X-Git-Url: https://git.netwichtig.de/gitweb/?a=blobdiff_plain;f=src%2Fmodules%2Fextra%2Fm_ssl_gnutls.cpp;h=adbd48fb64dcf44ebb74c8a63dde347d7a3ce6bc;hb=dd9ba46a3c4daa650ae080a73a650521b1f5fcf4;hp=3f9c4ac5d3258db8bc467d0d9813191339879000;hpb=de35a20ab7521ccd310bbc922c75b144b9a13fc2;p=user%2Fhenk%2Fcode%2Finspircd.git diff --git a/src/modules/extra/m_ssl_gnutls.cpp b/src/modules/extra/m_ssl_gnutls.cpp index 3f9c4ac5d..adbd48fb6 100644 --- a/src/modules/extra/m_ssl_gnutls.cpp +++ b/src/modules/extra/m_ssl_gnutls.cpp @@ -12,24 +12,13 @@ */ #include "inspircd.h" - #include #include - -#include "inspircd_config.h" -#include "configreader.h" -#include "users.h" -#include "channels.h" -#include "modules.h" -#include "socket.h" -#include "hashcomp.h" #include "transport.h" #include "m_cap.h" #ifdef WINDOWS #pragma comment(lib, "libgnutls-13.lib") -#undef MAX_DESCRIPTORS -#define MAX_DESCRIPTORS 10000 #endif /* $ModDesc: Provides SSL support for clients */ @@ -57,6 +46,11 @@ bool isin(const std::string &host, int port, const std::vector &por class issl_session : public classbase { public: + issl_session() + { + sess = NULL; + } + gnutls_session_t sess; issl_status status; std::string outbuf; @@ -75,10 +69,23 @@ class CommandStartTLS : public Command this->source = "m_ssl_gnutls.so"; } - CmdResult Handle (const char* const* parameters, int pcnt, User *user) + CmdResult Handle (const std::vector ¶meters, User *user) { - user->io = Caller; - Caller->OnRawSocketAccept(user->GetFd(), user->GetIPString(), user->GetPort()); + if (user->registered == REG_ALL) + { + ServerInstance->Users->QuitUser(user, "STARTTLS not allowed after client registration"); + } + else + { + if (!user->GetIOHook()) + { + user->WriteNumeric(670, "%s :STARTTLS successful, go ahead with TLS handshake", user->nick.c_str()); + user->AddIOHook(Caller); + Caller->OnRawSocketAccept(user->GetFd(), user->GetIPString(), user->GetPort()); + } + else + user->WriteNumeric(671, "%s :STARTTLS failure", user->nick.c_str()); + } return CMD_FAILURE; } @@ -94,7 +101,7 @@ class ModuleSSLGnuTLS : public Module std::vector listenports; int inbufsize; - issl_session sessions[MAX_DESCRIPTORS]; + issl_session* sessions; gnutls_certificate_credentials x509_cred; gnutls_dh_params dh_params; @@ -107,6 +114,7 @@ class ModuleSSLGnuTLS : public Module int dh_bits; int clientactive; + bool cred_alloc; CommandStartTLS* starttls; @@ -117,18 +125,14 @@ class ModuleSSLGnuTLS : public Module { ServerInstance->Modules->PublishInterface("BufferedSocketHook", this); + sessions = new issl_session[ServerInstance->SE->GetMaxFds()]; + // Not rehashable...because I cba to reduce all the sizes of existing buffers. inbufsize = ServerInstance->Config->NetBufferSize; gnutls_global_init(); // This must be called once in the program - if(gnutls_certificate_allocate_credentials(&x509_cred) != 0) - ServerInstance->Logs->Log("m_ssl_gnutls",DEFAULT, "m_ssl_gnutls.so: Failed to allocate certificate credentials"); - - // Guessing return meaning - if(gnutls_dh_params_init(&dh_params) < 0) - ServerInstance->Logs->Log("m_ssl_gnutls",DEFAULT, "m_ssl_gnutls.so: Failed to initialise DH parameters"); - + cred_alloc = false; // Needs the flag as it ignores a plain /rehash OnRehash(NULL,"ssl"); @@ -220,20 +224,35 @@ class ModuleSSLGnuTLS : public Module dh_bits = 1024; // Prepend relative paths with the path to the config directory. - if(cafile[0] != '/') + if ((cafile[0] != '/') && (!ServerInstance->Config->StartsWithWindowsDriveLetter(cafile))) cafile = confdir + cafile; - if(crlfile[0] != '/') + if ((crlfile[0] != '/') && (!ServerInstance->Config->StartsWithWindowsDriveLetter(crlfile))) crlfile = confdir + crlfile; - if(certfile[0] != '/') + if ((certfile[0] != '/') && (!ServerInstance->Config->StartsWithWindowsDriveLetter(certfile))) certfile = confdir + certfile; - if(keyfile[0] != '/') + if ((keyfile[0] != '/') && (!ServerInstance->Config->StartsWithWindowsDriveLetter(keyfile))) keyfile = confdir + keyfile; int ret; - + + if (cred_alloc) + { + // Deallocate the old credentials + gnutls_dh_params_deinit(dh_params); + gnutls_certificate_free_credentials(x509_cred); + } + else + cred_alloc = true; + + if((ret = gnutls_certificate_allocate_credentials(&x509_cred)) < 0) + ServerInstance->Logs->Log("m_ssl_gnutls",DEFAULT, "m_ssl_gnutls.so: Failed to allocate certificate credentials: %s", gnutls_strerror(ret)); + + if((ret = gnutls_dh_params_init(&dh_params)) < 0) + ServerInstance->Logs->Log("m_ssl_gnutls",DEFAULT, "m_ssl_gnutls.so: Failed to initialise DH parameters: %s", gnutls_strerror(ret)); + if((ret =gnutls_certificate_set_x509_trust_file(x509_cred, cafile.c_str(), GNUTLS_X509_FMT_PEM)) < 0) ServerInstance->Logs->Log("m_ssl_gnutls",DEFAULT, "m_ssl_gnutls.so: Failed to set X.509 trust file '%s': %s", cafile.c_str(), gnutls_strerror(ret)); @@ -243,7 +262,7 @@ class ModuleSSLGnuTLS : public Module if((ret = gnutls_certificate_set_x509_key_file (x509_cred, certfile.c_str(), keyfile.c_str(), GNUTLS_X509_FMT_PEM)) < 0) { // If this fails, no SSL port will work. At all. So, do the smart thing - throw a ModuleException - throw ModuleException("Unable to load GnuTLS server certificate: " + std::string(gnutls_strerror(ret))); + throw ModuleException("Unable to load GnuTLS server certificate (" + std::string(certfile) + ", key: " + keyfile + "): " + std::string(gnutls_strerror(ret))); } // This may be on a large (once a day or week) timer eventually. @@ -270,6 +289,8 @@ class ModuleSSLGnuTLS : public Module gnutls_dh_params_deinit(dh_params); gnutls_certificate_free_credentials(x509_cred); gnutls_global_deinit(); + ServerInstance->Modules->UnpublishInterface("BufferedSocketHook", this); + delete[] sessions; } virtual void OnCleanup(int target_type, void* item) @@ -278,11 +299,12 @@ class ModuleSSLGnuTLS : public Module { User* user = (User*)item; - if(user->io) + if (user->GetIOHook() == this) { // User is using SSL, they're a local user, and they're using one of *our* SSL ports. // Potentially there could be multiple SSL modules loaded at once on different ports. - User::QuitUser(ServerInstance, user, "SSL module unloading"); + ServerInstance->Users->QuitUser(user, "SSL module unloading"); + user->DelIOHook(); } if (user->GetExt("ssl_cert", dummy)) { @@ -291,8 +313,6 @@ class ModuleSSLGnuTLS : public Module delete tofree; user->Shrink("ssl_cert"); } - - user->io = NULL; } } @@ -311,7 +331,7 @@ class ModuleSSLGnuTLS : public Module virtual Version GetVersion() { - return Version(1, 2, 0, 0, VF_VENDOR, API_VERSION); + return Version("$Id$", VF_VENDOR, API_VERSION); } @@ -322,10 +342,10 @@ class ModuleSSLGnuTLS : public Module virtual void OnHookUserIO(User* user, const std::string &targetip) { - if (!user->io && isin(targetip,user->GetPort(),listenports)) + if (!user->GetIOHook() && isin(targetip,user->GetPort(),listenports)) { /* Hook the user with our module */ - user->io = this; + user->AddIOHook(this); } } @@ -341,7 +361,7 @@ class ModuleSSLGnuTLS : public Module const char* ret = "OK"; try { - ret = ServerInstance->Config->AddIOHook((Module*)this, (BufferedSocket*)ISR->Sock) ? "OK" : NULL; + ret = ISR->Sock->AddIOHook((Module*)this) ? "OK" : NULL; } catch (ModuleException &e) { @@ -351,7 +371,7 @@ class ModuleSSLGnuTLS : public Module } else if (strcmp("IS_UNHOOK", request->GetId()) == 0) { - return ServerInstance->Config->DelIOHook((BufferedSocket*)ISR->Sock) ? "OK" : NULL; + return ISR->Sock->DelIOHook() ? "OK" : NULL; } else if (strcmp("IS_HSDONE", request->GetId()) == 0) { @@ -383,11 +403,15 @@ class ModuleSSLGnuTLS : public Module virtual void OnRawSocketAccept(int fd, const std::string &ip, int localport) { /* Are there any possibilities of an out of range fd? Hope not, but lets be paranoid */ - if ((fd < 0) || (fd > MAX_DESCRIPTORS)) + if ((fd < 0) || (fd > ServerInstance->SE->GetMaxFds() - 1)) return; issl_session* session = &sessions[fd]; + /* For STARTTLS: Don't try and init a session on a socket that already has a session */ + if (session->sess) + return; + session->fd = fd; session->inbuf = new char[inbufsize]; session->inbufoffset = 0; @@ -416,7 +440,7 @@ class ModuleSSLGnuTLS : public Module virtual void OnRawSocketConnect(int fd) { /* Are there any possibilities of an out of range fd? Hope not, but lets be paranoid */ - if ((fd < 0) || (fd > MAX_DESCRIPTORS)) + if ((fd < 0) || (fd > ServerInstance->SE->GetMaxFds() - 1)) return; issl_session* session = &sessions[fd]; @@ -438,7 +462,7 @@ class ModuleSSLGnuTLS : public Module virtual void OnRawSocketClose(int fd) { /* Are there any possibilities of an out of range fd? Hope not, but lets be paranoid */ - if ((fd < 0) || (fd > MAX_DESCRIPTORS)) + if ((fd < 0) || (fd > ServerInstance->SE->GetMaxFds())) return; CloseSession(&sessions[fd]); @@ -457,7 +481,7 @@ class ModuleSSLGnuTLS : public Module virtual int OnRawSocketRead(int fd, char* buffer, unsigned int count, int &readresult) { /* Are there any possibilities of an out of range fd? Hope not, but lets be paranoid */ - if ((fd < 0) || (fd > MAX_DESCRIPTORS)) + if ((fd < 0) || (fd > ServerInstance->SE->GetMaxFds() - 1)) return 0; issl_session* session = &sessions[fd]; @@ -526,7 +550,7 @@ class ModuleSSLGnuTLS : public Module { memcpy(buffer, session->inbuf, count); // Move the stuff left in inbuf to the beginning of it - memcpy(session->inbuf, session->inbuf + count, (length - count)); + memmove(session->inbuf, session->inbuf + count, (length - count)); // Now we need to set session->inbufoffset to the amount of data still waiting to be handed to insp. session->inbufoffset = length - count; // Insp uses readresult as the count of how much data there is in buffer, so: @@ -552,7 +576,7 @@ class ModuleSSLGnuTLS : public Module virtual int OnRawSocketWrite(int fd, const char* buffer, int count) { /* Are there any possibilities of an out of range fd? Hope not, but lets be paranoid */ - if ((fd < 0) || (fd > MAX_DESCRIPTORS)) + if ((fd < 0) || (fd > ServerInstance->SE->GetMaxFds() - 1)) return 0; issl_session* session = &sessions[fd]; @@ -618,9 +642,9 @@ class ModuleSSLGnuTLS : public Module return; // Bugfix, only send this numeric for *our* SSL users - if (dest->GetExt("ssl", dummy) || ((IS_LOCAL(dest) && (dest->io == this)))) + if (dest->GetExt("ssl", dummy) || ((IS_LOCAL(dest) && (dest->GetIOHook() == this)))) { - ServerInstance->SendWhoisLine(source, dest, 320, "%s %s :is using a secure connection", source->nick, dest->nick); + ServerInstance->SendWhoisLine(source, dest, 320, "%s %s :is using a secure connection", source->nick.c_str(), dest->nick.c_str()); } } @@ -712,14 +736,7 @@ class ModuleSSLGnuTLS : public Module if ((user->GetExt("ssl", dummy)) && (IS_LOCAL(user))) { // Tell whatever protocol module we're using that we need to inform other servers of this metadata NOW. - std::deque* metadata = new std::deque; - metadata->push_back(user->uuid); - metadata->push_back("ssl"); // The metadata id - metadata->push_back("ON"); // The value to send - Event* event = new Event((char*)metadata,(Module*)this,"send_metadata"); - event->Send(ServerInstance); // Trigger the event. We don't care what module picks it up. - delete event; - delete metadata; + ServerInstance->PI->SendMetaData(user, TYPE_USER, "SSL", "on"); VerifyCertificate(&sessions[user->GetFd()],user); if (sessions[user->GetFd()].sess) @@ -727,7 +744,7 @@ class ModuleSSLGnuTLS : public Module std::string cipher = gnutls_kx_get_name(gnutls_kx_get(sessions[user->GetFd()].sess)); cipher.append("-").append(gnutls_cipher_get_name(gnutls_cipher_get(sessions[user->GetFd()].sess))).append("-"); cipher.append(gnutls_mac_get_name(gnutls_mac_get(sessions[user->GetFd()].sess))); - user->WriteServ("NOTICE %s :*** You are connected using SSL cipher \"%s\"", user->nick, cipher.c_str()); + user->WriteServ("NOTICE %s :*** You are connected using SSL cipher \"%s\"", user->nick.c_str(), cipher.c_str()); } } } @@ -901,7 +918,7 @@ class ModuleSSLGnuTLS : public Module GenericCapHandler(ev, "tls", "tls"); } - void Prioritize() + void Prioritize() { Module* server = ServerInstance->Modules->Find("m_spanningtree.so"); ServerInstance->Modules->SetPriority(this, I_OnPostConnect, PRIO_AFTER, &server);