1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
|
/*
* Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include <znc/znc.h>
using std::map;
class CIMAPAuthMod;
class CIMAPSock : public CSocket {
public:
CIMAPSock(CIMAPAuthMod* pModule, std::shared_ptr<CAuthBase> Auth)
: CSocket((CModule*)pModule), m_spAuth(Auth) {
m_pIMAPMod = pModule;
m_bSentReply = false;
m_bSentLogin = false;
EnableReadLine();
}
~CIMAPSock() override {
if (!m_bSentReply) {
m_spAuth->RefuseLogin(
"IMAP server is down, please try again later");
}
}
void ReadLine(const CString& sLine) override;
private:
protected:
CIMAPAuthMod* m_pIMAPMod;
bool m_bSentLogin;
bool m_bSentReply;
std::shared_ptr<CAuthBase> m_spAuth;
};
class CIMAPAuthMod : public CModule {
public:
MODCONSTRUCTOR(CIMAPAuthMod) {
m_Cache.SetTTL(60000);
m_sServer = "localhost";
m_uPort = 143;
m_bSSL = false;
}
~CIMAPAuthMod() override {}
bool OnBoot() override { return true; }
bool OnLoad(const CString& sArgs, CString& sMessage) override {
if (sArgs.Trim_n().empty()) {
return true; // use defaults
}
m_sServer = sArgs.Token(0);
CString sPort = sArgs.Token(1);
m_sUserFormat = sArgs.Token(2);
if (sPort.Left(1) == "+") {
m_bSSL = true;
sPort.LeftChomp();
}
unsigned short uPort = sPort.ToUShort();
if (uPort) {
m_uPort = uPort;
}
return true;
}
EModRet OnLoginAttempt(std::shared_ptr<CAuthBase> Auth) override {
CUser* pUser = CZNC::Get().FindUser(Auth->GetUsername());
if (!pUser) {
// @todo Will want to do some sort of && !m_bAllowCreate in the
// future
Auth->RefuseLogin("Invalid User - Halting IMAP Lookup");
return HALT;
}
if (pUser &&
m_Cache.HasItem(CString(Auth->GetUsername() + ":" +
Auth->GetPassword()).MD5())) {
DEBUG("+++ Found in cache");
Auth->AcceptLogin(*pUser);
return HALT;
}
CIMAPSock* pSock = new CIMAPSock(this, Auth);
pSock->Connect(m_sServer, m_uPort, m_bSSL, 20);
return HALT;
}
void OnModCommand(const CString& sLine) override {}
void CacheLogin(const CString& sLogin) { m_Cache.AddItem(sLogin); }
// Getters
const CString& GetUserFormat() const { return m_sUserFormat; }
// !Getters
private:
// Settings
CString m_sServer;
unsigned short m_uPort;
bool m_bSSL;
CString m_sUserFormat;
// !Settings
TCacheMap<CString> m_Cache;
};
void CIMAPSock::ReadLine(const CString& sLine) {
if (!m_bSentLogin) {
CString sUsername = m_spAuth->GetUsername();
m_bSentLogin = true;
const CString& sFormat = m_pIMAPMod->GetUserFormat();
if (!sFormat.empty()) {
if (sFormat.find('%') != CString::npos) {
sUsername = sFormat.Replace_n("%", sUsername);
} else {
sUsername += sFormat;
}
}
Write("AUTH LOGIN " + sUsername + " " + m_spAuth->GetPassword() +
"\r\n");
} else if (sLine.Left(5) == "AUTH ") {
CUser* pUser = CZNC::Get().FindUser(m_spAuth->GetUsername());
if (pUser && sLine.StartsWith("AUTH OK")) {
m_spAuth->AcceptLogin(*pUser);
// Use MD5 so passes don't sit in memory in plain text
m_pIMAPMod->CacheLogin(CString(m_spAuth->GetUsername() + ":" +
m_spAuth->GetPassword()).MD5());
DEBUG("+++ Successful IMAP lookup");
} else {
m_spAuth->RefuseLogin("Invalid Password");
DEBUG("--- FAILED IMAP lookup");
}
m_bSentReply = true;
Close();
}
}
template <>
void TModInfo<CIMAPAuthMod>(CModInfo& Info) {
Info.SetWikiPage("imapauth");
Info.SetHasArgs(true);
Info.SetArgsHelpText(Info.t_s("[ server [+]port [ UserFormatString ] ]"));
}
GLOBALMODULEDEFS(CIMAPAuthMod, t_s("Allow users to authenticate via IMAP."))
|
