ViewVC Help

View File | Revision Log | Show Annotations | View Changeset | Root Listing

root/svn/ircd-hybrid/trunk/src/conf_parser.y

Comparing ircd-hybrid/trunk/src/conf_parser.y (file contents):
Revision 7060 by michael, Mon Jan 18 18:55:40 2016 UTC vs.
Revision 7105 by michael, Sat Jan 23 20:11:27 2016 UTC

#	Line 53 | Line 53
53		#include "user.h"
54		#include "motd.h"
55
56	–	#ifdef HAVE_LIBCRYPTO
57	–	#include <openssl/rsa.h>
58	–	#include <openssl/bio.h>
59	–	#include <openssl/pem.h>
60	–	#include <openssl/dh.h>
61	–	#endif
62	–
63	–	#include "rsa.h"
64	–
56		int yylex(void);
57
58		static struct
#	Line 479 | Line 470 | serverinfo_item:        serverinfo_name
470
471		serverinfo_ssl_certificate_file: SSL_CERTIFICATE_FILE '=' QSTRING ';'
472		{
482	–	#ifdef HAVE_LIBCRYPTO
473		if (conf_parser_ctx.pass == 2)
474		{
475		if (!ConfigServerInfo.rsa_private_key_file)
#	Line 488 | Line 478 | serverinfo_ssl_certificate_file: SSL_CER
478		break;
479		}
480
481	<	if (SSL_CTX_use_certificate_chain_file(ConfigServerInfo.server_ctx, yylval.string) <= 0 ||
482	<	SSL_CTX_use_certificate_chain_file(ConfigServerInfo.client_ctx, yylval.string) <= 0)
493	<	{
494	<	report_crypto_errors();
495	<	conf_error_report("Could not open/read certificate file");
496	<	break;
497	<	}
481	>	if (ConfigServerInfo.ssl_certificate_file)
482	>	xfree(ConfigServerInfo.ssl_certificate_file);
483
484	<	if (SSL_CTX_use_PrivateKey_file(ConfigServerInfo.server_ctx, ConfigServerInfo.rsa_private_key_file,
500	<	SSL_FILETYPE_PEM) <= 0 ||
501	<	SSL_CTX_use_PrivateKey_file(ConfigServerInfo.client_ctx, ConfigServerInfo.rsa_private_key_file,
502	<	SSL_FILETYPE_PEM) <= 0)
503	<	{
504	<	report_crypto_errors();
505	<	conf_error_report("Could not read RSA private key");
506	<	break;
507	<	}
508	<
509	<	if (!SSL_CTX_check_private_key(ConfigServerInfo.server_ctx) ||
510	<	!SSL_CTX_check_private_key(ConfigServerInfo.client_ctx))
511	<	{
512	<	report_crypto_errors();
513	<	conf_error_report("Could not read RSA private key");
514	<	break;
515	<	}
484	>	ConfigServerInfo.ssl_certificate_file = xstrdup(yylval.string);
485		}
517	–	#endif
486		};
487
488		serverinfo_rsa_private_key_file: RSA_PRIVATE_KEY_FILE '=' QSTRING ';'
489		{
522	–	#ifdef HAVE_LIBCRYPTO
523	–	BIO *file = NULL;
524	–
490		if (conf_parser_ctx.pass != 1)
491		break;
492
493	<	if (ConfigServerInfo.rsa_private_key)
529	<	{
530	<	RSA_free(ConfigServerInfo.rsa_private_key);
531	<	ConfigServerInfo.rsa_private_key = NULL;
532	<	}
533	<
534	<	if (ConfigServerInfo.rsa_private_key_file)
535	<	{
536	<	xfree(ConfigServerInfo.rsa_private_key_file);
537	<	ConfigServerInfo.rsa_private_key_file = NULL;
538	<	}
539	<
493	>	xfree(ConfigServerInfo.rsa_private_key_file);
494		ConfigServerInfo.rsa_private_key_file = xstrdup(yylval.string);
541	–
542	–	if ((file = BIO_new_file(yylval.string, "r")) == NULL)
543	–	{
544	–	conf_error_report("File open failed, ignoring");
545	–	break;
546	–	}
547	–
548	–	ConfigServerInfo.rsa_private_key = PEM_read_bio_RSAPrivateKey(file, NULL, 0, NULL);
549	–
550	–	BIO_set_close(file, BIO_CLOSE);
551	–	BIO_free(file);
552	–
553	–	if (ConfigServerInfo.rsa_private_key == NULL)
554	–	{
555	–	conf_error_report("Couldn't extract key, ignoring");
556	–	break;
557	–	}
558	–
559	–	if (!RSA_check_key(ConfigServerInfo.rsa_private_key))
560	–	{
561	–	RSA_free(ConfigServerInfo.rsa_private_key);
562	–	ConfigServerInfo.rsa_private_key = NULL;
563	–
564	–	conf_error_report("Invalid key, ignoring");
565	–	break;
566	–	}
567	–
568	–	if (RSA_size(ConfigServerInfo.rsa_private_key) < 256)
569	–	{
570	–	RSA_free(ConfigServerInfo.rsa_private_key);
571	–	ConfigServerInfo.rsa_private_key = NULL;
572	–
573	–	conf_error_report("Ignoring serverinfo::rsa_private_key_file -- need at least a 2048 bit key size");
574	–	}
575	–	#endif
495		};
496
497		serverinfo_ssl_dh_param_file: SSL_DH_PARAM_FILE '=' QSTRING ';'
498		{
580	–	#ifdef HAVE_LIBCRYPTO
499		if (conf_parser_ctx.pass == 2)
500		{
501	<	BIO *file = BIO_new_file(yylval.string, "r");
502	<
585	<	if (file)
586	<	{
587	<	DH *dh = PEM_read_bio_DHparams(file, NULL, NULL, NULL);
588	<
589	<	BIO_free(file);
590	<
591	<	if (dh)
592	<	{
593	<	if (DH_size(dh) < 256)
594	<	conf_error_report("Ignoring serverinfo::ssl_dh_param_file -- need at least a 2048 bit DH prime size");
595	<	else
596	<	SSL_CTX_set_tmp_dh(ConfigServerInfo.server_ctx, dh);
597	<
598	<	DH_free(dh);
599	<	}
600	<	}
601	<	else
602	<	conf_error_report("Ignoring serverinfo::ssl_dh_param_file -- could not open/read Diffie-Hellman parameter file");
501	>	xfree(ConfigServerInfo.ssl_dh_param_file);
502	>	ConfigServerInfo.ssl_dh_param_file = xstrdup(yylval.string);
503		}
604	–	#endif
504		};
505
506		serverinfo_ssl_cipher_list: T_SSL_CIPHER_LIST '=' QSTRING ';'
507		{
609	–	#ifdef HAVE_LIBCRYPTO
508		if (conf_parser_ctx.pass == 2)
509	<	SSL_CTX_set_cipher_list(ConfigServerInfo.server_ctx, yylval.string);
510	<	#endif
509	>	{
510	>	xfree(ConfigServerInfo.ssl_cipher_list);
511	>	ConfigServerInfo.ssl_cipher_list = xstrdup(yylval.string);
512	>	}
513		};
514
515		serverinfo_ssl_message_digest_algorithm: SSL_MESSAGE_DIGEST_ALGORITHM '=' QSTRING ';'
516		{
617	–	#ifdef HAVE_LIBCRYPTO
517		if (conf_parser_ctx.pass == 2)
518		{
519	<	if ((ConfigServerInfo.message_digest_algorithm = EVP_get_digestbyname(yylval.string)) == NULL)
520	<	{
622	<	ConfigServerInfo.message_digest_algorithm = EVP_sha256();
623	<	conf_error_report("Ignoring serverinfo::ssl_message_digest_algorithm -- unknown message digest algorithm");
624	<	}
519	>	xfree(ConfigServerInfo.ssl_message_digest_algorithm);
520	>	ConfigServerInfo.ssl_message_digest_algorithm = xstrdup(yylval.string);
521		}
626	–	#endif
522		}
523
524		serverinfo_ssl_dh_elliptic_curve: SSL_DH_ELLIPTIC_CURVE '=' QSTRING ';'
525		{
631	–	#ifdef HAVE_LIBCRYPTO
632	–	#if OPENSSL_VERSION_NUMBER >= 0x009080FFL && !defined(OPENSSL_NO_ECDH)
633	–	int nid = 0;
634	–	EC_KEY *key = NULL;
635	–
526		if (conf_parser_ctx.pass == 2)
527		{
528	<	if ((nid = OBJ_sn2nid(yylval.string)) == 0)
529	<	{
640	<	conf_error_report("Ignoring serverinfo::ssl_dh_elliptic_curve -- unknown curve name");
641	<	break;
642	<	}
643	<
644	<	if ((key = EC_KEY_new_by_curve_name(nid)) == NULL)
645	<	{
646	<	conf_error_report("Ignoring serverinfo::ssl_dh_elliptic_curve -- could not create curve");
647	<	break;
648	<	}
649	<
650	<	SSL_CTX_set_tmp_ecdh(ConfigServerInfo.server_ctx, key);
651	<	EC_KEY_free(key);
528	>	xfree(ConfigServerInfo.ssl_dh_elliptic_curve);
529	>	ConfigServerInfo.ssl_dh_elliptic_curve = xstrdup(yylval.string);
530		}
653	–	#endif
654	–	#endif
531		};
532
533		serverinfo_name: NAME '=' QSTRING ';'
#	Line 1674 | Line 1550 | port_item: NUMBER
1550		{
1551		if (conf_parser_ctx.pass == 2)
1552		{
1553	<	#ifndef HAVE_LIBCRYPTO
1553	>	#ifndef HAVE_TLS
1554		if (block_state.flags.value & LISTENER_SSL)
1555		{
1556	<	conf_error_report("SSL not available - port closed");
1556	>	conf_error_report("TLS not available - port closed");
1557		break;
1558		}
1559		#endif
#	Line 1687 | Line 1563 | port_item: NUMBER
1563		{
1564		if (conf_parser_ctx.pass == 2)
1565		{
1566	<	#ifndef HAVE_LIBCRYPTO
1566	>	#ifndef HAVE_TLS
1567		if (block_state.flags.value & LISTENER_SSL)
1568		{
1569	<	conf_error_report("SSL not available - port closed");
1569	>	conf_error_report("TLS not available - port closed");
1570		break;
1571		}
1572		#endif
#	Line 2335 | Line 2211 | connect_class: CLASS '=' QSTRING ';'
2211
2212		connect_ssl_cipher_list: T_SSL_CIPHER_LIST '=' QSTRING ';'
2213		{
2214	<	#ifdef HAVE_LIBCRYPTO
2214	>	#ifdef HAVE_TLS
2215		if (conf_parser_ctx.pass == 2)
2216		strlcpy(block_state.ciph.buf, yylval.string, sizeof(block_state.ciph.buf));
2217		#else
2218		if (conf_parser_ctx.pass == 2)
2219	<	conf_error_report("Ignoring connect::ciphers -- no OpenSSL support");
2219	>	conf_error_report("Ignoring connect::ciphers -- no TLS support");
2220		#endif
2221		};
2222

Diff Legend

–	Removed lines
+	Added lines
<	Changed lines (old)
>	Changed lines (new)