char version[256];
};
+static void ssld_update_config_one(ssl_ctl_t *ctl);
static void send_new_ssl_certs_one(ssl_ctl_t * ctl);
-static void send_certfp_method(ssl_ctl_t *ctl, int method);
+static void send_certfp_method(ssl_ctl_t *ctl);
static rb_dlink_list ssl_daemons;
rb_close(P1);
ctl = allocate_ssl_daemon(F1, P2, pid);
if(ircd_ssl_ok)
- {
- send_certfp_method(ctl, ConfigFileEntry.certfp_method);
- send_new_ssl_certs_one(ctl);
-
- }
+ ssld_update_config_one(ctl);
ssl_read_ctl(ctl->F, ctl);
ssl_do_pipe(P2, ctl);
if(client_p->localClient->ssl_callback)
{
- CNCB *hdl = client_p->localClient->ssl_callback;
- void *data = client_p->localClient->ssl_data;
+ SSL_OPEN_CB *hdl = client_p->localClient->ssl_callback;
client_p->localClient->ssl_callback = NULL;
- client_p->localClient->ssl_data = NULL;
- hdl(client_p->localClient->F, RB_OK, data);
+ hdl(client_p, RB_OK);
}
}
/* if there is still a pending callback, call it now */
if(client_p->localClient->ssl_callback)
{
- CNCB *hdl = client_p->localClient->ssl_callback;
- void *data = client_p->localClient->ssl_data;
+ SSL_OPEN_CB *hdl = client_p->localClient->ssl_callback;
client_p->localClient->ssl_callback = NULL;
- client_p->localClient->ssl_data = NULL;
- hdl(client_p->localClient->F, RB_ERROR_SSL, data);
-
- /* the callback should have exited the client */
- return;
+ if (hdl(client_p, RB_ERROR_SSL))
+ {
+ /* the callback has exited the client */
+ return;
+ }
}
if(IsAnyServer(client_p) || IsRegistered(client_p))
{
struct Client *client_p;
uint32_t fd;
+ uint32_t certfp_method;
uint32_t len;
uint8_t *certfp;
char *certfp_string;
+ const char *method_string;
+ int method_len;
- if(ctl_buf->buflen > 9 + RB_SSL_CERTFP_LEN)
+ if(ctl_buf->buflen > 13 + RB_SSL_CERTFP_LEN)
return; /* bogus message..drop it.. XXX should warn here */
fd = buf_to_uint32(&ctl_buf->buf[1]);
- len = buf_to_uint32(&ctl_buf->buf[5]);
- certfp = (uint8_t *)&ctl_buf->buf[9];
+ certfp_method = buf_to_uint32(&ctl_buf->buf[5]);
+ len = buf_to_uint32(&ctl_buf->buf[9]);
+ certfp = (uint8_t *)&ctl_buf->buf[13];
client_p = find_cli_connid_hash(fd);
if(client_p == NULL)
return;
+
+ switch (certfp_method) {
+ case RB_SSL_CERTFP_METH_CERT_SHA1:
+ case RB_SSL_CERTFP_METH_CERT_SHA256:
+ case RB_SSL_CERTFP_METH_CERT_SHA512:
+ method_string = "";
+ break;
+
+ /* These names are copied from RFC 7218 */
+ case RB_SSL_CERTFP_METH_SPKI_SHA256:
+ method_string = "SPKI:SHA2-256:";
+ break;
+ case RB_SSL_CERTFP_METH_SPKI_SHA512:
+ method_string = "SPKI:SHA2-512:";
+ break;
+ default:
+ return;
+ }
+ method_len = strlen(method_string);
+
rb_free(client_p->certfp);
- certfp_string = rb_malloc(len * 2 + 1);
+ certfp_string = rb_malloc(method_len + len * 2 + 1);
+ strcpy(certfp_string, method_string);
for(uint32_t i = 0; i < len; i++)
- snprintf(certfp_string + 2 * i, 3, "%02x",
+ snprintf(certfp_string + method_len + 2 * i, 3, "%02x",
certfp[i]);
client_p->certfp = certfp_string;
}
}
static void
-send_certfp_method(ssl_ctl_t *ctl, int method)
+send_certfp_method(ssl_ctl_t *ctl)
{
char buf[5];
buf[0] = 'F';
- uint32_to_buf(&buf[1], method);
+ uint32_to_buf(&buf[1], ConfigFileEntry.certfp_method);
ssl_cmd_write_queue(ctl, NULL, 0, buf, sizeof(buf));
}
+static void
+ssld_update_config_one(ssl_ctl_t *ctl)
+{
+ send_certfp_method(ctl);
+ send_new_ssl_certs_one(ctl);
+}
+
void
ssld_update_config(void)
{
RB_DLINK_FOREACH(ptr, ssl_daemons.head)
{
ssl_ctl_t *ctl = ptr->data;
- send_new_ssl_certs_one(ctl);
+ ssld_update_config_one(ctl);
}
}
-
ssl_ctl_t *
start_ssld_accept(rb_fde_t * sslF, rb_fde_t * plainF, uint32_t id)
{