2 * ircd-ratbox: A slightly useful ircd.
3 * s_auth.c: Functions for querying a users ident.
5 * Copyright (C) 1990 Jarkko Oikarinen and University of Oulu, Co Center
6 * Copyright (C) 1996-2002 Hybrid Development Team
7 * Copyright (C) 2002-2005 ircd-ratbox development team
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 2 of the License, or
12 * (at your option) any later version.
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, write to the Free Software
21 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
24 * $Id: s_auth.c 26 2006-09-20 18:02:06Z spb $ */
28 * July 6, 1999 - Rewrote most of the code here. When a client connects
29 * to the server and passes initial socket validation checks, it
30 * is owned by this module (auth) which returns it to the rest of the
31 * server when dns and auth queries are finished. Until the client is
32 * released, the server does not know it exists and does not process
33 * any messages from it.
34 * --Bleep Thomas Helvey <tomh@inxpress.net>
44 #include "irc_string.h"
45 #include "sprintf_irc.h"
56 #include "blacklist.h"
59 * a bit different approach
60 * this replaces the original sendheader macros
63 static const char *HeaderMessages
[] =
65 "NOTICE AUTH :*** Looking up your hostname...",
66 "NOTICE AUTH :*** Found your hostname",
67 "NOTICE AUTH :*** Couldn't look up your hostname",
68 "NOTICE AUTH :*** Checking Ident",
69 "NOTICE AUTH :*** Got Ident response",
70 "NOTICE AUTH :*** No Ident response",
71 "NOTICE AUTH :*** Your hostname is too long, ignoring hostname",
72 "NOTICE AUTH :*** Your forward and reverse DNS do not match, ignoring hostname",
73 "NOTICE AUTH :*** Cannot verify hostname validity, ignoring hostname",
90 #define sendheader(c, r) sendto_one(c, HeaderMessages[(r)])
92 static dlink_list auth_poll_list
;
93 static BlockHeap
*auth_heap
;
94 static EVH timeout_auth_queries_event
;
96 static PF read_auth_reply
;
97 static CNCB auth_connect_callback
;
102 * Initialise the auth code
107 /* This hook takes a struct Client for its argument */
108 memset(&auth_poll_list
, 0, sizeof(auth_poll_list
));
109 eventAddIsh("timeout_auth_queries_event", timeout_auth_queries_event
, NULL
, 1);
110 auth_heap
= BlockHeapCreate(sizeof(struct AuthRequest
), LCLIENT_HEAP_SIZE
);
114 * make_auth_request - allocate a new auth request
116 static struct AuthRequest
*
117 make_auth_request(struct Client
*client
)
119 struct AuthRequest
*request
= BlockHeapAlloc(auth_heap
);
120 client
->localClient
->auth_request
= request
;
122 request
->client
= client
;
123 request
->timeout
= CurrentTime
+ ConfigFileEntry
.connect_timeout
;
128 * free_auth_request - cleanup auth request allocations
131 free_auth_request(struct AuthRequest
*request
)
133 BlockHeapFree(auth_heap
, request
);
137 * release_auth_client - release auth client from auth system
138 * this adds the client into the local client lists so it can be read by
139 * the main io processing loop
142 release_auth_client(struct AuthRequest
*auth
)
144 struct Client
*client
= auth
->client
;
146 if(IsDNSPending(auth
) || IsDoingAuth(auth
))
149 client
->localClient
->auth_request
= NULL
;
150 dlinkDelete(&auth
->node
, &auth_poll_list
);
151 free_auth_request(auth
);
152 if(client
->localClient
->fd
> highest_fd
)
153 highest_fd
= client
->localClient
->fd
;
156 * When a client has auth'ed, we want to start reading what it sends
157 * us. This is what read_packet() does.
160 client
->localClient
->allow_read
= MAX_FLOOD
;
161 comm_setflush(client
->localClient
->fd
, 1000, flood_recalc
, client
);
162 dlinkAddTail(client
, &client
->node
, &global_client_list
);
163 read_packet(client
->localClient
->fd
, client
);
167 * auth_dns_callback - called when resolver query finishes
168 * if the query resulted in a successful search, hp will contain
169 * a non-null pointer, otherwise hp will be null.
170 * set the client on it's way to a connection completion, regardless
171 * of success of failure
174 auth_dns_callback(void *vptr
, struct DNSReply
*reply
)
176 struct AuthRequest
*auth
= (struct AuthRequest
*) vptr
;
177 ClearDNSPending(auth
);
179 /* XXX: this shouldn't happen, but it does. -nenolod */
180 if(auth
->client
->localClient
== NULL
)
182 sendto_realops_snomask(SNO_GENERAL
, L_ALL
,
183 "auth_dns_callback(): auth->client->localClient (%s) is NULL", get_client_name(auth
->client
, HIDE_IP
));
185 dlinkDelete(&auth
->node
, &auth_poll_list
);
186 free_auth_request(auth
);
188 /* and they will silently drop through and all will hopefully be ok... -nenolod */
196 if(auth
->client
->localClient
->ip
.ss_family
== AF_INET
)
198 struct sockaddr_in
*ip
, *ip_fwd
;
200 ip
= (struct sockaddr_in
*) &auth
->client
->localClient
->ip
;
201 ip_fwd
= (struct sockaddr_in
*) &reply
->addr
;
203 if(ip
->sin_addr
.s_addr
!= ip_fwd
->sin_addr
.s_addr
)
205 sendheader(auth
->client
, REPORT_HOST_MISMATCH
);
210 else if(auth
->client
->localClient
->ip
.ss_family
== AF_INET6
)
212 struct sockaddr_in6
*ip
, *ip_fwd
;
214 ip
= (struct sockaddr_in6
*) &auth
->client
->localClient
->ip
;
215 ip_fwd
= (struct sockaddr_in6
*) &reply
->addr
;
217 if(memcmp(&ip
->sin6_addr
, &ip_fwd
->sin6_addr
, sizeof(struct in6_addr
)) != 0)
219 sendheader(auth
->client
, REPORT_HOST_MISMATCH
);
224 else /* can't verify it, don't know how. reject it. */
226 sendheader(auth
->client
, REPORT_HOST_UNKNOWN
);
230 if(good
&& strlen(reply
->h_name
) <= HOSTLEN
)
232 strlcpy(auth
->client
->host
, reply
->h_name
, sizeof(auth
->client
->host
));
233 sendheader(auth
->client
, REPORT_FIN_DNS
);
235 else if (strlen(reply
->h_name
) > HOSTLEN
)
236 sendheader(auth
->client
, REPORT_HOST_TOOLONG
);
239 sendheader(auth
->client
, REPORT_FAIL_DNS
);
241 release_auth_client(auth
);
245 * authsenderr - handle auth send errors
248 auth_error(struct AuthRequest
*auth
)
250 ++ServerStats
->is_abad
;
252 comm_close(auth
->fd
);
256 sendheader(auth
->client
, REPORT_FAIL_ID
);
258 release_auth_client(auth
);
262 * start_auth_query - Flag the client to show that an attempt to
263 * contact the ident server on
264 * the client's host. The connect and subsequently the socket are all put
265 * into 'non-blocking' mode. Should the connect or any later phase of the
266 * identifing process fail, it is aborted and the user is given a username
270 start_auth_query(struct AuthRequest
*auth
)
272 struct irc_sockaddr_storage localaddr
;
273 socklen_t locallen
= sizeof(struct irc_sockaddr_storage
);
277 if(IsAnyDead(auth
->client
))
280 family
= auth
->client
->localClient
->ip
.ss_family
;
281 if((fd
= comm_socket(family
, SOCK_STREAM
, 0, "ident")) == -1)
283 report_error("creating auth stream socket %s:%s",
284 get_client_name(auth
->client
, SHOW_IP
),
285 log_client_name(auth
->client
, SHOW_IP
), errno
);
286 ++ServerStats
->is_abad
;
289 if((MAXCONNECTIONS
- 10) < fd
)
291 sendto_realops_snomask(SNO_GENERAL
, L_ALL
,
292 "Can't allocate fd for auth on %s",
293 get_client_name(auth
->client
, SHOW_IP
));
298 sendheader(auth
->client
, REPORT_DO_ID
);
301 * get the local address of the client and bind to that to
302 * make the auth request. This used to be done only for
303 * ifdef VIRTUAL_HOST, but needs to be done for all clients
304 * since the ident request must originate from that same address--
305 * and machines with multiple IP addresses are common now
307 memset(&localaddr
, 0, locallen
);
308 getsockname(auth
->client
->localClient
->fd
,
309 (struct sockaddr
*) &localaddr
, &locallen
);
311 mangle_mapped_sockaddr((struct sockaddr
*)&localaddr
);
313 if(localaddr
.ss_family
== AF_INET6
)
315 ((struct sockaddr_in6
*)&localaddr
)->sin6_port
= 0;
318 ((struct sockaddr_in
*)&localaddr
)->sin_port
= 0;
321 SetAuthConnect(auth
);
323 comm_connect_tcp(fd
, auth
->client
->sockhost
, 113,
324 (struct sockaddr
*) &localaddr
, GET_SS_LEN(localaddr
),
325 auth_connect_callback
, auth
,
326 localaddr
.ss_family
, GlobalSetOptions
.ident_timeout
);
327 return 1; /* We suceed here for now */
331 * GetValidIdent - parse ident query reply from identd server
333 * Inputs - pointer to ident buf
334 * Output - NULL if no valid ident found, otherwise pointer to name
338 GetValidIdent(char *buf
)
346 char *remotePortString
;
348 /* All this to get rid of a sscanf() fun. */
349 remotePortString
= buf
;
351 colon1Ptr
= strchr(remotePortString
, ':');
357 colon2Ptr
= strchr(colon1Ptr
, ':');
363 commaPtr
= strchr(remotePortString
, ',');
371 remp
= atoi(remotePortString
);
375 locp
= atoi(commaPtr
);
379 /* look for USERID bordered by first pair of colons */
380 if(!strstr(colon1Ptr
, "USERID"))
383 colon3Ptr
= strchr(colon2Ptr
, ':');
393 * start_auth - starts auth (identd) and dns queries for a client
396 start_auth(struct Client
*client
)
398 struct AuthRequest
*auth
= 0;
399 s_assert(0 != client
);
403 /* to aid bopm which needs something unique to match against */
404 sendto_one(client
, "NOTICE AUTH :*** Processing connection to %s",
407 auth
= make_auth_request(client
);
409 auth
->dns_query
.ptr
= auth
;
410 auth
->dns_query
.callback
= auth_dns_callback
;
412 sendheader(client
, REPORT_DO_DNS
);
414 /* No DNS cache now, remember? -- adrian */
415 gethost_byaddr(&client
->localClient
->ip
, &auth
->dns_query
);
419 if(ConfigFileEntry
.disable_auth
== 0)
420 start_auth_query(auth
);
422 dlinkAdd(auth
, &auth
->node
, &auth_poll_list
);
426 * timeout_auth_queries - timeout resolver and identd requests
427 * allow clients through if requests failed
430 timeout_auth_queries_event(void *notused
)
433 dlink_node
*next_ptr
;
434 struct AuthRequest
*auth
;
436 DLINK_FOREACH_SAFE(ptr
, next_ptr
, auth_poll_list
.head
)
440 if(auth
->timeout
< CurrentTime
)
443 comm_close(auth
->fd
);
445 if(IsDoingAuth(auth
))
448 ++ServerStats
->is_abad
;
449 sendheader(auth
->client
, REPORT_FAIL_ID
);
450 auth
->client
->localClient
->auth_request
= NULL
;
452 if(IsDNSPending(auth
))
454 ClearDNSPending(auth
);
455 delete_resolver_queries(&auth
->dns_query
);
456 sendheader(auth
->client
, REPORT_FAIL_DNS
);
459 auth
->client
->localClient
->lasttime
= CurrentTime
;
460 release_auth_client(auth
);
466 * auth_connect_callback() - deal with the result of comm_connect_tcp()
468 * If the connection failed, we simply close the auth fd and report
469 * a failure. If the connection suceeded send the ident server a query
470 * giving "theirport , ourport". The write is only attempted *once* so
471 * it is deemed to be a fail if the entire write doesn't write all the
472 * data given. This shouldnt be a problem since the socket should have
473 * a write buffer far greater than this message to store it in should
474 * problems arise. -avalon
477 auth_connect_callback(int fd
, int error
, void *data
)
479 struct AuthRequest
*auth
= data
;
480 struct sockaddr_in us
;
481 struct sockaddr_in them
;
483 socklen_t ulen
= sizeof(struct sockaddr_in
);
484 socklen_t tlen
= sizeof(struct sockaddr_in
);
486 /* Check the error */
489 /* We had an error during connection :( */
495 (auth
->client
->localClient
->fd
, (struct sockaddr
*) &us
,
496 (socklen_t
*) & ulen
)
497 || getpeername(auth
->client
->localClient
->fd
,
498 (struct sockaddr
*) &them
, (socklen_t
*) & tlen
))
500 ilog(L_IOERROR
, "auth get{sock,peer}name error for %s:%m",
501 log_client_name(auth
->client
, SHOW_IP
));
505 ircsnprintf(authbuf
, sizeof(authbuf
), "%u , %u\r\n",
506 (unsigned int) ntohs(them
.sin_port
), (unsigned int) ntohs(us
.sin_port
));
508 if(write(auth
->fd
, authbuf
, strlen(authbuf
)) == -1)
513 ClearAuthConnect(auth
);
514 SetAuthPending(auth
);
515 read_auth_reply(auth
->fd
, auth
);
520 * read_auth_reply - read the reply (if any) from the ident server
522 * We only give it one shot, if the reply isn't good the first time
523 * fail the authentication entirely. --Bleep
525 #define AUTH_BUFSIZ 128
528 read_auth_reply(int fd
, void *data
)
530 struct AuthRequest
*auth
= data
;
535 char buf
[AUTH_BUFSIZ
+ 1]; /* buffer to read auth reply into */
537 len
= read(auth
->fd
, buf
, AUTH_BUFSIZ
);
539 if(len
< 0 && ignoreErrno(errno
))
541 comm_setselect(fd
, FDLIST_IDLECLIENT
, COMM_SELECT_READ
, read_auth_reply
, auth
, 0);
549 if((s
= GetValidIdent(buf
)))
551 t
= auth
->client
->username
;
553 while (*s
== '~' || *s
== '^')
556 for (count
= USERLEN
; *s
&& count
; s
++)
562 if(!IsSpace(*s
) && *s
!= ':' && *s
!= '[')
572 comm_close(auth
->fd
);
578 ++ServerStats
->is_abad
;
579 strcpy(auth
->client
->username
, "unknown");
580 sendheader(auth
->client
, REPORT_FAIL_ID
);
584 sendheader(auth
->client
, REPORT_FIN_ID
);
585 ++ServerStats
->is_asuc
;
586 SetGotId(auth
->client
);
589 release_auth_client(auth
);
595 * delete_auth_queries()
599 delete_auth_queries(struct Client
*target_p
)
601 struct AuthRequest
*auth
;
603 if(target_p
== NULL
|| target_p
->localClient
== NULL
||
604 target_p
->localClient
->auth_request
== NULL
)
607 auth
= target_p
->localClient
->auth_request
;
608 target_p
->localClient
->auth_request
= NULL
;
610 if(IsDNSPending(auth
))
611 delete_resolver_queries(&auth
->dns_query
);
614 comm_close(auth
->fd
);
616 dlinkDelete(&auth
->node
, &auth_poll_list
);
617 free_auth_request(auth
);