1 /* authd/provider.c - authentication provider framework
2 * Copyright (c) 2016 Elizabeth Myers <elizabeth@interlinked.me>
4 * Permission to use, copy, modify, and/or distribute this software for any
5 * purpose with or without fee is hereby granted, provided that the above
6 * copyright notice and this permission notice is present in all copies.
8 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
9 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
10 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
11 * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
12 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
13 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
14 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
15 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
16 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
17 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
18 * POSSIBILITY OF SUCH DAMAGE.
21 /* The basic design here is to have "authentication providers" that do things
22 * like query ident and blacklists and even open proxies.
24 * Providers are registered in the auth_providers linked list. It is planned to
25 * use a bitmap to store provider ID's later.
27 * Providers can either return failure immediately, immediate acceptance, or do
28 * work in the background (calling set_provider to signal this).
30 * Provider-specific data for each client can be kept in an index of the data
31 * struct member (using the provider's ID).
33 * All providers must implement at a minimum a perform_provider function. You
34 * don't have to implement the others if you don't need them.
36 * Providers may kick clients off by rejecting them. Upon rejection, all
37 * providers are cancelled. They can also unconditionally accept them.
39 * When a provider is done and is neutral on accepting/rejecting a client, it
40 * should call provider_done. Do NOT call this if you have accepted or rejected
43 * Eventually, stuff like *:line handling will be moved here, but that means we
44 * have to talk to bandb directly first.
46 * --Elizafox, 9 March 2016
49 #include "rb_dictionary.h"
53 rb_dlink_list auth_providers
;
56 rb_dictionary
*auth_clients
;
59 void load_provider(struct auth_provider
*provider
)
61 if(rb_dlink_list_length(&auth_providers
) >= MAX_PROVIDERS
)
63 warn_opers(L_CRIT
, "Exceeded maximum level of authd providers (%d max)", MAX_PROVIDERS
);
68 rb_dlinkAdd(provider
, &provider
->node
, &auth_providers
);
71 void unload_provider(struct auth_provider
*provider
)
74 rb_dlinkDelete(&provider
->node
, &auth_providers
);
77 /* Initalise all providers */
78 void init_providers(void)
80 auth_clients
= rb_dictionary_create("pending auth clients", rb_uint32cmp
);
81 load_provider(&rdns_provider
);
82 load_provider(&ident_provider
);
85 /* Terminate all providers */
86 void destroy_providers(void)
89 rb_dictionary_iter iter
;
90 struct auth_client
*auth
;
91 struct auth_provider
*provider
;
93 /* Cancel outstanding connections */
94 RB_DICTIONARY_FOREACH(auth
, &iter
, auth_clients
)
96 /* TBD - is this the right thing? */
97 reject_client(auth
, 0, "Authentication system is down... try reconnecting in a few seconds");
100 RB_DLINK_FOREACH(ptr
, auth_providers
.head
)
102 provider
= ptr
->data
;
104 if(provider
->destroy
)
109 /* Cancel outstanding providers for a client */
110 void cancel_providers(struct auth_client
*auth
)
113 struct auth_provider
*provider
;
115 RB_DLINK_FOREACH(ptr
, auth_providers
.head
)
117 provider
= ptr
->data
;
119 if(provider
->cancel
&& is_provider_on(auth
, provider
->id
))
120 /* Cancel if required */
121 provider
->cancel(auth
);
124 rb_dictionary_delete(auth_clients
, RB_UINT_TO_POINTER(auth
->cid
));
128 /* Provider is done */
129 void provider_done(struct auth_client
*auth
, provider_t id
)
132 struct auth_provider
*provider
;
134 set_provider_off(auth
, id
);
135 set_provider_done(auth
, id
);
139 /* No more providers, done */
140 accept_client(auth
, 0);
144 RB_DLINK_FOREACH(ptr
, auth_providers
.head
)
146 provider
= ptr
->data
;
148 if(provider
->completed
&& is_provider_on(auth
, provider
->id
))
149 /* Notify pending clients who asked for it */
150 provider
->completed(auth
, id
);
154 /* Reject a client */
155 void reject_client(struct auth_client
*auth
, provider_t id
, const char *reason
)
167 case PROVIDER_BLACKLIST
:
175 /* We send back username and hostname in case ircd wants to overrule our decision.
176 * In the future this may not be the case.
179 rb_helper_write(authd_helper
, "R %x %c %s %s :%s", auth
->cid
, reject
, auth
->username
, auth
->hostname
, reason
);
181 set_provider_off(auth
, id
);
182 cancel_providers(auth
);
185 /* Accept a client, cancel outstanding providers if any */
186 void accept_client(struct auth_client
*auth
, provider_t id
)
188 uint32_t cid
= auth
->cid
;
190 rb_helper_write(authd_helper
, "A %x %s %s", auth
->cid
, auth
->username
, auth
->hostname
);
192 set_provider_off(auth
, id
);
193 cancel_providers(auth
);
196 /* Send a notice to a client */
197 void notice_client(struct auth_client
*auth
, const char *fmt
, ...)
203 vsnprintf(buf
, sizeof(buf
), fmt
, args
);
206 rb_helper_write(authd_helper
, "N %x :%s", auth
->cid
, buf
);
209 /* Send a warning to the IRC daemon for logging, etc. */
210 void warn_opers(notice_level_t level
, const char *fmt
, ...)
216 vsnprintf(buf
, sizeof(buf
), fmt
, args
);
219 rb_helper_write(authd_helper
, "W %c :%s", level
, buf
);
222 /* Begin authenticating user */
223 static void start_auth(const char *cid
, const char *l_ip
, const char *l_port
, const char *c_ip
, const char *c_port
)
225 struct auth_provider
*provider
;
226 struct auth_client
*auth
= rb_malloc(sizeof(struct auth_client
));
227 long lcid
= strtol(cid
, NULL
, 16);
230 if(lcid
>= UINT32_MAX
)
233 auth
->cid
= (uint32_t)lcid
;
235 rb_strlcpy(auth
->l_ip
, l_ip
, sizeof(auth
->l_ip
));
236 auth
->l_port
= (uint16_t)atoi(l_port
); /* should be safe */
237 (void) rb_inet_pton_sock(l_ip
, (struct sockaddr
*)&auth
->l_addr
);
239 rb_strlcpy(auth
->c_ip
, c_ip
, sizeof(auth
->c_ip
));
240 auth
->c_port
= (uint16_t)atoi(c_port
);
241 (void) rb_inet_pton_sock(c_ip
, (struct sockaddr
*)&auth
->c_addr
);
244 if(GET_SS_FAMILY(&auth
->l_addr
) == AF_INET6
)
245 ((struct sockaddr_in6
*)&auth
->l_addr
)->sin6_port
= htons(auth
->l_port
);
248 ((struct sockaddr_in
*)&auth
->l_addr
)->sin_port
= htons(auth
->l_port
);
251 if(GET_SS_FAMILY(&auth
->c_addr
) == AF_INET6
)
252 ((struct sockaddr_in6
*)&auth
->c_addr
)->sin6_port
= htons(auth
->c_port
);
255 ((struct sockaddr_in
*)&auth
->c_addr
)->sin_port
= htons(auth
->c_port
);
257 rb_dictionary_add(auth_clients
, RB_UINT_TO_POINTER(auth
->cid
), auth
);
259 RB_DLINK_FOREACH(ptr
, auth_providers
.head
)
261 provider
= ptr
->data
;
263 /* Execute providers */
264 if(!provider
->start(auth
))
266 /* Rejected immediately */
267 cancel_providers(auth
);
272 /* If no providers are running, accept the client */
274 accept_client(auth
, 0);
277 /* Callback for the initiation */
278 void handle_new_connection(int parc
, char *parv
[])
282 warn_opers(L_CRIT
, "BUG: received too few params for new connection (7 expected, got %d)", parc
);
286 start_auth(parv
[1], parv
[2], parv
[3], parv
[4], parv
[5]);