Back to home page

Nginx displayed by LXR

Source navigation ]
Diff markup ]
Identifier search ]
general search ]
 
 
Version: nginx-1.15.11 ]​[ nginx-1.14.2 ]​

0001 
0002 /*
0003  * Copyright (C) Igor Sysoev
0004  * Copyright (C) Nginx, Inc.
0005  */
0006 
0007 
0008 #include <ngx_config.h>
0009 #include <ngx_core.h>
0010 #include <ngx_http.h>
0011 
0012 
0013 typedef struct {
0014     in_addr_t         mask;
0015     in_addr_t         addr;
0016     ngx_uint_t        deny;      /* unsigned  deny:1; */
0017 } ngx_http_access_rule_t;
0018 
0019 #if (NGX_HAVE_INET6)
0020 
0021 typedef struct {
0022     struct in6_addr   addr;
0023     struct in6_addr   mask;
0024     ngx_uint_t        deny;      /* unsigned  deny:1; */
0025 } ngx_http_access_rule6_t;
0026 
0027 #endif
0028 
0029 #if (NGX_HAVE_UNIX_DOMAIN)
0030 
0031 typedef struct {
0032     ngx_uint_t        deny;      /* unsigned  deny:1; */
0033 } ngx_http_access_rule_un_t;
0034 
0035 #endif
0036 
0037 typedef struct {
0038     ngx_array_t      *rules;     /* array of ngx_http_access_rule_t */
0039 #if (NGX_HAVE_INET6)
0040     ngx_array_t      *rules6;    /* array of ngx_http_access_rule6_t */
0041 #endif
0042 #if (NGX_HAVE_UNIX_DOMAIN)
0043     ngx_array_t      *rules_un;  /* array of ngx_http_access_rule_un_t */
0044 #endif
0045 } ngx_http_access_loc_conf_t;
0046 
0047 
0048 static ngx_int_t ngx_http_access_handler(ngx_http_request_t *r);
0049 static ngx_int_t ngx_http_access_inet(ngx_http_request_t *r,
0050     ngx_http_access_loc_conf_t *alcf, in_addr_t addr);
0051 #if (NGX_HAVE_INET6)
0052 static ngx_int_t ngx_http_access_inet6(ngx_http_request_t *r,
0053     ngx_http_access_loc_conf_t *alcf, u_char *p);
0054 #endif
0055 #if (NGX_HAVE_UNIX_DOMAIN)
0056 static ngx_int_t ngx_http_access_unix(ngx_http_request_t *r,
0057     ngx_http_access_loc_conf_t *alcf);
0058 #endif
0059 static ngx_int_t ngx_http_access_found(ngx_http_request_t *r, ngx_uint_t deny);
0060 static char *ngx_http_access_rule(ngx_conf_t *cf, ngx_command_t *cmd,
0061     void *conf);
0062 static void *ngx_http_access_create_loc_conf(ngx_conf_t *cf);
0063 static char *ngx_http_access_merge_loc_conf(ngx_conf_t *cf,
0064     void *parent, void *child);
0065 static ngx_int_t ngx_http_access_init(ngx_conf_t *cf);
0066 
0067 
0068 static ngx_command_t  ngx_http_access_commands[] = {
0069 
0070     { ngx_string("allow"),
0071       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LMT_CONF
0072                         |NGX_CONF_TAKE1,
0073       ngx_http_access_rule,
0074       NGX_HTTP_LOC_CONF_OFFSET,
0075       0,
0076       NULL },
0077 
0078     { ngx_string("deny"),
0079       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LMT_CONF
0080                         |NGX_CONF_TAKE1,
0081       ngx_http_access_rule,
0082       NGX_HTTP_LOC_CONF_OFFSET,
0083       0,
0084       NULL },
0085 
0086       ngx_null_command
0087 };
0088 
0089 
0090 
0091 static ngx_http_module_t  ngx_http_access_module_ctx = {
0092     NULL,                                  /* preconfiguration */
0093     ngx_http_access_init,                  /* postconfiguration */
0094 
0095     NULL,                                  /* create main configuration */
0096     NULL,                                  /* init main configuration */
0097 
0098     NULL,                                  /* create server configuration */
0099     NULL,                                  /* merge server configuration */
0100 
0101     ngx_http_access_create_loc_conf,       /* create location configuration */
0102     ngx_http_access_merge_loc_conf         /* merge location configuration */
0103 };
0104 
0105 
0106 ngx_module_t  ngx_http_access_module = {
0107     NGX_MODULE_V1,
0108     &ngx_http_access_module_ctx,           /* module context */
0109     ngx_http_access_commands,              /* module directives */
0110     NGX_HTTP_MODULE,                       /* module type */
0111     NULL,                                  /* init master */
0112     NULL,                                  /* init module */
0113     NULL,                                  /* init process */
0114     NULL,                                  /* init thread */
0115     NULL,                                  /* exit thread */
0116     NULL,                                  /* exit process */
0117     NULL,                                  /* exit master */
0118     NGX_MODULE_V1_PADDING
0119 };
0120 
0121 
0122 static ngx_int_t
0123 ngx_http_access_handler(ngx_http_request_t *r)
0124 {
0125     struct sockaddr_in          *sin;
0126     ngx_http_access_loc_conf_t  *alcf;
0127 #if (NGX_HAVE_INET6)
0128     u_char                      *p;
0129     in_addr_t                    addr;
0130     struct sockaddr_in6         *sin6;
0131 #endif
0132 
0133     alcf = ngx_http_get_module_loc_conf(r, ngx_http_access_module);
0134 
0135     switch (r->connection->sockaddr->sa_family) {
0136 
0137     case AF_INET:
0138         if (alcf->rules) {
0139             sin = (struct sockaddr_in *) r->connection->sockaddr;
0140             return ngx_http_access_inet(r, alcf, sin->sin_addr.s_addr);
0141         }
0142         break;
0143 
0144 #if (NGX_HAVE_INET6)
0145 
0146     case AF_INET6:
0147         sin6 = (struct sockaddr_in6 *) r->connection->sockaddr;
0148         p = sin6->sin6_addr.s6_addr;
0149 
0150         if (alcf->rules && IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
0151             addr = p[12] << 24;
0152             addr += p[13] << 16;
0153             addr += p[14] << 8;
0154             addr += p[15];
0155             return ngx_http_access_inet(r, alcf, htonl(addr));
0156         }
0157 
0158         if (alcf->rules6) {
0159             return ngx_http_access_inet6(r, alcf, p);
0160         }
0161 
0162         break;
0163 
0164 #endif
0165 
0166 #if (NGX_HAVE_UNIX_DOMAIN)
0167 
0168     case AF_UNIX:
0169         if (alcf->rules_un) {
0170             return ngx_http_access_unix(r, alcf);
0171         }
0172 
0173         break;
0174 
0175 #endif
0176     }
0177 
0178     return NGX_DECLINED;
0179 }
0180 
0181 
0182 static ngx_int_t
0183 ngx_http_access_inet(ngx_http_request_t *r, ngx_http_access_loc_conf_t *alcf,
0184     in_addr_t addr)
0185 {
0186     ngx_uint_t               i;
0187     ngx_http_access_rule_t  *rule;
0188 
0189     rule = alcf->rules->elts;
0190     for (i = 0; i < alcf->rules->nelts; i++) {
0191 
0192         ngx_log_debug3(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
0193                        "access: %08XD %08XD %08XD",
0194                        addr, rule[i].mask, rule[i].addr);
0195 
0196         if ((addr & rule[i].mask) == rule[i].addr) {
0197             return ngx_http_access_found(r, rule[i].deny);
0198         }
0199     }
0200 
0201     return NGX_DECLINED;
0202 }
0203 
0204 
0205 #if (NGX_HAVE_INET6)
0206 
0207 static ngx_int_t
0208 ngx_http_access_inet6(ngx_http_request_t *r, ngx_http_access_loc_conf_t *alcf,
0209     u_char *p)
0210 {
0211     ngx_uint_t                n;
0212     ngx_uint_t                i;
0213     ngx_http_access_rule6_t  *rule6;
0214 
0215     rule6 = alcf->rules6->elts;
0216     for (i = 0; i < alcf->rules6->nelts; i++) {
0217 
0218 #if (NGX_DEBUG)
0219         {
0220         size_t  cl, ml, al;
0221         u_char  ct[NGX_INET6_ADDRSTRLEN];
0222         u_char  mt[NGX_INET6_ADDRSTRLEN];
0223         u_char  at[NGX_INET6_ADDRSTRLEN];
0224 
0225         cl = ngx_inet6_ntop(p, ct, NGX_INET6_ADDRSTRLEN);
0226         ml = ngx_inet6_ntop(rule6[i].mask.s6_addr, mt, NGX_INET6_ADDRSTRLEN);
0227         al = ngx_inet6_ntop(rule6[i].addr.s6_addr, at, NGX_INET6_ADDRSTRLEN);
0228 
0229         ngx_log_debug6(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
0230                        "access: %*s %*s %*s", cl, ct, ml, mt, al, at);
0231         }
0232 #endif
0233 
0234         for (n = 0; n < 16; n++) {
0235             if ((p[n] & rule6[i].mask.s6_addr[n]) != rule6[i].addr.s6_addr[n]) {
0236                 goto next;
0237             }
0238         }
0239 
0240         return ngx_http_access_found(r, rule6[i].deny);
0241 
0242     next:
0243         continue;
0244     }
0245 
0246     return NGX_DECLINED;
0247 }
0248 
0249 #endif
0250 
0251 
0252 #if (NGX_HAVE_UNIX_DOMAIN)
0253 
0254 static ngx_int_t
0255 ngx_http_access_unix(ngx_http_request_t *r, ngx_http_access_loc_conf_t *alcf)
0256 {
0257     ngx_uint_t                  i;
0258     ngx_http_access_rule_un_t  *rule_un;
0259 
0260     rule_un = alcf->rules_un->elts;
0261     for (i = 0; i < alcf->rules_un->nelts; i++) {
0262 
0263         /* TODO: check path */
0264         if (1) {
0265             return ngx_http_access_found(r, rule_un[i].deny);
0266         }
0267     }
0268 
0269     return NGX_DECLINED;
0270 }
0271 
0272 #endif
0273 
0274 
0275 static ngx_int_t
0276 ngx_http_access_found(ngx_http_request_t *r, ngx_uint_t deny)
0277 {
0278     ngx_http_core_loc_conf_t  *clcf;
0279 
0280     if (deny) {
0281         clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);
0282 
0283         if (clcf->satisfy == NGX_HTTP_SATISFY_ALL) {
0284             ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
0285                           "access forbidden by rule");
0286         }
0287 
0288         return NGX_HTTP_FORBIDDEN;
0289     }
0290 
0291     return NGX_OK;
0292 }
0293 
0294 
0295 static char *
0296 ngx_http_access_rule(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
0297 {
0298     ngx_http_access_loc_conf_t *alcf = conf;
0299 
0300     ngx_int_t                   rc;
0301     ngx_uint_t                  all;
0302     ngx_str_t                  *value;
0303     ngx_cidr_t                  cidr;
0304     ngx_http_access_rule_t     *rule;
0305 #if (NGX_HAVE_INET6)
0306     ngx_http_access_rule6_t    *rule6;
0307 #endif
0308 #if (NGX_HAVE_UNIX_DOMAIN)
0309     ngx_http_access_rule_un_t  *rule_un;
0310 #endif
0311 
0312     all = 0;
0313     ngx_memzero(&cidr, sizeof(ngx_cidr_t));
0314 
0315     value = cf->args->elts;
0316 
0317     if (value[1].len == 3 && ngx_strcmp(value[1].data, "all") == 0) {
0318         all = 1;
0319 
0320 #if (NGX_HAVE_UNIX_DOMAIN)
0321     } else if (value[1].len == 5 && ngx_strcmp(value[1].data, "unix:") == 0) {
0322         cidr.family = AF_UNIX;
0323 #endif
0324 
0325     } else {
0326         rc = ngx_ptocidr(&value[1], &cidr);
0327 
0328         if (rc == NGX_ERROR) {
0329             ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
0330                          "invalid parameter \"%V\"", &value[1]);
0331             return NGX_CONF_ERROR;
0332         }
0333 
0334         if (rc == NGX_DONE) {
0335             ngx_conf_log_error(NGX_LOG_WARN, cf, 0,
0336                          "low address bits of %V are meaningless", &value[1]);
0337         }
0338     }
0339 
0340     if (cidr.family == AF_INET || all) {
0341 
0342         if (alcf->rules == NULL) {
0343             alcf->rules = ngx_array_create(cf->pool, 4,
0344                                            sizeof(ngx_http_access_rule_t));
0345             if (alcf->rules == NULL) {
0346                 return NGX_CONF_ERROR;
0347             }
0348         }
0349 
0350         rule = ngx_array_push(alcf->rules);
0351         if (rule == NULL) {
0352             return NGX_CONF_ERROR;
0353         }
0354 
0355         rule->mask = cidr.u.in.mask;
0356         rule->addr = cidr.u.in.addr;
0357         rule->deny = (value[0].data[0] == 'd') ? 1 : 0;
0358     }
0359 
0360 #if (NGX_HAVE_INET6)
0361     if (cidr.family == AF_INET6 || all) {
0362 
0363         if (alcf->rules6 == NULL) {
0364             alcf->rules6 = ngx_array_create(cf->pool, 4,
0365                                             sizeof(ngx_http_access_rule6_t));
0366             if (alcf->rules6 == NULL) {
0367                 return NGX_CONF_ERROR;
0368             }
0369         }
0370 
0371         rule6 = ngx_array_push(alcf->rules6);
0372         if (rule6 == NULL) {
0373             return NGX_CONF_ERROR;
0374         }
0375 
0376         rule6->mask = cidr.u.in6.mask;
0377         rule6->addr = cidr.u.in6.addr;
0378         rule6->deny = (value[0].data[0] == 'd') ? 1 : 0;
0379     }
0380 #endif
0381 
0382 #if (NGX_HAVE_UNIX_DOMAIN)
0383     if (cidr.family == AF_UNIX || all) {
0384 
0385         if (alcf->rules_un == NULL) {
0386             alcf->rules_un = ngx_array_create(cf->pool, 1,
0387                                             sizeof(ngx_http_access_rule_un_t));
0388             if (alcf->rules_un == NULL) {
0389                 return NGX_CONF_ERROR;
0390             }
0391         }
0392 
0393         rule_un = ngx_array_push(alcf->rules_un);
0394         if (rule_un == NULL) {
0395             return NGX_CONF_ERROR;
0396         }
0397 
0398         rule_un->deny = (value[0].data[0] == 'd') ? 1 : 0;
0399     }
0400 #endif
0401 
0402     return NGX_CONF_OK;
0403 }
0404 
0405 
0406 static void *
0407 ngx_http_access_create_loc_conf(ngx_conf_t *cf)
0408 {
0409     ngx_http_access_loc_conf_t  *conf;
0410 
0411     conf = ngx_pcalloc(cf->pool, sizeof(ngx_http_access_loc_conf_t));
0412     if (conf == NULL) {
0413         return NULL;
0414     }
0415 
0416     return conf;
0417 }
0418 
0419 
0420 static char *
0421 ngx_http_access_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
0422 {
0423     ngx_http_access_loc_conf_t  *prev = parent;
0424     ngx_http_access_loc_conf_t  *conf = child;
0425 
0426     if (conf->rules == NULL
0427 #if (NGX_HAVE_INET6)
0428         && conf->rules6 == NULL
0429 #endif
0430 #if (NGX_HAVE_UNIX_DOMAIN)
0431         && conf->rules_un == NULL
0432 #endif
0433     ) {
0434         conf->rules = prev->rules;
0435 #if (NGX_HAVE_INET6)
0436         conf->rules6 = prev->rules6;
0437 #endif
0438 #if (NGX_HAVE_UNIX_DOMAIN)
0439         conf->rules_un = prev->rules_un;
0440 #endif
0441     }
0442 
0443     return NGX_CONF_OK;
0444 }
0445 
0446 
0447 static ngx_int_t
0448 ngx_http_access_init(ngx_conf_t *cf)
0449 {
0450     ngx_http_handler_pt        *h;
0451     ngx_http_core_main_conf_t  *cmcf;
0452 
0453     cmcf = ngx_http_conf_get_module_main_conf(cf, ngx_http_core_module);
0454 
0455     h = ngx_array_push(&cmcf->phases[NGX_HTTP_ACCESS_PHASE].handlers);
0456     if (h == NULL) {
0457         return NGX_ERROR;
0458     }
0459 
0460     *h = ngx_http_access_handler;
0461 
0462     return NGX_OK;
0463 }