ouch/inspircd
2
0
Fork 0
mirror of https://github.com/inspircd/inspircd.git synced 2025-03-10 02:59:01 -04:00
Code Issues Packages Projects Releases Wiki Activity

Minor cleanup and documentation improvements.

Browse Source 
- Only show a generic failure message to the user upon oper failure
due to not having a secure connection or matching cert. fingerprint.
- Update the comment about oper:fingerprint as it can be a space
separated list of fingerprints and not just one.
- Improve a few code comments and formatting.
This commit is contained in:
Matt Schatz 2020-04-14 04:51:05 -06:00
parent 6ce92e8eb0
commit 85bd27a840
No known key found for this signature in database
GPG Key ID: 5BD12B0E6CFB19B2
3 changed files with 22 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
docs/conf/opers.conf.example
View File

@ -112,9 +112,9 @@
host="attila@inspircd.org *@2001:db8::/32"
# ** ADVANCED ** This option is disabled by default.
# fingerprint: When using the sslinfo module, you may specify
# a key fingerprint here. This can be obtained by using the /SSLINFO
# command while the module is loaded, and is also noticed on connect.
# fingerprint: When using the sslinfo module, you may specify a space separated
# list of TLS (SSL) client certificate fingerprints here. These can be obtained by using
# the /SSLINFO command while the module is loaded, and is also noticed on connect.
# This enhances security by verifying that the person opering up has
# a matching TLS (SSL) client certificate, which is very difficult to
# forge (impossible unless preimage attacks on the hash exist).

3
src/coremods/core_oper/cmd_oper.cpp
View File

@ -53,7 +53,6 @@ CmdResult CommandOper::HandleLocal(LocalUser* user, const Params& parameters)
if (match_pass && match_hosts)
{
/* found this oper's opertype */
user->Oper(ifo);
return CMD_SUCCESS;
}
@ -68,7 +67,7 @@ CmdResult CommandOper::HandleLocal(LocalUser* user, const Params& parameters)
fields.append("hosts ");
fields.erase(fields.length() - 1, 1);
// tell them they suck, and lag them up to help prevent brute-force attacks
// Tell them they failed (generically) and lag them up to help prevent brute-force attacks
user->WriteNumeric(ERR_NOOPERHOST, "Invalid oper credentials");
user->CommandFloodPenalty += 10000;

35
src/modules/m_sslinfo.cpp
View File

@ -153,7 +153,7 @@ class CommandSSLInfo : public Command
: Command(Creator, "SSLINFO", 1)
, sslapi(Creator)
{
this->syntax = "<nick>";
syntax = "<nick>";
}
CmdResult Handle(User* user, const Params& parameters) CXX11_OVERRIDE
@ -188,6 +188,7 @@ class CommandSSLInfo : public Command
user->WriteNotice("*** Issuer: " + cert->GetIssuer());
user->WriteNotice("*** Key Fingerprint: " + cert->GetFingerprint());
}
return CMD_SUCCESS;
}
};
@ -257,18 +258,18 @@ class ModuleSSLInfo
if (ifo->oper_block->getBool("sslonly") && !cert)
{
user->WriteNumeric(ERR_NOOPERHOST, "This oper login requires an SSL connection.");
user->WriteNumeric(ERR_NOOPERHOST, "Invalid oper credentials");
user->CommandFloodPenalty += 10000;
ServerInstance->SNO->WriteGlobalSno('o', "WARNING! Failed oper attempt by %s using login '%s': secure connection required.", user->GetFullRealHost().c_str(), parameters[0].c_str());
ServerInstance->SNO->WriteGlobalSno('o', "WARNING! Failed oper attempt by %s using login '%s': a secure connection is required.", user->GetFullRealHost().c_str(), parameters[0].c_str());
return MOD_RES_DENY;
}
std::string fingerprint;
if (ifo->oper_block->readString("fingerprint", fingerprint) && (!cert || !MatchFP(cert, fingerprint)))
{
user->WriteNumeric(ERR_NOOPERHOST, "This oper login requires a matching SSL certificate fingerprint.");
user->WriteNumeric(ERR_NOOPERHOST, "Invalid oper credentials");
user->CommandFloodPenalty += 10000;
ServerInstance->SNO->WriteGlobalSno('o', "WARNING! Failed oper attempt by %s using login '%s': client certificate fingerprint does not match.", user->GetFullRealHost().c_str(), parameters[0].c_str());
ServerInstance->SNO->WriteGlobalSno('o', "WARNING! Failed oper attempt by %s using login '%s': their TLS (SSL) client certificate fingerprint does not match.", user->GetFullRealHost().c_str(), parameters[0].c_str());
return MOD_RES_DENY;
}
}
@ -290,21 +291,20 @@ class ModuleSSLInfo
ssl_cert* const cert = ssliohook->GetCertificate();
{
std::string text = "*** You are connected to ";
if (!ssliohook->GetServerName(text))
text.append(ServerInstance->Config->ServerName);
text.append(" using SSL cipher '");
ssliohook->GetCiphersuite(text);
text.push_back('\'');
if ((cert) && (!cert->GetFingerprint().empty()))
text.append(" and your SSL certificate fingerprint is ").append(cert->GetFingerprint());
user->WriteNotice(text);
}
std::string text = "*** You are connected to ";
if (!ssliohook->GetServerName(text))
text.append(ServerInstance->Config->ServerName);
text.append(" using TLS (SSL) cipher '");
ssliohook->GetCiphersuite(text);
text.push_back('\'');
if (cert && !cert->GetFingerprint().empty())
text.append(" and your TLS (SSL) client certificate fingerprint is ").append(cert->GetFingerprint());
user->WriteNotice(text);
if (!cert)
return;
// find an auto-oper block for this user
// Find an auto-oper block for this user
for (ServerConfig::OperIndex::const_iterator i = ServerInstance->Config->oper_blocks.begin(); i != ServerInstance->Config->oper_blocks.end(); ++i)
{
OperInfo* ifo = i->second;
@ -332,6 +332,7 @@ class ModuleSSLInfo
if (!ok)
return MOD_RES_DENY;
return MOD_RES_PASSTHRU;
}