1/*
2   This module is an adaption of code from the tcpd-1.4 package written
3   by Wietse Venema, Eindhoven University of Technology, The Netherlands.
4
5   The code is used here with permission.
6
7   The code has been considerably changed from the original. Bug reports
8   should be sent to samba@samba.org
9
10   Updated for IPv6 by Jeremy Allison (C) 2007.
11*/
12
13#include "includes.h"
14
15#define NAME_INDEX 0
16#define ADDR_INDEX 1
17
18/* masked_match - match address against netnumber/netmask */
19static bool masked_match(const char *tok, const char *slash, const char *s)
20{
21	struct sockaddr_storage ss_mask;
22	struct sockaddr_storage ss_tok;
23	struct sockaddr_storage ss_host;
24	char *tok_copy = NULL;
25
26	if (!interpret_string_addr(&ss_host, s, 0)) {
27		return false;
28	}
29
30	if (*tok == '[') {
31		/* IPv6 address - remove braces. */
32		tok_copy = SMB_STRDUP(tok+1);
33		if (!tok_copy) {
34			return false;
35		}
36		/* Remove the terminating ']' */
37		tok_copy[PTR_DIFF(slash,tok)-1] = '\0';
38	} else {
39		tok_copy = SMB_STRDUP(tok);
40		if (!tok_copy) {
41			return false;
42		}
43		/* Remove the terminating '/' */
44		tok_copy[PTR_DIFF(slash,tok)] = '\0';
45	}
46
47	if (!interpret_string_addr(&ss_tok, tok_copy, 0)) {
48		SAFE_FREE(tok_copy);
49		return false;
50	}
51
52	SAFE_FREE(tok_copy);
53
54        if (strlen(slash + 1) > 2) {
55		if (!interpret_string_addr(&ss_mask, slash+1, 0)) {
56			return false;
57		}
58        } else {
59		char *endp = NULL;
60		unsigned long val = strtoul(slash+1, &endp, 0);
61		if (slash+1 == endp || (endp && *endp != '\0')) {
62			return false;
63		}
64		if (!make_netmask(&ss_mask, &ss_tok, val)) {
65			return false;
66		}
67        }
68
69	return same_net((struct sockaddr *)&ss_host, (struct sockaddr *)&ss_tok, (struct sockaddr *)&ss_mask);
70}
71
72/* string_match - match string s against token tok */
73static bool string_match(const char *tok,const char *s)
74{
75	size_t     tok_len;
76	size_t     str_len;
77	const char   *cut;
78
79	/* Return true if a token has the magic value "ALL". Return
80	 * true if the token is "FAIL". If the token starts with a "."
81	 * (domain name), return true if it matches the last fields of
82	 * the string. If the token has the magic value "LOCAL",
83	 * return true if the string does not contain a "."
84	 * character. If the token ends on a "." (network number),
85	 * return true if it matches the first fields of the
86	 * string. If the token begins with a "@" (netgroup name),
87	 * return true if the string is a (host) member of the
88	 * netgroup. Return true if the token fully matches the
89	 * string. If the token is a netnumber/netmask pair, return
90	 * true if the address is a member of the specified subnet.
91	 */
92
93	if (tok[0] == '.') {			/* domain: match last fields */
94		if ((str_len = strlen(s)) > (tok_len = strlen(tok))
95		    && strequal(tok, s + str_len - tok_len)) {
96			return true;
97		}
98	} else if (tok[0] == '@') { /* netgroup: look it up */
99#ifdef	HAVE_NETGROUP
100		DATA_BLOB tmp;
101		char *mydomain = NULL;
102		char *hostname = NULL;
103		bool netgroup_ok = false;
104
105		if (memcache_lookup(
106			    NULL, SINGLETON_CACHE,
107			    data_blob_string_const_null("yp_default_domain"),
108			    &tmp)) {
109
110			SMB_ASSERT(tmp.length > 0);
111			mydomain = (tmp.data[0] == '\0')
112				? NULL : (char *)tmp.data;
113		}
114		else {
115			yp_get_default_domain(&mydomain);
116
117			memcache_add(
118				NULL, SINGLETON_CACHE,
119				data_blob_string_const_null("yp_default_domain"),
120				data_blob_string_const_null(mydomain?mydomain:""));
121		}
122
123		if (!mydomain) {
124			DEBUG(0,("Unable to get default yp domain. "
125				"Try without it.\n"));
126		}
127		if (!(hostname = SMB_STRDUP(s))) {
128			DEBUG(1,("out of memory for strdup!\n"));
129			return false;
130		}
131
132		netgroup_ok = innetgr(tok + 1, hostname, (char *) 0, mydomain);
133
134		DEBUG(5,("looking for %s of domain %s in netgroup %s gave %s\n",
135			 hostname,
136			 mydomain?mydomain:"(ANY)",
137			 tok+1,
138			 BOOLSTR(netgroup_ok)));
139
140		SAFE_FREE(hostname);
141
142		if (netgroup_ok)
143			return true;
144#else
145		DEBUG(0,("access: netgroup support is not configured\n"));
146		return false;
147#endif
148	} else if (strequal(tok, "ALL")) {	/* all: match any */
149		return true;
150	} else if (strequal(tok, "FAIL")) {	/* fail: match any */
151		return true;
152	} else if (strequal(tok, "LOCAL")) {	/* local: no dots */
153		if (strchr_m(s, '.') == 0 && !strequal(s, "unknown")) {
154			return true;
155		}
156	} else if (strequal(tok, s)) {   /* match host name or address */
157		return true;
158	} else if (tok[(tok_len = strlen(tok)) - 1] == '.') {	/* network */
159		if (strncmp(tok, s, tok_len) == 0) {
160			return true;
161		}
162	} else if ((cut = strchr_m(tok, '/')) != 0) {	/* netnumber/netmask */
163		if ((isdigit(s[0]) && strchr_m(tok, '.') != NULL) ||
164			(tok[0] == '[' && cut > tok && cut[-1] == ']') ||
165			((isxdigit(s[0]) || s[0] == ':') &&
166				strchr_m(tok, ':') != NULL)) {
167			/* IPv4/netmask or
168			 * [IPv6:addr]/netmask or IPv6:addr/netmask */
169			return masked_match(tok, cut, s);
170		}
171	} else if (strchr_m(tok, '*') != 0 || strchr_m(tok, '?')) {
172		return unix_wild_match(tok, s);
173	}
174	return false;
175}
176
177/* client_match - match host name and address against token */
178bool client_match(const char *tok, const void *item)
179{
180	const char **client = (const char **)item;
181
182	/*
183	 * Try to match the address first. If that fails, try to match the host
184	 * name if available.
185	 */
186
187	if (string_match(tok, client[ADDR_INDEX])) {
188		return true;
189	}
190
191	if (strnequal(client[ADDR_INDEX],"::ffff:",7) &&
192			!strnequal(tok, "::ffff:",7)) {
193		/* client[ADDR_INDEX] is an IPv4 mapped to IPv6, but
194 		 * the list item is not. Try and match the IPv4 part of
195 		 * address only. This will happen a lot on IPv6 enabled
196 		 * systems with IPv4 allow/deny lists in smb.conf.
197 		 * Bug #5311. JRA.
198 		 */
199		if (string_match(tok, (client[ADDR_INDEX])+7)) {
200			return true;
201		}
202	}
203
204	if (client[NAME_INDEX][0] != 0) {
205		if (string_match(tok, client[NAME_INDEX])) {
206			return true;
207		}
208	}
209
210	return false;
211}
212
213/* list_match - match an item against a list of tokens with exceptions */
214bool list_match(const char **list,const void *item,
215		bool (*match_fn)(const char *, const void *))
216{
217	bool match = false;
218
219	if (!list) {
220		return false;
221	}
222
223	/*
224	 * Process tokens one at a time. We have exhausted all possible matches
225	 * when we reach an "EXCEPT" token or the end of the list. If we do find
226	 * a match, look for an "EXCEPT" list and recurse to determine whether
227	 * the match is affected by any exceptions.
228	 */
229
230	for (; *list ; list++) {
231		if (strequal(*list, "EXCEPT")) {
232			/* EXCEPT: give up */
233			break;
234		}
235		if ((match = (*match_fn) (*list, item))) {
236			/* true or FAIL */
237			break;
238		}
239	}
240	/* Process exceptions to true or FAIL matches. */
241
242	if (match != false) {
243		while (*list  && !strequal(*list, "EXCEPT")) {
244			list++;
245		}
246
247		for (; *list; list++) {
248			if ((*match_fn) (*list, item)) {
249				/* Exception Found */
250				return false;
251			}
252		}
253	}
254
255	return match;
256}
257
258/* return true if access should be allowed */
259static bool allow_access_internal(const char **deny_list,
260				const char **allow_list,
261				const char *cname,
262				const char *caddr)
263{
264	const char *client[2];
265
266	client[NAME_INDEX] = cname;
267	client[ADDR_INDEX] = caddr;
268
269	/* if it is loopback then always allow unless specifically denied */
270	if (strcmp(caddr, "127.0.0.1") == 0 || strcmp(caddr, "::1") == 0) {
271		/*
272		 * If 127.0.0.1 matches both allow and deny then allow.
273		 * Patch from Steve Langasek vorlon@netexpress.net.
274		 */
275		if (deny_list &&
276			list_match(deny_list,client,client_match) &&
277				(!allow_list ||
278				!list_match(allow_list,client, client_match))) {
279			return false;
280		}
281		return true;
282	}
283
284	/* if theres no deny list and no allow list then allow access */
285	if ((!deny_list || *deny_list == 0) &&
286	    (!allow_list || *allow_list == 0)) {
287		return true;
288	}
289
290	/* if there is an allow list but no deny list then allow only hosts
291	   on the allow list */
292	if (!deny_list || *deny_list == 0) {
293		return(list_match(allow_list,client,client_match));
294	}
295
296	/* if theres a deny list but no allow list then allow
297	   all hosts not on the deny list */
298	if (!allow_list || *allow_list == 0) {
299		return(!list_match(deny_list,client,client_match));
300	}
301
302	/* if there are both types of list then allow all hosts on the
303           allow list */
304	if (list_match(allow_list,(const char *)client,client_match)) {
305		return true;
306	}
307
308	/* if there are both types of list and it's not on the allow then
309	   allow it if its not on the deny */
310	if (list_match(deny_list,(const char *)client,client_match)) {
311		return false;
312	}
313
314	return true;
315}
316
317/* return true if access should be allowed */
318bool allow_access(const char **deny_list,
319		const char **allow_list,
320		const char *cname,
321		const char *caddr)
322{
323	bool ret;
324	char *nc_cname = smb_xstrdup(cname);
325	char *nc_caddr = smb_xstrdup(caddr);
326
327	ret = allow_access_internal(deny_list, allow_list, nc_cname, nc_caddr);
328
329	SAFE_FREE(nc_cname);
330	SAFE_FREE(nc_caddr);
331	return ret;
332}
333
334/* return true if the char* contains ip addrs only.  Used to avoid
335name lookup calls */
336
337static bool only_ipaddrs_in_list(const char **list)
338{
339	bool only_ip = true;
340
341	if (!list) {
342		return true;
343	}
344
345	for (; *list ; list++) {
346		/* factor out the special strings */
347		if (strequal(*list, "ALL") || strequal(*list, "FAIL") ||
348		    strequal(*list, "EXCEPT")) {
349			continue;
350		}
351
352		if (!is_ipaddress(*list)) {
353			/*
354			 * If we failed, make sure that it was not because
355			 * the token was a network/netmask pair. Only
356			 * network/netmask pairs have a '/' in them.
357			 */
358			if ((strchr_m(*list, '/')) == NULL) {
359				only_ip = false;
360				DEBUG(3,("only_ipaddrs_in_list: list has "
361					"non-ip address (%s)\n",
362					*list));
363				break;
364			}
365		}
366	}
367
368	return only_ip;
369}
370
371/* return true if access should be allowed to a service for a socket */
372bool check_access(int sock, const char **allow_list, const char **deny_list)
373{
374	bool ret = false;
375	bool only_ip = false;
376
377	if ((!deny_list || *deny_list==0) && (!allow_list || *allow_list==0))
378		ret = true;
379
380	if (!ret) {
381		char addr[INET6_ADDRSTRLEN];
382
383		/* Bypass name resolution calls if the lists
384		 * only contain IP addrs */
385		if (only_ipaddrs_in_list(allow_list) &&
386				only_ipaddrs_in_list(deny_list)) {
387			only_ip = true;
388			DEBUG (3, ("check_access: no hostnames "
389				"in host allow/deny list.\n"));
390			ret = allow_access(deny_list,
391					allow_list,
392					"",
393					get_peer_addr(sock,addr,sizeof(addr)));
394		} else {
395			DEBUG (3, ("check_access: hostnames in "
396				"host allow/deny list.\n"));
397			ret = allow_access(deny_list,
398					allow_list,
399					get_peer_name(sock,true),
400					get_peer_addr(sock,addr,sizeof(addr)));
401		}
402
403		if (ret) {
404			DEBUG(2,("Allowed connection from %s (%s)\n",
405				 only_ip ? "" : get_peer_name(sock,true),
406				 get_peer_addr(sock,addr,sizeof(addr))));
407		} else {
408			DEBUG(0,("Denied connection from %s (%s)\n",
409				 only_ip ? "" : get_peer_name(sock,true),
410				 get_peer_addr(sock,addr,sizeof(addr))));
411		}
412	}
413
414	return(ret);
415}
416