/* +------------------------------------+
* | Inspire Internet Relay Chat Daemon |
* +------------------------------------+
*
* InspIRCd: (C) 2002-2011 InspIRCd Development Team
* See: http://wiki.inspircd.org/Credits
*
* This program is free but copyrighted software; see
* the file COPYING for details.
*
* ---------------------------------------------------
*/
#include "inspircd.h"
#include <openssl/ssl.h>
#include <openssl/err.h>
#include "ssl.h"
#ifdef WINDOWS
#pragma comment(lib, "libeay32MTd")
#pragma comment(lib, "ssleay32MTd")
#undef MAX_DESCRIPTORS
#define MAX_DESCRIPTORS 10000
#endif
/* $ModDesc: Provides SSL support for clients */
/* $LinkerFlags: if("USE_FREEBSD_BASE_SSL") -lssl -lcrypto */
/* $CompileFlags: if(!"USE_FREEBSD_BASE_SSL") pkgconfversion("openssl","0.9.7") pkgconfincludes("openssl","/openssl/ssl.h","") */
/* $LinkerFlags: if(!"USE_FREEBSD_BASE_SSL") rpath("pkg-config --libs openssl") pkgconflibs("openssl","/libssl.so","-lssl -lcrypto -ldl") */
/* $NoPedantic */
enum issl_status { ISSL_NONE, ISSL_HANDSHAKING, ISSL_OPEN };
static bool SelfSigned = false;
static bool use_sha;
static char* get_error()
{
return ERR_error_string(ERR_get_error(), NULL);
}
static int error_callback(const char *str, size_t len, void *u);
static int OnVerify(int preverify_ok, X509_STORE_CTX *store_ctx)
{
/* XXX: This will allow self signed certificates.
* In the future if we want an option to not allow this,
* we can just return preverify_ok here, and openssl
* will boot off self-signed and invalid peer certs.
*/
int ve = X509_STORE_CTX_get_error(store_ctx);
SelfSigned = (ve == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT);
return 1;
}
/** Represents an SSL user's extra data
*/
class OSSLHook : public SSLIOHook
{
public:
SSL* sess;
issl_status status;
reference<ssl_cert> cert;
int fd;
bool outbound;
bool data_to_write;
OSSLHook(Module* Creator, bool client, StreamSocket* user, SSL_CTX* ctx) : SSLIOHook(Creator)
{
outbound = false;
data_to_write = false;
fd = user->GetFd();
sess = SSL_new(ctx);
status = ISSL_NONE;
outbound = client;
if (!sess)
return;
if (SSL_set_fd(sess, fd) == 0)
{
ServerInstance->Logs->Log("m_ssl_openssl",DEBUG,"BUG: Can't set fd with SSL_set_fd: %d", fd);
}
user->SetIOHook(this);
}
int OnRead(StreamSocket* user, std::string& recvq)
{
if (!sess)
return -1;
if (status == ISSL_HANDSHAKING)
{
// The handshake isn't finished and it wants to read, try to finish it.
if (!Handshake(user))
{
// Couldn't resume handshake.
if (status == ISSL_NONE)
return -1;
return 0;
}
}
// If we resumed the handshake then status will be ISSL_OPEN
if (status == ISSL_OPEN)
{
char* buffer = ServerInstance->GetReadBuffer();
size_t bufsiz = ServerInstance->Config->NetBufferSize;
int ret = SSL_read(sess, buffer, bufsiz);
if (ret > 0)
{
recvq.append(buffer, ret);
return 1;
}
else if (ret == 0)
{
// Client closed connection.
OnClose(user);
return -1;
}
else if (ret < 0)
{
int err = SSL_get_error(sess, ret);
if (err == SSL_ERROR_WANT_READ)
{
ServerInstance->SE->ChangeEventMask(user, FD_WANT_POLL_READ);
return 0;
}
else if (err == SSL_ERROR_WANT_WRITE)
{
ServerInstance->SE->ChangeEventMask(user, FD_WANT_NO_READ | FD_WANT_SINGLE_WRITE);
return 0;
}
else
{
OnClose(user);
return -1;
}
}
}
return 0;
}
int OnWrite(StreamSocket* user, std::string& buffer)
{
if (!sess)
return -1;
data_to_write = true;
if (status == ISSL_HANDSHAKING)
{
if (!Handshake(user))
{
// Couldn't resume handshake.
if (status == ISSL_NONE)
return -1;
return 0;
}
}
if (status == ISSL_OPEN)
{
int ret = SSL_write(sess, buffer.data(), buffer.size());
if (ret == (int)buffer.length())
{
data_to_write = false;
ServerInstance->SE->ChangeEventMask(user, FD_WANT_POLL_READ | FD_WANT_NO_WRITE);
return 1;
}
else if (ret > 0)
{
buffer = buffer.substr(ret);
ServerInstance->SE->ChangeEventMask(user, FD_WANT_SINGLE_WRITE);
return 0;
}
else if (ret == 0)
{
OnClose(user);
return -1;
}
else if (ret < 0)
{
int err = SSL_get_error(sess, ret);
if (err == SSL_ERROR_WANT_WRITE)
{
ServerInstance->SE->ChangeEventMask(user, FD_WANT_SINGLE_WRITE);
return 0;
}
else if (err == SSL_ERROR_WANT_READ)
{
ServerInstance->SE->ChangeEventMask(user, FD_WANT_POLL_READ | FD_WANT_NO_WRITE);
return 0;
}
else
{
OnClose(user);
return -1;
}
}
}
return 0;
}
bool Handshake(StreamSocket* user)
{
int ret;
if (outbound)
ret = SSL_connect(sess);
else
ret = SSL_accept(sess);
if (ret < 0)
{
int err = SSL_get_error(sess, ret);
if (err == SSL_ERROR_WANT_READ)
{
ServerInstance->SE->ChangeEventMask(user, FD_WANT_POLL_READ | FD_WANT_NO_WRITE);
status = ISSL_HANDSHAKING;
return true;
}
else if (err == SSL_ERROR_WANT_WRITE)
{
ServerInstance->SE->ChangeEventMask(user, FD_WANT_NO_READ | FD_WANT_SINGLE_WRITE);
status = ISSL_HANDSHAKING;
return true;
}
else
{
OnClose(user);
}
return false;
}
else if (ret > 0)
{
// Handshake complete.
VerifyCertificate(user);
status = ISSL_OPEN;
ServerInstance->SE->ChangeEventMask(user, FD_WANT_POLL_READ | FD_WANT_NO_WRITE | FD_ADD_TRIAL_WRITE);
return true;
}
else if (ret == 0)
{
OnClose(user);
return true;
}
return true;
}
void OnClose(StreamSocket* user)
{
if (sess)
{
SSL_shutdown(sess);
SSL_free(sess);
}
sess = NULL;
status = ISSL_NONE;
}
void VerifyCertificate(StreamSocket* user)
{
ssl_cert* certinfo = new ssl_cert;
cert = certinfo;
unsigned int n;
unsigned char md[EVP_MAX_MD_SIZE];
const EVP_MD *digest = use_sha ? EVP_sha1() : EVP_md5();
X509* rawcert = SSL_get_peer_certificate(sess);
if (!rawcert)
{
certinfo->error = "Could not get peer certificate: "+std::string(get_error());
return;
}
certinfo->invalid = (SSL_get_verify_result(sess) != X509_V_OK);
if (SelfSigned)
{
certinfo->unknownsigner = false;
certinfo->trusted = true;
}
else
{
certinfo->unknownsigner = true;
certinfo->trusted = false;
}
certinfo->dn = X509_NAME_oneline(X509_get_subject_name(rawcert),0,0);
certinfo->issuer = X509_NAME_oneline(X509_get_issuer_name(rawcert),0,0);
if (!X509_digest(rawcert, digest, md, &n))
{
certinfo->error = "Out of memory generating fingerprint";
}
else
{
certinfo->fingerprint = irc::hex(md, n);
}
if ((ASN1_UTCTIME_cmp_time_t(X509_get_notAfter(rawcert), ServerInstance->Time()) == -1) || (ASN1_UTCTIME_cmp_time_t(X509_get_notBefore(rawcert), ServerInstance->Time()) == 0))
{
certinfo->error = "Not activated, or expired certificate";
}
X509_free(rawcert);
}
ssl_cert* GetCertificate()
{
return cert;
}
};
class OSSLProvider : public IOHookProvider
{
public:
SSL_CTX* ctx;
SSL_CTX* clictx;
OSSLProvider(Module* Creator) : IOHookProvider(Creator, "ssl/openssl") {}
~OSSLProvider()
{
SSL_CTX_free(ctx);
SSL_CTX_free(clictx);
}
void OnClientConnection(StreamSocket* user, ConfigTag* tag)
{
new OSSLHook(creator, true, user, clictx);
}
void OnServerConnection(StreamSocket* user, ListenSocket* from)
{
new OSSLHook(creator, false, user, ctx);
}
};
class ModuleSSLOpenSSL : public Module
{
std::string sslports;
OSSLProvider iohook;
public:
ModuleSSLOpenSSL() : iohook(this)
{
/* Global SSL library initialization*/
SSL_library_init();
SSL_load_error_strings();
/* Build our SSL contexts:
* NOTE: OpenSSL makes us have two contexts, one for servers and one for clients. ICK.
*/
iohook.ctx = SSL_CTX_new( SSLv23_server_method() );
iohook.clictx = SSL_CTX_new( SSLv23_client_method() );
SSL_CTX_set_mode(iohook.ctx, SSL_MODE_ENABLE_PARTIAL_WRITE | SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
SSL_CTX_set_mode(iohook.clictx, SSL_MODE_ENABLE_PARTIAL_WRITE | SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
SSL_CTX_set_verify(iohook.ctx, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, OnVerify);
SSL_CTX_set_verify(iohook.clictx, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, OnVerify);
}
void init()
{
// Needs the flag as it ignores a plain /rehash
OnModuleRehash(NULL,"ssl");
Implementation eventlist[] = { I_On005Numeric, I_OnModuleRehash, I_OnUserConnect };
ServerInstance->Modules->Attach(eventlist, this, sizeof(eventlist)/sizeof(Implementation));
ServerInstance->Modules->AddService(iohook);
}
void ReadConfig(ConfigReadStatus&)
{
sslports.clear();
ConfigTag* Conf = ServerInstance->Config->GetTag("openssl");
if (Conf->getBool("showports", true))
{
for (size_t i = 0; i < ServerInstance->ports.size(); i++)
{
ListenSocket* port = ServerInstance->ports[i];
if (port->bind_tag->getString("ssl") != "openssl")
continue;
std::string portid = port->bind_desc;
ServerInstance->Logs->Log("m_ssl_openssl", DEFAULT, "m_ssl_openssl.so: Enabling SSL for port %s", portid.c_str());
if (port->bind_tag->getString("type", "clients") == "clients" && port->bind_addr != "127.0.0.1")
sslports.append(portid).append(";");
}
if (!sslports.empty())
sslports.erase(sslports.end() - 1);
}
}
void OnModuleRehash(User* user, const std::string ¶m)
{
if (param != "ssl")
return;
std::string keyfile;
std::string certfile;
std::string cafile;
std::string dhfile;
ConfigTag* conf = ServerInstance->Config->GetTag("openssl");
cafile = conf->getString("cafile", "conf/ca.pem");
certfile = conf->getString("certfile", "conf/cert.pem");
keyfile = conf->getString("keyfile", "conf/key.pem");
dhfile = conf->getString("dhfile", "conf/dhparams.pem");
std::string hash = conf->getString("hash", "md5");
if (hash != "sha1" && hash != "md5")
throw ModuleException("Unknown hash type " + hash);
use_sha = (hash == "sha1");
/* Load our keys and certificates
* NOTE: OpenSSL's error logging API sucks, don't blame us for this clusterfuck.
*/
if ((!SSL_CTX_use_certificate_chain_file(iohook.ctx, certfile.c_str())) ||
(!SSL_CTX_use_certificate_chain_file(iohook.clictx, certfile.c_str())))
{
ServerInstance->Logs->Log("m_ssl_openssl",DEFAULT, "m_ssl_openssl.so: Can't read certificate file %s. %s", certfile.c_str(), strerror(errno));
ERR_print_errors_cb(error_callback, this);
}
if (((!SSL_CTX_use_PrivateKey_file(iohook.ctx, keyfile.c_str(), SSL_FILETYPE_PEM))) ||
(!SSL_CTX_use_PrivateKey_file(iohook.clictx, keyfile.c_str(), SSL_FILETYPE_PEM)))
{
ServerInstance->Logs->Log("m_ssl_openssl",DEFAULT, "m_ssl_openssl.so: Can't read key file %s. %s", keyfile.c_str(), strerror(errno));
ERR_print_errors_cb(error_callback, this);
}
/* Load the CAs we trust*/
if (((!SSL_CTX_load_verify_locations(iohook.ctx, cafile.c_str(), 0))) ||
(!SSL_CTX_load_verify_locations(iohook.clictx, cafile.c_str(), 0)))
{
ServerInstance->Logs->Log("m_ssl_openssl",DEFAULT, "m_ssl_openssl.so: Can't read CA list from %s. %s", cafile.c_str(), strerror(errno));
ERR_print_errors_cb(error_callback, this);
}
FILE* dhpfile = fopen(dhfile.c_str(), "r");
DH* ret;
if (dhpfile == NULL)
{
ServerInstance->Logs->Log("m_ssl_openssl",DEFAULT, "m_ssl_openssl.so Couldn't open DH file %s: %s", dhfile.c_str(), strerror(errno));
throw ModuleException("Couldn't open DH file " + dhfile + ": " + strerror(errno));
}
else
{
ret = PEM_read_DHparams(dhpfile, NULL, NULL, NULL);
if ((SSL_CTX_set_tmp_dh(iohook.ctx, ret) < 0) || (SSL_CTX_set_tmp_dh(iohook.clictx, ret) < 0))
{
ServerInstance->Logs->Log("m_ssl_openssl",DEFAULT, "m_ssl_openssl.so: Couldn't set DH parameters %s. SSL errors follow:", dhfile.c_str());
ERR_print_errors_cb(error_callback, this);
}
}
fclose(dhpfile);
}
void On005Numeric(std::string &output)
{
if (!sslports.empty())
output.append(" SSL=" + sslports);
}
void OnUserConnect(LocalUser* user)
{
OSSLHook* hook = static_cast<OSSLHook*>(user->eh->GetIOHook());
if (hook && hook->creator == this)
{
if (!hook->cert->fingerprint.empty())
user->WriteServ("NOTICE %s :*** You are connected using SSL fingerprint %s",
user->nick.c_str(), hook->cert->fingerprint.c_str());
}
}
Version GetVersion()
{
return Version("Provides SSL support for clients", VF_VENDOR);
}
};
static int error_callback(const char *str, size_t len, void *u)
{
ServerInstance->Logs->Log("m_ssl_openssl",DEFAULT, "SSL error: " + std::string(str, len - 1));
return 0;
}
MODULE_INIT(ModuleSSLOpenSSL)
