trunk/modules/m_challenge.c

/*
 *  ircd-hybrid: an advanced Internet Relay Chat Daemon(ircd).
 *  m_challenge.c: Allows an IRC Operator to securely authenticate.
 *
 *  Copyright (C) 2002 by the past and present ircd coders, and others.
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2 of the License, or
 *  (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License
 *  along with this program; if not, write to the Free Software
 *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307
 *  USA
 *
 *  $Id$
 */

#include "stdinc.h"
#ifdef HAVE_LIBCRYPTO
#include "client.h"
#include "ircd.h"
#include "modules.h"
#include "numeric.h"
#include "send.h"
#include "s_conf.h"
#include "rsa.h"
#include "parse.h"
#include "irc_string.h"
#include "s_log.h"
#include "s_user.h"


/* failed_challenge_notice()
 *
 * inputs       - pointer to client doing /oper ...
 *              - pointer to nick they tried to oper as
 *              - pointer to reason they have failed
 * output       - nothing
 * side effects - notices all opers of the failed oper attempt if enabled
 */
static void
failed_challenge_notice(struct Client *source_p, const char *name,
                        const char *reason)
{
  if (ConfigFileEntry.failed_oper_notice)
    sendto_realops_flags(UMODE_ALL, L_ALL, "Failed CHALLENGE attempt as %s "
                         "by %s (%s@%s) - %s", name, source_p->name,
                         source_p->username, source_p->host, reason);
}

/*
 * m_challenge - generate RSA challenge for wouldbe oper
 * parv[0] = sender prefix
 * parv[1] = operator to challenge for, or +response
 *
 */
static void
m_challenge(struct Client *client_p, struct Client *source_p,
            int parc, char *parv[])
{
  char *challenge = NULL;
  struct ConfItem *conf = NULL;
  struct AccessItem *aconf = NULL;

  /* if theyre an oper, reprint oper motd and ignore */
  if (HasUMode(source_p, UMODE_OPER))
  {
    sendto_one(source_p, form_str(RPL_YOUREOPER), me.name, source_p->name);
    send_message_file(source_p, &ConfigFileEntry.opermotd);
    return;
  }

  if (*parv[1] == '+')
  {
    /* Ignore it if we aren't expecting this... -A1kmm */
    if (source_p->localClient->response == NULL)
      return;

    if (irccmp(source_p->localClient->response, ++parv[1]))
    {
      sendto_one(source_p, form_str(ERR_PASSWDMISMATCH), me.name,
                 source_p->name);
      failed_challenge_notice(source_p, source_p->localClient->auth_oper,
                              "challenge failed");
      return;
    }
    
    conf = find_exact_name_conf(OPER_TYPE,
                                source_p->localClient->auth_oper,
                                source_p->username, source_p->host);
    if (conf == NULL)
      conf = find_exact_name_conf(OPER_TYPE,
                                  source_p->localClient->auth_oper,
                                  source_p->username, source_p->sockhost);
    if (conf == NULL)
    {
      sendto_one (source_p, form_str(ERR_NOOPERHOST), me.name, source_p->name);
      log_oper_action(LOG_FAILED_OPER_TYPE, source_p, "%s\n",
                      source_p->localClient->auth_oper);
      return;
    }

    if (attach_conf(source_p, conf) != 0)
    {
      sendto_one(source_p,":%s NOTICE %s :Can't attach conf!",
                 me.name, source_p->name);   
      failed_challenge_notice(source_p, conf->name, "can't attach conf!");
      log_oper_action(LOG_FAILED_OPER_TYPE, source_p, "%s\n", 
                      source_p->localClient->auth_oper);
      return;
    }

    oper_up(source_p);

    ilog(L_TRACE, "OPER %s by %s!%s@%s",
         source_p->localClient->auth_oper, source_p->name, source_p->username,
         source_p->host);
    log_oper_action(LOG_OPER_TYPE, source_p,
                    "%s\n", source_p->localClient->auth_oper);

    MyFree(source_p->localClient->response);
    MyFree(source_p->localClient->auth_oper);
    source_p->localClient->response  = NULL;
    source_p->localClient->auth_oper = NULL;
    return;
  }

  MyFree(source_p->localClient->response);
  MyFree(source_p->localClient->auth_oper);
  source_p->localClient->response  = NULL;
  source_p->localClient->auth_oper = NULL;

  if ((conf = find_conf_exact(OPER_TYPE,
                              parv[1], source_p->username, source_p->host
                              )) != NULL)
    aconf = map_to_conf(conf);
  else if ((conf = find_conf_exact(OPER_TYPE,
                                   parv[1], source_p->username,
                                   source_p->sockhost)) != NULL)
    aconf = map_to_conf(conf);

  if (aconf == NULL)
  {
    sendto_one (source_p, form_str(ERR_NOOPERHOST), me.name, source_p->name);
    conf = find_exact_name_conf(OPER_TYPE, parv[1], NULL, NULL);
    failed_challenge_notice(source_p, parv[1], (conf != NULL)
                            ? "host mismatch" : "no oper {} block");
    log_oper_action(LOG_FAILED_OPER_TYPE, source_p, "%s\n", parv[1]);
    return;
  }

  if (aconf->rsa_public_key == NULL)
  {
    sendto_one (source_p, ":%s NOTICE %s :I'm sorry, PK authentication "
                "is not enabled for your oper{} block.", me.name,
                source_p->name);
    return;
  }

  if (!generate_challenge(&challenge, &(source_p->localClient->response),
                          aconf->rsa_public_key))
    sendto_one(source_p, form_str(RPL_RSACHALLENGE),
               me.name, source_p->name, challenge);

  DupString(source_p->localClient->auth_oper, conf->name);
  MyFree(challenge);
}

static struct Message challenge_msgtab = {
  "CHALLENGE", 0, 0, 2, MAXPARA, MFLG_SLOW, 0,
  { m_unregistered, m_challenge, m_ignore, m_ignore, m_challenge, m_ignore }
};

static void
module_init(void)
{
  mod_add_cmd(&challenge_msgtab);
}

static void
module_exit(void)
{
  mod_del_cmd(&challenge_msgtab);
}

struct module module_entry = {
  .node    = { NULL, NULL, NULL },
  .name    = NULL,
  .version = "$Revision$",
  .handle  = NULL,
  .modinit = module_init,
  .modexit = module_exit,
  .flags   = 0
};
#endif
Revision:	1243
Committed:	Fri Sep 30 10:47:53 2011 UTC (13 years, 11 months ago) by michael
Content type:	text/x-csrc
Original Path:	*ircd-hybrid-8/modules/m_challenge.c*
File size:	6274 byte(s)
Log Message:	- move content of msg.h, ircd_handler.h and handlers.h into parse.h and remove headers accordingly - killed common.h - remove m_killhost.c and m_flags.c from contrib/ - sort out unused header includes here and there
#	User	Rev	Content
1	adx	30	/*
2			* ircd-hybrid: an advanced Internet Relay Chat Daemon(ircd).
3			* m_challenge.c: Allows an IRC Operator to securely authenticate.
4			*
5			* Copyright (C) 2002 by the past and present ircd coders, and others.
6			*
7			* This program is free software; you can redistribute it and/or modify
8			* it under the terms of the GNU General Public License as published by
9			* the Free Software Foundation; either version 2 of the License, or
10			* (at your option) any later version.
11			*
12			* This program is distributed in the hope that it will be useful,
13			* but WITHOUT ANY WARRANTY; without even the implied warranty of
14			* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15			* GNU General Public License for more details.
16			*
17			* You should have received a copy of the GNU General Public License
18			* along with this program; if not, write to the Free Software
19			* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
20			* USA
21			*
22	knight	31	* $Id$
23	adx	30	*/
24
25			#include "stdinc.h"
26	michael	912	#ifdef HAVE_LIBCRYPTO
27	adx	30	#include "client.h"
28			#include "ircd.h"
29			#include "modules.h"
30			#include "numeric.h"
31			#include "send.h"
32			#include "s_conf.h"
33			#include "rsa.h"
34			#include "parse.h"
35			#include "irc_string.h"
36			#include "s_log.h"
37			#include "s_user.h"
38
39
40	michael	1230	/* failed_challenge_notice()
41			*
42			* inputs - pointer to client doing /oper ...
43			* - pointer to nick they tried to oper as
44			* - pointer to reason they have failed
45			* output - nothing
46			* side effects - notices all opers of the failed oper attempt if enabled
47			*/
48			static void
49			failed_challenge_notice(struct Client source_p, const char name,
50			const char *reason)
51	adx	30	{
52	michael	1230	if (ConfigFileEntry.failed_oper_notice)
53			sendto_realops_flags(UMODE_ALL, L_ALL, "Failed CHALLENGE attempt as %s "
54			"by %s (%s@%s) - %s", name, source_p->name,
55			source_p->username, source_p->host, reason);
56	adx	30	}
57
58			/*
59			* m_challenge - generate RSA challenge for wouldbe oper
60			* parv[0] = sender prefix
61			* parv[1] = operator to challenge for, or +response
62			*
63			*/
64			static void
65			m_challenge(struct Client client_p, struct Client source_p,
66			int parc, char *parv[])
67			{
68	michael	817	char *challenge = NULL;
69			struct ConfItem *conf = NULL;
70			struct AccessItem *aconf = NULL;
71	adx	30
72			/* if theyre an oper, reprint oper motd and ignore */
73	michael	1219	if (HasUMode(source_p, UMODE_OPER))
74	adx	30	{
75	michael	1230	sendto_one(source_p, form_str(RPL_YOUREOPER), me.name, source_p->name);
76	adx	30	send_message_file(source_p, &ConfigFileEntry.opermotd);
77			return;
78			}
79
80			if (*parv[1] == '+')
81			{
82			/* Ignore it if we aren't expecting this... -A1kmm */
83	michael	817	if (source_p->localClient->response == NULL)
84	adx	30	return;
85
86			if (irccmp(source_p->localClient->response, ++parv[1]))
87			{
88			sendto_one(source_p, form_str(ERR_PASSWDMISMATCH), me.name,
89	michael	1121	source_p->name);
90	adx	30	failed_challenge_notice(source_p, source_p->localClient->auth_oper,
91	michael	1121	"challenge failed");
92	adx	30	return;
93			}
94	michael	817
95			conf = find_exact_name_conf(OPER_TYPE,
96			source_p->localClient->auth_oper,
97			source_p->username, source_p->host);
98			if (conf == NULL)
99			conf = find_exact_name_conf(OPER_TYPE,
100			source_p->localClient->auth_oper,
101			source_p->username, source_p->sockhost);
102			if (conf == NULL)
103	adx	30	{
104	michael	1230	sendto_one (source_p, form_str(ERR_NOOPERHOST), me.name, source_p->name);
105	adx	30	log_oper_action(LOG_FAILED_OPER_TYPE, source_p, "%s\n",
106			source_p->localClient->auth_oper);
107			return;
108			}
109
110			if (attach_conf(source_p, conf) != 0)
111			{
112			sendto_one(source_p,":%s NOTICE %s :Can't attach conf!",
113			me.name, source_p->name);
114			failed_challenge_notice(source_p, conf->name, "can't attach conf!");
115			log_oper_action(LOG_FAILED_OPER_TYPE, source_p, "%s\n",
116			source_p->localClient->auth_oper);
117			return;
118			}
119
120			oper_up(source_p);
121
122			ilog(L_TRACE, "OPER %s by %s!%s@%s",
123			source_p->localClient->auth_oper, source_p->name, source_p->username,
124			source_p->host);
125			log_oper_action(LOG_OPER_TYPE, source_p,
126			"%s\n", source_p->localClient->auth_oper);
127
128			MyFree(source_p->localClient->response);
129			MyFree(source_p->localClient->auth_oper);
130			source_p->localClient->response = NULL;
131			source_p->localClient->auth_oper = NULL;
132			return;
133			}
134
135			MyFree(source_p->localClient->response);
136			MyFree(source_p->localClient->auth_oper);
137			source_p->localClient->response = NULL;
138			source_p->localClient->auth_oper = NULL;
139
140			if ((conf = find_conf_exact(OPER_TYPE,
141			parv[1], source_p->username, source_p->host
142			)) != NULL)
143	michael	817	aconf = map_to_conf(conf);
144	adx	30	else if ((conf = find_conf_exact(OPER_TYPE,
145			parv[1], source_p->username,
146			source_p->sockhost)) != NULL)
147	michael	817	aconf = map_to_conf(conf);
148	adx	30
149	michael	817	if (aconf == NULL)
150	adx	30	{
151	michael	1230	sendto_one (source_p, form_str(ERR_NOOPERHOST), me.name, source_p->name);
152	adx	30	conf = find_exact_name_conf(OPER_TYPE, parv[1], NULL, NULL);
153			failed_challenge_notice(source_p, parv[1], (conf != NULL)
154			? "host mismatch" : "no oper {} block");
155			log_oper_action(LOG_FAILED_OPER_TYPE, source_p, "%s\n", parv[1]);
156			return;
157			}
158
159			if (aconf->rsa_public_key == NULL)
160			{
161			sendto_one (source_p, ":%s NOTICE %s :I'm sorry, PK authentication "
162			"is not enabled for your oper{} block.", me.name,
163	michael	1230	source_p->name);
164	adx	30	return;
165			}
166
167			if (!generate_challenge(&challenge, &(source_p->localClient->response),
168			aconf->rsa_public_key))
169			sendto_one(source_p, form_str(RPL_RSACHALLENGE),
170	michael	1230	me.name, source_p->name, challenge);
171	adx	30
172			DupString(source_p->localClient->auth_oper, conf->name);
173			MyFree(challenge);
174			}
175
176	michael	1230	static struct Message challenge_msgtab = {
177			"CHALLENGE", 0, 0, 2, MAXPARA, MFLG_SLOW, 0,
178			{ m_unregistered, m_challenge, m_ignore, m_ignore, m_challenge, m_ignore }
179			};
180
181	adx	30	static void
182	michael	1230	module_init(void)
183	adx	30	{
184	michael	1230	mod_add_cmd(&challenge_msgtab);
185	adx	30	}
186	michael	1230
187			static void
188			module_exit(void)
189			{
190			mod_del_cmd(&challenge_msgtab);
191			}
192
193			struct module module_entry = {
194			.node = { NULL, NULL, NULL },
195			.name = NULL,
196			.version = "$Revision$",
197			.handle = NULL,
198			.modinit = module_init,
199			.modexit = module_exit,
200			.flags = 0
201			};
202	michael	912	#endif