authd/provider: some fixes

[solanum.git] / ircd / s_auth.c

/*
 *  ircd-ratbox: A slightly useful ircd.
 *  s_auth.c: Functions for querying a users ident.
 *
 *  Copyright (C) 1990 Jarkko Oikarinen and University of Oulu, Co Center
 *  Copyright (C) 1996-2002 Hybrid Development Team
 *  Copyright (C) 2002-2005 ircd-ratbox development team
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2 of the License, or
 *  (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License
 *  along with this program; if not, write to the Free Software
 *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307
 *  USA
 *
 */

/*
 * Changes:
 *   July 6, 1999 - Rewrote most of the code here. When a client connects
 *     to the server and passes initial socket validation checks, it
 *     is owned by this module (auth) which returns it to the rest of the
 *     server when dns and auth queries are finished. Until the client is
 *     released, the server does not know it exists and does not process
 *     any messages from it.
 *     --Bleep  Thomas Helvey <tomh@inxpress.net>
 */
#include "stdinc.h"
#include "defaults.h"
#include "s_auth.h"
#include "s_conf.h"
#include "client.h"
#include "match.h"
#include "ircd.h"
#include "numeric.h"
#include "packet.h"
#include "dns.h"
#include "logger.h"
#include "s_stats.h"
#include "send.h"
#include "hook.h"
#include "blacklist.h"
#include "s_assert.h"

struct AuthRequest
{
        rb_dlink_node node;
        struct Client *client;  /* pointer to client struct for request */
        uint16_t dns_id;        /* DNS Query */
        unsigned int flags;     /* current state of request */
        rb_fde_t *F;            /* file descriptor for auth queries */
        time_t timeout;         /* time when query expires */
        uint16_t lport;
        uint16_t rport;
};

/*
 * flag values for AuthRequest
 * NAMESPACE: AM_xxx - Authentication Module
 */
#define AM_AUTH_CONNECTING   (1 << 0)
#define AM_AUTH_PENDING      (1 << 1)
#define AM_DNS_PENDING       (1 << 2)

#define SetDNSPending(x)     ((x)->flags |= AM_DNS_PENDING)
#define ClearDNSPending(x)   ((x)->flags &= ~AM_DNS_PENDING)
#define IsDNSPending(x)      ((x)->flags &  AM_DNS_PENDING)

#define SetAuthConnect(x)    ((x)->flags |= AM_AUTH_CONNECTING)
#define ClearAuthConnect(x)  ((x)->flags &= ~AM_AUTH_CONNECTING)
#define IsAuthConnect(x)     ((x)->flags &  AM_AUTH_CONNECTING)

#define SetAuthPending(x)    ((x)->flags |= AM_AUTH_PENDING)
#define ClearAuthPending(x)  ((x)->flags &= AM_AUTH_PENDING)
#define IsAuthPending(x)     ((x)->flags &  AM_AUTH_PENDING)

#define ClearAuth(x)         ((x)->flags &= ~(AM_AUTH_PENDING | AM_AUTH_CONNECTING))
#define IsDoingAuth(x)       ((x)->flags &  (AM_AUTH_PENDING | AM_AUTH_CONNECTING))

/*
 * a bit different approach
 * this replaces the original sendheader macros
 */

static const char *HeaderMessages[] =
{
        ":*** Looking up your hostname...",
        ":*** Found your hostname",
        ":*** Couldn't look up your hostname",
        ":*** Checking Ident",
        ":*** Got Ident response",
        ":*** No Ident response",
        ":*** Your hostname is too long, ignoring hostname",
        ":*** Your forward and reverse DNS do not match, ignoring hostname",
        ":*** Cannot verify hostname validity, ignoring hostname",
};

typedef enum
{
        REPORT_DO_DNS,
        REPORT_FIN_DNS,
        REPORT_FAIL_DNS,
        REPORT_DO_ID,
        REPORT_FIN_ID,
        REPORT_FAIL_ID,
        REPORT_HOST_TOOLONG,
        REPORT_HOST_MISMATCH,
        REPORT_HOST_UNKNOWN
}
ReportType;

#define sendheader(c, r) sendto_one_notice(c, "%s", HeaderMessages[(r)])

static rb_dlink_list auth_poll_list;
static rb_bh *auth_heap;
static EVH timeout_auth_queries_event;

static PF read_auth_reply;
static CNCB auth_connect_callback;

/*
 * init_auth()
 *
 * Initialise the auth code
 */
void
init_auth(void)
{
        /* This hook takes a struct Client for its argument */
        memset(&auth_poll_list, 0, sizeof(auth_poll_list));
        rb_event_addish("timeout_auth_queries_event", timeout_auth_queries_event, NULL, 1);
        auth_heap = rb_bh_create(sizeof(struct AuthRequest), LCLIENT_HEAP_SIZE, "auth_heap");
}

/*
 * make_auth_request - allocate a new auth request
 */
static struct AuthRequest *
make_auth_request(struct Client *client)
{
        struct AuthRequest *request = rb_bh_alloc(auth_heap);
        client->localClient->auth_request = request;
        request->F = NULL;
        request->client = client;
        request->timeout = rb_current_time() + ConfigFileEntry.connect_timeout;
        return request;
}

/*
 * free_auth_request - cleanup auth request allocations
 */
static void
free_auth_request(struct AuthRequest *request)
{
        rb_bh_free(auth_heap, request);
}

/*
 * release_auth_client - release auth client from auth system
 * this adds the client into the local client lists so it can be read by
 * the main io processing loop
 */
static void
release_auth_client(struct AuthRequest *auth)
{
        struct Client *client = auth->client;

        if(IsDNSPending(auth) || IsDoingAuth(auth))
                return;

        client->localClient->auth_request = NULL;
        rb_dlinkDelete(&auth->node, &auth_poll_list);
        free_auth_request(auth);

        /*
         * When a client has auth'ed, we want to start reading what it sends
         * us. This is what read_packet() does.
         *     -- adrian
         */
        rb_dlinkAddTail(client, &client->node, &global_client_list);
        read_packet(client->localClient->F, client);
}

/*
 * auth_dns_callback - called when resolver query finishes
 * if the query resulted in a successful search, hp will contain
 * a non-null pointer, otherwise hp will be null.
 * set the client on it's way to a connection completion, regardless
 * of success of failure
 */
static void
auth_dns_callback(const char *result, int status, int aftype, void *vptr)
{
        struct AuthRequest *auth = (struct AuthRequest *) vptr;
        ClearDNSPending(auth);

        /* XXX: this shouldn't happen, but it does. -nenolod */
        if(auth->client->localClient == NULL)
        {
                sendto_realops_snomask(SNO_GENERAL, L_ALL,
                        "auth_dns_callback(): auth->client->localClient (%s) is NULL", get_client_name(auth->client, HIDE_IP));

                rb_dlinkDelete(&auth->node, &auth_poll_list);
                free_auth_request(auth);

                /* and they will silently drop through and all will hopefully be ok... -nenolod */
                return;
        }

        if(result != NULL && status)
        {
                int good = 1;

                if(good && strlen(result) <= HOSTLEN)
                {
                        rb_strlcpy(auth->client->host, result, sizeof(auth->client->host));
                        sendheader(auth->client, REPORT_FIN_DNS);
                }
                else if (strlen(result) > HOSTLEN)
                        sendheader(auth->client, REPORT_HOST_TOOLONG);
        }
        else
                sendheader(auth->client, REPORT_FAIL_DNS);

        release_auth_client(auth);
}

/*
 * authsenderr - handle auth send errors
 */
static void
auth_error(struct AuthRequest *auth)
{
        ++ServerStats.is_abad;

        rb_close(auth->F);
        auth->F = NULL;

        ClearAuth(auth);
        sendheader(auth->client, REPORT_FAIL_ID);

        release_auth_client(auth);
}

/*
 * start_auth_query - Flag the client to show that an attempt to
 * contact the ident server on
 * the client's host.  The connect and subsequently the socket are all put
 * into 'non-blocking' mode.  Should the connect or any later phase of the
 * identifing process fail, it is aborted and the user is given a username
 * of "unknown".
 */
static int
start_auth_query(struct AuthRequest *auth)
{
        struct rb_sockaddr_storage localaddr, destaddr;
        rb_fde_t *F;
        int family;

        if(IsAnyDead(auth->client))
                return 0;

        family = GET_SS_FAMILY(&auth->client->localClient->ip);
        if((F = rb_socket(family, SOCK_STREAM, 0, "ident")) == NULL)
        {
                ilog_error("creating auth stream socket");
                ++ServerStats.is_abad;
                return 0;
        }

        /*
         * TBD: this is a pointless arbitrary limit .. we either have a socket or not. -nenolod
         */
        if((maxconnections - 10) < rb_get_fd(F))
        {
                sendto_realops_snomask(SNO_GENERAL, L_ALL,
                                     "Can't allocate fd for auth on %s",
                                     get_client_name(auth->client, SHOW_IP));
                rb_close(F);
                return 0;
        }

        sendheader(auth->client, REPORT_DO_ID);

        /*
         * get the local address of the client and bind to that to
         * make the auth request.  This used to be done only for
         * ifdef VIRTUAL_HOST, but needs to be done for all clients
         * since the ident request must originate from that same address--
         * and machines with multiple IP addresses are common now
         */
        localaddr = auth->client->preClient->lip;

        /* XXX mangle_mapped_sockaddr((struct sockaddr *)&localaddr); */
#ifdef RB_IPV6
        if(GET_SS_FAMILY(&localaddr) == AF_INET6)
        {
                auth->lport = ntohs(((struct sockaddr_in6 *)&localaddr)->sin6_port);
                ((struct sockaddr_in6 *)&localaddr)->sin6_port = 0;
        }
        else
#endif
        {
                auth->lport = ntohs(((struct sockaddr_in *)&localaddr)->sin_port);
                ((struct sockaddr_in *)&localaddr)->sin_port = 0;
        }

        destaddr = auth->client->localClient->ip;
#ifdef RB_IPV6
        if(GET_SS_FAMILY(&localaddr) == AF_INET6)
        {
                auth->rport = ntohs(((struct sockaddr_in6 *)&destaddr)->sin6_port);
                ((struct sockaddr_in6 *)&destaddr)->sin6_port = htons(113);
        }
        else
#endif
        {
                auth->rport = ntohs(((struct sockaddr_in *)&destaddr)->sin_port);
                ((struct sockaddr_in *)&destaddr)->sin_port = htons(113);
        }

        auth->F = F;
        SetAuthConnect(auth);

        rb_connect_tcp(F, (struct sockaddr *)&destaddr,
                         (struct sockaddr *) &localaddr, GET_SS_LEN(&localaddr),
                         auth_connect_callback, auth,
                         GlobalSetOptions.ident_timeout);
        return 1;               /* We suceed here for now */
}

/*
 * GetValidIdent - parse ident query reply from identd server
 *
 * Inputs        - pointer to ident buf
 * Output        - NULL if no valid ident found, otherwise pointer to name
 * Side effects  -
 */
static char *
GetValidIdent(char *buf)
{
        int remp = 0;
        int locp = 0;
        char *colon1Ptr;
        char *colon2Ptr;
        char *colon3Ptr;
        char *commaPtr;
        char *remotePortString;

        /* All this to get rid of a sscanf() fun. */
        remotePortString = buf;

        colon1Ptr = strchr(remotePortString, ':');
        if(!colon1Ptr)
                return 0;

        *colon1Ptr = '\0';
        colon1Ptr++;
        colon2Ptr = strchr(colon1Ptr, ':');
        if(!colon2Ptr)
                return 0;

        *colon2Ptr = '\0';
        colon2Ptr++;
        commaPtr = strchr(remotePortString, ',');

        if(!commaPtr)
                return 0;

        *commaPtr = '\0';
        commaPtr++;

        remp = atoi(remotePortString);
        if(!remp)
                return 0;

        locp = atoi(commaPtr);
        if(!locp)
                return 0;

        /* look for USERID bordered by first pair of colons */
        if(!strstr(colon1Ptr, "USERID"))
                return 0;

        colon3Ptr = strchr(colon2Ptr, ':');
        if(!colon3Ptr)
                return 0;

        *colon3Ptr = '\0';
        colon3Ptr++;
        return (colon3Ptr);
}

/*
 * start_auth - starts auth (identd) and dns queries for a client
 */
void
start_auth(struct Client *client)
{
        struct AuthRequest *auth = 0;
        s_assert(0 != client);
        if(client == NULL)
                return;

        auth = make_auth_request(client);

        sendheader(client, REPORT_DO_DNS);

        /* No DNS cache now, remember? -- adrian */
        auth->dns_id = lookup_ip(client->sockhost, GET_SS_FAMILY(&client->localClient->ip), auth_dns_callback, auth);

        SetDNSPending(auth);

        if(ConfigFileEntry.disable_auth == 0)
                start_auth_query(auth);

        rb_dlinkAdd(auth, &auth->node, &auth_poll_list);
}

/*
 * timeout_auth_queries - timeout resolver and identd requests
 * allow clients through if requests failed
 */
static void
timeout_auth_queries_event(void *notused)
{
        rb_dlink_node *ptr;
        rb_dlink_node *next_ptr;
        struct AuthRequest *auth;

        RB_DLINK_FOREACH_SAFE(ptr, next_ptr, auth_poll_list.head)
        {
                auth = ptr->data;

                if(auth->timeout < rb_current_time())
                {
                        if(auth->F != NULL)
                                rb_close(auth->F);

                        if(IsDoingAuth(auth))
                        {
                                ClearAuth(auth);
                                ++ServerStats.is_abad;
                                sendheader(auth->client, REPORT_FAIL_ID);
                                auth->client->localClient->auth_request = NULL;
                        }
                        if(IsDNSPending(auth))
                        {
                                ClearDNSPending(auth);
                                cancel_lookup(auth->dns_id);
                                sendheader(auth->client, REPORT_FAIL_DNS);
                        }

                        auth->client->localClient->lasttime = rb_current_time();
                        release_auth_client(auth);
                }
        }
}

/*
 * auth_connect_callback() - deal with the result of rb_connect_tcp()
 *
 * If the connection failed, we simply close the auth fd and report
 * a failure. If the connection suceeded send the ident server a query
 * giving "theirport , ourport". The write is only attempted *once* so
 * it is deemed to be a fail if the entire write doesn't write all the
 * data given.  This shouldnt be a problem since the socket should have
 * a write buffer far greater than this message to store it in should
 * problems arise. -avalon
 */
static void
auth_connect_callback(rb_fde_t *F, int error, void *data)
{
        struct AuthRequest *auth = data;
        char authbuf[32];
        int authlen;

        /* Check the error */
        if(error != RB_OK)
        {
                /* We had an error during connection :( */
                auth_error(auth);
                return;
        }

        snprintf(authbuf, sizeof(authbuf), "%u , %u\r\n",
                   auth->rport, auth->lport);
        authlen = strlen(authbuf);

        if(rb_write(auth->F, authbuf, authlen) != authlen)
        {
                auth_error(auth);
                return;
        }
        ClearAuthConnect(auth);
        SetAuthPending(auth);
        read_auth_reply(auth->F, auth);
}


/*
 * read_auth_reply - read the reply (if any) from the ident server
 * we connected to.
 * We only give it one shot, if the reply isn't good the first time
 * fail the authentication entirely. --Bleep
 */
#define AUTH_BUFSIZ 128

static void
read_auth_reply(rb_fde_t *F, void *data)
{
        struct AuthRequest *auth = data;
        char *s = NULL;
        char *t = NULL;
        int len;
        int count;
        char buf[AUTH_BUFSIZ + 1];      /* buffer to read auth reply into */

        len = rb_read(F, buf, AUTH_BUFSIZ);

        if(len < 0 && rb_ignore_errno(errno))
        {
                rb_setselect(F, RB_SELECT_READ, read_auth_reply, auth);
                return;
        }

        if(len > 0)
        {
                buf[len] = '\0';

                if((s = GetValidIdent(buf)))
                {
                        t = auth->client->username;

                        while (*s == '~' || *s == '^')
                                s++;

                        for (count = USERLEN; *s && count; s++)
                        {
                                if(*s == '@')
                                {
                                        break;
                                }
                                if(!IsSpace(*s) && *s != ':' && *s != '[')
                                {
                                        *t++ = *s;
                                        count--;
                                }
                        }
                        *t = '\0';
                }
        }

        rb_close(auth->F);
        auth->F = NULL;
        ClearAuth(auth);

        if(s == NULL)
        {
                ++ServerStats.is_abad;
                strcpy(auth->client->username, "unknown");
                sendheader(auth->client, REPORT_FAIL_ID);
        }
        else
        {
                sendheader(auth->client, REPORT_FIN_ID);
                ++ServerStats.is_asuc;
                SetGotId(auth->client);
        }

        release_auth_client(auth);
}



/*
 * delete_auth_queries()
 */
void
delete_auth_queries(struct Client *target_p)
{
        struct AuthRequest *auth;

        if(target_p == NULL || target_p->localClient == NULL ||
           target_p->localClient->auth_request == NULL)
                return;

        auth = target_p->localClient->auth_request;
        target_p->localClient->auth_request = NULL;

        if(IsDNSPending(auth))
                cancel_lookup(auth->dns_id);

        if(auth->F != NULL)
                rb_close(auth->F);

        rb_dlinkDelete(&auth->node, &auth_poll_list);
        free_auth_request(auth);
}