- Made flist_find() and receive_file_entry() static functions.
[rsync.git] / access.c
index 050e8cc4f5b68905262527faad249aa4e70e359f..f8dd593fce82f2294f70cd09bff492cece681c69 100644 (file)
--- a/access.c
+++ b/access.c
 
 static int match_hostname(char *host, char *tok)
 {
-       if (!host || !*host) return 0;
-       return (fnmatch(tok, host, 0) == 0);
+       if (!host || !*host)
+               return 0;
+       return wildmatch(tok, host);
 }
 
+static int match_binary(char *b1, char *b2, char *mask, int addrlen)
+{
+       int i;
+
+       for (i = 0; i < addrlen; i++) {
+               if ((b1[i] ^ b2[i]) & mask[i])
+                       return 0;
+       }
+
+       return 1;
+}
+
+static void make_mask(char *mask, int plen, int addrlen)
+{
+       int w, b;
+
+       w = plen >> 3;
+       b = plen & 0x7;
+
+       if (w)
+               memset(mask, 0xff, w);
+       if (w < addrlen)
+               mask[w] = 0xff & (0xff<<(8-b));
+       if (w+1 < addrlen)
+               memset(mask+w+1, 0, addrlen-w-1);
+
+       return;
+}
 
 static int match_address(char *addr, char *tok)
 {
        char *p;
-       unsigned long a, t, mask = (unsigned long)~0;
-
-       if (!addr || !*addr) return 0;
+       struct addrinfo hints, *resa, *rest;
+       int gai;
+       int ret = 0;
+       int addrlen = 0;
+#if HAVE_STRTOL
+       long int bits;
+#else
+       int bits;
+#endif
+       char mask[16];
+       char *a = NULL, *t = NULL;
+       unsigned int len;
 
-       if (!isdigit(tok[0])) return 0;
+       if (!addr || !*addr)
+               return 0;
 
        p = strchr(tok,'/');
-       if (p) *p = 0;
+       if (p) {
+               *p = '\0';
+               len = p - tok;
+       } else
+               len = strlen(tok);
 
-       a = inet_addr(addr);
-       t = inet_addr(tok);
+       /* Fail quietly if tok is a hostname (not an address) */
+       if (strspn(tok, ".0123456789") != len
+#if INET6
+           && strchr(tok, ':') == NULL
+#endif
+       ) {
+               if (p)
+                       *p = '/';
+               return 0;
+       }
 
-       if (p) {
-               *p = '/';
+       memset(&hints, 0, sizeof(hints));
+       hints.ai_family = PF_UNSPEC;
+       hints.ai_socktype = SOCK_STREAM;
+#ifdef AI_NUMERICHOST
+       hints.ai_flags = AI_NUMERICHOST;
+#endif
+
+       if (getaddrinfo(addr, NULL, &hints, &resa) != 0) {
+               if (p)
+                       *p = '/';
+               return 0;
        }
 
-       if (t == INADDR_NONE) {
-               rprintf(FERROR,"malformed address %s\n", tok);
+       gai = getaddrinfo(tok, NULL, &hints, &rest);
+       if (p)
+               *p++ = '/';
+       if (gai != 0) {
+               rprintf(FLOG, "error matching address %s: %s\n",
+                       tok, gai_strerror(gai));
+               freeaddrinfo(resa);
                return 0;
        }
 
-       a = ntohl(a);
-       t = ntohl(t);
+       if (rest->ai_family != resa->ai_family) {
+               ret = 0;
+               goto out;
+       }
+
+       switch(resa->ai_family) {
+       case PF_INET:
+               a = (char *)&((struct sockaddr_in *)resa->ai_addr)->sin_addr;
+               t = (char *)&((struct sockaddr_in *)rest->ai_addr)->sin_addr;
+               addrlen = 4;
+
+               break;
+
+#if INET6
+       case PF_INET6:
+           {
+               struct sockaddr_in6 *sin6a, *sin6t;
+
+               sin6a = (struct sockaddr_in6 *)resa->ai_addr;
+               sin6t = (struct sockaddr_in6 *)rest->ai_addr;
+
+               a = (char *)&sin6a->sin6_addr;
+               t = (char *)&sin6t->sin6_addr;
+
+               addrlen = 16;
+
+#if HAVE_SOCKADDR_IN6_SCOPE_ID
+               if (sin6t->sin6_scope_id &&
+                   sin6a->sin6_scope_id != sin6t->sin6_scope_id) {
+                       ret = 0;
+                       goto out;
+               }
+#endif
+
+               break;
+           }
+#endif
+       default:
+           rprintf(FLOG, "unknown family %u\n", rest->ai_family);
+           ret = 0;
+           goto out;
+       }
 
+       bits = -1;
        if (p) {
-               if (strchr(p+1,'.')) {
-                       mask = inet_addr(p+1);
-                       if (mask == INADDR_NONE) {
-                               rprintf(FERROR,"malformed mask in %s\n", tok);
-                               return 0;
+               if (inet_pton(resa->ai_addr->sa_family, p, mask) <= 0) {
+#if HAVE_STRTOL
+                       char *ep = NULL;
+#else
+                       unsigned char *pp;
+#endif
+
+#if HAVE_STRTOL
+                       bits = strtol(p, &ep, 10);
+                       if (!*p || *ep) {
+                               rprintf(FLOG, "malformed mask in %s\n", tok);
+                               ret = 0;
+                               goto out;
+                       }
+#else
+                       for (pp = (unsigned char *)p; *pp; pp++) {
+                               if (!isascii(*pp) || !isdigit(*pp)) {
+                                       rprintf(FLOG, "malformed mask in %s\n", tok);
+                                       ret = 0;
+                                       goto out;
+                               }
                        }
-                       mask = ntohl(mask);
-               } else {
-                       int bits = atoi(p+1);
-                       if (bits == 0) return 1;
-                       if (bits <= 0 || bits > 32) {
-                               rprintf(FERROR,"malformed mask in %s\n", tok);
-                               return 0;
+                       bits = atoi(p);
+#endif
+                       if (bits == 0) {
+                               ret = 1;
+                               goto out;
+                       }
+                       if (bits < 0 || bits > (addrlen << 3)) {
+                               rprintf(FLOG, "malformed mask in %s\n", tok);
+                               ret = 0;
+                               goto out;
                        }
-                       mask &= (mask << (32-bits));
                }
+       } else {
+               bits = 128;
        }
 
-       return ((a&mask) == (t&mask));
+       if (bits >= 0)
+               make_mask(mask, bits, addrlen);
+
+       ret = match_binary(a, t, mask, addrlen);
+
+out:
+       freeaddrinfo(resa);
+       freeaddrinfo(rest);
+       return ret;
 }
 
 static int access_match(char *list, char *addr, char *host)
@@ -85,12 +219,14 @@ static int access_match(char *list, char *addr, char *host)
        char *tok;
        char *list2 = strdup(list);
 
-       if (!list2) out_of_memory("access_match");
+       if (!list2)
+               out_of_memory("access_match");
 
        strlower(list2);
-       if (host) strlower(host);
+       if (host)
+               strlower(host);
 
-       for (tok=strtok(list2," ,\t"); tok; tok=strtok(NULL," ,\t")) {
+       for (tok = strtok(list2, " ,\t"); tok; tok = strtok(NULL, " ,\t")) {
                if (match_hostname(host, tok) || match_address(addr, tok)) {
                        free(list2);
                        return 1;
@@ -103,29 +239,25 @@ static int access_match(char *list, char *addr, char *host)
 
 int allow_access(char *addr, char *host, char *allow_list, char *deny_list)
 {
-       /* if theres no deny list and no allow list then allow access */
-       if ((!deny_list || !*deny_list) && (!allow_list || !*allow_list))
-               return 1;
-
-       /* if there is an allow list but no deny list then allow only hosts
-          on the allow list */
-       if (!deny_list || !*deny_list)
-               return(access_match(allow_list, addr, host));
-
-       /* if theres a deny list but no allow list then allow
-          all hosts not on the deny list */
-       if (!allow_list || !*allow_list)
-               return(!access_match(deny_list,addr,host));
-
-       /* if there are both type of list then allow all hosts on the
-           allow list */
-       if (access_match(allow_list,addr,host))
-               return 1;
-
-       /* if there are both type of list and it's not on the allow then
-          allow it if its not on the deny */
-       if (access_match(deny_list,addr,host))
+       if (allow_list && !*allow_list)
+               allow_list = NULL;
+       if (deny_list && !*deny_list)
+               deny_list = NULL;
+
+       /* If we match an allow-list item, we always allow access. */
+       if (allow_list) {
+               if (access_match(allow_list, addr, host))
+                       return 1;
+               /* For an allow-list w/o a deny-list, disallow non-matches. */
+               if (!deny_list)
+                       return 0;
+       }
+
+       /* If we match a deny-list item (and got past any allow-list
+        * items), we always disallow access. */
+       if (deny_list && access_match(deny_list, addr, host))
                return 0;
 
+       /* Allow all other access. */
        return 1;
 }