]>
Commit | Line | Data |
---|---|---|
f8451915 AC |
1 | /* |
2 | * sslproc.c: An interface to ssld | |
3 | * Copyright (C) 2007 Aaron Sethman <androsyn@ratbox.org> | |
4 | * Copyright (C) 2007 ircd-ratbox development team | |
5 | * | |
6 | * This program is free software; you can redistribute it and/or modify | |
7 | * it under the terms of the GNU General Public License as published by | |
8 | * the Free Software Foundation; either version 2 of the License, or | |
9 | * (at your option) any later version. | |
10 | * | |
11 | * This program is distributed in the hope that it will be useful, | |
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
14 | * GNU General Public License for more details. | |
15 | * | |
16 | * You should have received a copy of the GNU General Public License | |
17 | * along with this program; if not, write to the Free Software | |
18 | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 | |
19 | * USA | |
f8451915 AC |
20 | */ |
21 | ||
fe037171 | 22 | #include <rb_lib.h> |
f8451915 | 23 | #include "stdinc.h" |
3202e249 VY |
24 | |
25 | ||
f8451915 AC |
26 | #include "s_conf.h" |
27 | #include "logger.h" | |
28 | #include "listener.h" | |
29 | #include "sslproc.h" | |
30 | #include "s_serv.h" | |
31 | #include "ircd.h" | |
32 | #include "hash.h" | |
33 | #include "client.h" | |
34 | #include "send.h" | |
35 | #include "packet.h" | |
f018ed84 | 36 | #include "certfp.h" |
f8451915 | 37 | |
3202e249 | 38 | static void ssl_read_ctl(rb_fde_t * F, void *data); |
f8451915 AC |
39 | static int ssld_count; |
40 | ||
3202e249 | 41 | static char tmpbuf[READBUF_SIZE]; |
f8451915 AC |
42 | static char nul = '\0'; |
43 | ||
44 | #define MAXPASSFD 4 | |
45 | #define READSIZE 1024 | |
46 | typedef struct _ssl_ctl_buf | |
47 | { | |
48 | rb_dlink_node node; | |
49 | char *buf; | |
50 | size_t buflen; | |
51 | rb_fde_t *F[MAXPASSFD]; | |
52 | int nfds; | |
53 | } ssl_ctl_buf_t; | |
54 | ||
55 | ||
56 | struct _ssl_ctl | |
57 | { | |
58 | rb_dlink_node node; | |
59 | int cli_count; | |
60 | rb_fde_t *F; | |
61 | rb_fde_t *P; | |
62 | pid_t pid; | |
63 | rb_dlink_list readq; | |
64 | rb_dlink_list writeq; | |
eb1b303d | 65 | uint8_t shutdown; |
0862e335 | 66 | uint8_t dead; |
e9ffc3c1 | 67 | char version[256]; |
f8451915 AC |
68 | }; |
69 | ||
93ad89b2 | 70 | static void ssld_update_config_one(ssl_ctl_t *ctl); |
f7b0c4b3 | 71 | static void send_new_ssl_certs_one(ssl_ctl_t * ctl); |
93ad89b2 | 72 | static void send_certfp_method(ssl_ctl_t *ctl); |
f8451915 AC |
73 | |
74 | ||
75 | static rb_dlink_list ssl_daemons; | |
76 | ||
196740c4 AC |
77 | static inline uint32_t |
78 | buf_to_uint32(char *buf) | |
f8451915 | 79 | { |
196740c4 | 80 | uint32_t x; |
0862e335 | 81 | memcpy(&x, buf, sizeof(x)); |
f8451915 AC |
82 | return x; |
83 | } | |
84 | ||
3202e249 | 85 | static inline void |
196740c4 | 86 | uint32_to_buf(char *buf, uint32_t x) |
f8451915 | 87 | { |
0862e335 | 88 | memcpy(buf, &x, sizeof(x)); |
f8451915 AC |
89 | return; |
90 | } | |
91 | ||
f8451915 | 92 | static ssl_ctl_t * |
3202e249 | 93 | allocate_ssl_daemon(rb_fde_t * F, rb_fde_t * P, int pid) |
f8451915 AC |
94 | { |
95 | ssl_ctl_t *ctl; | |
3202e249 | 96 | |
f8451915 AC |
97 | if(F == NULL || pid < 0) |
98 | return NULL; | |
3202e249 | 99 | ctl = rb_malloc(sizeof(ssl_ctl_t)); |
f8451915 AC |
100 | ctl->F = F; |
101 | ctl->P = P; | |
102 | ctl->pid = pid; | |
103 | ssld_count++; | |
104 | rb_dlinkAdd(ctl, &ctl->node, &ssl_daemons); | |
105 | return ctl; | |
106 | } | |
107 | ||
108 | static void | |
3202e249 | 109 | free_ssl_daemon(ssl_ctl_t * ctl) |
f8451915 AC |
110 | { |
111 | rb_dlink_node *ptr; | |
112 | ssl_ctl_buf_t *ctl_buf; | |
113 | int x; | |
114 | if(ctl->cli_count) | |
115 | return; | |
3202e249 | 116 | |
f8451915 AC |
117 | RB_DLINK_FOREACH(ptr, ctl->readq.head) |
118 | { | |
119 | ctl_buf = ptr->data; | |
120 | for(x = 0; x < ctl_buf->nfds; x++) | |
3202e249 | 121 | rb_close(ctl_buf->F[x]); |
f8451915 AC |
122 | |
123 | rb_free(ctl_buf->buf); | |
3202e249 | 124 | rb_free(ctl_buf); |
f8451915 AC |
125 | } |
126 | ||
127 | RB_DLINK_FOREACH(ptr, ctl->writeq.head) | |
128 | { | |
129 | ctl_buf = ptr->data; | |
130 | for(x = 0; x < ctl_buf->nfds; x++) | |
131 | rb_close(ctl_buf->F[x]); | |
132 | ||
133 | rb_free(ctl_buf->buf); | |
134 | rb_free(ctl_buf); | |
135 | } | |
136 | rb_close(ctl->F); | |
137 | rb_close(ctl->P); | |
138 | rb_dlinkDelete(&ctl->node, &ssl_daemons); | |
139 | rb_free(ctl); | |
140 | } | |
141 | ||
142 | static char *ssld_path; | |
143 | ||
144 | static int ssld_spin_count = 0; | |
145 | static time_t last_spin; | |
146 | static int ssld_wait = 0; | |
147 | ||
148 | ||
eb1b303d SA |
149 | void |
150 | restart_ssld(void) | |
151 | { | |
152 | rb_dlink_node *ptr, *next; | |
153 | ssl_ctl_t *ctl; | |
154 | ||
155 | RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head) | |
156 | { | |
157 | ctl = ptr->data; | |
158 | if(ctl->dead) | |
159 | continue; | |
160 | if(ctl->shutdown) | |
161 | continue; | |
162 | ctl->shutdown = 1; | |
163 | ssld_count--; | |
164 | if(!ctl->cli_count) | |
165 | { | |
166 | rb_kill(ctl->pid, SIGKILL); | |
167 | free_ssl_daemon(ctl); | |
168 | } | |
169 | } | |
170 | ||
036cafaa SA |
171 | ssld_spin_count = 0; |
172 | last_spin = 0; | |
173 | ssld_wait = 0; | |
f7b0c4b3 | 174 | start_ssldaemon(ServerInfo.ssld_count); |
eb1b303d SA |
175 | } |
176 | ||
f8451915 AC |
177 | static void |
178 | ssl_killall(void) | |
179 | { | |
180 | rb_dlink_node *ptr, *next; | |
181 | ssl_ctl_t *ctl; | |
182 | RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head) | |
183 | { | |
184 | ctl = ptr->data; | |
185 | if(ctl->dead) | |
186 | continue; | |
187 | ctl->dead = 1; | |
eb1b303d SA |
188 | if(!ctl->shutdown) |
189 | ssld_count--; | |
3202e249 | 190 | rb_kill(ctl->pid, SIGKILL); |
eb1b303d SA |
191 | if(!ctl->cli_count) |
192 | free_ssl_daemon(ctl); | |
f8451915 AC |
193 | } |
194 | } | |
195 | ||
196 | static void | |
3202e249 | 197 | ssl_dead(ssl_ctl_t * ctl) |
f8451915 AC |
198 | { |
199 | if(ctl->dead) | |
200 | return; | |
3202e249 | 201 | |
f8451915 | 202 | ctl->dead = 1; |
3202e249 | 203 | rb_kill(ctl->pid, SIGKILL); /* make sure the process is really gone */ |
eb1b303d SA |
204 | |
205 | if(!ctl->shutdown) | |
206 | { | |
207 | ssld_count--; | |
208 | ilog(L_MAIN, "ssld helper died - attempting to restart"); | |
a9227555 | 209 | sendto_realops_snomask(SNO_GENERAL, L_NETWIDE, "ssld helper died - attempting to restart"); |
f7b0c4b3 | 210 | start_ssldaemon(1); |
eb1b303d | 211 | } |
f8451915 AC |
212 | } |
213 | ||
214 | static void | |
3202e249 | 215 | ssl_do_pipe(rb_fde_t * F, void *data) |
f8451915 AC |
216 | { |
217 | int retlen; | |
218 | ssl_ctl_t *ctl = data; | |
219 | retlen = rb_write(F, "0", 1); | |
220 | if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno))) | |
221 | { | |
222 | ssl_dead(ctl); | |
223 | return; | |
224 | } | |
225 | rb_setselect(F, RB_SELECT_READ, ssl_do_pipe, data); | |
226 | } | |
227 | ||
228 | static void | |
229 | restart_ssld_event(void *unused) | |
230 | { | |
231 | ssld_spin_count = 0; | |
232 | last_spin = 0; | |
233 | ssld_wait = 0; | |
234 | if(ServerInfo.ssld_count > get_ssld_count()) | |
235 | { | |
236 | int start = ServerInfo.ssld_count - get_ssld_count(); | |
237 | ilog(L_MAIN, "Attempting to restart ssld processes"); | |
a9227555 | 238 | sendto_realops_snomask(SNO_GENERAL, L_NETWIDE, "Attempt to restart ssld processes"); |
f7b0c4b3 | 239 | start_ssldaemon(start); |
f8451915 AC |
240 | } |
241 | } | |
242 | ||
243 | int | |
f7b0c4b3 | 244 | start_ssldaemon(int count) |
f8451915 AC |
245 | { |
246 | rb_fde_t *F1, *F2; | |
247 | rb_fde_t *P1, *P2; | |
248 | char fullpath[PATH_MAX + 1]; | |
249 | char fdarg[6]; | |
250 | const char *parv[2]; | |
251 | char buf[128]; | |
3202e249 | 252 | char s_pid[10]; |
f8451915 AC |
253 | pid_t pid; |
254 | int started = 0, i; | |
255 | ||
256 | if(ssld_wait) | |
257 | return 0; | |
258 | ||
259 | if(ssld_spin_count > 20 && (rb_current_time() - last_spin < 5)) | |
260 | { | |
b9249347 | 261 | ilog(L_MAIN, "ssld helper is spinning - will attempt to restart in 1 minute"); |
a9227555 | 262 | sendto_realops_snomask(SNO_GENERAL, L_NETWIDE, |
3202e249 | 263 | "ssld helper is spinning - will attempt to restart in 1 minute"); |
f8451915 AC |
264 | rb_event_add("restart_ssld_event", restart_ssld_event, NULL, 60); |
265 | ssld_wait = 1; | |
266 | return 0; | |
267 | } | |
268 | ||
269 | ssld_spin_count++; | |
270 | last_spin = rb_current_time(); | |
3202e249 | 271 | |
f8451915 AC |
272 | if(ssld_path == NULL) |
273 | { | |
8f0c3422 | 274 | snprintf(fullpath, sizeof(fullpath), "%s/ssld", ircd_paths[IRCD_PATH_LIBEXEC]); |
3202e249 | 275 | |
f8451915 AC |
276 | if(access(fullpath, X_OK) == -1) |
277 | { | |
8f0c3422 | 278 | snprintf(fullpath, sizeof(fullpath), "%s/bin/ssld", ConfigFileEntry.dpath); |
f8451915 AC |
279 | if(access(fullpath, X_OK) == -1) |
280 | { | |
3202e249 | 281 | ilog(L_MAIN, |
8f0c3422 | 282 | "Unable to execute ssld in %s or %s/bin", |
283 | ircd_paths[IRCD_PATH_LIBEXEC], ConfigFileEntry.dpath); | |
3202e249 | 284 | return 0; |
f8451915 AC |
285 | } |
286 | } | |
287 | ssld_path = rb_strdup(fullpath); | |
288 | } | |
b697c329 | 289 | rb_strlcpy(buf, "-ircd ssld daemon", sizeof(buf)); |
f8451915 AC |
290 | parv[0] = buf; |
291 | parv[1] = NULL; | |
292 | ||
293 | for(i = 0; i < count; i++) | |
294 | { | |
295 | ssl_ctl_t *ctl; | |
eda22d87 JT |
296 | if(rb_socketpair(AF_UNIX, SOCK_DGRAM, 0, &F1, &F2, "SSL/TLS handle passing socket") == -1) |
297 | { | |
298 | ilog(L_MAIN, "Unable to create ssld - rb_socketpair failed: %s", strerror(errno)); | |
299 | return started; | |
300 | } | |
55abcbb2 | 301 | |
f8451915 AC |
302 | rb_set_buffers(F1, READBUF_SIZE); |
303 | rb_set_buffers(F2, READBUF_SIZE); | |
5203cba5 | 304 | snprintf(fdarg, sizeof(fdarg), "%d", rb_get_fd(F2)); |
3202e249 | 305 | rb_setenv("CTL_FD", fdarg, 1); |
cf09122b JT |
306 | if(rb_pipe(&P1, &P2, "SSL/TLS pipe") == -1) |
307 | { | |
308 | ilog(L_MAIN, "Unable to create ssld - rb_pipe failed: %s", strerror(errno)); | |
309 | return started; | |
310 | } | |
5203cba5 | 311 | snprintf(fdarg, sizeof(fdarg), "%d", rb_get_fd(P1)); |
3202e249 | 312 | rb_setenv("CTL_PIPE", fdarg, 1); |
5203cba5 | 313 | snprintf(s_pid, sizeof(s_pid), "%d", (int)getpid()); |
3202e249 | 314 | rb_setenv("CTL_PPID", s_pid, 1); |
68654844 DF |
315 | |
316 | rb_clear_cloexec(F2); | |
317 | rb_clear_cloexec(P1); | |
3202e249 VY |
318 | |
319 | pid = rb_spawn_process(ssld_path, (const char **) parv); | |
f8451915 AC |
320 | if(pid == -1) |
321 | { | |
322 | ilog(L_MAIN, "Unable to create ssld: %s\n", strerror(errno)); | |
323 | rb_close(F1); | |
324 | rb_close(F2); | |
325 | rb_close(P1); | |
326 | rb_close(P2); | |
327 | return started; | |
328 | } | |
329 | started++; | |
330 | rb_close(F2); | |
331 | rb_close(P1); | |
332 | ctl = allocate_ssl_daemon(F1, P2, pid); | |
bfc44622 | 333 | if(ircd_ssl_ok) |
93ad89b2 | 334 | ssld_update_config_one(ctl); |
f8451915 AC |
335 | ssl_read_ctl(ctl->F, ctl); |
336 | ssl_do_pipe(P2, ctl); | |
3202e249 | 337 | |
f8451915 | 338 | } |
f085388a U |
339 | ilog(L_MAIN, "ssld helper started"); |
340 | sendto_realops_snomask(SNO_GENERAL, L_NETWIDE, "ssld helper started"); | |
3202e249 | 341 | return started; |
f8451915 AC |
342 | } |
343 | ||
4fbb7362 SA |
344 | static void |
345 | ssl_process_open_fd(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf) | |
346 | { | |
347 | struct Client *client_p; | |
348 | uint32_t fd; | |
349 | ||
350 | if(ctl_buf->buflen < 5) | |
351 | return; /* bogus message..drop it.. XXX should warn here */ | |
352 | ||
353 | fd = buf_to_uint32(&ctl_buf->buf[1]); | |
354 | client_p = find_cli_connid_hash(fd); | |
355 | if(client_p == NULL || client_p->localClient == NULL) | |
356 | return; | |
357 | ||
358 | if(client_p->localClient->ssl_callback) | |
359 | { | |
53789fdd | 360 | SSL_OPEN_CB *hdl = client_p->localClient->ssl_callback; |
4fbb7362 SA |
361 | |
362 | client_p->localClient->ssl_callback = NULL; | |
4fbb7362 | 363 | |
53789fdd | 364 | hdl(client_p, RB_OK); |
4fbb7362 SA |
365 | } |
366 | } | |
367 | ||
f8451915 | 368 | static void |
3202e249 | 369 | ssl_process_dead_fd(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf) |
f8451915 AC |
370 | { |
371 | struct Client *client_p; | |
372 | char reason[256]; | |
196740c4 | 373 | uint32_t fd; |
f8451915 AC |
374 | |
375 | if(ctl_buf->buflen < 6) | |
3202e249 VY |
376 | return; /* bogus message..drop it.. XXX should warn here */ |
377 | ||
196740c4 | 378 | fd = buf_to_uint32(&ctl_buf->buf[1]); |
f8451915 | 379 | rb_strlcpy(reason, &ctl_buf->buf[5], sizeof(reason)); |
b5b4a0e7 | 380 | client_p = find_cli_connid_hash(fd); |
4fbb7362 | 381 | if(client_p == NULL || client_p->localClient == NULL) |
f8451915 | 382 | return; |
4fbb7362 SA |
383 | |
384 | if(IsAnyServer(client_p)) | |
385 | { | |
a9227555 | 386 | sendto_realops_snomask(SNO_GENERAL, L_NETWIDE, "ssld error for %s: %s", client_p->name, reason); |
4fbb7362 SA |
387 | ilog(L_SERVER, "ssld error for %s: %s", log_client_name(client_p, SHOW_IP), reason); |
388 | } | |
389 | ||
390 | /* if there is still a pending callback, call it now */ | |
391 | if(client_p->localClient->ssl_callback) | |
392 | { | |
53789fdd | 393 | SSL_OPEN_CB *hdl = client_p->localClient->ssl_callback; |
4fbb7362 SA |
394 | |
395 | client_p->localClient->ssl_callback = NULL; | |
4fbb7362 | 396 | |
53789fdd SA |
397 | if (hdl(client_p, RB_ERROR_SSL)) |
398 | { | |
399 | /* the callback has exited the client */ | |
400 | return; | |
401 | } | |
4fbb7362 SA |
402 | } |
403 | ||
42d609f6 JT |
404 | if(IsAnyServer(client_p) || IsRegistered(client_p)) |
405 | { | |
406 | /* read any last moment ERROR, QUIT or the like -- jilles */ | |
407 | if (!strcmp(reason, "Remote host closed the connection")) | |
408 | read_packet(client_p->localClient->F, client_p); | |
409 | if (IsAnyDead(client_p)) | |
410 | return; | |
411 | } | |
f8451915 AC |
412 | exit_client(client_p, client_p, &me, reason); |
413 | } | |
414 | ||
ebe33dbf AC |
415 | |
416 | static void | |
417 | ssl_process_cipher_string(ssl_ctl_t *ctl, ssl_ctl_buf_t *ctl_buf) | |
418 | { | |
419 | struct Client *client_p; | |
420 | const char *cstring; | |
421 | uint32_t fd; | |
422 | ||
423 | if(ctl_buf->buflen < 6) | |
424 | return; /* bogus message..drop it.. XXX should warn here */ | |
425 | ||
426 | fd = buf_to_uint32(&ctl_buf->buf[1]); | |
427 | cstring = (const char *)&ctl_buf->buf[5]; | |
428 | ||
429 | if(EmptyString(cstring)) | |
430 | return; | |
431 | ||
b5b4a0e7 | 432 | client_p = find_cli_connid_hash(fd); |
ebe33dbf AC |
433 | if(client_p != NULL && client_p->localClient != NULL) |
434 | { | |
435 | rb_free(client_p->localClient->cipher_string); | |
436 | client_p->localClient->cipher_string = rb_strdup(cstring); | |
437 | } | |
438 | } | |
439 | ||
440 | ||
7247337a JT |
441 | static void |
442 | ssl_process_certfp(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf) | |
443 | { | |
444 | struct Client *client_p; | |
196740c4 | 445 | uint32_t fd; |
dc986b54 | 446 | uint32_t certfp_method; |
196740c4 | 447 | uint32_t len; |
7247337a | 448 | uint8_t *certfp; |
8eda114a | 449 | char *certfp_string; |
dc986b54 SA |
450 | const char *method_string; |
451 | int method_len; | |
7247337a | 452 | |
dc986b54 | 453 | if(ctl_buf->buflen > 13 + RB_SSL_CERTFP_LEN) |
7247337a JT |
454 | return; /* bogus message..drop it.. XXX should warn here */ |
455 | ||
196740c4 | 456 | fd = buf_to_uint32(&ctl_buf->buf[1]); |
dc986b54 SA |
457 | certfp_method = buf_to_uint32(&ctl_buf->buf[5]); |
458 | len = buf_to_uint32(&ctl_buf->buf[9]); | |
459 | certfp = (uint8_t *)&ctl_buf->buf[13]; | |
b5b4a0e7 | 460 | client_p = find_cli_connid_hash(fd); |
7247337a JT |
461 | if(client_p == NULL) |
462 | return; | |
dc986b54 SA |
463 | |
464 | switch (certfp_method) { | |
465 | case RB_SSL_CERTFP_METH_CERT_SHA1: | |
f018ed84 SA |
466 | method_string = CERTFP_PREFIX_CERT_SHA1; |
467 | break; | |
dc986b54 | 468 | case RB_SSL_CERTFP_METH_CERT_SHA256: |
f018ed84 SA |
469 | method_string = CERTFP_PREFIX_CERT_SHA256; |
470 | break; | |
dc986b54 | 471 | case RB_SSL_CERTFP_METH_CERT_SHA512: |
f018ed84 | 472 | method_string = CERTFP_PREFIX_CERT_SHA512; |
dc986b54 | 473 | break; |
dc986b54 | 474 | case RB_SSL_CERTFP_METH_SPKI_SHA256: |
f018ed84 | 475 | method_string = CERTFP_PREFIX_SPKI_SHA256; |
dc986b54 SA |
476 | break; |
477 | case RB_SSL_CERTFP_METH_SPKI_SHA512: | |
f018ed84 | 478 | method_string = CERTFP_PREFIX_SPKI_SHA512; |
dc986b54 SA |
479 | break; |
480 | default: | |
481 | return; | |
482 | } | |
483 | method_len = strlen(method_string); | |
484 | ||
8eda114a | 485 | rb_free(client_p->certfp); |
dc986b54 | 486 | certfp_string = rb_malloc(method_len + len * 2 + 1); |
4d5a902f | 487 | rb_strlcpy(certfp_string, method_string, method_len + len * 2 + 1); |
66769bc1 | 488 | for(uint32_t i = 0; i < len; i++) |
dc986b54 | 489 | snprintf(certfp_string + method_len + 2 * i, 3, "%02x", |
7247337a | 490 | certfp[i]); |
8eda114a | 491 | client_p->certfp = certfp_string; |
7247337a JT |
492 | } |
493 | ||
f8451915 | 494 | static void |
3202e249 | 495 | ssl_process_cmd_recv(ssl_ctl_t * ctl) |
f8451915 AC |
496 | { |
497 | static const char *cannot_setup_ssl = "ssld cannot setup ssl, check your certificates and private key"; | |
498 | static const char *no_ssl_or_zlib = "ssld has neither SSL/TLS or zlib support killing all sslds"; | |
3202e249 | 499 | rb_dlink_node *ptr, *next; |
f8451915 | 500 | ssl_ctl_buf_t *ctl_buf; |
66769bc1 | 501 | unsigned long len; |
e9ffc3c1 | 502 | |
f8451915 AC |
503 | if(ctl->dead) |
504 | return; | |
e9ffc3c1 | 505 | |
f8451915 AC |
506 | RB_DLINK_FOREACH_SAFE(ptr, next, ctl->readq.head) |
507 | { | |
3202e249 VY |
508 | ctl_buf = ptr->data; |
509 | switch (*ctl_buf->buf) | |
f8451915 | 510 | { |
3202e249 | 511 | case 'N': |
bfc44622 | 512 | ircd_ssl_ok = false; /* ssld says it can't do ssl/tls */ |
3202e249 | 513 | break; |
4fbb7362 SA |
514 | case 'O': |
515 | ssl_process_open_fd(ctl, ctl_buf); | |
516 | break; | |
3202e249 VY |
517 | case 'D': |
518 | ssl_process_dead_fd(ctl, ctl_buf); | |
519 | break; | |
ebe33dbf AC |
520 | case 'C': |
521 | ssl_process_cipher_string(ctl, ctl_buf); | |
522 | break; | |
7247337a JT |
523 | case 'F': |
524 | ssl_process_certfp(ctl, ctl_buf); | |
525 | break; | |
3202e249 | 526 | case 'I': |
bfc44622 | 527 | ircd_ssl_ok = false; |
32ea9d3d | 528 | ilog(L_MAIN, "%s", cannot_setup_ssl); |
a9227555 | 529 | sendto_realops_snomask(SNO_GENERAL, L_NETWIDE, "%s", cannot_setup_ssl); |
f1709d5a | 530 | break; |
3202e249 | 531 | case 'U': |
43f06d8d | 532 | ircd_zlib_ok = 0; |
bfc44622 | 533 | ircd_ssl_ok = false; |
32ea9d3d | 534 | ilog(L_MAIN, "%s", no_ssl_or_zlib); |
a9227555 | 535 | sendto_realops_snomask(SNO_GENERAL, L_NETWIDE, "%s", no_ssl_or_zlib); |
3202e249 | 536 | ssl_killall(); |
7cc67225 | 537 | return; |
e9ffc3c1 SA |
538 | case 'V': |
539 | len = ctl_buf->buflen - 1; | |
540 | if (len > sizeof(ctl->version) - 1) | |
541 | len = sizeof(ctl->version) - 1; | |
542 | strncpy(ctl->version, &ctl_buf->buf[1], len); | |
3202e249 | 543 | case 'z': |
43f06d8d | 544 | ircd_zlib_ok = 0; |
3202e249 VY |
545 | break; |
546 | default: | |
547 | ilog(L_MAIN, "Received invalid command from ssld: %s", ctl_buf->buf); | |
a9227555 | 548 | sendto_realops_snomask(SNO_GENERAL, L_NETWIDE, "Received invalid command from ssld"); |
3202e249 | 549 | break; |
f8451915 AC |
550 | } |
551 | rb_dlinkDelete(ptr, &ctl->readq); | |
552 | rb_free(ctl_buf->buf); | |
553 | rb_free(ctl_buf); | |
554 | } | |
555 | ||
556 | } | |
557 | ||
558 | ||
559 | static void | |
3202e249 | 560 | ssl_read_ctl(rb_fde_t * F, void *data) |
f8451915 AC |
561 | { |
562 | ssl_ctl_buf_t *ctl_buf; | |
563 | ssl_ctl_t *ctl = data; | |
564 | int retlen; | |
565 | ||
566 | if(ctl->dead) | |
567 | return; | |
568 | do | |
569 | { | |
570 | ctl_buf = rb_malloc(sizeof(ssl_ctl_buf_t)); | |
571 | ctl_buf->buf = rb_malloc(READSIZE); | |
572 | retlen = rb_recv_fd_buf(ctl->F, ctl_buf->buf, READSIZE, ctl_buf->F, 4); | |
573 | ctl_buf->buflen = retlen; | |
3202e249 VY |
574 | if(retlen <= 0) |
575 | { | |
f8451915 AC |
576 | rb_free(ctl_buf->buf); |
577 | rb_free(ctl_buf); | |
578 | } | |
579 | else | |
580 | rb_dlinkAddTail(ctl_buf, &ctl_buf->node, &ctl->readq); | |
3202e249 VY |
581 | } |
582 | while(retlen > 0); | |
583 | ||
f8451915 AC |
584 | if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno))) |
585 | { | |
586 | ssl_dead(ctl); | |
587 | return; | |
3202e249 | 588 | } |
f8451915 AC |
589 | ssl_process_cmd_recv(ctl); |
590 | rb_setselect(ctl->F, RB_SELECT_READ, ssl_read_ctl, ctl); | |
591 | } | |
592 | ||
593 | static ssl_ctl_t * | |
594 | which_ssld(void) | |
595 | { | |
596 | ssl_ctl_t *ctl, *lowest = NULL; | |
597 | rb_dlink_node *ptr; | |
3202e249 | 598 | |
f8451915 AC |
599 | RB_DLINK_FOREACH(ptr, ssl_daemons.head) |
600 | { | |
601 | ctl = ptr->data; | |
602 | if(ctl->dead) | |
603 | continue; | |
eb1b303d SA |
604 | if(ctl->shutdown) |
605 | continue; | |
3202e249 VY |
606 | if(lowest == NULL) |
607 | { | |
f8451915 AC |
608 | lowest = ctl; |
609 | continue; | |
610 | } | |
611 | if(ctl->cli_count < lowest->cli_count) | |
612 | lowest = ctl; | |
613 | } | |
3202e249 | 614 | return (lowest); |
f8451915 AC |
615 | } |
616 | ||
617 | static void | |
3202e249 | 618 | ssl_write_ctl(rb_fde_t * F, void *data) |
f8451915 AC |
619 | { |
620 | ssl_ctl_t *ctl = data; | |
621 | ssl_ctl_buf_t *ctl_buf; | |
622 | rb_dlink_node *ptr, *next; | |
623 | int retlen, x; | |
624 | ||
625 | if(ctl->dead) | |
626 | return; | |
627 | ||
628 | RB_DLINK_FOREACH_SAFE(ptr, next, ctl->writeq.head) | |
629 | { | |
630 | ctl_buf = ptr->data; | |
631 | /* in theory unix sock_dgram shouldn't ever short write this.. */ | |
3202e249 | 632 | retlen = rb_send_fd_buf(ctl->F, ctl_buf->F, ctl_buf->nfds, ctl_buf->buf, ctl_buf->buflen, ctl->pid); |
f8451915 AC |
633 | if(retlen > 0) |
634 | { | |
635 | rb_dlinkDelete(ptr, &ctl->writeq); | |
636 | for(x = 0; x < ctl_buf->nfds; x++) | |
637 | rb_close(ctl_buf->F[x]); | |
638 | rb_free(ctl_buf->buf); | |
639 | rb_free(ctl_buf); | |
3202e249 | 640 | |
f8451915 AC |
641 | } |
642 | if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno))) | |
643 | { | |
644 | ssl_dead(ctl); | |
645 | return; | |
3202e249 VY |
646 | } |
647 | else | |
648 | { | |
f8451915 AC |
649 | rb_setselect(ctl->F, RB_SELECT_WRITE, ssl_write_ctl, ctl); |
650 | } | |
651 | } | |
652 | } | |
653 | ||
654 | static void | |
3202e249 | 655 | ssl_cmd_write_queue(ssl_ctl_t * ctl, rb_fde_t ** F, int count, const void *buf, size_t buflen) |
f8451915 AC |
656 | { |
657 | ssl_ctl_buf_t *ctl_buf; | |
3202e249 | 658 | int x; |
f8451915 AC |
659 | |
660 | /* don't bother */ | |
661 | if(ctl->dead) | |
662 | return; | |
3202e249 | 663 | |
f8451915 AC |
664 | ctl_buf = rb_malloc(sizeof(ssl_ctl_buf_t)); |
665 | ctl_buf->buf = rb_malloc(buflen); | |
666 | memcpy(ctl_buf->buf, buf, buflen); | |
667 | ctl_buf->buflen = buflen; | |
3202e249 | 668 | |
f8451915 AC |
669 | for(x = 0; x < count && x < MAXPASSFD; x++) |
670 | { | |
3202e249 | 671 | ctl_buf->F[x] = F[x]; |
f8451915 AC |
672 | } |
673 | ctl_buf->nfds = count; | |
674 | rb_dlinkAddTail(ctl_buf, &ctl_buf->node, &ctl->writeq); | |
675 | ssl_write_ctl(ctl->F, ctl); | |
676 | } | |
677 | ||
678 | ||
679 | static void | |
f7b0c4b3 | 680 | send_new_ssl_certs_one(ssl_ctl_t * ctl) |
f8451915 | 681 | { |
4d83a4d9 AJ |
682 | size_t len = 5; |
683 | ||
684 | if(ServerInfo.ssl_cert) | |
685 | len += strlen(ServerInfo.ssl_cert); | |
686 | else | |
687 | return; | |
688 | ||
689 | if(ServerInfo.ssl_private_key) | |
690 | len += strlen(ServerInfo.ssl_private_key); | |
f8451915 | 691 | |
f7b0c4b3 SA |
692 | if(ServerInfo.ssl_dh_params) |
693 | len += strlen(ServerInfo.ssl_dh_params); | |
4d83a4d9 | 694 | |
f7b0c4b3 SA |
695 | if(ServerInfo.ssl_cipher_list) |
696 | len += strlen(ServerInfo.ssl_cipher_list); | |
4d83a4d9 | 697 | |
f8451915 AC |
698 | if(len > sizeof(tmpbuf)) |
699 | { | |
a9227555 | 700 | sendto_realops_snomask(SNO_GENERAL, L_NETWIDE, |
3202e249 VY |
701 | "Parameters for send_new_ssl_certs_one too long (%zu > %zu) to pass to ssld, not sending...", |
702 | len, sizeof(tmpbuf)); | |
703 | ilog(L_MAIN, | |
704 | "Parameters for send_new_ssl_certs_one too long (%zu > %zu) to pass to ssld, not sending...", | |
705 | len, sizeof(tmpbuf)); | |
f8451915 AC |
706 | return; |
707 | } | |
4d83a4d9 AJ |
708 | |
709 | int ret = snprintf(tmpbuf, sizeof(tmpbuf), "K%c%s%c%s%c%s%c%s%c", nul, | |
710 | ServerInfo.ssl_cert, nul, | |
711 | ServerInfo.ssl_private_key != NULL ? ServerInfo.ssl_private_key : "", nul, | |
712 | ServerInfo.ssl_dh_params != NULL ? ServerInfo.ssl_dh_params : "", nul, | |
713 | ServerInfo.ssl_cipher_list != NULL ? ServerInfo.ssl_cipher_list : "", nul); | |
714 | ||
715 | if(ret > 5) | |
716 | ssl_cmd_write_queue(ctl, NULL, 0, tmpbuf, (size_t) ret); | |
f8451915 AC |
717 | } |
718 | ||
13d8f0ed | 719 | static void |
93ad89b2 | 720 | send_certfp_method(ssl_ctl_t *ctl) |
13d8f0ed AC |
721 | { |
722 | char buf[5]; | |
723 | ||
724 | buf[0] = 'F'; | |
93ad89b2 | 725 | uint32_to_buf(&buf[1], ConfigFileEntry.certfp_method); |
13d8f0ed AC |
726 | ssl_cmd_write_queue(ctl, NULL, 0, buf, sizeof(buf)); |
727 | } | |
728 | ||
93ad89b2 SA |
729 | static void |
730 | ssld_update_config_one(ssl_ctl_t *ctl) | |
731 | { | |
732 | send_certfp_method(ctl); | |
733 | send_new_ssl_certs_one(ctl); | |
734 | } | |
735 | ||
f8451915 | 736 | void |
f7b0c4b3 | 737 | ssld_update_config(void) |
f8451915 AC |
738 | { |
739 | rb_dlink_node *ptr; | |
f7b0c4b3 | 740 | |
f8451915 AC |
741 | RB_DLINK_FOREACH(ptr, ssl_daemons.head) |
742 | { | |
743 | ssl_ctl_t *ctl = ptr->data; | |
1cdf323b SA |
744 | |
745 | if (ctl->dead || ctl->shutdown) | |
746 | continue; | |
747 | ||
93ad89b2 | 748 | ssld_update_config_one(ctl); |
f8451915 AC |
749 | } |
750 | } | |
751 | ||
3202e249 | 752 | ssl_ctl_t * |
196740c4 | 753 | start_ssld_accept(rb_fde_t * sslF, rb_fde_t * plainF, uint32_t id) |
f8451915 AC |
754 | { |
755 | rb_fde_t *F[2]; | |
756 | ssl_ctl_t *ctl; | |
757 | char buf[5]; | |
758 | F[0] = sslF; | |
759 | F[1] = plainF; | |
760 | ||
761 | buf[0] = 'A'; | |
196740c4 | 762 | uint32_to_buf(&buf[1], id); |
f8451915 | 763 | ctl = which_ssld(); |
5e270e7d SA |
764 | if(!ctl) |
765 | return NULL; | |
f8451915 AC |
766 | ctl->cli_count++; |
767 | ssl_cmd_write_queue(ctl, F, 2, buf, sizeof(buf)); | |
768 | return ctl; | |
769 | } | |
770 | ||
771 | ssl_ctl_t * | |
196740c4 | 772 | start_ssld_connect(rb_fde_t * sslF, rb_fde_t * plainF, uint32_t id) |
f8451915 AC |
773 | { |
774 | rb_fde_t *F[2]; | |
775 | ssl_ctl_t *ctl; | |
776 | char buf[5]; | |
777 | F[0] = sslF; | |
778 | F[1] = plainF; | |
779 | ||
780 | buf[0] = 'C'; | |
196740c4 | 781 | uint32_to_buf(&buf[1], id); |
f8451915 AC |
782 | |
783 | ctl = which_ssld(); | |
5e270e7d SA |
784 | if(!ctl) |
785 | return NULL; | |
f8451915 AC |
786 | ctl->cli_count++; |
787 | ssl_cmd_write_queue(ctl, F, 2, buf, sizeof(buf)); | |
3202e249 | 788 | return ctl; |
f8451915 AC |
789 | } |
790 | ||
3202e249 VY |
791 | void |
792 | ssld_decrement_clicount(ssl_ctl_t * ctl) | |
f8451915 AC |
793 | { |
794 | if(ctl == NULL) | |
795 | return; | |
796 | ||
797 | ctl->cli_count--; | |
eb1b303d SA |
798 | if(ctl->shutdown && !ctl->cli_count) |
799 | { | |
800 | ctl->dead = 1; | |
801 | rb_kill(ctl->pid, SIGKILL); | |
802 | } | |
f8451915 AC |
803 | if(ctl->dead && !ctl->cli_count) |
804 | { | |
805 | free_ssl_daemon(ctl); | |
806 | } | |
807 | } | |
808 | ||
f8451915 AC |
809 | static void |
810 | cleanup_dead_ssl(void *unused) | |
811 | { | |
812 | rb_dlink_node *ptr, *next; | |
813 | ssl_ctl_t *ctl; | |
814 | RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head) | |
815 | { | |
816 | ctl = ptr->data; | |
817 | if(ctl->dead && !ctl->cli_count) | |
818 | { | |
3202e249 | 819 | free_ssl_daemon(ctl); |
f8451915 AC |
820 | } |
821 | } | |
822 | } | |
823 | ||
824 | int | |
825 | get_ssld_count(void) | |
826 | { | |
827 | return ssld_count; | |
828 | } | |
829 | ||
035d9143 | 830 | void |
e9ffc3c1 | 831 | ssld_foreach_info(void (*func)(void *data, pid_t pid, int cli_count, enum ssld_status status, const char *version), void *data) |
035d9143 SA |
832 | { |
833 | rb_dlink_node *ptr, *next; | |
834 | ssl_ctl_t *ctl; | |
835 | RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head) | |
836 | { | |
837 | ctl = ptr->data; | |
838 | func(data, ctl->pid, ctl->cli_count, | |
839 | ctl->dead ? SSLD_DEAD : | |
e9ffc3c1 SA |
840 | (ctl->shutdown ? SSLD_SHUTDOWN : SSLD_ACTIVE), |
841 | ctl->version); | |
035d9143 SA |
842 | } |
843 | } | |
844 | ||
3202e249 VY |
845 | void |
846 | init_ssld(void) | |
f8451915 | 847 | { |
c42a66be | 848 | rb_event_addish("cleanup_dead_ssld", cleanup_dead_ssl, NULL, 60); |
f8451915 | 849 | } |