Back to home page

Nginx displayed by LXR

Source navigation ]
Diff markup ]
Identifier search ]
general search ]
 
 
Version: nginx-1.13.12 ]​[ nginx-1.12.2 ]​

0001 
0002 /*
0003  * Copyright (C) Igor Sysoev
0004  * Copyright (C) Nginx, Inc.
0005  */
0006 
0007 
0008 #include <ngx_config.h>
0009 #include <ngx_core.h>
0010 #include <ngx_http.h>
0011 
0012 
0013 typedef struct {
0014     in_addr_t         mask;
0015     in_addr_t         addr;
0016     ngx_uint_t        deny;      /* unsigned  deny:1; */
0017 } ngx_http_access_rule_t;
0018 
0019 #if (NGX_HAVE_INET6)
0020 
0021 typedef struct {
0022     struct in6_addr   addr;
0023     struct in6_addr   mask;
0024     ngx_uint_t        deny;      /* unsigned  deny:1; */
0025 } ngx_http_access_rule6_t;
0026 
0027 #endif
0028 
0029 #if (NGX_HAVE_UNIX_DOMAIN)
0030 
0031 typedef struct {
0032     ngx_uint_t        deny;      /* unsigned  deny:1; */
0033 } ngx_http_access_rule_un_t;
0034 
0035 #endif
0036 
0037 typedef struct {
0038     ngx_array_t      *rules;     /* array of ngx_http_access_rule_t */
0039 #if (NGX_HAVE_INET6)
0040     ngx_array_t      *rules6;    /* array of ngx_http_access_rule6_t */
0041 #endif
0042 #if (NGX_HAVE_UNIX_DOMAIN)
0043     ngx_array_t      *rules_un;  /* array of ngx_http_access_rule_un_t */
0044 #endif
0045 } ngx_http_access_loc_conf_t;
0046 
0047 
0048 static ngx_int_t ngx_http_access_handler(ngx_http_request_t *r);
0049 static ngx_int_t ngx_http_access_inet(ngx_http_request_t *r,
0050     ngx_http_access_loc_conf_t *alcf, in_addr_t addr);
0051 #if (NGX_HAVE_INET6)
0052 static ngx_int_t ngx_http_access_inet6(ngx_http_request_t *r,
0053     ngx_http_access_loc_conf_t *alcf, u_char *p);
0054 #endif
0055 #if (NGX_HAVE_UNIX_DOMAIN)
0056 static ngx_int_t ngx_http_access_unix(ngx_http_request_t *r,
0057     ngx_http_access_loc_conf_t *alcf);
0058 #endif
0059 static ngx_int_t ngx_http_access_found(ngx_http_request_t *r, ngx_uint_t deny);
0060 static char *ngx_http_access_rule(ngx_conf_t *cf, ngx_command_t *cmd,
0061     void *conf);
0062 static void *ngx_http_access_create_loc_conf(ngx_conf_t *cf);
0063 static char *ngx_http_access_merge_loc_conf(ngx_conf_t *cf,
0064     void *parent, void *child);
0065 static ngx_int_t ngx_http_access_init(ngx_conf_t *cf);
0066 
0067 
0068 static ngx_command_t  ngx_http_access_commands[] = {
0069 
0070     { ngx_string("allow"),
0071       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LMT_CONF
0072                         |NGX_CONF_TAKE1,
0073       ngx_http_access_rule,
0074       NGX_HTTP_LOC_CONF_OFFSET,
0075       0,
0076       NULL },
0077 
0078     { ngx_string("deny"),
0079       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LMT_CONF
0080                         |NGX_CONF_TAKE1,
0081       ngx_http_access_rule,
0082       NGX_HTTP_LOC_CONF_OFFSET,
0083       0,
0084       NULL },
0085 
0086       ngx_null_command
0087 };
0088 
0089 
0090 
0091 static ngx_http_module_t  ngx_http_access_module_ctx = {
0092     NULL,                                  /* preconfiguration */
0093     ngx_http_access_init,                  /* postconfiguration */
0094 
0095     NULL,                                  /* create main configuration */
0096     NULL,                                  /* init main configuration */
0097 
0098     NULL,                                  /* create server configuration */
0099     NULL,                                  /* merge server configuration */
0100 
0101     ngx_http_access_create_loc_conf,       /* create location configuration */
0102     ngx_http_access_merge_loc_conf         /* merge location configuration */
0103 };
0104 
0105 
0106 ngx_module_t  ngx_http_access_module = {
0107     NGX_MODULE_V1,
0108     &ngx_http_access_module_ctx,           /* module context */
0109     ngx_http_access_commands,              /* module directives */
0110     NGX_HTTP_MODULE,                       /* module type */
0111     NULL,                                  /* init master */
0112     NULL,                                  /* init module */
0113     NULL,                                  /* init process */
0114     NULL,                                  /* init thread */
0115     NULL,                                  /* exit thread */
0116     NULL,                                  /* exit process */
0117     NULL,                                  /* exit master */
0118     NGX_MODULE_V1_PADDING
0119 };
0120 
0121 
0122 static ngx_int_t
0123 ngx_http_access_handler(ngx_http_request_t *r)
0124 {
0125     struct sockaddr_in          *sin;
0126     ngx_http_access_loc_conf_t  *alcf;
0127 #if (NGX_HAVE_INET6)
0128     u_char                      *p;
0129     in_addr_t                    addr;
0130     struct sockaddr_in6         *sin6;
0131 #endif
0132 
0133     alcf = ngx_http_get_module_loc_conf(r, ngx_http_access_module);
0134 
0135     switch (r->connection->sockaddr->sa_family) {
0136 
0137     case AF_INET:
0138         if (alcf->rules) {
0139             sin = (struct sockaddr_in *) r->connection->sockaddr;
0140             return ngx_http_access_inet(r, alcf, sin->sin_addr.s_addr);
0141         }
0142         break;
0143 
0144 #if (NGX_HAVE_INET6)
0145 
0146     case AF_INET6:
0147         sin6 = (struct sockaddr_in6 *) r->connection->sockaddr;
0148         p = sin6->sin6_addr.s6_addr;
0149 
0150         if (alcf->rules && IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
0151             addr = p[12] << 24;
0152             addr += p[13] << 16;
0153             addr += p[14] << 8;
0154             addr += p[15];
0155             return ngx_http_access_inet(r, alcf, htonl(addr));
0156         }
0157 
0158         if (alcf->rules6) {
0159             return ngx_http_access_inet6(r, alcf, p);
0160         }
0161 
0162         break;
0163 
0164 #endif
0165 
0166 #if (NGX_HAVE_UNIX_DOMAIN)
0167 
0168     case AF_UNIX:
0169         if (alcf->rules_un) {
0170             return ngx_http_access_unix(r, alcf);
0171         }
0172 
0173         break;
0174 
0175 #endif
0176     }
0177 
0178     return NGX_DECLINED;
0179 }
0180 
0181 
0182 static ngx_int_t
0183 ngx_http_access_inet(ngx_http_request_t *r, ngx_http_access_loc_conf_t *alcf,
0184     in_addr_t addr)
0185 {
0186     ngx_uint_t               i;
0187     ngx_http_access_rule_t  *rule;
0188 
0189     rule = alcf->rules->elts;
0190     for (i = 0; i < alcf->rules->nelts; i++) {
0191 
0192         ngx_log_debug3(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
0193                        "access: %08XD %08XD %08XD",
0194                        addr, rule[i].mask, rule[i].addr);
0195 
0196         if ((addr & rule[i].mask) == rule[i].addr) {
0197             return ngx_http_access_found(r, rule[i].deny);
0198         }
0199     }
0200 
0201     return NGX_DECLINED;
0202 }
0203 
0204 
0205 #if (NGX_HAVE_INET6)
0206 
0207 static ngx_int_t
0208 ngx_http_access_inet6(ngx_http_request_t *r, ngx_http_access_loc_conf_t *alcf,
0209     u_char *p)
0210 {
0211     ngx_uint_t                n;
0212     ngx_uint_t                i;
0213     ngx_http_access_rule6_t  *rule6;
0214 
0215     rule6 = alcf->rules6->elts;
0216     for (i = 0; i < alcf->rules6->nelts; i++) {
0217 
0218 #if (NGX_DEBUG)
0219         {
0220         size_t  cl, ml, al;
0221         u_char  ct[NGX_INET6_ADDRSTRLEN];
0222         u_char  mt[NGX_INET6_ADDRSTRLEN];
0223         u_char  at[NGX_INET6_ADDRSTRLEN];
0224 
0225         cl = ngx_inet6_ntop(p, ct, NGX_INET6_ADDRSTRLEN);
0226         ml = ngx_inet6_ntop(rule6[i].mask.s6_addr, mt, NGX_INET6_ADDRSTRLEN);
0227         al = ngx_inet6_ntop(rule6[i].addr.s6_addr, at, NGX_INET6_ADDRSTRLEN);
0228 
0229         ngx_log_debug6(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
0230                        "access: %*s %*s %*s", cl, ct, ml, mt, al, at);
0231         }
0232 #endif
0233 
0234         for (n = 0; n < 16; n++) {
0235             if ((p[n] & rule6[i].mask.s6_addr[n]) != rule6[i].addr.s6_addr[n]) {
0236                 goto next;
0237             }
0238         }
0239 
0240         return ngx_http_access_found(r, rule6[i].deny);
0241 
0242     next:
0243         continue;
0244     }
0245 
0246     return NGX_DECLINED;
0247 }
0248 
0249 #endif
0250 
0251 
0252 #if (NGX_HAVE_UNIX_DOMAIN)
0253 
0254 static ngx_int_t
0255 ngx_http_access_unix(ngx_http_request_t *r, ngx_http_access_loc_conf_t *alcf)
0256 {
0257     ngx_uint_t                  i;
0258     ngx_http_access_rule_un_t  *rule_un;
0259 
0260     rule_un = alcf->rules_un->elts;
0261     for (i = 0; i < alcf->rules_un->nelts; i++) {
0262 
0263         /* TODO: check path */
0264         if (1) {
0265             return ngx_http_access_found(r, rule_un[i].deny);
0266         }
0267     }
0268 
0269     return NGX_DECLINED;
0270 }
0271 
0272 #endif
0273 
0274 
0275 static ngx_int_t
0276 ngx_http_access_found(ngx_http_request_t *r, ngx_uint_t deny)
0277 {
0278     ngx_http_core_loc_conf_t  *clcf;
0279 
0280     if (deny) {
0281         clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);
0282 
0283         if (clcf->satisfy == NGX_HTTP_SATISFY_ALL) {
0284             ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
0285                           "access forbidden by rule");
0286         }
0287 
0288         return NGX_HTTP_FORBIDDEN;
0289     }
0290 
0291     return NGX_OK;
0292 }
0293 
0294 
0295 static char *
0296 ngx_http_access_rule(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
0297 {
0298     ngx_http_access_loc_conf_t *alcf = conf;
0299 
0300     ngx_int_t                   rc;
0301     ngx_uint_t                  all;
0302     ngx_str_t                  *value;
0303     ngx_cidr_t                  cidr;
0304     ngx_http_access_rule_t     *rule;
0305 #if (NGX_HAVE_INET6)
0306     ngx_http_access_rule6_t    *rule6;
0307 #endif
0308 #if (NGX_HAVE_UNIX_DOMAIN)
0309     ngx_http_access_rule_un_t  *rule_un;
0310 #endif
0311 
0312     ngx_memzero(&cidr, sizeof(ngx_cidr_t));
0313 
0314     value = cf->args->elts;
0315 
0316     all = (value[1].len == 3 && ngx_strcmp(value[1].data, "all") == 0);
0317 
0318     if (!all) {
0319 
0320 #if (NGX_HAVE_UNIX_DOMAIN)
0321 
0322         if (value[1].len == 5 && ngx_strcmp(value[1].data, "unix:") == 0) {
0323             cidr.family = AF_UNIX;
0324             rc = NGX_OK;
0325 
0326         } else {
0327             rc = ngx_ptocidr(&value[1], &cidr);
0328         }
0329 
0330 #else
0331         rc = ngx_ptocidr(&value[1], &cidr);
0332 #endif
0333 
0334         if (rc == NGX_ERROR) {
0335             ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
0336                          "invalid parameter \"%V\"", &value[1]);
0337             return NGX_CONF_ERROR;
0338         }
0339 
0340         if (rc == NGX_DONE) {
0341             ngx_conf_log_error(NGX_LOG_WARN, cf, 0,
0342                          "low address bits of %V are meaningless", &value[1]);
0343         }
0344     }
0345 
0346     if (cidr.family == AF_INET || all) {
0347 
0348         if (alcf->rules == NULL) {
0349             alcf->rules = ngx_array_create(cf->pool, 4,
0350                                            sizeof(ngx_http_access_rule_t));
0351             if (alcf->rules == NULL) {
0352                 return NGX_CONF_ERROR;
0353             }
0354         }
0355 
0356         rule = ngx_array_push(alcf->rules);
0357         if (rule == NULL) {
0358             return NGX_CONF_ERROR;
0359         }
0360 
0361         rule->mask = cidr.u.in.mask;
0362         rule->addr = cidr.u.in.addr;
0363         rule->deny = (value[0].data[0] == 'd') ? 1 : 0;
0364     }
0365 
0366 #if (NGX_HAVE_INET6)
0367     if (cidr.family == AF_INET6 || all) {
0368 
0369         if (alcf->rules6 == NULL) {
0370             alcf->rules6 = ngx_array_create(cf->pool, 4,
0371                                             sizeof(ngx_http_access_rule6_t));
0372             if (alcf->rules6 == NULL) {
0373                 return NGX_CONF_ERROR;
0374             }
0375         }
0376 
0377         rule6 = ngx_array_push(alcf->rules6);
0378         if (rule6 == NULL) {
0379             return NGX_CONF_ERROR;
0380         }
0381 
0382         rule6->mask = cidr.u.in6.mask;
0383         rule6->addr = cidr.u.in6.addr;
0384         rule6->deny = (value[0].data[0] == 'd') ? 1 : 0;
0385     }
0386 #endif
0387 
0388 #if (NGX_HAVE_UNIX_DOMAIN)
0389     if (cidr.family == AF_UNIX || all) {
0390 
0391         if (alcf->rules_un == NULL) {
0392             alcf->rules_un = ngx_array_create(cf->pool, 1,
0393                                             sizeof(ngx_http_access_rule_un_t));
0394             if (alcf->rules_un == NULL) {
0395                 return NGX_CONF_ERROR;
0396             }
0397         }
0398 
0399         rule_un = ngx_array_push(alcf->rules_un);
0400         if (rule_un == NULL) {
0401             return NGX_CONF_ERROR;
0402         }
0403 
0404         rule_un->deny = (value[0].data[0] == 'd') ? 1 : 0;
0405     }
0406 #endif
0407 
0408     return NGX_CONF_OK;
0409 }
0410 
0411 
0412 static void *
0413 ngx_http_access_create_loc_conf(ngx_conf_t *cf)
0414 {
0415     ngx_http_access_loc_conf_t  *conf;
0416 
0417     conf = ngx_pcalloc(cf->pool, sizeof(ngx_http_access_loc_conf_t));
0418     if (conf == NULL) {
0419         return NULL;
0420     }
0421 
0422     return conf;
0423 }
0424 
0425 
0426 static char *
0427 ngx_http_access_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
0428 {
0429     ngx_http_access_loc_conf_t  *prev = parent;
0430     ngx_http_access_loc_conf_t  *conf = child;
0431 
0432     if (conf->rules == NULL
0433 #if (NGX_HAVE_INET6)
0434         && conf->rules6 == NULL
0435 #endif
0436 #if (NGX_HAVE_UNIX_DOMAIN)
0437         && conf->rules_un == NULL
0438 #endif
0439     ) {
0440         conf->rules = prev->rules;
0441 #if (NGX_HAVE_INET6)
0442         conf->rules6 = prev->rules6;
0443 #endif
0444 #if (NGX_HAVE_UNIX_DOMAIN)
0445         conf->rules_un = prev->rules_un;
0446 #endif
0447     }
0448 
0449     return NGX_CONF_OK;
0450 }
0451 
0452 
0453 static ngx_int_t
0454 ngx_http_access_init(ngx_conf_t *cf)
0455 {
0456     ngx_http_handler_pt        *h;
0457     ngx_http_core_main_conf_t  *cmcf;
0458 
0459     cmcf = ngx_http_conf_get_module_main_conf(cf, ngx_http_core_module);
0460 
0461     h = ngx_array_push(&cmcf->phases[NGX_HTTP_ACCESS_PHASE].handlers);
0462     if (h == NULL) {
0463         return NGX_ERROR;
0464     }
0465 
0466     *h = ngx_http_access_handler;
0467 
0468     return NGX_OK;
0469 }