[solanum.git] / authd / provider.c

/* authd/provider.c - authentication provider framework
 * Copyright (c) 2016 Elizabeth Myers <elizabeth@interlinked.me>
 *
 * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice is present in all copies.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 */

/* The basic design here is to have "authentication providers" that do things
 * like query ident and blacklists and even open proxies.
 *
 * Providers are registered in the auth_providers linked list. It is planned to
 * use a bitmap to store provider ID's later.
 *
 * Providers can either return failure immediately, immediate acceptance, or do
 * work in the background (calling set_provider to signal this).
 *
 * Provider-specific data for each client can be kept in an index of the data
 * struct member (using the provider's ID).
 *
 * All providers must implement at a minimum a perform_provider function. You
 * don't have to implement the others if you don't need them.
 *
 * Providers may kick clients off by rejecting them. Upon rejection, all
 * providers are cancelled. They can also unconditionally accept them.
 *
 * When a provider is done and is neutral on accepting/rejecting a client, it
 * should call provider_done. Do NOT call this if you have accepted or rejected
 * the client.
 *
 * Eventually, stuff like *:line handling will be moved here, but that means we
 * have to talk to bandb directly first.
 *
 * --Elizafox, 9 March 2016
 */

#include "rb_dictionary.h"
#include "authd.h"
#include "provider.h"
#include "notice.h"

rb_dlink_list auth_providers;

/* Clients waiting */
rb_dictionary *auth_clients;

/* Load a provider */
void load_provider(struct auth_provider *provider)
{
	if(rb_dlink_list_length(&auth_providers) >= MAX_PROVIDERS)
	{
		warn_opers(L_CRIT, "Exceeded maximum level of authd providers (%d max)", MAX_PROVIDERS);
		return;
	}

	if(provider->opt_handlers != NULL)
	{
		struct auth_opts_handler *handler;

		for(handler = provider->opt_handlers; handler->option != NULL; handler++)
			rb_dictionary_add(authd_option_handlers, handler->option, handler);
	}

	provider->init();
	rb_dlinkAdd(provider, &provider->node, &auth_providers);
}

void unload_provider(struct auth_provider *provider)
{
	if(provider->opt_handlers != NULL)
	{
		struct auth_opts_handler *handler;

		for(handler = provider->opt_handlers; handler->option != NULL; handler++)
			rb_dictionary_delete(authd_option_handlers, handler->option);
	}
	provider->destroy();
	rb_dlinkDelete(&provider->node, &auth_providers);
}

/* Initalise all providers */
void init_providers(void)
{
	auth_clients = rb_dictionary_create("pending auth clients", rb_uint32cmp);
	load_provider(&rdns_provider);
	load_provider(&ident_provider);
	load_provider(&blacklist_provider);
}

/* Terminate all providers */
void destroy_providers(void)
{
	rb_dlink_node *ptr;
	rb_dictionary_iter iter;
	struct auth_client *auth;
	struct auth_provider *provider;

	/* Cancel outstanding connections */
	RB_DICTIONARY_FOREACH(auth, &iter, auth_clients)
	{
		/* TBD - is this the right thing? */
		reject_client(auth, 0, "Authentication system is down... try reconnecting in a few seconds");
	}

	RB_DLINK_FOREACH(ptr, auth_providers.head)
	{
		provider = ptr->data;

		if(provider->destroy)
			provider->destroy();
	}
}

/* Cancel outstanding providers for a client */
void cancel_providers(struct auth_client *auth)
{
	rb_dlink_node *ptr;
	struct auth_provider *provider;

	RB_DLINK_FOREACH(ptr, auth_providers.head)
	{
		provider = ptr->data;

		if(provider->cancel && is_provider_on(auth, provider->id))
			/* Cancel if required */
			provider->cancel(auth);
	}

	rb_dictionary_delete(auth_clients, RB_UINT_TO_POINTER(auth->cid));
	rb_free(auth);
}

/* Provider is done */
void provider_done(struct auth_client *auth, provider_t id)
{
	rb_dlink_node *ptr;
	struct auth_provider *provider;

	set_provider_off(auth, id);
	set_provider_done(auth, id);

	if(!auth->providers)
	{
		if(!auth->providers_starting)
			/* Only do this when there are no providers left */
			accept_client(auth, 0);
		return;
	}

	RB_DLINK_FOREACH(ptr, auth_providers.head)
	{
		provider = ptr->data;

		if(provider->completed && is_provider_on(auth, provider->id))
			/* Notify pending clients who asked for it */
			provider->completed(auth, id);
	}
}

/* Reject a client */
void reject_client(struct auth_client *auth, provider_t id, const char *reason)
{
	char reject;

	switch(id)
	{
	case PROVIDER_RDNS:
		reject = 'D';
		break;
	case PROVIDER_IDENT:
		reject = 'I';
		break;
	case PROVIDER_BLACKLIST:
		reject = 'B';
		break;
	default:
		reject = 'N';
		break;
	}

	/* We send back username and hostname in case ircd wants to overrule our decision.
	 * In the future this may not be the case.
	 * --Elizafox
	 */
	rb_helper_write(authd_helper, "R %x %c %s %s :%s", auth->cid, reject, auth->username, auth->hostname, reason);

	set_provider_off(auth, id);
	cancel_providers(auth);
}

/* Accept a client, cancel outstanding providers if any */
void accept_client(struct auth_client *auth, provider_t id)
{
	uint32_t cid = auth->cid;

	rb_helper_write(authd_helper, "A %x %s %s", auth->cid, auth->username, auth->hostname);

	set_provider_off(auth, id);
	cancel_providers(auth);
}

/* Begin authenticating user */
static void start_auth(const char *cid, const char *l_ip, const char *l_port, const char *c_ip, const char *c_port)
{
	struct auth_provider *provider;
	struct auth_client *auth = rb_malloc(sizeof(struct auth_client));
	long lcid = strtol(cid, NULL, 16);
	rb_dlink_node *ptr;

	if(lcid >= UINT32_MAX)
		return;

	auth->cid = (uint32_t)lcid;

	if(rb_dictionary_find(auth_clients, RB_UINT_TO_POINTER(auth->cid)) == NULL)
		rb_dictionary_add(auth_clients, RB_UINT_TO_POINTER(auth->cid), auth);
	else
	{
		warn_opers(L_CRIT, "BUG: duplicate client added via start_auth: %x", auth->cid);
		rb_free(auth);
		return;
	}

	rb_strlcpy(auth->l_ip, l_ip, sizeof(auth->l_ip));
	auth->l_port = (uint16_t)atoi(l_port);	/* should be safe */
	(void) rb_inet_pton_sock(l_ip, (struct sockaddr *)&auth->l_addr);

	rb_strlcpy(auth->c_ip, c_ip, sizeof(auth->c_ip));
	auth->c_port = (uint16_t)atoi(c_port);
	(void) rb_inet_pton_sock(c_ip, (struct sockaddr *)&auth->c_addr);

#ifdef RB_IPV6
	if(GET_SS_FAMILY(&auth->l_addr) == AF_INET6)
		((struct sockaddr_in6 *)&auth->l_addr)->sin6_port = htons(auth->l_port);
	else
#endif
		((struct sockaddr_in *)&auth->l_addr)->sin_port = htons(auth->l_port);

#ifdef RB_IPV6
	if(GET_SS_FAMILY(&auth->c_addr) == AF_INET6)
		((struct sockaddr_in6 *)&auth->c_addr)->sin6_port = htons(auth->c_port);
	else
#endif
		((struct sockaddr_in *)&auth->c_addr)->sin_port = htons(auth->c_port);

	memset(auth->data, 0, sizeof(auth->data));

	auth->providers_starting = true;
	RB_DLINK_FOREACH(ptr, auth_providers.head)
	{
		provider = ptr->data;

		lrb_assert(provider->start != NULL);

		/* Execute providers */
		if(!provider->start(auth))
		{
			/* Rejected immediately */
			cancel_providers(auth);
			return;
		}
	}
	auth->providers_starting = false;

	/* If no providers are running, accept the client */
	if(!auth->providers)
		accept_client(auth, 0);
}

/* Callback for the initiation */
void handle_new_connection(int parc, char *parv[])
{
	if(parc < 6)
	{
		warn_opers(L_CRIT, "BUG: received too few params for new connection (6 expected, got %d)", parc);
		return;
	}

	start_auth(parv[1], parv[2], parv[3], parv[4], parv[5]);
}
Commit	Line	Data
2b0cc3d3 EM	1	/* authd/provider.c - authentication provider framework
	2	* Copyright (c) 2016 Elizabeth Myers <elizabeth@interlinked.me>
	3	*
	4	* Permission to use, copy, modify, and/or distribute this software for any
	5	* purpose with or without fee is hereby granted, provided that the above
	6	* copyright notice and this permission notice is present in all copies.
	7	*
	8	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
	9	* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
	10	* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
	11	* DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
	12	* INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
	13	* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
	14	* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	15	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
	16	* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
	17	* IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
	18	* POSSIBILITY OF SUCH DAMAGE.
	19	*/
	20
89d22b9a EM	21	/* The basic design here is to have "authentication providers" that do things
89d22b9a EM	22	* like query ident and blacklists and even open proxies.
2b0cc3d3	23	*
f7b37c1d EM	24	* Providers are registered in the auth_providers linked list. It is planned to
f7b37c1d EM	25	* use a bitmap to store provider ID's later.
2b0cc3d3	26	*
89d22b9a EM	27	* Providers can either return failure immediately, immediate acceptance, or do
89d22b9a EM	28	* work in the background (calling set_provider to signal this).
2b0cc3d3	29	*
3e875f62 EM	30	* Provider-specific data for each client can be kept in an index of the data
3e875f62 EM	31	* struct member (using the provider's ID).
2b0cc3d3 EM	32	*
	33	* All providers must implement at a minimum a perform_provider function. You
	34	* don't have to implement the others if you don't need them.
	35	*
	36	* Providers may kick clients off by rejecting them. Upon rejection, all
	37	* providers are cancelled. They can also unconditionally accept them.
	38	*
	39	* When a provider is done and is neutral on accepting/rejecting a client, it
	40	* should call provider_done. Do NOT call this if you have accepted or rejected
	41	* the client.
	42	*
89d22b9a EM	43	* Eventually, stuff like *:line handling will be moved here, but that means we
	44	* have to talk to bandb directly first.
	45	*
2b0cc3d3 EM	46	* --Elizafox, 9 March 2016
	47	*/
	48
46d17a88	49	#include "rb_dictionary.h"
2b0cc3d3 EM	50	#include "authd.h"
2b0cc3d3 EM	51	#include "provider.h"
db821ee9	52	#include "notice.h"
2b0cc3d3 EM	53
	54	rb_dlink_list auth_providers;
	55
	56	/* Clients waiting */
aba29d5a	57	rb_dictionary *auth_clients;
2b0cc3d3 EM	58
	59	/* Load a provider */
	60	void load_provider(struct auth_provider *provider)
	61	{
3e875f62	62	if(rb_dlink_list_length(&auth_providers) >= MAX_PROVIDERS)
b2ede1aa EM	63	{
b2ede1aa EM	64	warn_opers(L_CRIT, "Exceeded maximum level of authd providers (%d max)", MAX_PROVIDERS);
3e875f62	65	return;
b2ede1aa	66	}
3e875f62	67
a51487e0 EM	68	if(provider->opt_handlers != NULL)
	69	{
	70	struct auth_opts_handler *handler;
	71
	72	for(handler = provider->opt_handlers; handler->option != NULL; handler++)
	73	rb_dictionary_add(authd_option_handlers, handler->option, handler);
	74	}
	75
2b0cc3d3 EM	76	provider->init();
	77	rb_dlinkAdd(provider, &provider->node, &auth_providers);
	78	}
	79
	80	void unload_provider(struct auth_provider *provider)
	81	{
a51487e0 EM	82	if(provider->opt_handlers != NULL)
	83	{
	84	struct auth_opts_handler *handler;
	85
	86	for(handler = provider->opt_handlers; handler->option != NULL; handler++)
	87	rb_dictionary_delete(authd_option_handlers, handler->option);
	88	}
2b0cc3d3 EM	89	provider->destroy();
	90	rb_dlinkDelete(&provider->node, &auth_providers);
	91	}
	92
	93	/* Initalise all providers */
	94	void init_providers(void)
	95	{
3e875f62	96	auth_clients = rb_dictionary_create("pending auth clients", rb_uint32cmp);
2b0cc3d3 EM	97	load_provider(&rdns_provider);
2b0cc3d3 EM	98	load_provider(&ident_provider);
f5586c3a	99	load_provider(&blacklist_provider);
2b0cc3d3 EM	100	}
	101
	102	/* Terminate all providers */
	103	void destroy_providers(void)
	104	{
	105	rb_dlink_node *ptr;
aba29d5a	106	rb_dictionary_iter iter;
3e875f62	107	struct auth_client *auth;
2b0cc3d3 EM	108	struct auth_provider *provider;
	109
	110	/* Cancel outstanding connections */
a52c7a8e	111	RB_DICTIONARY_FOREACH(auth, &iter, auth_clients)
2b0cc3d3	112	{
3e875f62 EM	113	/* TBD - is this the right thing? */
3e875f62 EM	114	reject_client(auth, 0, "Authentication system is down... try reconnecting in a few seconds");
2b0cc3d3 EM	115	}
	116
	117	RB_DLINK_FOREACH(ptr, auth_providers.head)
	118	{
	119	provider = ptr->data;
	120
	121	if(provider->destroy)
	122	provider->destroy();
	123	}
	124	}
	125
	126	/* Cancel outstanding providers for a client */
	127	void cancel_providers(struct auth_client *auth)
	128	{
	129	rb_dlink_node *ptr;
	130	struct auth_provider *provider;
	131
	132	RB_DLINK_FOREACH(ptr, auth_providers.head)
	133	{
	134	provider = ptr->data;
	135
a7d5aea1	136	if(provider->cancel && is_provider_on(auth, provider->id))
2b0cc3d3 EM	137	/* Cancel if required */
	138	provider->cancel(auth);
	139	}
46d17a88	140
3e875f62 EM	141	rb_dictionary_delete(auth_clients, RB_UINT_TO_POINTER(auth->cid));
3e875f62 EM	142	rb_free(auth);
2b0cc3d3 EM	143	}
	144
	145	/* Provider is done */
	146	void provider_done(struct auth_client *auth, provider_t id)
	147	{
	148	rb_dlink_node *ptr;
	149	struct auth_provider *provider;
	150
a7d5aea1 EM	151	set_provider_off(auth, id);
a7d5aea1 EM	152	set_provider_done(auth, id);
2b0cc3d3 EM	153
	154	if(!auth->providers)
	155	{
05fdc030 EM	156	if(!auth->providers_starting)
	157	/* Only do this when there are no providers left */
	158	accept_client(auth, 0);
2b0cc3d3 EM	159	return;
	160	}
	161
	162	RB_DLINK_FOREACH(ptr, auth_providers.head)
	163	{
	164	provider = ptr->data;
	165
a7d5aea1	166	if(provider->completed && is_provider_on(auth, provider->id))
2b0cc3d3 EM	167	/* Notify pending clients who asked for it */
	168	provider->completed(auth, id);
	169	}
	170	}
	171
f7b37c1d EM	172	/* Reject a client */
f7b37c1d EM	173	void reject_client(struct auth_client auth, provider_t id, const char reason)
2b0cc3d3	174	{
2b0cc3d3 EM	175	char reject;
	176
	177	switch(id)
	178	{
	179	case PROVIDER_RDNS:
	180	reject = 'D';
	181	break;
	182	case PROVIDER_IDENT:
	183	reject = 'I';
	184	break;
	185	case PROVIDER_BLACKLIST:
	186	reject = 'B';
	187	break;
2b0cc3d3 EM	188	default:
	189	reject = 'N';
	190	break;
	191	}
	192
3ad21f61 EM	193	/* We send back username and hostname in case ircd wants to overrule our decision.
	194	* In the future this may not be the case.
	195	* --Elizafox
	196	*/
ee658821	197	rb_helper_write(authd_helper, "R %x %c %s %s :%s", auth->cid, reject, auth->username, auth->hostname, reason);
2b0cc3d3	198
a7d5aea1	199	set_provider_off(auth, id);
46d17a88	200	cancel_providers(auth);
2b0cc3d3 EM	201	}
	202
	203	/* Accept a client, cancel outstanding providers if any */
	204	void accept_client(struct auth_client *auth, provider_t id)
	205	{
3e875f62	206	uint32_t cid = auth->cid;
2b0cc3d3 EM	207
	208	rb_helper_write(authd_helper, "A %x %s %s", auth->cid, auth->username, auth->hostname);
	209
a7d5aea1	210	set_provider_off(auth, id);
46d17a88	211	cancel_providers(auth);
2b0cc3d3 EM	212	}
2b0cc3d3 EM	213
2b0cc3d3 EM	214	/* Begin authenticating user */
	215	static void start_auth(const char cid, const char l_ip, const char l_port, const char c_ip, const char *c_port)
	216	{
	217	struct auth_provider *provider;
3e875f62	218	struct auth_client *auth = rb_malloc(sizeof(struct auth_client));
2b0cc3d3 EM	219	long lcid = strtol(cid, NULL, 16);
	220	rb_dlink_node *ptr;
	221
3e875f62	222	if(lcid >= UINT32_MAX)
2b0cc3d3 EM	223	return;
2b0cc3d3 EM	224
3e875f62	225	auth->cid = (uint32_t)lcid;
2b0cc3d3	226
05fdc030 EM	227	if(rb_dictionary_find(auth_clients, RB_UINT_TO_POINTER(auth->cid)) == NULL)
	228	rb_dictionary_add(auth_clients, RB_UINT_TO_POINTER(auth->cid), auth);
	229	else
	230	{
	231	warn_opers(L_CRIT, "BUG: duplicate client added via start_auth: %x", auth->cid);
	232	rb_free(auth);
	233	return;
	234	}
	235
2b0cc3d3 EM	236	rb_strlcpy(auth->l_ip, l_ip, sizeof(auth->l_ip));
2b0cc3d3 EM	237	auth->l_port = (uint16_t)atoi(l_port); /* should be safe */
32f8c78b	238	(void) rb_inet_pton_sock(l_ip, (struct sockaddr *)&auth->l_addr);
2b0cc3d3 EM	239
	240	rb_strlcpy(auth->c_ip, c_ip, sizeof(auth->c_ip));
	241	auth->c_port = (uint16_t)atoi(c_port);
32f8c78b	242	(void) rb_inet_pton_sock(c_ip, (struct sockaddr *)&auth->c_addr);
9c7498d5 EM	243
	244	#ifdef RB_IPV6
	245	if(GET_SS_FAMILY(&auth->l_addr) == AF_INET6)
32f8c78b	246	((struct sockaddr_in6 *)&auth->l_addr)->sin6_port = htons(auth->l_port);
9c7498d5 EM	247	else
9c7498d5 EM	248	#endif
32f8c78b	249	((struct sockaddr_in *)&auth->l_addr)->sin_port = htons(auth->l_port);
9c7498d5 EM	250
	251	#ifdef RB_IPV6
	252	if(GET_SS_FAMILY(&auth->c_addr) == AF_INET6)
32f8c78b	253	((struct sockaddr_in6 *)&auth->c_addr)->sin6_port = htons(auth->c_port);
9c7498d5 EM	254	else
9c7498d5 EM	255	#endif
32f8c78b	256	((struct sockaddr_in *)&auth->c_addr)->sin_port = htons(auth->c_port);
2b0cc3d3	257
0cff7adb EM	258	memset(auth->data, 0, sizeof(auth->data));
0cff7adb EM	259
05fdc030	260	auth->providers_starting = true;
2b0cc3d3 EM	261	RB_DLINK_FOREACH(ptr, auth_providers.head)
	262	{
	263	provider = ptr->data;
	264
05fdc030 EM	265	lrb_assert(provider->start != NULL);
05fdc030 EM	266
2b0cc3d3 EM	267	/* Execute providers */
	268	if(!provider->start(auth))
	269	{
	270	/* Rejected immediately */
	271	cancel_providers(auth);
	272	return;
	273	}
	274	}
05fdc030	275	auth->providers_starting = false;
2b0cc3d3 EM	276
	277	/* If no providers are running, accept the client */
	278	if(!auth->providers)
	279	accept_client(auth, 0);
	280	}
	281
	282	/* Callback for the initiation */
	283	void handle_new_connection(int parc, char *parv[])
	284	{
0cff7adb	285	if(parc < 6)
b2ede1aa	286	{
0cff7adb	287	warn_opers(L_CRIT, "BUG: received too few params for new connection (6 expected, got %d)", parc);
2b0cc3d3	288	return;
b2ede1aa	289	}
2b0cc3d3 EM	290
	291	start_auth(parv[1], parv[2], parv[3], parv[4], parv[5]);
	292	}