1 /*****************************************************************************
3 *****************************************************************************
4 * Copyright © 2005-2007 Rémi Denis-Courmont
7 * Authors: Rémi Denis-Courmont <rem # videolan.org>
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 2 of the License, or
12 * (at your option) any later version.
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, write to the Free Software
21 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston MA 02110-1301, USA.
22 *****************************************************************************/
24 /*****************************************************************************
26 *****************************************************************************/
31 #include <vlc_common.h>
36 #include <vlc_network.h>
39 /* FIXME: rwlock on acl, but libvlc doesn't implement rwlock */
40 typedef struct vlc_acl_entry_t
43 uint8_t i_bytes_match;
50 vlc_object_t *p_owner;
52 vlc_acl_entry_t *p_entries;
56 static int ACL_Resolve( vlc_object_t *p_this, uint8_t *p_bytes,
59 struct addrinfo hints, *res;
62 memset (&hints, 0, sizeof (hints));
63 hints.ai_socktype = SOCK_STREAM; /* doesn't matter */
64 hints.ai_flags = AI_NUMERICHOST;
66 if( vlc_getaddrinfo( p_this, psz_ip, 0, &hints, &res ) )
68 msg_Err( p_this, "invalid IP address %s", psz_ip );
72 p_bytes[16] = 0; /* avoids overflowing when i_bytes_match = 16 */
74 i_family = res->ai_addr->sa_family;
79 struct sockaddr_in *addr;
81 addr = (struct sockaddr_in *)res->ai_addr;
82 memset( p_bytes, 0, 12 );
83 memcpy( p_bytes + 12, &addr->sin_addr, 4 );
87 #if defined (HAVE_GETADDRINFO) || defined (WIN32)
88 /* unfortunately many people define AF_INET6
89 though they don't have struct sockaddr_in6 */
92 struct sockaddr_in6 *addr;
94 addr = (struct sockaddr_in6 *)res->ai_addr;
95 memcpy( p_bytes, &addr->sin6_addr, 16 );
101 msg_Err( p_this, "unknown address family" );
102 vlc_freeaddrinfo( res );
106 vlc_freeaddrinfo( res );
112 * Check if a given address passes an access control list.
114 * @param p_acl pre-existing ACL to match the address against
115 * @param psz_ip numeric IPv4/IPv6 address
117 * @return 0 if the first matching ACL entry is an access grant,
118 * 1 if the first matching ACL entry is a denial of access,
121 int ACL_Check( vlc_acl_t *p_acl, const char *psz_ip )
123 const vlc_acl_entry_t *p_cur, *p_end;
129 p_cur = p_acl->p_entries;
130 p_end = p_cur + p_acl->i_size;
132 if( ACL_Resolve( p_acl->p_owner, host, psz_ip ) < 0 )
135 while (p_cur < p_end)
139 i = p_cur->i_bytes_match;
140 if( (memcmp( p_cur->host, host, i ) == 0)
141 && (((p_cur->host[i] ^ host[i]) & p_cur->i_bits_mask) == 0) )
142 return !p_cur->b_allow;
147 return !p_acl->b_allow_default;
151 * Adds an item to an ACL.
152 * Items are always matched in the same order as they are added.
154 int ACL_AddNet( vlc_acl_t *p_acl, const char *psz_ip, int i_len,
157 vlc_acl_entry_t *p_ent;
162 i_size = p_acl->i_size;
163 p_ent = (vlc_acl_entry_t *)realloc( p_acl->p_entries,
164 ++p_acl->i_size * sizeof( *p_ent ) );
169 p_acl->p_entries = p_ent;
172 i_family = ACL_Resolve( p_acl->p_owner, p_ent->host, psz_ip );
176 * I'm lazy : memory space will be re-used in the next ACL_Add call...
185 if( i_family == AF_INET )
192 i_len = 128; /* ACL_AddHost */
195 p_ent->i_bytes_match = d.quot;
196 p_ent->i_bits_mask = 0xff << (8 - d.rem);
198 p_ent->b_allow = b_allow;
204 * Creates an empty ACL.
206 * @param b_allow whether to grant (true) or deny (false) access
207 * by default (ie if none of the ACL entries matched).
209 * @return an ACL object. NULL in case of error.
211 vlc_acl_t *ACL_Create( vlc_object_t *p_this, bool b_allow )
215 p_acl = (vlc_acl_t *)malloc( sizeof( *p_acl ) );
219 vlc_object_hold( p_this );
220 p_acl->p_owner = p_this;
222 p_acl->p_entries = NULL;
223 p_acl->b_allow_default = b_allow;
230 * Perform a deep copy of an existing ACL.
232 * @param p_this object to attach the copy to.
233 * @param p_acl ACL object to be copied.
235 * @return a new ACL object, or NULL on error.
237 vlc_acl_t *ACL_Duplicate( vlc_object_t *p_this, const vlc_acl_t *p_acl )
244 p_dupacl = (vlc_acl_t *)malloc( sizeof( *p_dupacl ) );
245 if( p_dupacl == NULL )
250 p_dupacl->p_entries = (vlc_acl_entry_t *)
251 malloc( p_acl->i_size * sizeof( vlc_acl_entry_t ) );
253 if( p_dupacl->p_entries == NULL )
259 memcpy( p_dupacl->p_entries, p_acl->p_entries,
260 p_acl->i_size * sizeof( vlc_acl_entry_t ) );
263 p_dupacl->p_entries = NULL;
265 vlc_object_hold( p_this );
266 p_dupacl->p_owner = p_this;
267 p_dupacl->i_size = p_acl->i_size;
268 p_dupacl->b_allow_default = p_acl->b_allow_default;
275 * Releases all resources associated with an ACL object.
277 void ACL_Destroy( vlc_acl_t *p_acl )
281 free( p_acl->p_entries );
282 vlc_object_release( p_acl->p_owner );
289 * Reads ACL entries from a file.
291 * @param p_acl ACL object in which to insert parsed entries.
292 * @param psz_patch filename from which to parse entries.
294 * @return 0 on success, -1 on error.
296 int ACL_LoadFile( vlc_acl_t *p_acl, const char *psz_path )
303 file = vlc_fopen( psz_path, "r" );
307 msg_Dbg( p_acl->p_owner, "find .hosts in dir=%s", psz_path );
309 while( !feof( file ) )
311 char line[1024], *psz_ip, *ptr;
313 if( fgets( line, sizeof( line ), file ) == NULL )
317 msg_Err( p_acl->p_owner, "error reading %s : %m", psz_path );
323 /* fgets() is cool : never overflow, always nul-terminate */
326 /* skips blanks - cannot overflow given '\0' is not space */
327 while( isspace( *psz_ip ) )
330 if( *psz_ip == '\0' ) /* empty/blank line */
333 ptr = strchr( psz_ip, '\n' );
334 if( ptr == NULL && !feof(file) )
336 msg_Warn( p_acl->p_owner, "skipping overly long line in %s",
340 if( fgets( line, sizeof( line ), file ) == NULL )
344 msg_Err( p_acl->p_owner, "error reading %s : %m",
350 while( strchr( line, '\n' ) == NULL);
352 continue; /* skip unusable line */
355 /* look for first space, CR, LF, etc. or comment character */
356 for( ptr = psz_ip; ( *ptr!='#' ) && !isspace( *ptr ) && *ptr; ++ptr );
360 /* skip lines without usable information */
364 msg_Dbg( p_acl->p_owner, "restricted to %s", psz_ip );
366 ptr = strchr( psz_ip, '/' );
368 *ptr++ = '\0'; /* separate address from mask length */
371 ? ACL_AddNet( p_acl, psz_ip, atoi( ptr ), true )
372 : ACL_AddHost( p_acl, psz_ip, true ) )
374 msg_Err( p_acl->p_owner, "cannot add ACL from %s", psz_path );