- User* dest = static_cast<User*>(target);
- if (dest->GetExt(extname))
- return;
-
- ssl_cert* cert = new ssl_cert;
- dest->Extend(extname, cert);
-
- std::stringstream s(extdata);
- std::string v;
- getline(s,v,' ');
-
- cert->invalid = (v.find('v') != std::string::npos);
- cert->trusted = (v.find('T') != std::string::npos);
- cert->revoked = (v.find('R') != std::string::npos);
- cert->unknownsigner = (v.find('s') != std::string::npos);
- if (v.find('E') != std::string::npos)
- {
- getline(s,cert->error,'\n');
- }
- else
- {
- getline(s,cert->fingerprint,' ');
- getline(s,cert->dn,' ');
- getline(s,cert->issuer,'\n');
- }
+ OperInfo* ifo = i->second;
+ std::string fp = ifo->oper_block->getString("fingerprint");
+ if (MatchFP(cert, fp) && ifo->oper_block->getBool("autologin"))
+ user->Oper(ifo);
+ }
+ }
+
+ ModResult OnSetConnectClass(LocalUser* user, ConnectClass* myclass) CXX11_OVERRIDE
+ {
+ ssl_cert* cert = cmd.sslapi.GetCertificate(user);
+ const char* error = NULL;
+ const std::string requiressl = myclass->config->getString("requiressl");
+ if (stdalgo::string::equalsci(requiressl, "trusted"))
+ {
+ if (!cert || !cert->IsCAVerified())
+ error = "a trusted TLS (SSL) client certificate";
+ }
+ else if (myclass->config->getBool("requiressl"))
+ {
+ if (!cert)
+ error = "a TLS (SSL) connection";
+ }
+
+ if (error)
+ {
+ ServerInstance->Logs->Log("CONNECTCLASS", LOG_DEBUG, "The %s connect class is not suitable as it requires %s",
+ myclass->GetName().c_str(), error);
+ return MOD_RES_DENY;
+ }
+
+ return MOD_RES_PASSTHRU;
+ }
+
+ void OnWebIRCAuth(LocalUser* user, const WebIRC::FlagMap* flags) CXX11_OVERRIDE
+ {
+ // We are only interested in connection flags. If none have been
+ // given then we have nothing to do.
+ if (!flags)
+ return;
+
+ // We only care about the tls connection flag if the connection
+ // between the gateway and the server is secure.
+ if (!cmd.sslapi.GetCertificate(user))
+ return;
+
+ WebIRC::FlagMap::const_iterator iter = flags->find("secure");
+ if (iter == flags->end())
+ {
+ // If this is not set then the connection between the client and
+ // the gateway is not secure.
+ cmd.sslapi.nosslext.set(user, 1);
+ cmd.sslapi.sslext.unset(user);
+ return;