Allow SSL fingerprint hash to be specified, and show fingerprint to client on connect

git-svn-id: http://svn.inspircd.org/repository/trunk/inspircd@12357 e03df62e-2008-0410-955e-edbf42e46eb7

diff --git a/src/modules/extra/m_ssl_gnutls.cpp b/src/modules/extra/m_ssl_gnutls.cpp
index df3709f10a6d457100bf4103701ba1d65374a809..374431752ccdb5c39b6e6c257b0839876a882877 100644 (file)
--- a/src/modules/extra/m_ssl_gnutls.cpp
+++ b/src/modules/extra/m_ssl_gnutls.cpp
@@ -122,12 +122,8 @@ class ModuleSSLGnuTLS : public Module
 
        gnutls_certificate_credentials x509_cred;
        gnutls_dh_params dh_params;
+       gnutls_digest_algorithm_t hash;
 
-       std::string keyfile;
-       std::string certfile;
-
-       std::string cafile;
-       std::string crlfile;
        std::string sslports;
        int dh_bits;
 
@@ -192,32 +188,32 @@ class ModuleSSLGnuTLS : public Module
                if(param != "ssl")
                        return;
 
+               std::string keyfile;
+               std::string certfile;
+               std::string cafile;
+               std::string crlfile;
                OnRehash(user);
 
                ConfigTag* Conf = ServerInstance->Config->ConfValue("gnutls");
 
-               cafile = Conf->getString("cafile");
-               crlfile = Conf->getString("crlfile");
-               certfile = Conf->getString("certfile");
-               keyfile = Conf->getString("keyfile");
+               cafile = Conf->getString("cafile", "conf/ca.pem");
+               crlfile = Conf->getString("crlfile", "conf/crl.pem");
+               certfile = Conf->getString("certfile", "conf/cert.pem");
+               keyfile = Conf->getString("keyfile", "conf/key.pem");
                dh_bits = Conf->getInt("dhbits");
-
-               // Set all the default values needed.
-               if (cafile.empty())
-                       cafile = "conf/ca.pem";
-
-               if (crlfile.empty())
-                       crlfile = "conf/crl.pem";
-
-               if (certfile.empty())
-                       certfile = "conf/cert.pem";
-
-               if (keyfile.empty())
-                       keyfile = "conf/key.pem";
+               std::string hashname = Conf->getString("hash", "md5");
 
                if((dh_bits != 768) && (dh_bits != 1024) && (dh_bits != 2048) && (dh_bits != 3072) && (dh_bits != 4096))
                        dh_bits = 1024;
 
+               if (hashname == "md5")
+                       hash = GNUTLS_DIG_MD5;
+               else if (hashname == "sha1")
+                       hash = GNUTLS_DIG_SHA1;
+               else
+                       throw ModuleException("Unknown hash type " + hashname);
+
+
                int ret;
 
                if (cred_alloc)
@@ -556,11 +552,16 @@ class ModuleSSLGnuTLS : public Module
                {
                        if (sessions[user->GetFd()].sess)
                        {
-                               SSLCertSubmission(user, this, ServerInstance->Modules->Find("m_sslinfo.so"), sessions[user->GetFd()].cert);
+                               ssl_cert* cert = sessions[user->GetFd()].cert;
+                               SSLCertSubmission(user, this, ServerInstance->Modules->Find("m_sslinfo.so"), cert);
                                std::string cipher = gnutls_kx_get_name(gnutls_kx_get(sessions[user->GetFd()].sess));
                                cipher.append("-").append(gnutls_cipher_get_name(gnutls_cipher_get(sessions[user->GetFd()].sess))).append("-");
                                cipher.append(gnutls_mac_get_name(gnutls_mac_get(sessions[user->GetFd()].sess)));
-                               user->WriteServ("NOTICE %s :*** You are connected using SSL cipher \"%s\"", user->nick.c_str(), cipher.c_str());
+                               if (cert->fingerprint.empty())
+                                       user->WriteServ("NOTICE %s :*** You are connected using SSL cipher \"%s\"", user->nick.c_str(), cipher.c_str());
+                               else
+                                       user->WriteServ("NOTICE %s :*** You are connected using SSL cipher \"%s\""
+                                               " and your SSL fingerprint is %s", user->nick.c_str(), cipher.c_str(), cert->fingerprint.c_str());
                        }
                }
        }
@@ -652,7 +653,7 @@ class ModuleSSLGnuTLS : public Module
                gnutls_x509_crt_get_issuer_dn(cert, name, &name_size);
                certinfo->issuer = name;
 
-               if ((ret = gnutls_x509_crt_get_fingerprint(cert, GNUTLS_DIG_MD5, digest, &digest_size)) < 0)
+               if ((ret = gnutls_x509_crt_get_fingerprint(cert, hash, digest, &digest_size)) < 0)
                {
                        certinfo->error = gnutls_strerror(ret);
                }

diff --git a/src/modules/extra/m_ssl_openssl.cpp b/src/modules/extra/m_ssl_openssl.cpp
index c46b93117cc95b5d3fe9b0283a057dcd180d6bcb..26110596923c8f47754a89fe9cfdeccecee37173 100644 (file)
--- a/src/modules/extra/m_ssl_openssl.cpp
+++ b/src/modules/extra/m_ssl_openssl.cpp
@@ -89,12 +89,8 @@ class ModuleSSLOpenSSL : public Module
 
        char cipher[MAXBUF];
 
-       std::string keyfile;
-       std::string certfile;
-       std::string cafile;
-       // std::string crlfile;
-       std::string dhfile;
        std::string sslports;
+       bool use_sha;
 
        ServiceProvider iohook;
  public:
@@ -168,27 +164,23 @@ class ModuleSSLOpenSSL : public Module
                if (param != "ssl")
                        return;
 
+               std::string keyfile;
+               std::string certfile;
+               std::string cafile;
+               std::string dhfile;
                OnRehash(user);
 
-               ConfigReader Conf;
-
-               cafile   = Conf.ReadValue("openssl", "cafile", 0);
-               certfile = Conf.ReadValue("openssl", "certfile", 0);
-               keyfile  = Conf.ReadValue("openssl", "keyfile", 0);
-               dhfile   = Conf.ReadValue("openssl", "dhfile", 0);
-
-               // Set all the default values needed.
-               if (cafile.empty())
-                       cafile = "conf/ca.pem";
+               ConfigTag* conf = ServerInstance->Config->ConfValue("openssl");
 
-               if (certfile.empty())
-                       certfile = "conf/cert.pem";
+               cafile   = conf->getString("cafile", "conf/ca.pem");
+               certfile = conf->getString("certfile", "conf/cert.pem");
+               keyfile  = conf->getString("keyfile", "conf/key.pem");
+               dhfile   = conf->getString("dhfile", "conf/dhparams.pem");
+               std::string hash = conf->getString("hash", "md5");
+               if (hash != "sha1" && hash != "md5")
+                       throw ModuleException("Unknown hash type " + hash);
+               use_sha = (hash == "sha1");
 
-               if (keyfile.empty())
-                       keyfile = "conf/key.pem";
-
-               if (dhfile.empty())
-                       dhfile = "conf/dhparams.pem";
 
                /* Load our keys and certificates
                 * NOTE: OpenSSL's error logging API sucks, don't blame us for this clusterfuck.
@@ -253,6 +245,10 @@ class ModuleSSLOpenSSL : public Module
                        if (sessions[user->GetFd()].sess)
                        {
                                SSLCertSubmission(user, this, ServerInstance->Modules->Find("m_sslinfo.so"), sessions[user->GetFd()].cert);
+
+                               if (!sessions[user->GetFd()].cert->fingerprint.empty())
+                                       user->WriteServ("NOTICE %s :*** You are connected using SSL fingerprint %s",
+                                               user->nick.c_str(), sessions[user->GetFd()].cert->fingerprint.c_str());
                        }
                }
        }
@@ -382,7 +378,7 @@ class ModuleSSLOpenSSL : public Module
                        char* buffer = ServerInstance->GetReadBuffer();
                        size_t bufsiz = ServerInstance->Config->NetBufferSize;
                        int ret = SSL_read(session->sess, buffer, bufsiz);
-                       
+
                        if (ret > 0)
                        {
                                recvq.append(buffer, ret);
@@ -563,7 +559,7 @@ class ModuleSSLOpenSSL : public Module
                session->cert = certinfo;
                unsigned int n;
                unsigned char md[EVP_MAX_MD_SIZE];
-               const EVP_MD *digest = EVP_md5();
+               const EVP_MD *digest = use_sha ? EVP_sha1() : EVP_md5();
 
                cert = SSL_get_peer_certificate((SSL*)session->sess);
 

diff --git a/src/modules/m_sasl.cpp b/src/modules/m_sasl.cpp
index 4dcb350bc99841fcacda358a0289f51d490b134e..3c3b1d2a00112dbd7f780bfb5e375953f0348f2c 100644 (file)
--- a/src/modules/m_sasl.cpp
+++ b/src/modules/m_sasl.cpp
@@ -252,8 +252,8 @@ class ModuleSASL : public Module
        {
                if (myclass->config->getBool("requiresasl"))
                {
-                       AccountExtItem* ext = GetAccountExtItem();
-                       if (ext && !ext.get(user))
+                       const AccountExtItem* ext = GetAccountExtItem();
+                       if (ext && !ext->get(user))
                                return MOD_RES_DENY;
                }
                return MOD_RES_PASSTHRU;