| 243 |
|
client_p->from = NULL; /* ...this should catch them! >:) --msa */ |
| 244 |
|
} |
| 245 |
|
|
| 246 |
+ |
/* Base16 encoding is: |
| 247 |
+ |
* Copyright (c) 2001-2004, Roger Dingledine |
| 248 |
+ |
* Copyright (c) 2004-2007, Roger Dingledine, Nick Mathewson |
| 249 |
+ |
* |
| 250 |
+ |
* Redistribution and use in source and binary forms, with or without |
| 251 |
+ |
* modification, are permitted provided that the following conditions are |
| 252 |
+ |
* met: |
| 253 |
+ |
* |
| 254 |
+ |
* Redistributions of source code must retain the above copyright |
| 255 |
+ |
* notice, this list of conditions and the following disclaimer. |
| 256 |
+ |
|
| 257 |
+ |
* Redistributions in binary form must reproduce the above copyright notice, |
| 258 |
+ |
* this list of conditions and the following disclaimer |
| 259 |
+ |
* in the documentation and/or other materials provided with the distribution. |
| 260 |
+ |
* |
| 261 |
+ |
* Neither the names of the copyright owners nor the names of its |
| 262 |
+ |
* contributors may be used to endorse or promote products derived from |
| 263 |
+ |
* this software without specific prior written permission. |
| 264 |
+ |
|
| 265 |
+ |
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS |
| 266 |
+ |
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT |
| 267 |
+ |
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR |
| 268 |
+ |
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT |
| 269 |
+ |
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
| 270 |
+ |
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT |
| 271 |
+ |
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, |
| 272 |
+ |
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY |
| 273 |
+ |
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
| 274 |
+ |
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE |
| 275 |
+ |
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
| 276 |
+ |
*/ |
| 277 |
+ |
static void |
| 278 |
+ |
base16_encode(char *dest, size_t destlen, const char *src, size_t srclen) |
| 279 |
+ |
{ |
| 280 |
+ |
const char *end; |
| 281 |
+ |
char *cp; |
| 282 |
+ |
|
| 283 |
+ |
assert(destlen >= srclen * 2 + 1); |
| 284 |
+ |
|
| 285 |
+ |
cp = dest; |
| 286 |
+ |
end = src + srclen; |
| 287 |
+ |
|
| 288 |
+ |
while (src < end) |
| 289 |
+ |
{ |
| 290 |
+ |
*cp++ = "0123456789ABCDEF"[(*(const uint8_t *)src) >> 4]; |
| 291 |
+ |
*cp++ = "0123456789ABCDEF"[(*(const uint8_t *)src) & 0xf]; |
| 292 |
+ |
++src; |
| 293 |
+ |
} |
| 294 |
+ |
|
| 295 |
+ |
*cp = '\0'; |
| 296 |
+ |
} |
| 297 |
+ |
|
| 298 |
|
#ifdef HAVE_LIBCRYPTO |
| 299 |
|
/* |
| 300 |
|
* ssl_handshake - let OpenSSL initialize the protocol. Register for |
| 303 |
|
static void |
| 304 |
|
ssl_handshake(int fd, struct Client *client_p) |
| 305 |
|
{ |
| 306 |
+ |
X509 *cert = NULL; |
| 307 |
|
int ret = SSL_accept(client_p->localClient->fd.ssl); |
| 308 |
+ |
int err = SSL_get_error(client_p->localClient->fd.ssl, ret); |
| 309 |
+ |
|
| 310 |
+ |
ilog(LOG_TYPE_IRCD, "SSL Error %d %s", err, ERR_error_string(err, NULL)); |
| 311 |
+ |
|
| 312 |
+ |
if ((cert = SSL_get_peer_certificate(client_p->localClient->fd.ssl))) |
| 313 |
+ |
{ |
| 314 |
+ |
int res = SSL_get_verify_result(client_p->localClient->fd.ssl); |
| 315 |
+ |
|
| 316 |
+ |
if (res == X509_V_OK || res == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN || |
| 317 |
+ |
res == X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE || |
| 318 |
+ |
res == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) |
| 319 |
+ |
base16_encode(client_p->certfp, sizeof(client_p->certfp), |
| 320 |
+ |
(const char *)cert->sha1_hash, sizeof(cert->sha1_hash)); |
| 321 |
+ |
else |
| 322 |
+ |
ilog(LOG_TYPE_IRCD, "Client %s!%s@%s gave bad SSL client certificate: %d", |
| 323 |
+ |
client_p->name, client_p->username, client_p->host, res); |
| 324 |
+ |
X509_free(cert); |
| 325 |
+ |
} |
| 326 |
|
|
| 327 |
|
if (ret <= 0) |
| 328 |
+ |
{ |
| 329 |
|
switch (SSL_get_error(client_p->localClient->fd.ssl, ret)) |
| 330 |
|
{ |
| 331 |
|
case SSL_ERROR_WANT_WRITE: |
| 342 |
|
exit_client(client_p, client_p, "Error during SSL handshake"); |
| 343 |
|
return; |
| 344 |
|
} |
| 345 |
+ |
} |
| 346 |
|
|
| 347 |
|
start_auth(client_p); |
| 348 |
|
} |