authd/provider.c

   1 /* authd/provider.c - authentication provider framework
   2  * Copyright (c) 2016 Elizabeth Myers <elizabeth@interlinked.me>
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice is present in all copies.
   7  *
   8  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
   9  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  10  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  11  * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
  12  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  13  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  14  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  15  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  16  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
  17  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  18  * POSSIBILITY OF SUCH DAMAGE.
  19  */
  20
  21 /* The basic design here is to have "authentication providers" that do things
  22  * like query ident and blacklists and even open proxies.
  23  *
  24  * Providers are registered in the auth_providers linked list. It is planned to
  25  * use a bitmap to store provider ID's later.
  26  *
  27  * Providers can either return failure immediately, immediate acceptance, or do
  28  * work in the background (calling set_provider to signal this).
  29  *
  30  * Provider-specific data for each client can be kept in an index of the data
  31  * struct member (using the provider's ID).
  32  *
  33  * All providers must implement at a minimum a perform_provider function. You
  34  * don't have to implement the others if you don't need them.
  35  *
  36  * Providers may kick clients off by rejecting them. Upon rejection, all
  37  * providers are cancelled. They can also unconditionally accept them.
  38  *
  39  * When a provider is done and is neutral on accepting/rejecting a client, it
  40  * should call provider_done. Do NOT call this if you have accepted or rejected
  41  * the client.
  42  *
  43  * Eventually, stuff like *:line handling will be moved here, but that means we
  44  * have to talk to bandb directly first.
  45  *
  46  * --Elizafox, 9 March 2016
  47  */
  48
  49 #include "rb_dictionary.h"
  50 #include "authd.h"
  51 #include "provider.h"
  52
  53 rb_dlink_list auth_providers;
  54
  55 /* Clients waiting */
  56 rb_dictionary *auth_clients;
  57
  58 /* Load a provider */
  59 void load_provider(struct auth_provider *provider)
  60 {
  61         if(rb_dlink_list_length(&auth_providers) >= MAX_PROVIDERS)
  62         {
  63                 warn_opers(L_CRIT, "Exceeded maximum level of authd providers (%d max)", MAX_PROVIDERS);
  64                 return;
  65         }
  66
  67         provider->init();
  68         rb_dlinkAdd(provider, &provider->node, &auth_providers);
  69 }
  70
  71 void unload_provider(struct auth_provider *provider)
  72 {
  73         provider->destroy();
  74         rb_dlinkDelete(&provider->node, &auth_providers);
  75 }
  76
  77 /* Initalise all providers */
  78 void init_providers(void)
  79 {
  80         auth_clients = rb_dictionary_create("pending auth clients", rb_uint32cmp);
  81         load_provider(&rdns_provider);
  82         load_provider(&ident_provider);
  83 }
  84
  85 /* Terminate all providers */
  86 void destroy_providers(void)
  87 {
  88         rb_dlink_node *ptr;
  89         rb_dictionary_iter iter;
  90         struct auth_client *auth;
  91         struct auth_provider *provider;
  92
  93         /* Cancel outstanding connections */
  94         RB_DICTIONARY_FOREACH(auth, &iter, auth_clients)
  95         {
  96                 /* TBD - is this the right thing? */
  97                 reject_client(auth, 0, "Authentication system is down... try reconnecting in a few seconds");
  98         }
  99
 100         RB_DLINK_FOREACH(ptr, auth_providers.head)
 101         {
 102                 provider = ptr->data;
 103
 104                 if(provider->destroy)
 105                         provider->destroy();
 106         }
 107 }
 108
 109 /* Cancel outstanding providers for a client */
 110 void cancel_providers(struct auth_client *auth)
 111 {
 112         rb_dlink_node *ptr;
 113         struct auth_provider *provider;
 114
 115         RB_DLINK_FOREACH(ptr, auth_providers.head)
 116         {
 117                 provider = ptr->data;
 118
 119                 if(provider->cancel && is_provider(auth, provider->id))
 120                         /* Cancel if required */
 121                         provider->cancel(auth);
 122         }
 123
 124         rb_dictionary_delete(auth_clients, RB_UINT_TO_POINTER(auth->cid));
 125         rb_free(auth);
 126 }
 127
 128 /* Provider is done */
 129 void provider_done(struct auth_client *auth, provider_t id)
 130 {
 131         rb_dlink_node *ptr;
 132         struct auth_provider *provider;
 133
 134         unset_provider(auth, id);
 135
 136         if(!auth->providers)
 137         {
 138                 /* No more providers, done */
 139                 accept_client(auth, 0);
 140                 return;
 141         }
 142
 143         RB_DLINK_FOREACH(ptr, auth_providers.head)
 144         {
 145                 provider = ptr->data;
 146
 147                 if(provider->completed && is_provider(auth, provider->id))
 148                         /* Notify pending clients who asked for it */
 149                         provider->completed(auth, id);
 150         }
 151 }
 152
 153 /* Reject a client */
 154 void reject_client(struct auth_client *auth, provider_t id, const char *reason)
 155 {
 156         char reject;
 157
 158         switch(id)
 159         {
 160         case PROVIDER_RDNS:
 161                 reject = 'D';
 162                 break;
 163         case PROVIDER_IDENT:
 164                 reject = 'I';
 165                 break;
 166         case PROVIDER_BLACKLIST:
 167                 reject = 'B';
 168                 break;
 169         default:
 170                 reject = 'N';
 171                 break;
 172         }
 173
 174         /* TODO send back ident */
 175         rb_helper_write(authd_helper, "R %x %c :%s", auth->cid, reject, reason);
 176
 177         unset_provider(auth, id);
 178         cancel_providers(auth);
 179 }
 180
 181 /* Accept a client, cancel outstanding providers if any */
 182 void accept_client(struct auth_client *auth, provider_t id)
 183 {
 184         uint32_t cid = auth->cid;
 185
 186         rb_helper_write(authd_helper, "A %x %s %s", auth->cid, auth->username, auth->hostname);
 187
 188         unset_provider(auth, id);
 189         cancel_providers(auth);
 190 }
 191
 192 /* Send a notice to a client */
 193 void notice_client(struct auth_client *auth, const char *fmt, ...)
 194 {
 195         char buf[BUFSIZE];
 196         va_list args;
 197
 198         va_start(args, fmt);
 199         vsnprintf(buf, sizeof(buf), fmt, args);
 200         va_end(args);
 201
 202         rb_helper_write(authd_helper, "N %x :%s", auth->cid, buf);
 203 }
 204
 205 /* Send a warning to the IRC daemon for logging, etc. */
 206 void warn_opers(notice_level_t level, const char *fmt, ...)
 207 {
 208         char buf[BUFSIZE];
 209         va_list args;
 210
 211         va_start(args, fmt);
 212         vsnprintf(buf, sizeof(buf), fmt, args);
 213         va_end(args);
 214
 215         rb_helper_write(authd_helper, "W %c :%s", level, buf);
 216 }
 217
 218 /* Begin authenticating user */
 219 static void start_auth(const char *cid, const char *l_ip, const char *l_port, const char *c_ip, const char *c_port)
 220 {
 221         struct auth_provider *provider;
 222         struct auth_client *auth = rb_malloc(sizeof(struct auth_client));
 223         long lcid = strtol(cid, NULL, 16);
 224         rb_dlink_node *ptr;
 225
 226         if(lcid >= UINT32_MAX)
 227                 return;
 228
 229         auth->cid = (uint32_t)lcid;
 230
 231         rb_strlcpy(auth->l_ip, l_ip, sizeof(auth->l_ip));
 232         auth->l_port = (uint16_t)atoi(l_port);  /* should be safe */
 233         (void) rb_inet_pton_sock(l_ip, (struct sockaddr *)&auth->l_addr);
 234
 235         rb_strlcpy(auth->c_ip, c_ip, sizeof(auth->c_ip));
 236         auth->c_port = (uint16_t)atoi(c_port);
 237         (void) rb_inet_pton_sock(c_ip, (struct sockaddr *)&auth->c_addr);
 238
 239 #ifdef RB_IPV6
 240         if(GET_SS_FAMILY(&auth->l_addr) == AF_INET6)
 241                 ((struct sockaddr_in6 *)&auth->l_addr)->sin6_port = htons(auth->l_port);
 242         else
 243 #endif
 244                 ((struct sockaddr_in *)&auth->l_addr)->sin_port = htons(auth->l_port);
 245
 246 #ifdef RB_IPV6
 247         if(GET_SS_FAMILY(&auth->c_addr) == AF_INET6)
 248                 ((struct sockaddr_in6 *)&auth->c_addr)->sin6_port = htons(auth->c_port);
 249         else
 250 #endif
 251                 ((struct sockaddr_in *)&auth->c_addr)->sin_port = htons(auth->c_port);
 252
 253         rb_dictionary_add(auth_clients, RB_UINT_TO_POINTER(auth->cid), auth);
 254
 255         RB_DLINK_FOREACH(ptr, auth_providers.head)
 256         {
 257                 provider = ptr->data;
 258
 259                 /* Execute providers */
 260                 if(!provider->start(auth))
 261                 {
 262                         /* Rejected immediately */
 263                         cancel_providers(auth);
 264                         return;
 265                 }
 266         }
 267
 268         /* If no providers are running, accept the client */
 269         if(!auth->providers)
 270                 accept_client(auth, 0);
 271 }
 272
 273 /* Callback for the initiation */
 274 void handle_new_connection(int parc, char *parv[])
 275 {
 276         if(parc < 7)
 277         {
 278                 warn_opers(L_CRIT, "BUG: received too few params for new connection (7 expected, got %d)", parc);
 279                 return;
 280         }
 281
 282         start_auth(parv[1], parv[2], parv[3], parv[4], parv[5]);
 283 }