ircd/authd.c

   1 /*
   2  *  authd.c: An interface to authd.
   3  *  (based somewhat on ircd-ratbox dns.c)
   4  *
   5  *  Copyright (C) 2005 Aaron Sethman <androsyn@ratbox.org>
   6  *  Copyright (C) 2005-2012 ircd-ratbox development team
   7  *  Copyright (C) 2016 William Pitcock <nenolod@dereferenced.org>
   8  *
   9  *  This program is free software; you can redistribute it and/or modify
  10  *  it under the terms of the GNU General Public License as published by
  11  *  the Free Software Foundation; either version 2 of the License, or
  12  *  (at your option) any later version.
  13  *
  14  *  This program is distributed in the hope that it will be useful,
  15  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  *  GNU General Public License for more details.
  18  *
  19  *  You should have received a copy of the GNU General Public License
  20  *  along with this program; if not, write to the Free Software
  21  *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301
  22  *  USA
  23  */
  24
  25 #include "stdinc.h"
  26 #include "rb_lib.h"
  27 #include "client.h"
  28 #include "ircd_defs.h"
  29 #include "parse.h"
  30 #include "authd.h"
  31 #include "match.h"
  32 #include "logger.h"
  33 #include "s_conf.h"
  34 #include "s_stats.h"
  35 #include "client.h"
  36 #include "packet.h"
  37 #include "hash.h"
  38 #include "send.h"
  39 #include "numeric.h"
  40 #include "msg.h"
  41 #include "dns.h"
  42
  43 static int start_authd(void);
  44 static void parse_authd_reply(rb_helper * helper);
  45 static void restart_authd_cb(rb_helper * helper);
  46 static EVH timeout_dead_authd_clients;
  47
  48 rb_helper *authd_helper;
  49 static char *authd_path;
  50
  51 uint32_t cid;
  52 static rb_dictionary *cid_clients;
  53 static struct ev_entry *timeout_ev;
  54
  55 rb_dictionary *bl_stats;
  56
  57 static int
  58 start_authd(void)
  59 {
  60         char fullpath[PATH_MAX + 1];
  61 #ifdef _WIN32
  62         const char *suffix = ".exe";
  63 #else
  64         const char *suffix = "";
  65 #endif
  66         if(authd_path == NULL)
  67         {
  68                 snprintf(fullpath, sizeof(fullpath), "%s%cauthd%s", ircd_paths[IRCD_PATH_LIBEXEC], RB_PATH_SEPARATOR, suffix);
  69
  70                 if(access(fullpath, X_OK) == -1)
  71                 {
  72                         snprintf(fullpath, sizeof(fullpath), "%s%cbin%cauthd%s",
  73                                  ConfigFileEntry.dpath, RB_PATH_SEPARATOR, RB_PATH_SEPARATOR, suffix);
  74                         if(access(fullpath, X_OK) == -1)
  75                         {
  76                                 ierror("Unable to execute authd in %s or %s/bin",
  77                                         ircd_paths[IRCD_PATH_LIBEXEC], ConfigFileEntry.dpath);
  78                                 sendto_realops_snomask(SNO_GENERAL, L_ALL,
  79                                                        "Unable to execute authd in %s or %s/bin",
  80                                                        ircd_paths[IRCD_PATH_LIBEXEC], ConfigFileEntry.dpath);
  81                                 return 1;
  82                         }
  83
  84                 }
  85
  86                 authd_path = rb_strdup(fullpath);
  87         }
  88
  89         if(cid_clients == NULL)
  90                 cid_clients = rb_dictionary_create("authd cid to uid mapping", rb_uint32cmp);
  91
  92         if(bl_stats == NULL)
  93                 bl_stats = rb_dictionary_create("blacklist statistics", strcasecmp);
  94
  95         if(timeout_ev == NULL)
  96                 timeout_ev = rb_event_addish("timeout_dead_authd_clients", timeout_dead_authd_clients, NULL, 1);
  97
  98         authd_helper = rb_helper_start("authd", authd_path, parse_authd_reply, restart_authd_cb);
  99
 100         if(authd_helper == NULL)
 101         {
 102                 ierror("Unable to start authd helper: %s", strerror(errno));
 103                 sendto_realops_snomask(SNO_GENERAL, L_ALL, "Unable to start authd helper: %s", strerror(errno));
 104                 return 1;
 105         }
 106         ilog(L_MAIN, "authd helper started");
 107         sendto_realops_snomask(SNO_GENERAL, L_ALL, "authd helper started");
 108         rb_helper_run(authd_helper);
 109         return 0;
 110 }
 111
 112 static inline uint32_t
 113 str_to_cid(const char *str)
 114 {
 115         long lcid = strtol(str, NULL, 16);
 116
 117         if(lcid > UINT32_MAX || lcid <= 0)
 118         {
 119                 iwarn("authd sent us back a bad client ID: %lx", lcid);
 120                 restart_authd();
 121                 return 0;
 122         }
 123
 124         return (uint32_t)lcid;
 125 }
 126
 127 static inline struct Client *
 128 cid_to_client(uint32_t cid, bool delete)
 129 {
 130         struct Client *client_p;
 131
 132         if(delete)
 133                 client_p = rb_dictionary_delete(cid_clients, RB_UINT_TO_POINTER(cid));
 134         else
 135                 client_p = rb_dictionary_retrieve(cid_clients, RB_UINT_TO_POINTER(cid));
 136
 137         if(client_p == NULL)
 138         {
 139                 iwarn("authd sent us back a bad client ID: %ux", cid);
 140                 restart_authd();
 141                 return NULL;
 142         }
 143
 144         return client_p;
 145 }
 146
 147 static void
 148 parse_authd_reply(rb_helper * helper)
 149 {
 150         ssize_t len;
 151         int parc;
 152         char authdBuf[READBUF_SIZE];
 153         char *parv[MAXPARA + 1];
 154         uint32_t cid;
 155         struct Client *client_p;
 156
 157         while((len = rb_helper_read(helper, authdBuf, sizeof(authdBuf))) > 0)
 158         {
 159                 parc = rb_string_to_array(authdBuf, parv, MAXPARA+1);
 160
 161                 switch (*parv[0])
 162                 {
 163                 case 'A':       /* Accepted a client */
 164                         if(parc != 4)
 165                         {
 166                                 iwarn("authd sent a result with wrong number of arguments: got %d", parc);
 167                                 restart_authd();
 168                                 return;
 169                         }
 170
 171                         if((cid = str_to_cid(parv[1])) == 0)
 172                                 return;
 173
 174                         /* cid to uid (retrieve and delete) */
 175                         if((client_p = cid_to_client(cid, true)) == NULL)
 176                                 return;
 177
 178                         authd_accept_client(client_p, parv[2], parv[3]);
 179                         break;
 180                 case 'R':       /* Reject client */
 181                         if(parc != 7)
 182                         {
 183                                 iwarn("authd sent us a result with wrong number of arguments: got %d", parc);
 184                                 restart_authd();
 185                                 return;
 186                         }
 187
 188                         if((cid = str_to_cid(parv[1])) == 0)
 189                                 return;
 190
 191                         /* cid to uid (retrieve and delete) */
 192                         if((client_p = cid_to_client(cid, true)) == NULL)
 193                                 return;
 194
 195                         authd_reject_client(client_p, parv[3], parv[4], toupper(*parv[2]), parv[5], parv[6]);
 196                         break;
 197                 case 'N':       /* Notice to client */
 198                         if(parc != 3)
 199                         {
 200                                 iwarn("authd sent us a result with wrong number of arguments: got %d", parc);
 201                                 restart_authd();
 202                                 return;
 203                         }
 204
 205                         if((cid = str_to_cid(parv[1])) == 0)
 206                                 return;
 207
 208                         /* cid to uid */
 209                         if((client_p = cid_to_client(cid, false)) == NULL)
 210                                 return;
 211
 212                         sendto_one_notice(client_p, ":%s", parv[2]);
 213                         break;
 214                 case 'E':       /* DNS Result */
 215                         if(parc != 5)
 216                         {
 217                                 iwarn("authd sent a result with wrong number of arguments: got %d", parc);
 218                                 restart_authd();
 219                                 return;
 220                         }
 221                         dns_results_callback(parv[1], parv[2], parv[3], parv[4]);
 222                         break;
 223                 case 'W':       /* Oper warning */
 224                         if(parc != 3)
 225                         {
 226                                 iwarn("authd sent a result with wrong number of arguments: got %d", parc);
 227                                 restart_authd();
 228                                 return;
 229                         }
 230
 231                         switch(*parv[2])
 232                         {
 233                         case 'D':       /* Debug */
 234                                 sendto_realops_snomask(SNO_DEBUG, L_ALL, "authd debug: %s", parv[3]);
 235                                 idebug("authd: %s", parv[3]);
 236                                 break;
 237                         case 'I':       /* Info */
 238                                 sendto_realops_snomask(SNO_GENERAL, L_ALL, "authd info: %s", parv[3]);
 239                                 inotice("authd: %s", parv[3]);
 240                                 break;
 241                         case 'W':       /* Warning */
 242                                 sendto_realops_snomask(SNO_GENERAL, L_ALL, "authd WARNING: %s", parv[3]);
 243                                 iwarn("authd: %s", parv[3]);
 244                                 break;
 245                         case 'C':       /* Critical (error) */
 246                                 sendto_realops_snomask(SNO_GENERAL, L_ALL, "authd CRITICAL: %s", parv[3]);
 247                                 ierror("authd: %s", parv[3]);
 248                                 break;
 249                         default:        /* idk */
 250                                 sendto_realops_snomask(SNO_GENERAL, L_ALL, "authd sent us an unknown oper notice type (%s): %s", parv[2], parv[3]);
 251                                 ilog(L_MAIN, "authd unknown oper notice type (%s): %s", parv[2], parv[3]);
 252                                 break;
 253                         }
 254
 255                         /* NOTREACHED */
 256                         break;
 257                 case 'X':       /* Stats error */
 258                 case 'Y':       /* Stats reply */
 259                 case 'Z':       /* End of stats reply */
 260                         if(parc < 3)
 261                         {
 262                                 iwarn("authd sent a result with wrong number of arguments: got %d", parc);
 263                                 restart_authd();
 264                                 return;
 265                         }
 266
 267                         /* Select by type */
 268                         switch(*parv[2])
 269                         {
 270                         case 'D':
 271                                 /* parv[0] conveys status */
 272                                 if(parc < 4)
 273                                 {
 274                                         iwarn("authd sent a result with wrong number of arguments: got %d", parc);
 275                                         restart_authd();
 276                                         return;
 277                                 }
 278                                 dns_stats_results_callback(parv[1], parv[0], parc - 3, (const char **)&parv[3]);
 279                                 break;
 280                         default:
 281                                 break;
 282                         }
 283                         break;
 284                 default:
 285                         break;
 286                 }
 287         }
 288 }
 289
 290 void
 291 init_authd(void)
 292 {
 293         if(start_authd())
 294         {
 295                 ierror("Unable to start authd helper: %s", strerror(errno));
 296                 exit(0);
 297         }
 298 }
 299
 300 void
 301 configure_authd(void)
 302 {
 303         /* These will do for now */
 304         set_authd_timeout("ident_timeout", GlobalSetOptions.ident_timeout);
 305         set_authd_timeout("rdns_timeout", ConfigFileEntry.connect_timeout);
 306         set_authd_timeout("rbl_timeout", ConfigFileEntry.connect_timeout);
 307         ident_check_enable(!ConfigFileEntry.disable_auth);
 308 }
 309
 310 static void
 311 restart_authd_cb(rb_helper * helper)
 312 {
 313         rb_dictionary_iter iter;
 314         struct Client *client_p;
 315
 316         iwarn("authd: restart_authd_cb called, authd died?");
 317         sendto_realops_snomask(SNO_GENERAL, L_ALL, "authd: restart_authd_cb called, authd died?");
 318
 319         if(helper != NULL)
 320         {
 321                 rb_helper_close(helper);
 322                 authd_helper = NULL;
 323         }
 324
 325         RB_DICTIONARY_FOREACH(client_p, &iter, cid_clients)
 326         {
 327                 /* Abort any existing clients */
 328                 authd_abort_client(client_p);
 329         }
 330
 331         start_authd();
 332 }
 333
 334 void
 335 restart_authd(void)
 336 {
 337         restart_authd_cb(authd_helper);
 338 }
 339
 340 void
 341 rehash_authd(void)
 342 {
 343         rb_helper_write(authd_helper, "R");
 344         configure_authd();
 345 }
 346
 347 void
 348 check_authd(void)
 349 {
 350         if(authd_helper == NULL)
 351                 restart_authd();
 352 }
 353
 354 static inline uint32_t
 355 generate_cid(void)
 356 {
 357         if(++cid == 0)
 358                 cid = 1;
 359
 360         return cid;
 361 }
 362
 363 /* Basically when this is called we begin handing off the client to authd for
 364  * processing. authd "owns" the client until processing is finished, or we
 365  * timeout from authd. authd will make a decision whether or not to accept the
 366  * client, but it's up to other parts of the code (for now) to decide if we're
 367  * gonna accept the client and ignore authd's suggestion.
 368  *
 369  * --Elizafox
 370  */
 371 void
 372 authd_initiate_client(struct Client *client_p)
 373 {
 374         char client_ipaddr[HOSTIPLEN+1];
 375         char listen_ipaddr[HOSTIPLEN+1];
 376         uint16_t client_port, listen_port;
 377         uint32_t authd_cid;
 378
 379         if(client_p->preClient == NULL || client_p->preClient->authd_cid != 0)
 380                 return;
 381
 382         authd_cid = client_p->preClient->authd_cid = generate_cid();
 383
 384         /* Collisions are extremely unlikely, so disregard the possibility */
 385         rb_dictionary_add(cid_clients, RB_UINT_TO_POINTER(authd_cid), client_p);
 386
 387         /* Retrieve listener and client IP's */
 388         rb_inet_ntop_sock((struct sockaddr *)&client_p->preClient->lip, listen_ipaddr, sizeof(listen_ipaddr));
 389         rb_inet_ntop_sock((struct sockaddr *)&client_p->localClient->ip, client_ipaddr, sizeof(client_ipaddr));
 390
 391         /* Retrieve listener and client ports */
 392         listen_port = ntohs(GET_SS_PORT(&client_p->preClient->lip));
 393         client_port = ntohs(GET_SS_PORT(&client_p->localClient->ip));
 394
 395         /* Add a bit of a fudge factor... */
 396         client_p->preClient->authd_timeout = rb_current_time() + ConfigFileEntry.connect_timeout + 10;
 397
 398         rb_helper_write(authd_helper, "C %x %s %hu %s %hu", authd_cid, listen_ipaddr, listen_port, client_ipaddr, client_port);
 399 }
 400
 401 /* When this is called we have a decision on client acceptance.
 402  *
 403  * After this point authd no longer "owns" the client.
 404  */
 405 static inline void
 406 authd_decide_client(struct Client *client_p, const char *ident, const char *host, bool accept, char cause, const char *data, const char *reason)
 407 {
 408         if(client_p->preClient == NULL || client_p->preClient->authd_cid == 0)
 409                 return;
 410
 411         if(*ident != '*')
 412         {
 413                 rb_strlcpy(client_p->username, ident, sizeof(client_p->username));
 414                 ServerStats.is_asuc++;
 415         }
 416         else
 417                 ServerStats.is_abad++; /* s_auth used to do this, stay compatible */
 418
 419         if(*host != '*')
 420                 rb_strlcpy(client_p->host, host, sizeof(client_p->host));
 421
 422         client_p->preClient->authd_accepted = accept;
 423         client_p->preClient->authd_cause = cause;
 424         client_p->preClient->authd_data = (data == NULL ? NULL : rb_strdup(data));
 425         client_p->preClient->authd_reason = (reason == NULL ? NULL : rb_strdup(reason));
 426
 427         rb_dictionary_delete(cid_clients, RB_UINT_TO_POINTER(client_p->preClient->authd_cid));
 428         client_p->preClient->authd_cid = 0;
 429
 430         /*
 431          * When a client has auth'ed, we want to start reading what it sends
 432          * us. This is what read_packet() does.
 433          *     -- adrian
 434          *
 435          * Above comment was originally in s_auth.c, but moved here with below code.
 436          * --Elizafox
 437          */
 438         rb_dlinkAddTail(client_p, &client_p->node, &global_client_list);
 439         read_packet(client_p->localClient->F, client_p);
 440 }
 441
 442 /* Convenience function to accept client */
 443 void
 444 authd_accept_client(struct Client *client_p, const char *ident, const char *host)
 445 {
 446         authd_decide_client(client_p, ident, host, true, '\0', NULL, NULL);
 447 }
 448
 449 /* Convenience function to reject client */
 450 void
 451 authd_reject_client(struct Client *client_p, const char *ident, const char *host, char cause, const char *data, const char *reason)
 452 {
 453         authd_decide_client(client_p, ident, host, false, cause, data, reason);
 454 }
 455
 456 void
 457 authd_abort_client(struct Client *client_p)
 458 {
 459         if(client_p == NULL || client_p->preClient == NULL)
 460                 return;
 461
 462         if(client_p->preClient->authd_cid == 0)
 463                 return;
 464
 465         rb_dictionary_delete(cid_clients, RB_UINT_TO_POINTER(client_p->preClient->authd_cid));
 466
 467         if(authd_helper != NULL)
 468                 rb_helper_write(authd_helper, "E %x", client_p->preClient->authd_cid);
 469
 470         /* XXX should we blindly allow like this? */
 471         authd_accept_client(client_p, "*", "*");
 472         client_p->preClient->authd_cid = 0;
 473 }
 474
 475 static void
 476 timeout_dead_authd_clients(void *notused __unused)
 477 {
 478         rb_dictionary_iter iter;
 479         struct Client *client_p;
 480
 481         RB_DICTIONARY_FOREACH(client_p, &iter, cid_clients)
 482         {
 483                 if(client_p->preClient->authd_timeout < rb_current_time())
 484                         authd_abort_client(client_p);
 485         }
 486 }
 487
 488 /* Turn a cause char (who rejected us) into the name of the provider */
 489 const char *
 490 get_provider_string(char cause)
 491 {
 492         switch(cause)
 493         {
 494         case 'B':
 495                 return "Blacklist";
 496         case 'D':
 497                 return "rDNS";
 498         case 'I':
 499                 return "Ident";
 500         default:
 501                 return "Unknown";
 502         }
 503 }
 504
 505 /* Send a new blacklist to authd */
 506 void
 507 add_blacklist(const char *host, const char *reason, uint8_t iptype, rb_dlink_list *filters)
 508 {
 509         rb_dlink_node *ptr;
 510         struct blacklist_stats *stats = rb_malloc(sizeof(struct blacklist_stats));
 511         char filterbuf[BUFSIZE] = "*";
 512         size_t s = 0;
 513
 514         /* Build a list of comma-separated values for authd.
 515          * We don't check for validity - do it elsewhere.
 516          */
 517         RB_DLINK_FOREACH(ptr, filters->head)
 518         {
 519                 char *filter = ptr->data;
 520                 size_t filterlen = strlen(filter) + 1;
 521
 522                 if(s + filterlen > sizeof(filterbuf))
 523                         break;
 524
 525                 snprintf(&filterbuf[s], sizeof(filterbuf) - s, "%s,", filter);
 526
 527                 s += filterlen;
 528         }
 529
 530         if(s)
 531                 filterbuf[s - 1] = '\0';
 532
 533         stats->iptype = iptype;
 534         stats->hits = 0;
 535         rb_dictionary_add(bl_stats, host, stats);
 536
 537         rb_helper_write(authd_helper, "O rbl %s %hhu %s :%s", host, iptype, filterbuf, reason);
 538 }
 539
 540 /* Delete a blacklist */
 541 void
 542 del_blacklist(const char *host)
 543 {
 544         rb_dictionary_delete(bl_stats, host);
 545
 546         rb_helper_write(authd_helper, "O rbl_del %s", host);
 547 }
 548
 549 /* Delete all the blacklists */
 550 void
 551 del_blacklist_all(void)
 552 {
 553         struct blacklist_stats *stats;
 554         rb_dictionary_iter iter;
 555
 556         RB_DICTIONARY_FOREACH(stats, &iter, bl_stats)
 557         {
 558                 rb_free(stats);
 559                 rb_dictionary_delete(bl_stats, iter.cur->key);
 560         }
 561
 562         rb_helper_write(authd_helper, "O rbl_del_all");
 563 }
 564
 565 /* Adjust an authd timeout value */
 566 bool
 567 set_authd_timeout(const char *key, int timeout)
 568 {
 569         if(timeout <= 0)
 570                 return false;
 571
 572         rb_helper_write(authd_helper, "O %s %d", key, timeout);
 573         return true;
 574 }
 575
 576 /* Enable identd checks */
 577 void
 578 ident_check_enable(bool enabled)
 579 {
 580         rb_helper_write(authd_helper, "O ident_enabled %d", enabled ? 1 : 0);
 581 }
 582
 583 /* Create an OPM listener */
 584 void
 585 create_opm_listener(const char *ip, uint16_t port)
 586 {
 587         rb_helper_write(authd_helper, "O opm_listener %s %hu", ip, port);
 588 }
 589
 590 /* Disable all OPM scans */
 591 void
 592 opm_check_enable(bool enabled)
 593 {
 594         rb_helper_write(authd_helper, "O opm_enable %d", enabled ? 1 : 0);
 595 }
 596
 597 /* Create an OPM proxy scan */
 598 void
 599 create_opm_proxy_scan(const char *scan, uint16_t port)
 600 {
 601         rb_helper_write(authd_helper, "O opm_scanner %s %hu", scan, port);
 602 }