source/lib/access.c

   1 /*
   2    This module is an adaption of code from the tcpd-1.4 package written
   3    by Wietse Venema, Eindhoven University of Technology, The Netherlands.
   4
   5    The code is used here with permission.
   6
   7    The code has been considerably changed from the original. Bug reports
   8    should be sent to samba@samba.org
   9
  10    Updated for IPv6 by Jeremy Allison (C) 2007.
  11 */
  12
  13 #include "includes.h"
  14
  15 #define NAME_INDEX 0
  16 #define ADDR_INDEX 1
  17
  18 /* masked_match - match address against netnumber/netmask */
  19 static bool masked_match(const char *tok, const char *slash, const char *s)
  20 {
  21         struct sockaddr_storage ss_mask;
  22         struct sockaddr_storage ss_tok;
  23         struct sockaddr_storage ss_host;
  24         char *tok_copy = NULL;
  25
  26         if (!interpret_string_addr(&ss_host, s, 0)) {
  27                 return false;
  28         }
  29
  30         if (*tok == '[') {
  31                 /* IPv6 address - remove braces. */
  32                 tok_copy = SMB_STRDUP(tok+1);
  33                 if (!tok_copy) {
  34                         return false;
  35                 }
  36                 /* Remove the terminating ']' */
  37                 tok_copy[PTR_DIFF(slash,tok)-1] = '\0';
  38         } else {
  39                 tok_copy = SMB_STRDUP(tok);
  40                 if (!tok_copy) {
  41                         return false;
  42                 }
  43                 /* Remove the terminating '/' */
  44                 tok_copy[PTR_DIFF(slash,tok)] = '\0';
  45         }
  46
  47         if (!interpret_string_addr(&ss_tok, tok_copy, 0)) {
  48                 SAFE_FREE(tok_copy);
  49                 return false;
  50         }
  51
  52         SAFE_FREE(tok_copy);
  53
  54         if (strlen(slash + 1) > 2) {
  55                 if (!interpret_string_addr(&ss_mask, slash+1, 0)) {
  56                         return false;
  57                 }
  58         } else {
  59                 char *endp = NULL;
  60                 unsigned long val = strtoul(slash+1, &endp, 0);
  61                 if (slash+1 == endp || (endp && *endp != '\0')) {
  62                         return false;
  63                 }
  64                 if (!make_netmask(&ss_mask, &ss_tok, val)) {
  65                         return false;
  66                 }
  67         }
  68
  69         return same_net(&ss_host, &ss_tok, &ss_mask);
  70 }
  71
  72 /* string_match - match string s against token tok */
  73 static bool string_match(const char *tok,const char *s)
  74 {
  75         size_t     tok_len;
  76         size_t     str_len;
  77         const char   *cut;
  78
  79         /* Return true if a token has the magic value "ALL". Return
  80          * true if the token is "FAIL". If the token starts with a "."
  81          * (domain name), return true if it matches the last fields of
  82          * the string. If the token has the magic value "LOCAL",
  83          * return true if the string does not contain a "."
  84          * character. If the token ends on a "." (network number),
  85          * return true if it matches the first fields of the
  86          * string. If the token begins with a "@" (netgroup name),
  87          * return true if the string is a (host) member of the
  88          * netgroup. Return true if the token fully matches the
  89          * string. If the token is a netnumber/netmask pair, return
  90          * true if the address is a member of the specified subnet.
  91          */
  92
  93         if (tok[0] == '.') {                    /* domain: match last fields */
  94                 if ((str_len = strlen(s)) > (tok_len = strlen(tok))
  95                     && strequal(tok, s + str_len - tok_len)) {
  96                         return true;
  97                 }
  98         } else if (tok[0] == '@') { /* netgroup: look it up */
  99 #ifdef  HAVE_NETGROUP
 100                 DATA_BLOB tmp;
 101                 char *mydomain = NULL;
 102                 char *hostname = NULL;
 103                 bool netgroup_ok = false;
 104
 105                 if (memcache_lookup(
 106                             NULL, SINGLETON_CACHE,
 107                             data_blob_string_const("yp_default_domain"),
 108                             &tmp)) {
 109
 110                         SMB_ASSERT(tmp.length > 0);
 111                         mydomain = (tmp.data[0] == '\0')
 112                                 ? NULL : (char *)tmp.data;
 113                 }
 114                 else {
 115                         yp_get_default_domain(&mydomain);
 116
 117                         memcache_add(
 118                                 NULL, SINGLETON_CACHE,
 119                                 data_blob_string_const("yp_default_domain"),
 120                                 data_blob_string_const(mydomain?mydomain:""));
 121                 }
 122
 123                 if (!mydomain) {
 124                         DEBUG(0,("Unable to get default yp domain. "
 125                                 "Try without it.\n"));
 126                 }
 127                 if (!(hostname = SMB_STRDUP(s))) {
 128                         DEBUG(1,("out of memory for strdup!\n"));
 129                         return false;
 130                 }
 131
 132                 netgroup_ok = innetgr(tok + 1, hostname, (char *) 0, mydomain);
 133
 134                 DEBUG(5,("looking for %s of domain %s in netgroup %s gave %s\n",
 135                          hostname,
 136                          mydomain?mydomain:"(ANY)",
 137                          tok+1,
 138                          BOOLSTR(netgroup_ok)));
 139
 140                 SAFE_FREE(hostname);
 141
 142                 if (netgroup_ok)
 143                         return true;
 144 #else
 145                 DEBUG(0,("access: netgroup support is not configured\n"));
 146                 return false;
 147 #endif
 148         } else if (strequal(tok, "ALL")) {      /* all: match any */
 149                 return true;
 150         } else if (strequal(tok, "FAIL")) {     /* fail: match any */
 151                 return true;
 152         } else if (strequal(tok, "LOCAL")) {    /* local: no dots */
 153                 if (strchr_m(s, '.') == 0 && !strequal(s, "unknown")) {
 154                         return true;
 155                 }
 156         } else if (strequal(tok, s)) {   /* match host name or address */
 157                 return true;
 158         } else if (tok[(tok_len = strlen(tok)) - 1] == '.') {   /* network */
 159                 if (strncmp(tok, s, tok_len) == 0) {
 160                         return true;
 161                 }
 162         } else if ((cut = strchr_m(tok, '/')) != 0) {   /* netnumber/netmask */
 163                 if ((isdigit(s[0]) && strchr_m(tok, '.') != NULL) ||
 164                         (tok[0] == '[' && cut > tok && cut[-1] == ']') ||
 165                         ((isxdigit(s[0]) || s[0] == ':') &&
 166                                 strchr_m(tok, ':') != NULL)) {
 167                         /* IPv4/netmask or
 168                          * [IPv6:addr]/netmask or IPv6:addr/netmask */
 169                         return masked_match(tok, cut, s);
 170                 }
 171         } else if (strchr_m(tok, '*') != 0 || strchr_m(tok, '?')) {
 172                 return unix_wild_match(tok, s);
 173         }
 174         return false;
 175 }
 176
 177 /* client_match - match host name and address against token */
 178 static bool client_match(const char *tok, const void *item)
 179 {
 180         const char **client = (const char **)item;
 181         bool match = false;
 182
 183         /*
 184          * Try to match the address first. If that fails, try to match the host
 185          * name if available.
 186          */
 187
 188         if ((match = string_match(tok, client[ADDR_INDEX])) == false) {
 189                 if (client[NAME_INDEX][0] != 0) {
 190                         match = string_match(tok, client[NAME_INDEX]);
 191                 }
 192         }
 193
 194         return match;
 195 }
 196
 197 /* list_match - match an item against a list of tokens with exceptions */
 198 static bool list_match(const char **list,const void *item,
 199                 bool (*match_fn)(const char *, const void *))
 200 {
 201         bool match = false;
 202
 203         if (!list) {
 204                 return false;
 205         }
 206
 207         /*
 208          * Process tokens one at a time. We have exhausted all possible matches
 209          * when we reach an "EXCEPT" token or the end of the list. If we do find
 210          * a match, look for an "EXCEPT" list and recurse to determine whether
 211          * the match is affected by any exceptions.
 212          */
 213
 214         for (; *list ; list++) {
 215                 if (strequal(*list, "EXCEPT")) {
 216                         /* EXCEPT: give up */
 217                         break;
 218                 }
 219                 if ((match = (*match_fn) (*list, item))) {
 220                         /* true or FAIL */
 221                         break;
 222                 }
 223         }
 224         /* Process exceptions to true or FAIL matches. */
 225
 226         if (match != false) {
 227                 while (*list  && !strequal(*list, "EXCEPT")) {
 228                         list++;
 229                 }
 230
 231                 for (; *list; list++) {
 232                         if ((*match_fn) (*list, item)) {
 233                                 /* Exception Found */
 234                                 return false;
 235                         }
 236                 }
 237         }
 238
 239         return match;
 240 }
 241
 242 /* return true if access should be allowed */
 243 static bool allow_access_internal(const char **deny_list,
 244                                 const char **allow_list,
 245                                 const char *cname,
 246                                 const char *caddr)
 247 {
 248         const char *client[2];
 249
 250         client[NAME_INDEX] = cname;
 251         client[ADDR_INDEX] = caddr;
 252
 253         /* if it is loopback then always allow unless specifically denied */
 254         if (strcmp(caddr, "127.0.0.1") == 0 || strcmp(caddr, "::1") == 0) {
 255                 /*
 256                  * If 127.0.0.1 matches both allow and deny then allow.
 257                  * Patch from Steve Langasek vorlon@netexpress.net.
 258                  */
 259                 if (deny_list &&
 260                         list_match(deny_list,client,client_match) &&
 261                                 (!allow_list ||
 262                                 !list_match(allow_list,client, client_match))) {
 263                         return false;
 264                 }
 265                 return true;
 266         }
 267
 268         /* if theres no deny list and no allow list then allow access */
 269         if ((!deny_list || *deny_list == 0) &&
 270             (!allow_list || *allow_list == 0)) {
 271                 return true;
 272         }
 273
 274         /* if there is an allow list but no deny list then allow only hosts
 275            on the allow list */
 276         if (!deny_list || *deny_list == 0) {
 277                 return(list_match(allow_list,client,client_match));
 278         }
 279
 280         /* if theres a deny list but no allow list then allow
 281            all hosts not on the deny list */
 282         if (!allow_list || *allow_list == 0) {
 283                 return(!list_match(deny_list,client,client_match));
 284         }
 285
 286         /* if there are both types of list then allow all hosts on the
 287            allow list */
 288         if (list_match(allow_list,(const char *)client,client_match)) {
 289                 return true;
 290         }
 291
 292         /* if there are both types of list and it's not on the allow then
 293            allow it if its not on the deny */
 294         if (list_match(deny_list,(const char *)client,client_match)) {
 295                 return false;
 296         }
 297
 298         return true;
 299 }
 300
 301 /* return true if access should be allowed */
 302 bool allow_access(const char **deny_list,
 303                 const char **allow_list,
 304                 const char *cname,
 305                 const char *caddr)
 306 {
 307         bool ret;
 308         char *nc_cname = smb_xstrdup(cname);
 309         char *nc_caddr = smb_xstrdup(caddr);
 310
 311         ret = allow_access_internal(deny_list, allow_list, nc_cname, nc_caddr);
 312
 313         SAFE_FREE(nc_cname);
 314         SAFE_FREE(nc_caddr);
 315         return ret;
 316 }
 317
 318 /* return true if the char* contains ip addrs only.  Used to avoid
 319 name lookup calls */
 320
 321 static bool only_ipaddrs_in_list(const char **list)
 322 {
 323         bool only_ip = true;
 324
 325         if (!list) {
 326                 return true;
 327         }
 328
 329         for (; *list ; list++) {
 330                 /* factor out the special strings */
 331                 if (strequal(*list, "ALL") || strequal(*list, "FAIL") ||
 332                     strequal(*list, "EXCEPT")) {
 333                         continue;
 334                 }
 335
 336                 if (!is_ipaddress(*list)) {
 337                         /*
 338                          * If we failed, make sure that it was not because
 339                          * the token was a network/netmask pair. Only
 340                          * network/netmask pairs have a '/' in them.
 341                          */
 342                         if ((strchr_m(*list, '/')) == NULL) {
 343                                 only_ip = false;
 344                                 DEBUG(3,("only_ipaddrs_in_list: list has "
 345                                         "non-ip address (%s)\n",
 346                                         *list));
 347                                 break;
 348                         }
 349                 }
 350         }
 351
 352         return only_ip;
 353 }
 354
 355 /* return true if access should be allowed to a service for a socket */
 356 bool check_access(int sock, const char **allow_list, const char **deny_list)
 357 {
 358         bool ret = false;
 359         bool only_ip = false;
 360
 361         if ((!deny_list || *deny_list==0) && (!allow_list || *allow_list==0))
 362                 ret = true;
 363
 364         if (!ret) {
 365                 char addr[INET6_ADDRSTRLEN];
 366
 367                 /* Bypass name resolution calls if the lists
 368                  * only contain IP addrs */
 369                 if (only_ipaddrs_in_list(allow_list) &&
 370                                 only_ipaddrs_in_list(deny_list)) {
 371                         only_ip = true;
 372                         DEBUG (3, ("check_access: no hostnames "
 373                                 "in host allow/deny list.\n"));
 374                         ret = allow_access(deny_list,
 375                                         allow_list,
 376                                         "",
 377                                         get_peer_addr(sock,addr,sizeof(addr)));
 378                 } else {
 379                         DEBUG (3, ("check_access: hostnames in "
 380                                 "host allow/deny list.\n"));
 381                         ret = allow_access(deny_list,
 382                                         allow_list,
 383                                         get_peer_name(sock,true),
 384                                         get_peer_addr(sock,addr,sizeof(addr)));
 385                 }
 386
 387                 if (ret) {
 388                         DEBUG(2,("Allowed connection from %s (%s)\n",
 389                                  only_ip ? "" : get_peer_name(sock,true),
 390                                  get_peer_addr(sock,addr,sizeof(addr))));
 391                 } else {
 392                         DEBUG(0,("Denied connection from %s (%s)\n",
 393                                  only_ip ? "" : get_peer_name(sock,true),
 394                                  get_peer_addr(sock,addr,sizeof(addr))));
 395                 }
 396         }
 397
 398         return(ret);
 399 }