Back to home page

Nginx displayed by LXR

Source navigation ]
Diff markup ]
Identifier search ]
general search ]
 
 
Version: nginx-1.13.12 ]​[ nginx-1.12.2 ]​

0001 
0002 /*
0003  * Copyright (C) Igor Sysoev
0004  * Copyright (C) Nginx, Inc.
0005  */
0006 
0007 
0008 #include <ngx_config.h>
0009 #include <ngx_core.h>
0010 #include <ngx_stream.h>
0011 
0012 
0013 typedef struct {
0014     in_addr_t         mask;
0015     in_addr_t         addr;
0016     ngx_uint_t        deny;      /* unsigned  deny:1; */
0017 } ngx_stream_access_rule_t;
0018 
0019 #if (NGX_HAVE_INET6)
0020 
0021 typedef struct {
0022     struct in6_addr   addr;
0023     struct in6_addr   mask;
0024     ngx_uint_t        deny;      /* unsigned  deny:1; */
0025 } ngx_stream_access_rule6_t;
0026 
0027 #endif
0028 
0029 #if (NGX_HAVE_UNIX_DOMAIN)
0030 
0031 typedef struct {
0032     ngx_uint_t        deny;      /* unsigned  deny:1; */
0033 } ngx_stream_access_rule_un_t;
0034 
0035 #endif
0036 
0037 typedef struct {
0038     ngx_array_t      *rules;     /* array of ngx_stream_access_rule_t */
0039 #if (NGX_HAVE_INET6)
0040     ngx_array_t      *rules6;    /* array of ngx_stream_access_rule6_t */
0041 #endif
0042 #if (NGX_HAVE_UNIX_DOMAIN)
0043     ngx_array_t      *rules_un;  /* array of ngx_stream_access_rule_un_t */
0044 #endif
0045 } ngx_stream_access_srv_conf_t;
0046 
0047 
0048 static ngx_int_t ngx_stream_access_handler(ngx_stream_session_t *s);
0049 static ngx_int_t ngx_stream_access_inet(ngx_stream_session_t *s,
0050     ngx_stream_access_srv_conf_t *ascf, in_addr_t addr);
0051 #if (NGX_HAVE_INET6)
0052 static ngx_int_t ngx_stream_access_inet6(ngx_stream_session_t *s,
0053     ngx_stream_access_srv_conf_t *ascf, u_char *p);
0054 #endif
0055 #if (NGX_HAVE_UNIX_DOMAIN)
0056 static ngx_int_t ngx_stream_access_unix(ngx_stream_session_t *s,
0057     ngx_stream_access_srv_conf_t *ascf);
0058 #endif
0059 static ngx_int_t ngx_stream_access_found(ngx_stream_session_t *s,
0060     ngx_uint_t deny);
0061 static char *ngx_stream_access_rule(ngx_conf_t *cf, ngx_command_t *cmd,
0062     void *conf);
0063 static void *ngx_stream_access_create_srv_conf(ngx_conf_t *cf);
0064 static char *ngx_stream_access_merge_srv_conf(ngx_conf_t *cf,
0065     void *parent, void *child);
0066 static ngx_int_t ngx_stream_access_init(ngx_conf_t *cf);
0067 
0068 
0069 static ngx_command_t  ngx_stream_access_commands[] = {
0070 
0071     { ngx_string("allow"),
0072       NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1,
0073       ngx_stream_access_rule,
0074       NGX_STREAM_SRV_CONF_OFFSET,
0075       0,
0076       NULL },
0077 
0078     { ngx_string("deny"),
0079       NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1,
0080       ngx_stream_access_rule,
0081       NGX_STREAM_SRV_CONF_OFFSET,
0082       0,
0083       NULL },
0084 
0085       ngx_null_command
0086 };
0087 
0088 
0089 
0090 static ngx_stream_module_t  ngx_stream_access_module_ctx = {
0091     NULL,                                  /* preconfiguration */
0092     ngx_stream_access_init,                /* postconfiguration */
0093 
0094     NULL,                                  /* create main configuration */
0095     NULL,                                  /* init main configuration */
0096 
0097     ngx_stream_access_create_srv_conf,     /* create server configuration */
0098     ngx_stream_access_merge_srv_conf       /* merge server configuration */
0099 };
0100 
0101 
0102 ngx_module_t  ngx_stream_access_module = {
0103     NGX_MODULE_V1,
0104     &ngx_stream_access_module_ctx,         /* module context */
0105     ngx_stream_access_commands,            /* module directives */
0106     NGX_STREAM_MODULE,                     /* module type */
0107     NULL,                                  /* init master */
0108     NULL,                                  /* init module */
0109     NULL,                                  /* init process */
0110     NULL,                                  /* init thread */
0111     NULL,                                  /* exit thread */
0112     NULL,                                  /* exit process */
0113     NULL,                                  /* exit master */
0114     NGX_MODULE_V1_PADDING
0115 };
0116 
0117 
0118 static ngx_int_t
0119 ngx_stream_access_handler(ngx_stream_session_t *s)
0120 {
0121     struct sockaddr_in            *sin;
0122     ngx_stream_access_srv_conf_t  *ascf;
0123 #if (NGX_HAVE_INET6)
0124     u_char                        *p;
0125     in_addr_t                      addr;
0126     struct sockaddr_in6           *sin6;
0127 #endif
0128 
0129     ascf = ngx_stream_get_module_srv_conf(s, ngx_stream_access_module);
0130 
0131     switch (s->connection->sockaddr->sa_family) {
0132 
0133     case AF_INET:
0134         if (ascf->rules) {
0135             sin = (struct sockaddr_in *) s->connection->sockaddr;
0136             return ngx_stream_access_inet(s, ascf, sin->sin_addr.s_addr);
0137         }
0138         break;
0139 
0140 #if (NGX_HAVE_INET6)
0141 
0142     case AF_INET6:
0143         sin6 = (struct sockaddr_in6 *) s->connection->sockaddr;
0144         p = sin6->sin6_addr.s6_addr;
0145 
0146         if (ascf->rules && IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
0147             addr = p[12] << 24;
0148             addr += p[13] << 16;
0149             addr += p[14] << 8;
0150             addr += p[15];
0151             return ngx_stream_access_inet(s, ascf, htonl(addr));
0152         }
0153 
0154         if (ascf->rules6) {
0155             return ngx_stream_access_inet6(s, ascf, p);
0156         }
0157 
0158         break;
0159 
0160 #endif
0161 
0162 #if (NGX_HAVE_UNIX_DOMAIN)
0163 
0164     case AF_UNIX:
0165         if (ascf->rules_un) {
0166             return ngx_stream_access_unix(s, ascf);
0167         }
0168 
0169         break;
0170 
0171 #endif
0172     }
0173 
0174     return NGX_DECLINED;
0175 }
0176 
0177 
0178 static ngx_int_t
0179 ngx_stream_access_inet(ngx_stream_session_t *s,
0180     ngx_stream_access_srv_conf_t *ascf, in_addr_t addr)
0181 {
0182     ngx_uint_t                 i;
0183     ngx_stream_access_rule_t  *rule;
0184 
0185     rule = ascf->rules->elts;
0186     for (i = 0; i < ascf->rules->nelts; i++) {
0187 
0188         ngx_log_debug3(NGX_LOG_DEBUG_STREAM, s->connection->log, 0,
0189                        "access: %08XD %08XD %08XD",
0190                        addr, rule[i].mask, rule[i].addr);
0191 
0192         if ((addr & rule[i].mask) == rule[i].addr) {
0193             return ngx_stream_access_found(s, rule[i].deny);
0194         }
0195     }
0196 
0197     return NGX_DECLINED;
0198 }
0199 
0200 
0201 #if (NGX_HAVE_INET6)
0202 
0203 static ngx_int_t
0204 ngx_stream_access_inet6(ngx_stream_session_t *s,
0205     ngx_stream_access_srv_conf_t *ascf, u_char *p)
0206 {
0207     ngx_uint_t                  n;
0208     ngx_uint_t                  i;
0209     ngx_stream_access_rule6_t  *rule6;
0210 
0211     rule6 = ascf->rules6->elts;
0212     for (i = 0; i < ascf->rules6->nelts; i++) {
0213 
0214 #if (NGX_DEBUG)
0215         {
0216         size_t  cl, ml, al;
0217         u_char  ct[NGX_INET6_ADDRSTRLEN];
0218         u_char  mt[NGX_INET6_ADDRSTRLEN];
0219         u_char  at[NGX_INET6_ADDRSTRLEN];
0220 
0221         cl = ngx_inet6_ntop(p, ct, NGX_INET6_ADDRSTRLEN);
0222         ml = ngx_inet6_ntop(rule6[i].mask.s6_addr, mt, NGX_INET6_ADDRSTRLEN);
0223         al = ngx_inet6_ntop(rule6[i].addr.s6_addr, at, NGX_INET6_ADDRSTRLEN);
0224 
0225         ngx_log_debug6(NGX_LOG_DEBUG_STREAM, s->connection->log, 0,
0226                        "access: %*s %*s %*s", cl, ct, ml, mt, al, at);
0227         }
0228 #endif
0229 
0230         for (n = 0; n < 16; n++) {
0231             if ((p[n] & rule6[i].mask.s6_addr[n]) != rule6[i].addr.s6_addr[n]) {
0232                 goto next;
0233             }
0234         }
0235 
0236         return ngx_stream_access_found(s, rule6[i].deny);
0237 
0238     next:
0239         continue;
0240     }
0241 
0242     return NGX_DECLINED;
0243 }
0244 
0245 #endif
0246 
0247 
0248 #if (NGX_HAVE_UNIX_DOMAIN)
0249 
0250 static ngx_int_t
0251 ngx_stream_access_unix(ngx_stream_session_t *s,
0252     ngx_stream_access_srv_conf_t *ascf)
0253 {
0254     ngx_uint_t                    i;
0255     ngx_stream_access_rule_un_t  *rule_un;
0256 
0257     rule_un = ascf->rules_un->elts;
0258     for (i = 0; i < ascf->rules_un->nelts; i++) {
0259 
0260         /* TODO: check path */
0261         if (1) {
0262             return ngx_stream_access_found(s, rule_un[i].deny);
0263         }
0264     }
0265 
0266     return NGX_DECLINED;
0267 }
0268 
0269 #endif
0270 
0271 
0272 static ngx_int_t
0273 ngx_stream_access_found(ngx_stream_session_t *s, ngx_uint_t deny)
0274 {
0275     if (deny) {
0276         ngx_log_error(NGX_LOG_ERR, s->connection->log, 0,
0277                       "access forbidden by rule");
0278         return NGX_STREAM_FORBIDDEN;
0279     }
0280 
0281     return NGX_OK;
0282 }
0283 
0284 
0285 static char *
0286 ngx_stream_access_rule(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
0287 {
0288     ngx_stream_access_srv_conf_t *ascf = conf;
0289 
0290     ngx_int_t                     rc;
0291     ngx_uint_t                    all;
0292     ngx_str_t                    *value;
0293     ngx_cidr_t                    cidr;
0294     ngx_stream_access_rule_t     *rule;
0295 #if (NGX_HAVE_INET6)
0296     ngx_stream_access_rule6_t    *rule6;
0297 #endif
0298 #if (NGX_HAVE_UNIX_DOMAIN)
0299     ngx_stream_access_rule_un_t  *rule_un;
0300 #endif
0301 
0302     all = 0;
0303     ngx_memzero(&cidr, sizeof(ngx_cidr_t));
0304 
0305     value = cf->args->elts;
0306 
0307     if (value[1].len == 3 && ngx_strcmp(value[1].data, "all") == 0) {
0308         all = 1;
0309 
0310 #if (NGX_HAVE_UNIX_DOMAIN)
0311     } else if (value[1].len == 5 && ngx_strcmp(value[1].data, "unix:") == 0) {
0312         cidr.family = AF_UNIX;
0313 #endif
0314 
0315     } else {
0316         rc = ngx_ptocidr(&value[1], &cidr);
0317 
0318         if (rc == NGX_ERROR) {
0319             ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
0320                          "invalid parameter \"%V\"", &value[1]);
0321             return NGX_CONF_ERROR;
0322         }
0323 
0324         if (rc == NGX_DONE) {
0325             ngx_conf_log_error(NGX_LOG_WARN, cf, 0,
0326                          "low address bits of %V are meaningless", &value[1]);
0327         }
0328     }
0329 
0330     if (cidr.family == AF_INET || all) {
0331 
0332         if (ascf->rules == NULL) {
0333             ascf->rules = ngx_array_create(cf->pool, 4,
0334                                            sizeof(ngx_stream_access_rule_t));
0335             if (ascf->rules == NULL) {
0336                 return NGX_CONF_ERROR;
0337             }
0338         }
0339 
0340         rule = ngx_array_push(ascf->rules);
0341         if (rule == NULL) {
0342             return NGX_CONF_ERROR;
0343         }
0344 
0345         rule->mask = cidr.u.in.mask;
0346         rule->addr = cidr.u.in.addr;
0347         rule->deny = (value[0].data[0] == 'd') ? 1 : 0;
0348     }
0349 
0350 #if (NGX_HAVE_INET6)
0351     if (cidr.family == AF_INET6 || all) {
0352 
0353         if (ascf->rules6 == NULL) {
0354             ascf->rules6 = ngx_array_create(cf->pool, 4,
0355                                             sizeof(ngx_stream_access_rule6_t));
0356             if (ascf->rules6 == NULL) {
0357                 return NGX_CONF_ERROR;
0358             }
0359         }
0360 
0361         rule6 = ngx_array_push(ascf->rules6);
0362         if (rule6 == NULL) {
0363             return NGX_CONF_ERROR;
0364         }
0365 
0366         rule6->mask = cidr.u.in6.mask;
0367         rule6->addr = cidr.u.in6.addr;
0368         rule6->deny = (value[0].data[0] == 'd') ? 1 : 0;
0369     }
0370 #endif
0371 
0372 #if (NGX_HAVE_UNIX_DOMAIN)
0373     if (cidr.family == AF_UNIX || all) {
0374 
0375         if (ascf->rules_un == NULL) {
0376             ascf->rules_un = ngx_array_create(cf->pool, 1,
0377                                           sizeof(ngx_stream_access_rule_un_t));
0378             if (ascf->rules_un == NULL) {
0379                 return NGX_CONF_ERROR;
0380             }
0381         }
0382 
0383         rule_un = ngx_array_push(ascf->rules_un);
0384         if (rule_un == NULL) {
0385             return NGX_CONF_ERROR;
0386         }
0387 
0388         rule_un->deny = (value[0].data[0] == 'd') ? 1 : 0;
0389     }
0390 #endif
0391 
0392     return NGX_CONF_OK;
0393 }
0394 
0395 
0396 static void *
0397 ngx_stream_access_create_srv_conf(ngx_conf_t *cf)
0398 {
0399     ngx_stream_access_srv_conf_t  *conf;
0400 
0401     conf = ngx_pcalloc(cf->pool, sizeof(ngx_stream_access_srv_conf_t));
0402     if (conf == NULL) {
0403         return NULL;
0404     }
0405 
0406     return conf;
0407 }
0408 
0409 
0410 static char *
0411 ngx_stream_access_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
0412 {
0413     ngx_stream_access_srv_conf_t  *prev = parent;
0414     ngx_stream_access_srv_conf_t  *conf = child;
0415 
0416     if (conf->rules == NULL
0417 #if (NGX_HAVE_INET6)
0418         && conf->rules6 == NULL
0419 #endif
0420 #if (NGX_HAVE_UNIX_DOMAIN)
0421         && conf->rules_un == NULL
0422 #endif
0423     ) {
0424         conf->rules = prev->rules;
0425 #if (NGX_HAVE_INET6)
0426         conf->rules6 = prev->rules6;
0427 #endif
0428 #if (NGX_HAVE_UNIX_DOMAIN)
0429         conf->rules_un = prev->rules_un;
0430 #endif
0431     }
0432 
0433     return NGX_CONF_OK;
0434 }
0435 
0436 
0437 static ngx_int_t
0438 ngx_stream_access_init(ngx_conf_t *cf)
0439 {
0440     ngx_stream_handler_pt        *h;
0441     ngx_stream_core_main_conf_t  *cmcf;
0442 
0443     cmcf = ngx_stream_conf_get_module_main_conf(cf, ngx_stream_core_module);
0444 
0445     h = ngx_array_push(&cmcf->phases[NGX_STREAM_ACCESS_PHASE].handlers);
0446     if (h == NULL) {
0447         return NGX_ERROR;
0448     }
0449 
0450     *h = ngx_stream_access_handler;
0451 
0452     return NGX_OK;
0453 }