/*
* ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c) 2005-2008 Florian Westphal <fw@strlen.de>
+ * Copyright (c)2005-2008 Florian Westphal (fw@strlen.de).
+ * Copyright (c)2008-2014 Alexander Barton (alex@barton.de) and Contributors.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ * Please read the file COPYING, README and AUTHORS for more information.
*/
#include "portab.h"
* SSL wrapper functions
*/
-#include "imp.h"
#include "conf-ssl.h"
#ifdef SSL_SUPPORT
#include "conn-ssl.h"
#include "log.h"
-#include "exp.h"
#include "defines.h"
extern struct SSLOptions Conf_SSLOptions;
#ifdef HAVE_LIBSSL
#include <openssl/err.h>
#include <openssl/rand.h>
+#include <openssl/dh.h>
static SSL_CTX * ssl_ctx;
static DH *dh_params;
static bool ConnSSL_LoadServerKey_gnutls PARAMS(( void ));
#endif
-#define SHA1_STRING_LEN (20 * 2 + 1)
+#define SHA256_STRING_LEN (32 * 2 + 1)
static bool ConnSSL_Init_SSL PARAMS(( CONNECTION *c ));
static int ConnectAccept PARAMS(( CONNECTION *c, bool connect ));
#ifdef HAVE_LIBSSL
SSL_CTX *newctx;
+#if OPENSSL_API_COMPAT < 0x10100000L
if (!ssl_ctx) {
SSL_library_init();
SSL_load_error_strings();
}
+#endif
if (!RAND_status()) {
Log(LOG_ERR, "OpenSSL PRNG not seeded: /dev/urandom missing?");
return false;
}
- if (!ConnSSL_LoadServerKey_openssl(newctx))
+ if (!ConnSSL_LoadServerKey_openssl(newctx)) {
+ /* Failed to read new key but an old ssl context
+ * already exists -> reuse old context */
+ if (ssl_ctx) {
+ SSL_CTX_free(newctx);
+ Log(LOG_WARNING,
+ "Re-Initializing of SSL failed, using old keys!");
+ return true;
+ }
+ /* No preexisting old context -> error. */
goto out;
+ }
- if(Conf_SSLOptions.CipherList && *Conf_SSLOptions.CipherList) {
- if(SSL_CTX_set_cipher_list(newctx, Conf_SSLOptions.CipherList) == 0 ) {
- Log(LOG_ERR,
- "Failed to apply OpenSSL cipher list \"%s\"!",
- Conf_SSLOptions.CipherList);
- goto out;
- } else {
- Log(LOG_INFO,
- "Successfully applied OpenSSL cipher list \"%s\".",
- Conf_SSLOptions.CipherList);
- }
+ if (SSL_CTX_set_cipher_list(newctx, Conf_SSLOptions.CipherList) == 0) {
+ Log(LOG_ERR, "Failed to apply OpenSSL cipher list \"%s\"!",
+ Conf_SSLOptions.CipherList);
+ goto out;
}
+ SSL_CTX_set_session_id_context(newctx, (unsigned char *)"ngircd", 6);
SSL_CTX_set_options(newctx, SSL_OP_SINGLE_DH_USE|SSL_OP_NO_SSLv2);
SSL_CTX_set_mode(newctx, SSL_MODE_ENABLE_PARTIAL_WRITE);
SSL_CTX_set_verify(newctx, SSL_VERIFY_PEER|SSL_VERIFY_CLIENT_ONCE,
Verify_openssl);
SSL_CTX_free(ssl_ctx);
ssl_ctx = newctx;
- Log(LOG_INFO, "%s initialized.", SSLeay_version(SSLEAY_VERSION));
+ Log(LOG_INFO, "%s initialized.", OpenSSL_version(OPENSSL_VERSION));
return true;
out:
SSL_CTX_free(newctx);
if (!ConnSSL_LoadServerKey_gnutls())
goto out;
- if(Conf_SSLOptions.CipherList && *Conf_SSLOptions.CipherList) {
- err = gnutls_priority_init(&priorities_cache,
- Conf_SSLOptions.CipherList, NULL);
- if (err != GNUTLS_E_SUCCESS) {
- Log(LOG_ERR,
- "Failed to apply GnuTLS cipher list \"%s\"!",
- Conf_SSLOptions.CipherList);
- goto out;
- }
- Log(LOG_INFO,
- "Successfully applied GnuTLS cipher list \"%s\".",
+ if (gnutls_priority_init(&priorities_cache, Conf_SSLOptions.CipherList,
+ NULL) != GNUTLS_E_SUCCESS) {
+ Log(LOG_ERR,
+ "Failed to apply GnuTLS cipher list \"%s\"!",
Conf_SSLOptions.CipherList);
- } else {
- err = gnutls_priority_init(&priorities_cache, "NORMAL", NULL);
- if (err != GNUTLS_E_SUCCESS) {
- Log(LOG_ERR,
- "Failed to apply GnuTLS cipher list \"NORMAL\"!");
- goto out;
- }
+ goto out;
}
Log(LOG_INFO, "GnuTLS %s initialized.", gnutls_check_version(NULL));
#ifdef HAVE_LIBGNUTLS
Conn_OPTION_ADD(c, CONN_SSL);
ret = gnutls_priority_set(c->ssl_state.gnutls_session, priorities_cache);
- if (ret != 0) {
+ if (ret != GNUTLS_E_SUCCESS) {
Log(LOG_ERR, "Failed to set GnuTLS session priorities: %s",
gnutls_strerror(ret));
ConnSSL_Free(c);
if (!cert)
return 0;
- if (!X509_digest(cert, EVP_sha1(), digest, &digest_size)) {
+ if (!X509_digest(cert, EVP_sha256(), digest, &digest_size)) {
X509_free(cert);
return 0;
}
unsigned char digest[MAX_HASH_SIZE];
size_t digest_size;
- if (gnutls_certificate_type_get(c->ssl_state.gnutls_session) != GNUTLS_CRT_X509)
+ if (gnutls_certificate_type_get(c->ssl_state.gnutls_session) !=
+ GNUTLS_CRT_X509)
return 0;
if (gnutls_x509_crt_init(&cert) != GNUTLS_E_SUCCESS)
gnutls_x509_crt_deinit(cert);
return 0;
}
-
- if (gnutls_x509_crt_import(cert, &cert_list[0], GNUTLS_X509_FMT_DER) != GNUTLS_E_SUCCESS) {
+
+ if (gnutls_x509_crt_import(cert, &cert_list[0],
+ GNUTLS_X509_FMT_DER) != GNUTLS_E_SUCCESS) {
gnutls_x509_crt_deinit(cert);
return 0;
}
digest_size = sizeof(digest);
- if (gnutls_x509_crt_get_fingerprint(cert, GNUTLS_DIG_SHA1, digest, &digest_size)) {
+ if (gnutls_x509_crt_get_fingerprint(cert, GNUTLS_DIG_SHA256, digest,
+ &digest_size)) {
gnutls_x509_crt_deinit(cert);
return 0;
}
assert(c->ssl_state.fingerprint == NULL);
- c->ssl_state.fingerprint = malloc(SHA1_STRING_LEN);
+ c->ssl_state.fingerprint = malloc(SHA256_STRING_LEN);
if (!c->ssl_state.fingerprint)
return 0;
ConnSSL_SetCertFp(CONNECTION *c, const char *fingerprint)
{
assert (c != NULL);
- c->ssl_state.fingerprint = strndup(fingerprint, SHA1_STRING_LEN - 1);
+ c->ssl_state.fingerprint = strndup(fingerprint, SHA256_STRING_LEN - 1);
return c->ssl_state.fingerprint != NULL;
}
#else
#endif /* SSL_SUPPORT */
/* -eof- */
-
-
projects / ngircd-alex.git / blobdiff