acl.h File Reference

Access Control of various sorts. More...

#include "asterisk/network.h"
#include "asterisk/io.h"

Include dependency graph for acl.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Data Structures
struct	ast_ha
	internal representation of acl entries In principle user applications would have no need for this, but there is sometimes a need to extract individual items, e.g. to print them, and rather than defining iterators to navigate the list, and an externally visible 'struct ast_ha_entry', at least in the short term it is more convenient to make the whole thing public and let users play with them. More...
Defines
#define	AST_SENSE_ALLOW   1
#define	AST_SENSE_DENY   0
Functions
struct ast_ha *	ast_append_ha (const char *sense, const char *stuff, struct ast_ha *path, int *error)
	Append ACL entry to host access list.
int	ast_apply_ha (struct ast_ha *ha, struct sockaddr_in *sin)
	Check IP address with host access list.
void	ast_copy_ha (const struct ast_ha *from, struct ast_ha *to)
	Copy ha structure.
struct ast_ha *	ast_duplicate_ha_list (struct ast_ha *original)
	Copy host access list.
int	ast_find_ourip (struct in_addr *ourip, struct sockaddr_in bindaddr)
void	ast_free_ha (struct ast_ha *ha)
	Free host access list.
int	ast_get_ip (struct sockaddr_in *sin, const char *value)
int	ast_get_ip_or_srv (struct sockaddr_in *sin, const char *value, const char *service)
int	ast_ouraddrfor (struct in_addr *them, struct in_addr *us)
int	ast_str2cos (const char *value, unsigned int *cos)
int	ast_str2tos (const char *value, unsigned int *tos)
const char *	ast_tos2str (unsigned int tos)

---

Detailed Description

Access Control of various sorts.

Definition in file acl.h.

---

Define Documentation

#define AST_SENSE_ALLOW   1

Definition at line 35 of file acl.h.

Referenced by ast_append_ha(), ast_apply_ha(), ast_sip_ouraddrfor(), and parse_register_contact().

#define AST_SENSE_DENY   0

Definition at line 34 of file acl.h.

Referenced by ast_append_ha().

---

Function Documentation

struct ast_ha* ast_append_ha	(	const char *	sense,
		const char *	stuff,
		struct ast_ha *	path,
		int *	error
	)			[read]

Append ACL entry to host access list.

Definition at line 272 of file acl.c.

References ast_debug, ast_free, ast_inet_ntoa(), ast_log(), ast_malloc, AST_SENSE_ALLOW, AST_SENSE_DENY, LOG_WARNING, ast_ha::netaddr, ast_ha::netmask, ast_ha::next, and ast_ha::sense.

Referenced by __init_manager(), add_calltoken_ignore(), build_callno_limits(), build_device(), build_gateway(), build_peer(), build_user(), config_parse_variables(), and reload_config().

{
   struct ast_ha *ha;
   char *nm;
   struct ast_ha *prev = NULL;
   struct ast_ha *ret;
   int x;
   char *tmp = ast_strdupa(stuff);

   ret = path;
   while (path) {
      prev = path;
      path = path->next;
   }

   if (!(ha = ast_malloc(sizeof(*ha)))) {
      return ret;
   }

   if (!(nm = strchr(tmp, '/'))) {
      /* assume /32. Yes, htonl does not do anything for this particular mask
         but we better use it to show we remember about byte order */
      ha->netmask.s_addr = htonl(0xFFFFFFFF);
   } else {
      *nm = '\0';
      nm++;

      if (!strchr(nm, '.')) {
         if ((sscanf(nm, "%30d", &x) == 1) && (x >= 0) && (x <= 32)) {
            if (x == 0) {
               /* This is special-cased to prevent unpredictable
                * behavior of shifting left 32 bits
                */
               ha->netmask.s_addr = 0;
            } else {
               ha->netmask.s_addr = htonl(0xFFFFFFFF << (32 - x));
            }
         } else {
            ast_log(LOG_WARNING, "Invalid CIDR in %s\n", stuff);
            ast_free(ha);
            if (error) {
               *error = 1;
            }
            return ret;
         }
      } else if (!inet_aton(nm, &ha->netmask)) {
         ast_log(LOG_WARNING, "Invalid mask in %s\n", stuff);
         ast_free(ha);
         if (error) {
            *error = 1;
         }
         return ret;
      }
   }

   if (!inet_aton(tmp, &ha->netaddr)) {
      ast_log(LOG_WARNING, "Invalid IP address in %s\n", stuff);
      ast_free(ha);
      if (error) {
         *error = 1;
      }
      return ret;
   }

   ha->netaddr.s_addr &= ha->netmask.s_addr;

   ha->sense = strncasecmp(sense, "p", 1) ? AST_SENSE_DENY : AST_SENSE_ALLOW;

   ha->next = NULL;
   if (prev) {
      prev->next = ha;
   } else {
      ret = ha;
   }

   ast_debug(1, "%s/%s sense %d appended to acl for peer\n", ast_strdupa(ast_inet_ntoa(ha->netaddr)), ast_strdupa(ast_inet_ntoa(ha->netmask)), ha->sense);

   return ret;
}

int ast_apply_ha	(	struct ast_ha *	ha,
		struct sockaddr_in *	sin
	)

Check IP address with host access list.

Definition at line 352 of file acl.c.

References ast_copy_string(), ast_debug, ast_inet_ntoa(), AST_SENSE_ALLOW, ast_ha::netaddr, ast_ha::netmask, ast_ha::next, and ast_ha::sense.

Referenced by ast_sip_ouraddrfor(), authenticate(), check_access(), check_peer_ok(), parse_register_contact(), register_verify(), and skinny_register().

{
   /* Start optimistic */
   int res = AST_SENSE_ALLOW;
   while (ha) {
#if 0 /* debugging code */
      char iabuf[INET_ADDRSTRLEN];
      char iabuf2[INET_ADDRSTRLEN];
      /* DEBUG */
      ast_copy_string(iabuf, ast_inet_ntoa(sin->sin_addr), sizeof(iabuf));
      ast_copy_string(iabuf2, ast_inet_ntoa(ha->netaddr), sizeof(iabuf2));
      ast_debug(1, "##### Testing %s with %s\n", iabuf, iabuf2);
#endif
      /* For each rule, if this address and the netmask = the net address
         apply the current rule */
      if ((sin->sin_addr.s_addr & ha->netmask.s_addr) == ha->netaddr.s_addr) {
         res = ha->sense;
      }
      ha = ha->next;
   }
   return res;
}

void ast_copy_ha	(	const struct ast_ha *	from,
		struct ast_ha *	to
	)

Copy ha structure.

Definition at line 228 of file acl.c.

References ast_ha::netaddr, ast_ha::netmask, and ast_ha::sense.

Referenced by add_calltoken_ignore(), ast_duplicate_ha(), and build_callno_limits().

{
   memcpy(&to->netaddr, &from->netaddr, sizeof(from->netaddr));
   memcpy(&to->netmask, &from->netmask, sizeof(from->netmask));
   to->sense = from->sense;
}

struct ast_ha* ast_duplicate_ha_list

(

struct ast_ha *

original

)

[read]

Copy host access list.

Definition at line 250 of file acl.c.

References ast_duplicate_ha(), and ast_ha::next.

{
   struct ast_ha *start = original;
   struct ast_ha *ret = NULL;
   struct ast_ha *current, *prev = NULL;

   while (start) {
      current = ast_duplicate_ha(start);  /* Create copy of this object */
      if (prev) {
         prev->next = current;           /* Link previous to this object */
      }

      if (!ret) {
         ret = current;                  /* Save starting point */
      }

      start = start->next;                /* Go to next object */
      prev = current;                     /* Save pointer to this object */
   }
   return ret;                             /* Return start of list */
}

int ast_find_ourip	(	struct in_addr *	ourip,
		struct sockaddr_in	bindaddr
	)

Definition at line 511 of file acl.c.

References ast_debug, ast_gethostbyname(), ast_log(), ast_ouraddrfor(), get_local_address(), hp, LOG_WARNING, and ourhost.

Referenced by __oh323_rtp_create(), gtalk_create_candidates(), jingle_create_candidates(), load_module(), and reload_config().

{
   char ourhost[MAXHOSTNAMELEN] = "";
   struct ast_hostent ahp;
   struct hostent *hp;
   struct in_addr saddr;

   /* just use the bind address if it is nonzero */
   if (ntohl(bindaddr.sin_addr.s_addr)) {
      memcpy(ourip, &bindaddr.sin_addr, sizeof(*ourip));
      ast_debug(3, "Attached to given IP address\n");
      return 0;
   }
   /* try to use our hostname */
   if (gethostname(ourhost, sizeof(ourhost) - 1)) {
      ast_log(LOG_WARNING, "Unable to get hostname\n");
   } else {
      if ((hp = ast_gethostbyname(ourhost, &ahp))) {
         memcpy(ourip, hp->h_addr, sizeof(*ourip));
         ast_debug(3, "Found one IP address based on local hostname %s.\n", ourhost);
         return 0;
      }
   }
   ast_debug(3, "Trying to check A.ROOT-SERVERS.NET and get our IP address for that connection\n");
   /* A.ROOT-SERVERS.NET. */
   if (inet_aton("198.41.0.4", &saddr) && !ast_ouraddrfor(&saddr, ourip)) {
      return 0;
   }
   return get_local_address(ourip);
}

void ast_free_ha

(

struct ast_ha *

ha

)

Free host access list.

Definition at line 217 of file acl.c.

References ast_free, and ast_ha::next.

Referenced by __init_manager(), add_calltoken_ignore(), build_callno_limits(), build_peer(), build_user(), destroy_gateway(), oh323_destroy_peer(), oh323_destroy_user(), peer_destructor(), reload_config(), sip_destroy_peer(), unload_module(), and user_destructor().

{
   struct ast_ha *hal;
   while (ha) {
      hal = ha;
      ha = ha->next;
      ast_free(hal);
   }
}

int ast_get_ip	(	struct sockaddr_in *	sin,
		const char *	value
	)

Definition at line 476 of file acl.c.

References ast_get_ip_or_srv().

Referenced by build_gateway(), build_peer(), build_user(), config_parse_variables(), and peer_set_srcaddr().

{
   return ast_get_ip_or_srv(sin, value, NULL);
}

int ast_get_ip_or_srv	(	struct sockaddr_in *	sin,
		const char *	value,
		const char *	service
	)

Definition at line 375 of file acl.c.

References ast_get_srv(), ast_gethostbyname(), ast_log(), hp, and LOG_WARNING.

Referenced by ast_dnsmgr_lookup(), ast_get_ip(), create_addr(), dnsmgr_refresh(), and proxy_update().

{
   struct hostent *hp;
   struct ast_hostent ahp;
   char srv[256];
   char host[256];
   int tportno = ntohs(sin->sin_port);
   if (service) {
      snprintf(srv, sizeof(srv), "%s.%s", service, value);
      if (ast_get_srv(NULL, host, sizeof(host), &tportno, srv) > 0) {
         sin->sin_port = htons(tportno);
         value = host;
      }
   }
   if ((hp = ast_gethostbyname(value, &ahp))) {
      memcpy(&sin->sin_addr, hp->h_addr, sizeof(sin->sin_addr));
   } else {
      ast_log(LOG_WARNING, "Unable to lookup '%s'\n", value);
      return -1;
   }
   return 0;
}

int ast_ouraddrfor	(	struct in_addr *	them,
		struct in_addr *	us
	)

Definition at line 481 of file acl.c.

References ast_debug, ast_log(), LOG_ERROR, LOG_WARNING, and s.

Referenced by ast_find_ourip(), ast_sip_ouraddrfor(), build_gateway(), and find_subchannel_and_lock().

{
   int s;
   struct sockaddr_in sin;
   socklen_t slen;

   if ((s = socket(PF_INET, SOCK_DGRAM, 0)) < 0) {
      ast_log(LOG_ERROR, "Cannot create socket\n");
      return -1;
   }
   sin.sin_family = AF_INET;
   sin.sin_port = htons(5060);
   sin.sin_addr = *them;
   if (connect(s, (struct sockaddr *)&sin, sizeof(sin))) {
      ast_log(LOG_WARNING, "Cannot connect\n");
      close(s);
      return -1;
   }
   slen = sizeof(sin);
   if (getsockname(s, (struct sockaddr *)&sin, &slen)) {
      ast_log(LOG_WARNING, "Cannot get socket name\n");
      close(s);
      return -1;
   }
   close(s);
   ast_debug(3, "Found IP address for this socket\n");
   *us = sin.sin_addr;
   return 0;
}

int ast_str2cos	(	const char *	value,
		unsigned int *	cos
	)

Definition at line 429 of file acl.c.

Referenced by config_parse_variables(), reload_config(), and set_config().

{
   int fval;

   if (sscanf(value, "%30d", &fval) == 1) {
      if (fval < 8) {
          *cos = fval;
          return 0;
      }
   }

   return -1;
}

int ast_str2tos	(	const char *	value,
		unsigned int *	tos
	)

Definition at line 443 of file acl.c.

References ARRAY_LEN, name, and dscp_codepoint::space.

Referenced by config_parse_variables(), iax_template_parse(), reload_config(), and set_config().

{
   int fval;
   unsigned int x;

   if (sscanf(value, "%30i", &fval) == 1) {
      *tos = fval & 0xFF;
      return 0;
   }

   for (x = 0; x < ARRAY_LEN(dscp_pool1); x++) {
      if (!strcasecmp(value, dscp_pool1[x].name)) {
         *tos = dscp_pool1[x].space << 2;
         return 0;
      }
   }

   return -1;
}

const char* ast_tos2str

(

unsigned int

tos

)

Definition at line 463 of file acl.c.

References ARRAY_LEN, dscp_codepoint::name, and dscp_codepoint::space.

Referenced by sip_show_settings().

{
   unsigned int x;

   for (x = 0; x < ARRAY_LEN(dscp_pool1); x++) {
      if (dscp_pool1[x].space == (tos >> 2)) {
         return dscp_pool1[x].name;
      }
   }

   return "unknown";
}