lib/util/access.c

   1 /*
   2    This module is an adaption of code from the tcpd-1.4 package written
   3    by Wietse Venema, Eindhoven University of Technology, The Netherlands.
   4
   5    The code is used here with permission.
   6
   7    The code has been considerably changed from the original. Bug reports
   8    should be sent to samba-technical@lists.samba.org
   9
  10    Updated for IPv6 by Jeremy Allison (C) 2007.
  11 */
  12
  13 #include "replace.h"
  14 #include "system/locale.h"
  15 #include "lib/util/debug.h"
  16 #include "../lib/util/memcache.h"
  17 #include "lib/socket/interfaces.h"
  18 #include "lib/util/samba_util.h"
  19 #include "lib/util/util_net.h"
  20 #include "lib/util/samba_util.h"
  21 #include "lib/util/memory.h"
  22 #include "lib/util/access.h"
  23 #include "lib/util/unix_match.h"
  24
  25 #if defined(HAVE_NETGROUP)
  26 #include "system/nis.h"
  27 #endif
  28
  29 #define NAME_INDEX 0
  30 #define ADDR_INDEX 1
  31
  32 /* masked_match - match address against netnumber/netmask */
  33 static bool masked_match(const char *tok, const char *slash, const char *s)
  34 {
  35         struct sockaddr_storage ss_mask;
  36         struct sockaddr_storage ss_tok;
  37         struct sockaddr_storage ss_host;
  38         char *tok_copy = NULL;
  39
  40         if (!interpret_string_addr(&ss_host, s, 0)) {
  41                 return false;
  42         }
  43
  44         if (*tok == '[') {
  45                 /* IPv6 address - remove braces. */
  46                 tok_copy = smb_xstrdup(tok+1);
  47                 if (!tok_copy) {
  48                         return false;
  49                 }
  50                 /* Remove the terminating ']' */
  51                 tok_copy[PTR_DIFF(slash,tok)-1] = '\0';
  52         } else {
  53                 tok_copy = smb_xstrdup(tok);
  54                 if (!tok_copy) {
  55                         return false;
  56                 }
  57                 /* Remove the terminating '/' */
  58                 tok_copy[PTR_DIFF(slash,tok)] = '\0';
  59         }
  60
  61         if (!interpret_string_addr(&ss_tok, tok_copy, 0)) {
  62                 SAFE_FREE(tok_copy);
  63                 return false;
  64         }
  65
  66         SAFE_FREE(tok_copy);
  67
  68         if (strlen(slash + 1) > 2) {
  69                 if (!interpret_string_addr(&ss_mask, slash+1, 0)) {
  70                         return false;
  71                 }
  72         } else {
  73                 char *endp = NULL;
  74                 unsigned long val = strtoul(slash+1, &endp, 0);
  75                 if (slash+1 == endp || (endp && *endp != '\0')) {
  76                         return false;
  77                 }
  78                 if (!make_netmask(&ss_mask, &ss_tok, val)) {
  79                         return false;
  80                 }
  81         }
  82
  83         return same_net((struct sockaddr *)(void *)&ss_host,
  84                         (struct sockaddr *)(void *)&ss_tok,
  85                         (struct sockaddr *)(void *)&ss_mask);
  86 }
  87
  88 /* string_match - match string s against token tok */
  89 static bool string_match(const char *tok,const char *s)
  90 {
  91         size_t     tok_len;
  92         size_t     str_len;
  93         const char   *cut;
  94
  95         /* Return true if a token has the magic value "ALL". Return
  96          * true if the token is "FAIL". If the token starts with a "."
  97          * (domain name), return true if it matches the last fields of
  98          * the string. If the token has the magic value "LOCAL",
  99          * return true if the string does not contain a "."
 100          * character. If the token ends on a "." (network number),
 101          * return true if it matches the first fields of the
 102          * string. If the token begins with a "@" (netgroup name),
 103          * return true if the string is a (host) member of the
 104          * netgroup. Return true if the token fully matches the
 105          * string. If the token is a netnumber/netmask pair, return
 106          * true if the address is a member of the specified subnet.
 107          */
 108
 109         if (tok[0] == '.') {                    /* domain: match last fields */
 110                 if ((str_len = strlen(s)) > (tok_len = strlen(tok))
 111                     && strequal_m(tok, s + str_len - tok_len)) {
 112                         return true;
 113                 }
 114         } else if (tok[0] == '@') { /* netgroup: look it up */
 115 #ifdef  HAVE_NETGROUP
 116                 DATA_BLOB tmp;
 117                 char *mydomain = NULL;
 118                 char *hostname = NULL;
 119                 bool netgroup_ok = false;
 120
 121                 if (memcache_lookup(
 122                             NULL, SINGLETON_CACHE,
 123                             data_blob_string_const_null("yp_default_domain"),
 124                             &tmp)) {
 125
 126                         SMB_ASSERT(tmp.length > 0);
 127                         mydomain = (tmp.data[0] == '\0')
 128                                 ? NULL : (char *)tmp.data;
 129                 }
 130                 else {
 131                         yp_get_default_domain(&mydomain);
 132
 133                         memcache_add(
 134                                 NULL, SINGLETON_CACHE,
 135                                 data_blob_string_const_null("yp_default_domain"),
 136                                 data_blob_string_const_null(mydomain?mydomain:""));
 137                 }
 138
 139                 if (!mydomain) {
 140                         DEBUG(0,("Unable to get default yp domain. "
 141                                 "Try without it.\n"));
 142                 }
 143                 if (!(hostname = smb_xstrdup(s))) {
 144                         DEBUG(1,("out of memory for strdup!\n"));
 145                         return false;
 146                 }
 147
 148                 netgroup_ok = innetgr(tok + 1, hostname, (char *) 0, mydomain);
 149
 150                 DBG_INFO("%s %s of domain %s in netgroup %s\n",
 151                          netgroup_ok ? "Found" : "Could not find",
 152                          hostname,
 153                          mydomain?mydomain:"(ANY)",
 154                          tok+1);
 155
 156                 SAFE_FREE(hostname);
 157
 158                 if (netgroup_ok)
 159                         return true;
 160 #else
 161                 DEBUG(0,("access: netgroup support is not configured\n"));
 162                 return false;
 163 #endif
 164         } else if (strequal_m(tok, "ALL")) {    /* all: match any */
 165                 return true;
 166         } else if (strequal_m(tok, "FAIL")) {   /* fail: match any */
 167                 return true;
 168         } else if (strequal_m(tok, "LOCAL")) {  /* local: no dots */
 169                 if (strchr_m(s, '.') == 0 && !strequal_m(s, "unknown")) {
 170                         return true;
 171                 }
 172         } else if (strequal_m(tok, s)) {   /* match host name or address */
 173                 return true;
 174         } else if (tok[(tok_len = strlen(tok)) - 1] == '.') {   /* network */
 175                 if (strncmp(tok, s, tok_len) == 0) {
 176                         return true;
 177                 }
 178         } else if ((cut = strchr_m(tok, '/')) != 0) {   /* netnumber/netmask */
 179                 if ((isdigit(s[0]) && strchr_m(tok, '.') != NULL) ||
 180                         (tok[0] == '[' && cut > tok && cut[-1] == ']') ||
 181                         ((isxdigit(s[0]) || s[0] == ':') &&
 182                                 strchr_m(tok, ':') != NULL)) {
 183                         /* IPv4/netmask or
 184                          * [IPv6:addr]/netmask or IPv6:addr/netmask */
 185                         return masked_match(tok, cut, s);
 186                 }
 187         } else if (strchr_m(tok, '*') != 0 || strchr_m(tok, '?')) {
 188                 return unix_wild_match(tok, s);
 189         }
 190         return false;
 191 }
 192
 193 /* client_match - match host name and address against token */
 194 bool client_match(const char *tok, const void *item)
 195 {
 196         const char **client = discard_const_p(const char *, item);
 197         const char *tok_addr = tok;
 198         const char *cli_addr = client[ADDR_INDEX];
 199
 200         /*
 201          * tok and client[ADDR_INDEX] can be an IPv4 mapped to IPv6,
 202          * we try and match the IPv4 part of address only.
 203          * Bug #5311 and #7383.
 204          */
 205
 206         if (strncasecmp_m(tok_addr, "::ffff:", 7) == 0) {
 207                 tok_addr += 7;
 208         }
 209
 210         if (strncasecmp_m(cli_addr, "::ffff:", 7) == 0) {
 211                 cli_addr += 7;
 212         }
 213
 214         /*
 215          * Try to match the address first. If that fails, try to match the host
 216          * name if available.
 217          */
 218
 219         if (string_match(tok_addr, cli_addr)) {
 220                 return true;
 221         }
 222
 223         if (client[NAME_INDEX][0] != 0) {
 224                 if (string_match(tok, client[NAME_INDEX])) {
 225                         return true;
 226                 }
 227         }
 228
 229         return false;
 230 }
 231
 232 /* list_match - match an item against a list of tokens with exceptions */
 233 bool list_match(const char **list,const void *item,
 234                 bool (*match_fn)(const char *, const void *))
 235 {
 236         bool match = false;
 237
 238         if (!list) {
 239                 return false;
 240         }
 241
 242         /*
 243          * Process tokens one at a time. We have exhausted all possible matches
 244          * when we reach an "EXCEPT" token or the end of the list. If we do find
 245          * a match, look for an "EXCEPT" list and recurse to determine whether
 246          * the match is affected by any exceptions.
 247          */
 248
 249         for (; *list ; list++) {
 250                 if (strequal_m(*list, "EXCEPT")) {
 251                         /* EXCEPT: give up */
 252                         break;
 253                 }
 254                 if ((match = (*match_fn) (*list, item))) {
 255                         /* true or FAIL */
 256                         break;
 257                 }
 258         }
 259         /* Process exceptions to true or FAIL matches. */
 260
 261         if (match != false) {
 262                 while (*list  && !strequal_m(*list, "EXCEPT")) {
 263                         list++;
 264                 }
 265
 266                 for (; *list; list++) {
 267                         if ((*match_fn) (*list, item)) {
 268                                 /* Exception Found */
 269                                 return false;
 270                         }
 271                 }
 272         }
 273
 274         return match;
 275 }
 276
 277 /* return true if access should be allowed */
 278 static bool allow_access_internal(const char **deny_list,
 279                                 const char **allow_list,
 280                                 const char *cname,
 281                                 const char *caddr)
 282 {
 283         const char *client[2];
 284
 285         client[NAME_INDEX] = cname;
 286         client[ADDR_INDEX] = caddr;
 287
 288         /* if it is loopback then always allow unless specifically denied */
 289         if (strcmp(caddr, "127.0.0.1") == 0 || strcmp(caddr, "::1") == 0) {
 290                 /*
 291                  * If 127.0.0.1 matches both allow and deny then allow.
 292                  * Patch from Steve Langasek vorlon@netexpress.net.
 293                  */
 294                 if (deny_list &&
 295                         list_match(deny_list,client,client_match) &&
 296                                 (!allow_list ||
 297                                 !list_match(allow_list,client, client_match))) {
 298                         return false;
 299                 }
 300                 return true;
 301         }
 302
 303         /* if theres no deny list and no allow list then allow access */
 304         if ((!deny_list || *deny_list == 0) &&
 305             (!allow_list || *allow_list == 0)) {
 306                 return true;
 307         }
 308
 309         /* if there is an allow list but no deny list then allow only hosts
 310            on the allow list */
 311         if (!deny_list || *deny_list == 0) {
 312                 return(list_match(allow_list,client,client_match));
 313         }
 314
 315         /* if theres a deny list but no allow list then allow
 316            all hosts not on the deny list */
 317         if (!allow_list || *allow_list == 0) {
 318                 return(!list_match(deny_list,client,client_match));
 319         }
 320
 321         /* if there are both types of list then allow all hosts on the
 322            allow list */
 323         if (list_match(allow_list,(const char *)client,client_match)) {
 324                 return true;
 325         }
 326
 327         /* if there are both types of list and it's not on the allow then
 328            allow it if its not on the deny */
 329         if (list_match(deny_list,(const char *)client,client_match)) {
 330                 return false;
 331         }
 332
 333         return true;
 334 }
 335
 336 /* return true if access should be allowed - doesn't print log message */
 337 bool allow_access_nolog(const char **deny_list,
 338                 const char **allow_list,
 339                 const char *cname,
 340                 const char *caddr)
 341 {
 342         bool ret;
 343         char *nc_cname = smb_xstrdup(cname);
 344         char *nc_caddr = smb_xstrdup(caddr);
 345
 346         ret = allow_access_internal(deny_list, allow_list, nc_cname, nc_caddr);
 347
 348         SAFE_FREE(nc_cname);
 349         SAFE_FREE(nc_caddr);
 350         return ret;
 351 }
 352
 353 /* return true if access should be allowed - prints log message */
 354 bool allow_access(const char **deny_list,
 355                 const char **allow_list,
 356                 const char *cname,
 357                 const char *caddr)
 358 {
 359         bool ret;
 360
 361         ret = allow_access_nolog(deny_list, allow_list, cname, caddr);
 362
 363         DEBUG(ret ? 3 : 0,
 364               ("%s connection from %s (%s)\n",
 365                ret ? "Allowed" : "Denied", cname, caddr));
 366
 367         return ret;
 368 }