Back to home page

Nginx displayed by LXR

Source navigation ]
Diff markup ]
Identifier search ]
general search ]
 
 
Version: nginx-1.13.12 ]​[ nginx-1.12.2 ]​

0001 
0002 /*
0003  * Copyright (C) Igor Sysoev
0004  * Copyright (C) Nginx, Inc.
0005  */
0006 
0007 
0008 #include <ngx_config.h>
0009 #include <ngx_core.h>
0010 #include <ngx_stream.h>
0011 
0012 
0013 typedef struct {
0014     in_addr_t         mask;
0015     in_addr_t         addr;
0016     ngx_uint_t        deny;      /* unsigned  deny:1; */
0017 } ngx_stream_access_rule_t;
0018 
0019 #if (NGX_HAVE_INET6)
0020 
0021 typedef struct {
0022     struct in6_addr   addr;
0023     struct in6_addr   mask;
0024     ngx_uint_t        deny;      /* unsigned  deny:1; */
0025 } ngx_stream_access_rule6_t;
0026 
0027 #endif
0028 
0029 #if (NGX_HAVE_UNIX_DOMAIN)
0030 
0031 typedef struct {
0032     ngx_uint_t        deny;      /* unsigned  deny:1; */
0033 } ngx_stream_access_rule_un_t;
0034 
0035 #endif
0036 
0037 typedef struct {
0038     ngx_array_t      *rules;     /* array of ngx_stream_access_rule_t */
0039 #if (NGX_HAVE_INET6)
0040     ngx_array_t      *rules6;    /* array of ngx_stream_access_rule6_t */
0041 #endif
0042 #if (NGX_HAVE_UNIX_DOMAIN)
0043     ngx_array_t      *rules_un;  /* array of ngx_stream_access_rule_un_t */
0044 #endif
0045 } ngx_stream_access_srv_conf_t;
0046 
0047 
0048 static ngx_int_t ngx_stream_access_handler(ngx_stream_session_t *s);
0049 static ngx_int_t ngx_stream_access_inet(ngx_stream_session_t *s,
0050     ngx_stream_access_srv_conf_t *ascf, in_addr_t addr);
0051 #if (NGX_HAVE_INET6)
0052 static ngx_int_t ngx_stream_access_inet6(ngx_stream_session_t *s,
0053     ngx_stream_access_srv_conf_t *ascf, u_char *p);
0054 #endif
0055 #if (NGX_HAVE_UNIX_DOMAIN)
0056 static ngx_int_t ngx_stream_access_unix(ngx_stream_session_t *s,
0057     ngx_stream_access_srv_conf_t *ascf);
0058 #endif
0059 static ngx_int_t ngx_stream_access_found(ngx_stream_session_t *s,
0060     ngx_uint_t deny);
0061 static char *ngx_stream_access_rule(ngx_conf_t *cf, ngx_command_t *cmd,
0062     void *conf);
0063 static void *ngx_stream_access_create_srv_conf(ngx_conf_t *cf);
0064 static char *ngx_stream_access_merge_srv_conf(ngx_conf_t *cf,
0065     void *parent, void *child);
0066 static ngx_int_t ngx_stream_access_init(ngx_conf_t *cf);
0067 
0068 
0069 static ngx_command_t  ngx_stream_access_commands[] = {
0070 
0071     { ngx_string("allow"),
0072       NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1,
0073       ngx_stream_access_rule,
0074       NGX_STREAM_SRV_CONF_OFFSET,
0075       0,
0076       NULL },
0077 
0078     { ngx_string("deny"),
0079       NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1,
0080       ngx_stream_access_rule,
0081       NGX_STREAM_SRV_CONF_OFFSET,
0082       0,
0083       NULL },
0084 
0085       ngx_null_command
0086 };
0087 
0088 
0089 
0090 static ngx_stream_module_t  ngx_stream_access_module_ctx = {
0091     NULL,                                  /* preconfiguration */
0092     ngx_stream_access_init,                /* postconfiguration */
0093 
0094     NULL,                                  /* create main configuration */
0095     NULL,                                  /* init main configuration */
0096 
0097     ngx_stream_access_create_srv_conf,     /* create server configuration */
0098     ngx_stream_access_merge_srv_conf       /* merge server configuration */
0099 };
0100 
0101 
0102 ngx_module_t  ngx_stream_access_module = {
0103     NGX_MODULE_V1,
0104     &ngx_stream_access_module_ctx,         /* module context */
0105     ngx_stream_access_commands,            /* module directives */
0106     NGX_STREAM_MODULE,                     /* module type */
0107     NULL,                                  /* init master */
0108     NULL,                                  /* init module */
0109     NULL,                                  /* init process */
0110     NULL,                                  /* init thread */
0111     NULL,                                  /* exit thread */
0112     NULL,                                  /* exit process */
0113     NULL,                                  /* exit master */
0114     NGX_MODULE_V1_PADDING
0115 };
0116 
0117 
0118 static ngx_int_t
0119 ngx_stream_access_handler(ngx_stream_session_t *s)
0120 {
0121     struct sockaddr_in            *sin;
0122     ngx_stream_access_srv_conf_t  *ascf;
0123 #if (NGX_HAVE_INET6)
0124     u_char                        *p;
0125     in_addr_t                      addr;
0126     struct sockaddr_in6           *sin6;
0127 #endif
0128 
0129     ascf = ngx_stream_get_module_srv_conf(s, ngx_stream_access_module);
0130 
0131     switch (s->connection->sockaddr->sa_family) {
0132 
0133     case AF_INET:
0134         if (ascf->rules) {
0135             sin = (struct sockaddr_in *) s->connection->sockaddr;
0136             return ngx_stream_access_inet(s, ascf, sin->sin_addr.s_addr);
0137         }
0138         break;
0139 
0140 #if (NGX_HAVE_INET6)
0141 
0142     case AF_INET6:
0143         sin6 = (struct sockaddr_in6 *) s->connection->sockaddr;
0144         p = sin6->sin6_addr.s6_addr;
0145 
0146         if (ascf->rules && IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
0147             addr = p[12] << 24;
0148             addr += p[13] << 16;
0149             addr += p[14] << 8;
0150             addr += p[15];
0151             return ngx_stream_access_inet(s, ascf, htonl(addr));
0152         }
0153 
0154         if (ascf->rules6) {
0155             return ngx_stream_access_inet6(s, ascf, p);
0156         }
0157 
0158         break;
0159 
0160 #endif
0161 
0162 #if (NGX_HAVE_UNIX_DOMAIN)
0163 
0164     case AF_UNIX:
0165         if (ascf->rules_un) {
0166             return ngx_stream_access_unix(s, ascf);
0167         }
0168 
0169         break;
0170 
0171 #endif
0172     }
0173 
0174     return NGX_DECLINED;
0175 }
0176 
0177 
0178 static ngx_int_t
0179 ngx_stream_access_inet(ngx_stream_session_t *s,
0180     ngx_stream_access_srv_conf_t *ascf, in_addr_t addr)
0181 {
0182     ngx_uint_t                 i;
0183     ngx_stream_access_rule_t  *rule;
0184 
0185     rule = ascf->rules->elts;
0186     for (i = 0; i < ascf->rules->nelts; i++) {
0187 
0188         ngx_log_debug3(NGX_LOG_DEBUG_STREAM, s->connection->log, 0,
0189                        "access: %08XD %08XD %08XD",
0190                        addr, rule[i].mask, rule[i].addr);
0191 
0192         if ((addr & rule[i].mask) == rule[i].addr) {
0193             return ngx_stream_access_found(s, rule[i].deny);
0194         }
0195     }
0196 
0197     return NGX_DECLINED;
0198 }
0199 
0200 
0201 #if (NGX_HAVE_INET6)
0202 
0203 static ngx_int_t
0204 ngx_stream_access_inet6(ngx_stream_session_t *s,
0205     ngx_stream_access_srv_conf_t *ascf, u_char *p)
0206 {
0207     ngx_uint_t                  n;
0208     ngx_uint_t                  i;
0209     ngx_stream_access_rule6_t  *rule6;
0210 
0211     rule6 = ascf->rules6->elts;
0212     for (i = 0; i < ascf->rules6->nelts; i++) {
0213 
0214 #if (NGX_DEBUG)
0215         {
0216         size_t  cl, ml, al;
0217         u_char  ct[NGX_INET6_ADDRSTRLEN];
0218         u_char  mt[NGX_INET6_ADDRSTRLEN];
0219         u_char  at[NGX_INET6_ADDRSTRLEN];
0220 
0221         cl = ngx_inet6_ntop(p, ct, NGX_INET6_ADDRSTRLEN);
0222         ml = ngx_inet6_ntop(rule6[i].mask.s6_addr, mt, NGX_INET6_ADDRSTRLEN);
0223         al = ngx_inet6_ntop(rule6[i].addr.s6_addr, at, NGX_INET6_ADDRSTRLEN);
0224 
0225         ngx_log_debug6(NGX_LOG_DEBUG_STREAM, s->connection->log, 0,
0226                        "access: %*s %*s %*s", cl, ct, ml, mt, al, at);
0227         }
0228 #endif
0229 
0230         for (n = 0; n < 16; n++) {
0231             if ((p[n] & rule6[i].mask.s6_addr[n]) != rule6[i].addr.s6_addr[n]) {
0232                 goto next;
0233             }
0234         }
0235 
0236         return ngx_stream_access_found(s, rule6[i].deny);
0237 
0238     next:
0239         continue;
0240     }
0241 
0242     return NGX_DECLINED;
0243 }
0244 
0245 #endif
0246 
0247 
0248 #if (NGX_HAVE_UNIX_DOMAIN)
0249 
0250 static ngx_int_t
0251 ngx_stream_access_unix(ngx_stream_session_t *s,
0252     ngx_stream_access_srv_conf_t *ascf)
0253 {
0254     ngx_uint_t                    i;
0255     ngx_stream_access_rule_un_t  *rule_un;
0256 
0257     rule_un = ascf->rules_un->elts;
0258     for (i = 0; i < ascf->rules_un->nelts; i++) {
0259 
0260         /* TODO: check path */
0261         if (1) {
0262             return ngx_stream_access_found(s, rule_un[i].deny);
0263         }
0264     }
0265 
0266     return NGX_DECLINED;
0267 }
0268 
0269 #endif
0270 
0271 
0272 static ngx_int_t
0273 ngx_stream_access_found(ngx_stream_session_t *s, ngx_uint_t deny)
0274 {
0275     if (deny) {
0276         ngx_log_error(NGX_LOG_ERR, s->connection->log, 0,
0277                       "access forbidden by rule");
0278         return NGX_STREAM_FORBIDDEN;
0279     }
0280 
0281     return NGX_OK;
0282 }
0283 
0284 
0285 static char *
0286 ngx_stream_access_rule(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
0287 {
0288     ngx_stream_access_srv_conf_t *ascf = conf;
0289 
0290     ngx_int_t                     rc;
0291     ngx_uint_t                    all;
0292     ngx_str_t                    *value;
0293     ngx_cidr_t                    cidr;
0294     ngx_stream_access_rule_t     *rule;
0295 #if (NGX_HAVE_INET6)
0296     ngx_stream_access_rule6_t    *rule6;
0297 #endif
0298 #if (NGX_HAVE_UNIX_DOMAIN)
0299     ngx_stream_access_rule_un_t  *rule_un;
0300 #endif
0301 
0302     ngx_memzero(&cidr, sizeof(ngx_cidr_t));
0303 
0304     value = cf->args->elts;
0305 
0306     all = (value[1].len == 3 && ngx_strcmp(value[1].data, "all") == 0);
0307 
0308     if (!all) {
0309 
0310 #if (NGX_HAVE_UNIX_DOMAIN)
0311 
0312         if (value[1].len == 5 && ngx_strcmp(value[1].data, "unix:") == 0) {
0313             cidr.family = AF_UNIX;
0314             rc = NGX_OK;
0315 
0316         } else {
0317             rc = ngx_ptocidr(&value[1], &cidr);
0318         }
0319 
0320 #else
0321         rc = ngx_ptocidr(&value[1], &cidr);
0322 #endif
0323 
0324         if (rc == NGX_ERROR) {
0325             ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
0326                          "invalid parameter \"%V\"", &value[1]);
0327             return NGX_CONF_ERROR;
0328         }
0329 
0330         if (rc == NGX_DONE) {
0331             ngx_conf_log_error(NGX_LOG_WARN, cf, 0,
0332                          "low address bits of %V are meaningless", &value[1]);
0333         }
0334     }
0335 
0336     if (cidr.family == AF_INET || all) {
0337 
0338         if (ascf->rules == NULL) {
0339             ascf->rules = ngx_array_create(cf->pool, 4,
0340                                            sizeof(ngx_stream_access_rule_t));
0341             if (ascf->rules == NULL) {
0342                 return NGX_CONF_ERROR;
0343             }
0344         }
0345 
0346         rule = ngx_array_push(ascf->rules);
0347         if (rule == NULL) {
0348             return NGX_CONF_ERROR;
0349         }
0350 
0351         rule->mask = cidr.u.in.mask;
0352         rule->addr = cidr.u.in.addr;
0353         rule->deny = (value[0].data[0] == 'd') ? 1 : 0;
0354     }
0355 
0356 #if (NGX_HAVE_INET6)
0357     if (cidr.family == AF_INET6 || all) {
0358 
0359         if (ascf->rules6 == NULL) {
0360             ascf->rules6 = ngx_array_create(cf->pool, 4,
0361                                             sizeof(ngx_stream_access_rule6_t));
0362             if (ascf->rules6 == NULL) {
0363                 return NGX_CONF_ERROR;
0364             }
0365         }
0366 
0367         rule6 = ngx_array_push(ascf->rules6);
0368         if (rule6 == NULL) {
0369             return NGX_CONF_ERROR;
0370         }
0371 
0372         rule6->mask = cidr.u.in6.mask;
0373         rule6->addr = cidr.u.in6.addr;
0374         rule6->deny = (value[0].data[0] == 'd') ? 1 : 0;
0375     }
0376 #endif
0377 
0378 #if (NGX_HAVE_UNIX_DOMAIN)
0379     if (cidr.family == AF_UNIX || all) {
0380 
0381         if (ascf->rules_un == NULL) {
0382             ascf->rules_un = ngx_array_create(cf->pool, 1,
0383                                           sizeof(ngx_stream_access_rule_un_t));
0384             if (ascf->rules_un == NULL) {
0385                 return NGX_CONF_ERROR;
0386             }
0387         }
0388 
0389         rule_un = ngx_array_push(ascf->rules_un);
0390         if (rule_un == NULL) {
0391             return NGX_CONF_ERROR;
0392         }
0393 
0394         rule_un->deny = (value[0].data[0] == 'd') ? 1 : 0;
0395     }
0396 #endif
0397 
0398     return NGX_CONF_OK;
0399 }
0400 
0401 
0402 static void *
0403 ngx_stream_access_create_srv_conf(ngx_conf_t *cf)
0404 {
0405     ngx_stream_access_srv_conf_t  *conf;
0406 
0407     conf = ngx_pcalloc(cf->pool, sizeof(ngx_stream_access_srv_conf_t));
0408     if (conf == NULL) {
0409         return NULL;
0410     }
0411 
0412     return conf;
0413 }
0414 
0415 
0416 static char *
0417 ngx_stream_access_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
0418 {
0419     ngx_stream_access_srv_conf_t  *prev = parent;
0420     ngx_stream_access_srv_conf_t  *conf = child;
0421 
0422     if (conf->rules == NULL
0423 #if (NGX_HAVE_INET6)
0424         && conf->rules6 == NULL
0425 #endif
0426 #if (NGX_HAVE_UNIX_DOMAIN)
0427         && conf->rules_un == NULL
0428 #endif
0429     ) {
0430         conf->rules = prev->rules;
0431 #if (NGX_HAVE_INET6)
0432         conf->rules6 = prev->rules6;
0433 #endif
0434 #if (NGX_HAVE_UNIX_DOMAIN)
0435         conf->rules_un = prev->rules_un;
0436 #endif
0437     }
0438 
0439     return NGX_CONF_OK;
0440 }
0441 
0442 
0443 static ngx_int_t
0444 ngx_stream_access_init(ngx_conf_t *cf)
0445 {
0446     ngx_stream_handler_pt        *h;
0447     ngx_stream_core_main_conf_t  *cmcf;
0448 
0449     cmcf = ngx_stream_conf_get_module_main_conf(cf, ngx_stream_core_module);
0450 
0451     h = ngx_array_push(&cmcf->phases[NGX_STREAM_ACCESS_PHASE].handlers);
0452     if (h == NULL) {
0453         return NGX_ERROR;
0454     }
0455 
0456     *h = ngx_stream_access_handler;
0457 
0458     return NGX_OK;
0459 }