9b0bd01749
Fix crash on (outgoing) server linking attempt.
2015-09-04 12:22:39 +02:00
452aa02737
SSL: use ECDHE key only once (per session) for better forward security.
2015-08-17 11:43:18 +02:00
37a6c078ff
Disable SSL tickets to improve forward security. Isn't that useful on IRC anyway (hence session cache was already off).
2015-08-17 11:37:27 +02:00
4378667303
SSL: Add support for ECDHE for forward secrecy.
2015-08-17 11:10:25 +02:00
f0bba94144
Disable SSLv3.
2015-08-16 21:10:53 +02:00
13fffa4e1a
split all the local client stuff to acptr->local. makes it a lot easier to catch bugs.
...
If the IRCd crashes then it's likely not by this change but rather an existing issue that was previously gone unnoticed.
2015-07-19 12:48:18 +02:00
0698ba296c
various stuff
2015-07-16 21:01:50 +02:00
9bd211d46e
Fix some ununitialized stuff
2015-07-16 10:56:46 +02:00
f22cef97d4
Why do we have those unnecessary (SSL *) casts everywhere? Poof. Gone.
2015-07-15 15:54:36 +02:00
dcb4e382a3
Apparently on newer OpenSSL versions (unreleased) you can't access the read buffer. So use this method instead. Ohh.. we are so helpful to our users..
2015-07-15 15:48:00 +02:00
168ff802c4
Show a meaningful error when connecting to an SSL-only port with STARTTLS (iotw: if you forgot ssl in link::outgoing::options).
2015-07-15 15:09:01 +02:00
f847d2c9e5
hmm. inconsistency.
2015-07-15 14:55:35 +02:00
f265e9f970
re-indent without chgs
2015-07-15 14:52:22 +02:00
5778e53515
Print a helpful error when trying to link using an SSL-only port and the port isn't actually SSL-only (on the other end).
2015-07-15 14:41:40 +02:00
1ba5f95ecb
For ougoing server links, attempt to upgrade the connection via STARTTLS if not using SSL/TLS already.
2015-07-15 12:09:11 +02:00
00dd10c744
transform more failops call
2015-07-09 14:05:06 +02:00
aea09603a4
Remove USE_SSL macro and associated code
...
We no longer support non-SSL builds, remove related code
2015-05-20 02:48:34 -04:00
8f7886d9c7
init_ctx_client() was accidentally setting options on ctx_server. Reported by Jobe ( #4346 ).
2015-05-18 12:12:24 +02:00
94a6305880
Added config_report_ssl_error() which is now used when we failed to (re)initialize
...
SSL, may print a bit more meaningful errors (though rather long and obscure).
2014-07-20 17:45:58 +02:00
a51479b614
Win32: Fix SSL error not showing up in dialog box (was logged to ircd.log, though..)
2014-07-20 17:31:15 +02:00
7ba2e3214c
First attempt at allowing server to boot if SSL is enabled but the
...
server/client SSL context failed to load (eg: no cert/key file).
2014-07-20 16:50:29 +02:00
d7c198cc82
Secure server to server links were previously hardcoded at SSLv3. This has
...
been fixed to be 'SSLv3 or later'. In practice this means that you will now
see a lot more server-to-server links using TLSv1.2.
2014-01-09 21:39:36 +01:00
101d2dd6a3
Big 3.4.x commit containing bug fixes and enhancements. Modularizing
...
user & channel modes. Fixing Windows build. Etc..
2014-05-11 20:56:02 +02:00
f5cfafb94e
- ssl: include prototype for start_of_normal_client_handshake().
2013-05-24 23:16:37 +00:00
afdf5d780a
- Replace ircsprintf() with bounds-checking ircsnprintf(), patch from FalconKirtaran. ( #4208 )
2013-05-21 06:26:52 +00:00
61fe014771
- Remove sendto_server_butone() and friends, now everything uses sendto_server(). ( #4202 )
...
Patch from FalconKirtaran.
2013-05-20 01:21:45 +00:00
95370c6420
- ssl: Clean up no longer needed debug messages.
2013-05-06 02:42:26 +00:00
595afafd28
- Finish up SSL linking support for evented I/O.
2013-05-06 02:39:18 +00:00
5bbc40438f
- Initial work at making SSL connects work with the evented I/O.
2013-05-06 02:14:31 +00:00
0b5fb5903e
- SSL: fix some bitrot left over from evented i/o rewrite
2013-01-14 06:23:53 -06:00
f768abc2c2
- Fix typo in previous patch, pointed out by Wolfwood. ( #4147 )
2012-12-26 13:18:27 -06:00
614a006900
- Do not attempt to set up DH params if not requested.
2012-12-01 23:11:44 -06:00
501d93d6ea
- Add support for providing a DH parameters file. ( #4147 )
...
DH parameters files must be encoded in PEM format, and the path is
set using the ssl::dh config setting. This is based on a patch
submitted by wolfwood, with some modifications to avoid using stdio
unnecessarily and to avoid code duplication.
2012-12-01 22:49:19 -06:00
ab5e766d9c
- Replace calls to strncpyzt() macro with more secure strlcpy().
...
This was done using Coccinelle, the semantic patch was:
@@
expression src, dst, len;
@@
- strncpyzt(src, dst, len);
+ strlcpy(src, dst, len);
2012-11-21 03:22:29 +00:00
25318ec24b
- Port the SSL code over to the evented I/O subsystem.
2012-10-05 14:19:54 +00:00
63dd326113
- SSL errors are now more descriptive. 'Underlying syscall error' is now
...
gone and shows the actual (surprise!) underlying syscall error.
Reported by vonitsanet, patch from ohnobinki (#0003157 ).
2010-09-19 14:26:47 +00:00
17c97c8442
- Fixed notices to opers about server delinks not being broadcasted to all
...
other servers if they were on SSL links. Reported by chotaire (#0003957 ).
2010-09-19 14:10:43 +00:00
94c2b58366
- Fix a few compiler warnings with some double-casting and another const. ( #3939 )
2010-08-03 23:57:44 +00:00
5a0a71de03
- Added support for STARTTLS. This allows users to switch to SSL without
...
having to use a special SSL-only port, they can simply switch to SSL on
any port. This is currently only supported by few clients (such as KVIrc 4).
This functionality can be disabled by setting set::ssl::options::no-starttls,
for example if you don't want to offer SSL to your users and only want it
to be used for server to server links.
Naturally, the IRCd must be compiled with SSL support for STARTTLS to work.
- Fixed SSL_ERROR_WANT_READ in IRCd_ssl_write()
2009-12-06 16:52:52 +00:00
ebf40ab6e6
- Added set::ssl::server-cipher-list, #002368 requested by Beastie
...
[Backport, sts]
- Added set::ssl::renegotiate-bytes, set::ssl:renegotiate-timeout, #0002971
suggested by tabrisnet. Gets activated when >0. Please set sane values.
[Backport, sts]
2008-08-11 13:54:35 +00:00
ef8ffdda04
- Showing even more SSL server errors now, hopefully all of them, also changed the
...
error notice a bit so it's much more like non-SSL server link errors. Reported by
vonitsanet (#0003150 ).
2006-12-19 19:37:41 +00:00
0537a49be6
- Fixed SSL bug where an outgoing connect (either autoconnect, or /connect), would not
...
show any error message when it failed. Error information has also been slightly
improved. Reported by vonitsanet (#0003138 ).
2006-12-06 14:33:42 +00:00
fe77be7070
- Win32: SSL private key prompt should now no longer crash. Patch provided by Alexey
...
Markevich (#0002866 ).
2006-11-04 13:23:37 +00:00
25684239fa
- Fixed some unitialized pointer things for win32 w/ssl on keyprompt, no idea if it
...
helps, though. Would appreciate it if another code looks into this. -- Syzop
2006-11-03 19:31:21 +00:00
601eb71ba7
- Fixed SSL crash problem due to previous SSL change.
2006-08-23 10:43:02 +00:00
05f5cfe02b
- The server SSL certificate and private key can now be reloaded without requiring a server
...
restart, simply use: /REHASH -ssl
2006-08-20 23:05:55 +00:00
ae03d2e4e8
- Added chained SSL certificates support, patch provided by justdave ( #0002848 ).
2006-04-09 16:51:04 +00:00
b30301ecfe
- Sometimes if an oper was connected trough SSL and had the junk snomask (+s +j) set it
...
would cause a crash. Reported by chasingsol (#0002777 ).
2006-01-27 15:25:31 +00:00
e5f16b777a
Made the win32 version use a dynamically linked libc
2004-05-30 00:59:05 +00:00
f58c46a334
- Updated SSL error for underlying syscall error a bit ( #0001615 ).
2004-03-03 21:27:05 +00:00
Bram Matthys