Merge pull request #230 from Robby-/insp20-openssl

[2.0] m_ssl_openssl: Show cipher used on connect and allow available ciphers to be customized.

diff --git a/src/modules/extra/m_ssl_openssl.cpp b/src/modules/extra/m_ssl_openssl.cpp
index 0a5a76792d1a35691c8960e948819f9dbf7448ca..fa9442a00d89024207c36498d143d5f7f31d3088 100644 (file)
--- a/src/modules/extra/m_ssl_openssl.cpp
+++ b/src/modules/extra/m_ssl_openssl.cpp
@@ -198,6 +198,13 @@ class ModuleSSLOpenSSL : public Module
                        throw ModuleException("Unknown hash type " + hash);
                use_sha = (hash == "sha1");
 
+               std::string ciphers = conf->getString("ciphers", "ALL");
+               if ((!SSL_CTX_set_cipher_list(ctx, ciphers.c_str())) || (!SSL_CTX_set_cipher_list(clictx, ciphers.c_str())))
+               {
+                       ServerInstance->Logs->Log("m_ssl_openssl",DEFAULT, "m_ssl_openssl.so: Can't set cipher list to %s.", ciphers.c_str());
+                       ERR_print_errors_cb(error_callback, this);
+               }
+
 
                /* Load our keys and certificates
                 * NOTE: OpenSSL's error logging API sucks, don't blame us for this clusterfuck.
@@ -262,8 +269,10 @@ class ModuleSSLOpenSSL : public Module
                        if (sessions[user->eh.GetFd()].sess)
                        {
                                if (!sessions[user->eh.GetFd()].cert->fingerprint.empty())
-                                       user->WriteServ("NOTICE %s :*** You are connected using SSL fingerprint %s",
-                                               user->nick.c_str(), sessions[user->eh.GetFd()].cert->fingerprint.c_str());
+                                       user->WriteServ("NOTICE %s :*** You are connected using SSL cipher \"%s\""
+                                               " and your SSL fingerprint is %s", user->nick.c_str(), SSL_get_cipher(sessions[user->eh.GetFd()].sess), sessions[user->eh.GetFd()].cert->fingerprint.c_str());
+                               else
+                                       user->WriteServ("NOTICE %s :*** You are connected using SSL cipher \"%s\"", user->nick.c_str(), SSL_get_cipher(sessions[user->eh.GetFd()].sess));
                        }
                }
        }