1/*
2   This module is an adaption of code from the tcpd-1.4 package written
3   by Wietse Venema, Eindhoven University of Technology, The Netherlands.
4
5   The code is used here with permission.
6
7   The code has been considerably changed from the original. Bug reports
8   should be sent to samba@samba.org
9*/
10
11#include "includes.h"
12
13#define	FAIL		(-1)
14
15#define ALLONES  ((uint32)0xFFFFFFFF)
16
17/* masked_match - match address against netnumber/netmask */
18static BOOL masked_match(const char *tok, const char *slash, const char *s)
19{
20	uint32 net;
21	uint32 mask;
22	uint32 addr;
23	fstring tok_cpy;
24
25	if ((addr = interpret_addr(s)) == INADDR_NONE)
26		return (False);
27
28	fstrcpy(tok_cpy, tok);
29	tok_cpy[PTR_DIFF(slash,tok)] = '\0';
30	net = interpret_addr(tok_cpy);
31	tok_cpy[PTR_DIFF(slash,tok)] = '/';
32
33        if (strlen(slash + 1) > 2) {
34                mask = interpret_addr(slash + 1);
35        } else {
36		mask = (uint32)((ALLONES >> atoi(slash + 1)) ^ ALLONES);
37		/* convert to network byte order */
38		mask = htonl(mask);
39        }
40
41	if (net == INADDR_NONE || mask == INADDR_NONE) {
42		DEBUG(0,("access: bad net/mask access control: %s\n", tok));
43		return (False);
44	}
45
46	return ((addr & mask) == (net & mask));
47}
48
49/* string_match - match string against token */
50static BOOL string_match(const char *tok,const char *s, char *invalid_char)
51{
52	size_t     tok_len;
53	size_t     str_len;
54	const char   *cut;
55
56	*invalid_char = '\0';
57
58	/* Return True if a token has the magic value "ALL". Return
59	 * FAIL if the token is "FAIL". If the token starts with a "."
60	 * (domain name), return True if it matches the last fields of
61	 * the string. If the token has the magic value "LOCAL",
62	 * return True if the string does not contain a "."
63	 * character. If the token ends on a "." (network number),
64	 * return True if it matches the first fields of the
65	 * string. If the token begins with a "@" (netgroup name),
66	 * return True if the string is a (host) member of the
67	 * netgroup. Return True if the token fully matches the
68	 * string. If the token is a netnumber/netmask pair, return
69	 * True if the address is a member of the specified subnet.
70	 */
71
72	if (tok[0] == '.') {			/* domain: match last fields */
73		if ((str_len = strlen(s)) > (tok_len = strlen(tok))
74		    && strequal(tok, s + str_len - tok_len))
75			return (True);
76	} else if (tok[0] == '@') { /* netgroup: look it up */
77#ifdef	HAVE_NETGROUP
78		static char *mydomain = NULL;
79		char *hostname = NULL;
80		BOOL netgroup_ok = False;
81
82		if (!mydomain)
83			yp_get_default_domain(&mydomain);
84
85		if (!mydomain) {
86			DEBUG(0,("Unable to get default yp domain. Try without it.\n"));
87		}
88		if (!(hostname = SMB_STRDUP(s))) {
89			DEBUG(1,("out of memory for strdup!\n"));
90			return False;
91		}
92
93		netgroup_ok = innetgr(tok + 1, hostname, (char *) 0, mydomain);
94
95		DEBUG(5,("looking for %s of domain %s in netgroup %s gave %s\n",
96			 hostname,
97			 mydomain?mydomain:"(ANY)",
98			 tok+1,
99			 BOOLSTR(netgroup_ok)));
100
101		SAFE_FREE(hostname);
102
103		if (netgroup_ok)
104			return(True);
105#else
106		DEBUG(0,("access: netgroup support is not configured\n"));
107		return (False);
108#endif
109	} else if (strequal(tok, "ALL")) {	/* all: match any */
110		return (True);
111	} else if (strequal(tok, "FAIL")) {	/* fail: match any */
112		return (FAIL);
113	} else if (strequal(tok, "LOCAL")) {	/* local: no dots */
114		if (strchr_m(s, '.') == 0 && !strequal(s, "unknown"))
115			return (True);
116	} else if (strequal(tok, s)) {   /* match host name or address */
117		return (True);
118	} else if (tok[(tok_len = strlen(tok)) - 1] == '.') {	/* network */
119		if (strncmp(tok, s, tok_len) == 0)
120			return (True);
121	} else if ((cut = strchr_m(tok, '/')) != 0) {	/* netnumber/netmask */
122		if (isdigit((int)s[0]) && masked_match(tok, cut, s))
123			return (True);
124	} else if (strchr_m(tok, '*') != 0) {
125		*invalid_char = '*';
126	} else if (strchr_m(tok, '?') != 0) {
127		*invalid_char = '?';
128	}
129	return (False);
130}
131
132/* client_match - match host name and address against token */
133static BOOL client_match(const char *tok, const char *item)
134{
135	const char **client = (const char **)item;
136	BOOL match;
137	char invalid_char = '\0';
138
139	/*
140	 * Try to match the address first. If that fails, try to match the host
141	 * name if available.
142	 */
143
144	if ((match = string_match(tok, client[1], &invalid_char)) == 0) {
145		if(invalid_char)
146			DEBUG(0,("client_match: address match failing due to invalid character '%c' found in \
147token '%s' in an allow/deny hosts line.\n", invalid_char, tok ));
148
149		if (client[0][0] != 0)
150			match = string_match(tok, client[0], &invalid_char);
151
152		if(invalid_char)
153			DEBUG(0,("client_match: address match failing due to invalid character '%c' found in \
154token '%s' in an allow/deny hosts line.\n", invalid_char, tok ));
155	}
156
157	return (match);
158}
159
160/* list_match - match an item against a list of tokens with exceptions */
161static BOOL list_match(const char **list,const char *item,
162		BOOL (*match_fn)(const char *, const char *))
163{
164	BOOL match = False;
165
166	if (!list)
167		return False;
168
169	/*
170	 * Process tokens one at a time. We have exhausted all possible matches
171	 * when we reach an "EXCEPT" token or the end of the list. If we do find
172	 * a match, look for an "EXCEPT" list and recurse to determine whether
173	 * the match is affected by any exceptions.
174	 */
175
176	for (; *list ; list++) {
177		if (strequal(*list, "EXCEPT"))	/* EXCEPT: give up */
178			break;
179		if ((match = (*match_fn) (*list, item)))	/* True or FAIL */
180			break;
181	}
182	/* Process exceptions to True or FAIL matches. */
183
184	if (match != False) {
185		while (*list  && !strequal(*list, "EXCEPT"))
186			list++;
187
188		for (; *list; list++) {
189			if ((*match_fn) (*list, item)) /* Exception Found */
190				return False;
191		}
192	}
193
194	return (match);
195}
196
197/* return true if access should be allowed */
198static BOOL allow_access_internal(const char **deny_list,const char **allow_list,
199			const char *cname, const char *caddr)
200{
201	const char *client[2];
202
203	client[0] = cname;
204	client[1] = caddr;
205
206	/* if it is loopback then always allow unless specifically denied */
207	if (strcmp(caddr, "127.0.0.1") == 0) {
208		/*
209		 * If 127.0.0.1 matches both allow and deny then allow.
210		 * Patch from Steve Langasek vorlon@netexpress.net.
211		 */
212		if (deny_list &&
213			list_match(deny_list,(const char *)client,client_match) &&
214				(!allow_list ||
215				!list_match(allow_list,(const char *)client, client_match))) {
216			return False;
217		}
218		return True;
219	}
220
221	/* if theres no deny list and no allow list then allow access */
222	if ((!deny_list || *deny_list == 0) &&
223	    (!allow_list || *allow_list == 0)) {
224		return(True);
225	}
226
227	/* if there is an allow list but no deny list then allow only hosts
228	   on the allow list */
229	if (!deny_list || *deny_list == 0)
230		return(list_match(allow_list,(const char *)client,client_match));
231
232	/* if theres a deny list but no allow list then allow
233	   all hosts not on the deny list */
234	if (!allow_list || *allow_list == 0)
235		return(!list_match(deny_list,(const char *)client,client_match));
236
237	/* if there are both types of list then allow all hosts on the
238           allow list */
239	if (list_match(allow_list,(const char *)client,client_match))
240		return (True);
241
242	/* if there are both types of list and it's not on the allow then
243	   allow it if its not on the deny */
244	if (list_match(deny_list,(const char *)client,client_match))
245		return (False);
246
247	return (True);
248}
249
250/* return true if access should be allowed */
251BOOL allow_access(const char **deny_list, const char **allow_list,
252		  const char *cname, const char *caddr)
253{
254	BOOL ret;
255	char *nc_cname = smb_xstrdup(cname);
256	char *nc_caddr = smb_xstrdup(caddr);
257
258	ret = allow_access_internal(deny_list, allow_list, nc_cname, nc_caddr);
259
260	SAFE_FREE(nc_cname);
261	SAFE_FREE(nc_caddr);
262	return ret;
263}
264
265/* return true if the char* contains ip addrs only.  Used to avoid
266gethostbyaddr() calls */
267
268static BOOL only_ipaddrs_in_list(const char** list)
269{
270	BOOL only_ip = True;
271
272	if (!list)
273		return True;
274
275	for (; *list ; list++) {
276		/* factor out the special strings */
277		if (strequal(*list, "ALL") || strequal(*list, "FAIL") ||
278		    strequal(*list, "EXCEPT")) {
279			continue;
280		}
281
282		if (!is_ipaddress(*list)) {
283			/*
284			 * if we failed, make sure that it was not because the token
285			 * was a network/netmask pair.  Only network/netmask pairs
286			 * have a '/' in them
287			 */
288			if ((strchr_m(*list, '/')) == NULL) {
289				only_ip = False;
290				DEBUG(3,("only_ipaddrs_in_list: list has non-ip address (%s)\n", *list));
291				break;
292			}
293		}
294	}
295
296	return only_ip;
297}
298
299/* return true if access should be allowed to a service for a socket */
300BOOL check_access(int sock, const char **allow_list, const char **deny_list)
301{
302	BOOL ret = False;
303	BOOL only_ip = False;
304
305	if ((!deny_list || *deny_list==0) && (!allow_list || *allow_list==0))
306		ret = True;
307
308	if (!ret) {
309		/* bypass gethostbyaddr() calls if the lists only contain IP addrs */
310		if (only_ipaddrs_in_list(allow_list) && only_ipaddrs_in_list(deny_list)) {
311			only_ip = True;
312			DEBUG (3, ("check_access: no hostnames in host allow/deny list.\n"));
313			ret = allow_access(deny_list,allow_list, "", get_peer_addr(sock));
314		} else {
315			DEBUG (3, ("check_access: hostnames in host allow/deny list.\n"));
316			ret = allow_access(deny_list,allow_list, get_peer_name(sock,True),
317					   get_peer_addr(sock));
318		}
319
320		if (ret) {
321			DEBUG(2,("Allowed connection from %s (%s)\n",
322				 only_ip ? "" : get_peer_name(sock,True),
323				 get_peer_addr(sock)));
324		} else {
325			DEBUG(0,("Denied connection from %s (%s)\n",
326				 only_ip ? "" : get_peer_name(sock,True),
327				 get_peer_addr(sock)));
328		}
329	}
330
331	return(ret);
332}
333