Merge insp20

[user/henk/code/inspircd.git] / src / modules / extra / m_ssl_openssl.cpp

diff --git a/src/modules/extra/m_ssl_openssl.cpp b/src/modules/extra/m_ssl_openssl.cpp
index c0ab862d24c20d4a8609ba268653e2def167e577..c8a035fac60d41702cda6c5bf37ffbd3a102ced2 100644 (file)
--- a/src/modules/extra/m_ssl_openssl.cpp
+++ b/src/modules/extra/m_ssl_openssl.cpp
@@ -196,9 +196,18 @@ namespace OpenSSL
                        return SSL_CTX_clear_options(ctx, clearoptions);
                }
 
-               SSL* CreateSession()
+               SSL* CreateServerSession()
                {
-                       return SSL_new(ctx);
+                       SSL* sess = SSL_new(ctx);
+                       SSL_set_accept_state(sess); // Act as server
+                       return sess;
+               }
+
+               SSL* CreateClientSession()
+               {
+                       SSL* sess = SSL_new(ctx);
+                       SSL_set_connect_state(sess); // Act as client
+                       return sess;
                }
        };
 
@@ -324,8 +333,8 @@ namespace OpenSSL
                }
 
                const std::string& GetName() const { return name; }
-               SSL* CreateServerSession() { return ctx.CreateSession(); }
-               SSL* CreateClientSession() { return clictx.CreateSession(); }
+               SSL* CreateServerSession() { return ctx.CreateServerSession(); }
+               SSL* CreateClientSession() { return clictx.CreateClientSession(); }
                const EVP_MD* GetDigest() { return digest; }
                bool AllowRenegotiation() const { return allowrenego; }
        };
@@ -350,21 +359,14 @@ class OpenSSLIOHook : public SSLIOHook
  private:
        SSL* sess;
        issl_status status;
-       const bool outbound;
        bool data_to_write;
        reference<OpenSSL::Profile> profile;
 
        // Returns 1 if handshake succeeded, 0 if it is still in progress, -1 if it failed
        int Handshake(StreamSocket* user)
        {
-               int ret;
-
                ERR_clear_error();
-               if (outbound)
-                       ret = SSL_connect(sess);
-               else
-                       ret = SSL_accept(sess);
-
+               int ret = SSL_do_handshake(sess);
                if (ret < 0)
                {
                        int err = SSL_get_error(sess, ret);
@@ -502,15 +504,29 @@ class OpenSSLIOHook : public SSLIOHook
        }
 #endif
 
+       // Returns 1 if application I/O should proceed, 0 if it must wait for the underlying protocol to progress, -1 on fatal error
+       int PrepareIO(StreamSocket* sock)
+       {
+               if (status == ISSL_OPEN)
+                       return 1;
+               else if (status == ISSL_HANDSHAKING)
+               {
+                       // The handshake isn't finished, try to finish it
+                       return Handshake(sock);
+               }
+
+               CloseSession();
+               return -1;
+       }
+
        // Calls our private SSLInfoCallback()
        friend void StaticSSLInfoCallback(const SSL* ssl, int where, int rc);
 
  public:
-       OpenSSLIOHook(IOHookProvider* hookprov, StreamSocket* sock, bool is_outbound, SSL* session, const reference<OpenSSL::Profile>& sslprofile)
+       OpenSSLIOHook(IOHookProvider* hookprov, StreamSocket* sock, SSL* session, const reference<OpenSSL::Profile>& sslprofile)
                : SSLIOHook(hookprov)
                , sess(session)
                , status(ISSL_NONE)
-               , outbound(is_outbound)
                , data_to_write(false)
                , profile(sslprofile)
        {
@@ -531,19 +547,10 @@ class OpenSSLIOHook : public SSLIOHook
 
        int OnStreamSocketRead(StreamSocket* user, std::string& recvq) CXX11_OVERRIDE
        {
-               if (!sess)
-               {
-                       CloseSession();
-                       return -1;
-               }
-
-               if (status == ISSL_HANDSHAKING)
-               {
-                       // The handshake isn't finished and it wants to read, try to finish it.
-                       int ret = Handshake(user);
-                       if (ret <= 0)
-                               return ret;
-               }
+               // Finish handshake if needed
+               int prepret = PrepareIO(user);
+               if (prepret <= 0)
+                       return prepret;
 
                // If we resumed the handshake then this->status will be ISSL_OPEN
                {
@@ -596,21 +603,13 @@ class OpenSSLIOHook : public SSLIOHook
 
        int OnStreamSocketWrite(StreamSocket* user, std::string& buffer) CXX11_OVERRIDE
        {
-               if (!sess)
-               {
-                       CloseSession();
-                       return -1;
-               }
+               // Finish handshake if needed
+               int prepret = PrepareIO(user);
+               if (prepret <= 0)
+                       return prepret;
 
                data_to_write = true;
 
-               if (status == ISSL_HANDSHAKING)
-               {
-                       int ret = Handshake(user);
-                       if (ret <= 0)
-                               return ret;
-               }
-
                // Session is ready for transferring application data
                {
                        ERR_clear_error();
@@ -681,6 +680,8 @@ class OpenSSLIOHook : public SSLIOHook
                out.append(SSL_get_version(sess)).push_back('-');
                out.append(SSL_get_cipher(sess));
        }
+
+       bool IsHandshakeDone() const { return (status == ISSL_OPEN); }
 };
 
 static void StaticSSLInfoCallback(const SSL* ssl, int where, int rc)
@@ -710,12 +711,12 @@ class OpenSSLIOHookProvider : public refcountbase, public IOHookProvider
 
        void OnAccept(StreamSocket* sock, irc::sockets::sockaddrs* client, irc::sockets::sockaddrs* server) CXX11_OVERRIDE
        {
-               new OpenSSLIOHook(this, sock, false, profile->CreateServerSession(), profile);
+               new OpenSSLIOHook(this, sock, profile->CreateServerSession(), profile);
        }
 
        void OnConnect(StreamSocket* sock) CXX11_OVERRIDE
        {
-               new OpenSSLIOHook(this, sock, true, profile->CreateClientSession(), profile);
+               new OpenSSLIOHook(this, sock, profile->CreateClientSession(), profile);
        }
 };
 
@@ -832,6 +833,18 @@ class ModuleSSLOpenSSL : public Module
                }
        }
 
+       ModResult OnCheckReady(LocalUser* user) CXX11_OVERRIDE
+       {
+               if ((user->eh.GetIOHook()) && (user->eh.GetIOHook()->prov->creator == this))
+               {
+                       OpenSSLIOHook* iohook = static_cast<OpenSSLIOHook*>(user->eh.GetIOHook());
+                       if (!iohook->IsHandshakeDone())
+                               return MOD_RES_DENY;
+               }
+
+               return MOD_RES_PASSTHRU;
+       }
+
        Version GetVersion() CXX11_OVERRIDE
        {
                return Version("Provides SSL support for clients", VF_VENDOR);