From b200104cf2c61465acecaca111e3ec727fc3b954 Mon Sep 17 00:00:00 2001
From: Attila Molnar <attilamolnar@hush.com>
Date: Wed, 24 Aug 2016 12:27:51 +0200
Subject: [PATCH] Check for errors after calling IOHookProvider::OnAccept()

---
 src/modules/m_httpd.cpp                    | 12 ++++++++++--
 src/modules/m_spanningtree/treesocket1.cpp | 12 ++++++++++--
 src/usermanager.cpp                        | 12 ++++++++++--
 3 files changed, 30 insertions(+), 6 deletions(-)

diff --git a/src/modules/m_httpd.cpp b/src/modules/m_httpd.cpp
index 64bef70d1..6055d1f77 100644
--- a/src/modules/m_httpd.cpp
+++ b/src/modules/m_httpd.cpp
@@ -76,10 +76,18 @@ class HttpServerSocket : public BufferedSocket, public Timer, public insp::intru
 		, postsize(0)
 		, waitingcull(false)
 	{
-		ServerInstance->Timers.AddTimer(this);
-
 		if ((!via->iohookprovs.empty()) && (via->iohookprovs.back()))
+		{
 			via->iohookprovs.back()->OnAccept(this, client, server);
+			// IOHook may have errored
+			if (!getError().empty())
+			{
+				AddToCull();
+				return;
+			}
+		}
+
+		ServerInstance->Timers.AddTimer(this);
 	}
 
 	~HttpServerSocket()
diff --git a/src/modules/m_spanningtree/treesocket1.cpp b/src/modules/m_spanningtree/treesocket1.cpp
index a96c4a90c..370c38d2c 100644
--- a/src/modules/m_spanningtree/treesocket1.cpp
+++ b/src/modules/m_spanningtree/treesocket1.cpp
@@ -63,8 +63,16 @@ TreeSocket::TreeSocket(int newfd, ListenSocket* via, irc::sockets::sockaddrs* cl
 	for (ListenSocket::IOHookProvList::iterator i = via->iohookprovs.begin(); i != via->iohookprovs.end(); ++i)
 	{
 		ListenSocket::IOHookProvRef& iohookprovref = *i;
-		if (iohookprovref)
-			iohookprovref->OnAccept(this, client, server);
+		if (!iohookprovref)
+			continue;
+
+		iohookprovref->OnAccept(this, client, server);
+		// IOHook could have encountered a fatal error, e.g. if the TLS ClientHello was already in the queue and there was no common TLS version
+		if (!getError().empty())
+		{
+			TreeSocket::OnError(I_ERR_OTHER);
+			return;
+		}
 	}
 
 	SendCapabilities(1);
diff --git a/src/usermanager.cpp b/src/usermanager.cpp
index 15c86157b..b3ee21f2b 100644
--- a/src/usermanager.cpp
+++ b/src/usermanager.cpp
@@ -91,8 +91,16 @@ void UserManager::AddUser(int socket, ListenSocket* via, irc::sockets::sockaddrs
 	for (ListenSocket::IOHookProvList::iterator i = via->iohookprovs.begin(); i != via->iohookprovs.end(); ++i)
 	{
 		ListenSocket::IOHookProvRef& iohookprovref = *i;
-		if (iohookprovref)
-			iohookprovref->OnAccept(eh, client, server);
+		if (!iohookprovref)
+			continue;
+
+		iohookprovref->OnAccept(eh, client, server);
+		// IOHook could have encountered a fatal error, e.g. if the TLS ClientHello was already in the queue and there was no common TLS version
+		if (!eh->getError().empty())
+		{
+			QuitUser(New, eh->getError());
+			return;
+		}
 	}
 
 	if (this->local_users.size() > ServerInstance->Config->SoftLimit)
-- 
2.39.2