send: remove ssl renegotiation limit

exit_client is not safe to call in send_queued_write. In start_auth,
sendheader is causing client exits prior to finish setting eg. the dns
pending flag.

diff --git a/include/fdlist.h b/include/fdlist.h
index b64126b32f77f2ef74445199523604c7ba89ce43..7f09c43f179324b5ccf7f42cb0768fa6b47e0cb9 100644 (file)
--- a/include/fdlist.h
+++ b/include/fdlist.h
@@ -92,7 +92,6 @@ typedef struct _fde
     /* We'd also add the retry count here when we get to that -- adrian */
   } connect;
   SSL *ssl;
-  int renegotiations;
   struct _fde *hnext;
 } fde_t;
 

diff --git a/src/fdlist.c b/src/fdlist.c
index 7c35f44452ea8f3e69219be5d7c515340c43d73b..4f4f6847457b8223e776faebc4821914b29d8483 100644 (file)
--- a/src/fdlist.c
+++ b/src/fdlist.c
@@ -152,7 +152,6 @@ fd_close(fde_t *F)
 
   if (F->ssl)
   {
-    SSL_set_app_data(F->ssl, NULL);
     SSL_free(F->ssl);
   }
 

diff --git a/src/migrate.c b/src/migrate.c
index 94397ab910ef6acbcb20efb246ad6ea9d517885d..b5bdb4c877af461cc62cde4b04fec5e000a97e96 100644 (file)
--- a/src/migrate.c
+++ b/src/migrate.c
@@ -271,7 +271,6 @@ ssl_connect_init(struct Client *client_p, struct MaskItem *conf, fde_t *fd)
   }
 
   SSL_set_fd(fd->ssl, fd->fd);
-  SSL_set_app_data(fd->ssl, fd);
 
   SSL_set_tlsext_host_name(fd->ssl, client_p->name);
 

diff --git a/src/packet.c b/src/packet.c
index 9d8808daff6cb629d8745063bc95902dfe4743c8..ac113660a8978184472214efe2199f02d9452e5b 100644 (file)
--- a/src/packet.c
+++ b/src/packet.c
@@ -296,12 +296,6 @@ read_packet(fde_t *fd, void *data)
       ERR_clear_error();
       length = SSL_read(fd->ssl, readBuf, READBUF_SIZE);
 
-      if (!IsServer(client_p) && fd->renegotiations > 1)
-      {
-        exit_client(client_p, &me, "SSL renegotiation not allowed");
-        return;
-      }
-
       /* translate openssl error codes, sigh */
       if (length < 0)
         switch (SSL_get_error(fd->ssl, length))

diff --git a/src/s_bsd.c b/src/s_bsd.c
index 57ed88ef433e58dcf71822f77a87b49c78e9976a..8b2b698a7356e6bf608240b097c679b538aa8e2c 100644 (file)
--- a/src/s_bsd.c
+++ b/src/s_bsd.c
@@ -336,7 +336,6 @@ add_connection(struct Listener *listener, struct irc_ssaddr *irn, int fd)
 
     AddFlag(new_client, FLAGS_SSL);
     SSL_set_fd(new_client->localClient->fd.ssl, fd);
-    SSL_set_app_data(new_client->localClient->fd.ssl, &new_client->localClient->fd);
     ssl_handshake(0, new_client);
   }
   else

diff --git a/src/s_serv.c b/src/s_serv.c
index 9a24e5a4883f1abe454d31e35c77cff958b6072d..2c0841ec9c7cd3ad1b06713d75d1cf5fb057de5b 100644 (file)
--- a/src/s_serv.c
+++ b/src/s_serv.c
@@ -905,7 +905,6 @@ ssl_connect_init(struct Client *client_p, struct MaskItem *conf, fde_t *fd)
   }
 
   SSL_set_fd(fd->ssl, fd->fd);
-  SSL_set_app_data(fd->ssl, fd);
 
   SSL_set_tlsext_host_name(fd->ssl, client_p->name);
 

diff --git a/src/send.c b/src/send.c
index 6a8309d850a8fe1d82d8f6328e05e7f3cd21c3c0..00a2decc75fc4bcefb7aff7733c3e0ea434bf49a 100644 (file)
--- a/src/send.c
+++ b/src/send.c
@@ -193,12 +193,6 @@ send_queued_write(struct Client *to)
         ERR_clear_error();
         retlen = SSL_write(to->localClient->fd.ssl, first->data + sendq->pos, first->size - sendq->pos);
 
-        if (!IsServer(to) && to->localClient->fd.renegotiations > 1)
-        {
-          exit_client(to, &me, "SSL renegotiation not allowed");
-          return;
-        }
-
         /* translate openssl error codes, sigh */
         if (retlen < 0)
         {

diff --git a/src/ssl.c b/src/ssl.c
index 4efb9bfb95745ddc346655f2b418c778454a857d..e18d50745dbc52f2b95a2d2812b11da8b4adf32d 100644 (file)
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -34,17 +34,6 @@ always_accept_verify_cb(int preverify_ok, X509_STORE_CTX *x509_ctx)
   return 1;
 }
 
-static void
-ssl_info_callback(const SSL *ssl, int where, int ret)
-{
-  if (where & SSL_CB_HANDSHAKE_START)
-  {
-    fde_t *fd = SSL_get_app_data(ssl);
-    if (fd)
-      ++fd->renegotiations;
-  }
-}
-
 static int
 ssl_servername_cb(SSL *s, int *ad, struct sslprofile *profile)
 {
@@ -138,8 +127,6 @@ sslprofile_identity_create(struct sslprofile *profile)
   SSL_CTX_set_verify(identity->server_ctx, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, always_accept_verify_cb);
   SSL_CTX_set_session_cache_mode(identity->server_ctx, SSL_SESS_CACHE_OFF);
 
-  SSL_CTX_set_info_callback(identity->server_ctx, ssl_info_callback);
-
   SSL_CTX_set_tlsext_servername_callback(identity->server_ctx, ssl_servername_cb);
   SSL_CTX_set_tlsext_servername_arg(identity->server_ctx, profile);