Various improvements to UNIX socket support.

[user/henk/code/inspircd.git] / src / modules / m_cgiirc.cpp

diff --git a/src/modules/m_cgiirc.cpp b/src/modules/m_cgiirc.cpp
index 4d0edcb23e1ed7a6a41a70284bfd7b6e65b39b69..d80719c1725b6ad03f44d05d8921a6cb9f91ccc1 100644 (file)
--- a/src/modules/m_cgiirc.cpp
+++ b/src/modules/m_cgiirc.cpp
@@ -34,29 +34,6 @@ enum
        RPL_WHOISGATEWAY = 350
 };
 
-// We need this method up here so that it can be accessed from anywhere
-static void ChangeIP(LocalUser* user, const irc::sockets::sockaddrs& sa)
-{
-       // Set the users IP address and make sure they are in the right clone pool.
-       ServerInstance->Users->RemoveCloneCounts(user);
-       user->SetClientIP(sa);
-       ServerInstance->Users->AddClone(user);
-       if (user->quitting)
-               return;
-
-       // Recheck the connect class.
-       user->MyClass = NULL;
-       user->SetClass();
-       user->CheckClass();
-       if (user->quitting)
-               return;
-
-       // Check if this user matches any XLines.
-       user->CheckLines(true);
-       if (user->quitting)
-               return;
-}
-
 // Encapsulates information about an ident host.
 class IdentHost
 {
@@ -103,15 +80,15 @@ class WebIRCHost
        {
        }
 
-       bool Matches(LocalUser* user, const std::string& pass) const
+       bool Matches(LocalUser* user, const std::string& pass, UserCertificateAPI& sslapi) const
        {
                // Did the user send a valid password?
                if (!password.empty() && !ServerInstance->PassCompare(user, password, pass, passhash))
                        return false;
 
                // Does the user have a valid fingerprint?
-               const std::string fp = SSLClientCert::GetFingerprint(&user->eh);
-               if (!fingerprint.empty() && fp != fingerprint)
+               const std::string fp = sslapi ? sslapi->GetFingerprint(user) : "";
+               if (!fingerprint.empty() && !InspIRCd::TimingSafeCompare(fp, fingerprint))
                        return false;
 
                // Does the user's hostname match our hostmask?
@@ -142,6 +119,7 @@ class CommandWebIRC : public SplitCommand
        StringExtItem gateway;
        StringExtItem realhost;
        StringExtItem realip;
+       UserCertificateAPI sslapi;
        Events::ModuleEventProvider webircevprov;
 
        CommandWebIRC(Module* Creator)
@@ -149,11 +127,12 @@ class CommandWebIRC : public SplitCommand
                , gateway("cgiirc_gateway", ExtensionItem::EXT_USER, Creator)
                , realhost("cgiirc_realhost", ExtensionItem::EXT_USER, Creator)
                , realip("cgiirc_realip", ExtensionItem::EXT_USER, Creator)
+               , sslapi(Creator)
                , webircevprov(Creator, "event/webirc")
        {
                allow_empty_last_param = false;
                works_before_reg = true;
-               this->syntax = "<password> <gateway> <hostname> <ip> [flags]";
+               this->syntax = "<password> <gateway> <hostname> <ip> [<flags>]";
        }
 
        CmdResult HandleLocal(LocalUser* user, const Params& parameters) CXX11_OVERRIDE
@@ -164,15 +143,15 @@ class CommandWebIRC : public SplitCommand
                for (std::vector<WebIRCHost>::const_iterator iter = hosts.begin(); iter != hosts.end(); ++iter)
                {
                        // If we don't match the host then skip to the next host.
-                       if (!iter->Matches(user, parameters[0]))
+                       if (!iter->Matches(user, parameters[0], sslapi))
                                continue;
 
                        irc::sockets::sockaddrs ipaddr;
                        if (!irc::sockets::aptosa(parameters[3], user->client_sa.port(), ipaddr))
                        {
-                               user->CommandFloodPenalty += 5000;
                                WriteLog("Connecting user %s (%s) tried to use WEBIRC but gave an invalid IP address.",
                                        user->uuid.c_str(), user->GetIPString().c_str());
+                               ServerInstance->Users->QuitUser(user, "WEBIRC: IP address is invalid: " + parameters[3]);
                                return CMD_FAILURE;
                        }
 
@@ -213,13 +192,13 @@ class CommandWebIRC : public SplitCommand
 
                        // Set the IP address sent via WEBIRC. We ignore the hostname and lookup
                        // instead do our own DNS lookups because of unreliable gateways.
-                       ChangeIP(user, ipaddr);
+                       user->SetClientIP(ipaddr);
                        return CMD_SUCCESS;
                }
 
-               user->CommandFloodPenalty += 5000;
                WriteLog("Connecting user %s (%s) tried to use WEBIRC but didn't match any configured WebIRC hosts.",
                        user->uuid.c_str(), user->GetIPString().c_str());
+               ServerInstance->Users->QuitUser(user, "WEBIRC: you don't match any configured WebIRC hosts.");
                return CMD_FAILURE;
        }
 
@@ -332,7 +311,7 @@ class ModuleCgiIRC
                        }
                        else
                        {
-                               throw ModuleException(type + " is an invalid <cgihost:mask> type, at " + tag->getTagLocation()); 
+                               throw ModuleException(type + " is an invalid <cgihost:mask> type, at " + tag->getTagLocation());
                        }
                }
 
@@ -389,8 +368,8 @@ class ModuleCgiIRC
                                user->uuid.c_str(), user->GetIPString().c_str(), address.addr().c_str(), user->ident.c_str(), newident.c_str());
 
                        user->ChangeIdent(newident);
-                       ChangeIP(user, address);
-                       break; 
+                       user->SetClientIP(address);
+                       break;
                }
                return MOD_RES_PASSTHRU;
        }