X-Git-Url: https://mattmccutchen.net/rsync/rsync.git/blobdiff_plain/bc2b4963a009dd8194b2e9f996a63b9c634a6263..8e41b68e8f975c02a5d9281be780ba5d1a385107:/access.c diff --git a/access.c b/access.c index aec633a7..48d79d2f 100644 --- a/access.c +++ b/access.c @@ -1,49 +1,46 @@ -/* - Copyright (C) Andrew Tridgell 1998 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. -*/ - /* - hosts allow/deny code for rsync - - */ + * Routines to authenticate access to a daemon (hosts allow/deny). + * + * Copyright (C) 1998 Andrew Tridgell + * Copyright (C) 2004-2007 Wayne Davison + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License along + * with this program; if not, visit the http://fsf.org website. + */ #include "rsync.h" - static int match_hostname(char *host, char *tok) { - if (!host || !*host) return 0; - return (fnmatch(tok, host, 0) == 0); + if (!host || !*host) + return 0; + return wildmatch(tok, host); } static int match_binary(char *b1, char *b2, char *mask, int addrlen) { int i; - for (i=0; i> 3; @@ -51,7 +48,8 @@ static void make_mask(char *mask, int plen, int addrlen) { if (w) memset(mask, 0xff, w); - mask[w] = 0xff & (0xff<<(8-b)); + if (w < addrlen) + mask[w] = 0xff & (0xff<<(8-b)); if (w+1 < addrlen) memset(mask+w+1, 0, addrlen-w-1); @@ -72,25 +70,48 @@ static int match_address(char *addr, char *tok) #endif char mask[16]; char *a = NULL, *t = NULL; + unsigned int len; - if (!addr || !*addr) return 0; + if (!addr || !*addr) + return 0; p = strchr(tok,'/'); - if (p) *p = 0; + if (p) { + *p = '\0'; + len = p - tok; + } else + len = strlen(tok); + + /* Fail quietly if tok is a hostname (not an address) */ + if (strspn(tok, ".0123456789") != len +#ifdef INET6 + && strchr(tok, ':') == NULL +#endif + ) { + if (p) + *p = '/'; + return 0; + } memset(&hints, 0, sizeof(hints)); hints.ai_family = PF_UNSPEC; hints.ai_socktype = SOCK_STREAM; +#ifdef AI_NUMERICHOST hints.ai_flags = AI_NUMERICHOST; +#endif - gai = getaddrinfo(addr, NULL, &hints, &resa); - if (gai) return 0; + if (getaddrinfo(addr, NULL, &hints, &resa) != 0) { + if (p) + *p = '/'; + return 0; + } gai = getaddrinfo(tok, NULL, &hints, &rest); if (p) *p++ = '/'; - if (gai) { - rprintf(FERROR,"malformed address %s\n", tok); + if (gai != 0) { + rprintf(FLOG, "error matching address %s: %s\n", + tok, gai_strerror(gai)); freeaddrinfo(resa); return 0; } @@ -119,6 +140,8 @@ static int match_address(char *addr, char *tok) a = (char *)&sin6a->sin6_addr; t = (char *)&sin6t->sin6_addr; + addrlen = 16; + #ifdef HAVE_SOCKADDR_IN6_SCOPE_ID if (sin6t->sin6_scope_id && sin6a->sin6_scope_id != sin6t->sin6_scope_id) { @@ -127,15 +150,11 @@ static int match_address(char *addr, char *tok) } #endif - a = (char *)&sin6a->sin6_addr; - t = (char *)&sin6t->sin6_addr; - addrlen = 16; - break; } #endif default: - rprintf(FERROR,"unknown family %u\n", rest->ai_family); + rprintf(FLOG, "unknown family %u\n", rest->ai_family); ret = 0; goto out; } @@ -152,14 +171,14 @@ static int match_address(char *addr, char *tok) #ifdef HAVE_STRTOL bits = strtol(p, &ep, 10); if (!*p || *ep) { - rprintf(FERROR,"malformed mask in %s\n", tok); + rprintf(FLOG, "malformed mask in %s\n", tok); ret = 0; goto out; } #else for (pp = (unsigned char *)p; *pp; pp++) { if (!isascii(*pp) || !isdigit(*pp)) { - rprintf(FERROR,"malformed mask in %s\n", tok); + rprintf(FLOG, "malformed mask in %s\n", tok); ret = 0; goto out; } @@ -171,7 +190,7 @@ static int match_address(char *addr, char *tok) goto out; } if (bits < 0 || bits > (addrlen << 3)) { - rprintf(FERROR,"malformed mask in %s\n", tok); + rprintf(FLOG, "malformed mask in %s\n", tok); ret = 0; goto out; } @@ -185,7 +204,7 @@ static int match_address(char *addr, char *tok) ret = match_binary(a, t, mask, addrlen); -out: + out: freeaddrinfo(resa); freeaddrinfo(rest); return ret; @@ -196,12 +215,14 @@ static int access_match(char *list, char *addr, char *host) char *tok; char *list2 = strdup(list); - if (!list2) out_of_memory("access_match"); + if (!list2) + out_of_memory("access_match"); strlower(list2); - if (host) strlower(host); + if (host) + strlower(host); - for (tok=strtok(list2," ,\t"); tok; tok=strtok(NULL," ,\t")) { + for (tok = strtok(list2, " ,\t"); tok; tok = strtok(NULL, " ,\t")) { if (match_hostname(host, tok) || match_address(addr, tok)) { free(list2); return 1; @@ -214,29 +235,25 @@ static int access_match(char *list, char *addr, char *host) int allow_access(char *addr, char *host, char *allow_list, char *deny_list) { - /* if theres no deny list and no allow list then allow access */ - if ((!deny_list || !*deny_list) && (!allow_list || !*allow_list)) - return 1; - - /* if there is an allow list but no deny list then allow only hosts - on the allow list */ - if (!deny_list || !*deny_list) - return(access_match(allow_list, addr, host)); - - /* if theres a deny list but no allow list then allow - all hosts not on the deny list */ - if (!allow_list || !*allow_list) - return(!access_match(deny_list,addr,host)); - - /* if there are both type of list then allow all hosts on the - allow list */ - if (access_match(allow_list,addr,host)) - return 1; - - /* if there are both type of list and it's not on the allow then - allow it if its not on the deny */ - if (access_match(deny_list,addr,host)) + if (allow_list && !*allow_list) + allow_list = NULL; + if (deny_list && !*deny_list) + deny_list = NULL; + + /* If we match an allow-list item, we always allow access. */ + if (allow_list) { + if (access_match(allow_list, addr, host)) + return 1; + /* For an allow-list w/o a deny-list, disallow non-matches. */ + if (!deny_list) + return 0; + } + + /* If we match a deny-list item (and got past any allow-list + * items), we always disallow access. */ + if (deny_list && access_match(deny_list, addr, host)) return 0; + /* Allow all other access. */ return 1; }