From 5bd0a93976f6818187e70a4446257d90a41c7ff1 Mon Sep 17 00:00:00 2001 From: Sadie Powell Date: Tue, 17 Aug 2021 12:06:22 +0100 Subject: Add an API for checking if I/O hooks are ready or not. --- src/modules/extra/m_ssl_gnutls.cpp | 21 ++++++++------------- src/modules/extra/m_ssl_mbedtls.cpp | 29 ++++++++++------------------- src/modules/extra/m_ssl_openssl.cpp | 31 +++++++++++++------------------ 3 files changed, 31 insertions(+), 50 deletions(-) (limited to 'src/modules/extra') diff --git a/src/modules/extra/m_ssl_gnutls.cpp b/src/modules/extra/m_ssl_gnutls.cpp index 0d8821cd9..43169df1a 100644 --- a/src/modules/extra/m_ssl_gnutls.cpp +++ b/src/modules/extra/m_ssl_gnutls.cpp @@ -99,8 +99,6 @@ #define GNUTLS_NEW_PRIO_API #endif -enum issl_status { ISSL_NONE, ISSL_HANDSHAKING, ISSL_HANDSHAKEN }; - #if INSPIRCD_GNUTLS_HAS_VERSION(2, 12, 0) #define INSPIRCD_GNUTLS_HAS_VECTOR_PUSH #define GNUTLS_NEW_CERT_CALLBACK_API @@ -728,7 +726,6 @@ class GnuTLSIOHook : public SSLIOHook { private: gnutls_session_t sess; - issl_status status; #ifdef INSPIRCD_GNUTLS_HAS_CORK size_t gbuffersize; #endif @@ -742,7 +739,7 @@ class GnuTLSIOHook : public SSLIOHook } sess = NULL; certificate = NULL; - status = ISSL_NONE; + status = STATUS_NONE; } // Returns 1 if handshake succeeded, 0 if it is still in progress, -1 if it failed @@ -755,7 +752,7 @@ class GnuTLSIOHook : public SSLIOHook if(ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED) { // Handshake needs resuming later, read() or write() would have blocked. - this->status = ISSL_HANDSHAKING; + this->status = STATUS_HANDSHAKING; if (gnutls_record_get_direction(this->sess) == 0) { @@ -780,7 +777,7 @@ class GnuTLSIOHook : public SSLIOHook else { // Change the session state - this->status = ISSL_HANDSHAKEN; + this->status = STATUS_OPEN; VerifyCertificate(); @@ -882,9 +879,9 @@ info_done_dealloc: // Returns 1 if application I/O should proceed, 0 if it must wait for the underlying protocol to progress, -1 on fatal error int PrepareIO(StreamSocket* sock) { - if (status == ISSL_HANDSHAKEN) + if (status == STATUS_OPEN) return 1; - else if (status == ISSL_HANDSHAKING) + else if (status == STATUS_HANDSHAKING) { // The handshake isn't finished, try to finish it return Handshake(sock); @@ -1050,7 +1047,6 @@ info_done_dealloc: GnuTLSIOHook(IOHookProvider* hookprov, StreamSocket* sock, inspircd_gnutls_session_init_flags_t flags) : SSLIOHook(hookprov) , sess(NULL) - , status(ISSL_NONE) #ifdef INSPIRCD_GNUTLS_HAS_CORK , gbuffersize(0) #endif @@ -1081,7 +1077,7 @@ info_done_dealloc: if (prepret <= 0) return prepret; - // If we resumed the handshake then this->status will be ISSL_HANDSHAKEN. + // If we resumed the handshake then this->status will be STATUS_OPEN. { GnuTLS::DataReader reader(sess); int ret = reader.ret(); @@ -1177,7 +1173,7 @@ info_done_dealloc: void GetCiphersuite(std::string& out) const CXX11_OVERRIDE { - if (!IsHandshakeDone()) + if (!IsHookReady()) return; out.append(UnknownIfNULL(gnutls_protocol_get_name(gnutls_protocol_get_version(sess)))).push_back('-'); out.append(UnknownIfNULL(gnutls_kx_get_name(gnutls_kx_get(sess)))).push_back('-'); @@ -1205,7 +1201,6 @@ info_done_dealloc: } GnuTLS::Profile& GetProfile(); - bool IsHandshakeDone() const { return (status == ISSL_HANDSHAKEN); } }; int GnuTLS::X509Credentials::cert_callback(gnutls_session_t sess, const gnutls_datum_t* req_ca_rdn, int nreqs, const gnutls_pk_algorithm_t* sign_algos, int sign_algos_length, cert_cb_last_param_type* st) @@ -1407,7 +1402,7 @@ class ModuleSSLGnuTLS : public Module ModResult OnCheckReady(LocalUser* user) CXX11_OVERRIDE { const GnuTLSIOHook* const iohook = static_cast(user->eh.GetModHook(this)); - if ((iohook) && (!iohook->IsHandshakeDone())) + if ((iohook) && (!iohook->IsHookReady())) return MOD_RES_DENY; return MOD_RES_PASSTHRU; } diff --git a/src/modules/extra/m_ssl_mbedtls.cpp b/src/modules/extra/m_ssl_mbedtls.cpp index 0df7ca2e5..abda2d1b0 100644 --- a/src/modules/extra/m_ssl_mbedtls.cpp +++ b/src/modules/extra/m_ssl_mbedtls.cpp @@ -535,25 +535,18 @@ namespace mbedTLS class mbedTLSIOHook : public SSLIOHook { - enum Status - { - ISSL_NONE, - ISSL_HANDSHAKING, - ISSL_HANDSHAKEN - }; - + private: mbedtls_ssl_context sess; - Status status; void CloseSession() { - if (status == ISSL_NONE) + if (status == STATUS_NONE) return; mbedtls_ssl_close_notify(&sess); mbedtls_ssl_free(&sess); certificate = NULL; - status = ISSL_NONE; + status = STATUS_NONE; } // Returns 1 if handshake succeeded, 0 if it is still in progress, -1 if it failed @@ -563,7 +556,7 @@ class mbedTLSIOHook : public SSLIOHook if (ret == 0) { // Change the session state - this->status = ISSL_HANDSHAKEN; + this->status = STATUS_OPEN; VerifyCertificate(); @@ -573,7 +566,7 @@ class mbedTLSIOHook : public SSLIOHook return 1; } - this->status = ISSL_HANDSHAKING; + this->status = STATUS_HANDSHAKING; if (ret == MBEDTLS_ERR_SSL_WANT_READ) { SocketEngine::ChangeEventMask(sock, FD_WANT_POLL_READ | FD_WANT_NO_WRITE); @@ -593,9 +586,9 @@ class mbedTLSIOHook : public SSLIOHook // Returns 1 if application I/O should proceed, 0 if it must wait for the underlying protocol to progress, -1 on fatal error int PrepareIO(StreamSocket* sock) { - if (status == ISSL_HANDSHAKEN) + if (status == STATUS_OPEN) return 1; - else if (status == ISSL_HANDSHAKING) + else if (status == STATUS_HANDSHAKING) { // The handshake isn't finished, try to finish it return Handshake(sock); @@ -693,7 +686,6 @@ class mbedTLSIOHook : public SSLIOHook public: mbedTLSIOHook(IOHookProvider* hookprov, StreamSocket* sock, bool isserver) : SSLIOHook(hookprov) - , status(ISSL_NONE) { mbedtls_ssl_init(&sess); if (isserver) @@ -719,7 +711,7 @@ class mbedTLSIOHook : public SSLIOHook if (prepret <= 0) return prepret; - // If we resumed the handshake then this->status will be ISSL_HANDSHAKEN. + // If we resumed the handshake then this->status will be STATUS_OPEN. char* const readbuf = ServerInstance->GetReadBuffer(); const size_t readbufsize = ServerInstance->Config->NetBufferSize; int ret = mbedtls_ssl_read(&sess, reinterpret_cast(readbuf), readbufsize); @@ -810,7 +802,7 @@ class mbedTLSIOHook : public SSLIOHook void GetCiphersuite(std::string& out) const CXX11_OVERRIDE { - if (!IsHandshakeDone()) + if (!IsHookReady()) return; out.append(mbedtls_ssl_get_version(&sess)).push_back('-'); @@ -830,7 +822,6 @@ class mbedTLSIOHook : public SSLIOHook } mbedTLS::Profile& GetProfile(); - bool IsHandshakeDone() const { return (status == ISSL_HANDSHAKEN); } }; class mbedTLSIOHookProvider : public SSLIOHookProvider @@ -998,7 +989,7 @@ class ModuleSSLmbedTLS : public Module ModResult OnCheckReady(LocalUser* user) CXX11_OVERRIDE { const mbedTLSIOHook* const iohook = static_cast(user->eh.GetModHook(this)); - if ((iohook) && (!iohook->IsHandshakeDone())) + if ((iohook) && (!iohook->IsHookReady())) return MOD_RES_DENY; return MOD_RES_PASSTHRU; } diff --git a/src/modules/extra/m_ssl_openssl.cpp b/src/modules/extra/m_ssl_openssl.cpp index d5d29d51c..740861b60 100644 --- a/src/modules/extra/m_ssl_openssl.cpp +++ b/src/modules/extra/m_ssl_openssl.cpp @@ -104,8 +104,6 @@ # define INSPIRCD_OPENSSL_OPAQUE_BIO #endif -enum issl_status { ISSL_NONE, ISSL_HANDSHAKING, ISSL_OPEN }; - static bool SelfSigned = false; static int exdataindex; @@ -576,7 +574,6 @@ class OpenSSLIOHook : public SSLIOHook { private: SSL* sess; - issl_status status; bool data_to_write; // Returns 1 if handshake succeeded, 0 if it is still in progress, -1 if it failed @@ -591,13 +588,13 @@ class OpenSSLIOHook : public SSLIOHook if (err == SSL_ERROR_WANT_READ) { SocketEngine::ChangeEventMask(user, FD_WANT_POLL_READ | FD_WANT_NO_WRITE); - this->status = ISSL_HANDSHAKING; + this->status = STATUS_HANDSHAKING; return 0; } else if (err == SSL_ERROR_WANT_WRITE) { SocketEngine::ChangeEventMask(user, FD_WANT_NO_READ | FD_WANT_SINGLE_WRITE); - this->status = ISSL_HANDSHAKING; + this->status = STATUS_HANDSHAKING; return 0; } else @@ -611,7 +608,7 @@ class OpenSSLIOHook : public SSLIOHook // Handshake complete. VerifyCertificate(); - status = ISSL_OPEN; + status = STATUS_OPEN; SocketEngine::ChangeEventMask(user, FD_WANT_POLL_READ | FD_WANT_NO_WRITE | FD_ADD_TRIAL_WRITE); @@ -633,7 +630,7 @@ class OpenSSLIOHook : public SSLIOHook } sess = NULL; certificate = NULL; - status = ISSL_NONE; + status = STATUS_NONE; } void VerifyCertificate() @@ -696,14 +693,14 @@ class OpenSSLIOHook : public SSLIOHook void SSLInfoCallback(int where, int rc) { - if ((where & SSL_CB_HANDSHAKE_START) && (status == ISSL_OPEN)) + if ((where & SSL_CB_HANDSHAKE_START) && (status == STATUS_OPEN)) { if (GetProfile().AllowRenegotiation()) return; // The other side is trying to renegotiate, kill the connection and change status - // to ISSL_NONE so CheckRenego() closes the session - status = ISSL_NONE; + // to STATUS_NONE so CheckRenego() closes the session + status = STATUS_NONE; BIO* bio = SSL_get_rbio(sess); EventHandler* eh = static_cast(BIO_get_data(bio)); SocketEngine::Shutdown(eh, 2); @@ -712,7 +709,7 @@ class OpenSSLIOHook : public SSLIOHook bool CheckRenego(StreamSocket* sock) { - if (status != ISSL_NONE) + if (status != STATUS_NONE) return true; ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "Session %p killed, attempted to renegotiate", (void*)sess); @@ -724,9 +721,9 @@ class OpenSSLIOHook : public SSLIOHook // Returns 1 if application I/O should proceed, 0 if it must wait for the underlying protocol to progress, -1 on fatal error int PrepareIO(StreamSocket* sock) { - if (status == ISSL_OPEN) + if (status == STATUS_OPEN) return 1; - else if (status == ISSL_HANDSHAKING) + else if (status == STATUS_HANDSHAKING) { // The handshake isn't finished, try to finish it return Handshake(sock); @@ -743,7 +740,6 @@ class OpenSSLIOHook : public SSLIOHook OpenSSLIOHook(IOHookProvider* hookprov, StreamSocket* sock, SSL* session) : SSLIOHook(hookprov) , sess(session) - , status(ISSL_NONE) , data_to_write(false) { // Create BIO instance and store a pointer to the socket in it which will be used by the read and write functions @@ -772,7 +768,7 @@ class OpenSSLIOHook : public SSLIOHook if (prepret <= 0) return prepret; - // If we resumed the handshake then this->status will be ISSL_OPEN + // If we resumed the handshake then this->status will be STATUS_OPEN { ERR_clear_error(); char* buffer = ServerInstance->GetReadBuffer(); @@ -890,7 +886,7 @@ class OpenSSLIOHook : public SSLIOHook void GetCiphersuite(std::string& out) const CXX11_OVERRIDE { - if (!IsHandshakeDone()) + if (!IsHookReady()) return; out.append(SSL_get_version(sess)).push_back('-'); out.append(SSL_get_cipher(sess)); @@ -906,7 +902,6 @@ class OpenSSLIOHook : public SSLIOHook return true; } - bool IsHandshakeDone() const { return (status == ISSL_OPEN); } OpenSSL::Profile& GetProfile(); }; @@ -1133,7 +1128,7 @@ class ModuleSSLOpenSSL : public Module ModResult OnCheckReady(LocalUser* user) CXX11_OVERRIDE { const OpenSSLIOHook* const iohook = static_cast(user->eh.GetModHook(this)); - if ((iohook) && (!iohook->IsHandshakeDone())) + if ((iohook) && (!iohook->IsHookReady())) return MOD_RES_DENY; return MOD_RES_PASSTHRU; } -- cgit v1.3.1-10-gc9f91 From 99dc047c2f04f7ec37082cc6373785f6f2f6b9ac Mon Sep 17 00:00:00 2001 From: Sadie Powell Date: Wed, 22 Sep 2021 20:37:23 +0100 Subject: Send SSL profile reloading errors to snomask `a`. --- src/modules/extra/m_ssl_gnutls.cpp | 2 +- src/modules/extra/m_ssl_mbedtls.cpp | 2 +- src/modules/extra/m_ssl_openssl.cpp | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) (limited to 'src/modules/extra') diff --git a/src/modules/extra/m_ssl_gnutls.cpp b/src/modules/extra/m_ssl_gnutls.cpp index 43169df1a..020f10482 100644 --- a/src/modules/extra/m_ssl_gnutls.cpp +++ b/src/modules/extra/m_ssl_gnutls.cpp @@ -1370,7 +1370,7 @@ class ModuleSSLGnuTLS : public Module } catch (ModuleException& ex) { - ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, ex.GetReason() + " Not applying settings."); + ServerInstance->SNO->WriteToSnoMask('a', "Failed to reload the GnuTLS TLS (SSL) profiles. " + ex.GetReason()); } } diff --git a/src/modules/extra/m_ssl_mbedtls.cpp b/src/modules/extra/m_ssl_mbedtls.cpp index abda2d1b0..cf7c9020f 100644 --- a/src/modules/extra/m_ssl_mbedtls.cpp +++ b/src/modules/extra/m_ssl_mbedtls.cpp @@ -968,7 +968,7 @@ class ModuleSSLmbedTLS : public Module } catch (ModuleException& ex) { - ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, ex.GetReason() + " Not applying settings."); + ServerInstance->SNO->WriteToSnoMask('a', "Failed to reload the mbedTLS TLS (SSL) profiles. " + ex.GetReason()); } } diff --git a/src/modules/extra/m_ssl_openssl.cpp b/src/modules/extra/m_ssl_openssl.cpp index 740861b60..a42e81cab 100644 --- a/src/modules/extra/m_ssl_openssl.cpp +++ b/src/modules/extra/m_ssl_openssl.cpp @@ -1106,7 +1106,7 @@ class ModuleSSLOpenSSL : public Module } catch (ModuleException& ex) { - ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, ex.GetReason() + " Not applying settings."); + ServerInstance->SNO->WriteToSnoMask('a', "Failed to reload the OpenSSL TLS (SSL) profiles. " + ex.GetReason()); } } -- cgit v1.3.1-10-gc9f91