Change Windows libraries to be dynamically linked

[user/henk/code/inspircd.git] / src / modules / extra / m_ssl_openssl.cpp

diff --git a/src/modules/extra/m_ssl_openssl.cpp b/src/modules/extra/m_ssl_openssl.cpp
index a8020bba18fafea552d39d5c8f35163772955258..60c90988a7aed04b4d87e67795f1d6e341b2f6dc 100644 (file)
--- a/src/modules/extra/m_ssl_openssl.cpp
+++ b/src/modules/extra/m_ssl_openssl.cpp
@@ -21,20 +21,23 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-
+ /* HACK: This prevents OpenSSL on OS X 10.7 and later from spewing deprecation
+  * warnings for every single function call. As far as I (SaberUK) know, Apple
+  * have no plans to remove OpenSSL so this warning just causes needless spam.
+  */
+#ifdef __APPLE__
+# define __AVAILABILITYMACROS__
+# define DEPRECATED_IN_MAC_OS_X_VERSION_10_7_AND_LATER
+#endif
+ 
 #include "inspircd.h"
 #include <openssl/ssl.h>
 #include <openssl/err.h>
 #include "ssl.h"
 
-#ifdef WINDOWS
-# pragma comment(lib, "libcrypto.lib")
-# pragma comment(lib, "libssl.lib")
-# pragma comment(lib, "user32.lib")
-# pragma comment(lib, "advapi32.lib")
-# pragma comment(lib, "libgcc.lib")
-# pragma comment(lib, "libmingwex.lib")
-# pragma comment(lib, "gdi32.lib")
+#ifdef _WIN32
+# pragma comment(lib, "ssleay32.lib")
+# pragma comment(lib, "libeay32.lib")
 # undef MAX_DESCRIPTORS
 # define MAX_DESCRIPTORS 10000
 #endif
@@ -68,7 +71,6 @@ public:
        issl_status status;
        reference<ssl_cert> cert;
 
-       int fd;
        bool outbound;
        bool data_to_write;
 
@@ -95,14 +97,11 @@ static int OnVerify(int preverify_ok, X509_STORE_CTX *ctx)
 
 class ModuleSSLOpenSSL : public Module
 {
-       int inbufsize;
        issl_session* sessions;
 
        SSL_CTX* ctx;
        SSL_CTX* clictx;
 
-       char cipher[MAXBUF];
-
        std::string sslports;
        bool use_sha;
 
@@ -113,9 +112,6 @@ class ModuleSSLOpenSSL : public Module
        {
                sessions = new issl_session[ServerInstance->SE->GetMaxFds()];
 
-               // Not rehashable...because I cba to reduce all the sizes of existing buffers.
-               inbufsize = ServerInstance->Config->NetBufferSize;
-
                /* Global SSL library initialization*/
                SSL_library_init();
                SSL_load_error_strings();
@@ -131,6 +127,9 @@ class ModuleSSLOpenSSL : public Module
 
                SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, OnVerify);
                SSL_CTX_set_verify(clictx, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, OnVerify);
+
+               const unsigned char session_id[] = "inspircd";
+               SSL_CTX_set_session_id_context(ctx, session_id, sizeof(session_id) - 1);
        }
 
        void init()
@@ -156,7 +155,7 @@ class ModuleSSLOpenSSL : public Module
                sslports.clear();
 
                ConfigTag* Conf = ServerInstance->Config->ConfValue("openssl");
-               
+
                if (Conf->getBool("showports", true))
                {
                        sslports = Conf->getString("advertisedports");
@@ -203,10 +202,10 @@ class ModuleSSLOpenSSL : public Module
 
                ConfigTag* conf = ServerInstance->Config->ConfValue("openssl");
 
-               cafile   = conf->getString("cafile", "conf/ca.pem");
-               certfile = conf->getString("certfile", "conf/cert.pem");
-               keyfile  = conf->getString("keyfile", "conf/key.pem");
-               dhfile   = conf->getString("dhfile", "conf/dhparams.pem");
+               cafile   = conf->getString("cafile", CONFIG_PATH "/ca.pem");
+               certfile = conf->getString("certfile", CONFIG_PATH "/cert.pem");
+               keyfile  = conf->getString("keyfile", CONFIG_PATH "/key.pem");
+               dhfile   = conf->getString("dhfile", CONFIG_PATH "/dhparams.pem");
                std::string hash = conf->getString("hash", "md5");
                if (hash != "sha1" && hash != "md5")
                        throw ModuleException("Unknown hash type " + hash);
@@ -241,11 +240,15 @@ class ModuleSSLOpenSSL : public Module
                /* Load the CAs we trust*/
                if (((!SSL_CTX_load_verify_locations(ctx, cafile.c_str(), 0))) || (!SSL_CTX_load_verify_locations(clictx, cafile.c_str(), 0)))
                {
-                       ServerInstance->Logs->Log("m_ssl_openssl",DEFAULT, "m_ssl_openssl.so: Can't read CA list from %s. %s", cafile.c_str(), strerror(errno));
+                       ServerInstance->Logs->Log("m_ssl_openssl",DEFAULT, "m_ssl_openssl.so: Can't read CA list from %s. This is only a problem if you want to verify client certificates, otherwise it's safe to ignore this message. Error: %s", cafile.c_str(), strerror(errno));
                        ERR_print_errors_cb(error_callback, this);
                }
 
+#ifdef _WIN32
+               BIO* dhpfile = BIO_new_file(dhfile.c_str(), "r");
+#else
                FILE* dhpfile = fopen(dhfile.c_str(), "r");
+#endif
                DH* ret;
 
                if (dhpfile == NULL)
@@ -255,15 +258,23 @@ class ModuleSSLOpenSSL : public Module
                }
                else
                {
+#ifdef _WIN32
+                       ret = PEM_read_bio_DHparams(dhpfile, NULL, NULL, NULL);
+                       BIO_free(dhpfile);
+#else
                        ret = PEM_read_DHparams(dhpfile, NULL, NULL, NULL);
+#endif
                        if ((SSL_CTX_set_tmp_dh(ctx, ret) < 0) || (SSL_CTX_set_tmp_dh(clictx, ret) < 0))
                        {
                                ServerInstance->Logs->Log("m_ssl_openssl",DEFAULT, "m_ssl_openssl.so: Couldn't set DH parameters %s. SSL errors follow:", dhfile.c_str());
                                ERR_print_errors_cb(error_callback, this);
                        }
+                       DH_free(ret);
                }
 
+#ifndef _WIN32
                fclose(dhpfile);
+#endif
        }
 
        void On005Numeric(std::string &output)
@@ -332,7 +343,6 @@ class ModuleSSLOpenSSL : public Module
 
                issl_session* session = &sessions[fd];
 
-               session->fd = fd;
                session->sess = SSL_new(ctx);
                session->status = ISSL_NONE;
                session->outbound = false;
@@ -359,7 +369,6 @@ class ModuleSSLOpenSSL : public Module
 
                issl_session* session = &sessions[fd];
 
-               session->fd = fd;
                session->sess = SSL_new(clictx);
                session->status = ISSL_NONE;
                session->outbound = true;
@@ -432,6 +441,7 @@ class ModuleSSLOpenSSL : public Module
                        {
                                // Client closed connection.
                                CloseSession(session);
+                               user->SetError("Connection closed");
                                return -1;
                        }
                        else if (ret < 0)
@@ -615,7 +625,7 @@ class ModuleSSLOpenSSL : public Module
 
                certinfo->invalid = (SSL_get_verify_result(session->sess) != X509_V_OK);
 
-               if (SelfSigned)
+               if (!SelfSigned)
                {
                        certinfo->unknownsigner = false;
                        certinfo->trusted = true;
@@ -626,8 +636,11 @@ class ModuleSSLOpenSSL : public Module
                        certinfo->trusted = false;
                }
 
-               certinfo->dn = X509_NAME_oneline(X509_get_subject_name(cert),0,0);
-               certinfo->issuer = X509_NAME_oneline(X509_get_issuer_name(cert),0,0);
+               char buf[512];
+               X509_NAME_oneline(X509_get_subject_name(cert), buf, sizeof(buf));
+               certinfo->dn = buf;
+               X509_NAME_oneline(X509_get_issuer_name(cert), buf, sizeof(buf));
+               certinfo->issuer = buf;
 
                if (!X509_digest(cert, digest, md, &n))
                {