From 7df008ead4badb6906d253dfb87b055d744c4822 Mon Sep 17 00:00:00 2001 From: stskeeps Date: Wed, 22 Nov 2000 20:38:00 +0000 Subject: [PATCH] +- Changed some stuff with SSL, you may want to seperate server.pem into + server.key.pem and server.cert.pem (or "rm Makefile" and "./Config") +- Fixed a couple of SJOIN/Link problems detected by Curt|s --- Changes | 3 +++ Makefile.dist | 11 ++++++++--- include/ssl.h | 4 ++-- src/ssl.c | 2 +- src/ssl.cnf | 14 ++++++-------- src/ssl.rnd | Bin 1024 -> 1024 bytes 6 files changed, 20 insertions(+), 14 deletions(-) diff --git a/Changes b/Changes index 6f90e2afc..c24c63e17 100644 --- a/Changes +++ b/Changes @@ -738,5 +738,8 @@ some potvin stuff - Added so blocking is only effective when SSL_connect()'ing - Fixed a couple of SJOIN/Link problems detected by Curt|s +- Changed some stuff with SSL, you may want to seperate server.pem into + server.key.pem and server.cert.pem (or "rm Makefile" and "./Config") +- Fixed a couple of SJOIN/Link problems detected by Curt|s - Made /stats C show SSL/Zip flags - Fixed the Stskeeps "mass G:line on /rehash" (tm) bug diff --git a/Makefile.dist b/Makefile.dist index 11a9d40e8..bbfb4edd7 100644 --- a/Makefile.dist +++ b/Makefile.dist @@ -214,7 +214,12 @@ install: all @echo "Now install by hand; make install is broken." pem: src/ssl.cnf - $(OPENSSLPATH) req -new -x509 -days 365 -nodes \ - -config src/ssl.cnf -out server.pem -keyout server.pem + @echo "Generating certificate request .. " + $(OPENSSLPATH) req -new -config src/ssl.cnf -out server.req.pem \ + -keyout server.key.pem -nodes + @echo "Generating self-signed certificate .. " + $(OPENSSLPATH) req -x509 -days 365 -in server.req.pem \ + -key server.key.pem -out server.cert.pem + @echo "Generating fingerprint .." $(OPENSSLPATH) x509 -subject -dates -fingerprint -noout \ - -in server.pem + -in server.cert.pem diff --git a/include/ssl.h b/include/ssl.h index 6b8e73362..28f3f4c04 100644 --- a/include/ssl.h +++ b/include/ssl.h @@ -1,6 +1,6 @@ /* Make these what you want for cert & key files */ -#define CERTF "server.pem" -#define KEYF "server.pem" +#define CERTF "server.cert.pem" +#define KEYF "server.key.pem" extern SSL_CTX * ctx; diff --git a/src/ssl.c b/src/ssl.c index 8556c648f..18bf68a4b 100644 --- a/src/ssl.c +++ b/src/ssl.c @@ -54,7 +54,7 @@ void init_ctx_client(void) ircd_log("Failed to load SSL certificate %s (client)", "client.pem"); exit(3); } - if (SSL_CTX_use_PrivateKey_file(ctx_client, CERTF, SSL_FILETYPE_PEM) <= 0) + if (SSL_CTX_use_PrivateKey_file(ctx_client, KEYF, SSL_FILETYPE_PEM) <= 0) { ircd_log("Failed to load SSL private key %s (client)", KEYF); exit(4); diff --git a/src/ssl.cnf b/src/ssl.cnf index 29c86eeaf..defe92fae 100644 --- a/src/ssl.cnf +++ b/src/ssl.cnf @@ -9,25 +9,23 @@ distinguished_name = req_dn x509_extensions = cert_type [ req_dn ] -countryName = US -countryName_default = Country Name +countryName = Country Name +countryName_default = US countryName_min = 2 countryName_max = 2 -stateOrProvinceName = City -stateOrProvinceName_default = City +stateOrProvinceName = State/Province +stateOrProvinceName_default = New York localityName = Locality Name (eg, city) 0.organizationName = Organization Name (eg, company) -0.organizationName_default = Organization Name (eg. company) +0.organizationName_default = IRC geeks organizationalUnitName = Organizational Unit Name (eg, section) -#organizationalUnitName_default = +organizationalUnitName_default = IRCd 0.commonName = Common Name (Full domain of your server) - -1.commonName = Common Name (default) 1.commonName_value = localhost [ cert_type ] diff --git a/src/ssl.rnd b/src/ssl.rnd index 97f69978e84fd274d6ff72bc499a328d20afc097..b911b7f1b863ad7372fe97351254dcc71486ba84 100644 GIT binary patch literal 1024 zcmV+b1poUX8C~p_=+yoi3_I*DFt6d5IUk$7`-jfP+((Qz5CZ`#9Z>V)0#q&ivc zNV2=du$n>BZ10mR_T?3^5Mccv8td1Z-R|pM{~R6YqGoVj1%v;PCqp<#XTx} zd!9?LwqmGFZ*5bk*?A1c*@Z`l^vUMNhVj}}9)z#}&W+xO_F&k3-pJdSmHLZrp&u35 z(%u_&)^Cf+6CL8{{3yjxei>MHet_A<27D-@+%Ix7V&hRhITfWNH?=W;G!dY~QU^-p zupfUe=LuY&`S+Td8b(J!b!*7H@%Lr(54Pi4Lokr-Rj6vU#!oeU0OmTvtKZ9x`v> zbKfqmHy0G6VuMf*sGHTR=x1N)%Y(&JviXLkZ@tDxh}a%z{O6Dinm4H7WxV(7!PvUV%hN*o7Kf()`Xq6=NWM9r1b#4V^ykQt&*SBaLxU!~svepnrZ<4zy$ zz?k{MB>|Hg24ziiXc&}%k;Xb(CHv`OQh75bG}4bcmM#~o!s5@&FUGUQ>feZuWryWF z+nny1%o!Gy@l~sU2-F17(B~om5dI(aLshO^x_oMhrVe#GT6kdq`||H3&fdB2)sKkg z2D+NY8u4>meIs5W#kP?L)hy2GD=i(nNI#x`0{BE_;1hPR;EJ`c-hItk)U^!W6|^;U zMNV~PNo^WkE8a)=UfZ24c9dacmF&tH)q$PGt9iAe``jIZMzwwTdPGx+hOvPNajG6< zlkf)lpYIWCkkA-Ha}JCc)9gHE3h@jp#AY{$uTY^${f)lh_GjA->7z{=WOY9XL$3$G z9HF7;)*QR+_^#dNqc9fq;Yf|J>R;FX<>LCW2^!#L?gVGVav*)^(-mtx)jLtzfYL`+ zwVeBOD4AY}Bw!UZTw19-tN18!(UBVjRQfh0L=U+MDhjSjW$f$DFIg_&A6c$(Pe8U9 zBVEksjc0Waoe?If8mNlt^VbTrV&Xk{wv(bgk_Oj}Xof*Q$+9@y4Dri$L8BE)zBXY) u3ZXe`QMa+ZV2>ntws7U!R zlYnRF%X|Z{&8-BQO~=2gqfg}UQ%5~Bhpd?@RZ->}^*{=@b871Zt--*Tn$IBF8Sr+Us6fC-pK#IO!$8}#$t zv&|;yXEv9As@J^`?1~LodYIb}JEf=} z;iY-1Q&a+O#{J)>teVMx4x@V!F|O<-52Y+$NSxOs2%zGzqN!(JuA)H82-W2?W|d&XN-=060zW5+>qV@r zT$NJ6>hYNV37-zHhx8cI_SAqk4z|`zu1zam8lg&LfNrbzX~UF zPPWWhwr;B>0U`{`;q~(MN!ZtpGKDQK?-Ek{zfnrT<>zppG<%%MXQd@q?JUVmKsV%q zDaL|ayqwi%N>XY8Ot^g?=n7z?<}hE@&IjWfzmJf4&8sJQm1t8u@V-B=f4Ohpn}Og# uZ-J6W44Y3GiXvjY8CvA4=MHFuPY{E)g!WjQPC9XJdEXAW#8uGZ$`g#I{{0gG