]>
Commit | Line | Data |
---|---|---|
2b6c8773 WP |
1 | /* |
2 | * sslproc.c: An interface to ssld | |
3 | * Copyright (C) 2007 Aaron Sethman <androsyn@ratbox.org> | |
4 | * Copyright (C) 2007 ircd-ratbox development team | |
5 | * | |
6 | * This program is free software; you can redistribute it and/or modify | |
7 | * it under the terms of the GNU General Public License as published by | |
8 | * the Free Software Foundation; either version 2 of the License, or | |
9 | * (at your option) any later version. | |
10 | * | |
11 | * This program is distributed in the hope that it will be useful, | |
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
14 | * GNU General Public License for more details. | |
15 | * | |
16 | * You should have received a copy of the GNU General Public License | |
17 | * along with this program; if not, write to the Free Software | |
18 | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 | |
19 | * USA | |
20 | * | |
94b4fbf9 | 21 | * $Id$ |
2b6c8773 WP |
22 | */ |
23 | ||
24 | #include <ratbox_lib.h> | |
25 | #include "stdinc.h" | |
94b4fbf9 VY |
26 | |
27 | ||
2b6c8773 WP |
28 | #include "s_conf.h" |
29 | #include "logger.h" | |
30 | #include "listener.h" | |
31 | #include "sslproc.h" | |
32 | #include "s_serv.h" | |
33 | #include "ircd.h" | |
34 | #include "hash.h" | |
35 | #include "client.h" | |
36 | #include "send.h" | |
37 | #include "packet.h" | |
38 | ||
39 | #define ZIPSTATS_TIME 60 | |
40 | ||
41 | static void collect_zipstats(void *unused); | |
94b4fbf9 | 42 | static void ssl_read_ctl(rb_fde_t * F, void *data); |
2b6c8773 WP |
43 | static int ssld_count; |
44 | ||
94b4fbf9 | 45 | static char tmpbuf[READBUF_SIZE]; |
2b6c8773 WP |
46 | static char nul = '\0'; |
47 | ||
48 | #define MAXPASSFD 4 | |
49 | #define READSIZE 1024 | |
50 | typedef struct _ssl_ctl_buf | |
51 | { | |
52 | rb_dlink_node node; | |
53 | char *buf; | |
54 | size_t buflen; | |
55 | rb_fde_t *F[MAXPASSFD]; | |
56 | int nfds; | |
57 | } ssl_ctl_buf_t; | |
58 | ||
59 | ||
60 | struct _ssl_ctl | |
61 | { | |
62 | rb_dlink_node node; | |
63 | int cli_count; | |
64 | rb_fde_t *F; | |
65 | rb_fde_t *P; | |
66 | pid_t pid; | |
67 | rb_dlink_list readq; | |
68 | rb_dlink_list writeq; | |
f5bdde4b | 69 | uint8_t dead; |
2b6c8773 WP |
70 | }; |
71 | ||
94b4fbf9 VY |
72 | static void send_new_ssl_certs_one(ssl_ctl_t * ctl, const char *ssl_cert, |
73 | const char *ssl_private_key, const char *ssl_dh_params); | |
74 | static void send_init_prng(ssl_ctl_t * ctl, prng_seed_t seedtype, const char *path); | |
2b6c8773 WP |
75 | |
76 | ||
77 | static rb_dlink_list ssl_daemons; | |
78 | ||
94b4fbf9 VY |
79 | static inline int32_t |
80 | buf_to_int32(char *buf) | |
2b6c8773 | 81 | { |
f5bdde4b VY |
82 | int32_t x; |
83 | memcpy(&x, buf, sizeof(x)); | |
2b6c8773 WP |
84 | return x; |
85 | } | |
86 | ||
94b4fbf9 VY |
87 | static inline void |
88 | int32_to_buf(char *buf, int32_t x) | |
2b6c8773 | 89 | { |
f5bdde4b | 90 | memcpy(buf, &x, sizeof(x)); |
2b6c8773 WP |
91 | return; |
92 | } | |
93 | ||
94 | ||
94b4fbf9 VY |
95 | static inline uint16_t |
96 | buf_to_uint16(char *buf) | |
2b6c8773 | 97 | { |
f5bdde4b VY |
98 | uint16_t x; |
99 | memcpy(&x, buf, sizeof(x)); | |
2b6c8773 WP |
100 | return x; |
101 | } | |
102 | ||
94b4fbf9 VY |
103 | static inline void |
104 | uint16_to_buf(char *buf, uint16_t x) | |
2b6c8773 | 105 | { |
f5bdde4b | 106 | memcpy(buf, &x, sizeof(x)); |
2b6c8773 WP |
107 | return; |
108 | } | |
109 | ||
110 | ||
111 | static ssl_ctl_t * | |
94b4fbf9 | 112 | allocate_ssl_daemon(rb_fde_t * F, rb_fde_t * P, int pid) |
2b6c8773 WP |
113 | { |
114 | ssl_ctl_t *ctl; | |
94b4fbf9 | 115 | |
2b6c8773 WP |
116 | if(F == NULL || pid < 0) |
117 | return NULL; | |
94b4fbf9 | 118 | ctl = rb_malloc(sizeof(ssl_ctl_t)); |
2b6c8773 WP |
119 | ctl->F = F; |
120 | ctl->P = P; | |
121 | ctl->pid = pid; | |
122 | ssld_count++; | |
123 | rb_dlinkAdd(ctl, &ctl->node, &ssl_daemons); | |
124 | return ctl; | |
125 | } | |
126 | ||
127 | static void | |
94b4fbf9 | 128 | free_ssl_daemon(ssl_ctl_t * ctl) |
2b6c8773 WP |
129 | { |
130 | rb_dlink_node *ptr; | |
131 | ssl_ctl_buf_t *ctl_buf; | |
132 | int x; | |
133 | if(ctl->cli_count) | |
134 | return; | |
94b4fbf9 | 135 | |
2b6c8773 WP |
136 | RB_DLINK_FOREACH(ptr, ctl->readq.head) |
137 | { | |
138 | ctl_buf = ptr->data; | |
139 | for(x = 0; x < ctl_buf->nfds; x++) | |
94b4fbf9 | 140 | rb_close(ctl_buf->F[x]); |
2b6c8773 WP |
141 | |
142 | rb_free(ctl_buf->buf); | |
94b4fbf9 | 143 | rb_free(ctl_buf); |
2b6c8773 WP |
144 | } |
145 | ||
146 | RB_DLINK_FOREACH(ptr, ctl->writeq.head) | |
147 | { | |
148 | ctl_buf = ptr->data; | |
149 | for(x = 0; x < ctl_buf->nfds; x++) | |
150 | rb_close(ctl_buf->F[x]); | |
151 | ||
152 | rb_free(ctl_buf->buf); | |
153 | rb_free(ctl_buf); | |
154 | } | |
155 | rb_close(ctl->F); | |
156 | rb_close(ctl->P); | |
157 | rb_dlinkDelete(&ctl->node, &ssl_daemons); | |
158 | rb_free(ctl); | |
159 | } | |
160 | ||
161 | static char *ssld_path; | |
162 | ||
163 | static int ssld_spin_count = 0; | |
164 | static time_t last_spin; | |
165 | static int ssld_wait = 0; | |
166 | ||
167 | ||
168 | static void | |
169 | ssl_killall(void) | |
170 | { | |
171 | rb_dlink_node *ptr, *next; | |
172 | ssl_ctl_t *ctl; | |
173 | RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head) | |
174 | { | |
175 | ctl = ptr->data; | |
176 | if(ctl->dead) | |
177 | continue; | |
178 | ctl->dead = 1; | |
179 | ssld_count--; | |
94b4fbf9 | 180 | rb_kill(ctl->pid, SIGKILL); |
2b6c8773 WP |
181 | } |
182 | } | |
183 | ||
184 | static void | |
94b4fbf9 | 185 | ssl_dead(ssl_ctl_t * ctl) |
2b6c8773 WP |
186 | { |
187 | if(ctl->dead) | |
188 | return; | |
94b4fbf9 | 189 | |
2b6c8773 WP |
190 | ctl->dead = 1; |
191 | ssld_count--; | |
94b4fbf9 | 192 | rb_kill(ctl->pid, SIGKILL); /* make sure the process is really gone */ |
2b6c8773 | 193 | ilog(L_MAIN, "ssld helper died - attempting to restart"); |
79c3c679 | 194 | sendto_realops_snomask(SNO_GENERAL, L_ALL, "ssld helper died - attempting to restart"); |
2b6c8773 WP |
195 | start_ssldaemon(1, ServerInfo.ssl_cert, ServerInfo.ssl_private_key, ServerInfo.ssl_dh_params); |
196 | } | |
197 | ||
198 | static void | |
94b4fbf9 | 199 | ssl_do_pipe(rb_fde_t * F, void *data) |
2b6c8773 WP |
200 | { |
201 | int retlen; | |
202 | ssl_ctl_t *ctl = data; | |
203 | retlen = rb_write(F, "0", 1); | |
204 | if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno))) | |
205 | { | |
206 | ssl_dead(ctl); | |
207 | return; | |
208 | } | |
209 | rb_setselect(F, RB_SELECT_READ, ssl_do_pipe, data); | |
210 | } | |
211 | ||
212 | static void | |
213 | restart_ssld_event(void *unused) | |
214 | { | |
215 | ssld_spin_count = 0; | |
216 | last_spin = 0; | |
217 | ssld_wait = 0; | |
218 | if(ServerInfo.ssld_count > get_ssld_count()) | |
219 | { | |
220 | int start = ServerInfo.ssld_count - get_ssld_count(); | |
221 | ilog(L_MAIN, "Attempting to restart ssld processes"); | |
79c3c679 | 222 | sendto_realops_snomask(SNO_GENERAL, L_ALL, "Attempt to restart ssld processes"); |
2b6c8773 WP |
223 | start_ssldaemon(start, ServerInfo.ssl_cert, ServerInfo.ssl_private_key, ServerInfo.ssl_dh_params); |
224 | } | |
225 | } | |
226 | ||
227 | int | |
228 | start_ssldaemon(int count, const char *ssl_cert, const char *ssl_private_key, const char *ssl_dh_params) | |
229 | { | |
230 | rb_fde_t *F1, *F2; | |
231 | rb_fde_t *P1, *P2; | |
94b4fbf9 VY |
232 | #ifdef _WIN32 |
233 | const char *suffix = ".exe"; | |
234 | #else | |
235 | const char *suffix = ""; | |
236 | #endif | |
237 | ||
2b6c8773 WP |
238 | char fullpath[PATH_MAX + 1]; |
239 | char fdarg[6]; | |
240 | const char *parv[2]; | |
241 | char buf[128]; | |
94b4fbf9 | 242 | char s_pid[10]; |
2b6c8773 WP |
243 | pid_t pid; |
244 | int started = 0, i; | |
245 | ||
246 | if(ssld_wait) | |
247 | return 0; | |
248 | ||
249 | if(ssld_spin_count > 20 && (rb_current_time() - last_spin < 5)) | |
250 | { | |
a0775df0 | 251 | ilog(L_MAIN, "ssld helper is spinning - will attempt to restart in 1 minute"); |
94b4fbf9 VY |
252 | sendto_realops_snomask(SNO_GENERAL, L_ALL, |
253 | "ssld helper is spinning - will attempt to restart in 1 minute"); | |
2b6c8773 WP |
254 | rb_event_add("restart_ssld_event", restart_ssld_event, NULL, 60); |
255 | ssld_wait = 1; | |
256 | return 0; | |
257 | } | |
258 | ||
259 | ssld_spin_count++; | |
260 | last_spin = rb_current_time(); | |
94b4fbf9 | 261 | |
2b6c8773 WP |
262 | if(ssld_path == NULL) |
263 | { | |
94b4fbf9 VY |
264 | rb_snprintf(fullpath, sizeof(fullpath), "%s/ssld%s", BINPATH, suffix); |
265 | ||
2b6c8773 WP |
266 | if(access(fullpath, X_OK) == -1) |
267 | { | |
94b4fbf9 VY |
268 | rb_snprintf(fullpath, sizeof(fullpath), "%s/bin/ssld%s", |
269 | ConfigFileEntry.dpath, suffix); | |
2b6c8773 WP |
270 | if(access(fullpath, X_OK) == -1) |
271 | { | |
94b4fbf9 VY |
272 | ilog(L_MAIN, |
273 | "Unable to execute ssld%s in %s/bin or %s", | |
274 | ConfigFileEntry.dpath, suffix, BINPATH); | |
275 | return 0; | |
2b6c8773 WP |
276 | } |
277 | } | |
278 | ssld_path = rb_strdup(fullpath); | |
279 | } | |
2b6c8773 WP |
280 | rb_strlcpy(buf, "-ircd ssld daemon helper", sizeof(buf)); |
281 | parv[0] = buf; | |
282 | parv[1] = NULL; | |
283 | ||
284 | for(i = 0; i < count; i++) | |
285 | { | |
286 | ssl_ctl_t *ctl; | |
e421505e JT |
287 | if(rb_socketpair(AF_UNIX, SOCK_DGRAM, 0, &F1, &F2, "SSL/TLS handle passing socket") == -1) |
288 | { | |
289 | ilog(L_MAIN, "Unable to create ssld - rb_socketpair failed: %s", strerror(errno)); | |
290 | return started; | |
291 | } | |
292 | ||
2b6c8773 WP |
293 | rb_set_buffers(F1, READBUF_SIZE); |
294 | rb_set_buffers(F2, READBUF_SIZE); | |
295 | rb_snprintf(fdarg, sizeof(fdarg), "%d", rb_get_fd(F2)); | |
94b4fbf9 | 296 | rb_setenv("CTL_FD", fdarg, 1); |
8479094d JT |
297 | if(rb_pipe(&P1, &P2, "SSL/TLS pipe") == -1) |
298 | { | |
299 | ilog(L_MAIN, "Unable to create ssld - rb_pipe failed: %s", strerror(errno)); | |
300 | return started; | |
301 | } | |
2b6c8773 | 302 | rb_snprintf(fdarg, sizeof(fdarg), "%d", rb_get_fd(P1)); |
94b4fbf9 | 303 | rb_setenv("CTL_PIPE", fdarg, 1); |
0dc49ff2 | 304 | rb_snprintf(s_pid, sizeof(s_pid), "%d", (int)getpid()); |
94b4fbf9 VY |
305 | rb_setenv("CTL_PPID", s_pid, 1); |
306 | #ifdef _WIN32 | |
307 | SetHandleInformation((HANDLE) rb_get_fd(F2), HANDLE_FLAG_INHERIT, 1); | |
308 | SetHandleInformation((HANDLE) rb_get_fd(P1), HANDLE_FLAG_INHERIT, 1); | |
309 | #endif | |
310 | ||
311 | pid = rb_spawn_process(ssld_path, (const char **) parv); | |
2b6c8773 WP |
312 | if(pid == -1) |
313 | { | |
314 | ilog(L_MAIN, "Unable to create ssld: %s\n", strerror(errno)); | |
315 | rb_close(F1); | |
316 | rb_close(F2); | |
317 | rb_close(P1); | |
318 | rb_close(P2); | |
319 | return started; | |
320 | } | |
321 | started++; | |
322 | rb_close(F2); | |
323 | rb_close(P1); | |
324 | ctl = allocate_ssl_daemon(F1, P2, pid); | |
325 | if(ssl_ok) | |
326 | { | |
327 | if(ConfigFileEntry.use_egd && (ConfigFileEntry.egdpool_path != NULL)) | |
328 | send_init_prng(ctl, RB_PRNG_EGD, ConfigFileEntry.egdpool_path); | |
329 | else | |
330 | send_init_prng(ctl, RB_PRNG_DEFAULT, NULL); | |
331 | } | |
332 | if(ssl_ok && ssl_cert != NULL && ssl_private_key != NULL) | |
94b4fbf9 VY |
333 | send_new_ssl_certs_one(ctl, ssl_cert, ssl_private_key, |
334 | ssl_dh_params != NULL ? ssl_dh_params : ""); | |
2b6c8773 WP |
335 | ssl_read_ctl(ctl->F, ctl); |
336 | ssl_do_pipe(P2, ctl); | |
94b4fbf9 | 337 | |
2b6c8773 | 338 | } |
94b4fbf9 | 339 | return started; |
2b6c8773 WP |
340 | } |
341 | ||
342 | static void | |
94b4fbf9 | 343 | ssl_process_zipstats(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf) |
2b6c8773 WP |
344 | { |
345 | struct Client *server; | |
346 | struct ZipStats *zips; | |
347 | int parc; | |
1a405809 | 348 | char *parv[7]; |
94b4fbf9 | 349 | parc = rb_string_to_array(ctl_buf->buf, parv, 6); |
2b6c8773 WP |
350 | server = find_server(NULL, parv[1]); |
351 | if(server == NULL || server->localClient == NULL || !IsCapable(server, CAP_ZIP)) | |
352 | return; | |
353 | if(server->localClient->zipstats == NULL) | |
354 | server->localClient->zipstats = rb_malloc(sizeof(struct ZipStats)); | |
94b4fbf9 | 355 | |
2b6c8773 WP |
356 | zips = server->localClient->zipstats; |
357 | ||
358 | zips->in += strtoull(parv[2], NULL, 10); | |
359 | zips->in_wire += strtoull(parv[3], NULL, 10); | |
360 | zips->out += strtoull(parv[4], NULL, 10); | |
361 | zips->out_wire += strtoull(parv[5], NULL, 10); | |
94b4fbf9 | 362 | |
2b6c8773 | 363 | if(zips->in > 0) |
94b4fbf9 | 364 | zips->in_ratio = ((double) (zips->in - zips->in_wire) / (double) zips->in) * 100.00; |
2b6c8773 WP |
365 | else |
366 | zips->in_ratio = 0; | |
94b4fbf9 | 367 | |
2b6c8773 | 368 | if(zips->out > 0) |
94b4fbf9 | 369 | zips->out_ratio = ((double) (zips->out - zips->out_wire) / (double) zips->out) * 100.00; |
2b6c8773 WP |
370 | else |
371 | zips->out_ratio = 0; | |
372 | } | |
373 | ||
374 | static void | |
94b4fbf9 | 375 | ssl_process_dead_fd(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf) |
2b6c8773 WP |
376 | { |
377 | struct Client *client_p; | |
378 | char reason[256]; | |
f5bdde4b | 379 | int32_t fd; |
2b6c8773 WP |
380 | |
381 | if(ctl_buf->buflen < 6) | |
94b4fbf9 VY |
382 | return; /* bogus message..drop it.. XXX should warn here */ |
383 | ||
2b6c8773 WP |
384 | fd = buf_to_int32(&ctl_buf->buf[1]); |
385 | rb_strlcpy(reason, &ctl_buf->buf[5], sizeof(reason)); | |
386 | client_p = find_cli_fd_hash(fd); | |
387 | if(client_p == NULL) | |
388 | return; | |
cffd37ee JT |
389 | if(IsAnyServer(client_p) || IsRegistered(client_p)) |
390 | { | |
391 | /* read any last moment ERROR, QUIT or the like -- jilles */ | |
392 | if (!strcmp(reason, "Remote host closed the connection")) | |
393 | read_packet(client_p->localClient->F, client_p); | |
394 | if (IsAnyDead(client_p)) | |
395 | return; | |
396 | } | |
2b6c8773 | 397 | if(IsAnyServer(client_p)) |
e5cdec73 | 398 | { |
2cf629d9 | 399 | sendto_realops_snomask(SNO_GENERAL, is_remote_connect(client_p) && !IsServer(client_p) ? L_NETWIDE : L_ALL, "ssld error for %s: %s", client_p->name, reason); |
e5cdec73 JT |
400 | ilog(L_SERVER, "ssld error for %s: %s", log_client_name(client_p, SHOW_IP), reason); |
401 | } | |
2b6c8773 WP |
402 | exit_client(client_p, client_p, &me, reason); |
403 | } | |
404 | ||
a099270d JT |
405 | static void |
406 | ssl_process_certfp(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf) | |
407 | { | |
408 | struct Client *client_p; | |
409 | int32_t fd; | |
410 | uint8_t *certfp; | |
411 | char certfp_string[RB_SSL_CERTFP_LEN * 2 + 1]; | |
412 | int i; | |
413 | ||
414 | if(ctl_buf->buflen != 5 + RB_SSL_CERTFP_LEN) | |
415 | return; /* bogus message..drop it.. XXX should warn here */ | |
416 | ||
417 | fd = buf_to_int32(&ctl_buf->buf[1]); | |
418 | certfp = (uint8_t *)&ctl_buf->buf[5]; | |
419 | client_p = find_cli_fd_hash(fd); | |
420 | if(client_p == NULL) | |
421 | return; | |
422 | for(i = 0; i < RB_SSL_CERTFP_LEN; i++) | |
423 | rb_snprintf(certfp_string + 2 * i, 3, "%02x", | |
424 | certfp[i]); | |
09fb2d18 | 425 | sendto_one_notice(client_p, ":*** Your client certificate fingerprint is: %s", certfp_string); |
a099270d JT |
426 | } |
427 | ||
2b6c8773 | 428 | static void |
94b4fbf9 | 429 | ssl_process_cmd_recv(ssl_ctl_t * ctl) |
2b6c8773 WP |
430 | { |
431 | static const char *cannot_setup_ssl = "ssld cannot setup ssl, check your certificates and private key"; | |
432 | static const char *no_ssl_or_zlib = "ssld has neither SSL/TLS or zlib support killing all sslds"; | |
94b4fbf9 | 433 | rb_dlink_node *ptr, *next; |
2b6c8773 WP |
434 | ssl_ctl_buf_t *ctl_buf; |
435 | if(ctl->dead) | |
436 | return; | |
437 | RB_DLINK_FOREACH_SAFE(ptr, next, ctl->readq.head) | |
438 | { | |
94b4fbf9 VY |
439 | ctl_buf = ptr->data; |
440 | switch (*ctl_buf->buf) | |
2b6c8773 | 441 | { |
94b4fbf9 VY |
442 | case 'N': |
443 | ssl_ok = 0; /* ssld says it can't do ssl/tls */ | |
444 | break; | |
445 | case 'D': | |
446 | ssl_process_dead_fd(ctl, ctl_buf); | |
447 | break; | |
a099270d JT |
448 | case 'F': |
449 | ssl_process_certfp(ctl, ctl_buf); | |
450 | break; | |
94b4fbf9 VY |
451 | case 'S': |
452 | ssl_process_zipstats(ctl, ctl_buf); | |
453 | break; | |
454 | case 'I': | |
455 | ssl_ok = 0; | |
456 | ilog(L_MAIN, cannot_setup_ssl); | |
457 | sendto_realops_snomask(SNO_GENERAL, L_ALL, cannot_setup_ssl); | |
458 | case 'U': | |
459 | zlib_ok = 0; | |
460 | ssl_ok = 0; | |
461 | ilog(L_MAIN, no_ssl_or_zlib); | |
462 | sendto_realops_snomask(SNO_GENERAL, L_ALL, no_ssl_or_zlib); | |
463 | ssl_killall(); | |
464 | break; | |
94b4fbf9 VY |
465 | case 'z': |
466 | zlib_ok = 0; | |
467 | break; | |
468 | default: | |
469 | ilog(L_MAIN, "Received invalid command from ssld: %s", ctl_buf->buf); | |
470 | sendto_realops_snomask(SNO_GENERAL, L_ALL, "Received invalid command from ssld"); | |
471 | break; | |
2b6c8773 WP |
472 | } |
473 | rb_dlinkDelete(ptr, &ctl->readq); | |
474 | rb_free(ctl_buf->buf); | |
475 | rb_free(ctl_buf); | |
476 | } | |
477 | ||
478 | } | |
479 | ||
480 | ||
481 | static void | |
94b4fbf9 | 482 | ssl_read_ctl(rb_fde_t * F, void *data) |
2b6c8773 WP |
483 | { |
484 | ssl_ctl_buf_t *ctl_buf; | |
485 | ssl_ctl_t *ctl = data; | |
486 | int retlen; | |
487 | ||
488 | if(ctl->dead) | |
489 | return; | |
490 | do | |
491 | { | |
492 | ctl_buf = rb_malloc(sizeof(ssl_ctl_buf_t)); | |
493 | ctl_buf->buf = rb_malloc(READSIZE); | |
494 | retlen = rb_recv_fd_buf(ctl->F, ctl_buf->buf, READSIZE, ctl_buf->F, 4); | |
495 | ctl_buf->buflen = retlen; | |
94b4fbf9 VY |
496 | if(retlen <= 0) |
497 | { | |
2b6c8773 WP |
498 | rb_free(ctl_buf->buf); |
499 | rb_free(ctl_buf); | |
500 | } | |
501 | else | |
502 | rb_dlinkAddTail(ctl_buf, &ctl_buf->node, &ctl->readq); | |
94b4fbf9 VY |
503 | } |
504 | while(retlen > 0); | |
505 | ||
2b6c8773 WP |
506 | if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno))) |
507 | { | |
508 | ssl_dead(ctl); | |
509 | return; | |
94b4fbf9 | 510 | } |
2b6c8773 WP |
511 | ssl_process_cmd_recv(ctl); |
512 | rb_setselect(ctl->F, RB_SELECT_READ, ssl_read_ctl, ctl); | |
513 | } | |
514 | ||
515 | static ssl_ctl_t * | |
516 | which_ssld(void) | |
517 | { | |
518 | ssl_ctl_t *ctl, *lowest = NULL; | |
519 | rb_dlink_node *ptr; | |
94b4fbf9 | 520 | |
2b6c8773 WP |
521 | RB_DLINK_FOREACH(ptr, ssl_daemons.head) |
522 | { | |
523 | ctl = ptr->data; | |
524 | if(ctl->dead) | |
525 | continue; | |
94b4fbf9 VY |
526 | if(lowest == NULL) |
527 | { | |
2b6c8773 WP |
528 | lowest = ctl; |
529 | continue; | |
530 | } | |
531 | if(ctl->cli_count < lowest->cli_count) | |
532 | lowest = ctl; | |
533 | } | |
94b4fbf9 | 534 | return (lowest); |
2b6c8773 WP |
535 | } |
536 | ||
537 | static void | |
94b4fbf9 | 538 | ssl_write_ctl(rb_fde_t * F, void *data) |
2b6c8773 WP |
539 | { |
540 | ssl_ctl_t *ctl = data; | |
541 | ssl_ctl_buf_t *ctl_buf; | |
542 | rb_dlink_node *ptr, *next; | |
543 | int retlen, x; | |
544 | ||
545 | if(ctl->dead) | |
546 | return; | |
547 | ||
548 | RB_DLINK_FOREACH_SAFE(ptr, next, ctl->writeq.head) | |
549 | { | |
550 | ctl_buf = ptr->data; | |
551 | /* in theory unix sock_dgram shouldn't ever short write this.. */ | |
94b4fbf9 | 552 | retlen = rb_send_fd_buf(ctl->F, ctl_buf->F, ctl_buf->nfds, ctl_buf->buf, ctl_buf->buflen, ctl->pid); |
2b6c8773 WP |
553 | if(retlen > 0) |
554 | { | |
555 | rb_dlinkDelete(ptr, &ctl->writeq); | |
556 | for(x = 0; x < ctl_buf->nfds; x++) | |
557 | rb_close(ctl_buf->F[x]); | |
558 | rb_free(ctl_buf->buf); | |
559 | rb_free(ctl_buf); | |
94b4fbf9 | 560 | |
2b6c8773 WP |
561 | } |
562 | if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno))) | |
563 | { | |
564 | ssl_dead(ctl); | |
565 | return; | |
94b4fbf9 VY |
566 | } |
567 | else | |
568 | { | |
2b6c8773 WP |
569 | rb_setselect(ctl->F, RB_SELECT_WRITE, ssl_write_ctl, ctl); |
570 | } | |
571 | } | |
572 | } | |
573 | ||
574 | static void | |
94b4fbf9 | 575 | ssl_cmd_write_queue(ssl_ctl_t * ctl, rb_fde_t ** F, int count, const void *buf, size_t buflen) |
2b6c8773 WP |
576 | { |
577 | ssl_ctl_buf_t *ctl_buf; | |
94b4fbf9 | 578 | int x; |
2b6c8773 WP |
579 | |
580 | /* don't bother */ | |
581 | if(ctl->dead) | |
582 | return; | |
94b4fbf9 | 583 | |
2b6c8773 WP |
584 | ctl_buf = rb_malloc(sizeof(ssl_ctl_buf_t)); |
585 | ctl_buf->buf = rb_malloc(buflen); | |
586 | memcpy(ctl_buf->buf, buf, buflen); | |
587 | ctl_buf->buflen = buflen; | |
94b4fbf9 | 588 | |
2b6c8773 WP |
589 | for(x = 0; x < count && x < MAXPASSFD; x++) |
590 | { | |
94b4fbf9 | 591 | ctl_buf->F[x] = F[x]; |
2b6c8773 WP |
592 | } |
593 | ctl_buf->nfds = count; | |
594 | rb_dlinkAddTail(ctl_buf, &ctl_buf->node, &ctl->writeq); | |
595 | ssl_write_ctl(ctl->F, ctl); | |
596 | } | |
597 | ||
598 | ||
599 | static void | |
94b4fbf9 | 600 | send_new_ssl_certs_one(ssl_ctl_t * ctl, const char *ssl_cert, const char *ssl_private_key, const char *ssl_dh_params) |
2b6c8773 WP |
601 | { |
602 | size_t len; | |
603 | ||
94b4fbf9 | 604 | len = strlen(ssl_cert) + strlen(ssl_private_key) + strlen(ssl_dh_params) + 5; |
2b6c8773 WP |
605 | if(len > sizeof(tmpbuf)) |
606 | { | |
94b4fbf9 VY |
607 | sendto_realops_snomask(SNO_GENERAL, L_ALL, |
608 | "Parameters for send_new_ssl_certs_one too long (%zu > %zu) to pass to ssld, not sending...", | |
609 | len, sizeof(tmpbuf)); | |
610 | ilog(L_MAIN, | |
611 | "Parameters for send_new_ssl_certs_one too long (%zu > %zu) to pass to ssld, not sending...", | |
612 | len, sizeof(tmpbuf)); | |
2b6c8773 WP |
613 | return; |
614 | } | |
94b4fbf9 VY |
615 | len = rb_snprintf(tmpbuf, sizeof(tmpbuf), "K%c%s%c%s%c%s%c", nul, ssl_cert, nul, |
616 | ssl_private_key, nul, ssl_dh_params, nul); | |
2b6c8773 WP |
617 | ssl_cmd_write_queue(ctl, NULL, 0, tmpbuf, len); |
618 | } | |
619 | ||
620 | static void | |
94b4fbf9 | 621 | send_init_prng(ssl_ctl_t * ctl, prng_seed_t seedtype, const char *path) |
2b6c8773 WP |
622 | { |
623 | size_t len; | |
624 | const char *s; | |
f5bdde4b | 625 | uint8_t seed = (uint8_t) seedtype; |
2b6c8773 WP |
626 | |
627 | if(path == NULL) | |
628 | s = ""; | |
629 | else | |
630 | s = path; | |
631 | ||
632 | len = strlen(s) + 3; | |
633 | if(len > sizeof(tmpbuf)) | |
634 | { | |
94b4fbf9 VY |
635 | sendto_realops_snomask(SNO_GENERAL, L_ALL, |
636 | "Parameters for send_init_prng too long (%zd > %zd) to pass to ssld, not sending...", | |
637 | len, sizeof(tmpbuf)); | |
638 | ilog(L_MAIN, | |
639 | "Parameters for send_init_prng too long (%zd > %zd) to pass to ssld, not sending...", | |
640 | len, sizeof(tmpbuf)); | |
2b6c8773 | 641 | return; |
94b4fbf9 VY |
642 | |
643 | } | |
2b6c8773 WP |
644 | len = rb_snprintf(tmpbuf, sizeof(tmpbuf), "I%c%s%c", seed, s, nul); |
645 | ssl_cmd_write_queue(ctl, NULL, 0, tmpbuf, len); | |
646 | } | |
647 | ||
648 | void | |
649 | send_new_ssl_certs(const char *ssl_cert, const char *ssl_private_key, const char *ssl_dh_params) | |
650 | { | |
651 | rb_dlink_node *ptr; | |
652 | if(ssl_cert == NULL || ssl_private_key == NULL || ssl_dh_params == NULL) | |
653 | { | |
654 | ssl_ok = 0; | |
655 | return; | |
656 | } | |
657 | RB_DLINK_FOREACH(ptr, ssl_daemons.head) | |
658 | { | |
659 | ssl_ctl_t *ctl = ptr->data; | |
94b4fbf9 | 660 | send_new_ssl_certs_one(ctl, ssl_cert, ssl_private_key, ssl_dh_params); |
2b6c8773 WP |
661 | } |
662 | } | |
663 | ||
664 | ||
94b4fbf9 VY |
665 | ssl_ctl_t * |
666 | start_ssld_accept(rb_fde_t * sslF, rb_fde_t * plainF, int32_t id) | |
2b6c8773 WP |
667 | { |
668 | rb_fde_t *F[2]; | |
669 | ssl_ctl_t *ctl; | |
670 | char buf[5]; | |
671 | F[0] = sslF; | |
672 | F[1] = plainF; | |
673 | ||
674 | buf[0] = 'A'; | |
675 | int32_to_buf(&buf[1], id); | |
676 | ctl = which_ssld(); | |
677 | ctl->cli_count++; | |
678 | ssl_cmd_write_queue(ctl, F, 2, buf, sizeof(buf)); | |
679 | return ctl; | |
680 | } | |
681 | ||
682 | ssl_ctl_t * | |
94b4fbf9 | 683 | start_ssld_connect(rb_fde_t * sslF, rb_fde_t * plainF, int32_t id) |
2b6c8773 WP |
684 | { |
685 | rb_fde_t *F[2]; | |
686 | ssl_ctl_t *ctl; | |
687 | char buf[5]; | |
688 | F[0] = sslF; | |
689 | F[1] = plainF; | |
690 | ||
691 | buf[0] = 'C'; | |
692 | int32_to_buf(&buf[1], id); | |
693 | ||
694 | ctl = which_ssld(); | |
695 | ctl->cli_count++; | |
696 | ssl_cmd_write_queue(ctl, F, 2, buf, sizeof(buf)); | |
94b4fbf9 | 697 | return ctl; |
2b6c8773 WP |
698 | } |
699 | ||
94b4fbf9 VY |
700 | void |
701 | ssld_decrement_clicount(ssl_ctl_t * ctl) | |
2b6c8773 WP |
702 | { |
703 | if(ctl == NULL) | |
704 | return; | |
705 | ||
706 | ctl->cli_count--; | |
707 | if(ctl->dead && !ctl->cli_count) | |
708 | { | |
709 | free_ssl_daemon(ctl); | |
710 | } | |
711 | } | |
712 | ||
713 | /* | |
714 | * what we end up sending to the ssld process for ziplinks is the following | |
715 | * Z[ourfd][level][RECVQ] | |
716 | * Z = ziplinks command = buf[0] | |
717 | * ourfd = Our end of the socketpair = buf[1..4] | |
718 | * level = zip level buf[5] | |
719 | * recvqlen = our recvq len = buf[6-7] | |
720 | * recvq = any data we read prior to starting ziplinks | |
721 | */ | |
722 | void | |
723 | start_zlib_session(void *data) | |
724 | { | |
94b4fbf9 | 725 | struct Client *server = (struct Client *) data; |
f5bdde4b VY |
726 | uint16_t recvqlen; |
727 | uint8_t level; | |
2b6c8773 WP |
728 | void *xbuf; |
729 | ||
730 | rb_fde_t *F[2]; | |
731 | rb_fde_t *xF1, *xF2; | |
732 | char *buf; | |
9bf8f69c | 733 | char buf2[9]; |
2b6c8773 WP |
734 | void *recvq_start; |
735 | ||
f5bdde4b | 736 | size_t hdr = (sizeof(uint8_t) * 2) + sizeof(int32_t); |
2b6c8773 WP |
737 | size_t len; |
738 | int cpylen, left; | |
739 | ||
740 | server->localClient->event = NULL; | |
741 | ||
742 | recvqlen = rb_linebuf_len(&server->localClient->buf_recvq); | |
94b4fbf9 | 743 | |
2b6c8773 WP |
744 | len = recvqlen + hdr; |
745 | ||
746 | if(len > READBUF_SIZE) | |
747 | { | |
94b4fbf9 VY |
748 | sendto_realops_snomask(SNO_GENERAL, L_ALL, |
749 | "ssld - attempted to pass message of %zd len, max len %d, giving up", | |
750 | len, READBUF_SIZE); | |
2b6c8773 WP |
751 | ilog(L_MAIN, "ssld - attempted to pass message of %zd len, max len %d, giving up", len, READBUF_SIZE); |
752 | exit_client(server, server, server, "ssld readbuf exceeded"); | |
753 | return; | |
754 | } | |
755 | ||
94b4fbf9 | 756 | buf = rb_malloc(len); |
2b6c8773 WP |
757 | level = ConfigFileEntry.compression_level; |
758 | ||
759 | int32_to_buf(&buf[1], rb_get_fd(server->localClient->F)); | |
94b4fbf9 | 760 | buf[5] = (char) level; |
2b6c8773 | 761 | |
94b4fbf9 | 762 | recvq_start = &buf[6]; |
2b6c8773 WP |
763 | server->localClient->zipstats = rb_malloc(sizeof(struct ZipStats)); |
764 | ||
765 | xbuf = recvq_start; | |
766 | left = recvqlen; | |
767 | ||
768 | do | |
769 | { | |
770 | cpylen = rb_linebuf_get(&server->localClient->buf_recvq, xbuf, left, LINEBUF_PARTIAL, LINEBUF_RAW); | |
771 | left -= cpylen; | |
94b4fbf9 VY |
772 | xbuf = (void *) (((uintptr_t) xbuf) + cpylen); |
773 | } | |
774 | while(cpylen > 0); | |
2b6c8773 WP |
775 | |
776 | /* Pass the socket to ssld. */ | |
777 | *buf = 'Z'; | |
e421505e JT |
778 | if(rb_socketpair(AF_UNIX, SOCK_STREAM, 0, &xF1, &xF2, "Initial zlib socketpairs") == -1) |
779 | { | |
780 | sendto_realops_snomask(SNO_GENERAL, L_ALL, "Error creating zlib socketpair - %s", strerror(errno)); | |
781 | ilog(L_MAIN, "Error creating zlib socketpairs - %s", strerror(errno)); | |
782 | exit_client(server, server, server, "Error creating zlib socketpair"); | |
783 | return; | |
784 | } | |
785 | ||
9bf8f69c JT |
786 | if(IsSSL(server)) |
787 | { | |
788 | /* tell ssld the new connid for the ssl part*/ | |
789 | buf2[0] = 'Y'; | |
790 | int32_to_buf(&buf2[1], rb_get_fd(server->localClient->F)); | |
791 | int32_to_buf(&buf2[5], rb_get_fd(xF2)); | |
792 | ssl_cmd_write_queue(server->localClient->ssl_ctl, NULL, 0, buf2, sizeof(buf2)); | |
793 | } | |
794 | ||
795 | ||
94b4fbf9 | 796 | F[0] = server->localClient->F; |
2b6c8773 | 797 | F[1] = xF1; |
94b4fbf9 | 798 | del_from_cli_fd_hash(server); |
2b6c8773 WP |
799 | server->localClient->F = xF2; |
800 | /* need to redo as what we did before isn't valid now */ | |
801 | int32_to_buf(&buf[1], rb_get_fd(server->localClient->F)); | |
802 | add_to_cli_fd_hash(server); | |
62271ba9 AS |
803 | |
804 | server->localClient->z_ctl = which_ssld(); | |
805 | server->localClient->z_ctl->cli_count++; | |
806 | ssl_cmd_write_queue(server->localClient->z_ctl, F, 2, buf, len); | |
2b6c8773 WP |
807 | rb_free(buf); |
808 | } | |
809 | ||
810 | static void | |
811 | collect_zipstats(void *unused) | |
812 | { | |
813 | rb_dlink_node *ptr; | |
814 | struct Client *target_p; | |
f5bdde4b | 815 | char buf[sizeof(uint8_t) + sizeof(int32_t) + HOSTLEN]; |
2b6c8773 WP |
816 | void *odata; |
817 | size_t len; | |
f5bdde4b | 818 | int32_t id; |
2b6c8773 WP |
819 | |
820 | buf[0] = 'S'; | |
f5bdde4b | 821 | odata = buf + sizeof(uint8_t) + sizeof(int32_t); |
2b6c8773 WP |
822 | |
823 | RB_DLINK_FOREACH(ptr, serv_list.head) | |
824 | { | |
825 | target_p = ptr->data; | |
826 | if(IsCapable(target_p, CAP_ZIP)) | |
827 | { | |
f5bdde4b | 828 | len = sizeof(uint8_t) + sizeof(uint32_t); |
2b6c8773 WP |
829 | |
830 | id = rb_get_fd(target_p->localClient->F); | |
831 | int32_to_buf(&buf[1], rb_get_fd(target_p->localClient->F)); | |
94b4fbf9 VY |
832 | rb_strlcpy(odata, target_p->name, (sizeof(buf) - len)); |
833 | len += strlen(odata) + 1; /* Get the \0 as well */ | |
62271ba9 | 834 | ssl_cmd_write_queue(target_p->localClient->z_ctl, NULL, 0, buf, len); |
2b6c8773 WP |
835 | } |
836 | } | |
837 | } | |
838 | ||
839 | static void | |
840 | cleanup_dead_ssl(void *unused) | |
841 | { | |
842 | rb_dlink_node *ptr, *next; | |
843 | ssl_ctl_t *ctl; | |
844 | RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head) | |
845 | { | |
846 | ctl = ptr->data; | |
847 | if(ctl->dead && !ctl->cli_count) | |
848 | { | |
94b4fbf9 | 849 | free_ssl_daemon(ctl); |
2b6c8773 WP |
850 | } |
851 | } | |
852 | } | |
853 | ||
854 | int | |
855 | get_ssld_count(void) | |
856 | { | |
857 | return ssld_count; | |
858 | } | |
859 | ||
94b4fbf9 VY |
860 | void |
861 | init_ssld(void) | |
2b6c8773 WP |
862 | { |
863 | rb_event_addish("collect_zipstats", collect_zipstats, NULL, ZIPSTATS_TIME); | |
864 | rb_event_addish("cleanup_dead_ssld", cleanup_dead_ssl, NULL, 1200); | |
865 | } |