fedserv/echoIRCd
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

whois: show negotiated TLS version/group/cipher in 671; sslgroup crate reads the KEX group

Browse source
This commit is contained in:
Jean Chevronnet 2026-08-24 21:45:46 +00:00
parent 85eb8218f0
commit 009bea734a
No known key found for this signature in database
GPG key ID: 439666D63A9477E4
13 changed files with 103 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

13
src/coremods/core_info.rs
View file

@ -200,6 +200,7 @@ impl Command for Whois {
last_active: u64,
signon: u64,
certfp: Option<String>,
tls_info: Option<String>,
swhois: Option<String>,
showwhois: bool,
}
@ -219,6 +220,7 @@ impl Command for Whois {
last_active,
signon,
certfp,
tls_info,
swhois,
showwhois,
} = {
@ -239,6 +241,7 @@ impl Command for Whois {
last_active: u.last_active,
signon: u.signon,
certfp: u.certfp.clone(),
tls_info: u.tls_info.clone(),
swhois: u
.ext
.get::<crate::coremods::core_oper::Swhois>()
@ -399,12 +402,18 @@ impl Command for Whois {
&format!("{nick} {acct} :is logged in as"),
);
}
// sslinfo: advertise a secure (TLS) connection
// sslinfo: advertise a secure (TLS) connection, with the negotiated
// version/group/cipher (e.g. TLSv1.3/X25519MLKEM768/TLS_CHACHA20_POLY1305_SHA256)
// when the backend could report it.
if secure && !(hide && crate::modules::hidewhois::hide_secure(s)) {
let detail = match &tls_info {
Some(t) if !t.is_empty() => format!(" [{t}]"),
_ => String::new(),
};
s.numeric(
uid,
RPL_WHOISSECURE,
&format!("{nick} :is using a secure connection"),
&format!("{nick} :is using a secure connection{detail}"),
);
}
// client-cert fingerprint (CertFP) — shown to the user themselves and opers

4
src/ircd.rs
View file

@ -28,6 +28,7 @@ pub enum Event {
sock: Option<TcpStream>,
secure: bool,
certfp: Option<String>, // TLS client-cert fingerprint (clients only)
tls_info: Option<String>, // negotiated TLS version/group/cipher (WHOIS 671)
local_port: u16, // the listener port the client connected to
link: bool, // a server-to-server connection, not a client
outbound: bool, // (link) we dialed them
@ -189,6 +190,7 @@ impl Ircd {
sock,
secure,
certfp,
tls_info,
local_port,
link,
outbound,
@ -198,7 +200,7 @@ impl Ircd {
self.server.add_link(uid, addr, out, sock, outbound);
} else {
self.server
.add_conn(uid, addr, out, sock, secure, certfp, local_port);
.add_conn(uid, addr, out, sock, secure, certfp, tls_info, local_port);
if websocket {
if let Some(u) = self.server.users.get_mut(&uid) {
u.flags.via_websocket = true;

2
src/link.rs
View file

@ -2827,6 +2827,7 @@ mod tests {
vhost: None,
secure: false,
certfp: None,
tls_info: None,
account: None,
signon: 0,
nick_ts: 0,
@ -2916,6 +2917,7 @@ mod tests {
vhost: None,
secure: false,
certfp: None,
tls_info: None,
account: None,
signon: 0,
nick_ts: 0,

1
src/modules/reputation.rs
View file

@ -374,6 +374,7 @@ mod tests {
vhost: None,
secure: false,
certfp: None,
tls_info: None,
account: Some("reverse".into()),
signon: 0,
nick_ts: 0,

1
src/s2s_sim.rs
View file

@ -74,6 +74,7 @@ impl Node {
vhost: None,
secure: false,
certfp: None,
tls_info: None,
account: None,
signon: 0,
nick_ts: 0,

3
src/server.rs
View file

@ -387,6 +387,7 @@ impl Server {
sock: Option<TcpStream>,
secure: bool,
certfp: Option<String>,
tls_info: Option<String>,
local_port: u16,
) {
let uuid = self.next_uuid();
@ -405,6 +406,7 @@ impl Server {
vhost: None,
secure,
certfp,
tls_info,
account: None,
signon: now(),
nick_ts: now(),
@ -1544,6 +1546,7 @@ mod tests {
vhost: None,
secure: false,
certfp: None,
tls_info: None,
account: None,
signon: 0,
nick_ts: 0,

15
src/socketengine.rs
View file

@ -656,6 +656,7 @@ fn reactor_loop(
sock: None,
secure: false,
certfp: None,
tls_info: None,
local_port: a.local_port,
link: false,
outbound: false,
@ -788,7 +789,8 @@ fn try_handshake(
core: &Sender<Event>,
) -> bool {
let mut close = false;
let mut connect: Option<(Uid, SocketAddr, u16, Option<String>, OutSink)> = None;
let mut connect: Option<(Uid, SocketAddr, u16, Option<String>, Option<String>, OutSink)> =
None;
if let Some(c) = conns.get_mut(&t) {
if !c.handshaking {
return true;
@ -798,10 +800,11 @@ fn try_handshake(
Ok(true) => {
c.handshaking = false;
let certfp = sess.peer_cert_fp();
let tls_info = sess.tls_info();
connect = c
.pending_out
.take()
.map(|out| (c.uid, c.addr, c.local_port, certfp, out));
.map(|out| (c.uid, c.addr, c.local_port, certfp, tls_info, out));
set_interest(poll, c, t); // handshake done: drop the extra WRITABLE
}
Ok(false) => return false, // still negotiating
@ -813,7 +816,7 @@ fn try_handshake(
} else {
return false;
}
if let Some((uid, addr, local_port, certfp, out)) = connect {
if let Some((uid, addr, local_port, certfp, tls_info, out)) = connect {
let _ = core.send(Event::Connect {
uid,
addr,
@ -821,6 +824,7 @@ fn try_handshake(
sock: None,
secure: true,
certfp,
tls_info,
local_port,
link: false,
outbound: false,
@ -943,6 +947,7 @@ fn read_conn(poll: &mut Poll, conns: &mut HashMap<usize, Conn>, t: usize, core:
sock: None,
secure,
certfp,
tls_info: None,
local_port,
link: false,
outbound: false,
@ -1096,6 +1101,7 @@ pub fn accept_loop(
sock: Some(shutdown),
secure: false,
certfp: None,
tls_info: None,
local_port,
link,
outbound: false,
@ -1180,6 +1186,7 @@ pub fn connect_link(addr: &str, core: Sender<Event>, counter: Arc<AtomicU64>, ma
sock: Some(shutdown),
secure: false,
certfp: None,
tls_info: None,
local_port: 0,
link: true,
outbound: true,
@ -1287,6 +1294,7 @@ fn tls_conn(
}
};
let certfp = conn.peer_cert_fp();
let tls_info = conn.tls_info();
let (out_tx, out_rx) = mpsc::channel::<String>();
if core
.send(Event::Connect {
@ -1296,6 +1304,7 @@ fn tls_conn(
sock: Some(shutdown),
secure: true,
certfp,
tls_info,
local_port,
link,
outbound: false,

30
src/tls.rs
View file

@ -15,7 +15,7 @@ use mio::net::TcpStream as MioStream;
use openssl::hash::MessageDigest;
use openssl::ssl::{
ErrorCode, NameType, SniError, Ssl, SslAcceptor, SslAcceptorBuilder, SslContext, SslFiletype,
SslMethod, SslMode, SslStream, SslVerifyMode,
SslMethod, SslMode, SslRef, SslStream, SslVerifyMode,
};
/// A hot-reloadable TLS certificate source (implemented by the openssl backend);
@ -41,6 +41,11 @@ pub trait TlsConn: Send {
/// SHA-256 fingerprint (lowercase hex) of the peer's certificate, if it sent
/// one. Drives SASL EXTERNAL / CertFP.
fn peer_cert_fp(&self) -> Option<String>;
/// `<version>/<group>/<cipher>` summary of the session for the WHOIS 671
/// sslinfo line, if the backend can report it.
fn tls_info(&self) -> Option<String> {
None
}
}
/// A non-blocking TLS session the reactor drives itself over a mio socket. The
@ -70,6 +75,10 @@ pub trait TlsSession: Send {
fn source(&mut self) -> &mut MioStream;
/// SHA-256 fingerprint of the peer certificate (CertFP / SASL EXTERNAL), if any.
fn peer_cert_fp(&self) -> Option<String>;
/// `<version>/<group>/<cipher>` summary of the session for WHOIS 671, if any.
fn tls_info(&self) -> Option<String> {
None
}
fn shutdown(&mut self);
}
@ -204,6 +213,19 @@ fn ssl_io_err(e: openssl::ssl::Error) -> io::Error {
}
}
/// `<version>/<group>/<cipher>` for the WHOIS 671 sslinfo line, e.g.
/// `TLSv1.3/X25519MLKEM768/TLS_CHACHA20_POLY1305_SHA256`. The key-exchange group
/// comes from `sslgroup` (SSL_get0_group_name); it's omitted when OpenSSL can't
/// report it (TLS 1.2, or before the handshake completes).
fn openssl_tls_info(ssl: &SslRef) -> Option<String> {
let cipher = ssl.current_cipher()?.name();
let ver = ssl.version_str();
match sslgroup::group_name(ssl) {
Some(g) if !g.is_empty() => Some(format!("{ver}/{g}/{cipher}")),
_ => Some(format!("{ver}/{cipher}")),
}
}
impl TlsSession for OpensslSession {
fn accept(&mut self) -> io::Result<bool> {
match self.0.accept() {
@ -233,6 +255,9 @@ impl TlsSession for OpensslSession {
let digest = cert.digest(MessageDigest::sha256()).ok()?;
Some(digest.iter().map(|b| format!("{b:02x}")).collect())
}
fn tls_info(&self) -> Option<String> {
openssl_tls_info(self.0.ssl())
}
fn shutdown(&mut self) {
// best-effort TLS close_notify, then close the socket. Non-blocking, so a
// WouldBlock just means the alert is queued — we don't wait for the peer's.
@ -264,4 +289,7 @@ impl TlsConn for OpensslConn {
let digest = cert.digest(MessageDigest::sha256()).ok()?;
Some(digest.iter().map(|b| format!("{b:02x}")).collect())
}
fn tls_info(&self) -> Option<String> {
openssl_tls_info(self.0.ssl())
}
}

1
src/users.rs
View file

@ -230,6 +230,7 @@ pub struct User {
pub vhost: Option<String>, // displayed-host override (CHGHOST/SETHOST vhost)
pub secure: bool, // connected over TLS (drives WHOIS 671 / sslinfo)
pub certfp: Option<String>, // TLS client-cert fingerprint (SASL EXTERNAL / CertFP)
pub tls_info: Option<String>, // negotiated TLS version/group/cipher (WHOIS 671)
pub account: Option<String>, // logged-in account name (set by services)
pub signon: u64, // unix secs at registration (WHOIS 317)
pub nick_ts: u64, // unix secs the current nick was taken (nick-collision arbitration)

1
src/websocket.rs
View file

@ -278,6 +278,7 @@ fn ws_session<S: WsStream>(
sock: Some(shutdown),
secure,
certfp: None,
tls_info: None,
local_port,
link: false,
outbound: false,