summaryrefslogtreecommitdiff
path: root/src/modules/extra
diff options
context:
space:
mode:
Diffstat (limited to 'src/modules/extra')
-rw-r--r--src/modules/extra/m_geoip.cpp14
-rw-r--r--src/modules/extra/m_ldapauth.cpp20
-rw-r--r--src/modules/extra/m_ldapoper.cpp30
-rw-r--r--src/modules/extra/m_mssql.cpp66
-rw-r--r--src/modules/extra/m_mysql.cpp30
-rw-r--r--src/modules/extra/m_pgsql.cpp43
-rw-r--r--src/modules/extra/m_regex_pcre.cpp40
-rw-r--r--src/modules/extra/m_regex_posix.cpp44
-rw-r--r--src/modules/extra/m_regex_re2.cpp78
-rw-r--r--src/modules/extra/m_regex_stdlib.cpp43
-rw-r--r--src/modules/extra/m_regex_tre.cpp44
-rw-r--r--src/modules/extra/m_sqlite3.cpp41
-rw-r--r--src/modules/extra/m_ssl_gnutls.cpp937
-rw-r--r--src/modules/extra/m_ssl_openssl.cpp549
14 files changed, 985 insertions, 994 deletions
diff --git a/src/modules/extra/m_geoip.cpp b/src/modules/extra/m_geoip.cpp
index a36c39bc8..50df9fc26 100644
--- a/src/modules/extra/m_geoip.cpp
+++ b/src/modules/extra/m_geoip.cpp
@@ -27,7 +27,6 @@
# pragma comment(lib, "GeoIP.lib")
#endif
-/* $ModDesc: Provides a way to restrict users by country using GeoIP lookup */
/* $LinkerFlags: -lGeoIP */
class ModuleGeoIP : public Module
@@ -37,7 +36,7 @@ class ModuleGeoIP : public Module
std::string* SetExt(LocalUser* user)
{
- const char* c = GeoIP_country_code_by_addr(gi, user->GetIPString());
+ const char* c = GeoIP_country_code_by_addr(gi, user->GetIPString().c_str());
if (!c)
c = "UNK";
@@ -51,15 +50,13 @@ class ModuleGeoIP : public Module
{
}
- void init()
+ void init() CXX11_OVERRIDE
{
gi = GeoIP_new(GEOIP_STANDARD);
if (gi == NULL)
throw ModuleException("Unable to initialize geoip, are you missing GeoIP.dat?");
ServerInstance->Modules->AddService(ext);
- Implementation eventlist[] = { I_OnSetConnectClass, I_OnStats };
- ServerInstance->Modules->Attach(eventlist, this, sizeof(eventlist)/sizeof(Implementation));
for (LocalUserList::const_iterator i = ServerInstance->Users->local_users.begin(); i != ServerInstance->Users->local_users.end(); ++i)
{
@@ -77,12 +74,12 @@ class ModuleGeoIP : public Module
GeoIP_delete(gi);
}
- Version GetVersion()
+ Version GetVersion() CXX11_OVERRIDE
{
return Version("Provides a way to assign users to connect classes by country using GeoIP lookup", VF_VENDOR);
}
- ModResult OnSetConnectClass(LocalUser* user, ConnectClass* myclass)
+ ModResult OnSetConnectClass(LocalUser* user, ConnectClass* myclass) CXX11_OVERRIDE
{
std::string* cc = ext.get(user);
if (!cc)
@@ -99,7 +96,7 @@ class ModuleGeoIP : public Module
return MOD_RES_DENY;
}
- ModResult OnStats(char symbol, User* user, string_list &out)
+ ModResult OnStats(char symbol, User* user, string_list &out) CXX11_OVERRIDE
{
if (symbol != 'G')
return MOD_RES_PASSTHRU;
@@ -129,4 +126,3 @@ class ModuleGeoIP : public Module
};
MODULE_INIT(ModuleGeoIP)
-
diff --git a/src/modules/extra/m_ldapauth.cpp b/src/modules/extra/m_ldapauth.cpp
index 5b3f1e7cc..517a6d395 100644
--- a/src/modules/extra/m_ldapauth.cpp
+++ b/src/modules/extra/m_ldapauth.cpp
@@ -35,7 +35,6 @@
# pragma comment(lib, "lber.lib")
#endif
-/* $ModDesc: Allow/Deny connections based upon answer from LDAP server */
/* $LinkerFlags: -lldap */
struct RAIILDAPString
@@ -119,12 +118,10 @@ public:
conn = NULL;
}
- void init()
+ void init() CXX11_OVERRIDE
{
ServerInstance->Modules->AddService(ldapAuthed);
ServerInstance->Modules->AddService(ldapVhost);
- Implementation eventlist[] = { I_OnCheckReady, I_OnRehash,I_OnUserRegister, I_OnUserConnect };
- ServerInstance->Modules->Attach(eventlist, this, sizeof(eventlist)/sizeof(Implementation));
OnRehash(NULL);
}
@@ -134,7 +131,7 @@ public:
ldap_unbind_ext(conn, NULL, NULL);
}
- void OnRehash(User* user)
+ void OnRehash(User* user) CXX11_OVERRIDE
{
ConfigTag* tag = ServerInstance->Config->ConfValue("ldapauth");
whitelistedcidrs.clear();
@@ -212,7 +209,7 @@ public:
std::string> &replacements)
{
std::string result;
- result.reserve(MAXBUF);
+ result.reserve(text.length());
for (unsigned int i = 0; i < text.length(); ++i) {
char c = text[i];
@@ -234,7 +231,7 @@ public:
return result;
}
- virtual void OnUserConnect(LocalUser *user)
+ void OnUserConnect(LocalUser *user) CXX11_OVERRIDE
{
std::string* cc = ldapVhost.get(user);
if (cc)
@@ -244,7 +241,7 @@ public:
}
}
- ModResult OnUserRegister(LocalUser* user)
+ ModResult OnUserRegister(LocalUser* user) CXX11_OVERRIDE
{
if ((!allowpattern.empty()) && (InspIRCd::Match(user->nick,allowpattern)))
{
@@ -378,7 +375,7 @@ public:
attr_value.bv_val = const_cast<char*>(val.c_str());
attr_value.bv_len = val.length();
- ServerInstance->Logs->Log("m_ldapauth", DEBUG, "LDAP compare: %s=%s", attr.c_str(), val.c_str());
+ ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "LDAP compare: %s=%s", attr.c_str(), val.c_str());
authed = (ldap_compare_ext_s(conn, DN, attr.c_str(), &attr_value, NULL, NULL) == LDAP_COMPARE_TRUE);
@@ -421,16 +418,15 @@ public:
return true;
}
- ModResult OnCheckReady(LocalUser* user)
+ ModResult OnCheckReady(LocalUser* user) CXX11_OVERRIDE
{
return ldapAuthed.get(user) ? MOD_RES_PASSTHRU : MOD_RES_DENY;
}
- Version GetVersion()
+ Version GetVersion() CXX11_OVERRIDE
{
return Version("Allow/Deny connections based upon answer from LDAP server", VF_VENDOR);
}
-
};
MODULE_INIT(ModuleLDAPAuth)
diff --git a/src/modules/extra/m_ldapoper.cpp b/src/modules/extra/m_ldapoper.cpp
index 53896878c..af7b48d07 100644
--- a/src/modules/extra/m_ldapoper.cpp
+++ b/src/modules/extra/m_ldapoper.cpp
@@ -32,24 +32,8 @@
# pragma comment(lib, "lber.lib")
#endif
-/* $ModDesc: Adds the ability to authenticate opers via LDAP */
/* $LinkerFlags: -lldap */
-// Duplicated code, also found in cmd_oper and m_sqloper
-static bool OneOfMatches(const char* host, const char* ip, const std::string& hostlist)
-{
- std::stringstream hl(hostlist);
- std::string xhost;
- while (hl >> xhost)
- {
- if (InspIRCd::Match(host, xhost, ascii_case_insensitive_map) || InspIRCd::MatchCIDR(ip, xhost, ascii_case_insensitive_map))
- {
- return true;
- }
- }
- return false;
-}
-
struct RAIILDAPString
{
char *str;
@@ -97,7 +81,7 @@ class ModuleLDAPAuth : public Module
std::string acceptedhosts = tag->getString("host");
std::string hostname = user->ident + "@" + user->host;
- if (!OneOfMatches(hostname.c_str(), user->GetIPString(), acceptedhosts))
+ if (!InspIRCd::MatchMask(acceptedhosts, hostname, user->GetIPString()))
return false;
if (!LookupOper(opername, inputpass))
@@ -113,20 +97,18 @@ public:
{
}
- void init()
+ void init() CXX11_OVERRIDE
{
- Implementation eventlist[] = { I_OnRehash, I_OnPreCommand };
- ServerInstance->Modules->Attach(eventlist, this, sizeof(eventlist)/sizeof(Implementation));
OnRehash(NULL);
}
- virtual ~ModuleLDAPAuth()
+ ~ModuleLDAPAuth()
{
if (conn)
ldap_unbind_ext(conn, NULL, NULL);
}
- virtual void OnRehash(User* user)
+ void OnRehash(User* user) CXX11_OVERRIDE
{
ConfigTag* tag = ServerInstance->Config->ConfValue("ldapoper");
@@ -168,7 +150,7 @@ public:
return true;
}
- ModResult OnPreCommand(std::string& command, std::vector<std::string>& parameters, LocalUser* user, bool validated, const std::string& original_line)
+ ModResult OnPreCommand(std::string& command, std::vector<std::string>& parameters, LocalUser* user, bool validated, const std::string& original_line) CXX11_OVERRIDE
{
if (validated && command == "OPER" && parameters.size() >= 2)
{
@@ -245,7 +227,7 @@ public:
}
}
- virtual Version GetVersion()
+ Version GetVersion() CXX11_OVERRIDE
{
return Version("Adds the ability to authenticate opers via LDAP", VF_VENDOR);
}
diff --git a/src/modules/extra/m_mssql.cpp b/src/modules/extra/m_mssql.cpp
index 598f9aac9..e6bac038c 100644
--- a/src/modules/extra/m_mssql.cpp
+++ b/src/modules/extra/m_mssql.cpp
@@ -30,10 +30,8 @@
#include "m_sqlv2.h"
-/* $ModDesc: MsSQL provider */
/* $CompileFlags: exec("grep VERSION_NO /usr/include/tdsver.h 2>/dev/null | perl -e 'print "-D_TDSVER=".((<> =~ /freetds v(\d+\.\d+)/i) ? $1*100 : 0);'") */
/* $LinkerFlags: -ltds */
-/* $ModDep: m_sqlv2.h */
class SQLConn;
class MsSQLResult;
@@ -64,8 +62,8 @@ class QueryThread : public SocketThread
public:
QueryThread(ModuleMsSQL* mod) : Parent(mod) { }
~QueryThread() { }
- virtual void Run();
- virtual void OnNotify();
+ void Run();
+ void OnNotify();
};
class MsSQLResult : public SQLresult
@@ -88,10 +86,6 @@ class MsSQLResult : public SQLresult
{
}
- ~MsSQLResult()
- {
- }
-
void AddRow(int colsnum, char **dat, char **colname)
{
colnames.clear();
@@ -111,17 +105,17 @@ class MsSQLResult : public SQLresult
rows++;
}
- virtual int Rows()
+ int Rows()
{
return rows;
}
- virtual int Cols()
+ int Cols()
{
return cols;
}
- virtual std::string ColName(int column)
+ std::string ColName(int column)
{
if (column < (int)colnames.size())
{
@@ -134,7 +128,7 @@ class MsSQLResult : public SQLresult
return "";
}
- virtual int ColNum(const std::string &column)
+ int ColNum(const std::string &column)
{
for (unsigned int i = 0; i < colnames.size(); i++)
{
@@ -145,7 +139,7 @@ class MsSQLResult : public SQLresult
return 0;
}
- virtual SQLfield GetValue(int row, int column)
+ SQLfield GetValue(int row, int column)
{
if ((row >= 0) && (row < rows) && (column >= 0) && (column < Cols()))
{
@@ -158,7 +152,7 @@ class MsSQLResult : public SQLresult
return SQLfield("",true);
}
- virtual SQLfieldList& GetRow()
+ SQLfieldList& GetRow()
{
if (currentrow < rows)
return fieldlists[currentrow];
@@ -166,7 +160,7 @@ class MsSQLResult : public SQLresult
return emptyfieldlist;
}
- virtual SQLfieldMap& GetRowMap()
+ SQLfieldMap& GetRowMap()
{
/* In an effort to reduce overhead we don't actually allocate the map
* until the first time it's needed...so...
@@ -192,7 +186,7 @@ class MsSQLResult : public SQLresult
return *fieldmap;
}
- virtual SQLfieldList* GetRowPtr()
+ SQLfieldList* GetRowPtr()
{
fieldlist = new SQLfieldList();
@@ -207,7 +201,7 @@ class MsSQLResult : public SQLresult
return fieldlist;
}
- virtual SQLfieldMap* GetRowMapPtr()
+ SQLfieldMap* GetRowMapPtr()
{
fieldmap = new SQLfieldMap();
@@ -223,12 +217,12 @@ class MsSQLResult : public SQLresult
return fieldmap;
}
- virtual void Free(SQLfieldMap* fm)
+ void Free(SQLfieldMap* fm)
{
delete fm;
}
- virtual void Free(SQLfieldList* fl)
+ void Free(SQLfieldList* fl)
{
delete fl;
}
@@ -258,7 +252,7 @@ class SQLConn : public classbase
if (tds_process_simple_query(sock) != TDS_SUCCEED)
{
LoggingMutex->Lock();
- ServerInstance->Logs->Log("m_mssql",DEFAULT, "WARNING: Could not select database " + host.name + " for DB with id: " + host.id);
+ ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "WARNING: Could not select database " + host.name + " for DB with id: " + host.id);
LoggingMutex->Unlock();
CloseDB();
}
@@ -266,7 +260,7 @@ class SQLConn : public classbase
else
{
LoggingMutex->Lock();
- ServerInstance->Logs->Log("m_mssql",DEFAULT, "WARNING: Could not select database " + host.name + " for DB with id: " + host.id);
+ ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "WARNING: Could not select database " + host.name + " for DB with id: " + host.id);
LoggingMutex->Unlock();
CloseDB();
}
@@ -274,7 +268,7 @@ class SQLConn : public classbase
else
{
LoggingMutex->Lock();
- ServerInstance->Logs->Log("m_mssql",DEFAULT, "WARNING: Could not connect to DB with id: " + host.id);
+ ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "WARNING: Could not connect to DB with id: " + host.id);
LoggingMutex->Unlock();
CloseDB();
}
@@ -433,7 +427,7 @@ class SQLConn : public classbase
char* msquery = strdup(req->query.q.data());
LoggingMutex->Lock();
- ServerInstance->Logs->Log("m_mssql",DEBUG,"doing Query: %s",msquery);
+ ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "doing Query: %s",msquery);
LoggingMutex->Unlock();
if (tds_submit_query(sock, msquery) != TDS_SUCCEED)
{
@@ -449,8 +443,8 @@ class SQLConn : public classbase
int tds_res;
while (tds_process_tokens(sock, &tds_res, NULL, TDS_TOKEN_RESULTS) == TDS_SUCCEED)
{
- //ServerInstance->Logs->Log("m_mssql",DEBUG,"<******> result type: %d", tds_res);
- //ServerInstance->Logs->Log("m_mssql",DEBUG,"AFFECTED ROWS: %d", sock->rows_affected);
+ //ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "<******> result type: %d", tds_res);
+ //ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "AFFECTED ROWS: %d", sock->rows_affected);
switch (tds_res)
{
case TDS_ROWFMT_RESULT:
@@ -476,8 +470,8 @@ class SQLConn : public classbase
if (sock->res_info->row_count > 0)
{
int cols = sock->res_info->num_cols;
- char** name = new char*[MAXBUF];
- char** data = new char*[MAXBUF];
+ char** name = new char*[512];
+ char** data = new char*[512];
for (int j=0; j<cols; j++)
{
TDSCOLUMN* col = sock->current_results->columns[j];
@@ -516,7 +510,7 @@ class SQLConn : public classbase
{
SQLConn* sc = (SQLConn*)pContext->parent;
LoggingMutex->Lock();
- ServerInstance->Logs->Log("m_mssql", DEBUG, "Message for DB with id: %s -> %s", sc->host.id.c_str(), pMessage->message);
+ ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "Message for DB with id: %s -> %s", sc->host.id.c_str(), pMessage->message);
LoggingMutex->Unlock();
return 0;
}
@@ -525,7 +519,7 @@ class SQLConn : public classbase
{
SQLConn* sc = (SQLConn*)pContext->parent;
LoggingMutex->Lock();
- ServerInstance->Logs->Log("m_mssql", DEFAULT, "Error for DB with id: %s -> %s", sc->host.id.c_str(), pMessage->message);
+ ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "Error for DB with id: %s -> %s", sc->host.id.c_str(), pMessage->message);
LoggingMutex->Unlock();
return 0;
}
@@ -657,18 +651,16 @@ class ModuleMsSQL : public Module
queryDispatcher = new QueryThread(this);
}
- void init()
+ void init() CXX11_OVERRIDE
{
ReadConf();
ServerInstance->Threads->Start(queryDispatcher);
- Implementation eventlist[] = { I_OnRehash };
- ServerInstance->Modules->Attach(eventlist, this, sizeof(eventlist)/sizeof(Implementation));
ServerInstance->Modules->AddService(sqlserv);
}
- virtual ~ModuleMsSQL()
+ ~ModuleMsSQL()
{
queryDispatcher->join();
delete queryDispatcher;
@@ -753,7 +745,7 @@ class ModuleMsSQL : public Module
if (HasHost(hi))
{
LoggingMutex->Lock();
- ServerInstance->Logs->Log("m_mssql",DEFAULT, "WARNING: A MsSQL connection with id: %s already exists. Aborting database open attempt.", hi.id.c_str());
+ ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "WARNING: A MsSQL connection with id: %s already exists. Aborting database open attempt.", hi.id.c_str());
LoggingMutex->Unlock();
return;
}
@@ -787,14 +779,14 @@ class ModuleMsSQL : public Module
connections.clear();
}
- virtual void OnRehash(User* user)
+ void OnRehash(User* user) CXX11_OVERRIDE
{
queryDispatcher->LockQueue();
ReadConf();
queryDispatcher->UnlockQueueWakeup();
}
- void OnRequest(Request& request)
+ void OnRequest(Request& request) CXX11_OVERRIDE
{
if(strcmp(SQLREQID, request.id) == 0)
{
@@ -825,7 +817,7 @@ class ModuleMsSQL : public Module
return ++currid;
}
- virtual Version GetVersion()
+ Version GetVersion() CXX11_OVERRIDE
{
return Version("MsSQL provider", VF_VENDOR);
}
diff --git a/src/modules/extra/m_mysql.cpp b/src/modules/extra/m_mysql.cpp
index 22cf5f3f4..2d20a82ab 100644
--- a/src/modules/extra/m_mysql.cpp
+++ b/src/modules/extra/m_mysql.cpp
@@ -25,7 +25,7 @@
#include "inspircd.h"
#include <mysql.h>
-#include "sql.h"
+#include "modules/sql.h"
#ifdef _WIN32
# pragma comment(lib, "mysqlclient.lib")
@@ -35,7 +35,6 @@
/* VERSION 3 API: With nonblocking (threaded) requests */
-/* $ModDesc: SQL Service Provider module for all other m_sql* modules */
/* $CompileFlags: exec("mysql_config --include") */
/* $LinkerFlags: exec("mysql_config --libs_r") rpath("mysql_config --libs_r") */
@@ -107,11 +106,11 @@ class ModuleSQL : public Module
ConnMap connections; // main thread only
ModuleSQL();
- void init();
+ void init() CXX11_OVERRIDE;
~ModuleSQL();
- void OnRehash(User* user);
- void OnUnloadModule(Module* mod);
- Version GetVersion();
+ void OnRehash(User* user) CXX11_OVERRIDE;
+ void OnUnloadModule(Module* mod) CXX11_OVERRIDE;
+ Version GetVersion() CXX11_OVERRIDE;
};
class DispatcherThread : public SocketThread
@@ -121,8 +120,8 @@ class DispatcherThread : public SocketThread
public:
DispatcherThread(ModuleSQL* CreatorModule) : Parent(CreatorModule) { }
~DispatcherThread() { }
- virtual void Run();
- virtual void OnNotify();
+ void Run();
+ void OnNotify();
};
#if !defined(MYSQL_VERSION_ID) || MYSQL_VERSION_ID<32224
@@ -188,21 +187,17 @@ class MySQLresult : public SQLResult
}
- ~MySQLresult()
- {
- }
-
- virtual int Rows()
+ int Rows()
{
return rows;
}
- virtual void GetCols(std::vector<std::string>& result)
+ void GetCols(std::vector<std::string>& result)
{
result.assign(colnames.begin(), colnames.end());
}
- virtual SQLEntry GetValue(int row, int column)
+ SQLEntry GetValue(int row, int column)
{
if ((row >= 0) && (row < rows) && (column >= 0) && (column < (int)fieldlists[row].size()))
{
@@ -211,7 +206,7 @@ class MySQLresult : public SQLResult
return SQLEntry();
}
- virtual bool GetRow(SQLEntries& result)
+ bool GetRow(SQLEntries& result)
{
if (currentrow < rows)
{
@@ -387,9 +382,6 @@ void ModuleSQL::init()
Dispatcher = new DispatcherThread(this);
ServerInstance->Threads->Start(Dispatcher);
- Implementation eventlist[] = { I_OnRehash, I_OnUnloadModule };
- ServerInstance->Modules->Attach(eventlist, this, sizeof(eventlist)/sizeof(Implementation));
-
OnRehash(NULL);
}
diff --git a/src/modules/extra/m_pgsql.cpp b/src/modules/extra/m_pgsql.cpp
index ac247548a..2300c9d5b 100644
--- a/src/modules/extra/m_pgsql.cpp
+++ b/src/modules/extra/m_pgsql.cpp
@@ -26,9 +26,8 @@
#include <cstdlib>
#include <sstream>
#include <libpq-fe.h>
-#include "sql.h"
+#include "modules/sql.h"
-/* $ModDesc: PostgreSQL Service Provider module for all other m_sql* modules, uses v2 of the SQL API */
/* $CompileFlags: -Iexec("pg_config --includedir") eval("my $s = `pg_config --version`;$s =~ /^.*?(\d+)\.(\d+)\.(\d+).*?$/;my $v = hex(sprintf("0x%02x%02x%02x", $1, $2, $3));print "-DPGSQL_HAS_ESCAPECONN" if(($v >= 0x080104) || ($v >= 0x07030F && $v < 0x070400) || ($v >= 0x07040D && $v < 0x080000) || ($v >= 0x080008 && $v < 0x080100));") */
/* $LinkerFlags: -Lexec("pg_config --libdir") -lpq */
@@ -62,7 +61,7 @@ class ReconnectTimer : public Timer
ReconnectTimer(ModulePgSQL* m) : Timer(5, ServerInstance->Time(), false), mod(m)
{
}
- virtual void Tick(time_t TIME);
+ bool Tick(time_t TIME);
};
struct QueueItem
@@ -97,12 +96,12 @@ class PgSQLresult : public SQLResult
PQclear(res);
}
- virtual int Rows()
+ int Rows()
{
return rows;
}
- virtual void GetCols(std::vector<std::string>& result)
+ void GetCols(std::vector<std::string>& result)
{
result.resize(PQnfields(res));
for(unsigned int i=0; i < result.size(); i++)
@@ -111,7 +110,7 @@ class PgSQLresult : public SQLResult
}
}
- virtual SQLEntry GetValue(int row, int column)
+ SQLEntry GetValue(int row, int column)
{
char* v = PQgetvalue(res, row, column);
if (!v || PQgetisnull(res, row, column))
@@ -120,7 +119,7 @@ class PgSQLresult : public SQLResult
return SQLEntry(std::string(v, PQgetlength(res, row, column)));
}
- virtual bool GetRow(SQLEntries& result)
+ bool GetRow(SQLEntries& result)
{
if (currentrow >= PQntuples(res))
return false;
@@ -152,7 +151,7 @@ class SQLConn : public SQLProvider, public EventHandler
{
if (!DoConnect())
{
- ServerInstance->Logs->Log("m_pgsql",DEFAULT, "WARNING: Could not connect to database " + tag->getString("id"));
+ ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "WARNING: Could not connect to database " + tag->getString("id"));
DelayReconnect();
}
}
@@ -180,7 +179,7 @@ class SQLConn : public SQLProvider, public EventHandler
}
}
- virtual void HandleEvent(EventType et, int errornum)
+ void HandleEvent(EventType et, int errornum)
{
switch (et)
{
@@ -244,7 +243,7 @@ class SQLConn : public SQLProvider, public EventHandler
if (!ServerInstance->SE->AddFd(this, FD_WANT_NO_WRITE | FD_WANT_NO_READ))
{
- ServerInstance->Logs->Log("m_pgsql",DEBUG, "BUG: Couldn't add pgsql socket to socket engine");
+ ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "BUG: Couldn't add pgsql socket to socket engine");
return false;
}
@@ -417,7 +416,7 @@ restart:
int error;
size_t escapedsize = PQescapeStringConn(sql, &buffer[0], parm.data(), parm.length(), &error);
if (error)
- ServerInstance->Logs->Log("m_pgsql", DEBUG, "BUG: Apparently PQescapeStringConn() failed");
+ ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "BUG: Apparently PQescapeStringConn() failed");
#else
size_t escapedsize = PQescapeString(&buffer[0], parm.data(), parm.length());
#endif
@@ -452,7 +451,7 @@ restart:
int error;
size_t escapedsize = PQescapeStringConn(sql, &buffer[0], parm.data(), parm.length(), &error);
if (error)
- ServerInstance->Logs->Log("m_pgsql", DEBUG, "BUG: Apparently PQescapeStringConn() failed");
+ ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "BUG: Apparently PQescapeStringConn() failed");
#else
size_t escapedsize = PQescapeString(&buffer[0], parm.data(), parm.length());
#endif
@@ -505,25 +504,22 @@ class ModulePgSQL : public Module
ReconnectTimer* retimer;
ModulePgSQL()
+ : retimer(NULL)
{
}
- void init()
+ void init() CXX11_OVERRIDE
{
ReadConf();
-
- Implementation eventlist[] = { I_OnUnloadModule, I_OnRehash };
- ServerInstance->Modules->Attach(eventlist, this, sizeof(eventlist)/sizeof(Implementation));
}
- virtual ~ModulePgSQL()
+ ~ModulePgSQL()
{
- if (retimer)
- ServerInstance->Timers->DelTimer(retimer);
+ delete retimer;
ClearAllConnections();
}
- virtual void OnRehash(User* user)
+ void OnRehash(User* user) CXX11_OVERRIDE
{
ReadConf();
}
@@ -564,7 +560,7 @@ class ModulePgSQL : public Module
connections.clear();
}
- void OnUnloadModule(Module* mod)
+ void OnUnloadModule(Module* mod) CXX11_OVERRIDE
{
SQLerror err(SQL_BAD_DBID);
for(ConnMap::iterator i = connections.begin(); i != connections.end(); i++)
@@ -592,16 +588,17 @@ class ModulePgSQL : public Module
}
}
- Version GetVersion()
+ Version GetVersion() CXX11_OVERRIDE
{
return Version("PostgreSQL Service Provider module for all other m_sql* modules, uses v2 of the SQL API", VF_VENDOR);
}
};
-void ReconnectTimer::Tick(time_t time)
+bool ReconnectTimer::Tick(time_t time)
{
mod->retimer = NULL;
mod->ReadConf();
+ return false;
}
void SQLConn::DelayReconnect()
diff --git a/src/modules/extra/m_regex_pcre.cpp b/src/modules/extra/m_regex_pcre.cpp
index cba234c8c..91c2d1404 100644
--- a/src/modules/extra/m_regex_pcre.cpp
+++ b/src/modules/extra/m_regex_pcre.cpp
@@ -20,10 +20,8 @@
#include "inspircd.h"
#include <pcre.h>
-#include "m_regex.h"
+#include "modules/regex.h"
-/* $ModDesc: Regex Provider Module for PCRE */
-/* $ModDep: m_regex.h */
/* $CompileFlags: exec("pcre-config --cflags") */
/* $LinkerFlags: exec("pcre-config --libs") rpath("pcre-config --libs") -lpcre */
@@ -31,21 +29,11 @@
# pragma comment(lib, "libpcre.lib")
#endif
-class PCREException : public ModuleException
-{
-public:
- PCREException(const std::string& rx, const std::string& error, int erroffset)
- : ModuleException("Error in regex " + rx + " at offset " + ConvToStr(erroffset) + ": " + error)
- {
- }
-};
-
class PCRERegex : public Regex
{
-private:
pcre* regex;
-public:
+ public:
PCRERegex(const std::string& rx) : Regex(rx)
{
const char* error;
@@ -53,24 +41,19 @@ public:
regex = pcre_compile(rx.c_str(), 0, &error, &erroffset, NULL);
if (!regex)
{
- ServerInstance->Logs->Log("REGEX", DEBUG, "pcre_compile failed: /%s/ [%d] %s", rx.c_str(), erroffset, error);
- throw PCREException(rx, error, erroffset);
+ ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "pcre_compile failed: /%s/ [%d] %s", rx.c_str(), erroffset, error);
+ throw RegexException(rx, error, erroffset);
}
}
- virtual ~PCRERegex()
+ ~PCRERegex()
{
pcre_free(regex);
}
- virtual bool Matches(const std::string& text)
+ bool Matches(const std::string& text) CXX11_OVERRIDE
{
- if (pcre_exec(regex, NULL, text.c_str(), text.length(), 0, 0, NULL, 0) > -1)
- {
- // Bang. :D
- return true;
- }
- return false;
+ return (pcre_exec(regex, NULL, text.c_str(), text.length(), 0, 0, NULL, 0) >= 0);
}
};
@@ -78,7 +61,7 @@ class PCREFactory : public RegexFactory
{
public:
PCREFactory(Module* m) : RegexFactory(m, "regex/pcre") {}
- Regex* Create(const std::string& expr)
+ Regex* Create(const std::string& expr) CXX11_OVERRIDE
{
return new PCRERegex(expr);
}
@@ -86,13 +69,14 @@ class PCREFactory : public RegexFactory
class ModuleRegexPCRE : public Module
{
-public:
+ public:
PCREFactory ref;
- ModuleRegexPCRE() : ref(this) {
+ ModuleRegexPCRE() : ref(this)
+ {
ServerInstance->Modules->AddService(ref);
}
- Version GetVersion()
+ Version GetVersion() CXX11_OVERRIDE
{
return Version("Regex Provider Module for PCRE", VF_VENDOR);
}
diff --git a/src/modules/extra/m_regex_posix.cpp b/src/modules/extra/m_regex_posix.cpp
index b3afd60c8..935cdbf92 100644
--- a/src/modules/extra/m_regex_posix.cpp
+++ b/src/modules/extra/m_regex_posix.cpp
@@ -19,28 +19,15 @@
#include "inspircd.h"
-#include "m_regex.h"
+#include "modules/regex.h"
#include <sys/types.h>
#include <regex.h>
-/* $ModDesc: Regex Provider Module for POSIX Regular Expressions */
-/* $ModDep: m_regex.h */
-
-class POSIXRegexException : public ModuleException
-{
-public:
- POSIXRegexException(const std::string& rx, const std::string& error)
- : ModuleException("Error in regex " + rx + ": " + error)
- {
- }
-};
-
class POSIXRegex : public Regex
{
-private:
regex_t regbuf;
-public:
+ public:
POSIXRegex(const std::string& rx, bool extended) : Regex(rx)
{
int flags = (extended ? REG_EXTENDED : 0) | REG_NOSUB;
@@ -58,23 +45,18 @@ public:
error = errbuf;
delete[] errbuf;
regfree(&regbuf);
- throw POSIXRegexException(rx, error);
+ throw RegexException(rx, error);
}
}
- virtual ~POSIXRegex()
+ ~POSIXRegex()
{
regfree(&regbuf);
}
- virtual bool Matches(const std::string& text)
+ bool Matches(const std::string& text) CXX11_OVERRIDE
{
- if (regexec(&regbuf, text.c_str(), 0, NULL, 0) == 0)
- {
- // Bang. :D
- return true;
- }
- return false;
+ return (regexec(&regbuf, text.c_str(), 0, NULL, 0) == 0);
}
};
@@ -83,7 +65,7 @@ class PosixFactory : public RegexFactory
public:
bool extended;
PosixFactory(Module* m) : RegexFactory(m, "regex/posix") {}
- Regex* Create(const std::string& expr)
+ Regex* Create(const std::string& expr) CXX11_OVERRIDE
{
return new POSIXRegex(expr, extended);
}
@@ -92,20 +74,20 @@ class PosixFactory : public RegexFactory
class ModuleRegexPOSIX : public Module
{
PosixFactory ref;
-public:
- ModuleRegexPOSIX() : ref(this) {
+
+ public:
+ ModuleRegexPOSIX() : ref(this)
+ {
ServerInstance->Modules->AddService(ref);
- Implementation eventlist[] = { I_OnRehash };
- ServerInstance->Modules->Attach(eventlist, this, sizeof(eventlist)/sizeof(Implementation));
OnRehash(NULL);
}
- Version GetVersion()
+ Version GetVersion() CXX11_OVERRIDE
{
return Version("Regex Provider Module for POSIX Regular Expressions", VF_VENDOR);
}
- void OnRehash(User* u)
+ void OnRehash(User* u) CXX11_OVERRIDE
{
ref.extended = ServerInstance->Config->ConfValue("posix")->getBool("extended");
}
diff --git a/src/modules/extra/m_regex_re2.cpp b/src/modules/extra/m_regex_re2.cpp
new file mode 100644
index 000000000..2525b70ab
--- /dev/null
+++ b/src/modules/extra/m_regex_re2.cpp
@@ -0,0 +1,78 @@
+/*
+ * InspIRCd -- Internet Relay Chat Daemon
+ *
+ * Copyright (C) 2013 Peter Powell <petpow@saberuk.com>
+ * Copyright (C) 2012 ChrisTX <chris@rev-crew.info>
+ *
+ * This file is part of InspIRCd. InspIRCd is free software: you can
+ * redistribute it and/or modify it under the terms of the GNU General Public
+ * License as published by the Free Software Foundation, version 2.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+
+#if defined __GNUC__
+# pragma GCC diagnostic ignored "-Wshadow"
+#endif
+
+#include "inspircd.h"
+#include "modules/regex.h"
+#include <re2/re2.h>
+
+
+/* $CompileFlags: -std=c++11 */
+/* $LinkerFlags: -lre2 */
+
+class RE2Regex : public Regex
+{
+ RE2 regexcl;
+
+ public:
+ RE2Regex(const std::string& rx) : Regex(rx), regexcl(rx, RE2::Quiet)
+ {
+ if (!regexcl.ok())
+ {
+ throw RegexException(rx, regexcl.error());
+ }
+ }
+
+ bool Matches(const std::string& text) CXX11_OVERRIDE
+ {
+ return RE2::FullMatch(text, regexcl);
+ }
+};
+
+class RE2Factory : public RegexFactory
+{
+ public:
+ RE2Factory(Module* m) : RegexFactory(m, "regex/re2") { }
+ Regex* Create(const std::string& expr) CXX11_OVERRIDE
+ {
+ return new RE2Regex(expr);
+ }
+};
+
+class ModuleRegexRE2 : public Module
+{
+ RE2Factory ref;
+
+ public:
+ ModuleRegexRE2() : ref(this)
+ {
+ ServerInstance->Modules->AddService(ref);
+ }
+
+ Version GetVersion() CXX11_OVERRIDE
+ {
+ return Version("Regex Provider Module for RE2", VF_VENDOR);
+ }
+};
+
+MODULE_INIT(ModuleRegexRE2)
diff --git a/src/modules/extra/m_regex_stdlib.cpp b/src/modules/extra/m_regex_stdlib.cpp
index 204728b65..5ec358d58 100644
--- a/src/modules/extra/m_regex_stdlib.cpp
+++ b/src/modules/extra/m_regex_stdlib.cpp
@@ -15,32 +15,18 @@
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
-
+
#include "inspircd.h"
-#include "m_regex.h"
+#include "modules/regex.h"
#include <regex>
-/* $ModDesc: Regex Provider Module for std::regex Regular Expressions */
-/* $ModConfig: <stdregex type="ecmascript">
- * Specify the Regular Expression engine to use here. Valid settings are
- * bre, ere, awk, grep, egrep, ecmascript (default if not specified)*/
/* $CompileFlags: -std=c++11 */
-/* $ModDep: m_regex.h */
-
-class StdRegexException : public ModuleException
-{
-public:
- StdRegexException(const std::string& rx, const std::string& error)
- : ModuleException(std::string("Error in regex ") + rx + ": " + error)
- {
- }
-};
class StdRegex : public Regex
{
-private:
std::regex regexcl;
-public:
+
+ public:
StdRegex(const std::string& rx, std::regex::flag_type fltype) : Regex(rx)
{
try{
@@ -48,11 +34,11 @@ public:
}
catch(std::regex_error rxerr)
{
- throw StdRegexException(rx, rxerr.what());
+ throw RegexException(rx, rxerr.what());
}
}
-
- virtual bool Matches(const std::string& text)
+
+ bool Matches(const std::string& text) CXX11_OVERRIDE
{
return std::regex_search(text, regexcl);
}
@@ -63,7 +49,7 @@ class StdRegexFactory : public RegexFactory
public:
std::regex::flag_type regextype;
StdRegexFactory(Module* m) : RegexFactory(m, "regex/stdregex") {}
- Regex* Create(const std::string& expr)
+ Regex* Create(const std::string& expr) CXX11_OVERRIDE
{
return new StdRegex(expr, regextype);
}
@@ -73,23 +59,22 @@ class ModuleRegexStd : public Module
{
public:
StdRegexFactory ref;
- ModuleRegexStd() : ref(this) {
+ ModuleRegexStd() : ref(this)
+ {
ServerInstance->Modules->AddService(ref);
- Implementation eventlist[] = { I_OnRehash };
- ServerInstance->Modules->Attach(eventlist, this, sizeof(eventlist)/sizeof(Implementation));
OnRehash(NULL);
}
- Version GetVersion()
+ Version GetVersion() CXX11_OVERRIDE
{
return Version("Regex Provider Module for std::regex", VF_VENDOR);
}
-
- void OnRehash(User* u)
+
+ void OnRehash(User* u) CXX11_OVERRIDE
{
ConfigTag* Conf = ServerInstance->Config->ConfValue("stdregex");
std::string regextype = Conf->getString("type", "ecmascript");
-
+
if(regextype == "bre")
ref.regextype = std::regex::basic;
else if(regextype == "ere")
diff --git a/src/modules/extra/m_regex_tre.cpp b/src/modules/extra/m_regex_tre.cpp
index 4b9eab472..92f2ad990 100644
--- a/src/modules/extra/m_regex_tre.cpp
+++ b/src/modules/extra/m_regex_tre.cpp
@@ -19,27 +19,15 @@
#include "inspircd.h"
-#include "m_regex.h"
+#include "modules/regex.h"
#include <sys/types.h>
#include <tre/regex.h>
-/* $ModDesc: Regex Provider Module for TRE Regular Expressions */
/* $CompileFlags: pkgconfincludes("tre","tre/regex.h","") */
/* $LinkerFlags: pkgconflibs("tre","/libtre.so","-ltre") rpath("pkg-config --libs tre") */
-/* $ModDep: m_regex.h */
-
-class TRERegexException : public ModuleException
-{
-public:
- TRERegexException(const std::string& rx, const std::string& error)
- : ModuleException("Error in regex " + rx + ": " + error)
- {
- }
-};
class TRERegex : public Regex
{
-private:
regex_t regbuf;
public:
@@ -60,30 +48,26 @@ public:
error = errbuf;
delete[] errbuf;
regfree(&regbuf);
- throw TRERegexException(rx, error);
+ throw RegexException(rx, error);
}
}
- virtual ~TRERegex()
+ ~TRERegex()
{
regfree(&regbuf);
}
- virtual bool Matches(const std::string& text)
+ bool Matches(const std::string& text) CXX11_OVERRIDE
{
- if (regexec(&regbuf, text.c_str(), 0, NULL, 0) == 0)
- {
- // Bang. :D
- return true;
- }
- return false;
+ return (regexec(&regbuf, text.c_str(), 0, NULL, 0) == 0);
}
};
-class TREFactory : public RegexFactory {
+class TREFactory : public RegexFactory
+{
public:
TREFactory(Module* m) : RegexFactory(m, "regex/tre") {}
- Regex* Create(const std::string& expr)
+ Regex* Create(const std::string& expr) CXX11_OVERRIDE
{
return new TRERegex(expr);
}
@@ -92,18 +76,16 @@ class TREFactory : public RegexFactory {
class ModuleRegexTRE : public Module
{
TREFactory trf;
-public:
- ModuleRegexTRE() : trf(this) {
- ServerInstance->Modules->AddService(trf);
- }
- Version GetVersion()
+ public:
+ ModuleRegexTRE() : trf(this)
{
- return Version("Regex Provider Module for TRE Regular Expressions", VF_VENDOR);
+ ServerInstance->Modules->AddService(trf);
}
- ~ModuleRegexTRE()
+ Version GetVersion() CXX11_OVERRIDE
{
+ return Version("Regex Provider Module for TRE Regular Expressions", VF_VENDOR);
}
};
diff --git a/src/modules/extra/m_sqlite3.cpp b/src/modules/extra/m_sqlite3.cpp
index 7f6a53359..54a2788eb 100644
--- a/src/modules/extra/m_sqlite3.cpp
+++ b/src/modules/extra/m_sqlite3.cpp
@@ -22,16 +22,14 @@
#include "inspircd.h"
#include <sqlite3.h>
-#include "sql.h"
+#include "modules/sql.h"
#ifdef _WIN32
# pragma comment(lib, "sqlite3.lib")
#endif
-/* $ModDesc: sqlite3 provider */
-/* $CompileFlags: pkgconfversion("sqlite3","3.3") pkgconfincludes("sqlite3","/sqlite3.h","") */
+/* $CompileFlags: pkgconfversion("sqlite3","3.3") pkgconfincludes("sqlite3","/sqlite3.h","") -Wno-pedantic */
/* $LinkerFlags: pkgconflibs("sqlite3","/libsqlite3.so","-lsqlite3") */
-/* $NoPedantic */
class SQLConn;
typedef std::map<std::string, SQLConn*> ConnMap;
@@ -48,16 +46,12 @@ class SQLite3Result : public SQLResult
{
}
- ~SQLite3Result()
- {
- }
-
- virtual int Rows()
+ int Rows()
{
return rows;
}
- virtual bool GetRow(SQLEntries& result)
+ bool GetRow(SQLEntries& result)
{
if (currentrow < rows)
{
@@ -72,7 +66,7 @@ class SQLite3Result : public SQLResult
}
}
- virtual void GetCols(std::vector<std::string>& result)
+ void GetCols(std::vector<std::string>& result)
{
result.assign(columns.begin(), columns.end());
}
@@ -80,7 +74,6 @@ class SQLite3Result : public SQLResult
class SQLConn : public SQLProvider
{
- private:
sqlite3* conn;
reference<ConfigTag> config;
@@ -90,7 +83,7 @@ class SQLConn : public SQLProvider
std::string host = tag->getString("hostname");
if (sqlite3_open_v2(host.c_str(), &conn, SQLITE_OPEN_READWRITE, 0) != SQLITE_OK)
{
- ServerInstance->Logs->Log("m_sqlite3",DEFAULT, "WARNING: Could not open DB with id: " + tag->getString("id"));
+ ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "WARNING: Could not open DB with id: " + tag->getString("id"));
conn = NULL;
}
}
@@ -149,13 +142,13 @@ class SQLConn : public SQLProvider
sqlite3_finalize(stmt);
}
- virtual void submit(SQLQuery* query, const std::string& q)
+ void submit(SQLQuery* query, const std::string& q)
{
Query(query, q);
delete query;
}
- virtual void submit(SQLQuery* query, const std::string& q, const ParamL& p)
+ void submit(SQLQuery* query, const std::string& q, const ParamL& p)
{
std::string res;
unsigned int param = 0;
@@ -176,7 +169,7 @@ class SQLConn : public SQLProvider
submit(query, res);
}
- virtual void submit(SQLQuery* query, const std::string& q, const ParamM& p)
+ void submit(SQLQuery* query, const std::string& q, const ParamM& p)
{
std::string res;
for(std::string::size_type i = 0; i < q.length(); i++)
@@ -206,23 +199,15 @@ class SQLConn : public SQLProvider
class ModuleSQLite3 : public Module
{
- private:
ConnMap conns;
public:
- ModuleSQLite3()
- {
- }
-
- void init()
+ void init() CXX11_OVERRIDE
{
ReadConf();
-
- Implementation eventlist[] = { I_OnRehash };
- ServerInstance->Modules->Attach(eventlist, this, sizeof(eventlist)/sizeof(Implementation));
}
- virtual ~ModuleSQLite3()
+ ~ModuleSQLite3()
{
ClearConns();
}
@@ -252,12 +237,12 @@ class ModuleSQLite3 : public Module
}
}
- void OnRehash(User* user)
+ void OnRehash(User* user) CXX11_OVERRIDE
{
ReadConf();
}
- Version GetVersion()
+ Version GetVersion() CXX11_OVERRIDE
{
return Version("sqlite3 provider", VF_VENDOR);
}
diff --git a/src/modules/extra/m_ssl_gnutls.cpp b/src/modules/extra/m_ssl_gnutls.cpp
index 1f1297ef9..53fc38ec0 100644
--- a/src/modules/extra/m_ssl_gnutls.cpp
+++ b/src/modules/extra/m_ssl_gnutls.cpp
@@ -25,8 +25,13 @@
#include <gcrypt.h>
#include <gnutls/gnutls.h>
#include <gnutls/x509.h>
-#include "ssl.h"
-#include "m_cap.h"
+#include "modules/ssl.h"
+#include "modules/cap.h"
+
+#if ((GNUTLS_VERSION_MAJOR > 2) || (GNUTLS_VERSION_MAJOR == 2 && GNUTLS_VERSION_MINOR > 9) || (GNUTLS_VERSION_MAJOR == 2 && GNUTLS_VERSION_MINOR == 9 && GNUTLS_VERSION_PATCH >= 8))
+#define GNUTLS_HAS_MAC_GET_ID
+#include <gnutls/crypto.h>
+#endif
#ifdef _WIN32
# pragma comment(lib, "libgnutls.lib")
@@ -39,10 +44,8 @@
# pragma comment(lib, "gdi32.lib")
#endif
-/* $ModDesc: Provides SSL support for clients */
-/* $CompileFlags: pkgconfincludes("gnutls","/gnutls/gnutls.h","") exec("libgcrypt-config --cflags") */
+/* $CompileFlags: pkgconfincludes("gnutls","/gnutls/gnutls.h","") exec("libgcrypt-config --cflags") -Wno-pedantic */
/* $LinkerFlags: rpath("pkg-config --libs gnutls") pkgconflibs("gnutls","/libgnutls.so","-lgnutls") exec("libgcrypt-config --libs") */
-/* $NoPedantic */
#ifndef GNUTLS_VERSION_MAJOR
#define GNUTLS_VERSION_MAJOR LIBGNUTLS_VERSION_MAJOR
@@ -106,77 +109,188 @@ public:
issl_session() : socket(NULL), sess(NULL) {}
};
-class CommandStartTLS : public SplitCommand
+class GnuTLSIOHook : public SSLIOHook
{
- public:
- bool enabled;
- CommandStartTLS (Module* mod) : SplitCommand(mod, "STARTTLS")
+ private:
+ void InitSession(StreamSocket* user, bool me_server)
{
- enabled = true;
- works_before_reg = true;
+ issl_session* session = &sessions[user->GetFd()];
+
+ gnutls_init(&session->sess, me_server ? GNUTLS_SERVER : GNUTLS_CLIENT);
+ session->socket = user;
+
+ #ifdef GNUTLS_NEW_PRIO_API
+ gnutls_priority_set(session->sess, priority);
+ #else
+ gnutls_set_default_priority(session->sess);
+ #endif
+ gnutls_credentials_set(session->sess, GNUTLS_CRD_CERTIFICATE, x509_cred);
+ gnutls_dh_set_prime_bits(session->sess, dh_bits);
+ gnutls_transport_set_ptr(session->sess, reinterpret_cast<gnutls_transport_ptr_t>(session));
+ gnutls_transport_set_push_function(session->sess, gnutls_push_wrapper);
+ gnutls_transport_set_pull_function(session->sess, gnutls_pull_wrapper);
+
+ if (me_server)
+ gnutls_certificate_server_set_request(session->sess, GNUTLS_CERT_REQUEST); // Request client certificate if any.
+
+ Handshake(session, user);
}
- CmdResult HandleLocal(const std::vector<std::string> &parameters, LocalUser *user)
+ void CloseSession(issl_session* session)
{
- if (!enabled)
+ if (session->sess)
{
- user->WriteNumeric(691, "%s :STARTTLS is not enabled", user->nick.c_str());
- return CMD_FAILURE;
+ gnutls_bye(session->sess, GNUTLS_SHUT_WR);
+ gnutls_deinit(session->sess);
}
+ session->socket = NULL;
+ session->sess = NULL;
+ session->cert = NULL;
+ session->status = ISSL_NONE;
+ }
- if (user->registered == REG_ALL)
- {
- user->WriteNumeric(691, "%s :STARTTLS is not permitted after client registration is complete", user->nick.c_str());
- }
- else
+ bool Handshake(issl_session* session, StreamSocket* user)
+ {
+ int ret = gnutls_handshake(session->sess);
+
+ if (ret < 0)
{
- if (!user->eh.GetIOHook())
+ if(ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED)
{
- user->WriteNumeric(670, "%s :STARTTLS successful, go ahead with TLS handshake", user->nick.c_str());
- /* We need to flush the write buffer prior to adding the IOHook,
- * otherwise we'll be sending this line inside the SSL session - which
- * won't start its handshake until the client gets this line. Currently,
- * we assume the write will not block here; this is usually safe, as
- * STARTTLS is sent very early on in the registration phase, where the
- * user hasn't built up much sendq. Handling a blocked write here would
- * be very annoying.
- */
- user->eh.DoWrite();
- user->eh.AddIOHook(creator);
- creator->OnStreamSocketAccept(&user->eh, NULL, NULL);
+ // Handshake needs resuming later, read() or write() would have blocked.
+
+ if(gnutls_record_get_direction(session->sess) == 0)
+ {
+ // gnutls_handshake() wants to read() again.
+ session->status = ISSL_HANDSHAKING_READ;
+ ServerInstance->SE->ChangeEventMask(user, FD_WANT_POLL_READ | FD_WANT_NO_WRITE);
+ }
+ else
+ {
+ // gnutls_handshake() wants to write() again.
+ session->status = ISSL_HANDSHAKING_WRITE;
+ ServerInstance->SE->ChangeEventMask(user, FD_WANT_NO_READ | FD_WANT_SINGLE_WRITE);
+ }
}
else
- user->WriteNumeric(691, "%s :STARTTLS failure", user->nick.c_str());
+ {
+ user->SetError("Handshake Failed - " + std::string(gnutls_strerror(ret)));
+ CloseSession(session);
+ session->status = ISSL_CLOSING;
+ }
+
+ return false;
}
+ else
+ {
+ // Change the seesion state
+ session->status = ISSL_HANDSHAKEN;
- return CMD_FAILURE;
+ VerifyCertificate(session,user);
+
+ // Finish writing, if any left
+ ServerInstance->SE->ChangeEventMask(user, FD_WANT_POLL_READ | FD_WANT_NO_WRITE | FD_ADD_TRIAL_WRITE);
+
+ return true;
+ }
}
-};
-class ModuleSSLGnuTLS : public Module
-{
- issl_session* sessions;
+ void VerifyCertificate(issl_session* session, StreamSocket* user)
+ {
+ if (!session->sess || !user)
+ return;
- gnutls_certificate_credentials_t x509_cred;
- gnutls_dh_params_t dh_params;
- gnutls_digest_algorithm_t hash;
- #ifdef GNUTLS_NEW_PRIO_API
- gnutls_priority_t priority;
- #endif
+ unsigned int status;
+ const gnutls_datum_t* cert_list;
+ int ret;
+ unsigned int cert_list_size;
+ gnutls_x509_crt_t cert;
+ char str[512];
+ unsigned char digest[512];
+ size_t digest_size = sizeof(digest);
+ size_t name_size = sizeof(str);
+ ssl_cert* certinfo = new ssl_cert;
+ session->cert = certinfo;
- std::string sslports;
- int dh_bits;
+ /* This verification function uses the trusted CAs in the credentials
+ * structure. So you must have installed one or more CA certificates.
+ */
+ ret = gnutls_certificate_verify_peers2(session->sess, &status);
- bool cred_alloc;
- bool dh_alloc;
+ if (ret < 0)
+ {
+ certinfo->error = std::string(gnutls_strerror(ret));
+ return;
+ }
- RandGen randhandler;
- CommandStartTLS starttls;
+ certinfo->invalid = (status & GNUTLS_CERT_INVALID);
+ certinfo->unknownsigner = (status & GNUTLS_CERT_SIGNER_NOT_FOUND);
+ certinfo->revoked = (status & GNUTLS_CERT_REVOKED);
+ certinfo->trusted = !(status & GNUTLS_CERT_SIGNER_NOT_CA);
- GenericCap capHandler;
- ServiceProvider iohook;
+ /* Up to here the process is the same for X.509 certificates and
+ * OpenPGP keys. From now on X.509 certificates are assumed. This can
+ * be easily extended to work with openpgp keys as well.
+ */
+ if (gnutls_certificate_type_get(session->sess) != GNUTLS_CRT_X509)
+ {
+ certinfo->error = "No X509 keys sent";
+ return;
+ }
+
+ ret = gnutls_x509_crt_init(&cert);
+ if (ret < 0)
+ {
+ certinfo->error = gnutls_strerror(ret);
+ return;
+ }
+
+ cert_list_size = 0;
+ cert_list = gnutls_certificate_get_peers(session->sess, &cert_list_size);
+ if (cert_list == NULL)
+ {
+ certinfo->error = "No certificate was found";
+ goto info_done_dealloc;
+ }
+
+ /* This is not a real world example, since we only check the first
+ * certificate in the given chain.
+ */
+
+ ret = gnutls_x509_crt_import(cert, &cert_list[0], GNUTLS_X509_FMT_DER);
+ if (ret < 0)
+ {
+ certinfo->error = gnutls_strerror(ret);
+ goto info_done_dealloc;
+ }
+
+ gnutls_x509_crt_get_dn(cert, str, &name_size);
+ certinfo->dn = str;
+
+ gnutls_x509_crt_get_issuer_dn(cert, str, &name_size);
+ certinfo->issuer = str;
+
+ if ((ret = gnutls_x509_crt_get_fingerprint(cert, hash, digest, &digest_size)) < 0)
+ {
+ certinfo->error = gnutls_strerror(ret);
+ }
+ else
+ {
+ certinfo->fingerprint = BinToHex(digest, digest_size);
+ }
+
+ /* Beware here we do not check for errors.
+ */
+ if ((gnutls_x509_crt_get_expiration_time(cert) < ServerInstance->Time()) || (gnutls_x509_crt_get_activation_time(cert) > ServerInstance->Time()))
+ {
+ certinfo->error = "Not activated, or expired certificate";
+ }
+
+info_done_dealloc:
+ gnutls_x509_crt_deinit(cert);
+ }
- inline static const char* UnknownIfNULL(const char* str)
+ static const char* UnknownIfNULL(const char* str)
{
return str ? str : "UNKNOWN";
}
@@ -246,27 +360,271 @@ class ModuleSSLGnuTLS : public Module
}
public:
+ issl_session* sessions;
+ gnutls_certificate_credentials_t x509_cred;
+
+ gnutls_digest_algorithm_t hash;
+ #ifdef GNUTLS_NEW_PRIO_API
+ gnutls_priority_t priority;
+ #endif
+ int dh_bits;
+
+ GnuTLSIOHook(Module* parent)
+ : SSLIOHook(parent, "ssl/gnutls")
+ {
+ sessions = new issl_session[ServerInstance->SE->GetMaxFds()];
+ }
+
+ ~GnuTLSIOHook()
+ {
+ delete[] sessions;
+ }
+
+ void OnStreamSocketAccept(StreamSocket* user, irc::sockets::sockaddrs* client, irc::sockets::sockaddrs* server) CXX11_OVERRIDE
+ {
+ issl_session* session = &sessions[user->GetFd()];
+
+ /* For STARTTLS: Don't try and init a session on a socket that already has a session */
+ if (session->sess)
+ return;
+
+ InitSession(user, true);
+ }
+
+ void OnStreamSocketConnect(StreamSocket* user) CXX11_OVERRIDE
+ {
+ InitSession(user, false);
+ }
+
+ void OnStreamSocketClose(StreamSocket* user) CXX11_OVERRIDE
+ {
+ CloseSession(&sessions[user->GetFd()]);
+ }
+
+ int OnStreamSocketRead(StreamSocket* user, std::string& recvq) CXX11_OVERRIDE
+ {
+ issl_session* session = &sessions[user->GetFd()];
+
+ if (!session->sess)
+ {
+ CloseSession(session);
+ user->SetError("No SSL session");
+ return -1;
+ }
+
+ if (session->status == ISSL_HANDSHAKING_READ || session->status == ISSL_HANDSHAKING_WRITE)
+ {
+ // The handshake isn't finished, try to finish it.
+
+ if(!Handshake(session, user))
+ {
+ if (session->status != ISSL_CLOSING)
+ return 0;
+ return -1;
+ }
+ }
+
+ // If we resumed the handshake then session->status will be ISSL_HANDSHAKEN.
+
+ if (session->status == ISSL_HANDSHAKEN)
+ {
+ char* buffer = ServerInstance->GetReadBuffer();
+ size_t bufsiz = ServerInstance->Config->NetBufferSize;
+ int ret = gnutls_record_recv(session->sess, buffer, bufsiz);
+ if (ret > 0)
+ {
+ recvq.append(buffer, ret);
+ return 1;
+ }
+ else if (ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED)
+ {
+ return 0;
+ }
+ else if (ret == 0)
+ {
+ user->SetError("Connection closed");
+ CloseSession(session);
+ return -1;
+ }
+ else
+ {
+ user->SetError(gnutls_strerror(ret));
+ CloseSession(session);
+ return -1;
+ }
+ }
+ else if (session->status == ISSL_CLOSING)
+ return -1;
+
+ return 0;
+ }
+
+ int OnStreamSocketWrite(StreamSocket* user, std::string& sendq) CXX11_OVERRIDE
+ {
+ issl_session* session = &sessions[user->GetFd()];
+
+ if (!session->sess)
+ {
+ CloseSession(session);
+ user->SetError("No SSL session");
+ return -1;
+ }
+
+ if (session->status == ISSL_HANDSHAKING_WRITE || session->status == ISSL_HANDSHAKING_READ)
+ {
+ // The handshake isn't finished, try to finish it.
+ Handshake(session, user);
+ if (session->status != ISSL_CLOSING)
+ return 0;
+ return -1;
+ }
+
+ int ret = 0;
+
+ if (session->status == ISSL_HANDSHAKEN)
+ {
+ ret = gnutls_record_send(session->sess, sendq.data(), sendq.length());
+
+ if (ret == (int)sendq.length())
+ {
+ ServerInstance->SE->ChangeEventMask(user, FD_WANT_NO_WRITE);
+ return 1;
+ }
+ else if (ret > 0)
+ {
+ sendq = sendq.substr(ret);
+ ServerInstance->SE->ChangeEventMask(user, FD_WANT_SINGLE_WRITE);
+ return 0;
+ }
+ else if (ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED || ret == 0)
+ {
+ ServerInstance->SE->ChangeEventMask(user, FD_WANT_SINGLE_WRITE);
+ return 0;
+ }
+ else // (ret < 0)
+ {
+ user->SetError(gnutls_strerror(ret));
+ CloseSession(session);
+ return -1;
+ }
+ }
+
+ return 0;
+ }
+
+ ssl_cert* GetCertificate(StreamSocket* sock) CXX11_OVERRIDE
+ {
+ int fd = sock->GetFd();
+ issl_session* session = &sessions[fd];
+ return session->cert;
+ }
+
+ void TellCiphersAndFingerprint(LocalUser* user)
+ {
+ const gnutls_session_t& sess = sessions[user->eh.GetFd()].sess;
+ if (sess)
+ {
+ std::string text = "*** You are connected using SSL cipher '";
+
+ text += UnknownIfNULL(gnutls_kx_get_name(gnutls_kx_get(sess)));
+ text.append("-").append(UnknownIfNULL(gnutls_cipher_get_name(gnutls_cipher_get(sess)))).append("-");
+ text.append(UnknownIfNULL(gnutls_mac_get_name(gnutls_mac_get(sess)))).append("'");
+
+ ssl_cert* cert = sessions[user->eh.GetFd()].cert;
+ if (!cert->fingerprint.empty())
+ text += " and your SSL fingerprint is " + cert->fingerprint;
+
+ user->WriteNotice(text);
+ }
+ }
+};
+
+class CommandStartTLS : public SplitCommand
+{
+ IOHook& hook;
+
+ public:
+ bool enabled;
+ CommandStartTLS(Module* mod, IOHook& Hook)
+ : SplitCommand(mod, "STARTTLS")
+ , hook(Hook)
+ {
+ enabled = true;
+ works_before_reg = true;
+ }
+
+ CmdResult HandleLocal(const std::vector<std::string> &parameters, LocalUser *user)
+ {
+ if (!enabled)
+ {
+ user->WriteNumeric(691, "%s :STARTTLS is not enabled", user->nick.c_str());
+ return CMD_FAILURE;
+ }
+
+ if (user->registered == REG_ALL)
+ {
+ user->WriteNumeric(691, "%s :STARTTLS is not permitted after client registration is complete", user->nick.c_str());
+ }
+ else
+ {
+ if (!user->eh.GetIOHook())
+ {
+ user->WriteNumeric(670, "%s :STARTTLS successful, go ahead with TLS handshake", user->nick.c_str());
+ /* We need to flush the write buffer prior to adding the IOHook,
+ * otherwise we'll be sending this line inside the SSL session - which
+ * won't start its handshake until the client gets this line. Currently,
+ * we assume the write will not block here; this is usually safe, as
+ * STARTTLS is sent very early on in the registration phase, where the
+ * user hasn't built up much sendq. Handling a blocked write here would
+ * be very annoying.
+ */
+ user->eh.DoWrite();
+ user->eh.AddIOHook(&hook);
+ hook.OnStreamSocketAccept(&user->eh, NULL, NULL);
+ }
+ else
+ user->WriteNumeric(691, "%s :STARTTLS failure", user->nick.c_str());
+ }
+
+ return CMD_FAILURE;
+ }
+};
+class ModuleSSLGnuTLS : public Module
+{
+ GnuTLSIOHook iohook;
+
+ gnutls_dh_params_t dh_params;
+
+ std::string sslports;
+
+ bool cred_alloc;
+ bool dh_alloc;
+
+ RandGen randhandler;
+ CommandStartTLS starttls;
+
+ GenericCap capHandler;
+
+ public:
ModuleSSLGnuTLS()
- : starttls(this), capHandler(this, "tls"), iohook(this, "ssl/gnutls", SERVICE_IOHOOK)
+ : iohook(this), starttls(this, iohook), capHandler(this, "tls")
{
gcry_control (GCRYCTL_INITIALIZATION_FINISHED, 0);
- sessions = new issl_session[ServerInstance->SE->GetMaxFds()];
-
gnutls_global_init(); // This must be called once in the program
gnutls_x509_privkey_init(&x509_key);
#ifdef GNUTLS_NEW_PRIO_API
// Init this here so it's always initialized, avoids an extra boolean
- gnutls_priority_init(&priority, "NORMAL", NULL);
+ gnutls_priority_init(&iohook.priority, "NORMAL", NULL);
#endif
cred_alloc = false;
dh_alloc = false;
}
- void init()
+ void init() CXX11_OVERRIDE
{
// Needs the flag as it ignores a plain /rehash
OnModuleRehash(NULL,"ssl");
@@ -274,16 +632,13 @@ class ModuleSSLGnuTLS : public Module
ServerInstance->GenRandom = &randhandler;
// Void return, guess we assume success
- gnutls_certificate_set_dh_params(x509_cred, dh_params);
- Implementation eventlist[] = { I_On005Numeric, I_OnRehash, I_OnModuleRehash, I_OnUserConnect,
- I_OnEvent, I_OnHookIO };
- ServerInstance->Modules->Attach(eventlist, this, sizeof(eventlist)/sizeof(Implementation));
+ gnutls_certificate_set_dh_params(iohook.x509_cred, dh_params);
ServerInstance->Modules->AddService(iohook);
ServerInstance->Modules->AddService(starttls);
}
- void OnRehash(User* user)
+ void OnRehash(User* user) CXX11_OVERRIDE
{
sslports.clear();
@@ -303,7 +658,7 @@ class ModuleSSLGnuTLS : public Module
continue;
const std::string& portid = port->bind_desc;
- ServerInstance->Logs->Log("m_ssl_gnutls", DEFAULT, "m_ssl_gnutls.so: Enabling SSL for port %s", portid.c_str());
+ ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "Enabling SSL for port %s", portid.c_str());
if (port->bind_tag->getString("type", "clients") == "clients" && port->bind_addr != "127.0.0.1")
{
@@ -323,7 +678,7 @@ class ModuleSSLGnuTLS : public Module
}
}
- void OnModuleRehash(User* user, const std::string &param)
+ void OnModuleRehash(User* user, const std::string &param) CXX11_OVERRIDE
{
if(param != "ssl")
return;
@@ -336,11 +691,11 @@ class ModuleSSLGnuTLS : public Module
ConfigTag* Conf = ServerInstance->Config->ConfValue("gnutls");
- cafile = Conf->getString("cafile", CONFIG_PATH "/ca.pem");
- crlfile = Conf->getString("crlfile", CONFIG_PATH "/crl.pem");
- certfile = Conf->getString("certfile", CONFIG_PATH "/cert.pem");
- keyfile = Conf->getString("keyfile", CONFIG_PATH "/key.pem");
- dh_bits = Conf->getInt("dhbits");
+ cafile = ServerInstance->Config->Paths.PrependConfig(Conf->getString("cafile", "ca.pem"));
+ crlfile = ServerInstance->Config->Paths.PrependConfig(Conf->getString("crlfile", "crl.pem"));
+ certfile = ServerInstance->Config->Paths.PrependConfig(Conf->getString("certfile", "cert.pem"));
+ keyfile = ServerInstance->Config->Paths.PrependConfig(Conf->getString("keyfile", "key.pem"));
+ int dh_bits = Conf->getInt("dhbits");
std::string hashname = Conf->getString("hash", "md5");
// The GnuTLS manual states that the gnutls_set_default_priority()
@@ -353,13 +708,30 @@ class ModuleSSLGnuTLS : public Module
if((dh_bits != 768) && (dh_bits != 1024) && (dh_bits != 2048) && (dh_bits != 3072) && (dh_bits != 4096))
dh_bits = 1024;
+ iohook.dh_bits = dh_bits;
+
+ // As older versions of gnutls can't do this, let's disable it where needed.
+#ifdef GNUTLS_HAS_MAC_GET_ID
+ // As gnutls_digest_algorithm_t and gnutls_mac_algorithm_t are mapped 1:1, we can do this
+ // There is no gnutls_dig_get_id() at the moment, but it may come later
+ iohook.hash = (gnutls_digest_algorithm_t)gnutls_mac_get_id(hashname.c_str());
+ if (iohook.hash == GNUTLS_DIG_UNKNOWN)
+ throw ModuleException("Unknown hash type " + hashname);
+
+ // Check if the user is walking around with their head in the ass,
+ // giving us something that is a valid MAC but not digest
+ gnutls_hash_hd_t is_digest;
+ if (gnutls_hash_init(&is_digest, iohook.hash) < 0)
+ throw ModuleException("Unknown hash type " + hashname);
+ gnutls_hash_deinit(is_digest, NULL);
+#else
if (hashname == "md5")
- hash = GNUTLS_DIG_MD5;
+ iohook.hash = GNUTLS_DIG_MD5;
else if (hashname == "sha1")
- hash = GNUTLS_DIG_SHA1;
+ iohook.hash = GNUTLS_DIG_SHA1;
else
throw ModuleException("Unknown hash type " + hashname);
-
+#endif
int ret;
@@ -373,32 +745,32 @@ class ModuleSSLGnuTLS : public Module
if (cred_alloc)
{
// Deallocate the old credentials
- gnutls_certificate_free_credentials(x509_cred);
+ gnutls_certificate_free_credentials(iohook.x509_cred);
for(unsigned int i=0; i < x509_certs.size(); i++)
gnutls_x509_crt_deinit(x509_certs[i]);
x509_certs.clear();
}
- ret = gnutls_certificate_allocate_credentials(&x509_cred);
+ ret = gnutls_certificate_allocate_credentials(&iohook.x509_cred);
cred_alloc = (ret >= 0);
if (!cred_alloc)
- ServerInstance->Logs->Log("m_ssl_gnutls",DEBUG, "m_ssl_gnutls.so: Failed to allocate certificate credentials: %s", gnutls_strerror(ret));
+ ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "Failed to allocate certificate credentials: %s", gnutls_strerror(ret));
- if((ret =gnutls_certificate_set_x509_trust_file(x509_cred, cafile.c_str(), GNUTLS_X509_FMT_PEM)) < 0)
- ServerInstance->Logs->Log("m_ssl_gnutls",DEBUG, "m_ssl_gnutls.so: Failed to set X.509 trust file '%s': %s", cafile.c_str(), gnutls_strerror(ret));
+ if((ret =gnutls_certificate_set_x509_trust_file(iohook.x509_cred, cafile.c_str(), GNUTLS_X509_FMT_PEM)) < 0)
+ ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "Failed to set X.509 trust file '%s': %s", cafile.c_str(), gnutls_strerror(ret));
- if((ret = gnutls_certificate_set_x509_crl_file (x509_cred, crlfile.c_str(), GNUTLS_X509_FMT_PEM)) < 0)
- ServerInstance->Logs->Log("m_ssl_gnutls",DEBUG, "m_ssl_gnutls.so: Failed to set X.509 CRL file '%s': %s", crlfile.c_str(), gnutls_strerror(ret));
+ if((ret = gnutls_certificate_set_x509_crl_file (iohook.x509_cred, crlfile.c_str(), GNUTLS_X509_FMT_PEM)) < 0)
+ ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "Failed to set X.509 CRL file '%s': %s", crlfile.c_str(), gnutls_strerror(ret));
FileReader reader;
- reader.LoadFile(certfile);
- std::string cert_string = reader.Contents();
+ reader.Load(certfile);
+ std::string cert_string = reader.GetString();
gnutls_datum_t cert_datum = { (unsigned char*)cert_string.data(), static_cast<unsigned int>(cert_string.length()) };
- reader.LoadFile(keyfile);
- std::string key_string = reader.Contents();
+ reader.Load(keyfile);
+ std::string key_string = reader.GetString();
gnutls_datum_t key_datum = { (unsigned char*)key_string.data(), static_cast<unsigned int>(key_string.length()) };
// If this fails, no SSL port will work. At all. So, do the smart thing - throw a ModuleException
@@ -423,40 +795,40 @@ class ModuleSSLGnuTLS : public Module
if((ret = gnutls_x509_privkey_import(x509_key, &key_datum, GNUTLS_X509_FMT_PEM)) < 0)
throw ModuleException("Unable to load GnuTLS server private key (" + keyfile + "): " + std::string(gnutls_strerror(ret)));
- if((ret = gnutls_certificate_set_x509_key(x509_cred, &x509_certs[0], certcount, x509_key)) < 0)
+ if((ret = gnutls_certificate_set_x509_key(iohook.x509_cred, &x509_certs[0], certcount, x509_key)) < 0)
throw ModuleException("Unable to set GnuTLS cert/key pair: " + std::string(gnutls_strerror(ret)));
#ifdef GNUTLS_NEW_PRIO_API
// It's safe to call this every time as we cannot have this uninitialized, see constructor and below.
- gnutls_priority_deinit(priority);
+ gnutls_priority_deinit(iohook.priority);
// Try to set the priorities for ciphers, kex methods etc. to the user supplied string
// If the user did not supply anything then the string is already set to "NORMAL"
const char* priocstr = priorities.c_str();
const char* prioerror;
- if ((ret = gnutls_priority_init(&priority, priocstr, &prioerror)) < 0)
+ if ((ret = gnutls_priority_init(&iohook.priority, priocstr, &prioerror)) < 0)
{
// gnutls did not understand the user supplied string, log and fall back to the default priorities
- ServerInstance->Logs->Log("m_ssl_gnutls",DEFAULT, "m_ssl_gnutls.so: Failed to set priorities to \"%s\": %s Syntax error at position %u, falling back to default (NORMAL)", priorities.c_str(), gnutls_strerror(ret), (unsigned int) (prioerror - priocstr));
- gnutls_priority_init(&priority, "NORMAL", NULL);
+ ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "Failed to set priorities to \"%s\": %s Syntax error at position %u, falling back to default (NORMAL)", priorities.c_str(), gnutls_strerror(ret), (unsigned int) (prioerror - priocstr));
+ gnutls_priority_init(&iohook.priority, "NORMAL", NULL);
}
#else
if (priorities != "NORMAL")
- ServerInstance->Logs->Log("m_ssl_gnutls",DEFAULT, "m_ssl_gnutls.so: You've set <gnutls:priority> to a value other than the default, but this is only supported with GnuTLS v2.1.7 or newer. Your GnuTLS version is older than that so the option will have no effect.");
+ ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "You've set <gnutls:priority> to a value other than the default, but this is only supported with GnuTLS v2.1.7 or newer. Your GnuTLS version is older than that so the option will have no effect.");
#endif
#if(GNUTLS_VERSION_MAJOR < 2 || ( GNUTLS_VERSION_MAJOR == 2 && GNUTLS_VERSION_MINOR < 12 ) )
- gnutls_certificate_client_set_retrieve_function (x509_cred, cert_callback);
+ gnutls_certificate_client_set_retrieve_function (iohook.x509_cred, cert_callback);
#else
- gnutls_certificate_set_retrieve_function (x509_cred, cert_callback);
+ gnutls_certificate_set_retrieve_function (iohook.x509_cred, cert_callback);
#endif
ret = gnutls_dh_params_init(&dh_params);
dh_alloc = (ret >= 0);
if (!dh_alloc)
{
- ServerInstance->Logs->Log("m_ssl_gnutls",DEFAULT, "m_ssl_gnutls.so: Failed to initialise DH parameters: %s", gnutls_strerror(ret));
+ ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "Failed to initialise DH parameters: %s", gnutls_strerror(ret));
return;
}
@@ -464,14 +836,14 @@ class ModuleSSLGnuTLS : public Module
if (!dhfile.empty())
{
// Try to load DH params from file
- reader.LoadFile(dhfile);
- std::string dhstring = reader.Contents();
+ reader.Load(dhfile);
+ std::string dhstring = reader.GetString();
gnutls_datum_t dh_datum = { (unsigned char*)dhstring.data(), static_cast<unsigned int>(dhstring.length()) };
if ((ret = gnutls_dh_params_import_pkcs3(dh_params, &dh_datum, GNUTLS_X509_FMT_PEM)) < 0)
{
// File unreadable or GnuTLS was unhappy with the contents, generate the DH primes now
- ServerInstance->Logs->Log("m_ssl_gnutls", DEFAULT, "m_ssl_gnutls.so: Generating DH parameters because I failed to load them from file '%s': %s", dhfile.c_str(), gnutls_strerror(ret));
+ ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "Generating DH parameters because I failed to load them from file '%s': %s", dhfile.c_str(), gnutls_strerror(ret));
GenerateDHParams();
}
}
@@ -493,8 +865,8 @@ class ModuleSSLGnuTLS : public Module
int ret;
- if((ret = gnutls_dh_params_generate2(dh_params, dh_bits)) < 0)
- ServerInstance->Logs->Log("m_ssl_gnutls",DEFAULT, "m_ssl_gnutls.so: Failed to generate DH parameters (%d bits): %s", dh_bits, gnutls_strerror(ret));
+ if((ret = gnutls_dh_params_generate2(dh_params, iohook.dh_bits)) < 0)
+ ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "Failed to generate DH parameters (%d bits): %s", iohook.dh_bits, gnutls_strerror(ret));
}
~ModuleSSLGnuTLS()
@@ -504,26 +876,25 @@ class ModuleSSLGnuTLS : public Module
gnutls_x509_privkey_deinit(x509_key);
#ifdef GNUTLS_NEW_PRIO_API
- gnutls_priority_deinit(priority);
+ gnutls_priority_deinit(iohook.priority);
#endif
if (dh_alloc)
gnutls_dh_params_deinit(dh_params);
if (cred_alloc)
- gnutls_certificate_free_credentials(x509_cred);
+ gnutls_certificate_free_credentials(iohook.x509_cred);
gnutls_global_deinit();
- delete[] sessions;
ServerInstance->GenRandom = &ServerInstance->HandleGenRandom;
}
- void OnCleanup(int target_type, void* item)
+ void OnCleanup(int target_type, void* item) CXX11_OVERRIDE
{
if(target_type == TYPE_USER)
{
LocalUser* user = IS_LOCAL(static_cast<User*>(item));
- if (user && user->eh.GetIOHook() == this)
+ if (user && user->eh.GetIOHook() == &iohook)
{
// User is using SSL, they're a local user, and they're using one of *our* SSL ports.
// Potentially there could be multiple SSL modules loaded at once on different ports.
@@ -532,373 +903,35 @@ class ModuleSSLGnuTLS : public Module
}
}
- Version GetVersion()
+ Version GetVersion() CXX11_OVERRIDE
{
return Version("Provides SSL support for clients", VF_VENDOR);
}
-
- void On005Numeric(std::string &output)
+ void On005Numeric(std::map<std::string, std::string>& tokens) CXX11_OVERRIDE
{
if (!sslports.empty())
- output.append(" SSL=" + sslports);
+ tokens["SSL"] = sslports;
if (starttls.enabled)
- output.append(" STARTTLS");
+ tokens["STARTTLS"];
}
- void OnHookIO(StreamSocket* user, ListenSocket* lsb)
+ void OnHookIO(StreamSocket* user, ListenSocket* lsb) CXX11_OVERRIDE
{
if (!user->GetIOHook() && lsb->bind_tag->getString("ssl") == "gnutls")
{
/* Hook the user with our module */
- user->AddIOHook(this);
- }
- }
-
- void OnRequest(Request& request)
- {
- if (strcmp("GET_SSL_CERT", request.id) == 0)
- {
- SocketCertificateRequest& req = static_cast<SocketCertificateRequest&>(request);
- int fd = req.sock->GetFd();
- issl_session* session = &sessions[fd];
-
- req.cert = session->cert;
- }
- }
-
- void InitSession(StreamSocket* user, bool me_server)
- {
- issl_session* session = &sessions[user->GetFd()];
-
- gnutls_init(&session->sess, me_server ? GNUTLS_SERVER : GNUTLS_CLIENT);
- session->socket = user;
-
- #ifdef GNUTLS_NEW_PRIO_API
- gnutls_priority_set(session->sess, priority);
- #else
- gnutls_set_default_priority(session->sess);
- #endif
- gnutls_credentials_set(session->sess, GNUTLS_CRD_CERTIFICATE, x509_cred);
- gnutls_dh_set_prime_bits(session->sess, dh_bits);
- gnutls_transport_set_ptr(session->sess, reinterpret_cast<gnutls_transport_ptr_t>(session));
- gnutls_transport_set_push_function(session->sess, gnutls_push_wrapper);
- gnutls_transport_set_pull_function(session->sess, gnutls_pull_wrapper);
-
- if (me_server)
- gnutls_certificate_server_set_request(session->sess, GNUTLS_CERT_REQUEST); // Request client certificate if any.
-
- Handshake(session, user);
- }
-
- void OnStreamSocketAccept(StreamSocket* user, irc::sockets::sockaddrs* client, irc::sockets::sockaddrs* server)
- {
- issl_session* session = &sessions[user->GetFd()];
-
- /* For STARTTLS: Don't try and init a session on a socket that already has a session */
- if (session->sess)
- return;
-
- InitSession(user, true);
- }
-
- void OnStreamSocketConnect(StreamSocket* user)
- {
- InitSession(user, false);
- }
-
- void OnStreamSocketClose(StreamSocket* user)
- {
- CloseSession(&sessions[user->GetFd()]);
- }
-
- int OnStreamSocketRead(StreamSocket* user, std::string& recvq)
- {
- issl_session* session = &sessions[user->GetFd()];
-
- if (!session->sess)
- {
- CloseSession(session);
- user->SetError("No SSL session");
- return -1;
- }
-
- if (session->status == ISSL_HANDSHAKING_READ || session->status == ISSL_HANDSHAKING_WRITE)
- {
- // The handshake isn't finished, try to finish it.
-
- if(!Handshake(session, user))
- {
- if (session->status != ISSL_CLOSING)
- return 0;
- return -1;
- }
- }
-
- // If we resumed the handshake then session->status will be ISSL_HANDSHAKEN.
-
- if (session->status == ISSL_HANDSHAKEN)
- {
- char* buffer = ServerInstance->GetReadBuffer();
- size_t bufsiz = ServerInstance->Config->NetBufferSize;
- int ret = gnutls_record_recv(session->sess, buffer, bufsiz);
- if (ret > 0)
- {
- recvq.append(buffer, ret);
- return 1;
- }
- else if (ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED)
- {
- return 0;
- }
- else if (ret == 0)
- {
- user->SetError("Connection closed");
- CloseSession(session);
- return -1;
- }
- else
- {
- user->SetError(gnutls_strerror(ret));
- CloseSession(session);
- return -1;
- }
- }
- else if (session->status == ISSL_CLOSING)
- return -1;
-
- return 0;
- }
-
- int OnStreamSocketWrite(StreamSocket* user, std::string& sendq)
- {
- issl_session* session = &sessions[user->GetFd()];
-
- if (!session->sess)
- {
- CloseSession(session);
- user->SetError("No SSL session");
- return -1;
- }
-
- if (session->status == ISSL_HANDSHAKING_WRITE || session->status == ISSL_HANDSHAKING_READ)
- {
- // The handshake isn't finished, try to finish it.
- Handshake(session, user);
- if (session->status != ISSL_CLOSING)
- return 0;
- return -1;
- }
-
- int ret = 0;
-
- if (session->status == ISSL_HANDSHAKEN)
- {
- ret = gnutls_record_send(session->sess, sendq.data(), sendq.length());
-
- if (ret == (int)sendq.length())
- {
- ServerInstance->SE->ChangeEventMask(user, FD_WANT_NO_WRITE);
- return 1;
- }
- else if (ret > 0)
- {
- sendq = sendq.substr(ret);
- ServerInstance->SE->ChangeEventMask(user, FD_WANT_SINGLE_WRITE);
- return 0;
- }
- else if (ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED || ret == 0)
- {
- ServerInstance->SE->ChangeEventMask(user, FD_WANT_SINGLE_WRITE);
- return 0;
- }
- else // (ret < 0)
- {
- user->SetError(gnutls_strerror(ret));
- CloseSession(session);
- return -1;
- }
- }
-
- return 0;
- }
-
- bool Handshake(issl_session* session, StreamSocket* user)
- {
- int ret = gnutls_handshake(session->sess);
-
- if (ret < 0)
- {
- if(ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED)
- {
- // Handshake needs resuming later, read() or write() would have blocked.
-
- if(gnutls_record_get_direction(session->sess) == 0)
- {
- // gnutls_handshake() wants to read() again.
- session->status = ISSL_HANDSHAKING_READ;
- ServerInstance->SE->ChangeEventMask(user, FD_WANT_POLL_READ | FD_WANT_NO_WRITE);
- }
- else
- {
- // gnutls_handshake() wants to write() again.
- session->status = ISSL_HANDSHAKING_WRITE;
- ServerInstance->SE->ChangeEventMask(user, FD_WANT_NO_READ | FD_WANT_SINGLE_WRITE);
- }
- }
- else
- {
- user->SetError("Handshake Failed - " + std::string(gnutls_strerror(ret)));
- CloseSession(session);
- session->status = ISSL_CLOSING;
- }
-
- return false;
- }
- else
- {
- // Change the seesion state
- session->status = ISSL_HANDSHAKEN;
-
- VerifyCertificate(session,user);
-
- // Finish writing, if any left
- ServerInstance->SE->ChangeEventMask(user, FD_WANT_POLL_READ | FD_WANT_NO_WRITE | FD_ADD_TRIAL_WRITE);
-
- return true;
- }
- }
-
- void OnUserConnect(LocalUser* user)
- {
- if (user->eh.GetIOHook() == this)
- {
- if (sessions[user->eh.GetFd()].sess)
- {
- const gnutls_session_t& sess = sessions[user->eh.GetFd()].sess;
- std::string cipher = UnknownIfNULL(gnutls_kx_get_name(gnutls_kx_get(sess)));
- cipher.append("-").append(UnknownIfNULL(gnutls_cipher_get_name(gnutls_cipher_get(sess)))).append("-");
- cipher.append(UnknownIfNULL(gnutls_mac_get_name(gnutls_mac_get(sess))));
-
- ssl_cert* cert = sessions[user->eh.GetFd()].cert;
- if (cert->fingerprint.empty())
- user->WriteServ("NOTICE %s :*** You are connected using SSL cipher \"%s\"", user->nick.c_str(), cipher.c_str());
- else
- user->WriteServ("NOTICE %s :*** You are connected using SSL cipher \"%s\""
- " and your SSL fingerprint is %s", user->nick.c_str(), cipher.c_str(), cert->fingerprint.c_str());
- }
- }
- }
-
- void CloseSession(issl_session* session)
- {
- if (session->sess)
- {
- gnutls_bye(session->sess, GNUTLS_SHUT_WR);
- gnutls_deinit(session->sess);
+ user->AddIOHook(&iohook);
}
- session->socket = NULL;
- session->sess = NULL;
- session->cert = NULL;
- session->status = ISSL_NONE;
}
- void VerifyCertificate(issl_session* session, StreamSocket* user)
+ void OnUserConnect(LocalUser* user) CXX11_OVERRIDE
{
- if (!session->sess || !user)
- return;
-
- unsigned int status;
- const gnutls_datum_t* cert_list;
- int ret;
- unsigned int cert_list_size;
- gnutls_x509_crt_t cert;
- char name[MAXBUF];
- unsigned char digest[MAXBUF];
- size_t digest_size = sizeof(digest);
- size_t name_size = sizeof(name);
- ssl_cert* certinfo = new ssl_cert;
- session->cert = certinfo;
-
- /* This verification function uses the trusted CAs in the credentials
- * structure. So you must have installed one or more CA certificates.
- */
- ret = gnutls_certificate_verify_peers2(session->sess, &status);
-
- if (ret < 0)
- {
- certinfo->error = std::string(gnutls_strerror(ret));
- return;
- }
-
- certinfo->invalid = (status & GNUTLS_CERT_INVALID);
- certinfo->unknownsigner = (status & GNUTLS_CERT_SIGNER_NOT_FOUND);
- certinfo->revoked = (status & GNUTLS_CERT_REVOKED);
- certinfo->trusted = !(status & GNUTLS_CERT_SIGNER_NOT_CA);
-
- /* Up to here the process is the same for X.509 certificates and
- * OpenPGP keys. From now on X.509 certificates are assumed. This can
- * be easily extended to work with openpgp keys as well.
- */
- if (gnutls_certificate_type_get(session->sess) != GNUTLS_CRT_X509)
- {
- certinfo->error = "No X509 keys sent";
- return;
- }
-
- ret = gnutls_x509_crt_init(&cert);
- if (ret < 0)
- {
- certinfo->error = gnutls_strerror(ret);
- return;
- }
-
- cert_list_size = 0;
- cert_list = gnutls_certificate_get_peers(session->sess, &cert_list_size);
- if (cert_list == NULL)
- {
- certinfo->error = "No certificate was found";
- goto info_done_dealloc;
- }
-
- /* This is not a real world example, since we only check the first
- * certificate in the given chain.
- */
-
- ret = gnutls_x509_crt_import(cert, &cert_list[0], GNUTLS_X509_FMT_DER);
- if (ret < 0)
- {
- certinfo->error = gnutls_strerror(ret);
- goto info_done_dealloc;
- }
-
- gnutls_x509_crt_get_dn(cert, name, &name_size);
- certinfo->dn = name;
-
- gnutls_x509_crt_get_issuer_dn(cert, name, &name_size);
- certinfo->issuer = name;
-
- if ((ret = gnutls_x509_crt_get_fingerprint(cert, hash, digest, &digest_size)) < 0)
- {
- certinfo->error = gnutls_strerror(ret);
- }
- else
- {
- certinfo->fingerprint = irc::hex(digest, digest_size);
- }
-
- /* Beware here we do not check for errors.
- */
- if ((gnutls_x509_crt_get_expiration_time(cert) < ServerInstance->Time()) || (gnutls_x509_crt_get_activation_time(cert) > ServerInstance->Time()))
- {
- certinfo->error = "Not activated, or expired certificate";
- }
-
-info_done_dealloc:
- gnutls_x509_crt_deinit(cert);
+ if (user->eh.GetIOHook() == &iohook)
+ iohook.TellCiphersAndFingerprint(user);
}
- void OnEvent(Event& ev)
+ void OnEvent(Event& ev) CXX11_OVERRIDE
{
if (starttls.enabled)
capHandler.HandleEvent(ev);
diff --git a/src/modules/extra/m_ssl_openssl.cpp b/src/modules/extra/m_ssl_openssl.cpp
index 7b7de023c..29c3568ef 100644
--- a/src/modules/extra/m_ssl_openssl.cpp
+++ b/src/modules/extra/m_ssl_openssl.cpp
@@ -29,11 +29,12 @@
# define __AVAILABILITYMACROS__
# define DEPRECATED_IN_MAC_OS_X_VERSION_10_7_AND_LATER
#endif
-
+
#include "inspircd.h"
+#include "iohook.h"
#include <openssl/ssl.h>
#include <openssl/err.h>
-#include "ssl.h"
+#include "modules/ssl.h"
#ifdef _WIN32
# pragma comment(lib, "libcrypto.lib")
@@ -47,14 +48,8 @@
# define MAX_DESCRIPTORS 10000
#endif
-/* $ModDesc: Provides SSL support for clients */
-
-/* $LinkerFlags: if("USE_FREEBSD_BASE_SSL") -lssl -lcrypto */
-/* $CompileFlags: if(!"USE_FREEBSD_BASE_SSL") pkgconfversion("openssl","0.9.7") pkgconfincludes("openssl","/openssl/ssl.h","") */
-/* $LinkerFlags: if(!"USE_FREEBSD_BASE_SSL") rpath("pkg-config --libs openssl") pkgconflibs("openssl","/libssl.so","-lssl -lcrypto -ldl") */
-
-/* $NoPedantic */
-
+/* $CompileFlags: pkgconfversion("openssl","0.9.7") pkgconfincludes("openssl","/openssl/ssl.h","") -Wno-pedantic */
+/* $LinkerFlags: rpath("pkg-config --libs openssl") pkgconflibs("openssl","/libssl.so","-lssl -lcrypto") */
enum issl_status { ISSL_NONE, ISSL_HANDSHAKING, ISSL_OPEN };
@@ -100,234 +95,144 @@ static int OnVerify(int preverify_ok, X509_STORE_CTX *ctx)
return 1;
}
-class ModuleSSLOpenSSL : public Module
+class OpenSSLIOHook : public SSLIOHook
{
- issl_session* sessions;
-
- SSL_CTX* ctx;
- SSL_CTX* clictx;
-
- std::string sslports;
- bool use_sha;
-
- ServiceProvider iohook;
- public:
-
- ModuleSSLOpenSSL() : iohook(this, "ssl/openssl", SERVICE_IOHOOK)
+ private:
+ bool Handshake(StreamSocket* user, issl_session* session)
{
- sessions = new issl_session[ServerInstance->SE->GetMaxFds()];
+ int ret;
- /* Global SSL library initialization*/
- SSL_library_init();
- SSL_load_error_strings();
+ if (session->outbound)
+ ret = SSL_connect(session->sess);
+ else
+ ret = SSL_accept(session->sess);
- /* Build our SSL contexts:
- * NOTE: OpenSSL makes us have two contexts, one for servers and one for clients. ICK.
- */
- ctx = SSL_CTX_new( SSLv23_server_method() );
- clictx = SSL_CTX_new( SSLv23_client_method() );
+ if (ret < 0)
+ {
+ int err = SSL_get_error(session->sess, ret);
- SSL_CTX_set_mode(ctx, SSL_MODE_ENABLE_PARTIAL_WRITE | SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
- SSL_CTX_set_mode(clictx, SSL_MODE_ENABLE_PARTIAL_WRITE | SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
+ if (err == SSL_ERROR_WANT_READ)
+ {
+ ServerInstance->SE->ChangeEventMask(user, FD_WANT_POLL_READ | FD_WANT_NO_WRITE);
+ session->status = ISSL_HANDSHAKING;
+ return true;
+ }
+ else if (err == SSL_ERROR_WANT_WRITE)
+ {
+ ServerInstance->SE->ChangeEventMask(user, FD_WANT_NO_READ | FD_WANT_SINGLE_WRITE);
+ session->status = ISSL_HANDSHAKING;
+ return true;
+ }
+ else
+ {
+ CloseSession(session);
+ }
- SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, OnVerify);
- SSL_CTX_set_verify(clictx, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, OnVerify);
- }
+ return false;
+ }
+ else if (ret > 0)
+ {
+ // Handshake complete.
+ VerifyCertificate(session, user);
- void init()
- {
- // Needs the flag as it ignores a plain /rehash
- OnModuleRehash(NULL,"ssl");
- Implementation eventlist[] = { I_On005Numeric, I_OnRehash, I_OnModuleRehash, I_OnHookIO, I_OnUserConnect };
- ServerInstance->Modules->Attach(eventlist, this, sizeof(eventlist)/sizeof(Implementation));
- ServerInstance->Modules->AddService(iohook);
- }
+ session->status = ISSL_OPEN;
- void OnHookIO(StreamSocket* user, ListenSocket* lsb)
- {
- if (!user->GetIOHook() && lsb->bind_tag->getString("ssl") == "openssl")
+ ServerInstance->SE->ChangeEventMask(user, FD_WANT_POLL_READ | FD_WANT_NO_WRITE | FD_ADD_TRIAL_WRITE);
+
+ return true;
+ }
+ else if (ret == 0)
{
- /* Hook the user with our module */
- user->AddIOHook(this);
+ CloseSession(session);
+ return true;
}
+
+ return true;
}
- void OnRehash(User* user)
+ void CloseSession(issl_session* session)
{
- sslports.clear();
-
- ConfigTag* Conf = ServerInstance->Config->ConfValue("openssl");
-
- if (Conf->getBool("showports", true))
+ if (session->sess)
{
- sslports = Conf->getString("advertisedports");
- if (!sslports.empty())
- return;
-
- for (size_t i = 0; i < ServerInstance->ports.size(); i++)
- {
- ListenSocket* port = ServerInstance->ports[i];
- if (port->bind_tag->getString("ssl") != "openssl")
- continue;
-
- const std::string& portid = port->bind_desc;
- ServerInstance->Logs->Log("m_ssl_openssl", DEFAULT, "m_ssl_openssl.so: Enabling SSL for port %s", portid.c_str());
-
- if (port->bind_tag->getString("type", "clients") == "clients" && port->bind_addr != "127.0.0.1")
- {
- /*
- * Found an SSL port for clients that is not bound to 127.0.0.1 and handled by us, display
- * the IP:port in ISUPPORT.
- *
- * We used to advertise all ports seperated by a ';' char that matched the above criteria,
- * but this resulted in too long ISUPPORT lines if there were lots of ports to be displayed.
- * To solve this by default we now only display the first IP:port found and let the user
- * configure the exact value for the 005 token, if necessary.
- */
- sslports = portid;
- break;
- }
- }
+ SSL_shutdown(session->sess);
+ SSL_free(session->sess);
}
+
+ session->sess = NULL;
+ session->status = ISSL_NONE;
+ errno = EIO;
}
- void OnModuleRehash(User* user, const std::string &param)
+ void VerifyCertificate(issl_session* session, StreamSocket* user)
{
- if (param != "ssl")
+ if (!session->sess || !user)
return;
- std::string keyfile;
- std::string certfile;
- std::string cafile;
- std::string dhfile;
- OnRehash(user);
-
- ConfigTag* conf = ServerInstance->Config->ConfValue("openssl");
-
- cafile = conf->getString("cafile", CONFIG_PATH "/ca.pem");
- certfile = conf->getString("certfile", CONFIG_PATH "/cert.pem");
- keyfile = conf->getString("keyfile", CONFIG_PATH "/key.pem");
- dhfile = conf->getString("dhfile", CONFIG_PATH "/dhparams.pem");
- std::string hash = conf->getString("hash", "md5");
- if (hash != "sha1" && hash != "md5")
- throw ModuleException("Unknown hash type " + hash);
- use_sha = (hash == "sha1");
+ X509* cert;
+ ssl_cert* certinfo = new ssl_cert;
+ session->cert = certinfo;
+ unsigned int n;
+ unsigned char md[EVP_MAX_MD_SIZE];
- std::string ciphers = conf->getString("ciphers", "");
+ cert = SSL_get_peer_certificate((SSL*)session->sess);
- if (!ciphers.empty())
+ if (!cert)
{
- if ((!SSL_CTX_set_cipher_list(ctx, ciphers.c_str())) || (!SSL_CTX_set_cipher_list(clictx, ciphers.c_str())))
- {
- ServerInstance->Logs->Log("m_ssl_openssl",DEFAULT, "m_ssl_openssl.so: Can't set cipher list to %s.", ciphers.c_str());
- ERR_print_errors_cb(error_callback, this);
- }
+ certinfo->error = "Could not get peer certificate: "+std::string(get_error());
+ return;
}
- /* Load our keys and certificates
- * NOTE: OpenSSL's error logging API sucks, don't blame us for this clusterfuck.
- */
- if ((!SSL_CTX_use_certificate_chain_file(ctx, certfile.c_str())) || (!SSL_CTX_use_certificate_chain_file(clictx, certfile.c_str())))
- {
- ServerInstance->Logs->Log("m_ssl_openssl",DEFAULT, "m_ssl_openssl.so: Can't read certificate file %s. %s", certfile.c_str(), strerror(errno));
- ERR_print_errors_cb(error_callback, this);
- }
+ certinfo->invalid = (SSL_get_verify_result(session->sess) != X509_V_OK);
- if (((!SSL_CTX_use_PrivateKey_file(ctx, keyfile.c_str(), SSL_FILETYPE_PEM))) || (!SSL_CTX_use_PrivateKey_file(clictx, keyfile.c_str(), SSL_FILETYPE_PEM)))
+ if (!SelfSigned)
{
- ServerInstance->Logs->Log("m_ssl_openssl",DEFAULT, "m_ssl_openssl.so: Can't read key file %s. %s", keyfile.c_str(), strerror(errno));
- ERR_print_errors_cb(error_callback, this);
+ certinfo->unknownsigner = false;
+ certinfo->trusted = true;
}
-
- /* Load the CAs we trust*/
- if (((!SSL_CTX_load_verify_locations(ctx, cafile.c_str(), 0))) || (!SSL_CTX_load_verify_locations(clictx, cafile.c_str(), 0)))
+ else
{
- ServerInstance->Logs->Log("m_ssl_openssl",DEFAULT, "m_ssl_openssl.so: Can't read CA list from %s. This is only a problem if you want to verify client certificates, otherwise it's safe to ignore this message. Error: %s", cafile.c_str(), strerror(errno));
- ERR_print_errors_cb(error_callback, this);
+ certinfo->unknownsigner = true;
+ certinfo->trusted = false;
}
- FILE* dhpfile = fopen(dhfile.c_str(), "r");
- DH* ret;
+ certinfo->dn = X509_NAME_oneline(X509_get_subject_name(cert),0,0);
+ certinfo->issuer = X509_NAME_oneline(X509_get_issuer_name(cert),0,0);
- if (dhpfile == NULL)
+ if (!X509_digest(cert, digest, md, &n))
{
- ServerInstance->Logs->Log("m_ssl_openssl",DEFAULT, "m_ssl_openssl.so Couldn't open DH file %s: %s", dhfile.c_str(), strerror(errno));
- throw ModuleException("Couldn't open DH file " + dhfile + ": " + strerror(errno));
+ certinfo->error = "Out of memory generating fingerprint";
}
else
{
- ret = PEM_read_DHparams(dhpfile, NULL, NULL, NULL);
- if ((SSL_CTX_set_tmp_dh(ctx, ret) < 0) || (SSL_CTX_set_tmp_dh(clictx, ret) < 0))
- {
- ServerInstance->Logs->Log("m_ssl_openssl",DEFAULT, "m_ssl_openssl.so: Couldn't set DH parameters %s. SSL errors follow:", dhfile.c_str());
- ERR_print_errors_cb(error_callback, this);
- }
+ certinfo->fingerprint = BinToHex(md, n);
}
- fclose(dhpfile);
- }
-
- void On005Numeric(std::string &output)
- {
- if (!sslports.empty())
- output.append(" SSL=" + sslports);
- }
-
- ~ModuleSSLOpenSSL()
- {
- SSL_CTX_free(ctx);
- SSL_CTX_free(clictx);
- delete[] sessions;
- }
-
- void OnUserConnect(LocalUser* user)
- {
- if (user->eh.GetIOHook() == this)
+ if ((ASN1_UTCTIME_cmp_time_t(X509_get_notAfter(cert), ServerInstance->Time()) == -1) || (ASN1_UTCTIME_cmp_time_t(X509_get_notBefore(cert), ServerInstance->Time()) == 0))
{
- if (sessions[user->eh.GetFd()].sess)
- {
- if (!sessions[user->eh.GetFd()].cert->fingerprint.empty())
- user->WriteServ("NOTICE %s :*** You are connected using SSL cipher \"%s\""
- " and your SSL fingerprint is %s", user->nick.c_str(), SSL_get_cipher(sessions[user->eh.GetFd()].sess), sessions[user->eh.GetFd()].cert->fingerprint.c_str());
- else
- user->WriteServ("NOTICE %s :*** You are connected using SSL cipher \"%s\"", user->nick.c_str(), SSL_get_cipher(sessions[user->eh.GetFd()].sess));
- }
+ certinfo->error = "Not activated, or expired certificate";
}
- }
-
- void OnCleanup(int target_type, void* item)
- {
- if (target_type == TYPE_USER)
- {
- LocalUser* user = IS_LOCAL((User*)item);
- if (user && user->eh.GetIOHook() == this)
- {
- // User is using SSL, they're a local user, and they're using one of *our* SSL ports.
- // Potentially there could be multiple SSL modules loaded at once on different ports.
- ServerInstance->Users->QuitUser(user, "SSL module unloading");
- }
- }
+ X509_free(cert);
}
- Version GetVersion()
+ public:
+ issl_session* sessions;
+ SSL_CTX* ctx;
+ SSL_CTX* clictx;
+ const EVP_MD *digest;
+
+ OpenSSLIOHook(Module* mod)
+ : SSLIOHook(mod, "ssl/openssl")
{
- return Version("Provides SSL support for clients", VF_VENDOR);
+ sessions = new issl_session[ServerInstance->SE->GetMaxFds()];
}
- void OnRequest(Request& request)
+ ~OpenSSLIOHook()
{
- if (strcmp("GET_SSL_CERT", request.id) == 0)
- {
- SocketCertificateRequest& req = static_cast<SocketCertificateRequest&>(request);
- int fd = req.sock->GetFd();
- issl_session* session = &sessions[fd];
-
- req.cert = session->cert;
- }
+ delete[] sessions;
}
- void OnStreamSocketAccept(StreamSocket* user, irc::sockets::sockaddrs* client, irc::sockets::sockaddrs* server)
+ void OnStreamSocketAccept(StreamSocket* user, irc::sockets::sockaddrs* client, irc::sockets::sockaddrs* server) CXX11_OVERRIDE
{
int fd = user->GetFd();
@@ -343,14 +248,14 @@ class ModuleSSLOpenSSL : public Module
if (SSL_set_fd(session->sess, fd) == 0)
{
- ServerInstance->Logs->Log("m_ssl_openssl",DEBUG,"BUG: Can't set fd with SSL_set_fd: %d", fd);
+ ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "BUG: Can't set fd with SSL_set_fd: %d", fd);
return;
}
Handshake(user, session);
}
- void OnStreamSocketConnect(StreamSocket* user)
+ void OnStreamSocketConnect(StreamSocket* user) CXX11_OVERRIDE
{
int fd = user->GetFd();
/* Are there any possibilities of an out of range fd? Hope not, but lets be paranoid */
@@ -368,14 +273,14 @@ class ModuleSSLOpenSSL : public Module
if (SSL_set_fd(session->sess, fd) == 0)
{
- ServerInstance->Logs->Log("m_ssl_openssl",DEBUG,"BUG: Can't set fd with SSL_set_fd: %d", fd);
+ ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "BUG: Can't set fd with SSL_set_fd: %d", fd);
return;
}
Handshake(user, session);
}
- void OnStreamSocketClose(StreamSocket* user)
+ void OnStreamSocketClose(StreamSocket* user) CXX11_OVERRIDE
{
int fd = user->GetFd();
/* Are there any possibilities of an out of range fd? Hope not, but lets be paranoid */
@@ -385,7 +290,7 @@ class ModuleSSLOpenSSL : public Module
CloseSession(&sessions[fd]);
}
- int OnStreamSocketRead(StreamSocket* user, std::string& recvq)
+ int OnStreamSocketRead(StreamSocket* user, std::string& recvq) CXX11_OVERRIDE
{
int fd = user->GetFd();
/* Are there any possibilities of an out of range fd? Hope not, but lets be paranoid */
@@ -459,7 +364,7 @@ class ModuleSSLOpenSSL : public Module
return 0;
}
- int OnStreamSocketWrite(StreamSocket* user, std::string& buffer)
+ int OnStreamSocketWrite(StreamSocket* user, std::string& buffer) CXX11_OVERRIDE
{
int fd = user->GetFd();
@@ -528,128 +433,230 @@ class ModuleSSLOpenSSL : public Module
return 0;
}
- bool Handshake(StreamSocket* user, issl_session* session)
+ ssl_cert* GetCertificate(StreamSocket* sock) CXX11_OVERRIDE
{
- int ret;
-
- if (session->outbound)
- ret = SSL_connect(session->sess);
- else
- ret = SSL_accept(session->sess);
+ int fd = sock->GetFd();
+ issl_session* session = &sessions[fd];
+ return session->cert;
+ }
- if (ret < 0)
+ void TellCiphersAndFingerprint(LocalUser* user)
+ {
+ issl_session& s = sessions[user->eh.GetFd()];
+ if (s.sess)
{
- int err = SSL_get_error(session->sess, ret);
-
- if (err == SSL_ERROR_WANT_READ)
- {
- ServerInstance->SE->ChangeEventMask(user, FD_WANT_POLL_READ | FD_WANT_NO_WRITE);
- session->status = ISSL_HANDSHAKING;
- return true;
- }
- else if (err == SSL_ERROR_WANT_WRITE)
- {
- ServerInstance->SE->ChangeEventMask(user, FD_WANT_NO_READ | FD_WANT_SINGLE_WRITE);
- session->status = ISSL_HANDSHAKING;
- return true;
- }
- else
- {
- CloseSession(session);
- }
+ std::string text = "*** You are connected using SSL cipher '" + std::string(SSL_get_cipher(s.sess)) + "'";
+ const std::string& fingerprint = s.cert->fingerprint;
+ if (!fingerprint.empty())
+ text += " and your SSL fingerprint is " + fingerprint;
- return false;
+ user->WriteNotice(text);
}
- else if (ret > 0)
- {
- // Handshake complete.
- VerifyCertificate(session, user);
+ }
+};
- session->status = ISSL_OPEN;
+class ModuleSSLOpenSSL : public Module
+{
+ std::string sslports;
+ OpenSSLIOHook iohook;
- ServerInstance->SE->ChangeEventMask(user, FD_WANT_POLL_READ | FD_WANT_NO_WRITE | FD_ADD_TRIAL_WRITE);
+ public:
+ ModuleSSLOpenSSL() : iohook(this)
+ {
+ /* Global SSL library initialization*/
+ SSL_library_init();
+ SSL_load_error_strings();
- return true;
- }
- else if (ret == 0)
- {
- CloseSession(session);
- return true;
- }
+ /* Build our SSL contexts:
+ * NOTE: OpenSSL makes us have two contexts, one for servers and one for clients. ICK.
+ */
+ iohook.ctx = SSL_CTX_new( SSLv23_server_method() );
+ iohook.clictx = SSL_CTX_new( SSLv23_client_method() );
- return true;
+ SSL_CTX_set_mode(iohook.ctx, SSL_MODE_ENABLE_PARTIAL_WRITE | SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
+ SSL_CTX_set_mode(iohook.clictx, SSL_MODE_ENABLE_PARTIAL_WRITE | SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
+
+ SSL_CTX_set_verify(iohook.ctx, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, OnVerify);
+ SSL_CTX_set_verify(iohook.clictx, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, OnVerify);
}
- void CloseSession(issl_session* session)
+ ~ModuleSSLOpenSSL()
{
- if (session->sess)
+ SSL_CTX_free(iohook.ctx);
+ SSL_CTX_free(iohook.clictx);
+ }
+
+ void init() CXX11_OVERRIDE
+ {
+ // Needs the flag as it ignores a plain /rehash
+ OnModuleRehash(NULL,"ssl");
+ ServerInstance->Modules->AddService(iohook);
+ }
+
+ void OnHookIO(StreamSocket* user, ListenSocket* lsb) CXX11_OVERRIDE
+ {
+ if (!user->GetIOHook() && lsb->bind_tag->getString("ssl") == "openssl")
{
- SSL_shutdown(session->sess);
- SSL_free(session->sess);
+ /* Hook the user with our module */
+ user->AddIOHook(&iohook);
}
+ }
- session->sess = NULL;
- session->status = ISSL_NONE;
- errno = EIO;
+ void OnRehash(User* user) CXX11_OVERRIDE
+ {
+ sslports.clear();
+
+ ConfigTag* Conf = ServerInstance->Config->ConfValue("openssl");
+
+ if (Conf->getBool("showports", true))
+ {
+ sslports = Conf->getString("advertisedports");
+ if (!sslports.empty())
+ return;
+
+ for (size_t i = 0; i < ServerInstance->ports.size(); i++)
+ {
+ ListenSocket* port = ServerInstance->ports[i];
+ if (port->bind_tag->getString("ssl") != "openssl")
+ continue;
+
+ const std::string& portid = port->bind_desc;
+ ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "Enabling SSL for port %s", portid.c_str());
+
+ if (port->bind_tag->getString("type", "clients") == "clients" && port->bind_addr != "127.0.0.1")
+ {
+ /*
+ * Found an SSL port for clients that is not bound to 127.0.0.1 and handled by us, display
+ * the IP:port in ISUPPORT.
+ *
+ * We used to advertise all ports seperated by a ';' char that matched the above criteria,
+ * but this resulted in too long ISUPPORT lines if there were lots of ports to be displayed.
+ * To solve this by default we now only display the first IP:port found and let the user
+ * configure the exact value for the 005 token, if necessary.
+ */
+ sslports = portid;
+ break;
+ }
+ }
+ }
}
- void VerifyCertificate(issl_session* session, StreamSocket* user)
+ void OnModuleRehash(User* user, const std::string &param) CXX11_OVERRIDE
{
- if (!session->sess || !user)
+ if (param != "ssl")
return;
- X509* cert;
- ssl_cert* certinfo = new ssl_cert;
- session->cert = certinfo;
- unsigned int n;
- unsigned char md[EVP_MAX_MD_SIZE];
- const EVP_MD *digest = use_sha ? EVP_sha1() : EVP_md5();
+ std::string keyfile;
+ std::string certfile;
+ std::string cafile;
+ std::string dhfile;
+ OnRehash(user);
- cert = SSL_get_peer_certificate((SSL*)session->sess);
+ ConfigTag* conf = ServerInstance->Config->ConfValue("openssl");
- if (!cert)
+ cafile = ServerInstance->Config->Paths.PrependConfig(conf->getString("cafile", "ca.pem"));
+ certfile = ServerInstance->Config->Paths.PrependConfig(conf->getString("certfile", "cert.pem"));
+ keyfile = ServerInstance->Config->Paths.PrependConfig(conf->getString("keyfile", "key.pem"));
+ dhfile = ServerInstance->Config->Paths.PrependConfig(conf->getString("dhfile", "dhparams.pem"));
+ std::string hash = conf->getString("hash", "md5");
+
+ iohook.digest = EVP_get_digestbyname(hash.c_str());
+ if (iohook.digest == NULL)
+ throw ModuleException("Unknown hash type " + hash);
+
+ std::string ciphers = conf->getString("ciphers", "");
+
+ SSL_CTX* ctx = iohook.ctx;
+ SSL_CTX* clictx = iohook.clictx;
+
+ if (!ciphers.empty())
{
- certinfo->error = "Could not get peer certificate: "+std::string(get_error());
- return;
+ if ((!SSL_CTX_set_cipher_list(ctx, ciphers.c_str())) || (!SSL_CTX_set_cipher_list(clictx, ciphers.c_str())))
+ {
+ ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "Can't set cipher list to %s.", ciphers.c_str());
+ ERR_print_errors_cb(error_callback, this);
+ }
}
- certinfo->invalid = (SSL_get_verify_result(session->sess) != X509_V_OK);
+ /* Load our keys and certificates
+ * NOTE: OpenSSL's error logging API sucks, don't blame us for this clusterfuck.
+ */
+ if ((!SSL_CTX_use_certificate_chain_file(ctx, certfile.c_str())) || (!SSL_CTX_use_certificate_chain_file(clictx, certfile.c_str())))
+ {
+ ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "Can't read certificate file %s. %s", certfile.c_str(), strerror(errno));
+ ERR_print_errors_cb(error_callback, this);
+ }
- if (!SelfSigned)
+ if (((!SSL_CTX_use_PrivateKey_file(ctx, keyfile.c_str(), SSL_FILETYPE_PEM))) || (!SSL_CTX_use_PrivateKey_file(clictx, keyfile.c_str(), SSL_FILETYPE_PEM)))
{
- certinfo->unknownsigner = false;
- certinfo->trusted = true;
+ ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "Can't read key file %s. %s", keyfile.c_str(), strerror(errno));
+ ERR_print_errors_cb(error_callback, this);
}
- else
+
+ /* Load the CAs we trust*/
+ if (((!SSL_CTX_load_verify_locations(ctx, cafile.c_str(), 0))) || (!SSL_CTX_load_verify_locations(clictx, cafile.c_str(), 0)))
{
- certinfo->unknownsigner = true;
- certinfo->trusted = false;
+ ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "Can't read CA list from %s. This is only a problem if you want to verify client certificates, otherwise it's safe to ignore this message. Error: %s", cafile.c_str(), strerror(errno));
+ ERR_print_errors_cb(error_callback, this);
}
- certinfo->dn = X509_NAME_oneline(X509_get_subject_name(cert),0,0);
- certinfo->issuer = X509_NAME_oneline(X509_get_issuer_name(cert),0,0);
+ FILE* dhpfile = fopen(dhfile.c_str(), "r");
+ DH* ret;
- if (!X509_digest(cert, digest, md, &n))
+ if (dhpfile == NULL)
{
- certinfo->error = "Out of memory generating fingerprint";
+ ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "Couldn't open DH file %s: %s", dhfile.c_str(), strerror(errno));
+ throw ModuleException("Couldn't open DH file " + dhfile + ": " + strerror(errno));
}
else
{
- certinfo->fingerprint = irc::hex(md, n);
+ ret = PEM_read_DHparams(dhpfile, NULL, NULL, NULL);
+ if ((SSL_CTX_set_tmp_dh(ctx, ret) < 0) || (SSL_CTX_set_tmp_dh(clictx, ret) < 0))
+ {
+ ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "Couldn't set DH parameters %s. SSL errors follow:", dhfile.c_str());
+ ERR_print_errors_cb(error_callback, this);
+ }
}
- if ((ASN1_UTCTIME_cmp_time_t(X509_get_notAfter(cert), ServerInstance->Time()) == -1) || (ASN1_UTCTIME_cmp_time_t(X509_get_notBefore(cert), ServerInstance->Time()) == 0))
+ fclose(dhpfile);
+ }
+
+ void On005Numeric(std::map<std::string, std::string>& tokens) CXX11_OVERRIDE
+ {
+ if (!sslports.empty())
+ tokens["SSL"] = sslports;
+ }
+
+ void OnUserConnect(LocalUser* user) CXX11_OVERRIDE
+ {
+ if (user->eh.GetIOHook() == &iohook)
+ iohook.TellCiphersAndFingerprint(user);
+ }
+
+ void OnCleanup(int target_type, void* item) CXX11_OVERRIDE
+ {
+ if (target_type == TYPE_USER)
{
- certinfo->error = "Not activated, or expired certificate";
+ LocalUser* user = IS_LOCAL((User*)item);
+
+ if (user && user->eh.GetIOHook() == &iohook)
+ {
+ // User is using SSL, they're a local user, and they're using one of *our* SSL ports.
+ // Potentially there could be multiple SSL modules loaded at once on different ports.
+ ServerInstance->Users->QuitUser(user, "SSL module unloading");
+ }
}
+ }
- X509_free(cert);
+ Version GetVersion() CXX11_OVERRIDE
+ {
+ return Version("Provides SSL support for clients", VF_VENDOR);
}
};
static int error_callback(const char *str, size_t len, void *u)
{
- ServerInstance->Logs->Log("m_ssl_openssl",DEFAULT, "SSL error: " + std::string(str, len - 1));
+ ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "SSL error: " + std::string(str, len - 1));
//
// XXX: Remove this line, it causes valgrind warnings...
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-16 02:55:01 +0000