*/
#include "inspircd.h"
-
#include <gnutls/gnutls.h>
#include <gnutls/x509.h>
-
-#include "inspircd_config.h"
-#include "configreader.h"
-#include "users.h"
-#include "channels.h"
-#include "modules.h"
-#include "socket.h"
-#include "hashcomp.h"
#include "transport.h"
#include "m_cap.h"
class issl_session : public classbase
{
public:
+ issl_session()
+ {
+ sess = NULL;
+ }
+
gnutls_session_t sess;
issl_status status;
std::string outbuf;
CmdResult Handle (const std::vector<std::string> ¶meters, User *user)
{
- user->io = Caller;
- Caller->OnRawSocketAccept(user->GetFd(), user->GetIPString(), user->GetPort());
+ if (user->registered == REG_ALL)
+ {
+ ServerInstance->Users->QuitUser(user, "STARTTLS not allowed after client registration");
+ }
+ else
+ {
+ if (!user->GetIOHook())
+ {
+ user->WriteNumeric(670, "%s :STARTTLS successful, go ahead with TLS handshake", user->nick.c_str());
+ user->AddIOHook(Caller);
+ Caller->OnRawSocketAccept(user->GetFd(), user->GetIPString(), user->GetPort());
+ }
+ else
+ user->WriteNumeric(671, "%s :STARTTLS failure", user->nick.c_str());
+ }
return CMD_FAILURE;
}
int dh_bits;
int clientactive;
+ bool cred_alloc;
CommandStartTLS* starttls;
gnutls_global_init(); // This must be called once in the program
- if(gnutls_certificate_allocate_credentials(&x509_cred) != 0)
- ServerInstance->Logs->Log("m_ssl_gnutls",DEFAULT, "m_ssl_gnutls.so: Failed to allocate certificate credentials");
-
- // Guessing return meaning
- if(gnutls_dh_params_init(&dh_params) < 0)
- ServerInstance->Logs->Log("m_ssl_gnutls",DEFAULT, "m_ssl_gnutls.so: Failed to initialise DH parameters");
-
+ cred_alloc = false;
// Needs the flag as it ignores a plain /rehash
OnRehash(NULL,"ssl");
keyfile = confdir + keyfile;
int ret;
-
+
+ if (cred_alloc)
+ {
+ // Deallocate the old credentials
+ gnutls_dh_params_deinit(dh_params);
+ gnutls_certificate_free_credentials(x509_cred);
+ }
+ else
+ cred_alloc = true;
+
+ if((ret = gnutls_certificate_allocate_credentials(&x509_cred)) < 0)
+ ServerInstance->Logs->Log("m_ssl_gnutls",DEFAULT, "m_ssl_gnutls.so: Failed to allocate certificate credentials: %s", gnutls_strerror(ret));
+
+ if((ret = gnutls_dh_params_init(&dh_params)) < 0)
+ ServerInstance->Logs->Log("m_ssl_gnutls",DEFAULT, "m_ssl_gnutls.so: Failed to initialise DH parameters: %s", gnutls_strerror(ret));
+
if((ret =gnutls_certificate_set_x509_trust_file(x509_cred, cafile.c_str(), GNUTLS_X509_FMT_PEM)) < 0)
ServerInstance->Logs->Log("m_ssl_gnutls",DEFAULT, "m_ssl_gnutls.so: Failed to set X.509 trust file '%s': %s", cafile.c_str(), gnutls_strerror(ret));
{
User* user = (User*)item;
- if(user->io)
+ if (user->GetIOHook() == this)
{
// User is using SSL, they're a local user, and they're using one of *our* SSL ports.
// Potentially there could be multiple SSL modules loaded at once on different ports.
ServerInstance->Users->QuitUser(user, "SSL module unloading");
+ user->DelIOHook();
}
if (user->GetExt("ssl_cert", dummy))
{
delete tofree;
user->Shrink("ssl_cert");
}
-
- user->io = NULL;
}
}
virtual Version GetVersion()
{
- return Version(1, 2, 0, 0, VF_VENDOR, API_VERSION);
+ return Version("$Id$", VF_VENDOR, API_VERSION);
}
virtual void OnHookUserIO(User* user, const std::string &targetip)
{
- if (!user->io && isin(targetip,user->GetPort(),listenports))
+ if (!user->GetIOHook() && isin(targetip,user->GetPort(),listenports))
{
/* Hook the user with our module */
- user->io = this;
+ user->AddIOHook(this);
}
}
const char* ret = "OK";
try
{
- ret = ServerInstance->Config->AddIOHook((Module*)this, (BufferedSocket*)ISR->Sock) ? "OK" : NULL;
+ ret = ISR->Sock->AddIOHook((Module*)this) ? "OK" : NULL;
}
catch (ModuleException &e)
{
}
else if (strcmp("IS_UNHOOK", request->GetId()) == 0)
{
- return ServerInstance->Config->DelIOHook((BufferedSocket*)ISR->Sock) ? "OK" : NULL;
+ return ISR->Sock->DelIOHook() ? "OK" : NULL;
}
else if (strcmp("IS_HSDONE", request->GetId()) == 0)
{
issl_session* session = &sessions[fd];
+ /* For STARTTLS: Don't try and init a session on a socket that already has a session */
+ if (session->sess)
+ return;
+
session->fd = fd;
session->inbuf = new char[inbufsize];
session->inbufoffset = 0;
{
memcpy(buffer, session->inbuf, count);
// Move the stuff left in inbuf to the beginning of it
- memcpy(session->inbuf, session->inbuf + count, (length - count));
+ memmove(session->inbuf, session->inbuf + count, (length - count));
// Now we need to set session->inbufoffset to the amount of data still waiting to be handed to insp.
session->inbufoffset = length - count;
// Insp uses readresult as the count of how much data there is in buffer, so:
return;
// Bugfix, only send this numeric for *our* SSL users
- if (dest->GetExt("ssl", dummy) || ((IS_LOCAL(dest) && (dest->io == this))))
+ if (dest->GetExt("ssl", dummy) || ((IS_LOCAL(dest) && (dest->GetIOHook() == this))))
{
- ServerInstance->SendWhoisLine(source, dest, 320, "%s %s :is using a secure connection", source->nick, dest->nick);
+ ServerInstance->SendWhoisLine(source, dest, 320, "%s %s :is using a secure connection", source->nick.c_str(), dest->nick.c_str());
}
}
std::string cipher = gnutls_kx_get_name(gnutls_kx_get(sessions[user->GetFd()].sess));
cipher.append("-").append(gnutls_cipher_get_name(gnutls_cipher_get(sessions[user->GetFd()].sess))).append("-");
cipher.append(gnutls_mac_get_name(gnutls_mac_get(sessions[user->GetFd()].sess)));
- user->WriteServ("NOTICE %s :*** You are connected using SSL cipher \"%s\"", user->nick, cipher.c_str());
+ user->WriteServ("NOTICE %s :*** You are connected using SSL cipher \"%s\"", user->nick.c_str(), cipher.c_str());
}
}
}
GenericCapHandler(ev, "tls", "tls");
}
- void Prioritize()
+ void Prioritize()
{
Module* server = ServerInstance->Modules->Find("m_spanningtree.so");
ServerInstance->Modules->SetPriority(this, I_OnPostConnect, PRIO_AFTER, &server);
projects / user / henk / code / inspircd.git / blobdiff