399586a84fbd4320f999da020ab0c555ad821ef7
[asterisk/asterisk.git] / acl.c
1 /*
2  * Asterisk -- A telephony toolkit for Linux.
3  *
4  * Various sorts of access control
5  * 
6  * Copyright (C) 1999, Mark Spencer
7  *
8  * Mark Spencer <markster@linux-support.net>
9  *
10  * This program is free software, distributed under the terms of
11  * the GNU General Public License
12  */
13
14 #include <stdio.h>
15 #include <stdlib.h>
16 #include <pthread.h>
17 #include <string.h>
18 #include <sys/time.h>
19 #include <signal.h>
20 #include <errno.h>
21 #include <unistd.h>
22 #include <asterisk/acl.h>
23 #include <asterisk/logger.h>
24 #include <asterisk/channel.h>
25 #include <arpa/inet.h>
26 #include <sys/socket.h>
27 #include <netdb.h>
28 #include <net/if.h>
29 #include <netinet/in_systm.h>
30 #include <netinet/ip.h>
31 #include <sys/ioctl.h>
32 #ifdef __OpenBSD__
33 #include <net/route.h>
34
35 static ast_mutex_t routeseq_lock = AST_MUTEX_INITIALIZER;
36 #endif
37
38 #define AST_SENSE_DENY                  0
39 #define AST_SENSE_ALLOW                 1
40
41 struct ast_ha {
42         /* Host access rule */
43         struct in_addr netaddr;
44         struct in_addr netmask;
45         int sense;
46         struct ast_ha *next;
47 };
48
49 /* Default IP - if not otherwise set, don't breathe garbage */
50 static struct in_addr __ourip = { 0x00000000 };
51
52 struct my_ifreq {
53         char ifrn_name[IFNAMSIZ];       /* Interface name, e.g. "eth0", "ppp0", etc.  */
54         struct sockaddr_in ifru_addr;
55 };
56
57 void ast_free_ha(struct ast_ha *ha)
58 {
59         struct ast_ha *hal;
60         while(ha) {
61                 hal = ha;
62                 ha = ha->next;
63                 free(hal);
64         }
65 }
66
67 struct ast_ha *ast_append_ha(char *sense, char *stuff, struct ast_ha *path)
68 {
69         struct ast_ha *ha = malloc(sizeof(struct ast_ha));
70         char *nm;
71         struct ast_ha *prev = NULL;
72         struct ast_ha *ret;
73         ret = path;
74         while(path) {
75                 prev = path;
76                 path = path->next;
77         }
78         if (ha) {
79                 char *stringp=NULL;
80                 stringp=stuff;
81                 strsep(&stringp, "/");
82                 nm = strsep(&stringp, "/");
83                 if (!nm)
84                         nm = "255.255.255.255";
85                 if (!inet_aton(stuff, &ha->netaddr)) {
86                         ast_log(LOG_WARNING, "%s not a valid IP\n", stuff);
87                         free(ha);
88                         return NULL;
89                 }
90                 if (!inet_aton(nm, &ha->netmask)) {
91                         ast_log(LOG_WARNING, "%s not a valid netmask\n", nm);
92                         free(ha);
93                         return NULL;
94                 }
95                 ha->netaddr.s_addr &= ha->netmask.s_addr;
96                 if (!strncasecmp(sense, "p", 1)) {
97                         ha->sense = AST_SENSE_ALLOW;
98                 } else {
99                         ha->sense = AST_SENSE_DENY;
100                 }
101                 ha->next = NULL;
102                 if (prev)
103                         prev->next = ha;
104                 else
105                         ret = ha;
106         }
107         return ret;
108 }
109
110 int ast_apply_ha(struct ast_ha *ha, struct sockaddr_in *sin)
111 {
112         /* Start optimistic */
113         int res = AST_SENSE_ALLOW;
114         while(ha) {
115                 /* For each rule, if this address and the netmask = the net address
116                    apply the current rule */
117                 if ((sin->sin_addr.s_addr & ha->netmask.s_addr) == (ha->netaddr.s_addr))
118                         res = ha->sense;
119                 ha = ha->next;
120         }
121         return res;
122 }
123
124 int ast_get_ip(struct sockaddr_in *sin, char *value)
125 {
126         struct hostent *hp;
127         hp = gethostbyname(value);
128         if (hp) {
129                 memcpy(&sin->sin_addr, hp->h_addr, sizeof(sin->sin_addr));
130         } else {
131                 ast_log(LOG_WARNING, "Unable to lookup '%s'\n", value);
132                 return -1;
133         }
134         return 0;
135 }
136
137 int inaddrcmp(struct sockaddr_in *sin1, struct sockaddr_in *sin2)
138 {
139         return ((sin1->sin_addr.s_addr != sin2->sin_addr.s_addr )
140                         || (sin1->sin_port != sin2->sin_port));
141 }
142
143 /* iface is the interface (e.g. eth0); address is the return value */
144 int ast_lookup_iface(char *iface, struct in_addr *address) {
145         int mysock, res = 0;
146         struct my_ifreq ifreq;
147
148         memset(&ifreq, 0, sizeof(ifreq));
149         strncpy(ifreq.ifrn_name,iface,sizeof(ifreq.ifrn_name) - 1);
150
151         mysock = socket(PF_INET,SOCK_DGRAM,IPPROTO_IP);
152         res = ioctl(mysock,SIOCGIFADDR,&ifreq);
153
154         close(mysock);
155         if (res < 0) {
156                 ast_log(LOG_WARNING, "Unable to get IP of %s: %s\n", iface, strerror(errno));
157                 memcpy((char *)address,(char *)&__ourip,sizeof(__ourip));
158                 return -1;
159         } else {
160                 memcpy((char *)address,(char *)&ifreq.ifru_addr.sin_addr,sizeof(ifreq.ifru_addr.sin_addr));
161                 return 0;
162         }
163 }
164
165 int ast_ouraddrfor(struct in_addr *them, struct in_addr *us)
166 {
167 #ifdef __OpenBSD__
168         struct sockaddr_in *sin;
169         struct sockaddr *sa;
170         struct {
171                 struct  rt_msghdr m_rtm;
172                 char    m_space[512];
173         } m_rtmsg;
174         char *cp, *p = ast_strdupa(inet_ntoa(*them));
175         int i, l, s, seq;
176         pid_t pid = getpid();
177         static int routeseq;    /* Protected by "routeseq_lock" mutex */
178
179         memset(us, 0, sizeof(struct in_addr));
180
181         memset(&m_rtmsg, 0, sizeof(m_rtmsg));
182         m_rtmsg.m_rtm.rtm_type = RTM_GET;
183         m_rtmsg.m_rtm.rtm_flags = RTF_UP | RTF_HOST;
184         m_rtmsg.m_rtm.rtm_version = RTM_VERSION;
185         ast_mutex_lock(&routeseq_lock);
186         seq = ++routeseq;
187         ast_mutex_unlock(&routeseq_lock);
188         m_rtmsg.m_rtm.rtm_seq = seq;
189         m_rtmsg.m_rtm.rtm_addrs = RTA_IFA | RTA_DST;
190         m_rtmsg.m_rtm.rtm_msglen = sizeof(struct rt_msghdr) + sizeof(struct sockaddr_in);
191         sin = (struct sockaddr_in *)m_rtmsg.m_space;
192         sin->sin_family = AF_INET;
193         sin->sin_len = sizeof(struct sockaddr_in);
194         sin->sin_addr = *them;
195
196         if ((s = socket(PF_ROUTE, SOCK_RAW, 0)) < 0) {
197                 ast_log(LOG_ERROR, "Error opening routing socket\n");
198                 return -1;
199         }
200         if (write(s, (char *)&m_rtmsg, m_rtmsg.m_rtm.rtm_msglen) < 0) {
201                 ast_log(LOG_ERROR, "Error writing to routing socket: %s\n", strerror(errno));
202                 close(s);
203                 return -1;
204         }
205         do {
206                 l = read(s, (char *)&m_rtmsg, sizeof(m_rtmsg));
207         } while (l > 0 && (m_rtmsg.m_rtm.rtm_seq != 1 || m_rtmsg.m_rtm.rtm_pid != pid));
208         close(s);
209         if (l < 0) {
210                 ast_log(LOG_ERROR, "Error reading from routing socket\n");
211                 return -1;
212         }
213
214         if (m_rtmsg.m_rtm.rtm_version != RTM_VERSION) {
215                 ast_log(LOG_ERROR, "Unsupported route socket protocol version\n");
216                 return -1;
217         }
218
219         if (m_rtmsg.m_rtm.rtm_msglen != l)
220                 ast_log(LOG_WARNING, "Message length mismatch, in packet %d, returned %d\n",
221                                 m_rtmsg.m_rtm.rtm_msglen, l);
222
223         if (m_rtmsg.m_rtm.rtm_errno) {
224                 ast_log(LOG_ERROR, "RTM_GET got %s (%d)\n",
225                                 strerror(m_rtmsg.m_rtm.rtm_errno), m_rtmsg.m_rtm.rtm_errno);
226                 return -1;
227         }
228
229         cp = (char *)m_rtmsg.m_space;
230         if (m_rtmsg.m_rtm.rtm_addrs)
231                 for (i = 1; i; i <<= 1)
232                         if (m_rtmsg.m_rtm.rtm_addrs & i) {
233                                 sa = (struct sockaddr *)cp;
234                                 if (i == RTA_IFA && sa->sa_family == AF_INET) {
235                                         sin = (struct sockaddr_in *)sa;
236                                         *us = sin->sin_addr;
237                                         ast_log(LOG_DEBUG, "Found route to %s, output from our address %s.\n", p, inet_ntoa(*us));
238                                         return 0;
239                                 }
240                                 cp += sa->sa_len > 0 ?
241                                           (1 + ((sa->sa_len - 1) | (sizeof(long) - 1))) :
242                                           sizeof(long);
243                         }
244
245         ast_log(LOG_DEBUG, "No route found for address %s!\n", p);
246         return -1;
247 #else
248         FILE *PROC;
249         unsigned int remote_ip;
250         int res = 1;
251         char line[256];
252         remote_ip = them->s_addr;
253         
254         PROC = fopen("/proc/net/route","r");
255         if (!PROC) {
256                 bzero(us,sizeof(struct in_addr));
257                 return -1;
258         }
259         /* First line contains headers */
260         fgets(line,sizeof(line),PROC);
261
262         while (!feof(PROC)) {
263                 char iface[8];
264                 unsigned int dest, gateway, mask;
265                 int i,fieldnum;
266                 char *fields[40];
267
268                 fgets(line,sizeof(line),PROC);
269
270                 fieldnum = 0;
271                 for (i=0;i<sizeof(line);i++) {
272                         char *offset;
273
274                         fields[fieldnum++] = line + i;
275                         offset = strchr(line + i,'\t');
276                         if (offset == NULL) {
277                                 /* Exit loop */
278                                 break;
279                         } else if (fieldnum >= 9) {
280                                 /* Short-circuit: can't break at 8, since the end of field 7 is figured when fieldnum=8 */
281                                 break;
282                         } else {
283                                 *offset = '\0';
284                                 i = offset - line;
285                         }
286                 }
287
288                 sscanf(fields[0],"%s",iface);
289                 sscanf(fields[1],"%x",&dest);
290                 sscanf(fields[2],"%x",&gateway);
291                 sscanf(fields[7],"%x",&mask);
292 #if 0
293                 printf("Addr: %s %08x Dest: %08x Mask: %08x\n", inet_ntoa(*them), remote_ip, dest, mask);
294 #endif          
295                 /* Looks simple, but here is the magic */
296                 if (((remote_ip & mask) ^ dest) == 0) {
297                         res = ast_lookup_iface(iface,us);
298                         break;
299                 }
300         }
301         fclose(PROC);
302         if (res == 1) {
303                 ast_log(LOG_WARNING, "Yikes!  No default route?!!\n");
304                 bzero(us,sizeof(struct in_addr));
305                 return -2;
306         } else if (res) {
307                 /* We've already warned in subroutine */
308                 return -1;
309         }
310         return 0;
311 #endif
312 }