1/*
2   This module is an adaption of code from the tcpd-1.4 package written
3   by Wietse Venema, Eindhoven University of Technology, The Netherlands.
4
5   The code is used here with permission.
6
7   The code has been considerably changed from the original. Bug reports
8   should be sent to samba@samba.org
9*/
10
11#include "includes.h"
12
13#define	FAIL		(-1)
14
15#define ALLONES  ((uint32)0xFFFFFFFF)
16
17/* masked_match - match address against netnumber/netmask */
18static BOOL masked_match(const char *tok, const char *slash, const char *s)
19{
20	uint32 net;
21	uint32 mask;
22	uint32 addr;
23	fstring tok_cpy;
24
25	if ((addr = interpret_addr(s)) == INADDR_NONE)
26		return (False);
27
28	fstrcpy(tok_cpy, tok);
29	tok_cpy[PTR_DIFF(slash,tok)] = '\0';
30	net = interpret_addr(tok_cpy);
31	tok_cpy[PTR_DIFF(slash,tok)] = '/';
32
33        if (strlen(slash + 1) > 2) {
34                mask = interpret_addr(slash + 1);
35        } else {
36		mask = (uint32)((ALLONES >> atoi(slash + 1)) ^ ALLONES);
37		/* convert to network byte order */
38		mask = htonl(mask);
39        }
40
41	if (net == INADDR_NONE || mask == INADDR_NONE) {
42		DEBUG(0,("access: bad net/mask access control: %s\n", tok));
43		return (False);
44	}
45
46	return ((addr & mask) == (net & mask));
47}
48
49/* string_match - match string against token */
50static BOOL string_match(const char *tok,const char *s, char *invalid_char)
51{
52	size_t     tok_len;
53	size_t     str_len;
54	const char   *cut;
55
56	*invalid_char = '\0';
57
58	/* Return True if a token has the magic value "ALL". Return
59	 * FAIL if the token is "FAIL". If the token starts with a "."
60	 * (domain name), return True if it matches the last fields of
61	 * the string. If the token has the magic value "LOCAL",
62	 * return True if the string does not contain a "."
63	 * character. If the token ends on a "." (network number),
64	 * return True if it matches the first fields of the
65	 * string. If the token begins with a "@" (netgroup name),
66	 * return True if the string is a (host) member of the
67	 * netgroup. Return True if the token fully matches the
68	 * string. If the token is a netnumber/netmask pair, return
69	 * True if the address is a member of the specified subnet.
70	 */
71
72	if (tok[0] == '.') {			/* domain: match last fields */
73		if ((str_len = strlen(s)) > (tok_len = strlen(tok))
74		    && strequal(tok, s + str_len - tok_len))
75			return (True);
76	} else if (tok[0] == '@') { /* netgroup: look it up */
77#ifdef	HAVE_NETGROUP
78		static char *mydomain = NULL;
79		char *hostname = NULL;
80		BOOL netgroup_ok = False;
81
82		if (!mydomain)
83			yp_get_default_domain(&mydomain);
84
85		if (!mydomain) {
86			DEBUG(0,("Unable to get default yp domain.\n"));
87			return False;
88		}
89		if (!(hostname = SMB_STRDUP(s))) {
90			DEBUG(1,("out of memory for strdup!\n"));
91			return False;
92		}
93
94		netgroup_ok = innetgr(tok + 1, hostname, (char *) 0, mydomain);
95
96		DEBUG(5,("looking for %s of domain %s in netgroup %s gave %s\n",
97			 hostname,
98			 mydomain,
99			 tok+1,
100			 BOOLSTR(netgroup_ok)));
101
102		SAFE_FREE(hostname);
103
104		if (netgroup_ok)
105			return(True);
106#else
107		DEBUG(0,("access: netgroup support is not configured\n"));
108		return (False);
109#endif
110	} else if (strequal(tok, "ALL")) {	/* all: match any */
111		return (True);
112	} else if (strequal(tok, "FAIL")) {	/* fail: match any */
113		return (FAIL);
114	} else if (strequal(tok, "LOCAL")) {	/* local: no dots */
115		if (strchr_m(s, '.') == 0 && !strequal(s, "unknown"))
116			return (True);
117	} else if (strequal(tok, s)) {   /* match host name or address */
118		return (True);
119	} else if (tok[(tok_len = strlen(tok)) - 1] == '.') {	/* network */
120		if (strncmp(tok, s, tok_len) == 0)
121			return (True);
122	} else if ((cut = strchr_m(tok, '/')) != 0) {	/* netnumber/netmask */
123		if (isdigit((int)s[0]) && masked_match(tok, cut, s))
124			return (True);
125	} else if (strchr_m(tok, '*') != 0) {
126		*invalid_char = '*';
127	} else if (strchr_m(tok, '?') != 0) {
128		*invalid_char = '?';
129	}
130	return (False);
131}
132
133/* client_match - match host name and address against token */
134static BOOL client_match(const char *tok, const char *item)
135{
136	const char **client = (const char **)item;
137	BOOL match;
138	char invalid_char = '\0';
139
140	/*
141	 * Try to match the address first. If that fails, try to match the host
142	 * name if available.
143	 */
144
145	if ((match = string_match(tok, client[1], &invalid_char)) == 0) {
146		if(invalid_char)
147			DEBUG(0,("client_match: address match failing due to invalid character '%c' found in \
148token '%s' in an allow/deny hosts line.\n", invalid_char, tok ));
149
150		if (client[0][0] != 0)
151			match = string_match(tok, client[0], &invalid_char);
152
153		if(invalid_char)
154			DEBUG(0,("client_match: address match failing due to invalid character '%c' found in \
155token '%s' in an allow/deny hosts line.\n", invalid_char, tok ));
156	}
157
158	return (match);
159}
160
161/* list_match - match an item against a list of tokens with exceptions */
162static BOOL list_match(const char **list,const char *item,
163		BOOL (*match_fn)(const char *, const char *))
164{
165	BOOL match = False;
166
167	if (!list)
168		return False;
169
170	/*
171	 * Process tokens one at a time. We have exhausted all possible matches
172	 * when we reach an "EXCEPT" token or the end of the list. If we do find
173	 * a match, look for an "EXCEPT" list and recurse to determine whether
174	 * the match is affected by any exceptions.
175	 */
176
177	for (; *list ; list++) {
178		if (strequal(*list, "EXCEPT"))	/* EXCEPT: give up */
179			break;
180		if ((match = (*match_fn) (*list, item)))	/* True or FAIL */
181			break;
182	}
183	/* Process exceptions to True or FAIL matches. */
184
185	if (match != False) {
186		while (*list  && !strequal(*list, "EXCEPT"))
187			list++;
188
189		for (; *list; list++) {
190			if ((*match_fn) (*list, item)) /* Exception Found */
191				return False;
192		}
193	}
194
195	return (match);
196}
197
198/* return true if access should be allowed */
199static BOOL allow_access_internal(const char **deny_list,const char **allow_list,
200			const char *cname, const char *caddr)
201{
202	const char *client[2];
203
204	client[0] = cname;
205	client[1] = caddr;
206
207	/* if it is loopback then always allow unless specifically denied */
208	if (strcmp(caddr, "127.0.0.1") == 0) {
209		/*
210		 * If 127.0.0.1 matches both allow and deny then allow.
211		 * Patch from Steve Langasek vorlon@netexpress.net.
212		 */
213		if (deny_list &&
214			list_match(deny_list,(const char *)client,client_match) &&
215				(!allow_list ||
216				!list_match(allow_list,(const char *)client, client_match))) {
217			return False;
218		}
219		return True;
220	}
221
222	/* if theres no deny list and no allow list then allow access */
223	if ((!deny_list || *deny_list == 0) &&
224	    (!allow_list || *allow_list == 0)) {
225		return(True);
226	}
227
228	/* if there is an allow list but no deny list then allow only hosts
229	   on the allow list */
230	if (!deny_list || *deny_list == 0)
231		return(list_match(allow_list,(const char *)client,client_match));
232
233	/* if theres a deny list but no allow list then allow
234	   all hosts not on the deny list */
235	if (!allow_list || *allow_list == 0)
236		return(!list_match(deny_list,(const char *)client,client_match));
237
238	/* if there are both types of list then allow all hosts on the
239           allow list */
240	if (list_match(allow_list,(const char *)client,client_match))
241		return (True);
242
243	/* if there are both types of list and it's not on the allow then
244	   allow it if its not on the deny */
245	if (list_match(deny_list,(const char *)client,client_match))
246		return (False);
247
248	return (True);
249}
250
251/* return true if access should be allowed */
252BOOL allow_access(const char **deny_list, const char **allow_list,
253		  const char *cname, const char *caddr)
254{
255	BOOL ret;
256	char *nc_cname = smb_xstrdup(cname);
257	char *nc_caddr = smb_xstrdup(caddr);
258
259	ret = allow_access_internal(deny_list, allow_list, nc_cname, nc_caddr);
260
261	SAFE_FREE(nc_cname);
262	SAFE_FREE(nc_caddr);
263	return ret;
264}
265
266/* return true if the char* contains ip addrs only.  Used to avoid
267gethostbyaddr() calls */
268
269static BOOL only_ipaddrs_in_list(const char** list)
270{
271	BOOL only_ip = True;
272
273	if (!list)
274		return True;
275
276	for (; *list ; list++) {
277		/* factor out the special strings */
278		if (strequal(*list, "ALL") || strequal(*list, "FAIL") ||
279		    strequal(*list, "EXCEPT")) {
280			continue;
281		}
282
283		if (!is_ipaddress(*list)) {
284			/*
285			 * if we failed, make sure that it was not because the token
286			 * was a network/netmask pair.  Only network/netmask pairs
287			 * have a '/' in them
288			 */
289			if ((strchr_m(*list, '/')) == NULL) {
290				only_ip = False;
291				DEBUG(3,("only_ipaddrs_in_list: list has non-ip address (%s)\n", *list));
292				break;
293			}
294		}
295	}
296
297	return only_ip;
298}
299
300/* return true if access should be allowed to a service for a socket */
301BOOL check_access(int sock, const char **allow_list, const char **deny_list)
302{
303	BOOL ret = False;
304	BOOL only_ip = False;
305
306	if ((!deny_list || *deny_list==0) && (!allow_list || *allow_list==0))
307		ret = True;
308
309	if (!ret) {
310		/* bypass gethostbyaddr() calls if the lists only contain IP addrs */
311		if (only_ipaddrs_in_list(allow_list) && only_ipaddrs_in_list(deny_list)) {
312			only_ip = True;
313			DEBUG (3, ("check_access: no hostnames in host allow/deny list.\n"));
314			ret = allow_access(deny_list,allow_list, "", get_peer_addr(sock));
315		} else {
316			DEBUG (3, ("check_access: hostnames in host allow/deny list.\n"));
317			ret = allow_access(deny_list,allow_list, get_peer_name(sock,True),
318					   get_peer_addr(sock));
319		}
320
321		if (ret) {
322			DEBUG(2,("Allowed connection from %s (%s)\n",
323				 only_ip ? "" : get_peer_name(sock,True),
324				 get_peer_addr(sock)));
325		} else {
326			DEBUG(0,("Denied connection from %s (%s)\n",
327				 only_ip ? "" : get_peer_name(sock,True),
328				 get_peer_addr(sock)));
329		}
330	}
331
332	return(ret);
333}
334