ircd/sslproc.c

   1 /*
   2  *  sslproc.c: An interface to ssld
   3  *  Copyright (C) 2007 Aaron Sethman <androsyn@ratbox.org>
   4  *  Copyright (C) 2007 ircd-ratbox development team
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 2 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, write to the Free Software
  18  *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301
  19  *  USA
  20  */
  21
  22 #include <rb_lib.h>
  23 #include "stdinc.h"
  24
  25
  26 #include "s_conf.h"
  27 #include "logger.h"
  28 #include "listener.h"
  29 #include "sslproc.h"
  30 #include "s_serv.h"
  31 #include "ircd.h"
  32 #include "hash.h"
  33 #include "client.h"
  34 #include "send.h"
  35 #include "packet.h"
  36
  37 #define ZIPSTATS_TIME           60
  38
  39 static void collect_zipstats(void *unused);
  40 static void ssl_read_ctl(rb_fde_t * F, void *data);
  41 static int ssld_count;
  42
  43 static char tmpbuf[READBUF_SIZE];
  44 static char nul = '\0';
  45
  46 #define MAXPASSFD 4
  47 #define READSIZE 1024
  48 typedef struct _ssl_ctl_buf
  49 {
  50         rb_dlink_node node;
  51         char *buf;
  52         size_t buflen;
  53         rb_fde_t *F[MAXPASSFD];
  54         int nfds;
  55 } ssl_ctl_buf_t;
  56
  57
  58 struct _ssl_ctl
  59 {
  60         rb_dlink_node node;
  61         int cli_count;
  62         rb_fde_t *F;
  63         rb_fde_t *P;
  64         pid_t pid;
  65         rb_dlink_list readq;
  66         rb_dlink_list writeq;
  67         uint8_t shutdown;
  68         uint8_t dead;
  69         char version[256];
  70 };
  71
  72 static void send_new_ssl_certs_one(ssl_ctl_t * ctl, const char *ssl_cert,
  73                                    const char *ssl_private_key, const char *ssl_dh_params,
  74                                    const char *ssl_cipher_list);
  75 static void send_certfp_method(ssl_ctl_t *ctl, int method);
  76
  77
  78 static rb_dlink_list ssl_daemons;
  79
  80 static inline uint32_t
  81 buf_to_uint32(char *buf)
  82 {
  83         uint32_t x;
  84         memcpy(&x, buf, sizeof(x));
  85         return x;
  86 }
  87
  88 static inline void
  89 uint32_to_buf(char *buf, uint32_t x)
  90 {
  91         memcpy(buf, &x, sizeof(x));
  92         return;
  93 }
  94
  95 static ssl_ctl_t *
  96 allocate_ssl_daemon(rb_fde_t * F, rb_fde_t * P, int pid)
  97 {
  98         ssl_ctl_t *ctl;
  99
 100         if(F == NULL || pid < 0)
 101                 return NULL;
 102         ctl = rb_malloc(sizeof(ssl_ctl_t));
 103         ctl->F = F;
 104         ctl->P = P;
 105         ctl->pid = pid;
 106         ssld_count++;
 107         rb_dlinkAdd(ctl, &ctl->node, &ssl_daemons);
 108         return ctl;
 109 }
 110
 111 static void
 112 free_ssl_daemon(ssl_ctl_t * ctl)
 113 {
 114         rb_dlink_node *ptr;
 115         ssl_ctl_buf_t *ctl_buf;
 116         int x;
 117         if(ctl->cli_count)
 118                 return;
 119
 120         RB_DLINK_FOREACH(ptr, ctl->readq.head)
 121         {
 122                 ctl_buf = ptr->data;
 123                 for(x = 0; x < ctl_buf->nfds; x++)
 124                         rb_close(ctl_buf->F[x]);
 125
 126                 rb_free(ctl_buf->buf);
 127                 rb_free(ctl_buf);
 128         }
 129
 130         RB_DLINK_FOREACH(ptr, ctl->writeq.head)
 131         {
 132                 ctl_buf = ptr->data;
 133                 for(x = 0; x < ctl_buf->nfds; x++)
 134                         rb_close(ctl_buf->F[x]);
 135
 136                 rb_free(ctl_buf->buf);
 137                 rb_free(ctl_buf);
 138         }
 139         rb_close(ctl->F);
 140         rb_close(ctl->P);
 141         rb_dlinkDelete(&ctl->node, &ssl_daemons);
 142         rb_free(ctl);
 143 }
 144
 145 static char *ssld_path;
 146
 147 static int ssld_spin_count = 0;
 148 static time_t last_spin;
 149 static int ssld_wait = 0;
 150
 151
 152 void
 153 restart_ssld(void)
 154 {
 155         rb_dlink_node *ptr, *next;
 156         ssl_ctl_t *ctl;
 157
 158         RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head)
 159         {
 160                 ctl = ptr->data;
 161                 if(ctl->dead)
 162                         continue;
 163                 if(ctl->shutdown)
 164                         continue;
 165                 ctl->shutdown = 1;
 166                 ssld_count--;
 167                 if(!ctl->cli_count)
 168                 {
 169                         rb_kill(ctl->pid, SIGKILL);
 170                         free_ssl_daemon(ctl);
 171                 }
 172         }
 173
 174         start_ssldaemon(ServerInfo.ssld_count, ServerInfo.ssl_cert, ServerInfo.ssl_private_key, ServerInfo.ssl_dh_params, ServerInfo.ssl_cipher_list);
 175 }
 176
 177 static void
 178 ssl_killall(void)
 179 {
 180         rb_dlink_node *ptr, *next;
 181         ssl_ctl_t *ctl;
 182         RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head)
 183         {
 184                 ctl = ptr->data;
 185                 if(ctl->dead)
 186                         continue;
 187                 ctl->dead = 1;
 188                 if(!ctl->shutdown)
 189                         ssld_count--;
 190                 rb_kill(ctl->pid, SIGKILL);
 191                 if(!ctl->cli_count)
 192                         free_ssl_daemon(ctl);
 193         }
 194 }
 195
 196 static void
 197 ssl_dead(ssl_ctl_t * ctl)
 198 {
 199         if(ctl->dead)
 200                 return;
 201
 202         ctl->dead = 1;
 203         rb_kill(ctl->pid, SIGKILL);     /* make sure the process is really gone */
 204
 205         if(!ctl->shutdown)
 206         {
 207                 ssld_count--;
 208                 ilog(L_MAIN, "ssld helper died - attempting to restart");
 209                 sendto_realops_snomask(SNO_GENERAL, L_ALL, "ssld helper died - attempting to restart");
 210                 start_ssldaemon(1, ServerInfo.ssl_cert, ServerInfo.ssl_private_key, ServerInfo.ssl_dh_params, ServerInfo.ssl_cipher_list);
 211         }
 212 }
 213
 214 static void
 215 ssl_do_pipe(rb_fde_t * F, void *data)
 216 {
 217         int retlen;
 218         ssl_ctl_t *ctl = data;
 219         retlen = rb_write(F, "0", 1);
 220         if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno)))
 221         {
 222                 ssl_dead(ctl);
 223                 return;
 224         }
 225         rb_setselect(F, RB_SELECT_READ, ssl_do_pipe, data);
 226 }
 227
 228 static void
 229 restart_ssld_event(void *unused)
 230 {
 231         ssld_spin_count = 0;
 232         last_spin = 0;
 233         ssld_wait = 0;
 234         if(ServerInfo.ssld_count > get_ssld_count())
 235         {
 236                 int start = ServerInfo.ssld_count - get_ssld_count();
 237                 ilog(L_MAIN, "Attempting to restart ssld processes");
 238                 sendto_realops_snomask(SNO_GENERAL, L_ALL, "Attempt to restart ssld processes");
 239                 start_ssldaemon(start, ServerInfo.ssl_cert, ServerInfo.ssl_private_key, ServerInfo.ssl_dh_params, ServerInfo.ssl_cipher_list);
 240         }
 241 }
 242
 243 int
 244 start_ssldaemon(int count, const char *ssl_cert, const char *ssl_private_key, const char *ssl_dh_params, const char *ssl_cipher_list)
 245 {
 246         rb_fde_t *F1, *F2;
 247         rb_fde_t *P1, *P2;
 248 #ifdef _WIN32
 249         const char *suffix = ".exe";
 250 #else
 251         const char *suffix = "";
 252 #endif
 253
 254         char fullpath[PATH_MAX + 1];
 255         char fdarg[6];
 256         const char *parv[2];
 257         char buf[128];
 258         char s_pid[10];
 259         pid_t pid;
 260         int started = 0, i;
 261
 262         if(ssld_wait)
 263                 return 0;
 264
 265         if(ssld_spin_count > 20 && (rb_current_time() - last_spin < 5))
 266         {
 267                 ilog(L_MAIN, "ssld helper is spinning - will attempt to restart in 1 minute");
 268                 sendto_realops_snomask(SNO_GENERAL, L_ALL,
 269                                        "ssld helper is spinning - will attempt to restart in 1 minute");
 270                 rb_event_add("restart_ssld_event", restart_ssld_event, NULL, 60);
 271                 ssld_wait = 1;
 272                 return 0;
 273         }
 274
 275         ssld_spin_count++;
 276         last_spin = rb_current_time();
 277
 278         if(ssld_path == NULL)
 279         {
 280                 snprintf(fullpath, sizeof(fullpath), "%s%cssld%s", ircd_paths[IRCD_PATH_LIBEXEC], RB_PATH_SEPARATOR, suffix);
 281
 282                 if(access(fullpath, X_OK) == -1)
 283                 {
 284                         snprintf(fullpath, sizeof(fullpath), "%s%cbin%cssld%s",
 285                                     ConfigFileEntry.dpath, RB_PATH_SEPARATOR, RB_PATH_SEPARATOR, suffix);
 286                         if(access(fullpath, X_OK) == -1)
 287                         {
 288                                 ilog(L_MAIN,
 289                                      "Unable to execute ssld%s in %s or %s/bin",
 290                                      suffix, ircd_paths[IRCD_PATH_LIBEXEC], ConfigFileEntry.dpath);
 291                                 return 0;
 292                         }
 293                 }
 294                 ssld_path = rb_strdup(fullpath);
 295         }
 296         rb_strlcpy(buf, "-ircd ssld daemon", sizeof(buf));
 297         parv[0] = buf;
 298         parv[1] = NULL;
 299
 300         for(i = 0; i < count; i++)
 301         {
 302                 ssl_ctl_t *ctl;
 303                 if(rb_socketpair(AF_UNIX, SOCK_DGRAM, 0, &F1, &F2, "SSL/TLS handle passing socket") == -1)
 304                 {
 305                         ilog(L_MAIN, "Unable to create ssld - rb_socketpair failed: %s", strerror(errno));
 306                         return started;
 307                 }
 308
 309                 rb_set_buffers(F1, READBUF_SIZE);
 310                 rb_set_buffers(F2, READBUF_SIZE);
 311                 snprintf(fdarg, sizeof(fdarg), "%d", rb_get_fd(F2));
 312                 rb_setenv("CTL_FD", fdarg, 1);
 313                 if(rb_pipe(&P1, &P2, "SSL/TLS pipe") == -1)
 314                 {
 315                         ilog(L_MAIN, "Unable to create ssld - rb_pipe failed: %s", strerror(errno));
 316                         return started;
 317                 }
 318                 snprintf(fdarg, sizeof(fdarg), "%d", rb_get_fd(P1));
 319                 rb_setenv("CTL_PIPE", fdarg, 1);
 320                 snprintf(s_pid, sizeof(s_pid), "%d", (int)getpid());
 321                 rb_setenv("CTL_PPID", s_pid, 1);
 322 #ifdef _WIN32
 323                 SetHandleInformation((HANDLE) rb_get_fd(F2), HANDLE_FLAG_INHERIT, 1);
 324                 SetHandleInformation((HANDLE) rb_get_fd(P1), HANDLE_FLAG_INHERIT, 1);
 325 #endif
 326
 327                 pid = rb_spawn_process(ssld_path, (const char **) parv);
 328                 if(pid == -1)
 329                 {
 330                         ilog(L_MAIN, "Unable to create ssld: %s\n", strerror(errno));
 331                         rb_close(F1);
 332                         rb_close(F2);
 333                         rb_close(P1);
 334                         rb_close(P2);
 335                         return started;
 336                 }
 337                 started++;
 338                 rb_close(F2);
 339                 rb_close(P1);
 340                 ctl = allocate_ssl_daemon(F1, P2, pid);
 341                 if(ircd_ssl_ok)
 342                 {
 343                         send_certfp_method(ctl, ConfigFileEntry.certfp_method);
 344
 345                         if(ssl_cert != NULL && ssl_private_key != NULL)
 346                                 send_new_ssl_certs_one(ctl, ssl_cert, ssl_private_key,
 347                                                        ssl_dh_params, ssl_cipher_list);
 348                 }
 349                 ssl_read_ctl(ctl->F, ctl);
 350                 ssl_do_pipe(P2, ctl);
 351
 352         }
 353         return started;
 354 }
 355
 356 static void
 357 ssl_process_zipstats(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf)
 358 {
 359         struct Client *server;
 360         struct ZipStats *zips;
 361         char *parv[7];
 362         (void) rb_string_to_array(ctl_buf->buf, parv, 6);
 363         server = find_server(NULL, parv[1]);
 364         if(server == NULL || server->localClient == NULL || !IsCapable(server, CAP_ZIP))
 365                 return;
 366         if(server->localClient->zipstats == NULL)
 367                 server->localClient->zipstats = rb_malloc(sizeof(struct ZipStats));
 368
 369         zips = server->localClient->zipstats;
 370
 371         zips->in += strtoull(parv[2], NULL, 10);
 372         zips->in_wire += strtoull(parv[3], NULL, 10);
 373         zips->out += strtoull(parv[4], NULL, 10);
 374         zips->out_wire += strtoull(parv[5], NULL, 10);
 375
 376         if(zips->in > 0)
 377                 zips->in_ratio = ((double) (zips->in - zips->in_wire) / (double) zips->in) * 100.00;
 378         else
 379                 zips->in_ratio = 0;
 380
 381         if(zips->out > 0)
 382                 zips->out_ratio = ((double) (zips->out - zips->out_wire) / (double) zips->out) * 100.00;
 383         else
 384                 zips->out_ratio = 0;
 385 }
 386
 387 static void
 388 ssl_process_open_fd(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf)
 389 {
 390         struct Client *client_p;
 391         uint32_t fd;
 392
 393         if(ctl_buf->buflen < 5)
 394                 return; /* bogus message..drop it.. XXX should warn here */
 395
 396         fd = buf_to_uint32(&ctl_buf->buf[1]);
 397         client_p = find_cli_connid_hash(fd);
 398         if(client_p == NULL || client_p->localClient == NULL)
 399                 return;
 400
 401         if(client_p->localClient->ssl_callback)
 402         {
 403                 CNCB *hdl = client_p->localClient->ssl_callback;
 404                 void *data = client_p->localClient->ssl_data;
 405
 406                 client_p->localClient->ssl_callback = NULL;
 407                 client_p->localClient->ssl_data = NULL;
 408
 409                 hdl(client_p->localClient->F, RB_OK, data);
 410         }
 411 }
 412
 413 static void
 414 ssl_process_dead_fd(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf)
 415 {
 416         struct Client *client_p;
 417         char reason[256];
 418         uint32_t fd;
 419
 420         if(ctl_buf->buflen < 6)
 421                 return;         /* bogus message..drop it.. XXX should warn here */
 422
 423         fd = buf_to_uint32(&ctl_buf->buf[1]);
 424         rb_strlcpy(reason, &ctl_buf->buf[5], sizeof(reason));
 425         client_p = find_cli_connid_hash(fd);
 426         if(client_p == NULL || client_p->localClient == NULL)
 427                 return;
 428
 429         if(IsAnyServer(client_p))
 430         {
 431                 sendto_realops_snomask(SNO_GENERAL, is_remote_connect(client_p) && !IsServer(client_p) ? L_NETWIDE : L_ALL, "ssld error for %s: %s", client_p->name, reason);
 432                 ilog(L_SERVER, "ssld error for %s: %s", log_client_name(client_p, SHOW_IP), reason);
 433         }
 434
 435         /* if there is still a pending callback, call it now */
 436         if(client_p->localClient->ssl_callback)
 437         {
 438                 CNCB *hdl = client_p->localClient->ssl_callback;
 439                 void *data = client_p->localClient->ssl_data;
 440
 441                 client_p->localClient->ssl_callback = NULL;
 442                 client_p->localClient->ssl_data = NULL;
 443
 444                 hdl(client_p->localClient->F, RB_ERROR_SSL, data);
 445
 446                 /* the callback should have exited the client */
 447                 return;
 448         }
 449
 450         if(IsAnyServer(client_p) || IsRegistered(client_p))
 451         {
 452                 /* read any last moment ERROR, QUIT or the like -- jilles */
 453                 if (!strcmp(reason, "Remote host closed the connection"))
 454                         read_packet(client_p->localClient->F, client_p);
 455                 if (IsAnyDead(client_p))
 456                         return;
 457         }
 458         exit_client(client_p, client_p, &me, reason);
 459 }
 460
 461
 462 static void
 463 ssl_process_cipher_string(ssl_ctl_t *ctl, ssl_ctl_buf_t *ctl_buf)
 464 {
 465         struct Client *client_p;
 466         const char *cstring;
 467         uint32_t fd;
 468
 469         if(ctl_buf->buflen < 6)
 470                 return;         /* bogus message..drop it.. XXX should warn here */
 471
 472         fd = buf_to_uint32(&ctl_buf->buf[1]);
 473         cstring = (const char *)&ctl_buf->buf[5];
 474
 475         if(EmptyString(cstring))
 476                 return;
 477
 478         client_p = find_cli_connid_hash(fd);
 479         if(client_p != NULL && client_p->localClient != NULL)
 480         {
 481                 rb_free(client_p->localClient->cipher_string);
 482                 client_p->localClient->cipher_string = rb_strdup(cstring);
 483         }
 484 }
 485
 486
 487 static void
 488 ssl_process_certfp(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf)
 489 {
 490         struct Client *client_p;
 491         uint32_t fd;
 492         uint32_t len;
 493         uint8_t *certfp;
 494         char *certfp_string;
 495
 496         if(ctl_buf->buflen > 9 + RB_SSL_CERTFP_LEN)
 497                 return;         /* bogus message..drop it.. XXX should warn here */
 498
 499         fd = buf_to_uint32(&ctl_buf->buf[1]);
 500         len = buf_to_uint32(&ctl_buf->buf[5]);
 501         certfp = (uint8_t *)&ctl_buf->buf[9];
 502         client_p = find_cli_connid_hash(fd);
 503         if(client_p == NULL)
 504                 return;
 505         rb_free(client_p->certfp);
 506         certfp_string = rb_malloc(len * 2 + 1);
 507         for(uint32_t i = 0; i < len; i++)
 508                 snprintf(certfp_string + 2 * i, 3, "%02x",
 509                                 certfp[i]);
 510         client_p->certfp = certfp_string;
 511 }
 512
 513 static void
 514 ssl_process_cmd_recv(ssl_ctl_t * ctl)
 515 {
 516         static const char *cannot_setup_ssl = "ssld cannot setup ssl, check your certificates and private key";
 517         static const char *no_ssl_or_zlib = "ssld has neither SSL/TLS or zlib support killing all sslds";
 518         rb_dlink_node *ptr, *next;
 519         ssl_ctl_buf_t *ctl_buf;
 520         unsigned long len;
 521
 522         if(ctl->dead)
 523                 return;
 524
 525         RB_DLINK_FOREACH_SAFE(ptr, next, ctl->readq.head)
 526         {
 527                 ctl_buf = ptr->data;
 528                 switch (*ctl_buf->buf)
 529                 {
 530                 case 'N':
 531                         ircd_ssl_ok = false;    /* ssld says it can't do ssl/tls */
 532                         break;
 533                 case 'O':
 534                         ssl_process_open_fd(ctl, ctl_buf);
 535                         break;
 536                 case 'D':
 537                         ssl_process_dead_fd(ctl, ctl_buf);
 538                         break;
 539                 case 'C':
 540                         ssl_process_cipher_string(ctl, ctl_buf);
 541                         break;
 542                 case 'F':
 543                         ssl_process_certfp(ctl, ctl_buf);
 544                         break;
 545                 case 'S':
 546                         ssl_process_zipstats(ctl, ctl_buf);
 547                         break;
 548                 case 'I':
 549                         ircd_ssl_ok = false;
 550                         ilog(L_MAIN, "%s", cannot_setup_ssl);
 551                         sendto_realops_snomask(SNO_GENERAL, L_ALL, "%s", cannot_setup_ssl);
 552                         break;
 553                 case 'U':
 554                         ircd_zlib_ok = 0;
 555                         ircd_ssl_ok = false;
 556                         ilog(L_MAIN, "%s", no_ssl_or_zlib);
 557                         sendto_realops_snomask(SNO_GENERAL, L_ALL, "%s", no_ssl_or_zlib);
 558                         ssl_killall();
 559                         return;
 560                 case 'V':
 561                         len = ctl_buf->buflen - 1;
 562                         if (len > sizeof(ctl->version) - 1)
 563                                 len = sizeof(ctl->version) - 1;
 564                         strncpy(ctl->version, &ctl_buf->buf[1], len);
 565                 case 'z':
 566                         ircd_zlib_ok = 0;
 567                         break;
 568                 default:
 569                         ilog(L_MAIN, "Received invalid command from ssld: %s", ctl_buf->buf);
 570                         sendto_realops_snomask(SNO_GENERAL, L_ALL, "Received invalid command from ssld");
 571                         break;
 572                 }
 573                 rb_dlinkDelete(ptr, &ctl->readq);
 574                 rb_free(ctl_buf->buf);
 575                 rb_free(ctl_buf);
 576         }
 577
 578 }
 579
 580
 581 static void
 582 ssl_read_ctl(rb_fde_t * F, void *data)
 583 {
 584         ssl_ctl_buf_t *ctl_buf;
 585         ssl_ctl_t *ctl = data;
 586         int retlen;
 587
 588         if(ctl->dead)
 589                 return;
 590         do
 591         {
 592                 ctl_buf = rb_malloc(sizeof(ssl_ctl_buf_t));
 593                 ctl_buf->buf = rb_malloc(READSIZE);
 594                 retlen = rb_recv_fd_buf(ctl->F, ctl_buf->buf, READSIZE, ctl_buf->F, 4);
 595                 ctl_buf->buflen = retlen;
 596                 if(retlen <= 0)
 597                 {
 598                         rb_free(ctl_buf->buf);
 599                         rb_free(ctl_buf);
 600                 }
 601                 else
 602                         rb_dlinkAddTail(ctl_buf, &ctl_buf->node, &ctl->readq);
 603         }
 604         while(retlen > 0);
 605
 606         if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno)))
 607         {
 608                 ssl_dead(ctl);
 609                 return;
 610         }
 611         ssl_process_cmd_recv(ctl);
 612         rb_setselect(ctl->F, RB_SELECT_READ, ssl_read_ctl, ctl);
 613 }
 614
 615 static ssl_ctl_t *
 616 which_ssld(void)
 617 {
 618         ssl_ctl_t *ctl, *lowest = NULL;
 619         rb_dlink_node *ptr;
 620
 621         RB_DLINK_FOREACH(ptr, ssl_daemons.head)
 622         {
 623                 ctl = ptr->data;
 624                 if(ctl->dead)
 625                         continue;
 626                 if(ctl->shutdown)
 627                         continue;
 628                 if(lowest == NULL)
 629                 {
 630                         lowest = ctl;
 631                         continue;
 632                 }
 633                 if(ctl->cli_count < lowest->cli_count)
 634                         lowest = ctl;
 635         }
 636         return (lowest);
 637 }
 638
 639 static void
 640 ssl_write_ctl(rb_fde_t * F, void *data)
 641 {
 642         ssl_ctl_t *ctl = data;
 643         ssl_ctl_buf_t *ctl_buf;
 644         rb_dlink_node *ptr, *next;
 645         int retlen, x;
 646
 647         if(ctl->dead)
 648                 return;
 649
 650         RB_DLINK_FOREACH_SAFE(ptr, next, ctl->writeq.head)
 651         {
 652                 ctl_buf = ptr->data;
 653                 /* in theory unix sock_dgram shouldn't ever short write this.. */
 654                 retlen = rb_send_fd_buf(ctl->F, ctl_buf->F, ctl_buf->nfds, ctl_buf->buf, ctl_buf->buflen, ctl->pid);
 655                 if(retlen > 0)
 656                 {
 657                         rb_dlinkDelete(ptr, &ctl->writeq);
 658                         for(x = 0; x < ctl_buf->nfds; x++)
 659                                 rb_close(ctl_buf->F[x]);
 660                         rb_free(ctl_buf->buf);
 661                         rb_free(ctl_buf);
 662
 663                 }
 664                 if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno)))
 665                 {
 666                         ssl_dead(ctl);
 667                         return;
 668                 }
 669                 else
 670                 {
 671                         rb_setselect(ctl->F, RB_SELECT_WRITE, ssl_write_ctl, ctl);
 672                 }
 673         }
 674 }
 675
 676 static void
 677 ssl_cmd_write_queue(ssl_ctl_t * ctl, rb_fde_t ** F, int count, const void *buf, size_t buflen)
 678 {
 679         ssl_ctl_buf_t *ctl_buf;
 680         int x;
 681
 682         /* don't bother */
 683         if(ctl->dead)
 684                 return;
 685
 686         ctl_buf = rb_malloc(sizeof(ssl_ctl_buf_t));
 687         ctl_buf->buf = rb_malloc(buflen);
 688         memcpy(ctl_buf->buf, buf, buflen);
 689         ctl_buf->buflen = buflen;
 690
 691         for(x = 0; x < count && x < MAXPASSFD; x++)
 692         {
 693                 ctl_buf->F[x] = F[x];
 694         }
 695         ctl_buf->nfds = count;
 696         rb_dlinkAddTail(ctl_buf, &ctl_buf->node, &ctl->writeq);
 697         ssl_write_ctl(ctl->F, ctl);
 698 }
 699
 700
 701 static void
 702 send_new_ssl_certs_one(ssl_ctl_t * ctl, const char *ssl_cert, const char *ssl_private_key, const char *ssl_dh_params, const char *ssl_cipher_list)
 703 {
 704         size_t len;
 705
 706         len = strlen(ssl_cert) + strlen(ssl_private_key) + 5;
 707         if(ssl_dh_params)
 708                 len += strlen(ssl_dh_params);
 709         if(ssl_cipher_list)
 710                 len += strlen(ssl_cipher_list);
 711         if(len > sizeof(tmpbuf))
 712         {
 713                 sendto_realops_snomask(SNO_GENERAL, L_ALL,
 714                                        "Parameters for send_new_ssl_certs_one too long (%zu > %zu) to pass to ssld, not sending...",
 715                                        len, sizeof(tmpbuf));
 716                 ilog(L_MAIN,
 717                      "Parameters for send_new_ssl_certs_one too long (%zu > %zu) to pass to ssld, not sending...",
 718                      len, sizeof(tmpbuf));
 719                 return;
 720         }
 721         len = snprintf(tmpbuf, sizeof(tmpbuf), "K%c%s%c%s%c%s%c%s%c", nul, ssl_cert, nul,
 722                           ssl_private_key, nul, ssl_dh_params != NULL ? ssl_dh_params : "", nul,
 723                           ssl_cipher_list != NULL ? ssl_cipher_list : "", nul);
 724         ssl_cmd_write_queue(ctl, NULL, 0, tmpbuf, len);
 725 }
 726
 727 static void
 728 send_certfp_method(ssl_ctl_t *ctl, int method)
 729 {
 730         char buf[5];
 731
 732         buf[0] = 'F';
 733         uint32_to_buf(&buf[1], method);
 734         ssl_cmd_write_queue(ctl, NULL, 0, buf, sizeof(buf));
 735 }
 736
 737 void
 738 send_new_ssl_certs(const char *ssl_cert, const char *ssl_private_key, const char *ssl_dh_params, const char *ssl_cipher_list)
 739 {
 740         rb_dlink_node *ptr;
 741         if(ssl_cert == NULL || ssl_private_key == NULL || ssl_dh_params == NULL)
 742         {
 743                 ircd_ssl_ok = false;
 744                 return;
 745         }
 746         RB_DLINK_FOREACH(ptr, ssl_daemons.head)
 747         {
 748                 ssl_ctl_t *ctl = ptr->data;
 749                 send_new_ssl_certs_one(ctl, ssl_cert, ssl_private_key, ssl_dh_params, ssl_cipher_list);
 750         }
 751 }
 752
 753
 754 ssl_ctl_t *
 755 start_ssld_accept(rb_fde_t * sslF, rb_fde_t * plainF, uint32_t id)
 756 {
 757         rb_fde_t *F[2];
 758         ssl_ctl_t *ctl;
 759         char buf[5];
 760         F[0] = sslF;
 761         F[1] = plainF;
 762
 763         buf[0] = 'A';
 764         uint32_to_buf(&buf[1], id);
 765         ctl = which_ssld();
 766         if(!ctl)
 767                 return NULL;
 768         ctl->cli_count++;
 769         ssl_cmd_write_queue(ctl, F, 2, buf, sizeof(buf));
 770         return ctl;
 771 }
 772
 773 ssl_ctl_t *
 774 start_ssld_connect(rb_fde_t * sslF, rb_fde_t * plainF, uint32_t id)
 775 {
 776         rb_fde_t *F[2];
 777         ssl_ctl_t *ctl;
 778         char buf[5];
 779         F[0] = sslF;
 780         F[1] = plainF;
 781
 782         buf[0] = 'C';
 783         uint32_to_buf(&buf[1], id);
 784
 785         ctl = which_ssld();
 786         if(!ctl)
 787                 return NULL;
 788         ctl->cli_count++;
 789         ssl_cmd_write_queue(ctl, F, 2, buf, sizeof(buf));
 790         return ctl;
 791 }
 792
 793 void
 794 ssld_decrement_clicount(ssl_ctl_t * ctl)
 795 {
 796         if(ctl == NULL)
 797                 return;
 798
 799         ctl->cli_count--;
 800         if(ctl->shutdown && !ctl->cli_count)
 801         {
 802                 ctl->dead = 1;
 803                 rb_kill(ctl->pid, SIGKILL);
 804         }
 805         if(ctl->dead && !ctl->cli_count)
 806         {
 807                 free_ssl_daemon(ctl);
 808         }
 809 }
 810
 811 /*
 812  * what we end up sending to the ssld process for ziplinks is the following
 813  * Z[ourfd][level][RECVQ]
 814  * Z = ziplinks command = buf[0]
 815  * ourfd = Our end of the socketpair = buf[1..4]
 816  * level = zip level buf[5]
 817  * recvqlen = our recvq len = buf[6-7]
 818  * recvq = any data we read prior to starting ziplinks
 819  */
 820 void
 821 start_zlib_session(void *data)
 822 {
 823         struct Client *server = (struct Client *) data;
 824         uint16_t recvqlen;
 825         uint8_t level;
 826         void *xbuf;
 827
 828         rb_fde_t *F[2];
 829         rb_fde_t *xF1, *xF2;
 830         char *buf;
 831         void *recvq_start;
 832
 833         size_t hdr = (sizeof(uint8_t) * 2) + sizeof(uint32_t);
 834         size_t len;
 835         int cpylen, left;
 836
 837         server->localClient->event = NULL;
 838
 839         recvqlen = rb_linebuf_len(&server->localClient->buf_recvq);
 840
 841         len = recvqlen + hdr;
 842
 843         if(len > READBUF_SIZE)
 844         {
 845                 sendto_realops_snomask(SNO_GENERAL, L_ALL,
 846                                        "ssld - attempted to pass message of %zd len, max len %d, giving up",
 847                                        len, READBUF_SIZE);
 848                 ilog(L_MAIN, "ssld - attempted to pass message of %zd len, max len %d, giving up", len, READBUF_SIZE);
 849                 exit_client(server, server, server, "ssld readbuf exceeded");
 850                 return;
 851         }
 852
 853         buf = rb_malloc(len);
 854         level = ConfigFileEntry.compression_level;
 855
 856         uint32_to_buf(&buf[1], rb_get_fd(server->localClient->F));
 857         buf[5] = (char) level;
 858
 859         recvq_start = &buf[6];
 860         server->localClient->zipstats = rb_malloc(sizeof(struct ZipStats));
 861
 862         xbuf = recvq_start;
 863         left = recvqlen;
 864
 865         do
 866         {
 867                 cpylen = rb_linebuf_get(&server->localClient->buf_recvq, xbuf, left, LINEBUF_PARTIAL, LINEBUF_RAW);
 868                 left -= cpylen;
 869                 xbuf = (void *) (((uintptr_t) xbuf) + cpylen);
 870         }
 871         while(cpylen > 0);
 872
 873         /* Pass the socket to ssld. */
 874         *buf = 'Z';
 875         if(rb_socketpair(AF_UNIX, SOCK_STREAM, 0, &xF1, &xF2, "Initial zlib socketpairs") == -1)
 876         {
 877                 sendto_realops_snomask(SNO_GENERAL, L_ALL, "Error creating zlib socketpair - %s", strerror(errno));
 878                 ilog(L_MAIN, "Error creating zlib socketpairs - %s", strerror(errno));
 879                 exit_client(server, server, server, "Error creating zlib socketpair");
 880                 rb_free(buf);
 881                 return;
 882         }
 883
 884         F[0] = server->localClient->F;
 885         F[1] = xF1;
 886         server->localClient->F = xF2;
 887         /* need to redo as what we did before isn't valid now */
 888         uint32_to_buf(&buf[1], connid_get(server));
 889
 890         server->localClient->z_ctl = which_ssld();
 891         if(!server->localClient->z_ctl)
 892         {
 893                 exit_client(server, server, server, "Error finding available ssld");
 894                 rb_free(buf);
 895                 return;
 896         }
 897         server->localClient->z_ctl->cli_count++;
 898         ssl_cmd_write_queue(server->localClient->z_ctl, F, 2, buf, len);
 899         rb_free(buf);
 900 }
 901
 902 static void
 903 collect_zipstats(void *unused)
 904 {
 905         rb_dlink_node *ptr;
 906         struct Client *target_p;
 907         char buf[sizeof(uint8_t) + sizeof(uint32_t) + HOSTLEN];
 908         void *odata;
 909         size_t len;
 910         uint32_t id;
 911
 912         buf[0] = 'S';
 913         odata = buf + sizeof(uint8_t) + sizeof(uint32_t);
 914
 915         RB_DLINK_FOREACH(ptr, serv_list.head)
 916         {
 917                 target_p = ptr->data;
 918                 if(IsCapable(target_p, CAP_ZIP))
 919                 {
 920                         len = sizeof(uint8_t) + sizeof(uint32_t);
 921
 922                         id = rb_get_fd(target_p->localClient->F);
 923                         uint32_to_buf(&buf[1], id);
 924                         rb_strlcpy(odata, target_p->name, (sizeof(buf) - len));
 925                         len += strlen(odata) + 1;       /* Get the \0 as well */
 926                         ssl_cmd_write_queue(target_p->localClient->z_ctl, NULL, 0, buf, len);
 927                 }
 928         }
 929 }
 930
 931 static void
 932 cleanup_dead_ssl(void *unused)
 933 {
 934         rb_dlink_node *ptr, *next;
 935         ssl_ctl_t *ctl;
 936         RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head)
 937         {
 938                 ctl = ptr->data;
 939                 if(ctl->dead && !ctl->cli_count)
 940                 {
 941                         free_ssl_daemon(ctl);
 942                 }
 943         }
 944 }
 945
 946 int
 947 get_ssld_count(void)
 948 {
 949         return ssld_count;
 950 }
 951
 952 void
 953 ssld_foreach_info(void (*func)(void *data, pid_t pid, int cli_count, enum ssld_status status, const char *version), void *data)
 954 {
 955         rb_dlink_node *ptr, *next;
 956         ssl_ctl_t *ctl;
 957         RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head)
 958         {
 959                 ctl = ptr->data;
 960                 func(data, ctl->pid, ctl->cli_count,
 961                         ctl->dead ? SSLD_DEAD :
 962                                 (ctl->shutdown ? SSLD_SHUTDOWN : SSLD_ACTIVE),
 963                         ctl->version);
 964         }
 965 }
 966
 967 void
 968 init_ssld(void)
 969 {
 970         rb_event_addish("collect_zipstats", collect_zipstats, NULL, ZIPSTATS_TIME);
 971         rb_event_addish("cleanup_dead_ssld", cleanup_dead_ssl, NULL, 60);
 972 }