Support IPv6 addresses with "hosts allow" and "hosts deny". Patch from

Hideaki Yoshifuji.

1 files changed, 134 insertions, 23 deletions

diff --git a/access.c b/access.c
index ff357480..aec633a7 100644
--- a/access.c
+++ b/access.c
@@ -30,54 +30,165 @@ static int match_hostname(char *host, char *tok)
 	return (fnmatch(tok, host, 0) == 0);
 }
 
+static int match_binary(char *b1, char *b2, char *mask, int addrlen)
+{
+	int i;
+
+	for (i=0; i<addrlen; i++) {
+		if ((b1[i]^b2[i])&mask[i]) {
+			return 0;
+		}
+	}
+
+	return 1;
+}
+
+static void make_mask(char *mask, int plen, int addrlen) {
+	int w, b;
+
+	w = plen >> 3;
+	b = plen & 0x7;
+
+	if (w)
+		memset(mask, 0xff, w);
+	mask[w] = 0xff & (0xff<<(8-b));
+	if (w+1 < addrlen)
+		memset(mask+w+1, 0, addrlen-w-1);
+
+	return;
+}
 
 static int match_address(char *addr, char *tok)
 {
 	char *p;
-	unsigned long a, t, mask = (unsigned long)~0;
+	struct addrinfo hints, *resa, *rest;
+	int gai;
+	int ret = 0;
+	int addrlen = 0;
+#ifdef HAVE_STRTOL
+	long int bits;
+#else
+	int bits;
+#endif
+	char mask[16];
+	char *a = NULL, *t = NULL;
 
 	if (!addr || !*addr) return 0;
 
-	if (!isdigit(* (unsigned char *) tok)) return 0;
-
 	p = strchr(tok,'/');
 	if (p) *p = 0;
 
-	a = inet_addr(addr);
-	t = inet_addr(tok);
+	memset(&hints, 0, sizeof(hints));
+	hints.ai_family = PF_UNSPEC;
+	hints.ai_socktype = SOCK_STREAM;
+	hints.ai_flags = AI_NUMERICHOST;
 
-	if (p) {
-		*p = '/';
-	}
+	gai = getaddrinfo(addr, NULL, &hints, &resa);
+	if (gai) return 0;
 
-	if (t == INADDR_NONE) {
+	gai = getaddrinfo(tok, NULL, &hints, &rest);
+	if (p)
+		*p++ = '/';
+	if (gai) {
 		rprintf(FERROR,"malformed address %s\n", tok);
+		freeaddrinfo(resa);
 		return 0;
 	}
 
-	a = ntohl(a);
-	t = ntohl(t);
+	if (rest->ai_family != resa->ai_family) {
+		ret = 0;
+		goto out;
+	}
+
+	switch(resa->ai_family) {
+	case PF_INET:
+		a = (char *)&((struct sockaddr_in *)resa->ai_addr)->sin_addr;
+		t = (char *)&((struct sockaddr_in *)rest->ai_addr)->sin_addr;
+		addrlen = 4;
+
+		break;
+
+#ifdef INET6
+	case PF_INET6:
+	    {
+		struct sockaddr_in6 *sin6a, *sin6t;
+
+		sin6a = (struct sockaddr_in6 *)resa->ai_addr;
+		sin6t = (struct sockaddr_in6 *)rest->ai_addr;
+
+		a = (char *)&sin6a->sin6_addr;
+		t = (char *)&sin6t->sin6_addr;
 
+#ifdef HAVE_SOCKADDR_IN6_SCOPE_ID
+		if (sin6t->sin6_scope_id &&
+		    sin6a->sin6_scope_id != sin6t->sin6_scope_id) {
+			ret = 0;
+			goto out;
+		}
+#endif
+
+		a = (char *)&sin6a->sin6_addr;
+		t = (char *)&sin6t->sin6_addr;
+		addrlen = 16;
+
+		break;
+	    }
+#endif
+	default:
+	    rprintf(FERROR,"unknown family %u\n", rest->ai_family);
+	    ret = 0;
+	    goto out;
+	}
+
+	bits = -1;
 	if (p) {
-		if (strchr(p+1,'.')) {
-			mask = inet_addr(p+1);
-			if (mask == INADDR_NONE) {
+		if (inet_pton(resa->ai_addr->sa_family, p, mask) <= 0) {
+#ifdef HAVE_STRTOL
+			char *ep = NULL;
+#else
+			unsigned char *pp;
+#endif
+
+#ifdef HAVE_STRTOL
+			bits = strtol(p, &ep, 10);
+			if (!*p || *ep) {
 				rprintf(FERROR,"malformed mask in %s\n", tok);
-				return 0;
+				ret = 0;
+				goto out;
+			}
+#else
+			for (pp = (unsigned char *)p; *pp; pp++) {
+				if (!isascii(*pp) || !isdigit(*pp)) {
+					rprintf(FERROR,"malformed mask in %s\n", tok);
+					ret = 0;
+					goto out;
+				}
 			}
-			mask = ntohl(mask);
-		} else {
-			int bits = atoi(p+1);
-			if (bits == 0) return 1;
-			if (bits <= 0 || bits > 32) {
+			bits = atoi(p);
+#endif
+			if (bits == 0) {
+				ret = 1;
+				goto out;
+			}
+			if (bits < 0 || bits > (addrlen << 3)) {
 				rprintf(FERROR,"malformed mask in %s\n", tok);
-				return 0;
+				ret = 0;
+				goto out;
 			}
-			mask &= (mask << (32-bits));
 		}
+	} else {
+		bits = 128;
 	}
 
-	return ((a&mask) == (t&mask));
+	if (bits >= 0)
+		make_mask(mask, bits, addrlen);
+
+	ret = match_binary(a, t, mask, addrlen);
+
+out:
+	freeaddrinfo(resa);
+	freeaddrinfo(rest);
+	return ret;
 }
 
 static int access_match(char *list, char *addr, char *host)