]>
Commit | Line | Data |
---|---|---|
c86edd1d Q |
1 | |
2 | #include "proxyscan.h" | |
3 | ||
4 | #include <sys/poll.h> | |
5 | #include <sys/types.h> | |
6 | #include <sys/socket.h> | |
7 | #include <netdb.h> | |
8 | #include "../core/error.h" | |
9 | #include "../core/events.h" | |
10 | #include <stdlib.h> | |
11 | #include <stdio.h> | |
12 | #include <errno.h> | |
13 | #include "../nick/nick.h" | |
14 | #include "../core/hooks.h" | |
15 | #include "../lib/sstring.h" | |
16 | #include "../irc/irc_config.h" | |
17 | #include "../localuser/localuser.h" | |
18 | #include "../core/config.h" | |
19 | #include <unistd.h> | |
20 | #include "../core/schedule.h" | |
21 | #include <string.h> | |
22 | #include "../irc/irc.h" | |
23 | #include "../lib/irc_string.h" | |
cfd3214b CP |
24 | #include "../lib/version.h" |
25 | #include "../channel/channel.h" | |
26 | #include "../localuser/localuserchannel.h" | |
818e3d5f | 27 | #include "../core/nsmalloc.h" |
557c8cb2 | 28 | #include "../lib/irc_ipv6.h" |
cfd3214b CP |
29 | |
30 | MODULE_VERSION("") | |
c86edd1d Q |
31 | |
32 | #define SCANTIMEOUT 60 | |
33 | ||
34 | #define SCANHOSTHASHSIZE 1000 | |
35 | #define SCANHASHSIZE 400 | |
36 | ||
37 | /* It's unlikely you'll get 100k of preamble before a connect... */ | |
38 | #define READ_SANITY_LIMIT 102400 | |
39 | ||
40 | scan *scantable[SCANHASHSIZE]; | |
41 | ||
42 | int listenfd; | |
43 | int activescans; | |
44 | int maxscans; | |
45 | int queuedhosts; | |
46 | int scansdone; | |
47 | int rescaninterval; | |
48 | int warningsent; | |
49 | int glinedhosts; | |
2220c058 | 50 | time_t ps_starttime; |
557c8cb2 P |
51 | int ps_cache_ext; |
52 | int ps_extscan_ext; | |
c86edd1d Q |
53 | |
54 | int numscans; /* number of scan types currently valid */ | |
55 | scantype thescans[PSCAN_MAXSCANS]; | |
56 | ||
57 | unsigned int hitsbyclass[10]; | |
58 | unsigned int scansbyclass[10]; | |
59 | ||
60 | unsigned int myip; | |
61 | sstring *myipstr; | |
62 | unsigned short listenport; | |
63 | int brokendb; | |
64 | ||
65 | unsigned int ps_mailip; | |
66 | unsigned int ps_mailport; | |
67 | sstring *ps_mailname; | |
68 | ||
92f1d9e3 D |
69 | unsigned long scanspermin; |
70 | unsigned long tempscanspermin=0; | |
71 | unsigned long lastscants=0; | |
72 | ||
761a4596 P |
73 | unsigned int ps_start_ts=0; |
74 | ||
c86edd1d Q |
75 | nick *proxyscannick; |
76 | ||
77 | FILE *ps_logfile; | |
78 | ||
79 | /* Local functions */ | |
80 | void handlescansock(int fd, short events); | |
81 | void timeoutscansock(void *arg); | |
82 | void proxyscan_newnick(int hooknum, void *arg); | |
83 | void proxyscan_lostnick(int hooknum, void *arg); | |
84 | void proxyscanuserhandler(nick *target, int message, void **params); | |
85 | void registerproxyscannick(); | |
86 | void killsock(scan *sp, int outcome); | |
87 | void killallscans(); | |
88 | void proxyscanstats(int hooknum, void *arg); | |
89 | void sendlagwarning(); | |
90 | void proxyscandostatus(nick *np); | |
91 | void proxyscandebug(nick *np); | |
92 | void proxyscan_newip(nick *np, unsigned long ip); | |
93 | int proxyscan_addscantype(int type, int port); | |
94 | int proxyscan_delscantype(int type, int port); | |
95 | ||
96 | int proxyscan_addscantype(int type, int port) { | |
97 | /* Check we have a spare scan slot */ | |
98 | ||
99 | if (numscans>=PSCAN_MAXSCANS) | |
100 | return 1; | |
101 | ||
102 | thescans[numscans].type=type; | |
103 | thescans[numscans].port=port; | |
104 | thescans[numscans].hits=0; | |
105 | ||
106 | numscans++; | |
107 | ||
108 | return 0; | |
109 | } | |
110 | ||
111 | int proxyscan_delscantype(int type, int port) { | |
112 | int i; | |
113 | ||
114 | for (i=0;i<numscans;i++) | |
115 | if (thescans[i].type==type && thescans[i].port==port) | |
116 | break; | |
117 | ||
118 | if (i>=numscans) | |
119 | return 1; | |
120 | ||
121 | memmove(thescans+i, thescans+(i+1), (PSCAN_MAXSCANS-(i+1)) * sizeof(scantype)); | |
122 | numscans--; | |
123 | ||
124 | return 0; | |
125 | } | |
126 | ||
127 | void _init(void) { | |
128 | sstring *cfgstr; | |
129 | int ipbits[4]; | |
130 | ||
761a4596 P |
131 | ps_start_ts = time(NULL); |
132 | ||
557c8cb2 | 133 | ps_cache_ext = registernodeext("proxyscancache"); |
a8ba1373 P |
134 | if( ps_cache_ext == -1 ) { |
135 | Error("proxyscan",ERR_INFO,"failed to reg node ext"); | |
136 | return; | |
557c8cb2 P |
137 | } |
138 | ps_extscan_ext = registernodeext("proxyscanextscan"); | |
a8ba1373 P |
139 | if ( ps_extscan_ext == -1) { |
140 | Error("proxyscan",ERR_INFO,"failed to reg node ext"); | |
141 | return; | |
557c8cb2 | 142 | } |
a8ba1373 | 143 | |
c86edd1d Q |
144 | memset(scantable,0,sizeof(scantable)); |
145 | maxscans=200; | |
146 | activescans=0; | |
147 | queuedhosts=0; | |
148 | scansdone=0; | |
149 | warningsent=0; | |
2220c058 | 150 | ps_starttime=time(NULL); |
c86edd1d Q |
151 | glinedhosts=0; |
152 | ||
92f1d9e3 D |
153 | scanspermin=0; |
154 | lastscants=time(NULL); | |
155 | ||
c86edd1d Q |
156 | /* Listen port */ |
157 | cfgstr=getcopyconfigitem("proxyscan","port","9999",6); | |
158 | listenport=strtol(cfgstr->content,NULL,10); | |
159 | freesstring(cfgstr); | |
160 | ||
161 | /* Max concurrent scans */ | |
162 | cfgstr=getcopyconfigitem("proxyscan","maxscans","200",5); | |
163 | maxscans=strtol(cfgstr->content,NULL,10); | |
164 | freesstring(cfgstr); | |
165 | ||
166 | /* Clean host timeout */ | |
167 | cfgstr=getcopyconfigitem("proxyscan","rescaninterval","3600",7); | |
168 | rescaninterval=strtol(cfgstr->content,NULL,10); | |
169 | cachehostinit(rescaninterval); | |
170 | freesstring(cfgstr); | |
171 | ||
172 | /* this default will NOT work well */ | |
173 | myipstr=getcopyconfigitem("proxyscan","ip","127.0.0.1",16); | |
174 | ||
175 | sscanf(myipstr->content,"%d.%d.%d.%d",&ipbits[0],&ipbits[1],&ipbits[2],&ipbits[3]); | |
176 | ||
177 | myip=((ipbits[0]&0xFF)<<24)+((ipbits[1]&0xFF)<<16)+ | |
178 | ((ipbits[2]&0xFF)<<8)+(ipbits[3]&0xFF); | |
179 | ||
f94f9cec | 180 | #if defined(PROXYSCAN_MAIL) |
c86edd1d Q |
181 | /* Mailer host */ |
182 | cfgstr=getcopyconfigitem("proxyscan","mailerip","",16); | |
183 | ||
c86edd1d Q |
184 | psm_mailerfd=-1; |
185 | if (cfgstr) { | |
186 | sscanf(cfgstr->content,"%d.%d.%d.%d",&ipbits[0],&ipbits[1],&ipbits[2],&ipbits[3]); | |
187 | ps_mailip = ((ipbits[0]&0xFF)<<24)+((ipbits[1]&0xFF)<<16)+ | |
188 | ((ipbits[2]&0xFF)<<8)+(ipbits[3]&0xFF); | |
189 | ps_mailport=25; | |
190 | freesstring(cfgstr); | |
191 | ||
192 | ps_mailname=getcopyconfigitem("proxyscan","mailname","some.mail.server",HOSTLEN); | |
c9db668b | 193 | Error("proxyscan",ERR_INFO,"Proxyscan mailer enabled; mailing to %s as %s.",IPlongtostr(ps_mailip),ps_mailname->content); |
c86edd1d Q |
194 | } else { |
195 | ps_mailport=0; | |
196 | ps_mailname=NULL; | |
197 | } | |
198 | #endif | |
199 | ||
200 | proxyscannick=NULL; | |
201 | /* Set up our nick on the network */ | |
202 | scheduleoneshot(time(NULL),®isterproxyscannick,NULL); | |
203 | ||
204 | registerhook(HOOK_NICK_NEWNICK,&proxyscan_newnick); | |
205 | ||
206 | registerhook(HOOK_CORE_STATSREQUEST,&proxyscanstats); | |
207 | ||
208 | /* Read in the clean hosts */ | |
209 | loadcachehosts(); | |
210 | ||
557c8cb2 P |
211 | /* Read in any custom ports to scan */ |
212 | loadextrascans(); | |
213 | ||
c86edd1d Q |
214 | /* Set up the database */ |
215 | if ((proxyscandbinit())!=0) { | |
216 | brokendb=1; | |
217 | } else { | |
218 | brokendb=0; | |
219 | } | |
220 | ||
221 | /* Default scan types */ | |
222 | proxyscan_addscantype(STYPE_HTTP, 8080); | |
223 | proxyscan_addscantype(STYPE_HTTP, 80); | |
224 | proxyscan_addscantype(STYPE_HTTP, 6588); | |
225 | proxyscan_addscantype(STYPE_HTTP, 8000); | |
226 | proxyscan_addscantype(STYPE_HTTP, 3128); | |
227 | proxyscan_addscantype(STYPE_HTTP, 3802); | |
228 | proxyscan_addscantype(STYPE_HTTP, 5490); | |
229 | proxyscan_addscantype(STYPE_HTTP, 7441); | |
230 | proxyscan_addscantype(STYPE_HTTP, 808); | |
231 | proxyscan_addscantype(STYPE_HTTP, 3332); | |
232 | proxyscan_addscantype(STYPE_HTTP, 2282); | |
0a85c6ba | 233 | proxyscan_addscantype(STYPE_SOCKS4, 559); |
c86edd1d Q |
234 | proxyscan_addscantype(STYPE_SOCKS4, 1080); |
235 | proxyscan_addscantype(STYPE_SOCKS5, 1080); | |
236 | proxyscan_addscantype(STYPE_SOCKS4, 1075); | |
237 | proxyscan_addscantype(STYPE_SOCKS5, 1075); | |
238 | proxyscan_addscantype(STYPE_SOCKS4, 2280); | |
239 | proxyscan_addscantype(STYPE_SOCKS5, 2280); | |
240 | proxyscan_addscantype(STYPE_SOCKS4, 1180); | |
241 | proxyscan_addscantype(STYPE_SOCKS5, 1180); | |
0a85c6ba P |
242 | proxyscan_addscantype(STYPE_SOCKS4, 9999); |
243 | proxyscan_addscantype(STYPE_SOCKS5, 9999); | |
c86edd1d Q |
244 | proxyscan_addscantype(STYPE_WINGATE, 23); |
245 | proxyscan_addscantype(STYPE_CISCO, 23); | |
246 | proxyscan_addscantype(STYPE_WINGATE, 1181); | |
247 | proxyscan_addscantype(STYPE_SOCKS5, 1978); | |
248 | proxyscan_addscantype(STYPE_SOCKS5, 1029); | |
249 | proxyscan_addscantype(STYPE_SOCKS5, 3801); | |
250 | proxyscan_addscantype(STYPE_SOCKS5, 3331); | |
251 | proxyscan_addscantype(STYPE_HTTP, 65506); | |
252 | proxyscan_addscantype(STYPE_HTTP, 63809); | |
905c2ba2 | 253 | proxyscan_addscantype(STYPE_HTTP, 63000); |
92f1d9e3 | 254 | proxyscan_addscantype(STYPE_SOCKS4, 29992); |
905c2ba2 | 255 | |
c86edd1d Q |
256 | /* Schedule saves */ |
257 | schedulerecurring(time(NULL)+3600,0,3600,&dumpcachehosts,NULL); | |
258 | ||
259 | ps_logfile=fopen("proxyscan.log","a"); | |
260 | } | |
261 | ||
262 | void registerproxyscannick(void *arg) { | |
263 | sstring *psnick,*psuser,*pshost,*psrealname; | |
264 | /* Set up our nick on the network */ | |
cfd3214b | 265 | channel *cp; |
c86edd1d Q |
266 | |
267 | psnick=getcopyconfigitem("proxyscan","nick","P",NICKLEN); | |
268 | psuser=getcopyconfigitem("proxyscan","user","proxyscan",USERLEN); | |
269 | pshost=getcopyconfigitem("proxyscan","host","some.host",HOSTLEN); | |
270 | psrealname=getcopyconfigitem("proxyscan","realname","Proxyscan",REALLEN); | |
271 | ||
272 | proxyscannick=registerlocaluser(psnick->content,psuser->content,pshost->content, | |
273 | psrealname->content, | |
274 | NULL,UMODE_OPER|UMODE_SERVICE|UMODE_DEAF, | |
275 | &proxyscanuserhandler); | |
276 | ||
277 | freesstring(psnick); | |
278 | freesstring(psuser); | |
279 | freesstring(pshost); | |
280 | freesstring(psrealname); | |
cfd3214b CP |
281 | |
282 | cp=findchannel("#twilightzone"); | |
283 | if (!cp) { | |
284 | localcreatechannel(proxyscannick,"#twilightzone"); | |
285 | } else { | |
286 | localjoinchannel(proxyscannick,cp); | |
287 | localgetops(proxyscannick,cp); | |
288 | } | |
c86edd1d Q |
289 | } |
290 | ||
291 | void _fini(void) { | |
292 | ||
293 | deregisterlocaluser(proxyscannick,NULL); | |
557c8cb2 P |
294 | |
295 | releasenodeext(ps_cache_ext); | |
296 | releasenodeext(ps_extscan_ext); | |
c86edd1d Q |
297 | |
298 | deregisterhook(HOOK_NICK_NEWNICK,&proxyscan_newnick); | |
299 | ||
300 | deregisterhook(HOOK_CORE_STATSREQUEST,&proxyscanstats); | |
301 | ||
302 | deleteschedule(NULL,&dumpcachehosts,NULL); | |
303 | ||
304 | /* Kill any scans in progress */ | |
305 | killallscans(); | |
306 | ||
307 | /* Dump the database - AFTER killallscans() which prunes it */ | |
308 | dumpcachehosts(NULL); | |
309 | ||
310 | /* free() all our structures */ | |
818e3d5f | 311 | nsfreeall(POOL_PROXYSCAN); |
c86edd1d | 312 | |
6e228f06 | 313 | freesstring(myipstr); |
c86edd1d Q |
314 | freesstring(ps_mailname); |
315 | #if defined(PROXYSCAN_MAIL) | |
316 | if (psm_mailerfd!=-1) | |
317 | deregisterhandler(psm_mailerfd,1); | |
318 | #endif | |
319 | ||
320 | if (ps_logfile) | |
321 | fclose(ps_logfile); | |
322 | } | |
323 | ||
324 | void proxyscanuserhandler(nick *target, int message, void **params) { | |
325 | nick *sender; | |
326 | char *msg; | |
327 | int i; | |
557c8cb2 P |
328 | struct irc_in_addr sin; |
329 | unsigned char bits; | |
330 | patricia_node_t *node; | |
c86edd1d Q |
331 | |
332 | switch(message) { | |
333 | case LU_KILLED: | |
334 | scheduleoneshot(time(NULL)+1,®isterproxyscannick,NULL); | |
335 | proxyscannick=NULL; | |
336 | break; | |
337 | ||
338 | case LU_PRIVMSG: | |
339 | case LU_SECUREMSG: | |
340 | sender=(nick *)params[0]; | |
341 | msg=(char *)params[1]; | |
342 | ||
343 | if (IsOper(sender)) { | |
344 | if (!ircd_strncmp(msg,"listopen",8)) { | |
345 | proxyscandolistopen(proxyscannick,sender,time(NULL)-rescaninterval); | |
346 | } | |
347 | ||
348 | if (!ircd_strncmp(msg,"status",6)) { | |
349 | proxyscandostatus(sender); | |
350 | } | |
351 | ||
352 | if (!ircd_strncmp(msg,"save",4)) { | |
353 | dumpcachehosts(NULL); | |
354 | sendnoticetouser(proxyscannick,sender,"Done."); | |
355 | } | |
356 | ||
357 | if (!ircd_strncmp(msg,"debug",5)) { | |
358 | proxyscandebug(sender); | |
359 | } | |
7d228b1d D |
360 | |
361 | if (!ircd_strncmp(msg,"spew ",5)) { | |
362 | /* check our database for the ip supplied */ | |
363 | unsigned long a,b,c,d; | |
364 | if (4 != sscanf(&msg[5],"%lu.%lu.%lu.%lu",&a,&b,&c,&d)) { | |
365 | sendnoticetouser(proxyscannick,sender,"Usage: spew x.x.x.x"); | |
366 | } else { | |
367 | /* check db */ | |
368 | proxyscanspewip(proxyscannick,sender,a,b,c,d); | |
369 | } | |
370 | } | |
371 | ||
372 | if (!ircd_strncmp(msg,"showkill ",9)) { | |
373 | /* check our database for the id supplied */ | |
374 | unsigned long a; | |
375 | if (1 != sscanf(&msg[9],"%lu",&a)) { | |
376 | sendnoticetouser(proxyscannick,sender,"Usage: showkill <id>"); | |
377 | } else { | |
378 | /* check db */ | |
379 | proxyscanshowkill(proxyscannick,sender,a); | |
380 | } | |
381 | } | |
382 | ||
c86edd1d | 383 | if (!ircd_strncmp(msg,"scan ",5)) { |
557c8cb2 P |
384 | if (0 == ipmask_parse(&msg[5],&sin, &bits)) { |
385 | sendnoticetouser(proxyscannick,sender,"Usage: scan <ip>"); | |
c86edd1d | 386 | } else { |
557c8cb2 P |
387 | sendnoticetouser(proxyscannick,sender,"Forcing scan of %s",IPtostr(sin)); |
388 | // * Just queue the scans directly here.. plonk them on the priority queue * / | |
389 | node = refnode(iptree, &sin, bits); /* node leaks node here - should only allow to scan a nick? */ | |
390 | for(i=0;i<numscans;i++) { | |
391 | queuescan(node,thescans[i].type,thescans[i].port,SCLASS_NORMAL,time(NULL)); | |
c86edd1d Q |
392 | } |
393 | } | |
394 | } | |
395 | ||
396 | if (!ircd_strncmp(msg,"addscan ",8)) { | |
397 | unsigned int a,b; | |
398 | if (sscanf(msg+8,"%u %u",&a,&b) != 2) { | |
399 | sendnoticetouser(proxyscannick,sender,"Usage: addscan <type> <port>"); | |
400 | } else { | |
401 | sendnoticetouser(proxyscannick,sender,"Added scan type %u port %u",a,b); | |
402 | proxyscan_addscantype(a,b); | |
403 | scanall(a,b); | |
404 | } | |
405 | } | |
406 | ||
407 | if (!ircd_strncmp(msg,"delscan ",8)) { | |
408 | unsigned int a,b; | |
409 | if (sscanf(msg+8,"%u %u",&a,&b) != 2) { | |
410 | sendnoticetouser(proxyscannick,sender,"Usage: delscan <type> <port>"); | |
411 | } else { | |
412 | sendnoticetouser(proxyscannick,sender,"Delete scan type %u port %u",a,b); | |
413 | proxyscan_delscantype(a,b); | |
414 | } | |
415 | } | |
416 | ||
7d228b1d | 417 | if ((!ircd_strncmp(msg,"help",4)) || (!ircd_strncmp(msg,"showcommands",12))) { |
c86edd1d | 418 | sendnoticetouser(proxyscannick,sender,"Proxyscan commands:"); |
7d228b1d D |
419 | sendnoticetouser(proxyscannick,sender,"----------------------------------------------------------------------"); |
420 | sendnoticetouser(proxyscannick,sender,"help Shows this help"); | |
421 | sendnoticetouser(proxyscannick,sender,"status Prints status information"); | |
422 | sendnoticetouser(proxyscannick,sender,"listopen Shows open proxies found recently"); | |
423 | sendnoticetouser(proxyscannick,sender,"save Saves the clean host database"); | |
424 | sendnoticetouser(proxyscannick,sender,"scan <ip> Force scan of the supplied IP"); | |
425 | sendnoticetouser(proxyscannick,sender,"spew <ip> Find <ip> in our list of open proxies"); | |
426 | sendnoticetouser(proxyscannick,sender,"showkill <id> Shows details of a kill or gline made by the service"); | |
c86edd1d Q |
427 | } |
428 | } | |
429 | ||
430 | default: | |
431 | break; | |
432 | } | |
433 | } | |
434 | ||
435 | void addscantohash(scan *sp) { | |
436 | int hash; | |
437 | hash=(sp->fd)%SCANHASHSIZE; | |
438 | ||
439 | sp->next=scantable[hash]; | |
440 | scantable[hash]=sp; | |
441 | ||
442 | activescans++; | |
443 | } | |
444 | ||
445 | void delscanfromhash(scan *sp) { | |
446 | int hash; | |
447 | scan **sh; | |
448 | ||
449 | hash=(sp->fd)%SCANHASHSIZE; | |
450 | ||
451 | for (sh=&(scantable[hash]);*sh;sh=&((*sh)->next)) { | |
452 | if (*sh==sp) { | |
453 | (*sh)=sp->next; | |
454 | break; | |
455 | } | |
456 | } | |
457 | ||
458 | activescans--; | |
459 | } | |
460 | ||
461 | scan *findscan(int fd) { | |
462 | int hash; | |
463 | scan *sp; | |
464 | ||
465 | hash=fd%SCANHASHSIZE; | |
466 | ||
467 | for (sp=scantable[hash];sp;sp=sp->next) | |
468 | if (sp->fd==fd) | |
469 | return sp; | |
470 | ||
471 | return NULL; | |
472 | } | |
473 | ||
557c8cb2 | 474 | void startscan(patricia_node_t *node, int type, int port, int class) { |
c86edd1d | 475 | scan *sp; |
92f1d9e3 D |
476 | float scantmp; |
477 | ||
478 | if (scansdone>maxscans) | |
479 | { | |
480 | /* ignore the first maxscans as this will skew our scans per second! */ | |
481 | tempscanspermin++; | |
482 | if ((lastscants+60) <= time(NULL)) | |
483 | { | |
484 | /* ok, at least 60 seconds has passed, calculate the scans per minute figure */ | |
485 | scantmp = time(NULL) - lastscants; | |
486 | scantmp = tempscanspermin / scantmp; | |
487 | scantmp = (scantmp * 60); | |
488 | scanspermin = scantmp; | |
489 | lastscants = time(NULL); | |
490 | tempscanspermin = 0; | |
491 | } | |
492 | } | |
c86edd1d Q |
493 | |
494 | sp=getscan(); | |
495 | ||
496 | sp->outcome=SOUTCOME_INPROGRESS; | |
497 | sp->port=port; | |
557c8cb2 | 498 | sp->node=node; |
c86edd1d Q |
499 | sp->type=type; |
500 | sp->class=class; | |
501 | sp->bytesread=0; | |
502 | sp->totalbytesread=0; | |
503 | memset(sp->readbuf, '\0', PSCAN_READBUFSIZE); | |
504 | ||
557c8cb2 | 505 | sp->fd=createconnectsocket(irc_in_addr_v4_to_int(&((patricia_node_t *)sp->node)->prefix->sin),sp->port); |
c86edd1d Q |
506 | sp->state=SSTATE_CONNECTING; |
507 | if (sp->fd<0) { | |
508 | /* Couldn't set up the socket? */ | |
509 | freescan(sp); | |
510 | return; | |
511 | } | |
512 | /* Wait until it is writeable */ | |
513 | registerhandler(sp->fd,POLLERR|POLLHUP|POLLOUT,&handlescansock); | |
514 | /* And set a timeout */ | |
515 | sp->sch=scheduleoneshot(time(NULL)+SCANTIMEOUT,&timeoutscansock,(void *)sp); | |
516 | addscantohash(sp); | |
517 | } | |
518 | ||
519 | void timeoutscansock(void *arg) { | |
520 | scan *sp=(scan *)arg; | |
521 | ||
522 | killsock(sp, SOUTCOME_CLOSED); | |
523 | } | |
524 | ||
525 | void killsock(scan *sp, int outcome) { | |
526 | int i; | |
527 | cachehost *chp; | |
528 | foundproxy *fpp; | |
529 | ||
530 | scansdone++; | |
531 | scansbyclass[sp->class]++; | |
532 | ||
533 | /* Remove the socket from the schedule/event lists */ | |
534 | deregisterhandler(sp->fd,1); /* this will close the fd for us */ | |
535 | deleteschedule(sp->sch,&timeoutscansock,(void *)sp); | |
536 | ||
537 | sp->outcome=outcome; | |
538 | delscanfromhash(sp); | |
539 | ||
540 | /* See if we need to queue another scan.. */ | |
541 | if (sp->outcome==SOUTCOME_CLOSED && | |
542 | ((sp->class==SCLASS_CHECK) || | |
543 | (sp->class==SCLASS_NORMAL && (sp->state==SSTATE_SENTREQUEST || sp->state==SSTATE_GOTRESPONSE)))) | |
557c8cb2 | 544 | queuescan(sp->node, sp->type, sp->port, SCLASS_PASS2, time(NULL)+300); |
c86edd1d Q |
545 | |
546 | if (sp->outcome==SOUTCOME_CLOSED && sp->class==SCLASS_PASS2) | |
557c8cb2 | 547 | queuescan(sp->node, sp->type, sp->port, SCLASS_PASS3, time(NULL)+300); |
c86edd1d Q |
548 | |
549 | if (sp->outcome==SOUTCOME_CLOSED && sp->class==SCLASS_PASS3) | |
557c8cb2 | 550 | queuescan(sp->node, sp->type, sp->port, SCLASS_PASS4, time(NULL)+300); |
c86edd1d Q |
551 | |
552 | if (sp->outcome==SOUTCOME_OPEN) { | |
553 | hitsbyclass[sp->class]++; | |
554 | ||
555 | /* Lets try and get the cache record. If there isn't one, make a new one. */ | |
557c8cb2 P |
556 | if (!(chp=findcachehost(sp->node))) { |
557 | chp=addcleanhost(time(NULL)); | |
558 | patricia_ref_prefix(sp->node->prefix); | |
a8ba1373 | 559 | sp->node->exts[ps_cache_ext] = chp; |
557c8cb2 | 560 | } |
c86edd1d Q |
561 | /* Stick it on the cache's list of proxies, if necessary */ |
562 | for (fpp=chp->proxies;fpp;fpp=fpp->next) | |
563 | if (fpp->type==sp->type && fpp->port==sp->port) | |
564 | break; | |
565 | ||
566 | if (!fpp) { | |
567 | fpp=getfoundproxy(); | |
568 | fpp->type=sp->type; | |
569 | fpp->port=sp->port; | |
570 | fpp->next=chp->proxies; | |
571 | chp->proxies=fpp; | |
572 | } | |
573 | ||
574 | if (!chp->glineid) { | |
575 | glinedhosts++; | |
557c8cb2 | 576 | loggline(chp, sp->node); |
c86edd1d | 577 | irc_send("%s GL * +*@%s 1800 :Open Proxy, see http://www.quakenet.org/openproxies.html - ID: %d", |
557c8cb2 P |
578 | mynumeric->content,IPtostr(((patricia_node_t *)sp->node)->prefix->sin),chp->glineid); |
579 | Error("proxyscan",ERR_DEBUG,"Found open proxy on host %s",IPtostr(((patricia_node_t *)sp->node)->prefix->sin)); | |
c86edd1d | 580 | } else { |
557c8cb2 | 581 | loggline(chp, sp->node); /* Update log only */ |
c86edd1d Q |
582 | } |
583 | ||
584 | /* Update counter */ | |
585 | for(i=0;i<numscans;i++) { | |
586 | if (thescans[i].type==sp->type && thescans[i].port==sp->port) { | |
587 | thescans[i].hits++; | |
588 | break; | |
589 | } | |
590 | } | |
591 | } | |
592 | ||
593 | freescan(sp); | |
594 | ||
595 | /* kick the queue.. */ | |
596 | startqueuedscans(); | |
597 | } | |
598 | ||
599 | void handlescansock(int fd, short events) { | |
600 | scan *sp; | |
601 | char buf[512]; | |
602 | int res; | |
603 | int i; | |
604 | unsigned long netip; | |
605 | unsigned short netport; | |
606 | ||
607 | if ((sp=findscan(fd))==NULL) { | |
608 | /* Not found; return and hope it goes away */ | |
609 | Error("proxyscan",ERR_ERROR,"Unexpected message from fd %d",fd); | |
610 | return; | |
611 | } | |
612 | ||
613 | /* It woke up, delete the alarm call.. */ | |
614 | deleteschedule(sp->sch,&timeoutscansock,(void *)sp); | |
615 | ||
616 | if (events & (POLLERR|POLLHUP)) { | |
617 | /* Some kind of error; give up on this socket */ | |
618 | if (sp->state==SSTATE_GOTRESPONSE) { | |
619 | /* If the error occured while we were waiting for a response, we might have | |
620 | * received the "OPEN PROXY!" message and the EOF at the same time, so continue | |
621 | * processing */ | |
622 | /* Error("proxyscan",ERR_DEBUG,"Got error in GOTRESPONSE state for %s, continuing.",IPtostr(sp->host->IP)); */ | |
623 | } else { | |
624 | killsock(sp, SOUTCOME_CLOSED); | |
625 | return; | |
626 | } | |
627 | } | |
628 | ||
629 | /* Otherwise, we got what we wanted.. */ | |
630 | ||
631 | switch(sp->state) { | |
632 | case SSTATE_CONNECTING: | |
633 | /* OK, we got activity while connecting, so we're going to send some | |
634 | * request depending on scan type. However, we can reregister everything | |
635 | * here to save duplicate code: This code is common for all handlers */ | |
636 | ||
637 | /* Delete the old handler */ | |
638 | deregisterhandler(fd,0); | |
639 | /* Set the new one */ | |
640 | registerhandler(fd,POLLERR|POLLHUP|POLLIN,&handlescansock); | |
641 | sp->sch=scheduleoneshot(time(NULL)+SCANTIMEOUT,&timeoutscansock,(void *)sp); | |
642 | /* Update state */ | |
643 | sp->state=SSTATE_SENTREQUEST; | |
644 | ||
645 | switch(sp->type) { | |
646 | case STYPE_HTTP: | |
647 | sprintf(buf,"CONNECT %s:%d HTTP/1.0\r\n\r\n",myipstr->content,listenport); | |
648 | if ((write(fd,buf,strlen(buf)))<strlen(buf)) { | |
649 | /* We didn't write the full amount, DIE */ | |
650 | killsock(sp,SOUTCOME_CLOSED); | |
651 | return; | |
652 | } | |
653 | break; | |
654 | ||
655 | case STYPE_SOCKS4: | |
656 | /* set up the buffer */ | |
657 | netip=htonl(myip); | |
658 | netport=htons(listenport); | |
659 | memcpy(&buf[4],&netip,4); | |
660 | memcpy(&buf[2],&netport,2); | |
661 | buf[0]=4; | |
662 | buf[1]=1; | |
663 | buf[8]=0; | |
664 | if ((write(fd,buf,9))<9) { | |
665 | /* Didn't write enough, give up */ | |
666 | killsock(sp,SOUTCOME_CLOSED); | |
667 | return; | |
668 | } | |
669 | break; | |
670 | ||
671 | case STYPE_SOCKS5: | |
672 | /* Set up initial request buffer */ | |
673 | buf[0]=5; | |
674 | buf[1]=1; | |
675 | buf[2]=0; | |
676 | if ((write(fd,buf,3))>3) { | |
677 | /* Didn't write enough, give up */ | |
678 | killsock(sp,SOUTCOME_CLOSED); | |
679 | return; | |
680 | } | |
681 | ||
682 | /* Now the actual connect request */ | |
683 | buf[0]=5; | |
684 | buf[1]=1; | |
685 | buf[2]=0; | |
686 | buf[3]=1; | |
687 | netip=htonl(myip); | |
688 | netport=htons(listenport); | |
689 | memcpy(&buf[4],&netip,4); | |
690 | memcpy(&buf[8],&netport,2); | |
691 | res=write(fd,buf,10); | |
692 | if (res<10) { | |
693 | killsock(sp,SOUTCOME_CLOSED); | |
694 | return; | |
695 | } | |
696 | break; | |
697 | ||
698 | case STYPE_WINGATE: | |
699 | /* Send wingate request */ | |
700 | sprintf(buf,"%s:%d\r\n",myipstr->content,listenport); | |
701 | if((write(fd,buf,strlen(buf)))<strlen(buf)) { | |
702 | killsock(sp,SOUTCOME_CLOSED); | |
703 | return; | |
704 | } | |
705 | break; | |
706 | ||
707 | case STYPE_CISCO: | |
708 | /* Send cisco request */ | |
709 | sprintf(buf,"cisco\r\n"); | |
710 | if ((write(fd,buf,strlen(buf)))<strlen(buf)) { | |
711 | killsock(sp, SOUTCOME_CLOSED); | |
712 | return; | |
713 | } | |
714 | ||
715 | sprintf(buf,"telnet %s %d\r\n",myipstr->content,listenport); | |
716 | if ((write(fd,buf,strlen(buf)))<strlen(buf)) { | |
717 | killsock(sp, SOUTCOME_CLOSED); | |
718 | return; | |
719 | } | |
720 | ||
905c2ba2 | 721 | break; |
722 | ||
723 | case STYPE_DIRECT: | |
724 | /* Do nothing */ | |
c86edd1d Q |
725 | break; |
726 | } | |
727 | break; | |
728 | ||
729 | case SSTATE_SENTREQUEST: | |
730 | res=read(fd, sp->readbuf+sp->bytesread, PSCAN_READBUFSIZE-sp->bytesread); | |
731 | ||
732 | if (res<=0) { | |
733 | if ((errno!=EINTR && errno!=EWOULDBLOCK) || res==0) { | |
734 | /* EOF, forget it */ | |
735 | killsock(sp, SOUTCOME_CLOSED); | |
736 | return; | |
737 | } | |
738 | } | |
739 | ||
740 | sp->bytesread+=res; | |
741 | sp->totalbytesread+=res; | |
742 | for (i=0;i<sp->bytesread - MAGICSTRINGLENGTH;i++) { | |
743 | if (!strncmp(sp->readbuf+i, MAGICSTRING, MAGICSTRINGLENGTH)) { | |
744 | /* Found the magic string */ | |
745 | /* If the offset is 0, this means it was the first thing we got from the socket, | |
746 | * so it's an actual IRCD (sheesh). Note that when the buffer is full and moved, | |
747 | * the thing moved to offset 0 would previously have been tested as offset | |
905c2ba2 | 748 | * PSCAN_READBUFSIZE/2. |
749 | * | |
750 | * Skip this checking for STYPE_DIRECT scans, which are used to detect trojans setting | |
751 | * up portforwards (which will therefore show up as ircds, we rely on the port being | |
752 | * strange enough to avoid false positives */ | |
753 | if (i==0 && (sp->type != STYPE_DIRECT)) { | |
c86edd1d Q |
754 | killsock(sp, SOUTCOME_CLOSED); |
755 | return; | |
756 | } | |
757 | ||
758 | killsock(sp, SOUTCOME_OPEN); | |
759 | return; | |
760 | } | |
761 | } | |
762 | ||
763 | /* If the buffer is full, move half of it along to make room */ | |
764 | if (sp->bytesread == PSCAN_READBUFSIZE) { | |
765 | memcpy(sp->readbuf, sp->readbuf + (PSCAN_READBUFSIZE)/2, PSCAN_READBUFSIZE/2); | |
766 | sp->bytesread = PSCAN_READBUFSIZE/2; | |
767 | } | |
768 | ||
769 | /* Don't read data forever.. */ | |
770 | if (sp->totalbytesread > READ_SANITY_LIMIT) { | |
771 | killsock(sp, SOUTCOME_CLOSED); | |
772 | return; | |
773 | } | |
774 | ||
775 | /* No magic string yet, we schedule another timeout in case it comes later. */ | |
776 | sp->sch=scheduleoneshot(time(NULL)+SCANTIMEOUT,&timeoutscansock,(void *)sp); | |
777 | return; | |
778 | } | |
779 | } | |
780 | ||
781 | void killallscans() { | |
782 | int i; | |
783 | scan *sp; | |
784 | cachehost *chp; | |
785 | ||
786 | for(i=0;i<SCANHASHSIZE;i++) { | |
787 | for(sp=scantable[i];sp;sp=sp->next) { | |
788 | /* If there is a pending scan, delete it's clean host record.. */ | |
a8ba1373 P |
789 | if ((chp=findcachehost(sp->node)) && !chp->proxies) { |
790 | sp->node->exts[ps_cache_ext] = NULL; | |
791 | derefnode(iptree,sp->node); | |
c86edd1d | 792 | delcachehost(chp); |
a8ba1373 | 793 | } |
c86edd1d Q |
794 | |
795 | if (sp->fd!=-1) { | |
796 | deregisterhandler(sp->fd,1); | |
797 | deleteschedule(sp->sch,&timeoutscansock,(void *)(sp)); | |
798 | } | |
799 | } | |
800 | } | |
801 | } | |
802 | ||
803 | void proxyscanstats(int hooknum, void *arg) { | |
804 | char buf[512]; | |
805 | ||
806 | sprintf(buf, "Proxyscn: %6d/%4d scans complete/in progress. %d hosts queued.", | |
807 | scansdone,activescans,queuedhosts); | |
808 | triggerhook(HOOK_CORE_STATSREPLY,buf); | |
809 | sprintf(buf, "Proxyscn: %6u known clean hosts",cleancount()); | |
810 | triggerhook(HOOK_CORE_STATSREPLY,buf); | |
811 | } | |
812 | ||
813 | void sendlagwarning() { | |
814 | int i,j; | |
815 | nick *np; | |
816 | ||
817 | for (i=0;i<MAXSERVERS;i++) { | |
818 | if (serverlist[i].maxusernum>0) { | |
819 | for(j=0;j<serverlist[i].maxusernum;j++) { | |
820 | np=servernicks[i][j]; | |
821 | if (np!=NULL && IsOper(np)) { | |
822 | sendnoticetouser(proxyscannick,np,"Warning: More than 20,000 hosts to scan - I'm lagging behind badly!"); | |
823 | } | |
824 | } | |
825 | } | |
826 | } | |
827 | } | |
828 | ||
905c2ba2 | 829 | int pscansort(const void *a, const void *b) { |
830 | int ra = *((const int *)a); | |
831 | int rb = *((const int *)b); | |
832 | ||
833 | return thescans[ra].hits - thescans[rb].hits; | |
834 | } | |
835 | ||
c86edd1d Q |
836 | void proxyscandostatus(nick *np) { |
837 | int i; | |
838 | int totaldetects=0; | |
905c2ba2 | 839 | int ord[PSCAN_MAXSCANS]; |
c86edd1d | 840 | |
2220c058 | 841 | sendnoticetouser(proxyscannick,np,"Service uptime: %s",longtoduration(time(NULL)-ps_starttime, 1)); |
c86edd1d Q |
842 | sendnoticetouser(proxyscannick,np,"Total scans completed: %d",scansdone); |
843 | sendnoticetouser(proxyscannick,np,"Total hosts glined: %d",glinedhosts); | |
844 | ||
a05832ea | 845 | sendnoticetouser(proxyscannick,np,"pendingscan structures: %lu x %u bytes = %lu bytes total",countpendingscan, |
92f1d9e3 D |
846 | sizeof(pendingscan), (countpendingscan * sizeof(pendingscan))); |
847 | ||
c86edd1d | 848 | sendnoticetouser(proxyscannick,np,"Currently active scans: %d/%d",activescans,maxscans); |
92f1d9e3 | 849 | sendnoticetouser(proxyscannick,np,"Processing speed: %lu scans per minute",scanspermin); |
c86edd1d Q |
850 | sendnoticetouser(proxyscannick,np,"Normal queued scans: %d",normalqueuedscans); |
851 | sendnoticetouser(proxyscannick,np,"Timed queued scans: %d",prioqueuedscans); | |
852 | sendnoticetouser(proxyscannick,np,"'Clean' cached hosts: %d",cleancount()); | |
853 | sendnoticetouser(proxyscannick,np,"'Dirty' cached hosts: %d",dirtycount()); | |
557c8cb2 P |
854 | |
855 | sendnoticetouser(proxyscannick,np,"Extra scans: %d", extrascancount()); | |
c86edd1d Q |
856 | for (i=0;i<5;i++) |
857 | sendnoticetouser(proxyscannick,np,"Open proxies, class %1d: %d/%d (%.2f%%)",i,hitsbyclass[i],scansbyclass[i],((float)hitsbyclass[i]*100)/scansbyclass[i]); | |
858 | ||
859 | for (i=0;i<numscans;i++) | |
860 | totaldetects+=thescans[i].hits; | |
861 | ||
905c2ba2 | 862 | for (i=0;i<numscans;i++) |
863 | ord[i]=i; | |
864 | ||
865 | qsort(ord,numscans,sizeof(int),pscansort); | |
866 | ||
c86edd1d Q |
867 | sendnoticetouser(proxyscannick,np,"Scan type Port Detections"); |
868 | for (i=0;i<numscans;i++) | |
869 | sendnoticetouser(proxyscannick,np,"%-9s %-5d %d (%.2f%%)", | |
905c2ba2 | 870 | scantostr(thescans[ord[i]].type), thescans[ord[i]].port, thescans[ord[i]].hits, ((float)thescans[ord[i]].hits*100)/totaldetects); |
c86edd1d Q |
871 | |
872 | sendnoticetouser(proxyscannick,np,"End of list."); | |
873 | } | |
874 | ||
875 | void proxyscandebug(nick *np) { | |
876 | /* Dump all scans.. */ | |
877 | int i; | |
878 | int activescansfound=0; | |
879 | int totalscansfound=0; | |
880 | scan *sp; | |
557c8cb2 P |
881 | patricia_node_t *node; |
882 | cachehost *chp; | |
c86edd1d Q |
883 | |
884 | sendnoticetouser(proxyscannick,np,"Active scans : %d",activescans); | |
885 | ||
886 | for (i=0;i<SCANHASHSIZE;i++) { | |
887 | for (sp=scantable[i];sp;sp=sp->next) { | |
888 | if (sp->outcome==SOUTCOME_INPROGRESS) { | |
889 | activescansfound++; | |
890 | } | |
891 | totalscansfound++; | |
892 | sendnoticetouser(proxyscannick,np,"fd: %d type: %d port: %d state: %d outcome: %d IP: %s", | |
557c8cb2 | 893 | sp->fd,sp->type,sp->port,sp->state,sp->outcome,IPtostr(((patricia_node_t *)sp->node)->prefix->sin)); |
c86edd1d Q |
894 | } |
895 | } | |
896 | ||
557c8cb2 | 897 | PATRICIA_WALK (iptree->head, node) { |
a8ba1373 P |
898 | if ( node->exts[ps_cache_ext] ) { |
899 | chp = (cachehost *) node->exts[ps_cache_ext]; | |
557c8cb2 | 900 | if (chp) |
16739dbe | 901 | sendnoticetouser(proxyscannick,np,"node: %s , chp: %p", IPtostr(((patricia_node_t *)node)->prefix->sin), chp); |
557c8cb2 P |
902 | } |
903 | } PATRICIA_WALK_END; | |
904 | ||
c86edd1d Q |
905 | sendnoticetouser(proxyscannick,np,"Total %d scans actually found (%d active)",totalscansfound,activescansfound); |
906 | } |