sslinfo: use the SSL certificate API to get user SSL certificates.

[user/henk/code/inspircd.git] / src / modules / extra / m_ssl_openssl.cpp

diff --git a/src/modules/extra/m_ssl_openssl.cpp b/src/modules/extra/m_ssl_openssl.cpp
index 828fcc26a07332e7e39c3b224582659533b38ca3..8d6b1e98ca1675f70042921e64c60cc6c51a523c 100644 (file)
--- a/src/modules/extra/m_ssl_openssl.cpp
+++ b/src/modules/extra/m_ssl_openssl.cpp
@@ -34,6 +34,10 @@
 #include "iohook.h"
 #include "modules/ssl.h"
 
+#ifdef __GNUC__
+# pragma GCC diagnostic push
+#endif
+
 // Ignore OpenSSL deprecation warnings on OS X Lion and newer.
 #if defined __APPLE__
 # pragma GCC diagnostic ignored "-Wdeprecated-declarations"
@@ -50,6 +54,10 @@
 #include <openssl/err.h>
 #include <openssl/dh.h>
 
+#ifdef __GNUC__
+# pragma GCC diagnostic pop
+#endif
+
 #ifdef _WIN32
 # pragma comment(lib, "ssleay32.lib")
 # pragma comment(lib, "libeay32.lib")
@@ -222,11 +230,11 @@ namespace OpenSSL
 
                        /* Set CRL mode */
                        unsigned long crlflags = X509_V_FLAG_CRL_CHECK;
-                       if (crlmode == "chain")
+                       if (stdalgo::string::equalsci(crlmode, "chain"))
                        {
                                crlflags |= X509_V_FLAG_CRL_CHECK_ALL;
                        }
-                       else if (crlmode != "leaf")
+                       else if (!stdalgo::string::equalsci(crlmode, "leaf"))
                        {
                                throw ModuleException("Unknown mode '" + crlmode + "'; expected either 'chain' (default) or 'leaf'");
                        }
@@ -336,14 +344,29 @@ namespace OpenSSL
                {
                        long setoptions = tag->getInt(ctxname + "setoptions", 0);
                        long clearoptions = tag->getInt(ctxname + "clearoptions", 0);
+
 #ifdef SSL_OP_NO_COMPRESSION
-                       if (!tag->getBool("compression", false)) // Disable compression by default
+                       // Disable compression by default
+                       if (!tag->getBool("compression", false))
                                setoptions |= SSL_OP_NO_COMPRESSION;
 #endif
+
                        // Disable TLSv1.0 by default.
                        if (!tag->getBool("tlsv1", false))
                                setoptions |= SSL_OP_NO_TLSv1;
 
+#ifdef SSL_OP_NO_TLSv1_1
+                       // Enable TLSv1.1 by default.
+                       if (!tag->getBool("tlsv11", true))
+                               setoptions |= SSL_OP_NO_TLSv1_1;
+#endif
+
+#ifdef SSL_OP_NO_TLSv1_2
+                       // Enable TLSv1.2 by default.
+                       if (!tag->getBool("tlsv12", true))
+                               setoptions |= SSL_OP_NO_TLSv1_2;
+#endif
+
                        if (!setoptions && !clearoptions)
                                return; // Nothing to do
 
@@ -359,7 +382,7 @@ namespace OpenSSL
                        , ctx(SSL_CTX_new(SSLv23_server_method()))
                        , clictx(SSL_CTX_new(SSLv23_client_method()))
                        , allowrenego(tag->getBool("renegotiation")) // Disallow by default
-                       , outrecsize(tag->getInt("outrecsize", 2048, 512, 16384))
+                       , outrecsize(tag->getUInt("outrecsize", 2048, 512, 16384))
                {
                        if ((!ctx.SetDH(dh)) || (!clictx.SetDH(dh)))
                                throw Exception("Couldn't set DH parameters");
@@ -963,7 +986,7 @@ class ModuleSSLOpenSSL : public Module
                for (ConfigIter i = tags.first; i != tags.second; ++i)
                {
                        ConfigTag* tag = i->second;
-                       if (tag->getString("provider") != "openssl")
+                       if (!stdalgo::string::equalsci(tag->getString("provider"), "openssl"))
                                continue;
 
                        std::string name = tag->getString("name");
@@ -1063,7 +1086,7 @@ class ModuleSSLOpenSSL : public Module
 
        Version GetVersion() CXX11_OVERRIDE
        {
-               return Version("Provides SSL support for clients", VF_VENDOR);
+               return Version("Provides SSL support via OpenSSL", VF_VENDOR);
        }
 };