src/mod_access.c

   1 #include "first.h"
   2
   3 #include "base.h"
   4 #include "log.h"
   5 #include "buffer.h"
   6
   7 #include "plugin.h"
   8
   9 #include <ctype.h>
  10 #include <stdlib.h>
  11 #include <string.h>
  12
  13 typedef struct {
  14         array *access_deny;
  15 } plugin_config;
  16
  17 typedef struct {
  18         PLUGIN_DATA;
  19
  20         plugin_config **config_storage;
  21
  22         plugin_config conf;
  23 } plugin_data;
  24
  25 INIT_FUNC(mod_access_init) {
  26         plugin_data *p;
  27
  28         p = calloc(1, sizeof(*p));
  29
  30         return p;
  31 }
  32
  33 FREE_FUNC(mod_access_free) {
  34         plugin_data *p = p_d;
  35
  36         UNUSED(srv);
  37
  38         if (!p) return HANDLER_GO_ON;
  39
  40         if (p->config_storage) {
  41                 size_t i;
  42                 for (i = 0; i < srv->config_context->used; i++) {
  43                         plugin_config *s = p->config_storage[i];
  44
  45                         if (NULL == s) continue;
  46
  47                         array_free(s->access_deny);
  48
  49                         free(s);
  50                 }
  51                 free(p->config_storage);
  52         }
  53
  54         free(p);
  55
  56         return HANDLER_GO_ON;
  57 }
  58
  59 SETDEFAULTS_FUNC(mod_access_set_defaults) {
  60         plugin_data *p = p_d;
  61         size_t i = 0;
  62
  63         config_values_t cv[] = {
  64                 { "url.access-deny",             NULL, T_CONFIG_ARRAY, T_CONFIG_SCOPE_CONNECTION },
  65                 { NULL,                          NULL, T_CONFIG_UNSET, T_CONFIG_SCOPE_UNSET }
  66         };
  67
  68         p->config_storage = calloc(1, srv->config_context->used * sizeof(plugin_config *));
  69
  70         for (i = 0; i < srv->config_context->used; i++) {
  71                 data_config const* config = (data_config const*)srv->config_context->data[i];
  72                 plugin_config *s;
  73
  74                 s = calloc(1, sizeof(plugin_config));
  75                 s->access_deny    = array_init();
  76
  77                 cv[0].destination = s->access_deny;
  78
  79                 p->config_storage[i] = s;
  80
  81                 if (0 != config_insert_values_global(srv, config->value, cv, i == 0 ? T_CONFIG_SCOPE_SERVER : T_CONFIG_SCOPE_CONNECTION)) {
  82                         return HANDLER_ERROR;
  83                 }
  84         }
  85
  86         return HANDLER_GO_ON;
  87 }
  88
  89 #define PATCH(x) \
  90         p->conf.x = s->x;
  91 static int mod_access_patch_connection(server *srv, connection *con, plugin_data *p) {
  92         size_t i, j;
  93         plugin_config *s = p->config_storage[0];
  94
  95         PATCH(access_deny);
  96
  97         /* skip the first, the global context */
  98         for (i = 1; i < srv->config_context->used; i++) {
  99                 data_config *dc = (data_config *)srv->config_context->data[i];
 100                 s = p->config_storage[i];
 101
 102                 /* condition didn't match */
 103                 if (!config_check_cond(srv, con, dc)) continue;
 104
 105                 /* merge config */
 106                 for (j = 0; j < dc->value->used; j++) {
 107                         data_unset *du = dc->value->data[j];
 108
 109                         if (buffer_is_equal_string(du->key, CONST_STR_LEN("url.access-deny"))) {
 110                                 PATCH(access_deny);
 111                         }
 112                 }
 113         }
 114
 115         return 0;
 116 }
 117 #undef PATCH
 118
 119 /**
 120  * URI handler
 121  *
 122  * we will get called twice:
 123  * - after the clean up of the URL and
 124  * - after the pathinfo checks are done
 125  *
 126  * this handles the issue of trailing slashes
 127  */
 128 URIHANDLER_FUNC(mod_access_uri_handler) {
 129         plugin_data *p = p_d;
 130         int s_len;
 131         size_t k;
 132
 133         if (buffer_is_empty(con->uri.path)) return HANDLER_GO_ON;
 134
 135         mod_access_patch_connection(srv, con, p);
 136
 137         s_len = buffer_string_length(con->uri.path);
 138
 139         if (con->conf.log_request_handling) {
 140                 log_error_write(srv, __FILE__, __LINE__, "s",
 141                                 "-- mod_access_uri_handler called");
 142         }
 143
 144         for (k = 0; k < p->conf.access_deny->used; k++) {
 145                 data_string *ds = (data_string *)p->conf.access_deny->data[k];
 146                 int ct_len = buffer_string_length(ds->value);
 147                 int denied = 0;
 148
 149
 150                 if (ct_len > s_len) continue;
 151                 if (buffer_is_empty(ds->value)) continue;
 152
 153                 /* if we have a case-insensitive FS we have to lower-case the URI here too */
 154
 155                 if (con->conf.force_lowercase_filenames) {
 156                         if (0 == strncasecmp(con->uri.path->ptr + s_len - ct_len, ds->value->ptr, ct_len)) {
 157                                 denied = 1;
 158                         }
 159                 } else {
 160                         if (0 == strncmp(con->uri.path->ptr + s_len - ct_len, ds->value->ptr, ct_len)) {
 161                                 denied = 1;
 162                         }
 163                 }
 164
 165                 if (denied) {
 166                         con->http_status = 403;
 167                         con->mode = DIRECT;
 168
 169                         if (con->conf.log_request_handling) {
 170                                 log_error_write(srv, __FILE__, __LINE__, "sb",
 171                                         "url denied as we match:", ds->value);
 172                         }
 173
 174                         return HANDLER_FINISHED;
 175                 }
 176         }
 177
 178         /* not found */
 179         return HANDLER_GO_ON;
 180 }
 181
 182
 183 int mod_access_plugin_init(plugin *p);
 184 int mod_access_plugin_init(plugin *p) {
 185         p->version     = LIGHTTPD_VERSION_ID;
 186         p->name        = buffer_init_string("access");
 187
 188         p->init        = mod_access_init;
 189         p->set_defaults = mod_access_set_defaults;
 190         p->handle_uri_clean = mod_access_uri_handler;
 191         p->handle_subrequest_start  = mod_access_uri_handler;
 192         p->cleanup     = mod_access_free;
 193
 194         p->data        = NULL;
 195
 196         return 0;
 197 }