ViewVC Help
View File | Revision Log | Show Annotations | View Changeset | Root Listing
root/svn/ircd-hybrid/contrib/m_spoof.c
Revision: 801
Committed: Wed Aug 30 16:54:25 2006 UTC (17 years, 7 months ago) by adx
Content type: text/x-csrc
File size: 14079 byte(s)
Log Message:
+ only filename changes

File Contents

# Content
1 /*
2 * ircd-hybrid: an advanced Internet Relay Chat Daemon(ircd).
3 * m_spoof.c: Supports dynamic auth{} creation/deletion.
4 *
5 * Copyright (C) 2002 by the past and present ircd coders, and others.
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 2 of the License, or
10 * (at your option) any later version.
11 *
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
16 *
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, write to the Free Software
19 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
20 * USA
21 *
22 * $Id$
23 */
24
25 /* MODULE CONFIGURATION FOLLOWS -- please read!! */
26
27 /*
28 * change to #define if you want to propagate received SPOOF/DELSPOOF messages
29 * to other servers. This allows you create subnets inside which spoofs are
30 * propagated. By manipulating PROPAGATE_SPOOF and RECEIVE_SPOOF, you can
31 * prepare boundary hubs of such subnets.
32 *
33 * I realize a shared{} could be better, but I don't want to touch core code.
34 *
35 * If you decide to enable this, remember to load m_spoof on all servers
36 * I am connected to, or you'll get plenty of "Unknown command" errors...
37 */
38 #define PROPAGATE_SPOOF
39
40 /*
41 * this server is allowed to receive spoofs/delspoofs from other servers.
42 * Use in conjunction with PROPAGATE_SPOOF (on target servers).
43 */
44 #define RECEIVE_SPOOF
45
46 /* where to put dynamic auth's -- this must be included from ircd.conf!
47 * Ideally put .include "spoof.conf" before all other auths.
48 * #undef if you want only a propagating hub server, not storing any data */
49 #define SPOOF_FILE "etc/spoof.conf"
50
51 /* disable if you don't want opers notices/logs */
52 #define LOG_SPOOF
53
54
55 /* END OF MODULE CONFIGURATION */
56
57 /* Usage: SPOOF <umask@hmask> <free.form.spoof|-> [flags|- [password]]
58 * -- Appends an auth{} block. Flags consist of characters:
59 * t (no_tilde), i (need_ident), k (kline_exempt),
60 * g (gline_exempt), l (exceed_limit), o (class = "opers"),
61 * f (can_flood), p (need_password), everything other is ignored.
62 * DELSPOOF <umask@hmask>
63 * -- Removes an auth{} block of exact umask@hmask, if found
64 *
65 * These commands are restricted to admins, so make sure your oper{} block
66 * has admin = yes or so.
67 */
68
69 #if !defined(PROPAGATE_SPOOF) && !defined(SPOOF_FILE)
70 #error You disabled both SPOOF_FILE and PROPAGATE_SPOOF, what do you expect me to do?
71 #endif
72
73 /* List of ircd includes from ../include/ */
74 #include "stdinc.h"
75 #include "conf/conf.h"
76 #include "handlers.h"
77 #include "client.h"
78 #include "common.h" /* FALSE bleah */
79 #include "hash.h"
80 #include "ircd.h"
81 #include "numeric.h"
82 #include "server.h"
83 #include "send.h"
84 #include "msg.h"
85 #include "parse.h"
86
87 static void mo_spoof(struct Client *, struct Client *, int, char *[]);
88 static void mo_delspoof(struct Client *, struct Client *, int, char *[]);
89
90 struct Message spoof_msgtab = {
91 "SPOOF", 0, 0, 3, 0, MFLG_SLOW, 0,
92 #ifdef RECEIVE_SPOOF
93 {m_unregistered, m_not_oper, mo_spoof, m_ignore, mo_spoof, m_ignore}
94 #else
95 {m_unregistered, m_not_oper, m_ignore, m_ignore, mo_spoof, m_ignore}
96 #endif
97 };
98
99 struct Message delspoof_msgtab = {
100 "DELSPOOF", 0, 0, 1, 0, MFLG_SLOW, 0,
101 #ifdef RECEIVE_SPOOF
102 {m_unregistered, m_not_oper, mo_delspoof, m_ignore, mo_delspoof, m_ignore}
103 #else
104 {m_unregistered, m_not_oper, m_ignore, m_ignore, mo_delspoof, m_ignore}
105 #endif
106 };
107
108 INIT_MODULE(m_spoof, "$Revision$")
109 {
110 mod_add_cmd(&spoof_msgtab);
111 mod_add_cmd(&delspoof_msgtab);
112 }
113
114 CLEANUP_MODULE
115 {
116 mod_del_cmd(&delspoof_msgtab);
117 mod_del_cmd(&spoof_msgtab);
118 }
119
120 #ifdef SPOOF_FILE
121 static void
122 try_flag(FBFILE *f, int *flags, int flag, const char *string)
123 {
124 if ((*flags & flag))
125 {
126 fbputs(string, f, strlen(string));
127
128 *flags &= ~flag;
129 fbputs(*flags ? ", " : ";\n", f, 2);
130 }
131 }
132 #endif
133
134 static void
135 mo_spoof(struct Client *client_p, struct Client *source_p,
136 int parc, char *parv[])
137 {
138 char *host, *spoof, *password;
139 const char *tmp = NULL;
140 const char *user = NULL;
141 const char *flags = NULL;
142 int i = 0;
143 #ifdef SPOOF_FILE
144 int class_opers;
145 FBFILE *f;
146 char buffer[1024];
147 #endif
148
149 if (MyConnect(source_p) && !IsOperAdmin(source_p))
150 {
151 sendto_one(source_p, form_str(ERR_NOPRIVS),
152 me.name, source_p->name, "SPOOF");
153 return;
154 }
155
156 /* check the user@host mask */
157 if (strchr(parv[1], '!') != NULL)
158 {
159 syntax:
160 if (MyConnect(source_p))
161 sendto_one(source_p, ":%s NOTICE %s :Syntax: SPOOF <umask@hmask> "
162 "<spoof/-> [flags/- [password]]", me.name, source_p->name);
163 return;
164 }
165
166 (void) collapse(parv[1]);
167
168 for (tmp = parv[1]; *tmp; tmp++)
169 if (!IsKWildChar(*tmp))
170 if (++i >= General.min_nonwildcard)
171 break;
172 if (i < General.min_nonwildcard)
173 {
174 if (MyConnect(source_p))
175 sendto_one(source_p, ":%s NOTICE %s :Not enough non-wildcard characters "
176 "in user@host mask",
177 me.name, source_p->name);
178 return;
179 }
180
181 host = strchr(parv[1], '@');
182 if (host)
183 {
184 user = parv[1];
185 *host = '\0';
186 host++;
187 }
188 else
189 {
190 user = "*";
191 host = parv[1];
192 }
193
194 /* check the spoof field */
195 spoof = parv[2];
196 if (spoof == NULL || !*spoof)
197 goto syntax;
198
199 if (spoof[0] != '-' || spoof[1] != '\0')
200 {
201 for (tmp = spoof; *tmp; tmp++)
202 if (!IsHostChar(*tmp)) {
203 if (MyConnect(source_p))
204 sendto_one(source_p, ":%s NOTICE %s :The spoof [%s] is invalid",
205 me.name, source_p->name, spoof);
206 return;
207 }
208 if (strlen(spoof) >= HOSTLEN) {
209 if (MyConnect(source_p))
210 sendto_one(source_p, ":%s NOTICE %s :Spoofs must be less than %d.."
211 "ignoring it", me.name, source_p->name, HOSTLEN);
212 return;
213 }
214 }
215
216 flags = (parc > 3) ? parv[3] : "-";
217 password = (parc > 4 && parv[4][0]) ? parv[4] : NULL;
218
219 #ifdef PROPAGATE_SPOOF
220 sendto_server(client_p, source_p, NULL, NOCAPS, NOCAPS,
221 ":%s SPOOF %s@%s %s %s :%s",
222 source_p->name, user, host, spoof, flags, password ? password : "");
223 #endif
224
225 #ifdef SPOOF_FILE
226 /* Walk through auth {} items and check if we have another auth block
227 * for this hostname */
228 if (find_exact_access_conf(acb_type_auth, user, host))
229 {
230 // auth entry already exists
231 if (MyConnect(source_p))
232 sendto_one(source_p,
233 ":%s NOTICE %s :auth for %s@%s already exists, you need "
234 "to use /DELSPOOF first", me.name, source_p->name, user, host);
235 #ifdef LOG_SPOOF
236 sendto_realops_flags(UMODE_ALL, L_ALL,
237 "%s attemped to re-add auth for %s@%s "
238 "[spoof: %s, flags: %s]", source_p->name, user, host,
239 spoof, flags);
240 #endif
241 return;
242 }
243
244 // Add the spoof to the the spoof file
245 if ((f = fbopen(SPOOF_FILE, "a")) == NULL)
246 {
247 sendto_realops_flags(UMODE_ALL, L_ALL,
248 "Could not open %s file, auth for %s@%s "
249 "[spoof: %s, flags: %s, requested by %s] not added",
250 SPOOF_FILE, user, host, spoof, flags, source_p->name);
251 return;
252 }
253
254 /* write the auth {} block */
255 fbputs("auth {\n", f, 7);
256 i = ircsprintf(buffer, "\tuser = \"%s@%s\";\n", user, host);
257 fbputs(buffer, f, i);
258 if (spoof[0] != '-' || spoof[1] != '\0')
259 {
260 i = ircsprintf(buffer, "\tspoof = \"%s\";\n", spoof);
261 fbputs(buffer, f, i);
262 }
263 if (password)
264 {
265 i = ircsprintf(buffer, "\tpassword = \"%s\";\n", password);
266 fbputs(buffer, f, i);
267 }
268
269 /* process given flags */
270 i = class_opers = 0;
271 for (tmp = flags; *tmp; ++tmp)
272 switch (*tmp)
273 {
274 case 't': i |= AUTH_FLAG_NO_TILDE; /* no_tilde = yes; */
275 break;
276 case 'i': i |= AUTH_FLAG_NEED_IDENT; /* need_ident = yes; */
277 break;
278 case 'k': i |= AUTH_FLAG_KLINE_EXEMPT; /* kline_exempt = yes; */
279 break;
280 case 'g': i |= AUTH_FLAG_GLINE_EXEMPT; /* gline_exempt = yes; */
281 break;
282 case 'l': i |= AUTH_FLAG_EXCEED_LIMIT; /* exceed_limit = yes; */
283 break;
284 case 'o': class_opers = 1; /* class = "opers"; */
285 break;
286 case 'f': i |= AUTH_FLAG_CAN_FLOOD; /* can_flood = yes; */
287 break;
288 case 'p': i|= AUTH_FLAG_NEED_PASSWORD; /* need_password = yes; */
289 }
290
291 if (i)
292 {
293 fbputs("\tflags = ", f, 9);
294 try_flag(f, &i, AUTH_FLAG_NO_TILDE, "no_tilde");
295 try_flag(f, &i, AUTH_FLAG_NEED_IDENT, "need_ident");
296 try_flag(f, &i, AUTH_FLAG_KLINE_EXEMPT, "kline_exempt");
297 try_flag(f, &i, AUTH_FLAG_GLINE_EXEMPT, "gline_exempt");
298 try_flag(f, &i, AUTH_FLAG_EXCEED_LIMIT, "exceed_limit");
299 try_flag(f, &i, AUTH_FLAG_CAN_FLOOD, "can_flood");
300 try_flag(f, &i, AUTH_FLAG_NEED_PASSWORD, "need_password");
301 }
302
303 if (class_opers)
304 fbputs("\tclass = \"opers\";\n", f, 18);
305 else
306 fbputs("\tclass = \"users\";\n", f, 18);
307
308 fbputs("};\n\n", f, 4);
309 fbclose(f);
310
311 read_conf_files(NO);
312 #endif
313
314 #ifdef LOG_SPOOF
315 sendto_realops_flags(UMODE_ALL, L_ALL,
316 "%s added auth for %s@%s [spoof: %s, flags: %s]",
317 source_p->name, user, host, spoof, flags);
318 ilog(L_TRACE, "%s added auth for %s@%s [spoof: %s, flags: %s]",
319 source_p->name, user, host, spoof, flags);
320 #endif
321 }
322
323 /* Now, our job is a bit harder. I will scan through the SPOOF_FILE
324 * and read all auths{} (assuming they are written in our line formatting..),
325 * then rewrite them skipping the one to delete. --adx */
326 static void
327 mo_delspoof(struct Client *client_p, struct Client *source_p,
328 int parc, char *parv[])
329 {
330 #ifdef SPOOF_FILE
331 FBFILE *f, *fout;
332 int ignore_it = 1, spoof_found = 0;
333 char buffer[1024], *tmp;
334 #endif
335 const char *user = NULL;
336 char *host = NULL;
337
338 if (MyConnect(source_p) && !IsOperAdmin(source_p))
339 {
340 sendto_one(source_p, form_str(ERR_NOPRIVS), me.name, parv[0], "DELSPOOF");
341 return;
342 }
343
344 if (parv[1] == NULL || !*parv[1])
345 {
346 if (MyConnect(source_p))
347 sendto_one(source_p, ":%s NOTICE %s :Syntax: /DELSPOOF <user@host>",
348 me.name, source_p->name);
349 return;
350 }
351
352 /* check user@host mask */
353 (void) collapse(parv[1]);
354
355 host = strchr(parv[1], '@');
356 if (host != NULL)
357 {
358 user = parv[1];
359 *host = '\0';
360 host++;
361 }
362 else
363 {
364 user = "*";
365 host = parv[1];
366 }
367
368 #ifdef PROPAGATE_SPOOF
369 sendto_server(client_p, source_p, NULL, NOCAPS, NOCAPS,
370 ":%s DELSPOOF %s@%s", source_p->name, user, host);
371 #endif
372
373 #ifdef SPOOF_FILE
374 if ((f = fbopen(SPOOF_FILE, "r")) == NULL)
375 {
376 sendto_realops_flags(UMODE_ALL, L_ALL,
377 "Could not open %s file, auth for %s@%s not deleted "
378 "(requested by %s)",
379 SPOOF_FILE, user, host, source_p->name);
380 return;
381 }
382
383 if ((fout = fbopen(SPOOF_FILE ".new", "w")) == NULL)
384 {
385 sendto_realops_flags(UMODE_ALL, L_ALL,
386 "Could not create %s.new file, auth for %s@%s not "
387 "deleted (requested by %s)",
388 SPOOF_FILE, user, host, source_p->name);
389 return;
390 }
391
392 while (fbgets(buffer, 1024, f))
393 {
394 if (!ircncmp(buffer, "auth {", 6))
395 {
396 /* don't process it yet.. we have to check whether the user="..."; field
397 * matches the user@host mask which is being deleted
398 */
399 ignore_it = 1;
400 continue;
401 }
402
403 /* a simple parser substitute... */
404 for (tmp = buffer; *tmp == '\t' || *tmp == ' '; tmp++)
405 ;
406 if (!ircncmp(tmp, "user", 4))
407 {
408 for (tmp += 4; *tmp == '\t' || *tmp == ' '; tmp++)
409 ;
410 if (*tmp == '=') {
411 for (++tmp; *tmp == '\t' || *tmp == ' '; tmp++)
412 ;
413 if (*tmp == '\"')
414 {
415 /* yuppi, we've just reached the user="..."; field */
416 int matches;
417 char *tmp2 = strchr(++tmp, '\"');
418
419 if (tmp2 != NULL)
420 *tmp2 = '\0';
421 tmp2 = strchr(tmp, '@');
422
423 /* is it matching our mask? */
424 if (tmp2 == NULL)
425 matches = !irccmp(user, "*") && !irccmp(host, tmp);
426 else
427 {
428 *tmp2++ = '\0';
429 matches = !irccmp(user, tmp) && !irccmp(host, tmp2);
430 }
431
432 if (!matches)
433 {
434 /* no.. so leave it unchanged */
435 if (ignore_it)
436 {
437 ignore_it = 0;
438 fbputs("auth {\n", fout, 7);
439 /* user="..." should be the first field in the auth {}; block,
440 * otherwise we could have problems...
441 */
442 }
443
444 fbputs("\tuser = \"", fout, 9);
445 if (tmp2 == NULL)
446 fbputs("*", fout, 1);
447 else
448 fbputs(tmp, fout, strlen(tmp));
449 fbputs("@", fout, 1);
450 fbputs(tmp2, fout, strlen(tmp2));
451 fbputs("\";\n", fout, 3);
452 }
453 else
454 {
455 /* we've got it! - omit and continue working */
456 spoof_found = 1;
457 }
458
459 continue;
460 }
461 }
462 }
463
464 if (!ignore_it)
465 fbputs(buffer, fout, strlen(buffer));
466 }
467
468 fbclose(f);
469 fbclose(fout);
470
471 if (!spoof_found)
472 {
473 if (MyConnect(source_p))
474 sendto_one(source_p, ":%s NOTICE %s :No auth for %s@%s found",
475 me.name, source_p->name, user, host);
476 unlink(SPOOF_FILE ".new");
477 return;
478 }
479
480 unlink(SPOOF_FILE);
481 rename(SPOOF_FILE ".new", SPOOF_FILE);
482 read_conf_files(NO);
483 #endif
484
485 #ifdef LOG_SPOOF
486 sendto_realops_flags(UMODE_ALL, L_ALL, "%s deleted auth for %s@%s",
487 source_p->name, user, host);
488 #endif
489 }

Properties

Name Value
svn:eol-style native
svn:keywords Id Revision