/*
* InspIRCd -- Internet Relay Chat Daemon
*
+ * Copyright (C) 2020 Matt Schatz <genius3000@g3k.solutions>
+ * Copyright (C) 2019 linuxdaemon <linuxdaemon.irc@gmail.com>
+ * Copyright (C) 2013-2014, 2016-2021 Sadie Powell <sadie@witchery.services>
+ * Copyright (C) 2013 Daniel Vassdal <shutter@canternet.org>
+ * Copyright (C) 2012-2017 Attila Molnar <attilamolnar@hush.com>
+ * Copyright (C) 2012-2013, 2016 Adam <Adam@anope.org>
+ * Copyright (C) 2012 Robby <robby@chatbelgie.be>
+ * Copyright (C) 2012 ChrisTX <xpipe@hotmail.de>
* Copyright (C) 2009-2010 Daniel De Graaf <danieldg@inspircd.org>
- * Copyright (C) 2008 John Brooks <john.brooks@dereferenced.net>
- * Copyright (C) 2006-2008 Craig Edwards <craigedwards@brainbox.cc>
+ * Copyright (C) 2009 Uli Schlachter <psychon@inspircd.org>
+ * Copyright (C) 2008 Robin Burchell <robin+git@viroteck.net>
+ * Copyright (C) 2008 John Brooks <special@inspircd.org>
+ * Copyright (C) 2007-2008, 2010 Craig Edwards <brain@inspircd.org>
* Copyright (C) 2007 Dennis Friis <peavey@inspircd.org>
- * Copyright (C) 2006 Oliver Lupton <oliverlupton@gmail.com>
+ * Copyright (C) 2006 Oliver Lupton <om@inspircd.org>
*
* This file is part of InspIRCd. InspIRCd is free software: you can
* redistribute it and/or modify it under the terms of the GNU General Public
/// $LinkerFlags: find_linker_flags("gnutls" "-lgnutls")
/// $LinkerFlags: require_version("gnutls" "1.0" "2.12") execute("libgcrypt-config --libs" "LIBGCRYPT_LDFLAGS")
+/// $PackageInfo: require_system("arch") gnutls pkgconf
/// $PackageInfo: require_system("centos") gnutls-devel pkgconfig
/// $PackageInfo: require_system("darwin") gnutls pkg-config
-/// $PackageInfo: require_system("debian" "1.0" "7.99") libgcrypt11-dev
/// $PackageInfo: require_system("debian") gnutls-bin libgnutls28-dev pkg-config
-/// $PackageInfo: require_system("ubuntu" "1.0" "13.10") libgcrypt11-dev
/// $PackageInfo: require_system("ubuntu") gnutls-bin libgnutls-dev pkg-config
#include "inspircd.h"
#include "modules/ssl.h"
#include <memory>
+#ifdef __GNUC__
+# pragma GCC diagnostic push
+#endif
+
// Fix warnings about the use of commas at end of enumerator lists on C++03.
#if defined __clang__
# pragma clang diagnostic ignored "-Wc++11-extensions"
# endif
#endif
-// Fix warnings about using std::auto_ptr on C++11 or newer.
-#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
-
#include <gnutls/gnutls.h>
#include <gnutls/x509.h>
+#ifdef __GNUC__
+# pragma GCC diagnostic pop
+#endif
+
+// Fix warnings about using std::auto_ptr on C++11 or newer.
+#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
+
#ifndef GNUTLS_VERSION_NUMBER
#define GNUTLS_VERSION_NUMBER LIBGNUTLS_VERSION_NUMBER
#define GNUTLS_VERSION LIBGNUTLS_VERSION
hash = GNUTLS_DIG_MD5;
else if (stdalgo::string::equalsci(hashname, "sha1"))
hash = GNUTLS_DIG_SHA1;
-#ifdef INSPIRCD_GNUTLS_ENABLE_SHA256_FINGERPRINT
else if (stdalgo::string::equalsci(hashname, "sha256"))
hash = GNUTLS_DIG_SHA256;
-#endif
else
throw Exception("Unknown hash type " + hashname);
#endif
Config(const std::string& profilename, ConfigTag* tag)
: name(profilename)
- , certstr(ReadFile(tag->getString("certfile", "cert.pem")))
- , keystr(ReadFile(tag->getString("keyfile", "key.pem")))
- , dh(DHParams::Import(ReadFile(tag->getString("dhfile", "dhparams.pem"))))
+ , certstr(ReadFile(tag->getString("certfile", "cert.pem", 1)))
+ , keystr(ReadFile(tag->getString("keyfile", "key.pem", 1)))
+ , dh(DHParams::Import(ReadFile(tag->getString("dhfile", "dhparams.pem", 1))))
, priostr(GetPrioStr(profilename, tag))
, mindh(tag->getUInt("mindhbits", 1024))
- , hashstr(tag->getString("hash", "md5"))
+ , hashstr(tag->getString("hash", "md5", 1))
, requestclientcert(tag->getBool("requestclientcert", true))
{
// Load trusted CA and revocation list, if set
}
CloseSession();
- sock->SetError("No SSL session");
+ sock->SetError("No TLS (SSL) session");
return -1;
}
return 0;
}
-class GnuTLSIOHookProvider : public IOHookProvider
+class GnuTLSIOHookProvider : public SSLIOHookProvider
{
GnuTLS::Profile profile;
public:
- GnuTLSIOHookProvider(Module* mod, GnuTLS::Profile::Config& config)
- : IOHookProvider(mod, "ssl/" + config.name, IOHookProvider::IOH_SSL)
+ GnuTLSIOHookProvider(Module* mod, GnuTLS::Profile::Config& config)
+ : SSLIOHookProvider(mod, config.name)
, profile(config)
{
ServerInstance->Modules->AddService(*this);
{
// First, store all profiles in a new, temporary container. If no problems occur, swap the two
// containers; this way if something goes wrong we can go back and continue using the current profiles,
- // avoiding unpleasant situations where no new SSL connections are possible.
+ // avoiding unpleasant situations where no new TLS (SSL) connections are possible.
ProfileList newprofiles;
ConfigTagList tags = ServerInstance->Config->ConfTags("sslprofile");
// No <sslprofile> tags found, create a profile named "gnutls" from settings in the <gnutls> block
const std::string defname = "gnutls";
ConfigTag* tag = ServerInstance->Config->ConfValue(defname);
- ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "No <sslprofile> tags found; using settings from the <gnutls> tag");
+ ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "No <sslprofile> tags found; using settings from the deprecated <gnutls> tag");
try
{
}
catch (CoreException& ex)
{
- throw ModuleException("Error while initializing the default SSL profile - " + ex.GetReason());
+ throw ModuleException("Error while initializing the default TLS (SSL) profile - " + ex.GetReason());
}
}
-
- for (ConfigIter i = tags.first; i != tags.second; ++i)
+ else
{
- ConfigTag* tag = i->second;
- if (!stdalgo::string::equalsci(tag->getString("provider"), "gnutls"))
- continue;
-
- std::string name = tag->getString("name");
- if (name.empty())
+ ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "You have defined an <sslprofile> tag; you should use this in place of \"gnutls\" when configuring TLS (SSL) connections in <bind:sslprofile> or <link:sslprofile>");
+ for (ConfigIter i = tags.first; i != tags.second; ++i)
{
- ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "Ignoring <sslprofile> tag without name at " + tag->getTagLocation());
- continue;
- }
+ ConfigTag* tag = i->second;
+ if (!stdalgo::string::equalsci(tag->getString("provider"), "gnutls"))
+ {
+ ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "Ignoring non-GnuTLS <sslprofile> tag at " + tag->getTagLocation());
+ continue;
+ }
- reference<GnuTLSIOHookProvider> prov;
- try
- {
- GnuTLS::Profile::Config profileconfig(name, tag);
- prov = new GnuTLSIOHookProvider(this, profileconfig);
- }
- catch (CoreException& ex)
- {
- throw ModuleException("Error while initializing SSL profile \"" + name + "\" at " + tag->getTagLocation() + " - " + ex.GetReason());
- }
+ std::string name = tag->getString("name");
+ if (name.empty())
+ {
+ ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "Ignoring <sslprofile> tag without name at " + tag->getTagLocation());
+ continue;
+ }
- newprofiles.push_back(prov);
+ reference<GnuTLSIOHookProvider> prov;
+ try
+ {
+ GnuTLS::Profile::Config profileconfig(name, tag);
+ prov = new GnuTLSIOHookProvider(this, profileconfig);
+ }
+ catch (CoreException& ex)
+ {
+ throw ModuleException("Error while initializing TLS (SSL) profile \"" + name + "\" at " + tag->getTagLocation() + " - " + ex.GetReason());
+ }
+
+ newprofiles.push_back(prov);
+ }
}
// New profiles are ok, begin using them
void OnModuleRehash(User* user, const std::string ¶m) CXX11_OVERRIDE
{
- if(param != "ssl")
+ if (!irc::equals(param, "tls") && !irc::equals(param, "ssl"))
return;
try
{
ReadProfiles();
+ ServerInstance->SNO->WriteToSnoMask('a', "GnuTLS TLS (SSL) profiles have been reloaded.");
}
catch (ModuleException& ex)
{
if ((user) && (user->eh.GetModHook(this)))
{
- // User is using SSL, they're a local user, and they're using one of *our* SSL ports.
- // Potentially there could be multiple SSL modules loaded at once on different ports.
- ServerInstance->Users->QuitUser(user, "SSL module unloading");
+ // User is using TLS (SSL), they're a local user, and they're using one of *our* TLS (SSL) ports.
+ // Potentially there could be multiple TLS (SSL) modules loaded at once on different ports.
+ ServerInstance->Users->QuitUser(user, "GnuTLS module unloading");
}
}
}
Version GetVersion() CXX11_OVERRIDE
{
- return Version("Provides SSL support for clients", VF_VENDOR);
+ return Version("Allows TLS (SSL) encrypted connections using the GnuTLS library.", VF_VENDOR);
}
ModResult OnCheckReady(LocalUser* user) CXX11_OVERRIDE
projects / user / henk / code / inspircd.git / blobdiff