modules/httpd/auth-ip.c

/* IP address authorization module for HTTP server.
 *
 * IRC Services is copyright (c) 1996-2009 Andrew Church.
 *     E-mail: <achurch@achurch.org>
 * Parts written by Andrew Kempe and others.
 * This program is free but copyrighted software; see the file GPL.txt for
 * details.
 */

#include "services.h"
#include "modules.h"
#include "conffile.h"
#include "http.h"
#include <netinet/in.h>
#include <netdb.h>

/*************************************************************************/

static Module *module_httpd;

/* List of hosts to allow/deny */
typedef struct {
    char *path;
    int pathlen;        /* for convenience */
    uint32 ip, mask;    /* network byte order */
    int allow;          /* 1 = allow, 0 = deny */
} DirInfo;
static DirInfo *protected = NULL;
static int protected_count = 0;

/*************************************************************************/
/************************ Authorization callback *************************/
/*************************************************************************/

static int do_auth(Client *c, int *close_ptr)
{
    int i;

    ARRAY_FOREACH (i, protected) {
        if (strncmp(c->url, protected[i].path, protected[i].pathlen) != 0)
            continue;
        if ((c->ip & protected[i].mask) != protected[i].ip)
            continue;
        if (protected[i].allow) {
            return HTTP_AUTH_UNDECIDED;
        } else {
            module_log("Denying request for %s from %s", c->url, c->address);
            return HTTP_AUTH_DENY;
        }
    }
    return HTTP_AUTH_UNDECIDED;
}

/*************************************************************************/
/***************************** Module stuff ******************************/
/*************************************************************************/

static int do_prefix(const char *filename, int linenum, char *param);
static int do_AllowHost(const char *filename, int linenum, char *param);
static int do_DenyHost(const char *filename, int linenum, char *param);
static int do_AllowDenyHost(const char *filename, int linenum, char *param,
                            int allow);
ConfigDirective module_config[] = {
    { "AllowHost",        { { CD_FUNC, 0, do_prefix },
                            { CD_FUNC, 0, do_AllowHost } } },
    { "DenyHost",         { { CD_FUNC, 0, do_prefix },
                            { CD_FUNC, 0, do_DenyHost } } },
    { NULL }
};

static char *prefix = NULL;

/*************************************************************************/

static int do_prefix(const char *filename, int linenum, char *param)
{
    if (filename) {
        free(prefix);
        prefix = strdup(param);
        if (!prefix) {
            config_error(filename, linenum, "Out of memory");
            return 0;
        }
    }
    return 1;
}

static int do_AllowHost(const char *filename, int linenum, char *param)
{
    return do_AllowDenyHost(filename, linenum, param, 1);
}

static int do_DenyHost(const char *filename, int linenum, char *param)
{
    return do_AllowDenyHost(filename, linenum, param, 0);
}

/*************************************************************************/

static int do_AllowDenyHost(const char *filename, int linenum, char *param,
                            int allow)
{
    char *s;
    int mask = 32;
    const uint8 *ip;
    int recursing = 0, i;
    DirInfo di;
    static DirInfo *new_protected = NULL;
    static int new_protected_count = 0;

    if (!filename) {
        /* filename == NULL, special actions */
        switch (linenum) {
          case CDFUNC_INIT:     /* prepare for reading */
            free(new_protected);
            new_protected = NULL;
            new_protected_count = 0;
            break;
          case CDFUNC_SET:      /* store new values in config variables */
            if (new_protected_count >= 0) {
                ARRAY_FOREACH (i, protected)
                    free(protected[i].path);
                free(protected);
                protected = new_protected;
                protected_count = new_protected_count;
                new_protected = NULL;
                new_protected_count = -1;  /* flag to say "don't copy again" */
            }
            break;
          case CDFUNC_DECONFIG: /* clear out config variables */
            ARRAY_FOREACH (i, protected)
                free(protected[i].path);
            free(protected);
            protected = NULL;
            protected_count = 0;
            break;
        } /* switch (linenum) */
        return 1;
    } /* if (!filename) */

    /* filename != NULL, process directive */

    if (linenum < 0) {
        recursing = 1;
        linenum = -linenum;
    }
    di.path = prefix;
    di.pathlen = strlen(prefix);
    prefix = NULL;

    s = strchr(param, '/');
    if (s) {
        *s++ = 0;
        mask = (int)atolsafe(s, 1, 31);
        if (mask < 1) {
            config_error(filename, linenum, "Invalid mask length `%s'", s);
            free(di.path);
            return 0;
        }
    }

    if (strcmp(param, "*") == 0) {
        /* All-hosts wildcard -> equivalent to 0.0.0.0/0 */
        ip = (const uint8 *)"\0\0\0\0";
        mask = 0;
    } else if ((ip = pack_ip(param)) != NULL) {
        /* IP address -> okay as is */
    } else {
        /* hostname -> check for double recursion, then look up and
         *             recursively add addresses */
#ifdef HAVE_GETHOSTBYNAME
        struct hostent *hp;
#endif
        if (recursing) {
            config_error(filename, linenum, "BUG: double recursion (param=%s)",
                         param);
            free(di.path);
            return 0;
        }
#ifdef HAVE_GETHOSTBYNAME
        if ((hp = gethostbyname(param)) != NULL) {
            if (hp->h_addrtype == AF_INET) {
                for (i = 0; hp->h_addr_list[i]; i++) {
                    char ipbuf[16];
                    ip = (const uint8 *)hp->h_addr_list[i];
                    snprintf(ipbuf, sizeof(ipbuf), "%u.%u.%u.%u",
                             ip[0], ip[1], ip[2], ip[3]);
                    if (strlen(ipbuf) > 15) {
                        config_error(filename, linenum,
                                     "BUG: strlen(ipbuf) > 15 [%s]", ipbuf);
                        free(di.path);
                        return 0;
                    }
                    prefix = strdup(di.path);
                    if (!prefix) {
                        config_error(filename, linenum, "Out of memory");
                        free(di.path);
                        return 0;
                    }
                    if (!do_AllowDenyHost(filename, -linenum, ipbuf, allow)) {
                        free(di.path);
                        return 0;
                    }
                }
                free(di.path);
                return 1;  /* Success */
            } else {                
                config_error(filename, linenum, "%s: no IPv4 addresses found",
                             param);
            }
        } else {
            config_error(filename, linenum, "%s: %s", param,
                         hstrerror(h_errno));
        }
#else
        config_error(filename, linenum,
                     "gethostbyname() not available, hostnames may not be"
                     " used");
#endif
        free(di.path);
        return 0;
    }

    di.ip = *((uint32 *)ip);
    di.mask = mask ? htonl(0xFFFFFFFFUL << (32-mask)) : 0;
    di.ip &= di.mask;
    di.allow = allow;
    ARRAY_EXTEND(new_protected);
    new_protected[new_protected_count-1] = di;
    return 1;
}

/*************************************************************************/
/*************************************************************************/

int init_module(void)
{
    module_httpd = find_module("httpd/main");
    if (!module_httpd) {
        module_log("Main httpd module not loaded");
        exit_module(0);
        return 0;
    }
    use_module(module_httpd);

    if (!add_callback(module_httpd, "auth", do_auth)) {
        module_log("Unable to add callback");
        exit_module(0);
        return 0;
    }

    return 1;
}

/*************************************************************************/

int exit_module(int shutdown_unused)
{
    if (module_httpd) {
        remove_callback(module_httpd, "auth", do_auth);
        unuse_module(module_httpd);
        module_httpd = NULL;
    }

    return 1;
}

/*************************************************************************/

/*
 * Local variables:
 *   c-file-style: "stroustrup"
 *   c-file-offsets: ((case-label . *) (statement-case-intro . *))
 *   indent-tabs-mode: nil
 * End:
 *
 * vim: expandtab shiftwidth=4:
 */
Revision:	3389
Committed:	Fri Apr 25 14:12:15 2014 UTC (11 years, 4 months ago) by michael
Content type:	text/x-csrc
File size:	8677 byte(s)
Log Message:	- Imported ircservices-5.1.24
#	User	Rev	Content
1	michael	3389	/* IP address authorization module for HTTP server.
2			*
3			* IRC Services is copyright (c) 1996-2009 Andrew Church.
4			* E-mail: <achurch@achurch.org>
5			* Parts written by Andrew Kempe and others.
6			* This program is free but copyrighted software; see the file GPL.txt for
7			* details.
8			*/
9
10			#include "services.h"
11			#include "modules.h"
12			#include "conffile.h"
13			#include "http.h"
14			#include <netinet/in.h>
15			#include <netdb.h>
16
17			/*************************************************************************/
18
19			static Module *module_httpd;
20
21			/* List of hosts to allow/deny */
22			typedef struct {
23			char *path;
24			int pathlen; /* for convenience */
25			uint32 ip, mask; /* network byte order */
26			int allow; /* 1 = allow, 0 = deny */
27			} DirInfo;
28			static DirInfo *protected = NULL;
29			static int protected_count = 0;
30
31			/*************************************************************************/
32			/********************** Authorization callback ***********************/
33			/*************************************************************************/
34
35			static int do_auth(Client c, int close_ptr)
36			{
37			int i;
38
39			ARRAY_FOREACH (i, protected) {
40			if (strncmp(c->url, protected[i].path, protected[i].pathlen) != 0)
41			continue;
42			if ((c->ip & protected[i].mask) != protected[i].ip)
43			continue;
44			if (protected[i].allow) {
45			return HTTP_AUTH_UNDECIDED;
46			} else {
47			module_log("Denying request for %s from %s", c->url, c->address);
48			return HTTP_AUTH_DENY;
49			}
50			}
51			return HTTP_AUTH_UNDECIDED;
52			}
53
54			/*************************************************************************/
55			/*************************** Module stuff ****************************/
56			/*************************************************************************/
57
58			static int do_prefix(const char filename, int linenum, char param);
59			static int do_AllowHost(const char filename, int linenum, char param);
60			static int do_DenyHost(const char filename, int linenum, char param);
61			static int do_AllowDenyHost(const char filename, int linenum, char param,
62			int allow);
63			ConfigDirective module_config[] = {
64			{ "AllowHost", { { CD_FUNC, 0, do_prefix },
65			{ CD_FUNC, 0, do_AllowHost } } },
66			{ "DenyHost", { { CD_FUNC, 0, do_prefix },
67			{ CD_FUNC, 0, do_DenyHost } } },
68			{ NULL }
69			};
70
71			static char *prefix = NULL;
72
73			/*************************************************************************/
74
75			static int do_prefix(const char filename, int linenum, char param)
76			{
77			if (filename) {
78			free(prefix);
79			prefix = strdup(param);
80			if (!prefix) {
81			config_error(filename, linenum, "Out of memory");
82			return 0;
83			}
84			}
85			return 1;
86			}
87
88			static int do_AllowHost(const char filename, int linenum, char param)
89			{
90			return do_AllowDenyHost(filename, linenum, param, 1);
91			}
92
93			static int do_DenyHost(const char filename, int linenum, char param)
94			{
95			return do_AllowDenyHost(filename, linenum, param, 0);
96			}
97
98			/*************************************************************************/
99
100			static int do_AllowDenyHost(const char filename, int linenum, char param,
101			int allow)
102			{
103			char *s;
104			int mask = 32;
105			const uint8 *ip;
106			int recursing = 0, i;
107			DirInfo di;
108			static DirInfo *new_protected = NULL;
109			static int new_protected_count = 0;
110
111			if (!filename) {
112			/* filename == NULL, special actions */
113			switch (linenum) {
114			case CDFUNC_INIT: /* prepare for reading */
115			free(new_protected);
116			new_protected = NULL;
117			new_protected_count = 0;
118			break;
119			case CDFUNC_SET: /* store new values in config variables */
120			if (new_protected_count >= 0) {
121			ARRAY_FOREACH (i, protected)
122			free(protected[i].path);
123			free(protected);
124			protected = new_protected;
125			protected_count = new_protected_count;
126			new_protected = NULL;
127			new_protected_count = -1; /* flag to say "don't copy again" */
128			}
129			break;
130			case CDFUNC_DECONFIG: /* clear out config variables */
131			ARRAY_FOREACH (i, protected)
132			free(protected[i].path);
133			free(protected);
134			protected = NULL;
135			protected_count = 0;
136			break;
137			} /* switch (linenum) */
138			return 1;
139			} /* if (!filename) */
140
141			/* filename != NULL, process directive */
142
143			if (linenum < 0) {
144			recursing = 1;
145			linenum = -linenum;
146			}
147			di.path = prefix;
148			di.pathlen = strlen(prefix);
149			prefix = NULL;
150
151			s = strchr(param, '/');
152			if (s) {
153			*s++ = 0;
154			mask = (int)atolsafe(s, 1, 31);
155			if (mask < 1) {
156			config_error(filename, linenum, "Invalid mask length `%s'", s);
157			free(di.path);
158			return 0;
159			}
160			}
161
162			if (strcmp(param, "*") == 0) {
163			/* All-hosts wildcard -> equivalent to 0.0.0.0/0 */
164			ip = (const uint8 *)"\0\0\0\0";
165			mask = 0;
166			} else if ((ip = pack_ip(param)) != NULL) {
167			/* IP address -> okay as is */
168			} else {
169			/* hostname -> check for double recursion, then look up and
170			* recursively add addresses */
171			#ifdef HAVE_GETHOSTBYNAME
172			struct hostent *hp;
173			#endif
174			if (recursing) {
175			config_error(filename, linenum, "BUG: double recursion (param=%s)",
176			param);
177			free(di.path);
178			return 0;
179			}
180			#ifdef HAVE_GETHOSTBYNAME
181			if ((hp = gethostbyname(param)) != NULL) {
182			if (hp->h_addrtype == AF_INET) {
183			for (i = 0; hp->h_addr_list[i]; i++) {
184			char ipbuf[16];
185			ip = (const uint8 *)hp->h_addr_list[i];
186			snprintf(ipbuf, sizeof(ipbuf), "%u.%u.%u.%u",
187			ip[0], ip[1], ip[2], ip[3]);
188			if (strlen(ipbuf) > 15) {
189			config_error(filename, linenum,
190			"BUG: strlen(ipbuf) > 15 [%s]", ipbuf);
191			free(di.path);
192			return 0;
193			}
194			prefix = strdup(di.path);
195			if (!prefix) {
196			config_error(filename, linenum, "Out of memory");
197			free(di.path);
198			return 0;
199			}
200			if (!do_AllowDenyHost(filename, -linenum, ipbuf, allow)) {
201			free(di.path);
202			return 0;
203			}
204			}
205			free(di.path);
206			return 1; /* Success */
207			} else {
208			config_error(filename, linenum, "%s: no IPv4 addresses found",
209			param);
210			}
211			} else {
212			config_error(filename, linenum, "%s: %s", param,
213			hstrerror(h_errno));
214			}
215			#else
216			config_error(filename, linenum,
217			"gethostbyname() not available, hostnames may not be"
218			" used");
219			#endif
220			free(di.path);
221			return 0;
222			}
223
224			di.ip = ((uint32 )ip);
225			di.mask = mask ? htonl(0xFFFFFFFFUL << (32-mask)) : 0;
226			di.ip &= di.mask;
227			di.allow = allow;
228			ARRAY_EXTEND(new_protected);
229			new_protected[new_protected_count-1] = di;
230			return 1;
231			}
232
233			/*************************************************************************/
234			/*************************************************************************/
235
236			int init_module(void)
237			{
238			module_httpd = find_module("httpd/main");
239			if (!module_httpd) {
240			module_log("Main httpd module not loaded");
241			exit_module(0);
242			return 0;
243			}
244			use_module(module_httpd);
245
246			if (!add_callback(module_httpd, "auth", do_auth)) {
247			module_log("Unable to add callback");
248			exit_module(0);
249			return 0;
250			}
251
252			return 1;
253			}
254
255			/*************************************************************************/
256
257			int exit_module(int shutdown_unused)
258			{
259			if (module_httpd) {
260			remove_callback(module_httpd, "auth", do_auth);
261			unuse_module(module_httpd);
262			module_httpd = NULL;
263			}
264
265			return 1;
266			}
267
268			/*************************************************************************/
269
270			/*
271			* Local variables:
272			* c-file-style: "stroustrup"
273			* c-file-offsets: ((case-label . ) (statement-case-intro . ))
274			* indent-tabs-mode: nil
275			* End:
276			*
277			* vim: expandtab shiftwidth=4:
278			*/