2 * Copyright (c) 1996 by
3 * David Nugent <davidn@blaze.net.au>
6 * Redistribution and use in source and binary forms, with or without
7 * modification, is permitted provided that the following conditions
9 * 1. Redistributions of source code must retain the above copyright
10 * notice immediately at the beginning of the file, without modification,
11 * this list of conditions, and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. This work was done expressly for inclusion into FreeBSD. Other use
16 * is permitted provided this notation is included.
17 * 4. Absolutely no warranty of function or purpose is made by the authors.
18 * 5. Modifications may be freely made to this file providing the above
21 * Support allow/deny lists in login class capabilities
23 * $FreeBSD: head/lib/libutil/login_ok.c 154414 2006-01-16 00:28:11Z rwatson $
26 #include <sys/types.h>
28 #include <sys/resource.h>
29 #include <sys/param.h>
32 #include <login_cap.h>
39 /* -- support functions -- */
43 * This function is intentionally public - reused by TAS.
44 * Returns TRUE (non-zero) if a string matches a pattern
45 * in a given array of patterns. 'flags' is passed directly
50 login_strinlist(const char **list
, char const *str
, int flags
)
54 if (str
!= NULL
&& *str
!= '\0') {
57 while (rc
== 0 && list
[i
] != NULL
)
58 rc
= fnmatch(list
[i
++], str
, flags
) == 0;
66 * Locate either or two strings in a given list
70 login_str2inlist(const char **ttlst
, const char *str1
, const char *str2
, int flags
)
74 if (login_strinlist(ttlst
, str1
, flags
))
76 else if (login_strinlist(ttlst
, str2
, flags
))
84 * This function is intentionally public - reused by TAS.
85 * Returns an allocated list of time periods given an array
86 * of time periods in ascii form.
90 login_timelist(login_cap_t
*lc
, char const *cap
, int *ltno
,
94 struct login_time
*lt
= NULL
;
97 if ((tl
= login_getcaplist(lc
, cap
, NULL
)) != NULL
) {
99 while (tl
[j
++] != NULL
)
103 else if ((lt
= realloc(*ltptr
, j
* sizeof(struct login_time
))) != NULL
) {
110 for (--j
; i
< j
; i
++)
111 lt
[i
] = parse_lt(tl
[i
]);
112 lt
[i
].lt_dow
= LTM_NONE
;
121 * This function is a variation of auth_ttyok(), but it checks two
122 * arbitrary capability lists not necessarily related to access.
123 * This hook is provided for the accounted/exclude accounting lists.
127 login_ttyok(login_cap_t
*lc
, const char *tty
, const char *allowcap
,
132 if (lc
!= NULL
&& tty
!= NULL
&& *tty
!= '\0') {
137 te
= getttynam(tty
); /* Need group name */
138 grp
= te
? te
->ty_group
: NULL
;
139 ttl
= login_getcaplist(lc
, allowcap
, NULL
);
141 if (ttl
!= NULL
&& !login_str2inlist(ttl
, tty
, grp
, 0))
142 rc
= 0; /* tty or ttygroup not in allow list */
145 ttl
= login_getcaplist(lc
, denycap
, NULL
);
146 if (ttl
!= NULL
&& login_str2inlist(ttl
, tty
, grp
, 0))
147 rc
= 0; /* tty or ttygroup in deny list */
157 * Determine whether or not login on a tty is accessible for
162 auth_ttyok(login_cap_t
*lc
, const char * tty
)
164 return login_ttyok(lc
, tty
, "ttys.allow", "ttys.deny");
170 * This function is a variation of auth_hostok(), but it checks two
171 * arbitrary capability lists not necessarily related to access.
172 * This hook is provided for the accounted/exclude accounting lists.
176 login_hostok(login_cap_t
*lc
, const char *host
, const char *ip
,
177 const char *allowcap
, const char *denycap
)
179 int rc
= 1; /* Default is ok */
182 ((host
!= NULL
&& *host
!= '\0') || (ip
!= NULL
&& *ip
!= '\0'))) {
185 hl
= login_getcaplist(lc
, allowcap
, NULL
);
186 if (hl
!= NULL
&& !login_str2inlist(hl
, host
, ip
, FNM_CASEFOLD
))
187 rc
= 0; /* host or IP not in allow list */
190 hl
= login_getcaplist(lc
, denycap
, NULL
);
191 if (hl
!= NULL
&& login_str2inlist(hl
, host
, ip
, FNM_CASEFOLD
))
192 rc
= 0; /* host or IP in deny list */
202 * Determine whether or not login from a host is ok
206 auth_hostok(login_cap_t
*lc
, const char *host
, const char *ip
)
208 return login_hostok(lc
, host
, ip
, "host.allow", "host.deny");
214 * Determine whether or not login is ok at a given time
218 auth_timeok(login_cap_t
*lc
, time_t t
)
220 int rc
= 1; /* Default is ok */
222 if (lc
!= NULL
&& t
!= (time_t)0 && t
!= (time_t)-1) {
225 static int ltimesno
= 0;
226 static struct login_time
*ltimes
= NULL
;
228 if ((tptr
= localtime(&t
)) != NULL
) {
229 struct login_time
*lt
;
231 lt
= login_timelist(lc
, "times.allow", <imesno
, <imes
);
232 if (lt
!= NULL
&& in_ltms(lt
, tptr
, NULL
) == -1)
233 rc
= 0; /* not in allowed times list */
236 lt
= login_timelist(lc
, "times.deny", <imesno
, <imes
);
237 if (lt
!= NULL
&& in_ltms(lt
, tptr
, NULL
) != -1)
238 rc
= 0; /* in deny times list */