[solanum.git] / modules / m_sasl.c

/* modules/m_sasl.c
 *   Copyright (C) 2006 Michael Tharp <gxti@partiallystapled.com>
 *   Copyright (C) 2006, 2011 charybdis development team
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are
 * met:
 *
 * 1.Redistributions of source code must retain the above copyright notice,
 *   this list of conditions and the following disclaimer.
 * 2.Redistributions in binary form must reproduce the above copyright
 *   notice, this list of conditions and the following disclaimer in the
 *   documentation and/or other materials provided with the distribution.
 * 3.The name of the author may not be used to endorse or promote products
 *   derived from this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 *
 * $Id: m_sasl.c 1409 2006-05-21 14:46:17Z jilles $
 */

#include "stdinc.h"

#include "client.h"
#include "hash.h"
#include "send.h"
#include "msg.h"
#include "modules.h"
#include "numeric.h"
#include "s_serv.h"
#include "s_stats.h"
#include "string.h"

static int mr_authenticate(struct Client *, struct Client *, int, const char **);
static int me_sasl(struct Client *, struct Client *, int, const char **);

static void abort_sasl(struct Client *);
static void abort_sasl_exit(hook_data_client_exit *);

struct Message authenticate_msgtab = {
	"AUTHENTICATE", 0, 0, 0, MFLG_SLOW,
	{{mr_authenticate, 2}, mg_reg, mg_ignore, mg_ignore, mg_ignore, mg_reg}
};
struct Message sasl_msgtab = {
	"SASL", 0, 0, 0, MFLG_SLOW,
	{mg_ignore, mg_ignore, mg_ignore, mg_ignore, {me_sasl, 5}, mg_ignore}
};

mapi_clist_av1 sasl_clist[] = { 
	&authenticate_msgtab, &sasl_msgtab, NULL
};
mapi_hfn_list_av1 sasl_hfnlist[] = {
	{ "new_local_user",	(hookfn) abort_sasl },
	{ "client_exit",	(hookfn) abort_sasl_exit },
	{ NULL, NULL }
};

DECLARE_MODULE_AV1(sasl, NULL, NULL, sasl_clist, NULL, sasl_hfnlist, "$Revision: 1409 $");

/*
 * parv[1] = mechanism.
 *    in ircv3.1, if this is EXTERNAL, we just send the certificate fingerprint.
 */
static int
mr_authenticate(struct Client *client_p, struct Client *source_p,
	int parc, const char *parv[])
{
	struct Client *agent_p = NULL;

	/* They really should use CAP for their own sake. */
	if(!IsCapable(source_p, CLICAP_SASL))
		return 0;

	if(source_p->preClient->sasl_complete)
	{
		sendto_one(source_p, form_str(ERR_SASLALREADY), me.name, EmptyString(source_p->name) ? "*" : source_p->name);
		return 0;
	}

	if(strlen(parv[1]) > 400)
	{
		sendto_one(source_p, form_str(ERR_SASLTOOLONG), me.name, EmptyString(source_p->name) ? "*" : source_p->name);
		return 0;
	}

	if(!*source_p->id)
	{
		/* Allocate a UID. */
		strcpy(source_p->id, generate_uid());
		add_to_id_hash(source_p->id, source_p);
	}

	if(*source_p->preClient->sasl_agent)
		agent_p = find_id(source_p->preClient->sasl_agent);

	if(agent_p == NULL)
	{
		if (!strcasecmp(parv[1], "EXTERNAL"))
		{
			if (source_p->certfp)
				source_p->preClient->sasl_external++;
		}

		sendto_server(NULL, NULL, CAP_TS6|CAP_ENCAP, NOCAPS, ":%s ENCAP * SASL %s * S %s", me.id,
				source_p->id, parv[1]);
	}
	else
		sendto_one(agent_p, ":%s ENCAP %s SASL %s %s C %s", me.id, agent_p->servptr->name,
				source_p->id, agent_p->id, parv[1]);

	source_p->preClient->sasl_out++;

	return 0;
}

static int
me_sasl(struct Client *client_p, struct Client *source_p,
	int parc, const char *parv[])
{
	struct Client *target_p, *agent_p;

	/* Let propagate if not addressed to us, or if broadcast.
	 * Only SASL agents can answer global requests.
	 */
	if(strncmp(parv[2], me.id, 3))
		return 0;

	if((target_p = find_id(parv[2])) == NULL)
		return 0;

	if(target_p->preClient == NULL)
		return 0;

	if((agent_p = find_id(parv[1])) == NULL)
		return 0;

	if(source_p != agent_p->servptr) /* WTF?! */
		return 0;

	/* We only accept messages from SASL agents; these must have umode +S
	 * (so the server must be listed in a service{} block).
	 */
	if(!IsService(agent_p))
		return 0;

	/* Reject if someone has already answered. */
	if(*target_p->preClient->sasl_agent && strncmp(parv[1], target_p->preClient->sasl_agent, IDLEN))
		return 0;
	else if(!*target_p->preClient->sasl_agent)
		rb_strlcpy(target_p->preClient->sasl_agent, parv[1], IDLEN);

	if(*parv[3] == 'C' && !target_p->preClient->sasl_external)
		sendto_one(target_p, "AUTHENTICATE %s", parv[4]);
	else if(*parv[3] == 'C' && *target_p->preClient->sasl_agent)
	{
		unsigned char *message;

		message = rb_base64_encode((unsigned char *) target_p->certfp, strlen(target_p->certfp));
		sendto_one(agent_p, ":%s ENCAP %s SASL %s %s C %s", me.id, agent_p->servptr->name,
				source_p->id, agent_p->id, message);

		rb_free(message);
	}
	else if(*parv[3] == 'D')
	{
		if(*parv[4] == 'F')
			sendto_one(target_p, form_str(ERR_SASLFAIL), me.name, EmptyString(target_p->name) ? "*" : target_p->name);
		else if(*parv[4] == 'S') {
			sendto_one(target_p, form_str(RPL_SASLSUCCESS), me.name, EmptyString(target_p->name) ? "*" : target_p->name);
			target_p->preClient->sasl_complete = 1;
			ServerStats.is_ssuc++;
		}
		*target_p->preClient->sasl_agent = '\0'; /* Blank the stored agent so someone else can answer */
	}
	
	return 0;
}

/* If the client never finished authenticating but is
 * registering anyway, abort the exchange.
 */
static void
abort_sasl(struct Client *data)
{
	if(data->preClient->sasl_out == 0 || data->preClient->sasl_complete)
		return;

	data->preClient->sasl_out = data->preClient->sasl_complete = 0;
	ServerStats.is_sbad++;

	if(!IsClosing(data))
		sendto_one(data, form_str(ERR_SASLABORTED), me.name, EmptyString(data->name) ? "*" : data->name);

	if(*data->preClient->sasl_agent)
	{
		struct Client *agent_p = find_id(data->preClient->sasl_agent);
		if(agent_p)
		{
			sendto_one(agent_p, ":%s ENCAP %s SASL %s %s D A", me.id, agent_p->servptr->name,
					data->id, agent_p->id);
			return;
		}
	}

	sendto_server(NULL, NULL, CAP_TS6|CAP_ENCAP, NOCAPS, ":%s ENCAP * SASL %s * D A", me.id,
			data->id);
}

static void
abort_sasl_exit(hook_data_client_exit *data)
{
	if (data->target->preClient)
		abort_sasl(data->target);
}
Commit	Line	Data
212380e3 AC	1	/* modules/m_sasl.c
212380e3 AC	2	* Copyright (C) 2006 Michael Tharp <gxti@partiallystapled.com>
27126f91	3	* Copyright (C) 2006, 2011 charybdis development team
212380e3 AC	4	*
	5	* Redistribution and use in source and binary forms, with or without
	6	* modification, are permitted provided that the following conditions are
	7	* met:
	8	*
	9	* 1.Redistributions of source code must retain the above copyright notice,
	10	* this list of conditions and the following disclaimer.
	11	* 2.Redistributions in binary form must reproduce the above copyright
	12	* notice, this list of conditions and the following disclaimer in the
	13	* documentation and/or other materials provided with the distribution.
	14	* 3.The name of the author may not be used to endorse or promote products
	15	* derived from this software without specific prior written permission.
	16	*
	17	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
	18	* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
	19	* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
	20	* DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
	21	* INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
	22	* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
	23	* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	24	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
	25	* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
	26	* IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
	27	* POSSIBILITY OF SUCH DAMAGE.
	28	*
	29	* $Id: m_sasl.c 1409 2006-05-21 14:46:17Z jilles $
	30	*/
	31
	32	#include "stdinc.h"
	33
	34	#include "client.h"
	35	#include "hash.h"
	36	#include "send.h"
	37	#include "msg.h"
	38	#include "modules.h"
	39	#include "numeric.h"
	40	#include "s_serv.h"
	41	#include "s_stats.h"
	42	#include "string.h"
	43
	44	static int mr_authenticate(struct Client , struct Client , int, const char **);
	45	static int me_sasl(struct Client , struct Client , int, const char **);
	46
	47	static void abort_sasl(struct Client *);
	48	static void abort_sasl_exit(hook_data_client_exit *);
	49
	50	struct Message authenticate_msgtab = {
	51	"AUTHENTICATE", 0, 0, 0, MFLG_SLOW,
	52	{{mr_authenticate, 2}, mg_reg, mg_ignore, mg_ignore, mg_ignore, mg_reg}
	53	};
	54	struct Message sasl_msgtab = {
	55	"SASL", 0, 0, 0, MFLG_SLOW,
	56	{mg_ignore, mg_ignore, mg_ignore, mg_ignore, {me_sasl, 5}, mg_ignore}
	57	};
	58
	59	mapi_clist_av1 sasl_clist[] = {
	60	&authenticate_msgtab, &sasl_msgtab, NULL
	61	};
	62	mapi_hfn_list_av1 sasl_hfnlist[] = {
	63	{ "new_local_user", (hookfn) abort_sasl },
	64	{ "client_exit", (hookfn) abort_sasl_exit },
	65	{ NULL, NULL }
	66	};
	67
68	DECLARE_MODULE_AV1(sasl, NULL, NULL, sasl_clist, NULL, sasl_hfnlist, "$Revision: 1409 $");
69
27126f91 AC	70	/*
	71	* parv[1] = mechanism.
	72	* in ircv3.1, if this is EXTERNAL, we just send the certificate fingerprint.
	73	*/
212380e3 AC	74	static int
	75	mr_authenticate(struct Client client_p, struct Client source_p,
	76	int parc, const char *parv[])
	77	{
	78	struct Client *agent_p = NULL;
	79
	80	/* They really should use CAP for their own sake. */
	81	if(!IsCapable(source_p, CLICAP_SASL))
	82	return 0;
	83
212380e3 AC	84	if(source_p->preClient->sasl_complete)
	85	{
	86	sendto_one(source_p, form_str(ERR_SASLALREADY), me.name, EmptyString(source_p->name) ? "*" : source_p->name);
	87	return 0;
	88	}
	89
	90	if(strlen(parv[1]) > 400)
	91	{
	92	sendto_one(source_p, form_str(ERR_SASLTOOLONG), me.name, EmptyString(source_p->name) ? "*" : source_p->name);
	93	return 0;
	94	}
	95
	96	if(!*source_p->id)
	97	{
	98	/* Allocate a UID. */
	99	strcpy(source_p->id, generate_uid());
	100	add_to_id_hash(source_p->id, source_p);
	101	}
	102
	103	if(*source_p->preClient->sasl_agent)
	104	agent_p = find_id(source_p->preClient->sasl_agent);
	105
	106	if(agent_p == NULL)
27126f91 AC	107	{
	108	if (!strcasecmp(parv[1], "EXTERNAL"))
	109	{
	110	if (source_p->certfp)
	111	source_p->preClient->sasl_external++;
	112	}
	113
212380e3 AC	114	sendto_server(NULL, NULL, CAP_TS6\|CAP_ENCAP, NOCAPS, ":%s ENCAP * SASL %s * S %s", me.id,
212380e3 AC	115	source_p->id, parv[1]);
27126f91	116	}
212380e3 AC	117	else
	118	sendto_one(agent_p, ":%s ENCAP %s SASL %s %s C %s", me.id, agent_p->servptr->name,
	119	source_p->id, agent_p->id, parv[1]);
d8c45202	120
212380e3 AC	121	source_p->preClient->sasl_out++;
	122
	123	return 0;
	124	}
	125
	126	static int
	127	me_sasl(struct Client client_p, struct Client source_p,
	128	int parc, const char *parv[])
	129	{
	130	struct Client target_p, agent_p;
	131
	132	/* Let propagate if not addressed to us, or if broadcast.
	133	* Only SASL agents can answer global requests.
	134	*/
	135	if(strncmp(parv[2], me.id, 3))
	136	return 0;
	137
	138	if((target_p = find_id(parv[2])) == NULL)
	139	return 0;
	140
	141	if(target_p->preClient == NULL)
	142	return 0;
	143
	144	if((agent_p = find_id(parv[1])) == NULL)
	145	return 0;
	146
	147	if(source_p != agent_p->servptr) /* WTF?! */
	148	return 0;
	149
	150	/* We only accept messages from SASL agents; these must have umode +S
	151	* (so the server must be listed in a service{} block).
	152	*/
	153	if(!IsService(agent_p))
	154	return 0;
	155
	156	/* Reject if someone has already answered. */
	157	if(*target_p->preClient->sasl_agent && strncmp(parv[1], target_p->preClient->sasl_agent, IDLEN))
	158	return 0;
	159	else if(!*target_p->preClient->sasl_agent)
f427c8b0	160	rb_strlcpy(target_p->preClient->sasl_agent, parv[1], IDLEN);
212380e3	161
27126f91	162	if(*parv[3] == 'C' && !target_p->preClient->sasl_external)
212380e3	163	sendto_one(target_p, "AUTHENTICATE %s", parv[4]);
27126f91 AC	164	else if(parv[3] == 'C' && target_p->preClient->sasl_agent)
	165	{
	166	unsigned char *message;
	167
	168	message = rb_base64_encode((unsigned char *) target_p->certfp, strlen(target_p->certfp));
	169	sendto_one(agent_p, ":%s ENCAP %s SASL %s %s C %s", me.id, agent_p->servptr->name,
	170	source_p->id, agent_p->id, message);
	171
	172	rb_free(message);
	173	}
212380e3 AC	174	else if(*parv[3] == 'D')
	175	{
	176	if(*parv[4] == 'F')
	177	sendto_one(target_p, form_str(ERR_SASLFAIL), me.name, EmptyString(target_p->name) ? "*" : target_p->name);
	178	else if(*parv[4] == 'S') {
	179	sendto_one(target_p, form_str(RPL_SASLSUCCESS), me.name, EmptyString(target_p->name) ? "*" : target_p->name);
	180	target_p->preClient->sasl_complete = 1;
47adde3d	181	ServerStats.is_ssuc++;
212380e3 AC	182	}
	183	target_p->preClient->sasl_agent = '\0'; / Blank the stored agent so someone else can answer */
	184	}
	185
	186	return 0;
	187	}
	188
	189	/* If the client never finished authenticating but is
	190	* registering anyway, abort the exchange.
	191	*/
	192	static void
	193	abort_sasl(struct Client *data)
	194	{
	195	if(data->preClient->sasl_out == 0 \|\| data->preClient->sasl_complete)
	196	return;
	197
	198	data->preClient->sasl_out = data->preClient->sasl_complete = 0;
47adde3d	199	ServerStats.is_sbad++;
212380e3 AC	200
	201	if(!IsClosing(data))
	202	sendto_one(data, form_str(ERR_SASLABORTED), me.name, EmptyString(data->name) ? "*" : data->name);
	203
	204	if(*data->preClient->sasl_agent)
	205	{
	206	struct Client *agent_p = find_id(data->preClient->sasl_agent);
	207	if(agent_p)
	208	{
	209	sendto_one(agent_p, ":%s ENCAP %s SASL %s %s D A", me.id, agent_p->servptr->name,
	210	data->id, agent_p->id);
	211	return;
	212	}
	213	}
	214
	215	sendto_server(NULL, NULL, CAP_TS6\|CAP_ENCAP, NOCAPS, ":%s ENCAP * SASL %s * D A", me.id,
	216	data->id);
	217	}
	218
	219	static void
	220	abort_sasl_exit(hook_data_client_exit *data)
	221	{
	222	if (data->target->preClient)
	223	abort_sasl(data->target);
	224	}
	225