X-Git-Url: https://arthur.barton.de/cgi-bin/gitweb.cgi?p=ngircd-alex.git;a=blobdiff_plain;f=src%2Fngircd%2Fconn-ssl.c;h=8f7b70afccb0e310793013e0f53ee5f38522a614;hp=4ef8f661b2d4fac2640eed10f0fdf8f7316335db;hb=343a90dc376eb9979151752ec33c64ca45b04802;hpb=b8c6dd503fe4e7814f4b9327a8cd43007a4ec150 diff --git a/src/ngircd/conn-ssl.c b/src/ngircd/conn-ssl.c index 4ef8f661..8f7b70af 100644 --- a/src/ngircd/conn-ssl.c +++ b/src/ngircd/conn-ssl.c @@ -1,11 +1,15 @@ /* * ngIRCd -- The Next Generation IRC Daemon - * - * SSL wrapper functions. * Copyright (c) 2005-2008 Florian Westphal */ #include "portab.h" + +/** + * @file + * SSL wrapper functions + */ + #include "imp.h" #include "conf-ssl.h" @@ -47,10 +51,11 @@ static bool ConnSSL_LoadServerKey_openssl PARAMS(( SSL_CTX *c )); #include #include -#define DH_BITS 1024 +#define DH_BITS 2048 +#define DH_BITS_MIN 1024 + static gnutls_certificate_credentials_t x509_cred; static gnutls_dh_params_t dh_params; - static bool ConnSSL_LoadServerKey_gnutls PARAMS(( void )); #endif @@ -383,10 +388,10 @@ ConnSSL_Init_SSL(CONNECTION *c) int ret; assert(c != NULL); #ifdef HAVE_LIBSSL - assert(ssl_ctx); - if (!ssl_ctx) /* NULL when library initialization failed */ + if (!ssl_ctx) { + Log(LOG_ERR, "Cannot init ssl_ctx: OpenSSL initialization failed at startup"); return false; - + } assert(c->ssl_state.ssl == NULL); c->ssl_state.ssl = SSL_new(ssl_ctx); @@ -407,6 +412,7 @@ ConnSSL_Init_SSL(CONNECTION *c) if (ret < 0) { Log(LOG_ERR, "gnutls_set_default_priority: %s", gnutls_strerror(ret)); ConnSSL_Free(c); + return false; } /* * The intermediate (long) cast is here to avoid a warning like: @@ -419,8 +425,9 @@ ConnSSL_Init_SSL(CONNECTION *c) if (ret < 0) { Log(LOG_ERR, "gnutls_credentials_set: %s", gnutls_strerror(ret)); ConnSSL_Free(c); + return false; } - gnutls_dh_set_prime_bits(c->ssl_state.gnutls_session, DH_BITS); + gnutls_dh_set_prime_bits(c->ssl_state.gnutls_session, DH_BITS_MIN); #endif Conn_OPTION_ADD(c, CONN_SSL); return true; @@ -433,10 +440,7 @@ ConnSSL_PrepareConnect(CONNECTION *c, UNUSED CONF_SERVER *s) bool ret; #ifdef HAVE_LIBGNUTLS int err; -#endif - assert(c != NULL); - assert(s != NULL); -#ifdef HAVE_LIBGNUTLS + err = gnutls_init(&c->ssl_state.gnutls_session, GNUTLS_CLIENT); if (err) { Log(LOG_ERR, "gnutls_init: %s", gnutls_strerror(err)); @@ -471,8 +475,6 @@ ConnSSL_HandleError( CONNECTION *c, const int code, const char *fname ) unsigned long sslerr; int real_errno = errno; - assert( fname ); - ret = SSL_get_error(c->ssl_state.ssl, code); switch (ret) { case SSL_ERROR_WANT_READ: @@ -518,15 +520,14 @@ ConnSSL_HandleError( CONNECTION *c, const int code, const char *fname ) switch (code) { case GNUTLS_E_AGAIN: case GNUTLS_E_INTERRUPTED: - if (gnutls_record_get_direction(c->ssl_state.gnutls_session)) { /* need write */ - io_event_del(c->sock, IO_WANTREAD); - Conn_OPTION_ADD(c, CONN_SSL_WANT_WRITE); /* fall through */ - break; - } else { /* need read */ - io_event_del(c->sock, IO_WANTWRITE); - Conn_OPTION_ADD(c, CONN_SSL_WANT_READ); + if (gnutls_record_get_direction(c->ssl_state.gnutls_session)) { + Conn_OPTION_ADD(c, CONN_SSL_WANT_WRITE); + io_event_del(c->sock, IO_WANTREAD); + } else { + Conn_OPTION_ADD(c, CONN_SSL_WANT_READ); + io_event_del(c->sock, IO_WANTWRITE); + } break; - } default: assert(code < 0); if (gnutls_error_is_fatal(code)) { @@ -546,20 +547,20 @@ ConnSSL_LogCertInfo( CONNECTION *c ) #ifdef HAVE_LIBSSL SSL *ssl = c->ssl_state.ssl; - assert( c ); - assert( ssl ); + assert(ssl); - Log(LOG_INFO, "New %s connection using cipher %s on socket %d.", - SSL_get_version(ssl), SSL_get_cipher(ssl), c->sock); + Log(LOG_INFO, "Connection %d: initialized %s using cipher %s.", + c->sock, SSL_get_version(ssl), SSL_get_cipher(ssl)); #endif #ifdef HAVE_LIBGNUTLS gnutls_session_t sess = c->ssl_state.gnutls_session; gnutls_cipher_algorithm_t cipher = gnutls_cipher_get(sess); - Log(LOG_INFO, "New %s connection using cipher %s-%s on socket %d.", + Log(LOG_INFO, "Connection %d: initialized %s using cipher %s-%s.", + c->sock, gnutls_protocol_get_name(gnutls_protocol_get_version(sess)), gnutls_cipher_get_name(cipher), - gnutls_mac_get_name(gnutls_mac_get(sess)), c->sock); + gnutls_mac_get_name(gnutls_mac_get(sess))); #endif } @@ -575,11 +576,8 @@ int ConnSSL_Accept( CONNECTION *c ) { assert(c != NULL); -#ifdef HAVE_LIBSSL - if (!c->ssl_state.ssl) { -#endif -#ifdef HAVE_LIBGNUTLS if (!Conn_OPTION_ISSET(c, CONN_SSL)) { +#ifdef HAVE_LIBGNUTLS int err = gnutls_init(&c->ssl_state.gnutls_session, GNUTLS_SERVER); if (err) { Log(LOG_ERR, "gnutls_init: %s", gnutls_strerror(err)); @@ -601,9 +599,7 @@ ConnSSL_Connect( CONNECTION *c ) #ifdef HAVE_LIBSSL assert(c->ssl_state.ssl); #endif -#ifdef HAVE_LIBGNUTLS assert(Conn_OPTION_ISSET(c, CONN_SSL)); -#endif return ConnectAccept(c, true); } @@ -623,13 +619,14 @@ ConnectAccept( CONNECTION *c, bool connect) #endif #ifdef HAVE_LIBGNUTLS (void) connect; - assert(Conn_OPTION_ISSET(c, CONN_SSL)); ret = gnutls_handshake(c->ssl_state.gnutls_session); if (ret) return ConnSSL_HandleError(c, ret, "gnutls_handshake"); #endif /* _GNUTLS */ Conn_OPTION_DEL(c, (CONN_SSL_WANT_WRITE|CONN_SSL_WANT_READ|CONN_SSL_CONNECT)); ConnSSL_LogCertInfo(c); + + Conn_StartLogin(CONNECTION2ID(c)); return 1; } @@ -648,7 +645,8 @@ ConnSSL_Write(CONNECTION *c, const void *buf, size_t count) #ifdef HAVE_LIBGNUTLS bw = gnutls_write(c->ssl_state.gnutls_session, buf, count); #endif - if ( bw > 0 ) return bw; + if (bw > 0) + return bw; if (ConnSSL_HandleError( c, bw, "ConnSSL_Write") == 0) errno = EAGAIN; /* try again */ return -1; @@ -685,11 +683,8 @@ ConnSSL_GetCipherInfo(CONNECTION *c, char *buf, size_t len) { #ifdef HAVE_LIBSSL char *nl; + SSL *ssl = c->ssl_state.ssl; - SSL *ssl; - assert(c != NULL); - assert(len >= 128); - ssl = c->ssl_state.ssl; if (!ssl) return false; *buf = 0; @@ -700,8 +695,6 @@ ConnSSL_GetCipherInfo(CONNECTION *c, char *buf, size_t len) return true; #endif #ifdef HAVE_LIBGNUTLS - assert(c != NULL); - assert(len >= 128); if (Conn_OPTION_ISSET(c, CONN_SSL)) { const char *name_cipher, *name_mac, *name_proto, *name_keyexchange; unsigned keysize;