From 4e1d7b84f5415e9901ec18c0ed4cb012376e4859 Mon Sep 17 00:00:00 2001
From: Sadie Powell
Date: Wed, 1 Mar 2023 20:07:27 +0000
Subject: Warn users when their client certificate is about to expire.

Closes #1938.
---
 src/modules/m_sslinfo.cpp | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

(limited to 'src')

diff --git a/src/modules/m_sslinfo.cpp b/src/modules/m_sslinfo.cpp
index f7f970a9d..309a99a64 100644
--- a/src/modules/m_sslinfo.cpp
+++ b/src/modules/m_sslinfo.cpp
@@ -253,6 +253,7 @@ class ModuleSSLInfo
  private:
 	CommandSSLInfo cmd;
 	std::string hash;
+	unsigned long warnexpiring;
 
 	bool MatchFP(ssl_cert* const cert, const std::string& fp) const
 	{
@@ -273,6 +274,7 @@ class ModuleSSLInfo
 		ConfigTag* tag = ServerInstance->Config->ConfValue("sslinfo");
 		cmd.operonlyfp = tag->getBool("operonly");
 		hash = tag->getString("hash");
+		warnexpiring = tag->getDuration("warnexpiring", 0, 0, 60*60*24*365);
 	}
 
 	Version GetVersion() CXX11_OVERRIDE
@@ -386,6 +388,19 @@ class ModuleSSLInfo
 			if (do_login)
 				user->Oper(ifo);
 		}
+
+		if (!warnexpiring || !cert->GetExpirationTime())
+			return;
+
+		if (ServerInstance->Time() > cert->GetExpirationTime())
+		{
+			user->WriteNotice("*** Your TLS (SSL) client certificate has expired.");
+		}
+		else if (static_cast<time_t>(ServerInstance->Time() + warnexpiring) > cert->GetExpirationTime())
+		{
+			const std::string duration = InspIRCd::DurationString(cert->GetExpirationTime() - ServerInstance->Time());
+			user->WriteNotice("*** Your TLS (SSL) client certificate expires in " + duration + ".");
+		}
 	}
 
 	ModResult OnSetConnectClass(LocalUser* user, ConnectClass* myclass) CXX11_OVERRIDE
-- 
cgit v1.3.1-10-gc9f91