src/modules/extra/m_ssl_oper_cert.cpp

   1 /*       +------------------------------------+
   2  *       | Inspire Internet Relay Chat Daemon |
   3  *       +------------------------------------+
   4  *
   5  *  InspIRCd: (C) 2002-2008 InspIRCd Development Team
   6  * See: http://www.inspircd.org/wiki/index.php/Credits
   7  *
   8  * This program is free but copyrighted software; see
   9  *            the file COPYING for details.
  10  *
  11  * ---------------------------------------------------
  12  */
  13
  14 /* $ModDesc: Allows for MD5 encrypted oper passwords */
  15 /* $ModDep: transport.h */
  16
  17 #include "inspircd.h"
  18 #include "inspircd_config.h"
  19 #include "users.h"
  20 #include "channels.h"
  21 #include "modules.h"
  22 #include "transport.h"
  23
  24 /** Handle /FINGERPRINT
  25  */
  26 class cmd_fingerprint : public Command
  27 {
  28  public:
  29         cmd_fingerprint (InspIRCd* Instance) : Command(Instance,"FINGERPRINT", 0, 1)
  30         {
  31                 this->source = "m_ssl_oper_cert.so";
  32                 syntax = "<nickname>";
  33         }
  34
  35         CmdResult Handle (const std::vector<std::string> &parameters, User *user)
  36         {
  37                 User* target = ServerInstance->FindNick(parameters[0]);
  38                 if (target)
  39                 {
  40                         ssl_cert* cert;
  41                         if (target->GetExt("ssl_cert",cert))
  42                         {
  43                                 if (cert->GetFingerprint().length())
  44                                 {
  45                                         user->WriteServ("NOTICE %s :Certificate fingerprint for %s is %s",user->nick.c_str(),target->nick.c_str(),cert->GetFingerprint().c_str());
  46                                         return CMD_SUCCESS;
  47                                 }
  48                                 else
  49                                 {
  50                                         user->WriteServ("NOTICE %s :Certificate fingerprint for %s does not exist!", user->nick.c_str(),target->nick.c_str());
  51                                         return CMD_FAILURE;
  52                                 }
  53                         }
  54                         else
  55                         {
  56                                 user->WriteServ("NOTICE %s :Certificate fingerprint for %s does not exist!", user->nick.c_str(), target->nick.c_str());
  57                                 return CMD_FAILURE;
  58                         }
  59                 }
  60                 else
  61                 {
  62                         user->WriteNumeric(401, "%s %s :No such nickname", user->nick.c_str(), parameters[0].c_str());
  63                         return CMD_FAILURE;
  64                 }
  65         }
  66 };
  67
  68
  69
  70 class ModuleOperSSLCert : public Module
  71 {
  72         ssl_cert* cert;
  73         bool HasCert;
  74         cmd_fingerprint* mycommand;
  75         ConfigReader* cf;
  76  public:
  77
  78         ModuleOperSSLCert(InspIRCd* Me)
  79                 : Module(Me)
  80         {
  81                 mycommand = new cmd_fingerprint(ServerInstance);
  82                 ServerInstance->AddCommand(mycommand);
  83                 cf = new ConfigReader(ServerInstance);
  84                 Implementation eventlist[] = { I_OnPreCommand, I_OnRehash };
  85                 ServerInstance->Modules->Attach(eventlist, this, 2);
  86         }
  87
  88         virtual ~ModuleOperSSLCert()
  89         {
  90                 delete cf;
  91         }
  92
  93
  94         virtual void OnRehash(User* user, const std::string &parameter)
  95         {
  96                 delete cf;
  97                 cf = new ConfigReader(ServerInstance);
  98         }
  99
 100         bool OneOfMatches(const char* host, const char* ip, const char* hostlist)
 101         {
 102                 std::stringstream hl(hostlist);
 103                 std::string xhost;
 104                 while (hl >> xhost)
 105                 {
 106                         if (InspIRCd::Match(host, xhost) || InspIRCd::MatchCIDR(ip, xhost))
 107                         {
 108                                 return true;
 109                         }
 110                 }
 111                 return false;
 112         }
 113
 114         virtual int OnPreCommand(std::string &command, std::vector<std::string> &parameters, User *user, bool validated, const std::string &original_line)
 115         {
 116                 irc::string cmd = command.c_str();
 117
 118                 if ((cmd == "OPER") && (validated))
 119                 {
 120                         char TheHost[MAXBUF];
 121                         char TheIP[MAXBUF];
 122                         std::string LoginName;
 123                         std::string Password;
 124                         std::string OperType;
 125                         std::string HostName;
 126                         std::string HashType;
 127                         std::string FingerPrint;
 128                         bool SSLOnly;
 129                         char* dummy;
 130
 131                         snprintf(TheHost,MAXBUF,"%s@%s",user->ident.c_str(),user->host.c_str());
 132                         snprintf(TheIP, MAXBUF,"%s@%s",user->ident.c_str(),user->GetIPString());
 133
 134                         HasCert = user->GetExt("ssl_cert",cert);
 135
 136                         for (int i = 0; i < cf->Enumerate("oper"); i++)
 137                         {
 138                                 LoginName = cf->ReadValue("oper", "name", i);
 139                                 Password = cf->ReadValue("oper", "password", i);
 140                                 OperType = cf->ReadValue("oper", "type", i);
 141                                 HostName = cf->ReadValue("oper", "host", i);
 142                                 HashType = cf->ReadValue("oper", "hash", i);
 143                                 FingerPrint = cf->ReadValue("oper", "fingerprint", i);
 144                                 SSLOnly = cf->ReadFlag("oper", "sslonly", i);
 145
 146                                 if (FingerPrint.empty() && !SSLOnly)
 147                                         continue;
 148
 149                                 if (LoginName != parameters[0])
 150                                         continue;
 151
 152                                 if (!OneOfMatches(TheHost, TheIP, HostName.c_str()))
 153                                         continue;
 154
 155                                 if (Password.length() && !ServerInstance->PassCompare(user, Password.c_str(),parameters[1].c_str(), HashType.c_str()))
 156                                         continue;
 157
 158                                 if (SSLOnly && !user->GetExt("ssl", dummy))
 159                                 {
 160                                         user->WriteNumeric(491, "%s :This oper login name requires an SSL connection.", user->nick.c_str());
 161                                         return 1;
 162                                 }
 163
 164                                 /*
 165                                  * No cert found or the fingerprint doesn't match
 166                                  */
 167                                 if ((!cert) || (cert->GetFingerprint() != FingerPrint))
 168                                 {
 169                                         user->WriteNumeric(491, "%s :This oper login name requires a matching key fingerprint.",user->nick.c_str());
 170                                         ServerInstance->SNO->WriteToSnoMask('o',"'%s' cannot oper, does not match fingerprint", user->nick.c_str());
 171                                         ServerInstance->Logs->Log("m_ssl_oper_cert",DEFAULT,"OPER: Failed oper attempt by %s!%s@%s: credentials valid, but wrong fingerprint.", user->nick.c_str(), user->ident.c_str(), user->host.c_str());
 172                                         return 1;
 173                                 }
 174                         }
 175                 }
 176
 177                 // Let core handle it for extra stuff
 178                 return 0;
 179         }
 180
 181         virtual Version GetVersion()
 182         {
 183                 return Version("$Id$", VF_VENDOR, API_VERSION);
 184         }
 185 };
 186
 187 MODULE_INIT(ModuleOperSSLCert)
 188