1 | /*************************************************************************** |
2 | * Copyright (C) 2005-2014 by the Quassel Project * |
3 | * devel@quassel-irc.org * |
4 | * * |
5 | * This program is free software; you can redistribute it and/or modify * |
6 | * it under the terms of the GNU General Public License as published by * |
7 | * the Free Software Foundation; either version 2 of the License, or * |
8 | * (at your option) version 3. * |
9 | * * |
10 | * This program is distributed in the hope that it will be useful, * |
11 | * but WITHOUT ANY WARRANTY; without even the implied warranty of * |
12 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * |
13 | * GNU General Public License for more details. * |
14 | * * |
15 | * You should have received a copy of the GNU General Public License * |
16 | * along with this program; if not, write to the * |
17 | * Free Software Foundation, Inc., * |
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * |
19 | ***************************************************************************/ |
20 | |
21 | #include "sslserver.h" |
22 | |
23 | #ifdef HAVE_SSL |
24 | # include <QSslSocket> |
25 | #endif |
26 | |
27 | #include <QDateTime> |
28 | #include <QFile> |
29 | |
30 | #include "logger.h" |
31 | #include "quassel.h" |
32 | |
33 | #ifdef HAVE_SSL |
34 | |
35 | SslServer::SslServer(QObject *parent) |
36 | : QTcpServer(parent), |
37 | _isCertValid(false) |
38 | { |
39 | static bool sslWarningShown = false; |
40 | if (!setCertificate(Quassel::configDirPath() + "quasselCert.pem" )) { |
41 | if (!sslWarningShown) { |
42 | quWarning() |
43 | << "SslServer: Unable to set certificate file\n" |
44 | << " Quassel Core will still work, but cannot provide SSL for client connections.\n" |
45 | << " Please see http://quassel-irc.org/faq/cert to learn how to enable SSL support." ; |
46 | sslWarningShown = true; |
47 | } |
48 | } |
49 | } |
50 | |
51 | |
52 | QTcpSocket *SslServer::nextPendingConnection() |
53 | { |
54 | if (_pendingConnections.isEmpty()) |
55 | return 0; |
56 | else |
57 | return _pendingConnections.takeFirst(); |
58 | } |
59 | |
60 | #if QT_VERSION >= 0x050000 |
61 | void SslServer::incomingConnection(qintptr socketDescriptor) |
62 | #else |
63 | void SslServer::incomingConnection(int socketDescriptor) |
64 | #endif |
65 | { |
66 | QSslSocket *serverSocket = new QSslSocket(this); |
67 | if (serverSocket->setSocketDescriptor(socketDescriptor)) { |
68 | if (isCertValid()) { |
69 | serverSocket->setLocalCertificate(_cert); |
70 | serverSocket->setPrivateKey(_key); |
71 | serverSocket->addCaCertificates(_ca); |
72 | } |
73 | _pendingConnections << serverSocket; |
74 | emit newConnection(); |
75 | } |
76 | else { |
77 | delete serverSocket; |
78 | } |
79 | } |
80 | |
81 | |
82 | bool SslServer::setCertificate(const QString &path) |
83 | { |
84 | _isCertValid = false; |
85 | |
86 | if (path.isEmpty()) |
87 | return false; |
88 | |
89 | QFile certFile(path); |
90 | if (!certFile.exists()) { |
91 | quWarning() << "SslServer: Certificate file" << qPrintable(path) << "does not exist" ; |
92 | return false; |
93 | } |
94 | |
95 | if (!certFile.open(QIODevice::ReadOnly)) { |
96 | quWarning() |
97 | << "SslServer: Failed to open certificate file" << qPrintable(path) |
98 | << "error:" << certFile.error(); |
99 | return false; |
100 | } |
101 | |
102 | QList<QSslCertificate> certList = QSslCertificate::fromDevice(&certFile); |
103 | |
104 | if (certList.isEmpty()) { |
105 | quWarning() << "SslServer: Certificate file doesn't contain a certificate" ; |
106 | return false; |
107 | } |
108 | |
109 | _cert = certList[0]; |
110 | certList.removeFirst(); // remove server cert |
111 | |
112 | // store CA and intermediates certs |
113 | _ca = certList; |
114 | |
115 | if (!certFile.reset()) { |
116 | quWarning() << "SslServer: IO error reading certificate file" ; |
117 | return false; |
118 | } |
119 | |
120 | _key = QSslKey(&certFile, QSsl::Rsa); |
121 | certFile.close(); |
122 | |
123 | if (_cert.isNull()) { |
124 | quWarning() << "SslServer:" << qPrintable(path) << "contains no certificate data" ; |
125 | return false; |
126 | } |
127 | |
128 | // We allow the core to offer SSL anyway, so no "return false" here. Client will warn about the cert being invalid. |
129 | const QDateTime now = QDateTime::currentDateTime(); |
130 | if (now < _cert.effectiveDate()) |
131 | quWarning() << "SslServer: Certificate won't be valid before" << _cert.effectiveDate().toString(); |
132 | |
133 | else if (now > _cert.expiryDate()) |
134 | quWarning() << "SslServer: Certificate expired on" << _cert.expiryDate().toString(); |
135 | |
136 | else { // Qt4's isValid() checks for time range and blacklist; avoid a double warning, hence the else block |
137 | #if QT_VERSION < 0x050000 |
138 | if (!_cert.isValid()) |
139 | #else |
140 | if (_cert.isBlacklisted()) |
141 | #endif |
142 | quWarning() << "SslServer: Certificate blacklisted" ; |
143 | } |
144 | if (_key.isNull()) { |
145 | quWarning() << "SslServer:" << qPrintable(path) << "contains no key data" ; |
146 | return false; |
147 | } |
148 | |
149 | _isCertValid = true; |
150 | |
151 | return _isCertValid; |
152 | } |
153 | |
154 | |
155 | #endif // HAVE_SSL |
156 | |