[solanum.git] / authd / provider.c

/* authd/provider.c - authentication provider framework
 * Copyright (c) 2016 Elizabeth Myers <elizabeth@interlinked.me>
 *
 * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice is present in all copies.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 */

/* The basic design here is to have "authentication providers" that do things
 * like query ident and blacklists and even open proxies.
 *
 * Providers are registered in the auth_providers linked list. It is planned to
 * use a bitmap to store provider ID's later.
 *
 * Providers can either return failure immediately, immediate acceptance, or do
 * work in the background (calling set_provider to signal this).
 *
 * Provider-specific data for each client can be kept in an index of the data
 * struct member (using the provider's ID).
 *
 * All providers must implement at a minimum a perform_provider function. You
 * don't have to implement the others if you don't need them.
 *
 * Providers may kick clients off by rejecting them. Upon rejection, all
 * providers are cancelled. They can also unconditionally accept them.
 *
 * When a provider is done and is neutral on accepting/rejecting a client, it
 * should call provider_done. Do NOT call this if you have accepted or rejected
 * the client.
 *
 * Eventually, stuff like *:line handling will be moved here, but that means we
 * have to talk to bandb directly first.
 *
 * --Elizafox, 9 March 2016
 */

#include "stdinc.h"
#include "rb_dictionary.h"
#include "authd.h"
#include "provider.h"
#include "notice.h"

static EVH provider_timeout_event;

rb_dlink_list auth_providers;

/* Clients waiting */
rb_dictionary *auth_clients;

static struct ev_entry *timeout_ev;

/* Load a provider */
void
load_provider(struct auth_provider *provider)
{
	if(rb_dlink_list_length(&auth_providers) >= MAX_PROVIDERS)
	{
		warn_opers(L_WARN, "provider: cannot load provider with id %d: maximum reached (%d)",
				provider->id, MAX_PROVIDERS);
		return;
	}

	if(provider->opt_handlers != NULL)
	{
		struct auth_opts_handler *handler;

		for(handler = provider->opt_handlers; handler->option != NULL; handler++)
			rb_dictionary_add(authd_option_handlers, handler->option, handler);
	}

	if(provider->stats_handler.letter != '\0')
		authd_stat_handlers[provider->stats_handler.letter] = provider->stats_handler.handler;

	if(provider->init != NULL)
		provider->init();

	rb_dlinkAdd(provider, &provider->node, &auth_providers);
}

void
unload_provider(struct auth_provider *provider)
{
	if(provider->opt_handlers != NULL)
	{
		struct auth_opts_handler *handler;

		for(handler = provider->opt_handlers; handler->option != NULL; handler++)
			rb_dictionary_delete(authd_option_handlers, handler->option);
	}

	if(provider->stats_handler.letter != '\0')
		authd_stat_handlers[provider->stats_handler.letter] = NULL;

	if(provider->destroy != NULL)
		provider->destroy();

	rb_dlinkDelete(&provider->node, &auth_providers);
}

/* Initalise all providers */
void
init_providers(void)
{
	auth_clients = rb_dictionary_create("pending auth clients", rb_uint32cmp);
	timeout_ev = rb_event_addish("provider_timeout_event", provider_timeout_event, NULL, 1);
	load_provider(&rdns_provider);
	load_provider(&ident_provider);
	load_provider(&blacklist_provider);
	load_provider(&opm_provider);
}

/* Terminate all providers */
void
destroy_providers(void)
{
	rb_dlink_node *ptr;
	rb_dictionary_iter iter;
	struct auth_client *auth;
	struct auth_provider *provider;

	/* Cancel outstanding connections */
	RB_DICTIONARY_FOREACH(auth, &iter, auth_clients)
	{
		/* TBD - is this the right thing? */
		reject_client(auth, -1, "destroy", "Authentication system is down... try reconnecting in a few seconds");
	}

	RB_DLINK_FOREACH(ptr, auth_providers.head)
	{
		provider = ptr->data;

		if(provider->destroy)
			provider->destroy();
	}

	rb_event_delete(timeout_ev);
}

/* Cancel outstanding providers for a client */
void
cancel_providers(struct auth_client *auth)
{
	rb_dlink_node *ptr;
	struct auth_provider *provider;

	RB_DLINK_FOREACH(ptr, auth_providers.head)
	{
		provider = ptr->data;

		if(provider->cancel && is_provider_on(auth, provider->id))
			/* Cancel if required */
			provider->cancel(auth);
	}

	rb_dictionary_delete(auth_clients, RB_UINT_TO_POINTER(auth->cid));
	rb_free(auth);
}

/* Provider is done - WARNING: do not use auth instance after calling! */
void
provider_done(struct auth_client *auth, provider_t id)
{
	rb_dlink_node *ptr;
	struct auth_provider *provider;

	set_provider_off(auth, id);
	set_provider_done(auth, id);

	if(!auth->providers)
	{
		if(!auth->providers_starting)
			/* Only do this when there are no providers left */
			accept_client(auth, -1);
		return;
	}

	RB_DLINK_FOREACH(ptr, auth_providers.head)
	{
		provider = ptr->data;

		if(provider->completed != NULL && is_provider_on(auth, provider->id))
			/* Notify pending clients who asked for it */
			provider->completed(auth, id);
	}
}

/* Reject a client - WARNING: do not use auth instance after calling! */
void
reject_client(struct auth_client *auth, provider_t id, const char *data, const char *fmt, ...)
{
	char reject;
	char buf[BUFSIZE];
	va_list args;

	switch(id)
	{
	case PROVIDER_RDNS:
		reject = 'D';
		break;
	case PROVIDER_IDENT:
		reject = 'I';
		break;
	case PROVIDER_BLACKLIST:
		reject = 'B';
		break;
	default:
		reject = 'N';
		break;
	}

	if(data == NULL)
		data = "*";

	va_start(args, fmt);
	vsnprintf(buf, sizeof(buf), fmt, args);
	va_end(args);

	/* We send back username and hostname in case ircd wants to overrule our decision.
	 * In the future this may not be the case.
	 * --Elizafox
	 */
	rb_helper_write(authd_helper, "R %x %c %s %s %s :%s", auth->cid, reject, auth->username, auth->hostname, data, buf);

	set_provider_off(auth, id);
	cancel_providers(auth);
}

/* Accept a client, cancel outstanding providers if any - WARNING: do nto use auth instance after calling! */
void
accept_client(struct auth_client *auth, provider_t id)
{
	rb_helper_write(authd_helper, "A %x %s %s", auth->cid, auth->username, auth->hostname);

	set_provider_off(auth, id);
	cancel_providers(auth);
}

/* Begin authenticating user */
static void
start_auth(const char *cid, const char *l_ip, const char *l_port, const char *c_ip, const char *c_port)
{
	struct auth_provider *provider;
	struct auth_client *auth = rb_malloc(sizeof(struct auth_client));
	long lcid = strtol(cid, NULL, 16);
	rb_dlink_node *ptr;

	if(lcid >= UINT32_MAX)
		return;

	auth->cid = (uint32_t)lcid;

	if(rb_dictionary_find(auth_clients, RB_UINT_TO_POINTER(auth->cid)) == NULL)
		rb_dictionary_add(auth_clients, RB_UINT_TO_POINTER(auth->cid), auth);
	else
	{
		warn_opers(L_CRIT, "provider: duplicate client added via start_auth: %x", auth->cid);
		exit(EX_PROVIDER_ERROR);
	}

	rb_strlcpy(auth->l_ip, l_ip, sizeof(auth->l_ip));
	auth->l_port = (uint16_t)atoi(l_port);	/* should be safe */
	(void) rb_inet_pton_sock(l_ip, (struct sockaddr *)&auth->l_addr);

	rb_strlcpy(auth->c_ip, c_ip, sizeof(auth->c_ip));
	auth->c_port = (uint16_t)atoi(c_port);
	(void) rb_inet_pton_sock(c_ip, (struct sockaddr *)&auth->c_addr);

#ifdef RB_IPV6
	if(GET_SS_FAMILY(&auth->l_addr) == AF_INET6)
		((struct sockaddr_in6 *)&auth->l_addr)->sin6_port = htons(auth->l_port);
	else
#endif
		((struct sockaddr_in *)&auth->l_addr)->sin_port = htons(auth->l_port);

#ifdef RB_IPV6
	if(GET_SS_FAMILY(&auth->c_addr) == AF_INET6)
		((struct sockaddr_in6 *)&auth->c_addr)->sin6_port = htons(auth->c_port);
	else
#endif
		((struct sockaddr_in *)&auth->c_addr)->sin_port = htons(auth->c_port);

	rb_strlcpy(auth->hostname, "*", sizeof(auth->hostname));
	rb_strlcpy(auth->username, "*", sizeof(auth->username));

	memset(auth->data, 0, sizeof(auth->data));

	auth->providers_starting = true;
	RB_DLINK_FOREACH(ptr, auth_providers.head)
	{
		provider = ptr->data;

		lrb_assert(provider->start != NULL);

		/* Execute providers */
		if(!provider->start(auth))
		{
			/* Rejected immediately */
			cancel_providers(auth);
			return;
		}
	}
	auth->providers_starting = false;

	/* If no providers are running, accept the client */
	if(!auth->providers)
		accept_client(auth, -1);
}

/* Callback for the initiation */
void
handle_new_connection(int parc, char *parv[])
{
	if(parc < 6)
	{
		warn_opers(L_CRIT, "provider: received too few params for new connection (6 expected, got %d)", parc);
		exit(EX_PROVIDER_ERROR);
	}

	start_auth(parv[1], parv[2], parv[3], parv[4], parv[5]);
}

void
handle_cancel_connection(int parc, char *parv[])
{
	struct auth_client *auth;
	long lcid;

	if(parc < 2)
	{
		warn_opers(L_CRIT, "provider: received too few params for new connection (2 expected, got %d)", parc);
		exit(EX_PROVIDER_ERROR);
	}

	if((lcid = strtol(parv[1], NULL, 16)) > UINT32_MAX)
	{
		warn_opers(L_CRIT, "provider: got a request to cancel a connection that can't exist: %lx", lcid);
		exit(EX_PROVIDER_ERROR);
	}

	if((auth = rb_dictionary_retrieve(auth_clients, RB_UINT_TO_POINTER((uint32_t)lcid))) == NULL)
	{
		warn_opers(L_CRIT, "provider: tried to cancel nonexistent connection %lx", lcid);
		exit(EX_PROVIDER_ERROR);
	}

	cancel_providers(auth);
}

static void
provider_timeout_event(void *notused __unused)
{
	struct auth_client *auth;
	rb_dictionary_iter iter;
	const time_t curtime = rb_current_time();

	RB_DICTIONARY_FOREACH(auth, &iter, auth_clients)
	{
		rb_dlink_node *ptr;

		RB_DLINK_FOREACH(ptr, auth_providers.head)
		{
			struct auth_provider *provider = ptr->data;
			const time_t timeout = auth->timeout[provider->id];

			if(is_provider_on(auth, provider->id) && provider->timeout != NULL &&
				timeout > 0 && timeout < curtime)
			{
				provider->timeout(auth);
			}
		}
	}
}
Commit	Line	Data
2b0cc3d3 EM	1	/* authd/provider.c - authentication provider framework
	2	* Copyright (c) 2016 Elizabeth Myers <elizabeth@interlinked.me>
	3	*
	4	* Permission to use, copy, modify, and/or distribute this software for any
	5	* purpose with or without fee is hereby granted, provided that the above
	6	* copyright notice and this permission notice is present in all copies.
	7	*
	8	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
	9	* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
	10	* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
	11	* DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
	12	* INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
	13	* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
	14	* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	15	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
	16	* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
	17	* IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
	18	* POSSIBILITY OF SUCH DAMAGE.
	19	*/
	20
89d22b9a EM	21	/* The basic design here is to have "authentication providers" that do things
89d22b9a EM	22	* like query ident and blacklists and even open proxies.
2b0cc3d3	23	*
f7b37c1d EM	24	* Providers are registered in the auth_providers linked list. It is planned to
f7b37c1d EM	25	* use a bitmap to store provider ID's later.
2b0cc3d3	26	*
89d22b9a EM	27	* Providers can either return failure immediately, immediate acceptance, or do
89d22b9a EM	28	* work in the background (calling set_provider to signal this).
2b0cc3d3	29	*
3e875f62 EM	30	* Provider-specific data for each client can be kept in an index of the data
3e875f62 EM	31	* struct member (using the provider's ID).
2b0cc3d3 EM	32	*
	33	* All providers must implement at a minimum a perform_provider function. You
	34	* don't have to implement the others if you don't need them.
	35	*
	36	* Providers may kick clients off by rejecting them. Upon rejection, all
	37	* providers are cancelled. They can also unconditionally accept them.
	38	*
	39	* When a provider is done and is neutral on accepting/rejecting a client, it
	40	* should call provider_done. Do NOT call this if you have accepted or rejected
	41	* the client.
	42	*
89d22b9a EM	43	* Eventually, stuff like *:line handling will be moved here, but that means we
	44	* have to talk to bandb directly first.
	45	*
2b0cc3d3 EM	46	* --Elizafox, 9 March 2016
	47	*/
	48
52d49164	49	#include "stdinc.h"
46d17a88	50	#include "rb_dictionary.h"
2b0cc3d3 EM	51	#include "authd.h"
2b0cc3d3 EM	52	#include "provider.h"
db821ee9	53	#include "notice.h"
2b0cc3d3	54
15c49abb EM	55	static EVH provider_timeout_event;
15c49abb EM	56
2b0cc3d3 EM	57	rb_dlink_list auth_providers;
	58
	59	/* Clients waiting */
aba29d5a	60	rb_dictionary *auth_clients;
2b0cc3d3	61
15c49abb EM	62	static struct ev_entry *timeout_ev;
15c49abb EM	63
2b0cc3d3	64	/* Load a provider */
60374ac9 EM	65	void
60374ac9 EM	66	load_provider(struct auth_provider *provider)
2b0cc3d3	67	{
3e875f62	68	if(rb_dlink_list_length(&auth_providers) >= MAX_PROVIDERS)
b2ede1aa	69	{
c23f9755 EM	70	warn_opers(L_WARN, "provider: cannot load provider with id %d: maximum reached (%d)",
c23f9755 EM	71	provider->id, MAX_PROVIDERS);
3e875f62	72	return;
b2ede1aa	73	}
3e875f62	74
a51487e0 EM	75	if(provider->opt_handlers != NULL)
	76	{
	77	struct auth_opts_handler *handler;
	78
	79	for(handler = provider->opt_handlers; handler->option != NULL; handler++)
	80	rb_dictionary_add(authd_option_handlers, handler->option, handler);
	81	}
	82
ee7f9271 EM	83	if(provider->stats_handler.letter != '\0')
	84	authd_stat_handlers[provider->stats_handler.letter] = provider->stats_handler.handler;
	85
9f9ab5c2 EM	86	if(provider->init != NULL)
	87	provider->init();
	88
2b0cc3d3 EM	89	rb_dlinkAdd(provider, &provider->node, &auth_providers);
	90	}
	91
60374ac9 EM	92	void
60374ac9 EM	93	unload_provider(struct auth_provider *provider)
2b0cc3d3	94	{
a51487e0 EM	95	if(provider->opt_handlers != NULL)
	96	{
	97	struct auth_opts_handler *handler;
	98
	99	for(handler = provider->opt_handlers; handler->option != NULL; handler++)
	100	rb_dictionary_delete(authd_option_handlers, handler->option);
	101	}
ee7f9271 EM	102
	103	if(provider->stats_handler.letter != '\0')
	104	authd_stat_handlers[provider->stats_handler.letter] = NULL;
	105
9f9ab5c2 EM	106	if(provider->destroy != NULL)
	107	provider->destroy();
	108
2b0cc3d3 EM	109	rb_dlinkDelete(&provider->node, &auth_providers);
	110	}
	111
	112	/* Initalise all providers */
60374ac9 EM	113	void
60374ac9 EM	114	init_providers(void)
2b0cc3d3	115	{
3e875f62	116	auth_clients = rb_dictionary_create("pending auth clients", rb_uint32cmp);
15c49abb	117	timeout_ev = rb_event_addish("provider_timeout_event", provider_timeout_event, NULL, 1);
2b0cc3d3 EM	118	load_provider(&rdns_provider);
2b0cc3d3 EM	119	load_provider(&ident_provider);
f5586c3a	120	load_provider(&blacklist_provider);
4e85459a	121	load_provider(&opm_provider);
2b0cc3d3 EM	122	}
	123
	124	/* Terminate all providers */
60374ac9 EM	125	void
60374ac9 EM	126	destroy_providers(void)
2b0cc3d3 EM	127	{
2b0cc3d3 EM	128	rb_dlink_node *ptr;
aba29d5a	129	rb_dictionary_iter iter;
3e875f62	130	struct auth_client *auth;
2b0cc3d3 EM	131	struct auth_provider *provider;
	132
	133	/* Cancel outstanding connections */
a52c7a8e	134	RB_DICTIONARY_FOREACH(auth, &iter, auth_clients)
2b0cc3d3	135	{
3e875f62	136	/* TBD - is this the right thing? */
6535177f	137	reject_client(auth, -1, "destroy", "Authentication system is down... try reconnecting in a few seconds");
2b0cc3d3 EM	138	}
	139
	140	RB_DLINK_FOREACH(ptr, auth_providers.head)
	141	{
	142	provider = ptr->data;
	143
	144	if(provider->destroy)
	145	provider->destroy();
	146	}
c23f9755 EM	147
c23f9755 EM	148	rb_event_delete(timeout_ev);
2b0cc3d3 EM	149	}
	150
	151	/* Cancel outstanding providers for a client */
60374ac9 EM	152	void
60374ac9 EM	153	cancel_providers(struct auth_client *auth)
2b0cc3d3 EM	154	{
	155	rb_dlink_node *ptr;
	156	struct auth_provider *provider;
	157
	158	RB_DLINK_FOREACH(ptr, auth_providers.head)
	159	{
	160	provider = ptr->data;
	161
a7d5aea1	162	if(provider->cancel && is_provider_on(auth, provider->id))
2b0cc3d3 EM	163	/* Cancel if required */
	164	provider->cancel(auth);
	165	}
46d17a88	166
3e875f62 EM	167	rb_dictionary_delete(auth_clients, RB_UINT_TO_POINTER(auth->cid));
3e875f62 EM	168	rb_free(auth);
2b0cc3d3 EM	169	}
2b0cc3d3 EM	170
420cfb67	171	/* Provider is done - WARNING: do not use auth instance after calling! */
60374ac9 EM	172	void
60374ac9 EM	173	provider_done(struct auth_client *auth, provider_t id)
2b0cc3d3 EM	174	{
	175	rb_dlink_node *ptr;
	176	struct auth_provider *provider;
	177
a7d5aea1 EM	178	set_provider_off(auth, id);
a7d5aea1 EM	179	set_provider_done(auth, id);
2b0cc3d3 EM	180
	181	if(!auth->providers)
	182	{
05fdc030 EM	183	if(!auth->providers_starting)
05fdc030 EM	184	/* Only do this when there are no providers left */
6535177f	185	accept_client(auth, -1);
2b0cc3d3 EM	186	return;
	187	}
	188
	189	RB_DLINK_FOREACH(ptr, auth_providers.head)
	190	{
	191	provider = ptr->data;
	192
9f9ab5c2	193	if(provider->completed != NULL && is_provider_on(auth, provider->id))
2b0cc3d3 EM	194	/* Notify pending clients who asked for it */
	195	provider->completed(auth, id);
	196	}
	197	}
	198
420cfb67	199	/* Reject a client - WARNING: do not use auth instance after calling! */
60374ac9	200	void
64afc358	201	reject_client(struct auth_client auth, provider_t id, const char data, const char *fmt, ...)
2b0cc3d3	202	{
2b0cc3d3	203	char reject;
64afc358 EM	204	char buf[BUFSIZE];
64afc358 EM	205	va_list args;
2b0cc3d3 EM	206
	207	switch(id)
	208	{
	209	case PROVIDER_RDNS:
	210	reject = 'D';
	211	break;
	212	case PROVIDER_IDENT:
	213	reject = 'I';
	214	break;
	215	case PROVIDER_BLACKLIST:
	216	reject = 'B';
	217	break;
2b0cc3d3 EM	218	default:
	219	reject = 'N';
	220	break;
	221	}
	222
6535177f EM	223	if(data == NULL)
	224	data = "*";
	225
a5ab1062	226	va_start(args, fmt);
64afc358 EM	227	vsnprintf(buf, sizeof(buf), fmt, args);
	228	va_end(args);
	229
3ad21f61 EM	230	/* We send back username and hostname in case ircd wants to overrule our decision.
	231	* In the future this may not be the case.
	232	* --Elizafox
	233	*/
64afc358	234	rb_helper_write(authd_helper, "R %x %c %s %s %s :%s", auth->cid, reject, auth->username, auth->hostname, data, buf);
2b0cc3d3	235
a7d5aea1	236	set_provider_off(auth, id);
46d17a88	237	cancel_providers(auth);
2b0cc3d3 EM	238	}
2b0cc3d3 EM	239
420cfb67	240	/* Accept a client, cancel outstanding providers if any - WARNING: do nto use auth instance after calling! */
60374ac9 EM	241	void
60374ac9 EM	242	accept_client(struct auth_client *auth, provider_t id)
2b0cc3d3	243	{
2b0cc3d3 EM	244	rb_helper_write(authd_helper, "A %x %s %s", auth->cid, auth->username, auth->hostname);
2b0cc3d3 EM	245
a7d5aea1	246	set_provider_off(auth, id);
46d17a88	247	cancel_providers(auth);
2b0cc3d3 EM	248	}
2b0cc3d3 EM	249
2b0cc3d3	250	/* Begin authenticating user */
60374ac9 EM	251	static void
60374ac9 EM	252	start_auth(const char cid, const char l_ip, const char l_port, const char c_ip, const char *c_port)
2b0cc3d3 EM	253	{
2b0cc3d3 EM	254	struct auth_provider *provider;
3e875f62	255	struct auth_client *auth = rb_malloc(sizeof(struct auth_client));
2b0cc3d3 EM	256	long lcid = strtol(cid, NULL, 16);
	257	rb_dlink_node *ptr;
	258
3e875f62	259	if(lcid >= UINT32_MAX)
2b0cc3d3 EM	260	return;
2b0cc3d3 EM	261
3e875f62	262	auth->cid = (uint32_t)lcid;
2b0cc3d3	263
05fdc030 EM	264	if(rb_dictionary_find(auth_clients, RB_UINT_TO_POINTER(auth->cid)) == NULL)
	265	rb_dictionary_add(auth_clients, RB_UINT_TO_POINTER(auth->cid), auth);
	266	else
	267	{
c23f9755 EM	268	warn_opers(L_CRIT, "provider: duplicate client added via start_auth: %x", auth->cid);
c23f9755 EM	269	exit(EX_PROVIDER_ERROR);
05fdc030 EM	270	}
05fdc030 EM	271
2b0cc3d3 EM	272	rb_strlcpy(auth->l_ip, l_ip, sizeof(auth->l_ip));
2b0cc3d3 EM	273	auth->l_port = (uint16_t)atoi(l_port); /* should be safe */
32f8c78b	274	(void) rb_inet_pton_sock(l_ip, (struct sockaddr *)&auth->l_addr);
2b0cc3d3 EM	275
	276	rb_strlcpy(auth->c_ip, c_ip, sizeof(auth->c_ip));
	277	auth->c_port = (uint16_t)atoi(c_port);
32f8c78b	278	(void) rb_inet_pton_sock(c_ip, (struct sockaddr *)&auth->c_addr);
9c7498d5 EM	279
	280	#ifdef RB_IPV6
	281	if(GET_SS_FAMILY(&auth->l_addr) == AF_INET6)
32f8c78b	282	((struct sockaddr_in6 *)&auth->l_addr)->sin6_port = htons(auth->l_port);
9c7498d5 EM	283	else
9c7498d5 EM	284	#endif
32f8c78b	285	((struct sockaddr_in *)&auth->l_addr)->sin_port = htons(auth->l_port);
9c7498d5 EM	286
	287	#ifdef RB_IPV6
	288	if(GET_SS_FAMILY(&auth->c_addr) == AF_INET6)
32f8c78b	289	((struct sockaddr_in6 *)&auth->c_addr)->sin6_port = htons(auth->c_port);
9c7498d5 EM	290	else
9c7498d5 EM	291	#endif
32f8c78b	292	((struct sockaddr_in *)&auth->c_addr)->sin_port = htons(auth->c_port);
2b0cc3d3	293
1345a41d EM	294	rb_strlcpy(auth->hostname, "*", sizeof(auth->hostname));
	295	rb_strlcpy(auth->username, "*", sizeof(auth->username));
	296
0cff7adb EM	297	memset(auth->data, 0, sizeof(auth->data));
0cff7adb EM	298
05fdc030	299	auth->providers_starting = true;
2b0cc3d3 EM	300	RB_DLINK_FOREACH(ptr, auth_providers.head)
	301	{
	302	provider = ptr->data;
	303
05fdc030 EM	304	lrb_assert(provider->start != NULL);
05fdc030 EM	305
2b0cc3d3 EM	306	/* Execute providers */
	307	if(!provider->start(auth))
	308	{
	309	/* Rejected immediately */
	310	cancel_providers(auth);
	311	return;
	312	}
	313	}
05fdc030	314	auth->providers_starting = false;
2b0cc3d3 EM	315
	316	/* If no providers are running, accept the client */
	317	if(!auth->providers)
6535177f	318	accept_client(auth, -1);
2b0cc3d3 EM	319	}
	320
	321	/* Callback for the initiation */
60374ac9 EM	322	void
60374ac9 EM	323	handle_new_connection(int parc, char *parv[])
2b0cc3d3	324	{
0cff7adb	325	if(parc < 6)
b2ede1aa	326	{
c23f9755 EM	327	warn_opers(L_CRIT, "provider: received too few params for new connection (6 expected, got %d)", parc);
c23f9755 EM	328	exit(EX_PROVIDER_ERROR);
b2ede1aa	329	}
2b0cc3d3 EM	330
	331	start_auth(parv[1], parv[2], parv[3], parv[4], parv[5]);
	332	}
60374ac9 EM	333
	334	void
	335	handle_cancel_connection(int parc, char *parv[])
	336	{
	337	struct auth_client *auth;
	338	long lcid;
	339
	340	if(parc < 2)
	341	{
c23f9755 EM	342	warn_opers(L_CRIT, "provider: received too few params for new connection (2 expected, got %d)", parc);
c23f9755 EM	343	exit(EX_PROVIDER_ERROR);
60374ac9 EM	344	}
	345
	346	if((lcid = strtol(parv[1], NULL, 16)) > UINT32_MAX)
	347	{
c23f9755 EM	348	warn_opers(L_CRIT, "provider: got a request to cancel a connection that can't exist: %lx", lcid);
c23f9755 EM	349	exit(EX_PROVIDER_ERROR);
60374ac9 EM	350	}
	351
	352	if((auth = rb_dictionary_retrieve(auth_clients, RB_UINT_TO_POINTER((uint32_t)lcid))) == NULL)
	353	{
c23f9755 EM	354	warn_opers(L_CRIT, "provider: tried to cancel nonexistent connection %lx", lcid);
c23f9755 EM	355	exit(EX_PROVIDER_ERROR);
60374ac9 EM	356	}
	357
	358	cancel_providers(auth);
	359	}
15c49abb EM	360
	361	static void
	362	provider_timeout_event(void *notused __unused)
	363	{
	364	struct auth_client *auth;
	365	rb_dictionary_iter iter;
	366	const time_t curtime = rb_current_time();
	367
	368	RB_DICTIONARY_FOREACH(auth, &iter, auth_clients)
	369	{
	370	rb_dlink_node *ptr;
	371
	372	RB_DLINK_FOREACH(ptr, auth_providers.head)
	373	{
	374	struct auth_provider *provider = ptr->data;
	375	const time_t timeout = auth->timeout[provider->id];
	376
	377	if(is_provider_on(auth, provider->id) && provider->timeout != NULL &&
c23f9755	378	timeout > 0 && timeout < curtime)
15c49abb EM	379	{
	380	provider->timeout(auth);
	381	}
	382	}
	383	}
	384	}