acl_list.c revision 269257 
1/*
2 * daemon/acl_list.h - client access control storage for the server.
3 *
4 * Copyright (c) 2007, NLnet Labs. All rights reserved.
5 *
6 * This software is open source.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * Redistributions of source code must retain the above copyright notice,
13 * this list of conditions and the following disclaimer.
14 *
15 * Redistributions in binary form must reproduce the above copyright notice,
16 * this list of conditions and the following disclaimer in the documentation
17 * and/or other materials provided with the distribution.
18 *
19 * Neither the name of the NLNET LABS nor the names of its contributors may
20 * be used to endorse or promote products derived from this software without
21 * specific prior written permission.
22 *
23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34 */
35
36/**
37 * \file
38 *
39 * This file helps the server keep out queries from outside sources, that
40 * should not be answered.
41 */
42#include "config.h"
43#include "daemon/acl_list.h"
44#include "util/regional.h"
45#include "util/log.h"
46#include "util/config_file.h"
47#include "util/net_help.h"
48
49struct acl_list*
50acl_list_create(void)
51{
52	struct acl_list* acl = (struct acl_list*)calloc(1,
53		sizeof(struct acl_list));
54	if(!acl)
55		return NULL;
56	acl->region = regional_create();
57	if(!acl->region) {
58		acl_list_delete(acl);
59		return NULL;
60	}
61	return acl;
62}
63
64void
65acl_list_delete(struct acl_list* acl)
66{
67	if(!acl)
68		return;
69	regional_destroy(acl->region);
70	free(acl);
71}
72
73/** insert new address into acl_list structure */
74static int
75acl_list_insert(struct acl_list* acl, struct sockaddr_storage* addr,
76	socklen_t addrlen, int net, enum acl_access control,
77	int complain_duplicates)
78{
79	struct acl_addr* node = regional_alloc(acl->region,
80		sizeof(struct acl_addr));
81	if(!node)
82		return 0;
83	node->control = control;
84	if(!addr_tree_insert(&acl->tree, &node->node, addr, addrlen, net)) {
85		if(complain_duplicates)
86			verbose(VERB_QUERY, "duplicate acl address ignored.");
87	}
88	return 1;
89}
90
91/** apply acl_list string */
92static int
93acl_list_str_cfg(struct acl_list* acl, const char* str, const char* s2,
94	int complain_duplicates)
95{
96	struct sockaddr_storage addr;
97	int net;
98	socklen_t addrlen;
99	enum acl_access control;
100	if(strcmp(s2, "allow") == 0)
101		control = acl_allow;
102	else if(strcmp(s2, "deny") == 0)
103		control = acl_deny;
104	else if(strcmp(s2, "refuse") == 0)
105		control = acl_refuse;
106	else if(strcmp(s2, "deny_non_local") == 0)
107		control = acl_deny_non_local;
108	else if(strcmp(s2, "refuse_non_local") == 0)
109		control = acl_refuse_non_local;
110	else if(strcmp(s2, "allow_snoop") == 0)
111		control = acl_allow_snoop;
112	else {
113		log_err("access control type %s unknown", str);
114		return 0;
115	}
116	if(!netblockstrtoaddr(str, UNBOUND_DNS_PORT, &addr, &addrlen, &net)) {
117		log_err("cannot parse access control: %s %s", str, s2);
118		return 0;
119	}
120	if(!acl_list_insert(acl, &addr, addrlen, net, control,
121		complain_duplicates)) {
122		log_err("out of memory");
123		return 0;
124	}
125	return 1;
126}
127
128/** read acl_list config */
129static int
130read_acl_list(struct acl_list* acl, struct config_file* cfg)
131{
132	struct config_str2list* p;
133	for(p = cfg->acls; p; p = p->next) {
134		log_assert(p->str && p->str2);
135		if(!acl_list_str_cfg(acl, p->str, p->str2, 1))
136			return 0;
137	}
138	return 1;
139}
140
141int
142acl_list_apply_cfg(struct acl_list* acl, struct config_file* cfg)
143{
144	regional_free_all(acl->region);
145	addr_tree_init(&acl->tree);
146	if(!read_acl_list(acl, cfg))
147		return 0;
148	/* insert defaults, with '0' to ignore them if they are duplicates */
149	if(!acl_list_str_cfg(acl, "0.0.0.0/0", "refuse", 0))
150		return 0;
151	if(!acl_list_str_cfg(acl, "127.0.0.0/8", "allow", 0))
152		return 0;
153	if(cfg->do_ip6) {
154		if(!acl_list_str_cfg(acl, "::0/0", "refuse", 0))
155			return 0;
156		if(!acl_list_str_cfg(acl, "::1", "allow", 0))
157			return 0;
158		if(!acl_list_str_cfg(acl, "::ffff:127.0.0.1", "allow", 0))
159			return 0;
160	}
161	addr_tree_init_parents(&acl->tree);
162	return 1;
163}
164
165enum acl_access
166acl_list_lookup(struct acl_list* acl, struct sockaddr_storage* addr,
167        socklen_t addrlen)
168{
169	struct acl_addr* r = (struct acl_addr*)addr_tree_lookup(&acl->tree,
170		addr, addrlen);
171	if(r) return r->control;
172	return acl_deny;
173}
174
175size_t
176acl_list_get_mem(struct acl_list* acl)
177{
178	if(!acl) return 0;
179	return sizeof(*acl) + regional_get_mem(acl->region);
180}
181