pegasus/unrealircd
1
0
Fork 0
mirror of https://github.com/unrealircd/unrealircd.git synced 2026-07-07 18:03:12 +02:00
Code Activity

Mention https://www.unrealircd.org/docs/FAQ#oper-requires-tls on OPER attempt

Browse Source 
form an insecure connection. There we explain a bit on the why and how to
configure some random IRC clients.
This also silently adds support for multi-line messages in
set::plaintext-policy::user-message (for warn) and
set::plaintext-policy::oper-message (for warn and deny).
This commit is contained in:
Bram Matthys
2020-03-06 08:58:55 +01:00
parent 6224efdaf3
commit 32170b81e3
5 changed files with 18 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/dynconf.h
+2 -2
View File
@@ -97,9 +97,9 @@ struct Configuration {
char *static_part;
TLSOptions *tls_options;
Policy plaintext_policy_user;
char *plaintext_policy_user_message;
MultiLine *plaintext_policy_user_message;
Policy plaintext_policy_oper;
char *plaintext_policy_oper_message;
MultiLine *plaintext_policy_oper_message;
Policy plaintext_policy_server;
Policy outdated_tls_policy_user;
char *outdated_tls_policy_user_message;
include/h.h
+1
View File
@@ -958,6 +958,7 @@ extern char *filename_add_suffix(const char *fname, const char *suffix);
extern int filename_has_suffix(const char *fname, const char *suffix);
extern void addmultiline(MultiLine **l, char *line);
extern void freemultiline(MultiLine *l);
#define safe_free_multiline(x) do { if (x) freemultiline(x); x = NULL; } while(0)
extern void sendnotice_multiline(Client *client, MultiLine *m);
extern void unreal_del_quotes(char *i);
extern char *unreal_add_quotes(char *str);
src/conf.c
+11 -8
View File
@@ -1586,8 +1586,8 @@ void free_iConf(Configuration *i)
free_tls_options(i->tls_options);
i->tls_options = NULL;
safe_free(i->tls_options);
safe_free(i->plaintext_policy_user_message);
safe_free(i->plaintext_policy_oper_message);
safe_free_multiline(i->plaintext_policy_user_message);
safe_free_multiline(i->plaintext_policy_oper_message);
safe_free(i->outdated_tls_policy_user_message);
safe_free(i->outdated_tls_policy_oper_message);
safe_free(i->restrict_usermodes);
@@ -1742,18 +1742,21 @@ void postconf_defaults(void)
{
/* The message depends on whether it's reject or warn.. */
if (iConf.plaintext_policy_user == POLICY_DENY)
safe_strdup(iConf.plaintext_policy_user_message, "Insecure connection. Please reconnect using SSL/TLS.");
addmultiline(&iConf.plaintext_policy_user_message, "Insecure connection. Please reconnect using SSL/TLS.");
else if (iConf.plaintext_policy_user == POLICY_WARN)
safe_strdup(iConf.plaintext_policy_user_message, "WARNING: Insecure connection. Please consider using SSL/TLS.");
addmultiline(&iConf.plaintext_policy_user_message, "WARNING: Insecure connection. Please consider using SSL/TLS.");
}
if (!iConf.plaintext_policy_oper_message)
{
/* The message depends on whether it's reject or warn.. */
if (iConf.plaintext_policy_oper == POLICY_DENY)
safe_strdup(iConf.plaintext_policy_oper_message, "You need to use a secure connection (SSL/TLS) in order to /OPER.");
{
addmultiline(&iConf.plaintext_policy_oper_message, "You need to use a secure connection (SSL/TLS) in order to /OPER.");
addmultiline(&iConf.plaintext_policy_oper_message, "See https://www.unrealircd.org/docs/FAQ#oper-requires-tls");
}
else if (iConf.plaintext_policy_oper == POLICY_WARN)
safe_strdup(iConf.plaintext_policy_oper_message, "WARNING: You /OPER'ed up from an insecure connection. Please consider using SSL/TLS.");
addmultiline(&iConf.plaintext_policy_oper_message, "WARNING: You /OPER'ed up from an insecure connection. Please consider using SSL/TLS.");
}
if (!iConf.outdated_tls_policy_user_message)
@@ -7674,9 +7677,9 @@ int _conf_set(ConfigFile *conf, ConfigEntry *ce)
else if (!strcmp(cepp->ce_varname, "server"))
tempiConf.plaintext_policy_server = policy_strtoval(cepp->ce_vardata);
else if (!strcmp(cepp->ce_varname, "user-message"))
safe_strdup(tempiConf.plaintext_policy_user_message, cepp->ce_vardata);
addmultiline(&tempiConf.plaintext_policy_user_message, cepp->ce_vardata);
else if (!strcmp(cepp->ce_varname, "oper-message"))
safe_strdup(tempiConf.plaintext_policy_oper_message, cepp->ce_vardata);
addmultiline(&tempiConf.plaintext_policy_oper_message, cepp->ce_vardata);
}
}
else if (!strcmp(cep->ce_varname, "outdated-tls-policy"))
src/modules/nick.c
+2 -2
View File
@@ -1085,7 +1085,7 @@ int _register_user(Client *client, char *nick, char *username, char *umode, char
sendnumeric(client, RPL_SNOMASK, get_snomask_string_raw(user->snomask));
if (!IsSecure(client) && !IsLocalhost(client) && (iConf.plaintext_policy_user == POLICY_WARN))
sendnotice(client, "%s", iConf.plaintext_policy_user_message);
sendnotice_multiline(client, iConf.plaintext_policy_user_message);
if (IsSecure(client) && (iConf.outdated_tls_policy_user == POLICY_WARN) && outdated_tls_client(client))
sendnotice(client, "%s", outdated_tls_client_build_string(iConf.outdated_tls_policy_user_message, client));
@@ -1300,7 +1300,7 @@ int AllowClient(Client *client, char *username)
if (!IsSecure(client) && !IsLocalhost(client) && (iConf.plaintext_policy_user == POLICY_DENY))
{
exit_client(client, NULL, iConf.plaintext_policy_user_message);
exit_client(client, NULL, iConf.plaintext_policy_user_message->line);
return 0;
}
src/modules/oper.c
+2 -2
View File
@@ -114,7 +114,7 @@ CMD_FUNC(cmd_oper)
/* set::plaintext-policy::oper 'deny' */
if (!IsSecure(client) && !IsLocalhost(client) && (iConf.plaintext_policy_oper == POLICY_DENY))
{
sendnotice(client, "%s", iConf.plaintext_policy_oper_message);
sendnotice_multiline(client, iConf.plaintext_policy_oper_message);
sendto_snomask_global
(SNO_OPER, "Failed OPER attempt by %s (%s@%s) [not using SSL/TLS]",
client->name, client->user->username, client->local->sockhost);
@@ -315,7 +315,7 @@ CMD_FUNC(cmd_oper)
/* set::plaintext-policy::oper 'warn' */
if (!IsSecure(client) && !IsLocalhost(client) && (iConf.plaintext_policy_oper == POLICY_WARN))
{
sendnotice(client, "%s", iConf.plaintext_policy_oper_message);
sendnotice_multiline(client, iConf.plaintext_policy_oper_message);
sendto_snomask_global
(SNO_OPER, "OPER %s [%s] used an insecure (non-SSL/TLS) connection to /OPER.",
client->name, name);