Iauth external mods dnsbl v2

doc/iauth.conf.5

@@ -158,13 +158,14 @@ Apache+PHP configurations).
 .B DNSBL
 This module performs a DNS query to check if an IP address is blacklisted.
 
-This module understands 3 options:
+This module only accepts 127.0.0.x A responses as valid DNSBL hits.
+Other A responses are ignored and logged as unexpected DNSBL responses.
+
+This module understands the following options:
 .B log
 to log the IP which is listed on the DNSBL
 .B reject
 to reject the connection which is listed on the DNSBL
-.B paranoid
-Double check that the DNSBL is actually responding a 127.0.0.x IP
 .B servers
 A comma-separated list of DNSBL domains which are checked. This iauth module cannot
 check which DNSBL type is used so only use for DNSBLs suitable where all
@@ -199,8 +200,10 @@ module webproxy
         port = 3128
 
 module dnsbl
-	option = log,reject,paranoid,servers=bl1.example.org,bl2.example.org
+	option = log,reject
 	reason = Denied access (DNSBL)
+	entry = bl1.example.org
+	entry = bl2.example.org
 .fi
 .RE
 .SH CAVEATS

doc/iauth.conf.example

@@ -46,11 +46,13 @@ module rfc931
 #	option = reject,careful
 #	reason = Denied access (insecure proxy found)
 
-# Reject clients based on DNS BL.
 #module dnsbl
-#	option = log,reject,servers=bl1.example.org,bl2.example.org
-#	reason = Denied access (DNSBL)
+#    option = log,reject,skip_if_ident,skip_if_sasl
+#    reason = Denied access (DNSBL)
+#    entry = torexit.dan.me.uk|Tor Exit Node
+#    entry = dnsbl.dronebl.org|You are listed in DroneBL - https://dronebl.org/lookup?ip={ip}
+
 
 # Check clients using an external scanning service.
 #module external
-#	option = sid=000A,host=127.0.0.1,port=9009,srcip=,timeout=20,allow_on_timeout=yes,skip_if_sasl,skip_if_ident
+#	option = host=127.0.0.1,port=9009,srcip=,timeout=20,allow_on_timeout=yes,skip_if_sasl,skip_if_ident

iauth/a_conf.c

@@ -31,11 +31,39 @@ static const volatile char rcsid[] = "@(#)$Id: a_conf.c,v 1.39 2004/11/13 16:46:
 static aModule *Mlist[16];
 
 #define DEFAULT_TIMEOUT 30
+#define CONF_BUFSIZE 1024
 
 u_int	debuglevel = 0;
 
 AnInstance *instances = NULL;
 
+
+static void	conf_kv_add(AnInstance *inst, const char *key, const char *value)
+{
+	aConfKV **last = &inst->module_kv;
+
+	while (*last)
+		last = &(*last)->next;
+	*last = (aConfKV *) malloc(sizeof(aConfKV));
+	(*last)->key = mystrdup((char *) key);
+	(*last)->value = mystrdup((char *) value);
+	(*last)->next = NULL;
+}
+
+static char *conf_trim(char *s)
+{
+	char *e;
+
+	while (*s == ' ' || *s == '	')
+		s++;
+	if (*s == '\0')
+		return s;
+	e = s + strlen(s);
+	while (e > s && (e[-1] == ' ' || e[-1] == '	'))
+		*--e = '\0';
+	return s;
+}
+
 static	void	conf_err(u_int nb, char *msg, char *chk)
 {
 	if (chk)
@@ -56,7 +84,7 @@ char	*conf_read(char *cfile)
 	u_int timeout = DEFAULT_TIMEOUT, totto = 0;
 	u_int lnnb = 0, i;
 	u_char icount = 0, Mcnt = 0;
-	char buffer[160], *ch;
+	char buffer[CONF_BUFSIZE], *ch;
 	AnInstance **last = &instances, *itmp;
 	FILE *cfh;
 
@@ -79,7 +107,7 @@ char	*conf_read(char *cfile)
 	    }
 	else
 	    {
-		while (fgets(buffer, 160, cfh))
+		while (fgets(buffer, sizeof(buffer), cfh))
 		    {
 			if ((ch = index(buffer, '\n')))
 			{
@@ -90,7 +118,7 @@ char	*conf_read(char *cfile)
 				conf_err(lnnb, "line too long, ignoring.",
 					 cfile);
 				/* now skip what's left */
-				while (fgets(buffer, 160, cfh))
+				while (fgets(buffer, sizeof(buffer), cfh))
 				{
 					if (index(buffer, '\n'))
 					{
@@ -227,7 +255,7 @@ char	*conf_read(char *cfile)
 			    }
 			if (Mlist[i] == &Module_rfc931 && ident)
 			    {
-				conf_err(lnnb, 
+				conf_err(lnnb,
 				 "This module can only be loaded once.",
 					 cfile);
 				continue;
@@ -247,12 +275,13 @@ char	*conf_read(char *cfile)
 			(*last)->skip_if_sasl = 0;
 			(*last)->wait_for_ident = 0;
 			(*last)->skip_if_ident = 0;
+			(*last)->module_kv = NULL;
 			(*last)->delayed = o_del;
 			(*last)->port = 0;
 			if (Mlist[i] == &Module_rfc931)
 				ident = *last;
 
-			while (fgets(buffer, 160, cfh))
+			while (fgets(buffer, sizeof(buffer), cfh))
 			    {
 				aTarget **ttmp;
 				int inverse = 0;
@@ -267,7 +296,7 @@ char	*conf_read(char *cfile)
 						 "line too long, ignoring.",
 						 cfile);
 					/* now skip what's left */
-					while (fgets(buffer, 160, cfh))
+					while (fgets(buffer, sizeof(buffer), cfh))
 						if (index(buffer,'\n'))
 							break;
 					continue;
@@ -444,8 +473,18 @@ char	*conf_read(char *cfile)
 				    }
 				else
 				    {
-					conf_err(lnnb, "Invalid keyword.",
-						 cfile);
+					char *prop = buffer + 1;
+					char *eq = strstr(prop, " = ");
+
+					if (!eq)
+					{
+						conf_err(lnnb, "Invalid keyword.",
+							 cfile);
+						continue;
+					}
+
+					*eq = '\0';
+					conf_kv_add(*last, conf_trim(prop), conf_trim(eq + 3));
 					continue;
 				    }
 				if (Mlist[i] == &Module_rfc931)
@@ -471,16 +510,25 @@ char	*conf_read(char *cfile)
 
 	if (ident == NULL)
 	    {
-		ident = *last = (AnInstance *) malloc(sizeof(AnInstance));
+		ident = *last = (AnInstance *) calloc(1, sizeof(AnInstance));
+		if (ident == NULL)
+			return NULL;
+
 		(*last)->nexti = NULL;
-		(*last)->opt = NULL;
+		(*last)->in = icount;
 		(*last)->mod = &Module_rfc931;
+		(*last)->opt = NULL;
+		(*last)->popt = NULL;
+		(*last)->data = NULL;
 		(*last)->hostname = NULL;
 		(*last)->address = NULL;
 		(*last)->timeout = DEFAULT_TIMEOUT;
-		(*last)->in = icount;
-		(*last)->popt = NULL;
-		(*last)->address = NULL;
+		(*last)->wait_for_reg = 0;
+		(*last)->skip_if_sasl = 0;
+		(*last)->wait_for_ident = 0;
+		(*last)->skip_if_ident = 0;
+		(*last)->reason = NULL;
+		(*last)->module_kv = NULL;
 		(*last)->delayed = o_del;
 		(*last)->port = 0;
 	    }

iauth/a_conf_def.h

@@ -21,6 +21,16 @@ typedef struct Module aModule;
 typedef struct Instance AnInstance;
 typedef struct Target aTarget;
 
+typedef struct ConfKV aConfKV;
+
+struct ConfKV
+{
+    char	*key;
+    char	*value;
+    aConfKV	*next;
+};
+
+
 struct Module
 {
     char	*name;			/* module name */
@@ -58,6 +68,7 @@ struct Instance
 	u_char  wait_for_ident; /* wait until ident lookup completes */
 	u_char 	skip_if_ident;  /* skip module if we got an ident reply */
     char	*reason;		/* reject reason */
+    aConfKV	*module_kv;		/* module-specific key/value pairs */
     u_char	delayed;		/* delayed execution mode */
 };
 

iauth/a_io.c

@@ -38,6 +38,9 @@ static char		iobuf[IOBUFSIZE+1];
 static char		rbuf[IOBUFSIZE+1];	/* incoming ircd stream */
 static int		iob_len = 0, rb_len = 0;
 
+static char		ircd_name[HOSTLEN + 1];
+static char		ircd_sid[SIDLEN + 1];
+
 typedef struct {
 	int fd;
 	int want_write;
@@ -214,6 +217,16 @@ void	sendto_ircd(char *pattern, ...)
         va_end(va);
 }
 
+const char *iauth_ircd_name(void)
+{
+	return ircd_name[0] ? ircd_name : "*";
+}
+
+const char *iauth_ircd_sid(void)
+{
+	return ircd_sid[0] ? ircd_sid : "*";
+}
+
 static char *iauth_skip_ws(char *p)
 {
 	while (*p == ' ' || *p == '\t')
@@ -794,8 +807,12 @@ static	void	parse_ircd(void)
 				   "Error from ircd: %s", chp);
 			break;
 		case 'M':
-			/* RPL_HELLO to be exact, but who cares. */
-			strConnLen = sprintf(strConn, ":%s 020 * :", chp+2);
+			/* M <servername> <sid> */
+			p = chp + 1;
+			p = iauth_read_token(p, ircd_name, sizeof(ircd_name));
+			(void) iauth_read_token(p, ircd_sid, sizeof(ircd_sid));
+			strConnLen = snprintf(strConn, sizeof(strConn),
+						  ":%s 020 * :", iauth_ircd_name());
 			break;
 		case 'S': /* SASL authentication */
 			cldata[cl].state |= A_SASL;

iauth/a_io_ext.h

@@ -38,6 +38,8 @@ extern anAuthData      cldata[MAXCONNECTIONS];
 EXTERN void io_init(void);
 EXTERN void vsendto_ircd (char *, va_list);
 EXTERN void sendto_ircd (char *, ...);
+EXTERN const char *iauth_ircd_name(void);
+EXTERN const char *iauth_ircd_sid(void);
 EXTERN void init_io (void);
 EXTERN void loop_io (void);
 EXTERN int tcp_connect (char *, char *, u_short, char **);