1 /* $OpenBSD: addrmatch.c,v 1.13 2016/09/21 16:55:42 djm Exp $ */
4 * Copyright (c) 2004-2008 Damien Miller <djm@mindrot.org>
6 * Permission to use, copy, modify, and distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21 #include <sys/types.h>
22 #include <sys/socket.h>
23 #include <netinet/in.h>
24 #include <arpa/inet.h>
42 } xa
; /* 128-bit address */
43 u_int32_t scope_id
; /* iface scope id for v6 */
46 #define addr8 xa.addr8
47 #define addr32 xa.addr32
51 addr_unicast_masklen(int af
)
64 masklen_valid(int af
, u_int masklen
)
68 return masklen
<= 32 ? 0 : -1;
70 return masklen
<= 128 ? 0 : -1;
77 * Convert struct sockaddr to struct xaddr
78 * Returns 0 on success, -1 on failure.
81 addr_sa_to_xaddr(struct sockaddr
*sa
, socklen_t slen
, struct xaddr
*xa
)
83 struct sockaddr_in
*in4
= (struct sockaddr_in
*)sa
;
84 struct sockaddr_in6
*in6
= (struct sockaddr_in6
*)sa
;
86 memset(xa
, '\0', sizeof(*xa
));
88 switch (sa
->sa_family
) {
90 if (slen
< (socklen_t
)sizeof(*in4
))
93 memcpy(&xa
->v4
, &in4
->sin_addr
, sizeof(xa
->v4
));
96 if (slen
< (socklen_t
)sizeof(*in6
))
99 memcpy(&xa
->v6
, &in6
->sin6_addr
, sizeof(xa
->v6
));
100 #ifdef HAVE_STRUCT_SOCKADDR_IN6_SIN6_SCOPE_ID
101 xa
->scope_id
= in6
->sin6_scope_id
;
112 * Calculate a netmask of length 'l' for address family 'af' and
114 * Returns 0 on success, -1 on failure.
117 addr_netmask(int af
, u_int l
, struct xaddr
*n
)
121 if (masklen_valid(af
, l
) != 0 || n
== NULL
)
124 memset(n
, '\0', sizeof(*n
));
130 n
->v4
.s_addr
= htonl((0xffffffff << (32 - l
)) & 0xffffffff);
134 for (i
= 0; i
< 4 && l
>= 32; i
++, l
-= 32)
135 n
->addr32
[i
] = 0xffffffffU
;
137 n
->addr32
[i
] = htonl((0xffffffff << (32 - l
)) &
146 * Perform logical AND of addresses 'a' and 'b', storing result in 'dst'.
147 * Returns 0 on success, -1 on failure.
150 addr_and(struct xaddr
*dst
, const struct xaddr
*a
, const struct xaddr
*b
)
154 if (dst
== NULL
|| a
== NULL
|| b
== NULL
|| a
->af
!= b
->af
)
157 memcpy(dst
, a
, sizeof(*dst
));
160 dst
->v4
.s_addr
&= b
->v4
.s_addr
;
163 dst
->scope_id
= a
->scope_id
;
164 for (i
= 0; i
< 4; i
++)
165 dst
->addr32
[i
] &= b
->addr32
[i
];
173 * Compare addresses 'a' and 'b'
174 * Return 0 if addresses are identical, -1 if (a < b) or 1 if (a > b)
177 addr_cmp(const struct xaddr
*a
, const struct xaddr
*b
)
182 return a
->af
== AF_INET6
? 1 : -1;
186 if (a
->v4
.s_addr
== b
->v4
.s_addr
)
188 return ntohl(a
->v4
.s_addr
) > ntohl(b
->v4
.s_addr
) ? 1 : -1;
190 for (i
= 0; i
< 16; i
++)
191 if (a
->addr8
[i
] - b
->addr8
[i
] != 0)
192 return a
->addr8
[i
] > b
->addr8
[i
] ? 1 : -1;
193 if (a
->scope_id
== b
->scope_id
)
195 return a
->scope_id
> b
->scope_id
? 1 : -1;
202 * Parse string address 'p' into 'n'
203 * Returns 0 on success, -1 on failure.
206 addr_pton(const char *p
, struct xaddr
*n
)
208 struct addrinfo hints
, *ai
;
210 memset(&hints
, '\0', sizeof(hints
));
211 hints
.ai_flags
= AI_NUMERICHOST
;
213 if (p
== NULL
|| getaddrinfo(p
, NULL
, &hints
, &ai
) != 0)
216 if (ai
== NULL
|| ai
->ai_addr
== NULL
)
220 addr_sa_to_xaddr(ai
->ai_addr
, ai
->ai_addrlen
, n
) == -1) {
230 * Perform bitwise negation of address
231 * Returns 0 on success, -1 on failure.
234 addr_invert(struct xaddr
*n
)
243 n
->v4
.s_addr
= ~n
->v4
.s_addr
;
246 for (i
= 0; i
< 4; i
++)
247 n
->addr32
[i
] = ~n
->addr32
[i
];
255 * Calculate a netmask of length 'l' for address family 'af' and
257 * Returns 0 on success, -1 on failure.
260 addr_hostmask(int af
, u_int l
, struct xaddr
*n
)
262 if (addr_netmask(af
, l
, n
) == -1 || addr_invert(n
) == -1)
268 * Test whether address 'a' is all zeros (i.e. 0.0.0.0 or ::)
269 * Returns 0 on if address is all-zeros, -1 if not all zeros or on failure.
272 addr_is_all0s(const struct xaddr
*a
)
278 return (a
->v4
.s_addr
== 0 ? 0 : -1);
280 for (i
= 0; i
< 4; i
++)
281 if (a
->addr32
[i
] != 0)
290 * Test whether host portion of address 'a', as determined by 'masklen'
292 * Returns 0 on if host portion of address is all-zeros,
293 * -1 if not all zeros or on failure.
296 addr_host_is_all0s(const struct xaddr
*a
, u_int masklen
)
298 struct xaddr tmp_addr
, tmp_mask
, tmp_result
;
300 memcpy(&tmp_addr
, a
, sizeof(tmp_addr
));
301 if (addr_hostmask(a
->af
, masklen
, &tmp_mask
) == -1)
303 if (addr_and(&tmp_result
, &tmp_addr
, &tmp_mask
) == -1)
305 return (addr_is_all0s(&tmp_result
));
309 * Parse a CIDR address (x.x.x.x/y or xxxx:yyyy::/z).
310 * Return -1 on parse error, -2 on inconsistency or 0 on success.
313 addr_pton_cidr(const char *p
, struct xaddr
*n
, u_int
*l
)
316 long unsigned int masklen
= 999;
317 char addrbuf
[64], *mp
, *cp
;
319 /* Don't modify argument */
320 if (p
== NULL
|| strlcpy(addrbuf
, p
, sizeof(addrbuf
)) >= sizeof(addrbuf
))
323 if ((mp
= strchr(addrbuf
, '/')) != NULL
) {
326 masklen
= strtoul(mp
, &cp
, 10);
327 if (*mp
== '\0' || *cp
!= '\0' || masklen
> 128)
331 if (addr_pton(addrbuf
, &tmp
) == -1)
335 masklen
= addr_unicast_masklen(tmp
.af
);
336 if (masklen_valid(tmp
.af
, masklen
) == -1)
338 if (addr_host_is_all0s(&tmp
, masklen
) != 0)
342 memcpy(n
, &tmp
, sizeof(*n
));
350 addr_netmatch(const struct xaddr
*host
, const struct xaddr
*net
, u_int masklen
)
352 struct xaddr tmp_mask
, tmp_result
;
354 if (host
->af
!= net
->af
)
357 if (addr_netmask(host
->af
, masklen
, &tmp_mask
) == -1)
359 if (addr_and(&tmp_result
, host
, &tmp_mask
) == -1)
361 return addr_cmp(&tmp_result
, net
);
365 * Match "addr" against list pattern list "_list", which may contain a
366 * mix of CIDR addresses and old-school wildcards.
368 * If addr is NULL, then no matching is performed, but _list is parsed
369 * and checked for well-formedness.
371 * Returns 1 on match found (never returned when addr == NULL).
372 * Returns 0 on if no match found, or no errors found when addr == NULL.
373 * Returns -1 on negated match found (never returned when addr == NULL).
374 * Returns -2 on invalid list entry.
377 addr_match_list(const char *addr
, const char *_list
)
380 struct xaddr try_addr
, match_addr
;
384 if (addr
!= NULL
&& addr_pton(addr
, &try_addr
) != 0) {
385 debug2("%s: couldn't parse address %.100s", __func__
, addr
);
388 if ((o
= list
= strdup(_list
)) == NULL
)
390 while ((cp
= strsep(&list
, ",")) != NULL
) {
398 /* Prefer CIDR address matching */
399 r
= addr_pton_cidr(cp
, &match_addr
, &masklen
);
401 debug2("%s: inconsistent mask length for "
402 "match network \"%.100s\"", __func__
, cp
);
406 if (addr
!= NULL
&& addr_netmatch(&try_addr
,
407 &match_addr
, masklen
) == 0) {
417 /* If CIDR parse failed, try wildcard string match */
418 if (addr
!= NULL
&& match_pattern(addr
, cp
) == 1)
428 * Match "addr" against list CIDR list "_list". Lexical wildcards and
429 * negation are not supported. If "addr" == NULL, will verify structure
432 * Returns 1 on match found (never returned when addr == NULL).
433 * Returns 0 on if no match found, or no errors found when addr == NULL.
434 * Returns -1 on error
437 addr_match_cidr_list(const char *addr
, const char *_list
)
440 struct xaddr try_addr
, match_addr
;
444 if (addr
!= NULL
&& addr_pton(addr
, &try_addr
) != 0) {
445 debug2("%s: couldn't parse address %.100s", __func__
, addr
);
448 if ((o
= list
= strdup(_list
)) == NULL
)
450 while ((cp
= strsep(&list
, ",")) != NULL
) {
452 error("%s: empty entry in list \"%.100s\"",
459 * NB. This function is called in pre-auth with untrusted data,
460 * so be extra paranoid about junk reaching getaddrino (via
464 /* Stop junk from reaching getaddrinfo. +3 is for masklen */
465 if (strlen(cp
) > INET6_ADDRSTRLEN
+ 3) {
466 error("%s: list entry \"%.100s\" too long",
471 #define VALID_CIDR_CHARS "0123456789abcdefABCDEF.:/"
472 if (strspn(cp
, VALID_CIDR_CHARS
) != strlen(cp
)) {
473 error("%s: list entry \"%.100s\" contains invalid "
474 "characters", __func__
, cp
);
478 /* Prefer CIDR address matching */
479 r
= addr_pton_cidr(cp
, &match_addr
, &masklen
);
481 error("Invalid network entry \"%.100s\"", cp
);
484 } else if (r
== -2) {
485 error("Inconsistent mask length for "
486 "network \"%.100s\"", cp
);
489 } else if (r
== 0 && addr
!= NULL
) {
490 if (addr_netmatch(&try_addr
, &match_addr
,