1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
|
#include <stdbool.h>
#include <stdlib.h>
#include <stdio.h>
#include <stdint.h>
#include <unistd.h>
#include <string.h>
#include <arpa/inet.h>
#include <netinet/in.h>
#include "triton.h"
#include "list.h"
#include "log.h"
#include "utils.h"
#include "iprange.h"
#include "memdebug.h"
struct iprange_t
{
struct list_head entry;
uint32_t begin;
uint32_t end;
};
static int conf_disable = 0;
static LIST_HEAD(client_ranges);
/* Maximum IPv4 address length with CIDR notation but no extra 0,
* e.g. "0xff.0xff.0xff.0xff/32".
*/
#define CIDR_MAXLEN 22
static void free_ranges(struct list_head *head)
{
struct iprange_t *range;
while (!list_empty(head)) {
range = list_first_entry(head, typeof(*range), entry);
list_del(&range->entry);
_free(range);
}
}
static int parse_iprange(const char *str, struct iprange_t **range)
{
char ipstr[CIDR_MAXLEN + 1] = { 0 };
struct iprange_t *_range;
struct in_addr addr;
const char *errmsg;
char *suffix_str;
uint32_t ipmin;
uint32_t ipmax;
bool is_cidr;
/* Extra spaces and comments must have already been removed */
if (strpbrk(str, " \t#")) {
log_error("iprange: impossible to parse range \"%s\":"
" invalid space or comment character found\n",
str);
return -1;
}
if (!strcmp(str, "disable"))
goto disable;
strncpy(ipstr, str, CIDR_MAXLEN + 1);
if (ipstr[CIDR_MAXLEN] != '\0') {
log_error("iprange: impossible to parse range \"%s\":"
" line too long\n",
str);
return -1;
}
suffix_str = strpbrk(ipstr, "-/");
if (!suffix_str) {
log_error("iprange: impossible to parse range \"%s\":"
" unrecognised range format\n",
str);
return -1;
}
is_cidr = *suffix_str == '/';
*suffix_str = '\0';
++suffix_str;
if (u_parse_ip4addr(ipstr, &addr, &errmsg)) {
log_error("iprange: impossible to parse range \"%s\":"
" invalid IPv4 address \"%s\"\n",
str, ipstr);
return -1;
}
ipmin = ntohl(addr.s_addr);
/* If is_cidr is set, range is given with CIDR notation,
* e.g. "192.0.2.0/24".
* If unset, range is an IP address where the last octet is replaced by
* an octet range, e.g. "192.0.2.0-255".
*/
if (is_cidr) {
long int prefix_len;
uint32_t mask;
if (u_readlong(&prefix_len, suffix_str, 0, 32)) {
log_error("iprange: impossible to parse range \"%s\":"
" invalid CIDR prefix length \"/%s\"\n",
str, suffix_str);
return -1;
}
/* Interpret /0 as disable request */
if (prefix_len == 0)
goto disable;
mask = UINT32_MAX << (32 - prefix_len);
if (ipmin != (ipmin & mask)) {
char buf[INET_ADDRSTRLEN] = { 0 };
ipmin &= mask;
addr.s_addr = htonl(ipmin);
log_warn("iprange: first IP of range %s will be %s\n",
str, inet_ntop(AF_INET, &addr, buf,
sizeof(buf)));
}
ipmax = ipmin | ~mask;
} else {
long int max;
if (u_readlong(&max, suffix_str, ipmin & 0xff, 255)) {
log_error("iprange: impossible to parse range \"%s\":"
" invalid upper bound \"-%s\"\n",
str, suffix_str);
return -1;
}
ipmax = (ipmin & 0xffffff00) | max;
}
_range = _malloc(sizeof(*_range));
if (!_range) {
log_error("iprange: impossible to allocate range \"%s\":"
" memory allocation failed\n", str);
return -1;
}
_range->begin = ipmin;
_range->end = ipmax;
*range = _range;
return 0;
disable:
*range = NULL;
return 0;
}
static void load_ranges(struct list_head *list, const char *conf_sect)
{
struct conf_sect_t *s = conf_get_section(conf_sect);
struct conf_option_t *opt;
struct iprange_t *r;
if (!s) {
log_emerg("iprange: section '%s' not found in config file, pptp and l2tp probably will not work...\n", conf_sect);
return;
}
list_for_each_entry(opt, &s->items, entry) {
/* Ignore parsing errors, parse_iprange() already logs suitable
* error message.
*/
if (parse_iprange(opt->name, &r) < 0)
continue;
if (!r) {
log_warn("iprange: iprange module disabled, improper IP address assignment may cause kernel soft lockup!\n");
free_ranges(list);
conf_disable = 1;
return;
}
list_add_tail(&r->entry, list);
}
}
static int check_range(struct list_head *list, in_addr_t ipaddr)
{
struct iprange_t *r;
uint32_t a = ntohl(ipaddr);
list_for_each_entry(r, list, entry) {
if (a >= r->begin && a <= r->end)
return 0;
}
return -1;
}
int __export iprange_client_check(in_addr_t ipaddr)
{
if (conf_disable)
return 0;
return check_range(&client_ranges, ipaddr);
}
int __export iprange_tunnel_check(in_addr_t ipaddr)
{
if (conf_disable)
return 0;
return !check_range(&client_ranges, ipaddr);
}
static void iprange_init(void)
{
load_ranges(&client_ranges, "client-ip-range");
}
DEFINE_INIT(10, iprange_init);
|
