X-Git-Url: https://git.netwichtig.de/gitweb/?a=blobdiff_plain;f=src%2Fmodules%2Fm_cgiirc.cpp;h=d80719c1725b6ad03f44d05d8921a6cb9f91ccc1;hb=08d2ff86b0c7ed91549d832cf3e572c8623dc8e8;hp=d67b09c39bb0c121930af4467a7697257cf2cb5b;hpb=79892a727e323dcc4bce7e9c0cf3c99c5fe61706;p=user%2Fhenk%2Fcode%2Finspircd.git

diff --git a/src/modules/m_cgiirc.cpp b/src/modules/m_cgiirc.cpp
index d67b09c39..d80719c17 100644
--- a/src/modules/m_cgiirc.cpp
+++ b/src/modules/m_cgiirc.cpp
@@ -34,29 +34,6 @@ enum
 	RPL_WHOISGATEWAY = 350
 };
 
-// We need this method up here so that it can be accessed from anywhere
-static void ChangeIP(LocalUser* user, const irc::sockets::sockaddrs& sa)
-{
-	// Set the users IP address and make sure they are in the right clone pool.
-	ServerInstance->Users->RemoveCloneCounts(user);
-	user->SetClientIP(sa);
-	ServerInstance->Users->AddClone(user);
-	if (user->quitting)
-		return;
-
-	// Recheck the connect class.
-	user->MyClass = NULL;
-	user->SetClass();
-	user->CheckClass();
-	if (user->quitting)
-		return;
-
-	// Check if this user matches any XLines.
-	user->CheckLines(true);
-	if (user->quitting)
-		return;
-}
-
 // Encapsulates information about an ident host.
 class IdentHost
 {
@@ -103,15 +80,15 @@ class WebIRCHost
 	{
 	}
 
-	bool Matches(LocalUser* user, const std::string& pass) const
+	bool Matches(LocalUser* user, const std::string& pass, UserCertificateAPI& sslapi) const
 	{
 		// Did the user send a valid password?
 		if (!password.empty() && !ServerInstance->PassCompare(user, password, pass, passhash))
 			return false;
 
 		// Does the user have a valid fingerprint?
-		const std::string fp = SSLClientCert::GetFingerprint(&user->eh);
-		if (!fingerprint.empty() && fp != fingerprint)
+		const std::string fp = sslapi ? sslapi->GetFingerprint(user) : "";
+		if (!fingerprint.empty() && !InspIRCd::TimingSafeCompare(fp, fingerprint))
 			return false;
 
 		// Does the user's hostname match our hostmask?
@@ -142,6 +119,7 @@ class CommandWebIRC : public SplitCommand
 	StringExtItem gateway;
 	StringExtItem realhost;
 	StringExtItem realip;
+	UserCertificateAPI sslapi;
 	Events::ModuleEventProvider webircevprov;
 
 	CommandWebIRC(Module* Creator)
@@ -149,11 +127,12 @@ class CommandWebIRC : public SplitCommand
 		, gateway("cgiirc_gateway", ExtensionItem::EXT_USER, Creator)
 		, realhost("cgiirc_realhost", ExtensionItem::EXT_USER, Creator)
 		, realip("cgiirc_realip", ExtensionItem::EXT_USER, Creator)
+		, sslapi(Creator)
 		, webircevprov(Creator, "event/webirc")
 	{
 		allow_empty_last_param = false;
 		works_before_reg = true;
-		this->syntax = "<password> <gateway> <hostname> <ip> [flags]";
+		this->syntax = "<password> <gateway> <hostname> <ip> [<flags>]";
 	}
 
 	CmdResult HandleLocal(LocalUser* user, const Params& parameters) CXX11_OVERRIDE
@@ -161,21 +140,21 @@ class CommandWebIRC : public SplitCommand
 		if (user->registered == REG_ALL || realhost.get(user))
 			return CMD_FAILURE;
 
-		irc::sockets::sockaddrs ipaddr;
-		if (!irc::sockets::aptosa(parameters[3], user->client_sa.port(), ipaddr))
-		{
-			user->CommandFloodPenalty += 5000;
-			WriteLog("Connecting user %s (%s) tried to use WEBIRC but gave an invalid IP address.",
-				user->uuid.c_str(), user->GetIPString().c_str());
-			return CMD_FAILURE;
-		}
-
 		for (std::vector<WebIRCHost>::const_iterator iter = hosts.begin(); iter != hosts.end(); ++iter)
 		{
 			// If we don't match the host then skip to the next host.
-			if (!iter->Matches(user, parameters[0]))
+			if (!iter->Matches(user, parameters[0], sslapi))
 				continue;
 
+			irc::sockets::sockaddrs ipaddr;
+			if (!irc::sockets::aptosa(parameters[3], user->client_sa.port(), ipaddr))
+			{
+				WriteLog("Connecting user %s (%s) tried to use WEBIRC but gave an invalid IP address.",
+					user->uuid.c_str(), user->GetIPString().c_str());
+				ServerInstance->Users->QuitUser(user, "WEBIRC: IP address is invalid: " + parameters[3]);
+				return CMD_FAILURE;
+			}
+
 			// The user matched a WebIRC block!
 			gateway.set(user, parameters[1]);
 			realhost.set(user, user->GetRealHost());
@@ -213,13 +192,13 @@ class CommandWebIRC : public SplitCommand
 
 			// Set the IP address sent via WEBIRC. We ignore the hostname and lookup
 			// instead do our own DNS lookups because of unreliable gateways.
-			ChangeIP(user, ipaddr);
+			user->SetClientIP(ipaddr);
 			return CMD_SUCCESS;
 		}
 
-		user->CommandFloodPenalty += 5000;
 		WriteLog("Connecting user %s (%s) tried to use WEBIRC but didn't match any configured WebIRC hosts.",
 			user->uuid.c_str(), user->GetIPString().c_str());
+		ServerInstance->Users->QuitUser(user, "WEBIRC: you don't match any configured WebIRC hosts.");
 		return CMD_FAILURE;
 	}
 
@@ -332,7 +311,7 @@ class ModuleCgiIRC
 			}
 			else
 			{
-				throw ModuleException(type + " is an invalid <cgihost:mask> type, at " + tag->getTagLocation()); 
+				throw ModuleException(type + " is an invalid <cgihost:mask> type, at " + tag->getTagLocation());
 			}
 		}
 
@@ -389,8 +368,8 @@ class ModuleCgiIRC
 				user->uuid.c_str(), user->GetIPString().c_str(), address.addr().c_str(), user->ident.c_str(), newident.c_str());
 
 			user->ChangeIdent(newident);
-			ChangeIP(user, address);
-			break; 
+			user->SetClientIP(address);
+			break;
 		}
 		return MOD_RES_PASSTHRU;
 	}
@@ -403,7 +382,7 @@ class ModuleCgiIRC
 			return;
 
 		WebIRC::FlagMap::const_iterator cport = flags->find("remote-port");
-		if (cport == flags->end())
+		if (cport != flags->end())
 		{
 			// If we can't parse the port then just give up.
 			uint16_t port = ConvToNum<uint16_t>(cport->second);
@@ -429,7 +408,7 @@ class ModuleCgiIRC
 		}
 
 		WebIRC::FlagMap::const_iterator sport = flags->find("local-port");
-		if (sport == flags->end())
+		if (sport != flags->end())
 		{
 			// If we can't parse the port then just give up.
 			uint16_t port = ConvToNum<uint16_t>(sport->second);