfile + "): " + std::string(gnutls_strerror(ret)));
                }
 
                // This may be on a large (once a day or week) timer eventually.
@@ -303,12 +303,12 @@ class ModuleSSLGnuTLS : public Module
                {
                        User* user = (User*)item;
 
-                       if (user->io == this)
+                       if (user->GetIOHook() == this)
                        {
                                // User is using SSL, they're a local user, and they're using one of *our* SSL ports.
                                // Potentially there could be multiple SSL modules loaded at once on different ports.
                                ServerInstance->Users->QuitUser(user, "SSL module unloading");
-                               user->io = NULL;
+                               user->DelIOHook();
                        }
                        if (user->GetExt("ssl_cert", dummy))
                        {
@@ -346,10 +346,10 @@ class ModuleSSLGnuTLS : public Module
 
        virtual void OnHookUserIO(User* user, const std::string &targetip)
        {
-               if (!user->io && isin(targetip,user->GetPort(),listenports))
+               if (!user->GetIOHook() && isin(targetip,user->GetPort(),listenports))
                {
                        /* Hook the user with our module */
-                       user->io = this;
+                       user->AddIOHook(this);
                }
        }
 
@@ -365,7 +365,7 @@ class ModuleSSLGnuTLS : public Module
                        const char* ret = "OK";
                        try
                        {
-                               ret = ServerInstance->Config->AddIOHook((Module*)this, (BufferedSocket*)ISR->Sock) ? "OK" : NULL;
+                               ret = ISR->Sock->AddIOHook((Module*)this) ? "OK" : NULL;
                        }
                        catch (ModuleException &e)
                        {
@@ -375,7 +375,7 @@ class ModuleSSLGnuTLS : public Module
                }
                else if (strcmp("IS_UNHOOK", request->GetId()) == 0)
                {
-                       return ServerInstance->Config->DelIOHook((BufferedSocket*)ISR->Sock) ? "OK" : NULL;
+                       return ISR->Sock->DelIOHook() ? "OK" : NULL;
                }
                else if (strcmp("IS_HSDONE", request->GetId()) == 0)
                {
@@ -538,6 +538,9 @@ class ModuleSSLGnuTLS : public Module
                                }
                                else
                                {
+                                       ServerInstance->Logs->Log("m_ssl_gnutls", DEFAULT,
+                                                       "m_ssl_gnutls.so: Error while reading on fd %d: %s",
+                                                       session->fd, gnutls_strerror(ret));
                                        readresult = 0;
                                        CloseSession(session);
                                }
@@ -618,6 +621,9 @@ class ModuleSSLGnuTLS : public Module
                        {
                                if(ret != GNUTLS_E_AGAIN && ret != GNUTLS_E_INTERRUPTED)
                                {
+                                       ServerInstance->Logs->Log("m_ssl_gnutls", DEFAULT,
+                                                       "m_ssl_gnutls.so: Error while writing to fd %d: %s",
+                                                       session->fd, gnutls_strerror(ret));
                                        CloseSession(session);
                                }
                                else
@@ -646,7 +652,7 @@ class ModuleSSLGnuTLS : public Module
                        return;
 
                // Bugfix, only send this numeric for *our* SSL users
-               if (dest->GetExt("ssl", dummy) || ((IS_LOCAL(dest) && (dest->io == this))))
+               if (dest->GetExt("ssl", dummy) || ((IS_LOCAL(dest) && (dest->GetIOHook() == this))))
                {
                        ServerInstance->SendWhoisLine(source, dest, 320, "%s %s :is using a secure connection", source->nick.c_str(), dest->nick.c_str());
                }
@@ -706,6 +712,9 @@ class ModuleSSLGnuTLS : public Module
                        else
                        {
                                // Handshake failed.
+                               ServerInstance->Logs->Log("m_ssl_gnutls", DEFAULT,
+                                               "m_ssl_gnutls.so: Handshake failed on fd %d: %s",
+                                               session->fd, gnutls_strerror(ret));
                                CloseSession(session);
                                session->status = ISSL_CLOSING;
                        }
@@ -907,7 +916,7 @@ class ModuleSSLGnuTLS : public Module
 
                /* Beware here we do not check for errors.
                 */
-               if ((gnutls_x509_crt_get_expiration_time(cert) < time(0)) || (gnutls_x509_crt_get_activation_time(cert) > time(0)))
+               if ((gnutls_x509_crt_get_expiration_time(cert) < ServerInstance->Time()) || (gnutls_x509_crt_get_activation_time(cert) > ServerInstance->Time()))
                {
                        certinfo->data.insert(std::make_pair("error","Not activated, or expired certificate"));
                }
@@ -920,19 +929,6 @@ class ModuleSSLGnuTLS : public Module
        void OnEvent(Event* ev)
        {
                GenericCapHandler(ev, "tls", "tls");
-               if (ev->GetEventID() == "cap_req")
-               {
-                       /* GenericCapHandler() Extends("tls") a user if it does
-                        * CAP REQ tls. Check if this was done.
-                        */
-                       CapData *data = (CapData *) ev->GetData();
-                       if (data->user->Shrink("tls"))
-                       {
-                               data->user->io = this;
-                               OnRawSocketAccept(data->user->GetFd(), data->user->GetIPString(),
-                                               data->user->GetPort());
-                       }
-               }
        }
 
        void Prioritize()