ViewVC Help

View File | Revision Log | Show Annotations | View Changeset | Root Listing

root/svn/ircd-hybrid/trunk/src/s_bsd.c

Comparing ircd-hybrid/trunk/src/s_bsd.c (file contents):
Revision 2632 by michael, Sun Dec 8 18:33:48 2013 UTC vs.
Revision 4461 by michael, Wed Aug 13 17:05:26 2014 UTC

#	Line 1 | Line 1
1		/*
2	<	*  ircd-hybrid: an advanced Internet Relay Chat Daemon(ircd).
3	<	*  s_bsd.c: Network functions.
2	>	*  ircd-hybrid: an advanced, lightweight Internet Relay Chat Daemon (ircd)
3		*
4	<	*  Copyright (C) 2002 by the past and present ircd coders, and others.
4	>	*  Copyright (c) 1997-2014 ircd-hybrid development team
5		*
6		*  This program is free software; you can redistribute it and/or modify
7		*  it under the terms of the GNU General Public License as published by
#	Line 18 | Line 17
17		*  along with this program; if not, write to the Free Software
18		*  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307
19		*  USA
20	<	*
21	<	*  $Id$
20	>	*/
21	>
22	>	/*! \file s_bsd.c
23	>	* \brief Network functions.
24	>	* \version $Id$
25		*/
26
27		#include "stdinc.h"
28	+	#ifdef HAVE_LIBCRYPTO
29	+	#include "rsa.h"
30	+	#endif
31		#include <netinet/in_systm.h>
32		#include <netinet/ip.h>
33		#include <netinet/tcp.h>
#	Line 37 | Line 42
42		#include "listener.h"
43		#include "numeric.h"
44		#include "packet.h"
45	<	#include "irc_res.h"
45	>	#include "res.h"
46		#include "restart.h"
47	<	#include "s_auth.h"
47	>	#include "auth.h"
48		#include "conf.h"
49		#include "log.h"
50	<	#include "s_serv.h"
50	>	#include "server.h"
51		#include "send.h"
52		#include "memory.h"
53	<	#include "s_user.h"
54	<	#include "hook.h"
53	>	#include "user.h"
54	>
55
56		static const char *comm_err_str[] = { "Comm OK", "Error during bind()",
57		"Error during DNS lookup", "connect timeout", "Error during connect()",
58		"Comm Error" };
59
60		static void comm_connect_callback(fde_t *, int);
61	<	static PF comm_connect_timeout;
62	<	static void comm_connect_dns_callback(void *, const struct irc_ssaddr *, const char *);
63	<	static PF comm_connect_tryconnect;
61	>	static void comm_connect_timeout(fde_t *, void *);
62	>	static void comm_connect_dns_callback(void *, const struct irc_ssaddr *, const char *, size_t);
63	>	static void comm_connect_tryconnect(fde_t *, void *);
64
65
61	–	/* check_can_use_v6()
62	–	*  Check if the system can open AF_INET6 sockets
63	–	*/
64	–	void
65	–	check_can_use_v6(void)
66	–	{
67	–	#ifdef IPV6
68	–	int v6;
69	–
70	–	if ((v6 = socket(AF_INET6, SOCK_STREAM, 0)) < 0)
71	–	ServerInfo.can_use_v6 = 0;
72	–	else
73	–	{
74	–	ServerInfo.can_use_v6 = 1;
75	–	close(v6);
76	–	}
77	–	#else
78	–	ServerInfo.can_use_v6 = 0;
79	–	#endif
80	–	}
81	–
66		/* get_sockerr - get the error value from the socket or the current errno
67		*
68		* Get the *real* error from the socket (well try to anyway..).
#	Line 104 | Line 88 | get_sockerr(int fd)
88		}
89
90		/*
91	<	* report_error - report an error from an errno.
91	>	* report_error - report an error from an errno.
92		* Record error to log and also send a copy to all *LOCAL* opers online.
93		*
94		*        text        is a *format* string for outputing error. It must
#	Line 118 | Line 102 | get_sockerr(int fd)
102		* Cannot use perror() within daemon. stderr is closed in
103		* ircd and cannot be used. And, worse yet, it might have
104		* been reassigned to a normal connection...
105	<	*
105	>	*
106		* Actually stderr is still there IFF ircd was run with -s --Rodder
107		*/
108
109		void
110	<	report_error(int level, const char* text, const char* who, int error)
110	>	report_error(int level, const char* text, const char* who, int error)
111		{
112		who = (who) ? who : "";
113
#	Line 171 | Line 155 | close_connection(struct Client *client_p
155		* even if it is marked as blocked (COMM_SELECT_READ handler is called
156		* before COMM_SELECT_WRITE). Let's try, nothing to lose.. -adx
157		*/
158	<	ClearSendqBlocked(client_p);
158	>	DelFlag(client_p, FLAGS_BLOCKED);
159		send_queued_write(client_p);
160		}
161
#	Line 220 | Line 204 | close_connection(struct Client *client_p
204
205		dbuf_clear(&client_p->localClient->buf_sendq);
206		dbuf_clear(&client_p->localClient->buf_recvq);
207	<
208	<	MyFree(client_p->localClient->passwd);
207	>
208	>	MyFree(client_p->localClient->password);
209	>	client_p->localClient->password = NULL;
210	>
211		detach_conf(client_p, CONF_CLIENT|CONF_OPER|CONF_SERVER);
226	–	client_p->from = NULL; /* ...this should catch them! >:) --msa */
212		}
213
214		#ifdef HAVE_LIBCRYPTO
#	Line 232 | Line 217 | close_connection(struct Client *client_p
217		* read/write events if necessary.
218		*/
219		static void
220	<	ssl_handshake(int fd, struct Client *client_p)
220	>	ssl_handshake(fde_t *fd, void *data)
221		{
222	+	struct Client *client_p = data;
223		X509 *cert = NULL;
224		int ret = 0;
225
226		if ((ret = SSL_accept(client_p->localClient->fd.ssl)) <= 0)
227		{
228	+	if ((CurrentTime - client_p->localClient->firsttime) > 30)
229	+	{
230	+	exit_client(client_p, "Timeout during SSL handshake");
231	+	return;
232	+	}
233	+
234		switch (SSL_get_error(client_p->localClient->fd.ssl, ret))
235		{
236		case SSL_ERROR_WANT_WRITE:
237		comm_setselect(&client_p->localClient->fd, COMM_SELECT_WRITE,
238	<	(PF *) ssl_handshake, client_p, 0);
238	>	ssl_handshake, client_p, 30);
239		return;
240
241		case SSL_ERROR_WANT_READ:
242		comm_setselect(&client_p->localClient->fd, COMM_SELECT_READ,
243	<	(PF *) ssl_handshake, client_p, 0);
243	>	ssl_handshake, client_p, 30);
244		return;
245
246		default:
247	<	exit_client(client_p, client_p, "Error during SSL handshake");
248	<	return;
247	>	exit_client(client_p, "Error during SSL handshake");
248	>	return;
249		}
250		}
251
252	+	comm_settimeout(&client_p->localClient->fd, 0, NULL, NULL);
253	+
254		if ((cert = SSL_get_peer_certificate(client_p->localClient->fd.ssl)))
255		{
256		int res = SSL_get_verify_result(client_p->localClient->fd.ssl);
257	<	char buf[EVP_MAX_MD_SIZE * 2 + 1] = { '\0' };
258	<	unsigned char md[EVP_MAX_MD_SIZE] = { '\0' };
257	>	char buf[EVP_MAX_MD_SIZE * 2 + 1] = "";
258	>	unsigned char md[EVP_MAX_MD_SIZE] = "";
259
260		if (res == X509_V_OK || res == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN ||
261		res == X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE ||
262		res == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT)
263		{
264	<	unsigned int i = 0, n = 0;
264	>	unsigned int n = 0;
265
266	<	if (X509_digest(cert, EVP_sha256(), md, &n))
266	>	if (X509_digest(cert, ConfigServerInfo.message_digest_algorithm, md, &n))
267		{
268	<	for (; i < n; ++i)
275	<	snprintf(buf + 2 * i, 3, "%02X", md[i]);
268	>	binary_to_hex(md, buf, n);
269		client_p->certfp = xstrdup(buf);
270		}
271		}
#	Line 287 | Line 280 | ssl_handshake(int fd, struct Client *cli
280		#endif
281
282		/*
283	<	* add_connection - creates a client which has just connected to us on
283	>	* add_connection - creates a client which has just connected to us on
284		* the given fd. The sockhost field is initialized with the ip# of the host.
285		* An unique id is calculated now, in case it is needed for auth.
286		* The client is sent to the auth module for verification, and not put in
#	Line 296 | Line 289 | ssl_handshake(int fd, struct Client *cli
289		void
290		add_connection(struct Listener *listener, struct irc_ssaddr *irn, int fd)
291		{
292	<	struct Client *new_client = make_client(NULL);
292	>	struct Client *client_p = make_client(NULL);
293
294	<	fd_open(&new_client->localClient->fd, fd, 1,
294	>	fd_open(&client_p->localClient->fd, fd, 1,
295		(listener->flags & LISTENER_SSL) ?
296	<	"Incoming SSL connection" : "Incoming connection");
296	>	"Incoming SSL connection" : "Incoming connection");
297
298		/*
299		* copy address to 'sockhost' as a string, copy it to host too
300		* so we have something valid to put into error messages...
301		*/
302	<	memcpy(&new_client->localClient->ip, irn, sizeof(struct irc_ssaddr));
302	>	memcpy(&client_p->localClient->ip, irn, sizeof(struct irc_ssaddr));
303
304	<	getnameinfo((struct sockaddr *)&new_client->localClient->ip,
305	<	new_client->localClient->ip.ss_len, new_client->sockhost,
306	<	sizeof(new_client->sockhost), NULL, 0, NI_NUMERICHOST);
307	<	new_client->localClient->aftype = new_client->localClient->ip.ss.ss_family;
304	>	getnameinfo((struct sockaddr *)&client_p->localClient->ip,
305	>	client_p->localClient->ip.ss_len, client_p->sockhost,
306	>	sizeof(client_p->sockhost), NULL, 0, NI_NUMERICHOST);
307	>	client_p->localClient->aftype = client_p->localClient->ip.ss.ss_family;
308
309		#ifdef HAVE_LIBGEOIP
310		/* XXX IPV6 SUPPORT XXX */
311		if (irn->ss.ss_family == AF_INET && geoip_ctx)
312		{
313	<	const struct sockaddr_in *v4 = (const struct sockaddr_in *)&new_client->localClient->ip;
314	<	new_client->localClient->country_id = GeoIP_id_by_ipnum(geoip_ctx, (unsigned long)ntohl(v4->sin_addr.s_addr));
313	>	const struct sockaddr_in *v4 = (const struct sockaddr_in *)&client_p->localClient->ip;
314	>	client_p->localClient->country_id = GeoIP_id_by_ipnum(geoip_ctx, (unsigned long)ntohl(v4->sin_addr.s_addr));
315		}
316		#endif
317
318	<	if (new_client->sockhost[0] == ':' && new_client->sockhost[1] == ':')
318	>	if (client_p->sockhost[0] == ':' && client_p->sockhost[1] == ':')
319		{
320	<	strlcpy(new_client->host, "0", sizeof(new_client->host));
321	<	strlcpy(new_client->host+1, new_client->sockhost, sizeof(new_client->host)-1);
322	<	memmove(new_client->sockhost+1, new_client->sockhost, sizeof(new_client->sockhost)-1);
323	<	new_client->sockhost[0] = '0';
320	>	strlcpy(client_p->host, "0", sizeof(client_p->host));
321	>	strlcpy(client_p->host+1, client_p->sockhost, sizeof(client_p->host)-1);
322	>	memmove(client_p->sockhost+1, client_p->sockhost, sizeof(client_p->sockhost)-1);
323	>	client_p->sockhost[0] = '0';
324		}
325		else
326	<	strlcpy(new_client->host, new_client->sockhost, sizeof(new_client->host));
326	>	strlcpy(client_p->host, client_p->sockhost, sizeof(client_p->host));
327
328	<	new_client->localClient->listener = listener;
328	>	client_p->localClient->listener = listener;
329		++listener->ref_count;
330
331		#ifdef HAVE_LIBCRYPTO
332		if (listener->flags & LISTENER_SSL)
333		{
334	<	if ((new_client->localClient->fd.ssl = SSL_new(ServerInfo.server_ctx)) == NULL)
334	>	if ((client_p->localClient->fd.ssl = SSL_new(ConfigServerInfo.server_ctx)) == NULL)
335		{
336		ilog(LOG_TYPE_IRCD, "SSL_new() ERROR! -- %s",
337		ERR_error_string(ERR_get_error(), NULL));
338
339	<	SetDead(new_client);
340	<	exit_client(new_client, new_client, "SSL_new failed");
339	>	SetDead(client_p);
340	>	exit_client(client_p, "SSL_new failed");
341		return;
342		}
343
344	<	AddFlag(new_client, FLAGS_SSL);
345	<	SSL_set_fd(new_client->localClient->fd.ssl, fd);
346	<	ssl_handshake(0, new_client);
344	>	AddFlag(client_p, FLAGS_SSL);
345	>	SSL_set_fd(client_p->localClient->fd.ssl, fd);
346	>	ssl_handshake(NULL, client_p);
347		}
348		else
349		#endif
350	<	start_auth(new_client);
350	>	start_auth(client_p);
351		}
352
353		/*
#	Line 390 | Line 383 | ignoreErrno(int ierrno)
383		* Set the timeout for the fd
384		*/
385		void
386	<	comm_settimeout(fde_t *fd, time_t timeout, PF *callback, void *cbdata)
386	>	comm_settimeout(fde_t *fd, time_t timeout, void (*callback)(fde_t *, void *), void *cbdata)
387		{
388		assert(fd->flags.open);
389
#	Line 409 | Line 402 | comm_settimeout(fde_t *fd, time_t timeou
402		* flush functions, and when comm_close() is implemented correctly
403		* with close functions, we _actually_ don't call comm_close() here ..
404		* -- originally Adrian's notes
405	<	* comm_close() is replaced with fd_close() in fdlist.c
405	>	* comm_close() is replaced with fd_close() in fdlist.c
406		*/
407		void
408	<	comm_setflush(fde_t *fd, time_t timeout, PF *callback, void *cbdata)
408	>	comm_setflush(fde_t *fd, time_t timeout, void (*callback)(fde_t *, void *), void *cbdata)
409		{
410		assert(fd->flags.open);
411
#	Line 429 | Line 422 | comm_setflush(fde_t *fd, time_t timeout,
422		* this will happen.
423		*/
424		void
425	<	comm_checktimeouts(void *notused)
425	>	comm_checktimeouts(void *unused)
426		{
427		int i;
428		fde_t *F;
429	<	PF *hdl;
429	>	void (*hdl)(fde_t *, void *);
430		void *data;
431
432		for (i = 0; i < FD_HASH_SIZE; i++)
#	Line 501 | Line 494 | comm_connect_tcp(fde_t *fd, const char *
494		*   -- adrian
495		*/
496		if ((clocal != NULL) && (bind(fd->fd, clocal, socklen) < 0))
497	<	{
497	>	{
498		/* Failure, call the callback with COMM_ERR_BIND */
499		comm_connect_callback(fd, COMM_ERR_BIND);
500		/* ... and quit */
#	Line 569 | Line 562 | comm_connect_callback(fde_t *fd, int sta
562		* called ..
563		*/
564		static void
565	<	comm_connect_timeout(fde_t *fd, void *notused)
565	>	comm_connect_timeout(fde_t *fd, void *unused)
566		{
567		/* error! */
568		comm_connect_callback(fd, COMM_ERR_TIMEOUT);
#	Line 582 | Line 575 | comm_connect_timeout(fde_t *fd, void *no
575		* otherwise we initiate the connect()
576		*/
577		static void
578	<	comm_connect_dns_callback(void *vptr, const struct irc_ssaddr *addr, const char *name)
578	>	comm_connect_dns_callback(void *vptr, const struct irc_ssaddr *addr, const char *name, size_t namelength)
579		{
580		fde_t *F = vptr;
581
582	<	if (name == NULL)
582	>	if (!addr)
583		{
584		comm_connect_callback(F, COMM_ERR_DNS);
585		return;
#	Line 598 | Line 591 | comm_connect_dns_callback(void *vptr, co
591		/* Copy over the DNS reply info so we can use it in the connect() */
592		/*
593		* Note we don't fudge the refcount here, because we aren't keeping
594	<	* the DNS record around, and the DNS cache is gone anyway..
594	>	* the DNS record around, and the DNS cache is gone anyway..
595		*     -- adrian
596		*/
597		memcpy(&F->connect.hostaddr, addr, addr->ss_len);
598		/* The cast is hacky, but safe - port offset is same on v4 and v6 */
599	<	((struct sockaddr_in *) &F->connect.hostaddr)->sin_port =
607	<	F->connect.hostaddr.ss_port;
599	>	((struct sockaddr_in *) &F->connect.hostaddr)->sin_port = F->connect.hostaddr.ss_port;
600		F->connect.hostaddr.ss_len = addr->ss_len;
601
602		/* Now, call the tryconnect() routine to try a connect() */
603		comm_connect_tryconnect(F, NULL);
604		}
605
606	<	/* static void comm_connect_tryconnect(int fd, void *notused)
606	>	/* static void comm_connect_tryconnect(int fd, void *unused)
607		* Input: The fd, the handler data(unused).
608		* Output: None.
609		* Side-effects: Try and connect with pending connect data for the FD. If
#	Line 620 | Line 612 | comm_connect_dns_callback(void *vptr, co
612		*               to select for a write event on this FD.
613		*/
614		static void
615	<	comm_connect_tryconnect(fde_t *fd, void *notused)
615	>	comm_connect_tryconnect(fde_t *fd, void *unused)
616		{
617		int retval;
618
#	Line 629 | Line 621 | comm_connect_tryconnect(fde_t *fd, void
621		return;
622
623		/* Try the connect() */
624	<	retval = connect(fd->fd, (struct sockaddr *) &fd->connect.hostaddr,
624	>	retval = connect(fd->fd, (struct sockaddr *) &fd->connect.hostaddr,
625		fd->connect.hostaddr.ss_len);
626
627		/* Error? */
#	Line 710 | Line 702 | comm_open(fde_t *F, int family, int sock
702		* fd_open (this function no longer does it).
703		*/
704		int
705	<	comm_accept(struct Listener *lptr, struct irc_ssaddr *pn)
705	>	comm_accept(struct Listener *lptr, struct irc_ssaddr *addr)
706		{
707		int newfd;
708		socklen_t addrlen = sizeof(struct irc_ssaddr);
#	Line 721 | Line 713 | comm_accept(struct Listener *lptr, struc
713		return -1;
714		}
715
716	+	memset(addr, 0, sizeof(struct irc_ssaddr));
717	+
718		/*
719		* Next, do the accept(). if we get an error, we should drop the
720		* reserved fd limit, but we can deal with that when comm_open()
721		* also does it. XXX -- adrian
722		*/
723	<	newfd = accept(lptr->fd.fd, (struct sockaddr *)pn, &addrlen);
723	>	newfd = accept(lptr->fd.fd, (struct sockaddr *)addr, &addrlen);
724		if (newfd < 0)
725		return -1;
726
727	<	#ifdef IPV6
734	<	remove_ipv6_mapping(pn);
735	<	#else
736	<	pn->ss_len = addrlen;
737	<	#endif
727	>	remove_ipv6_mapping(addr);
728
729		setup_socket(newfd);
730
#	Line 742 | Line 732 | comm_accept(struct Listener *lptr, struc
732		return newfd;
733		}
734
735	<	/*
735	>	/*
736		* remove_ipv6_mapping() - Removes IPv4-In-IPv6 mapping from an address
737		* OSes with IPv6 mapping listening on both
738		* AF_INET and AF_INET6 map AF_INET connections inside AF_INET6 structures
739	<	*
739	>	*
740		*/
751	–	#ifdef IPV6
741		void
742		remove_ipv6_mapping(struct irc_ssaddr *addr)
743		{
#	Line 756 | Line 745 | remove_ipv6_mapping(struct irc_ssaddr *a
745		{
746		if (IN6_IS_ADDR_V4MAPPED(&((struct sockaddr_in6 *)addr)->sin6_addr))
747		{
748	<	struct sockaddr_in6 v6;
748	>	struct sockaddr_in6 v6;
749		struct sockaddr_in *v4 = (struct sockaddr_in *)addr;
750
751		memcpy(&v6, addr, sizeof(v6));
#	Line 766 | Line 755 | remove_ipv6_mapping(struct irc_ssaddr *a
755		addr->ss.ss_family = AF_INET;
756		addr->ss_len = sizeof(struct sockaddr_in);
757		}
758	<	else
758	>	else
759		addr->ss_len = sizeof(struct sockaddr_in6);
760		}
761		else
762		addr->ss_len = sizeof(struct sockaddr_in);
763	<	}
775	<	#endif
763	>	}

Diff Legend

–	Removed lines
+	Added lines
<	Changed lines (old)
>	Changed lines (new)