Remove crufty CVS $Id$ tags.

[fwd] / acl.c

/* -*-c-*-
 *
 * Access control list handling
 *
 * (c) 1999 Straylight/Edgeware
 */

/*----- Licensing notice --------------------------------------------------* 
 *
 * This file is part of the `fw' port forwarder.
 *
 * `fw' is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 * 
 * `fw' is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 * 
 * You should have received a copy of the GNU General Public License
 * along with `fw'; if not, write to the Free Software Foundation,
 * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 */

/*----- Header files ------------------------------------------------------*/

#include "config.h"

#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include <sys/types.h>
#include <unistd.h>

#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>

#include <mLib/sub.h>

#include "acl.h"

/*----- Main code ---------------------------------------------------------*/

/* --- @acl_addhost@ --- *
 *
 * Arguments:	@acl_entry ***a@ = address of pointer to list tail
 *		@unsigned act@ = what to do with matching addresses
 *		@struct in_addr addr, mask@ = address and mask to match
 *
 * Returns:	---
 *
 * Use:		Adds a host-authentication entry to the end of an access
 *		control list.
 */

static int acl_checkhost(void *aa, struct in_addr addr, unsigned port)
{
  acl_host *a = aa;
  return ((addr.s_addr & a->mask.s_addr) == a->addr.s_addr);
}

static void acl_dumphost(void *aa, FILE *fp)
{
  acl_host *a = aa;
  
  fputs("from ", fp);
  fputs(inet_ntoa(a->addr), fp);
  fputc('/', fp);
  fputs(inet_ntoa(a->mask), fp);
}

static void acl_freehost(void *aa)
{
  acl_host *a = aa;
  DESTROY(a);
}

static const acl_ops acl_hostops = {
  acl_checkhost, acl_dumphost, acl_freehost
};

void acl_addhost(acl_entry ***a, unsigned act,
		 struct in_addr addr, struct in_addr mask)
{
  acl_host *aa = CREATE(acl_host);
  aa->a.next = 0;
  aa->a.ops = &acl_hostops;
  aa->a.act = act;
  aa->addr.s_addr = addr.s_addr & mask.s_addr;
  aa->mask = mask;
  **a = &aa->a;
  *a = &aa->a.next;
}

/* --- @acl_addpriv@ --- *
 *
 * Arguments:	@acl_entry ***a@ = address of pointer to list tail
 *		@unsigned act@ = what to do with matching addresses
 *
 * Returns:	---
 *
 * Use:		Adds a privileged-port check to the end of an access control
 *		list.
 */

static int acl_checkpriv(void *aa, struct in_addr addr, unsigned port)
{
  return (port < 1024);
}

static void acl_dumppriv(void *aa, FILE *fp)
{
  fputs("from privileged ports", fp);
}

static void acl_freepriv(void *aa)
{
  acl_entry *a = aa;
  DESTROY(a);
}

static const acl_ops acl_privops = {
  acl_checkpriv, acl_dumppriv, acl_freepriv
};

void acl_addpriv(acl_entry ***a, unsigned act)
{
  acl_entry *aa = CREATE(acl_entry);
  aa->next = 0;
  aa->ops = &acl_privops;
  aa->act = act;
  **a = aa;
  *a = &aa->next;
}

/* --- @acl_check@ --- *
 *
 * Arguments:	@acl_entry *a@ = pointer to ACL to check against
 *		@struct in_addr addr@ = address to check
 *		@unsigned port@ = port number to check
 *		@int *act@ = verdict (should initially be @ACT_ALLOW@)
 *
 * Returns:	Zero if undecided, nonzero if a rule matched.
 *
 * Use:		Checks an address against an ACL.
 */

int acl_check(acl_entry *a, struct in_addr addr, unsigned port, int *act)
{
  for (; a; a = a->next) {
    if (a->ops->check(a, addr, port)) {
      *act = a->act & ACL_PERM;
      return (1);
    }
    *act = (a->act & ACL_PERM) ^ 1;
  }
  return (0);
}

/* --- @acl_dump@ --- *
 *
 * Arguments:	@acl_entry *a@ = pointer to ACL to dump
 *		@FILE *fp@ = pointer to stream to dump on
 *
 * Returns:	---
 *
 * Use:		Dumps an access control list to an output stream.
 */

void acl_dump(acl_entry *a, FILE *fp)
{
  for (; a; a = a->next) {
    fprintf(fp, "  %s ",
	    (a->act & ACL_PERM) == ACL_ALLOW ? "allow" : "deny");
    a->ops->dump(a, fp);
    fputc('\n', fp);
  }
}

/* --- @acl_free@ --- *
 *
 * Arguments:	@acl_entry *a@ = pointer to a list of ACLs
 *
 * Returns:	---
 *
 * Use:		Frees all of the memory used by an ACL.
 */

void acl_free(acl_entry *a)
{
  while (a) {
    acl_entry *aa = a;
    a = a->next;
    aa->ops->free(aa);
  }
}

/*----- That's all, folks -------------------------------------------------*/