/*
* ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c) 2005-2008 Florian Westphal <fw@strlen.de>
+ * Copyright (c)2005-2008 Florian Westphal (fw@strlen.de).
+ * Copyright (c)2008-2014 Alexander Barton (alex@barton.de) and Contributors.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ * Please read the file COPYING, README and AUTHORS for more information.
*/
#include "portab.h"
* SSL wrapper functions
*/
-#include "imp.h"
#include "conf-ssl.h"
#ifdef SSL_SUPPORT
#include "conn-ssl.h"
#include "log.h"
-#include "exp.h"
#include "defines.h"
extern struct SSLOptions Conf_SSLOptions;
#ifdef HAVE_LIBSSL
#include <openssl/err.h>
#include <openssl/rand.h>
+#include <openssl/dh.h>
static SSL_CTX * ssl_ctx;
static DH *dh_params;
#define MAX_HASH_SIZE 64 /* from gnutls-int.h */
-static gnutls_certificate_credentials_t x509_cred;
+typedef struct {
+ int refcnt;
+ gnutls_certificate_credentials_t x509_cred;
+ gnutls_dh_params_t dh_params;
+} x509_cred_slot;
+
+static array x509_creds = INIT_ARRAY;
+static size_t x509_cred_idx;
+
static gnutls_dh_params_t dh_params;
-static gnutls_priority_t priorities_cache;
+static gnutls_priority_t priorities_cache = NULL;
static bool ConnSSL_LoadServerKey_gnutls PARAMS(( void ));
#endif
gnutls_bye(sess, GNUTLS_SHUT_RDWR);
gnutls_deinit(sess);
}
+ x509_cred_slot *slot = array_get(&x509_creds, sizeof(x509_cred_slot), c->ssl_state.x509_cred_idx);
+ assert(slot != NULL);
+ assert(slot->refcnt > 0);
+ assert(slot->x509_cred != NULL);
+ slot->refcnt--;
+ if ((c->ssl_state.x509_cred_idx != x509_cred_idx) && (slot->refcnt <= 0)) {
+ LogDebug("Discarding X509 certificate credentials from slot %zd.",
+ c->ssl_state.x509_cred_idx);
+ gnutls_certificate_free_keys(slot->x509_cred);
+ gnutls_certificate_free_credentials(slot->x509_cred);
+ slot->x509_cred = NULL;
+ gnutls_dh_params_deinit(slot->dh_params);
+ slot->dh_params = NULL;
+ slot->refcnt = 0;
+ }
#endif
assert(Conn_OPTION_ISSET(c, CONN_SSL));
/* can't just set bitmask to 0 -- there are other, non-ssl related flags, e.g. CONN_ZIP. */
#ifdef HAVE_LIBSSL
SSL_CTX *newctx;
+#if OPENSSL_API_COMPAT < 0x10100000L
if (!ssl_ctx) {
SSL_library_init();
SSL_load_error_strings();
}
+#endif
if (!RAND_status()) {
Log(LOG_ERR, "OpenSSL PRNG not seeded: /dev/urandom missing?");
return false;
}
- if (!ConnSSL_LoadServerKey_openssl(newctx))
+ if (!ConnSSL_LoadServerKey_openssl(newctx)) {
+ /* Failed to read new key but an old ssl context
+ * already exists -> reuse old context */
+ if (ssl_ctx) {
+ SSL_CTX_free(newctx);
+ Log(LOG_WARNING,
+ "Re-Initializing of SSL failed, using old keys!");
+ return true;
+ }
+ /* No preexisting old context -> error. */
goto out;
+ }
if (SSL_CTX_set_cipher_list(newctx, Conf_SSLOptions.CipherList) == 0) {
Log(LOG_ERR, "Failed to apply OpenSSL cipher list \"%s\"!",
goto out;
}
+ SSL_CTX_set_session_id_context(newctx, (unsigned char *)"ngircd", 6);
SSL_CTX_set_options(newctx, SSL_OP_SINGLE_DH_USE|SSL_OP_NO_SSLv2);
SSL_CTX_set_mode(newctx, SSL_MODE_ENABLE_PARTIAL_WRITE);
SSL_CTX_set_verify(newctx, SSL_VERIFY_PEER|SSL_VERIFY_CLIENT_ONCE,
Verify_openssl);
SSL_CTX_free(ssl_ctx);
ssl_ctx = newctx;
- Log(LOG_INFO, "%s initialized.", SSLeay_version(SSLEAY_VERSION));
+ Log(LOG_INFO, "%s initialized.", OpenSSL_version(OPENSSL_VERSION));
return true;
out:
SSL_CTX_free(newctx);
int err;
static bool initialized;
- if (initialized) {
- /* TODO: cannot reload gnutls keys: can't simply free x509
- * context -- it may still be in use */
- return false;
- }
-
- err = gnutls_global_init();
- if (err) {
- Log(LOG_ERR, "Failed to initialize GnuTLS: %s",
- gnutls_strerror(err));
- goto out;
+ if (!initialized) {
+ err = gnutls_global_init();
+ if (err) {
+ Log(LOG_ERR, "Failed to initialize GnuTLS: %s",
+ gnutls_strerror(err));
+ goto out;
+ }
}
if (!ConnSSL_LoadServerKey_gnutls())
goto out;
+ if (priorities_cache != NULL) {
+ gnutls_priority_deinit(priorities_cache);
+ }
if (gnutls_priority_init(&priorities_cache, Conf_SSLOptions.CipherList,
NULL) != GNUTLS_E_SUCCESS) {
Log(LOG_ERR,
int err;
const char *cert_file;
+ x509_cred_slot *slot = NULL;
+ gnutls_certificate_credentials_t x509_cred;
+
err = gnutls_certificate_allocate_credentials(&x509_cred);
if (err < 0) {
Log(LOG_ERR, "Failed to allocate certificate credentials: %s",
return false;
}
- cert_file = Conf_SSLOptions.CertFile ? Conf_SSLOptions.CertFile:Conf_SSLOptions.KeyFile;
- if (!cert_file) {
- Log(LOG_ERR, "No SSL server key configured!");
- return false;
- }
-
if (array_bytes(&Conf_SSLOptions.KeyFilePassword))
Log(LOG_WARNING,
"Ignoring SSL \"KeyFilePassword\": Not supported by GnuTLS.");
return false;
gnutls_certificate_set_dh_params(x509_cred, dh_params);
- err = gnutls_certificate_set_x509_key_file(x509_cred, cert_file, Conf_SSLOptions.KeyFile, GNUTLS_X509_FMT_PEM);
- if (err < 0) {
- Log(LOG_ERR,
- "Failed to set certificate key file (cert %s, key %s): %s",
- cert_file,
- Conf_SSLOptions.KeyFile ? Conf_SSLOptions.KeyFile : "(NULL)",
- gnutls_strerror(err));
- return false;
+
+ cert_file = Conf_SSLOptions.CertFile ?
+ Conf_SSLOptions.CertFile : Conf_SSLOptions.KeyFile;
+ if (Conf_SSLOptions.KeyFile) {
+ err = gnutls_certificate_set_x509_key_file(x509_cred, cert_file,
+ Conf_SSLOptions.KeyFile,
+ GNUTLS_X509_FMT_PEM);
+ if (err < 0) {
+ Log(LOG_ERR,
+ "Failed to set certificate key file (cert %s, key %s): %s",
+ cert_file,
+ Conf_SSLOptions.KeyFile ? Conf_SSLOptions.KeyFile : "(NULL)",
+ gnutls_strerror(err));
+ return false;
+ }
+ }
+
+ /* Free currently active x509 context (if any) unless it is still in use */
+ slot = array_get(&x509_creds, sizeof(x509_cred_slot), x509_cred_idx);
+ if ((slot != NULL) && (slot->refcnt <= 0) && (slot->x509_cred != NULL)) {
+ LogDebug("Discarding X509 certificate credentials from slot %zd.",
+ x509_cred_idx);
+ gnutls_certificate_free_keys(slot->x509_cred);
+ gnutls_certificate_free_credentials(slot->x509_cred);
+ slot->x509_cred = NULL;
+ gnutls_dh_params_deinit(slot->dh_params);
+ slot->dh_params = NULL;
+ slot->refcnt = 0;
+ }
+
+ /* Find free slot */
+ x509_cred_idx = (size_t) -1;
+ size_t i;
+ for (slot = array_start(&x509_creds), i = 0;
+ i < array_length(&x509_creds, sizeof(x509_cred_slot));
+ slot++, i++) {
+ if (slot->refcnt <= 0) {
+ x509_cred_idx = i;
+ break;
+ }
}
+ /* ... allocate new slot otherwise. */
+ if (x509_cred_idx == (size_t) -1) {
+ x509_cred_idx = array_length(&x509_creds, sizeof(x509_cred_slot));
+ slot = array_alloc(&x509_creds, sizeof(x509_cred_slot), x509_cred_idx);
+ if (slot == NULL) {
+ Log(LOG_ERR, "Failed to allocate new slot for certificate credentials");
+ return false;
+ }
+ }
+ Log(LOG_INFO, "Storing new X509 certificate credentials in slot %zd.", x509_cred_idx);
+ slot->x509_cred = x509_cred;
+ slot->refcnt = 0;
+
return true;
}
#endif
char *cert_key;
assert(ctx);
- if (!Conf_SSLOptions.KeyFile) {
- Log(LOG_ERR, "No SSL server key configured!");
- return false;
- }
-
SSL_CTX_set_default_passwd_cb(ctx, pem_passwd_cb);
SSL_CTX_set_default_passwd_cb_userdata(ctx, &Conf_SSLOptions.KeyFilePassword);
+ if (!Conf_SSLOptions.KeyFile)
+ return true;
+
if (SSL_CTX_use_PrivateKey_file(ctx, Conf_SSLOptions.KeyFile, SSL_FILETYPE_PEM) != 1) {
array_free_wipe(&Conf_SSLOptions.KeyFilePassword);
LogOpenSSLError("Failed to add private key", Conf_SSLOptions.KeyFile);
(gnutls_transport_ptr_t) (long) c->sock);
gnutls_certificate_server_set_request(c->ssl_state.gnutls_session,
GNUTLS_CERT_REQUEST);
+
+ LogDebug("Using X509 credentials from slot %zd.", x509_cred_idx);
+ c->ssl_state.x509_cred_idx = x509_cred_idx;
+ x509_cred_slot *slot = array_get(&x509_creds, sizeof(x509_cred_slot), x509_cred_idx);
+ slot->refcnt++;
ret = gnutls_credentials_set(c->ssl_state.gnutls_session,
- GNUTLS_CRD_CERTIFICATE, x509_cred);
+ GNUTLS_CRD_CERTIFICATE, slot->x509_cred);
if (ret != 0) {
Log(LOG_ERR, "Failed to set SSL credentials: %s",
gnutls_strerror(ret));
gnutls_x509_crt_deinit(cert);
return 0;
}
-
+
if (gnutls_x509_crt_import(cert, &cert_list[0],
GNUTLS_X509_FMT_DER) != GNUTLS_E_SUCCESS) {
gnutls_x509_crt_deinit(cert);
#endif /* SSL_SUPPORT */
/* -eof- */
-
-
projects / ngircd-alex.git / blobdiff