ViewVC Help

View File | Revision Log | Show Annotations | View Changeset | Root Listing

root/svn/ircd-hybrid/trunk/src/auth.c

Comparing ircd-hybrid/trunk/src/auth.c (file contents):
Revision 4340 by michael, Sat Aug 2 16:53:22 2014 UTC vs.
Revision 8385 by michael, Fri Mar 16 20:09:55 2018 UTC

#	Line 1 | Line 1
1		/*
2		*  ircd-hybrid: an advanced, lightweight Internet Relay Chat Daemon (ircd)
3		*
4	<	*  Copyright (c) 1997-2014 ircd-hybrid development team
4	>	*  Copyright (c) 1997-2018 ircd-hybrid development team
5		*
6		*  This program is free software; you can redistribute it and/or modify
7		*  it under the terms of the GNU General Public License as published by
#	Line 15 | Line 15
15		*
16		*  You should have received a copy of the GNU General Public License
17		*  along with this program; if not, write to the Free Software
18	<	*  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307
18	>	*  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301
19		*  USA
20		*/
21
22		/*! \file auth.c
23	<	* \brief Functions for querying a users ident.
23	>	* \brief Implementation of DNS and ident lookups.
24		* \version $Id$
25		*/
26
#	Line 50 | Line 50
50		#include "s_bsd.h"
51		#include "log.h"
52		#include "send.h"
53	<	#include "mempool.h"
53	>	#include "memory.h"
54
55
56	–	static const char *const HeaderMessages[] =
57	–	{
58	–	":*** Looking up your hostname",
59	–	":*** Found your hostname",
60	–	":*** Couldn't look up your hostname",
61	–	":*** Checking Ident",
62	–	":*** Got Ident response",
63	–	":*** No Ident response",
64	–	":*** Your forward and reverse DNS do not match, ignoring hostname",
65	–	":*** Your hostname is too long, ignoring hostname"
66	–	};
67	–
56		enum
57		{
58		REPORT_DO_DNS,
#	Line 74 | Line 62 | enum
62		REPORT_FIN_ID,
63		REPORT_FAIL_ID,
64		REPORT_IP_MISMATCH,
65	<	REPORT_HOST_TOOLONG
65	>	REPORT_HOST_TOOLONG,
66	>	REPORT_HOST_INVALID
67		};
68
69	<	#define sendheader(c, i) sendto_one_notice((c), &me, HeaderMessages[(i)])
69	>	static const char *const HeaderMessages[] =
70	>	{
71	>	[REPORT_DO_DNS] = ":*** Looking up your hostname",
72	>	[REPORT_FIN_DNS] = ":*** Found your hostname",
73	>	[REPORT_FAIL_DNS] = ":*** Couldn't look up your hostname",
74	>	[REPORT_DO_ID] = ":*** Checking Ident",
75	>	[REPORT_FIN_ID] = ":*** Got Ident response",
76	>	[REPORT_FAIL_ID] = ":*** No Ident response",
77	>	[REPORT_IP_MISMATCH] = ":*** Your forward and reverse DNS do not match, ignoring hostname",
78	>	[REPORT_HOST_TOOLONG] = ":*** Your hostname is too long, ignoring hostname",
79	>	[REPORT_HOST_INVALID] = ":*** Your hostname contains illegal characters, ignoring hostname"
80	>	};
81
82	<	static dlink_list auth_pending_list;
83	<	static PF read_auth_reply;
84	<	static CNCB auth_connect_callback;
82	>	#define auth_sendheader(c, i) sendto_one_notice((c), &me, "%s", HeaderMessages[(i)])
83
84	+	static dlink_list auth_list;
85
86	<	/*
87	<	* make_auth_request - allocate a new auth request
86	>
87	>	/*! \brief Allocate a new auth request.
88	>	* \param client The client being looked up.
89	>	* \return The newly allocated auth request.
90		*/
91		static struct AuthRequest *
92	<	make_auth_request(struct Client *client)
92	>	auth_make(struct Client *client)
93		{
94	<	struct AuthRequest *request = &client->localClient->auth;
94	>	struct AuthRequest *auth = xcalloc(sizeof(*auth));
95
96	<	memset(request, 0, sizeof(*request));
96	>	client->connection->auth = auth;
97	>	auth->client = client;
98	>	auth->timeout = CurrentTime + CONNECTTIMEOUT;
99
100	<	request->client  = client;
98	<	request->timeout = CurrentTime + CONNECTTIMEOUT;
99	<
100	<	return request;
100	>	return auth;
101		}
102
103	<	/*
104	<	* release_auth_client - release auth client from auth system
105	<	* this adds the client into the local client lists so it can be read by
106	<	* the main io processing loop
103	>	/*! \brief Release auth client from auth system. This adds the client into the
104	>	*         local client lists so it can be read by the main io processing loop.
105	>	* \param auth Pointer to AuthRequest struct to release
106		*/
107	<	void
108	<	release_auth_client(struct AuthRequest *auth)
107	>	static void
108	>	auth_release_client(struct AuthRequest *auth)
109		{
110	<	struct Client *client = auth->client;
110	>	struct Client *const client = auth->client;
111
112		if (IsDoingAuth(auth) || IsDNSPending(auth))
113		return;
114
115	<	if (IsInAuth(auth))
116	<	{
117	<	dlinkDelete(&auth->node, &auth_pending_list);
118	<	ClearInAuth(auth);
119	<	}
115	>	assert(dlinkFind(&auth_list, auth));
116	>	dlinkDelete(&auth->node, &auth_list);
117	>
118	>	xfree(auth);
119	>	client->connection->auth = NULL;
120
121		/*
122		* When a client has auth'ed, we want to start reading what it sends
123		* us. This is what read_packet() does.
124		*     -- adrian
125		*/
126	<	client->localClient->allow_read = MAX_FLOOD;
127	<	comm_setflush(&client->localClient->fd, 1000, flood_recalc, client);
126	>	client->connection->allow_read = MAX_FLOOD;
127	>	comm_setflush(client->connection->fd, 1000, flood_recalc, client);
128	>
129	>	client->connection->since     = CurrentTime;
130	>	client->connection->lasttime  = CurrentTime;
131	>	client->connection->firsttime = CurrentTime;
132	>	AddFlag(client, FLAGS_FINISHED_AUTH);
133
134	<	client->localClient->since     = CurrentTime;
131	<	client->localClient->lasttime  = CurrentTime;
132	<	client->localClient->firsttime = CurrentTime;
133	<	client->flags |= FLAGS_FINISHED_AUTH;
134	>	strlcpy(client->realhost, client->host, sizeof(client->realhost));
135
136	<	read_packet(&client->localClient->fd, client);
136	>	read_packet(client->connection->fd, client);
137		}
138
139	<	/*
140	<	* auth_dns_callback - called when resolver query finishes
141	<	* if the query resulted in a successful search, name will contain
142	<	* a non-NULL pointer, otherwise name will be NULL.
143	<	* set the client on it's way to a connection completion, regardless
144	<	* of success of failure
139	>	/*! Checks if a hostname is valid and doesn't contain illegal characters
140	>	* \param hostname The string to verify
141	>	* \return 1 if it is valid, 0 if it isn't
142	>	*/
143	>	static int
144	>	auth_verify_hostname(const char *hostname)
145	>	{
146	>	const char *p = hostname;
147	>
148	>	assert(p);
149	>
150	>	if (EmptyString(p) || *p == '.' || *p == ':')
151	>	return 0;
152	>
153	>	for (; *p; ++p)
154	>	if (!IsHostChar(*p))
155	>	return 0;
156	>
157	>	return 1;
158	>	}
159	>
160	>	/*! \brief Handle a complete DNS lookup. Send the client on its way to a connection
161	>	*         completion, regardless of success or failure.
162	>	* \param vptr The pending struct AuthRequest.
163	>	* \param addr IP address being resolved.
164	>	* \param name Resolved name, or NULL if lookup failed.
165	>	* \param namelength String length of the resolved hostname pointed by 'name'
166		*/
167		static void
168	<	auth_dns_callback(void *vptr, const struct irc_ssaddr *addr, const char *name)
168	>	auth_dns_callback(void *vptr, const struct irc_ssaddr *addr, const char *name, size_t namelength)
169		{
170	<	struct AuthRequest *auth = vptr;
170	>	struct AuthRequest *const auth = vptr;
171
172		ClearDNSPending(auth);
173
174	<	if (name)
174	>	if (!EmptyString(name))
175		{
176	<	const struct sockaddr_in *v4, *v4dns;
155	<	#ifdef IPV6
156	<	const struct sockaddr_in6 *v6, *v6dns;
157	<	#endif
158	<	int good = 1;
159	<
160	<	#ifdef IPV6
161	<	if (auth->client->localClient->ip.ss.ss_family == AF_INET6)
176	>	if (auth->client->connection->ip.ss.ss_family == AF_INET6)
177		{
178	<	v6 = (const struct sockaddr_in6 *)&auth->client->localClient->ip;
179	<	v6dns = (const struct sockaddr_in6 *)addr;
178	>	const struct sockaddr_in6 *const v6 = (const struct sockaddr_in6 *)&auth->client->connection->ip;
179	>	const struct sockaddr_in6 *const v6dns = (const struct sockaddr_in6 *)addr;
180
181	<	if (memcmp(&v6->sin6_addr, &v6dns->sin6_addr, sizeof(struct in6_addr)) != 0)
181	>	if (memcmp(&v6->sin6_addr, &v6dns->sin6_addr, sizeof(struct in6_addr)))
182		{
183	<	sendheader(auth->client, REPORT_IP_MISMATCH);
184	<	good = 0;
183	>	auth_sendheader(auth->client, REPORT_IP_MISMATCH);
184	>	auth_release_client(auth);
185	>	return;
186		}
187		}
188		else
173	–	#endif
189		{
190	<	v4 = (const struct sockaddr_in *)&auth->client->localClient->ip;
191	<	v4dns = (const struct sockaddr_in *)addr;
190	>	const struct sockaddr_in *const v4 = (const struct sockaddr_in *)&auth->client->connection->ip;
191	>	const struct sockaddr_in *const v4dns = (const struct sockaddr_in *)addr;
192
193		if (v4->sin_addr.s_addr != v4dns->sin_addr.s_addr)
194		{
195	<	sendheader(auth->client, REPORT_IP_MISMATCH);
196	<	good = 0;
195	>	auth_sendheader(auth->client, REPORT_IP_MISMATCH);
196	>	auth_release_client(auth);
197	>	return;
198		}
199		}
200
201	<	if (good && strlen(name) <= HOSTLEN)
201	>	if (namelength > HOSTLEN)
202	>	auth_sendheader(auth->client, REPORT_HOST_TOOLONG);
203	>	else if (!auth_verify_hostname(name))
204	>	auth_sendheader(auth->client, REPORT_HOST_INVALID);
205	>	else
206		{
207	<	strlcpy(auth->client->host, name,
208	<	sizeof(auth->client->host));
189	<	sendheader(auth->client, REPORT_FIN_DNS);
207	>	strlcpy(auth->client->host, name, sizeof(auth->client->host));
208	>	auth_sendheader(auth->client, REPORT_FIN_DNS);
209		}
191	–	else if (strlen(name) > HOSTLEN)
192	–	sendheader(auth->client, REPORT_HOST_TOOLONG);
210		}
211		else
212	<	sendheader(auth->client, REPORT_FAIL_DNS);
212	>	auth_sendheader(auth->client, REPORT_FAIL_DNS);
213
214	<	release_auth_client(auth);
214	>	auth_release_client(auth);
215		}
216
217		/*
218	<	* authsenderr - handle auth send errors
218	>	* auth_error - handle auth send errors
219		*/
220		static void
221		auth_error(struct AuthRequest *auth)
222		{
223		++ServerStats.is_abad;
224
225	<	fd_close(&auth->fd);
225	>	fd_close(auth->fd);
226	>	auth->fd = NULL;
227
228		ClearAuth(auth);
229
230	<	sendheader(auth->client, REPORT_FAIL_ID);
213	<
214	<	release_auth_client(auth);
215	<	}
216	<
217	<	/*
218	<	* start_auth_query - Flag the client to show that an attempt to
219	<	* contact the ident server on
220	<	* the client's host.  The connect and subsequently the socket are all put
221	<	* into 'non-blocking' mode.  Should the connect or any later phase of the
222	<	* identifing process fail, it is aborted and the user is given a username
223	<	* of "unknown".
224	<	*/
225	<	static int
226	<	start_auth_query(struct AuthRequest *auth)
227	<	{
228	<	struct irc_ssaddr localaddr;
229	<	socklen_t locallen = sizeof(struct irc_ssaddr);
230	<	#ifdef IPV6
231	<	struct sockaddr_in6 *v6;
232	<	#else
233	<	struct sockaddr_in *v4;
234	<	#endif
235	<
236	<	/* open a socket of the same type as the client socket */
237	<	if (comm_open(&auth->fd, auth->client->localClient->ip.ss.ss_family,
238	<	SOCK_STREAM, 0, "ident") == -1)
239	<	{
240	<	report_error(L_ALL, "creating auth stream socket %s:%s",
241	<	get_client_name(auth->client, SHOW_IP), errno);
242	<	ilog(LOG_TYPE_IRCD, "Unable to create auth socket for %s",
243	<	get_client_name(auth->client, SHOW_IP));
244	<	++ServerStats.is_abad;
245	<	return 0;
246	<	}
247	<
248	<	sendheader(auth->client, REPORT_DO_ID);
249	<
250	<	/*
251	<	* get the local address of the client and bind to that to
252	<	* make the auth request.  This used to be done only for
253	<	* ifdef VIRTUAL_HOST, but needs to be done for all clients
254	<	* since the ident request must originate from that same address--
255	<	* and machines with multiple IP addresses are common now
256	<	*/
257	<	memset(&localaddr, 0, locallen);
258	<	getsockname(auth->client->localClient->fd.fd, (struct sockaddr*)&localaddr,
259	<	&locallen);
260	<
261	<	#ifdef IPV6
262	<	remove_ipv6_mapping(&localaddr);
263	<	v6 = (struct sockaddr_in6 *)&localaddr;
264	<	v6->sin6_port = htons(0);
265	<	#else
266	<	localaddr.ss_len = locallen;
267	<	v4 = (struct sockaddr_in *)&localaddr;
268	<	v4->sin_port = htons(0);
269	<	#endif
270	<	localaddr.ss_port = htons(0);
271	<
272	<	comm_connect_tcp(&auth->fd, auth->client->sockhost, RFC1413_PORT,
273	<	(struct sockaddr *)&localaddr, localaddr.ss_len, auth_connect_callback,
274	<	auth, auth->client->localClient->ip.ss.ss_family,
275	<	GlobalSetOptions.ident_timeout);
276	<	return 1; /* We suceed here for now */
277	<	}
278	<
279	<	/*
280	<	* start_auth
281	<	*
282	<	* inputs       - pointer to client to auth
283	<	* output       - NONE
284	<	* side effects - starts auth (identd) and dns queries for a client
285	<	*/
286	<	void
287	<	start_auth(struct Client *client_p)
288	<	{
289	<	struct AuthRequest *auth = NULL;
290	<
291	<	assert(client_p);
292	<
293	<	auth = make_auth_request(client_p);
294	<	SetInAuth(auth);
295	<	dlinkAddTail(auth, &auth->node, &auth_pending_list);
296	<
297	<	sendheader(client_p, REPORT_DO_DNS);
298	<
299	<	SetDNSPending(auth);
300	<
301	<	if (ConfigGeneral.disable_auth == 0)
302	<	{
303	<	SetDoingAuth(auth);
304	<	start_auth_query(auth);
305	<	}
306	<
307	<	gethost_byaddr(auth_dns_callback, auth, &client_p->localClient->ip);
308	<	}
309	<
310	<	/*
311	<	* timeout_auth_queries - timeout resolver and identd requests
312	<	* allow clients through if requests failed
313	<	*/
314	<	static void
315	<	timeout_auth_queries_event(void *notused)
316	<	{
317	<	dlink_node *ptr = NULL, *ptr_next = NULL;
318	<
319	<	DLINK_FOREACH_SAFE(ptr, ptr_next, auth_pending_list.head)
320	<	{
321	<	struct AuthRequest *auth = ptr->data;
322	<
323	<	if (auth->timeout > CurrentTime)
324	<	break;
325	<
326	<	if (IsDoingAuth(auth))
327	<	{
328	<	++ServerStats.is_abad;
329	<	fd_close(&auth->fd);
330	<	ClearAuth(auth);
331	<	sendheader(auth->client, REPORT_FAIL_ID);
332	<	}
333	<
334	<	if (IsDNSPending(auth))
335	<	{
336	<	delete_resolver_queries(auth);
337	<	ClearDNSPending(auth);
338	<	sendheader(auth->client, REPORT_FAIL_DNS);
339	<	}
340	<
341	<	ilog(LOG_TYPE_IRCD, "DNS/AUTH timeout %s",
342	<	get_client_name(auth->client, SHOW_IP));
343	<	release_auth_client(auth);
344	<	}
345	<	}
346	<
347	<	/*
348	<	* auth_connect_callback() - deal with the result of comm_connect_tcp()
349	<	*
350	<	* If the connection failed, we simply close the auth fd and report
351	<	* a failure. If the connection suceeded send the ident server a query
352	<	* giving "theirport , ourport". The write is only attempted *once* so
353	<	* it is deemed to be a fail if the entire write doesn't write all the
354	<	* data given.  This shouldnt be a problem since the socket should have
355	<	* a write buffer far greater than this message to store it in should
356	<	* problems arise. -avalon
357	<	*/
358	<	static void
359	<	auth_connect_callback(fde_t *fd, int error, void *data)
360	<	{
361	<	struct AuthRequest *auth = data;
362	<	struct irc_ssaddr us;
363	<	struct irc_ssaddr them;
364	<	char authbuf[32];
365	<	socklen_t ulen = sizeof(struct irc_ssaddr);
366	<	socklen_t tlen = sizeof(struct irc_ssaddr);
367	<	uint16_t uport, tport;
368	<	#ifdef IPV6
369	<	struct sockaddr_in6 *v6;
370	<	#else
371	<	struct sockaddr_in *v4;
372	<	#endif
373	<
374	<	if (error != COMM_OK)
375	<	{
376	<	auth_error(auth);
377	<	return;
378	<	}
379	<
380	<	if (getsockname(auth->client->localClient->fd.fd, (struct sockaddr *)&us, &ulen) ||
381	<	getpeername(auth->client->localClient->fd.fd, (struct sockaddr *)&them, &tlen))
382	<	{
383	<	ilog(LOG_TYPE_IRCD, "auth get{sock,peer}name error for %s",
384	<	get_client_name(auth->client, SHOW_IP));
385	<	auth_error(auth);
386	<	return;
387	<	}
388	<
389	<	#ifdef IPV6
390	<	v6 = (struct sockaddr_in6 *)&us;
391	<	uport = ntohs(v6->sin6_port);
392	<	v6 = (struct sockaddr_in6 *)&them;
393	<	tport = ntohs(v6->sin6_port);
394	<	remove_ipv6_mapping(&us);
395	<	remove_ipv6_mapping(&them);
396	<	#else
397	<	v4 = (struct sockaddr_in *)&us;
398	<	uport = ntohs(v4->sin_port);
399	<	v4 = (struct sockaddr_in *)&them;
400	<	tport = ntohs(v4->sin_port);
401	<	us.ss_len = ulen;
402	<	them.ss_len = tlen;
403	<	#endif
404	<
405	<	snprintf(authbuf, sizeof(authbuf), "%u, %u\r\n", tport, uport);
406	<
407	<	if (send(fd->fd, authbuf, strlen(authbuf), 0) == -1)
408	<	{
409	<	auth_error(auth);
410	<	return;
411	<	}
230	>	auth_sendheader(auth->client, REPORT_FAIL_ID);
231
232	<	comm_setselect(fd, COMM_SELECT_READ, read_auth_reply, auth, 0);
232	>	auth_release_client(auth);
233		}
234
235		/** Enum used to index ident reply fields in a human-readable way. */
#	Line 428 | Line 247 | enum IdentReplyFields
247		* \return The userid, or NULL on parse failure.
248		*/
249		static const char *
250	<	check_ident_reply(char *reply)
250	>	auth_check_ident_reply(char *const reply)
251		{
252		char *token = NULL, *end = NULL;
253		char *vector[USERID_TOKEN_COUNT];
254	<	int count = token_vector(reply, ':', vector, USERID_TOKEN_COUNT);
254	>	const unsigned int count = token_vector(reply, ':', vector, USERID_TOKEN_COUNT);
255
256		if (USERID_TOKEN_COUNT != count)
257		return NULL;
#	Line 503 | Line 322 | check_ident_reply(char *reply)
322		return token;
323		}
324
325	<	/*
326	<	* read_auth_reply - read the reply (if any) from the ident server
327	<	* we connected to.
328	<	* We only give it one shot, if the reply isn't good the first time
329	<	* fail the authentication entirely. --Bleep
325	>	/*! \brief Read the reply (if any) from the ident server we connected to. We
326	>	*         only give it one shot, if the reply isn't good the first time fail
327	>	*         the authentication entirely. --Bleep
328	>	* \param F The socket/fd to read from.
329	>	* \param data The request to read.
330		*/
331		static void
332	<	read_auth_reply(fde_t *fd, void *data)
332	>	auth_read_reply(fde_t *F, void *data)
333		{
334	<	struct AuthRequest *auth = data;
334	>	struct AuthRequest *const auth = data;
335		const char *username = NULL;
336		ssize_t len = 0;
337		char buf[RFC1413_BUFSIZ + 1];
338
339	<	if ((len = recv(fd->fd, buf, RFC1413_BUFSIZ, 0)) > 0)
339	>	assert(auth->fd == F);
340	>
341	>	if ((len = recv(auth->fd->fd, buf, RFC1413_BUFSIZ, 0)) > 0)
342		{
343		buf[len] = '\0';
344	<	username = check_ident_reply(buf);
344	>	username = auth_check_ident_reply(buf);
345		}
346
347	<	fd_close(fd);
347	>	fd_close(auth->fd);
348	>	auth->fd = NULL;
349
350		ClearAuth(auth);
351
352		if (EmptyString(username))
353		{
354	<	sendheader(auth->client, REPORT_FAIL_ID);
354	>	auth_sendheader(auth->client, REPORT_FAIL_ID);
355		++ServerStats.is_abad;
356		}
357		else
358		{
359		strlcpy(auth->client->username, username, sizeof(auth->client->username));
360	<	sendheader(auth->client, REPORT_FIN_ID);
360	>	auth_sendheader(auth->client, REPORT_FIN_ID);
361		++ServerStats.is_asuc;
362	<	SetGotId(auth->client);
362	>	AddFlag(auth->client, FLAGS_GOTID);
363	>	}
364	>
365	>	auth_release_client(auth);
366	>	}
367	>
368	>	/*
369	>	* auth_connect_callback() - deal with the result of comm_connect_tcp()
370	>	*
371	>	* If the connection failed, we simply close the auth fd and report
372	>	* a failure. If the connection suceeded send the ident server a query
373	>	* giving "theirport , ourport". The write is only attempted *once* so
374	>	* it is deemed to be a fail if the entire write doesn't write all the
375	>	* data given.  This shouldnt be a problem since the socket should have
376	>	* a write buffer far greater than this message to store it in should
377	>	* problems arise. -avalon
378	>	*/
379	>	static void
380	>	auth_connect_callback(fde_t *F, int error, void *data)
381	>	{
382	>	struct AuthRequest *const auth = data;
383	>	struct irc_ssaddr us;
384	>	struct irc_ssaddr them;
385	>	char authbuf[16];
386	>	ssize_t len = 0;
387	>	socklen_t ulen = sizeof(struct irc_ssaddr);
388	>	socklen_t tlen = sizeof(struct irc_ssaddr);
389	>	uint16_t uport, tport;
390	>	struct sockaddr_in6 *v6;
391	>
392	>	if (error != COMM_OK)
393	>	{
394	>	auth_error(auth);
395	>	return;
396	>	}
397	>
398	>	assert(auth->fd == F);
399	>
400	>	if (getsockname(auth->client->connection->fd->fd, (struct sockaddr *)&us, &ulen) ||
401	>	getpeername(auth->client->connection->fd->fd, (struct sockaddr *)&them, &tlen))
402	>	{
403	>	report_error(L_ALL, "auth get{sock,peer}name error %s:%s",
404	>	client_get_name(auth->client, SHOW_IP), errno);
405	>	auth_error(auth);
406	>	return;
407	>	}
408	>
409	>	v6 = (struct sockaddr_in6 *)&us;
410	>	uport = ntohs(v6->sin6_port);
411	>	v6 = (struct sockaddr_in6 *)&them;
412	>	tport = ntohs(v6->sin6_port);
413	>
414	>	len = snprintf(authbuf, sizeof(authbuf), "%u, %u\r\n", tport, uport);
415	>
416	>	if (send(F->fd, authbuf, len, 0) != len)
417	>	{
418	>	auth_error(auth);
419	>	return;
420	>	}
421	>
422	>	comm_setselect(F, COMM_SELECT_READ, auth_read_reply, auth, 0);
423	>	}
424	>
425	>	/*! \brief Flag the client to show an attempt to contact the ident server on
426	>	*         the client's host. Should the connect or any later phase of the
427	>	*         identifying process fail, it is aborted and the user is given a
428	>	*         username of "unknown".
429	>	* \param auth The request for which to start the ident lookup.
430	>	*/
431	>	static void
432	>	auth_start_query(struct AuthRequest *auth)
433	>	{
434	>	struct irc_ssaddr localaddr;
435	>	socklen_t locallen = sizeof(struct irc_ssaddr);
436	>	struct sockaddr_in6 *v6;
437	>
438	>	/* Open a socket of the same type as the client socket */
439	>	int fd = comm_socket(auth->client->connection->ip.ss.ss_family, SOCK_STREAM, 0);
440	>	if (fd == -1)
441	>	{
442	>	report_error(L_ALL, "creating auth stream socket %s:%s",
443	>	client_get_name(auth->client, SHOW_IP), errno);
444	>	++ServerStats.is_abad;
445	>	return;
446		}
447
448	<	release_auth_client(auth);
448	>	auth->fd = fd_open(fd, 1, "ident");
449	>
450	>	SetDoingAuth(auth);
451	>	auth_sendheader(auth->client, REPORT_DO_ID);
452	>
453	>	/*
454	>	* Get the local address of the client and bind to that to
455	>	* make the auth request.
456	>	*/
457	>	memset(&localaddr, 0, locallen);
458	>	getsockname(auth->client->connection->fd->fd, (struct sockaddr *)&localaddr, &locallen);
459	>
460	>	remove_ipv6_mapping(&localaddr);
461	>	v6 = (struct sockaddr_in6 *)&localaddr;
462	>	v6->sin6_port = htons(0);
463	>	localaddr.ss_port = htons(0);
464	>
465	>	comm_connect_tcp(auth->fd, auth->client->sockhost, RFC1413_PORT,
466	>	(struct sockaddr *)&localaddr, localaddr.ss_len, auth_connect_callback,
467	>	auth, auth->client->connection->ip.ss.ss_family,
468	>	GlobalSetOptions.ident_timeout);
469	>	}
470	>
471	>	/*
472	>	* auth_start
473	>	*
474	>	* inputs       - pointer to client to auth
475	>	* output       - NONE
476	>	* side effects - starts auth (identd) and dns queries for a client
477	>	*/
478	>	void
479	>	auth_start(struct Client *client_p)
480	>	{
481	>	struct AuthRequest *auth = auth_make(client_p);
482	>
483	>	dlinkAddTail(auth, &auth->node, &auth_list);
484	>
485	>	auth_sendheader(client_p, REPORT_DO_DNS);
486	>
487	>	SetDNSPending(auth);
488	>
489	>	if (ConfigGeneral.disable_auth == 0)
490	>	auth_start_query(auth);
491	>
492	>	gethost_byaddr(auth_dns_callback, auth, &client_p->connection->ip);
493		}
494
495		/*
496	<	* delete_auth()
496	>	* auth_delete()
497		*/
498		void
499	<	delete_auth(struct AuthRequest *auth)
499	>	auth_delete(struct AuthRequest *auth)
500		{
501	+	if (IsDoingAuth(auth))
502	+	{
503	+	fd_close(auth->fd);
504	+	auth->fd = NULL;
505	+
506	+	ClearAuth(auth);
507	+	}
508	+
509		if (IsDNSPending(auth))
510	+	{
511		delete_resolver_queries(auth);
512	+	ClearDNSPending(auth);
513	+	}
514
515	<	if (IsDoingAuth(auth))
516	<	fd_close(&auth->fd);
515	>	assert(dlinkFind(&auth_list, auth));
516	>	dlinkDelete(&auth->node, &auth_list);
517	>	xfree(auth);
518	>	}
519
520	<	if (IsInAuth(auth))
520	>	/*
521	>	* auth_timeout_queries - timeout resolver and identd requests
522	>	* allow clients through if requests failed
523	>	*/
524	>	static void
525	>	auth_timeout_queries(void *notused)
526	>	{
527	>	dlink_node *node, *node_next;
528	>
529	>	DLINK_FOREACH_SAFE(node, node_next, auth_list.head)
530		{
531	<	dlinkDelete(&auth->node, &auth_pending_list);
532	<	ClearInAuth(auth);
531	>	struct AuthRequest *auth = node->data;
532	>
533	>	if (auth->timeout > CurrentTime)
534	>	break;
535	>
536	>	if (IsDoingAuth(auth))
537	>	{
538	>	++ServerStats.is_abad;
539	>
540	>	fd_close(auth->fd);
541	>	auth->fd = NULL;
542	>
543	>	ClearAuth(auth);
544	>
545	>	auth_sendheader(auth->client, REPORT_FAIL_ID);
546	>	}
547	>
548	>	if (IsDNSPending(auth))
549	>	{
550	>	delete_resolver_queries(auth);
551	>	ClearDNSPending(auth);
552	>
553	>	auth_sendheader(auth->client, REPORT_FAIL_DNS);
554	>	}
555	>
556	>	auth_release_client(auth);
557		}
558		}
559
#	Line 571 | Line 566 | auth_init(void)
566		{
567		static struct event timeout_auth_queries =
568		{
569	<	.name = "timeout_auth_queries_event",
570	<	.handler = timeout_auth_queries_event,
569	>	.name = "auth_timeout_queries",
570	>	.handler = auth_timeout_queries,
571		.when = 1
572		};
573

Comparing ircd-hybrid/trunk/src/auth.c (property svn:keywords):
Revision 4340 by michael, Sat Aug 2 16:53:22 2014 UTC vs.
Revision 8385 by michael, Fri Mar 16 20:09:55 2018 UTC

#	Line 1 | Line 1
1	<	Id Revision
1	>	Id

Diff Legend

–	Removed lines
+	Added lines
<	Changed lines (old)
>	Changed lines (new)