]>
Commit | Line | Data |
---|---|---|
1 | /* | |
2 | * charybdis: A slightly useful ircd. | |
3 | * blacklist.c: Manages DNS blacklist entries and lookups | |
4 | * | |
5 | * Copyright (C) 2006-2011 charybdis development team | |
6 | * | |
7 | * Redistribution and use in source and binary forms, with or without | |
8 | * modification, are permitted provided that the following conditions are | |
9 | * met: | |
10 | * | |
11 | * 1. Redistributions of source code must retain the above copyright notice, | |
12 | * this list of conditions and the following disclaimer. | |
13 | * | |
14 | * 2. Redistributions in binary form must reproduce the above copyright | |
15 | * notice, this list of conditions and the following disclaimer in the | |
16 | * documentation and/or other materials provided with the distribution. | |
17 | * | |
18 | * 3. The name of the author may not be used to endorse or promote products | |
19 | * derived from this software without specific prior written permission. | |
20 | * | |
21 | * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR | |
22 | * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED | |
23 | * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE | |
24 | * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, | |
25 | * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES | |
26 | * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR | |
27 | * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | |
28 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, | |
29 | * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING | |
30 | * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE | |
31 | * POSSIBILITY OF SUCH DAMAGE. | |
32 | * | |
33 | */ | |
34 | ||
35 | #include "stdinc.h" | |
36 | #include "client.h" | |
37 | #include "res.h" | |
38 | #include "numeric.h" | |
39 | #include "reject.h" | |
40 | #include "s_conf.h" | |
41 | #include "s_user.h" | |
42 | #include "blacklist.h" | |
43 | #include "send.h" | |
44 | ||
45 | rb_dlink_list blacklist_list = { NULL, NULL, 0 }; | |
46 | ||
47 | /* private interfaces */ | |
48 | static struct Blacklist *find_blacklist(char *name) | |
49 | { | |
50 | rb_dlink_node *nptr; | |
51 | ||
52 | RB_DLINK_FOREACH(nptr, blacklist_list.head) | |
53 | { | |
54 | struct Blacklist *blptr = (struct Blacklist *) nptr->data; | |
55 | ||
56 | if (!irccmp(blptr->host, name)) | |
57 | return blptr; | |
58 | } | |
59 | ||
60 | return NULL; | |
61 | } | |
62 | ||
63 | static inline int blacklist_check_reply(struct BlacklistClient *blcptr, struct rb_sockaddr_storage *addr) | |
64 | { | |
65 | struct Blacklist *blptr = blcptr->blacklist; | |
66 | char ipaddr[HOSTIPLEN]; | |
67 | char *lastoctet; | |
68 | rb_dlink_node *ptr; | |
69 | ||
70 | /* XXX the below two checks might want to change at some point | |
71 | * e.g. if IPv6 blacklists don't use 127.x.y.z or A records anymore | |
72 | * --Elizabeth | |
73 | */ | |
74 | if (addr->ss_family != AF_INET || | |
75 | memcmp(&((struct sockaddr_in *)addr)->sin_addr, "\177", 1)) | |
76 | goto blwarn; | |
77 | ||
78 | /* No filters and entry found - thus positive match */ | |
79 | if (!rb_dlink_list_length(&blptr->filters)) | |
80 | return 1; | |
81 | ||
82 | rb_inet_ntop_sock((struct sockaddr *)addr, ipaddr, sizeof(ipaddr)); | |
83 | ||
84 | /* Below will prolly have to change too if the above changes */ | |
85 | if ((lastoctet = strrchr(ipaddr, '.')) == NULL || *(++lastoctet) == '\0') | |
86 | goto blwarn; | |
87 | ||
88 | RB_DLINK_FOREACH(ptr, blcptr->blacklist->filters.head) | |
89 | { | |
90 | struct BlacklistFilter *filter = ptr->data; | |
91 | char *cmpstr; | |
92 | ||
93 | if (filter->type == BLACKLIST_FILTER_ALL) | |
94 | cmpstr = ipaddr; | |
95 | else if (filter->type == BLACKLIST_FILTER_LAST) | |
96 | cmpstr = lastoctet; | |
97 | else | |
98 | { | |
99 | sendto_realops_snomask(SNO_GENERAL, L_ALL, | |
100 | "blacklist_check_reply(): Unknown filtertype (BUG!)"); | |
101 | continue; | |
102 | } | |
103 | ||
104 | if (strcmp(cmpstr, filter->filterstr) == 0) | |
105 | /* Match! */ | |
106 | return 1; | |
107 | } | |
108 | ||
109 | return 0; | |
110 | blwarn: | |
111 | if (blcptr->blacklist->lastwarning + 3600 < rb_current_time()) | |
112 | { | |
113 | sendto_realops_snomask(SNO_GENERAL, L_ALL, | |
114 | "Garbage reply from blacklist %s", | |
115 | blcptr->blacklist->host); | |
116 | blcptr->blacklist->lastwarning = rb_current_time(); | |
117 | } | |
118 | return 0; | |
119 | } | |
120 | ||
121 | static void blacklist_dns_callback(void *vptr, struct DNSReply *reply) | |
122 | { | |
123 | struct BlacklistClient *blcptr = (struct BlacklistClient *) vptr; | |
124 | int listed = 0; | |
125 | ||
126 | if (blcptr == NULL || blcptr->client_p == NULL) | |
127 | return; | |
128 | ||
129 | if (blcptr->client_p->preClient == NULL) | |
130 | { | |
131 | sendto_realops_snomask(SNO_GENERAL, L_ALL, | |
132 | "blacklist_dns_callback(): blcptr->client_p->preClient (%s) is NULL", get_client_name(blcptr->client_p, HIDE_IP)); | |
133 | rb_free(blcptr); | |
134 | return; | |
135 | } | |
136 | ||
137 | if (reply != NULL) | |
138 | { | |
139 | if (blacklist_check_reply(blcptr, &reply->addr)) | |
140 | listed = TRUE; | |
141 | } | |
142 | ||
143 | /* they have a blacklist entry for this client */ | |
144 | if (listed && blcptr->client_p->preClient->dnsbl_listed == NULL) | |
145 | { | |
146 | blcptr->client_p->preClient->dnsbl_listed = blcptr->blacklist; | |
147 | /* reference to blacklist moves from blcptr to client_p->preClient... */ | |
148 | } | |
149 | else | |
150 | unref_blacklist(blcptr->blacklist); | |
151 | ||
152 | rb_dlinkDelete(&blcptr->node, &blcptr->client_p->preClient->dnsbl_queries); | |
153 | ||
154 | /* yes, it can probably happen... */ | |
155 | if (rb_dlink_list_length(&blcptr->client_p->preClient->dnsbl_queries) == 0 && blcptr->client_p->flags & FLAGS_SENTUSER && !EmptyString(blcptr->client_p->name)) | |
156 | { | |
157 | char buf[USERLEN + 1]; | |
158 | rb_strlcpy(buf, blcptr->client_p->username, sizeof buf); | |
159 | register_local_user(blcptr->client_p, blcptr->client_p, buf); | |
160 | } | |
161 | ||
162 | rb_free(blcptr); | |
163 | } | |
164 | ||
165 | static void initiate_blacklist_dnsquery(struct Blacklist *blptr, struct Client *client_p) | |
166 | { | |
167 | struct BlacklistClient *blcptr = rb_malloc(sizeof(struct BlacklistClient)); | |
168 | char buf[IRCD_RES_HOSTLEN + 1]; | |
169 | uint8_t *ip; | |
170 | ||
171 | blcptr->blacklist = blptr; | |
172 | blcptr->client_p = client_p; | |
173 | ||
174 | blcptr->dns_query.ptr = blcptr; | |
175 | blcptr->dns_query.callback = blacklist_dns_callback; | |
176 | ||
177 | if ((client_p->localClient->ip.ss_family == AF_INET) && blptr->ipv4) | |
178 | { | |
179 | ip = (uint8_t *)&((struct sockaddr_in *)&client_p->localClient->ip)->sin_addr.s_addr; | |
180 | ||
181 | /* becomes 2.0.0.127.torbl.ahbl.org or whatever */ | |
182 | rb_snprintf(buf, sizeof buf, "%d.%d.%d.%d.%s", | |
183 | (unsigned int) ip[3], | |
184 | (unsigned int) ip[2], | |
185 | (unsigned int) ip[1], | |
186 | (unsigned int) ip[0], | |
187 | blptr->host); | |
188 | } | |
189 | /* IPv6 is supported now. --Elizabeth */ | |
190 | else if ((client_p->localClient->ip.ss_family == AF_INET6) && blptr->ipv6) | |
191 | { | |
192 | /* Breaks it into ip[0] = 0x00, ip[1] = 0x00... ip[16] = 0x01 for localhost | |
193 | * I wish there was a uint4_t for C, this would make the below cleaner, but... */ | |
194 | ip = (uint8_t *)&((struct sockaddr_in6 *)&client_p->localClient->ip)->sin6_addr.s6_addr; | |
195 | char *bufptr = buf; | |
196 | int i; | |
197 | ||
198 | /* The below will give us something like | |
199 | * 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.foobl.invalid | |
200 | */ | |
201 | ||
202 | /* Going backwards */ | |
203 | for (i = 15; i >= 0; i--) | |
204 | { | |
205 | /* Get upper and lower nibbles (yes this works fine on | |
206 | * both big and little endian) */ | |
207 | uint8_t hi = (ip[i] >> 4) & 0x0F; | |
208 | uint8_t lo = ip[i] & 0x0F; | |
209 | ||
210 | /* One part... (why 5? rb_snprintf adds \0) */ | |
211 | rb_snprintf(bufptr, 5, "%1x.%1x.", | |
212 | (unsigned int) lo, /* Remember, backwards */ | |
213 | (unsigned int) hi); | |
214 | ||
215 | /* Lurch forward to next position */ | |
216 | bufptr += 4; | |
217 | } | |
218 | ||
219 | /* Tack host on */ | |
220 | strcpy(bufptr, blptr->host); | |
221 | } | |
222 | /* This shouldn't happen... */ | |
223 | else | |
224 | return; | |
225 | ||
226 | gethost_byname_type(buf, &blcptr->dns_query, T_A); | |
227 | ||
228 | rb_dlinkAdd(blcptr, &blcptr->node, &client_p->preClient->dnsbl_queries); | |
229 | blptr->refcount++; | |
230 | } | |
231 | ||
232 | /* public interfaces */ | |
233 | struct Blacklist *new_blacklist(char *name, char *reject_reason, int ipv4, int ipv6, rb_dlink_list *filters) | |
234 | { | |
235 | struct Blacklist *blptr; | |
236 | ||
237 | if (name == NULL || reject_reason == NULL) | |
238 | return NULL; | |
239 | ||
240 | blptr = find_blacklist(name); | |
241 | if (blptr == NULL) | |
242 | { | |
243 | blptr = rb_malloc(sizeof(struct Blacklist)); | |
244 | rb_dlinkAddAlloc(blptr, &blacklist_list); | |
245 | } | |
246 | else | |
247 | blptr->status &= ~CONF_ILLEGAL; | |
248 | ||
249 | rb_strlcpy(blptr->host, name, IRCD_RES_HOSTLEN + 1); | |
250 | rb_strlcpy(blptr->reject_reason, reject_reason, IRCD_BUFSIZE); | |
251 | blptr->ipv4 = ipv4; | |
252 | blptr->ipv6 = ipv6; | |
253 | ||
254 | rb_dlinkMoveList(filters, &blptr->filters); | |
255 | ||
256 | blptr->lastwarning = 0; | |
257 | ||
258 | return blptr; | |
259 | } | |
260 | ||
261 | void unref_blacklist(struct Blacklist *blptr) | |
262 | { | |
263 | rb_dlink_node *ptr, *next_ptr; | |
264 | ||
265 | blptr->refcount--; | |
266 | if (blptr->status & CONF_ILLEGAL && blptr->refcount <= 0) | |
267 | { | |
268 | RB_DLINK_FOREACH_SAFE(ptr, next_ptr, blptr->filters.head) | |
269 | { | |
270 | rb_free(ptr); | |
271 | rb_dlinkDelete(ptr, &blptr->filters); | |
272 | } | |
273 | ||
274 | rb_dlinkFindDestroy(blptr, &blacklist_list); | |
275 | rb_free(blptr); | |
276 | } | |
277 | } | |
278 | ||
279 | void lookup_blacklists(struct Client *client_p) | |
280 | { | |
281 | rb_dlink_node *nptr; | |
282 | ||
283 | RB_DLINK_FOREACH(nptr, blacklist_list.head) | |
284 | { | |
285 | struct Blacklist *blptr = (struct Blacklist *) nptr->data; | |
286 | ||
287 | if (!(blptr->status & CONF_ILLEGAL)) | |
288 | initiate_blacklist_dnsquery(blptr, client_p); | |
289 | } | |
290 | } | |
291 | ||
292 | void abort_blacklist_queries(struct Client *client_p) | |
293 | { | |
294 | rb_dlink_node *ptr, *next_ptr; | |
295 | struct BlacklistClient *blcptr; | |
296 | ||
297 | if (client_p->preClient == NULL) | |
298 | return; | |
299 | RB_DLINK_FOREACH_SAFE(ptr, next_ptr, client_p->preClient->dnsbl_queries.head) | |
300 | { | |
301 | blcptr = ptr->data; | |
302 | rb_dlinkDelete(&blcptr->node, &client_p->preClient->dnsbl_queries); | |
303 | unref_blacklist(blcptr->blacklist); | |
304 | delete_resolver_queries(&blcptr->dns_query); | |
305 | rb_free(blcptr); | |
306 | } | |
307 | } | |
308 | ||
309 | void destroy_blacklists(void) | |
310 | { | |
311 | rb_dlink_node *ptr, *next_ptr; | |
312 | struct Blacklist *blptr; | |
313 | ||
314 | RB_DLINK_FOREACH_SAFE(ptr, next_ptr, blacklist_list.head) | |
315 | { | |
316 | blptr = ptr->data; | |
317 | blptr->hits = 0; /* keep it simple and consistent */ | |
318 | if (blptr->refcount > 0) | |
319 | blptr->status |= CONF_ILLEGAL; | |
320 | else | |
321 | { | |
322 | rb_free(ptr->data); | |
323 | rb_dlinkDestroy(ptr, &blacklist_list); | |
324 | } | |
325 | } | |
326 | } |