[fwd] / acl.c

/* -*-c-*-
 *
 * $Id: acl.c,v 1.2 1999/07/26 23:28:15 mdw Exp $
 *
 * Access control list handling
 *
 * (c) 1999 Straylight/Edgeware
 */

/*----- Licensing notice --------------------------------------------------* 
 *
 * This file is part of the `fw' port forwarder.
 *
 * `fw' is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 * 
 * `fw' is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 * 
 * You should have received a copy of the GNU General Public License
 * along with `fw'; if not, write to the Free Software Foundation,
 * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 */

/*----- Revision history --------------------------------------------------* 
 *
 * $Log: acl.c,v $
 * Revision 1.2  1999/07/26 23:28:15  mdw
 * Minor modifications for new design.
 *
 * Revision 1.1.1.1  1999/07/01 08:56:23  mdw
 * Initial revision.
 *
 */

/*----- Header files ------------------------------------------------------*/

#include "config.h"

#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>

#include <mLib/sub.h>

#include "acl.h"

/*----- Static variables --------------------------------------------------*/

static acl_entry *global = 0;
static acl_entry **gtail = &global;

/*----- Main code ---------------------------------------------------------*/

/* --- @acl_check@ --- *
 *
 * Arguments:	@acl_entry *a@ = pointer to ACL to check against
 *		@struct in_addr addr@ = address to check
 *
 * Returns:	Nonzero if allowed.
 *
 * Use:		Checks an address against an ACL.
 */

int acl_check(acl_entry *a, struct in_addr addr)
{
  int act = ACL_ALLOW;
  int i;

  for (i = 0; i < 2; i++) {
    for (; a; a = a->next) {
      if ((addr.s_addr & a->mask.s_addr) == a->addr.s_addr)
	return (a->act & ACL_PERM);
      act = (a->act & ACL_PERM) ^ 1;
    }
    a = global;
  }

  return (act);
}

/* --- @acl_dump@ --- *
 *
 * Arguments:	@acl_entry *a@ = pointer to ACL to dump
 *		@FILE *fp@ = pointer to stream to dump on
 *
 * Returns:	---
 *
 * Use:		Dumps an access control list to an output stream.
 */

void acl_dump(acl_entry *a, FILE *fp)
{
  if (!a)
    a = global;
  for (; a; a = a->next) {
    fprintf(fp, "  %s from ",
	    (a->act & ACL_PERM) == ACL_ALLOW ? "allow" : "deny");
    fputs(inet_ntoa(a->addr), fp);
    fputc('/', fp);
    fputs(inet_ntoa(a->mask), fp);
    fputc('\n', fp);
  }
}

/* --- @acl_free@ --- *
 *
 * Arguments:	@acl_entry *a@ = pointer to a list of ACLs
 *
 * Returns:	---
 *
 * Use:		Frees all of the memory used by an ACL.
 */

void acl_free(acl_entry *a)
{
  while (a) {
    acl_entry *aa = a;
    a = a->next;
    DESTROY(aa);
  }
}

/* --- @acl_add@ --- *
 *
 * Arguments:	@acl_entry ***a@ = address of pointer to list tail
 *		@unsigned act@ = what to do with matching addresses
 *		@struct in_addr addr, mask@ = address and mask to match
 *
 * Returns:	---
 *
 * Use:		Adds an entry to the end of an access control list.
 */

void acl_add(acl_entry ***a, unsigned act,
	     struct in_addr addr, struct in_addr mask)
{
  acl_entry *aa = CREATE(acl_entry);
  aa->act = act;
  aa->addr.s_addr = addr.s_addr & mask.s_addr;
  aa->mask = mask;
  aa->next = 0;
  if (!a)
    a = &gtail;
  **a = aa;
  *a = &aa->next;
}

/*----- That's all, folks -------------------------------------------------*/
Commit	Line	Data
e82f7154	1	/* --c--
e82f7154	2	*
e5398e09	3	* $Id: acl.c,v 1.2 1999/07/26 23:28:15 mdw Exp $
e82f7154	4	*
	5	* Access control list handling
	6	*
e5398e09	7	* (c) 1999 Straylight/Edgeware
e82f7154	8	*/
	9
	10	/----- Licensing notice --------------------------------------------------
	11	*
	12	* This file is part of the `fw' port forwarder.
	13	*
	14	* `fw' is free software; you can redistribute it and/or modify
	15	* it under the terms of the GNU General Public License as published by
	16	* the Free Software Foundation; either version 2 of the License, or
	17	* (at your option) any later version.
	18	*
	19	* `fw' is distributed in the hope that it will be useful,
	20	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	21	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	22	* GNU General Public License for more details.
	23	*
	24	* You should have received a copy of the GNU General Public License
	25	* along with `fw'; if not, write to the Free Software Foundation,
	26	* Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
	27	*/
	28
	29	/----- Revision history --------------------------------------------------
	30	*
	31	* $Log: acl.c,v $
e5398e09	32	* Revision 1.2 1999/07/26 23:28:15 mdw
	33	* Minor modifications for new design.
	34	*
	35	* Revision 1.1.1.1 1999/07/01 08:56:23 mdw
	36	* Initial revision.
e82f7154	37	*
	38	*/
	39
	40	/----- Header files ------------------------------------------------------/
	41
	42	#include "config.h"
	43
	44	#include <errno.h>
	45	#include <stdio.h>
	46	#include <stdlib.h>
	47	#include <string.h>
	48
	49	#include <sys/socket.h>
	50	#include <netinet/in.h>
	51	#include <arpa/inet.h>
	52	#include <netdb.h>
	53
	54	#include <mLib/sub.h>
	55
	56	#include "acl.h"
	57
	58	/----- Static variables --------------------------------------------------/
	59
	60	static acl_entry *global = 0;
	61	static acl_entry **gtail = &global;
	62
	63	/----- Main code ---------------------------------------------------------/
	64
	65	/* --- @acl_check@ --- *
	66	*
	67	* Arguments: @acl_entry *a@ = pointer to ACL to check against
	68	* @struct in_addr addr@ = address to check
	69	*
	70	* Returns: Nonzero if allowed.
	71	*
	72	* Use: Checks an address against an ACL.
	73	*/
	74
	75	int acl_check(acl_entry *a, struct in_addr addr)
	76	{
	77	int act = ACL_ALLOW;
	78	int i;
	79
	80	for (i = 0; i < 2; i++) {
	81	for (; a; a = a->next) {
	82	if ((addr.s_addr & a->mask.s_addr) == a->addr.s_addr)
	83	return (a->act & ACL_PERM);
	84	act = (a->act & ACL_PERM) ^ 1;
	85	}
	86	a = global;
	87	}
	88
	89	return (act);
	90	}
	91
	92	/* --- @acl_dump@ --- *
	93	*
	94	* Arguments: @acl_entry *a@ = pointer to ACL to dump
	95	* @FILE *fp@ = pointer to stream to dump on
	96	*
	97	* Returns: ---
	98	*
	99	* Use: Dumps an access control list to an output stream.
	100	*/
101
102	void acl_dump(acl_entry a, FILE fp)
103	{
104	if (!a)
105	a = global;
106	for (; a; a = a->next) {
107	fprintf(fp, " %s from ",
108	(a->act & ACL_PERM) == ACL_ALLOW ? "allow" : "deny");
109	fputs(inet_ntoa(a->addr), fp);
110	fputc('/', fp);
111	fputs(inet_ntoa(a->mask), fp);
112	fputc('\n', fp);
113	}
114	}
115
e5398e09	116	/* --- @acl_free@ --- *
	117	*
	118	* Arguments: @acl_entry *a@ = pointer to a list of ACLs
	119	*
	120	* Returns: ---
	121	*
	122	* Use: Frees all of the memory used by an ACL.
	123	*/
	124
	125	void acl_free(acl_entry *a)
	126	{
	127	while (a) {
	128	acl_entry *aa = a;
	129	a = a->next;
	130	DESTROY(aa);
	131	}
	132	}
	133
e82f7154	134	/* --- @acl_add@ --- *
	135	*
	136	* Arguments: @acl_entry ***a@ = address of pointer to list tail
	137	* @unsigned act@ = what to do with matching addresses
	138	* @struct in_addr addr, mask@ = address and mask to match
	139	*
	140	* Returns: ---
	141	*
	142	* Use: Adds an entry to the end of an access control list.
	143	*/
	144
	145	void acl_add(acl_entry ***a, unsigned act,
	146	struct in_addr addr, struct in_addr mask)
	147	{
	148	acl_entry *aa = CREATE(acl_entry);
	149	aa->act = act;
	150	aa->addr.s_addr = addr.s_addr & mask.s_addr;
	151	aa->mask = mask;
	152	aa->next = 0;
	153	if (!a)
	154	a = &gtail;
	155	**a = aa;
	156	*a = &aa->next;
	157	}
	158
	159	/----- That's all, folks -------------------------------------------------/