access.c

   1 /*
   2    Copyright (C) Andrew Tridgell 1998
   3
   4    This program is free software; you can redistribute it and/or modify
   5    it under the terms of the GNU General Public License as published by
   6    the Free Software Foundation; either version 2 of the License, or
   7    (at your option) any later version.
   8
   9    This program is distributed in the hope that it will be useful,
  10    but WITHOUT ANY WARRANTY; without even the implied warranty of
  11    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12    GNU General Public License for more details.
  13
  14    You should have received a copy of the GNU General Public License
  15    along with this program; if not, write to the Free Software
  16    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  17 */
  18
  19 /*
  20   hosts allow/deny code for rsync
  21
  22   */
  23
  24 #include "rsync.h"
  25
  26
  27 static int match_hostname(char *host, char *tok)
  28 {
  29         if (!host || !*host)
  30                 return 0;
  31         return wildmatch(tok, host);
  32 }
  33
  34 static int match_binary(char *b1, char *b2, char *mask, int addrlen)
  35 {
  36         int i;
  37
  38         for (i = 0; i < addrlen; i++) {
  39                 if ((b1[i] ^ b2[i]) & mask[i])
  40                         return 0;
  41         }
  42
  43         return 1;
  44 }
  45
  46 static void make_mask(char *mask, int plen, int addrlen)
  47 {
  48         int w, b;
  49
  50         w = plen >> 3;
  51         b = plen & 0x7;
  52
  53         if (w)
  54                 memset(mask, 0xff, w);
  55         if (w < addrlen)
  56                 mask[w] = 0xff & (0xff<<(8-b));
  57         if (w+1 < addrlen)
  58                 memset(mask+w+1, 0, addrlen-w-1);
  59
  60         return;
  61 }
  62
  63 static int match_address(char *addr, char *tok)
  64 {
  65         char *p;
  66         struct addrinfo hints, *resa, *rest;
  67         int gai;
  68         int ret = 0;
  69         int addrlen = 0;
  70 #ifdef HAVE_STRTOL
  71         long int bits;
  72 #else
  73         int bits;
  74 #endif
  75         char mask[16];
  76         char *a = NULL, *t = NULL;
  77         unsigned int len;
  78
  79         if (!addr || !*addr)
  80                 return 0;
  81
  82         p = strchr(tok,'/');
  83         if (p) {
  84                 *p = '\0';
  85                 len = p - tok;
  86         } else
  87                 len = strlen(tok);
  88
  89         /* Fail quietly if tok is a hostname (not an address) */
  90         if (strspn(tok, ".0123456789") != len
  91 #ifdef INET6
  92             && strchr(tok, ':') == NULL
  93 #endif
  94         ) {
  95                 if (p)
  96                         *p = '/';
  97                 return 0;
  98         }
  99
 100         memset(&hints, 0, sizeof(hints));
 101         hints.ai_family = PF_UNSPEC;
 102         hints.ai_socktype = SOCK_STREAM;
 103 #ifdef AI_NUMERICHOST
 104         hints.ai_flags = AI_NUMERICHOST;
 105 #endif
 106
 107         if (getaddrinfo(addr, NULL, &hints, &resa) != 0) {
 108                 if (p)
 109                         *p = '/';
 110                 return 0;
 111         }
 112
 113         gai = getaddrinfo(tok, NULL, &hints, &rest);
 114         if (p)
 115                 *p++ = '/';
 116         if (gai != 0) {
 117                 rprintf(FLOG, "error matching address %s: %s\n",
 118                         tok, gai_strerror(gai));
 119                 freeaddrinfo(resa);
 120                 return 0;
 121         }
 122
 123         if (rest->ai_family != resa->ai_family) {
 124                 ret = 0;
 125                 goto out;
 126         }
 127
 128         switch(resa->ai_family) {
 129         case PF_INET:
 130                 a = (char *)&((struct sockaddr_in *)resa->ai_addr)->sin_addr;
 131                 t = (char *)&((struct sockaddr_in *)rest->ai_addr)->sin_addr;
 132                 addrlen = 4;
 133
 134                 break;
 135
 136 #ifdef INET6
 137         case PF_INET6:
 138             {
 139                 struct sockaddr_in6 *sin6a, *sin6t;
 140
 141                 sin6a = (struct sockaddr_in6 *)resa->ai_addr;
 142                 sin6t = (struct sockaddr_in6 *)rest->ai_addr;
 143
 144                 a = (char *)&sin6a->sin6_addr;
 145                 t = (char *)&sin6t->sin6_addr;
 146
 147                 addrlen = 16;
 148
 149 #ifdef HAVE_SOCKADDR_IN6_SCOPE_ID
 150                 if (sin6t->sin6_scope_id &&
 151                     sin6a->sin6_scope_id != sin6t->sin6_scope_id) {
 152                         ret = 0;
 153                         goto out;
 154                 }
 155 #endif
 156
 157                 break;
 158             }
 159 #endif
 160         default:
 161             rprintf(FLOG, "unknown family %u\n", rest->ai_family);
 162             ret = 0;
 163             goto out;
 164         }
 165
 166         bits = -1;
 167         if (p) {
 168                 if (inet_pton(resa->ai_addr->sa_family, p, mask) <= 0) {
 169 #ifdef HAVE_STRTOL
 170                         char *ep = NULL;
 171 #else
 172                         unsigned char *pp;
 173 #endif
 174
 175 #ifdef HAVE_STRTOL
 176                         bits = strtol(p, &ep, 10);
 177                         if (!*p || *ep) {
 178                                 rprintf(FLOG, "malformed mask in %s\n", tok);
 179                                 ret = 0;
 180                                 goto out;
 181                         }
 182 #else
 183                         for (pp = (unsigned char *)p; *pp; pp++) {
 184                                 if (!isascii(*pp) || !isdigit(*pp)) {
 185                                         rprintf(FLOG, "malformed mask in %s\n", tok);
 186                                         ret = 0;
 187                                         goto out;
 188                                 }
 189                         }
 190                         bits = atoi(p);
 191 #endif
 192                         if (bits == 0) {
 193                                 ret = 1;
 194                                 goto out;
 195                         }
 196                         if (bits < 0 || bits > (addrlen << 3)) {
 197                                 rprintf(FLOG, "malformed mask in %s\n", tok);
 198                                 ret = 0;
 199                                 goto out;
 200                         }
 201                 }
 202         } else {
 203                 bits = 128;
 204         }
 205
 206         if (bits >= 0)
 207                 make_mask(mask, bits, addrlen);
 208
 209         ret = match_binary(a, t, mask, addrlen);
 210
 211 out:
 212         freeaddrinfo(resa);
 213         freeaddrinfo(rest);
 214         return ret;
 215 }
 216
 217 static int access_match(char *list, char *addr, char *host)
 218 {
 219         char *tok;
 220         char *list2 = strdup(list);
 221
 222         if (!list2)
 223                 out_of_memory("access_match");
 224
 225         strlower(list2);
 226         if (host)
 227                 strlower(host);
 228
 229         for (tok = strtok(list2, " ,\t"); tok; tok = strtok(NULL, " ,\t")) {
 230                 if (match_hostname(host, tok) || match_address(addr, tok)) {
 231                         free(list2);
 232                         return 1;
 233                 }
 234         }
 235
 236         free(list2);
 237         return 0;
 238 }
 239
 240 int allow_access(char *addr, char *host, char *allow_list, char *deny_list)
 241 {
 242         if (allow_list && !*allow_list)
 243                 allow_list = NULL;
 244         if (deny_list && !*deny_list)
 245                 deny_list = NULL;
 246
 247         /* If we match an allow-list item, we always allow access. */
 248         if (allow_list) {
 249                 if (access_match(allow_list, addr, host))
 250                         return 1;
 251                 /* For an allow-list w/o a deny-list, disallow non-matches. */
 252                 if (!deny_list)
 253                         return 0;
 254         }
 255
 256         /* If we match a deny-list item (and got past any allow-list
 257          * items), we always disallow access. */
 258         if (deny_list && access_match(deny_list, addr, host))
 259                 return 0;
 260
 261         /* Allow all other access. */
 262         return 1;
 263 }