path: root/xlators/protocol/auth/addr/src/addr.c

/*
  Copyright (c) 2008-2012 Red Hat, Inc. <http://www.redhat.com>
  This file is part of GlusterFS.

  This file is licensed to you under your choice of the GNU Lesser
  General Public License, version 3 or any later version (LGPLv3 or
  later), or the GNU General Public License, version 2 (GPLv2), in all
  cases as published by the Free Software Foundation.
*/

#include <fnmatch.h>
#include <sys/socket.h>
#include <netdb.h>
#include "authenticate.h"
#include "dict.h"
#include "rpc-transport.h"

#define ENTRY_DELIMITER ","
#define ADDR_DELIMITER "|"
#define PRIVILEGED_PORT_CEILING 1024

#ifndef AF_INET_SDP
#define AF_INET_SDP 27
#endif

/* An option for subdir validation be like below */

/* 1. '*'
   2. '192.168.*'
   3. '
   4. '!10.10.1*' (Today as per the code, if negate is set on one entry, its
   never reset)
   5. '192.168.1.*, 10.1.10.*';168.168.2.* =/dir;* =/another-dir'

*/

int
compare_addr_and_update(char *option_str, char *peer_addr, char *subvol,
                        char *delimiter, auth_result_t *result,
                        auth_result_t status)
{
    char *addr_str = NULL;
    char *tmp = NULL;
    char negate = 0;
    char match = 0;
    int length = 0;
    int ret = 0;

    addr_str = strtok_r(option_str, delimiter, &tmp);

    while (addr_str) {
        gf_log(subvol, GF_LOG_INFO, "%s = \"%s\", received addr = \"%s\"",
               (status == AUTH_ACCEPT) ? "allowed" : "rejected", addr_str,
               peer_addr);
        if (addr_str[0] == '!') {
            negate = 1;
            addr_str++;
        }

        length = strlen(addr_str);
        if ((addr_str[0] != '*') && valid_host_name(addr_str, length)) {
            match = gf_is_same_address(addr_str, peer_addr);
            if (match) {
                *result = status;
                goto out;
            }
        } else {
            match = fnmatch(addr_str, peer_addr, 0);
            if (negate ? match : !match) {
                *result = status;
                goto out;
            }
        }

        addr_str = strtok_r(NULL, delimiter, &tmp);
    }

    ret = -1;
out:
    return ret;
}

void
parse_entries_and_compare(char *option_str, char *peer_addr, char *subvol,
                          char *subdir, auth_result_t *result,
                          auth_result_t status)
{
    char *entry = NULL;
    char *entry_cpy = NULL;
    char *directory = NULL;
    char *entries = NULL;
    char *addr_str = NULL;
    char *addr = NULL;
    char *tmp = NULL;
    char *tmpdir = NULL;
    int ret = 0;

    if (!subdir) {
        gf_log(subvol, GF_LOG_WARNING,
               "subdir entry not present, not performing any operation.");
        goto out;
    }

    entries = gf_strdup(option_str);
    if (!entries)
        goto out;

    if (entries[0] != '/' && !strchr(entries, '(')) {
        /* Backward compatible option */
        ret = compare_addr_and_update(entries, peer_addr, subvol, ",", result,
                                      status);
        goto out;
    }

    entry = strtok_r(entries, ENTRY_DELIMITER, &tmp);
    while (entry) {
        entry_cpy = gf_strdup(entry);
        if (!entry_cpy) {
            goto out;
        }

        directory = strtok_r(entry_cpy, "(", &tmpdir);
        if (directory[0] != '/')
            goto out;

        /* send second portion, after ' =' if directory matches */
        if (strcmp(subdir, directory))
            goto next_entry;

        addr_str = strtok_r(NULL, ")", &tmpdir);
        if (!addr_str)
            goto out;

        addr = gf_strdup(addr_str);
        if (!addr)
            goto out;

        gf_log(subvol, GF_LOG_INFO,
               "Found an entry for dir %s (%s),"
               " performing validation",
               subdir, addr);

        ret = compare_addr_and_update(addr, peer_addr, subvol, ADDR_DELIMITER,
                                      result, status);
        if (ret == 0) {
            break;
        }

        GF_FREE(addr);
        addr = NULL;

    next_entry:
        entry = strtok_r(NULL, ENTRY_DELIMITER, &tmp);
        GF_FREE(entry_cpy);
        entry_cpy = NULL;
    }

out:
    GF_FREE(entries);
    GF_FREE(entry_cpy);
    GF_FREE(addr);
}

auth_result_t
gf_auth(dict_t *input_params, dict_t *config_params)
{
    auth_result_t result = AUTH_DONT_CARE;
    int ret = 0;
    char *name = NULL;
    char *searchstr = NULL;
    peer_info_t *peer_info = NULL;
    data_t *peer_info_data = NULL;
    data_t *allow_addr = NULL;
    data_t *reject_addr = NULL;
    char *service = NULL;
    uint16_t peer_port = 0;
    char peer_addr[UNIX_PATH_MAX] = {
        0,
    };
    char *type = NULL;
    gf_boolean_t allow_insecure = _gf_false;
    char *subdir = NULL;

    name = data_to_str(dict_get(input_params, "remote-subvolume"));
    if (!name) {
        gf_log("authenticate/addr", GF_LOG_DEBUG,
               "remote-subvolume not specified");
        goto out;
    }

    ret = gf_asprintf(&searchstr, "auth.addr.%s.allow", name);
    if (-1 == ret) {
        gf_log("auth/addr", GF_LOG_DEBUG,
               "asprintf failed while setting search string");
        goto out;
    }

    allow_addr = dict_get(config_params, searchstr);
    GF_FREE(searchstr);

    ret = gf_asprintf(&searchstr, "auth.addr.%s.reject", name);
    if (-1 == ret) {
        gf_log("auth/addr", GF_LOG_ERROR,
               "asprintf failed while setting search string");
        goto out;
    }
    reject_addr = dict_get(config_params, searchstr);
    GF_FREE(searchstr);

    if (!allow_addr) {
        /* TODO: backward compatibility */
        ret = gf_asprintf(&searchstr, "auth.ip.%s.allow", name);
        if (-1 == ret) {
            gf_log("auth/addr", GF_LOG_ERROR,
                   "asprintf failed while setting search string");
            goto out;
        }
        allow_addr = dict_get(config_params, searchstr);
        GF_FREE(searchstr);
    }

    if (!(allow_addr || reject_addr)) {
        gf_log("auth/addr", GF_LOG_DEBUG,
               "none of the options auth.addr.%s.allow or "
               "auth.addr.%s.reject specified, returning auth_dont_care",
               name, name);
        goto out;
    }

    peer_info_data = dict_get(input_params, "peer-info");
    if (!peer_info_data) {
        gf_log("auth/addr", GF_LOG_ERROR, "peer-info not present");
        goto out;
    }

    ret = dict_get_str(input_params, "subdir-mount", &subdir);
    if (ret) {
        subdir = "/";
    }

    peer_info = data_to_ptr(peer_info_data);

    switch (((struct sockaddr *)&peer_info->sockaddr)->sa_family) {
        case AF_INET_SDP:
        case AF_INET:
        case AF_INET6:
            strcpy(peer_addr, peer_info->identifier);
            service = strrchr(peer_addr, ':');
            *service = '\0';
            service++;

            ret = dict_get_str(config_params, "rpc-auth-allow-insecure", &type);
            if (ret == 0) {
                ret = gf_string2boolean(type, &allow_insecure);
                if (ret < 0) {
                    gf_log("auth/addr", GF_LOG_WARNING,
                           "rpc-auth-allow-insecure option %s "
                           "is not a valid bool option",
                           type);
                    goto out;
                }
            }

            peer_port = atoi(service);
            if (peer_port >= PRIVILEGED_PORT_CEILING && !allow_insecure) {
                gf_log("auth/addr", GF_LOG_ERROR,
                       "client is bound to port %d which is not privileged",
                       peer_port);
                result = AUTH_REJECT;
                goto out;
            }
            break;

        case AF_UNIX:
            strcpy(peer_addr, peer_info->identifier);
            break;

        default:
            gf_log("authenticate/addr", GF_LOG_ERROR,
                   "unknown address family %d",
                   ((struct sockaddr *)&peer_info->sockaddr)->sa_family);
            goto out;
    }

    if (reject_addr) {
        parse_entries_and_compare(reject_addr->data, peer_addr, name, subdir,
                                  &result, AUTH_REJECT);
        if (result == AUTH_REJECT)
            goto out;
    }

    if (allow_addr) {
        parse_entries_and_compare(allow_addr->data, peer_addr, name, subdir,
                                  &result, AUTH_ACCEPT);
    }

out:
    return result;
}

struct volume_options options[] = {
    {
        .key = {"auth.addr.*.allow"},
        .type = GF_OPTION_TYPE_INTERNET_ADDRESS_LIST,
        .default_value = "*",
        .description = "List of addresses to be allowed to access volume",
        .op_version = {1},
        .flags = OPT_FLAG_SETTABLE | OPT_FLAG_DOC,
        .tags = {},
        /* option_validation_fn validate_fn; */
    },
    {
        .key = {"auth.addr.*.reject"},
        .type = GF_OPTION_TYPE_INTERNET_ADDRESS_LIST,
        .default_value = "*",
        .description = "List of addresses to be rejected to access volume",
        .op_version = {1},
        .flags = OPT_FLAG_SETTABLE | OPT_FLAG_DOC,
        .tags = {},
        /* option_validation_fn validate_fn; */
    },
    /* Backward compatibility */
    {
        .key = {"auth.ip.*.allow"},
        .type = GF_OPTION_TYPE_INTERNET_ADDRESS_LIST,
        .default_value = "*",
        .description = "List of addresses to be allowed to access volume",
        .op_version = {1},
        .flags = OPT_FLAG_SETTABLE | OPT_FLAG_DOC,
        .tags = {},
        /* option_validation_fn validate_fn; */
    },
    {.key = {NULL}}};