]> git.netwichtig.de Git - user/henk/code/inspircd.git/blobdiff - src/modules/m_httpd_acl.cpp
Fix a bunch of weird indentation and spacing issues.
[user/henk/code/inspircd.git] / src / modules / m_httpd_acl.cpp
index 8c682cfa9448d05ad12802d9f43a97cd69d5faf5..270e8b007ec94ef93e18122594f8bc83f70b25cf 100644 (file)
@@ -1,24 +1,32 @@
-/*       +------------------------------------+
- *       | Inspire Internet Relay Chat Daemon |
- *       +------------------------------------+
+/*
+ * InspIRCd -- Internet Relay Chat Daemon
  *
- *  InspIRCd: (C) 2002-2009 InspIRCd Development Team
- * See: http://wiki.inspircd.org/Credits
+ *   Copyright (C) 2018-2019 linuxdaemon <linuxdaemon.irc@gmail.com>
+ *   Copyright (C) 2013, 2017-2018, 2020 Sadie Powell <sadie@witchery.services>
+ *   Copyright (C) 2013, 2015 Attila Molnar <attilamolnar@hush.com>
+ *   Copyright (C) 2012, 2019 Robby <robby@chatbelgie.be>
+ *   Copyright (C) 2009-2010 Daniel De Graaf <danieldg@inspircd.org>
+ *   Copyright (C) 2008, 2010 Craig Edwards <brain@inspircd.org>
+ *   Copyright (C) 2008 Robin Burchell <robin+git@viroteck.net>
  *
- * This program is free but copyrighted software; see
- *         the file COPYING for details.
+ * This file is part of InspIRCd.  InspIRCd is free software: you can
+ * redistribute it and/or modify it under the terms of the GNU General Public
+ * License as published by the Free Software Foundation, version 2.
  *
- * ---------------------------------------------------
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-#include "inspircd.h"
-#include "httpd.h"
-#include "protocol.h"
 
-/* $ModDesc: Provides access control lists (passwording of resources, ip restrictions etc) to m_httpd.so dependent modules */
-/* $ModDep: httpd.h */
+#include "inspircd.h"
+#include "modules/httpd.h"
 
-class HTTPACL : public Extensible
+class HTTPACL
 {
  public:
        std::string path;
@@ -31,28 +39,30 @@ class HTTPACL : public Extensible
                const std::string &set_whitelist, const std::string &set_blacklist)
                : path(set_path), username(set_username), password(set_password), whitelist(set_whitelist),
                blacklist(set_blacklist) { }
-
-       ~HTTPACL() { }
 };
 
-class ModuleHTTPAccessList : public Module
+class ModuleHTTPAccessList : public Module, public HTTPACLEventListener
 {
-
-       std::string stylesheet;
-       bool changed;
+ private:
        std::vector<HTTPACL> acl_list;
+       HTTPdAPI API;
 
  public:
+       ModuleHTTPAccessList()
+               : HTTPACLEventListener(this)
+               , API(this)
+       {
+       }
 
-       void ReadConfig()
+       void ReadConfig(ConfigStatus& status) CXX11_OVERRIDE
        {
-               acl_list.clear();
-               ConfigReader c;
-               int n_items = c.Enumerate("httpdacl");
-               for (int i = 0; i < n_items; ++i)
+               std::vector<HTTPACL> new_acls;
+               ConfigTagList acls = ServerInstance->Config->ConfTags("httpdacl");
+               for (ConfigIter i = acls.first; i != acls.second; i++)
                {
-                       std::string path = c.ReadValue("httpdacl", "path", i);
-                       std::string types = c.ReadValue("httpdacl", "types", i);
+                       ConfigTag* c = i->second;
+                       std::string path = c->getString("path");
+                       std::string types = c->getString("types");
                        irc::commasepstream sep(types);
                        std::string type;
                        std::string username;
@@ -62,18 +72,18 @@ class ModuleHTTPAccessList : public Module
 
                        while (sep.GetToken(type))
                        {
-                               if (type == "password")
+                               if (stdalgo::string::equalsci(type, "password"))
                                {
-                                       username = c.ReadValue("httpdacl", "username", i);
-                                       password = c.ReadValue("httpdacl", "password", i);
+                                       username = c->getString("username");
+                                       password = c->getString("password");
                                }
-                               else if (type == "whitelist")
+                               else if (stdalgo::string::equalsci(type, "whitelist"))
                                {
-                                       whitelist = c.ReadValue("httpdacl", "whitelist", i);
+                                       whitelist = c->getString("whitelist");
                                }
-                               else if (type == "blacklist")
+                               else if (stdalgo::string::equalsci(type, "blacklist"))
                                {
-                                       blacklist = c.ReadValue("httpdacl", "blacklist", i);
+                                       blacklist = c->getString("blacklist");
                                }
                                else
                                {
@@ -81,97 +91,40 @@ class ModuleHTTPAccessList : public Module
                                }
                        }
 
-                       ServerInstance->Logs->Log("m_httpd_acl", DEBUG, "Read ACL: path=%s pass=%s whitelist=%s blacklist=%s", path.c_str(),
+                       ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "Read ACL: path=%s pass=%s whitelist=%s blacklist=%s", path.c_str(),
                                        password.c_str(), whitelist.c_str(), blacklist.c_str());
 
-                       acl_list.push_back(HTTPACL(path, username, password, whitelist, blacklist));
+                       new_acls.push_back(HTTPACL(path, username, password, whitelist, blacklist));
                }
+               acl_list.swap(new_acls);
        }
 
-       ModuleHTTPAccessList()  {
-               ReadConfig();
-               Implementation eventlist[] = { I_OnEvent, I_OnRequest };
-               ServerInstance->Modules->Attach(eventlist, this, 2);
-       }
-
-       void BlockAccess(HTTPRequest* http, Event* event, int returnval, const std::string &extraheaderkey = "", const std::string &extraheaderval="")
+       void BlockAccess(HTTPRequest* http, unsigned int returnval, const std::string &extraheaderkey = "", const std::string &extraheaderval="")
        {
-               ServerInstance->Logs->Log("m_httpd_acl", DEBUG, "BlockAccess (%d)", returnval);
+               ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "BlockAccess (%u)", returnval);
 
-               std::stringstream data("Access to this resource is denied by an access control list. Please contact your IRC administrator.");
-               HTTPDocument response(http->sock, &data, returnval);
-               response.headers.SetHeader("X-Powered-By", "m_httpd_acl.so");
+               std::stringstream data;
+               data << "<html><head></head><body style='font-family: sans-serif; text-align: center'>"
+                       << "<h1 style='font-size: 48pt'>Error " << returnval << "</h1>"
+                       << "<h2 style='font-size: 24pt'>Access to this resource is denied by an access control list.</h2>"
+                       << "<h2 style='font-size: 24pt'>Please contact your IRC administrator.</h2><hr>"
+                       << "<small>Powered by <a href='https://www.inspircd.org'>InspIRCd</a></small></body></html>";
+
+               HTTPDocumentResponse response(this, *http, &data, returnval);
+               response.headers.SetHeader("X-Powered-By", MODNAME);
                if (!extraheaderkey.empty())
                        response.headers.SetHeader(extraheaderkey, extraheaderval);
-               Request req((char*)&response, (Module*)this, event->GetSource());
-               req.Send();
+               API->SendResponse(response);
        }
 
-       bool IsBase64(unsigned char c)
+       bool IsAccessAllowed(HTTPRequest* http)
        {
-               return (isalnum(c) || (c == '+') || (c == '/'));
-       }
-
-       std::string Base64Decode(const std::string &base64)
-       {
-               const std::string base64_chars("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/");
-               int inputlen = base64.length();
-               int i = 0, j = 0, input = 0;
-               unsigned char longbuf[4], shortbuf[3];
-               std::string retval;
-
-               if (inputlen == 0)
-                       return "";
-
-               while (inputlen-- && (base64[input] != '=') && IsBase64(base64[input]))
                {
-                       longbuf[i++] = base64[input];
-                       input++;
-                       if (i == 4)
-                       {
-                               for (i = 0; i < 4; ++i)
-                                       longbuf[i] = base64_chars.find(longbuf[i]);
-
-                               shortbuf[0] = (longbuf[0] << 2)         + ((longbuf[1] & 0x30) >> 4);
-                               shortbuf[1] = ((longbuf[1] & 0xf) << 4) + ((longbuf[2] & 0x3c) >> 2);
-                               shortbuf[2] = ((longbuf[2] & 0x3) << 6) + longbuf[3];
-
-                               for (i = 0; i < 3; ++i)
-                                       retval += shortbuf[i];
-
-                               i = 0;
-                       }
-               }
-
-               if (i)
-               {
-                       for (j = i; j < 4; ++j)
-                               longbuf[j] = 0;
-
-                       for (j = 0; j < 4; ++j)
-                               longbuf[j] = base64_chars.find(longbuf[j]);
-
-                       shortbuf[0] = (longbuf[0] << 2)         + ((longbuf[1] & 0x30) >> 4);
-                       shortbuf[1] = ((longbuf[1] & 0xf) << 4) + ((longbuf[2] & 0x3c) >> 2);
-                       shortbuf[2] = ((longbuf[2] & 0x3) << 6) + longbuf[3];
-
-                       for (j = 0; j < i - 1; ++j)
-                               retval += shortbuf[j];
-               }
-
-               return retval;
-       }
-
-       void OnEvent(Event* event)
-       {
-               if (event->GetEventID() == "httpd_acl")
-               {
-                       ServerInstance->Logs->Log("m_http_stats", DEBUG,"Handling httpd acl event");
-                       HTTPRequest* http = (HTTPRequest*)event->GetData();
+                       ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "Handling httpd acl event");
 
                        for (std::vector<HTTPACL>::const_iterator this_acl = acl_list.begin(); this_acl != acl_list.end(); ++this_acl)
                        {
-                               if (InspIRCd::Match(http->GetURI(), this_acl->path, ascii_case_insensitive_map))
+                               if (InspIRCd::Match(http->GetPath(), this_acl->path, ascii_case_insensitive_map))
                                {
                                        if (!this_acl->blacklist.empty())
                                        {
@@ -183,10 +136,10 @@ class ModuleHTTPAccessList : public Module
                                                {
                                                        if (InspIRCd::Match(http->GetIP(), entry, ascii_case_insensitive_map))
                                                        {
-                                                               ServerInstance->Logs->Log("m_httpd_acl", DEBUG, "Denying access to blacklisted resource %s (matched by pattern %s) from ip %s (matched by entry %s)",
-                                                                               http->GetURI().c_str(), this_acl->path.c_str(), http->GetIP().c_str(), entry.c_str());
-                                                               BlockAccess(http, event, 403);
-                                                               return;
+                                                               ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "Denying access to blacklisted resource %s (matched by pattern %s) from ip %s (matched by entry %s)",
+                                                                               http->GetPath().c_str(), this_acl->path.c_str(), http->GetIP().c_str(), entry.c_str());
+                                                               BlockAccess(http, 403);
+                                                               return false;
                                                        }
                                                }
                                        }
@@ -205,17 +158,17 @@ class ModuleHTTPAccessList : public Module
 
                                                if (!allow_access)
                                                {
-                                                       ServerInstance->Logs->Log("m_httpd_acl", DEBUG, "Denying access to whitelisted resource %s (matched by pattern %s) from ip %s (Not in whitelist)",
-                                                                       http->GetURI().c_str(), this_acl->path.c_str(), http->GetIP().c_str());
-                                                       BlockAccess(http, event, 403);
-                                                       return;
+                                                       ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "Denying access to whitelisted resource %s (matched by pattern %s) from ip %s (Not in whitelist)",
+                                                                       http->GetPath().c_str(), this_acl->path.c_str(), http->GetIP().c_str());
+                                                       BlockAccess(http, 403);
+                                                       return false;
                                                }
                                        }
                                        if (!this_acl->password.empty() && !this_acl->username.empty())
                                        {
                                                /* Password auth, first look to see if we have a basic authentication header */
-                                               ServerInstance->Logs->Log("m_httpd_acl", DEBUG, "Checking HTTP auth password for resource %s (matched by pattern %s) from ip %s, against username %s",
-                                                               http->GetURI().c_str(), this_acl->path.c_str(), http->GetIP().c_str(), this_acl->username.c_str());
+                                               ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "Checking HTTP auth password for resource %s (matched by pattern %s) from ip %s, against username %s",
+                                                               http->GetPath().c_str(), this_acl->path.c_str(), http->GetIP().c_str(), this_acl->username.c_str());
 
                                                if (http->headers->IsSet("Authorization"))
                                                {
@@ -232,8 +185,8 @@ class ModuleHTTPAccessList : public Module
                                                                std::string pass;
 
                                                                sep.GetToken(base64);
-                                                               std::string userpass = Base64Decode(base64);
-                                                               ServerInstance->Logs->Log("m_httpd_acl", DEBUG, "HTTP authorization: %s (%s)", userpass.c_str(), base64.c_str());
+                                                               std::string userpass = Base64ToBin(base64);
+                                                               ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "HTTP authorization: %s (%s)", userpass.c_str(), base64.c_str());
 
                                                                irc::sepstream userpasspair(userpass, ':');
                                                                if (userpasspair.GetToken(user))
@@ -243,47 +196,57 @@ class ModuleHTTPAccessList : public Module
                                                                        /* Access granted if username and password are correct */
                                                                        if (user == this_acl->username && pass == this_acl->password)
                                                                        {
-                                                                               ServerInstance->Logs->Log("m_httpd_acl", DEBUG, "HTTP authorization: password and username match");
-                                                                               return;
+                                                                               ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "HTTP authorization: password and username match");
+                                                                               return true;
                                                                        }
                                                                        else
+                                                                       {
                                                                                /* Invalid password */
-                                                                               BlockAccess(http, event, 401, "WWW-Authenticate", "Basic realm=\"Restricted Object\"");
+                                                                               ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "HTTP authorization: password and username do not match");
+                                                                               BlockAccess(http, 401, "WWW-Authenticate", "Basic realm=\"Restricted Object\"");
+                                                                       }
                                                                }
                                                                else
+                                                               {
                                                                        /* Malformed user:pass pair */
-                                                                       BlockAccess(http, event, 401, "WWW-Authenticate", "Basic realm=\"Restricted Object\"");
+                                                                       ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "HTTP authorization: password and username malformed");
+                                                                       BlockAccess(http, 401, "WWW-Authenticate", "Basic realm=\"Restricted Object\"");
+                                                               }
                                                        }
                                                        else
+                                                       {
                                                                /* Unsupported authentication type */
-                                                               BlockAccess(http, event, 401, "WWW-Authenticate", "Basic realm=\"Restricted Object\"");
+                                                               ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "HTTP authorization: unsupported auth type: %s", authtype.c_str());
+                                                               BlockAccess(http, 401, "WWW-Authenticate", "Basic realm=\"Restricted Object\"");
+                                                       }
                                                }
                                                else
                                                {
                                                        /* No password given at all, access denied */
-                                                       BlockAccess(http, event, 401, "WWW-Authenticate", "Basic realm=\"Restricted Object\"");
+                                                       ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "HTTP authorization: password and username not sent");
+                                                       BlockAccess(http, 401, "WWW-Authenticate", "Basic realm=\"Restricted Object\"");
                                                }
+                                               return false;
                                        }
 
                                        /* A path may only match one ACL (the first it finds in the config file) */
-                                       return;
+                                       break;
                                }
                        }
                }
+               return true;
        }
 
-       const char* OnRequest(Request* request)
-       {
-               return NULL;
-       }
-
-       virtual ~ModuleHTTPAccessList()
+       ModResult OnHTTPACLCheck(HTTPRequest& req) CXX11_OVERRIDE
        {
+               if (IsAccessAllowed(&req))
+                       return MOD_RES_PASSTHRU;
+               return MOD_RES_DENY;
        }
 
-       virtual Version GetVersion()
+       Version GetVersion() CXX11_OVERRIDE
        {
-               return Version("Provides access control lists (passwording of resources, ip restrictions etc) to m_httpd.so dependent modules", VF_VENDOR, API_VERSION);
+               return Version("Allows the server administrator to control who can access resources served over HTTP with the httpd module.", VF_VENDOR);
        }
 };