src/s_auth.c

   1 /*
   2  *  ircd-ratbox: A slightly useful ircd.
   3  *  s_auth.c: Functions for querying a users ident.
   4  *
   5  *  Copyright (C) 1990 Jarkko Oikarinen and University of Oulu, Co Center
   6  *  Copyright (C) 1996-2002 Hybrid Development Team
   7  *  Copyright (C) 2002-2005 ircd-ratbox development team
   8  *
   9  *  This program is free software; you can redistribute it and/or modify
  10  *  it under the terms of the GNU General Public License as published by
  11  *  the Free Software Foundation; either version 2 of the License, or
  12  *  (at your option) any later version.
  13  *
  14  *  This program is distributed in the hope that it will be useful,
  15  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  *  GNU General Public License for more details.
  18  *
  19  *  You should have received a copy of the GNU General Public License
  20  *  along with this program; if not, write to the Free Software
  21  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307
  22  *  USA
  23  *
  24  *  $Id: s_auth.c 3354 2007-04-03 09:21:31Z nenolod $ */
  25
  26 /*
  27  * Changes:
  28  *   July 6, 1999 - Rewrote most of the code here. When a client connects
  29  *     to the server and passes initial socket validation checks, it
  30  *     is owned by this module (auth) which returns it to the rest of the
  31  *     server when dns and auth queries are finished. Until the client is
  32  *     released, the server does not know it exists and does not process
  33  *     any messages from it.
  34  *     --Bleep  Thomas Helvey <tomh@inxpress.net>
  35  */
  36 #include "stdinc.h"
  37 #include "config.h"
  38 #include "s_auth.h"
  39 #include "s_conf.h"
  40 #include "client.h"
  41 #include "common.h"
  42 #include "match.h"
  43 #include "ircd.h"
  44 #include "numeric.h"
  45 #include "packet.h"
  46 #include "res.h"
  47 #include "logger.h"
  48 #include "s_stats.h"
  49 #include "send.h"
  50 #include "hook.h"
  51 #include "blacklist.h"
  52
  53 struct AuthRequest
  54 {
  55         rb_dlink_node node;
  56         struct Client *client;  /* pointer to client struct for request */
  57         struct DNSQuery dns_query; /* DNS Query */
  58         unsigned int flags;     /* current state of request */
  59         rb_fde_t *F;            /* file descriptor for auth queries */
  60         time_t timeout;         /* time when query expires */
  61         uint16_t lport;
  62         uint16_t rport;
  63 };
  64
  65 /*
  66  * flag values for AuthRequest
  67  * NAMESPACE: AM_xxx - Authentication Module
  68  */
  69 #define AM_AUTH_CONNECTING   (1 << 0)
  70 #define AM_AUTH_PENDING      (1 << 1)
  71 #define AM_DNS_PENDING       (1 << 2)
  72
  73 #define SetDNSPending(x)     ((x)->flags |= AM_DNS_PENDING)
  74 #define ClearDNSPending(x)   ((x)->flags &= ~AM_DNS_PENDING)
  75 #define IsDNSPending(x)      ((x)->flags &  AM_DNS_PENDING)
  76
  77 #define SetAuthConnect(x)    ((x)->flags |= AM_AUTH_CONNECTING)
  78 #define ClearAuthConnect(x)  ((x)->flags &= ~AM_AUTH_CONNECTING)
  79 #define IsAuthConnect(x)     ((x)->flags &  AM_AUTH_CONNECTING)
  80
  81 #define SetAuthPending(x)    ((x)->flags |= AM_AUTH_PENDING)
  82 #define ClearAuthPending(x)  ((x)->flags &= AM_AUTH_PENDING)
  83 #define IsAuthPending(x)     ((x)->flags &  AM_AUTH_PENDING)
  84
  85 #define ClearAuth(x)         ((x)->flags &= ~(AM_AUTH_PENDING | AM_AUTH_CONNECTING))
  86 #define IsDoingAuth(x)       ((x)->flags &  (AM_AUTH_PENDING | AM_AUTH_CONNECTING))
  87
  88 /*
  89  * a bit different approach
  90  * this replaces the original sendheader macros
  91  */
  92
  93 static const char *HeaderMessages[] =
  94 {
  95         ":*** Looking up your hostname...",
  96         ":*** Found your hostname",
  97         ":*** Couldn't look up your hostname",
  98         ":*** Checking Ident",
  99         ":*** Got Ident response",
 100         ":*** No Ident response",
 101         ":*** Your hostname is too long, ignoring hostname",
 102         ":*** Your forward and reverse DNS do not match, ignoring hostname",
 103         ":*** Cannot verify hostname validity, ignoring hostname",
 104 };
 105
 106 typedef enum
 107 {
 108         REPORT_DO_DNS,
 109         REPORT_FIN_DNS,
 110         REPORT_FAIL_DNS,
 111         REPORT_DO_ID,
 112         REPORT_FIN_ID,
 113         REPORT_FAIL_ID,
 114         REPORT_HOST_TOOLONG,
 115         REPORT_HOST_MISMATCH,
 116         REPORT_HOST_UNKNOWN
 117 }
 118 ReportType;
 119
 120 #define sendheader(c, r) sendto_one_notice(c, HeaderMessages[(r)])
 121
 122 static rb_dlink_list auth_poll_list;
 123 static rb_bh *auth_heap;
 124 static EVH timeout_auth_queries_event;
 125
 126 static PF read_auth_reply;
 127 static CNCB auth_connect_callback;
 128
 129 /*
 130  * init_auth()
 131  *
 132  * Initialise the auth code
 133  */
 134 void
 135 init_auth(void)
 136 {
 137         /* This hook takes a struct Client for its argument */
 138         memset(&auth_poll_list, 0, sizeof(auth_poll_list));
 139         rb_event_addish("timeout_auth_queries_event", timeout_auth_queries_event, NULL, 1);
 140         auth_heap = rb_bh_create(sizeof(struct AuthRequest), LCLIENT_HEAP_SIZE, "auth_heap");
 141 }
 142
 143 /*
 144  * make_auth_request - allocate a new auth request
 145  */
 146 static struct AuthRequest *
 147 make_auth_request(struct Client *client)
 148 {
 149         struct AuthRequest *request = rb_bh_alloc(auth_heap);
 150         client->localClient->auth_request = request;
 151         request->F = NULL;
 152         request->client = client;
 153         request->timeout = rb_current_time() + ConfigFileEntry.connect_timeout;
 154         return request;
 155 }
 156
 157 /*
 158  * free_auth_request - cleanup auth request allocations
 159  */
 160 static void
 161 free_auth_request(struct AuthRequest *request)
 162 {
 163         rb_bh_free(auth_heap, request);
 164 }
 165
 166 /*
 167  * release_auth_client - release auth client from auth system
 168  * this adds the client into the local client lists so it can be read by
 169  * the main io processing loop
 170  */
 171 static void
 172 release_auth_client(struct AuthRequest *auth)
 173 {
 174         struct Client *client = auth->client;
 175
 176         if(IsDNSPending(auth) || IsDoingAuth(auth))
 177                 return;
 178
 179         client->localClient->auth_request = NULL;
 180         rb_dlinkDelete(&auth->node, &auth_poll_list);
 181         free_auth_request(auth);
 182
 183         /*
 184          * When a client has auth'ed, we want to start reading what it sends
 185          * us. This is what read_packet() does.
 186          *     -- adrian
 187          */
 188         client->localClient->allow_read = MAX_FLOOD;
 189         rb_dlinkAddTail(client, &client->node, &global_client_list);
 190         read_packet(client->localClient->F, client);
 191 }
 192
 193 /*
 194  * auth_dns_callback - called when resolver query finishes
 195  * if the query resulted in a successful search, hp will contain
 196  * a non-null pointer, otherwise hp will be null.
 197  * set the client on it's way to a connection completion, regardless
 198  * of success of failure
 199  */
 200 static void
 201 auth_dns_callback(void *vptr, struct DNSReply *reply)
 202 {
 203         struct AuthRequest *auth = (struct AuthRequest *) vptr;
 204         ClearDNSPending(auth);
 205
 206         /* XXX: this shouldn't happen, but it does. -nenolod */
 207         if(auth->client->localClient == NULL)
 208         {
 209                 sendto_realops_snomask(SNO_GENERAL, L_ALL,
 210                         "auth_dns_callback(): auth->client->localClient (%s) is NULL", get_client_name(auth->client, HIDE_IP));
 211
 212                 rb_dlinkDelete(&auth->node, &auth_poll_list);
 213                 free_auth_request(auth);
 214
 215                 /* and they will silently drop through and all will hopefully be ok... -nenolod */
 216                 return;
 217         }
 218
 219         if(reply)
 220         {
 221                 int good = 1;
 222
 223                 if(auth->client->localClient->ip.ss_family == AF_INET)
 224                 {
 225                         struct sockaddr_in *ip, *ip_fwd;
 226
 227                         ip = (struct sockaddr_in *) &auth->client->localClient->ip;
 228                         ip_fwd = (struct sockaddr_in *) &reply->addr;
 229
 230                         if(ip->sin_addr.s_addr != ip_fwd->sin_addr.s_addr)
 231                         {
 232                                 sendheader(auth->client, REPORT_HOST_MISMATCH);
 233                                 good = 0;
 234                         }
 235                 }
 236 #ifdef RB_IPV6
 237                 else if(auth->client->localClient->ip.ss_family == AF_INET6)
 238                 {
 239                         struct sockaddr_in6 *ip, *ip_fwd;
 240
 241                         ip = (struct sockaddr_in6 *) &auth->client->localClient->ip;
 242                         ip_fwd = (struct sockaddr_in6 *) &reply->addr;
 243
 244                         if(memcmp(&ip->sin6_addr, &ip_fwd->sin6_addr, sizeof(struct in6_addr)) != 0)
 245                         {
 246                                 sendheader(auth->client, REPORT_HOST_MISMATCH);
 247                                 good = 0;
 248                         }
 249                 }
 250 #endif
 251                 else    /* can't verify it, don't know how. reject it. */
 252                 {
 253                         sendheader(auth->client, REPORT_HOST_UNKNOWN);
 254                         good = 0;
 255                 }
 256
 257                 if(good && strlen(reply->h_name) <= HOSTLEN)
 258                 {
 259                         rb_strlcpy(auth->client->host, reply->h_name, sizeof(auth->client->host));
 260                         sendheader(auth->client, REPORT_FIN_DNS);
 261                 }
 262                 else if (strlen(reply->h_name) > HOSTLEN)
 263                         sendheader(auth->client, REPORT_HOST_TOOLONG);
 264         }
 265         else
 266                 sendheader(auth->client, REPORT_FAIL_DNS);
 267
 268         release_auth_client(auth);
 269 }
 270
 271 /*
 272  * authsenderr - handle auth send errors
 273  */
 274 static void
 275 auth_error(struct AuthRequest *auth)
 276 {
 277         ++ServerStats.is_abad;
 278
 279         rb_close(auth->F);
 280         auth->F = NULL;
 281
 282         ClearAuth(auth);
 283         sendheader(auth->client, REPORT_FAIL_ID);
 284
 285         release_auth_client(auth);
 286 }
 287
 288 /*
 289  * start_auth_query - Flag the client to show that an attempt to
 290  * contact the ident server on
 291  * the client's host.  The connect and subsequently the socket are all put
 292  * into 'non-blocking' mode.  Should the connect or any later phase of the
 293  * identifing process fail, it is aborted and the user is given a username
 294  * of "unknown".
 295  */
 296 static int
 297 start_auth_query(struct AuthRequest *auth)
 298 {
 299         struct rb_sockaddr_storage localaddr, destaddr;
 300         rb_fde_t *F;
 301         int family;
 302
 303         if(IsAnyDead(auth->client))
 304                 return 0;
 305
 306         family = auth->client->localClient->ip.ss_family;
 307         if((F = rb_socket(family, SOCK_STREAM, 0, "ident")) == NULL)
 308         {
 309                 ilog_error("creating auth stream socket");
 310                 ++ServerStats.is_abad;
 311                 return 0;
 312         }
 313
 314         /*
 315          * TBD: this is a pointless arbitrary limit .. we either have a socket or not. -nenolod
 316          */
 317         if((maxconnections - 10) < rb_get_fd(F))
 318         {
 319                 sendto_realops_snomask(SNO_GENERAL, L_ALL,
 320                                      "Can't allocate fd for auth on %s",
 321                                      get_client_name(auth->client, SHOW_IP));
 322                 rb_close(F);
 323                 return 0;
 324         }
 325
 326         sendheader(auth->client, REPORT_DO_ID);
 327
 328         /*
 329          * get the local address of the client and bind to that to
 330          * make the auth request.  This used to be done only for
 331          * ifdef VIRTUAL_HOST, but needs to be done for all clients
 332          * since the ident request must originate from that same address--
 333          * and machines with multiple IP addresses are common now
 334          */
 335         localaddr = auth->client->preClient->lip;
 336
 337         /* XXX mangle_mapped_sockaddr((struct sockaddr *)&localaddr); */
 338 #ifdef RB_IPV6
 339         if(localaddr.ss_family == AF_INET6)
 340         {
 341                 auth->lport = ntohs(((struct sockaddr_in6 *)&localaddr)->sin6_port);
 342                 ((struct sockaddr_in6 *)&localaddr)->sin6_port = 0;
 343         }
 344         else
 345 #endif
 346         {
 347                 auth->lport = ntohs(((struct sockaddr_in *)&localaddr)->sin_port);
 348                 ((struct sockaddr_in *)&localaddr)->sin_port = 0;
 349         }
 350
 351         destaddr = auth->client->localClient->ip;
 352 #ifdef RB_IPV6
 353         if(localaddr.ss_family == AF_INET6)
 354         {
 355                 auth->rport = ntohs(((struct sockaddr_in6 *)&destaddr)->sin6_port);
 356                 ((struct sockaddr_in6 *)&destaddr)->sin6_port = htons(113);
 357         }
 358         else
 359 #endif
 360         {
 361                 auth->rport = ntohs(((struct sockaddr_in *)&destaddr)->sin_port);
 362                 ((struct sockaddr_in *)&destaddr)->sin_port = htons(113);
 363         }
 364
 365         auth->F = F;
 366         SetAuthConnect(auth);
 367
 368         rb_connect_tcp(F, (struct sockaddr *)&destaddr,
 369                          (struct sockaddr *) &localaddr, GET_SS_LEN(&localaddr),
 370                          auth_connect_callback, auth,
 371                          GlobalSetOptions.ident_timeout);
 372         return 1;               /* We suceed here for now */
 373 }
 374
 375 /*
 376  * GetValidIdent - parse ident query reply from identd server
 377  *
 378  * Inputs        - pointer to ident buf
 379  * Output        - NULL if no valid ident found, otherwise pointer to name
 380  * Side effects  -
 381  */
 382 static char *
 383 GetValidIdent(char *buf)
 384 {
 385         int remp = 0;
 386         int locp = 0;
 387         char *colon1Ptr;
 388         char *colon2Ptr;
 389         char *colon3Ptr;
 390         char *commaPtr;
 391         char *remotePortString;
 392
 393         /* All this to get rid of a sscanf() fun. */
 394         remotePortString = buf;
 395
 396         colon1Ptr = strchr(remotePortString, ':');
 397         if(!colon1Ptr)
 398                 return 0;
 399
 400         *colon1Ptr = '\0';
 401         colon1Ptr++;
 402         colon2Ptr = strchr(colon1Ptr, ':');
 403         if(!colon2Ptr)
 404                 return 0;
 405
 406         *colon2Ptr = '\0';
 407         colon2Ptr++;
 408         commaPtr = strchr(remotePortString, ',');
 409
 410         if(!commaPtr)
 411                 return 0;
 412
 413         *commaPtr = '\0';
 414         commaPtr++;
 415
 416         remp = atoi(remotePortString);
 417         if(!remp)
 418                 return 0;
 419
 420         locp = atoi(commaPtr);
 421         if(!locp)
 422                 return 0;
 423
 424         /* look for USERID bordered by first pair of colons */
 425         if(!strstr(colon1Ptr, "USERID"))
 426                 return 0;
 427
 428         colon3Ptr = strchr(colon2Ptr, ':');
 429         if(!colon3Ptr)
 430                 return 0;
 431
 432         *colon3Ptr = '\0';
 433         colon3Ptr++;
 434         return (colon3Ptr);
 435 }
 436
 437 /*
 438  * start_auth - starts auth (identd) and dns queries for a client
 439  */
 440 void
 441 start_auth(struct Client *client)
 442 {
 443         struct AuthRequest *auth = 0;
 444         s_assert(0 != client);
 445         if(client == NULL)
 446                 return;
 447
 448         auth = make_auth_request(client);
 449
 450         auth->dns_query.ptr = auth;
 451         auth->dns_query.callback = auth_dns_callback;
 452
 453         sendheader(client, REPORT_DO_DNS);
 454
 455         /* No DNS cache now, remember? -- adrian */
 456         gethost_byaddr(&client->localClient->ip, &auth->dns_query);
 457
 458         SetDNSPending(auth);
 459
 460         if(ConfigFileEntry.disable_auth == 0)
 461                 start_auth_query(auth);
 462
 463         rb_dlinkAdd(auth, &auth->node, &auth_poll_list);
 464 }
 465
 466 /*
 467  * timeout_auth_queries - timeout resolver and identd requests
 468  * allow clients through if requests failed
 469  */
 470 static void
 471 timeout_auth_queries_event(void *notused)
 472 {
 473         rb_dlink_node *ptr;
 474         rb_dlink_node *next_ptr;
 475         struct AuthRequest *auth;
 476
 477         RB_DLINK_FOREACH_SAFE(ptr, next_ptr, auth_poll_list.head)
 478         {
 479                 auth = ptr->data;
 480
 481                 if(auth->timeout < rb_current_time())
 482                 {
 483                         if(auth->F != NULL)
 484                                 rb_close(auth->F);
 485
 486                         if(IsDoingAuth(auth))
 487                         {
 488                                 ClearAuth(auth);
 489                                 ++ServerStats.is_abad;
 490                                 sendheader(auth->client, REPORT_FAIL_ID);
 491                                 auth->client->localClient->auth_request = NULL;
 492                         }
 493                         if(IsDNSPending(auth))
 494                         {
 495                                 ClearDNSPending(auth);
 496                                 delete_resolver_queries(&auth->dns_query);
 497                                 sendheader(auth->client, REPORT_FAIL_DNS);
 498                         }
 499
 500                         auth->client->localClient->lasttime = rb_current_time();
 501                         release_auth_client(auth);
 502                 }
 503         }
 504 }
 505
 506 /*
 507  * auth_connect_callback() - deal with the result of rb_connect_tcp()
 508  *
 509  * If the connection failed, we simply close the auth fd and report
 510  * a failure. If the connection suceeded send the ident server a query
 511  * giving "theirport , ourport". The write is only attempted *once* so
 512  * it is deemed to be a fail if the entire write doesn't write all the
 513  * data given.  This shouldnt be a problem since the socket should have
 514  * a write buffer far greater than this message to store it in should
 515  * problems arise. -avalon
 516  */
 517 static void
 518 auth_connect_callback(rb_fde_t *F, int error, void *data)
 519 {
 520         struct AuthRequest *auth = data;
 521         char authbuf[32];
 522
 523         /* Check the error */
 524         if(error != RB_OK)
 525         {
 526                 /* We had an error during connection :( */
 527                 auth_error(auth);
 528                 return;
 529         }
 530
 531         rb_snprintf(authbuf, sizeof(authbuf), "%u , %u\r\n",
 532                    auth->rport, auth->lport);
 533
 534         if(rb_write(auth->F, authbuf, strlen(authbuf)) != strlen(authbuf))
 535         {
 536                 auth_error(auth);
 537                 return;
 538         }
 539         ClearAuthConnect(auth);
 540         SetAuthPending(auth);
 541         read_auth_reply(auth->F, auth);
 542 }
 543
 544
 545 /*
 546  * read_auth_reply - read the reply (if any) from the ident server
 547  * we connected to.
 548  * We only give it one shot, if the reply isn't good the first time
 549  * fail the authentication entirely. --Bleep
 550  */
 551 #define AUTH_BUFSIZ 128
 552
 553 static void
 554 read_auth_reply(rb_fde_t *F, void *data)
 555 {
 556         struct AuthRequest *auth = data;
 557         char *s = NULL;
 558         char *t = NULL;
 559         int len;
 560         int count;
 561         char buf[AUTH_BUFSIZ + 1];      /* buffer to read auth reply into */
 562
 563         len = rb_read(F, buf, AUTH_BUFSIZ);
 564
 565         if(len < 0 && rb_ignore_errno(errno))
 566         {
 567                 rb_setselect(F, RB_SELECT_READ, read_auth_reply, auth);
 568                 return;
 569         }
 570
 571         if(len > 0)
 572         {
 573                 buf[len] = '\0';
 574
 575                 if((s = GetValidIdent(buf)))
 576                 {
 577                         t = auth->client->username;
 578
 579                         while (*s == '~' || *s == '^')
 580                                 s++;
 581
 582                         for (count = USERLEN; *s && count; s++)
 583                         {
 584                                 if(*s == '@')
 585                                 {
 586                                         break;
 587                                 }
 588                                 if(!IsSpace(*s) && *s != ':' && *s != '[')
 589                                 {
 590                                         *t++ = *s;
 591                                         count--;
 592                                 }
 593                         }
 594                         *t = '\0';
 595                 }
 596         }
 597
 598         rb_close(auth->F);
 599         auth->F = NULL;
 600         ClearAuth(auth);
 601
 602         if(s == NULL)
 603         {
 604                 ++ServerStats.is_abad;
 605                 strcpy(auth->client->username, "unknown");
 606                 sendheader(auth->client, REPORT_FAIL_ID);
 607         }
 608         else
 609         {
 610                 sendheader(auth->client, REPORT_FIN_ID);
 611                 ++ServerStats.is_asuc;
 612                 SetGotId(auth->client);
 613         }
 614
 615         release_auth_client(auth);
 616 }
 617
 618
 619
 620 /*
 621  * delete_auth_queries()
 622  *
 623  */
 624 void
 625 delete_auth_queries(struct Client *target_p)
 626 {
 627         struct AuthRequest *auth;
 628
 629         if(target_p == NULL || target_p->localClient == NULL ||
 630            target_p->localClient->auth_request == NULL)
 631                 return;
 632
 633         auth = target_p->localClient->auth_request;
 634         target_p->localClient->auth_request = NULL;
 635
 636         if(IsDNSPending(auth))
 637                 delete_resolver_queries(&auth->dns_query);
 638
 639         if(auth->F != NULL)
 640                 rb_close(auth->F);
 641
 642         rb_dlinkDelete(&auth->node, &auth_poll_list);
 643         free_auth_request(auth);
 644 }