From ff766773bc547b03ffa3a15cb1c89896a2a7b8cf Mon Sep 17 00:00:00 2001 From: Sadie Powell Date: Sat, 29 Aug 2020 19:21:06 +0100 Subject: Warn about non-local plaintext server connections. --- src/modules/m_spanningtree/server.cpp | 4 ++++ src/modules/m_spanningtree/treesocket.h | 1 + src/modules/m_spanningtree/treesocket1.cpp | 18 ++++++++++++++---- 3 files changed, 19 insertions(+), 4 deletions(-) (limited to 'src/modules') diff --git a/src/modules/m_spanningtree/server.cpp b/src/modules/m_spanningtree/server.cpp index c635856e3..b55743659 100644 --- a/src/modules/m_spanningtree/server.cpp +++ b/src/modules/m_spanningtree/server.cpp @@ -141,6 +141,10 @@ Link* TreeSocket::AuthRemote(const CommandBase::Params& params) ssliohook->GetCiphersuite(ciphersuite); ServerInstance->SNO->WriteToSnoMask('l', "Negotiated ciphersuite %s on link %s", ciphersuite.c_str(), x->Name.c_str()); } + else if (!irc::sockets::cidr_mask("127.0.0.0/8").match(capab->remotesa) && !irc::sockets::cidr_mask("::1/128").match(capab->remotesa)) + { + ServerInstance->SNO->WriteGlobalSno('l', "Server connection to %s is not using SSL (TLS). This is VERY INSECURE and will not be allowed the next major version of InspIRCd.", x->Name.c_str()); + } return x; } diff --git a/src/modules/m_spanningtree/treesocket.h b/src/modules/m_spanningtree/treesocket.h index 046f0eb0a..0d3d515d0 100644 --- a/src/modules/m_spanningtree/treesocket.h +++ b/src/modules/m_spanningtree/treesocket.h @@ -80,6 +80,7 @@ struct CapabData int capab_phase; /* Have sent CAPAB already */ bool auth_fingerprint; /* Did we auth using SSL certificate fingerprint */ bool auth_challenge; /* Did we auth using challenge/response */ + irc::sockets::sockaddrs remotesa; /* The remote socket address. */ // Data saved from incoming SERVER command, for later use when our credentials have been accepted by the other party std::string description; diff --git a/src/modules/m_spanningtree/treesocket1.cpp b/src/modules/m_spanningtree/treesocket1.cpp index 5bc41ea64..ad69c42fa 100644 --- a/src/modules/m_spanningtree/treesocket1.cpp +++ b/src/modules/m_spanningtree/treesocket1.cpp @@ -40,13 +40,18 @@ * and only do minor initialization tasks ourselves. */ TreeSocket::TreeSocket(Link* link, Autoconnect* myac, const irc::sockets::sockaddrs& dest) - : linkID(link->Name), LinkState(CONNECTING), MyRoot(NULL), proto_version(0) - , burstsent(false), age(ServerInstance->Time()) + : linkID(link->Name) + , LinkState(CONNECTING) + , MyRoot(NULL) + , proto_version(0) + , burstsent(false) + , age(ServerInstance->Time()) { capab = new CapabData; capab->link = link; capab->ac = myac; capab->capab_phase = 0; + capab->remotesa = dest; irc::sockets::sockaddrs bind; memset(&bind, 0, sizeof(bind)); @@ -77,11 +82,16 @@ TreeSocket::TreeSocket(Link* link, Autoconnect* myac, const irc::sockets::sockad */ TreeSocket::TreeSocket(int newfd, ListenSocket* via, irc::sockets::sockaddrs* client, irc::sockets::sockaddrs* server) : BufferedSocket(newfd) - , linkID("inbound from " + client->addr()), LinkState(WAIT_AUTH_1), MyRoot(NULL), proto_version(0) - , burstsent(false), age(ServerInstance->Time()) + , linkID("inbound from " + client->addr()) + , LinkState(WAIT_AUTH_1) + , MyRoot(NULL) + , proto_version(0) + , burstsent(false) + , age(ServerInstance->Time()) { capab = new CapabData; capab->capab_phase = 0; + capab->remotesa = *client; for (ListenSocket::IOHookProvList::iterator i = via->iohookprovs.begin(); i != via->iohookprovs.end(); ++i) { -- cgit v1.3.1-10-gc9f91 From e1ebec0e7255ad500cba6b9f79f318366a00a13a Mon Sep 17 00:00:00 2001 From: Sadie Powell Date: Sat, 29 Aug 2020 22:17:52 +0100 Subject: Fix a word missing from the last commit. --- src/modules/m_spanningtree/server.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/modules') diff --git a/src/modules/m_spanningtree/server.cpp b/src/modules/m_spanningtree/server.cpp index b55743659..536c4424d 100644 --- a/src/modules/m_spanningtree/server.cpp +++ b/src/modules/m_spanningtree/server.cpp @@ -143,7 +143,7 @@ Link* TreeSocket::AuthRemote(const CommandBase::Params& params) } else if (!irc::sockets::cidr_mask("127.0.0.0/8").match(capab->remotesa) && !irc::sockets::cidr_mask("::1/128").match(capab->remotesa)) { - ServerInstance->SNO->WriteGlobalSno('l', "Server connection to %s is not using SSL (TLS). This is VERY INSECURE and will not be allowed the next major version of InspIRCd.", x->Name.c_str()); + ServerInstance->SNO->WriteGlobalSno('l', "Server connection to %s is not using SSL (TLS). This is VERY INSECURE and will not be allowed in the next major version of InspIRCd.", x->Name.c_str()); } return x; -- cgit v1.3.1-10-gc9f91 From 47aab9623c962baad5ddf50ad3d56a46dd3ddf45 Mon Sep 17 00:00:00 2001 From: Sadie Powell Date: Wed, 16 Sep 2020 22:32:22 +0100 Subject: Make it clear that , , and are deprecated. --- src/modules/extra/m_ssl_gnutls.cpp | 2 +- src/modules/extra/m_ssl_mbedtls.cpp | 2 +- src/modules/extra/m_ssl_openssl.cpp | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) (limited to 'src/modules') diff --git a/src/modules/extra/m_ssl_gnutls.cpp b/src/modules/extra/m_ssl_gnutls.cpp index 0846aaa2d..f79fa43de 100644 --- a/src/modules/extra/m_ssl_gnutls.cpp +++ b/src/modules/extra/m_ssl_gnutls.cpp @@ -1300,7 +1300,7 @@ class ModuleSSLGnuTLS : public Module // No tags found, create a profile named "gnutls" from settings in the block const std::string defname = "gnutls"; ConfigTag* tag = ServerInstance->Config->ConfValue(defname); - ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "No tags found; using settings from the tag"); + ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "No tags found; using settings from the deprecated tag"); try { diff --git a/src/modules/extra/m_ssl_mbedtls.cpp b/src/modules/extra/m_ssl_mbedtls.cpp index 83b9d0595..ecf4e660a 100644 --- a/src/modules/extra/m_ssl_mbedtls.cpp +++ b/src/modules/extra/m_ssl_mbedtls.cpp @@ -874,7 +874,7 @@ class ModuleSSLmbedTLS : public Module // No tags found, create a profile named "mbedtls" from settings in the block const std::string defname = "mbedtls"; ConfigTag* tag = ServerInstance->Config->ConfValue(defname); - ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "No tags found; using settings from the tag"); + ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "No tags found; using settings from the deprecated tag"); try { diff --git a/src/modules/extra/m_ssl_openssl.cpp b/src/modules/extra/m_ssl_openssl.cpp index 0c6122b4d..7880ebd56 100644 --- a/src/modules/extra/m_ssl_openssl.cpp +++ b/src/modules/extra/m_ssl_openssl.cpp @@ -986,7 +986,7 @@ class ModuleSSLOpenSSL : public Module // Create a default profile named "openssl" const std::string defname = "openssl"; ConfigTag* tag = ServerInstance->Config->ConfValue(defname); - ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "No tags found, using settings from the tag"); + ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "No tags found, using settings from the deprecated tag"); try { -- cgit v1.3.1-10-gc9f91