--- sbbs/src/sbbs3/login.cpp	2018/04/24 16:41:23	1.1.1.1
+++ sbbs/src/sbbs3/login.cpp	2018/04/24 16:43:19	1.1.1.2
@@ -2,13 +2,13 @@
 
 /* Synchronet user login routine */
 
-/* $Id: login.cpp,v 1.1.1.1 2018/04/24 16:41:23 root Exp $ */
+/* $Id: login.cpp,v 1.1.1.2 2018/04/24 16:43:19 root Exp $ */
 
 /****************************************************************************
  * @format.tab-size 4		(Plain Text/Source Code File Header)			*
  * @format.use-tabs true	(see http://www.synchro.net/ptsc_hdr.html)		*
  *																			*
- * Copyright 2006 Rob Swindell - http://www.synchro.net/copyright.html		*
+ * Copyright 2011 Rob Swindell - http://www.synchro.net/copyright.html		*
  *																			*
  * This program is free software; you can redistribute it and/or			*
  * modify it under the terms of the GNU General Public License				*
@@ -54,33 +54,37 @@ int sbbs_t::login(char *username, char *
 
 	if(str[0]=='*') {
 		memmove(str,str+1,strlen(str));
-		qwklogon=1; }
+		qwklogon=1; 
+	}
 	else
 		qwklogon=0;
 
-	if(!(cfg.node_misc&NM_NO_NUM) && isdigit(str[0])) {
+	if(!(cfg.node_misc&NM_NO_NUM) && isdigit((uchar)str[0])) {
 		useron.number=atoi(str);
 		getuserdat(&cfg,&useron);
 		if(useron.number && useron.misc&(DELETED|INACTIVE))
-			useron.number=0; }
+			useron.number=0; 
+	}
 
 	if(!useron.number) {
 		useron.number=matchuser(&cfg,str,FALSE);
 		if(!useron.number && (uchar)str[0]<0x7f && str[1]
 			&& isalpha(str[0]) && strchr(str,' ') && cfg.node_misc&NM_LOGON_R)
-			useron.number=userdatdupe(0,U_NAME,LEN_NAME,str,0);
+			useron.number=userdatdupe(0,U_NAME,LEN_NAME,str);
 		if(useron.number) {
 			getuserdat(&cfg,&useron);
 			if(useron.number && useron.misc&(DELETED|INACTIVE))
-				useron.number=0; } }
+				useron.number=0; } 
+	}
 
 	if(!useron.number) {
 		if(cfg.node_misc&NM_LOGON_P) {
-			strcpy(useron.alias,str);
+			SAFECOPY(useron.alias,str);
 			bputs(pw);
 			console|=CON_R_ECHOX;
 			getstr(str,LEN_PASS*2,K_UPPER|K_LOWPRIO|K_TAB);
 			console&=~(CON_R_ECHOX|CON_L_ECHOX);
+			badlogin(useron.alias, str);
 			bputs(text[InvalidLogon]);	/* why does this always fail? */
 			if(cfg.sys_misc&SM_ECHO_PW) 
 				sprintf(tmp,"(%04u)  %-25s  FAILED Password attempt: '%s'"
@@ -88,17 +92,20 @@ int sbbs_t::login(char *username, char *
 			else
 				sprintf(tmp,"(%04u)  %-25s  FAILED Password attempt"
 					,0,useron.alias);
-			logline("+!",tmp); 
+			logline(LOG_NOTICE,"+!",tmp); 
 		} else {
 			bputs(text[UnknownUser]);
 			sprintf(tmp,"Unknown User '%s'",str);
-			logline("+!",tmp); }
+			logline(LOG_NOTICE,"+!",tmp); 
+		}
 		useron.misc=useron_misc;
-		return(LOGIC_FALSE); }
+		return(LOGIC_FALSE); 
+	}
 
 	if(!online) {
 		useron.number=0;
-		return(LOGIC_FALSE); }
+		return(LOGIC_FALSE); 
+	}
 
 	if(useron.pass[0] || REALSYSOP) {
 		bputs(pw);
@@ -107,8 +114,10 @@ int sbbs_t::login(char *username, char *
 		console&=~(CON_R_ECHOX|CON_L_ECHOX);
 		if(!online) {
 			useron.number=0;
-			return(LOGIC_FALSE); }
+			return(LOGIC_FALSE); 
+		}
 		if(stricmp(useron.pass,str)) {
+			badlogin(useron.alias, str);
 			bputs(text[InvalidLogon]);
 			if(cfg.sys_misc&SM_ECHO_PW) 
 				sprintf(tmp,"(%04u)  %-25s  FAILED Password: '%s' Attempt: '%s'"
@@ -116,15 +125,34 @@ int sbbs_t::login(char *username, char *
 			else
 				sprintf(tmp,"(%04u)  %-25s  FAILED Password attempt"
 					,useron.number,useron.alias);
-			logline("+!",tmp);
+			logline(LOG_NOTICE,"+!",tmp);
 			useron.number=0;
 			useron.misc=useron_misc;
-			return(LOGIC_FALSE); }
+			return(LOGIC_FALSE); 
+		}
 		if(REALSYSOP && !chksyspass()) {
 			bputs(text[InvalidLogon]);
 			useron.number=0;
 			useron.misc=useron_misc;
-			return(LOGIC_FALSE); } }
+			return(LOGIC_FALSE); 
+		} 
+	}
 
 	return(LOGIC_TRUE);
 }
+
+void sbbs_t::badlogin(char* user, char* passwd)
+{
+	char reason[128];
+	ulong count;
+
+	SAFEPRINTF(reason,"%s LOGIN", connection);
+	count=loginFailure(startup->login_attempt_list, &client_addr, connection, user, passwd);
+	if(startup->login_attempt_hack_threshold && count>=startup->login_attempt_hack_threshold)
+		::hacklog(&cfg, reason, user, passwd, client_name, &client_addr);
+	if(startup->login_attempt_filter_threshold && count>=startup->login_attempt_filter_threshold)
+		filter_ip(&cfg, connection, "- TOO MANY CONSECUTIVE FAILED LOGIN ATTEMPTS"
+			,client_name, inet_ntoa(client_addr.sin_addr), user, /* fname: */NULL);
+
+	mswait(startup->login_attempt_delay);
+}