Changeset 778

Timestamp:

10/02/06 00:41:20 (6 years ago)

Author:

wd

Message:

• Add library get_address_type function
• Fix CGI:IRC support to actually work with CGI:IRC's twisted hostname supply method. :)

Location:

branches/ithildin-1.1

Files:

• include/ithildin/socket.h (modified) (1 diff)
• modules/ircd/addons/hostmask.c (modified) (3 diffs)
• modules/ircd/commands/pass.c (modified) (1 diff)
• source/socket.c (modified) (1 diff)
• source/string.c (modified) (2 diffs)

branches/ithildin-1.1/include/ithildin/socket.h

@@ -144 +144 @@
 #endif
 
+/* Functions for handling network address type detection */
+int get_address_type(const char *);
+
 /* if we don't have a system getaddrinfo, use the ones that will be included
  * from source/contrib/gailib.c */

branches/ithildin-1.1/modules/ircd/addons/hostmask.c

@@ -26 +26 @@
 HOOK_FUNCTION(hostmask_conf_hook);
 HOOK_FUNCTION(hostmask_cc_hook);
+static int validate_cgiirc_host(const char *, char **, char **);
 
 MODULE_LOADER(hostmask) {
@@ -72 +73 @@
 HOOK_FUNCTION(hostmask_cc_hook) {
     client_t *cli = (client_t *)data;
-    char *mask;
+    char *mask, *ip;
 
     if (cli->conn == NULL)
         return NULL; /* nothing to do */
 
+    mask = ip = NULL;
+
     mask = mdext(cli->conn->cls, class_hostmask_mdi);
     if (mask != NULL && *mask != '\0') {
         if (!strcasecmp(mask, CGI_IRC_SPECIAL_MASK)) {
-            /* Special CGI:IRC hack.  We take the password, if supplied, and
-             * use it as a hostname (as long as it's valid) */
+            /* Special CGI:IRC hack.  We take the password, if supplied, an
+             * use it as a hostname (as long as it's valid).  Good stuff. */
             if (cli->conn->pass != NULL && *cli->conn->pass != '\0' &&
-                    istr_okay(ircd.maps.host, cli->conn->pass))
-                mask = cli->conn->pass;
-            else {
+                    validate_cgiirc_host(cli->conn->pass, &ip, &mask)) {
+                log_debug("cgi:irc connection masked as %s / %s", ip, mask);
+                strcpy(cli->ip, ip); /* set the IP as well */
+            } else {
                 log_warn("cgi:irc hostmasked connection provided invalid "
                         "host (%s) (%s!%s@%s)",
@@ -102 +106 @@
 }
 
+/* CGIIRC(6)+__(2)+\0(1)+ip+host */
+#define CGIIRC_HOST_SIZE 9 + IPADDR_MAXLEN + HOSTLEN
+
+/* validate the string from a CGI:IRC connection.  The string is of the form
+ * CGIIRC_<ip>_<host>.  We ensure that both the IP and hostname are valid.  */
+static int validate_cgiirc_host(const char *in, char **ip, char **host) {
+    static char str[CGIIRC_HOST_SIZE];
+    char *s_ip, *s_host;
+
+    *ip = *host = NULL;
+    strlcpy(str, in, CGIIRC_HOST_SIZE);
+    
+    if (strncmp(str, "CGIIRC_", 7))
+        return 0;
+
+    s_ip = str + 7;
+    if ((s_host = strchr(s_ip, '_')) == NULL)
+        return 0; /* no hostname */
+    *s_host++ = '\0';
+
+    /* now we have ip/host, let's validate */
+    if (*s_ip == '\0' || *s_host == '\0')
+        return 0;
+
+    if (get_address_type(s_ip) == PF_UNSPEC)
+        return 0; /* bad IP */
+
+    if (strchr(s_host, '.') == NULL || !istr_okay(ircd.maps.host, s_host))
+        return 0; /* bogus host */
+
+    *ip = s_ip;
+    *host = s_host;
+    return 1;
+}
+
 /* vi:set ts=8 sts=4 sw=4 tw=76 et: */

branches/ithildin-1.1/modules/ircd/commands/pass.c

@@ -39 +39 @@
     if (conn->pass != NULL)
         free(conn->pass); /* dump whatever was there before.. */
-    conn->pass = malloc(HOSTLEN + 1);
-    strlcpy(conn->pass, pass, HOSTLEN + 1);
+    conn->pass = strdup(pass);
 }
 

branches/ithildin-1.1/source/socket.c

@@ -1008 +1008 @@
 #endif
 
+/* Function to determine the type of an address.  We do cheap best effort
+ * here.  If it looks IPv6-y we try inet_pton with AF_INET6, if it looks
+ * IPv4-y we try inet_pton with AF_INET, and as long as one succeeds we
+ * return that type. */
+int get_address_type(const char *addr) {
+    const char *s = addr;
+    unsigned char buf[IPADDR_SIZE];
+
+#ifdef INET6
+    if ((s = strchr(addr, ':') != NULL) && strchr(s + 1, ':') != NULL) {
+        /* either IPv6 or nothing, let's see */
+        if (inet_pton(PF_INET6, addr, buf) == 1)
+            return PF_INET6;
+        return PF_UNSPEC;
+    }
+#endif
+
+    if (inet_pton(PF_INET, addr, buf) == 1)
+        return PF_INET;
+    return PF_UNSPEC;
+}
+
 /* vi:set ts=8 sts=4 sw=4 tw=76 et: */

branches/ithildin-1.1/source/string.c

@@ -647 +647 @@
     int imask = 0;
     int i;
-    char *s;
+    char *mask;
 
     memset(bitmask, 0xff, IPADDR_SIZE);
     strlcpy(addr, wild, IPADDR_MAXLEN + 1);
-    /* First figure out what kind of address we've got.  We no longer support
-     * IPv4 mask form (ip:mask), but IPv6 addresses need at least two colons.
-     * If we find only one, just return 0 right away. */
-    if ((s = strchr(wild, ':')) != NULL) {
-        if (strchr(s + 1, ':') != NULL)
-            family = PF_INET6; /* actually, inet6.. */
-        else
-            return 0; /* no mask support */
-    }
-
-    if ((s = strchr(wild, '/')) != NULL) {
+
+    /* strip off the mask portion if it is there */
+    if ((mask = strchr(wild, '/')) != NULL) {
         /* mask form.  mask specifies significant bits from left to right.
-         * simple enough. */
-        if (IPADDR_MAXLEN > s - wild)
-            addr[s - wild] = '\0';
-        s++;
-        imask = str_conv_int(s, 32);
+         * we must make sure to truncate addr at the point where the mask
+         * starts as well, if it starts before IPADDR_MAXLEN. */
+        if (IPADDR_MAXLEN > mask - wild)
+            addr[mask - wild] = '\0';
+        mask++;
+    }
+
+    /* now determine the address family */
+    family = get_address_type(addr);
+    if (family != PF_INET && family != PF_INET6)
+        return 0;
+
+    /* and handle the bitmasking if need-be */
+    if (mask != NULL) {
+        imask = str_conv_int(mask, 0);
+
         if (family == PF_INET6) {
             if (imask <= 0)
@@ -684 +687 @@
             bitmask[(i - 1) / 8] = 0xff << (i % 8 ? (8 - (i % 8)) : 0);
     }
-    addr[IPADDR_MAXLEN] = '\0';
 
     /* now copy our addresses into bitmasks.  if either pton fails, assume no