ircd/sslproc.c

   1 /*
   2  *  sslproc.c: An interface to ssld
   3  *  Copyright (C) 2007 Aaron Sethman <androsyn@ratbox.org>
   4  *  Copyright (C) 2007 ircd-ratbox development team
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 2 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, write to the Free Software
  18  *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301
  19  *  USA
  20  */
  21
  22 #include <rb_lib.h>
  23 #include "stdinc.h"
  24
  25
  26 #include "s_conf.h"
  27 #include "logger.h"
  28 #include "listener.h"
  29 #include "sslproc.h"
  30 #include "s_serv.h"
  31 #include "ircd.h"
  32 #include "hash.h"
  33 #include "client.h"
  34 #include "send.h"
  35 #include "packet.h"
  36
  37 #define ZIPSTATS_TIME           60
  38
  39 static void collect_zipstats(void *unused);
  40 static void ssl_read_ctl(rb_fde_t * F, void *data);
  41 static int ssld_count;
  42
  43 static char tmpbuf[READBUF_SIZE];
  44 static char nul = '\0';
  45
  46 #define MAXPASSFD 4
  47 #define READSIZE 1024
  48 typedef struct _ssl_ctl_buf
  49 {
  50         rb_dlink_node node;
  51         char *buf;
  52         size_t buflen;
  53         rb_fde_t *F[MAXPASSFD];
  54         int nfds;
  55 } ssl_ctl_buf_t;
  56
  57
  58 struct _ssl_ctl
  59 {
  60         rb_dlink_node node;
  61         int cli_count;
  62         rb_fde_t *F;
  63         rb_fde_t *P;
  64         pid_t pid;
  65         rb_dlink_list readq;
  66         rb_dlink_list writeq;
  67         uint8_t shutdown;
  68         uint8_t dead;
  69         char version[256];
  70 };
  71
  72 static void send_new_ssl_certs_one(ssl_ctl_t * ctl, const char *ssl_cert,
  73                                    const char *ssl_private_key, const char *ssl_dh_params,
  74                                    const char *ssl_cipher_list);
  75 static void send_init_prng(ssl_ctl_t * ctl, prng_seed_t seedtype, const char *path);
  76 static void send_certfp_method(ssl_ctl_t *ctl, int method);
  77
  78
  79 static rb_dlink_list ssl_daemons;
  80
  81 static inline uint32_t
  82 buf_to_uint32(char *buf)
  83 {
  84         uint32_t x;
  85         memcpy(&x, buf, sizeof(x));
  86         return x;
  87 }
  88
  89 static inline void
  90 uint32_to_buf(char *buf, uint32_t x)
  91 {
  92         memcpy(buf, &x, sizeof(x));
  93         return;
  94 }
  95
  96 static ssl_ctl_t *
  97 allocate_ssl_daemon(rb_fde_t * F, rb_fde_t * P, int pid)
  98 {
  99         ssl_ctl_t *ctl;
 100
 101         if(F == NULL || pid < 0)
 102                 return NULL;
 103         ctl = rb_malloc(sizeof(ssl_ctl_t));
 104         ctl->F = F;
 105         ctl->P = P;
 106         ctl->pid = pid;
 107         ssld_count++;
 108         rb_dlinkAdd(ctl, &ctl->node, &ssl_daemons);
 109         return ctl;
 110 }
 111
 112 static void
 113 free_ssl_daemon(ssl_ctl_t * ctl)
 114 {
 115         rb_dlink_node *ptr;
 116         ssl_ctl_buf_t *ctl_buf;
 117         int x;
 118         if(ctl->cli_count)
 119                 return;
 120
 121         RB_DLINK_FOREACH(ptr, ctl->readq.head)
 122         {
 123                 ctl_buf = ptr->data;
 124                 for(x = 0; x < ctl_buf->nfds; x++)
 125                         rb_close(ctl_buf->F[x]);
 126
 127                 rb_free(ctl_buf->buf);
 128                 rb_free(ctl_buf);
 129         }
 130
 131         RB_DLINK_FOREACH(ptr, ctl->writeq.head)
 132         {
 133                 ctl_buf = ptr->data;
 134                 for(x = 0; x < ctl_buf->nfds; x++)
 135                         rb_close(ctl_buf->F[x]);
 136
 137                 rb_free(ctl_buf->buf);
 138                 rb_free(ctl_buf);
 139         }
 140         rb_close(ctl->F);
 141         rb_close(ctl->P);
 142         rb_dlinkDelete(&ctl->node, &ssl_daemons);
 143         rb_free(ctl);
 144 }
 145
 146 static char *ssld_path;
 147
 148 static int ssld_spin_count = 0;
 149 static time_t last_spin;
 150 static int ssld_wait = 0;
 151
 152
 153 void
 154 restart_ssld(void)
 155 {
 156         rb_dlink_node *ptr, *next;
 157         ssl_ctl_t *ctl;
 158
 159         RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head)
 160         {
 161                 ctl = ptr->data;
 162                 if(ctl->dead)
 163                         continue;
 164                 if(ctl->shutdown)
 165                         continue;
 166                 ctl->shutdown = 1;
 167                 ssld_count--;
 168                 if(!ctl->cli_count)
 169                 {
 170                         rb_kill(ctl->pid, SIGKILL);
 171                         free_ssl_daemon(ctl);
 172                 }
 173         }
 174
 175         start_ssldaemon(ServerInfo.ssld_count, ServerInfo.ssl_cert, ServerInfo.ssl_private_key, ServerInfo.ssl_dh_params, ServerInfo.ssl_cipher_list);
 176 }
 177
 178 static void
 179 ssl_killall(void)
 180 {
 181         rb_dlink_node *ptr, *next;
 182         ssl_ctl_t *ctl;
 183         RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head)
 184         {
 185                 ctl = ptr->data;
 186                 if(ctl->dead)
 187                         continue;
 188                 ctl->dead = 1;
 189                 if(!ctl->shutdown)
 190                         ssld_count--;
 191                 rb_kill(ctl->pid, SIGKILL);
 192                 if(!ctl->cli_count)
 193                         free_ssl_daemon(ctl);
 194         }
 195 }
 196
 197 static void
 198 ssl_dead(ssl_ctl_t * ctl)
 199 {
 200         if(ctl->dead)
 201                 return;
 202
 203         ctl->dead = 1;
 204         rb_kill(ctl->pid, SIGKILL);     /* make sure the process is really gone */
 205
 206         if(!ctl->shutdown)
 207         {
 208                 ssld_count--;
 209                 ilog(L_MAIN, "ssld helper died - attempting to restart");
 210                 sendto_realops_snomask(SNO_GENERAL, L_ALL, "ssld helper died - attempting to restart");
 211                 start_ssldaemon(1, ServerInfo.ssl_cert, ServerInfo.ssl_private_key, ServerInfo.ssl_dh_params, ServerInfo.ssl_cipher_list);
 212         }
 213 }
 214
 215 static void
 216 ssl_do_pipe(rb_fde_t * F, void *data)
 217 {
 218         int retlen;
 219         ssl_ctl_t *ctl = data;
 220         retlen = rb_write(F, "0", 1);
 221         if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno)))
 222         {
 223                 ssl_dead(ctl);
 224                 return;
 225         }
 226         rb_setselect(F, RB_SELECT_READ, ssl_do_pipe, data);
 227 }
 228
 229 static void
 230 restart_ssld_event(void *unused)
 231 {
 232         ssld_spin_count = 0;
 233         last_spin = 0;
 234         ssld_wait = 0;
 235         if(ServerInfo.ssld_count > get_ssld_count())
 236         {
 237                 int start = ServerInfo.ssld_count - get_ssld_count();
 238                 ilog(L_MAIN, "Attempting to restart ssld processes");
 239                 sendto_realops_snomask(SNO_GENERAL, L_ALL, "Attempt to restart ssld processes");
 240                 start_ssldaemon(start, ServerInfo.ssl_cert, ServerInfo.ssl_private_key, ServerInfo.ssl_dh_params, ServerInfo.ssl_cipher_list);
 241         }
 242 }
 243
 244 int
 245 start_ssldaemon(int count, const char *ssl_cert, const char *ssl_private_key, const char *ssl_dh_params, const char *ssl_cipher_list)
 246 {
 247         rb_fde_t *F1, *F2;
 248         rb_fde_t *P1, *P2;
 249 #ifdef _WIN32
 250         const char *suffix = ".exe";
 251 #else
 252         const char *suffix = "";
 253 #endif
 254
 255         char fullpath[PATH_MAX + 1];
 256         char fdarg[6];
 257         const char *parv[2];
 258         char buf[128];
 259         char s_pid[10];
 260         pid_t pid;
 261         int started = 0, i;
 262
 263         if(ssld_wait)
 264                 return 0;
 265
 266         if(ssld_spin_count > 20 && (rb_current_time() - last_spin < 5))
 267         {
 268                 ilog(L_MAIN, "ssld helper is spinning - will attempt to restart in 1 minute");
 269                 sendto_realops_snomask(SNO_GENERAL, L_ALL,
 270                                        "ssld helper is spinning - will attempt to restart in 1 minute");
 271                 rb_event_add("restart_ssld_event", restart_ssld_event, NULL, 60);
 272                 ssld_wait = 1;
 273                 return 0;
 274         }
 275
 276         ssld_spin_count++;
 277         last_spin = rb_current_time();
 278
 279         if(ssld_path == NULL)
 280         {
 281                 snprintf(fullpath, sizeof(fullpath), "%s%cssld%s", ircd_paths[IRCD_PATH_LIBEXEC], RB_PATH_SEPARATOR, suffix);
 282
 283                 if(access(fullpath, X_OK) == -1)
 284                 {
 285                         snprintf(fullpath, sizeof(fullpath), "%s%cbin%cssld%s",
 286                                     ConfigFileEntry.dpath, RB_PATH_SEPARATOR, RB_PATH_SEPARATOR, suffix);
 287                         if(access(fullpath, X_OK) == -1)
 288                         {
 289                                 ilog(L_MAIN,
 290                                      "Unable to execute ssld%s in %s or %s/bin",
 291                                      suffix, ircd_paths[IRCD_PATH_LIBEXEC], ConfigFileEntry.dpath);
 292                                 return 0;
 293                         }
 294                 }
 295                 ssld_path = rb_strdup(fullpath);
 296         }
 297         rb_strlcpy(buf, "-ircd ssld daemon", sizeof(buf));
 298         parv[0] = buf;
 299         parv[1] = NULL;
 300
 301         for(i = 0; i < count; i++)
 302         {
 303                 ssl_ctl_t *ctl;
 304                 if(rb_socketpair(AF_UNIX, SOCK_DGRAM, 0, &F1, &F2, "SSL/TLS handle passing socket") == -1)
 305                 {
 306                         ilog(L_MAIN, "Unable to create ssld - rb_socketpair failed: %s", strerror(errno));
 307                         return started;
 308                 }
 309
 310                 rb_set_buffers(F1, READBUF_SIZE);
 311                 rb_set_buffers(F2, READBUF_SIZE);
 312                 snprintf(fdarg, sizeof(fdarg), "%d", rb_get_fd(F2));
 313                 rb_setenv("CTL_FD", fdarg, 1);
 314                 if(rb_pipe(&P1, &P2, "SSL/TLS pipe") == -1)
 315                 {
 316                         ilog(L_MAIN, "Unable to create ssld - rb_pipe failed: %s", strerror(errno));
 317                         return started;
 318                 }
 319                 snprintf(fdarg, sizeof(fdarg), "%d", rb_get_fd(P1));
 320                 rb_setenv("CTL_PIPE", fdarg, 1);
 321                 snprintf(s_pid, sizeof(s_pid), "%d", (int)getpid());
 322                 rb_setenv("CTL_PPID", s_pid, 1);
 323 #ifdef _WIN32
 324                 SetHandleInformation((HANDLE) rb_get_fd(F2), HANDLE_FLAG_INHERIT, 1);
 325                 SetHandleInformation((HANDLE) rb_get_fd(P1), HANDLE_FLAG_INHERIT, 1);
 326 #endif
 327
 328                 pid = rb_spawn_process(ssld_path, (const char **) parv);
 329                 if(pid == -1)
 330                 {
 331                         ilog(L_MAIN, "Unable to create ssld: %s\n", strerror(errno));
 332                         rb_close(F1);
 333                         rb_close(F2);
 334                         rb_close(P1);
 335                         rb_close(P2);
 336                         return started;
 337                 }
 338                 started++;
 339                 rb_close(F2);
 340                 rb_close(P1);
 341                 ctl = allocate_ssl_daemon(F1, P2, pid);
 342                 if(ircd_ssl_ok)
 343                 {
 344                         send_init_prng(ctl, RB_PRNG_DEFAULT, NULL);
 345                         send_certfp_method(ctl, ConfigFileEntry.certfp_method);
 346
 347                         if(ssl_cert != NULL && ssl_private_key != NULL)
 348                                 send_new_ssl_certs_one(ctl, ssl_cert, ssl_private_key,
 349                                                        ssl_dh_params != NULL ? ssl_dh_params : "",
 350                                                        ssl_cipher_list != NULL ? ssl_cipher_list : "");
 351                 }
 352                 ssl_read_ctl(ctl->F, ctl);
 353                 ssl_do_pipe(P2, ctl);
 354
 355         }
 356         return started;
 357 }
 358
 359 static void
 360 ssl_process_zipstats(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf)
 361 {
 362         struct Client *server;
 363         struct ZipStats *zips;
 364         char *parv[7];
 365         (void) rb_string_to_array(ctl_buf->buf, parv, 6);
 366         server = find_server(NULL, parv[1]);
 367         if(server == NULL || server->localClient == NULL || !IsCapable(server, CAP_ZIP))
 368                 return;
 369         if(server->localClient->zipstats == NULL)
 370                 server->localClient->zipstats = rb_malloc(sizeof(struct ZipStats));
 371
 372         zips = server->localClient->zipstats;
 373
 374         zips->in += strtoull(parv[2], NULL, 10);
 375         zips->in_wire += strtoull(parv[3], NULL, 10);
 376         zips->out += strtoull(parv[4], NULL, 10);
 377         zips->out_wire += strtoull(parv[5], NULL, 10);
 378
 379         if(zips->in > 0)
 380                 zips->in_ratio = ((double) (zips->in - zips->in_wire) / (double) zips->in) * 100.00;
 381         else
 382                 zips->in_ratio = 0;
 383
 384         if(zips->out > 0)
 385                 zips->out_ratio = ((double) (zips->out - zips->out_wire) / (double) zips->out) * 100.00;
 386         else
 387                 zips->out_ratio = 0;
 388 }
 389
 390 static void
 391 ssl_process_open_fd(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf)
 392 {
 393         struct Client *client_p;
 394         uint32_t fd;
 395
 396         if(ctl_buf->buflen < 5)
 397                 return; /* bogus message..drop it.. XXX should warn here */
 398
 399         fd = buf_to_uint32(&ctl_buf->buf[1]);
 400         client_p = find_cli_connid_hash(fd);
 401         if(client_p == NULL || client_p->localClient == NULL)
 402                 return;
 403
 404         if(client_p->localClient->ssl_callback)
 405         {
 406                 CNCB *hdl = client_p->localClient->ssl_callback;
 407                 void *data = client_p->localClient->ssl_data;
 408
 409                 client_p->localClient->ssl_callback = NULL;
 410                 client_p->localClient->ssl_data = NULL;
 411
 412                 hdl(client_p->localClient->F, RB_OK, data);
 413         }
 414 }
 415
 416 static void
 417 ssl_process_dead_fd(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf)
 418 {
 419         struct Client *client_p;
 420         char reason[256];
 421         uint32_t fd;
 422
 423         if(ctl_buf->buflen < 6)
 424                 return;         /* bogus message..drop it.. XXX should warn here */
 425
 426         fd = buf_to_uint32(&ctl_buf->buf[1]);
 427         rb_strlcpy(reason, &ctl_buf->buf[5], sizeof(reason));
 428         client_p = find_cli_connid_hash(fd);
 429         if(client_p == NULL || client_p->localClient == NULL)
 430                 return;
 431
 432         if(IsAnyServer(client_p))
 433         {
 434                 sendto_realops_snomask(SNO_GENERAL, is_remote_connect(client_p) && !IsServer(client_p) ? L_NETWIDE : L_ALL, "ssld error for %s: %s", client_p->name, reason);
 435                 ilog(L_SERVER, "ssld error for %s: %s", log_client_name(client_p, SHOW_IP), reason);
 436         }
 437
 438         /* if there is still a pending callback, call it now */
 439         if(client_p->localClient->ssl_callback)
 440         {
 441                 CNCB *hdl = client_p->localClient->ssl_callback;
 442                 void *data = client_p->localClient->ssl_data;
 443
 444                 client_p->localClient->ssl_callback = NULL;
 445                 client_p->localClient->ssl_data = NULL;
 446
 447                 hdl(client_p->localClient->F, RB_ERROR_SSL, data);
 448
 449                 /* the callback should have exited the client */
 450                 return;
 451         }
 452
 453         if(IsAnyServer(client_p) || IsRegistered(client_p))
 454         {
 455                 /* read any last moment ERROR, QUIT or the like -- jilles */
 456                 if (!strcmp(reason, "Remote host closed the connection"))
 457                         read_packet(client_p->localClient->F, client_p);
 458                 if (IsAnyDead(client_p))
 459                         return;
 460         }
 461         exit_client(client_p, client_p, &me, reason);
 462 }
 463
 464
 465 static void
 466 ssl_process_cipher_string(ssl_ctl_t *ctl, ssl_ctl_buf_t *ctl_buf)
 467 {
 468         struct Client *client_p;
 469         const char *cstring;
 470         uint32_t fd;
 471
 472         if(ctl_buf->buflen < 6)
 473                 return;         /* bogus message..drop it.. XXX should warn here */
 474
 475         fd = buf_to_uint32(&ctl_buf->buf[1]);
 476         cstring = (const char *)&ctl_buf->buf[5];
 477
 478         if(EmptyString(cstring))
 479                 return;
 480
 481         client_p = find_cli_connid_hash(fd);
 482         if(client_p != NULL && client_p->localClient != NULL)
 483         {
 484                 rb_free(client_p->localClient->cipher_string);
 485                 client_p->localClient->cipher_string = rb_strdup(cstring);
 486         }
 487 }
 488
 489
 490 static void
 491 ssl_process_certfp(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf)
 492 {
 493         struct Client *client_p;
 494         uint32_t fd;
 495         uint32_t len;
 496         uint8_t *certfp;
 497         char *certfp_string;
 498
 499         if(ctl_buf->buflen > 9 + RB_SSL_CERTFP_LEN)
 500                 return;         /* bogus message..drop it.. XXX should warn here */
 501
 502         fd = buf_to_uint32(&ctl_buf->buf[1]);
 503         len = buf_to_uint32(&ctl_buf->buf[5]);
 504         certfp = (uint8_t *)&ctl_buf->buf[9];
 505         client_p = find_cli_connid_hash(fd);
 506         if(client_p == NULL)
 507                 return;
 508         rb_free(client_p->certfp);
 509         certfp_string = rb_malloc(len * 2 + 1);
 510         for(uint32_t i = 0; i < len; i++)
 511                 snprintf(certfp_string + 2 * i, 3, "%02x",
 512                                 certfp[i]);
 513         client_p->certfp = certfp_string;
 514 }
 515
 516 static void
 517 ssl_process_cmd_recv(ssl_ctl_t * ctl)
 518 {
 519         static const char *cannot_setup_ssl = "ssld cannot setup ssl, check your certificates and private key";
 520         static const char *no_ssl_or_zlib = "ssld has neither SSL/TLS or zlib support killing all sslds";
 521         rb_dlink_node *ptr, *next;
 522         ssl_ctl_buf_t *ctl_buf;
 523         unsigned long len;
 524
 525         if(ctl->dead)
 526                 return;
 527
 528         RB_DLINK_FOREACH_SAFE(ptr, next, ctl->readq.head)
 529         {
 530                 ctl_buf = ptr->data;
 531                 switch (*ctl_buf->buf)
 532                 {
 533                 case 'N':
 534                         ircd_ssl_ok = false;    /* ssld says it can't do ssl/tls */
 535                         break;
 536                 case 'O':
 537                         ssl_process_open_fd(ctl, ctl_buf);
 538                         break;
 539                 case 'D':
 540                         ssl_process_dead_fd(ctl, ctl_buf);
 541                         break;
 542                 case 'C':
 543                         ssl_process_cipher_string(ctl, ctl_buf);
 544                         break;
 545                 case 'F':
 546                         ssl_process_certfp(ctl, ctl_buf);
 547                         break;
 548                 case 'S':
 549                         ssl_process_zipstats(ctl, ctl_buf);
 550                         break;
 551                 case 'I':
 552                         ircd_ssl_ok = false;
 553                         ilog(L_MAIN, "%s", cannot_setup_ssl);
 554                         sendto_realops_snomask(SNO_GENERAL, L_ALL, "%s", cannot_setup_ssl);
 555                         break;
 556                 case 'U':
 557                         ircd_zlib_ok = 0;
 558                         ircd_ssl_ok = false;
 559                         ilog(L_MAIN, "%s", no_ssl_or_zlib);
 560                         sendto_realops_snomask(SNO_GENERAL, L_ALL, "%s", no_ssl_or_zlib);
 561                         ssl_killall();
 562                         return;
 563                 case 'V':
 564                         len = ctl_buf->buflen - 1;
 565                         if (len > sizeof(ctl->version) - 1)
 566                                 len = sizeof(ctl->version) - 1;
 567                         strncpy(ctl->version, &ctl_buf->buf[1], len);
 568                 case 'z':
 569                         ircd_zlib_ok = 0;
 570                         break;
 571                 default:
 572                         ilog(L_MAIN, "Received invalid command from ssld: %s", ctl_buf->buf);
 573                         sendto_realops_snomask(SNO_GENERAL, L_ALL, "Received invalid command from ssld");
 574                         break;
 575                 }
 576                 rb_dlinkDelete(ptr, &ctl->readq);
 577                 rb_free(ctl_buf->buf);
 578                 rb_free(ctl_buf);
 579         }
 580
 581 }
 582
 583
 584 static void
 585 ssl_read_ctl(rb_fde_t * F, void *data)
 586 {
 587         ssl_ctl_buf_t *ctl_buf;
 588         ssl_ctl_t *ctl = data;
 589         int retlen;
 590
 591         if(ctl->dead)
 592                 return;
 593         do
 594         {
 595                 ctl_buf = rb_malloc(sizeof(ssl_ctl_buf_t));
 596                 ctl_buf->buf = rb_malloc(READSIZE);
 597                 retlen = rb_recv_fd_buf(ctl->F, ctl_buf->buf, READSIZE, ctl_buf->F, 4);
 598                 ctl_buf->buflen = retlen;
 599                 if(retlen <= 0)
 600                 {
 601                         rb_free(ctl_buf->buf);
 602                         rb_free(ctl_buf);
 603                 }
 604                 else
 605                         rb_dlinkAddTail(ctl_buf, &ctl_buf->node, &ctl->readq);
 606         }
 607         while(retlen > 0);
 608
 609         if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno)))
 610         {
 611                 ssl_dead(ctl);
 612                 return;
 613         }
 614         ssl_process_cmd_recv(ctl);
 615         rb_setselect(ctl->F, RB_SELECT_READ, ssl_read_ctl, ctl);
 616 }
 617
 618 static ssl_ctl_t *
 619 which_ssld(void)
 620 {
 621         ssl_ctl_t *ctl, *lowest = NULL;
 622         rb_dlink_node *ptr;
 623
 624         RB_DLINK_FOREACH(ptr, ssl_daemons.head)
 625         {
 626                 ctl = ptr->data;
 627                 if(ctl->dead)
 628                         continue;
 629                 if(ctl->shutdown)
 630                         continue;
 631                 if(lowest == NULL)
 632                 {
 633                         lowest = ctl;
 634                         continue;
 635                 }
 636                 if(ctl->cli_count < lowest->cli_count)
 637                         lowest = ctl;
 638         }
 639         return (lowest);
 640 }
 641
 642 static void
 643 ssl_write_ctl(rb_fde_t * F, void *data)
 644 {
 645         ssl_ctl_t *ctl = data;
 646         ssl_ctl_buf_t *ctl_buf;
 647         rb_dlink_node *ptr, *next;
 648         int retlen, x;
 649
 650         if(ctl->dead)
 651                 return;
 652
 653         RB_DLINK_FOREACH_SAFE(ptr, next, ctl->writeq.head)
 654         {
 655                 ctl_buf = ptr->data;
 656                 /* in theory unix sock_dgram shouldn't ever short write this.. */
 657                 retlen = rb_send_fd_buf(ctl->F, ctl_buf->F, ctl_buf->nfds, ctl_buf->buf, ctl_buf->buflen, ctl->pid);
 658                 if(retlen > 0)
 659                 {
 660                         rb_dlinkDelete(ptr, &ctl->writeq);
 661                         for(x = 0; x < ctl_buf->nfds; x++)
 662                                 rb_close(ctl_buf->F[x]);
 663                         rb_free(ctl_buf->buf);
 664                         rb_free(ctl_buf);
 665
 666                 }
 667                 if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno)))
 668                 {
 669                         ssl_dead(ctl);
 670                         return;
 671                 }
 672                 else
 673                 {
 674                         rb_setselect(ctl->F, RB_SELECT_WRITE, ssl_write_ctl, ctl);
 675                 }
 676         }
 677 }
 678
 679 static void
 680 ssl_cmd_write_queue(ssl_ctl_t * ctl, rb_fde_t ** F, int count, const void *buf, size_t buflen)
 681 {
 682         ssl_ctl_buf_t *ctl_buf;
 683         int x;
 684
 685         /* don't bother */
 686         if(ctl->dead)
 687                 return;
 688
 689         ctl_buf = rb_malloc(sizeof(ssl_ctl_buf_t));
 690         ctl_buf->buf = rb_malloc(buflen);
 691         memcpy(ctl_buf->buf, buf, buflen);
 692         ctl_buf->buflen = buflen;
 693
 694         for(x = 0; x < count && x < MAXPASSFD; x++)
 695         {
 696                 ctl_buf->F[x] = F[x];
 697         }
 698         ctl_buf->nfds = count;
 699         rb_dlinkAddTail(ctl_buf, &ctl_buf->node, &ctl->writeq);
 700         ssl_write_ctl(ctl->F, ctl);
 701 }
 702
 703
 704 static void
 705 send_new_ssl_certs_one(ssl_ctl_t * ctl, const char *ssl_cert, const char *ssl_private_key, const char *ssl_dh_params, const char *ssl_cipher_list)
 706 {
 707         size_t len;
 708
 709         len = strlen(ssl_cert) + strlen(ssl_private_key) + strlen(ssl_dh_params) + 5;
 710         if(len > sizeof(tmpbuf))
 711         {
 712                 sendto_realops_snomask(SNO_GENERAL, L_ALL,
 713                                        "Parameters for send_new_ssl_certs_one too long (%zu > %zu) to pass to ssld, not sending...",
 714                                        len, sizeof(tmpbuf));
 715                 ilog(L_MAIN,
 716                      "Parameters for send_new_ssl_certs_one too long (%zu > %zu) to pass to ssld, not sending...",
 717                      len, sizeof(tmpbuf));
 718                 return;
 719         }
 720         len = snprintf(tmpbuf, sizeof(tmpbuf), "K%c%s%c%s%c%s%c%s%c", nul, ssl_cert, nul,
 721                           ssl_private_key, nul, ssl_dh_params, nul,
 722                           ssl_cipher_list != NULL ? ssl_cipher_list : "", nul);
 723         ssl_cmd_write_queue(ctl, NULL, 0, tmpbuf, len);
 724 }
 725
 726 static void
 727 send_init_prng(ssl_ctl_t * ctl, prng_seed_t seedtype, const char *path)
 728 {
 729         size_t len;
 730         const char *s;
 731         uint8_t seed = (uint8_t) seedtype;
 732
 733         if(path == NULL)
 734                 s = "";
 735         else
 736                 s = path;
 737
 738         len = strlen(s) + 3;
 739         if(len > sizeof(tmpbuf))
 740         {
 741                 sendto_realops_snomask(SNO_GENERAL, L_ALL,
 742                                        "Parameters for send_init_prng too long (%zd > %zd) to pass to ssld, not sending...",
 743                                        len, sizeof(tmpbuf));
 744                 ilog(L_MAIN,
 745                      "Parameters for send_init_prng too long (%zd > %zd) to pass to ssld, not sending...",
 746                      len, sizeof(tmpbuf));
 747                 return;
 748
 749         }
 750         len = snprintf(tmpbuf, sizeof(tmpbuf), "I%c%s%c", seed, s, nul);
 751         ssl_cmd_write_queue(ctl, NULL, 0, tmpbuf, len);
 752 }
 753
 754 static void
 755 send_certfp_method(ssl_ctl_t *ctl, int method)
 756 {
 757         char buf[5];
 758
 759         buf[0] = 'F';
 760         uint32_to_buf(&buf[1], method);
 761         ssl_cmd_write_queue(ctl, NULL, 0, buf, sizeof(buf));
 762 }
 763
 764 void
 765 send_new_ssl_certs(const char *ssl_cert, const char *ssl_private_key, const char *ssl_dh_params, const char *ssl_cipher_list)
 766 {
 767         rb_dlink_node *ptr;
 768         if(ssl_cert == NULL || ssl_private_key == NULL || ssl_dh_params == NULL)
 769         {
 770                 ircd_ssl_ok = false;
 771                 return;
 772         }
 773         RB_DLINK_FOREACH(ptr, ssl_daemons.head)
 774         {
 775                 ssl_ctl_t *ctl = ptr->data;
 776                 send_new_ssl_certs_one(ctl, ssl_cert, ssl_private_key, ssl_dh_params, ssl_cipher_list);
 777         }
 778 }
 779
 780
 781 ssl_ctl_t *
 782 start_ssld_accept(rb_fde_t * sslF, rb_fde_t * plainF, uint32_t id)
 783 {
 784         rb_fde_t *F[2];
 785         ssl_ctl_t *ctl;
 786         char buf[5];
 787         F[0] = sslF;
 788         F[1] = plainF;
 789
 790         buf[0] = 'A';
 791         uint32_to_buf(&buf[1], id);
 792         ctl = which_ssld();
 793         if(!ctl)
 794                 return NULL;
 795         ctl->cli_count++;
 796         ssl_cmd_write_queue(ctl, F, 2, buf, sizeof(buf));
 797         return ctl;
 798 }
 799
 800 ssl_ctl_t *
 801 start_ssld_connect(rb_fde_t * sslF, rb_fde_t * plainF, uint32_t id)
 802 {
 803         rb_fde_t *F[2];
 804         ssl_ctl_t *ctl;
 805         char buf[5];
 806         F[0] = sslF;
 807         F[1] = plainF;
 808
 809         buf[0] = 'C';
 810         uint32_to_buf(&buf[1], id);
 811
 812         ctl = which_ssld();
 813         if(!ctl)
 814                 return NULL;
 815         ctl->cli_count++;
 816         ssl_cmd_write_queue(ctl, F, 2, buf, sizeof(buf));
 817         return ctl;
 818 }
 819
 820 void
 821 ssld_decrement_clicount(ssl_ctl_t * ctl)
 822 {
 823         if(ctl == NULL)
 824                 return;
 825
 826         ctl->cli_count--;
 827         if(ctl->shutdown && !ctl->cli_count)
 828         {
 829                 ctl->dead = 1;
 830                 rb_kill(ctl->pid, SIGKILL);
 831         }
 832         if(ctl->dead && !ctl->cli_count)
 833         {
 834                 free_ssl_daemon(ctl);
 835         }
 836 }
 837
 838 /*
 839  * what we end up sending to the ssld process for ziplinks is the following
 840  * Z[ourfd][level][RECVQ]
 841  * Z = ziplinks command = buf[0]
 842  * ourfd = Our end of the socketpair = buf[1..4]
 843  * level = zip level buf[5]
 844  * recvqlen = our recvq len = buf[6-7]
 845  * recvq = any data we read prior to starting ziplinks
 846  */
 847 void
 848 start_zlib_session(void *data)
 849 {
 850         struct Client *server = (struct Client *) data;
 851         uint16_t recvqlen;
 852         uint8_t level;
 853         void *xbuf;
 854
 855         rb_fde_t *F[2];
 856         rb_fde_t *xF1, *xF2;
 857         char *buf;
 858         void *recvq_start;
 859
 860         size_t hdr = (sizeof(uint8_t) * 2) + sizeof(uint32_t);
 861         size_t len;
 862         int cpylen, left;
 863
 864         server->localClient->event = NULL;
 865
 866         recvqlen = rb_linebuf_len(&server->localClient->buf_recvq);
 867
 868         len = recvqlen + hdr;
 869
 870         if(len > READBUF_SIZE)
 871         {
 872                 sendto_realops_snomask(SNO_GENERAL, L_ALL,
 873                                        "ssld - attempted to pass message of %zd len, max len %d, giving up",
 874                                        len, READBUF_SIZE);
 875                 ilog(L_MAIN, "ssld - attempted to pass message of %zd len, max len %d, giving up", len, READBUF_SIZE);
 876                 exit_client(server, server, server, "ssld readbuf exceeded");
 877                 return;
 878         }
 879
 880         buf = rb_malloc(len);
 881         level = ConfigFileEntry.compression_level;
 882
 883         uint32_to_buf(&buf[1], rb_get_fd(server->localClient->F));
 884         buf[5] = (char) level;
 885
 886         recvq_start = &buf[6];
 887         server->localClient->zipstats = rb_malloc(sizeof(struct ZipStats));
 888
 889         xbuf = recvq_start;
 890         left = recvqlen;
 891
 892         do
 893         {
 894                 cpylen = rb_linebuf_get(&server->localClient->buf_recvq, xbuf, left, LINEBUF_PARTIAL, LINEBUF_RAW);
 895                 left -= cpylen;
 896                 xbuf = (void *) (((uintptr_t) xbuf) + cpylen);
 897         }
 898         while(cpylen > 0);
 899
 900         /* Pass the socket to ssld. */
 901         *buf = 'Z';
 902         if(rb_socketpair(AF_UNIX, SOCK_STREAM, 0, &xF1, &xF2, "Initial zlib socketpairs") == -1)
 903         {
 904                 sendto_realops_snomask(SNO_GENERAL, L_ALL, "Error creating zlib socketpair - %s", strerror(errno));
 905                 ilog(L_MAIN, "Error creating zlib socketpairs - %s", strerror(errno));
 906                 exit_client(server, server, server, "Error creating zlib socketpair");
 907                 rb_free(buf);
 908                 return;
 909         }
 910
 911         F[0] = server->localClient->F;
 912         F[1] = xF1;
 913         server->localClient->F = xF2;
 914         /* need to redo as what we did before isn't valid now */
 915         uint32_to_buf(&buf[1], connid_get(server));
 916
 917         server->localClient->z_ctl = which_ssld();
 918         if(!server->localClient->z_ctl)
 919         {
 920                 exit_client(server, server, server, "Error finding available ssld");
 921                 rb_free(buf);
 922                 return;
 923         }
 924         server->localClient->z_ctl->cli_count++;
 925         ssl_cmd_write_queue(server->localClient->z_ctl, F, 2, buf, len);
 926         rb_free(buf);
 927 }
 928
 929 static void
 930 collect_zipstats(void *unused)
 931 {
 932         rb_dlink_node *ptr;
 933         struct Client *target_p;
 934         char buf[sizeof(uint8_t) + sizeof(uint32_t) + HOSTLEN];
 935         void *odata;
 936         size_t len;
 937         uint32_t id;
 938
 939         buf[0] = 'S';
 940         odata = buf + sizeof(uint8_t) + sizeof(uint32_t);
 941
 942         RB_DLINK_FOREACH(ptr, serv_list.head)
 943         {
 944                 target_p = ptr->data;
 945                 if(IsCapable(target_p, CAP_ZIP))
 946                 {
 947                         len = sizeof(uint8_t) + sizeof(uint32_t);
 948
 949                         id = rb_get_fd(target_p->localClient->F);
 950                         uint32_to_buf(&buf[1], id);
 951                         rb_strlcpy(odata, target_p->name, (sizeof(buf) - len));
 952                         len += strlen(odata) + 1;       /* Get the \0 as well */
 953                         ssl_cmd_write_queue(target_p->localClient->z_ctl, NULL, 0, buf, len);
 954                 }
 955         }
 956 }
 957
 958 static void
 959 cleanup_dead_ssl(void *unused)
 960 {
 961         rb_dlink_node *ptr, *next;
 962         ssl_ctl_t *ctl;
 963         RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head)
 964         {
 965                 ctl = ptr->data;
 966                 if(ctl->dead && !ctl->cli_count)
 967                 {
 968                         free_ssl_daemon(ctl);
 969                 }
 970         }
 971 }
 972
 973 int
 974 get_ssld_count(void)
 975 {
 976         return ssld_count;
 977 }
 978
 979 void
 980 ssld_foreach_info(void (*func)(void *data, pid_t pid, int cli_count, enum ssld_status status, const char *version), void *data)
 981 {
 982         rb_dlink_node *ptr, *next;
 983         ssl_ctl_t *ctl;
 984         RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head)
 985         {
 986                 ctl = ptr->data;
 987                 func(data, ctl->pid, ctl->cli_count,
 988                         ctl->dead ? SSLD_DEAD :
 989                                 (ctl->shutdown ? SSLD_SHUTDOWN : SSLD_ACTIVE),
 990                         ctl->version);
 991         }
 992 }
 993
 994 void
 995 init_ssld(void)
 996 {
 997         rb_event_addish("collect_zipstats", collect_zipstats, NULL, ZIPSTATS_TIME);
 998         rb_event_addish("cleanup_dead_ssld", cleanup_dead_ssl, NULL, 60);
 999 }