*/
#include "inspircd.h"
-
#include <gnutls/gnutls.h>
#include <gnutls/x509.h>
-
-#include "inspircd_config.h"
-#include "configreader.h"
-#include "users.h"
-#include "channels.h"
-#include "modules.h"
-#include "socket.h"
-#include "hashcomp.h"
#include "transport.h"
#include "m_cap.h"
class issl_session : public classbase
{
public:
+ issl_session()
+ {
+ sess = NULL;
+ }
+
gnutls_session_t sess;
issl_status status;
std::string outbuf;
CmdResult Handle (const std::vector<std::string> ¶meters, User *user)
{
- if (user->registered == REG_ALL)
+ /* changed from == REG_ALL to catch clients sending STARTTLS
+ * after NICK and USER but before OnUserConnect completes and
+ * give a proper error message (see bug #645) - dz
+ */
+ if (user->registered != REG_NONE)
{
- ServerInstance->Users->QuitUser(user, "STARTTLS not allowed after client registration");
+ ServerInstance->Users->QuitUser(user, "STARTTLS is not permitted after client registration has started");
}
else
{
- if (!user->io)
+ if (!user->GetIOHook())
{
user->WriteNumeric(670, "%s :STARTTLS successful, go ahead with TLS handshake", user->nick.c_str());
- user->io = Caller;
+ user->AddIOHook(Caller);
Caller->OnRawSocketAccept(user->GetFd(), user->GetIPString(), user->GetPort());
}
else
- user->WriteNumeric(671, "%s :STARTTLS failure", user->nick.c_str());
+ user->WriteNumeric(691, "%s :STARTTLS failure", user->nick.c_str());
}
return CMD_FAILURE;
if((ret = gnutls_certificate_set_x509_key_file (x509_cred, certfile.c_str(), keyfile.c_str(), GNUTLS_X509_FMT_PEM)) < 0)
{
// If this fails, no SSL port will work. At all. So, do the smart thing - throw a ModuleException
- throw ModuleException("Unable to load GnuTLS server certificate: " + std::string(gnutls_strerror(ret)));
+ throw ModuleException("Unable to load GnuTLS server certificate (" + std::string(certfile) + ", key: " + keyfile + "): " + std::string(gnutls_strerror(ret)));
}
// This may be on a large (once a day or week) timer eventually.
{
User* user = (User*)item;
- if (user->io == this)
+ if (user->GetIOHook() == this)
{
// User is using SSL, they're a local user, and they're using one of *our* SSL ports.
// Potentially there could be multiple SSL modules loaded at once on different ports.
ServerInstance->Users->QuitUser(user, "SSL module unloading");
- user->io = NULL;
+ user->DelIOHook();
}
if (user->GetExt("ssl_cert", dummy))
{
virtual void OnHookUserIO(User* user, const std::string &targetip)
{
- if (!user->io && isin(targetip,user->GetPort(),listenports))
+ if (!user->GetIOHook() && isin(targetip,user->GetPort(),listenports))
{
/* Hook the user with our module */
- user->io = this;
+ user->AddIOHook(this);
}
}
const char* ret = "OK";
try
{
- ret = ServerInstance->Config->AddIOHook((Module*)this, (BufferedSocket*)ISR->Sock) ? "OK" : NULL;
+ ret = ISR->Sock->AddIOHook((Module*)this) ? "OK" : NULL;
}
catch (ModuleException &e)
{
}
else if (strcmp("IS_UNHOOK", request->GetId()) == 0)
{
- return ServerInstance->Config->DelIOHook((BufferedSocket*)ISR->Sock) ? "OK" : NULL;
+ return ISR->Sock->DelIOHook() ? "OK" : NULL;
}
else if (strcmp("IS_HSDONE", request->GetId()) == 0)
{
}
else
{
+ ServerInstance->Logs->Log("m_ssl_gnutls", DEFAULT,
+ "m_ssl_gnutls.so: Error while reading on fd %d: %s",
+ session->fd, gnutls_strerror(ret));
readresult = 0;
CloseSession(session);
}
{
if(ret != GNUTLS_E_AGAIN && ret != GNUTLS_E_INTERRUPTED)
{
+ ServerInstance->Logs->Log("m_ssl_gnutls", DEFAULT,
+ "m_ssl_gnutls.so: Error while writing to fd %d: %s",
+ session->fd, gnutls_strerror(ret));
CloseSession(session);
}
else
return;
// Bugfix, only send this numeric for *our* SSL users
- if (dest->GetExt("ssl", dummy) || ((IS_LOCAL(dest) && (dest->io == this))))
+ if (dest->GetExt("ssl", dummy) || ((IS_LOCAL(dest) && (dest->GetIOHook() == this))))
{
ServerInstance->SendWhoisLine(source, dest, 320, "%s %s :is using a secure connection", source->nick.c_str(), dest->nick.c_str());
}
else
{
// Handshake failed.
+ ServerInstance->Logs->Log("m_ssl_gnutls", DEFAULT,
+ "m_ssl_gnutls.so: Handshake failed on fd %d: %s",
+ session->fd, gnutls_strerror(ret));
CloseSession(session);
session->status = ISSL_CLOSING;
}
/* Beware here we do not check for errors.
*/
- if ((gnutls_x509_crt_get_expiration_time(cert) < time(0)) || (gnutls_x509_crt_get_activation_time(cert) > time(0)))
+ if ((gnutls_x509_crt_get_expiration_time(cert) < ServerInstance->Time()) || (gnutls_x509_crt_get_activation_time(cert) > ServerInstance->Time()))
{
certinfo->data.insert(std::make_pair("error","Not activated, or expired certificate"));
}
void OnEvent(Event* ev)
{
GenericCapHandler(ev, "tls", "tls");
- if (ev->GetEventID() == "cap_req")
- {
- /* GenericCapHandler() Extends("tls") a user if it does
- * CAP REQ tls. Check if this was done.
- */
- CapData *data = (CapData *) ev->GetData();
- if (data->user->Shrink("tls"))
- {
- /* Not in our spec?!?! */
- data->user->io = this;
- OnRawSocketAccept(data->user->GetFd(), data->user->GetIPString(),
- data->user->GetPort());
- }
- }
}
void Prioritize()