1178825Sdfr/************************************************************************ 2178825Sdfr* Copyright 1995 by Wietse Venema. All rights reserved. Some individual 3178825Sdfr* files may be covered by other copyrights. 4178825Sdfr* 5178825Sdfr* This material was originally written and compiled by Wietse Venema at 6178825Sdfr* Eindhoven University of Technology, The Netherlands, in 1990, 1991, 7178825Sdfr* 1992, 1993, 1994 and 1995. 8178825Sdfr* 9178825Sdfr* Redistribution and use in source and binary forms, with or without 10178825Sdfr* modification, are permitted provided that this entire copyright notice 11178825Sdfr* is duplicated in all such copies. 12178825Sdfr* 13178825Sdfr* This software is provided "as is" and without any expressed or implied 14178825Sdfr* warranties, including, without limitation, the implied warranties of 15178825Sdfr* merchantibility and fitness for any particular purpose. 16178825Sdfr************************************************************************/ 17178825Sdfr /* 18178825Sdfr * This module implements a simple but effective form of login access 19178825Sdfr * control based on login names and on host (or domain) names, internet 20178825Sdfr * addresses (or network numbers), or on terminal line names in case of 21178825Sdfr * non-networked logins. Diagnostics are reported through syslog(3). 22178825Sdfr * 23178825Sdfr * Author: Wietse Venema, Eindhoven University of Technology, The Netherlands. 24178825Sdfr */ 25178825Sdfr 26178825Sdfr#include "login_locl.h" 27178825Sdfr 28233294SstasRCSID("$Id$"); 29178825Sdfr 30178825Sdfr /* Delimiters for fields and for lists of users, ttys or hosts. */ 31178825Sdfr 32178825Sdfrstatic char fs[] = ":"; /* field separator */ 33178825Sdfrstatic char sep[] = ", \t"; /* list-element separator */ 34178825Sdfr 35178825Sdfr /* Constants to be used in assignments only, not in comparisons... */ 36178825Sdfr 37178825Sdfr#define YES 1 38178825Sdfr#define NO 0 39178825Sdfr 40178825Sdfr /* 41178825Sdfr * A structure to bundle up all login-related information to keep the 42178825Sdfr * functional interfaces as generic as possible. 43178825Sdfr */ 44178825Sdfrstruct login_info { 45178825Sdfr struct passwd *user; 46178825Sdfr char *from; 47178825Sdfr}; 48178825Sdfr 49178825Sdfrstatic int list_match(char *list, struct login_info *item, 50178825Sdfr int (*match_fn)(char *, struct login_info *)); 51178825Sdfrstatic int user_match(char *tok, struct login_info *item); 52178825Sdfrstatic int from_match(char *tok, struct login_info *item); 53178825Sdfrstatic int string_match(char *tok, char *string); 54178825Sdfr 55178825Sdfr/* login_access - match username/group and host/tty with access control file */ 56178825Sdfr 57178825Sdfrint login_access(struct passwd *user, char *from) 58178825Sdfr{ 59178825Sdfr struct login_info item; 60178825Sdfr FILE *fp; 61178825Sdfr char line[BUFSIZ]; 62178825Sdfr char *perm; /* becomes permission field */ 63178825Sdfr char *users; /* becomes list of login names */ 64178825Sdfr char *froms; /* becomes list of terminals or hosts */ 65178825Sdfr int match = NO; 66178825Sdfr int end; 67178825Sdfr int lineno = 0; /* for diagnostics */ 68178825Sdfr char *foo; 69178825Sdfr 70178825Sdfr /* 71178825Sdfr * Bundle up the arguments to avoid unnecessary clumsiness lateron. 72178825Sdfr */ 73178825Sdfr item.user = user; 74178825Sdfr item.from = from; 75178825Sdfr 76178825Sdfr /* 77178825Sdfr * Process the table one line at a time and stop at the first match. 78178825Sdfr * Blank lines and lines that begin with a '#' character are ignored. 79178825Sdfr * Non-comment lines are broken at the ':' character. All fields are 80178825Sdfr * mandatory. The first field should be a "+" or "-" character. A 81178825Sdfr * non-existing table means no access control. 82178825Sdfr */ 83178825Sdfr 84178825Sdfr if ((fp = fopen(_PATH_LOGACCESS, "r")) != 0) { 85178825Sdfr while (!match && fgets(line, sizeof(line), fp)) { 86178825Sdfr lineno++; 87178825Sdfr if (line[end = strlen(line) - 1] != '\n') { 88178825Sdfr syslog(LOG_ERR, "%s: line %d: missing newline or line too long", 89178825Sdfr _PATH_LOGACCESS, lineno); 90178825Sdfr continue; 91178825Sdfr } 92178825Sdfr if (line[0] == '#') 93178825Sdfr continue; /* comment line */ 94178825Sdfr while (end > 0 && isspace((unsigned char)line[end - 1])) 95178825Sdfr end--; 96178825Sdfr line[end] = 0; /* strip trailing whitespace */ 97178825Sdfr if (line[0] == 0) /* skip blank lines */ 98178825Sdfr continue; 99178825Sdfr foo = NULL; 100178825Sdfr if (!(perm = strtok_r(line, fs, &foo)) 101178825Sdfr || !(users = strtok_r(NULL, fs, &foo)) 102178825Sdfr || !(froms = strtok_r(NULL, fs, &foo)) 103178825Sdfr || strtok_r(NULL, fs, &foo)) { 104233294Sstas syslog(LOG_ERR, "%s: line %d: bad field count", 105178825Sdfr _PATH_LOGACCESS, 106178825Sdfr lineno); 107178825Sdfr continue; 108178825Sdfr } 109178825Sdfr if (perm[0] != '+' && perm[0] != '-') { 110233294Sstas syslog(LOG_ERR, "%s: line %d: bad first field", 111178825Sdfr _PATH_LOGACCESS, 112178825Sdfr lineno); 113178825Sdfr continue; 114178825Sdfr } 115178825Sdfr match = (list_match(froms, &item, from_match) 116178825Sdfr && list_match(users, &item, user_match)); 117178825Sdfr } 118178825Sdfr fclose(fp); 119178825Sdfr } else if (errno != ENOENT) { 120178825Sdfr syslog(LOG_ERR, "cannot open %s: %m", _PATH_LOGACCESS); 121178825Sdfr } 122178825Sdfr return (match == 0 || (line[0] == '+')); 123178825Sdfr} 124178825Sdfr 125178825Sdfr/* list_match - match an item against a list of tokens with exceptions */ 126178825Sdfr 127178825Sdfrstatic int 128178825Sdfrlist_match(char *list, 129178825Sdfr struct login_info *item, 130178825Sdfr int (*match_fn)(char *, struct login_info *)) 131178825Sdfr{ 132178825Sdfr char *tok; 133178825Sdfr int match = NO; 134178825Sdfr char *foo = NULL; 135178825Sdfr 136178825Sdfr /* 137178825Sdfr * Process tokens one at a time. We have exhausted all possible matches 138178825Sdfr * when we reach an "EXCEPT" token or the end of the list. If we do find 139178825Sdfr * a match, look for an "EXCEPT" list and recurse to determine whether 140178825Sdfr * the match is affected by any exceptions. 141178825Sdfr */ 142178825Sdfr 143178825Sdfr for (tok = strtok_r(list, sep, &foo); 144178825Sdfr tok != NULL; 145178825Sdfr tok = strtok_r(NULL, sep, &foo)) { 146178825Sdfr if (strcasecmp(tok, "EXCEPT") == 0) /* EXCEPT: give up */ 147178825Sdfr break; 148178825Sdfr if ((match = (*match_fn) (tok, item)) != 0) /* YES */ 149178825Sdfr break; 150178825Sdfr } 151178825Sdfr /* Process exceptions to matches. */ 152178825Sdfr 153178825Sdfr if (match != NO) { 154178825Sdfr while ((tok = strtok_r(NULL, sep, &foo)) && strcasecmp(tok, "EXCEPT")) 155178825Sdfr /* VOID */ ; 156178825Sdfr if (tok == 0 || list_match(NULL, item, match_fn) == NO) 157178825Sdfr return (match); 158178825Sdfr } 159178825Sdfr return (NO); 160178825Sdfr} 161178825Sdfr 162178825Sdfr/* myhostname - figure out local machine name */ 163178825Sdfr 164178825Sdfrstatic char *myhostname(void) 165178825Sdfr{ 166178825Sdfr static char name[MAXHOSTNAMELEN + 1] = ""; 167178825Sdfr 168178825Sdfr if (name[0] == 0) { 169178825Sdfr gethostname(name, sizeof(name)); 170178825Sdfr name[MAXHOSTNAMELEN] = 0; 171178825Sdfr } 172178825Sdfr return (name); 173178825Sdfr} 174178825Sdfr 175178825Sdfr/* netgroup_match - match group against machine or user */ 176178825Sdfr 177178825Sdfrstatic int netgroup_match(char *group, char *machine, char *user) 178178825Sdfr{ 179178825Sdfr#ifdef HAVE_YP_GET_DEFAULT_DOMAIN 180178825Sdfr static char *mydomain = 0; 181178825Sdfr 182178825Sdfr if (mydomain == 0) 183178825Sdfr yp_get_default_domain(&mydomain); 184178825Sdfr return (innetgr(group, machine, user, mydomain)); 185178825Sdfr#else 186178825Sdfr syslog(LOG_ERR, "NIS netgroup support not configured"); 187178825Sdfr return 0; 188178825Sdfr#endif 189178825Sdfr} 190178825Sdfr 191178825Sdfr/* user_match - match a username against one token */ 192178825Sdfr 193178825Sdfrstatic int user_match(char *tok, struct login_info *item) 194178825Sdfr{ 195178825Sdfr char *string = item->user->pw_name; 196178825Sdfr struct login_info fake_item; 197178825Sdfr struct group *group; 198178825Sdfr int i; 199178825Sdfr char *at; 200178825Sdfr 201178825Sdfr /* 202178825Sdfr * If a token has the magic value "ALL" the match always succeeds. 203178825Sdfr * Otherwise, return YES if the token fully matches the username, if the 204178825Sdfr * token is a group that contains the username, or if the token is the 205178825Sdfr * name of the user's primary group. 206178825Sdfr */ 207178825Sdfr 208178825Sdfr if ((at = strchr(tok + 1, '@')) != 0) { /* split user@host pattern */ 209178825Sdfr *at = 0; 210178825Sdfr fake_item.from = myhostname(); 211178825Sdfr return (user_match(tok, item) && from_match(at + 1, &fake_item)); 212178825Sdfr } else if (tok[0] == '@') { /* netgroup */ 213178825Sdfr return (netgroup_match(tok + 1, (char *) 0, string)); 214178825Sdfr } else if (string_match(tok, string)) { /* ALL or exact match */ 215178825Sdfr return (YES); 216178825Sdfr } else if ((group = getgrnam(tok)) != 0) { /* try group membership */ 217178825Sdfr if (item->user->pw_gid == group->gr_gid) 218178825Sdfr return (YES); 219178825Sdfr for (i = 0; group->gr_mem[i]; i++) 220178825Sdfr if (strcasecmp(string, group->gr_mem[i]) == 0) 221178825Sdfr return (YES); 222178825Sdfr } 223178825Sdfr return (NO); 224178825Sdfr} 225178825Sdfr 226178825Sdfr/* from_match - match a host or tty against a list of tokens */ 227178825Sdfr 228178825Sdfrstatic int from_match(char *tok, struct login_info *item) 229178825Sdfr{ 230178825Sdfr char *string = item->from; 231178825Sdfr int tok_len; 232178825Sdfr int str_len; 233178825Sdfr 234178825Sdfr /* 235178825Sdfr * If a token has the magic value "ALL" the match always succeeds. Return 236178825Sdfr * YES if the token fully matches the string. If the token is a domain 237178825Sdfr * name, return YES if it matches the last fields of the string. If the 238178825Sdfr * token has the magic value "LOCAL", return YES if the string does not 239178825Sdfr * contain a "." character. If the token is a network number, return YES 240178825Sdfr * if it matches the head of the string. 241178825Sdfr */ 242178825Sdfr 243178825Sdfr if (tok[0] == '@') { /* netgroup */ 244178825Sdfr return (netgroup_match(tok + 1, string, (char *) 0)); 245178825Sdfr } else if (string_match(tok, string)) { /* ALL or exact match */ 246178825Sdfr return (YES); 247178825Sdfr } else if (tok[0] == '.') { /* domain: match last fields */ 248178825Sdfr if ((str_len = strlen(string)) > (tok_len = strlen(tok)) 249178825Sdfr && strcasecmp(tok, string + str_len - tok_len) == 0) 250178825Sdfr return (YES); 251178825Sdfr } else if (strcasecmp(tok, "LOCAL") == 0) { /* local: no dots */ 252178825Sdfr if (strchr(string, '.') == 0) 253178825Sdfr return (YES); 254178825Sdfr } else if (tok[(tok_len = strlen(tok)) - 1] == '.' /* network */ 255178825Sdfr && strncmp(tok, string, tok_len) == 0) { 256178825Sdfr return (YES); 257178825Sdfr } 258178825Sdfr return (NO); 259178825Sdfr} 260178825Sdfr 261178825Sdfr/* string_match - match a string against one token */ 262178825Sdfr 263178825Sdfrstatic int string_match(char *tok, char *string) 264178825Sdfr{ 265178825Sdfr 266178825Sdfr /* 267178825Sdfr * If the token has the magic value "ALL" the match always succeeds. 268178825Sdfr * Otherwise, return YES if the token fully matches the string. 269178825Sdfr */ 270178825Sdfr 271178825Sdfr if (strcasecmp(tok, "ALL") == 0) { /* all: always matches */ 272178825Sdfr return (YES); 273178825Sdfr } else if (strcasecmp(tok, string) == 0) { /* try exact match */ 274178825Sdfr return (YES); 275178825Sdfr } 276178825Sdfr return (NO); 277178825Sdfr} 278