Merge branch 'ssl-improvements' into next

* ssl-improvements:
  * Refactor OpenSSL into openssl.{c,h} and load on startup
  * Show SSL status in (net|bot)server
  * Cleanup RAND/seeding code
  * Cleanup libcrypto on exit as well
  * Free ERR strings when unloading libcrypto as it's part of that lib
  * Rename load|unload_ssl to libssl
  * Properly cleanup ssl_ctx if unable to seed the PRNG
  * DRY net_switch_to_ssl() slightly
  * Disable SSLv2 support
  * Display whether a socket is SSL or not in dccstat
  * Use findanysnum()

src/Makefile.in

@@ -44,6 +44,7 @@ OBJS = auth.o \
 	misc.o \
 	misc_file.o \
 	net.o \
+	openssl.o \
 	adns.o \
 	response.o \
 	rfc1459.o \

src/cmds.c

@@ -3853,10 +3853,7 @@ static void rcmd_cursrv(char * fbot, char * fhand, char * fidx) {
 
     if (server_online) {
       daysdur(now, server_online, tmp, sizeof(tmp));
-      if (floodless)
-        simple_snprintf(cursrv, sizeof(cursrv), "Currently: %-30s (connected %s) [floodless ;)]", cursrvname, tmp);
-      else
-        simple_snprintf(cursrv, sizeof(cursrv), "Currently: %-30s (connected %s)", cursrvname, tmp);
+      simple_snprintf(cursrv, sizeof(cursrv), "Currently: %-30s (connected %s)%s%s", cursrvname, tmp, socklist[findanysnum(serv)].ssl ? " [SSL]" : "", floodless ? " [floodless]" : "");
 
       if (server_lag > 0) {
         simple_snprintf(tmp, sizeof(tmp), " Lag:%ds", server_lag);

src/crypto/dh_util.c

@@ -30,6 +30,11 @@ void DH1080_init() {
   }
 }
 
+void DH1080_uninit() {
+  BN_clear_free(b_prime);
+  BN_clear_free(b_generator);
+}
+
 /**
  * @brief Encode a string using FiSH's base64 algorithm (from FiSH/mIRC)
  * @note Any = padding is removed, and an 'A' is added if no padding was needed

src/crypto/dh_util.h

@@ -18,4 +18,5 @@ bd::String fishBase64Decode(const bd::String& str);
 void DH1080_gen(bd::String& privateKey, bd::String& publicKeyB64);
 bool DH1080_comp(const bd::String privateKey, const bd::String theirPublicKeyB64, bd::String& sharedKey);
 void DH1080_init();
+void DH1080_uninit();
 #endif

src/dccutil.c

@@ -630,12 +630,12 @@ tell_dcc(int idx)
   if (nicklen < 9)
     nicklen = 9;
 
-  simple_snprintf(format, sizeof format, "%%-4s %%-4s %%-8s %%-5s %%-%zus %%-40s %%s\n", nicklen);
-  dprintf(idx, format, "SOCK", "IDX", "ADDR", "PORT", "NICK", "HOST", "TYPE");
-  dprintf(idx, format, "----", "---", "--------", "-----", "---------",
+  simple_snprintf(format, sizeof format, "%%-4s %%-4s %%-4s %%-8s %%-5s %%-%zus %%-40s %%s\n", nicklen);
+  dprintf(idx, format, "SOCK", "IDX", "SSL", "ADDR", "PORT", "NICK", "HOST", "TYPE");
+  dprintf(idx, format, "----", "---", "---", "--------", "-----", "---------",
           "----------------------------------------", "----");
 
-  simple_snprintf(format, sizeof format, "%%-4d %%-4d %%08X %%5u %%-%zus %%-40s %%s\n", nicklen);
+  simple_snprintf(format, sizeof format, "%%-4d %%-4d %%-4s %%08X %%5u %%-%zus %%-40s %%s\n", nicklen);
 
   dprintf(idx, "dccn: %d, dcc_total: %d\n", dccn, dcc_total);
   dprintf(idx, "dns_idx: %d, servidx: %d\n", dns_idx, servidx);
@@ -652,7 +652,8 @@ tell_dcc(int idx)
         simple_snprintf(other, sizeof(other), "?:%lX  !! ERROR !!", (long) dcc[i].type);
         break;
       }
-      dprintf(idx, format, dcc[i].sock, i, dcc[i].addr, dcc[i].port, dcc[i].nick, dcc[i].host + j, other);
+      int snum = findanysnum(dcc[i].sock);
+      dprintf(idx, format, dcc[i].sock, i, (snum != -1 && socklist[snum].ssl) ? "yes" : "no", dcc[i].addr, dcc[i].port, dcc[i].nick, dcc[i].host + j, other);
     }
   }
 }

src/libcrypto.c

@@ -49,6 +49,7 @@ static int load_symbols(void *handle) {
   DLSYM_GLOBAL(handle, BF_encrypt);
   DLSYM_GLOBAL(handle, BF_set_key);
   DLSYM_GLOBAL(handle, ERR_error_string);
+  DLSYM_GLOBAL(handle, ERR_free_strings);
   DLSYM_GLOBAL(handle, ERR_get_error);
   DLSYM_GLOBAL(handle, OPENSSL_cleanse);
   DLSYM_GLOBAL(handle, RAND_file_name);
@@ -80,6 +81,9 @@ static int load_symbols(void *handle) {
   DLSYM_GLOBAL(handle, DH_new);
   DLSYM_GLOBAL(handle, DH_size);
 
+  DLSYM_GLOBAL(handle, EVP_cleanup);
+  DLSYM_GLOBAL(handle, CRYPTO_cleanup_all_ex_data);
+
 
   return 0;
 }

src/libcrypto.h

@@ -1,6 +1,10 @@
 #ifndef _LIBCRYPTO_H
 #define _LIBCRYPTO_H
 
+#ifdef HAVE_CONFIG_H
+#  include "config.h"
+#endif
+
 #include ".defs/libcrypto_pre.h"
 
 #include <openssl/crypto.h>
@@ -8,6 +12,8 @@
 #include <openssl/blowfish.h>
 #include <openssl/md5.h>
 #include <openssl/sha.h>
+#include <openssl/err.h>
+#include <openssl/rand.h>
 
 #include ".defs/libcrypto_post.h"
 
@@ -30,6 +36,7 @@ typedef void (*BF_encrypt_t)(BF_LONG*, const BF_KEY*);
 typedef void (*BF_set_key_t)(BF_KEY*, int, const unsigned char*);
 
 typedef char* (*ERR_error_string_t)(unsigned long, char*);
+typedef void (*ERR_free_strings_t)(void);
 typedef unsigned long (*ERR_get_error_t)(void);
 
 typedef void (*OPENSSL_cleanse_t)(void*, size_t);
@@ -64,6 +71,8 @@ typedef int (*DH_generate_key_t)(DH*);
 typedef DH* (*DH_new_t)(void);
 typedef int (*DH_size_t)(const DH*);
 
+typedef void (*EVP_cleanup_t)(void);
+typedef void (*CRYPTO_cleanup_all_ex_data_t)(void);
 
 int load_libcrypto();
 int unload_libcrypto();

src/libssl.c

@@ -36,13 +36,6 @@
 
 void *libssl_handle = NULL;
 static bd::Array<bd::String> my_symbols;
-#ifdef EGG_SSL_EXT
-SSL_CTX *ssl_ctx = NULL;
-char	*tls_rand_file = NULL;
-#endif
-int     ssl_use = 0; /* kyotou */
-
-static int seed_PRNG(void);
 
 static int load_symbols(void *handle) {
   const char *dlsym_error = NULL;
@@ -61,12 +54,13 @@ static int load_symbols(void *handle) {
   DLSYM_GLOBAL(handle, SSL_shutdown);
   DLSYM_GLOBAL(handle, SSLv23_client_method);
   DLSYM_GLOBAL(handle, SSL_write);
+  DLSYM_GLOBAL(handle, SSL_CTX_ctrl);
 
   return 0;
 }
 
 
-int load_ssl() {
+int load_libssl() {
   if (ssl_ctx) {
     return 0;
   }
@@ -90,37 +84,11 @@ int load_ssl() {
 
   load_symbols(libssl_handle);
 
-#ifdef EGG_SSL_EXT
-  /* good place to init ssl stuff */
-  SSL_load_error_strings();
-  OpenSSL_add_ssl_algorithms();
-  ssl_ctx = SSL_CTX_new(SSLv23_client_method());
-  if (!ssl_ctx) {
-    sdprintf("SSL_CTX_new() failed");
-    return 1;
-  }
-
-  if (seed_PRNG()) {
-    sdprintf("Wasn't able to properly seed the PRNG!");
-    return 1;
-  }
-#endif
-
   return 0;
 }
 
-int unload_ssl() {
+int unload_libssl() {
   if (libssl_handle) {
-#ifdef EGG_SSL_EXT
-    /* cleanup mess when quiting */
-    if (ssl_ctx) {
-      SSL_CTX_free(ssl_ctx);
-      ssl_ctx = NULL;
-    }
-    if (tls_rand_file)
-      RAND_write_file(tls_rand_file);
-#endif
-
     // Cleanup symbol table
     for (size_t i = 0; i < my_symbols.length(); ++i) {
       dl_symbol_table.remove(my_symbols[i]);
@@ -134,49 +102,3 @@ int unload_ssl() {
   }
   return 1;
 }
-
-#ifdef EGG_SSL_EXT
-static int seed_PRNG(void)
-{
-  char stackdata[1024];
-  static char rand_file[300];
-  FILE *fh;
-
-#if OPENSSL_VERSION_NUMBER >= 0x00905100
-  if (RAND_status())
-    return 0;     /* PRNG already good seeded */
-#endif
-  /* if the device '/dev/urandom' is present, OpenSSL uses it by default.
-   * check if it's present, else we have to make random data ourselfs.
-   */
-  if ((fh = fopen("/dev/urandom", "r"))) {
-    fclose(fh);
-    // Try /dev/random if urandom is unavailable
-    if ((fh = fopen("/dev/random", "r"))) {
-      fclose(fh);
-      return 0;
-    }
-  }
-  if (RAND_file_name(rand_file, sizeof(rand_file)))
-    tls_rand_file = rand_file;
-  else
-    return 1;
-  if (!RAND_load_file(rand_file, 1024)) {
-    /* no .rnd file found, create new seed */
-    unsigned int c;
-    c = time(NULL);
-    RAND_seed(&c, sizeof(c));
-    c = getpid();
-    RAND_seed(&c, sizeof(c));
-    RAND_seed(stackdata, sizeof(stackdata));
-  }
-#if OPENSSL_VERSION_NUMBER >= 0x00905100
-  if (!RAND_status())
-    return 2;   /* PRNG still badly seeded */
-#endif
-  return 0;
-}
-#endif
-
-
-

src/libssl.h

@@ -1,6 +1,10 @@
 #ifndef _LIBSSL_H
 #define _LIBSSL_H
 
+#ifdef HAVE_CONFIG_H
+#  include "config.h"
+#endif
+
 #include "common.h"
 #include "dl.h"
 #include <bdlib/src/String.h>
@@ -10,8 +14,6 @@
 #ifdef EGG_SSL_EXT
 # ifndef EGG_SSL_INCS
 #  include <openssl/ssl.h>
-#  include <openssl/err.h>
-#  include <openssl/rand.h>
 #  define EGG_SSL_INCS 1
 # endif
 #endif
@@ -32,14 +34,9 @@ typedef void (*SSL_load_error_strings_t)(void);
 typedef int (*SSL_library_init_t)(void);
 typedef void (*SSL_CTX_free_t)(SSL_CTX*);
 typedef SSL_CTX* (*SSL_CTX_new_t)(const SSL_METHOD*);
+typedef long (*SSL_CTX_ctrl_t)(SSL_CTX*, int, long, void*);
 
-int load_ssl();
-int unload_ssl();
-
-#ifdef EGG_SSL_EXT
-extern SSL_CTX *ssl_ctx;
-extern char *tls_rand_file;
-#endif
-extern int ssl_use;
+int load_libssl();
+int unload_libssl();
 
 #endif /* !_LIBSSL_H */

src/main.c

@@ -196,13 +196,8 @@ void fatal(const char *s, int recoverable)
     }
   }
 
-#ifdef EGG_SSL_EXT
-  if (ssl_use) {
-    unload_ssl();
-  }
-#endif
-
   if (!recoverable) {
+//    uninit_openssl();
 //    if (conf.bot && conf.bot->pid_file)
 //      unlink(conf.bot->pid_file);
     exit(1);
@@ -691,10 +686,10 @@ int main(int argc, char **argv)
   check_trace(1);
 #endif
 
-  if (load_libcrypto()) {
-    fatal("Unable to load libcrypto.", 0);
+  if (init_openssl()) {
+    fprintf(stderr, "Unable to initialize/find OpenSSL.\n");
+    return 1;
   }
-  DH1080_init();
 
   /* Initialize variables and stuff */
   timer_update_now(&egg_timeval_now);

src/net.c

@@ -623,18 +623,9 @@ int open_telnet_raw(int sock, const char *ipIn, port_t sport, bool proxy_on, int
 int net_switch_to_ssl(int sock) {
   int i = 0;
 
-  if (load_ssl()) {
-    debug0("Error while switching to SSL - error loading library");
-    return 0;
-  }
-
   debug0("net_switch_to_ssl()");
   sleep(3); // Give some time to let the connect() go through.
-  for (i = 0; i < MAXSOCKS; ++i) {
-    if (socklist[i].sock == sock && !(socklist[i].flags & SOCK_UNUSED)) {
-      break;
-    }
-  }
+  i = findanysnum(sock);
   if (i == MAXSOCKS) {
     debug0("Error while swithing to SSL - sock not found in list");
     return 0;
@@ -651,10 +642,9 @@ int net_switch_to_ssl(int sock) {
   }
 
   SSL_set_fd(socklist[i].ssl, socklist[i].sock);
-  int err = SSL_connect(socklist[i].ssl);
-  int timeout = 0;
+  int err = 0, timeout = 0;
 
-  while (err <= 0) {
+  while ((err = SSL_connect(socklist[i].ssl)) <= 0) {
     if (timeout++ > 500) {
       err = 0;
       break;
@@ -662,19 +652,16 @@ int net_switch_to_ssl(int sock) {
     int errs = SSL_get_error(socklist[i].ssl,err);
     if ((errs != SSL_ERROR_WANT_READ) && (errs != SSL_ERROR_WANT_WRITE) && (errs != SSL_ERROR_WANT_X509_LOOKUP)) {
       putlog(LOG_DEBUG, "*", "SSL_connect() = %d, %s", err, (char *)ERR_error_string(ERR_get_error(), NULL));
-      SSL_shutdown(socklist[i].ssl);
-      SSL_free(socklist[i].ssl);
-      socklist[i].ssl = NULL;
-      return 0;
+      goto error;
     }
     usleep(1000);
-    err = SSL_connect(socklist[i].ssl);
   }
 
   if (err == 1) {
     debug0("SSL_connect() success");
     return 1;
   }
+error:
   debug0("Error while SSL_connect()");
   SSL_shutdown(socklist[i].ssl);
   SSL_free(socklist[i].ssl);

src/net.h

@@ -12,7 +12,7 @@
 #include <setjmp.h>
 #include <bdlib/src/String.h>
 
-#include "libssl.h"
+#include "openssl.h"
 
 namespace bd {
   class Stream;

src/openssl.c

@@ -0,0 +1,131 @@
+/*
+ * Copyright (C) 1997 Robey Pointer
+ * Copyright (C) 1999 - 2002 Eggheads Development Team
+ * Copyright (C) 2002 - 2010 Bryan Drewery
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+ */
+
+/*
+ * openssl.c -- handles:
+ *   libcrypto / libssl handling
+ *
+ */
+
+
+#include "common.h"
+#include "main.h"
+#include "dl.h"
+#include <bdlib/src/String.h>
+#include <bdlib/src/Array.h>
+
+#include "libssl.h"
+#include "libcrypto.h"
+
+#ifdef EGG_SSL_EXT
+SSL_CTX *ssl_ctx = NULL;
+char	*tls_rand_file = NULL;
+#endif
+int     ssl_use = 0; /* kyotou */
+
+static int seed_PRNG(void);
+
+int init_openssl() {
+  load_libcrypto();
+  load_libssl();
+
+#ifdef EGG_SSL_EXT
+  /* good place to init ssl stuff */
+  SSL_load_error_strings();
+  OpenSSL_add_ssl_algorithms();
+  ssl_ctx = SSL_CTX_new(SSLv23_client_method());
+  if (!ssl_ctx) {
+    sdprintf("SSL_CTX_new() failed");
+    return 1;
+  }
+
+  // Disable insecure SSLv2
+  SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_SSLv2);
+
+  if (seed_PRNG()) {
+    sdprintf("Wasn't able to properly seed the PRNG!");
+    SSL_CTX_free(ssl_ctx);
+    ssl_ctx = NULL;
+    return 1;
+  }
+#endif
+
+  DH1080_init();
+
+  return 0;
+}
+
+int uninit_openssl () {
+  DH1080_uninit();
+
+#ifdef EGG_SSL_EXT
+  /* cleanup mess when quiting */
+  if (ssl_ctx) {
+    SSL_CTX_free(ssl_ctx);
+    ssl_ctx = NULL;
+  }
+  if (tls_rand_file)
+    RAND_write_file(tls_rand_file);
+#endif
+
+  ERR_free_strings();
+  EVP_cleanup();
+  CRYPTO_cleanup_all_ex_data();
+
+  unload_libssl();
+  unload_libcrypto();
+  return 0;
+}
+
+#ifdef EGG_SSL_EXT
+static int seed_PRNG(void)
+{
+  char stackdata[1024];
+  static char rand_file[300];
+  FILE *fh;
+
+  if (RAND_status())
+    return 0;     /* PRNG already good seeded */
+  /* if the device '/dev/urandom' is present, OpenSSL uses it by default.
+   * check if it's present, else we have to make random data ourselfs.
+   */
+  if ((fh = fopen("/dev/urandom", "r"))) {
+    fclose(fh);
+    // Try /dev/random if urandom is unavailable
+    if ((fh = fopen("/dev/random", "r"))) {
+      fclose(fh);
+      return 0;
+    }
+  }
+  if (RAND_file_name(rand_file, sizeof(rand_file)))
+    tls_rand_file = rand_file;
+  else
+    return 1;
+  if (!RAND_load_file(rand_file, 1024)) {
+    /* no .rnd file found, create new seed */
+    RAND_seed(&now, sizeof(time_t));
+    RAND_seed(&conf.bot->pid, sizeof(pid_t));
+    RAND_seed(stackdata, sizeof(stackdata));
+  }
+  if (!RAND_status())
+    return 2;   /* PRNG still badly seeded */
+  return 0;
+}
+#endif

src/openssl.h

@@ -0,0 +1,22 @@
+#ifndef _OPENSSL_H_
+#define _OPENSSL_H_
+
+#ifdef HAVE_CONFIG_H
+#  include "config.h"
+#endif
+
+#include "common.h"
+#include <bdlib/src/String.h>
+
+#include "libssl.h"
+#include "libcrypto.h"
+
+#ifdef EGG_SSL_EXT
+extern SSL_CTX *ssl_ctx;
+extern char *tls_rand_file;
+#endif
+extern int ssl_use;
+
+int init_openssl();
+int uninit_openssl();
+#endif