Add initial support for client certificate fingerprints

Networks such as Freenode and OFTC use client certificates to identify
users and servers, not only for services, but also for server operator
status and auth blocks.

This allows us to use stronger certificates for authentication rather
than passwords.

1 files changed, 13 insertions, 7 deletions

diff --git a/src/hostmask.c b/src/hostmask.c
index 5c34013..220b5c6 100644
--- a/src/hostmask.c
+++ b/src/hostmask.c
@@ -455,7 +455,8 @@ get_mask_hash(const char *text)
  */
 struct MaskItem *
 find_conf_by_address(const char *name, struct irc_ssaddr *addr, unsigned int type,
-                     int fam, const char *username, const char *password, int do_match)
+                     int fam, const char *username, const char *password, int do_match,
+                     const char *certfp)
 {
   unsigned int hprecv = 0;
   dlink_node *ptr = NULL;
@@ -481,6 +482,7 @@ find_conf_by_address(const char *name, struct irc_ssaddr *addr, unsigned int typ
               arec->masktype == HM_IPV6 &&
               match_ipv6(addr, &arec->Mask.ipa.addr,
                          arec->Mask.ipa.bits) &&
+	      (!arec->conf->certfp || (certfp && !strcmp(arec->conf->certfp, certfp))) &&
               (!username || !cmpfunc(arec->username, username)) &&
               (IsNeedPassword(arec->conf) || arec->conf->passwd == NULL ||
                match_conf_password(password, arec->conf)))
@@ -506,6 +508,7 @@ find_conf_by_address(const char *name, struct irc_ssaddr *addr, unsigned int typ
               arec->masktype == HM_IPV4 &&
               match_ipv4(addr, &arec->Mask.ipa.addr,
                          arec->Mask.ipa.bits) &&
+	      (!arec->conf->certfp || (certfp && !strcmp(arec->conf->certfp, certfp))) &&
               (!username || !cmpfunc(arec->username, username)) &&
               (IsNeedPassword(arec->conf) || arec->conf->passwd == NULL ||
                match_conf_password(password, arec->conf)))
@@ -531,6 +534,7 @@ find_conf_by_address(const char *name, struct irc_ssaddr *addr, unsigned int typ
             arec->precedence > hprecv &&
             (arec->masktype == HM_HOST) &&
             !cmpfunc(arec->Mask.hostname, name) &&
+	    (!arec->conf->certfp || (certfp && !strcmp(arec->conf->certfp, certfp))) &&
             (!username || !cmpfunc(arec->username, username)) &&
             (IsNeedPassword(arec->conf) || arec->conf->passwd == NULL ||
              match_conf_password(password, arec->conf)))
@@ -553,6 +557,7 @@ find_conf_by_address(const char *name, struct irc_ssaddr *addr, unsigned int typ
           arec->precedence > hprecv &&
           arec->masktype == HM_HOST &&
           !cmpfunc(arec->Mask.hostname, name) &&
+          (!arec->conf->certfp || (certfp && !strcmp(arec->conf->certfp, certfp))) &&
           (!username || !cmpfunc(arec->username, username)) &&
           (IsNeedPassword(arec->conf) || arec->conf->passwd == NULL ||
            match_conf_password(password, arec->conf)))
@@ -574,13 +579,14 @@ find_conf_by_address(const char *name, struct irc_ssaddr *addr, unsigned int typ
  */
 struct MaskItem *
 find_address_conf(const char *host, const char *user,
-                  struct irc_ssaddr *ip, int aftype, char *password)
+                  struct irc_ssaddr *ip, int aftype, char *password,
+                  const char *certfp)
 {
   struct MaskItem *authcnf = NULL, *killcnf = NULL;
 
   /* Find the best auth{} block... If none, return NULL -A1kmm */
   if ((authcnf = find_conf_by_address(host, ip, CONF_CLIENT, aftype, user,
-                                      password, 1)) == NULL)
+                                      password, 1, certfp)) == NULL)
     return NULL;
 
   /* If they are exempt from K-lines, return the best auth{} block. -A1kmm */
@@ -588,7 +594,7 @@ find_address_conf(const char *host, const char *user,
     return authcnf;
 
   /* Find the best K-line... -A1kmm */
-  killcnf = find_conf_by_address(host, ip, CONF_KLINE, aftype, user, NULL, 1);
+  killcnf = find_conf_by_address(host, ip, CONF_KLINE, aftype, user, NULL, 1, NULL);
 
   /*
    * If they are K-lined, return the K-line. Otherwise, return the
@@ -600,7 +606,7 @@ find_address_conf(const char *host, const char *user,
   if (IsConfExemptGline(authcnf))
     return authcnf;
 
-  killcnf = find_conf_by_address(host, ip, CONF_GLINE, aftype, user, NULL, 1);
+  killcnf = find_conf_by_address(host, ip, CONF_GLINE, aftype, user, NULL, 1, NULL);
   if (killcnf != NULL)
     return killcnf;
 
@@ -618,11 +624,11 @@ find_dline_conf(struct irc_ssaddr *addr, int aftype)
 {
   struct MaskItem *eline;
 
-  eline = find_conf_by_address(NULL, addr, CONF_EXEMPT, aftype, NULL, NULL, 1);
+  eline = find_conf_by_address(NULL, addr, CONF_EXEMPT, aftype, NULL, NULL, 1, NULL);
   if (eline != NULL)
     return eline;
 
-  return find_conf_by_address(NULL, addr, CONF_DLINE, aftype, NULL, NULL, 1);
+  return find_conf_by_address(NULL, addr, CONF_DLINE, aftype, NULL, NULL, 1, NULL);
 }
 
 /* void add_conf_by_address(int, struct MaskItem *aconf)