ircd/sslproc.c

   1 /*
   2  *  sslproc.c: An interface to ssld
   3  *  Copyright (C) 2007 Aaron Sethman <androsyn@ratbox.org>
   4  *  Copyright (C) 2007 ircd-ratbox development team
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 2 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, write to the Free Software
  18  *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301
  19  *  USA
  20  *
  21  *  $Id$
  22  */
  23
  24 #include <ratbox_lib.h>
  25 #include "stdinc.h"
  26
  27
  28 #include "s_conf.h"
  29 #include "logger.h"
  30 #include "listener.h"
  31 #include "sslproc.h"
  32 #include "s_serv.h"
  33 #include "ircd.h"
  34 #include "hash.h"
  35 #include "client.h"
  36 #include "send.h"
  37 #include "packet.h"
  38
  39 #define ZIPSTATS_TIME           60
  40
  41 static void collect_zipstats(void *unused);
  42 static void ssl_read_ctl(rb_fde_t * F, void *data);
  43 static int ssld_count;
  44
  45 static char tmpbuf[READBUF_SIZE];
  46 static char nul = '\0';
  47
  48 #define MAXPASSFD 4
  49 #define READSIZE 1024
  50 typedef struct _ssl_ctl_buf
  51 {
  52         rb_dlink_node node;
  53         char *buf;
  54         size_t buflen;
  55         rb_fde_t *F[MAXPASSFD];
  56         int nfds;
  57 } ssl_ctl_buf_t;
  58
  59
  60 struct _ssl_ctl
  61 {
  62         rb_dlink_node node;
  63         int cli_count;
  64         rb_fde_t *F;
  65         rb_fde_t *P;
  66         pid_t pid;
  67         rb_dlink_list readq;
  68         rb_dlink_list writeq;
  69         uint8_t shutdown;
  70         uint8_t dead;
  71 };
  72
  73 static void send_new_ssl_certs_one(ssl_ctl_t * ctl, const char *ssl_cert,
  74                                    const char *ssl_private_key, const char *ssl_dh_params,
  75                                    const char *ssl_cipher_list);
  76 static void send_init_prng(ssl_ctl_t * ctl, prng_seed_t seedtype, const char *path);
  77 static void send_certfp_method(ssl_ctl_t *ctl, int method);
  78
  79
  80 static rb_dlink_list ssl_daemons;
  81
  82 static inline uint32_t
  83 buf_to_uint32(char *buf)
  84 {
  85         uint32_t x;
  86         memcpy(&x, buf, sizeof(x));
  87         return x;
  88 }
  89
  90 static inline void
  91 uint32_to_buf(char *buf, uint32_t x)
  92 {
  93         memcpy(buf, &x, sizeof(x));
  94         return;
  95 }
  96
  97 static ssl_ctl_t *
  98 allocate_ssl_daemon(rb_fde_t * F, rb_fde_t * P, int pid)
  99 {
 100         ssl_ctl_t *ctl;
 101
 102         if(F == NULL || pid < 0)
 103                 return NULL;
 104         ctl = rb_malloc(sizeof(ssl_ctl_t));
 105         ctl->F = F;
 106         ctl->P = P;
 107         ctl->pid = pid;
 108         ssld_count++;
 109         rb_dlinkAdd(ctl, &ctl->node, &ssl_daemons);
 110         return ctl;
 111 }
 112
 113 static void
 114 free_ssl_daemon(ssl_ctl_t * ctl)
 115 {
 116         rb_dlink_node *ptr;
 117         ssl_ctl_buf_t *ctl_buf;
 118         int x;
 119         if(ctl->cli_count)
 120                 return;
 121
 122         RB_DLINK_FOREACH(ptr, ctl->readq.head)
 123         {
 124                 ctl_buf = ptr->data;
 125                 for(x = 0; x < ctl_buf->nfds; x++)
 126                         rb_close(ctl_buf->F[x]);
 127
 128                 rb_free(ctl_buf->buf);
 129                 rb_free(ctl_buf);
 130         }
 131
 132         RB_DLINK_FOREACH(ptr, ctl->writeq.head)
 133         {
 134                 ctl_buf = ptr->data;
 135                 for(x = 0; x < ctl_buf->nfds; x++)
 136                         rb_close(ctl_buf->F[x]);
 137
 138                 rb_free(ctl_buf->buf);
 139                 rb_free(ctl_buf);
 140         }
 141         rb_close(ctl->F);
 142         rb_close(ctl->P);
 143         rb_dlinkDelete(&ctl->node, &ssl_daemons);
 144         rb_free(ctl);
 145 }
 146
 147 static char *ssld_path;
 148
 149 static int ssld_spin_count = 0;
 150 static time_t last_spin;
 151 static int ssld_wait = 0;
 152
 153
 154 void
 155 restart_ssld(void)
 156 {
 157         rb_dlink_node *ptr, *next;
 158         ssl_ctl_t *ctl;
 159
 160         RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head)
 161         {
 162                 ctl = ptr->data;
 163                 if(ctl->dead)
 164                         continue;
 165                 if(ctl->shutdown)
 166                         continue;
 167                 ctl->shutdown = 1;
 168                 ssld_count--;
 169                 if(!ctl->cli_count)
 170                 {
 171                         rb_kill(ctl->pid, SIGKILL);
 172                         free_ssl_daemon(ctl);
 173                 }
 174         }
 175
 176         start_ssldaemon(ServerInfo.ssld_count, ServerInfo.ssl_cert, ServerInfo.ssl_private_key, ServerInfo.ssl_dh_params, ServerInfo.ssl_cipher_list);
 177 }
 178
 179 static void
 180 ssl_killall(void)
 181 {
 182         rb_dlink_node *ptr, *next;
 183         ssl_ctl_t *ctl;
 184         RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head)
 185         {
 186                 ctl = ptr->data;
 187                 if(ctl->dead)
 188                         continue;
 189                 ctl->dead = 1;
 190                 if(!ctl->shutdown)
 191                         ssld_count--;
 192                 rb_kill(ctl->pid, SIGKILL);
 193                 if(!ctl->cli_count)
 194                         free_ssl_daemon(ctl);
 195         }
 196 }
 197
 198 static void
 199 ssl_dead(ssl_ctl_t * ctl)
 200 {
 201         if(ctl->dead)
 202                 return;
 203
 204         ctl->dead = 1;
 205         rb_kill(ctl->pid, SIGKILL);     /* make sure the process is really gone */
 206
 207         if(!ctl->shutdown)
 208         {
 209                 ssld_count--;
 210                 ilog(L_MAIN, "ssld helper died - attempting to restart");
 211                 sendto_realops_snomask(SNO_GENERAL, L_ALL, "ssld helper died - attempting to restart");
 212                 start_ssldaemon(1, ServerInfo.ssl_cert, ServerInfo.ssl_private_key, ServerInfo.ssl_dh_params, ServerInfo.ssl_cipher_list);
 213         }
 214 }
 215
 216 static void
 217 ssl_do_pipe(rb_fde_t * F, void *data)
 218 {
 219         int retlen;
 220         ssl_ctl_t *ctl = data;
 221         retlen = rb_write(F, "0", 1);
 222         if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno)))
 223         {
 224                 ssl_dead(ctl);
 225                 return;
 226         }
 227         rb_setselect(F, RB_SELECT_READ, ssl_do_pipe, data);
 228 }
 229
 230 static void
 231 restart_ssld_event(void *unused)
 232 {
 233         ssld_spin_count = 0;
 234         last_spin = 0;
 235         ssld_wait = 0;
 236         if(ServerInfo.ssld_count > get_ssld_count())
 237         {
 238                 int start = ServerInfo.ssld_count - get_ssld_count();
 239                 ilog(L_MAIN, "Attempting to restart ssld processes");
 240                 sendto_realops_snomask(SNO_GENERAL, L_ALL, "Attempt to restart ssld processes");
 241                 start_ssldaemon(start, ServerInfo.ssl_cert, ServerInfo.ssl_private_key, ServerInfo.ssl_dh_params, ServerInfo.ssl_cipher_list);
 242         }
 243 }
 244
 245 int
 246 start_ssldaemon(int count, const char *ssl_cert, const char *ssl_private_key, const char *ssl_dh_params, const char *ssl_cipher_list)
 247 {
 248         rb_fde_t *F1, *F2;
 249         rb_fde_t *P1, *P2;
 250 #ifdef _WIN32
 251         const char *suffix = ".exe";
 252 #else
 253         const char *suffix = "";
 254 #endif
 255
 256         char fullpath[PATH_MAX + 1];
 257         char fdarg[6];
 258         const char *parv[2];
 259         char buf[128];
 260         char s_pid[10];
 261         pid_t pid;
 262         int started = 0, i;
 263
 264         if(ssld_wait)
 265                 return 0;
 266
 267         if(ssld_spin_count > 20 && (rb_current_time() - last_spin < 5))
 268         {
 269                 ilog(L_MAIN, "ssld helper is spinning - will attempt to restart in 1 minute");
 270                 sendto_realops_snomask(SNO_GENERAL, L_ALL,
 271                                        "ssld helper is spinning - will attempt to restart in 1 minute");
 272                 rb_event_add("restart_ssld_event", restart_ssld_event, NULL, 60);
 273                 ssld_wait = 1;
 274                 return 0;
 275         }
 276
 277         ssld_spin_count++;
 278         last_spin = rb_current_time();
 279
 280         if(ssld_path == NULL)
 281         {
 282                 snprintf(fullpath, sizeof(fullpath), "%s/ssld%s", PKGLIBEXECDIR, suffix);
 283
 284                 if(access(fullpath, X_OK) == -1)
 285                 {
 286                         snprintf(fullpath, sizeof(fullpath), "%s/bin/ssld%s",
 287                                     ConfigFileEntry.dpath, suffix);
 288                         if(access(fullpath, X_OK) == -1)
 289                         {
 290                                 ilog(L_MAIN,
 291                                      "Unable to execute ssld%s in %s or %s/bin",
 292                                      suffix, PKGLIBEXECDIR, ConfigFileEntry.dpath);
 293                                 return 0;
 294                         }
 295                 }
 296                 ssld_path = rb_strdup(fullpath);
 297         }
 298         rb_strlcpy(buf, "-ircd ssld daemon", sizeof(buf));
 299         parv[0] = buf;
 300         parv[1] = NULL;
 301
 302         for(i = 0; i < count; i++)
 303         {
 304                 ssl_ctl_t *ctl;
 305                 if(rb_socketpair(AF_UNIX, SOCK_DGRAM, 0, &F1, &F2, "SSL/TLS handle passing socket") == -1)
 306                 {
 307                         ilog(L_MAIN, "Unable to create ssld - rb_socketpair failed: %s", strerror(errno));
 308                         return started;
 309                 }
 310
 311                 rb_set_buffers(F1, READBUF_SIZE);
 312                 rb_set_buffers(F2, READBUF_SIZE);
 313                 snprintf(fdarg, sizeof(fdarg), "%d", rb_get_fd(F2));
 314                 rb_setenv("CTL_FD", fdarg, 1);
 315                 if(rb_pipe(&P1, &P2, "SSL/TLS pipe") == -1)
 316                 {
 317                         ilog(L_MAIN, "Unable to create ssld - rb_pipe failed: %s", strerror(errno));
 318                         return started;
 319                 }
 320                 snprintf(fdarg, sizeof(fdarg), "%d", rb_get_fd(P1));
 321                 rb_setenv("CTL_PIPE", fdarg, 1);
 322                 snprintf(s_pid, sizeof(s_pid), "%d", (int)getpid());
 323                 rb_setenv("CTL_PPID", s_pid, 1);
 324 #ifdef _WIN32
 325                 SetHandleInformation((HANDLE) rb_get_fd(F2), HANDLE_FLAG_INHERIT, 1);
 326                 SetHandleInformation((HANDLE) rb_get_fd(P1), HANDLE_FLAG_INHERIT, 1);
 327 #endif
 328
 329                 pid = rb_spawn_process(ssld_path, (const char **) parv);
 330                 if(pid == -1)
 331                 {
 332                         ilog(L_MAIN, "Unable to create ssld: %s\n", strerror(errno));
 333                         rb_close(F1);
 334                         rb_close(F2);
 335                         rb_close(P1);
 336                         rb_close(P2);
 337                         return started;
 338                 }
 339                 started++;
 340                 rb_close(F2);
 341                 rb_close(P1);
 342                 ctl = allocate_ssl_daemon(F1, P2, pid);
 343                 if(ssl_ok)
 344                 {
 345                         send_init_prng(ctl, RB_PRNG_DEFAULT, NULL);
 346                         send_certfp_method(ctl, ConfigFileEntry.certfp_method);
 347
 348                         if(ssl_cert != NULL && ssl_private_key != NULL)
 349                                 send_new_ssl_certs_one(ctl, ssl_cert, ssl_private_key,
 350                                                        ssl_dh_params != NULL ? ssl_dh_params : "",
 351                                                        ssl_cipher_list != NULL ? ssl_cipher_list : "");
 352                 }
 353                 ssl_read_ctl(ctl->F, ctl);
 354                 ssl_do_pipe(P2, ctl);
 355
 356         }
 357         return started;
 358 }
 359
 360 static void
 361 ssl_process_zipstats(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf)
 362 {
 363         struct Client *server;
 364         struct ZipStats *zips;
 365         char *parv[7];
 366         (void) rb_string_to_array(ctl_buf->buf, parv, 6);
 367         server = find_server(NULL, parv[1]);
 368         if(server == NULL || server->localClient == NULL || !IsCapable(server, CAP_ZIP))
 369                 return;
 370         if(server->localClient->zipstats == NULL)
 371                 server->localClient->zipstats = rb_malloc(sizeof(struct ZipStats));
 372
 373         zips = server->localClient->zipstats;
 374
 375         zips->in += strtoull(parv[2], NULL, 10);
 376         zips->in_wire += strtoull(parv[3], NULL, 10);
 377         zips->out += strtoull(parv[4], NULL, 10);
 378         zips->out_wire += strtoull(parv[5], NULL, 10);
 379
 380         if(zips->in > 0)
 381                 zips->in_ratio = ((double) (zips->in - zips->in_wire) / (double) zips->in) * 100.00;
 382         else
 383                 zips->in_ratio = 0;
 384
 385         if(zips->out > 0)
 386                 zips->out_ratio = ((double) (zips->out - zips->out_wire) / (double) zips->out) * 100.00;
 387         else
 388                 zips->out_ratio = 0;
 389 }
 390
 391 static void
 392 ssl_process_dead_fd(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf)
 393 {
 394         struct Client *client_p;
 395         char reason[256];
 396         uint32_t fd;
 397
 398         if(ctl_buf->buflen < 6)
 399                 return;         /* bogus message..drop it.. XXX should warn here */
 400
 401         fd = buf_to_uint32(&ctl_buf->buf[1]);
 402         rb_strlcpy(reason, &ctl_buf->buf[5], sizeof(reason));
 403         client_p = find_cli_connid_hash(fd);
 404         if(client_p == NULL)
 405                 return;
 406         if(IsAnyServer(client_p) || IsRegistered(client_p))
 407         {
 408                 /* read any last moment ERROR, QUIT or the like -- jilles */
 409                 if (!strcmp(reason, "Remote host closed the connection"))
 410                         read_packet(client_p->localClient->F, client_p);
 411                 if (IsAnyDead(client_p))
 412                         return;
 413         }
 414         if(IsAnyServer(client_p))
 415         {
 416                 sendto_realops_snomask(SNO_GENERAL, is_remote_connect(client_p) && !IsServer(client_p) ? L_NETWIDE : L_ALL, "ssld error for %s: %s", client_p->name, reason);
 417                 ilog(L_SERVER, "ssld error for %s: %s", log_client_name(client_p, SHOW_IP), reason);
 418         }
 419         exit_client(client_p, client_p, &me, reason);
 420 }
 421
 422
 423 static void
 424 ssl_process_cipher_string(ssl_ctl_t *ctl, ssl_ctl_buf_t *ctl_buf)
 425 {
 426         struct Client *client_p;
 427         const char *cstring;
 428         uint32_t fd;
 429
 430         if(ctl_buf->buflen < 6)
 431                 return;         /* bogus message..drop it.. XXX should warn here */
 432
 433         fd = buf_to_uint32(&ctl_buf->buf[1]);
 434         cstring = (const char *)&ctl_buf->buf[5];
 435
 436         if(EmptyString(cstring))
 437                 return;
 438
 439         client_p = find_cli_connid_hash(fd);
 440         if(client_p != NULL && client_p->localClient != NULL)
 441         {
 442                 rb_free(client_p->localClient->cipher_string);
 443                 client_p->localClient->cipher_string = rb_strdup(cstring);
 444         }
 445 }
 446
 447
 448 static void
 449 ssl_process_certfp(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf)
 450 {
 451         struct Client *client_p;
 452         uint32_t fd;
 453         uint32_t len;
 454         uint8_t *certfp;
 455         char *certfp_string;
 456         int i;
 457
 458         if(ctl_buf->buflen > 5 + RB_SSL_CERTFP_LEN)
 459                 return;         /* bogus message..drop it.. XXX should warn here */
 460
 461         fd = buf_to_uint32(&ctl_buf->buf[1]);
 462         len = buf_to_uint32(&ctl_buf->buf[5]);
 463         certfp = (uint8_t *)&ctl_buf->buf[9];
 464         client_p = find_cli_connid_hash(fd);
 465         if(client_p == NULL)
 466                 return;
 467         rb_free(client_p->certfp);
 468         certfp_string = rb_malloc(len * 2 + 1);
 469         for(i = 0; i < len; i++)
 470                 snprintf(certfp_string + 2 * i, 3, "%02x",
 471                                 certfp[i]);
 472         client_p->certfp = certfp_string;
 473 }
 474
 475 static void
 476 ssl_process_cmd_recv(ssl_ctl_t * ctl)
 477 {
 478         static const char *cannot_setup_ssl = "ssld cannot setup ssl, check your certificates and private key";
 479         static const char *no_ssl_or_zlib = "ssld has neither SSL/TLS or zlib support killing all sslds";
 480         rb_dlink_node *ptr, *next;
 481         ssl_ctl_buf_t *ctl_buf;
 482         if(ctl->dead)
 483                 return;
 484         RB_DLINK_FOREACH_SAFE(ptr, next, ctl->readq.head)
 485         {
 486                 ctl_buf = ptr->data;
 487                 switch (*ctl_buf->buf)
 488                 {
 489                 case 'N':
 490                         ssl_ok = 0;     /* ssld says it can't do ssl/tls */
 491                         break;
 492                 case 'D':
 493                         ssl_process_dead_fd(ctl, ctl_buf);
 494                         break;
 495                 case 'C':
 496                         ssl_process_cipher_string(ctl, ctl_buf);
 497                         break;
 498                 case 'F':
 499                         ssl_process_certfp(ctl, ctl_buf);
 500                         break;
 501                 case 'S':
 502                         ssl_process_zipstats(ctl, ctl_buf);
 503                         break;
 504                 case 'I':
 505                         ssl_ok = 0;
 506                         ilog(L_MAIN, "%s", cannot_setup_ssl);
 507                         sendto_realops_snomask(SNO_GENERAL, L_ALL, "%s", cannot_setup_ssl);
 508                         break;
 509                 case 'U':
 510                         zlib_ok = 0;
 511                         ssl_ok = 0;
 512                         ilog(L_MAIN, "%s", no_ssl_or_zlib);
 513                         sendto_realops_snomask(SNO_GENERAL, L_ALL, "%s", no_ssl_or_zlib);
 514                         ssl_killall();
 515                         break;
 516                 case 'z':
 517                         zlib_ok = 0;
 518                         break;
 519                 default:
 520                         ilog(L_MAIN, "Received invalid command from ssld: %s", ctl_buf->buf);
 521                         sendto_realops_snomask(SNO_GENERAL, L_ALL, "Received invalid command from ssld");
 522                         break;
 523                 }
 524                 rb_dlinkDelete(ptr, &ctl->readq);
 525                 rb_free(ctl_buf->buf);
 526                 rb_free(ctl_buf);
 527         }
 528
 529 }
 530
 531
 532 static void
 533 ssl_read_ctl(rb_fde_t * F, void *data)
 534 {
 535         ssl_ctl_buf_t *ctl_buf;
 536         ssl_ctl_t *ctl = data;
 537         int retlen;
 538
 539         if(ctl->dead)
 540                 return;
 541         do
 542         {
 543                 ctl_buf = rb_malloc(sizeof(ssl_ctl_buf_t));
 544                 ctl_buf->buf = rb_malloc(READSIZE);
 545                 retlen = rb_recv_fd_buf(ctl->F, ctl_buf->buf, READSIZE, ctl_buf->F, 4);
 546                 ctl_buf->buflen = retlen;
 547                 if(retlen <= 0)
 548                 {
 549                         rb_free(ctl_buf->buf);
 550                         rb_free(ctl_buf);
 551                 }
 552                 else
 553                         rb_dlinkAddTail(ctl_buf, &ctl_buf->node, &ctl->readq);
 554         }
 555         while(retlen > 0);
 556
 557         if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno)))
 558         {
 559                 ssl_dead(ctl);
 560                 return;
 561         }
 562         ssl_process_cmd_recv(ctl);
 563         rb_setselect(ctl->F, RB_SELECT_READ, ssl_read_ctl, ctl);
 564 }
 565
 566 static ssl_ctl_t *
 567 which_ssld(void)
 568 {
 569         ssl_ctl_t *ctl, *lowest = NULL;
 570         rb_dlink_node *ptr;
 571
 572         RB_DLINK_FOREACH(ptr, ssl_daemons.head)
 573         {
 574                 ctl = ptr->data;
 575                 if(ctl->dead)
 576                         continue;
 577                 if(ctl->shutdown)
 578                         continue;
 579                 if(lowest == NULL)
 580                 {
 581                         lowest = ctl;
 582                         continue;
 583                 }
 584                 if(ctl->cli_count < lowest->cli_count)
 585                         lowest = ctl;
 586         }
 587         return (lowest);
 588 }
 589
 590 static void
 591 ssl_write_ctl(rb_fde_t * F, void *data)
 592 {
 593         ssl_ctl_t *ctl = data;
 594         ssl_ctl_buf_t *ctl_buf;
 595         rb_dlink_node *ptr, *next;
 596         int retlen, x;
 597
 598         if(ctl->dead)
 599                 return;
 600
 601         RB_DLINK_FOREACH_SAFE(ptr, next, ctl->writeq.head)
 602         {
 603                 ctl_buf = ptr->data;
 604                 /* in theory unix sock_dgram shouldn't ever short write this.. */
 605                 retlen = rb_send_fd_buf(ctl->F, ctl_buf->F, ctl_buf->nfds, ctl_buf->buf, ctl_buf->buflen, ctl->pid);
 606                 if(retlen > 0)
 607                 {
 608                         rb_dlinkDelete(ptr, &ctl->writeq);
 609                         for(x = 0; x < ctl_buf->nfds; x++)
 610                                 rb_close(ctl_buf->F[x]);
 611                         rb_free(ctl_buf->buf);
 612                         rb_free(ctl_buf);
 613
 614                 }
 615                 if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno)))
 616                 {
 617                         ssl_dead(ctl);
 618                         return;
 619                 }
 620                 else
 621                 {
 622                         rb_setselect(ctl->F, RB_SELECT_WRITE, ssl_write_ctl, ctl);
 623                 }
 624         }
 625 }
 626
 627 static void
 628 ssl_cmd_write_queue(ssl_ctl_t * ctl, rb_fde_t ** F, int count, const void *buf, size_t buflen)
 629 {
 630         ssl_ctl_buf_t *ctl_buf;
 631         int x;
 632
 633         /* don't bother */
 634         if(ctl->dead)
 635                 return;
 636
 637         ctl_buf = rb_malloc(sizeof(ssl_ctl_buf_t));
 638         ctl_buf->buf = rb_malloc(buflen);
 639         memcpy(ctl_buf->buf, buf, buflen);
 640         ctl_buf->buflen = buflen;
 641
 642         for(x = 0; x < count && x < MAXPASSFD; x++)
 643         {
 644                 ctl_buf->F[x] = F[x];
 645         }
 646         ctl_buf->nfds = count;
 647         rb_dlinkAddTail(ctl_buf, &ctl_buf->node, &ctl->writeq);
 648         ssl_write_ctl(ctl->F, ctl);
 649 }
 650
 651
 652 static void
 653 send_new_ssl_certs_one(ssl_ctl_t * ctl, const char *ssl_cert, const char *ssl_private_key, const char *ssl_dh_params, const char *ssl_cipher_list)
 654 {
 655         size_t len;
 656
 657         len = strlen(ssl_cert) + strlen(ssl_private_key) + strlen(ssl_dh_params) + 5;
 658         if(len > sizeof(tmpbuf))
 659         {
 660                 sendto_realops_snomask(SNO_GENERAL, L_ALL,
 661                                        "Parameters for send_new_ssl_certs_one too long (%zu > %zu) to pass to ssld, not sending...",
 662                                        len, sizeof(tmpbuf));
 663                 ilog(L_MAIN,
 664                      "Parameters for send_new_ssl_certs_one too long (%zu > %zu) to pass to ssld, not sending...",
 665                      len, sizeof(tmpbuf));
 666                 return;
 667         }
 668         len = snprintf(tmpbuf, sizeof(tmpbuf), "K%c%s%c%s%c%s%c%s%c", nul, ssl_cert, nul,
 669                           ssl_private_key, nul, ssl_dh_params, nul,
 670                           ssl_cipher_list != NULL ? ssl_cipher_list : "", nul);
 671         ssl_cmd_write_queue(ctl, NULL, 0, tmpbuf, len);
 672 }
 673
 674 static void
 675 send_init_prng(ssl_ctl_t * ctl, prng_seed_t seedtype, const char *path)
 676 {
 677         size_t len;
 678         const char *s;
 679         uint8_t seed = (uint8_t) seedtype;
 680
 681         if(path == NULL)
 682                 s = "";
 683         else
 684                 s = path;
 685
 686         len = strlen(s) + 3;
 687         if(len > sizeof(tmpbuf))
 688         {
 689                 sendto_realops_snomask(SNO_GENERAL, L_ALL,
 690                                        "Parameters for send_init_prng too long (%zd > %zd) to pass to ssld, not sending...",
 691                                        len, sizeof(tmpbuf));
 692                 ilog(L_MAIN,
 693                      "Parameters for send_init_prng too long (%zd > %zd) to pass to ssld, not sending...",
 694                      len, sizeof(tmpbuf));
 695                 return;
 696
 697         }
 698         len = snprintf(tmpbuf, sizeof(tmpbuf), "I%c%s%c", seed, s, nul);
 699         ssl_cmd_write_queue(ctl, NULL, 0, tmpbuf, len);
 700 }
 701
 702 static void
 703 send_certfp_method(ssl_ctl_t *ctl, int method)
 704 {
 705         char buf[5];
 706
 707         buf[0] = 'F';
 708         uint32_to_buf(&buf[1], method);
 709         ssl_cmd_write_queue(ctl, NULL, 0, buf, sizeof(buf));
 710 }
 711
 712 void
 713 send_new_ssl_certs(const char *ssl_cert, const char *ssl_private_key, const char *ssl_dh_params, const char *ssl_cipher_list)
 714 {
 715         rb_dlink_node *ptr;
 716         if(ssl_cert == NULL || ssl_private_key == NULL || ssl_dh_params == NULL)
 717         {
 718                 ssl_ok = 0;
 719                 return;
 720         }
 721         RB_DLINK_FOREACH(ptr, ssl_daemons.head)
 722         {
 723                 ssl_ctl_t *ctl = ptr->data;
 724                 send_new_ssl_certs_one(ctl, ssl_cert, ssl_private_key, ssl_dh_params, ssl_cipher_list);
 725         }
 726 }
 727
 728
 729 ssl_ctl_t *
 730 start_ssld_accept(rb_fde_t * sslF, rb_fde_t * plainF, uint32_t id)
 731 {
 732         rb_fde_t *F[2];
 733         ssl_ctl_t *ctl;
 734         char buf[5];
 735         F[0] = sslF;
 736         F[1] = plainF;
 737
 738         buf[0] = 'A';
 739         uint32_to_buf(&buf[1], id);
 740         ctl = which_ssld();
 741         if(!ctl)
 742                 return NULL;
 743         ctl->cli_count++;
 744         ssl_cmd_write_queue(ctl, F, 2, buf, sizeof(buf));
 745         return ctl;
 746 }
 747
 748 ssl_ctl_t *
 749 start_ssld_connect(rb_fde_t * sslF, rb_fde_t * plainF, uint32_t id)
 750 {
 751         rb_fde_t *F[2];
 752         ssl_ctl_t *ctl;
 753         char buf[5];
 754         F[0] = sslF;
 755         F[1] = plainF;
 756
 757         buf[0] = 'C';
 758         uint32_to_buf(&buf[1], id);
 759
 760         ctl = which_ssld();
 761         if(!ctl)
 762                 return NULL;
 763         ctl->cli_count++;
 764         ssl_cmd_write_queue(ctl, F, 2, buf, sizeof(buf));
 765         return ctl;
 766 }
 767
 768 void
 769 ssld_decrement_clicount(ssl_ctl_t * ctl)
 770 {
 771         if(ctl == NULL)
 772                 return;
 773
 774         ctl->cli_count--;
 775         if(ctl->shutdown && !ctl->cli_count)
 776         {
 777                 ctl->dead = 1;
 778                 rb_kill(ctl->pid, SIGKILL);
 779         }
 780         if(ctl->dead && !ctl->cli_count)
 781         {
 782                 free_ssl_daemon(ctl);
 783         }
 784 }
 785
 786 /*
 787  * what we end up sending to the ssld process for ziplinks is the following
 788  * Z[ourfd][level][RECVQ]
 789  * Z = ziplinks command = buf[0]
 790  * ourfd = Our end of the socketpair = buf[1..4]
 791  * level = zip level buf[5]
 792  * recvqlen = our recvq len = buf[6-7]
 793  * recvq = any data we read prior to starting ziplinks
 794  */
 795 void
 796 start_zlib_session(void *data)
 797 {
 798         struct Client *server = (struct Client *) data;
 799         uint16_t recvqlen;
 800         uint8_t level;
 801         void *xbuf;
 802
 803         rb_fde_t *F[2];
 804         rb_fde_t *xF1, *xF2;
 805         char *buf;
 806         char buf2[9];
 807         void *recvq_start;
 808
 809         size_t hdr = (sizeof(uint8_t) * 2) + sizeof(uint32_t);
 810         size_t len;
 811         int cpylen, left;
 812
 813         server->localClient->event = NULL;
 814
 815         recvqlen = rb_linebuf_len(&server->localClient->buf_recvq);
 816
 817         len = recvqlen + hdr;
 818
 819         if(len > READBUF_SIZE)
 820         {
 821                 sendto_realops_snomask(SNO_GENERAL, L_ALL,
 822                                        "ssld - attempted to pass message of %zd len, max len %d, giving up",
 823                                        len, READBUF_SIZE);
 824                 ilog(L_MAIN, "ssld - attempted to pass message of %zd len, max len %d, giving up", len, READBUF_SIZE);
 825                 exit_client(server, server, server, "ssld readbuf exceeded");
 826                 return;
 827         }
 828
 829         buf = rb_malloc(len);
 830         level = ConfigFileEntry.compression_level;
 831
 832         uint32_to_buf(&buf[1], rb_get_fd(server->localClient->F));
 833         buf[5] = (char) level;
 834
 835         recvq_start = &buf[6];
 836         server->localClient->zipstats = rb_malloc(sizeof(struct ZipStats));
 837
 838         xbuf = recvq_start;
 839         left = recvqlen;
 840
 841         do
 842         {
 843                 cpylen = rb_linebuf_get(&server->localClient->buf_recvq, xbuf, left, LINEBUF_PARTIAL, LINEBUF_RAW);
 844                 left -= cpylen;
 845                 xbuf = (void *) (((uintptr_t) xbuf) + cpylen);
 846         }
 847         while(cpylen > 0);
 848
 849         /* Pass the socket to ssld. */
 850         *buf = 'Z';
 851         if(rb_socketpair(AF_UNIX, SOCK_STREAM, 0, &xF1, &xF2, "Initial zlib socketpairs") == -1)
 852         {
 853                 sendto_realops_snomask(SNO_GENERAL, L_ALL, "Error creating zlib socketpair - %s", strerror(errno));
 854                 ilog(L_MAIN, "Error creating zlib socketpairs - %s", strerror(errno));
 855                 exit_client(server, server, server, "Error creating zlib socketpair");
 856                 rb_free(buf);
 857                 return;
 858         }
 859
 860         if(IsSSL(server))
 861         {
 862                 /* tell ssld the new connid for the ssl part*/
 863                 buf2[0] = 'Y';
 864                 uint32_to_buf(&buf2[1], rb_get_fd(server->localClient->F));
 865                 uint32_to_buf(&buf2[5], rb_get_fd(xF2));
 866                 ssl_cmd_write_queue(server->localClient->ssl_ctl, NULL, 0, buf2, sizeof(buf2));
 867         }
 868
 869
 870         F[0] = server->localClient->F;
 871         F[1] = xF1;
 872         del_from_zconnid_hash(server);
 873         server->localClient->F = xF2;
 874         /* need to redo as what we did before isn't valid now */
 875         uint32_to_buf(&buf[1], server->localClient->zconnid);
 876         add_to_zconnid_hash(server);
 877
 878         server->localClient->z_ctl = which_ssld();
 879         if(!server->localClient->z_ctl)
 880         {
 881                 exit_client(server, server, server, "Error finding available ssld");
 882                 rb_free(buf);
 883                 return;
 884         }
 885         server->localClient->z_ctl->cli_count++;
 886         ssl_cmd_write_queue(server->localClient->z_ctl, F, 2, buf, len);
 887         rb_free(buf);
 888 }
 889
 890 static void
 891 collect_zipstats(void *unused)
 892 {
 893         rb_dlink_node *ptr;
 894         struct Client *target_p;
 895         char buf[sizeof(uint8_t) + sizeof(uint32_t) + HOSTLEN];
 896         void *odata;
 897         size_t len;
 898         uint32_t id;
 899
 900         buf[0] = 'S';
 901         odata = buf + sizeof(uint8_t) + sizeof(uint32_t);
 902
 903         RB_DLINK_FOREACH(ptr, serv_list.head)
 904         {
 905                 target_p = ptr->data;
 906                 if(IsCapable(target_p, CAP_ZIP))
 907                 {
 908                         len = sizeof(uint8_t) + sizeof(uint32_t);
 909
 910                         id = rb_get_fd(target_p->localClient->F);
 911                         uint32_to_buf(&buf[1], id);
 912                         rb_strlcpy(odata, target_p->name, (sizeof(buf) - len));
 913                         len += strlen(odata) + 1;       /* Get the \0 as well */
 914                         ssl_cmd_write_queue(target_p->localClient->z_ctl, NULL, 0, buf, len);
 915                 }
 916         }
 917 }
 918
 919 static void
 920 cleanup_dead_ssl(void *unused)
 921 {
 922         rb_dlink_node *ptr, *next;
 923         ssl_ctl_t *ctl;
 924         RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head)
 925         {
 926                 ctl = ptr->data;
 927                 if(ctl->dead && !ctl->cli_count)
 928                 {
 929                         free_ssl_daemon(ctl);
 930                 }
 931         }
 932 }
 933
 934 int
 935 get_ssld_count(void)
 936 {
 937         return ssld_count;
 938 }
 939
 940 void
 941 ssld_foreach_info(void (*func)(void *data, pid_t pid, int cli_count, enum ssld_status status), void *data)
 942 {
 943         rb_dlink_node *ptr, *next;
 944         ssl_ctl_t *ctl;
 945         RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head)
 946         {
 947                 ctl = ptr->data;
 948                 func(data, ctl->pid, ctl->cli_count,
 949                         ctl->dead ? SSLD_DEAD :
 950                                 (ctl->shutdown ? SSLD_SHUTDOWN : SSLD_ACTIVE));
 951         }
 952 }
 953
 954 void
 955 init_ssld(void)
 956 {
 957         rb_event_addish("collect_zipstats", collect_zipstats, NULL, ZIPSTATS_TIME);
 958         rb_event_addish("cleanup_dead_ssld", cleanup_dead_ssl, NULL, 60);
 959 }