Specify session context for OpenSSL clients

[ngircd-alex.git] / src / ngircd / conn-ssl.c

diff --git a/src/ngircd/conn-ssl.c b/src/ngircd/conn-ssl.c
index a97896758cc30c2f63724ab5396e797e064763da..be6ee0a8f9490be9dd5a15976d483ab0d9a850d0 100644 (file)
--- a/src/ngircd/conn-ssl.c
+++ b/src/ngircd/conn-ssl.c
@@ -1,6 +1,13 @@
 /*
  * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c) 2005-2008 Florian Westphal <fw@strlen.de>
+ * Copyright (c)2005-2008 Florian Westphal (fw@strlen.de).
+ * Copyright (c)2008-2014 Alexander Barton (alex@barton.de) and Contributors.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ * Please read the file COPYING, README and AUTHORS for more information.
  */
 
 #include "portab.h"
@@ -10,7 +17,6 @@
  * SSL wrapper functions
  */
 
-#include "imp.h"
 #include "conf-ssl.h"
 
 #ifdef SSL_SUPPORT
@@ -29,7 +35,6 @@
 #include "conn-ssl.h"
 #include "log.h"
 
-#include "exp.h"
 #include "defines.h"
 
 extern struct SSLOptions Conf_SSLOptions;
@@ -58,10 +63,11 @@ static bool ConnSSL_LoadServerKey_openssl PARAMS(( SSL_CTX *c ));
 
 static gnutls_certificate_credentials_t x509_cred;
 static gnutls_dh_params_t dh_params;
+static gnutls_priority_t priorities_cache;
 static bool ConnSSL_LoadServerKey_gnutls PARAMS(( void ));
 #endif
 
-#define SHA1_STRING_LEN        (20 * 2 + 1)
+#define SHA256_STRING_LEN      (32 * 2 + 1)
 
 static bool ConnSSL_Init_SSL PARAMS(( CONNECTION *c ));
 static int ConnectAccept PARAMS(( CONNECTION *c, bool connect ));
@@ -305,19 +311,13 @@ ConnSSL_InitLibrary( void )
        if (!ConnSSL_LoadServerKey_openssl(newctx))
                goto out;
 
-       if(Conf_SSLOptions.CipherList && *Conf_SSLOptions.CipherList) {
-               if(SSL_CTX_set_cipher_list(newctx, Conf_SSLOptions.CipherList) == 0 ) {
-                       Log(LOG_ERR,
-                           "Failed to apply SSL cipher list \"%s\"!",
-                           Conf_SSLOptions.CipherList);
-                       goto out;
-               } else {
-                       Log(LOG_INFO,
-                           "Successfully applied SSL cipher list: \"%s\".",
-                           Conf_SSLOptions.CipherList);
-               }
+       if (SSL_CTX_set_cipher_list(newctx, Conf_SSLOptions.CipherList) == 0) {
+               Log(LOG_ERR, "Failed to apply OpenSSL cipher list \"%s\"!",
+                   Conf_SSLOptions.CipherList);
+               goto out;
        }
 
+       SSL_CTX_set_session_id_context(newctx, (unsigned char *)"ngircd", 6);
        SSL_CTX_set_options(newctx, SSL_OP_SINGLE_DH_USE|SSL_OP_NO_SSLv2);
        SSL_CTX_set_mode(newctx, SSL_MODE_ENABLE_PARTIAL_WRITE);
        SSL_CTX_set_verify(newctx, SSL_VERIFY_PEER|SSL_VERIFY_CLIENT_ONCE,
@@ -341,29 +341,30 @@ out:
                return false;
        }
 
-       if(Conf_SSLOptions.CipherList != NULL) {
-               Log(LOG_ERR,
-                   "Failed to apply SSL cipher list \"%s\": Not implemented for GnuTLS!",
-                   Conf_SSLOptions.CipherList);
-               array_free(&Conf_SSLOptions.ListenPorts);
-               return false;
-       }
-
        err = gnutls_global_init();
        if (err) {
                Log(LOG_ERR, "Failed to initialize GnuTLS: %s",
                    gnutls_strerror(err));
-               array_free(&Conf_SSLOptions.ListenPorts);
-               return false;
+               goto out;
        }
-       if (!ConnSSL_LoadServerKey_gnutls()) {
-               array_free(&Conf_SSLOptions.ListenPorts);
-               return false;
+
+       if (!ConnSSL_LoadServerKey_gnutls())
+               goto out;
+
+       if (gnutls_priority_init(&priorities_cache, Conf_SSLOptions.CipherList,
+                                NULL) != GNUTLS_E_SUCCESS) {
+               Log(LOG_ERR,
+                   "Failed to apply GnuTLS cipher list \"%s\"!",
+                   Conf_SSLOptions.CipherList);
+               goto out;
        }
 
        Log(LOG_INFO, "GnuTLS %s initialized.", gnutls_check_version(NULL));
        initialized = true;
        return true;
+out:
+       array_free(&Conf_SSLOptions.ListenPorts);
+       return false;
 #endif
 }
 
@@ -489,9 +490,9 @@ ConnSSL_Init_SSL(CONNECTION *c)
 #endif
 #ifdef HAVE_LIBGNUTLS
        Conn_OPTION_ADD(c, CONN_SSL);
-       ret = gnutls_set_default_priority(c->ssl_state.gnutls_session);
-       if (ret != 0) {
-               Log(LOG_ERR, "Failed to set GnuTLS default priority: %s",
+       ret = gnutls_priority_set(c->ssl_state.gnutls_session, priorities_cache);
+       if (ret != GNUTLS_E_SUCCESS) {
+               Log(LOG_ERR, "Failed to set GnuTLS session priorities: %s",
                    gnutls_strerror(ret));
                ConnSSL_Free(c);
                return false;
@@ -716,7 +717,7 @@ ConnSSL_InitCertFp( CONNECTION *c )
        if (!cert)
                return 0;
 
-       if (!X509_digest(cert, EVP_sha1(), digest, &digest_size)) {
+       if (!X509_digest(cert, EVP_sha256(), digest, &digest_size)) {
                X509_free(cert);
                return 0;
        }
@@ -730,7 +731,8 @@ ConnSSL_InitCertFp( CONNECTION *c )
        unsigned char digest[MAX_HASH_SIZE];
        size_t digest_size;
 
-       if (gnutls_certificate_type_get(c->ssl_state.gnutls_session) != GNUTLS_CRT_X509)
+       if (gnutls_certificate_type_get(c->ssl_state.gnutls_session) !=
+                                       GNUTLS_CRT_X509)
                return 0;
 
        if (gnutls_x509_crt_init(&cert) != GNUTLS_E_SUCCESS)
@@ -744,13 +746,15 @@ ConnSSL_InitCertFp( CONNECTION *c )
                return 0;
        }
        
-       if (gnutls_x509_crt_import(cert, &cert_list[0], GNUTLS_X509_FMT_DER) != GNUTLS_E_SUCCESS) {
+       if (gnutls_x509_crt_import(cert, &cert_list[0],
+                                  GNUTLS_X509_FMT_DER) != GNUTLS_E_SUCCESS) {
                gnutls_x509_crt_deinit(cert);
                return 0;
        }
 
        digest_size = sizeof(digest);
-       if (gnutls_x509_crt_get_fingerprint(cert, GNUTLS_DIG_SHA1, digest, &digest_size)) {
+       if (gnutls_x509_crt_get_fingerprint(cert, GNUTLS_DIG_SHA256, digest,
+                                           &digest_size)) {
                gnutls_x509_crt_deinit(cert);
                return 0;
        }
@@ -760,7 +764,7 @@ ConnSSL_InitCertFp( CONNECTION *c )
 
        assert(c->ssl_state.fingerprint == NULL);
 
-       c->ssl_state.fingerprint = malloc(SHA1_STRING_LEN);
+       c->ssl_state.fingerprint = malloc(SHA256_STRING_LEN);
        if (!c->ssl_state.fingerprint)
                return 0;
 
@@ -895,7 +899,7 @@ bool
 ConnSSL_SetCertFp(CONNECTION *c, const char *fingerprint)
 {
        assert (c != NULL);
-       c->ssl_state.fingerprint = strndup(fingerprint, SHA1_STRING_LEN - 1);
+       c->ssl_state.fingerprint = strndup(fingerprint, SHA256_STRING_LEN - 1);
        return c->ssl_state.fingerprint != NULL;
 }
 #else