ircd/sslproc.c

   1 /*
   2  *  sslproc.c: An interface to ssld
   3  *  Copyright (C) 2007 Aaron Sethman <androsyn@ratbox.org>
   4  *  Copyright (C) 2007 ircd-ratbox development team
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 2 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, write to the Free Software
  18  *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301
  19  *  USA
  20  */
  21
  22 #include <rb_lib.h>
  23 #include "stdinc.h"
  24
  25
  26 #include "s_conf.h"
  27 #include "logger.h"
  28 #include "listener.h"
  29 #include "sslproc.h"
  30 #include "s_serv.h"
  31 #include "ircd.h"
  32 #include "hash.h"
  33 #include "client.h"
  34 #include "send.h"
  35 #include "packet.h"
  36 #include "certfp.h"
  37
  38 static void ssl_read_ctl(rb_fde_t * F, void *data);
  39 static int ssld_count;
  40
  41 static char tmpbuf[READBUF_SIZE];
  42 static char nul = '\0';
  43
  44 #define MAXPASSFD 4
  45 #define READSIZE 1024
  46 typedef struct _ssl_ctl_buf
  47 {
  48         rb_dlink_node node;
  49         char *buf;
  50         size_t buflen;
  51         rb_fde_t *F[MAXPASSFD];
  52         int nfds;
  53 } ssl_ctl_buf_t;
  54
  55
  56 struct _ssl_ctl
  57 {
  58         rb_dlink_node node;
  59         int cli_count;
  60         rb_fde_t *F;
  61         rb_fde_t *P;
  62         pid_t pid;
  63         rb_dlink_list readq;
  64         rb_dlink_list writeq;
  65         uint8_t shutdown;
  66         uint8_t dead;
  67         char version[256];
  68 };
  69
  70 static void ssld_update_config_one(ssl_ctl_t *ctl);
  71 static void send_new_ssl_certs_one(ssl_ctl_t * ctl);
  72 static void send_certfp_method(ssl_ctl_t *ctl);
  73
  74
  75 static rb_dlink_list ssl_daemons;
  76
  77 static inline uint32_t
  78 buf_to_uint32(char *buf)
  79 {
  80         uint32_t x;
  81         memcpy(&x, buf, sizeof(x));
  82         return x;
  83 }
  84
  85 static inline void
  86 uint32_to_buf(char *buf, uint32_t x)
  87 {
  88         memcpy(buf, &x, sizeof(x));
  89         return;
  90 }
  91
  92 static ssl_ctl_t *
  93 allocate_ssl_daemon(rb_fde_t * F, rb_fde_t * P, int pid)
  94 {
  95         ssl_ctl_t *ctl;
  96
  97         if(F == NULL || pid < 0)
  98                 return NULL;
  99         ctl = rb_malloc(sizeof(ssl_ctl_t));
 100         ctl->F = F;
 101         ctl->P = P;
 102         ctl->pid = pid;
 103         ssld_count++;
 104         rb_dlinkAdd(ctl, &ctl->node, &ssl_daemons);
 105         return ctl;
 106 }
 107
 108 static void
 109 free_ssl_daemon(ssl_ctl_t * ctl)
 110 {
 111         rb_dlink_node *ptr;
 112         ssl_ctl_buf_t *ctl_buf;
 113         int x;
 114         if(ctl->cli_count)
 115                 return;
 116
 117         RB_DLINK_FOREACH(ptr, ctl->readq.head)
 118         {
 119                 ctl_buf = ptr->data;
 120                 for(x = 0; x < ctl_buf->nfds; x++)
 121                         rb_close(ctl_buf->F[x]);
 122
 123                 rb_free(ctl_buf->buf);
 124                 rb_free(ctl_buf);
 125         }
 126
 127         RB_DLINK_FOREACH(ptr, ctl->writeq.head)
 128         {
 129                 ctl_buf = ptr->data;
 130                 for(x = 0; x < ctl_buf->nfds; x++)
 131                         rb_close(ctl_buf->F[x]);
 132
 133                 rb_free(ctl_buf->buf);
 134                 rb_free(ctl_buf);
 135         }
 136         rb_close(ctl->F);
 137         rb_close(ctl->P);
 138         rb_dlinkDelete(&ctl->node, &ssl_daemons);
 139         rb_free(ctl);
 140 }
 141
 142 static char *ssld_path;
 143
 144 static int ssld_spin_count = 0;
 145 static time_t last_spin;
 146 static int ssld_wait = 0;
 147
 148
 149 void
 150 restart_ssld(void)
 151 {
 152         rb_dlink_node *ptr, *next;
 153         ssl_ctl_t *ctl;
 154
 155         RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head)
 156         {
 157                 ctl = ptr->data;
 158                 if(ctl->dead)
 159                         continue;
 160                 if(ctl->shutdown)
 161                         continue;
 162                 ctl->shutdown = 1;
 163                 ssld_count--;
 164                 if(!ctl->cli_count)
 165                 {
 166                         rb_kill(ctl->pid, SIGKILL);
 167                         free_ssl_daemon(ctl);
 168                 }
 169         }
 170
 171         ssld_spin_count = 0;
 172         last_spin = 0;
 173         ssld_wait = 0;
 174         start_ssldaemon(ServerInfo.ssld_count);
 175 }
 176
 177 static void
 178 ssl_killall(void)
 179 {
 180         rb_dlink_node *ptr, *next;
 181         ssl_ctl_t *ctl;
 182         RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head)
 183         {
 184                 ctl = ptr->data;
 185                 if(ctl->dead)
 186                         continue;
 187                 ctl->dead = 1;
 188                 if(!ctl->shutdown)
 189                         ssld_count--;
 190                 rb_kill(ctl->pid, SIGKILL);
 191                 if(!ctl->cli_count)
 192                         free_ssl_daemon(ctl);
 193         }
 194 }
 195
 196 static void
 197 ssl_dead(ssl_ctl_t * ctl)
 198 {
 199         if(ctl->dead)
 200                 return;
 201
 202         ctl->dead = 1;
 203         rb_kill(ctl->pid, SIGKILL);     /* make sure the process is really gone */
 204
 205         if(!ctl->shutdown)
 206         {
 207                 ssld_count--;
 208                 ilog(L_MAIN, "ssld helper died - attempting to restart");
 209                 sendto_realops_snomask(SNO_GENERAL, L_NETWIDE, "ssld helper died - attempting to restart");
 210                 start_ssldaemon(1);
 211         }
 212 }
 213
 214 static void
 215 ssl_do_pipe(rb_fde_t * F, void *data)
 216 {
 217         int retlen;
 218         ssl_ctl_t *ctl = data;
 219         retlen = rb_write(F, "0", 1);
 220         if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno)))
 221         {
 222                 ssl_dead(ctl);
 223                 return;
 224         }
 225         rb_setselect(F, RB_SELECT_READ, ssl_do_pipe, data);
 226 }
 227
 228 static void
 229 restart_ssld_event(void *unused)
 230 {
 231         ssld_spin_count = 0;
 232         last_spin = 0;
 233         ssld_wait = 0;
 234         if(ServerInfo.ssld_count > get_ssld_count())
 235         {
 236                 int start = ServerInfo.ssld_count - get_ssld_count();
 237                 ilog(L_MAIN, "Attempting to restart ssld processes");
 238                 sendto_realops_snomask(SNO_GENERAL, L_NETWIDE, "Attempt to restart ssld processes");
 239                 start_ssldaemon(start);
 240         }
 241 }
 242
 243 int
 244 start_ssldaemon(int count)
 245 {
 246         rb_fde_t *F1, *F2;
 247         rb_fde_t *P1, *P2;
 248         char fullpath[PATH_MAX + 1];
 249         char fdarg[6];
 250         const char *parv[2];
 251         char buf[128];
 252         char s_pid[10];
 253         pid_t pid;
 254         int started = 0, i;
 255
 256         if(ssld_wait)
 257                 return 0;
 258
 259         if(ssld_spin_count > 20 && (rb_current_time() - last_spin < 5))
 260         {
 261                 ilog(L_MAIN, "ssld helper is spinning - will attempt to restart in 1 minute");
 262                 sendto_realops_snomask(SNO_GENERAL, L_NETWIDE,
 263                                        "ssld helper is spinning - will attempt to restart in 1 minute");
 264                 rb_event_add("restart_ssld_event", restart_ssld_event, NULL, 60);
 265                 ssld_wait = 1;
 266                 return 0;
 267         }
 268
 269         ssld_spin_count++;
 270         last_spin = rb_current_time();
 271
 272         if(ssld_path == NULL)
 273         {
 274                 snprintf(fullpath, sizeof(fullpath), "%s/ssld", ircd_paths[IRCD_PATH_LIBEXEC]);
 275
 276                 if(access(fullpath, X_OK) == -1)
 277                 {
 278                         snprintf(fullpath, sizeof(fullpath), "%s/bin/ssld", ConfigFileEntry.dpath);
 279                         if(access(fullpath, X_OK) == -1)
 280                         {
 281                                 ilog(L_MAIN,
 282                                      "Unable to execute ssld in %s or %s/bin",
 283                                      ircd_paths[IRCD_PATH_LIBEXEC], ConfigFileEntry.dpath);
 284                                 return 0;
 285                         }
 286                 }
 287                 ssld_path = rb_strdup(fullpath);
 288         }
 289         rb_strlcpy(buf, "-ircd ssld daemon", sizeof(buf));
 290         parv[0] = buf;
 291         parv[1] = NULL;
 292
 293         for(i = 0; i < count; i++)
 294         {
 295                 ssl_ctl_t *ctl;
 296                 if(rb_socketpair(AF_UNIX, SOCK_DGRAM, 0, &F1, &F2, "SSL/TLS handle passing socket") == -1)
 297                 {
 298                         ilog(L_MAIN, "Unable to create ssld - rb_socketpair failed: %s", strerror(errno));
 299                         return started;
 300                 }
 301
 302                 rb_set_buffers(F1, READBUF_SIZE);
 303                 rb_set_buffers(F2, READBUF_SIZE);
 304                 snprintf(fdarg, sizeof(fdarg), "%d", rb_get_fd(F2));
 305                 rb_setenv("CTL_FD", fdarg, 1);
 306                 if(rb_pipe(&P1, &P2, "SSL/TLS pipe") == -1)
 307                 {
 308                         ilog(L_MAIN, "Unable to create ssld - rb_pipe failed: %s", strerror(errno));
 309                         return started;
 310                 }
 311                 snprintf(fdarg, sizeof(fdarg), "%d", rb_get_fd(P1));
 312                 rb_setenv("CTL_PIPE", fdarg, 1);
 313                 snprintf(s_pid, sizeof(s_pid), "%d", (int)getpid());
 314                 rb_setenv("CTL_PPID", s_pid, 1);
 315
 316                 rb_clear_cloexec(F2);
 317                 rb_clear_cloexec(P1);
 318
 319                 pid = rb_spawn_process(ssld_path, (const char **) parv);
 320                 if(pid == -1)
 321                 {
 322                         ilog(L_MAIN, "Unable to create ssld: %s\n", strerror(errno));
 323                         rb_close(F1);
 324                         rb_close(F2);
 325                         rb_close(P1);
 326                         rb_close(P2);
 327                         return started;
 328                 }
 329                 started++;
 330                 rb_close(F2);
 331                 rb_close(P1);
 332                 ctl = allocate_ssl_daemon(F1, P2, pid);
 333                 if(ircd_ssl_ok)
 334                         ssld_update_config_one(ctl);
 335                 ssl_read_ctl(ctl->F, ctl);
 336                 ssl_do_pipe(P2, ctl);
 337
 338         }
 339         ilog(L_MAIN, "ssld helper started");
 340         sendto_realops_snomask(SNO_GENERAL, L_NETWIDE, "ssld helper started");
 341         return started;
 342 }
 343
 344 static void
 345 ssl_process_open_fd(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf)
 346 {
 347         struct Client *client_p;
 348         uint32_t fd;
 349
 350         if(ctl_buf->buflen < 5)
 351                 return; /* bogus message..drop it.. XXX should warn here */
 352
 353         fd = buf_to_uint32(&ctl_buf->buf[1]);
 354         client_p = find_cli_connid_hash(fd);
 355         if(client_p == NULL || client_p->localClient == NULL)
 356                 return;
 357
 358         if(client_p->localClient->ssl_callback)
 359         {
 360                 SSL_OPEN_CB *hdl = client_p->localClient->ssl_callback;
 361
 362                 client_p->localClient->ssl_callback = NULL;
 363
 364                 hdl(client_p, RB_OK);
 365         }
 366 }
 367
 368 static void
 369 ssl_process_dead_fd(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf)
 370 {
 371         struct Client *client_p;
 372         char reason[256];
 373         uint32_t fd;
 374
 375         if(ctl_buf->buflen < 6)
 376                 return;         /* bogus message..drop it.. XXX should warn here */
 377
 378         fd = buf_to_uint32(&ctl_buf->buf[1]);
 379         rb_strlcpy(reason, &ctl_buf->buf[5], sizeof(reason));
 380         client_p = find_cli_connid_hash(fd);
 381         if(client_p == NULL || client_p->localClient == NULL)
 382                 return;
 383
 384         if(IsAnyServer(client_p))
 385         {
 386                 sendto_realops_snomask(SNO_GENERAL, L_NETWIDE, "ssld error for %s: %s", client_p->name, reason);
 387                 ilog(L_SERVER, "ssld error for %s: %s", log_client_name(client_p, SHOW_IP), reason);
 388         }
 389
 390         /* if there is still a pending callback, call it now */
 391         if(client_p->localClient->ssl_callback)
 392         {
 393                 SSL_OPEN_CB *hdl = client_p->localClient->ssl_callback;
 394
 395                 client_p->localClient->ssl_callback = NULL;
 396
 397                 if (hdl(client_p, RB_ERROR_SSL))
 398                 {
 399                         /* the callback has exited the client */
 400                         return;
 401                 }
 402         }
 403
 404         if(IsAnyServer(client_p) || IsRegistered(client_p))
 405         {
 406                 /* read any last moment ERROR, QUIT or the like -- jilles */
 407                 if (!strcmp(reason, "Remote host closed the connection"))
 408                         read_packet(client_p->localClient->F, client_p);
 409                 if (IsAnyDead(client_p))
 410                         return;
 411         }
 412         exit_client(client_p, client_p, &me, reason);
 413 }
 414
 415
 416 static void
 417 ssl_process_cipher_string(ssl_ctl_t *ctl, ssl_ctl_buf_t *ctl_buf)
 418 {
 419         struct Client *client_p;
 420         const char *cstring;
 421         uint32_t fd;
 422
 423         if(ctl_buf->buflen < 6)
 424                 return;         /* bogus message..drop it.. XXX should warn here */
 425
 426         fd = buf_to_uint32(&ctl_buf->buf[1]);
 427         cstring = (const char *)&ctl_buf->buf[5];
 428
 429         if(EmptyString(cstring))
 430                 return;
 431
 432         client_p = find_cli_connid_hash(fd);
 433         if(client_p != NULL && client_p->localClient != NULL)
 434         {
 435                 rb_free(client_p->localClient->cipher_string);
 436                 client_p->localClient->cipher_string = rb_strdup(cstring);
 437         }
 438 }
 439
 440
 441 static void
 442 ssl_process_certfp(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf)
 443 {
 444         struct Client *client_p;
 445         uint32_t fd;
 446         uint32_t certfp_method;
 447         uint32_t len;
 448         uint8_t *certfp;
 449         char *certfp_string;
 450         const char *method_string;
 451         int method_len;
 452
 453         if(ctl_buf->buflen > 13 + RB_SSL_CERTFP_LEN)
 454                 return;         /* bogus message..drop it.. XXX should warn here */
 455
 456         fd = buf_to_uint32(&ctl_buf->buf[1]);
 457         certfp_method = buf_to_uint32(&ctl_buf->buf[5]);
 458         len = buf_to_uint32(&ctl_buf->buf[9]);
 459         certfp = (uint8_t *)&ctl_buf->buf[13];
 460         client_p = find_cli_connid_hash(fd);
 461         if(client_p == NULL)
 462                 return;
 463
 464         switch (certfp_method) {
 465         case RB_SSL_CERTFP_METH_CERT_SHA1:
 466                 method_string = CERTFP_PREFIX_CERT_SHA1;
 467                 break;
 468         case RB_SSL_CERTFP_METH_CERT_SHA256:
 469                 method_string = CERTFP_PREFIX_CERT_SHA256;
 470                 break;
 471         case RB_SSL_CERTFP_METH_CERT_SHA512:
 472                 method_string = CERTFP_PREFIX_CERT_SHA512;
 473                 break;
 474         case RB_SSL_CERTFP_METH_SPKI_SHA256:
 475                 method_string = CERTFP_PREFIX_SPKI_SHA256;
 476                 break;
 477         case RB_SSL_CERTFP_METH_SPKI_SHA512:
 478                 method_string = CERTFP_PREFIX_SPKI_SHA512;
 479                 break;
 480         default:
 481                 return;
 482         }
 483         method_len = strlen(method_string);
 484
 485         rb_free(client_p->certfp);
 486         certfp_string = rb_malloc(method_len + len * 2 + 1);
 487         rb_strlcpy(certfp_string, method_string, method_len + len * 2 + 1);
 488         for(uint32_t i = 0; i < len; i++)
 489                 snprintf(certfp_string + method_len + 2 * i, 3, "%02x",
 490                                 certfp[i]);
 491         client_p->certfp = certfp_string;
 492 }
 493
 494 static void
 495 ssl_process_cmd_recv(ssl_ctl_t * ctl)
 496 {
 497         static const char *cannot_setup_ssl = "ssld cannot setup ssl, check your certificates and private key";
 498         static const char *no_ssl_or_zlib = "ssld has neither SSL/TLS or zlib support killing all sslds";
 499         rb_dlink_node *ptr, *next;
 500         ssl_ctl_buf_t *ctl_buf;
 501         unsigned long len;
 502
 503         if(ctl->dead)
 504                 return;
 505
 506         RB_DLINK_FOREACH_SAFE(ptr, next, ctl->readq.head)
 507         {
 508                 ctl_buf = ptr->data;
 509                 switch (*ctl_buf->buf)
 510                 {
 511                 case 'N':
 512                         ircd_ssl_ok = false;    /* ssld says it can't do ssl/tls */
 513                         break;
 514                 case 'O':
 515                         ssl_process_open_fd(ctl, ctl_buf);
 516                         break;
 517                 case 'D':
 518                         ssl_process_dead_fd(ctl, ctl_buf);
 519                         break;
 520                 case 'C':
 521                         ssl_process_cipher_string(ctl, ctl_buf);
 522                         break;
 523                 case 'F':
 524                         ssl_process_certfp(ctl, ctl_buf);
 525                         break;
 526                 case 'I':
 527                         ircd_ssl_ok = false;
 528                         ilog(L_MAIN, "%s", cannot_setup_ssl);
 529                         sendto_realops_snomask(SNO_GENERAL, L_NETWIDE, "%s", cannot_setup_ssl);
 530                         break;
 531                 case 'U':
 532                         ircd_zlib_ok = 0;
 533                         ircd_ssl_ok = false;
 534                         ilog(L_MAIN, "%s", no_ssl_or_zlib);
 535                         sendto_realops_snomask(SNO_GENERAL, L_NETWIDE, "%s", no_ssl_or_zlib);
 536                         ssl_killall();
 537                         return;
 538                 case 'V':
 539                         len = ctl_buf->buflen - 1;
 540                         if (len > sizeof(ctl->version) - 1)
 541                                 len = sizeof(ctl->version) - 1;
 542                         strncpy(ctl->version, &ctl_buf->buf[1], len);
 543                 case 'z':
 544                         ircd_zlib_ok = 0;
 545                         break;
 546                 default:
 547                         ilog(L_MAIN, "Received invalid command from ssld: %s", ctl_buf->buf);
 548                         sendto_realops_snomask(SNO_GENERAL, L_NETWIDE, "Received invalid command from ssld");
 549                         break;
 550                 }
 551                 rb_dlinkDelete(ptr, &ctl->readq);
 552                 rb_free(ctl_buf->buf);
 553                 rb_free(ctl_buf);
 554         }
 555
 556 }
 557
 558
 559 static void
 560 ssl_read_ctl(rb_fde_t * F, void *data)
 561 {
 562         ssl_ctl_buf_t *ctl_buf;
 563         ssl_ctl_t *ctl = data;
 564         int retlen;
 565
 566         if(ctl->dead)
 567                 return;
 568         do
 569         {
 570                 ctl_buf = rb_malloc(sizeof(ssl_ctl_buf_t));
 571                 ctl_buf->buf = rb_malloc(READSIZE);
 572                 retlen = rb_recv_fd_buf(ctl->F, ctl_buf->buf, READSIZE, ctl_buf->F, 4);
 573                 ctl_buf->buflen = retlen;
 574                 if(retlen <= 0)
 575                 {
 576                         rb_free(ctl_buf->buf);
 577                         rb_free(ctl_buf);
 578                 }
 579                 else
 580                         rb_dlinkAddTail(ctl_buf, &ctl_buf->node, &ctl->readq);
 581         }
 582         while(retlen > 0);
 583
 584         if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno)))
 585         {
 586                 ssl_dead(ctl);
 587                 return;
 588         }
 589         ssl_process_cmd_recv(ctl);
 590         rb_setselect(ctl->F, RB_SELECT_READ, ssl_read_ctl, ctl);
 591 }
 592
 593 static ssl_ctl_t *
 594 which_ssld(void)
 595 {
 596         ssl_ctl_t *ctl, *lowest = NULL;
 597         rb_dlink_node *ptr;
 598
 599         RB_DLINK_FOREACH(ptr, ssl_daemons.head)
 600         {
 601                 ctl = ptr->data;
 602                 if(ctl->dead)
 603                         continue;
 604                 if(ctl->shutdown)
 605                         continue;
 606                 if(lowest == NULL)
 607                 {
 608                         lowest = ctl;
 609                         continue;
 610                 }
 611                 if(ctl->cli_count < lowest->cli_count)
 612                         lowest = ctl;
 613         }
 614         return (lowest);
 615 }
 616
 617 static void
 618 ssl_write_ctl(rb_fde_t * F, void *data)
 619 {
 620         ssl_ctl_t *ctl = data;
 621         ssl_ctl_buf_t *ctl_buf;
 622         rb_dlink_node *ptr, *next;
 623         int retlen, x;
 624
 625         if(ctl->dead)
 626                 return;
 627
 628         RB_DLINK_FOREACH_SAFE(ptr, next, ctl->writeq.head)
 629         {
 630                 ctl_buf = ptr->data;
 631                 /* in theory unix sock_dgram shouldn't ever short write this.. */
 632                 retlen = rb_send_fd_buf(ctl->F, ctl_buf->F, ctl_buf->nfds, ctl_buf->buf, ctl_buf->buflen, ctl->pid);
 633                 if(retlen > 0)
 634                 {
 635                         rb_dlinkDelete(ptr, &ctl->writeq);
 636                         for(x = 0; x < ctl_buf->nfds; x++)
 637                                 rb_close(ctl_buf->F[x]);
 638                         rb_free(ctl_buf->buf);
 639                         rb_free(ctl_buf);
 640
 641                 }
 642                 if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno)))
 643                 {
 644                         ssl_dead(ctl);
 645                         return;
 646                 }
 647                 else
 648                 {
 649                         rb_setselect(ctl->F, RB_SELECT_WRITE, ssl_write_ctl, ctl);
 650                 }
 651         }
 652 }
 653
 654 static void
 655 ssl_cmd_write_queue(ssl_ctl_t * ctl, rb_fde_t ** F, int count, const void *buf, size_t buflen)
 656 {
 657         ssl_ctl_buf_t *ctl_buf;
 658         int x;
 659
 660         /* don't bother */
 661         if(ctl->dead)
 662                 return;
 663
 664         ctl_buf = rb_malloc(sizeof(ssl_ctl_buf_t));
 665         ctl_buf->buf = rb_malloc(buflen);
 666         memcpy(ctl_buf->buf, buf, buflen);
 667         ctl_buf->buflen = buflen;
 668
 669         for(x = 0; x < count && x < MAXPASSFD; x++)
 670         {
 671                 ctl_buf->F[x] = F[x];
 672         }
 673         ctl_buf->nfds = count;
 674         rb_dlinkAddTail(ctl_buf, &ctl_buf->node, &ctl->writeq);
 675         ssl_write_ctl(ctl->F, ctl);
 676 }
 677
 678
 679 static void
 680 send_new_ssl_certs_one(ssl_ctl_t * ctl)
 681 {
 682         size_t len = 5;
 683
 684         if(ServerInfo.ssl_cert)
 685                 len += strlen(ServerInfo.ssl_cert);
 686         else
 687                 return;
 688
 689         if(ServerInfo.ssl_private_key)
 690                 len += strlen(ServerInfo.ssl_private_key);
 691
 692         if(ServerInfo.ssl_dh_params)
 693                 len += strlen(ServerInfo.ssl_dh_params);
 694
 695         if(ServerInfo.ssl_cipher_list)
 696                 len += strlen(ServerInfo.ssl_cipher_list);
 697
 698         if(len > sizeof(tmpbuf))
 699         {
 700                 sendto_realops_snomask(SNO_GENERAL, L_NETWIDE,
 701                                        "Parameters for send_new_ssl_certs_one too long (%zu > %zu) to pass to ssld, not sending...",
 702                                        len, sizeof(tmpbuf));
 703                 ilog(L_MAIN,
 704                      "Parameters for send_new_ssl_certs_one too long (%zu > %zu) to pass to ssld, not sending...",
 705                      len, sizeof(tmpbuf));
 706                 return;
 707         }
 708
 709         int ret = snprintf(tmpbuf, sizeof(tmpbuf), "K%c%s%c%s%c%s%c%s%c", nul,
 710                            ServerInfo.ssl_cert, nul,
 711                            ServerInfo.ssl_private_key != NULL ? ServerInfo.ssl_private_key : "", nul,
 712                            ServerInfo.ssl_dh_params != NULL ? ServerInfo.ssl_dh_params : "", nul,
 713                            ServerInfo.ssl_cipher_list != NULL ? ServerInfo.ssl_cipher_list : "", nul);
 714
 715         if(ret > 5)
 716                 ssl_cmd_write_queue(ctl, NULL, 0, tmpbuf, (size_t) ret);
 717 }
 718
 719 static void
 720 send_certfp_method(ssl_ctl_t *ctl)
 721 {
 722         char buf[5];
 723
 724         buf[0] = 'F';
 725         uint32_to_buf(&buf[1], ConfigFileEntry.certfp_method);
 726         ssl_cmd_write_queue(ctl, NULL, 0, buf, sizeof(buf));
 727 }
 728
 729 static void
 730 ssld_update_config_one(ssl_ctl_t *ctl)
 731 {
 732         send_certfp_method(ctl);
 733         send_new_ssl_certs_one(ctl);
 734 }
 735
 736 void
 737 ssld_update_config(void)
 738 {
 739         rb_dlink_node *ptr;
 740
 741         RB_DLINK_FOREACH(ptr, ssl_daemons.head)
 742         {
 743                 ssl_ctl_t *ctl = ptr->data;
 744
 745                 if (ctl->dead || ctl->shutdown)
 746                         continue;
 747
 748                 ssld_update_config_one(ctl);
 749         }
 750 }
 751
 752 ssl_ctl_t *
 753 start_ssld_accept(rb_fde_t * sslF, rb_fde_t * plainF, uint32_t id)
 754 {
 755         rb_fde_t *F[2];
 756         ssl_ctl_t *ctl;
 757         char buf[5];
 758         F[0] = sslF;
 759         F[1] = plainF;
 760
 761         buf[0] = 'A';
 762         uint32_to_buf(&buf[1], id);
 763         ctl = which_ssld();
 764         if(!ctl)
 765                 return NULL;
 766         ctl->cli_count++;
 767         ssl_cmd_write_queue(ctl, F, 2, buf, sizeof(buf));
 768         return ctl;
 769 }
 770
 771 ssl_ctl_t *
 772 start_ssld_connect(rb_fde_t * sslF, rb_fde_t * plainF, uint32_t id)
 773 {
 774         rb_fde_t *F[2];
 775         ssl_ctl_t *ctl;
 776         char buf[5];
 777         F[0] = sslF;
 778         F[1] = plainF;
 779
 780         buf[0] = 'C';
 781         uint32_to_buf(&buf[1], id);
 782
 783         ctl = which_ssld();
 784         if(!ctl)
 785                 return NULL;
 786         ctl->cli_count++;
 787         ssl_cmd_write_queue(ctl, F, 2, buf, sizeof(buf));
 788         return ctl;
 789 }
 790
 791 void
 792 ssld_decrement_clicount(ssl_ctl_t * ctl)
 793 {
 794         if(ctl == NULL)
 795                 return;
 796
 797         ctl->cli_count--;
 798         if(ctl->shutdown && !ctl->cli_count)
 799         {
 800                 ctl->dead = 1;
 801                 rb_kill(ctl->pid, SIGKILL);
 802         }
 803         if(ctl->dead && !ctl->cli_count)
 804         {
 805                 free_ssl_daemon(ctl);
 806         }
 807 }
 808
 809 static void
 810 cleanup_dead_ssl(void *unused)
 811 {
 812         rb_dlink_node *ptr, *next;
 813         ssl_ctl_t *ctl;
 814         RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head)
 815         {
 816                 ctl = ptr->data;
 817                 if(ctl->dead && !ctl->cli_count)
 818                 {
 819                         free_ssl_daemon(ctl);
 820                 }
 821         }
 822 }
 823
 824 int
 825 get_ssld_count(void)
 826 {
 827         return ssld_count;
 828 }
 829
 830 void
 831 ssld_foreach_info(void (*func)(void *data, pid_t pid, int cli_count, enum ssld_status status, const char *version), void *data)
 832 {
 833         rb_dlink_node *ptr, *next;
 834         ssl_ctl_t *ctl;
 835         RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head)
 836         {
 837                 ctl = ptr->data;
 838                 func(data, ctl->pid, ctl->cli_count,
 839                         ctl->dead ? SSLD_DEAD :
 840                                 (ctl->shutdown ? SSLD_SHUTDOWN : SSLD_ACTIVE),
 841                         ctl->version);
 842         }
 843 }
 844
 845 void
 846 init_ssld(void)
 847 {
 848         rb_event_addish("cleanup_dead_ssld", cleanup_dead_ssl, NULL, 60);
 849 }