1 files changed, 86 insertions, 35 deletions

diff --git a/src/modules/m_sqlauth.cpp b/src/modules/m_sqlauth.cpp
index df97145be..5c3c5a84e 100644
--- a/src/modules/m_sqlauth.cpp
+++ b/src/modules/m_sqlauth.cpp
@@ -18,10 +18,9 @@
 
 
 #include "inspircd.h"
-#include "sql.h"
-#include "hash.h"
-
-/* $ModDesc: Allow/Deny connections based upon an arbitrary SQL table */
+#include "modules/sql.h"
+#include "modules/hash.h"
+#include "modules/ssl.h"
 
 enum AuthState {
 	AUTH_STATE_NONE = 0,
@@ -29,24 +28,69 @@ enum AuthState {
 	AUTH_STATE_FAIL = 2
 };
 
-class AuthQuery : public SQLQuery
+class AuthQuery : public SQL::Query
 {
  public:
 	const std::string uid;
 	LocalIntExt& pendingExt;
 	bool verbose;
-	AuthQuery(Module* me, const std::string& u, LocalIntExt& e, bool v)
-		: SQLQuery(me), uid(u), pendingExt(e), verbose(v)
+	const std::string& kdf;
+	const std::string& pwcolumn;
+
+	AuthQuery(Module* me, const std::string& u, LocalIntExt& e, bool v, const std::string& kd, const std::string& pwcol)
+		: SQL::Query(me)
+		, uid(u)
+		, pendingExt(e)
+		, verbose(v)
+		, kdf(kd)
+		, pwcolumn(pwcol)
 	{
 	}
-	
-	void OnResult(SQLResult& res)
+
+	void OnResult(SQL::Result& res) CXX11_OVERRIDE
 	{
-		User* user = ServerInstance->FindNick(uid);
+		LocalUser* user = static_cast<LocalUser*>(ServerInstance->FindUUID(uid));
 		if (!user)
 			return;
+
 		if (res.Rows())
 		{
+			if (!kdf.empty())
+			{
+				HashProvider* hashprov = ServerInstance->Modules->FindDataService<HashProvider>("hash/" + kdf);
+				if (!hashprov)
+				{
+					if (verbose)
+						ServerInstance->SNO->WriteGlobalSno('a', "Forbidden connection from %s (a provider for %s was not loaded)", user->GetFullRealHost().c_str(), kdf.c_str());
+					pendingExt.set(user, AUTH_STATE_FAIL);
+					return;
+				}
+
+				size_t colindex = 0;
+				if (!pwcolumn.empty() && !res.HasColumn(pwcolumn, colindex))
+				{
+					if (verbose)
+						ServerInstance->SNO->WriteGlobalSno('a', "Forbidden connection from %s (the column specified (%s) was not returned)", user->GetFullRealHost().c_str(), pwcolumn.c_str());
+					pendingExt.set(user, AUTH_STATE_FAIL);
+					return;
+				}
+
+				SQL::Row row;
+				while (res.GetRow(row))
+				{
+					if (hashprov->Compare(user->password, row[colindex]))
+					{
+						pendingExt.set(user, AUTH_STATE_NONE);
+						return;
+					}
+				}
+
+				if (verbose)
+					ServerInstance->SNO->WriteGlobalSno('a', "Forbidden connection from %s (Password from the SQL query did not match the user provided password)", user->GetFullRealHost().c_str());
+				pendingExt.set(user, AUTH_STATE_FAIL);
+				return;
+			}
+
 			pendingExt.set(user, AUTH_STATE_NONE);
 		}
 		else
@@ -57,41 +101,38 @@ class AuthQuery : public SQLQuery
 		}
 	}
 
-	void OnError(SQLerror& error)
+	void OnError(SQL::Error& error) CXX11_OVERRIDE
 	{
 		User* user = ServerInstance->FindNick(uid);
 		if (!user)
 			return;
 		pendingExt.set(user, AUTH_STATE_FAIL);
 		if (verbose)
-			ServerInstance->SNO->WriteGlobalSno('a', "Forbidden connection from %s (SQL query failed: %s)", user->GetFullRealHost().c_str(), error.Str());
+			ServerInstance->SNO->WriteGlobalSno('a', "Forbidden connection from %s (SQL query failed: %s)", user->GetFullRealHost().c_str(), error.ToString());
 	}
 };
 
 class ModuleSQLAuth : public Module
 {
 	LocalIntExt pendingExt;
-	dynamic_reference<SQLProvider> SQL;
+	dynamic_reference<SQL::Provider> SQL;
 
 	std::string freeformquery;
 	std::string killreason;
 	std::string allowpattern;
 	bool verbose;
+	std::vector<std::string> hash_algos;
+	std::string kdf;
+	std::string pwcolumn;
 
  public:
-	ModuleSQLAuth() : pendingExt("sqlauth-wait", this), SQL(this, "SQL")
+	ModuleSQLAuth()
+		: pendingExt("sqlauth-wait", ExtensionItem::EXT_USER, this)
+		, SQL(this, "SQL")
 	{
 	}
 
-	void init()
-	{
-		ServerInstance->Modules->AddService(pendingExt);
-		OnRehash(NULL);
-		Implementation eventlist[] = { I_OnCheckReady, I_OnRehash, I_OnUserRegister };
-		ServerInstance->Modules->Attach(eventlist, this, sizeof(eventlist)/sizeof(Implementation));
-	}
-
-	void OnRehash(User* user)
+	void ReadConfig(ConfigStatus& status) CXX11_OVERRIDE
 	{
 		ConfigTag* conf = ServerInstance->Config->ConfValue("sqlauth");
 		std::string dbid = conf->getString("dbid");
@@ -103,9 +144,17 @@ class ModuleSQLAuth : public Module
 		killreason = conf->getString("killreason");
 		allowpattern = conf->getString("allowpattern");
 		verbose = conf->getBool("verbose");
+		kdf = conf->getString("kdf");
+		pwcolumn = conf->getString("column");
+
+		hash_algos.clear();
+		irc::commasepstream algos(conf->getString("hash", "md5,sha256"));
+		std::string algo;
+		while (algos.GetToken(algo))
+			hash_algos.push_back(algo);
 	}
 
-	ModResult OnUserRegister(LocalUser* user)
+	ModResult OnUserRegister(LocalUser* user) CXX11_OVERRIDE
 	{
 		// Note this is their initial (unresolved) connect block
 		ConfigTag* tag = user->MyClass->config;
@@ -127,24 +176,26 @@ class ModuleSQLAuth : public Module
 
 		pendingExt.set(user, AUTH_STATE_BUSY);
 
-		ParamM userinfo;
-		SQL->PopulateUserInfo(user, userinfo);
+		SQL::ParamMap userinfo;
+		SQL::PopulateUserInfo(user, userinfo);
 		userinfo["pass"] = user->password;
 
-		HashProvider* md5 = ServerInstance->Modules->FindDataService<HashProvider>("hash/md5");
-		if (md5)
-			userinfo["md5pass"] = md5->hexsum(user->password);
+		for (std::vector<std::string>::const_iterator it = hash_algos.begin(); it != hash_algos.end(); ++it)
+		{
+			HashProvider* hashprov = ServerInstance->Modules->FindDataService<HashProvider>("hash/" + *it);
+			if (hashprov && !hashprov->IsKDF())
+				userinfo[*it + "pass"] = hashprov->Generate(user->password);
+		}
 
-		HashProvider* sha256 = ServerInstance->Modules->FindDataService<HashProvider>("hash/sha256");
-		if (sha256)
-			userinfo["sha256pass"] = sha256->hexsum(user->password);
+		const std::string certfp = SSLClientCert::GetFingerprint(&user->eh);
+		userinfo["certfp"] = certfp;
 
-		SQL->submit(new AuthQuery(this, user->uuid, pendingExt, verbose), freeformquery, userinfo);
+		SQL->Submit(new AuthQuery(this, user->uuid, pendingExt, verbose, kdf, pwcolumn), freeformquery, userinfo);
 
 		return MOD_RES_PASSTHRU;
 	}
 
-	ModResult OnCheckReady(LocalUser* user)
+	ModResult OnCheckReady(LocalUser* user) CXX11_OVERRIDE
 	{
 		switch (pendingExt.get(user))
 		{
@@ -159,7 +210,7 @@ class ModuleSQLAuth : public Module
 		return MOD_RES_PASSTHRU;
 	}
 
-	Version GetVersion()
+	Version GetVersion() CXX11_OVERRIDE
 	{
 		return Version("Allow/Deny connections based upon an arbitrary SQL table", VF_VENDOR);
 	}