trojanscan/trojanscan.c

   1 /*
   2  * Trojanscan version 2
   3  *
   4  * Trojanscan  copyright (C) Chris Porter 2002-2009
   5  * Newserv bits copyright (C) David Mansell 2002-2003
   6  *
   7  * TODO: CHECK::
   8  *   - Poke splidge about +r'ing bots, potential problems:
   9  *     - users might whine about T clone stealing account
  10  *       - would have to steal one already in use, so if trojans start using /msg q whois they'll see
  11  *       (though they have to be authed for this, they could use a clone of their own however)
  12  */
  13
  14 #include "trojanscan.h"
  15 #include "../lib/strlfunc.h"
  16 #include "../lib/version.h"
  17 #include "../core/nsmalloc.h"
  18 #include <stdint.h>
  19
  20 #define tmalloc(x)     nsmalloc(POOL_TROJANSCAN, x)
  21 #define tfree(x)       nsfree(POOL_TROJANSCAN, x)
  22
  23 MODULE_VERSION(TROJANSCAN_VERSION);
  24
  25 void trojanscan_phrasematch(channel *chp, nick *sender, trojanscan_phrases *phrase, char messagetype, char *matchbuf);
  26 char *trojanscan_sanitise(char *input);
  27 void trojanscan_refresh_settings(void);
  28 static void trojanscan_part_watch(int hook, void *arg);
  29 static void trojanscan_connect_nick(void *);
  30
  31 #define TROJANSCAN_SETTING_SIZE 256
  32 #define TROJANSCAN_MAX_SETTINGS 50
  33
  34 static struct {
  35   char setting[TROJANSCAN_SETTING_SIZE];
  36   char value[TROJANSCAN_SETTING_SIZE];
  37 } trojanscan_settings[TROJANSCAN_MAX_SETTINGS];
  38
  39 static int settingcount = 0;
  40 static char *versionreply;
  41 static int hooksregistered = 0;
  42 static void *trojanscan_connect_nick_schedule;
  43
  44 void _init() {
  45   trojanscan_cmds = newcommandtree();
  46
  47   addcommandtotree(trojanscan_cmds, "showcommands", TROJANSCAN_ACL_UNAUTHED, 0, &trojanscan_showcommands);
  48   addcommandtotree(trojanscan_cmds, "help", TROJANSCAN_ACL_UNAUTHED, 1, &trojanscan_help);
  49   addcommandtotree(trojanscan_cmds, "hello", TROJANSCAN_ACL_UNAUTHED | TROJANSCAN_ACL_OPER, 1, &trojanscan_hello);
  50
  51   addcommandtotree(trojanscan_cmds, "join", TROJANSCAN_ACL_STAFF, 1, &trojanscan_userjoin);
  52   addcommandtotree(trojanscan_cmds, "chanlist", TROJANSCAN_ACL_STAFF, 0, &trojanscan_chanlist);
  53   addcommandtotree(trojanscan_cmds, "whois", TROJANSCAN_ACL_STAFF, 1, &trojanscan_whois);
  54
  55   addcommandtotree(trojanscan_cmds, "changelev", TROJANSCAN_ACL_STAFF | TROJANSCAN_ACL_OPER, 2, &trojanscan_changelev);
  56   addcommandtotree(trojanscan_cmds, "deluser", TROJANSCAN_ACL_TEAMLEADER | TROJANSCAN_ACL_OPER, 2, &trojanscan_deluser);
  57   addcommandtotree(trojanscan_cmds, "mew", TROJANSCAN_ACL_STAFF, 2, &trojanscan_mew);
  58   addcommandtotree(trojanscan_cmds, "status", TROJANSCAN_ACL_STAFF | TROJANSCAN_ACL_OPER, 0, &trojanscan_status);
  59   addcommandtotree(trojanscan_cmds, "listusers", TROJANSCAN_ACL_TEAMLEADER, 0, &trojanscan_listusers);
  60
  61   addcommandtotree(trojanscan_cmds, "rehash", TROJANSCAN_ACL_WEBSITE, 0, &trojanscan_rehash);
  62
  63   addcommandtotree(trojanscan_cmds, "cat", TROJANSCAN_ACL_OPER, 1, &trojanscan_cat);
  64
  65   addcommandtotree(trojanscan_cmds, "reschedule", TROJANSCAN_ACL_DEVELOPER | TROJANSCAN_ACL_OPER, 0, &trojanscan_reschedule);
  66
  67   srand((int)time(NULL));
  68
  69   trojanscan_connect_schedule = scheduleoneshot(time(NULL) + 1, &trojanscan_connect, NULL);
  70 }
  71
  72 void _fini(void) {
  73   int i;
  74   struct trojanscan_realchannels *rp = trojanscan_realchanlist, *oldrp;
  75   struct trojanscan_rejoinlist *rj = trojanscan_schedulerejoins, *oldrj;
  76
  77   if (trojanscan_nick)
  78     deregisterlocaluser(trojanscan_nick, NULL);
  79
  80   if (trojanscan_connect_schedule)
  81     deleteschedule(trojanscan_connect_schedule, &trojanscan_connect, NULL);
  82
  83   if (trojanscan_connect_nick_schedule)
  84     deleteschedule(trojanscan_connect_nick_schedule, &trojanscan_connect_nick, NULL);
  85
  86   if(trojanscan_schedule)
  87     deleteschedule(trojanscan_schedule, &trojanscan_dojoin, NULL);
  88
  89   if(trojanscan_poolschedule)
  90     deleteschedule(trojanscan_poolschedule, &trojanscan_repool, NULL);
  91
  92   if(trojanscan_cloneschedule)
  93     deleteschedule(trojanscan_poolschedule, &trojanscan_registerclones, NULL);
  94
  95   if(hooksregistered)
  96     deregisterhook(HOOK_CHANNEL_PART, trojanscan_part_watch);
  97
  98   while(rp) {
  99     deleteschedule(rp->schedule, &trojanscan_dopart, (void *)rp);
 100     oldrp = rp;
 101     rp = rp->next;
 102     tfree(oldrp);
 103   }
 104
 105   while(rj) {
 106     deleteschedule(rj->schedule, &trojanscan_rejoin_channel, (void *)rj);
 107     freesstring(rj->channel);
 108     oldrj = rj;
 109     rj = rj->next;
 110     tfree(oldrj);
 111   }
 112
 113   if(trojanscan_initialschedule)
 114     deleteschedule(trojanscan_initialschedule, &trojanscan_fill_channels, NULL);
 115
 116   deleteschedule(trojanscan_rehashschedule, &trojanscan_rehash_schedule, NULL);
 117
 118   for (i=0;i<TROJANSCAN_CLONE_TOTAL;i++)
 119     if(trojanscan_swarm[i].clone) {
 120       deregisterlocaluser(trojanscan_swarm[i].clone, NULL);
 121       derefnode(iptree, trojanscan_swarm[i].fakeipnode);
 122       trojanscan_swarm[i].clone = NULL;
 123     }
 124   trojanscan_free_database();
 125   trojanscan_free_channels();
 126
 127   for (i=0;i<trojanscan_hostpoolsize;i++)
 128     freesstring(trojanscan_hostpool[i]);
 129
 130   for (i=0;i<trojanscan_tailpoolsize;i++)
 131     freesstring(trojanscan_tailpool[i]);
 132   trojanscan_database_close();
 133
 134   deletecommandfromtree(trojanscan_cmds, "showcommands", &trojanscan_showcommands);
 135   deletecommandfromtree(trojanscan_cmds, "help", &trojanscan_help);
 136   deletecommandfromtree(trojanscan_cmds, "hello", &trojanscan_hello);
 137   deletecommandfromtree(trojanscan_cmds, "join", &trojanscan_userjoin);
 138   deletecommandfromtree(trojanscan_cmds, "chanlist", &trojanscan_chanlist);
 139   deletecommandfromtree(trojanscan_cmds, "whois", &trojanscan_whois);
 140   deletecommandfromtree(trojanscan_cmds, "changelev", &trojanscan_changelev);
 141   deletecommandfromtree(trojanscan_cmds, "deluser", &trojanscan_deluser);
 142   deletecommandfromtree(trojanscan_cmds, "mew", &trojanscan_mew);
 143   deletecommandfromtree(trojanscan_cmds, "status", &trojanscan_status);
 144   deletecommandfromtree(trojanscan_cmds, "listusers", &trojanscan_listusers);
 145   deletecommandfromtree(trojanscan_cmds, "rehash", &trojanscan_rehash);
 146   deletecommandfromtree(trojanscan_cmds, "cat", &trojanscan_cat);
 147   deletecommandfromtree(trojanscan_cmds, "reschedule", &trojanscan_reschedule);
 148
 149   destroycommandtree(trojanscan_cmds);
 150   nscheckfreeall(POOL_TROJANSCAN);
 151 }
 152
 153 static void trojanscan_connect_nick(void *arg) {
 154   sstring *mnick, *myident, *myhost, *myrealname, *myauthname;
 155   channel *cp;
 156
 157   mnick = getcopyconfigitem("trojanscan", "nick", "T", NICKLEN);
 158   myident = getcopyconfigitem("trojanscan", "ident", "trojanscan", NICKLEN);
 159   myhost = getcopyconfigitem("trojanscan", "hostname", "trojanscan.quakenet.org", HOSTLEN);
 160   myrealname = getcopyconfigitem("trojanscan", "realname", "Trojanscan v" TROJANSCAN_VERSION, REALLEN);
 161   myauthname = getcopyconfigitem("trojanscan", "authname", "T", ACCOUNTLEN);
 162
 163   trojanscan_nick = registerlocaluser(mnick->content, myident->content, myhost->content, myrealname->content, myauthname->content, UMODE_SERVICE | UMODE_DEAF |
 164                                                                                                                           UMODE_OPER | UMODE_INV |
 165                                                                                                                           UMODE_ACCOUNT,
 166                                                                                                                           &trojanscan_handlemessages);
 167   freesstring(mnick);
 168   freesstring(myident);
 169   freesstring(myhost);
 170   freesstring(myrealname);
 171   freesstring(myauthname);
 172
 173   cp = findchannel(TROJANSCAN_OPERCHANNEL);
 174   if (!cp) {
 175     localcreatechannel(trojanscan_nick, TROJANSCAN_OPERCHANNEL);
 176   } else {
 177     if(!localjoinchannel(trojanscan_nick, cp))
 178       localgetops(trojanscan_nick, cp);
 179   }
 180
 181   cp = findchannel(TROJANSCAN_CHANNEL);
 182   if (!cp) {
 183     localcreatechannel(trojanscan_nick, TROJANSCAN_CHANNEL);
 184   } else {
 185     if(!localjoinchannel(trojanscan_nick, cp))
 186       localgetops(trojanscan_nick, cp);
 187   }
 188
 189 #ifdef TROJANSCAN_PEONCHANNEL
 190   cp = findchannel(TROJANSCAN_PEONCHANNEL);
 191   if (!cp) {
 192     localcreatechannel(trojanscan_nick, TROJANSCAN_PEONCHANNEL);
 193   } else {
 194     if(!localjoinchannel(trojanscan_nick, cp))
 195       localgetops(trojanscan_nick, cp);
 196   }
 197 #endif
 198 }
 199
 200 void trojanscan_connect(void *arg) {
 201   sstring *dbhost, *dbuser, *dbpass, *db, *dbport, *temp;
 202   int length, i;
 203   char buf[10];
 204
 205   trojanscan_connect_schedule = NULL;
 206
 207   for(i=0;i<TROJANSCAN_CLONE_TOTAL;i++)
 208     trojanscan_swarm[i].index = i; /* sure this could be done with pointer arithmetic... */
 209
 210   trojanscan_hostpoolsize = 0;
 211   trojanscan_tailpoolsize = 0;
 212   trojanscan_hostmode = 0;
 213   trojanscan_poolschedule = NULL;
 214   trojanscan_cloneschedule = NULL;
 215   trojanscan_realchanlist = NULL;
 216   trojanscan_database.glines = 0;
 217   trojanscan_database.detections = 0;
 218
 219   dbhost = getcopyconfigitem("trojanscan", "dbhost", "localhost", 100);
 220   dbuser = getcopyconfigitem("trojanscan", "dbuser", "moo", 100);
 221   dbpass = getcopyconfigitem("trojanscan", "dbpass", "changeme", 100);
 222   db = getcopyconfigitem("trojanscan", "db", "moo", 100);
 223
 224   dbport = getcopyconfigitem("trojanscan", "dbport", "3306", 10);
 225
 226   length = snprintf(buf, sizeof(buf) - 1, "%d", TROJANSCAN_DEFAULT_MAXCHANS);
 227   temp = getcopyconfigitem("trojanscan", "maxchans", buf, length);
 228
 229   trojanscan_maxchans = atoi(temp->content);
 230   freesstring(temp);
 231
 232   length = snprintf(buf, sizeof(buf) - 1, "%d", TROJANSCAN_DEFAULT_CYCLETIME);
 233   temp = getcopyconfigitem("trojanscan", "cycletime", buf, length);
 234
 235   trojanscan_cycletime = atoi(temp->content);
 236   freesstring(temp);
 237
 238   length = snprintf(buf, sizeof(buf) - 1, "%d", TROJANSCAN_DEFAULT_PARTTIME);
 239   temp = getcopyconfigitem("trojanscan", "parttime", buf, length);
 240   trojanscan_part_time = atoi(temp->content);
 241   freesstring(temp);
 242
 243   length = snprintf(buf, sizeof(buf) - 1, "%d", TROJANSCAN_DEFAULT_MAXUSERS);
 244   temp = getcopyconfigitem("trojanscan", "maxusers", buf, length);
 245   trojanscan_maxusers = atoi(temp->content);
 246   freesstring(temp);
 247
 248   length = snprintf(buf, sizeof(buf) - 1, "%d", TROJANSCAN_MINIMUM_HOSTS_BEFORE_POOL);
 249   temp = getcopyconfigitem("trojanscan", "minpoolhosts", buf, length);
 250   trojanscan_min_hosts = atoi(temp->content);
 251   freesstring(temp);
 252
 253   if ((trojanscan_cycletime / trojanscan_maxchans) < 1) {
 254     Error("trojanscan", ERR_FATAL, "Cycletime / maxchans < 1, increase cycletime or decrease maxchans else cycling breaks.");
 255     freesstring(dbhost);
 256     freesstring(dbuser);
 257     freesstring(dbpass);
 258     freesstring(db);
 259     freesstring(dbport);
 260     return; /* PPA: module failed to load */
 261   }
 262
 263   length = snprintf(buf, sizeof(buf) - 1, "%d", TROJANSCAN_DEFAULT_MINIMUM_CHANNEL_SIZE);
 264   temp = getcopyconfigitem("trojanscan", "minchansize", buf, length);
 265   trojanscan_minchansize = atoi(temp->content);
 266   freesstring(temp);
 267
 268   trojanscan_connect_nick(NULL);
 269
 270   if (trojanscan_database_connect(dbhost->content, dbuser->content, dbpass->content, db->content, atoi(dbport->content)) < 0) {
 271     Error("trojanscan", ERR_FATAL, "Cannot connect to database host!");
 272     freesstring(dbhost);
 273     freesstring(dbuser);
 274     freesstring(dbpass);
 275     freesstring(db);
 276     freesstring(dbport);
 277     return; /* PPA: module failed to load */
 278   }
 279
 280   trojanscan_database_query("CREATE TABLE phrases (id INT(10) PRIMARY KEY AUTO_INCREMENT, wormid INT(10) NOT NULL, phrase TEXT NOT NULL, priority INT(10) DEFAULT 0 NOT NULL, dateadded int(10), disabled BOOL DEFAULT 0 NOT NULL)");
 281   trojanscan_database_query("CREATE TABLE worms (id INT(10) PRIMARY KEY AUTO_INCREMENT, wormname TEXT NOT NULL, glinetype INT DEFAULT 0, data text, hitmsgs BOOL DEFAULT 1, hitchans BOOL DEFAULT 0, epidemic BOOL DEFAULT 0, privinfo text)");
 282   trojanscan_database_query("CREATE TABLE logs (id INT(10) PRIMARY KEY AUTO_INCREMENT, userid INT(10) NOT NULL, act TEXT NOT NULL, description TEXT NOT NULL, ts TIMESTAMP)");
 283   trojanscan_database_query("CREATE TABLE channels (id INT(10) PRIMARY KEY AUTO_INCREMENT, channel VARCHAR(%d) NOT NULL, exempt BOOL DEFAULT 0)", CHANNELLEN);
 284   trojanscan_database_query("CREATE TABLE users (id INT(10) PRIMARY KEY AUTO_INCREMENT, authname VARCHAR(%d) NOT NULL, authlevel TINYINT(4) NOT NULL)", ACCOUNTLEN);
 285   trojanscan_database_query("CREATE TABLE hits (id INT(10) PRIMARY KEY AUTO_INCREMENT, nickname VARCHAR(%d) NOT NULL, ident VARCHAR(%d) NOT NULL, host VARCHAR(%d) NOT NULL, phrase INT(10) NOT NULL, ts TIMESTAMP, messagetype VARCHAR(1) NOT NULL DEFAULT 'm', glined BOOL DEFAULT 1)", NICKLEN, USERLEN, HOSTLEN);
 286   trojanscan_database_query("CREATE TABLE settings (id INT(10) PRIMARY KEY AUTO_INCREMENT, setting VARCHAR(255) NOT NULL UNIQUE, value VARCHAR(255) NOT NULL)");
 287   trojanscan_database_query("CREATE TABLE wwwlogs (id INT(10) PRIMARY KEY AUTO_INCREMENT, authid INT(10) NOT NULL, ip VARCHAR(15), action TEXT, ts TIMESTAMP)");
 288   trojanscan_database_query("CREATE TABLE unknownlog (id INT(10) PRIMARY KEY AUTO_INCREMENT, data TEXT, user VARCHAR(%d) NOT NULL, ts TIMESTAMP)", NICKLEN+USERLEN+HOSTLEN+3);
 289
 290   trojanscan_database_query("DELETE FROM settings WHERE setting = 'rehash' OR setting = 'changed'");
 291   trojanscan_database_query("INSERT INTO settings (setting, value) VALUES ('rehash','0')");
 292   trojanscan_database_query("INSERT INTO settings (setting, value) VALUES ('changed','0')");
 293
 294   /* assumption: constants aren't supplied by someone evil */
 295   trojanscan_database_query("INSERT INTO settings (setting, value) VALUES ('versionreply','" TROJANSCAN_DEFAULT_VERSION_REPLY "')");
 296
 297   trojanscan_refresh_settings();
 298   trojanscan_read_database(1);
 299
 300   freesstring(dbhost);
 301   freesstring(dbuser);
 302   freesstring(dbpass);
 303   freesstring(db);
 304   freesstring(dbport);
 305   trojanscan_registerclones(NULL);
 306
 307   trojanscan_rehashschedule = scheduleoneshot(time(NULL) + 60, &trojanscan_rehash_schedule, NULL);
 308
 309   registerhook(HOOK_CHANNEL_PART, trojanscan_part_watch);
 310   hooksregistered = 1;
 311 }
 312
 313 char *trojanscan_get_setting(char *setting) {
 314   int i;
 315
 316   for(i=0;i<settingcount;i++)
 317     if(!strcmp(trojanscan_settings[i].setting, setting))
 318       return trojanscan_settings[i].value;
 319
 320   return NULL;
 321 }
 322
 323 void trojanscan_refresh_settings(void) {
 324   trojanscan_database_res *res;
 325   trojanscan_database_row sqlrow;
 326   int i = 0;
 327
 328   if(trojanscan_database_query("SELECT setting, value FROM settings"))
 329     return;
 330
 331   if(!(res = trojanscan_database_store_result(&trojanscan_sql)))
 332     return;
 333
 334   if (trojanscan_database_num_rows(res) <= 0)
 335     return;
 336
 337   while((sqlrow = trojanscan_database_fetch_row(res))) {
 338     strlcpy(trojanscan_settings[i].setting, sqlrow[0], TROJANSCAN_SETTING_SIZE);
 339     strlcpy(trojanscan_settings[i].value, sqlrow[1], TROJANSCAN_SETTING_SIZE);
 340
 341     trojanscan_sanitise(trojanscan_settings[i].value);
 342
 343     if(++i == TROJANSCAN_MAX_SETTINGS)
 344       break;
 345   }
 346
 347   settingcount = i;
 348
 349   trojanscan_database_free_result(res);
 350
 351   /* optimisation hack */
 352   versionreply = trojanscan_get_setting("versionreply");
 353 }
 354
 355 void trojanscan_rehash_schedule(void *arg) {
 356   char *v;
 357   trojanscan_rehashschedule = scheduleoneshot(time(NULL) + 60, &trojanscan_rehash_schedule, NULL);
 358
 359   trojanscan_refresh_settings();
 360
 361   v = trojanscan_get_setting("rehash");
 362   if(v && v[0] == '1') {
 363     trojanscan_mainchanmsg("n: rehash initiated by website. . .");
 364     trojanscan_read_database(0);
 365   }
 366 }
 367
 368 void trojanscan_free_database(void) {
 369   int i;
 370   for(i=0;i<trojanscan_database.total_channels;i++)
 371     freesstring(trojanscan_database.channels[i].name);
 372   tfree(trojanscan_database.channels);
 373   for(i=0;i<trojanscan_database.total_phrases;i++) {
 374     if (trojanscan_database.phrases[i].phrase)
 375       pcre_free(trojanscan_database.phrases[i].phrase);
 376     if (trojanscan_database.phrases[i].hint)
 377       pcre_free(trojanscan_database.phrases[i].hint);
 378   }
 379   tfree(trojanscan_database.phrases);
 380   for(i=0;i<trojanscan_database.total_worms;i++)
 381     freesstring(trojanscan_database.worms[i].name);
 382   tfree(trojanscan_database.worms);
 383   trojanscan_database.total_channels = 0;
 384   trojanscan_database.total_phrases = 0;
 385   trojanscan_database.total_worms = 0;
 386   trojanscan_database.channels = NULL;
 387   trojanscan_database.phrases = NULL;
 388   trojanscan_database.worms = NULL;
 389 }
 390
 391 char *trojanscan_sanitise(char *input) {
 392   char *p;
 393
 394   for(p=input;*p;p++)
 395     if(*p == '\r' || *p == '\n')
 396       *p = '!';
 397
 398   return input;
 399 }
 400
 401 sstring *trojanscan_getsstring(char *string, int length) {
 402   int i;
 403
 404   for(i=0;i<length;i++) {
 405     if ((string[i] == '\r') || (string[i] == '\n')) {
 406       Error("trojanscan", ERR_WARNING, "Error reading %s at position %d, set to ERROR!", string, i+1);
 407       return getsstring("ERROR", sizeof("ERROR"));
 408     }
 409   }
 410
 411   return getsstring(string, length);
 412 }
 413
 414 int trojanscan_strip_codes(char *buf, size_t max, char *original) {
 415   int i, j, length = TROJANSCAN_MMIN(strlen(original), max-1);
 416   char *p2 = original, *p3, flag = 0;
 417   p3 = buf;
 418   for(i=0;i<length+1;i++) {
 419     switch (*p2) {
 420       case '\002':
 421       case '\017':
 422       case '\026':
 423       case '\037':
 424       break;
 425       case '\003':
 426         for(j=0;j<6;j++) {
 427           if ((i + 1) > length)
 428             break;
 429           if ((j == 4) && flag)
 430             break;
 431           p2++;
 432           i++;
 433           if ((j == 0) && (!((*p2 >= '0') && (*p2 <= '9'))))
 434             break;
 435           if (j == 1) {
 436
 437             if (*p2 == ',') {
 438                 if ((i + 1) > length)
 439                   break;
 440                 if (!((*(p2 + 1) >= '0') && (*(p2 + 1) <= '9')))
 441                   break;
 442               flag = 1;
 443             } else if ((*p2 >= '0') && (*p2 <= '9')) {
 444               flag = 0;
 445             } else {
 446               break;
 447             }
 448           }
 449           if (j == 2) {
 450             if (flag) {
 451               if (!((*p2 >= '0') && (*p2 <= '9')))
 452                 break;
 453             } else {
 454               if (*p2 != ',') {
 455                 break;
 456               } else {
 457                 if ((i + 1) > length)
 458                   break;
 459                 if (!((*(p2 + 1) >= '0') && (*(p2 + 1) <= '9')))
 460                   break;
 461               }
 462             }
 463           }
 464           if ((j == 3) && (!((*p2 >= '0') && (*p2 <= '9'))))
 465             break;
 466           if ((j == 4) && (!((*p2 >= '0') && (*p2 <= '9'))))
 467             break;
 468         }
 469         p2--;
 470         i--;
 471         break;
 472
 473       default:
 474         *p3 = *p2;
 475         p3++;
 476         break;
 477     }
 478     p2++;
 479   }
 480   return p3 - buf;
 481 }
 482
 483 struct trojanscan_worms *trojanscan_find_worm_by_id(int id) {
 484   int i;
 485   for(i=0;i<trojanscan_database.total_worms;i++)
 486     if ((trojanscan_database.worms[i].id == id))
 487       return &trojanscan_database.worms[i];
 488   return NULL;
 489 }
 490
 491 void trojanscan_read_database(int first_time) {
 492   const char *error;
 493   int erroroffset, i, tempresult;
 494
 495   trojanscan_database_res *res;
 496   trojanscan_database_row sqlrow;
 497
 498   if (!first_time) {
 499     trojanscan_free_database();
 500   } else {
 501     trojanscan_database.total_channels = 0;
 502     trojanscan_database.total_phrases = 0;
 503     trojanscan_database.total_worms = 0;
 504   }
 505
 506   if (!(trojanscan_database_query("SELECT channel, exempt FROM channels"))) {
 507     if ((res = trojanscan_database_store_result(&trojanscan_sql))) {
 508       trojanscan_database.total_channels = trojanscan_database_num_rows(res);
 509       if (trojanscan_database.total_channels > 0) {
 510         if ((trojanscan_database.channels = (trojanscan_channels *)tmalloc(sizeof(trojanscan_channels) * trojanscan_database.total_channels))) {
 511           if ((trojanscan_database.total_channels>0) && trojanscan_database.channels) {
 512             i = 0;
 513             while((sqlrow = trojanscan_database_fetch_row(res))) {
 514               trojanscan_database.channels[i].name = trojanscan_getsstring(trojanscan_sanitise(sqlrow[0]), strlen(sqlrow[0]));
 515               trojanscan_database.channels[i].exempt = (sqlrow[1][0] == '1');
 516               i++;
 517             }
 518           }
 519         }
 520       }
 521       trojanscan_database_free_result(res);
 522     }
 523   }
 524
 525   if (!(trojanscan_database_query("SELECT id, wormname, glinetype, length(data), hitmsgs, hitchans, epidemic FROM worms"))) {
 526     if ((res = trojanscan_database_store_result(&trojanscan_sql))) {
 527       trojanscan_database.total_worms = trojanscan_database_num_rows(res);
 528       if (trojanscan_database.total_worms > 0) {
 529         if ((trojanscan_database.worms = (trojanscan_worms *)tmalloc(sizeof(trojanscan_worms) * trojanscan_database.total_worms))) {
 530           i = 0;
 531           while((sqlrow = trojanscan_database_fetch_row(res))) {
 532             trojanscan_database.worms[i].id = atoi(sqlrow[0]);
 533             trojanscan_database.worms[i].name = trojanscan_getsstring(trojanscan_sanitise(sqlrow[1]), strlen(sqlrow[1]));
 534             tempresult = atoi(sqlrow[2]);
 535             trojanscan_database.worms[i].glineuser = (tempresult == 0);
 536             trojanscan_database.worms[i].glinehost = (tempresult == 1);
 537             trojanscan_database.worms[i].monitor = (tempresult == 2);
 538             if(sqlrow[3]) {
 539               trojanscan_database.worms[i].datalen = ((atoi(sqlrow[3]) == 0) ? 0 : 1);
 540             } else {
 541               trojanscan_database.worms[i].datalen = 0;
 542             }
 543
 544             trojanscan_database.worms[i].hitpriv = (atoi(sqlrow[4]) == 1);
 545             trojanscan_database.worms[i].hitchans = (atoi(sqlrow[5]) == 1);
 546             trojanscan_database.worms[i].epidemic = (atoi(sqlrow[6]) == 1);
 547
 548             i++;
 549           }
 550         }
 551       }
 552       trojanscan_database_free_result(res);
 553     }
 554   }
 555
 556   if (!(trojanscan_database_query("SELECT id, phrase, wormid FROM phrases WHERE disabled = 0 ORDER BY priority DESC"))) {
 557     if ((res = trojanscan_database_store_result(&trojanscan_sql))) {
 558       trojanscan_database.total_phrases = trojanscan_database_num_rows(res);
 559       if (trojanscan_database.total_phrases > 0) {
 560         if ((trojanscan_database.phrases = (trojanscan_phrases *)tmalloc(sizeof(trojanscan_phrases) * trojanscan_database.total_phrases))) {
 561           i = 0;
 562           while((sqlrow = trojanscan_database_fetch_row(res))) {
 563             trojanscan_database.phrases[i].id = atoi(sqlrow[0]);
 564             trojanscan_database.phrases[i].worm = trojanscan_find_worm_by_id(atoi(sqlrow[2]));
 565             if (!(trojanscan_database.phrases[i].phrase = pcre_compile(sqlrow[1], PCRE_CASELESS, &error, &erroroffset, NULL))) {
 566               Error("trojanscan", ERR_WARNING, "Error compiling expression %s at offset %d: %s", sqlrow[1], erroroffset, error);
 567             } else {
 568               trojanscan_database.phrases[i].hint = pcre_study(trojanscan_database.phrases[i].phrase, 0, &error);
 569               if (error) {
 570                 Error("trojanscan", ERR_WARNING, "Error studying expression %s: %s", sqlrow[1], error);
 571                 pcre_free(trojanscan_database.phrases[i].phrase);
 572                 trojanscan_database.phrases[i].phrase = NULL;
 573               }
 574             }
 575             i++;
 576           }
 577         }
 578       }
 579       trojanscan_database_free_result(res);
 580     }
 581   }
 582
 583   trojanscan_database_query("UPDATE settings SET value = '0' where setting = 'rehash'");
 584 }
 585
 586 void trojanscan_log(nick *np, char *event, char *details, ...) {
 587   int nickid = 0;
 588   char eevent[TROJANSCAN_QUERY_TEMP_BUF_SIZE], edetails[TROJANSCAN_QUERY_TEMP_BUF_SIZE], buf[513];
 589   va_list va;
 590
 591   va_start(va, details);
 592   vsnprintf(buf, sizeof(buf) - 1, details, va);
 593   va_end(va);
 594
 595   if (np)
 596     if (IsAccount(np))
 597       nickid = trojanscan_user_id_by_authname(np->authname);
 598
 599   trojanscan_database_escape_string(eevent, event, strlen(event));
 600   trojanscan_database_escape_string(edetails, buf, strlen(buf));
 601   trojanscan_database_query("INSERT INTO logs (userid, act, description) VALUES ('%d', '%s', '%s')", nickid, eevent, edetails);
 602 }
 603
 604 void trojanscan_generateclone(void *arg) {
 605   int i, loops = 0, modes = UMODE_XOPER | UMODE_INV;
 606   char c_nick[NICKLEN+1], c_ident[USERLEN+1], c_host[HOSTLEN+1], c_real[REALLEN+1];
 607   patricia_node_t *fakeip;
 608
 609   i = (int)((long)arg);
 610
 611   /* PPA: unlikely to be infinite */
 612   do {
 613     c_nick[0] = '\0';
 614     if (!loops && trojanscan_hostmode) /* only have one go at this */
 615       trojanscan_generatenick(c_nick, NICKLEN);
 616     if(!c_nick[0])
 617       trojanscan_gennick(c_nick, trojanscan_minmaxrand(7, TROJANSCAN_MMIN(13, NICKLEN)));
 618     loops++;
 619   } while ((getnickbynick(c_nick) != NULL));
 620
 621   trojanscan_generateident(c_ident, USERLEN);
 622   if(!c_ident[0])
 623     trojanscan_genident(c_ident, trojanscan_minmaxrand(4, TROJANSCAN_MMIN(8, USERLEN)));
 624
 625   if(trojanscan_hostmode) {
 626     trojanscan_generatehost(c_host, HOSTLEN, &fakeip);
 627     if(!c_host[0])
 628       trojanscan_genhost(c_host, HOSTLEN, &fakeip);
 629   } else {
 630     trojanscan_genhost(c_host, HOSTLEN, &fakeip);
 631   }
 632
 633   trojanscan_generaterealname(c_real, REALLEN);
 634   if(!c_real[0])
 635     trojanscan_genreal(c_real, trojanscan_minmaxrand(15, TROJANSCAN_MMIN(50, REALLEN)));
 636
 637   trojanscan_swarm[i].clone = registerlocaluser(c_nick, c_ident, c_host, c_real, NULL, modes, &trojanscan_clonehandlemessages);
 638   trojanscan_swarm[i].fakeipnode = fakeip;
 639
 640   if(trojanscan_swarm[i].clone && !trojanscan_swarm_created) {
 641     nick *np = trojanscan_selectuser();
 642     if(np) /* select a 'random' sign on time for whois generation */
 643       trojanscan_swarm[i].clone->timestamp = np->timestamp;
 644   }
 645   trojanscan_swarm[i].remaining = trojanscan_minmaxrand(5, 100);
 646
 647   trojanscan_swarm[i].sitting = 0;
 648
 649 }
 650
 651 void trojanscan_free_channels(void) {
 652   int i;
 653   if(trojanscan_chans) {
 654     for(i=0;i<trojanscan_activechans;i++)
 655       freesstring(trojanscan_chans[i].channel);
 656     tfree(trojanscan_chans);
 657     trojanscan_chans = NULL;
 658     trojanscan_activechans = 0;
 659   }
 660 }
 661
 662 void trojanscan_repool(void *arg) {
 663   if (trojanscan_generatepool() < TROJANSCAN_MINPOOLSIZE) {
 664     trojanscan_hostmode = 0;
 665     return;
 666   } else {
 667     trojanscan_hostmode = 1;
 668     trojanscan_poolschedule = scheduleoneshot(time(NULL) + TROJANSCAN_POOL_REGENERATION, &trojanscan_repool, NULL);
 669   }
 670 }
 671
 672 void trojanscan_registerclones(void *arg) {
 673   unsigned int i;
 674
 675   if (trojanscan_generatepool() < TROJANSCAN_MINPOOLSIZE) {
 676     trojanscan_hostmode = 0;
 677     trojanscan_cloneschedule = scheduleoneshot(time(NULL) + 10, &trojanscan_registerclones, NULL);
 678     return;
 679   } else {
 680     trojanscan_hostmode = 1;
 681     trojanscan_poolschedule = scheduleoneshot(time(NULL) + TROJANSCAN_POOL_REGENERATION, &trojanscan_repool, NULL);
 682     trojanscan_cloneschedule = NULL;
 683   }
 684
 685   for (i=0;i<TROJANSCAN_CLONE_TOTAL;i++)
 686     trojanscan_generateclone((void *)((long)i));
 687   trojanscan_mainchanmsg("n: swarm (%d clones) created.", TROJANSCAN_CLONE_TOTAL);
 688   trojanscan_swarm_created = 1;
 689
 690   trojanscan_initialschedule = scheduleoneshot(time(NULL) + 60, &trojanscan_fill_channels, NULL);
 691 }
 692
 693 int trojanscan_status(void *sender, int cargc, char **cargv) {
 694   nick *np = (nick *)sender;
 695   trojanscan_log(np, "status", "");
 696   trojanscan_reply(np, "Channels in schedule: %d", trojanscan_activechans);
 697   trojanscan_reply(np, "Channels in database: %d", trojanscan_database.total_channels);
 698   trojanscan_reply(np, "Phrases: %d", trojanscan_database.total_phrases);
 699   trojanscan_reply(np, "Worms: %d", trojanscan_database.total_worms);
 700   trojanscan_reply(np, "Detections: %d", trojanscan_database.detections);
 701   trojanscan_reply(np, "Glines: %d", trojanscan_database.glines);
 702   trojanscan_reply(np, "Host/tail pool size: %d", TROJANSCAN_POOLSIZE);
 703   trojanscan_reply(np, "Cycletime: %d", trojanscan_cycletime);
 704   trojanscan_reply(np, "Clones: %d", TROJANSCAN_CLONE_TOTAL);
 705   return CMD_OK;
 706 }
 707
 708 int trojanscan_chanlist(void *sender, int cargc, char **cargv) {
 709   int i;
 710   nick *np = (nick *)sender;
 711   char buf[CHANNELLEN * 2 + 20];
 712   trojanscan_reply(np, "Channel list (%d total):", trojanscan_activechans);
 713   buf[0] = '\0';
 714
 715   for(i=0;i<trojanscan_activechans;i++) {
 716     if(trojanscan_chans[i].channel->length + 3 > sizeof(buf) - strlen(buf)) {
 717       trojanscan_reply(np, "%s", buf);
 718       buf[0] = '\0';
 719     }
 720
 721     /* if splidge sees this I'm going to die */
 722     strlcat(buf, trojanscan_chans[i].channel->content, sizeof(buf));
 723     strlcat(buf, " ", sizeof(buf));
 724   }
 725   if(buf[0])
 726     trojanscan_reply(np, "%s", buf);
 727
 728   trojanscan_reply(np, "Done.");
 729   return CMD_OK;
 730 }
 731
 732 int trojanscan_whois(void *sender, int cargc, char **cargv) {
 733   char *tochange;
 734   nick *np = (nick *)sender, *np2;
 735   int templevel;
 736
 737   if (cargc < 1) {
 738     trojanscan_reply(np, "Not enough parameters.");
 739     return CMD_ERROR;
 740   }
 741
 742   if (cargv[0][0] == '#') {
 743     tochange = cargv[0] + 1;
 744   } else {
 745     int i;
 746     np2 = getnickbynick(cargv[0]);
 747     if (!np2) {
 748       trojanscan_reply(np, "That nickname is not on the network.");
 749       return CMD_ERROR;
 750     }
 751     for(i=0;i<TROJANSCAN_CLONE_TOTAL;i++) {
 752       if(trojanscan_swarm[i].clone->nick && !ircd_strcmp(trojanscan_swarm[i].clone->nick, np2->nick)) {
 753         trojanscan_reply(np, "Nickname   : %s", np2->nick);
 754         trojanscan_reply(np, "Swarm      : yes");
 755         return CMD_OK;
 756       }
 757     }
 758     if (!IsAccount(np2)) {
 759       trojanscan_reply(np, "User is not authed.");
 760       return CMD_OK;
 761     }
 762     tochange = np2->authname;
 763   }
 764
 765   templevel = trojanscan_user_level_by_authname(tochange);
 766   if (templevel == -1) {
 767     trojanscan_reply(np, "User does not exist.");
 768   } else {
 769     union trojanscan_userlevel flags;
 770     flags.number = templevel;
 771     trojanscan_reply(np, "Authname   : %s", tochange);
 772     trojanscan_reply(np, "Flags      : +" TROJANSCAN_FLAG_MASK, TrojanscanFlagsInfo(flags));
 773   }
 774
 775   return CMD_OK;
 776 }
 777
 778 void trojanscan_privmsg_chan_or_nick(channel *cp, nick *np, char *message, ...) {
 779   char buf[513];
 780   va_list va;
 781
 782   if (!trojanscan_nick)
 783     return;
 784
 785   va_start(va, message);
 786   vsnprintf(buf, sizeof(buf) - 1, message, va);
 787   va_end(va);
 788
 789   if (cp) {
 790     sendmessagetochannel(trojanscan_nick, cp, buf);
 791   } else {
 792     sendmessagetouser(trojanscan_nick, np, buf);
 793   }
 794
 795 }
 796
 797 int trojanscan_mew(void *sender, int cargc, char **cargv) {
 798   nick *np = (nick *)sender, *np2 = NULL;
 799   channel *cp = NULL;
 800
 801   if (cargc < 2) {
 802     trojanscan_reply(np, "Not enough paramaters.");
 803     return CMD_ERROR;
 804   }
 805
 806   if(cargv[0][0] == '#') {
 807     if (!(cp = findchannel(cargv[0]))) {
 808       trojanscan_reply(np, "Channel not found.");
 809       return CMD_ERROR;
 810     }
 811     trojanscan_log(np, "mew", "%s %s", cp->index->name->content, cargv[1]);
 812   } else {
 813     if (!(np2 = getnickbynick(cargv[0]))) {
 814       trojanscan_reply(np, "Nickname is not present on the network.");
 815       return CMD_ERROR;
 816     }
 817     trojanscan_log(np, "mew", "%s %s", np2->nick, cargv[1]);
 818   }
 819
 820   trojanscan_privmsg_chan_or_nick(cp, np2, "\001ACTION mews hopefully at %s\001", cargv[1]);
 821
 822   if (cp) {
 823     trojanscan_reply(np, "Mewed at %s in %s.", cargv[1], cp->index->name->content);
 824   } else {
 825     trojanscan_reply(np, "Mewed at %s at %s.", cargv[1], np2->nick);
 826   }
 827
 828   if(!IsOper(np))
 829     trojanscan_mainchanmsg("n: mew: %s %s (%s/%s)", cargv[1], cp?cp->index->name->content:np2->nick, np->nick, np->authname);
 830
 831   return CMD_OK;
 832 }
 833
 834 int trojanscan_cat(void *sender, int cargc, char **cargv) {
 835   nick *np = (nick *)sender, *np2 = NULL;
 836   channel *cp = NULL;
 837   FILE *cat;
 838   char buf[513], *p;
 839
 840   if (cargc < 1) {
 841     trojanscan_reply(np, "Not enough paramaters.");
 842     return CMD_ERROR;
 843   }
 844
 845   if(cargv[0][0] == '#') {
 846     if (!(cp = findchannel(cargv[0]))) {
 847       trojanscan_reply(np, "Channel not found.");
 848       return CMD_ERROR;
 849     }
 850     trojanscan_log(np, "cat", cp->index->name->content);
 851   } else {
 852     if (!(np2 = getnickbynick(cargv[0]))) {
 853       trojanscan_reply(np, "Nickname is not present on the network.");
 854       return CMD_ERROR;
 855     }
 856     trojanscan_log(np, "cat", np2->nick);
 857   }
 858
 859   if ((!(cat = fopen(TROJANSCAN_CAT, "r")))) {
 860     trojanscan_reply(np, "Unable to open cat!");
 861     return CMD_ERROR;
 862   }
 863
 864   while (fgets(buf, sizeof(buf) - 1, cat)) {
 865     if ((p = strchr(buf, '\n'))) {
 866       *p = '\0';
 867       trojanscan_privmsg_chan_or_nick(cp, np2, "%s", buf);
 868     } else if (feof(cat)) {
 869       trojanscan_privmsg_chan_or_nick(cp, np2, "%s", buf);
 870     }
 871   }
 872
 873   fclose(cat);
 874
 875   if (cp) {
 876     trojanscan_reply(np, "Spammed cat in %s.", cp->index->name->content);
 877   } else {
 878     trojanscan_reply(np, "Spammed cat at %s.", np2->nick);
 879   }
 880
 881   return CMD_OK;
 882 }
 883
 884 int trojanscan_reschedule(void *sender, int cargc, char **cargv) {
 885   nick *np = (nick *)sender;
 886   trojanscan_log(np, "reschedule", "");
 887   trojanscan_fill_channels(NULL);
 888
 889   trojanscan_reply(np, "Rescheduled.");
 890   return CMD_OK;
 891 }
 892
 893 int trojanscan_listusers(void *sender, int cargc, char **cargv) {
 894   nick *np = (nick *)sender;
 895
 896   trojanscan_log(np, "listusers", "");
 897
 898   trojanscan_reply(np, "User list:");
 899
 900   if (!(trojanscan_database_query("SELECT authname, authlevel FROM users ORDER BY authlevel DESC, authname"))) {
 901     trojanscan_database_res *res;
 902     if ((res = trojanscan_database_store_result(&trojanscan_sql))) {
 903       if (trojanscan_database_num_rows(res)) {
 904         trojanscan_database_row sqlrow;
 905         union trojanscan_userlevel flags;
 906         while((sqlrow = trojanscan_database_fetch_row(res))) {
 907           flags.number = atoi(sqlrow[1]);
 908           trojanscan_reply(np, "%s +" TROJANSCAN_FLAG_MASK, sqlrow[0], TrojanscanIsDeveloper(flags) ? "d" : "", TrojanscanIsTeamLeader(flags) ? "t" : "", TrojanscanIsStaff(flags) ? "s" : "", TrojanscanIsWebsite(flags) ? "w" : "", TrojanscanIsCat(flags) ? "c" : "");
 909         }
 910       }
 911       trojanscan_database_free_result(res);
 912     }
 913   }
 914
 915   trojanscan_reply(np, "Done.");
 916   return CMD_OK;
 917 }
 918
 919 int trojanscan_help(void *sender, int cargc, char **cargv) {
 920   nick *np = (nick *)sender;
 921
 922   if (cargc == 0) {
 923     trojanscan_reply(np, "Not enough parameters.");
 924     return CMD_ERROR;
 925   }
 926
 927   if (!strcasecmp("help", cargv[0])) {
 928     trojanscan_reply(np, "Syntax: help <command name>");
 929     trojanscan_reply(np, "Gives help on commands.");
 930   } else if (!strcasecmp("status", cargv[0])) {
 931     trojanscan_reply(np, "Syntax: status");
 932     trojanscan_reply(np, "Gives statistical information about the bot.");
 933   } else if (!strcasecmp("join", cargv[0])) {
 934     trojanscan_reply(np, "Syntax: join <#channel>");
 935     trojanscan_reply(np, "Orders a clone to join supplied channel.");
 936   } else if (!strcasecmp("showcommands", cargv[0])) {
 937     trojanscan_reply(np, "Syntax: showcommands");
 938     trojanscan_reply(np, "Pretty obvious.");
 939   } else if (!strcasecmp("hello", cargv[0])) {
 940     trojanscan_reply(np, "Syntax: hello ?nickname?");
 941     trojanscan_reply(np, "Creates a new user.");
 942   } else if (!strcasecmp("rehash", cargv[0])) {
 943     trojanscan_reply(np, "Syntax: rehash");
 944     trojanscan_reply(np, "Reloads bot database.");
 945   } else if (!strcasecmp("changelev", cargv[0])) {
 946     trojanscan_reply(np, "Syntax: changelev <nickname or #authname> <flags>");
 947     trojanscan_reply(np, "Changes access flags of selected user to supplied input.");
 948     trojanscan_reply(np, "+d -> developer");
 949     trojanscan_reply(np, "+t -> team leader");
 950     trojanscan_reply(np, "+s -> staff");
 951     trojanscan_reply(np, "+w -> web management");
 952     trojanscan_reply(np, "+c -> cat access");
 953   } else if (!strcasecmp("deluser", cargv[0])) {
 954     trojanscan_reply(np, "Syntax: deluser <nickname or #authname>");
 955     trojanscan_reply(np, "Deletes selected user from my database.");
 956   } else if (!strcasecmp("mew", cargv[0])) {
 957     trojanscan_reply(np, "Syntax: mew <#channel or nickname> <nickname>");
 958     trojanscan_reply(np, "Gracefully mews at target in selected channel or query.");
 959   } else if (!strcasecmp("cat", cargv[0])) {
 960     trojanscan_reply(np, "Syntax: cat <#channel or nickname>");
 961     trojanscan_reply(np, "Shows the almightly cat.");
 962   } else if (!strcasecmp("reschedule", cargv[0])) {
 963     trojanscan_reply(np, "Syntax: reschedule");
 964     trojanscan_reply(np, "Recalculates bots schedule.");
 965   } else if (!strcasecmp("chanlist", cargv[0])) {
 966     trojanscan_reply(np, "Syntax: chanlist");
 967     trojanscan_reply(np, "Displays bots current channel list.");
 968   } else if (!strcasecmp("whois", cargv[0])) {
 969     trojanscan_reply(np, "Syntax: whois <nickname or #authname>");
 970     trojanscan_reply(np, "Displays information on given user.");
 971   } else if (!strcasecmp("whois", cargv[0])) {
 972     trojanscan_reply(np, "Syntax: listusers <flags>");
 973     trojanscan_reply(np, "Displays users with listusersing flags.");
 974   } else {
 975     trojanscan_reply(np, "Command not found.");
 976     return CMD_ERROR;
 977   }
 978
 979   return CMD_OK;
 980 }
 981
 982 int trojanscan_hello(void *sender, int cargc, char **cargv) {
 983   nick *np = (nick *)sender, *toadd;
 984   char eaccount[TROJANSCAN_QUERY_TEMP_BUF_SIZE];
 985   int level = 0;
 986
 987   if (cargc > 0) {
 988     toadd = getnickbynick(cargv[0]);
 989     if (!toadd) {
 990       trojanscan_reply(np, "That nickname is not on the network.");
 991       return CMD_ERROR;
 992     }
 993     if (!IsAccount(toadd)) {
 994       trojanscan_reply(np, "That user is not authed with the network.");
 995       return CMD_ERROR;
 996     }
 997   } else {
 998     if (!IsAccount(np)) {
 999       trojanscan_reply(np, "You are not authed with the network, auth before creating your user.");
1000       return CMD_ERROR;
1001     }
1002     toadd = np;
1003   }
1004
1005   if (trojanscan_user_level_by_authname(toadd->authname)!=-1) {
1006     trojanscan_reply(np, "Authname (%s) is already on file.", toadd->authname);
1007     return CMD_ERROR;
1008   }
1009
1010   trojanscan_log(np, "hello", toadd->authname);
1011
1012   if (!(trojanscan_database_query("SELECT id FROM users LIMIT 1"))) {
1013     trojanscan_database_res *res;
1014     if ((res = trojanscan_database_store_result(&trojanscan_sql))) {
1015       if (trojanscan_database_num_rows(res) == 0)
1016         level = TROJANSCAN_ACL_DEVELOPER | TROJANSCAN_ACL_STAFF | TROJANSCAN_ACL_WEBSITE | TROJANSCAN_ACL_CAT;
1017       trojanscan_database_free_result(res);
1018     }
1019   }
1020
1021   trojanscan_database_escape_string(eaccount, toadd->authname, strlen(toadd->authname));
1022   trojanscan_database_query("INSERT INTO users (authname, authlevel) VALUES ('%s', %d)", eaccount, level);
1023   trojanscan_reply(np, "Account added to database, account %s%s.", toadd->authname, level>0?" (first user so developer access)":"");
1024
1025   return CMD_OK;
1026 }
1027
1028 int trojanscan_user_level_by_authname(char *authname) {
1029   int result = -1, sl = strlen(authname);
1030   char eaccount[TROJANSCAN_QUERY_TEMP_BUF_SIZE];
1031
1032   trojanscan_database_escape_string(eaccount, authname, sl);
1033   if (!(trojanscan_database_query("SELECT authlevel, authname FROM users WHERE authname = '%s'", eaccount))) {
1034     trojanscan_database_res *res;
1035     if ((res = trojanscan_database_store_result(&trojanscan_sql))) {
1036       if (trojanscan_database_num_rows(res) > 0) {
1037         trojanscan_database_row sqlrow = trojanscan_database_fetch_row(res);
1038         result = atoi(sqlrow[0]);
1039         strlcpy(authname, sqlrow[1], sl + 1);
1040       }
1041       trojanscan_database_free_result(res);
1042     }
1043   }
1044   return result;
1045 }
1046
1047 int trojanscan_user_id_by_authname(char *authname) {
1048   int result = 0;
1049   char eaccount[TROJANSCAN_QUERY_TEMP_BUF_SIZE];
1050
1051   trojanscan_database_escape_string(eaccount, authname, strlen(authname));
1052   if (!(trojanscan_database_query("SELECT id FROM users WHERE authname = '%s'", eaccount))) {
1053     trojanscan_database_res *res;
1054     if ((res = trojanscan_database_store_result(&trojanscan_sql))) {
1055       if (trojanscan_database_num_rows(res) > 0) {
1056         trojanscan_database_row sqlrow = trojanscan_database_fetch_row(res);
1057         result = atoi(sqlrow[0]);
1058       }
1059       trojanscan_database_free_result(res);
1060     }
1061   }
1062   return result;
1063 }
1064
1065 struct trojanscan_clones *trojanscan_selectclone(char type) {
1066   struct trojanscan_clones *rc;
1067   int randomclone, hits = 0, minlimit, maxlimit;
1068
1069   if(type == TROJANSCAN_WATCH_CLONES) {
1070     minlimit = TROJANSCAN_CLONE_MAX;
1071     maxlimit = minlimit + TROJANSCAN_WATCHCLONE_MAX - 1;
1072   } else {
1073     minlimit = 0;
1074     maxlimit = TROJANSCAN_CLONE_MAX - 1;
1075   }
1076
1077   do {
1078     randomclone = trojanscan_minmaxrand(minlimit, maxlimit);
1079     if (hits++ > 200)
1080       return NULL;
1081     rc = &trojanscan_swarm[randomclone];
1082     if ((type == TROJANSCAN_NORMAL_CLONES) && (rc->sitting == 0) && (rc->remaining == 0))
1083       break;
1084
1085   } while (rc->remaining == 0);
1086
1087   if(type == TROJANSCAN_NORMAL_CLONES) {
1088     if ((rc->sitting == 0) && (rc->remaining == 0)) {
1089       if ((!rc->remaining) && (!rc->sitting)) {
1090         if (rc->clone) {
1091           deregisterlocaluser(rc->clone, NULL);
1092           derefnode(iptree, rc->fakeipnode);
1093           rc->clone = NULL;
1094         }
1095         trojanscan_generateclone((void *)((long)rc->index));
1096       }
1097     }
1098   }
1099
1100   return rc;
1101
1102 }
1103
1104 /* hack hack hack */
1105 int trojanscan_nickbanned(trojanscan_clones *np, channel *cp) {
1106   int ret;
1107   patricia_node_t *realipnode = np->clone->ipnode;
1108
1109   np->clone->ipnode = np->fakeipnode;
1110
1111   ret = nickbanned(np->clone, cp, 0);
1112
1113   np->clone->ipnode = realipnode;
1114
1115   return ret;
1116 }
1117
1118 struct trojanscan_realchannels *trojanscan_allocaterc(char *chan) {
1119   struct trojanscan_realchannels *rc;
1120   struct trojanscan_clones *clonep;
1121   channel *cp;
1122   int attempts_left = 10;
1123
1124   if (!chan) {
1125     trojanscan_errorcode = 1; /* sorry splidge ;( */
1126     return NULL;
1127   }
1128
1129   if(chan[0] != '#') {
1130     trojanscan_errorcode = 2;
1131     return NULL;
1132   }
1133
1134   if (strlen(chan) > 1) {
1135     if(strrchr(chan, ',')) {
1136       trojanscan_errorcode = 3;
1137       return NULL;
1138     }
1139
1140     if(strrchr(chan, ' ')) {
1141       trojanscan_errorcode = 4;
1142       return NULL;
1143     }
1144   }
1145
1146   cp = findchannel(chan);
1147   if (!cp) {
1148     trojanscan_errorcode = 5;
1149     return NULL;
1150   }
1151
1152   do {
1153     clonep = trojanscan_selectclone(TROJANSCAN_NORMAL_CLONES);
1154     if (!clonep) {
1155       trojanscan_errorcode = 6;
1156       return NULL;
1157     }
1158     if(!trojanscan_nickbanned(clonep, cp))
1159       break;
1160   } while (--attempts_left > 0);
1161
1162   if (!attempts_left) {
1163     trojanscan_errorcode = 7;
1164     return NULL;
1165   }
1166
1167   rc = (struct trojanscan_realchannels *)tmalloc(sizeof(struct trojanscan_realchannels));
1168
1169   rc->next = NULL;
1170   rc->clone = clonep;
1171   rc->chan = cp;
1172   rc->donotpart = 0;
1173   rc->kickedout = 0;
1174   return rc;
1175 }
1176
1177 void trojanscan_join(struct trojanscan_realchannels *rc) {
1178   struct trojanscan_realchannels *rp = trojanscan_realchanlist;
1179
1180   if (rc->clone && rc->clone->clone) {
1181     if (!localjoinchannel(rc->clone->clone, rc->chan)) {
1182       rc->clone->remaining--;
1183       rc->clone->sitting++;
1184       if (trojanscan_minmaxrand(1, TROJANSCAN_NICKCHANGE_ODDS)%TROJANSCAN_NICKCHANGE_ODDS == 0)
1185         trojanscan_donickchange((void *)rc->clone);
1186
1187       rc->schedule = scheduleoneshot(time(NULL)+trojanscan_part_time, &trojanscan_dopart, (void *)rc);
1188
1189       if (rp) {
1190         for(;rp->next;rp=rp->next);
1191         rp->next = rc;
1192       } else {
1193         trojanscan_realchanlist = rc;
1194       }
1195     }
1196   }
1197
1198 }
1199
1200 int trojanscan_userjoin(void *sender, int cargc, char **cargv) {
1201   nick *np = (nick *)sender;
1202   struct trojanscan_realchannels *rc;
1203
1204   if (cargc < 1) {
1205     trojanscan_reply(np, "Not enough paramaters");
1206     return CMD_ERROR;
1207   }
1208
1209   if (!trojanscan_swarm_created) {
1210     trojanscan_reply(np, "My swarm is currently empty.");
1211     return CMD_OK;
1212   }
1213
1214   if((rc = trojanscan_allocaterc(cargv[0]))) {
1215     trojanscan_log(np, "join", cargv[0]);
1216     trojanscan_join(rc);
1217     trojanscan_reply(np, "Clone has joined channel.");
1218     if(!IsOper(np))
1219       trojanscan_mainchanmsg("n: join: %s (%s/%s)", cargv[0], np->nick, np->authname);
1220   } else {
1221     if (trojanscan_errorcode == 5) {
1222       trojanscan_reply(np, "Not joining empty channel, check you entered the correct channel name.");
1223     } else {
1224       trojanscan_reply(np, "Clone could not join channel (error code %d)!", trojanscan_errorcode);
1225     }
1226   }
1227   return CMD_OK;
1228 }
1229
1230 int trojanscan_rehash(void *sender, int cargc, char **cargv) {
1231   nick *np = (void *)sender;
1232   trojanscan_refresh_settings();
1233   trojanscan_read_database(0);
1234   trojanscan_log(np, "rehash", "");
1235   trojanscan_reply(np, "Done.");
1236   return CMD_OK;
1237 }
1238
1239 int trojanscan_changelev(void *sender, int cargc, char **cargv) {
1240   nick *np = (nick *)sender, *np2;
1241   int templevel;
1242   char eaccount[TROJANSCAN_QUERY_TEMP_BUF_SIZE], *tochange, *p, mode = 1, error = 0, clast = 0, specialcase;
1243   union trojanscan_userlevel flags1, flags2;
1244
1245   if (cargc < 2) {
1246     trojanscan_reply(np, "Not enough parameters.");
1247     return CMD_ERROR;
1248   }
1249
1250   templevel = trojanscan_user_level_by_authname(np->authname);
1251
1252   if (templevel == -1) {
1253     trojanscan_reply(np, "You do not have an account.");
1254     return CMD_ERROR;
1255   }
1256
1257   flags1.number = templevel;
1258
1259   if (cargv[0][0] == '#') {
1260     tochange = cargv[0] + 1;
1261   } else {
1262     np2 = getnickbynick(cargv[0]);
1263     if (!np2) {
1264       trojanscan_reply(np, "That nickname is not on the network.");
1265       return CMD_ERROR;
1266     }
1267     if (!IsAccount(np2)) {
1268       trojanscan_reply(np, "That user is not authed with the network.");
1269       return CMD_ERROR;
1270     }
1271     tochange = np2->authname;
1272   }
1273
1274   templevel = trojanscan_user_level_by_authname(tochange);
1275
1276   if (templevel == -1) {
1277     trojanscan_reply(np, "User does not exist.");
1278     return CMD_ERROR;
1279   }
1280
1281   flags2.number = templevel;
1282
1283   if (!ircd_strcmp(np->authname, tochange)) {
1284     specialcase = 1;
1285   } else {
1286     specialcase = 0;
1287   }
1288
1289   for (p=cargv[1];*p;p++) {
1290     switch (*p) {
1291       case '+':
1292       case '-':
1293         mode = (*p == '+');
1294         break;
1295       case 'd':
1296         if (!TrojanscanIsDeveloper(flags1))
1297           clast = 1;
1298         flags2.values.developer = mode;
1299         break;
1300       case 't':
1301         if (!TrojanscanIsDeveloper(flags1))
1302           clast = 1;
1303         flags2.values.teamleader = mode;
1304         break;
1305       case 's':
1306         if (!TrojanscanIsLeastTeamLeader(flags1))
1307           clast = 1;
1308         flags2.values.staff = mode;
1309         break;
1310       case 'w':
1311         if (!TrojanscanIsDeveloper(flags1))
1312           clast = 1;
1313         flags2.values.website = mode;
1314         break;
1315       case 'c':
1316         if (!TrojanscanIsDeveloper(flags1))
1317           clast = 1;
1318         flags2.values.cat = mode;
1319         break;
1320       default:
1321         error = 1;
1322         goto last;
1323         break;
1324     }
1325     if (clast == 1) {
1326       if (specialcase && !mode) { /* allow user to remove their own flags */
1327         clast = 0;
1328       } else {
1329         goto last;
1330       }
1331     }
1332   }
1333
1334   last:
1335   if (*p) {
1336     if (error) {
1337       trojanscan_reply(np, "Unknown mode: %c%c.", mode?'+':'-', *p);
1338     } else {
1339       trojanscan_reply(np, "You have insufficient privilidges to add/remove one or more flags specified.");
1340     }
1341     return CMD_ERROR;
1342   }
1343
1344   trojanscan_log(np, "changelev", "%s %s", tochange, cargv[1]);
1345   trojanscan_database_escape_string(eaccount, tochange, strlen(tochange));
1346   trojanscan_database_query("UPDATE users SET authlevel = %d WHERE authname = '%s'", flags2.number, eaccount);
1347
1348   trojanscan_reply(np, "Flags changed.");
1349
1350   return CMD_OK;
1351 }
1352
1353 int trojanscan_deluser(void *sender, int cargc, char **cargv) {
1354   nick *np = (nick *)sender, *to;
1355   int templevel;
1356   char eaccount[TROJANSCAN_QUERY_TEMP_BUF_SIZE], *account;
1357   union trojanscan_userlevel flags1, flags2;
1358
1359   if (cargc < 1) {
1360     trojanscan_reply(np, "Not enough parameters.");
1361     return CMD_ERROR;
1362   }
1363
1364   if (cargv[0][0] == '#') {
1365     account = cargv[0] + 1;
1366   } else {
1367     to = getnickbynick(cargv[0]);
1368     if (!to) {
1369       trojanscan_reply(np, "That nickname is not on the network.");
1370       return CMD_ERROR;
1371     }
1372     if (!IsAccount(to)) {
1373       trojanscan_reply(np, "That user is not authed with the network.");
1374       return CMD_ERROR;
1375     }
1376     account = to->authname;
1377   }
1378
1379   flags1.number = trojanscan_user_level_by_authname(np->authname);
1380   templevel = trojanscan_user_level_by_authname(account);
1381
1382   if (templevel == -1) {
1383     trojanscan_reply(np, "Auth %s does not exist.", account);
1384     return CMD_ERROR;
1385   }
1386
1387   flags2.number = templevel;
1388
1389   if (!TrojanscanIsDeveloper(flags1) && TrojanscanIsLeastTeamLeader(flags2)) {
1390       trojanscan_reply(np, "Your cannot delete %s as his/her flags equal or surpass your own.", account);
1391       return CMD_ERROR;
1392   }
1393
1394   trojanscan_log(np, "deluser", account);
1395   trojanscan_database_escape_string(eaccount, account, strlen(account));
1396   trojanscan_database_query("DELETE FROM users WHERE authname = '%s'", eaccount);
1397   trojanscan_reply(np, "User deleted.");
1398
1399   return CMD_OK;
1400 }
1401
1402 int trojanscan_add_ll(struct trojanscan_prechannels **head, struct trojanscan_prechannels *newitem) {
1403   struct trojanscan_prechannels *position, *lastitem = NULL, *location = NULL;
1404   if (!*head) {
1405     *head = newitem;
1406     newitem->next = NULL;
1407     if (newitem->exempt) {
1408       return 0;
1409     } else {
1410       return 1;
1411     }
1412   }
1413   /* if its exempt, we don't give a monkeys where it is... */
1414   if (newitem->exempt) {
1415     newitem->next = *head;
1416     *head = newitem;
1417     return 0;
1418   }
1419
1420   for(position=*head;position;lastitem=position,position=position->next) {
1421     if (!ircd_strcmp(position->name->content, newitem->name->content)) {
1422       tfree(newitem);
1423       return 0;
1424     }
1425     if (!location && (position->size < newitem->size)) {
1426       if (!lastitem) {
1427         location = *head;
1428       } else {
1429         location = lastitem;
1430       }
1431     }
1432   }
1433   if (!location) {
1434     newitem->next = NULL;
1435     lastitem->next = newitem;
1436   } else {
1437     newitem->next = location->next;
1438     location->next = newitem;
1439   }
1440   if(newitem->exempt) {
1441     return 0;
1442   } else {
1443     return 1;
1444   }
1445 }
1446
1447 void trojanscan_watch_clone_update(struct trojanscan_prechannels *hp, int count) {
1448   int i, j, marked;
1449   struct trojanscan_prechannels *lp;
1450   struct trojanscan_templist *markedlist = NULL;
1451
1452   if(count > 0) {
1453     markedlist = (struct trojanscan_templist *)tmalloc(count * sizeof(struct trojanscan_templist));
1454     if (!markedlist)
1455       return;
1456     memset(markedlist, 0, sizeof(struct trojanscan_templist) * count);
1457   }
1458
1459   for(i=0;i<trojanscan_activechans;i++) {
1460     marked = 0;
1461     if(markedlist) {
1462       for(lp=hp,j=0;j<count&&lp;j++,lp=lp->next) {
1463         if(!markedlist[j].active && !lp->exempt && !ircd_strcmp(lp->name->content, trojanscan_chans[i].channel->content)) { /* we're already on the channel */
1464           if(trojanscan_chans[i].watch_clone) {
1465             markedlist[j].active = 1;
1466             markedlist[j].watch_clone = trojanscan_chans[i].watch_clone;
1467             lp->watch_clone = trojanscan_chans[i].watch_clone;
1468           }
1469           marked = 1;
1470           break;
1471         }
1472       }
1473     }
1474     if(!marked && trojanscan_chans[i].watch_clone) {
1475       channel *cp = findchannel(trojanscan_chans[i].channel->content);
1476       if(cp)
1477         localpartchannel(trojanscan_chans[i].watch_clone->clone, cp, NULL);
1478     }
1479   }
1480
1481   if(!markedlist)
1482     return;
1483
1484   for(j=0,lp=hp;j<count&&lp;j++,lp=lp->next) {
1485     if((!markedlist[j].active || !markedlist[j].watch_clone) && !lp->exempt) {
1486       channel *cp = findchannel(lp->name->content);
1487       if(cp) {
1488         int attempts = 10;
1489         do {
1490           lp->watch_clone = trojanscan_selectclone(TROJANSCAN_WATCH_CLONES);
1491           if(!lp->watch_clone)
1492             break;
1493           if(!trojanscan_nickbanned(lp->watch_clone, cp)) {
1494             if(localjoinchannel(lp->watch_clone->clone, cp))
1495               lp->watch_clone = NULL;
1496             break;
1497           }
1498         } while(--attempts > 0);
1499         if(!attempts)
1500           lp->watch_clone = NULL;
1501
1502       }
1503     }
1504   }
1505
1506   tfree(markedlist);
1507 }
1508
1509 void trojanscan_fill_channels(void *arg) {
1510   struct trojanscan_prechannels *head = NULL, *lp, *last = NULL;
1511   int i, count, tempctime = 0;
1512
1513   chanindex *chn;
1514
1515   for (count=i=0;i<trojanscan_database.total_channels;i++) {
1516     lp = (trojanscan_prechannels *)tmalloc(sizeof(trojanscan_prechannels));
1517     lp->name = trojanscan_database.channels[i].name;
1518     lp->size = 65535;
1519     lp->exempt = trojanscan_database.channels[i].exempt;
1520     lp->watch_clone = NULL;
1521     if (trojanscan_add_ll(&head, lp))
1522       count++;
1523   }
1524
1525   for (i=0;i<CHANNELHASHSIZE;i++) {
1526     for(chn=chantable[i];chn;chn=chn->next) {
1527       if (chn->channel && !IsKey(chn->channel) && !IsInviteOnly(chn->channel) && !IsRegOnly(chn->channel) && (chn->channel->users->totalusers >= trojanscan_minchansize)) {
1528         lp = (trojanscan_prechannels *)tmalloc(sizeof(trojanscan_prechannels));
1529         lp->name = chn->name;
1530         lp->size = chn->channel->users->totalusers;
1531         lp->exempt = 0;
1532         lp->watch_clone = NULL;
1533         if (trojanscan_add_ll(&head, lp))
1534           count++;
1535       }
1536     }
1537   }
1538
1539   count = TROJANSCAN_MMIN(count, trojanscan_maxchans);
1540
1541   trojanscan_watch_clone_update(head, count);
1542
1543   trojanscan_free_channels();
1544   trojanscan_chans = (struct trojanscan_inchannel *)tmalloc(count * sizeof(struct trojanscan_inchannel));
1545   memset(trojanscan_chans, 0, count * sizeof(struct trojanscan_inchannel));
1546   trojanscan_activechans = count;
1547   i = 0;
1548
1549   for(lp=head;lp;last=lp,lp=lp->next) {
1550     if (!(lp->exempt) && (i < count)) {
1551       trojanscan_chans[i].channel = getsstring(lp->name->content, lp->name->length);
1552       trojanscan_chans[i++].watch_clone = lp->watch_clone;
1553     }
1554     if (last)
1555       tfree(last);
1556   }
1557
1558   if (last)
1559     tfree(last);
1560
1561   if (trojanscan_activechans > 0) {
1562     tempctime = trojanscan_cycletime / trojanscan_activechans;
1563   } else {
1564     tempctime = 60;
1565     trojanscan_mainchanmsg("d: just escaped a divide by zero error (no activechans!), rescheduling in 60 seconds");
1566   }
1567
1568   if(trojanscan_schedule)
1569     deleteschedule(trojanscan_schedule, &trojanscan_dojoin, NULL);
1570
1571   trojanscan_channumber = 0;
1572
1573   trojanscan_schedule = schedulerecurring(time(NULL) + tempctime, trojanscan_activechans + 1, tempctime, trojanscan_dojoin, NULL);
1574
1575 }
1576
1577 void trojanscan_dojoin(void *arg) {
1578   struct trojanscan_realchannels *rc;
1579   if (trojanscan_channumber >= trojanscan_activechans) {
1580     trojanscan_schedule = NULL;
1581     trojanscan_fill_channels(NULL);
1582   } else {
1583     if ((rc = trojanscan_allocaterc(trojanscan_chans[trojanscan_channumber++].channel->content)))
1584       trojanscan_join(rc);
1585   }
1586 }
1587
1588
1589 void trojanscan_dopart(void *arg) {
1590   struct trojanscan_realchannels *rc = (struct trojanscan_realchannels *)arg, *rp, *past = NULL;
1591
1592   if (rc->kickedout) { /* there's a join scheduled, wait for it (reschedule) */
1593     rc->schedule = scheduleoneshot(time(NULL)+5, &trojanscan_dopart, (void *)rc);
1594     return;
1595   }
1596
1597   if (rc->clone->clone && (!(rc->donotpart)))
1598     localpartchannel(rc->clone->clone, rc->chan, NULL);
1599
1600   rc->clone->sitting--;
1601
1602   for(rp=trojanscan_realchanlist;rp;rp=rp->next) {
1603     if (rp == rc) {
1604       if (!past) {
1605         trojanscan_realchanlist = rp->next;
1606       } else {
1607         past->next = rp->next;
1608       }
1609       tfree(rp);
1610       break;
1611     }
1612     past = rp;
1613   }
1614
1615 }
1616
1617 void trojanscan_donickchange(void *arg) { /* just incase I choose to make this schedule at some point */
1618   struct trojanscan_clones *clone = (trojanscan_clones *)arg;
1619   if (clone && clone->clone) {
1620     char c_nick[NICKLEN+1];
1621     int loops = 0;
1622     /* PPA: unlikely to be infinite */
1623     do {
1624       if ((loops++ < 10) && trojanscan_hostmode) {
1625         trojanscan_generatenick(c_nick, NICKLEN);
1626       } else {
1627         trojanscan_gennick(c_nick, trojanscan_minmaxrand(7, TROJANSCAN_MMIN(13, NICKLEN)));
1628       }
1629     } while (c_nick[0] && (getnickbynick(c_nick) != NULL));
1630
1631     renamelocaluser(clone->clone, c_nick);
1632   }
1633
1634 }
1635
1636 int trojanscan_keysort(const void *v1, const void *v2) {
1637   return ((*(trojanscan_prechannels **)v2)->size - (*(trojanscan_prechannels **)v1)->size);
1638 }
1639
1640 int trojanscan_showcommands(void *sender, int cargc, char **cargv) {
1641   nick *np = (nick *)sender;
1642   Command *cmdlist[100];
1643   int i, n;
1644   char level = 0;
1645
1646   n = getcommandlist(trojanscan_cmds, cmdlist, 100);
1647
1648   trojanscan_reply(np, "The following commands are registered at present:");
1649
1650   for(i=0;i<n;i++) {
1651     if (cmdlist[i]->level & TROJANSCAN_ACL_STAFF) {
1652       level = 's';
1653     } else if (cmdlist[i]->level & TROJANSCAN_ACL_DEVELOPER) {
1654       level = 'd';
1655     } else if (cmdlist[i]->level & TROJANSCAN_ACL_TEAMLEADER) {
1656       level = 't';
1657     } else if (cmdlist[i]->level & TROJANSCAN_ACL_CAT) {
1658       level = 'c';
1659     } else if (cmdlist[i]->level & TROJANSCAN_ACL_WEBSITE) {
1660       level = 'w';
1661     } else if (cmdlist[i]->level & TROJANSCAN_ACL_UNAUTHED) {
1662       level = 0;
1663     }
1664     if (level) {
1665       trojanscan_reply(np, "%s (+%c)", cmdlist[i]->command->content, level);
1666     } else {
1667       trojanscan_reply(np, "%s", cmdlist[i]->command->content);
1668     }
1669   }
1670   trojanscan_reply(np, "End of list.");
1671   return CMD_OK;
1672 }
1673
1674 void trojanscan_handlemessages(nick *target, int messagetype, void **args) {
1675   Command *cmd;
1676   char *cargv[50];
1677   int cargc, templevel;
1678   nick *sender;
1679   union trojanscan_userlevel level;
1680
1681   switch(messagetype) {
1682     case LU_PRIVMSG:
1683     case LU_SECUREMSG:
1684       /* If it's a message, first arg is nick and second is message */
1685       sender = (nick *)args[0];
1686
1687       if(strncmp(TROJANSCAN_VERSION_DETECT, args[1], sizeof(TROJANSCAN_VERSION_DETECT)-1)==0) {
1688         char p = ((char *)args[1])[sizeof(TROJANSCAN_VERSION_DETECT)-1];
1689         if((p == ' ') || (p == '\0') || (p == 1)) {
1690           trojanscan_reply(sender, "\001VERSION Trojanscan (or Tigger) Newserv module version %s by Chris Porter (slug), Newserv by David Mansell (splidge). Compiled " __DATE__ " " __TIME__ ".\001", TROJANSCAN_VERSION);
1691           return;
1692         }
1693       }
1694
1695       /* Split the line into params */
1696       cargc = splitline((char *)args[1], cargv, 50, 0);
1697       if(cargc == 0 || !cargv[0])
1698         return;
1699
1700       cmd=findcommandintree(trojanscan_cmds, cargv[0], 1);
1701       if (!cmd) {
1702         trojanscan_reply(sender, "Unknown command.");
1703         return;
1704       }
1705
1706       if ((cmd->level & TROJANSCAN_ACL_OPER) && !IsOper(sender)) {
1707         trojanscan_reply(sender, "You need to be opered to use this command.");
1708         return;
1709       }
1710
1711       /* bit grim code... */
1712
1713       if (!(cmd->level & TROJANSCAN_ACL_UNAUTHED)) {
1714         if (!IsAccount(sender)) {
1715           trojanscan_reply(sender, "You must be authed with the network to access this command!");
1716           return;
1717         }
1718         templevel = trojanscan_user_level_by_authname(sender->authname);
1719
1720         if (templevel == -1) {
1721           trojanscan_reply(sender, "You do not have an account.");
1722           return;
1723         }
1724
1725         level.number = templevel;
1726
1727         if ((cmd->level & TROJANSCAN_ACL_DEVELOPER) && !TrojanscanIsDeveloper(level)) {
1728           trojanscan_reply(sender, "Access denied.");
1729           return;
1730         }
1731         if ((cmd->level & TROJANSCAN_ACL_TEAMLEADER) && !TrojanscanIsLeastTeamLeader(level)) {
1732           trojanscan_reply(sender, "Access denied.");
1733           return;
1734         }
1735         if ((cmd->level & TROJANSCAN_ACL_STAFF) && !TrojanscanIsLeastStaff(level)) {
1736           trojanscan_reply(sender, "Access denied.");
1737           return;
1738         }
1739         if ((cmd->level & TROJANSCAN_ACL_CAT) && !TrojanscanIsCat(level)) {
1740           trojanscan_reply(sender, "Access denied.");
1741           return;
1742         }
1743         if ((cmd->level & TROJANSCAN_ACL_WEBSITE) && !TrojanscanIsLeastWebsite(level)) {
1744           trojanscan_reply(sender, "Access denied.");
1745           return;
1746         }
1747       }
1748
1749       /* Check the maxargs */
1750       if (cmd->maxparams<(cargc-1)) {
1751         /* We need to do some rejoining */
1752         rejoinline(cargv[cmd->maxparams], cargc-(cmd->maxparams));
1753         cargc = (cmd->maxparams) + 1;
1754       }
1755
1756       (cmd->handler)((void *)sender, cargc - 1, &(cargv[1]));
1757       break;
1758
1759     case LU_KILLED:
1760       /* someone killed me?  Bastards */
1761       trojanscan_connect_nick_schedule = scheduleoneshot(time(NULL) + 1, &trojanscan_connect_nick, NULL);
1762       trojanscan_nick = NULL;
1763       break;
1764
1765     default:
1766       break;
1767   }
1768 }
1769
1770 static char trojanscan_getmtfromhooktype(int input) {
1771   switch(input) {
1772     case HOOK_CHANNEL_PART: return 'P';
1773     default:                return '?';
1774   }
1775 }
1776
1777 char trojanscan_getmtfrommessagetype(int input) {
1778   switch(input) {
1779     case LU_PRIVMSG:    return 'm';
1780     case LU_PRIVNOTICE: return 'n';
1781     case LU_SECUREMSG:  return 's';
1782     case LU_CHANMSG:    return 'M';
1783     case LU_CHANNOTICE: return 'N';
1784     default:            return '?';
1785   }
1786 }
1787
1788 static void trojanscan_process(nick *sender, channel *cp, char mt, char *pretext) {
1789   char text[513];
1790   unsigned int len;
1791   unsigned int i;
1792   struct trojanscan_worms *worm;
1793   int vector[30], detected = 0;
1794
1795   trojanscan_strip_codes(text, sizeof(text) - 1, pretext);
1796
1797   len = strlen(text);
1798
1799   for(i=0;i<trojanscan_database.total_phrases;i++) {
1800     if (
1801          (
1802            (worm = trojanscan_database.phrases[i].worm)
1803          ) &&
1804          (
1805            (
1806              (
1807                (mt == 'm') || (mt == 's') || (mt == 'n')
1808              ) &&
1809              (
1810                (trojanscan_database.phrases[i].worm->hitpriv)
1811              )
1812            ) ||
1813            (
1814              (
1815                (mt == 'M') || (mt == 'N') || (mt == 'P')
1816              ) &&
1817              (
1818                (trojanscan_database.phrases[i].worm->hitchans)
1819              )
1820            )
1821          ) &&
1822          (trojanscan_database.phrases[i].phrase)
1823        ) {
1824       int pre = pcre_exec(trojanscan_database.phrases[i].phrase, trojanscan_database.phrases[i].hint, text, len, 0, 0, vector, 30);
1825       if(pre >= 0) {
1826         char matchbuf[513];
1827         matchbuf[0] = 0;
1828         matchbuf[512] = 0; /* hmm */
1829
1830         if(pre > 1)
1831           if(pcre_copy_substring(text, vector, pre, 1, matchbuf, sizeof(matchbuf) - 1) <= 0)
1832             matchbuf[0] = 0;
1833
1834         trojanscan_phrasematch(cp, sender, &trojanscan_database.phrases[i], mt, matchbuf);
1835
1836         detected = 1;
1837         break;
1838       }
1839     }
1840   }
1841   if (!detected && (mt != 'N') && (mt != 'M')) {
1842     char etext[TROJANSCAN_QUERY_TEMP_BUF_SIZE], enick[TROJANSCAN_QUERY_TEMP_BUF_SIZE], eident[TROJANSCAN_QUERY_TEMP_BUF_SIZE], ehost[TROJANSCAN_QUERY_TEMP_BUF_SIZE];
1843     trojanscan_database_escape_string(etext, text, len);
1844     trojanscan_database_escape_string(enick, sender->nick, strlen(sender->nick));
1845     trojanscan_database_escape_string(eident, sender->ident, strlen(sender->ident));
1846     trojanscan_database_escape_string(ehost, sender->host->name->content, sender->host->name->length);
1847     trojanscan_database_query("INSERT INTO unknownlog (data, user) VALUES ('%s','%s!%s@%s')", etext, enick, eident, ehost);
1848   }
1849 }
1850
1851 void trojanscan_clonehandlemessages(nick *target, int messagetype, void **args) {
1852   char *pretext = NULL;
1853   nick *sender;
1854   struct trojanscan_realchannels *rp;
1855   struct trojanscan_rejoinlist *rj;
1856   char mt = trojanscan_getmtfrommessagetype(messagetype);
1857   char *channel_name;
1858   channel *cp = NULL;
1859   int i;
1860
1861   switch(messagetype) {
1862     case LU_PRIVMSG:
1863     case LU_SECUREMSG:
1864     case LU_PRIVNOTICE:
1865
1866     pretext = (char *)args[1];
1867
1868     case LU_CHANMSG:
1869     case LU_CHANNOTICE:
1870       sender = (nick *)args[0];
1871
1872       if (strlen(sender->nick) < 2)
1873         break;
1874
1875       if (!pretext) {
1876         pretext = (char *)args[2];
1877         cp = args[1];
1878       }
1879
1880       if(strncmp(TROJANSCAN_VERSION_DETECT, pretext, sizeof(TROJANSCAN_VERSION_DETECT)-1)==0) {
1881         char p = pretext[sizeof(TROJANSCAN_VERSION_DETECT)-1];
1882         if((p == ' ') || (p == '\0') || (p == 1)) {
1883           int staff = 0;
1884           if (IsOper(sender)) {
1885             staff = 1;
1886           } else {
1887             if (IsAccount(sender)) {
1888               int templevel = trojanscan_user_level_by_authname(sender->authname);
1889               if (templevel != -1) {
1890                 union trojanscan_userlevel level;
1891                 level.number = templevel;
1892                 if (TrojanscanIsLeastStaff(level))
1893                   staff = 1;
1894               }
1895             }
1896           }
1897           if (staff) {
1898             if(trojanscan_nick) {
1899               sendnoticetouser(target, sender, "\001VERSION T clone, check T for confirmation.\001");
1900               sendnoticetouser(trojanscan_nick, sender, "\001VERSION %s is part of my swarm.\001", target->nick);
1901             } else {
1902               sendnoticetouser(target, sender, "\001VERSION T clone, though since T is currently gone you'll have to version me again in a minute for confirmation.\001");
1903             }
1904           } else {
1905             sendnoticetouser(target, sender,  "\001VERSION %s\001", versionreply);
1906           }
1907
1908           return;
1909         }
1910       }
1911
1912       trojanscan_process(sender, cp, mt, pretext);
1913       break;
1914     case LU_KILLED:
1915       /* someone killed me?  Bastards */
1916
1917       /* PPA: we do NOT rejoin channels at this moment in time, it is possible to do this though */
1918       for (i=0;i<TROJANSCAN_CLONE_TOTAL;i++) {
1919         if (trojanscan_swarm[i].clone == target) {
1920
1921           scheduleoneshot(time(NULL)+1, &trojanscan_generateclone, (void *)((long)i));
1922           if(i >= TROJANSCAN_CLONE_MAX) {
1923             int j;
1924             for(j=0;j<trojanscan_activechans;j++)
1925               if(trojanscan_chans[j].watch_clone == &trojanscan_swarm[i])
1926                 trojanscan_chans[j].watch_clone = NULL;
1927           } else {
1928             for(rp=trojanscan_realchanlist;rp;rp=rp->next)
1929               if ((rp->clone == &(trojanscan_swarm[i])))
1930                 rp->donotpart = 1;
1931           }
1932           derefnode(iptree, trojanscan_swarm[i].fakeipnode);
1933           trojanscan_swarm[i].clone = NULL;
1934           trojanscan_swarm[i].remaining = 0; /* bah */
1935           break;
1936         }
1937       }
1938       break;
1939
1940     case LU_KICKED:
1941       channel_name = ((channel *)args[1])->index->name->content;
1942       for (i=0;i<trojanscan_activechans;i++) {
1943         if (!trojanscan_chans[i].watch_clone)
1944           continue;
1945         if ((trojanscan_chans[i].watch_clone->clone == target) && (!strcmp(trojanscan_chans[i].channel->content, channel_name)))
1946           break;
1947       }
1948       if(i != trojanscan_activechans) {
1949         int j;
1950         for(j=0;j<TROJANSCAN_CLONE_TOTAL;j++) {
1951           if(&trojanscan_swarm[j] == trojanscan_chans[i].watch_clone) {
1952             trojanscan_chans[i].watch_clone = NULL;
1953             break;
1954           }
1955         }
1956       } else {
1957       /*
1958         trojanscan_mainchanmsg("k: %s on %s by %s", target->nick, ((channel *)args[1])->index->name->content, (((nick *)args[0])->nick)?(((nick *)args[0])->nick):"(server)");
1959       */
1960         rj = (struct trojanscan_rejoinlist *)tmalloc(sizeof(struct trojanscan_rejoinlist));
1961         if (rj) {
1962           rj->rp = NULL;
1963           for(rp=trojanscan_realchanlist;rp;rp=rp->next)
1964                if ((rp->clone->clone == target) && (rp->chan == args[1])) {
1965                 rp->kickedout++;
1966                 rj->rp = rp;
1967                 break;
1968               }
1969             if(!rj->rp) {
1970               tfree(rj);
1971               return;
1972             }
1973
1974             rj->channel = getsstring(((channel *)args[1])->index->name->content, ((channel *)args[1])->index->name->length);
1975             if(!rj->channel) {
1976               trojanscan_mainchanmsg("d: unable to allocate memory for channel: %s upon rejoin", ((channel *)args[1])->index->name->content);
1977               tfree(rj);
1978               return;
1979             }
1980
1981             rj->clone = rp->clone;
1982             rj->next = trojanscan_schedulerejoins;
1983             trojanscan_schedulerejoins = rj;
1984
1985             rj->schedule = scheduleoneshot(time(NULL)+1, &trojanscan_rejoin_channel, (void *)rj);
1986           }
1987         }
1988         break;
1989     default:
1990       break;
1991   }
1992 }
1993
1994 static void trojanscan_part_watch(int hook, void *arg) {
1995   void **arglist = (void **)arg;
1996   channel *cp = (channel *)arglist[0];
1997   nick *np = arglist[1];
1998   char *reason = arglist[2];
1999
2000   if(!cp || !np || !reason || (*reason == '\0'))
2001     return;
2002
2003   trojanscan_process(np, cp, trojanscan_getmtfromhooktype(hook), reason);
2004 }
2005
2006 static int trojanscan_hostcount(nick *sender, int hostmode, char *mask, int masklen) {
2007   int usercount = 0, j;
2008   nick *np = NULL; /* sigh at warnings */
2009
2010   if(hostmode)
2011     usercount = sender->ipnode->usercount;
2012
2013   if(usercount > TROJANSCAN_MAX_HOST_GLINE) {
2014     hostmode = 0;
2015     usercount = 0;
2016   }
2017
2018   /* should really go through the ipnode I guess */
2019   if(!hostmode)
2020     for (j=0;j<NICKHASHSIZE;j++)
2021       for (np=nicktable[j];np;np=np->next)
2022         if (np->ipnode==sender->ipnode && !ircd_strcmp(np->ident, sender->ident))
2023           usercount++;
2024
2025   if(mask)
2026     snprintf(mask, masklen, "%s@%s", hostmode?"*":sender->ident, IPtostr(sender->p_ipaddr));
2027
2028   return usercount;
2029 }
2030
2031 void trojanscan_phrasematch(channel *chp, nick *sender, trojanscan_phrases *phrase, char messagetype, char *matchbuf) {
2032   char glinemask[HOSTLEN + USERLEN + NICKLEN + 4], enick[TROJANSCAN_QUERY_TEMP_BUF_SIZE], eident[TROJANSCAN_QUERY_TEMP_BUF_SIZE], ehost[TROJANSCAN_QUERY_TEMP_BUF_SIZE];
2033   unsigned int frequency;
2034   int glining = 0, usercount;
2035   struct trojanscan_worms *worm = phrase->worm;
2036
2037   trojanscan_database.detections++;
2038
2039   usercount = 0;
2040   if (worm->monitor) {
2041     usercount = -1;
2042   } else if(worm->glinehost || worm->glineuser) {
2043     glining = 1;
2044
2045     usercount = trojanscan_hostcount(sender, worm->glinehost, glinemask, sizeof(glinemask));
2046   }
2047
2048   if (!usercount) {
2049     trojanscan_mainchanmsg("w: user %s!%s@%s triggered infection monitor, yet no hosts found at stage 2 -- worm: %s", sender->nick, sender->ident, sender->host->name->content, worm->name->content);
2050     return;
2051   }
2052
2053   if (glining && (usercount > trojanscan_maxusers)) {
2054     trojanscan_mainchanmsg("w: not glining %s!%s@%s due to too many users (%d) with mask: *!%s -- worm: %s)", sender->nick, sender->ident, sender->host->name->content, usercount, glinemask, worm->name->content);
2055     return;
2056   }
2057
2058   if (glining && !worm->datalen) {
2059     trojanscan_mainchanmsg("w: not glining %s!%s@%s due to too lack of removal data with mask: *!%s (%d users) -- worm: %s)", sender->nick, sender->ident, sender->host->name->content, glinemask, usercount, worm->name->content);
2060     return;
2061   }
2062
2063   trojanscan_database_escape_string(enick, sender->nick, strlen(sender->nick));
2064   trojanscan_database_escape_string(eident, sender->ident, strlen(sender->ident));
2065   trojanscan_database_escape_string(ehost, sender->host->name->content, sender->host->name->length);
2066
2067   frequency = 1;
2068
2069   if (!(trojanscan_database_query("SELECT COUNT(*) FROM hits WHERE glined = %d AND host = '%s'", glining, ehost))) {
2070     trojanscan_database_res *res;
2071     if ((res = trojanscan_database_store_result(&trojanscan_sql))) {
2072       trojanscan_database_row sqlrow;
2073       if ((trojanscan_database_num_rows(res) > 0) && (sqlrow = trojanscan_database_fetch_row(res)))
2074         frequency = atoi(sqlrow[0]) + 1;
2075       trojanscan_database_free_result(res);
2076     }
2077   }
2078
2079   if (!glining) {
2080     trojanscan_mainchanmsg("m: t: %c u: %s!%s@%s%s%s w: %s p: %d %s%s", messagetype, sender->nick, sender->ident, sender->host->name->content, messagetype=='N'||messagetype=='M'||messagetype=='P'?" #: ":"", messagetype=='N'||messagetype=='M'||messagetype=='P'?chp->index->name->content:"", worm->name->content, phrase->id, matchbuf[0]?" --: ":"", matchbuf[0]?matchbuf:"");
2081 #ifdef TROJANSCAN_PEONCHANNEL
2082     trojanscan_peonchanmsg("m: t: %c u: %s!%s@%s%s%s%s w: %s %s%s", messagetype, sender->nick, sender->ident, (IsHideHost(sender)&&IsAccount(sender))?sender->authname:sender->host->name->content, (IsHideHost(sender)&&IsAccount(sender))?"."HIS_HIDDENHOST:"", messagetype=='N'||messagetype=='M'||messagetype=='P'?" #: ":"", messagetype=='N'||messagetype=='M'||messagetype=='P'?chp->index->name->content:"", worm->name->content, matchbuf[0]?" --: ":"", matchbuf[0]?matchbuf:"");
2083 #endif
2084   } else {
2085     int glinetime = TROJANSCAN_FIRST_OFFENSE * frequency * (worm->epidemic?TROJANSCAN_EPIDEMIC_MULTIPLIER:1);
2086     if(glinetime > 7 * 24)
2087       glinetime = 7 * 24; /* can't set glines over 7 days with normal non U:lined glines */
2088
2089     trojanscan_database_query("INSERT INTO hits (nickname, ident, host, phrase, messagetype, glined) VALUES ('%s', '%s', '%s', %d, '%c', %d)", enick, eident, ehost, phrase->id, messagetype, glining);
2090     trojanscan_database.glines++;
2091
2092     irc_send("%s GL * +%s %d %jd :You (%s!%s@%s) are infected with a trojan (%s/%d), see %s%d for details - banned for %d hours\r\n", mynumeric->content, glinemask, glinetime * 3600, (intmax_t)time(NULL), sender->nick, sender->ident, sender->host->name->content, worm->name->content, phrase->id, TROJANSCAN_URL_PREFIX, worm->id, glinetime);
2093
2094     trojanscan_mainchanmsg("g: *!%s t: %c u: %s!%s@%s%s%s c: %d w: %s%s p: %d f: %d%s%s", glinemask, messagetype, sender->nick, sender->ident, sender->host->name->content, messagetype=='N'||messagetype=='M'||messagetype=='P'?" #: ":"", messagetype=='N'||messagetype=='M'||messagetype=='P'?chp->index->name->content:"", usercount, worm->name->content, worm->epidemic?"(E)":"", phrase->id, frequency, matchbuf[0]?" --: ":"", matchbuf[0]?matchbuf:"");
2095   }
2096 }
2097
2098 void trojanscan_rejoin_channel(void *arg) {
2099   struct trojanscan_rejoinlist *rj2, *lrj, *rj = (struct trojanscan_rejoinlist *)arg;
2100
2101   channel *cp = findchannel(rj->channel->content);
2102   freesstring(rj->channel);
2103
2104   if (rj->rp) {
2105     rj->rp->kickedout--;
2106     if (!cp) {
2107       rj->rp->donotpart = 1; /* we were the last user on the channel, so we need to be VERY careful freeing it */
2108     } else {
2109       if(!rj->rp->donotpart && !rj->rp->kickedout) { /* check we're allowed to join channels (not killed), and we're the last one to join */
2110         if (trojanscan_nickbanned(rj->clone, cp)) {
2111           rj->rp->donotpart = 1;
2112         } else {
2113           localjoinchannel(rj->clone->clone, cp);
2114         }
2115       }
2116     }
2117   }
2118
2119   rj2 = trojanscan_schedulerejoins;
2120   lrj = NULL;
2121
2122   if (rj2 == rj) {
2123     trojanscan_schedulerejoins = rj->next;
2124     tfree(rj);
2125   } else {
2126     for(rj2=trojanscan_schedulerejoins;rj2;lrj=rj2,rj2=rj2->next) {
2127       if (rj2 == rj) {
2128         lrj->next = rj2->next;
2129         tfree(rj);
2130         break;
2131       }
2132     }
2133   }
2134
2135 }
2136
2137 void trojanscan_reply(nick *target, char *message, ... ) {
2138   char buf[513];
2139   va_list va;
2140
2141   if (!trojanscan_nick)
2142     return;
2143
2144   va_start(va, message);
2145   vsnprintf(buf, sizeof(buf) - 1, message, va);
2146   va_end(va);
2147
2148   sendnoticetouser(trojanscan_nick, target, "%s", buf);
2149 }
2150
2151
2152 void trojanscan_mainchanmsg(char *message, ...) {
2153   char buf[513];
2154   va_list va;
2155   channel *cp;
2156
2157   if (!trojanscan_nick)
2158     return;
2159   if (!(cp = findchannel(TROJANSCAN_CHANNEL)))
2160     return;
2161
2162   va_start(va, message);
2163   vsnprintf(buf, sizeof(buf) - 1, message, va);
2164   va_end(va);
2165
2166   sendmessagetochannel(trojanscan_nick, cp, "%s", buf);
2167 }
2168
2169 #ifdef TROJANSCAN_PEONCHANNEL
2170 void trojanscan_peonchanmsg(char *message, ...) {
2171   char buf[513];
2172   va_list va;
2173   channel *cp;
2174
2175   if (!trojanscan_nick)
2176     return;
2177   if (!(cp = findchannel(TROJANSCAN_PEONCHANNEL)))
2178     return;
2179
2180   va_start(va, message);
2181   vsnprintf(buf, sizeof(buf) - 1, message, va);
2182   va_end(va);
2183
2184   sendmessagetochannel(trojanscan_nick, cp, "%s", buf);
2185 }
2186 #endif
2187
2188 int trojanscan_minmaxrand(float min, float max) {
2189   return (int)((max-min+1)*rand()/(RAND_MAX+min))+min;
2190 }
2191
2192 char *trojanscan_iptostr(char *buf, int buflen, unsigned int ip) {
2193   snprintf(buf, buflen, "%d.%d.%d.%d", ip >> 24, (ip >> 16) & 255, (ip >> 8) & 255, ip & 255);
2194   return buf;
2195 }
2196
2197 char trojanscan_genchar(int ty) {
2198   /* hostname and realname characters*/
2199   if (!ty) {
2200     if (!(trojanscan_minmaxrand(0, 40) % 10)) {
2201       return trojanscan_minmaxrand(48, 57);
2202     } else {
2203       return trojanscan_minmaxrand(97, 122);
2204     }
2205   /* ident characters - without numbers*/
2206   } else if (ty == 1) {
2207     return trojanscan_minmaxrand(97, 122);
2208   /* ident characters - with numbers*/
2209   } else if (ty == 2) {
2210     ty = trojanscan_minmaxrand(97, 125);
2211     if (ty > 122) return trojanscan_minmaxrand(48, 57);
2212     return ty;
2213   /* nick characters - with and without numbers*/
2214   } else if (ty == 3 || ty == 4) {
2215     if (!(trojanscan_minmaxrand(0, 59) % 16)) {
2216       char weirdos[6] = { '\\', '|', '[', '{', ']', '}' };
2217       return weirdos[trojanscan_minmaxrand(0, 5)];
2218     }
2219     if (ty == 4) {
2220       ty = trojanscan_minmaxrand(65, 93);
2221       if (ty > 90) return trojanscan_minmaxrand(48, 57);
2222     } else {
2223       ty = trojanscan_minmaxrand(65, 90);
2224     }
2225     if (!(trojanscan_minmaxrand(0, 40) % 8)) return ty;
2226     return ty + 32;
2227   /* moron check */
2228   } else {
2229     return ' ';
2230   }
2231 }
2232
2233 void trojanscan_gennick(char *ptc, char size) {
2234   int i;
2235   for (i=0;i<size;i++) {
2236     if (i == 0) {
2237       ptc[i] = trojanscan_genchar(3);
2238     } else {
2239       ptc[i] = trojanscan_genchar(4);
2240     }
2241   }
2242   ptc[i] = '\0';
2243 }
2244
2245 void trojanscan_genident(char *ptc, char size) {
2246   int i;
2247   for (i=0;i<size;i++) {
2248     if (i == 0) {
2249       ptc[i] = trojanscan_genchar(1);
2250     } else {
2251       ptc[i] = trojanscan_genchar(2);
2252     }
2253   }
2254   ptc[i] = '\0';
2255 }
2256
2257 void trojanscan_genhost(char *ptc, char size, patricia_node_t **fakeipnode) {
2258   int dots = trojanscan_minmaxrand(2, 5), i, dotexist = 0, cur;
2259   struct irc_in_addr ipaddress;
2260
2261   while (!dotexist) {
2262     for (i=0;i<size;i++) {
2263       ptc[i] = trojanscan_genchar(0);
2264       if ((i > 5) && (i < (size-4))) {
2265         if ((ptc[i-1] != '.') && (ptc[i-1] != '-')) {
2266           cur = trojanscan_minmaxrand(1,size / dots);
2267           if (cur < 3) {
2268             if (cur == 1) {
2269               ptc[i] = '.';
2270               dotexist = 1;
2271             } else {
2272               ptc[i] = '-';
2273             }
2274           }
2275         }
2276       }
2277     }
2278   }
2279   ptc[i] = '\0';
2280
2281   memset(&ipaddress, 0, sizeof(ipaddress));
2282   ((unsigned short *)(ipaddress.in6_16))[5] = 65535;
2283   ((unsigned short *)(ipaddress.in6_16))[6] = trojanscan_minmaxrand(0, 65535);
2284   ((unsigned short *)(ipaddress.in6_16))[7] = trojanscan_minmaxrand(0, 65535);
2285
2286   *fakeipnode = refnode(iptree, &ipaddress, PATRICIA_MAXBITS);
2287 }
2288
2289 void trojanscan_genreal(char *ptc, char size) {
2290   int spaces = trojanscan_minmaxrand(2, 4), i;
2291   for (i=0;i<size;i++) {
2292     ptc[i] = trojanscan_genchar(0);
2293     if ((i > 5) && (i < (size-4))) {
2294       if (ptc[i-1] != ' ') {
2295         if (trojanscan_minmaxrand(1,size / spaces) == 1) ptc[i] = ' ';
2296       }
2297     }
2298   }
2299   ptc[i] = '\0';
2300 }
2301
2302 int trojanscan_is_not_octet(char *begin, int length) {
2303   int i;
2304   if(length > 3)
2305     return 0;
2306   for(i=0;i<length;i++) {
2307     if (!((*begin >= '0') && (*begin <= '9')))
2308       return 0;
2309     begin++;
2310   }
2311   return 1;
2312 }
2313
2314 int trojanscan_generatepool(void) {
2315   int i, k = 0, j = 0, loops = 0;
2316   char *p, *pp;
2317   nick *np;
2318
2319   for (i=0;i<NICKHASHSIZE;i++)
2320     for (np=nicktable[i];np;np=np->next)
2321       j++;
2322
2323   if(j < trojanscan_min_hosts)
2324     return 0;
2325
2326   if(TROJANSCAN_HOST_MODE == TROJANSCAN_STEAL_HOST)
2327     return TROJANSCAN_MINPOOLSIZE;
2328
2329   i = 0;
2330   do {
2331     for (j=trojanscan_minmaxrand(0, NICKHASHSIZE-1);j<NICKHASHSIZE;j++) {
2332       if (nicktable[j]) {
2333         for(p=nicktable[j]->host->name->content, pp=p;*p;) {
2334           if (*++p == '.') {
2335             if (!trojanscan_is_not_octet(pp, p-pp)) {
2336               if (i < TROJANSCAN_POOLSIZE) {
2337                 if (i < trojanscan_hostpoolsize)
2338                   freesstring(trojanscan_hostpool[i]);
2339                 trojanscan_hostpool[i] = getsstring(pp, p-pp);
2340                 i++;
2341               } else {
2342                 if (k >= TROJANSCAN_POOLSIZE)
2343                  break;
2344               }
2345             }
2346             pp=++p;
2347           }
2348         }
2349         if (!trojanscan_is_not_octet(pp, p-pp)) {
2350           if (k < TROJANSCAN_POOLSIZE) {
2351             if (k < trojanscan_tailpoolsize)
2352               freesstring(trojanscan_tailpool[k]);
2353             trojanscan_tailpool[k] = getsstring(pp, p-pp);
2354             k++;
2355           } else {
2356             if (i >= TROJANSCAN_POOLSIZE)
2357               break;
2358           }
2359         }
2360       }
2361     }
2362     loops++;
2363   } while ((loops < 5) && ((i < TROJANSCAN_POOLSIZE) || (k < TROJANSCAN_POOLSIZE)));
2364
2365   trojanscan_hostpoolsize = i;
2366   trojanscan_tailpoolsize = k;
2367   return i;
2368 }
2369
2370 nick *trojanscan_selectuser(void) {
2371   int target = trojanscan_minmaxrand(0, 500), loops = 150, j;
2372   nick *np;
2373   do {
2374     for (j=trojanscan_minmaxrand(0, NICKHASHSIZE-1);j<NICKHASHSIZE;j++)
2375       for(np=nicktable[j];np;np=np->next)
2376         if (!--target)
2377           return np;
2378   } while(--loops > 0);
2379   return NULL;
2380 }
2381
2382 host *trojanscan_selecthost(void) {
2383   int target = trojanscan_minmaxrand(0, 500), loops = 150, j;
2384   host *hp;
2385   do {
2386     for (j=trojanscan_minmaxrand(0, HOSTHASHSIZE-1);j<HOSTHASHSIZE;j++)
2387       for(hp=hosttable[j];hp;hp=hp->next)
2388         if (!--target)
2389           return hp;
2390   } while(--loops > 0);
2391
2392   return NULL;
2393 }
2394
2395 static int specialuseronhost(host *hp) {
2396   nick *np;
2397
2398   for(np=hp->nicks;np;np=np->nextbyhost)
2399     if(IsOper(np) || IsService(np) || IsXOper(np) || NickOnServiceServer(np))
2400       return 1;
2401
2402   return 0;
2403 }
2404
2405 void trojanscan_generatehost(char *buf, int maxsize, patricia_node_t **fakeip) {
2406   struct irc_in_addr ipaddress;
2407
2408   if(TROJANSCAN_HOST_MODE == TROJANSCAN_STEAL_HOST) {
2409     host *hp;
2410     int loops = 20;
2411
2412     buf[0] = '\0';
2413
2414     do {
2415       hp = trojanscan_selecthost();
2416       if(hp && (hp->clonecount <= TROJANSCAN_MAX_CLONE_COUNT) && !trojanscan_isip(hp->name->content) && !specialuseronhost(hp)) {
2417         strlcpy(buf, hp->name->content, maxsize + 1);
2418         if(hp->nicks) {
2419           *fakeip = hp->nicks->ipnode;
2420           patricia_ref_prefix(hp->nicks->ipnode->prefix);
2421         } else {
2422           memset(&ipaddress, 0, sizeof(ipaddress));
2423           ((unsigned short *)(ipaddress.in6_16))[5] = 65535;
2424           ((unsigned short *)(ipaddress.in6_16))[6] = trojanscan_minmaxrand(0, 65535);
2425           ((unsigned short *)(ipaddress.in6_16))[7] = trojanscan_minmaxrand(0, 65535);
2426
2427           *fakeip = refnode(iptree, &ipaddress, PATRICIA_MAXBITS);
2428         }
2429         break;
2430       }
2431     } while(--loops > 0);
2432   } else {
2433     char *cpos;
2434     int pieces = trojanscan_minmaxrand(2, 4), totallen = 0, a = 0, i;
2435     int *choices = tmalloc(sizeof(int) * (pieces + 1));
2436     int *lengths = tmalloc(sizeof(int) * (pieces + 1));
2437
2438     choices[pieces] = trojanscan_minmaxrand(0, trojanscan_tailpoolsize-1);
2439     lengths[pieces] = strlen(trojanscan_tailpool[choices[pieces]]->content) + 1;
2440     totallen += lengths[pieces];
2441
2442     for (i=0;i<pieces;i++) {
2443       choices[i] = trojanscan_minmaxrand(0, trojanscan_hostpoolsize-1);
2444       lengths[i] = strlen(trojanscan_hostpool[choices[i]]->content) + 1;
2445       if (totallen+lengths[i] > maxsize) {
2446         choices[i] = choices[pieces];
2447         lengths[i] = lengths[pieces];
2448         pieces-=(pieces-i);
2449         break;
2450       }
2451       totallen += lengths[i];
2452     }
2453
2454     for (i=0;i<pieces;i++) {
2455       for (cpos=trojanscan_hostpool[choices[i]]->content; *cpos;)
2456         buf[a++] = *cpos++;
2457       buf[a++] = '.';
2458     }
2459
2460     for (cpos=trojanscan_tailpool[choices[i]]->content; *cpos;) {
2461       buf[a++] = *cpos++;
2462     }
2463
2464     buf[a] = '\0';
2465     tfree(choices);
2466     tfree(lengths);
2467
2468     memset(&ipaddress, 0, sizeof(ipaddress));
2469     ((unsigned short *)(ipaddress.in6_16))[5] = 65535;
2470     ((unsigned short *)(ipaddress.in6_16))[6] = trojanscan_minmaxrand(0, 65535);
2471     ((unsigned short *)(ipaddress.in6_16))[7] = trojanscan_minmaxrand(0, 65535);
2472
2473     *fakeip = refnode(iptree, &ipaddress, PATRICIA_MAXBITS);
2474   }
2475 }
2476
2477 void trojanscan_generatenick(char *buf, int maxsize) {
2478   int bits = trojanscan_minmaxrand(2, 3), loops = 0, wanttocopy, len = 0, i, d = 0, newmaxsize = maxsize - trojanscan_minmaxrand(0, 7);
2479   nick *np;
2480
2481   if(newmaxsize > 2)
2482     maxsize = newmaxsize;
2483
2484   do {
2485     np = trojanscan_selectuser();
2486     if(np) {
2487       wanttocopy = trojanscan_minmaxrand(1, (strlen(np->nick) / 2) + 3);
2488       for(i=0;((i<wanttocopy) && (len<maxsize));i++)
2489         buf[len++] = np->nick[i];
2490       if(++d > bits) {
2491         buf[len] = '\0';
2492         return;
2493       }
2494     }
2495   } while (++loops < 10);
2496   buf[0] = '\0';
2497 }
2498
2499 void trojanscan_generateident(char *buf, int maxsize) {
2500   nick *np = trojanscan_selectuser();
2501   buf[0] = '\0';
2502   if(np)
2503     strlcpy(buf, np->ident, maxsize + 1);
2504 }
2505
2506 void trojanscan_generaterealname(char *buf, int maxsize) {
2507   nick *np = trojanscan_selectuser();
2508   buf[0] = '\0';
2509   if(np)
2510     strlcpy(buf, np->realname->name->content, maxsize + 1);
2511 }
2512
2513 void trojanscan_database_close(void) {
2514   mysql_close(&trojanscan_sql);
2515 }
2516
2517 int trojanscan_database_connect(char *dbhost, char *dbuser, char *dbpass, char *db, unsigned int port) {
2518   mysql_init(&trojanscan_sql);
2519   if (!mysql_real_connect(&trojanscan_sql, dbhost, dbuser, dbpass, db, port, NULL, 0))
2520     return -1;
2521   return 0;
2522 }
2523
2524 void trojanscan_database_escape_string(char *dest, char *source, size_t length) {
2525   mysql_escape_string(dest, source, length);
2526 }
2527
2528 int trojanscan_database_query(char *format, ...) {
2529   char trojanscan_sqlquery[TROJANSCAN_QUERY_BUF_SIZE];
2530   va_list va;
2531
2532   va_start(va, format);
2533   vsnprintf(trojanscan_sqlquery, sizeof(trojanscan_sqlquery) - 1, format, va);
2534   va_end(va);
2535   return mysql_query(&trojanscan_sql, trojanscan_sqlquery);
2536 }
2537
2538 int trojanscan_database_num_rows(trojanscan_database_res *res) {
2539   return mysql_num_rows(res);
2540 }
2541
2542 trojanscan_database_res *trojanscan_database_store_result() {
2543   return mysql_store_result(&trojanscan_sql);
2544 }
2545
2546 trojanscan_database_row trojanscan_database_fetch_row(trojanscan_database_res *res) {
2547   return mysql_fetch_row(res);
2548 }
2549
2550 void trojanscan_database_free_result(trojanscan_database_res *res) {
2551   mysql_free_result(res);
2552 }
2553
2554 int trojanscan_isip(char *host) {
2555   char *p = host, components = 0, length = 0;
2556
2557   for(;*p;p++) {
2558     if(*p == '.') {
2559       if(((!length) || (length = 0)) || (++components > 3))
2560         return 0;
2561     } else {
2562       if ((++length > 3) || !isdigit(*p))
2563         return 0;
2564     }
2565   }
2566   return components == 3;
2567 }
2568