ircd/sslproc.c

   1 /*
   2  *  sslproc.c: An interface to ssld
   3  *  Copyright (C) 2007 Aaron Sethman <androsyn@ratbox.org>
   4  *  Copyright (C) 2007 ircd-ratbox development team
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 2 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, write to the Free Software
  18  *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301
  19  *  USA
  20  *
  21  *  $Id$
  22  */
  23
  24 #include <ratbox_lib.h>
  25 #include "stdinc.h"
  26
  27
  28 #include "s_conf.h"
  29 #include "logger.h"
  30 #include "listener.h"
  31 #include "sslproc.h"
  32 #include "s_serv.h"
  33 #include "ircd.h"
  34 #include "hash.h"
  35 #include "client.h"
  36 #include "send.h"
  37 #include "packet.h"
  38
  39 #define ZIPSTATS_TIME           60
  40
  41 static void collect_zipstats(void *unused);
  42 static void ssl_read_ctl(rb_fde_t * F, void *data);
  43 static int ssld_count;
  44
  45 static char tmpbuf[READBUF_SIZE];
  46 static char nul = '\0';
  47
  48 #define MAXPASSFD 4
  49 #define READSIZE 1024
  50 typedef struct _ssl_ctl_buf
  51 {
  52         rb_dlink_node node;
  53         char *buf;
  54         size_t buflen;
  55         rb_fde_t *F[MAXPASSFD];
  56         int nfds;
  57 } ssl_ctl_buf_t;
  58
  59
  60 struct _ssl_ctl
  61 {
  62         rb_dlink_node node;
  63         int cli_count;
  64         rb_fde_t *F;
  65         rb_fde_t *P;
  66         pid_t pid;
  67         rb_dlink_list readq;
  68         rb_dlink_list writeq;
  69         uint8_t dead;
  70 };
  71
  72 static void send_new_ssl_certs_one(ssl_ctl_t * ctl, const char *ssl_cert,
  73                                    const char *ssl_private_key, const char *ssl_dh_params,
  74                                    const char *ssl_cipher_list);
  75 static void send_init_prng(ssl_ctl_t * ctl, prng_seed_t seedtype, const char *path);
  76 static void send_certfp_method(ssl_ctl_t *ctl, int method);
  77
  78
  79 static rb_dlink_list ssl_daemons;
  80
  81 static inline uint32_t
  82 buf_to_uint32(char *buf)
  83 {
  84         uint32_t x;
  85         memcpy(&x, buf, sizeof(x));
  86         return x;
  87 }
  88
  89 static inline void
  90 uint32_to_buf(char *buf, uint32_t x)
  91 {
  92         memcpy(buf, &x, sizeof(x));
  93         return;
  94 }
  95
  96 static ssl_ctl_t *
  97 allocate_ssl_daemon(rb_fde_t * F, rb_fde_t * P, int pid)
  98 {
  99         ssl_ctl_t *ctl;
 100
 101         if(F == NULL || pid < 0)
 102                 return NULL;
 103         ctl = rb_malloc(sizeof(ssl_ctl_t));
 104         ctl->F = F;
 105         ctl->P = P;
 106         ctl->pid = pid;
 107         ssld_count++;
 108         rb_dlinkAdd(ctl, &ctl->node, &ssl_daemons);
 109         return ctl;
 110 }
 111
 112 static void
 113 free_ssl_daemon(ssl_ctl_t * ctl)
 114 {
 115         rb_dlink_node *ptr;
 116         ssl_ctl_buf_t *ctl_buf;
 117         int x;
 118         if(ctl->cli_count)
 119                 return;
 120
 121         RB_DLINK_FOREACH(ptr, ctl->readq.head)
 122         {
 123                 ctl_buf = ptr->data;
 124                 for(x = 0; x < ctl_buf->nfds; x++)
 125                         rb_close(ctl_buf->F[x]);
 126
 127                 rb_free(ctl_buf->buf);
 128                 rb_free(ctl_buf);
 129         }
 130
 131         RB_DLINK_FOREACH(ptr, ctl->writeq.head)
 132         {
 133                 ctl_buf = ptr->data;
 134                 for(x = 0; x < ctl_buf->nfds; x++)
 135                         rb_close(ctl_buf->F[x]);
 136
 137                 rb_free(ctl_buf->buf);
 138                 rb_free(ctl_buf);
 139         }
 140         rb_close(ctl->F);
 141         rb_close(ctl->P);
 142         rb_dlinkDelete(&ctl->node, &ssl_daemons);
 143         rb_free(ctl);
 144 }
 145
 146 static char *ssld_path;
 147
 148 static int ssld_spin_count = 0;
 149 static time_t last_spin;
 150 static int ssld_wait = 0;
 151
 152
 153 static void
 154 ssl_killall(void)
 155 {
 156         rb_dlink_node *ptr, *next;
 157         ssl_ctl_t *ctl;
 158         RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head)
 159         {
 160                 ctl = ptr->data;
 161                 if(ctl->dead)
 162                         continue;
 163                 ctl->dead = 1;
 164                 ssld_count--;
 165                 rb_kill(ctl->pid, SIGKILL);
 166         }
 167 }
 168
 169 static void
 170 ssl_dead(ssl_ctl_t * ctl)
 171 {
 172         if(ctl->dead)
 173                 return;
 174
 175         ctl->dead = 1;
 176         ssld_count--;
 177         rb_kill(ctl->pid, SIGKILL);     /* make sure the process is really gone */
 178         ilog(L_MAIN, "ssld helper died - attempting to restart");
 179         sendto_realops_snomask(SNO_GENERAL, L_ALL, "ssld helper died - attempting to restart");
 180         start_ssldaemon(1, ServerInfo.ssl_cert, ServerInfo.ssl_private_key, ServerInfo.ssl_dh_params, ServerInfo.ssl_cipher_list);
 181 }
 182
 183 static void
 184 ssl_do_pipe(rb_fde_t * F, void *data)
 185 {
 186         int retlen;
 187         ssl_ctl_t *ctl = data;
 188         retlen = rb_write(F, "0", 1);
 189         if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno)))
 190         {
 191                 ssl_dead(ctl);
 192                 return;
 193         }
 194         rb_setselect(F, RB_SELECT_READ, ssl_do_pipe, data);
 195 }
 196
 197 static void
 198 restart_ssld_event(void *unused)
 199 {
 200         ssld_spin_count = 0;
 201         last_spin = 0;
 202         ssld_wait = 0;
 203         if(ServerInfo.ssld_count > get_ssld_count())
 204         {
 205                 int start = ServerInfo.ssld_count - get_ssld_count();
 206                 ilog(L_MAIN, "Attempting to restart ssld processes");
 207                 sendto_realops_snomask(SNO_GENERAL, L_ALL, "Attempt to restart ssld processes");
 208                 start_ssldaemon(start, ServerInfo.ssl_cert, ServerInfo.ssl_private_key, ServerInfo.ssl_dh_params, ServerInfo.ssl_cipher_list);
 209         }
 210 }
 211
 212 int
 213 start_ssldaemon(int count, const char *ssl_cert, const char *ssl_private_key, const char *ssl_dh_params, const char *ssl_cipher_list)
 214 {
 215         rb_fde_t *F1, *F2;
 216         rb_fde_t *P1, *P2;
 217 #ifdef _WIN32
 218         const char *suffix = ".exe";
 219 #else
 220         const char *suffix = "";
 221 #endif
 222
 223         char fullpath[PATH_MAX + 1];
 224         char fdarg[6];
 225         const char *parv[2];
 226         char buf[128];
 227         char s_pid[10];
 228         pid_t pid;
 229         int started = 0, i;
 230
 231         if(ssld_wait)
 232                 return 0;
 233
 234         if(ssld_spin_count > 20 && (rb_current_time() - last_spin < 5))
 235         {
 236                 ilog(L_MAIN, "ssld helper is spinning - will attempt to restart in 1 minute");
 237                 sendto_realops_snomask(SNO_GENERAL, L_ALL,
 238                                        "ssld helper is spinning - will attempt to restart in 1 minute");
 239                 rb_event_add("restart_ssld_event", restart_ssld_event, NULL, 60);
 240                 ssld_wait = 1;
 241                 return 0;
 242         }
 243
 244         ssld_spin_count++;
 245         last_spin = rb_current_time();
 246
 247         if(ssld_path == NULL)
 248         {
 249                 rb_snprintf(fullpath, sizeof(fullpath), "%s/ssld%s", PKGLIBEXECDIR, suffix);
 250
 251                 if(access(fullpath, X_OK) == -1)
 252                 {
 253                         rb_snprintf(fullpath, sizeof(fullpath), "%s/bin/ssld%s",
 254                                     ConfigFileEntry.dpath, suffix);
 255                         if(access(fullpath, X_OK) == -1)
 256                         {
 257                                 ilog(L_MAIN,
 258                                      "Unable to execute ssld%s in %s or %s/bin",
 259                                      suffix, PKGLIBEXECDIR, ConfigFileEntry.dpath);
 260                                 return 0;
 261                         }
 262                 }
 263                 ssld_path = rb_strdup(fullpath);
 264         }
 265         rb_strlcpy(buf, "-ircd ssld daemon", sizeof(buf));
 266         parv[0] = buf;
 267         parv[1] = NULL;
 268
 269         for(i = 0; i < count; i++)
 270         {
 271                 ssl_ctl_t *ctl;
 272                 if(rb_socketpair(AF_UNIX, SOCK_DGRAM, 0, &F1, &F2, "SSL/TLS handle passing socket") == -1)
 273                 {
 274                         ilog(L_MAIN, "Unable to create ssld - rb_socketpair failed: %s", strerror(errno));
 275                         return started;
 276                 }
 277
 278                 rb_set_buffers(F1, READBUF_SIZE);
 279                 rb_set_buffers(F2, READBUF_SIZE);
 280                 rb_snprintf(fdarg, sizeof(fdarg), "%d", rb_get_fd(F2));
 281                 rb_setenv("CTL_FD", fdarg, 1);
 282                 if(rb_pipe(&P1, &P2, "SSL/TLS pipe") == -1)
 283                 {
 284                         ilog(L_MAIN, "Unable to create ssld - rb_pipe failed: %s", strerror(errno));
 285                         return started;
 286                 }
 287                 rb_snprintf(fdarg, sizeof(fdarg), "%d", rb_get_fd(P1));
 288                 rb_setenv("CTL_PIPE", fdarg, 1);
 289                 rb_snprintf(s_pid, sizeof(s_pid), "%d", (int)getpid());
 290                 rb_setenv("CTL_PPID", s_pid, 1);
 291 #ifdef _WIN32
 292                 SetHandleInformation((HANDLE) rb_get_fd(F2), HANDLE_FLAG_INHERIT, 1);
 293                 SetHandleInformation((HANDLE) rb_get_fd(P1), HANDLE_FLAG_INHERIT, 1);
 294 #endif
 295
 296                 pid = rb_spawn_process(ssld_path, (const char **) parv);
 297                 if(pid == -1)
 298                 {
 299                         ilog(L_MAIN, "Unable to create ssld: %s\n", strerror(errno));
 300                         rb_close(F1);
 301                         rb_close(F2);
 302                         rb_close(P1);
 303                         rb_close(P2);
 304                         return started;
 305                 }
 306                 started++;
 307                 rb_close(F2);
 308                 rb_close(P1);
 309                 ctl = allocate_ssl_daemon(F1, P2, pid);
 310                 if(ssl_ok)
 311                 {
 312                         send_init_prng(ctl, RB_PRNG_DEFAULT, NULL);
 313                         send_certfp_method(ctl, ConfigFileEntry.certfp_method);
 314
 315                         if(ssl_cert != NULL && ssl_private_key != NULL)
 316                                 send_new_ssl_certs_one(ctl, ssl_cert, ssl_private_key,
 317                                                        ssl_dh_params != NULL ? ssl_dh_params : "",
 318                                                        ssl_cipher_list != NULL ? ssl_cipher_list : "");
 319                 }
 320                 ssl_read_ctl(ctl->F, ctl);
 321                 ssl_do_pipe(P2, ctl);
 322
 323         }
 324         return started;
 325 }
 326
 327 static void
 328 ssl_process_zipstats(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf)
 329 {
 330         struct Client *server;
 331         struct ZipStats *zips;
 332         char *parv[7];
 333         (void) rb_string_to_array(ctl_buf->buf, parv, 6);
 334         server = find_server(NULL, parv[1]);
 335         if(server == NULL || server->localClient == NULL || !IsCapable(server, CAP_ZIP))
 336                 return;
 337         if(server->localClient->zipstats == NULL)
 338                 server->localClient->zipstats = rb_malloc(sizeof(struct ZipStats));
 339
 340         zips = server->localClient->zipstats;
 341
 342         zips->in += strtoull(parv[2], NULL, 10);
 343         zips->in_wire += strtoull(parv[3], NULL, 10);
 344         zips->out += strtoull(parv[4], NULL, 10);
 345         zips->out_wire += strtoull(parv[5], NULL, 10);
 346
 347         if(zips->in > 0)
 348                 zips->in_ratio = ((double) (zips->in - zips->in_wire) / (double) zips->in) * 100.00;
 349         else
 350                 zips->in_ratio = 0;
 351
 352         if(zips->out > 0)
 353                 zips->out_ratio = ((double) (zips->out - zips->out_wire) / (double) zips->out) * 100.00;
 354         else
 355                 zips->out_ratio = 0;
 356 }
 357
 358 static void
 359 ssl_process_dead_fd(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf)
 360 {
 361         struct Client *client_p;
 362         char reason[256];
 363         uint32_t fd;
 364
 365         if(ctl_buf->buflen < 6)
 366                 return;         /* bogus message..drop it.. XXX should warn here */
 367
 368         fd = buf_to_uint32(&ctl_buf->buf[1]);
 369         rb_strlcpy(reason, &ctl_buf->buf[5], sizeof(reason));
 370         client_p = find_cli_connid_hash(fd);
 371         if(client_p == NULL)
 372                 return;
 373         if(IsAnyServer(client_p) || IsRegistered(client_p))
 374         {
 375                 /* read any last moment ERROR, QUIT or the like -- jilles */
 376                 if (!strcmp(reason, "Remote host closed the connection"))
 377                         read_packet(client_p->localClient->F, client_p);
 378                 if (IsAnyDead(client_p))
 379                         return;
 380         }
 381         if(IsAnyServer(client_p))
 382         {
 383                 sendto_realops_snomask(SNO_GENERAL, is_remote_connect(client_p) && !IsServer(client_p) ? L_NETWIDE : L_ALL, "ssld error for %s: %s", client_p->name, reason);
 384                 ilog(L_SERVER, "ssld error for %s: %s", log_client_name(client_p, SHOW_IP), reason);
 385         }
 386         exit_client(client_p, client_p, &me, reason);
 387 }
 388
 389
 390 static void
 391 ssl_process_cipher_string(ssl_ctl_t *ctl, ssl_ctl_buf_t *ctl_buf)
 392 {
 393         struct Client *client_p;
 394         const char *cstring;
 395         uint32_t fd;
 396
 397         if(ctl_buf->buflen < 6)
 398                 return;         /* bogus message..drop it.. XXX should warn here */
 399
 400         fd = buf_to_uint32(&ctl_buf->buf[1]);
 401         cstring = (const char *)&ctl_buf->buf[5];
 402
 403         if(EmptyString(cstring))
 404                 return;
 405
 406         client_p = find_cli_connid_hash(fd);
 407         if(client_p != NULL && client_p->localClient != NULL)
 408         {
 409                 rb_free(client_p->localClient->cipher_string);
 410                 client_p->localClient->cipher_string = rb_strdup(cstring);
 411         }
 412 }
 413
 414
 415 static void
 416 ssl_process_certfp(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf)
 417 {
 418         struct Client *client_p;
 419         uint32_t fd;
 420         uint32_t len;
 421         uint8_t *certfp;
 422         char *certfp_string;
 423         int i;
 424
 425         if(ctl_buf->buflen > 5 + RB_SSL_CERTFP_LEN)
 426                 return;         /* bogus message..drop it.. XXX should warn here */
 427
 428         fd = buf_to_uint32(&ctl_buf->buf[1]);
 429         len = buf_to_uint32(&ctl_buf->buf[5]);
 430         certfp = (uint8_t *)&ctl_buf->buf[9];
 431         client_p = find_cli_connid_hash(fd);
 432         if(client_p == NULL)
 433                 return;
 434         rb_free(client_p->certfp);
 435         certfp_string = rb_malloc(len * 2 + 1);
 436         for(i = 0; i < len; i++)
 437                 rb_snprintf(certfp_string + 2 * i, 3, "%02x",
 438                                 certfp[i]);
 439         client_p->certfp = certfp_string;
 440 }
 441
 442 static void
 443 ssl_process_cmd_recv(ssl_ctl_t * ctl)
 444 {
 445         static const char *cannot_setup_ssl = "ssld cannot setup ssl, check your certificates and private key";
 446         static const char *no_ssl_or_zlib = "ssld has neither SSL/TLS or zlib support killing all sslds";
 447         rb_dlink_node *ptr, *next;
 448         ssl_ctl_buf_t *ctl_buf;
 449         if(ctl->dead)
 450                 return;
 451         RB_DLINK_FOREACH_SAFE(ptr, next, ctl->readq.head)
 452         {
 453                 ctl_buf = ptr->data;
 454                 switch (*ctl_buf->buf)
 455                 {
 456                 case 'N':
 457                         ssl_ok = 0;     /* ssld says it can't do ssl/tls */
 458                         break;
 459                 case 'D':
 460                         ssl_process_dead_fd(ctl, ctl_buf);
 461                         break;
 462                 case 'C':
 463                         ssl_process_cipher_string(ctl, ctl_buf);
 464                         break;
 465                 case 'F':
 466                         ssl_process_certfp(ctl, ctl_buf);
 467                         break;
 468                 case 'S':
 469                         ssl_process_zipstats(ctl, ctl_buf);
 470                         break;
 471                 case 'I':
 472                         ssl_ok = 0;
 473                         ilog(L_MAIN, "%s", cannot_setup_ssl);
 474                         sendto_realops_snomask(SNO_GENERAL, L_ALL, "%s", cannot_setup_ssl);
 475                         break;
 476                 case 'U':
 477                         zlib_ok = 0;
 478                         ssl_ok = 0;
 479                         ilog(L_MAIN, "%s", no_ssl_or_zlib);
 480                         sendto_realops_snomask(SNO_GENERAL, L_ALL, "%s", no_ssl_or_zlib);
 481                         ssl_killall();
 482                         break;
 483                 case 'z':
 484                         zlib_ok = 0;
 485                         break;
 486                 default:
 487                         ilog(L_MAIN, "Received invalid command from ssld: %s", ctl_buf->buf);
 488                         sendto_realops_snomask(SNO_GENERAL, L_ALL, "Received invalid command from ssld");
 489                         break;
 490                 }
 491                 rb_dlinkDelete(ptr, &ctl->readq);
 492                 rb_free(ctl_buf->buf);
 493                 rb_free(ctl_buf);
 494         }
 495
 496 }
 497
 498
 499 static void
 500 ssl_read_ctl(rb_fde_t * F, void *data)
 501 {
 502         ssl_ctl_buf_t *ctl_buf;
 503         ssl_ctl_t *ctl = data;
 504         int retlen;
 505
 506         if(ctl->dead)
 507                 return;
 508         do
 509         {
 510                 ctl_buf = rb_malloc(sizeof(ssl_ctl_buf_t));
 511                 ctl_buf->buf = rb_malloc(READSIZE);
 512                 retlen = rb_recv_fd_buf(ctl->F, ctl_buf->buf, READSIZE, ctl_buf->F, 4);
 513                 ctl_buf->buflen = retlen;
 514                 if(retlen <= 0)
 515                 {
 516                         rb_free(ctl_buf->buf);
 517                         rb_free(ctl_buf);
 518                 }
 519                 else
 520                         rb_dlinkAddTail(ctl_buf, &ctl_buf->node, &ctl->readq);
 521         }
 522         while(retlen > 0);
 523
 524         if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno)))
 525         {
 526                 ssl_dead(ctl);
 527                 return;
 528         }
 529         ssl_process_cmd_recv(ctl);
 530         rb_setselect(ctl->F, RB_SELECT_READ, ssl_read_ctl, ctl);
 531 }
 532
 533 static ssl_ctl_t *
 534 which_ssld(void)
 535 {
 536         ssl_ctl_t *ctl, *lowest = NULL;
 537         rb_dlink_node *ptr;
 538
 539         RB_DLINK_FOREACH(ptr, ssl_daemons.head)
 540         {
 541                 ctl = ptr->data;
 542                 if(ctl->dead)
 543                         continue;
 544                 if(lowest == NULL)
 545                 {
 546                         lowest = ctl;
 547                         continue;
 548                 }
 549                 if(ctl->cli_count < lowest->cli_count)
 550                         lowest = ctl;
 551         }
 552         return (lowest);
 553 }
 554
 555 static void
 556 ssl_write_ctl(rb_fde_t * F, void *data)
 557 {
 558         ssl_ctl_t *ctl = data;
 559         ssl_ctl_buf_t *ctl_buf;
 560         rb_dlink_node *ptr, *next;
 561         int retlen, x;
 562
 563         if(ctl->dead)
 564                 return;
 565
 566         RB_DLINK_FOREACH_SAFE(ptr, next, ctl->writeq.head)
 567         {
 568                 ctl_buf = ptr->data;
 569                 /* in theory unix sock_dgram shouldn't ever short write this.. */
 570                 retlen = rb_send_fd_buf(ctl->F, ctl_buf->F, ctl_buf->nfds, ctl_buf->buf, ctl_buf->buflen, ctl->pid);
 571                 if(retlen > 0)
 572                 {
 573                         rb_dlinkDelete(ptr, &ctl->writeq);
 574                         for(x = 0; x < ctl_buf->nfds; x++)
 575                                 rb_close(ctl_buf->F[x]);
 576                         rb_free(ctl_buf->buf);
 577                         rb_free(ctl_buf);
 578
 579                 }
 580                 if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno)))
 581                 {
 582                         ssl_dead(ctl);
 583                         return;
 584                 }
 585                 else
 586                 {
 587                         rb_setselect(ctl->F, RB_SELECT_WRITE, ssl_write_ctl, ctl);
 588                 }
 589         }
 590 }
 591
 592 static void
 593 ssl_cmd_write_queue(ssl_ctl_t * ctl, rb_fde_t ** F, int count, const void *buf, size_t buflen)
 594 {
 595         ssl_ctl_buf_t *ctl_buf;
 596         int x;
 597
 598         /* don't bother */
 599         if(ctl->dead)
 600                 return;
 601
 602         ctl_buf = rb_malloc(sizeof(ssl_ctl_buf_t));
 603         ctl_buf->buf = rb_malloc(buflen);
 604         memcpy(ctl_buf->buf, buf, buflen);
 605         ctl_buf->buflen = buflen;
 606
 607         for(x = 0; x < count && x < MAXPASSFD; x++)
 608         {
 609                 ctl_buf->F[x] = F[x];
 610         }
 611         ctl_buf->nfds = count;
 612         rb_dlinkAddTail(ctl_buf, &ctl_buf->node, &ctl->writeq);
 613         ssl_write_ctl(ctl->F, ctl);
 614 }
 615
 616
 617 static void
 618 send_new_ssl_certs_one(ssl_ctl_t * ctl, const char *ssl_cert, const char *ssl_private_key, const char *ssl_dh_params, const char *ssl_cipher_list)
 619 {
 620         size_t len;
 621
 622         len = strlen(ssl_cert) + strlen(ssl_private_key) + strlen(ssl_dh_params) + 5;
 623         if(len > sizeof(tmpbuf))
 624         {
 625                 sendto_realops_snomask(SNO_GENERAL, L_ALL,
 626                                        "Parameters for send_new_ssl_certs_one too long (%zu > %zu) to pass to ssld, not sending...",
 627                                        len, sizeof(tmpbuf));
 628                 ilog(L_MAIN,
 629                      "Parameters for send_new_ssl_certs_one too long (%zu > %zu) to pass to ssld, not sending...",
 630                      len, sizeof(tmpbuf));
 631                 return;
 632         }
 633         len = rb_snprintf(tmpbuf, sizeof(tmpbuf), "K%c%s%c%s%c%s%c%s%c", nul, ssl_cert, nul,
 634                           ssl_private_key, nul, ssl_dh_params, nul,
 635                           ssl_cipher_list != NULL ? ssl_cipher_list : "", nul);
 636         ssl_cmd_write_queue(ctl, NULL, 0, tmpbuf, len);
 637 }
 638
 639 static void
 640 send_init_prng(ssl_ctl_t * ctl, prng_seed_t seedtype, const char *path)
 641 {
 642         size_t len;
 643         const char *s;
 644         uint8_t seed = (uint8_t) seedtype;
 645
 646         if(path == NULL)
 647                 s = "";
 648         else
 649                 s = path;
 650
 651         len = strlen(s) + 3;
 652         if(len > sizeof(tmpbuf))
 653         {
 654                 sendto_realops_snomask(SNO_GENERAL, L_ALL,
 655                                        "Parameters for send_init_prng too long (%zd > %zd) to pass to ssld, not sending...",
 656                                        len, sizeof(tmpbuf));
 657                 ilog(L_MAIN,
 658                      "Parameters for send_init_prng too long (%zd > %zd) to pass to ssld, not sending...",
 659                      len, sizeof(tmpbuf));
 660                 return;
 661
 662         }
 663         len = rb_snprintf(tmpbuf, sizeof(tmpbuf), "I%c%s%c", seed, s, nul);
 664         ssl_cmd_write_queue(ctl, NULL, 0, tmpbuf, len);
 665 }
 666
 667 static void
 668 send_certfp_method(ssl_ctl_t *ctl, int method)
 669 {
 670         char buf[5];
 671
 672         buf[0] = 'F';
 673         uint32_to_buf(&buf[1], method);
 674         ssl_cmd_write_queue(ctl, NULL, 0, buf, sizeof(buf));
 675 }
 676
 677 void
 678 send_new_ssl_certs(const char *ssl_cert, const char *ssl_private_key, const char *ssl_dh_params, const char *ssl_cipher_list)
 679 {
 680         rb_dlink_node *ptr;
 681         if(ssl_cert == NULL || ssl_private_key == NULL || ssl_dh_params == NULL)
 682         {
 683                 ssl_ok = 0;
 684                 return;
 685         }
 686         RB_DLINK_FOREACH(ptr, ssl_daemons.head)
 687         {
 688                 ssl_ctl_t *ctl = ptr->data;
 689                 send_new_ssl_certs_one(ctl, ssl_cert, ssl_private_key, ssl_dh_params, ssl_cipher_list);
 690         }
 691 }
 692
 693
 694 ssl_ctl_t *
 695 start_ssld_accept(rb_fde_t * sslF, rb_fde_t * plainF, uint32_t id)
 696 {
 697         rb_fde_t *F[2];
 698         ssl_ctl_t *ctl;
 699         char buf[5];
 700         F[0] = sslF;
 701         F[1] = plainF;
 702
 703         buf[0] = 'A';
 704         uint32_to_buf(&buf[1], id);
 705         ctl = which_ssld();
 706         ctl->cli_count++;
 707         ssl_cmd_write_queue(ctl, F, 2, buf, sizeof(buf));
 708         return ctl;
 709 }
 710
 711 ssl_ctl_t *
 712 start_ssld_connect(rb_fde_t * sslF, rb_fde_t * plainF, uint32_t id)
 713 {
 714         rb_fde_t *F[2];
 715         ssl_ctl_t *ctl;
 716         char buf[5];
 717         F[0] = sslF;
 718         F[1] = plainF;
 719
 720         buf[0] = 'C';
 721         uint32_to_buf(&buf[1], id);
 722
 723         ctl = which_ssld();
 724         ctl->cli_count++;
 725         ssl_cmd_write_queue(ctl, F, 2, buf, sizeof(buf));
 726         return ctl;
 727 }
 728
 729 void
 730 ssld_decrement_clicount(ssl_ctl_t * ctl)
 731 {
 732         if(ctl == NULL)
 733                 return;
 734
 735         ctl->cli_count--;
 736         if(ctl->dead && !ctl->cli_count)
 737         {
 738                 free_ssl_daemon(ctl);
 739         }
 740 }
 741
 742 /*
 743  * what we end up sending to the ssld process for ziplinks is the following
 744  * Z[ourfd][level][RECVQ]
 745  * Z = ziplinks command = buf[0]
 746  * ourfd = Our end of the socketpair = buf[1..4]
 747  * level = zip level buf[5]
 748  * recvqlen = our recvq len = buf[6-7]
 749  * recvq = any data we read prior to starting ziplinks
 750  */
 751 void
 752 start_zlib_session(void *data)
 753 {
 754         struct Client *server = (struct Client *) data;
 755         uint16_t recvqlen;
 756         uint8_t level;
 757         void *xbuf;
 758
 759         rb_fde_t *F[2];
 760         rb_fde_t *xF1, *xF2;
 761         char *buf;
 762         char buf2[9];
 763         void *recvq_start;
 764
 765         size_t hdr = (sizeof(uint8_t) * 2) + sizeof(uint32_t);
 766         size_t len;
 767         int cpylen, left;
 768
 769         server->localClient->event = NULL;
 770
 771         recvqlen = rb_linebuf_len(&server->localClient->buf_recvq);
 772
 773         len = recvqlen + hdr;
 774
 775         if(len > READBUF_SIZE)
 776         {
 777                 sendto_realops_snomask(SNO_GENERAL, L_ALL,
 778                                        "ssld - attempted to pass message of %zd len, max len %d, giving up",
 779                                        len, READBUF_SIZE);
 780                 ilog(L_MAIN, "ssld - attempted to pass message of %zd len, max len %d, giving up", len, READBUF_SIZE);
 781                 exit_client(server, server, server, "ssld readbuf exceeded");
 782                 return;
 783         }
 784
 785         buf = rb_malloc(len);
 786         level = ConfigFileEntry.compression_level;
 787
 788         uint32_to_buf(&buf[1], rb_get_fd(server->localClient->F));
 789         buf[5] = (char) level;
 790
 791         recvq_start = &buf[6];
 792         server->localClient->zipstats = rb_malloc(sizeof(struct ZipStats));
 793
 794         xbuf = recvq_start;
 795         left = recvqlen;
 796
 797         do
 798         {
 799                 cpylen = rb_linebuf_get(&server->localClient->buf_recvq, xbuf, left, LINEBUF_PARTIAL, LINEBUF_RAW);
 800                 left -= cpylen;
 801                 xbuf = (void *) (((uintptr_t) xbuf) + cpylen);
 802         }
 803         while(cpylen > 0);
 804
 805         /* Pass the socket to ssld. */
 806         *buf = 'Z';
 807         if(rb_socketpair(AF_UNIX, SOCK_STREAM, 0, &xF1, &xF2, "Initial zlib socketpairs") == -1)
 808         {
 809                 sendto_realops_snomask(SNO_GENERAL, L_ALL, "Error creating zlib socketpair - %s", strerror(errno));
 810                 ilog(L_MAIN, "Error creating zlib socketpairs - %s", strerror(errno));
 811                 exit_client(server, server, server, "Error creating zlib socketpair");
 812                 return;
 813         }
 814
 815         if(IsSSL(server))
 816         {
 817                 /* tell ssld the new connid for the ssl part*/
 818                 buf2[0] = 'Y';
 819                 uint32_to_buf(&buf2[1], rb_get_fd(server->localClient->F));
 820                 uint32_to_buf(&buf2[5], rb_get_fd(xF2));
 821                 ssl_cmd_write_queue(server->localClient->ssl_ctl, NULL, 0, buf2, sizeof(buf2));
 822         }
 823
 824
 825         F[0] = server->localClient->F;
 826         F[1] = xF1;
 827         del_from_cli_connid_hash(server);
 828         server->localClient->F = xF2;
 829         /* need to redo as what we did before isn't valid now */
 830         uint32_to_buf(&buf[1], rb_get_fd(server->localClient->F));
 831         add_to_cli_connid_hash(server);
 832
 833         server->localClient->z_ctl = which_ssld();
 834         server->localClient->z_ctl->cli_count++;
 835         ssl_cmd_write_queue(server->localClient->z_ctl, F, 2, buf, len);
 836         rb_free(buf);
 837 }
 838
 839 static void
 840 collect_zipstats(void *unused)
 841 {
 842         rb_dlink_node *ptr;
 843         struct Client *target_p;
 844         char buf[sizeof(uint8_t) + sizeof(uint32_t) + HOSTLEN];
 845         void *odata;
 846         size_t len;
 847         uint32_t id;
 848
 849         buf[0] = 'S';
 850         odata = buf + sizeof(uint8_t) + sizeof(uint32_t);
 851
 852         RB_DLINK_FOREACH(ptr, serv_list.head)
 853         {
 854                 target_p = ptr->data;
 855                 if(IsCapable(target_p, CAP_ZIP))
 856                 {
 857                         len = sizeof(uint8_t) + sizeof(uint32_t);
 858
 859                         id = rb_get_fd(target_p->localClient->F);
 860                         uint32_to_buf(&buf[1], id);
 861                         rb_strlcpy(odata, target_p->name, (sizeof(buf) - len));
 862                         len += strlen(odata) + 1;       /* Get the \0 as well */
 863                         ssl_cmd_write_queue(target_p->localClient->z_ctl, NULL, 0, buf, len);
 864                 }
 865         }
 866 }
 867
 868 static void
 869 cleanup_dead_ssl(void *unused)
 870 {
 871         rb_dlink_node *ptr, *next;
 872         ssl_ctl_t *ctl;
 873         RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head)
 874         {
 875                 ctl = ptr->data;
 876                 if(ctl->dead && !ctl->cli_count)
 877                 {
 878                         free_ssl_daemon(ctl);
 879                 }
 880         }
 881 }
 882
 883 int
 884 get_ssld_count(void)
 885 {
 886         return ssld_count;
 887 }
 888
 889 void
 890 init_ssld(void)
 891 {
 892         rb_event_addish("collect_zipstats", collect_zipstats, NULL, ZIPSTATS_TIME);
 893         rb_event_addish("cleanup_dead_ssld", cleanup_dead_ssl, NULL, 60);
 894 }