Rename `<bind:ssl>` to `<bind:sslprofile>`.

[user/henk/code/inspircd.git] / src / modules / m_ircv3_sts.cpp

diff --git a/src/modules/m_ircv3_sts.cpp b/src/modules/m_ircv3_sts.cpp
index a8738b2ac0d718d0d2774bf423840c34b685053d..9b9d625f6727c73f14e26b00d3f5a9cacc3ed6fa 100644 (file)
--- a/src/modules/m_ircv3_sts.cpp
+++ b/src/modules/m_ircv3_sts.cpp
@@ -1,8 +1,8 @@
 /*
  * InspIRCd -- Internet Relay Chat Daemon
  *
- *   Copyright (C) 2015 Attila Molnar <attilamolnar@hush.com>
- *   Copyright (C) 2017 Peter Powell <petpow@saberuk.com>
+ *   Copyright (C) 2020 Matt Schatz <genius3000@g3k.solutions>
+ *   Copyright (C) 2017-2020 Sadie Powell <sadie@witchery.services>
  *
  * This file is part of InspIRCd.  InspIRCd is free software: you can
  * redistribute it and/or modify it under the terms of the GNU General Public
@@ -35,6 +35,10 @@ class STSCap : public Cap::Capability
                if (GetProtocol(user) == Cap::CAP_LEGACY)
                        return false;
 
+               // Don't send the cap to clients in a class which has STS disabled.
+               if (!user->GetClass()->config->getBool("usests", true))
+                       return false;
+
                // Plaintext listeners have their own policy.
                SSLIOHook* sslhook = SSLIOHook::IsSSL(&user->eh);
                if (!sslhook)
@@ -67,6 +71,7 @@ class STSCap : public Cap::Capability
        STSCap(Module* mod)
                : Cap::Capability(mod, "sts")
        {
+               DisableAutoRegister();
        }
 
        ~STSCap()
@@ -124,7 +129,7 @@ class ModuleIRCv3STS : public Module
  private:
        STSCap cap;
 
-       // The IRCv3 STS specification requires that the server is listening using SSL using a valid certificate.
+       // The IRCv3 STS specification requires that the server is listening using TLS (SSL) using a valid certificate.
        bool HasValidSSLPort(unsigned int port)
        {
                for (std::vector<ListenSocket*>::const_iterator iter = ServerInstance->ports.begin(); iter != ServerInstance->ports.end(); ++iter)
@@ -136,8 +141,8 @@ class ModuleIRCv3STS : public Module
                        if (saport != port)
                                continue;
 
-                       // Is this listener using SSL?
-                       if (ls->bind_tag->getString("ssl").empty())
+                       // Is this listener using TLS (SSL)?
+                       if (ls->bind_tag->getString("sslprofile", ls->bind_tag->getString("ssl")).empty())
                                continue;
 
                        // TODO: Add a way to check if a listener's TLS cert is CA-verified.
@@ -167,14 +172,17 @@ class ModuleIRCv3STS : public Module
                if (!HasValidSSLPort(port))
                        throw ModuleException("<sts:port> must be a TLS port, at " + tag->getTagLocation());
 
-               unsigned long duration = tag->getDuration("duration", 60*60*24*30*2);
+               unsigned long duration = tag->getDuration("duration", 5*60, 60);
                bool preload = tag->getBool("preload");
                cap.SetPolicy(host, duration, port, preload);
+
+               if (!cap.IsRegistered())
+                       ServerInstance->Modules->AddService(cap);
        }
 
        Version GetVersion() CXX11_OVERRIDE
        {
-               return Version("Provides IRCv3 Strict Transport Security policy advertisement", VF_OPTCOMMON|VF_VENDOR);
+               return Version("Adds support for the IRCv3 Strict Transport Security specification.", VF_OPTCOMMON|VF_VENDOR);
        }
 };