X-Git-Url: https://jfr.im/git/solanum.git/blobdiff_plain/6fb9f214497a613d04e08b23cce78c4476d12589..59cfd72e68e7b41c134eb066f1537abf7f57e024:/modules/m_sasl.c diff --git a/modules/m_sasl.c b/modules/m_sasl.c index 38c7baeb..e8217aa6 100644 --- a/modules/m_sasl.c +++ b/modules/m_sasl.c @@ -1,6 +1,7 @@ /* modules/m_sasl.c * Copyright (C) 2006 Michael Tharp * Copyright (C) 2006 charybdis development team + * Copyright (C) 2016 ChatLounge IRC Network Development Team * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are @@ -25,8 +26,6 @@ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE * POSSIBILITY OF SUCH DAMAGE. - * - * $Id: m_sasl.c 1409 2006-05-21 14:46:17Z jilles $ */ #include "stdinc.h" @@ -37,45 +36,104 @@ #include "msg.h" #include "modules.h" #include "numeric.h" +#include "reject.h" #include "s_serv.h" #include "s_stats.h" #include "string.h" #include "s_newconf.h" #include "s_conf.h" -static int m_authenticate(struct Client *, struct Client *, int, const char **); -static int me_sasl(struct Client *, struct Client *, int, const char **); +static const char sasl_desc[] = "Provides SASL authentication support"; + +static void m_authenticate(struct MsgBuf *, struct Client *, struct Client *, int, const char **); +static void me_sasl(struct MsgBuf *, struct Client *, struct Client *, int, const char **); +static void me_mechlist(struct MsgBuf *, struct Client *, struct Client *, int, const char **); static void abort_sasl(struct Client *); static void abort_sasl_exit(hook_data_client_exit *); -static void advertise_sasl(struct Client *); -static void advertise_sasl_exit(hook_data_client_exit *); +static void advertise_sasl_cap(bool); +static void advertise_sasl_new(struct Client *); +static void advertise_sasl_exit(void *); +static void advertise_sasl_config(void *); + +static unsigned int CLICAP_SASL = 0; +static char mechlist_buf[BUFSIZE]; +static bool sasl_agent_present = false; struct Message authenticate_msgtab = { - "AUTHENTICATE", 0, 0, 0, MFLG_SLOW, + "AUTHENTICATE", 0, 0, 0, 0, {{m_authenticate, 2}, {m_authenticate, 2}, mg_ignore, mg_ignore, mg_ignore, {m_authenticate, 2}} }; struct Message sasl_msgtab = { - "SASL", 0, 0, 0, MFLG_SLOW, + "SASL", 0, 0, 0, 0, {mg_ignore, mg_ignore, mg_ignore, mg_ignore, {me_sasl, 5}, mg_ignore} }; +struct Message mechlist_msgtab = { + "MECHLIST", 0, 0, 0, 0, + {mg_ignore, mg_ignore, mg_ignore, mg_ignore, {me_mechlist, 2}, mg_ignore} +}; mapi_clist_av1 sasl_clist[] = { - &authenticate_msgtab, &sasl_msgtab, NULL + &authenticate_msgtab, &sasl_msgtab, &mechlist_msgtab, NULL }; mapi_hfn_list_av1 sasl_hfnlist[] = { { "new_local_user", (hookfn) abort_sasl }, { "client_exit", (hookfn) abort_sasl_exit }, - { "new_remote_user", (hookfn) advertise_sasl }, - { "client_exit", (hookfn) advertise_sasl_exit }, + { "new_remote_user", (hookfn) advertise_sasl_new }, + { "after_client_exit", (hookfn) advertise_sasl_exit }, + { "conf_read_end", (hookfn) advertise_sasl_config }, { NULL, NULL } }; -DECLARE_MODULE_AV1(sasl, NULL, NULL, sasl_clist, NULL, sasl_hfnlist, "$Revision: 1409 $"); +static bool +sasl_visible(struct Client *ignored) +{ + struct Client *agent_p = NULL; + + if (ConfigFileEntry.sasl_service) + agent_p = find_named_client(ConfigFileEntry.sasl_service); + + return agent_p != NULL && IsService(agent_p); +} + +static const char * +sasl_data(struct Client *client_p) +{ + return *mechlist_buf != 0 ? mechlist_buf : NULL; +} + +static struct ClientCapability capdata_sasl = { + .visible = sasl_visible, + .data = sasl_data, + .flags = CLICAP_FLAGS_STICKY, +}; + +mapi_cap_list_av2 sasl_cap_list[] = { + { MAPI_CAP_CLIENT, "sasl", &capdata_sasl, &CLICAP_SASL }, + { 0, NULL, NULL, NULL }, +}; static int -m_authenticate(struct Client *client_p, struct Client *source_p, +_modinit(void) +{ + memset(mechlist_buf, 0, sizeof mechlist_buf); + sasl_agent_present = false; + + advertise_sasl_config(NULL); + return 0; +} + +static void +_moddeinit(void) +{ + advertise_sasl_cap(false); +} + +DECLARE_MODULE_AV2(sasl, _modinit, _moddeinit, sasl_clist, NULL, sasl_hfnlist, sasl_cap_list, NULL, sasl_desc); + +static void +m_authenticate(struct MsgBuf *msgbuf_p, struct Client *client_p, struct Client *source_p, int parc, const char *parv[]) { struct Client *agent_p = NULL; @@ -83,19 +141,31 @@ m_authenticate(struct Client *client_p, struct Client *source_p, /* They really should use CAP for their own sake. */ if(!IsCapable(source_p, CLICAP_SASL)) - return 0; + return; - if (strlen(client_p->id) == 3) + if(source_p->localClient->sasl_next_retry > rb_current_time()) + { + sendto_one(source_p, form_str(RPL_LOAD2HI), me.name, EmptyString(source_p->name) ? "*" : source_p->name, msgbuf_p->cmd); + return; + } + + if (strlen(client_p->id) == 3 || (source_p->preClient && !EmptyString(source_p->preClient->id))) { exit_client(client_p, client_p, client_p, "Mixing client and server protocol"); - return 0; + return; + } + + if (*parv[1] == ':' || strchr(parv[1], ' ')) + { + exit_client(client_p, client_p, client_p, "Malformed AUTHENTICATE"); + return; } saslserv_p = find_named_client(ConfigFileEntry.sasl_service); - if (saslserv_p == NULL || !IsService(saslserv_p)) + if(saslserv_p == NULL || !IsService(saslserv_p)) { sendto_one(source_p, form_str(ERR_SASLABORTED), me.name, EmptyString(source_p->name) ? "*" : source_p->name); - return 0; + return; } if(source_p->localClient->sasl_complete) @@ -107,13 +177,13 @@ m_authenticate(struct Client *client_p, struct Client *source_p, if(strlen(parv[1]) > 400) { sendto_one(source_p, form_str(ERR_SASLTOOLONG), me.name, EmptyString(source_p->name) ? "*" : source_p->name); - return 0; + return; } if(!*source_p->id) { /* Allocate a UID. */ - strcpy(source_p->id, generate_uid()); + rb_strlcpy(source_p->id, generate_uid(), sizeof(source_p->id)); add_to_id_hash(source_p->id, source_p); } @@ -122,11 +192,19 @@ m_authenticate(struct Client *client_p, struct Client *source_p, if(agent_p == NULL) { - sendto_one(saslserv_p, ":%s ENCAP %s SASL %s %s H %s %s", + if (!strcmp(parv[1], "*")) + { + sendto_one(source_p, form_str(ERR_SASLABORTED), me.name, EmptyString(source_p->name) ? "*" : source_p->name); + source_p->localClient->sasl_out = 0; + return; + } + + sendto_one(saslserv_p, ":%s ENCAP %s SASL %s %s H %s %s %c", me.id, saslserv_p->servptr->name, source_p->id, saslserv_p->id, - source_p->host, source_p->sockhost); + source_p->host, source_p->sockhost, + IsSSL(source_p) ? 'S' : 'P'); - if (!strcmp(parv[1], "EXTERNAL") && source_p->certfp != NULL) + if (source_p->certfp != NULL) sendto_one(saslserv_p, ":%s ENCAP %s SASL %s %s S %s %s", me.id, saslserv_p->servptr->name, source_p->id, saslserv_p->id, parv[1], source_p->certfp); @@ -138,64 +216,118 @@ m_authenticate(struct Client *client_p, struct Client *source_p, rb_strlcpy(source_p->localClient->sasl_agent, saslserv_p->id, IDLEN); } else + { + if (!strcmp(parv[1], "*")) + { + sendto_one(source_p, form_str(ERR_SASLABORTED), me.name, EmptyString(source_p->name) ? "*" : source_p->name); + sendto_one(agent_p, ":%s ENCAP %s SASL %s %s D A", me.id, agent_p->servptr->name, source_p->id, agent_p->id); + source_p->localClient->sasl_out = 0; + return; + } + sendto_one(agent_p, ":%s ENCAP %s SASL %s %s C %s", me.id, agent_p->servptr->name, source_p->id, agent_p->id, parv[1]); - source_p->localClient->sasl_out++; + } - return 0; + source_p->localClient->sasl_out++; } -static int -me_sasl(struct Client *client_p, struct Client *source_p, +static void +me_sasl(struct MsgBuf *msgbuf_p, struct Client *client_p, struct Client *source_p, int parc, const char *parv[]) { struct Client *target_p, *agent_p; + bool in_progress; /* Let propagate if not addressed to us, or if broadcast. * Only SASL agents can answer global requests. */ if(strncmp(parv[2], me.id, 3)) - return 0; + return; if((target_p = find_id(parv[2])) == NULL) - return 0; + return; if((agent_p = find_id(parv[1])) == NULL) - return 0; + return; if(source_p != agent_p->servptr) /* WTF?! */ - return 0; + return; /* We only accept messages from SASL agents; these must have umode +S * (so the server must be listed in a service{} block). */ if(!IsService(agent_p)) - return 0; + return; + + /* If SASL has been aborted, we only want to track authentication failures. */ + in_progress = target_p->localClient->sasl_out != 0; /* Reject if someone has already answered. */ if(*target_p->localClient->sasl_agent && strncmp(parv[1], target_p->localClient->sasl_agent, IDLEN)) - return 0; - else if(!*target_p->localClient->sasl_agent) + return; + else if(!*target_p->localClient->sasl_agent && in_progress) rb_strlcpy(target_p->localClient->sasl_agent, parv[1], IDLEN); if(*parv[3] == 'C') - sendto_one(target_p, "AUTHENTICATE %s", parv[4]); + { + if (in_progress) { + sendto_one(target_p, "AUTHENTICATE %s", parv[4]); + target_p->localClient->sasl_messages++; + } + } else if(*parv[3] == 'D') { if(*parv[4] == 'F') - sendto_one(target_p, form_str(ERR_SASLFAIL), me.name, EmptyString(target_p->name) ? "*" : target_p->name); - else if(*parv[4] == 'S') { - sendto_one(target_p, form_str(RPL_SASLSUCCESS), me.name, EmptyString(target_p->name) ? "*" : target_p->name); - target_p->localClient->sasl_complete = 1; - ServerStats.is_ssuc++; + { + if (in_progress) { + sendto_one(target_p, form_str(ERR_SASLFAIL), me.name, EmptyString(target_p->name) ? "*" : target_p->name); + } + /* Failures with zero messages are just "unknown mechanism" errors; don't count those. */ + if(target_p->localClient->sasl_messages > 0) + { + if(*target_p->name) + { + /* Allow 2 tries before rate-limiting as some clients try EXTERNAL + * then PLAIN right after it if the auth failed, causing the client to be + * rate-limited immediately and not being able to login with SASL. + */ + if (target_p->localClient->sasl_failures++ > 0) + target_p->localClient->sasl_next_retry = rb_current_time() + (1 << MIN(target_p->localClient->sasl_failures + 1, 8)); + } + else if(throttle_add((struct sockaddr*)&target_p->localClient->ip)) + { + exit_client(target_p, target_p, &me, "Too many failed authentication attempts"); + return; + } + } + } + else if(*parv[4] == 'S') + { + if (in_progress) { + sendto_one(target_p, form_str(RPL_SASLSUCCESS), me.name, EmptyString(target_p->name) ? "*" : target_p->name); + target_p->localClient->sasl_failures = 0; + target_p->localClient->sasl_complete = 1; + ServerStats.is_ssuc++; + } } *target_p->localClient->sasl_agent = '\0'; /* Blank the stored agent so someone else can answer */ + target_p->localClient->sasl_messages = 0; } else if(*parv[3] == 'M') - sendto_one(target_p, form_str(RPL_SASLMECHS), me.name, EmptyString(target_p->name) ? "*" : target_p->name, parv[4]); + { + if (in_progress) { + sendto_one(target_p, form_str(RPL_SASLMECHS), me.name, EmptyString(target_p->name) ? "*" : target_p->name, parv[4]); + } + } +} - return 0; +static void +me_mechlist(struct MsgBuf *msgbuf_p, struct Client *client_p, struct Client *source_p, + int parc, const char *parv[]) +{ + rb_strlcpy(mechlist_buf, parv[1], sizeof mechlist_buf); } /* If the client never finished authenticating but is @@ -236,7 +368,20 @@ abort_sasl_exit(hook_data_client_exit *data) } static void -advertise_sasl(struct Client *client_p) +advertise_sasl_cap(bool available) +{ + if (sasl_agent_present != available) { + if (available) { + sendto_local_clients_with_capability(CLICAP_CAP_NOTIFY, ":%s CAP * NEW :sasl", me.name); + } else { + sendto_local_clients_with_capability(CLICAP_CAP_NOTIFY, ":%s CAP * DEL :sasl", me.name); + } + sasl_agent_present = available; + } +} + +static void +advertise_sasl_new(struct Client *client_p) { if (!ConfigFileEntry.sasl_service) return; @@ -244,17 +389,22 @@ advertise_sasl(struct Client *client_p) if (irccmp(client_p->name, ConfigFileEntry.sasl_service)) return; - sendto_local_clients_with_capability(CLICAP_CAP_NOTIFY, ":%s CAP * NEW :sasl", me.name); + advertise_sasl_cap(IsService(client_p)); } static void -advertise_sasl_exit(hook_data_client_exit *data) +advertise_sasl_exit(void *ignored) { if (!ConfigFileEntry.sasl_service) return; - if (irccmp(data->target->name, ConfigFileEntry.sasl_service)) - return; + if (sasl_agent_present) { + advertise_sasl_cap(sasl_visible(NULL)); + } +} - sendto_local_clients_with_capability(CLICAP_CAP_NOTIFY, ":%s CAP * DEL :sasl", me.name); +static void +advertise_sasl_config(void *ignored) +{ + advertise_sasl_cap(sasl_visible(NULL)); }