trunk/modules/m_challenge.c

/*
 *  ircd-hybrid: an advanced Internet Relay Chat Daemon(ircd).
 *  m_challenge.c: Allows an IRC Operator to securely authenticate.
 *
 *  Copyright (C) 2002 by the past and present ircd coders, and others.
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2 of the License, or
 *  (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License
 *  along with this program; if not, write to the Free Software
 *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307
 *  USA
 *
 *  $Id$
 */

#include "stdinc.h"
#include "client.h"
#include "ircd.h"
#include "modules.h"
#include "numeric.h"
#include "send.h"
#include "conf.h"
#include "rsa.h"
#include "parse.h"
#include "irc_string.h"
#include "log.h"
#include "s_user.h"


#ifdef HAVE_LIBCRYPTO
/* failed_challenge_notice()
 *
 * inputs       - pointer to client doing /oper ...
 *              - pointer to nick they tried to oper as
 *              - pointer to reason they have failed
 * output       - nothing
 * side effects - notices all opers of the failed oper attempt if enabled
 */
static void
failed_challenge_notice(struct Client *source_p, const char *name,
                        const char *reason)
{
  if (ConfigFileEntry.failed_oper_notice)
    sendto_realops_flags(UMODE_ALL, L_ALL, "Failed CHALLENGE attempt as %s "
                         "by %s (%s@%s) - %s", name, source_p->name,
                         source_p->username, source_p->host, reason);

  ilog(LOG_TYPE_OPER, "Failed CHALLENGE attempt as %s "
       "by %s (%s@%s) - %s", name, source_p->name,
       source_p->username, source_p->host, reason);
}

/*
 * m_challenge - generate RSA challenge for wouldbe oper
 * parv[0] = sender prefix
 * parv[1] = operator to challenge for, or +response
 *
 */
static void
m_challenge(struct Client *client_p, struct Client *source_p,
            int parc, char *parv[])
{
  char *challenge = NULL;
  struct ConfItem *conf = NULL;
  struct AccessItem *aconf = NULL;

  /* if theyre an oper, reprint oper motd and ignore */
  if (HasUMode(source_p, UMODE_OPER))
  {
    sendto_one(source_p, form_str(RPL_YOUREOPER),
               me.name, source_p->name);
    return;
  }

  if (*parv[1] == '+')
  {
    /* Ignore it if we aren't expecting this... -A1kmm */
    if (source_p->localClient->response == NULL)
      return;

    if (irccmp(source_p->localClient->response, ++parv[1]))
    {
      sendto_one(source_p, form_str(ERR_PASSWDMISMATCH), me.name,
                 source_p->name);
      failed_challenge_notice(source_p, source_p->localClient->auth_oper,
                              "challenge failed");
      return;
    }
    
    conf = find_exact_name_conf(OPER_TYPE, source_p,
                                source_p->localClient->auth_oper, NULL, NULL);
    if (conf == NULL)
    {
      /* XXX: logging */
      sendto_one (source_p, form_str(ERR_NOOPERHOST), me.name, source_p->name);
      return;
    }

    if (attach_conf(source_p, conf) != 0)
    {
      sendto_one(source_p,":%s NOTICE %s :Can't attach conf!",
                 me.name, source_p->name);   
      failed_challenge_notice(source_p, conf->name, "can't attach conf!");
      return;
    }

    oper_up(source_p);

    ilog(LOG_TYPE_OPER, "OPER %s by %s!%s@%s",
         source_p->localClient->auth_oper, source_p->name, source_p->username,
         source_p->host);

    MyFree(source_p->localClient->response);
    MyFree(source_p->localClient->auth_oper);
    source_p->localClient->response  = NULL;
    source_p->localClient->auth_oper = NULL;
    return;
  }

  MyFree(source_p->localClient->response);
  MyFree(source_p->localClient->auth_oper);
  source_p->localClient->response  = NULL;
  source_p->localClient->auth_oper = NULL;

  if ((conf = find_conf_exact(OPER_TYPE,
                              parv[1], source_p->username, source_p->host
                              )) != NULL)
    aconf = map_to_conf(conf);
  else if ((conf = find_conf_exact(OPER_TYPE,
                                   parv[1], source_p->username,
                                   source_p->sockhost)) != NULL)
    aconf = map_to_conf(conf);

  if (aconf == NULL)
  {
    sendto_one (source_p, form_str(ERR_NOOPERHOST), me.name, source_p->name);
    conf = find_exact_name_conf(OPER_TYPE, NULL, parv[1], NULL, NULL);
    failed_challenge_notice(source_p, parv[1], (conf != NULL)
                            ? "host mismatch" : "no oper {} block");
    return;
  }

  if (aconf->rsa_public_key == NULL)
  {
    sendto_one (source_p, ":%s NOTICE %s :I'm sorry, PK authentication "
                "is not enabled for your oper{} block.", me.name,
                source_p->name);
    return;
  }

  if (!generate_challenge(&challenge, &(source_p->localClient->response),
                          aconf->rsa_public_key))
    sendto_one(source_p, form_str(RPL_RSACHALLENGE),
               me.name, source_p->name, challenge);

  DupString(source_p->localClient->auth_oper, conf->name);
  MyFree(challenge);
}

static struct Message challenge_msgtab = {
  "CHALLENGE", 0, 0, 2, MAXPARA, MFLG_SLOW, 0,
  { m_unregistered, m_challenge, m_ignore, m_ignore, m_challenge, m_ignore }
};

static void
module_init(void)
{
  mod_add_cmd(&challenge_msgtab);
}

static void
module_exit(void)
{
  mod_del_cmd(&challenge_msgtab);
}

#else

static void
module_init(void)
{
}

static void
module_exit(void)
{
}
#endif

struct module module_entry = {
  .node    = { NULL, NULL, NULL },
  .name    = NULL,
  .version = "$Revision$",
  .handle  = NULL,
  .modinit = module_init,
  .modexit = module_exit,
  .flags   = 0
};
Revision:	1446
Committed:	Mon Jun 25 20:05:12 2012 UTC (13 years, 2 months ago) by michael
Content type:	text/x-csrc
Original Path:	*ircd-hybrid-8/modules/m_challenge.c*
File size:	5868 byte(s)
Log Message:	- Removed OMOTD --- Diese und die folgenden Zeilen werden ignoriert -- M include/defaults.h M include/conf.h M include/numeric.h M include/motd.h M src/s_user.c M src/messages.tab M src/motd.c M src/ircd.c M modules/Makefile.in M modules/m_challenge.c M modules/m_oper.c D modules/m_omotd.c M modules/m_rehash.c M modules/Makefile.am M NEWS
#	Content
1	/*
2	* ircd-hybrid: an advanced Internet Relay Chat Daemon(ircd).
3	* m_challenge.c: Allows an IRC Operator to securely authenticate.
4	*
5	* Copyright (C) 2002 by the past and present ircd coders, and others.
6	*
7	* This program is free software; you can redistribute it and/or modify
8	* it under the terms of the GNU General Public License as published by
9	* the Free Software Foundation; either version 2 of the License, or
10	* (at your option) any later version.
11	*
12	* This program is distributed in the hope that it will be useful,
13	* but WITHOUT ANY WARRANTY; without even the implied warranty of
14	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15	* GNU General Public License for more details.
16	*
17	* You should have received a copy of the GNU General Public License
18	* along with this program; if not, write to the Free Software
19	* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
20	* USA
21	*
22	* $Id$
23	*/
24
25	#include "stdinc.h"
26	#include "client.h"
27	#include "ircd.h"
28	#include "modules.h"
29	#include "numeric.h"
30	#include "send.h"
31	#include "conf.h"
32	#include "rsa.h"
33	#include "parse.h"
34	#include "irc_string.h"
35	#include "log.h"
36	#include "s_user.h"
37
38
39	#ifdef HAVE_LIBCRYPTO
40	/* failed_challenge_notice()
41	*
42	* inputs - pointer to client doing /oper ...
43	* - pointer to nick they tried to oper as
44	* - pointer to reason they have failed
45	* output - nothing
46	* side effects - notices all opers of the failed oper attempt if enabled
47	*/
48	static void
49	failed_challenge_notice(struct Client source_p, const char name,
50	const char *reason)
51	{
52	if (ConfigFileEntry.failed_oper_notice)
53	sendto_realops_flags(UMODE_ALL, L_ALL, "Failed CHALLENGE attempt as %s "
54	"by %s (%s@%s) - %s", name, source_p->name,
55	source_p->username, source_p->host, reason);
56
57	ilog(LOG_TYPE_OPER, "Failed CHALLENGE attempt as %s "
58	"by %s (%s@%s) - %s", name, source_p->name,
59	source_p->username, source_p->host, reason);
60	}
61
62	/*
63	* m_challenge - generate RSA challenge for wouldbe oper
64	* parv[0] = sender prefix
65	* parv[1] = operator to challenge for, or +response
66	*
67	*/
68	static void
69	m_challenge(struct Client client_p, struct Client source_p,
70	int parc, char *parv[])
71	{
72	char *challenge = NULL;
73	struct ConfItem *conf = NULL;
74	struct AccessItem *aconf = NULL;
75
76	/* if theyre an oper, reprint oper motd and ignore */
77	if (HasUMode(source_p, UMODE_OPER))
78	{
79	sendto_one(source_p, form_str(RPL_YOUREOPER),
80	me.name, source_p->name);
81	return;
82	}
83
84	if (*parv[1] == '+')
85	{
86	/* Ignore it if we aren't expecting this... -A1kmm */
87	if (source_p->localClient->response == NULL)
88	return;
89
90	if (irccmp(source_p->localClient->response, ++parv[1]))
91	{
92	sendto_one(source_p, form_str(ERR_PASSWDMISMATCH), me.name,
93	source_p->name);
94	failed_challenge_notice(source_p, source_p->localClient->auth_oper,
95	"challenge failed");
96	return;
97	}
98
99	conf = find_exact_name_conf(OPER_TYPE, source_p,
100	source_p->localClient->auth_oper, NULL, NULL);
101	if (conf == NULL)
102	{
103	/* XXX: logging */
104	sendto_one (source_p, form_str(ERR_NOOPERHOST), me.name, source_p->name);
105	return;
106	}
107
108	if (attach_conf(source_p, conf) != 0)
109	{
110	sendto_one(source_p,":%s NOTICE %s :Can't attach conf!",
111	me.name, source_p->name);
112	failed_challenge_notice(source_p, conf->name, "can't attach conf!");
113	return;
114	}
115
116	oper_up(source_p);
117
118	ilog(LOG_TYPE_OPER, "OPER %s by %s!%s@%s",
119	source_p->localClient->auth_oper, source_p->name, source_p->username,
120	source_p->host);
121
122	MyFree(source_p->localClient->response);
123	MyFree(source_p->localClient->auth_oper);
124	source_p->localClient->response = NULL;
125	source_p->localClient->auth_oper = NULL;
126	return;
127	}
128
129	MyFree(source_p->localClient->response);
130	MyFree(source_p->localClient->auth_oper);
131	source_p->localClient->response = NULL;
132	source_p->localClient->auth_oper = NULL;
133
134	if ((conf = find_conf_exact(OPER_TYPE,
135	parv[1], source_p->username, source_p->host
136	)) != NULL)
137	aconf = map_to_conf(conf);
138	else if ((conf = find_conf_exact(OPER_TYPE,
139	parv[1], source_p->username,
140	source_p->sockhost)) != NULL)
141	aconf = map_to_conf(conf);
142
143	if (aconf == NULL)
144	{
145	sendto_one (source_p, form_str(ERR_NOOPERHOST), me.name, source_p->name);
146	conf = find_exact_name_conf(OPER_TYPE, NULL, parv[1], NULL, NULL);
147	failed_challenge_notice(source_p, parv[1], (conf != NULL)
148	? "host mismatch" : "no oper {} block");
149	return;
150	}
151
152	if (aconf->rsa_public_key == NULL)
153	{
154	sendto_one (source_p, ":%s NOTICE %s :I'm sorry, PK authentication "
155	"is not enabled for your oper{} block.", me.name,
156	source_p->name);
157	return;
158	}
159
160	if (!generate_challenge(&challenge, &(source_p->localClient->response),
161	aconf->rsa_public_key))
162	sendto_one(source_p, form_str(RPL_RSACHALLENGE),
163	me.name, source_p->name, challenge);
164
165	DupString(source_p->localClient->auth_oper, conf->name);
166	MyFree(challenge);
167	}
168
169	static struct Message challenge_msgtab = {
170	"CHALLENGE", 0, 0, 2, MAXPARA, MFLG_SLOW, 0,
171	{ m_unregistered, m_challenge, m_ignore, m_ignore, m_challenge, m_ignore }
172	};
173
174	static void
175	module_init(void)
176	{
177	mod_add_cmd(&challenge_msgtab);
178	}
179
180	static void
181	module_exit(void)
182	{
183	mod_del_cmd(&challenge_msgtab);
184	}
185
186	#else
187
188	static void
189	module_init(void)
190	{
191	}
192
193	static void
194	module_exit(void)
195	{
196	}
197	#endif
198
199	struct module module_entry = {
200	.node = { NULL, NULL, NULL },
201	.name = NULL,
202	.version = "$Revision$",
203	.handle = NULL,
204	.modinit = module_init,
205	.modexit = module_exit,
206	.flags = 0
207	};