X-Git-Url: https://mattmccutchen.net/rsync/rsync.git/blobdiff_plain/7bc8218d814a9014536685e0e544aa7fd06b9868..0f78b81511be65d8fe21af1e6ac674f9e80ac29d:/access.c diff --git a/access.c b/access.c index b05059f9..89f1256e 100644 --- a/access.c +++ b/access.c @@ -1,49 +1,47 @@ -/* - Copyright (C) Andrew Tridgell 1998 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. -*/ - /* - hosts allow/deny code for rsync - - */ + * Routines to authenticate access to a daemon (hosts allow/deny). + * + * Copyright (C) 1998 Andrew Tridgell + * Copyright (C) 2004, 2005 Wayne Davison + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ #include "rsync.h" - static int match_hostname(char *host, char *tok) { - if (!host || !*host) return 0; - return (fnmatch(tok, host, 0) == 0); + if (!host || !*host) + return 0; + return wildmatch(tok, host); } static int match_binary(char *b1, char *b2, char *mask, int addrlen) { int i; - for (i=0; i> 3; @@ -73,11 +71,28 @@ static int match_address(char *addr, char *tok) #endif char mask[16]; char *a = NULL, *t = NULL; + unsigned int len; - if (!addr || !*addr) return 0; + if (!addr || !*addr) + return 0; p = strchr(tok,'/'); - if (p) *p = 0; + if (p) { + *p = '\0'; + len = p - tok; + } else + len = strlen(tok); + + /* Fail quietly if tok is a hostname (not an address) */ + if (strspn(tok, ".0123456789") != len +#ifdef INET6 + && strchr(tok, ':') == NULL +#endif + ) { + if (p) + *p = '/'; + return 0; + } memset(&hints, 0, sizeof(hints)); hints.ai_family = PF_UNSPEC; @@ -86,14 +101,18 @@ static int match_address(char *addr, char *tok) hints.ai_flags = AI_NUMERICHOST; #endif - gai = getaddrinfo(addr, NULL, &hints, &resa); - if (gai) return 0; + if (getaddrinfo(addr, NULL, &hints, &resa) != 0) { + if (p) + *p = '/'; + return 0; + } gai = getaddrinfo(tok, NULL, &hints, &rest); if (p) *p++ = '/'; - if (gai) { - rprintf(FERROR,"malformed address %s\n", tok); + if (gai != 0) { + rprintf(FLOG, "error matching address %s: %s\n", + tok, gai_strerror(gai)); freeaddrinfo(resa); return 0; } @@ -136,7 +155,7 @@ static int match_address(char *addr, char *tok) } #endif default: - rprintf(FERROR,"unknown family %u\n", rest->ai_family); + rprintf(FLOG, "unknown family %u\n", rest->ai_family); ret = 0; goto out; } @@ -153,14 +172,14 @@ static int match_address(char *addr, char *tok) #ifdef HAVE_STRTOL bits = strtol(p, &ep, 10); if (!*p || *ep) { - rprintf(FERROR,"malformed mask in %s\n", tok); + rprintf(FLOG, "malformed mask in %s\n", tok); ret = 0; goto out; } #else for (pp = (unsigned char *)p; *pp; pp++) { if (!isascii(*pp) || !isdigit(*pp)) { - rprintf(FERROR,"malformed mask in %s\n", tok); + rprintf(FLOG, "malformed mask in %s\n", tok); ret = 0; goto out; } @@ -172,7 +191,7 @@ static int match_address(char *addr, char *tok) goto out; } if (bits < 0 || bits > (addrlen << 3)) { - rprintf(FERROR,"malformed mask in %s\n", tok); + rprintf(FLOG, "malformed mask in %s\n", tok); ret = 0; goto out; } @@ -186,7 +205,7 @@ static int match_address(char *addr, char *tok) ret = match_binary(a, t, mask, addrlen); -out: + out: freeaddrinfo(resa); freeaddrinfo(rest); return ret; @@ -197,12 +216,14 @@ static int access_match(char *list, char *addr, char *host) char *tok; char *list2 = strdup(list); - if (!list2) out_of_memory("access_match"); + if (!list2) + out_of_memory("access_match"); strlower(list2); - if (host) strlower(host); + if (host) + strlower(host); - for (tok=strtok(list2," ,\t"); tok; tok=strtok(NULL," ,\t")) { + for (tok = strtok(list2, " ,\t"); tok; tok = strtok(NULL, " ,\t")) { if (match_hostname(host, tok) || match_address(addr, tok)) { free(list2); return 1; @@ -215,29 +236,25 @@ static int access_match(char *list, char *addr, char *host) int allow_access(char *addr, char *host, char *allow_list, char *deny_list) { - /* if theres no deny list and no allow list then allow access */ - if ((!deny_list || !*deny_list) && (!allow_list || !*allow_list)) - return 1; - - /* if there is an allow list but no deny list then allow only hosts - on the allow list */ - if (!deny_list || !*deny_list) - return(access_match(allow_list, addr, host)); - - /* if theres a deny list but no allow list then allow - all hosts not on the deny list */ - if (!allow_list || !*allow_list) - return(!access_match(deny_list,addr,host)); - - /* if there are both type of list then allow all hosts on the - allow list */ - if (access_match(allow_list,addr,host)) - return 1; - - /* if there are both type of list and it's not on the allow then - allow it if its not on the deny */ - if (access_match(deny_list,addr,host)) + if (allow_list && !*allow_list) + allow_list = NULL; + if (deny_list && !*deny_list) + deny_list = NULL; + + /* If we match an allow-list item, we always allow access. */ + if (allow_list) { + if (access_match(allow_list, addr, host)) + return 1; + /* For an allow-list w/o a deny-list, disallow non-matches. */ + if (!deny_list) + return 0; + } + + /* If we match a deny-list item (and got past any allow-list + * items), we always disallow access. */ + if (deny_list && access_match(deny_list, addr, host)) return 0; + /* Allow all other access. */ return 1; }