src/s_auth.c

   1 /*
   2  *  ircd-ratbox: A slightly useful ircd.
   3  *  s_auth.c: Functions for querying a users ident.
   4  *
   5  *  Copyright (C) 1990 Jarkko Oikarinen and University of Oulu, Co Center
   6  *  Copyright (C) 1996-2002 Hybrid Development Team
   7  *  Copyright (C) 2002-2005 ircd-ratbox development team
   8  *
   9  *  This program is free software; you can redistribute it and/or modify
  10  *  it under the terms of the GNU General Public License as published by
  11  *  the Free Software Foundation; either version 2 of the License, or
  12  *  (at your option) any later version.
  13  *
  14  *  This program is distributed in the hope that it will be useful,
  15  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  *  GNU General Public License for more details.
  18  *
  19  *  You should have received a copy of the GNU General Public License
  20  *  along with this program; if not, write to the Free Software
  21  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307
  22  *  USA
  23  */
  24
  25 /*
  26  * Changes:
  27  *   July 6, 1999 - Rewrote most of the code here. When a client connects
  28  *     to the server and passes initial socket validation checks, it
  29  *     is owned by this module (auth) which returns it to the rest of the
  30  *     server when dns and auth queries are finished. Until the client is
  31  *     released, the server does not know it exists and does not process
  32  *     any messages from it.
  33  *     --Bleep  Thomas Helvey <tomh@inxpress.net>
  34  */
  35 #include "stdinc.h"
  36 #include "config.h"
  37 #include "tools.h"
  38 #include "s_auth.h"
  39 #include "s_conf.h"
  40 #include "client.h"
  41 #include "common.h"
  42 #include "event.h"
  43 #include "irc_string.h"
  44 #include "sprintf_irc.h"
  45 #include "ircd.h"
  46 #include "numeric.h"
  47 #include "packet.h"
  48 #include "res.h"
  49 #include "commio.h"
  50 #include "s_log.h"
  51 #include "s_stats.h"
  52 #include "send.h"
  53 #include "memory.h"
  54 #include "hook.h"
  55 #include "blacklist.h"
  56
  57 /*
  58  * a bit different approach
  59  * this replaces the original sendheader macros
  60  */
  61
  62 static const char *HeaderMessages[] =
  63 {
  64         "NOTICE AUTH :*** Looking up your hostname...",
  65         "NOTICE AUTH :*** Found your hostname",
  66         "NOTICE AUTH :*** Couldn't look up your hostname",
  67         "NOTICE AUTH :*** Checking Ident",
  68         "NOTICE AUTH :*** Got Ident response",
  69         "NOTICE AUTH :*** No Ident response",
  70         "NOTICE AUTH :*** Your hostname is too long, ignoring hostname",
  71         "NOTICE AUTH :*** Your forward and reverse DNS do not match, ignoring hostname",
  72         "NOTICE AUTH :*** Cannot verify hostname validity, ignoring hostname",
  73 };
  74
  75 typedef enum
  76 {
  77         REPORT_DO_DNS,
  78         REPORT_FIN_DNS,
  79         REPORT_FAIL_DNS,
  80         REPORT_DO_ID,
  81         REPORT_FIN_ID,
  82         REPORT_FAIL_ID,
  83         REPORT_HOST_TOOLONG,
  84         REPORT_HOST_MISMATCH,
  85         REPORT_HOST_UNKNOWN
  86 }
  87 ReportType;
  88
  89 #define sendheader(c, r) sendto_one(c, HeaderMessages[(r)])
  90
  91 static dlink_list auth_poll_list;
  92 static BlockHeap *auth_heap;
  93 static EVH timeout_auth_queries_event;
  94
  95 static PF read_auth_reply;
  96 static CNCB auth_connect_callback;
  97
  98 /*
  99  * init_auth()
 100  *
 101  * Initialise the auth code
 102  */
 103 void
 104 init_auth(void)
 105 {
 106         /* This hook takes a struct Client for its argument */
 107         memset(&auth_poll_list, 0, sizeof(auth_poll_list));
 108         eventAddIsh("timeout_auth_queries_event", timeout_auth_queries_event, NULL, 1);
 109         auth_heap = BlockHeapCreate(sizeof(struct AuthRequest), LCLIENT_HEAP_SIZE);
 110 }
 111
 112 /*
 113  * make_auth_request - allocate a new auth request
 114  */
 115 static struct AuthRequest *
 116 make_auth_request(struct Client *client)
 117 {
 118         struct AuthRequest *request = BlockHeapAlloc(auth_heap);
 119         client->localClient->auth_request = request;
 120         request->fd = -1;
 121         request->client = client;
 122         request->timeout = CurrentTime + ConfigFileEntry.connect_timeout;
 123         return request;
 124 }
 125
 126 /*
 127  * free_auth_request - cleanup auth request allocations
 128  */
 129 static void
 130 free_auth_request(struct AuthRequest *request)
 131 {
 132         BlockHeapFree(auth_heap, request);
 133 }
 134
 135 /*
 136  * release_auth_client - release auth client from auth system
 137  * this adds the client into the local client lists so it can be read by
 138  * the main io processing loop
 139  */
 140 static void
 141 release_auth_client(struct AuthRequest *auth)
 142 {
 143         struct Client *client = auth->client;
 144
 145         if(IsDNSPending(auth) || IsDoingAuth(auth))
 146                 return;
 147
 148         client->localClient->auth_request = NULL;
 149         dlinkDelete(&auth->node, &auth_poll_list);
 150         free_auth_request(auth);
 151         if(client->localClient->fd > highest_fd)
 152                 highest_fd = client->localClient->fd;
 153
 154         /*
 155          * When a client has auth'ed, we want to start reading what it sends
 156          * us. This is what read_packet() does.
 157          *     -- adrian
 158          */
 159         client->localClient->allow_read = MAX_FLOOD;
 160         comm_setflush(client->localClient->fd, 1000, flood_recalc, client);
 161         dlinkAddTail(client, &client->node, &global_client_list);
 162         read_packet(client->localClient->fd, client);
 163 }
 164
 165 /*
 166  * auth_dns_callback - called when resolver query finishes
 167  * if the query resulted in a successful search, hp will contain
 168  * a non-null pointer, otherwise hp will be null.
 169  * set the client on it's way to a connection completion, regardless
 170  * of success of failure
 171  */
 172 static void
 173 auth_dns_callback(void *vptr, struct DNSReply *reply)
 174 {
 175         struct AuthRequest *auth = (struct AuthRequest *) vptr;
 176         ClearDNSPending(auth);
 177
 178         /* XXX: this shouldn't happen, but it does. -nenolod */
 179         if(auth->client->localClient == NULL)
 180         {
 181                 sendto_realops_snomask(SNO_GENERAL, L_ALL,
 182                         "auth_dns_callback(): auth->client->localClient (%s) is NULL", get_client_name(auth->client, HIDE_IP));
 183
 184                 dlinkDelete(&auth->node, &auth_poll_list);
 185                 free_auth_request(auth);
 186
 187                 /* and they will silently drop through and all will hopefully be ok... -nenolod */
 188                 return;
 189         }
 190
 191         if(reply)
 192         {
 193                 int good = 1;
 194
 195                 if(auth->client->localClient->ip.ss_family == AF_INET)
 196                 {
 197                         struct sockaddr_in *ip, *ip_fwd;
 198
 199                         ip = (struct sockaddr_in *) &auth->client->localClient->ip;
 200                         ip_fwd = (struct sockaddr_in *) &reply->addr;
 201
 202                         if(ip->sin_addr.s_addr != ip_fwd->sin_addr.s_addr)
 203                         {
 204                                 sendheader(auth->client, REPORT_HOST_MISMATCH);
 205                                 good = 0;
 206                         }
 207                 }
 208 #ifdef IPV6
 209                 else if(auth->client->localClient->ip.ss_family == AF_INET6)
 210                 {
 211                         struct sockaddr_in6 *ip, *ip_fwd;
 212
 213                         ip = (struct sockaddr_in6 *) &auth->client->localClient->ip;
 214                         ip_fwd = (struct sockaddr_in6 *) &reply->addr;
 215
 216                         if(memcmp(&ip->sin6_addr, &ip_fwd->sin6_addr, sizeof(struct in6_addr)) != 0)
 217                         {
 218                                 sendheader(auth->client, REPORT_HOST_MISMATCH);
 219                                 good = 0;
 220                         }
 221                 }
 222 #endif
 223                 else    /* can't verify it, don't know how. reject it. */
 224                 {
 225                         sendheader(auth->client, REPORT_HOST_UNKNOWN);
 226                         good = 0;
 227                 }
 228
 229                 if(good && strlen(reply->h_name) <= HOSTLEN)
 230                 {
 231                         strlcpy(auth->client->host, reply->h_name, sizeof(auth->client->host));
 232                         sendheader(auth->client, REPORT_FIN_DNS);
 233                 }
 234                 else if (strlen(reply->h_name) > HOSTLEN)
 235                         sendheader(auth->client, REPORT_HOST_TOOLONG);
 236         }
 237         else
 238                 sendheader(auth->client, REPORT_FAIL_DNS);
 239
 240         release_auth_client(auth);
 241 }
 242
 243 /*
 244  * authsenderr - handle auth send errors
 245  */
 246 static void
 247 auth_error(struct AuthRequest *auth)
 248 {
 249         ++ServerStats->is_abad;
 250
 251         comm_close(auth->fd);
 252         auth->fd = -1;
 253
 254         ClearAuth(auth);
 255         sendheader(auth->client, REPORT_FAIL_ID);
 256
 257         release_auth_client(auth);
 258 }
 259
 260 /*
 261  * start_auth_query - Flag the client to show that an attempt to
 262  * contact the ident server on
 263  * the client's host.  The connect and subsequently the socket are all put
 264  * into 'non-blocking' mode.  Should the connect or any later phase of the
 265  * identifing process fail, it is aborted and the user is given a username
 266  * of "unknown".
 267  */
 268 static int
 269 start_auth_query(struct AuthRequest *auth)
 270 {
 271         struct irc_sockaddr_storage localaddr;
 272         socklen_t locallen = sizeof(struct irc_sockaddr_storage);
 273         int fd;
 274         int family;
 275
 276         if(IsAnyDead(auth->client))
 277                 return 0;
 278
 279         family = auth->client->localClient->ip.ss_family;
 280         if((fd = comm_socket(family, SOCK_STREAM, 0, "ident")) == -1)
 281         {
 282                 report_error("creating auth stream socket %s:%s",
 283                              get_client_name(auth->client, SHOW_IP),
 284                              log_client_name(auth->client, SHOW_IP), errno);
 285                 ++ServerStats->is_abad;
 286                 return 0;
 287         }
 288         if((MAXCONNECTIONS - 10) < fd)
 289         {
 290                 sendto_realops_snomask(SNO_GENERAL, L_ALL,
 291                                      "Can't allocate fd for auth on %s",
 292                                      get_client_name(auth->client, SHOW_IP));
 293                 comm_close(fd);
 294                 return 0;
 295         }
 296
 297         sendheader(auth->client, REPORT_DO_ID);
 298
 299         /*
 300          * get the local address of the client and bind to that to
 301          * make the auth request.  This used to be done only for
 302          * ifdef VIRTUAL_HOST, but needs to be done for all clients
 303          * since the ident request must originate from that same address--
 304          * and machines with multiple IP addresses are common now
 305          */
 306         memset(&localaddr, 0, locallen);
 307         getsockname(auth->client->localClient->fd,
 308                     (struct sockaddr *) &localaddr, &locallen);
 309
 310         mangle_mapped_sockaddr((struct sockaddr *)&localaddr);
 311 #ifdef IPV6
 312         if(localaddr.ss_family == AF_INET6)
 313         {
 314                 ((struct sockaddr_in6 *)&localaddr)->sin6_port = 0;
 315         } else
 316 #endif
 317         ((struct sockaddr_in *)&localaddr)->sin_port = 0;
 318
 319         auth->fd = fd;
 320         SetAuthConnect(auth);
 321
 322         comm_connect_tcp(fd, auth->client->sockhost, 113,
 323                          (struct sockaddr *) &localaddr, GET_SS_LEN(localaddr),
 324                          auth_connect_callback, auth,
 325                          localaddr.ss_family, GlobalSetOptions.ident_timeout);
 326         return 1;               /* We suceed here for now */
 327 }
 328
 329 /*
 330  * GetValidIdent - parse ident query reply from identd server
 331  *
 332  * Inputs        - pointer to ident buf
 333  * Output        - NULL if no valid ident found, otherwise pointer to name
 334  * Side effects  -
 335  */
 336 static char *
 337 GetValidIdent(char *buf)
 338 {
 339         int remp = 0;
 340         int locp = 0;
 341         char *colon1Ptr;
 342         char *colon2Ptr;
 343         char *colon3Ptr;
 344         char *commaPtr;
 345         char *remotePortString;
 346
 347         /* All this to get rid of a sscanf() fun. */
 348         remotePortString = buf;
 349
 350         colon1Ptr = strchr(remotePortString, ':');
 351         if(!colon1Ptr)
 352                 return 0;
 353
 354         *colon1Ptr = '\0';
 355         colon1Ptr++;
 356         colon2Ptr = strchr(colon1Ptr, ':');
 357         if(!colon2Ptr)
 358                 return 0;
 359
 360         *colon2Ptr = '\0';
 361         colon2Ptr++;
 362         commaPtr = strchr(remotePortString, ',');
 363
 364         if(!commaPtr)
 365                 return 0;
 366
 367         *commaPtr = '\0';
 368         commaPtr++;
 369
 370         remp = atoi(remotePortString);
 371         if(!remp)
 372                 return 0;
 373
 374         locp = atoi(commaPtr);
 375         if(!locp)
 376                 return 0;
 377
 378         /* look for USERID bordered by first pair of colons */
 379         if(!strstr(colon1Ptr, "USERID"))
 380                 return 0;
 381
 382         colon3Ptr = strchr(colon2Ptr, ':');
 383         if(!colon3Ptr)
 384                 return 0;
 385
 386         *colon3Ptr = '\0';
 387         colon3Ptr++;
 388         return (colon3Ptr);
 389 }
 390
 391 /*
 392  * start_auth - starts auth (identd) and dns queries for a client
 393  */
 394 void
 395 start_auth(struct Client *client)
 396 {
 397         struct AuthRequest *auth = 0;
 398         s_assert(0 != client);
 399         if(client == NULL)
 400                 return;
 401
 402         /* to aid bopm which needs something unique to match against */
 403         sendto_one(client, "NOTICE AUTH :*** Processing connection to %s",
 404                         me.name);
 405
 406         auth = make_auth_request(client);
 407
 408         auth->dns_query.ptr = auth;
 409         auth->dns_query.callback = auth_dns_callback;
 410
 411         sendheader(client, REPORT_DO_DNS);
 412
 413         /* No DNS cache now, remember? -- adrian */
 414         gethost_byaddr(&client->localClient->ip, &auth->dns_query);
 415
 416         SetDNSPending(auth);
 417
 418         if(ConfigFileEntry.disable_auth == 0)
 419                 start_auth_query(auth);
 420
 421         dlinkAdd(auth, &auth->node, &auth_poll_list);
 422 }
 423
 424 /*
 425  * timeout_auth_queries - timeout resolver and identd requests
 426  * allow clients through if requests failed
 427  */
 428 static void
 429 timeout_auth_queries_event(void *notused)
 430 {
 431         dlink_node *ptr;
 432         dlink_node *next_ptr;
 433         struct AuthRequest *auth;
 434
 435         DLINK_FOREACH_SAFE(ptr, next_ptr, auth_poll_list.head)
 436         {
 437                 auth = ptr->data;
 438
 439                 if(auth->timeout < CurrentTime)
 440                 {
 441                         if(auth->fd >= 0)
 442                                 comm_close(auth->fd);
 443
 444                         if(IsDoingAuth(auth))
 445                         {
 446                                 ClearAuth(auth);
 447                                 ++ServerStats->is_abad;
 448                                 sendheader(auth->client, REPORT_FAIL_ID);
 449                                 auth->client->localClient->auth_request = NULL;
 450                         }
 451                         if(IsDNSPending(auth))
 452                         {
 453                                 ClearDNSPending(auth);
 454                                 delete_resolver_queries(&auth->dns_query);
 455                                 sendheader(auth->client, REPORT_FAIL_DNS);
 456                         }
 457
 458                         auth->client->localClient->lasttime = CurrentTime;
 459                         release_auth_client(auth);
 460                 }
 461         }
 462 }
 463
 464 /*
 465  * auth_connect_callback() - deal with the result of comm_connect_tcp()
 466  *
 467  * If the connection failed, we simply close the auth fd and report
 468  * a failure. If the connection suceeded send the ident server a query
 469  * giving "theirport , ourport". The write is only attempted *once* so
 470  * it is deemed to be a fail if the entire write doesn't write all the
 471  * data given.  This shouldnt be a problem since the socket should have
 472  * a write buffer far greater than this message to store it in should
 473  * problems arise. -avalon
 474  */
 475 static void
 476 auth_connect_callback(int fd, int error, void *data)
 477 {
 478         struct AuthRequest *auth = data;
 479         struct sockaddr_in us;
 480         struct sockaddr_in them;
 481         char authbuf[32];
 482         socklen_t ulen = sizeof(struct sockaddr_in);
 483         socklen_t tlen = sizeof(struct sockaddr_in);
 484
 485         /* Check the error */
 486         if(error != COMM_OK)
 487         {
 488                 /* We had an error during connection :( */
 489                 auth_error(auth);
 490                 return;
 491         }
 492
 493         if(getsockname
 494            (auth->client->localClient->fd, (struct sockaddr *) &us,
 495             (socklen_t *) & ulen)
 496            || getpeername(auth->client->localClient->fd,
 497                           (struct sockaddr *) &them, (socklen_t *) & tlen))
 498         {
 499                 ilog(L_IOERROR, "auth get{sock,peer}name error for %s:%m",
 500                      log_client_name(auth->client, SHOW_IP));
 501                 auth_error(auth);
 502                 return;
 503         }
 504         ircsnprintf(authbuf, sizeof(authbuf), "%u , %u\r\n",
 505                    (unsigned int) ntohs(them.sin_port), (unsigned int) ntohs(us.sin_port));
 506
 507         if(write(auth->fd, authbuf, strlen(authbuf)) == -1)
 508         {
 509                 auth_error(auth);
 510                 return;
 511         }
 512         ClearAuthConnect(auth);
 513         SetAuthPending(auth);
 514         read_auth_reply(auth->fd, auth);
 515 }
 516
 517
 518 /*
 519  * read_auth_reply - read the reply (if any) from the ident server
 520  * we connected to.
 521  * We only give it one shot, if the reply isn't good the first time
 522  * fail the authentication entirely. --Bleep
 523  */
 524 #define AUTH_BUFSIZ 128
 525
 526 static void
 527 read_auth_reply(int fd, void *data)
 528 {
 529         struct AuthRequest *auth = data;
 530         char *s = NULL;
 531         char *t = NULL;
 532         int len;
 533         int count;
 534         char buf[AUTH_BUFSIZ + 1];      /* buffer to read auth reply into */
 535
 536         len = read(auth->fd, buf, AUTH_BUFSIZ);
 537
 538         if(len < 0 && ignoreErrno(errno))
 539         {
 540                 comm_setselect(fd, FDLIST_IDLECLIENT, COMM_SELECT_READ, read_auth_reply, auth, 0);
 541                 return;
 542         }
 543
 544         if(len > 0)
 545         {
 546                 buf[len] = '\0';
 547
 548                 if((s = GetValidIdent(buf)))
 549                 {
 550                         t = auth->client->username;
 551
 552                         while (*s == '~' || *s == '^')
 553                                 s++;
 554
 555                         for (count = USERLEN; *s && count; s++)
 556                         {
 557                                 if(*s == '@')
 558                                 {
 559                                         break;
 560                                 }
 561                                 if(!IsSpace(*s) && *s != ':' && *s != '[')
 562                                 {
 563                                         *t++ = *s;
 564                                         count--;
 565                                 }
 566                         }
 567                         *t = '\0';
 568                 }
 569         }
 570
 571         comm_close(auth->fd);
 572         auth->fd = -1;
 573         ClearAuth(auth);
 574
 575         if(s == NULL)
 576         {
 577                 ++ServerStats->is_abad;
 578                 strcpy(auth->client->username, "unknown");
 579                 sendheader(auth->client, REPORT_FAIL_ID);
 580         }
 581         else
 582         {
 583                 sendheader(auth->client, REPORT_FIN_ID);
 584                 ++ServerStats->is_asuc;
 585                 SetGotId(auth->client);
 586         }
 587
 588         release_auth_client(auth);
 589 }
 590
 591
 592
 593 /*
 594  * delete_auth_queries()
 595  *
 596  */
 597 void
 598 delete_auth_queries(struct Client *target_p)
 599 {
 600         struct AuthRequest *auth;
 601
 602         if(target_p == NULL || target_p->localClient == NULL ||
 603            target_p->localClient->auth_request == NULL)
 604                 return;
 605
 606         auth = target_p->localClient->auth_request;
 607         target_p->localClient->auth_request = NULL;
 608
 609         if(IsDNSPending(auth))
 610                 delete_resolver_queries(&auth->dns_query);
 611
 612         if(auth->fd >= 0)
 613                 comm_close(auth->fd);
 614
 615         dlinkDelete(&auth->node, &auth_poll_list);
 616         free_auth_request(auth);
 617 }