X-Git-Url: https://mattmccutchen.net/rsync/rsync.git/blobdiff_plain/fe332038c6776f749b86fcdb81058fb7c244b037..4fd842f98df4970f6e49a0365dbed60774e56c09:/access.c diff --git a/access.c b/access.c index 1dc73aed..0dd8cb77 100644 --- a/access.c +++ b/access.c @@ -1,32 +1,28 @@ -/* - Copyright (C) Andrew Tridgell 1998 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. -*/ - /* - hosts allow/deny code for rsync - - */ + * Routines to authenticate access to a daemon (hosts allow/deny). + * + * Copyright (C) 1998 Andrew Tridgell + * Copyright (C) 2004-2007 Wayne Davison + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 3 as + * published by the Free Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License along + * with this program; if not, visit the http://fsf.org website. + */ #include "rsync.h" - static int match_hostname(char *host, char *tok) { - if (!host || !*host) return 0; + if (!host || !*host) + return 0; return wildmatch(tok, host); } @@ -34,16 +30,16 @@ static int match_binary(char *b1, char *b2, char *mask, int addrlen) { int i; - for (i=0; i> 3; @@ -75,22 +71,26 @@ static int match_address(char *addr, char *tok) char *a = NULL, *t = NULL; unsigned int len; - if (!addr || !*addr) return 0; + if (!addr || !*addr) + return 0; p = strchr(tok,'/'); if (p) { *p = '\0'; len = p - tok; - } - else + } else len = strlen(tok); /* Fail quietly if tok is a hostname (not an address) */ if (strspn(tok, ".0123456789") != len #ifdef INET6 - && !strchr(tok, ':') + && strchr(tok, ':') == NULL #endif - ) return 0; + ) { + if (p) + *p = '/'; + return 0; + } memset(&hints, 0, sizeof(hints)); hints.ai_family = PF_UNSPEC; @@ -99,17 +99,18 @@ static int match_address(char *addr, char *tok) hints.ai_flags = AI_NUMERICHOST; #endif - gai = getaddrinfo(addr, NULL, &hints, &resa); - if (gai) return 0; + if (getaddrinfo(addr, NULL, &hints, &resa) != 0) { + if (p) + *p = '/'; + return 0; + } gai = getaddrinfo(tok, NULL, &hints, &rest); if (p) *p++ = '/'; - if (gai) { - rprintf(FERROR, - "error matching address %s: %s\n", - tok, - gai_strerror(gai)); + if (gai != 0) { + rprintf(FLOG, "error matching address %s: %s\n", + tok, gai_strerror(gai)); freeaddrinfo(resa); return 0; } @@ -152,7 +153,7 @@ static int match_address(char *addr, char *tok) } #endif default: - rprintf(FERROR,"unknown family %u\n", rest->ai_family); + rprintf(FLOG, "unknown family %u\n", rest->ai_family); ret = 0; goto out; } @@ -169,14 +170,14 @@ static int match_address(char *addr, char *tok) #ifdef HAVE_STRTOL bits = strtol(p, &ep, 10); if (!*p || *ep) { - rprintf(FERROR,"malformed mask in %s\n", tok); + rprintf(FLOG, "malformed mask in %s\n", tok); ret = 0; goto out; } #else for (pp = (unsigned char *)p; *pp; pp++) { if (!isascii(*pp) || !isdigit(*pp)) { - rprintf(FERROR,"malformed mask in %s\n", tok); + rprintf(FLOG, "malformed mask in %s\n", tok); ret = 0; goto out; } @@ -188,7 +189,7 @@ static int match_address(char *addr, char *tok) goto out; } if (bits < 0 || bits > (addrlen << 3)) { - rprintf(FERROR,"malformed mask in %s\n", tok); + rprintf(FLOG, "malformed mask in %s\n", tok); ret = 0; goto out; } @@ -202,7 +203,7 @@ static int match_address(char *addr, char *tok) ret = match_binary(a, t, mask, addrlen); -out: + out: freeaddrinfo(resa); freeaddrinfo(rest); return ret; @@ -213,12 +214,14 @@ static int access_match(char *list, char *addr, char *host) char *tok; char *list2 = strdup(list); - if (!list2) out_of_memory("access_match"); + if (!list2) + out_of_memory("access_match"); strlower(list2); - if (host) strlower(host); + if (host) + strlower(host); - for (tok=strtok(list2," ,\t"); tok; tok=strtok(NULL," ,\t")) { + for (tok = strtok(list2, " ,\t"); tok; tok = strtok(NULL, " ,\t")) { if (match_hostname(host, tok) || match_address(addr, tok)) { free(list2); return 1; @@ -231,29 +234,25 @@ static int access_match(char *list, char *addr, char *host) int allow_access(char *addr, char *host, char *allow_list, char *deny_list) { - /* if theres no deny list and no allow list then allow access */ - if ((!deny_list || !*deny_list) && (!allow_list || !*allow_list)) - return 1; - - /* if there is an allow list but no deny list then allow only hosts - on the allow list */ - if (!deny_list || !*deny_list) - return(access_match(allow_list, addr, host)); - - /* if theres a deny list but no allow list then allow - all hosts not on the deny list */ - if (!allow_list || !*allow_list) - return(!access_match(deny_list,addr,host)); - - /* if there are both type of list then allow all hosts on the - allow list */ - if (access_match(allow_list,addr,host)) - return 1; - - /* if there are both type of list and it's not on the allow then - allow it if its not on the deny */ - if (access_match(deny_list,addr,host)) + if (allow_list && !*allow_list) + allow_list = NULL; + if (deny_list && !*deny_list) + deny_list = NULL; + + /* If we match an allow-list item, we always allow access. */ + if (allow_list) { + if (access_match(allow_list, addr, host)) + return 1; + /* For an allow-list w/o a deny-list, disallow non-matches. */ + if (!deny_list) + return 0; + } + + /* If we match a deny-list item (and got past any allow-list + * items), we always disallow access. */ + if (deny_list && access_match(deny_list, addr, host)) return 0; + /* Allow all other access. */ return 1; }