]>
Commit | Line | Data |
---|---|---|
1 | /* | |
2 | * sslproc.c: An interface to ssld | |
3 | * Copyright (C) 2007 Aaron Sethman <androsyn@ratbox.org> | |
4 | * Copyright (C) 2007 ircd-ratbox development team | |
5 | * | |
6 | * This program is free software; you can redistribute it and/or modify | |
7 | * it under the terms of the GNU General Public License as published by | |
8 | * the Free Software Foundation; either version 2 of the License, or | |
9 | * (at your option) any later version. | |
10 | * | |
11 | * This program is distributed in the hope that it will be useful, | |
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
14 | * GNU General Public License for more details. | |
15 | * | |
16 | * You should have received a copy of the GNU General Public License | |
17 | * along with this program; if not, write to the Free Software | |
18 | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 | |
19 | * USA | |
20 | * | |
21 | * $Id$ | |
22 | */ | |
23 | ||
24 | #include <ratbox_lib.h> | |
25 | #include "stdinc.h" | |
26 | ||
27 | ||
28 | #include "s_conf.h" | |
29 | #include "logger.h" | |
30 | #include "listener.h" | |
31 | #include "sslproc.h" | |
32 | #include "s_serv.h" | |
33 | #include "ircd.h" | |
34 | #include "hash.h" | |
35 | #include "client.h" | |
36 | #include "send.h" | |
37 | #include "packet.h" | |
38 | ||
39 | #define ZIPSTATS_TIME 60 | |
40 | ||
41 | static void collect_zipstats(void *unused); | |
42 | static void ssl_read_ctl(rb_fde_t * F, void *data); | |
43 | static int ssld_count; | |
44 | ||
45 | static char tmpbuf[READBUF_SIZE]; | |
46 | static char nul = '\0'; | |
47 | ||
48 | #define MAXPASSFD 4 | |
49 | #define READSIZE 1024 | |
50 | typedef struct _ssl_ctl_buf | |
51 | { | |
52 | rb_dlink_node node; | |
53 | char *buf; | |
54 | size_t buflen; | |
55 | rb_fde_t *F[MAXPASSFD]; | |
56 | int nfds; | |
57 | } ssl_ctl_buf_t; | |
58 | ||
59 | ||
60 | struct _ssl_ctl | |
61 | { | |
62 | rb_dlink_node node; | |
63 | int cli_count; | |
64 | rb_fde_t *F; | |
65 | rb_fde_t *P; | |
66 | pid_t pid; | |
67 | rb_dlink_list readq; | |
68 | rb_dlink_list writeq; | |
69 | uint8_t shutdown; | |
70 | uint8_t dead; | |
71 | }; | |
72 | ||
73 | static void send_new_ssl_certs_one(ssl_ctl_t * ctl, const char *ssl_cert, | |
74 | const char *ssl_private_key, const char *ssl_dh_params, | |
75 | const char *ssl_cipher_list); | |
76 | static void send_init_prng(ssl_ctl_t * ctl, prng_seed_t seedtype, const char *path); | |
77 | static void send_certfp_method(ssl_ctl_t *ctl, int method); | |
78 | ||
79 | ||
80 | static rb_dlink_list ssl_daemons; | |
81 | ||
82 | static inline uint32_t | |
83 | buf_to_uint32(char *buf) | |
84 | { | |
85 | uint32_t x; | |
86 | memcpy(&x, buf, sizeof(x)); | |
87 | return x; | |
88 | } | |
89 | ||
90 | static inline void | |
91 | uint32_to_buf(char *buf, uint32_t x) | |
92 | { | |
93 | memcpy(buf, &x, sizeof(x)); | |
94 | return; | |
95 | } | |
96 | ||
97 | static ssl_ctl_t * | |
98 | allocate_ssl_daemon(rb_fde_t * F, rb_fde_t * P, int pid) | |
99 | { | |
100 | ssl_ctl_t *ctl; | |
101 | ||
102 | if(F == NULL || pid < 0) | |
103 | return NULL; | |
104 | ctl = rb_malloc(sizeof(ssl_ctl_t)); | |
105 | ctl->F = F; | |
106 | ctl->P = P; | |
107 | ctl->pid = pid; | |
108 | ssld_count++; | |
109 | rb_dlinkAdd(ctl, &ctl->node, &ssl_daemons); | |
110 | return ctl; | |
111 | } | |
112 | ||
113 | static void | |
114 | free_ssl_daemon(ssl_ctl_t * ctl) | |
115 | { | |
116 | rb_dlink_node *ptr; | |
117 | ssl_ctl_buf_t *ctl_buf; | |
118 | int x; | |
119 | if(ctl->cli_count) | |
120 | return; | |
121 | ||
122 | RB_DLINK_FOREACH(ptr, ctl->readq.head) | |
123 | { | |
124 | ctl_buf = ptr->data; | |
125 | for(x = 0; x < ctl_buf->nfds; x++) | |
126 | rb_close(ctl_buf->F[x]); | |
127 | ||
128 | rb_free(ctl_buf->buf); | |
129 | rb_free(ctl_buf); | |
130 | } | |
131 | ||
132 | RB_DLINK_FOREACH(ptr, ctl->writeq.head) | |
133 | { | |
134 | ctl_buf = ptr->data; | |
135 | for(x = 0; x < ctl_buf->nfds; x++) | |
136 | rb_close(ctl_buf->F[x]); | |
137 | ||
138 | rb_free(ctl_buf->buf); | |
139 | rb_free(ctl_buf); | |
140 | } | |
141 | rb_close(ctl->F); | |
142 | rb_close(ctl->P); | |
143 | rb_dlinkDelete(&ctl->node, &ssl_daemons); | |
144 | rb_free(ctl); | |
145 | } | |
146 | ||
147 | static char *ssld_path; | |
148 | ||
149 | static int ssld_spin_count = 0; | |
150 | static time_t last_spin; | |
151 | static int ssld_wait = 0; | |
152 | ||
153 | ||
154 | void | |
155 | restart_ssld(void) | |
156 | { | |
157 | rb_dlink_node *ptr, *next; | |
158 | ssl_ctl_t *ctl; | |
159 | ||
160 | RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head) | |
161 | { | |
162 | ctl = ptr->data; | |
163 | if(ctl->dead) | |
164 | continue; | |
165 | if(ctl->shutdown) | |
166 | continue; | |
167 | ctl->shutdown = 1; | |
168 | ssld_count--; | |
169 | if(!ctl->cli_count) | |
170 | { | |
171 | rb_kill(ctl->pid, SIGKILL); | |
172 | free_ssl_daemon(ctl); | |
173 | } | |
174 | } | |
175 | ||
176 | start_ssldaemon(ServerInfo.ssld_count, ServerInfo.ssl_cert, ServerInfo.ssl_private_key, ServerInfo.ssl_dh_params, ServerInfo.ssl_cipher_list); | |
177 | } | |
178 | ||
179 | static void | |
180 | ssl_killall(void) | |
181 | { | |
182 | rb_dlink_node *ptr, *next; | |
183 | ssl_ctl_t *ctl; | |
184 | RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head) | |
185 | { | |
186 | ctl = ptr->data; | |
187 | if(ctl->dead) | |
188 | continue; | |
189 | ctl->dead = 1; | |
190 | if(!ctl->shutdown) | |
191 | ssld_count--; | |
192 | rb_kill(ctl->pid, SIGKILL); | |
193 | if(!ctl->cli_count) | |
194 | free_ssl_daemon(ctl); | |
195 | } | |
196 | } | |
197 | ||
198 | static void | |
199 | ssl_dead(ssl_ctl_t * ctl) | |
200 | { | |
201 | if(ctl->dead) | |
202 | return; | |
203 | ||
204 | ctl->dead = 1; | |
205 | rb_kill(ctl->pid, SIGKILL); /* make sure the process is really gone */ | |
206 | ||
207 | if(!ctl->shutdown) | |
208 | { | |
209 | ssld_count--; | |
210 | ilog(L_MAIN, "ssld helper died - attempting to restart"); | |
211 | sendto_realops_snomask(SNO_GENERAL, L_ALL, "ssld helper died - attempting to restart"); | |
212 | start_ssldaemon(1, ServerInfo.ssl_cert, ServerInfo.ssl_private_key, ServerInfo.ssl_dh_params, ServerInfo.ssl_cipher_list); | |
213 | } | |
214 | } | |
215 | ||
216 | static void | |
217 | ssl_do_pipe(rb_fde_t * F, void *data) | |
218 | { | |
219 | int retlen; | |
220 | ssl_ctl_t *ctl = data; | |
221 | retlen = rb_write(F, "0", 1); | |
222 | if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno))) | |
223 | { | |
224 | ssl_dead(ctl); | |
225 | return; | |
226 | } | |
227 | rb_setselect(F, RB_SELECT_READ, ssl_do_pipe, data); | |
228 | } | |
229 | ||
230 | static void | |
231 | restart_ssld_event(void *unused) | |
232 | { | |
233 | ssld_spin_count = 0; | |
234 | last_spin = 0; | |
235 | ssld_wait = 0; | |
236 | if(ServerInfo.ssld_count > get_ssld_count()) | |
237 | { | |
238 | int start = ServerInfo.ssld_count - get_ssld_count(); | |
239 | ilog(L_MAIN, "Attempting to restart ssld processes"); | |
240 | sendto_realops_snomask(SNO_GENERAL, L_ALL, "Attempt to restart ssld processes"); | |
241 | start_ssldaemon(start, ServerInfo.ssl_cert, ServerInfo.ssl_private_key, ServerInfo.ssl_dh_params, ServerInfo.ssl_cipher_list); | |
242 | } | |
243 | } | |
244 | ||
245 | int | |
246 | start_ssldaemon(int count, const char *ssl_cert, const char *ssl_private_key, const char *ssl_dh_params, const char *ssl_cipher_list) | |
247 | { | |
248 | rb_fde_t *F1, *F2; | |
249 | rb_fde_t *P1, *P2; | |
250 | #ifdef _WIN32 | |
251 | const char *suffix = ".exe"; | |
252 | #else | |
253 | const char *suffix = ""; | |
254 | #endif | |
255 | ||
256 | char fullpath[PATH_MAX + 1]; | |
257 | char fdarg[6]; | |
258 | const char *parv[2]; | |
259 | char buf[128]; | |
260 | char s_pid[10]; | |
261 | pid_t pid; | |
262 | int started = 0, i; | |
263 | ||
264 | if(ssld_wait) | |
265 | return 0; | |
266 | ||
267 | if(ssld_spin_count > 20 && (rb_current_time() - last_spin < 5)) | |
268 | { | |
269 | ilog(L_MAIN, "ssld helper is spinning - will attempt to restart in 1 minute"); | |
270 | sendto_realops_snomask(SNO_GENERAL, L_ALL, | |
271 | "ssld helper is spinning - will attempt to restart in 1 minute"); | |
272 | rb_event_add("restart_ssld_event", restart_ssld_event, NULL, 60); | |
273 | ssld_wait = 1; | |
274 | return 0; | |
275 | } | |
276 | ||
277 | ssld_spin_count++; | |
278 | last_spin = rb_current_time(); | |
279 | ||
280 | if(ssld_path == NULL) | |
281 | { | |
282 | snprintf(fullpath, sizeof(fullpath), "%s/ssld%s", PKGLIBEXECDIR, suffix); | |
283 | ||
284 | if(access(fullpath, X_OK) == -1) | |
285 | { | |
286 | snprintf(fullpath, sizeof(fullpath), "%s/bin/ssld%s", | |
287 | ConfigFileEntry.dpath, suffix); | |
288 | if(access(fullpath, X_OK) == -1) | |
289 | { | |
290 | ilog(L_MAIN, | |
291 | "Unable to execute ssld%s in %s or %s/bin", | |
292 | suffix, PKGLIBEXECDIR, ConfigFileEntry.dpath); | |
293 | return 0; | |
294 | } | |
295 | } | |
296 | ssld_path = rb_strdup(fullpath); | |
297 | } | |
298 | rb_strlcpy(buf, "-ircd ssld daemon", sizeof(buf)); | |
299 | parv[0] = buf; | |
300 | parv[1] = NULL; | |
301 | ||
302 | for(i = 0; i < count; i++) | |
303 | { | |
304 | ssl_ctl_t *ctl; | |
305 | if(rb_socketpair(AF_UNIX, SOCK_DGRAM, 0, &F1, &F2, "SSL/TLS handle passing socket") == -1) | |
306 | { | |
307 | ilog(L_MAIN, "Unable to create ssld - rb_socketpair failed: %s", strerror(errno)); | |
308 | return started; | |
309 | } | |
310 | ||
311 | rb_set_buffers(F1, READBUF_SIZE); | |
312 | rb_set_buffers(F2, READBUF_SIZE); | |
313 | snprintf(fdarg, sizeof(fdarg), "%d", rb_get_fd(F2)); | |
314 | rb_setenv("CTL_FD", fdarg, 1); | |
315 | if(rb_pipe(&P1, &P2, "SSL/TLS pipe") == -1) | |
316 | { | |
317 | ilog(L_MAIN, "Unable to create ssld - rb_pipe failed: %s", strerror(errno)); | |
318 | return started; | |
319 | } | |
320 | snprintf(fdarg, sizeof(fdarg), "%d", rb_get_fd(P1)); | |
321 | rb_setenv("CTL_PIPE", fdarg, 1); | |
322 | snprintf(s_pid, sizeof(s_pid), "%d", (int)getpid()); | |
323 | rb_setenv("CTL_PPID", s_pid, 1); | |
324 | #ifdef _WIN32 | |
325 | SetHandleInformation((HANDLE) rb_get_fd(F2), HANDLE_FLAG_INHERIT, 1); | |
326 | SetHandleInformation((HANDLE) rb_get_fd(P1), HANDLE_FLAG_INHERIT, 1); | |
327 | #endif | |
328 | ||
329 | pid = rb_spawn_process(ssld_path, (const char **) parv); | |
330 | if(pid == -1) | |
331 | { | |
332 | ilog(L_MAIN, "Unable to create ssld: %s\n", strerror(errno)); | |
333 | rb_close(F1); | |
334 | rb_close(F2); | |
335 | rb_close(P1); | |
336 | rb_close(P2); | |
337 | return started; | |
338 | } | |
339 | started++; | |
340 | rb_close(F2); | |
341 | rb_close(P1); | |
342 | ctl = allocate_ssl_daemon(F1, P2, pid); | |
343 | if(ssl_ok) | |
344 | { | |
345 | send_init_prng(ctl, RB_PRNG_DEFAULT, NULL); | |
346 | send_certfp_method(ctl, ConfigFileEntry.certfp_method); | |
347 | ||
348 | if(ssl_cert != NULL && ssl_private_key != NULL) | |
349 | send_new_ssl_certs_one(ctl, ssl_cert, ssl_private_key, | |
350 | ssl_dh_params != NULL ? ssl_dh_params : "", | |
351 | ssl_cipher_list != NULL ? ssl_cipher_list : ""); | |
352 | } | |
353 | ssl_read_ctl(ctl->F, ctl); | |
354 | ssl_do_pipe(P2, ctl); | |
355 | ||
356 | } | |
357 | return started; | |
358 | } | |
359 | ||
360 | static void | |
361 | ssl_process_zipstats(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf) | |
362 | { | |
363 | struct Client *server; | |
364 | struct ZipStats *zips; | |
365 | char *parv[7]; | |
366 | (void) rb_string_to_array(ctl_buf->buf, parv, 6); | |
367 | server = find_server(NULL, parv[1]); | |
368 | if(server == NULL || server->localClient == NULL || !IsCapable(server, CAP_ZIP)) | |
369 | return; | |
370 | if(server->localClient->zipstats == NULL) | |
371 | server->localClient->zipstats = rb_malloc(sizeof(struct ZipStats)); | |
372 | ||
373 | zips = server->localClient->zipstats; | |
374 | ||
375 | zips->in += strtoull(parv[2], NULL, 10); | |
376 | zips->in_wire += strtoull(parv[3], NULL, 10); | |
377 | zips->out += strtoull(parv[4], NULL, 10); | |
378 | zips->out_wire += strtoull(parv[5], NULL, 10); | |
379 | ||
380 | if(zips->in > 0) | |
381 | zips->in_ratio = ((double) (zips->in - zips->in_wire) / (double) zips->in) * 100.00; | |
382 | else | |
383 | zips->in_ratio = 0; | |
384 | ||
385 | if(zips->out > 0) | |
386 | zips->out_ratio = ((double) (zips->out - zips->out_wire) / (double) zips->out) * 100.00; | |
387 | else | |
388 | zips->out_ratio = 0; | |
389 | } | |
390 | ||
391 | static void | |
392 | ssl_process_dead_fd(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf) | |
393 | { | |
394 | struct Client *client_p; | |
395 | char reason[256]; | |
396 | uint32_t fd; | |
397 | ||
398 | if(ctl_buf->buflen < 6) | |
399 | return; /* bogus message..drop it.. XXX should warn here */ | |
400 | ||
401 | fd = buf_to_uint32(&ctl_buf->buf[1]); | |
402 | rb_strlcpy(reason, &ctl_buf->buf[5], sizeof(reason)); | |
403 | client_p = find_cli_connid_hash(fd); | |
404 | if(client_p == NULL) | |
405 | return; | |
406 | if(IsAnyServer(client_p) || IsRegistered(client_p)) | |
407 | { | |
408 | /* read any last moment ERROR, QUIT or the like -- jilles */ | |
409 | if (!strcmp(reason, "Remote host closed the connection")) | |
410 | read_packet(client_p->localClient->F, client_p); | |
411 | if (IsAnyDead(client_p)) | |
412 | return; | |
413 | } | |
414 | if(IsAnyServer(client_p)) | |
415 | { | |
416 | sendto_realops_snomask(SNO_GENERAL, is_remote_connect(client_p) && !IsServer(client_p) ? L_NETWIDE : L_ALL, "ssld error for %s: %s", client_p->name, reason); | |
417 | ilog(L_SERVER, "ssld error for %s: %s", log_client_name(client_p, SHOW_IP), reason); | |
418 | } | |
419 | exit_client(client_p, client_p, &me, reason); | |
420 | } | |
421 | ||
422 | ||
423 | static void | |
424 | ssl_process_cipher_string(ssl_ctl_t *ctl, ssl_ctl_buf_t *ctl_buf) | |
425 | { | |
426 | struct Client *client_p; | |
427 | const char *cstring; | |
428 | uint32_t fd; | |
429 | ||
430 | if(ctl_buf->buflen < 6) | |
431 | return; /* bogus message..drop it.. XXX should warn here */ | |
432 | ||
433 | fd = buf_to_uint32(&ctl_buf->buf[1]); | |
434 | cstring = (const char *)&ctl_buf->buf[5]; | |
435 | ||
436 | if(EmptyString(cstring)) | |
437 | return; | |
438 | ||
439 | client_p = find_cli_connid_hash(fd); | |
440 | if(client_p != NULL && client_p->localClient != NULL) | |
441 | { | |
442 | rb_free(client_p->localClient->cipher_string); | |
443 | client_p->localClient->cipher_string = rb_strdup(cstring); | |
444 | } | |
445 | } | |
446 | ||
447 | ||
448 | static void | |
449 | ssl_process_certfp(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf) | |
450 | { | |
451 | struct Client *client_p; | |
452 | uint32_t fd; | |
453 | uint32_t len; | |
454 | uint8_t *certfp; | |
455 | char *certfp_string; | |
456 | int i; | |
457 | ||
458 | if(ctl_buf->buflen > 5 + RB_SSL_CERTFP_LEN) | |
459 | return; /* bogus message..drop it.. XXX should warn here */ | |
460 | ||
461 | fd = buf_to_uint32(&ctl_buf->buf[1]); | |
462 | len = buf_to_uint32(&ctl_buf->buf[5]); | |
463 | certfp = (uint8_t *)&ctl_buf->buf[9]; | |
464 | client_p = find_cli_connid_hash(fd); | |
465 | if(client_p == NULL) | |
466 | return; | |
467 | rb_free(client_p->certfp); | |
468 | certfp_string = rb_malloc(len * 2 + 1); | |
469 | for(i = 0; i < len; i++) | |
470 | snprintf(certfp_string + 2 * i, 3, "%02x", | |
471 | certfp[i]); | |
472 | client_p->certfp = certfp_string; | |
473 | } | |
474 | ||
475 | static void | |
476 | ssl_process_cmd_recv(ssl_ctl_t * ctl) | |
477 | { | |
478 | static const char *cannot_setup_ssl = "ssld cannot setup ssl, check your certificates and private key"; | |
479 | static const char *no_ssl_or_zlib = "ssld has neither SSL/TLS or zlib support killing all sslds"; | |
480 | rb_dlink_node *ptr, *next; | |
481 | ssl_ctl_buf_t *ctl_buf; | |
482 | if(ctl->dead) | |
483 | return; | |
484 | RB_DLINK_FOREACH_SAFE(ptr, next, ctl->readq.head) | |
485 | { | |
486 | ctl_buf = ptr->data; | |
487 | switch (*ctl_buf->buf) | |
488 | { | |
489 | case 'N': | |
490 | ssl_ok = 0; /* ssld says it can't do ssl/tls */ | |
491 | break; | |
492 | case 'D': | |
493 | ssl_process_dead_fd(ctl, ctl_buf); | |
494 | break; | |
495 | case 'C': | |
496 | ssl_process_cipher_string(ctl, ctl_buf); | |
497 | break; | |
498 | case 'F': | |
499 | ssl_process_certfp(ctl, ctl_buf); | |
500 | break; | |
501 | case 'S': | |
502 | ssl_process_zipstats(ctl, ctl_buf); | |
503 | break; | |
504 | case 'I': | |
505 | ssl_ok = 0; | |
506 | ilog(L_MAIN, "%s", cannot_setup_ssl); | |
507 | sendto_realops_snomask(SNO_GENERAL, L_ALL, "%s", cannot_setup_ssl); | |
508 | break; | |
509 | case 'U': | |
510 | zlib_ok = 0; | |
511 | ssl_ok = 0; | |
512 | ilog(L_MAIN, "%s", no_ssl_or_zlib); | |
513 | sendto_realops_snomask(SNO_GENERAL, L_ALL, "%s", no_ssl_or_zlib); | |
514 | ssl_killall(); | |
515 | break; | |
516 | case 'z': | |
517 | zlib_ok = 0; | |
518 | break; | |
519 | default: | |
520 | ilog(L_MAIN, "Received invalid command from ssld: %s", ctl_buf->buf); | |
521 | sendto_realops_snomask(SNO_GENERAL, L_ALL, "Received invalid command from ssld"); | |
522 | break; | |
523 | } | |
524 | rb_dlinkDelete(ptr, &ctl->readq); | |
525 | rb_free(ctl_buf->buf); | |
526 | rb_free(ctl_buf); | |
527 | } | |
528 | ||
529 | } | |
530 | ||
531 | ||
532 | static void | |
533 | ssl_read_ctl(rb_fde_t * F, void *data) | |
534 | { | |
535 | ssl_ctl_buf_t *ctl_buf; | |
536 | ssl_ctl_t *ctl = data; | |
537 | int retlen; | |
538 | ||
539 | if(ctl->dead) | |
540 | return; | |
541 | do | |
542 | { | |
543 | ctl_buf = rb_malloc(sizeof(ssl_ctl_buf_t)); | |
544 | ctl_buf->buf = rb_malloc(READSIZE); | |
545 | retlen = rb_recv_fd_buf(ctl->F, ctl_buf->buf, READSIZE, ctl_buf->F, 4); | |
546 | ctl_buf->buflen = retlen; | |
547 | if(retlen <= 0) | |
548 | { | |
549 | rb_free(ctl_buf->buf); | |
550 | rb_free(ctl_buf); | |
551 | } | |
552 | else | |
553 | rb_dlinkAddTail(ctl_buf, &ctl_buf->node, &ctl->readq); | |
554 | } | |
555 | while(retlen > 0); | |
556 | ||
557 | if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno))) | |
558 | { | |
559 | ssl_dead(ctl); | |
560 | return; | |
561 | } | |
562 | ssl_process_cmd_recv(ctl); | |
563 | rb_setselect(ctl->F, RB_SELECT_READ, ssl_read_ctl, ctl); | |
564 | } | |
565 | ||
566 | static ssl_ctl_t * | |
567 | which_ssld(void) | |
568 | { | |
569 | ssl_ctl_t *ctl, *lowest = NULL; | |
570 | rb_dlink_node *ptr; | |
571 | ||
572 | RB_DLINK_FOREACH(ptr, ssl_daemons.head) | |
573 | { | |
574 | ctl = ptr->data; | |
575 | if(ctl->dead) | |
576 | continue; | |
577 | if(ctl->shutdown) | |
578 | continue; | |
579 | if(lowest == NULL) | |
580 | { | |
581 | lowest = ctl; | |
582 | continue; | |
583 | } | |
584 | if(ctl->cli_count < lowest->cli_count) | |
585 | lowest = ctl; | |
586 | } | |
587 | return (lowest); | |
588 | } | |
589 | ||
590 | static void | |
591 | ssl_write_ctl(rb_fde_t * F, void *data) | |
592 | { | |
593 | ssl_ctl_t *ctl = data; | |
594 | ssl_ctl_buf_t *ctl_buf; | |
595 | rb_dlink_node *ptr, *next; | |
596 | int retlen, x; | |
597 | ||
598 | if(ctl->dead) | |
599 | return; | |
600 | ||
601 | RB_DLINK_FOREACH_SAFE(ptr, next, ctl->writeq.head) | |
602 | { | |
603 | ctl_buf = ptr->data; | |
604 | /* in theory unix sock_dgram shouldn't ever short write this.. */ | |
605 | retlen = rb_send_fd_buf(ctl->F, ctl_buf->F, ctl_buf->nfds, ctl_buf->buf, ctl_buf->buflen, ctl->pid); | |
606 | if(retlen > 0) | |
607 | { | |
608 | rb_dlinkDelete(ptr, &ctl->writeq); | |
609 | for(x = 0; x < ctl_buf->nfds; x++) | |
610 | rb_close(ctl_buf->F[x]); | |
611 | rb_free(ctl_buf->buf); | |
612 | rb_free(ctl_buf); | |
613 | ||
614 | } | |
615 | if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno))) | |
616 | { | |
617 | ssl_dead(ctl); | |
618 | return; | |
619 | } | |
620 | else | |
621 | { | |
622 | rb_setselect(ctl->F, RB_SELECT_WRITE, ssl_write_ctl, ctl); | |
623 | } | |
624 | } | |
625 | } | |
626 | ||
627 | static void | |
628 | ssl_cmd_write_queue(ssl_ctl_t * ctl, rb_fde_t ** F, int count, const void *buf, size_t buflen) | |
629 | { | |
630 | ssl_ctl_buf_t *ctl_buf; | |
631 | int x; | |
632 | ||
633 | /* don't bother */ | |
634 | if(ctl->dead) | |
635 | return; | |
636 | ||
637 | ctl_buf = rb_malloc(sizeof(ssl_ctl_buf_t)); | |
638 | ctl_buf->buf = rb_malloc(buflen); | |
639 | memcpy(ctl_buf->buf, buf, buflen); | |
640 | ctl_buf->buflen = buflen; | |
641 | ||
642 | for(x = 0; x < count && x < MAXPASSFD; x++) | |
643 | { | |
644 | ctl_buf->F[x] = F[x]; | |
645 | } | |
646 | ctl_buf->nfds = count; | |
647 | rb_dlinkAddTail(ctl_buf, &ctl_buf->node, &ctl->writeq); | |
648 | ssl_write_ctl(ctl->F, ctl); | |
649 | } | |
650 | ||
651 | ||
652 | static void | |
653 | send_new_ssl_certs_one(ssl_ctl_t * ctl, const char *ssl_cert, const char *ssl_private_key, const char *ssl_dh_params, const char *ssl_cipher_list) | |
654 | { | |
655 | size_t len; | |
656 | ||
657 | len = strlen(ssl_cert) + strlen(ssl_private_key) + strlen(ssl_dh_params) + 5; | |
658 | if(len > sizeof(tmpbuf)) | |
659 | { | |
660 | sendto_realops_snomask(SNO_GENERAL, L_ALL, | |
661 | "Parameters for send_new_ssl_certs_one too long (%zu > %zu) to pass to ssld, not sending...", | |
662 | len, sizeof(tmpbuf)); | |
663 | ilog(L_MAIN, | |
664 | "Parameters for send_new_ssl_certs_one too long (%zu > %zu) to pass to ssld, not sending...", | |
665 | len, sizeof(tmpbuf)); | |
666 | return; | |
667 | } | |
668 | len = snprintf(tmpbuf, sizeof(tmpbuf), "K%c%s%c%s%c%s%c%s%c", nul, ssl_cert, nul, | |
669 | ssl_private_key, nul, ssl_dh_params, nul, | |
670 | ssl_cipher_list != NULL ? ssl_cipher_list : "", nul); | |
671 | ssl_cmd_write_queue(ctl, NULL, 0, tmpbuf, len); | |
672 | } | |
673 | ||
674 | static void | |
675 | send_init_prng(ssl_ctl_t * ctl, prng_seed_t seedtype, const char *path) | |
676 | { | |
677 | size_t len; | |
678 | const char *s; | |
679 | uint8_t seed = (uint8_t) seedtype; | |
680 | ||
681 | if(path == NULL) | |
682 | s = ""; | |
683 | else | |
684 | s = path; | |
685 | ||
686 | len = strlen(s) + 3; | |
687 | if(len > sizeof(tmpbuf)) | |
688 | { | |
689 | sendto_realops_snomask(SNO_GENERAL, L_ALL, | |
690 | "Parameters for send_init_prng too long (%zd > %zd) to pass to ssld, not sending...", | |
691 | len, sizeof(tmpbuf)); | |
692 | ilog(L_MAIN, | |
693 | "Parameters for send_init_prng too long (%zd > %zd) to pass to ssld, not sending...", | |
694 | len, sizeof(tmpbuf)); | |
695 | return; | |
696 | ||
697 | } | |
698 | len = snprintf(tmpbuf, sizeof(tmpbuf), "I%c%s%c", seed, s, nul); | |
699 | ssl_cmd_write_queue(ctl, NULL, 0, tmpbuf, len); | |
700 | } | |
701 | ||
702 | static void | |
703 | send_certfp_method(ssl_ctl_t *ctl, int method) | |
704 | { | |
705 | char buf[5]; | |
706 | ||
707 | buf[0] = 'F'; | |
708 | uint32_to_buf(&buf[1], method); | |
709 | ssl_cmd_write_queue(ctl, NULL, 0, buf, sizeof(buf)); | |
710 | } | |
711 | ||
712 | void | |
713 | send_new_ssl_certs(const char *ssl_cert, const char *ssl_private_key, const char *ssl_dh_params, const char *ssl_cipher_list) | |
714 | { | |
715 | rb_dlink_node *ptr; | |
716 | if(ssl_cert == NULL || ssl_private_key == NULL || ssl_dh_params == NULL) | |
717 | { | |
718 | ssl_ok = 0; | |
719 | return; | |
720 | } | |
721 | RB_DLINK_FOREACH(ptr, ssl_daemons.head) | |
722 | { | |
723 | ssl_ctl_t *ctl = ptr->data; | |
724 | send_new_ssl_certs_one(ctl, ssl_cert, ssl_private_key, ssl_dh_params, ssl_cipher_list); | |
725 | } | |
726 | } | |
727 | ||
728 | ||
729 | ssl_ctl_t * | |
730 | start_ssld_accept(rb_fde_t * sslF, rb_fde_t * plainF, uint32_t id) | |
731 | { | |
732 | rb_fde_t *F[2]; | |
733 | ssl_ctl_t *ctl; | |
734 | char buf[5]; | |
735 | F[0] = sslF; | |
736 | F[1] = plainF; | |
737 | ||
738 | buf[0] = 'A'; | |
739 | uint32_to_buf(&buf[1], id); | |
740 | ctl = which_ssld(); | |
741 | if(!ctl) | |
742 | return NULL; | |
743 | ctl->cli_count++; | |
744 | ssl_cmd_write_queue(ctl, F, 2, buf, sizeof(buf)); | |
745 | return ctl; | |
746 | } | |
747 | ||
748 | ssl_ctl_t * | |
749 | start_ssld_connect(rb_fde_t * sslF, rb_fde_t * plainF, uint32_t id) | |
750 | { | |
751 | rb_fde_t *F[2]; | |
752 | ssl_ctl_t *ctl; | |
753 | char buf[5]; | |
754 | F[0] = sslF; | |
755 | F[1] = plainF; | |
756 | ||
757 | buf[0] = 'C'; | |
758 | uint32_to_buf(&buf[1], id); | |
759 | ||
760 | ctl = which_ssld(); | |
761 | if(!ctl) | |
762 | return NULL; | |
763 | ctl->cli_count++; | |
764 | ssl_cmd_write_queue(ctl, F, 2, buf, sizeof(buf)); | |
765 | return ctl; | |
766 | } | |
767 | ||
768 | void | |
769 | ssld_decrement_clicount(ssl_ctl_t * ctl) | |
770 | { | |
771 | if(ctl == NULL) | |
772 | return; | |
773 | ||
774 | ctl->cli_count--; | |
775 | if(ctl->shutdown && !ctl->cli_count) | |
776 | { | |
777 | ctl->dead = 1; | |
778 | rb_kill(ctl->pid, SIGKILL); | |
779 | } | |
780 | if(ctl->dead && !ctl->cli_count) | |
781 | { | |
782 | free_ssl_daemon(ctl); | |
783 | } | |
784 | } | |
785 | ||
786 | /* | |
787 | * what we end up sending to the ssld process for ziplinks is the following | |
788 | * Z[ourfd][level][RECVQ] | |
789 | * Z = ziplinks command = buf[0] | |
790 | * ourfd = Our end of the socketpair = buf[1..4] | |
791 | * level = zip level buf[5] | |
792 | * recvqlen = our recvq len = buf[6-7] | |
793 | * recvq = any data we read prior to starting ziplinks | |
794 | */ | |
795 | void | |
796 | start_zlib_session(void *data) | |
797 | { | |
798 | struct Client *server = (struct Client *) data; | |
799 | uint16_t recvqlen; | |
800 | uint8_t level; | |
801 | void *xbuf; | |
802 | ||
803 | rb_fde_t *F[2]; | |
804 | rb_fde_t *xF1, *xF2; | |
805 | char *buf; | |
806 | char buf2[9]; | |
807 | void *recvq_start; | |
808 | ||
809 | size_t hdr = (sizeof(uint8_t) * 2) + sizeof(uint32_t); | |
810 | size_t len; | |
811 | int cpylen, left; | |
812 | ||
813 | server->localClient->event = NULL; | |
814 | ||
815 | recvqlen = rb_linebuf_len(&server->localClient->buf_recvq); | |
816 | ||
817 | len = recvqlen + hdr; | |
818 | ||
819 | if(len > READBUF_SIZE) | |
820 | { | |
821 | sendto_realops_snomask(SNO_GENERAL, L_ALL, | |
822 | "ssld - attempted to pass message of %zd len, max len %d, giving up", | |
823 | len, READBUF_SIZE); | |
824 | ilog(L_MAIN, "ssld - attempted to pass message of %zd len, max len %d, giving up", len, READBUF_SIZE); | |
825 | exit_client(server, server, server, "ssld readbuf exceeded"); | |
826 | return; | |
827 | } | |
828 | ||
829 | buf = rb_malloc(len); | |
830 | level = ConfigFileEntry.compression_level; | |
831 | ||
832 | uint32_to_buf(&buf[1], rb_get_fd(server->localClient->F)); | |
833 | buf[5] = (char) level; | |
834 | ||
835 | recvq_start = &buf[6]; | |
836 | server->localClient->zipstats = rb_malloc(sizeof(struct ZipStats)); | |
837 | ||
838 | xbuf = recvq_start; | |
839 | left = recvqlen; | |
840 | ||
841 | do | |
842 | { | |
843 | cpylen = rb_linebuf_get(&server->localClient->buf_recvq, xbuf, left, LINEBUF_PARTIAL, LINEBUF_RAW); | |
844 | left -= cpylen; | |
845 | xbuf = (void *) (((uintptr_t) xbuf) + cpylen); | |
846 | } | |
847 | while(cpylen > 0); | |
848 | ||
849 | /* Pass the socket to ssld. */ | |
850 | *buf = 'Z'; | |
851 | if(rb_socketpair(AF_UNIX, SOCK_STREAM, 0, &xF1, &xF2, "Initial zlib socketpairs") == -1) | |
852 | { | |
853 | sendto_realops_snomask(SNO_GENERAL, L_ALL, "Error creating zlib socketpair - %s", strerror(errno)); | |
854 | ilog(L_MAIN, "Error creating zlib socketpairs - %s", strerror(errno)); | |
855 | exit_client(server, server, server, "Error creating zlib socketpair"); | |
856 | rb_free(buf); | |
857 | return; | |
858 | } | |
859 | ||
860 | if(IsSSL(server)) | |
861 | { | |
862 | /* tell ssld the new connid for the ssl part*/ | |
863 | buf2[0] = 'Y'; | |
864 | uint32_to_buf(&buf2[1], rb_get_fd(server->localClient->F)); | |
865 | uint32_to_buf(&buf2[5], rb_get_fd(xF2)); | |
866 | ssl_cmd_write_queue(server->localClient->ssl_ctl, NULL, 0, buf2, sizeof(buf2)); | |
867 | } | |
868 | ||
869 | ||
870 | F[0] = server->localClient->F; | |
871 | F[1] = xF1; | |
872 | del_from_cli_zconnid_hash(server); | |
873 | server->localClient->F = xF2; | |
874 | /* need to redo as what we did before isn't valid now */ | |
875 | uint32_to_buf(&buf[1], server->localClient->zconnid); | |
876 | add_to_cli_zconnid_hash(server); | |
877 | ||
878 | server->localClient->z_ctl = which_ssld(); | |
879 | if(!server->localClient->z_ctl) | |
880 | { | |
881 | exit_client(server, server, server, "Error finding available ssld"); | |
882 | rb_free(buf); | |
883 | return; | |
884 | } | |
885 | server->localClient->z_ctl->cli_count++; | |
886 | ssl_cmd_write_queue(server->localClient->z_ctl, F, 2, buf, len); | |
887 | rb_free(buf); | |
888 | } | |
889 | ||
890 | static void | |
891 | collect_zipstats(void *unused) | |
892 | { | |
893 | rb_dlink_node *ptr; | |
894 | struct Client *target_p; | |
895 | char buf[sizeof(uint8_t) + sizeof(uint32_t) + HOSTLEN]; | |
896 | void *odata; | |
897 | size_t len; | |
898 | uint32_t id; | |
899 | ||
900 | buf[0] = 'S'; | |
901 | odata = buf + sizeof(uint8_t) + sizeof(uint32_t); | |
902 | ||
903 | RB_DLINK_FOREACH(ptr, serv_list.head) | |
904 | { | |
905 | target_p = ptr->data; | |
906 | if(IsCapable(target_p, CAP_ZIP)) | |
907 | { | |
908 | len = sizeof(uint8_t) + sizeof(uint32_t); | |
909 | ||
910 | id = rb_get_fd(target_p->localClient->F); | |
911 | uint32_to_buf(&buf[1], id); | |
912 | rb_strlcpy(odata, target_p->name, (sizeof(buf) - len)); | |
913 | len += strlen(odata) + 1; /* Get the \0 as well */ | |
914 | ssl_cmd_write_queue(target_p->localClient->z_ctl, NULL, 0, buf, len); | |
915 | } | |
916 | } | |
917 | } | |
918 | ||
919 | static void | |
920 | cleanup_dead_ssl(void *unused) | |
921 | { | |
922 | rb_dlink_node *ptr, *next; | |
923 | ssl_ctl_t *ctl; | |
924 | RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head) | |
925 | { | |
926 | ctl = ptr->data; | |
927 | if(ctl->dead && !ctl->cli_count) | |
928 | { | |
929 | free_ssl_daemon(ctl); | |
930 | } | |
931 | } | |
932 | } | |
933 | ||
934 | int | |
935 | get_ssld_count(void) | |
936 | { | |
937 | return ssld_count; | |
938 | } | |
939 | ||
940 | void | |
941 | ssld_foreach_info(void (*func)(void *data, pid_t pid, int cli_count, enum ssld_status status), void *data) | |
942 | { | |
943 | rb_dlink_node *ptr, *next; | |
944 | ssl_ctl_t *ctl; | |
945 | RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head) | |
946 | { | |
947 | ctl = ptr->data; | |
948 | func(data, ctl->pid, ctl->cli_count, | |
949 | ctl->dead ? SSLD_DEAD : | |
950 | (ctl->shutdown ? SSLD_SHUTDOWN : SSLD_ACTIVE)); | |
951 | } | |
952 | } | |
953 | ||
954 | void | |
955 | init_ssld(void) | |
956 | { | |
957 | rb_event_addish("collect_zipstats", collect_zipstats, NULL, ZIPSTATS_TIME); | |
958 | rb_event_addish("cleanup_dead_ssld", cleanup_dead_ssl, NULL, 60); | |
959 | } |