1 /* $NetBSD: match_ops.c,v 1.1.1.2 2013/01/02 18:59:13 tron Exp $ */ 2 3 /*++ 4 /* NAME 5 /* match_ops 3 6 /* SUMMARY 7 /* simple string or host pattern matching 8 /* SYNOPSIS 9 /* #include <match_list.h> 10 /* 11 /* int match_string(list, string, pattern) 12 /* MATCH_LIST *list; 13 /* const char *string; 14 /* const char *pattern; 15 /* 16 /* int match_hostname(list, name, pattern) 17 /* MATCH_LIST *list; 18 /* const char *name; 19 /* const char *pattern; 20 /* 21 /* int match_hostaddr(list, addr, pattern) 22 /* MATCH_LIST *list; 23 /* const char *addr; 24 /* const char *pattern; 25 /* DESCRIPTION 26 /* This module implements simple string and host name or address 27 /* matching. The matching process is case insensitive. If a pattern 28 /* has the form type:name, table lookup is used instead of string 29 /* or address comparison. 30 /* 31 /* match_string() matches the string against the pattern, requiring 32 /* an exact (case-insensitive) match. The flags argument is not used. 33 /* 34 /* match_hostname() matches the host name when the hostname matches 35 /* the pattern exactly, or when the pattern matches a parent domain 36 /* of the named host. The flags argument specifies the bit-wise OR 37 /* of zero or more of the following: 38 /* .IP MATCH_FLAG_PARENT 39 /* The hostname pattern foo.com matches itself and any name below 40 /* the domain foo.com. If this flag is cleared, foo.com matches itself 41 /* only, and .foo.com matches any name below the domain foo.com. 42 /* .IP MATCH_FLAG_RETURN 43 /* Log a warning, return "not found", and set list->error to 44 /* a non-zero dictionary error code, instead of raising a fatal 45 /* run-time error. 46 /* .RE 47 /* Specify MATCH_FLAG_NONE to request none of the above. 48 /* 49 /* match_hostaddr() matches a host address when the pattern is 50 /* identical to the host address, or when the pattern is a net/mask 51 /* that contains the address. The mask specifies the number of 52 /* bits in the network part of the pattern. The flags argument is 53 /* not used. 54 /* LICENSE 55 /* .ad 56 /* .fi 57 /* The Secure Mailer license must be distributed with this software. 58 /* AUTHOR(S) 59 /* Wietse Venema 60 /* IBM T.J. Watson Research 61 /* P.O. Box 704 62 /* Yorktown Heights, NY 10598, USA 63 /*--*/ 64 65 /* System library. */ 66 67 #include <sys_defs.h> 68 #include <netinet/in.h> 69 #include <arpa/inet.h> 70 #include <string.h> 71 #include <stdlib.h> 72 73 #ifdef STRCASECMP_IN_STRINGS_H 74 #include <strings.h> 75 #endif 76 77 /* Utility library. */ 78 79 #include <msg.h> 80 #include <mymalloc.h> 81 #include <split_at.h> 82 #include <dict.h> 83 #include <match_list.h> 84 #include <stringops.h> 85 #include <cidr_match.h> 86 87 #define MATCH_DICTIONARY(pattern) \ 88 ((pattern)[0] != '[' && strchr((pattern), ':') != 0) 89 90 /* match_error - return or raise fatal error */ 91 92 static int match_error(MATCH_LIST *list, const char *fmt,...) 93 { 94 VSTRING *buf = vstring_alloc(100); 95 va_list ap; 96 97 /* 98 * Report, and maybe return. 99 */ 100 va_start(ap, fmt); 101 vstring_vsprintf(buf, fmt, ap); 102 va_end(ap); 103 if (list->flags & MATCH_FLAG_RETURN) { 104 msg_warn("%s", vstring_str(buf)); 105 } else { 106 msg_fatal("%s", vstring_str(buf)); 107 } 108 vstring_free(buf); 109 return (0); 110 } 111 112 /* match_string - match a string literal */ 113 114 int match_string(MATCH_LIST *list, const char *string, const char *pattern) 115 { 116 const char *myname = "match_string"; 117 DICT *dict; 118 119 if (msg_verbose) 120 msg_info("%s: %s ~? %s", myname, string, pattern); 121 122 /* 123 * Try dictionary lookup: exact match. 124 */ 125 if (MATCH_DICTIONARY(pattern)) { 126 if ((dict = dict_handle(pattern)) == 0) 127 msg_panic("%s: unknown dictionary: %s", myname, pattern); 128 if (dict_get(dict, string) != 0) 129 return (1); 130 if ((list->error = dict->error) != 0) 131 return (match_error(list, "%s:%s: table lookup problem", 132 dict->type, dict->name)); 133 return (0); 134 } 135 136 /* 137 * Try an exact string match. 138 */ 139 if (strcasecmp(string, pattern) == 0) { 140 return (1); 141 } 142 143 /* 144 * No match found. 145 */ 146 return (0); 147 } 148 149 /* match_hostname - match a host by name */ 150 151 int match_hostname(MATCH_LIST *list, const char *name, const char *pattern) 152 { 153 const char *myname = "match_hostname"; 154 const char *pd; 155 const char *entry; 156 const char *next; 157 int match; 158 DICT *dict; 159 160 if (msg_verbose) 161 msg_info("%s: %s ~? %s", myname, name, pattern); 162 163 /* 164 * Try dictionary lookup: exact match and parent domains. 165 * 166 * Don't look up parent domain substrings with regexp maps etc. 167 */ 168 if (MATCH_DICTIONARY(pattern)) { 169 if ((dict = dict_handle(pattern)) == 0) 170 msg_panic("%s: unknown dictionary: %s", myname, pattern); 171 match = 0; 172 for (entry = name; *entry != 0; entry = next) { 173 if (entry == name || (dict->flags & DICT_FLAG_FIXED)) { 174 match = (dict_get(dict, entry) != 0); 175 if (msg_verbose > 1) 176 msg_info("%s: lookup %s:%s %s: %s", 177 myname, dict->type, dict->name, entry, 178 match ? "found" : "notfound"); 179 if (match != 0) 180 break; 181 if ((list->error = dict->error) != 0) 182 return (match_error(list, "%s:%s: table lookup problem", 183 dict->type, dict->name)); 184 } 185 if ((next = strchr(entry + 1, '.')) == 0) 186 break; 187 if (list->flags & MATCH_FLAG_PARENT) 188 next += 1; 189 } 190 return (match); 191 } 192 193 /* 194 * Try an exact match with the host name. 195 */ 196 if (strcasecmp(name, pattern) == 0) { 197 return (1); 198 } 199 200 /* 201 * See if the pattern is a parent domain of the hostname. 202 */ 203 else { 204 if (list->flags & MATCH_FLAG_PARENT) { 205 pd = name + strlen(name) - strlen(pattern); 206 if (pd > name && pd[-1] == '.' && strcasecmp(pd, pattern) == 0) 207 return (1); 208 } else if (pattern[0] == '.') { 209 pd = name + strlen(name) - strlen(pattern); 210 if (pd > name && strcasecmp(pd, pattern) == 0) 211 return (1); 212 } 213 } 214 return (0); 215 } 216 217 /* match_hostaddr - match host by address */ 218 219 int match_hostaddr(MATCH_LIST *list, const char *addr, const char *pattern) 220 { 221 const char *myname = "match_hostaddr"; 222 char *saved_patt; 223 CIDR_MATCH match_info; 224 DICT *dict; 225 VSTRING *err; 226 int rc; 227 228 if (msg_verbose) 229 msg_info("%s: %s ~? %s", myname, addr, pattern); 230 231 #define V4_ADDR_STRING_CHARS "01234567890." 232 #define V6_ADDR_STRING_CHARS V4_ADDR_STRING_CHARS "abcdefABCDEF:" 233 234 if (addr[strspn(addr, V6_ADDR_STRING_CHARS)] != 0) 235 return (0); 236 237 /* 238 * Try dictionary lookup. This can be case insensitive. 239 */ 240 if (MATCH_DICTIONARY(pattern)) { 241 if ((dict = dict_handle(pattern)) == 0) 242 msg_panic("%s: unknown dictionary: %s", myname, pattern); 243 if (dict_get(dict, addr) != 0) 244 return (1); 245 if ((list->error = dict->error) != 0) 246 return (match_error(list, "%s:%s: table lookup problem", 247 dict->type, dict->name)); 248 return (0); 249 } 250 251 /* 252 * Try an exact match with the host address. 253 */ 254 if (pattern[0] != '[') { 255 if (strcasecmp(addr, pattern) == 0) 256 return (1); 257 } else { 258 size_t addr_len = strlen(addr); 259 260 if (strncasecmp(addr, pattern + 1, addr_len) == 0 261 && strcmp(pattern + 1 + addr_len, "]") == 0) 262 return (1); 263 } 264 265 /* 266 * Light-weight tests before we get into expensive operations. 267 * 268 * - Don't bother matching IPv4 against IPv6. Postfix transforms 269 * IPv4-in-IPv6 to native IPv4 form when IPv4 support is enabled in 270 * Postfix; if not, then Postfix has no business dealing with IPv4 271 * addresses anyway. 272 * 273 * - Don't bother unless the pattern is either an IPv6 address or net/mask. 274 * 275 * We can safely skip IPv4 address patterns because their form is 276 * unambiguous and they did not match in the strcasecmp() calls above. 277 * 278 * XXX We MUST skip (parent) domain names, which may appear in NAMADR_LIST 279 * input, to avoid triggering false cidr_match_parse() errors. 280 * 281 * The last two conditions below are for backwards compatibility with 282 * earlier Postfix versions: don't abort with fatal errors on junk that 283 * was silently ignored (principle of least astonishment). 284 */ 285 if (!strchr(addr, ':') != !strchr(pattern, ':') 286 || pattern[strcspn(pattern, ":/")] == 0 287 || pattern[strspn(pattern, V4_ADDR_STRING_CHARS)] == 0 288 || pattern[strspn(pattern, V6_ADDR_STRING_CHARS "[]/")] != 0) 289 return (0); 290 291 /* 292 * No escape from expensive operations: either we have a net/mask 293 * pattern, or we have an address that can have multiple valid 294 * representations (e.g., 0:0:0:0:0:0:0:1 versus ::1, etc.). The only way 295 * to find out if the address matches the pattern is to transform 296 * everything into to binary form, and to do the comparison there. 297 */ 298 saved_patt = mystrdup(pattern); 299 err = cidr_match_parse(&match_info, saved_patt, (VSTRING *) 0); 300 myfree(saved_patt); 301 if (err != 0) { 302 list->error = DICT_ERR_RETRY; 303 rc = match_error(list, "%s", vstring_str(err)); 304 vstring_free(err); 305 return (rc); 306 } 307 return (cidr_match_execute(&match_info, addr) != 0); 308 } 309