diff options
| -rw-r--r-- | docs/conf/opers.conf.example | 6 | ||||
| -rw-r--r-- | src/coremods/core_oper/cmd_oper.cpp | 3 | ||||
| -rw-r--r-- | src/modules/m_sslinfo.cpp | 35 |
3 files changed, 22 insertions, 22 deletions
diff --git a/docs/conf/opers.conf.example b/docs/conf/opers.conf.example index 2c5da870a..d8c266b1f 100644 --- a/docs/conf/opers.conf.example +++ b/docs/conf/opers.conf.example @@ -112,9 +112,9 @@ host="attila@inspircd.org *@2001:db8::/32" # ** ADVANCED ** This option is disabled by default. - # fingerprint: When using the sslinfo module, you may specify - # a key fingerprint here. This can be obtained by using the /SSLINFO - # command while the module is loaded, and is also noticed on connect. + # fingerprint: When using the sslinfo module, you may specify a space separated + # list of TLS (SSL) client certificate fingerprints here. These can be obtained by using + # the /SSLINFO command while the module is loaded, and is also noticed on connect. # This enhances security by verifying that the person opering up has # a matching TLS (SSL) client certificate, which is very difficult to # forge (impossible unless preimage attacks on the hash exist). diff --git a/src/coremods/core_oper/cmd_oper.cpp b/src/coremods/core_oper/cmd_oper.cpp index 391c7f41f..f1da883e8 100644 --- a/src/coremods/core_oper/cmd_oper.cpp +++ b/src/coremods/core_oper/cmd_oper.cpp @@ -53,7 +53,6 @@ CmdResult CommandOper::HandleLocal(LocalUser* user, const Params& parameters) if (match_pass && match_hosts) { - /* found this oper's opertype */ user->Oper(ifo); return CMD_SUCCESS; } @@ -68,7 +67,7 @@ CmdResult CommandOper::HandleLocal(LocalUser* user, const Params& parameters) fields.append("hosts "); fields.erase(fields.length() - 1, 1); - // tell them they suck, and lag them up to help prevent brute-force attacks + // Tell them they failed (generically) and lag them up to help prevent brute-force attacks user->WriteNumeric(ERR_NOOPERHOST, "Invalid oper credentials"); user->CommandFloodPenalty += 10000; diff --git a/src/modules/m_sslinfo.cpp b/src/modules/m_sslinfo.cpp index 885ae6f74..477785bea 100644 --- a/src/modules/m_sslinfo.cpp +++ b/src/modules/m_sslinfo.cpp @@ -153,7 +153,7 @@ class CommandSSLInfo : public Command : Command(Creator, "SSLINFO", 1) , sslapi(Creator) { - this->syntax = "<nick>"; + syntax = "<nick>"; } CmdResult Handle(User* user, const Params& parameters) CXX11_OVERRIDE @@ -188,6 +188,7 @@ class CommandSSLInfo : public Command user->WriteNotice("*** Issuer: " + cert->GetIssuer()); user->WriteNotice("*** Key Fingerprint: " + cert->GetFingerprint()); } + return CMD_SUCCESS; } }; @@ -257,18 +258,18 @@ class ModuleSSLInfo if (ifo->oper_block->getBool("sslonly") && !cert) { - user->WriteNumeric(ERR_NOOPERHOST, "This oper login requires an SSL connection."); + user->WriteNumeric(ERR_NOOPERHOST, "Invalid oper credentials"); user->CommandFloodPenalty += 10000; - ServerInstance->SNO->WriteGlobalSno('o', "WARNING! Failed oper attempt by %s using login '%s': secure connection required.", user->GetFullRealHost().c_str(), parameters[0].c_str()); + ServerInstance->SNO->WriteGlobalSno('o', "WARNING! Failed oper attempt by %s using login '%s': a secure connection is required.", user->GetFullRealHost().c_str(), parameters[0].c_str()); return MOD_RES_DENY; } std::string fingerprint; if (ifo->oper_block->readString("fingerprint", fingerprint) && (!cert || !MatchFP(cert, fingerprint))) { - user->WriteNumeric(ERR_NOOPERHOST, "This oper login requires a matching SSL certificate fingerprint."); + user->WriteNumeric(ERR_NOOPERHOST, "Invalid oper credentials"); user->CommandFloodPenalty += 10000; - ServerInstance->SNO->WriteGlobalSno('o', "WARNING! Failed oper attempt by %s using login '%s': client certificate fingerprint does not match.", user->GetFullRealHost().c_str(), parameters[0].c_str()); + ServerInstance->SNO->WriteGlobalSno('o', "WARNING! Failed oper attempt by %s using login '%s': their TLS (SSL) client certificate fingerprint does not match.", user->GetFullRealHost().c_str(), parameters[0].c_str()); return MOD_RES_DENY; } } @@ -290,21 +291,20 @@ class ModuleSSLInfo ssl_cert* const cert = ssliohook->GetCertificate(); - { - std::string text = "*** You are connected to "; - if (!ssliohook->GetServerName(text)) - text.append(ServerInstance->Config->ServerName); - text.append(" using SSL cipher '"); - ssliohook->GetCiphersuite(text); - text.push_back('\''); - if ((cert) && (!cert->GetFingerprint().empty())) - text.append(" and your SSL certificate fingerprint is ").append(cert->GetFingerprint()); - user->WriteNotice(text); - } + std::string text = "*** You are connected to "; + if (!ssliohook->GetServerName(text)) + text.append(ServerInstance->Config->ServerName); + text.append(" using TLS (SSL) cipher '"); + ssliohook->GetCiphersuite(text); + text.push_back('\''); + if (cert && !cert->GetFingerprint().empty()) + text.append(" and your TLS (SSL) client certificate fingerprint is ").append(cert->GetFingerprint()); + user->WriteNotice(text); if (!cert) return; - // find an auto-oper block for this user + + // Find an auto-oper block for this user for (ServerConfig::OperIndex::const_iterator i = ServerInstance->Config->oper_blocks.begin(); i != ServerInstance->Config->oper_blocks.end(); ++i) { OperInfo* ifo = i->second; @@ -332,6 +332,7 @@ class ModuleSSLInfo if (!ok) return MOD_RES_DENY; + return MOD_RES_PASSTHRU; } |