[solanum.git] / authd / provider.c

/* authd/provider.c - authentication provider framework
 * Copyright (c) 2016 Elizabeth Myers <elizabeth@interlinked.me>
 *
 * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice is present in all copies.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 */

/* So the basic design here is to have "authentication providers" that do
 * things like query ident and blacklists and even open proxies.
 *
 * Providers are registered in the auth_providers linked list. It is planned to
 * use a bitmap to store provider ID's later.
 *
 * Providers can either return failure immediately, immediate acceptance, or
 * do work in the background (calling set_provider to signal this).
 *
 * Provider-specific data for each client can be kept in an index of the data
 * struct member (using the provider's ID).
 *
 * All providers must implement at a minimum a perform_provider function. You
 * don't have to implement the others if you don't need them.
 *
 * Providers may kick clients off by rejecting them. Upon rejection, all
 * providers are cancelled. They can also unconditionally accept them.
 *
 * When a provider is done and is neutral on accepting/rejecting a client, it
 * should call provider_done. Do NOT call this if you have accepted or rejected
 * the client.
 *
 * --Elizafox, 9 March 2016
 */

#include "rb_dictionary.h"
#include "authd.h"
#include "provider.h"

rb_dlink_list auth_providers;

/* Clients waiting */
struct Dictionary *auth_clients;

/* Load a provider */
void load_provider(struct auth_provider *provider)
{
	if(rb_dlink_list_length(&auth_providers) >= MAX_PROVIDERS)
		/* XXX should probably warn here */
		return;

	provider->init();
	rb_dlinkAdd(provider, &provider->node, &auth_providers);
}

void unload_provider(struct auth_provider *provider)
{
	provider->destroy();
	rb_dlinkDelete(&provider->node, &auth_providers);
}

/* Initalise all providers */
void init_providers(void)
{
	auth_clients = rb_dictionary_create("pending auth clients", rb_uint32cmp);
	load_provider(&rdns_provider);
	load_provider(&ident_provider);
}

/* Terminate all providers */
void destroy_providers(void)
{
	rb_dlink_node *ptr;
	struct DictionaryIter iter;
	struct auth_client *auth;
	struct auth_provider *provider;

	/* Cancel outstanding connections */
	DICTIONARY_FOREACH(auth, &iter, auth_clients)
	{
		/* TBD - is this the right thing? */
		reject_client(auth, 0, "Authentication system is down... try reconnecting in a few seconds");
	}

	RB_DLINK_FOREACH(ptr, auth_providers.head)
	{
		provider = ptr->data;

		if(provider->destroy)
			provider->destroy();
	}
}

/* Cancel outstanding providers for a client */
void cancel_providers(struct auth_client *auth)
{
	rb_dlink_node *ptr;
	struct auth_provider *provider;

	RB_DLINK_FOREACH(ptr, auth_providers.head)
	{
		provider = ptr->data;

		if(provider->cancel && is_provider(auth, provider->id))
			/* Cancel if required */
			provider->cancel(auth);
	}

	rb_dictionary_delete(auth_clients, RB_UINT_TO_POINTER(auth->cid));
	rb_free(auth);
}

/* Provider is done */
void provider_done(struct auth_client *auth, provider_t id)
{
	rb_dlink_node *ptr;
	struct auth_provider *provider;

	unset_provider(auth, id);

	if(!auth->providers)
	{
		/* No more providers, done */
		accept_client(auth, 0);
		return;
	}

	RB_DLINK_FOREACH(ptr, auth_providers.head)
	{
		provider = ptr->data;

		if(provider->completed && is_provider(auth, provider->id))
			/* Notify pending clients who asked for it */
			provider->completed(auth, id);
	}
}

/* Reject a client */
void reject_client(struct auth_client *auth, provider_t id, const char *reason)
{
	char reject;

	switch(id)
	{
	case PROVIDER_RDNS:
		reject = 'D';
		break;
	case PROVIDER_IDENT:
		reject = 'I';
		break;
	case PROVIDER_BLACKLIST:
		reject = 'B';
		break;
	default:
		reject = 'N';
		break;
	}

	/* TODO send back ident */
	rb_helper_write(authd_helper, "R %x %c :%s", auth->cid, reject, reason);

	unset_provider(auth, id);
	cancel_providers(auth);
}

/* Accept a client, cancel outstanding providers if any */
void accept_client(struct auth_client *auth, provider_t id)
{
	uint32_t cid = auth->cid;

	rb_helper_write(authd_helper, "A %x %s %s", auth->cid, auth->username, auth->hostname);

	unset_provider(auth, id);
	cancel_providers(auth);
}

/* Send a notice to a client */
void notice_client(struct auth_client *auth, const char *notice)
{
	rb_helper_write(authd_helper, "N %x :%s", auth->cid, notice);
}

/* Begin authenticating user */
static void start_auth(const char *cid, const char *l_ip, const char *l_port, const char *c_ip, const char *c_port)
{
	struct auth_provider *provider;
	struct auth_client *auth = rb_malloc(sizeof(struct auth_client));
	long lcid = strtol(cid, NULL, 16);
	rb_dlink_node *ptr;

	if(lcid >= UINT32_MAX)
		return;

	auth->cid = (uint32_t)lcid;

	rb_strlcpy(auth->l_ip, l_ip, sizeof(auth->l_ip));
	auth->l_port = (uint16_t)atoi(l_port);	/* should be safe */

	rb_strlcpy(auth->c_ip, c_ip, sizeof(auth->c_ip));
	auth->c_port = (uint16_t)atoi(c_port);

	rb_dictionary_add(auth_clients, RB_UINT_TO_POINTER(auth->cid), auth);

	RB_DLINK_FOREACH(ptr, auth_providers.head)
	{
		provider = ptr->data;

		/* Execute providers */
		if(!provider->start(auth))
		{
			/* Rejected immediately */
			cancel_providers(auth);
			return;
		}
	}

	/* If no providers are running, accept the client */
	if(!auth->providers)
		accept_client(auth, 0);
}

/* Callback for the initiation */
void handle_new_connection(int parc, char *parv[])
{
	if(parc < 7)
		return;

	start_auth(parv[1], parv[2], parv[3], parv[4], parv[5]);
}
Commit	Line	Data
2b0cc3d3 EM	1	/* authd/provider.c - authentication provider framework
	2	* Copyright (c) 2016 Elizabeth Myers <elizabeth@interlinked.me>
	3	*
	4	* Permission to use, copy, modify, and/or distribute this software for any
	5	* purpose with or without fee is hereby granted, provided that the above
	6	* copyright notice and this permission notice is present in all copies.
	7	*
	8	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
	9	* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
	10	* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
	11	* DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
	12	* INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
	13	* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
	14	* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	15	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
	16	* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
	17	* IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
	18	* POSSIBILITY OF SUCH DAMAGE.
	19	*/
	20
	21	/* So the basic design here is to have "authentication providers" that do
	22	* things like query ident and blacklists and even open proxies.
	23	*
f7b37c1d EM	24	* Providers are registered in the auth_providers linked list. It is planned to
f7b37c1d EM	25	* use a bitmap to store provider ID's later.
2b0cc3d3 EM	26	*
	27	* Providers can either return failure immediately, immediate acceptance, or
	28	* do work in the background (calling set_provider to signal this).
	29	*
3e875f62 EM	30	* Provider-specific data for each client can be kept in an index of the data
3e875f62 EM	31	* struct member (using the provider's ID).
2b0cc3d3 EM	32	*
	33	* All providers must implement at a minimum a perform_provider function. You
	34	* don't have to implement the others if you don't need them.
	35	*
	36	* Providers may kick clients off by rejecting them. Upon rejection, all
	37	* providers are cancelled. They can also unconditionally accept them.
	38	*
	39	* When a provider is done and is neutral on accepting/rejecting a client, it
	40	* should call provider_done. Do NOT call this if you have accepted or rejected
	41	* the client.
	42	*
	43	* --Elizafox, 9 March 2016
	44	*/
	45
46d17a88	46	#include "rb_dictionary.h"
2b0cc3d3 EM	47	#include "authd.h"
	48	#include "provider.h"
	49
	50	rb_dlink_list auth_providers;
	51
	52	/* Clients waiting */
3e875f62	53	struct Dictionary *auth_clients;
2b0cc3d3 EM	54
	55	/* Load a provider */
	56	void load_provider(struct auth_provider *provider)
	57	{
3e875f62 EM	58	if(rb_dlink_list_length(&auth_providers) >= MAX_PROVIDERS)
	59	/* XXX should probably warn here */
	60	return;
	61
2b0cc3d3 EM	62	provider->init();
	63	rb_dlinkAdd(provider, &provider->node, &auth_providers);
	64	}
	65
	66	void unload_provider(struct auth_provider *provider)
	67	{
	68	provider->destroy();
	69	rb_dlinkDelete(&provider->node, &auth_providers);
	70	}
	71
	72	/* Initalise all providers */
	73	void init_providers(void)
	74	{
3e875f62	75	auth_clients = rb_dictionary_create("pending auth clients", rb_uint32cmp);
2b0cc3d3 EM	76	load_provider(&rdns_provider);
	77	load_provider(&ident_provider);
	78	}
	79
	80	/* Terminate all providers */
	81	void destroy_providers(void)
	82	{
	83	rb_dlink_node *ptr;
3e875f62 EM	84	struct DictionaryIter iter;
3e875f62 EM	85	struct auth_client *auth;
2b0cc3d3 EM	86	struct auth_provider *provider;
	87
	88	/* Cancel outstanding connections */
3e875f62	89	DICTIONARY_FOREACH(auth, &iter, auth_clients)
2b0cc3d3	90	{
3e875f62 EM	91	/* TBD - is this the right thing? */
3e875f62 EM	92	reject_client(auth, 0, "Authentication system is down... try reconnecting in a few seconds");
2b0cc3d3 EM	93	}
	94
	95	RB_DLINK_FOREACH(ptr, auth_providers.head)
	96	{
	97	provider = ptr->data;
	98
	99	if(provider->destroy)
	100	provider->destroy();
	101	}
	102	}
	103
	104	/* Cancel outstanding providers for a client */
	105	void cancel_providers(struct auth_client *auth)
	106	{
	107	rb_dlink_node *ptr;
	108	struct auth_provider *provider;
	109
	110	RB_DLINK_FOREACH(ptr, auth_providers.head)
	111	{
	112	provider = ptr->data;
	113
	114	if(provider->cancel && is_provider(auth, provider->id))
	115	/* Cancel if required */
	116	provider->cancel(auth);
	117	}
46d17a88	118
3e875f62 EM	119	rb_dictionary_delete(auth_clients, RB_UINT_TO_POINTER(auth->cid));
3e875f62 EM	120	rb_free(auth);
2b0cc3d3 EM	121	}
	122
	123	/* Provider is done */
	124	void provider_done(struct auth_client *auth, provider_t id)
	125	{
	126	rb_dlink_node *ptr;
	127	struct auth_provider *provider;
	128
	129	unset_provider(auth, id);
	130
	131	if(!auth->providers)
	132	{
	133	/* No more providers, done */
	134	accept_client(auth, 0);
	135	return;
	136	}
	137
	138	RB_DLINK_FOREACH(ptr, auth_providers.head)
	139	{
	140	provider = ptr->data;
	141
	142	if(provider->completed && is_provider(auth, provider->id))
	143	/* Notify pending clients who asked for it */
	144	provider->completed(auth, id);
	145	}
	146	}
	147
f7b37c1d EM	148	/* Reject a client */
f7b37c1d EM	149	void reject_client(struct auth_client auth, provider_t id, const char reason)
2b0cc3d3	150	{
2b0cc3d3 EM	151	char reject;
	152
	153	switch(id)
	154	{
	155	case PROVIDER_RDNS:
	156	reject = 'D';
	157	break;
	158	case PROVIDER_IDENT:
	159	reject = 'I';
	160	break;
	161	case PROVIDER_BLACKLIST:
	162	reject = 'B';
	163	break;
2b0cc3d3 EM	164	default:
	165	reject = 'N';
	166	break;
	167	}
	168
46d17a88	169	/* TODO send back ident */
2b0cc3d3 EM	170	rb_helper_write(authd_helper, "R %x %c :%s", auth->cid, reject, reason);
	171
	172	unset_provider(auth, id);
46d17a88	173	cancel_providers(auth);
2b0cc3d3 EM	174	}
	175
	176	/* Accept a client, cancel outstanding providers if any */
	177	void accept_client(struct auth_client *auth, provider_t id)
	178	{
3e875f62	179	uint32_t cid = auth->cid;
2b0cc3d3 EM	180
	181	rb_helper_write(authd_helper, "A %x %s %s", auth->cid, auth->username, auth->hostname);
	182
	183	unset_provider(auth, id);
46d17a88	184	cancel_providers(auth);
2b0cc3d3 EM	185	}
	186
	187	/* Send a notice to a client */
	188	void notice_client(struct auth_client auth, const char notice)
	189	{
	190	rb_helper_write(authd_helper, "N %x :%s", auth->cid, notice);
	191	}
	192
	193	/* Begin authenticating user */
	194	static void start_auth(const char cid, const char l_ip, const char l_port, const char c_ip, const char *c_port)
	195	{
	196	struct auth_provider *provider;
3e875f62	197	struct auth_client *auth = rb_malloc(sizeof(struct auth_client));
2b0cc3d3 EM	198	long lcid = strtol(cid, NULL, 16);
	199	rb_dlink_node *ptr;
	200
3e875f62	201	if(lcid >= UINT32_MAX)
2b0cc3d3 EM	202	return;
2b0cc3d3 EM	203
3e875f62	204	auth->cid = (uint32_t)lcid;
2b0cc3d3 EM	205
	206	rb_strlcpy(auth->l_ip, l_ip, sizeof(auth->l_ip));
	207	auth->l_port = (uint16_t)atoi(l_port); /* should be safe */
	208
	209	rb_strlcpy(auth->c_ip, c_ip, sizeof(auth->c_ip));
	210	auth->c_port = (uint16_t)atoi(c_port);
	211
3e875f62	212	rb_dictionary_add(auth_clients, RB_UINT_TO_POINTER(auth->cid), auth);
f7b37c1d	213
2b0cc3d3 EM	214	RB_DLINK_FOREACH(ptr, auth_providers.head)
	215	{
	216	provider = ptr->data;
	217
	218	/* Execute providers */
	219	if(!provider->start(auth))
	220	{
	221	/* Rejected immediately */
	222	cancel_providers(auth);
	223	return;
	224	}
	225	}
	226
	227	/* If no providers are running, accept the client */
	228	if(!auth->providers)
	229	accept_client(auth, 0);
	230	}
	231
	232	/* Callback for the initiation */
	233	void handle_new_connection(int parc, char *parv[])
	234	{
	235	if(parc < 7)
	236	return;
	237
	238	start_auth(parv[1], parv[2], parv[3], parv[4], parv[5]);
	239	}