X-Git-Url: https://git.netwichtig.de/gitweb/?a=blobdiff_plain;f=src%2Fmodules%2Fm_ircv3_sts.cpp;h=c75da3fc0924c96e7f07938aae5af2569b6f41b7;hb=80e81e3b81b779901fd9d67f8ae030ee30c0bcec;hp=a8738b2ac0d718d0d2774bf423840c34b685053d;hpb=961109ae4fde97144fdedeef25607a5b8b3ec2c2;p=user%2Fhenk%2Fcode%2Finspircd.git

diff --git a/src/modules/m_ircv3_sts.cpp b/src/modules/m_ircv3_sts.cpp
index a8738b2ac..c75da3fc0 100644
--- a/src/modules/m_ircv3_sts.cpp
+++ b/src/modules/m_ircv3_sts.cpp
@@ -1,8 +1,8 @@
 /*
  * InspIRCd -- Internet Relay Chat Daemon
  *
- *   Copyright (C) 2015 Attila Molnar <attilamolnar@hush.com>
- *   Copyright (C) 2017 Peter Powell <petpow@saberuk.com>
+ *   Copyright (C) 2020 Matt Schatz <genius3000@g3k.solutions>
+ *   Copyright (C) 2017-2020 Sadie Powell <sadie@witchery.services>
  *
  * This file is part of InspIRCd.  InspIRCd is free software: you can
  * redistribute it and/or modify it under the terms of the GNU General Public
@@ -35,6 +35,10 @@ class STSCap : public Cap::Capability
 		if (GetProtocol(user) == Cap::CAP_LEGACY)
 			return false;
 
+		// Don't send the cap to clients in a class which has STS disabled.
+		if (!user->GetClass()->config->getBool("usests", true))
+			return false;
+
 		// Plaintext listeners have their own policy.
 		SSLIOHook* sslhook = SSLIOHook::IsSSL(&user->eh);
 		if (!sslhook)
@@ -67,6 +71,7 @@ class STSCap : public Cap::Capability
 	STSCap(Module* mod)
 		: Cap::Capability(mod, "sts")
 	{
+		DisableAutoRegister();
 	}
 
 	~STSCap()
@@ -124,7 +129,7 @@ class ModuleIRCv3STS : public Module
  private:
 	STSCap cap;
 
-	// The IRCv3 STS specification requires that the server is listening using SSL using a valid certificate.
+	// The IRCv3 STS specification requires that the server is listening using TLS (SSL) using a valid certificate.
 	bool HasValidSSLPort(unsigned int port)
 	{
 		for (std::vector<ListenSocket*>::const_iterator iter = ServerInstance->ports.begin(); iter != ServerInstance->ports.end(); ++iter)
@@ -136,7 +141,7 @@ class ModuleIRCv3STS : public Module
 			if (saport != port)
 				continue;
 
-			// Is this listener using SSL?
+			// Is this listener using TLS (SSL)?
 			if (ls->bind_tag->getString("ssl").empty())
 				continue;
 
@@ -167,14 +172,17 @@ class ModuleIRCv3STS : public Module
 		if (!HasValidSSLPort(port))
 			throw ModuleException("<sts:port> must be a TLS port, at " + tag->getTagLocation());
 
-		unsigned long duration = tag->getDuration("duration", 60*60*24*30*2);
+		unsigned long duration = tag->getDuration("duration", 5*60, 60);
 		bool preload = tag->getBool("preload");
 		cap.SetPolicy(host, duration, port, preload);
+
+		if (!cap.IsRegistered())
+			ServerInstance->Modules->AddService(cap);
 	}
 
 	Version GetVersion() CXX11_OVERRIDE
 	{
-		return Version("Provides IRCv3 Strict Transport Security policy advertisement", VF_OPTCOMMON|VF_VENDOR);
+		return Version("Adds support for the IRCv3 Strict Transport Security specification.", VF_OPTCOMMON|VF_VENDOR);
 	}
 };