usr/src/cmd/cmd-inet/common/addr_match.c

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21
  22 /*
  23  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
  24  * Use is subject to license terms.
  25  */
  26
  27 #pragma ident   "%Z%%M% %I%     %E% SMI"
  28
  29 #include <sys/types.h>
  30 #include <sys/socket.h>
  31 #include <netdb.h>
  32 #include <netinet/in.h>
  33 #include <string.h>
  34 #include <syslog.h>
  35 #include <addr_match.h>
  36
  37 /*
  38  * Function to compare IP addresses.  It walks the list provided in
  39  * the res parameter, comparing to the original address in sin or sin6,
  40  * with some addition guidance provided by fromp.  It returns B_TRUE
  41  * if a match is found, otherwise B_FALSE.
  42  */
  43
  44 static boolean_t
  45 find_match(const struct addrinfo *res,
  46     const struct sockaddr_storage *fromp,
  47     const struct sockaddr_in *sin,
  48     const struct sockaddr_in6 *sin6)
  49 {
  50         const struct addrinfo *ai;
  51
  52         /* This is the moral equivalent of an assert. */
  53         if ((fromp->ss_family == AF_INET && sin == NULL) ||
  54             (fromp->ss_family == AF_INET6 && sin6 == NULL))
  55                 return (B_FALSE);
  56
  57         for (ai = res; ai != NULL; ai = ai->ai_next) {
  58                 struct sockaddr_in *s4;
  59                 struct sockaddr_in6 *s6;
  60                 void *addr1, *addr2;
  61                 size_t size;
  62
  63                 if (ai->ai_family != fromp->ss_family)
  64                         continue;
  65                 if (ai->ai_family == AF_INET) {
  66                         /* LINTED E_BAD_PTR_CAST_ALIGN */
  67                         s4 = (struct sockaddr_in *)ai->ai_addr;
  68                         addr1 = &s4->sin_addr;
  69                         addr2 = &((struct sockaddr_in *)sin)->sin_addr;
  70                         size = sizeof (struct in_addr);
  71                 } else if (ai->ai_family == AF_INET6) {
  72                         /* LINTED E_BAD_PTR_CAST_ALIGN */
  73                         s6 = (struct sockaddr_in6 *)ai->ai_addr;
  74                         addr1 = &s6->sin6_addr;
  75                         addr2 = &((struct sockaddr_in6 *)sin6)->sin6_addr;
  76                         size = sizeof (struct in6_addr);
  77                 } else {
  78                         continue;
  79                 }
  80                 if (memcmp(addr1, addr2, size) == 0)
  81                         return (B_TRUE);
  82         }
  83         return (B_FALSE);
  84 }
  85
  86 void
  87 check_address(const char *prog,
  88     const struct sockaddr_storage *fromp,
  89     const struct sockaddr_in *sin,
  90     const struct sockaddr_in6 *sin6,
  91     const char *printable_addr,
  92     char *hostname,
  93     size_t hostsize)
  94 {
  95         /*
  96          * We have to check for spoofing.  So take hostname, look up its
  97          * address(es), and walk the list until we have a match with the
  98          * original IP address.  If no match is found, log a warning and
  99          * use the original IP address for authentication purposes.
 100          */
 101         struct addrinfo *res, hints;
 102         boolean_t match_found = B_FALSE;
 103
 104         (void) memset(&hints, 0, sizeof (hints));
 105         hints.ai_flags = AI_CANONNAME|AI_V4MAPPED|AI_ADDRCONFIG|AI_ALL;
 106         hints.ai_family = fromp->ss_family;
 107         if (getaddrinfo(hostname, NULL, &hints, &res) == 0) {
 108                 match_found = find_match(res, fromp, sin, sin6);
 109                 freeaddrinfo(res);
 110         }
 111         if (!match_found) {
 112                 syslog(LOG_WARNING, "%s: IP address '%s' maps to host "
 113                     "name '%s',\r\n but that host name does not map to "
 114                     "the same IP address.", prog, printable_addr, hostname);
 115                 (void) strlcpy(hostname, printable_addr, hostsize);
 116         }
 117 }