/*
* InspIRCd -- Internet Relay Chat Daemon
*
+ * Copyright (C) 2020 Matt Schatz <genius3000@g3k.solutions>
+ * Copyright (C) 2019 linuxdaemon <linuxdaemon.irc@gmail.com>
+ * Copyright (C) 2017 Wade Cline <wadecline@hotmail.com>
+ * Copyright (C) 2014, 2016 Adam <Adam@anope.org>
+ * Copyright (C) 2014 Julien Vehent <julien@linuxwall.info>
+ * Copyright (C) 2013-2014, 2016-2020 Sadie Powell <sadie@witchery.services>
+ * Copyright (C) 2012-2017 Attila Molnar <attilamolnar@hush.com>
+ * Copyright (C) 2012 Robby <robby@chatbelgie.be>
+ * Copyright (C) 2012 ChrisTX <xpipe@hotmail.de>
* Copyright (C) 2009-2010 Daniel De Graaf <danieldg@inspircd.org>
- * Copyright (C) 2008 Pippijn van Steenhoven <pip88nl@gmail.com>
- * Copyright (C) 2006-2008 Craig Edwards <craigedwards@brainbox.cc>
- * Copyright (C) 2008 Thomas Stagner <aquanight@inspircd.org>
+ * Copyright (C) 2008 Robin Burchell <robin+git@viroteck.net>
+ * Copyright (C) 2007-2008, 2010 Craig Edwards <brain@inspircd.org>
* Copyright (C) 2007 Dennis Friis <peavey@inspircd.org>
- * Copyright (C) 2006 Oliver Lupton <oliverlupton@gmail.com>
*
* This file is part of InspIRCd. InspIRCd is free software: you can
* redistribute it and/or modify it under the terms of the GNU General Public
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
-/// $CompilerFlags: find_compiler_flags("openssl")
+/// $CompilerFlags: find_compiler_flags("openssl" "")
/// $LinkerFlags: find_linker_flags("openssl" "-lssl -lcrypto")
+/// $PackageInfo: require_system("arch") openssl pkgconf
/// $PackageInfo: require_system("centos") openssl-devel pkgconfig
/// $PackageInfo: require_system("darwin") openssl pkg-config
/// $PackageInfo: require_system("debian") libssl-dev openssl pkg-config
#include "iohook.h"
#include "modules/ssl.h"
+#ifdef __GNUC__
+# pragma GCC diagnostic push
+#endif
+
// Ignore OpenSSL deprecation warnings on OS X Lion and newer.
#if defined __APPLE__
# pragma GCC diagnostic ignored "-Wdeprecated-declarations"
#endif
+// LibreSSL lies about the version of OpenSSL it is compatible with and is a general pain
+// to support. Support for it was removed in the master branch at the same time that
+// support for OpenSSL pre-1.1 was.
+#if defined __GNUC__ && defined LIBRESSL_VERSION_NUMBER
+# warning LibreSSL support will be discontinued in the future. Consider using the ssl_gnutls or ssl_mbedtls modules instead.
+#endif
+
// Fix warnings about the use of `long long` on C++03.
#if defined __clang__
# pragma clang diagnostic ignored "-Wc++11-long-long"
#include <openssl/err.h>
#include <openssl/dh.h>
+#ifdef __GNUC__
+# pragma GCC diagnostic pop
+#endif
+
#ifdef _WIN32
# pragma comment(lib, "ssleay32.lib")
# pragma comment(lib, "libeay32.lib")
/* Set CRL mode */
unsigned long crlflags = X509_V_FLAG_CRL_CHECK;
- if (crlmode == "chain")
+ if (stdalgo::string::equalsci(crlmode, "chain"))
{
crlflags |= X509_V_FLAG_CRL_CHECK_ALL;
}
- else if (crlmode != "leaf")
+ else if (!stdalgo::string::equalsci(crlmode, "leaf"))
{
throw ModuleException("Unknown mode '" + crlmode + "'; expected either 'chain' (default) or 'leaf'");
}
X509_STORE* store = SSL_CTX_get_cert_store(ctx);
if (!store)
{
- throw ModuleException("Unable to get X509_STORE from SSL context; this should never happen");
+ throw ModuleException("Unable to get X509_STORE from TLS (SSL) context; this should never happen");
}
ERR_clear_error();
if (!X509_STORE_load_locations(store,
{
long setoptions = tag->getInt(ctxname + "setoptions", 0);
long clearoptions = tag->getInt(ctxname + "clearoptions", 0);
+
#ifdef SSL_OP_NO_COMPRESSION
- if (!tag->getBool("compression", false)) // Disable compression by default
+ // Disable compression by default
+ if (!tag->getBool("compression", false))
setoptions |= SSL_OP_NO_COMPRESSION;
#endif
+
// Disable TLSv1.0 by default.
if (!tag->getBool("tlsv1", false))
setoptions |= SSL_OP_NO_TLSv1;
+#ifdef SSL_OP_NO_TLSv1_1
+ // Enable TLSv1.1 by default.
+ if (!tag->getBool("tlsv11", true))
+ setoptions |= SSL_OP_NO_TLSv1_1;
+#endif
+
+#ifdef SSL_OP_NO_TLSv1_2
+ // Enable TLSv1.2 by default.
+ if (!tag->getBool("tlsv12", true))
+ setoptions |= SSL_OP_NO_TLSv1_2;
+#endif
+
if (!setoptions && !clearoptions)
return; // Nothing to do
public:
Profile(const std::string& profilename, ConfigTag* tag)
: name(profilename)
- , dh(ServerInstance->Config->Paths.PrependConfig(tag->getString("dhfile", "dhparams.pem")))
+ , dh(ServerInstance->Config->Paths.PrependConfig(tag->getString("dhfile", "dhparams.pem", 1)))
, ctx(SSL_CTX_new(SSLv23_server_method()))
, clictx(SSL_CTX_new(SSLv23_client_method()))
, allowrenego(tag->getBool("renegotiation")) // Disallow by default
if ((!ctx.SetDH(dh)) || (!clictx.SetDH(dh)))
throw Exception("Couldn't set DH parameters");
- std::string hash = tag->getString("hash", "md5");
+ const std::string hash = tag->getString("hash", "md5", 1);
digest = EVP_get_digestbyname(hash.c_str());
if (digest == NULL)
throw Exception("Unknown hash type " + hash);
}
#ifndef OPENSSL_NO_ECDH
- std::string curvename = tag->getString("ecdhcurve", "prime256v1");
+ const std::string curvename = tag->getString("ecdhcurve", "prime256v1", 1);
if (!curvename.empty())
ctx.SetECDH(curvename);
#endif
/* Load our keys and certificates
* NOTE: OpenSSL's error logging API sucks, don't blame us for this clusterfuck.
*/
- std::string filename = ServerInstance->Config->Paths.PrependConfig(tag->getString("certfile", "cert.pem"));
+ std::string filename = ServerInstance->Config->Paths.PrependConfig(tag->getString("certfile", "cert.pem", 1));
if ((!ctx.SetCerts(filename)) || (!clictx.SetCerts(filename)))
{
ERR_print_errors_cb(error_callback, this);
throw Exception("Can't read certificate file: " + lasterr);
}
- filename = ServerInstance->Config->Paths.PrependConfig(tag->getString("keyfile", "key.pem"));
+ filename = ServerInstance->Config->Paths.PrependConfig(tag->getString("keyfile", "key.pem", 1));
if ((!ctx.SetPrivateKey(filename)) || (!clictx.SetPrivateKey(filename)))
{
ERR_print_errors_cb(error_callback, this);
}
// Load the CAs we trust
- filename = ServerInstance->Config->Paths.PrependConfig(tag->getString("cafile", "ca.pem"));
+ filename = ServerInstance->Config->Paths.PrependConfig(tag->getString("cafile", "ca.pem", 1));
if ((!ctx.SetCA(filename)) || (!clictx.SetCA(filename)))
{
ERR_print_errors_cb(error_callback, this);
}
// Load the CRLs.
- std::string crlfile = tag->getString("crlfile");
- std::string crlpath = tag->getString("crlpath");
- std::string crlmode = tag->getString("crlmode", "chain");
+ const std::string crlfile = tag->getString("crlfile");
+ const std::string crlpath = tag->getString("crlpath");
+ const std::string crlmode = tag->getString("crlmode", "chain", 1);
ctx.SetCRL(crlfile, crlpath, crlmode);
clictx.SetVerifyCert();
// Create a default profile named "openssl"
const std::string defname = "openssl";
ConfigTag* tag = ServerInstance->Config->ConfValue(defname);
- ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "No <sslprofile> tags found, using settings from the <openssl> tag");
+ ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "No <sslprofile> tags found, using settings from the deprecated <openssl> tag");
try
{
}
catch (OpenSSL::Exception& ex)
{
- throw ModuleException("Error while initializing the default SSL profile - " + ex.GetReason());
+ throw ModuleException("Error while initializing the default TLS (SSL) profile - " + ex.GetReason());
}
}
-
- for (ConfigIter i = tags.first; i != tags.second; ++i)
+ else
{
- ConfigTag* tag = i->second;
- if (tag->getString("provider") != "openssl")
- continue;
-
- std::string name = tag->getString("name");
- if (name.empty())
+ ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "You have defined an <sslprofile> tag; you should use this in place of \"openssl\" when configuring TLS (SSL) connections in <bind:ssl> or <link:ssl>");
+ for (ConfigIter i = tags.first; i != tags.second; ++i)
{
- ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "Ignoring <sslprofile> tag without name at " + tag->getTagLocation());
- continue;
- }
+ ConfigTag* tag = i->second;
+ if (!stdalgo::string::equalsci(tag->getString("provider"), "openssl"))
+ {
+ ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "Ignoring non-OpenSSL <sslprofile> tag at " + tag->getTagLocation());
+ continue;
+ }
- reference<OpenSSLIOHookProvider> prov;
- try
- {
- prov = new OpenSSLIOHookProvider(this, name, tag);
- }
- catch (CoreException& ex)
- {
- throw ModuleException("Error while initializing SSL profile \"" + name + "\" at " + tag->getTagLocation() + " - " + ex.GetReason());
- }
+ std::string name = tag->getString("name");
+ if (name.empty())
+ {
+ ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "Ignoring <sslprofile> tag without name at " + tag->getTagLocation());
+ continue;
+ }
- newprofiles.push_back(prov);
+ reference<OpenSSLIOHookProvider> prov;
+ try
+ {
+ prov = new OpenSSLIOHookProvider(this, name, tag);
+ }
+ catch (CoreException& ex)
+ {
+ throw ModuleException("Error while initializing TLS (SSL) profile \"" + name + "\" at " + tag->getTagLocation() + " - " + ex.GetReason());
+ }
+
+ newprofiles.push_back(prov);
+ }
}
for (ProfileList::iterator i = profiles.begin(); i != profiles.end(); ++i)
void OnModuleRehash(User* user, const std::string ¶m) CXX11_OVERRIDE
{
- if (param != "ssl")
+ if (!irc::equals(param, "tls") && !irc::equals(param, "ssl"))
return;
try
{
ReadProfiles();
+ ServerInstance->SNO->WriteToSnoMask('a', "OpenSSL TLS (SSL) profiles have been reloaded.");
}
catch (ModuleException& ex)
{
if ((user) && (user->eh.GetModHook(this)))
{
- // User is using SSL, they're a local user, and they're using one of *our* SSL ports.
- // Potentially there could be multiple SSL modules loaded at once on different ports.
- ServerInstance->Users->QuitUser(user, "SSL module unloading");
+ // User is using TLS (SSL), they're a local user, and they're using one of *our* TLS (SSL) ports.
+ // Potentially there could be multiple TLS (SSL) modules loaded at once on different ports.
+ ServerInstance->Users->QuitUser(user, "OpenSSL module unloading");
}
}
}
Version GetVersion() CXX11_OVERRIDE
{
- return Version("Provides SSL support for clients", VF_VENDOR);
+ return Version("Allows TLS (SSL) encrypted connections using the OpenSSL library.", VF_VENDOR);
}
};
projects / user / henk / code / inspircd.git / blobdiff