mirrors/ngircd
1
0
Fork 0
mirror of https://github.com/osmarks/ngircd.git synced 2024-10-27 20:36:18 +00:00
Code Issues Releases Wiki Activity

Allow SSL client-only configurations without keys/certificates

Browse Source 
You don't need to configure certificates/keys as long as you don't
configure SSL-enabled listening ports.

This can make sense when you want to only link your local daemon to an
uplink server using SSL and only have clients on your local host or in
you fully trusted network, where SSL is not required.
This commit is contained in:
Alexander Barton 2024-01-06 19:53:33 +01:00
parent 07219281ef
commit 2448d047f9
2 changed files with 27 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
src/ngircd/conn-ssl.c
View File

@ -421,12 +421,6 @@ ConnSSL_LoadServerKey_gnutls(void)
return false;
}
cert_file = Conf_SSLOptions.CertFile ? Conf_SSLOptions.CertFile:Conf_SSLOptions.KeyFile;
if (!cert_file) {
Log(LOG_ERR, "No SSL server key configured!");
return false;
}
if (array_bytes(&Conf_SSLOptions.KeyFilePassword))
Log(LOG_WARNING,
"Ignoring SSL \"KeyFilePassword\": Not supported by GnuTLS.");
@ -435,7 +429,13 @@ ConnSSL_LoadServerKey_gnutls(void)
return false;
gnutls_certificate_set_dh_params(x509_cred, dh_params);
err = gnutls_certificate_set_x509_key_file(x509_cred, cert_file, Conf_SSLOptions.KeyFile, GNUTLS_X509_FMT_PEM);
cert_file = Conf_SSLOptions.CertFile ?
Conf_SSLOptions.CertFile : Conf_SSLOptions.KeyFile;
if (Conf_SSLOptions.KeyFile) {
err = gnutls_certificate_set_x509_key_file(x509_cred, cert_file,
Conf_SSLOptions.KeyFile,
GNUTLS_X509_FMT_PEM);
if (err < 0) {
Log(LOG_ERR,
"Failed to set certificate key file (cert %s, key %s): %s",
@ -444,6 +444,7 @@ ConnSSL_LoadServerKey_gnutls(void)
gnutls_strerror(err));
return false;
}
}
/* Free currently active x509 context (if any) unless it is still in use */
slot = array_get(&x509_creds, sizeof(x509_cred_slot), x509_cred_idx);
@ -494,14 +495,12 @@ ConnSSL_LoadServerKey_openssl(SSL_CTX *ctx)
char *cert_key;
assert(ctx);
if (!Conf_SSLOptions.KeyFile) {
Log(LOG_ERR, "No SSL server key configured!");
return false;
}
SSL_CTX_set_default_passwd_cb(ctx, pem_passwd_cb);
SSL_CTX_set_default_passwd_cb_userdata(ctx, &Conf_SSLOptions.KeyFilePassword);
if (!Conf_SSLOptions.KeyFile)
return true;
if (SSL_CTX_use_PrivateKey_file(ctx, Conf_SSLOptions.KeyFile, SSL_FILETYPE_PEM) != 1) {
array_free_wipe(&Conf_SSLOptions.KeyFilePassword);
LogOpenSSLError("Failed to add private key", Conf_SSLOptions.KeyFile);

9
src/ngircd/conn.c
View File

@ -479,6 +479,15 @@ Conn_InitListeners( void )
/* not using systemd socket activation, initialize listening sockets: */
#ifdef SSL_SUPPORT
if (!Conf_SSLOptions.KeyFile &&
array_length(&Conf_SSLOptions.ListenPorts, sizeof (UINT16))) {
Log(LOG_ERR,
"Ignoring SSL-enabled listening ports: No key file set!");
array_free(&Conf_SSLOptions.ListenPorts);
}
#endif
/* can't use Conf_ListenAddress directly, see below */
copy = strdup(Conf_ListenAddress);
if (!copy) {