+/* +------------------------------------+
+ * | Inspire Internet Relay Chat Daemon |
+ * +------------------------------------+
+ *
+ * InspIRCd: (C) 2002-2007 InspIRCd Development Team
+ * See: http://www.inspircd.org/wiki/index.php/Credits
+ *
+ * This program is free but copyrighted software; see
+ * the file COPYING for details.
+ *
+ * ---------------------------------------------------
+ */
+
#include <string>
#include <vector>
#include "hashcomp.h"
#include "inspircd.h"
-#include "ssl_cert.h"
+#include "transport.h"
/* $ModDesc: Provides SSL support for clients */
/* $CompileFlags: `perl extra/openssl_config.pl compile` */
/* $LinkerFlags: `perl extra/openssl_config.pl link` */
-/* $ModDep: ssl_cert.h */
-
+/* $ModDep: transport.h */
enum issl_status { ISSL_NONE, ISSL_HANDSHAKING, ISSL_OPEN };
enum issl_io_status { ISSL_WRITE, ISSL_READ };
: Module::Module(Me)
{
culllist = new CullList(ServerInstance);
+
+ ServerInstance->PublishInterface("InspSocketHook", this);
// Not rehashable...because I cba to reduce all the sizes of existing buffers.
inbufsize = ServerInstance->Config->NetBufferSize;
void Implements(char* List)
{
- List[I_OnRawSocketAccept] = List[I_OnRawSocketClose] = List[I_OnRawSocketRead] = List[I_OnRawSocketWrite] = List[I_OnCleanup] = 1;
- List[I_OnSyncUserMetaData] = List[I_OnDecodeMetaData] = List[I_OnUnloadModule] = List[I_OnRehash] = List[I_OnWhois] = List[I_OnPostConnect] = 1;
+ List[I_OnRawSocketConnect] = List[I_OnRawSocketAccept] = List[I_OnRawSocketClose] = List[I_OnRawSocketRead] = List[I_OnRawSocketWrite] = List[I_OnCleanup] = 1;
+ List[I_OnRequest] = List[I_OnSyncUserMetaData] = List[I_OnDecodeMetaData] = List[I_OnUnloadModule] = List[I_OnRehash] = List[I_OnWhois] = List[I_OnPostConnect] = 1;
+ }
+
+ virtual char* OnRequest(Request* request)
+ {
+ ISHRequest* ISR = (ISHRequest*)request;
+ ServerInstance->Log(DEBUG, "hook OnRequest");
+ if (strcmp("IS_NAME", request->GetId()) == 0)
+ {
+ return "openssl";
+ }
+ else if (strcmp("IS_HOOK", request->GetId()) == 0)
+ {
+ char* ret = "OK";
+ try
+ {
+ ret = ServerInstance->Config->AddIOHook((Module*)this, (InspSocket*)ISR->Sock) ? (char*)"OK" : NULL;
+ }
+ catch (ModuleException &e)
+ {
+ return NULL;
+ }
+
+ return ret;
+ }
+ else if (strcmp("IS_UNHOOK", request->GetId()) == 0)
+ {
+ ServerInstance->Log(DEBUG, "Unhooking socket %08x", ISR->Sock);
+ return ServerInstance->Config->DelIOHook((InspSocket*)ISR->Sock) ? (char*)"OK" : NULL;
+ }
+ else if (strcmp("IS_HSDONE", request->GetId()) == 0)
+ {
+ issl_session* session = &sessions[ISR->Sock->GetFd()];
+ return (session->status == ISSL_HANDSHAKING) ? NULL : (char*)"OK";
+ }
+ else if (strcmp("IS_ATTACH", request->GetId()) == 0)
+ {
+ issl_session* session = &sessions[ISR->Sock->GetFd()];
+ if (session)
+ {
+ VerifyCertificate(session, (InspSocket*)ISR->Sock);
+ return "OK";
+ }
+ }
+ return NULL;
}
+
virtual void OnRawSocketAccept(int fd, const std::string &ip, int localport)
{
+ ServerInstance->Log(DEBUG, "Hook accept %d", fd);
issl_session* session = &sessions[fd];
session->fd = fd;
Handshake(session);
}
+ virtual void OnRawSocketConnect(int fd)
+ {
+ issl_session* session = &sessions[fd];
+
+ session->fd = fd;
+ session->inbuf = new char[inbufsize];
+ session->inbufoffset = 0;
+ session->sess = SSL_new(ctx);
+ session->status = ISSL_NONE;
+
+ if (session->sess == NULL)
+ {
+ ServerInstance->Log(DEBUG, "m_ssl.so: Couldn't create SSL object: %s", get_error());
+ return;
+ }
+
+ if (SSL_set_fd(session->sess, fd) == 0)
+ {
+ ServerInstance->Log(DEBUG, "m_ssl.so: Couldn't set fd for SSL object: %s", get_error());
+ return;
+ }
+
+ Handshake(session);
+ }
+
virtual void OnRawSocketClose(int fd)
{
ServerInstance->Log(DEBUG, "m_ssl_openssl.so: OnRawSocketClose: %d", fd);
int DoWrite(issl_session* session)
{
+ if (!session->outbuf.size())
+ return -1;
+
+ ServerInstance->Log(DEBUG, "m_ssl_openssl.so: To write: %d", session->outbuf.size());
int ret = SSL_write(session->sess, session->outbuf.data(), session->outbuf.size());
if (ret == 0)
session->status = ISSL_NONE;
}
- void VerifyCertificate(issl_session* session, userrec* user)
+ void VerifyCertificate(issl_session* session, Extensible* user)
{
X509* cert;
ssl_cert* certinfo = new ssl_cert;
certinfo->data.insert(std::make_pair("fingerprint",irc::hex(md, n)));
}
- user->WriteServ("NOTICE %s :*** Your SSL Certificate fingerprint is: %s", user->nick, irc::hex(md, n).c_str());
-
if ((ASN1_UTCTIME_cmp_time_t(X509_get_notAfter(cert), time(NULL)) == -1) || (ASN1_UTCTIME_cmp_time_t(X509_get_notBefore(cert), time(NULL)) == 0))
{
certinfo->data.insert(std::make_pair("error","Not activated, or expired certificate"));