Move quitting of clients to a central Cull List, and do quitting outside userrec and in main loop.

git-svn-id: http://svn.inspircd.org/repository/trunk/inspircd@6497 e03df62e-2008-0410-955e-edbf42e46eb7

1 files changed, 75 insertions, 85 deletions

diff --git a/src/modules/extra/m_ssl_gnutls.cpp b/src/modules/extra/m_ssl_gnutls.cpp
index 04153dc3c..cb88fdf70 100644
--- a/src/modules/extra/m_ssl_gnutls.cpp
+++ b/src/modules/extra/m_ssl_gnutls.cpp
@@ -42,7 +42,7 @@ bool isin(int port, const std::vector<int> &portlist)
 	for(unsigned int i = 0; i < portlist.size(); i++)
 		if(portlist[i] == port)
 			return true;
-			
+
 	return false;
 }
 
@@ -61,41 +61,35 @@ public:
 
 class ModuleSSLGnuTLS : public Module
 {
-	
+
 	ConfigReader* Conf;
 
 	char* dummy;
-	
-	CullList* culllist;
-	
+
 	std::vector<int> listenports;
-	
+
 	int inbufsize;
 	issl_session sessions[MAX_DESCRIPTORS];
-	
+
 	gnutls_certificate_credentials x509_cred;
 	gnutls_dh_params dh_params;
-	
+
 	std::string keyfile;
 	std::string certfile;
 	std::string cafile;
 	std::string crlfile;
 	int dh_bits;
-	
+
  public:
-	
+
 	ModuleSSLGnuTLS(InspIRCd* Me)
 		: Module::Module(Me)
 	{
-		
-
-		culllist = new CullList(ServerInstance);
-
 		ServerInstance->PublishInterface("InspSocketHook", this);
-		
+
 		// Not rehashable...because I cba to reduce all the sizes of existing buffers.
 		inbufsize = ServerInstance->Config->NetBufferSize;
-		
+
 		gnutls_global_init(); // This must be called once in the program
 
 		if(gnutls_certificate_allocate_credentials(&x509_cred) != 0)
@@ -107,25 +101,25 @@ class ModuleSSLGnuTLS : public Module
 
 		// Needs the flag as it ignores a plain /rehash
 		OnRehash(NULL,"ssl");
-		
+
 		// Void return, guess we assume success
 		gnutls_certificate_set_dh_params(x509_cred, dh_params);
 	}
-	
+
 	virtual void OnRehash(userrec* user, const std::string &param)
 	{
 		if(param != "ssl")
 			return;
-	
+
 		Conf = new ConfigReader(ServerInstance);
-		
+
 		for(unsigned int i = 0; i < listenports.size(); i++)
 		{
 			ServerInstance->Config->DelIOHook(listenports[i]);
 		}
-		
+
 		listenports.clear();
-		
+
 		for(int i = 0; i < Conf->Enumerate("bind"); i++)
 		{
 			// For each <bind> tag
@@ -152,46 +146,46 @@ class ModuleSSLGnuTLS : public Module
 				}
 			}
 		}
-		
+
 		std::string confdir(CONFIG_FILE);
 		// +1 so we the path ends with a /
 		confdir = confdir.substr(0, confdir.find_last_of('/') + 1);
-		
+
 		cafile	= Conf->ReadValue("gnutls", "cafile", 0);
 		crlfile	= Conf->ReadValue("gnutls", "crlfile", 0);
 		certfile	= Conf->ReadValue("gnutls", "certfile", 0);
 		keyfile	= Conf->ReadValue("gnutls", "keyfile", 0);
 		dh_bits	= Conf->ReadInteger("gnutls", "dhbits", 0, false);
-		
+
 		// Set all the default values needed.
 		if(cafile == "")
 			cafile = "ca.pem";
-			
+
 		if(crlfile == "")
 			crlfile = "crl.pem";
-			
+
 		if(certfile == "")
 			certfile = "cert.pem";
-			
+
 		if(keyfile == "")
 			keyfile = "key.pem";
-			
+
 		if((dh_bits != 768) && (dh_bits != 1024) && (dh_bits != 2048) && (dh_bits != 3072) && (dh_bits != 4096))
 			dh_bits = 1024;
-			
-		// Prepend relative paths with the path to the config directory.	
+
+		// Prepend relative paths with the path to the config directory.
 		if(cafile[0] != '/')
 			cafile = confdir + cafile;
-		
+
 		if(crlfile[0] != '/')
 			crlfile = confdir + crlfile;
-			
+
 		if(certfile[0] != '/')
 			certfile = confdir + certfile;
-			
+
 		if(keyfile[0] != '/')
 			keyfile = confdir + keyfile;
-		
+
 		int ret;
 
 		if((ret =gnutls_certificate_set_x509_trust_file(x509_cred, cafile.c_str(), GNUTLS_X509_FMT_PEM)) < 0)
@@ -203,45 +197,44 @@ class ModuleSSLGnuTLS : public Module
 		// Guessing on the return value of this, manual doesn't say :|
 		if((ret = gnutls_certificate_set_x509_key_file (x509_cred, certfile.c_str(), keyfile.c_str(), GNUTLS_X509_FMT_PEM)) < 0)
 			ServerInstance->Log(DEFAULT, "m_ssl_gnutls.so: Failed to set X.509 certificate and key files '%s' and '%s': %s", certfile.c_str(), keyfile.c_str(), gnutls_strerror(ret));
-			
+
 		// This may be on a large (once a day or week) timer eventually.
 		GenerateDHParams();
-		
+
 		DELETE(Conf);
 	}
-	
+
 	void GenerateDHParams()
 	{
  		// Generate Diffie Hellman parameters - for use with DHE
 		// kx algorithms. These should be discarded and regenerated
 		// once a day, once a week or once a month. Depending on the
 		// security requirements.
-		
+
 		int ret;
 
 		if((ret = gnutls_dh_params_generate2(dh_params, dh_bits)) < 0)
 			ServerInstance->Log(DEFAULT, "m_ssl_gnutls.so: Failed to generate DH parameters (%d bits): %s", dh_bits, gnutls_strerror(ret));
 	}
-	
+
 	virtual ~ModuleSSLGnuTLS()
 	{
 		gnutls_dh_params_deinit(dh_params);
 		gnutls_certificate_free_credentials(x509_cred);
 		gnutls_global_deinit();
-		delete culllist;
 	}
-	
+
 	virtual void OnCleanup(int target_type, void* item)
 	{
 		if(target_type == TYPE_USER)
 		{
 			userrec* user = (userrec*)item;
-			
+
 			if(user->GetExt("ssl", dummy) && isin(user->GetPort(), listenports))
 			{
 				// User is using SSL, they're a local user, and they're using one of *our* SSL ports.
 				// Potentially there could be multiple SSL modules loaded at once on different ports.
-				culllist->AddItem(user, "SSL module unloading");
+				ServerInstance->GlobalCulls.AddItem(user, "SSL module unloading");
 			}
 			if (user->GetExt("ssl_cert", dummy) && isin(user->GetPort(), listenports))
 			{
@@ -252,14 +245,11 @@ class ModuleSSLGnuTLS : public Module
 			}
 		}
 	}
-	
+
 	virtual void OnUnloadModule(Module* mod, const std::string &name)
 	{
 		if(mod == this)
 		{
-			// We're being unloaded, kill all the users added to the cull list in OnCleanup
-			culllist->Apply();
-			
 			for(unsigned int i = 0; i < listenports.size(); i++)
 			{
 				ServerInstance->Config->DelIOHook(listenports[i]);
@@ -270,7 +260,7 @@ class ModuleSSLGnuTLS : public Module
 			}
 		}
 	}
-	
+
 	virtual Version GetVersion()
 	{
 		return Version(1, 1, 0, 0, VF_VENDOR, API_VERSION);
@@ -327,18 +317,18 @@ class ModuleSSLGnuTLS : public Module
 	virtual void OnRawSocketAccept(int fd, const std::string &ip, int localport)
 	{
 		issl_session* session = &sessions[fd];
-	
+
 		session->fd = fd;
 		session->inbuf = new char[inbufsize];
 		session->inbufoffset = 0;
-	
+
 		gnutls_init(&session->sess, GNUTLS_SERVER);
 
 		gnutls_set_default_priority(session->sess); // Avoid calling all the priority functions, defaults are adequate.
 		gnutls_credentials_set(session->sess, GNUTLS_CRD_CERTIFICATE, x509_cred);
 		gnutls_certificate_server_set_request(session->sess, GNUTLS_CERT_REQUEST); // Request client certificate if any.
 		gnutls_dh_set_prime_bits(session->sess, dh_bits);
-		
+
 		/* This is an experimental change to avoid a warning on 64bit systems about casting between integer and pointer of different sizes
 		 * This needs testing, but it's easy enough to rollback if need be
 		 * Old: gnutls_transport_set_ptr(session->sess, (gnutls_transport_ptr_t) fd); // Give gnutls the fd for the socket.
@@ -346,7 +336,7 @@ class ModuleSSLGnuTLS : public Module
 		 *
 		 * With testing this seems to...not work :/
 		 */
-		
+
 		gnutls_transport_set_ptr(session->sess, (gnutls_transport_ptr_t) fd); // Give gnutls the fd for the socket.
 
 		Handshake(session);
@@ -387,11 +377,11 @@ class ModuleSSLGnuTLS : public Module
 			user->Shrink("ssl_cert");
 		}
 	}
-	
+
 	virtual int OnRawSocketRead(int fd, char* buffer, unsigned int count, int &readresult)
 	{
 		issl_session* session = &sessions[fd];
-		
+
 		if (!session->sess)
 		{
 			readresult = 0;
@@ -402,10 +392,10 @@ class ModuleSSLGnuTLS : public Module
 		if (session->status == ISSL_HANDSHAKING_READ)
 		{
 			// The handshake isn't finished, try to finish it.
-			
+
 			if(!Handshake(session))
 			{
-				// Couldn't resume handshake.	
+				// Couldn't resume handshake.
 				return -1;
 			}
 		}
@@ -413,9 +403,9 @@ class ModuleSSLGnuTLS : public Module
 		{
 			return -1;
 		}
-		
+
 		// If we resumed the handshake then session->status will be ISSL_HANDSHAKEN.
-		
+
 		if (session->status == ISSL_HANDSHAKEN)
 		{
 			// Is this right? Not sure if the unencrypted data is garaunteed to be the same length.
@@ -444,9 +434,9 @@ class ModuleSSLGnuTLS : public Module
 				// Read successfully 'ret' bytes into inbuf + inbufoffset
 				// There are 'ret' + 'inbufoffset' bytes of data in 'inbuf'
 				// 'buffer' is 'count' long
-				
+
 				unsigned int length = ret + session->inbufoffset;
-						
+
 				if(count <= length)
 				{
 					memcpy(buffer, session->inbuf, count);
@@ -470,10 +460,10 @@ class ModuleSSLGnuTLS : public Module
 		}
 		else if(session->status == ISSL_CLOSING)
 			readresult = 0;
-		
+
 		return 1;
 	}
-	
+
 	virtual int OnRawSocketWrite(int fd, const char* buffer, int count)
 	{
 		if (!count)
@@ -503,9 +493,9 @@ class ModuleSSLGnuTLS : public Module
 		int ret = 0;
 
 		if(session->status == ISSL_HANDSHAKEN)
-		{	
+		{
 			ret = gnutls_record_send(session->sess, sendbuffer, count);
-		
+
 			if(ret == 0)
 				CloseSession(session);
 			else if(ret < 0)
@@ -518,13 +508,13 @@ class ModuleSSLGnuTLS : public Module
 				session->outbuf = session->outbuf.substr(ret);
 			}
 		}
-		
+
 		/* Who's smart idea was it to return 1 when we havent written anything?
 		 * This fucks the buffer up in InspSocket :p
 		 */
 		return ret < 1 ? 0 : ret;
 	}
-	
+
 	// :kenny.chatspike.net 320 Om Epy|AFK :is a Secure Connection
 	virtual void OnWhois(userrec* source, userrec* dest)
 	{
@@ -534,7 +524,7 @@ class ModuleSSLGnuTLS : public Module
 			ServerInstance->SendWhoisLine(source, dest, 320, "%s %s :is using a secure connection", source->nick, dest->nick);
 		}
 	}
-	
+
 	virtual void OnSyncUserMetaData(userrec* user, Module* proto, void* opaque, const std::string &extname)
 	{
 		// check if the linking module wants to know about OUR metadata
@@ -549,7 +539,7 @@ class ModuleSSLGnuTLS : public Module
 			}
 		}
 	}
-	
+
 	virtual void OnDecodeMetaData(int target_type, void* target, const std::string &extname, const std::string &extdata)
 	{
 		// check if its our metadata key, and its associated with a user
@@ -563,17 +553,17 @@ class ModuleSSLGnuTLS : public Module
 			}
 		}
 	}
-	
+
 	bool Handshake(issl_session* session)
-	{		
+	{
 		int ret = gnutls_handshake(session->sess);
-      
+
 		if (ret < 0)
 		{
 			if(ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED)
 			{
 				// Handshake needs resuming later, read() or write() would have blocked.
-				
+
 				if(gnutls_record_get_direction(session->sess) == 0)
 				{
 					// gnutls_handshake() wants to read() again.
@@ -583,7 +573,7 @@ class ModuleSSLGnuTLS : public Module
 				{
 					// gnutls_handshake() wants to write() again.
 					session->status = ISSL_HANDSHAKING_WRITE;
-					MakePollWrite(session);	
+					MakePollWrite(session);
 				}
 			}
 			else
@@ -592,7 +582,7 @@ class ModuleSSLGnuTLS : public Module
 				CloseSession(session);
 				session->status = ISSL_CLOSING;
 			}
-			
+
 			return false;
 		}
 		else
@@ -608,10 +598,10 @@ class ModuleSSLGnuTLS : public Module
 
 			// Change the seesion state
 			session->status = ISSL_HANDSHAKEN;
-			
+
 			// Finish writing, if any left
 			MakePollWrite(session);
-			
+
 			return true;
 		}
 	}
@@ -635,12 +625,12 @@ class ModuleSSLGnuTLS : public Module
 			VerifyCertificate(&sessions[user->GetFd()],user);
 		}
 	}
-	
+
 	void MakePollWrite(issl_session* session)
 	{
 		OnRawSocketWrite(session->fd, NULL, 0);
 	}
-	
+
 	void CloseSession(issl_session* session)
 	{
 		if(session->sess)
@@ -648,12 +638,12 @@ class ModuleSSLGnuTLS : public Module
 			gnutls_bye(session->sess, GNUTLS_SHUT_WR);
 			gnutls_deinit(session->sess);
 		}
-		
+
 		if(session->inbuf)
 		{
 			delete[] session->inbuf;
 		}
-		
+
 		session->outbuf.clear();
 		session->inbuf = NULL;
 		session->sess = NULL;
@@ -718,7 +708,7 @@ class ModuleSSLGnuTLS : public Module
 		{
 			certinfo->data.insert(std::make_pair("trusted",ConvToStr(1)));
 		}
-	
+
 		/* Up to here the process is the same for X.509 certificates and
 		 * OpenPGP keys. From now on X.509 certificates are assumed. This can
 		 * be easily extended to work with openpgp keys as well.
@@ -744,7 +734,7 @@ class ModuleSSLGnuTLS : public Module
 			return;
 		}
 
-		/* This is not a real world example, since we only check the first 
+		/* This is not a real world example, since we only check the first
 		 * certificate in the given chain.
 		 */
 
@@ -792,11 +782,11 @@ class ModuleSSLGnuTLSFactory : public ModuleFactory
 	ModuleSSLGnuTLSFactory()
 	{
 	}
-	
+
 	~ModuleSSLGnuTLSFactory()
 	{
 	}
-	
+
 	virtual Module * CreateModule(InspIRCd* Me)
 	{
 		return new ModuleSSLGnuTLS(Me);