+
+ ModResult OnSetConnectClass(LocalUser* user, ConnectClass* myclass) CXX11_OVERRIDE
+ {
+ ssl_cert* cert = cmd.sslapi.GetCertificate(user);
+ bool ok = true;
+ if (myclass->config->getString("requiressl") == "trusted")
+ {
+ ok = (cert && cert->IsCAVerified());
+ ServerInstance->Logs->Log("CONNECTCLASS", LOG_DEBUG, "Class requires a trusted SSL cert. Client %s one.", (ok ? "has" : "does not have"));
+ }
+ else if (myclass->config->getBool("requiressl"))
+ {
+ ok = (cert != NULL);
+ ServerInstance->Logs->Log("CONNECTCLASS", LOG_DEBUG, "Class requires SSL. Client %s using SSL.", (ok ? "is" : "is not"));
+ }
+
+ if (!ok)
+ return MOD_RES_DENY;
+ return MOD_RES_PASSTHRU;
+ }
+
+ void OnWebIRCAuth(LocalUser* user, const WebIRC::FlagMap* flags) CXX11_OVERRIDE
+ {
+ // We are only interested in connection flags. If none have been
+ // given then we have nothing to do.
+ if (!flags)
+ return;
+
+ // We only care about the tls connection flag if the connection
+ // between the gateway and the server is secure.
+ if (!cmd.sslapi.GetCertificate(user))
+ return;
+
+ WebIRC::FlagMap::const_iterator iter = flags->find("secure");
+ if (iter == flags->end())
+ {
+ // If this is not set then the connection between the client and
+ // the gateway is not secure.
+ cmd.sslapi.nosslext.set(user, 1);
+ cmd.sslapi.sslext.unset(user);
+ return;
+ }
+
+ // Create a fake ssl_cert for the user.
+ ssl_cert* cert = new ssl_cert;
+ cert->error = "WebIRC users can not specify valid certs yet";
+ cert->invalid = true;
+ cert->revoked = true;
+ cert->trusted = false;
+ cert->unknownsigner = true;
+ cmd.sslapi.SetCertificate(user, cert);
+ }