Warn if the server config contains an unhashed password.

This will be made a hard failure in v4.

diff --git a/include/users.h b/include/users.h
index ca9c3f55703169fc016632a82183cf9a8748b53d..c08be8c6fec737ce208953e28c79743cf35a2884 100644 (file)
--- a/include/users.h
+++ b/include/users.h
@@ -149,6 +149,12 @@ struct CoreExport ConnectClass : public refcountbase
         */
        insp::flat_set<int> ports;
 
+       /** If non-empty then the password a user must specify in PASS to be assigned to this class. */
+       std::string password;
+
+       /** If non-empty then the hash algorithm that the password field is hashed with. */
+       std::string passwordhash;
+
        /** Create a new connect class with no settings.
         */
        ConnectClass(ConfigTag* tag, char type, const std::string& mask);

diff --git a/src/configreader.cpp b/src/configreader.cpp
index 51f846f705f82ced7c90ea1064a8cd95bd88fe51..a43a9d78cd2f8a4e8c7ede9a13ac208d873dcb9d 100644 (file)
--- a/src/configreader.cpp
+++ b/src/configreader.cpp
@@ -304,6 +304,14 @@ void ServerConfig::CrossCheckConnectBlocks(ServerConfig* current)
                        me->maxconnwarn = tag->getBool("maxconnwarn", me->maxconnwarn);
                        me->limit = tag->getUInt("limit", me->limit);
                        me->resolvehostnames = tag->getBool("resolvehostnames", me->resolvehostnames);
+                       me->password = tag->getString("password", me->password);
+
+                       me->passwordhash = tag->getString("hash", me->passwordhash);
+                       if (!me->password.empty() && (me->passwordhash.empty() || stdalgo::string::equalsci(me->passwordhash, "plaintext")))
+                       {
+                               ServerInstance->Logs->Log("CONNECTCLASS", LOG_DEFAULT, "<connect> tag '%s' at %s contains an plain text password, this is insecure!",
+                                       name.c_str(), tag->getTagLocation().c_str());
+                       }
 
                        std::string ports = tag->getString("port");
                        if (!ports.empty())

diff --git a/src/modules/m_cgiirc.cpp b/src/modules/m_cgiirc.cpp
index 94fc99db143b3c59d967cd65a101b9fc3a064915..d4a02859d77361c84ee1173308856bb00ea9e6d9 100644 (file)
--- a/src/modules/m_cgiirc.cpp
+++ b/src/modules/m_cgiirc.cpp
@@ -307,12 +307,19 @@ class ModuleCgiIRC
                                // The IP address will be received via the WEBIRC command.
                                const std::string fingerprint = tag->getString("fingerprint");
                                const std::string password = tag->getString("password");
+                               const std::string passwordhash = tag->getString("hash", "plaintext", 1);
 
                                // WebIRC blocks require a password.
                                if (fingerprint.empty() && password.empty())
                                        throw ModuleException("When using <cgihost type=\"webirc\"> either the fingerprint or password field is required, at " + tag->getTagLocation());
 
-                               webirchosts.push_back(WebIRCHost(mask, fingerprint, password, tag->getString("hash")));
+                               if (!password.empty() && stdalgo::string::equalsci(passwordhash, "plaintext"))
+                               {
+                                       ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "<cgihost> tag at %s contains an plain text password, this is insecure!",
+                                               tag->getTagLocation().c_str());
+                               }
+
+                               webirchosts.push_back(WebIRCHost(mask, fingerprint, password, passwordhash));
                        }
                        else
                        {

diff --git a/src/modules/m_customtitle.cpp b/src/modules/m_customtitle.cpp
index faf614e2f4b7382b41587e2c83962ce4dc1ec989..7cdd0bc4fd3f42543755fd3f5852aee6d10645f9 100644 (file)
--- a/src/modules/m_customtitle.cpp
+++ b/src/modules/m_customtitle.cpp
@@ -136,7 +136,13 @@ class ModuleCustomTitle : public Module, public Whois::LineEventListener
                        if (pass.empty())
                                throw ModuleException("<title:password> is empty at " + tag->getTagLocation());
 
-                       std::string hash = tag->getString("hash");
+                       const std::string hash = tag->getString("hash", "plaintext", 1);
+                       if (stdalgo::string::equalsci(hash, "plaintext"))
+                       {
+                               ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "<title> tag for %s at %s contains an plain text password, this is insecure!",
+                                       name.c_str(), tag->getTagLocation().c_str());
+                       }
+
                        std::string host = tag->getString("host", "*@*");
                        std::string title = tag->getString("title");
                        std::string vhost = tag->getString("vhost");

diff --git a/src/modules/m_vhost.cpp b/src/modules/m_vhost.cpp
index 573b9b31a12f76d5ba1030c49291522dad86c0c1..43d732ef92b52bc5b01f3d6874339dab55d708f4 100644 (file)
--- a/src/modules/m_vhost.cpp
+++ b/src/modules/m_vhost.cpp
@@ -103,13 +103,21 @@ class ModuleVHost : public Module
                        std::string mask = tag->getString("host");
                        if (mask.empty())
                                throw ModuleException("<vhost:host> is empty! at " + tag->getTagLocation());
+
                        std::string username = tag->getString("user");
                        if (username.empty())
                                throw ModuleException("<vhost:user> is empty! at " + tag->getTagLocation());
+
                        std::string pass = tag->getString("pass");
                        if (pass.empty())
                                throw ModuleException("<vhost:pass> is empty! at " + tag->getTagLocation());
-                       std::string hash = tag->getString("hash");
+
+                       const std::string hash = tag->getString("hash", "plaintext", 1);
+                       if (stdalgo::string::equalsci(hash, "plaintext"))
+                       {
+                               ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "<vhost> tag for %s at %s contains an plain text password, this is insecure!",
+                                       username.c_str(), tag->getTagLocation().c_str());
+                       }
 
                        CustomVhost vhost(username, pass, hash, mask);
                        newhosts.insert(std::make_pair(username, vhost));

diff --git a/src/users.cpp b/src/users.cpp
index 4edfd574c1949badf7874edf2a919fc32870e88f..0c95ecc0bc84214d5e5128855ffcb8cd3c13e27b 100644 (file)
--- a/src/users.cpp
+++ b/src/users.cpp
@@ -1155,9 +1155,9 @@ void LocalUser::SetClass(const std::string &explicit_name)
                                }
                        }
 
-                       if (regdone && !c->config->getString("password").empty())
+                       if (regdone && !c->password.empty())
                        {
-                               if (!ServerInstance->PassCompare(this, c->config->getString("password"), password, c->config->getString("hash")))
+                               if (!ServerInstance->PassCompare(this, c->password, password, c->passwordhash))
                                {
                                        ServerInstance->Logs->Log("CONNECTCLASS", LOG_DEBUG, "Bad password, skipping");
                                        continue;
@@ -1290,4 +1290,6 @@ void ConnectClass::Update(const ConnectClass* src)
        limit = src->limit;
        resolvehostnames = src->resolvehostnames;
        ports = src->ports;
+       password = src->password;
+       passwordhash = src->passwordhash;
 }