Cipher list selection for OpenSSL

[ngircd.git] / src / ngircd / conn-ssl.c

diff --git a/src/ngircd/conn-ssl.c b/src/ngircd/conn-ssl.c
index 4156fb192a0b990c644f014c30848ab5d433db75..059e871ddaa38af341e995f577225fad84940091 100644 (file)
--- a/src/ngircd/conn-ssl.c
+++ b/src/ngircd/conn-ssl.c
@@ -61,7 +61,7 @@ static gnutls_dh_params_t dh_params;
 static bool ConnSSL_LoadServerKey_gnutls PARAMS(( void ));
 #endif
 
-#define CERTFP_LEN     (20 * 2 + 1)
+#define SHA1_STRING_LEN        (20 * 2 + 1)
 
 static bool ConnSSL_Init_SSL PARAMS(( CONNECTION *c ));
 static int ConnectAccept PARAMS(( CONNECTION *c, bool connect ));
@@ -285,8 +285,10 @@ ConnSSL_InitLibrary( void )
        if (!RAND_status()) {
                Log(LOG_ERR, "OpenSSL PRNG not seeded: /dev/urandom missing?");
                /*
-                * it is probably best to fail and let the user install EGD or a similar program if no kernel random device is available.
-                * According to OpenSSL RAND_egd(3): "The automatic query of /var/run/egd-pool et al was added in OpenSSL 0.9.7";
+                * it is probably best to fail and let the user install EGD or
+                * a similar program if no kernel random device is available.
+                * According to OpenSSL RAND_egd(3): "The automatic query of
+                * /var/run/egd-pool et al was added in OpenSSL 0.9.7";
                 * so it makes little sense to deal with PRNGD seeding ourselves.
                 */
                array_free(&Conf_SSLOptions.ListenPorts);
@@ -303,9 +305,23 @@ ConnSSL_InitLibrary( void )
        if (!ConnSSL_LoadServerKey_openssl(newctx))
                goto out;
 
+       if(Conf_SSLOptions.CipherList && *Conf_SSLOptions.CipherList) {
+               if(SSL_CTX_set_cipher_list(newctx, Conf_SSLOptions.CipherList) == 0 ) {
+                       Log(LOG_ERR,
+                           "Failed to apply SSL cipher list \"%s\"!",
+                           Conf_SSLOptions.CipherList);
+                       goto out;
+               } else {
+                       Log(LOG_INFO,
+                           "Successfully applied SSL cipher list: \"%s\".",
+                           Conf_SSLOptions.CipherList);
+               }
+       }
+
        SSL_CTX_set_options(newctx, SSL_OP_SINGLE_DH_USE|SSL_OP_NO_SSLv2);
        SSL_CTX_set_mode(newctx, SSL_MODE_ENABLE_PARTIAL_WRITE);
-       SSL_CTX_set_verify(newctx, SSL_VERIFY_PEER|SSL_VERIFY_CLIENT_ONCE, Verify_openssl);
+       SSL_CTX_set_verify(newctx, SSL_VERIFY_PEER|SSL_VERIFY_CLIENT_ONCE,
+                          Verify_openssl);
        SSL_CTX_free(ssl_ctx);
        ssl_ctx = newctx;
        Log(LOG_INFO, "%s initialized.", SSLeay_version(SSLEAY_VERSION));
@@ -318,12 +334,25 @@ out:
 #ifdef HAVE_LIBGNUTLS
        int err;
        static bool initialized;
-       if (initialized) /* TODO: cannot reload gnutls keys: can't simply free x509 context -- it may still be in use */
+
+       if (initialized) {
+               /* TODO: cannot reload gnutls keys: can't simply free x509
+                * context -- it may still be in use */
                return false;
+       }
+
+       if(Conf_SSLOptions.CipherList != NULL) {
+               Log(LOG_ERR,
+                   "Failed to apply SSL cipher list \"%s\": Not implemented for GnuTLS!",
+                   Conf_SSLOptions.CipherList);
+               array_free(&Conf_SSLOptions.ListenPorts);
+               return false;
+       }
 
        err = gnutls_global_init();
        if (err) {
-               Log(LOG_ERR, "Failed to initialize GnuTLS: %s", gnutls_strerror(err));
+               Log(LOG_ERR, "Failed to initialize GnuTLS: %s",
+                   gnutls_strerror(err));
                array_free(&Conf_SSLOptions.ListenPorts);
                return false;
        }
@@ -331,6 +360,7 @@ out:
                array_free(&Conf_SSLOptions.ListenPorts);
                return false;
        }
+
        Log(LOG_INFO, "GnuTLS %s initialized.", gnutls_check_version(NULL));
        initialized = true;
        return true;
@@ -360,7 +390,7 @@ ConnSSL_LoadServerKey_gnutls(void)
 
        if (array_bytes(&Conf_SSLOptions.KeyFilePassword))
                Log(LOG_WARNING,
-                   "Ignoring KeyFilePassword: Not supported by GnuTLS.");
+                   "Ignoring SSL \"KeyFilePassword\": Not supported by GnuTLS.");
 
        if (!Load_DH_params())
                return false;
@@ -723,7 +753,7 @@ ConnSSL_InitCertFp( CONNECTION *c )
 
        assert(c->ssl_state.fingerprint == NULL);
 
-       c->ssl_state.fingerprint = malloc(CERTFP_LEN);
+       c->ssl_state.fingerprint = malloc(SHA1_STRING_LEN);
        if (!c->ssl_state.fingerprint)
                return 0;
 
@@ -858,7 +888,7 @@ bool
 ConnSSL_SetCertFp(CONNECTION *c, const char *fingerprint)
 {
        assert (c != NULL);
-       c->ssl_state.fingerprint = strdup(fingerprint);
+       c->ssl_state.fingerprint = strndup(fingerprint, SHA1_STRING_LEN - 1);
        return c->ssl_state.fingerprint != NULL;
 }
 #else