iauth: support for external services

[patrick-irc]

Prepare iauth to support modules that communicate with external services (e.g. Java, Python or cloud backends).

The main goal is to make iauth suitable for modules that keep persistent connections to external services and need information that only becomes available later during client registration, such as NICK/USER, SASL or ident results.

1. Enable persistent global connections for iauth modules

Extended the module interface with module-wide lifecycle hooks (ginit, gtick, gwork, grelease) and added support for global file descriptors.

Global file descriptors can be registered independently of individual client requests and are integrated into both the select() and poll() event loops. Modules can therefore maintain persistent TCP/socket connections to external services instead of opening a new connection for every client.

Added:

• io_register_gfd()
• io_update_gfd()
• io_unregister_gfd()
• global read/write event handling through gwork()
• periodic module processing through gtick()
• global initialization through ginit()

This provides the foundation for asynchronous modules backed by long-running external services.

2. Allow modules to run after NICK/USER but before registration completes

Added a new wait_for_reg module option.

Some authentication decisions require information that is not available when the TCP connection is first accepted. wait_for_reg allows such modules to run after the client has supplied its registration data, while still preventing the client from becoming fully registered.

A new iauth/ircd handshake coordinates this:

• iauth sends P <clid> <count> when matching wait_for_reg modules exist.
• ircd marks the connection with DEFER_USER_REG and continues parsing the client's registration commands.
• once NICK/USER and CAP/SASL negotiation are complete, ircd sends H together with the registration data.
• iauth runs the deferred modules.
• after iauth sends D, ircd resumes register_user() and completes registration.

This allows external authentication modules to inspect the complete client introduction without having to authenticate users after they have already joined the network.

3. Add SASL- and ident-aware module scheduling

Added configuration options for conditionally delaying or skipping iauth modules:

• wait_for_reg — run only once the client's registration information is available.
• skip_if_sasl — implies wait_for_reg and skips the module when SASL authentication has already succeeded.
• wait_for_ident — wait until the ident lookup has definitively completed.
• skip_if_ident — wait for ident and skip the module when a valid ident response was received.

Successful SASL authentication is now reported from ircd to iauth using the new S message, including the authenticated SASL username.

The RFC931 module now explicitly reports both successful and unsuccessful ident completion, allowing the iauth scheduler to reliably continue modules waiting for the ident result.

These options make it possible to avoid unnecessary external authentication requests when a stronger or cheaper authentication mechanism has already succeeded.

4. Expose complete registration context to iauth modules

Extended AuthData so modules can access the registration information needed by external authentication services:

• nickname
• USER username (user1)
• USER mode field (user2)
• USER server field (user3)
• realname
• SASL username

The original USER parameters are now retained on the ircd client until registration completes and are passed to iauth with the H message.

This also removes the previous dependency on XLINE for retaining these fields, making the registration context consistently available to iauth.

5. Improve communication between iauth modules and unregistered clients

Added support for an R response from iauth.

This allows a module to send an IRC protocol line back to a client while registration is still pending, e.g.

:ircnet.hostsailor.com 465 nick :You (*@1.2.3.4) are banned from this server: Listed in torexit.dan.me.uk

[patrick-irc]

The changes described above have been tested over a long period on ircnet.tngnet.nl, hostsailor.ircnet.nl, hostsailor.ircnet.nl.