solanum-vs-hackint-and-char.../ircd/s_auth.c

609 lines
15 KiB
C
Raw Normal View History

/*
* ircd-ratbox: A slightly useful ircd.
* s_auth.c: Functions for querying a users ident.
*
* Copyright (C) 1990 Jarkko Oikarinen and University of Oulu, Co Center
* Copyright (C) 1996-2002 Hybrid Development Team
* Copyright (C) 2002-2005 ircd-ratbox development team
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
* USA
*
*/
/*
* Changes:
* July 6, 1999 - Rewrote most of the code here. When a client connects
* to the server and passes initial socket validation checks, it
* is owned by this module (auth) which returns it to the rest of the
* server when dns and auth queries are finished. Until the client is
* released, the server does not know it exists and does not process
* any messages from it.
* --Bleep Thomas Helvey <tomh@inxpress.net>
*/
#include "stdinc.h"
2016-03-20 00:14:26 +00:00
#include "defaults.h"
#include "s_auth.h"
#include "s_conf.h"
#include "client.h"
#include "common.h"
#include "match.h"
#include "ircd.h"
#include "numeric.h"
#include "packet.h"
#include "dns.h"
#include "logger.h"
#include "s_stats.h"
#include "send.h"
#include "hook.h"
#include "blacklist.h"
#include "s_assert.h"
struct AuthRequest
{
rb_dlink_node node;
struct Client *client; /* pointer to client struct for request */
uint16_t dns_id; /* DNS Query */
unsigned int flags; /* current state of request */
rb_fde_t *F; /* file descriptor for auth queries */
time_t timeout; /* time when query expires */
uint16_t lport;
uint16_t rport;
};
/*
* flag values for AuthRequest
* NAMESPACE: AM_xxx - Authentication Module
*/
#define AM_AUTH_CONNECTING (1 << 0)
#define AM_AUTH_PENDING (1 << 1)
#define AM_DNS_PENDING (1 << 2)
#define SetDNSPending(x) ((x)->flags |= AM_DNS_PENDING)
#define ClearDNSPending(x) ((x)->flags &= ~AM_DNS_PENDING)
#define IsDNSPending(x) ((x)->flags & AM_DNS_PENDING)
#define SetAuthConnect(x) ((x)->flags |= AM_AUTH_CONNECTING)
#define ClearAuthConnect(x) ((x)->flags &= ~AM_AUTH_CONNECTING)
#define IsAuthConnect(x) ((x)->flags & AM_AUTH_CONNECTING)
#define SetAuthPending(x) ((x)->flags |= AM_AUTH_PENDING)
#define ClearAuthPending(x) ((x)->flags &= AM_AUTH_PENDING)
#define IsAuthPending(x) ((x)->flags & AM_AUTH_PENDING)
#define ClearAuth(x) ((x)->flags &= ~(AM_AUTH_PENDING | AM_AUTH_CONNECTING))
#define IsDoingAuth(x) ((x)->flags & (AM_AUTH_PENDING | AM_AUTH_CONNECTING))
/*
* a bit different approach
* this replaces the original sendheader macros
*/
static const char *HeaderMessages[] =
{
[svn] Backport from early 3.x: -- nenolod 2006/09/27 16:39:14 UTC (20060927-2178) Log: - remove "Processing connection to foobar.net" message Changes: Modified: +0 -3 trunk/src/s_auth.c (File Modified) nenolod 2006/09/27 16:34:26 UTC (20060927-2176) Log: - missed the processing connection one (actually, we can probably nuke this one) Changes: Modified: +1 -2 trunk/src/s_auth.c (File Modified) river 2006/09/27 16:33:05 UTC (20060927-2174) Log: get_client_name = stupid Changes: Modified: +10 -7 trunk/modules/core/m_kill.c (File Modified) nenolod 2006/09/27 16:32:37 UTC (20060927-2172) Log: - remove excessive arguments Changes: Modified: +1 -2 trunk/src/s_conf.c (File Modified) +1 -1 trunk/src/s_user.c (File Modified) nenolod 2006/09/27 16:30:59 UTC (20060927-2170) Log: - use sendto_one_notice() for on-connect notices too. Changes: Modified: +10 -10 trunk/src/s_auth.c (File Modified) nenolod 2006/09/27 16:27:01 UTC (20060927-2168) Log: - use sendto_one_notice() in the core, too. Changes: Modified: +2 -2 trunk/src/chmode.c (File Modified) +8 -15 trunk/src/modules.c (File Modified) +3 -5 trunk/src/s_conf.c (File Modified) +1 -2 trunk/src/s_newconf.c (File Modified) +20 -57 trunk/src/s_user.c (File Modified) river 2006/09/27 16:19:25 UTC (20060927-2166) Log: the KILL command will use get_client_name(, SHOW_IP) instead of target->name, and will show a more useful error for local opers Changes: Modified: +6 -4 trunk/modules/core/m_kill.c (File Modified) nenolod 2006/09/27 16:09:48 UTC (20060927-2164) Log: - fix bugs in sendto_one_notice()/sendto_one_numeric() where a client identifier won't be sent to unregistered clients Changes: Modified: +4 -2 trunk/src/send.c (File Modified) nenolod 2006/09/27 16:05:46 UTC (20060927-2161) Log: - back out r2159 Changes: Modified: +1 -1 trunk/include/client.h (File Modified) nenolod 2006/09/27 16:04:05 UTC (20060927-2159) Log: - get_id(): fall back to "*" if client has no known name Changes: Modified: +1 -1 trunk/include/client.h (File Modified) nenolod 2006/09/27 16:01:29 UTC (20060927-2157) Log: - convert to sendto_one_notice(). Changes: Modified: +2 -3 trunk/unsupported/m_clearchan.c (File Modified) +4 -6 trunk/unsupported/m_force.c (File Modified) nenolod 2006/09/27 15:57:11 UTC (20060927-2155) Log: - use sendto_one_notice() in many places instead of sendto_one(source_p, ":%s NOTICE %s :", ...); Changes: Modified: +10 -25 trunk/extensions/example_module.c (File Modified) +5 -14 trunk/extensions/hurt.c (File Modified) +1 -2 trunk/extensions/m_42.c (File Modified) +7 -12 trunk/extensions/m_mkpasswd.c (File Modified) +1 -2 trunk/extensions/m_ojoin.c (File Modified) +1 -2 trunk/extensions/m_opme.c (File Modified) +3 -3 trunk/extensions/spy_whois_notice.c (File Modified) +3 -3 trunk/extensions/spy_whois_notice_global.c (File Modified) +3 -7 trunk/modules/core/m_die.c (File Modified) +2 -4 trunk/modules/core/m_kill.c (File Modified) +2 -2 trunk/modules/core/m_squit.c (File Modified) +1 -2 trunk/modules/m_challenge.c (File Modified) +11 -15 trunk/modules/m_connect.c (File Modified) +20 -28 trunk/modules/m_dline.c (File Modified) +2 -2 trunk/modules/m_etrace.c (File Modified) +11 -21 trunk/modules/m_gline.c (File Modified) +2 -4 trunk/modules/m_kline.c (File Modified) +1 -2 trunk/modules/m_rehash.c (File Modified) +3 -7 trunk/modules/m_restart.c (File Modified) +31 -45 trunk/modules/m_set.c (File Modified) +2 -4 trunk/modules/m_testmask.c (File Modified) +5 -8 trunk/modules/m_unreject.c (File Modified) +2 -5 trunk/modules/m_xline.c (File Modified) --
2007-01-25 07:23:01 +00:00
":*** Looking up your hostname...",
":*** Found your hostname",
":*** Couldn't look up your hostname",
":*** Checking Ident",
":*** Got Ident response",
":*** No Ident response",
":*** Your hostname is too long, ignoring hostname",
":*** Your forward and reverse DNS do not match, ignoring hostname",
":*** Cannot verify hostname validity, ignoring hostname",
};
typedef enum
{
REPORT_DO_DNS,
REPORT_FIN_DNS,
REPORT_FAIL_DNS,
REPORT_DO_ID,
REPORT_FIN_ID,
REPORT_FAIL_ID,
REPORT_HOST_TOOLONG,
REPORT_HOST_MISMATCH,
REPORT_HOST_UNKNOWN
}
ReportType;
#define sendheader(c, r) sendto_one_notice(c, "%s", HeaderMessages[(r)])
2008-04-01 20:41:52 +00:00
static rb_dlink_list auth_poll_list;
static rb_bh *auth_heap;
static EVH timeout_auth_queries_event;
static PF read_auth_reply;
static CNCB auth_connect_callback;
/*
* init_auth()
*
* Initialise the auth code
*/
void
init_auth(void)
{
/* This hook takes a struct Client for its argument */
memset(&auth_poll_list, 0, sizeof(auth_poll_list));
2008-04-02 01:43:35 +00:00
rb_event_addish("timeout_auth_queries_event", timeout_auth_queries_event, NULL, 1);
2008-04-02 19:14:34 +00:00
auth_heap = rb_bh_create(sizeof(struct AuthRequest), LCLIENT_HEAP_SIZE, "auth_heap");
}
/*
* make_auth_request - allocate a new auth request
*/
static struct AuthRequest *
make_auth_request(struct Client *client)
{
struct AuthRequest *request = rb_bh_alloc(auth_heap);
client->localClient->auth_request = request;
2008-04-02 19:14:34 +00:00
request->F = NULL;
request->client = client;
2008-04-01 23:53:20 +00:00
request->timeout = rb_current_time() + ConfigFileEntry.connect_timeout;
return request;
}
/*
* free_auth_request - cleanup auth request allocations
*/
static void
free_auth_request(struct AuthRequest *request)
{
rb_bh_free(auth_heap, request);
}
/*
* release_auth_client - release auth client from auth system
* this adds the client into the local client lists so it can be read by
* the main io processing loop
*/
static void
release_auth_client(struct AuthRequest *auth)
{
struct Client *client = auth->client;
if(IsDNSPending(auth) || IsDoingAuth(auth))
return;
client->localClient->auth_request = NULL;
2008-04-01 20:41:52 +00:00
rb_dlinkDelete(&auth->node, &auth_poll_list);
free_auth_request(auth);
/*
* When a client has auth'ed, we want to start reading what it sends
* us. This is what read_packet() does.
* -- adrian
*/
2008-04-01 20:41:52 +00:00
rb_dlinkAddTail(client, &client->node, &global_client_list);
2008-04-02 19:14:34 +00:00
read_packet(client->localClient->F, client);
}
/*
* auth_dns_callback - called when resolver query finishes
* if the query resulted in a successful search, hp will contain
* a non-null pointer, otherwise hp will be null.
* set the client on it's way to a connection completion, regardless
* of success of failure
*/
static void
auth_dns_callback(const char *result, int status, int aftype, void *vptr)
{
struct AuthRequest *auth = (struct AuthRequest *) vptr;
ClearDNSPending(auth);
/* XXX: this shouldn't happen, but it does. -nenolod */
if(auth->client->localClient == NULL)
{
sendto_realops_snomask(SNO_GENERAL, L_ALL,
"auth_dns_callback(): auth->client->localClient (%s) is NULL", get_client_name(auth->client, HIDE_IP));
2008-04-01 20:41:52 +00:00
rb_dlinkDelete(&auth->node, &auth_poll_list);
free_auth_request(auth);
/* and they will silently drop through and all will hopefully be ok... -nenolod */
return;
}
if(result != NULL && status)
{
int good = 1;
if(good && strlen(result) <= HOSTLEN)
{
rb_strlcpy(auth->client->host, result, sizeof(auth->client->host));
sendheader(auth->client, REPORT_FIN_DNS);
}
else if (strlen(result) > HOSTLEN)
sendheader(auth->client, REPORT_HOST_TOOLONG);
}
else
sendheader(auth->client, REPORT_FAIL_DNS);
release_auth_client(auth);
}
/*
* authsenderr - handle auth send errors
*/
static void
auth_error(struct AuthRequest *auth)
{
++ServerStats.is_abad;
2008-04-02 19:14:34 +00:00
rb_close(auth->F);
auth->F = NULL;
ClearAuth(auth);
sendheader(auth->client, REPORT_FAIL_ID);
release_auth_client(auth);
}
/*
* start_auth_query - Flag the client to show that an attempt to
* contact the ident server on
* the client's host. The connect and subsequently the socket are all put
* into 'non-blocking' mode. Should the connect or any later phase of the
* identifing process fail, it is aborted and the user is given a username
* of "unknown".
*/
static int
start_auth_query(struct AuthRequest *auth)
{
2008-04-02 19:14:34 +00:00
struct rb_sockaddr_storage localaddr, destaddr;
rb_fde_t *F;
int family;
if(IsAnyDead(auth->client))
return 0;
family = auth->client->localClient->ip.ss_family;
2008-04-02 19:14:34 +00:00
if((F = rb_socket(family, SOCK_STREAM, 0, "ident")) == NULL)
{
2008-04-03 02:47:03 +00:00
ilog_error("creating auth stream socket");
++ServerStats.is_abad;
return 0;
}
/*
* TBD: this is a pointless arbitrary limit .. we either have a socket or not. -nenolod
*/
2008-04-02 19:14:34 +00:00
if((maxconnections - 10) < rb_get_fd(F))
{
sendto_realops_snomask(SNO_GENERAL, L_ALL,
"Can't allocate fd for auth on %s",
get_client_name(auth->client, SHOW_IP));
2008-04-02 19:14:34 +00:00
rb_close(F);
return 0;
}
sendheader(auth->client, REPORT_DO_ID);
/*
* get the local address of the client and bind to that to
* make the auth request. This used to be done only for
* ifdef VIRTUAL_HOST, but needs to be done for all clients
* since the ident request must originate from that same address--
* and machines with multiple IP addresses are common now
*/
2008-08-27 22:49:04 +00:00
localaddr = auth->client->preClient->lip;
2008-04-02 19:14:34 +00:00
/* XXX mangle_mapped_sockaddr((struct sockaddr *)&localaddr); */
#ifdef RB_IPV6
if(localaddr.ss_family == AF_INET6)
{
auth->lport = ntohs(((struct sockaddr_in6 *)&localaddr)->sin6_port);
((struct sockaddr_in6 *)&localaddr)->sin6_port = 0;
}
else
#endif
{
auth->lport = ntohs(((struct sockaddr_in *)&localaddr)->sin_port);
((struct sockaddr_in *)&localaddr)->sin_port = 0;
}
2008-04-02 19:14:34 +00:00
destaddr = auth->client->localClient->ip;
#ifdef RB_IPV6
2008-04-02 19:14:34 +00:00
if(localaddr.ss_family == AF_INET6)
{
auth->rport = ntohs(((struct sockaddr_in6 *)&destaddr)->sin6_port);
((struct sockaddr_in6 *)&destaddr)->sin6_port = htons(113);
}
else
2008-04-02 19:14:34 +00:00
#endif
{
auth->rport = ntohs(((struct sockaddr_in *)&destaddr)->sin_port);
((struct sockaddr_in *)&destaddr)->sin_port = htons(113);
}
2008-04-02 19:14:34 +00:00
auth->F = F;
SetAuthConnect(auth);
2008-04-02 19:14:34 +00:00
rb_connect_tcp(F, (struct sockaddr *)&destaddr,
(struct sockaddr *) &localaddr, GET_SS_LEN(&localaddr),
auth_connect_callback, auth,
2008-04-02 19:14:34 +00:00
GlobalSetOptions.ident_timeout);
return 1; /* We suceed here for now */
}
/*
* GetValidIdent - parse ident query reply from identd server
*
* Inputs - pointer to ident buf
* Output - NULL if no valid ident found, otherwise pointer to name
* Side effects -
*/
static char *
GetValidIdent(char *buf)
{
int remp = 0;
int locp = 0;
char *colon1Ptr;
char *colon2Ptr;
char *colon3Ptr;
char *commaPtr;
char *remotePortString;
/* All this to get rid of a sscanf() fun. */
remotePortString = buf;
colon1Ptr = strchr(remotePortString, ':');
if(!colon1Ptr)
return 0;
*colon1Ptr = '\0';
colon1Ptr++;
colon2Ptr = strchr(colon1Ptr, ':');
if(!colon2Ptr)
return 0;
*colon2Ptr = '\0';
colon2Ptr++;
commaPtr = strchr(remotePortString, ',');
if(!commaPtr)
return 0;
*commaPtr = '\0';
commaPtr++;
remp = atoi(remotePortString);
if(!remp)
return 0;
locp = atoi(commaPtr);
if(!locp)
return 0;
/* look for USERID bordered by first pair of colons */
if(!strstr(colon1Ptr, "USERID"))
return 0;
colon3Ptr = strchr(colon2Ptr, ':');
if(!colon3Ptr)
return 0;
*colon3Ptr = '\0';
colon3Ptr++;
return (colon3Ptr);
}
/*
* start_auth - starts auth (identd) and dns queries for a client
*/
void
start_auth(struct Client *client)
{
struct AuthRequest *auth = 0;
s_assert(0 != client);
if(client == NULL)
return;
auth = make_auth_request(client);
sendheader(client, REPORT_DO_DNS);
/* No DNS cache now, remember? -- adrian */
auth->dns_id = lookup_ip(client->sockhost, GET_SS_FAMILY(&client->localClient->ip), auth_dns_callback, auth);
SetDNSPending(auth);
if(ConfigFileEntry.disable_auth == 0)
start_auth_query(auth);
2008-04-01 20:41:52 +00:00
rb_dlinkAdd(auth, &auth->node, &auth_poll_list);
}
/*
* timeout_auth_queries - timeout resolver and identd requests
* allow clients through if requests failed
*/
static void
timeout_auth_queries_event(void *notused)
{
2008-04-01 20:41:52 +00:00
rb_dlink_node *ptr;
rb_dlink_node *next_ptr;
struct AuthRequest *auth;
RB_DLINK_FOREACH_SAFE(ptr, next_ptr, auth_poll_list.head)
{
auth = ptr->data;
2008-04-01 23:53:20 +00:00
if(auth->timeout < rb_current_time())
{
2008-04-02 19:14:34 +00:00
if(auth->F != NULL)
rb_close(auth->F);
if(IsDoingAuth(auth))
{
ClearAuth(auth);
++ServerStats.is_abad;
sendheader(auth->client, REPORT_FAIL_ID);
auth->client->localClient->auth_request = NULL;
}
if(IsDNSPending(auth))
{
ClearDNSPending(auth);
cancel_lookup(auth->dns_id);
sendheader(auth->client, REPORT_FAIL_DNS);
}
2008-04-01 23:53:20 +00:00
auth->client->localClient->lasttime = rb_current_time();
release_auth_client(auth);
}
}
}
/*
2008-04-01 20:38:40 +00:00
* auth_connect_callback() - deal with the result of rb_connect_tcp()
*
* If the connection failed, we simply close the auth fd and report
* a failure. If the connection suceeded send the ident server a query
* giving "theirport , ourport". The write is only attempted *once* so
* it is deemed to be a fail if the entire write doesn't write all the
* data given. This shouldnt be a problem since the socket should have
* a write buffer far greater than this message to store it in should
* problems arise. -avalon
*/
static void
2008-04-02 19:14:34 +00:00
auth_connect_callback(rb_fde_t *F, int error, void *data)
{
struct AuthRequest *auth = data;
char authbuf[32];
int authlen;
/* Check the error */
2008-04-02 19:14:34 +00:00
if(error != RB_OK)
{
/* We had an error during connection :( */
auth_error(auth);
return;
}
snprintf(authbuf, sizeof(authbuf), "%u , %u\r\n",
auth->rport, auth->lport);
authlen = strlen(authbuf);
if(rb_write(auth->F, authbuf, authlen) != authlen)
{
auth_error(auth);
return;
}
ClearAuthConnect(auth);
SetAuthPending(auth);
2008-04-02 19:14:34 +00:00
read_auth_reply(auth->F, auth);
}
/*
* read_auth_reply - read the reply (if any) from the ident server
* we connected to.
* We only give it one shot, if the reply isn't good the first time
* fail the authentication entirely. --Bleep
*/
#define AUTH_BUFSIZ 128
static void
2008-04-02 19:14:34 +00:00
read_auth_reply(rb_fde_t *F, void *data)
{
struct AuthRequest *auth = data;
char *s = NULL;
char *t = NULL;
int len;
int count;
char buf[AUTH_BUFSIZ + 1]; /* buffer to read auth reply into */
len = rb_read(F, buf, AUTH_BUFSIZ);
2008-04-02 19:14:34 +00:00
if(len < 0 && rb_ignore_errno(errno))
{
2008-04-02 19:14:34 +00:00
rb_setselect(F, RB_SELECT_READ, read_auth_reply, auth);
return;
}
if(len > 0)
{
buf[len] = '\0';
if((s = GetValidIdent(buf)))
{
t = auth->client->username;
while (*s == '~' || *s == '^')
s++;
for (count = USERLEN; *s && count; s++)
{
if(*s == '@')
{
break;
}
if(!IsSpace(*s) && *s != ':' && *s != '[')
{
*t++ = *s;
count--;
}
}
*t = '\0';
}
}
2008-04-02 19:14:34 +00:00
rb_close(auth->F);
auth->F = NULL;
ClearAuth(auth);
if(s == NULL)
{
++ServerStats.is_abad;
strcpy(auth->client->username, "unknown");
sendheader(auth->client, REPORT_FAIL_ID);
}
else
{
sendheader(auth->client, REPORT_FIN_ID);
++ServerStats.is_asuc;
SetGotId(auth->client);
}
release_auth_client(auth);
}
/*
* delete_auth_queries()
*/
void
delete_auth_queries(struct Client *target_p)
{
struct AuthRequest *auth;
if(target_p == NULL || target_p->localClient == NULL ||
target_p->localClient->auth_request == NULL)
return;
auth = target_p->localClient->auth_request;
target_p->localClient->auth_request = NULL;
if(IsDNSPending(auth))
cancel_lookup(auth->dns_id);
2008-04-02 19:14:34 +00:00
if(auth->F != NULL)
rb_close(auth->F);
2008-04-01 20:41:52 +00:00
rb_dlinkDelete(&auth->node, &auth_poll_list);
free_auth_request(auth);
}