From e7e7d2fddf8b5b536d7b67bb024060e5a4397097 Mon Sep 17 00:00:00 2001
From: z3APA3A <3APA3A@3proxy.ru>
Date: Wed, 21 Aug 2019 15:20:43 +0300
Subject: [PATCH] "limit" support in authcache to bind sessions to ip

---
 doc/html/howtoe.html |  7 ++++++-
 doc/html/howtor.html |  7 +++++++
 man/3proxy.cfg.3     |  2 ++
 src/auth.c           | 24 +++++++++++++++++-------
 src/conf.c           |  1 +
 5 files changed, 33 insertions(+), 8 deletions(-)

diff --git a/doc/html/howtoe.html b/doc/html/howtoe.html
index c1ae3b9..7c29aa5 100644
--- a/doc/html/howtoe.html
+++ b/doc/html/howtoe.html
@@ -461,7 +461,12 @@ proxy -n
 </p>
 Please note, that caching affects security. Never use caching for access to
 critical resources, such as web administration.
-
+  <p>authcache can be used to bind user's sessions to ip with 'limit' option, with
+  <pre>
+  autchcache ip,user,pass,limit 120
+  auth cache strong</pre>
+  user will not be able to use more than a single IP during cache time (120 sec).
+  </p>
 		<li><A NAME="USERS">How to create user list</A>
 <p>
 Userslist is created with 'users' command.
diff --git a/doc/html/howtor.html b/doc/html/howtor.html
index de084ca..a97ecad 100644
--- a/doc/html/howtor.html
+++ b/doc/html/howtor.html
@@ -469,6 +469,13 @@
   использовать кэширование для доступа к критичным ресурсам, в частности к
   интерфейсу администрирования.
   </p>
+  <p>authcache так же может использоваться для привязки сессий пользователя к ip с
+  с помощью опции limit
+  <pre>
+  autchcache ip,user,pass,limit 120
+  auth cache strong</pre>
+  запретит пользователю использовать более одного адреса в течении времени кеширования.
+  </p>
   <li><a name="USERS"><i>Как создать список пользователей</i></a>
   <p>
   Список пользователей задается с помощью команды users. 
diff --git a/man/3proxy.cfg.3 b/man/3proxy.cfg.3
index e9699db..661d330 100644
--- a/man/3proxy.cfg.3
+++ b/man/3proxy.cfg.3
@@ -519,6 +519,8 @@ assigned to the same user without actual authentication.
  user - same as above, but IP is not checked. 
 .br
  user,password - both username and password are checked against cached ones.
+.br
+ limit - limit user to use only one ip, \'ip\' and \'user\' are required
 .br
 Use auth type \'cache\' for cached authentication
 
diff --git a/src/auth.c b/src/auth.c
index 5e7c430..f34b20b 100644
--- a/src/auth.c
+++ b/src/auth.c
@@ -721,15 +721,24 @@ int cacheauth(struct clientparam * param){
 			continue;
 			
 		}
-		if(((!(conf.authcachetype&2)) || (param->username && ac->username && !strcmp(ac->username, (char *)param->username))) &&
-		   ((!(conf.authcachetype&1)) || (*SAFAMILY(&ac->sa) ==  *SAFAMILY(&param->sincr) && !memcmp(SAADDR(&ac->sa), SAADDR(&param->sincr), SAADDRLEN(&ac->sa)))) && 
+		if((!(conf.authcachetype&2) || (param->username && ac->username && !strcmp(ac->username, (char *)param->username))) &&
 		   (!(conf.authcachetype&4) || (ac->password && param->password && !strcmp(ac->password, (char *)param->password)))) {
-			if(param->username){
-				myfree(param->username);
+
+			if(!(conf.authcachetype&1)
+				|| ((*SAFAMILY(&ac->sa) ==  *SAFAMILY(&param->sincr) 
+				   && !memcmp(SAADDR(&ac->sa), SAADDR(&param->sincr), SAADDRLEN(&ac->sa))))){
+
+				if(param->username){
+					myfree(param->username);
+				}
+				param->username = (unsigned char *)mystrdup(ac->username);
+				pthread_mutex_unlock(&hash_mutex);
+				return 0;
+			}
+			else if ((conf.authcachetype&1) && (conf.authcachetype&8)) {
+				pthread_mutex_unlock(&hash_mutex);
+				return 10;
 			}
-			param->username = (unsigned char *)mystrdup(ac->username);
-			pthread_mutex_unlock(&hash_mutex);
-			return 0;
 		}
 		last = ac;
 		ac = ac->next;
@@ -790,6 +799,7 @@ int doauth(struct clientparam * param){
 			break;
 		}
 		if(res > ret) ret = res;
+		if(ret > 9) return ret;
 	}
 	if(!res){
 		return alwaysauth(param);
diff --git a/src/conf.c b/src/conf.c
index aef48af..4c9ea02 100644
--- a/src/conf.c
+++ b/src/conf.c
@@ -1338,6 +1338,7 @@ static int h_authcache(int argc, unsigned char **argv){
 	if(strstr((char *) *(argv + 1), "ip")) conf.authcachetype |= 1;
 	if(strstr((char *) *(argv + 1), "user")) conf.authcachetype |= 2;
 	if(strstr((char *) *(argv + 1), "pass")) conf.authcachetype |= 4;
+	if(strstr((char *) *(argv + 1), "limit")) conf.authcachetype |= 8;
 	if(argc > 2) conf.authcachetime = (unsigned) atoi((char *) *(argv + 2));
 	if(!conf.authcachetype) conf.authcachetype = 6;
 	if(!conf.authcachetime) conf.authcachetime = 600;