[solanum.git] / modules / m_oper.c

/*
 *  ircd-ratbox: A slightly useful ircd.
 *  m_oper.c: Makes a user an IRC Operator.
 *
 *  Copyright (C) 1990 Jarkko Oikarinen and University of Oulu, Co Center
 *  Copyright (C) 1996-2002 Hybrid Development Team
 *  Copyright (C) 2002-2005 ircd-ratbox development team
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2 of the License, or
 *  (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License
 *  along with this program; if not, write to the Free Software
 *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307
 *  USA
 */

#include "stdinc.h"
#include "client.h"
#include "match.h"
#include "ircd.h"
#include "numeric.h"
#include "s_conf.h"
#include "s_newconf.h"
#include "logger.h"
#include "s_user.h"
#include "s_serv.h"
#include "send.h"
#include "msg.h"
#include "parse.h"
#include "modules.h"
#include "packet.h"
#include "cache.h"

static const char oper_desc[] = "Provides the OPER command to become an IRC operator";

static void m_oper(struct MsgBuf *, struct Client *, struct Client *, int, const char **);
static void mc_oper(struct MsgBuf *, struct Client *, struct Client *, int, const char **);
static void me_oper(struct MsgBuf *, struct Client *, struct Client *, int, const char **);

static bool match_oper_password(const char *password, struct oper_conf *oper_p);

struct Message oper_msgtab = {
	"OPER", 0, 0, 0, 0,
	{mg_unreg, {m_oper, 3}, {mc_oper, 2}, mg_ignore, {me_oper, 2}, {m_oper, 3}}
};

mapi_clist_av1 oper_clist[] = { &oper_msgtab, NULL };

DECLARE_MODULE_AV2(oper, NULL, NULL, oper_clist, NULL, NULL, NULL, NULL, oper_desc);

/*
 * m_oper
 *      parv[1] = oper name
 *      parv[2] = oper password
 */
static void
m_oper(struct MsgBuf *msgbuf_p, struct Client *client_p, struct Client *source_p, int parc, const char *parv[])
{
	struct oper_conf *oper_p;
	const char *name;
	const char *password;

	name = parv[1];
	password = parv[2];

	if (ConfigFileEntry.oper_secure_only && !IsSecureClient(source_p))
	{
		sendto_one_notice(source_p, ":You must be using a secure connection to /OPER on this server");
		if (ConfigFileEntry.failed_oper_notice)
		{
			sendto_realops_snomask(SNO_GENERAL, L_NETWIDE,
					"Failed OPER attempt - missing secure connection by %s (%s@%s)",
					source_p->name, source_p->username, source_p->host);
		}
		return;
	}

	if(IsOper(source_p))
	{
		sendto_one(source_p, form_str(RPL_YOUREOPER), me.name, source_p->name);
		send_oper_motd(source_p);
		return;
	}

	/* end the grace period */
	if(!IsFloodDone(source_p))
		flood_endgrace(source_p);

	oper_p = find_oper_conf(source_p->username, source_p->orighost,
				source_p->sockhost, name);

	if(oper_p == NULL)
	{
		sendto_one_numeric(source_p, ERR_NOOPERHOST, form_str(ERR_NOOPERHOST));
		ilog(L_FOPER, "FAILED OPER (%s) by (%s!%s@%s) (%s)",
		     name, source_p->name,
		     source_p->username, source_p->host, source_p->sockhost);

		if(ConfigFileEntry.failed_oper_notice)
		{
			sendto_realops_snomask(SNO_GENERAL, L_NETWIDE,
					     "Failed OPER attempt - host mismatch by %s (%s@%s)",
					     source_p->name, source_p->username, source_p->host);
		}

		return;
	}

	if(IsOperConfNeedSSL(oper_p) && !IsSecureClient(source_p))
	{
		sendto_one_numeric(source_p, ERR_NOOPERHOST, form_str(ERR_NOOPERHOST));
		ilog(L_FOPER, "FAILED OPER (%s) by (%s!%s@%s) (%s) -- requires SSL/TLS",
		     name, source_p->name,
		     source_p->username, source_p->host, source_p->sockhost);

		if(ConfigFileEntry.failed_oper_notice)
		{
			sendto_realops_snomask(SNO_GENERAL, L_ALL,
					     "Failed OPER attempt - missing SSL/TLS by %s (%s@%s)",
					     source_p->name, source_p->username, source_p->host);
		}
		return;
	}

	if (oper_p->certfp != NULL)
	{
		if (source_p->certfp == NULL || rb_strcasecmp(source_p->certfp, oper_p->certfp))
		{
			sendto_one_numeric(source_p, ERR_NOOPERHOST, form_str(ERR_NOOPERHOST));
			ilog(L_FOPER, "FAILED OPER (%s) by (%s!%s@%s) (%s) -- client certificate fingerprint mismatch",
			     name, source_p->name,
			     source_p->username, source_p->host, source_p->sockhost);

			if(ConfigFileEntry.failed_oper_notice)
			{
				sendto_realops_snomask(SNO_GENERAL, L_ALL,
						     "Failed OPER attempt - client certificate fingerprint mismatch by %s (%s@%s)",
						     source_p->name, source_p->username, source_p->host);
			}
			return;
		}
	}

	if(match_oper_password(password, oper_p))
	{
		oper_up(source_p, oper_p);

		ilog(L_OPERED, "OPER %s by %s!%s@%s (%s)",
		     name, source_p->name, source_p->username, source_p->host,
		     source_p->sockhost);
		return;
	}
	else
	{
		sendto_one(source_p, form_str(ERR_PASSWDMISMATCH),
			   me.name, source_p->name);

		ilog(L_FOPER, "FAILED OPER (%s) by (%s!%s@%s) (%s)",
		     name, source_p->name, source_p->username, source_p->host,
		     source_p->sockhost);

		if(ConfigFileEntry.failed_oper_notice)
		{
			sendto_realops_snomask(SNO_GENERAL, L_NETWIDE,
					     "Failed OPER attempt by %s (%s@%s)",
					     source_p->name, source_p->username, source_p->host);
		}
	}
}

/*
 * mc_oper - server-to-server OPER propagation
 *     parv[1] = opername
 *     parv[2] = privset
 */
static void
mc_oper(struct MsgBuf *msgbuf_p, struct Client *client_p, struct Client *source_p, int parc, const char *parv[])
{
	struct PrivilegeSet *privset;

	if (parc >= 3)
	{
		sendto_server(client_p, NULL, CAP_TS6, NOCAPS, ":%s OPER %s %s", use_id(source_p), parv[1], parv[2]);

		privset = privilegeset_get(parv[2]);
		if(privset == NULL)
		{
			/* if we don't have a matching privset, we'll create an empty one and
			 * mark it illegal, so it gets picked up on a rehash later */
			sendto_realops_snomask(SNO_GENERAL, L_NETWIDE, "Received OPER for %s with unknown privset %s", source_p->name, parv[2]);
			privset = privilegeset_set_new(parv[2], "", 0);
			privset->status |= CONF_ILLEGAL;
		}

		privset = privilegeset_ref(privset);
		if (source_p->user->privset != NULL)
			privilegeset_unref(source_p->user->privset);

		source_p->user->privset = privset;
	}
	else
	{
		sendto_server(client_p, NULL, CAP_TS6, NOCAPS, ":%s OPER %s", use_id(source_p), parv[1]);
	}

	rb_free(source_p->user->opername);
	source_p->user->opername = rb_strdup(parv[1]);
}

/*
 * me_oper - ircd-seven-style OPER propagation
 *     parv[1] = opername
 */
static void
me_oper(struct MsgBuf *msgbuf_p, struct Client *client_p, struct Client *source_p, int parc, const char *parv[])
{
	rb_free(source_p->user->opername);
	source_p->user->opername = rb_strdup(parv[1]);
}

/*
 * match_oper_password
 *
 * inputs       - pointer to given password
 *              - pointer to Conf
 * output       - true if match, false otherwise
 * side effects - none
 */
static bool
match_oper_password(const char *password, struct oper_conf *oper_p)
{
	const char *encr;

	/* passwd may be NULL pointer. Head it off at the pass... */
	if(EmptyString(oper_p->passwd))
		return false;

	if(IsOperConfEncrypted(oper_p))
	{
		/* use first two chars of the password they send in as salt */
		/* If the password in the conf is MD5, and ircd is linked
		 * to scrypt on FreeBSD, or the standard crypt library on
		 * glibc Linux, then this code will work fine on generating
		 * the proper encrypted hash for comparison.
		 */
		if(!EmptyString(password))
			encr = rb_crypt(password, oper_p->passwd);
		else
			encr = "";
	}
	else
		encr = password;

	if(encr != NULL && strcmp(encr, oper_p->passwd) == 0)
		return true;
	else
		return false;
}
Commit	Line	Data
212380e3 AC	1	/*
	2	* ircd-ratbox: A slightly useful ircd.
	3	* m_oper.c: Makes a user an IRC Operator.
	4	*
	5	* Copyright (C) 1990 Jarkko Oikarinen and University of Oulu, Co Center
	6	* Copyright (C) 1996-2002 Hybrid Development Team
	7	* Copyright (C) 2002-2005 ircd-ratbox development team
	8	*
	9	* This program is free software; you can redistribute it and/or modify
	10	* it under the terms of the GNU General Public License as published by
	11	* the Free Software Foundation; either version 2 of the License, or
	12	* (at your option) any later version.
	13	*
	14	* This program is distributed in the hope that it will be useful,
	15	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	16	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	17	* GNU General Public License for more details.
	18	*
	19	* You should have received a copy of the GNU General Public License
	20	* along with this program; if not, write to the Free Software
	21	* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
	22	* USA
212380e3 AC	23	*/
	24
	25	#include "stdinc.h"
212380e3	26	#include "client.h"
4562c604	27	#include "match.h"
212380e3 AC	28	#include "ircd.h"
212380e3 AC	29	#include "numeric.h"
212380e3 AC	30	#include "s_conf.h"
212380e3 AC	31	#include "s_newconf.h"
4016731b	32	#include "logger.h"
212380e3	33	#include "s_user.h"
ed3ca2ff	34	#include "s_serv.h"
212380e3 AC	35	#include "send.h"
	36	#include "msg.h"
	37	#include "parse.h"
	38	#include "modules.h"
	39	#include "packet.h"
	40	#include "cache.h"
	41
eeabf33a EM	42	static const char oper_desc[] = "Provides the OPER command to become an IRC operator";
eeabf33a EM	43
3c7d6fcc	44	static void m_oper(struct MsgBuf , struct Client , struct Client , int, const char *);
ed3ca2ff	45	static void mc_oper(struct MsgBuf , struct Client , struct Client , int, const char *);
53b209c7	46	static void me_oper(struct MsgBuf , struct Client , struct Client , int, const char *);
3c7d6fcc EM	47
3c7d6fcc EM	48	static bool match_oper_password(const char password, struct oper_conf oper_p);
212380e3 AC	49
212380e3 AC	50	struct Message oper_msgtab = {
7baa37a9	51	"OPER", 0, 0, 0, 0,
eeaea746	52	{mg_unreg, {m_oper, 3}, {mc_oper, 2}, mg_ignore, {me_oper, 2}, {m_oper, 3}}
212380e3 AC	53	};
	54
	55	mapi_clist_av1 oper_clist[] = { &oper_msgtab, NULL };
1fe7d608	56
1fe7d608	57	DECLARE_MODULE_AV2(oper, NULL, NULL, oper_clist, NULL, NULL, NULL, NULL, oper_desc);
212380e3	58
212380e3 AC	59	/*
212380e3 AC	60	* m_oper
212380e3 AC	61	* parv[1] = oper name
	62	* parv[2] = oper password
	63	*/
3c7d6fcc	64	static void
428ca87b	65	m_oper(struct MsgBuf msgbuf_p, struct Client client_p, struct Client source_p, int parc, const char parv[])
212380e3 AC	66	{
	67	struct oper_conf *oper_p;
	68	const char *name;
	69	const char *password;
	70
	71	name = parv[1];
	72	password = parv[2];
	73
40ecb85a	74	if (ConfigFileEntry.oper_secure_only && !IsSecureClient(source_p))
	75	{
	76	sendto_one_notice(source_p, ":You must be using a secure connection to /OPER on this server");
	77	if (ConfigFileEntry.failed_oper_notice)
	78	{
	79	sendto_realops_snomask(SNO_GENERAL, L_NETWIDE,
	80	"Failed OPER attempt - missing secure connection by %s (%s@%s)",
	81	source_p->name, source_p->username, source_p->host);
	82	}
	83	return;
	84	}
	85
212380e3 AC	86	if(IsOper(source_p))
	87	{
	88	sendto_one(source_p, form_str(RPL_YOUREOPER), me.name, source_p->name);
	89	send_oper_motd(source_p);
3c7d6fcc	90	return;
212380e3 AC	91	}
	92
	93	/* end the grace period */
	94	if(!IsFloodDone(source_p))
	95	flood_endgrace(source_p);
	96
55abcbb2	97	oper_p = find_oper_conf(source_p->username, source_p->orighost,
212380e3 AC	98	source_p->sockhost, name);
	99
	100	if(oper_p == NULL)
	101	{
76169ea7	102	sendto_one_numeric(source_p, ERR_NOOPERHOST, form_str(ERR_NOOPERHOST));
212380e3 AC	103	ilog(L_FOPER, "FAILED OPER (%s) by (%s!%s@%s) (%s)",
	104	name, source_p->name,
	105	source_p->username, source_p->host, source_p->sockhost);
	106
	107	if(ConfigFileEntry.failed_oper_notice)
	108	{
	109	sendto_realops_snomask(SNO_GENERAL, L_NETWIDE,
	110	"Failed OPER attempt - host mismatch by %s (%s@%s)",
	111	source_p->name, source_p->username, source_p->host);
	112	}
	113
3c7d6fcc	114	return;
212380e3 AC	115	}
212380e3 AC	116
35eccf49	117	if(IsOperConfNeedSSL(oper_p) && !IsSecureClient(source_p))
b1594414	118	{
76169ea7	119	sendto_one_numeric(source_p, ERR_NOOPERHOST, form_str(ERR_NOOPERHOST));
b1594414 JT	120	ilog(L_FOPER, "FAILED OPER (%s) by (%s!%s@%s) (%s) -- requires SSL/TLS",
	121	name, source_p->name,
	122	source_p->username, source_p->host, source_p->sockhost);
	123
	124	if(ConfigFileEntry.failed_oper_notice)
	125	{
	126	sendto_realops_snomask(SNO_GENERAL, L_ALL,
	127	"Failed OPER attempt - missing SSL/TLS by %s (%s@%s)",
	128	source_p->name, source_p->username, source_p->host);
	129	}
3c7d6fcc	130	return;
b1594414 JT	131	}
b1594414 JT	132
ff31db84 AC	133	if (oper_p->certfp != NULL)
ff31db84 AC	134	{
f956cb0f	135	if (source_p->certfp == NULL \|\| rb_strcasecmp(source_p->certfp, oper_p->certfp))
ff31db84	136	{
76169ea7	137	sendto_one_numeric(source_p, ERR_NOOPERHOST, form_str(ERR_NOOPERHOST));
ff31db84 AC	138	ilog(L_FOPER, "FAILED OPER (%s) by (%s!%s@%s) (%s) -- client certificate fingerprint mismatch",
	139	name, source_p->name,
	140	source_p->username, source_p->host, source_p->sockhost);
	141
	142	if(ConfigFileEntry.failed_oper_notice)
	143	{
	144	sendto_realops_snomask(SNO_GENERAL, L_ALL,
	145	"Failed OPER attempt - client certificate fingerprint mismatch by %s (%s@%s)",
	146	source_p->name, source_p->username, source_p->host);
	147	}
3c7d6fcc	148	return;
ff31db84 AC	149	}
	150	}
	151
212380e3 AC	152	if(match_oper_password(password, oper_p))
	153	{
	154	oper_up(source_p, oper_p);
	155
	156	ilog(L_OPERED, "OPER %s by %s!%s@%s (%s)",
	157	name, source_p->name, source_p->username, source_p->host,
	158	source_p->sockhost);
3c7d6fcc	159	return;
212380e3 AC	160	}
	161	else
	162	{
	163	sendto_one(source_p, form_str(ERR_PASSWDMISMATCH),
	164	me.name, source_p->name);
	165
	166	ilog(L_FOPER, "FAILED OPER (%s) by (%s!%s@%s) (%s)",
	167	name, source_p->name, source_p->username, source_p->host,
	168	source_p->sockhost);
	169
	170	if(ConfigFileEntry.failed_oper_notice)
	171	{
	172	sendto_realops_snomask(SNO_GENERAL, L_NETWIDE,
	173	"Failed OPER attempt by %s (%s@%s)",
	174	source_p->name, source_p->username, source_p->host);
	175	}
	176	}
212380e3 AC	177	}
212380e3 AC	178
ed3ca2ff EK	179	/*
	180	* mc_oper - server-to-server OPER propagation
	181	* parv[1] = opername
	182	* parv[2] = privset
	183	*/
	184	static void
	185	mc_oper(struct MsgBuf msgbuf_p, struct Client client_p, struct Client source_p, int parc, const char parv[])
	186	{
	187	struct PrivilegeSet *privset;
ed3ca2ff	188
eeaea746	189	if (parc >= 3)
ed3ca2ff	190	{
eeaea746 EK	191	sendto_server(client_p, NULL, CAP_TS6, NOCAPS, ":%s OPER %s %s", use_id(source_p), parv[1], parv[2]);
	192
	193	privset = privilegeset_get(parv[2]);
	194	if(privset == NULL)
	195	{
	196	/* if we don't have a matching privset, we'll create an empty one and
	197	* mark it illegal, so it gets picked up on a rehash later */
	198	sendto_realops_snomask(SNO_GENERAL, L_NETWIDE, "Received OPER for %s with unknown privset %s", source_p->name, parv[2]);
	199	privset = privilegeset_set_new(parv[2], "", 0);
	200	privset->status \|= CONF_ILLEGAL;
	201	}
ed3ca2ff	202
eeaea746 EK	203	privset = privilegeset_ref(privset);
	204	if (source_p->user->privset != NULL)
	205	privilegeset_unref(source_p->user->privset);
ed3ca2ff	206
eeaea746 EK	207	source_p->user->privset = privset;
	208	}
	209	else
	210	{
	211	sendto_server(client_p, NULL, CAP_TS6, NOCAPS, ":%s OPER %s", use_id(source_p), parv[1]);
	212	}
53b209c7 EK	213
	214	rb_free(source_p->user->opername);
	215	source_p->user->opername = rb_strdup(parv[1]);
	216	}
	217
	218	/*
	219	* me_oper - ircd-seven-style OPER propagation
	220	* parv[1] = opername
	221	*/
	222	static void
	223	me_oper(struct MsgBuf msgbuf_p, struct Client client_p, struct Client source_p, int parc, const char parv[])
	224	{
	225	rb_free(source_p->user->opername);
ed3ca2ff EK	226	source_p->user->opername = rb_strdup(parv[1]);
	227	}
	228
212380e3 AC	229	/*
	230	* match_oper_password
	231	*
	232	* inputs - pointer to given password
55abcbb2	233	* - pointer to Conf
3c7d6fcc	234	* output - true if match, false otherwise
212380e3 AC	235	* side effects - none
212380e3 AC	236	*/
3c7d6fcc	237	static bool
212380e3 AC	238	match_oper_password(const char password, struct oper_conf oper_p)
	239	{
	240	const char *encr;
	241
	242	/* passwd may be NULL pointer. Head it off at the pass... */
	243	if(EmptyString(oper_p->passwd))
3c7d6fcc	244	return false;
212380e3 AC	245
	246	if(IsOperConfEncrypted(oper_p))
	247	{
	248	/* use first two chars of the password they send in as salt */
55abcbb2	249	/* If the password in the conf is MD5, and ircd is linked
212380e3 AC	250	* to scrypt on FreeBSD, or the standard crypt library on
	251	* glibc Linux, then this code will work fine on generating
	252	* the proper encrypted hash for comparison.
	253	*/
	254	if(!EmptyString(password))
d20b49d5	255	encr = rb_crypt(password, oper_p->passwd);
212380e3 AC	256	else
	257	encr = "";
	258	}
	259	else
	260	encr = password;
	261
e69375f3	262	if(encr != NULL && strcmp(encr, oper_p->passwd) == 0)
3c7d6fcc	263	return true;
212380e3	264	else
3c7d6fcc	265	return false;
212380e3	266	}