X-Git-Url: https://jfr.im/git/solanum.git/blobdiff_plain/b74739c247f516dcbdc3f96b815df1f655a7a6b7..ea41b24fd4807e3565bf5f8f293e2efc4c20b62d:/authd/provider.c diff --git a/authd/provider.c b/authd/provider.c index 51ee9ee0..2d196732 100644 --- a/authd/provider.c +++ b/authd/provider.c @@ -18,16 +18,17 @@ * POSSIBILITY OF SUCH DAMAGE. */ -/* So the basic design here is to have "authentication providers" that do - * things like query ident and blacklists and even open proxies. +/* The basic design here is to have "authentication providers" that do things + * like query ident and DNSBLs and even open proxies. * - * Providers are registered statically in the struct auth_providers array. You will - * probably want to add an item to the provider_t enum also. + * Providers are registered in the auth_providers linked list. It is planned to + * use a bitmap to store provider ID's later. * - * Providers can either return failure immediately, immediate acceptance, or - * do work in the background (calling set_provider to signal this). + * Providers can either return failure immediately, immediate acceptance, or do + * work in the background (calling set_provider to signal this). * - * It is up to providers to keep their own state on clients if they need to. + * Provider-specific data for each client can be kept in an index of the data + * struct member (using the provider's ID). * * All providers must implement at a minimum a perform_provider function. You * don't have to implement the others if you don't need them. @@ -39,198 +40,394 @@ * should call provider_done. Do NOT call this if you have accepted or rejected * the client. * + * Eventually, stuff like *:line handling will be moved here, but that means we + * have to talk to bandb directly first. + * * --Elizafox, 9 March 2016 */ +#include "stdinc.h" +#include "rb_dictionary.h" +#include "rb_lib.h" #include "authd.h" #include "provider.h" +#include "notice.h" + +static EVH provider_timeout_event; +rb_dictionary *auth_clients; rb_dlink_list auth_providers; -/* Clients waiting */ -struct auth_client auth_clients[MAX_CLIENTS]; +static rb_dlink_list free_pids; +static uint32_t allocated_pids; +static struct ev_entry *timeout_ev; -/* Load a provider */ -void load_provider(struct auth_provider *provider) +/* Set a provider's raw status */ +static inline void +set_provider_status(struct auth_client *auth, uint32_t provider, provider_status_t status) { - provider->init(); - rb_dlinkAdd(provider, &provider->node, &auth_providers); + auth->data[provider].status = status; } -void unload_provider(struct auth_provider *provider) +/* Set the provider as running */ +static inline void +set_provider_running(struct auth_client *auth, uint32_t provider) { - provider->destroy(); - rb_dlinkDelete(&provider->node, &auth_providers); + auth->providers_active++; + set_provider_status(auth, provider, PROVIDER_STATUS_RUNNING); +} + +/* Provider is no longer operating on this auth client */ +static inline void +set_provider_done(struct auth_client *auth, uint32_t provider) +{ + set_provider_status(auth, provider, PROVIDER_STATUS_DONE); + auth->providers_active--; } /* Initalise all providers */ -void init_providers(void) +void +init_providers(void) { + auth_clients = rb_dictionary_create("pending auth clients", rb_uint32cmp); + timeout_ev = rb_event_addish("provider_timeout_event", provider_timeout_event, NULL, 1); + + /* FIXME must be started before rdns/ident to receive completion notification from them */ + load_provider(&dnsbl_provider); + load_provider(&opm_provider); + + /* FIXME must be started after dnsbl/opm in case of early completion notifications */ load_provider(&rdns_provider); + load_provider(&ident_provider); } /* Terminate all providers */ -void destroy_providers(void) +void +destroy_providers(void) { - rb_dlink_node *ptr; - struct auth_provider *provider; + rb_dlink_node *ptr, *nptr; + rb_dictionary_iter iter; + struct auth_client *auth; /* Cancel outstanding connections */ - for (size_t i = 0; i < MAX_CLIENTS; i++) + RB_DICTIONARY_FOREACH(auth, &iter, auth_clients) { - if(auth_clients[i].cid) - { - /* TBD - is this the right thing? - * (NOTE - this error message is designed for morons) */ - reject_client(&auth_clients[i], 0, - "IRC server reloading... try reconnecting in a few seconds"); - } + auth_client_ref(auth); + + /* TBD - is this the right thing? */ + reject_client(auth, UINT32_MAX, "destroy", + "Authentication system is down... try reconnecting in a few seconds"); + + auth_client_unref(auth); } - RB_DLINK_FOREACH(ptr, auth_providers.head) + RB_DLINK_FOREACH_SAFE(ptr, nptr, auth_providers.head) { - provider = ptr->data; + struct auth_provider *provider = ptr->data; if(provider->destroy) provider->destroy(); + + rb_dlinkDelete(ptr, &auth_providers); } + + rb_dictionary_destroy(auth_clients, NULL, NULL); + rb_event_delete(timeout_ev); } -/* Cancel outstanding providers for a client */ -void cancel_providers(struct auth_client *auth) +/* Load a provider */ +void +load_provider(struct auth_provider *provider) { - rb_dlink_node *ptr; - struct auth_provider *provider; + /* Assign a PID */ + if(rb_dlink_list_length(&free_pids) > 0) + { + /* use the free list */ + provider->id = RB_POINTER_TO_UINT(free_pids.head->data); + rb_dlinkDestroy(free_pids.head, &free_pids); + } + else + { + if(allocated_pids == MAX_PROVIDERS || allocated_pids == UINT32_MAX) + { + warn_opers(L_WARN, "Cannot load additional provider, max reached!"); + return; + } - RB_DLINK_FOREACH(ptr, auth_providers.head) + provider->id = allocated_pids++; + } + + if(provider->opt_handlers != NULL) { - provider = ptr->data; + struct auth_opts_handler *handler; - if(provider->cancel && is_provider(auth, provider->id)) - /* Cancel if required */ - provider->cancel(auth); + for(handler = provider->opt_handlers; handler->option != NULL; handler++) + rb_dictionary_add(authd_option_handlers, handler->option, handler); } -} -/* Provider is done */ -void provider_done(struct auth_client *auth, provider_t id) -{ - rb_dlink_node *ptr; - struct auth_provider *provider; + if(provider->stats_handler.letter != '\0') + authd_stat_handlers[(unsigned char)provider->stats_handler.letter] = provider->stats_handler.handler; - unset_provider(auth, id); + if(provider->init != NULL) + provider->init(); - if(!auth->providers) - { - /* No more providers, done */ - accept_client(auth, 0); - return; - } + rb_dlinkAdd(provider, &provider->node, &auth_providers); +} - RB_DLINK_FOREACH(ptr, auth_providers.head) +void +unload_provider(struct auth_provider *provider) +{ + if(provider->opt_handlers != NULL) { - provider = ptr->data; + struct auth_opts_handler *handler; - if(provider->completed && is_provider(auth, provider->id)) - /* Notify pending clients who asked for it */ - provider->completed(auth, id); + for(handler = provider->opt_handlers; handler->option != NULL; handler++) + rb_dictionary_delete(authd_option_handlers, handler->option); } + + if(provider->stats_handler.letter != '\0') + authd_stat_handlers[(unsigned char)provider->stats_handler.letter] = NULL; + + if(provider->destroy != NULL) + provider->destroy(); + + rb_dlinkDelete(&provider->node, &auth_providers); + + /* Reclaim ID */ + rb_dlinkAddAlloc(RB_UINT_TO_POINTER(provider->id), &free_pids); +} + +void +auth_client_free(struct auth_client *auth) +{ + rb_dictionary_delete(auth_clients, RB_UINT_TO_POINTER(auth->cid)); + rb_free(auth->data); + rb_free(auth); } -/* Reject a client, cancel outstanding providers if any */ -void reject_client(struct auth_client *auth, provider_t id, const char *reason) +/* Cancel outstanding providers for a client (if any). */ +void +cancel_providers(struct auth_client *auth) { - uint16_t cid = auth->cid; + if(auth->providers_cancelled) + return; - rb_helper_write(authd_helper, "R %x :%s", auth->cid, reason); + auth->providers_cancelled = true; - unset_provider(auth, id); + if(auth->providers_active > 0) + { + rb_dlink_node *ptr; - if(auth->providers) - cancel_providers(auth); + RB_DLINK_FOREACH(ptr, auth_providers.head) + { + struct auth_provider *provider = ptr->data; - memset(&auth_clients[cid], 0, sizeof(struct auth_client)); + if(provider->cancel != NULL && is_provider_running(auth, provider->id)) + /* Cancel if required */ + provider->cancel(auth); + } + } } -/* Accept a client, cancel outstanding providers if any */ -void accept_client(struct auth_client *auth, provider_t id) +/* Provider is done */ +void +provider_done(struct auth_client *auth, uint32_t id) { - uint16_t cid = auth->cid; + rb_dlink_node *ptr; - rb_helper_write(authd_helper, "A %x %s %s", auth->cid, auth->username, auth->hostname); + lrb_assert(is_provider_running(auth, id)); + lrb_assert(id != UINT32_MAX); + lrb_assert(id < allocated_pids); + + set_provider_done(auth, id); - unset_provider(auth, id); + if(auth->providers_active == 0 && !auth->providers_starting) + { + /* All done */ + accept_client(auth); + return; + } - if(auth->providers) - cancel_providers(auth); + RB_DLINK_FOREACH(ptr, auth_providers.head) + { + struct auth_provider *provider = ptr->data; - memset(&auth_clients[cid], 0, sizeof(struct auth_client)); + if(provider->completed != NULL && is_provider_running(auth, provider->id)) + /* Notify pending clients who asked for it */ + provider->completed(auth, id); + } } -/* Send a notice to a client */ -void notice_client(struct auth_client *auth, const char *notice) +/* Reject a client and cancel any outstanding providers */ +void +reject_client(struct auth_client *auth, uint32_t id, const char *data, const char *fmt, ...) { - rb_helper_write(authd_helper, "N %x :%s", auth->cid, notice); + char buf[BUFSIZE]; + va_list args; + + va_start(args, fmt); + vsnprintf(buf, sizeof(buf), fmt, args); + va_end(args); + + /* We send back username and hostname in case ircd wants to overrule our decision. + * In the future this may not be the case. + * --Elizafox + */ + rb_helper_write(authd_helper, "R %x %c %s %s %s :%s", + auth->cid, id != UINT32_MAX ? auth->data[id].provider->letter : '*', + auth->username, auth->hostname, + data == NULL ? "*" : data, buf); + + if(id != UINT32_MAX) + set_provider_done(auth, id); + + cancel_providers(auth); +} + +/* Accept a client and cancel outstanding providers if any */ +void +accept_client(struct auth_client *auth) +{ + rb_helper_write(authd_helper, "A %x %s %s", auth->cid, auth->username, auth->hostname); + cancel_providers(auth); } /* Begin authenticating user */ -static void start_auth(const char *cid, const char *l_ip, const char *l_port, const char *c_ip, const char *c_port) +static void +start_auth(const char *cid, const char *l_ip, const char *l_port, const char *c_ip, const char *c_port, const char *protocol) { - rb_dlink_node *ptr; - struct auth_provider *provider; struct auth_client *auth; - long lcid = strtol(cid, NULL, 16); - - if(lcid >= MAX_CLIENTS) - return; + unsigned long long lcid = strtoull(cid, NULL, 16); + rb_dlink_node *ptr; - auth = &auth_clients[lcid]; - if(auth->cid != 0) - /* Shouldn't get here */ + if(lcid == 0 || lcid > UINT32_MAX) return; - auth->cid = (uint16_t)lcid; + auth = rb_malloc(sizeof(struct auth_client)); + auth_client_ref(auth); + auth->cid = (uint32_t)lcid; - (void)rb_inet_pton_sock(l_ip, (struct sockaddr *)&auth->l_addr); -#ifdef RB_IPV6 - if(GET_SS_FAMILY(&auth->l_addr) == AF_INET6) - ((struct sockaddr_in6 *)&auth->l_addr)->sin6_port = htons(atoi(l_ip)); + if(rb_dictionary_find(auth_clients, RB_UINT_TO_POINTER(auth->cid)) == NULL) + rb_dictionary_add(auth_clients, RB_UINT_TO_POINTER(auth->cid), auth); else -#endif - ((struct sockaddr_in *)&auth->l_addr)->sin_port = htons(atoi(l_ip)); + { + warn_opers(L_CRIT, "provider: duplicate client added via start_auth: %s", cid); + exit(EX_PROVIDER_ERROR); + } - (void)rb_inet_pton_sock(c_ip, (struct sockaddr *)&auth->c_addr); -#ifdef RB_IPV6 - if(GET_SS_FAMILY(&auth->c_addr) == AF_INET6) - ((struct sockaddr_in6 *)&auth->c_addr)->sin6_port = htons(atoi(c_ip)); - else -#endif - ((struct sockaddr_in *)&auth->c_addr)->sin_port = htons(atoi(c_ip)); + auth->protocol = strtoull(protocol, NULL, 16); + + rb_strlcpy(auth->l_ip, l_ip, sizeof(auth->l_ip)); + auth->l_port = (uint16_t)atoi(l_port); /* should be safe */ + (void) rb_inet_pton_sock(l_ip, &auth->l_addr); + SET_SS_PORT(&auth->l_addr, htons(auth->l_port)); + rb_strlcpy(auth->c_ip, c_ip, sizeof(auth->c_ip)); + auth->c_port = (uint16_t)atoi(c_port); + (void) rb_inet_pton_sock(c_ip, &auth->c_addr); + SET_SS_PORT(&auth->c_addr, htons(auth->c_port)); + rb_strlcpy(auth->hostname, "*", sizeof(auth->hostname)); + rb_strlcpy(auth->username, "*", sizeof(auth->username)); + + auth->data = rb_malloc(allocated_pids * sizeof(struct auth_client_data)); + + auth->providers_starting = true; RB_DLINK_FOREACH(ptr, auth_providers.head) { - provider = ptr->data; + struct auth_provider *provider = ptr->data; + + auth->data[provider->id].provider = provider; + + lrb_assert(provider->start != NULL); /* Execute providers */ + set_provider_running(auth, provider->id); if(!provider->start(auth)) - { /* Rejected immediately */ - cancel_providers(auth); - return; - } + goto done; + + if(auth->providers_cancelled) + break; } + auth->providers_starting = false; /* If no providers are running, accept the client */ - if(!auth->providers) - accept_client(auth, 0); + if(auth->providers_active == 0) + accept_client(auth); + +done: + auth_client_unref(auth); } /* Callback for the initiation */ -void handle_new_connection(int parc, char *parv[]) +void +handle_new_connection(int parc, char *parv[]) +{ + if (parc < 6) { + warn_opers(L_CRIT, "provider: received too few params for new connection (6 expected, got %d)", parc); + exit(EX_PROVIDER_ERROR); + } + + start_auth(parv[1], parv[2], parv[3], parv[4], parv[5], parc > 6 ? parv[6] : "0"); +} + +void +handle_cancel_connection(int parc, char *parv[]) { - if(parc < 7) + struct auth_client *auth; + unsigned long long lcid; + + if(parc < 2) + { + warn_opers(L_CRIT, "provider: received too few params for new connection (2 expected, got %d)", parc); + exit(EX_PROVIDER_ERROR); + } + + lcid = strtoull(parv[1], NULL, 16); + if(lcid == 0 || lcid > UINT32_MAX) + { + warn_opers(L_CRIT, "provider: got a request to cancel a connection that can't exist: %s", parv[1]); + exit(EX_PROVIDER_ERROR); + } + + if((auth = rb_dictionary_retrieve(auth_clients, RB_UINT_TO_POINTER((uint32_t)lcid))) == NULL) + { + /* This could happen as a race if we've accepted/rejected but they cancel, so don't die here. + * --Elizafox */ return; + } + + auth_client_ref(auth); + cancel_providers(auth); + auth_client_unref(auth); +} + +static void +provider_timeout_event(void *notused __unused) +{ + struct auth_client *auth; + rb_dictionary_iter iter; + const time_t curtime = rb_current_time(); - start_auth(parv[1], parv[2], parv[3], parv[4], parv[5]); + RB_DICTIONARY_FOREACH(auth, &iter, auth_clients) + { + rb_dlink_node *ptr; + + auth_client_ref(auth); + + RB_DLINK_FOREACH(ptr, auth_providers.head) + { + struct auth_provider *provider = ptr->data; + const time_t timeout = get_provider_timeout(auth, provider->id); + + if(is_provider_running(auth, provider->id) && provider->timeout != NULL && + timeout > 0 && timeout < curtime) + { + provider->timeout(auth); + } + } + + auth_client_unref(auth); + } }