]>
Commit | Line | Data |
---|---|---|
212380e3 AC |
1 | /* |
2 | * charybdis: A slightly useful ircd. | |
3 | * blacklist.c: Manages DNS blacklist entries and lookups | |
4 | * | |
0a1e77c2 | 5 | * Copyright (C) 2006-2011 charybdis development team |
212380e3 AC |
6 | * |
7 | * Redistribution and use in source and binary forms, with or without | |
8 | * modification, are permitted provided that the following conditions are | |
9 | * met: | |
10 | * | |
11 | * 1. Redistributions of source code must retain the above copyright notice, | |
12 | * this list of conditions and the following disclaimer. | |
13 | * | |
14 | * 2. Redistributions in binary form must reproduce the above copyright | |
15 | * notice, this list of conditions and the following disclaimer in the | |
16 | * documentation and/or other materials provided with the distribution. | |
17 | * | |
18 | * 3. The name of the author may not be used to endorse or promote products | |
19 | * derived from this software without specific prior written permission. | |
20 | * | |
21 | * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR | |
22 | * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED | |
23 | * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE | |
24 | * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, | |
25 | * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES | |
26 | * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR | |
27 | * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | |
28 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, | |
29 | * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING | |
30 | * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE | |
31 | * POSSIBILITY OF SUCH DAMAGE. | |
212380e3 AC |
32 | */ |
33 | ||
34 | #include "stdinc.h" | |
35 | #include "client.h" | |
1d02144f | 36 | #include "dns.h" |
212380e3 AC |
37 | #include "numeric.h" |
38 | #include "reject.h" | |
39 | #include "s_conf.h" | |
40 | #include "s_user.h" | |
41 | #include "blacklist.h" | |
77d3d2db | 42 | #include "send.h" |
212380e3 | 43 | |
b2f0da88 | 44 | rb_dlink_list blacklist_list = { NULL, NULL, 0 }; |
212380e3 AC |
45 | |
46 | /* private interfaces */ | |
47 | static struct Blacklist *find_blacklist(char *name) | |
48 | { | |
b2f0da88 | 49 | rb_dlink_node *nptr; |
212380e3 | 50 | |
b2f0da88 | 51 | RB_DLINK_FOREACH(nptr, blacklist_list.head) |
212380e3 AC |
52 | { |
53 | struct Blacklist *blptr = (struct Blacklist *) nptr->data; | |
54 | ||
55 | if (!irccmp(blptr->host, name)) | |
56 | return blptr; | |
57 | } | |
58 | ||
59 | return NULL; | |
60 | } | |
61 | ||
1d02144f | 62 | static inline int blacklist_check_reply(struct BlacklistClient *blcptr, const char *ipaddr) |
3c93d380 EM |
63 | { |
64 | struct Blacklist *blptr = blcptr->blacklist; | |
1d02144f | 65 | const char *lastoctet; |
3c93d380 EM |
66 | rb_dlink_node *ptr; |
67 | ||
3c93d380 EM |
68 | /* No filters and entry found - thus positive match */ |
69 | if (!rb_dlink_list_length(&blptr->filters)) | |
70 | return 1; | |
71 | ||
3c93d380 EM |
72 | /* Below will prolly have to change too if the above changes */ |
73 | if ((lastoctet = strrchr(ipaddr, '.')) == NULL || *(++lastoctet) == '\0') | |
74 | goto blwarn; | |
75 | ||
76 | RB_DLINK_FOREACH(ptr, blcptr->blacklist->filters.head) | |
77 | { | |
78 | struct BlacklistFilter *filter = ptr->data; | |
1d02144f | 79 | const char *cmpstr; |
3c93d380 EM |
80 | |
81 | if (filter->type == BLACKLIST_FILTER_ALL) | |
82 | cmpstr = ipaddr; | |
83 | else if (filter->type == BLACKLIST_FILTER_LAST) | |
84 | cmpstr = lastoctet; | |
85 | else | |
86 | { | |
87 | sendto_realops_snomask(SNO_GENERAL, L_ALL, | |
88 | "blacklist_check_reply(): Unknown filtertype (BUG!)"); | |
89 | continue; | |
90 | } | |
91 | ||
92 | if (strcmp(cmpstr, filter->filterstr) == 0) | |
93 | /* Match! */ | |
94 | return 1; | |
95 | } | |
96 | ||
97 | return 0; | |
98 | blwarn: | |
99 | if (blcptr->blacklist->lastwarning + 3600 < rb_current_time()) | |
100 | { | |
101 | sendto_realops_snomask(SNO_GENERAL, L_ALL, | |
102 | "Garbage reply from blacklist %s", | |
103 | blcptr->blacklist->host); | |
104 | blcptr->blacklist->lastwarning = rb_current_time(); | |
105 | } | |
106 | return 0; | |
107 | } | |
108 | ||
1d02144f | 109 | static void blacklist_dns_callback(const char *result, int status, int aftype, void *vptr) |
212380e3 AC |
110 | { |
111 | struct BlacklistClient *blcptr = (struct BlacklistClient *) vptr; | |
07554369 | 112 | bool listed = false; |
212380e3 AC |
113 | |
114 | if (blcptr == NULL || blcptr->client_p == NULL) | |
115 | return; | |
116 | ||
117 | if (blcptr->client_p->preClient == NULL) | |
118 | { | |
119 | sendto_realops_snomask(SNO_GENERAL, L_ALL, | |
120 | "blacklist_dns_callback(): blcptr->client_p->preClient (%s) is NULL", get_client_name(blcptr->client_p, HIDE_IP)); | |
637c4932 | 121 | rb_free(blcptr); |
212380e3 AC |
122 | return; |
123 | } | |
124 | ||
1d02144f | 125 | if (result != NULL && status) |
137d856d | 126 | { |
1d02144f | 127 | if (blacklist_check_reply(blcptr, result)) |
07554369 | 128 | listed = true; |
137d856d JT |
129 | } |
130 | ||
212380e3 | 131 | /* they have a blacklist entry for this client */ |
137d856d | 132 | if (listed && blcptr->client_p->preClient->dnsbl_listed == NULL) |
212380e3 AC |
133 | { |
134 | blcptr->client_p->preClient->dnsbl_listed = blcptr->blacklist; | |
135 | /* reference to blacklist moves from blcptr to client_p->preClient... */ | |
136 | } | |
137 | else | |
138 | unref_blacklist(blcptr->blacklist); | |
139 | ||
b2f0da88 | 140 | rb_dlinkDelete(&blcptr->node, &blcptr->client_p->preClient->dnsbl_queries); |
212380e3 AC |
141 | |
142 | /* yes, it can probably happen... */ | |
b2f0da88 | 143 | if (rb_dlink_list_length(&blcptr->client_p->preClient->dnsbl_queries) == 0 && blcptr->client_p->flags & FLAGS_SENTUSER && !EmptyString(blcptr->client_p->name)) |
21251822 | 144 | register_local_user(blcptr->client_p, blcptr->client_p); |
212380e3 | 145 | |
637c4932 | 146 | rb_free(blcptr); |
212380e3 AC |
147 | } |
148 | ||
212380e3 AC |
149 | static void initiate_blacklist_dnsquery(struct Blacklist *blptr, struct Client *client_p) |
150 | { | |
eddc2ab6 | 151 | struct BlacklistClient *blcptr = rb_malloc(sizeof(struct BlacklistClient)); |
db3efb7a | 152 | char buf[IRCD_RES_HOSTLEN + 1]; |
5d21ef50 | 153 | uint8_t *ip; |
212380e3 AC |
154 | |
155 | blcptr->blacklist = blptr; | |
156 | blcptr->client_p = client_p; | |
157 | ||
cdf5ed6c | 158 | /* IPv4 */ |
1d90b085 | 159 | if ((GET_SS_FAMILY(&client_p->localClient->ip) == AF_INET) && blptr->ipv4) |
0a1e77c2 EM |
160 | { |
161 | ip = (uint8_t *)&((struct sockaddr_in *)&client_p->localClient->ip)->sin_addr.s_addr; | |
162 | ||
163 | /* becomes 2.0.0.127.torbl.ahbl.org or whatever */ | |
5203cba5 | 164 | snprintf(buf, sizeof buf, "%d.%d.%d.%d.%s", |
0a1e77c2 EM |
165 | (unsigned int) ip[3], |
166 | (unsigned int) ip[2], | |
167 | (unsigned int) ip[1], | |
168 | (unsigned int) ip[0], | |
169 | blptr->host); | |
170 | } | |
1d90b085 | 171 | #ifdef RB_IPV6 |
cdf5ed6c | 172 | /* IPv6 */ |
1d90b085 | 173 | else if ((GET_SS_FAMILY(&client_p->localClient->ip) == AF_INET6) && blptr->ipv6) |
0a1e77c2 | 174 | { |
cdf5ed6c EM |
175 | /* Split up for rDNS lookup |
176 | * ex: ip[0] = 0x00, ip[1] = 0x00... ip[16] = 0x01 for localhost | |
177 | * Giving us: | |
178 | * 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.foobl.invalid | |
179 | * or something like that. | |
180 | */ | |
0a1e77c2 EM |
181 | ip = (uint8_t *)&((struct sockaddr_in6 *)&client_p->localClient->ip)->sin6_addr.s6_addr; |
182 | char *bufptr = buf; | |
183 | int i; | |
184 | ||
0a1e77c2 | 185 | /* Going backwards */ |
cdf5ed6c | 186 | for (i = 15; i >= 0; i--, bufptr += 4) |
0a1e77c2 | 187 | { |
cdf5ed6c | 188 | /* Get upper and lower nibbles */ |
0a1e77c2 EM |
189 | uint8_t hi = (ip[i] >> 4) & 0x0F; |
190 | uint8_t lo = ip[i] & 0x0F; | |
191 | ||
cdf5ed6c | 192 | /* One part... 4 chars + terminator */ |
5203cba5 | 193 | snprintf(bufptr, 5, "%1x.%1x.", |
0a1e77c2 EM |
194 | (unsigned int) lo, /* Remember, backwards */ |
195 | (unsigned int) hi); | |
0a1e77c2 | 196 | } |
212380e3 | 197 | |
0a1e77c2 EM |
198 | /* Tack host on */ |
199 | strcpy(bufptr, blptr->host); | |
200 | } | |
1d90b085 | 201 | #endif |
0a1e77c2 EM |
202 | /* This shouldn't happen... */ |
203 | else | |
204 | return; | |
212380e3 | 205 | |
1d02144f | 206 | blcptr->dns_id = lookup_hostname(buf, AF_INET, blacklist_dns_callback, blcptr); |
212380e3 | 207 | |
b2f0da88 | 208 | rb_dlinkAdd(blcptr, &blcptr->node, &client_p->preClient->dnsbl_queries); |
212380e3 AC |
209 | blptr->refcount++; |
210 | } | |
211 | ||
212 | /* public interfaces */ | |
3c93d380 | 213 | struct Blacklist *new_blacklist(char *name, char *reject_reason, int ipv4, int ipv6, rb_dlink_list *filters) |
212380e3 AC |
214 | { |
215 | struct Blacklist *blptr; | |
216 | ||
217 | if (name == NULL || reject_reason == NULL) | |
218 | return NULL; | |
219 | ||
220 | blptr = find_blacklist(name); | |
221 | if (blptr == NULL) | |
222 | { | |
eddc2ab6 | 223 | blptr = rb_malloc(sizeof(struct Blacklist)); |
b2f0da88 | 224 | rb_dlinkAddAlloc(blptr, &blacklist_list); |
212380e3 AC |
225 | } |
226 | else | |
227 | blptr->status &= ~CONF_ILLEGAL; | |
3c93d380 | 228 | |
db3efb7a | 229 | rb_strlcpy(blptr->host, name, IRCD_RES_HOSTLEN + 1); |
82236a2a | 230 | rb_strlcpy(blptr->reject_reason, reject_reason, BUFSIZE); |
0a1e77c2 EM |
231 | blptr->ipv4 = ipv4; |
232 | blptr->ipv6 = ipv6; | |
3c93d380 EM |
233 | |
234 | rb_dlinkMoveList(filters, &blptr->filters); | |
235 | ||
96274734 | 236 | blptr->lastwarning = 0; |
212380e3 AC |
237 | |
238 | return blptr; | |
239 | } | |
240 | ||
241 | void unref_blacklist(struct Blacklist *blptr) | |
242 | { | |
3c93d380 EM |
243 | rb_dlink_node *ptr, *next_ptr; |
244 | ||
212380e3 AC |
245 | blptr->refcount--; |
246 | if (blptr->status & CONF_ILLEGAL && blptr->refcount <= 0) | |
247 | { | |
3c93d380 EM |
248 | RB_DLINK_FOREACH_SAFE(ptr, next_ptr, blptr->filters.head) |
249 | { | |
3c93d380 | 250 | rb_dlinkDelete(ptr, &blptr->filters); |
b84e58f9 | 251 | rb_free(ptr); |
3c93d380 EM |
252 | } |
253 | ||
b2f0da88 | 254 | rb_dlinkFindDestroy(blptr, &blacklist_list); |
637c4932 | 255 | rb_free(blptr); |
212380e3 AC |
256 | } |
257 | } | |
258 | ||
259 | void lookup_blacklists(struct Client *client_p) | |
260 | { | |
b2f0da88 | 261 | rb_dlink_node *nptr; |
212380e3 | 262 | |
b2f0da88 | 263 | RB_DLINK_FOREACH(nptr, blacklist_list.head) |
212380e3 AC |
264 | { |
265 | struct Blacklist *blptr = (struct Blacklist *) nptr->data; | |
266 | ||
267 | if (!(blptr->status & CONF_ILLEGAL)) | |
268 | initiate_blacklist_dnsquery(blptr, client_p); | |
269 | } | |
270 | } | |
271 | ||
272 | void abort_blacklist_queries(struct Client *client_p) | |
273 | { | |
637c4932 | 274 | rb_dlink_node *ptr, *next_ptr; |
212380e3 AC |
275 | struct BlacklistClient *blcptr; |
276 | ||
277 | if (client_p->preClient == NULL) | |
278 | return; | |
637c4932 | 279 | RB_DLINK_FOREACH_SAFE(ptr, next_ptr, client_p->preClient->dnsbl_queries.head) |
212380e3 AC |
280 | { |
281 | blcptr = ptr->data; | |
b2f0da88 | 282 | rb_dlinkDelete(&blcptr->node, &client_p->preClient->dnsbl_queries); |
212380e3 | 283 | unref_blacklist(blcptr->blacklist); |
1d02144f | 284 | cancel_lookup(blcptr->dns_id); |
637c4932 | 285 | rb_free(blcptr); |
212380e3 AC |
286 | } |
287 | } | |
288 | ||
289 | void destroy_blacklists(void) | |
290 | { | |
637c4932 | 291 | rb_dlink_node *ptr, *next_ptr; |
212380e3 AC |
292 | struct Blacklist *blptr; |
293 | ||
637c4932 | 294 | RB_DLINK_FOREACH_SAFE(ptr, next_ptr, blacklist_list.head) |
212380e3 AC |
295 | { |
296 | blptr = ptr->data; | |
297 | blptr->hits = 0; /* keep it simple and consistent */ | |
298 | if (blptr->refcount > 0) | |
299 | blptr->status |= CONF_ILLEGAL; | |
300 | else | |
301 | { | |
637c4932 | 302 | rb_free(ptr->data); |
b2f0da88 | 303 | rb_dlinkDestroy(ptr, &blacklist_list); |
212380e3 AC |
304 | } |
305 | } | |
306 | } |