authd/providers/ident.c

   1 /* authd/providers/ident.c - ident lookup provider for authd
   2  * Copyright (c) 2016 Elizabeth Myers <elizabeth@interlinked.me>
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice is present in all copies.
   7  *
   8  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
   9  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  10  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  11  * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
  12  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  13  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  14  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  15  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  16  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
  17  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  18  * POSSIBILITY OF SUCH DAMAGE.
  19  */
  20
  21 /* Largely adapted from old s_auth.c, but reworked for authd. rDNS code
  22  * moved to its own provider.
  23  *
  24  * --Elizafox 13 March 2016
  25  */
  26
  27 #include "stdinc.h"
  28 #include "defaults.h"
  29 #include "match.h"
  30 #include "authd.h"
  31 #include "notice.h"
  32 #include "provider.h"
  33 #include "res.h"
  34
  35 #define SELF_PID (ident_provider.id)
  36
  37 #define IDENT_BUFSIZE 128
  38
  39 struct ident_query
  40 {
  41         rb_fde_t *F;                            /* Our FD */
  42 };
  43
  44 /* Goinked from old s_auth.c --Elizafox */
  45 static const char *messages[] =
  46 {
  47         "*** Checking Ident",
  48         "*** Got Ident response",
  49         "*** No Ident response",
  50         "*** Cannot verify ident validity, ignoring ident",
  51         "*** Ident disabled, not checking ident",
  52 };
  53
  54 typedef enum
  55 {
  56         REPORT_LOOKUP,
  57         REPORT_FOUND,
  58         REPORT_FAIL,
  59         REPORT_INVALID,
  60         REPORT_DISABLED,
  61 } ident_message;
  62
  63 static CNCB ident_connected;
  64 static PF read_ident_reply;
  65
  66 static void client_fail(struct auth_client *auth, ident_message message);
  67 static void client_success(struct auth_client *auth);
  68 static char * get_valid_ident(char *buf);
  69
  70 static int ident_timeout = IDENT_TIMEOUT_DEFAULT;
  71 static bool ident_enable = true;
  72
  73
  74 /*
  75  * ident_connected() - deal with the result of rb_connect_tcp()
  76  *
  77  * If the connection failed, we simply close the auth fd and report
  78  * a failure. If the connection suceeded send the ident server a query
  79  * giving "theirport , ourport". The write is only attempted *once* so
  80  * it is deemed to be a fail if the entire write doesn't write all the
  81  * data given.  This shouldnt be a problem since the socket should have
  82  * a write buffer far greater than this message to store it in should
  83  * problems arise. -avalon
  84  */
  85 static void
  86 ident_connected(rb_fde_t *F __unused, int error, void *data)
  87 {
  88         struct auth_client *auth = data;
  89         struct ident_query *query;
  90         char authbuf[32];
  91         int authlen;
  92
  93         lrb_assert(auth != NULL);
  94         query = get_provider_data(auth, SELF_PID);
  95         lrb_assert(query != NULL);
  96
  97         /* Check the error */
  98         if(error != RB_OK)
  99         {
 100                 /* We had an error during connection :( */
 101                 client_fail(auth, REPORT_FAIL);
 102                 return;
 103         }
 104
 105         snprintf(authbuf, sizeof(authbuf), "%u , %u\r\n",
 106                         auth->c_port, auth->l_port);
 107         authlen = strlen(authbuf);
 108
 109         if(rb_write(query->F, authbuf, authlen) != authlen)
 110         {
 111                 client_fail(auth, REPORT_FAIL);
 112                 return;
 113         }
 114
 115         read_ident_reply(query->F, auth);
 116 }
 117
 118 static void
 119 read_ident_reply(rb_fde_t *F, void *data)
 120 {
 121         struct auth_client *auth = data;
 122         char buf[IDENT_BUFSIZE + 1];    /* buffer to read auth reply into */
 123         ident_message message = REPORT_FAIL;
 124         char *s = NULL;
 125         char *t = NULL;
 126         ssize_t len;
 127         int count;
 128
 129         len = rb_read(F, buf, IDENT_BUFSIZE);
 130         if(len < 0 && rb_ignore_errno(errno))
 131         {
 132                 rb_setselect(F, RB_SELECT_READ, read_ident_reply, auth);
 133                 return;
 134         }
 135
 136         if(len > 0)
 137         {
 138                 if((s = get_valid_ident(buf)) != NULL)
 139                 {
 140                         t = auth->username;
 141
 142                         while (*s == '~' || *s == '^')
 143                                 s++;
 144
 145                         for (count = USERLEN; *s && count; s++)
 146                         {
 147                                 if(*s == '@' || *s == '\r' || *s == '\n')
 148                                         break;
 149
 150                                 if(*s != ' ' && *s != ':' && *s != '[')
 151                                 {
 152                                         *t++ = *s;
 153                                         count--;
 154                                 }
 155                         }
 156                         *t = '\0';
 157                 }
 158                 else
 159                         message = REPORT_INVALID;
 160         }
 161
 162         if(s == NULL)
 163                 client_fail(auth, message);
 164         else
 165                 client_success(auth);
 166 }
 167
 168 static void
 169 client_fail(struct auth_client *auth, ident_message report)
 170 {
 171         struct ident_query *query = get_provider_data(auth, SELF_PID);
 172
 173         lrb_assert(query != NULL);
 174
 175         rb_strlcpy(auth->username, "*", sizeof(auth->username));
 176
 177         if(query->F != NULL)
 178                 rb_close(query->F);
 179
 180         rb_free(query);
 181         set_provider_data(auth, SELF_PID, NULL);
 182         set_provider_timeout_absolute(auth, SELF_PID, 0);
 183
 184         notice_client(auth->cid, messages[report]);
 185         provider_done(auth, SELF_PID);
 186
 187         auth_client_unref(auth);
 188 }
 189
 190 static void
 191 client_success(struct auth_client *auth)
 192 {
 193         struct ident_query *query = get_provider_data(auth, SELF_PID);
 194
 195         lrb_assert(query != NULL);
 196
 197         if(query->F != NULL)
 198                 rb_close(query->F);
 199
 200         rb_free(query);
 201         set_provider_data(auth, SELF_PID, NULL);
 202         set_provider_timeout_absolute(auth, SELF_PID, 0);
 203
 204         notice_client(auth->cid, messages[REPORT_FOUND]);
 205         provider_done(auth, SELF_PID);
 206
 207         auth_client_unref(auth);
 208 }
 209
 210 /* get_valid_ident
 211  * parse ident query reply from identd server
 212  *
 213  * Taken from old s_auth.c --Elizafox
 214  *
 215  * Inputs       - pointer to ident buf
 216  * Outputs      - NULL if no valid ident found, otherwise pointer to name
 217  * Side effects - None
 218  */
 219 static char *
 220 get_valid_ident(char *buf)
 221 {
 222         int remp = 0;
 223         int locp = 0;
 224         char *colon1Ptr;
 225         char *colon2Ptr;
 226         char *colon3Ptr;
 227         char *commaPtr;
 228         char *remotePortString;
 229
 230         /* All this to get rid of a sscanf() fun. */
 231         remotePortString = buf;
 232
 233         colon1Ptr = strchr(remotePortString, ':');
 234         if(!colon1Ptr)
 235                 return NULL;
 236
 237         *colon1Ptr = '\0';
 238         colon1Ptr++;
 239         colon2Ptr = strchr(colon1Ptr, ':');
 240         if(!colon2Ptr)
 241                 return NULL;
 242
 243         *colon2Ptr = '\0';
 244         colon2Ptr++;
 245         commaPtr = strchr(remotePortString, ',');
 246
 247         if(!commaPtr)
 248                 return NULL;
 249
 250         *commaPtr = '\0';
 251         commaPtr++;
 252
 253         remp = atoi(remotePortString);
 254         if(!remp)
 255                 return NULL;
 256
 257         locp = atoi(commaPtr);
 258         if(!locp)
 259                 return NULL;
 260
 261         /* look for USERID bordered by first pair of colons */
 262         if(!strstr(colon1Ptr, "USERID"))
 263                 return NULL;
 264
 265         colon3Ptr = strchr(colon2Ptr, ':');
 266         if(!colon3Ptr)
 267                 return NULL;
 268
 269         *colon3Ptr = '\0';
 270         colon3Ptr++;
 271         return (colon3Ptr);
 272 }
 273
 274 static void
 275 ident_destroy(void)
 276 {
 277         struct auth_client *auth;
 278         rb_dictionary_iter iter;
 279
 280         /* Nuke all ident queries */
 281         RB_DICTIONARY_FOREACH(auth, &iter, auth_clients)
 282         {
 283                 if(get_provider_data(auth, SELF_PID) != NULL)
 284                         client_fail(auth, REPORT_FAIL);
 285                 /* auth is now invalid as we have no reference */
 286         }
 287 }
 288
 289 static bool
 290 ident_start(struct auth_client *auth)
 291 {
 292         struct ident_query *query = rb_malloc(sizeof(struct ident_query));
 293         struct rb_sockaddr_storage l_addr, c_addr;
 294         int family = GET_SS_FAMILY(&auth->c_addr);
 295
 296         lrb_assert(get_provider_data(auth, SELF_PID) == NULL);
 297
 298         if(!ident_enable)
 299         {
 300                 rb_free(query);
 301                 notice_client(auth->cid, messages[REPORT_DISABLED]);
 302                 provider_done(auth, SELF_PID);
 303                 return true;
 304         }
 305
 306         auth_client_ref(auth);
 307
 308         notice_client(auth->cid, messages[REPORT_LOOKUP]);
 309
 310         set_provider_data(auth, SELF_PID, query);
 311         set_provider_timeout_relative(auth, SELF_PID, ident_timeout);
 312
 313         if((query->F = rb_socket(family, SOCK_STREAM, auth->protocol, "ident")) == NULL)
 314         {
 315                 warn_opers(L_DEBUG, "Could not create ident socket: %s", strerror(errno));
 316                 client_fail(auth, REPORT_FAIL);
 317                 return true;    /* Not a fatal error */
 318         }
 319
 320         /* Build sockaddr_storages for rb_connect_tcp below */
 321         l_addr = auth->l_addr;
 322         c_addr = auth->c_addr;
 323
 324         SET_SS_PORT(&l_addr, 0);
 325         SET_SS_PORT(&c_addr, htons(113));
 326
 327         rb_connect_tcp(query->F, (struct sockaddr *)&c_addr,
 328                         (struct sockaddr *)&l_addr,
 329                         ident_connected,
 330                         auth, ident_timeout);
 331
 332         return true;
 333 }
 334
 335 static void
 336 ident_cancel(struct auth_client *auth)
 337 {
 338         struct ident_query *query = get_provider_data(auth, SELF_PID);
 339
 340         if(query != NULL)
 341                 client_fail(auth, REPORT_FAIL);
 342 }
 343
 344 static void
 345 add_conf_ident_timeout(const char *key __unused, int parc __unused, const char **parv)
 346 {
 347         int timeout = atoi(parv[0]);
 348
 349         if(timeout < 0)
 350         {
 351                 warn_opers(L_CRIT, "Ident: ident timeout < 0 (value: %d)", timeout);
 352                 exit(EX_PROVIDER_ERROR);
 353         }
 354
 355         ident_timeout = timeout;
 356 }
 357
 358 static void
 359 set_ident_enabled(const char *key __unused, int parc __unused, const char **parv)
 360 {
 361         ident_enable = (*parv[0] == '1');
 362 }
 363
 364 struct auth_opts_handler ident_options[] =
 365 {
 366         { "ident_timeout", 1, add_conf_ident_timeout },
 367         { "ident_enabled", 1, set_ident_enabled },
 368         { NULL, 0, NULL },
 369 };
 370
 371
 372 struct auth_provider ident_provider =
 373 {
 374         .name = "ident",
 375         .letter = 'I',
 376         .start = ident_start,
 377         .destroy = ident_destroy,
 378         .cancel = ident_cancel,
 379         .timeout = ident_cancel,
 380         .opt_handlers = ident_options,
 381 };