From 6535177fef2f782593f2f95bf5d2ca709dd46e2d Mon Sep 17 00:00:00 2001 From: Elizabeth Myers Date: Sun, 27 Mar 2016 13:52:52 -0500 Subject: [PATCH 01/14] authd/provider: add data to rejection tag. This is used for information such as what blacklist rejected the client. --- authd/provider.c | 13 ++++++++----- authd/provider.h | 2 +- authd/providers/blacklist.c | 2 +- 3 files changed, 10 insertions(+), 7 deletions(-) diff --git a/authd/provider.c b/authd/provider.c index fcd9490a..941e4059 100644 --- a/authd/provider.c +++ b/authd/provider.c @@ -115,7 +115,7 @@ destroy_providers(void) RB_DICTIONARY_FOREACH(auth, &iter, auth_clients) { /* TBD - is this the right thing? */ - reject_client(auth, 0, "Authentication system is down... try reconnecting in a few seconds"); + reject_client(auth, -1, "destroy", "Authentication system is down... try reconnecting in a few seconds"); } RB_DLINK_FOREACH(ptr, auth_providers.head) @@ -161,7 +161,7 @@ provider_done(struct auth_client *auth, provider_t id) { if(!auth->providers_starting) /* Only do this when there are no providers left */ - accept_client(auth, 0); + accept_client(auth, -1); return; } @@ -177,7 +177,7 @@ provider_done(struct auth_client *auth, provider_t id) /* Reject a client - WARNING: do not use auth instance after calling! */ void -reject_client(struct auth_client *auth, provider_t id, const char *reason) +reject_client(struct auth_client *auth, provider_t id, const char *data, const char *reason) { char reject; @@ -197,11 +197,14 @@ reject_client(struct auth_client *auth, provider_t id, const char *reason) break; } + if(data == NULL) + data = "*"; + /* We send back username and hostname in case ircd wants to overrule our decision. * In the future this may not be the case. * --Elizafox */ - rb_helper_write(authd_helper, "R %x %c %s %s :%s", auth->cid, reject, auth->username, auth->hostname, reason); + rb_helper_write(authd_helper, "R %x %c %s %s %s :%s", auth->cid, reject, auth->username, auth->hostname, data, reason); set_provider_off(auth, id); cancel_providers(auth); @@ -285,7 +288,7 @@ start_auth(const char *cid, const char *l_ip, const char *l_port, const char *c_ /* If no providers are running, accept the client */ if(!auth->providers) - accept_client(auth, 0); + accept_client(auth, -1); } /* Callback for the initiation */ diff --git a/authd/provider.h b/authd/provider.h index a9e99e2c..3c2773cc 100644 --- a/authd/provider.h +++ b/authd/provider.h @@ -97,7 +97,7 @@ void cancel_providers(struct auth_client *auth); void provider_done(struct auth_client *auth, provider_t id); void accept_client(struct auth_client *auth, provider_t id); -void reject_client(struct auth_client *auth, provider_t id, const char *reason); +void reject_client(struct auth_client *auth, provider_t id, const char *data, const char *reason); void handle_new_connection(int parc, char *parv[]); void handle_cancel_connection(int parc, char *parv[]); diff --git a/authd/providers/blacklist.c b/authd/providers/blacklist.c index c05cb630..c738b438 100644 --- a/authd/providers/blacklist.c +++ b/authd/providers/blacklist.c @@ -246,7 +246,7 @@ blacklist_dns_callback(const char *result, bool status, query_type type, void *d { /* Match found, so proceed no further */ blacklists_cancel(auth); - reject_client(auth, PROVIDER_BLACKLIST, bl->reason); + reject_client(auth, PROVIDER_BLACKLIST, bl->host, bl->reason); return; } From eccc44ed7b4fad9c7f581cd642fd50c4a04d5e91 Mon Sep 17 00:00:00 2001 From: Elizabeth Myers Date: Sun, 27 Mar 2016 14:41:50 -0500 Subject: [PATCH 02/14] authd/providers/blacklist: use uint8_t for iptype This clearly illustrates what it is --- authd/providers/blacklist.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/authd/providers/blacklist.c b/authd/providers/blacklist.c index c738b438..03bc7cab 100644 --- a/authd/providers/blacklist.c +++ b/authd/providers/blacklist.c @@ -58,7 +58,7 @@ struct blacklist { char host[IRCD_RES_HOSTLEN + 1]; char reason[BUFSIZE]; /* Reason template (ircd fills in the blanks) */ - unsigned char iptype; /* IP types supported */ + uint8_t iptype; /* IP types supported */ rb_dlink_list filters; /* Filters for queries */ bool delete; /* If true delete when no clients */ @@ -102,7 +102,7 @@ static void blacklists_cancel(struct auth_client *); /* private interfaces */ static void unref_blacklist(struct blacklist *); -static struct blacklist *new_blacklist(const char *, const char *, unsigned char, rb_dlink_list *); +static struct blacklist *new_blacklist(const char *, const char *, uint8_t, rb_dlink_list *); static struct blacklist *find_blacklist(const char *); static bool blacklist_check_reply(struct blacklist_lookup *, const char *); static void blacklist_dns_callback(const char *, bool, query_type, void *); @@ -136,7 +136,7 @@ unref_blacklist(struct blacklist *bl) } static struct blacklist * -new_blacklist(const char *name, const char *reason, unsigned char iptype, rb_dlink_list *filters) +new_blacklist(const char *name, const char *reason, uint8_t iptype, rb_dlink_list *filters) { struct blacklist *bl; @@ -442,7 +442,7 @@ add_conf_blacklist(const char *key, int parc, const char **parv) { rb_dlink_list filters = { NULL, NULL, 0 }; char *tmp, *elemlist = rb_strdup(parv[2]); - unsigned char iptype; + uint8_t iptype; if(*elemlist == '*') goto end; From 02e141f7a3c7cfff57cccd5f721fb9352b78531d Mon Sep 17 00:00:00 2001 From: Elizabeth Myers Date: Sun, 27 Mar 2016 17:04:14 -0500 Subject: [PATCH 03/14] authd: add stats reporting API --- authd/dns.c | 19 ++++++++++++------- authd/notice.c | 40 ++++++++++++++++++++++++++++++++++++++-- authd/notice.h | 3 +++ 3 files changed, 53 insertions(+), 9 deletions(-) diff --git a/authd/dns.c b/authd/dns.c index 19b3efcb..487979fe 100644 --- a/authd/dns.c +++ b/authd/dns.c @@ -20,6 +20,7 @@ #include "authd.h" #include "dns.h" +#include "notice.h" #include "res.h" static void handle_lookup_ip_reply(void *data, struct DNSReply *reply); @@ -255,35 +256,39 @@ enumerate_nameservers(const char *rid, const char letter) { char buf[(HOSTIPLEN + 1) * IRCD_MAXNS]; char *c = buf; - int i; + size_t s = 0; + uint32_t i_rid = (uint32_t)strtol(rid, NULL, 16); if (!irc_nscount) { /* Shouldn't happen */ - rb_helper_write(authd_helper, "X %s %c NONAMESERVERS", rid, letter); + stats_error(i_rid, letter, "NONAMESERVERS"); return; } - for(i = 0; i < irc_nscount; i++) + for(int i = 0; i < irc_nscount; i++) { char addr[HOSTIPLEN]; + size_t addrlen; rb_inet_ntop_sock((struct sockaddr *)&irc_nsaddr_list[i], addr, sizeof(addr)); if (!addr[0]) { /* Shouldn't happen */ - rb_helper_write(authd_helper, "X %s %c INVALIDNAMESERVER", rid, letter); + stats_error(i_rid, letter, "INVALIDNAMESERVER"); return; } - (void)snprintf(c, HOSTIPLEN + 1, "%s ", addr); - c += strlen(addr) + 1; + addrlen = strlen(addr) + 1; + (void)snprintf(c, sizeof(buf) - s, "%s ", addr); + c += addrlen; + s += addrlen; } *(--c) = '\0'; - rb_helper_write(authd_helper, "Y %s %c %s", rid, letter, buf); + stats_result(i_rid, letter, "%s", buf); } void diff --git a/authd/notice.c b/authd/notice.c index 3e1d3f8a..76e231c2 100644 --- a/authd/notice.c +++ b/authd/notice.c @@ -22,7 +22,8 @@ #include "notice.h" /* Send a notice to a client */ -void notice_client(uint32_t cid, const char *fmt, ...) +void +notice_client(uint32_t cid, const char *fmt, ...) { char buf[BUFSIZE]; va_list args; @@ -35,7 +36,8 @@ void notice_client(uint32_t cid, const char *fmt, ...) } /* Send a warning to the IRC daemon for logging, etc. */ -void warn_opers(notice_level_t level, const char *fmt, ...) +void +warn_opers(notice_level_t level, const char *fmt, ...) { char buf[BUFSIZE]; va_list args; @@ -46,3 +48,37 @@ void warn_opers(notice_level_t level, const char *fmt, ...) rb_helper_write(authd_helper, "W %c :%s", level, buf); } + +/* Send a stats result */ +void +stats_result(uint32_t cid, char letter, const char *fmt, ...) +{ + char buf[BUFSIZE]; + va_list args; + + va_start(args, fmt); + vsnprintf(buf, sizeof(buf), fmt, args); + va_end(args); + + rb_helper_write(authd_helper, "Y %x %c %s", cid, letter, buf); +} + +/* Send a stats error */ +void +stats_error(uint32_t cid, char letter, const char *fmt, ...) +{ + char buf[BUFSIZE]; + va_list args; + + va_start(args, fmt); + vsnprintf(buf, sizeof(buf), fmt, args); + va_end(args); + + rb_helper_write(authd_helper, "X %x %c %s", cid, letter, buf); +} + +void +stats_done(uint32_t cid, char letter) +{ + rb_helper_write(authd_helper, "Z %x %c", cid, letter); +} diff --git a/authd/notice.h b/authd/notice.h index 1e48bccf..5a4349ab 100644 --- a/authd/notice.h +++ b/authd/notice.h @@ -31,5 +31,8 @@ typedef enum void notice_client(uint32_t cid, const char *fmt, ...); void warn_opers(notice_level_t level, const char *fmt, ...); +void stats_result(uint32_t cid, char letter, const char *fmt, ...); +void stats_error(uint32_t cid, char letter, const char *fmt, ...); +void stats_done(uint32_t cid, char letter); #endif /* __CHARYBDIS_AUTHD_NOTICE_H__ */ From ee7f92714ad53c5bc362447fc98670d873863411 Mon Sep 17 00:00:00 2001 From: Elizabeth Myers Date: Sun, 27 Mar 2016 17:15:08 -0500 Subject: [PATCH 04/14] authd/provider: add stats handling hooking --- authd/provider.c | 7 +++++++ authd/provider.h | 8 ++++++++ 2 files changed, 15 insertions(+) diff --git a/authd/provider.c b/authd/provider.c index 941e4059..b512b4a0 100644 --- a/authd/provider.c +++ b/authd/provider.c @@ -74,6 +74,9 @@ load_provider(struct auth_provider *provider) rb_dictionary_add(authd_option_handlers, handler->option, handler); } + if(provider->stats_handler.letter != '\0') + authd_stat_handlers[provider->stats_handler.letter] = provider->stats_handler.handler; + provider->init(); rb_dlinkAdd(provider, &provider->node, &auth_providers); } @@ -88,6 +91,10 @@ unload_provider(struct auth_provider *provider) for(handler = provider->opt_handlers; handler->option != NULL; handler++) rb_dictionary_delete(authd_option_handlers, handler->option); } + + if(provider->stats_handler.letter != '\0') + authd_stat_handlers[provider->stats_handler.letter] = NULL; + provider->destroy(); rb_dlinkDelete(&provider->node, &auth_providers); } diff --git a/authd/provider.h b/authd/provider.h index 3c2773cc..c5462c93 100644 --- a/authd/provider.h +++ b/authd/provider.h @@ -65,6 +65,12 @@ typedef bool (*provider_start_t)(struct auth_client *); typedef void (*provider_cancel_t)(struct auth_client *); typedef void (*provider_complete_t)(struct auth_client *, provider_t); +struct auth_stats_handler +{ + const char letter; + authd_stat_handler handler; +}; + struct auth_provider { rb_dlink_node node; @@ -78,6 +84,8 @@ struct auth_provider provider_cancel_t cancel; /* Authentication cancelled */ provider_complete_t completed; /* Callback for when other performers complete (think dependency chains) */ + struct auth_stats_handler stats_handler; + struct auth_opts_handler *opt_handlers; }; From 26d491b95fce9be22a72f498907dcaccbcb20b15 Mon Sep 17 00:00:00 2001 From: Elizabeth Myers Date: Sun, 27 Mar 2016 17:28:26 -0500 Subject: [PATCH 05/14] authd: pass in uint32_t rid's. --- authd/authd.c | 9 ++++++++- authd/authd.h | 2 +- authd/dns.c | 16 +++++++--------- authd/dns.h | 2 +- 4 files changed, 17 insertions(+), 12 deletions(-) diff --git a/authd/authd.c b/authd/authd.c index 6f500a9d..8aabf267 100644 --- a/authd/authd.c +++ b/authd/authd.c @@ -53,6 +53,7 @@ static void handle_stat(int parc, char *parv[]) { authd_stat_handler handler; + long lrid; if(parc < 3) { @@ -60,10 +61,16 @@ handle_stat(int parc, char *parv[]) return; } + if((lrid = strtol(parv[1], NULL, 16)) > UINT32_MAX) + { + warn_opers(L_CRIT, "BUG: handle_stat got a rid that was too large: %lx", lrid); + return; + } + if (!(handler = authd_stat_handlers[(unsigned char)parv[2][0]])) return; - handler(parv[1], parv[2][0]); + handler((uint32_t)lrid, parv[2][0]); } static void diff --git a/authd/authd.h b/authd/authd.h index 07c746ca..43901dc0 100644 --- a/authd/authd.h +++ b/authd/authd.h @@ -40,7 +40,7 @@ struct auth_opts_handler extern rb_helper *authd_helper; typedef void (*authd_cmd_handler)(int parc, char *parv[]); -typedef void (*authd_stat_handler)(const char *rid, const char letter); +typedef void (*authd_stat_handler)(uint32_t rid, const char letter); typedef void (*authd_reload_handler)(const char letter); extern authd_cmd_handler authd_cmd_handlers[256]; diff --git a/authd/dns.c b/authd/dns.c index 487979fe..7d6d9472 100644 --- a/authd/dns.c +++ b/authd/dns.c @@ -252,17 +252,15 @@ handle_resolve_dns(int parc, char *parv[]) } void -enumerate_nameservers(const char *rid, const char letter) +enumerate_nameservers(uint32_t rid, const char letter) { char buf[(HOSTIPLEN + 1) * IRCD_MAXNS]; - char *c = buf; size_t s = 0; - uint32_t i_rid = (uint32_t)strtol(rid, NULL, 16); if (!irc_nscount) { /* Shouldn't happen */ - stats_error(i_rid, letter, "NONAMESERVERS"); + stats_error(rid, letter, "NONAMESERVERS"); return; } @@ -276,19 +274,19 @@ enumerate_nameservers(const char *rid, const char letter) if (!addr[0]) { /* Shouldn't happen */ - stats_error(i_rid, letter, "INVALIDNAMESERVER"); + stats_error(rid, letter, "INVALIDNAMESERVER"); return; } addrlen = strlen(addr) + 1; - (void)snprintf(c, sizeof(buf) - s, "%s ", addr); - c += addrlen; + (void)snprintf(&buf[s], sizeof(buf) - s, "%s ", addr); s += addrlen; } - *(--c) = '\0'; + if(s > 0) + buf[--s] = '\0'; - stats_result(i_rid, letter, "%s", buf); + stats_result(rid, letter, "%s", buf); } void diff --git a/authd/dns.h b/authd/dns.h index b4eae8c6..7383ab69 100644 --- a/authd/dns.h +++ b/authd/dns.h @@ -55,7 +55,7 @@ extern struct dns_query *lookup_ip(const char *host, int aftype, DNSCB callback, extern void cancel_query(struct dns_query *query); extern void handle_resolve_dns(int parc, char *parv[]); -extern void enumerate_nameservers(const char *rid, const char letter); +extern void enumerate_nameservers(uint32_t rid, const char letter); extern void reload_nameservers(const char letter); #endif From 54fb109d82db131d80e71a30b9d1214fbe53bf54 Mon Sep 17 00:00:00 2001 From: Elizabeth Myers Date: Sun, 27 Mar 2016 23:57:06 -0500 Subject: [PATCH 06/14] authd/providers/ident: add conf option for enabling ident --- authd/providers/ident.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/authd/providers/ident.c b/authd/providers/ident.c index e14fac43..935c8bf1 100644 --- a/authd/providers/ident.c +++ b/authd/providers/ident.c @@ -66,6 +66,7 @@ static char * get_valid_ident(char *buf); static struct ev_entry *timeout_ev; static int ident_timeout = 5; +static bool ident_enable = true; /* Timeout outstanding queries */ @@ -320,8 +321,11 @@ static bool ident_start(struct auth_client *auth) struct rb_sockaddr_storage l_addr, c_addr; int family = GET_SS_FAMILY(&auth->c_addr); - if(auth->data[PROVIDER_IDENT] != NULL) + if(!ident_enable || auth->data[PROVIDER_IDENT] != NULL) + { + set_provider_done(auth, PROVIDER_IDENT); /* for blacklists */ return true; + } notice_client(auth->cid, messages[REPORT_LOOKUP]); @@ -387,9 +391,18 @@ add_conf_ident_timeout(const char *key __unused, int parc __unused, const char * ident_timeout = timeout; } +static void +set_ident_enabled(const char *key __unused, int parc __unused, const char **parv) +{ + enable_ident = (strcasecmp(parv[0], "true") == 0 || + strcasecmp(parv[0], "1") == 0 || + strcasecmp(parv[0], "enable") == 0); +} + struct auth_opts_handler ident_options[] = { { "ident_timeout", 1, add_conf_ident_timeout }, + { "ident_enabled", 1, set_ident_enabled }, { NULL, 0, NULL }, }; From 8e001551648cff1813059455329fc39fbe61187a Mon Sep 17 00:00:00 2001 From: Elizabeth Myers Date: Mon, 28 Mar 2016 00:03:27 -0500 Subject: [PATCH 07/14] authd/providers/ident: fix typo --- authd/providers/ident.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/authd/providers/ident.c b/authd/providers/ident.c index 935c8bf1..5f7740b5 100644 --- a/authd/providers/ident.c +++ b/authd/providers/ident.c @@ -394,7 +394,7 @@ add_conf_ident_timeout(const char *key __unused, int parc __unused, const char * static void set_ident_enabled(const char *key __unused, int parc __unused, const char **parv) { - enable_ident = (strcasecmp(parv[0], "true") == 0 || + ident_enable = (strcasecmp(parv[0], "true") == 0 || strcasecmp(parv[0], "1") == 0 || strcasecmp(parv[0], "enable") == 0); } From a90465f76738b55103dcbc85d7b0233cef0f0349 Mon Sep 17 00:00:00 2001 From: Elizabeth Myers Date: Mon, 28 Mar 2016 01:05:19 -0500 Subject: [PATCH 08/14] authd/providers/blacklist: add stats reporting for blacklist info --- authd/providers/blacklist.c | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/authd/providers/blacklist.c b/authd/providers/blacklist.c index 03bc7cab..922d4b2c 100644 --- a/authd/providers/blacklist.c +++ b/authd/providers/blacklist.c @@ -63,6 +63,7 @@ struct blacklist bool delete; /* If true delete when no clients */ int refcount; /* When 0 and delete is set, remove this blacklist */ + unsigned int hits; time_t lastwarning; /* Last warning about garbage replies sent */ }; @@ -81,7 +82,7 @@ struct blacklist_lookup struct blacklist_filter { filter_t type; /* Type of filter */ - char filter[HOSTIPLEN]; /* The filter itself */ + char filter[HOSTIPLEN]; /* The filter itself */ rb_dlink_node node; }; @@ -245,6 +246,7 @@ blacklist_dns_callback(const char *result, bool status, query_type type, void *d if (result != NULL && status && blacklist_check_reply(bllookup, result)) { /* Match found, so proceed no further */ + bl->hits++; blacklists_cancel(auth); reject_client(auth, PROVIDER_BLACKLIST, bl->host, bl->reason); return; @@ -544,6 +546,24 @@ add_conf_blacklist_timeout(const char *key, int parc, const char **parv) blacklist_timeout = timeout; } +static void +blacklist_stats(uint32_t rid, char letter) +{ + rb_dlink_node *ptr; + + RB_DLINK_FOREACH(ptr, blacklist_list.head) + { + struct blacklist *bl = ptr->data; + + if(bl->delete) + continue; + + stats_result(rid, letter, "%s %hhu %u", bl->host, bl->iptype, bl->hits); + } + + stats_done(rid, letter); +} + struct auth_opts_handler blacklist_options[] = { { "rbl", 4, add_conf_blacklist }, @@ -562,4 +582,5 @@ struct auth_provider blacklist_provider = .cancel = blacklists_cancel, .completed = blacklists_initiate, .opt_handlers = blacklist_options, + .stats_handler = { 'B', blacklist_stats }, }; From bd7c2037bff076f977b0d119a8d75987e273ecd2 Mon Sep 17 00:00:00 2001 From: Elizabeth Myers Date: Mon, 28 Mar 2016 01:55:54 -0500 Subject: [PATCH 09/14] authd/providers/rdns: change option name to rdns_timeout --- authd/providers/rdns.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/authd/providers/rdns.c b/authd/providers/rdns.c index e5e1f6dd..e4f2430e 100644 --- a/authd/providers/rdns.c +++ b/authd/providers/rdns.c @@ -189,7 +189,7 @@ add_conf_dns_timeout(const char *key, int parc, const char **parv) struct auth_opts_handler rdns_options[] = { - { "dns_timeout", 1, add_conf_dns_timeout }, + { "rdns_timeout", 1, add_conf_dns_timeout }, { NULL, 0, NULL }, }; From d3f6b808677ba8bd3fa48f9bd61b99a2292a8c3e Mon Sep 17 00:00:00 2001 From: Elizabeth Myers Date: Mon, 28 Mar 2016 02:11:16 -0500 Subject: [PATCH 10/14] Replace s_auth/blacklist stuff with authd calls This also does a lot of surgery on the conf system to reconfigure authd. /!\ WARNING! ACHTUNG! ADVERTENCIA! ATTENTION! AVVERTIMENTO! /!\ This code has not been run-time tested yet (though it compiles)! --- include/authd.h | 23 ++ include/blacklist.h | 68 ----- include/client.h | 28 +- include/s_auth.h | 34 --- ircd/Makefile.am | 2 - ircd/authd.c | 334 ++++++++++++++++++++++-- ircd/blacklist.c | 306 ---------------------- ircd/client.c | 21 +- ircd/ircd.c | 4 +- ircd/listener.c | 4 +- ircd/newconf.c | 66 ++--- ircd/s_auth.c | 607 -------------------------------------------- ircd/s_conf.c | 3 +- ircd/s_user.c | 104 +++++--- modules/m_set.c | 1 + modules/m_stats.c | 84 +++--- modules/m_user.c | 2 - 17 files changed, 502 insertions(+), 1189 deletions(-) delete mode 100644 include/blacklist.h delete mode 100644 include/s_auth.h delete mode 100644 ircd/blacklist.c delete mode 100644 ircd/s_auth.c diff --git a/include/authd.h b/include/authd.h index 276d6fa8..03405958 100644 --- a/include/authd.h +++ b/include/authd.h @@ -26,11 +26,34 @@ #ifndef CHARYBDIS_AUTHD_H #define CHARYBDIS_AUTHD_H +#include "stdinc.h" +#include "rb_dictionary.h" +#include "client.h" + +struct blacklist_stats +{ + uint8_t iptype; + unsigned int hits; +}; + extern rb_helper *authd_helper; +extern rb_dictionary *bl_stats; + void init_authd(void); +void configure_authd(void); void restart_authd(void); void rehash_authd(void); void check_authd(void); +void authd_initiate_client(struct Client *); +void authd_decide_client(struct Client *client_p, const char *ident, const char *host, bool accept, char cause, const char *data, const char *reason); +void authd_abort_client(struct Client *); +const char *get_provider_string(char cause); + +void add_blacklist(const char *host, const char *reason, uint8_t iptype, rb_dlink_list *filters); +void del_blacklist(const char *host); +void del_blacklist_all(void); +void set_authd_timeout(const char *key, int timeout); + #endif diff --git a/include/blacklist.h b/include/blacklist.h deleted file mode 100644 index 7c8fc23e..00000000 --- a/include/blacklist.h +++ /dev/null @@ -1,68 +0,0 @@ -/* - * charybdis: A slightly useful ircd. - * blacklist.h: Manages DNS blacklist entries and lookups - * - * Copyright (C) 2006 charybdis development team - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 - * USA - */ - -#ifndef _BLACKLIST_H_ -#define _BLACKLIST_H_ - -#include "stdinc.h" - -#define BLACKLIST_FILTER_ALL 1 -#define BLACKLIST_FILTER_LAST 2 - -/* A configured DNSBL */ -struct Blacklist { - unsigned int status; /* If CONF_ILLEGAL, delete when no clients */ - int refcount; - int ipv4; /* Does this blacklist support IPv4 lookups? */ - int ipv6; /* Does this blacklist support IPv6 lookups? */ - char host[IRCD_RES_HOSTLEN + 1]; - rb_dlink_list filters; /* Filters for queries */ - char reject_reason[BUFSIZE]; - unsigned int hits; - time_t lastwarning; -}; - -/* A lookup in progress for a particular DNSBL for a particular client */ -struct BlacklistClient { - struct Blacklist *blacklist; - struct Client *client_p; - uint16_t dns_id; - rb_dlink_node node; -}; - -/* A blacklist filter */ -struct BlacklistFilter { - int type; /* Type of filter */ - char filterstr[HOSTIPLEN]; /* The filter itself */ - rb_dlink_node node; -}; - -/* public interfaces */ -struct Blacklist *new_blacklist(char *host, char *reject_reason, int ipv4, int ipv6, rb_dlink_list *filters); -void lookup_blacklists(struct Client *client_p); -void abort_blacklist_queries(struct Client *client_p); -void unref_blacklist(struct Blacklist *blptr); -void destroy_blacklists(void); - -extern rb_dlink_list blacklist_list; - -#endif diff --git a/include/client.h b/include/client.h index b9a612bf..ee2c5969 100644 --- a/include/client.h +++ b/include/client.h @@ -63,7 +63,6 @@ struct Client; struct User; struct Server; struct LocalUser; -struct AuthRequest; struct PreClient; struct ListClient; struct scache_entry; @@ -190,6 +189,7 @@ struct LocalUser /* Send and receive linebuf queues .. */ buf_head_t buf_sendq; buf_head_t buf_recvq; + /* * we want to use unsigned int here so the sizes have a better chance of * staying the same on 64 bit machines. The current trend is to use @@ -199,13 +199,15 @@ struct LocalUser * performed on these, it's not safe to allow them to become negative, * which is possible for long running server connections. Unsigned values * generally overflow gracefully. --Bleep + * + * We have modern conveniences. Let's use uint32_t. --Elizafox */ - unsigned int sendM; /* Statistics: protocol messages send */ - unsigned int sendK; /* Statistics: total k-bytes send */ - unsigned int receiveM; /* Statistics: protocol messages received */ - unsigned int receiveK; /* Statistics: total k-bytes received */ - unsigned short sendB; /* counters to count upto 1-k lots of bytes */ - unsigned short receiveB; /* sent and received. */ + uint32_t sendM; /* Statistics: protocol messages send */ + uint32_t sendK; /* Statistics: total k-bytes send */ + uint32_t receiveM; /* Statistics: protocol messages received */ + uint32_t receiveK; /* Statistics: total k-bytes received */ + uint16_t sendB; /* counters to count upto 1-k lots of bytes */ + uint16_t receiveB; /* sent and received. */ struct Listener *listener; /* listener accepted from */ struct ConfItem *att_conf; /* attached conf */ struct server_conf *att_sconf; @@ -251,7 +253,6 @@ struct LocalUser int sent_parsed; /* how many messages we've parsed in this second */ time_t last_knock; /* time of last knock */ unsigned long random_ping; - struct AuthRequest *auth_request; /* target change stuff */ /* targets we're aware of (fnv32(use_id(target_p))): @@ -291,8 +292,12 @@ struct PreClient char spoofuser[USERLEN + 1]; char spoofhost[HOSTLEN + 1]; - rb_dlink_list dnsbl_queries; /* list of struct BlacklistClient * */ - struct Blacklist *dnsbl_listed; /* first dnsbl where it's listed */ + uint32_t authd_cid; /* authd id */ + time_t authd_timeout; /* When to terminate authd query */ + bool authd_accepted; /* did authd accept us? */ + char authd_cause; /* rejection cause */ + char *authd_data; /* reason data */ + char *authd_reason; /* reason we were rejected */ struct rb_sockaddr_storage lip; /* address of our side of the connection */ }; @@ -574,8 +579,6 @@ extern int exit_client(struct Client *, struct Client *, struct Client *, const extern void error_exit_client(struct Client *, int); - - extern void count_local_client_memory(size_t * count, size_t * memory); extern void count_remote_client_memory(size_t * count, size_t * memory); @@ -594,7 +597,6 @@ extern int show_ip(struct Client *source_p, struct Client *target_p); extern int show_ip_conf(struct ConfItem *aconf, struct Client *source_p); extern int show_ip_whowas(struct Whowas *whowas, struct Client *source_p); -extern void initUser(void); extern void free_user(struct User *, struct Client *); extern struct User *make_user(struct Client *); extern struct Server *make_server(struct Client *); diff --git a/include/s_auth.h b/include/s_auth.h deleted file mode 100644 index bbc20b7f..00000000 --- a/include/s_auth.h +++ /dev/null @@ -1,34 +0,0 @@ -/* - * ircd-ratbox: A slightly useful ircd. - * s_auth.h: A header for the ident functions. - * - * Copyright (C) 1990 Jarkko Oikarinen and University of Oulu, Co Center - * Copyright (C) 1996-2002 Hybrid Development Team - * Copyright (C) 2002-2004 ircd-ratbox development team - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 - * USA - */ - -#ifndef INCLUDED_s_auth_h -#define INCLUDED_s_auth_h - -struct Client; - -extern void start_auth(struct Client *); -extern void init_auth(void); -extern void delete_auth_queries(struct Client *); - -#endif /* INCLUDED_s_auth_h */ diff --git a/ircd/Makefile.am b/ircd/Makefile.am index 20370488..b1f6011d 100644 --- a/ircd/Makefile.am +++ b/ircd/Makefile.am @@ -21,7 +21,6 @@ endif libircd_la_SOURCES = \ authd.c \ bandbi.c \ - blacklist.c \ cache.c \ capability.c \ channel.c \ @@ -53,7 +52,6 @@ libircd_la_SOURCES = \ ratelimit.c \ reject.c \ restart.c \ - s_auth.c \ s_conf.c \ s_newconf.c \ s_serv.c \ diff --git a/ircd/authd.c b/ircd/authd.c index 8b453393..cfbbb52f 100644 --- a/ircd/authd.c +++ b/ircd/authd.c @@ -22,20 +22,23 @@ * USA */ -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include +#include "stdinc.h" +#include "rb_lib.h" +#include "client.h" +#include "ircd_defs.h" +#include "parse.h" +#include "authd.h" +#include "match.h" +#include "logger.h" +#include "s_conf.h" +#include "s_stats.h" +#include "client.h" +#include "packet.h" +#include "hash.h" +#include "send.h" +#include "numeric.h" +#include "msg.h" +#include "dns.h" static int start_authd(void); static void parse_authd_reply(rb_helper * helper); @@ -44,6 +47,11 @@ static void restart_authd_cb(rb_helper * helper); rb_helper *authd_helper; static char *authd_path; +uint32_t cid = 1; +static rb_dictionary *cid_clients; + +rb_dictionary *bl_stats; + static int start_authd(void) { @@ -77,6 +85,12 @@ start_authd(void) authd_path = rb_strdup(fullpath); } + if(cid_clients == NULL) + cid_clients = rb_dictionary_create("authd cid to uid mapping", rb_uint32cmp); + + if(bl_stats == NULL) + bl_stats = rb_dictionary_create("blacklist statistics", strcasecmp); + authd_helper = rb_helper_start("authd", authd_path, parse_authd_reply, restart_authd_cb); if(authd_helper == NULL) @@ -98,6 +112,9 @@ parse_authd_reply(rb_helper * helper) int parc; char dnsBuf[READBUF_SIZE]; char *parv[MAXPARA + 1]; + long lcid; + char *id; + struct Client *client_p; while((len = rb_helper_read(helper, dnsBuf, sizeof(dnsBuf))) > 0) { @@ -105,7 +122,75 @@ parse_authd_reply(rb_helper * helper) switch (*parv[0]) { - case 'E': + case 'A': /* Accepted a client */ + if(parc != 4) + { + iwarn("authd sent a result with wrong number of arguments: got %d", parc); + restart_authd(); + return; + } + + if((lcid = strtol(parv[1], NULL, 16)) > UINT32_MAX) + { + iwarn("authd sent us back a bad client ID"); + restart_authd(); + return; + } + + /* cid to uid (retrieve and delete) */ + if((id = rb_dictionary_delete(cid_clients, RB_UINT_TO_POINTER((uint32_t)lcid))) == NULL) + { + iwarn("authd sent us back an unknown client ID"); + restart_authd(); + return; + } + + if((client_p = find_id(id)) == NULL) + { + /* Client vanished... */ + rb_free(id); + return; + } + + rb_free(id); + + authd_decide_client(client_p, parv[2], parv[3], true, '\0', NULL, NULL); + break; + case 'R': /* Reject client */ + if(parc != 7) + { + iwarn("authd sent us a result with wrong number of arguments: got %d", parc); + restart_authd(); + return; + } + + if((lcid = strtol(parv[1], NULL, 16)) > UINT32_MAX) + { + iwarn("authd sent us back a bad client ID"); + restart_authd(); + return; + } + + /* cid to uid (retrieve and delete) */ + if((id = rb_dictionary_delete(cid_clients, RB_UINT_TO_POINTER((uint32_t)lcid))) == NULL) + { + iwarn("authd sent us back an unknown client ID"); + restart_authd(); + return; + } + + if((client_p = find_id(id)) == NULL) + { + /* Client vanished... */ + rb_free(id); + return; + } + + rb_free(id); + + authd_decide_client(client_p, parv[3], parv[4], false, toupper(*parv[2]), parv[5], parv[6]); + return; + case 'E': /* DNS Result */ if(parc != 5) { ilog(L_MAIN, "authd sent a result with wrong number of arguments: got %d", parc); @@ -114,7 +199,7 @@ parse_authd_reply(rb_helper * helper) } dns_results_callback(parv[1], parv[2], parv[3], parv[4]); break; - case 'W': + case 'W': /* Oper warning */ if(parc != 3) { ilog(L_MAIN, "authd sent a result with wrong number of arguments: got %d", parc); @@ -124,7 +209,7 @@ parse_authd_reply(rb_helper * helper) switch(*parv[2]) { - case 'D': /* debug */ + case 'D': /* Debug */ sendto_realops_snomask(SNO_DEBUG, L_ALL, "authd debug: %s", parv[3]); break; case 'I': /* Info */ @@ -147,9 +232,9 @@ parse_authd_reply(rb_helper * helper) /* NOTREACHED */ break; - case 'X': - case 'Y': - case 'Z': + case 'X': /* Stats error */ + case 'Y': /* Stats reply */ + case 'Z': /* End of stats reply */ if(parc < 3) { ilog(L_MAIN, "authd sent a result with wrong number of arguments: got %d", parc); @@ -190,6 +275,15 @@ init_authd(void) } } +void +configure_authd(void) +{ + /* These will do for now */ + set_authd_timeout("ident_timeout", GlobalSetOptions.ident_timeout); + set_authd_timeout("rdns_timeout", ConfigFileEntry.connect_timeout); + set_authd_timeout("blacklist_timeout", ConfigFileEntry.connect_timeout); +} + static void restart_authd_cb(rb_helper * helper) { @@ -213,6 +307,7 @@ void rehash_authd(void) { rb_helper_write(authd_helper, "R"); + configure_authd(); } void @@ -221,3 +316,202 @@ check_authd(void) if(authd_helper == NULL) restart_authd(); } + +static inline uint32_t +generate_cid(void) +{ + if(++cid == 0) + cid = 1; + + return cid; +} + +/* Basically when this is called we begin handing off the client to authd for + * processing. authd "owns" the client until processing is finished, or we + * timeout from authd. authd will make a decision whether or not to accept the + * client, but it's up to other parts of the code (for now) to decide if we're + * gonna accept the client and ignore authd's suggestion. + * + * --Elizafox + */ +void +authd_initiate_client(struct Client *client_p) +{ + char client_ipaddr[HOSTIPLEN+1]; + char listen_ipaddr[HOSTIPLEN+1]; + uint16_t client_port, listen_port; + uint32_t authd_cid; + + if(client_p->preClient == NULL || client_p->preClient->authd_cid == 0) + return; + + authd_cid = client_p->preClient->authd_cid = generate_cid(); + + /* Collisions are extremely unlikely, so disregard the possibility */ + rb_dictionary_add(cid_clients, RB_UINT_TO_POINTER(authd_cid), rb_strdup(client_p->id)); + + /* Retrieve listener and client IP's */ + rb_inet_ntop_sock((struct sockaddr *)&client_p->preClient->lip, listen_ipaddr, sizeof(listen_ipaddr)); + rb_inet_ntop_sock((struct sockaddr *)&client_p->localClient->ip, client_ipaddr, sizeof(client_ipaddr)); + + /* Retrieve listener and client ports */ +#ifdef RB_IPV6 + if(GET_SS_FAMILY(&client_p->preClient->lip) == AF_INET6) + listen_port = ntohs(((struct sockaddr_in6 *)&client_p->preClient->lip)->sin6_port); + else +#endif + listen_port = ntohs(((struct sockaddr_in *)&client_p->preClient->lip)->sin_port); + +#ifdef RB_IPV6 + if(GET_SS_FAMILY(&client_p->localClient->ip) == AF_INET6) + client_port = ntohs(((struct sockaddr_in6 *)&client_p->localClient->ip)->sin6_port); + else +#endif + client_port = ntohs(((struct sockaddr_in *)&client_p->localClient->ip)->sin_port); + + /* FIXME timeout should be configurable */ + client_p->preClient->authd_timeout = rb_current_time() + 45; + + rb_helper_write(authd_helper, "C %x %s %hu %s %hu", authd_cid, listen_ipaddr, listen_port, client_ipaddr, client_port); +} + +/* When this is called we have a decision on client acceptance. + * + * After this point authd no longer "owns" the client. + */ +void +authd_decide_client(struct Client *client_p, const char *ident, const char *host, bool accept, char cause, const char *data, const char *reason) +{ + if(client_p->preClient == NULL || client_p->preClient->authd_cid == 0) + return; + + if(*ident != '*') + { + rb_strlcpy(client_p->username, ident, sizeof(client_p->username)); + ServerStats.is_abad++; /* s_auth used to do this, stay compatible */ + } + else + ServerStats.is_asuc++; + + if(*host != '*') + rb_strlcpy(client_p->host, host, sizeof(client_p->host)); + + client_p->preClient->authd_accepted = accept; + client_p->preClient->authd_cause = cause; + client_p->preClient->authd_data = (data == NULL ? NULL : rb_strdup(data)); + client_p->preClient->authd_reason = (reason == NULL ? NULL : rb_strdup(reason)); + + rb_dictionary_delete(cid_clients, RB_UINT_TO_POINTER(client_p->preClient->authd_cid)); + + client_p->preClient->authd_cid = 0; + + /* + * When a client has auth'ed, we want to start reading what it sends + * us. This is what read_packet() does. + * -- adrian + * + * Above comment was originally in s_auth.c, but moved here with below code. + * --Elizafox + */ + rb_dlinkAddTail(client_p, &client_p->node, &global_client_list); + read_packet(client_p->localClient->F, client_p); +} + +void +authd_abort_client(struct Client *client_p) +{ + if(client_p->preClient == NULL) + return; + + if(client_p->preClient->authd_cid == 0) + return; + + rb_dictionary_delete(cid_clients, RB_UINT_TO_POINTER(client_p->preClient->authd_cid)); + + rb_helper_write(authd_helper, "E %x", client_p->preClient->authd_cid); + client_p->preClient->authd_cid = 0; +} + +/* Turn a cause char (who rejected us) into the name of the provider */ +const char * +get_provider_string(char cause) +{ + switch(cause) + { + case 'B': + return "Blacklist"; + case 'D': + return "rDNS"; + case 'I': + return "Ident"; + default: + return "Unknown"; + } +} + +/* Send a new blacklist to authd */ +void +add_blacklist(const char *host, const char *reason, uint8_t iptype, rb_dlink_list *filters) +{ + rb_dlink_node *ptr; + struct blacklist_stats *stats = rb_malloc(sizeof(struct blacklist_stats)); + char filterbuf[BUFSIZE]; + size_t s = 0; + + /* Build a list of comma-separated values for authd. + * We don't check for validity - do it elsewhere. + */ + RB_DLINK_FOREACH(ptr, filters->head) + { + char *filter = ptr->data; + size_t filterlen = strlen(filter) + 1; + + if(s + filterlen > sizeof(filterbuf)) + break; + + snprintf(&filterbuf[s], sizeof(filterbuf) - s, "%s,", filter); + + s += filterlen; + } + + if(s) + filterbuf[s - 1] = '\0'; + + stats->iptype = iptype; + stats->hits = 0; + rb_dictionary_add(bl_stats, host, stats); + + rb_helper_write(authd_helper, "O rbl %s %hhu %s :%s", host, iptype, filterbuf, reason); +} + +/* Delete a blacklist */ +void +del_blacklist(const char *host) +{ + rb_dictionary_delete(bl_stats, host); + + rb_helper_write(authd_helper, "O rbl_del %s", host); +} + +/* Delete all the blacklists */ +void +del_blacklist_all(void) +{ + struct blacklist_stats *stats; + rb_dictionary_iter iter; + + RB_DICTIONARY_FOREACH(stats, &iter, bl_stats) + { + rb_free(stats); + rb_dictionary_delete(bl_stats, iter.cur->key); + } + + rb_helper_write(authd_helper, "O rbl_del_all"); +} + +/* Adjust an authd timeout value */ +void +set_authd_timeout(const char *key, int timeout) +{ + rb_helper_write(authd_helper, "O %s %d", key, timeout); +} diff --git a/ircd/blacklist.c b/ircd/blacklist.c deleted file mode 100644 index 47438438..00000000 --- a/ircd/blacklist.c +++ /dev/null @@ -1,306 +0,0 @@ -/* - * charybdis: A slightly useful ircd. - * blacklist.c: Manages DNS blacklist entries and lookups - * - * Copyright (C) 2006-2011 charybdis development team - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions are - * met: - * - * 1. Redistributions of source code must retain the above copyright notice, - * this list of conditions and the following disclaimer. - * - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * - * 3. The name of the author may not be used to endorse or promote products - * derived from this software without specific prior written permission. - * - * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR - * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED - * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE - * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, - * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES - * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR - * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, - * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING - * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - * POSSIBILITY OF SUCH DAMAGE. - */ - -#include "stdinc.h" -#include "client.h" -#include "dns.h" -#include "numeric.h" -#include "reject.h" -#include "s_conf.h" -#include "s_user.h" -#include "blacklist.h" -#include "send.h" - -rb_dlink_list blacklist_list = { NULL, NULL, 0 }; - -/* private interfaces */ -static struct Blacklist *find_blacklist(char *name) -{ - rb_dlink_node *nptr; - - RB_DLINK_FOREACH(nptr, blacklist_list.head) - { - struct Blacklist *blptr = (struct Blacklist *) nptr->data; - - if (!irccmp(blptr->host, name)) - return blptr; - } - - return NULL; -} - -static inline int blacklist_check_reply(struct BlacklistClient *blcptr, const char *ipaddr) -{ - struct Blacklist *blptr = blcptr->blacklist; - const char *lastoctet; - rb_dlink_node *ptr; - - /* No filters and entry found - thus positive match */ - if (!rb_dlink_list_length(&blptr->filters)) - return 1; - - /* Below will prolly have to change too if the above changes */ - if ((lastoctet = strrchr(ipaddr, '.')) == NULL || *(++lastoctet) == '\0') - goto blwarn; - - RB_DLINK_FOREACH(ptr, blcptr->blacklist->filters.head) - { - struct BlacklistFilter *filter = ptr->data; - const char *cmpstr; - - if (filter->type == BLACKLIST_FILTER_ALL) - cmpstr = ipaddr; - else if (filter->type == BLACKLIST_FILTER_LAST) - cmpstr = lastoctet; - else - { - sendto_realops_snomask(SNO_GENERAL, L_ALL, - "blacklist_check_reply(): Unknown filtertype (BUG!)"); - continue; - } - - if (strcmp(cmpstr, filter->filterstr) == 0) - /* Match! */ - return 1; - } - - return 0; -blwarn: - if (blcptr->blacklist->lastwarning + 3600 < rb_current_time()) - { - sendto_realops_snomask(SNO_GENERAL, L_ALL, - "Garbage reply from blacklist %s", - blcptr->blacklist->host); - blcptr->blacklist->lastwarning = rb_current_time(); - } - return 0; -} - -static void blacklist_dns_callback(const char *result, int status, int aftype, void *vptr) -{ - struct BlacklistClient *blcptr = (struct BlacklistClient *) vptr; - bool listed = false; - - if (blcptr == NULL || blcptr->client_p == NULL) - return; - - if (blcptr->client_p->preClient == NULL) - { - sendto_realops_snomask(SNO_GENERAL, L_ALL, - "blacklist_dns_callback(): blcptr->client_p->preClient (%s) is NULL", get_client_name(blcptr->client_p, HIDE_IP)); - rb_free(blcptr); - return; - } - - if (result != NULL && status) - { - if (blacklist_check_reply(blcptr, result)) - listed = true; - } - - /* they have a blacklist entry for this client */ - if (listed && blcptr->client_p->preClient->dnsbl_listed == NULL) - { - blcptr->client_p->preClient->dnsbl_listed = blcptr->blacklist; - /* reference to blacklist moves from blcptr to client_p->preClient... */ - } - else - unref_blacklist(blcptr->blacklist); - - rb_dlinkDelete(&blcptr->node, &blcptr->client_p->preClient->dnsbl_queries); - - /* yes, it can probably happen... */ - if (rb_dlink_list_length(&blcptr->client_p->preClient->dnsbl_queries) == 0 && blcptr->client_p->flags & FLAGS_SENTUSER && !EmptyString(blcptr->client_p->name)) - register_local_user(blcptr->client_p, blcptr->client_p); - - rb_free(blcptr); -} - -static void initiate_blacklist_dnsquery(struct Blacklist *blptr, struct Client *client_p) -{ - struct BlacklistClient *blcptr = rb_malloc(sizeof(struct BlacklistClient)); - char buf[IRCD_RES_HOSTLEN + 1]; - uint8_t *ip; - - blcptr->blacklist = blptr; - blcptr->client_p = client_p; - - /* IPv4 */ - if ((GET_SS_FAMILY(&client_p->localClient->ip) == AF_INET) && blptr->ipv4) - { - ip = (uint8_t *)&((struct sockaddr_in *)&client_p->localClient->ip)->sin_addr.s_addr; - - /* becomes 2.0.0.127.torbl.ahbl.org or whatever */ - snprintf(buf, sizeof buf, "%d.%d.%d.%d.%s", - (unsigned int) ip[3], - (unsigned int) ip[2], - (unsigned int) ip[1], - (unsigned int) ip[0], - blptr->host); - } -#ifdef RB_IPV6 - /* IPv6 */ - else if ((GET_SS_FAMILY(&client_p->localClient->ip) == AF_INET6) && blptr->ipv6) - { - /* Split up for rDNS lookup - * ex: ip[0] = 0x00, ip[1] = 0x00... ip[16] = 0x01 for localhost - * Giving us: - * 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.foobl.invalid - * or something like that. - */ - ip = (uint8_t *)&((struct sockaddr_in6 *)&client_p->localClient->ip)->sin6_addr.s6_addr; - char *bufptr = buf; - int i; - - /* Going backwards */ - for (i = 15; i >= 0; i--, bufptr += 4) - { - /* Get upper and lower nibbles */ - uint8_t hi = (ip[i] >> 4) & 0x0F; - uint8_t lo = ip[i] & 0x0F; - - /* One part... 4 chars + terminator */ - snprintf(bufptr, 5, "%1x.%1x.", - (unsigned int) lo, /* Remember, backwards */ - (unsigned int) hi); - } - - /* Tack host on */ - strcpy(bufptr, blptr->host); - } -#endif - /* This shouldn't happen... */ - else - return; - - blcptr->dns_id = lookup_hostname(buf, AF_INET, blacklist_dns_callback, blcptr); - - rb_dlinkAdd(blcptr, &blcptr->node, &client_p->preClient->dnsbl_queries); - blptr->refcount++; -} - -/* public interfaces */ -struct Blacklist *new_blacklist(char *name, char *reject_reason, int ipv4, int ipv6, rb_dlink_list *filters) -{ - struct Blacklist *blptr; - - if (name == NULL || reject_reason == NULL) - return NULL; - - blptr = find_blacklist(name); - if (blptr == NULL) - { - blptr = rb_malloc(sizeof(struct Blacklist)); - rb_dlinkAddAlloc(blptr, &blacklist_list); - } - else - blptr->status &= ~CONF_ILLEGAL; - - rb_strlcpy(blptr->host, name, IRCD_RES_HOSTLEN + 1); - rb_strlcpy(blptr->reject_reason, reject_reason, BUFSIZE); - blptr->ipv4 = ipv4; - blptr->ipv6 = ipv6; - - rb_dlinkMoveList(filters, &blptr->filters); - - blptr->lastwarning = 0; - - return blptr; -} - -void unref_blacklist(struct Blacklist *blptr) -{ - rb_dlink_node *ptr, *next_ptr; - - blptr->refcount--; - if (blptr->status & CONF_ILLEGAL && blptr->refcount <= 0) - { - RB_DLINK_FOREACH_SAFE(ptr, next_ptr, blptr->filters.head) - { - rb_dlinkDelete(ptr, &blptr->filters); - rb_free(ptr); - } - - rb_dlinkFindDestroy(blptr, &blacklist_list); - rb_free(blptr); - } -} - -void lookup_blacklists(struct Client *client_p) -{ - rb_dlink_node *nptr; - - RB_DLINK_FOREACH(nptr, blacklist_list.head) - { - struct Blacklist *blptr = (struct Blacklist *) nptr->data; - - if (!(blptr->status & CONF_ILLEGAL)) - initiate_blacklist_dnsquery(blptr, client_p); - } -} - -void abort_blacklist_queries(struct Client *client_p) -{ - rb_dlink_node *ptr, *next_ptr; - struct BlacklistClient *blcptr; - - if (client_p->preClient == NULL) - return; - RB_DLINK_FOREACH_SAFE(ptr, next_ptr, client_p->preClient->dnsbl_queries.head) - { - blcptr = ptr->data; - rb_dlinkDelete(&blcptr->node, &client_p->preClient->dnsbl_queries); - unref_blacklist(blcptr->blacklist); - cancel_lookup(blcptr->dns_id); - rb_free(blcptr); - } -} - -void destroy_blacklists(void) -{ - rb_dlink_node *ptr, *next_ptr; - struct Blacklist *blptr; - - RB_DLINK_FOREACH_SAFE(ptr, next_ptr, blacklist_list.head) - { - blptr = ptr->data; - blptr->hits = 0; /* keep it simple and consistent */ - if (blptr->refcount > 0) - blptr->status |= CONF_ILLEGAL; - else - { - rb_free(ptr->data); - rb_dlinkDestroy(ptr, &blacklist_list); - } - } -} diff --git a/ircd/client.c b/ircd/client.c index 268f61b2..86ca8fcc 100644 --- a/ircd/client.c +++ b/ircd/client.c @@ -32,7 +32,7 @@ #include "ircd.h" #include "numeric.h" #include "packet.h" -#include "s_auth.h" +#include "authd.h" #include "s_conf.h" #include "s_newconf.h" #include "logger.h" @@ -47,7 +47,6 @@ #include "hook.h" #include "msg.h" #include "monitor.h" -#include "blacklist.h" #include "reject.h" #include "scache.h" #include "rb_dictionary.h" @@ -253,17 +252,15 @@ make_client(struct Client *from) void free_pre_client(struct Client *client_p) { - struct Blacklist *blptr; - s_assert(NULL != client_p); if(client_p->preClient == NULL) return; - blptr = client_p->preClient->dnsbl_listed; - if (blptr != NULL) - unref_blacklist(blptr); - s_assert(rb_dlink_list_length(&client_p->preClient->dnsbl_queries) == 0); + s_assert(client_p->preClient->authd_cid == 0); + + rb_free(client_p->preClient->authd_data); + rb_free(client_p->preClient->authd_reason); rb_bh_free(pclient_heap, client_p->preClient); client_p->preClient = NULL; @@ -454,9 +451,8 @@ check_unknowns_list(rb_dlink_list * list) if(IsDead(client_p) || IsClosing(client_p)) continue; - /* still has DNSbls to validate against */ - if(client_p->preClient != NULL && - rb_dlink_list_length(&client_p->preClient->dnsbl_queries) > 0) + /* Still querying with authd */ + if(client_p->preClient != NULL && client_p->preClient->authd_cid != 0) continue; /* @@ -1355,8 +1351,7 @@ static int exit_unknown_client(struct Client *client_p, struct Client *source_p, struct Client *from, const char *comment) { - delete_auth_queries(source_p); - abort_blacklist_queries(source_p); + authd_abort_client(client_p); rb_dlinkDelete(&source_p->localClient->tnode, &unknown_list); if(!IsIOError(source_p)) diff --git a/ircd/ircd.c b/ircd/ircd.c index 8a16ffa4..5c576fc8 100644 --- a/ircd/ircd.c +++ b/ircd/ircd.c @@ -39,7 +39,6 @@ #include "numeric.h" #include "parse.h" #include "restart.h" -#include "s_auth.h" #include "s_conf.h" #include "logger.h" #include "s_serv.h" /* try_connections */ @@ -782,7 +781,6 @@ charybdis_main(int argc, char *argv[]) load_all_modules(1); load_core_modules(1); - init_auth(); /* Initialise the auth code */ init_authd(); /* Start up authd. */ init_dns(); /* Start up DNS query system */ @@ -847,6 +845,8 @@ charybdis_main(int argc, char *argv[]) return 0; /* Why? We want the launcher to exit out. */ } + configure_authd(); + me.from = &me; me.servptr = &me; SetMe(&me); diff --git a/ircd/listener.c b/ircd/listener.c index aeff94e9..6038a2d8 100644 --- a/ircd/listener.c +++ b/ircd/listener.c @@ -34,7 +34,7 @@ #include "s_newconf.h" #include "s_stats.h" #include "send.h" -#include "s_auth.h" +#include "authd.h" #include "reject.h" #include "s_conf.h" #include "hostmask.h" @@ -509,7 +509,7 @@ add_connection(struct Listener *listener, rb_fde_t *F, struct sockaddr *sai, str ++listener->ref_count; - start_auth(new_client); + authd_initiate_client(new_client); } static const char *toofast = "ERROR :Reconnecting too fast, throttled.\r\n"; diff --git a/ircd/newconf.c b/ircd/newconf.c index 7a726db3..347f0f25 100644 --- a/ircd/newconf.c +++ b/ircd/newconf.c @@ -24,7 +24,6 @@ #include "cache.h" #include "ircd.h" #include "snomask.h" -#include "blacklist.h" #include "sslproc.h" #include "privilege.h" #include "chmode.h" @@ -55,8 +54,7 @@ static struct alias_entry *yy_alias = NULL; static char *yy_blacklist_host = NULL; static char *yy_blacklist_reason = NULL; -static int yy_blacklist_ipv4 = 1; -static int yy_blacklist_ipv6 = 0; +static uint8_t yy_blacklist_iptype = 0; static rb_dlink_list yy_blacklist_filters; static char *yy_privset_extends = NULL; @@ -1841,6 +1839,9 @@ conf_set_channel_autochanmodes(void *data) /* XXX for below */ static void conf_set_blacklist_reason(void *data); +#define IPTYPE_IPV4 1 +#define IPTYPE_IPV6 2 + static void conf_set_blacklist_host(void *data) { @@ -1854,8 +1855,7 @@ conf_set_blacklist_host(void *data) return; } - yy_blacklist_ipv4 = 1; - yy_blacklist_ipv6 = 0; + yy_blacklist_iptype |= IPTYPE_IPV4; yy_blacklist_host = rb_strdup(data); } @@ -1865,25 +1865,24 @@ conf_set_blacklist_type(void *data) conf_parm_t *args = data; /* Don't assume we have either if we got here */ - yy_blacklist_ipv4 = 0; - yy_blacklist_ipv6 = 0; + yy_blacklist_iptype = 0; for (; args; args = args->next) { if (!strcasecmp(args->v.string, "ipv4")) - yy_blacklist_ipv4 = 1; + yy_blacklist_iptype |= IPTYPE_IPV4; else if (!strcasecmp(args->v.string, "ipv6")) - yy_blacklist_ipv6 = 1; + yy_blacklist_iptype |= IPTYPE_IPV6; else conf_report_error("blacklist::type has unknown address family %s", args->v.string); } /* If we have neither, just default to IPv4 */ - if (!yy_blacklist_ipv4 && !yy_blacklist_ipv6) + if (!yy_blacklist_iptype) { conf_report_error("blacklist::type has neither IPv4 nor IPv6 (defaulting to IPv4)"); - yy_blacklist_ipv4 = 1; + yy_blacklist_iptype = IPTYPE_IPV4; } } @@ -1891,13 +1890,13 @@ static void conf_set_blacklist_matches(void *data) { conf_parm_t *args = data; + enum filter_t { FILTER_NONE, FILTER_ALL, FILTER_LAST }; for (; args; args = args->next) { - struct BlacklistFilter *filter; char *str = args->v.string; char *p; - int type = BLACKLIST_FILTER_LAST; + enum filter_t type = FILTER_LAST; if (CF_TYPE(args->type) != CF_QSTRING) { @@ -1922,17 +1921,17 @@ conf_set_blacklist_matches(void *data) { /* Check for validity */ if (*p == '.') - type = BLACKLIST_FILTER_ALL; - else if (!isalnum((unsigned char)*p)) + type = FILTER_ALL; + else if (!isdigit((unsigned char)*p)) { conf_report_error("blacklist::matches has invalid IP match entry %s", str); - type = 0; + type = FILTER_NONE; break; } } - if (type == BLACKLIST_FILTER_ALL) + if (type == FILTER_ALL) { /* Basic IP sanity check */ struct rb_sockaddr_storage tmp; @@ -1943,7 +1942,7 @@ conf_set_blacklist_matches(void *data) continue; } } - else if (type == BLACKLIST_FILTER_LAST) + else if (type == FILTER_LAST) { /* Verify it's the correct length */ if (strlen(str) > 3) @@ -1958,11 +1957,7 @@ conf_set_blacklist_matches(void *data) continue; /* Invalid entry */ } - filter = rb_malloc(sizeof(struct BlacklistFilter)); - filter->type = type; - rb_strlcpy(filter->filterstr, str, sizeof(filter->filterstr)); - - rb_dlinkAdd(filter, &filter->node, &yy_blacklist_filters); + rb_dlinkAddAlloc(rb_strdup(str), &yy_blacklist_filters); } } @@ -1974,7 +1969,7 @@ conf_set_blacklist_reason(void *data) if (yy_blacklist_host && data) { yy_blacklist_reason = rb_strdup(data); - if (yy_blacklist_ipv6) + if (yy_blacklist_iptype & IPTYPE_IPV4) { /* Make sure things fit (64 = alnum count + dots) */ if ((64 + strlen(yy_blacklist_host)) > IRCD_RES_HOSTLEN) @@ -1985,7 +1980,7 @@ conf_set_blacklist_reason(void *data) } } /* Avoid doing redundant check, IPv6 is bigger than IPv4 --Elizabeth */ - if (yy_blacklist_ipv4 && !yy_blacklist_ipv6) + if ((yy_blacklist_iptype & IPTYPE_IPV4) && !(yy_blacklist_iptype & IPTYPE_IPV6)) { /* Make sure things fit (16 = number of nums + dots) */ if ((16 + strlen(yy_blacklist_host)) > IRCD_RES_HOSTLEN) @@ -1996,30 +1991,23 @@ conf_set_blacklist_reason(void *data) } } - new_blacklist(yy_blacklist_host, yy_blacklist_reason, yy_blacklist_ipv4, yy_blacklist_ipv6, - &yy_blacklist_filters); + add_blacklist(yy_blacklist_host, yy_blacklist_reason, yy_blacklist_iptype, &yy_blacklist_filters); } cleanup_bl: - if (data == NULL) + RB_DLINK_FOREACH_SAFE(ptr, nptr, yy_blacklist_filters.head) { - RB_DLINK_FOREACH_SAFE(ptr, nptr, yy_blacklist_filters.head) - { - rb_dlinkDelete(ptr, &yy_blacklist_filters); - rb_free(ptr); - } - } - else - { - yy_blacklist_filters = (rb_dlink_list){ NULL, NULL, 0 }; + rb_free(ptr->data); + rb_dlinkDestroy(ptr, &yy_blacklist_filters); } + yy_blacklist_filters = (rb_dlink_list){ NULL, NULL, 0 }; + rb_free(yy_blacklist_host); rb_free(yy_blacklist_reason); yy_blacklist_host = NULL; yy_blacklist_reason = NULL; - yy_blacklist_ipv4 = 1; - yy_blacklist_ipv6 = 0; + yy_blacklist_iptype = 0; } /* public functions */ diff --git a/ircd/s_auth.c b/ircd/s_auth.c deleted file mode 100644 index c30b9e14..00000000 --- a/ircd/s_auth.c +++ /dev/null @@ -1,607 +0,0 @@ -/* - * ircd-ratbox: A slightly useful ircd. - * s_auth.c: Functions for querying a users ident. - * - * Copyright (C) 1990 Jarkko Oikarinen and University of Oulu, Co Center - * Copyright (C) 1996-2002 Hybrid Development Team - * Copyright (C) 2002-2005 ircd-ratbox development team - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 - * USA - * - */ - -/* - * Changes: - * July 6, 1999 - Rewrote most of the code here. When a client connects - * to the server and passes initial socket validation checks, it - * is owned by this module (auth) which returns it to the rest of the - * server when dns and auth queries are finished. Until the client is - * released, the server does not know it exists and does not process - * any messages from it. - * --Bleep Thomas Helvey - */ -#include "stdinc.h" -#include "defaults.h" -#include "s_auth.h" -#include "s_conf.h" -#include "client.h" -#include "match.h" -#include "ircd.h" -#include "numeric.h" -#include "packet.h" -#include "dns.h" -#include "logger.h" -#include "s_stats.h" -#include "send.h" -#include "hook.h" -#include "blacklist.h" -#include "s_assert.h" - -struct AuthRequest -{ - rb_dlink_node node; - struct Client *client; /* pointer to client struct for request */ - uint16_t dns_id; /* DNS Query */ - unsigned int flags; /* current state of request */ - rb_fde_t *F; /* file descriptor for auth queries */ - time_t timeout; /* time when query expires */ - uint16_t lport; - uint16_t rport; -}; - -/* - * flag values for AuthRequest - * NAMESPACE: AM_xxx - Authentication Module - */ -#define AM_AUTH_CONNECTING (1 << 0) -#define AM_AUTH_PENDING (1 << 1) -#define AM_DNS_PENDING (1 << 2) - -#define SetDNSPending(x) ((x)->flags |= AM_DNS_PENDING) -#define ClearDNSPending(x) ((x)->flags &= ~AM_DNS_PENDING) -#define IsDNSPending(x) ((x)->flags & AM_DNS_PENDING) - -#define SetAuthConnect(x) ((x)->flags |= AM_AUTH_CONNECTING) -#define ClearAuthConnect(x) ((x)->flags &= ~AM_AUTH_CONNECTING) -#define IsAuthConnect(x) ((x)->flags & AM_AUTH_CONNECTING) - -#define SetAuthPending(x) ((x)->flags |= AM_AUTH_PENDING) -#define ClearAuthPending(x) ((x)->flags &= AM_AUTH_PENDING) -#define IsAuthPending(x) ((x)->flags & AM_AUTH_PENDING) - -#define ClearAuth(x) ((x)->flags &= ~(AM_AUTH_PENDING | AM_AUTH_CONNECTING)) -#define IsDoingAuth(x) ((x)->flags & (AM_AUTH_PENDING | AM_AUTH_CONNECTING)) - -/* - * a bit different approach - * this replaces the original sendheader macros - */ - -static const char *HeaderMessages[] = -{ - ":*** Looking up your hostname...", - ":*** Found your hostname", - ":*** Couldn't look up your hostname", - ":*** Checking Ident", - ":*** Got Ident response", - ":*** No Ident response", - ":*** Your hostname is too long, ignoring hostname", - ":*** Your forward and reverse DNS do not match, ignoring hostname", - ":*** Cannot verify hostname validity, ignoring hostname", -}; - -typedef enum -{ - REPORT_DO_DNS, - REPORT_FIN_DNS, - REPORT_FAIL_DNS, - REPORT_DO_ID, - REPORT_FIN_ID, - REPORT_FAIL_ID, - REPORT_HOST_TOOLONG, - REPORT_HOST_MISMATCH, - REPORT_HOST_UNKNOWN -} -ReportType; - -#define sendheader(c, r) sendto_one_notice(c, "%s", HeaderMessages[(r)]) - -static rb_dlink_list auth_poll_list; -static rb_bh *auth_heap; -static EVH timeout_auth_queries_event; - -static PF read_auth_reply; -static CNCB auth_connect_callback; - -/* - * init_auth() - * - * Initialise the auth code - */ -void -init_auth(void) -{ - /* This hook takes a struct Client for its argument */ - memset(&auth_poll_list, 0, sizeof(auth_poll_list)); - rb_event_addish("timeout_auth_queries_event", timeout_auth_queries_event, NULL, 1); - auth_heap = rb_bh_create(sizeof(struct AuthRequest), LCLIENT_HEAP_SIZE, "auth_heap"); -} - -/* - * make_auth_request - allocate a new auth request - */ -static struct AuthRequest * -make_auth_request(struct Client *client) -{ - struct AuthRequest *request = rb_bh_alloc(auth_heap); - client->localClient->auth_request = request; - request->F = NULL; - request->client = client; - request->timeout = rb_current_time() + ConfigFileEntry.connect_timeout; - return request; -} - -/* - * free_auth_request - cleanup auth request allocations - */ -static void -free_auth_request(struct AuthRequest *request) -{ - rb_bh_free(auth_heap, request); -} - -/* - * release_auth_client - release auth client from auth system - * this adds the client into the local client lists so it can be read by - * the main io processing loop - */ -static void -release_auth_client(struct AuthRequest *auth) -{ - struct Client *client = auth->client; - - if(IsDNSPending(auth) || IsDoingAuth(auth)) - return; - - client->localClient->auth_request = NULL; - rb_dlinkDelete(&auth->node, &auth_poll_list); - free_auth_request(auth); - - /* - * When a client has auth'ed, we want to start reading what it sends - * us. This is what read_packet() does. - * -- adrian - */ - rb_dlinkAddTail(client, &client->node, &global_client_list); - read_packet(client->localClient->F, client); -} - -/* - * auth_dns_callback - called when resolver query finishes - * if the query resulted in a successful search, hp will contain - * a non-null pointer, otherwise hp will be null. - * set the client on it's way to a connection completion, regardless - * of success of failure - */ -static void -auth_dns_callback(const char *result, int status, int aftype, void *vptr) -{ - struct AuthRequest *auth = (struct AuthRequest *) vptr; - ClearDNSPending(auth); - - /* XXX: this shouldn't happen, but it does. -nenolod */ - if(auth->client->localClient == NULL) - { - sendto_realops_snomask(SNO_GENERAL, L_ALL, - "auth_dns_callback(): auth->client->localClient (%s) is NULL", get_client_name(auth->client, HIDE_IP)); - - rb_dlinkDelete(&auth->node, &auth_poll_list); - free_auth_request(auth); - - /* and they will silently drop through and all will hopefully be ok... -nenolod */ - return; - } - - if(result != NULL && status) - { - int good = 1; - - if(good && strlen(result) <= HOSTLEN) - { - rb_strlcpy(auth->client->host, result, sizeof(auth->client->host)); - sendheader(auth->client, REPORT_FIN_DNS); - } - else if (strlen(result) > HOSTLEN) - sendheader(auth->client, REPORT_HOST_TOOLONG); - } - else - sendheader(auth->client, REPORT_FAIL_DNS); - - release_auth_client(auth); -} - -/* - * authsenderr - handle auth send errors - */ -static void -auth_error(struct AuthRequest *auth) -{ - ++ServerStats.is_abad; - - rb_close(auth->F); - auth->F = NULL; - - ClearAuth(auth); - sendheader(auth->client, REPORT_FAIL_ID); - - release_auth_client(auth); -} - -/* - * start_auth_query - Flag the client to show that an attempt to - * contact the ident server on - * the client's host. The connect and subsequently the socket are all put - * into 'non-blocking' mode. Should the connect or any later phase of the - * identifing process fail, it is aborted and the user is given a username - * of "unknown". - */ -static int -start_auth_query(struct AuthRequest *auth) -{ - struct rb_sockaddr_storage localaddr, destaddr; - rb_fde_t *F; - int family; - - if(IsAnyDead(auth->client)) - return 0; - - family = GET_SS_FAMILY(&auth->client->localClient->ip); - if((F = rb_socket(family, SOCK_STREAM, 0, "ident")) == NULL) - { - ilog_error("creating auth stream socket"); - ++ServerStats.is_abad; - return 0; - } - - /* - * TBD: this is a pointless arbitrary limit .. we either have a socket or not. -nenolod - */ - if((maxconnections - 10) < rb_get_fd(F)) - { - sendto_realops_snomask(SNO_GENERAL, L_ALL, - "Can't allocate fd for auth on %s", - get_client_name(auth->client, SHOW_IP)); - rb_close(F); - return 0; - } - - sendheader(auth->client, REPORT_DO_ID); - - /* - * get the local address of the client and bind to that to - * make the auth request. This used to be done only for - * ifdef VIRTUAL_HOST, but needs to be done for all clients - * since the ident request must originate from that same address-- - * and machines with multiple IP addresses are common now - */ - localaddr = auth->client->preClient->lip; - - /* XXX mangle_mapped_sockaddr((struct sockaddr *)&localaddr); */ -#ifdef RB_IPV6 - if(GET_SS_FAMILY(&localaddr) == AF_INET6) - { - auth->lport = ntohs(((struct sockaddr_in6 *)&localaddr)->sin6_port); - ((struct sockaddr_in6 *)&localaddr)->sin6_port = 0; - } - else -#endif - { - auth->lport = ntohs(((struct sockaddr_in *)&localaddr)->sin_port); - ((struct sockaddr_in *)&localaddr)->sin_port = 0; - } - - destaddr = auth->client->localClient->ip; -#ifdef RB_IPV6 - if(GET_SS_FAMILY(&localaddr) == AF_INET6) - { - auth->rport = ntohs(((struct sockaddr_in6 *)&destaddr)->sin6_port); - ((struct sockaddr_in6 *)&destaddr)->sin6_port = htons(113); - } - else -#endif - { - auth->rport = ntohs(((struct sockaddr_in *)&destaddr)->sin_port); - ((struct sockaddr_in *)&destaddr)->sin_port = htons(113); - } - - auth->F = F; - SetAuthConnect(auth); - - rb_connect_tcp(F, (struct sockaddr *)&destaddr, - (struct sockaddr *) &localaddr, GET_SS_LEN(&localaddr), - auth_connect_callback, auth, - GlobalSetOptions.ident_timeout); - return 1; /* We suceed here for now */ -} - -/* - * GetValidIdent - parse ident query reply from identd server - * - * Inputs - pointer to ident buf - * Output - NULL if no valid ident found, otherwise pointer to name - * Side effects - - */ -static char * -GetValidIdent(char *buf) -{ - int remp = 0; - int locp = 0; - char *colon1Ptr; - char *colon2Ptr; - char *colon3Ptr; - char *commaPtr; - char *remotePortString; - - /* All this to get rid of a sscanf() fun. */ - remotePortString = buf; - - colon1Ptr = strchr(remotePortString, ':'); - if(!colon1Ptr) - return 0; - - *colon1Ptr = '\0'; - colon1Ptr++; - colon2Ptr = strchr(colon1Ptr, ':'); - if(!colon2Ptr) - return 0; - - *colon2Ptr = '\0'; - colon2Ptr++; - commaPtr = strchr(remotePortString, ','); - - if(!commaPtr) - return 0; - - *commaPtr = '\0'; - commaPtr++; - - remp = atoi(remotePortString); - if(!remp) - return 0; - - locp = atoi(commaPtr); - if(!locp) - return 0; - - /* look for USERID bordered by first pair of colons */ - if(!strstr(colon1Ptr, "USERID")) - return 0; - - colon3Ptr = strchr(colon2Ptr, ':'); - if(!colon3Ptr) - return 0; - - *colon3Ptr = '\0'; - colon3Ptr++; - return (colon3Ptr); -} - -/* - * start_auth - starts auth (identd) and dns queries for a client - */ -void -start_auth(struct Client *client) -{ - struct AuthRequest *auth = 0; - s_assert(0 != client); - if(client == NULL) - return; - - auth = make_auth_request(client); - - sendheader(client, REPORT_DO_DNS); - - /* No DNS cache now, remember? -- adrian */ - auth->dns_id = lookup_ip(client->sockhost, GET_SS_FAMILY(&client->localClient->ip), auth_dns_callback, auth); - - SetDNSPending(auth); - - if(ConfigFileEntry.disable_auth == 0) - start_auth_query(auth); - - rb_dlinkAdd(auth, &auth->node, &auth_poll_list); -} - -/* - * timeout_auth_queries - timeout resolver and identd requests - * allow clients through if requests failed - */ -static void -timeout_auth_queries_event(void *notused) -{ - rb_dlink_node *ptr; - rb_dlink_node *next_ptr; - struct AuthRequest *auth; - - RB_DLINK_FOREACH_SAFE(ptr, next_ptr, auth_poll_list.head) - { - auth = ptr->data; - - if(auth->timeout < rb_current_time()) - { - if(auth->F != NULL) - rb_close(auth->F); - - if(IsDoingAuth(auth)) - { - ClearAuth(auth); - ++ServerStats.is_abad; - sendheader(auth->client, REPORT_FAIL_ID); - auth->client->localClient->auth_request = NULL; - } - if(IsDNSPending(auth)) - { - ClearDNSPending(auth); - cancel_lookup(auth->dns_id); - sendheader(auth->client, REPORT_FAIL_DNS); - } - - auth->client->localClient->lasttime = rb_current_time(); - release_auth_client(auth); - } - } -} - -/* - * auth_connect_callback() - deal with the result of rb_connect_tcp() - * - * If the connection failed, we simply close the auth fd and report - * a failure. If the connection suceeded send the ident server a query - * giving "theirport , ourport". The write is only attempted *once* so - * it is deemed to be a fail if the entire write doesn't write all the - * data given. This shouldnt be a problem since the socket should have - * a write buffer far greater than this message to store it in should - * problems arise. -avalon - */ -static void -auth_connect_callback(rb_fde_t *F, int error, void *data) -{ - struct AuthRequest *auth = data; - char authbuf[32]; - int authlen; - - /* Check the error */ - if(error != RB_OK) - { - /* We had an error during connection :( */ - auth_error(auth); - return; - } - - snprintf(authbuf, sizeof(authbuf), "%u , %u\r\n", - auth->rport, auth->lport); - authlen = strlen(authbuf); - - if(rb_write(auth->F, authbuf, authlen) != authlen) - { - auth_error(auth); - return; - } - ClearAuthConnect(auth); - SetAuthPending(auth); - read_auth_reply(auth->F, auth); -} - - -/* - * read_auth_reply - read the reply (if any) from the ident server - * we connected to. - * We only give it one shot, if the reply isn't good the first time - * fail the authentication entirely. --Bleep - */ -#define AUTH_BUFSIZ 128 - -static void -read_auth_reply(rb_fde_t *F, void *data) -{ - struct AuthRequest *auth = data; - char *s = NULL; - char *t = NULL; - int len; - int count; - char buf[AUTH_BUFSIZ + 1]; /* buffer to read auth reply into */ - - len = rb_read(F, buf, AUTH_BUFSIZ); - - if(len < 0 && rb_ignore_errno(errno)) - { - rb_setselect(F, RB_SELECT_READ, read_auth_reply, auth); - return; - } - - if(len > 0) - { - buf[len] = '\0'; - - if((s = GetValidIdent(buf))) - { - t = auth->client->username; - - while (*s == '~' || *s == '^') - s++; - - for (count = USERLEN; *s && count; s++) - { - if(*s == '@') - { - break; - } - if(!IsSpace(*s) && *s != ':' && *s != '[') - { - *t++ = *s; - count--; - } - } - *t = '\0'; - } - } - - rb_close(auth->F); - auth->F = NULL; - ClearAuth(auth); - - if(s == NULL) - { - ++ServerStats.is_abad; - strcpy(auth->client->username, "unknown"); - sendheader(auth->client, REPORT_FAIL_ID); - } - else - { - sendheader(auth->client, REPORT_FIN_ID); - ++ServerStats.is_asuc; - SetGotId(auth->client); - } - - release_auth_client(auth); -} - - - -/* - * delete_auth_queries() - */ -void -delete_auth_queries(struct Client *target_p) -{ - struct AuthRequest *auth; - - if(target_p == NULL || target_p->localClient == NULL || - target_p->localClient->auth_request == NULL) - return; - - auth = target_p->localClient->auth_request; - target_p->localClient->auth_request = NULL; - - if(IsDNSPending(auth)) - cancel_lookup(auth->dns_id); - - if(auth->F != NULL) - rb_close(auth->F); - - rb_dlinkDelete(&auth->node, &auth_poll_list); - free_auth_request(auth); -} diff --git a/ircd/s_conf.c b/ircd/s_conf.c index 87520538..18db1736 100644 --- a/ircd/s_conf.c +++ b/ircd/s_conf.c @@ -43,7 +43,6 @@ #include "send.h" #include "reject.h" #include "cache.h" -#include "blacklist.h" #include "privilege.h" #include "sslproc.h" #include "bandbi.h" @@ -1526,7 +1525,7 @@ clear_out_old_conf(void) alias_dict = NULL; } - destroy_blacklists(); + del_blacklist_all(); privilegeset_mark_all_illegal(); diff --git a/ircd/s_user.c b/ircd/s_user.c index 86a8c7cd..8c8f6796 100644 --- a/ircd/s_user.c +++ b/ircd/s_user.c @@ -48,7 +48,6 @@ #include "hook.h" #include "monitor.h" #include "snomask.h" -#include "blacklist.h" #include "substitution.h" #include "chmode.h" #include "s_assert.h" @@ -252,8 +251,8 @@ register_local_user(struct Client *client_p, struct Client *source_p) if(source_p->flags & FLAGS_CLICAP) return -1; - /* still has DNSbls to validate against */ - if(rb_dlink_list_length(&source_p->preClient->dnsbl_queries) > 0) + /* Waiting on authd */ + if(source_p->preClient->authd_cid) return -1; client_p->localClient->last = rb_current_time(); @@ -301,7 +300,6 @@ register_local_user(struct Client *client_p, struct Client *source_p) rb_strlcpy(source_p->host, source_p->sockhost, sizeof(source_p->host)); } - aconf = source_p->localClient->att_conf; if(aconf == NULL) @@ -421,45 +419,83 @@ register_local_user(struct Client *client_p, struct Client *source_p) return CLIENT_EXITED; } - /* dnsbl check */ - if (source_p->preClient->dnsbl_listed != NULL) + /* authd rejection check */ + if(source_p->preClient->authd_accepted == false) { - if (IsExemptKline(source_p) || IsConfExemptDNSBL(aconf)) - sendto_one_notice(source_p, ":*** Your IP address %s is listed in %s, but you are exempt", - source_p->sockhost, source_p->preClient->dnsbl_listed->host); - else + struct blacklist_stats *stats; + rb_dlink_list varlist = { NULL, NULL, 0 }; + char *reason; + + substitution_append_var(&varlist, "nick", source_p->name); + substitution_append_var(&varlist, "ip", source_p->sockhost); + substitution_append_var(&varlist, "host", source_p->host); + substitution_append_var(&varlist, "dnsbl-host", source_p->preClient->authd_data); + substitution_append_var(&varlist, "network-name", ServerInfo.network_name); + reason = substitution_parse(source_p->preClient->authd_reason, &varlist); + + switch(source_p->preClient->authd_cause) { - sendto_realops_snomask(SNO_REJ, L_NETWIDE, - "Listed on DNSBL %s: %s (%s@%s) [%s] [%s]", - source_p->preClient->dnsbl_listed->host, - source_p->name, - source_p->username, source_p->host, - IsIPSpoof(source_p) ? "255.255.255.255" : source_p->sockhost, - source_p->info); + case 'B': /* Blacklists */ + if((stats = rb_dictionary_retrieve(bl_stats, source_p->preClient->authd_data)) != NULL) + stats->hits++; + + if(IsExemptKline(source_p) || IsConfExemptDNSBL(aconf)) + { + sendto_one_notice(source_p, ":*** Your IP address %s is listed in %s, but you are exempt", + source_p->sockhost, source_p->preClient->authd_data); + } + else + { + sendto_realops_snomask(SNO_REJ, L_NETWIDE, + "Listed on DNSBL %s: %s (%s@%s) [%s] [%s]", + source_p->preClient->authd_data, + source_p->name, + source_p->username, source_p->host, + IsIPSpoof(source_p) ? "255.255.255.255" : source_p->sockhost, + source_p->info); - rb_dlink_list varlist = { NULL, NULL, 0 }; + ServerStats.is_ref++; - substitution_append_var(&varlist, "nick", source_p->name); - substitution_append_var(&varlist, "ip", source_p->sockhost); - substitution_append_var(&varlist, "host", source_p->host); - substitution_append_var(&varlist, "dnsbl-host", source_p->preClient->dnsbl_listed->host); - substitution_append_var(&varlist, "network-name", ServerInfo.network_name); + sendto_one(source_p, form_str(ERR_YOUREBANNEDCREEP), + me.name, source_p->name, reason); - ServerStats.is_ref++; + sendto_one_notice(source_p, ":*** Your IP address %s is listed in %s", + source_p->sockhost, source_p->preClient->authd_data); + add_reject(source_p, NULL, NULL); + exit_client(client_p, source_p, &me, "*** Banned (DNS blacklist)"); + substitution_free(&varlist); + return CLIENT_EXITED; + } + break; + default: /* Unknown, but handle the case properly */ + if (IsExemptKline(source_p)) + { + sendto_one_notice(source_p, ":*** You were rejected, but you are exempt (reason: %s)", + reason); + } + else + { + sendto_realops_snomask(SNO_REJ, L_NETWIDE, + "Rejected by authentication system (reason %s): %s (%s@%s) [%s] [%s]", + reason, source_p->name, source_p->username, source_p->host, + IsIPSpoof(source_p) ? "255.255.255.255" : source_p->sockhost, + source_p->info); - sendto_one(source_p, form_str(ERR_YOUREBANNEDCREEP), - me.name, source_p->name, - substitution_parse(source_p->preClient->dnsbl_listed->reject_reason, &varlist)); + ServerStats.is_ref++; - substitution_free(&varlist); + sendto_one(source_p, form_str(ERR_YOUREBANNEDCREEP), + me.name, source_p->name, reason); - sendto_one_notice(source_p, ":*** Your IP address %s is listed in %s", - source_p->sockhost, source_p->preClient->dnsbl_listed->host); - source_p->preClient->dnsbl_listed->hits++; - add_reject(source_p, NULL, NULL); - exit_client(client_p, source_p, &me, "*** Banned (DNS blacklist)"); - return CLIENT_EXITED; + sendto_one_notice(source_p, ":*** Rejected by authentication system: %s", + reason); + add_reject(source_p, NULL, NULL); + exit_client(client_p, source_p, &me, "*** Banned (authentication system)"); + substitution_free(&varlist); + return CLIENT_EXITED; + } } + + substitution_free(&varlist); } /* valid user name check */ diff --git a/modules/m_set.c b/modules/m_set.c index e28b7002..2355ab10 100644 --- a/modules/m_set.c +++ b/modules/m_set.c @@ -202,6 +202,7 @@ quote_identtimeout(struct Client *source_p, const char *arg, int newval) "%s has changed IDENTTIMEOUT to %d", get_oper_name(source_p), newval); GlobalSetOptions.ident_timeout = newval; + set_authd_timeout("ident_timeout", newval); } else sendto_one_notice(source_p, ":IDENTTIMEOUT is currently %d", diff --git a/modules/m_stats.c b/modules/m_stats.c index 40082039..afaea433 100644 --- a/modules/m_stats.c +++ b/modules/m_stats.c @@ -37,7 +37,6 @@ #include "s_serv.h" /* hunt_server */ #include "s_stats.h" #include "s_user.h" /* show_opers */ -#include "blacklist.h" /* dnsbl stuff */ #include "parse.h" #include "modules.h" #include "hook.h" @@ -141,51 +140,51 @@ static void stats_capability(struct Client *); */ static struct stats_cmd stats_cmd_table[256] = { /* letter handler/handler_parv parv oper admin */ - ['a'] = { { stats_dns_servers }, false, true, true, }, - ['A'] = { { stats_dns_servers }, false, true, true, }, - ['b'] = { { stats_delay }, false, true, true, }, - ['B'] = { { stats_hash }, false, true, true, }, + ['a'] = { { stats_dns_servers }, false, true, true, }, + ['A'] = { { stats_dns_servers }, false, true, true, }, + ['b'] = { { stats_delay }, false, true, true, }, + ['B'] = { { stats_hash }, false, true, true, }, ['c'] = { { stats_connect }, false, false, false, }, ['C'] = { { stats_capability }, false, true, false, }, - ['d'] = { { stats_tdeny }, false, true, false, }, - ['D'] = { { stats_deny }, false, true, false, }, - ['e'] = { { stats_exempt }, false, true, false, }, - ['E'] = { { stats_events }, false, true, true, }, - ['f'] = { { stats_comm }, false, true, true, }, - ['F'] = { { stats_comm }, false, true, true, }, - ['g'] = { { stats_prop_klines }, false, true, false, }, + ['d'] = { { stats_tdeny }, false, true, false, }, + ['D'] = { { stats_deny }, false, true, false, }, + ['e'] = { { stats_exempt }, false, true, false, }, + ['E'] = { { stats_events }, false, true, true, }, + ['f'] = { { stats_comm }, false, true, true, }, + ['F'] = { { stats_comm }, false, true, true, }, + ['g'] = { { stats_prop_klines }, false, true, false, }, ['h'] = { { stats_hubleaf }, false, false, false, }, ['H'] = { { stats_hubleaf }, false, false, false, }, - ['i'] = { { stats_auth }, false, false, false, }, - ['I'] = { { stats_auth }, false, false, false, }, + ['i'] = { { stats_auth }, false, false, false, }, + ['I'] = { { stats_auth }, false, false, false, }, ['k'] = { { stats_tklines }, false, false, false, }, - ['K'] = { { stats_klines }, false, false, false, }, - ['l'] = { { .handler_parv = stats_ltrace }, true, false, false, }, - ['L'] = { { .handler_parv = stats_ltrace }, true, false, false, }, + ['K'] = { { stats_klines }, false, false, false, }, + ['l'] = { { .handler_parv = stats_ltrace }, true, false, false, }, + ['L'] = { { .handler_parv = stats_ltrace }, true, false, false, }, ['m'] = { { stats_messages }, false, false, false, }, ['M'] = { { stats_messages }, false, false, false, }, - ['n'] = { { stats_dnsbl }, false, false, false, }, - ['o'] = { { stats_oper }, false, false, false, }, + ['n'] = { { stats_dnsbl }, false, false, false, }, + ['o'] = { { stats_oper }, false, false, false, }, ['O'] = { { stats_privset }, false, true, false, }, ['p'] = { { stats_operedup }, false, false, false, }, - ['P'] = { { stats_ports }, false, false, false, }, - ['q'] = { { stats_tresv }, false, true, false, }, - ['Q'] = { { stats_resv }, false, true, false, }, - ['r'] = { { stats_usage }, false, true, false, }, - ['R'] = { { stats_usage }, false, true, false, }, - ['s'] = { { stats_ssld }, false, true, true, }, - ['S'] = { { stats_ssld }, false, true, true, }, - ['t'] = { { stats_tstats }, false, true, false, }, - ['T'] = { { stats_tstats }, false, true, false, }, - ['u'] = { { stats_uptime }, false, false, false, }, - ['U'] = { { stats_shared }, false, true, false, }, + ['P'] = { { stats_ports }, false, false, false, }, + ['q'] = { { stats_tresv }, false, true, false, }, + ['Q'] = { { stats_resv }, false, true, false, }, + ['r'] = { { stats_usage }, false, true, false, }, + ['R'] = { { stats_usage }, false, true, false, }, + ['s'] = { { stats_ssld }, false, true, true, }, + ['S'] = { { stats_ssld }, false, true, true, }, + ['t'] = { { stats_tstats }, false, true, false, }, + ['T'] = { { stats_tstats }, false, true, false, }, + ['u'] = { { stats_uptime }, false, false, false, }, + ['U'] = { { stats_shared }, false, true, false, }, ['v'] = { { stats_servers }, false, false, false, }, ['V'] = { { stats_servers }, false, false, false, }, - ['x'] = { { stats_tgecos }, false, true, false, }, - ['X'] = { { stats_gecos }, false, true, false, }, - ['y'] = { { stats_class }, false, false, false, }, - ['Y'] = { { stats_class }, false, false, false, }, - ['z'] = { { stats_memory }, false, true, false, }, + ['x'] = { { stats_tgecos }, false, true, false, }, + ['X'] = { { stats_gecos }, false, true, false, }, + ['y'] = { { stats_class }, false, false, false, }, + ['Y'] = { { stats_class }, false, false, false, }, + ['z'] = { { stats_memory }, false, true, false, }, ['Z'] = { { stats_ziplinks }, false, true, false, }, ['?'] = { { stats_servlinks }, false, false, false, }, }; @@ -758,19 +757,14 @@ stats_messages(struct Client *source_p) static void stats_dnsbl(struct Client *source_p) { - rb_dlink_node *ptr; - struct Blacklist *blptr; + rb_dictionary_iter iter; + struct blacklist_stats *stats; - RB_DLINK_FOREACH(ptr, blacklist_list.head) + RB_DICTIONARY_FOREACH(stats, &iter, bl_stats) { - blptr = ptr->data; - /* use RPL_STATSDEBUG for now -- jilles */ - sendto_one_numeric(source_p, RPL_STATSDEBUG, "n :%d %s %s (%d)", - blptr->hits, - blptr->host, - blptr->status & CONF_ILLEGAL ? "disabled" : "active", - blptr->refcount); + sendto_one_numeric(source_p, RPL_STATSDEBUG, "n :%d %s", + stats->hits, (const char *)iter.cur->key); } } diff --git a/modules/m_user.c b/modules/m_user.c index cd8c7c13..d0360039 100644 --- a/modules/m_user.c +++ b/modules/m_user.c @@ -33,7 +33,6 @@ #include "msg.h" #include "parse.h" #include "modules.h" -#include "blacklist.h" #include "s_assert.h" static const char user_desc[] = @@ -92,7 +91,6 @@ do_local_user(struct Client *client_p, struct Client *source_p, make_user(source_p); - lookup_blacklists(source_p); source_p->flags |= FLAGS_SENTUSER; rb_strlcpy(source_p->info, realname, sizeof(source_p->info)); From cc4d393152cd39194793d61f811988ce9e7310b6 Mon Sep 17 00:00:00 2001 From: Elizabeth Myers Date: Mon, 28 Mar 2016 02:19:34 -0500 Subject: [PATCH 11/14] ircd/authd: implement client noticing --- ircd/authd.c | 31 ++++++++++++++++++++++++++++++- 1 file changed, 30 insertions(+), 1 deletion(-) diff --git a/ircd/authd.c b/ircd/authd.c index cfbbb52f..5d4a7f8f 100644 --- a/ircd/authd.c +++ b/ircd/authd.c @@ -189,7 +189,36 @@ parse_authd_reply(rb_helper * helper) rb_free(id); authd_decide_client(client_p, parv[3], parv[4], false, toupper(*parv[2]), parv[5], parv[6]); - return; + break; + case 'N': /* Notice to client */ + if(parv != 3) + { + iwarn("authd sent us a result with wrong number of arguments: got %d", parc); + restart_authd(); + return; + } + + if((lcid = strtol(parv[1], NULL, 16)) > UINT32_MAX) + { + iwarn("authd sent us back a bad client ID"); + restart_authd(); + return; + } + + /* cid to uid */ + if((id = rb_dictionary_retrieve(cid_clients, RB_UINT_TO_POINTER((uint32_t)lcid))) == NULL) + { + iwarn("authd sent us back an unknown client ID"); + restart_authd(); + return; + } + + if((client_p = find_id(id)) == NULL) + /* Client vanished... we'll let the timeout code handle it */ + return; + + sendto_one_notice(client_p, ":%s", parv[2]); + break; case 'E': /* DNS Result */ if(parc != 5) { From ef0b13b9601803d8d4c14504c2bbf88e03d6acb6 Mon Sep 17 00:00:00 2001 From: Elizabeth Myers Date: Mon, 28 Mar 2016 02:30:54 -0500 Subject: [PATCH 12/14] ircd/authd: timeout dead authd clients --- ircd/authd.c | 34 +++++++++++++++++++++++++++++++++- 1 file changed, 33 insertions(+), 1 deletion(-) diff --git a/ircd/authd.c b/ircd/authd.c index 5d4a7f8f..db646363 100644 --- a/ircd/authd.c +++ b/ircd/authd.c @@ -43,12 +43,14 @@ static int start_authd(void); static void parse_authd_reply(rb_helper * helper); static void restart_authd_cb(rb_helper * helper); +static EVH timeout_dead_authd_clients; rb_helper *authd_helper; static char *authd_path; uint32_t cid = 1; static rb_dictionary *cid_clients; +static struct ev_entry *timeout_ev; rb_dictionary *bl_stats; @@ -91,6 +93,9 @@ start_authd(void) if(bl_stats == NULL) bl_stats = rb_dictionary_create("blacklist statistics", strcasecmp); + if(timeout_ev == NULL) + timeout_ev = rb_event_addish("timeout_dead_authd_clients", timeout_dead_authd_clients, NULL, 1); + authd_helper = rb_helper_start("authd", authd_path, parse_authd_reply, restart_authd_cb); if(authd_helper == NULL) @@ -191,7 +196,7 @@ parse_authd_reply(rb_helper * helper) authd_decide_client(client_p, parv[3], parv[4], false, toupper(*parv[2]), parv[5], parv[6]); break; case 'N': /* Notice to client */ - if(parv != 3) + if(parc != 3) { iwarn("authd sent us a result with wrong number of arguments: got %d", parc); restart_authd(); @@ -461,6 +466,33 @@ authd_abort_client(struct Client *client_p) client_p->preClient->authd_cid = 0; } +static void +timeout_dead_authd_clients(void *notused __unused) +{ + rb_dictionary_iter iter; + char *id; + + RB_DICTIONARY_FOREACH(id, &iter, cid_clients) + { + struct Client *client_p; + if((client_p = find_id(id)) == NULL) + { + /* This shouldn't happen... but just in case... */ + rb_helper_write(authd_helper, "E %x", RB_POINTER_TO_UINT(iter.cur->key)); + rb_free(id); + rb_dictionary_delete(cid_clients, iter.cur->key); + continue; + } + + if(client_p->preClient->authd_timeout < rb_current_time()) + { + rb_helper_write(authd_helper, "E %x", client_p->preClient->authd_cid); + rb_free(id); + rb_dictionary_delete(cid_clients, RB_UINT_TO_POINTER(client_p->preClient->authd_cid)); + } + } +} + /* Turn a cause char (who rejected us) into the name of the provider */ const char * get_provider_string(char cause) From 59d42a9fcb59922d2911936363abf7d096e72af9 Mon Sep 17 00:00:00 2001 From: Elizabeth Myers Date: Mon, 28 Mar 2016 02:32:05 -0500 Subject: [PATCH 13/14] ircd/authd: use proper timeout values for clients --- ircd/authd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ircd/authd.c b/ircd/authd.c index db646363..fa7e77f7 100644 --- a/ircd/authd.c +++ b/ircd/authd.c @@ -403,8 +403,8 @@ authd_initiate_client(struct Client *client_p) #endif client_port = ntohs(((struct sockaddr_in *)&client_p->localClient->ip)->sin_port); - /* FIXME timeout should be configurable */ - client_p->preClient->authd_timeout = rb_current_time() + 45; + /* Add a bit of a fudge factor... */ + client_p->preClient->authd_timeout = rb_current_time() + ConfigFileEntry.connect_timeout + 5; rb_helper_write(authd_helper, "C %x %s %hu %s %hu", authd_cid, listen_ipaddr, listen_port, client_ipaddr, client_port); } From ad04380360ad4e3c8faadaea42ccdf6274fe2228 Mon Sep 17 00:00:00 2001 From: Elizabeth Myers Date: Mon, 28 Mar 2016 02:42:20 -0500 Subject: [PATCH 14/14] ircd/authd: respect auth_disabled config option --- include/authd.h | 1 + ircd/authd.c | 7 +++++++ 2 files changed, 8 insertions(+) diff --git a/include/authd.h b/include/authd.h index 03405958..71990aa7 100644 --- a/include/authd.h +++ b/include/authd.h @@ -55,5 +55,6 @@ void add_blacklist(const char *host, const char *reason, uint8_t iptype, rb_dlin void del_blacklist(const char *host); void del_blacklist_all(void); void set_authd_timeout(const char *key, int timeout); +void ident_check_enable(bool enabled); #endif diff --git a/ircd/authd.c b/ircd/authd.c index fa7e77f7..d2514deb 100644 --- a/ircd/authd.c +++ b/ircd/authd.c @@ -316,6 +316,7 @@ configure_authd(void) set_authd_timeout("ident_timeout", GlobalSetOptions.ident_timeout); set_authd_timeout("rdns_timeout", ConfigFileEntry.connect_timeout); set_authd_timeout("blacklist_timeout", ConfigFileEntry.connect_timeout); + ident_check_enable(ConfigFileEntry.disable_auth); } static void @@ -576,3 +577,9 @@ set_authd_timeout(const char *key, int timeout) { rb_helper_write(authd_helper, "O %s %d", key, timeout); } + +void +ident_check_enable(bool enabled) +{ + rb_helper_write(authd_helper, "O ident_enabled %d", enabled ? 1 : 0); +}