2891 lines
91 KiB
C
2891 lines
91 KiB
C
/************************************************************************
|
|
* IRC - Internet Relay Chat, src/s_auth.c
|
|
* Copyright (C) 1992 Darren Reed
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation; either version 1, or (at your option)
|
|
* any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program; if not, write to the Free Software
|
|
* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
|
|
*
|
|
* Changes:
|
|
* July 6, 1999 - Rewrote most of the code here. When a client connects
|
|
* to the server and passes initial socket validation checks, it
|
|
* is owned by this module (auth) which returns it to the rest of the
|
|
* server when dns and auth queries are finished. Until the client is
|
|
* released, the server does not know it exists and does not process
|
|
* any messages from it.
|
|
* --Bleep Thomas Helvey <tomh@inxpress.net>
|
|
*
|
|
* December 26, 2005 - Rewrite the flag handling and integrate that with
|
|
* an IRCnet-style IAuth protocol.
|
|
* -- Michael Poole
|
|
*/
|
|
/** @file
|
|
* @brief Implementation of DNS and ident lookups.
|
|
* @version $Id: s_auth.c 1934 2010-01-04 17:15:13Z klmitch $
|
|
*/
|
|
#include "config.h"
|
|
|
|
#include "s_auth.h"
|
|
#include "class.h"
|
|
#include "client.h"
|
|
#include "hash.h"
|
|
#include "IPcheck.h"
|
|
#include "ircd.h"
|
|
#include "ircd_alloc.h"
|
|
#include "ircd_chattr.h"
|
|
#include "ircd_events.h"
|
|
#include "ircd_features.h"
|
|
#include "ircd_geoip.h"
|
|
#include "ircd_log.h"
|
|
#include "ircd_osdep.h"
|
|
#include "ircd_reply.h"
|
|
#include "ircd_snprintf.h"
|
|
#include "ircd_string.h"
|
|
#include "list.h"
|
|
#include "mark.h"
|
|
#include "msg.h" /* for MAXPARA */
|
|
#include "numeric.h"
|
|
#include "numnicks.h"
|
|
#include "querycmds.h"
|
|
#include "random.h"
|
|
#include "res.h"
|
|
#include "s_bsd.h"
|
|
#include "s_conf.h"
|
|
#include "s_debug.h"
|
|
#include "s_misc.h"
|
|
#include "s_user.h"
|
|
#include "send.h"
|
|
#include "ssl.h"
|
|
|
|
#include <errno.h>
|
|
#include <string.h>
|
|
#include <stdlib.h>
|
|
#include <unistd.h>
|
|
#include <fcntl.h>
|
|
#include <sys/socket.h>
|
|
#include <sys/ioctl.h>
|
|
|
|
/** Pending operations during registration. */
|
|
enum AuthRequestFlag {
|
|
AR_AUTH_PENDING, /**< ident connecting or waiting for response */
|
|
AR_DNS_PENDING, /**< dns request sent, waiting for response */
|
|
AR_CAP_PENDING, /**< in middle of CAP negotiations */
|
|
AR_NEEDS_PONG, /**< user has not PONGed */
|
|
AR_NEEDS_USER, /**< user must send USER command */
|
|
AR_NEEDS_NICK, /**< user must send NICK command */
|
|
AR_LAST_SCAN = AR_NEEDS_NICK, /**< maximum flag to scan through */
|
|
AR_IAUTH_PENDING, /**< iauth request sent, waiting for response */
|
|
AR_IAUTH_HURRY, /**< we told iauth to hurry up */
|
|
AR_IAUTH_USERNAME, /**< iauth sent a username (preferred or forced) */
|
|
AR_IAUTH_FUSERNAME, /**< iauth sent a forced username */
|
|
AR_IAUTH_SOFT_DONE, /**< iauth has no objection to client */
|
|
AR_PASSWORD_CHECKED, /**< client password already checked */
|
|
AR_LOC_DONE, /**< loc messages have been sent */
|
|
AR_NUM_FLAGS
|
|
};
|
|
|
|
DECLARE_FLAGSET(AuthRequestFlags, AR_NUM_FLAGS);
|
|
|
|
/** Stores registration state of a client. */
|
|
struct AuthRequest {
|
|
struct AuthRequest* next; /**< linked list node ptr */
|
|
struct AuthRequest* prev; /**< linked list node ptr */
|
|
struct Client* client; /**< pointer to client struct for request */
|
|
struct irc_sockaddr local; /**< local endpoint address */
|
|
struct irc_in_addr original; /**< original client IP address */
|
|
struct Socket socket; /**< socket descriptor for auth queries */
|
|
struct Timer timeout; /**< timeout timer for ident and dns queries */
|
|
struct Timer loctimeout; /**< timeout timer for Login On Connect */
|
|
struct AuthRequestFlags flags; /**< current state of request */
|
|
unsigned int cookie; /**< cookie the user must PONG */
|
|
unsigned short port; /**< client's remote port number */
|
|
};
|
|
|
|
/** Array of message text (with length) pairs for AUTH status
|
|
* messages. Indexed using #ReportType.
|
|
*/
|
|
static struct {
|
|
const char* message;
|
|
unsigned int length;
|
|
} HeaderMessages [] = {
|
|
#define MSG(STR) { STR, sizeof(STR) - 1 }
|
|
MSG("NOTICE * :*** Looking up your hostname\r\n"),
|
|
MSG("NOTICE * :*** Found your hostname\r\n"),
|
|
MSG("NOTICE * :*** Couldn't look up your hostname\r\n"),
|
|
MSG("NOTICE * :*** Checking Ident\r\n"),
|
|
MSG("NOTICE * :*** Got ident response\r\n"),
|
|
MSG("NOTICE * :*** No ident response\r\n"),
|
|
MSG("NOTICE * :*** \r\n"),
|
|
MSG("NOTICE * :*** Your forward and reverse DNS do not match, "
|
|
"ignoring hostname.\r\n"),
|
|
MSG("NOTICE * :*** Invalid hostname\r\n")
|
|
#undef MSG
|
|
};
|
|
|
|
/** Enum used to index messages in the HeaderMessages[] array. */
|
|
typedef enum {
|
|
REPORT_DO_DNS,
|
|
REPORT_FIN_DNS,
|
|
REPORT_FAIL_DNS,
|
|
REPORT_DO_ID,
|
|
REPORT_FIN_ID,
|
|
REPORT_FAIL_ID,
|
|
REPORT_FAIL_IAUTH,
|
|
REPORT_IP_MISMATCH,
|
|
REPORT_INVAL_DNS
|
|
} ReportType;
|
|
|
|
/** Sends response \a r (from #ReportType) to client \a c. */
|
|
#ifdef USE_SSL
|
|
#define sendheader(c, r) \
|
|
ssl_send(c, HeaderMessages[(r)].message, HeaderMessages[(r)].length)
|
|
#else
|
|
#define sendheader(c, r) \
|
|
send(cli_fd(c), HeaderMessages[(r)].message, HeaderMessages[(r)].length, 0)
|
|
#endif /* USE_SSL */
|
|
|
|
/** Enumeration of IAuth connection flags. */
|
|
enum IAuthFlag
|
|
{
|
|
IAUTH_BLOCKED, /**< socket buffer full */
|
|
IAUTH_CLOSING, /**< candidate to be disposed */
|
|
/* The following flags are controlled by iauth's "O" options command. */
|
|
IAUTH_ADDLINFO, /**< Send additional info
|
|
* (password and username). */
|
|
IAUTH_FIRST_OPTION = IAUTH_ADDLINFO, /**< First flag that is a policy option. */
|
|
IAUTH_REQUIRED, /**< IAuth completion required for registration. */
|
|
IAUTH_TIMEOUT, /**< Refuse new connections if IAuth is behind. */
|
|
IAUTH_EXTRAWAIT, /**< Give IAuth extra time to answer. */
|
|
IAUTH_UNDERNET, /**< Enable Undernet extensions. */
|
|
IAUTH_WEBIRC, /**< Enable Nefarious WEBIRC extensions. */
|
|
IAUTH_SSLFP, /**< Enable Nefarious SSL client certificate fingerprint notifcation. */
|
|
IAUTH_ACCOUNT, /**< Enable Nefarious SASL account notification. */
|
|
IAUTH_EVENTS, /**< Enable Nefarious Event notifications. */
|
|
IAUTH_SASL, /**< Enable SASL authentication handling in IAuth. */
|
|
IAUTH_LAST_FLAG /**< total number of flags */
|
|
};
|
|
/** Declare a bitset structure indexed by IAuthFlag. */
|
|
DECLARE_FLAGSET(IAuthFlags, IAUTH_LAST_FLAG);
|
|
|
|
/** Describes state of an IAuth connection. */
|
|
struct IAuth {
|
|
struct MsgQ i_sendQ; /**< messages queued to send */
|
|
struct Socket i_socket; /**< main socket to iauth */
|
|
struct Socket i_stderr; /**< error socket for iauth */
|
|
struct IAuthFlags i_flags; /**< connection state/status/flags */
|
|
uint64_t i_recvB; /**< bytes received */
|
|
uint64_t i_sendB; /**< bytes sent */
|
|
time_t started; /**< time that this instance was started */
|
|
unsigned int i_recvM; /**< messages received */
|
|
unsigned int i_sendM; /**< messages sent */
|
|
unsigned int i_count; /**< characters used in i_buffer */
|
|
unsigned int i_errcount; /**< characters used in i_errbuf */
|
|
int i_debug; /**< debug level */
|
|
char i_buffer[BUFSIZE+1]; /**< partial unprocessed line from server */
|
|
char i_errbuf[BUFSIZE+1]; /**< partial unprocessed error line */
|
|
char *i_version; /**< iauth version string */
|
|
struct SLink *i_config; /**< configuration string list */
|
|
struct SLink *i_stats; /**< statistics string list */
|
|
char **i_argv; /**< argument list */
|
|
int i_argc; /**< number of arguments in argument list */
|
|
};
|
|
|
|
/** Return whether flag \a flag is set on \a iauth. */
|
|
#define IAuthHas(iauth, flag) ((iauth) && FlagHas(&(iauth)->i_flags, flag))
|
|
/** Set flag \a flag on \a iauth. */
|
|
#define IAuthSet(iauth, flag) FlagSet(&(iauth)->i_flags, flag)
|
|
/** Clear flag \a flag from \a iauth. */
|
|
#define IAuthClr(iauth, flag) FlagClr(&(iauth)->i_flags, flag)
|
|
/** Get connected flag for \a iauth. */
|
|
#define i_GetConnected(iauth) ((iauth) && s_fd(i_socket(iauth)) > -1)
|
|
|
|
/** Return socket event generator for \a iauth. */
|
|
#define i_socket(iauth) (&(iauth)->i_socket)
|
|
/** Return stderr socket for \a iauth. */
|
|
#define i_stderr(iauth) (&(iauth)->i_stderr)
|
|
/** Return outbound message queue for \a iauth. */
|
|
#define i_sendQ(iauth) (&(iauth)->i_sendQ)
|
|
/** Return debug level for \a iauth. */
|
|
#define i_debug(iauth) ((iauth)->i_debug)
|
|
|
|
/** Active instance of IAuth. */
|
|
static struct IAuth *iauth;
|
|
/** Freelist of AuthRequest structures. */
|
|
static struct AuthRequest *auth_freelist;
|
|
|
|
static void iauth_sock_callback(struct Event *ev);
|
|
static void iauth_stderr_callback(struct Event *ev);
|
|
static int sendto_iauth(struct Client *cptr, const char *format, ...);
|
|
static int preregister_user(struct Client *cptr);
|
|
typedef int (*iauth_cmd_handler)(struct IAuth *iauth, struct Client *cli,
|
|
int parc, char **params);
|
|
|
|
/** Copies a username, cleaning it in the process.
|
|
*
|
|
* @param[out] dest Destination buffer for user name.
|
|
* @param[in] src Source buffer for user name. Must be distinct from
|
|
* \a dest.
|
|
*/
|
|
void clean_username(char *dest, const char *src)
|
|
{
|
|
int rlen = USERLEN;
|
|
char ch;
|
|
|
|
/* First character can be ~, later characters cannot. */
|
|
if (!IsCntrl(*src))
|
|
{
|
|
ch = *src++;
|
|
*dest++ = IsUserChar(ch) ? ch : '_';
|
|
rlen--;
|
|
}
|
|
while (rlen-- && !IsCntrl(ch = *src++))
|
|
{
|
|
*dest++ = (IsUserChar(ch) && (ch != '~')) ? ch : '_';
|
|
}
|
|
*dest = '\0';
|
|
}
|
|
|
|
/** Set username for user associated with \a auth.
|
|
* @param[in] auth Client authorization request to work on.
|
|
* @return Zero if client is kept, CPTR_KILLED if client rejected.
|
|
*/
|
|
static int auth_set_username(struct AuthRequest *auth)
|
|
{
|
|
struct Client *sptr = auth->client;
|
|
struct User *user = cli_user(sptr);
|
|
char *d;
|
|
char *s;
|
|
int killreason;
|
|
short upper = 0;
|
|
short lower = 0;
|
|
short leadcaps = 0;
|
|
short other = 0;
|
|
short digits = 0;
|
|
short digitgroups = 0;
|
|
char ch;
|
|
char last;
|
|
|
|
if (FlagHas(&auth->flags, AR_IAUTH_FUSERNAME))
|
|
{
|
|
ircd_strncpy(user->username, cli_username(sptr), USERLEN + 1);
|
|
}
|
|
else if (IsIdented(sptr))
|
|
{
|
|
clean_username(user->username, cli_username(sptr));
|
|
}
|
|
else if (HasFlag(sptr, FLAG_DOID))
|
|
{
|
|
/* Prepend ~ to user->username. */
|
|
s = user->username;
|
|
s[USERLEN-1] = '\0';
|
|
for (last = '~'; last != '\0'; )
|
|
{
|
|
ch = *s;
|
|
*s++ = last;
|
|
last = ch;
|
|
}
|
|
*s = '\0';
|
|
} /* else cleaned version of client-provided name is in place */
|
|
|
|
/* If username is empty or just ~, reject. */
|
|
if ((user->username[0] == '\0')
|
|
|| ((user->username[0] == '~') && (user->username[1] == '\0')))
|
|
return exit_client(sptr, sptr, &me, "USER: Bogus userid.");
|
|
|
|
/* Check for K-, G- or Z-line. */
|
|
killreason = find_kill(sptr);
|
|
if (killreason) {
|
|
ServerStats->is_ref++;
|
|
return exit_client(sptr, sptr, &me,
|
|
(killreason == -1 ? "K-lined" :
|
|
(killreason == -2 ? "G-lined" : "Z-lined")));
|
|
}
|
|
|
|
if (!FlagHas(&auth->flags, AR_IAUTH_FUSERNAME))
|
|
{
|
|
/* Check for mixed case usernames, meaning probably hacked. Jon2 3-94
|
|
* Explanations of rules moved to where it is checked Entrope 2-06
|
|
*/
|
|
s = d = user->username + (user->username[0] == '~');
|
|
for (last = '\0';
|
|
(ch = *d++) != '\0';
|
|
last = ch)
|
|
{
|
|
if (IsLower(ch))
|
|
{
|
|
lower++;
|
|
}
|
|
else if (IsUpper(ch))
|
|
{
|
|
upper++;
|
|
/* Accept caps as leading if we haven't seen lower case or digits yet. */
|
|
if ((leadcaps || last == '\0') && !lower && !digits)
|
|
leadcaps++;
|
|
}
|
|
else if (IsDigit(ch))
|
|
{
|
|
digits++;
|
|
if (!IsDigit(last))
|
|
{
|
|
digitgroups++;
|
|
/* If more than two groups of digits, reject. */
|
|
if (digitgroups > 2)
|
|
goto badid;
|
|
}
|
|
}
|
|
else if (ch == '-' || ch == '_' || ch == '.')
|
|
{
|
|
other++;
|
|
/* If -_. exist at start, consecutively, or more than twice, reject. */
|
|
if (last == '\0' || last == '-' || last == '_' || last == '.' || other > 2)
|
|
goto badid;
|
|
}
|
|
else /* All other punctuation is rejected. */
|
|
goto badid;
|
|
}
|
|
|
|
/* If mixed case, first must be capital, but no more than three;
|
|
* but if three capitals, they must all be leading. */
|
|
if (lower && upper && (!leadcaps || leadcaps > 3 ||
|
|
(upper > 2 && upper > leadcaps)))
|
|
goto badid;
|
|
/* If two different groups of digits, one must be either at the
|
|
* start or end. */
|
|
if (digitgroups == 2 && !(IsDigit(s[0]) || IsDigit(ch)))
|
|
goto badid;
|
|
/* Must have at least one letter. */
|
|
if (!lower && !upper)
|
|
goto badid;
|
|
/* Final character must not be punctuation. */
|
|
if (!IsAlnum(last))
|
|
goto badid;
|
|
}
|
|
|
|
return 0;
|
|
|
|
badid:
|
|
/* If we confirmed their username, and it is what they claimed,
|
|
* accept it. */
|
|
if (IsIdented(sptr) && !strcmp(cli_username(sptr), user->username))
|
|
return 0;
|
|
|
|
if (!feature_bool(FEAT_STRICTUSERNAME))
|
|
return 0;
|
|
|
|
ServerStats->is_ref++;
|
|
send_reply(sptr, SND_EXPLICIT | ERR_INVALIDUSERNAME,
|
|
":Your username is invalid.");
|
|
send_reply(sptr, SND_EXPLICIT | ERR_INVALIDUSERNAME,
|
|
":Connect with your real username, in lowercase.");
|
|
send_reply(sptr, SND_EXPLICIT | ERR_INVALIDUSERNAME,
|
|
":If your mail address were foo@bar.com, your username "
|
|
"would be foo.");
|
|
return exit_client(sptr, sptr, &me, "USER: Bad username");
|
|
}
|
|
|
|
void auth_end_loc(struct AuthRequest *auth)
|
|
{
|
|
if (!auth)
|
|
return;
|
|
|
|
if (t_active(&auth->loctimeout))
|
|
timer_del(&auth->loctimeout);
|
|
}
|
|
|
|
/** Timeout a given auth request.
|
|
* @param[in] ev A timer event whose associated data is the expired
|
|
* struct AuthRequest.
|
|
*/
|
|
static void auth_loc_timeout_callback(struct Event* ev)
|
|
{
|
|
struct AuthRequest *auth;
|
|
struct Client *cptr;
|
|
|
|
assert(0 != ev_timer(ev));
|
|
assert(0 != t_data(ev_timer(ev)));
|
|
|
|
if (ev_type(ev) == ET_EXPIRE) {
|
|
auth = (struct AuthRequest*) t_data(ev_timer(ev));
|
|
cptr = auth->client;
|
|
|
|
if (!cli_loc(cptr))
|
|
return;
|
|
|
|
sendcmdto_one(&me, CMD_NOTICE, cptr, "%s :Service '%s' is not available (timeout)",
|
|
(cli_name(cptr) ? cli_name(cptr) : "*"), cli_loc(cptr)->service);
|
|
sendcmdto_one(&me, CMD_NOTICE, cptr, "%s :Type \002/QUOTE PASS\002 to "
|
|
"connect anyway", (cli_name(cptr) ? cli_name(cptr) : "*"));
|
|
}
|
|
}
|
|
|
|
static void auth_complete_sasl(struct Client *client)
|
|
{
|
|
if (IsSASLComplete(client) && cli_saslaccount(client)[0]) {
|
|
if (cli_saslacccreate(client))
|
|
cli_user(client)->acc_create = cli_saslacccreate(client);
|
|
ircd_strncpy(cli_user(client)->account, cli_saslaccount(client), ACCOUNTLEN + 1);
|
|
SetAccount(client);
|
|
}
|
|
|
|
abort_sasl(client, 0);
|
|
}
|
|
|
|
static void auth_do_loc(struct Client *client, struct Client *service)
|
|
{
|
|
/* If a cookie already exists, we're already doing LOC */
|
|
if (cli_loc(client)->cookie)
|
|
return;
|
|
|
|
/* the cookie is used to verify replies from the service, in case the
|
|
* client disconnects and the fd is reused
|
|
*/
|
|
do {
|
|
cli_loc(client)->cookie = ircrandom() & 0x7fffffff;
|
|
} while (!cli_loc(client)->cookie);
|
|
|
|
sendcmdto_one(&me, CMD_NOTICE, client, "%s :Attempting service login to %s",
|
|
(cli_name(client) ? cli_name(client) : "*"), cli_loc(client)->service);
|
|
|
|
if ( feature_bool(FEAT_LOC_SENDHOST) ) {
|
|
char realhost[HOSTLEN + 3];
|
|
char *hoststr = (cli_sockhost(client) ? cli_sockhost(client) : cli_sock_ip(client));
|
|
|
|
if (strchr(hoststr, ':') != NULL)
|
|
ircd_snprintf(0, realhost, sizeof(realhost), "[%s]", hoststr);
|
|
else
|
|
ircd_strncpy(realhost, hoststr, sizeof(realhost));
|
|
|
|
if (cli_sslclifp(client) && !EmptyString(cli_sslclifp(client)) && feature_bool(FEAT_LOC_SENDSSLFP)) {
|
|
sendcmdto_one(&me, CMD_ACCOUNT, service, "%C S .%u.%u %s@%s:%s %s %s :%s", service,
|
|
cli_fd(client), cli_loc(client)->cookie, cli_username(client),
|
|
realhost, cli_sock_ip(client), cli_sslclifp(client), cli_loc(client)->account,
|
|
cli_loc(client)->password);
|
|
} else {
|
|
sendcmdto_one(&me, CMD_ACCOUNT, service, "%C H .%u.%u %s@%s:%s %s :%s", service,
|
|
cli_fd(client), cli_loc(client)->cookie, cli_username(client),
|
|
realhost, cli_sock_ip(client), cli_loc(client)->account,
|
|
cli_loc(client)->password);
|
|
}
|
|
} else {
|
|
sendcmdto_one(&me, CMD_ACCOUNT, service, "%C C .%u.%u %s :%s", service,
|
|
cli_fd(client), cli_loc(client)->cookie,
|
|
cli_loc(client)->account, cli_loc(client)->password);
|
|
}
|
|
}
|
|
|
|
/** Check whether an authorization request is complete.
|
|
* This means that no flags from 0 to #AR_LAST_SCAN are set on \a auth.
|
|
* If #AR_IAUTH_PENDING is set, optionally go into "hurry" state. If
|
|
* 0 through #AR_LAST_SCAN and #AR_IAUTH_PENDING are all clear,
|
|
* destroy \a auth, clear the password, set the username, and register
|
|
* the client.
|
|
* @param[in] auth Authorization request to check.
|
|
* @return Zero if client is kept, CPTR_KILLED if client rejected.
|
|
*/
|
|
static int check_auth_finished(struct AuthRequest *auth)
|
|
{
|
|
enum AuthRequestFlag flag;
|
|
int res;
|
|
struct Client *acptr;
|
|
struct Client *cptr = auth->client;
|
|
|
|
/* Check non-iauth registration blocking flags. */
|
|
for (flag = 0; flag <= AR_LAST_SCAN; ++flag)
|
|
if (FlagHas(&auth->flags, flag))
|
|
{
|
|
Debug((DEBUG_INFO, "Auth %p [%d] still has flag %d", auth,
|
|
cli_fd(auth->client), flag));
|
|
return 0;
|
|
}
|
|
|
|
if (IsUserPort(cptr) && cli_loc(cptr)) {
|
|
if (FlagHas(&auth->flags, AR_LOC_DONE))
|
|
return 0;
|
|
FlagSet(&auth->flags, AR_LOC_DONE);
|
|
if ((acptr = FindUser(cli_loc(cptr)->service)) && IsChannelService(acptr)) {
|
|
timer_add(timer_init(&auth->loctimeout), auth_loc_timeout_callback, (void*) auth,
|
|
TT_RELATIVE, feature_int(FEAT_LOC_TIMEOUT));
|
|
auth_do_loc(cptr, acptr);
|
|
return 0;
|
|
} else {
|
|
sendcmdto_one(&me, CMD_NOTICE, cptr, "%s :Service '%s' is not available (%s)",
|
|
(cli_name(cptr) ? cli_name(cptr) : "*"), cli_loc(cptr)->service,
|
|
(acptr ? "not a service" : "no such service"));
|
|
sendcmdto_one(&me, CMD_NOTICE, cptr, "%s :Type \002/QUOTE PASS\002 to "
|
|
"connect anyway", (cli_name(cptr) ? cli_name(cptr) : "*"));
|
|
return 0;
|
|
}
|
|
}
|
|
|
|
/* Finish off SASL. */
|
|
if (IsUserPort(auth->client))
|
|
auth_complete_sasl(auth->client);
|
|
|
|
/* If appropriate, do preliminary assignment to connection class. */
|
|
if (IsUserPort(auth->client)
|
|
&& !FlagHas(&auth->flags, AR_IAUTH_HURRY)
|
|
&& preregister_user(auth->client))
|
|
return CPTR_KILLED;
|
|
|
|
/* If we have not done so, check client password. Do this as soon
|
|
* as possible so that iauth's challenge/response (which uses PASS
|
|
* for responses) is not confused with the client's password.
|
|
*/
|
|
if (IsUserPort(auth->client)
|
|
&& !FlagHas(&auth->flags, AR_PASSWORD_CHECKED))
|
|
{
|
|
struct ConfItem *aconf;
|
|
|
|
aconf = cli_confs(auth->client)->value.aconf;
|
|
|
|
if (!verify_sslclifp(auth->client, aconf))
|
|
{
|
|
ServerStats->is_ref++;
|
|
send_reply(auth->client, ERR_SSLCLIFP);
|
|
return exit_client(auth->client, auth->client, &me, "SSL fingerprint mismatch");
|
|
}
|
|
|
|
if (aconf
|
|
&& !EmptyString(aconf->passwd)
|
|
&& strcmp(cli_passwd(auth->client), aconf->passwd))
|
|
{
|
|
ServerStats->is_ref++;
|
|
send_reply(auth->client, ERR_PASSWDMISMATCH);
|
|
return exit_client(auth->client, auth->client, &me, "Bad Password");
|
|
}
|
|
FlagSet(&auth->flags, AR_PASSWORD_CHECKED);
|
|
}
|
|
|
|
/* Check if iauth is done. */
|
|
if (FlagHas(&auth->flags, AR_IAUTH_PENDING))
|
|
{
|
|
/* Switch auth request to hurry-up state. */
|
|
if (!FlagHas(&auth->flags, AR_IAUTH_HURRY))
|
|
{
|
|
/* Set "hurry" flag in auth request. */
|
|
FlagSet(&auth->flags, AR_IAUTH_HURRY);
|
|
|
|
/* If iauth wants it, send notification. */
|
|
if (IAuthHas(iauth, IAUTH_UNDERNET))
|
|
sendto_iauth(auth->client, "H %s", get_client_class(auth->client));
|
|
|
|
/* If iauth wants it, give client more time. */
|
|
if (IAuthHas(iauth, IAUTH_EXTRAWAIT))
|
|
cli_firsttime(auth->client) = CurrentTime;
|
|
}
|
|
|
|
Debug((DEBUG_INFO, "Auth %p [%d] still has flag %d", auth,
|
|
cli_fd(auth->client), AR_IAUTH_PENDING));
|
|
return 0;
|
|
}
|
|
else
|
|
FlagSet(&auth->flags, AR_IAUTH_HURRY);
|
|
|
|
if (IsUserPort(auth->client))
|
|
{
|
|
memset(cli_passwd(auth->client), 0, sizeof(cli_passwd(auth->client)));
|
|
res = auth_set_username(auth);
|
|
if (res == 0)
|
|
res = register_user(auth->client, auth->client);
|
|
}
|
|
else
|
|
res = 0;
|
|
if (res == 0)
|
|
destroy_auth_request(auth);
|
|
return res;
|
|
}
|
|
|
|
/** Verify that a hostname is valid, i.e., only contains characters
|
|
* valid for a hostname and that a hostname is not too long.
|
|
* @param host Hostname to check.
|
|
* @param maxlen Maximum length of hostname, not including NUL terminator.
|
|
* @return Non-zero if the hostname is valid.
|
|
*/
|
|
static int
|
|
auth_verify_hostname(const char *host, int maxlen)
|
|
{
|
|
int i;
|
|
|
|
/* Walk through the host name */
|
|
for (i = 0; host[i]; i++)
|
|
/* If it's not a hostname character or if it's too long, return false */
|
|
if (!IsHostChar(host[i]) || i >= maxlen)
|
|
return 0;
|
|
|
|
return 1; /* it's a valid hostname */
|
|
}
|
|
|
|
/** Check whether a client already has a CONF_CLIENT configuration
|
|
* item.
|
|
*
|
|
* @return A pointer to the client's first CONF_CLIENT, or NULL if
|
|
* there are none.
|
|
*/
|
|
static struct ConfItem *find_conf_client(struct Client *cptr)
|
|
{
|
|
struct SLink *list;
|
|
|
|
for (list = cli_confs(cptr); list != NULL; list = list->next) {
|
|
struct ConfItem *aconf;
|
|
aconf = list->value.aconf;
|
|
if (aconf->status & CONF_CLIENT)
|
|
return aconf;
|
|
}
|
|
|
|
return NULL;
|
|
}
|
|
|
|
/** Assign a client to a connection class.
|
|
* @param[in] cptr Client to assign to a class.
|
|
* @return Zero if client is kept, CPTR_KILLED if rejected.
|
|
*/
|
|
static int preregister_user(struct Client *cptr)
|
|
{
|
|
static time_t last_too_many1;
|
|
static time_t last_too_many2;
|
|
|
|
ircd_strncpy(cli_user(cptr)->host, cli_sockhost(cptr), HOSTLEN + 1);
|
|
ircd_strncpy(cli_user(cptr)->realhost, cli_sockhost(cptr), HOSTLEN + 1);
|
|
|
|
/* Set client's GeoIP data */
|
|
geoip_apply(cptr);
|
|
|
|
if (find_conf_client(cptr)) {
|
|
return 0;
|
|
}
|
|
|
|
switch (conf_check_client(cptr))
|
|
{
|
|
case ACR_OK:
|
|
break;
|
|
case ACR_NO_AUTHORIZATION:
|
|
sendto_opmask_butone(0, SNO_UNAUTH, "Unauthorized connection from %s.",
|
|
get_client_name(cptr, HIDE_IP));
|
|
++ServerStats->is_ref;
|
|
return exit_client(cptr, cptr, &me,
|
|
"No Authorization - use another server");
|
|
case ACR_TOO_MANY_IN_CLASS:
|
|
sendto_opmask_butone_ratelimited(0, SNO_TOOMANY, &last_too_many1,
|
|
"Too many connections in class %s for %s.",
|
|
get_client_class(cptr),
|
|
get_client_name(cptr, SHOW_IP));
|
|
++ServerStats->is_ref;
|
|
return exit_client(cptr, cptr, &me,
|
|
"Sorry, your connection class is full - try "
|
|
"again later or try another server");
|
|
case ACR_TOO_MANY_FROM_IP:
|
|
sendto_opmask_butone_ratelimited(0, SNO_TOOMANY, &last_too_many2,
|
|
"Too many connections from same IP for %s.",
|
|
get_client_name(cptr, SHOW_IP));
|
|
++ServerStats->is_ref;
|
|
return exit_client(cptr, cptr, &me,
|
|
"Too many connections from your host");
|
|
case ACR_ALREADY_AUTHORIZED:
|
|
/* Can this ever happen? */
|
|
case ACR_BAD_SOCKET:
|
|
++ServerStats->is_ref;
|
|
if (IsIPChecked(cptr))
|
|
IPcheck_connect_fail(cptr, 0);
|
|
return exit_client(cptr, cptr, &me, "Unknown error -- Try again");
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
/** Send the ident server a query giving "theirport , ourport". The
|
|
* write is only attempted *once* so it is deemed to be a fail if the
|
|
* entire write doesn't write all the data given. This shouldn't be a
|
|
* problem since the socket should have a write buffer far greater
|
|
* than this message to store it in should problems arise. -avalon
|
|
* @param[in] auth The request to send.
|
|
*/
|
|
static void send_auth_query(struct AuthRequest* auth)
|
|
{
|
|
char authbuf[32];
|
|
unsigned int count;
|
|
|
|
assert(0 != auth);
|
|
|
|
ircd_snprintf(0, authbuf, sizeof(authbuf), "%hu , %hu\r\n",
|
|
auth->port, auth->local.port);
|
|
|
|
if (IO_SUCCESS != os_send_nonb(s_fd(&auth->socket), authbuf, strlen(authbuf), &count)) {
|
|
close(s_fd(&auth->socket));
|
|
socket_del(&auth->socket);
|
|
s_fd(&auth->socket) = -1;
|
|
++ServerStats->is_abad;
|
|
if (IsUserPort(auth->client))
|
|
sendheader(auth->client, REPORT_FAIL_ID);
|
|
FlagClr(&auth->flags, AR_AUTH_PENDING);
|
|
check_auth_finished(auth);
|
|
}
|
|
}
|
|
|
|
/** Enum used to index ident reply fields in a human-readable way. */
|
|
enum IdentReplyFields {
|
|
IDENT_PORT_NUMBERS,
|
|
IDENT_REPLY_TYPE,
|
|
IDENT_OS_TYPE,
|
|
IDENT_INFO,
|
|
USERID_TOKEN_COUNT
|
|
};
|
|
|
|
/** Parse an ident reply line and extract the userid from it.
|
|
* @param[in] reply The ident reply line.
|
|
* @return The userid, or NULL on parse failure.
|
|
*/
|
|
static char* check_ident_reply(char* reply)
|
|
{
|
|
char* token;
|
|
char* end;
|
|
char* vector[USERID_TOKEN_COUNT];
|
|
int count = token_vector(reply, ':', vector, USERID_TOKEN_COUNT);
|
|
|
|
if (USERID_TOKEN_COUNT != count)
|
|
return 0;
|
|
/*
|
|
* second token is the reply type
|
|
*/
|
|
token = vector[IDENT_REPLY_TYPE];
|
|
if (EmptyString(token))
|
|
return 0;
|
|
|
|
while (IsSpace(*token))
|
|
++token;
|
|
|
|
if (0 != strncmp(token, "USERID", 6))
|
|
return 0;
|
|
|
|
/*
|
|
* third token is the os type
|
|
*/
|
|
token = vector[IDENT_OS_TYPE];
|
|
if (EmptyString(token))
|
|
return 0;
|
|
while (IsSpace(*token))
|
|
++token;
|
|
|
|
/*
|
|
* Unless "OTHER" is specified as the operating system
|
|
* type, the server is expected to return the "normal"
|
|
* user identification of the owner of this connection.
|
|
* "Normal" in this context may be taken to mean a string
|
|
* of characters which uniquely identifies the connection
|
|
* owner such as a user identifier assigned by the system
|
|
* administrator and used by such user as a mail
|
|
* identifier, or as the "user" part of a user/password
|
|
* pair used to gain access to system resources. When an
|
|
* operating system is specified (e.g., anything but
|
|
* "OTHER"), the user identifier is expected to be in a
|
|
* more or less immediately useful form - e.g., something
|
|
* that could be used as an argument to "finger" or as a
|
|
* mail address.
|
|
*/
|
|
if (0 == strncmp(token, "OTHER", 5))
|
|
return 0;
|
|
/*
|
|
* fourth token is the username
|
|
*/
|
|
token = vector[IDENT_INFO];
|
|
if (EmptyString(token))
|
|
return 0;
|
|
while (IsSpace(*token))
|
|
++token;
|
|
/*
|
|
* look for the end of the username, terminators are '\0, @, <SPACE>, :'
|
|
*/
|
|
for (end = token; *end; ++end) {
|
|
if (IsSpace(*end) || '@' == *end || ':' == *end)
|
|
break;
|
|
}
|
|
*end = '\0';
|
|
return token;
|
|
}
|
|
|
|
/** Read the reply (if any) from the ident server we connected to. We
|
|
* only give it one shot, if the reply isn't good the first time fail
|
|
* the authentication entirely. --Bleep
|
|
* @param[in] auth The request to read.
|
|
*/
|
|
static void read_auth_reply(struct AuthRequest* auth)
|
|
{
|
|
char* username = 0;
|
|
unsigned int len;
|
|
/*
|
|
* rfc1453 sez we MUST accept 512 bytes
|
|
*/
|
|
char buf[BUFSIZE + 1];
|
|
|
|
assert(0 != auth);
|
|
assert(0 != auth->client);
|
|
assert(auth == cli_auth(auth->client));
|
|
|
|
if (IO_SUCCESS == os_recv_nonb(s_fd(&auth->socket), buf, BUFSIZE, &len)) {
|
|
buf[len] = '\0';
|
|
Debug((DEBUG_INFO, "Auth %p [%d] reply: %s", auth, cli_fd(auth->client), buf));
|
|
username = check_ident_reply(buf);
|
|
Debug((DEBUG_INFO, "Username: %s", username));
|
|
}
|
|
|
|
Debug((DEBUG_INFO, "Deleting auth [%d] socket %p", auth, cli_fd(auth->client)));
|
|
close(s_fd(&auth->socket));
|
|
socket_del(&auth->socket);
|
|
s_fd(&auth->socket) = -1;
|
|
|
|
if (EmptyString(username)) {
|
|
if (IsUserPort(auth->client))
|
|
sendheader(auth->client, REPORT_FAIL_ID);
|
|
++ServerStats->is_abad;
|
|
if (IAuthHas(iauth, IAUTH_UNDERNET))
|
|
sendto_iauth(auth->client, "u");
|
|
} else {
|
|
if (IsUserPort(auth->client))
|
|
sendheader(auth->client, REPORT_FIN_ID);
|
|
++ServerStats->is_asuc;
|
|
if (!FlagHas(&auth->flags, AR_IAUTH_USERNAME)) {
|
|
ircd_strncpy(cli_username(auth->client), username, USERLEN + 1);
|
|
SetGotId(auth->client);
|
|
}
|
|
if (IAuthHas(iauth, IAUTH_UNDERNET))
|
|
sendto_iauth(auth->client, "u %s", username);
|
|
}
|
|
|
|
FlagClr(&auth->flags, AR_AUTH_PENDING);
|
|
check_auth_finished(auth);
|
|
}
|
|
|
|
/** Handle socket I/O activity.
|
|
* @param[in] ev A socket event whos associated data is the active
|
|
* struct AuthRequest.
|
|
*/
|
|
static void auth_sock_callback(struct Event* ev)
|
|
{
|
|
struct AuthRequest* auth;
|
|
|
|
assert(0 != ev_socket(ev));
|
|
assert(0 != s_data(ev_socket(ev)));
|
|
|
|
auth = (struct AuthRequest*) s_data(ev_socket(ev));
|
|
|
|
switch (ev_type(ev)) {
|
|
case ET_DESTROY: /* being destroyed */
|
|
break;
|
|
|
|
case ET_CONNECT: /* socket connection completed */
|
|
Debug((DEBUG_INFO, "Connection completed for auth %p [%d]; sending query",
|
|
auth, cli_fd(auth->client)));
|
|
socket_state(&auth->socket, SS_CONNECTED);
|
|
send_auth_query(auth);
|
|
break;
|
|
|
|
case ET_READ: /* socket is readable */
|
|
case ET_EOF: /* end of file on socket */
|
|
case ET_ERROR: /* error on socket */
|
|
Debug((DEBUG_INFO, "Auth socket %p [%p] readable", auth, ev_socket(ev)));
|
|
read_auth_reply(auth);
|
|
break;
|
|
|
|
default:
|
|
assert(0 && "Unrecognized event in auth_socket_callback().");
|
|
break;
|
|
}
|
|
}
|
|
|
|
/** Stop an auth request completely.
|
|
* @param[in] auth The struct AuthRequest to cancel.
|
|
*/
|
|
void destroy_auth_request(struct AuthRequest* auth)
|
|
{
|
|
Debug((DEBUG_INFO, "Deleting auth request for %p", auth->client));
|
|
|
|
if (FlagHas(&auth->flags, AR_DNS_PENDING)) {
|
|
delete_resolver_queries(auth);
|
|
}
|
|
|
|
if (-1 < s_fd(&auth->socket)) {
|
|
close(s_fd(&auth->socket));
|
|
socket_del(&auth->socket);
|
|
s_fd(&auth->socket) = -1;
|
|
}
|
|
|
|
if (t_active(&auth->timeout))
|
|
timer_del(&auth->timeout);
|
|
|
|
if (t_active(&auth->loctimeout))
|
|
timer_del(&auth->loctimeout);
|
|
|
|
cli_auth(auth->client) = NULL;
|
|
auth->next = auth_freelist;
|
|
auth_freelist = auth;
|
|
}
|
|
|
|
/** Handle a 'ping' (authorization) timeout for a client.
|
|
* @param[in] cptr The client whose session authorization has timed out.
|
|
* @return Zero if client is kept, CPTR_KILLED if client rejected.
|
|
*/
|
|
int auth_ping_timeout(struct Client *cptr)
|
|
{
|
|
struct AuthRequest *auth;
|
|
enum AuthRequestFlag flag;
|
|
|
|
auth = cli_auth(cptr);
|
|
|
|
/* Check whether the auth request is gone (more likely, it never
|
|
* existed, as in an outbound server connection). */
|
|
if (!auth || cli_loc(cptr))
|
|
return exit_client_msg(cptr, cptr, &me, "Registration Timeout");
|
|
|
|
/* Check for a user-controlled timeout. */
|
|
for (flag = 0; flag <= AR_LAST_SCAN; ++flag) {
|
|
if (FlagHas(&auth->flags, flag)) {
|
|
/* Display message if they have sent a NICK and a USER but no
|
|
* nospoof PONG.
|
|
*/
|
|
if (*(cli_name(cptr)) && cli_user(cptr) && *(cli_user(cptr))->username) {
|
|
send_reply(cptr, SND_EXPLICIT | ERR_BADPING,
|
|
":Your client may not be compatible with this server.");
|
|
send_reply(cptr, SND_EXPLICIT | ERR_BADPING,
|
|
":Compatible clients are available at %s",
|
|
feature_str(FEAT_URL_CLIENTS));
|
|
}
|
|
return exit_client_msg(cptr, cptr, &me, "Registration Timeout");
|
|
}
|
|
}
|
|
|
|
/* Check for iauth timeout. */
|
|
if (FlagHas(&auth->flags, AR_IAUTH_PENDING)) {
|
|
if (IAuthHas(iauth, IAUTH_REQUIRED)
|
|
&& !FlagHas(&auth->flags, AR_IAUTH_SOFT_DONE)) {
|
|
sendheader(cptr, REPORT_FAIL_IAUTH);
|
|
return exit_client_msg(cptr, cptr, &me, "Authorization Timeout");
|
|
}
|
|
sendto_iauth(cptr, "T");
|
|
FlagClr(&auth->flags, AR_IAUTH_PENDING);
|
|
return check_auth_finished(auth);
|
|
}
|
|
|
|
assert(0 && "Unexpectedly reached end of auth_ping_timeout()");
|
|
return 0;
|
|
}
|
|
|
|
/** Timeout a given auth request.
|
|
* @param[in] ev A timer event whose associated data is the expired
|
|
* struct AuthRequest.
|
|
*/
|
|
static void auth_timeout_callback(struct Event* ev)
|
|
{
|
|
struct AuthRequest* auth;
|
|
|
|
assert(0 != ev_timer(ev));
|
|
assert(0 != t_data(ev_timer(ev)));
|
|
|
|
auth = (struct AuthRequest*) t_data(ev_timer(ev));
|
|
|
|
if (ev_type(ev) == ET_EXPIRE) {
|
|
/* Report the timeout in the log. */
|
|
log_write(LS_RESOLVER, L_INFO, 0, "Registration timeout %s",
|
|
get_client_name(auth->client, HIDE_IP));
|
|
|
|
/* Notify client if ident lookup failed. */
|
|
if (FlagHas(&auth->flags, AR_AUTH_PENDING)) {
|
|
FlagClr(&auth->flags, AR_AUTH_PENDING);
|
|
if (IsUserPort(auth->client))
|
|
sendheader(auth->client, REPORT_FAIL_ID);
|
|
}
|
|
|
|
/* Likewise if dns lookup failed. */
|
|
if (FlagHas(&auth->flags, AR_DNS_PENDING)) {
|
|
FlagClr(&auth->flags, AR_DNS_PENDING);
|
|
delete_resolver_queries(auth);
|
|
if (IsUserPort(auth->client))
|
|
sendheader(auth->client, REPORT_FAIL_DNS);
|
|
}
|
|
|
|
/* Try to register the client. */
|
|
check_auth_finished(auth);
|
|
}
|
|
}
|
|
|
|
/** Handle a complete DNS lookup. Send the client on it's way to a
|
|
* connection completion, regardless of success or failure -- unless
|
|
* there was a mismatch and KILL_IPMISMATCH is set.
|
|
* @param[in] vptr The pending struct AuthRequest.
|
|
* @param[in] addr IP address being resolved.
|
|
* @param[in] h_name Resolved name, or NULL if lookup failed.
|
|
*/
|
|
static void auth_dns_callback(void* vptr, const struct irc_in_addr *addr, const char *h_name)
|
|
{
|
|
struct AuthRequest* auth = (struct AuthRequest*) vptr;
|
|
assert(0 != auth);
|
|
|
|
FlagClr(&auth->flags, AR_DNS_PENDING);
|
|
if (!addr) {
|
|
/* DNS entry was missing for the IP. */
|
|
if (IsUserPort(auth->client))
|
|
sendheader(auth->client, REPORT_FAIL_DNS);
|
|
sendto_iauth(auth->client, "d");
|
|
} else if (!irc_in_addr_valid(addr)
|
|
|| (irc_in_addr_cmp(&cli_ip(auth->client), addr)
|
|
&& irc_in_addr_cmp(&auth->original, addr))) {
|
|
/* IP for hostname did not match client's IP. */
|
|
sendto_opmask_butone(0, SNO_IPMISMATCH, "IP# Mismatch: %s != %s[%s]",
|
|
cli_sock_ip(auth->client), h_name,
|
|
ircd_ntoa(addr));
|
|
if (IsUserPort(auth->client))
|
|
sendheader(auth->client, REPORT_IP_MISMATCH);
|
|
if (feature_bool(FEAT_KILL_IPMISMATCH)) {
|
|
exit_client(auth->client, auth->client, &me, "IP mismatch");
|
|
return;
|
|
}
|
|
} else if (!auth_verify_hostname(h_name, HOSTLEN)) {
|
|
/* Hostname did not look valid. */
|
|
if (IsUserPort(auth->client))
|
|
sendheader(auth->client, REPORT_INVAL_DNS);
|
|
sendto_iauth(auth->client, "d");
|
|
} else {
|
|
/* Hostname and mappings checked out. */
|
|
if (IsUserPort(auth->client))
|
|
sendheader(auth->client, REPORT_FIN_DNS);
|
|
if (IsIPSpoofed(auth->client))
|
|
ircd_strncpy(cli_connecthost(auth->client), h_name, HOSTLEN + 1);
|
|
else
|
|
ircd_strncpy(cli_sockhost(auth->client), h_name, HOSTLEN + 1);
|
|
sendto_iauth(auth->client, "N %s", h_name);
|
|
}
|
|
check_auth_finished(auth);
|
|
}
|
|
|
|
/** Flag the client to show an attempt to contact the ident server on
|
|
* the client's host. Should the connect or any later phase of the
|
|
* identifying process fail, it is aborted and the user is given a
|
|
* username of "unknown".
|
|
* @param[in] auth The request for which to start the ident lookup.
|
|
*/
|
|
static void start_auth_query(struct AuthRequest* auth)
|
|
{
|
|
struct irc_sockaddr remote_addr;
|
|
struct irc_sockaddr local_addr;
|
|
int fd;
|
|
IOResult result;
|
|
|
|
assert(0 != auth);
|
|
assert(0 != auth->client);
|
|
|
|
if (feature_bool(FEAT_NOIDENT) || find_except_conf(auth->client, EFLAG_IDENT))
|
|
return;
|
|
|
|
/*
|
|
* get the local address of the client and bind to that to
|
|
* make the auth request. This used to be done only for
|
|
* ifdef VIRTUAL_HOST, but needs to be done for all clients
|
|
* since the ident request must originate from that same address--
|
|
* and machines with multiple IP addresses are common now
|
|
*/
|
|
memcpy(&local_addr, &auth->local, sizeof(local_addr));
|
|
local_addr.port = 0;
|
|
memcpy(&remote_addr.addr, &cli_ip(auth->client), sizeof(remote_addr.addr));
|
|
remote_addr.port = 113;
|
|
fd = os_socket(&local_addr, SOCK_STREAM, "auth query", 0);
|
|
if (fd < 0) {
|
|
++ServerStats->is_abad;
|
|
if (IsUserPort(auth->client))
|
|
sendheader(auth->client, REPORT_FAIL_ID);
|
|
return;
|
|
}
|
|
if (IsUserPort(auth->client))
|
|
sendheader(auth->client, REPORT_DO_ID);
|
|
|
|
if ((result = os_connect_nonb(fd, &remote_addr)) == IO_FAILURE ||
|
|
!socket_add(&auth->socket, auth_sock_callback, (void*) auth,
|
|
result == IO_SUCCESS ? SS_CONNECTED : SS_CONNECTING,
|
|
SOCK_EVENT_READABLE, fd)) {
|
|
++ServerStats->is_abad;
|
|
if (IsUserPort(auth->client))
|
|
sendheader(auth->client, REPORT_FAIL_ID);
|
|
close(fd);
|
|
return;
|
|
}
|
|
|
|
FlagSet(&auth->flags, AR_AUTH_PENDING);
|
|
if (result == IO_SUCCESS)
|
|
send_auth_query(auth);
|
|
}
|
|
|
|
/** Initiate DNS lookup for a client.
|
|
* @param[in] auth The auth request for which to start the DNS lookup.
|
|
*/
|
|
static void start_dns_query(struct AuthRequest *auth)
|
|
{
|
|
if (feature_bool(FEAT_NODNS) || find_except_conf(auth->client, EFLAG_RDNS)) {
|
|
sendto_iauth(auth->client, "d");
|
|
return;
|
|
}
|
|
|
|
if (irc_in_addr_is_loopback(&cli_ip(auth->client))) {
|
|
strcpy(cli_sockhost(auth->client), cli_name(&me));
|
|
sendto_iauth(auth->client, "N %s", cli_sockhost(auth->client));
|
|
return;
|
|
}
|
|
|
|
if (IsUserPort(auth->client))
|
|
sendheader(auth->client, REPORT_DO_DNS);
|
|
|
|
FlagSet(&auth->flags, AR_DNS_PENDING);
|
|
gethost_byaddr(&cli_ip(auth->client), auth_dns_callback, auth);
|
|
}
|
|
|
|
/** Initiate IAuth check for a client.
|
|
* @param[in] auth The auth request for which to star the IAuth check.
|
|
*/
|
|
static void start_iauth_query(struct AuthRequest *auth)
|
|
{
|
|
FlagSet(&auth->flags, AR_IAUTH_PENDING);
|
|
if (!sendto_iauth(auth->client, "C %s %hu %s %hu",
|
|
cli_sock_ip(auth->client), auth->port,
|
|
ircd_ntoa(&auth->local.addr), auth->local.port)) {
|
|
FlagClr(&auth->flags, AR_IAUTH_PENDING);
|
|
return;
|
|
}
|
|
|
|
if (IAuthHas(iauth, IAUTH_SSLFP) && cli_sslclifp(auth->client) && !EmptyString(cli_sslclifp(auth->client)))
|
|
sendto_iauth(auth->client, "F %s", cli_sslclifp(auth->client));
|
|
}
|
|
|
|
/** Starts auth (identd) and dns queries for a client.
|
|
* @param[in] client The client for which to start queries.
|
|
*/
|
|
void start_auth(struct Client* client)
|
|
{
|
|
struct irc_sockaddr remote;
|
|
struct AuthRequest* auth;
|
|
|
|
assert(0 != client);
|
|
Debug((DEBUG_INFO, "Beginning auth request on client %p", client));
|
|
|
|
/* Register with event handlers. */
|
|
cli_lasttime(client) = CurrentTime;
|
|
cli_since(client) = CurrentTime;
|
|
if (cli_fd(client) > HighestFd)
|
|
HighestFd = cli_fd(client);
|
|
LocalClientArray[cli_fd(client)] = client;
|
|
socket_events(&(cli_socket(client)), SOCK_ACTION_SET | SOCK_EVENT_READABLE);
|
|
|
|
/* Allocate the AuthRequest. */
|
|
auth = auth_freelist;
|
|
if (auth)
|
|
auth_freelist = auth->next;
|
|
else
|
|
auth = MyMalloc(sizeof(*auth));
|
|
assert(0 != auth);
|
|
memset(auth, 0, sizeof(*auth));
|
|
auth->client = client;
|
|
cli_auth(client) = auth;
|
|
s_fd(&auth->socket) = -1;
|
|
timer_add(timer_init(&auth->timeout), auth_timeout_callback, (void*) auth,
|
|
TT_RELATIVE, feature_int(FEAT_AUTH_TIMEOUT));
|
|
|
|
/* Try to get socket endpoint addresses. */
|
|
if (!os_get_sockname(cli_fd(client), &auth->local)
|
|
|| !os_get_peername(cli_fd(client), &remote)) {
|
|
++ServerStats->is_abad;
|
|
if (IsUserPort(auth->client))
|
|
sendheader(auth->client, REPORT_FAIL_ID);
|
|
exit_client(auth->client, auth->client, &me, "Socket local/peer lookup failed");
|
|
return;
|
|
}
|
|
auth->port = remote.port;
|
|
|
|
/* Set required client inputs for users. */
|
|
if (IsUserPort(client)) {
|
|
cli_user(client) = make_user(client);
|
|
cli_user(client)->server = &me;
|
|
FlagSet(&auth->flags, AR_NEEDS_USER);
|
|
FlagSet(&auth->flags, AR_NEEDS_NICK);
|
|
|
|
/* Try to start iauth lookup. */
|
|
start_iauth_query(auth);
|
|
}
|
|
|
|
/* Try to start DNS lookup. */
|
|
start_dns_query(auth);
|
|
|
|
/* Try to start ident lookup. */
|
|
start_auth_query(auth);
|
|
|
|
/* Add client to GlobalClientList. */
|
|
add_client_to_list(client);
|
|
|
|
/* Check which auth events remain pending. */
|
|
check_auth_finished(auth);
|
|
}
|
|
|
|
/** Mark that a user has PONGed while unregistered.
|
|
* @param[in] auth Authorization request for client.
|
|
* @param[in] cookie PONG cookie value sent by client.
|
|
* @return Zero if client should be kept, CPTR_KILLED if rejected.
|
|
*/
|
|
int auth_set_pong(struct AuthRequest *auth, unsigned int cookie)
|
|
{
|
|
assert(auth != NULL);
|
|
if (!FlagHas(&auth->flags, AR_NEEDS_PONG))
|
|
return 0;
|
|
if (cookie != auth->cookie)
|
|
{
|
|
send_reply(auth->client, SND_EXPLICIT | ERR_BADPING,
|
|
":To connect, type /QUOTE PONG %u", auth->cookie);
|
|
return 0;
|
|
}
|
|
cli_lasttime(auth->client) = CurrentTime;
|
|
FlagClr(&auth->flags, AR_NEEDS_PONG);
|
|
return check_auth_finished(auth);
|
|
}
|
|
|
|
/** Record a user's claimed username and userinfo.
|
|
* @param[in] auth Authorization request for client.
|
|
* @param[in] username Client's asserted username.
|
|
* @param[in] hostname Third argument of USER command (client's
|
|
* hostname, per RFC 1459).
|
|
* @param[in] servername Fourth argument of USER command (server's
|
|
* name, per RFC 1459).
|
|
* @param[in] userinfo Client's asserted self-description.
|
|
* @return Zero if client should be kept, CPTR_KILLED if rejected.
|
|
*/
|
|
int auth_set_user(struct AuthRequest *auth, const char *username, const char *hostname, const char *servername, const char *userinfo)
|
|
{
|
|
struct Client *cptr;
|
|
|
|
assert(auth != NULL);
|
|
if (FlagHas(&auth->flags, AR_IAUTH_HURRY))
|
|
return 0;
|
|
FlagClr(&auth->flags, AR_NEEDS_USER);
|
|
cptr = auth->client;
|
|
ircd_strncpy(cli_info(cptr), userinfo, REALLEN + 1);
|
|
clean_username(cli_user(cptr)->username, username);
|
|
ircd_strncpy(cli_user(cptr)->host, cli_sockhost(cptr), HOSTLEN + 1);
|
|
if (IAuthHas(iauth, IAUTH_UNDERNET))
|
|
sendto_iauth(cptr, "U %s %s %s :%s", cli_user(cptr)->username, hostname, servername, userinfo);
|
|
else if (IAuthHas(iauth, IAUTH_ADDLINFO))
|
|
sendto_iauth(cptr, "U %s", username);
|
|
return check_auth_finished(auth);
|
|
}
|
|
|
|
/** Handle authorization-related aspects of initial nickname selection.
|
|
* This is called after verifying that the nickname is available.
|
|
* @param[in] auth Authorization request for client.
|
|
* @param[in] nickname Client's requested nickname.
|
|
* @return Zero if client should be kept, CPTR_KILLED if rejected.
|
|
*/
|
|
int auth_set_nick(struct AuthRequest *auth, const char *nickname)
|
|
{
|
|
assert(auth != NULL);
|
|
FlagClr(&auth->flags, AR_NEEDS_NICK);
|
|
/*
|
|
* If the client hasn't gotten a cookie-ping yet,
|
|
* choose a cookie and send it. -record!jegelhof@cloud9.net
|
|
*/
|
|
if (!auth->cookie) {
|
|
do {
|
|
auth->cookie = ircrandom();
|
|
} while (!auth->cookie);
|
|
sendrawto_one(auth->client, "PING :%u", auth->cookie);
|
|
FlagSet(&auth->flags, AR_NEEDS_PONG);
|
|
}
|
|
if (IAuthHas(iauth, IAUTH_UNDERNET))
|
|
sendto_iauth(auth->client, "n %s", nickname);
|
|
return check_auth_finished(auth);
|
|
}
|
|
|
|
/** Record a user's password.
|
|
* @param[in] auth Authorization request for client.
|
|
* @param[in] password Client's password.
|
|
* @return Zero if client should be kept, CPTR_KILLED if rejected.
|
|
*/
|
|
int auth_set_password(struct AuthRequest *auth, const char *password)
|
|
{
|
|
assert(auth != NULL);
|
|
if (IAuthHas(iauth, IAUTH_ADDLINFO))
|
|
sendto_iauth(auth->client, "P :%s", password);
|
|
return check_auth_finished(auth);
|
|
}
|
|
|
|
/** Forward a clients WEBIRC request.
|
|
* @param[in] auth Authorization request for client.
|
|
* @param[in] password Password supplied in the WEBIRC message.
|
|
* @param[in] username User name supplied in the WEBIRC message.
|
|
* @param[in] hostname Host name supplied in the WEBIRC message.
|
|
* @param[in] ip IP address supplied in the WEBIRC message.
|
|
* @return Zero if client should be kept, -1 if not forwarded.
|
|
*/
|
|
int auth_set_webirc(struct AuthRequest *auth, const char *password, const char *username, const char *hostname, const char *ip, const char *opts)
|
|
{
|
|
assert(auth != NULL);
|
|
if (IAuthHas(iauth, IAUTH_WEBIRC))
|
|
{
|
|
if (opts != NULL)
|
|
sendto_iauth(auth->client, "W %s %s %s %s :%s", password, username, hostname, ip, opts);
|
|
else
|
|
sendto_iauth(auth->client, "W %s %s %s %s", password, username, hostname, ip);
|
|
return 0;
|
|
}
|
|
return -1;
|
|
}
|
|
|
|
/** Forward a clients SASL/LOC account name.
|
|
* @param[in] auth Authorization request for client.
|
|
* @param[in] account Account name applied to the client.
|
|
* @return Zero if client should be kept, -1 if not forwarded.
|
|
*/
|
|
int auth_set_account(struct AuthRequest *auth, const char *account)
|
|
{
|
|
assert(auth != NULL);
|
|
if (IAuthHas(iauth, IAUTH_ACCOUNT))
|
|
sendto_iauth(auth->client, "R %s", account);
|
|
return check_auth_finished(auth);
|
|
}
|
|
|
|
/** Updates a client's original IP.
|
|
* @param[in] auth Authorization request for client.
|
|
* @param[in] addr Original address to set.
|
|
*/
|
|
void auth_set_originalip(struct AuthRequest *auth, const struct irc_in_addr addr)
|
|
{
|
|
assert(auth != NULL);
|
|
|
|
if (!irc_in_addr_valid(&auth->original))
|
|
memcpy(&auth->original, &addr, sizeof(auth->original));
|
|
}
|
|
|
|
/** Forward a clients WEBIRC request.
|
|
* @param[in] auth Authorization request for client.
|
|
* @param[in] password Password supplied in the WEBIRC message.
|
|
* @param[in] username User name supplied in the WEBIRC message.
|
|
* @param[in] hostname Host name supplied in the WEBIRC message.
|
|
* @param[in] ip IP address supplied in the WEBIRC message.
|
|
* @return Zero if client should be kept, CPTR_KILLED if rejected.
|
|
*/
|
|
int auth_set_webirc_trusted(struct AuthRequest *auth, const char *password, const char *username, const char *hostname, const char *ip, const char *opts)
|
|
{
|
|
assert(auth != NULL);
|
|
if (IAuthHas(iauth, IAUTH_WEBIRC)) {
|
|
if (opts != NULL)
|
|
sendto_iauth(auth->client, "w %s %s %s %s :%s", password, username, hostname, ip, opts);
|
|
else
|
|
sendto_iauth(auth->client, "w %s %s %s %s", password, username, hostname, ip);
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
void auth_send_event(const char *event, const char *paramstring)
|
|
{
|
|
if (IAuthHas(iauth, IAUTH_EVENTS))
|
|
sendto_iauth(NULL, "e %s%s%s", event, (paramstring ? " :" : ""), (paramstring ? paramstring : ""));
|
|
}
|
|
|
|
/** Send exit notification for \a cptr to iauth.
|
|
* @param[in] cptr Client who is exiting.
|
|
*/
|
|
void auth_send_exit(struct Client *cptr)
|
|
{
|
|
sendto_iauth(cptr, "D");
|
|
}
|
|
|
|
/** Forward an XREPLY on to iauth.
|
|
* @param[in] sptr Source of the XREPLY.
|
|
* @param[in] routing Routing information for the original XQUERY.
|
|
* @param[in] reply Contents of the reply.
|
|
*/
|
|
void auth_send_xreply(struct Client *sptr, const char *routing,
|
|
const char *reply)
|
|
{
|
|
sendto_iauth(NULL, "X %#C %s :%s", sptr, routing, reply);
|
|
}
|
|
|
|
/** Mark that a user has started capabilities negotiation.
|
|
* This blocks authorization until auth_cap_done() is called.
|
|
* @param[in] auth Authorization request for client.
|
|
* @return Zero if client should be kept, CPTR_KILLED if rejected.
|
|
*/
|
|
int auth_cap_start(struct AuthRequest *auth)
|
|
{
|
|
assert(auth != NULL);
|
|
FlagSet(&auth->flags, AR_CAP_PENDING);
|
|
return 0;
|
|
}
|
|
|
|
/** Mark that a user has completed capabilities negotiation.
|
|
* This unblocks authorization if auth_cap_start() was called.
|
|
* @param[in] auth Authorization request for client.
|
|
* @return Zero if client should be kept, CPTR_KILLED if rejected.
|
|
*/
|
|
int auth_cap_done(struct AuthRequest *auth)
|
|
{
|
|
assert(auth != NULL);
|
|
FlagClr(&auth->flags, AR_CAP_PENDING);
|
|
return check_auth_finished(auth);
|
|
}
|
|
|
|
/** Check if IAuth is configured to handle SASL authentication.
|
|
* @return Non-zero if IAuth handles SASL, zero otherwise.
|
|
*/
|
|
int auth_iauth_handles_sasl(void)
|
|
{
|
|
return IAuthHas(iauth, IAUTH_SASL);
|
|
}
|
|
|
|
/** Send SASL authentication start to IAuth.
|
|
* @param[in] cptr Client starting SASL.
|
|
* @param[in] mechanism SASL mechanism name.
|
|
* @param[in] certfp SSL certificate fingerprint (may be NULL).
|
|
* @return Non-zero on success, zero on failure.
|
|
*/
|
|
int auth_send_sasl_start(struct Client *cptr, const char *mechanism, const char *certfp)
|
|
{
|
|
if (!IAuthHas(iauth, IAUTH_SASL))
|
|
return 0;
|
|
|
|
if (!EmptyString(certfp))
|
|
return sendto_iauth(cptr, "A S %s :%s", mechanism, certfp);
|
|
else
|
|
return sendto_iauth(cptr, "A S :%s", mechanism);
|
|
}
|
|
|
|
/** Send SASL host information to IAuth.
|
|
* @param[in] cptr Client authenticating.
|
|
* @param[in] username Client's username.
|
|
* @param[in] host Client's hostname.
|
|
* @param[in] ip Client's IP address.
|
|
* @return Non-zero on success, zero on failure.
|
|
*/
|
|
int auth_send_sasl_host(struct Client *cptr, const char *username, const char *host, const char *ip)
|
|
{
|
|
if (!IAuthHas(iauth, IAUTH_SASL))
|
|
return 0;
|
|
|
|
return sendto_iauth(cptr, "A H :%s@%s:%s", username, host, ip);
|
|
}
|
|
|
|
/** Send SASL authentication data to IAuth.
|
|
* @param[in] cptr Client authenticating.
|
|
* @param[in] data Base64-encoded SASL data.
|
|
* @return Non-zero on success, zero on failure.
|
|
*/
|
|
int auth_send_sasl_data(struct Client *cptr, const char *data)
|
|
{
|
|
if (!IAuthHas(iauth, IAUTH_SASL))
|
|
return 0;
|
|
|
|
return sendto_iauth(cptr, "a :%s", data);
|
|
}
|
|
|
|
/** Attempt to spawn the process for an IAuth instance.
|
|
* @param[in] iauth IAuth descriptor.
|
|
* @param[in] automatic If non-zero, apply sanity checks against
|
|
* excessive automatic restarts.
|
|
* @return 0 on success, non-zero on failure.
|
|
*/
|
|
int iauth_do_spawn(struct IAuth *iauth, int automatic)
|
|
{
|
|
pid_t cpid;
|
|
int s_io[2];
|
|
int s_err[2];
|
|
int res;
|
|
|
|
if (automatic && CurrentTime - iauth->started < 5)
|
|
{
|
|
sendto_opmask_butone(NULL, SNO_AUTH, "IAuth crashed fast, leaving it dead.");
|
|
return -1;
|
|
}
|
|
|
|
/* Record time we tried to spawn the iauth process. */
|
|
iauth->started = CurrentTime;
|
|
|
|
/* Attempt to allocate a pair of sockets. */
|
|
res = os_socketpair(s_io);
|
|
if (res) {
|
|
res = errno;
|
|
Debug((DEBUG_INFO, "Unable to create IAuth socketpair: %s", strerror(res)));
|
|
return res;
|
|
}
|
|
|
|
/* Mark the parent's side of the pair (element 0) as non-blocking. */
|
|
res = os_set_nonblocking(s_io[0]);
|
|
if (!res) {
|
|
res = errno;
|
|
Debug((DEBUG_INFO, "Unable to make IAuth socket non-blocking: %s", strerror(res)));
|
|
close(s_io[1]);
|
|
close(s_io[0]);
|
|
return res;
|
|
}
|
|
|
|
/* Initialize the socket structure to talk to the child. */
|
|
res = socket_add(i_socket(iauth), iauth_sock_callback, iauth,
|
|
SS_CONNECTED, SOCK_EVENT_READABLE, s_io[0]);
|
|
if (!res) {
|
|
res = errno;
|
|
Debug((DEBUG_INFO, "Unable to register IAuth socket: %s", strerror(res)));
|
|
close(s_io[1]);
|
|
close(s_io[0]);
|
|
return res;
|
|
}
|
|
|
|
/* Allocate another pair for stderr. */
|
|
res = os_socketpair(s_err);
|
|
if (res) {
|
|
res = errno;
|
|
Debug((DEBUG_INFO, "Unable to create IAuth stderr: %s", strerror(res)));
|
|
socket_del(i_socket(iauth));
|
|
close(s_io[1]);
|
|
close(s_io[0]);
|
|
return res;
|
|
}
|
|
|
|
/* Mark parent side of this pair non-blocking, too. */
|
|
res = os_set_nonblocking(s_err[0]);
|
|
if (!res) {
|
|
res = errno;
|
|
Debug((DEBUG_INFO, "Unable to make IAuth stderr non-blocking: %s", strerror(res)));
|
|
close(s_err[1]);
|
|
close(s_err[0]);
|
|
socket_del(i_socket(iauth));
|
|
close(s_io[1]);
|
|
close(s_io[0]);
|
|
return res;
|
|
}
|
|
|
|
/* And set up i_stderr(iauth). */
|
|
res = socket_add(i_stderr(iauth), iauth_stderr_callback, iauth,
|
|
SS_CONNECTED, SOCK_EVENT_READABLE, s_err[0]);
|
|
if (!res) {
|
|
res = errno;
|
|
Debug((DEBUG_INFO, "Unable to register IAuth stderr: %s", strerror(res)));
|
|
close(s_err[1]);
|
|
close(s_err[0]);
|
|
socket_del(i_socket(iauth));
|
|
close(s_io[1]);
|
|
close(s_io[0]);
|
|
return res;
|
|
}
|
|
|
|
/* Attempt to fork a child process. */
|
|
cpid = fork();
|
|
if (cpid < 0) {
|
|
/* Error forking the child, still in parent. */
|
|
res = errno;
|
|
Debug((DEBUG_INFO, "Unable to fork IAuth child: %s", strerror(res)));
|
|
socket_del(i_stderr(iauth));
|
|
close(s_err[1]);
|
|
close(s_err[0]);
|
|
socket_del(i_socket(iauth));
|
|
close(s_io[1]);
|
|
close(s_io[0]);
|
|
return res;
|
|
}
|
|
|
|
if (cpid > 0) {
|
|
/* We are the parent process. Close the child's sockets. */
|
|
close(s_io[1]);
|
|
close(s_err[1]);
|
|
/* Send our server name (supposedly for proxy checking purposes)
|
|
* and maximum number of connections (for allocation hints).
|
|
* Need to use conf_get_local() since &me may not be fully
|
|
* initialized the first time we run.
|
|
*/
|
|
sendto_iauth(NULL, "M %s %d", conf_get_local()->name, MAXCONNECTIONS);
|
|
/* Indicate success (until the child dies). */
|
|
return 0;
|
|
}
|
|
|
|
/* We are the child process.
|
|
* Duplicate our end of the socket to stdin, stdout and stderr.
|
|
* Then close all the higher-numbered FDs and exec the process.
|
|
*/
|
|
if (dup2(s_io[1], 0) == 0
|
|
&& dup2(s_io[1], 1) == 1
|
|
&& dup2(s_err[1], 2) == 2) {
|
|
close_connections(0);
|
|
execvp(iauth->i_argv[0], iauth->i_argv);
|
|
}
|
|
|
|
/* If we got here, something was seriously wrong. */
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
/** Restart an %IAuth program.
|
|
* @return 0 on failure, 1 on success, 2 on no IAuth program.
|
|
*/
|
|
int auth_restart(void)
|
|
{
|
|
static struct IAuth *iauthnew;
|
|
int ii;
|
|
|
|
if (!iauth)
|
|
return 2;
|
|
|
|
/* Need to initialize a new connection. */
|
|
iauthnew = MyCalloc(1, sizeof(*iauthnew));
|
|
msgq_init(i_sendQ(iauthnew));
|
|
/* Populate iauth's argv array. */
|
|
iauthnew->i_argv = MyCalloc(iauth->i_argc + 1, sizeof(iauthnew->i_argv[0]));
|
|
for (ii = 0; ii < iauth->i_argc; ++ii)
|
|
DupString(iauthnew->i_argv[ii], iauth->i_argv[ii]);
|
|
iauthnew->i_argv[ii] = NULL;
|
|
|
|
auth_close_unused();
|
|
iauth = iauthnew;
|
|
|
|
/* Try to spawn it, and handle the results. */
|
|
if (iauth_do_spawn(iauth, 0))
|
|
return 0;
|
|
IAuthClr(iauth, IAUTH_CLOSING);
|
|
return 1;
|
|
}
|
|
|
|
/** See if an %IAuth program must be spawned.
|
|
* If a process is already running with the specified options, keep it.
|
|
* Otherwise spawn a new child process to perform the %IAuth function.
|
|
* @param[in] argc Number of parameters to use when starting process.
|
|
* @param[in] argv Array of parameters to start process.
|
|
* @return 0 on failure, 1 on new process, 2 on reuse of existing process.
|
|
*/
|
|
int auth_spawn(int argc, char *argv[])
|
|
{
|
|
int ii;
|
|
|
|
if (iauth) {
|
|
int same = 1;
|
|
|
|
/* Check that incoming arguments all match pre-existing arguments. */
|
|
for (ii = 0; same && (ii < argc); ++ii) {
|
|
if (NULL == iauth->i_argv[ii]
|
|
|| 0 != strcmp(iauth->i_argv[ii], argv[ii]))
|
|
same = 0;
|
|
}
|
|
/* Check that we have no more pre-existing arguments. */
|
|
if (same && iauth->i_argv[ii])
|
|
same = 0;
|
|
/* If they are the same and still connected, clear the "closing" flag and exit. */
|
|
if (same && i_GetConnected(iauth)) {
|
|
Debug((DEBUG_INFO, "Reusing existing IAuth process"));
|
|
IAuthClr(iauth, IAUTH_CLOSING);
|
|
return 2;
|
|
}
|
|
auth_close_unused();
|
|
}
|
|
|
|
/* Need to initialize a new connection. */
|
|
iauth = MyCalloc(1, sizeof(*iauth));
|
|
msgq_init(i_sendQ(iauth));
|
|
/* Populate iauth's argv array. */
|
|
iauth->i_argv = MyCalloc(argc + 1, sizeof(iauth->i_argv[0]));
|
|
for (ii = 0; ii < argc; ++ii)
|
|
DupString(iauth->i_argv[ii], argv[ii]);
|
|
iauth->i_argv[ii] = NULL;
|
|
iauth->i_argc = argc;
|
|
/* Try to spawn it, and handle the results. */
|
|
if (iauth_do_spawn(iauth, 0))
|
|
return 0;
|
|
IAuthClr(iauth, IAUTH_CLOSING);
|
|
return 1;
|
|
}
|
|
|
|
/** Mark all %IAuth connections as closing. */
|
|
void auth_mark_closing(void)
|
|
{
|
|
if (iauth)
|
|
IAuthSet(iauth, IAUTH_CLOSING);
|
|
}
|
|
|
|
/** Complete disconnection of an %IAuth connection.
|
|
* @param[in] iauth %Connection to fully close.
|
|
*/
|
|
static void iauth_disconnect(struct IAuth *iauth)
|
|
{
|
|
if (iauth == NULL)
|
|
return;
|
|
|
|
/* Close error socket. */
|
|
if (s_fd(i_stderr(iauth)) != -1) {
|
|
close(s_fd(i_stderr(iauth)));
|
|
socket_del(i_stderr(iauth));
|
|
s_fd(i_stderr(iauth)) = -1;
|
|
}
|
|
|
|
/* Close main socket. */
|
|
if (s_fd(i_socket(iauth)) != -1) {
|
|
close(s_fd(i_socket(iauth)));
|
|
socket_del(i_socket(iauth));
|
|
s_fd(i_socket(iauth)) = -1;
|
|
}
|
|
}
|
|
|
|
/** Close all %IAuth connections marked as closing. */
|
|
void auth_close_unused(void)
|
|
{
|
|
if (IAuthHas(iauth, IAUTH_CLOSING)) {
|
|
int ii;
|
|
iauth_disconnect(iauth);
|
|
if (iauth->i_argv) {
|
|
for (ii = 0; iauth->i_argv[ii]; ++ii)
|
|
MyFree(iauth->i_argv[ii]);
|
|
MyFree(iauth->i_argv);
|
|
}
|
|
MyFree(iauth);
|
|
}
|
|
}
|
|
|
|
/** Send queued output to \a iauth.
|
|
* @param[in] iauth Writable connection with queued data.
|
|
*/
|
|
static void iauth_write(struct IAuth *iauth)
|
|
{
|
|
unsigned int bytes_tried, bytes_sent;
|
|
IOResult iores;
|
|
|
|
if (IAuthHas(iauth, IAUTH_BLOCKED))
|
|
return;
|
|
while (MsgQLength(i_sendQ(iauth)) > 0) {
|
|
iores = os_sendv_nonb(s_fd(i_socket(iauth)), i_sendQ(iauth), &bytes_tried, &bytes_sent);
|
|
switch (iores) {
|
|
case IO_SUCCESS:
|
|
msgq_delete(i_sendQ(iauth), bytes_sent);
|
|
iauth->i_sendB += bytes_sent;
|
|
if (bytes_tried == bytes_sent)
|
|
break;
|
|
/* If bytes_sent < bytes_tried, fall through to IO_BLOCKED. */
|
|
case IO_BLOCKED:
|
|
IAuthSet(iauth, IAUTH_BLOCKED);
|
|
socket_events(i_socket(iauth), SOCK_ACTION_ADD | SOCK_EVENT_WRITABLE);
|
|
return;
|
|
case IO_FAILURE:
|
|
iauth_disconnect(iauth);
|
|
return;
|
|
}
|
|
}
|
|
/* We were able to flush all events, so remove notification. */
|
|
socket_events(i_socket(iauth), SOCK_ACTION_DEL | SOCK_EVENT_WRITABLE);
|
|
}
|
|
|
|
/** Send a message to iauth.
|
|
* @param[in] cptr Optional client context for message.
|
|
* @param[in] format Format string for message.
|
|
* @return Non-zero on successful send or buffering, zero on failure.
|
|
*/
|
|
static int sendto_iauth(struct Client *cptr, const char *format, ...)
|
|
{
|
|
struct VarData vd;
|
|
struct MsgBuf *mb;
|
|
|
|
/* Do not send requests when we have no iauth. */
|
|
if (!i_GetConnected(iauth))
|
|
return 0;
|
|
/* Do not send for clients in the NORMAL state. */
|
|
if (cptr
|
|
&& (format[0] != 'D')
|
|
&& (!cli_auth(cptr) || !FlagHas(&cli_auth(cptr)->flags, AR_IAUTH_PENDING)))
|
|
return 0;
|
|
|
|
/* Build the message buffer. */
|
|
vd.vd_format = format;
|
|
va_start(vd.vd_args, format);
|
|
if (0 == cptr)
|
|
mb = msgq_make(NULL, "-1 %v", &vd);
|
|
else
|
|
mb = msgq_make(NULL, "%d %v", cli_fd(cptr), &vd);
|
|
va_end(vd.vd_args);
|
|
|
|
/* Tack it onto the iauth sendq and try to write it. */
|
|
++iauth->i_sendM;
|
|
msgq_add(i_sendQ(iauth), mb, 0);
|
|
msgq_clean(mb);
|
|
iauth_write(iauth);
|
|
return 1;
|
|
}
|
|
|
|
/** Send text to interested operators (SNO_AUTH server notice).
|
|
* @param[in] iauth Active IAuth session.
|
|
* @param[in] cli Client referenced by command.
|
|
* @param[in] parc Number of parameters (1).
|
|
* @param[in] params Text to send.
|
|
* @return Zero.
|
|
*/
|
|
static int iauth_cmd_snotice(struct IAuth *iauth, struct Client *cli,
|
|
int parc, char **params)
|
|
{
|
|
sendto_opmask_butone(NULL, SNO_AUTH, "%s", params[0]);
|
|
return 0;
|
|
}
|
|
|
|
/** Set the debug level for the session.
|
|
* @param[in] iauth Active IAuth session.
|
|
* @param[in] cli Client referenced by command.
|
|
* @param[in] parc Number of parameters (1).
|
|
* @param[in] params String starting with an integer.
|
|
* @return Zero.
|
|
*/
|
|
static int iauth_cmd_debuglevel(struct IAuth *iauth, struct Client *cli,
|
|
int parc, char **params)
|
|
{
|
|
int new_level;
|
|
|
|
new_level = parc > 0 ? atoi(params[0]) : 0;
|
|
if (i_debug(iauth) > 0 || new_level > 0) {
|
|
/* The "ia_dbg" name is borrowed from (IRCnet) ircd. */
|
|
sendto_opmask_butone(NULL, SNO_AUTH, "ia_dbg = %d", new_level);
|
|
}
|
|
i_debug(iauth) = new_level;
|
|
return 0;
|
|
}
|
|
|
|
/** Set policy options for the session.
|
|
* Old policy is forgotten, and any of the following characters in \a
|
|
* params enable the corresponding policy:
|
|
* \li A IAUTH_ADDLINFO
|
|
* \li R IAUTH_REQUIRED
|
|
* \li T IAUTH_TIMEOUT
|
|
* \li W IAUTH_EXTRAWAIT
|
|
* \li U IAUTH_UNDERNET
|
|
*
|
|
* @param[in] iauth Active IAuth session.
|
|
* @param[in] cli Client referenced by command.
|
|
* @param[in] parc Number of parameters (1).
|
|
* @param[in] params Zero or more policy options.
|
|
* @return Zero.
|
|
*/
|
|
static int iauth_cmd_policy(struct IAuth *iauth, struct Client *cli,
|
|
int parc, char **params)
|
|
{
|
|
enum IAuthFlag flag;
|
|
char *p;
|
|
|
|
/* Erase old policy first. */
|
|
for (flag = IAUTH_FIRST_OPTION; flag < IAUTH_LAST_FLAG; ++flag)
|
|
IAuthClr(iauth, flag);
|
|
|
|
if (parc > 0) /* only try to parse if we were given a policy string */
|
|
/* Parse new policy set. */
|
|
for (p = params[0]; *p; p++) switch (*p) {
|
|
case 'A': IAuthSet(iauth, IAUTH_ADDLINFO); break;
|
|
case 'R': IAuthSet(iauth, IAUTH_REQUIRED); break;
|
|
case 'T': IAuthSet(iauth, IAUTH_TIMEOUT); break;
|
|
case 'W': IAuthSet(iauth, IAUTH_EXTRAWAIT); break;
|
|
case 'U': IAuthSet(iauth, IAUTH_UNDERNET); break;
|
|
case 'w': IAuthSet(iauth, IAUTH_WEBIRC); break;
|
|
case 'F': IAuthSet(iauth, IAUTH_SSLFP); break;
|
|
case 'r': IAuthSet(iauth, IAUTH_ACCOUNT); break;
|
|
case 'e': IAuthSet(iauth, IAUTH_EVENTS); break;
|
|
case 'S': IAuthSet(iauth, IAUTH_SASL); break;
|
|
}
|
|
|
|
/* Optionally notify operators. */
|
|
if (i_debug(iauth) > 0)
|
|
sendto_opmask_butone(NULL, SNO_AUTH, "iauth options: %s", params[0]);
|
|
return 0;
|
|
}
|
|
|
|
/** Set the iauth program version number.
|
|
* @param[in] iauth Active IAuth session.
|
|
* @param[in] cli Client referenced by command.
|
|
* @param[in] parc Number of parameters (1).
|
|
* @param[in] params Version number or name.
|
|
* @return Zero.
|
|
*/
|
|
static int iauth_cmd_version(struct IAuth *iauth, struct Client *cli,
|
|
int parc, char **params)
|
|
{
|
|
MyFree(iauth->i_version);
|
|
DupString(iauth->i_version, parc > 0 ? params[0] : "<NONE>");
|
|
sendto_opmask_butone(NULL, SNO_AUTH, "iauth version %s running.",
|
|
iauth->i_version);
|
|
return 0;
|
|
}
|
|
|
|
/** Paste a parameter list together into a single string.
|
|
* @param[in] parc Number of parameters.
|
|
* @param[in] params Parameter list to paste together.
|
|
* @return Pasted parameter list.
|
|
*/
|
|
static char *paste_params(int parc, char **params)
|
|
{
|
|
char *str, *tmp;
|
|
int len = 0, lengths[MAXPARA], i;
|
|
|
|
/* Compute the length... */
|
|
for (i = 0; i < parc; i++)
|
|
len += lengths[i] = strlen(params[i]);
|
|
|
|
/* Allocate memory, accounting for string lengths, spaces (parc - 1), a
|
|
* sentinel, and the trailing \0
|
|
*/
|
|
str = MyMalloc(len + parc + 1);
|
|
|
|
/* Build the pasted string */
|
|
for (tmp = str, i = 0; i < parc; i++) {
|
|
if (i) /* add space separator... */
|
|
*(tmp++) = ' ';
|
|
if (i == parc - 1) /* add colon sentinel */
|
|
*(tmp++) = ':';
|
|
|
|
/* Copy string component... */
|
|
memcpy(tmp, params[i], lengths[i]);
|
|
tmp += lengths[i]; /* move to end of string */
|
|
}
|
|
|
|
/* terminate the string... */
|
|
*tmp = '\0';
|
|
|
|
return str; /* return the pasted string */
|
|
}
|
|
|
|
/** Clear cached iauth configuration information.
|
|
* @param[in] iauth Active IAuth session.
|
|
* @param[in] cli Client referenced by command.
|
|
* @param[in] parc Number of parameters (0).
|
|
* @param[in] params Parameter list (ignored).
|
|
* @return Zero.
|
|
*/
|
|
static int iauth_cmd_newconfig(struct IAuth *iauth, struct Client *cli,
|
|
int parc, char **params)
|
|
{
|
|
struct SLink *head;
|
|
struct SLink *next;
|
|
|
|
head = iauth->i_config;
|
|
iauth->i_config = NULL;
|
|
for (; head; head = next) {
|
|
next = head->next;
|
|
MyFree(head->value.cp);
|
|
free_link(head);
|
|
}
|
|
sendto_opmask_butone(NULL, SNO_AUTH, "New iauth configuration.");
|
|
return 0;
|
|
}
|
|
|
|
/** Append iauth configuration information.
|
|
* @param[in] iauth Active IAuth session.
|
|
* @param[in] cli Client referenced by command.
|
|
* @param[in] parc Number of parameters.
|
|
* @param[in] params Description of configuration element.
|
|
* @return Zero.
|
|
*/
|
|
static int iauth_cmd_config(struct IAuth *iauth, struct Client *cli,
|
|
int parc, char **params)
|
|
{
|
|
struct SLink *node;
|
|
|
|
if (iauth->i_config) {
|
|
for (node = iauth->i_config; node->next; node = node->next) ;
|
|
node = node->next = make_link();
|
|
} else {
|
|
node = iauth->i_config = make_link();
|
|
}
|
|
node->value.cp = paste_params(parc, params);
|
|
node->next = 0; /* must be explicitly cleared */
|
|
return 0;
|
|
}
|
|
|
|
/** Clear cached iauth configuration information.
|
|
* @param[in] iauth Active IAuth session.
|
|
* @param[in] cli Client referenced by command.
|
|
* @param[in] parc Number of parameters (0).
|
|
* @param[in] params Parameter list (ignored).
|
|
* @return Zero.
|
|
*/
|
|
static int iauth_cmd_newstats(struct IAuth *iauth, struct Client *cli,
|
|
int parc, char **params)
|
|
{
|
|
struct SLink *head;
|
|
struct SLink *next;
|
|
|
|
head = iauth->i_stats;
|
|
iauth->i_stats = NULL;
|
|
for (; head; head = next) {
|
|
next = head->next;
|
|
MyFree(head->value.cp);
|
|
free_link(head);
|
|
}
|
|
sendto_opmask_butone(NULL, SNO_AUTH, "New iauth statistics.");
|
|
return 0;
|
|
}
|
|
|
|
/** Append iauth statistics information.
|
|
* @param[in] iauth Active IAuth session.
|
|
* @param[in] cli Client referenced by command.
|
|
* @param[in] parc Number of parameters.
|
|
* @param[in] params Statistics element.
|
|
* @return Zero.
|
|
*/
|
|
static int iauth_cmd_stats(struct IAuth *iauth, struct Client *cli,
|
|
int parc, char **params)
|
|
{
|
|
struct SLink *node;
|
|
if (iauth->i_stats) {
|
|
for (node = iauth->i_stats; node->next; node = node->next) ;
|
|
node = node->next = make_link();
|
|
} else {
|
|
node = iauth->i_stats = make_link();
|
|
}
|
|
node->value.cp = paste_params(parc, params);
|
|
node->next = 0; /* must be explicitly cleared */
|
|
return 0;
|
|
}
|
|
|
|
/** Set client's username to a trusted string even if it breaks the rules.
|
|
* @param[in] iauth Active IAuth session.
|
|
* @param[in] cli Client referenced by command.
|
|
* @param[in] parc Number of parameters (1).
|
|
* @param[in] params Forced username.
|
|
* @return One.
|
|
*/
|
|
static int iauth_cmd_username_forced(struct IAuth *iauth, struct Client *cli,
|
|
int parc, char **params)
|
|
{
|
|
assert(cli_auth(cli) != NULL);
|
|
FlagClr(&cli_auth(cli)->flags, AR_AUTH_PENDING);
|
|
if (!EmptyString(params[0])) {
|
|
ircd_strncpy(cli_username(cli), params[0], USERLEN + 1);
|
|
SetGotId(cli);
|
|
FlagSet(&cli_auth(cli)->flags, AR_IAUTH_USERNAME);
|
|
FlagSet(&cli_auth(cli)->flags, AR_IAUTH_FUSERNAME);
|
|
}
|
|
return 1;
|
|
}
|
|
|
|
/** Set client's username to a trusted string.
|
|
* @param[in] iauth Active IAuth session.
|
|
* @param[in] cli Client referenced by command.
|
|
* @param[in] parc Number of parameters (1).
|
|
* @param[in] params Trusted username.
|
|
* @return One.
|
|
*/
|
|
static int iauth_cmd_username_good(struct IAuth *iauth, struct Client *cli,
|
|
int parc, char **params)
|
|
{
|
|
assert(cli_auth(cli) != NULL);
|
|
FlagClr(&cli_auth(cli)->flags, AR_AUTH_PENDING);
|
|
if (!EmptyString(params[0])) {
|
|
ircd_strncpy(cli_username(cli), params[0], USERLEN + 1);
|
|
SetGotId(cli);
|
|
FlagSet(&cli_auth(cli)->flags, AR_IAUTH_USERNAME);
|
|
}
|
|
return 1;
|
|
}
|
|
|
|
/** Set client's username to an untrusted string.
|
|
* @param[in] iauth Active IAuth session.
|
|
* @param[in] cli Client referenced by command.
|
|
* @param[in] parc Number of parameters (1).
|
|
* @param[in] params Untrusted username.
|
|
* @return One.
|
|
*/
|
|
static int iauth_cmd_username_bad(struct IAuth *iauth, struct Client *cli,
|
|
int parc, char **params)
|
|
{
|
|
assert(cli_auth(cli) != NULL);
|
|
FlagClr(&cli_auth(cli)->flags, AR_AUTH_PENDING);
|
|
if (!EmptyString(params[0]))
|
|
ircd_strncpy(cli_user(cli)->username, params[0], USERLEN + 1);
|
|
return 1;
|
|
}
|
|
|
|
/** Set client's hostname.
|
|
* @param[in] iauth Active IAuth session.
|
|
* @param[in] cli Client referenced by command.
|
|
* @param[in] parc Number of parameters (1).
|
|
* @param[in] params New hostname for client.
|
|
* @return Non-zero if \a cli authorization should be checked for completion.
|
|
*/
|
|
static int iauth_cmd_hostname(struct IAuth *iauth, struct Client *cli,
|
|
int parc, char **params)
|
|
{
|
|
struct AuthRequest *auth;
|
|
|
|
if (EmptyString(params[0])) {
|
|
sendto_iauth(cli, "E Missing :Missing hostname parameter");
|
|
return 0;
|
|
}
|
|
|
|
auth = cli_auth(cli);
|
|
assert(auth != NULL);
|
|
|
|
/* If a DNS request is pending, abort it. */
|
|
if (FlagHas(&auth->flags, AR_DNS_PENDING)) {
|
|
FlagClr(&auth->flags, AR_DNS_PENDING);
|
|
delete_resolver_queries(auth);
|
|
if (IsUserPort(cli))
|
|
sendheader(cli, REPORT_FIN_DNS);
|
|
}
|
|
|
|
/* Copy old details to cli_connectip and cli_connecthost. */
|
|
if (!IsIPSpoofed(cli)) {
|
|
memcpy(&cli_connectip(cli), &cli_ip(cli), sizeof(cli_ip(cli)));
|
|
ircd_strncpy(cli_connecthost(cli), cli_sockhost(cli), HOSTLEN + 1);
|
|
SetIPSpoofed(cli);
|
|
}
|
|
|
|
/* Set hostname from params. */
|
|
ircd_strncpy(cli_sockhost(cli), params[0], HOSTLEN + 1);
|
|
/* If we have gotten here, the user is in a "hurry" state and has
|
|
* been pre-registered. Their hostname was set during that, and
|
|
* needs to be overwritten now.
|
|
*/
|
|
if (FlagHas(&auth->flags, AR_IAUTH_HURRY)) {
|
|
ircd_strncpy(cli_user(cli)->host, cli_sockhost(cli), HOSTLEN + 1);
|
|
ircd_strncpy(cli_user(cli)->realhost, cli_sockhost(cli), HOSTLEN + 1);
|
|
}
|
|
return 1;
|
|
}
|
|
|
|
/** Set client's IP address.
|
|
* @param[in] iauth Active IAuth session.
|
|
* @param[in] cli Client referenced by command.
|
|
* @param[in] parc Number of parameters (1).
|
|
* @param[in] params New IP address for client in dotted quad or
|
|
* standard IPv6 format.
|
|
* @return Zero.
|
|
*/
|
|
static int iauth_cmd_ip_address(struct IAuth *iauth, struct Client *cli,
|
|
int parc, char **params)
|
|
{
|
|
struct irc_in_addr addr;
|
|
struct AuthRequest *auth;
|
|
|
|
if (EmptyString(params[0])) {
|
|
sendto_iauth(cli, "E Missing :Missing IP address parameter");
|
|
return 0;
|
|
}
|
|
|
|
/* Get AuthRequest for client. */
|
|
auth = cli_auth(cli);
|
|
assert(auth != NULL);
|
|
|
|
/* Parse the client's new IP address. */
|
|
if (!ircd_aton(&addr, params[0])) {
|
|
sendto_iauth(cli, "E Invalid :Unable to parse IP address [%s]", params[0]);
|
|
return 0;
|
|
}
|
|
|
|
/* Copy old details to cli_connectip and cli_connecthost. */
|
|
if (!IsIPSpoofed(cli)) {
|
|
memcpy(&cli_connectip(cli), &cli_ip(cli), sizeof(cli_ip(cli)));
|
|
ircd_strncpy(cli_connecthost(cli), cli_sockhost(cli), HOSTLEN + 1);
|
|
SetIPSpoofed(cli);
|
|
}
|
|
|
|
/* If this is the first IP override, save the client's original
|
|
* address in case we get a DNS response later.
|
|
*/
|
|
if (!irc_in_addr_valid(&auth->original))
|
|
memcpy(&auth->original, &cli_ip(cli), sizeof(auth->original));
|
|
|
|
/* Undo original IP connection in IPcheck. */
|
|
if (IsIPChecked(cli)) {
|
|
IPcheck_connect_fail(cli, 1);
|
|
ClearIPChecked(cli);
|
|
}
|
|
|
|
/* Update the IP and charge them as a remote connect. */
|
|
memcpy(&cli_ip(cli), &addr, sizeof(cli_ip(cli)));
|
|
if (!find_except_conf(cli, EFLAG_IPCHECK))
|
|
IPcheck_remote_connect(cli, 0);
|
|
|
|
return 0;
|
|
}
|
|
|
|
/** Find a ConfItem structure for a named connection class.
|
|
* @param[in] class_name Name of configuration class to find.
|
|
* @return A ConfItem of type CONF_CLIENT for the class, or NULL on failure.
|
|
*/
|
|
static struct ConfItem *auth_find_class_conf(const char *class_name)
|
|
{
|
|
static struct ConfItem *aconf_list;
|
|
struct ConnectionClass *class;
|
|
struct ConfItem *aconf;
|
|
|
|
/* Make sure the configuration class is valid. */
|
|
class = find_class(class_name);
|
|
if (!class || !class->valid)
|
|
return NULL;
|
|
|
|
/* Look for an existing ConfItem for the class. */
|
|
for (aconf = aconf_list; aconf; aconf = aconf->next)
|
|
if (aconf->conn_class == class)
|
|
break;
|
|
|
|
/* If no ConfItem, create one. */
|
|
if (!aconf) {
|
|
aconf = make_conf(CONF_CLIENT);
|
|
if (!aconf) {
|
|
sendto_opmask_butone(NULL, SNO_AUTH,
|
|
"Unable to allocate ConfItem for class %s!",
|
|
ConClass(class));
|
|
return NULL;
|
|
}
|
|
/* make_conf() "helpfully" links the conf into GlobalConfList,
|
|
* which we do not want, so undo that. (Ugh.)
|
|
*/
|
|
if (aconf == GlobalConfList) {
|
|
GlobalConfList = aconf->next;
|
|
}
|
|
/* Back to business as usual. */
|
|
aconf->conn_class = class;
|
|
aconf->next = aconf_list;
|
|
aconf_list = aconf;
|
|
}
|
|
|
|
return aconf;
|
|
}
|
|
|
|
/** Tentatively accept a client in IAuth.
|
|
* @param[in] iauth Active IAuth session.
|
|
* @param[in] cli Client referenced by command.
|
|
* @param[in] parc Number of parameters.
|
|
* @param[in] params Optional class name for client.
|
|
* @return Negative (CPTR_KILLED) if the connection is refused, one otherwise.
|
|
*/
|
|
static int iauth_cmd_soft_done(struct IAuth *iauth, struct Client *cli,
|
|
int parc, char **params)
|
|
{
|
|
/* Clear iauth pending flag. */
|
|
assert(cli_auth(cli) != NULL);
|
|
FlagSet(&cli_auth(cli)->flags, AR_IAUTH_SOFT_DONE);
|
|
return 1;
|
|
}
|
|
|
|
/** Accept a client in IAuth.
|
|
* @param[in] iauth Active IAuth session.
|
|
* @param[in] cli Client referenced by command.
|
|
* @param[in] parc Number of parameters.
|
|
* @param[in] params Optional class name for client.
|
|
* @return Negative (CPTR_KILLED) if the connection is refused, one otherwise.
|
|
*/
|
|
static int iauth_cmd_done_client(struct IAuth *iauth, struct Client *cli,
|
|
int parc, char **params)
|
|
{
|
|
static time_t warn_time;
|
|
|
|
/* Clear iauth pending flag. */
|
|
assert(cli_auth(cli) != NULL);
|
|
FlagClr(&cli_auth(cli)->flags, AR_IAUTH_PENDING);
|
|
|
|
/* If a connection class was specified (and usable), assign the client to it. */
|
|
if (!EmptyString(params[0])) {
|
|
struct ConfItem *aconf;
|
|
|
|
aconf = auth_find_class_conf(params[0]);
|
|
if (aconf) {
|
|
enum AuthorizationCheckResult acr;
|
|
|
|
acr = attach_conf(cli, aconf);
|
|
switch (acr) {
|
|
case ACR_OK:
|
|
/* There should maybe be some way to set FLAG_DOID here.. */
|
|
break;
|
|
case ACR_TOO_MANY_IN_CLASS:
|
|
++ServerStats->is_ref;
|
|
return exit_client(cli, cli, &me,
|
|
"Sorry, your connection class is full - try "
|
|
"again later or try another server");
|
|
default:
|
|
log_write(LS_IAUTH, L_ERROR, 0, "IAuth: Unexpected AuthorizationCheckResult %d from attach_conf()", acr);
|
|
break;
|
|
}
|
|
} else
|
|
sendto_opmask_butone_ratelimited(NULL, SNO_AUTH, &warn_time,
|
|
"iauth tried to use undefined class [%s]",
|
|
params[0]);
|
|
}
|
|
|
|
return 1;
|
|
}
|
|
|
|
/** Accept a client in IAuth and assign them to an account.
|
|
* @param[in] iauth Active IAuth session.
|
|
* @param[in] cli Client referenced by command.
|
|
* @param[in] parc Number of parameters.
|
|
* @param[in] params Account name and optional class name for client.
|
|
* @return Negative if the connection is refused, otherwise non-zero
|
|
* if \a cli authorization should be checked for completion.
|
|
*/
|
|
static int iauth_cmd_done_account(struct IAuth *iauth, struct Client *cli,
|
|
int parc, char **params)
|
|
{
|
|
size_t len;
|
|
|
|
/* Sanity check. */
|
|
if (EmptyString(params[0])) {
|
|
sendto_iauth(cli, "E Missing :Missing account parameter");
|
|
return 0;
|
|
}
|
|
/* Check length of account name. */
|
|
len = strcspn(params[0], ": ");
|
|
if (len > ACCOUNTLEN) {
|
|
sendto_iauth(cli, "E Invalid :Account parameter too long");
|
|
return 0;
|
|
}
|
|
/* If account has a creation timestamp, use it. */
|
|
assert(cli_user(cli) != NULL);
|
|
if (params[0][len] == ':') {
|
|
cli_user(cli)->acc_create = strtoul(params[0] + len + 1, NULL, 10);
|
|
params[0][len] = '\0';
|
|
}
|
|
|
|
/* Copy account name to User structure. */
|
|
ircd_strncpy(cli_user(cli)->account, params[0], ACCOUNTLEN + 1);
|
|
SetAccount(cli);
|
|
|
|
/* Fall through to the normal "done" handler. */
|
|
return iauth_cmd_done_client(iauth, cli, parc - 1, params + 1);
|
|
}
|
|
|
|
/** Reject a client's connection.
|
|
* @param[in] iauth Active IAuth session.
|
|
* @param[in] cli Client referenced by command.
|
|
* @param[in] parc Number of parameters (1).
|
|
* @param[in] params Optional kill message.
|
|
* @return Zero.
|
|
*/
|
|
static int iauth_cmd_kill(struct IAuth *iauth, struct Client *cli,
|
|
int parc, char **params)
|
|
{
|
|
if (cli_auth(cli))
|
|
FlagClr(&cli_auth(cli)->flags, AR_IAUTH_PENDING);
|
|
if (EmptyString(params[0]))
|
|
params[0] = "Access denied";
|
|
exit_client(cli, cli, &me, params[0]);
|
|
return 0;
|
|
}
|
|
|
|
/** Change a client's usermode.
|
|
* @param[in] iauth Active IAuth session.
|
|
* @param[in] cli Client referenced by command.
|
|
* @param[in] parc Number of parameters (at least one).
|
|
* @param[in] params Usermode arguments for client.
|
|
* @return Zero.
|
|
*/
|
|
static int iauth_cmd_mark(struct IAuth *iauth, struct Client *cli,
|
|
int parc, char **params)
|
|
{
|
|
if ((parc < 2) || EmptyString(params[0])) {
|
|
sendto_iauth(cli, "E Missing :Missing mark parameter");
|
|
return 0;
|
|
}
|
|
/* params[0] == type, params[1] == data */
|
|
if (!ircd_strcmp(params[0], MARK_WEBIRC)) {
|
|
ircd_strncpy(cli_webirc(cli), params[1], BUFSIZE + 1);
|
|
} else if (!ircd_strcmp(params[0], MARK_GEOIP)) {
|
|
if ((parc < 3) || EmptyString(params[1]) || EmptyString(params[2])) {
|
|
sendto_iauth(cli, "E Missing :Missing mark geoip parameter");
|
|
return 0;
|
|
}
|
|
geoip_apply_mark(cli, params[1], params[2], (parc > 3 ? params[3] : NULL));
|
|
} else if (!ircd_strcmp(params[0], MARK_CVERSION)) {
|
|
ircd_strncpy(cli_version(cli), params[1], VERSIONLEN + 1);
|
|
} else if (!ircd_strcmp(params[0], MARK_SSLCLIFP)) {
|
|
ircd_strncpy(cli_sslclifp(cli), params[1], BUFSIZE + 1);
|
|
} else if (!ircd_strcmp(params[0], MARK_KILL)) {
|
|
ircd_strncpy(cli_killmark(cli), params[1], BUFSIZE + 1);
|
|
} else if (!ircd_strcmp(params[0], MARK_MARK) || !ircd_strcmp(params[0], MARK_DNSBL_DATA)) {
|
|
add_mark(cli, params[1]);
|
|
SetMarked(cli);
|
|
} else {
|
|
sendto_iauth(cli, "E Invalid :Invalid mark type");
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
/** Change a client's usermode.
|
|
* @param[in] iauth Active IAuth session.
|
|
* @param[in] cli Client referenced by command.
|
|
* @param[in] parc Number of parameters (at least one).
|
|
* @param[in] params Usermode arguments for client (with the first
|
|
* starting with '+').
|
|
* @return Zero.
|
|
*/
|
|
static int iauth_cmd_usermode(struct IAuth *iauth, struct Client *cli,
|
|
int parc, char **params)
|
|
{
|
|
if (params[0][0] == '+')
|
|
{
|
|
set_user_mode(cli, cli, parc + 2, params - 2, ALLOWMODES_ANY);
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
/** Send a challenge string to the client.
|
|
* @param[in] iauth Active IAuth session.
|
|
* @param[in] cli Client referenced by command.
|
|
* @param[in] parc Number of parameters (1).
|
|
* @param[in] params Challenge message for client.
|
|
* @return Zero.
|
|
*/
|
|
static int iauth_cmd_challenge(struct IAuth *iauth, struct Client *cli,
|
|
int parc, char **params)
|
|
{
|
|
if (!EmptyString(params[0]))
|
|
sendrawto_one(cli, "NOTICE * :*** %s", params[0]);
|
|
return 0;
|
|
}
|
|
|
|
/** Send an extension query to a specified remote server.
|
|
* @param[in] iauth Active IAuth session.
|
|
* @param[in] cli Client referenced by command.
|
|
* @param[in] parc Number of parameters (3).
|
|
* @param[in] params Remote server, routing information, and query.
|
|
* @return Zero.
|
|
*/
|
|
static int iauth_cmd_xquery(struct IAuth *iauth, struct Client *cli,
|
|
int parc, char **params)
|
|
{
|
|
char *serv;
|
|
const char *routing;
|
|
const char *query;
|
|
struct Client *acptr;
|
|
|
|
/* Process parameters */
|
|
if (EmptyString(params[0])) {
|
|
sendto_iauth(cli, "E Missing :Missing server parameter");
|
|
return 0;
|
|
} else
|
|
serv = params[0];
|
|
|
|
if (EmptyString(params[1])) {
|
|
sendto_iauth(cli, "E Missing :Missing routing parameter");
|
|
return 0;
|
|
} else
|
|
routing = params[1];
|
|
|
|
if (EmptyString(params[2])) {
|
|
sendto_iauth(cli, "E Missing :Missing query parameter");
|
|
return 0;
|
|
} else
|
|
query = params[2];
|
|
|
|
/* Try to find the specified server */
|
|
if (!(acptr = find_match_server(serv))) {
|
|
sendto_iauth(cli, "x %s %s :Server not online", serv, routing);
|
|
return 0;
|
|
}
|
|
|
|
/* If it's to us, do nothing; otherwise, forward the query */
|
|
if (!IsMe(acptr))
|
|
/* The "iauth:" prefix helps ircu route the reply to iauth */
|
|
sendcmdto_one(&me, CMD_XQUERY, acptr, "%C iauth:%s :%s", acptr, routing,
|
|
query);
|
|
|
|
return 0;
|
|
}
|
|
|
|
/** Handle SASL challenge from IAuth.
|
|
* @param[in] iauth Active IAuth session.
|
|
* @param[in] cli Client referenced by command.
|
|
* @param[in] parc Number of parameters (1).
|
|
* @param[in] params Challenge data (base64).
|
|
* @return Zero.
|
|
*/
|
|
static int iauth_cmd_sasl_challenge(struct IAuth *iauth, struct Client *cli,
|
|
int parc, char **params)
|
|
{
|
|
if (EmptyString(params[0]))
|
|
return 0;
|
|
|
|
/* Forward challenge to client */
|
|
sendrawto_one(cli, "AUTHENTICATE %s", params[0]);
|
|
return 0;
|
|
}
|
|
|
|
/** Handle SASL login success from IAuth.
|
|
* @param[in] iauth Active IAuth session.
|
|
* @param[in] cli Client referenced by command.
|
|
* @param[in] parc Number of parameters (1+).
|
|
* @param[in] params Account name.
|
|
* @return Non-zero to check auth completion.
|
|
*/
|
|
static int iauth_cmd_sasl_loggedin(struct IAuth *iauth, struct Client *cli,
|
|
int parc, char **params)
|
|
{
|
|
size_t len;
|
|
|
|
if (EmptyString(params[0])) {
|
|
sendto_iauth(cli, "E Missing :Missing account parameter");
|
|
return 0;
|
|
}
|
|
|
|
/* Check length of account name. */
|
|
len = strcspn(params[0], ": ");
|
|
if (len > ACCOUNTLEN) {
|
|
sendto_iauth(cli, "E Invalid :Account parameter too long");
|
|
return 0;
|
|
}
|
|
|
|
/* Store account in SASL fields */
|
|
ircd_strncpy(cli_saslaccount(cli), params[0], ACCOUNTLEN + 1);
|
|
|
|
/* If account has a creation timestamp, use it. */
|
|
if (params[0][len] == ':') {
|
|
cli_saslacccreate(cli) = strtoul(params[0] + len + 1, NULL, 10);
|
|
}
|
|
|
|
/* Send RPL_LOGGEDIN to client */
|
|
send_reply(cli, RPL_LOGGEDIN, cli_name(cli), cli_user(cli) ? cli_user(cli)->username : "*",
|
|
cli_user(cli) ? cli_user(cli)->host : "*", cli_saslaccount(cli), cli_saslaccount(cli));
|
|
|
|
return 0;
|
|
}
|
|
|
|
/** Handle SASL authentication failure from IAuth.
|
|
* @param[in] iauth Active IAuth session.
|
|
* @param[in] cli Client referenced by command.
|
|
* @param[in] parc Number of parameters.
|
|
* @param[in] params Unused.
|
|
* @return Zero.
|
|
*/
|
|
static int iauth_cmd_sasl_fail(struct IAuth *iauth, struct Client *cli,
|
|
int parc, char **params)
|
|
{
|
|
send_reply(cli, ERR_SASLFAIL, EmptyString(params[0]) ? "" : params[0]);
|
|
return 0;
|
|
}
|
|
|
|
/** Handle SASL mechanism list from IAuth.
|
|
* @param[in] iauth Active IAuth session.
|
|
* @param[in] cli Client referenced by command.
|
|
* @param[in] parc Number of parameters (1).
|
|
* @param[in] params Mechanism list.
|
|
* @return Zero.
|
|
*/
|
|
static int iauth_cmd_sasl_mechs(struct IAuth *iauth, struct Client *cli,
|
|
int parc, char **params)
|
|
{
|
|
if (EmptyString(params[0]))
|
|
return 0;
|
|
|
|
send_reply(cli, ERR_SASLMECHS, params[0]);
|
|
return 0;
|
|
}
|
|
|
|
/** Handle SASL authentication success (done) from IAuth.
|
|
* @param[in] iauth Active IAuth session.
|
|
* @param[in] cli Client referenced by command.
|
|
* @param[in] parc Number of parameters.
|
|
* @param[in] params Unused.
|
|
* @return Zero.
|
|
*/
|
|
static int iauth_cmd_sasl_done(struct IAuth *iauth, struct Client *cli,
|
|
int parc, char **params)
|
|
{
|
|
/* Mark SASL as complete */
|
|
SetFlag(cli, FLAG_SASLCOMPLETE);
|
|
|
|
/* Send success to client */
|
|
send_reply(cli, RPL_SASLSUCCESS);
|
|
|
|
/* Cancel SASL timeout */
|
|
if (t_active(&cli_sasltimeout(cli)))
|
|
timer_del(&cli_sasltimeout(cli));
|
|
|
|
return 0;
|
|
}
|
|
|
|
/** Parse a \a message from \a iauth.
|
|
* @param[in] iauth Active IAuth session.
|
|
* @param[in] message Message to be parsed.
|
|
*/
|
|
static void iauth_parse(struct IAuth *iauth, char *message)
|
|
{
|
|
char *params[MAXPARA + 1]; /* leave space for NULL */
|
|
int parc = 0;
|
|
iauth_cmd_handler handler;
|
|
struct AuthRequest *auth;
|
|
struct Client *cli;
|
|
int has_cli;
|
|
int id;
|
|
|
|
/* Find command handler... */
|
|
switch (*(message++)) {
|
|
case '>': handler = iauth_cmd_snotice; has_cli = 0; break;
|
|
case 'G': handler = iauth_cmd_debuglevel; has_cli = 0; break;
|
|
case 'O': handler = iauth_cmd_policy; has_cli = 0; break;
|
|
case 'V': handler = iauth_cmd_version; has_cli = 0; break;
|
|
case 'a': handler = iauth_cmd_newconfig; has_cli = 0; break;
|
|
case 'A': handler = iauth_cmd_config; has_cli = 0; break;
|
|
case 's': handler = iauth_cmd_newstats; has_cli = 0; break;
|
|
case 'S': handler = iauth_cmd_stats; has_cli = 0; break;
|
|
case 'X': handler = iauth_cmd_xquery; has_cli = 0; break;
|
|
case 'o': handler = iauth_cmd_username_forced; has_cli = 1; break;
|
|
case 'U': handler = iauth_cmd_username_good; has_cli = 1; break;
|
|
case 'u': handler = iauth_cmd_username_bad; has_cli = 1; break;
|
|
case 'N': handler = iauth_cmd_hostname; has_cli = 1; break;
|
|
case 'I': handler = iauth_cmd_ip_address; has_cli = 1; break;
|
|
case 'm': handler = iauth_cmd_mark; has_cli = 1; break;
|
|
case 'M': handler = iauth_cmd_usermode; has_cli = 1; break;
|
|
case 'C': handler = iauth_cmd_challenge; has_cli = 1; break;
|
|
case 'd': handler = iauth_cmd_soft_done; has_cli = 1; break;
|
|
case 'D': handler = iauth_cmd_done_client; has_cli = 1; break;
|
|
case 'R': handler = iauth_cmd_done_account; has_cli = 1; break;
|
|
case 'k': /* The 'k' command indicates the user should be booted
|
|
* off without telling opers. There is no way to
|
|
* signal that to exit_client(), so we fall through to
|
|
* the case that we do implement.
|
|
*/
|
|
case 'K': handler = iauth_cmd_kill; has_cli = 2; break;
|
|
case 'r': /* we handle termination directly */ return;
|
|
/* SASL-related commands from IAuth */
|
|
case 'c': handler = iauth_cmd_sasl_challenge; has_cli = 2; break;
|
|
case 'L': handler = iauth_cmd_sasl_loggedin; has_cli = 2; break;
|
|
case 'f': handler = iauth_cmd_sasl_fail; has_cli = 2; break;
|
|
case 'l': handler = iauth_cmd_sasl_mechs; has_cli = 2; break;
|
|
case 'Z': handler = iauth_cmd_sasl_done; has_cli = 2; break;
|
|
default: sendto_iauth(NULL, "E Garbage :[%s]", message); return;
|
|
}
|
|
|
|
while (parc < MAXPARA) {
|
|
while (IsSpace(*message)) /* skip leading whitespace */
|
|
message++;
|
|
|
|
if (!*message) /* hit the end of the string, break out */
|
|
break;
|
|
|
|
if (*message == ':') { /* found sentinel... */
|
|
params[parc++] = message + 1;
|
|
break; /* it's the last parameter anyway */
|
|
}
|
|
|
|
params[parc++] = message; /* save the parameter */
|
|
while (*message && !IsSpace(*message))
|
|
message++; /* find the end of the parameter */
|
|
|
|
if (*message) /* terminate the parameter */
|
|
*(message++) = '\0';
|
|
}
|
|
|
|
params[parc] = NULL; /* terminate the parameter list */
|
|
|
|
/* Check to see if the command specifies a client... */
|
|
if (!has_cli) {
|
|
/* Handler does not need a client. */
|
|
handler(iauth, NULL, parc, params);
|
|
} else {
|
|
/* Try to find the client associated with the request. */
|
|
id = strtol(params[0], NULL, 10);
|
|
if (parc < 3)
|
|
sendto_iauth(NULL, "E Missing :Need <id> <ip> <port>");
|
|
else if (id < 0 || id > HighestFd || !(cli = LocalClientArray[id]))
|
|
/* Client no longer exists (or never existed). */
|
|
sendto_iauth(NULL, "E Gone :[%s %s %s]", params[0], params[1],
|
|
params[2]);
|
|
else if ((!(auth = cli_auth(cli)) ||
|
|
!FlagHas(&auth->flags, AR_IAUTH_PENDING)) &&
|
|
has_cli == 1)
|
|
/* Client is done with IAuth checks. */
|
|
sendto_iauth(cli, "E Done :[%s %s %s]", params[0], params[1], params[2]);
|
|
else {
|
|
struct irc_sockaddr addr;
|
|
int res;
|
|
|
|
/* Parse IP address and port number from parameters */
|
|
res = ipmask_parse(params[1], &addr.addr, NULL);
|
|
addr.port = strtol(params[2], NULL, 10);
|
|
|
|
/* Check IP address and port number against expected. */
|
|
if (0 == res ||
|
|
(irc_in_addr_cmp(&addr.addr, &cli_ip(cli)) &&
|
|
irc_in_addr_cmp(&addr.addr, &cli_connectip(cli))) ||
|
|
(auth && addr.port != auth->port))
|
|
/* Report mismatch to iauth. */
|
|
sendto_iauth(cli, "E Mismatch :[%s] != [%s]", params[1],
|
|
ircd_ntoa(&cli_ip(cli)));
|
|
else if (handler(iauth, cli, parc - 3, params + 3) > 0)
|
|
/* Handler indicated a possible state change. */
|
|
check_auth_finished(auth);
|
|
}
|
|
}
|
|
}
|
|
|
|
/** Read input from \a iauth.
|
|
* Reads up to SERVER_TCP_WINDOW bytes per pass.
|
|
* @param[in] iauth Readable connection.
|
|
*/
|
|
static void iauth_read(struct IAuth *iauth)
|
|
{
|
|
static char readbuf[SERVER_TCP_WINDOW];
|
|
unsigned int length, count;
|
|
char *sol;
|
|
char *eol;
|
|
|
|
/* Copy partial data to readbuf, append new data. */
|
|
length = iauth->i_count;
|
|
memcpy(readbuf, iauth->i_buffer, length);
|
|
if (IO_SUCCESS != os_recv_nonb(s_fd(i_socket(iauth)),
|
|
readbuf + length,
|
|
sizeof(readbuf) - length - 1,
|
|
&count))
|
|
return;
|
|
readbuf[length += count] = '\0';
|
|
|
|
/* Parse each complete line. */
|
|
for (sol = readbuf; (eol = strchr(sol, '\n')) != NULL; sol = eol + 1) {
|
|
*eol = '\0';
|
|
if (*(eol - 1) == '\r') /* take out carriage returns, too... */
|
|
*(eol - 1) = '\0';
|
|
|
|
/* If spammy debug, send the message to opers. */
|
|
if (i_debug(iauth) > 1)
|
|
sendto_opmask_butone(NULL, SNO_AUTH, "Parsing: \"%s\"", sol);
|
|
|
|
/* Parse the line... */
|
|
iauth_parse(iauth, sol);
|
|
}
|
|
|
|
/* Put unused data back into connection's buffer. */
|
|
iauth->i_count = strlen(sol);
|
|
if (iauth->i_count > BUFSIZE)
|
|
iauth->i_count = BUFSIZE;
|
|
memcpy(iauth->i_buffer, sol, iauth->i_count);
|
|
}
|
|
|
|
/** Handle socket activity for an %IAuth connection.
|
|
* @param[in] ev &Socket event; the IAuth connection is the user data
|
|
* pointer for the socket.
|
|
*/
|
|
static void iauth_sock_callback(struct Event *ev)
|
|
{
|
|
struct IAuth *iauth;
|
|
|
|
assert(0 != ev_socket(ev));
|
|
iauth = (struct IAuth*) s_data(ev_socket(ev));
|
|
assert(0 != iauth);
|
|
|
|
switch (ev_type(ev)) {
|
|
case ET_DESTROY:
|
|
if (!IAuthHas(iauth, IAUTH_CLOSING) && !s_active(i_stderr(iauth)))
|
|
iauth_do_spawn(iauth, 1);
|
|
break;
|
|
case ET_READ:
|
|
iauth_read(iauth);
|
|
break;
|
|
case ET_WRITE:
|
|
IAuthClr(iauth, IAUTH_BLOCKED);
|
|
iauth_write(iauth);
|
|
break;
|
|
case ET_ERROR:
|
|
log_write(LS_IAUTH, L_ERROR, 0, "IAuth socket error: %s", strerror(ev_data(ev)));
|
|
/* and fall through to the ET_EOF case */
|
|
case ET_EOF:
|
|
iauth_disconnect(iauth);
|
|
break;
|
|
default:
|
|
assert(0 && "Unrecognized event type");
|
|
break;
|
|
}
|
|
}
|
|
|
|
/** Read error input from \a iauth.
|
|
* @param[in] iauth Readable connection.
|
|
*/
|
|
static void iauth_read_stderr(struct IAuth *iauth)
|
|
{
|
|
static char readbuf[SERVER_TCP_WINDOW];
|
|
unsigned int length, count;
|
|
char *sol;
|
|
char *eol;
|
|
|
|
/* Copy partial data to readbuf, append new data. */
|
|
length = iauth->i_errcount;
|
|
memcpy(readbuf, iauth->i_errbuf, length);
|
|
if (IO_SUCCESS != os_recv_nonb(s_fd(i_stderr(iauth)),
|
|
readbuf + length,
|
|
sizeof(readbuf) - length - 1,
|
|
&count))
|
|
return;
|
|
readbuf[length += count] = '\0';
|
|
|
|
/* Send each complete line to SNO_AUTH. */
|
|
for (sol = readbuf; (eol = strchr(sol, '\n')) != NULL; sol = eol + 1) {
|
|
*eol = '\0';
|
|
if (*(eol - 1) == '\r') /* take out carriage returns, too... */
|
|
*(eol - 1) = '\0';
|
|
Debug((DEBUG_ERROR, "IAuth error: %s", sol));
|
|
log_write(LS_IAUTH, L_ERROR, 0, "IAuth error: %s", sol);
|
|
sendto_opmask_butone(NULL, SNO_AUTH, "%s", sol);
|
|
}
|
|
|
|
/* Put unused data back into connection's buffer. */
|
|
iauth->i_errcount = strlen(sol);
|
|
if (iauth->i_errcount > BUFSIZE)
|
|
iauth->i_errcount = BUFSIZE;
|
|
memcpy(iauth->i_errbuf, sol, iauth->i_errcount);
|
|
}
|
|
|
|
/** Handle error socket activity for an %IAuth connection.
|
|
* @param[in] ev &Socket event; the IAuth connection is the user data
|
|
* pointer for the socket.
|
|
*/
|
|
static void iauth_stderr_callback(struct Event *ev)
|
|
{
|
|
struct IAuth *iauth;
|
|
|
|
assert(0 != ev_socket(ev));
|
|
iauth = (struct IAuth*) s_data(ev_socket(ev));
|
|
assert(0 != iauth);
|
|
|
|
switch (ev_type(ev)) {
|
|
case ET_DESTROY:
|
|
if (!IAuthHas(iauth, IAUTH_CLOSING) && !s_active(i_socket(iauth)))
|
|
iauth_do_spawn(iauth, 1);
|
|
break;
|
|
case ET_READ:
|
|
iauth_read_stderr(iauth);
|
|
break;
|
|
case ET_ERROR:
|
|
log_write(LS_IAUTH, L_ERROR, 0, "IAuth stderr error: %s", strerror(ev_data(ev)));
|
|
/* and fall through to the ET_EOF case */
|
|
case ET_EOF:
|
|
iauth_disconnect(iauth);
|
|
break;
|
|
default:
|
|
assert(0 && "Unrecognized event type");
|
|
break;
|
|
}
|
|
}
|
|
|
|
/** Report active iauth's configuration to \a cptr.
|
|
* @param[in] cptr Client requesting statistics.
|
|
* @param[in] sd Stats descriptor for request.
|
|
* @param[in] param Extra parameter from user (may be NULL).
|
|
*/
|
|
void report_iauth_conf(struct Client *cptr, const struct StatDesc *sd, char *param)
|
|
{
|
|
struct SLink *link;
|
|
|
|
if (iauth) for (link = iauth->i_config; link; link = link->next)
|
|
{
|
|
send_reply(cptr, SND_EXPLICIT | RPL_STATSDEBUG, ":%s",
|
|
link->value.cp);
|
|
}
|
|
}
|
|
|
|
/** Report active iauth's statistics to \a cptr.
|
|
* @param[in] cptr Client requesting statistics.
|
|
* @param[in] sd Stats descriptor for request.
|
|
* @param[in] param Extra parameter from user (may be NULL).
|
|
*/
|
|
void report_iauth_stats(struct Client *cptr, const struct StatDesc *sd, char *param)
|
|
{
|
|
struct SLink *link;
|
|
|
|
if (iauth) for (link = iauth->i_stats; link; link = link->next)
|
|
{
|
|
send_reply(cptr, SND_EXPLICIT | RPL_STATSDEBUG, ":%s",
|
|
link->value.cp);
|
|
}
|
|
}
|