Move configuration examples to docs, remove automatic overwrite on make install

[user/henk/code/inspircd.git] / src / modules / extra / m_ssl_openssl.cpp

diff --git a/src/modules/extra/m_ssl_openssl.cpp b/src/modules/extra/m_ssl_openssl.cpp
index 1d4ebd7fda737fd01fcc1e45bd8ad842d0bb14ba..018d7351ef1e66d0495876ee588b43ac53e63c74 100644 (file)
--- a/src/modules/extra/m_ssl_openssl.cpp
+++ b/src/modules/extra/m_ssl_openssl.cpp
@@ -30,8 +30,6 @@
 /* $LinkerFlags: if(!"USE_FREEBSD_BASE_SSL") rpath("pkg-config --libs openssl") pkgconflibs("openssl","/libssl.so","-lssl -lcrypto -ldl") */
 
 /* $NoPedantic */
-/* $CopyInstall: conf/key.pem $(CONPATH) -m 0400 -o $(INSTUID) */
-/* $CopyInstall: conf/cert.pem $(CONPATH) -m 0444 */
 
 
 enum issl_status { ISSL_NONE, ISSL_HANDSHAKING, ISSL_OPEN };
@@ -89,19 +87,14 @@ class ModuleSSLOpenSSL : public Module
 
        char cipher[MAXBUF];
 
-       std::string keyfile;
-       std::string certfile;
-       std::string cafile;
-       // std::string crlfile;
-       std::string dhfile;
        std::string sslports;
+       bool use_sha;
 
        ServiceProvider iohook;
  public:
 
        ModuleSSLOpenSSL() : iohook(this, "ssl/openssl", SERVICE_IOHOOK)
        {
-
                sessions = new issl_session[ServerInstance->SE->GetMaxFds()];
 
                // Not rehashable...because I cba to reduce all the sizes of existing buffers.
@@ -122,7 +115,10 @@ class ModuleSSLOpenSSL : public Module
 
                SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, OnVerify);
                SSL_CTX_set_verify(clictx, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, OnVerify);
+       }
 
+       void init()
+       {
                // Needs the flag as it ignores a plain /rehash
                OnModuleRehash(NULL,"ssl");
                Implementation eventlist[] = { I_On005Numeric, I_OnRehash, I_OnModuleRehash, I_OnHookIO, I_OnUserConnect };
@@ -166,27 +162,23 @@ class ModuleSSLOpenSSL : public Module
                if (param != "ssl")
                        return;
 
+               std::string keyfile;
+               std::string certfile;
+               std::string cafile;
+               std::string dhfile;
                OnRehash(user);
 
-               ConfigReader Conf;
-
-               cafile   = Conf.ReadValue("openssl", "cafile", 0);
-               certfile = Conf.ReadValue("openssl", "certfile", 0);
-               keyfile  = Conf.ReadValue("openssl", "keyfile", 0);
-               dhfile   = Conf.ReadValue("openssl", "dhfile", 0);
+               ConfigTag* conf = ServerInstance->Config->ConfValue("openssl");
 
-               // Set all the default values needed.
-               if (cafile.empty())
-                       cafile = "conf/ca.pem";
+               cafile   = conf->getString("cafile", "conf/ca.pem");
+               certfile = conf->getString("certfile", "conf/cert.pem");
+               keyfile  = conf->getString("keyfile", "conf/key.pem");
+               dhfile   = conf->getString("dhfile", "conf/dhparams.pem");
+               std::string hash = conf->getString("hash", "md5");
+               if (hash != "sha1" && hash != "md5")
+                       throw ModuleException("Unknown hash type " + hash);
+               use_sha = (hash == "sha1");
 
-               if (certfile.empty())
-                       certfile = "conf/cert.pem";
-
-               if (keyfile.empty())
-                       keyfile = "conf/key.pem";
-
-               if (dhfile.empty())
-                       dhfile = "conf/dhparams.pem";
 
                /* Load our keys and certificates
                 * NOTE: OpenSSL's error logging API sucks, don't blame us for this clusterfuck.
@@ -251,6 +243,10 @@ class ModuleSSLOpenSSL : public Module
                        if (sessions[user->GetFd()].sess)
                        {
                                SSLCertSubmission(user, this, ServerInstance->Modules->Find("m_sslinfo.so"), sessions[user->GetFd()].cert);
+
+                               if (!sessions[user->GetFd()].cert->fingerprint.empty())
+                                       user->WriteServ("NOTICE %s :*** You are connected using SSL fingerprint %s",
+                                               user->nick.c_str(), sessions[user->GetFd()].cert->fingerprint.c_str());
                        }
                }
        }
@@ -380,7 +376,7 @@ class ModuleSSLOpenSSL : public Module
                        char* buffer = ServerInstance->GetReadBuffer();
                        size_t bufsiz = ServerInstance->Config->NetBufferSize;
                        int ret = SSL_read(session->sess, buffer, bufsiz);
-                       
+
                        if (ret > 0)
                        {
                                recvq.append(buffer, ret);
@@ -561,7 +557,7 @@ class ModuleSSLOpenSSL : public Module
                session->cert = certinfo;
                unsigned int n;
                unsigned char md[EVP_MAX_MD_SIZE];
-               const EVP_MD *digest = EVP_md5();
+               const EVP_MD *digest = use_sha ? EVP_sha1() : EVP_md5();
 
                cert = SSL_get_peer_certificate((SSL*)session->sess);