src/modules/extra/m_ssl_oper_cert.cpp

   1 /*       +------------------------------------+
   2  *       | Inspire Internet Relay Chat Daemon |
   3  *       +------------------------------------+
   4  *
   5  *  InspIRCd: (C) 2002-2009 InspIRCd Development Team
   6  * See: http://wiki.inspircd.org/Credits
   7  *
   8  * This program is free but copyrighted software; see
   9  *            the file COPYING for details.
  10  *
  11  * ---------------------------------------------------
  12  */
  13
  14 /* $ModDesc: Allows for MD5 encrypted oper passwords */
  15 /* $ModDep: transport.h */
  16
  17 #include "inspircd.h"
  18 #include "transport.h"
  19
  20 /** Handle /FINGERPRINT
  21  */
  22 class CommandFingerprint : public Command
  23 {
  24  public:
  25         CommandFingerprint (InspIRCd* Instance) : Command(Instance,"FINGERPRINT", 0, 1)
  26         {
  27                 this->source = "m_ssl_oper_cert.so";
  28                 syntax = "<nickname>";
  29         }
  30
  31         CmdResult Handle (const std::vector<std::string> &parameters, User *user)
  32         {
  33                 User* target = ServerInstance->FindNick(parameters[0]);
  34                 if (target)
  35                 {
  36                         ssl_cert* cert;
  37                         if (target->GetExt("ssl_cert",cert))
  38                         {
  39                                 if (cert->GetFingerprint().length())
  40                                 {
  41                                         user->WriteServ("NOTICE %s :Certificate fingerprint for %s is %s",user->nick.c_str(),target->nick.c_str(),cert->GetFingerprint().c_str());
  42                                         return CMD_LOCALONLY;
  43                                 }
  44                                 else
  45                                 {
  46                                         user->WriteServ("NOTICE %s :Certificate fingerprint for %s does not exist!", user->nick.c_str(),target->nick.c_str());
  47                                         return CMD_FAILURE;
  48                                 }
  49                         }
  50                         else
  51                         {
  52                                 user->WriteServ("NOTICE %s :Certificate fingerprint for %s does not exist!", user->nick.c_str(), target->nick.c_str());
  53                                 return CMD_FAILURE;
  54                         }
  55                 }
  56                 else
  57                 {
  58                         user->WriteNumeric(401, "%s %s :No such nickname", user->nick.c_str(), parameters[0].c_str());
  59                         return CMD_FAILURE;
  60                 }
  61         }
  62 };
  63
  64
  65
  66 class ModuleOperSSLCert : public Module
  67 {
  68         ssl_cert* cert;
  69         bool HasCert;
  70         CommandFingerprint* mycommand;
  71         ConfigReader* cf;
  72  public:
  73
  74         ModuleOperSSLCert(InspIRCd* Me)
  75                 : Module(Me)
  76         {
  77                 mycommand = new CommandFingerprint(ServerInstance);
  78                 ServerInstance->AddCommand(mycommand);
  79                 cf = new ConfigReader(ServerInstance);
  80                 Implementation eventlist[] = { I_OnPreCommand, I_OnRehash };
  81                 ServerInstance->Modules->Attach(eventlist, this, 2);
  82         }
  83
  84         virtual ~ModuleOperSSLCert()
  85         {
  86                 delete cf;
  87         }
  88
  89
  90         virtual void OnRehash(User* user, const std::string &parameter)
  91         {
  92                 delete cf;
  93                 cf = new ConfigReader(ServerInstance);
  94         }
  95
  96         bool OneOfMatches(const char* host, const char* ip, const char* hostlist)
  97         {
  98                 std::stringstream hl(hostlist);
  99                 std::string xhost;
 100                 while (hl >> xhost)
 101                 {
 102                         if (InspIRCd::Match(host, xhost, ascii_case_insensitive_map) || InspIRCd::MatchCIDR(ip, xhost, ascii_case_insensitive_map))
 103                         {
 104                                 return true;
 105                         }
 106                 }
 107                 return false;
 108         }
 109
 110         virtual int OnPreCommand(std::string &command, std::vector<std::string> &parameters, User *user, bool validated, const std::string &original_line)
 111         {
 112                 irc::string cmd = command.c_str();
 113
 114                 if ((cmd == "OPER") && (validated))
 115                 {
 116                         char TheHost[MAXBUF];
 117                         char TheIP[MAXBUF];
 118                         std::string LoginName;
 119                         std::string Password;
 120                         std::string OperType;
 121                         std::string HostName;
 122                         std::string HashType;
 123                         std::string FingerPrint;
 124                         bool SSLOnly;
 125                         char* dummy;
 126
 127                         snprintf(TheHost,MAXBUF,"%s@%s",user->ident.c_str(),user->host.c_str());
 128                         snprintf(TheIP, MAXBUF,"%s@%s",user->ident.c_str(),user->GetIPString());
 129
 130                         HasCert = user->GetExt("ssl_cert",cert);
 131
 132                         for (int i = 0; i < cf->Enumerate("oper"); i++)
 133                         {
 134                                 LoginName = cf->ReadValue("oper", "name", i);
 135                                 Password = cf->ReadValue("oper", "password", i);
 136                                 OperType = cf->ReadValue("oper", "type", i);
 137                                 HostName = cf->ReadValue("oper", "host", i);
 138                                 HashType = cf->ReadValue("oper", "hash", i);
 139                                 FingerPrint = cf->ReadValue("oper", "fingerprint", i);
 140                                 SSLOnly = cf->ReadFlag("oper", "sslonly", i);
 141
 142                                 if (FingerPrint.empty() && !SSLOnly)
 143                                         continue;
 144
 145                                 if (LoginName != parameters[0])
 146                                         continue;
 147
 148                                 if (!OneOfMatches(TheHost, TheIP, HostName.c_str()))
 149                                         continue;
 150
 151                                 if (Password.length() && ServerInstance->PassCompare(user, Password.c_str(),parameters[1].c_str(), HashType.c_str()))
 152                                         continue;
 153
 154                                 if (SSLOnly && !user->GetExt("ssl", dummy))
 155                                 {
 156                                         user->WriteNumeric(491, "%s :This oper login name requires an SSL connection.", user->nick.c_str());
 157                                         return 1;
 158                                 }
 159
 160                                 /*
 161                                  * No cert found or the fingerprint doesn't match
 162                                  */
 163                                 if ((!cert) || (cert->GetFingerprint() != FingerPrint))
 164                                 {
 165                                         user->WriteNumeric(491, "%s :This oper login name requires a matching key fingerprint.",user->nick.c_str());
 166                                         ServerInstance->SNO->WriteToSnoMask('o',"'%s' cannot oper, does not match fingerprint", user->nick.c_str());
 167                                         ServerInstance->Logs->Log("m_ssl_oper_cert",DEFAULT,"OPER: Failed oper attempt by %s!%s@%s: credentials valid, but wrong fingerprint.", user->nick.c_str(), user->ident.c_str(), user->host.c_str());
 168                                         return 1;
 169                                 }
 170                         }
 171                 }
 172
 173                 // Let core handle it for extra stuff
 174                 return 0;
 175         }
 176
 177         virtual Version GetVersion()
 178         {
 179                 return Version("$Id$", VF_VENDOR, API_VERSION);
 180         }
 181 };
 182
 183 MODULE_INIT(ModuleOperSSLCert)
 184