[irc/rqf/shadowircd.git] / modules / m_oper.c

/*
 *  ircd-ratbox: A slightly useful ircd.
 *  m_oper.c: Makes a user an IRC Operator.
 *
 *  Copyright (C) 1990 Jarkko Oikarinen and University of Oulu, Co Center
 *  Copyright (C) 1996-2002 Hybrid Development Team
 *  Copyright (C) 2002-2005 ircd-ratbox development team
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2 of the License, or
 *  (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License
 *  along with this program; if not, write to the Free Software
 *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307
 *  USA
 *
 *  $Id: m_oper.c 1483 2006-05-27 18:58:12Z jilles $
 */

#include "stdinc.h"
#include "client.h"
#include "common.h"
#include "match.h"
#include "ircd.h"
#include "numeric.h"
#include "s_conf.h"
#include "s_newconf.h"
#include "logger.h"
#include "s_user.h"
#include "send.h"
#include "msg.h"
#include "parse.h"
#include "modules.h"
#include "packet.h"
#include "cache.h"

static int m_oper(struct Client *, struct Client *, int, const char **);

struct Message oper_msgtab = {
	"OPER", 0, 0, 0, MFLG_SLOW,
	{mg_unreg, {m_oper, 3}, mg_ignore, mg_ignore, mg_ignore, {m_oper, 3}}
};

mapi_clist_av1 oper_clist[] = { &oper_msgtab, NULL };
DECLARE_MODULE_AV1(oper, NULL, NULL, oper_clist, NULL, NULL, "$Revision: 1483 $");

static int match_oper_password(const char *password, struct oper_conf *oper_p);

/*
 * m_oper
 *      parv[1] = oper name
 *      parv[2] = oper password
 */
static int
m_oper(struct Client *client_p, struct Client *source_p, int parc, const char *parv[])
{
	struct oper_conf *oper_p;
	const char *name;
	const char *password;

	name = parv[1];
	password = parv[2];

	if(IsOper(source_p))
	{
		sendto_one(source_p, form_str(RPL_YOUREOPER), me.name, source_p->name);
		send_oper_motd(source_p);
		return 0;
	}

	/* end the grace period */
	if(!IsFloodDone(source_p))
		flood_endgrace(source_p);

	oper_p = find_oper_conf(source_p->username, source_p->orighost, 
				source_p->sockhost, name);

	if(oper_p == NULL)
	{
		sendto_one_numeric(source_p, ERR_NOOPERHOST, form_str(ERR_NOOPERHOST));
		ilog(L_FOPER, "FAILED OPER (%s) by (%s!%s@%s) (%s)",
		     name, source_p->name,
		     source_p->username, source_p->host, source_p->sockhost);

		if(ConfigFileEntry.failed_oper_notice)
		{
			sendto_realops_snomask(SNO_GENERAL, L_NETWIDE,
					     "Failed OPER attempt - host mismatch by %s (%s@%s)",
					     source_p->name, source_p->username, source_p->host);
		}

		return 0;
	}

	if(IsOperConfNeedSSL(oper_p) && !IsSSLClient(source_p))
	{
		sendto_one_numeric(source_p, ERR_NOOPERHOST, form_str(ERR_NOOPERHOST));
		ilog(L_FOPER, "FAILED OPER (%s) by (%s!%s@%s) (%s) -- requires SSL/TLS",
		     name, source_p->name,
		     source_p->username, source_p->host, source_p->sockhost);

		if(ConfigFileEntry.failed_oper_notice)
		{
			sendto_realops_snomask(SNO_GENERAL, L_ALL,
					     "Failed OPER attempt - missing SSL/TLS by %s (%s@%s)",
					     source_p->name, source_p->username, source_p->host);
		}
		return 0;
	}

	if (oper_p->certfp != NULL)
	{
		if (source_p->certfp == NULL || strcasecmp(source_p->certfp, oper_p->certfp))
		{
			sendto_one_numeric(source_p, ERR_NOOPERHOST, form_str(ERR_NOOPERHOST));
			ilog(L_FOPER, "FAILED OPER (%s) by (%s!%s@%s) (%s) -- client certificate fingerprint mismatch",
			     name, source_p->name,
			     source_p->username, source_p->host, source_p->sockhost);

			if(ConfigFileEntry.failed_oper_notice)
			{
				sendto_realops_snomask(SNO_GENERAL, L_ALL,
						     "Failed OPER attempt - client certificate fingerprint mismatch by %s (%s@%s)",
						     source_p->name, source_p->username, source_p->host);
			}
			return 0;
		}
	}

	if(match_oper_password(password, oper_p))
	{
		oper_up(source_p, oper_p);

		ilog(L_OPERED, "OPER %s by %s!%s@%s (%s)",
		     name, source_p->name, source_p->username, source_p->host,
		     source_p->sockhost);
		return 0;
	}
	else
	{
		sendto_one(source_p, form_str(ERR_PASSWDMISMATCH),
			   me.name, source_p->name);

		ilog(L_FOPER, "FAILED OPER (%s) by (%s!%s@%s) (%s)",
		     name, source_p->name, source_p->username, source_p->host,
		     source_p->sockhost);

		if(ConfigFileEntry.failed_oper_notice)
		{
			sendto_realops_snomask(SNO_GENERAL, L_NETWIDE,
					     "Failed OPER attempt by %s (%s@%s)",
					     source_p->name, source_p->username, source_p->host);
		}
	}

	return 0;
}

/*
 * match_oper_password
 *
 * inputs       - pointer to given password
 *              - pointer to Conf 
 * output       - YES or NO if match
 * side effects - none
 */
static int
match_oper_password(const char *password, struct oper_conf *oper_p)
{
	const char *encr;

	/* passwd may be NULL pointer. Head it off at the pass... */
	if(EmptyString(oper_p->passwd))
		return NO;

	if(IsOperConfEncrypted(oper_p))
	{
		/* use first two chars of the password they send in as salt */
		/* If the password in the conf is MD5, and ircd is linked   
		 * to scrypt on FreeBSD, or the standard crypt library on
		 * glibc Linux, then this code will work fine on generating
		 * the proper encrypted hash for comparison.
		 */
		if(!EmptyString(password))
			encr = rb_crypt(password, oper_p->passwd);
		else
			encr = "";
	}
	else
		encr = password;

	if(strcmp(encr, oper_p->passwd) == 0)
		return YES;
	else
		return NO;
}
Commit	Line	Data
212380e3	1	/*
	2	* ircd-ratbox: A slightly useful ircd.
	3	* m_oper.c: Makes a user an IRC Operator.
	4	*
	5	* Copyright (C) 1990 Jarkko Oikarinen and University of Oulu, Co Center
	6	* Copyright (C) 1996-2002 Hybrid Development Team
	7	* Copyright (C) 2002-2005 ircd-ratbox development team
	8	*
	9	* This program is free software; you can redistribute it and/or modify
	10	* it under the terms of the GNU General Public License as published by
	11	* the Free Software Foundation; either version 2 of the License, or
	12	* (at your option) any later version.
	13	*
	14	* This program is distributed in the hope that it will be useful,
	15	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	16	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	17	* GNU General Public License for more details.
	18	*
	19	* You should have received a copy of the GNU General Public License
	20	* along with this program; if not, write to the Free Software
	21	* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
	22	* USA
	23	*
	24	* $Id: m_oper.c 1483 2006-05-27 18:58:12Z jilles $
	25	*/
	26
	27	#include "stdinc.h"
212380e3	28	#include "client.h"
212380e3	29	#include "common.h"
13ae2f4b	30	#include "match.h"
212380e3	31	#include "ircd.h"
212380e3	32	#include "numeric.h"
212380e3	33	#include "s_conf.h"
212380e3	34	#include "s_newconf.h"
d3455e2c	35	#include "logger.h"
212380e3	36	#include "s_user.h"
	37	#include "send.h"
	38	#include "msg.h"
	39	#include "parse.h"
	40	#include "modules.h"
	41	#include "packet.h"
	42	#include "cache.h"
	43
	44	static int m_oper(struct Client , struct Client , int, const char **);
	45
	46	struct Message oper_msgtab = {
	47	"OPER", 0, 0, 0, MFLG_SLOW,
	48	{mg_unreg, {m_oper, 3}, mg_ignore, mg_ignore, mg_ignore, {m_oper, 3}}
	49	};
	50
	51	mapi_clist_av1 oper_clist[] = { &oper_msgtab, NULL };
	52	DECLARE_MODULE_AV1(oper, NULL, NULL, oper_clist, NULL, NULL, "$Revision: 1483 $");
	53
	54	static int match_oper_password(const char password, struct oper_conf oper_p);
212380e3	55
	56	/*
	57	* m_oper
212380e3	58	* parv[1] = oper name
	59	* parv[2] = oper password
	60	*/
	61	static int
	62	m_oper(struct Client client_p, struct Client source_p, int parc, const char *parv[])
	63	{
	64	struct oper_conf *oper_p;
	65	const char *name;
	66	const char *password;
	67
	68	name = parv[1];
	69	password = parv[2];
	70
	71	if(IsOper(source_p))
	72	{
	73	sendto_one(source_p, form_str(RPL_YOUREOPER), me.name, source_p->name);
	74	send_oper_motd(source_p);
	75	return 0;
	76	}
	77
	78	/* end the grace period */
	79	if(!IsFloodDone(source_p))
	80	flood_endgrace(source_p);
	81
	82	oper_p = find_oper_conf(source_p->username, source_p->orighost,
	83	source_p->sockhost, name);
	84
	85	if(oper_p == NULL)
	86	{
e4c72f79	87	sendto_one_numeric(source_p, ERR_NOOPERHOST, form_str(ERR_NOOPERHOST));
212380e3	88	ilog(L_FOPER, "FAILED OPER (%s) by (%s!%s@%s) (%s)",
	89	name, source_p->name,
	90	source_p->username, source_p->host, source_p->sockhost);
	91
	92	if(ConfigFileEntry.failed_oper_notice)
	93	{
	94	sendto_realops_snomask(SNO_GENERAL, L_NETWIDE,
	95	"Failed OPER attempt - host mismatch by %s (%s@%s)",
	96	source_p->name, source_p->username, source_p->host);
	97	}
	98
	99	return 0;
	100	}
	101
663bbb28 JT	102	if(IsOperConfNeedSSL(oper_p) && !IsSSLClient(source_p))
663bbb28 JT	103	{
e4c72f79	104	sendto_one_numeric(source_p, ERR_NOOPERHOST, form_str(ERR_NOOPERHOST));
663bbb28 JT	105	ilog(L_FOPER, "FAILED OPER (%s) by (%s!%s@%s) (%s) -- requires SSL/TLS",
	106	name, source_p->name,
	107	source_p->username, source_p->host, source_p->sockhost);
	108
	109	if(ConfigFileEntry.failed_oper_notice)
	110	{
	111	sendto_realops_snomask(SNO_GENERAL, L_ALL,
	112	"Failed OPER attempt - missing SSL/TLS by %s (%s@%s)",
	113	source_p->name, source_p->username, source_p->host);
	114	}
	115	return 0;
	116	}
	117
d8a023ed WP	118	if (oper_p->certfp != NULL)
	119	{
	120	if (source_p->certfp == NULL \|\| strcasecmp(source_p->certfp, oper_p->certfp))
	121	{
e4c72f79	122	sendto_one_numeric(source_p, ERR_NOOPERHOST, form_str(ERR_NOOPERHOST));
d8a023ed WP	123	ilog(L_FOPER, "FAILED OPER (%s) by (%s!%s@%s) (%s) -- client certificate fingerprint mismatch",
	124	name, source_p->name,
	125	source_p->username, source_p->host, source_p->sockhost);
	126
	127	if(ConfigFileEntry.failed_oper_notice)
	128	{
	129	sendto_realops_snomask(SNO_GENERAL, L_ALL,
	130	"Failed OPER attempt - client certificate fingerprint mismatch by %s (%s@%s)",
	131	source_p->name, source_p->username, source_p->host);
	132	}
	133	return 0;
	134	}
	135	}
	136
212380e3	137	if(match_oper_password(password, oper_p))
	138	{
	139	oper_up(source_p, oper_p);
	140
	141	ilog(L_OPERED, "OPER %s by %s!%s@%s (%s)",
	142	name, source_p->name, source_p->username, source_p->host,
	143	source_p->sockhost);
	144	return 0;
	145	}
	146	else
	147	{
	148	sendto_one(source_p, form_str(ERR_PASSWDMISMATCH),
	149	me.name, source_p->name);
	150
	151	ilog(L_FOPER, "FAILED OPER (%s) by (%s!%s@%s) (%s)",
	152	name, source_p->name, source_p->username, source_p->host,
	153	source_p->sockhost);
	154
	155	if(ConfigFileEntry.failed_oper_notice)
	156	{
	157	sendto_realops_snomask(SNO_GENERAL, L_NETWIDE,
	158	"Failed OPER attempt by %s (%s@%s)",
	159	source_p->name, source_p->username, source_p->host);
	160	}
	161	}
	162
	163	return 0;
	164	}
	165
	166	/*
	167	* match_oper_password
	168	*
	169	* inputs - pointer to given password
	170	* - pointer to Conf
	171	* output - YES or NO if match
	172	* side effects - none
	173	*/
	174	static int
	175	match_oper_password(const char password, struct oper_conf oper_p)
	176	{
	177	const char *encr;
	178
	179	/* passwd may be NULL pointer. Head it off at the pass... */
	180	if(EmptyString(oper_p->passwd))
	181	return NO;
	182
	183	if(IsOperConfEncrypted(oper_p))
	184	{
	185	/* use first two chars of the password they send in as salt */
	186	/* If the password in the conf is MD5, and ircd is linked
	187	* to scrypt on FreeBSD, or the standard crypt library on
	188	* glibc Linux, then this code will work fine on generating
	189	* the proper encrypted hash for comparison.
	190	*/
	191	if(!EmptyString(password))
7796ef04	192	encr = rb_crypt(password, oper_p->passwd);
212380e3	193	else
	194	encr = "";
	195	}
	196	else
	197	encr = password;
	198
	199	if(strcmp(encr, oper_p->passwd) == 0)
	200	return YES;
	201	else
	202	return NO;
	203	}