ircd/sslproc.c

   1 /*
   2  *  sslproc.c: An interface to ssld
   3  *  Copyright (C) 2007 Aaron Sethman <androsyn@ratbox.org>
   4  *  Copyright (C) 2007 ircd-ratbox development team
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 2 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, write to the Free Software
  18  *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301
  19  *  USA
  20  */
  21
  22 #include <rb_lib.h>
  23 #include "stdinc.h"
  24
  25
  26 #include "s_conf.h"
  27 #include "logger.h"
  28 #include "listener.h"
  29 #include "sslproc.h"
  30 #include "s_serv.h"
  31 #include "ircd.h"
  32 #include "hash.h"
  33 #include "client.h"
  34 #include "send.h"
  35 #include "packet.h"
  36 #include "certfp.h"
  37
  38 static void ssl_read_ctl(rb_fde_t * F, void *data);
  39 static int ssld_count;
  40
  41 static char tmpbuf[READBUF_SIZE];
  42 static char nul = '\0';
  43
  44 #define MAXPASSFD 4
  45 #define READSIZE 1024
  46 typedef struct _ssl_ctl_buf
  47 {
  48         rb_dlink_node node;
  49         char *buf;
  50         size_t buflen;
  51         rb_fde_t *F[MAXPASSFD];
  52         int nfds;
  53 } ssl_ctl_buf_t;
  54
  55
  56 struct _ssl_ctl
  57 {
  58         rb_dlink_node node;
  59         int cli_count;
  60         rb_fde_t *F;
  61         rb_fde_t *P;
  62         pid_t pid;
  63         rb_dlink_list readq;
  64         rb_dlink_list writeq;
  65         uint8_t shutdown;
  66         uint8_t dead;
  67         char version[256];
  68 };
  69
  70 static void ssld_update_config_one(ssl_ctl_t *ctl);
  71 static void send_new_ssl_certs_one(ssl_ctl_t * ctl);
  72 static void send_certfp_method(ssl_ctl_t *ctl);
  73
  74
  75 static rb_dlink_list ssl_daemons;
  76
  77 static inline uint32_t
  78 buf_to_uint32(char *buf)
  79 {
  80         uint32_t x;
  81         memcpy(&x, buf, sizeof(x));
  82         return x;
  83 }
  84
  85 static inline void
  86 uint32_to_buf(char *buf, uint32_t x)
  87 {
  88         memcpy(buf, &x, sizeof(x));
  89         return;
  90 }
  91
  92 static ssl_ctl_t *
  93 allocate_ssl_daemon(rb_fde_t * F, rb_fde_t * P, int pid)
  94 {
  95         ssl_ctl_t *ctl;
  96
  97         if(F == NULL || pid < 0)
  98                 return NULL;
  99         ctl = rb_malloc(sizeof(ssl_ctl_t));
 100         ctl->F = F;
 101         ctl->P = P;
 102         ctl->pid = pid;
 103         ssld_count++;
 104         rb_dlinkAdd(ctl, &ctl->node, &ssl_daemons);
 105         return ctl;
 106 }
 107
 108 static void
 109 free_ssl_daemon(ssl_ctl_t * ctl)
 110 {
 111         rb_dlink_node *ptr;
 112         ssl_ctl_buf_t *ctl_buf;
 113         int x;
 114         if(ctl->cli_count)
 115                 return;
 116
 117         RB_DLINK_FOREACH(ptr, ctl->readq.head)
 118         {
 119                 ctl_buf = ptr->data;
 120                 for(x = 0; x < ctl_buf->nfds; x++)
 121                         rb_close(ctl_buf->F[x]);
 122
 123                 rb_free(ctl_buf->buf);
 124                 rb_free(ctl_buf);
 125         }
 126
 127         RB_DLINK_FOREACH(ptr, ctl->writeq.head)
 128         {
 129                 ctl_buf = ptr->data;
 130                 for(x = 0; x < ctl_buf->nfds; x++)
 131                         rb_close(ctl_buf->F[x]);
 132
 133                 rb_free(ctl_buf->buf);
 134                 rb_free(ctl_buf);
 135         }
 136         rb_close(ctl->F);
 137         rb_close(ctl->P);
 138         rb_dlinkDelete(&ctl->node, &ssl_daemons);
 139         rb_free(ctl);
 140 }
 141
 142 static char *ssld_path;
 143
 144 static int ssld_spin_count = 0;
 145 static time_t last_spin;
 146 static int ssld_wait = 0;
 147
 148
 149 void
 150 restart_ssld(void)
 151 {
 152         rb_dlink_node *ptr, *next;
 153         ssl_ctl_t *ctl;
 154
 155         RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head)
 156         {
 157                 ctl = ptr->data;
 158                 if(ctl->dead)
 159                         continue;
 160                 if(ctl->shutdown)
 161                         continue;
 162                 ctl->shutdown = 1;
 163                 ssld_count--;
 164                 if(!ctl->cli_count)
 165                 {
 166                         rb_kill(ctl->pid, SIGKILL);
 167                         free_ssl_daemon(ctl);
 168                 }
 169         }
 170
 171         ssld_spin_count = 0;
 172         last_spin = 0;
 173         ssld_wait = 0;
 174         start_ssldaemon(ServerInfo.ssld_count);
 175 }
 176
 177 static void
 178 ssl_killall(void)
 179 {
 180         rb_dlink_node *ptr, *next;
 181         ssl_ctl_t *ctl;
 182         RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head)
 183         {
 184                 ctl = ptr->data;
 185                 if(ctl->dead)
 186                         continue;
 187                 ctl->dead = 1;
 188                 if(!ctl->shutdown)
 189                         ssld_count--;
 190                 rb_kill(ctl->pid, SIGKILL);
 191                 if(!ctl->cli_count)
 192                         free_ssl_daemon(ctl);
 193         }
 194 }
 195
 196 static void
 197 ssl_dead(ssl_ctl_t * ctl)
 198 {
 199         if(ctl->dead)
 200                 return;
 201
 202         ctl->dead = 1;
 203         rb_kill(ctl->pid, SIGKILL);     /* make sure the process is really gone */
 204
 205         if(!ctl->shutdown)
 206         {
 207                 ssld_count--;
 208                 ilog(L_MAIN, "ssld helper died - attempting to restart");
 209                 sendto_realops_snomask(SNO_GENERAL, L_NETWIDE, "ssld helper died - attempting to restart");
 210                 start_ssldaemon(1);
 211         }
 212 }
 213
 214 static void
 215 ssl_do_pipe(rb_fde_t * F, void *data)
 216 {
 217         int retlen;
 218         ssl_ctl_t *ctl = data;
 219         retlen = rb_write(F, "0", 1);
 220         if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno)))
 221         {
 222                 ssl_dead(ctl);
 223                 return;
 224         }
 225         rb_setselect(F, RB_SELECT_READ, ssl_do_pipe, data);
 226 }
 227
 228 static void
 229 restart_ssld_event(void *unused)
 230 {
 231         ssld_spin_count = 0;
 232         last_spin = 0;
 233         ssld_wait = 0;
 234         if(ServerInfo.ssld_count > get_ssld_count())
 235         {
 236                 int start = ServerInfo.ssld_count - get_ssld_count();
 237                 ilog(L_MAIN, "Attempting to restart ssld processes");
 238                 sendto_realops_snomask(SNO_GENERAL, L_NETWIDE, "Attempt to restart ssld processes");
 239                 start_ssldaemon(start);
 240         }
 241 }
 242
 243 int
 244 start_ssldaemon(int count)
 245 {
 246         rb_fde_t *F1, *F2;
 247         rb_fde_t *P1, *P2;
 248 #ifdef _WIN32
 249         const char *suffix = ".exe";
 250 #else
 251         const char *suffix = "";
 252 #endif
 253
 254         char fullpath[PATH_MAX + 1];
 255         char fdarg[6];
 256         const char *parv[2];
 257         char buf[128];
 258         char s_pid[10];
 259         pid_t pid;
 260         int started = 0, i;
 261
 262         if(ssld_wait)
 263                 return 0;
 264
 265         if(ssld_spin_count > 20 && (rb_current_time() - last_spin < 5))
 266         {
 267                 ilog(L_MAIN, "ssld helper is spinning - will attempt to restart in 1 minute");
 268                 sendto_realops_snomask(SNO_GENERAL, L_NETWIDE,
 269                                        "ssld helper is spinning - will attempt to restart in 1 minute");
 270                 rb_event_add("restart_ssld_event", restart_ssld_event, NULL, 60);
 271                 ssld_wait = 1;
 272                 return 0;
 273         }
 274
 275         ssld_spin_count++;
 276         last_spin = rb_current_time();
 277
 278         if(ssld_path == NULL)
 279         {
 280                 snprintf(fullpath, sizeof(fullpath), "%s%cssld%s", ircd_paths[IRCD_PATH_LIBEXEC], RB_PATH_SEPARATOR, suffix);
 281
 282                 if(access(fullpath, X_OK) == -1)
 283                 {
 284                         snprintf(fullpath, sizeof(fullpath), "%s%cbin%cssld%s",
 285                                     ConfigFileEntry.dpath, RB_PATH_SEPARATOR, RB_PATH_SEPARATOR, suffix);
 286                         if(access(fullpath, X_OK) == -1)
 287                         {
 288                                 ilog(L_MAIN,
 289                                      "Unable to execute ssld%s in %s or %s/bin",
 290                                      suffix, ircd_paths[IRCD_PATH_LIBEXEC], ConfigFileEntry.dpath);
 291                                 return 0;
 292                         }
 293                 }
 294                 ssld_path = rb_strdup(fullpath);
 295         }
 296         rb_strlcpy(buf, "-ircd ssld daemon", sizeof(buf));
 297         parv[0] = buf;
 298         parv[1] = NULL;
 299
 300         for(i = 0; i < count; i++)
 301         {
 302                 ssl_ctl_t *ctl;
 303                 if(rb_socketpair(AF_UNIX, SOCK_DGRAM, 0, &F1, &F2, "SSL/TLS handle passing socket") == -1)
 304                 {
 305                         ilog(L_MAIN, "Unable to create ssld - rb_socketpair failed: %s", strerror(errno));
 306                         return started;
 307                 }
 308
 309                 rb_set_buffers(F1, READBUF_SIZE);
 310                 rb_set_buffers(F2, READBUF_SIZE);
 311                 snprintf(fdarg, sizeof(fdarg), "%d", rb_get_fd(F2));
 312                 rb_setenv("CTL_FD", fdarg, 1);
 313                 if(rb_pipe(&P1, &P2, "SSL/TLS pipe") == -1)
 314                 {
 315                         ilog(L_MAIN, "Unable to create ssld - rb_pipe failed: %s", strerror(errno));
 316                         return started;
 317                 }
 318                 snprintf(fdarg, sizeof(fdarg), "%d", rb_get_fd(P1));
 319                 rb_setenv("CTL_PIPE", fdarg, 1);
 320                 snprintf(s_pid, sizeof(s_pid), "%d", (int)getpid());
 321                 rb_setenv("CTL_PPID", s_pid, 1);
 322
 323                 rb_clear_cloexec(F2);
 324                 rb_clear_cloexec(P1);
 325
 326                 pid = rb_spawn_process(ssld_path, (const char **) parv);
 327                 if(pid == -1)
 328                 {
 329                         ilog(L_MAIN, "Unable to create ssld: %s\n", strerror(errno));
 330                         rb_close(F1);
 331                         rb_close(F2);
 332                         rb_close(P1);
 333                         rb_close(P2);
 334                         return started;
 335                 }
 336                 started++;
 337                 rb_close(F2);
 338                 rb_close(P1);
 339                 ctl = allocate_ssl_daemon(F1, P2, pid);
 340                 if(ircd_ssl_ok)
 341                         ssld_update_config_one(ctl);
 342                 ssl_read_ctl(ctl->F, ctl);
 343                 ssl_do_pipe(P2, ctl);
 344
 345         }
 346         return started;
 347 }
 348
 349 static void
 350 ssl_process_open_fd(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf)
 351 {
 352         struct Client *client_p;
 353         uint32_t fd;
 354
 355         if(ctl_buf->buflen < 5)
 356                 return; /* bogus message..drop it.. XXX should warn here */
 357
 358         fd = buf_to_uint32(&ctl_buf->buf[1]);
 359         client_p = find_cli_connid_hash(fd);
 360         if(client_p == NULL || client_p->localClient == NULL)
 361                 return;
 362
 363         if(client_p->localClient->ssl_callback)
 364         {
 365                 SSL_OPEN_CB *hdl = client_p->localClient->ssl_callback;
 366
 367                 client_p->localClient->ssl_callback = NULL;
 368
 369                 hdl(client_p, RB_OK);
 370         }
 371 }
 372
 373 static void
 374 ssl_process_dead_fd(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf)
 375 {
 376         struct Client *client_p;
 377         char reason[256];
 378         uint32_t fd;
 379
 380         if(ctl_buf->buflen < 6)
 381                 return;         /* bogus message..drop it.. XXX should warn here */
 382
 383         fd = buf_to_uint32(&ctl_buf->buf[1]);
 384         rb_strlcpy(reason, &ctl_buf->buf[5], sizeof(reason));
 385         client_p = find_cli_connid_hash(fd);
 386         if(client_p == NULL || client_p->localClient == NULL)
 387                 return;
 388
 389         if(IsAnyServer(client_p))
 390         {
 391                 sendto_realops_snomask(SNO_GENERAL, L_NETWIDE, "ssld error for %s: %s", client_p->name, reason);
 392                 ilog(L_SERVER, "ssld error for %s: %s", log_client_name(client_p, SHOW_IP), reason);
 393         }
 394
 395         /* if there is still a pending callback, call it now */
 396         if(client_p->localClient->ssl_callback)
 397         {
 398                 SSL_OPEN_CB *hdl = client_p->localClient->ssl_callback;
 399
 400                 client_p->localClient->ssl_callback = NULL;
 401
 402                 if (hdl(client_p, RB_ERROR_SSL))
 403                 {
 404                         /* the callback has exited the client */
 405                         return;
 406                 }
 407         }
 408
 409         if(IsAnyServer(client_p) || IsRegistered(client_p))
 410         {
 411                 /* read any last moment ERROR, QUIT or the like -- jilles */
 412                 if (!strcmp(reason, "Remote host closed the connection"))
 413                         read_packet(client_p->localClient->F, client_p);
 414                 if (IsAnyDead(client_p))
 415                         return;
 416         }
 417         exit_client(client_p, client_p, &me, reason);
 418 }
 419
 420
 421 static void
 422 ssl_process_cipher_string(ssl_ctl_t *ctl, ssl_ctl_buf_t *ctl_buf)
 423 {
 424         struct Client *client_p;
 425         const char *cstring;
 426         uint32_t fd;
 427
 428         if(ctl_buf->buflen < 6)
 429                 return;         /* bogus message..drop it.. XXX should warn here */
 430
 431         fd = buf_to_uint32(&ctl_buf->buf[1]);
 432         cstring = (const char *)&ctl_buf->buf[5];
 433
 434         if(EmptyString(cstring))
 435                 return;
 436
 437         client_p = find_cli_connid_hash(fd);
 438         if(client_p != NULL && client_p->localClient != NULL)
 439         {
 440                 rb_free(client_p->localClient->cipher_string);
 441                 client_p->localClient->cipher_string = rb_strdup(cstring);
 442         }
 443 }
 444
 445
 446 static void
 447 ssl_process_certfp(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf)
 448 {
 449         struct Client *client_p;
 450         uint32_t fd;
 451         uint32_t certfp_method;
 452         uint32_t len;
 453         uint8_t *certfp;
 454         char *certfp_string;
 455         const char *method_string;
 456         int method_len;
 457
 458         if(ctl_buf->buflen > 13 + RB_SSL_CERTFP_LEN)
 459                 return;         /* bogus message..drop it.. XXX should warn here */
 460
 461         fd = buf_to_uint32(&ctl_buf->buf[1]);
 462         certfp_method = buf_to_uint32(&ctl_buf->buf[5]);
 463         len = buf_to_uint32(&ctl_buf->buf[9]);
 464         certfp = (uint8_t *)&ctl_buf->buf[13];
 465         client_p = find_cli_connid_hash(fd);
 466         if(client_p == NULL)
 467                 return;
 468
 469         switch (certfp_method) {
 470         case RB_SSL_CERTFP_METH_CERT_SHA1:
 471                 method_string = CERTFP_PREFIX_CERT_SHA1;
 472                 break;
 473         case RB_SSL_CERTFP_METH_CERT_SHA256:
 474                 method_string = CERTFP_PREFIX_CERT_SHA256;
 475                 break;
 476         case RB_SSL_CERTFP_METH_CERT_SHA512:
 477                 method_string = CERTFP_PREFIX_CERT_SHA512;
 478                 break;
 479         case RB_SSL_CERTFP_METH_SPKI_SHA256:
 480                 method_string = CERTFP_PREFIX_SPKI_SHA256;
 481                 break;
 482         case RB_SSL_CERTFP_METH_SPKI_SHA512:
 483                 method_string = CERTFP_PREFIX_SPKI_SHA512;
 484                 break;
 485         default:
 486                 return;
 487         }
 488         method_len = strlen(method_string);
 489
 490         rb_free(client_p->certfp);
 491         certfp_string = rb_malloc(method_len + len * 2 + 1);
 492         rb_strlcpy(certfp_string, method_string, method_len + len * 2 + 1);
 493         for(uint32_t i = 0; i < len; i++)
 494                 snprintf(certfp_string + method_len + 2 * i, 3, "%02x",
 495                                 certfp[i]);
 496         client_p->certfp = certfp_string;
 497 }
 498
 499 static void
 500 ssl_process_cmd_recv(ssl_ctl_t * ctl)
 501 {
 502         static const char *cannot_setup_ssl = "ssld cannot setup ssl, check your certificates and private key";
 503         static const char *no_ssl_or_zlib = "ssld has neither SSL/TLS or zlib support killing all sslds";
 504         rb_dlink_node *ptr, *next;
 505         ssl_ctl_buf_t *ctl_buf;
 506         unsigned long len;
 507
 508         if(ctl->dead)
 509                 return;
 510
 511         RB_DLINK_FOREACH_SAFE(ptr, next, ctl->readq.head)
 512         {
 513                 ctl_buf = ptr->data;
 514                 switch (*ctl_buf->buf)
 515                 {
 516                 case 'N':
 517                         ircd_ssl_ok = false;    /* ssld says it can't do ssl/tls */
 518                         break;
 519                 case 'O':
 520                         ssl_process_open_fd(ctl, ctl_buf);
 521                         break;
 522                 case 'D':
 523                         ssl_process_dead_fd(ctl, ctl_buf);
 524                         break;
 525                 case 'C':
 526                         ssl_process_cipher_string(ctl, ctl_buf);
 527                         break;
 528                 case 'F':
 529                         ssl_process_certfp(ctl, ctl_buf);
 530                         break;
 531                 case 'I':
 532                         ircd_ssl_ok = false;
 533                         ilog(L_MAIN, "%s", cannot_setup_ssl);
 534                         sendto_realops_snomask(SNO_GENERAL, L_NETWIDE, "%s", cannot_setup_ssl);
 535                         break;
 536                 case 'U':
 537                         ircd_zlib_ok = 0;
 538                         ircd_ssl_ok = false;
 539                         ilog(L_MAIN, "%s", no_ssl_or_zlib);
 540                         sendto_realops_snomask(SNO_GENERAL, L_NETWIDE, "%s", no_ssl_or_zlib);
 541                         ssl_killall();
 542                         return;
 543                 case 'V':
 544                         len = ctl_buf->buflen - 1;
 545                         if (len > sizeof(ctl->version) - 1)
 546                                 len = sizeof(ctl->version) - 1;
 547                         strncpy(ctl->version, &ctl_buf->buf[1], len);
 548                 case 'z':
 549                         ircd_zlib_ok = 0;
 550                         break;
 551                 default:
 552                         ilog(L_MAIN, "Received invalid command from ssld: %s", ctl_buf->buf);
 553                         sendto_realops_snomask(SNO_GENERAL, L_NETWIDE, "Received invalid command from ssld");
 554                         break;
 555                 }
 556                 rb_dlinkDelete(ptr, &ctl->readq);
 557                 rb_free(ctl_buf->buf);
 558                 rb_free(ctl_buf);
 559         }
 560
 561 }
 562
 563
 564 static void
 565 ssl_read_ctl(rb_fde_t * F, void *data)
 566 {
 567         ssl_ctl_buf_t *ctl_buf;
 568         ssl_ctl_t *ctl = data;
 569         int retlen;
 570
 571         if(ctl->dead)
 572                 return;
 573         do
 574         {
 575                 ctl_buf = rb_malloc(sizeof(ssl_ctl_buf_t));
 576                 ctl_buf->buf = rb_malloc(READSIZE);
 577                 retlen = rb_recv_fd_buf(ctl->F, ctl_buf->buf, READSIZE, ctl_buf->F, 4);
 578                 ctl_buf->buflen = retlen;
 579                 if(retlen <= 0)
 580                 {
 581                         rb_free(ctl_buf->buf);
 582                         rb_free(ctl_buf);
 583                 }
 584                 else
 585                         rb_dlinkAddTail(ctl_buf, &ctl_buf->node, &ctl->readq);
 586         }
 587         while(retlen > 0);
 588
 589         if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno)))
 590         {
 591                 ssl_dead(ctl);
 592                 return;
 593         }
 594         ssl_process_cmd_recv(ctl);
 595         rb_setselect(ctl->F, RB_SELECT_READ, ssl_read_ctl, ctl);
 596 }
 597
 598 static ssl_ctl_t *
 599 which_ssld(void)
 600 {
 601         ssl_ctl_t *ctl, *lowest = NULL;
 602         rb_dlink_node *ptr;
 603
 604         RB_DLINK_FOREACH(ptr, ssl_daemons.head)
 605         {
 606                 ctl = ptr->data;
 607                 if(ctl->dead)
 608                         continue;
 609                 if(ctl->shutdown)
 610                         continue;
 611                 if(lowest == NULL)
 612                 {
 613                         lowest = ctl;
 614                         continue;
 615                 }
 616                 if(ctl->cli_count < lowest->cli_count)
 617                         lowest = ctl;
 618         }
 619         return (lowest);
 620 }
 621
 622 static void
 623 ssl_write_ctl(rb_fde_t * F, void *data)
 624 {
 625         ssl_ctl_t *ctl = data;
 626         ssl_ctl_buf_t *ctl_buf;
 627         rb_dlink_node *ptr, *next;
 628         int retlen, x;
 629
 630         if(ctl->dead)
 631                 return;
 632
 633         RB_DLINK_FOREACH_SAFE(ptr, next, ctl->writeq.head)
 634         {
 635                 ctl_buf = ptr->data;
 636                 /* in theory unix sock_dgram shouldn't ever short write this.. */
 637                 retlen = rb_send_fd_buf(ctl->F, ctl_buf->F, ctl_buf->nfds, ctl_buf->buf, ctl_buf->buflen, ctl->pid);
 638                 if(retlen > 0)
 639                 {
 640                         rb_dlinkDelete(ptr, &ctl->writeq);
 641                         for(x = 0; x < ctl_buf->nfds; x++)
 642                                 rb_close(ctl_buf->F[x]);
 643                         rb_free(ctl_buf->buf);
 644                         rb_free(ctl_buf);
 645
 646                 }
 647                 if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno)))
 648                 {
 649                         ssl_dead(ctl);
 650                         return;
 651                 }
 652                 else
 653                 {
 654                         rb_setselect(ctl->F, RB_SELECT_WRITE, ssl_write_ctl, ctl);
 655                 }
 656         }
 657 }
 658
 659 static void
 660 ssl_cmd_write_queue(ssl_ctl_t * ctl, rb_fde_t ** F, int count, const void *buf, size_t buflen)
 661 {
 662         ssl_ctl_buf_t *ctl_buf;
 663         int x;
 664
 665         /* don't bother */
 666         if(ctl->dead)
 667                 return;
 668
 669         ctl_buf = rb_malloc(sizeof(ssl_ctl_buf_t));
 670         ctl_buf->buf = rb_malloc(buflen);
 671         memcpy(ctl_buf->buf, buf, buflen);
 672         ctl_buf->buflen = buflen;
 673
 674         for(x = 0; x < count && x < MAXPASSFD; x++)
 675         {
 676                 ctl_buf->F[x] = F[x];
 677         }
 678         ctl_buf->nfds = count;
 679         rb_dlinkAddTail(ctl_buf, &ctl_buf->node, &ctl->writeq);
 680         ssl_write_ctl(ctl->F, ctl);
 681 }
 682
 683
 684 static void
 685 send_new_ssl_certs_one(ssl_ctl_t * ctl)
 686 {
 687         size_t len = 5;
 688
 689         if(ServerInfo.ssl_cert)
 690                 len += strlen(ServerInfo.ssl_cert);
 691         else
 692                 return;
 693
 694         if(ServerInfo.ssl_private_key)
 695                 len += strlen(ServerInfo.ssl_private_key);
 696
 697         if(ServerInfo.ssl_dh_params)
 698                 len += strlen(ServerInfo.ssl_dh_params);
 699
 700         if(ServerInfo.ssl_cipher_list)
 701                 len += strlen(ServerInfo.ssl_cipher_list);
 702
 703         if(len > sizeof(tmpbuf))
 704         {
 705                 sendto_realops_snomask(SNO_GENERAL, L_NETWIDE,
 706                                        "Parameters for send_new_ssl_certs_one too long (%zu > %zu) to pass to ssld, not sending...",
 707                                        len, sizeof(tmpbuf));
 708                 ilog(L_MAIN,
 709                      "Parameters for send_new_ssl_certs_one too long (%zu > %zu) to pass to ssld, not sending...",
 710                      len, sizeof(tmpbuf));
 711                 return;
 712         }
 713
 714         int ret = snprintf(tmpbuf, sizeof(tmpbuf), "K%c%s%c%s%c%s%c%s%c", nul,
 715                            ServerInfo.ssl_cert, nul,
 716                            ServerInfo.ssl_private_key != NULL ? ServerInfo.ssl_private_key : "", nul,
 717                            ServerInfo.ssl_dh_params != NULL ? ServerInfo.ssl_dh_params : "", nul,
 718                            ServerInfo.ssl_cipher_list != NULL ? ServerInfo.ssl_cipher_list : "", nul);
 719
 720         if(ret > 5)
 721                 ssl_cmd_write_queue(ctl, NULL, 0, tmpbuf, (size_t) ret);
 722 }
 723
 724 static void
 725 send_certfp_method(ssl_ctl_t *ctl)
 726 {
 727         char buf[5];
 728
 729         buf[0] = 'F';
 730         uint32_to_buf(&buf[1], ConfigFileEntry.certfp_method);
 731         ssl_cmd_write_queue(ctl, NULL, 0, buf, sizeof(buf));
 732 }
 733
 734 static void
 735 ssld_update_config_one(ssl_ctl_t *ctl)
 736 {
 737         send_certfp_method(ctl);
 738         send_new_ssl_certs_one(ctl);
 739 }
 740
 741 void
 742 ssld_update_config(void)
 743 {
 744         rb_dlink_node *ptr;
 745
 746         RB_DLINK_FOREACH(ptr, ssl_daemons.head)
 747         {
 748                 ssl_ctl_t *ctl = ptr->data;
 749
 750                 if (ctl->dead || ctl->shutdown)
 751                         continue;
 752
 753                 ssld_update_config_one(ctl);
 754         }
 755 }
 756
 757 ssl_ctl_t *
 758 start_ssld_accept(rb_fde_t * sslF, rb_fde_t * plainF, uint32_t id)
 759 {
 760         rb_fde_t *F[2];
 761         ssl_ctl_t *ctl;
 762         char buf[5];
 763         F[0] = sslF;
 764         F[1] = plainF;
 765
 766         buf[0] = 'A';
 767         uint32_to_buf(&buf[1], id);
 768         ctl = which_ssld();
 769         if(!ctl)
 770                 return NULL;
 771         ctl->cli_count++;
 772         ssl_cmd_write_queue(ctl, F, 2, buf, sizeof(buf));
 773         return ctl;
 774 }
 775
 776 ssl_ctl_t *
 777 start_ssld_connect(rb_fde_t * sslF, rb_fde_t * plainF, uint32_t id)
 778 {
 779         rb_fde_t *F[2];
 780         ssl_ctl_t *ctl;
 781         char buf[5];
 782         F[0] = sslF;
 783         F[1] = plainF;
 784
 785         buf[0] = 'C';
 786         uint32_to_buf(&buf[1], id);
 787
 788         ctl = which_ssld();
 789         if(!ctl)
 790                 return NULL;
 791         ctl->cli_count++;
 792         ssl_cmd_write_queue(ctl, F, 2, buf, sizeof(buf));
 793         return ctl;
 794 }
 795
 796 void
 797 ssld_decrement_clicount(ssl_ctl_t * ctl)
 798 {
 799         if(ctl == NULL)
 800                 return;
 801
 802         ctl->cli_count--;
 803         if(ctl->shutdown && !ctl->cli_count)
 804         {
 805                 ctl->dead = 1;
 806                 rb_kill(ctl->pid, SIGKILL);
 807         }
 808         if(ctl->dead && !ctl->cli_count)
 809         {
 810                 free_ssl_daemon(ctl);
 811         }
 812 }
 813
 814 static void
 815 cleanup_dead_ssl(void *unused)
 816 {
 817         rb_dlink_node *ptr, *next;
 818         ssl_ctl_t *ctl;
 819         RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head)
 820         {
 821                 ctl = ptr->data;
 822                 if(ctl->dead && !ctl->cli_count)
 823                 {
 824                         free_ssl_daemon(ctl);
 825                 }
 826         }
 827 }
 828
 829 int
 830 get_ssld_count(void)
 831 {
 832         return ssld_count;
 833 }
 834
 835 void
 836 ssld_foreach_info(void (*func)(void *data, pid_t pid, int cli_count, enum ssld_status status, const char *version), void *data)
 837 {
 838         rb_dlink_node *ptr, *next;
 839         ssl_ctl_t *ctl;
 840         RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head)
 841         {
 842                 ctl = ptr->data;
 843                 func(data, ctl->pid, ctl->cli_count,
 844                         ctl->dead ? SSLD_DEAD :
 845                                 (ctl->shutdown ? SSLD_SHUTDOWN : SSLD_ACTIVE),
 846                         ctl->version);
 847         }
 848 }
 849
 850 void
 851 init_ssld(void)
 852 {
 853         rb_event_addish("cleanup_dead_ssld", cleanup_dead_ssl, NULL, 60);
 854 }