From dd8536ef3eddac19e517e99479f7ec7c4c1faf1c Mon Sep 17 00:00:00 2001 From: "David Adam (zanchey)" Date: Thu, 8 Sep 2011 20:55:01 +0800 Subject: [PATCH] [PATCH] server - allow IDENT auth by anyone from a trusted subnet --- src/server/server.c | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/src/server/server.c b/src/server/server.c index 3169ca0..21740fd 100644 --- a/src/server/server.c +++ b/src/server/server.c @@ -34,6 +34,9 @@ #define MSG_STR_TOO_LONG "499 Command too long (limit "EXPSTR(INPUT_BUFFER_SIZE)")\n" +#define IDENT_TRUSTED_NETWORK 0x825F0D00 +#define IDENT_TRUSTED_NETMASK 0xFFFFFFC0 + // === TYPES === typedef struct sClient { @@ -541,18 +544,27 @@ void Server_Cmd_AUTHIDENT(tClient *Client, char *Args) char *username; int userflags; const int ident_timeout = 5; + socklen_t len; + struct sockaddr_in client_addr; + uint32_t client_ip; if( Args != NULL && strlen(Args) ) { sendf(Client->Socket, "407 AUTHIDENT takes no arguments\n"); return ; } - // Check if trusted - if( !Client->bIsTrusted ) { - if(giDebugLevel) - Debug(Client, "Untrusted client attempting to AUTHIDENT"); - sendf(Client->Socket, "401 Untrusted\n"); - return ; + // Check if trusted (only works with INET sockets at present) + len = sizeof(client_addr); + if ( ! getpeername(Client->Socket, (struct sockaddr*)&client_addr, &len) ) { + // throw an error + } + + client_ip = client_addr.sin_addr.s_addr; + if ( ! (ntohl(client_ip) == 0x7F000001 || ( (ntohl(client_ip) & IDENT_TRUSTED_NETMASK) == IDENT_TRUSTED_NETWORK ) )) { + if(giDebugLevel) + Debug(Client, "Untrusted client attempting to AUTHIDENT"); + sendf(Client->Socket, "401 Untrusted\n"); + return ; } // Get username via IDENT -- 2.20.1