From 32170b81e3095fe50800b0f4fc76ebb86fb4ed23 Mon Sep 17 00:00:00 2001 From: Bram Matthys Date: Fri, 6 Mar 2020 08:58:55 +0100 Subject: [PATCH] Mention https://www.unrealircd.org/docs/FAQ#oper-requires-tls on OPER attempt form an insecure connection. There we explain a bit on the why and how to configure some random IRC clients. This also silently adds support for multi-line messages in set::plaintext-policy::user-message (for warn) and set::plaintext-policy::oper-message (for warn and deny). --- include/dynconf.h | 4 ++-- include/h.h | 1 + src/conf.c | 19 +++++++++++-------- src/modules/nick.c | 4 ++-- src/modules/oper.c | 4 ++-- 5 files changed, 18 insertions(+), 14 deletions(-) diff --git a/include/dynconf.h b/include/dynconf.h index 07f96983f..675063bcf 100644 --- a/include/dynconf.h +++ b/include/dynconf.h @@ -97,9 +97,9 @@ struct Configuration { char *static_part; TLSOptions *tls_options; Policy plaintext_policy_user; - char *plaintext_policy_user_message; + MultiLine *plaintext_policy_user_message; Policy plaintext_policy_oper; - char *plaintext_policy_oper_message; + MultiLine *plaintext_policy_oper_message; Policy plaintext_policy_server; Policy outdated_tls_policy_user; char *outdated_tls_policy_user_message; diff --git a/include/h.h b/include/h.h index a31729d4d..39e2125b7 100644 --- a/include/h.h +++ b/include/h.h @@ -958,6 +958,7 @@ extern char *filename_add_suffix(const char *fname, const char *suffix); extern int filename_has_suffix(const char *fname, const char *suffix); extern void addmultiline(MultiLine **l, char *line); extern void freemultiline(MultiLine *l); +#define safe_free_multiline(x) do { if (x) freemultiline(x); x = NULL; } while(0) extern void sendnotice_multiline(Client *client, MultiLine *m); extern void unreal_del_quotes(char *i); extern char *unreal_add_quotes(char *str); diff --git a/src/conf.c b/src/conf.c index e65ebeef2..207955b06 100644 --- a/src/conf.c +++ b/src/conf.c @@ -1586,8 +1586,8 @@ void free_iConf(Configuration *i) free_tls_options(i->tls_options); i->tls_options = NULL; safe_free(i->tls_options); - safe_free(i->plaintext_policy_user_message); - safe_free(i->plaintext_policy_oper_message); + safe_free_multiline(i->plaintext_policy_user_message); + safe_free_multiline(i->plaintext_policy_oper_message); safe_free(i->outdated_tls_policy_user_message); safe_free(i->outdated_tls_policy_oper_message); safe_free(i->restrict_usermodes); @@ -1742,18 +1742,21 @@ void postconf_defaults(void) { /* The message depends on whether it's reject or warn.. */ if (iConf.plaintext_policy_user == POLICY_DENY) - safe_strdup(iConf.plaintext_policy_user_message, "Insecure connection. Please reconnect using SSL/TLS."); + addmultiline(&iConf.plaintext_policy_user_message, "Insecure connection. Please reconnect using SSL/TLS."); else if (iConf.plaintext_policy_user == POLICY_WARN) - safe_strdup(iConf.plaintext_policy_user_message, "WARNING: Insecure connection. Please consider using SSL/TLS."); + addmultiline(&iConf.plaintext_policy_user_message, "WARNING: Insecure connection. Please consider using SSL/TLS."); } if (!iConf.plaintext_policy_oper_message) { /* The message depends on whether it's reject or warn.. */ if (iConf.plaintext_policy_oper == POLICY_DENY) - safe_strdup(iConf.plaintext_policy_oper_message, "You need to use a secure connection (SSL/TLS) in order to /OPER."); + { + addmultiline(&iConf.plaintext_policy_oper_message, "You need to use a secure connection (SSL/TLS) in order to /OPER."); + addmultiline(&iConf.plaintext_policy_oper_message, "See https://www.unrealircd.org/docs/FAQ#oper-requires-tls"); + } else if (iConf.plaintext_policy_oper == POLICY_WARN) - safe_strdup(iConf.plaintext_policy_oper_message, "WARNING: You /OPER'ed up from an insecure connection. Please consider using SSL/TLS."); + addmultiline(&iConf.plaintext_policy_oper_message, "WARNING: You /OPER'ed up from an insecure connection. Please consider using SSL/TLS."); } if (!iConf.outdated_tls_policy_user_message) @@ -7674,9 +7677,9 @@ int _conf_set(ConfigFile *conf, ConfigEntry *ce) else if (!strcmp(cepp->ce_varname, "server")) tempiConf.plaintext_policy_server = policy_strtoval(cepp->ce_vardata); else if (!strcmp(cepp->ce_varname, "user-message")) - safe_strdup(tempiConf.plaintext_policy_user_message, cepp->ce_vardata); + addmultiline(&tempiConf.plaintext_policy_user_message, cepp->ce_vardata); else if (!strcmp(cepp->ce_varname, "oper-message")) - safe_strdup(tempiConf.plaintext_policy_oper_message, cepp->ce_vardata); + addmultiline(&tempiConf.plaintext_policy_oper_message, cepp->ce_vardata); } } else if (!strcmp(cep->ce_varname, "outdated-tls-policy")) diff --git a/src/modules/nick.c b/src/modules/nick.c index daf1e9d91..9cf9704c2 100644 --- a/src/modules/nick.c +++ b/src/modules/nick.c @@ -1085,7 +1085,7 @@ int _register_user(Client *client, char *nick, char *username, char *umode, char sendnumeric(client, RPL_SNOMASK, get_snomask_string_raw(user->snomask)); if (!IsSecure(client) && !IsLocalhost(client) && (iConf.plaintext_policy_user == POLICY_WARN)) - sendnotice(client, "%s", iConf.plaintext_policy_user_message); + sendnotice_multiline(client, iConf.plaintext_policy_user_message); if (IsSecure(client) && (iConf.outdated_tls_policy_user == POLICY_WARN) && outdated_tls_client(client)) sendnotice(client, "%s", outdated_tls_client_build_string(iConf.outdated_tls_policy_user_message, client)); @@ -1300,7 +1300,7 @@ int AllowClient(Client *client, char *username) if (!IsSecure(client) && !IsLocalhost(client) && (iConf.plaintext_policy_user == POLICY_DENY)) { - exit_client(client, NULL, iConf.plaintext_policy_user_message); + exit_client(client, NULL, iConf.plaintext_policy_user_message->line); return 0; } diff --git a/src/modules/oper.c b/src/modules/oper.c index f9776cf57..ee7d89a84 100644 --- a/src/modules/oper.c +++ b/src/modules/oper.c @@ -114,7 +114,7 @@ CMD_FUNC(cmd_oper) /* set::plaintext-policy::oper 'deny' */ if (!IsSecure(client) && !IsLocalhost(client) && (iConf.plaintext_policy_oper == POLICY_DENY)) { - sendnotice(client, "%s", iConf.plaintext_policy_oper_message); + sendnotice_multiline(client, iConf.plaintext_policy_oper_message); sendto_snomask_global (SNO_OPER, "Failed OPER attempt by %s (%s@%s) [not using SSL/TLS]", client->name, client->user->username, client->local->sockhost); @@ -315,7 +315,7 @@ CMD_FUNC(cmd_oper) /* set::plaintext-policy::oper 'warn' */ if (!IsSecure(client) && !IsLocalhost(client) && (iConf.plaintext_policy_oper == POLICY_WARN)) { - sendnotice(client, "%s", iConf.plaintext_policy_oper_message); + sendnotice_multiline(client, iConf.plaintext_policy_oper_message); sendto_snomask_global (SNO_OPER, "OPER %s [%s] used an insecure (non-SSL/TLS) connection to /OPER.", client->name, name);