src/modules/m_cgiirc.cpp

   1 /*
   2  * InspIRCd -- Internet Relay Chat Daemon
   3  *
   4  *   Copyright (C) 2009-2010 Daniel De Graaf <danieldg@inspircd.org>
   5  *   Copyright (C) 2007-2008 John Brooks <john.brooks@dereferenced.net>
   6  *   Copyright (C) 2008 Pippijn van Steenhoven <pip88nl@gmail.com>
   7  *   Copyright (C) 2006-2008 Craig Edwards <craigedwards@brainbox.cc>
   8  *   Copyright (C) 2007 Robin Burchell <robin+git@viroteck.net>
   9  *   Copyright (C) 2007 Dennis Friis <peavey@inspircd.org>
  10  *   Copyright (C) 2006 Oliver Lupton <oliverlupton@gmail.com>
  11  *
  12  * This file is part of InspIRCd.  InspIRCd is free software: you can
  13  * redistribute it and/or modify it under the terms of the GNU General Public
  14  * License as published by the Free Software Foundation, version 2.
  15  *
  16  * This program is distributed in the hope that it will be useful, but WITHOUT
  17  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
  18  * FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
  19  * details.
  20  *
  21  * You should have received a copy of the GNU General Public License
  22  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  23  */
  24
  25
  26 #include "inspircd.h"
  27 #include "modules/ssl.h"
  28 #include "modules/webirc.h"
  29 #include "modules/whois.h"
  30
  31 enum
  32 {
  33         // InspIRCd-specific.
  34         RPL_WHOISGATEWAY = 350
  35 };
  36
  37 // We need this method up here so that it can be accessed from anywhere
  38 static void ChangeIP(LocalUser* user, const irc::sockets::sockaddrs& sa)
  39 {
  40         // Set the users IP address and make sure they are in the right clone pool.
  41         ServerInstance->Users->RemoveCloneCounts(user);
  42         user->SetClientIP(sa);
  43         ServerInstance->Users->AddClone(user);
  44         if (user->quitting)
  45                 return;
  46
  47         // Recheck the connect class.
  48         user->MyClass = NULL;
  49         user->SetClass();
  50         user->CheckClass();
  51         if (user->quitting)
  52                 return;
  53
  54         // Check if this user matches any XLines.
  55         user->CheckLines(true);
  56         if (user->quitting)
  57                 return;
  58 }
  59
  60 // Encapsulates information about an ident host.
  61 class IdentHost
  62 {
  63  private:
  64         std::string hostmask;
  65         std::string newident;
  66
  67  public:
  68         IdentHost(const std::string& mask, const std::string& ident)
  69                 : hostmask(mask)
  70                 , newident(ident)
  71         {
  72         }
  73
  74         const std::string& GetIdent() const
  75         {
  76                 return newident;
  77         }
  78
  79         bool Matches(LocalUser* user) const
  80         {
  81                 if (!InspIRCd::Match(user->GetRealHost(), hostmask, ascii_case_insensitive_map))
  82                         return false;
  83
  84                 return InspIRCd::MatchCIDR(user->GetIPString(), hostmask, ascii_case_insensitive_map);
  85         }
  86 };
  87
  88 // Encapsulates information about a WebIRC host.
  89 class WebIRCHost
  90 {
  91  private:
  92         std::string hostmask;
  93         std::string fingerprint;
  94         std::string password;
  95         std::string passhash;
  96
  97  public:
  98         WebIRCHost(const std::string& mask, const std::string& fp, const std::string& pass, const std::string& hash)
  99                 : hostmask(mask)
 100                 , fingerprint(fp)
 101                 , password(pass)
 102                 , passhash(hash)
 103         {
 104         }
 105
 106         bool Matches(LocalUser* user, const std::string& pass) const
 107         {
 108                 // Did the user send a valid password?
 109                 if (!password.empty() && !ServerInstance->PassCompare(user, password, pass, passhash))
 110                         return false;
 111
 112                 // Does the user have a valid fingerprint?
 113                 const std::string fp = SSLClientCert::GetFingerprint(&user->eh);
 114                 if (!fingerprint.empty() && fp != fingerprint)
 115                         return false;
 116
 117                 // Does the user's hostname match our hostmask?
 118                 if (InspIRCd::Match(user->GetRealHost(), hostmask, ascii_case_insensitive_map))
 119                         return true;
 120
 121                 // Does the user's IP address match our hostmask?
 122                 return InspIRCd::MatchCIDR(user->GetIPString(), hostmask, ascii_case_insensitive_map);
 123         }
 124 };
 125
 126 /*
 127  * WEBIRC
 128  *  This is used for the webirc method of CGIIRC auth, and is (really) the best way to do these things.
 129  *  Syntax: WEBIRC password gateway hostname ip
 130  *  Where password is a shared key, gateway is the name of the WebIRC gateway and version (e.g. cgiirc), hostname
 131  *  is the resolved host of the client issuing the command and IP is the real IP of the client.
 132  *
 133  * How it works:
 134  *  To tie in with the rest of cgiirc module, and to avoid race conditions, /webirc is only processed locally
 135  *  and simply sets metadata on the user, which is later decoded on full connect to give something meaningful.
 136  */
 137 class CommandWebIRC : public SplitCommand
 138 {
 139  public:
 140         std::vector<WebIRCHost> hosts;
 141         bool notify;
 142         StringExtItem gateway;
 143         StringExtItem realhost;
 144         StringExtItem realip;
 145         Events::ModuleEventProvider webircevprov;
 146
 147         CommandWebIRC(Module* Creator)
 148                 : SplitCommand(Creator, "WEBIRC", 4)
 149                 , gateway("cgiirc_gateway", ExtensionItem::EXT_USER, Creator)
 150                 , realhost("cgiirc_realhost", ExtensionItem::EXT_USER, Creator)
 151                 , realip("cgiirc_realip", ExtensionItem::EXT_USER, Creator)
 152                 , webircevprov(Creator, "event/webirc")
 153         {
 154                 allow_empty_last_param = false;
 155                 works_before_reg = true;
 156                 this->syntax = "<password> <gateway> <hostname> <ip> [flags]";
 157         }
 158
 159         CmdResult HandleLocal(LocalUser* user, const Params& parameters) CXX11_OVERRIDE
 160         {
 161                 if (user->registered == REG_ALL || realhost.get(user))
 162                         return CMD_FAILURE;
 163
 164                 for (std::vector<WebIRCHost>::const_iterator iter = hosts.begin(); iter != hosts.end(); ++iter)
 165                 {
 166                         // If we don't match the host then skip to the next host.
 167                         if (!iter->Matches(user, parameters[0]))
 168                                 continue;
 169
 170                         irc::sockets::sockaddrs ipaddr;
 171                         if (!irc::sockets::aptosa(parameters[3], user->client_sa.port(), ipaddr))
 172                         {
 173                                 user->CommandFloodPenalty += 5000;
 174                                 WriteLog("Connecting user %s (%s) tried to use WEBIRC but gave an invalid IP address.",
 175                                         user->uuid.c_str(), user->GetIPString().c_str());
 176                                 return CMD_FAILURE;
 177                         }
 178
 179                         // The user matched a WebIRC block!
 180                         gateway.set(user, parameters[1]);
 181                         realhost.set(user, user->GetRealHost());
 182                         realip.set(user, user->GetIPString());
 183
 184                         WriteLog("Connecting user %s is using a WebIRC gateway; changing their IP from %s to %s.",
 185                                 user->uuid.c_str(), user->GetIPString().c_str(), parameters[3].c_str());
 186
 187                         // If we have custom flags then deal with them.
 188                         WebIRC::FlagMap flags;
 189                         const bool hasflags = (parameters.size() > 4);
 190                         if (hasflags)
 191                         {
 192                                 // Parse the flags.
 193                                 irc::spacesepstream flagstream(parameters[4]);
 194                                 for (std::string flag; flagstream.GetToken(flag); )
 195                                 {
 196                                         // Does this flag have a value?
 197                                         const size_t separator = flag.find('=');
 198                                         if (separator == std::string::npos)
 199                                         {
 200                                                 flags[flag];
 201                                                 continue;
 202                                         }
 203
 204                                         // The flag has a value!
 205                                         const std::string key = flag.substr(0, separator);
 206                                         const std::string value = flag.substr(separator + 1);
 207                                         flags[key] = value;
 208                                 }
 209                         }
 210
 211                         // Inform modules about the WebIRC attempt.
 212                         FOREACH_MOD_CUSTOM(webircevprov, WebIRC::EventListener, OnWebIRCAuth, (user, (hasflags ? &flags : NULL)));
 213
 214                         // Set the IP address sent via WEBIRC. We ignore the hostname and lookup
 215                         // instead do our own DNS lookups because of unreliable gateways.
 216                         ChangeIP(user, ipaddr);
 217                         return CMD_SUCCESS;
 218                 }
 219
 220                 user->CommandFloodPenalty += 5000;
 221                 WriteLog("Connecting user %s (%s) tried to use WEBIRC but didn't match any configured WebIRC hosts.",
 222                         user->uuid.c_str(), user->GetIPString().c_str());
 223                 return CMD_FAILURE;
 224         }
 225
 226         void WriteLog(const char* message, ...) CUSTOM_PRINTF(2, 3)
 227         {
 228                 std::string buffer;
 229                 VAFORMAT(buffer, message, message);
 230
 231                 // If we are sending a snotice then the message will already be
 232                 // written to the logfile.
 233                 if (notify)
 234                         ServerInstance->SNO->WriteGlobalSno('w', buffer);
 235                 else
 236                         ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, buffer);
 237         }
 238 };
 239
 240 class ModuleCgiIRC
 241         : public Module
 242         , public WebIRC::EventListener
 243         , public Whois::EventListener
 244 {
 245  private:
 246         CommandWebIRC cmd;
 247         std::vector<IdentHost> hosts;
 248
 249         static bool ParseIdent(LocalUser* user, irc::sockets::sockaddrs& out)
 250         {
 251                 const char* ident = NULL;
 252                 if (user->ident.length() == 8)
 253                 {
 254                         // The ident is an IPv4 address encoded in hexadecimal with two characters
 255                         // per address segment.
 256                         ident = user->ident.c_str();
 257                 }
 258                 else if (user->ident.length() == 9 && user->ident[0] == '~')
 259                 {
 260                         // The same as above but m_ident got to this user before we did. Strip the
 261                         // ident prefix and continue as normal.
 262                         ident = user->ident.c_str() + 1;
 263                 }
 264                 else
 265                 {
 266                         // The user either does not have an IPv4 in their ident or the gateway server
 267                         // is also running an identd. In the latter case there isn't really a lot we
 268                         // can do so we just assume that the client in question is not connecting via
 269                         // an ident gateway.
 270                         return false;
 271                 }
 272
 273                 // Try to convert the IP address to a string. If this fails then the user
 274                 // does not have an IPv4 address in their ident.
 275                 errno = 0;
 276                 unsigned long address = strtoul(ident, NULL, 16);
 277                 if (errno)
 278                         return false;
 279
 280                 out.in4.sin_family = AF_INET;
 281                 out.in4.sin_addr.s_addr = htonl(address);
 282                 return true;
 283         }
 284
 285  public:
 286         ModuleCgiIRC()
 287                 : WebIRC::EventListener(this)
 288                 , Whois::EventListener(this)
 289                 , cmd(this)
 290         {
 291         }
 292
 293         void init() CXX11_OVERRIDE
 294         {
 295                 ServerInstance->SNO->EnableSnomask('w', "CGIIRC");
 296         }
 297
 298         void ReadConfig(ConfigStatus& status) CXX11_OVERRIDE
 299         {
 300                 std::vector<IdentHost> identhosts;
 301                 std::vector<WebIRCHost> webirchosts;
 302
 303                 ConfigTagList tags = ServerInstance->Config->ConfTags("cgihost");
 304                 for (ConfigIter i = tags.first; i != tags.second; ++i)
 305                 {
 306                         ConfigTag* tag = i->second;
 307
 308                         // Ensure that we have the <cgihost:mask> parameter.
 309                         const std::string mask = tag->getString("mask");
 310                         if (mask.empty())
 311                                 throw ModuleException("<cgihost:mask> is a mandatory field, at " + tag->getTagLocation());
 312
 313                         // Determine what lookup type this host uses.
 314                         const std::string type = tag->getString("type");
 315                         if (stdalgo::string::equalsci(type, "ident"))
 316                         {
 317                                 // The IP address should be looked up from the hex IP address.
 318                                 const std::string newident = tag->getString("newident", "gateway", ServerInstance->IsIdent);
 319                                 identhosts.push_back(IdentHost(mask, newident));
 320                         }
 321                         else if (stdalgo::string::equalsci(type, "webirc"))
 322                         {
 323                                 // The IP address will be received via the WEBIRC command.
 324                                 const std::string fingerprint = tag->getString("fingerprint");
 325                                 const std::string password = tag->getString("password");
 326
 327                                 // WebIRC blocks require a password.
 328                                 if (fingerprint.empty() && password.empty())
 329                                         throw ModuleException("When using <cgihost type=\"webirc\"> either the fingerprint or password field is required, at " + tag->getTagLocation());
 330
 331                                 webirchosts.push_back(WebIRCHost(mask, fingerprint, password, tag->getString("hash")));
 332                         }
 333                         else
 334                         {
 335                                 throw ModuleException(type + " is an invalid <cgihost:mask> type, at " + tag->getTagLocation());
 336                         }
 337                 }
 338
 339                 // The host configuration was valid so we can apply it.
 340                 hosts.swap(identhosts);
 341                 cmd.hosts.swap(webirchosts);
 342
 343                 // Do we send an oper notice when a m_cgiirc client has their IP changed?
 344                 cmd.notify = ServerInstance->Config->ConfValue("cgiirc")->getBool("opernotice", true);
 345         }
 346
 347         ModResult OnSetConnectClass(LocalUser* user, ConnectClass* myclass) CXX11_OVERRIDE
 348         {
 349                 // If <connect:webirc> is not set then we have nothing to do.
 350                 const std::string webirc = myclass->config->getString("webirc");
 351                 if (webirc.empty())
 352                         return MOD_RES_PASSTHRU;
 353
 354                 // If the user is not connecting via a WebIRC gateway then they
 355                 // cannot match this connect class.
 356                 const std::string* gateway = cmd.gateway.get(user);
 357                 if (!gateway)
 358                         return MOD_RES_DENY;
 359
 360                 // If the gateway matches the <connect:webirc> constraint then
 361                 // allow the check to continue. Otherwise, reject it.
 362                 return InspIRCd::Match(*gateway, webirc) ? MOD_RES_PASSTHRU : MOD_RES_DENY;
 363         }
 364
 365         ModResult OnUserRegister(LocalUser* user) CXX11_OVERRIDE
 366         {
 367                 // There is no need to check for gateways if one is already being used.
 368                 if (cmd.realhost.get(user))
 369                         return MOD_RES_PASSTHRU;
 370
 371                 for (std::vector<IdentHost>::const_iterator iter = hosts.begin(); iter != hosts.end(); ++iter)
 372                 {
 373                         // If we don't match the host then skip to the next host.
 374                         if (!iter->Matches(user))
 375                                 continue;
 376
 377                         // We have matched an <cgihost> block! Try to parse the encoded IPv4 address
 378                         // out of the ident.
 379                         irc::sockets::sockaddrs address(user->client_sa);
 380                         if (!ParseIdent(user, address))
 381                                 return MOD_RES_PASSTHRU;
 382
 383                         // Store the hostname and IP of the gateway for later use.
 384                         cmd.realhost.set(user, user->GetRealHost());
 385                         cmd.realip.set(user, user->GetIPString());
 386
 387                         const std::string& newident = iter->GetIdent();
 388                         cmd.WriteLog("Connecting user %s is using an ident gateway; changing their IP from %s to %s and their ident from %s to %s.",
 389                                 user->uuid.c_str(), user->GetIPString().c_str(), address.addr().c_str(), user->ident.c_str(), newident.c_str());
 390
 391                         user->ChangeIdent(newident);
 392                         ChangeIP(user, address);
 393                         break;
 394                 }
 395                 return MOD_RES_PASSTHRU;
 396         }
 397
 398         void OnWebIRCAuth(LocalUser* user, const WebIRC::FlagMap* flags) CXX11_OVERRIDE
 399         {
 400                 // We are only interested in connection flags. If none have been
 401                 // given then we have nothing to do.
 402                 if (!flags)
 403                         return;
 404
 405                 WebIRC::FlagMap::const_iterator cport = flags->find("remote-port");
 406                 if (cport != flags->end())
 407                 {
 408                         // If we can't parse the port then just give up.
 409                         uint16_t port = ConvToNum<uint16_t>(cport->second);
 410                         if (port)
 411                         {
 412                                 switch (user->client_sa.family())
 413                                 {
 414                                         case AF_INET:
 415                                                 user->client_sa.in4.sin_port = htons(port);
 416                                                 break;
 417
 418                                         case AF_INET6:
 419                                                 user->client_sa.in6.sin6_port = htons(port);
 420                                                 break;
 421
 422                                         default:
 423                                                 // If we have reached this point then we have encountered a bug.
 424                                                 ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "BUG: OnWebIRCAuth(%s): socket type %d is unknown!",
 425                                                         user->uuid.c_str(), user->client_sa.family());
 426                                                 return;
 427                                 }
 428                         }
 429                 }
 430
 431                 WebIRC::FlagMap::const_iterator sport = flags->find("local-port");
 432                 if (sport != flags->end())
 433                 {
 434                         // If we can't parse the port then just give up.
 435                         uint16_t port = ConvToNum<uint16_t>(sport->second);
 436                         if (port)
 437                         {
 438                                 switch (user->server_sa.family())
 439                                 {
 440                                         case AF_INET:
 441                                                 user->server_sa.in4.sin_port = htons(port);
 442                                                 break;
 443
 444                                         case AF_INET6:
 445                                                 user->server_sa.in6.sin6_port = htons(port);
 446                                                 break;
 447
 448                                         default:
 449                                                 // If we have reached this point then we have encountered a bug.
 450                                                 ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "BUG: OnWebIRCAuth(%s): socket type %d is unknown!",
 451                                                         user->uuid.c_str(), user->server_sa.family());
 452                                                 return;
 453                                 }
 454                         }
 455                 }
 456         }
 457
 458         void OnWhois(Whois::Context& whois) CXX11_OVERRIDE
 459         {
 460                 if (!whois.IsSelfWhois() && !whois.GetSource()->HasPrivPermission("users/auspex"))
 461                         return;
 462
 463                 // If these fields are not set then the client is not using a gateway.
 464                 const std::string* realhost = cmd.realhost.get(whois.GetTarget());
 465                 const std::string* realip = cmd.realip.get(whois.GetTarget());
 466                 if (!realhost || !realip)
 467                         return;
 468
 469                 const std::string* gateway = cmd.gateway.get(whois.GetTarget());
 470                 if (gateway)
 471                         whois.SendLine(RPL_WHOISGATEWAY, *realhost, *realip, "is connected via the " + *gateway + " WebIRC gateway");
 472                 else
 473                         whois.SendLine(RPL_WHOISGATEWAY, *realhost, *realip, "is connected via an ident gateway");
 474         }
 475
 476         Version GetVersion() CXX11_OVERRIDE
 477         {
 478                 return Version("Enables forwarding the real IP address of a user from a gateway to the IRC server", VF_VENDOR);
 479         }
 480 };
 481
 482 MODULE_INIT(ModuleCgiIRC)