2 * charybdis: an advanced ircd
3 * gnutls.c: GnuTLS support functions.
5 * Copyright (c) 2008 William Pitcock <nenolod -at- sacredspiral.co.uk>
7 * Permission to use, copy, modify, and/or distribute this software for any
8 * purpose with or without fee is hereby granted, provided that the above
9 * copyright notice and this permission notice is present in all copies.
11 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
12 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
13 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
14 * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
15 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
16 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
17 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
18 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
19 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
20 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
21 * POSSIBILITY OF SUCH DAMAGE.
28 #include <gnutls/gnutls.h>
29 #include <gcrypt.h> /* for gcry_control */
33 static gnutls_certificate_credentials_t x509_cred
;
34 static gnutls_priority_t priority_cache
;
35 static gnutls_dh_params_t dh_params
;
40 /* force use of /dev/urandom. */
41 gcry_control(GCRYCTL_ENABLE_QUICK_RANDOM
, 0);
45 gnutls_certificate_allocate_credentials(&x509_cred
);
46 gnutls_certificate_set_x509_trust_file(x509_cred
, ETCPATH
"/ca.pem", GNUTLS_X509_FMT_PEM
);
47 gnutls_certificate_set_x509_crl_file(x509_cred
, ETCPATH
"/crl.pem", GNUTLS_X509_FMT_PEM
);
48 gnutls_certificate_set_x509_key_file(x509_cred
, ETCPATH
"/cert.pem", ETCPATH
"/key.pem", GNUTLS_X509_FMT_PEM
);
50 gnutls_dh_params_init(&dh_params
);
51 gnutls_dh_params_generate2(dh_params
, DH_BITS
);
53 gnutls_priority_init(&priority_cache
, "NORMAL", NULL
);
55 gnutls_certificate_set_dh_params(x509_cred
, dh_params
);
59 * allocates a new TLS session.
62 irc_tls_session_new(int fd
)
64 gnutls_session_t session
;
66 gnutls_init(&session
, GNUTLS_SERVER
);
67 gnutls_priority_set(session
, priority_cache
);
68 gnutls_credentials_set(session
, GNUTLS_CRD_CERTIFICATE
, x509_cred
);
70 /* request client certificate if any. */
71 gnutls_certificate_server_set_request(session
, GNUTLS_CERT_REQUEST
);
73 gnutls_session_enable_compatibility_mode(session
);
74 gnutls_transport_set_ptr(session
, (void *) sd
);
80 * helper function to handshake or remove the socket from commio.
83 irc_tls_handshake(int fd
, gnutls_session_t session
)
87 ret
= gnutls_handshake(session
);
91 gnutls_deinit(session
);