]> git.netwichtig.de Git - user/henk/code/inspircd.git/blobdiff - src/modules/m_cloaking.cpp
Merge branch 'insp20' into master.
[user/henk/code/inspircd.git] / src / modules / m_cloaking.cpp
index d7992301cfa26390af033eec29a1a417d6974291..5152442311b3127f641c10ffa1ffd2a86f701a63 100644 (file)
@@ -1 +1,418 @@
-/*       +------------------------------------+\r *       | Inspire Internet Relay Chat Daemon |\r *       +------------------------------------+\r *\r *  InspIRCd: (C) 2002-2007 InspIRCd Development Team\r * See: http://www.inspircd.org/wiki/index.php/Credits\r *\r * This program is free but copyrighted software; see\r *            the file COPYING for details.\r *\r * ---------------------------------------------------\r */\r\r#include "inspircd.h"\r#include "users.h"\r#include "channels.h"\r#include "modules.h"\r#include "m_hash.h"\r\r/* $ModDesc: Provides masking of user hostnames */\r/* $ModDep: m_hash.h */\r\r/* Used to vary the output a little more depending on the cloak keys */\rstatic const char* xtab[] = {"F92E45D871BCA630", "A1B9D80C72E653F4", "1ABC078934DEF562", "ABCDEF5678901234"};\r\r/** Handles user mode +x\r */\rclass CloakUser : public ModeHandler\r{\r   \r       std::string prefix;\r    unsigned int key1;\r     unsigned int key2;\r     unsigned int key3;\r     unsigned int key4;\r     Module* Sender;\r        Module* HashProvider;\r\r /** This function takes a domain name string and returns just the last two domain parts,\r        * or the last domain part if only two are available. Failing that it just returns what it was given.\r   *\r      * For example, if it is passed "svn.inspircd.org" it will return ".inspircd.org".\r      * If it is passed "brainbox.winbot.co.uk" it will return ".co.uk",\r     * and if it is passed "localhost.localdomain" it will return ".localdomain".\r   * \r     * This is used to ensure a significant part of the host is always cloaked (see Bug #216)\r       */\r    std::string LastTwoDomainParts(const std::string &host)\r        {\r              int dots = 0;\r          std::string::size_type splitdot = host.length();\r\r              for (std::string::size_type x = host.length() - 1; x; --x)\r             {\r                      if (host[x] == '.')\r                    {\r                              splitdot = x;\r                          dots++;\r                        }\r                      if (dots >= 3)\r                         break;\r         }\r\r             if (splitdot == host.length())\r                 return host;\r           else\r                   return host.substr(splitdot);\r  }\r      \r public:\r      CloakUser(InspIRCd* Instance, Module* Source, Module* Hash) : ModeHandler(Instance, 'x', 0, 0, false, MODETYPE_USER, false), Sender(Source), HashProvider(Hash)\r        {\r      }\r\r     ModeAction OnModeChange(userrec* source, userrec* dest, chanrec* channel, std::string &parameter, bool adding)\r {\r              if (source != dest)\r                    return MODEACTION_DENY;\r\r               /* For remote clients, we dont take any action, we just allow it.\r               * The local server where they are will set their cloak instead.\r                */\r            if (!IS_LOCAL(dest))\r                   return MODEACTION_ALLOW;\r\r              if (adding)\r            {\r                      if(!dest->IsModeSet('x'))\r                      {\r                              /* The mode is being turned on - so attempt to\r                          * allocate the user a cloaked host using a non-reversible\r                              * algorithm (its simple, but its non-reversible so the\r                                 * simplicity doesnt really matter). This algorithm\r                             * will not work if the user has only one level of domain\r                               * naming in their hostname (e.g. if they are on a lan or\r                               * are connecting via localhost) -- this doesnt matter much.\r                            */\r\r                           char* n1 = strchr(dest->host,'.');\r                             char* n2 = strchr(dest->host,':');\r                     \r                               if (n1 || n2)\r                          {\r                                      /* InspIRCd users have two hostnames; A displayed\r                                       * hostname which can be modified by modules (e.g.\r                                      * to create vhosts, implement chghost, etc) and a\r                                      * 'real' hostname which you shouldnt write to.\r                                         */\r\r                                   unsigned int iv[] = { key1, key2, key3, key4 };\r                                        std::string a = LastTwoDomainParts(dest->host);\r                                        std::string b;\r\r                                        /** Reset the Hash module, and send it our IV and hex table */\r                                 HashResetRequest(Sender, HashProvider).Send();\r                                 HashKeyRequest(Sender, HashProvider, iv).Send();\r                                       HashHexRequest(Sender, HashProvider, xtab[(*dest->host) % 4]);\r\r                                        /* Generate a cloak using specialized Hash */\r                                  std::string hostcloak = prefix + "-" + std::string(HashSumRequest(Sender, HashProvider, dest->host).Send()).substr(0,8) + a;\r\r                                  /* Fix by brain - if the cloaked host is > the max length of a host (64 bytes\r                                   * according to the DNS RFC) then tough titty, they get cloaked as an IP. \r                                      * Their ISP shouldnt go to town on subdomains, or they shouldnt have a kiddie\r                                  * vhost.\r                                       */\r#ifdef IPV6\r                                        in6_addr testaddr;\r                                     in_addr testaddr2;\r                                     if ((dest->GetProtocolFamily() == AF_INET6) && (inet_pton(AF_INET6,dest->host,&testaddr) < 1) && (hostcloak.length() <= 64))\r                                           /* Invalid ipv6 address, and ipv6 user (resolved host) */\r                                              b = hostcloak;\r                                 else if ((dest->GetProtocolFamily() == AF_INET) && (inet_aton(dest->host,&testaddr2) < 1) && (hostcloak.length() <= 64))\r                                               /* Invalid ipv4 address, and ipv4 user (resolved host) */\r                                              b = hostcloak;\r                                 else\r                                           /* Valid ipv6 or ipv4 address (not resolved) ipv4 or ipv6 user */\r                                              b = ((!strchr(dest->host,':')) ? Cloak4(dest->host) : Cloak6(dest->host));\r#else\r                                       in_addr testaddr;\r                                      if ((inet_aton(dest->host,&testaddr) < 1) && (hostcloak.length() <= 64))\r                                               /* Invalid ipv4 address, and ipv4 user (resolved host) */\r                                              b = hostcloak;\r                                 else\r                                           /* Valid ipv4 address (not resolved) ipv4 user */\r                                              b = Cloak4(dest->host);\r#endif\r\r                                        dest->ChangeDisplayedHost(b.c_str());\r                          }\r                              \r                               dest->SetMode('x',true);\r                               return MODEACTION_ALLOW;\r                       }\r              }\r              else\r           {\r                      if (dest->IsModeSet('x'))\r                      {\r                              /* User is removing the mode, so just restore their real host\r                                   * and make it match the displayed one.\r                                 */\r                            dest->ChangeDisplayedHost(dest->host);\r                         dest->SetMode('x',false);\r                              return MODEACTION_ALLOW;\r                       }\r              }\r\r             return MODEACTION_DENY;\r        }\r\r     std::string Cloak4(const char* ip)\r     {\r              unsigned int iv[] = { key1, key2, key3, key4 };\r                irc::sepstream seps(ip, '.');\r          std::string ra[4];;\r            std::string octet[4];\r          int i[4];\r\r             for (int j = 0; j < 4; j++)\r            {\r                      octet[j] = seps.GetToken();\r                    i[j] = atoi(octet[j].c_str());\r         }\r\r             octet[3] = octet[0] + "." + octet[1] + "." + octet[2] + "." + octet[3];\r                octet[2] = octet[0] + "." + octet[1] + "." + octet[2];\r         octet[1] = octet[0] + "." + octet[1];\r\r         /* Reset the Hash module and send it our IV */\r         HashResetRequest(Sender, HashProvider).Send();\r         HashKeyRequest(Sender, HashProvider, iv).Send();\r\r              /* Send the Hash module a different hex table for each octet group's Hash sum */\r               for (int k = 0; k < 4; k++)\r            {\r                      HashHexRequest(Sender, HashProvider, xtab[(iv[k]+i[k]) % 4]).Send();\r                   ra[k] = std::string(HashSumRequest(Sender, HashProvider, octet[k]).Send()).substr(0,6);\r                }\r              /* Stick them all together */\r          return std::string().append(ra[0]).append(".").append(ra[1]).append(".").append(ra[2]).append(".").append(ra[3]);\r      }\r\r     std::string Cloak6(const char* ip)\r     {\r              /* Theyre using 4in6 (YUCK). Translate as ipv4 cloak */\r                if (!strncmp(ip, "0::ffff:", 8))\r                       return Cloak4(ip + 8);\r\r                /* If we get here, yes it really is an ipv6 ip */\r              unsigned int iv[] = { key1, key2, key3, key4 };\r                std::vector<std::string> hashies;\r              std::string item;\r              int rounds = 0;\r\r               /* Reset the Hash module and send it our IV */\r         HashResetRequest(Sender, HashProvider).Send();\r         HashKeyRequest(Sender, HashProvider, iv).Send();\r\r              for (const char* input = ip; *input; input++)\r          {\r                      item += *input;\r                        if (item.length() > 7)\r                 {\r                              /* Send the Hash module a different hex table for each octet group's Hash sum */\r                               HashHexRequest(Sender, HashProvider, xtab[(key1+rounds) % 4]).Send();\r                          hashies.push_back(std::string(HashSumRequest(Sender, HashProvider, item).Send()).substr(0,8));\r                         item.clear();\r                  }\r                      rounds++;\r              }\r              if (!item.empty())\r             {\r                      /* Send the Hash module a different hex table for each octet group's Hash sum */\r                       HashHexRequest(Sender, HashProvider, xtab[(key1+rounds) % 4]).Send();\r                  hashies.push_back(std::string(HashSumRequest(Sender, HashProvider, item).Send()).substr(0,8));\r                 item.clear();\r          }\r              /* Stick them all together */\r          return irc::stringjoiner(":", hashies, 0, hashies.size() - 1).GetJoined();\r     }\r      \r       void DoRehash()\r        {\r              ConfigReader Conf(ServerInstance);\r             key1 = key2 = key3 = key4 = 0;\r         key1 = Conf.ReadInteger("cloak","key1",0,true);\r                key2 = Conf.ReadInteger("cloak","key2",0,true);\r                key3 = Conf.ReadInteger("cloak","key3",0,true);\r                key4 = Conf.ReadInteger("cloak","key4",0,true);\r                prefix = Conf.ReadValue("cloak","prefix",0);\r\r          if (prefix.empty())\r                    prefix = ServerInstance->Config->Network;\r\r             if (!key1 && !key2 && !key3 && !key4)\r                  throw ModuleException("You have not defined cloak keys for m_cloaking!!! THIS IS INSECURE AND SHOULD BE CHECKED!");\r    }\r};\r\r\rclass ModuleCloaking : public Module\r{\r private:\r        \r       CloakUser* cu;\r Module* HashModule;\r\r public:\r  ModuleCloaking(InspIRCd* Me)\r           : Module(Me)\r   {\r              ServerInstance->UseInterface("HashRequest");\r\r          /* Attempt to locate the md5 service provider, bail if we can't find it */\r             HashModule = ServerInstance->FindModule("m_md5.so");\r           if (!HashModule)\r                       throw ModuleException("Can't find m_md5.so. Please load m_md5.so before m_cloaking.so.");\r\r             /* Create new mode handler object */\r           cu = new CloakUser(ServerInstance, this, HashModule);\r\r         /* Register it with the core */         \r               if (!ServerInstance->AddMode(cu, 'x'))\r                 throw ModuleException("Could not add new modes!");\r\r            OnRehash(NULL,"");\r     }\r      \r       virtual ~ModuleCloaking()\r      {\r              ServerInstance->Modes->DelMode(cu);\r            DELETE(cu);\r            ServerInstance->DoneWithInterface("HashRequest");\r      }\r      \r       virtual Version GetVersion()\r   {\r              // returns the version number of the module to be\r              // listed in /MODULES\r          return Version(1,1,0,2,VF_COMMON|VF_VENDOR,API_VERSION);\r       }\r\r     virtual void OnRehash(userrec* user, const std::string &parameter)\r     {\r              cu->DoRehash();\r        }\r\r     void Implements(char* List)\r    {\r              List[I_OnRehash] = 1;\r  }\r};\r\rMODULE_INIT(ModuleCloaking)\r
\ No newline at end of file
+/*
+ * InspIRCd -- Internet Relay Chat Daemon
+ *
+ *   Copyright (C) 2009-2010 Daniel De Graaf <danieldg@inspircd.org>
+ *   Copyright (C) 2006-2008 Robin Burchell <robin+git@viroteck.net>
+ *   Copyright (C) 2008 Pippijn van Steenhoven <pip88nl@gmail.com>
+ *   Copyright (C) 2003-2008 Craig Edwards <craigedwards@brainbox.cc>
+ *   Copyright (C) 2007 John Brooks <john.brooks@dereferenced.net>
+ *   Copyright (C) 2007 Dennis Friis <peavey@inspircd.org>
+ *   Copyright (C) 2006 Oliver Lupton <oliverlupton@gmail.com>
+ *
+ * This file is part of InspIRCd.  InspIRCd is free software: you can
+ * redistribute it and/or modify it under the terms of the GNU General Public
+ * License as published by the Free Software Foundation, version 2.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+
+#include "inspircd.h"
+#include "modules/hash.h"
+
+enum CloakMode
+{
+       /** 2.0 cloak of "half" of the hostname plus the full IP hash */
+       MODE_HALF_CLOAK,
+       /** 2.0 cloak of IP hash, split at 2 common CIDR range points */
+       MODE_OPAQUE
+};
+
+// lowercase-only encoding similar to base64, used for hash output
+static const char base32[] = "0123456789abcdefghijklmnopqrstuv";
+
+/** Handles user mode +x
+ */
+class CloakUser : public ModeHandler
+{
+ public:
+       bool active;
+       LocalStringExt ext;
+       std::string debounce_uid;
+       time_t debounce_ts;
+       int debounce_count;
+
+       CloakUser(Module* source)
+               : ModeHandler(source, "cloak", 'x', PARAM_NONE, MODETYPE_USER)
+               , active(false)
+               , ext("cloaked_host", ExtensionItem::EXT_USER, source)
+               , debounce_ts(0)
+               , debounce_count(0)
+       {
+       }
+
+       ModeAction OnModeChange(User* source, User* dest, Channel* channel, std::string& parameter, bool adding) CXX11_OVERRIDE
+       {
+               LocalUser* user = IS_LOCAL(dest);
+
+               /* For remote clients, we don't take any action, we just allow it.
+                * The local server where they are will set their cloak instead.
+                * This is fine, as we will receive it later.
+                */
+               if (!user)
+               {
+                       // Remote setters broadcast mode before host while local setters do the opposite, so this takes that into account
+                       active = IS_LOCAL(source) ? adding : !adding;
+                       dest->SetMode(this, adding);
+                       return MODEACTION_ALLOW;
+               }
+
+               if (user->uuid == debounce_uid && debounce_ts == ServerInstance->Time())
+               {
+                       // prevent spamming using /mode user +x-x+x-x+x-x
+                       if (++debounce_count > 2)
+                               return MODEACTION_DENY;
+               }
+               else
+               {
+                       debounce_uid = user->uuid;
+                       debounce_count = 1;
+                       debounce_ts = ServerInstance->Time();
+               }
+
+               if (adding == user->IsModeSet(this))
+                       return MODEACTION_DENY;
+
+               /* don't allow this user to spam modechanges */
+               if (source == dest)
+                       user->CommandFloodPenalty += 5000;
+
+               if (adding)
+               {
+                       // assume this is more correct
+                       if (user->registered != REG_ALL && user->GetRealHost() != user->GetDisplayedHost())
+                               return MODEACTION_DENY;
+
+                       std::string* cloak = ext.get(user);
+
+                       if (!cloak)
+                       {
+                               /* Force creation of missing cloak */
+                               creator->OnUserConnect(user);
+                               cloak = ext.get(user);
+                       }
+                       if (cloak)
+                       {
+                               user->ChangeDisplayedHost(*cloak);
+                               user->SetMode(this, true);
+                               return MODEACTION_ALLOW;
+                       }
+                       else
+                               return MODEACTION_DENY;
+               }
+               else
+               {
+                       /* User is removing the mode, so restore their real host
+                        * and make it match the displayed one.
+                        */
+                       user->SetMode(this, false);
+                       user->ChangeDisplayedHost(user->GetRealHost().c_str());
+                       return MODEACTION_ALLOW;
+               }
+       }
+};
+
+class CommandCloak : public Command
+{
+ public:
+       CommandCloak(Module* Creator) : Command(Creator, "CLOAK", 1)
+       {
+               flags_needed = 'o';
+               syntax = "<host>";
+       }
+
+       CmdResult Handle(const std::vector<std::string>& parameters, User* user) CXX11_OVERRIDE;
+};
+
+class ModuleCloaking : public Module
+{
+ public:
+       CloakUser cu;
+       CloakMode mode;
+       CommandCloak ck;
+       std::string prefix;
+       std::string suffix;
+       std::string key;
+       unsigned int domainparts;
+       dynamic_reference<HashProvider> Hash;
+
+       ModuleCloaking()
+               : cu(this)
+               , mode(MODE_OPAQUE)
+               , ck(this)
+               , Hash(this, "hash/md5")
+       {
+       }
+
+       /** This function takes a domain name string and returns just the last two domain parts,
+        * or the last domain part if only two are available. Failing that it just returns what it was given.
+        *
+        * For example, if it is passed "svn.inspircd.org" it will return ".inspircd.org".
+        * If it is passed "brainbox.winbot.co.uk" it will return ".co.uk",
+        * and if it is passed "localhost.localdomain" it will return ".localdomain".
+        *
+        * This is used to ensure a significant part of the host is always cloaked (see Bug #216)
+        */
+       std::string LastTwoDomainParts(const std::string &host)
+       {
+               unsigned int dots = 0;
+               std::string::size_type splitdot = host.length();
+
+               for (std::string::size_type x = host.length() - 1; x; --x)
+               {
+                       if (host[x] == '.')
+                       {
+                               splitdot = x;
+                               dots++;
+                       }
+                       if (dots >= domainparts)
+                               break;
+               }
+
+               if (splitdot == host.length())
+                       return "";
+               else
+                       return host.substr(splitdot);
+       }
+
+       /**
+        * 2.0-style cloaking function
+        * @param item The item to cloak (part of an IP or hostname)
+        * @param id A unique ID for this type of item (to make it unique if the item matches)
+        * @param len The length of the output. Maximum for MD5 is 16 characters.
+        */
+       std::string SegmentCloak(const std::string& item, char id, size_t len)
+       {
+               std::string input;
+               input.reserve(key.length() + 3 + item.length());
+               input.append(1, id);
+               input.append(key);
+               input.append(1, '\0'); // null does not terminate a C++ string
+               input.append(item);
+
+               std::string rv = Hash->GenerateRaw(input).substr(0,len);
+               for(size_t i = 0; i < len; i++)
+               {
+                       // this discards 3 bits per byte. We have an
+                       // overabundance of bits in the hash output, doesn't
+                       // matter which ones we are discarding.
+                       rv[i] = base32[rv[i] & 0x1F];
+               }
+               return rv;
+       }
+
+       std::string SegmentIP(const irc::sockets::sockaddrs& ip, bool full)
+       {
+               std::string bindata;
+               size_t hop1, hop2, hop3;
+               size_t len1, len2;
+               std::string rv;
+               if (ip.sa.sa_family == AF_INET6)
+               {
+                       bindata = std::string((const char*)ip.in6.sin6_addr.s6_addr, 16);
+                       hop1 = 8;
+                       hop2 = 6;
+                       hop3 = 4;
+                       len1 = 6;
+                       len2 = 4;
+                       // pfx s1.s2.s3. (xxxx.xxxx or s4) sfx
+                       //     6  4  4    9/6
+                       rv.reserve(prefix.length() + 26 + suffix.length());
+               }
+               else
+               {
+                       bindata = std::string((const char*)&ip.in4.sin_addr, 4);
+                       hop1 = 3;
+                       hop2 = 0;
+                       hop3 = 2;
+                       len1 = len2 = 3;
+                       // pfx s1.s2. (xxx.xxx or s3) sfx
+                       rv.reserve(prefix.length() + 15 + suffix.length());
+               }
+
+               rv.append(prefix);
+               rv.append(SegmentCloak(bindata, 10, len1));
+               rv.append(1, '.');
+               bindata.erase(hop1);
+               rv.append(SegmentCloak(bindata, 11, len2));
+               if (hop2)
+               {
+                       rv.append(1, '.');
+                       bindata.erase(hop2);
+                       rv.append(SegmentCloak(bindata, 12, len2));
+               }
+
+               if (full)
+               {
+                       rv.append(1, '.');
+                       bindata.erase(hop3);
+                       rv.append(SegmentCloak(bindata, 13, 6));
+                       rv.append(suffix);
+               }
+               else
+               {
+                       if (ip.sa.sa_family == AF_INET6)
+                       {
+                               rv.append(InspIRCd::Format(".%02x%02x.%02x%02x%s",
+                                       ip.in6.sin6_addr.s6_addr[2], ip.in6.sin6_addr.s6_addr[3],
+                                       ip.in6.sin6_addr.s6_addr[0], ip.in6.sin6_addr.s6_addr[1], suffix.c_str()));
+                       }
+                       else
+                       {
+                               const unsigned char* ip4 = (const unsigned char*)&ip.in4.sin_addr;
+                               rv.append(InspIRCd::Format(".%d.%d%s", ip4[1], ip4[0], suffix.c_str()));
+                       }
+               }
+               return rv;
+       }
+
+       ModResult OnCheckBan(User* user, Channel* chan, const std::string& mask) CXX11_OVERRIDE
+       {
+               LocalUser* lu = IS_LOCAL(user);
+               if (!lu)
+                       return MOD_RES_PASSTHRU;
+
+               OnUserConnect(lu);
+               std::string* cloak = cu.ext.get(user);
+               /* Check if they have a cloaked host, but are not using it */
+               if (cloak && *cloak != user->GetDisplayedHost())
+               {
+                       const std::string cloakMask = user->nick + "!" + user->ident + "@" + *cloak;
+                       if (InspIRCd::Match(cloakMask, mask))
+                               return MOD_RES_DENY;
+               }
+               return MOD_RES_PASSTHRU;
+       }
+
+       void Prioritize() CXX11_OVERRIDE
+       {
+               /* Needs to be after m_banexception etc. */
+               ServerInstance->Modules->SetPriority(this, I_OnCheckBan, PRIORITY_LAST);
+       }
+
+       // this unsets umode +x on every host change. If we are actually doing a +x
+       // mode change, we will call SetMode back to true AFTER the host change is done.
+       void OnChangeHost(User* u, const std::string& host) CXX11_OVERRIDE
+       {
+               if (u->IsModeSet(cu) && !cu.active)
+               {
+                       u->SetMode(cu, false);
+                       u->WriteCommand("MODE", "-" + ConvToStr(cu.GetModeChar()));
+               }
+               cu.active = false;
+       }
+
+       Version GetVersion() CXX11_OVERRIDE
+       {
+               std::string testcloak = "broken";
+               if (Hash)
+               {
+                       switch (mode)
+                       {
+                               case MODE_HALF_CLOAK:
+                                       // Use old cloaking verification to stay compatible with 2.0
+                                       // But verify domainparts when use 3.0-only features
+                                       if (domainparts == 3)
+                                               testcloak = prefix + SegmentCloak("*", 3, 8) + suffix;
+                                       else
+                                       {
+                                               irc::sockets::sockaddrs sa;
+                                               testcloak = GenCloak(sa, "", testcloak + ConvToStr(domainparts));
+                                       }
+                                       break;
+                               case MODE_OPAQUE:
+                                       testcloak = prefix + SegmentCloak("*", 4, 8) + suffix;
+                       }
+               }
+               return Version("Provides masking of user hostnames", VF_COMMON|VF_VENDOR, testcloak);
+       }
+
+       void ReadConfig(ConfigStatus& status) CXX11_OVERRIDE
+       {
+               ConfigTag* tag = ServerInstance->Config->ConfValue("cloak");
+               prefix = tag->getString("prefix");
+               suffix = tag->getString("suffix", ".IP");
+
+               std::string modestr = tag->getString("mode");
+               if (modestr == "half")
+               {
+                       mode = MODE_HALF_CLOAK;
+                       domainparts = tag->getUInt("domainparts", 3, 1, 10);
+               }
+               else if (modestr == "full")
+                       mode = MODE_OPAQUE;
+               else
+                       throw ModuleException("Bad value for <cloak:mode>; must be half or full");
+
+               key = tag->getString("key");
+               if (key.empty() || key == "secret")
+                       throw ModuleException("You have not defined cloak keys for m_cloaking. Define <cloak:key> as a network-wide secret.");
+       }
+
+       std::string GenCloak(const irc::sockets::sockaddrs& ip, const std::string& ipstr, const std::string& host)
+       {
+               std::string chost;
+
+               irc::sockets::sockaddrs hostip;
+               bool host_is_ip = irc::sockets::aptosa(host, ip.port(), hostip) && hostip == ip;
+
+               switch (mode)
+               {
+                       case MODE_HALF_CLOAK:
+                       {
+                               if (!host_is_ip)
+                                       chost = prefix + SegmentCloak(host, 1, 6) + LastTwoDomainParts(host);
+                               if (chost.empty() || chost.length() > 50)
+                                       chost = SegmentIP(ip, false);
+                               break;
+                       }
+                       case MODE_OPAQUE:
+                       default:
+                               chost = SegmentIP(ip, true);
+               }
+               return chost;
+       }
+
+       void OnUserConnect(LocalUser* dest) CXX11_OVERRIDE
+       {
+               std::string* cloak = cu.ext.get(dest);
+               if (cloak)
+                       return;
+
+               cu.ext.set(dest, GenCloak(dest->client_sa, dest->GetIPString(), dest->GetRealHost()));
+       }
+};
+
+CmdResult CommandCloak::Handle(const std::vector<std::string> &parameters, User *user)
+{
+       ModuleCloaking* mod = (ModuleCloaking*)(Module*)creator;
+       irc::sockets::sockaddrs sa;
+       std::string cloak;
+
+       if (irc::sockets::aptosa(parameters[0], 0, sa))
+               cloak = mod->GenCloak(sa, parameters[0], parameters[0]);
+       else
+               cloak = mod->GenCloak(sa, "", parameters[0]);
+
+       user->WriteNotice("*** Cloak for " + parameters[0] + " is " + cloak);
+
+       return CMD_SUCCESS;
+}
+
+MODULE_INIT(ModuleCloaking)