Added support for SASS impersonation using the PLAIN method

diff --git a/src/nickserv.c b/src/nickserv.c
index d625ab2d6f5b4b7b27db51d8c2a310b44131988b..485d1fde4a37b06045ba0f5307328327984f3fa4 100644 (file)
--- a/src/nickserv.c
+++ b/src/nickserv.c
@@ -5731,7 +5731,7 @@ sasl_packet(struct SASLSession *session)
         free(raw);
         return;
     }
-    else /* We only have PLAIN at the moment so next message must be credentials */
+    else
     {
         char *raw = NULL;
         size_t rawlen = 0;
@@ -5741,6 +5741,7 @@ sasl_packet(struct SASLSession *session)
         char *r = NULL;
         unsigned int i = 0, c = 0;
         struct handle_info *hi = NULL;
+        struct handle_info *hii = NULL;
         static char buffer[256];
 
         base64_decode_alloc(session->buf, session->buflen, &raw, &rawlen);
@@ -5777,10 +5778,29 @@ sasl_packet(struct SASLSession *session)
             }
             else
             {
-                snprintf(buffer, sizeof(buffer), "%s "FMT_TIME_T, hi->handle, hi->registered);
-                log_module(NS_LOG, LOG_DEBUG, "SASL: Valid credentials supplied");
-                irc_sasl(session->source, session->uid, "L", buffer);
-                irc_sasl(session->source, session->uid, "D", "S");
+                if (*authzid && irccasecmp(authzid, authcid) && HANDLE_FLAGGED(hi, IMPERSONATE))
+                {
+                    hii = hi;
+                    hi = get_handle_info(authzid);
+                }
+                if (hi)
+                {
+                    if (hii)
+                    {
+                        log_module(NS_LOG, LOG_DEBUG, "SASL: %s is ipersonating %s", hii->handle, hi->handle);
+                        snprintf(buffer, sizeof(buffer), "%s "FMT_TIME_T, hii->handle, hii->registered);
+                        irc_sasl(session->source, session->uid, "I", buffer);
+                    }
+                    log_module(NS_LOG, LOG_DEBUG, "SASL: Valid credentials supplied");
+                    snprintf(buffer, sizeof(buffer), "%s "FMT_TIME_T, hi->handle, hi->registered);
+                    irc_sasl(session->source, session->uid, "L", buffer);
+                    irc_sasl(session->source, session->uid, "D", "S");
+                }
+                else
+                {
+                    log_module(NS_LOG, LOG_DEBUG, "SASL: Invalid credentials supplied");
+                    irc_sasl(session->source, session->uid, "D", "F");
+                }
             }
         }
 
@@ -5943,6 +5963,9 @@ init_nickserv(const char *nick)
     for (i=0; handle_flags[i]; i++) {
         handle_inverse_flags[(unsigned char)handle_flags[i]] = i + 1;
         flag_access_levels[i] = 0;
+        /* ensure flag I requires a minimum of 999 if not set in the config */
+        if ((unsigned char)handle_flags[i] == 'I')
+            flag_access_levels[i] = 999;
     }
 
     conf_register_reload(nickserv_conf_read);

diff --git a/src/nickserv.h b/src/nickserv.h
index 3676c521b2ef0729a62c4c9fe43fd87f34e587bc..5a2fb893fe8bceff846cbe7bc267bda21d0dcf9d 100644 (file)
--- a/src/nickserv.h
+++ b/src/nickserv.h
@@ -41,9 +41,10 @@ struct svccmd;
 #define HI_FLAG_NETWORK_HELPER 0x00000100
 #define HI_FLAG_BOT            0x00000200
 #define HI_FLAG_AUTOHIDE       0x00000400
-#define HI_FLAG_ADVANCED       0x00000800
+#define HI_FLAG_IMPERSONATE    0x00000800
+#define HI_FLAG_ADVANCED       0x00001000
 /* Flag characters for the above.  First char is LSB, etc. */
-#define HANDLE_FLAGS "SphgscfnHbx"
+#define HANDLE_FLAGS "SphgscfnHbxI"
 
 /* HI_STYLE_* go into handle_info.userlist_style */
 #define HI_STYLE_NORMAL               'n'

diff --git a/x3.conf.example b/x3.conf.example
index 9d5ad9231deae5e933f4a40e5d13e7cf65d9b92b..b8e3c17b784f8899a7b4c594fae4fbd0294074c8 100644 (file)
--- a/x3.conf.example
+++ b/x3.conf.example
@@ -183,6 +183,7 @@
             "uc_H" "800"; // net helper (upper case H)
             "S" "999";    // O3 access suspended
             "b" "1";      // Bot (Hidden from !staff etc)
+            "I" "999";   // User can impersonate an account with an equal or lower opserv level
         };
 
         // and for who can change epithets for staff