X-Git-Url: https://git.netwichtig.de/gitweb/?a=blobdiff_plain;f=src%2Fmodules%2Fm_sslinfo.cpp;h=70e065257bc763892819ee0d8bb61d98d117f2e6;hb=7488b2de62811d7f831e84fb0aeac2345a7f9ee9;hp=2c84c114bfd9e152e0d896c99a9f1f80cf4336db;hpb=4a6fedd9324d87349a806c9c1d0ae6e7d3c1fd38;p=user%2Fhenk%2Fcode%2Finspircd.git diff --git a/src/modules/m_sslinfo.cpp b/src/modules/m_sslinfo.cpp index 2c84c114b..70e065257 100644 --- a/src/modules/m_sslinfo.cpp +++ b/src/modules/m_sslinfo.cpp @@ -1,9 +1,9 @@ /* * InspIRCd -- Internet Relay Chat Daemon * + * Copyright (C) 2020 Matt Schatz * Copyright (C) 2019 linuxdaemon - * Copyright (C) 2013, 2017-2019 Sadie Powell - * Copyright (C) 2013 Christopher 'm4z' Holm + * Copyright (C) 2013, 2017-2020 Sadie Powell * Copyright (C) 2012-2016 Attila Molnar * Copyright (C) 2012 Robby * Copyright (C) 2010 Adam @@ -138,7 +138,7 @@ class UserCertificateAPIImpl : public UserCertificateAPIBase void SetCertificate(User* user, ssl_cert* cert) CXX11_OVERRIDE { - ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "Setting SSL certificate for %s: %s", + ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "Setting TLS (SSL) client certificate for %s: %s", user->GetFullHost().c_str(), cert->GetMetaLine().c_str()); sslext.set(user, cert); } @@ -153,7 +153,7 @@ class CommandSSLInfo : public Command : Command(Creator, "SSLINFO", 1) , sslapi(Creator) { - this->syntax = ""; + syntax = ""; } CmdResult Handle(User* user, const Params& parameters) CXX11_OVERRIDE @@ -165,20 +165,23 @@ class CommandSSLInfo : public Command user->WriteNumeric(Numerics::NoSuchNick(parameters[0])); return CMD_FAILURE; } + bool operonlyfp = ServerInstance->Config->ConfValue("sslinfo")->getBool("operonly"); if (operonlyfp && !user->IsOper() && target != user) { - user->WriteNotice("*** You cannot view SSL certificate information for other users"); + user->WriteNotice("*** You cannot view TLS (SSL) client certificate information for other users"); return CMD_FAILURE; } + ssl_cert* cert = sslapi.GetCertificate(target); if (!cert) { - user->WriteNotice("*** No SSL certificate for this user"); + user->WriteNotice(InspIRCd::Format("*** %s is not connected using TLS (SSL).", target->nick.c_str())); } else if (cert->GetError().length()) { - user->WriteNotice("*** No SSL certificate information for this user (" + cert->GetError() + ")."); + user->WriteNotice(InspIRCd::Format("*** %s is connected using TLS (SSL) but has not specified a valid client certificate (%s).", + target->nick.c_str(), cert->GetError().c_str())); } else { @@ -186,6 +189,7 @@ class CommandSSLInfo : public Command user->WriteNotice("*** Issuer: " + cert->GetIssuer()); user->WriteNotice("*** Key Fingerprint: " + cert->GetFingerprint()); } + return CMD_SUCCESS; } }; @@ -215,7 +219,7 @@ class ModuleSSLInfo Version GetVersion() CXX11_OVERRIDE { - return Version("Adds user facing SSL information, various SSL configuration options, and the /SSLINFO command to look up SSL certificate information for other users.", VF_VENDOR); + return Version("Adds user facing TLS (SSL) information, various TLS (SSL) configuration options, and the /SSLINFO command to look up TLS (SSL) certificate information for other users.", VF_VENDOR); } void OnWhois(Whois::Context& whois) CXX11_OVERRIDE @@ -226,7 +230,7 @@ class ModuleSSLInfo whois.SendLine(RPL_WHOISSECURE, "is using a secure connection"); bool operonlyfp = ServerInstance->Config->ConfValue("sslinfo")->getBool("operonly"); if ((!operonlyfp || whois.IsSelfWhois() || whois.GetSource()->IsOper()) && !cert->fingerprint.empty()) - whois.SendLine(RPL_WHOISCERTFP, InspIRCd::Format("has client certificate fingerprint %s", cert->fingerprint.c_str())); + whois.SendLine(RPL_WHOISCERTFP, InspIRCd::Format("has TLS (SSL) client certificate fingerprint %s", cert->fingerprint.c_str())); } } @@ -255,18 +259,18 @@ class ModuleSSLInfo if (ifo->oper_block->getBool("sslonly") && !cert) { - user->WriteNumeric(ERR_NOOPERHOST, "This oper login requires an SSL connection."); + user->WriteNumeric(ERR_NOOPERHOST, "Invalid oper credentials"); user->CommandFloodPenalty += 10000; - ServerInstance->SNO->WriteGlobalSno('o', "WARNING! Failed oper attempt by %s using login '%s': secure connection required.", user->GetFullRealHost().c_str(), parameters[0].c_str()); + ServerInstance->SNO->WriteGlobalSno('o', "WARNING! Failed oper attempt by %s using login '%s': a secure connection is required.", user->GetFullRealHost().c_str(), parameters[0].c_str()); return MOD_RES_DENY; } std::string fingerprint; if (ifo->oper_block->readString("fingerprint", fingerprint) && (!cert || !MatchFP(cert, fingerprint))) { - user->WriteNumeric(ERR_NOOPERHOST, "This oper login requires a matching SSL certificate fingerprint."); + user->WriteNumeric(ERR_NOOPERHOST, "Invalid oper credentials"); user->CommandFloodPenalty += 10000; - ServerInstance->SNO->WriteGlobalSno('o', "WARNING! Failed oper attempt by %s using login '%s': client certificate fingerprint does not match.", user->GetFullRealHost().c_str(), parameters[0].c_str()); + ServerInstance->SNO->WriteGlobalSno('o', "WARNING! Failed oper attempt by %s using login '%s': their TLS (SSL) client certificate fingerprint does not match.", user->GetFullRealHost().c_str(), parameters[0].c_str()); return MOD_RES_DENY; } } @@ -288,21 +292,20 @@ class ModuleSSLInfo ssl_cert* const cert = ssliohook->GetCertificate(); - { - std::string text = "*** You are connected to "; - if (!ssliohook->GetServerName(text)) - text.append(ServerInstance->Config->ServerName); - text.append(" using SSL cipher '"); - ssliohook->GetCiphersuite(text); - text.push_back('\''); - if ((cert) && (!cert->GetFingerprint().empty())) - text.append(" and your SSL certificate fingerprint is ").append(cert->GetFingerprint()); - user->WriteNotice(text); - } + std::string text = "*** You are connected to "; + if (!ssliohook->GetServerName(text)) + text.append(ServerInstance->Config->ServerName); + text.append(" using TLS (SSL) cipher '"); + ssliohook->GetCiphersuite(text); + text.push_back('\''); + if (cert && !cert->GetFingerprint().empty()) + text.append(" and your TLS (SSL) client certificate fingerprint is ").append(cert->GetFingerprint()); + user->WriteNotice(text); if (!cert) return; - // find an auto-oper block for this user + + // Find an auto-oper block for this user for (ServerConfig::OperIndex::const_iterator i = ServerInstance->Config->oper_blocks.begin(); i != ServerInstance->Config->oper_blocks.end(); ++i) { OperInfo* ifo = i->second; @@ -320,16 +323,17 @@ class ModuleSSLInfo if (stdalgo::string::equalsci(requiressl, "trusted")) { ok = (cert && cert->IsCAVerified()); - ServerInstance->Logs->Log("CONNECTCLASS", LOG_DEBUG, "Class requires a trusted SSL cert. Client %s one.", (ok ? "has" : "does not have")); + ServerInstance->Logs->Log("CONNECTCLASS", LOG_DEBUG, "Class requires a trusted TLS (SSL) client certificate. Client %s one.", (ok ? "has" : "does not have")); } else if (myclass->config->getBool("requiressl")) { ok = (cert != NULL); - ServerInstance->Logs->Log("CONNECTCLASS", LOG_DEBUG, "Class requires SSL. Client %s using SSL.", (ok ? "is" : "is not")); + ServerInstance->Logs->Log("CONNECTCLASS", LOG_DEBUG, "Class requires a secure connection. Client %s on a secure connection.", (ok ? "is" : "is not")); } if (!ok) return MOD_RES_DENY; + return MOD_RES_PASSTHRU; }