]> git.netwichtig.de Git - user/henk/code/inspircd.git/blob - src/modules/m_cgiirc.cpp
Only try to parse the WebIRC IP if the user matches a host.
[user/henk/code/inspircd.git] / src / modules / m_cgiirc.cpp
1 /*
2  * InspIRCd -- Internet Relay Chat Daemon
3  *
4  *   Copyright (C) 2009-2010 Daniel De Graaf <danieldg@inspircd.org>
5  *   Copyright (C) 2007-2008 John Brooks <john.brooks@dereferenced.net>
6  *   Copyright (C) 2008 Pippijn van Steenhoven <pip88nl@gmail.com>
7  *   Copyright (C) 2006-2008 Craig Edwards <craigedwards@brainbox.cc>
8  *   Copyright (C) 2007 Robin Burchell <robin+git@viroteck.net>
9  *   Copyright (C) 2007 Dennis Friis <peavey@inspircd.org>
10  *   Copyright (C) 2006 Oliver Lupton <oliverlupton@gmail.com>
11  *
12  * This file is part of InspIRCd.  InspIRCd is free software: you can
13  * redistribute it and/or modify it under the terms of the GNU General Public
14  * License as published by the Free Software Foundation, version 2.
15  *
16  * This program is distributed in the hope that it will be useful, but WITHOUT
17  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
18  * FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
19  * details.
20  *
21  * You should have received a copy of the GNU General Public License
22  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
23  */
24
25
26 #include "inspircd.h"
27 #include "modules/ssl.h"
28 #include "modules/webirc.h"
29 #include "modules/whois.h"
30
31 enum
32 {
33         // InspIRCd-specific.
34         RPL_WHOISGATEWAY = 350
35 };
36
37 // We need this method up here so that it can be accessed from anywhere
38 static void ChangeIP(LocalUser* user, const irc::sockets::sockaddrs& sa)
39 {
40         // Set the users IP address and make sure they are in the right clone pool.
41         ServerInstance->Users->RemoveCloneCounts(user);
42         user->SetClientIP(sa);
43         ServerInstance->Users->AddClone(user);
44         if (user->quitting)
45                 return;
46
47         // Recheck the connect class.
48         user->MyClass = NULL;
49         user->SetClass();
50         user->CheckClass();
51         if (user->quitting)
52                 return;
53
54         // Check if this user matches any XLines.
55         user->CheckLines(true);
56         if (user->quitting)
57                 return;
58 }
59
60 // Encapsulates information about an ident host.
61 class IdentHost
62 {
63  private:
64         std::string hostmask;
65         std::string newident;
66
67  public:
68         IdentHost(const std::string& mask, const std::string& ident)
69                 : hostmask(mask)
70                 , newident(ident)
71         {
72         }
73
74         const std::string& GetIdent() const
75         {
76                 return newident;
77         }
78
79         bool Matches(LocalUser* user) const
80         {
81                 if (!InspIRCd::Match(user->GetRealHost(), hostmask, ascii_case_insensitive_map))
82                         return false;
83
84                 return InspIRCd::MatchCIDR(user->GetIPString(), hostmask, ascii_case_insensitive_map);
85         }
86 };
87
88 // Encapsulates information about a WebIRC host.
89 class WebIRCHost
90 {
91  private:
92         std::string hostmask;
93         std::string fingerprint;
94         std::string password;
95         std::string passhash;
96
97  public:
98         WebIRCHost(const std::string& mask, const std::string& fp, const std::string& pass, const std::string& hash)
99                 : hostmask(mask)
100                 , fingerprint(fp)
101                 , password(pass)
102                 , passhash(hash)
103         {
104         }
105
106         bool Matches(LocalUser* user, const std::string& pass) const
107         {
108                 // Did the user send a valid password?
109                 if (!password.empty() && !ServerInstance->PassCompare(user, password, pass, passhash))
110                         return false;
111
112                 // Does the user have a valid fingerprint?
113                 const std::string fp = SSLClientCert::GetFingerprint(&user->eh);
114                 if (!fingerprint.empty() && fp != fingerprint)
115                         return false;
116
117                 // Does the user's hostname match our hostmask?
118                 if (InspIRCd::Match(user->GetRealHost(), hostmask, ascii_case_insensitive_map))
119                         return true;
120
121                 // Does the user's IP address match our hostmask?
122                 return InspIRCd::MatchCIDR(user->GetIPString(), hostmask, ascii_case_insensitive_map);
123         }
124 };
125
126 /*
127  * WEBIRC
128  *  This is used for the webirc method of CGIIRC auth, and is (really) the best way to do these things.
129  *  Syntax: WEBIRC password gateway hostname ip
130  *  Where password is a shared key, gateway is the name of the WebIRC gateway and version (e.g. cgiirc), hostname
131  *  is the resolved host of the client issuing the command and IP is the real IP of the client.
132  *
133  * How it works:
134  *  To tie in with the rest of cgiirc module, and to avoid race conditions, /webirc is only processed locally
135  *  and simply sets metadata on the user, which is later decoded on full connect to give something meaningful.
136  */
137 class CommandWebIRC : public SplitCommand
138 {
139  public:
140         std::vector<WebIRCHost> hosts;
141         bool notify;
142         StringExtItem gateway;
143         StringExtItem realhost;
144         StringExtItem realip;
145         Events::ModuleEventProvider webircevprov;
146
147         CommandWebIRC(Module* Creator)
148                 : SplitCommand(Creator, "WEBIRC", 4)
149                 , gateway("cgiirc_gateway", ExtensionItem::EXT_USER, Creator)
150                 , realhost("cgiirc_realhost", ExtensionItem::EXT_USER, Creator)
151                 , realip("cgiirc_realip", ExtensionItem::EXT_USER, Creator)
152                 , webircevprov(Creator, "event/webirc")
153         {
154                 allow_empty_last_param = false;
155                 works_before_reg = true;
156                 this->syntax = "<password> <gateway> <hostname> <ip> [flags]";
157         }
158
159         CmdResult HandleLocal(LocalUser* user, const Params& parameters) CXX11_OVERRIDE
160         {
161                 if (user->registered == REG_ALL || realhost.get(user))
162                         return CMD_FAILURE;
163
164                 for (std::vector<WebIRCHost>::const_iterator iter = hosts.begin(); iter != hosts.end(); ++iter)
165                 {
166                         // If we don't match the host then skip to the next host.
167                         if (!iter->Matches(user, parameters[0]))
168                                 continue;
169
170                         irc::sockets::sockaddrs ipaddr;
171                         if (!irc::sockets::aptosa(parameters[3], user->client_sa.port(), ipaddr))
172                         {
173                                 user->CommandFloodPenalty += 5000;
174                                 WriteLog("Connecting user %s (%s) tried to use WEBIRC but gave an invalid IP address.",
175                                         user->uuid.c_str(), user->GetIPString().c_str());
176                                 return CMD_FAILURE;
177                         }
178
179                         // The user matched a WebIRC block!
180                         gateway.set(user, parameters[1]);
181                         realhost.set(user, user->GetRealHost());
182                         realip.set(user, user->GetIPString());
183
184                         WriteLog("Connecting user %s is using a WebIRC gateway; changing their IP from %s to %s.",
185                                 user->uuid.c_str(), user->GetIPString().c_str(), parameters[3].c_str());
186
187                         // If we have custom flags then deal with them.
188                         WebIRC::FlagMap flags;
189                         const bool hasflags = (parameters.size() > 4);
190                         if (hasflags)
191                         {
192                                 // Parse the flags.
193                                 irc::spacesepstream flagstream(parameters[4]);
194                                 for (std::string flag; flagstream.GetToken(flag); )
195                                 {
196                                         // Does this flag have a value?
197                                         const size_t separator = flag.find('=');
198                                         if (separator == std::string::npos)
199                                         {
200                                                 flags[flag];
201                                                 continue;
202                                         }
203
204                                         // The flag has a value!
205                                         const std::string key = flag.substr(0, separator);
206                                         const std::string value = flag.substr(separator + 1);
207                                         flags[key] = value;
208                                 }
209                         }
210
211                         // Inform modules about the WebIRC attempt.
212                         FOREACH_MOD_CUSTOM(webircevprov, WebIRC::EventListener, OnWebIRCAuth, (user, (hasflags ? &flags : NULL)));
213
214                         // Set the IP address sent via WEBIRC. We ignore the hostname and lookup
215                         // instead do our own DNS lookups because of unreliable gateways.
216                         ChangeIP(user, ipaddr);
217                         return CMD_SUCCESS;
218                 }
219
220                 user->CommandFloodPenalty += 5000;
221                 WriteLog("Connecting user %s (%s) tried to use WEBIRC but didn't match any configured WebIRC hosts.",
222                         user->uuid.c_str(), user->GetIPString().c_str());
223                 return CMD_FAILURE;
224         }
225
226         void WriteLog(const char* message, ...) CUSTOM_PRINTF(2, 3)
227         {
228                 std::string buffer;
229                 VAFORMAT(buffer, message, message);
230
231                 // If we are sending a snotice then the message will already be
232                 // written to the logfile.
233                 if (notify)
234                         ServerInstance->SNO->WriteGlobalSno('w', buffer);
235                 else
236                         ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, buffer);
237         }
238 };
239
240 class ModuleCgiIRC
241         : public Module
242         , public WebIRC::EventListener
243         , public Whois::EventListener
244 {
245  private:
246         CommandWebIRC cmd;
247         std::vector<IdentHost> hosts;
248
249         static bool ParseIdent(LocalUser* user, irc::sockets::sockaddrs& out)
250         {
251                 const char* ident = NULL;
252                 if (user->ident.length() == 8)
253                 {
254                         // The ident is an IPv4 address encoded in hexadecimal with two characters
255                         // per address segment.
256                         ident = user->ident.c_str();
257                 }
258                 else if (user->ident.length() == 9 && user->ident[0] == '~')
259                 {
260                         // The same as above but m_ident got to this user before we did. Strip the
261                         // ident prefix and continue as normal.
262                         ident = user->ident.c_str() + 1;
263                 }
264                 else
265                 {
266                         // The user either does not have an IPv4 in their ident or the gateway server
267                         // is also running an identd. In the latter case there isn't really a lot we
268                         // can do so we just assume that the client in question is not connecting via
269                         // an ident gateway.
270                         return false;
271                 }
272
273                 // Try to convert the IP address to a string. If this fails then the user
274                 // does not have an IPv4 address in their ident.
275                 errno = 0;
276                 unsigned long address = strtoul(ident, NULL, 16);
277                 if (errno)
278                         return false;
279
280                 out.in4.sin_family = AF_INET;
281                 out.in4.sin_addr.s_addr = htonl(address);
282                 return true;
283         }
284
285  public:
286         ModuleCgiIRC()
287                 : WebIRC::EventListener(this)
288                 , Whois::EventListener(this)
289                 , cmd(this)
290         {
291         }
292
293         void init() CXX11_OVERRIDE
294         {
295                 ServerInstance->SNO->EnableSnomask('w', "CGIIRC");
296         }
297
298         void ReadConfig(ConfigStatus& status) CXX11_OVERRIDE
299         {
300                 std::vector<IdentHost> identhosts;
301                 std::vector<WebIRCHost> webirchosts;
302
303                 ConfigTagList tags = ServerInstance->Config->ConfTags("cgihost");
304                 for (ConfigIter i = tags.first; i != tags.second; ++i)
305                 {
306                         ConfigTag* tag = i->second;
307
308                         // Ensure that we have the <cgihost:mask> parameter.
309                         const std::string mask = tag->getString("mask");
310                         if (mask.empty())
311                                 throw ModuleException("<cgihost:mask> is a mandatory field, at " + tag->getTagLocation());
312
313                         // Determine what lookup type this host uses.
314                         const std::string type = tag->getString("type");
315                         if (stdalgo::string::equalsci(type, "ident"))
316                         {
317                                 // The IP address should be looked up from the hex IP address.
318                                 const std::string newident = tag->getString("newident", "gateway", ServerInstance->IsIdent);
319                                 identhosts.push_back(IdentHost(mask, newident));
320                         }
321                         else if (stdalgo::string::equalsci(type, "webirc"))
322                         {
323                                 // The IP address will be received via the WEBIRC command.
324                                 const std::string fingerprint = tag->getString("fingerprint");
325                                 const std::string password = tag->getString("password");
326
327                                 // WebIRC blocks require a password.
328                                 if (fingerprint.empty() && password.empty())
329                                         throw ModuleException("When using <cgihost type=\"webirc\"> either the fingerprint or password field is required, at " + tag->getTagLocation());
330
331                                 webirchosts.push_back(WebIRCHost(mask, fingerprint, password, tag->getString("hash")));
332                         }
333                         else
334                         {
335                                 throw ModuleException(type + " is an invalid <cgihost:mask> type, at " + tag->getTagLocation()); 
336                         }
337                 }
338
339                 // The host configuration was valid so we can apply it.
340                 hosts.swap(identhosts);
341                 cmd.hosts.swap(webirchosts);
342
343                 // Do we send an oper notice when a m_cgiirc client has their IP changed?
344                 cmd.notify = ServerInstance->Config->ConfValue("cgiirc")->getBool("opernotice", true);
345         }
346
347         ModResult OnSetConnectClass(LocalUser* user, ConnectClass* myclass) CXX11_OVERRIDE
348         {
349                 // If <connect:webirc> is not set then we have nothing to do.
350                 const std::string webirc = myclass->config->getString("webirc");
351                 if (webirc.empty())
352                         return MOD_RES_PASSTHRU;
353
354                 // If the user is not connecting via a WebIRC gateway then they
355                 // cannot match this connect class.
356                 const std::string* gateway = cmd.gateway.get(user);
357                 if (!gateway)
358                         return MOD_RES_DENY;
359
360                 // If the gateway matches the <connect:webirc> constraint then
361                 // allow the check to continue. Otherwise, reject it.
362                 return InspIRCd::Match(*gateway, webirc) ? MOD_RES_PASSTHRU : MOD_RES_DENY;
363         }
364
365         ModResult OnUserRegister(LocalUser* user) CXX11_OVERRIDE
366         {
367                 // There is no need to check for gateways if one is already being used.
368                 if (cmd.realhost.get(user))
369                         return MOD_RES_PASSTHRU;
370
371                 for (std::vector<IdentHost>::const_iterator iter = hosts.begin(); iter != hosts.end(); ++iter)
372                 {
373                         // If we don't match the host then skip to the next host.
374                         if (!iter->Matches(user))
375                                 continue;
376
377                         // We have matched an <cgihost> block! Try to parse the encoded IPv4 address
378                         // out of the ident.
379                         irc::sockets::sockaddrs address(user->client_sa);
380                         if (!ParseIdent(user, address))
381                                 return MOD_RES_PASSTHRU;
382
383                         // Store the hostname and IP of the gateway for later use.
384                         cmd.realhost.set(user, user->GetRealHost());
385                         cmd.realip.set(user, user->GetIPString());
386
387                         const std::string& newident = iter->GetIdent();
388                         cmd.WriteLog("Connecting user %s is using an ident gateway; changing their IP from %s to %s and their ident from %s to %s.",
389                                 user->uuid.c_str(), user->GetIPString().c_str(), address.addr().c_str(), user->ident.c_str(), newident.c_str());
390
391                         user->ChangeIdent(newident);
392                         ChangeIP(user, address);
393                         break; 
394                 }
395                 return MOD_RES_PASSTHRU;
396         }
397
398         void OnWebIRCAuth(LocalUser* user, const WebIRC::FlagMap* flags) CXX11_OVERRIDE
399         {
400                 // We are only interested in connection flags. If none have been
401                 // given then we have nothing to do.
402                 if (!flags)
403                         return;
404
405                 WebIRC::FlagMap::const_iterator cport = flags->find("remote-port");
406                 if (cport != flags->end())
407                 {
408                         // If we can't parse the port then just give up.
409                         uint16_t port = ConvToNum<uint16_t>(cport->second);
410                         if (port)
411                         {
412                                 switch (user->client_sa.family())
413                                 {
414                                         case AF_INET:
415                                                 user->client_sa.in4.sin_port = htons(port);
416                                                 break;
417
418                                         case AF_INET6:
419                                                 user->client_sa.in6.sin6_port = htons(port);
420                                                 break;
421
422                                         default:
423                                                 // If we have reached this point then we have encountered a bug.
424                                                 ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "BUG: OnWebIRCAuth(%s): socket type %d is unknown!",
425                                                         user->uuid.c_str(), user->client_sa.family());
426                                                 return;
427                                 }
428                         }
429                 }
430
431                 WebIRC::FlagMap::const_iterator sport = flags->find("local-port");
432                 if (sport != flags->end())
433                 {
434                         // If we can't parse the port then just give up.
435                         uint16_t port = ConvToNum<uint16_t>(sport->second);
436                         if (port)
437                         {
438                                 switch (user->server_sa.family())
439                                 {
440                                         case AF_INET:
441                                                 user->server_sa.in4.sin_port = htons(port);
442                                                 break;
443
444                                         case AF_INET6:
445                                                 user->server_sa.in6.sin6_port = htons(port);
446                                                 break;
447
448                                         default:
449                                                 // If we have reached this point then we have encountered a bug.
450                                                 ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "BUG: OnWebIRCAuth(%s): socket type %d is unknown!",
451                                                         user->uuid.c_str(), user->server_sa.family());
452                                                 return;
453                                 }
454                         }
455                 }
456         }
457
458         void OnWhois(Whois::Context& whois) CXX11_OVERRIDE
459         {
460                 if (!whois.IsSelfWhois() && !whois.GetSource()->HasPrivPermission("users/auspex"))
461                         return;
462
463                 // If these fields are not set then the client is not using a gateway.
464                 const std::string* realhost = cmd.realhost.get(whois.GetTarget());
465                 const std::string* realip = cmd.realip.get(whois.GetTarget());
466                 if (!realhost || !realip)
467                         return;
468
469                 const std::string* gateway = cmd.gateway.get(whois.GetTarget());
470                 if (gateway)
471                         whois.SendLine(RPL_WHOISGATEWAY, *realhost, *realip, "is connected via the " + *gateway + " WebIRC gateway");
472                 else
473                         whois.SendLine(RPL_WHOISGATEWAY, *realhost, *realip, "is connected via an ident gateway");
474         }
475
476         Version GetVersion() CXX11_OVERRIDE
477         {
478                 return Version("Enables forwarding the real IP address of a user from a gateway to the IRC server", VF_VENDOR);
479         }
480 };
481
482 MODULE_INIT(ModuleCgiIRC)