S2S-TLS/OpenSSL: Set the verification flags only once

[ngircd-alex.git] / src / ngircd / conf.c

diff --git a/src/ngircd/conf.c b/src/ngircd/conf.c
index ec3238373084c79140357e7cd5a646e408c362c3..86a622475c7d0a54dee7ac5b99be9d087271085c 100644 (file)
--- a/src/ngircd/conf.c
+++ b/src/ngircd/conf.c
@@ -113,6 +113,12 @@ ConfSSL_Init(void)
        free(Conf_SSLOptions.CertFile);
        Conf_SSLOptions.CertFile = NULL;
 
+       free(Conf_SSLOptions.CAFile);
+       Conf_SSLOptions.CAFile = NULL;
+
+       free(Conf_SSLOptions.CRLFile);
+       Conf_SSLOptions.CRLFile = NULL;
+
        free(Conf_SSLOptions.DHFile);
        Conf_SSLOptions.DHFile = NULL;
        array_free_wipe(&Conf_SSLOptions.KeyFilePassword);
@@ -436,10 +442,14 @@ Conf_Test( void )
 
 #ifdef SSL_SUPPORT
        puts("[SSL]");
+       printf("  CAFile = %s\n", Conf_SSLOptions.CAFile
+                                       ? Conf_SSLOptions.CAFile : "");
        printf("  CertFile = %s\n", Conf_SSLOptions.CertFile
                                        ? Conf_SSLOptions.CertFile : "");
        printf("  CipherList = %s\n", Conf_SSLOptions.CipherList ?
               Conf_SSLOptions.CipherList : DEFAULT_CIPHERS);
+       printf("  CRLFile = %s\n", Conf_SSLOptions.CRLFile
+                                       ? Conf_SSLOptions.CRLFile : "");
        printf("  DHFile = %s\n", Conf_SSLOptions.DHFile
                                        ? Conf_SSLOptions.DHFile : "");
        printf("  KeyFile = %s\n", Conf_SSLOptions.KeyFile
@@ -465,7 +475,10 @@ Conf_Test( void )
                printf( "  Host = %s\n", Conf_Server[i].host );
                printf( "  Port = %u\n", (unsigned int)Conf_Server[i].port );
 #ifdef SSL_SUPPORT
-               printf( "  SSLConnect = %s\n", yesno_to_str(Conf_Server[i].SSLConnect));
+               printf("  SSLConnect = %s\n",
+                      yesno_to_str(Conf_Server[i].SSLConnect));
+               printf("  SSLVerify = %s\n",
+                      yesno_to_str(Conf_Server[i].SSLVerify));
 #endif
                printf( "  MyPassword = %s\n", Conf_Server[i].pwd_in );
                printf( "  PeerPassword = %s\n", Conf_Server[i].pwd_out );
@@ -903,29 +916,46 @@ Read_Config(bool TestOnly, bool IsStarting)
        struct dirent *entry;
        int i, n;
        FILE *fd;
-       DIR *dh;
+       DIR *dh = NULL;
+
+       if (!NGIRCd_ConfFile[0]) {
+               /* No configuration file name explicitly given on the command
+                * line, use defaults but ignore errors when this file can't be
+                * read later on. */
+               strlcpy(file, SYSCONFDIR, sizeof(file));
+               strlcat(file, CONFIG_FILE, sizeof(file));
+               ptr = file;
+       } else
+               ptr = NGIRCd_ConfFile;
 
-       Config_Error(LOG_INFO, "Using configuration file \"%s\" ...", NGIRCd_ConfFile);
+       Config_Error(LOG_INFO, "Using %s configuration file \"%s\" ...",
+                    !NGIRCd_ConfFile[0] ? "default" : "specified", ptr);
 
        /* Open configuration file */
-       fd = fopen( NGIRCd_ConfFile, "r" );
-       if( ! fd ) {
-               /* No configuration file found! */
-               Config_Error( LOG_ALERT, "Can't read configuration \"%s\": %s",
-                                       NGIRCd_ConfFile, strerror( errno ));
-               if (!IsStarting)
-                       return false;
-               Config_Error( LOG_ALERT, "%s exiting due to fatal errors!", PACKAGE_NAME );
-               exit( 1 );
+       fd = fopen(ptr, "r");
+       if (!fd) {
+               if (NGIRCd_ConfFile[0]) {
+                       Config_Error(LOG_ALERT,
+                                    "Can't read specified configuration file \"%s\": %s",
+                                    ptr, strerror(errno));
+                       if (IsStarting) {
+                               Config_Error(LOG_ALERT,
+                                            "%s exiting due to fatal errors!",
+                                            PACKAGE_NAME);
+                               exit(1);
+                       }
+               }
+               Config_Error(LOG_WARNING,
+                            "Can't read default configuration file \"%s\": %s - Ignored.",
+                            ptr, strerror(errno));
        }
 
        opers_free();
        Set_Defaults(IsStarting);
 
-       if (TestOnly)
+       if (TestOnly && fd)
                Config_Error(LOG_INFO,
-                            "Reading configuration from \"%s\" ...",
-                            NGIRCd_ConfFile );
+                            "Reading configuration from \"%s\" ...", ptr);
 
        /* Clean up server configuration structure: mark all already
         * configured servers as "once" so that they are deleted
@@ -962,16 +992,23 @@ Read_Config(bool TestOnly, bool IsStarting)
        ConfSSL_Init();
 #endif
 
-       Read_Config_File(NGIRCd_ConfFile, fd);
-       fclose(fd);
+       if (fd) {
+               Read_Config_File(ptr, fd);
+               fclose(fd);
+       }
 
        if (Conf_IncludeDir[0]) {
+               /* Include directory was set in the main configuration file. So
+                * use it and show errors. */
                dh = opendir(Conf_IncludeDir);
                if (!dh)
                        Config_Error(LOG_ALERT,
                                     "Can't open include directory \"%s\": %s",
                                     Conf_IncludeDir, strerror(errno));
-       } else {
+       } else if (!NGIRCd_ConfFile[0]) {
+               /* No include dir set in the configuration file used (if any)
+                * but no config file explicitly specified either: so use the
+                * default include path here as well! */
                strlcpy(Conf_IncludeDir, SYSCONFDIR, sizeof(Conf_IncludeDir));
                strlcat(Conf_IncludeDir, CONFIG_DIR, sizeof(Conf_IncludeDir));
                dh = opendir(Conf_IncludeDir);
@@ -1773,6 +1810,16 @@ Handle_SSL(const char *File, int Line, char *Var, char *Arg)
                Conf_SSLOptions.CipherList = strdup_warn(Arg);
                return;
        }
+       if (strcasecmp(Var, "CAFile") == 0) {
+               assert(Conf_SSLOptions.CAFile == NULL);
+               Conf_SSLOptions.CAFile = strdup_warn(Arg);
+               return;
+       }
+       if (strcasecmp(Var, "CRLFile") == 0) {
+               assert(Conf_SSLOptions.CRLFile == NULL);
+               Conf_SSLOptions.CRLFile = strdup_warn(Arg);
+               return;
+       }
 
        Config_Error_Section(File, Line, Var, "SSL");
 }
@@ -1903,7 +1950,11 @@ Handle_SERVER(const char *File, int Line, char *Var, char *Arg )
        if( strcasecmp( Var, "SSLConnect" ) == 0 ) {
                New_Server.SSLConnect = Check_ArgIsTrue(Arg);
                return;
-        }
+       }
+       if (strcasecmp(Var, "SSLVerify") == 0) {
+               New_Server.SSLVerify = Check_ArgIsTrue(Arg);
+               return;
+       }
 #endif
        if( strcasecmp( Var, "Group" ) == 0 ) {
                /* Server group */
@@ -2104,8 +2155,7 @@ Validate_Config(bool Configtest, bool Rehash)
        if (!Conf_ServerName[0] || !strchr(Conf_ServerName, '.')) {
                config_valid = false;
                Config_Error(LOG_ALERT,
-                            "No (valid) server name configured in \"%s\" (section 'Global': 'Name')!",
-                            NGIRCd_ConfFile);
+                            "No (valid) server name configured (section 'Global': 'Name')!");
                if (!Configtest && !Rehash) {
                        Config_Error(LOG_ALERT,
                                     "%s exiting due to fatal errors!",
@@ -2119,8 +2169,7 @@ Validate_Config(bool Configtest, bool Rehash)
                /* No administrative contact configured! */
                config_valid = false;
                Config_Error(LOG_ALERT,
-                            "No administrator email address configured in \"%s\" ('AdminEMail')!",
-                            NGIRCd_ConfFile);
+                            "No administrator email address configured ('AdminEMail')!");
                if (!Configtest) {
                        Config_Error(LOG_ALERT,
                                     "%s exiting due to fatal errors!",