2002-05-30 01:40:29 +00:00
|
|
|
/*
|
|
|
|
* Asterisk -- A telephony toolkit for Linux.
|
|
|
|
*
|
|
|
|
* Various sorts of access control
|
|
|
|
*
|
|
|
|
* Copyright (C) 1999, Mark Spencer
|
|
|
|
*
|
|
|
|
* Mark Spencer <markster@linux-support.net>
|
|
|
|
*
|
|
|
|
* This program is free software, distributed under the terms of
|
|
|
|
* the GNU General Public License
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include <stdio.h>
|
|
|
|
#include <stdlib.h>
|
|
|
|
#include <pthread.h>
|
|
|
|
#include <string.h>
|
|
|
|
#include <sys/time.h>
|
|
|
|
#include <signal.h>
|
|
|
|
#include <errno.h>
|
|
|
|
#include <unistd.h>
|
|
|
|
#include <asterisk/acl.h>
|
|
|
|
#include <asterisk/logger.h>
|
2003-10-22 03:10:34 +00:00
|
|
|
#include <asterisk/channel.h>
|
2004-05-09 08:22:15 +00:00
|
|
|
#include <asterisk/utils.h>
|
2002-05-30 01:40:29 +00:00
|
|
|
#include <arpa/inet.h>
|
|
|
|
#include <sys/socket.h>
|
|
|
|
#include <netdb.h>
|
2003-05-04 05:52:52 +00:00
|
|
|
#include <net/if.h>
|
|
|
|
#include <netinet/in_systm.h>
|
|
|
|
#include <netinet/ip.h>
|
|
|
|
#include <sys/ioctl.h>
|
2004-02-02 06:39:23 +00:00
|
|
|
#if defined(__OpenBSD__) || defined(__NetBSD__) || defined(__FreeBSD__)
|
2003-10-22 04:09:28 +00:00
|
|
|
#include <fcntl.h>
|
2003-10-22 03:10:34 +00:00
|
|
|
#include <net/route.h>
|
|
|
|
|
|
|
|
static ast_mutex_t routeseq_lock = AST_MUTEX_INITIALIZER;
|
|
|
|
#endif
|
2002-05-30 01:40:29 +00:00
|
|
|
|
|
|
|
#define AST_SENSE_DENY 0
|
|
|
|
#define AST_SENSE_ALLOW 1
|
|
|
|
|
|
|
|
struct ast_ha {
|
|
|
|
/* Host access rule */
|
|
|
|
struct in_addr netaddr;
|
|
|
|
struct in_addr netmask;
|
|
|
|
int sense;
|
|
|
|
struct ast_ha *next;
|
|
|
|
};
|
|
|
|
|
2003-05-04 05:52:52 +00:00
|
|
|
/* Default IP - if not otherwise set, don't breathe garbage */
|
2003-05-08 14:53:15 +00:00
|
|
|
static struct in_addr __ourip = { 0x00000000 };
|
2003-05-04 05:52:52 +00:00
|
|
|
|
|
|
|
struct my_ifreq {
|
|
|
|
char ifrn_name[IFNAMSIZ]; /* Interface name, e.g. "eth0", "ppp0", etc. */
|
|
|
|
struct sockaddr_in ifru_addr;
|
|
|
|
};
|
|
|
|
|
2002-05-30 01:40:29 +00:00
|
|
|
void ast_free_ha(struct ast_ha *ha)
|
|
|
|
{
|
|
|
|
struct ast_ha *hal;
|
|
|
|
while(ha) {
|
|
|
|
hal = ha;
|
|
|
|
ha = ha->next;
|
|
|
|
free(hal);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
struct ast_ha *ast_append_ha(char *sense, char *stuff, struct ast_ha *path)
|
|
|
|
{
|
|
|
|
struct ast_ha *ha = malloc(sizeof(struct ast_ha));
|
|
|
|
char *nm;
|
2004-01-10 21:19:56 +00:00
|
|
|
char tmp[256] = "";
|
2002-05-30 01:40:29 +00:00
|
|
|
struct ast_ha *prev = NULL;
|
|
|
|
struct ast_ha *ret;
|
2004-01-10 21:43:17 +00:00
|
|
|
int x,z;
|
|
|
|
unsigned int y;
|
2002-05-30 01:40:29 +00:00
|
|
|
ret = path;
|
|
|
|
while(path) {
|
|
|
|
prev = path;
|
|
|
|
path = path->next;
|
|
|
|
}
|
|
|
|
if (ha) {
|
2004-01-10 21:19:56 +00:00
|
|
|
strncpy(tmp, stuff, sizeof(tmp) - 1);
|
|
|
|
nm = strchr(tmp, '/');
|
2002-05-30 01:40:29 +00:00
|
|
|
if (!nm)
|
|
|
|
nm = "255.255.255.255";
|
2004-01-10 21:19:56 +00:00
|
|
|
else {
|
|
|
|
*nm = '\0';
|
|
|
|
nm++;
|
|
|
|
}
|
2004-01-10 21:43:17 +00:00
|
|
|
if (!strchr(nm, '.')) {
|
|
|
|
if ((sscanf(nm, "%i", &x) == 1) && (x >= 0) && (x <= 32)) {
|
|
|
|
y = 0;
|
|
|
|
for (z=0;z<x;z++) {
|
|
|
|
y >>= 1;
|
2004-01-10 22:19:31 +00:00
|
|
|
y |= 0x80000000;
|
2004-01-10 21:43:17 +00:00
|
|
|
}
|
|
|
|
ha->netmask.s_addr = htonl(y);
|
|
|
|
}
|
|
|
|
} else if (!inet_aton(nm, &ha->netmask)) {
|
|
|
|
ast_log(LOG_WARNING, "%s not a valid netmask\n", nm);
|
2002-05-30 01:40:29 +00:00
|
|
|
free(ha);
|
2004-01-10 21:19:56 +00:00
|
|
|
return path;
|
2002-05-30 01:40:29 +00:00
|
|
|
}
|
2004-01-10 21:43:17 +00:00
|
|
|
if (!inet_aton(tmp, &ha->netaddr)) {
|
|
|
|
ast_log(LOG_WARNING, "%s not a valid IP\n", tmp);
|
2002-05-30 01:40:29 +00:00
|
|
|
free(ha);
|
2004-01-10 21:19:56 +00:00
|
|
|
return path;
|
2002-05-30 01:40:29 +00:00
|
|
|
}
|
|
|
|
ha->netaddr.s_addr &= ha->netmask.s_addr;
|
|
|
|
if (!strncasecmp(sense, "p", 1)) {
|
|
|
|
ha->sense = AST_SENSE_ALLOW;
|
|
|
|
} else {
|
|
|
|
ha->sense = AST_SENSE_DENY;
|
|
|
|
}
|
|
|
|
ha->next = NULL;
|
|
|
|
if (prev)
|
|
|
|
prev->next = ha;
|
|
|
|
else
|
|
|
|
ret = ha;
|
|
|
|
}
|
2003-05-05 06:14:25 +00:00
|
|
|
return ret;
|
2002-05-30 01:40:29 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
int ast_apply_ha(struct ast_ha *ha, struct sockaddr_in *sin)
|
|
|
|
{
|
|
|
|
/* Start optimistic */
|
|
|
|
int res = AST_SENSE_ALLOW;
|
|
|
|
while(ha) {
|
|
|
|
/* For each rule, if this address and the netmask = the net address
|
|
|
|
apply the current rule */
|
|
|
|
if ((sin->sin_addr.s_addr & ha->netmask.s_addr) == (ha->netaddr.s_addr))
|
|
|
|
res = ha->sense;
|
|
|
|
ha = ha->next;
|
|
|
|
}
|
|
|
|
return res;
|
|
|
|
}
|
|
|
|
|
|
|
|
int ast_get_ip(struct sockaddr_in *sin, char *value)
|
|
|
|
{
|
|
|
|
struct hostent *hp;
|
2004-04-22 00:20:34 +00:00
|
|
|
struct ast_hostent ahp;
|
|
|
|
hp = ast_gethostbyname(value, &ahp);
|
2002-05-30 01:40:29 +00:00
|
|
|
if (hp) {
|
|
|
|
memcpy(&sin->sin_addr, hp->h_addr, sizeof(sin->sin_addr));
|
|
|
|
} else {
|
|
|
|
ast_log(LOG_WARNING, "Unable to lookup '%s'\n", value);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2003-05-04 05:52:52 +00:00
|
|
|
/* iface is the interface (e.g. eth0); address is the return value */
|
|
|
|
int ast_lookup_iface(char *iface, struct in_addr *address) {
|
|
|
|
int mysock, res = 0;
|
|
|
|
struct my_ifreq ifreq;
|
|
|
|
|
|
|
|
memset(&ifreq, 0, sizeof(ifreq));
|
|
|
|
strncpy(ifreq.ifrn_name,iface,sizeof(ifreq.ifrn_name) - 1);
|
|
|
|
|
|
|
|
mysock = socket(PF_INET,SOCK_DGRAM,IPPROTO_IP);
|
|
|
|
res = ioctl(mysock,SIOCGIFADDR,&ifreq);
|
|
|
|
|
|
|
|
close(mysock);
|
|
|
|
if (res < 0) {
|
|
|
|
ast_log(LOG_WARNING, "Unable to get IP of %s: %s\n", iface, strerror(errno));
|
2003-05-04 06:05:45 +00:00
|
|
|
memcpy((char *)address,(char *)&__ourip,sizeof(__ourip));
|
2003-05-04 05:52:52 +00:00
|
|
|
return -1;
|
|
|
|
} else {
|
2003-05-04 06:05:45 +00:00
|
|
|
memcpy((char *)address,(char *)&ifreq.ifru_addr.sin_addr,sizeof(ifreq.ifru_addr.sin_addr));
|
2003-05-04 05:52:52 +00:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
int ast_ouraddrfor(struct in_addr *them, struct in_addr *us)
|
|
|
|
{
|
2004-02-02 06:39:23 +00:00
|
|
|
#if defined(__OpenBSD__) || defined(__NetBSD__) || defined(__FreeBSD__)
|
2003-10-22 03:10:34 +00:00
|
|
|
struct sockaddr_in *sin;
|
|
|
|
struct sockaddr *sa;
|
|
|
|
struct {
|
|
|
|
struct rt_msghdr m_rtm;
|
|
|
|
char m_space[512];
|
|
|
|
} m_rtmsg;
|
|
|
|
char *cp, *p = ast_strdupa(inet_ntoa(*them));
|
2003-10-22 04:09:28 +00:00
|
|
|
int i, l, s, seq, flags;
|
2003-10-22 03:10:34 +00:00
|
|
|
pid_t pid = getpid();
|
|
|
|
static int routeseq; /* Protected by "routeseq_lock" mutex */
|
|
|
|
|
|
|
|
memset(us, 0, sizeof(struct in_addr));
|
|
|
|
|
|
|
|
memset(&m_rtmsg, 0, sizeof(m_rtmsg));
|
|
|
|
m_rtmsg.m_rtm.rtm_type = RTM_GET;
|
|
|
|
m_rtmsg.m_rtm.rtm_flags = RTF_UP | RTF_HOST;
|
|
|
|
m_rtmsg.m_rtm.rtm_version = RTM_VERSION;
|
|
|
|
ast_mutex_lock(&routeseq_lock);
|
|
|
|
seq = ++routeseq;
|
|
|
|
ast_mutex_unlock(&routeseq_lock);
|
|
|
|
m_rtmsg.m_rtm.rtm_seq = seq;
|
|
|
|
m_rtmsg.m_rtm.rtm_addrs = RTA_IFA | RTA_DST;
|
|
|
|
m_rtmsg.m_rtm.rtm_msglen = sizeof(struct rt_msghdr) + sizeof(struct sockaddr_in);
|
|
|
|
sin = (struct sockaddr_in *)m_rtmsg.m_space;
|
|
|
|
sin->sin_family = AF_INET;
|
|
|
|
sin->sin_len = sizeof(struct sockaddr_in);
|
|
|
|
sin->sin_addr = *them;
|
|
|
|
|
|
|
|
if ((s = socket(PF_ROUTE, SOCK_RAW, 0)) < 0) {
|
|
|
|
ast_log(LOG_ERROR, "Error opening routing socket\n");
|
|
|
|
return -1;
|
|
|
|
}
|
2003-10-22 04:09:28 +00:00
|
|
|
flags = fcntl(s, F_GETFL);
|
|
|
|
fcntl(s, F_SETFL, flags | O_NONBLOCK);
|
2003-10-22 03:10:34 +00:00
|
|
|
if (write(s, (char *)&m_rtmsg, m_rtmsg.m_rtm.rtm_msglen) < 0) {
|
|
|
|
ast_log(LOG_ERROR, "Error writing to routing socket: %s\n", strerror(errno));
|
|
|
|
close(s);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
do {
|
|
|
|
l = read(s, (char *)&m_rtmsg, sizeof(m_rtmsg));
|
|
|
|
} while (l > 0 && (m_rtmsg.m_rtm.rtm_seq != 1 || m_rtmsg.m_rtm.rtm_pid != pid));
|
|
|
|
if (l < 0) {
|
2003-10-22 04:09:28 +00:00
|
|
|
if (errno != EAGAIN)
|
|
|
|
ast_log(LOG_ERROR, "Error reading from routing socket\n");
|
|
|
|
close(s);
|
2003-10-22 03:10:34 +00:00
|
|
|
return -1;
|
|
|
|
}
|
2003-10-22 04:09:28 +00:00
|
|
|
close(s);
|
2003-10-22 03:10:34 +00:00
|
|
|
|
|
|
|
if (m_rtmsg.m_rtm.rtm_version != RTM_VERSION) {
|
|
|
|
ast_log(LOG_ERROR, "Unsupported route socket protocol version\n");
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (m_rtmsg.m_rtm.rtm_msglen != l)
|
|
|
|
ast_log(LOG_WARNING, "Message length mismatch, in packet %d, returned %d\n",
|
|
|
|
m_rtmsg.m_rtm.rtm_msglen, l);
|
|
|
|
|
|
|
|
if (m_rtmsg.m_rtm.rtm_errno) {
|
|
|
|
ast_log(LOG_ERROR, "RTM_GET got %s (%d)\n",
|
|
|
|
strerror(m_rtmsg.m_rtm.rtm_errno), m_rtmsg.m_rtm.rtm_errno);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
cp = (char *)m_rtmsg.m_space;
|
|
|
|
if (m_rtmsg.m_rtm.rtm_addrs)
|
|
|
|
for (i = 1; i; i <<= 1)
|
|
|
|
if (m_rtmsg.m_rtm.rtm_addrs & i) {
|
|
|
|
sa = (struct sockaddr *)cp;
|
|
|
|
if (i == RTA_IFA && sa->sa_family == AF_INET) {
|
|
|
|
sin = (struct sockaddr_in *)sa;
|
|
|
|
*us = sin->sin_addr;
|
|
|
|
ast_log(LOG_DEBUG, "Found route to %s, output from our address %s.\n", p, inet_ntoa(*us));
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
cp += sa->sa_len > 0 ?
|
|
|
|
(1 + ((sa->sa_len - 1) | (sizeof(long) - 1))) :
|
|
|
|
sizeof(long);
|
|
|
|
}
|
|
|
|
|
|
|
|
ast_log(LOG_DEBUG, "No route found for address %s!\n", p);
|
|
|
|
return -1;
|
|
|
|
#else
|
2003-05-04 05:52:52 +00:00
|
|
|
FILE *PROC;
|
|
|
|
unsigned int remote_ip;
|
|
|
|
int res = 1;
|
|
|
|
char line[256];
|
|
|
|
remote_ip = them->s_addr;
|
|
|
|
|
|
|
|
PROC = fopen("/proc/net/route","r");
|
|
|
|
if (!PROC) {
|
|
|
|
bzero(us,sizeof(struct in_addr));
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
/* First line contains headers */
|
|
|
|
fgets(line,sizeof(line),PROC);
|
|
|
|
|
|
|
|
while (!feof(PROC)) {
|
2004-03-20 19:08:57 +00:00
|
|
|
char iface[256];
|
2003-05-04 05:52:52 +00:00
|
|
|
unsigned int dest, gateway, mask;
|
|
|
|
int i,fieldnum;
|
|
|
|
char *fields[40];
|
|
|
|
|
|
|
|
fgets(line,sizeof(line),PROC);
|
|
|
|
|
|
|
|
fieldnum = 0;
|
|
|
|
for (i=0;i<sizeof(line);i++) {
|
|
|
|
char *offset;
|
|
|
|
|
|
|
|
fields[fieldnum++] = line + i;
|
|
|
|
offset = strchr(line + i,'\t');
|
|
|
|
if (offset == NULL) {
|
|
|
|
/* Exit loop */
|
|
|
|
break;
|
|
|
|
} else if (fieldnum >= 9) {
|
|
|
|
/* Short-circuit: can't break at 8, since the end of field 7 is figured when fieldnum=8 */
|
|
|
|
break;
|
|
|
|
} else {
|
|
|
|
*offset = '\0';
|
|
|
|
i = offset - line;
|
|
|
|
}
|
|
|
|
}
|
2004-03-20 19:08:57 +00:00
|
|
|
if (fieldnum >= 8) {
|
2003-05-04 05:52:52 +00:00
|
|
|
|
2004-03-20 19:08:57 +00:00
|
|
|
sscanf(fields[0],"%s",iface);
|
|
|
|
sscanf(fields[1],"%x",&dest);
|
|
|
|
sscanf(fields[2],"%x",&gateway);
|
|
|
|
sscanf(fields[7],"%x",&mask);
|
2003-05-04 05:52:52 +00:00
|
|
|
#if 0
|
2004-03-20 19:08:57 +00:00
|
|
|
printf("Addr: %s %08x Dest: %08x Mask: %08x\n", inet_ntoa(*them), remote_ip, dest, mask);
|
2003-05-04 05:52:52 +00:00
|
|
|
#endif
|
2004-03-20 19:08:57 +00:00
|
|
|
/* Looks simple, but here is the magic */
|
|
|
|
if (((remote_ip & mask) ^ dest) == 0) {
|
|
|
|
res = ast_lookup_iface(iface,us);
|
|
|
|
break;
|
|
|
|
}
|
2003-05-04 05:52:52 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
fclose(PROC);
|
|
|
|
if (res == 1) {
|
|
|
|
ast_log(LOG_WARNING, "Yikes! No default route?!!\n");
|
|
|
|
bzero(us,sizeof(struct in_addr));
|
|
|
|
return -2;
|
|
|
|
} else if (res) {
|
|
|
|
/* We've already warned in subroutine */
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
return 0;
|
2003-10-22 03:10:34 +00:00
|
|
|
#endif
|
2003-05-04 05:52:52 +00:00
|
|
|
}
|