1 /* $OpenBSD: prefix.c,v 1.7 2003/09/02 23:27:55 itojun Exp $ */
2 /* $KAME: prefix.c,v 1.13 2003/09/02 22:50:17 itojun Exp $ */
3
4 /*
5 * Copyright (C) 2000 WIDE Project.
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 * 3. Neither the name of the project nor the names of its contributors
17 * may be used to endorse or promote products derived from this software
18 * without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 */
32
33 #include <sys/types.h>
34 #include <sys/socket.h>
35 #include <netinet/in.h>
36 #include <stdio.h>
37 #include <netdb.h>
38 #include <string.h>
39 #include <stddef.h>
40 #include <stdlib.h>
41 #include <limits.h>
42
43 #ifndef offsetof
44 #define offsetof(type, member) ((size_t)(u_long)(&((type *)0)->member))
45 #endif
46
47 #include "faithd.h"
48 #include "prefix.h"
49
50 static int prefix_set(const char *, struct prefix *, int);
51 static struct config *config_load1(const char *);
52 #if 0
53 static void config_show1(const struct config *);
54 static void config_show(void);
55 #endif
56
57 struct config *config_list = NULL;
58 const int niflags = NI_NUMERICHOST;
59
60 static int
prefix_set(const char * s,struct prefix * prefix,int slash)61 prefix_set(const char *s, struct prefix *prefix, int slash)
62 {
63 char *p = NULL, *q, *r;
64 struct addrinfo hints, *res = NULL;
65 int max;
66 char *a;
67
68 p = strdup(s);
69 if (!p)
70 goto fail;
71 q = strchr(p, '/');
72 if (q) {
73 if (!slash)
74 goto fail;
75 *q++ = '\0';
76 }
77
78 memset(&hints, 0, sizeof(hints));
79 hints.ai_family = PF_UNSPEC;
80 hints.ai_socktype = SOCK_DGRAM; /*dummy*/
81 hints.ai_flags = AI_NUMERICHOST;
82 if (getaddrinfo(p, "0", &hints, &res))
83 goto fail;
84 if (res->ai_next || res->ai_addrlen > sizeof(prefix->a))
85 goto fail;
86 memcpy(&prefix->a, res->ai_addr, res->ai_addrlen);
87
88 switch (prefix->a.ss_family) {
89 case AF_INET:
90 max = 32;
91 a = (char *)&((struct sockaddr_in *)&prefix->a)->sin_addr;
92 break;
93 case AF_INET6:
94 max = 128;
95 a = (char *)&((struct sockaddr_in6 *)&prefix->a)->sin6_addr;
96 break;
97 default:
98 a = NULL;
99 max = -1;
100 break;
101 }
102
103 if (q) {
104 r = NULL;
105 prefix->l = (int)strtoul(q, &r, 10);
106 if (!*q || *r)
107 goto fail;
108 if (prefix->l < 0 || prefix->l > max)
109 goto fail;
110 } else
111 prefix->l = max;
112
113 if (p)
114 free(p);
115 if (res)
116 freeaddrinfo(res);
117 return 0;
118
119 fail:
120 if (p)
121 free(p);
122 if (res)
123 freeaddrinfo(res);
124 return -1;
125 }
126
127 const char *
prefix_string(const struct prefix * prefix)128 prefix_string(const struct prefix *prefix)
129 {
130 static char buf[NI_MAXHOST + 20];
131 char hbuf[NI_MAXHOST];
132
133 if (getnameinfo((const struct sockaddr *)&prefix->a, prefix->a.ss_len,
134 hbuf, sizeof(hbuf), NULL, 0, niflags))
135 return NULL;
136 snprintf(buf, sizeof(buf), "%s/%d", hbuf, prefix->l);
137 return buf;
138 }
139
140 int
prefix_match(const struct prefix * prefix,const struct sockaddr * sa)141 prefix_match(const struct prefix *prefix, const struct sockaddr *sa)
142 {
143 struct sockaddr_storage a, b;
144 char *pa, *pb;
145 int off, l;
146
147 if (prefix->a.ss_family != sa->sa_family ||
148 prefix->a.ss_len != sa->sa_len)
149 return 0;
150
151 switch (prefix->a.ss_family) {
152 case AF_INET:
153 off = offsetof(struct sockaddr_in, sin_addr);
154 break;
155 case AF_INET6:
156 off = offsetof(struct sockaddr_in6, sin6_addr);
157 break;
158 default:
159 if (memcmp(&prefix->a, sa, prefix->a.ss_len) != 0)
160 return 0;
161 else
162 return 1;
163 }
164
165 memcpy(&a, &prefix->a, prefix->a.ss_len);
166 memcpy(&b, sa, sa->sa_len);
167 l = prefix->l / 8 + (prefix->l % 8 ? 1 : 0);
168
169 /* overrun check */
170 if (off + l > a.ss_len)
171 return 0;
172
173 pa = ((char *)&a) + off;
174 pb = ((char *)&b) + off;
175 if (prefix->l % 8) {
176 pa[prefix->l / 8] &= 0xff00 >> (prefix->l % 8);
177 pb[prefix->l / 8] &= 0xff00 >> (prefix->l % 8);
178 }
179 if (memcmp(pa, pb, l) != 0)
180 return 0;
181 else
182 return 1;
183 }
184
185 /*
186 * prefix/prefixlen permit/deny prefix/prefixlen [srcaddr]
187 * 3ffe::/16 permit 10.0.0.0/8 10.1.1.1
188 */
189 static struct config *
config_load1(const char * line)190 config_load1(const char *line)
191 {
192 struct config *conf;
193 char buf[BUFSIZ];
194 char *p;
195 char *token[4];
196 int i;
197
198 if (strlen(line) + 1 > sizeof(buf))
199 return NULL;
200 strlcpy(buf, line, sizeof(buf));
201
202 p = strchr(buf, '\n');
203 if (!p)
204 return NULL;
205 *p = '\0';
206 p = strchr(buf, '#');
207 if (p)
208 *p = '\0';
209 if (strlen(buf) == 0)
210 return NULL;
211
212 p = buf;
213 memset(token, 0, sizeof(token));
214 for (i = 0; i < sizeof(token) / sizeof(token[0]); i++) {
215 token[i] = strtok(p, "\t ");
216 p = NULL;
217 if (token[i] == NULL)
218 break;
219 }
220 /* extra tokens? */
221 if (strtok(p, "\t ") != NULL)
222 return NULL;
223 /* insufficient tokens */
224 switch (i) {
225 case 3:
226 case 4:
227 break;
228 default:
229 return NULL;
230 }
231
232 conf = (struct config *)malloc(sizeof(*conf));
233 if (conf == NULL)
234 return NULL;
235 memset(conf, 0, sizeof(*conf));
236
237 if (strcasecmp(token[1], "permit") == 0)
238 conf->permit = 1;
239 else if (strcasecmp(token[1], "deny") == 0)
240 conf->permit = 0;
241 else {
242 /* invalid keyword is considered as "deny" */
243 conf->permit = 0;
244 }
245
246 if (prefix_set(token[0], &conf->match, 1) < 0)
247 goto fail;
248 if (prefix_set(token[2], &conf->dest, 1) < 0)
249 goto fail;
250 if (token[3]) {
251 if (prefix_set(token[3], &conf->src, 0) < 0)
252 goto fail;
253 }
254
255 return conf;
256
257 fail:
258 free(conf);
259 return NULL;
260 }
261
262 int
config_load(const char * configfile)263 config_load(const char *configfile)
264 {
265 FILE *fp;
266 char buf[BUFSIZ];
267 struct config *conf, *p;
268 struct config sentinel;
269
270 config_list = NULL;
271
272 if (!configfile)
273 configfile = _PATH_PREFIX_CONF;
274 fp = fopen(configfile, "r");
275 if (fp == NULL)
276 return -1;
277
278 p = &sentinel;
279 sentinel.next = NULL;
280 while (fgets(buf, sizeof(buf), fp) != NULL) {
281 conf = config_load1(buf);
282 if (conf) {
283 p->next = conf;
284 p = p->next;
285 }
286 }
287 config_list = sentinel.next;
288
289 fclose(fp);
290 return 0;
291 }
292
293 #if 0
294 static void
295 config_show1(const struct config *conf)
296 {
297 const char *p;
298
299 p = prefix_string(&conf->match);
300 printf("%s", p ? p : "?");
301
302 if (conf->permit)
303 printf(" permit");
304 else
305 printf(" deny");
306
307 p = prefix_string(&conf->dest);
308 printf(" %s", p ? p : "?");
309
310 printf("\n");
311 }
312
313 static void
314 config_show()
315 {
316 struct config *conf;
317
318 for (conf = config_list; conf; conf = conf->next)
319 config_show1(conf);
320 }
321 #endif
322
323 const struct config *
config_match(struct sockaddr * sa1,struct sockaddr * sa2)324 config_match(struct sockaddr *sa1, struct sockaddr *sa2)
325 {
326 static struct config conf;
327 const struct config *p;
328
329 memset(&conf, 0, sizeof(conf));
330 if (!config_list) {
331 conf.permit = 1;
332 memcpy(&conf.match.a, sa1, sa1->sa_len);
333 memcpy(&conf.dest.a, sa2, sa2->sa_len);
334 return &conf;
335 }
336
337 for (p = config_list; p; p = p->next)
338 if (prefix_match(&p->match, sa1) && prefix_match(&p->dest, sa2))
339 return p;
340
341 return NULL;
342 }
343