X-Git-Url: https://jfr.im/git/solanum.git/blobdiff_plain/7b4d1de38d39b145376678a22d6ff2529af9ac3b..ea41b24fd4807e3565bf5f8f293e2efc4c20b62d:/authd/provider.c

diff --git a/authd/provider.c b/authd/provider.c
index b512b4a0..2d196732 100644
--- a/authd/provider.c
+++ b/authd/provider.c
@@ -19,7 +19,7 @@
  */
 
 /* The basic design here is to have "authentication providers" that do things
- * like query ident and blacklists and even open proxies.
+ * like query ident and DNSBLs and even open proxies.
  *
  * Providers are registered in the auth_providers linked list. It is planned to
  * use a bitmap to store provider ID's later.
@@ -46,24 +46,115 @@
  * --Elizafox, 9 March 2016
  */
 
+#include "stdinc.h"
 #include "rb_dictionary.h"
+#include "rb_lib.h"
 #include "authd.h"
 #include "provider.h"
 #include "notice.h"
 
-rb_dlink_list auth_providers;
+static EVH provider_timeout_event;
 
-/* Clients waiting */
 rb_dictionary *auth_clients;
+rb_dlink_list auth_providers;
+
+static rb_dlink_list free_pids;
+static uint32_t allocated_pids;
+static struct ev_entry *timeout_ev;
+
+/* Set a provider's raw status */
+static inline void
+set_provider_status(struct auth_client *auth, uint32_t provider, provider_status_t status)
+{
+	auth->data[provider].status = status;
+}
+
+/* Set the provider as running */
+static inline void
+set_provider_running(struct auth_client *auth, uint32_t provider)
+{
+	auth->providers_active++;
+	set_provider_status(auth, provider, PROVIDER_STATUS_RUNNING);
+}
+
+/* Provider is no longer operating on this auth client */
+static inline void
+set_provider_done(struct auth_client *auth, uint32_t provider)
+{
+	set_provider_status(auth, provider, PROVIDER_STATUS_DONE);
+	auth->providers_active--;
+}
+
+/* Initalise all providers */
+void
+init_providers(void)
+{
+	auth_clients = rb_dictionary_create("pending auth clients", rb_uint32cmp);
+	timeout_ev = rb_event_addish("provider_timeout_event", provider_timeout_event, NULL, 1);
+
+	/* FIXME must be started before rdns/ident to receive completion notification from them */
+	load_provider(&dnsbl_provider);
+	load_provider(&opm_provider);
+
+	/* FIXME must be started after dnsbl/opm in case of early completion notifications */
+	load_provider(&rdns_provider);
+	load_provider(&ident_provider);
+}
+
+/* Terminate all providers */
+void
+destroy_providers(void)
+{
+	rb_dlink_node *ptr, *nptr;
+	rb_dictionary_iter iter;
+	struct auth_client *auth;
+
+	/* Cancel outstanding connections */
+	RB_DICTIONARY_FOREACH(auth, &iter, auth_clients)
+	{
+		auth_client_ref(auth);
+
+		/* TBD - is this the right thing? */
+		reject_client(auth, UINT32_MAX, "destroy",
+			"Authentication system is down... try reconnecting in a few seconds");
+
+		auth_client_unref(auth);
+	}
+
+	RB_DLINK_FOREACH_SAFE(ptr, nptr, auth_providers.head)
+	{
+		struct auth_provider *provider = ptr->data;
+
+		if(provider->destroy)
+			provider->destroy();
+
+		rb_dlinkDelete(ptr, &auth_providers);
+	}
+
+	rb_dictionary_destroy(auth_clients, NULL, NULL);
+	rb_event_delete(timeout_ev);
+}
 
 /* Load a provider */
 void
 load_provider(struct auth_provider *provider)
 {
-	if(rb_dlink_list_length(&auth_providers) >= MAX_PROVIDERS)
+	/* Assign a PID */
+	if(rb_dlink_list_length(&free_pids) > 0)
 	{
-		warn_opers(L_CRIT, "Exceeded maximum level of authd providers (%d max)", MAX_PROVIDERS);
-		return;
+		/* use the free list */
+		provider->id = RB_POINTER_TO_UINT(free_pids.head->data);
+		rb_dlinkDestroy(free_pids.head, &free_pids);
+	}
+	else
+	{
+		if(allocated_pids == MAX_PROVIDERS || allocated_pids == UINT32_MAX)
+		{
+			warn_opers(L_WARN, "Cannot load additional provider, max reached!");
+			return;
+		}
+
+		provider->id = allocated_pids++;
 	}
 
 	if(provider->opt_handlers != NULL)
@@ -75,9 +166,11 @@ load_provider(struct auth_provider *provider)
 	}
 
 	if(provider->stats_handler.letter != '\0')
-		authd_stat_handlers[provider->stats_handler.letter] = provider->stats_handler.handler;
+		authd_stat_handlers[(unsigned char)provider->stats_handler.letter] = provider->stats_handler.handler;
+
+	if(provider->init != NULL)
+		provider->init();
 
-	provider->init();
 	rb_dlinkAdd(provider, &provider->node, &auth_providers);
 }
 
@@ -93,247 +186,248 @@ unload_provider(struct auth_provider *provider)
 	}
 
 	if(provider->stats_handler.letter != '\0')
-		authd_stat_handlers[provider->stats_handler.letter] = NULL;
+		authd_stat_handlers[(unsigned char)provider->stats_handler.letter] = NULL;
+
+	if(provider->destroy != NULL)
+		provider->destroy();
 
-	provider->destroy();
 	rb_dlinkDelete(&provider->node, &auth_providers);
-}
 
-/* Initalise all providers */
-void
-init_providers(void)
-{
-	auth_clients = rb_dictionary_create("pending auth clients", rb_uint32cmp);
-	load_provider(&rdns_provider);
-	load_provider(&ident_provider);
-	load_provider(&blacklist_provider);
+	/* Reclaim ID */
+	rb_dlinkAddAlloc(RB_UINT_TO_POINTER(provider->id), &free_pids);
 }
 
-/* Terminate all providers */
 void
-destroy_providers(void)
+auth_client_free(struct auth_client *auth)
 {
-	rb_dlink_node *ptr;
-	rb_dictionary_iter iter;
-	struct auth_client *auth;
-	struct auth_provider *provider;
-
-	/* Cancel outstanding connections */
-	RB_DICTIONARY_FOREACH(auth, &iter, auth_clients)
-	{
-		/* TBD - is this the right thing? */
-		reject_client(auth, -1, "destroy", "Authentication system is down... try reconnecting in a few seconds");
-	}
-
-	RB_DLINK_FOREACH(ptr, auth_providers.head)
-	{
-		provider = ptr->data;
-
-		if(provider->destroy)
-			provider->destroy();
-	}
+	rb_dictionary_delete(auth_clients, RB_UINT_TO_POINTER(auth->cid));
+	rb_free(auth->data);
+	rb_free(auth);
 }
 
-/* Cancel outstanding providers for a client */
+/* Cancel outstanding providers for a client (if any). */
 void
 cancel_providers(struct auth_client *auth)
 {
-	rb_dlink_node *ptr;
-	struct auth_provider *provider;
+	if(auth->providers_cancelled)
+		return;
 
-	RB_DLINK_FOREACH(ptr, auth_providers.head)
+	auth->providers_cancelled = true;
+
+	if(auth->providers_active > 0)
 	{
-		provider = ptr->data;
+		rb_dlink_node *ptr;
 
-		if(provider->cancel && is_provider_on(auth, provider->id))
-			/* Cancel if required */
-			provider->cancel(auth);
-	}
+		RB_DLINK_FOREACH(ptr, auth_providers.head)
+		{
+			struct auth_provider *provider = ptr->data;
 
-	rb_dictionary_delete(auth_clients, RB_UINT_TO_POINTER(auth->cid));
-	rb_free(auth);
+			if(provider->cancel != NULL && is_provider_running(auth, provider->id))
+				/* Cancel if required */
+				provider->cancel(auth);
+		}
+	}
 }
 
-/* Provider is done - WARNING: do not use auth instance after calling! */
+/* Provider is done */
 void
-provider_done(struct auth_client *auth, provider_t id)
+provider_done(struct auth_client *auth, uint32_t id)
 {
 	rb_dlink_node *ptr;
-	struct auth_provider *provider;
 
-	set_provider_off(auth, id);
+	lrb_assert(is_provider_running(auth, id));
+	lrb_assert(id != UINT32_MAX);
+	lrb_assert(id < allocated_pids);
+
 	set_provider_done(auth, id);
 
-	if(!auth->providers)
+	if(auth->providers_active == 0 && !auth->providers_starting)
 	{
-		if(!auth->providers_starting)
-			/* Only do this when there are no providers left */
-			accept_client(auth, -1);
+		/* All done */
+		accept_client(auth);
 		return;
 	}
 
 	RB_DLINK_FOREACH(ptr, auth_providers.head)
 	{
-		provider = ptr->data;
+		struct auth_provider *provider = ptr->data;
 
-		if(provider->completed && is_provider_on(auth, provider->id))
+		if(provider->completed != NULL && is_provider_running(auth, provider->id))
 			/* Notify pending clients who asked for it */
 			provider->completed(auth, id);
 	}
 }
 
-/* Reject a client - WARNING: do not use auth instance after calling! */
+/* Reject a client and cancel any outstanding providers */
 void
-reject_client(struct auth_client *auth, provider_t id, const char *data, const char *reason)
+reject_client(struct auth_client *auth, uint32_t id, const char *data, const char *fmt, ...)
 {
-	char reject;
+	char buf[BUFSIZE];
+	va_list args;
 
-	switch(id)
-	{
-	case PROVIDER_RDNS:
-		reject = 'D';
-		break;
-	case PROVIDER_IDENT:
-		reject = 'I';
-		break;
-	case PROVIDER_BLACKLIST:
-		reject = 'B';
-		break;
-	default:
-		reject = 'N';
-		break;
-	}
-
-	if(data == NULL)
-		data = "*";
+	va_start(args, fmt);
+	vsnprintf(buf, sizeof(buf), fmt, args);
+	va_end(args);
 
 	/* We send back username and hostname in case ircd wants to overrule our decision.
 	 * In the future this may not be the case.
 	 * --Elizafox
 	 */
-	rb_helper_write(authd_helper, "R %x %c %s %s %s :%s", auth->cid, reject, auth->username, auth->hostname, data, reason);
+	rb_helper_write(authd_helper, "R %x %c %s %s %s :%s",
+		auth->cid, id != UINT32_MAX ? auth->data[id].provider->letter : '*',
+		auth->username, auth->hostname,
+		data == NULL ? "*" : data, buf);
+
+	if(id != UINT32_MAX)
+		set_provider_done(auth, id);
 
-	set_provider_off(auth, id);
 	cancel_providers(auth);
 }
 
-/* Accept a client, cancel outstanding providers if any - WARNING: do nto use auth instance after calling! */
+/* Accept a client and cancel outstanding providers if any */
 void
-accept_client(struct auth_client *auth, provider_t id)
+accept_client(struct auth_client *auth)
 {
-	uint32_t cid = auth->cid;
-
 	rb_helper_write(authd_helper, "A %x %s %s", auth->cid, auth->username, auth->hostname);
-
-	set_provider_off(auth, id);
 	cancel_providers(auth);
 }
 
 /* Begin authenticating user */
 static void
-start_auth(const char *cid, const char *l_ip, const char *l_port, const char *c_ip, const char *c_port)
+start_auth(const char *cid, const char *l_ip, const char *l_port, const char *c_ip, const char *c_port, const char *protocol)
 {
-	struct auth_provider *provider;
-	struct auth_client *auth = rb_malloc(sizeof(struct auth_client));
-	long lcid = strtol(cid, NULL, 16);
+	struct auth_client *auth;
+	unsigned long long lcid = strtoull(cid, NULL, 16);
 	rb_dlink_node *ptr;
 
-	if(lcid >= UINT32_MAX)
+	if(lcid == 0 || lcid > UINT32_MAX)
 		return;
 
+	auth = rb_malloc(sizeof(struct auth_client));
+	auth_client_ref(auth);
 	auth->cid = (uint32_t)lcid;
 
 	if(rb_dictionary_find(auth_clients, RB_UINT_TO_POINTER(auth->cid)) == NULL)
 		rb_dictionary_add(auth_clients, RB_UINT_TO_POINTER(auth->cid), auth);
 	else
 	{
-		warn_opers(L_CRIT, "BUG: duplicate client added via start_auth: %x", auth->cid);
-		rb_free(auth);
-		return;
+		warn_opers(L_CRIT, "provider: duplicate client added via start_auth: %s", cid);
+		exit(EX_PROVIDER_ERROR);
 	}
 
+	auth->protocol = strtoull(protocol, NULL, 16);
+
 	rb_strlcpy(auth->l_ip, l_ip, sizeof(auth->l_ip));
 	auth->l_port = (uint16_t)atoi(l_port);	/* should be safe */
-	(void) rb_inet_pton_sock(l_ip, (struct sockaddr *)&auth->l_addr);
+	(void) rb_inet_pton_sock(l_ip, &auth->l_addr);
+	SET_SS_PORT(&auth->l_addr, htons(auth->l_port));
 
 	rb_strlcpy(auth->c_ip, c_ip, sizeof(auth->c_ip));
 	auth->c_port = (uint16_t)atoi(c_port);
-	(void) rb_inet_pton_sock(c_ip, (struct sockaddr *)&auth->c_addr);
+	(void) rb_inet_pton_sock(c_ip, &auth->c_addr);
+	SET_SS_PORT(&auth->c_addr, htons(auth->c_port));
 
-#ifdef RB_IPV6
-	if(GET_SS_FAMILY(&auth->l_addr) == AF_INET6)
-		((struct sockaddr_in6 *)&auth->l_addr)->sin6_port = htons(auth->l_port);
-	else
-#endif
-		((struct sockaddr_in *)&auth->l_addr)->sin_port = htons(auth->l_port);
-
-#ifdef RB_IPV6
-	if(GET_SS_FAMILY(&auth->c_addr) == AF_INET6)
-		((struct sockaddr_in6 *)&auth->c_addr)->sin6_port = htons(auth->c_port);
-	else
-#endif
-		((struct sockaddr_in *)&auth->c_addr)->sin_port = htons(auth->c_port);
+	rb_strlcpy(auth->hostname, "*", sizeof(auth->hostname));
+	rb_strlcpy(auth->username, "*", sizeof(auth->username));
 
-	memset(auth->data, 0, sizeof(auth->data));
+	auth->data = rb_malloc(allocated_pids * sizeof(struct auth_client_data));
 
 	auth->providers_starting = true;
 	RB_DLINK_FOREACH(ptr, auth_providers.head)
 	{
-		provider = ptr->data;
+		struct auth_provider *provider = ptr->data;
+
+		auth->data[provider->id].provider = provider;
 
 		lrb_assert(provider->start != NULL);
 
 		/* Execute providers */
+		set_provider_running(auth, provider->id);
 		if(!provider->start(auth))
-		{
 			/* Rejected immediately */
-			cancel_providers(auth);
-			return;
-		}
+			goto done;
+
+		if(auth->providers_cancelled)
+			break;
 	}
 	auth->providers_starting = false;
 
 	/* If no providers are running, accept the client */
-	if(!auth->providers)
-		accept_client(auth, -1);
+	if(auth->providers_active == 0)
+		accept_client(auth);
+
+done:
+	auth_client_unref(auth);
 }
 
 /* Callback for the initiation */
 void
 handle_new_connection(int parc, char *parv[])
 {
-	if(parc < 6)
-	{
-		warn_opers(L_CRIT, "BUG: received too few params for new connection (6 expected, got %d)", parc);
-		return;
+	if (parc < 6) {
+		warn_opers(L_CRIT, "provider: received too few params for new connection (6 expected, got %d)", parc);
+		exit(EX_PROVIDER_ERROR);
 	}
 
-	start_auth(parv[1], parv[2], parv[3], parv[4], parv[5]);
+	start_auth(parv[1], parv[2], parv[3], parv[4], parv[5], parc > 6 ? parv[6] : "0");
 }
 
 void
 handle_cancel_connection(int parc, char *parv[])
 {
 	struct auth_client *auth;
-	long lcid;
+	unsigned long long lcid;
 
 	if(parc < 2)
 	{
-		warn_opers(L_CRIT, "BUG: received too few params for new connection (2 expected, got %d)", parc);
-		return;
+		warn_opers(L_CRIT, "provider: received too few params for new connection (2 expected, got %d)", parc);
+		exit(EX_PROVIDER_ERROR);
 	}
 
-	if((lcid = strtol(parv[1], NULL, 16)) > UINT32_MAX)
+	lcid = strtoull(parv[1], NULL, 16);
+	if(lcid == 0 || lcid > UINT32_MAX)
 	{
-		warn_opers(L_CRIT, "BUG: got a request to cancel a connection that can't exist: %lx", lcid);
-		return;
+		warn_opers(L_CRIT, "provider: got a request to cancel a connection that can't exist: %s", parv[1]);
+		exit(EX_PROVIDER_ERROR);
 	}
 
 	if((auth = rb_dictionary_retrieve(auth_clients, RB_UINT_TO_POINTER((uint32_t)lcid))) == NULL)
 	{
-		warn_opers(L_CRIT, "BUG: tried to cancel nonexistent connection %lx", lcid);
+		/* This could happen as a race if we've accepted/rejected but they cancel, so don't die here.
+		 * --Elizafox */
 		return;
 	}
 
+	auth_client_ref(auth);
 	cancel_providers(auth);
+	auth_client_unref(auth);
+}
+
+static void
+provider_timeout_event(void *notused __unused)
+{
+	struct auth_client *auth;
+	rb_dictionary_iter iter;
+	const time_t curtime = rb_current_time();
+
+	RB_DICTIONARY_FOREACH(auth, &iter, auth_clients)
+	{
+		rb_dlink_node *ptr;
+
+		auth_client_ref(auth);
+
+		RB_DLINK_FOREACH(ptr, auth_providers.head)
+		{
+			struct auth_provider *provider = ptr->data;
+			const time_t timeout = get_provider_timeout(auth, provider->id);
+
+			if(is_provider_running(auth, provider->id) && provider->timeout != NULL &&
+				timeout > 0 && timeout < curtime)
+			{
+				provider->timeout(auth);
+			}
+		}
+
+		auth_client_unref(auth);
+	}
 }