src/sslproc.c

   1 /*
   2  *  sslproc.c: An interface to ssld
   3  *  Copyright (C) 2007 Aaron Sethman <androsyn@ratbox.org>
   4  *  Copyright (C) 2007 ircd-ratbox development team
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 2 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, write to the Free Software
  18  *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301
  19  *  USA
  20  *
  21  *  $Id$
  22  */
  23
  24 #include <ratbox_lib.h>
  25 #include "stdinc.h"
  26
  27
  28 #include "s_conf.h"
  29 #include "logger.h"
  30 #include "listener.h"
  31 #include "sslproc.h"
  32 #include "s_serv.h"
  33 #include "ircd.h"
  34 #include "hash.h"
  35 #include "client.h"
  36 #include "send.h"
  37 #include "packet.h"
  38
  39 #define ZIPSTATS_TIME           60
  40
  41 static void collect_zipstats(void *unused);
  42 static void ssl_read_ctl(rb_fde_t * F, void *data);
  43 static int ssld_count;
  44
  45 static char tmpbuf[READBUF_SIZE];
  46 static char nul = '\0';
  47
  48 #define MAXPASSFD 4
  49 #define READSIZE 1024
  50 typedef struct _ssl_ctl_buf
  51 {
  52         rb_dlink_node node;
  53         char *buf;
  54         size_t buflen;
  55         rb_fde_t *F[MAXPASSFD];
  56         int nfds;
  57 } ssl_ctl_buf_t;
  58
  59
  60 struct _ssl_ctl
  61 {
  62         rb_dlink_node node;
  63         int cli_count;
  64         rb_fde_t *F;
  65         rb_fde_t *P;
  66         pid_t pid;
  67         rb_dlink_list readq;
  68         rb_dlink_list writeq;
  69         uint8_t dead;
  70 };
  71
  72 static void send_new_ssl_certs_one(ssl_ctl_t * ctl, const char *ssl_cert,
  73                                    const char *ssl_private_key, const char *ssl_dh_params);
  74 static void send_init_prng(ssl_ctl_t * ctl, prng_seed_t seedtype, const char *path);
  75
  76
  77 static rb_dlink_list ssl_daemons;
  78
  79 static inline int32_t
  80 buf_to_int32(char *buf)
  81 {
  82         int32_t x;
  83         memcpy(&x, buf, sizeof(x));
  84         return x;
  85 }
  86
  87 static inline void
  88 int32_to_buf(char *buf, int32_t x)
  89 {
  90         memcpy(buf, &x, sizeof(x));
  91         return;
  92 }
  93
  94
  95 static inline uint16_t
  96 buf_to_uint16(char *buf)
  97 {
  98         uint16_t x;
  99         memcpy(&x, buf, sizeof(x));
 100         return x;
 101 }
 102
 103 static inline void
 104 uint16_to_buf(char *buf, uint16_t x)
 105 {
 106         memcpy(buf, &x, sizeof(x));
 107         return;
 108 }
 109
 110
 111 static ssl_ctl_t *
 112 allocate_ssl_daemon(rb_fde_t * F, rb_fde_t * P, int pid)
 113 {
 114         ssl_ctl_t *ctl;
 115
 116         if(F == NULL || pid < 0)
 117                 return NULL;
 118         ctl = rb_malloc(sizeof(ssl_ctl_t));
 119         ctl->F = F;
 120         ctl->P = P;
 121         ctl->pid = pid;
 122         ssld_count++;
 123         rb_dlinkAdd(ctl, &ctl->node, &ssl_daemons);
 124         return ctl;
 125 }
 126
 127 static void
 128 free_ssl_daemon(ssl_ctl_t * ctl)
 129 {
 130         rb_dlink_node *ptr;
 131         ssl_ctl_buf_t *ctl_buf;
 132         int x;
 133         if(ctl->cli_count)
 134                 return;
 135
 136         RB_DLINK_FOREACH(ptr, ctl->readq.head)
 137         {
 138                 ctl_buf = ptr->data;
 139                 for(x = 0; x < ctl_buf->nfds; x++)
 140                         rb_close(ctl_buf->F[x]);
 141
 142                 rb_free(ctl_buf->buf);
 143                 rb_free(ctl_buf);
 144         }
 145
 146         RB_DLINK_FOREACH(ptr, ctl->writeq.head)
 147         {
 148                 ctl_buf = ptr->data;
 149                 for(x = 0; x < ctl_buf->nfds; x++)
 150                         rb_close(ctl_buf->F[x]);
 151
 152                 rb_free(ctl_buf->buf);
 153                 rb_free(ctl_buf);
 154         }
 155         rb_close(ctl->F);
 156         rb_close(ctl->P);
 157         rb_dlinkDelete(&ctl->node, &ssl_daemons);
 158         rb_free(ctl);
 159 }
 160
 161 static char *ssld_path;
 162
 163 static int ssld_spin_count = 0;
 164 static time_t last_spin;
 165 static int ssld_wait = 0;
 166
 167
 168 static void
 169 ssl_killall(void)
 170 {
 171         rb_dlink_node *ptr, *next;
 172         ssl_ctl_t *ctl;
 173         RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head)
 174         {
 175                 ctl = ptr->data;
 176                 if(ctl->dead)
 177                         continue;
 178                 ctl->dead = 1;
 179                 ssld_count--;
 180                 rb_kill(ctl->pid, SIGKILL);
 181         }
 182 }
 183
 184 static void
 185 ssl_dead(ssl_ctl_t * ctl)
 186 {
 187         if(ctl->dead)
 188                 return;
 189
 190         ctl->dead = 1;
 191         ssld_count--;
 192         rb_kill(ctl->pid, SIGKILL);     /* make sure the process is really gone */
 193         ilog(L_MAIN, "ssld helper died - attempting to restart");
 194         sendto_realops_snomask(SNO_GENERAL, L_ALL, "ssld helper died - attempting to restart");
 195         start_ssldaemon(1, ServerInfo.ssl_cert, ServerInfo.ssl_private_key, ServerInfo.ssl_dh_params);
 196 }
 197
 198 static void
 199 ssl_do_pipe(rb_fde_t * F, void *data)
 200 {
 201         int retlen;
 202         ssl_ctl_t *ctl = data;
 203         retlen = rb_write(F, "0", 1);
 204         if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno)))
 205         {
 206                 ssl_dead(ctl);
 207                 return;
 208         }
 209         rb_setselect(F, RB_SELECT_READ, ssl_do_pipe, data);
 210 }
 211
 212 static void
 213 restart_ssld_event(void *unused)
 214 {
 215         ssld_spin_count = 0;
 216         last_spin = 0;
 217         ssld_wait = 0;
 218         if(ServerInfo.ssld_count > get_ssld_count())
 219         {
 220                 int start = ServerInfo.ssld_count - get_ssld_count();
 221                 ilog(L_MAIN, "Attempting to restart ssld processes");
 222                 sendto_realops_snomask(SNO_GENERAL, L_ALL, "Attempt to restart ssld processes");
 223                 start_ssldaemon(start, ServerInfo.ssl_cert, ServerInfo.ssl_private_key, ServerInfo.ssl_dh_params);
 224         }
 225 }
 226
 227 int
 228 start_ssldaemon(int count, const char *ssl_cert, const char *ssl_private_key, const char *ssl_dh_params)
 229 {
 230         rb_fde_t *F1, *F2;
 231         rb_fde_t *P1, *P2;
 232 #ifdef _WIN32
 233         const char *suffix = ".exe";
 234 #else
 235         const char *suffix = "";
 236 #endif
 237
 238         char fullpath[PATH_MAX + 1];
 239         char fdarg[6];
 240         const char *parv[2];
 241         char buf[128];
 242         char s_pid[10];
 243         pid_t pid;
 244         int started = 0, i;
 245
 246         if(ssld_wait)
 247                 return 0;
 248
 249         if(ssld_spin_count > 20 && (rb_current_time() - last_spin < 5))
 250         {
 251                 ilog(L_MAIN, "ssld helper is spinning - will attempt to restart in 1 minute");
 252                 sendto_realops_snomask(SNO_GENERAL, L_ALL,
 253                                        "ssld helper is spinning - will attempt to restart in 1 minute");
 254                 rb_event_add("restart_ssld_event", restart_ssld_event, NULL, 60);
 255                 ssld_wait = 1;
 256                 return 0;
 257         }
 258
 259         ssld_spin_count++;
 260         last_spin = rb_current_time();
 261
 262         if(ssld_path == NULL)
 263         {
 264                 rb_snprintf(fullpath, sizeof(fullpath), "%s/ssld%s", PKGLIBEXECDIR, suffix);
 265
 266                 if(access(fullpath, X_OK) == -1)
 267                 {
 268                         rb_snprintf(fullpath, sizeof(fullpath), "%s/bin/ssld%s",
 269                                     ConfigFileEntry.dpath, suffix);
 270                         if(access(fullpath, X_OK) == -1)
 271                         {
 272                                 ilog(L_MAIN,
 273                                      "Unable to execute ssld%s in %s or %s/bin",
 274                                      suffix, PKGLIBEXECDIR, ConfigFileEntry.dpath);
 275                                 return 0;
 276                         }
 277                 }
 278                 ssld_path = rb_strdup(fullpath);
 279         }
 280         rb_strlcpy(buf, "-ircd ssld daemon helper", sizeof(buf));
 281         parv[0] = buf;
 282         parv[1] = NULL;
 283
 284         for(i = 0; i < count; i++)
 285         {
 286                 ssl_ctl_t *ctl;
 287                 if(rb_socketpair(AF_UNIX, SOCK_DGRAM, 0, &F1, &F2, "SSL/TLS handle passing socket") == -1)
 288                 {
 289                         ilog(L_MAIN, "Unable to create ssld - rb_socketpair failed: %s", strerror(errno));
 290                         return started;
 291                 }
 292
 293                 rb_set_buffers(F1, READBUF_SIZE);
 294                 rb_set_buffers(F2, READBUF_SIZE);
 295                 rb_snprintf(fdarg, sizeof(fdarg), "%d", rb_get_fd(F2));
 296                 rb_setenv("CTL_FD", fdarg, 1);
 297                 if(rb_pipe(&P1, &P2, "SSL/TLS pipe") == -1)
 298                 {
 299                         ilog(L_MAIN, "Unable to create ssld - rb_pipe failed: %s", strerror(errno));
 300                         return started;
 301                 }
 302                 rb_snprintf(fdarg, sizeof(fdarg), "%d", rb_get_fd(P1));
 303                 rb_setenv("CTL_PIPE", fdarg, 1);
 304                 rb_snprintf(s_pid, sizeof(s_pid), "%d", (int)getpid());
 305                 rb_setenv("CTL_PPID", s_pid, 1);
 306 #ifdef _WIN32
 307                 SetHandleInformation((HANDLE) rb_get_fd(F2), HANDLE_FLAG_INHERIT, 1);
 308                 SetHandleInformation((HANDLE) rb_get_fd(P1), HANDLE_FLAG_INHERIT, 1);
 309 #endif
 310
 311                 pid = rb_spawn_process(ssld_path, (const char **) parv);
 312                 if(pid == -1)
 313                 {
 314                         ilog(L_MAIN, "Unable to create ssld: %s\n", strerror(errno));
 315                         rb_close(F1);
 316                         rb_close(F2);
 317                         rb_close(P1);
 318                         rb_close(P2);
 319                         return started;
 320                 }
 321                 started++;
 322                 rb_close(F2);
 323                 rb_close(P1);
 324                 ctl = allocate_ssl_daemon(F1, P2, pid);
 325                 if(ssl_ok)
 326                 {
 327                         if(ConfigFileEntry.use_egd && (ConfigFileEntry.egdpool_path != NULL))
 328                                 send_init_prng(ctl, RB_PRNG_EGD, ConfigFileEntry.egdpool_path);
 329                         else
 330                                 send_init_prng(ctl, RB_PRNG_DEFAULT, NULL);
 331                 }
 332                 if(ssl_ok && ssl_cert != NULL && ssl_private_key != NULL)
 333                         send_new_ssl_certs_one(ctl, ssl_cert, ssl_private_key,
 334                                                ssl_dh_params != NULL ? ssl_dh_params : "");
 335                 ssl_read_ctl(ctl->F, ctl);
 336                 ssl_do_pipe(P2, ctl);
 337
 338         }
 339         return started;
 340 }
 341
 342 static void
 343 ssl_process_zipstats(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf)
 344 {
 345         struct Client *server;
 346         struct ZipStats *zips;
 347         int parc;
 348         char *parv[7];
 349         parc = rb_string_to_array(ctl_buf->buf, parv, 6);
 350         server = find_server(NULL, parv[1]);
 351         if(server == NULL || server->localClient == NULL || !IsCapable(server, CAP_ZIP))
 352                 return;
 353         if(server->localClient->zipstats == NULL)
 354                 server->localClient->zipstats = rb_malloc(sizeof(struct ZipStats));
 355
 356         zips = server->localClient->zipstats;
 357
 358         zips->in += strtoull(parv[2], NULL, 10);
 359         zips->in_wire += strtoull(parv[3], NULL, 10);
 360         zips->out += strtoull(parv[4], NULL, 10);
 361         zips->out_wire += strtoull(parv[5], NULL, 10);
 362
 363         if(zips->in > 0)
 364                 zips->in_ratio = ((double) (zips->in - zips->in_wire) / (double) zips->in) * 100.00;
 365         else
 366                 zips->in_ratio = 0;
 367
 368         if(zips->out > 0)
 369                 zips->out_ratio = ((double) (zips->out - zips->out_wire) / (double) zips->out) * 100.00;
 370         else
 371                 zips->out_ratio = 0;
 372 }
 373
 374 static void
 375 ssl_process_dead_fd(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf)
 376 {
 377         struct Client *client_p;
 378         char reason[256];
 379         int32_t fd;
 380
 381         if(ctl_buf->buflen < 6)
 382                 return;         /* bogus message..drop it.. XXX should warn here */
 383
 384         fd = buf_to_int32(&ctl_buf->buf[1]);
 385         rb_strlcpy(reason, &ctl_buf->buf[5], sizeof(reason));
 386         client_p = find_cli_fd_hash(fd);
 387         if(client_p == NULL)
 388                 return;
 389         if(IsAnyServer(client_p) || IsRegistered(client_p))
 390         {
 391                 /* read any last moment ERROR, QUIT or the like -- jilles */
 392                 if (!strcmp(reason, "Remote host closed the connection"))
 393                         read_packet(client_p->localClient->F, client_p);
 394                 if (IsAnyDead(client_p))
 395                         return;
 396         }
 397         if(IsAnyServer(client_p))
 398         {
 399                 sendto_realops_snomask(SNO_GENERAL, is_remote_connect(client_p) && !IsServer(client_p) ? L_NETWIDE : L_ALL, "ssld error for %s: %s", client_p->name, reason);
 400                 ilog(L_SERVER, "ssld error for %s: %s", log_client_name(client_p, SHOW_IP), reason);
 401         }
 402         exit_client(client_p, client_p, &me, reason);
 403 }
 404
 405 static void
 406 ssl_process_certfp(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf)
 407 {
 408         struct Client *client_p;
 409         int32_t fd;
 410         uint8_t *certfp;
 411         char *certfp_string;
 412         int i;
 413
 414         if(ctl_buf->buflen != 5 + RB_SSL_CERTFP_LEN)
 415                 return;         /* bogus message..drop it.. XXX should warn here */
 416
 417         fd = buf_to_int32(&ctl_buf->buf[1]);
 418         certfp = (uint8_t *)&ctl_buf->buf[5];
 419         client_p = find_cli_fd_hash(fd);
 420         if(client_p == NULL)
 421                 return;
 422         rb_free(client_p->certfp);
 423         certfp_string = rb_malloc(RB_SSL_CERTFP_LEN * 2 + 1);
 424         for(i = 0; i < RB_SSL_CERTFP_LEN; i++)
 425                 rb_snprintf(certfp_string + 2 * i, 3, "%02x",
 426                                 certfp[i]);
 427         client_p->certfp = certfp_string;
 428 }
 429
 430 static void
 431 ssl_process_cmd_recv(ssl_ctl_t * ctl)
 432 {
 433         static const char *cannot_setup_ssl = "ssld cannot setup ssl, check your certificates and private key";
 434         static const char *no_ssl_or_zlib = "ssld has neither SSL/TLS or zlib support killing all sslds";
 435         rb_dlink_node *ptr, *next;
 436         ssl_ctl_buf_t *ctl_buf;
 437         if(ctl->dead)
 438                 return;
 439         RB_DLINK_FOREACH_SAFE(ptr, next, ctl->readq.head)
 440         {
 441                 ctl_buf = ptr->data;
 442                 switch (*ctl_buf->buf)
 443                 {
 444                 case 'N':
 445                         ssl_ok = 0;     /* ssld says it can't do ssl/tls */
 446                         break;
 447                 case 'D':
 448                         ssl_process_dead_fd(ctl, ctl_buf);
 449                         break;
 450                 case 'F':
 451                         ssl_process_certfp(ctl, ctl_buf);
 452                         break;
 453                 case 'S':
 454                         ssl_process_zipstats(ctl, ctl_buf);
 455                         break;
 456                 case 'I':
 457                         ssl_ok = 0;
 458                         ilog(L_MAIN, "%s", cannot_setup_ssl);
 459                         sendto_realops_snomask(SNO_GENERAL, L_ALL, "%s", cannot_setup_ssl);
 460                         break;
 461                 case 'U':
 462                         zlib_ok = 0;
 463                         ssl_ok = 0;
 464                         ilog(L_MAIN, "%s", no_ssl_or_zlib);
 465                         sendto_realops_snomask(SNO_GENERAL, L_ALL, "%s", no_ssl_or_zlib);
 466                         ssl_killall();
 467                         break;
 468                 case 'z':
 469                         zlib_ok = 0;
 470                         break;
 471                 default:
 472                         ilog(L_MAIN, "Received invalid command from ssld: %s", ctl_buf->buf);
 473                         sendto_realops_snomask(SNO_GENERAL, L_ALL, "Received invalid command from ssld");
 474                         break;
 475                 }
 476                 rb_dlinkDelete(ptr, &ctl->readq);
 477                 rb_free(ctl_buf->buf);
 478                 rb_free(ctl_buf);
 479         }
 480
 481 }
 482
 483
 484 static void
 485 ssl_read_ctl(rb_fde_t * F, void *data)
 486 {
 487         ssl_ctl_buf_t *ctl_buf;
 488         ssl_ctl_t *ctl = data;
 489         int retlen;
 490
 491         if(ctl->dead)
 492                 return;
 493         do
 494         {
 495                 ctl_buf = rb_malloc(sizeof(ssl_ctl_buf_t));
 496                 ctl_buf->buf = rb_malloc(READSIZE);
 497                 retlen = rb_recv_fd_buf(ctl->F, ctl_buf->buf, READSIZE, ctl_buf->F, 4);
 498                 ctl_buf->buflen = retlen;
 499                 if(retlen <= 0)
 500                 {
 501                         rb_free(ctl_buf->buf);
 502                         rb_free(ctl_buf);
 503                 }
 504                 else
 505                         rb_dlinkAddTail(ctl_buf, &ctl_buf->node, &ctl->readq);
 506         }
 507         while(retlen > 0);
 508
 509         if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno)))
 510         {
 511                 ssl_dead(ctl);
 512                 return;
 513         }
 514         ssl_process_cmd_recv(ctl);
 515         rb_setselect(ctl->F, RB_SELECT_READ, ssl_read_ctl, ctl);
 516 }
 517
 518 static ssl_ctl_t *
 519 which_ssld(void)
 520 {
 521         ssl_ctl_t *ctl, *lowest = NULL;
 522         rb_dlink_node *ptr;
 523
 524         RB_DLINK_FOREACH(ptr, ssl_daemons.head)
 525         {
 526                 ctl = ptr->data;
 527                 if(ctl->dead)
 528                         continue;
 529                 if(lowest == NULL)
 530                 {
 531                         lowest = ctl;
 532                         continue;
 533                 }
 534                 if(ctl->cli_count < lowest->cli_count)
 535                         lowest = ctl;
 536         }
 537         return (lowest);
 538 }
 539
 540 static void
 541 ssl_write_ctl(rb_fde_t * F, void *data)
 542 {
 543         ssl_ctl_t *ctl = data;
 544         ssl_ctl_buf_t *ctl_buf;
 545         rb_dlink_node *ptr, *next;
 546         int retlen, x;
 547
 548         if(ctl->dead)
 549                 return;
 550
 551         RB_DLINK_FOREACH_SAFE(ptr, next, ctl->writeq.head)
 552         {
 553                 ctl_buf = ptr->data;
 554                 /* in theory unix sock_dgram shouldn't ever short write this.. */
 555                 retlen = rb_send_fd_buf(ctl->F, ctl_buf->F, ctl_buf->nfds, ctl_buf->buf, ctl_buf->buflen, ctl->pid);
 556                 if(retlen > 0)
 557                 {
 558                         rb_dlinkDelete(ptr, &ctl->writeq);
 559                         for(x = 0; x < ctl_buf->nfds; x++)
 560                                 rb_close(ctl_buf->F[x]);
 561                         rb_free(ctl_buf->buf);
 562                         rb_free(ctl_buf);
 563
 564                 }
 565                 if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno)))
 566                 {
 567                         ssl_dead(ctl);
 568                         return;
 569                 }
 570                 else
 571                 {
 572                         rb_setselect(ctl->F, RB_SELECT_WRITE, ssl_write_ctl, ctl);
 573                 }
 574         }
 575 }
 576
 577 static void
 578 ssl_cmd_write_queue(ssl_ctl_t * ctl, rb_fde_t ** F, int count, const void *buf, size_t buflen)
 579 {
 580         ssl_ctl_buf_t *ctl_buf;
 581         int x;
 582
 583         /* don't bother */
 584         if(ctl->dead)
 585                 return;
 586
 587         ctl_buf = rb_malloc(sizeof(ssl_ctl_buf_t));
 588         ctl_buf->buf = rb_malloc(buflen);
 589         memcpy(ctl_buf->buf, buf, buflen);
 590         ctl_buf->buflen = buflen;
 591
 592         for(x = 0; x < count && x < MAXPASSFD; x++)
 593         {
 594                 ctl_buf->F[x] = F[x];
 595         }
 596         ctl_buf->nfds = count;
 597         rb_dlinkAddTail(ctl_buf, &ctl_buf->node, &ctl->writeq);
 598         ssl_write_ctl(ctl->F, ctl);
 599 }
 600
 601
 602 static void
 603 send_new_ssl_certs_one(ssl_ctl_t * ctl, const char *ssl_cert, const char *ssl_private_key, const char *ssl_dh_params)
 604 {
 605         size_t len;
 606
 607         len = strlen(ssl_cert) + strlen(ssl_private_key) + strlen(ssl_dh_params) + 5;
 608         if(len > sizeof(tmpbuf))
 609         {
 610                 sendto_realops_snomask(SNO_GENERAL, L_ALL,
 611                                        "Parameters for send_new_ssl_certs_one too long (%zu > %zu) to pass to ssld, not sending...",
 612                                        len, sizeof(tmpbuf));
 613                 ilog(L_MAIN,
 614                      "Parameters for send_new_ssl_certs_one too long (%zu > %zu) to pass to ssld, not sending...",
 615                      len, sizeof(tmpbuf));
 616                 return;
 617         }
 618         len = rb_snprintf(tmpbuf, sizeof(tmpbuf), "K%c%s%c%s%c%s%c", nul, ssl_cert, nul,
 619                           ssl_private_key, nul, ssl_dh_params, nul);
 620         ssl_cmd_write_queue(ctl, NULL, 0, tmpbuf, len);
 621 }
 622
 623 static void
 624 send_init_prng(ssl_ctl_t * ctl, prng_seed_t seedtype, const char *path)
 625 {
 626         size_t len;
 627         const char *s;
 628         uint8_t seed = (uint8_t) seedtype;
 629
 630         if(path == NULL)
 631                 s = "";
 632         else
 633                 s = path;
 634
 635         len = strlen(s) + 3;
 636         if(len > sizeof(tmpbuf))
 637         {
 638                 sendto_realops_snomask(SNO_GENERAL, L_ALL,
 639                                        "Parameters for send_init_prng too long (%zd > %zd) to pass to ssld, not sending...",
 640                                        len, sizeof(tmpbuf));
 641                 ilog(L_MAIN,
 642                      "Parameters for send_init_prng too long (%zd > %zd) to pass to ssld, not sending...",
 643                      len, sizeof(tmpbuf));
 644                 return;
 645
 646         }
 647         len = rb_snprintf(tmpbuf, sizeof(tmpbuf), "I%c%s%c", seed, s, nul);
 648         ssl_cmd_write_queue(ctl, NULL, 0, tmpbuf, len);
 649 }
 650
 651 void
 652 send_new_ssl_certs(const char *ssl_cert, const char *ssl_private_key, const char *ssl_dh_params)
 653 {
 654         rb_dlink_node *ptr;
 655         if(ssl_cert == NULL || ssl_private_key == NULL || ssl_dh_params == NULL)
 656         {
 657                 ssl_ok = 0;
 658                 return;
 659         }
 660         RB_DLINK_FOREACH(ptr, ssl_daemons.head)
 661         {
 662                 ssl_ctl_t *ctl = ptr->data;
 663                 send_new_ssl_certs_one(ctl, ssl_cert, ssl_private_key, ssl_dh_params);
 664         }
 665 }
 666
 667
 668 ssl_ctl_t *
 669 start_ssld_accept(rb_fde_t * sslF, rb_fde_t * plainF, int32_t id)
 670 {
 671         rb_fde_t *F[2];
 672         ssl_ctl_t *ctl;
 673         char buf[5];
 674         F[0] = sslF;
 675         F[1] = plainF;
 676
 677         buf[0] = 'A';
 678         int32_to_buf(&buf[1], id);
 679         ctl = which_ssld();
 680         ctl->cli_count++;
 681         ssl_cmd_write_queue(ctl, F, 2, buf, sizeof(buf));
 682         return ctl;
 683 }
 684
 685 ssl_ctl_t *
 686 start_ssld_connect(rb_fde_t * sslF, rb_fde_t * plainF, int32_t id)
 687 {
 688         rb_fde_t *F[2];
 689         ssl_ctl_t *ctl;
 690         char buf[5];
 691         F[0] = sslF;
 692         F[1] = plainF;
 693
 694         buf[0] = 'C';
 695         int32_to_buf(&buf[1], id);
 696
 697         ctl = which_ssld();
 698         ctl->cli_count++;
 699         ssl_cmd_write_queue(ctl, F, 2, buf, sizeof(buf));
 700         return ctl;
 701 }
 702
 703 void
 704 ssld_decrement_clicount(ssl_ctl_t * ctl)
 705 {
 706         if(ctl == NULL)
 707                 return;
 708
 709         ctl->cli_count--;
 710         if(ctl->dead && !ctl->cli_count)
 711         {
 712                 free_ssl_daemon(ctl);
 713         }
 714 }
 715
 716 /*
 717  * what we end up sending to the ssld process for ziplinks is the following
 718  * Z[ourfd][level][RECVQ]
 719  * Z = ziplinks command = buf[0]
 720  * ourfd = Our end of the socketpair = buf[1..4]
 721  * level = zip level buf[5]
 722  * recvqlen = our recvq len = buf[6-7]
 723  * recvq = any data we read prior to starting ziplinks
 724  */
 725 void
 726 start_zlib_session(void *data)
 727 {
 728         struct Client *server = (struct Client *) data;
 729         uint16_t recvqlen;
 730         uint8_t level;
 731         void *xbuf;
 732
 733         rb_fde_t *F[2];
 734         rb_fde_t *xF1, *xF2;
 735         char *buf;
 736         char buf2[9];
 737         void *recvq_start;
 738
 739         size_t hdr = (sizeof(uint8_t) * 2) + sizeof(int32_t);
 740         size_t len;
 741         int cpylen, left;
 742
 743         server->localClient->event = NULL;
 744
 745         recvqlen = rb_linebuf_len(&server->localClient->buf_recvq);
 746
 747         len = recvqlen + hdr;
 748
 749         if(len > READBUF_SIZE)
 750         {
 751                 sendto_realops_snomask(SNO_GENERAL, L_ALL,
 752                                        "ssld - attempted to pass message of %zd len, max len %d, giving up",
 753                                        len, READBUF_SIZE);
 754                 ilog(L_MAIN, "ssld - attempted to pass message of %zd len, max len %d, giving up", len, READBUF_SIZE);
 755                 exit_client(server, server, server, "ssld readbuf exceeded");
 756                 return;
 757         }
 758
 759         buf = rb_malloc(len);
 760         level = ConfigFileEntry.compression_level;
 761
 762         int32_to_buf(&buf[1], rb_get_fd(server->localClient->F));
 763         buf[5] = (char) level;
 764
 765         recvq_start = &buf[6];
 766         server->localClient->zipstats = rb_malloc(sizeof(struct ZipStats));
 767
 768         xbuf = recvq_start;
 769         left = recvqlen;
 770
 771         do
 772         {
 773                 cpylen = rb_linebuf_get(&server->localClient->buf_recvq, xbuf, left, LINEBUF_PARTIAL, LINEBUF_RAW);
 774                 left -= cpylen;
 775                 xbuf = (void *) (((uintptr_t) xbuf) + cpylen);
 776         }
 777         while(cpylen > 0);
 778
 779         /* Pass the socket to ssld. */
 780         *buf = 'Z';
 781         if(rb_socketpair(AF_UNIX, SOCK_STREAM, 0, &xF1, &xF2, "Initial zlib socketpairs") == -1)
 782         {
 783                 sendto_realops_snomask(SNO_GENERAL, L_ALL, "Error creating zlib socketpair - %s", strerror(errno));
 784                 ilog(L_MAIN, "Error creating zlib socketpairs - %s", strerror(errno));
 785                 exit_client(server, server, server, "Error creating zlib socketpair");
 786                 return;
 787         }
 788
 789         if(IsSSL(server))
 790         {
 791                 /* tell ssld the new connid for the ssl part*/
 792                 buf2[0] = 'Y';
 793                 int32_to_buf(&buf2[1], rb_get_fd(server->localClient->F));
 794                 int32_to_buf(&buf2[5], rb_get_fd(xF2));
 795                 ssl_cmd_write_queue(server->localClient->ssl_ctl, NULL, 0, buf2, sizeof(buf2));
 796         }
 797
 798
 799         F[0] = server->localClient->F;
 800         F[1] = xF1;
 801         del_from_cli_fd_hash(server);
 802         server->localClient->F = xF2;
 803         /* need to redo as what we did before isn't valid now */
 804         int32_to_buf(&buf[1], rb_get_fd(server->localClient->F));
 805         add_to_cli_fd_hash(server);
 806
 807         server->localClient->z_ctl = which_ssld();
 808         server->localClient->z_ctl->cli_count++;
 809         ssl_cmd_write_queue(server->localClient->z_ctl, F, 2, buf, len);
 810         rb_free(buf);
 811 }
 812
 813 static void
 814 collect_zipstats(void *unused)
 815 {
 816         rb_dlink_node *ptr;
 817         struct Client *target_p;
 818         char buf[sizeof(uint8_t) + sizeof(int32_t) + HOSTLEN];
 819         void *odata;
 820         size_t len;
 821         int32_t id;
 822
 823         buf[0] = 'S';
 824         odata = buf + sizeof(uint8_t) + sizeof(int32_t);
 825
 826         RB_DLINK_FOREACH(ptr, serv_list.head)
 827         {
 828                 target_p = ptr->data;
 829                 if(IsCapable(target_p, CAP_ZIP))
 830                 {
 831                         len = sizeof(uint8_t) + sizeof(uint32_t);
 832
 833                         id = rb_get_fd(target_p->localClient->F);
 834                         int32_to_buf(&buf[1], rb_get_fd(target_p->localClient->F));
 835                         rb_strlcpy(odata, target_p->name, (sizeof(buf) - len));
 836                         len += strlen(odata) + 1;       /* Get the \0 as well */
 837                         ssl_cmd_write_queue(target_p->localClient->z_ctl, NULL, 0, buf, len);
 838                 }
 839         }
 840 }
 841
 842 static void
 843 cleanup_dead_ssl(void *unused)
 844 {
 845         rb_dlink_node *ptr, *next;
 846         ssl_ctl_t *ctl;
 847         RB_DLINK_FOREACH_SAFE(ptr, next, ssl_daemons.head)
 848         {
 849                 ctl = ptr->data;
 850                 if(ctl->dead && !ctl->cli_count)
 851                 {
 852                         free_ssl_daemon(ctl);
 853                 }
 854         }
 855 }
 856
 857 int
 858 get_ssld_count(void)
 859 {
 860         return ssld_count;
 861 }
 862
 863 void
 864 init_ssld(void)
 865 {
 866         rb_event_addish("collect_zipstats", collect_zipstats, NULL, ZIPSTATS_TIME);
 867         rb_event_addish("cleanup_dead_ssld", cleanup_dead_ssl, NULL, 1200);
 868 }