1 /* 2 * Copyright 2004 Sun Microsystems, Inc. All rights reserved. 3 * Use is subject to license terms. 4 */ 5 6 #pragma ident "%Z%%M% %I% %E% SMI" 7 8 /* 9 * This module implements a simple access control language that is based on 10 * host (or domain) names, NIS (host) netgroup names, IP addresses (or 11 * network numbers) and daemon process names. When a match is found the 12 * search is terminated, and depending on whether PROCESS_OPTIONS is defined, 13 * a list of options is executed or an optional shell command is executed. 14 * 15 * Host and user names are looked up on demand, provided that suitable endpoint 16 * information is available as sockaddr_in structures or TLI netbufs. As a 17 * side effect, the pattern matching process may change the contents of 18 * request structure fields. 19 * 20 * Diagnostics are reported through syslog(3). 21 * 22 * Compile with -DNETGROUP if your library provides support for netgroups. 23 * 24 * Author: Wietse Venema, Eindhoven University of Technology, The Netherlands. 25 */ 26 27 #ifndef lint 28 static char sccsid[] = "@(#) hosts_access.c 1.21 97/02/12 02:13:22"; 29 #endif 30 31 /* System libraries. */ 32 33 #include <sys/types.h> 34 #include <sys/param.h> 35 #include <netinet/in.h> 36 #include <arpa/inet.h> 37 #include <rpcsvc/ypclnt.h> 38 #include <netdb.h> 39 #include <stdio.h> 40 #include <stdlib.h> 41 #include <unistd.h> 42 #include <syslog.h> 43 #include <ctype.h> 44 #include <errno.h> 45 #include <setjmp.h> 46 #include <string.h> 47 48 extern char *fgets(); 49 extern int errno; 50 51 #ifndef INADDR_NONE 52 #define INADDR_NONE (-1) /* XXX should be 0xffffffff */ 53 #endif 54 55 /* Local stuff. */ 56 57 #include "tcpd.h" 58 59 /* Error handling. */ 60 61 extern jmp_buf tcpd_buf; 62 63 /* Delimiters for lists of daemons or clients. */ 64 65 static char sep[] = ", \t\r\n"; 66 67 /* Constants to be used in assignments only, not in comparisons... */ 68 69 #define YES 1 70 #define NO 0 71 72 /* 73 * These variables are globally visible so that they can be redirected in 74 * verification mode. 75 */ 76 77 char *hosts_allow_table = HOSTS_ALLOW; 78 char *hosts_deny_table = HOSTS_DENY; 79 int hosts_access_verbose = 0; 80 81 /* 82 * In a long-running process, we are not at liberty to just go away. 83 */ 84 85 int resident = (-1); /* -1, 0: unknown; +1: yes */ 86 87 /* Forward declarations. */ 88 89 static int table_match(); 90 static int list_match(); 91 static int server_match(); 92 static int client_match(); 93 static int host_match(); 94 static int string_match(); 95 static int masked_match(); 96 #ifdef HAVE_IPV6 97 static void ipv6_mask(); 98 #endif 99 100 /* Size of logical line buffer. */ 101 102 #define BUFLEN 2048 103 104 /* hosts_access - host access control facility */ 105 106 int hosts_access(request) 107 struct request_info *request; 108 { 109 int verdict; 110 111 /* 112 * If the (daemon, client) pair is matched by an entry in the file 113 * /etc/hosts.allow, access is granted. Otherwise, if the (daemon, 114 * client) pair is matched by an entry in the file /etc/hosts.deny, 115 * access is denied. Otherwise, access is granted. A non-existent 116 * access-control file is treated as an empty file. 117 * 118 * After a rule has been matched, the optional language extensions may 119 * decide to grant or refuse service anyway. Or, while a rule is being 120 * processed, a serious error is found, and it seems better to play safe 121 * and deny service. All this is done by jumping back into the 122 * hosts_access() routine, bypassing the regular return from the 123 * table_match() function calls below. 124 */ 125 126 if (resident <= 0) 127 resident++; 128 verdict = setjmp(tcpd_buf); 129 if (verdict != 0) 130 return (verdict == AC_PERMIT); 131 if (table_match(hosts_allow_table, request)) 132 return (YES); 133 if (table_match(hosts_deny_table, request)) 134 return (NO); 135 return (YES); 136 } 137 138 /* table_match - match table entries with (daemon, client) pair */ 139 140 static int table_match(table, request) 141 char *table; 142 struct request_info *request; 143 { 144 FILE *fp; 145 char sv_list[BUFLEN]; /* becomes list of daemons */ 146 char *cl_list; /* becomes list of clients */ 147 char *sh_cmd; /* becomes optional shell command */ 148 int match = NO; 149 struct tcpd_context saved_context; 150 151 saved_context = tcpd_context; /* stupid compilers */ 152 153 /* 154 * Between the fopen() and fclose() calls, avoid jumps that may cause 155 * file descriptor leaks. 156 */ 157 158 if ((fp = fopen(table, "r")) != 0) { 159 tcpd_context.file = table; 160 tcpd_context.line = 0; 161 while (match == NO && xgets(sv_list, sizeof(sv_list), fp) != 0) { 162 if (sv_list[strlen(sv_list) - 1] != '\n') { 163 tcpd_warn("missing newline or line too long"); 164 continue; 165 } 166 if (sv_list[0] == '#' || sv_list[strspn(sv_list, " \t\r\n")] == 0) 167 continue; 168 if ((cl_list = split_at(skip_ipv6_addrs(sv_list), ':')) == 0) { 169 tcpd_warn("missing \":\" separator"); 170 continue; 171 } 172 sh_cmd = split_at(skip_ipv6_addrs(cl_list), ':'); 173 match = list_match(sv_list, request, server_match) 174 && list_match(cl_list, request, client_match); 175 } 176 (void) fclose(fp); 177 } else if (errno != ENOENT) { 178 tcpd_warn("cannot open %s: %m", table); 179 } 180 if (match) { 181 if (hosts_access_verbose > 1) 182 syslog(LOG_DEBUG, "matched: %s line %d", 183 tcpd_context.file, tcpd_context.line); 184 if (sh_cmd) { 185 #ifdef PROCESS_OPTIONS 186 process_options(sh_cmd, request); 187 #else 188 char cmd[BUFSIZ]; 189 shell_cmd(percent_x(cmd, sizeof(cmd), sh_cmd, request)); 190 #endif 191 } 192 } 193 tcpd_context = saved_context; 194 return (match); 195 } 196 197 /* list_match - match a request against a list of patterns with exceptions */ 198 199 static int list_match(list, request, match_fn) 200 char *list; 201 struct request_info *request; 202 int (*match_fn) (); 203 { 204 char *tok; 205 206 /* 207 * Process tokens one at a time. We have exhausted all possible matches 208 * when we reach an "EXCEPT" token or the end of the list. If we do find 209 * a match, look for an "EXCEPT" list and recurse to determine whether 210 * the match is affected by any exceptions. 211 */ 212 213 for (tok = strtok(list, sep); tok != 0; tok = strtok((char *) 0, sep)) { 214 if (STR_EQ(tok, "EXCEPT")) /* EXCEPT: give up */ 215 return (NO); 216 if (match_fn(tok, request)) { /* YES: look for exceptions */ 217 while ((tok = strtok((char *) 0, sep)) && STR_NE(tok, "EXCEPT")) 218 /* VOID */ ; 219 return (tok == 0 || list_match((char *) 0, request, match_fn) == 0); 220 } 221 } 222 return (NO); 223 } 224 225 /* server_match - match server information */ 226 227 static int server_match(tok, request) 228 char *tok; 229 struct request_info *request; 230 { 231 char *host; 232 233 if ((host = split_at(tok + 1, '@')) == 0) { /* plain daemon */ 234 return (string_match(tok, eval_daemon(request))); 235 } else { /* daemon@host */ 236 return (string_match(tok, eval_daemon(request)) 237 && host_match(host, request->server)); 238 } 239 } 240 241 /* client_match - match client information */ 242 243 static int client_match(tok, request) 244 char *tok; 245 struct request_info *request; 246 { 247 char *host; 248 249 if ((host = split_at(tok + 1, '@')) == 0) { /* plain host */ 250 return (host_match(tok, request->client)); 251 } else { /* user@host */ 252 return (host_match(host, request->client) 253 && string_match(tok, eval_user(request))); 254 } 255 } 256 257 /* host_match - match host name and/or address against pattern */ 258 259 static int host_match(tok, host) 260 char *tok; 261 struct host_info *host; 262 { 263 char *mask; 264 265 /* 266 * This code looks a little hairy because we want to avoid unnecessary 267 * hostname lookups. 268 * 269 * The KNOWN pattern requires that both address AND name be known; some 270 * patterns are specific to host names or to host addresses; all other 271 * patterns are satisfied when either the address OR the name match. 272 */ 273 274 if (tok[0] == '@') { /* netgroup: look it up */ 275 #ifdef NETGROUP 276 static char *mydomain = 0; 277 if (mydomain == 0) 278 yp_get_default_domain(&mydomain); 279 return (innetgr(tok + 1, eval_hostname(host), (char *) 0, mydomain)); 280 #else 281 tcpd_warn("netgroup support is disabled"); /* not tcpd_jump() */ 282 return (NO); 283 #endif 284 } else if (STR_EQ(tok, "KNOWN")) { /* check address and name */ 285 char *name = eval_hostname(host); 286 return (STR_NE(eval_hostaddr(host), unknown) && HOSTNAME_KNOWN(name)); 287 } else if (STR_EQ(tok, "LOCAL")) { /* local: no dots in name */ 288 char *name = eval_hostname(host); 289 return (strchr(name, '.') == 0 && HOSTNAME_KNOWN(name)); 290 #ifdef HAVE_IPV6 291 } else if (tok[0] == '[') { /* IPv6 address */ 292 struct in6_addr in6, hostin6, *hip; 293 char *cbr; 294 char *slash; 295 int mask = IPV6_ABITS; 296 297 /* 298 * In some cases we don't get the sockaddr, only the addr. 299 * We use inet_pton to convert it to its binary representation 300 * and match against that. 301 */ 302 if (host->sin == NULL) { 303 if (host->addr == NULL || 304 inet_pton(AF_INET6, host->addr, &hostin6) != 1) { 305 return (NO); 306 } 307 hip = &hostin6; 308 } else { 309 if (SGFAM(host->sin) != AF_INET6) 310 return (NO); 311 hip = &host->sin->sg_sin6.sin6_addr; 312 } 313 314 if (cbr = strchr(tok, ']')) 315 *cbr = '\0'; 316 317 /* 318 * A /nnn prefix specifies how many bits of the address we 319 * need to check. 320 */ 321 if (slash = strchr(tok, '/')) { 322 *slash = '\0'; 323 mask = atoi(slash+1); 324 if (mask < 0 || mask > IPV6_ABITS) { 325 tcpd_warn("bad IP6 prefix specification"); 326 return (NO); 327 } 328 /* Copy, because we need to modify it below */ 329 if (host->sin != NULL) { 330 hostin6 = host->sin->sg_sin6.sin6_addr; 331 hip = &hostin6; 332 } 333 } 334 335 if (cbr == NULL || inet_pton(AF_INET6, tok+1, &in6) != 1) { 336 tcpd_warn("bad IP6 address specification"); 337 return (NO); 338 } 339 /* 340 * Zero the bits we're not interested in in both addresses 341 * then compare. Note that we take a copy of the host info 342 * in that case. 343 */ 344 if (mask != IPV6_ABITS) { 345 ipv6_mask(&in6, mask); 346 ipv6_mask(hip, mask); 347 } 348 if (memcmp(&in6, hip, sizeof(in6)) == 0) 349 return (YES); 350 return (NO); 351 #endif 352 } else if ((mask = split_at(tok, '/')) != 0) { /* net/mask */ 353 return (masked_match(tok, mask, eval_hostaddr(host))); 354 } else { /* anything else */ 355 return (string_match(tok, eval_hostaddr(host)) 356 || (NOT_INADDR(tok) && string_match(tok, eval_hostname(host)))); 357 } 358 } 359 360 /* string_match - match string against pattern */ 361 362 static int string_match(tok, string) 363 char *tok; 364 char *string; 365 { 366 int n; 367 368 if (tok[0] == '.') { /* suffix */ 369 n = strlen(string) - strlen(tok); 370 return (n > 0 && STR_EQ(tok, string + n)); 371 } else if (STR_EQ(tok, "ALL")) { /* all: match any */ 372 return (YES); 373 } else if (STR_EQ(tok, "KNOWN")) { /* not unknown */ 374 return (STR_NE(string, unknown)); 375 } else if (tok[(n = strlen(tok)) - 1] == '.') { /* prefix */ 376 return (STRN_EQ(tok, string, n)); 377 } else { /* exact match */ 378 return (STR_EQ(tok, string)); 379 } 380 } 381 382 /* masked_match - match address against netnumber/netmask */ 383 384 static int masked_match(net_tok, mask_tok, string) 385 char *net_tok; 386 char *mask_tok; 387 char *string; 388 { 389 unsigned long net; 390 unsigned long mask; 391 unsigned long addr; 392 393 /* 394 * Disallow forms other than dotted quad: the treatment that inet_addr() 395 * gives to forms with less than four components is inconsistent with the 396 * access control language. John P. Rouillard <rouilj@cs.umb.edu>. 397 */ 398 399 if ((addr = dot_quad_addr(string)) == INADDR_NONE) 400 return (NO); 401 if ((net = dot_quad_addr(net_tok)) == INADDR_NONE 402 || (mask = dot_quad_addr(mask_tok)) == INADDR_NONE) { 403 tcpd_warn("bad net/mask expression: %s/%s", net_tok, mask_tok); 404 return (NO); /* not tcpd_jump() */ 405 } 406 return ((addr & mask) == net); 407 } 408 409 #ifdef HAVE_IPV6 410 /* 411 * Function that zeros all but the first "maskbits" bits of the IPV6 address 412 * This function can be made generic by specifying an address length as 413 * extra parameter. (So Wietse can implement 1.2.3.4/16) 414 */ 415 static void ipv6_mask(in6p, maskbits) 416 struct in6_addr *in6p; 417 int maskbits; 418 { 419 uchar_t *p = (uchar_t*) in6p; 420 421 if (maskbits < 0 || maskbits >= IPV6_ABITS) 422 return; 423 424 p += maskbits / 8; 425 maskbits %= 8; 426 427 if (maskbits != 0) 428 *p++ &= 0xff << (8 - maskbits); 429 430 while (p < (((uchar_t*) in6p)) + sizeof(*in6p)) 431 *p++ = 0; 432 } 433 #endif 434