1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
|
/* acl.c
* Access Control List
*
* Copyright (C) 2000,2001,2002 by Salvatore Sanfilippo
* <antirez@invece.org>
*
* This code is under the GPL license version 2
* See the COPYING file for more information
*/
/* ens.h must be included before all other includes */
#include "ens.h"
#include <string.h>
#include <stdlib.h>
/* global vars */
/* ACL chains, allow and deny lists for different targets */
struct acl *acl_dns_allow_head = NULL;
struct acl *acl_dns_allow_tail = NULL;
struct acl *acl_dns_deny_head = NULL;
struct acl *acl_dns_deny_tail = NULL;
struct acl *acl_fwd_allow_head = NULL;
struct acl *acl_fwd_allow_tail = NULL;
struct acl *acl_fwd_deny_head = NULL;
struct acl *acl_fwd_deny_tail = NULL;
struct acl *acl_axfr_allow_head = NULL;
struct acl *acl_axfr_allow_tail = NULL;
struct acl *acl_axfr_deny_head = NULL;
struct acl *acl_axfr_deny_tail = NULL;
/* not exported functions */
static int acl_check(char *ip, struct acl *allow, struct acl *deny);
static void acl_free_list(struct acl **head, struct acl **tail);
/* exported functions */
void acl_add_rule(char *rule, struct acl **head, struct acl **tail);
void acl_free(void);
int acl_check_dns(char *ip);
int acl_check_fwd(char *ip);
int acl_check_axfr(char *ip);
/* acl_add_rule() allocate and set a rule in the
* acl list identified by 'head' and 'tail' */
void acl_add_rule(char *rule, struct acl **head, struct acl **tail)
{
if (*head == NULL) {
*head = malloc(sizeof(struct acl));
if (*head == NULL)
goto out_of_memory;
*tail = *head;
} else {
(*tail)->next = malloc(sizeof(struct acl));
if ((*tail)->next == NULL)
goto out_of_memory;
*tail = (*tail)->next;
}
strlcpy((*tail)->rule, rule, RULE_MAXSIZE);
(*tail)->next = NULL;
return;
out_of_memory:
perror("acl_dns_add_rule() malloc");
exit(1);
}
int acl_check_dns(char *ip)
{
return acl_check(ip, acl_dns_allow_head, acl_dns_deny_head);
}
int acl_check_fwd(char *ip)
{
return acl_check(ip, acl_fwd_allow_head, acl_fwd_deny_head);
}
int acl_check_axfr(char *ip)
{
return acl_check(ip, acl_axfr_allow_head, acl_axfr_deny_head);
}
/* acl_check() implements the hosts.allow/hosts.deny style ACL */
static int acl_check(char *ip, struct acl *allow, struct acl *deny)
{
struct acl *a;
size_t l;
a = allow; /* search in the allow list */
while(a) {
l = strlen(a->rule);
if (a->rule[l-1] != '$') {
if (!strncmp(a->rule, ip, l))
return ACL_ALLOW;
} else {
if (l == 1) /* only $ */
return ACL_ALLOW;
if (l == strlen(ip)+1 && !strncmp(a->rule, ip, l-1))
return ACL_ALLOW;
}
a = a->next;
}
a = deny; /* search in the deny list */
while(a) {
l = strlen(a->rule);
if (a->rule[l-1] != '$') {
if (!strncmp(a->rule, ip, l))
return ACL_DENY;
} else {
if (l == 1) /* only $ */
return ACL_DENY;
if (l == strlen(ip)+1 && !strncmp(a->rule, ip, l-1))
return ACL_DENY;
}
a = a->next;
}
return ACL_ALLOW;
}
/* Free all elements of some ACL list */
static void acl_free_list(struct acl **head, struct acl **tail)
{
struct acl *a, *t;
a = *head;
while(a) {
t = a->next;
free(a);
a = t;
};
*head = *tail = NULL;
}
/* Free all the ACL lists */
void acl_free(void)
{
/* free the ACL list */
acl_free_list(&acl_dns_allow_head, &acl_dns_allow_tail);
acl_free_list(&acl_dns_deny_head, &acl_dns_deny_tail);
acl_free_list(&acl_fwd_allow_head, &acl_axfr_allow_tail);
acl_free_list(&acl_fwd_deny_head, &acl_axfr_deny_tail);
acl_free_list(&acl_axfr_allow_head, &acl_axfr_allow_tail);
acl_free_list(&acl_axfr_deny_head, &acl_axfr_deny_tail);
}
|
