S2S-TLS/OpenSSL: Streamline logging

[ngircd-alex.git] / src / ngircd / conn.c

diff --git a/src/ngircd/conn.c b/src/ngircd/conn.c
index ae442b4ddbd5abf9820f804397d057a9082af59e..100429435eeb6dcae4ed59c76db558a322e43262 100644 (file)
--- a/src/ngircd/conn.c
+++ b/src/ngircd/conn.c
@@ -2556,6 +2556,13 @@ cb_listen_ssl(int sock, short irrelevant)
 /**
  * IO callback for new outgoing SSL-enabled server connections.
  *
+ * IMPORTANT: The SSL session has been validated before, but all errors have
+ * been ignored so far! The reason for this is that the generic SSL code has no
+ * idea if the new session actually belongs to a server, as this only becomes
+ * clear when the remote peer sends its PASS command (and we have to handle
+ * invalid client certificates!). Therefore, it is important to check the
+ * status of the SSL session first before continuing the server handshake here!
+ *
  * @param sock         Socket descriptor.
  * @param unused       (ignored IO specification)
  */
@@ -2563,6 +2570,7 @@ static void
 cb_connserver_login_ssl(int sock, short unused)
 {
        CONN_ID idx = Socket2Index(sock);
+       int serveridx;
 
        (void) unused;
 
@@ -2581,9 +2589,26 @@ cb_connserver_login_ssl(int sock, short unused)
                        return;
        }
 
-       Log( LOG_INFO, "SSL connection %d with \"%s:%d\" established.", idx,
-           My_Connections[idx].host, Conf_Server[Conf_GetServer( idx )].port );
+       serveridx = Conf_GetServer(idx);
+       assert(serveridx >= 0);
 
+       /* The SSL handshake is done, but validation results were ignored so
+        * far, so let's see where we are: */
+       LogDebug("SSL handshake on socket %d done.", idx);
+       if (!Conn_OPTION_ISSET(&My_Connections[idx], CONN_SSL_PEERCERT_OK)) {
+               if (Conf_Server[serveridx].SSLVerify) {
+                       Log(LOG_ERR,
+                               "Peer certificate check failed for \"%s\" on connection %d!",
+                               My_Connections[idx].host, idx);
+                       Conn_Close(idx, "Valid certificate required",
+                                  NULL, false);
+                       return;
+               }
+               Log(LOG_WARNING,
+                       "Peer certificate check failed for \"%s\" on connection %d, but \"SSLVerify\" is disabled. Continuing ...",
+                       My_Connections[idx].host, idx);
+       }
+       LogDebug("Server certificate accepted, continuing server login ...");
        server_login(idx);
 }