X-Git-Url: https://git.netwichtig.de/gitweb/?a=blobdiff_plain;f=src%2Fmodules%2Fm_sasl.cpp;h=57e605d61a0bcb59698a15caefb5ce4b7bc50a01;hb=d848034590bc402277da975b7efdbc78ce1722fc;hp=cb52451111cd16e7767d405779c79cdaca78f6a7;hpb=ec6955f28ba9423828ac24ef83caee09ffa6b52c;p=user%2Fhenk%2Fcode%2Finspircd.git

diff --git a/src/modules/m_sasl.cpp b/src/modules/m_sasl.cpp
index cb5245111..57e605d61 100644
--- a/src/modules/m_sasl.cpp
+++ b/src/modules/m_sasl.cpp
@@ -1,8 +1,15 @@
 /*
  * InspIRCd -- Internet Relay Chat Daemon
  *
+ *   Copyright (C) 2016 Adam <Adam@anope.org>
+ *   Copyright (C) 2014 Mantas Mikulėnas <grawity@gmail.com>
+ *   Copyright (C) 2013-2016, 2018 Attila Molnar <attilamolnar@hush.com>
+ *   Copyright (C) 2013, 2017-2020 Sadie Powell <sadie@witchery.services>
+ *   Copyright (C) 2013 Daniel Vassdal <shutter@canternet.org>
+ *   Copyright (C) 2012, 2019 Robby <robby@chatbelgie.be>
  *   Copyright (C) 2009-2010 Daniel De Graaf <danieldg@inspircd.org>
- *   Copyright (C) 2008 Craig Edwards <craigedwards@brainbox.cc>
+ *   Copyright (C) 2008, 2010 Craig Edwards <brain@inspircd.org>
+ *   Copyright (C) 2008 Thomas Stagner <aquanight@inspircd.org>
  *
  * This file is part of InspIRCd.  InspIRCd is free software: you can
  * redistribute it and/or modify it under the terms of the GNU General Public
@@ -37,8 +44,12 @@ enum
 
 static std::string sasl_target;
 
-class ServerTracker : public ServerEventListener
+class ServerTracker
+	: public ServerProtocol::LinkEventListener
 {
+	// Stop GCC warnings about the deprecated OnServerSplit event.
+	using ServerProtocol::LinkEventListener::OnServerSplit;
+
 	bool online;
 
 	void Update(const Server* server, bool linked)
@@ -58,14 +69,14 @@ class ServerTracker : public ServerEventListener
 		Update(server, true);
 	}
 
-	void OnServerSplit(const Server* server) CXX11_OVERRIDE
+	void OnServerSplit(const Server* server, bool error) CXX11_OVERRIDE
 	{
 		Update(server, false);
 	}
 
  public:
 	ServerTracker(Module* mod)
-		: ServerEventListener(mod)
+		: ServerProtocol::LinkEventListener(mod)
 	{
 		Reset();
 	}
@@ -98,21 +109,28 @@ class ServerTracker : public ServerEventListener
 
 class SASLCap : public Cap::Capability
 {
+ private:
 	std::string mechlist;
 	const ServerTracker& servertracker;
+	UserCertificateAPI sslapi;
 
 	bool OnRequest(LocalUser* user, bool adding) CXX11_OVERRIDE
 	{
-		// Requesting this cap is allowed anytime
-		if (adding)
-			return true;
+		if (requiressl && sslapi && !sslapi->GetCertificate(user))
+			return false;
 
-		// But removing it can only be done when unregistered
-		return (user->registered != REG_ALL);
+		// Servers MUST NAK any sasl capability request if the authentication layer
+		// is unavailable.
+		return servertracker.IsOnline();
 	}
 
 	bool OnList(LocalUser* user) CXX11_OVERRIDE
 	{
+		if (requiressl && sslapi && !sslapi->GetCertificate(user))
+			return false;
+
+		// Servers MUST NOT advertise the sasl capability if the authentication layer
+		// is unavailable.
 		return servertracker.IsOnline();
 	}
 
@@ -122,9 +140,11 @@ class SASLCap : public Cap::Capability
 	}
 
  public:
+	bool requiressl;
 	SASLCap(Module* mod, const ServerTracker& tracker)
 		: Cap::Capability(mod, "sasl")
 		, servertracker(tracker)
+		, sslapi(mod)
 	{
 	}
 
@@ -193,7 +213,7 @@ class SaslAuthenticator
 		params.push_back(method);
 
 		const std::string fp = sslapi ? sslapi->GetFingerprint(user) : "";
-		if (fp.size())
+		if (!fp.empty())
 			params.push_back(fp);
 
 		SendSASL(user, "*", 'S', params);
@@ -215,11 +235,11 @@ class SaslAuthenticator
 	{
 		switch (this->state)
 		{
-		 case SASL_INIT:
+		case SASL_INIT:
 			this->agent = msg[0];
 			this->state = SASL_COMM;
 			/* fall through */
-		 case SASL_COMM:
+		case SASL_COMM:
 			if (msg[0] != this->agent)
 				return this->state;
 
@@ -247,9 +267,9 @@ class SaslAuthenticator
 				ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "Services sent an unknown SASL message \"%s\" \"%s\"", msg[2].c_str(), msg[3].c_str());
 
 			break;
-		 case SASL_DONE:
+		case SASL_DONE:
 			break;
-		 default:
+		default:
 			ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "WTF: SaslState is not a known state (%d)", this->state);
 			break;
 		}
@@ -281,16 +301,16 @@ class SaslAuthenticator
 
 		switch (this->result)
 		{
-		 case SASL_OK:
+		case SASL_OK:
 			this->user->WriteNumeric(RPL_SASLSUCCESS, "SASL authentication successful");
 			break;
-	 	 case SASL_ABORT:
+		case SASL_ABORT:
 			this->user->WriteNumeric(ERR_SASLABORTED, "SASL authentication aborted");
 			break;
-		 case SASL_FAIL:
+		case SASL_FAIL:
 			this->user->WriteNumeric(ERR_SASLFAIL, "SASL authentication failed");
 			break;
-		 default:
+		default:
 			break;
 		}
 
@@ -301,8 +321,8 @@ class SaslAuthenticator
 class CommandAuthenticate : public SplitCommand
 {
  private:
-	 // The maximum length of an AUTHENTICATE request.
-	 static const size_t MAX_AUTHENTICATE_SIZE = 400;
+	// The maximum length of an AUTHENTICATE request.
+	static const size_t MAX_AUTHENTICATE_SIZE = 400;
 
  public:
 	SimpleExtItem<SaslAuthenticator>& authExt;
@@ -416,10 +436,13 @@ class ModuleSASL : public Module
 
 	void ReadConfig(ConfigStatus& status) CXX11_OVERRIDE
 	{
-		std::string target = ServerInstance->Config->ConfValue("sasl")->getString("target");
+		ConfigTag* tag = ServerInstance->Config->ConfValue("sasl");
+
+		const std::string target = tag->getString("target");
 		if (target.empty())
 			throw ModuleException("<sasl:target> must be set to the name of your services server!");
 
+		cap.requiressl = tag->getBool("requiressl");
 		sasl_target = target;
 		servertracker.Reset();
 	}
@@ -432,7 +455,7 @@ class ModuleSASL : public Module
 
 	Version GetVersion() CXX11_OVERRIDE
 	{
-		return Version("Provides support for IRC Authentication Layer (aka: SASL) via AUTHENTICATE.", VF_VENDOR);
+		return Version("Provides the IRCv3 sasl client capability.", VF_VENDOR);
 	}
 };