]>
Commit | Line | Data |
---|---|---|
1 | /* | |
2 | * ircd-ratbox: A slightly useful ircd. | |
3 | * s_auth.c: Functions for querying a users ident. | |
4 | * | |
5 | * Copyright (C) 1990 Jarkko Oikarinen and University of Oulu, Co Center | |
6 | * Copyright (C) 1996-2002 Hybrid Development Team | |
7 | * Copyright (C) 2002-2005 ircd-ratbox development team | |
8 | * | |
9 | * This program is free software; you can redistribute it and/or modify | |
10 | * it under the terms of the GNU General Public License as published by | |
11 | * the Free Software Foundation; either version 2 of the License, or | |
12 | * (at your option) any later version. | |
13 | * | |
14 | * This program is distributed in the hope that it will be useful, | |
15 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
16 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
17 | * GNU General Public License for more details. | |
18 | * | |
19 | * You should have received a copy of the GNU General Public License | |
20 | * along with this program; if not, write to the Free Software | |
21 | * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 | |
22 | * USA | |
23 | * | |
24 | * $Id: s_auth.c 1683 2006-06-20 14:26:16Z jilles $ */ | |
25 | ||
26 | /* | |
27 | * Changes: | |
28 | * July 6, 1999 - Rewrote most of the code here. When a client connects | |
29 | * to the server and passes initial socket validation checks, it | |
30 | * is owned by this module (auth) which returns it to the rest of the | |
31 | * server when dns and auth queries are finished. Until the client is | |
32 | * released, the server does not know it exists and does not process | |
33 | * any messages from it. | |
34 | * --Bleep Thomas Helvey <tomh@inxpress.net> | |
35 | */ | |
36 | #include "stdinc.h" | |
37 | #include "config.h" | |
38 | #include "tools.h" | |
39 | #include "s_auth.h" | |
40 | #include "s_conf.h" | |
41 | #include "client.h" | |
42 | #include "common.h" | |
43 | #include "event.h" | |
44 | #include "irc_string.h" | |
45 | #include "sprintf_irc.h" | |
46 | #include "ircd.h" | |
47 | #include "numeric.h" | |
48 | #include "packet.h" | |
49 | #include "res.h" | |
50 | #include "commio.h" | |
51 | #include "s_log.h" | |
52 | #include "s_stats.h" | |
53 | #include "send.h" | |
54 | #include "memory.h" | |
55 | #include "hook.h" | |
56 | #include "blacklist.h" | |
57 | ||
58 | /* | |
59 | * a bit different approach | |
60 | * this replaces the original sendheader macros | |
61 | */ | |
62 | ||
63 | static const char *HeaderMessages[] = | |
64 | { | |
65 | "NOTICE AUTH :*** Looking up your hostname...", | |
66 | "NOTICE AUTH :*** Found your hostname", | |
67 | "NOTICE AUTH :*** Couldn't look up your hostname", | |
68 | "NOTICE AUTH :*** Checking Ident", | |
69 | "NOTICE AUTH :*** Got Ident response", | |
70 | "NOTICE AUTH :*** No Ident response", | |
71 | "NOTICE AUTH :*** Your hostname is too long, ignoring hostname", | |
72 | "NOTICE AUTH :*** Your forward and reverse DNS do not match, ignoring hostname", | |
73 | "NOTICE AUTH :*** Cannot verify hostname validity, ignoring hostname", | |
74 | }; | |
75 | ||
76 | typedef enum | |
77 | { | |
78 | REPORT_DO_DNS, | |
79 | REPORT_FIN_DNS, | |
80 | REPORT_FAIL_DNS, | |
81 | REPORT_DO_ID, | |
82 | REPORT_FIN_ID, | |
83 | REPORT_FAIL_ID, | |
84 | REPORT_HOST_TOOLONG, | |
85 | REPORT_HOST_MISMATCH, | |
86 | REPORT_HOST_UNKNOWN | |
87 | } | |
88 | ReportType; | |
89 | ||
90 | #define sendheader(c, r) sendto_one(c, HeaderMessages[(r)]) | |
91 | ||
92 | static dlink_list auth_poll_list; | |
93 | static BlockHeap *auth_heap; | |
94 | static EVH timeout_auth_queries_event; | |
95 | ||
96 | static PF read_auth_reply; | |
97 | static CNCB auth_connect_callback; | |
98 | ||
99 | /* | |
100 | * init_auth() | |
101 | * | |
102 | * Initialise the auth code | |
103 | */ | |
104 | void | |
105 | init_auth(void) | |
106 | { | |
107 | /* This hook takes a struct Client for its argument */ | |
108 | memset(&auth_poll_list, 0, sizeof(auth_poll_list)); | |
109 | eventAddIsh("timeout_auth_queries_event", timeout_auth_queries_event, NULL, 1); | |
110 | auth_heap = BlockHeapCreate(sizeof(struct AuthRequest), LCLIENT_HEAP_SIZE); | |
111 | } | |
112 | ||
113 | /* | |
114 | * make_auth_request - allocate a new auth request | |
115 | */ | |
116 | static struct AuthRequest * | |
117 | make_auth_request(struct Client *client) | |
118 | { | |
119 | struct AuthRequest *request = BlockHeapAlloc(auth_heap); | |
120 | client->localClient->auth_request = request; | |
121 | request->fd = -1; | |
122 | request->client = client; | |
123 | request->timeout = CurrentTime + ConfigFileEntry.connect_timeout; | |
124 | return request; | |
125 | } | |
126 | ||
127 | /* | |
128 | * free_auth_request - cleanup auth request allocations | |
129 | */ | |
130 | static void | |
131 | free_auth_request(struct AuthRequest *request) | |
132 | { | |
133 | BlockHeapFree(auth_heap, request); | |
134 | } | |
135 | ||
136 | /* | |
137 | * release_auth_client - release auth client from auth system | |
138 | * this adds the client into the local client lists so it can be read by | |
139 | * the main io processing loop | |
140 | */ | |
141 | static void | |
142 | release_auth_client(struct AuthRequest *auth) | |
143 | { | |
144 | struct Client *client = auth->client; | |
145 | ||
146 | if(IsDNSPending(auth) || IsDoingAuth(auth)) | |
147 | return; | |
148 | ||
149 | client->localClient->auth_request = NULL; | |
150 | dlinkDelete(&auth->node, &auth_poll_list); | |
151 | free_auth_request(auth); | |
152 | if(client->localClient->fd > highest_fd) | |
153 | highest_fd = client->localClient->fd; | |
154 | ||
155 | /* | |
156 | * When a client has auth'ed, we want to start reading what it sends | |
157 | * us. This is what read_packet() does. | |
158 | * -- adrian | |
159 | */ | |
160 | client->localClient->allow_read = MAX_FLOOD; | |
161 | comm_setflush(client->localClient->fd, 1000, flood_recalc, client); | |
162 | dlinkAddTail(client, &client->node, &global_client_list); | |
163 | read_packet(client->localClient->fd, client); | |
164 | } | |
165 | ||
166 | /* | |
167 | * auth_dns_callback - called when resolver query finishes | |
168 | * if the query resulted in a successful search, hp will contain | |
169 | * a non-null pointer, otherwise hp will be null. | |
170 | * set the client on it's way to a connection completion, regardless | |
171 | * of success of failure | |
172 | */ | |
173 | static void | |
174 | auth_dns_callback(void *vptr, struct DNSReply *reply) | |
175 | { | |
176 | struct AuthRequest *auth = (struct AuthRequest *) vptr; | |
177 | ClearDNSPending(auth); | |
178 | ||
179 | /* XXX: this shouldn't happen, but it does. -nenolod */ | |
180 | if(auth->client->localClient == NULL) | |
181 | { | |
182 | sendto_realops_snomask(SNO_GENERAL, L_ALL, | |
183 | "auth_dns_callback(): auth->client->localClient (%s) is NULL", get_client_name(auth->client, HIDE_IP)); | |
184 | ||
185 | dlinkDelete(&auth->node, &auth_poll_list); | |
186 | free_auth_request(auth); | |
187 | ||
188 | /* and they will silently drop through and all will hopefully be ok... -nenolod */ | |
189 | return; | |
190 | } | |
191 | ||
192 | if(reply) | |
193 | { | |
194 | int good = 1; | |
195 | ||
196 | if(auth->client->localClient->ip.ss_family == AF_INET) | |
197 | { | |
198 | struct sockaddr_in *ip, *ip_fwd; | |
199 | ||
200 | ip = (struct sockaddr_in *) &auth->client->localClient->ip; | |
201 | ip_fwd = (struct sockaddr_in *) &reply->addr; | |
202 | ||
203 | if(ip->sin_addr.s_addr != ip_fwd->sin_addr.s_addr) | |
204 | { | |
205 | sendheader(auth->client, REPORT_HOST_MISMATCH); | |
206 | good = 0; | |
207 | } | |
208 | } | |
209 | #ifdef IPV6 | |
210 | else if(auth->client->localClient->ip.ss_family == AF_INET6) | |
211 | { | |
212 | struct sockaddr_in6 *ip, *ip_fwd; | |
213 | ||
214 | ip = (struct sockaddr_in6 *) &auth->client->localClient->ip; | |
215 | ip_fwd = (struct sockaddr_in6 *) &reply->addr; | |
216 | ||
217 | if(memcmp(&ip->sin6_addr, &ip_fwd->sin6_addr, sizeof(struct in6_addr)) != 0) | |
218 | { | |
219 | sendheader(auth->client, REPORT_HOST_MISMATCH); | |
220 | good = 0; | |
221 | } | |
222 | } | |
223 | #endif | |
224 | else /* can't verify it, don't know how. reject it. */ | |
225 | { | |
226 | sendheader(auth->client, REPORT_HOST_UNKNOWN); | |
227 | good = 0; | |
228 | } | |
229 | ||
230 | if(good && strlen(reply->h_name) <= HOSTLEN) | |
231 | { | |
232 | strlcpy(auth->client->host, reply->h_name, sizeof(auth->client->host)); | |
233 | sendheader(auth->client, REPORT_FIN_DNS); | |
234 | } | |
235 | else if (strlen(reply->h_name) > HOSTLEN) | |
236 | sendheader(auth->client, REPORT_HOST_TOOLONG); | |
237 | } | |
238 | else | |
239 | sendheader(auth->client, REPORT_FAIL_DNS); | |
240 | ||
241 | release_auth_client(auth); | |
242 | } | |
243 | ||
244 | /* | |
245 | * authsenderr - handle auth send errors | |
246 | */ | |
247 | static void | |
248 | auth_error(struct AuthRequest *auth) | |
249 | { | |
250 | ++ServerStats->is_abad; | |
251 | ||
252 | comm_close(auth->fd); | |
253 | auth->fd = -1; | |
254 | ||
255 | ClearAuth(auth); | |
256 | sendheader(auth->client, REPORT_FAIL_ID); | |
257 | ||
258 | release_auth_client(auth); | |
259 | } | |
260 | ||
261 | /* | |
262 | * start_auth_query - Flag the client to show that an attempt to | |
263 | * contact the ident server on | |
264 | * the client's host. The connect and subsequently the socket are all put | |
265 | * into 'non-blocking' mode. Should the connect or any later phase of the | |
266 | * identifing process fail, it is aborted and the user is given a username | |
267 | * of "unknown". | |
268 | */ | |
269 | static int | |
270 | start_auth_query(struct AuthRequest *auth) | |
271 | { | |
272 | struct irc_sockaddr_storage localaddr; | |
273 | socklen_t locallen = sizeof(struct irc_sockaddr_storage); | |
274 | int fd; | |
275 | int family; | |
276 | ||
277 | if(IsAnyDead(auth->client)) | |
278 | return 0; | |
279 | ||
280 | family = auth->client->localClient->ip.ss_family; | |
281 | if((fd = comm_socket(family, SOCK_STREAM, 0, "ident")) == -1) | |
282 | { | |
283 | report_error("creating auth stream socket %s:%s", | |
284 | get_client_name(auth->client, SHOW_IP), | |
285 | log_client_name(auth->client, SHOW_IP), errno); | |
286 | ++ServerStats->is_abad; | |
287 | return 0; | |
288 | } | |
289 | if((MAXCONNECTIONS - 10) < fd) | |
290 | { | |
291 | sendto_realops_snomask(SNO_GENERAL, L_ALL, | |
292 | "Can't allocate fd for auth on %s", | |
293 | get_client_name(auth->client, SHOW_IP)); | |
294 | comm_close(fd); | |
295 | return 0; | |
296 | } | |
297 | ||
298 | sendheader(auth->client, REPORT_DO_ID); | |
299 | ||
300 | /* | |
301 | * get the local address of the client and bind to that to | |
302 | * make the auth request. This used to be done only for | |
303 | * ifdef VIRTUAL_HOST, but needs to be done for all clients | |
304 | * since the ident request must originate from that same address-- | |
305 | * and machines with multiple IP addresses are common now | |
306 | */ | |
307 | memset(&localaddr, 0, locallen); | |
308 | getsockname(auth->client->localClient->fd, | |
309 | (struct sockaddr *) &localaddr, &locallen); | |
310 | ||
311 | mangle_mapped_sockaddr((struct sockaddr *)&localaddr); | |
312 | #ifdef IPV6 | |
313 | if(localaddr.ss_family == AF_INET6) | |
314 | { | |
315 | ((struct sockaddr_in6 *)&localaddr)->sin6_port = 0; | |
316 | } else | |
317 | #endif | |
318 | ((struct sockaddr_in *)&localaddr)->sin_port = 0; | |
319 | ||
320 | auth->fd = fd; | |
321 | SetAuthConnect(auth); | |
322 | ||
323 | comm_connect_tcp(fd, auth->client->sockhost, 113, | |
324 | (struct sockaddr *) &localaddr, GET_SS_LEN(localaddr), | |
325 | auth_connect_callback, auth, | |
326 | localaddr.ss_family, GlobalSetOptions.ident_timeout); | |
327 | return 1; /* We suceed here for now */ | |
328 | } | |
329 | ||
330 | /* | |
331 | * GetValidIdent - parse ident query reply from identd server | |
332 | * | |
333 | * Inputs - pointer to ident buf | |
334 | * Output - NULL if no valid ident found, otherwise pointer to name | |
335 | * Side effects - | |
336 | */ | |
337 | static char * | |
338 | GetValidIdent(char *buf) | |
339 | { | |
340 | int remp = 0; | |
341 | int locp = 0; | |
342 | char *colon1Ptr; | |
343 | char *colon2Ptr; | |
344 | char *colon3Ptr; | |
345 | char *commaPtr; | |
346 | char *remotePortString; | |
347 | ||
348 | /* All this to get rid of a sscanf() fun. */ | |
349 | remotePortString = buf; | |
350 | ||
351 | colon1Ptr = strchr(remotePortString, ':'); | |
352 | if(!colon1Ptr) | |
353 | return 0; | |
354 | ||
355 | *colon1Ptr = '\0'; | |
356 | colon1Ptr++; | |
357 | colon2Ptr = strchr(colon1Ptr, ':'); | |
358 | if(!colon2Ptr) | |
359 | return 0; | |
360 | ||
361 | *colon2Ptr = '\0'; | |
362 | colon2Ptr++; | |
363 | commaPtr = strchr(remotePortString, ','); | |
364 | ||
365 | if(!commaPtr) | |
366 | return 0; | |
367 | ||
368 | *commaPtr = '\0'; | |
369 | commaPtr++; | |
370 | ||
371 | remp = atoi(remotePortString); | |
372 | if(!remp) | |
373 | return 0; | |
374 | ||
375 | locp = atoi(commaPtr); | |
376 | if(!locp) | |
377 | return 0; | |
378 | ||
379 | /* look for USERID bordered by first pair of colons */ | |
380 | if(!strstr(colon1Ptr, "USERID")) | |
381 | return 0; | |
382 | ||
383 | colon3Ptr = strchr(colon2Ptr, ':'); | |
384 | if(!colon3Ptr) | |
385 | return 0; | |
386 | ||
387 | *colon3Ptr = '\0'; | |
388 | colon3Ptr++; | |
389 | return (colon3Ptr); | |
390 | } | |
391 | ||
392 | /* | |
393 | * start_auth - starts auth (identd) and dns queries for a client | |
394 | */ | |
395 | void | |
396 | start_auth(struct Client *client) | |
397 | { | |
398 | struct AuthRequest *auth = 0; | |
399 | s_assert(0 != client); | |
400 | if(client == NULL) | |
401 | return; | |
402 | ||
403 | /* to aid bopm which needs something unique to match against */ | |
404 | sendto_one(client, "NOTICE AUTH :*** Processing connection to %s", | |
405 | me.name); | |
406 | ||
407 | auth = make_auth_request(client); | |
408 | ||
409 | auth->dns_query.ptr = auth; | |
410 | auth->dns_query.callback = auth_dns_callback; | |
411 | ||
412 | sendheader(client, REPORT_DO_DNS); | |
413 | ||
414 | /* No DNS cache now, remember? -- adrian */ | |
415 | gethost_byaddr(&client->localClient->ip, &auth->dns_query); | |
416 | ||
417 | SetDNSPending(auth); | |
418 | ||
419 | if(ConfigFileEntry.disable_auth == 0) | |
420 | start_auth_query(auth); | |
421 | ||
422 | dlinkAdd(auth, &auth->node, &auth_poll_list); | |
423 | } | |
424 | ||
425 | /* | |
426 | * timeout_auth_queries - timeout resolver and identd requests | |
427 | * allow clients through if requests failed | |
428 | */ | |
429 | static void | |
430 | timeout_auth_queries_event(void *notused) | |
431 | { | |
432 | dlink_node *ptr; | |
433 | dlink_node *next_ptr; | |
434 | struct AuthRequest *auth; | |
435 | ||
436 | DLINK_FOREACH_SAFE(ptr, next_ptr, auth_poll_list.head) | |
437 | { | |
438 | auth = ptr->data; | |
439 | ||
440 | if(auth->timeout < CurrentTime) | |
441 | { | |
442 | if(auth->fd >= 0) | |
443 | comm_close(auth->fd); | |
444 | ||
445 | if(IsDoingAuth(auth)) | |
446 | { | |
447 | ClearAuth(auth); | |
448 | ++ServerStats->is_abad; | |
449 | sendheader(auth->client, REPORT_FAIL_ID); | |
450 | auth->client->localClient->auth_request = NULL; | |
451 | } | |
452 | if(IsDNSPending(auth)) | |
453 | { | |
454 | ClearDNSPending(auth); | |
455 | delete_resolver_queries(&auth->dns_query); | |
456 | sendheader(auth->client, REPORT_FAIL_DNS); | |
457 | } | |
458 | ||
459 | auth->client->localClient->lasttime = CurrentTime; | |
460 | release_auth_client(auth); | |
461 | } | |
462 | } | |
463 | } | |
464 | ||
465 | /* | |
466 | * auth_connect_callback() - deal with the result of comm_connect_tcp() | |
467 | * | |
468 | * If the connection failed, we simply close the auth fd and report | |
469 | * a failure. If the connection suceeded send the ident server a query | |
470 | * giving "theirport , ourport". The write is only attempted *once* so | |
471 | * it is deemed to be a fail if the entire write doesn't write all the | |
472 | * data given. This shouldnt be a problem since the socket should have | |
473 | * a write buffer far greater than this message to store it in should | |
474 | * problems arise. -avalon | |
475 | */ | |
476 | static void | |
477 | auth_connect_callback(int fd, int error, void *data) | |
478 | { | |
479 | struct AuthRequest *auth = data; | |
480 | struct sockaddr_in us; | |
481 | struct sockaddr_in them; | |
482 | char authbuf[32]; | |
483 | socklen_t ulen = sizeof(struct sockaddr_in); | |
484 | socklen_t tlen = sizeof(struct sockaddr_in); | |
485 | ||
486 | /* Check the error */ | |
487 | if(error != COMM_OK) | |
488 | { | |
489 | /* We had an error during connection :( */ | |
490 | auth_error(auth); | |
491 | return; | |
492 | } | |
493 | ||
494 | if(getsockname | |
495 | (auth->client->localClient->fd, (struct sockaddr *) &us, | |
496 | (socklen_t *) & ulen) | |
497 | || getpeername(auth->client->localClient->fd, | |
498 | (struct sockaddr *) &them, (socklen_t *) & tlen)) | |
499 | { | |
500 | ilog(L_IOERROR, "auth get{sock,peer}name error for %s:%m", | |
501 | log_client_name(auth->client, SHOW_IP)); | |
502 | auth_error(auth); | |
503 | return; | |
504 | } | |
505 | ircsnprintf(authbuf, sizeof(authbuf), "%u , %u\r\n", | |
506 | (unsigned int) ntohs(them.sin_port), (unsigned int) ntohs(us.sin_port)); | |
507 | ||
508 | if(write(auth->fd, authbuf, strlen(authbuf)) == -1) | |
509 | { | |
510 | auth_error(auth); | |
511 | return; | |
512 | } | |
513 | ClearAuthConnect(auth); | |
514 | SetAuthPending(auth); | |
515 | read_auth_reply(auth->fd, auth); | |
516 | } | |
517 | ||
518 | ||
519 | /* | |
520 | * read_auth_reply - read the reply (if any) from the ident server | |
521 | * we connected to. | |
522 | * We only give it one shot, if the reply isn't good the first time | |
523 | * fail the authentication entirely. --Bleep | |
524 | */ | |
525 | #define AUTH_BUFSIZ 128 | |
526 | ||
527 | static void | |
528 | read_auth_reply(int fd, void *data) | |
529 | { | |
530 | struct AuthRequest *auth = data; | |
531 | char *s = NULL; | |
532 | char *t = NULL; | |
533 | int len; | |
534 | int count; | |
535 | char buf[AUTH_BUFSIZ + 1]; /* buffer to read auth reply into */ | |
536 | ||
537 | len = read(auth->fd, buf, AUTH_BUFSIZ); | |
538 | ||
539 | if(len < 0 && ignoreErrno(errno)) | |
540 | { | |
541 | comm_setselect(fd, FDLIST_IDLECLIENT, COMM_SELECT_READ, read_auth_reply, auth, 0); | |
542 | return; | |
543 | } | |
544 | ||
545 | if(len > 0) | |
546 | { | |
547 | buf[len] = '\0'; | |
548 | ||
549 | if((s = GetValidIdent(buf))) | |
550 | { | |
551 | t = auth->client->username; | |
552 | ||
553 | while (*s == '~' || *s == '^') | |
554 | s++; | |
555 | ||
556 | for (count = USERLEN; *s && count; s++) | |
557 | { | |
558 | if(*s == '@') | |
559 | { | |
560 | break; | |
561 | } | |
562 | if(!IsSpace(*s) && *s != ':' && *s != '[') | |
563 | { | |
564 | *t++ = *s; | |
565 | count--; | |
566 | } | |
567 | } | |
568 | *t = '\0'; | |
569 | } | |
570 | } | |
571 | ||
572 | comm_close(auth->fd); | |
573 | auth->fd = -1; | |
574 | ClearAuth(auth); | |
575 | ||
576 | if(s == NULL) | |
577 | { | |
578 | ++ServerStats->is_abad; | |
579 | strcpy(auth->client->username, "unknown"); | |
580 | sendheader(auth->client, REPORT_FAIL_ID); | |
581 | } | |
582 | else | |
583 | { | |
584 | sendheader(auth->client, REPORT_FIN_ID); | |
585 | ++ServerStats->is_asuc; | |
586 | SetGotId(auth->client); | |
587 | } | |
588 | ||
589 | release_auth_client(auth); | |
590 | } | |
591 | ||
592 | ||
593 | ||
594 | /* | |
595 | * delete_auth_queries() | |
596 | * | |
597 | */ | |
598 | void | |
599 | delete_auth_queries(struct Client *target_p) | |
600 | { | |
601 | struct AuthRequest *auth; | |
602 | ||
603 | if(target_p == NULL || target_p->localClient == NULL || | |
604 | target_p->localClient->auth_request == NULL) | |
605 | return; | |
606 | ||
607 | auth = target_p->localClient->auth_request; | |
608 | target_p->localClient->auth_request = NULL; | |
609 | ||
610 | if(IsDNSPending(auth)) | |
611 | delete_resolver_queries(&auth->dns_query); | |
612 | ||
613 | if(auth->fd >= 0) | |
614 | comm_close(auth->fd); | |
615 | ||
616 | dlinkDelete(&auth->node, &auth_poll_list); | |
617 | free_auth_request(auth); | |
618 | } |