ircd/sslproc.c

   1 /*
   2  *  sslproc.c: An interface to ssld
   3  *  Copyright (C) 2007 Aaron Sethman <androsyn@ratbox.org>
   4  *  Copyright (C) 2007 ircd-ratbox development team
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 2 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, write to the Free Software
  18  *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301
  19  *  USA
  20  *
  21  *  $Id$
  22  */
  23
  24 #include <ratbox_lib.h>
  25 #include "stdinc.h"
  26
  27
  28 #include "s_conf.h"
  29 #include "logger.h"
  30 #include "listener.h"
  31 #include "sslproc.h"
  32 #include "s_serv.h"
  33 #include "ircd.h"
  34 #include "hash.h"
  35 #include "client.h"
  36 #include "send.h"
  37 #include "packet.h"
  38
  39 #define ZIPSTATS_TIME           60
  40
  41 static void collect_zipstats(void *unused);
  42 static void ssl_read_ctl(rb_fde_t * F, void *data);
  43 static int ssld_count;
  44
  45 static char tmpbuf[READBUF_SIZE];
  46 static char nul = '\0';
  47
  48 #define MAXPASSFD 4
  49 #define READSIZE 1024
  50 typedef struct _ssl_ctl_buf
  51 {
  52         rb_dlink_node node;
  53         char *buf;
  54         size_t buflen;
  55         rb_fde_t *F[MAXPASSFD];
  56         int nfds;
  57 } ssl_ctl_buf_t;
  58
  59
  60 struct _ssl_ctl
  61 {
  62         rb_dlink_node node;
  63         int cli_count;
  64         rb_fde_t *F;
  65         rb_fde_t *P;
  66         pid_t pid;
  67         rb_dlink_list readq;
  68         rb_dlink_list writeq;
  69         uint8_t shutdown;
  70         uint8_t dead;
  71         char version[256];
  72 };
  73
  74 static void send_new_ssl_certs_one(ssl_ctl_t * ctl, const char *ssl_cert,
  75                                    const char *ssl_private_key, const char *ssl_dh_params,
  76                                    const char *ssl_cipher_list);
  77 static void send_init_prng(ssl_ctl_t * ctl, prng_seed_t seedtype, const char *path);
  78 static void send_certfp_method(ssl_ctl_t *ctl, int method);
  79
  80
  81 static rb_dlink_list ssl_daemons;
  82
  83 static inline uint32_t
  84 buf_to_uint32(char *buf)
  85 {
  86         uint32_t x;
  87         memcpy(&x, buf, sizeof(x));
  88         return x;
  89 }
  90
  91 static inline void
  92 uint32_to_buf(char *buf, uint32_t x)
  93 {
  94         memcpy(buf, &x, sizeof(x));
  95         return;
  96 }
  97
  98 static ssl_ctl_t *
  99 allocate_ssl_daemon(rb_fde_t * F, rb_fde_t * P, int pid)
 100 {
 101         ssl_ctl_t *ctl;
 102
 103         if(F == NULL || pid < 0)
 104                 return NULL;
 105         ctl = rb_malloc(sizeof(ssl_ctl_t));
 106         ctl->F = F;
 107         ctl->P = P;
 108         ctl->pid = pid;
 109         ssld_count++;
 110         rb_dlinkAdd(ctl, &ctl->node, &ssl_daemons);
 111         return ctl;
 112 }
 113
 114 static void
 115 free_ssl_daemon(ssl_ctl_t * ctl)
 116 {
 117         rb_dlink_node *ptr;
 118         ssl_ctl_buf_t *ctl_buf;
 119         int x;
 120         if(ctl->cli_count)
 121                 return;
 122
 123         RB_DLINK_FOREACH(ptr, ctl->readq.head)
 124         {
 125                 ctl_buf = ptr->data;
 126                 for(x = 0; x < ctl_buf->nfds; x++)
 127                         rb_close(ctl_buf->F[x]);
 128
 129                 rb_free(ctl_buf->buf);
 130                 rb_free(ctl_buf);
 131         }
 132
 133         RB_DLINK_FOREACH(ptr, ctl->writeq.head)
 134         {
 135                 ctl_buf = ptr->data;
 136                 for(x = 0; x < ctl_buf->nfds; x++)
 137                         rb_close(ctl_buf->F[x]);
 138
 139                 rb_free(ctl_buf->buf);
 140                 rb_free(ctl_buf);
 141         }
 142         rb_close(ctl->F);
 143         rb_close(ctl->P);
 144         rb_dlinkDelete(&ctl->node, &ssl_daemons);
 145         rb_free(ctl);
 146 }
 147
 148 static char *ssld_path;
 149
 150 static int ssld_spin_count = 0;
 151 static time_t last_spin;
 152 static int ssld_wait = 0;
 153
 154
 155 void
 156 restart_ssld(void)
 157 {
 158         rb_dlink_node *ptr, *next;
 159         ssl_ctl_t *ctl;
 160
 161         RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head)
 162         {
 163                 ctl = ptr->data;
 164                 if(ctl->dead)
 165                         continue;
 166                 if(ctl->shutdown)
 167                         continue;
 168                 ctl->shutdown = 1;
 169                 ssld_count--;
 170                 if(!ctl->cli_count)
 171                 {
 172                         rb_kill(ctl->pid, SIGKILL);
 173                         free_ssl_daemon(ctl);
 174                 }
 175         }
 176
 177         start_ssldaemon(ServerInfo.ssld_count, ServerInfo.ssl_cert, ServerInfo.ssl_private_key, ServerInfo.ssl_dh_params, ServerInfo.ssl_cipher_list);
 178 }
 179
 180 static void
 181 ssl_killall(void)
 182 {
 183         rb_dlink_node *ptr, *next;
 184         ssl_ctl_t *ctl;
 185         RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head)
 186         {
 187                 ctl = ptr->data;
 188                 if(ctl->dead)
 189                         continue;
 190                 ctl->dead = 1;
 191                 if(!ctl->shutdown)
 192                         ssld_count--;
 193                 rb_kill(ctl->pid, SIGKILL);
 194                 if(!ctl->cli_count)
 195                         free_ssl_daemon(ctl);
 196         }
 197 }
 198
 199 static void
 200 ssl_dead(ssl_ctl_t * ctl)
 201 {
 202         if(ctl->dead)
 203                 return;
 204
 205         ctl->dead = 1;
 206         rb_kill(ctl->pid, SIGKILL);     /* make sure the process is really gone */
 207
 208         if(!ctl->shutdown)
 209         {
 210                 ssld_count--;
 211                 ilog(L_MAIN, "ssld helper died - attempting to restart");
 212                 sendto_realops_snomask(SNO_GENERAL, L_ALL, "ssld helper died - attempting to restart");
 213                 start_ssldaemon(1, ServerInfo.ssl_cert, ServerInfo.ssl_private_key, ServerInfo.ssl_dh_params, ServerInfo.ssl_cipher_list);
 214         }
 215 }
 216
 217 static void
 218 ssl_do_pipe(rb_fde_t * F, void *data)
 219 {
 220         int retlen;
 221         ssl_ctl_t *ctl = data;
 222         retlen = rb_write(F, "0", 1);
 223         if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno)))
 224         {
 225                 ssl_dead(ctl);
 226                 return;
 227         }
 228         rb_setselect(F, RB_SELECT_READ, ssl_do_pipe, data);
 229 }
 230
 231 static void
 232 restart_ssld_event(void *unused)
 233 {
 234         ssld_spin_count = 0;
 235         last_spin = 0;
 236         ssld_wait = 0;
 237         if(ServerInfo.ssld_count > get_ssld_count())
 238         {
 239                 int start = ServerInfo.ssld_count - get_ssld_count();
 240                 ilog(L_MAIN, "Attempting to restart ssld processes");
 241                 sendto_realops_snomask(SNO_GENERAL, L_ALL, "Attempt to restart ssld processes");
 242                 start_ssldaemon(start, ServerInfo.ssl_cert, ServerInfo.ssl_private_key, ServerInfo.ssl_dh_params, ServerInfo.ssl_cipher_list);
 243         }
 244 }
 245
 246 int
 247 start_ssldaemon(int count, const char *ssl_cert, const char *ssl_private_key, const char *ssl_dh_params, const char *ssl_cipher_list)
 248 {
 249         rb_fde_t *F1, *F2;
 250         rb_fde_t *P1, *P2;
 251 #ifdef _WIN32
 252         const char *suffix = ".exe";
 253 #else
 254         const char *suffix = "";
 255 #endif
 256
 257         char fullpath[PATH_MAX + 1];
 258         char fdarg[6];
 259         const char *parv[2];
 260         char buf[128];
 261         char s_pid[10];
 262         pid_t pid;
 263         int started = 0, i;
 264
 265         if(ssld_wait)
 266                 return 0;
 267
 268         if(ssld_spin_count > 20 && (rb_current_time() - last_spin < 5))
 269         {
 270                 ilog(L_MAIN, "ssld helper is spinning - will attempt to restart in 1 minute");
 271                 sendto_realops_snomask(SNO_GENERAL, L_ALL,
 272                                        "ssld helper is spinning - will attempt to restart in 1 minute");
 273                 rb_event_add("restart_ssld_event", restart_ssld_event, NULL, 60);
 274                 ssld_wait = 1;
 275                 return 0;
 276         }
 277
 278         ssld_spin_count++;
 279         last_spin = rb_current_time();
 280
 281         if(ssld_path == NULL)
 282         {
 283                 snprintf(fullpath, sizeof(fullpath), "%s/ssld%s", PKGLIBEXECDIR, suffix);
 284
 285                 if(access(fullpath, X_OK) == -1)
 286                 {
 287                         snprintf(fullpath, sizeof(fullpath), "%s/bin/ssld%s",
 288                                     ConfigFileEntry.dpath, suffix);
 289                         if(access(fullpath, X_OK) == -1)
 290                         {
 291                                 ilog(L_MAIN,
 292                                      "Unable to execute ssld%s in %s or %s/bin",
 293                                      suffix, PKGLIBEXECDIR, ConfigFileEntry.dpath);
 294                                 return 0;
 295                         }
 296                 }
 297                 ssld_path = rb_strdup(fullpath);
 298         }
 299         rb_strlcpy(buf, "-ircd ssld daemon", sizeof(buf));
 300         parv[0] = buf;
 301         parv[1] = NULL;
 302
 303         for(i = 0; i < count; i++)
 304         {
 305                 ssl_ctl_t *ctl;
 306                 if(rb_socketpair(AF_UNIX, SOCK_DGRAM, 0, &F1, &F2, "SSL/TLS handle passing socket") == -1)
 307                 {
 308                         ilog(L_MAIN, "Unable to create ssld - rb_socketpair failed: %s", strerror(errno));
 309                         return started;
 310                 }
 311
 312                 rb_set_buffers(F1, READBUF_SIZE);
 313                 rb_set_buffers(F2, READBUF_SIZE);
 314                 snprintf(fdarg, sizeof(fdarg), "%d", rb_get_fd(F2));
 315                 rb_setenv("CTL_FD", fdarg, 1);
 316                 if(rb_pipe(&P1, &P2, "SSL/TLS pipe") == -1)
 317                 {
 318                         ilog(L_MAIN, "Unable to create ssld - rb_pipe failed: %s", strerror(errno));
 319                         return started;
 320                 }
 321                 snprintf(fdarg, sizeof(fdarg), "%d", rb_get_fd(P1));
 322                 rb_setenv("CTL_PIPE", fdarg, 1);
 323                 snprintf(s_pid, sizeof(s_pid), "%d", (int)getpid());
 324                 rb_setenv("CTL_PPID", s_pid, 1);
 325 #ifdef _WIN32
 326                 SetHandleInformation((HANDLE) rb_get_fd(F2), HANDLE_FLAG_INHERIT, 1);
 327                 SetHandleInformation((HANDLE) rb_get_fd(P1), HANDLE_FLAG_INHERIT, 1);
 328 #endif
 329
 330                 pid = rb_spawn_process(ssld_path, (const char **) parv);
 331                 if(pid == -1)
 332                 {
 333                         ilog(L_MAIN, "Unable to create ssld: %s\n", strerror(errno));
 334                         rb_close(F1);
 335                         rb_close(F2);
 336                         rb_close(P1);
 337                         rb_close(P2);
 338                         return started;
 339                 }
 340                 started++;
 341                 rb_close(F2);
 342                 rb_close(P1);
 343                 ctl = allocate_ssl_daemon(F1, P2, pid);
 344                 if(ssl_ok)
 345                 {
 346                         send_init_prng(ctl, RB_PRNG_DEFAULT, NULL);
 347                         send_certfp_method(ctl, ConfigFileEntry.certfp_method);
 348
 349                         if(ssl_cert != NULL && ssl_private_key != NULL)
 350                                 send_new_ssl_certs_one(ctl, ssl_cert, ssl_private_key,
 351                                                        ssl_dh_params != NULL ? ssl_dh_params : "",
 352                                                        ssl_cipher_list != NULL ? ssl_cipher_list : "");
 353                 }
 354                 ssl_read_ctl(ctl->F, ctl);
 355                 ssl_do_pipe(P2, ctl);
 356
 357         }
 358         return started;
 359 }
 360
 361 static void
 362 ssl_process_zipstats(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf)
 363 {
 364         struct Client *server;
 365         struct ZipStats *zips;
 366         char *parv[7];
 367         (void) rb_string_to_array(ctl_buf->buf, parv, 6);
 368         server = find_server(NULL, parv[1]);
 369         if(server == NULL || server->localClient == NULL || !IsCapable(server, CAP_ZIP))
 370                 return;
 371         if(server->localClient->zipstats == NULL)
 372                 server->localClient->zipstats = rb_malloc(sizeof(struct ZipStats));
 373
 374         zips = server->localClient->zipstats;
 375
 376         zips->in += strtoull(parv[2], NULL, 10);
 377         zips->in_wire += strtoull(parv[3], NULL, 10);
 378         zips->out += strtoull(parv[4], NULL, 10);
 379         zips->out_wire += strtoull(parv[5], NULL, 10);
 380
 381         if(zips->in > 0)
 382                 zips->in_ratio = ((double) (zips->in - zips->in_wire) / (double) zips->in) * 100.00;
 383         else
 384                 zips->in_ratio = 0;
 385
 386         if(zips->out > 0)
 387                 zips->out_ratio = ((double) (zips->out - zips->out_wire) / (double) zips->out) * 100.00;
 388         else
 389                 zips->out_ratio = 0;
 390 }
 391
 392 static void
 393 ssl_process_dead_fd(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf)
 394 {
 395         struct Client *client_p;
 396         char reason[256];
 397         uint32_t fd;
 398
 399         if(ctl_buf->buflen < 6)
 400                 return;         /* bogus message..drop it.. XXX should warn here */
 401
 402         fd = buf_to_uint32(&ctl_buf->buf[1]);
 403         rb_strlcpy(reason, &ctl_buf->buf[5], sizeof(reason));
 404         client_p = find_cli_connid_hash(fd);
 405         if(client_p == NULL)
 406                 return;
 407         if(IsAnyServer(client_p) || IsRegistered(client_p))
 408         {
 409                 /* read any last moment ERROR, QUIT or the like -- jilles */
 410                 if (!strcmp(reason, "Remote host closed the connection"))
 411                         read_packet(client_p->localClient->F, client_p);
 412                 if (IsAnyDead(client_p))
 413                         return;
 414         }
 415         if(IsAnyServer(client_p))
 416         {
 417                 sendto_realops_snomask(SNO_GENERAL, is_remote_connect(client_p) && !IsServer(client_p) ? L_NETWIDE : L_ALL, "ssld error for %s: %s", client_p->name, reason);
 418                 ilog(L_SERVER, "ssld error for %s: %s", log_client_name(client_p, SHOW_IP), reason);
 419         }
 420         exit_client(client_p, client_p, &me, reason);
 421 }
 422
 423
 424 static void
 425 ssl_process_cipher_string(ssl_ctl_t *ctl, ssl_ctl_buf_t *ctl_buf)
 426 {
 427         struct Client *client_p;
 428         const char *cstring;
 429         uint32_t fd;
 430
 431         if(ctl_buf->buflen < 6)
 432                 return;         /* bogus message..drop it.. XXX should warn here */
 433
 434         fd = buf_to_uint32(&ctl_buf->buf[1]);
 435         cstring = (const char *)&ctl_buf->buf[5];
 436
 437         if(EmptyString(cstring))
 438                 return;
 439
 440         client_p = find_cli_connid_hash(fd);
 441         if(client_p != NULL && client_p->localClient != NULL)
 442         {
 443                 rb_free(client_p->localClient->cipher_string);
 444                 client_p->localClient->cipher_string = rb_strdup(cstring);
 445         }
 446 }
 447
 448
 449 static void
 450 ssl_process_certfp(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf)
 451 {
 452         struct Client *client_p;
 453         uint32_t fd;
 454         uint32_t len;
 455         uint8_t *certfp;
 456         char *certfp_string;
 457         int i;
 458
 459         if(ctl_buf->buflen > 5 + RB_SSL_CERTFP_LEN)
 460                 return;         /* bogus message..drop it.. XXX should warn here */
 461
 462         fd = buf_to_uint32(&ctl_buf->buf[1]);
 463         len = buf_to_uint32(&ctl_buf->buf[5]);
 464         certfp = (uint8_t *)&ctl_buf->buf[9];
 465         client_p = find_cli_connid_hash(fd);
 466         if(client_p == NULL)
 467                 return;
 468         rb_free(client_p->certfp);
 469         certfp_string = rb_malloc(len * 2 + 1);
 470         for(i = 0; i < len; i++)
 471                 snprintf(certfp_string + 2 * i, 3, "%02x",
 472                                 certfp[i]);
 473         client_p->certfp = certfp_string;
 474 }
 475
 476 static void
 477 ssl_process_cmd_recv(ssl_ctl_t * ctl)
 478 {
 479         static const char *cannot_setup_ssl = "ssld cannot setup ssl, check your certificates and private key";
 480         static const char *no_ssl_or_zlib = "ssld has neither SSL/TLS or zlib support killing all sslds";
 481         rb_dlink_node *ptr, *next;
 482         ssl_ctl_buf_t *ctl_buf;
 483         int len;
 484
 485         if(ctl->dead)
 486                 return;
 487
 488         RB_DLINK_FOREACH_SAFE(ptr, next, ctl->readq.head)
 489         {
 490                 ctl_buf = ptr->data;
 491                 switch (*ctl_buf->buf)
 492                 {
 493                 case 'N':
 494                         ssl_ok = 0;     /* ssld says it can't do ssl/tls */
 495                         break;
 496                 case 'D':
 497                         ssl_process_dead_fd(ctl, ctl_buf);
 498                         break;
 499                 case 'C':
 500                         ssl_process_cipher_string(ctl, ctl_buf);
 501                         break;
 502                 case 'F':
 503                         ssl_process_certfp(ctl, ctl_buf);
 504                         break;
 505                 case 'S':
 506                         ssl_process_zipstats(ctl, ctl_buf);
 507                         break;
 508                 case 'I':
 509                         ssl_ok = 0;
 510                         ilog(L_MAIN, "%s", cannot_setup_ssl);
 511                         sendto_realops_snomask(SNO_GENERAL, L_ALL, "%s", cannot_setup_ssl);
 512                         break;
 513                 case 'U':
 514                         zlib_ok = 0;
 515                         ssl_ok = 0;
 516                         ilog(L_MAIN, "%s", no_ssl_or_zlib);
 517                         sendto_realops_snomask(SNO_GENERAL, L_ALL, "%s", no_ssl_or_zlib);
 518                         ssl_killall();
 519                         break;
 520                 case 'V':
 521                         len = ctl_buf->buflen - 1;
 522                         if (len > sizeof(ctl->version) - 1)
 523                                 len = sizeof(ctl->version) - 1;
 524                         strncpy(ctl->version, &ctl_buf->buf[1], len);
 525                 case 'z':
 526                         zlib_ok = 0;
 527                         break;
 528                 default:
 529                         ilog(L_MAIN, "Received invalid command from ssld: %s", ctl_buf->buf);
 530                         sendto_realops_snomask(SNO_GENERAL, L_ALL, "Received invalid command from ssld");
 531                         break;
 532                 }
 533                 rb_dlinkDelete(ptr, &ctl->readq);
 534                 rb_free(ctl_buf->buf);
 535                 rb_free(ctl_buf);
 536         }
 537
 538 }
 539
 540
 541 static void
 542 ssl_read_ctl(rb_fde_t * F, void *data)
 543 {
 544         ssl_ctl_buf_t *ctl_buf;
 545         ssl_ctl_t *ctl = data;
 546         int retlen;
 547
 548         if(ctl->dead)
 549                 return;
 550         do
 551         {
 552                 ctl_buf = rb_malloc(sizeof(ssl_ctl_buf_t));
 553                 ctl_buf->buf = rb_malloc(READSIZE);
 554                 retlen = rb_recv_fd_buf(ctl->F, ctl_buf->buf, READSIZE, ctl_buf->F, 4);
 555                 ctl_buf->buflen = retlen;
 556                 if(retlen <= 0)
 557                 {
 558                         rb_free(ctl_buf->buf);
 559                         rb_free(ctl_buf);
 560                 }
 561                 else
 562                         rb_dlinkAddTail(ctl_buf, &ctl_buf->node, &ctl->readq);
 563         }
 564         while(retlen > 0);
 565
 566         if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno)))
 567         {
 568                 ssl_dead(ctl);
 569                 return;
 570         }
 571         ssl_process_cmd_recv(ctl);
 572         rb_setselect(ctl->F, RB_SELECT_READ, ssl_read_ctl, ctl);
 573 }
 574
 575 static ssl_ctl_t *
 576 which_ssld(void)
 577 {
 578         ssl_ctl_t *ctl, *lowest = NULL;
 579         rb_dlink_node *ptr;
 580
 581         RB_DLINK_FOREACH(ptr, ssl_daemons.head)
 582         {
 583                 ctl = ptr->data;
 584                 if(ctl->dead)
 585                         continue;
 586                 if(ctl->shutdown)
 587                         continue;
 588                 if(lowest == NULL)
 589                 {
 590                         lowest = ctl;
 591                         continue;
 592                 }
 593                 if(ctl->cli_count < lowest->cli_count)
 594                         lowest = ctl;
 595         }
 596         return (lowest);
 597 }
 598
 599 static void
 600 ssl_write_ctl(rb_fde_t * F, void *data)
 601 {
 602         ssl_ctl_t *ctl = data;
 603         ssl_ctl_buf_t *ctl_buf;
 604         rb_dlink_node *ptr, *next;
 605         int retlen, x;
 606
 607         if(ctl->dead)
 608                 return;
 609
 610         RB_DLINK_FOREACH_SAFE(ptr, next, ctl->writeq.head)
 611         {
 612                 ctl_buf = ptr->data;
 613                 /* in theory unix sock_dgram shouldn't ever short write this.. */
 614                 retlen = rb_send_fd_buf(ctl->F, ctl_buf->F, ctl_buf->nfds, ctl_buf->buf, ctl_buf->buflen, ctl->pid);
 615                 if(retlen > 0)
 616                 {
 617                         rb_dlinkDelete(ptr, &ctl->writeq);
 618                         for(x = 0; x < ctl_buf->nfds; x++)
 619                                 rb_close(ctl_buf->F[x]);
 620                         rb_free(ctl_buf->buf);
 621                         rb_free(ctl_buf);
 622
 623                 }
 624                 if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno)))
 625                 {
 626                         ssl_dead(ctl);
 627                         return;
 628                 }
 629                 else
 630                 {
 631                         rb_setselect(ctl->F, RB_SELECT_WRITE, ssl_write_ctl, ctl);
 632                 }
 633         }
 634 }
 635
 636 static void
 637 ssl_cmd_write_queue(ssl_ctl_t * ctl, rb_fde_t ** F, int count, const void *buf, size_t buflen)
 638 {
 639         ssl_ctl_buf_t *ctl_buf;
 640         int x;
 641
 642         /* don't bother */
 643         if(ctl->dead)
 644                 return;
 645
 646         ctl_buf = rb_malloc(sizeof(ssl_ctl_buf_t));
 647         ctl_buf->buf = rb_malloc(buflen);
 648         memcpy(ctl_buf->buf, buf, buflen);
 649         ctl_buf->buflen = buflen;
 650
 651         for(x = 0; x < count && x < MAXPASSFD; x++)
 652         {
 653                 ctl_buf->F[x] = F[x];
 654         }
 655         ctl_buf->nfds = count;
 656         rb_dlinkAddTail(ctl_buf, &ctl_buf->node, &ctl->writeq);
 657         ssl_write_ctl(ctl->F, ctl);
 658 }
 659
 660
 661 static void
 662 send_new_ssl_certs_one(ssl_ctl_t * ctl, const char *ssl_cert, const char *ssl_private_key, const char *ssl_dh_params, const char *ssl_cipher_list)
 663 {
 664         size_t len;
 665
 666         len = strlen(ssl_cert) + strlen(ssl_private_key) + strlen(ssl_dh_params) + 5;
 667         if(len > sizeof(tmpbuf))
 668         {
 669                 sendto_realops_snomask(SNO_GENERAL, L_ALL,
 670                                        "Parameters for send_new_ssl_certs_one too long (%zu > %zu) to pass to ssld, not sending...",
 671                                        len, sizeof(tmpbuf));
 672                 ilog(L_MAIN,
 673                      "Parameters for send_new_ssl_certs_one too long (%zu > %zu) to pass to ssld, not sending...",
 674                      len, sizeof(tmpbuf));
 675                 return;
 676         }
 677         len = snprintf(tmpbuf, sizeof(tmpbuf), "K%c%s%c%s%c%s%c%s%c", nul, ssl_cert, nul,
 678                           ssl_private_key, nul, ssl_dh_params, nul,
 679                           ssl_cipher_list != NULL ? ssl_cipher_list : "", nul);
 680         ssl_cmd_write_queue(ctl, NULL, 0, tmpbuf, len);
 681 }
 682
 683 static void
 684 send_init_prng(ssl_ctl_t * ctl, prng_seed_t seedtype, const char *path)
 685 {
 686         size_t len;
 687         const char *s;
 688         uint8_t seed = (uint8_t) seedtype;
 689
 690         if(path == NULL)
 691                 s = "";
 692         else
 693                 s = path;
 694
 695         len = strlen(s) + 3;
 696         if(len > sizeof(tmpbuf))
 697         {
 698                 sendto_realops_snomask(SNO_GENERAL, L_ALL,
 699                                        "Parameters for send_init_prng too long (%zd > %zd) to pass to ssld, not sending...",
 700                                        len, sizeof(tmpbuf));
 701                 ilog(L_MAIN,
 702                      "Parameters for send_init_prng too long (%zd > %zd) to pass to ssld, not sending...",
 703                      len, sizeof(tmpbuf));
 704                 return;
 705
 706         }
 707         len = snprintf(tmpbuf, sizeof(tmpbuf), "I%c%s%c", seed, s, nul);
 708         ssl_cmd_write_queue(ctl, NULL, 0, tmpbuf, len);
 709 }
 710
 711 static void
 712 send_certfp_method(ssl_ctl_t *ctl, int method)
 713 {
 714         char buf[5];
 715
 716         buf[0] = 'F';
 717         uint32_to_buf(&buf[1], method);
 718         ssl_cmd_write_queue(ctl, NULL, 0, buf, sizeof(buf));
 719 }
 720
 721 void
 722 send_new_ssl_certs(const char *ssl_cert, const char *ssl_private_key, const char *ssl_dh_params, const char *ssl_cipher_list)
 723 {
 724         rb_dlink_node *ptr;
 725         if(ssl_cert == NULL || ssl_private_key == NULL || ssl_dh_params == NULL)
 726         {
 727                 ssl_ok = 0;
 728                 return;
 729         }
 730         RB_DLINK_FOREACH(ptr, ssl_daemons.head)
 731         {
 732                 ssl_ctl_t *ctl = ptr->data;
 733                 send_new_ssl_certs_one(ctl, ssl_cert, ssl_private_key, ssl_dh_params, ssl_cipher_list);
 734         }
 735 }
 736
 737
 738 ssl_ctl_t *
 739 start_ssld_accept(rb_fde_t * sslF, rb_fde_t * plainF, uint32_t id)
 740 {
 741         rb_fde_t *F[2];
 742         ssl_ctl_t *ctl;
 743         char buf[5];
 744         F[0] = sslF;
 745         F[1] = plainF;
 746
 747         buf[0] = 'A';
 748         uint32_to_buf(&buf[1], id);
 749         ctl = which_ssld();
 750         if(!ctl)
 751                 return NULL;
 752         ctl->cli_count++;
 753         ssl_cmd_write_queue(ctl, F, 2, buf, sizeof(buf));
 754         return ctl;
 755 }
 756
 757 ssl_ctl_t *
 758 start_ssld_connect(rb_fde_t * sslF, rb_fde_t * plainF, uint32_t id)
 759 {
 760         rb_fde_t *F[2];
 761         ssl_ctl_t *ctl;
 762         char buf[5];
 763         F[0] = sslF;
 764         F[1] = plainF;
 765
 766         buf[0] = 'C';
 767         uint32_to_buf(&buf[1], id);
 768
 769         ctl = which_ssld();
 770         if(!ctl)
 771                 return NULL;
 772         ctl->cli_count++;
 773         ssl_cmd_write_queue(ctl, F, 2, buf, sizeof(buf));
 774         return ctl;
 775 }
 776
 777 void
 778 ssld_decrement_clicount(ssl_ctl_t * ctl)
 779 {
 780         if(ctl == NULL)
 781                 return;
 782
 783         ctl->cli_count--;
 784         if(ctl->shutdown && !ctl->cli_count)
 785         {
 786                 ctl->dead = 1;
 787                 rb_kill(ctl->pid, SIGKILL);
 788         }
 789         if(ctl->dead && !ctl->cli_count)
 790         {
 791                 free_ssl_daemon(ctl);
 792         }
 793 }
 794
 795 /*
 796  * what we end up sending to the ssld process for ziplinks is the following
 797  * Z[ourfd][level][RECVQ]
 798  * Z = ziplinks command = buf[0]
 799  * ourfd = Our end of the socketpair = buf[1..4]
 800  * level = zip level buf[5]
 801  * recvqlen = our recvq len = buf[6-7]
 802  * recvq = any data we read prior to starting ziplinks
 803  */
 804 void
 805 start_zlib_session(void *data)
 806 {
 807         struct Client *server = (struct Client *) data;
 808         uint16_t recvqlen;
 809         uint8_t level;
 810         void *xbuf;
 811
 812         rb_fde_t *F[2];
 813         rb_fde_t *xF1, *xF2;
 814         char *buf;
 815         char buf2[9];
 816         void *recvq_start;
 817
 818         size_t hdr = (sizeof(uint8_t) * 2) + sizeof(uint32_t);
 819         size_t len;
 820         int cpylen, left;
 821
 822         server->localClient->event = NULL;
 823
 824         recvqlen = rb_linebuf_len(&server->localClient->buf_recvq);
 825
 826         len = recvqlen + hdr;
 827
 828         if(len > READBUF_SIZE)
 829         {
 830                 sendto_realops_snomask(SNO_GENERAL, L_ALL,
 831                                        "ssld - attempted to pass message of %zd len, max len %d, giving up",
 832                                        len, READBUF_SIZE);
 833                 ilog(L_MAIN, "ssld - attempted to pass message of %zd len, max len %d, giving up", len, READBUF_SIZE);
 834                 exit_client(server, server, server, "ssld readbuf exceeded");
 835                 return;
 836         }
 837
 838         buf = rb_malloc(len);
 839         level = ConfigFileEntry.compression_level;
 840
 841         uint32_to_buf(&buf[1], rb_get_fd(server->localClient->F));
 842         buf[5] = (char) level;
 843
 844         recvq_start = &buf[6];
 845         server->localClient->zipstats = rb_malloc(sizeof(struct ZipStats));
 846
 847         xbuf = recvq_start;
 848         left = recvqlen;
 849
 850         do
 851         {
 852                 cpylen = rb_linebuf_get(&server->localClient->buf_recvq, xbuf, left, LINEBUF_PARTIAL, LINEBUF_RAW);
 853                 left -= cpylen;
 854                 xbuf = (void *) (((uintptr_t) xbuf) + cpylen);
 855         }
 856         while(cpylen > 0);
 857
 858         /* Pass the socket to ssld. */
 859         *buf = 'Z';
 860         if(rb_socketpair(AF_UNIX, SOCK_STREAM, 0, &xF1, &xF2, "Initial zlib socketpairs") == -1)
 861         {
 862                 sendto_realops_snomask(SNO_GENERAL, L_ALL, "Error creating zlib socketpair - %s", strerror(errno));
 863                 ilog(L_MAIN, "Error creating zlib socketpairs - %s", strerror(errno));
 864                 exit_client(server, server, server, "Error creating zlib socketpair");
 865                 rb_free(buf);
 866                 return;
 867         }
 868
 869         if(IsSSL(server))
 870         {
 871                 /* tell ssld the new connid for the ssl part*/
 872                 buf2[0] = 'Y';
 873                 uint32_to_buf(&buf2[1], rb_get_fd(server->localClient->F));
 874                 uint32_to_buf(&buf2[5], rb_get_fd(xF2));
 875                 ssl_cmd_write_queue(server->localClient->ssl_ctl, NULL, 0, buf2, sizeof(buf2));
 876         }
 877
 878
 879         F[0] = server->localClient->F;
 880         F[1] = xF1;
 881         del_from_zconnid_hash(server);
 882         server->localClient->F = xF2;
 883         /* need to redo as what we did before isn't valid now */
 884         uint32_to_buf(&buf[1], server->localClient->zconnid);
 885         add_to_zconnid_hash(server);
 886
 887         server->localClient->z_ctl = which_ssld();
 888         if(!server->localClient->z_ctl)
 889         {
 890                 exit_client(server, server, server, "Error finding available ssld");
 891                 rb_free(buf);
 892                 return;
 893         }
 894         server->localClient->z_ctl->cli_count++;
 895         ssl_cmd_write_queue(server->localClient->z_ctl, F, 2, buf, len);
 896         rb_free(buf);
 897 }
 898
 899 static void
 900 collect_zipstats(void *unused)
 901 {
 902         rb_dlink_node *ptr;
 903         struct Client *target_p;
 904         char buf[sizeof(uint8_t) + sizeof(uint32_t) + HOSTLEN];
 905         void *odata;
 906         size_t len;
 907         uint32_t id;
 908
 909         buf[0] = 'S';
 910         odata = buf + sizeof(uint8_t) + sizeof(uint32_t);
 911
 912         RB_DLINK_FOREACH(ptr, serv_list.head)
 913         {
 914                 target_p = ptr->data;
 915                 if(IsCapable(target_p, CAP_ZIP))
 916                 {
 917                         len = sizeof(uint8_t) + sizeof(uint32_t);
 918
 919                         id = rb_get_fd(target_p->localClient->F);
 920                         uint32_to_buf(&buf[1], id);
 921                         rb_strlcpy(odata, target_p->name, (sizeof(buf) - len));
 922                         len += strlen(odata) + 1;       /* Get the \0 as well */
 923                         ssl_cmd_write_queue(target_p->localClient->z_ctl, NULL, 0, buf, len);
 924                 }
 925         }
 926 }
 927
 928 static void
 929 cleanup_dead_ssl(void *unused)
 930 {
 931         rb_dlink_node *ptr, *next;
 932         ssl_ctl_t *ctl;
 933         RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head)
 934         {
 935                 ctl = ptr->data;
 936                 if(ctl->dead && !ctl->cli_count)
 937                 {
 938                         free_ssl_daemon(ctl);
 939                 }
 940         }
 941 }
 942
 943 int
 944 get_ssld_count(void)
 945 {
 946         return ssld_count;
 947 }
 948
 949 void
 950 ssld_foreach_info(void (*func)(void *data, pid_t pid, int cli_count, enum ssld_status status, const char *version), void *data)
 951 {
 952         rb_dlink_node *ptr, *next;
 953         ssl_ctl_t *ctl;
 954         RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head)
 955         {
 956                 ctl = ptr->data;
 957                 func(data, ctl->pid, ctl->cli_count,
 958                         ctl->dead ? SSLD_DEAD :
 959                                 (ctl->shutdown ? SSLD_SHUTDOWN : SSLD_ACTIVE),
 960                         ctl->version);
 961         }
 962 }
 963
 964 void
 965 init_ssld(void)
 966 {
 967         rb_event_addish("collect_zipstats", collect_zipstats, NULL, ZIPSTATS_TIME);
 968         rb_event_addish("cleanup_dead_ssld", cleanup_dead_ssl, NULL, 60);
 969 }