access.c

   1 /*
   2  * Routines to authenticate access to a daemon (hosts allow/deny).
   3  *
   4  * Copyright (C) 1998 Andrew Tridgell
   5  * Copyright (C) 2004-2020 Wayne Davison
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License as published by
   9  * the Free Software Foundation; either version 3 of the License, or
  10  * (at your option) any later version.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU General Public License along
  18  * with this program; if not, visit the http://fsf.org website.
  19  */
  20
  21 #include "rsync.h"
  22
  23 static int allow_forward_dns;
  24
  25 extern const char undetermined_hostname[];
  26
  27 static int match_hostname(const char **host_ptr, const char *addr, const char *tok)
  28 {
  29         struct hostent *hp;
  30         unsigned int i;
  31         const char *host = *host_ptr;
  32
  33         if (!host || !*host)
  34                 return 0;
  35
  36         /* First check if the reverse-DNS-determined hostname matches. */
  37         if (iwildmatch(tok, host))
  38                 return 1;
  39
  40         if (!allow_forward_dns)
  41                 return 0;
  42
  43         /* Fail quietly if tok is an address or wildcarded entry, not a simple hostname. */
  44         if (!tok[strspn(tok, ".0123456789")] || tok[strcspn(tok, ":/*?[")])
  45                 return 0;
  46
  47         /* Now try forward-DNS on the token (config-specified hostname) and see if the IP matches. */
  48         if (!(hp = gethostbyname(tok)))
  49                 return 0;
  50
  51         for (i = 0; hp->h_addr_list[i] != NULL; i++) {
  52                 if (strcmp(addr, inet_ntoa(*(struct in_addr*)(hp->h_addr_list[i]))) == 0) {
  53                         /* If reverse lookups are off, we'll use the conf-specified
  54                          * hostname in preference to UNDETERMINED. */
  55                         if (host == undetermined_hostname) {
  56                                 if (!(*host_ptr = strdup(tok)))
  57                                         *host_ptr = undetermined_hostname;
  58                         }
  59                         return 1;
  60                 }
  61         }
  62
  63         return 0;
  64 }
  65
  66 static int match_binary(const char *b1, const char *b2, const char *mask, int addrlen)
  67 {
  68         int i;
  69
  70         for (i = 0; i < addrlen; i++) {
  71                 if ((b1[i] ^ b2[i]) & mask[i])
  72                         return 0;
  73         }
  74
  75         return 1;
  76 }
  77
  78 static void make_mask(char *mask, int plen, int addrlen)
  79 {
  80         int w, b;
  81
  82         w = plen >> 3;
  83         b = plen & 0x7;
  84
  85         if (w)
  86                 memset(mask, 0xff, w);
  87         if (w < addrlen)
  88                 mask[w] = 0xff & (0xff<<(8-b));
  89         if (w+1 < addrlen)
  90                 memset(mask+w+1, 0, addrlen-w-1);
  91
  92         return;
  93 }
  94
  95 static int match_address(const char *addr, const char *tok)
  96 {
  97         char *p;
  98         struct addrinfo hints, *resa, *rest;
  99         int gai;
 100         int ret = 0;
 101         int addrlen = 0;
 102 #ifdef HAVE_STRTOL
 103         long int bits;
 104 #else
 105         int bits;
 106 #endif
 107         char mask[16];
 108         char *a = NULL, *t = NULL;
 109
 110         if (!addr || !*addr)
 111                 return 0;
 112
 113         p = strchr(tok,'/');
 114         if (p)
 115                 *p = '\0';
 116
 117         /* Fail quietly if tok is a hostname, not an address. */
 118         if (tok[strspn(tok, ".0123456789")] && strchr(tok, ':') == NULL) {
 119                 if (p)
 120                         *p = '/';
 121                 return 0;
 122         }
 123
 124         memset(&hints, 0, sizeof(hints));
 125         hints.ai_family = PF_UNSPEC;
 126         hints.ai_socktype = SOCK_STREAM;
 127 #ifdef AI_NUMERICHOST
 128         hints.ai_flags = AI_NUMERICHOST;
 129 #endif
 130
 131         if (getaddrinfo(addr, NULL, &hints, &resa) != 0) {
 132                 if (p)
 133                         *p = '/';
 134                 return 0;
 135         }
 136
 137         gai = getaddrinfo(tok, NULL, &hints, &rest);
 138         if (p)
 139                 *p++ = '/';
 140         if (gai != 0) {
 141                 rprintf(FLOG, "error matching address %s: %s\n",
 142                         tok, gai_strerror(gai));
 143                 freeaddrinfo(resa);
 144                 return 0;
 145         }
 146
 147         if (rest->ai_family != resa->ai_family) {
 148                 ret = 0;
 149                 goto out;
 150         }
 151
 152         switch(resa->ai_family) {
 153         case PF_INET:
 154                 a = (char *)&((struct sockaddr_in *)resa->ai_addr)->sin_addr;
 155                 t = (char *)&((struct sockaddr_in *)rest->ai_addr)->sin_addr;
 156                 addrlen = 4;
 157
 158                 break;
 159
 160 #ifdef INET6
 161         case PF_INET6: {
 162                 struct sockaddr_in6 *sin6a, *sin6t;
 163
 164                 sin6a = (struct sockaddr_in6 *)resa->ai_addr;
 165                 sin6t = (struct sockaddr_in6 *)rest->ai_addr;
 166
 167                 a = (char *)&sin6a->sin6_addr;
 168                 t = (char *)&sin6t->sin6_addr;
 169
 170                 addrlen = 16;
 171
 172 #ifdef HAVE_SOCKADDR_IN6_SCOPE_ID
 173                 if (sin6t->sin6_scope_id && sin6a->sin6_scope_id != sin6t->sin6_scope_id) {
 174                         ret = 0;
 175                         goto out;
 176                 }
 177 #endif
 178
 179                 break;
 180         }
 181 #endif
 182         default:
 183                 rprintf(FLOG, "unknown family %u\n", rest->ai_family);
 184                 ret = 0;
 185                 goto out;
 186         }
 187
 188         bits = -1;
 189         if (p) {
 190                 if (inet_pton(resa->ai_addr->sa_family, p, mask) <= 0) {
 191 #ifdef HAVE_STRTOL
 192                         char *ep = NULL;
 193 #else
 194                         unsigned char *pp;
 195 #endif
 196
 197 #ifdef HAVE_STRTOL
 198                         bits = strtol(p, &ep, 10);
 199                         if (!*p || *ep) {
 200                                 rprintf(FLOG, "malformed mask in %s\n", tok);
 201                                 ret = 0;
 202                                 goto out;
 203                         }
 204 #else
 205                         for (pp = (unsigned char *)p; *pp; pp++) {
 206                                 if (!isascii(*pp) || !isdigit(*pp)) {
 207                                         rprintf(FLOG, "malformed mask in %s\n", tok);
 208                                         ret = 0;
 209                                         goto out;
 210                                 }
 211                         }
 212                         bits = atoi(p);
 213 #endif
 214                         if (bits == 0) {
 215                                 ret = 1;
 216                                 goto out;
 217                         }
 218                         if (bits < 0 || bits > (addrlen << 3)) {
 219                                 rprintf(FLOG, "malformed mask in %s\n", tok);
 220                                 ret = 0;
 221                                 goto out;
 222                         }
 223                 }
 224         } else {
 225                 bits = 128;
 226         }
 227
 228         if (bits >= 0)
 229                 make_mask(mask, bits, addrlen);
 230
 231         ret = match_binary(a, t, mask, addrlen);
 232
 233   out:
 234         freeaddrinfo(resa);
 235         freeaddrinfo(rest);
 236         return ret;
 237 }
 238
 239 static int access_match(const char *list, const char *addr, const char **host_ptr)
 240 {
 241         char *tok;
 242         char *list2 = strdup(list);
 243
 244         if (!list2)
 245                 out_of_memory("access_match");
 246
 247         strlower(list2);
 248
 249         for (tok = strtok(list2, " ,\t"); tok; tok = strtok(NULL, " ,\t")) {
 250                 if (match_hostname(host_ptr, addr, tok) || match_address(addr, tok)) {
 251                         free(list2);
 252                         return 1;
 253                 }
 254         }
 255
 256         free(list2);
 257         return 0;
 258 }
 259
 260 int allow_access(const char *addr, const char **host_ptr, int i)
 261 {
 262         const char *allow_list = lp_hosts_allow(i);
 263         const char *deny_list = lp_hosts_deny(i);
 264
 265         if (allow_list && !*allow_list)
 266                 allow_list = NULL;
 267         if (deny_list && !*deny_list)
 268                 deny_list = NULL;
 269
 270         allow_forward_dns = lp_forward_lookup(i);
 271
 272         /* If we match an allow-list item, we always allow access. */
 273         if (allow_list) {
 274                 if (access_match(allow_list, addr, host_ptr))
 275                         return 1;
 276                 /* For an allow-list w/o a deny-list, disallow non-matches. */
 277                 if (!deny_list)
 278                         return 0;
 279         }
 280
 281         /* If we match a deny-list item (and got past any allow-list
 282          * items), we always disallow access. */
 283         if (deny_list && access_match(deny_list, addr, host_ptr))
 284                 return 0;
 285
 286         /* Allow all other access. */
 287         return 1;
 288 }