Include connection security with the SASL host information.

[user/henk/code/inspircd.git] / src / modules / m_sasl.cpp

diff --git a/src/modules/m_sasl.cpp b/src/modules/m_sasl.cpp
index b59fd38355f2bfa44ea8338709e88ca86c9a3543..0ef93ec5ae66476923dfe7eaded192dba54711df 100644 (file)
--- a/src/modules/m_sasl.cpp
+++ b/src/modules/m_sasl.cpp
@@ -51,10 +51,72 @@ class SaslAuthenticator
        SaslResult result;
        bool state_announced;
 
+       /* taken from m_services_account */
+       static bool ReadCGIIRCExt(const char* extname, User* user, std::string& out)
+       {
+               ExtensionItem* wiext = ServerInstance->Extensions.GetItem(extname);
+               if (!wiext)
+                       return false;
+
+               if (wiext->creator->ModuleSourceFile != "m_cgiirc.so")
+                       return false;
+
+               StringExtItem* stringext = static_cast<StringExtItem*>(wiext);
+               std::string* addr = stringext->get(user);
+               if (!addr)
+                       return false;
+
+               out = *addr;
+               return true;
+       }
+
+
+       void SendHostIP()
+       {
+               std::string host, ip;
+
+               if (!ReadCGIIRCExt("cgiirc_webirc_hostname", user, host))
+               {
+                       host = user->host;
+               }
+               if (!ReadCGIIRCExt("cgiirc_webirc_ip", user, ip))
+               {
+                       ip = user->GetIPString();
+               }
+               else
+               {
+                       /* IP addresses starting with a : on irc are a Bad Thing (tm) */
+                       if (ip.c_str()[0] == ':')
+                               ip.insert(ip.begin(),1,'0');
+               }
+
+               parameterlist params;
+               params.push_back(sasl_target);
+               params.push_back("SASL");
+               params.push_back(user->uuid);
+               params.push_back("*");
+               params.push_back("H");
+               params.push_back(host);
+               params.push_back(ip);
+
+               LocalUser* lu = IS_LOCAL(user);
+               if (lu)
+               {
+                       // NOTE: SaslAuthenticator instances are only created for local
+                       // users so this parameter will always be appended.
+                       SocketCertificateRequest req(&lu->eh, ServerInstance->Modules->Find("m_sasl.so"));
+                       params.push_back(req.cert ? "S" : "P");
+               }
+
+               SendSASL(params);
+       }
+
  public:
        SaslAuthenticator(User* user_, const std::string& method)
                : user(user_), state(SASL_INIT), state_announced(false)
        {
+               SendHostIP();
+
                parameterlist params;
                params.push_back(sasl_target);
                params.push_back("SASL");
@@ -147,7 +209,7 @@ class SaslAuthenticator
 
                SendSASL(params);
 
-               if (parameters[0][0] == '*')
+               if (parameters[0].c_str()[0] == '*')
                {
                        this->Abort();
                        return false;
@@ -189,6 +251,7 @@ class CommandAuthenticate : public Command
                : Command(Creator, "AUTHENTICATE", 1), authExt(ext), cap(Cap)
        {
                works_before_reg = true;
+               allow_empty_last_param = false;
        }
 
        CmdResult Handle (const std::vector<std::string>& parameters, User *user)
@@ -199,6 +262,9 @@ class CommandAuthenticate : public Command
                        if (!cap.ext.get(user))
                                return CMD_FAILURE;
 
+                       if (parameters[0].find(' ') != std::string::npos || parameters[0][0] == ':')
+                               return CMD_FAILURE;
+
                        SaslAuthenticator *sasl = authExt.get(user);
                        if (!sasl)
                                authExt.set(user, new SaslAuthenticator(user, parameters[0]));
@@ -264,7 +330,7 @@ class ModuleSASL : public Module
        void init()
        {
                OnRehash(NULL);
-               Implementation eventlist[] = { I_OnEvent, I_OnUserRegister, I_OnRehash };
+               Implementation eventlist[] = { I_OnEvent, I_OnUserConnect, I_OnRehash };
                ServerInstance->Modules->Attach(eventlist, this, sizeof(eventlist)/sizeof(Implementation));
 
                ServiceProvider* providelist[] = { &auth, &sasl, &authExt };
@@ -279,7 +345,7 @@ class ModuleSASL : public Module
                sasl_target = ServerInstance->Config->ConfValue("sasl")->getString("target", "*");
        }
 
-       ModResult OnUserRegister(LocalUser *user)
+       void OnUserConnect(LocalUser *user)
        {
                SaslAuthenticator *sasl_ = authExt.get(user);
                if (sasl_)
@@ -287,13 +353,11 @@ class ModuleSASL : public Module
                        sasl_->Abort();
                        authExt.unset(user);
                }
-
-               return MOD_RES_PASSTHRU;
        }
 
        Version GetVersion()
        {
-               return Version("Provides support for IRC Authentication Layer (aka: atheme SASL) via AUTHENTICATE.",VF_VENDOR);
+               return Version("Provides support for IRC Authentication Layer (aka: SASL) via AUTHENTICATE.", VF_VENDOR);
        }
 
        void OnEvent(Event &ev)