+/*
+ * Copyright (C) 2005-2008 Andre Noll <maan@systemlinux.org>
+ *
+ * Licensed under the GPL v2. For licencing details see COPYING.
+ */
+
+/** \file acl.c Access control lists for paraslash senders. */
+
+#include "para.h"
+#include "error.h"
+#include "string.h"
+#include "list.h"
+#include "net.h"
+
+/**
+ * Describes one entry in the blacklist/whitelist of a paraslash sender.
+ */
+struct access_info {
+ /** The address to be black/whitelisted. */
+ struct in_addr addr;
+ /** The netmask for this entry. */
+ unsigned netmask;
+ /** The position of this entry in the acl. */
+ struct list_head node;
+};
+
+
+/**
+ * Return true if addr_1 matches addr_2 in the first `netmask' bits.
+ */
+static int v4_addr_match(uint32_t addr_1, uint32_t addr_2, uint8_t netmask)
+{
+ uint32_t mask = ~0U;
+
+ if (netmask < 32)
+ mask <<= (32 - netmask);
+ return (htonl(addr_1) & mask) == (htonl(addr_2) & mask);
+}
+
+int host_in_acl(int fd, struct list_head *acl)
+{
+ struct access_info *ai, *tmp;
+ struct sockaddr_storage ss;
+ socklen_t sslen = sizeof(ss);
+ struct in_addr v4_addr;
+
+ if (getpeername(fd, (struct sockaddr *)&ss, &sslen) < 0) {
+ PARA_ERROR_LOG("Can not determine peer address: %s\n", strerror(errno));
+ goto no_match;
+ }
+ v4_addr = extract_v4_addr(&ss);
+ if (!v4_addr.s_addr)
+ goto no_match;
+
+ list_for_each_entry_safe(ai, tmp, acl, node)
+ if (v4_addr_match(v4_addr.s_addr, ai->addr.s_addr, ai->netmask))
+ return 1;
+no_match:
+ return 0;
+}
+
+void add_acl_entry(struct list_head *acl, struct in_addr addr,
+ int netmask)
+{
+ struct access_info *ai = para_malloc(sizeof(struct access_info));
+ ai->addr = addr;
+ ai->netmask = netmask;
+ PARA_INFO_LOG("adding %s/%i to access list\n", inet_ntoa(ai->addr),
+ ai->netmask);
+ para_list_add(&ai->node, acl);
+}
+
+
+void del_acl_entry(struct list_head *acl, struct in_addr addr,
+ int netmask)
+{
+ struct access_info *ai, *tmp;
+
+ list_for_each_entry_safe(ai, tmp, acl, node) {
+ char *nad = para_strdup(inet_ntoa(ai->addr));
+ if (!strcmp(nad, inet_ntoa(addr)) &&
+ ai->netmask == netmask) {
+ PARA_NOTICE_LOG("removing %s/%i from access list\n",
+ nad, ai->netmask);
+ list_del(&ai->node);
+ free(ai);
+ }
+ free(nad);
+ }
+}
+
+char *get_acl_contents(struct list_head *acl)
+{
+ struct access_info *ai, *tmp_ai;
+ char *ret = NULL;
+
+ list_for_each_entry_safe(ai, tmp_ai, acl, node) {
+ char *tmp = make_message("%s%s/%d ", ret? ret : "",
+ inet_ntoa(ai->addr), ai->netmask);
+ free(ret);
+ ret = tmp;
+ }
+ return ret;
+}
+
+void init_acl(struct list_head *acl, char * const *acl_info, int num)
+{
+ int i;
+
+ INIT_LIST_HEAD(acl);
+ for (i = 0; i < num; i++) {
+ char *arg = para_strdup(acl_info[i]);
+ char *p = strchr(arg, '/');
+ struct in_addr addr;
+ int netmask;
+
+ if (!p)
+ goto err;
+ *p = '\0';
+ if (!inet_pton(AF_INET, arg, &addr))
+ goto err;
+ netmask = atoi(++p);
+ if (netmask < 0 || netmask > 32)
+ goto err;
+ add_acl_entry(acl, addr, netmask);
+ goto success;
+err:
+ PARA_CRIT_LOG("syntax error: %s\n", acl_info[i]);
+success:
+ free(arg);
+ continue;
+ }
+}
+