[READ-ONLY] Mirror of https://github.com/VibeDevelopers/Comet.
ircd/listener: return a fatal TLS alert for early rejected TLS clients
This is in furtherance of commit 3fdf26aa19628d5e12a3 which added
functionality to reply with a TLS record layer alert for D-Lined TLS
clients. It turns out that there are other plaintext error messages
in this same function that should receive the same treatment.
Also move another error string to a variable and use a compile-time
optimised-out strlen for it too, to use the same approach as an
existing error string.
Finally, use a different alert (internal_error) for the case where
IRCd is simply unable to accept more connections.
Aaron Jones
(Nov 7, 2023, 11:52 PM UTC)
642c73dd
c1b01bf5
+48
-21
+1
-1
include/reject.h
+1
-1
include/reject.h
···
28
28
#define DELAYED_EXIT_TIME 10
29
29
30
30
void init_reject(void);
31
-
int check_reject(rb_fde_t *F, struct sockaddr *addr);
31
+
int check_reject(rb_fde_t *F, struct sockaddr *addr, bool ssl);
32
32
void add_reject(struct Client *, const char *mask1, const char *mask2, struct ConfItem *aconf, const char *reason);
33
33
int is_reject_ip(struct sockaddr *addr);
34
34
void flush_reject(void);
+19
-5
ircd/listener.c
+19
-5
ircd/listener.c
···
581
581
static time_t last_oper_notice = 0;
582
582
int len;
583
583
584
+
static const char *allinuse = "ERROR :All connections in use\r\n";
584
585
static const char *toofast = "ERROR :Reconnecting too fast, throttled.\r\n";
585
586
586
-
static const unsigned char sslerrcode[] = {
587
+
static const unsigned char ssldeniederrcode[] = {
587
588
// SSLv3.0 Fatal Alert: Access Denied
588
589
0x15, 0x03, 0x00, 0x00, 0x02, 0x02, 0x31
590
+
};
591
+
592
+
static const unsigned char sslinternalerrcode[] = {
593
+
// SSLv3.0 Fatal Alert: Internal Error
594
+
0x15, 0x03, 0x00, 0x00, 0x02, 0x02, 0x50
589
595
};
590
596
591
597
if(listener->ssl && (!ircd_ssl_ok || !get_ssld_count()))
···
608
614
last_oper_notice = rb_current_time();
609
615
}
610
616
611
-
rb_write(F, "ERROR :All connections in use\r\n", 31);
617
+
if(listener->ssl)
618
+
rb_write(F, sslinternalerrcode, sizeof(sslinternalerrcode));
619
+
else
620
+
rb_write(F, allinuse, strlen(allinuse));
621
+
612
622
rb_close(F);
613
623
return 0;
614
624
}
···
625
635
626
636
if(listener->ssl)
627
637
{
628
-
rb_write(F, sslerrcode, sizeof(sslerrcode));
638
+
rb_write(F, ssldeniederrcode, sizeof(ssldeniederrcode));
629
639
}
630
640
else if(ConfigFileEntry.dline_with_reason)
631
641
{
···
648
658
return 0;
649
659
}
650
660
651
-
if(check_reject(F, addr)) {
661
+
if(check_reject(F, addr, listener->ssl)) {
652
662
/* Reject the connection without closing the socket
653
663
* because it is now on the delay_exit list. */
654
664
return 0;
···
656
666
657
667
if(throttle_add(addr))
658
668
{
659
-
rb_write(F, toofast, strlen(toofast));
669
+
if(listener->ssl)
670
+
rb_write(F, ssldeniederrcode, sizeof(ssldeniederrcode));
671
+
else
672
+
rb_write(F, toofast, strlen(toofast));
673
+
660
674
rb_close(F);
661
675
return 0;
662
676
}
+28
-15
ircd/reject.c
+28
-15
ircd/reject.c
···
58
58
rb_fde_t *F;
59
59
struct ConfItem *aconf;
60
60
const char *reason;
61
+
bool ssl;
61
62
} delay_t;
62
63
63
64
typedef struct _throttle
···
92
93
delay_t *ddata;
93
94
static const char *errbuf = "ERROR :Closing Link: (*** Banned (cache))\r\n";
94
95
96
+
static const unsigned char ssldeniederrcode[] = {
97
+
// SSLv3.0 Fatal Alert: Access Denied
98
+
0x15, 0x03, 0x00, 0x00, 0x02, 0x02, 0x31
99
+
};
100
+
95
101
RB_DLINK_FOREACH_SAFE(ptr, ptr_next, delay_exit.head)
96
102
{
97
103
ddata = ptr->data;
98
104
99
-
*dynamic_reason = '\0';
105
+
if (ddata->ssl)
106
+
{
107
+
rb_write(ddata->F, ssldeniederrcode, sizeof(ssldeniederrcode));
108
+
}
109
+
else
110
+
{
111
+
*dynamic_reason = '\0';
112
+
113
+
if (ddata->aconf)
114
+
snprintf(dynamic_reason, sizeof dynamic_reason, form_str(ERR_YOUREBANNEDCREEP) "\r\n",
115
+
me.name, "*", get_user_ban_reason(ddata->aconf));
116
+
else if (ddata->reason)
117
+
snprintf(dynamic_reason, sizeof dynamic_reason, ":%s 465 %s :%s\r\n",
118
+
me.name, "*", ddata->reason);
119
+
120
+
if (*dynamic_reason)
121
+
rb_write(ddata->F, dynamic_reason, strlen(dynamic_reason));
122
+
123
+
rb_write(ddata->F, errbuf, strlen(errbuf));
124
+
}
100
125
101
126
if (ddata->aconf)
102
-
{
103
-
snprintf(dynamic_reason, sizeof dynamic_reason, form_str(ERR_YOUREBANNEDCREEP) "\r\n",
104
-
me.name, "*", get_user_ban_reason(ddata->aconf));
105
-
rb_write(ddata->F, dynamic_reason, strlen(dynamic_reason));
106
-
107
127
deref_conf(ddata->aconf);
108
-
}
109
-
else if (ddata->reason)
110
-
{
111
-
snprintf(dynamic_reason, sizeof dynamic_reason, ":%s 465 %s :%s\r\n",
112
-
me.name, "*", ddata->reason);
113
-
rb_write(ddata->F, dynamic_reason, strlen(dynamic_reason));
114
-
}
115
128
116
-
rb_write(ddata->F, errbuf, strlen(errbuf));
117
129
rb_close(ddata->F);
118
130
rb_free(ddata);
119
131
}
···
228
240
}
229
241
230
242
int
231
-
check_reject(rb_fde_t *F, struct sockaddr *addr)
243
+
check_reject(rb_fde_t *F, struct sockaddr *addr, bool ssl)
232
244
{
233
245
rb_patricia_node_t *pnode;
234
246
reject_t *rdata;
···
276
288
ddata->reason = NULL;
277
289
}
278
290
ddata->F = F;
291
+
ddata->ssl = ssl;
279
292
rb_dlinkAdd(ddata, &ddata->node, &delay_exit);
280
293
return 1;
281
294
}