modules/m_starttls.c

   1 /*
   2  * Copyright (c) 2012 William Pitcock <nenolod@dereferenced.org>.
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice is present in all copies.
   7  *
   8  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
   9  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  10  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  11  * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
  12  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  13  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  14  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  15  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  16  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
  17  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  18  * POSSIBILITY OF SUCH DAMAGE.
  19  */
  20
  21 #include "stdinc.h"
  22 #include "client.h"
  23 #include "common.h"
  24 #include "match.h"
  25 #include "hash.h"
  26 #include "ircd.h"
  27 #include "numeric.h"
  28 #include "send.h"
  29 #include "msg.h"
  30 #include "modules.h"
  31 #include "sslproc.h"
  32 #include "s_assert.h"
  33 #include "s_serv.h"
  34 #include "logger.h"
  35
  36 static const char starttls_desc[] = "Provides the tls CAP and STARTTLS command";
  37
  38 static void mr_starttls(struct MsgBuf *, struct Client *, struct Client *, int, const char **);
  39
  40 struct Message starttls_msgtab = {
  41         "STARTTLS", 0, 0, 0, 0,
  42         {{mr_starttls, 0}, mg_ignore, mg_ignore, mg_ignore, mg_ignore, mg_ignore}
  43 };
  44
  45 mapi_clist_av1 starttls_clist[] = { &starttls_msgtab, NULL };
  46
  47 unsigned int CLICAP_TLS = 0;
  48
  49 #ifdef HAVE_LIBCRYPTO
  50 mapi_cap_list_av2 starttls_cap_list[] = {
  51         { MAPI_CAP_CLIENT, "tls", NULL, &CLICAP_TLS },
  52         { 0, NULL, NULL, NULL }
  53 };
  54 #else /* HAVE_LIBCRYPTO */
  55
  56 mapi_cap_list_av2 starttls_cap_list[] = { { 0, NULL, NULL, NULL } };
  57
  58 #endif /* HAVE_LIBCRYPTO */
  59
  60 DECLARE_MODULE_AV2(starttls, NULL, NULL, starttls_clist, NULL, NULL, starttls_cap_list, NULL, starttls_desc);
  61
  62 static void
  63 mr_starttls(struct MsgBuf *msgbuf_p, struct Client *client_p, struct Client *source_p, int parc, const char *parv[])
  64 {
  65 #ifdef HAVE_LIBCRYPTO
  66         ssl_ctl_t *ctl;
  67         rb_fde_t *F[2];
  68
  69         if (!MyConnect(client_p))
  70                 return;
  71
  72         if (IsSSL(client_p))
  73         {
  74                 sendto_one_numeric(client_p, ERR_STARTTLS, form_str(ERR_STARTTLS), "Nested TLS handshake not allowed");
  75                 return;
  76         }
  77
  78         if (!ircd_ssl_ok || !get_ssld_count())
  79         {
  80                 sendto_one_numeric(client_p, ERR_STARTTLS, form_str(ERR_STARTTLS), "TLS is not configured");
  81                 return;
  82         }
  83
  84         if (rb_socketpair(AF_UNIX, SOCK_STREAM, 0, &F[0], &F[1], "STARTTLS ssld session") == -1)
  85         {
  86                 ilog_error("error creating SSL/TLS socketpair for ssld slave");
  87                 sendto_one_numeric(client_p, ERR_STARTTLS, form_str(ERR_STARTTLS), "Unable to create SSL/TLS socketpair for ssld offload slave");
  88                 return;
  89         }
  90
  91         s_assert(client_p->localClient != NULL);
  92
  93         /* clear out any remaining plaintext lines */
  94         rb_linebuf_donebuf(&client_p->localClient->buf_recvq);
  95
  96         sendto_one_numeric(client_p, RPL_STARTTLS, form_str(RPL_STARTTLS));
  97         send_queued(client_p);
  98
  99         ctl = start_ssld_accept(client_p->localClient->F, F[1], rb_get_fd(F[0]));
 100         if (ctl != NULL)
 101         {
 102                 client_p->localClient->F = F[0];
 103                 client_p->localClient->ssl_ctl = ctl;
 104                 SetSSL(client_p);
 105         }
 106 #else /* HAVE_LIBCRYPTO */
 107         sendto_one_numeric(client_p, ERR_STARTTLS, form_str(ERR_STARTTLS), "TLS is not configured");
 108 #endif /* HAVE_LIBCRYPTO */
 109 }