src/modules/extra/m_ssl_oper_cert.cpp

   1 /*       +------------------------------------+
   2  *       | Inspire Internet Relay Chat Daemon |
   3  *       +------------------------------------+
   4  *
   5  *  InspIRCd: (C) 2002-2007 InspIRCd Development Team
   6  * See: http://www.inspircd.org/wiki/index.php/Credits
   7  *
   8  * This program is free but copyrighted software; see
   9  *            the file COPYING for details.
  10  *
  11  * ---------------------------------------------------
  12  */
  13
  14 /* $ModDesc: Allows for MD5 encrypted oper passwords */
  15 /* $ModDep: transport.h */
  16
  17 #include "inspircd.h"
  18 #include "inspircd_config.h"
  19 #include "users.h"
  20 #include "channels.h"
  21 #include "modules.h"
  22 #include "transport.h"
  23 #include "wildcard.h"
  24
  25 /** Handle /FINGERPRINT
  26  */
  27 class cmd_fingerprint : public Command
  28 {
  29  public:
  30         cmd_fingerprint (InspIRCd* Instance) : Command(Instance,"FINGERPRINT", 0, 1)
  31         {
  32                 this->source = "m_ssl_oper_cert.so";
  33                 syntax = "<nickname>";
  34         }
  35
  36         CmdResult Handle (const char** parameters, int pcnt, userrec *user)
  37         {
  38                 userrec* target = ServerInstance->FindNick(parameters[0]);
  39                 if (target)
  40                 {
  41                         ssl_cert* cert;
  42                         if (target->GetExt("ssl_cert",cert))
  43                         {
  44                                 if (cert->GetFingerprint().length())
  45                                 {
  46                                         user->WriteServ("NOTICE %s :Certificate fingerprint for %s is %s",user->nick,target->nick,cert->GetFingerprint().c_str());
  47                                         return CMD_SUCCESS;
  48                                 }
  49                                 else
  50                                 {
  51                                         user->WriteServ("NOTICE %s :Certificate fingerprint for %s does not exist!", user->nick,target->nick);
  52                                         return CMD_FAILURE;
  53                                 }
  54                         }
  55                         else
  56                         {
  57                                 user->WriteServ("NOTICE %s :Certificate fingerprint for %s does not exist!", user->nick, target->nick);
  58                                 return CMD_FAILURE;
  59                         }
  60                 }
  61                 else
  62                 {
  63                         user->WriteServ("401 %s %s :No such nickname", user->nick, parameters[0]);
  64                         return CMD_FAILURE;
  65                 }
  66         }
  67 };
  68
  69
  70
  71 class ModuleOperSSLCert : public Module
  72 {
  73         ssl_cert* cert;
  74         bool HasCert;
  75         cmd_fingerprint* mycommand;
  76         ConfigReader* cf;
  77  public:
  78
  79         ModuleOperSSLCert(InspIRCd* Me)
  80                 : Module(Me)
  81         {
  82                 mycommand = new cmd_fingerprint(ServerInstance);
  83                 ServerInstance->AddCommand(mycommand);
  84                 cf = new ConfigReader(ServerInstance);
  85         }
  86
  87         virtual ~ModuleOperSSLCert()
  88         {
  89                 delete cf;
  90         }
  91
  92         void Implements(char* List)
  93         {
  94                 List[I_OnPreCommand] = List[I_OnRehash] = 1;
  95         }
  96
  97         virtual void OnRehash(userrec* user, const std::string &parameter)
  98         {
  99                 delete cf;
 100                 cf = new ConfigReader(ServerInstance);
 101         }
 102
 103         bool OneOfMatches(const char* host, const char* ip, const char* hostlist)
 104         {
 105                 std::stringstream hl(hostlist);
 106                 std::string xhost;
 107                 while (hl >> xhost)
 108                 {
 109                         if (match(host,xhost.c_str()) || match(ip,xhost.c_str(),true))
 110                         {
 111                                 return true;
 112                         }
 113                 }
 114                 return false;
 115         }
 116
 117
 118         virtual int OnPreCommand(const std::string &command, const char** parameters, int pcnt, userrec *user, bool validated, const std::string &original_line)
 119         {
 120                 irc::string cmd = command.c_str();
 121
 122                 if ((cmd == "OPER") && (validated))
 123                 {
 124                         char TheHost[MAXBUF];
 125                         char TheIP[MAXBUF];
 126                         std::string LoginName;
 127                         std::string Password;
 128                         std::string OperType;
 129                         std::string HostName;
 130                         std::string FingerPrint;
 131                         bool SSLOnly;
 132                         char* dummy;
 133
 134                         snprintf(TheHost,MAXBUF,"%s@%s",user->ident,user->host);
 135                         snprintf(TheIP, MAXBUF,"%s@%s",user->ident,user->GetIPString());
 136
 137                         HasCert = user->GetExt("ssl_cert",cert);
 138
 139                         for (int i = 0; i < cf->Enumerate("oper"); i++)
 140                         {
 141                                 LoginName = cf->ReadValue("oper", "name", i);
 142                                 Password = cf->ReadValue("oper", "password", i);
 143                                 OperType = cf->ReadValue("oper", "type", i);
 144                                 HostName = cf->ReadValue("oper", "host", i);
 145                                 FingerPrint = cf->ReadValue("oper", "fingerprint", i);
 146                                 SSLOnly = cf->ReadFlag("oper", "sslonly", i);
 147
 148                                 if (SSLOnly || !FingerPrint.empty())
 149                                 {
 150                                         if ((!strcmp(LoginName.c_str(),parameters[0])) && (!ServerInstance->OperPassCompare(Password.c_str(),parameters[1],i)) && (OneOfMatches(TheHost,TheIP,HostName.c_str())))
 151                                         {
 152                                                 if (SSLOnly && !user->GetExt("ssl", dummy))
 153                                                 {
 154                                                         user->WriteServ("491 %s :This oper login name requires an SSL connection.", user->nick);
 155                                                         return 1;
 156                                                 }
 157
 158                                                 /* This oper would match */
 159                                                 if ((!cert) || (cert->GetFingerprint() != FingerPrint))
 160                                                 {
 161                                                         user->WriteServ("491 %s :This oper login name requires a matching key fingerprint.",user->nick);
 162                                                         ServerInstance->SNO->WriteToSnoMask('o',"'%s' cannot oper, does not match fingerprint", user->nick);
 163                                                         ServerInstance->Log(DEFAULT,"OPER: Failed oper attempt by %s!%s@%s: credentials valid, but wrong fingerprint.",user->nick,user->ident,user->host);
 164                                                         return 1;
 165                                                 }
 166                                         }
 167                                 }
 168                         }
 169                 }
 170                 return 0;
 171         }
 172
 173         virtual Version GetVersion()
 174         {
 175                 return Version(1,1,0,0,VF_VENDOR,API_VERSION);
 176         }
 177 };
 178
 179 MODULE_INIT(ModuleOperSSLCert);
 180