Optionally validate certificates on TLS server links

[ngircd-alex.git] / src / ngircd / irc-server.c

diff --git a/src/ngircd/irc-server.c b/src/ngircd/irc-server.c
index 7dbaba86a6bc20bc70d0d59b6db9969653b234b0..6f64c3b2983d05c77d4b97e6034df0a70537d7e6 100644 (file)
--- a/src/ngircd/irc-server.c
+++ b/src/ngircd/irc-server.c
@@ -1,6 +1,6 @@
 /*
  * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c)2001-2013 Alexander Barton (alex@barton.de) and Contributors.
+ * Copyright (c)2001-2014 Alexander Barton (alex@barton.de) and Contributors.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -16,31 +16,25 @@
  * IRC commands for server links
  */
 
-#include "imp.h"
 #include <assert.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <strings.h>
 
-#include "defines.h"
-#include "conn.h"
 #include "conn-func.h"
 #include "conn-zip.h"
 #include "conf.h"
 #include "channel.h"
-#include "lists.h"
 #include "log.h"
 #include "messages.h"
 #include "parse.h"
 #include "numeric.h"
 #include "ngircd.h"
 #include "irc-info.h"
-#include "irc-macros.h"
 #include "irc-write.h"
 #include "op.h"
 
-#include "exp.h"
 #include "irc-server.h"
 
 /**
@@ -103,6 +97,21 @@ IRC_SERVER( CLIENT *Client, REQUEST *Req )
                        return DISCONNECTED;
                }
 
+#ifdef SSL_SUPPORT
+               /*
+                * This check is only done if RequireClientCert is disabled, and this Servers [SERVER] section has
+                * "SSLVerify" enabled.
+                * (if RequireClientCert is set, certificate validation is done during SSL/TLS handshake)
+                */
+               CONN_ID con = Client_Conn (Client);
+               if (Conf_Server[i].SSLVerify && !(Conn_Options(con) & CONN_SSL_PEERCERT_OK)) {
+                       Log(LOG_ERR, "Connection %d: SSLVerify is set, and server \"%s\" did not present a valid certificate",
+                                                                               Client_Conn(Client), Req->argv[0]);
+                       Conn_Close(Client_Conn(Client), NULL, "No valid SSL certificate", true);
+                       return DISCONNECTED;
+               }
+#endif
+
                /* Is there a registered server with this ID? */
                if (!Client_CheckID(Client, Req->argv[0]))
                        return DISCONNECTED;