vulpineawoo/solanum
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Merge branch 'authd-framework'

Browse source
This commit is contained in:
Elizabeth Myers 2016-03-28 16:51:45 -05:00
commit e196add31a
31 changed files with 2455 additions and 1266 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
authd/Makefile.am
View file

@ -2,6 +2,18 @@ pkglibexec_PROGRAMS = authd
AM_CFLAGS=$(WARNFLAGS)
AM_CPPFLAGS = -I../include -I../librb/include
authd_SOURCES = \
authd.c \
dns.c \
getaddrinfo.c \
getnameinfo.c \
notice.c \
provider.c \
res.c \
reslib.c \
reslist.c \
providers/blacklist.c \
providers/ident.c \
providers/rdns.c
authd_SOURCES = authd.c res.c reslib.c reslist.c getnameinfo.c getaddrinfo.c dns.c notice.c
authd_LDADD = ../librb/src/librb.la

50
authd/authd.c
View file

@ -20,17 +20,22 @@
#include "authd.h"
#include "dns.h"
#include "provider.h"
#include "notice.h"
#define MAXPARA 10
static void handle_reload(int parc, char *parv[]);
static void handle_stat(int parc, char *parv[]);
static void handle_options(int parc, char *parv[]);
rb_helper *authd_helper = NULL;
authd_cmd_handler authd_cmd_handlers[256] = {
['C'] = handle_new_connection,
['D'] = handle_resolve_dns,
['E'] = handle_cancel_connection,
['O'] = handle_options,
['R'] = handle_reload,
['D'] = resolve_dns,
['S'] = handle_stat,
};
@ -42,10 +47,13 @@ authd_reload_handler authd_reload_handlers[256] = {
['D'] = reload_nameservers,
};
rb_dictionary *authd_option_handlers;
static void
handle_stat(int parc, char *parv[])
{
authd_stat_handler handler;
long lrid;
if(parc < 3)
{
@ -53,10 +61,42 @@ handle_stat(int parc, char *parv[])
return;
}
if((lrid = strtol(parv[1], NULL, 16)) > UINT32_MAX)
{
warn_opers(L_CRIT, "BUG: handle_stat got a rid that was too large: %lx", lrid);
return;
}
if (!(handler = authd_stat_handlers[(unsigned char)parv[2][0]]))
return;
handler(parv[1], parv[2][0]);
handler((uint32_t)lrid, parv[2][0]);
}
static void
handle_options(int parc, char *parv[])
{
struct auth_opts_handler *handler;
if(parc < 3)
{
warn_opers(L_CRIT, "BUG: handle_options received too few parameters (at least 3 expected, got %d)", parc);
return;
}
if((handler = rb_dictionary_retrieve(authd_option_handlers, parv[1])) == NULL)
{
warn_opers(L_CRIT, "BUG: handle_options got a bad option type %s", parv[1]);
return;
}
if((parc - 2) < handler->min_parc)
{
warn_opers(L_CRIT, "BUG: handle_options received too few parameters (at least %d expected, got %d)", handler->min_parc, parc);
return;
}
handler->handler(parv[1], parc - 2, (const char **)&parv[2]);
}
static void
@ -161,10 +201,16 @@ main(int argc, char *argv[])
rb_set_time();
setup_signals();
authd_option_handlers = rb_dictionary_create("authd options handlers", strcasecmp);
init_resolver();
init_providers();
rb_init_prng(NULL, RB_PRNG_DEFAULT);
rb_helper_loop(authd_helper, 0);
destroy_providers();
return 0;
}

18
authd/authd.h
View file

@ -21,20 +21,32 @@
#ifndef _AUTHD_H
#define _AUTHD_H
#include <rb_lib.h>
#include <stdio.h>
#include "stdinc.h"
#include "rb_lib.h"
#include "rb_dictionary.h"
#include "setup.h"
#include "ircd_defs.h"
typedef void (*provider_opts_handler_t)(const char *, int, const char **);
struct auth_opts_handler
{
const char *option;
int min_parc;
provider_opts_handler_t handler;
};
extern rb_helper *authd_helper;
typedef void (*authd_cmd_handler)(int parc, char *parv[]);
typedef void (*authd_stat_handler)(const char *rid, const char letter);
typedef void (*authd_stat_handler)(uint32_t rid, const char letter);
typedef void (*authd_reload_handler)(const char letter);
extern authd_cmd_handler authd_cmd_handlers[256];
extern authd_stat_handler authd_stat_handlers[256];
extern authd_reload_handler authd_reload_handlers[256];
extern rb_dictionary *authd_option_handlers;
#endif

57
authd/dns.c
View file

@ -20,6 +20,7 @@
#include "authd.h"
#include "dns.h"
#include "notice.h"
#include "res.h"
static void handle_lookup_ip_reply(void *data, struct DNSReply *reply);
@ -69,9 +70,10 @@ lookup_ip(const char *host, int aftype, DNSCB callback, void *data)
/* See lookup_ip's comment */
struct dns_query *
lookup_hostname(const char *ip, int aftype, DNSCB callback, void *data)
lookup_hostname(const char *ip, DNSCB callback, void *data)
{
struct dns_query *query = rb_malloc(sizeof(struct dns_query));
int aftype;
if(!rb_inet_pton_sock(ip, (struct sockaddr *)&query->addr))
{
@ -79,6 +81,8 @@ lookup_hostname(const char *ip, int aftype, DNSCB callback, void *data)
return NULL;
}
aftype = GET_SS_FAMILY(&query->addr);
if(aftype == AF_INET)
query->type = QUERY_PTR_A;
#ifdef RB_IPV6
@ -116,15 +120,12 @@ handle_lookup_ip_reply(void *data, struct DNSReply *reply)
{
struct dns_query *query = data;
char ip[64] = "*";
query_type type = QUERY_INVALID;
if(!query)
if(query == NULL)
/* Shouldn't happen */
exit(2);
type = query->type;
if(!reply)
if(reply == NULL)
goto end;
switch(query->type)
@ -152,7 +153,7 @@ handle_lookup_ip_reply(void *data, struct DNSReply *reply)
end:
if(query->callback)
query->callback(ip, ip[0] != '*', type, query->data);
query->callback(ip, ip[0] != '*', query->type, query->data);
rb_free(query);
}
@ -164,11 +165,11 @@ handle_lookup_hostname_reply(void *data, struct DNSReply *reply)
struct dns_query *query = data;
char *hostname = NULL;
if(!query)
if(query == NULL)
/* Shouldn't happen */
exit(4);
if(!reply)
if(reply == NULL)
goto end;
if(query->type == QUERY_PTR_A)
@ -177,7 +178,7 @@ handle_lookup_hostname_reply(void *data, struct DNSReply *reply)
ip = (struct sockaddr_in *) &query->addr;
ip_fwd = (struct sockaddr_in *) &reply->addr;
if(ip->sin_addr.s_addr == ip_fwd->sin_addr.s_addr && strlen(reply->h_name) < 63)
if(ip->sin_addr.s_addr == ip_fwd->sin_addr.s_addr)
hostname = reply->h_name;
}
#ifdef RB_IPV6
@ -187,7 +188,7 @@ handle_lookup_hostname_reply(void *data, struct DNSReply *reply)
ip = (struct sockaddr_in6 *) &query->addr;
ip_fwd = (struct sockaddr_in6 *) &reply->addr;
if(memcmp(&ip->sin6_addr, &ip_fwd->sin6_addr, sizeof(struct in6_addr)) == 0 && strlen(reply->h_name) < 63)
if(memcmp(&ip->sin6_addr, &ip_fwd->sin6_addr, sizeof(struct in6_addr)) == 0)
hostname = reply->h_name;
}
#endif
@ -209,7 +210,7 @@ submit_dns_answer(const char *reply, bool status, query_type type, void *data)
if(!id || type == QUERY_INVALID)
exit(6);
if(!reply || !status)
if(reply == NULL || status == false)
{
rb_helper_write(authd_helper, "E %s E %c *", id, type);
rb_free(id);
@ -221,7 +222,7 @@ submit_dns_answer(const char *reply, bool status, query_type type, void *data)
}
void
resolve_dns(int parc, char *parv[])
handle_resolve_dns(int parc, char *parv[])
{
char *id = rb_strdup(parv[1]);
char qtype = *parv[2];
@ -240,10 +241,9 @@ resolve_dns(int parc, char *parv[])
break;
#ifdef RB_IPV6
case 'S':
aftype = AF_INET6;
#endif
case 'R':
if(!lookup_hostname(record, aftype, submit_dns_answer, id))
if(!lookup_hostname(record, submit_dns_answer, id))
submit_dns_answer(NULL, false, qtype, NULL);
break;
default:
@ -252,40 +252,41 @@ resolve_dns(int parc, char *parv[])
}
void
enumerate_nameservers(const char *rid, const char letter)
enumerate_nameservers(uint32_t rid, const char letter)
{
char buf[40 * IRCD_MAXNS]; /* Plenty */
char *c = buf;
int i;
char buf[(HOSTIPLEN + 1) * IRCD_MAXNS];
size_t s = 0;
if (!irc_nscount)
{
/* Shouldn't happen */
rb_helper_write(authd_helper, "X %s %c NONAMESERVERS", rid, letter);
stats_error(rid, letter, "NONAMESERVERS");
return;
}
for(i = 0; i < irc_nscount; i++)
for(int i = 0; i < irc_nscount; i++)
{
char addr[40];
int ret;
char addr[HOSTIPLEN];
size_t addrlen;
rb_inet_ntop_sock((struct sockaddr *)&irc_nsaddr_list[i], addr, sizeof(addr));
if (!addr[0])
{
/* Shouldn't happen */
rb_helper_write(authd_helper, "X %s %c INVALIDNAMESERVER", rid, letter);
stats_error(rid, letter, "INVALIDNAMESERVER");
return;
}
ret = snprintf(c, 40, "%s ", addr);
c += (size_t)ret;
addrlen = strlen(addr) + 1;
(void)snprintf(&buf[s], sizeof(buf) - s, "%s ", addr);
s += addrlen;
}
*(--c) = '\0';
if(s > 0)
buf[--s] = '\0';
rb_helper_write(authd_helper, "Y %s %c %s", rid, letter, buf);
stats_result(rid, letter, "%s", buf);
}
void

6
authd/dns.h
View file

@ -50,12 +50,12 @@ struct dns_query
void *data;
};
extern struct dns_query *lookup_hostname(const char *ip, int aftype, DNSCB callback, void *data);
extern struct dns_query *lookup_hostname(const char *ip, DNSCB callback, void *data);
extern struct dns_query *lookup_ip(const char *host, int aftype, DNSCB callback, void *data);
extern void cancel_query(struct dns_query *query);
extern void resolve_dns(int parc, char *parv[]);
extern void enumerate_nameservers(const char *rid, const char letter);
extern void handle_resolve_dns(int parc, char *parv[]);
extern void enumerate_nameservers(uint32_t rid, const char letter);
extern void reload_nameservers(const char letter);
#endif

40
authd/notice.c
View file

@ -22,7 +22,8 @@
#include "notice.h"
/* Send a notice to a client */
void notice_client(uint32_t cid, const char *fmt, ...)
void
notice_client(uint32_t cid, const char *fmt, ...)
{
char buf[BUFSIZE];
va_list args;
@ -35,7 +36,8 @@ void notice_client(uint32_t cid, const char *fmt, ...)
}
/* Send a warning to the IRC daemon for logging, etc. */
void warn_opers(notice_level_t level, const char *fmt, ...)
void
warn_opers(notice_level_t level, const char *fmt, ...)
{
char buf[BUFSIZE];
va_list args;
@ -46,3 +48,37 @@ void warn_opers(notice_level_t level, const char *fmt, ...)
rb_helper_write(authd_helper, "W %c :%s", level, buf);
}
/* Send a stats result */
void
stats_result(uint32_t cid, char letter, const char *fmt, ...)
{
char buf[BUFSIZE];
va_list args;
va_start(args, fmt);
vsnprintf(buf, sizeof(buf), fmt, args);
va_end(args);
rb_helper_write(authd_helper, "Y %x %c %s", cid, letter, buf);
}
/* Send a stats error */
void
stats_error(uint32_t cid, char letter, const char *fmt, ...)
{
char buf[BUFSIZE];
va_list args;
va_start(args, fmt);
vsnprintf(buf, sizeof(buf), fmt, args);
va_end(args);
rb_helper_write(authd_helper, "X %x %c %s", cid, letter, buf);
}
void
stats_done(uint32_t cid, char letter)
{
rb_helper_write(authd_helper, "Z %x %c", cid, letter);
}

3
authd/notice.h
View file

@ -31,5 +31,8 @@ typedef enum
void notice_client(uint32_t cid, const char *fmt, ...);
void warn_opers(notice_level_t level, const char *fmt, ...);
void stats_result(uint32_t cid, char letter, const char *fmt, ...);
void stats_error(uint32_t cid, char letter, const char *fmt, ...);
void stats_done(uint32_t cid, char letter);
#endif /* __CHARYBDIS_AUTHD_NOTICE_H__ */

342
authd/provider.c Normal file
View file

@ -0,0 +1,342 @@
/* authd/provider.c - authentication provider framework
* Copyright (c) 2016 Elizabeth Myers <elizabeth@interlinked.me>
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice is present in all copies.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
* INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
* IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
/* The basic design here is to have "authentication providers" that do things
* like query ident and blacklists and even open proxies.
*
* Providers are registered in the auth_providers linked list. It is planned to
* use a bitmap to store provider ID's later.
*
* Providers can either return failure immediately, immediate acceptance, or do
* work in the background (calling set_provider to signal this).
*
* Provider-specific data for each client can be kept in an index of the data
* struct member (using the provider's ID).
*
* All providers must implement at a minimum a perform_provider function. You
* don't have to implement the others if you don't need them.
*
* Providers may kick clients off by rejecting them. Upon rejection, all
* providers are cancelled. They can also unconditionally accept them.
*
* When a provider is done and is neutral on accepting/rejecting a client, it
* should call provider_done. Do NOT call this if you have accepted or rejected
* the client.
*
* Eventually, stuff like *:line handling will be moved here, but that means we
* have to talk to bandb directly first.
*
* --Elizafox, 9 March 2016
*/
#include "rb_dictionary.h"
#include "authd.h"
#include "provider.h"
#include "notice.h"
rb_dlink_list auth_providers;
/* Clients waiting */
rb_dictionary *auth_clients;
/* Load a provider */
void
load_provider(struct auth_provider *provider)
{
if(rb_dlink_list_length(&auth_providers) >= MAX_PROVIDERS)
{
warn_opers(L_CRIT, "Exceeded maximum level of authd providers (%d max)", MAX_PROVIDERS);
return;
}
if(provider->opt_handlers != NULL)
{
struct auth_opts_handler *handler;
for(handler = provider->opt_handlers; handler->option != NULL; handler++)
rb_dictionary_add(authd_option_handlers, handler->option, handler);
}
if(provider->stats_handler.letter != '\0')
authd_stat_handlers[provider->stats_handler.letter] = provider->stats_handler.handler;
provider->init();
rb_dlinkAdd(provider, &provider->node, &auth_providers);
}
void
unload_provider(struct auth_provider *provider)
{
if(provider->opt_handlers != NULL)
{
struct auth_opts_handler *handler;
for(handler = provider->opt_handlers; handler->option != NULL; handler++)
rb_dictionary_delete(authd_option_handlers, handler->option);
}
if(provider->stats_handler.letter != '\0')
authd_stat_handlers[provider->stats_handler.letter] = NULL;
provider->destroy();
rb_dlinkDelete(&provider->node, &auth_providers);
}
/* Initalise all providers */
void
init_providers(void)
{
auth_clients = rb_dictionary_create("pending auth clients", rb_uint32cmp);
load_provider(&rdns_provider);
load_provider(&ident_provider);
load_provider(&blacklist_provider);
}
/* Terminate all providers */
void
destroy_providers(void)
{
rb_dlink_node *ptr;
rb_dictionary_iter iter;
struct auth_client *auth;
struct auth_provider *provider;
/* Cancel outstanding connections */
RB_DICTIONARY_FOREACH(auth, &iter, auth_clients)
{
/* TBD - is this the right thing? */
reject_client(auth, -1, "destroy", "Authentication system is down... try reconnecting in a few seconds");
}
RB_DLINK_FOREACH(ptr, auth_providers.head)
{
provider = ptr->data;
if(provider->destroy)
provider->destroy();
}
}
/* Cancel outstanding providers for a client */
void
cancel_providers(struct auth_client *auth)
{
rb_dlink_node *ptr;
struct auth_provider *provider;
RB_DLINK_FOREACH(ptr, auth_providers.head)
{
provider = ptr->data;
if(provider->cancel && is_provider_on(auth, provider->id))
/* Cancel if required */
provider->cancel(auth);
}
rb_dictionary_delete(auth_clients, RB_UINT_TO_POINTER(auth->cid));
rb_free(auth);
}
/* Provider is done - WARNING: do not use auth instance after calling! */
void
provider_done(struct auth_client *auth, provider_t id)
{
rb_dlink_node *ptr;
struct auth_provider *provider;
set_provider_off(auth, id);
set_provider_done(auth, id);
if(!auth->providers)
{
if(!auth->providers_starting)
/* Only do this when there are no providers left */
accept_client(auth, -1);
return;
}
RB_DLINK_FOREACH(ptr, auth_providers.head)
{
provider = ptr->data;
if(provider->completed && is_provider_on(auth, provider->id))
/* Notify pending clients who asked for it */
provider->completed(auth, id);
}
}
/* Reject a client - WARNING: do not use auth instance after calling! */
void
reject_client(struct auth_client *auth, provider_t id, const char *data, const char *reason)
{
char reject;
switch(id)
{
case PROVIDER_RDNS:
reject = 'D';
break;
case PROVIDER_IDENT:
reject = 'I';
break;
case PROVIDER_BLACKLIST:
reject = 'B';
break;
default:
reject = 'N';
break;
}
if(data == NULL)
data = "*";
/* We send back username and hostname in case ircd wants to overrule our decision.
* In the future this may not be the case.
* --Elizafox
*/
rb_helper_write(authd_helper, "R %x %c %s %s %s :%s", auth->cid, reject, auth->username, auth->hostname, data, reason);
set_provider_off(auth, id);
cancel_providers(auth);
}
/* Accept a client, cancel outstanding providers if any - WARNING: do nto use auth instance after calling! */
void
accept_client(struct auth_client *auth, provider_t id)
{
uint32_t cid = auth->cid;
rb_helper_write(authd_helper, "A %x %s %s", auth->cid, auth->username, auth->hostname);
set_provider_off(auth, id);
cancel_providers(auth);
}
/* Begin authenticating user */
static void
start_auth(const char *cid, const char *l_ip, const char *l_port, const char *c_ip, const char *c_port)
{
struct auth_provider *provider;
struct auth_client *auth = rb_malloc(sizeof(struct auth_client));
long lcid = strtol(cid, NULL, 16);
rb_dlink_node *ptr;
if(lcid >= UINT32_MAX)
return;
auth->cid = (uint32_t)lcid;
if(rb_dictionary_find(auth_clients, RB_UINT_TO_POINTER(auth->cid)) == NULL)
rb_dictionary_add(auth_clients, RB_UINT_TO_POINTER(auth->cid), auth);
else
{
warn_opers(L_CRIT, "BUG: duplicate client added via start_auth: %x", auth->cid);
rb_free(auth);
return;
}
rb_strlcpy(auth->l_ip, l_ip, sizeof(auth->l_ip));
auth->l_port = (uint16_t)atoi(l_port); /* should be safe */
(void) rb_inet_pton_sock(l_ip, (struct sockaddr *)&auth->l_addr);
rb_strlcpy(auth->c_ip, c_ip, sizeof(auth->c_ip));
auth->c_port = (uint16_t)atoi(c_port);
(void) rb_inet_pton_sock(c_ip, (struct sockaddr *)&auth->c_addr);
#ifdef RB_IPV6
if(GET_SS_FAMILY(&auth->l_addr) == AF_INET6)
((struct sockaddr_in6 *)&auth->l_addr)->sin6_port = htons(auth->l_port);
else
#endif
((struct sockaddr_in *)&auth->l_addr)->sin_port = htons(auth->l_port);
#ifdef RB_IPV6
if(GET_SS_FAMILY(&auth->c_addr) == AF_INET6)
((struct sockaddr_in6 *)&auth->c_addr)->sin6_port = htons(auth->c_port);
else
#endif
((struct sockaddr_in *)&auth->c_addr)->sin_port = htons(auth->c_port);
rb_strlcpy(auth->hostname, "*", sizeof(auth->hostname));
rb_strlcpy(auth->username, "*", sizeof(auth->username));
memset(auth->data, 0, sizeof(auth->data));
auth->providers_starting = true;
RB_DLINK_FOREACH(ptr, auth_providers.head)
{
provider = ptr->data;
lrb_assert(provider->start != NULL);
/* Execute providers */
if(!provider->start(auth))
{
/* Rejected immediately */
cancel_providers(auth);
return;
}
}
auth->providers_starting = false;
/* If no providers are running, accept the client */
if(!auth->providers)
accept_client(auth, -1);
}
/* Callback for the initiation */
void
handle_new_connection(int parc, char *parv[])
{
if(parc < 6)
{
warn_opers(L_CRIT, "BUG: received too few params for new connection (6 expected, got %d)", parc);
return;
}
start_auth(parv[1], parv[2], parv[3], parv[4], parv[5]);
}
void
handle_cancel_connection(int parc, char *parv[])
{
struct auth_client *auth;
long lcid;
if(parc < 2)
{
warn_opers(L_CRIT, "BUG: received too few params for new connection (2 expected, got %d)", parc);
return;
}
if((lcid = strtol(parv[1], NULL, 16)) > UINT32_MAX)
{
warn_opers(L_CRIT, "BUG: got a request to cancel a connection that can't exist: %lx", lcid);
return;
}
if((auth = rb_dictionary_retrieve(auth_clients, RB_UINT_TO_POINTER((uint32_t)lcid))) == NULL)
{
warn_opers(L_CRIT, "BUG: tried to cancel nonexistent connection %lx", lcid);
return;
}
cancel_providers(auth);
}

147
authd/provider.h Normal file
View file

@ -0,0 +1,147 @@
/* authd/provider.h - authentication provider framework
* Copyright (c) 2016 Elizabeth Myers <elizabeth@interlinked.me>
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice is present in all copies.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
* INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
* IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
#ifndef __CHARYBDIS_AUTHD_PROVIDER_H__
#define __CHARYBDIS_AUTHD_PROVIDER_H__
#include "stdinc.h"
#include "authd.h"
#include "rb_dictionary.h"
#define MAX_PROVIDERS 32 /* This should be enough */
/* Registered providers */
typedef enum
{
PROVIDER_RDNS,
PROVIDER_IDENT,
PROVIDER_BLACKLIST,
} provider_t;
struct auth_client
{
uint16_t cid; /* Client ID */
char l_ip[HOSTIPLEN + 1]; /* Listener IP address */
uint16_t l_port; /* Listener port */
struct rb_sockaddr_storage l_addr; /* Listener address/port */
char c_ip[HOSTIPLEN + 1]; /* Client IP address */
uint16_t c_port; /* Client port */
struct rb_sockaddr_storage c_addr; /* Client address/port */
char hostname[HOSTLEN + 1]; /* Used for DNS lookup */
char username[USERLEN + 1]; /* Used for ident lookup */
uint32_t providers; /* Providers at work,
* none left when set to 0 */
uint32_t providers_done; /* Providers completed */
bool providers_starting; /* Providers are still warming up */
void *data[MAX_PROVIDERS]; /* Provider-specific data slots */
};
typedef bool (*provider_init_t)(void);
typedef void (*provider_destroy_t)(void);
typedef bool (*provider_start_t)(struct auth_client *);
typedef void (*provider_cancel_t)(struct auth_client *);
typedef void (*provider_complete_t)(struct auth_client *, provider_t);
struct auth_stats_handler
{
const char letter;
authd_stat_handler handler;
};
struct auth_provider
{
rb_dlink_node node;
provider_t id;
provider_init_t init; /* Initalise the provider */
provider_destroy_t destroy; /* Terminate the provider */
provider_start_t start; /* Perform authentication */
provider_cancel_t cancel; /* Authentication cancelled */
provider_complete_t completed; /* Callback for when other performers complete (think dependency chains) */
struct auth_stats_handler stats_handler;
struct auth_opts_handler *opt_handlers;
};
extern rb_dlink_list auth_providers;
extern rb_dictionary *auth_clients;
extern struct auth_provider rdns_provider;
extern struct auth_provider ident_provider;
extern struct auth_provider blacklist_provider;
void load_provider(struct auth_provider *provider);
void unload_provider(struct auth_provider *provider);
void init_providers(void);
void destroy_providers(void);
void cancel_providers(struct auth_client *auth);
void provider_done(struct auth_client *auth, provider_t id);
void accept_client(struct auth_client *auth, provider_t id);
void reject_client(struct auth_client *auth, provider_t id, const char *data, const char *reason);
void handle_new_connection(int parc, char *parv[]);
void handle_cancel_connection(int parc, char *parv[]);
/* Provider is operating on this auth_client (set this if you have async work to do) */
static inline void
set_provider_on(struct auth_client *auth, provider_t provider)
{
auth->providers |= (1 << provider);
}
/* Provider is no longer operating on this auth client (you should use provider_done) */
static inline void
set_provider_off(struct auth_client *auth, provider_t provider)
{
auth->providers &= ~(1 << provider);
}
/* Set the provider to done (you should use provider_done) */
static inline void
set_provider_done(struct auth_client *auth, provider_t provider)
{
auth->providers_done |= (1 << provider);
}
/* Check if provider is operating on this auth client */
static inline bool
is_provider_on(struct auth_client *auth, provider_t provider)
{
return auth->providers & (1 << provider);
}
static inline bool
is_provider_done(struct auth_client *auth, provider_t provider)
{
return auth->providers_done & (1 << provider);
}
#endif /* __CHARYBDIS_AUTHD_PROVIDER_H__ */

588
authd/providers/blacklist.c Normal file
View file

@ -0,0 +1,588 @@
/*
* charybdis: A slightly useful ircd.
* blacklist.c: Manages DNS blacklist entries and lookups
*
* Copyright (C) 2006-2011 charybdis development team
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are
* met:
*
* 1. Redistributions of source code must retain the above copyright notice,
* this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* 3. The name of the author may not be used to endorse or promote products
* derived from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
* INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
* IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
/* Originally written for charybdis circa 2006 (by nenolod?).
* Tweaked for authd. Some functions and structs renamed. Public/private
* interfaces have been shifted around. Some code has been cleaned up too.
* -- Elizafox 24 March 2016
*/
#include "authd.h"
#include "provider.h"
#include "notice.h"
#include "stdinc.h"
#include "dns.h"
typedef enum filter_t
{
FILTER_ALL = 1,
FILTER_LAST = 2,
} filter_t;
/* Blacklist accepted IP types */
#define IPTYPE_IPV4 1
#define IPTYPE_IPV6 2
/* A configured DNSBL */
struct blacklist
{
char host[IRCD_RES_HOSTLEN + 1];
char reason[BUFSIZE]; /* Reason template (ircd fills in the blanks) */
uint8_t iptype; /* IP types supported */
rb_dlink_list filters; /* Filters for queries */
bool delete; /* If true delete when no clients */
int refcount; /* When 0 and delete is set, remove this blacklist */
unsigned int hits;
time_t lastwarning; /* Last warning about garbage replies sent */
};
/* A lookup in progress for a particular DNSBL for a particular client */
struct blacklist_lookup
{
struct blacklist *bl; /* Blacklist we're checking */
struct auth_client *auth; /* Client */
struct dns_query *query; /* DNS query pointer */
rb_dlink_node node;
};
/* A blacklist filter */
struct blacklist_filter
{
filter_t type; /* Type of filter */
char filter[HOSTIPLEN]; /* The filter itself */
rb_dlink_node node;
};
/* Blacklist user data attached to auth_client instance */
struct blacklist_user
{
rb_dlink_list queries; /* Blacklist queries in flight */
time_t timeout; /* When this times out */
};
/* public interfaces */
static bool blacklists_init(void);
static void blacklists_destroy(void);
static bool blacklists_start(struct auth_client *);
static void blacklists_cancel(struct auth_client *);
/* private interfaces */
static void unref_blacklist(struct blacklist *);
static struct blacklist *new_blacklist(const char *, const char *, uint8_t, rb_dlink_list *);
static struct blacklist *find_blacklist(const char *);
static bool blacklist_check_reply(struct blacklist_lookup *, const char *);
static void blacklist_dns_callback(const char *, bool, query_type, void *);
static void initiate_blacklist_dnsquery(struct blacklist *, struct auth_client *);
static void timeout_blacklist_queries_event(void *);
/* Variables */
static rb_dlink_list blacklist_list = { NULL, NULL, 0 };
static struct ev_entry *timeout_ev;
static int blacklist_timeout = 15;
/* private interfaces */
static void
unref_blacklist(struct blacklist *bl)
{
rb_dlink_node *ptr, *nptr;
bl->refcount--;
if (bl->delete && bl->refcount <= 0)
{
RB_DLINK_FOREACH_SAFE(ptr, nptr, bl->filters.head)
{
rb_dlinkDelete(ptr, &bl->filters);
rb_free(ptr);
}
rb_dlinkFindDestroy(bl, &blacklist_list);
rb_free(bl);
}
}
static struct blacklist *
new_blacklist(const char *name, const char *reason, uint8_t iptype, rb_dlink_list *filters)
{
struct blacklist *bl;
if (name == NULL || reason == NULL || iptype == 0)
return NULL;
if((bl = find_blacklist(name)) == NULL)
{
bl = rb_malloc(sizeof(struct blacklist));
rb_dlinkAddAlloc(bl, &blacklist_list);
}
else
bl->delete = false;
rb_strlcpy(bl->host, name, IRCD_RES_HOSTLEN + 1);
rb_strlcpy(bl->reason, reason, BUFSIZE);
bl->iptype = iptype;
rb_dlinkMoveList(filters, &bl->filters);
bl->lastwarning = 0;
return bl;
}
static struct blacklist *
find_blacklist(const char *name)
{
rb_dlink_node *ptr;
RB_DLINK_FOREACH(ptr, blacklist_list.head)
{
struct blacklist *bl = (struct blacklist *)ptr->data;
if (!strcasecmp(bl->host, name))
return bl;
}
return NULL;
}
static inline bool
blacklist_check_reply(struct blacklist_lookup *bllookup, const char *ipaddr)
{
struct blacklist *bl = bllookup->bl;
const char *lastoctet;
rb_dlink_node *ptr;
/* No filters and entry found - thus positive match */
if (!rb_dlink_list_length(&bl->filters))
return true;
/* Below will prolly have to change if IPv6 address replies are sent back */
if ((lastoctet = strrchr(ipaddr, '.')) == NULL || *(++lastoctet) == '\0')
goto blwarn;
RB_DLINK_FOREACH(ptr, bl->filters.head)
{
struct blacklist_filter *filter = ptr->data;
const char *cmpstr;
if (filter->type == FILTER_ALL)
cmpstr = ipaddr;
else if (filter->type == FILTER_LAST)
cmpstr = lastoctet;
else
{
warn_opers(L_CRIT, "BUG: Unknown blacklist filter type on blacklist %s: %d",
bl->host, filter->type);
continue;
}
if (strcmp(cmpstr, filter->filter) == 0)
/* Match! */
return true;
}
return false;
blwarn:
if (bl->lastwarning + 3600 < rb_current_time())
{
warn_opers(L_WARN, "Garbage/undecipherable reply received from blacklist %s (reply %s)",
bl->host, ipaddr);
bl->lastwarning = rb_current_time();
}
return false;
}
static void
blacklist_dns_callback(const char *result, bool status, query_type type, void *data)
{
struct blacklist_lookup *bllookup = (struct blacklist_lookup *)data;
struct blacklist_user *bluser;
struct blacklist *bl;
struct auth_client *auth;
if (bllookup == NULL || bllookup->auth == NULL)
return;
bl = bllookup->bl;
auth = bllookup->auth;
bluser = auth->data[PROVIDER_BLACKLIST];
if(bluser == NULL)
return;
if (result != NULL && status && blacklist_check_reply(bllookup, result))
{
/* Match found, so proceed no further */
bl->hits++;
blacklists_cancel(auth);
reject_client(auth, PROVIDER_BLACKLIST, bl->host, bl->reason);
return;
}
unref_blacklist(bl);
cancel_query(bllookup->query); /* Ignore future responses */
rb_dlinkDelete(&bllookup->node, &bluser->queries);
rb_free(bllookup);
if(!rb_dlink_list_length(&bluser->queries))
{
/* Done here */
rb_free(bluser);
auth->data[PROVIDER_BLACKLIST] = NULL;
provider_done(auth, PROVIDER_BLACKLIST);
}
}
static void
initiate_blacklist_dnsquery(struct blacklist *bl, struct auth_client *auth)
{
struct blacklist_lookup *bllookup = rb_malloc(sizeof(struct blacklist_lookup));
struct blacklist_user *bluser = auth->data[PROVIDER_BLACKLIST];
char buf[IRCD_RES_HOSTLEN + 1];
int aftype;
bllookup->bl = bl;
bllookup->auth = auth;
aftype = GET_SS_FAMILY(&auth->c_addr);
if((aftype == AF_INET && (bl->iptype & IPTYPE_IPV4) == 0) ||
(aftype == AF_INET6 && (bl->iptype & IPTYPE_IPV6) == 0))
/* Incorrect blacklist type for this IP... */
return;
build_rdns(buf, sizeof(buf), &auth->c_addr, bl->host);
bllookup->query = lookup_ip(buf, AF_INET, blacklist_dns_callback, bllookup);
rb_dlinkAdd(bllookup, &bllookup->node, &bluser->queries);
bl->refcount++;
}
/* Timeout outstanding queries */
static void
timeout_blacklist_queries_event(void *notused)
{
struct auth_client *auth;
rb_dictionary_iter iter;
RB_DICTIONARY_FOREACH(auth, &iter, auth_clients)
{
struct blacklist_user *bluser = auth->data[PROVIDER_BLACKLIST];
if(bluser != NULL && bluser->timeout < rb_current_time())
{
blacklists_cancel(auth);
provider_done(auth, PROVIDER_BLACKLIST);
}
}
}
static inline void
lookup_all_blacklists(struct auth_client *auth)
{
struct blacklist_user *bluser = auth->data[PROVIDER_BLACKLIST];
rb_dlink_node *ptr;
RB_DLINK_FOREACH(ptr, blacklist_list.head)
{
struct blacklist *bl = (struct blacklist *)ptr->data;
if (!bl->delete)
initiate_blacklist_dnsquery(bl, auth);
}
bluser->timeout = rb_current_time() + blacklist_timeout;
}
static inline void
delete_blacklist(struct blacklist *bl)
{
if (bl->refcount > 0)
bl->delete = true;
else
{
rb_dlinkFindDestroy(bl, &blacklist_list);
rb_free(bl);
}
}
static void
delete_all_blacklists(void)
{
rb_dlink_node *ptr, *nptr;
RB_DLINK_FOREACH_SAFE(ptr, nptr, blacklist_list.head)
{
delete_blacklist(ptr->data);
}
}
/* public interfaces */
static bool
blacklists_start(struct auth_client *auth)
{
if(auth->data[PROVIDER_BLACKLIST] != NULL)
return true;
if(!rb_dlink_list_length(&blacklist_list))
/* Nothing to do... */
return true;
auth->data[PROVIDER_BLACKLIST] = rb_malloc(sizeof(struct blacklist_user));
if(is_provider_done(auth, PROVIDER_RDNS) && is_provider_done(auth, PROVIDER_IDENT))
/* This probably can't happen but let's handle this case anyway */
lookup_all_blacklists(auth);
set_provider_on(auth, PROVIDER_BLACKLIST);
return true;
}
/* This is called every time a provider is completed as long as we are marked not done */
static void
blacklists_initiate(struct auth_client *auth, provider_t provider)
{
struct blacklist_user *bluser = auth->data[PROVIDER_BLACKLIST];
lrb_assert(provider != PROVIDER_BLACKLIST);
lrb_assert(!is_provider_done(auth, PROVIDER_BLACKLIST));
lrb_assert(rb_dlink_list_length(&blacklist_list) > 0);
if(bluser == NULL || rb_dlink_list_length(&bluser->queries))
/* Nothing to do */
return;
else if(!(is_provider_done(auth, PROVIDER_RDNS) && is_provider_done(auth, PROVIDER_IDENT)))
/* Don't start until we've completed these */
return;
else
lookup_all_blacklists(auth);
}
static void
blacklists_cancel(struct auth_client *auth)
{
rb_dlink_node *ptr, *nptr;
struct blacklist_user *bluser = auth->data[PROVIDER_BLACKLIST];
if(bluser == NULL)
return;
RB_DLINK_FOREACH_SAFE(ptr, nptr, bluser->queries.head)
{
struct blacklist_lookup *bllookup = ptr->data;
cancel_query(bllookup->query);
unref_blacklist(bllookup->bl);
rb_dlinkDelete(&bllookup->node, &bluser->queries);
rb_free(bllookup);
}
rb_free(bluser);
auth->data[PROVIDER_BLACKLIST] = NULL;
}
static bool
blacklists_init(void)
{
timeout_ev = rb_event_addish("timeout_blacklist_queries_event", timeout_blacklist_queries_event, NULL, 1);
return (timeout_ev != NULL);
}
static void
blacklists_destroy(void)
{
rb_dlink_node *ptr, *nptr;
rb_dictionary_iter iter;
struct blacklist *bl;
struct auth_client *auth;
RB_DICTIONARY_FOREACH(auth, &iter, auth_clients)
{
blacklists_cancel(auth);
}
delete_all_blacklists();
rb_event_delete(timeout_ev);
}
static void
add_conf_blacklist(const char *key, int parc, const char **parv)
{
rb_dlink_list filters = { NULL, NULL, 0 };
char *tmp, *elemlist = rb_strdup(parv[2]);
uint8_t iptype;
if(*elemlist == '*')
goto end;
for(char *elem = rb_strtok_r(elemlist, ",", &tmp); elem; elem = rb_strtok_r(NULL, ",", &tmp))
{
struct blacklist_filter *filter = rb_malloc(sizeof(struct blacklist_filter));
int dot_c = 0;
filter_t type = FILTER_LAST;
bool valid = true;
/* Check blacklist filter type and for validity */
for(char *c = elem; *c != '\0'; c++)
{
if(*c == '.')
{
if(++dot_c > 3)
{
warn_opers(L_CRIT, "addr_conf_blacklist got a bad filter (too many octets)");
valid = false;
break;
}
type = FILTER_ALL;
}
else if(!isdigit(*c))
{
warn_opers(L_CRIT, "addr_conf_blacklist got a bad filter (invalid character in blacklist filter: %c)", *c);
valid = false;
break;
}
}
if(valid && dot_c > 0 && dot_c < 3)
{
warn_opers(L_CRIT, "addr_conf_blacklist got a bad filter (insufficient octets)");
valid = false;
}
if(!valid)
{
rb_free(filter);
continue;
}
filter->type = type;
rb_strlcpy(filter->filter, elem, sizeof(filter->filter));
rb_dlinkAdd(filter, &filter->node, &filters);
}
end:
rb_free(elemlist);
iptype = atoi(parv[1]) & 0x3;
if(new_blacklist(parv[0], parv[3], iptype, &filters) == NULL)
{
rb_dlink_node *ptr, *nptr;
warn_opers(L_CRIT, "addr_conf_blacklist got a malformed blacklist");
RB_DLINK_FOREACH_SAFE(ptr, nptr, filters.head)
{
rb_free(ptr->data);
rb_dlinkDelete(ptr, &filters);
}
}
}
static void
del_conf_blacklist(const char *key, int parc, const char **parv)
{
struct blacklist *bl = find_blacklist(parv[0]);
if(bl == NULL)
{
warn_opers(L_CRIT, "BUG: tried to remove nonexistent blacklist %s", parv[0]);
return;
}
delete_blacklist(bl);
}
static void
del_conf_blacklist_all(const char *key, int parc, const char **parv)
{
delete_all_blacklists();
}
static void
add_conf_blacklist_timeout(const char *key, int parc, const char **parv)
{
int timeout = atoi(parv[0]);
if(timeout < 0)
{
warn_opers(L_CRIT, "BUG: blacklist timeout < 0 (value: %d)", timeout);
return;
}
blacklist_timeout = timeout;
}
#if 0
static void
blacklist_stats(uint32_t rid, char letter)
{
rb_dlink_node *ptr;
RB_DLINK_FOREACH(ptr, blacklist_list.head)
{
struct blacklist *bl = ptr->data;
if(bl->delete)
continue;
stats_result(rid, letter, "%s %hhu %u", bl->host, bl->iptype, bl->hits);
}
stats_done(rid, letter);
}
#endif
struct auth_opts_handler blacklist_options[] =
{
{ "rbl", 4, add_conf_blacklist },
{ "rbl_del", 1, del_conf_blacklist },
{ "rbl_del_all", 0, del_conf_blacklist_all },
{ "rbl_timeout", 1, add_conf_blacklist_timeout },
{ NULL, 0, NULL },
};
struct auth_provider blacklist_provider =
{
.id = PROVIDER_BLACKLIST,
.init = blacklists_init,
.destroy = blacklists_destroy,
.start = blacklists_start,
.cancel = blacklists_cancel,
.completed = blacklists_initiate,
.opt_handlers = blacklist_options,
/* .stats_handler = { 'B', blacklist_stats }, */
};

425
authd/providers/ident.c Normal file
View file

@ -0,0 +1,425 @@
/* authd/providers/ident.c - ident lookup provider for authd
* Copyright (c) 2016 Elizabeth Myers <elizabeth@interlinked.me>
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice is present in all copies.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
* INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
* IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
/* Largely adapted from old s_auth.c, but reworked for authd. rDNS code
* moved to its own provider.
*
* --Elizafox 13 March 2016
*/
#include "stdinc.h"
#include "match.h"
#include "authd.h"
#include "notice.h"
#include "provider.h"
#include "res.h"
#define IDENT_BUFSIZE 128
struct ident_query
{
time_t timeout; /* Timeout interval */
rb_fde_t *F; /* Our FD */
};
/* Goinked from old s_auth.c --Elizafox */
static const char *messages[] =
{
"*** Checking Ident",
"*** Got Ident response",
"*** No Ident response",
"*** Cannot verify ident validity, ignoring ident",
"*** Ident disabled, not checking ident",
};
typedef enum
{
REPORT_LOOKUP,
REPORT_FOUND,
REPORT_FAIL,
REPORT_INVALID,
REPORT_DISABLED,
} ident_message;
static EVH timeout_ident_queries_event;
static CNCB ident_connected;
static PF read_ident_reply;
static void client_fail(struct auth_client *auth, ident_message message);
static void client_success(struct auth_client *auth);
static char * get_valid_ident(char *buf);
static struct ev_entry *timeout_ev;
static int ident_timeout = 5;
static bool ident_enable = true;
/* Timeout outstanding queries */
static void
timeout_ident_queries_event(void *notused __unused)
{
struct auth_client *auth;
rb_dictionary_iter iter;
RB_DICTIONARY_FOREACH(auth, &iter, auth_clients)
{
struct ident_query *query = auth->data[PROVIDER_IDENT];
if(query != NULL && query->timeout < rb_current_time())
client_fail(auth, REPORT_FAIL);
}
}
/*
* ident_connected() - deal with the result of rb_connect_tcp()
*
* If the connection failed, we simply close the auth fd and report
* a failure. If the connection suceeded send the ident server a query
* giving "theirport , ourport". The write is only attempted *once* so
* it is deemed to be a fail if the entire write doesn't write all the
* data given. This shouldnt be a problem since the socket should have
* a write buffer far greater than this message to store it in should
* problems arise. -avalon
*/
static void
ident_connected(rb_fde_t *F __unused, int error, void *data)
{
struct auth_client *auth = data;
struct ident_query *query;
char authbuf[32];
int authlen;
if(auth == NULL)
return;
query = auth->data[PROVIDER_IDENT];
if(query == NULL)
return;
/* Check the error */
if(error != RB_OK)
{
/* We had an error during connection :( */
client_fail(auth, REPORT_FAIL);
return;
}
snprintf(authbuf, sizeof(authbuf), "%u , %u\r\n",
auth->c_port, auth->l_port);
authlen = strlen(authbuf);
if(rb_write(query->F, authbuf, authlen) != authlen)
{
client_fail(auth, REPORT_FAIL);
return;
}
read_ident_reply(query->F, auth);
}
static void
read_ident_reply(rb_fde_t *F, void *data)
{
struct auth_client *auth = data;
struct ident_query *query;
char buf[IDENT_BUFSIZE + 1]; /* buffer to read auth reply into */
ident_message message = REPORT_FAIL;
char *s = NULL;
char *t = NULL;
ssize_t len;
int count;
if(auth == NULL)
return;
query = auth->data[PROVIDER_IDENT];
if(query == NULL)
return;
len = rb_read(F, buf, IDENT_BUFSIZE);
if(len < 0 && rb_ignore_errno(errno))
{
rb_setselect(F, RB_SELECT_READ, read_ident_reply, auth);
return;
}
if(len > 0)
{
if((s = get_valid_ident(buf)) != NULL)
{
t = auth->username;
while (*s == '~' || *s == '^')
s++;
for (count = USERLEN; *s && count; s++)
{
if(*s == '@' || *s == '\r' || *s == '\n')
break;
if(*s != ' ' && *s != ':' && *s != '[')
{
*t++ = *s;
count--;
}
}
*t = '\0';
}
else
message = REPORT_INVALID;
}
if(s == NULL)
client_fail(auth, message);
else
client_success(auth);
}
static void
client_fail(struct auth_client *auth, ident_message report)
{
struct ident_query *query = auth->data[PROVIDER_IDENT];
if(query == NULL)
return;
rb_strlcpy(auth->username, "*", sizeof(auth->username));
if(query->F != NULL)
rb_close(query->F);
rb_free(query);
auth->data[PROVIDER_IDENT] = NULL;
notice_client(auth->cid, messages[report]);
provider_done(auth, PROVIDER_IDENT);
}
static void
client_success(struct auth_client *auth)
{
struct ident_query *query = auth->data[PROVIDER_IDENT];
if(query == NULL)
return;
if(query->F != NULL)
rb_close(query->F);
rb_free(query);
auth->data[PROVIDER_IDENT] = NULL;
notice_client(auth->cid, messages[REPORT_FOUND]);
provider_done(auth, PROVIDER_IDENT);
}
/* get_valid_ident
* parse ident query reply from identd server
*
* Taken from old s_auth.c --Elizafox
*
* Inputs - pointer to ident buf
* Outputs - NULL if no valid ident found, otherwise pointer to name
* Side effects - None
*/
static char *
get_valid_ident(char *buf)
{
int remp = 0;
int locp = 0;
char *colon1Ptr;
char *colon2Ptr;
char *colon3Ptr;
char *commaPtr;
char *remotePortString;
/* All this to get rid of a sscanf() fun. */
remotePortString = buf;
colon1Ptr = strchr(remotePortString, ':');
if(!colon1Ptr)
return NULL;
*colon1Ptr = '\0';
colon1Ptr++;
colon2Ptr = strchr(colon1Ptr, ':');
if(!colon2Ptr)
return NULL;
*colon2Ptr = '\0';
colon2Ptr++;
commaPtr = strchr(remotePortString, ',');
if(!commaPtr)
return NULL;
*commaPtr = '\0';
commaPtr++;
remp = atoi(remotePortString);
if(!remp)
return NULL;
locp = atoi(commaPtr);
if(!locp)
return NULL;
/* look for USERID bordered by first pair of colons */
if(!strstr(colon1Ptr, "USERID"))
return NULL;
colon3Ptr = strchr(colon2Ptr, ':');
if(!colon3Ptr)
return NULL;
*colon3Ptr = '\0';
colon3Ptr++;
return (colon3Ptr);
}
static bool
ident_init(void)
{
timeout_ev = rb_event_addish("timeout_ident_queries_event", timeout_ident_queries_event, NULL, 1);
return (timeout_ev != NULL);
}
static void
ident_destroy(void)
{
struct auth_client *auth;
rb_dictionary_iter iter;
/* Nuke all ident queries */
RB_DICTIONARY_FOREACH(auth, &iter, auth_clients)
{
if(auth->data[PROVIDER_IDENT] != NULL)
client_fail(auth, REPORT_FAIL);
}
}
static bool ident_start(struct auth_client *auth)
{
struct ident_query *query = rb_malloc(sizeof(struct ident_query));
struct rb_sockaddr_storage l_addr, c_addr;
int family = GET_SS_FAMILY(&auth->c_addr);
if(auth->data[PROVIDER_IDENT] != NULL)
{
set_provider_done(auth, PROVIDER_IDENT); /* for blacklists */
return true;
}
else if(!ident_enable)
{
notice_client(auth->cid, messages[REPORT_DISABLED]);
set_provider_done(auth, PROVIDER_IDENT);
return true;
}
notice_client(auth->cid, messages[REPORT_LOOKUP]);
auth->data[PROVIDER_IDENT] = query;
query->timeout = rb_current_time() + ident_timeout;
if((query->F = rb_socket(family, SOCK_STREAM, 0, "ident")) == NULL)
{
warn_opers(L_DEBUG, "Could not create ident socket: %s", strerror(errno));
client_fail(auth, REPORT_FAIL);
return true; /* Not a fatal error */
}
/* Build sockaddr_storages for rb_connect_tcp below */
memcpy(&l_addr, &auth->l_addr, sizeof(l_addr));
memcpy(&c_addr, &auth->c_addr, sizeof(c_addr));
/* Set the ports correctly */
#ifdef RB_IPV6
if(GET_SS_FAMILY(&l_addr) == AF_INET6)
((struct sockaddr_in6 *)&l_addr)->sin6_port = 0;
else
#endif
((struct sockaddr_in *)&l_addr)->sin_port = 0;
#ifdef RB_IPV6
if(GET_SS_FAMILY(&c_addr) == AF_INET6)
((struct sockaddr_in6 *)&c_addr)->sin6_port = htons(113);
else
#endif
((struct sockaddr_in *)&c_addr)->sin_port = htons(113);
rb_connect_tcp(query->F, (struct sockaddr *)&c_addr,
(struct sockaddr *)&l_addr,
GET_SS_LEN(&l_addr), ident_connected,
auth, ident_timeout);
set_provider_on(auth, PROVIDER_IDENT);
return true;
}
static void
ident_cancel(struct auth_client *auth)
{
struct ident_query *query = auth->data[PROVIDER_IDENT];
if(query != NULL)
client_fail(auth, REPORT_FAIL);
}
static void
add_conf_ident_timeout(const char *key __unused, int parc __unused, const char **parv)
{
int timeout = atoi(parv[0]);
if(timeout < 0)
{
warn_opers(L_CRIT, "BUG: ident timeout < 0 (value: %d)", timeout);
return;
}
ident_timeout = timeout;
}
static void
set_ident_enabled(const char *key __unused, int parc __unused, const char **parv)
{
ident_enable = (*parv[0] == '1');
}
struct auth_opts_handler ident_options[] =
{
{ "ident_timeout", 1, add_conf_ident_timeout },
{ "ident_enabled", 1, set_ident_enabled },
{ NULL, 0, NULL },
};
struct auth_provider ident_provider =
{
.id = PROVIDER_IDENT,
.init = ident_init,
.destroy = ident_destroy,
.start = ident_start,
.cancel = ident_cancel,
.completed = NULL,
.opt_handlers = ident_options,
};

205
authd/providers/rdns.c Normal file
View file

@ -0,0 +1,205 @@
/* authd/providers/rdns.c - rDNS lookup provider for authd
* Copyright (c) 2016 Elizabeth Myers <elizabeth@interlinked.me>
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice is present in all copies.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
* INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
* IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
#include "stdinc.h"
#include "rb_commio.h"
#include "authd.h"
#include "provider.h"
#include "notice.h"
#include "res.h"
#include "dns.h"
struct user_query
{
struct dns_query *query; /* Pending DNS query */
time_t timeout; /* When the request times out */
};
/* Goinked from old s_auth.c --Elizabeth */
static const char *messages[] =
{
"*** Looking up your hostname...",
"*** Found your hostname",
"*** Couldn't look up your hostname",
"*** Your hostname is too long, ignoring hostname",
};
typedef enum
{
REPORT_LOOKUP,
REPORT_FOUND,
REPORT_FAIL,
REPORT_TOOLONG,
} dns_message;
static void client_fail(struct auth_client *auth, dns_message message);
static void client_success(struct auth_client *auth);
static void dns_answer_callback(const char *res, bool status, query_type type, void *data);
static struct ev_entry *timeout_ev;
static EVH timeout_dns_queries_event;
static int rdns_timeout = 15;
static void
dns_answer_callback(const char *res, bool status, query_type type, void *data)
{
struct auth_client *auth = data;
struct user_query *query = auth->data[PROVIDER_RDNS];
if(query == NULL || res == NULL || status == false)
client_fail(auth, REPORT_FAIL);
else if(strlen(res) > HOSTLEN)
client_fail(auth, REPORT_TOOLONG);
else
{
rb_strlcpy(auth->hostname, res, HOSTLEN + 1);
client_success(auth);
}
}
/* Timeout outstanding queries */
static void
timeout_dns_queries_event(void *notused)
{
struct auth_client *auth;
rb_dictionary_iter iter;
RB_DICTIONARY_FOREACH(auth, &iter, auth_clients)
{
struct user_query *query = auth->data[PROVIDER_RDNS];
if(query != NULL && query->timeout < rb_current_time())
{
client_fail(auth, REPORT_FAIL);
return;
}
}
}
static void
client_fail(struct auth_client *auth, dns_message report)
{
struct user_query *query = auth->data[PROVIDER_RDNS];
if(query == NULL)
return;
rb_strlcpy(auth->hostname, "*", sizeof(auth->hostname));
notice_client(auth->cid, messages[report]);
cancel_query(query->query);
rb_free(query);
auth->data[PROVIDER_RDNS] = NULL;
provider_done(auth, PROVIDER_RDNS);
}
static void
client_success(struct auth_client *auth)
{
struct user_query *query = auth->data[PROVIDER_RDNS];
notice_client(auth->cid, messages[REPORT_FOUND]);
cancel_query(query->query);
rb_free(query);
auth->data[PROVIDER_RDNS] = NULL;
provider_done(auth, PROVIDER_RDNS);
}
static bool
rdns_init(void)
{
timeout_ev = rb_event_addish("timeout_dns_queries_event", timeout_dns_queries_event, NULL, 1);
return (timeout_ev != NULL);
}
static void
rdns_destroy(void)
{
struct auth_client *auth;
rb_dictionary_iter iter;
RB_DICTIONARY_FOREACH(auth, &iter, auth_clients)
{
if(auth->data[PROVIDER_RDNS] != NULL)
client_fail(auth, REPORT_FAIL);
}
rb_event_delete(timeout_ev);
}
static bool
rdns_start(struct auth_client *auth)
{
struct user_query *query = rb_malloc(sizeof(struct user_query));
query->timeout = rb_current_time() + rdns_timeout;
auth->data[PROVIDER_RDNS] = query;
query->query = lookup_hostname(auth->c_ip, dns_answer_callback, auth);
notice_client(auth->cid, messages[REPORT_LOOKUP]);
set_provider_on(auth, PROVIDER_RDNS);
return true;
}
static void
rdns_cancel(struct auth_client *auth)
{
struct user_query *query = auth->data[PROVIDER_RDNS];
if(query != NULL)
client_fail(auth, REPORT_FAIL);
}
static void
add_conf_dns_timeout(const char *key, int parc, const char **parv)
{
int timeout = atoi(parv[0]);
if(timeout < 0)
{
warn_opers(L_CRIT, "BUG: DNS timeout < 0 (value: %d)", timeout);
return;
}
rdns_timeout = timeout;
}
struct auth_opts_handler rdns_options[] =
{
{ "rdns_timeout", 1, add_conf_dns_timeout },
{ NULL, 0, NULL },
};
struct auth_provider rdns_provider =
{
.id = PROVIDER_RDNS,
.init = rdns_init,
.destroy = rdns_destroy,
.start = rdns_start,
.cancel = rdns_cancel,
.completed = NULL,
.opt_handlers = rdns_options,
};

47
authd/res.c
View file

@ -465,28 +465,22 @@ static void do_query_name(struct DNSQuery *query, const char *name, struct resli
query_name(request);
}
/*
* do_query_number - Use this to do reverse IP# lookups.
*/
static void do_query_number(struct DNSQuery *query, const struct rb_sockaddr_storage *addr,
struct reslist *request)
/* Build an rDNS style query - if suffix is NULL, use the appropriate .arpa zone */
void build_rdns(char *buf, size_t size, const struct rb_sockaddr_storage *addr, const char *suffix)
{
const unsigned char *cp;
if (request == NULL)
{
request = make_request(query);
memcpy(&request->addr, addr, sizeof(struct rb_sockaddr_storage));
request->name = (char *)rb_malloc(IRCD_RES_HOSTLEN + 1);
}
if (GET_SS_FAMILY(addr) == AF_INET)
{
const struct sockaddr_in *v4 = (const struct sockaddr_in *)addr;
cp = (const unsigned char *)&v4->sin_addr.s_addr;
sprintf(request->queryname, "%u.%u.%u.%u.in-addr.arpa", (unsigned int)(cp[3]),
(unsigned int)(cp[2]), (unsigned int)(cp[1]), (unsigned int)(cp[0]));
(void) snprintf(buf, size, "%u.%u.%u.%u.%s",
(unsigned int)(cp[3]),
(unsigned int)(cp[2]),
(unsigned int)(cp[1]),
(unsigned int)(cp[0]),
suffix == NULL ? "in-addr.arpa" : suffix);
}
#ifdef RB_IPV6
else if (GET_SS_FAMILY(addr) == AF_INET6)
@ -494,8 +488,8 @@ static void do_query_number(struct DNSQuery *query, const struct rb_sockaddr_sto
const struct sockaddr_in6 *v6 = (const struct sockaddr_in6 *)addr;
cp = (const unsigned char *)&v6->sin6_addr.s6_addr;
(void)sprintf(request->queryname, "%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x."
"%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.ip6.arpa",
(void) snprintf(buf, size,
"%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%s",
(unsigned int)(cp[15] & 0xf), (unsigned int)(cp[15] >> 4),
(unsigned int)(cp[14] & 0xf), (unsigned int)(cp[14] >> 4),
(unsigned int)(cp[13] & 0xf), (unsigned int)(cp[13] >> 4),
@ -511,9 +505,28 @@ static void do_query_number(struct DNSQuery *query, const struct rb_sockaddr_sto
(unsigned int)(cp[3] & 0xf), (unsigned int)(cp[3] >> 4),
(unsigned int)(cp[2] & 0xf), (unsigned int)(cp[2] >> 4),
(unsigned int)(cp[1] & 0xf), (unsigned int)(cp[1] >> 4),
(unsigned int)(cp[0] & 0xf), (unsigned int)(cp[0] >> 4));
(unsigned int)(cp[0] & 0xf), (unsigned int)(cp[0] >> 4),
suffix == NULL ? "ip6.arpa" : suffix);
}
#endif
}
/*
* do_query_number - Use this to do reverse IP# lookups.
*/
static void do_query_number(struct DNSQuery *query, const struct rb_sockaddr_storage *addr,
struct reslist *request)
{
const unsigned char *cp;
if (request == NULL)
{
request = make_request(query);
memcpy(&request->addr, addr, sizeof(struct rb_sockaddr_storage));
request->name = (char *)rb_malloc(IRCD_RES_HOSTLEN + 1);
}
build_rdns(request->queryname, IRCD_RES_HOSTLEN + 1, addr, NULL);
request->type = T_PTR;
query_name(request);

1
authd/res.h
View file

@ -32,5 +32,6 @@ extern void init_resolver(void);
extern void restart_resolver(void);
extern void gethost_byname_type(const char *, struct DNSQuery *, int);
extern void gethost_byaddr(const struct rb_sockaddr_storage *, struct DNSQuery *);
extern void build_rdns(char *, size_t, const struct rb_sockaddr_storage *, const char *);
#endif

24
include/authd.h
View file

@ -26,11 +26,35 @@
#ifndef CHARYBDIS_AUTHD_H
#define CHARYBDIS_AUTHD_H
#include "stdinc.h"
#include "rb_dictionary.h"
#include "client.h"
struct blacklist_stats
{
uint8_t iptype;
unsigned int hits;
};
extern rb_helper *authd_helper;
extern rb_dictionary *bl_stats;
void init_authd(void);
void configure_authd(void);
void restart_authd(void);
void rehash_authd(void);
void check_authd(void);
void authd_initiate_client(struct Client *);
void authd_decide_client(struct Client *client_p, const char *ident, const char *host, bool accept, char cause, const char *data, const char *reason);
void authd_abort_client(struct Client *);
const char *get_provider_string(char cause);
void add_blacklist(const char *host, const char *reason, uint8_t iptype, rb_dlink_list *filters);
void del_blacklist(const char *host);
void del_blacklist_all(void);
void set_authd_timeout(const char *key, int timeout);
void ident_check_enable(bool enabled);
#endif

68
include/blacklist.h
View file

@ -1,68 +0,0 @@
/*
* charybdis: A slightly useful ircd.
* blacklist.h: Manages DNS blacklist entries and lookups
*
* Copyright (C) 2006 charybdis development team
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
* USA
*/
#ifndef _BLACKLIST_H_
#define _BLACKLIST_H_
#include "stdinc.h"
#define BLACKLIST_FILTER_ALL 1
#define BLACKLIST_FILTER_LAST 2
/* A configured DNSBL */
struct Blacklist {
unsigned int status; /* If CONF_ILLEGAL, delete when no clients */
int refcount;
int ipv4; /* Does this blacklist support IPv4 lookups? */
int ipv6; /* Does this blacklist support IPv6 lookups? */
char host[IRCD_RES_HOSTLEN + 1];
rb_dlink_list filters; /* Filters for queries */
char reject_reason[BUFSIZE];
unsigned int hits;
time_t lastwarning;
};
/* A lookup in progress for a particular DNSBL for a particular client */
struct BlacklistClient {
struct Blacklist *blacklist;
struct Client *client_p;
uint16_t dns_id;
rb_dlink_node node;
};
/* A blacklist filter */
struct BlacklistFilter {
int type; /* Type of filter */
char filterstr[HOSTIPLEN]; /* The filter itself */
rb_dlink_node node;
};
/* public interfaces */
struct Blacklist *new_blacklist(char *host, char *reject_reason, int ipv4, int ipv6, rb_dlink_list *filters);
void lookup_blacklists(struct Client *client_p);
void abort_blacklist_queries(struct Client *client_p);
void unref_blacklist(struct Blacklist *blptr);
void destroy_blacklists(void);
extern rb_dlink_list blacklist_list;
#endif

28
include/client.h
View file

@ -63,7 +63,6 @@ struct Client;
struct User;
struct Server;
struct LocalUser;
struct AuthRequest;
struct PreClient;
struct ListClient;
struct scache_entry;
@ -190,6 +189,7 @@ struct LocalUser
/* Send and receive linebuf queues .. */
buf_head_t buf_sendq;
buf_head_t buf_recvq;
/*
* we want to use unsigned int here so the sizes have a better chance of
* staying the same on 64 bit machines. The current trend is to use
@ -199,13 +199,15 @@ struct LocalUser
* performed on these, it's not safe to allow them to become negative,
* which is possible for long running server connections. Unsigned values
* generally overflow gracefully. --Bleep
*
* We have modern conveniences. Let's use uint32_t. --Elizafox
*/
unsigned int sendM; /* Statistics: protocol messages send */
unsigned int sendK; /* Statistics: total k-bytes send */
unsigned int receiveM; /* Statistics: protocol messages received */
unsigned int receiveK; /* Statistics: total k-bytes received */
unsigned short sendB; /* counters to count upto 1-k lots of bytes */
unsigned short receiveB; /* sent and received. */
uint32_t sendM; /* Statistics: protocol messages send */
uint32_t sendK; /* Statistics: total k-bytes send */
uint32_t receiveM; /* Statistics: protocol messages received */
uint32_t receiveK; /* Statistics: total k-bytes received */
uint16_t sendB; /* counters to count upto 1-k lots of bytes */
uint16_t receiveB; /* sent and received. */
struct Listener *listener; /* listener accepted from */
struct ConfItem *att_conf; /* attached conf */
struct server_conf *att_sconf;
@ -251,7 +253,6 @@ struct LocalUser
int sent_parsed; /* how many messages we've parsed in this second */
time_t last_knock; /* time of last knock */
unsigned long random_ping;
struct AuthRequest *auth_request;
/* target change stuff */
/* targets we're aware of (fnv32(use_id(target_p))):
@ -291,8 +292,12 @@ struct PreClient
char spoofuser[USERLEN + 1];
char spoofhost[HOSTLEN + 1];
rb_dlink_list dnsbl_queries; /* list of struct BlacklistClient * */
struct Blacklist *dnsbl_listed; /* first dnsbl where it's listed */
uint32_t authd_cid; /* authd id */
time_t authd_timeout; /* When to terminate authd query */
bool authd_accepted; /* did authd accept us? */
char authd_cause; /* rejection cause */
char *authd_data; /* reason data */
char *authd_reason; /* reason we were rejected */
struct rb_sockaddr_storage lip; /* address of our side of the connection */
};
@ -574,8 +579,6 @@ extern int exit_client(struct Client *, struct Client *, struct Client *, const
extern void error_exit_client(struct Client *, int);
extern void count_local_client_memory(size_t * count, size_t * memory);
extern void count_remote_client_memory(size_t * count, size_t * memory);
@ -594,7 +597,6 @@ extern int show_ip(struct Client *source_p, struct Client *target_p);
extern int show_ip_conf(struct ConfItem *aconf, struct Client *source_p);
extern int show_ip_whowas(struct Whowas *whowas, struct Client *source_p);
extern void initUser(void);
extern void free_user(struct User *, struct Client *);
extern struct User *make_user(struct Client *);
extern struct Server *make_server(struct Client *);

34
include/s_auth.h
View file

@ -1,34 +0,0 @@
/*
* ircd-ratbox: A slightly useful ircd.
* s_auth.h: A header for the ident functions.
*
* Copyright (C) 1990 Jarkko Oikarinen and University of Oulu, Co Center
* Copyright (C) 1996-2002 Hybrid Development Team
* Copyright (C) 2002-2004 ircd-ratbox development team
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
* USA
*/
#ifndef INCLUDED_s_auth_h
#define INCLUDED_s_auth_h
struct Client;
extern void start_auth(struct Client *);
extern void init_auth(void);
extern void delete_auth_queries(struct Client *);
#endif /* INCLUDED_s_auth_h */

2
ircd/Makefile.am
View file

@ -21,7 +21,6 @@ endif
libircd_la_SOURCES = \
authd.c \
bandbi.c \
blacklist.c \
cache.c \
capability.c \
channel.c \
@ -53,7 +52,6 @@ libircd_la_SOURCES = \
ratelimit.c \
reject.c \
restart.c \
s_auth.c \
s_conf.c \
s_newconf.c \
s_serv.c \

384
ircd/authd.c
View file

@ -22,28 +22,38 @@
* USA
*/
#include <stdinc.h>
#include <rb_lib.h>
#include <client.h>
#include <ircd_defs.h>
#include <parse.h>
#include <authd.h>
#include <match.h>
#include <logger.h>
#include <s_conf.h>
#include <client.h>
#include <send.h>
#include <numeric.h>
#include <msg.h>
#include <dns.h>
#include "stdinc.h"
#include "rb_lib.h"
#include "client.h"
#include "ircd_defs.h"
#include "parse.h"
#include "authd.h"
#include "match.h"
#include "logger.h"
#include "s_conf.h"
#include "s_stats.h"
#include "client.h"
#include "packet.h"
#include "hash.h"
#include "send.h"
#include "numeric.h"
#include "msg.h"
#include "dns.h"
static int start_authd(void);
static void parse_authd_reply(rb_helper * helper);
static void restart_authd_cb(rb_helper * helper);
static EVH timeout_dead_authd_clients;
rb_helper *authd_helper;
static char *authd_path;
uint32_t cid;
static rb_dictionary *cid_clients;
static struct ev_entry *timeout_ev;
rb_dictionary *bl_stats;
static int
start_authd(void)
{
@ -77,6 +87,15 @@ start_authd(void)
authd_path = rb_strdup(fullpath);
}
if(cid_clients == NULL)
cid_clients = rb_dictionary_create("authd cid to uid mapping", rb_uint32cmp);
if(bl_stats == NULL)
bl_stats = rb_dictionary_create("blacklist statistics", strcasecmp);
if(timeout_ev == NULL)
timeout_ev = rb_event_addish("timeout_dead_authd_clients", timeout_dead_authd_clients, NULL, 1);
authd_helper = rb_helper_start("authd", authd_path, parse_authd_reply, restart_authd_cb);
if(authd_helper == NULL)
@ -96,16 +115,100 @@ parse_authd_reply(rb_helper * helper)
{
ssize_t len;
int parc;
char dnsBuf[READBUF_SIZE];
char authdBuf[READBUF_SIZE];
char *parv[MAXPARA + 1];
long lcid;
uint32_t cid;
struct Client *client_p;
while((len = rb_helper_read(helper, dnsBuf, sizeof(dnsBuf))) > 0)
while((len = rb_helper_read(helper, authdBuf, sizeof(authdBuf))) > 0)
{
parc = rb_string_to_array(dnsBuf, parv, MAXPARA+1);
parc = rb_string_to_array(authdBuf, parv, MAXPARA+1);
switch (*parv[0])
{
case 'E':
case 'A': /* Accepted a client */
if(parc != 4)
{
iwarn("authd sent a result with wrong number of arguments: got %d", parc);
restart_authd();
return;
}
if((lcid = strtol(parv[1], NULL, 16)) > UINT32_MAX || lcid < 0)
{
iwarn("authd sent us back a bad client ID: %ld", lcid);
restart_authd();
return;
}
cid = (uint32_t)lcid;
/* cid to uid (retrieve and delete) */
if((client_p = rb_dictionary_delete(cid_clients, RB_UINT_TO_POINTER(cid))) == NULL)
{
iwarn("authd sent us back an unknown client ID %x", cid);
restart_authd();
return;
}
authd_decide_client(client_p, parv[2], parv[3], true, '\0', NULL, NULL);
break;
case 'R': /* Reject client */
if(parc != 7)
{
iwarn("authd sent us a result with wrong number of arguments: got %d", parc);
restart_authd();
return;
}
if((lcid = strtol(parv[1], NULL, 16)) > UINT32_MAX || lcid < 0)
{
iwarn("authd sent us back a bad client ID %ld", lcid);
restart_authd();
return;
}
cid = (uint32_t)lcid;
/* cid to uid (retrieve and delete) */
if((client_p = rb_dictionary_delete(cid_clients, RB_UINT_TO_POINTER(cid))) == NULL)
{
iwarn("authd sent us back an unknown client ID %x", cid);
restart_authd();
return;
}
authd_decide_client(client_p, parv[3], parv[4], false, toupper(*parv[2]), parv[5], parv[6]);
break;
case 'N': /* Notice to client */
if(parc != 3)
{
iwarn("authd sent us a result with wrong number of arguments: got %d", parc);
restart_authd();
return;
}
if((lcid = strtol(parv[1], NULL, 16)) > UINT32_MAX || lcid < 0)
{
iwarn("authd sent us back a bad client ID %ld", lcid);
restart_authd();
return;
}
cid = (uint32_t)lcid;
/* cid to uid */
if((client_p = rb_dictionary_retrieve(cid_clients, RB_UINT_TO_POINTER(cid))) == NULL)
{
iwarn("authd sent us back an unknown client ID %x", cid);
restart_authd();
return;
}
sendto_one_notice(client_p, ":%s", parv[2]);
break;
case 'E': /* DNS Result */
if(parc != 5)
{
ilog(L_MAIN, "authd sent a result with wrong number of arguments: got %d", parc);
@ -114,7 +217,7 @@ parse_authd_reply(rb_helper * helper)
}
dns_results_callback(parv[1], parv[2], parv[3], parv[4]);
break;
case 'W':
case 'W': /* Oper warning */
if(parc != 3)
{
ilog(L_MAIN, "authd sent a result with wrong number of arguments: got %d", parc);
@ -124,7 +227,7 @@ parse_authd_reply(rb_helper * helper)
switch(*parv[2])
{
case 'D': /* debug */
case 'D': /* Debug */
sendto_realops_snomask(SNO_DEBUG, L_ALL, "authd debug: %s", parv[3]);
break;
case 'I': /* Info */
@ -147,9 +250,9 @@ parse_authd_reply(rb_helper * helper)
/* NOTREACHED */
break;
case 'X':
case 'Y':
case 'Z':
case 'X': /* Stats error */
case 'Y': /* Stats reply */
case 'Z': /* End of stats reply */
if(parc < 3)
{
ilog(L_MAIN, "authd sent a result with wrong number of arguments: got %d", parc);
@ -190,6 +293,16 @@ init_authd(void)
}
}
void
configure_authd(void)
{
/* These will do for now */
set_authd_timeout("ident_timeout", GlobalSetOptions.ident_timeout);
set_authd_timeout("rdns_timeout", ConfigFileEntry.connect_timeout);
set_authd_timeout("rbl_timeout", ConfigFileEntry.connect_timeout);
ident_check_enable(!ConfigFileEntry.disable_auth);
}
static void
restart_authd_cb(rb_helper * helper)
{
@ -213,6 +326,7 @@ void
rehash_authd(void)
{
rb_helper_write(authd_helper, "R");
configure_authd();
}
void
@ -221,3 +335,227 @@ check_authd(void)
if(authd_helper == NULL)
restart_authd();
}
static inline uint32_t
generate_cid(void)
{
if(++cid == 0)
cid = 1;
return cid;
}
/* Basically when this is called we begin handing off the client to authd for
* processing. authd "owns" the client until processing is finished, or we
* timeout from authd. authd will make a decision whether or not to accept the
* client, but it's up to other parts of the code (for now) to decide if we're
* gonna accept the client and ignore authd's suggestion.
*
* --Elizafox
*/
void
authd_initiate_client(struct Client *client_p)
{
char client_ipaddr[HOSTIPLEN+1];
char listen_ipaddr[HOSTIPLEN+1];
uint16_t client_port, listen_port;
uint32_t authd_cid;
if(client_p->preClient == NULL || client_p->preClient->authd_cid != 0)
return;
authd_cid = client_p->preClient->authd_cid = generate_cid();
/* Collisions are extremely unlikely, so disregard the possibility */
rb_dictionary_add(cid_clients, RB_UINT_TO_POINTER(authd_cid), client_p);
/* Retrieve listener and client IP's */
rb_inet_ntop_sock((struct sockaddr *)&client_p->preClient->lip, listen_ipaddr, sizeof(listen_ipaddr));
rb_inet_ntop_sock((struct sockaddr *)&client_p->localClient->ip, client_ipaddr, sizeof(client_ipaddr));
/* Retrieve listener and client ports */
#ifdef RB_IPV6
if(GET_SS_FAMILY(&client_p->preClient->lip) == AF_INET6)
listen_port = ntohs(((struct sockaddr_in6 *)&client_p->preClient->lip)->sin6_port);
else
#endif
listen_port = ntohs(((struct sockaddr_in *)&client_p->preClient->lip)->sin_port);
#ifdef RB_IPV6
if(GET_SS_FAMILY(&client_p->localClient->ip) == AF_INET6)
client_port = ntohs(((struct sockaddr_in6 *)&client_p->localClient->ip)->sin6_port);
else
#endif
client_port = ntohs(((struct sockaddr_in *)&client_p->localClient->ip)->sin_port);
/* Add a bit of a fudge factor... */
client_p->preClient->authd_timeout = rb_current_time() + ConfigFileEntry.connect_timeout + 5;
rb_helper_write(authd_helper, "C %x %s %hu %s %hu", authd_cid, listen_ipaddr, listen_port, client_ipaddr, client_port);
}
/* When this is called we have a decision on client acceptance.
*
* After this point authd no longer "owns" the client.
*/
void
authd_decide_client(struct Client *client_p, const char *ident, const char *host, bool accept, char cause, const char *data, const char *reason)
{
if(client_p->preClient == NULL || client_p->preClient->authd_cid == 0)
return;
if(*ident != '*')
{
rb_strlcpy(client_p->username, ident, sizeof(client_p->username));
ServerStats.is_abad++; /* s_auth used to do this, stay compatible */
}
else
ServerStats.is_asuc++;
if(*host != '*')
rb_strlcpy(client_p->host, host, sizeof(client_p->host));
client_p->preClient->authd_accepted = accept;
client_p->preClient->authd_cause = cause;
client_p->preClient->authd_data = (data == NULL ? NULL : rb_strdup(data));
client_p->preClient->authd_reason = (reason == NULL ? NULL : rb_strdup(reason));
rb_dictionary_delete(cid_clients, RB_UINT_TO_POINTER(client_p->preClient->authd_cid));
client_p->preClient->authd_cid = 0;
/*
* When a client has auth'ed, we want to start reading what it sends
* us. This is what read_packet() does.
* -- adrian
*
* Above comment was originally in s_auth.c, but moved here with below code.
* --Elizafox
*/
rb_dlinkAddTail(client_p, &client_p->node, &global_client_list);
read_packet(client_p->localClient->F, client_p);
}
void
authd_abort_client(struct Client *client_p)
{
if(client_p->preClient == NULL)
return;
if(client_p->preClient->authd_cid == 0)
return;
rb_dictionary_delete(cid_clients, RB_UINT_TO_POINTER(client_p->preClient->authd_cid));
rb_helper_write(authd_helper, "E %x", client_p->preClient->authd_cid);
client_p->preClient->authd_cid = 0;
}
static void
timeout_dead_authd_clients(void *notused __unused)
{
rb_dictionary_iter iter;
char *id;
RB_DICTIONARY_FOREACH(id, &iter, cid_clients)
{
struct Client *client_p;
if(client_p->preClient->authd_timeout < rb_current_time())
{
rb_helper_write(authd_helper, "E %x", client_p->preClient->authd_cid);
rb_free(id);
rb_dictionary_delete(cid_clients, RB_UINT_TO_POINTER(client_p->preClient->authd_cid));
}
}
}
/* Turn a cause char (who rejected us) into the name of the provider */
const char *
get_provider_string(char cause)
{
switch(cause)
{
case 'B':
return "Blacklist";
case 'D':
return "rDNS";
case 'I':
return "Ident";
default:
return "Unknown";
}
}
/* Send a new blacklist to authd */
void
add_blacklist(const char *host, const char *reason, uint8_t iptype, rb_dlink_list *filters)
{
rb_dlink_node *ptr;
struct blacklist_stats *stats = rb_malloc(sizeof(struct blacklist_stats));
char filterbuf[BUFSIZE] = "*";
size_t s = 0;
/* Build a list of comma-separated values for authd.
* We don't check for validity - do it elsewhere.
*/
RB_DLINK_FOREACH(ptr, filters->head)
{
char *filter = ptr->data;
size_t filterlen = strlen(filter) + 1;
if(s + filterlen > sizeof(filterbuf))
break;
snprintf(&filterbuf[s], sizeof(filterbuf) - s, "%s,", filter);
s += filterlen;
}
if(s)
filterbuf[s - 1] = '\0';
stats->iptype = iptype;
stats->hits = 0;
rb_dictionary_add(bl_stats, host, stats);
rb_helper_write(authd_helper, "O rbl %s %hhu %s :%s", host, iptype, filterbuf, reason);
}
/* Delete a blacklist */
void
del_blacklist(const char *host)
{
rb_dictionary_delete(bl_stats, host);
rb_helper_write(authd_helper, "O rbl_del %s", host);
}
/* Delete all the blacklists */
void
del_blacklist_all(void)
{
struct blacklist_stats *stats;
rb_dictionary_iter iter;
RB_DICTIONARY_FOREACH(stats, &iter, bl_stats)
{
rb_free(stats);
rb_dictionary_delete(bl_stats, iter.cur->key);
}
rb_helper_write(authd_helper, "O rbl_del_all");
}
/* Adjust an authd timeout value */
void
set_authd_timeout(const char *key, int timeout)
{
rb_helper_write(authd_helper, "O %s %d", key, timeout);
}
void
ident_check_enable(bool enabled)
{
rb_helper_write(authd_helper, "O ident_enabled %d", enabled ? 1 : 0);
}

306
ircd/blacklist.c
View file

@ -1,306 +0,0 @@
/*
* charybdis: A slightly useful ircd.
* blacklist.c: Manages DNS blacklist entries and lookups
*
* Copyright (C) 2006-2011 charybdis development team
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are
* met:
*
* 1. Redistributions of source code must retain the above copyright notice,
* this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* 3. The name of the author may not be used to endorse or promote products
* derived from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
* INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
* IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
#include "stdinc.h"
#include "client.h"
#include "dns.h"
#include "numeric.h"
#include "reject.h"
#include "s_conf.h"
#include "s_user.h"
#include "blacklist.h"
#include "send.h"
rb_dlink_list blacklist_list = { NULL, NULL, 0 };
/* private interfaces */
static struct Blacklist *find_blacklist(char *name)
{
rb_dlink_node *nptr;
RB_DLINK_FOREACH(nptr, blacklist_list.head)
{
struct Blacklist *blptr = (struct Blacklist *) nptr->data;
if (!irccmp(blptr->host, name))
return blptr;
}
return NULL;
}
static inline int blacklist_check_reply(struct BlacklistClient *blcptr, const char *ipaddr)
{
struct Blacklist *blptr = blcptr->blacklist;
const char *lastoctet;
rb_dlink_node *ptr;
/* No filters and entry found - thus positive match */
if (!rb_dlink_list_length(&blptr->filters))
return 1;
/* Below will prolly have to change too if the above changes */
if ((lastoctet = strrchr(ipaddr, '.')) == NULL || *(++lastoctet) == '\0')
goto blwarn;
RB_DLINK_FOREACH(ptr, blcptr->blacklist->filters.head)
{
struct BlacklistFilter *filter = ptr->data;
const char *cmpstr;
if (filter->type == BLACKLIST_FILTER_ALL)
cmpstr = ipaddr;
else if (filter->type == BLACKLIST_FILTER_LAST)
cmpstr = lastoctet;
else
{
sendto_realops_snomask(SNO_GENERAL, L_ALL,
"blacklist_check_reply(): Unknown filtertype (BUG!)");
continue;
}
if (strcmp(cmpstr, filter->filterstr) == 0)
/* Match! */
return 1;
}
return 0;
blwarn:
if (blcptr->blacklist->lastwarning + 3600 < rb_current_time())
{
sendto_realops_snomask(SNO_GENERAL, L_ALL,
"Garbage reply from blacklist %s",
blcptr->blacklist->host);
blcptr->blacklist->lastwarning = rb_current_time();
}
return 0;
}
static void blacklist_dns_callback(const char *result, int status, int aftype, void *vptr)
{
struct BlacklistClient *blcptr = (struct BlacklistClient *) vptr;
bool listed = false;
if (blcptr == NULL || blcptr->client_p == NULL)
return;
if (blcptr->client_p->preClient == NULL)
{
sendto_realops_snomask(SNO_GENERAL, L_ALL,
"blacklist_dns_callback(): blcptr->client_p->preClient (%s) is NULL", get_client_name(blcptr->client_p, HIDE_IP));
rb_free(blcptr);
return;
}
if (result != NULL && status)
{
if (blacklist_check_reply(blcptr, result))
listed = true;
}
/* they have a blacklist entry for this client */
if (listed && blcptr->client_p->preClient->dnsbl_listed == NULL)
{
blcptr->client_p->preClient->dnsbl_listed = blcptr->blacklist;
/* reference to blacklist moves from blcptr to client_p->preClient... */
}
else
unref_blacklist(blcptr->blacklist);
rb_dlinkDelete(&blcptr->node, &blcptr->client_p->preClient->dnsbl_queries);
/* yes, it can probably happen... */
if (rb_dlink_list_length(&blcptr->client_p->preClient->dnsbl_queries) == 0 && blcptr->client_p->flags & FLAGS_SENTUSER && !EmptyString(blcptr->client_p->name))
register_local_user(blcptr->client_p, blcptr->client_p);
rb_free(blcptr);
}
static void initiate_blacklist_dnsquery(struct Blacklist *blptr, struct Client *client_p)
{
struct BlacklistClient *blcptr = rb_malloc(sizeof(struct BlacklistClient));
char buf[IRCD_RES_HOSTLEN + 1];
uint8_t *ip;
blcptr->blacklist = blptr;
blcptr->client_p = client_p;
/* IPv4 */
if ((GET_SS_FAMILY(&client_p->localClient->ip) == AF_INET) && blptr->ipv4)
{
ip = (uint8_t *)&((struct sockaddr_in *)&client_p->localClient->ip)->sin_addr.s_addr;
/* becomes 2.0.0.127.torbl.ahbl.org or whatever */
snprintf(buf, sizeof buf, "%d.%d.%d.%d.%s",
(unsigned int) ip[3],
(unsigned int) ip[2],
(unsigned int) ip[1],
(unsigned int) ip[0],
blptr->host);
}
#ifdef RB_IPV6
/* IPv6 */
else if ((GET_SS_FAMILY(&client_p->localClient->ip) == AF_INET6) && blptr->ipv6)
{
/* Split up for rDNS lookup
* ex: ip[0] = 0x00, ip[1] = 0x00... ip[16] = 0x01 for localhost
* Giving us:
* 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.foobl.invalid
* or something like that.
*/
ip = (uint8_t *)&((struct sockaddr_in6 *)&client_p->localClient->ip)->sin6_addr.s6_addr;
char *bufptr = buf;
int i;
/* Going backwards */
for (i = 15; i >= 0; i--, bufptr += 4)
{
/* Get upper and lower nibbles */
uint8_t hi = (ip[i] >> 4) & 0x0F;
uint8_t lo = ip[i] & 0x0F;
/* One part... 4 chars + terminator */
snprintf(bufptr, 5, "%1x.%1x.",
(unsigned int) lo, /* Remember, backwards */
(unsigned int) hi);
}
/* Tack host on */
strcpy(bufptr, blptr->host);
}
#endif
/* This shouldn't happen... */
else
return;
blcptr->dns_id = lookup_hostname(buf, AF_INET, blacklist_dns_callback, blcptr);
rb_dlinkAdd(blcptr, &blcptr->node, &client_p->preClient->dnsbl_queries);
blptr->refcount++;
}
/* public interfaces */
struct Blacklist *new_blacklist(char *name, char *reject_reason, int ipv4, int ipv6, rb_dlink_list *filters)
{
struct Blacklist *blptr;
if (name == NULL || reject_reason == NULL)
return NULL;
blptr = find_blacklist(name);
if (blptr == NULL)
{
blptr = rb_malloc(sizeof(struct Blacklist));
rb_dlinkAddAlloc(blptr, &blacklist_list);
}
else
blptr->status &= ~CONF_ILLEGAL;
rb_strlcpy(blptr->host, name, IRCD_RES_HOSTLEN + 1);
rb_strlcpy(blptr->reject_reason, reject_reason, BUFSIZE);
blptr->ipv4 = ipv4;
blptr->ipv6 = ipv6;
rb_dlinkMoveList(filters, &blptr->filters);
blptr->lastwarning = 0;
return blptr;
}
void unref_blacklist(struct Blacklist *blptr)
{
rb_dlink_node *ptr, *next_ptr;
blptr->refcount--;
if (blptr->status & CONF_ILLEGAL && blptr->refcount <= 0)
{
RB_DLINK_FOREACH_SAFE(ptr, next_ptr, blptr->filters.head)
{
rb_dlinkDelete(ptr, &blptr->filters);
rb_free(ptr);
}
rb_dlinkFindDestroy(blptr, &blacklist_list);
rb_free(blptr);
}
}
void lookup_blacklists(struct Client *client_p)
{
rb_dlink_node *nptr;
RB_DLINK_FOREACH(nptr, blacklist_list.head)
{
struct Blacklist *blptr = (struct Blacklist *) nptr->data;
if (!(blptr->status & CONF_ILLEGAL))
initiate_blacklist_dnsquery(blptr, client_p);
}
}
void abort_blacklist_queries(struct Client *client_p)
{
rb_dlink_node *ptr, *next_ptr;
struct BlacklistClient *blcptr;
if (client_p->preClient == NULL)
return;
RB_DLINK_FOREACH_SAFE(ptr, next_ptr, client_p->preClient->dnsbl_queries.head)
{
blcptr = ptr->data;
rb_dlinkDelete(&blcptr->node, &client_p->preClient->dnsbl_queries);
unref_blacklist(blcptr->blacklist);
cancel_lookup(blcptr->dns_id);
rb_free(blcptr);
}
}
void destroy_blacklists(void)
{
rb_dlink_node *ptr, *next_ptr;
struct Blacklist *blptr;
RB_DLINK_FOREACH_SAFE(ptr, next_ptr, blacklist_list.head)
{
blptr = ptr->data;
blptr->hits = 0; /* keep it simple and consistent */
if (blptr->refcount > 0)
blptr->status |= CONF_ILLEGAL;
else
{
rb_free(ptr->data);
rb_dlinkDestroy(ptr, &blacklist_list);
}
}
}

21
ircd/client.c
View file

@ -32,7 +32,7 @@
#include "ircd.h"
#include "numeric.h"
#include "packet.h"
#include "s_auth.h"
#include "authd.h"
#include "s_conf.h"
#include "s_newconf.h"
#include "logger.h"
@ -47,7 +47,6 @@
#include "hook.h"
#include "msg.h"
#include "monitor.h"
#include "blacklist.h"
#include "reject.h"
#include "scache.h"
#include "rb_dictionary.h"
@ -253,17 +252,15 @@ make_client(struct Client *from)
void
free_pre_client(struct Client *client_p)
{
struct Blacklist *blptr;
s_assert(NULL != client_p);
if(client_p->preClient == NULL)
return;
blptr = client_p->preClient->dnsbl_listed;
if (blptr != NULL)
unref_blacklist(blptr);
s_assert(rb_dlink_list_length(&client_p->preClient->dnsbl_queries) == 0);
s_assert(client_p->preClient->authd_cid == 0);
rb_free(client_p->preClient->authd_data);
rb_free(client_p->preClient->authd_reason);
rb_bh_free(pclient_heap, client_p->preClient);
client_p->preClient = NULL;
@ -454,9 +451,8 @@ check_unknowns_list(rb_dlink_list * list)
if(IsDead(client_p) || IsClosing(client_p))
continue;
/* still has DNSbls to validate against */
if(client_p->preClient != NULL &&
rb_dlink_list_length(&client_p->preClient->dnsbl_queries) > 0)
/* Still querying with authd */
if(client_p->preClient != NULL && client_p->preClient->authd_cid != 0)
continue;
/*
@ -1355,8 +1351,7 @@ static int
exit_unknown_client(struct Client *client_p, struct Client *source_p, struct Client *from,
const char *comment)
{
delete_auth_queries(source_p);
abort_blacklist_queries(source_p);
authd_abort_client(client_p);
rb_dlinkDelete(&source_p->localClient->tnode, &unknown_list);
if(!IsIOError(source_p))

4
ircd/ircd.c
View file

@ -39,7 +39,6 @@
#include "numeric.h"
#include "parse.h"
#include "restart.h"
#include "s_auth.h"
#include "s_conf.h"
#include "logger.h"
#include "s_serv.h" /* try_connections */
@ -782,7 +781,6 @@ charybdis_main(int argc, char *argv[])
load_all_modules(1);
load_core_modules(1);
init_auth(); /* Initialise the auth code */
init_authd(); /* Start up authd. */
init_dns(); /* Start up DNS query system */
@ -865,6 +863,8 @@ charybdis_main(int argc, char *argv[])
load_help();
open_logfiles();
configure_authd();
ilog(L_MAIN, "Server Ready");
/* We want try_connections to be called as soon as possible now! -- adrian */

4
ircd/listener.c
View file

@ -34,7 +34,7 @@
#include "s_newconf.h"
#include "s_stats.h"
#include "send.h"
#include "s_auth.h"
#include "authd.h"
#include "reject.h"
#include "s_conf.h"
#include "hostmask.h"
@ -509,7 +509,7 @@ add_connection(struct Listener *listener, rb_fde_t *F, struct sockaddr *sai, str
++listener->ref_count;
start_auth(new_client);
authd_initiate_client(new_client);
}
static const char *toofast = "ERROR :Reconnecting too fast, throttled.\r\n";

64
ircd/newconf.c
View file

@ -24,7 +24,6 @@
#include "cache.h"
#include "ircd.h"
#include "snomask.h"
#include "blacklist.h"
#include "sslproc.h"
#include "privilege.h"
#include "chmode.h"
@ -55,9 +54,8 @@ static struct alias_entry *yy_alias = NULL;
static char *yy_blacklist_host = NULL;
static char *yy_blacklist_reason = NULL;
static int yy_blacklist_ipv4 = 1;
static int yy_blacklist_ipv6 = 0;
static rb_dlink_list yy_blacklist_filters;
static uint8_t yy_blacklist_iptype = 0;
static rb_dlink_list yy_blacklist_filters = { NULL, NULL, 0 };
static char *yy_privset_extends = NULL;
@ -1841,6 +1839,9 @@ conf_set_channel_autochanmodes(void *data)
/* XXX for below */
static void conf_set_blacklist_reason(void *data);
#define IPTYPE_IPV4 1
#define IPTYPE_IPV6 2
static void
conf_set_blacklist_host(void *data)
{
@ -1854,8 +1855,7 @@ conf_set_blacklist_host(void *data)
return;
}
yy_blacklist_ipv4 = 1;
yy_blacklist_ipv6 = 0;
yy_blacklist_iptype |= IPTYPE_IPV4;
yy_blacklist_host = rb_strdup(data);
}
@ -1865,25 +1865,24 @@ conf_set_blacklist_type(void *data)
conf_parm_t *args = data;
/* Don't assume we have either if we got here */
yy_blacklist_ipv4 = 0;
yy_blacklist_ipv6 = 0;
yy_blacklist_iptype = 0;
for (; args; args = args->next)
{
if (!strcasecmp(args->v.string, "ipv4"))
yy_blacklist_ipv4 = 1;
yy_blacklist_iptype |= IPTYPE_IPV4;
else if (!strcasecmp(args->v.string, "ipv6"))
yy_blacklist_ipv6 = 1;
yy_blacklist_iptype |= IPTYPE_IPV6;
else
conf_report_error("blacklist::type has unknown address family %s",
args->v.string);
}
/* If we have neither, just default to IPv4 */
if (!yy_blacklist_ipv4 && !yy_blacklist_ipv6)
if (!yy_blacklist_iptype)
{
conf_report_error("blacklist::type has neither IPv4 nor IPv6 (defaulting to IPv4)");
yy_blacklist_ipv4 = 1;
yy_blacklist_iptype = IPTYPE_IPV4;
}
}
@ -1891,13 +1890,13 @@ static void
conf_set_blacklist_matches(void *data)
{
conf_parm_t *args = data;
enum filter_t { FILTER_NONE, FILTER_ALL, FILTER_LAST };
for (; args; args = args->next)
{
struct BlacklistFilter *filter;
char *str = args->v.string;
char *p;
int type = BLACKLIST_FILTER_LAST;
enum filter_t type = FILTER_LAST;
if (CF_TYPE(args->type) != CF_QSTRING)
{
@ -1922,17 +1921,17 @@ conf_set_blacklist_matches(void *data)
{
/* Check for validity */
if (*p == '.')
type = BLACKLIST_FILTER_ALL;
else if (!isalnum((unsigned char)*p))
type = FILTER_ALL;
else if (!isdigit((unsigned char)*p))
{
conf_report_error("blacklist::matches has invalid IP match entry %s",
str);
type = 0;
type = FILTER_NONE;
break;
}
}
if (type == BLACKLIST_FILTER_ALL)
if (type == FILTER_ALL)
{
/* Basic IP sanity check */
struct rb_sockaddr_storage tmp;
@ -1943,7 +1942,7 @@ conf_set_blacklist_matches(void *data)
continue;
}
}
else if (type == BLACKLIST_FILTER_LAST)
else if (type == FILTER_LAST)
{
/* Verify it's the correct length */
if (strlen(str) > 3)
@ -1958,11 +1957,7 @@ conf_set_blacklist_matches(void *data)
continue; /* Invalid entry */
}
filter = rb_malloc(sizeof(struct BlacklistFilter));
filter->type = type;
rb_strlcpy(filter->filterstr, str, sizeof(filter->filterstr));
rb_dlinkAdd(filter, &filter->node, &yy_blacklist_filters);
rb_dlinkAddAlloc(rb_strdup(str), &yy_blacklist_filters);
}
}
@ -1974,7 +1969,7 @@ conf_set_blacklist_reason(void *data)
if (yy_blacklist_host && data)
{
yy_blacklist_reason = rb_strdup(data);
if (yy_blacklist_ipv6)
if (yy_blacklist_iptype & IPTYPE_IPV4)
{
/* Make sure things fit (64 = alnum count + dots) */
if ((64 + strlen(yy_blacklist_host)) > IRCD_RES_HOSTLEN)
@ -1985,7 +1980,7 @@ conf_set_blacklist_reason(void *data)
}
}
/* Avoid doing redundant check, IPv6 is bigger than IPv4 --Elizabeth */
if (yy_blacklist_ipv4 && !yy_blacklist_ipv6)
if ((yy_blacklist_iptype & IPTYPE_IPV4) && !(yy_blacklist_iptype & IPTYPE_IPV6))
{
/* Make sure things fit (16 = number of nums + dots) */
if ((16 + strlen(yy_blacklist_host)) > IRCD_RES_HOSTLEN)
@ -1996,30 +1991,23 @@ conf_set_blacklist_reason(void *data)
}
}
new_blacklist(yy_blacklist_host, yy_blacklist_reason, yy_blacklist_ipv4, yy_blacklist_ipv6,
&yy_blacklist_filters);
add_blacklist(yy_blacklist_host, yy_blacklist_reason, yy_blacklist_iptype, &yy_blacklist_filters);
}
cleanup_bl:
if (data == NULL)
{
RB_DLINK_FOREACH_SAFE(ptr, nptr, yy_blacklist_filters.head)
{
rb_dlinkDelete(ptr, &yy_blacklist_filters);
rb_free(ptr);
rb_free(ptr->data);
rb_dlinkDestroy(ptr, &yy_blacklist_filters);
}
}
else
{
yy_blacklist_filters = (rb_dlink_list){ NULL, NULL, 0 };
}
rb_free(yy_blacklist_host);
rb_free(yy_blacklist_reason);
yy_blacklist_host = NULL;
yy_blacklist_reason = NULL;
yy_blacklist_ipv4 = 1;
yy_blacklist_ipv6 = 0;
yy_blacklist_iptype = 0;
}
/* public functions */

607
ircd/s_auth.c
View file

@ -1,607 +0,0 @@
/*
* ircd-ratbox: A slightly useful ircd.
* s_auth.c: Functions for querying a users ident.
*
* Copyright (C) 1990 Jarkko Oikarinen and University of Oulu, Co Center
* Copyright (C) 1996-2002 Hybrid Development Team
* Copyright (C) 2002-2005 ircd-ratbox development team
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
* USA
*
*/
/*
* Changes:
* July 6, 1999 - Rewrote most of the code here. When a client connects
* to the server and passes initial socket validation checks, it
* is owned by this module (auth) which returns it to the rest of the
* server when dns and auth queries are finished. Until the client is
* released, the server does not know it exists and does not process
* any messages from it.
* --Bleep Thomas Helvey <tomh@inxpress.net>
*/
#include "stdinc.h"
#include "defaults.h"
#include "s_auth.h"
#include "s_conf.h"
#include "client.h"
#include "match.h"
#include "ircd.h"
#include "numeric.h"
#include "packet.h"
#include "dns.h"
#include "logger.h"
#include "s_stats.h"
#include "send.h"
#include "hook.h"
#include "blacklist.h"
#include "s_assert.h"
struct AuthRequest
{
rb_dlink_node node;
struct Client *client; /* pointer to client struct for request */
uint16_t dns_id; /* DNS Query */
unsigned int flags; /* current state of request */
rb_fde_t *F; /* file descriptor for auth queries */
time_t timeout; /* time when query expires */
uint16_t lport;
uint16_t rport;
};
/*
* flag values for AuthRequest
* NAMESPACE: AM_xxx - Authentication Module
*/
#define AM_AUTH_CONNECTING (1 << 0)
#define AM_AUTH_PENDING (1 << 1)
#define AM_DNS_PENDING (1 << 2)
#define SetDNSPending(x) ((x)->flags |= AM_DNS_PENDING)
#define ClearDNSPending(x) ((x)->flags &= ~AM_DNS_PENDING)
#define IsDNSPending(x) ((x)->flags & AM_DNS_PENDING)
#define SetAuthConnect(x) ((x)->flags |= AM_AUTH_CONNECTING)
#define ClearAuthConnect(x) ((x)->flags &= ~AM_AUTH_CONNECTING)
#define IsAuthConnect(x) ((x)->flags & AM_AUTH_CONNECTING)
#define SetAuthPending(x) ((x)->flags |= AM_AUTH_PENDING)
#define ClearAuthPending(x) ((x)->flags &= AM_AUTH_PENDING)
#define IsAuthPending(x) ((x)->flags & AM_AUTH_PENDING)
#define ClearAuth(x) ((x)->flags &= ~(AM_AUTH_PENDING | AM_AUTH_CONNECTING))
#define IsDoingAuth(x) ((x)->flags & (AM_AUTH_PENDING | AM_AUTH_CONNECTING))
/*
* a bit different approach
* this replaces the original sendheader macros
*/
static const char *HeaderMessages[] =
{
":*** Looking up your hostname...",
":*** Found your hostname",
":*** Couldn't look up your hostname",
":*** Checking Ident",
":*** Got Ident response",
":*** No Ident response",
":*** Your hostname is too long, ignoring hostname",
":*** Your forward and reverse DNS do not match, ignoring hostname",
":*** Cannot verify hostname validity, ignoring hostname",
};
typedef enum
{
REPORT_DO_DNS,
REPORT_FIN_DNS,
REPORT_FAIL_DNS,
REPORT_DO_ID,
REPORT_FIN_ID,
REPORT_FAIL_ID,
REPORT_HOST_TOOLONG,
REPORT_HOST_MISMATCH,
REPORT_HOST_UNKNOWN
}
ReportType;
#define sendheader(c, r) sendto_one_notice(c, "%s", HeaderMessages[(r)])
static rb_dlink_list auth_poll_list;
static rb_bh *auth_heap;
static EVH timeout_auth_queries_event;
static PF read_auth_reply;
static CNCB auth_connect_callback;
/*
* init_auth()
*
* Initialise the auth code
*/
void
init_auth(void)
{
/* This hook takes a struct Client for its argument */
memset(&auth_poll_list, 0, sizeof(auth_poll_list));
rb_event_addish("timeout_auth_queries_event", timeout_auth_queries_event, NULL, 1);
auth_heap = rb_bh_create(sizeof(struct AuthRequest), LCLIENT_HEAP_SIZE, "auth_heap");
}
/*
* make_auth_request - allocate a new auth request
*/
static struct AuthRequest *
make_auth_request(struct Client *client)
{
struct AuthRequest *request = rb_bh_alloc(auth_heap);
client->localClient->auth_request = request;
request->F = NULL;
request->client = client;
request->timeout = rb_current_time() + ConfigFileEntry.connect_timeout;
return request;
}
/*
* free_auth_request - cleanup auth request allocations
*/
static void
free_auth_request(struct AuthRequest *request)
{
rb_bh_free(auth_heap, request);
}
/*
* release_auth_client - release auth client from auth system
* this adds the client into the local client lists so it can be read by
* the main io processing loop
*/
static void
release_auth_client(struct AuthRequest *auth)
{
struct Client *client = auth->client;
if(IsDNSPending(auth) || IsDoingAuth(auth))
return;
client->localClient->auth_request = NULL;
rb_dlinkDelete(&auth->node, &auth_poll_list);
free_auth_request(auth);
/*
* When a client has auth'ed, we want to start reading what it sends
* us. This is what read_packet() does.
* -- adrian
*/
rb_dlinkAddTail(client, &client->node, &global_client_list);
read_packet(client->localClient->F, client);
}
/*
* auth_dns_callback - called when resolver query finishes
* if the query resulted in a successful search, hp will contain
* a non-null pointer, otherwise hp will be null.
* set the client on it's way to a connection completion, regardless
* of success of failure
*/
static void
auth_dns_callback(const char *result, int status, int aftype, void *vptr)
{
struct AuthRequest *auth = (struct AuthRequest *) vptr;
ClearDNSPending(auth);
/* XXX: this shouldn't happen, but it does. -nenolod */
if(auth->client->localClient == NULL)
{
sendto_realops_snomask(SNO_GENERAL, L_ALL,
"auth_dns_callback(): auth->client->localClient (%s) is NULL", get_client_name(auth->client, HIDE_IP));
rb_dlinkDelete(&auth->node, &auth_poll_list);
free_auth_request(auth);
/* and they will silently drop through and all will hopefully be ok... -nenolod */
return;
}
if(result != NULL && status)
{
int good = 1;
if(good && strlen(result) <= HOSTLEN)
{
rb_strlcpy(auth->client->host, result, sizeof(auth->client->host));
sendheader(auth->client, REPORT_FIN_DNS);
}
else if (strlen(result) > HOSTLEN)
sendheader(auth->client, REPORT_HOST_TOOLONG);
}
else
sendheader(auth->client, REPORT_FAIL_DNS);
release_auth_client(auth);
}
/*
* authsenderr - handle auth send errors
*/
static void
auth_error(struct AuthRequest *auth)
{
++ServerStats.is_abad;
rb_close(auth->F);
auth->F = NULL;
ClearAuth(auth);
sendheader(auth->client, REPORT_FAIL_ID);
release_auth_client(auth);
}
/*
* start_auth_query - Flag the client to show that an attempt to
* contact the ident server on
* the client's host. The connect and subsequently the socket are all put
* into 'non-blocking' mode. Should the connect or any later phase of the
* identifing process fail, it is aborted and the user is given a username
* of "unknown".
*/
static int
start_auth_query(struct AuthRequest *auth)
{
struct rb_sockaddr_storage localaddr, destaddr;
rb_fde_t *F;
int family;
if(IsAnyDead(auth->client))
return 0;
family = GET_SS_FAMILY(&auth->client->localClient->ip);
if((F = rb_socket(family, SOCK_STREAM, 0, "ident")) == NULL)
{
ilog_error("creating auth stream socket");
++ServerStats.is_abad;
return 0;
}
/*
* TBD: this is a pointless arbitrary limit .. we either have a socket or not. -nenolod
*/
if((maxconnections - 10) < rb_get_fd(F))
{
sendto_realops_snomask(SNO_GENERAL, L_ALL,
"Can't allocate fd for auth on %s",
get_client_name(auth->client, SHOW_IP));
rb_close(F);
return 0;
}
sendheader(auth->client, REPORT_DO_ID);
/*
* get the local address of the client and bind to that to
* make the auth request. This used to be done only for
* ifdef VIRTUAL_HOST, but needs to be done for all clients
* since the ident request must originate from that same address--
* and machines with multiple IP addresses are common now
*/
localaddr = auth->client->preClient->lip;
/* XXX mangle_mapped_sockaddr((struct sockaddr *)&localaddr); */
#ifdef RB_IPV6
if(GET_SS_FAMILY(&localaddr) == AF_INET6)
{
auth->lport = ntohs(((struct sockaddr_in6 *)&localaddr)->sin6_port);
((struct sockaddr_in6 *)&localaddr)->sin6_port = 0;
}
else
#endif
{
auth->lport = ntohs(((struct sockaddr_in *)&localaddr)->sin_port);
((struct sockaddr_in *)&localaddr)->sin_port = 0;
}
destaddr = auth->client->localClient->ip;
#ifdef RB_IPV6
if(GET_SS_FAMILY(&localaddr) == AF_INET6)
{
auth->rport = ntohs(((struct sockaddr_in6 *)&destaddr)->sin6_port);
((struct sockaddr_in6 *)&destaddr)->sin6_port = htons(113);
}
else
#endif
{
auth->rport = ntohs(((struct sockaddr_in *)&destaddr)->sin_port);
((struct sockaddr_in *)&destaddr)->sin_port = htons(113);
}
auth->F = F;
SetAuthConnect(auth);
rb_connect_tcp(F, (struct sockaddr *)&destaddr,
(struct sockaddr *) &localaddr, GET_SS_LEN(&localaddr),
auth_connect_callback, auth,
GlobalSetOptions.ident_timeout);
return 1; /* We suceed here for now */
}
/*
* GetValidIdent - parse ident query reply from identd server
*
* Inputs - pointer to ident buf
* Output - NULL if no valid ident found, otherwise pointer to name
* Side effects -
*/
static char *
GetValidIdent(char *buf)
{
int remp = 0;
int locp = 0;
char *colon1Ptr;
char *colon2Ptr;
char *colon3Ptr;
char *commaPtr;
char *remotePortString;
/* All this to get rid of a sscanf() fun. */
remotePortString = buf;
colon1Ptr = strchr(remotePortString, ':');
if(!colon1Ptr)
return 0;
*colon1Ptr = '\0';
colon1Ptr++;
colon2Ptr = strchr(colon1Ptr, ':');
if(!colon2Ptr)
return 0;
*colon2Ptr = '\0';
colon2Ptr++;
commaPtr = strchr(remotePortString, ',');
if(!commaPtr)
return 0;
*commaPtr = '\0';
commaPtr++;
remp = atoi(remotePortString);
if(!remp)
return 0;
locp = atoi(commaPtr);
if(!locp)
return 0;
/* look for USERID bordered by first pair of colons */
if(!strstr(colon1Ptr, "USERID"))
return 0;
colon3Ptr = strchr(colon2Ptr, ':');
if(!colon3Ptr)
return 0;
*colon3Ptr = '\0';
colon3Ptr++;
return (colon3Ptr);
}
/*
* start_auth - starts auth (identd) and dns queries for a client
*/
void
start_auth(struct Client *client)
{
struct AuthRequest *auth = 0;
s_assert(0 != client);
if(client == NULL)
return;
auth = make_auth_request(client);
sendheader(client, REPORT_DO_DNS);
/* No DNS cache now, remember? -- adrian */
auth->dns_id = lookup_ip(client->sockhost, GET_SS_FAMILY(&client->localClient->ip), auth_dns_callback, auth);
SetDNSPending(auth);
if(ConfigFileEntry.disable_auth == 0)
start_auth_query(auth);
rb_dlinkAdd(auth, &auth->node, &auth_poll_list);
}
/*
* timeout_auth_queries - timeout resolver and identd requests
* allow clients through if requests failed
*/
static void
timeout_auth_queries_event(void *notused)
{
rb_dlink_node *ptr;
rb_dlink_node *next_ptr;
struct AuthRequest *auth;
RB_DLINK_FOREACH_SAFE(ptr, next_ptr, auth_poll_list.head)
{
auth = ptr->data;
if(auth->timeout < rb_current_time())
{
if(auth->F != NULL)
rb_close(auth->F);
if(IsDoingAuth(auth))
{
ClearAuth(auth);
++ServerStats.is_abad;
sendheader(auth->client, REPORT_FAIL_ID);
auth->client->localClient->auth_request = NULL;
}
if(IsDNSPending(auth))
{
ClearDNSPending(auth);
cancel_lookup(auth->dns_id);
sendheader(auth->client, REPORT_FAIL_DNS);
}
auth->client->localClient->lasttime = rb_current_time();
release_auth_client(auth);
}
}
}
/*
* auth_connect_callback() - deal with the result of rb_connect_tcp()
*
* If the connection failed, we simply close the auth fd and report
* a failure. If the connection suceeded send the ident server a query
* giving "theirport , ourport". The write is only attempted *once* so
* it is deemed to be a fail if the entire write doesn't write all the
* data given. This shouldnt be a problem since the socket should have
* a write buffer far greater than this message to store it in should
* problems arise. -avalon
*/
static void
auth_connect_callback(rb_fde_t *F, int error, void *data)
{
struct AuthRequest *auth = data;
char authbuf[32];
int authlen;
/* Check the error */
if(error != RB_OK)
{
/* We had an error during connection :( */
auth_error(auth);
return;
}
snprintf(authbuf, sizeof(authbuf), "%u , %u\r\n",
auth->rport, auth->lport);
authlen = strlen(authbuf);
if(rb_write(auth->F, authbuf, authlen) != authlen)
{
auth_error(auth);
return;
}
ClearAuthConnect(auth);
SetAuthPending(auth);
read_auth_reply(auth->F, auth);
}
/*
* read_auth_reply - read the reply (if any) from the ident server
* we connected to.
* We only give it one shot, if the reply isn't good the first time
* fail the authentication entirely. --Bleep
*/
#define AUTH_BUFSIZ 128
static void
read_auth_reply(rb_fde_t *F, void *data)
{
struct AuthRequest *auth = data;
char *s = NULL;
char *t = NULL;
int len;
int count;
char buf[AUTH_BUFSIZ + 1]; /* buffer to read auth reply into */
len = rb_read(F, buf, AUTH_BUFSIZ);
if(len < 0 && rb_ignore_errno(errno))
{
rb_setselect(F, RB_SELECT_READ, read_auth_reply, auth);
return;
}
if(len > 0)
{
buf[len] = '\0';
if((s = GetValidIdent(buf)))
{
t = auth->client->username;
while (*s == '~' || *s == '^')
s++;
for (count = USERLEN; *s && count; s++)
{
if(*s == '@' || *s == '\r' || *s == '\n')
{
break;
}
if(!IsSpace(*s) && *s != ':' && *s != '[')
{
*t++ = *s;
count--;
}
}
*t = '\0';
}
}
rb_close(auth->F);
auth->F = NULL;
ClearAuth(auth);
if(s == NULL)
{
++ServerStats.is_abad;
strcpy(auth->client->username, "unknown");
sendheader(auth->client, REPORT_FAIL_ID);
}
else
{
sendheader(auth->client, REPORT_FIN_ID);
++ServerStats.is_asuc;
SetGotId(auth->client);
}
release_auth_client(auth);
}
/*
* delete_auth_queries()
*/
void
delete_auth_queries(struct Client *target_p)
{
struct AuthRequest *auth;
if(target_p == NULL || target_p->localClient == NULL ||
target_p->localClient->auth_request == NULL)
return;
auth = target_p->localClient->auth_request;
target_p->localClient->auth_request = NULL;
if(IsDNSPending(auth))
cancel_lookup(auth->dns_id);
if(auth->F != NULL)
rb_close(auth->F);
rb_dlinkDelete(&auth->node, &auth_poll_list);
free_auth_request(auth);
}

3
ircd/s_conf.c
View file

@ -43,7 +43,6 @@
#include "send.h"
#include "reject.h"
#include "cache.h"
#include "blacklist.h"
#include "privilege.h"
#include "sslproc.h"
#include "bandbi.h"
@ -1526,7 +1525,7 @@ clear_out_old_conf(void)
alias_dict = NULL;
}
destroy_blacklists();
del_blacklist_all();
privilegeset_mark_all_illegal();

82
ircd/s_user.c
View file

@ -48,7 +48,6 @@
#include "hook.h"
#include "monitor.h"
#include "snomask.h"
#include "blacklist.h"
#include "substitution.h"
#include "chmode.h"
#include "s_assert.h"
@ -252,8 +251,8 @@ register_local_user(struct Client *client_p, struct Client *source_p)
if(source_p->flags & FLAGS_CLICAP)
return -1;
/* still has DNSbls to validate against */
if(rb_dlink_list_length(&source_p->preClient->dnsbl_queries) > 0)
/* Waiting on authd */
if(source_p->preClient->authd_cid)
return -1;
client_p->localClient->last = rb_current_time();
@ -301,7 +300,6 @@ register_local_user(struct Client *client_p, struct Client *source_p)
rb_strlcpy(source_p->host, source_p->sockhost, sizeof(source_p->host));
}
aconf = source_p->localClient->att_conf;
if(aconf == NULL)
@ -421,47 +419,85 @@ register_local_user(struct Client *client_p, struct Client *source_p)
return CLIENT_EXITED;
}
/* dnsbl check */
if (source_p->preClient->dnsbl_listed != NULL)
/* authd rejection check */
if(source_p->preClient->authd_accepted == false)
{
struct blacklist_stats *stats;
rb_dlink_list varlist = { NULL, NULL, 0 };
char *reason;
substitution_append_var(&varlist, "nick", source_p->name);
substitution_append_var(&varlist, "ip", source_p->sockhost);
substitution_append_var(&varlist, "host", source_p->host);
substitution_append_var(&varlist, "dnsbl-host", source_p->preClient->authd_data);
substitution_append_var(&varlist, "network-name", ServerInfo.network_name);
reason = substitution_parse(source_p->preClient->authd_reason, &varlist);
switch(source_p->preClient->authd_cause)
{
case 'B': /* Blacklists */
if((stats = rb_dictionary_retrieve(bl_stats, source_p->preClient->authd_data)) != NULL)
stats->hits++;
if(IsExemptKline(source_p) || IsConfExemptDNSBL(aconf))
{
if (IsExemptKline(source_p) || IsConfExemptDNSBL(aconf))
sendto_one_notice(source_p, ":*** Your IP address %s is listed in %s, but you are exempt",
source_p->sockhost, source_p->preClient->dnsbl_listed->host);
source_p->sockhost, source_p->preClient->authd_data);
}
else
{
sendto_realops_snomask(SNO_REJ, L_NETWIDE,
"Listed on DNSBL %s: %s (%s@%s) [%s] [%s]",
source_p->preClient->dnsbl_listed->host,
source_p->preClient->authd_data,
source_p->name,
source_p->username, source_p->host,
IsIPSpoof(source_p) ? "255.255.255.255" : source_p->sockhost,
source_p->info);
rb_dlink_list varlist = { NULL, NULL, 0 };
ServerStats.is_ref++;
substitution_append_var(&varlist, "nick", source_p->name);
substitution_append_var(&varlist, "ip", source_p->sockhost);
substitution_append_var(&varlist, "host", source_p->host);
substitution_append_var(&varlist, "dnsbl-host", source_p->preClient->dnsbl_listed->host);
substitution_append_var(&varlist, "network-name", ServerInfo.network_name);
sendto_one(source_p, form_str(ERR_YOUREBANNEDCREEP),
me.name, source_p->name, reason);
sendto_one_notice(source_p, ":*** Your IP address %s is listed in %s",
source_p->sockhost, source_p->preClient->authd_data);
add_reject(source_p, NULL, NULL);
exit_client(client_p, source_p, &me, "*** Banned (DNS blacklist)");
substitution_free(&varlist);
return CLIENT_EXITED;
}
break;
default: /* Unknown, but handle the case properly */
if (IsExemptKline(source_p))
{
sendto_one_notice(source_p, ":*** You were rejected, but you are exempt (reason: %s)",
reason);
}
else
{
sendto_realops_snomask(SNO_REJ, L_NETWIDE,
"Rejected by authentication system (reason %s): %s (%s@%s) [%s] [%s]",
reason, source_p->name, source_p->username, source_p->host,
IsIPSpoof(source_p) ? "255.255.255.255" : source_p->sockhost,
source_p->info);
ServerStats.is_ref++;
sendto_one(source_p, form_str(ERR_YOUREBANNEDCREEP),
me.name, source_p->name,
substitution_parse(source_p->preClient->dnsbl_listed->reject_reason, &varlist));
me.name, source_p->name, reason);
substitution_free(&varlist);
sendto_one_notice(source_p, ":*** Your IP address %s is listed in %s",
source_p->sockhost, source_p->preClient->dnsbl_listed->host);
source_p->preClient->dnsbl_listed->hits++;
sendto_one_notice(source_p, ":*** Rejected by authentication system: %s",
reason);
add_reject(source_p, NULL, NULL);
exit_client(client_p, source_p, &me, "*** Banned (DNS blacklist)");
exit_client(client_p, source_p, &me, "*** Banned (authentication system)");
substitution_free(&varlist);
return CLIENT_EXITED;
}
}
substitution_free(&varlist);
}
/* valid user name check */
if(!valid_username(source_p->username))

1
modules/m_set.c
View file

@ -202,6 +202,7 @@ quote_identtimeout(struct Client *source_p, const char *arg, int newval)
"%s has changed IDENTTIMEOUT to %d",
get_oper_name(source_p), newval);
GlobalSetOptions.ident_timeout = newval;
set_authd_timeout("ident_timeout", newval);
}
else
sendto_one_notice(source_p, ":IDENTTIMEOUT is currently %d",

16
modules/m_stats.c
View file

@ -37,7 +37,6 @@
#include "s_serv.h" /* hunt_server */
#include "s_stats.h"
#include "s_user.h" /* show_opers */
#include "blacklist.h" /* dnsbl stuff */
#include "parse.h"
#include "modules.h"
#include "hook.h"
@ -758,19 +757,14 @@ stats_messages(struct Client *source_p)
static void
stats_dnsbl(struct Client *source_p)
{
rb_dlink_node *ptr;
struct Blacklist *blptr;
rb_dictionary_iter iter;
struct blacklist_stats *stats;
RB_DLINK_FOREACH(ptr, blacklist_list.head)
RB_DICTIONARY_FOREACH(stats, &iter, bl_stats)
{
blptr = ptr->data;
/* use RPL_STATSDEBUG for now -- jilles */
sendto_one_numeric(source_p, RPL_STATSDEBUG, "n :%d %s %s (%d)",
blptr->hits,
blptr->host,
blptr->status & CONF_ILLEGAL ? "disabled" : "active",
blptr->refcount);
sendto_one_numeric(source_p, RPL_STATSDEBUG, "n :%d %s",
stats->hits, (const char *)iter.cur->key);
}
}

2
modules/m_user.c
View file

@ -33,7 +33,6 @@
#include "msg.h"
#include "parse.h"
#include "modules.h"
#include "blacklist.h"
#include "s_assert.h"
static const char user_desc[] =
@ -92,7 +91,6 @@ do_local_user(struct Client *client_p, struct Client *source_p,
make_user(source_p);
lookup_blacklists(source_p);
source_p->flags |= FLAGS_SENTUSER;
rb_strlcpy(source_p->info, realname, sizeof(source_p->info));