]>
Commit | Line | Data |
---|---|---|
f8451915 AC |
1 | /* |
2 | * sslproc.c: An interface to ssld | |
3 | * Copyright (C) 2007 Aaron Sethman <androsyn@ratbox.org> | |
4 | * Copyright (C) 2007 ircd-ratbox development team | |
5 | * | |
6 | * This program is free software; you can redistribute it and/or modify | |
7 | * it under the terms of the GNU General Public License as published by | |
8 | * the Free Software Foundation; either version 2 of the License, or | |
9 | * (at your option) any later version. | |
10 | * | |
11 | * This program is distributed in the hope that it will be useful, | |
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
14 | * GNU General Public License for more details. | |
15 | * | |
16 | * You should have received a copy of the GNU General Public License | |
17 | * along with this program; if not, write to the Free Software | |
18 | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 | |
19 | * USA | |
20 | * | |
21 | * $Id: sslproc.c 25179 2008-03-30 16:34:57Z androsyn $ | |
22 | */ | |
23 | ||
24 | #include <ratbox_lib.h> | |
25 | #include "stdinc.h" | |
26 | #include "s_conf.h" | |
27 | #include "logger.h" | |
28 | #include "listener.h" | |
29 | #include "sslproc.h" | |
30 | #include "s_serv.h" | |
31 | #include "ircd.h" | |
32 | #include "hash.h" | |
33 | #include "client.h" | |
34 | #include "send.h" | |
35 | #include "packet.h" | |
36 | ||
37 | #define ZIPSTATS_TIME 60 | |
38 | ||
39 | static void collect_zipstats(void *unused); | |
40 | static void ssl_read_ctl(rb_fde_t *F, void *data); | |
41 | static int ssld_count; | |
42 | ||
43 | static char tmpbuf[READBUF_SIZE]; | |
44 | static char nul = '\0'; | |
45 | ||
46 | #define MAXPASSFD 4 | |
47 | #define READSIZE 1024 | |
48 | typedef struct _ssl_ctl_buf | |
49 | { | |
50 | rb_dlink_node node; | |
51 | char *buf; | |
52 | size_t buflen; | |
53 | rb_fde_t *F[MAXPASSFD]; | |
54 | int nfds; | |
55 | } ssl_ctl_buf_t; | |
56 | ||
57 | ||
58 | struct _ssl_ctl | |
59 | { | |
60 | rb_dlink_node node; | |
61 | int cli_count; | |
62 | rb_fde_t *F; | |
63 | rb_fde_t *P; | |
64 | pid_t pid; | |
65 | rb_dlink_list readq; | |
66 | rb_dlink_list writeq; | |
67 | rb_uint8_t dead; | |
68 | }; | |
69 | ||
70 | static void send_new_ssl_certs_one(ssl_ctl_t *ctl, const char *ssl_cert, const char *ssl_private_key, const char *ssl_dh_params); | |
71 | static void send_init_prng(ssl_ctl_t *ctl, prng_seed_t seedtype, const char *path); | |
72 | ||
73 | ||
74 | static rb_dlink_list ssl_daemons; | |
75 | ||
76 | static inline rb_int32_t buf_to_int32(char *buf) | |
77 | { | |
78 | rb_int32_t x; | |
79 | x = *buf << 24; | |
80 | x |= *(++buf) << 16; | |
81 | x |= *(++buf) << 8; | |
82 | x |= *(++buf); | |
83 | return x; | |
84 | } | |
85 | ||
86 | static inline void int32_to_buf(char *buf, rb_int32_t x) | |
87 | { | |
88 | *(buf) = x >> 24 & 0xFF; | |
89 | *(++buf) = x >> 16 & 0xFF; | |
90 | *(++buf) = x >> 8 & 0xFF; | |
91 | *(++buf) = x & 0xFF; | |
92 | return; | |
93 | } | |
94 | ||
95 | ||
96 | static inline rb_uint16_t buf_to_uint16(char *buf) | |
97 | { | |
98 | rb_uint16_t x; | |
99 | x = *(buf) << 8; | |
100 | x |= *(++buf); | |
101 | return x; | |
102 | } | |
103 | ||
104 | static inline void uint16_to_buf(char *buf, rb_uint16_t x) | |
105 | { | |
106 | *(buf) = x >> 8 & 0xFF; | |
107 | *(++buf) = x & 0xFF; | |
108 | return; | |
109 | } | |
110 | ||
111 | ||
112 | static ssl_ctl_t * | |
113 | allocate_ssl_daemon(rb_fde_t *F, rb_fde_t *P, int pid) | |
114 | { | |
115 | ssl_ctl_t *ctl; | |
116 | ||
117 | if(F == NULL || pid < 0) | |
118 | return NULL; | |
119 | ctl = rb_malloc(sizeof(ssl_ctl_t)); | |
120 | ctl->F = F; | |
121 | ctl->P = P; | |
122 | ctl->pid = pid; | |
123 | ssld_count++; | |
124 | rb_dlinkAdd(ctl, &ctl->node, &ssl_daemons); | |
125 | return ctl; | |
126 | } | |
127 | ||
128 | static void | |
129 | free_ssl_daemon(ssl_ctl_t *ctl) | |
130 | { | |
131 | rb_dlink_node *ptr; | |
132 | ssl_ctl_buf_t *ctl_buf; | |
133 | int x; | |
134 | if(ctl->cli_count) | |
135 | return; | |
136 | ||
137 | RB_DLINK_FOREACH(ptr, ctl->readq.head) | |
138 | { | |
139 | ctl_buf = ptr->data; | |
140 | for(x = 0; x < ctl_buf->nfds; x++) | |
141 | rb_close(ctl_buf->F[x]); | |
142 | ||
143 | rb_free(ctl_buf->buf); | |
144 | rb_free(ctl_buf); | |
145 | } | |
146 | ||
147 | RB_DLINK_FOREACH(ptr, ctl->writeq.head) | |
148 | { | |
149 | ctl_buf = ptr->data; | |
150 | for(x = 0; x < ctl_buf->nfds; x++) | |
151 | rb_close(ctl_buf->F[x]); | |
152 | ||
153 | rb_free(ctl_buf->buf); | |
154 | rb_free(ctl_buf); | |
155 | } | |
156 | rb_close(ctl->F); | |
157 | rb_close(ctl->P); | |
158 | rb_dlinkDelete(&ctl->node, &ssl_daemons); | |
159 | rb_free(ctl); | |
160 | } | |
161 | ||
162 | static char *ssld_path; | |
163 | ||
164 | static int ssld_spin_count = 0; | |
165 | static time_t last_spin; | |
166 | static int ssld_wait = 0; | |
167 | ||
168 | ||
169 | static void | |
170 | ssl_killall(void) | |
171 | { | |
172 | rb_dlink_node *ptr, *next; | |
173 | ssl_ctl_t *ctl; | |
174 | RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head) | |
175 | { | |
176 | ctl = ptr->data; | |
177 | if(ctl->dead) | |
178 | continue; | |
179 | ctl->dead = 1; | |
180 | ssld_count--; | |
181 | kill(ctl->pid, SIGKILL); | |
182 | } | |
183 | } | |
184 | ||
185 | static void | |
186 | ssl_dead(ssl_ctl_t *ctl) | |
187 | { | |
188 | if(ctl->dead) | |
189 | return; | |
190 | ||
191 | ctl->dead = 1; | |
192 | ssld_count--; | |
193 | kill(ctl->pid, SIGKILL); /* make sure the process is really gone */ | |
194 | ilog(L_MAIN, "ssld helper died - attempting to restart"); | |
536845c5 | 195 | sendto_realops_snomask(SNO_GENERAL, L_ALL, "ssld helper died - attempting to restart"); |
f8451915 AC |
196 | start_ssldaemon(1, ServerInfo.ssl_cert, ServerInfo.ssl_private_key, ServerInfo.ssl_dh_params); |
197 | } | |
198 | ||
199 | static void | |
200 | ssl_do_pipe(rb_fde_t *F, void *data) | |
201 | { | |
202 | int retlen; | |
203 | ssl_ctl_t *ctl = data; | |
204 | retlen = rb_write(F, "0", 1); | |
205 | if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno))) | |
206 | { | |
207 | ssl_dead(ctl); | |
208 | return; | |
209 | } | |
210 | rb_setselect(F, RB_SELECT_READ, ssl_do_pipe, data); | |
211 | } | |
212 | ||
213 | static void | |
214 | restart_ssld_event(void *unused) | |
215 | { | |
216 | ssld_spin_count = 0; | |
217 | last_spin = 0; | |
218 | ssld_wait = 0; | |
219 | if(ServerInfo.ssld_count > get_ssld_count()) | |
220 | { | |
221 | int start = ServerInfo.ssld_count - get_ssld_count(); | |
222 | ilog(L_MAIN, "Attempting to restart ssld processes"); | |
536845c5 | 223 | sendto_realops_snomask(SNO_GENERAL, L_ALL, "Attempt to restart ssld processes"); |
f8451915 AC |
224 | start_ssldaemon(start, ServerInfo.ssl_cert, ServerInfo.ssl_private_key, ServerInfo.ssl_dh_params); |
225 | } | |
226 | } | |
227 | ||
228 | int | |
229 | start_ssldaemon(int count, const char *ssl_cert, const char *ssl_private_key, const char *ssl_dh_params) | |
230 | { | |
231 | rb_fde_t *F1, *F2; | |
232 | rb_fde_t *P1, *P2; | |
233 | char fullpath[PATH_MAX + 1]; | |
234 | char fdarg[6]; | |
235 | const char *parv[2]; | |
236 | char buf[128]; | |
237 | pid_t pid; | |
238 | int started = 0, i; | |
239 | ||
240 | if(ssld_wait) | |
241 | return 0; | |
242 | ||
243 | if(ssld_spin_count > 20 && (rb_current_time() - last_spin < 5)) | |
244 | { | |
245 | ilog(L_MAIN, "ssld helper is spinning - will attempt to restart in 5 minutes"); | |
536845c5 | 246 | sendto_realops_snomask(SNO_GENERAL, L_ALL, "ssld helper is spinning - will attempt to restart in 1 minute"); |
f8451915 AC |
247 | rb_event_add("restart_ssld_event", restart_ssld_event, NULL, 60); |
248 | ssld_wait = 1; | |
249 | return 0; | |
250 | } | |
251 | ||
252 | ssld_spin_count++; | |
253 | last_spin = rb_current_time(); | |
254 | if(ssld_path == NULL) | |
255 | { | |
256 | rb_snprintf(fullpath, sizeof(fullpath), "%s/ssld", BINPATH); | |
257 | ||
258 | if(access(fullpath, X_OK) == -1) | |
259 | { | |
260 | rb_snprintf(fullpath, sizeof(fullpath), "%s/bin/ssld", ConfigFileEntry.dpath); | |
261 | if(access(fullpath, X_OK) == -1) | |
262 | { | |
263 | ilog(L_MAIN, "Unable to execute ssld in %s/bin or %s", ConfigFileEntry.dpath, BINPATH); | |
264 | return 0 ; | |
265 | } | |
266 | } | |
267 | ssld_path = rb_strdup(fullpath); | |
268 | } | |
269 | ||
270 | rb_strlcpy(buf, "-ircd ssld daemon helper", sizeof(buf)); | |
271 | parv[0] = buf; | |
272 | parv[1] = NULL; | |
273 | ||
274 | for(i = 0; i < count; i++) | |
275 | { | |
276 | ssl_ctl_t *ctl; | |
277 | rb_socketpair(AF_UNIX, SOCK_DGRAM, 0, &F1, &F2, "SSL/TLS handle passing socket"); | |
278 | rb_set_buffers(F1, READBUF_SIZE); | |
279 | rb_set_buffers(F2, READBUF_SIZE); | |
280 | rb_snprintf(fdarg, sizeof(fdarg), "%d", rb_get_fd(F2)); | |
281 | setenv("CTL_FD", fdarg, 1); | |
282 | rb_pipe(&P1, &P2, "SSL/TLS pipe"); | |
283 | rb_snprintf(fdarg, sizeof(fdarg), "%d", rb_get_fd(P1)); | |
284 | setenv("CTL_PIPE", fdarg, 1); | |
285 | ||
286 | pid = rb_spawn_process(ssld_path, (const char **)parv); | |
287 | if(pid == -1) | |
288 | { | |
289 | ilog(L_MAIN, "Unable to create ssld: %s\n", strerror(errno)); | |
290 | rb_close(F1); | |
291 | rb_close(F2); | |
292 | rb_close(P1); | |
293 | rb_close(P2); | |
294 | return started; | |
295 | } | |
296 | started++; | |
297 | rb_close(F2); | |
298 | rb_close(P1); | |
299 | ctl = allocate_ssl_daemon(F1, P2, pid); | |
300 | if(ssl_ok) | |
301 | { | |
302 | if(ConfigFileEntry.use_egd && (ConfigFileEntry.egdpool_path != NULL)) | |
303 | send_init_prng(ctl, RB_PRNG_EGD, ConfigFileEntry.egdpool_path); | |
304 | else | |
305 | send_init_prng(ctl, RB_PRNG_DEFAULT, NULL); | |
306 | } | |
307 | if(ssl_ok && ssl_cert != NULL && ssl_private_key != NULL) | |
308 | send_new_ssl_certs_one(ctl, ssl_cert, ssl_private_key, ssl_dh_params != NULL ? ssl_dh_params : ""); | |
309 | ssl_read_ctl(ctl->F, ctl); | |
310 | ssl_do_pipe(P2, ctl); | |
311 | } | |
312 | return started; | |
313 | } | |
314 | ||
315 | static void | |
316 | ssl_process_zipstats(ssl_ctl_t *ctl, ssl_ctl_buf_t *ctl_buf) | |
317 | { | |
318 | struct Client *server; | |
319 | struct ZipStats *zips; | |
320 | int parc; | |
321 | char *parv[6]; | |
322 | parc = rb_string_to_array(ctl_buf->buf, parv, 6); | |
323 | server = find_server(NULL, parv[1]); | |
324 | if(server == NULL || server->localClient == NULL || !IsCapable(server, CAP_ZIP)) | |
325 | return; | |
326 | if(server->localClient->zipstats == NULL) | |
327 | server->localClient->zipstats = rb_malloc(sizeof(struct ZipStats)); | |
328 | ||
329 | zips = server->localClient->zipstats; | |
330 | ||
331 | zips->in += strtoull(parv[2], NULL, 10); | |
332 | zips->in_wire += strtoull(parv[3], NULL, 10); | |
333 | zips->out += strtoull(parv[4], NULL, 10); | |
334 | zips->out_wire += strtoull(parv[5], NULL, 10); | |
335 | ||
336 | if(zips->in > 0) | |
337 | zips->in_ratio = ((double)(zips->in - zips->in_wire) / (double) zips->in) * 100.00; | |
338 | else | |
339 | zips->in_ratio = 0; | |
340 | ||
341 | if(zips->out > 0) | |
342 | zips->out_ratio = ((double)(zips->out - zips->out_wire) / (double) zips->out) * 100.00; | |
343 | else | |
344 | zips->out_ratio = 0; | |
345 | } | |
346 | ||
347 | static void | |
348 | ssl_process_dead_fd(ssl_ctl_t *ctl, ssl_ctl_buf_t *ctl_buf) | |
349 | { | |
350 | struct Client *client_p; | |
351 | char reason[256]; | |
352 | rb_int32_t fd; | |
353 | ||
354 | if(ctl_buf->buflen < 6) | |
355 | return; /* bogus message..drop it.. XXX should warn here */ | |
356 | ||
357 | fd = buf_to_int32(&ctl_buf->buf[1]); | |
358 | rb_strlcpy(reason, &ctl_buf->buf[5], sizeof(reason)); | |
359 | client_p = find_cli_fd_hash(fd); | |
360 | if(client_p == NULL) | |
361 | return; | |
362 | if(IsAnyServer(client_p)) | |
536845c5 | 363 | sendto_realops_snomask(SNO_GENERAL, L_ALL, "ssld error for %s: %s", client_p->name, reason); |
f8451915 AC |
364 | exit_client(client_p, client_p, &me, reason); |
365 | } | |
366 | ||
367 | ||
368 | static void | |
369 | ssl_process_zip_ready(ssl_ctl_t *ctl, ssl_ctl_buf_t *ctl_buf) | |
370 | { | |
371 | struct Client *client_p; | |
372 | rb_int32_t fd; | |
373 | ||
374 | if(ctl_buf->buflen < 5) | |
375 | return; /* bogus message..drop it.. XXX should warn here */ | |
376 | ||
377 | fd = buf_to_int32(&ctl_buf->buf[1]); | |
378 | client_p = find_cli_fd_hash(fd); | |
379 | if(client_p == NULL) | |
380 | return; | |
381 | ||
382 | /* Now start sending the data that should be compressed. */ | |
383 | // ClearCork(client_p); | |
384 | send_pop_queue(client_p); | |
385 | /* Start reading uncompressed data. */ | |
386 | read_packet(client_p->localClient->F, client_p); | |
387 | } | |
388 | ||
389 | ||
390 | static void | |
391 | ssl_process_cmd_recv(ssl_ctl_t *ctl) | |
392 | { | |
393 | static const char *cannot_setup_ssl = "ssld cannot setup ssl, check your certificates and private key"; | |
394 | static const char *no_ssl_or_zlib = "ssld has neither SSL/TLS or zlib support killing all sslds"; | |
395 | rb_dlink_node *ptr, *next; | |
396 | ssl_ctl_buf_t *ctl_buf; | |
397 | if(ctl->dead) | |
398 | return; | |
399 | RB_DLINK_FOREACH_SAFE(ptr, next, ctl->readq.head) | |
400 | { | |
401 | ctl_buf = ptr->data; | |
402 | switch(*ctl_buf->buf) | |
403 | { | |
404 | case 'N': | |
405 | ssl_ok = 0; /* ssld says it can't do ssl/tls */ | |
406 | break; | |
407 | case 'D': | |
408 | ssl_process_dead_fd(ctl, ctl_buf); | |
409 | break; | |
410 | case 'S': | |
411 | ssl_process_zipstats(ctl, ctl_buf); | |
412 | break; | |
413 | case 'I': | |
414 | ssl_ok = 0; | |
415 | ilog(L_MAIN, cannot_setup_ssl); | |
536845c5 | 416 | sendto_realops_snomask(SNO_GENERAL, L_ALL, cannot_setup_ssl); |
f8451915 AC |
417 | case 'U': |
418 | zlib_ok = 0; | |
419 | ssl_ok = 0; | |
420 | ilog(L_MAIN, no_ssl_or_zlib); | |
536845c5 | 421 | sendto_realops_snomask(SNO_GENERAL, L_ALL, no_ssl_or_zlib); |
f8451915 AC |
422 | ssl_killall(); |
423 | break; | |
424 | case 'R': | |
425 | ssl_process_zip_ready(ctl, ctl_buf); | |
426 | break; | |
427 | case 'z': | |
428 | zlib_ok = 0; | |
429 | break; | |
430 | default: | |
431 | ilog(L_MAIN, "Received invalid command from ssld: %s", ctl_buf->buf); | |
536845c5 | 432 | sendto_realops_snomask(SNO_GENERAL, L_ALL, "Received invalid command from ssld"); |
f8451915 AC |
433 | break; |
434 | } | |
435 | rb_dlinkDelete(ptr, &ctl->readq); | |
436 | rb_free(ctl_buf->buf); | |
437 | rb_free(ctl_buf); | |
438 | } | |
439 | ||
440 | } | |
441 | ||
442 | ||
443 | static void | |
444 | ssl_read_ctl(rb_fde_t *F, void *data) | |
445 | { | |
446 | ssl_ctl_buf_t *ctl_buf; | |
447 | ssl_ctl_t *ctl = data; | |
448 | int retlen; | |
449 | ||
450 | if(ctl->dead) | |
451 | return; | |
452 | do | |
453 | { | |
454 | ctl_buf = rb_malloc(sizeof(ssl_ctl_buf_t)); | |
455 | ctl_buf->buf = rb_malloc(READSIZE); | |
456 | retlen = rb_recv_fd_buf(ctl->F, ctl_buf->buf, READSIZE, ctl_buf->F, 4); | |
457 | ctl_buf->buflen = retlen; | |
458 | if(retlen <= 0) { | |
459 | rb_free(ctl_buf->buf); | |
460 | rb_free(ctl_buf); | |
461 | } | |
462 | else | |
463 | rb_dlinkAddTail(ctl_buf, &ctl_buf->node, &ctl->readq); | |
464 | } while(retlen > 0); | |
465 | ||
466 | if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno))) | |
467 | { | |
468 | ssl_dead(ctl); | |
469 | return; | |
470 | } | |
471 | ssl_process_cmd_recv(ctl); | |
472 | rb_setselect(ctl->F, RB_SELECT_READ, ssl_read_ctl, ctl); | |
473 | } | |
474 | ||
475 | static ssl_ctl_t * | |
476 | which_ssld(void) | |
477 | { | |
478 | ssl_ctl_t *ctl, *lowest = NULL; | |
479 | rb_dlink_node *ptr; | |
480 | ||
481 | RB_DLINK_FOREACH(ptr, ssl_daemons.head) | |
482 | { | |
483 | ctl = ptr->data; | |
484 | if(ctl->dead) | |
485 | continue; | |
486 | if(lowest == NULL) { | |
487 | lowest = ctl; | |
488 | continue; | |
489 | } | |
490 | if(ctl->cli_count < lowest->cli_count) | |
491 | lowest = ctl; | |
492 | } | |
493 | return(lowest); | |
494 | } | |
495 | ||
496 | static void | |
497 | ssl_write_ctl(rb_fde_t *F, void *data) | |
498 | { | |
499 | ssl_ctl_t *ctl = data; | |
500 | ssl_ctl_buf_t *ctl_buf; | |
501 | rb_dlink_node *ptr, *next; | |
502 | int retlen, x; | |
503 | ||
504 | if(ctl->dead) | |
505 | return; | |
506 | ||
507 | RB_DLINK_FOREACH_SAFE(ptr, next, ctl->writeq.head) | |
508 | { | |
509 | ctl_buf = ptr->data; | |
510 | /* in theory unix sock_dgram shouldn't ever short write this.. */ | |
511 | retlen = rb_send_fd_buf(ctl->F, ctl_buf->F, ctl_buf->nfds, ctl_buf->buf, ctl_buf->buflen); | |
512 | if(retlen > 0) | |
513 | { | |
514 | rb_dlinkDelete(ptr, &ctl->writeq); | |
515 | for(x = 0; x < ctl_buf->nfds; x++) | |
516 | rb_close(ctl_buf->F[x]); | |
517 | rb_free(ctl_buf->buf); | |
518 | rb_free(ctl_buf); | |
519 | ||
520 | } | |
521 | if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno))) | |
522 | { | |
523 | ssl_dead(ctl); | |
524 | return; | |
525 | } else { | |
526 | rb_setselect(ctl->F, RB_SELECT_WRITE, ssl_write_ctl, ctl); | |
527 | } | |
528 | } | |
529 | } | |
530 | ||
531 | static void | |
532 | ssl_cmd_write_queue(ssl_ctl_t *ctl, rb_fde_t **F, int count, const void *buf, size_t buflen) | |
533 | { | |
534 | ssl_ctl_buf_t *ctl_buf; | |
535 | int x; | |
536 | ||
537 | /* don't bother */ | |
538 | if(ctl->dead) | |
539 | return; | |
540 | ||
541 | ctl_buf = rb_malloc(sizeof(ssl_ctl_buf_t)); | |
542 | ctl_buf->buf = rb_malloc(buflen); | |
543 | memcpy(ctl_buf->buf, buf, buflen); | |
544 | ctl_buf->buflen = buflen; | |
545 | ||
546 | for(x = 0; x < count && x < MAXPASSFD; x++) | |
547 | { | |
548 | ctl_buf->F[x] = F[x]; | |
549 | } | |
550 | ctl_buf->nfds = count; | |
551 | rb_dlinkAddTail(ctl_buf, &ctl_buf->node, &ctl->writeq); | |
552 | ssl_write_ctl(ctl->F, ctl); | |
553 | } | |
554 | ||
555 | ||
556 | static void | |
557 | send_new_ssl_certs_one(ssl_ctl_t *ctl, const char *ssl_cert, const char *ssl_private_key, const char *ssl_dh_params) | |
558 | { | |
559 | size_t len; | |
560 | ||
561 | len = strlen(ssl_cert) + strlen(ssl_private_key) + strlen(ssl_dh_params) + 5; | |
562 | if(len > sizeof(tmpbuf)) | |
563 | { | |
536845c5 | 564 | sendto_realops_snomask(SNO_GENERAL, L_ALL, |
f8451915 AC |
565 | "Parameters for send_new_ssl_certs_one too long (%zu > %zu) to pass to ssld, not sending...", |
566 | len, sizeof(tmpbuf)); | |
567 | ilog(L_MAIN, "Parameters for send_new_ssl_certs_one too long (%zu > %zu) to pass to ssld, not sending...", | |
568 | len, sizeof(tmpbuf)); | |
569 | return; | |
570 | } | |
571 | len = rb_snprintf(tmpbuf, sizeof(tmpbuf), "K%c%s%c%s%c%s%c", nul, ssl_cert, nul, ssl_private_key, nul, ssl_dh_params, nul); | |
572 | ssl_cmd_write_queue(ctl, NULL, 0, tmpbuf, len); | |
573 | } | |
574 | ||
575 | static void | |
576 | send_init_prng(ssl_ctl_t *ctl, prng_seed_t seedtype, const char *path) | |
577 | { | |
578 | size_t len; | |
579 | const char *s; | |
580 | rb_uint8_t seed = (rb_uint8_t) seedtype; | |
581 | ||
582 | if(path == NULL) | |
583 | s = ""; | |
584 | else | |
585 | s = path; | |
586 | ||
587 | len = strlen(s) + 3; | |
588 | if(len > sizeof(tmpbuf)) | |
589 | { | |
536845c5 | 590 | sendto_realops_snomask(SNO_GENERAL, L_ALL, |
f8451915 AC |
591 | "Parameters for send_init_prng too long (%zd > %zd) to pass to ssld, not sending...", |
592 | len, sizeof(tmpbuf)); | |
593 | ilog(L_MAIN, "Parameters for send_init_prng too long (%zd > %zd) to pass to ssld, not sending...", | |
594 | len, sizeof(tmpbuf)); | |
595 | return; | |
596 | ||
597 | } | |
598 | len = rb_snprintf(tmpbuf, sizeof(tmpbuf), "I%c%s%c", seed, s, nul); | |
599 | ssl_cmd_write_queue(ctl, NULL, 0, tmpbuf, len); | |
600 | } | |
601 | ||
602 | void | |
603 | send_new_ssl_certs(const char *ssl_cert, const char *ssl_private_key, const char *ssl_dh_params) | |
604 | { | |
605 | rb_dlink_node *ptr; | |
606 | if(ssl_cert == NULL || ssl_private_key == NULL || ssl_dh_params == NULL) | |
607 | { | |
608 | ssl_ok = 0; | |
609 | return; | |
610 | } | |
611 | RB_DLINK_FOREACH(ptr, ssl_daemons.head) | |
612 | { | |
613 | ssl_ctl_t *ctl = ptr->data; | |
614 | send_new_ssl_certs_one(ctl, ssl_cert, ssl_private_key, ssl_dh_params); | |
615 | } | |
616 | } | |
617 | ||
618 | ||
619 | ssl_ctl_t * | |
620 | start_ssld_accept(rb_fde_t *sslF, rb_fde_t *plainF, rb_int32_t id) | |
621 | { | |
622 | rb_fde_t *F[2]; | |
623 | ssl_ctl_t *ctl; | |
624 | char buf[5]; | |
625 | F[0] = sslF; | |
626 | F[1] = plainF; | |
627 | ||
628 | buf[0] = 'A'; | |
629 | int32_to_buf(&buf[1], id); | |
630 | ctl = which_ssld(); | |
631 | ctl->cli_count++; | |
632 | ssl_cmd_write_queue(ctl, F, 2, buf, sizeof(buf)); | |
633 | return ctl; | |
634 | } | |
635 | ||
636 | ssl_ctl_t * | |
637 | start_ssld_connect(rb_fde_t *sslF, rb_fde_t *plainF, rb_int32_t id) | |
638 | { | |
639 | rb_fde_t *F[2]; | |
640 | ssl_ctl_t *ctl; | |
641 | char buf[5]; | |
642 | F[0] = sslF; | |
643 | F[1] = plainF; | |
644 | ||
645 | buf[0] = 'C'; | |
646 | int32_to_buf(&buf[1], id); | |
647 | ||
648 | ctl = which_ssld(); | |
649 | ctl->cli_count++; | |
650 | ssl_cmd_write_queue(ctl, F, 2, buf, sizeof(buf)); | |
651 | return ctl; | |
652 | } | |
653 | ||
654 | void | |
655 | ssld_decrement_clicount(ssl_ctl_t *ctl) | |
656 | { | |
657 | if(ctl == NULL) | |
658 | return; | |
659 | ||
660 | ctl->cli_count--; | |
661 | if(ctl->dead && !ctl->cli_count) | |
662 | { | |
663 | free_ssl_daemon(ctl); | |
664 | } | |
665 | } | |
666 | ||
667 | /* | |
668 | * what we end up sending to the ssld process for ziplinks is the following | |
669 | * Z[ourfd][level][RECVQ] | |
670 | * Z = ziplinks command = buf[0] | |
671 | * ourfd = Our end of the socketpair = buf[1..4] | |
672 | * level = zip level buf[5] | |
673 | * recvqlen = our recvq len = buf[6-7] | |
674 | * recvq = any data we read prior to starting ziplinks | |
675 | */ | |
676 | void | |
677 | start_zlib_session(void *data) | |
678 | { | |
679 | struct Client *server = (struct Client *)data; | |
680 | rb_uint16_t recvqlen; | |
681 | rb_uint8_t level; | |
682 | void *xbuf; | |
683 | ||
684 | rb_fde_t *F[2]; | |
685 | rb_fde_t *xF1, *xF2; | |
686 | char *buf; | |
687 | void *recvq_start; | |
688 | ||
689 | size_t hdr = (sizeof(rb_uint8_t) * 2) + sizeof(rb_int32_t); | |
690 | size_t len; | |
691 | int cpylen, left; | |
692 | ||
693 | server->localClient->event = NULL; | |
694 | ||
695 | recvqlen = rb_linebuf_len(&server->localClient->buf_recvq); | |
696 | ||
697 | len = recvqlen + hdr; | |
698 | ||
699 | if(len > READBUF_SIZE) | |
700 | { | |
701 | rb_free(buf); | |
536845c5 | 702 | sendto_realops_snomask(SNO_GENERAL, L_ALL, "ssld - attempted to pass message of %zd len, max len %d, giving up", len, READBUF_SIZE); |
f8451915 AC |
703 | ilog(L_MAIN, "ssld - attempted to pass message of %zd len, max len %d, giving up", len, READBUF_SIZE); |
704 | exit_client(server, server, server, "ssld readbuf exceeded"); | |
705 | return; | |
706 | } | |
707 | ||
708 | buf = rb_malloc(len); | |
709 | level = ConfigFileEntry.compression_level; | |
710 | ||
711 | int32_to_buf(&buf[1], rb_get_fd(server->localClient->F)); | |
712 | buf[5] = (char)level; | |
713 | ||
714 | recvq_start = &buf[6]; | |
715 | server->localClient->zipstats = rb_malloc(sizeof(struct ZipStats)); | |
716 | ||
717 | xbuf = recvq_start; | |
718 | left = recvqlen; | |
719 | ||
720 | do | |
721 | { | |
722 | cpylen = rb_linebuf_get(&server->localClient->buf_recvq, xbuf, left, LINEBUF_PARTIAL, LINEBUF_RAW); | |
723 | left -= cpylen; | |
724 | xbuf += cpylen; | |
725 | } while(cpylen > 0); | |
726 | ||
727 | /* Pass the socket to ssld. */ | |
728 | *buf = 'Z'; | |
729 | rb_socketpair(AF_UNIX, SOCK_STREAM, 0, &xF1, &xF2, "Initial zlib socketpairs"); | |
730 | ||
731 | F[0] = server->localClient->F; | |
732 | F[1] = xF1; | |
733 | del_from_cli_fd_hash(server); | |
734 | server->localClient->F = xF2; | |
735 | /* need to redo as what we did before isn't valid now */ | |
736 | int32_to_buf(&buf[1], rb_get_fd(server->localClient->F)); | |
737 | add_to_cli_fd_hash(server); | |
738 | server->localClient->ssl_ctl = which_ssld(); | |
739 | server->localClient->ssl_ctl->cli_count++; | |
740 | ssl_cmd_write_queue(server->localClient->ssl_ctl, F, 2, buf, len); | |
741 | rb_free(buf); | |
742 | } | |
743 | ||
744 | static void | |
745 | collect_zipstats(void *unused) | |
746 | { | |
747 | rb_dlink_node *ptr; | |
748 | struct Client *target_p; | |
749 | char buf[sizeof(rb_uint8_t) + sizeof(rb_int32_t) + HOSTLEN]; | |
750 | void *odata; | |
751 | size_t len; | |
752 | rb_int32_t id; | |
753 | ||
754 | buf[0] = 'S'; | |
755 | odata = buf + sizeof(rb_uint8_t) + sizeof(rb_int32_t); | |
756 | ||
757 | RB_DLINK_FOREACH(ptr, serv_list.head) | |
758 | { | |
759 | target_p = ptr->data; | |
760 | if(IsCapable(target_p, CAP_ZIP)) | |
761 | { | |
762 | len = sizeof(rb_uint8_t) + sizeof(rb_uint32_t); | |
763 | ||
764 | id = rb_get_fd(target_p->localClient->F); | |
765 | int32_to_buf(&buf[1], rb_get_fd(target_p->localClient->F)); | |
766 | rb_strlcpy(odata, target_p->name, (sizeof(buf)-len)); | |
767 | len += strlen(odata) + 1; /* Get the \0 as well */ | |
768 | ssl_cmd_write_queue(target_p->localClient->ssl_ctl, NULL, 0, buf, len); | |
769 | } | |
770 | } | |
771 | } | |
772 | ||
773 | static void | |
774 | cleanup_dead_ssl(void *unused) | |
775 | { | |
776 | rb_dlink_node *ptr, *next; | |
777 | ssl_ctl_t *ctl; | |
778 | RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head) | |
779 | { | |
780 | ctl = ptr->data; | |
781 | if(ctl->dead && !ctl->cli_count) | |
782 | { | |
783 | free_ssl_daemon(ctl); | |
784 | } | |
785 | } | |
786 | } | |
787 | ||
788 | int | |
789 | get_ssld_count(void) | |
790 | { | |
791 | return ssld_count; | |
792 | } | |
793 | ||
794 | void init_ssld(void) | |
795 | { | |
796 | rb_event_addish("collect_zipstats", collect_zipstats, NULL, ZIPSTATS_TIME); | |
797 | rb_event_addish("cleanup_dead_ssld", cleanup_dead_ssl, NULL, 1200); | |
798 | } | |
799 |