]>
Commit | Line | Data |
---|---|---|
f8451915 AC |
1 | /* |
2 | * sslproc.c: An interface to ssld | |
3 | * Copyright (C) 2007 Aaron Sethman <androsyn@ratbox.org> | |
4 | * Copyright (C) 2007 ircd-ratbox development team | |
5 | * | |
6 | * This program is free software; you can redistribute it and/or modify | |
7 | * it under the terms of the GNU General Public License as published by | |
8 | * the Free Software Foundation; either version 2 of the License, or | |
9 | * (at your option) any later version. | |
10 | * | |
11 | * This program is distributed in the hope that it will be useful, | |
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
14 | * GNU General Public License for more details. | |
15 | * | |
16 | * You should have received a copy of the GNU General Public License | |
17 | * along with this program; if not, write to the Free Software | |
18 | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 | |
19 | * USA | |
f8451915 AC |
20 | */ |
21 | ||
22 | #include <ratbox_lib.h> | |
23 | #include "stdinc.h" | |
3202e249 VY |
24 | |
25 | ||
f8451915 AC |
26 | #include "s_conf.h" |
27 | #include "logger.h" | |
28 | #include "listener.h" | |
29 | #include "sslproc.h" | |
30 | #include "s_serv.h" | |
31 | #include "ircd.h" | |
32 | #include "hash.h" | |
33 | #include "client.h" | |
34 | #include "send.h" | |
35 | #include "packet.h" | |
36 | ||
37 | #define ZIPSTATS_TIME 60 | |
38 | ||
39 | static void collect_zipstats(void *unused); | |
3202e249 | 40 | static void ssl_read_ctl(rb_fde_t * F, void *data); |
f8451915 AC |
41 | static int ssld_count; |
42 | ||
3202e249 | 43 | static char tmpbuf[READBUF_SIZE]; |
f8451915 AC |
44 | static char nul = '\0'; |
45 | ||
46 | #define MAXPASSFD 4 | |
47 | #define READSIZE 1024 | |
48 | typedef struct _ssl_ctl_buf | |
49 | { | |
50 | rb_dlink_node node; | |
51 | char *buf; | |
52 | size_t buflen; | |
53 | rb_fde_t *F[MAXPASSFD]; | |
54 | int nfds; | |
55 | } ssl_ctl_buf_t; | |
56 | ||
57 | ||
58 | struct _ssl_ctl | |
59 | { | |
60 | rb_dlink_node node; | |
61 | int cli_count; | |
62 | rb_fde_t *F; | |
63 | rb_fde_t *P; | |
64 | pid_t pid; | |
65 | rb_dlink_list readq; | |
66 | rb_dlink_list writeq; | |
eb1b303d | 67 | uint8_t shutdown; |
0862e335 | 68 | uint8_t dead; |
e9ffc3c1 | 69 | char version[256]; |
f8451915 AC |
70 | }; |
71 | ||
3202e249 | 72 | static void send_new_ssl_certs_one(ssl_ctl_t * ctl, const char *ssl_cert, |
c1725bda AC |
73 | const char *ssl_private_key, const char *ssl_dh_params, |
74 | const char *ssl_cipher_list); | |
3202e249 | 75 | static void send_init_prng(ssl_ctl_t * ctl, prng_seed_t seedtype, const char *path); |
13d8f0ed | 76 | static void send_certfp_method(ssl_ctl_t *ctl, int method); |
f8451915 AC |
77 | |
78 | ||
79 | static rb_dlink_list ssl_daemons; | |
80 | ||
196740c4 AC |
81 | static inline uint32_t |
82 | buf_to_uint32(char *buf) | |
f8451915 | 83 | { |
196740c4 | 84 | uint32_t x; |
0862e335 | 85 | memcpy(&x, buf, sizeof(x)); |
f8451915 AC |
86 | return x; |
87 | } | |
88 | ||
3202e249 | 89 | static inline void |
196740c4 | 90 | uint32_to_buf(char *buf, uint32_t x) |
f8451915 | 91 | { |
0862e335 | 92 | memcpy(buf, &x, sizeof(x)); |
f8451915 AC |
93 | return; |
94 | } | |
95 | ||
f8451915 | 96 | static ssl_ctl_t * |
3202e249 | 97 | allocate_ssl_daemon(rb_fde_t * F, rb_fde_t * P, int pid) |
f8451915 AC |
98 | { |
99 | ssl_ctl_t *ctl; | |
3202e249 | 100 | |
f8451915 AC |
101 | if(F == NULL || pid < 0) |
102 | return NULL; | |
3202e249 | 103 | ctl = rb_malloc(sizeof(ssl_ctl_t)); |
f8451915 AC |
104 | ctl->F = F; |
105 | ctl->P = P; | |
106 | ctl->pid = pid; | |
107 | ssld_count++; | |
108 | rb_dlinkAdd(ctl, &ctl->node, &ssl_daemons); | |
109 | return ctl; | |
110 | } | |
111 | ||
112 | static void | |
3202e249 | 113 | free_ssl_daemon(ssl_ctl_t * ctl) |
f8451915 AC |
114 | { |
115 | rb_dlink_node *ptr; | |
116 | ssl_ctl_buf_t *ctl_buf; | |
117 | int x; | |
118 | if(ctl->cli_count) | |
119 | return; | |
3202e249 | 120 | |
f8451915 AC |
121 | RB_DLINK_FOREACH(ptr, ctl->readq.head) |
122 | { | |
123 | ctl_buf = ptr->data; | |
124 | for(x = 0; x < ctl_buf->nfds; x++) | |
3202e249 | 125 | rb_close(ctl_buf->F[x]); |
f8451915 AC |
126 | |
127 | rb_free(ctl_buf->buf); | |
3202e249 | 128 | rb_free(ctl_buf); |
f8451915 AC |
129 | } |
130 | ||
131 | RB_DLINK_FOREACH(ptr, ctl->writeq.head) | |
132 | { | |
133 | ctl_buf = ptr->data; | |
134 | for(x = 0; x < ctl_buf->nfds; x++) | |
135 | rb_close(ctl_buf->F[x]); | |
136 | ||
137 | rb_free(ctl_buf->buf); | |
138 | rb_free(ctl_buf); | |
139 | } | |
140 | rb_close(ctl->F); | |
141 | rb_close(ctl->P); | |
142 | rb_dlinkDelete(&ctl->node, &ssl_daemons); | |
143 | rb_free(ctl); | |
144 | } | |
145 | ||
146 | static char *ssld_path; | |
147 | ||
148 | static int ssld_spin_count = 0; | |
149 | static time_t last_spin; | |
150 | static int ssld_wait = 0; | |
151 | ||
152 | ||
eb1b303d SA |
153 | void |
154 | restart_ssld(void) | |
155 | { | |
156 | rb_dlink_node *ptr, *next; | |
157 | ssl_ctl_t *ctl; | |
158 | ||
159 | RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head) | |
160 | { | |
161 | ctl = ptr->data; | |
162 | if(ctl->dead) | |
163 | continue; | |
164 | if(ctl->shutdown) | |
165 | continue; | |
166 | ctl->shutdown = 1; | |
167 | ssld_count--; | |
168 | if(!ctl->cli_count) | |
169 | { | |
170 | rb_kill(ctl->pid, SIGKILL); | |
171 | free_ssl_daemon(ctl); | |
172 | } | |
173 | } | |
174 | ||
175 | start_ssldaemon(ServerInfo.ssld_count, ServerInfo.ssl_cert, ServerInfo.ssl_private_key, ServerInfo.ssl_dh_params, ServerInfo.ssl_cipher_list); | |
176 | } | |
177 | ||
f8451915 AC |
178 | static void |
179 | ssl_killall(void) | |
180 | { | |
181 | rb_dlink_node *ptr, *next; | |
182 | ssl_ctl_t *ctl; | |
183 | RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head) | |
184 | { | |
185 | ctl = ptr->data; | |
186 | if(ctl->dead) | |
187 | continue; | |
188 | ctl->dead = 1; | |
eb1b303d SA |
189 | if(!ctl->shutdown) |
190 | ssld_count--; | |
3202e249 | 191 | rb_kill(ctl->pid, SIGKILL); |
eb1b303d SA |
192 | if(!ctl->cli_count) |
193 | free_ssl_daemon(ctl); | |
f8451915 AC |
194 | } |
195 | } | |
196 | ||
197 | static void | |
3202e249 | 198 | ssl_dead(ssl_ctl_t * ctl) |
f8451915 AC |
199 | { |
200 | if(ctl->dead) | |
201 | return; | |
3202e249 | 202 | |
f8451915 | 203 | ctl->dead = 1; |
3202e249 | 204 | rb_kill(ctl->pid, SIGKILL); /* make sure the process is really gone */ |
eb1b303d SA |
205 | |
206 | if(!ctl->shutdown) | |
207 | { | |
208 | ssld_count--; | |
209 | ilog(L_MAIN, "ssld helper died - attempting to restart"); | |
210 | sendto_realops_snomask(SNO_GENERAL, L_ALL, "ssld helper died - attempting to restart"); | |
211 | start_ssldaemon(1, ServerInfo.ssl_cert, ServerInfo.ssl_private_key, ServerInfo.ssl_dh_params, ServerInfo.ssl_cipher_list); | |
212 | } | |
f8451915 AC |
213 | } |
214 | ||
215 | static void | |
3202e249 | 216 | ssl_do_pipe(rb_fde_t * F, void *data) |
f8451915 AC |
217 | { |
218 | int retlen; | |
219 | ssl_ctl_t *ctl = data; | |
220 | retlen = rb_write(F, "0", 1); | |
221 | if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno))) | |
222 | { | |
223 | ssl_dead(ctl); | |
224 | return; | |
225 | } | |
226 | rb_setselect(F, RB_SELECT_READ, ssl_do_pipe, data); | |
227 | } | |
228 | ||
229 | static void | |
230 | restart_ssld_event(void *unused) | |
231 | { | |
232 | ssld_spin_count = 0; | |
233 | last_spin = 0; | |
234 | ssld_wait = 0; | |
235 | if(ServerInfo.ssld_count > get_ssld_count()) | |
236 | { | |
237 | int start = ServerInfo.ssld_count - get_ssld_count(); | |
238 | ilog(L_MAIN, "Attempting to restart ssld processes"); | |
536845c5 | 239 | sendto_realops_snomask(SNO_GENERAL, L_ALL, "Attempt to restart ssld processes"); |
c1725bda | 240 | start_ssldaemon(start, ServerInfo.ssl_cert, ServerInfo.ssl_private_key, ServerInfo.ssl_dh_params, ServerInfo.ssl_cipher_list); |
f8451915 AC |
241 | } |
242 | } | |
243 | ||
244 | int | |
c1725bda | 245 | start_ssldaemon(int count, const char *ssl_cert, const char *ssl_private_key, const char *ssl_dh_params, const char *ssl_cipher_list) |
f8451915 AC |
246 | { |
247 | rb_fde_t *F1, *F2; | |
248 | rb_fde_t *P1, *P2; | |
3202e249 VY |
249 | #ifdef _WIN32 |
250 | const char *suffix = ".exe"; | |
251 | #else | |
252 | const char *suffix = ""; | |
253 | #endif | |
254 | ||
f8451915 AC |
255 | char fullpath[PATH_MAX + 1]; |
256 | char fdarg[6]; | |
257 | const char *parv[2]; | |
258 | char buf[128]; | |
3202e249 | 259 | char s_pid[10]; |
f8451915 AC |
260 | pid_t pid; |
261 | int started = 0, i; | |
262 | ||
263 | if(ssld_wait) | |
264 | return 0; | |
265 | ||
266 | if(ssld_spin_count > 20 && (rb_current_time() - last_spin < 5)) | |
267 | { | |
b9249347 | 268 | ilog(L_MAIN, "ssld helper is spinning - will attempt to restart in 1 minute"); |
3202e249 VY |
269 | sendto_realops_snomask(SNO_GENERAL, L_ALL, |
270 | "ssld helper is spinning - will attempt to restart in 1 minute"); | |
f8451915 AC |
271 | rb_event_add("restart_ssld_event", restart_ssld_event, NULL, 60); |
272 | ssld_wait = 1; | |
273 | return 0; | |
274 | } | |
275 | ||
276 | ssld_spin_count++; | |
277 | last_spin = rb_current_time(); | |
3202e249 | 278 | |
f8451915 AC |
279 | if(ssld_path == NULL) |
280 | { | |
5203cba5 | 281 | snprintf(fullpath, sizeof(fullpath), "%s/ssld%s", PKGLIBEXECDIR, suffix); |
3202e249 | 282 | |
f8451915 AC |
283 | if(access(fullpath, X_OK) == -1) |
284 | { | |
5203cba5 | 285 | snprintf(fullpath, sizeof(fullpath), "%s/bin/ssld%s", |
3202e249 | 286 | ConfigFileEntry.dpath, suffix); |
f8451915 AC |
287 | if(access(fullpath, X_OK) == -1) |
288 | { | |
3202e249 | 289 | ilog(L_MAIN, |
c74836dc NPB |
290 | "Unable to execute ssld%s in %s or %s/bin", |
291 | suffix, PKGLIBEXECDIR, ConfigFileEntry.dpath); | |
3202e249 | 292 | return 0; |
f8451915 AC |
293 | } |
294 | } | |
295 | ssld_path = rb_strdup(fullpath); | |
296 | } | |
b697c329 | 297 | rb_strlcpy(buf, "-ircd ssld daemon", sizeof(buf)); |
f8451915 AC |
298 | parv[0] = buf; |
299 | parv[1] = NULL; | |
300 | ||
301 | for(i = 0; i < count; i++) | |
302 | { | |
303 | ssl_ctl_t *ctl; | |
eda22d87 JT |
304 | if(rb_socketpair(AF_UNIX, SOCK_DGRAM, 0, &F1, &F2, "SSL/TLS handle passing socket") == -1) |
305 | { | |
306 | ilog(L_MAIN, "Unable to create ssld - rb_socketpair failed: %s", strerror(errno)); | |
307 | return started; | |
308 | } | |
55abcbb2 | 309 | |
f8451915 AC |
310 | rb_set_buffers(F1, READBUF_SIZE); |
311 | rb_set_buffers(F2, READBUF_SIZE); | |
5203cba5 | 312 | snprintf(fdarg, sizeof(fdarg), "%d", rb_get_fd(F2)); |
3202e249 | 313 | rb_setenv("CTL_FD", fdarg, 1); |
cf09122b JT |
314 | if(rb_pipe(&P1, &P2, "SSL/TLS pipe") == -1) |
315 | { | |
316 | ilog(L_MAIN, "Unable to create ssld - rb_pipe failed: %s", strerror(errno)); | |
317 | return started; | |
318 | } | |
5203cba5 | 319 | snprintf(fdarg, sizeof(fdarg), "%d", rb_get_fd(P1)); |
3202e249 | 320 | rb_setenv("CTL_PIPE", fdarg, 1); |
5203cba5 | 321 | snprintf(s_pid, sizeof(s_pid), "%d", (int)getpid()); |
3202e249 VY |
322 | rb_setenv("CTL_PPID", s_pid, 1); |
323 | #ifdef _WIN32 | |
324 | SetHandleInformation((HANDLE) rb_get_fd(F2), HANDLE_FLAG_INHERIT, 1); | |
325 | SetHandleInformation((HANDLE) rb_get_fd(P1), HANDLE_FLAG_INHERIT, 1); | |
326 | #endif | |
327 | ||
328 | pid = rb_spawn_process(ssld_path, (const char **) parv); | |
f8451915 AC |
329 | if(pid == -1) |
330 | { | |
331 | ilog(L_MAIN, "Unable to create ssld: %s\n", strerror(errno)); | |
332 | rb_close(F1); | |
333 | rb_close(F2); | |
334 | rb_close(P1); | |
335 | rb_close(P2); | |
336 | return started; | |
337 | } | |
338 | started++; | |
339 | rb_close(F2); | |
340 | rb_close(P1); | |
341 | ctl = allocate_ssl_daemon(F1, P2, pid); | |
342 | if(ssl_ok) | |
13d8f0ed | 343 | { |
e861902f | 344 | send_init_prng(ctl, RB_PRNG_DEFAULT, NULL); |
13d8f0ed AC |
345 | send_certfp_method(ctl, ConfigFileEntry.certfp_method); |
346 | ||
347 | if(ssl_cert != NULL && ssl_private_key != NULL) | |
348 | send_new_ssl_certs_one(ctl, ssl_cert, ssl_private_key, | |
c1725bda AC |
349 | ssl_dh_params != NULL ? ssl_dh_params : "", |
350 | ssl_cipher_list != NULL ? ssl_cipher_list : ""); | |
13d8f0ed | 351 | } |
f8451915 AC |
352 | ssl_read_ctl(ctl->F, ctl); |
353 | ssl_do_pipe(P2, ctl); | |
3202e249 | 354 | |
f8451915 | 355 | } |
3202e249 | 356 | return started; |
f8451915 AC |
357 | } |
358 | ||
359 | static void | |
3202e249 | 360 | ssl_process_zipstats(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf) |
f8451915 AC |
361 | { |
362 | struct Client *server; | |
363 | struct ZipStats *zips; | |
4f7a1fee | 364 | char *parv[7]; |
32fb5895 | 365 | (void) rb_string_to_array(ctl_buf->buf, parv, 6); |
f8451915 AC |
366 | server = find_server(NULL, parv[1]); |
367 | if(server == NULL || server->localClient == NULL || !IsCapable(server, CAP_ZIP)) | |
368 | return; | |
369 | if(server->localClient->zipstats == NULL) | |
370 | server->localClient->zipstats = rb_malloc(sizeof(struct ZipStats)); | |
3202e249 | 371 | |
f8451915 AC |
372 | zips = server->localClient->zipstats; |
373 | ||
374 | zips->in += strtoull(parv[2], NULL, 10); | |
375 | zips->in_wire += strtoull(parv[3], NULL, 10); | |
376 | zips->out += strtoull(parv[4], NULL, 10); | |
377 | zips->out_wire += strtoull(parv[5], NULL, 10); | |
3202e249 | 378 | |
f8451915 | 379 | if(zips->in > 0) |
3202e249 | 380 | zips->in_ratio = ((double) (zips->in - zips->in_wire) / (double) zips->in) * 100.00; |
f8451915 AC |
381 | else |
382 | zips->in_ratio = 0; | |
3202e249 | 383 | |
f8451915 | 384 | if(zips->out > 0) |
3202e249 | 385 | zips->out_ratio = ((double) (zips->out - zips->out_wire) / (double) zips->out) * 100.00; |
f8451915 AC |
386 | else |
387 | zips->out_ratio = 0; | |
388 | } | |
389 | ||
390 | static void | |
3202e249 | 391 | ssl_process_dead_fd(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf) |
f8451915 AC |
392 | { |
393 | struct Client *client_p; | |
394 | char reason[256]; | |
196740c4 | 395 | uint32_t fd; |
f8451915 AC |
396 | |
397 | if(ctl_buf->buflen < 6) | |
3202e249 VY |
398 | return; /* bogus message..drop it.. XXX should warn here */ |
399 | ||
196740c4 | 400 | fd = buf_to_uint32(&ctl_buf->buf[1]); |
f8451915 | 401 | rb_strlcpy(reason, &ctl_buf->buf[5], sizeof(reason)); |
b5b4a0e7 | 402 | client_p = find_cli_connid_hash(fd); |
f8451915 AC |
403 | if(client_p == NULL) |
404 | return; | |
42d609f6 JT |
405 | if(IsAnyServer(client_p) || IsRegistered(client_p)) |
406 | { | |
407 | /* read any last moment ERROR, QUIT or the like -- jilles */ | |
408 | if (!strcmp(reason, "Remote host closed the connection")) | |
409 | read_packet(client_p->localClient->F, client_p); | |
410 | if (IsAnyDead(client_p)) | |
411 | return; | |
412 | } | |
f8451915 | 413 | if(IsAnyServer(client_p)) |
81c5873e | 414 | { |
2a073ca2 | 415 | sendto_realops_snomask(SNO_GENERAL, is_remote_connect(client_p) && !IsServer(client_p) ? L_NETWIDE : L_ALL, "ssld error for %s: %s", client_p->name, reason); |
81c5873e JT |
416 | ilog(L_SERVER, "ssld error for %s: %s", log_client_name(client_p, SHOW_IP), reason); |
417 | } | |
f8451915 AC |
418 | exit_client(client_p, client_p, &me, reason); |
419 | } | |
420 | ||
ebe33dbf AC |
421 | |
422 | static void | |
423 | ssl_process_cipher_string(ssl_ctl_t *ctl, ssl_ctl_buf_t *ctl_buf) | |
424 | { | |
425 | struct Client *client_p; | |
426 | const char *cstring; | |
427 | uint32_t fd; | |
428 | ||
429 | if(ctl_buf->buflen < 6) | |
430 | return; /* bogus message..drop it.. XXX should warn here */ | |
431 | ||
432 | fd = buf_to_uint32(&ctl_buf->buf[1]); | |
433 | cstring = (const char *)&ctl_buf->buf[5]; | |
434 | ||
435 | if(EmptyString(cstring)) | |
436 | return; | |
437 | ||
b5b4a0e7 | 438 | client_p = find_cli_connid_hash(fd); |
ebe33dbf AC |
439 | if(client_p != NULL && client_p->localClient != NULL) |
440 | { | |
441 | rb_free(client_p->localClient->cipher_string); | |
442 | client_p->localClient->cipher_string = rb_strdup(cstring); | |
443 | } | |
444 | } | |
445 | ||
446 | ||
7247337a JT |
447 | static void |
448 | ssl_process_certfp(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf) | |
449 | { | |
450 | struct Client *client_p; | |
196740c4 AC |
451 | uint32_t fd; |
452 | uint32_t len; | |
7247337a | 453 | uint8_t *certfp; |
8eda114a | 454 | char *certfp_string; |
7247337a JT |
455 | int i; |
456 | ||
772c95cc | 457 | if(ctl_buf->buflen > 5 + RB_SSL_CERTFP_LEN) |
7247337a JT |
458 | return; /* bogus message..drop it.. XXX should warn here */ |
459 | ||
196740c4 AC |
460 | fd = buf_to_uint32(&ctl_buf->buf[1]); |
461 | len = buf_to_uint32(&ctl_buf->buf[5]); | |
e6bbb410 | 462 | certfp = (uint8_t *)&ctl_buf->buf[9]; |
b5b4a0e7 | 463 | client_p = find_cli_connid_hash(fd); |
7247337a JT |
464 | if(client_p == NULL) |
465 | return; | |
8eda114a | 466 | rb_free(client_p->certfp); |
e6bbb410 EM |
467 | certfp_string = rb_malloc(len * 2 + 1); |
468 | for(i = 0; i < len; i++) | |
5203cba5 | 469 | snprintf(certfp_string + 2 * i, 3, "%02x", |
7247337a | 470 | certfp[i]); |
8eda114a | 471 | client_p->certfp = certfp_string; |
7247337a JT |
472 | } |
473 | ||
f8451915 | 474 | static void |
3202e249 | 475 | ssl_process_cmd_recv(ssl_ctl_t * ctl) |
f8451915 AC |
476 | { |
477 | static const char *cannot_setup_ssl = "ssld cannot setup ssl, check your certificates and private key"; | |
478 | static const char *no_ssl_or_zlib = "ssld has neither SSL/TLS or zlib support killing all sslds"; | |
3202e249 | 479 | rb_dlink_node *ptr, *next; |
f8451915 | 480 | ssl_ctl_buf_t *ctl_buf; |
e9ffc3c1 SA |
481 | int len; |
482 | ||
f8451915 AC |
483 | if(ctl->dead) |
484 | return; | |
e9ffc3c1 | 485 | |
f8451915 AC |
486 | RB_DLINK_FOREACH_SAFE(ptr, next, ctl->readq.head) |
487 | { | |
3202e249 VY |
488 | ctl_buf = ptr->data; |
489 | switch (*ctl_buf->buf) | |
f8451915 | 490 | { |
3202e249 VY |
491 | case 'N': |
492 | ssl_ok = 0; /* ssld says it can't do ssl/tls */ | |
493 | break; | |
494 | case 'D': | |
495 | ssl_process_dead_fd(ctl, ctl_buf); | |
496 | break; | |
ebe33dbf AC |
497 | case 'C': |
498 | ssl_process_cipher_string(ctl, ctl_buf); | |
499 | break; | |
7247337a JT |
500 | case 'F': |
501 | ssl_process_certfp(ctl, ctl_buf); | |
502 | break; | |
3202e249 VY |
503 | case 'S': |
504 | ssl_process_zipstats(ctl, ctl_buf); | |
505 | break; | |
506 | case 'I': | |
507 | ssl_ok = 0; | |
32ea9d3d | 508 | ilog(L_MAIN, "%s", cannot_setup_ssl); |
481b443b | 509 | sendto_realops_snomask(SNO_GENERAL, L_ALL, "%s", cannot_setup_ssl); |
f1709d5a | 510 | break; |
3202e249 VY |
511 | case 'U': |
512 | zlib_ok = 0; | |
513 | ssl_ok = 0; | |
32ea9d3d | 514 | ilog(L_MAIN, "%s", no_ssl_or_zlib); |
481b443b | 515 | sendto_realops_snomask(SNO_GENERAL, L_ALL, "%s", no_ssl_or_zlib); |
3202e249 VY |
516 | ssl_killall(); |
517 | break; | |
e9ffc3c1 SA |
518 | case 'V': |
519 | len = ctl_buf->buflen - 1; | |
520 | if (len > sizeof(ctl->version) - 1) | |
521 | len = sizeof(ctl->version) - 1; | |
522 | strncpy(ctl->version, &ctl_buf->buf[1], len); | |
3202e249 VY |
523 | case 'z': |
524 | zlib_ok = 0; | |
525 | break; | |
526 | default: | |
527 | ilog(L_MAIN, "Received invalid command from ssld: %s", ctl_buf->buf); | |
528 | sendto_realops_snomask(SNO_GENERAL, L_ALL, "Received invalid command from ssld"); | |
529 | break; | |
f8451915 AC |
530 | } |
531 | rb_dlinkDelete(ptr, &ctl->readq); | |
532 | rb_free(ctl_buf->buf); | |
533 | rb_free(ctl_buf); | |
534 | } | |
535 | ||
536 | } | |
537 | ||
538 | ||
539 | static void | |
3202e249 | 540 | ssl_read_ctl(rb_fde_t * F, void *data) |
f8451915 AC |
541 | { |
542 | ssl_ctl_buf_t *ctl_buf; | |
543 | ssl_ctl_t *ctl = data; | |
544 | int retlen; | |
545 | ||
546 | if(ctl->dead) | |
547 | return; | |
548 | do | |
549 | { | |
550 | ctl_buf = rb_malloc(sizeof(ssl_ctl_buf_t)); | |
551 | ctl_buf->buf = rb_malloc(READSIZE); | |
552 | retlen = rb_recv_fd_buf(ctl->F, ctl_buf->buf, READSIZE, ctl_buf->F, 4); | |
553 | ctl_buf->buflen = retlen; | |
3202e249 VY |
554 | if(retlen <= 0) |
555 | { | |
f8451915 AC |
556 | rb_free(ctl_buf->buf); |
557 | rb_free(ctl_buf); | |
558 | } | |
559 | else | |
560 | rb_dlinkAddTail(ctl_buf, &ctl_buf->node, &ctl->readq); | |
3202e249 VY |
561 | } |
562 | while(retlen > 0); | |
563 | ||
f8451915 AC |
564 | if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno))) |
565 | { | |
566 | ssl_dead(ctl); | |
567 | return; | |
3202e249 | 568 | } |
f8451915 AC |
569 | ssl_process_cmd_recv(ctl); |
570 | rb_setselect(ctl->F, RB_SELECT_READ, ssl_read_ctl, ctl); | |
571 | } | |
572 | ||
573 | static ssl_ctl_t * | |
574 | which_ssld(void) | |
575 | { | |
576 | ssl_ctl_t *ctl, *lowest = NULL; | |
577 | rb_dlink_node *ptr; | |
3202e249 | 578 | |
f8451915 AC |
579 | RB_DLINK_FOREACH(ptr, ssl_daemons.head) |
580 | { | |
581 | ctl = ptr->data; | |
582 | if(ctl->dead) | |
583 | continue; | |
eb1b303d SA |
584 | if(ctl->shutdown) |
585 | continue; | |
3202e249 VY |
586 | if(lowest == NULL) |
587 | { | |
f8451915 AC |
588 | lowest = ctl; |
589 | continue; | |
590 | } | |
591 | if(ctl->cli_count < lowest->cli_count) | |
592 | lowest = ctl; | |
593 | } | |
3202e249 | 594 | return (lowest); |
f8451915 AC |
595 | } |
596 | ||
597 | static void | |
3202e249 | 598 | ssl_write_ctl(rb_fde_t * F, void *data) |
f8451915 AC |
599 | { |
600 | ssl_ctl_t *ctl = data; | |
601 | ssl_ctl_buf_t *ctl_buf; | |
602 | rb_dlink_node *ptr, *next; | |
603 | int retlen, x; | |
604 | ||
605 | if(ctl->dead) | |
606 | return; | |
607 | ||
608 | RB_DLINK_FOREACH_SAFE(ptr, next, ctl->writeq.head) | |
609 | { | |
610 | ctl_buf = ptr->data; | |
611 | /* in theory unix sock_dgram shouldn't ever short write this.. */ | |
3202e249 | 612 | retlen = rb_send_fd_buf(ctl->F, ctl_buf->F, ctl_buf->nfds, ctl_buf->buf, ctl_buf->buflen, ctl->pid); |
f8451915 AC |
613 | if(retlen > 0) |
614 | { | |
615 | rb_dlinkDelete(ptr, &ctl->writeq); | |
616 | for(x = 0; x < ctl_buf->nfds; x++) | |
617 | rb_close(ctl_buf->F[x]); | |
618 | rb_free(ctl_buf->buf); | |
619 | rb_free(ctl_buf); | |
3202e249 | 620 | |
f8451915 AC |
621 | } |
622 | if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno))) | |
623 | { | |
624 | ssl_dead(ctl); | |
625 | return; | |
3202e249 VY |
626 | } |
627 | else | |
628 | { | |
f8451915 AC |
629 | rb_setselect(ctl->F, RB_SELECT_WRITE, ssl_write_ctl, ctl); |
630 | } | |
631 | } | |
632 | } | |
633 | ||
634 | static void | |
3202e249 | 635 | ssl_cmd_write_queue(ssl_ctl_t * ctl, rb_fde_t ** F, int count, const void *buf, size_t buflen) |
f8451915 AC |
636 | { |
637 | ssl_ctl_buf_t *ctl_buf; | |
3202e249 | 638 | int x; |
f8451915 AC |
639 | |
640 | /* don't bother */ | |
641 | if(ctl->dead) | |
642 | return; | |
3202e249 | 643 | |
f8451915 AC |
644 | ctl_buf = rb_malloc(sizeof(ssl_ctl_buf_t)); |
645 | ctl_buf->buf = rb_malloc(buflen); | |
646 | memcpy(ctl_buf->buf, buf, buflen); | |
647 | ctl_buf->buflen = buflen; | |
3202e249 | 648 | |
f8451915 AC |
649 | for(x = 0; x < count && x < MAXPASSFD; x++) |
650 | { | |
3202e249 | 651 | ctl_buf->F[x] = F[x]; |
f8451915 AC |
652 | } |
653 | ctl_buf->nfds = count; | |
654 | rb_dlinkAddTail(ctl_buf, &ctl_buf->node, &ctl->writeq); | |
655 | ssl_write_ctl(ctl->F, ctl); | |
656 | } | |
657 | ||
658 | ||
659 | static void | |
c1725bda | 660 | send_new_ssl_certs_one(ssl_ctl_t * ctl, const char *ssl_cert, const char *ssl_private_key, const char *ssl_dh_params, const char *ssl_cipher_list) |
f8451915 AC |
661 | { |
662 | size_t len; | |
663 | ||
3202e249 | 664 | len = strlen(ssl_cert) + strlen(ssl_private_key) + strlen(ssl_dh_params) + 5; |
f8451915 AC |
665 | if(len > sizeof(tmpbuf)) |
666 | { | |
3202e249 VY |
667 | sendto_realops_snomask(SNO_GENERAL, L_ALL, |
668 | "Parameters for send_new_ssl_certs_one too long (%zu > %zu) to pass to ssld, not sending...", | |
669 | len, sizeof(tmpbuf)); | |
670 | ilog(L_MAIN, | |
671 | "Parameters for send_new_ssl_certs_one too long (%zu > %zu) to pass to ssld, not sending...", | |
672 | len, sizeof(tmpbuf)); | |
f8451915 AC |
673 | return; |
674 | } | |
5203cba5 | 675 | len = snprintf(tmpbuf, sizeof(tmpbuf), "K%c%s%c%s%c%s%c%s%c", nul, ssl_cert, nul, |
0a604c72 AC |
676 | ssl_private_key, nul, ssl_dh_params, nul, |
677 | ssl_cipher_list != NULL ? ssl_cipher_list : "", nul); | |
f8451915 AC |
678 | ssl_cmd_write_queue(ctl, NULL, 0, tmpbuf, len); |
679 | } | |
680 | ||
681 | static void | |
3202e249 | 682 | send_init_prng(ssl_ctl_t * ctl, prng_seed_t seedtype, const char *path) |
f8451915 AC |
683 | { |
684 | size_t len; | |
685 | const char *s; | |
0862e335 | 686 | uint8_t seed = (uint8_t) seedtype; |
f8451915 AC |
687 | |
688 | if(path == NULL) | |
689 | s = ""; | |
690 | else | |
691 | s = path; | |
692 | ||
693 | len = strlen(s) + 3; | |
694 | if(len > sizeof(tmpbuf)) | |
695 | { | |
3202e249 VY |
696 | sendto_realops_snomask(SNO_GENERAL, L_ALL, |
697 | "Parameters for send_init_prng too long (%zd > %zd) to pass to ssld, not sending...", | |
698 | len, sizeof(tmpbuf)); | |
699 | ilog(L_MAIN, | |
700 | "Parameters for send_init_prng too long (%zd > %zd) to pass to ssld, not sending...", | |
701 | len, sizeof(tmpbuf)); | |
f8451915 | 702 | return; |
3202e249 VY |
703 | |
704 | } | |
5203cba5 | 705 | len = snprintf(tmpbuf, sizeof(tmpbuf), "I%c%s%c", seed, s, nul); |
f8451915 AC |
706 | ssl_cmd_write_queue(ctl, NULL, 0, tmpbuf, len); |
707 | } | |
708 | ||
13d8f0ed AC |
709 | static void |
710 | send_certfp_method(ssl_ctl_t *ctl, int method) | |
711 | { | |
712 | char buf[5]; | |
713 | ||
714 | buf[0] = 'F'; | |
196740c4 | 715 | uint32_to_buf(&buf[1], method); |
13d8f0ed AC |
716 | ssl_cmd_write_queue(ctl, NULL, 0, buf, sizeof(buf)); |
717 | } | |
718 | ||
f8451915 | 719 | void |
c1725bda | 720 | send_new_ssl_certs(const char *ssl_cert, const char *ssl_private_key, const char *ssl_dh_params, const char *ssl_cipher_list) |
f8451915 AC |
721 | { |
722 | rb_dlink_node *ptr; | |
723 | if(ssl_cert == NULL || ssl_private_key == NULL || ssl_dh_params == NULL) | |
724 | { | |
725 | ssl_ok = 0; | |
726 | return; | |
727 | } | |
728 | RB_DLINK_FOREACH(ptr, ssl_daemons.head) | |
729 | { | |
730 | ssl_ctl_t *ctl = ptr->data; | |
c1725bda | 731 | send_new_ssl_certs_one(ctl, ssl_cert, ssl_private_key, ssl_dh_params, ssl_cipher_list); |
f8451915 AC |
732 | } |
733 | } | |
734 | ||
735 | ||
3202e249 | 736 | ssl_ctl_t * |
196740c4 | 737 | start_ssld_accept(rb_fde_t * sslF, rb_fde_t * plainF, uint32_t id) |
f8451915 AC |
738 | { |
739 | rb_fde_t *F[2]; | |
740 | ssl_ctl_t *ctl; | |
741 | char buf[5]; | |
742 | F[0] = sslF; | |
743 | F[1] = plainF; | |
744 | ||
745 | buf[0] = 'A'; | |
196740c4 | 746 | uint32_to_buf(&buf[1], id); |
f8451915 | 747 | ctl = which_ssld(); |
5e270e7d SA |
748 | if(!ctl) |
749 | return NULL; | |
f8451915 AC |
750 | ctl->cli_count++; |
751 | ssl_cmd_write_queue(ctl, F, 2, buf, sizeof(buf)); | |
752 | return ctl; | |
753 | } | |
754 | ||
755 | ssl_ctl_t * | |
196740c4 | 756 | start_ssld_connect(rb_fde_t * sslF, rb_fde_t * plainF, uint32_t id) |
f8451915 AC |
757 | { |
758 | rb_fde_t *F[2]; | |
759 | ssl_ctl_t *ctl; | |
760 | char buf[5]; | |
761 | F[0] = sslF; | |
762 | F[1] = plainF; | |
763 | ||
764 | buf[0] = 'C'; | |
196740c4 | 765 | uint32_to_buf(&buf[1], id); |
f8451915 AC |
766 | |
767 | ctl = which_ssld(); | |
5e270e7d SA |
768 | if(!ctl) |
769 | return NULL; | |
f8451915 AC |
770 | ctl->cli_count++; |
771 | ssl_cmd_write_queue(ctl, F, 2, buf, sizeof(buf)); | |
3202e249 | 772 | return ctl; |
f8451915 AC |
773 | } |
774 | ||
3202e249 VY |
775 | void |
776 | ssld_decrement_clicount(ssl_ctl_t * ctl) | |
f8451915 AC |
777 | { |
778 | if(ctl == NULL) | |
779 | return; | |
780 | ||
781 | ctl->cli_count--; | |
eb1b303d SA |
782 | if(ctl->shutdown && !ctl->cli_count) |
783 | { | |
784 | ctl->dead = 1; | |
785 | rb_kill(ctl->pid, SIGKILL); | |
786 | } | |
f8451915 AC |
787 | if(ctl->dead && !ctl->cli_count) |
788 | { | |
789 | free_ssl_daemon(ctl); | |
790 | } | |
791 | } | |
792 | ||
55abcbb2 | 793 | /* |
f8451915 | 794 | * what we end up sending to the ssld process for ziplinks is the following |
55abcbb2 KB |
795 | * Z[ourfd][level][RECVQ] |
796 | * Z = ziplinks command = buf[0] | |
f8451915 AC |
797 | * ourfd = Our end of the socketpair = buf[1..4] |
798 | * level = zip level buf[5] | |
799 | * recvqlen = our recvq len = buf[6-7] | |
800 | * recvq = any data we read prior to starting ziplinks | |
801 | */ | |
802 | void | |
803 | start_zlib_session(void *data) | |
804 | { | |
3202e249 | 805 | struct Client *server = (struct Client *) data; |
0862e335 VY |
806 | uint16_t recvqlen; |
807 | uint8_t level; | |
f8451915 AC |
808 | void *xbuf; |
809 | ||
810 | rb_fde_t *F[2]; | |
811 | rb_fde_t *xF1, *xF2; | |
812 | char *buf; | |
07c2bb75 | 813 | char buf2[9]; |
f8451915 AC |
814 | void *recvq_start; |
815 | ||
196740c4 | 816 | size_t hdr = (sizeof(uint8_t) * 2) + sizeof(uint32_t); |
f8451915 AC |
817 | size_t len; |
818 | int cpylen, left; | |
819 | ||
820 | server->localClient->event = NULL; | |
821 | ||
822 | recvqlen = rb_linebuf_len(&server->localClient->buf_recvq); | |
3202e249 | 823 | |
f8451915 AC |
824 | len = recvqlen + hdr; |
825 | ||
826 | if(len > READBUF_SIZE) | |
827 | { | |
3202e249 VY |
828 | sendto_realops_snomask(SNO_GENERAL, L_ALL, |
829 | "ssld - attempted to pass message of %zd len, max len %d, giving up", | |
830 | len, READBUF_SIZE); | |
f8451915 AC |
831 | ilog(L_MAIN, "ssld - attempted to pass message of %zd len, max len %d, giving up", len, READBUF_SIZE); |
832 | exit_client(server, server, server, "ssld readbuf exceeded"); | |
833 | return; | |
834 | } | |
835 | ||
3202e249 | 836 | buf = rb_malloc(len); |
f8451915 AC |
837 | level = ConfigFileEntry.compression_level; |
838 | ||
196740c4 | 839 | uint32_to_buf(&buf[1], rb_get_fd(server->localClient->F)); |
3202e249 | 840 | buf[5] = (char) level; |
f8451915 | 841 | |
3202e249 | 842 | recvq_start = &buf[6]; |
f8451915 AC |
843 | server->localClient->zipstats = rb_malloc(sizeof(struct ZipStats)); |
844 | ||
845 | xbuf = recvq_start; | |
846 | left = recvqlen; | |
847 | ||
848 | do | |
849 | { | |
850 | cpylen = rb_linebuf_get(&server->localClient->buf_recvq, xbuf, left, LINEBUF_PARTIAL, LINEBUF_RAW); | |
851 | left -= cpylen; | |
3202e249 VY |
852 | xbuf = (void *) (((uintptr_t) xbuf) + cpylen); |
853 | } | |
854 | while(cpylen > 0); | |
f8451915 AC |
855 | |
856 | /* Pass the socket to ssld. */ | |
857 | *buf = 'Z'; | |
eda22d87 JT |
858 | if(rb_socketpair(AF_UNIX, SOCK_STREAM, 0, &xF1, &xF2, "Initial zlib socketpairs") == -1) |
859 | { | |
860 | sendto_realops_snomask(SNO_GENERAL, L_ALL, "Error creating zlib socketpair - %s", strerror(errno)); | |
861 | ilog(L_MAIN, "Error creating zlib socketpairs - %s", strerror(errno)); | |
862 | exit_client(server, server, server, "Error creating zlib socketpair"); | |
b9ff4868 | 863 | rb_free(buf); |
eda22d87 JT |
864 | return; |
865 | } | |
55abcbb2 | 866 | |
07c2bb75 JT |
867 | if(IsSSL(server)) |
868 | { | |
869 | /* tell ssld the new connid for the ssl part*/ | |
870 | buf2[0] = 'Y'; | |
196740c4 AC |
871 | uint32_to_buf(&buf2[1], rb_get_fd(server->localClient->F)); |
872 | uint32_to_buf(&buf2[5], rb_get_fd(xF2)); | |
07c2bb75 JT |
873 | ssl_cmd_write_queue(server->localClient->ssl_ctl, NULL, 0, buf2, sizeof(buf2)); |
874 | } | |
875 | ||
876 | ||
3202e249 | 877 | F[0] = server->localClient->F; |
f8451915 | 878 | F[1] = xF1; |
1b6568f6 | 879 | del_from_zconnid_hash(server); |
f8451915 AC |
880 | server->localClient->F = xF2; |
881 | /* need to redo as what we did before isn't valid now */ | |
a0130f9d | 882 | uint32_to_buf(&buf[1], server->localClient->zconnid); |
1b6568f6 | 883 | add_to_zconnid_hash(server); |
a4165b42 AS |
884 | |
885 | server->localClient->z_ctl = which_ssld(); | |
5e270e7d SA |
886 | if(!server->localClient->z_ctl) |
887 | { | |
888 | exit_client(server, server, server, "Error finding available ssld"); | |
889 | rb_free(buf); | |
890 | return; | |
891 | } | |
a4165b42 AS |
892 | server->localClient->z_ctl->cli_count++; |
893 | ssl_cmd_write_queue(server->localClient->z_ctl, F, 2, buf, len); | |
f8451915 AC |
894 | rb_free(buf); |
895 | } | |
896 | ||
897 | static void | |
898 | collect_zipstats(void *unused) | |
899 | { | |
900 | rb_dlink_node *ptr; | |
901 | struct Client *target_p; | |
196740c4 | 902 | char buf[sizeof(uint8_t) + sizeof(uint32_t) + HOSTLEN]; |
f8451915 AC |
903 | void *odata; |
904 | size_t len; | |
196740c4 | 905 | uint32_t id; |
f8451915 AC |
906 | |
907 | buf[0] = 'S'; | |
196740c4 | 908 | odata = buf + sizeof(uint8_t) + sizeof(uint32_t); |
f8451915 AC |
909 | |
910 | RB_DLINK_FOREACH(ptr, serv_list.head) | |
911 | { | |
912 | target_p = ptr->data; | |
913 | if(IsCapable(target_p, CAP_ZIP)) | |
914 | { | |
0862e335 | 915 | len = sizeof(uint8_t) + sizeof(uint32_t); |
f8451915 AC |
916 | |
917 | id = rb_get_fd(target_p->localClient->F); | |
196740c4 | 918 | uint32_to_buf(&buf[1], id); |
3202e249 VY |
919 | rb_strlcpy(odata, target_p->name, (sizeof(buf) - len)); |
920 | len += strlen(odata) + 1; /* Get the \0 as well */ | |
a4165b42 | 921 | ssl_cmd_write_queue(target_p->localClient->z_ctl, NULL, 0, buf, len); |
f8451915 AC |
922 | } |
923 | } | |
924 | } | |
925 | ||
926 | static void | |
927 | cleanup_dead_ssl(void *unused) | |
928 | { | |
929 | rb_dlink_node *ptr, *next; | |
930 | ssl_ctl_t *ctl; | |
931 | RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head) | |
932 | { | |
933 | ctl = ptr->data; | |
934 | if(ctl->dead && !ctl->cli_count) | |
935 | { | |
3202e249 | 936 | free_ssl_daemon(ctl); |
f8451915 AC |
937 | } |
938 | } | |
939 | } | |
940 | ||
941 | int | |
942 | get_ssld_count(void) | |
943 | { | |
944 | return ssld_count; | |
945 | } | |
946 | ||
035d9143 | 947 | void |
e9ffc3c1 | 948 | ssld_foreach_info(void (*func)(void *data, pid_t pid, int cli_count, enum ssld_status status, const char *version), void *data) |
035d9143 SA |
949 | { |
950 | rb_dlink_node *ptr, *next; | |
951 | ssl_ctl_t *ctl; | |
952 | RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head) | |
953 | { | |
954 | ctl = ptr->data; | |
955 | func(data, ctl->pid, ctl->cli_count, | |
956 | ctl->dead ? SSLD_DEAD : | |
e9ffc3c1 SA |
957 | (ctl->shutdown ? SSLD_SHUTDOWN : SSLD_ACTIVE), |
958 | ctl->version); | |
035d9143 SA |
959 | } |
960 | } | |
961 | ||
3202e249 VY |
962 | void |
963 | init_ssld(void) | |
f8451915 AC |
964 | { |
965 | rb_event_addish("collect_zipstats", collect_zipstats, NULL, ZIPSTATS_TIME); | |
c42a66be | 966 | rb_event_addish("cleanup_dead_ssld", cleanup_dead_ssl, NULL, 60); |
f8451915 | 967 | } |