isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Split out address matching into its own file and add regression

Browse Source 
tests for it.
This commit is contained in:
Todd C. Miller
2011-08-29 14:10:18 -04:00
parent a47f005437
commit 1a259de176
6 changed files with 411 additions and 154 deletions
Download Patch File Download Diff File Expand all files Collapse all files

148
plugins/sudoers/match.c
View File

@@ -25,7 +25,6 @@
#include <sys/types.h>
#include <sys/param.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <stdio.h>
#ifdef STDC_HEADERS
@@ -57,8 +56,6 @@
#include <ctype.h>
#include <pwd.h>
#include <grp.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>
#ifdef HAVE_DIRENT_H
# include <dirent.h>
@@ -78,7 +75,6 @@
#endif
#include "sudoers.h"
#include "interfaces.h"
#include "parse.h"
#include <gram.h>
@@ -597,150 +593,6 @@ command_matches_dir(char *sudoers_dir, size_t dlen)
return dent != NULL;
}
static int
addr_matches_if(char *n)
{
union sudo_in_addr_un addr;
struct interface *ifp;
#ifdef HAVE_IN6_ADDR
int j;
#endif
int family;
#ifdef HAVE_IN6_ADDR
if (inet_pton(AF_INET6, n, &addr.ip6) > 0) {
family = AF_INET6;
} else
#endif
{
family = AF_INET;
addr.ip4.s_addr = inet_addr(n);
}
for (ifp = interfaces; ifp != NULL; ifp = ifp->next) {
if (ifp->family != family)
continue;
switch(family) {
case AF_INET:
if (ifp->addr.ip4.s_addr == addr.ip4.s_addr ||
(ifp->addr.ip4.s_addr & ifp->netmask.ip4.s_addr)
== addr.ip4.s_addr)
return TRUE;
break;
#ifdef HAVE_IN6_ADDR
case AF_INET6:
if (memcmp(ifp->addr.ip6.s6_addr, addr.ip6.s6_addr,
sizeof(addr.ip6.s6_addr)) == 0)
return TRUE;
for (j = 0; j < sizeof(addr.ip6.s6_addr); j++) {
if ((ifp->addr.ip6.s6_addr[j] & ifp->netmask.ip6.s6_addr[j]) != addr.ip6.s6_addr[j])
break;
}
if (j == sizeof(addr.ip6.s6_addr))
return TRUE;
#endif
}
}
return FALSE;
}
static int
addr_matches_if_netmask(char *n, char *m)
{
int i;
union sudo_in_addr_un addr, mask;
struct interface *ifp;
#ifdef HAVE_IN6_ADDR
int j;
#endif
int family;
#ifdef HAVE_IN6_ADDR
if (inet_pton(AF_INET6, n, &addr.ip6) > 0)
family = AF_INET6;
else
#endif
{
family = AF_INET;
addr.ip4.s_addr = inet_addr(n);
}
if (family == AF_INET) {
if (strchr(m, '.')) {
mask.ip4.s_addr = inet_addr(m);
} else {
i = atoi(m);
if (i == 0)
mask.ip4.s_addr = 0;
else if (i == 32)
mask.ip4.s_addr = 0xffffffff;
else
mask.ip4.s_addr = 0xffffffff - (1 << (32 - i)) + 1;
mask.ip4.s_addr = htonl(mask.ip4.s_addr);
}
addr.ip4.s_addr &= mask.ip4.s_addr;
}
#ifdef HAVE_IN6_ADDR
else {
if (inet_pton(AF_INET6, m, &mask.ip6) <= 0) {
j = atoi(m);
for (i = 0; i < sizeof(addr.ip6.s6_addr); i++) {
if (j < i * 8)
mask.ip6.s6_addr[i] = 0;
else if (i * 8 + 8 <= j)
mask.ip6.s6_addr[i] = 0xff;
else
mask.ip6.s6_addr[i] = 0xff00 >> (j - i * 8);
addr.ip6.s6_addr[i] &= mask.ip6.s6_addr[i];
}
}
}
#endif /* HAVE_IN6_ADDR */
for (ifp = interfaces; ifp != NULL; ifp = ifp->next) {
if (ifp->family != family)
continue;
switch(family) {
case AF_INET:
if ((ifp->addr.ip4.s_addr & mask.ip4.s_addr) == addr.ip4.s_addr)
return TRUE;
#ifdef HAVE_IN6_ADDR
case AF_INET6:
for (j = 0; j < sizeof(addr.ip6.s6_addr); j++) {
if ((ifp->addr.ip6.s6_addr[j] & mask.ip6.s6_addr[j]) != addr.ip6.s6_addr[j])
break;
}
if (j == sizeof(addr.ip6.s6_addr))
return TRUE;
#endif /* HAVE_IN6_ADDR */
}
}
return FALSE;
}
/*
* Returns TRUE if "n" is one of our ip addresses or if
* "n" is a network that we are on, else returns FALSE.
*/
int
addr_matches(char *n)
{
char *m;
int retval;
/* If there's an explicit netmask, use it. */
if ((m = strchr(n, '/'))) {
*m++ = '\0';
retval = addr_matches_if_netmask(n, m);
*(m - 1) = '/';
} else
retval = addr_matches_if(n);
return retval;
}
/*
* Returns TRUE if the hostname matches the pattern, else FALSE
*/