trunk/src/hostmask.c

/*
 *  ircd-hybrid: an advanced, lightweight Internet Relay Chat Daemon (ircd)
 *
 *  Copyright (c) 2001-2015 ircd-hybrid development team
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2 of the License, or
 *  (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License
 *  along with this program; if not, write to the Free Software
 *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301
 *  USA
 */

/*! \file hostmask.c
 * \brief Code to efficiently find IP & hostmask based configs.
 * \version $Id$
 */

#include "stdinc.h"
#include "memory.h"
#include "ircd_defs.h"
#include "list.h"
#include "conf.h"
#include "hostmask.h"
#include "send.h"
#include "irc_string.h"
#include "ircd.h"


#define DigitParse(ch) do { \
                       if (ch >= '0' && ch <= '9') \
                         ch = ch - '0'; \
                       else if (ch >= 'A' && ch <= 'F') \
                         ch = ch - 'A' + 10; \
                       else if (ch >= 'a' && ch <= 'f') \
                         ch = ch - 'a' + 10; \
                       } while (0);

/* The mask parser/type determination code... */

/* int try_parse_v6_netmask(const char *, struct irc_ssaddr *, int *);
 * Input: A possible IPV6 address as a string.
 * Output: An integer describing whether it is an IPV6 or hostmask,
 *         an address(if it is IPV6), a bitlength(if it is IPV6).
 * Side effects: None
 * Comments: Called from parse_netmask
 */
/* Fixed so ::/0 (any IPv6 address) is valid
   Also a bug in DigitParse above.
   -Gozem 2002-07-19 gozem@linux.nu
*/
static int
try_parse_v6_netmask(const char *text, struct irc_ssaddr *addr, int *b)
{
  char c;
  int d[8] = { 0, 0, 0, 0, 0, 0, 0, 0 };
  int dp = 0;
  int nyble = 4;
  int finsert = -1;
  int bits = 128;
  int deficit = 0;
  short dc[8];
  struct sockaddr_in6 *const v6 = (struct sockaddr_in6 *)addr;

  for (const char *p = text; (c = *p); ++p)
  {
    if (IsXDigit(c))
    {
      if (nyble == 0)
        return HM_HOST;
      DigitParse(c);
      d[dp] |= c << (4 * --nyble);
    }
    else if (c == ':')
    {
      if (p > text && *(p - 1) == ':')
      {
        if (finsert >= 0)
          return HM_HOST;
        finsert = dp;
      }
      else
      {
        /* If there were less than 4 hex digits, e.g. :ABC: shift right
         * so we don't interpret it as ABC0 -A1kmm */
        d[dp] = d[dp] >> 4 * nyble;
        nyble = 4;
        if (++dp >= 8)
          return HM_HOST;
      }
    }
    else if (c == '*')
    {
      /* * must be last, and * is ambiguous if there is a ::... -A1kmm */
      if (finsert >= 0 || *(p + 1) || dp == 0 || *(p - 1) != ':')
        return HM_HOST;
      bits = dp * 16;
    }
    else if (c == '/')
    {
      char *after;

      d[dp] = d[dp] >> 4 * nyble;
      ++dp;
      bits = strtoul(p + 1, &after, 10);

      if (bits < 0 || *after)
        return HM_HOST;
      if (bits > dp * 4 && !(finsert >= 0 && bits <= 128))
        return HM_HOST;
      break;
    }
    else
      return HM_HOST;
  }

  d[dp] = d[dp] >> 4 * nyble;

  if (c == 0)
    ++dp;
  if (finsert < 0 && bits == 0)
    bits = dp * 16;

  /* How many words are missing? -A1kmm */
  deficit = bits / 16 + ((bits % 16) ? 1 : 0) - dp;

  /* Now fill in the gaps(from ::) in the copied table... -A1kmm */
  for (dp = 0, nyble = 0; dp < 8; ++dp)
  {
    if (nyble == finsert && deficit)
    {
      dc[dp] = 0;
      deficit--;
    }
    else
      dc[dp] = d[nyble++];
  }

  /* Set unused bits to 0... -A1kmm */
  if (bits < 128 && (bits % 16 != 0))
    dc[bits / 16] &= ~((1 << (15 - bits % 16)) - 1);
  for (dp = bits / 16 + (bits % 16 ? 1 : 0); dp < 8; ++dp)
    dc[dp] = 0;

  /* And assign... -A1kmm */
  if (addr)
    for (dp = 0; dp < 8; ++dp)
      /* The cast is a kludge to make netbsd work. */
      ((unsigned short *)&v6->sin6_addr)[dp] = htons(dc[dp]);

  if (b)
    *b = bits;
  return HM_IPV6;
}

/* int try_parse_v4_netmask(const char *, struct irc_ssaddr *, int *);
 * Input: A possible IPV4 address as a string.
 * Output: An integer describing whether it is an IPV4 or hostmask,
 *         an address(if it is IPV4), a bitlength(if it is IPV4).
 * Side effects: None
 * Comments: Called from parse_netmask
 */
static int
try_parse_v4_netmask(const char *text, struct irc_ssaddr *addr, int *b)
{
  const char *digits[4];
  unsigned char addb[4];
  int n = 0, bits = 0;
  char c;
  struct sockaddr_in *const v4 = (struct sockaddr_in *)addr;

  digits[n++] = text;

  for (const char *p = text; (c = *p); ++p)
  {
    if (c >= '0' && c <= '9')   /* empty */
      ;
    else if (c == '.')
    {
      if (n >= 4)
        return HM_HOST;

      digits[n++] = p + 1;
    }
    else if (c == '*')
    {
      if (*(p + 1) || n == 0 || *(p - 1) != '.')
        return HM_HOST;

      bits = (n - 1) * 8;
      break;
    }
    else if (c == '/')
    {
      char *after;
      bits = strtoul(p + 1, &after, 10);

      if (bits < 0 || *after)
        return HM_HOST;
      if (bits > n * 8)
        return HM_HOST;

      break;
    }
    else
      return HM_HOST;
  }

  if (n < 4 && bits == 0)
    bits = n * 8;
  if (bits)
    while (n < 4)
      digits[n++] = "0";

  for (n = 0; n < 4; ++n)
    addb[n] = strtoul(digits[n], NULL, 10);

  if (bits == 0)
    bits = 32;

  /* Set unused bits to 0... -A1kmm */
  if (bits < 32 && bits % 8)
    addb[bits / 8] &= ~((1 << (8 - bits % 8)) - 1);
  for (n = bits / 8 + (bits % 8 ? 1 : 0); n < 4; ++n)
    addb[n] = 0;
  if (addr)
    v4->sin_addr.s_addr =
      htonl(addb[0] << 24 | addb[1] << 16 | addb[2] << 8 | addb[3]);
  if (b)
    *b = bits;
  return HM_IPV4;
}

/* int parse_netmask(const char *, struct irc_ssaddr *, int *);
 * Input: A hostmask, or an IPV4/6 address.
 * Output: An integer describing whether it is an IPV4, IPV6 address or a
 *         hostmask, an address(if it is an IP mask),
 *         a bitlength(if it is IP mask).
 * Side effects: None
 */
int
parse_netmask(const char *text, struct irc_ssaddr *addr, int *b)
{
  if (strchr(text, '.'))
    return try_parse_v4_netmask(text, addr, b);
  if (strchr(text, ':'))
    return try_parse_v6_netmask(text, addr, b);

  return HM_HOST;
}

/* The address matching stuff... */
/* int match_ipv6(struct irc_ssaddr *, struct irc_ssaddr *, int)
 * Input: An IP address, an IP mask, the number of bits in the mask.
 * Output: if match, -1 else 0
 * Side effects: None
 */
int
match_ipv6(const struct irc_ssaddr *addr, const struct irc_ssaddr *mask, int bits)
{
  int i, m, n = bits / 8;
  const struct sockaddr_in6 *const v6 = (const struct sockaddr_in6 *)addr;
  const struct sockaddr_in6 *const v6mask = (const struct sockaddr_in6 *)mask;

  for (i = 0; i < n; ++i)
    if (v6->sin6_addr.s6_addr[i] != v6mask->sin6_addr.s6_addr[i])
      return 0;

  if ((m = bits % 8) == 0)
    return -1;
  if ((v6->sin6_addr.s6_addr[n] & ~((1 << (8 - m)) - 1)) ==
      v6mask->sin6_addr.s6_addr[n])
    return -1;
  return 0;
}

/* int match_ipv4(struct irc_ssaddr *, struct irc_ssaddr *, int)
 * Input: An IP address, an IP mask, the number of bits in the mask.
 * Output: if match, -1 else 0
 * Side Effects: None
 */
int
match_ipv4(const struct irc_ssaddr *addr, const struct irc_ssaddr *mask, int bits)
{
  const struct sockaddr_in *const v4 = (const struct sockaddr_in *)addr;
  const struct sockaddr_in *const v4mask = (const struct sockaddr_in *)mask;

  if ((ntohl(v4->sin_addr.s_addr) & ~((1 << (32 - bits)) - 1)) !=
      ntohl(v4mask->sin_addr.s_addr))
    return 0;
  return -1;
}

/*
 * mask_addr
 *
 * inputs       - pointer to the ip to mask
 *              - bitlen
 * output       - NONE
 * side effects -
 */
void
mask_addr(struct irc_ssaddr *ip, int bits)
{
  int mask;
  struct sockaddr_in6 *v6_base_ip;
  int i, m, n;
  struct sockaddr_in *v4_base_ip;

  if (ip->ss.ss_family == AF_INET)
  {
    uint32_t tmp = 0;
    v4_base_ip = (struct sockaddr_in *)ip;

    mask = ~((1 << (32 - bits)) - 1);
    tmp = ntohl(v4_base_ip->sin_addr.s_addr);
    v4_base_ip->sin_addr.s_addr = htonl(tmp & mask);
  }
  else
  {
    n = bits / 8;
    m = bits % 8;
    v6_base_ip = (struct sockaddr_in6 *)ip;

    mask = ~((1 << (8 - m)) - 1);
    v6_base_ip->sin6_addr.s6_addr[n] = v6_base_ip->sin6_addr.s6_addr[n] & mask;

    for (i = n + 1; i < 16; i++)
      v6_base_ip->sin6_addr.s6_addr[i] = 0;
  }
}

/* Hashtable stuff...now external as it's used in m_stats.c */
dlink_list atable[ATABLE_SIZE];

/* unsigned long hash_ipv4(struct irc_ssaddr*)
 * Input: An IP address.
 * Output: A hash value of the IP address.
 * Side effects: None
 */
static uint32_t
hash_ipv4(const struct irc_ssaddr *addr, int bits)
{
  if (bits != 0)
  {
    const struct sockaddr_in *const v4 = (const struct sockaddr_in *)addr;
    uint32_t av = ntohl(v4->sin_addr.s_addr) & ~((1 << (32 - bits)) - 1);

    return (av ^ (av >> 12) ^ (av >> 24)) & (ATABLE_SIZE - 1);
  }

  return 0;
}

/* unsigned long hash_ipv6(struct irc_ssaddr*)
 * Input: An IP address.
 * Output: A hash value of the IP address.
 * Side effects: None
 */
static uint32_t
hash_ipv6(const struct irc_ssaddr *addr, int bits)
{
  uint32_t v = 0, n;
  const struct sockaddr_in6 *const v6 = (const struct sockaddr_in6 *)addr;

  for (n = 0; n < 16; ++n)
  {
    if (bits >= 8)
    {
      v ^= v6->sin6_addr.s6_addr[n];
      bits -= 8;
    }
    else if (bits)
    {
      v ^= v6->sin6_addr.s6_addr[n] & ~((1 << (8 - bits)) - 1);
      return v & (ATABLE_SIZE - 1);
    }
    else
      return v & (ATABLE_SIZE - 1);
  }

  return v & (ATABLE_SIZE - 1);
}

/* int hash_text(const char *start)
 * Input: The start of the text to hash.
 * Output: The hash of the string between 1 and (TH_MAX-1)
 * Side-effects: None.
 */
static uint32_t
hash_text(const char *start)
{
  uint32_t h = 0;

  for (const char *p = start; *p; ++p)
    h = (h << 4) - (h + ToLower(*p));

  return h & (ATABLE_SIZE - 1);
}

/* unsigned long get_hash_mask(const char *)
 * Input: The text to hash.
 * Output: The hash of the string right of the first '.' past the last
 *         wildcard in the string.
 * Side-effects: None.
 */
static uint32_t
get_mask_hash(const char *text)
{
  const char *hp = "", *p;

  for (p = text + strlen(text) - 1; p >= text; --p)
    if (IsMWildChar(*p))
      return hash_text(hp);
    else if (*p == '.')
      hp = p + 1;
  return hash_text(text);
}

/* struct MaskItem *find_conf_by_address(const char *, struct irc_ssaddr *,
 *                                         int type, int fam, const char *username)
 * Input: The hostname, the address, the type of mask to find, the address
 *        family, the username.
 * Output: The matching value with the highest precedence.
 * Side-effects: None
 * Note: Setting bit 0 of the type means that the username is ignored.
 * Warning: IsNeedPassword for everything that is not an auth{} entry
 * should always be true (i.e. conf->flags & CONF_FLAGS_NEED_PASSWORD == 0)
 */
struct MaskItem *
find_conf_by_address(const char *name, struct irc_ssaddr *addr, unsigned int type,
                     int fam, const char *username, const char *password, int do_match)
{
  unsigned int hprecv = 0;
  dlink_node *node = NULL;
  struct MaskItem *hprec = NULL;
  struct AddressRec *arec = NULL;
  int b;
  int (*cmpfunc)(const char *, const char *) = do_match ? match : irccmp;

  if (addr)
  {
    /* Check for IPV6 matches... */
    if (fam == AF_INET6)
    {
      for (b = 128; b >= 0; b -= 16)
      {
        DLINK_FOREACH(node, atable[hash_ipv6(addr, b)].head)
        {
          arec = node->data;

          if ((arec->type == type) &&
              arec->precedence > hprecv &&
              arec->masktype == HM_IPV6 &&
              match_ipv6(addr, &arec->Mask.ipa.addr,
                         arec->Mask.ipa.bits) &&
              (!username || !cmpfunc(arec->username, username)) &&
              (IsNeedPassword(arec->conf) || arec->conf->passwd == NULL ||
               match_conf_password(password, arec->conf)))
          {
            hprecv = arec->precedence;
            hprec = arec->conf;
          }
        }
      }
    }
    else if (fam == AF_INET)
    {
      for (b = 32; b >= 0; b -= 8)
      {
        DLINK_FOREACH(node, atable[hash_ipv4(addr, b)].head)
        {
          arec = node->data;

          if ((arec->type == type) &&
              arec->precedence > hprecv &&
              arec->masktype == HM_IPV4 &&
              match_ipv4(addr, &arec->Mask.ipa.addr,
                         arec->Mask.ipa.bits) &&
              (!username || !cmpfunc(arec->username, username)) &&
              (IsNeedPassword(arec->conf) || arec->conf->passwd == NULL ||
               match_conf_password(password, arec->conf)))
          {
            hprecv = arec->precedence;
            hprec = arec->conf;
          }
        }
      }
    }
  }

  if (name)
  {
    const char *p = name;

    while (1)
    {
        DLINK_FOREACH(node, atable[hash_text(p)].head)
        {
          arec = node->data;
          if ((arec->type == type) &&
            arec->precedence > hprecv &&
            (arec->masktype == HM_HOST) &&
            !cmpfunc(arec->Mask.hostname, name) &&
            (!username || !cmpfunc(arec->username, username)) &&
            (IsNeedPassword(arec->conf) || arec->conf->passwd == NULL ||
             match_conf_password(password, arec->conf)))
        {
          hprecv = arec->precedence;
          hprec = arec->conf;
        }
      }

      if ((p = strchr(p, '.')) == NULL)
        break;
      ++p;
    }

    DLINK_FOREACH(node, atable[0].head)
    {
      arec = node->data;

      if (arec->type == type &&
          arec->precedence > hprecv &&
          arec->masktype == HM_HOST &&
          !cmpfunc(arec->Mask.hostname, name) &&
          (!username || !cmpfunc(arec->username, username)) &&
          (IsNeedPassword(arec->conf) || arec->conf->passwd == NULL ||
           match_conf_password(password, arec->conf)))
      {
        hprecv = arec->precedence;
        hprec = arec->conf;
      }
    }
  }

  return hprec;
}

/* struct MaskItem* find_address_conf(const char*, const char*,
 *                                     struct irc_ssaddr*, int, char *);
 * Input: The hostname, username, address, address family.
 * Output: The applicable MaskItem.
 * Side-effects: None
 */
struct MaskItem *
find_address_conf(const char *host, const char *user, struct irc_ssaddr *ip,
                  int aftype, const char *password)
{
  struct MaskItem *authcnf = NULL, *killcnf = NULL;

  /* Find the best auth{} block... If none, return NULL -A1kmm */
  if ((authcnf = find_conf_by_address(host, ip, CONF_CLIENT, aftype, user,
                                      password, 1)) == NULL)
    return NULL;

  /* If they are exempt from K-lines, return the best auth{} block. -A1kmm */
  if (IsConfExemptKline(authcnf))
    return authcnf;

  /* Find the best K-line... -A1kmm */
  killcnf = find_conf_by_address(host, ip, CONF_KLINE, aftype, user, NULL, 1);

  /*
   * If they are K-lined, return the K-line. Otherwise, return the
   * auth{} block. -A1kmm
   */
  if (killcnf)
    return killcnf;

  if (IsConfExemptGline(authcnf))
    return authcnf;

  killcnf = find_conf_by_address(host, ip, CONF_GLINE, aftype, user, NULL, 1);
  if (killcnf)
    return killcnf;

  return authcnf;
}

/* struct MaskItem* find_dline_conf(struct irc_ssaddr*, int)
 *
 * Input:       An address, an address family.
 * Output:      The best matching D-line or exempt line.
 * Side effects: None.
 */
struct MaskItem *
find_dline_conf(struct irc_ssaddr *addr, int aftype)
{
  struct MaskItem *eline;

  eline = find_conf_by_address(NULL, addr, CONF_EXEMPT, aftype, NULL, NULL, 1);
  if (eline)
    return eline;

  return find_conf_by_address(NULL, addr, CONF_DLINE, aftype, NULL, NULL, 1);
}

/* void add_conf_by_address(int, struct MaskItem *aconf)
 * Input:
 * Output: None
 * Side-effects: Adds this entry to the hash table.
 */
struct AddressRec *
add_conf_by_address(const unsigned int type, struct MaskItem *conf)
{
  struct AddressRec *arec = NULL;
  const char *const hostname = conf->host;
  const char *const username = conf->user;
  static unsigned int prec_value = 0xFFFFFFFF;
  int bits = 0;

  assert(type && !EmptyString(hostname));

  arec = MyCalloc(sizeof(struct AddressRec));
  arec->masktype = parse_netmask(hostname, &arec->Mask.ipa.addr, &bits);
  arec->Mask.ipa.bits = bits;
  arec->username = username;
  arec->conf = conf;
  arec->precedence = prec_value--;
  arec->type = type;

  switch (arec->masktype)
  {
    case HM_IPV4:
      /* We have to do this, since we do not re-hash for every bit -A1kmm. */
      bits -= bits % 8;
      dlinkAdd(arec, &arec->node, &atable[hash_ipv4(&arec->Mask.ipa.addr, bits)]);
      break;
    case HM_IPV6:
      /* We have to do this, since we do not re-hash for every bit -A1kmm. */
      bits -= bits % 16;
      dlinkAdd(arec, &arec->node, &atable[hash_ipv6(&arec->Mask.ipa.addr, bits)]);
      break;
    default: /* HM_HOST */
      arec->Mask.hostname = hostname;
      dlinkAdd(arec, &arec->node, &atable[get_mask_hash(hostname)]);
      break;
  }

  return arec;
}

/* void delete_one_address(const char*, struct MaskItem*)
 * Input: An address string, the associated MaskItem.
 * Output: None
 * Side effects: Deletes an address record. Frees the MaskItem if there
 *               is nothing referencing it, sets it as illegal otherwise.
 */
void
delete_one_address_conf(const char *address, struct MaskItem *conf)
{
  int bits = 0;
  uint32_t hv = 0;
  dlink_node *node = NULL;
  struct irc_ssaddr addr;

  switch (parse_netmask(address, &addr, &bits))
  {
    case HM_IPV4:
      /* We have to do this, since we do not re-hash for every bit -A1kmm. */
      bits -= bits % 8;
      hv = hash_ipv4(&addr, bits);
      break;
    case HM_IPV6:
      /* We have to do this, since we do not re-hash for every bit -A1kmm. */
      bits -= bits % 16;
      hv = hash_ipv6(&addr, bits);
      break;
    default: /* HM_HOST */
      hv = get_mask_hash(address);
      break;
  }

  DLINK_FOREACH(node, atable[hv].head)
  {
    struct AddressRec *arec = node->data;

    if (arec->conf == conf)
    {
      dlinkDelete(&arec->node, &atable[hv]);

      if (!conf->ref_count)
        conf_free(conf);

      MyFree(arec);
      return;
    }
  }
}

/* void clear_out_address_conf(void)
 * Input: None
 * Output: None
 * Side effects: Clears out all address records in the hash table,
 *               frees them, and frees the MaskItems if nothing references
 *               them, otherwise sets them as illegal.
 */
void
clear_out_address_conf(void)
{
  dlink_node *node = NULL, *node_next = NULL;

  for (unsigned int i = 0; i < ATABLE_SIZE; ++i)
  {
    DLINK_FOREACH_SAFE(node, node_next, atable[i].head)
    {
      struct AddressRec *arec = node->data;

      /*
       * We keep the temporary K-lines and destroy the permanent ones,
       * just to be confusing :) -A1kmm
       */
      if (arec->conf->until || IsConfDatabase(arec->conf))
        continue;

      dlinkDelete(&arec->node, &atable[i]);
      arec->conf->active = 0;

      if (!arec->conf->ref_count)
        conf_free(arec->conf);
      MyFree(arec);
    }
  }
}

static void
hostmask_send_expiration(const struct AddressRec *const arec)
{
  char ban_type = '\0';

  if (!ConfigGeneral.tkline_expire_notices)
    return;

  switch (arec->type)
  {
    case CONF_KLINE:
      ban_type = 'K';
      break;
    case CONF_DLINE:
      ban_type = 'D';
      break;
    case CONF_GLINE:
      ban_type = 'G';
      break;
    default: break;
  }

  sendto_realops_flags(UMODE_ALL, L_ALL, SEND_NOTICE,
                       "Temporary %c-line for [%s@%s] expired", ban_type,
                       (arec->conf->user) ? arec->conf->user : "*",
                       (arec->conf->host) ? arec->conf->host : "*");
}

void
hostmask_expire_temporary(void)
{
  dlink_node *node = NULL, *node_next = NULL;

  for (unsigned int i = 0; i < ATABLE_SIZE; ++i)
  {
    DLINK_FOREACH_SAFE(node, node_next, atable[i].head)
    {
      struct AddressRec *arec = node->data;

      if (!arec->conf->until || arec->conf->until > CurrentTime)
        continue;

      switch (arec->type)
      {
        case CONF_KLINE:
        case CONF_DLINE:
        case CONF_GLINE:
          hostmask_send_expiration(arec);

          dlinkDelete(&arec->node, &atable[i]);
          conf_free(arec->conf);
          MyFree(arec);
          break;
        default: break;
      }
    }
  }
}
Revision:	5347
Committed:	Sun Jan 11 12:42:20 2015 UTC (10 years, 7 months ago) by michael
Content type:	text/x-csrc
File size:	20920 byte(s)
Log Message:	- Update copyright years
#	Content
1	/*
2	* ircd-hybrid: an advanced, lightweight Internet Relay Chat Daemon (ircd)
3	*
4	* Copyright (c) 2001-2015 ircd-hybrid development team
5	*
6	* This program is free software; you can redistribute it and/or modify
7	* it under the terms of the GNU General Public License as published by
8	* the Free Software Foundation; either version 2 of the License, or
9	* (at your option) any later version.
10	*
11	* This program is distributed in the hope that it will be useful,
12	* but WITHOUT ANY WARRANTY; without even the implied warranty of
13	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14	* GNU General Public License for more details.
15	*
16	* You should have received a copy of the GNU General Public License
17	* along with this program; if not, write to the Free Software
18	* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301
19	* USA
20	*/
21
22	/*! \file hostmask.c
23	* \brief Code to efficiently find IP & hostmask based configs.
24	* \version $Id$
25	*/
26
27	#include "stdinc.h"
28	#include "memory.h"
29	#include "ircd_defs.h"
30	#include "list.h"
31	#include "conf.h"
32	#include "hostmask.h"
33	#include "send.h"
34	#include "irc_string.h"
35	#include "ircd.h"
36
37
38	#define DigitParse(ch) do { \
39	if (ch >= '0' && ch <= '9') \
40	ch = ch - '0'; \
41	else if (ch >= 'A' && ch <= 'F') \
42	ch = ch - 'A' + 10; \
43	else if (ch >= 'a' && ch <= 'f') \
44	ch = ch - 'a' + 10; \
45	} while (0);
46
47	/* The mask parser/type determination code... */
48
49	/* int try_parse_v6_netmask(const char , struct irc_ssaddr , int *);
50	* Input: A possible IPV6 address as a string.
51	* Output: An integer describing whether it is an IPV6 or hostmask,
52	* an address(if it is IPV6), a bitlength(if it is IPV6).
53	* Side effects: None
54	* Comments: Called from parse_netmask
55	*/
56	/* Fixed so ::/0 (any IPv6 address) is valid
57	Also a bug in DigitParse above.
58	-Gozem 2002-07-19 gozem@linux.nu
59	*/
60	static int
61	try_parse_v6_netmask(const char text, struct irc_ssaddr addr, int *b)
62	{
63	char c;
64	int d[8] = { 0, 0, 0, 0, 0, 0, 0, 0 };
65	int dp = 0;
66	int nyble = 4;
67	int finsert = -1;
68	int bits = 128;
69	int deficit = 0;
70	short dc[8];
71	struct sockaddr_in6 const v6 = (struct sockaddr_in6 )addr;
72
73	for (const char p = text; (c = p); ++p)
74	{
75	if (IsXDigit(c))
76	{
77	if (nyble == 0)
78	return HM_HOST;
79	DigitParse(c);
80	d[dp] \|= c << (4 * --nyble);
81	}
82	else if (c == ':')
83	{
84	if (p > text && *(p - 1) == ':')
85	{
86	if (finsert >= 0)
87	return HM_HOST;
88	finsert = dp;
89	}
90	else
91	{
92	/* If there were less than 4 hex digits, e.g. :ABC: shift right
93	* so we don't interpret it as ABC0 -A1kmm */
94	d[dp] = d[dp] >> 4 * nyble;
95	nyble = 4;
96	if (++dp >= 8)
97	return HM_HOST;
98	}
99	}
100	else if (c == '*')
101	{
102	/* * must be last, and * is ambiguous if there is a ::... -A1kmm */
103	if (finsert >= 0 \|\| (p + 1) \|\| dp == 0 \|\| (p - 1) != ':')
104	return HM_HOST;
105	bits = dp * 16;
106	}
107	else if (c == '/')
108	{
109	char *after;
110
111	d[dp] = d[dp] >> 4 * nyble;
112	++dp;
113	bits = strtoul(p + 1, &after, 10);
114
115	if (bits < 0 \|\| *after)
116	return HM_HOST;
117	if (bits > dp * 4 && !(finsert >= 0 && bits <= 128))
118	return HM_HOST;
119	break;
120	}
121	else
122	return HM_HOST;
123	}
124
125	d[dp] = d[dp] >> 4 * nyble;
126
127	if (c == 0)
128	++dp;
129	if (finsert < 0 && bits == 0)
130	bits = dp * 16;
131
132	/* How many words are missing? -A1kmm */
133	deficit = bits / 16 + ((bits % 16) ? 1 : 0) - dp;
134
135	/* Now fill in the gaps(from ::) in the copied table... -A1kmm */
136	for (dp = 0, nyble = 0; dp < 8; ++dp)
137	{
138	if (nyble == finsert && deficit)
139	{
140	dc[dp] = 0;
141	deficit--;
142	}
143	else
144	dc[dp] = d[nyble++];
145	}
146
147	/* Set unused bits to 0... -A1kmm */
148	if (bits < 128 && (bits % 16 != 0))
149	dc[bits / 16] &= ~((1 << (15 - bits % 16)) - 1);
150	for (dp = bits / 16 + (bits % 16 ? 1 : 0); dp < 8; ++dp)
151	dc[dp] = 0;
152
153	/* And assign... -A1kmm */
154	if (addr)
155	for (dp = 0; dp < 8; ++dp)
156	/* The cast is a kludge to make netbsd work. */
157	((unsigned short *)&v6->sin6_addr)[dp] = htons(dc[dp]);
158
159	if (b)
160	*b = bits;
161	return HM_IPV6;
162	}
163
164	/* int try_parse_v4_netmask(const char , struct irc_ssaddr , int *);
165	* Input: A possible IPV4 address as a string.
166	* Output: An integer describing whether it is an IPV4 or hostmask,
167	* an address(if it is IPV4), a bitlength(if it is IPV4).
168	* Side effects: None
169	* Comments: Called from parse_netmask
170	*/
171	static int
172	try_parse_v4_netmask(const char text, struct irc_ssaddr addr, int *b)
173	{
174	const char *digits[4];
175	unsigned char addb[4];
176	int n = 0, bits = 0;
177	char c;
178	struct sockaddr_in const v4 = (struct sockaddr_in )addr;
179
180	digits[n++] = text;
181
182	for (const char p = text; (c = p); ++p)
183	{
184	if (c >= '0' && c <= '9') /* empty */
185	;
186	else if (c == '.')
187	{
188	if (n >= 4)
189	return HM_HOST;
190
191	digits[n++] = p + 1;
192	}
193	else if (c == '*')
194	{
195	if ((p + 1) \|\| n == 0 \|\| (p - 1) != '.')
196	return HM_HOST;
197
198	bits = (n - 1) * 8;
199	break;
200	}
201	else if (c == '/')
202	{
203	char *after;
204	bits = strtoul(p + 1, &after, 10);
205
206	if (bits < 0 \|\| *after)
207	return HM_HOST;
208	if (bits > n * 8)
209	return HM_HOST;
210
211	break;
212	}
213	else
214	return HM_HOST;
215	}
216
217	if (n < 4 && bits == 0)
218	bits = n * 8;
219	if (bits)
220	while (n < 4)
221	digits[n++] = "0";
222
223	for (n = 0; n < 4; ++n)
224	addb[n] = strtoul(digits[n], NULL, 10);
225
226	if (bits == 0)
227	bits = 32;
228
229	/* Set unused bits to 0... -A1kmm */
230	if (bits < 32 && bits % 8)
231	addb[bits / 8] &= ~((1 << (8 - bits % 8)) - 1);
232	for (n = bits / 8 + (bits % 8 ? 1 : 0); n < 4; ++n)
233	addb[n] = 0;
234	if (addr)
235	v4->sin_addr.s_addr =
236	htonl(addb[0] << 24 \| addb[1] << 16 \| addb[2] << 8 \| addb[3]);
237	if (b)
238	*b = bits;
239	return HM_IPV4;
240	}
241
242	/* int parse_netmask(const char , struct irc_ssaddr , int *);
243	* Input: A hostmask, or an IPV4/6 address.
244	* Output: An integer describing whether it is an IPV4, IPV6 address or a
245	* hostmask, an address(if it is an IP mask),
246	* a bitlength(if it is IP mask).
247	* Side effects: None
248	*/
249	int
250	parse_netmask(const char text, struct irc_ssaddr addr, int *b)
251	{
252	if (strchr(text, '.'))
253	return try_parse_v4_netmask(text, addr, b);
254	if (strchr(text, ':'))
255	return try_parse_v6_netmask(text, addr, b);
256
257	return HM_HOST;
258	}
259
260	/* The address matching stuff... */
261	/* int match_ipv6(struct irc_ssaddr , struct irc_ssaddr , int)
262	* Input: An IP address, an IP mask, the number of bits in the mask.
263	* Output: if match, -1 else 0
264	* Side effects: None
265	*/
266	int
267	match_ipv6(const struct irc_ssaddr addr, const struct irc_ssaddr mask, int bits)
268	{
269	int i, m, n = bits / 8;
270	const struct sockaddr_in6 const v6 = (const struct sockaddr_in6 )addr;
271	const struct sockaddr_in6 const v6mask = (const struct sockaddr_in6 )mask;
272
273	for (i = 0; i < n; ++i)
274	if (v6->sin6_addr.s6_addr[i] != v6mask->sin6_addr.s6_addr[i])
275	return 0;
276
277	if ((m = bits % 8) == 0)
278	return -1;
279	if ((v6->sin6_addr.s6_addr[n] & ~((1 << (8 - m)) - 1)) ==
280	v6mask->sin6_addr.s6_addr[n])
281	return -1;
282	return 0;
283	}
284
285	/* int match_ipv4(struct irc_ssaddr , struct irc_ssaddr , int)
286	* Input: An IP address, an IP mask, the number of bits in the mask.
287	* Output: if match, -1 else 0
288	* Side Effects: None
289	*/
290	int
291	match_ipv4(const struct irc_ssaddr addr, const struct irc_ssaddr mask, int bits)
292	{
293	const struct sockaddr_in const v4 = (const struct sockaddr_in )addr;
294	const struct sockaddr_in const v4mask = (const struct sockaddr_in )mask;
295
296	if ((ntohl(v4->sin_addr.s_addr) & ~((1 << (32 - bits)) - 1)) !=
297	ntohl(v4mask->sin_addr.s_addr))
298	return 0;
299	return -1;
300	}
301
302	/*
303	* mask_addr
304	*
305	* inputs - pointer to the ip to mask
306	* - bitlen
307	* output - NONE
308	* side effects -
309	*/
310	void
311	mask_addr(struct irc_ssaddr *ip, int bits)
312	{
313	int mask;
314	struct sockaddr_in6 *v6_base_ip;
315	int i, m, n;
316	struct sockaddr_in *v4_base_ip;
317
318	if (ip->ss.ss_family == AF_INET)
319	{
320	uint32_t tmp = 0;
321	v4_base_ip = (struct sockaddr_in *)ip;
322
323	mask = ~((1 << (32 - bits)) - 1);
324	tmp = ntohl(v4_base_ip->sin_addr.s_addr);
325	v4_base_ip->sin_addr.s_addr = htonl(tmp & mask);
326	}
327	else
328	{
329	n = bits / 8;
330	m = bits % 8;
331	v6_base_ip = (struct sockaddr_in6 *)ip;
332
333	mask = ~((1 << (8 - m)) - 1);
334	v6_base_ip->sin6_addr.s6_addr[n] = v6_base_ip->sin6_addr.s6_addr[n] & mask;
335
336	for (i = n + 1; i < 16; i++)
337	v6_base_ip->sin6_addr.s6_addr[i] = 0;
338	}
339	}
340
341	/* Hashtable stuff...now external as it's used in m_stats.c */
342	dlink_list atable[ATABLE_SIZE];
343
344	/* unsigned long hash_ipv4(struct irc_ssaddr*)
345	* Input: An IP address.
346	* Output: A hash value of the IP address.
347	* Side effects: None
348	*/
349	static uint32_t
350	hash_ipv4(const struct irc_ssaddr *addr, int bits)
351	{
352	if (bits != 0)
353	{
354	const struct sockaddr_in const v4 = (const struct sockaddr_in )addr;
355	uint32_t av = ntohl(v4->sin_addr.s_addr) & ~((1 << (32 - bits)) - 1);
356
357	return (av ^ (av >> 12) ^ (av >> 24)) & (ATABLE_SIZE - 1);
358	}
359
360	return 0;
361	}
362
363	/* unsigned long hash_ipv6(struct irc_ssaddr*)
364	* Input: An IP address.
365	* Output: A hash value of the IP address.
366	* Side effects: None
367	*/
368	static uint32_t
369	hash_ipv6(const struct irc_ssaddr *addr, int bits)
370	{
371	uint32_t v = 0, n;
372	const struct sockaddr_in6 const v6 = (const struct sockaddr_in6 )addr;
373
374	for (n = 0; n < 16; ++n)
375	{
376	if (bits >= 8)
377	{
378	v ^= v6->sin6_addr.s6_addr[n];
379	bits -= 8;
380	}
381	else if (bits)
382	{
383	v ^= v6->sin6_addr.s6_addr[n] & ~((1 << (8 - bits)) - 1);
384	return v & (ATABLE_SIZE - 1);
385	}
386	else
387	return v & (ATABLE_SIZE - 1);
388	}
389
390	return v & (ATABLE_SIZE - 1);
391	}
392
393	/* int hash_text(const char *start)
394	* Input: The start of the text to hash.
395	* Output: The hash of the string between 1 and (TH_MAX-1)
396	* Side-effects: None.
397	*/
398	static uint32_t
399	hash_text(const char *start)
400	{
401	uint32_t h = 0;
402
403	for (const char p = start; p; ++p)
404	h = (h << 4) - (h + ToLower(*p));
405
406	return h & (ATABLE_SIZE - 1);
407	}
408
409	/* unsigned long get_hash_mask(const char *)
410	* Input: The text to hash.
411	* Output: The hash of the string right of the first '.' past the last
412	* wildcard in the string.
413	* Side-effects: None.
414	*/
415	static uint32_t
416	get_mask_hash(const char *text)
417	{
418	const char hp = "", p;
419
420	for (p = text + strlen(text) - 1; p >= text; --p)
421	if (IsMWildChar(*p))
422	return hash_text(hp);
423	else if (*p == '.')
424	hp = p + 1;
425	return hash_text(text);
426	}
427
428	/* struct MaskItem find_conf_by_address(const char , struct irc_ssaddr *,
429	* int type, int fam, const char *username)
430	* Input: The hostname, the address, the type of mask to find, the address
431	* family, the username.
432	* Output: The matching value with the highest precedence.
433	* Side-effects: None
434	* Note: Setting bit 0 of the type means that the username is ignored.
435	* Warning: IsNeedPassword for everything that is not an auth{} entry
436	* should always be true (i.e. conf->flags & CONF_FLAGS_NEED_PASSWORD == 0)
437	*/
438	struct MaskItem *
439	find_conf_by_address(const char name, struct irc_ssaddr addr, unsigned int type,
440	int fam, const char username, const char password, int do_match)
441	{
442	unsigned int hprecv = 0;
443	dlink_node *node = NULL;
444	struct MaskItem *hprec = NULL;
445	struct AddressRec *arec = NULL;
446	int b;
447	int (cmpfunc)(const char , const char *) = do_match ? match : irccmp;
448
449	if (addr)
450	{
451	/* Check for IPV6 matches... */
452	if (fam == AF_INET6)
453	{
454	for (b = 128; b >= 0; b -= 16)
455	{
456	DLINK_FOREACH(node, atable[hash_ipv6(addr, b)].head)
457	{
458	arec = node->data;
459
460	if ((arec->type == type) &&
461	arec->precedence > hprecv &&
462	arec->masktype == HM_IPV6 &&
463	match_ipv6(addr, &arec->Mask.ipa.addr,
464	arec->Mask.ipa.bits) &&
465	(!username \|\| !cmpfunc(arec->username, username)) &&
466	(IsNeedPassword(arec->conf) \|\| arec->conf->passwd == NULL \|\|
467	match_conf_password(password, arec->conf)))
468	{
469	hprecv = arec->precedence;
470	hprec = arec->conf;
471	}
472	}
473	}
474	}
475	else if (fam == AF_INET)
476	{
477	for (b = 32; b >= 0; b -= 8)
478	{
479	DLINK_FOREACH(node, atable[hash_ipv4(addr, b)].head)
480	{
481	arec = node->data;
482
483	if ((arec->type == type) &&
484	arec->precedence > hprecv &&
485	arec->masktype == HM_IPV4 &&
486	match_ipv4(addr, &arec->Mask.ipa.addr,
487	arec->Mask.ipa.bits) &&
488	(!username \|\| !cmpfunc(arec->username, username)) &&
489	(IsNeedPassword(arec->conf) \|\| arec->conf->passwd == NULL \|\|
490	match_conf_password(password, arec->conf)))
491	{
492	hprecv = arec->precedence;
493	hprec = arec->conf;
494	}
495	}
496	}
497	}
498	}
499
500	if (name)
501	{
502	const char *p = name;
503
504	while (1)
505	{
506	DLINK_FOREACH(node, atable[hash_text(p)].head)
507	{
508	arec = node->data;
509	if ((arec->type == type) &&
510	arec->precedence > hprecv &&
511	(arec->masktype == HM_HOST) &&
512	!cmpfunc(arec->Mask.hostname, name) &&
513	(!username \|\| !cmpfunc(arec->username, username)) &&
514	(IsNeedPassword(arec->conf) \|\| arec->conf->passwd == NULL \|\|
515	match_conf_password(password, arec->conf)))
516	{
517	hprecv = arec->precedence;
518	hprec = arec->conf;
519	}
520	}
521
522	if ((p = strchr(p, '.')) == NULL)
523	break;
524	++p;
525	}
526
527	DLINK_FOREACH(node, atable[0].head)
528	{
529	arec = node->data;
530
531	if (arec->type == type &&
532	arec->precedence > hprecv &&
533	arec->masktype == HM_HOST &&
534	!cmpfunc(arec->Mask.hostname, name) &&
535	(!username \|\| !cmpfunc(arec->username, username)) &&
536	(IsNeedPassword(arec->conf) \|\| arec->conf->passwd == NULL \|\|
537	match_conf_password(password, arec->conf)))
538	{
539	hprecv = arec->precedence;
540	hprec = arec->conf;
541	}
542	}
543	}
544
545	return hprec;
546	}
547
548	/* struct MaskItem* find_address_conf(const char, const char,
549	* struct irc_ssaddr, int, char );
550	* Input: The hostname, username, address, address family.
551	* Output: The applicable MaskItem.
552	* Side-effects: None
553	*/
554	struct MaskItem *
555	find_address_conf(const char host, const char user, struct irc_ssaddr *ip,
556	int aftype, const char *password)
557	{
558	struct MaskItem authcnf = NULL, killcnf = NULL;
559
560	/* Find the best auth{} block... If none, return NULL -A1kmm */
561	if ((authcnf = find_conf_by_address(host, ip, CONF_CLIENT, aftype, user,
562	password, 1)) == NULL)
563	return NULL;
564
565	/* If they are exempt from K-lines, return the best auth{} block. -A1kmm */
566	if (IsConfExemptKline(authcnf))
567	return authcnf;
568
569	/* Find the best K-line... -A1kmm */
570	killcnf = find_conf_by_address(host, ip, CONF_KLINE, aftype, user, NULL, 1);
571
572	/*
573	* If they are K-lined, return the K-line. Otherwise, return the
574	* auth{} block. -A1kmm
575	*/
576	if (killcnf)
577	return killcnf;
578
579	if (IsConfExemptGline(authcnf))
580	return authcnf;
581
582	killcnf = find_conf_by_address(host, ip, CONF_GLINE, aftype, user, NULL, 1);
583	if (killcnf)
584	return killcnf;
585
586	return authcnf;
587	}
588
589	/* struct MaskItem* find_dline_conf(struct irc_ssaddr*, int)
590	*
591	* Input: An address, an address family.
592	* Output: The best matching D-line or exempt line.
593	* Side effects: None.
594	*/
595	struct MaskItem *
596	find_dline_conf(struct irc_ssaddr *addr, int aftype)
597	{
598	struct MaskItem *eline;
599
600	eline = find_conf_by_address(NULL, addr, CONF_EXEMPT, aftype, NULL, NULL, 1);
601	if (eline)
602	return eline;
603
604	return find_conf_by_address(NULL, addr, CONF_DLINE, aftype, NULL, NULL, 1);
605	}
606
607	/* void add_conf_by_address(int, struct MaskItem *aconf)
608	* Input:
609	* Output: None
610	* Side-effects: Adds this entry to the hash table.
611	*/
612	struct AddressRec *
613	add_conf_by_address(const unsigned int type, struct MaskItem *conf)
614	{
615	struct AddressRec *arec = NULL;
616	const char *const hostname = conf->host;
617	const char *const username = conf->user;
618	static unsigned int prec_value = 0xFFFFFFFF;
619	int bits = 0;
620
621	assert(type && !EmptyString(hostname));
622
623	arec = MyCalloc(sizeof(struct AddressRec));
624	arec->masktype = parse_netmask(hostname, &arec->Mask.ipa.addr, &bits);
625	arec->Mask.ipa.bits = bits;
626	arec->username = username;
627	arec->conf = conf;
628	arec->precedence = prec_value--;
629	arec->type = type;
630
631	switch (arec->masktype)
632	{
633	case HM_IPV4:
634	/* We have to do this, since we do not re-hash for every bit -A1kmm. */
635	bits -= bits % 8;
636	dlinkAdd(arec, &arec->node, &atable[hash_ipv4(&arec->Mask.ipa.addr, bits)]);
637	break;
638	case HM_IPV6:
639	/* We have to do this, since we do not re-hash for every bit -A1kmm. */
640	bits -= bits % 16;
641	dlinkAdd(arec, &arec->node, &atable[hash_ipv6(&arec->Mask.ipa.addr, bits)]);
642	break;
643	default: /* HM_HOST */
644	arec->Mask.hostname = hostname;
645	dlinkAdd(arec, &arec->node, &atable[get_mask_hash(hostname)]);
646	break;
647	}
648
649	return arec;
650	}
651
652	/* void delete_one_address(const char, struct MaskItem)
653	* Input: An address string, the associated MaskItem.
654	* Output: None
655	* Side effects: Deletes an address record. Frees the MaskItem if there
656	* is nothing referencing it, sets it as illegal otherwise.
657	*/
658	void
659	delete_one_address_conf(const char address, struct MaskItem conf)
660	{
661	int bits = 0;
662	uint32_t hv = 0;
663	dlink_node *node = NULL;
664	struct irc_ssaddr addr;
665
666	switch (parse_netmask(address, &addr, &bits))
667	{
668	case HM_IPV4:
669	/* We have to do this, since we do not re-hash for every bit -A1kmm. */
670	bits -= bits % 8;
671	hv = hash_ipv4(&addr, bits);
672	break;
673	case HM_IPV6:
674	/* We have to do this, since we do not re-hash for every bit -A1kmm. */
675	bits -= bits % 16;
676	hv = hash_ipv6(&addr, bits);
677	break;
678	default: /* HM_HOST */
679	hv = get_mask_hash(address);
680	break;
681	}
682
683	DLINK_FOREACH(node, atable[hv].head)
684	{
685	struct AddressRec *arec = node->data;
686
687	if (arec->conf == conf)
688	{
689	dlinkDelete(&arec->node, &atable[hv]);
690
691	if (!conf->ref_count)
692	conf_free(conf);
693
694	MyFree(arec);
695	return;
696	}
697	}
698	}
699
700	/* void clear_out_address_conf(void)
701	* Input: None
702	* Output: None
703	* Side effects: Clears out all address records in the hash table,
704	* frees them, and frees the MaskItems if nothing references
705	* them, otherwise sets them as illegal.
706	*/
707	void
708	clear_out_address_conf(void)
709	{
710	dlink_node node = NULL, node_next = NULL;
711
712	for (unsigned int i = 0; i < ATABLE_SIZE; ++i)
713	{
714	DLINK_FOREACH_SAFE(node, node_next, atable[i].head)
715	{
716	struct AddressRec *arec = node->data;
717
718	/*
719	* We keep the temporary K-lines and destroy the permanent ones,
720	* just to be confusing :) -A1kmm
721	*/
722	if (arec->conf->until \|\| IsConfDatabase(arec->conf))
723	continue;
724
725	dlinkDelete(&arec->node, &atable[i]);
726	arec->conf->active = 0;
727
728	if (!arec->conf->ref_count)
729	conf_free(arec->conf);
730	MyFree(arec);
731	}
732	}
733	}
734
735	static void
736	hostmask_send_expiration(const struct AddressRec *const arec)
737	{
738	char ban_type = '\0';
739
740	if (!ConfigGeneral.tkline_expire_notices)
741	return;
742
743	switch (arec->type)
744	{
745	case CONF_KLINE:
746	ban_type = 'K';
747	break;
748	case CONF_DLINE:
749	ban_type = 'D';
750	break;
751	case CONF_GLINE:
752	ban_type = 'G';
753	break;
754	default: break;
755	}
756
757	sendto_realops_flags(UMODE_ALL, L_ALL, SEND_NOTICE,
758	"Temporary %c-line for [%s@%s] expired", ban_type,
759	(arec->conf->user) ? arec->conf->user : "*",
760	(arec->conf->host) ? arec->conf->host : "*");
761	}
762
763	void
764	hostmask_expire_temporary(void)
765	{
766	dlink_node node = NULL, node_next = NULL;
767
768	for (unsigned int i = 0; i < ATABLE_SIZE; ++i)
769	{
770	DLINK_FOREACH_SAFE(node, node_next, atable[i].head)
771	{
772	struct AddressRec *arec = node->data;
773
774	if (!arec->conf->until \|\| arec->conf->until > CurrentTime)
775	continue;
776
777	switch (arec->type)
778	{
779	case CONF_KLINE:
780	case CONF_DLINE:
781	case CONF_GLINE:
782	hostmask_send_expiration(arec);
783
784	dlinkDelete(&arec->node, &atable[i]);
785	conf_free(arec->conf);
786	MyFree(arec);
787	break;
788	default: break;
789	}
790	}
791	}
792	}