From: Egor <egor@patchysicp.xyz>
Date: Wed, 11 May 2022 14:35:02 +0000 (+0300)
Subject: enable tls client certificates
X-Git-Url: https://git.patchysicp.xyz/?a=commitdiff_plain;h=c299cee7eb5e00390e31cfa049c384d04a9076d5;p=patchyircd.git

enable tls client certificates
---

diff --git a/irc.c b/irc.c
index 72f8f20..f079b49 100644
--- a/irc.c
+++ b/irc.c
@@ -843,6 +843,11 @@ void newUser(struct client_data *client) {
 		return;
 	client->regstate = REG_REGISTERED;
 	client->umode |= UMODE_INVISIBLE | UMODE_WALLOPS;
+#ifdef HAS_TLS
+	// TODO: move this when we add sasl
+	if (client->cctx && tls_peer_cert_provided(client->cctx))
+		fprintf(stderr, "CertFP %"PRISocket": %s\n", client->FD, tls_peer_cert_hash(client->cctx));
+#endif
 	rpl_welcome(client),  sendbuf(client);
 	rpl_yourhost(client), sendbuf(client);
 	rpl_created(client),  sendbuf(client);
diff --git a/main.c b/main.c
index fe2638f..685c2a8 100644
--- a/main.c
+++ b/main.c
@@ -226,6 +226,8 @@ int main() {
 		return fprintf(stderr, "tls_config_set_cert_file: %s\n", tls_config_error(tls_cfg)), 1;
 	if (tls_config_set_key_file(tls_cfg, "key.pem") == -1)
 		return fprintf(stderr, "tls_config_set_key_file: %s\n", tls_config_error(tls_cfg)), 1;
+	tls_config_insecure_noverifycert(tls_cfg);
+	tls_config_verify_client_optional(tls_cfg);
 	if (!(tls_ctx = tls_server()))
 		return fprintf(stderr, "tls_server error\n"), 1;
 	if (tls_configure(tls_ctx, tls_cfg) == -1)