Add some more hold music
[asterisk/asterisk.git] / acl.c
1 /*
2  * Asterisk -- A telephony toolkit for Linux.
3  *
4  * Various sorts of access control
5  * 
6  * Copyright (C) 1999, Mark Spencer
7  *
8  * Mark Spencer <markster@linux-support.net>
9  *
10  * This program is free software, distributed under the terms of
11  * the GNU General Public License
12  */
13
14 #include <stdio.h>
15 #include <stdlib.h>
16 #include <string.h>
17 #include <sys/time.h>
18 #include <signal.h>
19 #include <errno.h>
20 #include <unistd.h>
21 #include <asterisk/acl.h>
22 #include <asterisk/logger.h>
23 #include <asterisk/channel.h>
24 #include <asterisk/utils.h>
25 #include <asterisk/lock.h>
26 #include <arpa/inet.h>
27 #include <sys/socket.h>
28 #include <netdb.h>
29 #include <net/if.h>
30 #include <netinet/in_systm.h>
31 #include <netinet/ip.h>
32 #include <sys/ioctl.h>
33 #if defined(__OpenBSD__) || defined(__NetBSD__) || defined(__FreeBSD__)
34 #include <fcntl.h>
35 #include <net/route.h>
36
37 AST_MUTEX_DEFINE_STATIC(routeseq_lock);
38 #endif
39
40
41 struct ast_ha {
42         /* Host access rule */
43         struct in_addr netaddr;
44         struct in_addr netmask;
45         int sense;
46         struct ast_ha *next;
47 };
48
49 /* Default IP - if not otherwise set, don't breathe garbage */
50 static struct in_addr __ourip = { 0x00000000 };
51
52 struct my_ifreq {
53         char ifrn_name[IFNAMSIZ];       /* Interface name, e.g. "eth0", "ppp0", etc.  */
54         struct sockaddr_in ifru_addr;
55 };
56
57 /* Free HA structure */
58 void ast_free_ha(struct ast_ha *ha)
59 {
60         struct ast_ha *hal;
61         while(ha) {
62                 hal = ha;
63                 ha = ha->next;
64                 free(hal);
65         }
66 }
67
68 /* Copy HA structure */
69 static void ast_copy_ha(struct ast_ha *from, struct ast_ha *to)
70 {
71         memcpy(&to->netaddr, &from->netaddr, sizeof(from->netaddr));
72         memcpy(&to->netmask, &from->netmask, sizeof(from->netmask));
73         to->sense = from->sense;
74 }
75
76 /* Create duplicate of ha structure */
77 static struct ast_ha *ast_duplicate_ha(struct ast_ha *original)
78 {
79         struct ast_ha *new_ha = malloc(sizeof(struct ast_ha));
80
81         /* Copy from original to new object */
82         ast_copy_ha(original, new_ha); 
83
84         return(new_ha);
85
86 }
87
88 /* Create duplicate HA link list */
89 /*  Used in chan_sip2 templates */
90 struct ast_ha *ast_duplicate_ha_list(struct ast_ha *original)
91 {
92         struct ast_ha *start=original;
93         struct ast_ha *ret = NULL;
94         struct ast_ha *link,*prev=NULL;
95
96         while(start) {
97                 link = ast_duplicate_ha(start);  /* Create copy of this object */
98                 if (prev)
99                         prev->next = link;              /* Link previous to this object */
100
101                 if (!ret) 
102                         ret = link;             /* Save starting point */
103
104                 start = start->next;            /* Go to next object */
105                 prev = link;                    /* Save pointer to this object */
106         }
107         return (ret);                           /* Return start of list */
108 }
109
110 struct ast_ha *ast_append_ha(char *sense, char *stuff, struct ast_ha *path)
111 {
112         struct ast_ha *ha = malloc(sizeof(struct ast_ha));
113         char *nm="255.255.255.255";
114         char tmp[256] = "";
115         struct ast_ha *prev = NULL;
116         struct ast_ha *ret;
117         int x,z;
118         unsigned int y;
119         ret = path;
120         while(path) {
121                 prev = path;
122                 path = path->next;
123         }
124         if (ha) {
125                 strncpy(tmp, stuff, sizeof(tmp) - 1);
126                 nm = strchr(tmp, '/');
127                 if (!nm)
128                         nm = "255.255.255.255";
129                 else {
130                         *nm = '\0';
131                         nm++;
132                 }
133                 if (!strchr(nm, '.')) {
134                         if ((sscanf(nm, "%i", &x) == 1) && (x >= 0) && (x <= 32)) {
135                                 y = 0;
136                                 for (z=0;z<x;z++) {
137                                         y >>= 1;
138                                         y |= 0x80000000;
139                                 }
140                                 ha->netmask.s_addr = htonl(y);
141                         }
142                 } else if (!inet_aton(nm, &ha->netmask)) {
143                         ast_log(LOG_WARNING, "%s not a valid netmask\n", nm);
144                         free(ha);
145                         return path;
146                 }
147                 if (!inet_aton(tmp, &ha->netaddr)) {
148                         ast_log(LOG_WARNING, "%s not a valid IP\n", tmp);
149                         free(ha);
150                         return path;
151                 }
152                 ha->netaddr.s_addr &= ha->netmask.s_addr;
153                 if (!strncasecmp(sense, "p", 1)) {
154                         ha->sense = AST_SENSE_ALLOW;
155                 } else {
156                         ha->sense = AST_SENSE_DENY;
157                 }
158                 ha->next = NULL;
159                 if (prev)
160                         prev->next = ha;
161                 else
162                         ret = ha;
163         }
164         ast_log(LOG_DEBUG, "%s/%s appended to acl for peer\n",stuff, nm);
165         return ret;
166 }
167
168 int ast_apply_ha(struct ast_ha *ha, struct sockaddr_in *sin)
169 {
170         /* Start optimistic */
171         int res = AST_SENSE_ALLOW;
172         while(ha) {
173                 char iabuf[INET_ADDRSTRLEN];
174                 char iabuf2[INET_ADDRSTRLEN];
175                 /* DEBUG */
176                 ast_log(LOG_DEBUG,
177                         "##### Testing %s with %s\n",
178                         ast_inet_ntoa(iabuf, sizeof(iabuf), sin->sin_addr),
179                         ast_inet_ntoa(iabuf2, sizeof(iabuf2), ha->netaddr));
180                 /* For each rule, if this address and the netmask = the net address
181                    apply the current rule */
182                 if ((sin->sin_addr.s_addr & ha->netmask.s_addr) == (ha->netaddr.s_addr))
183                         res = ha->sense;
184                 ha = ha->next;
185         }
186         return res;
187 }
188
189 int ast_get_ip(struct sockaddr_in *sin, char *value)
190 {
191         struct hostent *hp;
192         struct ast_hostent ahp;
193         hp = ast_gethostbyname(value, &ahp);
194         if (hp) {
195                 memcpy(&sin->sin_addr, hp->h_addr, sizeof(sin->sin_addr));
196         } else {
197                 ast_log(LOG_WARNING, "Unable to lookup '%s'\n", value);
198                 return -1;
199         }
200         return 0;
201 }
202
203 /* iface is the interface (e.g. eth0); address is the return value */
204 int ast_lookup_iface(char *iface, struct in_addr *address) {
205         int mysock, res = 0;
206         struct my_ifreq ifreq;
207
208         memset(&ifreq, 0, sizeof(ifreq));
209         strncpy(ifreq.ifrn_name,iface,sizeof(ifreq.ifrn_name) - 1);
210
211         mysock = socket(PF_INET,SOCK_DGRAM,IPPROTO_IP);
212         res = ioctl(mysock,SIOCGIFADDR,&ifreq);
213
214         close(mysock);
215         if (res < 0) {
216                 ast_log(LOG_WARNING, "Unable to get IP of %s: %s\n", iface, strerror(errno));
217                 memcpy((char *)address,(char *)&__ourip,sizeof(__ourip));
218                 return -1;
219         } else {
220                 memcpy((char *)address,(char *)&ifreq.ifru_addr.sin_addr,sizeof(ifreq.ifru_addr.sin_addr));
221                 return 0;
222         }
223 }
224
225 int ast_ouraddrfor(struct in_addr *them, struct in_addr *us)
226 {
227 #if defined(__OpenBSD__) || defined(__NetBSD__) || defined(__FreeBSD__)
228         struct sockaddr_in *sin;
229         struct sockaddr *sa;
230         struct {
231                 struct  rt_msghdr m_rtm;
232                 char    m_space[512];
233         } m_rtmsg;
234         char iabuf[INET_ADDRSTRLEN];
235         char *cp, *p;
236         int i, l, s, seq, flags;
237         pid_t pid = getpid();
238         static int routeseq;    /* Protected by "routeseq_lock" mutex */
239
240         p = ast_strdupa(ast_inet_ntoa(iabuf, sizeof(iabuf), *them));
241         memset(us, 0, sizeof(struct in_addr));
242
243         memset(&m_rtmsg, 0, sizeof(m_rtmsg));
244         m_rtmsg.m_rtm.rtm_type = RTM_GET;
245         m_rtmsg.m_rtm.rtm_flags = RTF_UP | RTF_HOST;
246         m_rtmsg.m_rtm.rtm_version = RTM_VERSION;
247         ast_mutex_lock(&routeseq_lock);
248         seq = ++routeseq;
249         ast_mutex_unlock(&routeseq_lock);
250         m_rtmsg.m_rtm.rtm_seq = seq;
251         m_rtmsg.m_rtm.rtm_addrs = RTA_IFA | RTA_DST;
252         m_rtmsg.m_rtm.rtm_msglen = sizeof(struct rt_msghdr) + sizeof(struct sockaddr_in);
253         sin = (struct sockaddr_in *)m_rtmsg.m_space;
254         sin->sin_family = AF_INET;
255         sin->sin_len = sizeof(struct sockaddr_in);
256         sin->sin_addr = *them;
257
258         if ((s = socket(PF_ROUTE, SOCK_RAW, 0)) < 0) {
259                 ast_log(LOG_ERROR, "Error opening routing socket\n");
260                 return -1;
261         }
262         flags = fcntl(s, F_GETFL);
263         fcntl(s, F_SETFL, flags | O_NONBLOCK);
264         if (write(s, (char *)&m_rtmsg, m_rtmsg.m_rtm.rtm_msglen) < 0) {
265                 ast_log(LOG_ERROR, "Error writing to routing socket: %s\n", strerror(errno));
266                 close(s);
267                 return -1;
268         }
269         do {
270                 l = read(s, (char *)&m_rtmsg, sizeof(m_rtmsg));
271         } while (l > 0 && (m_rtmsg.m_rtm.rtm_seq != 1 || m_rtmsg.m_rtm.rtm_pid != pid));
272         if (l < 0) {
273                 if (errno != EAGAIN)
274                         ast_log(LOG_ERROR, "Error reading from routing socket\n");
275                 close(s);
276                 return -1;
277         }
278         close(s);
279
280         if (m_rtmsg.m_rtm.rtm_version != RTM_VERSION) {
281                 ast_log(LOG_ERROR, "Unsupported route socket protocol version\n");
282                 return -1;
283         }
284
285         if (m_rtmsg.m_rtm.rtm_msglen != l)
286                 ast_log(LOG_WARNING, "Message length mismatch, in packet %d, returned %d\n",
287                                 m_rtmsg.m_rtm.rtm_msglen, l);
288
289         if (m_rtmsg.m_rtm.rtm_errno) {
290                 ast_log(LOG_ERROR, "RTM_GET got %s (%d)\n",
291                                 strerror(m_rtmsg.m_rtm.rtm_errno), m_rtmsg.m_rtm.rtm_errno);
292                 return -1;
293         }
294
295         cp = (char *)m_rtmsg.m_space;
296         if (m_rtmsg.m_rtm.rtm_addrs)
297                 for (i = 1; i; i <<= 1)
298                         if (m_rtmsg.m_rtm.rtm_addrs & i) {
299                                 sa = (struct sockaddr *)cp;
300                                 if (i == RTA_IFA && sa->sa_family == AF_INET) {
301                                         sin = (struct sockaddr_in *)sa;
302                                         *us = sin->sin_addr;
303                                         ast_log(LOG_DEBUG, "Found route to %s, output from our address %s.\n", p, ast_inet_ntoa(iabuf, sizeof(iabuf), *us));
304                                         return 0;
305                                 }
306                                 cp += sa->sa_len > 0 ?
307                                           (1 + ((sa->sa_len - 1) | (sizeof(long) - 1))) :
308                                           sizeof(long);
309                         }
310
311         ast_log(LOG_DEBUG, "No route found for address %s!\n", p);
312         return -1;
313 #else
314         FILE *PROC;
315         unsigned int remote_ip;
316         int res = 1;
317         char line[256];
318         remote_ip = them->s_addr;
319         
320         PROC = fopen("/proc/net/route","r");
321         if (!PROC) {
322                 bzero(us,sizeof(struct in_addr));
323                 return -1;
324         }
325         /* First line contains headers */
326         fgets(line,sizeof(line),PROC);
327
328         while (!feof(PROC)) {
329                 char iface[256];
330                 unsigned int dest, gateway, mask;
331                 int i,fieldnum;
332                 char *fields[40];
333
334                 fgets(line,sizeof(line),PROC);
335
336                 fieldnum = 0;
337                 for (i=0;i<sizeof(line);i++) {
338                         char *offset;
339
340                         fields[fieldnum++] = line + i;
341                         offset = strchr(line + i,'\t');
342                         if (offset == NULL) {
343                                 /* Exit loop */
344                                 break;
345                         } else if (fieldnum >= 9) {
346                                 /* Short-circuit: can't break at 8, since the end of field 7 is figured when fieldnum=8 */
347                                 break;
348                         } else {
349                                 *offset = '\0';
350                                 i = offset - line;
351                         }
352                 }
353                 if (fieldnum >= 8) {
354
355                         sscanf(fields[0],"%s",iface);
356                         sscanf(fields[1],"%x",&dest);
357                         sscanf(fields[2],"%x",&gateway);
358                         sscanf(fields[7],"%x",&mask);
359 #if 0
360                         { char iabuf[INET_ADDRSTRLEN]; 
361                         printf("Addr: %s %08x Dest: %08x Mask: %08x\n", ast_inet_ntoa(iabuf, sizeof(iabuf), *them), remote_ip, dest, mask); }
362 #endif          
363                         /* Looks simple, but here is the magic */
364                         if (((remote_ip & mask) ^ dest) == 0) {
365                                 res = ast_lookup_iface(iface,us);
366                                 break;
367                         }
368                 }
369         }
370         fclose(PROC);
371         if (res == 1) {
372                 ast_log(LOG_WARNING, "Yikes!  No default route?!!\n");
373                 bzero(us,sizeof(struct in_addr));
374                 return -2;
375         } else if (res) {
376                 /* We've already warned in subroutine */
377                 return -1;
378         }
379         return 0;
380 #endif
381 }