X-Git-Url: https://jfr.im/git/irc/rqf/shadowircd.git/blobdiff_plain/212380e3f42f585dc1ea927402252eb943f91f7b..12c4f819fadcc5fac4de0c9f510c02c560ad0f20:/modules/m_challenge.c diff --git a/modules/m_challenge.c b/modules/m_challenge.c index 5fab030..19729e3 100644 --- a/modules/m_challenge.c +++ b/modules/m_challenge.c @@ -21,7 +21,7 @@ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 * USA * - * $Id: m_challenge.c 1483 2006-05-27 18:58:12Z jilles $ + * $Id: m_challenge.c 3161 2007-01-25 07:23:01Z nenolod $ */ #include "stdinc.h" @@ -36,7 +36,6 @@ #include #endif -#include "memory.h" #include "client.h" #include "ircd.h" #include "modules.h" @@ -45,8 +44,8 @@ #include "s_conf.h" #include "msg.h" #include "parse.h" -#include "irc_string.h" -#include "s_log.h" +#include "match.h" +#include "logger.h" #include "s_user.h" #include "cache.h" #include "s_newconf.h" @@ -70,7 +69,7 @@ static int challenge_load(void) #endif } -DECLARE_MODULE_AV1(challenge, challenge_load, NULL, NULL, NULL, NULL, "$Revision: 1483 $"); +DECLARE_MODULE_AV1(challenge, challenge_load, NULL, NULL, NULL, NULL, "$Revision: 3161 $"); #else static int m_challenge(struct Client *, struct Client *, int, const char **); @@ -82,7 +81,7 @@ struct Message challenge_msgtab = { }; mapi_clist_av1 challenge_clist[] = { &challenge_msgtab, NULL }; -DECLARE_MODULE_AV1(challenge, NULL, NULL, challenge_clist, NULL, NULL, "$Revision: 1483 $"); +DECLARE_MODULE_AV1(challenge, NULL, NULL, challenge_clist, NULL, NULL, "$Revision: 3161 $"); static int generate_challenge(char **r_challenge, char **r_response, RSA * key); @@ -92,8 +91,8 @@ cleanup_challenge(struct Client *target_p) if(target_p->localClient == NULL) return; - MyFree(target_p->localClient->challenge); - MyFree(target_p->localClient->opername); + rb_free(target_p->localClient->challenge); + rb_free(target_p->localClient->opername); target_p->localClient->challenge = NULL; target_p->localClient->opername = NULL; target_p->localClient->chal_time = 0; @@ -101,7 +100,6 @@ cleanup_challenge(struct Client *target_p) /* * m_challenge - generate RSA challenge for wouldbe oper - * parv[0] = sender prefix * parv[1] = operator to challenge for, or +response * */ @@ -129,7 +127,7 @@ m_challenge(struct Client *client_p, struct Client *source_p, int parc, const ch if(!source_p->localClient->challenge) return 0; - if((CurrentTime - source_p->localClient->chal_time) > CHALLENGE_EXPIRES) + if((rb_current_time() - source_p->localClient->chal_time) > CHALLENGE_EXPIRES) { sendto_one(source_p, form_str(ERR_PASSWDMISMATCH), me.name, source_p->name); ilog(L_FOPER, "EXPIRED CHALLENGE (%s) by (%s!%s@%s) (%s)", @@ -145,7 +143,7 @@ m_challenge(struct Client *client_p, struct Client *source_p, int parc, const ch return 0; } - b_response = ircd_base64_decode((const unsigned char *)++parv[1], strlen(parv[1]), &len); + b_response = rb_base64_decode((const unsigned char *)++parv[1], strlen(parv[1]), &len); if(len != SHA_DIGEST_LENGTH || memcmp(source_p->localClient->challenge, b_response, SHA_DIGEST_LENGTH)) @@ -161,12 +159,12 @@ m_challenge(struct Client *client_p, struct Client *source_p, int parc, const ch source_p->name, source_p->username, source_p->host); - MyFree(b_response); + rb_free(b_response); cleanup_challenge(source_p); return 0; } - MyFree(b_response); + rb_free(b_response); oper_p = find_oper_conf(source_p->username, source_p->orighost, source_p->sockhost, @@ -220,18 +218,33 @@ m_challenge(struct Client *client_p, struct Client *source_p, int parc, const ch if(!oper_p->rsa_pubkey) { - sendto_one(source_p, ":%s NOTICE %s :I'm sorry, PK authentication " - "is not enabled for your oper{} block.", me.name, parv[0]); + sendto_one_notice(source_p, ":I'm sorry, PK authentication is not enabled for your oper{} block."); + return 0; + } + + if(IsOperConfNeedSSL(oper_p) && !IsSSLClient(source_p)) + { + sendto_one(source_p, form_str(ERR_NOOPERHOST), me.name, source_p->name); + ilog(L_FOPER, "FAILED CHALLENGE (%s) by (%s!%s@%s) (%s) -- requires SSL/TLS", + parv[1], source_p->name, source_p->username, source_p->host, + source_p->sockhost); + + if(ConfigFileEntry.failed_oper_notice) + { + sendto_realops_snomask(SNO_GENERAL, L_ALL, + "Failed CHALLENGE attempt - missing SSL/TLS by %s (%s@%s)", + source_p->name, source_p->username, source_p->host); + } return 0; } if(!generate_challenge(&challenge, &(source_p->localClient->challenge), oper_p->rsa_pubkey)) { char *chal = challenge; - source_p->localClient->chal_time = CurrentTime; + source_p->localClient->chal_time = rb_current_time(); for(;;) { - cnt = strlcpy(chal_line, chal, CHALLENGE_WIDTH); + cnt = rb_strlcpy(chal_line, chal, CHALLENGE_WIDTH); sendto_one(source_p, form_str(RPL_RSACHALLENGE2), me.name, source_p->name, chal_line); if(cnt > CHALLENGE_WIDTH) chal += CHALLENGE_WIDTH - 1; @@ -241,8 +254,8 @@ m_challenge(struct Client *client_p, struct Client *source_p, int parc, const ch } sendto_one(source_p, form_str(RPL_ENDOFRSACHALLENGE2), me.name, source_p->name); - MyFree(challenge); - DupString(source_p->localClient->opername, oper_p->name); + rb_free(challenge); + source_p->localClient->opername = rb_strdup(oper_p->name); } else sendto_one_notice(source_p, ":Failed to generate challenge."); @@ -250,28 +263,6 @@ m_challenge(struct Client *client_p, struct Client *source_p, int parc, const ch return 0; } -static int -get_randomness(unsigned char *buf, int length) -{ - /* Seed OpenSSL PRNG with EGD enthropy pool -kre */ - if(ConfigFileEntry.use_egd && (ConfigFileEntry.egdpool_path != NULL)) - { - if(RAND_egd(ConfigFileEntry.egdpool_path) == -1) - return -1; - } - - if(RAND_status()) - { - if(RAND_bytes(buf, length) > 0) - return 1; - } - else { - if(RAND_pseudo_bytes(buf, length) >= 0) - return 1; - } - return 0; -} - static int generate_challenge(char **r_challenge, char **r_response, RSA * rsa) { @@ -284,25 +275,26 @@ generate_challenge(char **r_challenge, char **r_response, RSA * rsa) if(!rsa) return -1; - if(get_randomness(secret, CHALLENGE_SECRET_LENGTH)) + if(rb_get_random(secret, CHALLENGE_SECRET_LENGTH)) { SHA1_Init(&ctx); - SHA1_Update(&ctx, (u_int8_t *)secret, CHALLENGE_SECRET_LENGTH); - *r_response = MyMalloc(SHA_DIGEST_LENGTH); - SHA1_Final((u_int8_t *)*r_response, &ctx); + SHA1_Update(&ctx, (uint8_t *)secret, CHALLENGE_SECRET_LENGTH); + *r_response = malloc(SHA_DIGEST_LENGTH); + SHA1_Final((uint8_t *)*r_response, &ctx); length = RSA_size(rsa); - tmp = MyMalloc(length); + tmp = rb_malloc(length); ret = RSA_public_encrypt(CHALLENGE_SECRET_LENGTH, secret, tmp, rsa, RSA_PKCS1_OAEP_PADDING); - if (ret >= 0) + if(ret >= 0) { - *r_challenge = (char *)ircd_base64_encode(tmp, ret); - MyFree(tmp); + *r_challenge = (char *)rb_base64_encode(tmp, ret); + rb_free(tmp); return 0; } - MyFree(tmp); - MyFree(*r_response); + + rb_free(tmp); + rb_free(*r_response); *r_response = NULL; }