Fix cloaking not ignoring the case of a user's hostname.

[user/henk/code/inspircd.git] / src / modules / m_sasl.cpp

diff --git a/src/modules/m_sasl.cpp b/src/modules/m_sasl.cpp
index 480f8f6db0d0ebc2ee559a80b705ae77417e6f8c..28bce2bf3c44478fe5cbde604d66847bbf1afc72 100644 (file)
--- a/src/modules/m_sasl.cpp
+++ b/src/modules/m_sasl.cpp
@@ -37,7 +37,8 @@ enum
 
 static std::string sasl_target;
 
-class ServerTracker : public ServerEventListener
+class ServerTracker
+       : public ServerProtocol::LinkEventListener
 {
        bool online;
 
@@ -65,7 +66,7 @@ class ServerTracker : public ServerEventListener
 
  public:
        ServerTracker(Module* mod)
-               : ServerEventListener(mod)
+               : ServerProtocol::LinkEventListener(mod)
        {
                Reset();
        }
@@ -103,16 +104,15 @@ class SASLCap : public Cap::Capability
 
        bool OnRequest(LocalUser* user, bool adding) CXX11_OVERRIDE
        {
-               // Requesting this cap is allowed anytime
-               if (adding)
-                       return true;
-
-               // But removing it can only be done when unregistered
-               return (user->registered != REG_ALL);
+               // Servers MUST NAK any sasl capability request if the authentication layer
+               // is unavailable.
+               return servertracker.IsOnline();
        }
 
        bool OnList(LocalUser* user) CXX11_OVERRIDE
        {
+               // Servers MUST NOT advertise the sasl capability if the authentication layer
+               // is unavailable.
                return servertracker.IsOnline();
        }
 
@@ -171,26 +171,28 @@ class SaslAuthenticator
        SaslResult result;
        bool state_announced;
 
-       void SendHostIP()
+       void SendHostIP(UserCertificateAPI& sslapi)
        {
                std::vector<std::string> params;
                params.push_back(user->GetRealHost());
                params.push_back(user->GetIPString());
-               params.push_back(SSLIOHook::IsSSL(&user->eh) ? "S" : "P");
+               params.push_back(sslapi && sslapi->GetCertificate(user) ? "S" : "P");
 
                SendSASL(user, "*", 'H', params);
        }
 
  public:
-       SaslAuthenticator(LocalUser* user_, const std::string& method)
-               : user(user_), state(SASL_INIT), state_announced(false)
+       SaslAuthenticator(LocalUser* user_, const std::string& method, UserCertificateAPI& sslapi)
+               : user(user_)
+               , state(SASL_INIT)
+               , state_announced(false)
        {
-               SendHostIP();
+               SendHostIP(sslapi);
 
                std::vector<std::string> params;
                params.push_back(method);
 
-               const std::string fp = SSLClientCert::GetFingerprint(&user->eh);
+               const std::string fp = sslapi ? sslapi->GetFingerprint(user) : "";
                if (fp.size())
                        params.push_back(fp);
 
@@ -282,7 +284,7 @@ class SaslAuthenticator
                 case SASL_OK:
                        this->user->WriteNumeric(RPL_SASLSUCCESS, "SASL authentication successful");
                        break;
-                case SASL_ABORT:
+                case SASL_ABORT:
                        this->user->WriteNumeric(ERR_SASLABORTED, "SASL authentication aborted");
                        break;
                 case SASL_FAIL:
@@ -305,10 +307,13 @@ class CommandAuthenticate : public SplitCommand
  public:
        SimpleExtItem<SaslAuthenticator>& authExt;
        Cap::Capability& cap;
+       UserCertificateAPI sslapi;
+
        CommandAuthenticate(Module* Creator, SimpleExtItem<SaslAuthenticator>& ext, Cap::Capability& Cap)
                : SplitCommand(Creator, "AUTHENTICATE", 1)
                , authExt(ext)
                , cap(Cap)
+               , sslapi(Creator)
        {
                works_before_reg = true;
                allow_empty_last_param = false;
@@ -331,7 +336,7 @@ class CommandAuthenticate : public SplitCommand
 
                        SaslAuthenticator *sasl = authExt.get(user);
                        if (!sasl)
-                               authExt.set(user, new SaslAuthenticator(user, parameters[0]));
+                               authExt.set(user, new SaslAuthenticator(user, parameters[0], sslapi));
                        else if (sasl->SendClientMessage(parameters) == false)  // IAL abort extension --nenolod
                        {
                                sasl->AnnounceState();
@@ -427,7 +432,7 @@ class ModuleSASL : public Module
 
        Version GetVersion() CXX11_OVERRIDE
        {
-               return Version("Provides support for IRC Authentication Layer (aka: SASL) via AUTHENTICATE.", VF_VENDOR);
+               return Version("Provides support for IRC Authentication Layer (aka: SASL) via AUTHENTICATE", VF_VENDOR);
        }
 };