src/acl/Ip.cc

   1 /*
   2  * DEBUG: section 28    Access Control
   3  * AUTHOR: Duane Wessels
   4  *
   5  * SQUID Web Proxy Cache          http://www.squid-cache.org/
   6  * ----------------------------------------------------------
   7  *
   8  *  Squid is the result of efforts by numerous individuals from
   9  *  the Internet community; see the CONTRIBUTORS file for full
  10  *  details.   Many organizations have provided support for Squid's
  11  *  development; see the SPONSORS file for full details.  Squid is
  12  *  Copyrighted (C) 2001 by the Regents of the University of
  13  *  California; see the COPYRIGHT file for full details.  Squid
  14  *  incorporates software developed and/or copyrighted by other
  15  *  sources; see the CREDITS file for full details.
  16  *
  17  *  This program is free software; you can redistribute it and/or modify
  18  *  it under the terms of the GNU General Public License as published by
  19  *  the Free Software Foundation; either version 2 of the License, or
  20  *  (at your option) any later version.
  21  *
  22  *  This program is distributed in the hope that it will be useful,
  23  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  24  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  25  *  GNU General Public License for more details.
  26  *
  27  *  You should have received a copy of the GNU General Public License
  28  *  along with this program; if not, write to the Free Software
  29  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA.
  30  *
  31  * Copyright (c) 2003, Robert Collins <robertc@squid-cache.org>
  32  */
  33
  34 #include "squid.h"
  35 #include "acl/Checklist.h"
  36 #include "acl/Ip.h"
  37 #include "cache_cf.h"
  38 #include "Debug.h"
  39 #include "ip/tools.h"
  40 #include "MemBuf.h"
  41 #include "wordlist.h"
  42
  43 void *
  44 ACLIP::operator new (size_t byteCount)
  45 {
  46     fatal ("ACLIP::operator new: unused");
  47     return (void *)1;
  48 }
  49
  50 void
  51 ACLIP::operator delete (void *address)
  52 {
  53     fatal ("ACLIP::operator delete: unused");
  54 }
  55
  56 /**
  57  * Writes an IP ACL data into a buffer, then copies the buffer into the wordlist given
  58  *
  59  \param ip      ACL data structure to display
  60  \param state   wordlist structure which is being generated
  61  */
  62 void
  63 ACLIP::DumpIpListWalkee(acl_ip_data * const & ip, void *state)
  64 {
  65     static_cast<SBufList *>(state)->push_back(ip->toSBuf());
  66 }
  67
  68 /**
  69  * print/format an acl_ip_data structure for debugging output.
  70  *
  71  \param buf     string buffer to write to
  72  \param len     size of the buffer available
  73  */
  74 void
  75 acl_ip_data::toStr(char *buf, int len) const
  76 {
  77     char *b1 = buf;
  78     char *b2 = NULL;
  79     char *b3 = NULL;
  80     int rlen = 0;
  81
  82     addr1.toStr(b1, len - rlen );
  83     rlen = strlen(buf);
  84     b2 = buf + rlen;
  85
  86     if (!addr2.isAnyAddr()) {
  87         b2[0] = '-';
  88         ++rlen;
  89         addr2.toStr(&(b2[1]), len - rlen );
  90         rlen = strlen(buf);
  91     } else
  92         b2[0] = '\0';
  93
  94     b3 = buf + rlen;
  95
  96     if (!mask.isNoAddr()) {
  97         b3[0] = '/';
  98         ++rlen;
  99         int cidr =  mask.cidr() - (addr1.isIPv4()?96:0);
 100         snprintf(&(b3[1]), (len-rlen), "%u", (unsigned int)(cidr<0?0:cidr) );
 101     } else
 102         b3[0] = '\0';
 103 }
 104
 105 SBuf
 106 acl_ip_data::toSBuf() const
 107 {
 108     const int bufsz = MAX_IPSTRLEN*2+6;
 109     static char tmpbuf[ bufsz ];
 110     toStr(tmpbuf,bufsz);
 111     return SBuf(tmpbuf);
 112 }
 113
 114 /*
 115  * aclIpAddrNetworkCompare - The guts of the comparison for IP ACLs
 116  * matching checks.  The first argument (p) is a "host" address,
 117  * i.e.  the IP address of a cache client.  The second argument (q)
 118  * is an entry in some address-based access control element.  This
 119  * function is called via ACLIP::match() and the splay library.
 120  */
 121 int
 122 aclIpAddrNetworkCompare(acl_ip_data * const &p, acl_ip_data * const &q)
 123 {
 124     Ip::Address A = p->addr1;
 125
 126     /* apply netmask */
 127     A.applyMask(q->mask);
 128
 129     debugs(28,9, "aclIpAddrNetworkCompare: compare: " << p->addr1 << "/" << q->mask << " (" << A << ")  vs " <<
 130            q->addr1 << "-" << q->addr2 << "/" << q->mask);
 131
 132     if (q->addr2.isAnyAddr()) {       /* single address check */
 133
 134         return A.matchIPAddr( q->addr1 );
 135
 136     } else {                   /* range address check */
 137
 138         if ( (A >= q->addr1) && (A <= q->addr2) )
 139             return 0; /* valid. inside range. */
 140         else
 141             return A.matchIPAddr( q->addr1 ); /* outside of range, 'less than' */
 142     }
 143 }
 144
 145 /*
 146  * acl_ip_data::NetworkCompare - Compare two acl_ip_data entries.  Strictly
 147  * used by the splay insertion routine.  It emits a warning if it
 148  * detects a "collision" or overlap that would confuse the splay
 149  * sorting algorithm.  Much like aclDomainCompare.
 150  * The first argument (p) is a "host" address, i.e. the IP address of a cache client.
 151  * The second argument (b) is a "network" address that might have a subnet and/or range.
 152  * We mask the host address bits with the network subnet mask.
 153  */
 154 int
 155 acl_ip_data::NetworkCompare(acl_ip_data * const & a, acl_ip_data * const &b)
 156 {
 157     int ret;
 158     bool bina = true;
 159     ret = aclIpAddrNetworkCompare(b, a);
 160
 161     if (ret != 0) {
 162         bina = false;
 163         ret = aclIpAddrNetworkCompare(a, b);
 164     }
 165
 166     if (ret == 0) {
 167         char buf_n1[3*(MAX_IPSTRLEN+1)];
 168         char buf_n2[3*(MAX_IPSTRLEN+1)];
 169         if (bina) {
 170             b->toStr(buf_n1, 3*(MAX_IPSTRLEN+1));
 171             a->toStr(buf_n2, 3*(MAX_IPSTRLEN+1));
 172         } else {
 173             a->toStr(buf_n1, 3*(MAX_IPSTRLEN+1));
 174             b->toStr(buf_n2, 3*(MAX_IPSTRLEN+1));
 175         }
 176         debugs(28, DBG_CRITICAL, "WARNING: (" << (bina?'B':'A') << ") '" << buf_n1 << "' is a subnetwork of (" << (bina?'A':'B') << ") '" << buf_n2 << "'");
 177         debugs(28, DBG_CRITICAL, "WARNING: because of this '" << (bina?buf_n2:buf_n1) << "' is ignored to keep splay tree searching predictable");
 178         debugs(28, DBG_CRITICAL, "WARNING: You should probably remove '" << buf_n1 << "' from the ACL named '" << AclMatchedName << "'");
 179     }
 180
 181     return ret;
 182 }
 183
 184 /**
 185  * Decode an ascii representation (asc) of a IP netmask address or CIDR,
 186  * and place resulting information in mask.
 187  * This function should NOT be called if 'asc' is a hostname!
 188  */
 189 bool
 190 acl_ip_data::DecodeMask(const char *asc, Ip::Address &mask, int ctype)
 191 {
 192     char junk;
 193     int a1 = 0;
 194
 195     /* default is a mask that doesn't change any IP */
 196     mask.setNoAddr();
 197
 198     if (!asc || !*asc) {
 199         return true;
 200     }
 201
 202     /* An int mask 128, 32 */
 203     if ((sscanf(asc, "%d%c", &a1, &junk)==1) &&
 204             (a1 <= 128) && (a1  >= 0)
 205        ) {
 206         return mask.applyMask(a1, ctype);
 207     }
 208
 209     /* dotted notation */
 210     /* assignment returns true if asc contained an IP address as text */
 211     if ((mask = asc)) {
 212         /* HACK: IPv4 netmasks don't cleanly map to IPv6 masks. */
 213         debugs(28, DBG_CRITICAL, "WARNING: Netmasks are deprecated. Please use CIDR masks instead.");
 214         if (mask.isIPv4()) {
 215             /* locate what CIDR mask was _probably_ meant to be in its native protocol format. */
 216             /* this will completely crap out with a security fail-open if the admin is playing mask tricks */
 217             /* however, thats their fault, and we do warn. see bug 2601 for the effects if we don't do this. */
 218             unsigned int m = mask.cidr();
 219             debugs(28, DBG_CRITICAL, "WARNING: IPv4 netmasks are particularly nasty when used to compare IPv6 to IPv4 ranges.");
 220             debugs(28, DBG_CRITICAL, "WARNING: For now we will assume you meant to write /" << m);
 221             /* reset the mask completely, and crop to the CIDR boundary back properly. */
 222             mask.setNoAddr();
 223             return mask.applyMask(m,AF_INET);
 224         }
 225         return true;
 226     }
 227
 228     return false;
 229 }
 230
 231 /* Handle either type of address, IPv6 will be discarded with a warning if disabled */
 232 #define SCAN_ACL1_6       "%[0123456789ABCDEFabcdef:]-%[0123456789ABCDEFabcdef:]/%[0123456789]"
 233 #define SCAN_ACL2_6       "%[0123456789ABCDEFabcdef:]-%[0123456789ABCDEFabcdef:]%c"
 234 #define SCAN_ACL3_6       "%[0123456789ABCDEFabcdef:]/%[0123456789]"
 235 #define SCAN_ACL4_6       "%[0123456789ABCDEFabcdef:]/%c"
 236 /* We DO need to know which is which though, for proper CIDR masking. */
 237 #define SCAN_ACL1_4       "%[0123456789.]-%[0123456789.]/%[0123456789.]"
 238 #define SCAN_ACL2_4       "%[0123456789.]-%[0123456789.]%c"
 239 #define SCAN_ACL3_4       "%[0123456789.]/%[0123456789.]"
 240 #define SCAN_ACL4_4       "%[0123456789.]/%c"
 241
 242 acl_ip_data *
 243 acl_ip_data::FactoryParse(const char *t)
 244 {
 245     LOCAL_ARRAY(char, addr1, 256);
 246     LOCAL_ARRAY(char, addr2, 256);
 247     LOCAL_ARRAY(char, mask, 256);
 248     acl_ip_data *r = NULL;
 249     acl_ip_data **Q = NULL;
 250     Ip::Address temp;
 251     char c;
 252     unsigned int changed;
 253     acl_ip_data *q = new acl_ip_data;
 254     int iptype = AF_UNSPEC;
 255
 256     debugs(28, 5, "aclIpParseIpData: " << t);
 257
 258     /* Special ACL RHS "all" matches entire Internet */
 259     if (strcmp(t, "all") == 0) {
 260         debugs(28, 9, "aclIpParseIpData: magic 'all' found.");
 261         q->addr1.setAnyAddr();
 262         q->addr2.setEmpty();
 263         q->mask.setAnyAddr();
 264         return q;
 265     }
 266
 267     /* Detect some old broken strings equivalent to 'all'.
 268      * treat them nicely. But be loud until its fixed.  */
 269     if (strcmp(t, "0/0") == 0 || strcmp(t, "0.0.0.0/0") == 0 || strcmp(t, "0.0.0.0/0.0.0.0") == 0 ||
 270             strcmp(t, "0.0.0.0-255.255.255.255") == 0 || strcmp(t, "0.0.0.0-0.0.0.0/0") == 0) {
 271
 272         debugs(28,DBG_CRITICAL, "ERROR: '" << t << "' needs to be replaced by the term 'all'.");
 273         debugs(28,DBG_CRITICAL, "SECURITY NOTICE: Overriding config setting. Using 'all' instead.");
 274         q->addr1.setAnyAddr();
 275         q->addr2.setEmpty();
 276         q->mask.setAnyAddr();
 277         return q;
 278     }
 279
 280     /* Special ACL RHS "ipv4" matches IPv4 Internet
 281      * A nod to IANA; we include the entire class space in case
 282      * they manage to find a way to recover and use it */
 283     if (strcmp(t, "ipv4") == 0) {
 284         q->mask.setNoAddr();
 285         q->mask.applyMask(0, AF_INET);
 286         return q;
 287     }
 288
 289     /* Special ACL RHS "ipv6" matches IPv6-Unicast Internet */
 290     if (strcmp(t, "ipv6") == 0) {
 291         debugs(28, 9, "aclIpParseIpData: magic 'ipv6' found.");
 292         r = q; // save head of the list for result.
 293
 294         /* 0000::/4 is a mix of localhost and obsolete IPv4-mapping space. Not valid outside this host. */
 295
 296         /* Future global unicast space: 1000::/4 */
 297         q->addr1 = "1000::";
 298         q->mask.setNoAddr();
 299         q->mask.applyMask(4, AF_INET6);
 300
 301         /* Current global unicast space: 2000::/4 = (2000::/4 - 3000::/4) */
 302         q->next = new acl_ip_data;
 303         q = q->next;
 304         q->addr1 = "2000::";
 305         q->mask.setNoAddr();
 306         q->mask.applyMask(3, AF_INET6);
 307
 308         /* Future global unicast space: 4000::/2 = (4000::/4 - 7000::/4) */
 309         q->next = new acl_ip_data;
 310         q = q->next;
 311         q->addr1 = "4000::";
 312         q->mask.setNoAddr();
 313         q->mask.applyMask(2, AF_INET6);
 314
 315         /* Future global unicast space: 8000::/2 = (8000::/4 - B000::/4) */
 316         q->next = new acl_ip_data;
 317         q = q->next;
 318         q->addr1 = "8000::";
 319         q->mask.setNoAddr();
 320         q->mask.applyMask(2, AF_INET6);
 321
 322         /* Future global unicast space: C000::/3 = (C000::/4 - D000::/4) */
 323         q->next = new acl_ip_data;
 324         q = q->next;
 325         q->addr1 = "C000::";
 326         q->mask.setNoAddr();
 327         q->mask.applyMask(3, AF_INET6);
 328
 329         /* Future global unicast space: E000::/4 */
 330         q->next = new acl_ip_data;
 331         q = q->next;
 332         q->addr1 = "E000::";
 333         q->mask.setNoAddr();
 334         q->mask.applyMask(4, AF_INET6);
 335
 336         /* F000::/4 is mostly reserved non-unicast. With some exceptions ... */
 337
 338         /* RFC 4193 Unique-Local unicast space: FC00::/7 */
 339         q->next = new acl_ip_data;
 340         q = q->next;
 341         q->addr1 = "FC00::";
 342         q->mask.setNoAddr();
 343         q->mask.applyMask(7, AF_INET6);
 344
 345         /* Link-Local unicast space: FE80::/10 */
 346         q->next = new acl_ip_data;
 347         q = q->next;
 348         q->addr1 = "FE80::";
 349         q->mask.setNoAddr();
 350         q->mask.applyMask(10, AF_INET6);
 351
 352         return r;
 353     }
 354
 355 // IPv4
 356     if (sscanf(t, SCAN_ACL1_4, addr1, addr2, mask) == 3) {
 357         debugs(28, 9, "aclIpParseIpData: '" << t << "' matched: SCAN1-v4: " << SCAN_ACL1_4);
 358         iptype=AF_INET;
 359     } else if (sscanf(t, SCAN_ACL2_4, addr1, addr2, &c) >= 2) {
 360         debugs(28, 9, "aclIpParseIpData: '" << t << "' matched: SCAN2-v4: " << SCAN_ACL2_4);
 361         mask[0] = '\0';
 362         iptype=AF_INET;
 363     } else if (sscanf(t, SCAN_ACL3_4, addr1, mask) == 2) {
 364         debugs(28, 9, "aclIpParseIpData: '" << t << "' matched: SCAN3-v4: " << SCAN_ACL3_4);
 365         addr2[0] = '\0';
 366         iptype=AF_INET;
 367     } else if (sscanf(t, SCAN_ACL4_4, addr1,&c) == 2) {
 368         debugs(28, 9, "aclIpParseIpData: '" << t << "' matched: SCAN4-v4: " << SCAN_ACL4_4);
 369         addr2[0] = '\0';
 370         mask[0] = '\0';
 371         iptype=AF_INET;
 372
 373 // IPv6
 374     } else if (sscanf(t, SCAN_ACL1_6, addr1, addr2, mask) == 3) {
 375         debugs(28, 9, "aclIpParseIpData: '" << t << "' matched: SCAN1-v6: " << SCAN_ACL1_6);
 376         iptype=AF_INET6;
 377     } else if (sscanf(t, SCAN_ACL2_6, addr1, addr2, &c) >= 2) {
 378         debugs(28, 9, "aclIpParseIpData: '" << t << "' matched: SCAN2-v6: " << SCAN_ACL2_6);
 379         mask[0] = '\0';
 380         iptype=AF_INET6;
 381     } else if (sscanf(t, SCAN_ACL3_6, addr1, mask) == 2) {
 382         debugs(28, 9, "aclIpParseIpData: '" << t << "' matched: SCAN3-v6: " << SCAN_ACL3_6);
 383         addr2[0] = '\0';
 384         iptype=AF_INET6;
 385     } else if (sscanf(t, SCAN_ACL4_6, addr1, mask) == 2) {
 386         debugs(28, 9, "aclIpParseIpData: '" << t << "' matched: SCAN4-v6: " << SCAN_ACL4_6);
 387         addr2[0] = '\0';
 388         iptype=AF_INET6;
 389
 390 // Neither
 391     } else if (sscanf(t, "%[^/]/%s", addr1, mask) == 2) {
 392         debugs(28, 9, "aclIpParseIpData: '" << t << "' matched: non-IP pattern: %[^/]/%s");
 393         addr2[0] = '\0';
 394     } else if (sscanf(t, "%s", addr1) == 1) {
 395         /*
 396          * Note, must use plain getaddrinfo() here because at startup
 397          * ipcache hasn't been initialized
 398          * TODO: offload this to one of the Ip::Address lookups.
 399          */
 400
 401         debugs(28, 5, "aclIpParseIpData: Lookup Host/IP " << addr1);
 402         struct addrinfo *hp = NULL, *x = NULL;
 403         struct addrinfo hints;
 404         Ip::Address *prev_addr = NULL;
 405
 406         memset(&hints, 0, sizeof(struct addrinfo));
 407
 408         int errcode = getaddrinfo(addr1,NULL,&hints,&hp);
 409         if (hp == NULL) {
 410             debugs(28, DBG_CRITICAL, "aclIpParseIpData: Bad host/IP: '" << addr1 <<
 411                    "' in '" << t << "', flags=" << hints.ai_flags <<
 412                    " : (" << errcode << ") " << gai_strerror(errcode) );
 413             self_destruct();
 414             return NULL;
 415         }
 416
 417         Q = &q;
 418
 419         for (x = hp; x != NULL;) {
 420             if ((r = *Q) == NULL)
 421                 r = *Q = new acl_ip_data;
 422
 423             /* getaddrinfo given a host has a nasty tendency to return duplicate addr's */
 424             /* BUT sorted fortunately, so we can drop most of them easily */
 425             r->addr1 = *x;
 426             x = x->ai_next;
 427             if ( prev_addr && r->addr1 == *prev_addr) {
 428                 debugs(28, 3, "aclIpParseIpData: Duplicate host/IP: '" << r->addr1 << "' dropped.");
 429                 delete r;
 430                 *Q = NULL;
 431                 continue;
 432             } else
 433                 prev_addr = &r->addr1;
 434
 435             debugs(28, 3, "aclIpParseIpData: Located host/IP: '" << r->addr1 << "'");
 436
 437             r->addr2.setAnyAddr();
 438             r->mask.setNoAddr();
 439
 440             Q = &r->next;
 441
 442             debugs(28, 3, "" << addr1 << " --> " << r->addr1 );
 443         }
 444
 445         if (*Q != NULL) {
 446             debugs(28, DBG_CRITICAL, "aclIpParseIpData: Bad host/IP: '" << t << "'");
 447             self_destruct();
 448             return NULL;
 449         }
 450
 451         freeaddrinfo(hp);
 452
 453         return q;
 454     }
 455
 456     /* ignore IPv6 addresses when built with IPv4-only */
 457     if ( iptype == AF_INET6 && !Ip::EnableIpv6) {
 458         debugs(28, DBG_IMPORTANT, "aclIpParseIpData: IPv6 has not been enabled.");
 459         delete q;
 460         return NULL;
 461     }
 462
 463     /* Decode addr1 */
 464     if (!*addr1 || !(q->addr1 = addr1)) {
 465         debugs(28, DBG_CRITICAL, "aclIpParseIpData: unknown first address in '" << t << "'");
 466         delete q;
 467         self_destruct();
 468         return NULL;
 469     }
 470
 471     /* Decode addr2 */
 472     if (!*addr2)
 473         q->addr2.setAnyAddr();
 474     else if (!(q->addr2=addr2) ) {
 475         debugs(28, DBG_CRITICAL, "aclIpParseIpData: unknown second address in '" << t << "'");
 476         delete q;
 477         self_destruct();
 478         return NULL;
 479     }
 480
 481     /* Decode mask (NULL or empty means a exact host mask) */
 482     if (!DecodeMask(mask, q->mask, iptype)) {
 483         debugs(28, DBG_CRITICAL, "aclParseIpData: unknown netmask '" << mask << "' in '" << t << "'");
 484         delete q;
 485         self_destruct();
 486         return NULL;
 487     }
 488
 489     changed = 0;
 490     changed += q->addr1.applyMask(q->mask);
 491     changed += q->addr2.applyMask(q->mask);
 492
 493     if (changed)
 494         debugs(28, DBG_CRITICAL, "aclIpParseIpData: WARNING: Netmask masks away part of the specified IP in '" << t << "'");
 495
 496     debugs(28,9, HERE << "Parsed: " << q->addr1 << "-" << q->addr2 << "/" << q->mask << "(/" << q->mask.cidr() <<")");
 497
 498     /* 1.2.3.4/255.255.255.0  --> 1.2.3.0 */
 499     /* Same as IPv6 (not so trivial to depict) */
 500     return q;
 501 }
 502
 503 void
 504 ACLIP::parse()
 505 {
 506     flags.parseFlags();
 507
 508     while (char *t = strtokFile()) {
 509         acl_ip_data *q = acl_ip_data::FactoryParse(t);
 510
 511         while (q != NULL) {
 512             /* pop each result off the list and add it to the data tree individually */
 513             acl_ip_data *next_node = q->next;
 514             q->next = NULL;
 515             data = data->insert(q, acl_ip_data::NetworkCompare);
 516             q = next_node;
 517         }
 518     }
 519 }
 520
 521 ACLIP::~ACLIP()
 522 {
 523     if (data)
 524         data->destroy(IPSplay::DefaultFree);
 525 }
 526
 527 SBufList
 528 ACLIP::dump() const
 529 {
 530     SBufList sl;
 531     data->walk(DumpIpListWalkee, &sl);
 532     return sl;
 533 }
 534
 535 bool
 536 ACLIP::empty() const
 537 {
 538     return data->empty();
 539 }
 540
 541 int
 542 ACLIP::match(Ip::Address &clientip)
 543 {
 544     static acl_ip_data ClientAddress;
 545     /*
 546      * aclIpAddrNetworkCompare() takes two acl_ip_data pointers as
 547      * arguments, so we must create a fake one for the client's IP
 548      * address. Since we are scanning for a single IP mask and addr2
 549      * MUST be set to empty.
 550      */
 551     ClientAddress.addr1 = clientip;
 552     ClientAddress.addr2.setEmpty();
 553     ClientAddress.mask.setEmpty();
 554
 555     data = data->splay(&ClientAddress, aclIpAddrNetworkCompare);
 556     debugs(28, 3, "aclIpMatchIp: '" << clientip << "' " << (splayLastResult ? "NOT found" : "found"));
 557     return !splayLastResult;
 558 }
 559
 560 acl_ip_data::acl_ip_data() :addr1(), addr2(), mask(), next (NULL) {}
 561
 562 acl_ip_data::acl_ip_data(Ip::Address const &anAddress1, Ip::Address const &anAddress2, Ip::Address const &aMask, acl_ip_data *aNext) : addr1(anAddress1), addr2(anAddress2), mask(aMask), next(aNext) {}