trojanscan/trojanscan.c

   1 /*
   2  * Trojanscan version 2
   3  *
   4  * Trojanscan  copyright (C) Chris Porter 2002-2009
   5  * Newserv bits copyright (C) David Mansell 2002-2003
   6  *
   7  * TODO: CHECK::
   8  *   - Poke splidge about +r'ing bots, potential problems:
   9  *     - users might whine about T clone stealing account
  10  *       - would have to steal one already in use, so if trojans start using /msg q whois they'll see
  11  *       (though they have to be authed for this, they could use a clone of their own however)
  12  */
  13
  14 #include "trojanscan.h"
  15 #include "../lib/strlfunc.h"
  16 #include "../lib/version.h"
  17 #include "../core/nsmalloc.h"
  18 #include <stdint.h>
  19
  20 #define tmalloc(x)     nsmalloc(POOL_TROJANSCAN, x)
  21 #define tfree(x)       nsfree(POOL_TROJANSCAN, x)
  22
  23 MODULE_VERSION(TROJANSCAN_VERSION);
  24
  25 void trojanscan_phrasematch(channel *chp, nick *sender, trojanscan_phrases *phrase, char messagetype, char *matchbuf);
  26 char *trojanscan_sanitise(char *input);
  27 void trojanscan_refresh_settings(void);
  28 static void trojanscan_part_watch(int hook, void *arg);
  29 static void trojanscan_connect_nick(void *);
  30
  31 #define TROJANSCAN_SETTING_SIZE 256
  32 #define TROJANSCAN_MAX_SETTINGS 50
  33
  34 static struct {
  35   char setting[TROJANSCAN_SETTING_SIZE];
  36   char value[TROJANSCAN_SETTING_SIZE];
  37 } trojanscan_settings[TROJANSCAN_MAX_SETTINGS];
  38
  39 static int settingcount = 0;
  40 static char *versionreply;
  41 static int hooksregistered = 0;
  42 static void *trojanscan_connect_nick_schedule;
  43
  44 static void *db_ping_schedule;
  45
  46 void _init() {
  47   trojanscan_cmds = newcommandtree();
  48
  49   addcommandtotree(trojanscan_cmds, "showcommands", TROJANSCAN_ACL_UNAUTHED, 0, &trojanscan_showcommands);
  50   addcommandtotree(trojanscan_cmds, "help", TROJANSCAN_ACL_UNAUTHED, 1, &trojanscan_help);
  51   addcommandtotree(trojanscan_cmds, "hello", TROJANSCAN_ACL_UNAUTHED | TROJANSCAN_ACL_OPER, 1, &trojanscan_hello);
  52
  53   addcommandtotree(trojanscan_cmds, "join", TROJANSCAN_ACL_STAFF, 1, &trojanscan_userjoin);
  54   addcommandtotree(trojanscan_cmds, "chanlist", TROJANSCAN_ACL_STAFF, 0, &trojanscan_chanlist);
  55   addcommandtotree(trojanscan_cmds, "whois", TROJANSCAN_ACL_STAFF, 1, &trojanscan_whois);
  56
  57   addcommandtotree(trojanscan_cmds, "changelev", TROJANSCAN_ACL_STAFF | TROJANSCAN_ACL_OPER, 2, &trojanscan_changelev);
  58   addcommandtotree(trojanscan_cmds, "deluser", TROJANSCAN_ACL_TEAMLEADER | TROJANSCAN_ACL_OPER, 2, &trojanscan_deluser);
  59   addcommandtotree(trojanscan_cmds, "mew", TROJANSCAN_ACL_STAFF, 2, &trojanscan_mew);
  60   addcommandtotree(trojanscan_cmds, "status", TROJANSCAN_ACL_STAFF | TROJANSCAN_ACL_OPER, 0, &trojanscan_status);
  61   addcommandtotree(trojanscan_cmds, "listusers", TROJANSCAN_ACL_TEAMLEADER, 0, &trojanscan_listusers);
  62
  63   addcommandtotree(trojanscan_cmds, "rehash", TROJANSCAN_ACL_WEBSITE, 0, &trojanscan_rehash);
  64
  65   addcommandtotree(trojanscan_cmds, "cat", TROJANSCAN_ACL_OPER, 1, &trojanscan_cat);
  66
  67   addcommandtotree(trojanscan_cmds, "reschedule", TROJANSCAN_ACL_DEVELOPER | TROJANSCAN_ACL_OPER, 0, &trojanscan_reschedule);
  68
  69   srand((int)time(NULL));
  70
  71   trojanscan_connect_schedule = scheduleoneshot(time(NULL) + 1, &trojanscan_connect, NULL);
  72 }
  73
  74 void _fini(void) {
  75   int i;
  76   struct trojanscan_realchannels *rp = trojanscan_realchanlist, *oldrp;
  77   struct trojanscan_rejoinlist *rj = trojanscan_schedulerejoins, *oldrj;
  78
  79   if (trojanscan_nick)
  80     deregisterlocaluser(trojanscan_nick, NULL);
  81
  82   if (trojanscan_connect_schedule)
  83     deleteschedule(trojanscan_connect_schedule, &trojanscan_connect, NULL);
  84
  85   if (trojanscan_connect_nick_schedule)
  86     deleteschedule(trojanscan_connect_nick_schedule, &trojanscan_connect_nick, NULL);
  87
  88   if(trojanscan_schedule)
  89     deleteschedule(trojanscan_schedule, &trojanscan_dojoin, NULL);
  90
  91   if(trojanscan_poolschedule)
  92     deleteschedule(trojanscan_poolschedule, &trojanscan_repool, NULL);
  93
  94   if(trojanscan_cloneschedule)
  95     deleteschedule(trojanscan_poolschedule, &trojanscan_registerclones, NULL);
  96
  97   if(hooksregistered)
  98     deregisterhook(HOOK_CHANNEL_PART, trojanscan_part_watch);
  99
 100   while(rp) {
 101     deleteschedule(rp->schedule, &trojanscan_dopart, (void *)rp);
 102     oldrp = rp;
 103     rp = rp->next;
 104     tfree(oldrp);
 105   }
 106
 107   while(rj) {
 108     deleteschedule(rj->schedule, &trojanscan_rejoin_channel, (void *)rj);
 109     freesstring(rj->channel);
 110     oldrj = rj;
 111     rj = rj->next;
 112     tfree(oldrj);
 113   }
 114
 115   if(trojanscan_initialschedule)
 116     deleteschedule(trojanscan_initialschedule, &trojanscan_fill_channels, NULL);
 117
 118   deleteschedule(trojanscan_rehashschedule, &trojanscan_rehash_schedule, NULL);
 119
 120   for (i=0;i<TROJANSCAN_CLONE_TOTAL;i++)
 121     if(trojanscan_swarm[i].clone) {
 122       deregisterlocaluser(trojanscan_swarm[i].clone, NULL);
 123       derefnode(iptree, trojanscan_swarm[i].fakeipnode);
 124       trojanscan_swarm[i].clone = NULL;
 125     }
 126   trojanscan_free_database();
 127   trojanscan_free_channels();
 128
 129   for (i=0;i<trojanscan_hostpoolsize;i++)
 130     freesstring(trojanscan_hostpool[i]);
 131
 132   for (i=0;i<trojanscan_tailpoolsize;i++)
 133     freesstring(trojanscan_tailpool[i]);
 134
 135   trojanscan_database_close();
 136
 137   deletecommandfromtree(trojanscan_cmds, "showcommands", &trojanscan_showcommands);
 138   deletecommandfromtree(trojanscan_cmds, "help", &trojanscan_help);
 139   deletecommandfromtree(trojanscan_cmds, "hello", &trojanscan_hello);
 140   deletecommandfromtree(trojanscan_cmds, "join", &trojanscan_userjoin);
 141   deletecommandfromtree(trojanscan_cmds, "chanlist", &trojanscan_chanlist);
 142   deletecommandfromtree(trojanscan_cmds, "whois", &trojanscan_whois);
 143   deletecommandfromtree(trojanscan_cmds, "changelev", &trojanscan_changelev);
 144   deletecommandfromtree(trojanscan_cmds, "deluser", &trojanscan_deluser);
 145   deletecommandfromtree(trojanscan_cmds, "mew", &trojanscan_mew);
 146   deletecommandfromtree(trojanscan_cmds, "status", &trojanscan_status);
 147   deletecommandfromtree(trojanscan_cmds, "listusers", &trojanscan_listusers);
 148   deletecommandfromtree(trojanscan_cmds, "rehash", &trojanscan_rehash);
 149   deletecommandfromtree(trojanscan_cmds, "cat", &trojanscan_cat);
 150   deletecommandfromtree(trojanscan_cmds, "reschedule", &trojanscan_reschedule);
 151
 152   destroycommandtree(trojanscan_cmds);
 153   nscheckfreeall(POOL_TROJANSCAN);
 154 }
 155
 156 static void trojanscan_connect_nick(void *arg) {
 157   sstring *mnick, *myident, *myhost, *myrealname, *myauthname;
 158   channel *cp;
 159
 160   mnick = getcopyconfigitem("trojanscan", "nick", "T", NICKLEN);
 161   myident = getcopyconfigitem("trojanscan", "ident", "trojanscan", NICKLEN);
 162   myhost = getcopyconfigitem("trojanscan", "hostname", "trojanscan.quakenet.org", HOSTLEN);
 163   myrealname = getcopyconfigitem("trojanscan", "realname", "Trojanscan v" TROJANSCAN_VERSION, REALLEN);
 164   myauthname = getcopyconfigitem("trojanscan", "authname", "T", ACCOUNTLEN);
 165
 166   trojanscan_nick = registerlocaluser(mnick->content, myident->content, myhost->content, myrealname->content, myauthname->content, UMODE_SERVICE | UMODE_DEAF |
 167                                                                                                                           UMODE_OPER | UMODE_INV |
 168                                                                                                                           UMODE_ACCOUNT,
 169                                                                                                                           &trojanscan_handlemessages);
 170   freesstring(mnick);
 171   freesstring(myident);
 172   freesstring(myhost);
 173   freesstring(myrealname);
 174   freesstring(myauthname);
 175
 176   cp = findchannel(TROJANSCAN_OPERCHANNEL);
 177   if (!cp) {
 178     localcreatechannel(trojanscan_nick, TROJANSCAN_OPERCHANNEL);
 179   } else {
 180     if(!localjoinchannel(trojanscan_nick, cp))
 181       localgetops(trojanscan_nick, cp);
 182   }
 183
 184   cp = findchannel(TROJANSCAN_CHANNEL);
 185   if (!cp) {
 186     localcreatechannel(trojanscan_nick, TROJANSCAN_CHANNEL);
 187   } else {
 188     if(!localjoinchannel(trojanscan_nick, cp))
 189       localgetops(trojanscan_nick, cp);
 190   }
 191
 192 #ifdef TROJANSCAN_PEONCHANNEL
 193   cp = findchannel(TROJANSCAN_PEONCHANNEL);
 194   if (!cp) {
 195     localcreatechannel(trojanscan_nick, TROJANSCAN_PEONCHANNEL);
 196   } else {
 197     if(!localjoinchannel(trojanscan_nick, cp))
 198       localgetops(trojanscan_nick, cp);
 199   }
 200 #endif
 201 }
 202
 203 void trojanscan_connect(void *arg) {
 204   sstring *dbhost, *dbuser, *dbpass, *db, *dbport, *temp;
 205   int length, i;
 206   char buf[10];
 207
 208   trojanscan_connect_schedule = NULL;
 209
 210   for(i=0;i<TROJANSCAN_CLONE_TOTAL;i++)
 211     trojanscan_swarm[i].index = i; /* sure this could be done with pointer arithmetic... */
 212
 213   trojanscan_hostpoolsize = 0;
 214   trojanscan_tailpoolsize = 0;
 215   trojanscan_hostmode = 0;
 216   trojanscan_poolschedule = NULL;
 217   trojanscan_cloneschedule = NULL;
 218   trojanscan_realchanlist = NULL;
 219   trojanscan_database.glines = 0;
 220   trojanscan_database.detections = 0;
 221
 222   dbhost = getcopyconfigitem("trojanscan", "dbhost", "localhost", 100);
 223   dbuser = getcopyconfigitem("trojanscan", "dbuser", "moo", 100);
 224   dbpass = getcopyconfigitem("trojanscan", "dbpass", "changeme", 100);
 225   db = getcopyconfigitem("trojanscan", "db", "moo", 100);
 226
 227   dbport = getcopyconfigitem("trojanscan", "dbport", "3306", 10);
 228
 229   length = snprintf(buf, sizeof(buf) - 1, "%d", TROJANSCAN_DEFAULT_MAXCHANS);
 230   temp = getcopyconfigitem("trojanscan", "maxchans", buf, length);
 231
 232   trojanscan_maxchans = atoi(temp->content);
 233   freesstring(temp);
 234
 235   length = snprintf(buf, sizeof(buf) - 1, "%d", TROJANSCAN_DEFAULT_CYCLETIME);
 236   temp = getcopyconfigitem("trojanscan", "cycletime", buf, length);
 237
 238   trojanscan_cycletime = atoi(temp->content);
 239   freesstring(temp);
 240
 241   length = snprintf(buf, sizeof(buf) - 1, "%d", TROJANSCAN_DEFAULT_PARTTIME);
 242   temp = getcopyconfigitem("trojanscan", "parttime", buf, length);
 243   trojanscan_part_time = atoi(temp->content);
 244   freesstring(temp);
 245
 246   length = snprintf(buf, sizeof(buf) - 1, "%d", TROJANSCAN_DEFAULT_MAXUSERS);
 247   temp = getcopyconfigitem("trojanscan", "maxusers", buf, length);
 248   trojanscan_maxusers = atoi(temp->content);
 249   freesstring(temp);
 250
 251   length = snprintf(buf, sizeof(buf) - 1, "%d", TROJANSCAN_MINIMUM_HOSTS_BEFORE_POOL);
 252   temp = getcopyconfigitem("trojanscan", "minpoolhosts", buf, length);
 253   trojanscan_min_hosts = atoi(temp->content);
 254   freesstring(temp);
 255
 256   if ((trojanscan_cycletime / trojanscan_maxchans) < 1) {
 257     Error("trojanscan", ERR_FATAL, "Cycletime / maxchans < 1, increase cycletime or decrease maxchans else cycling breaks.");
 258     freesstring(dbhost);
 259     freesstring(dbuser);
 260     freesstring(dbpass);
 261     freesstring(db);
 262     freesstring(dbport);
 263     return; /* PPA: module failed to load */
 264   }
 265
 266   length = snprintf(buf, sizeof(buf) - 1, "%d", TROJANSCAN_DEFAULT_MINIMUM_CHANNEL_SIZE);
 267   temp = getcopyconfigitem("trojanscan", "minchansize", buf, length);
 268   trojanscan_minchansize = atoi(temp->content);
 269   freesstring(temp);
 270
 271   trojanscan_connect_nick(NULL);
 272
 273   if (trojanscan_database_connect(dbhost->content, dbuser->content, dbpass->content, db->content, atoi(dbport->content)) < 0) {
 274     Error("trojanscan", ERR_FATAL, "Cannot connect to database host!");
 275     freesstring(dbhost);
 276     freesstring(dbuser);
 277     freesstring(dbpass);
 278     freesstring(db);
 279     freesstring(dbport);
 280     return; /* PPA: module failed to load */
 281   }
 282
 283   trojanscan_database_query("CREATE TABLE phrases (id INT(10) PRIMARY KEY AUTO_INCREMENT, wormid INT(10) NOT NULL, phrase TEXT NOT NULL, priority INT(10) DEFAULT 0 NOT NULL, dateadded int(10), disabled BOOL DEFAULT 0 NOT NULL)");
 284   trojanscan_database_query("CREATE TABLE worms (id INT(10) PRIMARY KEY AUTO_INCREMENT, wormname TEXT NOT NULL, glinetype INT DEFAULT 0, data text, hitmsgs BOOL DEFAULT 1, hitchans BOOL DEFAULT 0, epidemic BOOL DEFAULT 0, privinfo text)");
 285   trojanscan_database_query("CREATE TABLE logs (id INT(10) PRIMARY KEY AUTO_INCREMENT, userid INT(10) NOT NULL, act TEXT NOT NULL, description TEXT NOT NULL, ts TIMESTAMP)");
 286   trojanscan_database_query("CREATE TABLE channels (id INT(10) PRIMARY KEY AUTO_INCREMENT, channel VARCHAR(%d) NOT NULL, exempt BOOL DEFAULT 0)", CHANNELLEN);
 287   trojanscan_database_query("CREATE TABLE users (id INT(10) PRIMARY KEY AUTO_INCREMENT, authname VARCHAR(%d) NOT NULL, authlevel TINYINT(4) NOT NULL)", ACCOUNTLEN);
 288   trojanscan_database_query("CREATE TABLE hits (id INT(10) PRIMARY KEY AUTO_INCREMENT, nickname VARCHAR(%d) NOT NULL, ident VARCHAR(%d) NOT NULL, host VARCHAR(%d) NOT NULL, phrase INT(10) NOT NULL, ts TIMESTAMP, messagetype VARCHAR(1) NOT NULL DEFAULT 'm', glined BOOL DEFAULT 1)", NICKLEN, USERLEN, HOSTLEN);
 289   trojanscan_database_query("CREATE TABLE settings (id INT(10) PRIMARY KEY AUTO_INCREMENT, setting VARCHAR(255) NOT NULL UNIQUE, value VARCHAR(255) NOT NULL)");
 290   trojanscan_database_query("CREATE TABLE wwwlogs (id INT(10) PRIMARY KEY AUTO_INCREMENT, authid INT(10) NOT NULL, ip VARCHAR(15), action TEXT, ts TIMESTAMP)");
 291   trojanscan_database_query("CREATE TABLE unknownlog (id INT(10) PRIMARY KEY AUTO_INCREMENT, data TEXT, user VARCHAR(%d) NOT NULL, ts TIMESTAMP)", NICKLEN+USERLEN+HOSTLEN+3);
 292
 293   trojanscan_database_query("DELETE FROM settings WHERE setting = 'rehash' OR setting = 'changed'");
 294   trojanscan_database_query("INSERT INTO settings (setting, value) VALUES ('rehash','0')");
 295   trojanscan_database_query("INSERT INTO settings (setting, value) VALUES ('changed','0')");
 296
 297   /* assumption: constants aren't supplied by someone evil */
 298   trojanscan_database_query("INSERT INTO settings (setting, value) VALUES ('versionreply','" TROJANSCAN_DEFAULT_VERSION_REPLY "')");
 299
 300   trojanscan_refresh_settings();
 301   trojanscan_read_database(1);
 302
 303   freesstring(dbhost);
 304   freesstring(dbuser);
 305   freesstring(dbpass);
 306   freesstring(db);
 307   freesstring(dbport);
 308   trojanscan_registerclones(NULL);
 309
 310   trojanscan_rehashschedule = scheduleoneshot(time(NULL) + 60, &trojanscan_rehash_schedule, NULL);
 311
 312   registerhook(HOOK_CHANNEL_PART, trojanscan_part_watch);
 313   hooksregistered = 1;
 314 }
 315
 316 char *trojanscan_get_setting(char *setting) {
 317   int i;
 318
 319   for(i=0;i<settingcount;i++)
 320     if(!strcmp(trojanscan_settings[i].setting, setting))
 321       return trojanscan_settings[i].value;
 322
 323   return NULL;
 324 }
 325
 326 void trojanscan_refresh_settings(void) {
 327   trojanscan_database_res *res;
 328   trojanscan_database_row sqlrow;
 329   int i = 0;
 330
 331   if(trojanscan_database_query("SELECT setting, value FROM settings"))
 332     return;
 333
 334   if(!(res = trojanscan_database_store_result(&trojanscan_sql)))
 335     return;
 336
 337   if (trojanscan_database_num_rows(res) <= 0)
 338     return;
 339
 340   while((sqlrow = trojanscan_database_fetch_row(res))) {
 341     strlcpy(trojanscan_settings[i].setting, sqlrow[0], TROJANSCAN_SETTING_SIZE);
 342     strlcpy(trojanscan_settings[i].value, sqlrow[1], TROJANSCAN_SETTING_SIZE);
 343
 344     trojanscan_sanitise(trojanscan_settings[i].value);
 345
 346     if(++i == TROJANSCAN_MAX_SETTINGS)
 347       break;
 348   }
 349
 350   settingcount = i;
 351
 352   trojanscan_database_free_result(res);
 353
 354   /* optimisation hack */
 355   versionreply = trojanscan_get_setting("versionreply");
 356 }
 357
 358 void trojanscan_rehash_schedule(void *arg) {
 359   char *v;
 360   trojanscan_rehashschedule = scheduleoneshot(time(NULL) + 60, &trojanscan_rehash_schedule, NULL);
 361
 362   trojanscan_refresh_settings();
 363
 364   v = trojanscan_get_setting("rehash");
 365   if(v && v[0] == '1') {
 366     trojanscan_mainchanmsg("n: rehash initiated by website. . .");
 367     trojanscan_read_database(0);
 368   }
 369 }
 370
 371 void trojanscan_free_database(void) {
 372   int i;
 373   for(i=0;i<trojanscan_database.total_channels;i++)
 374     freesstring(trojanscan_database.channels[i].name);
 375   tfree(trojanscan_database.channels);
 376   for(i=0;i<trojanscan_database.total_phrases;i++) {
 377     if (trojanscan_database.phrases[i].phrase)
 378       pcre_free(trojanscan_database.phrases[i].phrase);
 379     if (trojanscan_database.phrases[i].hint)
 380       pcre_free(trojanscan_database.phrases[i].hint);
 381   }
 382   tfree(trojanscan_database.phrases);
 383   for(i=0;i<trojanscan_database.total_worms;i++)
 384     freesstring(trojanscan_database.worms[i].name);
 385   tfree(trojanscan_database.worms);
 386   trojanscan_database.total_channels = 0;
 387   trojanscan_database.total_phrases = 0;
 388   trojanscan_database.total_worms = 0;
 389   trojanscan_database.channels = NULL;
 390   trojanscan_database.phrases = NULL;
 391   trojanscan_database.worms = NULL;
 392 }
 393
 394 char *trojanscan_sanitise(char *input) {
 395   char *p;
 396
 397   for(p=input;*p;p++)
 398     if(*p == '\r' || *p == '\n')
 399       *p = '!';
 400
 401   return input;
 402 }
 403
 404 sstring *trojanscan_getsstring(char *string, int length) {
 405   int i;
 406
 407   for(i=0;i<length;i++) {
 408     if ((string[i] == '\r') || (string[i] == '\n')) {
 409       Error("trojanscan", ERR_WARNING, "Error reading %s at position %d, set to ERROR!", string, i+1);
 410       return getsstring("ERROR", sizeof("ERROR"));
 411     }
 412   }
 413
 414   return getsstring(string, length);
 415 }
 416
 417 int trojanscan_strip_codes(char *buf, size_t max, char *original) {
 418   int i, j, length = TROJANSCAN_MMIN(strlen(original), max-1);
 419   char *p2 = original, *p3, flag = 0;
 420   p3 = buf;
 421   for(i=0;i<length+1;i++) {
 422     switch (*p2) {
 423       case '\002':
 424       case '\017':
 425       case '\026':
 426       case '\037':
 427       break;
 428       case '\003':
 429         for(j=0;j<6;j++) {
 430           if ((i + 1) > length)
 431             break;
 432           if ((j == 4) && flag)
 433             break;
 434           p2++;
 435           i++;
 436           if ((j == 0) && (!((*p2 >= '0') && (*p2 <= '9'))))
 437             break;
 438           if (j == 1) {
 439
 440             if (*p2 == ',') {
 441                 if ((i + 1) > length)
 442                   break;
 443                 if (!((*(p2 + 1) >= '0') && (*(p2 + 1) <= '9')))
 444                   break;
 445               flag = 1;
 446             } else if ((*p2 >= '0') && (*p2 <= '9')) {
 447               flag = 0;
 448             } else {
 449               break;
 450             }
 451           }
 452           if (j == 2) {
 453             if (flag) {
 454               if (!((*p2 >= '0') && (*p2 <= '9')))
 455                 break;
 456             } else {
 457               if (*p2 != ',') {
 458                 break;
 459               } else {
 460                 if ((i + 1) > length)
 461                   break;
 462                 if (!((*(p2 + 1) >= '0') && (*(p2 + 1) <= '9')))
 463                   break;
 464               }
 465             }
 466           }
 467           if ((j == 3) && (!((*p2 >= '0') && (*p2 <= '9'))))
 468             break;
 469           if ((j == 4) && (!((*p2 >= '0') && (*p2 <= '9'))))
 470             break;
 471         }
 472         p2--;
 473         i--;
 474         break;
 475
 476       default:
 477         *p3 = *p2;
 478         p3++;
 479         break;
 480     }
 481     p2++;
 482   }
 483   return p3 - buf;
 484 }
 485
 486 struct trojanscan_worms *trojanscan_find_worm_by_id(int id) {
 487   int i;
 488   for(i=0;i<trojanscan_database.total_worms;i++)
 489     if (trojanscan_database.worms[i].id == id)
 490       return &trojanscan_database.worms[i];
 491   return NULL;
 492 }
 493
 494 void trojanscan_read_database(int first_time) {
 495   const char *error;
 496   int erroroffset, i, tempresult;
 497
 498   trojanscan_database_res *res;
 499   trojanscan_database_row sqlrow;
 500
 501   if (!first_time) {
 502     trojanscan_free_database();
 503   } else {
 504     trojanscan_database.total_channels = 0;
 505     trojanscan_database.total_phrases = 0;
 506     trojanscan_database.total_worms = 0;
 507   }
 508
 509   if (!(trojanscan_database_query("SELECT channel, exempt FROM channels"))) {
 510     if ((res = trojanscan_database_store_result(&trojanscan_sql))) {
 511       trojanscan_database.total_channels = trojanscan_database_num_rows(res);
 512       if (trojanscan_database.total_channels > 0) {
 513         if ((trojanscan_database.channels = (trojanscan_channels *)tmalloc(sizeof(trojanscan_channels) * trojanscan_database.total_channels))) {
 514           if ((trojanscan_database.total_channels>0) && trojanscan_database.channels) {
 515             i = 0;
 516             while((sqlrow = trojanscan_database_fetch_row(res))) {
 517               trojanscan_database.channels[i].name = trojanscan_getsstring(trojanscan_sanitise(sqlrow[0]), strlen(sqlrow[0]));
 518               trojanscan_database.channels[i].exempt = (sqlrow[1][0] == '1');
 519               i++;
 520             }
 521           }
 522         }
 523       }
 524       trojanscan_database_free_result(res);
 525     }
 526   }
 527
 528   if (!(trojanscan_database_query("SELECT id, wormname, glinetype, length(data), hitmsgs, hitchans, epidemic FROM worms"))) {
 529     if ((res = trojanscan_database_store_result(&trojanscan_sql))) {
 530       trojanscan_database.total_worms = trojanscan_database_num_rows(res);
 531       if (trojanscan_database.total_worms > 0) {
 532         if ((trojanscan_database.worms = (trojanscan_worms *)tmalloc(sizeof(trojanscan_worms) * trojanscan_database.total_worms))) {
 533           i = 0;
 534           while((sqlrow = trojanscan_database_fetch_row(res))) {
 535             trojanscan_database.worms[i].id = atoi(sqlrow[0]);
 536             trojanscan_database.worms[i].name = trojanscan_getsstring(trojanscan_sanitise(sqlrow[1]), strlen(sqlrow[1]));
 537             tempresult = atoi(sqlrow[2]);
 538             trojanscan_database.worms[i].glineuser = (tempresult == 0);
 539             trojanscan_database.worms[i].glinehost = (tempresult == 1);
 540             trojanscan_database.worms[i].monitor = (tempresult == 2);
 541             if(sqlrow[3]) {
 542               trojanscan_database.worms[i].datalen = ((atoi(sqlrow[3]) == 0) ? 0 : 1);
 543             } else {
 544               trojanscan_database.worms[i].datalen = 0;
 545             }
 546
 547             trojanscan_database.worms[i].hitpriv = (atoi(sqlrow[4]) == 1);
 548             trojanscan_database.worms[i].hitchans = (atoi(sqlrow[5]) == 1);
 549             trojanscan_database.worms[i].epidemic = (atoi(sqlrow[6]) == 1);
 550
 551             i++;
 552           }
 553         }
 554       }
 555       trojanscan_database_free_result(res);
 556     }
 557   }
 558
 559   if (!(trojanscan_database_query("SELECT id, phrase, wormid FROM phrases WHERE disabled = 0 ORDER BY priority DESC"))) {
 560     if ((res = trojanscan_database_store_result(&trojanscan_sql))) {
 561       trojanscan_database.total_phrases = trojanscan_database_num_rows(res);
 562       if (trojanscan_database.total_phrases > 0) {
 563         if ((trojanscan_database.phrases = (trojanscan_phrases *)tmalloc(sizeof(trojanscan_phrases) * trojanscan_database.total_phrases))) {
 564           i = 0;
 565           while((sqlrow = trojanscan_database_fetch_row(res))) {
 566             trojanscan_database.phrases[i].id = atoi(sqlrow[0]);
 567             trojanscan_database.phrases[i].worm = trojanscan_find_worm_by_id(atoi(sqlrow[2]));
 568             if (!(trojanscan_database.phrases[i].phrase = pcre_compile(sqlrow[1], PCRE_CASELESS, &error, &erroroffset, NULL))) {
 569               Error("trojanscan", ERR_WARNING, "Error compiling expression %s at offset %d: %s", sqlrow[1], erroroffset, error);
 570             } else {
 571               trojanscan_database.phrases[i].hint = pcre_study(trojanscan_database.phrases[i].phrase, 0, &error);
 572               if (error) {
 573                 Error("trojanscan", ERR_WARNING, "Error studying expression %s: %s", sqlrow[1], error);
 574                 pcre_free(trojanscan_database.phrases[i].phrase);
 575                 trojanscan_database.phrases[i].phrase = NULL;
 576               }
 577             }
 578             i++;
 579           }
 580         }
 581       }
 582       trojanscan_database_free_result(res);
 583     }
 584   }
 585
 586   trojanscan_database_query("UPDATE settings SET value = '0' where setting = 'rehash'");
 587 }
 588
 589 void trojanscan_log(nick *np, char *event, char *details, ...) {
 590   int nickid = 0;
 591   char eevent[TROJANSCAN_QUERY_TEMP_BUF_SIZE], edetails[TROJANSCAN_QUERY_TEMP_BUF_SIZE], buf[513];
 592   va_list va;
 593
 594   va_start(va, details);
 595   vsnprintf(buf, sizeof(buf) - 1, details, va);
 596   va_end(va);
 597
 598   if (np)
 599     if (IsAccount(np))
 600       nickid = trojanscan_user_id_by_authname(np->authname);
 601
 602   trojanscan_database_escape_string(eevent, event, strlen(event));
 603   trojanscan_database_escape_string(edetails, buf, strlen(buf));
 604   trojanscan_database_query("INSERT INTO logs (userid, act, description) VALUES ('%d', '%s', '%s')", nickid, eevent, edetails);
 605 }
 606
 607 void trojanscan_generateclone(void *arg) {
 608   int i, loops = 0, modes = UMODE_XOPER | UMODE_INV;
 609   char c_nick[NICKLEN+1], c_ident[USERLEN+1], c_host[HOSTLEN+1], c_real[REALLEN+1];
 610   patricia_node_t *fakeip;
 611
 612   i = (int)((long)arg);
 613
 614   /* PPA: unlikely to be infinite */
 615   do {
 616     c_nick[0] = '\0';
 617     if (!loops && trojanscan_hostmode) /* only have one go at this */
 618       trojanscan_generatenick(c_nick, NICKLEN);
 619     if(!c_nick[0])
 620       trojanscan_gennick(c_nick, trojanscan_minmaxrand(7, TROJANSCAN_MMIN(13, NICKLEN)));
 621     loops++;
 622   } while ((getnickbynick(c_nick) != NULL));
 623
 624   trojanscan_generateident(c_ident, USERLEN);
 625   if(!c_ident[0])
 626     trojanscan_genident(c_ident, trojanscan_minmaxrand(4, TROJANSCAN_MMIN(8, USERLEN)));
 627
 628   if(trojanscan_hostmode) {
 629     trojanscan_generatehost(c_host, HOSTLEN, &fakeip);
 630     if(!c_host[0])
 631       trojanscan_genhost(c_host, HOSTLEN, &fakeip);
 632   } else {
 633     trojanscan_genhost(c_host, HOSTLEN, &fakeip);
 634   }
 635
 636   trojanscan_generaterealname(c_real, REALLEN);
 637   if(!c_real[0])
 638     trojanscan_genreal(c_real, trojanscan_minmaxrand(15, TROJANSCAN_MMIN(50, REALLEN)));
 639
 640   trojanscan_swarm[i].clone = registerlocaluser(c_nick, c_ident, c_host, c_real, NULL, modes, &trojanscan_clonehandlemessages);
 641   trojanscan_swarm[i].fakeipnode = fakeip;
 642
 643   if(trojanscan_swarm[i].clone && !trojanscan_swarm_created) {
 644     nick *np = trojanscan_selectuser();
 645     if(np) /* select a 'random' sign on time for whois generation */
 646       trojanscan_swarm[i].clone->timestamp = np->timestamp;
 647   }
 648   trojanscan_swarm[i].remaining = trojanscan_minmaxrand(5, 100);
 649
 650   trojanscan_swarm[i].sitting = 0;
 651
 652 }
 653
 654 void trojanscan_free_channels(void) {
 655   int i;
 656   if(trojanscan_chans) {
 657     for(i=0;i<trojanscan_activechans;i++)
 658       freesstring(trojanscan_chans[i].channel);
 659     tfree(trojanscan_chans);
 660     trojanscan_chans = NULL;
 661     trojanscan_activechans = 0;
 662   }
 663 }
 664
 665 void trojanscan_repool(void *arg) {
 666   if (trojanscan_generatepool() < TROJANSCAN_MINPOOLSIZE) {
 667     trojanscan_hostmode = 0;
 668     return;
 669   } else {
 670     trojanscan_hostmode = 1;
 671     trojanscan_poolschedule = scheduleoneshot(time(NULL) + TROJANSCAN_POOL_REGENERATION, &trojanscan_repool, NULL);
 672   }
 673 }
 674
 675 void trojanscan_registerclones(void *arg) {
 676   unsigned int i;
 677
 678   if (trojanscan_generatepool() < TROJANSCAN_MINPOOLSIZE) {
 679     trojanscan_hostmode = 0;
 680     trojanscan_cloneschedule = scheduleoneshot(time(NULL) + 10, &trojanscan_registerclones, NULL);
 681     return;
 682   } else {
 683     trojanscan_hostmode = 1;
 684     trojanscan_poolschedule = scheduleoneshot(time(NULL) + TROJANSCAN_POOL_REGENERATION, &trojanscan_repool, NULL);
 685     trojanscan_cloneschedule = NULL;
 686   }
 687
 688   for (i=0;i<TROJANSCAN_CLONE_TOTAL;i++)
 689     trojanscan_generateclone((void *)((long)i));
 690   trojanscan_mainchanmsg("n: swarm (%d clones) created.", TROJANSCAN_CLONE_TOTAL);
 691   trojanscan_swarm_created = 1;
 692
 693   trojanscan_initialschedule = scheduleoneshot(time(NULL) + 60, &trojanscan_fill_channels, NULL);
 694 }
 695
 696 int trojanscan_status(void *sender, int cargc, char **cargv) {
 697   nick *np = (nick *)sender;
 698   trojanscan_log(np, "status", "");
 699   trojanscan_reply(np, "Channels in schedule: %d", trojanscan_activechans);
 700   trojanscan_reply(np, "Channels in database: %d", trojanscan_database.total_channels);
 701   trojanscan_reply(np, "Phrases: %d", trojanscan_database.total_phrases);
 702   trojanscan_reply(np, "Worms: %d", trojanscan_database.total_worms);
 703   trojanscan_reply(np, "Detections: %d", trojanscan_database.detections);
 704   trojanscan_reply(np, "Glines: %d", trojanscan_database.glines);
 705   trojanscan_reply(np, "Host/tail pool size: %d", TROJANSCAN_POOLSIZE);
 706   trojanscan_reply(np, "Cycletime: %d", trojanscan_cycletime);
 707   trojanscan_reply(np, "Clones: %d", TROJANSCAN_CLONE_TOTAL);
 708   return CMD_OK;
 709 }
 710
 711 int trojanscan_chanlist(void *sender, int cargc, char **cargv) {
 712   int i;
 713   nick *np = (nick *)sender;
 714   char buf[CHANNELLEN * 2 + 20];
 715   trojanscan_reply(np, "Channel list (%d total):", trojanscan_activechans);
 716   buf[0] = '\0';
 717
 718   for(i=0;i<trojanscan_activechans;i++) {
 719     if(trojanscan_chans[i].channel->length + 3 > sizeof(buf) - strlen(buf)) {
 720       trojanscan_reply(np, "%s", buf);
 721       buf[0] = '\0';
 722     }
 723
 724     /* if splidge sees this I'm going to die */
 725     strlcat(buf, trojanscan_chans[i].channel->content, sizeof(buf));
 726     strlcat(buf, " ", sizeof(buf));
 727   }
 728   if(buf[0])
 729     trojanscan_reply(np, "%s", buf);
 730
 731   trojanscan_reply(np, "Done.");
 732   return CMD_OK;
 733 }
 734
 735 int trojanscan_whois(void *sender, int cargc, char **cargv) {
 736   char *tochange;
 737   nick *np = (nick *)sender, *np2;
 738   int templevel;
 739
 740   if (cargc < 1) {
 741     trojanscan_reply(np, "Not enough parameters.");
 742     return CMD_ERROR;
 743   }
 744
 745   if (cargv[0][0] == '#') {
 746     tochange = cargv[0] + 1;
 747   } else {
 748     int i;
 749     np2 = getnickbynick(cargv[0]);
 750     if (!np2) {
 751       trojanscan_reply(np, "That nickname is not on the network.");
 752       return CMD_ERROR;
 753     }
 754     for(i=0;i<TROJANSCAN_CLONE_TOTAL;i++) {
 755       if(trojanscan_swarm[i].clone->nick && !ircd_strcmp(trojanscan_swarm[i].clone->nick, np2->nick)) {
 756         trojanscan_reply(np, "Nickname   : %s", np2->nick);
 757         trojanscan_reply(np, "Swarm      : yes");
 758         return CMD_OK;
 759       }
 760     }
 761     if (!IsAccount(np2)) {
 762       trojanscan_reply(np, "User is not authed.");
 763       return CMD_OK;
 764     }
 765     tochange = np2->authname;
 766   }
 767
 768   templevel = trojanscan_user_level_by_authname(tochange);
 769   if (templevel == -1) {
 770     trojanscan_reply(np, "User does not exist.");
 771   } else {
 772     union trojanscan_userlevel flags;
 773     flags.number = templevel;
 774     trojanscan_reply(np, "Authname   : %s", tochange);
 775     trojanscan_reply(np, "Flags      : +" TROJANSCAN_FLAG_MASK, TrojanscanFlagsInfo(flags));
 776   }
 777
 778   return CMD_OK;
 779 }
 780
 781 void trojanscan_privmsg_chan_or_nick(channel *cp, nick *np, char *message, ...) {
 782   char buf[513];
 783   va_list va;
 784
 785   if (!trojanscan_nick)
 786     return;
 787
 788   va_start(va, message);
 789   vsnprintf(buf, sizeof(buf) - 1, message, va);
 790   va_end(va);
 791
 792   if (cp) {
 793     sendmessagetochannel(trojanscan_nick, cp, "%s", buf);
 794   } else {
 795     sendmessagetouser(trojanscan_nick, np, "%s", buf);
 796   }
 797
 798 }
 799
 800 int trojanscan_mew(void *sender, int cargc, char **cargv) {
 801   nick *np = (nick *)sender, *np2 = NULL;
 802   channel *cp = NULL;
 803
 804   if (cargc < 2) {
 805     trojanscan_reply(np, "Not enough paramaters.");
 806     return CMD_ERROR;
 807   }
 808
 809   if(cargv[0][0] == '#') {
 810     if (!(cp = findchannel(cargv[0]))) {
 811       trojanscan_reply(np, "Channel not found.");
 812       return CMD_ERROR;
 813     }
 814     trojanscan_log(np, "mew", "%s %s", cp->index->name->content, cargv[1]);
 815   } else {
 816     if (!(np2 = getnickbynick(cargv[0]))) {
 817       trojanscan_reply(np, "Nickname is not present on the network.");
 818       return CMD_ERROR;
 819     }
 820     trojanscan_log(np, "mew", "%s %s", np2->nick, cargv[1]);
 821   }
 822
 823   trojanscan_privmsg_chan_or_nick(cp, np2, "\001ACTION mews hopefully at %s\001", cargv[1]);
 824
 825   if (cp) {
 826     trojanscan_reply(np, "Mewed at %s in %s.", cargv[1], cp->index->name->content);
 827   } else {
 828     trojanscan_reply(np, "Mewed at %s at %s.", cargv[1], np2->nick);
 829   }
 830
 831   if(!IsOper(np))
 832     trojanscan_mainchanmsg("n: mew: %s %s (%s/%s)", cargv[1], cp?cp->index->name->content:np2->nick, np->nick, np->authname);
 833
 834   return CMD_OK;
 835 }
 836
 837 int trojanscan_cat(void *sender, int cargc, char **cargv) {
 838   nick *np = (nick *)sender, *np2 = NULL;
 839   channel *cp = NULL;
 840   FILE *cat;
 841   char buf[513], *p;
 842
 843   if (cargc < 1) {
 844     trojanscan_reply(np, "Not enough paramaters.");
 845     return CMD_ERROR;
 846   }
 847
 848   if(cargv[0][0] == '#') {
 849     if (!(cp = findchannel(cargv[0]))) {
 850       trojanscan_reply(np, "Channel not found.");
 851       return CMD_ERROR;
 852     }
 853     trojanscan_log(np, "cat", cp->index->name->content);
 854   } else {
 855     if (!(np2 = getnickbynick(cargv[0]))) {
 856       trojanscan_reply(np, "Nickname is not present on the network.");
 857       return CMD_ERROR;
 858     }
 859     trojanscan_log(np, "cat", np2->nick);
 860   }
 861
 862   if ((!(cat = fopen(TROJANSCAN_CAT, "r")))) {
 863     trojanscan_reply(np, "Unable to open cat!");
 864     return CMD_ERROR;
 865   }
 866
 867   while (fgets(buf, sizeof(buf) - 1, cat)) {
 868     if ((p = strchr(buf, '\n'))) {
 869       *p = '\0';
 870       trojanscan_privmsg_chan_or_nick(cp, np2, "%s", buf);
 871     } else if (feof(cat)) {
 872       trojanscan_privmsg_chan_or_nick(cp, np2, "%s", buf);
 873     }
 874   }
 875
 876   fclose(cat);
 877
 878   if (cp) {
 879     trojanscan_reply(np, "Spammed cat in %s.", cp->index->name->content);
 880   } else {
 881     trojanscan_reply(np, "Spammed cat at %s.", np2->nick);
 882   }
 883
 884   return CMD_OK;
 885 }
 886
 887 int trojanscan_reschedule(void *sender, int cargc, char **cargv) {
 888   nick *np = (nick *)sender;
 889   trojanscan_log(np, "reschedule", "");
 890   trojanscan_fill_channels(NULL);
 891
 892   trojanscan_reply(np, "Rescheduled.");
 893   return CMD_OK;
 894 }
 895
 896 int trojanscan_listusers(void *sender, int cargc, char **cargv) {
 897   nick *np = (nick *)sender;
 898
 899   trojanscan_log(np, "listusers", "");
 900
 901   trojanscan_reply(np, "User list:");
 902
 903   if (!(trojanscan_database_query("SELECT authname, authlevel FROM users ORDER BY authlevel DESC, authname"))) {
 904     trojanscan_database_res *res;
 905     if ((res = trojanscan_database_store_result(&trojanscan_sql))) {
 906       if (trojanscan_database_num_rows(res)) {
 907         trojanscan_database_row sqlrow;
 908         union trojanscan_userlevel flags;
 909         while((sqlrow = trojanscan_database_fetch_row(res))) {
 910           flags.number = atoi(sqlrow[1]);
 911           trojanscan_reply(np, "%s +" TROJANSCAN_FLAG_MASK, sqlrow[0], TrojanscanIsDeveloper(flags) ? "d" : "", TrojanscanIsTeamLeader(flags) ? "t" : "", TrojanscanIsStaff(flags) ? "s" : "", TrojanscanIsWebsite(flags) ? "w" : "", TrojanscanIsCat(flags) ? "c" : "");
 912         }
 913       }
 914       trojanscan_database_free_result(res);
 915     }
 916   }
 917
 918   trojanscan_reply(np, "Done.");
 919   return CMD_OK;
 920 }
 921
 922 int trojanscan_help(void *sender, int cargc, char **cargv) {
 923   nick *np = (nick *)sender;
 924
 925   if (cargc == 0) {
 926     trojanscan_reply(np, "Not enough parameters.");
 927     return CMD_ERROR;
 928   }
 929
 930   if (!strcasecmp("help", cargv[0])) {
 931     trojanscan_reply(np, "Syntax: help <command name>");
 932     trojanscan_reply(np, "Gives help on commands.");
 933   } else if (!strcasecmp("status", cargv[0])) {
 934     trojanscan_reply(np, "Syntax: status");
 935     trojanscan_reply(np, "Gives statistical information about the bot.");
 936   } else if (!strcasecmp("join", cargv[0])) {
 937     trojanscan_reply(np, "Syntax: join <#channel>");
 938     trojanscan_reply(np, "Orders a clone to join supplied channel.");
 939   } else if (!strcasecmp("showcommands", cargv[0])) {
 940     trojanscan_reply(np, "Syntax: showcommands");
 941     trojanscan_reply(np, "Pretty obvious.");
 942   } else if (!strcasecmp("hello", cargv[0])) {
 943     trojanscan_reply(np, "Syntax: hello ?nickname?");
 944     trojanscan_reply(np, "Creates a new user.");
 945   } else if (!strcasecmp("rehash", cargv[0])) {
 946     trojanscan_reply(np, "Syntax: rehash");
 947     trojanscan_reply(np, "Reloads bot database.");
 948   } else if (!strcasecmp("changelev", cargv[0])) {
 949     trojanscan_reply(np, "Syntax: changelev <nickname or #authname> <flags>");
 950     trojanscan_reply(np, "Changes access flags of selected user to supplied input.");
 951     trojanscan_reply(np, "+d -> developer");
 952     trojanscan_reply(np, "+t -> team leader");
 953     trojanscan_reply(np, "+s -> staff");
 954     trojanscan_reply(np, "+w -> web management");
 955     trojanscan_reply(np, "+c -> cat access");
 956   } else if (!strcasecmp("deluser", cargv[0])) {
 957     trojanscan_reply(np, "Syntax: deluser <nickname or #authname>");
 958     trojanscan_reply(np, "Deletes selected user from my database.");
 959   } else if (!strcasecmp("mew", cargv[0])) {
 960     trojanscan_reply(np, "Syntax: mew <#channel or nickname> <nickname>");
 961     trojanscan_reply(np, "Gracefully mews at target in selected channel or query.");
 962   } else if (!strcasecmp("cat", cargv[0])) {
 963     trojanscan_reply(np, "Syntax: cat <#channel or nickname>");
 964     trojanscan_reply(np, "Shows the almightly cat.");
 965   } else if (!strcasecmp("reschedule", cargv[0])) {
 966     trojanscan_reply(np, "Syntax: reschedule");
 967     trojanscan_reply(np, "Recalculates bots schedule.");
 968   } else if (!strcasecmp("chanlist", cargv[0])) {
 969     trojanscan_reply(np, "Syntax: chanlist");
 970     trojanscan_reply(np, "Displays bots current channel list.");
 971   } else if (!strcasecmp("whois", cargv[0])) {
 972     trojanscan_reply(np, "Syntax: whois <nickname or #authname>");
 973     trojanscan_reply(np, "Displays information on given user.");
 974   } else if (!strcasecmp("whois", cargv[0])) {
 975     trojanscan_reply(np, "Syntax: listusers <flags>");
 976     trojanscan_reply(np, "Displays users with listusersing flags.");
 977   } else {
 978     trojanscan_reply(np, "Command not found.");
 979     return CMD_ERROR;
 980   }
 981
 982   return CMD_OK;
 983 }
 984
 985 int trojanscan_hello(void *sender, int cargc, char **cargv) {
 986   nick *np = (nick *)sender, *toadd;
 987   char eaccount[TROJANSCAN_QUERY_TEMP_BUF_SIZE];
 988   int level = 0;
 989
 990   if (cargc > 0) {
 991     toadd = getnickbynick(cargv[0]);
 992     if (!toadd) {
 993       trojanscan_reply(np, "That nickname is not on the network.");
 994       return CMD_ERROR;
 995     }
 996     if (!IsAccount(toadd)) {
 997       trojanscan_reply(np, "That user is not authed with the network.");
 998       return CMD_ERROR;
 999     }
1000   } else {
1001     if (!IsAccount(np)) {
1002       trojanscan_reply(np, "You are not authed with the network, auth before creating your user.");
1003       return CMD_ERROR;
1004     }
1005     toadd = np;
1006   }
1007
1008   if (trojanscan_user_level_by_authname(toadd->authname)!=-1) {
1009     trojanscan_reply(np, "Authname (%s) is already on file.", toadd->authname);
1010     return CMD_ERROR;
1011   }
1012
1013   trojanscan_log(np, "hello", toadd->authname);
1014
1015   if (!(trojanscan_database_query("SELECT id FROM users LIMIT 1"))) {
1016     trojanscan_database_res *res;
1017     if ((res = trojanscan_database_store_result(&trojanscan_sql))) {
1018       if (trojanscan_database_num_rows(res) == 0)
1019         level = TROJANSCAN_ACL_DEVELOPER | TROJANSCAN_ACL_STAFF | TROJANSCAN_ACL_WEBSITE | TROJANSCAN_ACL_CAT;
1020       trojanscan_database_free_result(res);
1021     }
1022   }
1023
1024   trojanscan_database_escape_string(eaccount, toadd->authname, strlen(toadd->authname));
1025   trojanscan_database_query("INSERT INTO users (authname, authlevel) VALUES ('%s', %d)", eaccount, level);
1026   trojanscan_reply(np, "Account added to database, account %s%s.", toadd->authname, level>0?" (first user so developer access)":"");
1027
1028   return CMD_OK;
1029 }
1030
1031 int trojanscan_user_level_by_authname(char *authname) {
1032   int result = -1, sl = strlen(authname);
1033   char eaccount[TROJANSCAN_QUERY_TEMP_BUF_SIZE];
1034
1035   trojanscan_database_escape_string(eaccount, authname, sl);
1036   if (!(trojanscan_database_query("SELECT authlevel, authname FROM users WHERE authname = '%s'", eaccount))) {
1037     trojanscan_database_res *res;
1038     if ((res = trojanscan_database_store_result(&trojanscan_sql))) {
1039       if (trojanscan_database_num_rows(res) > 0) {
1040         trojanscan_database_row sqlrow = trojanscan_database_fetch_row(res);
1041         result = atoi(sqlrow[0]);
1042         strlcpy(authname, sqlrow[1], sl + 1);
1043       }
1044       trojanscan_database_free_result(res);
1045     }
1046   }
1047   return result;
1048 }
1049
1050 int trojanscan_user_id_by_authname(char *authname) {
1051   int result = 0;
1052   char eaccount[TROJANSCAN_QUERY_TEMP_BUF_SIZE];
1053
1054   trojanscan_database_escape_string(eaccount, authname, strlen(authname));
1055   if (!(trojanscan_database_query("SELECT id FROM users WHERE authname = '%s'", eaccount))) {
1056     trojanscan_database_res *res;
1057     if ((res = trojanscan_database_store_result(&trojanscan_sql))) {
1058       if (trojanscan_database_num_rows(res) > 0) {
1059         trojanscan_database_row sqlrow = trojanscan_database_fetch_row(res);
1060         result = atoi(sqlrow[0]);
1061       }
1062       trojanscan_database_free_result(res);
1063     }
1064   }
1065   return result;
1066 }
1067
1068 struct trojanscan_clones *trojanscan_selectclone(char type) {
1069   struct trojanscan_clones *rc;
1070   int randomclone, hits = 0, minlimit, maxlimit;
1071
1072   if(type == TROJANSCAN_WATCH_CLONES) {
1073     minlimit = TROJANSCAN_CLONE_MAX;
1074     maxlimit = minlimit + TROJANSCAN_WATCHCLONE_MAX - 1;
1075   } else {
1076     minlimit = 0;
1077     maxlimit = TROJANSCAN_CLONE_MAX - 1;
1078   }
1079
1080   do {
1081     randomclone = trojanscan_minmaxrand(minlimit, maxlimit);
1082     if (hits++ > 200)
1083       return NULL;
1084     rc = &trojanscan_swarm[randomclone];
1085     if ((type == TROJANSCAN_NORMAL_CLONES) && (rc->sitting == 0) && (rc->remaining == 0))
1086       break;
1087
1088   } while (rc->remaining == 0);
1089
1090   if(type == TROJANSCAN_NORMAL_CLONES) {
1091     if ((rc->sitting == 0) && (rc->remaining == 0)) {
1092       if ((!rc->remaining) && (!rc->sitting)) {
1093         if (rc->clone) {
1094           deregisterlocaluser(rc->clone, NULL);
1095           derefnode(iptree, rc->fakeipnode);
1096           rc->clone = NULL;
1097         }
1098         trojanscan_generateclone((void *)((long)rc->index));
1099       }
1100     }
1101   }
1102
1103   return rc;
1104
1105 }
1106
1107 /* hack hack hack */
1108 int trojanscan_nickbanned(trojanscan_clones *np, channel *cp) {
1109   int ret;
1110   patricia_node_t *realipnode = np->clone->ipnode;
1111
1112   np->clone->ipnode = np->fakeipnode;
1113
1114   ret = nickbanned(np->clone, cp, 0);
1115
1116   np->clone->ipnode = realipnode;
1117
1118   return ret;
1119 }
1120
1121 struct trojanscan_realchannels *trojanscan_allocaterc(char *chan) {
1122   struct trojanscan_realchannels *rc;
1123   struct trojanscan_clones *clonep;
1124   channel *cp;
1125   int attempts_left = 10;
1126
1127   if (!chan) {
1128     trojanscan_errorcode = 1; /* sorry splidge ;( */
1129     return NULL;
1130   }
1131
1132   if(chan[0] != '#') {
1133     trojanscan_errorcode = 2;
1134     return NULL;
1135   }
1136
1137   if (strlen(chan) > 1) {
1138     if(strrchr(chan, ',')) {
1139       trojanscan_errorcode = 3;
1140       return NULL;
1141     }
1142
1143     if(strrchr(chan, ' ')) {
1144       trojanscan_errorcode = 4;
1145       return NULL;
1146     }
1147   }
1148
1149   cp = findchannel(chan);
1150   if (!cp) {
1151     trojanscan_errorcode = 5;
1152     return NULL;
1153   }
1154
1155   do {
1156     clonep = trojanscan_selectclone(TROJANSCAN_NORMAL_CLONES);
1157     if (!clonep) {
1158       trojanscan_errorcode = 6;
1159       return NULL;
1160     }
1161     if(!trojanscan_nickbanned(clonep, cp))
1162       break;
1163   } while (--attempts_left > 0);
1164
1165   if (!attempts_left) {
1166     trojanscan_errorcode = 7;
1167     return NULL;
1168   }
1169
1170   rc = (struct trojanscan_realchannels *)tmalloc(sizeof(struct trojanscan_realchannels));
1171
1172   rc->next = NULL;
1173   rc->clone = clonep;
1174   rc->chan = cp;
1175   rc->donotpart = 0;
1176   rc->kickedout = 0;
1177   return rc;
1178 }
1179
1180 void trojanscan_join(struct trojanscan_realchannels *rc) {
1181   struct trojanscan_realchannels *rp = trojanscan_realchanlist;
1182
1183   if (rc->clone && rc->clone->clone) {
1184     if (!localjoinchannel(rc->clone->clone, rc->chan)) {
1185       rc->clone->remaining--;
1186       rc->clone->sitting++;
1187       if (trojanscan_minmaxrand(1, TROJANSCAN_NICKCHANGE_ODDS)%TROJANSCAN_NICKCHANGE_ODDS == 0)
1188         trojanscan_donickchange((void *)rc->clone);
1189
1190       rc->schedule = scheduleoneshot(time(NULL)+trojanscan_part_time, &trojanscan_dopart, (void *)rc);
1191
1192       if (rp) {
1193         for(;rp->next;rp=rp->next);
1194         rp->next = rc;
1195       } else {
1196         trojanscan_realchanlist = rc;
1197       }
1198     }
1199   }
1200
1201 }
1202
1203 int trojanscan_userjoin(void *sender, int cargc, char **cargv) {
1204   nick *np = (nick *)sender;
1205   struct trojanscan_realchannels *rc;
1206
1207   if (cargc < 1) {
1208     trojanscan_reply(np, "Not enough paramaters");
1209     return CMD_ERROR;
1210   }
1211
1212   if (!trojanscan_swarm_created) {
1213     trojanscan_reply(np, "My swarm is currently empty.");
1214     return CMD_OK;
1215   }
1216
1217   if((rc = trojanscan_allocaterc(cargv[0]))) {
1218     trojanscan_log(np, "join", cargv[0]);
1219     trojanscan_join(rc);
1220     trojanscan_reply(np, "Clone has joined channel.");
1221     if(!IsOper(np))
1222       trojanscan_mainchanmsg("n: join: %s (%s/%s)", cargv[0], np->nick, np->authname);
1223   } else {
1224     if (trojanscan_errorcode == 5) {
1225       trojanscan_reply(np, "Not joining empty channel, check you entered the correct channel name.");
1226     } else {
1227       trojanscan_reply(np, "Clone could not join channel (error code %d)!", trojanscan_errorcode);
1228     }
1229   }
1230   return CMD_OK;
1231 }
1232
1233 int trojanscan_rehash(void *sender, int cargc, char **cargv) {
1234   nick *np = (void *)sender;
1235   trojanscan_refresh_settings();
1236   trojanscan_read_database(0);
1237   trojanscan_log(np, "rehash", "");
1238   trojanscan_reply(np, "Done.");
1239   return CMD_OK;
1240 }
1241
1242 int trojanscan_changelev(void *sender, int cargc, char **cargv) {
1243   nick *np = (nick *)sender, *np2;
1244   int templevel;
1245   char eaccount[TROJANSCAN_QUERY_TEMP_BUF_SIZE], *tochange, *p, mode = 1, error = 0, clast = 0, specialcase;
1246   union trojanscan_userlevel flags1, flags2;
1247
1248   if (cargc < 2) {
1249     trojanscan_reply(np, "Not enough parameters.");
1250     return CMD_ERROR;
1251   }
1252
1253   templevel = trojanscan_user_level_by_authname(np->authname);
1254
1255   if (templevel == -1) {
1256     trojanscan_reply(np, "You do not have an account.");
1257     return CMD_ERROR;
1258   }
1259
1260   flags1.number = templevel;
1261
1262   if (cargv[0][0] == '#') {
1263     tochange = cargv[0] + 1;
1264   } else {
1265     np2 = getnickbynick(cargv[0]);
1266     if (!np2) {
1267       trojanscan_reply(np, "That nickname is not on the network.");
1268       return CMD_ERROR;
1269     }
1270     if (!IsAccount(np2)) {
1271       trojanscan_reply(np, "That user is not authed with the network.");
1272       return CMD_ERROR;
1273     }
1274     tochange = np2->authname;
1275   }
1276
1277   templevel = trojanscan_user_level_by_authname(tochange);
1278
1279   if (templevel == -1) {
1280     trojanscan_reply(np, "User does not exist.");
1281     return CMD_ERROR;
1282   }
1283
1284   flags2.number = templevel;
1285
1286   if (!ircd_strcmp(np->authname, tochange)) {
1287     specialcase = 1;
1288   } else {
1289     specialcase = 0;
1290   }
1291
1292   for (p=cargv[1];*p;p++) {
1293     switch (*p) {
1294       case '+':
1295       case '-':
1296         mode = (*p == '+');
1297         break;
1298       case 'd':
1299         if (!TrojanscanIsDeveloper(flags1))
1300           clast = 1;
1301         flags2.values.developer = mode;
1302         break;
1303       case 't':
1304         if (!TrojanscanIsDeveloper(flags1))
1305           clast = 1;
1306         flags2.values.teamleader = mode;
1307         break;
1308       case 's':
1309         if (!TrojanscanIsLeastTeamLeader(flags1))
1310           clast = 1;
1311         flags2.values.staff = mode;
1312         break;
1313       case 'w':
1314         if (!TrojanscanIsDeveloper(flags1))
1315           clast = 1;
1316         flags2.values.website = mode;
1317         break;
1318       case 'c':
1319         if (!TrojanscanIsDeveloper(flags1))
1320           clast = 1;
1321         flags2.values.cat = mode;
1322         break;
1323       default:
1324         error = 1;
1325         goto last;
1326         break;
1327     }
1328     if (clast == 1) {
1329       if (specialcase && !mode) { /* allow user to remove their own flags */
1330         clast = 0;
1331       } else {
1332         goto last;
1333       }
1334     }
1335   }
1336
1337   last:
1338   if (*p) {
1339     if (error) {
1340       trojanscan_reply(np, "Unknown mode: %c%c.", mode?'+':'-', *p);
1341     } else {
1342       trojanscan_reply(np, "You have insufficient privilidges to add/remove one or more flags specified.");
1343     }
1344     return CMD_ERROR;
1345   }
1346
1347   trojanscan_log(np, "changelev", "%s %s", tochange, cargv[1]);
1348   trojanscan_database_escape_string(eaccount, tochange, strlen(tochange));
1349   trojanscan_database_query("UPDATE users SET authlevel = %d WHERE authname = '%s'", flags2.number, eaccount);
1350
1351   trojanscan_reply(np, "Flags changed.");
1352
1353   return CMD_OK;
1354 }
1355
1356 int trojanscan_deluser(void *sender, int cargc, char **cargv) {
1357   nick *np = (nick *)sender, *to;
1358   int templevel;
1359   char eaccount[TROJANSCAN_QUERY_TEMP_BUF_SIZE], *account;
1360   union trojanscan_userlevel flags1, flags2;
1361
1362   if (cargc < 1) {
1363     trojanscan_reply(np, "Not enough parameters.");
1364     return CMD_ERROR;
1365   }
1366
1367   if (cargv[0][0] == '#') {
1368     account = cargv[0] + 1;
1369   } else {
1370     to = getnickbynick(cargv[0]);
1371     if (!to) {
1372       trojanscan_reply(np, "That nickname is not on the network.");
1373       return CMD_ERROR;
1374     }
1375     if (!IsAccount(to)) {
1376       trojanscan_reply(np, "That user is not authed with the network.");
1377       return CMD_ERROR;
1378     }
1379     account = to->authname;
1380   }
1381
1382   flags1.number = trojanscan_user_level_by_authname(np->authname);
1383   templevel = trojanscan_user_level_by_authname(account);
1384
1385   if (templevel == -1) {
1386     trojanscan_reply(np, "Auth %s does not exist.", account);
1387     return CMD_ERROR;
1388   }
1389
1390   flags2.number = templevel;
1391
1392   if (!TrojanscanIsDeveloper(flags1) && TrojanscanIsLeastTeamLeader(flags2)) {
1393       trojanscan_reply(np, "Your cannot delete %s as his/her flags equal or surpass your own.", account);
1394       return CMD_ERROR;
1395   }
1396
1397   trojanscan_log(np, "deluser", account);
1398   trojanscan_database_escape_string(eaccount, account, strlen(account));
1399   trojanscan_database_query("DELETE FROM users WHERE authname = '%s'", eaccount);
1400   trojanscan_reply(np, "User deleted.");
1401
1402   return CMD_OK;
1403 }
1404
1405 int trojanscan_add_ll(struct trojanscan_prechannels **head, struct trojanscan_prechannels *newitem) {
1406   struct trojanscan_prechannels *position, *lastitem = NULL, *location = NULL;
1407   if (!*head) {
1408     *head = newitem;
1409     newitem->next = NULL;
1410     if (newitem->exempt) {
1411       return 0;
1412     } else {
1413       return 1;
1414     }
1415   }
1416   /* if its exempt, we don't give a monkeys where it is... */
1417   if (newitem->exempt) {
1418     newitem->next = *head;
1419     *head = newitem;
1420     return 0;
1421   }
1422
1423   for(position=*head;position;lastitem=position,position=position->next) {
1424     if (!ircd_strcmp(position->name->content, newitem->name->content)) {
1425       tfree(newitem);
1426       return 0;
1427     }
1428     if (!location && (position->size < newitem->size)) {
1429       if (!lastitem) {
1430         location = *head;
1431       } else {
1432         location = lastitem;
1433       }
1434     }
1435   }
1436   if (!location) {
1437     newitem->next = NULL;
1438     lastitem->next = newitem;
1439   } else {
1440     newitem->next = location->next;
1441     location->next = newitem;
1442   }
1443   if(newitem->exempt) {
1444     return 0;
1445   } else {
1446     return 1;
1447   }
1448 }
1449
1450 void trojanscan_watch_clone_update(struct trojanscan_prechannels *hp, int count) {
1451   int i, j, marked;
1452   struct trojanscan_prechannels *lp;
1453   struct trojanscan_templist *markedlist = NULL;
1454
1455   if(count > 0) {
1456     markedlist = (struct trojanscan_templist *)tmalloc(count * sizeof(struct trojanscan_templist));
1457     if (!markedlist)
1458       return;
1459     memset(markedlist, 0, sizeof(struct trojanscan_templist) * count);
1460   }
1461
1462   for(i=0;i<trojanscan_activechans;i++) {
1463     marked = 0;
1464     if(markedlist) {
1465       for(lp=hp,j=0;j<count&&lp;j++,lp=lp->next) {
1466         if(!markedlist[j].active && !lp->exempt && !ircd_strcmp(lp->name->content, trojanscan_chans[i].channel->content)) { /* we're already on the channel */
1467           if(trojanscan_chans[i].watch_clone) {
1468             markedlist[j].active = 1;
1469             markedlist[j].watch_clone = trojanscan_chans[i].watch_clone;
1470             lp->watch_clone = trojanscan_chans[i].watch_clone;
1471           }
1472           marked = 1;
1473           break;
1474         }
1475       }
1476     }
1477     if(!marked && trojanscan_chans[i].watch_clone) {
1478       channel *cp = findchannel(trojanscan_chans[i].channel->content);
1479       if(cp)
1480         localpartchannel(trojanscan_chans[i].watch_clone->clone, cp, NULL);
1481     }
1482   }
1483
1484   if(!markedlist)
1485     return;
1486
1487   for(j=0,lp=hp;j<count&&lp;j++,lp=lp->next) {
1488     if((!markedlist[j].active || !markedlist[j].watch_clone) && !lp->exempt) {
1489       channel *cp = findchannel(lp->name->content);
1490       if(cp) {
1491         int attempts = 10;
1492         do {
1493           lp->watch_clone = trojanscan_selectclone(TROJANSCAN_WATCH_CLONES);
1494           if(!lp->watch_clone)
1495             break;
1496           if(!trojanscan_nickbanned(lp->watch_clone, cp)) {
1497             if(localjoinchannel(lp->watch_clone->clone, cp))
1498               lp->watch_clone = NULL;
1499             break;
1500           }
1501         } while(--attempts > 0);
1502         if(!attempts)
1503           lp->watch_clone = NULL;
1504
1505       }
1506     }
1507   }
1508
1509   tfree(markedlist);
1510 }
1511
1512 void trojanscan_fill_channels(void *arg) {
1513   struct trojanscan_prechannels *head = NULL, *lp, *last = NULL;
1514   int i, count, tempctime = 0;
1515
1516   chanindex *chn;
1517
1518   for (count=i=0;i<trojanscan_database.total_channels;i++) {
1519     lp = (trojanscan_prechannels *)tmalloc(sizeof(trojanscan_prechannels));
1520     lp->name = trojanscan_database.channels[i].name;
1521     lp->size = 65535;
1522     lp->exempt = trojanscan_database.channels[i].exempt;
1523     lp->watch_clone = NULL;
1524     if (trojanscan_add_ll(&head, lp))
1525       count++;
1526   }
1527
1528   for (i=0;i<CHANNELHASHSIZE;i++) {
1529     for(chn=chantable[i];chn;chn=chn->next) {
1530       if (chn->channel && !IsKey(chn->channel) && !IsInviteOnly(chn->channel) && !IsRegOnly(chn->channel) && (chn->channel->users->totalusers >= trojanscan_minchansize)) {
1531         lp = (trojanscan_prechannels *)tmalloc(sizeof(trojanscan_prechannels));
1532         lp->name = chn->name;
1533         lp->size = chn->channel->users->totalusers;
1534         lp->exempt = 0;
1535         lp->watch_clone = NULL;
1536         if (trojanscan_add_ll(&head, lp))
1537           count++;
1538       }
1539     }
1540   }
1541
1542   count = TROJANSCAN_MMIN(count, trojanscan_maxchans);
1543
1544   trojanscan_watch_clone_update(head, count);
1545
1546   trojanscan_free_channels();
1547   trojanscan_chans = (struct trojanscan_inchannel *)tmalloc(count * sizeof(struct trojanscan_inchannel));
1548   memset(trojanscan_chans, 0, count * sizeof(struct trojanscan_inchannel));
1549   trojanscan_activechans = count;
1550   i = 0;
1551
1552   for(lp=head;lp;last=lp,lp=lp->next) {
1553     if (!(lp->exempt) && (i < count)) {
1554       trojanscan_chans[i].channel = getsstring(lp->name->content, lp->name->length);
1555       trojanscan_chans[i++].watch_clone = lp->watch_clone;
1556     }
1557     if (last)
1558       tfree(last);
1559   }
1560
1561   if (last)
1562     tfree(last);
1563
1564   if (trojanscan_activechans > 0) {
1565     tempctime = trojanscan_cycletime / trojanscan_activechans;
1566   } else {
1567     tempctime = 60;
1568     trojanscan_mainchanmsg("d: just escaped a divide by zero error (no activechans!), rescheduling in 60 seconds");
1569   }
1570
1571   if(trojanscan_schedule)
1572     deleteschedule(trojanscan_schedule, &trojanscan_dojoin, NULL);
1573
1574   trojanscan_channumber = 0;
1575
1576   trojanscan_schedule = schedulerecurring(time(NULL) + tempctime, trojanscan_activechans + 1, tempctime, trojanscan_dojoin, NULL);
1577
1578 }
1579
1580 void trojanscan_dojoin(void *arg) {
1581   struct trojanscan_realchannels *rc;
1582   if (trojanscan_channumber >= trojanscan_activechans) {
1583     trojanscan_schedule = NULL;
1584     trojanscan_fill_channels(NULL);
1585   } else {
1586     if ((rc = trojanscan_allocaterc(trojanscan_chans[trojanscan_channumber++].channel->content)))
1587       trojanscan_join(rc);
1588   }
1589 }
1590
1591
1592 void trojanscan_dopart(void *arg) {
1593   struct trojanscan_realchannels *rc = (struct trojanscan_realchannels *)arg, *rp, *past = NULL;
1594
1595   if (rc->kickedout) { /* there's a join scheduled, wait for it (reschedule) */
1596     rc->schedule = scheduleoneshot(time(NULL)+5, &trojanscan_dopart, (void *)rc);
1597     return;
1598   }
1599
1600   if (rc->clone->clone && (!(rc->donotpart)))
1601     localpartchannel(rc->clone->clone, rc->chan, NULL);
1602
1603   rc->clone->sitting--;
1604
1605   for(rp=trojanscan_realchanlist;rp;rp=rp->next) {
1606     if (rp == rc) {
1607       if (!past) {
1608         trojanscan_realchanlist = rp->next;
1609       } else {
1610         past->next = rp->next;
1611       }
1612       tfree(rp);
1613       break;
1614     }
1615     past = rp;
1616   }
1617
1618 }
1619
1620 void trojanscan_donickchange(void *arg) { /* just incase I choose to make this schedule at some point */
1621   struct trojanscan_clones *clone = (trojanscan_clones *)arg;
1622   if (clone && clone->clone) {
1623     char c_nick[NICKLEN+1];
1624     int loops = 0;
1625     /* PPA: unlikely to be infinite */
1626     do {
1627       if ((loops++ < 10) && trojanscan_hostmode) {
1628         trojanscan_generatenick(c_nick, NICKLEN);
1629       } else {
1630         trojanscan_gennick(c_nick, trojanscan_minmaxrand(7, TROJANSCAN_MMIN(13, NICKLEN)));
1631       }
1632     } while (c_nick[0] && (getnickbynick(c_nick) != NULL));
1633
1634     renamelocaluser(clone->clone, c_nick);
1635   }
1636
1637 }
1638
1639 int trojanscan_keysort(const void *v1, const void *v2) {
1640   return ((*(trojanscan_prechannels **)v2)->size - (*(trojanscan_prechannels **)v1)->size);
1641 }
1642
1643 int trojanscan_showcommands(void *sender, int cargc, char **cargv) {
1644   nick *np = (nick *)sender;
1645   Command *cmdlist[100];
1646   int i, n;
1647   char level = 0;
1648
1649   n = getcommandlist(trojanscan_cmds, cmdlist, 100);
1650
1651   trojanscan_reply(np, "The following commands are registered at present:");
1652
1653   for(i=0;i<n;i++) {
1654     if (cmdlist[i]->level & TROJANSCAN_ACL_STAFF) {
1655       level = 's';
1656     } else if (cmdlist[i]->level & TROJANSCAN_ACL_DEVELOPER) {
1657       level = 'd';
1658     } else if (cmdlist[i]->level & TROJANSCAN_ACL_TEAMLEADER) {
1659       level = 't';
1660     } else if (cmdlist[i]->level & TROJANSCAN_ACL_CAT) {
1661       level = 'c';
1662     } else if (cmdlist[i]->level & TROJANSCAN_ACL_WEBSITE) {
1663       level = 'w';
1664     } else if (cmdlist[i]->level & TROJANSCAN_ACL_UNAUTHED) {
1665       level = 0;
1666     }
1667     if (level) {
1668       trojanscan_reply(np, "%s (+%c)", cmdlist[i]->command->content, level);
1669     } else {
1670       trojanscan_reply(np, "%s", cmdlist[i]->command->content);
1671     }
1672   }
1673   trojanscan_reply(np, "End of list.");
1674   return CMD_OK;
1675 }
1676
1677 void trojanscan_handlemessages(nick *target, int messagetype, void **args) {
1678   Command *cmd;
1679   char *cargv[50];
1680   int cargc, templevel;
1681   nick *sender;
1682   union trojanscan_userlevel level;
1683
1684   switch(messagetype) {
1685     case LU_PRIVMSG:
1686     case LU_SECUREMSG:
1687       /* If it's a message, first arg is nick and second is message */
1688       sender = (nick *)args[0];
1689
1690       if(strncmp(TROJANSCAN_VERSION_DETECT, args[1], sizeof(TROJANSCAN_VERSION_DETECT)-1)==0) {
1691         char p = ((char *)args[1])[sizeof(TROJANSCAN_VERSION_DETECT)-1];
1692         if((p == ' ') || (p == '\0') || (p == 1)) {
1693           trojanscan_reply(sender, "\001VERSION Trojanscan (or Tigger) Newserv module version %s by Chris Porter (slug), Newserv by David Mansell (splidge). Compiled " __DATE__ " " __TIME__ ".\001", TROJANSCAN_VERSION);
1694           return;
1695         }
1696       }
1697
1698       /* Split the line into params */
1699       cargc = splitline((char *)args[1], cargv, 50, 0);
1700       if(cargc == 0 || !cargv[0])
1701         return;
1702
1703       cmd=findcommandintree(trojanscan_cmds, cargv[0], 1);
1704       if (!cmd) {
1705         trojanscan_reply(sender, "Unknown command.");
1706         return;
1707       }
1708
1709       if ((cmd->level & TROJANSCAN_ACL_OPER) && !IsOper(sender)) {
1710         trojanscan_reply(sender, "You need to be opered to use this command.");
1711         return;
1712       }
1713
1714       /* bit grim code... */
1715
1716       if (!(cmd->level & TROJANSCAN_ACL_UNAUTHED)) {
1717         if (!IsAccount(sender)) {
1718           trojanscan_reply(sender, "You must be authed with the network to access this command!");
1719           return;
1720         }
1721         templevel = trojanscan_user_level_by_authname(sender->authname);
1722
1723         if (templevel == -1) {
1724           trojanscan_reply(sender, "You do not have an account.");
1725           return;
1726         }
1727
1728         level.number = templevel;
1729
1730         if ((cmd->level & TROJANSCAN_ACL_DEVELOPER) && !TrojanscanIsDeveloper(level)) {
1731           trojanscan_reply(sender, "Access denied.");
1732           return;
1733         }
1734         if ((cmd->level & TROJANSCAN_ACL_TEAMLEADER) && !TrojanscanIsLeastTeamLeader(level)) {
1735           trojanscan_reply(sender, "Access denied.");
1736           return;
1737         }
1738         if ((cmd->level & TROJANSCAN_ACL_STAFF) && !TrojanscanIsLeastStaff(level)) {
1739           trojanscan_reply(sender, "Access denied.");
1740           return;
1741         }
1742         if ((cmd->level & TROJANSCAN_ACL_CAT) && !TrojanscanIsCat(level)) {
1743           trojanscan_reply(sender, "Access denied.");
1744           return;
1745         }
1746         if ((cmd->level & TROJANSCAN_ACL_WEBSITE) && !TrojanscanIsLeastWebsite(level)) {
1747           trojanscan_reply(sender, "Access denied.");
1748           return;
1749         }
1750       }
1751
1752       /* Check the maxargs */
1753       if (cmd->maxparams<(cargc-1)) {
1754         /* We need to do some rejoining */
1755         rejoinline(cargv[cmd->maxparams], cargc-(cmd->maxparams));
1756         cargc = (cmd->maxparams) + 1;
1757       }
1758
1759       (cmd->handler)((void *)sender, cargc - 1, &(cargv[1]));
1760       break;
1761
1762     case LU_KILLED:
1763       /* someone killed me?  Bastards */
1764       trojanscan_connect_nick_schedule = scheduleoneshot(time(NULL) + 1, &trojanscan_connect_nick, NULL);
1765       trojanscan_nick = NULL;
1766       break;
1767
1768     default:
1769       break;
1770   }
1771 }
1772
1773 static char trojanscan_getmtfromhooktype(int input) {
1774   switch(input) {
1775     case HOOK_CHANNEL_PART: return 'P';
1776     default:                return '?';
1777   }
1778 }
1779
1780 char trojanscan_getmtfrommessagetype(int input) {
1781   switch(input) {
1782     case LU_PRIVMSG:    return 'm';
1783     case LU_PRIVNOTICE: return 'n';
1784     case LU_SECUREMSG:  return 's';
1785     case LU_CHANMSG:    return 'M';
1786     case LU_CHANNOTICE: return 'N';
1787     default:            return '?';
1788   }
1789 }
1790
1791 static void trojanscan_process(nick *sender, channel *cp, char mt, char *pretext) {
1792   char text[513];
1793   unsigned int len;
1794   unsigned int i;
1795   struct trojanscan_worms *worm;
1796   int vector[30], detected = 0;
1797
1798   trojanscan_strip_codes(text, sizeof(text) - 1, pretext);
1799
1800   len = strlen(text);
1801
1802   for(i=0;i<trojanscan_database.total_phrases;i++) {
1803     if (
1804          (
1805            (worm = trojanscan_database.phrases[i].worm)
1806          ) &&
1807          (
1808            (
1809              (
1810                (mt == 'm') || (mt == 's') || (mt == 'n')
1811              ) &&
1812              (
1813                (trojanscan_database.phrases[i].worm->hitpriv)
1814              )
1815            ) ||
1816            (
1817              (
1818                (mt == 'M') || (mt == 'N') || (mt == 'P')
1819              ) &&
1820              (
1821                (trojanscan_database.phrases[i].worm->hitchans)
1822              )
1823            )
1824          ) &&
1825          (trojanscan_database.phrases[i].phrase)
1826        ) {
1827       int pre = pcre_exec(trojanscan_database.phrases[i].phrase, trojanscan_database.phrases[i].hint, text, len, 0, 0, vector, 30);
1828       if(pre >= 0) {
1829         char matchbuf[513];
1830         matchbuf[0] = 0;
1831         matchbuf[512] = 0; /* hmm */
1832
1833         if(pre > 1)
1834           if(pcre_copy_substring(text, vector, pre, 1, matchbuf, sizeof(matchbuf) - 1) <= 0)
1835             matchbuf[0] = 0;
1836
1837         trojanscan_phrasematch(cp, sender, &trojanscan_database.phrases[i], mt, matchbuf);
1838
1839         detected = 1;
1840         break;
1841       }
1842     }
1843   }
1844   if (!detected && (mt != 'N') && (mt != 'M')) {
1845     char etext[TROJANSCAN_QUERY_TEMP_BUF_SIZE], enick[TROJANSCAN_QUERY_TEMP_BUF_SIZE], eident[TROJANSCAN_QUERY_TEMP_BUF_SIZE], ehost[TROJANSCAN_QUERY_TEMP_BUF_SIZE];
1846     trojanscan_database_escape_string(etext, text, len);
1847     trojanscan_database_escape_string(enick, sender->nick, strlen(sender->nick));
1848     trojanscan_database_escape_string(eident, sender->ident, strlen(sender->ident));
1849     trojanscan_database_escape_string(ehost, sender->host->name->content, sender->host->name->length);
1850     trojanscan_database_query("INSERT INTO unknownlog (data, user) VALUES ('%s','%s!%s@%s')", etext, enick, eident, ehost);
1851   }
1852 }
1853
1854 void trojanscan_clonehandlemessages(nick *target, int messagetype, void **args) {
1855   char *pretext = NULL;
1856   nick *sender;
1857   struct trojanscan_realchannels *rp;
1858   struct trojanscan_rejoinlist *rj;
1859   char mt = trojanscan_getmtfrommessagetype(messagetype);
1860   char *channel_name;
1861   channel *cp = NULL;
1862   int i;
1863
1864   switch(messagetype) {
1865     case LU_PRIVMSG:
1866     case LU_SECUREMSG:
1867     case LU_PRIVNOTICE:
1868
1869     pretext = (char *)args[1];
1870
1871     case LU_CHANMSG:
1872     case LU_CHANNOTICE:
1873       sender = (nick *)args[0];
1874
1875       if (strlen(sender->nick) < 2)
1876         break;
1877
1878       if (!pretext) {
1879         pretext = (char *)args[2];
1880         cp = args[1];
1881       }
1882
1883       if(strncmp(TROJANSCAN_VERSION_DETECT, pretext, sizeof(TROJANSCAN_VERSION_DETECT)-1)==0) {
1884         char p = pretext[sizeof(TROJANSCAN_VERSION_DETECT)-1];
1885         if((p == ' ') || (p == '\0') || (p == 1)) {
1886           int staff = 0;
1887           if (IsOper(sender)) {
1888             staff = 1;
1889           } else {
1890             if (IsAccount(sender)) {
1891               int templevel = trojanscan_user_level_by_authname(sender->authname);
1892               if (templevel != -1) {
1893                 union trojanscan_userlevel level;
1894                 level.number = templevel;
1895                 if (TrojanscanIsLeastStaff(level))
1896                   staff = 1;
1897               }
1898             }
1899           }
1900           if (staff) {
1901             if(trojanscan_nick) {
1902               sendnoticetouser(target, sender, "\001VERSION T clone, check T for confirmation.\001");
1903               sendnoticetouser(trojanscan_nick, sender, "\001VERSION %s is part of my swarm.\001", target->nick);
1904             } else {
1905               sendnoticetouser(target, sender, "\001VERSION T clone, though since T is currently gone you'll have to version me again in a minute for confirmation.\001");
1906             }
1907           } else {
1908             sendnoticetouser(target, sender,  "\001VERSION %s\001", versionreply);
1909           }
1910
1911           return;
1912         }
1913       }
1914
1915       trojanscan_process(sender, cp, mt, pretext);
1916       break;
1917     case LU_KILLED:
1918       /* someone killed me?  Bastards */
1919
1920       /* PPA: we do NOT rejoin channels at this moment in time, it is possible to do this though */
1921       for (i=0;i<TROJANSCAN_CLONE_TOTAL;i++) {
1922         if (trojanscan_swarm[i].clone == target) {
1923
1924           scheduleoneshot(time(NULL)+1, &trojanscan_generateclone, (void *)((long)i));
1925           if(i >= TROJANSCAN_CLONE_MAX) {
1926             int j;
1927             for(j=0;j<trojanscan_activechans;j++)
1928               if(trojanscan_chans[j].watch_clone == &trojanscan_swarm[i])
1929                 trojanscan_chans[j].watch_clone = NULL;
1930           } else {
1931             for(rp=trojanscan_realchanlist;rp;rp=rp->next)
1932               if (rp->clone == &(trojanscan_swarm[i]))
1933                 rp->donotpart = 1;
1934           }
1935           derefnode(iptree, trojanscan_swarm[i].fakeipnode);
1936           trojanscan_swarm[i].clone = NULL;
1937           trojanscan_swarm[i].remaining = 0; /* bah */
1938           break;
1939         }
1940       }
1941       break;
1942
1943     case LU_KICKED:
1944       channel_name = ((channel *)args[1])->index->name->content;
1945       for (i=0;i<trojanscan_activechans;i++) {
1946         if (!trojanscan_chans[i].watch_clone)
1947           continue;
1948         if ((trojanscan_chans[i].watch_clone->clone == target) && (!strcmp(trojanscan_chans[i].channel->content, channel_name)))
1949           break;
1950       }
1951       if(i != trojanscan_activechans) {
1952         int j;
1953         for(j=0;j<TROJANSCAN_CLONE_TOTAL;j++) {
1954           if(&trojanscan_swarm[j] == trojanscan_chans[i].watch_clone) {
1955             trojanscan_chans[i].watch_clone = NULL;
1956             break;
1957           }
1958         }
1959       } else {
1960       /*
1961         trojanscan_mainchanmsg("k: %s on %s by %s", target->nick, ((channel *)args[1])->index->name->content, (((nick *)args[0])->nick)?(((nick *)args[0])->nick):"(server)");
1962       */
1963         rj = (struct trojanscan_rejoinlist *)tmalloc(sizeof(struct trojanscan_rejoinlist));
1964         if (rj) {
1965           rj->rp = NULL;
1966           for(rp=trojanscan_realchanlist;rp;rp=rp->next)
1967                if ((rp->clone->clone == target) && (rp->chan == args[1])) {
1968                 rp->kickedout++;
1969                 rj->rp = rp;
1970                 break;
1971               }
1972             if(!rj->rp) {
1973               tfree(rj);
1974               return;
1975             }
1976
1977             rj->channel = getsstring(((channel *)args[1])->index->name->content, ((channel *)args[1])->index->name->length);
1978             if(!rj->channel) {
1979               trojanscan_mainchanmsg("d: unable to allocate memory for channel: %s upon rejoin", ((channel *)args[1])->index->name->content);
1980               tfree(rj);
1981               return;
1982             }
1983
1984             rj->clone = rp->clone;
1985             rj->next = trojanscan_schedulerejoins;
1986             trojanscan_schedulerejoins = rj;
1987
1988             rj->schedule = scheduleoneshot(time(NULL)+1, &trojanscan_rejoin_channel, (void *)rj);
1989           }
1990         }
1991         break;
1992     default:
1993       break;
1994   }
1995 }
1996
1997 static void trojanscan_part_watch(int hook, void *arg) {
1998   void **arglist = (void **)arg;
1999   channel *cp = (channel *)arglist[0];
2000   nick *np = arglist[1];
2001   char *reason = arglist[2];
2002
2003   if(!cp || !np || !reason || (*reason == '\0'))
2004     return;
2005
2006   trojanscan_process(np, cp, trojanscan_getmtfromhooktype(hook), reason);
2007 }
2008
2009 static int trojanscan_hostcount(nick *sender, int hostmode, char *mask, int masklen) {
2010   int usercount = 0, j;
2011   nick *np = NULL; /* sigh at warnings */
2012
2013   if(hostmode)
2014     usercount = sender->ipnode->usercount;
2015
2016   if(usercount > TROJANSCAN_MAX_HOST_GLINE) {
2017     hostmode = 0;
2018     usercount = 0;
2019   }
2020
2021   /* should really go through the ipnode I guess */
2022   if(!hostmode)
2023     for (j=0;j<NICKHASHSIZE;j++)
2024       for (np=nicktable[j];np;np=np->next)
2025         if (np->ipnode==sender->ipnode && !ircd_strcmp(np->ident, sender->ident))
2026           usercount++;
2027
2028   if(mask)
2029     snprintf(mask, masklen, "%s@%s", hostmode?"*":sender->ident, IPtostr(sender->p_ipaddr));
2030
2031   return usercount;
2032 }
2033
2034 void trojanscan_phrasematch(channel *chp, nick *sender, trojanscan_phrases *phrase, char messagetype, char *matchbuf) {
2035   char glinemask[HOSTLEN + USERLEN + NICKLEN + 4], enick[TROJANSCAN_QUERY_TEMP_BUF_SIZE], eident[TROJANSCAN_QUERY_TEMP_BUF_SIZE], ehost[TROJANSCAN_QUERY_TEMP_BUF_SIZE];
2036   unsigned int frequency;
2037   int glining = 0, usercount;
2038   struct trojanscan_worms *worm = phrase->worm;
2039
2040   trojanscan_database.detections++;
2041
2042   usercount = 0;
2043   if (worm->monitor) {
2044     usercount = -1;
2045   } else if(worm->glinehost || worm->glineuser) {
2046     glining = 1;
2047
2048     usercount = trojanscan_hostcount(sender, worm->glinehost, glinemask, sizeof(glinemask));
2049   }
2050
2051   if (!usercount) {
2052     trojanscan_mainchanmsg("w: user %s!%s@%s triggered infection monitor, yet no hosts found at stage 2 -- worm: %s", sender->nick, sender->ident, sender->host->name->content, worm->name->content);
2053     return;
2054   }
2055
2056   if (glining && (usercount > trojanscan_maxusers)) {
2057     trojanscan_mainchanmsg("w: not glining %s!%s@%s due to too many users (%d) with mask: *!%s -- worm: %s)", sender->nick, sender->ident, sender->host->name->content, usercount, glinemask, worm->name->content);
2058     return;
2059   }
2060
2061   if (glining && !worm->datalen) {
2062     trojanscan_mainchanmsg("w: not glining %s!%s@%s due to too lack of removal data with mask: *!%s (%d users) -- worm: %s)", sender->nick, sender->ident, sender->host->name->content, glinemask, usercount, worm->name->content);
2063     return;
2064   }
2065
2066   trojanscan_database_escape_string(enick, sender->nick, strlen(sender->nick));
2067   trojanscan_database_escape_string(eident, sender->ident, strlen(sender->ident));
2068   trojanscan_database_escape_string(ehost, sender->host->name->content, sender->host->name->length);
2069
2070   frequency = 1;
2071
2072   if (!(trojanscan_database_query("SELECT COUNT(*) FROM hits WHERE glined = %d AND host = '%s'", glining, ehost))) {
2073     trojanscan_database_res *res;
2074     if ((res = trojanscan_database_store_result(&trojanscan_sql))) {
2075       trojanscan_database_row sqlrow;
2076       if ((trojanscan_database_num_rows(res) > 0) && (sqlrow = trojanscan_database_fetch_row(res)))
2077         frequency = atoi(sqlrow[0]) + 1;
2078       trojanscan_database_free_result(res);
2079     }
2080   }
2081
2082   if (!glining) {
2083     trojanscan_mainchanmsg("m: t: %c u: %s!%s@%s%s%s w: %s p: %d %s%s", messagetype, sender->nick, sender->ident, sender->host->name->content, messagetype=='N'||messagetype=='M'||messagetype=='P'?" #: ":"", messagetype=='N'||messagetype=='M'||messagetype=='P'?chp->index->name->content:"", worm->name->content, phrase->id, matchbuf[0]?" --: ":"", matchbuf[0]?matchbuf:"");
2084 #ifdef TROJANSCAN_PEONCHANNEL
2085     trojanscan_peonchanmsg("m: t: %c u: %s!%s@%s%s%s%s w: %s %s%s", messagetype, sender->nick, sender->ident, (IsHideHost(sender)&&IsAccount(sender))?sender->authname:sender->host->name->content, (IsHideHost(sender)&&IsAccount(sender))?"."HIS_HIDDENHOST:"", messagetype=='N'||messagetype=='M'||messagetype=='P'?" #: ":"", messagetype=='N'||messagetype=='M'||messagetype=='P'?chp->index->name->content:"", worm->name->content, matchbuf[0]?" --: ":"", matchbuf[0]?matchbuf:"");
2086 #endif
2087   } else {
2088     int glinetime = TROJANSCAN_FIRST_OFFENSE * frequency * (worm->epidemic?TROJANSCAN_EPIDEMIC_MULTIPLIER:1);
2089     if(glinetime > 7 * 24)
2090       glinetime = 7 * 24; /* can't set glines over 7 days with normal non U:lined glines */
2091
2092     trojanscan_database_query("INSERT INTO hits (nickname, ident, host, phrase, messagetype, glined) VALUES ('%s', '%s', '%s', %d, '%c', %d)", enick, eident, ehost, phrase->id, messagetype, glining);
2093     trojanscan_database.glines++;
2094
2095     irc_send("%s GL * +%s %d %jd :You (%s!%s@%s) are infected with a trojan (%s/%d), see %s%d for details - banned for %d hours\r\n", mynumeric->content, glinemask, glinetime * 3600, (intmax_t)time(NULL), sender->nick, sender->ident, sender->host->name->content, worm->name->content, phrase->id, TROJANSCAN_URL_PREFIX, worm->id, glinetime);
2096
2097     trojanscan_mainchanmsg("g: *!%s t: %c u: %s!%s@%s%s%s c: %d w: %s%s p: %d f: %d%s%s", glinemask, messagetype, sender->nick, sender->ident, sender->host->name->content, messagetype=='N'||messagetype=='M'||messagetype=='P'?" #: ":"", messagetype=='N'||messagetype=='M'||messagetype=='P'?chp->index->name->content:"", usercount, worm->name->content, worm->epidemic?"(E)":"", phrase->id, frequency, matchbuf[0]?" --: ":"", matchbuf[0]?matchbuf:"");
2098   }
2099 }
2100
2101 void trojanscan_rejoin_channel(void *arg) {
2102   struct trojanscan_rejoinlist *rj2, *lrj, *rj = (struct trojanscan_rejoinlist *)arg;
2103
2104   channel *cp = findchannel(rj->channel->content);
2105   freesstring(rj->channel);
2106
2107   if (rj->rp) {
2108     rj->rp->kickedout--;
2109     if (!cp) {
2110       rj->rp->donotpart = 1; /* we were the last user on the channel, so we need to be VERY careful freeing it */
2111     } else {
2112       if(!rj->rp->donotpart && !rj->rp->kickedout) { /* check we're allowed to join channels (not killed), and we're the last one to join */
2113         if (trojanscan_nickbanned(rj->clone, cp)) {
2114           rj->rp->donotpart = 1;
2115         } else {
2116           localjoinchannel(rj->clone->clone, cp);
2117         }
2118       }
2119     }
2120   }
2121
2122   rj2 = trojanscan_schedulerejoins;
2123   lrj = NULL;
2124
2125   if (rj2 == rj) {
2126     trojanscan_schedulerejoins = rj->next;
2127     tfree(rj);
2128   } else {
2129     for(rj2=trojanscan_schedulerejoins;rj2;lrj=rj2,rj2=rj2->next) {
2130       if (rj2 == rj) {
2131         lrj->next = rj2->next;
2132         tfree(rj);
2133         break;
2134       }
2135     }
2136   }
2137
2138 }
2139
2140 void trojanscan_reply(nick *target, char *message, ... ) {
2141   char buf[513];
2142   va_list va;
2143
2144   if (!trojanscan_nick)
2145     return;
2146
2147   va_start(va, message);
2148   vsnprintf(buf, sizeof(buf) - 1, message, va);
2149   va_end(va);
2150
2151   sendnoticetouser(trojanscan_nick, target, "%s", buf);
2152 }
2153
2154
2155 void trojanscan_mainchanmsg(char *message, ...) {
2156   char buf[513];
2157   va_list va;
2158   channel *cp;
2159
2160   if (!trojanscan_nick)
2161     return;
2162   if (!(cp = findchannel(TROJANSCAN_CHANNEL)))
2163     return;
2164
2165   va_start(va, message);
2166   vsnprintf(buf, sizeof(buf) - 1, message, va);
2167   va_end(va);
2168
2169   sendmessagetochannel(trojanscan_nick, cp, "%s", buf);
2170 }
2171
2172 #ifdef TROJANSCAN_PEONCHANNEL
2173 void trojanscan_peonchanmsg(char *message, ...) {
2174   char buf[513];
2175   va_list va;
2176   channel *cp;
2177
2178   if (!trojanscan_nick)
2179     return;
2180   if (!(cp = findchannel(TROJANSCAN_PEONCHANNEL)))
2181     return;
2182
2183   va_start(va, message);
2184   vsnprintf(buf, sizeof(buf) - 1, message, va);
2185   va_end(va);
2186
2187   sendmessagetochannel(trojanscan_nick, cp, "%s", buf);
2188 }
2189 #endif
2190
2191 int trojanscan_minmaxrand(float min, float max) {
2192   return (int)((max-min+1)*rand()/(RAND_MAX+min))+min;
2193 }
2194
2195 char *trojanscan_iptostr(char *buf, int buflen, unsigned int ip) {
2196   snprintf(buf, buflen, "%d.%d.%d.%d", ip >> 24, (ip >> 16) & 255, (ip >> 8) & 255, ip & 255);
2197   return buf;
2198 }
2199
2200 char trojanscan_genchar(int ty) {
2201   /* hostname and realname characters*/
2202   if (!ty) {
2203     if (!(trojanscan_minmaxrand(0, 40) % 10)) {
2204       return trojanscan_minmaxrand(48, 57);
2205     } else {
2206       return trojanscan_minmaxrand(97, 122);
2207     }
2208   /* ident characters - without numbers*/
2209   } else if (ty == 1) {
2210     return trojanscan_minmaxrand(97, 122);
2211   /* ident characters - with numbers*/
2212   } else if (ty == 2) {
2213     ty = trojanscan_minmaxrand(97, 125);
2214     if (ty > 122) return trojanscan_minmaxrand(48, 57);
2215     return ty;
2216   /* nick characters - with and without numbers*/
2217   } else if (ty == 3 || ty == 4) {
2218     if (!(trojanscan_minmaxrand(0, 59) % 16)) {
2219       char weirdos[6] = { '\\', '|', '[', '{', ']', '}' };
2220       return weirdos[trojanscan_minmaxrand(0, 5)];
2221     }
2222     if (ty == 4) {
2223       ty = trojanscan_minmaxrand(65, 93);
2224       if (ty > 90) return trojanscan_minmaxrand(48, 57);
2225     } else {
2226       ty = trojanscan_minmaxrand(65, 90);
2227     }
2228     if (!(trojanscan_minmaxrand(0, 40) % 8)) return ty;
2229     return ty + 32;
2230   /* moron check */
2231   } else {
2232     return ' ';
2233   }
2234 }
2235
2236 void trojanscan_gennick(char *ptc, char size) {
2237   int i;
2238   for (i=0;i<size;i++) {
2239     if (i == 0) {
2240       ptc[i] = trojanscan_genchar(3);
2241     } else {
2242       ptc[i] = trojanscan_genchar(4);
2243     }
2244   }
2245   ptc[i] = '\0';
2246 }
2247
2248 void trojanscan_genident(char *ptc, char size) {
2249   int i;
2250   for (i=0;i<size;i++) {
2251     if (i == 0) {
2252       ptc[i] = trojanscan_genchar(1);
2253     } else {
2254       ptc[i] = trojanscan_genchar(2);
2255     }
2256   }
2257   ptc[i] = '\0';
2258 }
2259
2260 void trojanscan_genhost(char *ptc, char size, patricia_node_t **fakeipnode) {
2261   int dots = trojanscan_minmaxrand(2, 5), i, dotexist = 0, cur;
2262   struct irc_in_addr ipaddress;
2263
2264   while (!dotexist) {
2265     for (i=0;i<size;i++) {
2266       ptc[i] = trojanscan_genchar(0);
2267       if ((i > 5) && (i < (size-4))) {
2268         if ((ptc[i-1] != '.') && (ptc[i-1] != '-')) {
2269           cur = trojanscan_minmaxrand(1,size / dots);
2270           if (cur < 3) {
2271             if (cur == 1) {
2272               ptc[i] = '.';
2273               dotexist = 1;
2274             } else {
2275               ptc[i] = '-';
2276             }
2277           }
2278         }
2279       }
2280     }
2281   }
2282   ptc[i] = '\0';
2283
2284   memset(&ipaddress, 0, sizeof(ipaddress));
2285   ((unsigned short *)(ipaddress.in6_16))[5] = 65535;
2286   ((unsigned short *)(ipaddress.in6_16))[6] = trojanscan_minmaxrand(0, 65535);
2287   ((unsigned short *)(ipaddress.in6_16))[7] = trojanscan_minmaxrand(0, 65535);
2288
2289   *fakeipnode = refnode(iptree, &ipaddress, PATRICIA_MAXBITS);
2290 }
2291
2292 void trojanscan_genreal(char *ptc, char size) {
2293   int spaces = trojanscan_minmaxrand(2, 4), i;
2294   for (i=0;i<size;i++) {
2295     ptc[i] = trojanscan_genchar(0);
2296     if ((i > 5) && (i < (size-4))) {
2297       if (ptc[i-1] != ' ') {
2298         if (trojanscan_minmaxrand(1,size / spaces) == 1) ptc[i] = ' ';
2299       }
2300     }
2301   }
2302   ptc[i] = '\0';
2303 }
2304
2305 int trojanscan_is_not_octet(char *begin, int length) {
2306   int i;
2307   if(length > 3)
2308     return 0;
2309   for(i=0;i<length;i++) {
2310     if (!((*begin >= '0') && (*begin <= '9')))
2311       return 0;
2312     begin++;
2313   }
2314   return 1;
2315 }
2316
2317 int trojanscan_generatepool(void) {
2318   int i, k = 0, j = 0, loops = 0;
2319   char *p, *pp;
2320   nick *np;
2321
2322   for (i=0;i<NICKHASHSIZE;i++)
2323     for (np=nicktable[i];np;np=np->next)
2324       j++;
2325
2326   if(j < trojanscan_min_hosts)
2327     return 0;
2328
2329   if(TROJANSCAN_HOST_MODE == TROJANSCAN_STEAL_HOST)
2330     return TROJANSCAN_MINPOOLSIZE;
2331
2332   i = 0;
2333   do {
2334     for (j=trojanscan_minmaxrand(0, NICKHASHSIZE-1);j<NICKHASHSIZE;j++) {
2335       if (nicktable[j]) {
2336         for(p=nicktable[j]->host->name->content, pp=p;*p;) {
2337           if (*++p == '.') {
2338             if (!trojanscan_is_not_octet(pp, p-pp)) {
2339               if (i < TROJANSCAN_POOLSIZE) {
2340                 if (i < trojanscan_hostpoolsize)
2341                   freesstring(trojanscan_hostpool[i]);
2342                 trojanscan_hostpool[i] = getsstring(pp, p-pp);
2343                 i++;
2344               } else {
2345                 if (k >= TROJANSCAN_POOLSIZE)
2346                  break;
2347               }
2348             }
2349             pp=++p;
2350           }
2351         }
2352         if (!trojanscan_is_not_octet(pp, p-pp)) {
2353           if (k < TROJANSCAN_POOLSIZE) {
2354             if (k < trojanscan_tailpoolsize)
2355               freesstring(trojanscan_tailpool[k]);
2356             trojanscan_tailpool[k] = getsstring(pp, p-pp);
2357             k++;
2358           } else {
2359             if (i >= TROJANSCAN_POOLSIZE)
2360               break;
2361           }
2362         }
2363       }
2364     }
2365     loops++;
2366   } while ((loops < 5) && ((i < TROJANSCAN_POOLSIZE) || (k < TROJANSCAN_POOLSIZE)));
2367
2368   trojanscan_hostpoolsize = i;
2369   trojanscan_tailpoolsize = k;
2370   return i;
2371 }
2372
2373 nick *trojanscan_selectuser(void) {
2374   int target = trojanscan_minmaxrand(0, 500), loops = 150, j;
2375   nick *np;
2376   do {
2377     for (j=trojanscan_minmaxrand(0, NICKHASHSIZE-1);j<NICKHASHSIZE;j++)
2378       for(np=nicktable[j];np;np=np->next)
2379         if (!--target)
2380           return np;
2381   } while(--loops > 0);
2382   return NULL;
2383 }
2384
2385 host *trojanscan_selecthost(void) {
2386   int target = trojanscan_minmaxrand(0, 500), loops = 150, j;
2387   host *hp;
2388   do {
2389     for (j=trojanscan_minmaxrand(0, HOSTHASHSIZE-1);j<HOSTHASHSIZE;j++)
2390       for(hp=hosttable[j];hp;hp=hp->next)
2391         if (!--target)
2392           return hp;
2393   } while(--loops > 0);
2394
2395   return NULL;
2396 }
2397
2398 static int specialuseronhost(host *hp) {
2399   nick *np;
2400
2401   for(np=hp->nicks;np;np=np->nextbyhost)
2402     if(IsOper(np) || IsService(np) || IsXOper(np) || NickOnServiceServer(np))
2403       return 1;
2404
2405   return 0;
2406 }
2407
2408 void trojanscan_generatehost(char *buf, int maxsize, patricia_node_t **fakeip) {
2409   struct irc_in_addr ipaddress;
2410
2411   if(TROJANSCAN_HOST_MODE == TROJANSCAN_STEAL_HOST) {
2412     host *hp;
2413     int loops = 20;
2414
2415     buf[0] = '\0';
2416
2417     do {
2418       hp = trojanscan_selecthost();
2419       if(hp && (hp->clonecount <= TROJANSCAN_MAX_CLONE_COUNT) && !trojanscan_isip(hp->name->content) && !specialuseronhost(hp)) {
2420         strlcpy(buf, hp->name->content, maxsize + 1);
2421         if(hp->nicks) {
2422           *fakeip = hp->nicks->ipnode;
2423           patricia_ref_prefix(hp->nicks->ipnode->prefix);
2424         } else {
2425           memset(&ipaddress, 0, sizeof(ipaddress));
2426           ((unsigned short *)(ipaddress.in6_16))[5] = 65535;
2427           ((unsigned short *)(ipaddress.in6_16))[6] = trojanscan_minmaxrand(0, 65535);
2428           ((unsigned short *)(ipaddress.in6_16))[7] = trojanscan_minmaxrand(0, 65535);
2429
2430           *fakeip = refnode(iptree, &ipaddress, PATRICIA_MAXBITS);
2431         }
2432         break;
2433       }
2434     } while(--loops > 0);
2435   } else {
2436     char *cpos;
2437     int pieces = trojanscan_minmaxrand(2, 4), totallen = 0, a = 0, i;
2438     int *choices = tmalloc(sizeof(int) * (pieces + 1));
2439     int *lengths = tmalloc(sizeof(int) * (pieces + 1));
2440
2441     choices[pieces] = trojanscan_minmaxrand(0, trojanscan_tailpoolsize-1);
2442     lengths[pieces] = strlen(trojanscan_tailpool[choices[pieces]]->content) + 1;
2443     totallen += lengths[pieces];
2444
2445     for (i=0;i<pieces;i++) {
2446       choices[i] = trojanscan_minmaxrand(0, trojanscan_hostpoolsize-1);
2447       lengths[i] = strlen(trojanscan_hostpool[choices[i]]->content) + 1;
2448       if (totallen+lengths[i] > maxsize) {
2449         choices[i] = choices[pieces];
2450         lengths[i] = lengths[pieces];
2451         pieces-=(pieces-i);
2452         break;
2453       }
2454       totallen += lengths[i];
2455     }
2456
2457     for (i=0;i<pieces;i++) {
2458       for (cpos=trojanscan_hostpool[choices[i]]->content; *cpos;)
2459         buf[a++] = *cpos++;
2460       buf[a++] = '.';
2461     }
2462
2463     for (cpos=trojanscan_tailpool[choices[i]]->content; *cpos;) {
2464       buf[a++] = *cpos++;
2465     }
2466
2467     buf[a] = '\0';
2468     tfree(choices);
2469     tfree(lengths);
2470
2471     memset(&ipaddress, 0, sizeof(ipaddress));
2472     ((unsigned short *)(ipaddress.in6_16))[5] = 65535;
2473     ((unsigned short *)(ipaddress.in6_16))[6] = trojanscan_minmaxrand(0, 65535);
2474     ((unsigned short *)(ipaddress.in6_16))[7] = trojanscan_minmaxrand(0, 65535);
2475
2476     *fakeip = refnode(iptree, &ipaddress, PATRICIA_MAXBITS);
2477   }
2478 }
2479
2480 void trojanscan_generatenick(char *buf, int maxsize) {
2481   int bits = trojanscan_minmaxrand(2, 3), loops = 0, wanttocopy, len = 0, i, d = 0, newmaxsize = maxsize - trojanscan_minmaxrand(0, 7);
2482   nick *np;
2483
2484   if(newmaxsize > 2)
2485     maxsize = newmaxsize;
2486
2487   do {
2488     np = trojanscan_selectuser();
2489     if(np) {
2490       wanttocopy = trojanscan_minmaxrand(1, (strlen(np->nick) / 2) + 3);
2491       for(i=0;((i<wanttocopy) && (len<maxsize));i++)
2492         buf[len++] = np->nick[i];
2493       if(++d > bits) {
2494         buf[len] = '\0';
2495         return;
2496       }
2497     }
2498   } while (++loops < 10);
2499   buf[0] = '\0';
2500 }
2501
2502 void trojanscan_generateident(char *buf, int maxsize) {
2503   nick *np = trojanscan_selectuser();
2504   buf[0] = '\0';
2505   if(np)
2506     strlcpy(buf, np->ident, maxsize + 1);
2507 }
2508
2509 void trojanscan_generaterealname(char *buf, int maxsize) {
2510   nick *np = trojanscan_selectuser();
2511   buf[0] = '\0';
2512   if(np)
2513     strlcpy(buf, np->realname->name->content, maxsize + 1);
2514 }
2515
2516 static void db_ping(void *arg) {
2517   if (!(trojanscan_database_query("SELECT 1"))) {
2518     trojanscan_database_res *res;
2519     if ((res = trojanscan_database_store_result(&trojanscan_sql))) {
2520       trojanscan_database_free_result(res);
2521     }
2522   }
2523
2524   db_ping_schedule = scheduleoneshot(time(NULL) + 60, &db_ping, NULL);
2525 }
2526
2527 void trojanscan_database_close(void) {
2528   if(db_ping_schedule)
2529     deleteschedule(db_ping_schedule, db_ping, NULL);
2530
2531   mysql_close(&trojanscan_sql);
2532 }
2533
2534 int trojanscan_database_connect(char *dbhost, char *dbuser, char *dbpass, char *db, unsigned int port) {
2535   mysql_init(&trojanscan_sql);
2536   if (!mysql_real_connect(&trojanscan_sql, dbhost, dbuser, dbpass, db, port, NULL, 0))
2537     return -1;
2538
2539
2540   db_ping_schedule = scheduleoneshot(time(NULL) + 60, &db_ping, NULL);
2541
2542   return 0;
2543 }
2544
2545 void trojanscan_database_escape_string(char *dest, char *source, size_t length) {
2546   mysql_escape_string(dest, source, length);
2547 }
2548
2549 int trojanscan_database_query(char *format, ...) {
2550   char trojanscan_sqlquery[TROJANSCAN_QUERY_BUF_SIZE];
2551   va_list va;
2552
2553   va_start(va, format);
2554   vsnprintf(trojanscan_sqlquery, sizeof(trojanscan_sqlquery) - 1, format, va);
2555   va_end(va);
2556   return mysql_query(&trojanscan_sql, trojanscan_sqlquery);
2557 }
2558
2559 int trojanscan_database_num_rows(trojanscan_database_res *res) {
2560   return mysql_num_rows(res);
2561 }
2562
2563 trojanscan_database_res *trojanscan_database_store_result() {
2564   return mysql_store_result(&trojanscan_sql);
2565 }
2566
2567 trojanscan_database_row trojanscan_database_fetch_row(trojanscan_database_res *res) {
2568   return mysql_fetch_row(res);
2569 }
2570
2571 void trojanscan_database_free_result(trojanscan_database_res *res) {
2572   mysql_free_result(res);
2573 }
2574
2575 int trojanscan_isip(char *host) {
2576   char *p = host, components = 0, length = 0;
2577
2578   for(;*p;p++) {
2579     if(*p == '.') {
2580       if(((!length) || (length = 0)) || (++components > 3))
2581         return 0;
2582     } else {
2583       if ((++length > 3) || !isdigit(*p))
2584         return 0;
2585     }
2586   }
2587   return components == 3;
2588 }
2589