X-Git-Url: https://arthur.barton.de/cgi-bin/gitweb.cgi?p=ngircd-alex.git;a=blobdiff_plain;f=src%2Fngircd%2Fconn-ssl.c;h=3f482dc7ff60263ce40822d41d20c4a7b345e409;hp=b16c6b94e35299a54091ae9bb60dba9e1880c174;hb=e7cb9b1a001a97b1edf0e862808cbd0be5264a7a;hpb=d0977258ee14a5178e98c9a00c064d90f0eac9d6 diff --git a/src/ngircd/conn-ssl.c b/src/ngircd/conn-ssl.c index b16c6b94..3f482dc7 100644 --- a/src/ngircd/conn-ssl.c +++ b/src/ngircd/conn-ssl.c @@ -1,6 +1,13 @@ /* * ngIRCd -- The Next Generation IRC Daemon - * Copyright (c) 2005-2008 Florian Westphal + * Copyright (c)2005-2008 Florian Westphal (fw@strlen.de). + * Copyright (c)2008-2014 Alexander Barton (alex@barton.de) and Contributors. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * Please read the file COPYING, README and AUTHORS for more information. */ #include "portab.h" @@ -10,7 +17,6 @@ * SSL wrapper functions */ -#include "imp.h" #include "conf-ssl.h" #ifdef SSL_SUPPORT @@ -29,7 +35,6 @@ #include "conn-ssl.h" #include "log.h" -#include "exp.h" #include "defines.h" extern struct SSLOptions Conf_SSLOptions; @@ -37,6 +42,7 @@ extern struct SSLOptions Conf_SSLOptions; #ifdef HAVE_LIBSSL #include #include +#include static SSL_CTX * ssl_ctx; static DH *dh_params; @@ -62,7 +68,7 @@ static gnutls_priority_t priorities_cache; static bool ConnSSL_LoadServerKey_gnutls PARAMS(( void )); #endif -#define SHA1_STRING_LEN (20 * 2 + 1) +#define SHA256_STRING_LEN (32 * 2 + 1) static bool ConnSSL_Init_SSL PARAMS(( CONNECTION *c )); static int ConnectAccept PARAMS(( CONNECTION *c, bool connect )); @@ -278,10 +284,12 @@ ConnSSL_InitLibrary( void ) #ifdef HAVE_LIBSSL SSL_CTX *newctx; +#if OPENSSL_API_COMPAT < 0x10100000L if (!ssl_ctx) { SSL_library_init(); SSL_load_error_strings(); } +#endif if (!RAND_status()) { Log(LOG_ERR, "OpenSSL PRNG not seeded: /dev/urandom missing?"); @@ -303,29 +311,33 @@ ConnSSL_InitLibrary( void ) return false; } - if (!ConnSSL_LoadServerKey_openssl(newctx)) + if (!ConnSSL_LoadServerKey_openssl(newctx)) { + /* Failed to read new key but an old ssl context + * already exists -> reuse old context */ + if (ssl_ctx) { + SSL_CTX_free(newctx); + Log(LOG_WARNING, + "Re-Initializing of SSL failed, using old keys!"); + return true; + } + /* No preexisting old context -> error. */ goto out; + } - if(Conf_SSLOptions.CipherList && *Conf_SSLOptions.CipherList) { - if(SSL_CTX_set_cipher_list(newctx, Conf_SSLOptions.CipherList) == 0 ) { - Log(LOG_ERR, - "Failed to apply OpenSSL cipher list \"%s\"!", - Conf_SSLOptions.CipherList); - goto out; - } else { - Log(LOG_INFO, - "Successfully applied OpenSSL cipher list \"%s\".", - Conf_SSLOptions.CipherList); - } + if (SSL_CTX_set_cipher_list(newctx, Conf_SSLOptions.CipherList) == 0) { + Log(LOG_ERR, "Failed to apply OpenSSL cipher list \"%s\"!", + Conf_SSLOptions.CipherList); + goto out; } + SSL_CTX_set_session_id_context(newctx, (unsigned char *)"ngircd", 6); SSL_CTX_set_options(newctx, SSL_OP_SINGLE_DH_USE|SSL_OP_NO_SSLv2); SSL_CTX_set_mode(newctx, SSL_MODE_ENABLE_PARTIAL_WRITE); SSL_CTX_set_verify(newctx, SSL_VERIFY_PEER|SSL_VERIFY_CLIENT_ONCE, Verify_openssl); SSL_CTX_free(ssl_ctx); ssl_ctx = newctx; - Log(LOG_INFO, "%s initialized.", SSLeay_version(SSLEAY_VERSION)); + Log(LOG_INFO, "%s initialized.", OpenSSL_version(OPENSSL_VERSION)); return true; out: SSL_CTX_free(newctx); @@ -352,25 +364,12 @@ out: if (!ConnSSL_LoadServerKey_gnutls()) goto out; - if(Conf_SSLOptions.CipherList && *Conf_SSLOptions.CipherList) { - err = gnutls_priority_init(&priorities_cache, - Conf_SSLOptions.CipherList, NULL); - if (err != GNUTLS_E_SUCCESS) { - Log(LOG_ERR, - "Failed to apply GnuTLS cipher list \"%s\"!", - Conf_SSLOptions.CipherList); - goto out; - } - Log(LOG_INFO, - "Successfully applied GnuTLS cipher list \"%s\".", + if (gnutls_priority_init(&priorities_cache, Conf_SSLOptions.CipherList, + NULL) != GNUTLS_E_SUCCESS) { + Log(LOG_ERR, + "Failed to apply GnuTLS cipher list \"%s\"!", Conf_SSLOptions.CipherList); - } else { - err = gnutls_priority_init(&priorities_cache, "NORMAL", NULL); - if (err != GNUTLS_E_SUCCESS) { - Log(LOG_ERR, - "Failed to apply GnuTLS cipher list \"NORMAL\"!"); - goto out; - } + goto out; } Log(LOG_INFO, "GnuTLS %s initialized.", gnutls_check_version(NULL)); @@ -505,7 +504,7 @@ ConnSSL_Init_SSL(CONNECTION *c) #ifdef HAVE_LIBGNUTLS Conn_OPTION_ADD(c, CONN_SSL); ret = gnutls_priority_set(c->ssl_state.gnutls_session, priorities_cache); - if (ret != 0) { + if (ret != GNUTLS_E_SUCCESS) { Log(LOG_ERR, "Failed to set GnuTLS session priorities: %s", gnutls_strerror(ret)); ConnSSL_Free(c); @@ -731,7 +730,7 @@ ConnSSL_InitCertFp( CONNECTION *c ) if (!cert) return 0; - if (!X509_digest(cert, EVP_sha1(), digest, &digest_size)) { + if (!X509_digest(cert, EVP_sha256(), digest, &digest_size)) { X509_free(cert); return 0; } @@ -745,7 +744,8 @@ ConnSSL_InitCertFp( CONNECTION *c ) unsigned char digest[MAX_HASH_SIZE]; size_t digest_size; - if (gnutls_certificate_type_get(c->ssl_state.gnutls_session) != GNUTLS_CRT_X509) + if (gnutls_certificate_type_get(c->ssl_state.gnutls_session) != + GNUTLS_CRT_X509) return 0; if (gnutls_x509_crt_init(&cert) != GNUTLS_E_SUCCESS) @@ -758,14 +758,16 @@ ConnSSL_InitCertFp( CONNECTION *c ) gnutls_x509_crt_deinit(cert); return 0; } - - if (gnutls_x509_crt_import(cert, &cert_list[0], GNUTLS_X509_FMT_DER) != GNUTLS_E_SUCCESS) { + + if (gnutls_x509_crt_import(cert, &cert_list[0], + GNUTLS_X509_FMT_DER) != GNUTLS_E_SUCCESS) { gnutls_x509_crt_deinit(cert); return 0; } digest_size = sizeof(digest); - if (gnutls_x509_crt_get_fingerprint(cert, GNUTLS_DIG_SHA1, digest, &digest_size)) { + if (gnutls_x509_crt_get_fingerprint(cert, GNUTLS_DIG_SHA256, digest, + &digest_size)) { gnutls_x509_crt_deinit(cert); return 0; } @@ -775,7 +777,7 @@ ConnSSL_InitCertFp( CONNECTION *c ) assert(c->ssl_state.fingerprint == NULL); - c->ssl_state.fingerprint = malloc(SHA1_STRING_LEN); + c->ssl_state.fingerprint = malloc(SHA256_STRING_LEN); if (!c->ssl_state.fingerprint) return 0; @@ -910,7 +912,7 @@ bool ConnSSL_SetCertFp(CONNECTION *c, const char *fingerprint) { assert (c != NULL); - c->ssl_state.fingerprint = strndup(fingerprint, SHA1_STRING_LEN - 1); + c->ssl_state.fingerprint = strndup(fingerprint, SHA256_STRING_LEN - 1); return c->ssl_state.fingerprint != NULL; } #else @@ -923,5 +925,3 @@ ConnSSL_InitLibrary(void) #endif /* SSL_SUPPORT */ /* -eof- */ - -