ircd-hybrid/modules/m_challenge.c

/*
 *  ircd-hybrid: an advanced Internet Relay Chat Daemon(ircd).
 *  m_challenge.c: Allows an IRC Operator to securely authenticate.
 *
 *  Copyright (C) 2002 by the past and present ircd coders, and others.
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2 of the License, or
 *  (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License
 *  along with this program; if not, write to the Free Software
 *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307
 *  USA
 *
 *  $Id$
 */

#include "stdinc.h"
#include "handlers.h"
#include "client.h"
#include "ircd.h"
#include "modules.h"
#include "numeric.h"
#include "send.h"
#include "s_conf.h"
/* -lcrypto is implicit for building this module! */
#include "rsa.h"
#include "msg.h"
#include "parse.h"
#include "s_user.h"

static void failed_challenge_notice(struct Client *, const char *,
                                    const char *);
static void m_challenge(struct Client *, struct Client *, int, char **);

/* We have openssl support, so include /CHALLENGE */
struct Message challenge_msgtab = {
  "CHALLENGE", 0, 0, 2, 0, MFLG_SLOW, 0,
  { m_unregistered, m_challenge, m_ignore, m_ignore, m_challenge, m_ignore }
};

#ifndef STATIC_MODULES
void
_modinit(void)
{
  mod_add_cmd(&challenge_msgtab);
}

void
_moddeinit(void)
{
  mod_del_cmd(&challenge_msgtab);
}

const char *_version = "$Revision$";
#endif

/*
 * m_challenge - generate RSA challenge for wouldbe oper
 * parv[0] = sender prefix
 * parv[1] = operator to challenge for, or +response
 *
 */
static void
m_challenge(struct Client *client_p, struct Client *source_p,
            int parc, char *parv[])
{
  char *challenge;
  struct ConfItem *conf=NULL;
  struct AccessItem *aconf=NULL;

  assert(source_p->localClient);

  /* if theyre an oper, reprint oper motd and ignore */
  if (IsOper(source_p))
  {
    sendto_one(source_p, form_str(RPL_YOUREOPER), me.name, parv[0]);
    send_message_file(source_p, &ConfigFileEntry.opermotd);
    return;
  }

  if (*parv[1] == '+')
  {
    /* Ignore it if we aren't expecting this... -A1kmm */
    if (!source_p->localClient->response)
      return;

    if (irccmp(source_p->localClient->response, ++parv[1]))
    {
      sendto_one(source_p, form_str(ERR_PASSWDMISMATCH), me.name,
                 source_p->name);
      failed_challenge_notice(source_p, source_p->localClient->auth_oper,
                              "challenge failed");
      return;
    }
     
    if ((conf = find_exact_name_conf(OPER_TYPE,
                                     source_p->localClient->auth_oper,
                                     source_p->username, source_p->host
                                   )) == NULL)
    {
      sendto_one (source_p, form_str(ERR_NOOPERHOST), me.name, parv[0]);
      log_oper_action(LOG_FAILED_OPER_TYPE, source_p, "%s\n",
                      source_p->localClient->auth_oper);
      return;
    }

    oper_up(source_p, conf);

    ilog(L_TRACE, "OPER %s by %s!%s@%s",
         source_p->localClient->auth_oper, source_p->name, source_p->username,
         source_p->host);
    log_oper_action(LOG_OPER_TYPE, source_p,
                    "%s\n", source_p->localClient->auth_oper);

    MyFree(source_p->localClient->response);
    MyFree(source_p->localClient->auth_oper);
    source_p->localClient->response  = NULL;
    source_p->localClient->auth_oper = NULL;
    return;
  }

  MyFree(source_p->localClient->response);
  MyFree(source_p->localClient->auth_oper);
  source_p->localClient->response  = NULL;
  source_p->localClient->auth_oper = NULL;

  if ((conf = find_exact_name_conf(OPER_TYPE,
                                   parv[1], source_p->username, source_p->host
                                   )) != NULL)
  {
    aconf = (struct AccessItem *)map_to_conf(conf);
  }
  else if ((conf = find_exact_name_conf(OPER_TYPE,
                                        parv[1], source_p->username,
                                        source_p->sockhost)) != NULL)
  {
    aconf = (struct AccessItem *)map_to_conf(conf);
  }

  if(aconf == NULL)
  {
    sendto_one (source_p, form_str(ERR_NOOPERHOST), me.name, parv[0]);
    conf = find_exact_name_conf(OPER_TYPE, parv[1], NULL, NULL);
    failed_challenge_notice(source_p, parv[1], (conf != NULL)
                            ? "host mismatch" : "no oper {} block");
    log_oper_action(LOG_FAILED_OPER_TYPE, source_p, "%s\n", parv[1]);
    return;
  }

  if (aconf->rsa_public_key == NULL)
  {
    sendto_one (source_p, ":%s NOTICE %s :I'm sorry, PK authentication "
                "is not enabled for your oper{} block.", me.name,
                parv[0]);
    return;
  }

  if (!generate_challenge(&challenge, &(source_p->localClient->response),
                          aconf->rsa_public_key))
    sendto_one(source_p, form_str(RPL_RSACHALLENGE),
               me.name, parv[0], challenge);

  DupString(source_p->localClient->auth_oper, conf->name);
  MyFree(challenge);
}

/* failed_challenge_notice()
 *
 * inputs       - pointer to client doing /oper ...
 *              - pointer to nick they tried to oper as
 *              - pointer to reason they have failed
 * output       - nothing
 * side effects - notices all opers of the failed oper attempt if enabled
 */
static void
failed_challenge_notice(struct Client *source_p, const char *name,
                        const char *reason)
{
  if (ConfigFileEntry.failed_oper_notice)
    sendto_realops_flags(UMODE_ALL, L_ALL, "Failed CHALLENGE attempt as %s "
                         "by %s (%s@%s) - %s", name, source_p->name,
                         source_p->username, source_p->host, reason);
}
Revision:	101
Committed:	Mon Oct 10 03:52:14 2005 UTC (20 years, 10 months ago) by db
Content type:	text/x-csrc
File size:	5721 byte(s)
Log Message:	- First pass at s_conf.c cleanup for attach clients - attach_conf() is gone replaced with attach_iline() Clients/servers have one single I line "attached", i.e. the confs list is gone. - Add attach_leaf_hub() Add a leaf or hub mask to the given server, ->serv must exist since there can be a list of hub masks and leaf masks, this continues to be a dlink list - Removed redundant find_conf_exact() This function can be replaced in all cases with find_exact_name_conf() notably because all find_conf_exact did differently was count whether an oper conf would cause an already connected client to exceed class limits. - oper_up() now takes an extra conf pointer pointing to the found oper conf, the oper flags are set in the client->iline as necessary in oper_up() - Cleaned up more prototypes that should have been moved from s_conf.h to parse_aline.h notably. find_kill() and find_gkill() - m_stats.c needs more cleanup since memory in attached "confs" is now not counted. This should be replaced with iline memory count and hub/leaf confs memory count.
#	User	Rev	Content
1	adx	30	/*
2			* ircd-hybrid: an advanced Internet Relay Chat Daemon(ircd).
3			* m_challenge.c: Allows an IRC Operator to securely authenticate.
4			*
5			* Copyright (C) 2002 by the past and present ircd coders, and others.
6			*
7			* This program is free software; you can redistribute it and/or modify
8			* it under the terms of the GNU General Public License as published by
9			* the Free Software Foundation; either version 2 of the License, or
10			* (at your option) any later version.
11			*
12			* This program is distributed in the hope that it will be useful,
13			* but WITHOUT ANY WARRANTY; without even the implied warranty of
14			* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15			* GNU General Public License for more details.
16			*
17			* You should have received a copy of the GNU General Public License
18			* along with this program; if not, write to the Free Software
19			* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
20			* USA
21			*
22	knight	31	* $Id$
23	adx	30	*/
24
25			#include "stdinc.h"
26			#include "handlers.h"
27			#include "client.h"
28			#include "ircd.h"
29			#include "modules.h"
30			#include "numeric.h"
31			#include "send.h"
32			#include "s_conf.h"
33			/* -lcrypto is implicit for building this module! */
34			#include "rsa.h"
35			#include "msg.h"
36			#include "parse.h"
37			#include "s_user.h"
38
39			static void failed_challenge_notice(struct Client , const char ,
40			const char *);
41			static void m_challenge(struct Client , struct Client , int, char **);
42
43			/* We have openssl support, so include /CHALLENGE */
44			struct Message challenge_msgtab = {
45			"CHALLENGE", 0, 0, 2, 0, MFLG_SLOW, 0,
46			{ m_unregistered, m_challenge, m_ignore, m_ignore, m_challenge, m_ignore }
47			};
48
49			#ifndef STATIC_MODULES
50			void
51			_modinit(void)
52			{
53			mod_add_cmd(&challenge_msgtab);
54			}
55
56			void
57			_moddeinit(void)
58			{
59			mod_del_cmd(&challenge_msgtab);
60			}
61
62	knight	31	const char *_version = "$Revision$";
63	adx	30	#endif
64
65			/*
66			* m_challenge - generate RSA challenge for wouldbe oper
67			* parv[0] = sender prefix
68			* parv[1] = operator to challenge for, or +response
69			*
70			*/
71			static void
72			m_challenge(struct Client client_p, struct Client source_p,
73			int parc, char *parv[])
74			{
75			char *challenge;
76			struct ConfItem *conf=NULL;
77			struct AccessItem *aconf=NULL;
78
79			assert(source_p->localClient);
80
81			/* if theyre an oper, reprint oper motd and ignore */
82			if (IsOper(source_p))
83			{
84			sendto_one(source_p, form_str(RPL_YOUREOPER), me.name, parv[0]);
85			send_message_file(source_p, &ConfigFileEntry.opermotd);
86			return;
87			}
88
89			if (*parv[1] == '+')
90			{
91			/* Ignore it if we aren't expecting this... -A1kmm */
92			if (!source_p->localClient->response)
93			return;
94
95			if (irccmp(source_p->localClient->response, ++parv[1]))
96			{
97			sendto_one(source_p, form_str(ERR_PASSWDMISMATCH), me.name,
98			source_p->name);
99			failed_challenge_notice(source_p, source_p->localClient->auth_oper,
100			"challenge failed");
101			return;
102			}
103
104			if ((conf = find_exact_name_conf(OPER_TYPE,
105			source_p->localClient->auth_oper,
106			source_p->username, source_p->host
107			)) == NULL)
108			{
109			sendto_one (source_p, form_str(ERR_NOOPERHOST), me.name, parv[0]);
110			log_oper_action(LOG_FAILED_OPER_TYPE, source_p, "%s\n",
111			source_p->localClient->auth_oper);
112			return;
113			}
114
115	db	101	oper_up(source_p, conf);
116	adx	30
117			ilog(L_TRACE, "OPER %s by %s!%s@%s",
118			source_p->localClient->auth_oper, source_p->name, source_p->username,
119			source_p->host);
120			log_oper_action(LOG_OPER_TYPE, source_p,
121			"%s\n", source_p->localClient->auth_oper);
122
123			MyFree(source_p->localClient->response);
124			MyFree(source_p->localClient->auth_oper);
125			source_p->localClient->response = NULL;
126			source_p->localClient->auth_oper = NULL;
127			return;
128			}
129
130			MyFree(source_p->localClient->response);
131			MyFree(source_p->localClient->auth_oper);
132			source_p->localClient->response = NULL;
133			source_p->localClient->auth_oper = NULL;
134
135	db	101	if ((conf = find_exact_name_conf(OPER_TYPE,
136			parv[1], source_p->username, source_p->host
137			)) != NULL)
138	adx	30	{
139			aconf = (struct AccessItem *)map_to_conf(conf);
140			}
141	db	101	else if ((conf = find_exact_name_conf(OPER_TYPE,
142			parv[1], source_p->username,
143			source_p->sockhost)) != NULL)
144	adx	30	{
145			aconf = (struct AccessItem *)map_to_conf(conf);
146			}
147
148			if(aconf == NULL)
149			{
150			sendto_one (source_p, form_str(ERR_NOOPERHOST), me.name, parv[0]);
151			conf = find_exact_name_conf(OPER_TYPE, parv[1], NULL, NULL);
152			failed_challenge_notice(source_p, parv[1], (conf != NULL)
153			? "host mismatch" : "no oper {} block");
154			log_oper_action(LOG_FAILED_OPER_TYPE, source_p, "%s\n", parv[1]);
155			return;
156			}
157
158			if (aconf->rsa_public_key == NULL)
159			{
160			sendto_one (source_p, ":%s NOTICE %s :I'm sorry, PK authentication "
161			"is not enabled for your oper{} block.", me.name,
162			parv[0]);
163			return;
164			}
165
166			if (!generate_challenge(&challenge, &(source_p->localClient->response),
167			aconf->rsa_public_key))
168			sendto_one(source_p, form_str(RPL_RSACHALLENGE),
169			me.name, parv[0], challenge);
170
171			DupString(source_p->localClient->auth_oper, conf->name);
172			MyFree(challenge);
173			}
174
175			/* failed_challenge_notice()
176			*
177			* inputs - pointer to client doing /oper ...
178			* - pointer to nick they tried to oper as
179			* - pointer to reason they have failed
180			* output - nothing
181			* side effects - notices all opers of the failed oper attempt if enabled
182			*/
183			static void
184			failed_challenge_notice(struct Client source_p, const char name,
185			const char *reason)
186			{
187			if (ConfigFileEntry.failed_oper_notice)
188			sendto_realops_flags(UMODE_ALL, L_ALL, "Failed CHALLENGE attempt as %s "
189			"by %s (%s@%s) - %s", name, source_p->name,
190			source_p->username, source_p->host, reason);
191			}