* POSSIBILITY OF SUCH DAMAGE.
*/
-/* So the basic design here is to have "authentication providers" that do
- * things like query ident and blacklists and even open proxies.
+/* The basic design here is to have "authentication providers" that do things
+ * like query ident and DNSBLs and even open proxies.
*
- * Providers are registered statically in the struct auth_providers array. You will
- * probably want to add an item to the provider_t enum also.
+ * Providers are registered in the auth_providers linked list. It is planned to
+ * use a bitmap to store provider ID's later.
*
- * Providers can either return failure immediately, immediate acceptance, or
- * do work in the background (calling set_provider to signal this).
+ * Providers can either return failure immediately, immediate acceptance, or do
+ * work in the background (calling set_provider to signal this).
*
- * It is up to providers to keep their own state on clients if they need to.
+ * Provider-specific data for each client can be kept in an index of the data
+ * struct member (using the provider's ID).
*
* All providers must implement at a minimum a perform_provider function. You
* don't have to implement the others if you don't need them.
* should call provider_done. Do NOT call this if you have accepted or rejected
* the client.
*
+ * Eventually, stuff like *:line handling will be moved here, but that means we
+ * have to talk to bandb directly first.
+ *
* --Elizafox, 9 March 2016
*/
+#include "stdinc.h"
+#include "rb_dictionary.h"
+#include "rb_lib.h"
#include "authd.h"
#include "provider.h"
+#include "notice.h"
+
+static EVH provider_timeout_event;
+rb_dictionary *auth_clients;
rb_dlink_list auth_providers;
-/* Clients waiting */
-struct auth_client auth_clients[MAX_CLIENTS];
+static rb_dlink_list free_pids;
+static uint32_t allocated_pids;
+static struct ev_entry *timeout_ev;
-/* Load a provider */
-void load_provider(struct auth_provider *provider)
+/* Set a provider's raw status */
+static inline void
+set_provider_status(struct auth_client *auth, uint32_t provider, provider_status_t status)
{
- provider->init();
- rb_dlinkAdd(provider, &provider->node, &auth_providers);
+ auth->data[provider].status = status;
}
-void unload_provider(struct auth_provider *provider)
+/* Set the provider as running */
+static inline void
+set_provider_running(struct auth_client *auth, uint32_t provider)
{
- provider->destroy();
- rb_dlinkDelete(&provider->node, &auth_providers);
+ auth->providers_active++;
+ set_provider_status(auth, provider, PROVIDER_STATUS_RUNNING);
+}
+
+/* Provider is no longer operating on this auth client */
+static inline void
+set_provider_done(struct auth_client *auth, uint32_t provider)
+{
+ set_provider_status(auth, provider, PROVIDER_STATUS_DONE);
+ auth->providers_active--;
}
/* Initalise all providers */
-void init_providers(void)
+void
+init_providers(void)
{
- rb_dlink_node *ptr;
- struct auth_provider *provider;
+ auth_clients = rb_dictionary_create("pending auth clients", rb_uint32cmp);
+ timeout_ev = rb_event_addish("provider_timeout_event", provider_timeout_event, NULL, 1);
- RB_DLINK_FOREACH(ptr, auth_providers.head)
- {
- provider = ptr->data;
+ /* FIXME must be started before rdns/ident to receive completion notification from them */
+ load_provider(&dnsbl_provider);
+ load_provider(&opm_provider);
- if(provider->init && !provider->init())
- /* Provider failed to init, time to go */
- exit(1);
- }
+ /* FIXME must be started after dnsbl/opm in case of early completion notifications */
+ load_provider(&rdns_provider);
+ load_provider(&ident_provider);
}
/* Terminate all providers */
-void destroy_providers(void)
+void
+destroy_providers(void)
{
- rb_dlink_node *ptr;
- struct auth_provider *provider;
+ rb_dlink_node *ptr, *nptr;
+ rb_dictionary_iter iter;
+ struct auth_client *auth;
/* Cancel outstanding connections */
- for (size_t i = 0; i < MAX_CLIENTS; i++)
+ RB_DICTIONARY_FOREACH(auth, &iter, auth_clients)
{
- if(auth_clients[i].cid)
- {
- /* TBD - is this the right thing?
- * (NOTE - this error message is designed for morons) */
- reject_client(&auth_clients[i], 0,
- "IRC server reloading... try reconnecting in a few seconds");
- }
+ auth_client_ref(auth);
+
+ /* TBD - is this the right thing? */
+ reject_client(auth, UINT32_MAX, "destroy",
+ "Authentication system is down... try reconnecting in a few seconds");
+
+ auth_client_unref(auth);
}
- RB_DLINK_FOREACH(ptr, auth_providers.head)
+ RB_DLINK_FOREACH_SAFE(ptr, nptr, auth_providers.head)
{
- provider = ptr->data;
+ struct auth_provider *provider = ptr->data;
if(provider->destroy)
provider->destroy();
+
+ rb_dlinkDelete(ptr, &auth_providers);
}
+
+ rb_dictionary_destroy(auth_clients, NULL, NULL);
+ rb_event_delete(timeout_ev);
}
-/* Cancel outstanding providers for a client */
-void cancel_providers(struct auth_client *auth)
+/* Load a provider */
+void
+load_provider(struct auth_provider *provider)
{
- rb_dlink_node *ptr;
- struct auth_provider *provider;
+ /* Assign a PID */
+ if(rb_dlink_list_length(&free_pids) > 0)
+ {
+ /* use the free list */
+ provider->id = RB_POINTER_TO_UINT(free_pids.head->data);
+ rb_dlinkDestroy(free_pids.head, &free_pids);
+ }
+ else
+ {
+ if(allocated_pids == MAX_PROVIDERS || allocated_pids == UINT32_MAX)
+ {
+ warn_opers(L_WARN, "Cannot load additional provider, max reached!");
+ return;
+ }
- RB_DLINK_FOREACH(ptr, auth_providers.head)
+ provider->id = allocated_pids++;
+ }
+
+ if(provider->opt_handlers != NULL)
{
- provider = ptr->data;
+ struct auth_opts_handler *handler;
- if(provider->cancel && is_provider(auth, provider->id))
- /* Cancel if required */
- provider->cancel(auth);
+ for(handler = provider->opt_handlers; handler->option != NULL; handler++)
+ rb_dictionary_add(authd_option_handlers, handler->option, handler);
}
-}
-/* Provider is done */
-void provider_done(struct auth_client *auth, provider_t id)
-{
- rb_dlink_node *ptr;
- struct auth_provider *provider;
+ if(provider->stats_handler.letter != '\0')
+ authd_stat_handlers[(unsigned char)provider->stats_handler.letter] = provider->stats_handler.handler;
- unset_provider(auth, id);
+ if(provider->init != NULL)
+ provider->init();
- if(!auth->providers)
- {
- /* No more providers, done */
- accept_client(auth, 0);
- return;
- }
+ rb_dlinkAdd(provider, &provider->node, &auth_providers);
+}
- RB_DLINK_FOREACH(ptr, auth_providers.head)
+void
+unload_provider(struct auth_provider *provider)
+{
+ if(provider->opt_handlers != NULL)
{
- provider = ptr->data;
+ struct auth_opts_handler *handler;
- if(provider->completed && is_provider(auth, provider->id))
- /* Notify pending clients who asked for it */
- provider->completed(auth, id);
+ for(handler = provider->opt_handlers; handler->option != NULL; handler++)
+ rb_dictionary_delete(authd_option_handlers, handler->option);
}
+
+ if(provider->stats_handler.letter != '\0')
+ authd_stat_handlers[(unsigned char)provider->stats_handler.letter] = NULL;
+
+ if(provider->destroy != NULL)
+ provider->destroy();
+
+ rb_dlinkDelete(&provider->node, &auth_providers);
+
+ /* Reclaim ID */
+ rb_dlinkAddAlloc(RB_UINT_TO_POINTER(provider->id), &free_pids);
+}
+
+void
+auth_client_free(struct auth_client *auth)
+{
+ rb_dictionary_delete(auth_clients, RB_UINT_TO_POINTER(auth->cid));
+ rb_free(auth->data);
+ rb_free(auth);
}
-/* Reject a client, cancel outstanding providers if any */
-void reject_client(struct auth_client *auth, provider_t id, const char *reason)
+/* Cancel outstanding providers for a client (if any). */
+void
+cancel_providers(struct auth_client *auth)
{
- uint16_t cid = auth->cid;
+ if(auth->providers_cancelled)
+ return;
- rb_helper_write(authd_helper, "R %x :%s", auth->cid, reason);
+ auth->providers_cancelled = true;
- unset_provider(auth, id);
+ if(auth->providers_active > 0)
+ {
+ rb_dlink_node *ptr;
- if(auth->providers)
- cancel_providers(auth);
+ RB_DLINK_FOREACH(ptr, auth_providers.head)
+ {
+ struct auth_provider *provider = ptr->data;
- memset(&auth_clients[cid], 0, sizeof(struct auth_client));
+ if(provider->cancel != NULL && is_provider_running(auth, provider->id))
+ /* Cancel if required */
+ provider->cancel(auth);
+ }
+ }
}
-/* Accept a client, cancel outstanding providers if any */
-void accept_client(struct auth_client *auth, provider_t id)
+/* Provider is done */
+void
+provider_done(struct auth_client *auth, uint32_t id)
{
- uint16_t cid = auth->cid;
+ rb_dlink_node *ptr;
- rb_helper_write(authd_helper, "A %x %s %s", auth->cid, auth->username, auth->hostname);
+ lrb_assert(is_provider_running(auth, id));
+ lrb_assert(id != UINT32_MAX);
+ lrb_assert(id < allocated_pids);
- unset_provider(auth, id);
+ set_provider_done(auth, id);
- if(auth->providers)
- cancel_providers(auth);
+ if(auth->providers_active == 0 && !auth->providers_starting)
+ {
+ /* All done */
+ accept_client(auth);
+ return;
+ }
- memset(&auth_clients[cid], 0, sizeof(struct auth_client));
+ RB_DLINK_FOREACH(ptr, auth_providers.head)
+ {
+ struct auth_provider *provider = ptr->data;
+
+ if(provider->completed != NULL && is_provider_running(auth, provider->id))
+ /* Notify pending clients who asked for it */
+ provider->completed(auth, id);
+ }
}
-/* Send a notice to a client */
-void notice_client(struct auth_client *auth, const char *notice)
+/* Reject a client and cancel any outstanding providers */
+void
+reject_client(struct auth_client *auth, uint32_t id, const char *data, const char *fmt, ...)
{
- rb_helper_write(authd_helper, "N %x :%s", auth->cid, notice);
+ char buf[BUFSIZE];
+ va_list args;
+
+ va_start(args, fmt);
+ vsnprintf(buf, sizeof(buf), fmt, args);
+ va_end(args);
+
+ /* We send back username and hostname in case ircd wants to overrule our decision.
+ * In the future this may not be the case.
+ * --Elizafox
+ */
+ rb_helper_write(authd_helper, "R %x %c %s %s %s :%s",
+ auth->cid, id != UINT32_MAX ? auth->data[id].provider->letter : '*',
+ auth->username, auth->hostname,
+ data == NULL ? "*" : data, buf);
+
+ if(id != UINT32_MAX)
+ set_provider_done(auth, id);
+
+ cancel_providers(auth);
+}
+
+/* Accept a client and cancel outstanding providers if any */
+void
+accept_client(struct auth_client *auth)
+{
+ rb_helper_write(authd_helper, "A %x %s %s", auth->cid, auth->username, auth->hostname);
+ cancel_providers(auth);
}
/* Begin authenticating user */
-void start_auth(const char *cid, const char *l_ip, const char *l_port, const char *c_ip, const char *c_port)
+static void
+start_auth(const char *cid, const char *l_ip, const char *l_port, const char *c_ip, const char *c_port, const char *protocol)
{
- rb_dlink_node *ptr;
- struct auth_provider *provider;
struct auth_client *auth;
- long lcid = strtol(cid, NULL, 16);
+ unsigned long long lcid = strtoull(cid, NULL, 16);
+ rb_dlink_node *ptr;
- if(lcid >= MAX_CLIENTS)
+ if(lcid == 0 || lcid > UINT32_MAX)
return;
- auth = &auth_clients[lcid];
- if(auth->cid != 0)
- /* Shouldn't get here */
- return;
+ auth = rb_malloc(sizeof(struct auth_client));
+ auth_client_ref(auth);
+ auth->cid = (uint32_t)lcid;
+
+ if(rb_dictionary_find(auth_clients, RB_UINT_TO_POINTER(auth->cid)) == NULL)
+ rb_dictionary_add(auth_clients, RB_UINT_TO_POINTER(auth->cid), auth);
+ else
+ {
+ warn_opers(L_CRIT, "provider: duplicate client added via start_auth: %s", cid);
+ exit(EX_PROVIDER_ERROR);
+ }
- auth->cid = (uint16_t)lcid;
+ auth->protocol = strtoull(protocol, NULL, 16);
rb_strlcpy(auth->l_ip, l_ip, sizeof(auth->l_ip));
- auth->l_port = (uint16_t)atoi(l_port); /* Safe cast, port shouldn't exceed 16 bits */
+ auth->l_port = (uint16_t)atoi(l_port); /* should be safe */
+ (void) rb_inet_pton_sock(l_ip, &auth->l_addr);
+ SET_SS_PORT(&auth->l_addr, htons(auth->l_port));
rb_strlcpy(auth->c_ip, c_ip, sizeof(auth->c_ip));
auth->c_port = (uint16_t)atoi(c_port);
+ (void) rb_inet_pton_sock(c_ip, &auth->c_addr);
+ SET_SS_PORT(&auth->c_addr, htons(auth->c_port));
+ rb_strlcpy(auth->hostname, "*", sizeof(auth->hostname));
+ rb_strlcpy(auth->username, "*", sizeof(auth->username));
+
+ auth->data = rb_malloc(allocated_pids * sizeof(struct auth_client_data));
+
+ auth->providers_starting = true;
RB_DLINK_FOREACH(ptr, auth_providers.head)
{
- provider = ptr->data;
+ struct auth_provider *provider = ptr->data;
+
+ auth->data[provider->id].provider = provider;
+
+ lrb_assert(provider->start != NULL);
/* Execute providers */
+ set_provider_running(auth, provider->id);
if(!provider->start(auth))
- {
/* Rejected immediately */
- cancel_providers(auth);
- return;
- }
+ goto done;
+
+ if(auth->providers_cancelled)
+ break;
}
+ auth->providers_starting = false;
/* If no providers are running, accept the client */
- if(!auth->providers)
- accept_client(auth, 0);
+ if(auth->providers_active == 0)
+ accept_client(auth);
+
+done:
+ auth_client_unref(auth);
}
/* Callback for the initiation */
-void handle_new_connection(int parc, char *parv[])
+void
+handle_new_connection(int parc, char *parv[])
+{
+ if (parc < 6) {
+ warn_opers(L_CRIT, "provider: received too few params for new connection (6 expected, got %d)", parc);
+ exit(EX_PROVIDER_ERROR);
+ }
+
+ start_auth(parv[1], parv[2], parv[3], parv[4], parv[5], parc > 6 ? parv[6] : "0");
+}
+
+void
+handle_cancel_connection(int parc, char *parv[])
{
- if(parc < 5)
+ struct auth_client *auth;
+ unsigned long long lcid;
+
+ if(parc < 2)
+ {
+ warn_opers(L_CRIT, "provider: received too few params for new connection (2 expected, got %d)", parc);
+ exit(EX_PROVIDER_ERROR);
+ }
+
+ lcid = strtoull(parv[1], NULL, 16);
+ if(lcid == 0 || lcid > UINT32_MAX)
+ {
+ warn_opers(L_CRIT, "provider: got a request to cancel a connection that can't exist: %s", parv[1]);
+ exit(EX_PROVIDER_ERROR);
+ }
+
+ if((auth = rb_dictionary_retrieve(auth_clients, RB_UINT_TO_POINTER((uint32_t)lcid))) == NULL)
+ {
+ /* This could happen as a race if we've accepted/rejected but they cancel, so don't die here.
+ * --Elizafox */
return;
+ }
+
+ auth_client_ref(auth);
+ cancel_providers(auth);
+ auth_client_unref(auth);
+}
+
+static void
+provider_timeout_event(void *notused __unused)
+{
+ struct auth_client *auth;
+ rb_dictionary_iter iter;
+ const time_t curtime = rb_current_time();
- start_auth(parv[1], parv[2], parv[3], parv[4], parv[5]);
+ RB_DICTIONARY_FOREACH(auth, &iter, auth_clients)
+ {
+ rb_dlink_node *ptr;
+
+ auth_client_ref(auth);
+
+ RB_DLINK_FOREACH(ptr, auth_providers.head)
+ {
+ struct auth_provider *provider = ptr->data;
+ const time_t timeout = get_provider_timeout(auth, provider->id);
+
+ if(is_provider_running(auth, provider->id) && provider->timeout != NULL &&
+ timeout > 0 && timeout < curtime)
+ {
+ provider->timeout(auth);
+ }
+ }
+
+ auth_client_unref(auth);
+ }
}