trojanscan/trojanscan.c

   1 /*
   2  * Trojanscan version 2
   3  *
   4  * Trojanscan  copyright (C) Chris Porter 2002-2007
   5  * Newserv bits copyright (C) David Mansell 2002-2003
   6  *
   7  * TODO: CHECK::
   8  *   - Poke splidge about +r'ing bots, potential problems:
   9  *     - users might whine about T clone stealing account
  10  *       - would have to steal one already in use, so if trojans start using /msg q whois they'll see
  11  *       (though they have to be authed for this, they could use a clone of their own however)
  12  */
  13
  14 #include "trojanscan.h"
  15 #include "../lib/strlfunc.h"
  16 #include "../lib/version.h"
  17 #include "../core/nsmalloc.h"
  18
  19 #define tmalloc(x)     nsmalloc(POOL_TROJANSCAN, x)
  20 #define tfree(x)       nsfree(POOL_TROJANSCAN, x)
  21
  22 MODULE_VERSION(TROJANSCAN_VERSION);
  23
  24 void trojanscan_phrasematch(channel *chp, nick *sender, trojanscan_phrases *phrase, char messagetype, char *matchbuf);
  25 char *trojanscan_sanitise(char *input);
  26 void trojanscan_refresh_settings(void);
  27 static void trojanscan_part_watch(int hook, void *arg);
  28 static void trojanscan_connect_nick(void *);
  29
  30 #define TROJANSCAN_SETTING_SIZE 256
  31 #define TROJANSCAN_MAX_SETTINGS 50
  32
  33 static struct {
  34   char setting[TROJANSCAN_SETTING_SIZE];
  35   char value[TROJANSCAN_SETTING_SIZE];
  36 } trojanscan_settings[TROJANSCAN_MAX_SETTINGS];
  37
  38 static int settingcount = 0;
  39 static char *versionreply;
  40 static int hooksregistered = 0;
  41 static void *trojanscan_connect_nick_schedule;
  42
  43 void _init() {
  44   trojanscan_cmds = newcommandtree();
  45
  46   addcommandtotree(trojanscan_cmds, "showcommands", TROJANSCAN_ACL_UNAUTHED, 0, &trojanscan_showcommands);
  47   addcommandtotree(trojanscan_cmds, "help", TROJANSCAN_ACL_UNAUTHED, 1, &trojanscan_help);
  48   addcommandtotree(trojanscan_cmds, "hello", TROJANSCAN_ACL_UNAUTHED | TROJANSCAN_ACL_OPER, 1, &trojanscan_hello);
  49
  50   addcommandtotree(trojanscan_cmds, "join", TROJANSCAN_ACL_STAFF, 1, &trojanscan_userjoin);
  51   addcommandtotree(trojanscan_cmds, "chanlist", TROJANSCAN_ACL_STAFF, 0, &trojanscan_chanlist);
  52   addcommandtotree(trojanscan_cmds, "whois", TROJANSCAN_ACL_STAFF, 1, &trojanscan_whois);
  53
  54   addcommandtotree(trojanscan_cmds, "changelev", TROJANSCAN_ACL_STAFF | TROJANSCAN_ACL_OPER, 2, &trojanscan_changelev);
  55   addcommandtotree(trojanscan_cmds, "deluser", TROJANSCAN_ACL_TEAMLEADER | TROJANSCAN_ACL_OPER, 2, &trojanscan_deluser);
  56   addcommandtotree(trojanscan_cmds, "mew", TROJANSCAN_ACL_STAFF, 2, &trojanscan_mew);
  57   addcommandtotree(trojanscan_cmds, "status", TROJANSCAN_ACL_STAFF | TROJANSCAN_ACL_OPER, 0, &trojanscan_status);
  58   addcommandtotree(trojanscan_cmds, "listusers", TROJANSCAN_ACL_TEAMLEADER, 0, &trojanscan_listusers);
  59
  60   addcommandtotree(trojanscan_cmds, "rehash", TROJANSCAN_ACL_WEBSITE, 0, &trojanscan_rehash);
  61
  62   addcommandtotree(trojanscan_cmds, "cat", TROJANSCAN_ACL_OPER, 1, &trojanscan_cat);
  63
  64   addcommandtotree(trojanscan_cmds, "reschedule", TROJANSCAN_ACL_DEVELOPER | TROJANSCAN_ACL_OPER, 0, &trojanscan_reschedule);
  65
  66   srand((int)time(NULL));
  67
  68   trojanscan_connect_schedule = scheduleoneshot(time(NULL) + 1, &trojanscan_connect, NULL);
  69 }
  70
  71 void _fini(void) {
  72   int i;
  73   struct trojanscan_realchannels *rp = trojanscan_realchanlist, *oldrp;
  74   struct trojanscan_rejoinlist *rj = trojanscan_schedulerejoins, *oldrj;
  75
  76   if (trojanscan_nick)
  77     deregisterlocaluser(trojanscan_nick, NULL);
  78
  79   if (trojanscan_connect_schedule)
  80     deleteschedule(trojanscan_connect_schedule, &trojanscan_connect, NULL);
  81
  82   if (trojanscan_connect_nick_schedule)
  83     deleteschedule(trojanscan_connect_nick_schedule, &trojanscan_connect_nick, NULL);
  84
  85   if(trojanscan_schedule)
  86     deleteschedule(trojanscan_schedule, &trojanscan_dojoin, NULL);
  87
  88   if(trojanscan_poolschedule)
  89     deleteschedule(trojanscan_poolschedule, &trojanscan_repool, NULL);
  90
  91   if(trojanscan_cloneschedule)
  92     deleteschedule(trojanscan_poolschedule, &trojanscan_registerclones, NULL);
  93
  94   if(hooksregistered)
  95     deregisterhook(HOOK_CHANNEL_PART, trojanscan_part_watch);
  96
  97   while(rp) {
  98     deleteschedule(rp->schedule, &trojanscan_dopart, (void *)rp);
  99     oldrp = rp;
 100     rp = rp->next;
 101     tfree(oldrp);
 102   }
 103
 104   while(rj) {
 105     deleteschedule(rj->schedule, &trojanscan_rejoin_channel, (void *)rj);
 106     freesstring(rj->channel);
 107     oldrj = rj;
 108     rj = rj->next;
 109     tfree(oldrj);
 110   }
 111
 112   if(trojanscan_initialschedule)
 113     deleteschedule(trojanscan_initialschedule, &trojanscan_fill_channels, NULL);
 114
 115   deleteschedule(trojanscan_rehashschedule, &trojanscan_rehash_schedule, NULL);
 116
 117   for (i=0;i<TROJANSCAN_CLONE_TOTAL;i++)
 118     if(trojanscan_swarm[i].clone) {
 119       deregisterlocaluser(trojanscan_swarm[i].clone, NULL);
 120       derefnode(iptree, trojanscan_swarm[i].fakeipnode);
 121       trojanscan_swarm[i].clone = NULL;
 122     }
 123   trojanscan_free_database();
 124   trojanscan_free_channels();
 125
 126   for (i=0;i<trojanscan_hostpoolsize;i++)
 127     freesstring(trojanscan_hostpool[i]);
 128
 129   for (i=0;i<trojanscan_tailpoolsize;i++)
 130     freesstring(trojanscan_tailpool[i]);
 131   trojanscan_database_close();
 132 }
 133
 134 static void trojanscan_connect_nick(void *arg) {
 135   sstring *mnick, *myident, *myhost, *myrealname, *myauthname;
 136   channel *cp;
 137
 138   mnick = getcopyconfigitem("trojanscan", "nick", "T", NICKLEN);
 139   myident = getcopyconfigitem("trojanscan", "ident", "trojanscan", NICKLEN);
 140   myhost = getcopyconfigitem("trojanscan", "hostname", "trojanscan.slug.netsplit.net", HOSTLEN);
 141   myrealname = getcopyconfigitem("trojanscan", "realname", "Trojanscan v" TROJANSCAN_VERSION, REALLEN);
 142   myauthname = getcopyconfigitem("trojanscan", "authname", "T", ACCOUNTLEN);
 143
 144   trojanscan_nick = registerlocaluser(mnick->content, myident->content, myhost->content, myrealname->content, myauthname->content, UMODE_SERVICE | UMODE_DEAF |
 145                                                                                                                           UMODE_OPER | UMODE_INV |
 146                                                                                                                           UMODE_ACCOUNT,
 147                                                                                                                           &trojanscan_handlemessages);
 148   freesstring(mnick);
 149   freesstring(myident);
 150   freesstring(myhost);
 151   freesstring(myrealname);
 152   freesstring(myauthname);
 153
 154   cp = findchannel(TROJANSCAN_OPERCHANNEL);
 155   if (!cp) {
 156     localcreatechannel(trojanscan_nick, TROJANSCAN_OPERCHANNEL);
 157   } else {
 158     if(!localjoinchannel(trojanscan_nick, cp))
 159       localgetops(trojanscan_nick, cp);
 160   }
 161
 162   cp = findchannel(TROJANSCAN_CHANNEL);
 163   if (!cp) {
 164     localcreatechannel(trojanscan_nick, TROJANSCAN_CHANNEL);
 165   } else {
 166     if(!localjoinchannel(trojanscan_nick, cp))
 167       localgetops(trojanscan_nick, cp);
 168   }
 169
 170 #ifdef TROJANSCAN_PEONCHANNEL
 171   cp = findchannel(TROJANSCAN_PEONCHANNEL);
 172   if (!cp) {
 173     localcreatechannel(trojanscan_nick, TROJANSCAN_PEONCHANNEL);
 174   } else {
 175     if(!localjoinchannel(trojanscan_nick, cp))
 176       localgetops(trojanscan_nick, cp);
 177   }
 178 #endif
 179 }
 180
 181 void trojanscan_connect(void *arg) {
 182   sstring *dbhost, *dbuser, *dbpass, *db, *dbport, *temp;
 183   int length, i;
 184   char buf[10];
 185
 186   trojanscan_connect_schedule = NULL;
 187
 188   for(i=0;i<TROJANSCAN_CLONE_TOTAL;i++)
 189     trojanscan_swarm[i].index = i; /* sure this could be done with pointer arithmetic... */
 190
 191   trojanscan_hostpoolsize = 0;
 192   trojanscan_tailpoolsize = 0;
 193   trojanscan_hostmode = 0;
 194   trojanscan_poolschedule = NULL;
 195   trojanscan_cloneschedule = NULL;
 196   trojanscan_realchanlist = NULL;
 197   trojanscan_database.glines = 0;
 198   trojanscan_database.detections = 0;
 199
 200   dbhost = getcopyconfigitem("trojanscan", "dbhost", "localhost", HOSTLEN);
 201   dbuser = getcopyconfigitem("trojanscan", "dbuser", "", NICKLEN);
 202   dbpass = getcopyconfigitem("trojanscan", "dbpass", "", REALLEN);
 203   db = getcopyconfigitem("trojanscan", "db", "", NICKLEN);
 204
 205   dbport = getcopyconfigitem("trojanscan", "dbport", "3306", ACCOUNTLEN);
 206
 207   length = snprintf(buf, sizeof(buf) - 1, "%d", TROJANSCAN_DEFAULT_MAXCHANS);
 208   temp = getcopyconfigitem("trojanscan", "maxchans", buf, length);
 209
 210   trojanscan_maxchans = atoi(temp->content);
 211   freesstring(temp);
 212
 213   length = snprintf(buf, sizeof(buf) - 1, "%d", TROJANSCAN_DEFAULT_CYCLETIME);
 214   temp = getcopyconfigitem("trojanscan", "cycletime", buf, length);
 215
 216   trojanscan_cycletime = atoi(temp->content);
 217   freesstring(temp);
 218
 219   length = snprintf(buf, sizeof(buf) - 1, "%d", TROJANSCAN_DEFAULT_PARTTIME);
 220   temp = getcopyconfigitem("trojanscan", "parttime", buf, length);
 221   trojanscan_part_time = atoi(temp->content);
 222   freesstring(temp);
 223
 224   length = snprintf(buf, sizeof(buf) - 1, "%d", TROJANSCAN_DEFAULT_MAXUSERS);
 225   temp = getcopyconfigitem("trojanscan", "maxusers", buf, length);
 226   trojanscan_maxusers = atoi(temp->content);
 227   freesstring(temp);
 228
 229   length = snprintf(buf, sizeof(buf) - 1, "%d", TROJANSCAN_MINIMUM_HOSTS_BEFORE_POOL);
 230   temp = getcopyconfigitem("trojanscan", "minpoolhosts", buf, length);
 231   trojanscan_min_hosts = atoi(temp->content);
 232   freesstring(temp);
 233
 234   if ((trojanscan_cycletime / trojanscan_maxchans) < 1) {
 235     Error("trojanscan", ERR_FATAL, "Cycletime / maxchans < 1, increase cycletime or decrease maxchans else cycling breaks.");
 236     return; /* PPA: module failed to load */
 237   }
 238
 239   length = snprintf(buf, sizeof(buf) - 1, "%d", TROJANSCAN_DEFAULT_MINIMUM_CHANNEL_SIZE);
 240   temp = getcopyconfigitem("trojanscan", "minchansize", buf, length);
 241   trojanscan_minchansize = atoi(temp->content);
 242   freesstring(temp);
 243
 244   trojanscan_connect_nick(NULL);
 245
 246   if (trojanscan_database_connect(dbhost->content, dbuser->content, dbpass->content, db->content, atoi(dbport->content)) < 0) {
 247     Error("trojanscan", ERR_FATAL, "Cannot connect to database host!");
 248     return; /* PPA: module failed to load */
 249   }
 250
 251   trojanscan_database_query("CREATE TABLE phrases (id INT(10) PRIMARY KEY AUTO_INCREMENT, wormid INT(10) NOT NULL, phrase TEXT NOT NULL, priority INT(10) DEFAULT 0 NOT NULL, dateadded int(10), disabled BOOL DEFAULT 0 NOT NULL)");
 252   trojanscan_database_query("CREATE TABLE worms (id INT(10) PRIMARY KEY AUTO_INCREMENT, wormname TEXT NOT NULL, glinetype INT DEFAULT 0, data text, hitmsgs BOOL DEFAULT 1, hitchans BOOL DEFAULT 0, epidemic BOOL DEFAULT 0, privinfo text)");
 253   trojanscan_database_query("CREATE TABLE logs (id INT(10) PRIMARY KEY AUTO_INCREMENT, userid INT(10) NOT NULL, act TEXT NOT NULL, description TEXT NOT NULL, ts TIMESTAMP)");
 254   trojanscan_database_query("CREATE TABLE channels (id INT(10) PRIMARY KEY AUTO_INCREMENT, channel VARCHAR(%d) NOT NULL, exempt BOOL DEFAULT 0)", CHANNELLEN);
 255   trojanscan_database_query("CREATE TABLE users (id INT(10) PRIMARY KEY AUTO_INCREMENT, authname VARCHAR(%d) NOT NULL, authlevel TINYINT(4) NOT NULL)", ACCOUNTLEN);
 256   trojanscan_database_query("CREATE TABLE hits (id INT(10) PRIMARY KEY AUTO_INCREMENT, nickname VARCHAR(%d) NOT NULL, ident VARCHAR(%d) NOT NULL, host VARCHAR(%d) NOT NULL, phrase INT(10) NOT NULL, ts TIMESTAMP, messagetype VARCHAR(1) NOT NULL DEFAULT 'm', glined BOOL DEFAULT 1)", NICKLEN, USERLEN, HOSTLEN);
 257   trojanscan_database_query("CREATE TABLE settings (id INT(10) PRIMARY KEY AUTO_INCREMENT, setting VARCHAR(255) NOT NULL UNIQUE, value VARCHAR(255) NOT NULL)");
 258   trojanscan_database_query("CREATE TABLE wwwlogs (id INT(10) PRIMARY KEY AUTO_INCREMENT, authid INT(10) NOT NULL, ip VARCHAR(15), action TEXT, ts TIMESTAMP)");
 259   trojanscan_database_query("CREATE TABLE unknownlog (id INT(10) PRIMARY KEY AUTO_INCREMENT, data TEXT, user VARCHAR(%d) NOT NULL, ts TIMESTAMP)", NICKLEN+USERLEN+HOSTLEN+3);
 260
 261   trojanscan_database_query("DELETE FROM settings WHERE setting = 'rehash' OR setting = 'changed'");
 262   trojanscan_database_query("INSERT INTO settings (setting, value) VALUES ('rehash','0')");
 263   trojanscan_database_query("INSERT INTO settings (setting, value) VALUES ('changed','0')");
 264
 265   /* assumption: constants aren't supplied by someone evil */
 266   trojanscan_database_query("INSERT INTO settings (setting, value) VALUES ('versionreply','" TROJANSCAN_DEFAULT_VERSION_REPLY "')");
 267
 268   trojanscan_refresh_settings();
 269   trojanscan_read_database(1);
 270
 271   freesstring(dbhost);
 272   freesstring(dbuser);
 273   freesstring(dbpass);
 274   freesstring(db);
 275   freesstring(dbport);
 276   trojanscan_registerclones(NULL);
 277
 278   trojanscan_rehashschedule = scheduleoneshot(time(NULL) + 60, &trojanscan_rehash_schedule, NULL);
 279
 280   registerhook(HOOK_CHANNEL_PART, trojanscan_part_watch);
 281   hooksregistered = 1;
 282 }
 283
 284 char *trojanscan_get_setting(char *setting) {
 285   int i;
 286
 287   for(i=0;i<settingcount;i++)
 288     if(!strcmp(trojanscan_settings[i].setting, setting))
 289       return trojanscan_settings[i].value;
 290
 291   return NULL;
 292 }
 293
 294 void trojanscan_refresh_settings(void) {
 295   trojanscan_database_res *res;
 296   trojanscan_database_row sqlrow;
 297   int i = 0;
 298
 299   if(trojanscan_database_query("SELECT setting, value FROM settings"))
 300     return;
 301
 302   if(!(res = trojanscan_database_store_result(&trojanscan_sql)))
 303     return;
 304
 305   if (trojanscan_database_num_rows(res) <= 0)
 306     return;
 307
 308   while((sqlrow = trojanscan_database_fetch_row(res))) {
 309     strlcpy(trojanscan_settings[i].setting, sqlrow[0], TROJANSCAN_SETTING_SIZE);
 310     strlcpy(trojanscan_settings[i].value, sqlrow[1], TROJANSCAN_SETTING_SIZE);
 311
 312     trojanscan_sanitise(trojanscan_settings[i].value);
 313
 314     if(++i == TROJANSCAN_MAX_SETTINGS)
 315       break;
 316   }
 317
 318   settingcount = i;
 319
 320   trojanscan_database_free_result(res);
 321
 322   /* optimisation hack */
 323   versionreply = trojanscan_get_setting("versionreply");
 324 }
 325
 326 void trojanscan_rehash_schedule(void *arg) {
 327   char *v;
 328   trojanscan_rehashschedule = scheduleoneshot(time(NULL) + 60, &trojanscan_rehash_schedule, NULL);
 329
 330   trojanscan_refresh_settings();
 331
 332   v = trojanscan_get_setting("rehash");
 333   if(v && v[0] == '1') {
 334     trojanscan_mainchanmsg("n: rehash initiated by website. . .");
 335     trojanscan_read_database(0);
 336   }
 337 }
 338
 339 void trojanscan_free_database(void) {
 340   int i;
 341   for(i=0;i<trojanscan_database.total_channels;i++)
 342     freesstring(trojanscan_database.channels[i].name);
 343   tfree(trojanscan_database.channels);
 344   for(i=0;i<trojanscan_database.total_phrases;i++) {
 345     if (trojanscan_database.phrases[i].phrase)
 346       pcre_free(trojanscan_database.phrases[i].phrase);
 347     if (trojanscan_database.phrases[i].hint)
 348       pcre_free(trojanscan_database.phrases[i].hint);
 349   }
 350   tfree(trojanscan_database.phrases);
 351   for(i=0;i<trojanscan_database.total_worms;i++)
 352     freesstring(trojanscan_database.worms[i].name);
 353   tfree(trojanscan_database.worms);
 354   trojanscan_database.total_channels = 0;
 355   trojanscan_database.total_phrases = 0;
 356   trojanscan_database.total_worms = 0;
 357
 358 }
 359
 360 char *trojanscan_sanitise(char *input) {
 361   char *p;
 362
 363   for(p=input;*p;p++)
 364     if(*p == '\r' || *p == '\n')
 365       *p = '!';
 366
 367   return input;
 368 }
 369
 370 sstring *trojanscan_getsstring(char *string, int length) {
 371   int i;
 372
 373   for(i=0;i<length;i++) {
 374     if ((string[i] == '\r') || (string[i] == '\n')) {
 375       Error("trojanscan", ERR_WARNING, "Error reading %s at position %d, set to ERROR!", string, i+1);
 376       return getsstring("ERROR", sizeof("ERROR"));
 377     }
 378   }
 379
 380   return getsstring(string, length);
 381 }
 382
 383 int trojanscan_strip_codes(char *buf, size_t max, char *original) {
 384   int i, j, length = TROJANSCAN_MMIN(strlen(original), max-1);
 385   char *p2 = original, *p3, flag = 0;
 386   p3 = buf;
 387   for(i=0;i<length+1;i++) {
 388     switch (*p2) {
 389       case '\002':
 390       case '\017':
 391       case '\026':
 392       case '\037':
 393       break;
 394       case '\003':
 395         for(j=0;j<6;j++) {
 396           if ((i + 1) > length)
 397             break;
 398           if ((j == 4) && flag)
 399             break;
 400           p2++;
 401           i++;
 402           if ((j == 0) && (!((*p2 >= '0') && (*p2 <= '9'))))
 403             break;
 404           if (j == 1) {
 405
 406             if (*p2 == ',') {
 407                 if ((i + 1) > length)
 408                   break;
 409                 if (!((*(p2 + 1) >= '0') && (*(p2 + 1) <= '9')))
 410                   break;
 411               flag = 1;
 412             } else if ((*p2 >= '0') && (*p2 <= '9')) {
 413               flag = 0;
 414             } else {
 415               break;
 416             }
 417           }
 418           if (j == 2) {
 419             if (flag) {
 420               if (!((*p2 >= '0') && (*p2 <= '9')))
 421                 break;
 422             } else {
 423               if (*p2 != ',') {
 424                 break;
 425               } else {
 426                 if ((i + 1) > length)
 427                   break;
 428                 if (!((*(p2 + 1) >= '0') && (*(p2 + 1) <= '9')))
 429                   break;
 430               }
 431             }
 432           }
 433           if ((j == 3) && (!((*p2 >= '0') && (*p2 <= '9'))))
 434             break;
 435           if ((j == 4) && (!((*p2 >= '0') && (*p2 <= '9'))))
 436             break;
 437         }
 438         p2--;
 439         i--;
 440         break;
 441
 442       default:
 443         *p3 = *p2;
 444         p3++;
 445         break;
 446     }
 447     p2++;
 448   }
 449   return p3 - buf;
 450 }
 451
 452 struct trojanscan_worms *trojanscan_find_worm_by_id(int id) {
 453   int i;
 454   for(i=0;i<trojanscan_database.total_worms;i++)
 455     if ((trojanscan_database.worms[i].id == id))
 456       return &trojanscan_database.worms[i];
 457   return NULL;
 458 }
 459
 460 void trojanscan_read_database(int first_time) {
 461   const char *error;
 462   int erroroffset, i, tempresult;
 463
 464   trojanscan_database_res *res;
 465   trojanscan_database_row sqlrow;
 466
 467   if (!first_time) {
 468     trojanscan_free_database();
 469   } else {
 470     trojanscan_database.total_channels = 0;
 471     trojanscan_database.total_phrases = 0;
 472     trojanscan_database.total_worms = 0;
 473   }
 474
 475   if (!(trojanscan_database_query("SELECT channel, exempt FROM channels"))) {
 476     if ((res = trojanscan_database_store_result(&trojanscan_sql))) {
 477       trojanscan_database.total_channels = trojanscan_database_num_rows(res);
 478       if (trojanscan_database.total_channels > 0) {
 479         if ((trojanscan_database.channels = (trojanscan_channels *)tmalloc(sizeof(trojanscan_channels) * trojanscan_database.total_channels))) {
 480           if ((trojanscan_database.total_channels>0) && trojanscan_database.channels) {
 481             i = 0;
 482             while((sqlrow = trojanscan_database_fetch_row(res))) {
 483               trojanscan_database.channels[i].name = trojanscan_getsstring(trojanscan_sanitise(sqlrow[0]), strlen(sqlrow[0]));
 484               trojanscan_database.channels[i].exempt = (sqlrow[1][0] == '1');
 485               i++;
 486             }
 487           }
 488         }
 489       }
 490       trojanscan_database_free_result(res);
 491     }
 492   }
 493
 494   if (!(trojanscan_database_query("SELECT id, wormname, glinetype, length(data), hitmsgs, hitchans, epidemic FROM worms"))) {
 495     if ((res = trojanscan_database_store_result(&trojanscan_sql))) {
 496       trojanscan_database.total_worms = trojanscan_database_num_rows(res);
 497       if (trojanscan_database.total_worms > 0) {
 498         if ((trojanscan_database.worms = (trojanscan_worms *)tmalloc(sizeof(trojanscan_worms) * trojanscan_database.total_worms))) {
 499           i = 0;
 500           while((sqlrow = trojanscan_database_fetch_row(res))) {
 501             trojanscan_database.worms[i].id = atoi(sqlrow[0]);
 502             trojanscan_database.worms[i].name = trojanscan_getsstring(trojanscan_sanitise(sqlrow[1]), strlen(sqlrow[1]));
 503             tempresult = atoi(sqlrow[2]);
 504             trojanscan_database.worms[i].glineuser = (tempresult == 0);
 505             trojanscan_database.worms[i].glinehost = (tempresult == 1);
 506             trojanscan_database.worms[i].monitor = (tempresult == 2);
 507             if(sqlrow[3]) {
 508               trojanscan_database.worms[i].datalen = ((atoi(sqlrow[3]) == 0) ? 0 : 1);
 509             } else {
 510               trojanscan_database.worms[i].datalen = 0;
 511             }
 512
 513             trojanscan_database.worms[i].hitpriv = (atoi(sqlrow[4]) == 1);
 514             trojanscan_database.worms[i].hitchans = (atoi(sqlrow[5]) == 1);
 515             trojanscan_database.worms[i].epidemic = (atoi(sqlrow[6]) == 1);
 516
 517             i++;
 518           }
 519         }
 520       }
 521       trojanscan_database_free_result(res);
 522     }
 523   }
 524
 525   if (!(trojanscan_database_query("SELECT id, phrase, wormid FROM phrases WHERE disabled = 0 ORDER BY priority DESC"))) {
 526     if ((res = trojanscan_database_store_result(&trojanscan_sql))) {
 527       trojanscan_database.total_phrases = trojanscan_database_num_rows(res);
 528       if (trojanscan_database.total_phrases > 0) {
 529         if ((trojanscan_database.phrases = (trojanscan_phrases *)tmalloc(sizeof(trojanscan_phrases) * trojanscan_database.total_phrases))) {
 530           i = 0;
 531           while((sqlrow = trojanscan_database_fetch_row(res))) {
 532             trojanscan_database.phrases[i].id = atoi(sqlrow[0]);
 533             trojanscan_database.phrases[i].worm = trojanscan_find_worm_by_id(atoi(sqlrow[2]));
 534             if (!(trojanscan_database.phrases[i].phrase = pcre_compile(sqlrow[1], PCRE_CASELESS, &error, &erroroffset, NULL))) {
 535               Error("trojanscan", ERR_WARNING, "Error compiling expression %s at offset %d: %s", sqlrow[1], erroroffset, error);
 536             } else {
 537               trojanscan_database.phrases[i].hint = pcre_study(trojanscan_database.phrases[i].phrase, 0, &error);
 538               if (error) {
 539                 Error("trojanscan", ERR_WARNING, "Error studying expression %s: %s", sqlrow[1], error);
 540                 pcre_free(trojanscan_database.phrases[i].phrase);
 541                 trojanscan_database.phrases[i].phrase = NULL;
 542               }
 543             }
 544             i++;
 545           }
 546         }
 547       }
 548       trojanscan_database_free_result(res);
 549     }
 550   }
 551
 552   trojanscan_database_query("UPDATE settings SET value = '0' where setting = 'rehash'");
 553 }
 554
 555 void trojanscan_log(nick *np, char *event, char *details, ...) {
 556   int nickid = 0;
 557   char eevent[TROJANSCAN_QUERY_TEMP_BUF_SIZE], edetails[TROJANSCAN_QUERY_TEMP_BUF_SIZE], buf[513];
 558   va_list va;
 559
 560   va_start(va, details);
 561   vsnprintf(buf, sizeof(buf) - 1, details, va);
 562   va_end(va);
 563
 564   if (np)
 565     if (IsAccount(np))
 566       nickid = trojanscan_user_id_by_authname(np->authname);
 567
 568   trojanscan_database_escape_string(eevent, event, strlen(event));
 569   trojanscan_database_escape_string(edetails, buf, strlen(buf));
 570   trojanscan_database_query("INSERT INTO logs (userid, act, description) VALUES ('%d', '%s', '%s')", nickid, eevent, edetails);
 571 }
 572
 573 void trojanscan_generateclone(void *arg) {
 574   int i, loops = 0, modes = UMODE_XOPER | UMODE_INV;
 575   char c_nick[NICKLEN+1], c_ident[USERLEN+1], c_host[HOSTLEN+1], c_real[REALLEN+1];
 576   patricia_node_t *fakeip;
 577
 578   i = (int)((long)arg);
 579
 580   /* PPA: unlikely to be infinite */
 581   do {
 582     c_nick[0] = '\0';
 583     if (!loops && trojanscan_hostmode) /* only have one go at this */
 584       trojanscan_generatenick(c_nick, NICKLEN);
 585     if(!c_nick[0])
 586       trojanscan_gennick(c_nick, trojanscan_minmaxrand(7, TROJANSCAN_MMIN(13, NICKLEN)));
 587     loops++;
 588   } while ((getnickbynick(c_nick) != NULL));
 589
 590   trojanscan_generateident(c_ident, USERLEN);
 591   if(!c_ident[0])
 592     trojanscan_genident(c_ident, trojanscan_minmaxrand(4, TROJANSCAN_MMIN(8, USERLEN)));
 593
 594   if(trojanscan_hostmode) {
 595     trojanscan_generatehost(c_host, HOSTLEN, &fakeip);
 596     if(!c_host[0])
 597       trojanscan_genhost(c_host, HOSTLEN, &fakeip);
 598   } else {
 599     trojanscan_genhost(c_host, HOSTLEN, &fakeip);
 600   }
 601
 602   trojanscan_generaterealname(c_real, REALLEN);
 603   if(!c_real[0])
 604     trojanscan_genreal(c_real, trojanscan_minmaxrand(15, TROJANSCAN_MMIN(50, REALLEN)));
 605
 606   trojanscan_swarm[i].clone = registerlocaluser(c_nick, c_ident, c_host, c_real, NULL, modes, &trojanscan_clonehandlemessages);
 607   trojanscan_swarm[i].fakeipnode = fakeip;
 608
 609   if(trojanscan_swarm[i].clone && !trojanscan_swarm_created) {
 610     nick *np = trojanscan_selectuser();
 611     if(np) /* select a 'random' sign on time for whois generation */
 612       trojanscan_swarm[i].clone->timestamp = np->timestamp;
 613   }
 614   trojanscan_swarm[i].remaining = trojanscan_minmaxrand(5, 100);
 615
 616   trojanscan_swarm[i].sitting = 0;
 617
 618 }
 619
 620 void trojanscan_free_channels(void) {
 621   int i;
 622   if(trojanscan_chans) {
 623     for(i=0;i<trojanscan_activechans;i++)
 624       freesstring(trojanscan_chans[i].channel);
 625     tfree(trojanscan_chans);
 626     trojanscan_chans = NULL;
 627     trojanscan_activechans = 0;
 628   }
 629 }
 630
 631 void trojanscan_repool(void *arg) {
 632   if (trojanscan_generatepool() < TROJANSCAN_MINPOOLSIZE) {
 633     trojanscan_hostmode = 0;
 634     return;
 635   } else {
 636     trojanscan_hostmode = 1;
 637     trojanscan_poolschedule = scheduleoneshot(time(NULL) + TROJANSCAN_POOL_REGENERATION, &trojanscan_repool, NULL);
 638   }
 639 }
 640
 641 void trojanscan_registerclones(void *arg) {
 642   unsigned int i;
 643
 644   if (trojanscan_generatepool() < TROJANSCAN_MINPOOLSIZE) {
 645     trojanscan_hostmode = 0;
 646     trojanscan_cloneschedule = scheduleoneshot(time(NULL) + 10, &trojanscan_registerclones, NULL);
 647     return;
 648   } else {
 649     trojanscan_hostmode = 1;
 650     trojanscan_poolschedule = scheduleoneshot(time(NULL) + TROJANSCAN_POOL_REGENERATION, &trojanscan_repool, NULL);
 651     trojanscan_cloneschedule = NULL;
 652   }
 653
 654   for (i=0;i<TROJANSCAN_CLONE_TOTAL;i++)
 655     trojanscan_generateclone((void *)((long)i));
 656   trojanscan_mainchanmsg("n: swarm (%d clones) created.", TROJANSCAN_CLONE_TOTAL);
 657   trojanscan_swarm_created = 1;
 658
 659   trojanscan_initialschedule = scheduleoneshot(time(NULL) + 60, &trojanscan_fill_channels, NULL);
 660 }
 661
 662 int trojanscan_status(void *sender, int cargc, char **cargv) {
 663   nick *np = (nick *)sender;
 664   trojanscan_log(np, "status", "");
 665   trojanscan_reply(np, "Channels in schedule: %d", trojanscan_activechans);
 666   trojanscan_reply(np, "Channels in database: %d", trojanscan_database.total_channels);
 667   trojanscan_reply(np, "Phrases: %d", trojanscan_database.total_phrases);
 668   trojanscan_reply(np, "Worms: %d", trojanscan_database.total_worms);
 669   trojanscan_reply(np, "Detections: %d", trojanscan_database.detections);
 670   trojanscan_reply(np, "Glines: %d", trojanscan_database.glines);
 671   trojanscan_reply(np, "Host/tail pool size: %d", TROJANSCAN_POOLSIZE);
 672   trojanscan_reply(np, "Cycletime: %d", trojanscan_cycletime);
 673   trojanscan_reply(np, "Clones: %d", TROJANSCAN_CLONE_TOTAL);
 674   return CMD_OK;
 675 }
 676
 677 int trojanscan_chanlist(void *sender, int cargc, char **cargv) {
 678   int i;
 679   nick *np = (nick *)sender;
 680   char buf[CHANNELLEN * 2 + 20];
 681   trojanscan_reply(np, "Channel list (%d total):", trojanscan_activechans);
 682   buf[0] = '\0';
 683
 684   for(i=0;i<trojanscan_activechans;i++) {
 685     if(trojanscan_chans[i].channel->length + 3 > sizeof(buf) - strlen(buf)) {
 686       trojanscan_reply(np, "%s", buf);
 687       buf[0] = '\0';
 688     }
 689
 690     /* if splidge sees this I'm going to die */
 691     strlcat(buf, trojanscan_chans[i].channel->content, sizeof(buf));
 692     strlcat(buf, " ", sizeof(buf));
 693   }
 694   if(buf[0])
 695     trojanscan_reply(np, "%s", buf);
 696
 697   trojanscan_reply(np, "Done.");
 698   return CMD_OK;
 699 }
 700
 701 int trojanscan_whois(void *sender, int cargc, char **cargv) {
 702   char *tochange;
 703   nick *np = (nick *)sender, *np2;
 704   int templevel;
 705
 706   if (cargc < 1) {
 707     trojanscan_reply(np, "Not enough parameters.");
 708     return CMD_ERROR;
 709   }
 710
 711   if (cargv[0][0] == '#') {
 712     tochange = cargv[0] + 1;
 713   } else {
 714     int i;
 715     np2 = getnickbynick(cargv[0]);
 716     if (!np2) {
 717       trojanscan_reply(np, "That nickname is not on the network.");
 718       return CMD_ERROR;
 719     }
 720     for(i=0;i<TROJANSCAN_CLONE_TOTAL;i++) {
 721       if(trojanscan_swarm[i].clone->nick && !ircd_strcmp(trojanscan_swarm[i].clone->nick, np2->nick)) {
 722         trojanscan_reply(np, "Nickname   : %s", np2->nick);
 723         trojanscan_reply(np, "Swarm      : yes", trojanscan_swarm[i].clone->nick);
 724         return CMD_OK;
 725       }
 726     }
 727     if (!IsAccount(np2)) {
 728       trojanscan_reply(np, "User is not authed.");
 729       return CMD_OK;
 730     }
 731     tochange = np2->authname;
 732   }
 733
 734   templevel = trojanscan_user_level_by_authname(tochange);
 735   if (templevel == -1) {
 736     trojanscan_reply(np, "User does not exist.");
 737   } else {
 738     union trojanscan_userlevel flags;
 739     flags.number = templevel;
 740     trojanscan_reply(np, "Authname   : %s", tochange);
 741     trojanscan_reply(np, "Flags      : +" TROJANSCAN_FLAG_MASK, TrojanscanFlagsInfo(flags));
 742   }
 743
 744   return CMD_OK;
 745 }
 746
 747 void trojanscan_privmsg_chan_or_nick(channel *cp, nick *np, char *message, ...) {
 748   char buf[513];
 749   va_list va;
 750
 751   if (!trojanscan_nick)
 752     return;
 753
 754   va_start(va, message);
 755   vsnprintf(buf, sizeof(buf) - 1, message, va);
 756   va_end(va);
 757
 758   if (cp) {
 759     sendmessagetochannel(trojanscan_nick, cp, buf);
 760   } else {
 761     sendmessagetouser(trojanscan_nick, np, buf);
 762   }
 763
 764 }
 765
 766 int trojanscan_mew(void *sender, int cargc, char **cargv) {
 767   nick *np = (nick *)sender, *np2 = NULL;
 768   channel *cp = NULL;
 769
 770   if (cargc < 2) {
 771     trojanscan_reply(np, "Not enough paramaters.");
 772     return CMD_ERROR;
 773   }
 774
 775   if(cargv[0][0] == '#') {
 776     if (!(cp = findchannel(cargv[0]))) {
 777       trojanscan_reply(np, "Channel not found.");
 778       return CMD_ERROR;
 779     }
 780     trojanscan_log(np, "mew", "%s %s", cp->index->name->content, cargv[1]);
 781   } else {
 782     if (!(np2 = getnickbynick(cargv[0]))) {
 783       trojanscan_reply(np, "Nickname is not present on the network.");
 784       return CMD_ERROR;
 785     }
 786     trojanscan_log(np, "mew", "%s %s", np2->nick, cargv[1]);
 787   }
 788
 789   trojanscan_privmsg_chan_or_nick(cp, np2, "\001ACTION mews hopefully at %s\001", cargv[1]);
 790
 791   if (cp) {
 792     trojanscan_reply(np, "Mewed at %s in %s.", cargv[1], cp->index->name->content);
 793   } else {
 794     trojanscan_reply(np, "Mewed at %s at %s.", cargv[1], np2->nick);
 795   }
 796
 797   if(!IsOper(np))
 798     trojanscan_mainchanmsg("n: mew: %s %s (%s/%s)", cargv[1], cp?cp->index->name->content:np2->nick, np->nick, np->authname);
 799
 800   return CMD_OK;
 801 }
 802
 803 int trojanscan_cat(void *sender, int cargc, char **cargv) {
 804   nick *np = (nick *)sender, *np2 = NULL;
 805   channel *cp = NULL;
 806   FILE *cat;
 807   char buf[513], *p;
 808
 809   if (cargc < 1) {
 810     trojanscan_reply(np, "Not enough paramaters.");
 811     return CMD_ERROR;
 812   }
 813
 814   if(cargv[0][0] == '#') {
 815     if (!(cp = findchannel(cargv[0]))) {
 816       trojanscan_reply(np, "Channel not found.");
 817       return CMD_ERROR;
 818     }
 819     trojanscan_log(np, "cat", cp->index->name->content);
 820   } else {
 821     if (!(np2 = getnickbynick(cargv[0]))) {
 822       trojanscan_reply(np, "Nickname is not present on the network.");
 823       return CMD_ERROR;
 824     }
 825     trojanscan_log(np, "cat", np2->nick);
 826   }
 827
 828   if ((!(cat = fopen(TROJANSCAN_CAT, "r")))) {
 829     trojanscan_reply(np, "Unable to open cat!");
 830     return CMD_ERROR;
 831   }
 832
 833   while (fgets(buf, sizeof(buf) - 1, cat)) {
 834     if ((p = strchr(buf, '\n'))) {
 835       *p = '\0';
 836       trojanscan_privmsg_chan_or_nick(cp, np2, "%s", buf);
 837     } else if (feof(cat)) {
 838       trojanscan_privmsg_chan_or_nick(cp, np2, "%s", buf);
 839     }
 840   }
 841
 842   fclose(cat);
 843
 844   if (cp) {
 845     trojanscan_reply(np, "Spammed cat in %s.", cp->index->name->content);
 846   } else {
 847     trojanscan_reply(np, "Spammed cat at %s.", np2->nick);
 848   }
 849
 850   return CMD_OK;
 851 }
 852
 853 int trojanscan_reschedule(void *sender, int cargc, char **cargv) {
 854   nick *np = (nick *)sender;
 855   trojanscan_log(np, "reschedule", "");
 856   trojanscan_fill_channels(NULL);
 857
 858   trojanscan_reply(np, "Rescheduled.");
 859   return CMD_OK;
 860 }
 861
 862 int trojanscan_listusers(void *sender, int cargc, char **cargv) {
 863   nick *np = (nick *)sender;
 864
 865   trojanscan_log(np, "listusers", "");
 866
 867   trojanscan_reply(np, "User list:");
 868
 869   if (!(trojanscan_database_query("SELECT authname, authlevel FROM users ORDER BY authlevel DESC, authname"))) {
 870     trojanscan_database_res *res;
 871     if ((res = trojanscan_database_store_result(&trojanscan_sql))) {
 872       if (trojanscan_database_num_rows(res)) {
 873         trojanscan_database_row sqlrow;
 874         union trojanscan_userlevel flags;
 875         while((sqlrow = trojanscan_database_fetch_row(res))) {
 876           flags.number = atoi(sqlrow[1]);
 877           trojanscan_reply(np, "%s +" TROJANSCAN_FLAG_MASK, sqlrow[0], TrojanscanIsDeveloper(flags) ? "d" : "", TrojanscanIsTeamLeader(flags) ? "t" : "", TrojanscanIsStaff(flags) ? "s" : "", TrojanscanIsWebsite(flags) ? "w" : "", TrojanscanIsCat(flags) ? "c" : "");
 878         }
 879       }
 880       trojanscan_database_free_result(res);
 881     }
 882   }
 883
 884   trojanscan_reply(np, "Done.");
 885   return CMD_OK;
 886 }
 887
 888 int trojanscan_help(void *sender, int cargc, char **cargv) {
 889   nick *np = (nick *)sender;
 890
 891   if (cargc == 0) {
 892     trojanscan_reply(np, "Not enough parameters.");
 893     return CMD_ERROR;
 894   }
 895
 896   if (!strcasecmp("help", cargv[0])) {
 897     trojanscan_reply(np, "Syntax: help <command name>");
 898     trojanscan_reply(np, "Gives help on commands.");
 899   } else if (!strcasecmp("status", cargv[0])) {
 900     trojanscan_reply(np, "Syntax: status");
 901     trojanscan_reply(np, "Gives statistical information about the bot.");
 902   } else if (!strcasecmp("join", cargv[0])) {
 903     trojanscan_reply(np, "Syntax: join <#channel>");
 904     trojanscan_reply(np, "Orders a clone to join supplied channel.");
 905   } else if (!strcasecmp("showcommands", cargv[0])) {
 906     trojanscan_reply(np, "Syntax: showcommands");
 907     trojanscan_reply(np, "Pretty obvious.");
 908   } else if (!strcasecmp("hello", cargv[0])) {
 909     trojanscan_reply(np, "Syntax: hello ?nickname?");
 910     trojanscan_reply(np, "Creates a new user.");
 911   } else if (!strcasecmp("rehash", cargv[0])) {
 912     trojanscan_reply(np, "Syntax: rehash");
 913     trojanscan_reply(np, "Reloads bot database.");
 914   } else if (!strcasecmp("changelev", cargv[0])) {
 915     trojanscan_reply(np, "Syntax: changelev <nickname or #authname> <flags>");
 916     trojanscan_reply(np, "Changes access flags of selected user to supplied input.");
 917     trojanscan_reply(np, "+d -> developer");
 918     trojanscan_reply(np, "+t -> team leader");
 919     trojanscan_reply(np, "+s -> staff");
 920     trojanscan_reply(np, "+w -> web management");
 921     trojanscan_reply(np, "+c -> cat access");
 922   } else if (!strcasecmp("deluser", cargv[0])) {
 923     trojanscan_reply(np, "Syntax: deluser <nickname or #authname>");
 924     trojanscan_reply(np, "Deletes selected user from my database.");
 925   } else if (!strcasecmp("mew", cargv[0])) {
 926     trojanscan_reply(np, "Syntax: mew <#channel or nickname> <nickname>");
 927     trojanscan_reply(np, "Gracefully mews at target in selected channel or query.");
 928   } else if (!strcasecmp("cat", cargv[0])) {
 929     trojanscan_reply(np, "Syntax: cat <#channel or nickname>");
 930     trojanscan_reply(np, "Shows the almightly cat.");
 931   } else if (!strcasecmp("reschedule", cargv[0])) {
 932     trojanscan_reply(np, "Syntax: reschedule");
 933     trojanscan_reply(np, "Recalculates bots schedule.");
 934   } else if (!strcasecmp("chanlist", cargv[0])) {
 935     trojanscan_reply(np, "Syntax: chanlist");
 936     trojanscan_reply(np, "Displays bots current channel list.");
 937   } else if (!strcasecmp("whois", cargv[0])) {
 938     trojanscan_reply(np, "Syntax: whois <nickname or #authname>");
 939     trojanscan_reply(np, "Displays information on given user.");
 940   } else if (!strcasecmp("whois", cargv[0])) {
 941     trojanscan_reply(np, "Syntax: listusers <flags>");
 942     trojanscan_reply(np, "Displays users with listusersing flags.");
 943   } else {
 944     trojanscan_reply(np, "Command not found.");
 945     return CMD_ERROR;
 946   }
 947
 948   return CMD_OK;
 949 }
 950
 951 int trojanscan_hello(void *sender, int cargc, char **cargv) {
 952   nick *np = (nick *)sender, *toadd;
 953   char eaccount[TROJANSCAN_QUERY_TEMP_BUF_SIZE];
 954   int level = 0;
 955
 956   if (cargc > 0) {
 957     toadd = getnickbynick(cargv[0]);
 958     if (!toadd) {
 959       trojanscan_reply(np, "That nickname is not on the network.");
 960       return CMD_ERROR;
 961     }
 962     if (!IsAccount(toadd)) {
 963       trojanscan_reply(np, "That user is not authed with the network.");
 964       return CMD_ERROR;
 965     }
 966   } else {
 967     if (!IsAccount(np)) {
 968       trojanscan_reply(np, "You are not authed with the network, auth before creating your user.");
 969       return CMD_ERROR;
 970     }
 971     toadd = np;
 972   }
 973
 974   if (trojanscan_user_level_by_authname(toadd->authname)!=-1) {
 975     trojanscan_reply(np, "Authname (%s) is already on file.", toadd->authname);
 976     return CMD_ERROR;
 977   }
 978
 979   trojanscan_log(np, "hello", toadd->authname);
 980
 981   if (!(trojanscan_database_query("SELECT id FROM users LIMIT 1"))) {
 982     trojanscan_database_res *res;
 983     if ((res = trojanscan_database_store_result(&trojanscan_sql))) {
 984       if (trojanscan_database_num_rows(res) == 0)
 985         level = TROJANSCAN_ACL_DEVELOPER | TROJANSCAN_ACL_STAFF | TROJANSCAN_ACL_WEBSITE | TROJANSCAN_ACL_CAT;
 986       trojanscan_database_free_result(res);
 987     }
 988   }
 989
 990   trojanscan_database_escape_string(eaccount, toadd->authname, strlen(toadd->authname));
 991   trojanscan_database_query("INSERT INTO users (authname, authlevel) VALUES ('%s', %d)", eaccount, level);
 992   trojanscan_reply(np, "Account added to database, account %s%s.", toadd->authname, level>0?" (first user so developer access)":"");
 993
 994   return CMD_OK;
 995 }
 996
 997 int trojanscan_user_level_by_authname(char *authname) {
 998   int result = -1, sl = strlen(authname);
 999   char eaccount[TROJANSCAN_QUERY_TEMP_BUF_SIZE];
1000
1001   trojanscan_database_escape_string(eaccount, authname, sl);
1002   if (!(trojanscan_database_query("SELECT authlevel, authname FROM users WHERE authname = '%s'", eaccount))) {
1003     trojanscan_database_res *res;
1004     if ((res = trojanscan_database_store_result(&trojanscan_sql))) {
1005       if (trojanscan_database_num_rows(res) > 0) {
1006         trojanscan_database_row sqlrow = trojanscan_database_fetch_row(res);
1007         result = atoi(sqlrow[0]);
1008         strlcpy(authname, sqlrow[1], sl + 1);
1009       }
1010       trojanscan_database_free_result(res);
1011     }
1012   }
1013   return result;
1014 }
1015
1016 int trojanscan_user_id_by_authname(char *authname) {
1017   int result = 0;
1018   char eaccount[TROJANSCAN_QUERY_TEMP_BUF_SIZE];
1019
1020   trojanscan_database_escape_string(eaccount, authname, strlen(authname));
1021   if (!(trojanscan_database_query("SELECT id FROM users WHERE authname = '%s'", eaccount))) {
1022     trojanscan_database_res *res;
1023     if ((res = trojanscan_database_store_result(&trojanscan_sql))) {
1024       if (trojanscan_database_num_rows(res) > 0) {
1025         trojanscan_database_row sqlrow = trojanscan_database_fetch_row(res);
1026         result = atoi(sqlrow[0]);
1027       }
1028       trojanscan_database_free_result(res);
1029     }
1030   }
1031   return result;
1032 }
1033
1034 struct trojanscan_clones *trojanscan_selectclone(char type) {
1035   struct trojanscan_clones *rc;
1036   int randomclone, hits = 0, minlimit, maxlimit;
1037
1038   if(type == TROJANSCAN_WATCH_CLONES) {
1039     minlimit = TROJANSCAN_CLONE_MAX;
1040     maxlimit = minlimit + TROJANSCAN_WATCHCLONE_MAX - 1;
1041   } else {
1042     minlimit = 0;
1043     maxlimit = TROJANSCAN_CLONE_MAX - 1;
1044   }
1045
1046   do {
1047     randomclone = trojanscan_minmaxrand(minlimit, maxlimit);
1048     if (hits++ > 200)
1049       return NULL;
1050     rc = &trojanscan_swarm[randomclone];
1051     if ((type == TROJANSCAN_NORMAL_CLONES) && (rc->sitting == 0) && (rc->remaining == 0))
1052       break;
1053
1054   } while (rc->remaining == 0);
1055
1056   if(type == TROJANSCAN_NORMAL_CLONES) {
1057     if ((rc->sitting == 0) && (rc->remaining == 0)) {
1058       if ((!rc->remaining) && (!rc->sitting)) {
1059         if (rc->clone) {
1060           deregisterlocaluser(rc->clone, NULL);
1061           derefnode(iptree, rc->fakeipnode);
1062           rc->clone = NULL;
1063         }
1064         trojanscan_generateclone((void *)((long)rc->index));
1065       }
1066     }
1067   }
1068
1069   return rc;
1070
1071 }
1072
1073 /* hack hack hack */
1074 int trojanscan_nickbanned(trojanscan_clones *np, channel *cp) {
1075   int ret;
1076   patricia_node_t *realipnode = np->clone->ipnode;
1077
1078   np->clone->ipnode = np->fakeipnode;
1079
1080   ret = nickbanned(np->clone, cp);
1081
1082   np->clone->ipnode = realipnode;
1083
1084   return ret;
1085 }
1086
1087 struct trojanscan_realchannels *trojanscan_allocaterc(char *chan) {
1088   struct trojanscan_realchannels *rc;
1089   struct trojanscan_clones *clonep;
1090   channel *cp;
1091   int attempts_left = 10;
1092
1093   if (!chan) {
1094     trojanscan_errorcode = 1; /* sorry splidge ;( */
1095     return NULL;
1096   }
1097
1098   if(chan[0] != '#') {
1099     trojanscan_errorcode = 2;
1100     return NULL;
1101   }
1102
1103   if (strlen(chan) > 1) {
1104     if(strrchr(chan, ',')) {
1105       trojanscan_errorcode = 3;
1106       return NULL;
1107     }
1108
1109     if(strrchr(chan, ' ')) {
1110       trojanscan_errorcode = 4;
1111       return NULL;
1112     }
1113   }
1114
1115   cp = findchannel(chan);
1116   if (!cp) {
1117     trojanscan_errorcode = 5;
1118     return NULL;
1119   }
1120
1121   do {
1122     clonep = trojanscan_selectclone(TROJANSCAN_NORMAL_CLONES);
1123     if (!clonep) {
1124       trojanscan_errorcode = 6;
1125       return NULL;
1126     }
1127     if(!trojanscan_nickbanned(clonep, cp))
1128       break;
1129   } while (--attempts_left > 0);
1130
1131   if (!attempts_left) {
1132     trojanscan_errorcode = 7;
1133     return NULL;
1134   }
1135
1136   rc = (struct trojanscan_realchannels *)tmalloc(sizeof(struct trojanscan_realchannels));
1137
1138   rc->next = NULL;
1139   rc->clone = clonep;
1140   rc->chan = cp;
1141   rc->donotpart = 0;
1142   rc->kickedout = 0;
1143   return rc;
1144 }
1145
1146 void trojanscan_join(struct trojanscan_realchannels *rc) {
1147   struct trojanscan_realchannels *rp = trojanscan_realchanlist;
1148
1149   if (rc->clone && rc->clone->clone) {
1150     if (!localjoinchannel(rc->clone->clone, rc->chan)) {
1151       rc->clone->remaining--;
1152       rc->clone->sitting++;
1153       if (trojanscan_minmaxrand(1, TROJANSCAN_NICKCHANGE_ODDS)%TROJANSCAN_NICKCHANGE_ODDS == 0)
1154         trojanscan_donickchange((void *)rc->clone);
1155
1156       rc->schedule = scheduleoneshot(time(NULL)+trojanscan_part_time, &trojanscan_dopart, (void *)rc);
1157
1158       if (rp) {
1159         for(;rp->next;rp=rp->next);
1160         rp->next = rc;
1161       } else {
1162         trojanscan_realchanlist = rc;
1163       }
1164     }
1165   }
1166
1167 }
1168
1169 int trojanscan_userjoin(void *sender, int cargc, char **cargv) {
1170   nick *np = (nick *)sender;
1171   struct trojanscan_realchannels *rc;
1172
1173   if (cargc < 1) {
1174     trojanscan_reply(np, "Not enough paramaters");
1175     return CMD_ERROR;
1176   }
1177
1178   if (!trojanscan_swarm_created) {
1179     trojanscan_reply(np, "My swarm is currently empty.");
1180     return CMD_OK;
1181   }
1182
1183   if((rc = trojanscan_allocaterc(cargv[0]))) {
1184     trojanscan_log(np, "join", cargv[0]);
1185     trojanscan_join(rc);
1186     trojanscan_reply(np, "Clone has joined channel.");
1187     if(!IsOper(np))
1188       trojanscan_mainchanmsg("n: join: %s (%s/%s)", cargv[0], np->nick, np->authname);
1189   } else {
1190     if (trojanscan_errorcode == 5) {
1191       trojanscan_reply(np, "Not joining empty channel, check you entered the correct channel name.");
1192     } else {
1193       trojanscan_reply(np, "Clone could not join channel (error code %d)!", trojanscan_errorcode);
1194     }
1195   }
1196   return CMD_OK;
1197 }
1198
1199 int trojanscan_rehash(void *sender, int cargc, char **cargv) {
1200   nick *np = (void *)sender;
1201   trojanscan_refresh_settings();
1202   trojanscan_read_database(0);
1203   trojanscan_log(np, "rehash", "");
1204   trojanscan_reply(np, "Done.");
1205   return CMD_OK;
1206 }
1207
1208 int trojanscan_changelev(void *sender, int cargc, char **cargv) {
1209   nick *np = (nick *)sender, *np2;
1210   int templevel;
1211   char eaccount[TROJANSCAN_QUERY_TEMP_BUF_SIZE], *tochange, *p, mode = 1, error = 0, clast = 0, specialcase;
1212   union trojanscan_userlevel flags1, flags2;
1213
1214   if (cargc < 2) {
1215     trojanscan_reply(np, "Not enough parameters.");
1216     return CMD_ERROR;
1217   }
1218
1219   templevel = trojanscan_user_level_by_authname(np->authname);
1220
1221   if (templevel == -1) {
1222     trojanscan_reply(np, "You do not have an account.");
1223     return CMD_ERROR;
1224   }
1225
1226   flags1.number = templevel;
1227
1228   if (cargv[0][0] == '#') {
1229     tochange = cargv[0] + 1;
1230   } else {
1231     np2 = getnickbynick(cargv[0]);
1232     if (!np2) {
1233       trojanscan_reply(np, "That nickname is not on the network.");
1234       return CMD_ERROR;
1235     }
1236     if (!IsAccount(np2)) {
1237       trojanscan_reply(np, "That user is not authed with the network.");
1238       return CMD_ERROR;
1239     }
1240     tochange = np2->authname;
1241   }
1242
1243   templevel = trojanscan_user_level_by_authname(tochange);
1244
1245   if (templevel == -1) {
1246     trojanscan_reply(np, "User does not exist.");
1247     return CMD_ERROR;
1248   }
1249
1250   flags2.number = templevel;
1251
1252   if (!ircd_strcmp(np->authname, tochange)) {
1253     specialcase = 1;
1254   } else {
1255     specialcase = 0;
1256   }
1257
1258   for (p=cargv[1];*p;p++) {
1259     switch (*p) {
1260       case '+':
1261       case '-':
1262         mode = (*p == '+');
1263         break;
1264       case 'd':
1265         if (!TrojanscanIsDeveloper(flags1))
1266           clast = 1;
1267         flags2.values.developer = mode;
1268         break;
1269       case 't':
1270         if (!TrojanscanIsDeveloper(flags1))
1271           clast = 1;
1272         flags2.values.teamleader = mode;
1273         break;
1274       case 's':
1275         if (!TrojanscanIsLeastTeamLeader(flags1))
1276           clast = 1;
1277         flags2.values.staff = mode;
1278         break;
1279       case 'w':
1280         if (!TrojanscanIsDeveloper(flags1))
1281           clast = 1;
1282         flags2.values.website = mode;
1283         break;
1284       case 'c':
1285         if (!TrojanscanIsDeveloper(flags1))
1286           clast = 1;
1287         flags2.values.cat = mode;
1288         break;
1289       default:
1290         error = 1;
1291         goto last;
1292         break;
1293     }
1294     if (clast == 1) {
1295       if (specialcase && !mode) { /* allow user to remove their own flags */
1296         clast = 0;
1297       } else {
1298         goto last;
1299       }
1300     }
1301   }
1302
1303   last:
1304   if (*p) {
1305     if (error) {
1306       trojanscan_reply(np, "Unknown mode: %c%c.", mode?'+':'-', *p);
1307     } else {
1308       trojanscan_reply(np, "You have insufficient privilidges to add/remove one or more flags specified.");
1309     }
1310     return CMD_ERROR;
1311   }
1312
1313   trojanscan_log(np, "changelev", "%s %s", tochange, cargv[1]);
1314   trojanscan_database_escape_string(eaccount, tochange, strlen(tochange));
1315   trojanscan_database_query("UPDATE users SET authlevel = %d WHERE authname = '%s'", flags2.number, eaccount);
1316
1317   trojanscan_reply(np, "Flags changed.");
1318
1319   return CMD_OK;
1320 }
1321
1322 int trojanscan_deluser(void *sender, int cargc, char **cargv) {
1323   nick *np = (nick *)sender, *to;
1324   int templevel;
1325   char eaccount[TROJANSCAN_QUERY_TEMP_BUF_SIZE], *account;
1326   union trojanscan_userlevel flags1, flags2;
1327
1328   if (cargc < 1) {
1329     trojanscan_reply(np, "Not enough parameters.");
1330     return CMD_ERROR;
1331   }
1332
1333   if (cargv[0][0] == '#') {
1334     account = cargv[0] + 1;
1335   } else {
1336     to = getnickbynick(cargv[0]);
1337     if (!to) {
1338       trojanscan_reply(np, "That nickname is not on the network.");
1339       return CMD_ERROR;
1340     }
1341     if (!IsAccount(to)) {
1342       trojanscan_reply(np, "That user is not authed with the network.");
1343       return CMD_ERROR;
1344     }
1345     account = to->authname;
1346   }
1347
1348   flags1.number = trojanscan_user_level_by_authname(np->authname);
1349   templevel = trojanscan_user_level_by_authname(account);
1350
1351   if (templevel == -1) {
1352     trojanscan_reply(np, "Auth %s does not exist.", account);
1353     return CMD_ERROR;
1354   }
1355
1356   flags2.number = templevel;
1357
1358   if (!TrojanscanIsDeveloper(flags1) && TrojanscanIsLeastTeamLeader(flags2)) {
1359       trojanscan_reply(np, "Your cannot delete %s as his/her flags equal or surpass your own.", account);
1360       return CMD_ERROR;
1361   }
1362
1363   trojanscan_log(np, "deluser", account);
1364   trojanscan_database_escape_string(eaccount, account, strlen(account));
1365   trojanscan_database_query("DELETE FROM users WHERE authname = '%s'", eaccount);
1366   trojanscan_reply(np, "User deleted.");
1367
1368   return CMD_OK;
1369 }
1370
1371 int trojanscan_add_ll(struct trojanscan_prechannels **head, struct trojanscan_prechannels *newitem) {
1372   struct trojanscan_prechannels *position, *lastitem = NULL, *location = NULL;
1373   if (!*head) {
1374     *head = newitem;
1375     newitem->next = NULL;
1376     if (newitem->exempt) {
1377       return 0;
1378     } else {
1379       return 1;
1380     }
1381   }
1382   /* if its exempt, we don't give a monkeys where it is... */
1383   if (newitem->exempt) {
1384     newitem->next = *head;
1385     *head = newitem;
1386     return 0;
1387   }
1388
1389   for(position=*head;position;lastitem=position,position=position->next) {
1390     if (!ircd_strcmp(position->name->content, newitem->name->content)) {
1391       tfree(newitem);
1392       return 0;
1393     }
1394     if (!location && (position->size < newitem->size)) {
1395       if (!lastitem) {
1396         location = *head;
1397       } else {
1398         location = lastitem;
1399       }
1400     }
1401   }
1402   if (!location) {
1403     newitem->next = NULL;
1404     lastitem->next = newitem;
1405   } else {
1406     newitem->next = location->next;
1407     location->next = newitem;
1408   }
1409   if(newitem->exempt) {
1410     return 0;
1411   } else {
1412     return 1;
1413   }
1414 }
1415
1416 void trojanscan_watch_clone_update(struct trojanscan_prechannels *hp, int count) {
1417   int i, j, marked;
1418   struct trojanscan_prechannels *lp;
1419   struct trojanscan_templist *markedlist = NULL;
1420
1421   if(count > 0) {
1422     markedlist = (struct trojanscan_templist *)tmalloc(count * sizeof(struct trojanscan_templist));
1423     if (!markedlist)
1424       return;
1425     memset(markedlist, 0, sizeof(struct trojanscan_templist) * count);
1426   }
1427
1428   for(i=0;i<trojanscan_activechans;i++) {
1429     marked = 0;
1430     if(markedlist) {
1431       for(lp=hp,j=0;j<count&&lp;j++,lp=lp->next) {
1432         if(!markedlist[j].active && !lp->exempt && !ircd_strcmp(lp->name->content, trojanscan_chans[i].channel->content)) { /* we're already on the channel */
1433           if(trojanscan_chans[i].watch_clone) {
1434             markedlist[j].active = 1;
1435             markedlist[j].watch_clone = trojanscan_chans[i].watch_clone;
1436             lp->watch_clone = trojanscan_chans[i].watch_clone;
1437           }
1438           marked = 1;
1439           break;
1440         }
1441       }
1442     }
1443     if(!marked && trojanscan_chans[i].watch_clone) {
1444       channel *cp = findchannel(trojanscan_chans[i].channel->content);
1445       if(cp)
1446         localpartchannel(trojanscan_chans[i].watch_clone->clone, cp, NULL);
1447     }
1448   }
1449
1450   if(!markedlist)
1451     return;
1452
1453   for(j=0,lp=hp;j<count&&lp;j++,lp=lp->next) {
1454     if((!markedlist[j].active || !markedlist[j].watch_clone) && !lp->exempt) {
1455       channel *cp = findchannel(lp->name->content);
1456       if(cp) {
1457         int attempts = 10;
1458         do {
1459           lp->watch_clone = trojanscan_selectclone(TROJANSCAN_WATCH_CLONES);
1460           if(!lp->watch_clone)
1461             break;
1462           if(!trojanscan_nickbanned(lp->watch_clone, cp)) {
1463             if(localjoinchannel(lp->watch_clone->clone, cp))
1464               lp->watch_clone = NULL;
1465             break;
1466           }
1467         } while(--attempts > 0);
1468         if(!attempts)
1469           lp->watch_clone = NULL;
1470
1471       }
1472     }
1473   }
1474
1475   tfree(markedlist);
1476 }
1477
1478 void trojanscan_fill_channels(void *arg) {
1479   struct trojanscan_prechannels *head = NULL, *lp, *last = NULL;
1480   int i, count, tempctime = 0;
1481
1482   chanindex *chn;
1483
1484   for (count=i=0;i<trojanscan_database.total_channels;i++) {
1485     lp = (trojanscan_prechannels *)tmalloc(sizeof(trojanscan_prechannels));
1486     lp->name = trojanscan_database.channels[i].name;
1487     lp->size = 65535;
1488     lp->exempt = trojanscan_database.channels[i].exempt;
1489     lp->watch_clone = NULL;
1490     if (trojanscan_add_ll(&head, lp))
1491       count++;
1492   }
1493
1494   for (i=0;i<CHANNELHASHSIZE;i++) {
1495     for(chn=chantable[i];chn;chn=chn->next) {
1496       if (chn->channel && !IsKey(chn->channel) && !IsInviteOnly(chn->channel) && !IsRegOnly(chn->channel) && (chn->channel->users->totalusers >= trojanscan_minchansize)) {
1497         lp = (trojanscan_prechannels *)tmalloc(sizeof(trojanscan_prechannels));
1498         lp->name = chn->name;
1499         lp->size = chn->channel->users->totalusers;
1500         lp->exempt = 0;
1501         lp->watch_clone = NULL;
1502         if (trojanscan_add_ll(&head, lp))
1503           count++;
1504       }
1505     }
1506   }
1507
1508   count = TROJANSCAN_MMIN(count, trojanscan_maxchans);
1509
1510   trojanscan_watch_clone_update(head, count);
1511
1512   trojanscan_free_channels();
1513   trojanscan_chans = (struct trojanscan_inchannel *)tmalloc(count * sizeof(struct trojanscan_inchannel));
1514   memset(trojanscan_chans, 0, count * sizeof(struct trojanscan_inchannel));
1515   trojanscan_activechans = count;
1516   i = 0;
1517
1518   for(lp=head;lp;last=lp,lp=lp->next) {
1519     if (!(lp->exempt) && (i < count)) {
1520       trojanscan_chans[i].channel = getsstring(lp->name->content, lp->name->length);
1521       trojanscan_chans[i++].watch_clone = lp->watch_clone;
1522     }
1523     if (last)
1524       tfree(last);
1525   }
1526
1527   if (last)
1528     tfree(last);
1529
1530   if (trojanscan_activechans > 0) {
1531     tempctime = trojanscan_cycletime / trojanscan_activechans;
1532   } else {
1533     tempctime = 60;
1534     trojanscan_mainchanmsg("d: just escaped a divide by zero error (no activechans!), rescheduling in 60 seconds");
1535   }
1536
1537   if(trojanscan_schedule)
1538     deleteschedule(trojanscan_schedule, &trojanscan_dojoin, NULL);
1539
1540   trojanscan_channumber = 0;
1541
1542   trojanscan_schedule = schedulerecurring(time(NULL) + tempctime, trojanscan_activechans + 1, tempctime, trojanscan_dojoin, NULL);
1543
1544 }
1545
1546 void trojanscan_dojoin(void *arg) {
1547   struct trojanscan_realchannels *rc;
1548   if (trojanscan_channumber >= trojanscan_activechans) {
1549     trojanscan_schedule = NULL;
1550     trojanscan_fill_channels(NULL);
1551   } else {
1552     if ((rc = trojanscan_allocaterc(trojanscan_chans[trojanscan_channumber++].channel->content)))
1553       trojanscan_join(rc);
1554   }
1555 }
1556
1557
1558 void trojanscan_dopart(void *arg) {
1559   struct trojanscan_realchannels *rc = (struct trojanscan_realchannels *)arg, *rp, *past = NULL;
1560
1561   if (rc->kickedout) { /* there's a join scheduled, wait for it (reschedule) */
1562     rc->schedule = scheduleoneshot(time(NULL)+5, &trojanscan_dopart, (void *)rc);
1563     return;
1564   }
1565
1566   if (rc->clone->clone && (!(rc->donotpart)))
1567     localpartchannel(rc->clone->clone, rc->chan, NULL);
1568
1569   rc->clone->sitting--;
1570
1571   for(rp=trojanscan_realchanlist;rp;rp=rp->next) {
1572     if (rp == rc) {
1573       if (!past) {
1574         trojanscan_realchanlist = rp->next;
1575       } else {
1576         past->next = rp->next;
1577       }
1578       tfree(rp);
1579       break;
1580     }
1581     past = rp;
1582   }
1583
1584 }
1585
1586 void trojanscan_donickchange(void *arg) { /* just incase I choose to make this schedule at some point */
1587   struct trojanscan_clones *clone = (trojanscan_clones *)arg;
1588   if (clone && clone->clone) {
1589     char c_nick[NICKLEN+1];
1590     int loops = 0;
1591     /* PPA: unlikely to be infinite */
1592     do {
1593       if ((loops++ < 10) && trojanscan_hostmode) {
1594         trojanscan_generatenick(c_nick, NICKLEN);
1595       } else {
1596         trojanscan_gennick(c_nick, trojanscan_minmaxrand(7, TROJANSCAN_MMIN(13, NICKLEN)));
1597       }
1598     } while (c_nick[0] && (getnickbynick(c_nick) != NULL));
1599
1600     renamelocaluser(clone->clone, c_nick);
1601   }
1602
1603 }
1604
1605 int trojanscan_keysort(const void *v1, const void *v2) {
1606   return ((*(trojanscan_prechannels **)v2)->size - (*(trojanscan_prechannels **)v1)->size);
1607 }
1608
1609 int trojanscan_showcommands(void *sender, int cargc, char **cargv) {
1610   nick *np = (nick *)sender;
1611   Command *cmdlist[100];
1612   int i, n;
1613   char level = 0;
1614
1615   n = getcommandlist(trojanscan_cmds, cmdlist, 100);
1616
1617   trojanscan_reply(np, "The following commands are registered at present:");
1618
1619   for(i=0;i<n;i++) {
1620     if (cmdlist[i]->level & TROJANSCAN_ACL_STAFF) {
1621       level = 's';
1622     } else if (cmdlist[i]->level & TROJANSCAN_ACL_DEVELOPER) {
1623       level = 'd';
1624     } else if (cmdlist[i]->level & TROJANSCAN_ACL_TEAMLEADER) {
1625       level = 't';
1626     } else if (cmdlist[i]->level & TROJANSCAN_ACL_CAT) {
1627       level = 'c';
1628     } else if (cmdlist[i]->level & TROJANSCAN_ACL_WEBSITE) {
1629       level = 'w';
1630     } else if (cmdlist[i]->level & TROJANSCAN_ACL_UNAUTHED) {
1631       level = 0;
1632     }
1633     if (level) {
1634       trojanscan_reply(np, "%s (+%c)", cmdlist[i]->command->content, level);
1635     } else {
1636       trojanscan_reply(np, "%s", cmdlist[i]->command->content);
1637     }
1638   }
1639   trojanscan_reply(np, "End of list.");
1640   return CMD_OK;
1641 }
1642
1643 void trojanscan_handlemessages(nick *target, int messagetype, void **args) {
1644   Command *cmd;
1645   char *cargv[50];
1646   int cargc, templevel;
1647   nick *sender;
1648   union trojanscan_userlevel level;
1649
1650   switch(messagetype) {
1651     case LU_PRIVMSG:
1652     case LU_SECUREMSG:
1653       /* If it's a message, first arg is nick and second is message */
1654       sender = (nick *)args[0];
1655
1656       if(strncmp(TROJANSCAN_VERSION_DETECT, args[1], sizeof(TROJANSCAN_VERSION_DETECT)-1)==0) {
1657         char p = ((char *)args[1])[sizeof(TROJANSCAN_VERSION_DETECT)-1];
1658         if((p == ' ') || (p == '\0') || (p == 1)) {
1659           trojanscan_reply(sender, "\001VERSION Trojanscan (or Tigger) Newserv module version %s by Chris Porter (slug), Newserv by David Mansell (splidge). Compiled " __DATE__ " " __TIME__ ".\001", TROJANSCAN_VERSION);
1660           return;
1661         }
1662       }
1663
1664       /* Split the line into params */
1665       cargc = splitline((char *)args[1], cargv, 50, 0);
1666       if(cargc == 0 || !cargv[0])
1667         return;
1668
1669       cmd=findcommandintree(trojanscan_cmds, cargv[0], 1);
1670       if (!cmd) {
1671         trojanscan_reply(sender, "Unknown command.");
1672         return;
1673       }
1674
1675       if ((cmd->level & TROJANSCAN_ACL_OPER) && !IsOper(sender)) {
1676         trojanscan_reply(sender, "You need to be opered to use this command.");
1677         return;
1678       }
1679
1680       /* bit grim code... */
1681
1682       if (!(cmd->level & TROJANSCAN_ACL_UNAUTHED)) {
1683         if (!IsAccount(sender)) {
1684           trojanscan_reply(sender, "You must be authed with the network to access this command!");
1685           return;
1686         }
1687         templevel = trojanscan_user_level_by_authname(sender->authname);
1688
1689         if (templevel == -1) {
1690           trojanscan_reply(sender, "You do not have an account.");
1691           return;
1692         }
1693
1694         level.number = templevel;
1695
1696         if ((cmd->level & TROJANSCAN_ACL_DEVELOPER) && !TrojanscanIsDeveloper(level)) {
1697           trojanscan_reply(sender, "Access denied.");
1698           return;
1699         }
1700         if ((cmd->level & TROJANSCAN_ACL_TEAMLEADER) && !TrojanscanIsLeastTeamLeader(level)) {
1701           trojanscan_reply(sender, "Access denied.");
1702           return;
1703         }
1704         if ((cmd->level & TROJANSCAN_ACL_STAFF) && !TrojanscanIsLeastStaff(level)) {
1705           trojanscan_reply(sender, "Access denied.");
1706           return;
1707         }
1708         if ((cmd->level & TROJANSCAN_ACL_CAT) && !TrojanscanIsCat(level)) {
1709           trojanscan_reply(sender, "Access denied.");
1710           return;
1711         }
1712         if ((cmd->level & TROJANSCAN_ACL_WEBSITE) && !TrojanscanIsLeastWebsite(level)) {
1713           trojanscan_reply(sender, "Access denied.");
1714           return;
1715         }
1716       }
1717
1718       /* Check the maxargs */
1719       if (cmd->maxparams<(cargc-1)) {
1720         /* We need to do some rejoining */
1721         rejoinline(cargv[cmd->maxparams], cargc-(cmd->maxparams));
1722         cargc = (cmd->maxparams) + 1;
1723       }
1724
1725       (cmd->handler)((void *)sender, cargc - 1, &(cargv[1]));
1726       break;
1727
1728     case LU_KILLED:
1729       /* someone killed me?  Bastards */
1730       trojanscan_connect_nick_schedule = scheduleoneshot(time(NULL) + 1, &trojanscan_connect_nick, NULL);
1731       trojanscan_nick = NULL;
1732       break;
1733
1734     default:
1735       break;
1736   }
1737 }
1738
1739 static char trojanscan_getmtfromhooktype(int input) {
1740   switch(input) {
1741     case HOOK_CHANNEL_PART: return 'P';
1742     default:                return '?';
1743   }
1744 }
1745
1746 char trojanscan_getmtfrommessagetype(int input) {
1747   switch(input) {
1748     case LU_PRIVMSG:    return 'm';
1749     case LU_PRIVNOTICE: return 'n';
1750     case LU_SECUREMSG:  return 's';
1751     case LU_CHANMSG:    return 'M';
1752     case LU_CHANNOTICE: return 'N';
1753     default:            return '?';
1754   }
1755 }
1756
1757 static void trojanscan_process(nick *sender, channel *cp, char mt, char *pretext) {
1758   char text[513];
1759   unsigned int len;
1760   unsigned int i;
1761   struct trojanscan_worms *worm;
1762   int vector[30], detected = 0;
1763
1764   trojanscan_strip_codes(text, sizeof(text) - 1, pretext);
1765
1766   len = strlen(text);
1767
1768   for(i=0;i<trojanscan_database.total_phrases;i++) {
1769     if (
1770          (
1771            (worm = trojanscan_database.phrases[i].worm)
1772          ) &&
1773          (
1774            (
1775              (
1776                (mt == 'm') || (mt == 's') || (mt == 'n')
1777              ) &&
1778              (
1779                (trojanscan_database.phrases[i].worm->hitpriv)
1780              )
1781            ) ||
1782            (
1783              (
1784                (mt == 'M') || (mt == 'N') || (mt == 'P')
1785              ) &&
1786              (
1787                (trojanscan_database.phrases[i].worm->hitchans)
1788              )
1789            )
1790          ) &&
1791          (trojanscan_database.phrases[i].phrase)
1792        ) {
1793       int pre = pcre_exec(trojanscan_database.phrases[i].phrase, trojanscan_database.phrases[i].hint, text, len, 0, 0, vector, 30);
1794       if(pre >= 0) {
1795         char matchbuf[513];
1796         matchbuf[0] = 0;
1797         matchbuf[512] = 0; /* hmm */
1798
1799         if(pre > 1)
1800           if(pcre_copy_substring(text, vector, pre, 1, matchbuf, sizeof(matchbuf) - 1) <= 0)
1801             matchbuf[0] = 0;
1802
1803         trojanscan_phrasematch(cp, sender, &trojanscan_database.phrases[i], mt, matchbuf);
1804
1805         detected = 1;
1806         break;
1807       }
1808     }
1809   }
1810   if (!detected && (mt != 'N') && (mt != 'M')) {
1811     char etext[TROJANSCAN_QUERY_TEMP_BUF_SIZE], enick[TROJANSCAN_QUERY_TEMP_BUF_SIZE], eident[TROJANSCAN_QUERY_TEMP_BUF_SIZE], ehost[TROJANSCAN_QUERY_TEMP_BUF_SIZE];
1812     trojanscan_database_escape_string(etext, text, len);
1813     trojanscan_database_escape_string(enick, sender->nick, strlen(sender->nick));
1814     trojanscan_database_escape_string(eident, sender->ident, strlen(sender->ident));
1815     trojanscan_database_escape_string(ehost, sender->host->name->content, sender->host->name->length);
1816     trojanscan_database_query("INSERT INTO unknownlog (data, user) VALUES ('%s','%s!%s@%s')", etext, enick, eident, ehost);
1817   }
1818 }
1819
1820 void trojanscan_clonehandlemessages(nick *target, int messagetype, void **args) {
1821   char *pretext = NULL;
1822   nick *sender;
1823   struct trojanscan_realchannels *rp;
1824   struct trojanscan_rejoinlist *rj;
1825   char mt = trojanscan_getmtfrommessagetype(messagetype);
1826   char *channel_name;
1827   channel *cp = NULL;
1828   int i;
1829
1830   switch(messagetype) {
1831     case LU_PRIVMSG:
1832     case LU_SECUREMSG:
1833     case LU_PRIVNOTICE:
1834
1835     pretext = (char *)args[1];
1836
1837     case LU_CHANMSG:
1838     case LU_CHANNOTICE:
1839       sender = (nick *)args[0];
1840
1841       if (strlen(sender->nick) < 2)
1842         break;
1843
1844       if (!pretext) {
1845         pretext = (char *)args[2];
1846         cp = args[1];
1847       }
1848
1849       if(strncmp(TROJANSCAN_VERSION_DETECT, pretext, sizeof(TROJANSCAN_VERSION_DETECT)-1)==0) {
1850         char p = pretext[sizeof(TROJANSCAN_VERSION_DETECT)-1];
1851         if((p == ' ') || (p == '\0') || (p == 1)) {
1852           int staff = 0;
1853           if (IsOper(sender)) {
1854             staff = 1;
1855           } else {
1856             if (IsAccount(sender)) {
1857               int templevel = trojanscan_user_level_by_authname(sender->authname);
1858               if (templevel != -1) {
1859                 union trojanscan_userlevel level;
1860                 level.number = templevel;
1861                 if (TrojanscanIsLeastStaff(level))
1862                   staff = 1;
1863               }
1864             }
1865           }
1866           if (staff) {
1867             if(trojanscan_nick) {
1868               sendnoticetouser(target, sender, "\001VERSION T clone, check T for confirmation.\001");
1869               sendnoticetouser(trojanscan_nick, sender, "\001VERSION %s is part of my swarm.\001", target->nick);
1870             } else {
1871               sendnoticetouser(target, sender, "\001VERSION T clone, though since T is currently gone you'll have to version me again in a minute for confirmation.\001");
1872             }
1873           } else {
1874             sendnoticetouser(target, sender,  "\001VERSION %s\001", versionreply);
1875           }
1876
1877           return;
1878         }
1879       }
1880
1881       trojanscan_process(sender, cp, mt, pretext);
1882       break;
1883     case LU_KILLED:
1884       /* someone killed me?  Bastards */
1885
1886       /* PPA: we do NOT rejoin channels at this moment in time, it is possible to do this though */
1887       for (i=0;i<TROJANSCAN_CLONE_TOTAL;i++) {
1888         if (trojanscan_swarm[i].clone == target) {
1889
1890           scheduleoneshot(time(NULL)+1, &trojanscan_generateclone, (void *)((long)i));
1891           if(i >= TROJANSCAN_CLONE_MAX) {
1892             int j;
1893             for(j=0;j<trojanscan_activechans;j++)
1894               if(trojanscan_chans[j].watch_clone == &trojanscan_swarm[i])
1895                 trojanscan_chans[j].watch_clone = NULL;
1896           } else {
1897             for(rp=trojanscan_realchanlist;rp;rp=rp->next)
1898               if ((rp->clone == &(trojanscan_swarm[i])))
1899                 rp->donotpart = 1;
1900           }
1901           derefnode(iptree, trojanscan_swarm[i].fakeipnode);
1902           trojanscan_swarm[i].clone = NULL;
1903           trojanscan_swarm[i].remaining = 0; /* bah */
1904           break;
1905         }
1906       }
1907       break;
1908
1909     case LU_KICKED:
1910       channel_name = ((channel *)args[1])->index->name->content;
1911       for (i=0;i<trojanscan_activechans;i++) {
1912         if (!trojanscan_chans[i].watch_clone)
1913           continue;
1914         if ((trojanscan_chans[i].watch_clone->clone == target) && (!strcmp(trojanscan_chans[i].channel->content, channel_name)))
1915           break;
1916       }
1917       if(i != trojanscan_activechans) {
1918         int j;
1919         for(j=0;j<TROJANSCAN_CLONE_TOTAL;j++) {
1920           if(&trojanscan_swarm[j] == trojanscan_chans[i].watch_clone) {
1921             trojanscan_chans[i].watch_clone = NULL;
1922             break;
1923           }
1924         }
1925       } else {
1926       /*
1927         trojanscan_mainchanmsg("k: %s on %s by %s", target->nick, ((channel *)args[1])->index->name->content, (((nick *)args[0])->nick)?(((nick *)args[0])->nick):"(server)");
1928       */
1929         rj = (struct trojanscan_rejoinlist *)tmalloc(sizeof(struct trojanscan_rejoinlist));
1930         if (rj) {
1931           rj->rp = NULL;
1932           for(rp=trojanscan_realchanlist;rp;rp=rp->next)
1933                if ((rp->clone->clone == target) && (rp->chan == args[1])) {
1934                 rp->kickedout++;
1935                 rj->rp = rp;
1936                 break;
1937               }
1938             if(!rj->rp) {
1939               tfree(rj);
1940               return;
1941             }
1942
1943             rj->channel = getsstring(((channel *)args[1])->index->name->content, ((channel *)args[1])->index->name->length);
1944             if(!rj->channel) {
1945               trojanscan_mainchanmsg("d: unable to allocate memory for channel: %s upon rejoin", ((channel *)args[1])->index->name->content);
1946               tfree(rj);
1947               return;
1948             }
1949
1950             rj->clone = rp->clone;
1951             rj->next = trojanscan_schedulerejoins;
1952             trojanscan_schedulerejoins = rj;
1953
1954             rj->schedule = scheduleoneshot(time(NULL)+1, &trojanscan_rejoin_channel, (void *)rj);
1955           }
1956         }
1957         break;
1958     default:
1959       break;
1960   }
1961 }
1962
1963 static void trojanscan_part_watch(int hook, void *arg) {
1964   void **arglist = (void **)arg;
1965   channel *cp = (channel *)arglist[0];
1966   nick *np = arglist[1];
1967   char *reason = arglist[2];
1968
1969   if(!cp || !np || !reason || (*reason == '\0'))
1970     return;
1971
1972   trojanscan_process(np, cp, trojanscan_getmtfromhooktype(hook), reason);
1973 }
1974
1975 static int trojanscan_hostcount(nick *sender, int hostmode, char *mask, int masklen) {
1976   int usercount = 0, j;
1977   nick *np = NULL; /* sigh at warnings */
1978
1979   if(hostmode)
1980     for (j=0;j<NICKHASHSIZE;j++)
1981       for (np=nicktable[j];np;np=np->next)
1982         if (np->ipnode==sender->ipnode)
1983           usercount++;
1984
1985   if(usercount > TROJANSCAN_MAX_HOST_GLINE) {
1986     hostmode = 0;
1987     usercount = 0;
1988   }
1989
1990   if(!hostmode)
1991     for (j=0;j<NICKHASHSIZE;j++)
1992       for (np=nicktable[j];np;np=np->next)
1993         if (np->ipnode==sender->ipnode && !ircd_strcmp(np->ident, sender->ident))
1994           usercount++;
1995
1996   if(mask)
1997     snprintf(mask, masklen, "%s@%s", hostmode?"*":sender->ident, IPtostr(sender->p_ipaddr));
1998
1999   return usercount;
2000 }
2001
2002 void trojanscan_phrasematch(channel *chp, nick *sender, trojanscan_phrases *phrase, char messagetype, char *matchbuf) {
2003   char glinemask[HOSTLEN + USERLEN + NICKLEN + 4], enick[TROJANSCAN_QUERY_TEMP_BUF_SIZE], eident[TROJANSCAN_QUERY_TEMP_BUF_SIZE], ehost[TROJANSCAN_QUERY_TEMP_BUF_SIZE];
2004   unsigned int frequency;
2005   int glining = 0, usercount;
2006   struct trojanscan_worms *worm = phrase->worm;
2007
2008   trojanscan_database.detections++;
2009
2010   usercount = 0;
2011   if (worm->monitor) {
2012     usercount = -1;
2013   } else if(worm->glinehost || worm->glineuser) {
2014     glining = 1;
2015
2016     usercount = trojanscan_hostcount(sender, worm->glinehost, glinemask, sizeof(glinemask));
2017   }
2018
2019   if (!usercount) {
2020     trojanscan_mainchanmsg("w: user %s!%s@%s triggered infection monitor, yet no hosts found at stage 2 -- worm: %s", sender->nick, sender->ident, sender->host->name->content, worm->name->content);
2021     return;
2022   }
2023
2024   if (glining && (usercount > trojanscan_maxusers)) {
2025     trojanscan_mainchanmsg("w: not glining %s!%s@%s due to too many users (%d) with mask: *!%s -- worm: %s)", sender->nick, sender->ident, sender->host->name->content, usercount, glinemask, worm->name->content);
2026     return;
2027   }
2028
2029   if (glining && !worm->datalen) {
2030     trojanscan_mainchanmsg("w: not glining %s!%s@%s due to too lack of removal data with mask: *!%s (%d users) -- worm: %s)", sender->nick, sender->ident, sender->host->name->content, glinemask, usercount, worm->name->content);
2031     return;
2032   }
2033
2034   trojanscan_database_escape_string(enick, sender->nick, strlen(sender->nick));
2035   trojanscan_database_escape_string(eident, sender->ident, strlen(sender->ident));
2036   trojanscan_database_escape_string(ehost, sender->host->name->content, sender->host->name->length);
2037
2038   frequency = 1;
2039
2040   if (!(trojanscan_database_query("SELECT COUNT(*) FROM hits WHERE glined = %d AND host = '%s'", glining, ehost))) {
2041     trojanscan_database_res *res;
2042     if ((res = trojanscan_database_store_result(&trojanscan_sql))) {
2043       trojanscan_database_row sqlrow;
2044       if ((trojanscan_database_num_rows(res) > 0) && (sqlrow = trojanscan_database_fetch_row(res)))
2045         frequency = atoi(sqlrow[0]) + 1;
2046       trojanscan_database_free_result(res);
2047     }
2048   }
2049
2050   if (!glining) {
2051     trojanscan_mainchanmsg("m: t: %c u: %s!%s@%s%s%s w: %s p: %d %s%s", messagetype, sender->nick, sender->ident, sender->host->name->content, messagetype=='N'||messagetype=='M'||messagetype=='P'?" #: ":"", messagetype=='N'||messagetype=='M'||messagetype=='P'?chp->index->name->content:"", worm->name->content, phrase->id, matchbuf[0]?" --: ":"", matchbuf[0]?matchbuf:"");
2052 #ifdef TROJANSCAN_PEONCHANNEL
2053     trojanscan_peonchanmsg("m: t: %c u: %s!%s@%s%s%s%s w: %s %s%s", messagetype, sender->nick, sender->ident, (IsHideHost(sender)&&IsAccount(sender))?sender->authname:sender->host->name->content, (IsHideHost(sender)&&IsAccount(sender))?"."HIS_HIDDENHOST:"", messagetype=='N'||messagetype=='M'||messagetype=='P'?" #: ":"", messagetype=='N'||messagetype=='M'||messagetype=='P'?chp->index->name->content:"", worm->name->content, matchbuf[0]?" --: ":"", matchbuf[0]?matchbuf:"");
2054 #endif
2055   } else {
2056     int glinetime = TROJANSCAN_FIRST_OFFENSE * frequency * (worm->epidemic?TROJANSCAN_EPIDEMIC_MULTIPLIER:1);
2057     if(glinetime > 7 * 24)
2058       glinetime = 7 * 24; /* can't set glines over 7 days with normal non U:lined glines */
2059
2060     trojanscan_database_query("INSERT INTO hits (nickname, ident, host, phrase, messagetype, glined) VALUES ('%s', '%s', '%s', %d, '%c', %d)", enick, eident, ehost, phrase->id, messagetype, glining);
2061     trojanscan_database.glines++;
2062
2063     irc_send("%s GL * +%s %d :You (%s!%s@%s) are infected with a trojan (%s/%d), see %s%d for details - banned for %d hours\r\n", mynumeric->content, glinemask, glinetime * 3600, sender->nick, sender->ident, sender->host->name->content, worm->name->content, phrase->id, TROJANSCAN_URL_PREFIX, worm->id, glinetime);
2064
2065     trojanscan_mainchanmsg("g: *!%s t: %c u: %s!%s@%s%s%s c: %d w: %s%s p: %d f: %d", glinemask, messagetype, sender->nick, sender->ident, sender->host->name->content, messagetype=='N'||messagetype=='M'||messagetype=='P'?" #: ":"", messagetype=='N'||messagetype=='M'||messagetype=='P'?chp->index->name->content:"", usercount, worm->name->content, worm->epidemic?"(E)":"", phrase->id, frequency);
2066   }
2067 }
2068
2069 void trojanscan_rejoin_channel(void *arg) {
2070   struct trojanscan_rejoinlist *rj2, *lrj, *rj = (struct trojanscan_rejoinlist *)arg;
2071
2072   channel *cp = findchannel(rj->channel->content);
2073   freesstring(rj->channel);
2074
2075   if (rj->rp) {
2076     rj->rp->kickedout--;
2077     if (!cp) {
2078       rj->rp->donotpart = 1; /* we were the last user on the channel, so we need to be VERY careful freeing it */
2079     } else {
2080       if(!rj->rp->donotpart && !rj->rp->kickedout) { /* check we're allowed to join channels (not killed), and we're the last one to join */
2081         if (trojanscan_nickbanned(rj->clone, cp)) {
2082           rj->rp->donotpart = 1;
2083         } else {
2084           localjoinchannel(rj->clone->clone, cp);
2085         }
2086       }
2087     }
2088   }
2089
2090   rj2 = trojanscan_schedulerejoins;
2091   lrj = NULL;
2092
2093   if (rj2 == rj) {
2094     trojanscan_schedulerejoins = rj->next;
2095     tfree(rj);
2096   } else {
2097     for(rj2=trojanscan_schedulerejoins;rj2;lrj=rj2,rj2=rj2->next) {
2098       if (rj2 == rj) {
2099         lrj->next = rj2->next;
2100         tfree(rj);
2101         break;
2102       }
2103     }
2104   }
2105
2106 }
2107
2108 void trojanscan_reply(nick *target, char *message, ... ) {
2109   char buf[513];
2110   va_list va;
2111
2112   if (!trojanscan_nick)
2113     return;
2114
2115   va_start(va, message);
2116   vsnprintf(buf, sizeof(buf) - 1, message, va);
2117   va_end(va);
2118
2119   sendnoticetouser(trojanscan_nick, target, "%s", buf);
2120 }
2121
2122
2123 void trojanscan_mainchanmsg(char *message, ...) {
2124   char buf[513];
2125   va_list va;
2126   channel *cp;
2127
2128   if (!trojanscan_nick)
2129     return;
2130   if (!(cp = findchannel(TROJANSCAN_CHANNEL)))
2131     return;
2132
2133   va_start(va, message);
2134   vsnprintf(buf, sizeof(buf) - 1, message, va);
2135   va_end(va);
2136
2137   sendmessagetochannel(trojanscan_nick, cp, "%s", buf);
2138 }
2139
2140 #ifdef TROJANSCAN_PEONCHANNEL
2141 void trojanscan_peonchanmsg(char *message, ...) {
2142   char buf[513];
2143   va_list va;
2144   channel *cp;
2145
2146   if (!trojanscan_nick)
2147     return;
2148   if (!(cp = findchannel(TROJANSCAN_PEONCHANNEL)))
2149     return;
2150
2151   va_start(va, message);
2152   vsnprintf(buf, sizeof(buf) - 1, message, va);
2153   va_end(va);
2154
2155   sendmessagetochannel(trojanscan_nick, cp, "%s", buf);
2156 }
2157 #endif
2158
2159 int trojanscan_minmaxrand(float min, float max) {
2160   return (int)((max-min+1)*rand()/(RAND_MAX+min))+min;
2161 }
2162
2163 char *trojanscan_iptostr(char *buf, int buflen, unsigned int ip) {
2164   snprintf(buf, buflen, "%d.%d.%d.%d", ip >> 24, (ip >> 16) & 255, (ip >> 8) & 255, ip & 255);
2165   return buf;
2166 }
2167
2168 char trojanscan_genchar(int ty) {
2169   /* hostname and realname characters*/
2170   if (!ty) {
2171     if (!(trojanscan_minmaxrand(0, 40) % 10)) {
2172       return trojanscan_minmaxrand(48, 57);
2173     } else {
2174       return trojanscan_minmaxrand(97, 122);
2175     }
2176   /* ident characters - without numbers*/
2177   } else if (ty == 1) {
2178     return trojanscan_minmaxrand(97, 122);
2179   /* ident characters - with numbers*/
2180   } else if (ty == 2) {
2181     ty = trojanscan_minmaxrand(97, 125);
2182     if (ty > 122) return trojanscan_minmaxrand(48, 57);
2183     return ty;
2184   /* nick characters - with and without numbers*/
2185   } else if (ty == 3 || ty == 4) {
2186     if (!(trojanscan_minmaxrand(0, 59) % 16)) {
2187       char weirdos[6] = { '\\', '|', '[', '{', ']', '}' };
2188       return weirdos[trojanscan_minmaxrand(0, 5)];
2189     }
2190     if (ty == 4) {
2191       ty = trojanscan_minmaxrand(65, 93);
2192       if (ty > 90) return trojanscan_minmaxrand(48, 57);
2193     } else {
2194       ty = trojanscan_minmaxrand(65, 90);
2195     }
2196     if (!(trojanscan_minmaxrand(0, 40) % 8)) return ty;
2197     return ty + 32;
2198   /* moron check */
2199   } else {
2200     return ' ';
2201   }
2202 }
2203
2204 void trojanscan_gennick(char *ptc, char size) {
2205   int i;
2206   for (i=0;i<size;i++) {
2207     if (i == 0) {
2208       ptc[i] = trojanscan_genchar(3);
2209     } else {
2210       ptc[i] = trojanscan_genchar(4);
2211     }
2212   }
2213   ptc[i] = '\0';
2214 }
2215
2216 void trojanscan_genident(char *ptc, char size) {
2217   int i;
2218   for (i=0;i<size;i++) {
2219     if (i == 0) {
2220       ptc[i] = trojanscan_genchar(1);
2221     } else {
2222       ptc[i] = trojanscan_genchar(2);
2223     }
2224   }
2225   ptc[i] = '\0';
2226 }
2227
2228 void trojanscan_genhost(char *ptc, char size, patricia_node_t **fakeipnode) {
2229   int dots = trojanscan_minmaxrand(2, 5), i, dotexist = 0, cur;
2230   struct irc_in_addr ipaddress;
2231
2232   while (!dotexist) {
2233     for (i=0;i<size;i++) {
2234       ptc[i] = trojanscan_genchar(0);
2235       if ((i > 5) && (i < (size-4))) {
2236         if ((ptc[i-1] != '.') && (ptc[i-1] != '-')) {
2237           cur = trojanscan_minmaxrand(1,size / dots);
2238           if (cur < 3) {
2239             if (cur == 1) {
2240               ptc[i] = '.';
2241               dotexist = 1;
2242             } else {
2243               ptc[i] = '-';
2244             }
2245           }
2246         }
2247       }
2248     }
2249   }
2250   ptc[i] = '\0';
2251
2252   memset(&ipaddress, 0, sizeof(ipaddress));
2253   ((unsigned short *)(ipaddress.in6_16))[5] = 65535;
2254   ((unsigned short *)(ipaddress.in6_16))[6] = trojanscan_minmaxrand(0, 65535);
2255   ((unsigned short *)(ipaddress.in6_16))[7] = trojanscan_minmaxrand(0, 65535);
2256
2257   *fakeipnode = refnode(iptree, &ipaddress, PATRICIA_MAXBITS);
2258 }
2259
2260 void trojanscan_genreal(char *ptc, char size) {
2261   int spaces = trojanscan_minmaxrand(2, 4), i;
2262   for (i=0;i<size;i++) {
2263     ptc[i] = trojanscan_genchar(0);
2264     if ((i > 5) && (i < (size-4))) {
2265       if (ptc[i-1] != ' ') {
2266         if (trojanscan_minmaxrand(1,size / spaces) == 1) ptc[i] = ' ';
2267       }
2268     }
2269   }
2270   ptc[i] = '\0';
2271 }
2272
2273 int trojanscan_is_not_octet(char *begin, int length) {
2274   int i;
2275   if(length > 3)
2276     return 0;
2277   for(i=0;i<length;i++) {
2278     if (!((*begin >= '0') && (*begin <= '9')))
2279       return 0;
2280     begin++;
2281   }
2282   return 1;
2283 }
2284
2285 int trojanscan_generatepool(void) {
2286   int i, k = 0, j = 0, loops = 0;
2287   char *p, *pp;
2288   nick *np;
2289
2290   for (i=0;i<NICKHASHSIZE;i++)
2291     for (np=nicktable[i];np;np=np->next)
2292       j++;
2293
2294   if(j < trojanscan_min_hosts)
2295     return 0;
2296
2297   if(TROJANSCAN_HOST_MODE == TROJANSCAN_STEAL_HOST)
2298     return TROJANSCAN_MINPOOLSIZE;
2299
2300   i = 0;
2301   do {
2302     for (j=trojanscan_minmaxrand(0, NICKHASHSIZE-1);j<NICKHASHSIZE;j++) {
2303       if (nicktable[j]) {
2304         for(p=nicktable[j]->host->name->content, pp=p;*p;) {
2305           if (*++p == '.') {
2306             if (!trojanscan_is_not_octet(pp, p-pp)) {
2307               if (i < TROJANSCAN_POOLSIZE) {
2308                 if (i < trojanscan_hostpoolsize)
2309                   freesstring(trojanscan_hostpool[i]);
2310                 trojanscan_hostpool[i] = getsstring(pp, p-pp);
2311                 i++;
2312               } else {
2313                 if (k >= TROJANSCAN_POOLSIZE)
2314                  break;
2315               }
2316             }
2317             pp=++p;
2318           }
2319         }
2320         if (!trojanscan_is_not_octet(pp, p-pp)) {
2321           if (k < TROJANSCAN_POOLSIZE) {
2322             if (k < trojanscan_tailpoolsize)
2323               freesstring(trojanscan_tailpool[k]);
2324             trojanscan_tailpool[k] = getsstring(pp, p-pp);
2325             k++;
2326           } else {
2327             if (i >= TROJANSCAN_POOLSIZE)
2328               break;
2329           }
2330         }
2331       }
2332     }
2333     loops++;
2334   } while ((loops < 5) && ((i < TROJANSCAN_POOLSIZE) || (k < TROJANSCAN_POOLSIZE)));
2335
2336   trojanscan_hostpoolsize = i;
2337   trojanscan_tailpoolsize = k;
2338   return i;
2339 }
2340
2341 nick *trojanscan_selectuser(void) {
2342   int target = trojanscan_minmaxrand(0, 500), loops = 150, j;
2343   nick *np;
2344   do {
2345     for (j=trojanscan_minmaxrand(0, NICKHASHSIZE-1);j<NICKHASHSIZE;j++)
2346       for(np=nicktable[j];np;np=np->next)
2347         if (!--target)
2348           return np;
2349   } while(--loops > 0);
2350   return NULL;
2351 }
2352
2353 host *trojanscan_selecthost(void) {
2354   int target = trojanscan_minmaxrand(0, 500), loops = 150, j;
2355   host *hp;
2356   do {
2357     for (j=trojanscan_minmaxrand(0, HOSTHASHSIZE-1);j<HOSTHASHSIZE;j++)
2358       for(hp=hosttable[j];hp;hp=hp->next)
2359         if (!--target)
2360           return hp;
2361   } while(--loops > 0);
2362
2363   return NULL;
2364 }
2365
2366 void trojanscan_generatehost(char *buf, int maxsize, patricia_node_t **fakeip) {
2367   struct irc_in_addr ipaddress;
2368
2369   if(TROJANSCAN_HOST_MODE == TROJANSCAN_STEAL_HOST) {
2370     host *hp;
2371     int loops = 20;
2372
2373     buf[0] = '\0';
2374
2375     do {
2376       hp = trojanscan_selecthost();
2377       if(hp && (hp->clonecount <= TROJANSCAN_MAX_CLONE_COUNT) && !trojanscan_isip(hp->name->content)) {
2378         strlcpy(buf, hp->name->content, maxsize + 1);
2379         if(hp->nicks) {
2380           *fakeip = hp->nicks->ipnode;
2381           patricia_ref_prefix(hp->nicks->ipnode->prefix);
2382         } else {
2383           memset(&ipaddress, 0, sizeof(ipaddress));
2384           ((unsigned short *)(ipaddress.in6_16))[5] = 65535;
2385           ((unsigned short *)(ipaddress.in6_16))[6] = trojanscan_minmaxrand(0, 65535);
2386           ((unsigned short *)(ipaddress.in6_16))[7] = trojanscan_minmaxrand(0, 65535);
2387
2388           *fakeip = refnode(iptree, &ipaddress, PATRICIA_MAXBITS);
2389         }
2390         break;
2391       }
2392     } while(--loops > 0);
2393   } else {
2394     char *cpos;
2395     int pieces = trojanscan_minmaxrand(2, 4), totallen = 0, a = 0, i;
2396     int *choices = tmalloc(sizeof(int) * (pieces + 1));
2397     int *lengths = tmalloc(sizeof(int) * (pieces + 1));
2398
2399     choices[pieces] = trojanscan_minmaxrand(0, trojanscan_tailpoolsize-1);
2400     lengths[pieces] = strlen(trojanscan_tailpool[choices[pieces]]->content) + 1;
2401     totallen += lengths[pieces];
2402
2403     for (i=0;i<pieces;i++) {
2404       choices[i] = trojanscan_minmaxrand(0, trojanscan_hostpoolsize-1);
2405       lengths[i] = strlen(trojanscan_hostpool[choices[i]]->content) + 1;
2406       if (totallen+lengths[i] > maxsize) {
2407         choices[i] = choices[pieces];
2408         lengths[i] = lengths[pieces];
2409         pieces-=(pieces-i);
2410         break;
2411       }
2412       totallen += lengths[i];
2413     }
2414
2415     for (i=0;i<pieces;i++) {
2416       for (cpos=trojanscan_hostpool[choices[i]]->content; *cpos;)
2417         buf[a++] = *cpos++;
2418       buf[a++] = '.';
2419     }
2420
2421     for (cpos=trojanscan_tailpool[choices[i]]->content; *cpos;) {
2422       buf[a++] = *cpos++;
2423     }
2424
2425     buf[a] = '\0';
2426     tfree(choices);
2427     tfree(lengths);
2428
2429     memset(&ipaddress, 0, sizeof(ipaddress));
2430     ((unsigned short *)(ipaddress.in6_16))[5] = 65535;
2431     ((unsigned short *)(ipaddress.in6_16))[6] = trojanscan_minmaxrand(0, 65535);
2432     ((unsigned short *)(ipaddress.in6_16))[7] = trojanscan_minmaxrand(0, 65535);
2433
2434     *fakeip = refnode(iptree, &ipaddress, PATRICIA_MAXBITS);
2435   }
2436 }
2437
2438 void trojanscan_generatenick(char *buf, int maxsize) {
2439   int bits = trojanscan_minmaxrand(2, 3), loops = 0, wanttocopy, len = 0, i, d = 0, newmaxsize = maxsize - trojanscan_minmaxrand(0, 7);
2440   nick *np;
2441
2442   if(newmaxsize > 2)
2443     maxsize = newmaxsize;
2444
2445   do {
2446     np = trojanscan_selectuser();
2447     if(np) {
2448       wanttocopy = trojanscan_minmaxrand(1, (strlen(np->nick) / 2) + 3);
2449       for(i=0;((i<wanttocopy) && (len<maxsize));i++)
2450         buf[len++] = np->nick[i];
2451       if(++d > bits) {
2452         buf[len] = '\0';
2453         return;
2454       }
2455     }
2456   } while (++loops < 10);
2457   buf[0] = '\0';
2458 }
2459
2460 void trojanscan_generateident(char *buf, int maxsize) {
2461   nick *np = trojanscan_selectuser();
2462   buf[0] = '\0';
2463   if(np)
2464     strlcpy(buf, np->ident, maxsize + 1);
2465 }
2466
2467 void trojanscan_generaterealname(char *buf, int maxsize) {
2468   nick *np = trojanscan_selectuser();
2469   buf[0] = '\0';
2470   if(np)
2471     strlcpy(buf, np->realname->name->content, maxsize + 1);
2472 }
2473
2474 void trojanscan_database_close(void) {
2475   mysql_close(&trojanscan_sql);
2476 }
2477
2478 int trojanscan_database_connect(char *dbhost, char *dbuser, char *dbpass, char *db, unsigned int port) {
2479   mysql_init(&trojanscan_sql);
2480   if (!mysql_real_connect(&trojanscan_sql, dbhost, dbuser, dbpass, db, port, NULL, 0))
2481     return -1;
2482   return 0;
2483 }
2484
2485 void trojanscan_database_escape_string(char *dest, char *source, size_t length) {
2486   mysql_escape_string(dest, source, length);
2487 }
2488
2489 int trojanscan_database_query(char *format, ...) {
2490   char trojanscan_sqlquery[TROJANSCAN_QUERY_BUF_SIZE];
2491   va_list va;
2492
2493   va_start(va, format);
2494   vsnprintf(trojanscan_sqlquery, sizeof(trojanscan_sqlquery) - 1, format, va);
2495   va_end(va);
2496   return mysql_query(&trojanscan_sql, trojanscan_sqlquery);
2497 }
2498
2499 int trojanscan_database_num_rows(trojanscan_database_res *res) {
2500   return mysql_num_rows(res);
2501 }
2502
2503 trojanscan_database_res *trojanscan_database_store_result() {
2504   return mysql_store_result(&trojanscan_sql);
2505 }
2506
2507 trojanscan_database_row trojanscan_database_fetch_row(trojanscan_database_res *res) {
2508   return mysql_fetch_row(res);
2509 }
2510
2511 void trojanscan_database_free_result(trojanscan_database_res *res) {
2512   mysql_free_result(res);
2513 }
2514
2515 int trojanscan_isip(char *host) {
2516   char *p = host, components = 0, length = 0;
2517
2518   for(;*p;p++) {
2519     if(*p == '.') {
2520       if(((!length) || (length = 0)) || (++components > 3))
2521         return 0;
2522     } else {
2523       if ((++length > 3) || !isdigit(*p))
2524         return 0;
2525     }
2526   }
2527   return components == 3;
2528 }
2529