lib/util/access.c

   1 /*
   2    This module is an adaption of code from the tcpd-1.4 package written
   3    by Wietse Venema, Eindhoven University of Technology, The Netherlands.
   4
   5    The code is used here with permission.
   6
   7    The code has been considerably changed from the original. Bug reports
   8    should be sent to samba-technical@lists.samba.org
   9
  10    Updated for IPv6 by Jeremy Allison (C) 2007.
  11 */
  12
  13 #include "replace.h"
  14 #include "system/locale.h"
  15 #include "lib/util/debug.h"
  16 #include "../lib/util/memcache.h"
  17 #include "lib/socket/interfaces.h"
  18 #include "lib/util/samba_util.h"
  19 #include "lib/util/util_net.h"
  20 #include "lib/util/samba_util.h"
  21 #include "lib/util/memory.h"
  22 #include "lib/util/access.h"
  23 #include "lib/util/unix_match.h"
  24
  25 #define NAME_INDEX 0
  26 #define ADDR_INDEX 1
  27
  28 /* masked_match - match address against netnumber/netmask */
  29 static bool masked_match(const char *tok, const char *slash, const char *s)
  30 {
  31         struct sockaddr_storage ss_mask;
  32         struct sockaddr_storage ss_tok;
  33         struct sockaddr_storage ss_host;
  34         char *tok_copy = NULL;
  35
  36         if (!interpret_string_addr(&ss_host, s, 0)) {
  37                 return false;
  38         }
  39
  40         if (*tok == '[') {
  41                 /* IPv6 address - remove braces. */
  42                 tok_copy = smb_xstrdup(tok+1);
  43                 if (!tok_copy) {
  44                         return false;
  45                 }
  46                 /* Remove the terminating ']' */
  47                 tok_copy[PTR_DIFF(slash,tok)-1] = '\0';
  48         } else {
  49                 tok_copy = smb_xstrdup(tok);
  50                 if (!tok_copy) {
  51                         return false;
  52                 }
  53                 /* Remove the terminating '/' */
  54                 tok_copy[PTR_DIFF(slash,tok)] = '\0';
  55         }
  56
  57         if (!interpret_string_addr(&ss_tok, tok_copy, 0)) {
  58                 SAFE_FREE(tok_copy);
  59                 return false;
  60         }
  61
  62         SAFE_FREE(tok_copy);
  63
  64         if (strlen(slash + 1) > 2) {
  65                 if (!interpret_string_addr(&ss_mask, slash+1, 0)) {
  66                         return false;
  67                 }
  68         } else {
  69                 char *endp = NULL;
  70                 unsigned long val = strtoul(slash+1, &endp, 0);
  71                 if (slash+1 == endp || (endp && *endp != '\0')) {
  72                         return false;
  73                 }
  74                 if (!make_netmask(&ss_mask, &ss_tok, val)) {
  75                         return false;
  76                 }
  77         }
  78
  79         return same_net((struct sockaddr *)(void *)&ss_host,
  80                         (struct sockaddr *)(void *)&ss_tok,
  81                         (struct sockaddr *)(void *)&ss_mask);
  82 }
  83
  84 /* string_match - match string s against token tok */
  85 static bool string_match(const char *tok,const char *s)
  86 {
  87         size_t     tok_len;
  88         size_t     str_len;
  89         const char   *cut;
  90
  91         /* Return true if a token has the magic value "ALL". Return
  92          * true if the token is "FAIL". If the token starts with a "."
  93          * (domain name), return true if it matches the last fields of
  94          * the string. If the token has the magic value "LOCAL",
  95          * return true if the string does not contain a "."
  96          * character. If the token ends on a "." (network number),
  97          * return true if it matches the first fields of the
  98          * string. If the token begins with a "@" (netgroup name),
  99          * return true if the string is a (host) member of the
 100          * netgroup. Return true if the token fully matches the
 101          * string. If the token is a netnumber/netmask pair, return
 102          * true if the address is a member of the specified subnet.
 103          */
 104
 105         if (tok[0] == '.') {                    /* domain: match last fields */
 106                 if ((str_len = strlen(s)) > (tok_len = strlen(tok))
 107                     && strequal_m(tok, s + str_len - tok_len)) {
 108                         return true;
 109                 }
 110         } else if (tok[0] == '@') { /* netgroup: look it up */
 111 #ifdef  HAVE_NETGROUP
 112                 DATA_BLOB tmp;
 113                 char *mydomain = NULL;
 114                 char *hostname = NULL;
 115                 bool netgroup_ok = false;
 116
 117                 if (memcache_lookup(
 118                             NULL, SINGLETON_CACHE,
 119                             data_blob_string_const_null("yp_default_domain"),
 120                             &tmp)) {
 121
 122                         SMB_ASSERT(tmp.length > 0);
 123                         mydomain = (tmp.data[0] == '\0')
 124                                 ? NULL : (char *)tmp.data;
 125                 }
 126                 else {
 127                         yp_get_default_domain(&mydomain);
 128
 129                         memcache_add(
 130                                 NULL, SINGLETON_CACHE,
 131                                 data_blob_string_const_null("yp_default_domain"),
 132                                 data_blob_string_const_null(mydomain?mydomain:""));
 133                 }
 134
 135                 if (!mydomain) {
 136                         DEBUG(0,("Unable to get default yp domain. "
 137                                 "Try without it.\n"));
 138                 }
 139                 if (!(hostname = smb_xstrdup(s))) {
 140                         DEBUG(1,("out of memory for strdup!\n"));
 141                         return false;
 142                 }
 143
 144                 netgroup_ok = innetgr(tok + 1, hostname, (char *) 0, mydomain);
 145
 146                 DEBUG(5,("looking for %s of domain %s in netgroup %s gave %s\n",
 147                          hostname,
 148                          mydomain?mydomain:"(ANY)",
 149                          tok+1,
 150                          BOOLSTR(netgroup_ok)));
 151
 152                 SAFE_FREE(hostname);
 153
 154                 if (netgroup_ok)
 155                         return true;
 156 #else
 157                 DEBUG(0,("access: netgroup support is not configured\n"));
 158                 return false;
 159 #endif
 160         } else if (strequal_m(tok, "ALL")) {    /* all: match any */
 161                 return true;
 162         } else if (strequal_m(tok, "FAIL")) {   /* fail: match any */
 163                 return true;
 164         } else if (strequal_m(tok, "LOCAL")) {  /* local: no dots */
 165                 if (strchr_m(s, '.') == 0 && !strequal_m(s, "unknown")) {
 166                         return true;
 167                 }
 168         } else if (strequal_m(tok, s)) {   /* match host name or address */
 169                 return true;
 170         } else if (tok[(tok_len = strlen(tok)) - 1] == '.') {   /* network */
 171                 if (strncmp(tok, s, tok_len) == 0) {
 172                         return true;
 173                 }
 174         } else if ((cut = strchr_m(tok, '/')) != 0) {   /* netnumber/netmask */
 175                 if ((isdigit(s[0]) && strchr_m(tok, '.') != NULL) ||
 176                         (tok[0] == '[' && cut > tok && cut[-1] == ']') ||
 177                         ((isxdigit(s[0]) || s[0] == ':') &&
 178                                 strchr_m(tok, ':') != NULL)) {
 179                         /* IPv4/netmask or
 180                          * [IPv6:addr]/netmask or IPv6:addr/netmask */
 181                         return masked_match(tok, cut, s);
 182                 }
 183         } else if (strchr_m(tok, '*') != 0 || strchr_m(tok, '?')) {
 184                 return unix_wild_match(tok, s);
 185         }
 186         return false;
 187 }
 188
 189 /* client_match - match host name and address against token */
 190 bool client_match(const char *tok, const void *item)
 191 {
 192         const char **client = discard_const_p(const char *, item);
 193         const char *tok_addr = tok;
 194         const char *cli_addr = client[ADDR_INDEX];
 195
 196         /*
 197          * tok and client[ADDR_INDEX] can be an IPv4 mapped to IPv6,
 198          * we try and match the IPv4 part of address only.
 199          * Bug #5311 and #7383.
 200          */
 201
 202         if (strncasecmp_m(tok_addr, "::ffff:", 7) == 0) {
 203                 tok_addr += 7;
 204         }
 205
 206         if (strncasecmp_m(cli_addr, "::ffff:", 7) == 0) {
 207                 cli_addr += 7;
 208         }
 209
 210         /*
 211          * Try to match the address first. If that fails, try to match the host
 212          * name if available.
 213          */
 214
 215         if (string_match(tok_addr, cli_addr)) {
 216                 return true;
 217         }
 218
 219         if (client[NAME_INDEX][0] != 0) {
 220                 if (string_match(tok, client[NAME_INDEX])) {
 221                         return true;
 222                 }
 223         }
 224
 225         return false;
 226 }
 227
 228 /* list_match - match an item against a list of tokens with exceptions */
 229 bool list_match(const char **list,const void *item,
 230                 bool (*match_fn)(const char *, const void *))
 231 {
 232         bool match = false;
 233
 234         if (!list) {
 235                 return false;
 236         }
 237
 238         /*
 239          * Process tokens one at a time. We have exhausted all possible matches
 240          * when we reach an "EXCEPT" token or the end of the list. If we do find
 241          * a match, look for an "EXCEPT" list and recurse to determine whether
 242          * the match is affected by any exceptions.
 243          */
 244
 245         for (; *list ; list++) {
 246                 if (strequal_m(*list, "EXCEPT")) {
 247                         /* EXCEPT: give up */
 248                         break;
 249                 }
 250                 if ((match = (*match_fn) (*list, item))) {
 251                         /* true or FAIL */
 252                         break;
 253                 }
 254         }
 255         /* Process exceptions to true or FAIL matches. */
 256
 257         if (match != false) {
 258                 while (*list  && !strequal_m(*list, "EXCEPT")) {
 259                         list++;
 260                 }
 261
 262                 for (; *list; list++) {
 263                         if ((*match_fn) (*list, item)) {
 264                                 /* Exception Found */
 265                                 return false;
 266                         }
 267                 }
 268         }
 269
 270         return match;
 271 }
 272
 273 /* return true if access should be allowed */
 274 static bool allow_access_internal(const char **deny_list,
 275                                 const char **allow_list,
 276                                 const char *cname,
 277                                 const char *caddr)
 278 {
 279         const char *client[2];
 280
 281         client[NAME_INDEX] = cname;
 282         client[ADDR_INDEX] = caddr;
 283
 284         /* if it is loopback then always allow unless specifically denied */
 285         if (strcmp(caddr, "127.0.0.1") == 0 || strcmp(caddr, "::1") == 0) {
 286                 /*
 287                  * If 127.0.0.1 matches both allow and deny then allow.
 288                  * Patch from Steve Langasek vorlon@netexpress.net.
 289                  */
 290                 if (deny_list &&
 291                         list_match(deny_list,client,client_match) &&
 292                                 (!allow_list ||
 293                                 !list_match(allow_list,client, client_match))) {
 294                         return false;
 295                 }
 296                 return true;
 297         }
 298
 299         /* if theres no deny list and no allow list then allow access */
 300         if ((!deny_list || *deny_list == 0) &&
 301             (!allow_list || *allow_list == 0)) {
 302                 return true;
 303         }
 304
 305         /* if there is an allow list but no deny list then allow only hosts
 306            on the allow list */
 307         if (!deny_list || *deny_list == 0) {
 308                 return(list_match(allow_list,client,client_match));
 309         }
 310
 311         /* if theres a deny list but no allow list then allow
 312            all hosts not on the deny list */
 313         if (!allow_list || *allow_list == 0) {
 314                 return(!list_match(deny_list,client,client_match));
 315         }
 316
 317         /* if there are both types of list then allow all hosts on the
 318            allow list */
 319         if (list_match(allow_list,(const char *)client,client_match)) {
 320                 return true;
 321         }
 322
 323         /* if there are both types of list and it's not on the allow then
 324            allow it if its not on the deny */
 325         if (list_match(deny_list,(const char *)client,client_match)) {
 326                 return false;
 327         }
 328
 329         return true;
 330 }
 331
 332 /* return true if access should be allowed - doesn't print log message */
 333 bool allow_access_nolog(const char **deny_list,
 334                 const char **allow_list,
 335                 const char *cname,
 336                 const char *caddr)
 337 {
 338         bool ret;
 339         char *nc_cname = smb_xstrdup(cname);
 340         char *nc_caddr = smb_xstrdup(caddr);
 341
 342         ret = allow_access_internal(deny_list, allow_list, nc_cname, nc_caddr);
 343
 344         SAFE_FREE(nc_cname);
 345         SAFE_FREE(nc_caddr);
 346         return ret;
 347 }
 348
 349 /* return true if access should be allowed - prints log message */
 350 bool allow_access(const char **deny_list,
 351                 const char **allow_list,
 352                 const char *cname,
 353                 const char *caddr)
 354 {
 355         bool ret;
 356
 357         ret = allow_access_nolog(deny_list, allow_list, cname, caddr);
 358
 359         DEBUG(ret ? 3 : 0,
 360               ("%s connection from %s (%s)\n",
 361                ret ? "Allowed" : "Denied", cname, caddr));
 362
 363         return ret;
 364 }