xref: /freebsd/contrib/tcp_wrappers/hosts_access.c (revision fcb560670601b2a4d87bb31d7531c8dcc37ee71b)
1  /*
2   * This module implements a simple access control language that is based on
3   * host (or domain) names, NIS (host) netgroup names, IP addresses (or
4   * network numbers) and daemon process names. When a match is found the
5   * search is terminated, and depending on whether PROCESS_OPTIONS is defined,
6   * a list of options is executed or an optional shell command is executed.
7   *
8   * Host and user names are looked up on demand, provided that suitable endpoint
9   * information is available as sockaddr_in structures or TLI netbufs. As a
10   * side effect, the pattern matching process may change the contents of
11   * request structure fields.
12   *
13   * Diagnostics are reported through syslog(3).
14   *
15   * Compile with -DNETGROUP if your library provides support for netgroups.
16   *
17   * Author: Wietse Venema, Eindhoven University of Technology, The Netherlands.
18   *
19   * $FreeBSD$
20   */
21 
22 #ifndef lint
23 static char sccsid[] = "@(#) hosts_access.c 1.21 97/02/12 02:13:22";
24 #endif
25 
26 /* System libraries. */
27 
28 #include <sys/types.h>
29 #ifdef INT32_T
30     typedef uint32_t u_int32_t;
31 #endif
32 #include <sys/param.h>
33 #ifdef INET6
34 #include <sys/socket.h>
35 #endif
36 #include <netinet/in.h>
37 #include <arpa/inet.h>
38 #include <stdio.h>
39 #include <syslog.h>
40 #include <ctype.h>
41 #include <errno.h>
42 #include <setjmp.h>
43 #include <string.h>
44 #ifdef INET6
45 #include <netdb.h>
46 #endif
47 #include <stdlib.h>
48 
49 extern char *fgets();
50 extern int errno;
51 
52 #ifndef	INADDR_NONE
53 #define	INADDR_NONE	(-1)		/* XXX should be 0xffffffff */
54 #endif
55 
56 /* Local stuff. */
57 
58 #include "tcpd.h"
59 
60 /* Error handling. */
61 
62 extern jmp_buf tcpd_buf;
63 
64 /* Delimiters for lists of daemons or clients. */
65 
66 static char sep[] = ", \t\r\n";
67 
68 /* Constants to be used in assignments only, not in comparisons... */
69 
70 #define	YES		1
71 #define	NO		0
72 
73  /*
74   * These variables are globally visible so that they can be redirected in
75   * verification mode.
76   */
77 
78 char   *hosts_allow_table = HOSTS_ALLOW;
79 char   *hosts_deny_table = HOSTS_DENY;
80 int     hosts_access_verbose = 0;
81 
82  /*
83   * In a long-running process, we are not at liberty to just go away.
84   */
85 
86 int     resident = (-1);		/* -1, 0: unknown; +1: yes */
87 
88 /* Forward declarations. */
89 
90 static int table_match();
91 static int list_match();
92 static int server_match();
93 static int client_match();
94 static int host_match();
95 static int string_match();
96 static int masked_match();
97 #ifdef INET6
98 static int masked_match4();
99 static int masked_match6();
100 #endif
101 
102 /* Size of logical line buffer. */
103 
104 #define	BUFLEN 2048
105 
106 /* definition to be used from workarounds.c */
107 #ifdef NETGROUP
108 int     yp_get_default_domain(char  **);
109 #endif
110 
111 /* hosts_access - host access control facility */
112 
113 int     hosts_access(request)
114 struct request_info *request;
115 {
116     int     verdict;
117 
118     /*
119      * If the (daemon, client) pair is matched by an entry in the file
120      * /etc/hosts.allow, access is granted. Otherwise, if the (daemon,
121      * client) pair is matched by an entry in the file /etc/hosts.deny,
122      * access is denied. Otherwise, access is granted. A non-existent
123      * access-control file is treated as an empty file.
124      *
125      * After a rule has been matched, the optional language extensions may
126      * decide to grant or refuse service anyway. Or, while a rule is being
127      * processed, a serious error is found, and it seems better to play safe
128      * and deny service. All this is done by jumping back into the
129      * hosts_access() routine, bypassing the regular return from the
130      * table_match() function calls below.
131      */
132 
133     if (resident <= 0)
134 	resident++;
135     verdict = setjmp(tcpd_buf);
136     if (verdict != 0)
137 	return (verdict == AC_PERMIT);
138     if (table_match(hosts_allow_table, request))
139 	return (YES);
140     if (table_match(hosts_deny_table, request))
141 	return (NO);
142     return (YES);
143 }
144 
145 /* table_match - match table entries with (daemon, client) pair */
146 
147 static int table_match(table, request)
148 char   *table;
149 struct request_info *request;
150 {
151     FILE   *fp;
152     char    sv_list[BUFLEN];		/* becomes list of daemons */
153     char   *cl_list;			/* becomes list of clients */
154     char   *sh_cmd;			/* becomes optional shell command */
155     int     match = NO;
156     struct tcpd_context saved_context;
157     char   *cp;
158 
159     saved_context = tcpd_context;		/* stupid compilers */
160 
161     /*
162      * Between the fopen() and fclose() calls, avoid jumps that may cause
163      * file descriptor leaks.
164      */
165 
166     if ((fp = fopen(table, "r")) != 0) {
167 	tcpd_context.file = table;
168 	tcpd_context.line = 0;
169 	while (match == NO && xgets(sv_list, sizeof(sv_list), fp) != 0) {
170 	    if (sv_list[strlen(sv_list) - 1] != '\n') {
171 		tcpd_warn("missing newline or line too long");
172 		continue;
173 	    }
174 	    /* Ignore anything after unescaped # character */
175 	    for (cp = strchr(sv_list, '#'); cp != NULL;) {
176 		if (cp > sv_list && cp[-1] == '\\') {
177 		    cp = strchr(cp + 1, '#');
178 		    continue;
179 		}
180 		*cp = '\0';
181 		break;
182 	    }
183 	    if (sv_list[strspn(sv_list, " \t\r\n")] == 0)
184 		continue;
185 	    if ((cl_list = split_at(sv_list, ':')) == 0) {
186 		tcpd_warn("missing \":\" separator");
187 		continue;
188 	    }
189 	    sh_cmd = split_at(cl_list, ':');
190 	    match = list_match(sv_list, request, server_match)
191 		&& list_match(cl_list, request, client_match);
192 	}
193 	(void) fclose(fp);
194     } else if (errno != ENOENT) {
195 	tcpd_warn("cannot open %s: %m", table);
196     }
197     if (match) {
198 	if (hosts_access_verbose > 1)
199 	    syslog(LOG_DEBUG, "matched:  %s line %d",
200 		   tcpd_context.file, tcpd_context.line);
201 	if (sh_cmd) {
202 #ifdef PROCESS_OPTIONS
203 	    process_options(sh_cmd, request);
204 #else
205 	    char    cmd[BUFSIZ];
206 	    shell_cmd(percent_x(cmd, sizeof(cmd), sh_cmd, request));
207 #endif
208 	}
209     }
210     tcpd_context = saved_context;
211     return (match);
212 }
213 
214 /* list_match - match a request against a list of patterns with exceptions */
215 
216 static int list_match(list, request, match_fn)
217 char   *list;
218 struct request_info *request;
219 int   (*match_fn) ();
220 {
221     char   *tok;
222 
223     /*
224      * Process tokens one at a time. We have exhausted all possible matches
225      * when we reach an "EXCEPT" token or the end of the list. If we do find
226      * a match, look for an "EXCEPT" list and recurse to determine whether
227      * the match is affected by any exceptions.
228      */
229 
230     for (tok = strtok(list, sep); tok != 0; tok = strtok((char *) 0, sep)) {
231 	if (STR_EQ(tok, "EXCEPT"))		/* EXCEPT: give up */
232 	    return (NO);
233 	if (match_fn(tok, request)) {		/* YES: look for exceptions */
234 	    while ((tok = strtok((char *) 0, sep)) && STR_NE(tok, "EXCEPT"))
235 		 /* VOID */ ;
236 	    return (tok == 0 || list_match((char *) 0, request, match_fn) == 0);
237 	}
238     }
239     return (NO);
240 }
241 
242 /* server_match - match server information */
243 
244 static int server_match(tok, request)
245 char   *tok;
246 struct request_info *request;
247 {
248     char   *host;
249 
250     if ((host = split_at(tok + 1, '@')) == 0) {	/* plain daemon */
251 	return (string_match(tok, eval_daemon(request)));
252     } else {					/* daemon@host */
253 	return (string_match(tok, eval_daemon(request))
254 		&& host_match(host, request->server));
255     }
256 }
257 
258 /* client_match - match client information */
259 
260 static int client_match(tok, request)
261 char   *tok;
262 struct request_info *request;
263 {
264     char   *host;
265 
266     if ((host = split_at(tok + 1, '@')) == 0) {	/* plain host */
267 	return (host_match(tok, request->client));
268     } else {					/* user@host */
269 	return (host_match(host, request->client)
270 		&& string_match(tok, eval_user(request)));
271     }
272 }
273 
274 /* hostfile_match - look up host patterns from file */
275 
276 static int hostfile_match(path, host)
277 char   *path;
278 struct host_info *host;
279 {
280     char    tok[BUFSIZ];
281     int     match = NO;
282     FILE   *fp;
283 
284     if ((fp = fopen(path, "r")) != 0) {
285 	while (fscanf(fp, "%s", tok) == 1 && !(match = host_match(tok, host)))
286 	     /* void */ ;
287 	fclose(fp);
288     } else if (errno != ENOENT) {
289 	tcpd_warn("open %s: %m", path);
290     }
291     return (match);
292 }
293 
294 /* host_match - match host name and/or address against pattern */
295 
296 static int host_match(tok, host)
297 char   *tok;
298 struct host_info *host;
299 {
300     char   *mask;
301 
302     /*
303      * This code looks a little hairy because we want to avoid unnecessary
304      * hostname lookups.
305      *
306      * The KNOWN pattern requires that both address AND name be known; some
307      * patterns are specific to host names or to host addresses; all other
308      * patterns are satisfied when either the address OR the name match.
309      */
310 
311     if (tok[0] == '@') {			/* netgroup: look it up */
312 #ifdef  NETGROUP
313 	static char *mydomain = 0;
314 	if (mydomain == 0)
315 	    yp_get_default_domain(&mydomain);
316 	return (innetgr(tok + 1, eval_hostname(host), (char *) 0, mydomain));
317 #else
318 	tcpd_warn("netgroup support is disabled");	/* not tcpd_jump() */
319 	return (NO);
320 #endif
321     } else if (tok[0] == '/') {			/* /file hack */
322 	return (hostfile_match(tok, host));
323     } else if (STR_EQ(tok, "KNOWN")) {		/* check address and name */
324 	char   *name = eval_hostname(host);
325 	return (STR_NE(eval_hostaddr(host), unknown) && HOSTNAME_KNOWN(name));
326     } else if (STR_EQ(tok, "LOCAL")) {		/* local: no dots in name */
327 	char   *name = eval_hostname(host);
328 	return (strchr(name, '.') == 0 && HOSTNAME_KNOWN(name));
329     } else if ((mask = split_at(tok, '/')) != 0) {	/* net/mask */
330 	return (masked_match(tok, mask, eval_hostaddr(host)));
331     } else {					/* anything else */
332 	return (string_match(tok, eval_hostaddr(host))
333 	    || (NOT_INADDR(tok) && string_match(tok, eval_hostname(host))));
334     }
335 }
336 
337 /* string_match - match string against pattern */
338 
339 static int string_match(tok, string)
340 char   *tok;
341 char   *string;
342 {
343     int     n;
344 
345 #ifdef INET6
346     /* convert IPv4 mapped IPv6 address to IPv4 address */
347     if (STRN_EQ(string, "::ffff:", 7)
348 	&& dot_quad_addr(string + 7) != INADDR_NONE) {
349 	string += 7;
350     }
351 #endif
352     if (tok[0] == '.') {			/* suffix */
353 	n = strlen(string) - strlen(tok);
354 	return (n > 0 && STR_EQ(tok, string + n));
355     } else if (STR_EQ(tok, "ALL")) {		/* all: match any */
356 	return (YES);
357     } else if (STR_EQ(tok, "KNOWN")) {		/* not unknown */
358 	return (STR_NE(string, unknown));
359     } else if (tok[(n = strlen(tok)) - 1] == '.') {	/* prefix */
360 	return (STRN_EQ(tok, string, n));
361     } else {					/* exact match */
362 #ifdef INET6
363 	struct addrinfo hints, *res;
364 	struct sockaddr_in6 pat, addr;
365 	int len, ret;
366 	char ch;
367 
368 	len = strlen(tok);
369 	if (*tok == '[' && tok[len - 1] == ']') {
370 	    ch = tok[len - 1];
371 	    tok[len - 1] = '\0';
372 	    memset(&hints, 0, sizeof(hints));
373 	    hints.ai_family = AF_INET6;
374 	    hints.ai_socktype = SOCK_STREAM;
375 	    hints.ai_flags = AI_PASSIVE | AI_NUMERICHOST;
376 	    if ((ret = getaddrinfo(tok + 1, NULL, &hints, &res)) == 0) {
377 		memcpy(&pat, res->ai_addr, sizeof(pat));
378 		freeaddrinfo(res);
379 	    }
380 	    tok[len - 1] = ch;
381 	    if (ret != 0 || getaddrinfo(string, NULL, &hints, &res) != 0)
382 		return NO;
383 	    memcpy(&addr, res->ai_addr, sizeof(addr));
384 	    freeaddrinfo(res);
385 	    if (pat.sin6_scope_id != 0 &&
386 		addr.sin6_scope_id != pat.sin6_scope_id)
387 		return NO;
388 	    return (!memcmp(&pat.sin6_addr, &addr.sin6_addr,
389 			    sizeof(struct in6_addr)));
390 	    return (ret);
391 	}
392 #endif
393 	return (STR_EQ(tok, string));
394     }
395 }
396 
397 /* masked_match - match address against netnumber/netmask */
398 
399 #ifdef INET6
400 static int masked_match(net_tok, mask_tok, string)
401 char   *net_tok;
402 char   *mask_tok;
403 char   *string;
404 {
405     return (masked_match4(net_tok, mask_tok, string) ||
406 	    masked_match6(net_tok, mask_tok, string));
407 }
408 
409 static int masked_match4(net_tok, mask_tok, string)
410 #else
411 static int masked_match(net_tok, mask_tok, string)
412 #endif
413 char   *net_tok;
414 char   *mask_tok;
415 char   *string;
416 {
417 #ifdef INET6
418     u_int32_t net;
419     u_int32_t mask;
420     u_int32_t addr;
421 #else
422     unsigned long net;
423     unsigned long mask;
424     unsigned long addr;
425 #endif
426 
427     /*
428      * Disallow forms other than dotted quad: the treatment that inet_addr()
429      * gives to forms with less than four components is inconsistent with the
430      * access control language. John P. Rouillard <rouilj@cs.umb.edu>.
431      */
432 
433     if ((addr = dot_quad_addr(string)) == INADDR_NONE)
434 	return (NO);
435     if ((net = dot_quad_addr(net_tok)) == INADDR_NONE
436 	|| (mask = dot_quad_addr(mask_tok)) == INADDR_NONE) {
437 #ifndef INET6
438 	tcpd_warn("bad net/mask expression: %s/%s", net_tok, mask_tok);
439 #endif
440 	return (NO);				/* not tcpd_jump() */
441     }
442     return ((addr & mask) == net);
443 }
444 
445 #ifdef INET6
446 static int masked_match6(net_tok, mask_tok, string)
447 char   *net_tok;
448 char   *mask_tok;
449 char   *string;
450 {
451     struct addrinfo hints, *res;
452     struct sockaddr_in6 net, addr;
453     u_int32_t mask;
454     int len, mask_len, i = 0;
455     char ch;
456 
457     memset(&hints, 0, sizeof(hints));
458     hints.ai_family = AF_INET6;
459     hints.ai_socktype = SOCK_STREAM;
460     hints.ai_flags = AI_PASSIVE | AI_NUMERICHOST;
461     if (getaddrinfo(string, NULL, &hints, &res) != 0)
462 	return NO;
463     memcpy(&addr, res->ai_addr, sizeof(addr));
464     freeaddrinfo(res);
465 
466     if (IN6_IS_ADDR_V4MAPPED(&addr.sin6_addr)) {
467 	if ((*(u_int32_t *)&net.sin6_addr.s6_addr[12] = dot_quad_addr(net_tok)) == INADDR_NONE
468 	 || (mask = dot_quad_addr(mask_tok)) == INADDR_NONE)
469 	    return (NO);
470 	return ((*(u_int32_t *)&addr.sin6_addr.s6_addr[12] & mask) == *(u_int32_t *)&net.sin6_addr.s6_addr[12]);
471     }
472 
473     /* match IPv6 address against netnumber/prefixlen */
474     len = strlen(net_tok);
475     if (*net_tok != '[' || net_tok[len - 1] != ']')
476 	return NO;
477     ch = net_tok[len - 1];
478     net_tok[len - 1] = '\0';
479     if (getaddrinfo(net_tok + 1, NULL, &hints, &res) != 0) {
480 	net_tok[len - 1] = ch;
481 	return NO;
482     }
483     memcpy(&net, res->ai_addr, sizeof(net));
484     freeaddrinfo(res);
485     net_tok[len - 1] = ch;
486     if ((mask_len = atoi(mask_tok)) < 0 || mask_len > 128)
487 	return NO;
488 
489     if (net.sin6_scope_id != 0 && addr.sin6_scope_id != net.sin6_scope_id)
490 	return NO;
491     while (mask_len > 0) {
492 	if (mask_len < 32) {
493 	    mask = htonl(~(0xffffffff >> mask_len));
494 	    if ((*(u_int32_t *)&addr.sin6_addr.s6_addr[i] & mask) != (*(u_int32_t *)&net.sin6_addr.s6_addr[i] & mask))
495 		return NO;
496 	    break;
497 	}
498 	if (*(u_int32_t *)&addr.sin6_addr.s6_addr[i] != *(u_int32_t *)&net.sin6_addr.s6_addr[i])
499 	    return NO;
500 	i += 4;
501 	mask_len -= 32;
502     }
503     return YES;
504 }
505 #endif /* INET6 */
506