2 This module is an adaption of code from the tcpd-1.4 package written
3 by Wietse Venema, Eindhoven University of Technology, The Netherlands.
5 The code is used here with permission.
7 The code has been considerably changed from the original. Bug reports
8 should be sent to samba@samba.org
10 Updated for IPv6 by Jeremy Allison (C) 2007.
18 /* masked_match - match address against netnumber/netmask */
19 static bool masked_match(const char *tok, const char *slash, const char *s)
21 struct sockaddr_storage ss_mask;
22 struct sockaddr_storage ss_tok;
23 struct sockaddr_storage ss_host;
24 char *tok_copy = NULL;
26 if (!interpret_string_addr(&ss_host, s, 0)) {
31 /* IPv6 address - remove braces. */
32 tok_copy = SMB_STRDUP(tok+1);
36 /* Remove the terminating ']' */
37 tok_copy[PTR_DIFF(slash,tok)-1] = '\0';
39 tok_copy = SMB_STRDUP(tok);
43 /* Remove the terminating '/' */
44 tok_copy[PTR_DIFF(slash,tok)] = '\0';
47 if (!interpret_string_addr(&ss_tok, tok_copy, 0)) {
54 if (strlen(slash + 1) > 2) {
55 if (!interpret_string_addr(&ss_mask, slash+1, 0)) {
60 unsigned long val = strtoul(slash+1, &endp, 0);
61 if (slash+1 == endp || (endp && *endp != '\0')) {
64 if (!make_netmask(&ss_mask, &ss_tok, val)) {
69 return same_net(&ss_host, &ss_tok, &ss_mask);
72 /* string_match - match string s against token tok */
73 static bool string_match(const char *tok,const char *s)
79 /* Return true if a token has the magic value "ALL". Return
80 * true if the token is "FAIL". If the token starts with a "."
81 * (domain name), return true if it matches the last fields of
82 * the string. If the token has the magic value "LOCAL",
83 * return true if the string does not contain a "."
84 * character. If the token ends on a "." (network number),
85 * return true if it matches the first fields of the
86 * string. If the token begins with a "@" (netgroup name),
87 * return true if the string is a (host) member of the
88 * netgroup. Return true if the token fully matches the
89 * string. If the token is a netnumber/netmask pair, return
90 * true if the address is a member of the specified subnet.
93 if (tok[0] == '.') { /* domain: match last fields */
94 if ((str_len = strlen(s)) > (tok_len = strlen(tok))
95 && strequal(tok, s + str_len - tok_len)) {
98 } else if (tok[0] == '@') { /* netgroup: look it up */
101 char *mydomain = NULL;
102 char *hostname = NULL;
103 bool netgroup_ok = false;
106 NULL, SINGLETON_CACHE,
107 data_blob_string_const("yp_default_domain"),
110 SMB_ASSERT(tmp.length > 0);
111 mydomain = (tmp.data[0] == '\0')
112 ? NULL : (char *)tmp.data;
115 yp_get_default_domain(&mydomain);
118 NULL, SINGLETON_CACHE,
119 data_blob_string_const("yp_default_domain"),
120 data_blob_string_const(mydomain?mydomain:""));
124 DEBUG(0,("Unable to get default yp domain. "
125 "Try without it.\n"));
127 if (!(hostname = SMB_STRDUP(s))) {
128 DEBUG(1,("out of memory for strdup!\n"));
132 netgroup_ok = innetgr(tok + 1, hostname, (char *) 0, mydomain);
134 DEBUG(5,("looking for %s of domain %s in netgroup %s gave %s\n",
136 mydomain?mydomain:"(ANY)",
138 BOOLSTR(netgroup_ok)));
145 DEBUG(0,("access: netgroup support is not configured\n"));
148 } else if (strequal(tok, "ALL")) { /* all: match any */
150 } else if (strequal(tok, "FAIL")) { /* fail: match any */
152 } else if (strequal(tok, "LOCAL")) { /* local: no dots */
153 if (strchr_m(s, '.') == 0 && !strequal(s, "unknown")) {
156 } else if (strequal(tok, s)) { /* match host name or address */
158 } else if (tok[(tok_len = strlen(tok)) - 1] == '.') { /* network */
159 if (strncmp(tok, s, tok_len) == 0) {
162 } else if ((cut = strchr_m(tok, '/')) != 0) { /* netnumber/netmask */
163 if ((isdigit(s[0]) && strchr_m(tok, '.') != NULL) ||
164 (tok[0] == '[' && cut > tok && cut[-1] == ']') ||
165 ((isxdigit(s[0]) || s[0] == ':') &&
166 strchr_m(tok, ':') != NULL)) {
168 * [IPv6:addr]/netmask or IPv6:addr/netmask */
169 return masked_match(tok, cut, s);
171 } else if (strchr_m(tok, '*') != 0 || strchr_m(tok, '?')) {
172 return unix_wild_match(tok, s);
177 /* client_match - match host name and address against token */
178 static bool client_match(const char *tok, const void *item)
180 const char **client = (const char **)item;
183 * Try to match the address first. If that fails, try to match the host
187 if (string_match(tok, client[ADDR_INDEX])) {
191 if (strnequal(client[ADDR_INDEX],"::ffff:",7) &&
192 !strnequal(tok, "::ffff:",7)) {
193 /* client[ADDR_INDEX] is an IPv4 mapped to IPv6, but
194 * the list item is not. Try and match the IPv4 part of
195 * address only. This will happen a lot on IPv6 enabled
196 * systems with IPv4 allow/deny lists in smb.conf.
199 if (string_match(tok, (client[ADDR_INDEX])+7)) {
204 if (client[NAME_INDEX][0] != 0) {
205 if (string_match(tok, client[NAME_INDEX])) {
213 /* list_match - match an item against a list of tokens with exceptions */
214 static bool list_match(const char **list,const void *item,
215 bool (*match_fn)(const char *, const void *))
224 * Process tokens one at a time. We have exhausted all possible matches
225 * when we reach an "EXCEPT" token or the end of the list. If we do find
226 * a match, look for an "EXCEPT" list and recurse to determine whether
227 * the match is affected by any exceptions.
230 for (; *list ; list++) {
231 if (strequal(*list, "EXCEPT")) {
232 /* EXCEPT: give up */
235 if ((match = (*match_fn) (*list, item))) {
240 /* Process exceptions to true or FAIL matches. */
242 if (match != false) {
243 while (*list && !strequal(*list, "EXCEPT")) {
247 for (; *list; list++) {
248 if ((*match_fn) (*list, item)) {
249 /* Exception Found */
258 /* return true if access should be allowed */
259 static bool allow_access_internal(const char **deny_list,
260 const char **allow_list,
264 const char *client[2];
266 client[NAME_INDEX] = cname;
267 client[ADDR_INDEX] = caddr;
269 /* if it is loopback then always allow unless specifically denied */
270 if (strcmp(caddr, "127.0.0.1") == 0 || strcmp(caddr, "::1") == 0) {
272 * If 127.0.0.1 matches both allow and deny then allow.
273 * Patch from Steve Langasek vorlon@netexpress.net.
276 list_match(deny_list,client,client_match) &&
278 !list_match(allow_list,client, client_match))) {
284 /* if theres no deny list and no allow list then allow access */
285 if ((!deny_list || *deny_list == 0) &&
286 (!allow_list || *allow_list == 0)) {
290 /* if there is an allow list but no deny list then allow only hosts
292 if (!deny_list || *deny_list == 0) {
293 return(list_match(allow_list,client,client_match));
296 /* if theres a deny list but no allow list then allow
297 all hosts not on the deny list */
298 if (!allow_list || *allow_list == 0) {
299 return(!list_match(deny_list,client,client_match));
302 /* if there are both types of list then allow all hosts on the
304 if (list_match(allow_list,(const char *)client,client_match)) {
308 /* if there are both types of list and it's not on the allow then
309 allow it if its not on the deny */
310 if (list_match(deny_list,(const char *)client,client_match)) {
317 /* return true if access should be allowed */
318 bool allow_access(const char **deny_list,
319 const char **allow_list,
324 char *nc_cname = smb_xstrdup(cname);
325 char *nc_caddr = smb_xstrdup(caddr);
327 ret = allow_access_internal(deny_list, allow_list, nc_cname, nc_caddr);
334 /* return true if the char* contains ip addrs only. Used to avoid
337 static bool only_ipaddrs_in_list(const char **list)
345 for (; *list ; list++) {
346 /* factor out the special strings */
347 if (strequal(*list, "ALL") || strequal(*list, "FAIL") ||
348 strequal(*list, "EXCEPT")) {
352 if (!is_ipaddress(*list)) {
354 * If we failed, make sure that it was not because
355 * the token was a network/netmask pair. Only
356 * network/netmask pairs have a '/' in them.
358 if ((strchr_m(*list, '/')) == NULL) {
360 DEBUG(3,("only_ipaddrs_in_list: list has "
361 "non-ip address (%s)\n",
371 /* return true if access should be allowed to a service for a socket */
372 bool check_access(int sock, const char **allow_list, const char **deny_list)
375 bool only_ip = false;
377 if ((!deny_list || *deny_list==0) && (!allow_list || *allow_list==0))
381 char addr[INET6_ADDRSTRLEN];
383 /* Bypass name resolution calls if the lists
384 * only contain IP addrs */
385 if (only_ipaddrs_in_list(allow_list) &&
386 only_ipaddrs_in_list(deny_list)) {
388 DEBUG (3, ("check_access: no hostnames "
389 "in host allow/deny list.\n"));
390 ret = allow_access(deny_list,
393 get_peer_addr(sock,addr,sizeof(addr)));
395 DEBUG (3, ("check_access: hostnames in "
396 "host allow/deny list.\n"));
397 ret = allow_access(deny_list,
399 get_peer_name(sock,true),
400 get_peer_addr(sock,addr,sizeof(addr)));
404 DEBUG(2,("Allowed connection from %s (%s)\n",
405 only_ip ? "" : get_peer_name(sock,true),
406 get_peer_addr(sock,addr,sizeof(addr))));
408 DEBUG(0,("Denied connection from %s (%s)\n",
409 only_ip ? "" : get_peer_name(sock,true),
410 get_peer_addr(sock,addr,sizeof(addr))));