authd/provider.c

   1 /* authd/provider.c - authentication provider framework
   2  * Copyright (c) 2016 Elizabeth Myers <elizabeth@interlinked.me>
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice is present in all copies.
   7  *
   8  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
   9  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  10  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  11  * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
  12  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  13  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  14  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  15  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  16  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
  17  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  18  * POSSIBILITY OF SUCH DAMAGE.
  19  */
  20
  21 /* So the basic design here is to have "authentication providers" that do
  22  * things like query ident and blacklists and even open proxies.
  23  *
  24  * Providers are registered statically in the struct auth_providers array. You will
  25  * probably want to add an item to the provider_t enum also.
  26  *
  27  * Providers can either return failure immediately, immediate acceptance, or
  28  * do work in the background (calling set_provider to signal this).
  29  *
  30  * It is up to providers to keep their own state on clients if they need to.
  31  *
  32  * All providers must implement at a minimum a perform_provider function. You
  33  * don't have to implement the others if you don't need them.
  34  *
  35  * Providers may kick clients off by rejecting them. Upon rejection, all
  36  * providers are cancelled. They can also unconditionally accept them.
  37  *
  38  * When a provider is done and is neutral on accepting/rejecting a client, it
  39  * should call provider_done. Do NOT call this if you have accepted or rejected
  40  * the client.
  41  *
  42  * --Elizafox, 9 March 2016
  43  */
  44
  45 #include "authd.h"
  46 #include "provider.h"
  47
  48 rb_dlink_list auth_providers;
  49
  50 /* Clients waiting */
  51 struct auth_client auth_clients[MAX_CLIENTS];
  52
  53 /* Load a provider */
  54 void load_provider(struct auth_provider *provider)
  55 {
  56         provider->init();
  57         rb_dlinkAdd(provider, &provider->node, &auth_providers);
  58 }
  59
  60 void unload_provider(struct auth_provider *provider)
  61 {
  62         provider->destroy();
  63         rb_dlinkDelete(&provider->node, &auth_providers);
  64 }
  65
  66 /* Initalise all providers */
  67 void init_providers(void)
  68 {
  69         load_provider(&rdns_provider);
  70         load_provider(&ident_provider);
  71 }
  72
  73 /* Terminate all providers */
  74 void destroy_providers(void)
  75 {
  76         rb_dlink_node *ptr;
  77         struct auth_provider *provider;
  78
  79         /* Cancel outstanding connections */
  80         for (size_t i = 0; i < MAX_CLIENTS; i++)
  81         {
  82                 if(auth_clients[i].cid)
  83                 {
  84                         /* TBD - is this the right thing?
  85                          * (NOTE - this error message is designed for morons) */
  86                         reject_client(&auth_clients[i], 0, true,
  87                                         "IRC server reloading... try reconnecting in a few seconds");
  88                 }
  89         }
  90
  91         RB_DLINK_FOREACH(ptr, auth_providers.head)
  92         {
  93                 provider = ptr->data;
  94
  95                 if(provider->destroy)
  96                         provider->destroy();
  97         }
  98 }
  99
 100 /* Cancel outstanding providers for a client */
 101 void cancel_providers(struct auth_client *auth)
 102 {
 103         rb_dlink_node *ptr;
 104         struct auth_provider *provider;
 105
 106         RB_DLINK_FOREACH(ptr, auth_providers.head)
 107         {
 108                 provider = ptr->data;
 109
 110                 if(provider->cancel && is_provider(auth, provider->id))
 111                         /* Cancel if required */
 112                         provider->cancel(auth);
 113         }
 114 }
 115
 116 /* Provider is done */
 117 void provider_done(struct auth_client *auth, provider_t id)
 118 {
 119         rb_dlink_node *ptr;
 120         struct auth_provider *provider;
 121
 122         unset_provider(auth, id);
 123
 124         if(!auth->providers)
 125         {
 126                 /* No more providers, done */
 127                 accept_client(auth, 0);
 128                 return;
 129         }
 130
 131         RB_DLINK_FOREACH(ptr, auth_providers.head)
 132         {
 133                 provider = ptr->data;
 134
 135                 if(provider->completed && is_provider(auth, provider->id))
 136                         /* Notify pending clients who asked for it */
 137                         provider->completed(auth, id);
 138         }
 139 }
 140
 141 /* Reject a client, cancel outstanding providers if any if hard set to true */
 142 void reject_client(struct auth_client *auth, provider_t id, bool hard, const char *reason)
 143 {
 144         uint16_t cid = auth->cid;
 145         char reject;
 146
 147         switch(id)
 148         {
 149         case PROVIDER_RDNS:
 150                 reject = 'D';
 151                 break;
 152         case PROVIDER_IDENT:
 153                 reject = 'I';
 154                 break;
 155         case PROVIDER_BLACKLIST:
 156                 reject = 'B';
 157                 break;
 158         case PROVIDER_NULL:
 159         default:
 160                 reject = 'N';
 161                 break;
 162         }
 163
 164         rb_helper_write(authd_helper, "R %x %c :%s", auth->cid, reject, reason);
 165
 166         unset_provider(auth, id);
 167
 168         if(hard && auth->providers)
 169         {
 170                 cancel_providers(auth);
 171                 memset(&auth_clients[cid], 0, sizeof(struct auth_client));
 172         }
 173 }
 174
 175 /* Accept a client, cancel outstanding providers if any */
 176 void accept_client(struct auth_client *auth, provider_t id)
 177 {
 178         uint16_t cid = auth->cid;
 179
 180         rb_helper_write(authd_helper, "A %x %s %s", auth->cid, auth->username, auth->hostname);
 181
 182         unset_provider(auth, id);
 183
 184         if(auth->providers)
 185                 cancel_providers(auth);
 186
 187         memset(&auth_clients[cid], 0, sizeof(struct auth_client));
 188 }
 189
 190 /* Send a notice to a client */
 191 void notice_client(struct auth_client *auth, const char *notice)
 192 {
 193         rb_helper_write(authd_helper, "N %x :%s", auth->cid, notice);
 194 }
 195
 196 /* Begin authenticating user */
 197 static void start_auth(const char *cid, const char *l_ip, const char *l_port, const char *c_ip, const char *c_port)
 198 {
 199         struct auth_provider *provider;
 200         struct auth_client *auth;
 201         long lcid = strtol(cid, NULL, 16);
 202         rb_dlink_node *ptr;
 203
 204         if(lcid >= MAX_CLIENTS)
 205                 return;
 206
 207         auth = &auth_clients[lcid];
 208         if(auth->cid != 0)
 209                 /* Shouldn't get here */
 210                 return;
 211
 212         auth->cid = (uint16_t)lcid;
 213
 214         rb_strlcpy(auth->l_ip, l_ip, sizeof(auth->l_ip));
 215         auth->l_port = (uint16_t)atoi(l_port);  /* should be safe */
 216
 217         rb_strlcpy(auth->c_ip, c_ip, sizeof(auth->c_ip));
 218         auth->c_port = (uint16_t)atoi(c_port);
 219
 220         RB_DLINK_FOREACH(ptr, auth_providers.head)
 221         {
 222                 provider = ptr->data;
 223
 224                 /* Execute providers */
 225                 if(!provider->start(auth))
 226                 {
 227                         /* Rejected immediately */
 228                         cancel_providers(auth);
 229                         return;
 230                 }
 231         }
 232
 233         /* If no providers are running, accept the client */
 234         if(!auth->providers)
 235                 accept_client(auth, 0);
 236 }
 237
 238 /* Callback for the initiation */
 239 void handle_new_connection(int parc, char *parv[])
 240 {
 241         if(parc < 7)
 242                 return;
 243
 244         start_auth(parv[1], parv[2], parv[3], parv[4], parv[5]);
 245 }