* charybdis: A slightly useful ircd.
* blacklist.c: Manages DNS blacklist entries and lookups
*
- * Copyright (C) 2006-2008 charybdis development team
+ * Copyright (C) 2006-2011 charybdis development team
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are
* IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*
- * $Id: blacklist.c 2743 2006-11-10 15:15:00Z jilles $
*/
#include "stdinc.h"
#include "client.h"
#include "res.h"
-#include "tools.h"
-#include "memory.h"
#include "numeric.h"
#include "reject.h"
#include "s_conf.h"
#include "s_user.h"
#include "blacklist.h"
+#include "send.h"
rb_dlink_list blacklist_list = { NULL, NULL, 0 };
return NULL;
}
+static inline int blacklist_check_reply(struct BlacklistClient *blcptr, struct rb_sockaddr_storage *addr)
+{
+ struct Blacklist *blptr = blcptr->blacklist;
+ char ipaddr[HOSTIPLEN];
+ char *lastoctet;
+ rb_dlink_node *ptr;
+
+ /* XXX the below two checks might want to change at some point
+ * e.g. if IPv6 blacklists don't use 127.x.y.z or A records anymore
+ * --Elizabeth
+ */
+ if (addr->ss_family != AF_INET ||
+ memcmp(&((struct sockaddr_in *)addr)->sin_addr, "\177", 1))
+ goto blwarn;
+
+ /* No filters and entry found - thus positive match */
+ if (!rb_dlink_list_length(&blptr->filters))
+ return 1;
+
+ rb_inet_ntop_sock((struct sockaddr *)addr, ipaddr, sizeof(ipaddr));
+
+ /* Below will prolly have to change too if the above changes */
+ if ((lastoctet = strrchr(ipaddr, '.')) == NULL || *(++lastoctet) == '\0')
+ goto blwarn;
+
+ RB_DLINK_FOREACH(ptr, blcptr->blacklist->filters.head)
+ {
+ struct BlacklistFilter *filter = ptr->data;
+ char *cmpstr;
+
+ if (filter->type == BLACKLIST_FILTER_ALL)
+ cmpstr = ipaddr;
+ else if (filter->type == BLACKLIST_FILTER_LAST)
+ cmpstr = lastoctet;
+ else
+ {
+ sendto_realops_snomask(SNO_GENERAL, L_ALL,
+ "blacklist_check_reply(): Unknown filtertype (BUG!)");
+ continue;
+ }
+
+ if (strcmp(cmpstr, filter->filterstr) == 0)
+ /* Match! */
+ return 1;
+ }
+
+ return 0;
+blwarn:
+ if (blcptr->blacklist->lastwarning + 3600 < rb_current_time())
+ {
+ sendto_realops_snomask(SNO_GENERAL, L_ALL,
+ "Garbage reply from blacklist %s",
+ blcptr->blacklist->host);
+ blcptr->blacklist->lastwarning = rb_current_time();
+ }
+ return 0;
+}
+
static void blacklist_dns_callback(void *vptr, struct DNSReply *reply)
{
struct BlacklistClient *blcptr = (struct BlacklistClient *) vptr;
{
sendto_realops_snomask(SNO_GENERAL, L_ALL,
"blacklist_dns_callback(): blcptr->client_p->preClient (%s) is NULL", get_client_name(blcptr->client_p, HIDE_IP));
- MyFree(blcptr);
+ rb_free(blcptr);
return;
}
if (reply != NULL)
{
- /* only accept 127.0.0.x as a listing */
- if (reply->addr.ss_family == AF_INET &&
- !memcmp(&((struct sockaddr_in *)&reply->addr)->sin_addr, "\177\0\0", 3))
+ if (blacklist_check_reply(blcptr, &reply->addr))
listed = TRUE;
- else if (blcptr->blacklist->lastwarning + 3600 < CurrentTime)
- {
- sendto_realops_snomask(SNO_GENERAL, L_ALL,
- "Garbage reply from blacklist %s",
- blcptr->blacklist->host);
- blcptr->blacklist->lastwarning = CurrentTime;
- }
}
/* they have a blacklist entry for this client */
if (rb_dlink_list_length(&blcptr->client_p->preClient->dnsbl_queries) == 0 && blcptr->client_p->flags & FLAGS_SENTUSER && !EmptyString(blcptr->client_p->name))
{
char buf[USERLEN + 1];
- strlcpy(buf, blcptr->client_p->username, sizeof buf);
+ rb_strlcpy(buf, blcptr->client_p->username, sizeof buf);
register_local_user(blcptr->client_p, blcptr->client_p, buf);
}
- MyFree(blcptr);
+ rb_free(blcptr);
}
-/* XXX: no IPv6 implementation, not to concerned right now though. */
static void initiate_blacklist_dnsquery(struct Blacklist *blptr, struct Client *client_p)
{
- struct BlacklistClient *blcptr = MyMalloc(sizeof(struct BlacklistClient));
- char buf[IRCD_BUFSIZE];
- int ip[4];
+ struct BlacklistClient *blcptr = rb_malloc(sizeof(struct BlacklistClient));
+ char buf[IRCD_RES_HOSTLEN + 1];
+ uint8_t *ip;
blcptr->blacklist = blptr;
blcptr->client_p = client_p;
blcptr->dns_query.ptr = blcptr;
blcptr->dns_query.callback = blacklist_dns_callback;
- /* XXX: yes I know this is bad, I don't really care right now */
- sscanf(client_p->sockhost, "%d.%d.%d.%d", &ip[3], &ip[2], &ip[1], &ip[0]);
+ if ((client_p->localClient->ip.ss_family == AF_INET) && blptr->ipv4)
+ {
+ ip = (uint8_t *)&((struct sockaddr_in *)&client_p->localClient->ip)->sin_addr.s_addr;
+
+ /* becomes 2.0.0.127.torbl.ahbl.org or whatever */
+ rb_snprintf(buf, sizeof buf, "%d.%d.%d.%d.%s",
+ (unsigned int) ip[3],
+ (unsigned int) ip[2],
+ (unsigned int) ip[1],
+ (unsigned int) ip[0],
+ blptr->host);
+ }
+ /* IPv6 is supported now. --Elizabeth */
+ else if ((client_p->localClient->ip.ss_family == AF_INET6) && blptr->ipv6)
+ {
+ /* Breaks it into ip[0] = 0x00, ip[1] = 0x00... ip[16] = 0x01 for localhost
+ * I wish there was a uint4_t for C, this would make the below cleaner, but... */
+ ip = (uint8_t *)&((struct sockaddr_in6 *)&client_p->localClient->ip)->sin6_addr.s6_addr;
+ char *bufptr = buf;
+ int i;
+
+ /* The below will give us something like
+ * 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.foobl.invalid
+ */
+
+ /* Going backwards */
+ for (i = 15; i >= 0; i--)
+ {
+ /* Get upper and lower nibbles (yes this works fine on
+ * both big and little endian) */
+ uint8_t hi = (ip[i] >> 4) & 0x0F;
+ uint8_t lo = ip[i] & 0x0F;
+
+ /* One part... (why 5? rb_snprintf adds \0) */
+ rb_snprintf(bufptr, 5, "%1x.%1x.",
+ (unsigned int) lo, /* Remember, backwards */
+ (unsigned int) hi);
+
+ /* Lurch forward to next position */
+ bufptr += 4;
+ }
- /* becomes 2.0.0.127.torbl.ahbl.org or whatever */
- rb_snprintf(buf, IRCD_BUFSIZE, "%d.%d.%d.%d.%s", ip[0], ip[1], ip[2], ip[3], blptr->host);
+ /* Tack host on */
+ strcpy(bufptr, blptr->host);
+ }
+ /* This shouldn't happen... */
+ else
+ return;
gethost_byname_type(buf, &blcptr->dns_query, T_A);
}
/* public interfaces */
-struct Blacklist *new_blacklist(char *name, char *reject_reason)
+struct Blacklist *new_blacklist(char *name, char *reject_reason, int ipv4, int ipv6, rb_dlink_list *filters)
{
struct Blacklist *blptr;
blptr = find_blacklist(name);
if (blptr == NULL)
{
- blptr = MyMalloc(sizeof(struct Blacklist));
+ blptr = rb_malloc(sizeof(struct Blacklist));
rb_dlinkAddAlloc(blptr, &blacklist_list);
}
else
blptr->status &= ~CONF_ILLEGAL;
- strlcpy(blptr->host, name, HOSTLEN);
- strlcpy(blptr->reject_reason, reject_reason, IRCD_BUFSIZE);
+
+ rb_strlcpy(blptr->host, name, IRCD_RES_HOSTLEN + 1);
+ rb_strlcpy(blptr->reject_reason, reject_reason, IRCD_BUFSIZE);
+ blptr->ipv4 = ipv4;
+ blptr->ipv6 = ipv6;
+
+ rb_dlinkMoveList(filters, &blptr->filters);
+
blptr->lastwarning = 0;
return blptr;
void unref_blacklist(struct Blacklist *blptr)
{
+ rb_dlink_node *ptr, *next_ptr;
+
blptr->refcount--;
if (blptr->status & CONF_ILLEGAL && blptr->refcount <= 0)
{
+ RB_DLINK_FOREACH_SAFE(ptr, next_ptr, blptr->filters.head)
+ {
+ rb_free(ptr);
+ rb_dlinkDelete(ptr, &blptr->filters);
+ }
+
rb_dlinkFindDestroy(blptr, &blacklist_list);
- MyFree(blptr);
+ rb_free(blptr);
}
}
{
rb_dlink_node *nptr;
- /* We don't do IPv6 right now, sorry! */
- if (client_p->localClient->ip.ss_family == AF_INET6)
- return;
-
RB_DLINK_FOREACH(nptr, blacklist_list.head)
{
struct Blacklist *blptr = (struct Blacklist *) nptr->data;
rb_dlinkDelete(&blcptr->node, &client_p->preClient->dnsbl_queries);
unref_blacklist(blcptr->blacklist);
delete_resolver_queries(&blcptr->dns_query);
- MyFree(blcptr);
+ rb_free(blcptr);
}
}
blptr->status |= CONF_ILLEGAL;
else
{
- MyFree(ptr->data);
+ rb_free(ptr->data);
rb_dlinkDestroy(ptr, &blacklist_list);
}
}
projects / solanum.git / blobdiff