authd/providers/blacklist.c

   1 /*
   2  * charybdis: A slightly useful ircd.
   3  * blacklist.c: Manages DNS blacklist entries and lookups
   4  *
   5  * Copyright (C) 2006-2011 charybdis development team
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions are
   9  * met:
  10  *
  11  * 1. Redistributions of source code must retain the above copyright notice,
  12  *    this list of conditions and the following disclaimer.
  13  *
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in the
  16  *    documentation and/or other materials provided with the distribution.
  17  *
  18  * 3. The name of the author may not be used to endorse or promote products
  19  *    derived from this software without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  22  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  23  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  24  * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
  25  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  26  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  27  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  29  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
  30  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  31  * POSSIBILITY OF SUCH DAMAGE.
  32  */
  33
  34 /* Originally written for charybdis circa 2006 (by nenolod?).
  35  * Tweaked for authd. Some functions and structs renamed. Public/private
  36  * interfaces have been shifted around. Some code has been cleaned up too.
  37  * -- Elizafox 24 March 2016
  38  */
  39
  40 #include "authd.h"
  41 #include "provider.h"
  42 #include "notice.h"
  43 #include "stdinc.h"
  44 #include "dns.h"
  45
  46 typedef enum filter_t
  47 {
  48         FILTER_ALL = 1,
  49         FILTER_LAST = 2,
  50 } filter_t;
  51
  52 /* Blacklist accepted IP types */
  53 #define IPTYPE_IPV4     1
  54 #define IPTYPE_IPV6     2
  55
  56 /* A configured DNSBL */
  57 struct blacklist
  58 {
  59         char host[IRCD_RES_HOSTLEN + 1];
  60         char reason[BUFSIZE];           /* Reason template (ircd fills in the blanks) */
  61         unsigned char iptype;           /* IP types supported */
  62         rb_dlink_list filters;          /* Filters for queries */
  63
  64         bool delete;                    /* If true delete when no clients */
  65         int refcount;                   /* When 0 and delete is set, remove this blacklist */
  66
  67         time_t lastwarning;             /* Last warning about garbage replies sent */
  68 };
  69
  70 /* A lookup in progress for a particular DNSBL for a particular client */
  71 struct blacklist_lookup
  72 {
  73         struct blacklist *bl;           /* Blacklist we're checking */
  74         struct auth_client *auth;       /* Client */
  75         struct dns_query *query;        /* DNS query pointer */
  76
  77         rb_dlink_node node;
  78 };
  79
  80 /* A blacklist filter */
  81 struct blacklist_filter
  82 {
  83         filter_t type;                  /* Type of filter */
  84         char filter[HOSTIPLEN]; /* The filter itself */
  85
  86         rb_dlink_node node;
  87 };
  88
  89 /* Blacklist user data attached to auth_client instance */
  90 struct blacklist_user
  91 {
  92         rb_dlink_list queries;          /* Blacklist queries in flight */
  93         time_t timeout;                 /* When this times out */
  94 };
  95
  96 /* public interfaces */
  97 static bool blacklists_init(void);
  98 static void blacklists_destroy(void);
  99
 100 static bool blacklists_start(struct auth_client *);
 101 static void blacklists_cancel(struct auth_client *);
 102
 103 /* private interfaces */
 104 static void unref_blacklist(struct blacklist *);
 105 static struct blacklist *new_blacklist(const char *, const char *, unsigned char, rb_dlink_list *);
 106 static struct blacklist *find_blacklist(const char *);
 107 static bool blacklist_check_reply(struct blacklist_lookup *, const char *);
 108 static void blacklist_dns_callback(const char *, bool, query_type, void *);
 109 static void initiate_blacklist_dnsquery(struct blacklist *, struct auth_client *);
 110 static void timeout_blacklist_queries_event(void *);
 111
 112 /* Variables */
 113 static rb_dlink_list blacklist_list = { NULL, NULL, 0 };
 114 static struct ev_entry *timeout_ev;
 115 static int blacklist_timeout = 15;
 116
 117 /* private interfaces */
 118
 119 static void
 120 unref_blacklist(struct blacklist *bl)
 121 {
 122         rb_dlink_node *ptr, *nptr;
 123
 124         bl->refcount--;
 125         if (bl->delete && bl->refcount <= 0)
 126         {
 127                 RB_DLINK_FOREACH_SAFE(ptr, nptr, bl->filters.head)
 128                 {
 129                         rb_dlinkDelete(ptr, &bl->filters);
 130                         rb_free(ptr);
 131                 }
 132
 133                 rb_dlinkFindDestroy(bl, &blacklist_list);
 134                 rb_free(bl);
 135         }
 136 }
 137
 138 static struct blacklist *
 139 new_blacklist(const char *name, const char *reason, unsigned char iptype, rb_dlink_list *filters)
 140 {
 141         struct blacklist *bl;
 142
 143         if (name == NULL || reason == NULL || iptype == 0)
 144                 return NULL;
 145
 146         if((bl = find_blacklist(name)) == NULL)
 147         {
 148                 bl = rb_malloc(sizeof(struct blacklist));
 149                 rb_dlinkAddAlloc(bl, &blacklist_list);
 150         }
 151         else
 152                 bl->delete = false;
 153
 154         rb_strlcpy(bl->host, name, IRCD_RES_HOSTLEN + 1);
 155         rb_strlcpy(bl->reason, reason, BUFSIZE);
 156         bl->iptype = iptype;
 157
 158         rb_dlinkMoveList(filters, &bl->filters);
 159
 160         bl->lastwarning = 0;
 161
 162         return bl;
 163 }
 164
 165 static struct blacklist *
 166 find_blacklist(const char *name)
 167 {
 168         rb_dlink_node *ptr;
 169
 170         RB_DLINK_FOREACH(ptr, blacklist_list.head)
 171         {
 172                 struct blacklist *bl = (struct blacklist *)ptr->data;
 173
 174                 if (!strcasecmp(bl->host, name))
 175                         return bl;
 176         }
 177
 178         return NULL;
 179 }
 180
 181 static inline bool
 182 blacklist_check_reply(struct blacklist_lookup *bllookup, const char *ipaddr)
 183 {
 184         struct blacklist *bl = bllookup->bl;
 185         const char *lastoctet;
 186         rb_dlink_node *ptr;
 187
 188         /* No filters and entry found - thus positive match */
 189         if (!rb_dlink_list_length(&bl->filters))
 190                 return true;
 191
 192         /* Below will prolly have to change if IPv6 address replies are sent back */
 193         if ((lastoctet = strrchr(ipaddr, '.')) == NULL || *(++lastoctet) == '\0')
 194                 goto blwarn;
 195
 196         RB_DLINK_FOREACH(ptr, bl->filters.head)
 197         {
 198                 struct blacklist_filter *filter = ptr->data;
 199                 const char *cmpstr;
 200
 201                 if (filter->type == FILTER_ALL)
 202                         cmpstr = ipaddr;
 203                 else if (filter->type == FILTER_LAST)
 204                         cmpstr = lastoctet;
 205                 else
 206                 {
 207                         warn_opers(L_CRIT, "BUG: Unknown blacklist filter type on blacklist %s: %d",
 208                                         bl->host, filter->type);
 209                         continue;
 210                 }
 211
 212                 if (strcmp(cmpstr, filter->filter) == 0)
 213                         /* Match! */
 214                         return true;
 215         }
 216
 217         return false;
 218 blwarn:
 219         if (bl->lastwarning + 3600 < rb_current_time())
 220         {
 221                 warn_opers(L_WARN, "Garbage/undecipherable reply received from blacklist %s (reply %s)",
 222                                 bl->host, ipaddr);
 223                 bl->lastwarning = rb_current_time();
 224         }
 225         return false;
 226 }
 227
 228 static void
 229 blacklist_dns_callback(const char *result, bool status, query_type type, void *data)
 230 {
 231         struct blacklist_lookup *bllookup = (struct blacklist_lookup *)data;
 232         struct blacklist_user *bluser;
 233         struct auth_client *auth;
 234
 235         if (bllookup == NULL || bllookup->auth == NULL)
 236                 return;
 237
 238         auth = bllookup->auth;
 239         bluser = auth->data[PROVIDER_BLACKLIST];
 240         if(bluser == NULL)
 241                 return;
 242
 243         if (result != NULL && status && blacklist_check_reply(bllookup, result))
 244         {
 245                 /* Match found, so proceed no further */
 246                 blacklists_cancel(auth);
 247                 reject_client(auth, PROVIDER_BLACKLIST, bllookup->bl->reason);
 248                 return;
 249         }
 250
 251         unref_blacklist(bllookup->bl);
 252         rb_dlinkDelete(&bllookup->node, &bluser->queries);
 253         rb_free(bllookup);
 254
 255         if(!rb_dlink_list_length(&bluser->queries))
 256         {
 257                 /* Done here */
 258                 provider_done(auth, PROVIDER_BLACKLIST);
 259                 rb_free(bluser);
 260                 auth->data[PROVIDER_BLACKLIST] = NULL;
 261         }
 262 }
 263
 264 static void
 265 initiate_blacklist_dnsquery(struct blacklist *bl, struct auth_client *auth)
 266 {
 267         struct blacklist_lookup *bllookup = rb_malloc(sizeof(struct blacklist_lookup));
 268         struct blacklist_user *bluser = auth->data[PROVIDER_BLACKLIST];
 269         char buf[IRCD_RES_HOSTLEN + 1];
 270         int aftype;
 271
 272         bllookup->bl = bl;
 273         bllookup->auth = auth;
 274
 275         aftype = GET_SS_FAMILY(&auth->c_addr);
 276         if((aftype == AF_INET && (bl->iptype & IPTYPE_IPV4) == 0) ||
 277                 (aftype == AF_INET6 && (bl->iptype & IPTYPE_IPV6) == 0))
 278                 /* Incorrect blacklist type for this IP... */
 279                 return;
 280
 281         build_rdns(buf, sizeof(buf), &auth->c_addr, bl->host);
 282
 283         bllookup->query = lookup_ip(buf, AF_INET, blacklist_dns_callback, bllookup);
 284
 285         rb_dlinkAdd(bllookup, &bllookup->node, &bluser->queries);
 286         bl->refcount++;
 287 }
 288
 289 /* Timeout outstanding queries */
 290 static void
 291 timeout_blacklist_queries_event(void *notused)
 292 {
 293         struct auth_client *auth;
 294         rb_dictionary_iter iter;
 295
 296         RB_DICTIONARY_FOREACH(auth, &iter, auth_clients)
 297         {
 298                 struct blacklist_user *bluser = auth->data[PROVIDER_BLACKLIST];
 299
 300                 if(bluser != NULL && bluser->timeout < rb_current_time())
 301                 {
 302                         blacklists_cancel(auth);
 303                         provider_done(auth, PROVIDER_BLACKLIST);
 304                 }
 305         }
 306 }
 307
 308 static inline void
 309 lookup_all_blacklists(struct auth_client *auth)
 310 {
 311         struct blacklist_user *bluser = auth->data[PROVIDER_BLACKLIST];
 312         rb_dlink_node *ptr;
 313
 314         RB_DLINK_FOREACH(ptr, blacklist_list.head)
 315         {
 316                 struct blacklist *bl = (struct blacklist *)ptr->data;
 317
 318                 if (!bl->delete)
 319                         initiate_blacklist_dnsquery(bl, auth);
 320         }
 321
 322         bluser->timeout = rb_current_time() + blacklist_timeout;
 323 }
 324
 325 static inline void
 326 delete_blacklist(struct blacklist *bl)
 327 {
 328         if (bl->refcount > 0)
 329                 bl->delete = true;
 330         else
 331         {
 332                 rb_dlinkFindDestroy(bl, &blacklist_list);
 333                 rb_free(bl);
 334         }
 335 }
 336
 337 static void
 338 delete_all_blacklists(void)
 339 {
 340         rb_dlink_node *ptr, *nptr;
 341
 342         RB_DLINK_FOREACH_SAFE(ptr, nptr, blacklist_list.head)
 343         {
 344                 delete_blacklist(ptr->data);
 345         }
 346 }
 347
 348 /* public interfaces */
 349 static bool
 350 blacklists_start(struct auth_client *auth)
 351 {
 352         if(auth->data[PROVIDER_BLACKLIST] != NULL)
 353                 return true;
 354
 355         if(!rb_dlink_list_length(&blacklist_list))
 356                 /* Nothing to do... */
 357                 return true;
 358
 359         auth->data[PROVIDER_BLACKLIST] = rb_malloc(sizeof(struct blacklist_user));
 360
 361         if(is_provider_done(auth, PROVIDER_RDNS) && is_provider_done(auth, PROVIDER_IDENT))
 362                 /* This probably can't happen but let's handle this case anyway */
 363                 lookup_all_blacklists(auth);
 364
 365         set_provider_on(auth, PROVIDER_BLACKLIST);
 366         return true;
 367 }
 368
 369 /* This is called every time a provider is completed as long as we are marked not done */
 370 static void
 371 blacklists_initiate(struct auth_client *auth, provider_t provider)
 372 {
 373         struct blacklist_user *bluser = auth->data[PROVIDER_BLACKLIST];
 374
 375         lrb_assert(provider != PROVIDER_BLACKLIST);
 376         lrb_assert(!is_provider_done(auth, PROVIDER_BLACKLIST));
 377         lrb_assert(rb_dlink_list_length(&blacklist_list) > 0);
 378
 379         if(bluser == NULL || rb_dlink_list_length(&bluser->queries))
 380                 /* Nothing to do */
 381                 return;
 382         else if(!(is_provider_done(auth, PROVIDER_RDNS) && is_provider_done(auth, PROVIDER_IDENT)))
 383                 /* Don't start until we've completed these */
 384                 return;
 385         else
 386                 lookup_all_blacklists(auth);
 387 }
 388
 389 static void
 390 blacklists_cancel(struct auth_client *auth)
 391 {
 392         rb_dlink_node *ptr, *nptr;
 393         struct blacklist_user *bluser = auth->data[PROVIDER_BLACKLIST];
 394
 395         if(bluser == NULL)
 396                 return;
 397
 398         RB_DLINK_FOREACH_SAFE(ptr, nptr, bluser->queries.head)
 399         {
 400                 struct blacklist_lookup *bllookup = ptr->data;
 401                 rb_dlinkDelete(&bllookup->node, &bluser->queries);
 402                 unref_blacklist(bllookup->bl);
 403                 cancel_query(bllookup->query);
 404                 rb_free(bllookup);
 405         }
 406
 407         rb_free(bluser);
 408         auth->data[PROVIDER_BLACKLIST] = NULL;
 409 }
 410
 411 static bool
 412 blacklists_init(void)
 413 {
 414         timeout_ev = rb_event_addish("timeout_blacklist_queries_event", timeout_blacklist_queries_event, NULL, 1);
 415         return (timeout_ev != NULL);
 416 }
 417
 418 static void
 419 blacklists_destroy(void)
 420 {
 421         rb_dlink_node *ptr, *nptr;
 422         rb_dictionary_iter iter;
 423         struct blacklist *bl;
 424         struct auth_client *auth;
 425
 426         RB_DICTIONARY_FOREACH(auth, &iter, auth_clients)
 427         {
 428                 blacklists_cancel(auth);
 429         }
 430
 431         delete_all_blacklists();
 432         rb_event_delete(timeout_ev);
 433 }
 434
 435 static void
 436 add_conf_blacklist(const char *key, int parc, const char **parv)
 437 {
 438         rb_dlink_list filters = { NULL, NULL, 0 };
 439         char *tmp, *elemlist = rb_strdup(parv[2]);
 440         unsigned char iptype;
 441
 442         if(*elemlist == '*')
 443                 goto end;
 444
 445         for(char *elem = rb_strtok_r(elemlist, ",", &tmp); elem; elem = rb_strtok_r(NULL, ",", &tmp))
 446         {
 447                 struct blacklist_filter *filter = rb_malloc(sizeof(struct blacklist_filter));
 448                 int dot_c = 0;
 449                 filter_t type = FILTER_LAST;
 450                 bool valid = true;
 451
 452                 /* Check blacklist filter type and for validity */
 453                 for(char *c = elem; *c != '\0'; c++)
 454                 {
 455                         if(*c == '.')
 456                         {
 457                                 if(++dot_c > 3)
 458                                 {
 459                                         warn_opers(L_CRIT, "addr_conf_blacklist got a bad filter (too many octets)");
 460                                         valid = false;
 461                                         break;
 462                                 }
 463
 464                                 type = FILTER_ALL;
 465                         }
 466                         else if(!isdigit(*c))
 467                         {
 468                                 warn_opers(L_CRIT, "addr_conf_blacklist got a bad filter (invalid character in blacklist filter: %c)", *c);
 469                                 valid = false;
 470                                 break;
 471                         }
 472                 }
 473
 474                 if(valid && dot_c > 0 && dot_c < 3)
 475                 {
 476                         warn_opers(L_CRIT, "addr_conf_blacklist got a bad filter (insufficient octets)");
 477                         valid = false;
 478                 }
 479
 480                 if(!valid)
 481                 {
 482                         rb_free(filter);
 483                         continue;
 484                 }
 485
 486                 filter->type = type;
 487                 rb_strlcpy(filter->filter, elem, sizeof(filter->filter));
 488                 rb_dlinkAdd(filter, &filter->node, &filters);
 489         }
 490
 491 end:
 492         rb_free(elemlist);
 493
 494         iptype = atoi(parv[1]) & 0x3;
 495         if(new_blacklist(parv[0], parv[3], iptype, &filters) == NULL)
 496         {
 497                 rb_dlink_node *ptr, *nptr;
 498
 499                 warn_opers(L_CRIT, "addr_conf_blacklist got a malformed blacklist");
 500
 501                 RB_DLINK_FOREACH_SAFE(ptr, nptr, filters.head)
 502                 {
 503                         rb_free(ptr->data);
 504                         rb_dlinkDelete(ptr, &filters);
 505                 }
 506         }
 507 }
 508
 509 static void
 510 del_conf_blacklist(const char *key, int parc, const char **parv)
 511 {
 512         struct blacklist *bl = find_blacklist(parv[0]);
 513         if(bl == NULL)
 514         {
 515                 warn_opers(L_CRIT, "BUG: tried to remove nonexistent blacklist %s", parv[0]);
 516                 return;
 517         }
 518
 519         delete_blacklist(bl);
 520 }
 521
 522 static void
 523 del_conf_blacklist_all(const char *key, int parc, const char **parv)
 524 {
 525         delete_all_blacklists();
 526 }
 527
 528 static void
 529 add_conf_blacklist_timeout(const char *key, int parc, const char **parv)
 530 {
 531         int timeout = atoi(parv[0]);
 532
 533         if(timeout < 0)
 534         {
 535                 warn_opers(L_CRIT, "BUG: blacklist timeout < 0 (value: %d)", timeout);
 536                 return;
 537         }
 538
 539         blacklist_timeout = timeout;
 540 }
 541
 542 struct auth_opts_handler blacklist_options[] =
 543 {
 544         { "rbl", 4, add_conf_blacklist },
 545         { "rbl_del", 1, del_conf_blacklist },
 546         { "rbl_del_all", 0, del_conf_blacklist_all },
 547         { "rbl_timeout", 1, add_conf_blacklist_timeout },
 548         { NULL, 0, NULL },
 549 };
 550
 551 struct auth_provider blacklist_provider =
 552 {
 553         .id = PROVIDER_BLACKLIST,
 554         .init = blacklists_init,
 555         .destroy = blacklists_destroy,
 556         .start = blacklists_start,
 557         .cancel = blacklists_cancel,
 558         .completed = blacklists_initiate,
 559         .opt_handlers = blacklist_options,
 560 };