X-Git-Url: https://git.netwichtig.de/gitweb/?a=blobdiff_plain;f=src%2Fmodules%2Fextra%2Fm_ssl_gnutls.cpp;h=910ff4a2126df35760639b706a7b99efbcc04056;hb=b950e46bfeef5643ff68c8c78530c1eff25d024e;hp=51408067f5e819439bfcc626d839fd4c0818c9f6;hpb=e588fdca3b29dc3bab6051cf409637a5bace35d8;p=user%2Fhenk%2Fcode%2Finspircd.git diff --git a/src/modules/extra/m_ssl_gnutls.cpp b/src/modules/extra/m_ssl_gnutls.cpp index 51408067f..910ff4a21 100644 --- a/src/modules/extra/m_ssl_gnutls.cpp +++ b/src/modules/extra/m_ssl_gnutls.cpp @@ -28,8 +28,6 @@ #ifdef WINDOWS #pragma comment(lib, "libgnutls-13.lib") -#undef MAX_DESCRIPTORS -#define MAX_DESCRIPTORS 10000 #endif /* $ModDesc: Provides SSL support for clients */ @@ -75,13 +73,23 @@ class CommandStartTLS : public Command this->source = "m_ssl_gnutls.so"; } - CmdResult Handle (const char* const* parameters, int pcnt, User *user) + CmdResult Handle (const std::vector ¶meters, User *user) { - if (!user->GetExt("tls")) - return CMD_FAILURE; - - user->io = Caller; - Caller->OnRawSocketAccept(user->GetFd(), user->GetIPString(), user->GetPort()); + if (user->registered == REG_ALL) + { + ServerInstance->Users->QuitUser(user, "STARTTLS not allowed after client registration"); + } + else + { + if (!user->io) + { + user->WriteNumeric(670, "%s :STARTTLS successful, go ahead with TLS handshake", user->nick.c_str()); + user->io = Caller; + Caller->OnRawSocketAccept(user->GetFd(), user->GetIPString(), user->GetPort()); + } + else + user->WriteNumeric(671, "%s :STARTTLS failure", user->nick.c_str()); + } return CMD_FAILURE; } @@ -97,7 +105,7 @@ class ModuleSSLGnuTLS : public Module std::vector listenports; int inbufsize; - issl_session sessions[MAX_DESCRIPTORS]; + issl_session* sessions; gnutls_certificate_credentials x509_cred; gnutls_dh_params dh_params; @@ -110,6 +118,7 @@ class ModuleSSLGnuTLS : public Module int dh_bits; int clientactive; + bool cred_alloc; CommandStartTLS* starttls; @@ -120,18 +129,14 @@ class ModuleSSLGnuTLS : public Module { ServerInstance->Modules->PublishInterface("BufferedSocketHook", this); + sessions = new issl_session[ServerInstance->SE->GetMaxFds()]; + // Not rehashable...because I cba to reduce all the sizes of existing buffers. inbufsize = ServerInstance->Config->NetBufferSize; gnutls_global_init(); // This must be called once in the program - if(gnutls_certificate_allocate_credentials(&x509_cred) != 0) - ServerInstance->Logs->Log("m_ssl_gnutls",DEFAULT, "m_ssl_gnutls.so: Failed to allocate certificate credentials"); - - // Guessing return meaning - if(gnutls_dh_params_init(&dh_params) < 0) - ServerInstance->Logs->Log("m_ssl_gnutls",DEFAULT, "m_ssl_gnutls.so: Failed to initialise DH parameters"); - + cred_alloc = false; // Needs the flag as it ignores a plain /rehash OnRehash(NULL,"ssl"); @@ -175,13 +180,13 @@ class ModuleSSLGnuTLS : public Module for (size_t i = 0; i < ServerInstance->Config->ports.size(); i++) if ((ServerInstance->Config->ports[i]->GetPort() == portno) && (ServerInstance->Config->ports[i]->GetIP() == addr)) ServerInstance->Config->ports[i]->SetDescription("ssl"); - ServerInstance->Logs->Log("m_ssl_gnutls",DEFAULT, "m_ssl_gnutls.so: Enabling SSL for port %d", portno); + ServerInstance->Logs->Log("m_ssl_gnutls",DEFAULT, "m_ssl_gnutls.so: Enabling SSL for port %ld", portno); sslports.append((addr.empty() ? "*" : addr)).append(":").append(ConvToStr(portno)).append(";"); } catch (ModuleException &e) { - ServerInstance->Logs->Log("m_ssl_gnutls",DEFAULT, "m_ssl_gnutls.so: FAILED to enable SSL on port %d: %s. Maybe it's already hooked by the same port on a different IP, or you have an other SSL or similar module loaded?", portno, e.GetReason()); + ServerInstance->Logs->Log("m_ssl_gnutls",DEFAULT, "m_ssl_gnutls.so: FAILED to enable SSL on port %ld: %s. Maybe it's already hooked by the same port on a different IP, or you have an other SSL or similar module loaded?", portno, e.GetReason()); } } } @@ -223,20 +228,35 @@ class ModuleSSLGnuTLS : public Module dh_bits = 1024; // Prepend relative paths with the path to the config directory. - if(cafile[0] != '/') + if ((cafile[0] != '/') && (!ServerInstance->Config->StartsWithWindowsDriveLetter(cafile))) cafile = confdir + cafile; - if(crlfile[0] != '/') + if ((crlfile[0] != '/') && (!ServerInstance->Config->StartsWithWindowsDriveLetter(crlfile))) crlfile = confdir + crlfile; - if(certfile[0] != '/') + if ((certfile[0] != '/') && (!ServerInstance->Config->StartsWithWindowsDriveLetter(certfile))) certfile = confdir + certfile; - if(keyfile[0] != '/') + if ((keyfile[0] != '/') && (!ServerInstance->Config->StartsWithWindowsDriveLetter(keyfile))) keyfile = confdir + keyfile; int ret; - + + if (cred_alloc) + { + // Deallocate the old credentials + gnutls_dh_params_deinit(dh_params); + gnutls_certificate_free_credentials(x509_cred); + } + else + cred_alloc = true; + + if((ret = gnutls_certificate_allocate_credentials(&x509_cred)) < 0) + ServerInstance->Logs->Log("m_ssl_gnutls",DEFAULT, "m_ssl_gnutls.so: Failed to allocate certificate credentials: %s", gnutls_strerror(ret)); + + if((ret = gnutls_dh_params_init(&dh_params)) < 0) + ServerInstance->Logs->Log("m_ssl_gnutls",DEFAULT, "m_ssl_gnutls.so: Failed to initialise DH parameters: %s", gnutls_strerror(ret)); + if((ret =gnutls_certificate_set_x509_trust_file(x509_cred, cafile.c_str(), GNUTLS_X509_FMT_PEM)) < 0) ServerInstance->Logs->Log("m_ssl_gnutls",DEFAULT, "m_ssl_gnutls.so: Failed to set X.509 trust file '%s': %s", cafile.c_str(), gnutls_strerror(ret)); @@ -273,6 +293,8 @@ class ModuleSSLGnuTLS : public Module gnutls_dh_params_deinit(dh_params); gnutls_certificate_free_credentials(x509_cred); gnutls_global_deinit(); + ServerInstance->Modules->UnpublishInterface("BufferedSocketHook", this); + delete[] sessions; } virtual void OnCleanup(int target_type, void* item) @@ -281,11 +303,12 @@ class ModuleSSLGnuTLS : public Module { User* user = (User*)item; - if(user->io) + if (user->io == this) { // User is using SSL, they're a local user, and they're using one of *our* SSL ports. // Potentially there could be multiple SSL modules loaded at once on different ports. - User::QuitUser(ServerInstance, user, "SSL module unloading"); + ServerInstance->Users->QuitUser(user, "SSL module unloading"); + user->io = NULL; } if (user->GetExt("ssl_cert", dummy)) { @@ -294,8 +317,6 @@ class ModuleSSLGnuTLS : public Module delete tofree; user->Shrink("ssl_cert"); } - - user->io = NULL; } } @@ -314,7 +335,7 @@ class ModuleSSLGnuTLS : public Module virtual Version GetVersion() { - return Version(1, 2, 0, 0, VF_VENDOR, API_VERSION); + return Version("$Id$", VF_VENDOR, API_VERSION); } @@ -386,11 +407,15 @@ class ModuleSSLGnuTLS : public Module virtual void OnRawSocketAccept(int fd, const std::string &ip, int localport) { /* Are there any possibilities of an out of range fd? Hope not, but lets be paranoid */ - if ((fd < 0) || (fd > MAX_DESCRIPTORS)) + if ((fd < 0) || (fd > ServerInstance->SE->GetMaxFds() - 1)) return; issl_session* session = &sessions[fd]; + /* For STARTTLS: Don't try and init a session on a socket that already has a session */ + if (session->sess) + return; + session->fd = fd; session->inbuf = new char[inbufsize]; session->inbufoffset = 0; @@ -419,7 +444,7 @@ class ModuleSSLGnuTLS : public Module virtual void OnRawSocketConnect(int fd) { /* Are there any possibilities of an out of range fd? Hope not, but lets be paranoid */ - if ((fd < 0) || (fd > MAX_DESCRIPTORS)) + if ((fd < 0) || (fd > ServerInstance->SE->GetMaxFds() - 1)) return; issl_session* session = &sessions[fd]; @@ -441,7 +466,7 @@ class ModuleSSLGnuTLS : public Module virtual void OnRawSocketClose(int fd) { /* Are there any possibilities of an out of range fd? Hope not, but lets be paranoid */ - if ((fd < 0) || (fd > MAX_DESCRIPTORS)) + if ((fd < 0) || (fd > ServerInstance->SE->GetMaxFds())) return; CloseSession(&sessions[fd]); @@ -460,7 +485,7 @@ class ModuleSSLGnuTLS : public Module virtual int OnRawSocketRead(int fd, char* buffer, unsigned int count, int &readresult) { /* Are there any possibilities of an out of range fd? Hope not, but lets be paranoid */ - if ((fd < 0) || (fd > MAX_DESCRIPTORS)) + if ((fd < 0) || (fd > ServerInstance->SE->GetMaxFds() - 1)) return 0; issl_session* session = &sessions[fd]; @@ -529,7 +554,7 @@ class ModuleSSLGnuTLS : public Module { memcpy(buffer, session->inbuf, count); // Move the stuff left in inbuf to the beginning of it - memcpy(session->inbuf, session->inbuf + count, (length - count)); + memmove(session->inbuf, session->inbuf + count, (length - count)); // Now we need to set session->inbufoffset to the amount of data still waiting to be handed to insp. session->inbufoffset = length - count; // Insp uses readresult as the count of how much data there is in buffer, so: @@ -555,7 +580,7 @@ class ModuleSSLGnuTLS : public Module virtual int OnRawSocketWrite(int fd, const char* buffer, int count) { /* Are there any possibilities of an out of range fd? Hope not, but lets be paranoid */ - if ((fd < 0) || (fd > MAX_DESCRIPTORS)) + if ((fd < 0) || (fd > ServerInstance->SE->GetMaxFds() - 1)) return 0; issl_session* session = &sessions[fd]; @@ -623,7 +648,7 @@ class ModuleSSLGnuTLS : public Module // Bugfix, only send this numeric for *our* SSL users if (dest->GetExt("ssl", dummy) || ((IS_LOCAL(dest) && (dest->io == this)))) { - ServerInstance->SendWhoisLine(source, dest, 320, "%s %s :is using a secure connection", source->nick, dest->nick); + ServerInstance->SendWhoisLine(source, dest, 320, "%s %s :is using a secure connection", source->nick.c_str(), dest->nick.c_str()); } } @@ -715,14 +740,7 @@ class ModuleSSLGnuTLS : public Module if ((user->GetExt("ssl", dummy)) && (IS_LOCAL(user))) { // Tell whatever protocol module we're using that we need to inform other servers of this metadata NOW. - std::deque* metadata = new std::deque; - metadata->push_back(user->nick); - metadata->push_back("ssl"); // The metadata id - metadata->push_back("ON"); // The value to send - Event* event = new Event((char*)metadata,(Module*)this,"send_metadata"); - event->Send(ServerInstance); // Trigger the event. We don't care what module picks it up. - delete event; - delete metadata; + ServerInstance->PI->SendMetaData(user, TYPE_USER, "SSL", "on"); VerifyCertificate(&sessions[user->GetFd()],user); if (sessions[user->GetFd()].sess) @@ -730,7 +748,7 @@ class ModuleSSLGnuTLS : public Module std::string cipher = gnutls_kx_get_name(gnutls_kx_get(sessions[user->GetFd()].sess)); cipher.append("-").append(gnutls_cipher_get_name(gnutls_cipher_get(sessions[user->GetFd()].sess))).append("-"); cipher.append(gnutls_mac_get_name(gnutls_mac_get(sessions[user->GetFd()].sess))); - user->WriteServ("NOTICE %s :*** You are connected using SSL cipher \"%s\"", user->nick, cipher.c_str()); + user->WriteServ("NOTICE %s :*** You are connected using SSL cipher \"%s\"", user->nick.c_str(), cipher.c_str()); } } } @@ -902,8 +920,27 @@ class ModuleSSLGnuTLS : public Module void OnEvent(Event* ev) { GenericCapHandler(ev, "tls", "tls"); + if (ev->GetEventID() == "cap_req") + { + /* GenericCapHandler() Extends("tls") a user if it does + * CAP REQ tls. Check if this was done. + */ + CapData *data = (CapData *) ev->GetData(); + if (data->user->Shrink("tls")) + { + /* Not in our spec?!?! */ + data->user->io = this; + OnRawSocketAccept(data->user->GetFd(), data->user->GetIPString(), + data->user->GetPort()); + } + } } + void Prioritize() + { + Module* server = ServerInstance->Modules->Find("m_spanningtree.so"); + ServerInstance->Modules->SetPriority(this, I_OnPostConnect, PRIO_AFTER, &server); + } }; MODULE_INIT(ModuleSSLGnuTLS)