X-Git-Url: https://arthur.barton.de/cgi-bin/gitweb.cgi?a=blobdiff_plain;f=src%2Fngircd%2Fconn-ssl.c;h=493bcc75c66847e0ed50f118e805d3a81a58da4e;hb=99db111bca731490e8e91dfe3efe075179177005;hp=a97896758cc30c2f63724ab5396e797e064763da;hpb=51231ac8d45bf329f4724a145e6bc7a3ea118570;p=ngircd-alex.git

diff --git a/src/ngircd/conn-ssl.c b/src/ngircd/conn-ssl.c
index a9789675..493bcc75 100644
--- a/src/ngircd/conn-ssl.c
+++ b/src/ngircd/conn-ssl.c
@@ -58,10 +58,11 @@ static bool ConnSSL_LoadServerKey_openssl PARAMS(( SSL_CTX *c ));
 
 static gnutls_certificate_credentials_t x509_cred;
 static gnutls_dh_params_t dh_params;
+static gnutls_priority_t priorities_cache;
 static bool ConnSSL_LoadServerKey_gnutls PARAMS(( void ));
 #endif
 
-#define SHA1_STRING_LEN	(20 * 2 + 1)
+#define SHA256_STRING_LEN	(32 * 2 + 1)
 
 static bool ConnSSL_Init_SSL PARAMS(( CONNECTION *c ));
 static int ConnectAccept PARAMS(( CONNECTION *c, bool connect ));
@@ -305,17 +306,10 @@ ConnSSL_InitLibrary( void )
 	if (!ConnSSL_LoadServerKey_openssl(newctx))
 		goto out;
 
-	if(Conf_SSLOptions.CipherList && *Conf_SSLOptions.CipherList) {
-		if(SSL_CTX_set_cipher_list(newctx, Conf_SSLOptions.CipherList) == 0 ) {
-			Log(LOG_ERR,
-			    "Failed to apply SSL cipher list \"%s\"!",
-			    Conf_SSLOptions.CipherList);
-			goto out;
-		} else {
-			Log(LOG_INFO,
-			    "Successfully applied SSL cipher list: \"%s\".",
-			    Conf_SSLOptions.CipherList);
-		}
+	if (SSL_CTX_set_cipher_list(newctx, Conf_SSLOptions.CipherList) == 0) {
+		Log(LOG_ERR, "Failed to apply OpenSSL cipher list \"%s\"!",
+		    Conf_SSLOptions.CipherList);
+		goto out;
 	}
 
 	SSL_CTX_set_options(newctx, SSL_OP_SINGLE_DH_USE|SSL_OP_NO_SSLv2);
@@ -341,29 +335,30 @@ out:
 		return false;
 	}
 
-	if(Conf_SSLOptions.CipherList != NULL) {
-		Log(LOG_ERR,
-		    "Failed to apply SSL cipher list \"%s\": Not implemented for GnuTLS!",
-		    Conf_SSLOptions.CipherList);
-		array_free(&Conf_SSLOptions.ListenPorts);
-		return false;
-	}
-
 	err = gnutls_global_init();
 	if (err) {
 		Log(LOG_ERR, "Failed to initialize GnuTLS: %s",
 		    gnutls_strerror(err));
-		array_free(&Conf_SSLOptions.ListenPorts);
-		return false;
+		goto out;
 	}
-	if (!ConnSSL_LoadServerKey_gnutls()) {
-		array_free(&Conf_SSLOptions.ListenPorts);
-		return false;
+
+	if (!ConnSSL_LoadServerKey_gnutls())
+		goto out;
+
+	if (gnutls_priority_init(&priorities_cache, Conf_SSLOptions.CipherList,
+				 NULL) != GNUTLS_E_SUCCESS) {
+		Log(LOG_ERR,
+		    "Failed to apply GnuTLS cipher list \"%s\"!",
+		    Conf_SSLOptions.CipherList);
+		goto out;
 	}
 
 	Log(LOG_INFO, "GnuTLS %s initialized.", gnutls_check_version(NULL));
 	initialized = true;
 	return true;
+out:
+	array_free(&Conf_SSLOptions.ListenPorts);
+	return false;
 #endif
 }
 
@@ -489,9 +484,9 @@ ConnSSL_Init_SSL(CONNECTION *c)
 #endif
 #ifdef HAVE_LIBGNUTLS
 	Conn_OPTION_ADD(c, CONN_SSL);
-	ret = gnutls_set_default_priority(c->ssl_state.gnutls_session);
-	if (ret != 0) {
-		Log(LOG_ERR, "Failed to set GnuTLS default priority: %s",
+	ret = gnutls_priority_set(c->ssl_state.gnutls_session, priorities_cache);
+	if (ret != GNUTLS_E_SUCCESS) {
+		Log(LOG_ERR, "Failed to set GnuTLS session priorities: %s",
 		    gnutls_strerror(ret));
 		ConnSSL_Free(c);
 		return false;
@@ -716,7 +711,7 @@ ConnSSL_InitCertFp( CONNECTION *c )
 	if (!cert)
 		return 0;
 
-	if (!X509_digest(cert, EVP_sha1(), digest, &digest_size)) {
+	if (!X509_digest(cert, EVP_sha256(), digest, &digest_size)) {
 		X509_free(cert);
 		return 0;
 	}
@@ -730,7 +725,8 @@ ConnSSL_InitCertFp( CONNECTION *c )
 	unsigned char digest[MAX_HASH_SIZE];
 	size_t digest_size;
 
-	if (gnutls_certificate_type_get(c->ssl_state.gnutls_session) != GNUTLS_CRT_X509)
+	if (gnutls_certificate_type_get(c->ssl_state.gnutls_session) !=
+					GNUTLS_CRT_X509)
 		return 0;
 
 	if (gnutls_x509_crt_init(&cert) != GNUTLS_E_SUCCESS)
@@ -744,13 +740,15 @@ ConnSSL_InitCertFp( CONNECTION *c )
 		return 0;
 	}
 	
-	if (gnutls_x509_crt_import(cert, &cert_list[0], GNUTLS_X509_FMT_DER) != GNUTLS_E_SUCCESS) {
+	if (gnutls_x509_crt_import(cert, &cert_list[0],
+				   GNUTLS_X509_FMT_DER) != GNUTLS_E_SUCCESS) {
 		gnutls_x509_crt_deinit(cert);
 		return 0;
 	}
 
 	digest_size = sizeof(digest);
-	if (gnutls_x509_crt_get_fingerprint(cert, GNUTLS_DIG_SHA1, digest, &digest_size)) {
+	if (gnutls_x509_crt_get_fingerprint(cert, GNUTLS_DIG_SHA256, digest,
+					    &digest_size)) {
 		gnutls_x509_crt_deinit(cert);
 		return 0;
 	}
@@ -760,7 +758,7 @@ ConnSSL_InitCertFp( CONNECTION *c )
 
 	assert(c->ssl_state.fingerprint == NULL);
 
-	c->ssl_state.fingerprint = malloc(SHA1_STRING_LEN);
+	c->ssl_state.fingerprint = malloc(SHA256_STRING_LEN);
 	if (!c->ssl_state.fingerprint)
 		return 0;
 
@@ -895,7 +893,7 @@ bool
 ConnSSL_SetCertFp(CONNECTION *c, const char *fingerprint)
 {
 	assert (c != NULL);
-	c->ssl_state.fingerprint = strndup(fingerprint, SHA1_STRING_LEN - 1);
+	c->ssl_state.fingerprint = strndup(fingerprint, SHA256_STRING_LEN - 1);
 	return c->ssl_state.fingerprint != NULL;
 }
 #else