X-Git-Url: https://arthur.barton.de/cgi-bin/gitweb.cgi?p=ngircd-alex.git;a=blobdiff_plain;f=src%2Fngircd%2Fconn-ssl.c;h=46f1c9d0a584007707336f46b86bbea2b5632992;hp=ae9595f99c9b75d366504dc5e25b83f18eeb634d;hb=57aa64e1176b47830801cec8615affcc24cfb142;hpb=bdd44eb0ab7e6ee080989c672ce6deeffae987c2 diff --git a/src/ngircd/conn-ssl.c b/src/ngircd/conn-ssl.c index ae9595f9..46f1c9d0 100644 --- a/src/ngircd/conn-ssl.c +++ b/src/ngircd/conn-ssl.c @@ -123,7 +123,10 @@ pem_passwd_cb(char *buf, int size, int rwflag, void *password) { array *pass = password; int passlen; - assert(rwflag == 0); /* 0 -> callback used for decryption. See SSL_CTX_set_default_passwd_cb(3) */ + + (void)rwflag; /* rwflag is unused if DEBUG is not set. */ + assert(rwflag == 0); /* 0 -> callback used for decryption. + * See SSL_CTX_set_default_passwd_cb(3) */ passlen = (int) array_bytes(pass); @@ -148,7 +151,7 @@ Load_DH_params(void) bool ret = true; if (!Conf_SSLOptions.DHFile) { - Log(LOG_NOTICE, "Configuration option \"SSLDHFile\" not set"); + Log(LOG_NOTICE, "Configuration option \"SSLDHFile\" not set!"); return false; } fp = fopen(Conf_SSLOptions.DHFile, "r"); @@ -158,7 +161,8 @@ Load_DH_params(void) } dh_params = PEM_read_DHparams(fp, NULL, NULL, NULL); if (!dh_params) { - Log(LOG_ERR, "%s: PEM_read_DHparams failed", Conf_SSLOptions.DHFile); + Log(LOG_ERR, "%s: PEM_read_DHparams failed!", + Conf_SSLOptions.DHFile); ret = false; } fclose(fp); @@ -191,7 +195,9 @@ Load_DH_params(void) } } if (need_dhgenerate) { - Log(LOG_WARNING, "SSLDHFile not set, generating %u bit DH parameters. This may take a while...", DH_BITS); + Log(LOG_WARNING, + "SSLDHFile not set, generating %u bit DH parameters. This may take a while ...", + DH_BITS); err = gnutls_dh_params_generate2(tmp_dh_params, DH_BITS); if (err < 0) { Log(LOG_ERR, "gnutls_dh_params_generate2: %s", gnutls_strerror(err)); @@ -222,7 +228,8 @@ void ConnSSL_Free(CONNECTION *c) } #endif assert(Conn_OPTION_ISSET(c, CONN_SSL)); - Conn_OPTION_DEL(c, (CONN_SSL_CONNECT|CONN_SSL|CONN_SSL_WANT_WRITE)); + /* can't just set bitmask to 0 -- there are other, non-ssl related flags, e.g. CONN_ZIP. */ + Conn_OPTION_DEL(c, CONN_SSL_FLAGS_ALL); } @@ -260,7 +267,7 @@ ConnSSL_InitLibrary( void ) SSL_CTX_set_mode(newctx, SSL_MODE_ENABLE_PARTIAL_WRITE); SSL_CTX_free(ssl_ctx); ssl_ctx = newctx; - Log(LOG_INFO, "%s initialized", SSLeay_version(SSLEAY_VERSION)); + Log(LOG_INFO, "%s initialized.", SSLeay_version(SSLEAY_VERSION)); return true; out: SSL_CTX_free(newctx); @@ -279,7 +286,7 @@ out: } if (!ConnSSL_LoadServerKey_gnutls()) return false; - Log(LOG_INFO, "gnutls %s initialized", gnutls_check_version(NULL)); + Log(LOG_INFO, "gnutls %s initialized.", gnutls_check_version(NULL)); initialized = true; return true; #endif @@ -301,12 +308,13 @@ ConnSSL_LoadServerKey_gnutls(void) cert_file = Conf_SSLOptions.CertFile ? Conf_SSLOptions.CertFile:Conf_SSLOptions.KeyFile; if (!cert_file) { - Log(LOG_ERR, "Neither Key nor certificate File set"); + Log(LOG_NOTICE, "No SSL server key configured, SSL disabled."); return false; } if (array_bytes(&Conf_SSLOptions.KeyFilePassword)) - Log(LOG_WARNING, "Ignoring KeyFilePassword: Not supported by GNUTLS"); + Log(LOG_WARNING, + "Ignoring KeyFilePassword: Not supported by GNUTLS."); if (!Load_DH_params()) return false; @@ -331,7 +339,7 @@ ConnSSL_LoadServerKey_openssl(SSL_CTX *ctx) assert(ctx); if (!Conf_SSLOptions.KeyFile) { - Log(LOG_NOTICE, "No SSL Server Key configured, ssl disabled"); + Log(LOG_NOTICE, "No SSL server key configured, SSL disabled."); return false; } @@ -400,7 +408,13 @@ ConnSSL_Init_SSL(CONNECTION *c) Log(LOG_ERR, "gnutls_set_default_priority: %s", gnutls_strerror(ret)); ConnSSL_Free(c); } - gnutls_transport_set_ptr(c->ssl_state.gnutls_session, (gnutls_transport_ptr_t) c->sock); + /* + * The intermediate (long) cast is here to avoid a warning like: + * "cast to pointer from integer of different size" on 64-bit platforms. + * There doesn't seem to be an alternate GNUTLS API we could use instead, see e.g. + * http://www.mail-archive.com/help-gnutls@gnu.org/msg00286.html + */ + gnutls_transport_set_ptr(c->ssl_state.gnutls_session, (gnutls_transport_ptr_t) (long) c->sock); ret = gnutls_credentials_set(c->ssl_state.gnutls_session, GNUTLS_CRD_CERTIFICATE, x509_cred); if (ret < 0) { Log(LOG_ERR, "gnutls_credentials_set: %s", gnutls_strerror(ret)); @@ -470,8 +484,8 @@ ConnSSL_HandleError( CONNECTION *c, const int code, const char *fname ) Conn_OPTION_ADD(c, CONN_SSL_WANT_WRITE); /* fall through */ case SSL_ERROR_NONE: return 0; /* try again later */ - case SSL_ERROR_ZERO_RETURN: /* TLS/SSL Connection was shut down */ - LogOpenSSLError("TLS/SSL Connection shutdown", fname); + case SSL_ERROR_ZERO_RETURN: + LogDebug("TLS/SSL connection shut down normally"); break; /* SSL_ERROR_WANT_CONNECT, SSL_ERROR_WANT_ACCEPT, SSL_ERROR_WANT_X509_LOOKUP @@ -504,15 +518,14 @@ ConnSSL_HandleError( CONNECTION *c, const int code, const char *fname ) switch (code) { case GNUTLS_E_AGAIN: case GNUTLS_E_INTERRUPTED: - if (gnutls_record_get_direction(c->ssl_state.gnutls_session)) { /* need write */ - io_event_del(c->sock, IO_WANTREAD); - Conn_OPTION_ADD(c, CONN_SSL_WANT_WRITE); /* fall through */ - break; - } else { /* need read */ - io_event_del(c->sock, IO_WANTWRITE); - Conn_OPTION_ADD(c, CONN_SSL_WANT_READ); + if (gnutls_record_get_direction(c->ssl_state.gnutls_session)) { + Conn_OPTION_ADD(c, CONN_SSL_WANT_WRITE); + io_event_del(c->sock, IO_WANTREAD); + } else { + Conn_OPTION_ADD(c, CONN_SSL_WANT_READ); + io_event_del(c->sock, IO_WANTWRITE); + } break; - } default: assert(code < 0); if (gnutls_error_is_fatal(code)) { @@ -535,17 +548,17 @@ ConnSSL_LogCertInfo( CONNECTION *c ) assert( c ); assert( ssl ); - Log( LOG_INFO, "New %s connection using cipher %s on socket %d", + Log(LOG_INFO, "New %s connection using cipher %s on socket %d.", SSL_get_version(ssl), SSL_get_cipher(ssl), c->sock); #endif #ifdef HAVE_LIBGNUTLS - gnutls_credentials_type_t cred; gnutls_session_t sess = c->ssl_state.gnutls_session; gnutls_cipher_algorithm_t cipher = gnutls_cipher_get(sess); - Log( LOG_INFO, "New %s connection using cipher %s-%s on socket %d", - gnutls_protocol_get_name(gnutls_protocol_get_version(sess)), - gnutls_cipher_get_name(cipher), gnutls_mac_get_name(gnutls_mac_get(sess)), c->sock); + Log(LOG_INFO, "New %s connection using cipher %s-%s on socket %d.", + gnutls_protocol_get_name(gnutls_protocol_get_version(sess)), + gnutls_cipher_get_name(cipher), + gnutls_mac_get_name(gnutls_mac_get(sess)), c->sock); #endif } @@ -670,12 +683,20 @@ bool ConnSSL_GetCipherInfo(CONNECTION *c, char *buf, size_t len) { #ifdef HAVE_LIBSSL + char *nl; + SSL *ssl; assert(c != NULL); assert(len >= 128); ssl = c->ssl_state.ssl; - if (!ssl) return false; - return SSL_CIPHER_description(SSL_get_current_cipher(ssl), buf, len) != NULL; + if (!ssl) + return false; + *buf = 0; + SSL_CIPHER_description(SSL_get_current_cipher(ssl), buf, len); + nl = strchr(buf, '\n'); + if (nl) + *nl = 0; + return true; #endif #ifdef HAVE_LIBGNUTLS assert(c != NULL); @@ -692,7 +713,7 @@ ConnSSL_GetCipherInfo(CONNECTION *c, char *buf, size_t len) name_proto = gnutls_protocol_get_name(gnutls_protocol_get_version(sess)); name_keyexchange = gnutls_kx_get_name(gnutls_kx_get(sess)); - return snprintf(buf, len, "%s-%s%15s Kx=%s Enc=%s(%u) Mac=%s\n", + return snprintf(buf, len, "%s-%s%15s Kx=%s Enc=%s(%u) Mac=%s", name_cipher, name_mac, name_proto, name_keyexchange, name_cipher, keysize, name_mac) > 0; } return false;