sslproc: simplify ssl open callback

[solanum.git] / ircd / sslproc.c

diff --git a/ircd/sslproc.c b/ircd/sslproc.c
index 2f92c2b1e7b8137a0cc68be5d86ecc152a7e9ded..8780e1ac4a1e2abd1542e6a7f29fa786c36ddb09 100644 (file)
--- a/ircd/sslproc.c
+++ b/ircd/sslproc.c
@@ -69,8 +69,9 @@ struct _ssl_ctl
        char version[256];
 };
 
+static void ssld_update_config_one(ssl_ctl_t *ctl);
 static void send_new_ssl_certs_one(ssl_ctl_t * ctl);
-static void send_certfp_method(ssl_ctl_t *ctl, int method);
+static void send_certfp_method(ssl_ctl_t *ctl);
 
 
 static rb_dlink_list ssl_daemons;
@@ -337,11 +338,7 @@ start_ssldaemon(int count)
                rb_close(P1);
                ctl = allocate_ssl_daemon(F1, P2, pid);
                if(ircd_ssl_ok)
-               {
-                       send_certfp_method(ctl, ConfigFileEntry.certfp_method);
-                       send_new_ssl_certs_one(ctl);
-
-               }
+                       ssld_update_config_one(ctl);
                ssl_read_ctl(ctl->F, ctl);
                ssl_do_pipe(P2, ctl);
 
@@ -396,13 +393,11 @@ ssl_process_open_fd(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf)
 
        if(client_p->localClient->ssl_callback)
        {
-               CNCB *hdl = client_p->localClient->ssl_callback;
-               void *data = client_p->localClient->ssl_data;
+               SSL_OPEN_CB *hdl = client_p->localClient->ssl_callback;
 
                client_p->localClient->ssl_callback = NULL;
-               client_p->localClient->ssl_data = NULL;
 
-               hdl(client_p->localClient->F, RB_OK, data);
+               hdl(client_p, RB_OK);
        }
 }
 
@@ -431,16 +426,15 @@ ssl_process_dead_fd(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf)
        /* if there is still a pending callback, call it now */
        if(client_p->localClient->ssl_callback)
        {
-               CNCB *hdl = client_p->localClient->ssl_callback;
-               void *data = client_p->localClient->ssl_data;
+               SSL_OPEN_CB *hdl = client_p->localClient->ssl_callback;
 
                client_p->localClient->ssl_callback = NULL;
-               client_p->localClient->ssl_data = NULL;
 
-               hdl(client_p->localClient->F, RB_ERROR_SSL, data);
-
-               /* the callback should have exited the client */
-               return;
+               if (hdl(client_p, RB_ERROR_SSL))
+               {
+                       /* the callback has exited the client */
+                       return;
+               }
        }
 
        if(IsAnyServer(client_p) || IsRegistered(client_p))
@@ -485,23 +479,48 @@ ssl_process_certfp(ssl_ctl_t * ctl, ssl_ctl_buf_t * ctl_buf)
 {
        struct Client *client_p;
        uint32_t fd;
+       uint32_t certfp_method;
        uint32_t len;
        uint8_t *certfp;
        char *certfp_string;
+       const char *method_string;
+       int method_len;
 
-       if(ctl_buf->buflen > 9 + RB_SSL_CERTFP_LEN)
+       if(ctl_buf->buflen > 13 + RB_SSL_CERTFP_LEN)
                return;         /* bogus message..drop it.. XXX should warn here */
 
        fd = buf_to_uint32(&ctl_buf->buf[1]);
-       len = buf_to_uint32(&ctl_buf->buf[5]);
-       certfp = (uint8_t *)&ctl_buf->buf[9];
+       certfp_method = buf_to_uint32(&ctl_buf->buf[5]);
+       len = buf_to_uint32(&ctl_buf->buf[9]);
+       certfp = (uint8_t *)&ctl_buf->buf[13];
        client_p = find_cli_connid_hash(fd);
        if(client_p == NULL)
                return;
+
+       switch (certfp_method) {
+       case RB_SSL_CERTFP_METH_CERT_SHA1:
+       case RB_SSL_CERTFP_METH_CERT_SHA256:
+       case RB_SSL_CERTFP_METH_CERT_SHA512:
+               method_string = "";
+               break;
+
+       /* These names are copied from RFC 7218 */
+       case RB_SSL_CERTFP_METH_SPKI_SHA256:
+               method_string = "SPKI:SHA2-256:";
+               break;
+       case RB_SSL_CERTFP_METH_SPKI_SHA512:
+               method_string = "SPKI:SHA2-512:";
+               break;
+       default:
+               return;
+       }
+       method_len = strlen(method_string);
+
        rb_free(client_p->certfp);
-       certfp_string = rb_malloc(len * 2 + 1);
+       certfp_string = rb_malloc(method_len + len * 2 + 1);
+       strcpy(certfp_string, method_string);
        for(uint32_t i = 0; i < len; i++)
-               snprintf(certfp_string + 2 * i, 3, "%02x",
+               snprintf(certfp_string + method_len + 2 * i, 3, "%02x",
                                certfp[i]);
        client_p->certfp = certfp_string;
 }
@@ -723,15 +742,22 @@ send_new_ssl_certs_one(ssl_ctl_t * ctl)
 }
 
 static void
-send_certfp_method(ssl_ctl_t *ctl, int method)
+send_certfp_method(ssl_ctl_t *ctl)
 {
        char buf[5];
 
        buf[0] = 'F';
-       uint32_to_buf(&buf[1], method);
+       uint32_to_buf(&buf[1], ConfigFileEntry.certfp_method);
        ssl_cmd_write_queue(ctl, NULL, 0, buf, sizeof(buf));
 }
 
+static void
+ssld_update_config_one(ssl_ctl_t *ctl)
+{
+       send_certfp_method(ctl);
+       send_new_ssl_certs_one(ctl);
+}
+
 void
 ssld_update_config(void)
 {
@@ -740,11 +766,10 @@ ssld_update_config(void)
        RB_DLINK_FOREACH(ptr, ssl_daemons.head)
        {
                ssl_ctl_t *ctl = ptr->data;
-               send_new_ssl_certs_one(ctl);
+               ssld_update_config_one(ctl);
        }
 }
 
-
 ssl_ctl_t *
 start_ssld_accept(rb_fde_t * sslF, rb_fde_t * plainF, uint32_t id)
 {