authd/provider.c

   1 /* authd/provider.c - authentication provider framework
   2  * Copyright (c) 2016 Elizabeth Myers <elizabeth@interlinked.me>
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice is present in all copies.
   7  *
   8  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
   9  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  10  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  11  * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
  12  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  13  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  14  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  15  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  16  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
  17  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  18  * POSSIBILITY OF SUCH DAMAGE.
  19  */
  20
  21 /* So the basic design here is to have "authentication providers" that do
  22  * things like query ident and blacklists and even open proxies.
  23  *
  24  * Providers are registered in the auth_providers linked list. It is planned to
  25  * use a bitmap to store provider ID's later.
  26  *
  27  * Providers can either return failure immediately, immediate acceptance, or
  28  * do work in the background (calling set_provider to signal this).
  29  *
  30  * Provider-specific data for each client can be kept in an index of the data
  31  * struct member (using the provider's ID).
  32  *
  33  * All providers must implement at a minimum a perform_provider function. You
  34  * don't have to implement the others if you don't need them.
  35  *
  36  * Providers may kick clients off by rejecting them. Upon rejection, all
  37  * providers are cancelled. They can also unconditionally accept them.
  38  *
  39  * When a provider is done and is neutral on accepting/rejecting a client, it
  40  * should call provider_done. Do NOT call this if you have accepted or rejected
  41  * the client.
  42  *
  43  * --Elizafox, 9 March 2016
  44  */
  45
  46 #include "rb_dictionary.h"
  47 #include "authd.h"
  48 #include "provider.h"
  49
  50 rb_dlink_list auth_providers;
  51
  52 /* Clients waiting */
  53 struct Dictionary *auth_clients;
  54
  55 /* Load a provider */
  56 void load_provider(struct auth_provider *provider)
  57 {
  58         if(rb_dlink_list_length(&auth_providers) >= MAX_PROVIDERS)
  59                 /* XXX should probably warn here */
  60                 return;
  61
  62         provider->init();
  63         rb_dlinkAdd(provider, &provider->node, &auth_providers);
  64 }
  65
  66 void unload_provider(struct auth_provider *provider)
  67 {
  68         provider->destroy();
  69         rb_dlinkDelete(&provider->node, &auth_providers);
  70 }
  71
  72 /* Initalise all providers */
  73 void init_providers(void)
  74 {
  75         auth_clients = rb_dictionary_create("pending auth clients", rb_uint32cmp);
  76         load_provider(&rdns_provider);
  77         load_provider(&ident_provider);
  78 }
  79
  80 /* Terminate all providers */
  81 void destroy_providers(void)
  82 {
  83         rb_dlink_node *ptr;
  84         struct DictionaryIter iter;
  85         struct auth_client *auth;
  86         struct auth_provider *provider;
  87
  88         /* Cancel outstanding connections */
  89         DICTIONARY_FOREACH(auth, &iter, auth_clients)
  90         {
  91                 /* TBD - is this the right thing? */
  92                 reject_client(auth, 0, "Authentication system is down... try reconnecting in a few seconds");
  93         }
  94
  95         RB_DLINK_FOREACH(ptr, auth_providers.head)
  96         {
  97                 provider = ptr->data;
  98
  99                 if(provider->destroy)
 100                         provider->destroy();
 101         }
 102 }
 103
 104 /* Cancel outstanding providers for a client */
 105 void cancel_providers(struct auth_client *auth)
 106 {
 107         rb_dlink_node *ptr;
 108         struct auth_provider *provider;
 109
 110         RB_DLINK_FOREACH(ptr, auth_providers.head)
 111         {
 112                 provider = ptr->data;
 113
 114                 if(provider->cancel && is_provider(auth, provider->id))
 115                         /* Cancel if required */
 116                         provider->cancel(auth);
 117         }
 118
 119         rb_dictionary_delete(auth_clients, RB_UINT_TO_POINTER(auth->cid));
 120         rb_free(auth);
 121 }
 122
 123 /* Provider is done */
 124 void provider_done(struct auth_client *auth, provider_t id)
 125 {
 126         rb_dlink_node *ptr;
 127         struct auth_provider *provider;
 128
 129         unset_provider(auth, id);
 130
 131         if(!auth->providers)
 132         {
 133                 /* No more providers, done */
 134                 accept_client(auth, 0);
 135                 return;
 136         }
 137
 138         RB_DLINK_FOREACH(ptr, auth_providers.head)
 139         {
 140                 provider = ptr->data;
 141
 142                 if(provider->completed && is_provider(auth, provider->id))
 143                         /* Notify pending clients who asked for it */
 144                         provider->completed(auth, id);
 145         }
 146 }
 147
 148 /* Reject a client */
 149 void reject_client(struct auth_client *auth, provider_t id, const char *reason)
 150 {
 151         char reject;
 152
 153         switch(id)
 154         {
 155         case PROVIDER_RDNS:
 156                 reject = 'D';
 157                 break;
 158         case PROVIDER_IDENT:
 159                 reject = 'I';
 160                 break;
 161         case PROVIDER_BLACKLIST:
 162                 reject = 'B';
 163                 break;
 164         default:
 165                 reject = 'N';
 166                 break;
 167         }
 168
 169         /* TODO send back ident */
 170         rb_helper_write(authd_helper, "R %x %c :%s", auth->cid, reject, reason);
 171
 172         unset_provider(auth, id);
 173         cancel_providers(auth);
 174 }
 175
 176 /* Accept a client, cancel outstanding providers if any */
 177 void accept_client(struct auth_client *auth, provider_t id)
 178 {
 179         uint32_t cid = auth->cid;
 180
 181         rb_helper_write(authd_helper, "A %x %s %s", auth->cid, auth->username, auth->hostname);
 182
 183         unset_provider(auth, id);
 184         cancel_providers(auth);
 185 }
 186
 187 /* Send a notice to a client */
 188 void notice_client(struct auth_client *auth, const char *notice)
 189 {
 190         rb_helper_write(authd_helper, "N %x :%s", auth->cid, notice);
 191 }
 192
 193 /* Begin authenticating user */
 194 static void start_auth(const char *cid, const char *l_ip, const char *l_port, const char *c_ip, const char *c_port)
 195 {
 196         struct auth_provider *provider;
 197         struct auth_client *auth = rb_malloc(sizeof(struct auth_client));
 198         long lcid = strtol(cid, NULL, 16);
 199         rb_dlink_node *ptr;
 200
 201         if(lcid >= UINT32_MAX)
 202                 return;
 203
 204         auth->cid = (uint32_t)lcid;
 205
 206         rb_strlcpy(auth->l_ip, l_ip, sizeof(auth->l_ip));
 207         auth->l_port = (uint16_t)atoi(l_port);  /* should be safe */
 208
 209         rb_strlcpy(auth->c_ip, c_ip, sizeof(auth->c_ip));
 210         auth->c_port = (uint16_t)atoi(c_port);
 211
 212         rb_dictionary_add(auth_clients, RB_UINT_TO_POINTER(auth->cid), auth);
 213
 214         RB_DLINK_FOREACH(ptr, auth_providers.head)
 215         {
 216                 provider = ptr->data;
 217
 218                 /* Execute providers */
 219                 if(!provider->start(auth))
 220                 {
 221                         /* Rejected immediately */
 222                         cancel_providers(auth);
 223                         return;
 224                 }
 225         }
 226
 227         /* If no providers are running, accept the client */
 228         if(!auth->providers)
 229                 accept_client(auth, 0);
 230 }
 231
 232 /* Callback for the initiation */
 233 void handle_new_connection(int parc, char *parv[])
 234 {
 235         if(parc < 7)
 236                 return;
 237
 238         start_auth(parv[1], parv[2], parv[3], parv[4], parv[5]);
 239 }