From 7f433a45bf0f4178df90cb1ccfbf3a878cab2ea7 Mon Sep 17 00:00:00 2001
From: Daniel De Graaf
Date: Thu, 22 Mar 2012 18:35:25 -0400
Subject: m_ssl_gnutls: remove DH parameter generation

While the gnutls documentation recommends that DH parameters be
regenerated, this does not actually improve security and may freeze the
ircd for a significant amount of time (50s in some reports). Remove it.
---
 src/modules/extra/m_ssl_gnutls.cpp | 24 ++----------------------
 1 file changed, 2 insertions(+), 22 deletions(-)

(limited to 'src/modules')

diff --git a/src/modules/extra/m_ssl_gnutls.cpp b/src/modules/extra/m_ssl_gnutls.cpp
index e65f93fbb..3486025db 100644
--- a/src/modules/extra/m_ssl_gnutls.cpp
+++ b/src/modules/extra/m_ssl_gnutls.cpp
@@ -720,7 +720,6 @@ class ModuleSSLGnuTLS : public Module
 	GnuTLSProvider iohook;
 	CommandStartTLS starttls;
 
-	int once_in_a_while;
 	std::string sslports;
 
 	reference<DH_info> dh;
@@ -728,7 +727,7 @@ class ModuleSSLGnuTLS : public Module
  public:
 
 	ModuleSSLGnuTLS()
-		: capHandler(this, "tls"), iohook(this), starttls(this, iohook), once_in_a_while(0)
+		: capHandler(this, "tls"), iohook(this), starttls(this, iohook)
 	{
 		gnutls_global_init(); // This must be called once in the program
 	}
@@ -739,7 +738,7 @@ class ModuleSSLGnuTLS : public Module
 
 		ServerInstance->GenRandom = &randhandler;
 
-		Implementation eventlist[] = { I_On005Numeric, I_OnModuleRehash, I_OnUserConnect, I_OnEvent, I_OnGarbageCollect };
+		Implementation eventlist[] = { I_On005Numeric, I_OnModuleRehash, I_OnUserConnect, I_OnEvent };
 		ServerInstance->Modules->Attach(eventlist, this, sizeof(eventlist)/sizeof(Implementation));
 
 		ServerInstance->Modules->AddService(iohook);
@@ -824,25 +823,6 @@ class ModuleSSLGnuTLS : public Module
 		}
 	}
 
-	void OnGarbageCollect()
-	{
- 		// Generate Diffie Hellman parameters - for use with DHE
-		// kx algorithms. These should be discarded and regenerated
-		// once a day, once a week or once a month. Depending on the
-		// security requirements.
-		if (once_in_a_while++ & 0xFF)
-			return;
-
-		dh = new DH_info(dh->bits);
-		reference<x509_cred> cred = iohook.def_creds;
-		iohook.def_creds = new x509_cred(cred, dh);
-		for(std::map<std::string, reference<x509_cred> >::iterator i = iohook.creds.begin(); i != iohook.creds.end(); i++)
-		{
-			cred = i->second;
-			i->second = new x509_cred(cred, dh);
-		}
-	}
-
 	~ModuleSSLGnuTLS()
 	{
 		iohook.creds.clear();
-- 
cgit v1.3.1-10-gc9f91