src/s_auth.c

   1 /*
   2  *  ircd-ratbox: A slightly useful ircd.
   3  *  s_auth.c: Functions for querying a users ident.
   4  *
   5  *  Copyright (C) 1990 Jarkko Oikarinen and University of Oulu, Co Center
   6  *  Copyright (C) 1996-2002 Hybrid Development Team
   7  *  Copyright (C) 2002-2005 ircd-ratbox development team
   8  *
   9  *  This program is free software; you can redistribute it and/or modify
  10  *  it under the terms of the GNU General Public License as published by
  11  *  the Free Software Foundation; either version 2 of the License, or
  12  *  (at your option) any later version.
  13  *
  14  *  This program is distributed in the hope that it will be useful,
  15  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  *  GNU General Public License for more details.
  18  *
  19  *  You should have received a copy of the GNU General Public License
  20  *  along with this program; if not, write to the Free Software
  21  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307
  22  *  USA
  23  *
  24  *  $Id: s_auth.c 3354 2007-04-03 09:21:31Z nenolod $ */
  25
  26 /*
  27  * Changes:
  28  *   July 6, 1999 - Rewrote most of the code here. When a client connects
  29  *     to the server and passes initial socket validation checks, it
  30  *     is owned by this module (auth) which returns it to the rest of the
  31  *     server when dns and auth queries are finished. Until the client is
  32  *     released, the server does not know it exists and does not process
  33  *     any messages from it.
  34  *     --Bleep  Thomas Helvey <tomh@inxpress.net>
  35  */
  36 #include "stdinc.h"
  37 #include "config.h"
  38 #include "s_auth.h"
  39 #include "s_conf.h"
  40 #include "client.h"
  41 #include "common.h"
  42 #include "match.h"
  43 #include "ircd.h"
  44 #include "numeric.h"
  45 #include "packet.h"
  46 #include "res.h"
  47 #include "logger.h"
  48 #include "s_stats.h"
  49 #include "send.h"
  50 #include "hook.h"
  51 #include "blacklist.h"
  52
  53 struct AuthRequest
  54 {
  55         rb_dlink_node node;
  56         struct Client *client;  /* pointer to client struct for request */
  57         struct DNSQuery dns_query; /* DNS Query */
  58         unsigned int flags;     /* current state of request */
  59         rb_fde_t *F;            /* file descriptor for auth queries */
  60         time_t timeout;         /* time when query expires */
  61         uint16_t lport;
  62         uint16_t rport;
  63 };
  64
  65 /*
  66  * flag values for AuthRequest
  67  * NAMESPACE: AM_xxx - Authentication Module
  68  */
  69 #define AM_AUTH_CONNECTING   (1 << 0)
  70 #define AM_AUTH_PENDING      (1 << 1)
  71 #define AM_DNS_PENDING       (1 << 2)
  72
  73 #define SetDNSPending(x)     ((x)->flags |= AM_DNS_PENDING)
  74 #define ClearDNSPending(x)   ((x)->flags &= ~AM_DNS_PENDING)
  75 #define IsDNSPending(x)      ((x)->flags &  AM_DNS_PENDING)
  76
  77 #define SetAuthConnect(x)    ((x)->flags |= AM_AUTH_CONNECTING)
  78 #define ClearAuthConnect(x)  ((x)->flags &= ~AM_AUTH_CONNECTING)
  79 #define IsAuthConnect(x)     ((x)->flags &  AM_AUTH_CONNECTING)
  80
  81 #define SetAuthPending(x)    ((x)->flags |= AM_AUTH_PENDING)
  82 #define ClearAuthPending(x)  ((x)->flags &= AM_AUTH_PENDING)
  83 #define IsAuthPending(x)     ((x)->flags &  AM_AUTH_PENDING)
  84
  85 #define ClearAuth(x)         ((x)->flags &= ~(AM_AUTH_PENDING | AM_AUTH_CONNECTING))
  86 #define IsDoingAuth(x)       ((x)->flags &  (AM_AUTH_PENDING | AM_AUTH_CONNECTING))
  87
  88 /*
  89  * a bit different approach
  90  * this replaces the original sendheader macros
  91  */
  92
  93 static const char *HeaderMessages[] =
  94 {
  95         ":*** Looking up your hostname...",
  96         ":*** Found your hostname",
  97         ":*** Couldn't look up your hostname",
  98         ":*** Checking Ident",
  99         ":*** Got Ident response",
 100         ":*** No Ident response",
 101         ":*** Your hostname is too long, ignoring hostname",
 102         ":*** Your forward and reverse DNS do not match, ignoring hostname",
 103         ":*** Cannot verify hostname validity, ignoring hostname",
 104 };
 105
 106 typedef enum
 107 {
 108         REPORT_DO_DNS,
 109         REPORT_FIN_DNS,
 110         REPORT_FAIL_DNS,
 111         REPORT_DO_ID,
 112         REPORT_FIN_ID,
 113         REPORT_FAIL_ID,
 114         REPORT_HOST_TOOLONG,
 115         REPORT_HOST_MISMATCH,
 116         REPORT_HOST_UNKNOWN
 117 }
 118 ReportType;
 119
 120 #define sendheader(c, r) sendto_one_notice(c, HeaderMessages[(r)])
 121
 122 static rb_dlink_list auth_poll_list;
 123 static rb_bh *auth_heap;
 124 static EVH timeout_auth_queries_event;
 125
 126 static PF read_auth_reply;
 127 static CNCB auth_connect_callback;
 128
 129 /*
 130  * init_auth()
 131  *
 132  * Initialise the auth code
 133  */
 134 void
 135 init_auth(void)
 136 {
 137         /* This hook takes a struct Client for its argument */
 138         memset(&auth_poll_list, 0, sizeof(auth_poll_list));
 139         rb_event_addish("timeout_auth_queries_event", timeout_auth_queries_event, NULL, 1);
 140         auth_heap = rb_bh_create(sizeof(struct AuthRequest), LCLIENT_HEAP_SIZE, "auth_heap");
 141 }
 142
 143 /*
 144  * make_auth_request - allocate a new auth request
 145  */
 146 static struct AuthRequest *
 147 make_auth_request(struct Client *client)
 148 {
 149         struct AuthRequest *request = rb_bh_alloc(auth_heap);
 150         client->localClient->auth_request = request;
 151         request->F = NULL;
 152         request->client = client;
 153         request->timeout = rb_current_time() + ConfigFileEntry.connect_timeout;
 154         return request;
 155 }
 156
 157 /*
 158  * free_auth_request - cleanup auth request allocations
 159  */
 160 static void
 161 free_auth_request(struct AuthRequest *request)
 162 {
 163         rb_bh_free(auth_heap, request);
 164 }
 165
 166 /*
 167  * release_auth_client - release auth client from auth system
 168  * this adds the client into the local client lists so it can be read by
 169  * the main io processing loop
 170  */
 171 static void
 172 release_auth_client(struct AuthRequest *auth)
 173 {
 174         struct Client *client = auth->client;
 175
 176         if(IsDNSPending(auth) || IsDoingAuth(auth))
 177                 return;
 178
 179         client->localClient->auth_request = NULL;
 180         rb_dlinkDelete(&auth->node, &auth_poll_list);
 181         free_auth_request(auth);
 182
 183         /*
 184          * When a client has auth'ed, we want to start reading what it sends
 185          * us. This is what read_packet() does.
 186          *     -- adrian
 187          */
 188         client->localClient->allow_read = MAX_FLOOD;
 189         rb_dlinkAddTail(client, &client->node, &global_client_list);
 190         read_packet(client->localClient->F, client);
 191 }
 192
 193 /*
 194  * auth_dns_callback - called when resolver query finishes
 195  * if the query resulted in a successful search, hp will contain
 196  * a non-null pointer, otherwise hp will be null.
 197  * set the client on it's way to a connection completion, regardless
 198  * of success of failure
 199  */
 200 static void
 201 auth_dns_callback(void *vptr, struct DNSReply *reply)
 202 {
 203         struct AuthRequest *auth = (struct AuthRequest *) vptr;
 204         ClearDNSPending(auth);
 205
 206         /* XXX: this shouldn't happen, but it does. -nenolod */
 207         if(auth->client->localClient == NULL)
 208         {
 209                 sendto_realops_snomask(SNO_GENERAL, L_ALL,
 210                         "auth_dns_callback(): auth->client->localClient (%s) is NULL", get_client_name(auth->client, HIDE_IP));
 211
 212                 rb_dlinkDelete(&auth->node, &auth_poll_list);
 213                 free_auth_request(auth);
 214
 215                 /* and they will silently drop through and all will hopefully be ok... -nenolod */
 216                 return;
 217         }
 218
 219         if(reply)
 220         {
 221                 int good = 1;
 222
 223                 if(auth->client->localClient->ip.ss_family == AF_INET)
 224                 {
 225                         struct sockaddr_in *ip, *ip_fwd;
 226
 227                         ip = (struct sockaddr_in *) &auth->client->localClient->ip;
 228                         ip_fwd = (struct sockaddr_in *) &reply->addr;
 229
 230                         if(ip->sin_addr.s_addr != ip_fwd->sin_addr.s_addr)
 231                         {
 232                                 sendheader(auth->client, REPORT_HOST_MISMATCH);
 233                                 good = 0;
 234                         }
 235                 }
 236 #ifdef RB_IPV6
 237                 else if(auth->client->localClient->ip.ss_family == AF_INET6)
 238                 {
 239                         struct sockaddr_in6 *ip, *ip_fwd;
 240
 241                         ip = (struct sockaddr_in6 *) &auth->client->localClient->ip;
 242                         ip_fwd = (struct sockaddr_in6 *) &reply->addr;
 243
 244                         if(memcmp(&ip->sin6_addr, &ip_fwd->sin6_addr, sizeof(struct in6_addr)) != 0)
 245                         {
 246                                 sendheader(auth->client, REPORT_HOST_MISMATCH);
 247                                 good = 0;
 248                         }
 249                 }
 250 #endif
 251                 else    /* can't verify it, don't know how. reject it. */
 252                 {
 253                         sendheader(auth->client, REPORT_HOST_UNKNOWN);
 254                         good = 0;
 255                 }
 256
 257                 if(good && strlen(reply->h_name) <= HOSTLEN)
 258                 {
 259                         rb_strlcpy(auth->client->host, reply->h_name, sizeof(auth->client->host));
 260                         sendheader(auth->client, REPORT_FIN_DNS);
 261                 }
 262                 else if (strlen(reply->h_name) > HOSTLEN)
 263                         sendheader(auth->client, REPORT_HOST_TOOLONG);
 264         }
 265         else
 266                 sendheader(auth->client, REPORT_FAIL_DNS);
 267
 268         release_auth_client(auth);
 269 }
 270
 271 /*
 272  * authsenderr - handle auth send errors
 273  */
 274 static void
 275 auth_error(struct AuthRequest *auth)
 276 {
 277         ++ServerStats.is_abad;
 278
 279         rb_close(auth->F);
 280         auth->F = NULL;
 281
 282         ClearAuth(auth);
 283         sendheader(auth->client, REPORT_FAIL_ID);
 284
 285         release_auth_client(auth);
 286 }
 287
 288 /*
 289  * start_auth_query - Flag the client to show that an attempt to
 290  * contact the ident server on
 291  * the client's host.  The connect and subsequently the socket are all put
 292  * into 'non-blocking' mode.  Should the connect or any later phase of the
 293  * identifing process fail, it is aborted and the user is given a username
 294  * of "unknown".
 295  */
 296 static int
 297 start_auth_query(struct AuthRequest *auth)
 298 {
 299         struct rb_sockaddr_storage localaddr, destaddr;
 300         socklen_t locallen = sizeof(struct rb_sockaddr_storage);
 301         rb_fde_t *F;
 302         int family;
 303
 304         if(IsAnyDead(auth->client))
 305                 return 0;
 306
 307         family = auth->client->localClient->ip.ss_family;
 308         if((F = rb_socket(family, SOCK_STREAM, 0, "ident")) == NULL)
 309         {
 310                 ilog_error("creating auth stream socket");
 311                 ++ServerStats.is_abad;
 312                 return 0;
 313         }
 314
 315         /*
 316          * TBD: this is a pointless arbitrary limit .. we either have a socket or not. -nenolod
 317          */
 318         if((maxconnections - 10) < rb_get_fd(F))
 319         {
 320                 sendto_realops_snomask(SNO_GENERAL, L_ALL,
 321                                      "Can't allocate fd for auth on %s",
 322                                      get_client_name(auth->client, SHOW_IP));
 323                 rb_close(F);
 324                 return 0;
 325         }
 326
 327         sendheader(auth->client, REPORT_DO_ID);
 328
 329         /*
 330          * get the local address of the client and bind to that to
 331          * make the auth request.  This used to be done only for
 332          * ifdef VIRTUAL_HOST, but needs to be done for all clients
 333          * since the ident request must originate from that same address--
 334          * and machines with multiple IP addresses are common now
 335          */
 336         memset(&localaddr, 0, locallen);
 337         if(getsockname(rb_get_fd(auth->client->localClient->F),
 338                     (struct sockaddr *) &localaddr, &locallen) == -1)
 339         {
 340                 /* can happen if connection was just closed */
 341                 rb_close(F);
 342                 return 0;
 343         }
 344
 345         /* XXX mangle_mapped_sockaddr((struct sockaddr *)&localaddr); */
 346 #ifdef RB_IPV6
 347         if(localaddr.ss_family == AF_INET6)
 348         {
 349                 auth->lport = ntohs(((struct sockaddr_in6 *)&localaddr)->sin6_port);
 350                 ((struct sockaddr_in6 *)&localaddr)->sin6_port = 0;
 351         }
 352         else
 353 #endif
 354         {
 355                 auth->lport = ntohs(((struct sockaddr_in *)&localaddr)->sin_port);
 356                 ((struct sockaddr_in *)&localaddr)->sin_port = 0;
 357         }
 358
 359         destaddr = auth->client->localClient->ip;
 360 #ifdef RB_IPV6
 361         if(localaddr.ss_family == AF_INET6)
 362         {
 363                 auth->rport = ntohs(((struct sockaddr_in6 *)&destaddr)->sin6_port);
 364                 ((struct sockaddr_in6 *)&destaddr)->sin6_port = htons(113);
 365         }
 366         else
 367 #endif
 368         {
 369                 auth->rport = ntohs(((struct sockaddr_in *)&destaddr)->sin_port);
 370                 ((struct sockaddr_in *)&destaddr)->sin_port = htons(113);
 371         }
 372
 373         auth->F = F;
 374         SetAuthConnect(auth);
 375
 376         rb_connect_tcp(F, (struct sockaddr *)&destaddr,
 377                          (struct sockaddr *) &localaddr, GET_SS_LEN(&localaddr),
 378                          auth_connect_callback, auth,
 379                          GlobalSetOptions.ident_timeout);
 380         return 1;               /* We suceed here for now */
 381 }
 382
 383 /*
 384  * GetValidIdent - parse ident query reply from identd server
 385  *
 386  * Inputs        - pointer to ident buf
 387  * Output        - NULL if no valid ident found, otherwise pointer to name
 388  * Side effects  -
 389  */
 390 static char *
 391 GetValidIdent(char *buf)
 392 {
 393         int remp = 0;
 394         int locp = 0;
 395         char *colon1Ptr;
 396         char *colon2Ptr;
 397         char *colon3Ptr;
 398         char *commaPtr;
 399         char *remotePortString;
 400
 401         /* All this to get rid of a sscanf() fun. */
 402         remotePortString = buf;
 403
 404         colon1Ptr = strchr(remotePortString, ':');
 405         if(!colon1Ptr)
 406                 return 0;
 407
 408         *colon1Ptr = '\0';
 409         colon1Ptr++;
 410         colon2Ptr = strchr(colon1Ptr, ':');
 411         if(!colon2Ptr)
 412                 return 0;
 413
 414         *colon2Ptr = '\0';
 415         colon2Ptr++;
 416         commaPtr = strchr(remotePortString, ',');
 417
 418         if(!commaPtr)
 419                 return 0;
 420
 421         *commaPtr = '\0';
 422         commaPtr++;
 423
 424         remp = atoi(remotePortString);
 425         if(!remp)
 426                 return 0;
 427
 428         locp = atoi(commaPtr);
 429         if(!locp)
 430                 return 0;
 431
 432         /* look for USERID bordered by first pair of colons */
 433         if(!strstr(colon1Ptr, "USERID"))
 434                 return 0;
 435
 436         colon3Ptr = strchr(colon2Ptr, ':');
 437         if(!colon3Ptr)
 438                 return 0;
 439
 440         *colon3Ptr = '\0';
 441         colon3Ptr++;
 442         return (colon3Ptr);
 443 }
 444
 445 /*
 446  * start_auth - starts auth (identd) and dns queries for a client
 447  */
 448 void
 449 start_auth(struct Client *client)
 450 {
 451         struct AuthRequest *auth = 0;
 452         s_assert(0 != client);
 453         if(client == NULL)
 454                 return;
 455
 456         auth = make_auth_request(client);
 457
 458         auth->dns_query.ptr = auth;
 459         auth->dns_query.callback = auth_dns_callback;
 460
 461         sendheader(client, REPORT_DO_DNS);
 462
 463         /* No DNS cache now, remember? -- adrian */
 464         gethost_byaddr(&client->localClient->ip, &auth->dns_query);
 465
 466         SetDNSPending(auth);
 467
 468         if(ConfigFileEntry.disable_auth == 0)
 469                 start_auth_query(auth);
 470
 471         rb_dlinkAdd(auth, &auth->node, &auth_poll_list);
 472 }
 473
 474 /*
 475  * timeout_auth_queries - timeout resolver and identd requests
 476  * allow clients through if requests failed
 477  */
 478 static void
 479 timeout_auth_queries_event(void *notused)
 480 {
 481         rb_dlink_node *ptr;
 482         rb_dlink_node *next_ptr;
 483         struct AuthRequest *auth;
 484
 485         RB_DLINK_FOREACH_SAFE(ptr, next_ptr, auth_poll_list.head)
 486         {
 487                 auth = ptr->data;
 488
 489                 if(auth->timeout < rb_current_time())
 490                 {
 491                         if(auth->F != NULL)
 492                                 rb_close(auth->F);
 493
 494                         if(IsDoingAuth(auth))
 495                         {
 496                                 ClearAuth(auth);
 497                                 ++ServerStats.is_abad;
 498                                 sendheader(auth->client, REPORT_FAIL_ID);
 499                                 auth->client->localClient->auth_request = NULL;
 500                         }
 501                         if(IsDNSPending(auth))
 502                         {
 503                                 ClearDNSPending(auth);
 504                                 delete_resolver_queries(&auth->dns_query);
 505                                 sendheader(auth->client, REPORT_FAIL_DNS);
 506                         }
 507
 508                         auth->client->localClient->lasttime = rb_current_time();
 509                         release_auth_client(auth);
 510                 }
 511         }
 512 }
 513
 514 /*
 515  * auth_connect_callback() - deal with the result of rb_connect_tcp()
 516  *
 517  * If the connection failed, we simply close the auth fd and report
 518  * a failure. If the connection suceeded send the ident server a query
 519  * giving "theirport , ourport". The write is only attempted *once* so
 520  * it is deemed to be a fail if the entire write doesn't write all the
 521  * data given.  This shouldnt be a problem since the socket should have
 522  * a write buffer far greater than this message to store it in should
 523  * problems arise. -avalon
 524  */
 525 static void
 526 auth_connect_callback(rb_fde_t *F, int error, void *data)
 527 {
 528         struct AuthRequest *auth = data;
 529         char authbuf[32];
 530
 531         /* Check the error */
 532         if(error != RB_OK)
 533         {
 534                 /* We had an error during connection :( */
 535                 auth_error(auth);
 536                 return;
 537         }
 538
 539         rb_snprintf(authbuf, sizeof(authbuf), "%u , %u\r\n",
 540                    auth->rport, auth->lport);
 541
 542         if(rb_write(auth->F, authbuf, strlen(authbuf)) != strlen(authbuf))
 543         {
 544                 auth_error(auth);
 545                 return;
 546         }
 547         ClearAuthConnect(auth);
 548         SetAuthPending(auth);
 549         read_auth_reply(auth->F, auth);
 550 }
 551
 552
 553 /*
 554  * read_auth_reply - read the reply (if any) from the ident server
 555  * we connected to.
 556  * We only give it one shot, if the reply isn't good the first time
 557  * fail the authentication entirely. --Bleep
 558  */
 559 #define AUTH_BUFSIZ 128
 560
 561 static void
 562 read_auth_reply(rb_fde_t *F, void *data)
 563 {
 564         struct AuthRequest *auth = data;
 565         char *s = NULL;
 566         char *t = NULL;
 567         int len;
 568         int count;
 569         char buf[AUTH_BUFSIZ + 1];      /* buffer to read auth reply into */
 570
 571         len = rb_read(F, buf, AUTH_BUFSIZ);
 572
 573         if(len < 0 && rb_ignore_errno(errno))
 574         {
 575                 rb_setselect(F, RB_SELECT_READ, read_auth_reply, auth);
 576                 return;
 577         }
 578
 579         if(len > 0)
 580         {
 581                 buf[len] = '\0';
 582
 583                 if((s = GetValidIdent(buf)))
 584                 {
 585                         t = auth->client->username;
 586
 587                         while (*s == '~' || *s == '^')
 588                                 s++;
 589
 590                         for (count = USERLEN; *s && count; s++)
 591                         {
 592                                 if(*s == '@')
 593                                 {
 594                                         break;
 595                                 }
 596                                 if(!IsSpace(*s) && *s != ':' && *s != '[')
 597                                 {
 598                                         *t++ = *s;
 599                                         count--;
 600                                 }
 601                         }
 602                         *t = '\0';
 603                 }
 604         }
 605
 606         rb_close(auth->F);
 607         auth->F = NULL;
 608         ClearAuth(auth);
 609
 610         if(s == NULL)
 611         {
 612                 ++ServerStats.is_abad;
 613                 strcpy(auth->client->username, "unknown");
 614                 sendheader(auth->client, REPORT_FAIL_ID);
 615         }
 616         else
 617         {
 618                 sendheader(auth->client, REPORT_FIN_ID);
 619                 ++ServerStats.is_asuc;
 620                 SetGotId(auth->client);
 621         }
 622
 623         release_auth_client(auth);
 624 }
 625
 626
 627
 628 /*
 629  * delete_auth_queries()
 630  *
 631  */
 632 void
 633 delete_auth_queries(struct Client *target_p)
 634 {
 635         struct AuthRequest *auth;
 636
 637         if(target_p == NULL || target_p->localClient == NULL ||
 638            target_p->localClient->auth_request == NULL)
 639                 return;
 640
 641         auth = target_p->localClient->auth_request;
 642         target_p->localClient->auth_request = NULL;
 643
 644         if(IsDNSPending(auth))
 645                 delete_resolver_queries(&auth->dns_query);
 646
 647         if(auth->F != NULL)
 648                 rb_close(auth->F);
 649
 650         rb_dlinkDelete(&auth->node, &auth_poll_list);
 651         free_auth_request(auth);
 652 }