authd/providers/opm.c

   1 /* authd/providers/opm.c - small open proxy monitor
   2  * Copyright (c) 2016 Elizabeth Myers <elizabeth@interlinked.me>
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice is present in all copies.
   7  *
   8  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
   9  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  10  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  11  * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
  12  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  13  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  14  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  15  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  16  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
  17  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  18  * POSSIBILITY OF SUCH DAMAGE.
  19  */
  20
  21 #include "stdinc.h"
  22 #include "rb_lib.h"
  23 #include "defaults.h"
  24 #include "setup.h"
  25 #include "authd.h"
  26 #include "notice.h"
  27 #include "provider.h"
  28
  29 #define SELF_PID (opm_provider.id)
  30
  31 #define OPM_READSIZE 128
  32
  33 typedef enum protocol_t
  34 {
  35         PROTO_NONE,
  36         PROTO_SOCKS4,
  37         PROTO_SOCKS5,
  38         PROTO_HTTP_CONNECT,
  39         PROTO_HTTPS_CONNECT,
  40 } protocol_t;
  41
  42 /* Lookup data associated with auth client */
  43 struct opm_lookup
  44 {
  45         rb_dlink_list scans;    /* List of scans */
  46         bool in_progress;
  47 };
  48
  49 struct opm_scan;
  50 typedef void (*opm_callback_t)(struct opm_scan *);
  51
  52 /* A proxy scanner */
  53 struct opm_proxy
  54 {
  55         char note[16];
  56         protocol_t proto;
  57         uint16_t port;
  58         bool ssl;               /* Connect to proxy with SSL */
  59         bool ipv6;              /* Proxy supports IPv6 */
  60
  61         opm_callback_t callback;
  62
  63         rb_dlink_node node;
  64 };
  65
  66 /* A listener for proxy replies */
  67 struct opm_listener
  68 {
  69         char ip[HOSTIPLEN];
  70         uint16_t port;
  71         struct rb_sockaddr_storage addr;
  72         rb_fde_t *F;
  73 };
  74
  75 /* An individual proxy scan */
  76 struct opm_scan
  77 {
  78         struct auth_client *auth;
  79         rb_fde_t *F;                    /* fd for scan */
  80
  81         struct opm_proxy *proxy;        /* Associated proxy */
  82         struct opm_listener *listener;  /* Associated listener */
  83
  84         rb_dlink_node node;
  85 };
  86
  87 /* Proxies that we scan for */
  88 static rb_dlink_list proxy_scanners;
  89
  90 static ACCB accept_opm;
  91 static PF read_opm_reply;
  92
  93 static CNCB opm_connected;
  94
  95 static void opm_cancel(struct auth_client *auth);
  96 static bool create_listener(const char *ip, uint16_t port);
  97
  98 static int opm_timeout = OPM_TIMEOUT_DEFAULT;
  99 static bool opm_enable = false;
 100
 101 enum
 102 {
 103         LISTEN_IPV4,
 104         LISTEN_IPV6,
 105         LISTEN_LAST,
 106 };
 107
 108 /* IPv4 and IPv6 */
 109 static struct opm_listener listeners[LISTEN_LAST];
 110
 111 static inline protocol_t
 112 get_protocol_from_string(const char *str)
 113 {
 114         if(strcasecmp(str, "socks4") == 0)
 115                 return PROTO_SOCKS4;
 116         else if(strcasecmp(str, "socks5") == 0)
 117                 return PROTO_SOCKS5;
 118         else if(strcasecmp(str, "httpconnect") == 0)
 119                 return PROTO_HTTP_CONNECT;
 120         else if(strcasecmp(str, "httpsconnect") == 0)
 121                 return PROTO_HTTPS_CONNECT;
 122         else
 123                 return PROTO_NONE;
 124 }
 125
 126 static inline struct opm_proxy *
 127 find_proxy_scanner(protocol_t proto, uint16_t port)
 128 {
 129         rb_dlink_node *ptr;
 130
 131         RB_DLINK_FOREACH(ptr, proxy_scanners.head)
 132         {
 133                 struct opm_proxy *proxy = ptr->data;
 134
 135                 if(proxy->proto == proto && proxy->port == port)
 136                         return proxy;
 137         }
 138
 139         return NULL;
 140 }
 141
 142 /* This is called when an open proxy connects to us */
 143 static void
 144 read_opm_reply(rb_fde_t *F, void *data)
 145 {
 146         rb_dlink_node *ptr;
 147         struct auth_client *auth = data;
 148         struct opm_lookup *lookup;
 149         char readbuf[OPM_READSIZE];
 150         ssize_t len;
 151
 152         lrb_assert(auth != NULL);
 153         lookup = get_provider_data(auth, SELF_PID);
 154         lrb_assert(lookup != NULL);
 155
 156         if((len = rb_read(F, readbuf, sizeof(readbuf))) < 0 && rb_ignore_errno(errno))
 157         {
 158                 rb_setselect(F, RB_SELECT_READ, read_opm_reply, auth);
 159                 return;
 160         }
 161         else if(len <= 0)
 162         {
 163                 /* Dead */
 164                 rb_close(F);
 165                 return;
 166         }
 167
 168         RB_DLINK_FOREACH(ptr, proxy_scanners.head)
 169         {
 170                 struct opm_proxy *proxy = ptr->data;
 171
 172                 if(strncmp(proxy->note, readbuf, strlen(proxy->note)) == 0)
 173                 {
 174                         rb_dlink_node *ptr, *nptr;
 175
 176                         /* Cancel outstanding lookups */
 177                         RB_DLINK_FOREACH_SAFE(ptr, nptr, lookup->scans.head)
 178                         {
 179                                 struct opm_scan *scan = ptr->data;
 180
 181                                 rb_close(scan->F);
 182                                 rb_free(scan);
 183                         }
 184
 185                         /* No longer needed, client is going away */
 186                         rb_free(lookup);
 187
 188                         reject_client(auth, SELF_PID, readbuf, "Open proxy detected");
 189                         break;
 190                 }
 191         }
 192
 193         rb_close(F);
 194 }
 195
 196 static void
 197 accept_opm(rb_fde_t *F, int status, struct sockaddr *addr, rb_socklen_t len, void *data)
 198 {
 199         struct auth_client *auth = NULL;
 200         struct opm_listener *listener = data;
 201         struct rb_sockaddr_storage localaddr;
 202         unsigned int llen = sizeof(struct rb_sockaddr_storage);
 203         rb_dictionary_iter iter;
 204
 205         if(status != 0 || listener == NULL)
 206         {
 207                 rb_close(F);
 208                 return;
 209         }
 210
 211         if(getsockname(rb_get_fd(F), (struct sockaddr *)&localaddr, &llen))
 212         {
 213                 /* This can happen if the client goes away after accept */
 214                 rb_close(F);
 215                 return;
 216         }
 217
 218         /* Correlate connection with client(s) */
 219         RB_DICTIONARY_FOREACH(auth, &iter, auth_clients)
 220         {
 221                 if(GET_SS_FAMILY(&auth->c_addr) != GET_SS_FAMILY(&localaddr))
 222                         continue;
 223
 224                 /* Compare the addresses */
 225                 switch(GET_SS_FAMILY(&localaddr))
 226                 {
 227                 case AF_INET:
 228                         {
 229                                 struct sockaddr_in *s = (struct sockaddr_in *)&localaddr, *c = (struct sockaddr_in *)&auth->c_addr;
 230
 231                                 if(s->sin_addr.s_addr == c->sin_addr.s_addr)
 232                                 {
 233                                         /* Match... check if it's real */
 234                                         rb_setselect(F, RB_SELECT_READ, read_opm_reply, auth);
 235                                         return;
 236                                 }
 237                                 break;
 238                         }
 239 #ifdef RB_IPV6
 240                 case AF_INET6:
 241                         {
 242                                 struct sockaddr_in6 *s = (struct sockaddr_in6 *)&localaddr, *c = (struct sockaddr_in6 *)&auth->c_addr;
 243
 244                                 if(IN6_ARE_ADDR_EQUAL(&s->sin6_addr, &c->sin6_addr))
 245                                 {
 246                                         rb_setselect(F, RB_SELECT_READ, read_opm_reply, auth);
 247                                         return;
 248                                 }
 249                                 break;
 250                         }
 251 #endif
 252                 default:
 253                         warn_opers(L_CRIT, "OPM: unknown address type in listen function");
 254                         exit(EX_PROVIDER_ERROR);
 255                 }
 256         }
 257
 258         /* We don't care about the socket if we get here */
 259         rb_close(F);
 260 }
 261
 262 /* Scanners */
 263
 264 static void
 265 opm_connected(rb_fde_t *F, int error, void *data)
 266 {
 267         struct opm_scan *scan = data;
 268         struct opm_proxy *proxy = scan->proxy;
 269         struct auth_client *auth = scan->auth;
 270         struct opm_lookup *lookup = get_provider_data(auth, SELF_PID);
 271
 272         if(error || !opm_enable)
 273         {
 274                 //notice_client(scan->auth->cid, "*** Scan not connected: %s", proxy->note);
 275                 goto end;
 276         }
 277
 278         switch(GET_SS_FAMILY(&auth->c_addr))
 279         {
 280         case AF_INET:
 281                 if(listeners[LISTEN_IPV4].F == NULL)
 282                         /* They cannot respond to us */
 283                         goto end;
 284
 285                 break;
 286 #ifdef RB_IPV6
 287         case AF_INET6:
 288                 if(!proxy->ipv6)
 289                         /* Welp, too bad */
 290                         goto end;
 291
 292                 if(listeners[LISTEN_IPV6].F == NULL)
 293                         /* They cannot respond to us */
 294                         goto end;
 295
 296                 break;
 297 #endif
 298         default:
 299                 goto end;
 300         }
 301
 302         proxy->callback(scan);
 303
 304 end:
 305         rb_close(scan->F);
 306         rb_dlinkDelete(&scan->node, &lookup->scans);
 307         rb_free(scan);
 308 }
 309
 310 static void
 311 socks4_connected(struct opm_scan *scan)
 312 {
 313         uint8_t sendbuf[9]; /* Size we're building */
 314         uint8_t *c = sendbuf;
 315
 316         memcpy(c, "\x04\x01", 2); c += 2; /* Socks version 4, connect command */
 317         memcpy(c, &(((struct sockaddr_in *)&scan->listener->addr)->sin_port), 2); c += 2; /* Port */
 318         memcpy(c, &(((struct sockaddr_in *)&scan->listener->addr)->sin_addr.s_addr), 4); c += 4; /* Address */
 319         *c = '\x00'; /* No userid */
 320
 321         /* Send header */
 322         if(rb_write(scan->F, sendbuf, sizeof(sendbuf)) < 0)
 323                 return;
 324
 325         /* Send note */
 326         if(rb_write(scan->F, scan->proxy->note, strlen(scan->proxy->note) + 1) < 0)
 327                 return;
 328 }
 329
 330 static void
 331 socks5_connected(struct opm_scan *scan)
 332 {
 333         struct auth_client *auth = scan->auth;
 334         uint8_t sendbuf[25]; /* Size we're building */
 335         uint8_t *c = sendbuf;
 336
 337         /* Build the version header and socks request
 338          * version header (3 bytes): version, number of auth methods, auth type (0 for none)
 339          * connect req (3 bytes): version, command (1 = connect), reserved (0)
 340          */
 341         memcpy(c, "\x05\x01\x00\x05\x01\x00", 6); c += 6;
 342
 343         switch(GET_SS_FAMILY(&auth->c_addr))
 344         {
 345         case AF_INET:
 346                 *(c++) = '\x01'; /* Address type (1 = IPv4) */
 347                 memcpy(c, &(((struct sockaddr_in *)&scan->listener->addr)->sin_addr.s_addr), 4); c += 4; /* Address */
 348                 memcpy(c, &(((struct sockaddr_in *)&scan->listener->addr)->sin_port), 2); c += 2; /* Port */
 349                 break;
 350 #ifdef RB_IPV6
 351         case AF_INET6:
 352                 *(c++) = '\x04'; /* Address type (4 = IPv6) */
 353                 memcpy(c, ((struct sockaddr_in6 *)&scan->listener->addr)->sin6_addr.s6_addr, 16); c += 16; /* Address */
 354                 memcpy(c, &(((struct sockaddr_in6 *)&scan->listener->addr)->sin6_port), 2); c += 2; /* Port */
 355                 break;
 356 #endif
 357         default:
 358                 return;
 359         }
 360
 361         /* Send header */
 362         if(rb_write(scan->F, sendbuf, (size_t)(sendbuf - c)) <= 0)
 363                 return;
 364
 365         /* Now the note in a separate write */
 366         if(rb_write(scan->F, scan->proxy->note, strlen(scan->proxy->note) + 1) <= 0)
 367                 return;
 368 }
 369
 370 static void
 371 http_connect_connected(struct opm_scan *scan)
 372 {
 373         struct auth_client *auth = scan->auth;
 374         char sendbuf[128]; /* A bit bigger than we need but better safe than sorry */
 375
 376         /* Simple enough to build */
 377         snprintf(sendbuf, sizeof(sendbuf), "CONNECT %s:%hu HTTP/1.0\r\n\r\n", scan->listener->ip, scan->listener->port);
 378
 379         /* Send request */
 380         if(rb_write(scan->F, sendbuf, strlen(sendbuf)) <= 0)
 381                 return;
 382
 383         /* Now the note in a separate write */
 384         if(rb_write(scan->F, scan->proxy->note, strlen(scan->proxy->note) + 1) <= 0)
 385                 return;
 386
 387         /* MiroTik needs this, and as a separate write */
 388         if(rb_write(scan->F, "\r\n", 2) <= 0)
 389                 return;
 390 }
 391
 392 /* Establish connections */
 393 static inline void
 394 establish_connection(struct auth_client *auth, struct opm_proxy *proxy)
 395 {
 396         struct opm_lookup *lookup = get_provider_data(auth, SELF_PID);
 397         struct opm_scan *scan = rb_malloc(sizeof(struct opm_scan));
 398         struct opm_listener *listener;
 399         struct rb_sockaddr_storage c_a, l_a;
 400         int opt = 1;
 401
 402         lrb_assert(lookup != NULL);
 403
 404 #ifdef RB_IPV6
 405         if(GET_SS_FAMILY(&auth->c_addr) == AF_INET6)
 406         {
 407                 if(proxy->proto == PROTO_SOCKS4)
 408                 {
 409                         /* SOCKS4 doesn't support IPv6 */
 410                         rb_free(scan);
 411                         return;
 412                 }
 413                 listener = &listeners[LISTEN_IPV6];
 414         }
 415         else
 416 #endif
 417                 listener = &listeners[LISTEN_IPV4];
 418
 419         if(listener->F == NULL)
 420         {
 421                 /* We can't respond */
 422                 rb_free(scan);
 423                 return;
 424         }
 425
 426         c_a = auth->c_addr;     /* Client */
 427         l_a = listener->addr;   /* Listener (connect using its IP) */
 428
 429         scan->auth = auth;
 430         scan->proxy = proxy;
 431         scan->listener = listener;
 432         if((scan->F = rb_socket(GET_SS_FAMILY(&auth->c_addr), SOCK_STREAM, 0, proxy->note)) == NULL)
 433         {
 434                 warn_opers(L_WARN, "OPM: could not create OPM socket (proto %s): %s", proxy->note, strerror(errno));
 435                 rb_free(scan);
 436                 return;
 437         }
 438
 439         /* Disable Nagle's algorithim - buffering could affect scans */
 440         (void)setsockopt(rb_get_fd(scan->F), IPPROTO_TCP, TCP_NODELAY, (char *)&opt, sizeof(opt));
 441
 442         SET_SS_PORT(&l_a, 0);
 443         SET_SS_PORT(&c_a, htons(proxy->port));
 444
 445         rb_dlinkAdd(scan, &scan->node, &lookup->scans);
 446
 447         if(!proxy->ssl)
 448                 rb_connect_tcp(scan->F,
 449                                 (struct sockaddr *)&c_a,
 450                                 (struct sockaddr *)&l_a,
 451                                 opm_connected, scan, opm_timeout);
 452         else
 453                 rb_connect_tcp_ssl(scan->F,
 454                                 (struct sockaddr *)&c_a,
 455                                 (struct sockaddr *)&l_a,
 456                                 opm_connected, scan, opm_timeout);
 457 }
 458
 459 static bool
 460 create_listener(const char *ip, uint16_t port)
 461 {
 462         struct auth_client *auth;
 463         struct opm_listener *listener;
 464         struct rb_sockaddr_storage addr;
 465         rb_dictionary_iter iter;
 466         rb_fde_t *F;
 467         int opt = 1;
 468
 469         if(!rb_inet_pton_sock(ip, (struct sockaddr *)&addr))
 470         {
 471                 warn_opers(L_CRIT, "OPM: got a bad listener: %s:%hu", ip, port);
 472                 exit(EX_PROVIDER_ERROR);
 473         }
 474
 475         SET_SS_PORT(&addr, htons(port));
 476
 477 #ifdef RB_IPV6
 478         if(GET_SS_FAMILY(&addr) == AF_INET6)
 479         {
 480                 struct sockaddr_in6 *a1, *a2;
 481
 482                 listener = &listeners[LISTEN_IPV6];
 483
 484                 a1 = (struct sockaddr_in6 *)&addr;
 485                 a2 = (struct sockaddr_in6 *)&listener->addr;
 486
 487                 if(IN6_ARE_ADDR_EQUAL(&a1->sin6_addr, &a2->sin6_addr) &&
 488                         GET_SS_PORT(&addr) == GET_SS_PORT(&listener->addr) &&
 489                         listener->F != NULL)
 490                 {
 491                         /* Listener already exists */
 492                         return false;
 493                 }
 494         }
 495         else
 496 #endif
 497         {
 498                 struct sockaddr_in *a1, *a2;
 499
 500                 listener = &listeners[LISTEN_IPV4];
 501
 502                 a1 = (struct sockaddr_in *)&addr;
 503                 a2 = (struct sockaddr_in *)&listener->addr;
 504
 505                 if(a1->sin_addr.s_addr == a2->sin_addr.s_addr &&
 506                         GET_SS_PORT(&addr) == GET_SS_PORT(&listener->addr) &&
 507                         listener->F != NULL)
 508                 {
 509                         /* Listener already exists */
 510                         return false;
 511                 }
 512         }
 513
 514         if((F = rb_socket(GET_SS_FAMILY(&addr), SOCK_STREAM, 0, "OPM listener socket")) == NULL)
 515         {
 516                 /* This shouldn't fail, or we have big problems... */
 517                 warn_opers(L_CRIT, "OPM: cannot create socket: %s", strerror(errno));
 518                 exit(EX_PROVIDER_ERROR);
 519         }
 520
 521         if(setsockopt(rb_get_fd(F), SOL_SOCKET, SO_REUSEADDR, (char *)&opt, sizeof(opt)))
 522         {
 523                 /* This shouldn't fail either... */
 524                 warn_opers(L_CRIT, "OPM: cannot set options on socket: %s", strerror(errno));
 525                 exit(EX_PROVIDER_ERROR);
 526         }
 527
 528         if(bind(rb_get_fd(F), (struct sockaddr *)&addr, GET_SS_LEN(&addr)))
 529         {
 530                 /* Shit happens, let's not cripple authd over /this/ since it could be user error */
 531                 warn_opers(L_WARN, "OPM: cannot bind on socket: %s", strerror(errno));
 532                 rb_close(F);
 533                 return false;
 534         }
 535
 536         if(rb_listen(F, SOMAXCONN, false)) /* deferred accept could interfere with detection */
 537         {
 538                 /* Again, could be user error */
 539                 warn_opers(L_WARN, "OPM: cannot listen on socket: %s", strerror(errno));
 540                 rb_close(F);
 541                 return false;
 542         }
 543
 544         /* From this point forward we assume we have a listener */
 545
 546         if(listener->F != NULL)
 547                 /* Close old listener */
 548                 rb_close(listener->F);
 549
 550         listener->F = F;
 551
 552         /* Cancel clients that may be on old listener
 553          * XXX - should rescan clients that need it
 554          */
 555         RB_DICTIONARY_FOREACH(auth, &iter, auth_clients)
 556         {
 557                 opm_cancel(auth);
 558                 /* auth is now invalid as we have no reference */
 559         }
 560
 561         /* Copy data */
 562         rb_strlcpy(listener->ip, ip, sizeof(listener->ip));
 563         listener->port = port;
 564         listener->addr = addr;
 565
 566         opm_enable = true; /* Implicitly set this to true for now if we have a listener */
 567         rb_accept_tcp(listener->F, NULL, accept_opm, listener);
 568         return true;
 569 }
 570
 571 static void
 572 opm_scan(struct auth_client *auth)
 573 {
 574         rb_dlink_node *ptr;
 575         struct opm_lookup *lookup;
 576
 577         lrb_assert(auth != NULL);
 578
 579         lookup = get_provider_data(auth, SELF_PID);
 580         set_provider_timeout_relative(auth, SELF_PID, opm_timeout);
 581
 582         lookup->in_progress = true;
 583
 584         RB_DLINK_FOREACH(ptr, proxy_scanners.head)
 585         {
 586                 struct opm_proxy *proxy = ptr->data;
 587                 //notice_client(auth->cid, "*** Scanning for proxy type %s", proxy->note);
 588                 establish_connection(auth, proxy);
 589         }
 590
 591         notice_client(auth->cid, "*** Scanning for open proxies...");
 592 }
 593
 594 /* This is called every time a provider is completed as long as we are marked not done */
 595 static void
 596 opm_initiate(struct auth_client *auth, uint32_t provider)
 597 {
 598         struct opm_lookup *lookup = get_provider_data(auth, SELF_PID);
 599         uint32_t rdns_pid, ident_pid;
 600
 601         lrb_assert(provider != SELF_PID);
 602         lrb_assert(!is_provider_done(auth, SELF_PID));
 603         lrb_assert(rb_dlink_list_length(&proxy_scanners) > 0);
 604
 605         if(lookup == NULL || lookup->in_progress)
 606                 /* Nothing to do */
 607                 return;
 608         else if((!get_provider_id("rdns", &rdns_pid) || is_provider_done(auth, rdns_pid)) &&
 609                 (!get_provider_id("ident", &ident_pid) || is_provider_done(auth, ident_pid)))
 610                 /* Don't start until ident and rdns are finished (or not loaded) */
 611                 return;
 612         else
 613                 opm_scan(auth);
 614 }
 615
 616 static bool
 617 opm_start(struct auth_client *auth)
 618 {
 619         uint32_t rdns_pid, ident_pid;
 620
 621         lrb_assert(get_provider_data(auth, SELF_PID) == NULL);
 622
 623         if(!opm_enable || rb_dlink_list_length(&proxy_scanners) == 0)
 624                 /* Nothing to do... */
 625                 return true;
 626
 627         auth_client_ref(auth);
 628
 629         set_provider_data(auth, SELF_PID, rb_malloc(sizeof(struct opm_lookup)));
 630
 631         if((!get_provider_id("rdns", &rdns_pid) || is_provider_done(auth, rdns_pid)) &&
 632                 (!get_provider_id("ident", &ident_pid) || is_provider_done(auth, ident_pid)))
 633         {
 634                 /* Don't start until ident and rdns are finished (or not loaded) */
 635                 opm_scan(auth);
 636         }
 637
 638         set_provider_running(auth, SELF_PID);
 639         return true;
 640 }
 641
 642 static void
 643 opm_cancel(struct auth_client *auth)
 644 {
 645         struct opm_lookup *lookup = get_provider_data(auth, SELF_PID);
 646
 647         if(lookup != NULL)
 648         {
 649                 rb_dlink_node *ptr, *nptr;
 650
 651                 notice_client(auth->cid, "*** Did not detect open proxies");
 652
 653                 RB_DLINK_FOREACH_SAFE(ptr, nptr, lookup->scans.head)
 654                 {
 655                         struct opm_scan *scan = ptr->data;
 656
 657                         rb_close(scan->F);
 658                         rb_free(scan);
 659                 }
 660
 661                 rb_free(lookup);
 662
 663                 set_provider_data(auth, SELF_PID, NULL);
 664                 set_provider_timeout_absolute(auth, SELF_PID, 0);
 665                 provider_done(auth, SELF_PID);
 666
 667                 auth_client_unref(auth);
 668         }
 669 }
 670
 671 static void
 672 opm_destroy(void)
 673 {
 674         struct auth_client *auth;
 675         rb_dictionary_iter iter;
 676
 677         /* Nuke all opm lookups */
 678         RB_DICTIONARY_FOREACH(auth, &iter, auth_clients)
 679         {
 680                 opm_cancel(auth);
 681                 /* auth is now invalid as we have no reference */
 682         }
 683 }
 684
 685
 686 static void
 687 add_conf_opm_timeout(const char *key __unused, int parc __unused, const char **parv)
 688 {
 689         int timeout = atoi(parv[0]);
 690
 691         if(timeout < 0)
 692         {
 693                 warn_opers(L_CRIT, "opm: opm timeout < 0 (value: %d)", timeout);
 694                 return;
 695         }
 696
 697         opm_timeout = timeout;
 698 }
 699
 700 static void
 701 set_opm_enabled(const char *key __unused, int parc __unused, const char **parv)
 702 {
 703         bool enable = (*parv[0] == '1');
 704
 705         if(!enable)
 706         {
 707                 if(listeners[LISTEN_IPV4].F != NULL || listeners[LISTEN_IPV6].F != NULL)
 708                 {
 709                         struct auth_client *auth;
 710                         rb_dictionary_iter iter;
 711
 712                         /* Close the listening socket */
 713                         if(listeners[LISTEN_IPV4].F != NULL)
 714                                 rb_close(listeners[LISTEN_IPV4].F);
 715
 716                         if(listeners[LISTEN_IPV6].F != NULL)
 717                                 rb_close(listeners[LISTEN_IPV6].F);
 718
 719                         listeners[LISTEN_IPV4].F = listeners[LISTEN_IPV6].F = NULL;
 720
 721                         RB_DICTIONARY_FOREACH(auth, &iter, auth_clients)
 722                         {
 723                                 opm_cancel(auth);
 724                                 /* auth is now invalid as we have no reference */
 725                         }
 726                 }
 727         }
 728         else
 729         {
 730                 if(listeners[LISTEN_IPV4].ip[0] != '\0' && listeners[LISTEN_IPV4].port != 0)
 731                 {
 732                         if(listeners[LISTEN_IPV4].F == NULL)
 733                                 /* Pre-configured IP/port, just re-establish */
 734                                 create_listener(listeners[LISTEN_IPV4].ip, listeners[LISTEN_IPV4].port);
 735                 }
 736
 737                 if(listeners[LISTEN_IPV6].ip[0] != '\0' && listeners[LISTEN_IPV6].port != 0)
 738                 {
 739                         if(listeners[LISTEN_IPV6].F == NULL)
 740                                 /* Pre-configured IP/port, just re-establish */
 741                                 create_listener(listeners[LISTEN_IPV6].ip, listeners[LISTEN_IPV6].port);
 742                 }
 743         }
 744
 745         opm_enable = enable;
 746 }
 747
 748 static void
 749 set_opm_listener(const char *key __unused, int parc __unused, const char **parv)
 750 {
 751         const char *ip = parv[0];
 752         int iport = atoi(parv[1]);
 753
 754         if(iport > 65535 || iport <= 0)
 755         {
 756                 warn_opers(L_CRIT, "OPM: got a bad listener: %s:%s", parv[0], parv[1]);
 757                 exit(EX_PROVIDER_ERROR);
 758         }
 759
 760         create_listener(ip, (uint16_t)iport);
 761 }
 762
 763 static void
 764 create_opm_scanner(const char *key __unused, int parc __unused, const char **parv)
 765 {
 766         int iport = atoi(parv[1]);
 767         struct opm_proxy *proxy = rb_malloc(sizeof(struct opm_proxy));
 768
 769         if(iport <= 0 || iport > 65535)
 770         {
 771                 warn_opers(L_CRIT, "OPM: got a bad scanner: %s (port %s)", parv[0], parv[1]);
 772                 exit(EX_PROVIDER_ERROR);
 773         }
 774
 775         proxy->port = (uint16_t)iport;
 776
 777         switch((proxy->proto = get_protocol_from_string(parv[0])))
 778         {
 779         case PROTO_SOCKS4:
 780                 snprintf(proxy->note, sizeof(proxy->note), "socks4:%hu", proxy->port);
 781                 proxy->ssl = false;
 782                 proxy->callback = socks4_connected;
 783                 break;
 784         case PROTO_SOCKS5:
 785                 snprintf(proxy->note, sizeof(proxy->note), "socks5:%hu", proxy->port);
 786                 proxy->ssl = false;
 787                 proxy->callback = socks5_connected;
 788                 break;
 789         case PROTO_HTTP_CONNECT:
 790                 snprintf(proxy->note, sizeof(proxy->note), "httpconnect:%hu", proxy->port);
 791                 proxy->ssl = false;
 792                 proxy->callback = http_connect_connected;
 793                 break;
 794         case PROTO_HTTPS_CONNECT:
 795                 snprintf(proxy->note, sizeof(proxy->note), "httpsconnect:%hu", proxy->port);
 796                 proxy->callback = http_connect_connected;
 797                 proxy->ssl = true;
 798                 break;
 799         default:
 800                 warn_opers(L_CRIT, "OPM: got an unknown proxy type: %s (port %hu)", parv[0], proxy->port);
 801                 exit(EX_PROVIDER_ERROR);
 802         }
 803
 804         if(find_proxy_scanner(proxy->proto, proxy->port) != NULL)
 805         {
 806                 warn_opers(L_CRIT, "OPM: got a duplicate scanner: %s (port %hu)", parv[0], proxy->port);
 807                 rb_free(proxy);
 808                 return;
 809         }
 810
 811         rb_dlinkAdd(proxy, &proxy->node, &proxy_scanners);
 812 }
 813
 814 static void
 815 delete_opm_scanner(const char *key __unused, int parc __unused, const char **parv)
 816 {
 817         struct auth_client *auth;
 818         struct opm_proxy *proxy;
 819         protocol_t proto = get_protocol_from_string(parv[0]);
 820         int iport = atoi(parv[1]);
 821         rb_dictionary_iter iter;
 822
 823         if(iport <= 0 || iport > 65535)
 824         {
 825                 warn_opers(L_CRIT, "OPM: got a bad scanner to delete: %s (port %s)", parv[0], parv[1]);
 826                 exit(EX_PROVIDER_ERROR);
 827         }
 828
 829         if(proto == PROTO_NONE)
 830         {
 831                 warn_opers(L_CRIT, "OPM: got an unknown proxy type to delete: %s (port %d)", parv[0], iport);
 832                 exit(EX_PROVIDER_ERROR);
 833         }
 834
 835         if((proxy = find_proxy_scanner(proto, (uint16_t)iport)) == NULL)
 836         {
 837                 warn_opers(L_CRIT, "OPM: cannot find proxy to delete: %s (port %d)", parv[0], iport);
 838                 exit(EX_PROVIDER_ERROR);
 839         }
 840
 841         /* Abort remaining clients on this scanner */
 842         RB_DICTIONARY_FOREACH(auth, &iter, auth_clients)
 843         {
 844                 rb_dlink_node *ptr;
 845                 struct opm_lookup *lookup = get_provider_data(auth, SELF_PID);
 846
 847                 if(lookup == NULL)
 848                         continue;
 849
 850                 auth_client_ref(auth);
 851
 852                 RB_DLINK_FOREACH(ptr, lookup->scans.head)
 853                 {
 854                         struct opm_scan *scan = ptr->data;
 855
 856                         if(scan->proxy->port == proxy->port && scan->proxy->proto == proxy->proto)
 857                         {
 858                                 /* Match */
 859                                 rb_dlinkDelete(&scan->node, &lookup->scans);
 860                                 rb_free(scan);
 861
 862                                 if(rb_dlink_list_length(&lookup->scans) == 0)
 863                                         opm_cancel(auth);
 864
 865                                 break;
 866                         }
 867                 }
 868
 869                 auth_client_unref(auth);
 870         }
 871
 872         rb_dlinkDelete(&proxy->node, &proxy_scanners);
 873         rb_free(proxy);
 874
 875         if(rb_dlink_list_length(&proxy_scanners) == 0)
 876                 opm_enable = false;
 877 }
 878
 879 static void
 880 delete_opm_scanner_all(const char *key __unused, int parc __unused, const char **parv __unused)
 881 {
 882         struct auth_client *auth;
 883         rb_dlink_node *ptr, *nptr;
 884         rb_dictionary_iter iter;
 885
 886         RB_DLINK_FOREACH_SAFE(ptr, nptr, proxy_scanners.head)
 887         {
 888                 rb_free(ptr->data);
 889                 rb_dlinkDelete(ptr, &proxy_scanners);
 890         }
 891
 892         RB_DICTIONARY_FOREACH(auth, &iter, auth_clients)
 893         {
 894                 opm_cancel(auth);
 895                 /* auth is now invalid as we have no reference */
 896         }
 897
 898         opm_enable = false;
 899 }
 900
 901 static void
 902 delete_opm_listener_all(const char *key __unused, int parc __unused, const char **parv __unused)
 903 {
 904         if(listeners[LISTEN_IPV4].F != NULL)
 905                 rb_close(listeners[LISTEN_IPV4].F);
 906
 907 #ifdef RB_IPV6
 908         if(listeners[LISTEN_IPV6].F != NULL)
 909                 rb_close(listeners[LISTEN_IPV6].F);
 910 #endif
 911
 912         memset(&listeners, 0, sizeof(listeners));
 913 }
 914
 915
 916 struct auth_opts_handler opm_options[] =
 917 {
 918         { "opm_timeout", 1, add_conf_opm_timeout },
 919         { "opm_enabled", 1, set_opm_enabled },
 920         { "opm_listener", 2, set_opm_listener },
 921         { "opm_listener_del_all", 0, delete_opm_listener_all },
 922         { "opm_scanner", 2, create_opm_scanner },
 923         { "opm_scanner_del", 2, delete_opm_scanner },
 924         { "opm_scanner_del_all", 0, delete_opm_scanner_all },
 925         { NULL, 0, NULL },
 926 };
 927
 928 struct auth_provider opm_provider =
 929 {
 930         .name = "opm",
 931         .letter = 'O',
 932         .destroy = opm_destroy,
 933         .start = opm_start,
 934         .cancel = opm_cancel,
 935         .timeout = opm_cancel,
 936         .completed = opm_initiate,
 937         .opt_handlers = opm_options,
 938 };