enable tls client certificates

diff --git a/irc.c b/irc.c
index 72f8f20..f079b49 100644 (file)
--- a/irc.c
+++ b/irc.c
@@ -843,6 +843,11 @@ void newUser(struct client_data *client) {
                return;
        client->regstate = REG_REGISTERED;
        client->umode |= UMODE_INVISIBLE | UMODE_WALLOPS;
+#ifdef HAS_TLS
+       // TODO: move this when we add sasl
+       if (client->cctx && tls_peer_cert_provided(client->cctx))
+               fprintf(stderr, "CertFP %"PRISocket": %s\n", client->FD, tls_peer_cert_hash(client->cctx));
+#endif
        rpl_welcome(client),  sendbuf(client);
        rpl_yourhost(client), sendbuf(client);
        rpl_created(client),  sendbuf(client);

diff --git a/main.c b/main.c
index fe2638f..685c2a8 100644 (file)
--- a/main.c
+++ b/main.c
@@ -226,6 +226,8 @@ int main() {
                return fprintf(stderr, "tls_config_set_cert_file: %s\n", tls_config_error(tls_cfg)), 1;
        if (tls_config_set_key_file(tls_cfg, "key.pem") == -1)
                return fprintf(stderr, "tls_config_set_key_file: %s\n", tls_config_error(tls_cfg)), 1;
+       tls_config_insecure_noverifycert(tls_cfg);
+       tls_config_verify_client_optional(tls_cfg);
        if (!(tls_ctx = tls_server()))
                return fprintf(stderr, "tls_server error\n"), 1;
        if (tls_configure(tls_ctx, tls_cfg) == -1)