X-Git-Url: https://git.netwichtig.de/gitweb/?a=blobdiff_plain;f=src%2Fmodules%2Fextra%2Fm_ssl_gnutls.cpp;h=cc934ff77288fe76b6b1d739bf36630bec82e61d;hb=44f42a13de52c8025942ddab42f51feb36821782;hp=d20b8d53a6d0f3b0c344cb586059b129e8a88743;hpb=2d3684dee52216e539405caca85f05423e0bce43;p=user%2Fhenk%2Fcode%2Finspircd.git diff --git a/src/modules/extra/m_ssl_gnutls.cpp b/src/modules/extra/m_ssl_gnutls.cpp index d20b8d53a..cc934ff77 100644 --- a/src/modules/extra/m_ssl_gnutls.cpp +++ b/src/modules/extra/m_ssl_gnutls.cpp @@ -1,16 +1,26 @@ -/* +------------------------------------+ - * | Inspire Internet Relay Chat Daemon | - * +------------------------------------+ +/* + * InspIRCd -- Internet Relay Chat Daemon * - * InspIRCd: (C) 2002-2010 InspIRCd Development Team - * See: http://wiki.inspircd.org/Credits + * Copyright (C) 2009-2010 Daniel De Graaf + * Copyright (C) 2008 John Brooks + * Copyright (C) 2006-2008 Craig Edwards + * Copyright (C) 2007 Dennis Friis + * Copyright (C) 2006 Oliver Lupton * - * This program is free but copyrighted software; see - * the file COPYING for details. + * This file is part of InspIRCd. InspIRCd is free software: you can + * redistribute it and/or modify it under the terms of the GNU General Public + * License as published by the Free Software Foundation, version 2. * - * --------------------------------------------------- + * This program is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS + * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more + * details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see . */ + #include "inspircd.h" #include #include @@ -18,24 +28,20 @@ #include "ssl.h" #include "m_cap.h" -#ifdef WINDOWS -#pragma comment(lib, "libgnutls-13.lib") -#endif - /* $ModDesc: Provides SSL support for clients */ /* $CompileFlags: pkgconfincludes("gnutls","/gnutls/gnutls.h","") */ -/* $LinkerFlags: rpath("pkg-config --libs gnutls") pkgconflibs("gnutls","/libgnutls.so","-lgnutls") */ +/* $LinkerFlags: rpath("pkg-config --libs gnutls") pkgconflibs("gnutls","/libgnutls.so","-lgnutls") -lgcrypt */ enum issl_status { ISSL_NONE, ISSL_HANDSHAKING_READ, ISSL_HANDSHAKING_WRITE, ISSL_HANDSHAKEN, ISSL_CLOSING, ISSL_CLOSED }; -static gnutls_x509_crt_t x509_cert; +static std::vector x509_certs; static gnutls_x509_privkey_t x509_key; static int cert_callback (gnutls_session_t session, const gnutls_datum_t * req_ca_rdn, int nreqs, const gnutls_pk_algorithm_t * sign_algos, int sign_algos_length, gnutls_retr_st * st) { st->type = GNUTLS_CRT_X509; - st->ncerts = 1; - st->cert.x509 = &x509_cert; + st->ncerts = x509_certs.size(); + st->cert.x509 = &x509_certs[0]; st->key.x509 = x509_key; st->deinit_all = 0; @@ -50,7 +56,7 @@ static ssize_t gnutls_pull_wrapper(gnutls_transport_ptr_t user_wrap, void* buffe errno = EAGAIN; return -1; } - int rv = recv(user->GetFd(), buffer, size, 0); + int rv = recv(user->GetFd(), reinterpret_cast(buffer), size, 0); if (rv < (int)size) ServerInstance->SE->ChangeEventMask(user, FD_READ_WILL_BLOCK); return rv; @@ -64,7 +70,7 @@ static ssize_t gnutls_push_wrapper(gnutls_transport_ptr_t user_wrap, const void* errno = EAGAIN; return -1; } - int rv = send(user->GetFd(), buffer, size, 0); + int rv = send(user->GetFd(), reinterpret_cast(buffer), size, 0); if (rv < (int)size) ServerInstance->SE->ChangeEventMask(user, FD_WRITE_WILL_BLOCK); return rv; @@ -164,7 +170,6 @@ class ModuleSSLGnuTLS : public Module sessions = new issl_session[ServerInstance->SE->GetMaxFds()]; gnutls_global_init(); // This must be called once in the program - gnutls_x509_crt_init(&x509_cert); gnutls_x509_privkey_init(&x509_key); cred_alloc = false; @@ -252,6 +257,10 @@ class ModuleSSLGnuTLS : public Module // Deallocate the old credentials gnutls_dh_params_deinit(dh_params); gnutls_certificate_free_credentials(x509_cred); + + for(unsigned int i=0; i < x509_certs.size(); i++) + gnutls_x509_crt_deinit(x509_certs[i]); + x509_certs.clear(); } else cred_alloc = true; @@ -276,13 +285,17 @@ class ModuleSSLGnuTLS : public Module gnutls_datum_t key_datum = { (unsigned char*)key_string.data(), key_string.length() }; // If this fails, no SSL port will work. At all. So, do the smart thing - throw a ModuleException - if((ret = gnutls_x509_crt_import(x509_cert, &cert_datum, GNUTLS_X509_FMT_PEM)) < 0) + unsigned int certcount = Conf->getInt("certcount", 3); + x509_certs.resize(certcount); + ret = gnutls_x509_crt_list_import(&x509_certs[0], &certcount, &cert_datum, GNUTLS_X509_FMT_PEM, GNUTLS_X509_CRT_LIST_IMPORT_FAIL_IF_EXCEED); + if (ret < 0) throw ModuleException("Unable to load GnuTLS server certificate (" + certfile + "): " + std::string(gnutls_strerror(ret))); + x509_certs.resize(certcount); if((ret = gnutls_x509_privkey_import(x509_key, &key_datum, GNUTLS_X509_FMT_PEM)) < 0) throw ModuleException("Unable to load GnuTLS server private key (" + keyfile + "): " + std::string(gnutls_strerror(ret))); - if((ret = gnutls_certificate_set_x509_key(x509_cred, &x509_cert, 1, x509_key)) < 0) + if((ret = gnutls_certificate_set_x509_key(x509_cred, &x509_certs[0], certcount, x509_key)) < 0) throw ModuleException("Unable to set GnuTLS cert/key pair: " + std::string(gnutls_strerror(ret))); gnutls_certificate_client_set_retrieve_function (x509_cred, cert_callback); @@ -309,7 +322,9 @@ class ModuleSSLGnuTLS : public Module ~ModuleSSLGnuTLS() { - gnutls_x509_crt_deinit(x509_cert); + for(unsigned int i=0; i < x509_certs.size(); i++) + gnutls_x509_crt_deinit(x509_certs[i]); + x509_certs.clear(); gnutls_x509_privkey_deinit(x509_key); if (cred_alloc) { @@ -511,17 +526,11 @@ class ModuleSSLGnuTLS : public Module ServerInstance->SE->ChangeEventMask(user, FD_WANT_SINGLE_WRITE); return 0; } - else if (ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED) + else if (ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED || ret == 0) { ServerInstance->SE->ChangeEventMask(user, FD_WANT_SINGLE_WRITE); return 0; } - else if (ret == 0) - { - CloseSession(session); - user->SetError("SSL Connection closed"); - return -1; - } else // (ret < 0) { user->SetError(gnutls_strerror(ret)); @@ -612,7 +621,7 @@ class ModuleSSLGnuTLS : public Module void VerifyCertificate(issl_session* session, StreamSocket* user) { - if (!session->sess || !user || session->cert) + if (!session->sess || !user) return; unsigned int status;