1*0Sstevel@tonic-gate /*
2*0Sstevel@tonic-gate * CDDL HEADER START
3*0Sstevel@tonic-gate *
4*0Sstevel@tonic-gate * The contents of this file are subject to the terms of the
5*0Sstevel@tonic-gate * Common Development and Distribution License, Version 1.0 only
6*0Sstevel@tonic-gate * (the "License"). You may not use this file except in compliance
7*0Sstevel@tonic-gate * with the License.
8*0Sstevel@tonic-gate *
9*0Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10*0Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
11*0Sstevel@tonic-gate * See the License for the specific language governing permissions
12*0Sstevel@tonic-gate * and limitations under the License.
13*0Sstevel@tonic-gate *
14*0Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
15*0Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16*0Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
17*0Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
18*0Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
19*0Sstevel@tonic-gate *
20*0Sstevel@tonic-gate * CDDL HEADER END
21*0Sstevel@tonic-gate */
22*0Sstevel@tonic-gate /*
23*0Sstevel@tonic-gate * Copyright (c) 1999 by Sun Microsystems, Inc.
24*0Sstevel@tonic-gate * All rights reserved.
25*0Sstevel@tonic-gate */
26*0Sstevel@tonic-gate
27*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI"
28*0Sstevel@tonic-gate
29*0Sstevel@tonic-gate #include <sys/types.h>
30*0Sstevel@tonic-gate #include <sys/socket.h>
31*0Sstevel@tonic-gate #include <netinet/in.h>
32*0Sstevel@tonic-gate #include <arpa/inet.h>
33*0Sstevel@tonic-gate #include <stdlib.h>
34*0Sstevel@tonic-gate #include <unistd.h>
35*0Sstevel@tonic-gate #include <stdio.h>
36*0Sstevel@tonic-gate #include <string.h>
37*0Sstevel@tonic-gate #include <malloc.h>
38*0Sstevel@tonic-gate #include <syslog.h>
39*0Sstevel@tonic-gate #include <sys/tiuser.h>
40*0Sstevel@tonic-gate
41*0Sstevel@tonic-gate #define ACCFILE "/var/yp/securenets"
42*0Sstevel@tonic-gate #define MAXLINE 128
43*0Sstevel@tonic-gate
44*0Sstevel@tonic-gate typedef union {
45*0Sstevel@tonic-gate struct in_addr in4;
46*0Sstevel@tonic-gate struct in6_addr in6;
47*0Sstevel@tonic-gate } inaddr_t;
48*0Sstevel@tonic-gate
49*0Sstevel@tonic-gate struct seclist {
50*0Sstevel@tonic-gate sa_family_t af;
51*0Sstevel@tonic-gate inaddr_t mask;
52*0Sstevel@tonic-gate inaddr_t net;
53*0Sstevel@tonic-gate struct seclist *next;
54*0Sstevel@tonic-gate };
55*0Sstevel@tonic-gate
56*0Sstevel@tonic-gate static int string2inaddr(char *, sa_family_t *, inaddr_t *);
57*0Sstevel@tonic-gate static int addrequal(sa_family_t af, inaddr_t *laddr, inaddr_t *mask,
58*0Sstevel@tonic-gate inaddr_t *caddr);
59*0Sstevel@tonic-gate
60*0Sstevel@tonic-gate static struct seclist *slist;
61*0Sstevel@tonic-gate static int nofile = 0;
62*0Sstevel@tonic-gate
63*0Sstevel@tonic-gate void
get_secure_nets(char * daemon_name)64*0Sstevel@tonic-gate get_secure_nets(char *daemon_name)
65*0Sstevel@tonic-gate {
66*0Sstevel@tonic-gate FILE *fp;
67*0Sstevel@tonic-gate char strung[MAXLINE], nmask[MAXLINE], net[MAXLINE];
68*0Sstevel@tonic-gate inaddr_t maskin, netin;
69*0Sstevel@tonic-gate sa_family_t maskaf, netaf;
70*0Sstevel@tonic-gate struct seclist *tmp1, *tmp2;
71*0Sstevel@tonic-gate int items = 0, line = 0;
72*0Sstevel@tonic-gate if (fp = fopen(ACCFILE, "r")) {
73*0Sstevel@tonic-gate tmp1 = (struct seclist *) malloc(sizeof (struct seclist));
74*0Sstevel@tonic-gate slist = tmp2 = tmp1;
75*0Sstevel@tonic-gate while (fgets(strung, MAXLINE, fp)) {
76*0Sstevel@tonic-gate line++;
77*0Sstevel@tonic-gate if (strung[strlen(strung) - 1] != '\n') {
78*0Sstevel@tonic-gate syslog(LOG_ERR|LOG_DAEMON,
79*0Sstevel@tonic-gate "%s: %s line %d: too long\n",
80*0Sstevel@tonic-gate daemon_name, ACCFILE, line);
81*0Sstevel@tonic-gate exit(1);
82*0Sstevel@tonic-gate }
83*0Sstevel@tonic-gate if (strung[0] != '#') {
84*0Sstevel@tonic-gate items++;
85*0Sstevel@tonic-gate if (sscanf(strung,
86*0Sstevel@tonic-gate "%46s%46s", nmask, net) < 2) {
87*0Sstevel@tonic-gate
88*0Sstevel@tonic-gate syslog(LOG_ERR|LOG_DAEMON,
89*0Sstevel@tonic-gate "%s: %s line %d: missing fields\n",
90*0Sstevel@tonic-gate daemon_name, ACCFILE, line);
91*0Sstevel@tonic-gate exit(1);
92*0Sstevel@tonic-gate }
93*0Sstevel@tonic-gate netaf = AF_UNSPEC;
94*0Sstevel@tonic-gate if (! string2inaddr(net, &netaf, &netin)) {
95*0Sstevel@tonic-gate syslog(LOG_ERR|LOG_DAEMON,
96*0Sstevel@tonic-gate "%s: %s line %d: error in address\n",
97*0Sstevel@tonic-gate daemon_name, ACCFILE, line);
98*0Sstevel@tonic-gate exit(1);
99*0Sstevel@tonic-gate }
100*0Sstevel@tonic-gate maskaf = netaf;
101*0Sstevel@tonic-gate if (! string2inaddr(nmask, &maskaf, &maskin) ||
102*0Sstevel@tonic-gate maskaf != netaf) {
103*0Sstevel@tonic-gate syslog(LOG_ERR|LOG_DAEMON,
104*0Sstevel@tonic-gate "%s: %s line %d: error in netmask\n",
105*0Sstevel@tonic-gate daemon_name, ACCFILE, line);
106*0Sstevel@tonic-gate exit(1);
107*0Sstevel@tonic-gate }
108*0Sstevel@tonic-gate if (! addrequal(netaf, &netin, &maskin,
109*0Sstevel@tonic-gate &netin)) {
110*0Sstevel@tonic-gate syslog(LOG_ERR|LOG_DAEMON,
111*0Sstevel@tonic-gate "%s: %s line %d: netmask does not match network\n",
112*0Sstevel@tonic-gate daemon_name, ACCFILE, line);
113*0Sstevel@tonic-gate exit(1);
114*0Sstevel@tonic-gate }
115*0Sstevel@tonic-gate
116*0Sstevel@tonic-gate tmp1->af = netaf;
117*0Sstevel@tonic-gate tmp1->mask = maskin;
118*0Sstevel@tonic-gate tmp1->net = netin;
119*0Sstevel@tonic-gate tmp1->next = (struct seclist *)
120*0Sstevel@tonic-gate malloc(sizeof (struct seclist));
121*0Sstevel@tonic-gate tmp2 = tmp1;
122*0Sstevel@tonic-gate tmp1 = tmp1->next;
123*0Sstevel@tonic-gate }
124*0Sstevel@tonic-gate }
125*0Sstevel@tonic-gate tmp2->next = NULL;
126*0Sstevel@tonic-gate /* if nothing to process, set nofile flag and free up memory */
127*0Sstevel@tonic-gate if (items == 0) {
128*0Sstevel@tonic-gate free(slist);
129*0Sstevel@tonic-gate nofile = 1;
130*0Sstevel@tonic-gate }
131*0Sstevel@tonic-gate } else {
132*0Sstevel@tonic-gate syslog(LOG_WARNING|LOG_DAEMON, "%s: no %s file\n",
133*0Sstevel@tonic-gate daemon_name, ACCFILE);
134*0Sstevel@tonic-gate nofile = 1;
135*0Sstevel@tonic-gate }
136*0Sstevel@tonic-gate }
137*0Sstevel@tonic-gate
138*0Sstevel@tonic-gate int
check_secure_net_ti(struct netbuf * caller,char * ypname)139*0Sstevel@tonic-gate check_secure_net_ti(struct netbuf *caller, char *ypname) {
140*0Sstevel@tonic-gate struct seclist *tmp;
141*0Sstevel@tonic-gate sa_family_t af;
142*0Sstevel@tonic-gate inaddr_t addr;
143*0Sstevel@tonic-gate char buf[INET6_ADDRSTRLEN];
144*0Sstevel@tonic-gate
145*0Sstevel@tonic-gate if (nofile)
146*0Sstevel@tonic-gate return (1);
147*0Sstevel@tonic-gate
148*0Sstevel@tonic-gate af = ((struct sockaddr_storage *)caller->buf)->ss_family;
149*0Sstevel@tonic-gate if (af == AF_INET) {
150*0Sstevel@tonic-gate addr.in4 = ((struct sockaddr_in *)caller->buf)->sin_addr;
151*0Sstevel@tonic-gate } else if (af == AF_INET6) {
152*0Sstevel@tonic-gate addr.in6 = ((struct sockaddr_in6 *)caller->buf)->sin6_addr;
153*0Sstevel@tonic-gate } else {
154*0Sstevel@tonic-gate return (1);
155*0Sstevel@tonic-gate }
156*0Sstevel@tonic-gate
157*0Sstevel@tonic-gate tmp = slist;
158*0Sstevel@tonic-gate while (tmp != NULL) {
159*0Sstevel@tonic-gate if (af == tmp->af &&
160*0Sstevel@tonic-gate addrequal(af, &tmp->net, &tmp->mask, &addr)) {
161*0Sstevel@tonic-gate return (1);
162*0Sstevel@tonic-gate }
163*0Sstevel@tonic-gate tmp = tmp->next;
164*0Sstevel@tonic-gate }
165*0Sstevel@tonic-gate syslog(LOG_ERR|LOG_DAEMON, "%s: access denied for %s\n",
166*0Sstevel@tonic-gate ypname, inet_ntop(af,
167*0Sstevel@tonic-gate (af == AF_INET6) ? (void *)&addr.in6 :
168*0Sstevel@tonic-gate (void *)&addr.in4, buf, sizeof (buf)));
169*0Sstevel@tonic-gate
170*0Sstevel@tonic-gate return (0);
171*0Sstevel@tonic-gate }
172*0Sstevel@tonic-gate
173*0Sstevel@tonic-gate
174*0Sstevel@tonic-gate static int
string2inaddr(char * string,sa_family_t * af,inaddr_t * addr)175*0Sstevel@tonic-gate string2inaddr(char *string, sa_family_t *af, inaddr_t *addr) {
176*0Sstevel@tonic-gate
177*0Sstevel@tonic-gate sa_family_t stringaf = AF_UNSPEC;
178*0Sstevel@tonic-gate
179*0Sstevel@tonic-gate stringaf = (strchr(string, ':') != 0) ? AF_INET6 : AF_INET;
180*0Sstevel@tonic-gate
181*0Sstevel@tonic-gate if (*af != AF_UNSPEC && strcmp(string, "host") == 0) {
182*0Sstevel@tonic-gate if (*af == AF_INET) {
183*0Sstevel@tonic-gate string = "255.255.255.255";
184*0Sstevel@tonic-gate stringaf = AF_INET;
185*0Sstevel@tonic-gate } else if (*af == AF_INET6) {
186*0Sstevel@tonic-gate string = "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff";
187*0Sstevel@tonic-gate stringaf = AF_INET6;
188*0Sstevel@tonic-gate }
189*0Sstevel@tonic-gate }
190*0Sstevel@tonic-gate
191*0Sstevel@tonic-gate *af = stringaf;
192*0Sstevel@tonic-gate if (inet_pton(*af, string, (*af == AF_INET6) ? (void *)&addr->in6 :
193*0Sstevel@tonic-gate (void *)&addr->in4) != 1) {
194*0Sstevel@tonic-gate return (0);
195*0Sstevel@tonic-gate }
196*0Sstevel@tonic-gate
197*0Sstevel@tonic-gate return (1);
198*0Sstevel@tonic-gate }
199*0Sstevel@tonic-gate
200*0Sstevel@tonic-gate
201*0Sstevel@tonic-gate static int
addrequal(sa_family_t af,inaddr_t * laddr,inaddr_t * mask,inaddr_t * caddr)202*0Sstevel@tonic-gate addrequal(sa_family_t af, inaddr_t *laddr, inaddr_t *mask, inaddr_t *caddr) {
203*0Sstevel@tonic-gate
204*0Sstevel@tonic-gate if (af == AF_INET6) {
205*0Sstevel@tonic-gate int i;
206*0Sstevel@tonic-gate for (i = 0; i < sizeof (laddr->in6.s6_addr); i++) {
207*0Sstevel@tonic-gate if ((caddr->in6.s6_addr[i] & mask->in6.s6_addr[i]) !=
208*0Sstevel@tonic-gate laddr->in6.s6_addr[i])
209*0Sstevel@tonic-gate return (0);
210*0Sstevel@tonic-gate }
211*0Sstevel@tonic-gate return (1);
212*0Sstevel@tonic-gate } else if (af == AF_INET) {
213*0Sstevel@tonic-gate return ((caddr->in4.s_addr & mask->in4.s_addr) ==
214*0Sstevel@tonic-gate laddr->in4.s_addr);
215*0Sstevel@tonic-gate } else {
216*0Sstevel@tonic-gate return (0);
217*0Sstevel@tonic-gate }
218*0Sstevel@tonic-gate }
219*0Sstevel@tonic-gate
220*0Sstevel@tonic-gate
221*0Sstevel@tonic-gate static void
print_inaddr(char * string,sa_family_t af,inaddr_t * addr)222*0Sstevel@tonic-gate print_inaddr(char *string, sa_family_t af, inaddr_t *addr) {
223*0Sstevel@tonic-gate
224*0Sstevel@tonic-gate char buf[INET6_ADDRSTRLEN];
225*0Sstevel@tonic-gate
226*0Sstevel@tonic-gate printf("%s %s %s\n",
227*0Sstevel@tonic-gate string, (af == AF_INET6)?"AF_INET6":"AF_INET",
228*0Sstevel@tonic-gate inet_ntop(af, (af == AF_INET6) ? (void *)&addr->in6 :
229*0Sstevel@tonic-gate (void *)&addr->in4, buf, sizeof (buf)));
230*0Sstevel@tonic-gate }
231