X-Git-Url: https://jfr.im/git/solanum.git/blobdiff_plain/21f715a9a38f5b8db32676a07be6decef5a4fd7a..bfc44622c8d3c9b94e89ee169e0e04d61adcc098:/modules/m_starttls.c

diff --git a/modules/m_starttls.c b/modules/m_starttls.c
index 81c7952a..67f31d15 100644
--- a/modules/m_starttls.c
+++ b/modules/m_starttls.c
@@ -29,32 +29,63 @@
 #include "msg.h"
 #include "modules.h"
 #include "sslproc.h"
+#include "s_assert.h"
+#include "s_serv.h"
+#include "logger.h"
 
-static int mr_starttls(struct Client *, struct Client *, int, const char **);
+static const char starttls_desc[] = "Provides the tls CAP and STARTTLS command";
+
+static void mr_starttls(struct MsgBuf *, struct Client *, struct Client *, int, const char **);
 
 struct Message starttls_msgtab = {
-	"STARTTLS", 0, 0, 0, MFLG_SLOW,
+	"STARTTLS", 0, 0, 0, 0,
 	{{mr_starttls, 0}, mg_ignore, mg_ignore, mg_ignore, mg_ignore, mg_ignore}
 };
 
 mapi_clist_av1 starttls_clist[] = { &starttls_msgtab, NULL };
 
-DECLARE_MODULE_AV1(starttls, NULL, NULL, starttls_clist, NULL, NULL, "$Revision$");
+unsigned int CLICAP_TLS = 0;
+
+#ifdef HAVE_LIBCRYPTO
+mapi_cap_list_av2 starttls_cap_list[] = {
+	{ MAPI_CAP_CLIENT, "tls", NULL, &CLICAP_TLS },
+	{ 0, NULL, NULL, NULL }
+};
+#else /* HAVE_LIBCRYPTO */
+
+mapi_cap_list_av2 starttls_cap_list[] = { { 0, NULL, NULL, NULL } };
+
+#endif /* HAVE_LIBCRYPTO */
+
+DECLARE_MODULE_AV2(starttls, NULL, NULL, starttls_clist, NULL, NULL, starttls_cap_list, NULL, starttls_desc);
 
-static int
-mr_starttls(struct Client *client_p, struct Client *source_p, int parc, const char *parv[])
+static void
+mr_starttls(struct MsgBuf *msgbuf_p, struct Client *client_p, struct Client *source_p, int parc, const char *parv[])
 {
 #ifdef HAVE_LIBCRYPTO
 	ssl_ctl_t *ctl;
 	rb_fde_t *F[2];
 
 	if (!MyConnect(client_p))
-		return 0;
+		return;
+
+	if (IsSSL(client_p))
+	{
+		sendto_one_numeric(client_p, ERR_STARTTLS, form_str(ERR_STARTTLS), "Nested TLS handshake not allowed");
+		return;
+	}
+
+	if (!ircd_ssl_ok || !get_ssld_count())
+	{
+		sendto_one_numeric(client_p, ERR_STARTTLS, form_str(ERR_STARTTLS), "TLS is not configured");
+		return;
+	}
 
 	if (rb_socketpair(AF_UNIX, SOCK_STREAM, 0, &F[0], &F[1], "STARTTLS ssld session") == -1)
 	{
 		ilog_error("error creating SSL/TLS socketpair for ssld slave");
-		return 1;
+		sendto_one_numeric(client_p, ERR_STARTTLS, form_str(ERR_STARTTLS), "Unable to create SSL/TLS socketpair for ssld offload slave");
+		return;
 	}
 
 	s_assert(client_p->localClient != NULL);
@@ -72,9 +103,7 @@ mr_starttls(struct Client *client_p, struct Client *source_p, int parc, const ch
 		client_p->localClient->ssl_ctl = ctl;
 		SetSSL(client_p);
 	}
-	else
-		return 1;
-
-#endif
-	return 0;
+#else /* HAVE_LIBCRYPTO */
+	sendto_one_numeric(client_p, ERR_STARTTLS, form_str(ERR_STARTTLS), "TLS is not configured");
+#endif /* HAVE_LIBCRYPTO */
 }