ircd/sslproc.c

   1 /*
   2  *  sslproc.c: An interface to ssld
   3  *  Copyright (C) 2007 Aaron Sethman <androsyn@ratbox.org>
   4  *  Copyright (C) 2007 ircd-ratbox development team
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 2 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, write to the Free Software
  18  *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301
  19  *  USA
  20  */
  21
  22 #include <rb_lib.h>
  23 #include "stdinc.h"
  24
  25
  26 #include "s_conf.h"
  27 #include "logger.h"
  28 #include "listener.h"
  29 #include "sslproc.h"
  30 #include "s_serv.h"
  31 #include "ircd.h"
  32 #include "hash.h"
  33 #include "client.h"
  34 #include "send.h"
  35 #include "packet.h"
  36 #include "certfp.h"
  37
  38 #define ZIPSTATS_TIME           60
  39
  40 static void collect_zipstats(void *unused);
  41 static void ssl_read_ctl(rb_fde_t * F, void *data);
  42 static int ssld_count;
  43
  44 static char tmpbuf[READBUF_SIZE];
  45 static char nul = '\0';
  46
  47 #define MAXPASSFD 4
  48 #define READSIZE 1024
  49 typedef struct _ssl_ctl_buf
  50 {
  51         rb_dlink_node node;
  52         char *buf;
  53         size_t buflen;
  54         rb_fde_t *F[MAXPASSFD];
  55         int nfds;
  56 } ssl_ctl_buf_t;
  57
  58
  59 struct _ssl_ctl
  60 {
  61         rb_dlink_node node;
  62         int cli_count;
  63         rb_fde_t *F;
  64         rb_fde_t *P;
  65         pid_t pid;
  66         rb_dlink_list readq;
  67         rb_dlink_list writeq;
  68         uint8_t shutdown;
  69         uint8_t dead;
  70         char version[256];
  71 };
  72
  73 static void ssld_update_config_one(ssl_ctl_t *ctl);
  74 static void send_new_ssl_certs_one(ssl_ctl_t * ctl);
  75 static void send_certfp_method(ssl_ctl_t *ctl);
  76
  77
  78 static rb_dlink_list ssl_daemons;
  79
  80 static inline uint32_t
  81 buf_to_uint32(char *buf)
  82 {
  83         uint32_t x;
  84         memcpy(&x, buf, sizeof(x));
  85         return x;
  86 }
  87
  88 static inline void
  89 uint32_to_buf(char *buf, uint32_t x)
  90 {
  91         memcpy(buf, &x, sizeof(x));
  92         return;
  93 }
  94
  95 static ssl_ctl_t *
  96 allocate_ssl_daemon(rb_fde_t * F, rb_fde_t * P, int pid)
  97 {
  98         ssl_ctl_t *ctl;
  99
 100         if(F == NULL || pid < 0)
 101                 return NULL;
 102         ctl = rb_malloc(sizeof(ssl_ctl_t));
 103         ctl->F = F;
 104         ctl->P = P;
 105         ctl->pid = pid;
 106         ssld_count++;
 107         rb_dlinkAdd(ctl, &ctl->node, &ssl_daemons);
 108         return ctl;
 109 }
 110
 111 static void
 112 free_ssl_daemon(ssl_ctl_t * ctl)
 113 {
 114         rb_dlink_node *ptr;
 115         ssl_ctl_buf_t *ctl_buf;
 116         int x;
 117         if(ctl->cli_count)
 118                 return;
 119
 120         RB_DLINK_FOREACH(ptr, ctl->readq.head)
 121         {
 122                 ctl_buf = ptr->data;
 123                 for(x = 0; x < ctl_buf->nfds; x++)
 124                         rb_close(ctl_buf->F[x]);
 125
 126                 rb_free(ctl_buf->buf);
 127                 rb_free(ctl_buf);
 128         }
 129
 130         RB_DLINK_FOREACH(ptr, ctl->writeq.head)
 131         {
 132                 ctl_buf = ptr->data;
 133                 for(x = 0; x < ctl_buf->nfds; x++)
 134                         rb_close(ctl_buf->F[x]);
 135
 136                 rb_free(ctl_buf->buf);
 137                 rb_free(ctl_buf);
 138         }
 139         rb_close(ctl->F);
 140         rb_close(ctl->P);
 141         rb_dlinkDelete(&ctl->node, &ssl_daemons);
 142         rb_free(ctl);
 143 }
 144
 145 static char *ssld_path;
 146
 147 static int ssld_spin_count = 0;
 148 static time_t last_spin;
 149 static int ssld_wait = 0;
 150
 151
 152 void
 153 restart_ssld(void)
 154 {
 155         rb_dlink_node *ptr, *next;
 156         ssl_ctl_t *ctl;
 157
 158         RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head)
 159         {
 160                 ctl = ptr->data;
 161                 if(ctl->dead)
 162                         continue;
 163                 if(ctl->shutdown)
 164                         continue;
 165                 ctl->shutdown = 1;
 166                 ssld_count--;
 167                 if(!ctl->cli_count)
 168                 {
 169                         rb_kill(ctl->pid, SIGKILL);
 170                         free_ssl_daemon(ctl);
 171                 }
 172         }
 173
 174         ssld_spin_count = 0;
 175         last_spin = 0;
 176         ssld_wait = 0;
 177         start_ssldaemon(ServerInfo.ssld_count);
 178 }
 179
 180 static void
 181 ssl_killall(void)
 182 {
 183         rb_dlink_node *ptr, *next;
 184         ssl_ctl_t *ctl;
 185         RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head)
 186         {
 187                 ctl = ptr->data;
 188                 if(ctl->dead)
 189                         continue;
 190                 ctl->dead = 1;
 191                 if(!ctl->shutdown)
 192                         ssld_count--;
 193                 rb_kill(ctl->pid, SIGKILL);
 194                 if(!ctl->cli_count)
 195                         free_ssl_daemon(ctl);
 196         }
 197 }
 198
 199 static void
 200 ssl_dead(ssl_ctl_t * ctl)
 201 {
 202         if(ctl->dead)
 203                 return;
 204
 205         ctl->dead = 1;
 206         rb_kill(ctl->pid, SIGKILL);     /* make sure the process is really gone */
 207
 208         if(!ctl->shutdown)
 209         {
 210                 ssld_count--;
 211                 ilog(L_MAIN, "ssld helper died - attempting to restart");
 212                 sendto_realops_snomask(SNO_GENERAL, L_NETWIDE, "ssld helper died - attempting to restart");
 213                 start_ssldaemon(1);
 214         }
 215 }
 216
 217 static void
 218 ssl_do_pipe(rb_fde_t * F, void *data)
 219 {
 220         int retlen;
 221         ssl_ctl_t *ctl = data;
 222         retlen = rb_write(F, "0", 1);
 223         if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno)))
 224         {
 225                 ssl_dead(ctl);
 226                 return;
 227         }
 228         rb_setselect(F, RB_SELECT_READ, ssl_do_pipe, data);
 229 }
 230
 231 static void
 232 restart_ssld_event(void *unused)
 233 {
 234         ssld_spin_count = 0;
 235         last_spin = 0;
 236         ssld_wait = 0;
 237         if(ServerInfo.ssld_count > get_ssld_count())
 238         {
 239                 int start = ServerInfo.ssld_count - get_ssld_count();
 240                 ilog(L_MAIN, "Attempting to restart ssld processes");
 241                 sendto_realops_snomask(SNO_GENERAL, L_NETWIDE, "Attempt to restart ssld processes");
 242                 start_ssldaemon(start);
 243         }
 244 }
 245
 246 int
 247 start_ssldaemon(int count)
 248 {
 249         rb_fde_t *F1, *F2;
 250         rb_fde_t *P1, *P2;
 251 #ifdef _WIN32
 252         const char *suffix = ".exe";
 253 #else
 254         const char *suffix = "";
 255 #endif
 256
 257         char fullpath[PATH_MAX + 1];
 258         char fdarg[6];
 259         const char *parv[2];
 260         char buf[128];
 261         char s_pid[10];
 262         pid_t pid;
 263         int started = 0, i;
 264
 265         if(ssld_wait)
 266                 return 0;
 267
 268         if(ssld_spin_count > 20 && (rb_current_time() - last_spin < 5))
 269         {
 270                 ilog(L_MAIN, "ssld helper is spinning - will attempt to restart in 1 minute");
 271                 sendto_realops_snomask(SNO_GENERAL, L_NETWIDE,
 272                                        "ssld helper is spinning - will attempt to restart in 1 minute");
 273                 rb_event_add("restart_ssld_event", restart_ssld_event, NULL, 60);
 274                 ssld_wait = 1;
 275                 return 0;
 276         }
 277
 278         ssld_spin_count++;
 279         last_spin = rb_current_time();
 280
 281         if(ssld_path == NULL)
 282         {
 283                 snprintf(fullpath, sizeof(fullpath), "%s%cssld%s", ircd_paths[IRCD_PATH_LIBEXEC], RB_PATH_SEPARATOR, suffix);
 284
 285                 if(access(fullpath, X_OK) == -1)
 286                 {
 287                         snprintf(fullpath, sizeof(fullpath), "%s%cbin%cssld%s",
 288                                     ConfigFileEntry.dpath, RB_PATH_SEPARATOR, RB_PATH_SEPARATOR, suffix);
 289                         if(access(fullpath, X_OK) == -1)
 290                         {
 291                                 ilog(L_MAIN,
 292                                      "Unable to execute ssld%s in %s or %s/bin",
 293                                      suffix, ircd_paths[IRCD_PATH_LIBEXEC], ConfigFileEntry.dpath);
 294                                 return 0;
 295                         }
 296                 }
 297                 ssld_path = rb_strdup(fullpath);
 298         }
 299         rb_strlcpy(buf, "-ircd ssld daemon", sizeof(buf));
 300         parv[0] = buf;
 301         parv[1] = NULL;
 302
 303         for(i = 0; i < count; i++)
 304         {
 305                 ssl_ctl_t *ctl;
 306                 if(rb_socketpair(AF_UNIX, SOCK_DGRAM, 0, &F1, &F2, "SSL/TLS handle passing socket") == -1)
 307                 {
 308                         ilog(L_MAIN, "Unable to create ssld - rb_socketpair failed: %s", strerror(errno));
 309                         return started;
 310                 }
 311
 312                 rb_set_buffers(F1, READBUF_SIZE);
 313                 rb_set_buffers(F2, READBUF_SIZE);
 314                 snprintf(fdarg, sizeof(fdarg), "%d", rb_get_fd(F2));
 315                 rb_setenv("CTL_FD", fdarg, 1);
 316                 if(rb_pipe(&P1, &P2, "SSL/TLS pipe") == -1)
 317                 {
 318                         ilog(L_MAIN, "Unable to create ssld - rb_pipe failed: %s", strerror(errno));
 319                         return started;
 320                 }
 321                 snprintf(fdarg, sizeof(fdarg), "%d", rb_get_fd(P1));
 322                 rb_setenv("CTL_PIPE", fdarg, 1);
 323                 snprintf(s_pid, sizeof(s_pid), "%d", (int)getpid());
 324                 rb_setenv("CTL_PPID", s_pid, 1);
 325 #ifdef _WIN32
 326                 SetHandleInformation((HANDLE) rb_get_fd(F2), HANDLE_FLAG_INHERIT, 1);
 327                 SetHandleInformation((HANDLE) rb_get_fd(P1), HANDLE_FLAG_INHERIT, 1);
 328 #endif
 329
 330                 pid = rb_spawn_process(ssld_path, (const char **) parv);
 331                 if(pid == -1)
 332                 {
 333                         ilog(L_MAIN, "Unable to create ssld: %s\n", strerror(errno));
 334                         rb_close(F1);
 335                         rb_close(F2);
 336                         rb_close(P1);
 337                         rb_close(P2);
 338                         return started;
 339                 }
 340                 started++;
 341                 rb_close(F2);
 342                 rb_close(P1);
 343                 ctl = allocate_ssl_daemon(F1, P2, pid);
 344                 if(ircd_ssl_ok)
 345                         ssld_update_config_one(ctl);
 346                 ssl_read_ctl(ctl->F, ctl);
 347                 ssl_do_pipe(P2, ctl);
 348
 349         }
 350         return started;
 351 }
 352
 353 static void
 354 ssl_process_zipstats(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf)
 355 {
 356         struct Client *server;
 357         struct ZipStats *zips;
 358         char *parv[6];
 359         int parc = rb_string_to_array(ctl_buf->buf, parv, sizeof(parv));
 360
 361         if (parc < sizeof(parv))
 362                 return;
 363
 364         server = find_server(NULL, parv[1]);
 365         if(server == NULL || server->localClient == NULL || !IsCapable(server, CAP_ZIP))
 366                 return;
 367         if(server->localClient->zipstats == NULL)
 368                 server->localClient->zipstats = rb_malloc(sizeof(struct ZipStats));
 369
 370         zips = server->localClient->zipstats;
 371
 372         zips->in += strtoull(parv[2], NULL, 10);
 373         zips->in_wire += strtoull(parv[3], NULL, 10);
 374         zips->out += strtoull(parv[4], NULL, 10);
 375         zips->out_wire += strtoull(parv[5], NULL, 10);
 376
 377         if(zips->in > 0)
 378                 zips->in_ratio = ((double) (zips->in - zips->in_wire) / (double) zips->in) * 100.00;
 379         else
 380                 zips->in_ratio = 0;
 381
 382         if(zips->out > 0)
 383                 zips->out_ratio = ((double) (zips->out - zips->out_wire) / (double) zips->out) * 100.00;
 384         else
 385                 zips->out_ratio = 0;
 386 }
 387
 388 static void
 389 ssl_process_open_fd(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf)
 390 {
 391         struct Client *client_p;
 392         uint32_t fd;
 393
 394         if(ctl_buf->buflen < 5)
 395                 return; /* bogus message..drop it.. XXX should warn here */
 396
 397         fd = buf_to_uint32(&ctl_buf->buf[1]);
 398         client_p = find_cli_connid_hash(fd);
 399         if(client_p == NULL || client_p->localClient == NULL)
 400                 return;
 401
 402         if(client_p->localClient->ssl_callback)
 403         {
 404                 SSL_OPEN_CB *hdl = client_p->localClient->ssl_callback;
 405
 406                 client_p->localClient->ssl_callback = NULL;
 407
 408                 hdl(client_p, RB_OK);
 409         }
 410 }
 411
 412 static void
 413 ssl_process_dead_fd(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf)
 414 {
 415         struct Client *client_p;
 416         char reason[256];
 417         uint32_t fd;
 418
 419         if(ctl_buf->buflen < 6)
 420                 return;         /* bogus message..drop it.. XXX should warn here */
 421
 422         fd = buf_to_uint32(&ctl_buf->buf[1]);
 423         rb_strlcpy(reason, &ctl_buf->buf[5], sizeof(reason));
 424         client_p = find_cli_connid_hash(fd);
 425         if(client_p == NULL || client_p->localClient == NULL)
 426                 return;
 427
 428         if(IsAnyServer(client_p))
 429         {
 430                 sendto_realops_snomask(SNO_GENERAL, L_NETWIDE, "ssld error for %s: %s", client_p->name, reason);
 431                 ilog(L_SERVER, "ssld error for %s: %s", log_client_name(client_p, SHOW_IP), reason);
 432         }
 433
 434         /* if there is still a pending callback, call it now */
 435         if(client_p->localClient->ssl_callback)
 436         {
 437                 SSL_OPEN_CB *hdl = client_p->localClient->ssl_callback;
 438
 439                 client_p->localClient->ssl_callback = NULL;
 440
 441                 if (hdl(client_p, RB_ERROR_SSL))
 442                 {
 443                         /* the callback has exited the client */
 444                         return;
 445                 }
 446         }
 447
 448         if(IsAnyServer(client_p) || IsRegistered(client_p))
 449         {
 450                 /* read any last moment ERROR, QUIT or the like -- jilles */
 451                 if (!strcmp(reason, "Remote host closed the connection"))
 452                         read_packet(client_p->localClient->F, client_p);
 453                 if (IsAnyDead(client_p))
 454                         return;
 455         }
 456         exit_client(client_p, client_p, &me, reason);
 457 }
 458
 459
 460 static void
 461 ssl_process_cipher_string(ssl_ctl_t *ctl, ssl_ctl_buf_t *ctl_buf)
 462 {
 463         struct Client *client_p;
 464         const char *cstring;
 465         uint32_t fd;
 466
 467         if(ctl_buf->buflen < 6)
 468                 return;         /* bogus message..drop it.. XXX should warn here */
 469
 470         fd = buf_to_uint32(&ctl_buf->buf[1]);
 471         cstring = (const char *)&ctl_buf->buf[5];
 472
 473         if(EmptyString(cstring))
 474                 return;
 475
 476         client_p = find_cli_connid_hash(fd);
 477         if(client_p != NULL && client_p->localClient != NULL)
 478         {
 479                 rb_free(client_p->localClient->cipher_string);
 480                 client_p->localClient->cipher_string = rb_strdup(cstring);
 481         }
 482 }
 483
 484
 485 static void
 486 ssl_process_certfp(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf)
 487 {
 488         struct Client *client_p;
 489         uint32_t fd;
 490         uint32_t certfp_method;
 491         uint32_t len;
 492         uint8_t *certfp;
 493         char *certfp_string;
 494         const char *method_string;
 495         int method_len;
 496
 497         if(ctl_buf->buflen > 13 + RB_SSL_CERTFP_LEN)
 498                 return;         /* bogus message..drop it.. XXX should warn here */
 499
 500         fd = buf_to_uint32(&ctl_buf->buf[1]);
 501         certfp_method = buf_to_uint32(&ctl_buf->buf[5]);
 502         len = buf_to_uint32(&ctl_buf->buf[9]);
 503         certfp = (uint8_t *)&ctl_buf->buf[13];
 504         client_p = find_cli_connid_hash(fd);
 505         if(client_p == NULL)
 506                 return;
 507
 508         switch (certfp_method) {
 509         case RB_SSL_CERTFP_METH_CERT_SHA1:
 510                 method_string = CERTFP_PREFIX_CERT_SHA1;
 511                 break;
 512         case RB_SSL_CERTFP_METH_CERT_SHA256:
 513                 method_string = CERTFP_PREFIX_CERT_SHA256;
 514                 break;
 515         case RB_SSL_CERTFP_METH_CERT_SHA512:
 516                 method_string = CERTFP_PREFIX_CERT_SHA512;
 517                 break;
 518         case RB_SSL_CERTFP_METH_SPKI_SHA256:
 519                 method_string = CERTFP_PREFIX_SPKI_SHA256;
 520                 break;
 521         case RB_SSL_CERTFP_METH_SPKI_SHA512:
 522                 method_string = CERTFP_PREFIX_SPKI_SHA512;
 523                 break;
 524         default:
 525                 return;
 526         }
 527         method_len = strlen(method_string);
 528
 529         rb_free(client_p->certfp);
 530         certfp_string = rb_malloc(method_len + len * 2 + 1);
 531         rb_strlcpy(certfp_string, method_string, method_len + len * 2 + 1);
 532         for(uint32_t i = 0; i < len; i++)
 533                 snprintf(certfp_string + method_len + 2 * i, 3, "%02x",
 534                                 certfp[i]);
 535         client_p->certfp = certfp_string;
 536 }
 537
 538 static void
 539 ssl_process_cmd_recv(ssl_ctl_t * ctl)
 540 {
 541         static const char *cannot_setup_ssl = "ssld cannot setup ssl, check your certificates and private key";
 542         static const char *no_ssl_or_zlib = "ssld has neither SSL/TLS or zlib support killing all sslds";
 543         rb_dlink_node *ptr, *next;
 544         ssl_ctl_buf_t *ctl_buf;
 545         unsigned long len;
 546
 547         if(ctl->dead)
 548                 return;
 549
 550         RB_DLINK_FOREACH_SAFE(ptr, next, ctl->readq.head)
 551         {
 552                 ctl_buf = ptr->data;
 553                 switch (*ctl_buf->buf)
 554                 {
 555                 case 'N':
 556                         ircd_ssl_ok = false;    /* ssld says it can't do ssl/tls */
 557                         break;
 558                 case 'O':
 559                         ssl_process_open_fd(ctl, ctl_buf);
 560                         break;
 561                 case 'D':
 562                         ssl_process_dead_fd(ctl, ctl_buf);
 563                         break;
 564                 case 'C':
 565                         ssl_process_cipher_string(ctl, ctl_buf);
 566                         break;
 567                 case 'F':
 568                         ssl_process_certfp(ctl, ctl_buf);
 569                         break;
 570                 case 'S':
 571                         ssl_process_zipstats(ctl, ctl_buf);
 572                         break;
 573                 case 'I':
 574                         ircd_ssl_ok = false;
 575                         ilog(L_MAIN, "%s", cannot_setup_ssl);
 576                         sendto_realops_snomask(SNO_GENERAL, L_NETWIDE, "%s", cannot_setup_ssl);
 577                         break;
 578                 case 'U':
 579                         ircd_zlib_ok = 0;
 580                         ircd_ssl_ok = false;
 581                         ilog(L_MAIN, "%s", no_ssl_or_zlib);
 582                         sendto_realops_snomask(SNO_GENERAL, L_NETWIDE, "%s", no_ssl_or_zlib);
 583                         ssl_killall();
 584                         return;
 585                 case 'V':
 586                         len = ctl_buf->buflen - 1;
 587                         if (len > sizeof(ctl->version) - 1)
 588                                 len = sizeof(ctl->version) - 1;
 589                         strncpy(ctl->version, &ctl_buf->buf[1], len);
 590                 case 'z':
 591                         ircd_zlib_ok = 0;
 592                         break;
 593                 default:
 594                         ilog(L_MAIN, "Received invalid command from ssld: %s", ctl_buf->buf);
 595                         sendto_realops_snomask(SNO_GENERAL, L_NETWIDE, "Received invalid command from ssld");
 596                         break;
 597                 }
 598                 rb_dlinkDelete(ptr, &ctl->readq);
 599                 rb_free(ctl_buf->buf);
 600                 rb_free(ctl_buf);
 601         }
 602
 603 }
 604
 605
 606 static void
 607 ssl_read_ctl(rb_fde_t * F, void *data)
 608 {
 609         ssl_ctl_buf_t *ctl_buf;
 610         ssl_ctl_t *ctl = data;
 611         int retlen;
 612
 613         if(ctl->dead)
 614                 return;
 615         do
 616         {
 617                 ctl_buf = rb_malloc(sizeof(ssl_ctl_buf_t));
 618                 ctl_buf->buf = rb_malloc(READSIZE);
 619                 retlen = rb_recv_fd_buf(ctl->F, ctl_buf->buf, READSIZE, ctl_buf->F, 4);
 620                 ctl_buf->buflen = retlen;
 621                 if(retlen <= 0)
 622                 {
 623                         rb_free(ctl_buf->buf);
 624                         rb_free(ctl_buf);
 625                 }
 626                 else
 627                         rb_dlinkAddTail(ctl_buf, &ctl_buf->node, &ctl->readq);
 628         }
 629         while(retlen > 0);
 630
 631         if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno)))
 632         {
 633                 ssl_dead(ctl);
 634                 return;
 635         }
 636         ssl_process_cmd_recv(ctl);
 637         rb_setselect(ctl->F, RB_SELECT_READ, ssl_read_ctl, ctl);
 638 }
 639
 640 static ssl_ctl_t *
 641 which_ssld(void)
 642 {
 643         ssl_ctl_t *ctl, *lowest = NULL;
 644         rb_dlink_node *ptr;
 645
 646         RB_DLINK_FOREACH(ptr, ssl_daemons.head)
 647         {
 648                 ctl = ptr->data;
 649                 if(ctl->dead)
 650                         continue;
 651                 if(ctl->shutdown)
 652                         continue;
 653                 if(lowest == NULL)
 654                 {
 655                         lowest = ctl;
 656                         continue;
 657                 }
 658                 if(ctl->cli_count < lowest->cli_count)
 659                         lowest = ctl;
 660         }
 661         return (lowest);
 662 }
 663
 664 static void
 665 ssl_write_ctl(rb_fde_t * F, void *data)
 666 {
 667         ssl_ctl_t *ctl = data;
 668         ssl_ctl_buf_t *ctl_buf;
 669         rb_dlink_node *ptr, *next;
 670         int retlen, x;
 671
 672         if(ctl->dead)
 673                 return;
 674
 675         RB_DLINK_FOREACH_SAFE(ptr, next, ctl->writeq.head)
 676         {
 677                 ctl_buf = ptr->data;
 678                 /* in theory unix sock_dgram shouldn't ever short write this.. */
 679                 retlen = rb_send_fd_buf(ctl->F, ctl_buf->F, ctl_buf->nfds, ctl_buf->buf, ctl_buf->buflen, ctl->pid);
 680                 if(retlen > 0)
 681                 {
 682                         rb_dlinkDelete(ptr, &ctl->writeq);
 683                         for(x = 0; x < ctl_buf->nfds; x++)
 684                                 rb_close(ctl_buf->F[x]);
 685                         rb_free(ctl_buf->buf);
 686                         rb_free(ctl_buf);
 687
 688                 }
 689                 if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno)))
 690                 {
 691                         ssl_dead(ctl);
 692                         return;
 693                 }
 694                 else
 695                 {
 696                         rb_setselect(ctl->F, RB_SELECT_WRITE, ssl_write_ctl, ctl);
 697                 }
 698         }
 699 }
 700
 701 static void
 702 ssl_cmd_write_queue(ssl_ctl_t * ctl, rb_fde_t ** F, int count, const void *buf, size_t buflen)
 703 {
 704         ssl_ctl_buf_t *ctl_buf;
 705         int x;
 706
 707         /* don't bother */
 708         if(ctl->dead)
 709                 return;
 710
 711         ctl_buf = rb_malloc(sizeof(ssl_ctl_buf_t));
 712         ctl_buf->buf = rb_malloc(buflen);
 713         memcpy(ctl_buf->buf, buf, buflen);
 714         ctl_buf->buflen = buflen;
 715
 716         for(x = 0; x < count && x < MAXPASSFD; x++)
 717         {
 718                 ctl_buf->F[x] = F[x];
 719         }
 720         ctl_buf->nfds = count;
 721         rb_dlinkAddTail(ctl_buf, &ctl_buf->node, &ctl->writeq);
 722         ssl_write_ctl(ctl->F, ctl);
 723 }
 724
 725
 726 static void
 727 send_new_ssl_certs_one(ssl_ctl_t * ctl)
 728 {
 729         size_t len = 5;
 730
 731         if(ServerInfo.ssl_cert)
 732                 len += strlen(ServerInfo.ssl_cert);
 733         else
 734                 return;
 735
 736         if(ServerInfo.ssl_private_key)
 737                 len += strlen(ServerInfo.ssl_private_key);
 738
 739         if(ServerInfo.ssl_dh_params)
 740                 len += strlen(ServerInfo.ssl_dh_params);
 741
 742         if(ServerInfo.ssl_cipher_list)
 743                 len += strlen(ServerInfo.ssl_cipher_list);
 744
 745         if(len > sizeof(tmpbuf))
 746         {
 747                 sendto_realops_snomask(SNO_GENERAL, L_NETWIDE,
 748                                        "Parameters for send_new_ssl_certs_one too long (%zu > %zu) to pass to ssld, not sending...",
 749                                        len, sizeof(tmpbuf));
 750                 ilog(L_MAIN,
 751                      "Parameters for send_new_ssl_certs_one too long (%zu > %zu) to pass to ssld, not sending...",
 752                      len, sizeof(tmpbuf));
 753                 return;
 754         }
 755
 756         int ret = snprintf(tmpbuf, sizeof(tmpbuf), "K%c%s%c%s%c%s%c%s%c", nul,
 757                            ServerInfo.ssl_cert, nul,
 758                            ServerInfo.ssl_private_key != NULL ? ServerInfo.ssl_private_key : "", nul,
 759                            ServerInfo.ssl_dh_params != NULL ? ServerInfo.ssl_dh_params : "", nul,
 760                            ServerInfo.ssl_cipher_list != NULL ? ServerInfo.ssl_cipher_list : "", nul);
 761
 762         if(ret > 5)
 763                 ssl_cmd_write_queue(ctl, NULL, 0, tmpbuf, (size_t) ret);
 764 }
 765
 766 static void
 767 send_certfp_method(ssl_ctl_t *ctl)
 768 {
 769         char buf[5];
 770
 771         buf[0] = 'F';
 772         uint32_to_buf(&buf[1], ConfigFileEntry.certfp_method);
 773         ssl_cmd_write_queue(ctl, NULL, 0, buf, sizeof(buf));
 774 }
 775
 776 static void
 777 ssld_update_config_one(ssl_ctl_t *ctl)
 778 {
 779         send_certfp_method(ctl);
 780         send_new_ssl_certs_one(ctl);
 781 }
 782
 783 void
 784 ssld_update_config(void)
 785 {
 786         rb_dlink_node *ptr;
 787
 788         RB_DLINK_FOREACH(ptr, ssl_daemons.head)
 789         {
 790                 ssl_ctl_t *ctl = ptr->data;
 791
 792                 if (ctl->dead || ctl->shutdown)
 793                         continue;
 794
 795                 ssld_update_config_one(ctl);
 796         }
 797 }
 798
 799 ssl_ctl_t *
 800 start_ssld_accept(rb_fde_t * sslF, rb_fde_t * plainF, uint32_t id)
 801 {
 802         rb_fde_t *F[2];
 803         ssl_ctl_t *ctl;
 804         char buf[5];
 805         F[0] = sslF;
 806         F[1] = plainF;
 807
 808         buf[0] = 'A';
 809         uint32_to_buf(&buf[1], id);
 810         ctl = which_ssld();
 811         if(!ctl)
 812                 return NULL;
 813         ctl->cli_count++;
 814         ssl_cmd_write_queue(ctl, F, 2, buf, sizeof(buf));
 815         return ctl;
 816 }
 817
 818 ssl_ctl_t *
 819 start_ssld_connect(rb_fde_t * sslF, rb_fde_t * plainF, uint32_t id)
 820 {
 821         rb_fde_t *F[2];
 822         ssl_ctl_t *ctl;
 823         char buf[5];
 824         F[0] = sslF;
 825         F[1] = plainF;
 826
 827         buf[0] = 'C';
 828         uint32_to_buf(&buf[1], id);
 829
 830         ctl = which_ssld();
 831         if(!ctl)
 832                 return NULL;
 833         ctl->cli_count++;
 834         ssl_cmd_write_queue(ctl, F, 2, buf, sizeof(buf));
 835         return ctl;
 836 }
 837
 838 void
 839 ssld_decrement_clicount(ssl_ctl_t * ctl)
 840 {
 841         if(ctl == NULL)
 842                 return;
 843
 844         ctl->cli_count--;
 845         if(ctl->shutdown && !ctl->cli_count)
 846         {
 847                 ctl->dead = 1;
 848                 rb_kill(ctl->pid, SIGKILL);
 849         }
 850         if(ctl->dead && !ctl->cli_count)
 851         {
 852                 free_ssl_daemon(ctl);
 853         }
 854 }
 855
 856 /*
 857  * what we end up sending to the ssld process for ziplinks is the following
 858  * Z[ourfd][level][RECVQ]
 859  * Z = ziplinks command = buf[0]
 860  * ourfd = Our end of the socketpair = buf[1..4]
 861  * level = zip level buf[5]
 862  * recvqlen = our recvq len = buf[6-7]
 863  * recvq = any data we read prior to starting ziplinks
 864  */
 865 void
 866 start_zlib_session(void *data)
 867 {
 868         struct Client *server = (struct Client *) data;
 869         uint16_t recvqlen;
 870         uint8_t level;
 871         void *xbuf;
 872
 873         rb_fde_t *F[2];
 874         rb_fde_t *xF1, *xF2;
 875         char *buf;
 876         void *recvq_start;
 877
 878         size_t hdr = (sizeof(uint8_t) * 2) + sizeof(uint32_t);
 879         size_t len;
 880         int cpylen, left;
 881
 882         server->localClient->event = NULL;
 883
 884         recvqlen = rb_linebuf_len(&server->localClient->buf_recvq);
 885
 886         len = recvqlen + hdr;
 887
 888         if(len > READBUF_SIZE)
 889         {
 890                 sendto_realops_snomask(SNO_GENERAL, L_NETWIDE,
 891                                        "ssld - attempted to pass message of %zd len, max len %d, giving up",
 892                                        len, READBUF_SIZE);
 893                 ilog(L_MAIN, "ssld - attempted to pass message of %zd len, max len %d, giving up", len, READBUF_SIZE);
 894                 exit_client(server, server, server, "ssld readbuf exceeded");
 895                 return;
 896         }
 897
 898         buf = rb_malloc(len);
 899         level = ConfigFileEntry.compression_level;
 900
 901         uint32_to_buf(&buf[1], rb_get_fd(server->localClient->F));
 902         buf[5] = (char) level;
 903
 904         recvq_start = &buf[6];
 905         server->localClient->zipstats = rb_malloc(sizeof(struct ZipStats));
 906
 907         xbuf = recvq_start;
 908         left = recvqlen;
 909
 910         do
 911         {
 912                 cpylen = rb_linebuf_get(&server->localClient->buf_recvq, xbuf, left, LINEBUF_PARTIAL, LINEBUF_RAW);
 913                 left -= cpylen;
 914                 xbuf = (void *) (((uintptr_t) xbuf) + cpylen);
 915         }
 916         while(cpylen > 0);
 917
 918         /* Pass the socket to ssld. */
 919         *buf = 'Z';
 920         if(rb_socketpair(AF_UNIX, SOCK_STREAM, 0, &xF1, &xF2, "Initial zlib socketpairs") == -1)
 921         {
 922                 sendto_realops_snomask(SNO_GENERAL, L_NETWIDE, "Error creating zlib socketpair - %s", strerror(errno));
 923                 ilog(L_MAIN, "Error creating zlib socketpairs - %s", strerror(errno));
 924                 exit_client(server, server, server, "Error creating zlib socketpair");
 925                 rb_free(buf);
 926                 return;
 927         }
 928
 929         F[0] = server->localClient->F;
 930         F[1] = xF1;
 931         server->localClient->F = xF2;
 932         /* need to redo as what we did before isn't valid now */
 933         uint32_to_buf(&buf[1], connid_get(server));
 934
 935         server->localClient->z_ctl = which_ssld();
 936         if(!server->localClient->z_ctl)
 937         {
 938                 exit_client(server, server, server, "Error finding available ssld");
 939                 rb_free(buf);
 940                 return;
 941         }
 942         server->localClient->z_ctl->cli_count++;
 943         ssl_cmd_write_queue(server->localClient->z_ctl, F, 2, buf, len);
 944         rb_free(buf);
 945 }
 946
 947 static void
 948 collect_zipstats(void *unused)
 949 {
 950         rb_dlink_node *ptr;
 951         struct Client *target_p;
 952         char buf[sizeof(uint8_t) + sizeof(uint32_t) + HOSTLEN];
 953         void *odata;
 954         size_t len;
 955         uint32_t id;
 956
 957         buf[0] = 'S';
 958         odata = buf + sizeof(uint8_t) + sizeof(uint32_t);
 959
 960         RB_DLINK_FOREACH(ptr, serv_list.head)
 961         {
 962                 target_p = ptr->data;
 963                 if(IsCapable(target_p, CAP_ZIP))
 964                 {
 965                         len = sizeof(uint8_t) + sizeof(uint32_t);
 966
 967                         id = rb_get_fd(target_p->localClient->F);
 968                         uint32_to_buf(&buf[1], id);
 969                         rb_strlcpy(odata, target_p->name, (sizeof(buf) - len));
 970                         len += strlen(odata) + 1;       /* Get the \0 as well */
 971                         ssl_cmd_write_queue(target_p->localClient->z_ctl, NULL, 0, buf, len);
 972                 }
 973         }
 974 }
 975
 976 static void
 977 cleanup_dead_ssl(void *unused)
 978 {
 979         rb_dlink_node *ptr, *next;
 980         ssl_ctl_t *ctl;
 981         RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head)
 982         {
 983                 ctl = ptr->data;
 984                 if(ctl->dead && !ctl->cli_count)
 985                 {
 986                         free_ssl_daemon(ctl);
 987                 }
 988         }
 989 }
 990
 991 int
 992 get_ssld_count(void)
 993 {
 994         return ssld_count;
 995 }
 996
 997 void
 998 ssld_foreach_info(void (*func)(void *data, pid_t pid, int cli_count, enum ssld_status status, const char *version), void *data)
 999 {
1000         rb_dlink_node *ptr, *next;
1001         ssl_ctl_t *ctl;
1002         RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head)
1003         {
1004                 ctl = ptr->data;
1005                 func(data, ctl->pid, ctl->cli_count,
1006                         ctl->dead ? SSLD_DEAD :
1007                                 (ctl->shutdown ? SSLD_SHUTDOWN : SSLD_ACTIVE),
1008                         ctl->version);
1009         }
1010 }
1011
1012 void
1013 init_ssld(void)
1014 {
1015         rb_event_addish("collect_zipstats", collect_zipstats, NULL, ZIPSTATS_TIME);
1016         rb_event_addish("cleanup_dead_ssld", cleanup_dead_ssl, NULL, 60);
1017 }