X-Git-Url: https://git.netwichtig.de/gitweb/?a=blobdiff_plain;f=src%2Fmodules%2Fextra%2Fm_ssl_gnutls.cpp;h=a8a35fa78ee45bdcd4fd0abd9b608fb630cb62c7;hb=ac7defcd3e52695dcf5e5150e9fe3e1624205e64;hp=06daf763ea134ec1d474b87d8111afb811665574;hpb=73977e660f8bcb53c3f7363835d94d3bb7ad021a;p=user%2Fhenk%2Fcode%2Finspircd.git diff --git a/src/modules/extra/m_ssl_gnutls.cpp b/src/modules/extra/m_ssl_gnutls.cpp index 06daf763e..a8a35fa78 100644 --- a/src/modules/extra/m_ssl_gnutls.cpp +++ b/src/modules/extra/m_ssl_gnutls.cpp @@ -28,7 +28,7 @@ #include "ssl.h" #include "m_cap.h" -#ifdef WINDOWS +#ifdef _WIN32 # pragma comment(lib, "libgnutls.lib") # pragma comment(lib, "libgcrypt.lib") # pragma comment(lib, "libgpg-error.lib") @@ -40,17 +40,31 @@ #endif /* $ModDesc: Provides SSL support for clients */ -/* $CompileFlags: pkgconfincludes("gnutls","/gnutls/gnutls.h","") -Wno-deprecated-declarations */ -/* $LinkerFlags: rpath("pkg-config --libs gnutls") pkgconflibs("gnutls","/libgnutls.so","-lgnutls") -lgcrypt */ +/* $CompileFlags: pkgconfincludes("gnutls","/gnutls/gnutls.h","") exec("libgcrypt-config --cflags") */ +/* $LinkerFlags: rpath("pkg-config --libs gnutls") pkgconflibs("gnutls","/libgnutls.so","-lgnutls") exec("libgcrypt-config --libs") */ +/* $NoPedantic */ + +// These don't exist in older GnuTLS versions +#if(GNUTLS_VERSION_MAJOR < 2) +typedef gnutls_certificate_credentials_t gnutls_certificate_credentials; +typedef gnutls_dh_params_t gnutls_dh_params; +#endif enum issl_status { ISSL_NONE, ISSL_HANDSHAKING_READ, ISSL_HANDSHAKING_WRITE, ISSL_HANDSHAKEN, ISSL_CLOSING, ISSL_CLOSED }; static std::vector x509_certs; static gnutls_x509_privkey_t x509_key; +#if(GNUTLS_VERSION_MAJOR < 2 || ( GNUTLS_VERSION_MAJOR == 2 && GNUTLS_VERSION_MINOR < 12 ) ) static int cert_callback (gnutls_session_t session, const gnutls_datum_t * req_ca_rdn, int nreqs, const gnutls_pk_algorithm_t * sign_algos, int sign_algos_length, gnutls_retr_st * st) { st->type = GNUTLS_CRT_X509; +#else +static int cert_callback (gnutls_session_t session, const gnutls_datum_t * req_ca_rdn, int nreqs, + const gnutls_pk_algorithm_t * sign_algos, int sign_algos_length, gnutls_retr2_st * st) { + st->cert_type = GNUTLS_CRT_X509; + st->key_type = GNUTLS_PRIVKEY_X509; +#endif st->ncerts = x509_certs.size(); st->cert.x509 = &x509_certs[0]; st->key.x509 = x509_key; @@ -159,8 +173,8 @@ class ModuleSSLGnuTLS : public Module { issl_session* sessions; - gnutls_certificate_credentials x509_cred; - gnutls_dh_params dh_params; + gnutls_certificate_credentials_t x509_cred; + gnutls_dh_params_t dh_params; gnutls_digest_algorithm_t hash; gnutls_priority_t priority; @@ -328,12 +342,23 @@ class ModuleSSLGnuTLS : public Module gnutls_datum_t key_datum = { (unsigned char*)key_string.data(), static_cast(key_string.length()) }; // If this fails, no SSL port will work. At all. So, do the smart thing - throw a ModuleException - unsigned int certcount = Conf->getInt("certcount", 3); + unsigned int certcount = 3; x509_certs.resize(certcount); ret = gnutls_x509_crt_list_import(&x509_certs[0], &certcount, &cert_datum, GNUTLS_X509_FMT_PEM, GNUTLS_X509_CRT_LIST_IMPORT_FAIL_IF_EXCEED); - if (ret < 0) - throw ModuleException("Unable to load GnuTLS server certificate (" + certfile + "): " + std::string(gnutls_strerror(ret))); - x509_certs.resize(certcount); + if (ret == GNUTLS_E_SHORT_MEMORY_BUFFER) + { + // the buffer wasn't big enough to hold all certs but gnutls updated certcount to the number of available certs, try again with a bigger buffer + x509_certs.resize(certcount); + ret = gnutls_x509_crt_list_import(&x509_certs[0], &certcount, &cert_datum, GNUTLS_X509_FMT_PEM, GNUTLS_X509_CRT_LIST_IMPORT_FAIL_IF_EXCEED); + } + + if (ret <= 0) + { + // clear the vector so we won't call gnutls_x509_crt_deinit() on the (uninited) certs later + x509_certs.clear(); + throw ModuleException("Unable to load GnuTLS server certificate (" + certfile + "): " + ((ret < 0) ? (std::string(gnutls_strerror(ret))) : "No certs could be read")); + } + x509_certs.resize(ret); if((ret = gnutls_x509_privkey_import(x509_key, &key_datum, GNUTLS_X509_FMT_PEM)) < 0) throw ModuleException("Unable to load GnuTLS server private key (" + keyfile + "): " + std::string(gnutls_strerror(ret))); @@ -352,12 +377,15 @@ class ModuleSSLGnuTLS : public Module if ((ret = gnutls_priority_init(&priority, priocstr, &prioerror)) < 0) { // gnutls did not understand the user supplied string, log and fall back to the default priorities - ServerInstance->Logs->Log("m_ssl_gnutls",DEFAULT, "m_ssl_gnutls.so: Failed to set priorities to \"%s\": %s Syntax error at position %ld, falling back to default (NORMAL)", priorities.c_str(), gnutls_strerror(ret), (prioerror - priocstr)); + ServerInstance->Logs->Log("m_ssl_gnutls",DEFAULT, "m_ssl_gnutls.so: Failed to set priorities to \"%s\": %s Syntax error at position %u, falling back to default (NORMAL)", priorities.c_str(), gnutls_strerror(ret), (unsigned int) (prioerror - priocstr)); gnutls_priority_init(&priority, "NORMAL", NULL); } + #if(GNUTLS_VERSION_MAJOR < 2 || ( GNUTLS_VERSION_MAJOR == 2 && GNUTLS_VERSION_MINOR < 12 ) ) gnutls_certificate_client_set_retrieve_function (x509_cred, cert_callback); - + #else + gnutls_certificate_set_retrieve_function (x509_cred, cert_callback); + #endif ret = gnutls_dh_params_init(&dh_params); dh_alloc = (ret >= 0); if (!dh_alloc) @@ -532,7 +560,7 @@ class ModuleSSLGnuTLS : public Module } else if (ret == 0) { - user->SetError("SSL Connection closed"); + user->SetError("Connection closed"); CloseSession(session); return -1; } @@ -627,7 +655,7 @@ class ModuleSSLGnuTLS : public Module } else { - user->SetError(std::string("Handshake Failed - ") + gnutls_strerror(ret)); + user->SetError("Handshake Failed - " + std::string(gnutls_strerror(ret))); CloseSession(session); session->status = ISSL_CLOSING; }