xio-tcpwrap.c

   1 /* source: xio-tcpwrap.c */
   2 /* Copyright Gerhard Rieger 2006-2008 */
   3 /* Published under the GNU General Public License V.2, see file COPYING */
   4
   5 /* this file contains the source for tcpwrapper handling stuff */
   6
   7 #include "xiosysincludes.h"
   8 #if WITH_LIBWRAP
   9 #include "tcpd.h"
  10 #endif
  11 #include "xioopen.h"
  12
  13 #include "xio-tcpwrap.h"
  14
  15
  16 #if (WITH_TCP || WITH_UDP) && WITH_LIBWRAP
  17
  18 const struct optdesc opt_tcpwrappers = { "tcpwrappers", "tcpwrap", OPT_TCPWRAPPERS, GROUP_RANGE,  PH_ACCEPT, TYPE_STRING_NULL, OFUNC_SPEC };
  19 const struct optdesc opt_tcpwrap_etc               = { "tcpwrap-etc",               "tcpwrap-dir", OPT_TCPWRAP_ETC,               GROUP_RANGE, PH_ACCEPT, TYPE_FILENAME, OFUNC_SPEC };
  20 #if defined(HAVE_HOSTS_ALLOW_TABLE)
  21 const struct optdesc opt_tcpwrap_hosts_allow_table = { "tcpwrap-hosts-allow-table", "allow-table", OPT_TCPWRAP_HOSTS_ALLOW_TABLE, GROUP_RANGE, PH_ACCEPT, TYPE_FILENAME, OFUNC_SPEC };
  22 #endif
  23 #if defined(HAVE_HOSTS_DENY_TABLE)
  24 const struct optdesc opt_tcpwrap_hosts_deny_table  = { "tcpwrap-hosts-deny-table",  "deny-table",  OPT_TCPWRAP_HOSTS_DENY_TABLE,  GROUP_RANGE, PH_ACCEPT, TYPE_FILENAME, OFUNC_SPEC };
  25 #endif
  26
  27
  28 /* they are declared only externally with libwrap and would be unresolved
  29    without these definitions */
  30 int allow_severity=10, deny_severity=10;
  31
  32 /* returns 0 if option was found and could be applied
  33    returns 1 if option was not found
  34    returns -1 if option was found but failed */
  35 int xio_retropt_tcpwrap(xiosingle_t *xfd, struct opt *opts) {
  36    bool dolibwrap = false;
  37    dolibwrap =
  38       retropt_string(opts, OPT_TCPWRAPPERS,
  39                      &xfd->para.socket.ip.libwrapname) >= 0 || dolibwrap;
  40    dolibwrap =
  41       retropt_string(opts, OPT_TCPWRAP_ETC,
  42                      &xfd->para.socket.ip.tcpwrap_etc) >= 0 || dolibwrap;
  43 #if defined(HAVE_HOSTS_ALLOW_TABLE)
  44    dolibwrap =
  45       retropt_string(opts, OPT_TCPWRAP_HOSTS_ALLOW_TABLE,
  46                      &xfd->para.socket.ip.hosts_allow_table) >= 0 || dolibwrap;
  47 #endif
  48 #if defined(HAVE_HOSTS_DENY_TABLE)
  49    dolibwrap =
  50       retropt_string(opts, OPT_TCPWRAP_HOSTS_DENY_TABLE,
  51                      &xfd->para.socket.ip.hosts_deny_table) >= 0 || dolibwrap;
  52 #endif
  53    if (dolibwrap) {
  54       xfd->para.socket.ip.dolibwrap = true;
  55       if (xfd->para.socket.ip.libwrapname == NULL) {
  56          xfd->para.socket.ip.libwrapname = (char *)diag_get_string('p');
  57       }
  58 #if defined(HAVE_HOSTS_ALLOW_TABLE) || defined(HAVE_HOSTS_DENY_TABLE)
  59       if (xfd->para.socket.ip.tcpwrap_etc) {
  60          if (xfd->para.socket.ip.hosts_allow_table == NULL) {
  61             xfd->para.socket.ip.hosts_allow_table =
  62                Malloc(strlen(xfd->para.socket.ip.tcpwrap_etc)+1+11+1);
  63             sprintf(xfd->para.socket.ip.hosts_allow_table, "%s/hosts.allow",
  64                     xfd->para.socket.ip.tcpwrap_etc);
  65          }
  66          if (xfd->para.socket.ip.hosts_deny_table == NULL) {
  67             xfd->para.socket.ip.hosts_deny_table =
  68                Malloc(strlen(xfd->para.socket.ip.tcpwrap_etc)+1+10+1);
  69             sprintf(xfd->para.socket.ip.hosts_deny_table, "%s/hosts.deny",
  70                     xfd->para.socket.ip.tcpwrap_etc);
  71          }
  72       }
  73 #endif /* defined(HAVE_HOSTS_ALLOW_TABLE) || defined(HAVE_HOSTS_DENY_TABLE) */
  74       return 0;
  75    }
  76    return 1;
  77 }
  78
  79
  80 /* returns -1 if forbidden, 0 if no tcpwrap check, or 1 if explicitely allowed
  81    */
  82 int xio_tcpwrap_check(xiosingle_t *xfd, union sockaddr_union *us,
  83                       union sockaddr_union *them) {
  84    char *save_hosts_allow_table, *save_hosts_deny_table;
  85    struct request_info ri;
  86 #if WITH_IP6
  87    char clientaddr[INET6_ADDRSTRLEN] = "", serveraddr[INET6_ADDRSTRLEN] = "";
  88 #else
  89    char clientaddr[INET_ADDRSTRLEN] = "", serveraddr[INET_ADDRSTRLEN] = "";
  90 #endif
  91    int allow;
  92
  93    if (!xfd->para.socket.ip.dolibwrap) {
  94       return 0;
  95    }
  96    if (us == NULL || them == NULL)  { return -1; }
  97
  98 #if defined(HAVE_HOSTS_ALLOW_TABLE)
  99    save_hosts_allow_table = hosts_allow_table;
 100    if (xfd->para.socket.ip.hosts_allow_table) {
 101       Debug1("hosts_allow_table = \"%s\"",
 102              xfd->para.socket.ip.hosts_allow_table);
 103       hosts_allow_table = xfd->para.socket.ip.hosts_allow_table;
 104    }
 105 #endif /* defined(HAVE_HOSTS_ALLOW_TABLE) */
 106 #if defined(HAVE_HOSTS_DENY_TABLE)
 107    save_hosts_deny_table  = hosts_deny_table;
 108    if (xfd->para.socket.ip.hosts_deny_table) {
 109       Debug1("hosts_deny_table = \"%s\"",
 110              xfd->para.socket.ip.hosts_deny_table);
 111       hosts_deny_table  = xfd->para.socket.ip.hosts_deny_table;
 112    }
 113 #endif /* defined(HAVE_HOSTS_DENY_TABLE) */
 114
 115    hosts_access_verbose = 32767;
 116    if (inet_ntop(them->soa.sa_family,
 117 #if WITH_IP6
 118                  them->soa.sa_family==PF_INET6 ?
 119                  (void *)&them->ip6.sin6_addr :
 120 #endif
 121                  (void *)&them->ip4.sin_addr,
 122                  clientaddr, sizeof(clientaddr)) == NULL) {
 123       Warn1("inet_ntop(): %s", strerror(errno));
 124    }
 125    if (inet_ntop(us->soa.sa_family,
 126 #if WITH_IP6
 127                  us->soa.sa_family==PF_INET6 ?
 128                  (void *)&us->ip6.sin6_addr :
 129 #endif
 130                  (void *)&us->ip4.sin_addr,
 131                  serveraddr, sizeof(serveraddr)) == NULL) {
 132       Warn1("inet_ntop(): %s", strerror(errno));
 133    }
 134    Debug7("request_init(%p, RQ_FILE, %d, RQ_CLIENT_SIN, {%s:%u}, RQ_SERVER_SIN, {%s:%u}, RQ_DAEMON, \"%s\", 0",
 135            &ri, xfd->fd, clientaddr,
 136            ntohs(((struct sockaddr_in *)them)->sin_port),
 137            serveraddr, ntohs(us->ip4.sin_port),
 138            xfd->para.socket.ip.libwrapname?xfd->para.socket.ip.libwrapname:(char *)diag_get_string('p'));
 139    request_init(&ri, RQ_FILE, xfd->fd,
 140                 RQ_CLIENT_SIN, them,
 141                 RQ_SERVER_SIN, &us->soa,
 142                 RQ_DAEMON, xfd->para.socket.ip.libwrapname?xfd->para.socket.ip.libwrapname:(char *)diag_get_string('p'), 0);
 143    Debug("request_init() ->");
 144
 145    Debug1("sock_methods(%p)", &ri);
 146    sock_methods(&ri);
 147    Debug("sock_methods() ->");
 148
 149    Debug1("hosts_access(%p)", &ri);
 150    allow = hosts_access(&ri);
 151    Debug1("hosts_access() -> %d", allow);
 152
 153 #if defined(HAVE_HOSTS_ALLOW_TABLE)
 154    hosts_allow_table = save_hosts_allow_table;
 155 #endif
 156 #if defined(HAVE_HOSTS_DENY_TABLE)
 157    hosts_deny_table  = save_hosts_deny_table;
 158 #endif
 159    if (allow == 0) {
 160       return -1;
 161    }
 162    return 1;
 163 }
 164
 165 #endif /* (WITH_TCP || WITH_UDP) && WITH_LIBWRAP */
 166