1  /*
2   * This module implements a simple access control language that is based on
3   * host (or domain) names, NIS (host) netgroup names, IP addresses (or
4   * network numbers) and daemon process names. When a match is found the
5   * search is terminated, and depending on whether PROCESS_OPTIONS is defined,
6   * a list of options is executed or an optional shell command is executed.
7   *
8   * Host and user names are looked up on demand, provided that suitable endpoint
9   * information is available as sockaddr_in structures or TLI netbufs. As a
10   * side effect, the pattern matching process may change the contents of
11   * request structure fields.
12   *
13   * Diagnostics are reported through syslog(3).
14   *
15   * Compile with -DNETGROUP if your library provides support for netgroups.
16   *
17   * Author: Wietse Venema, Eindhoven University of Technology, The Netherlands.
18   *
19   * $FreeBSD: src/contrib/tcp_wrappers/hosts_access.c,v 1.3.2.1 2000/07/18 08:34:54 ume Exp $
20   */
21 
22 #ifndef lint
23 static char sccsid[] = "@(#) hosts_access.c 1.21 97/02/12 02:13:22";
24 #endif
25 
26 /* System libraries. */
27 
28 #include <sys/types.h>
29 #ifdef INT32_T
30     typedef uint32_t u_int32_t;
31 #endif
32 #include <sys/param.h>
33 #ifdef INET6
34 #include <sys/socket.h>
35 #endif
36 #include <netinet/in.h>
37 #include <arpa/inet.h>
38 #include <stdio.h>
39 #include <syslog.h>
40 #include <ctype.h>
41 #include <errno.h>
42 #include <setjmp.h>
43 #include <string.h>
44 #ifdef INET6
45 #include <netdb.h>
46 #endif
47 
48 extern char *fgets();
49 extern int errno;
50 
51 #ifndef	INADDR_NONE
52 #define	INADDR_NONE	(-1)		/* XXX should be 0xffffffff */
53 #endif
54 
55 /* Local stuff. */
56 
57 #include "tcpd.h"
58 
59 /* Error handling. */
60 
61 extern jmp_buf tcpd_buf;
62 
63 /* Delimiters for lists of daemons or clients. */
64 
65 static char sep[] = ", \t\r\n";
66 
67 /* Constants to be used in assignments only, not in comparisons... */
68 
69 #define	YES		1
70 #define	NO		0
71 
72  /*
73   * These variables are globally visible so that they can be redirected in
74   * verification mode.
75   */
76 
77 char   *hosts_allow_table = HOSTS_ALLOW;
78 char   *hosts_deny_table = HOSTS_DENY;
79 int     hosts_access_verbose = 0;
80 
81  /*
82   * In a long-running process, we are not at liberty to just go away.
83   */
84 
85 int     resident = (-1);		/* -1, 0: unknown; +1: yes */
86 
87 /* Forward declarations. */
88 
89 static int table_match();
90 static int list_match();
91 static int server_match();
92 static int client_match();
93 static int host_match();
94 static int string_match();
95 static int masked_match();
96 #ifdef INET6
97 static int masked_match4();
98 static int masked_match6();
99 #endif
100 
101 /* Size of logical line buffer. */
102 
103 #define	BUFLEN 2048
104 
105 /* hosts_access - host access control facility */
106 
107 int     hosts_access(request)
108 struct request_info *request;
109 {
110     int     verdict;
111 
112     /*
113      * If the (daemon, client) pair is matched by an entry in the file
114      * /etc/hosts.allow, access is granted. Otherwise, if the (daemon,
115      * client) pair is matched by an entry in the file /etc/hosts.deny,
116      * access is denied. Otherwise, access is granted. A non-existent
117      * access-control file is treated as an empty file.
118      *
119      * After a rule has been matched, the optional language extensions may
120      * decide to grant or refuse service anyway. Or, while a rule is being
121      * processed, a serious error is found, and it seems better to play safe
122      * and deny service. All this is done by jumping back into the
123      * hosts_access() routine, bypassing the regular return from the
124      * table_match() function calls below.
125      */
126 
127     if (resident <= 0)
128 	resident++;
129     verdict = setjmp(tcpd_buf);
130     if (verdict != 0)
131 	return (verdict == AC_PERMIT);
132     if (table_match(hosts_allow_table, request))
133 	return (YES);
134     if (table_match(hosts_deny_table, request))
135 	return (NO);
136     return (YES);
137 }
138 
139 /* table_match - match table entries with (daemon, client) pair */
140 
141 static int table_match(table, request)
142 char   *table;
143 struct request_info *request;
144 {
145     FILE   *fp;
146     char    sv_list[BUFLEN];		/* becomes list of daemons */
147     char   *cl_list;			/* becomes list of clients */
148     char   *sh_cmd;			/* becomes optional shell command */
149     int     match = NO;
150     struct tcpd_context saved_context;
151 
152     saved_context = tcpd_context;		/* stupid compilers */
153 
154     /*
155      * Between the fopen() and fclose() calls, avoid jumps that may cause
156      * file descriptor leaks.
157      */
158 
159     if ((fp = fopen(table, "r")) != 0) {
160 	tcpd_context.file = table;
161 	tcpd_context.line = 0;
162 	while (match == NO && xgets(sv_list, sizeof(sv_list), fp) != 0) {
163 	    if (sv_list[strlen(sv_list) - 1] != '\n') {
164 		tcpd_warn("missing newline or line too long");
165 		continue;
166 	    }
167 	    if (sv_list[0] == '#' || sv_list[strspn(sv_list, " \t\r\n")] == 0)
168 		continue;
169 	    if ((cl_list = split_at(sv_list, ':')) == 0) {
170 		tcpd_warn("missing \":\" separator");
171 		continue;
172 	    }
173 	    sh_cmd = split_at(cl_list, ':');
174 	    match = list_match(sv_list, request, server_match)
175 		&& list_match(cl_list, request, client_match);
176 	}
177 	(void) fclose(fp);
178     } else if (errno != ENOENT) {
179 	tcpd_warn("cannot open %s: %m", table);
180     }
181     if (match) {
182 	if (hosts_access_verbose > 1)
183 	    syslog(LOG_DEBUG, "matched:  %s line %d",
184 		   tcpd_context.file, tcpd_context.line);
185 	if (sh_cmd) {
186 #ifdef PROCESS_OPTIONS
187 	    process_options(sh_cmd, request);
188 #else
189 	    char    cmd[BUFSIZ];
190 	    shell_cmd(percent_x(cmd, sizeof(cmd), sh_cmd, request));
191 #endif
192 	}
193     }
194     tcpd_context = saved_context;
195     return (match);
196 }
197 
198 /* list_match - match a request against a list of patterns with exceptions */
199 
200 static int list_match(list, request, match_fn)
201 char   *list;
202 struct request_info *request;
203 int   (*match_fn) ();
204 {
205     char   *tok;
206 
207     /*
208      * Process tokens one at a time. We have exhausted all possible matches
209      * when we reach an "EXCEPT" token or the end of the list. If we do find
210      * a match, look for an "EXCEPT" list and recurse to determine whether
211      * the match is affected by any exceptions.
212      */
213 
214     for (tok = strtok(list, sep); tok != 0; tok = strtok((char *) 0, sep)) {
215 	if (STR_EQ(tok, "EXCEPT"))		/* EXCEPT: give up */
216 	    return (NO);
217 	if (match_fn(tok, request)) {		/* YES: look for exceptions */
218 	    while ((tok = strtok((char *) 0, sep)) && STR_NE(tok, "EXCEPT"))
219 		 /* VOID */ ;
220 	    return (tok == 0 || list_match((char *) 0, request, match_fn) == 0);
221 	}
222     }
223     return (NO);
224 }
225 
226 /* server_match - match server information */
227 
228 static int server_match(tok, request)
229 char   *tok;
230 struct request_info *request;
231 {
232     char   *host;
233 
234     if ((host = split_at(tok + 1, '@')) == 0) {	/* plain daemon */
235 	return (string_match(tok, eval_daemon(request)));
236     } else {					/* daemon@host */
237 	return (string_match(tok, eval_daemon(request))
238 		&& host_match(host, request->server));
239     }
240 }
241 
242 /* client_match - match client information */
243 
244 static int client_match(tok, request)
245 char   *tok;
246 struct request_info *request;
247 {
248     char   *host;
249 
250     if ((host = split_at(tok + 1, '@')) == 0) {	/* plain host */
251 	return (host_match(tok, request->client));
252     } else {					/* user@host */
253 	return (host_match(host, request->client)
254 		&& string_match(tok, eval_user(request)));
255     }
256 }
257 
258 /* hostfile_match - look up host patterns from file */
259 
260 static int hostfile_match(path, host)
261 char   *path;
262 struct hosts_info *host;
263 {
264     char    tok[BUFSIZ];
265     int     match = NO;
266     FILE   *fp;
267 
268     if ((fp = fopen(path, "r")) != 0) {
269 	while (fscanf(fp, "%s", tok) == 1 && !(match = host_match(tok, host)))
270 	     /* void */ ;
271 	fclose(fp);
272     } else if (errno != ENOENT) {
273 	tcpd_warn("open %s: %m", path);
274     }
275     return (match);
276 }
277 
278 /* host_match - match host name and/or address against pattern */
279 
280 static int host_match(tok, host)
281 char   *tok;
282 struct host_info *host;
283 {
284     char   *mask;
285 
286     /*
287      * This code looks a little hairy because we want to avoid unnecessary
288      * hostname lookups.
289      *
290      * The KNOWN pattern requires that both address AND name be known; some
291      * patterns are specific to host names or to host addresses; all other
292      * patterns are satisfied when either the address OR the name match.
293      */
294 
295     if (tok[0] == '@') {			/* netgroup: look it up */
296 #ifdef  NETGROUP
297 	static char *mydomain = 0;
298 	if (mydomain == 0)
299 	    yp_get_default_domain(&mydomain);
300 	return (innetgr(tok + 1, eval_hostname(host), (char *) 0, mydomain));
301 #else
302 	tcpd_warn("netgroup support is disabled");	/* not tcpd_jump() */
303 	return (NO);
304 #endif
305     } else if (tok[0] == '/') {			/* /file hack */
306 	return (hostfile_match(tok, host));
307     } else if (STR_EQ(tok, "KNOWN")) {		/* check address and name */
308 	char   *name = eval_hostname(host);
309 	return (STR_NE(eval_hostaddr(host), unknown) && HOSTNAME_KNOWN(name));
310     } else if (STR_EQ(tok, "LOCAL")) {		/* local: no dots in name */
311 	char   *name = eval_hostname(host);
312 	return (strchr(name, '.') == 0 && HOSTNAME_KNOWN(name));
313     } else if ((mask = split_at(tok, '/')) != 0) {	/* net/mask */
314 	return (masked_match(tok, mask, eval_hostaddr(host)));
315     } else {					/* anything else */
316 	return (string_match(tok, eval_hostaddr(host))
317 	    || (NOT_INADDR(tok) && string_match(tok, eval_hostname(host))));
318     }
319 }
320 
321 /* string_match - match string against pattern */
322 
323 static int string_match(tok, string)
324 char   *tok;
325 char   *string;
326 {
327     int     n;
328 
329 #ifdef INET6
330     /* convert IPv4 mapped IPv6 address to IPv4 address */
331     if (STRN_EQ(string, "::ffff:", 7)
332 	&& dot_quad_addr(string + 7) != INADDR_NONE) {
333 	string += 7;
334     }
335 #endif
336     if (tok[0] == '.') {			/* suffix */
337 	n = strlen(string) - strlen(tok);
338 	return (n > 0 && STR_EQ(tok, string + n));
339     } else if (STR_EQ(tok, "ALL")) {		/* all: match any */
340 	return (YES);
341     } else if (STR_EQ(tok, "KNOWN")) {		/* not unknown */
342 	return (STR_NE(string, unknown));
343     } else if (tok[(n = strlen(tok)) - 1] == '.') {	/* prefix */
344 	return (STRN_EQ(tok, string, n));
345     } else {					/* exact match */
346 #ifdef INET6
347 	struct addrinfo hints, *res;
348 	struct sockaddr_in6 pat, addr;
349 	int len, ret;
350 	char ch;
351 
352 	len = strlen(tok);
353 	if (*tok == '[' && tok[len - 1] == ']') {
354 	    ch = tok[len - 1];
355 	    tok[len - 1] = '\0';
356 	    memset(&hints, 0, sizeof(hints));
357 	    hints.ai_family = AF_INET6;
358 	    hints.ai_socktype = SOCK_STREAM;
359 	    hints.ai_flags = AI_PASSIVE | AI_NUMERICHOST;
360 	    if ((ret = getaddrinfo(tok + 1, NULL, &hints, &res)) == 0) {
361 		memcpy(&pat, res->ai_addr, sizeof(pat));
362 		freeaddrinfo(res);
363 	    }
364 	    tok[len - 1] = ch;
365 	    if (ret != 0 || getaddrinfo(string, NULL, &hints, &res) != 0)
366 		return NO;
367 	    memcpy(&addr, res->ai_addr, sizeof(addr));
368 	    freeaddrinfo(res);
369 #ifdef NI_WITHSCOPEID
370 	    if (pat.sin6_scope_id != 0 &&
371 		addr.sin6_scope_id != pat.sin6_scope_id)
372 		return NO;
373 #endif
374 	    return (!memcmp(&pat.sin6_addr, &addr.sin6_addr,
375 			    sizeof(struct in6_addr)));
376 	    return (ret);
377 	}
378 #endif
379 	return (STR_EQ(tok, string));
380     }
381 }
382 
383 /* masked_match - match address against netnumber/netmask */
384 
385 #ifdef INET6
386 static int masked_match(net_tok, mask_tok, string)
387 char   *net_tok;
388 char   *mask_tok;
389 char   *string;
390 {
391     return (masked_match4(net_tok, mask_tok, string) ||
392 	    masked_match6(net_tok, mask_tok, string));
393 }
394 
395 static int masked_match4(net_tok, mask_tok, string)
396 #else
397 static int masked_match(net_tok, mask_tok, string)
398 #endif
399 char   *net_tok;
400 char   *mask_tok;
401 char   *string;
402 {
403 #ifdef INET6
404     u_int32_t net;
405     u_int32_t mask;
406     u_int32_t addr;
407 #else
408     unsigned long net;
409     unsigned long mask;
410     unsigned long addr;
411 #endif
412 
413     /*
414      * Disallow forms other than dotted quad: the treatment that inet_addr()
415      * gives to forms with less than four components is inconsistent with the
416      * access control language. John P. Rouillard <rouilj@cs.umb.edu>.
417      */
418 
419     if ((addr = dot_quad_addr(string)) == INADDR_NONE)
420 	return (NO);
421     if ((net = dot_quad_addr(net_tok)) == INADDR_NONE
422 	|| (mask = dot_quad_addr(mask_tok)) == INADDR_NONE) {
423 #ifndef INET6
424 	tcpd_warn("bad net/mask expression: %s/%s", net_tok, mask_tok);
425 #endif
426 	return (NO);				/* not tcpd_jump() */
427     }
428     return ((addr & mask) == net);
429 }
430 
431 #ifdef INET6
432 static int masked_match6(net_tok, mask_tok, string)
433 char   *net_tok;
434 char   *mask_tok;
435 char   *string;
436 {
437     struct addrinfo hints, *res;
438     struct sockaddr_in6 net, addr;
439     u_int32_t mask;
440     int len, mask_len, i = 0;
441     char ch;
442 
443     memset(&hints, 0, sizeof(hints));
444     hints.ai_family = AF_INET6;
445     hints.ai_socktype = SOCK_STREAM;
446     hints.ai_flags = AI_PASSIVE | AI_NUMERICHOST;
447     if (getaddrinfo(string, NULL, &hints, &res) != 0)
448 	return NO;
449     memcpy(&addr, res->ai_addr, sizeof(addr));
450     freeaddrinfo(res);
451 
452     if (IN6_IS_ADDR_V4MAPPED(&addr.sin6_addr)) {
453 	if ((*(u_int32_t *)&net.sin6_addr.s6_addr[12] = dot_quad_addr(net_tok)) == INADDR_NONE
454 	 || (mask = dot_quad_addr(mask_tok)) == INADDR_NONE)
455 	    return (NO);
456 	return ((*(u_int32_t *)&addr.sin6_addr.s6_addr[12] & mask) == *(u_int32_t *)&net.sin6_addr.s6_addr[12]);
457     }
458 
459     /* match IPv6 address against netnumber/prefixlen */
460     len = strlen(net_tok);
461     if (*net_tok != '[' || net_tok[len - 1] != ']')
462 	return NO;
463     ch = net_tok[len - 1];
464     net_tok[len - 1] = '\0';
465     if (getaddrinfo(net_tok + 1, NULL, &hints, &res) != 0) {
466 	net_tok[len - 1] = ch;
467 	return NO;
468     }
469     memcpy(&net, res->ai_addr, sizeof(net));
470     freeaddrinfo(res);
471     net_tok[len - 1] = ch;
472     if ((mask_len = atoi(mask_tok)) < 0 || mask_len > 128)
473 	return NO;
474 
475 #ifdef NI_WITHSCOPEID
476     if (net.sin6_scope_id != 0 && addr.sin6_scope_id != net.sin6_scope_id)
477 	return NO;
478 #endif
479     while (mask_len > 0) {
480 	if (mask_len < 32) {
481 	    mask = htonl(~(0xffffffff >> mask_len));
482 	    if ((*(u_int32_t *)&addr.sin6_addr.s6_addr[i] & mask) != (*(u_int32_t *)&net.sin6_addr.s6_addr[i] & mask))
483 		return NO;
484 	    break;
485 	}
486 	if (*(u_int32_t *)&addr.sin6_addr.s6_addr[i] != *(u_int32_t *)&net.sin6_addr.s6_addr[i])
487 	    return NO;
488 	i += 4;
489 	mask_len -= 32;
490     }
491     return YES;
492 }
493 #endif /* INET6 */
494