Adding upstream version 1.8.27.upstream/1.8.27upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 211 insertions, 0 deletions

diff --git a/plugins/sudoers/match_addr.c b/plugins/sudoers/match_addr.c
new file mode 100644
index 0000000..4310e05
--- /dev/null
+++ b/plugins/sudoers/match_addr.c
@@ -0,0 +1,211 @@
+/*
+ * Copyright (c) 1996, 1998-2005, 2007-2015
+ *	Todd C. Miller <Todd.Miller@sudo.ws>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ * Sponsored in part by the Defense Advanced Research Projects
+ * Agency (DARPA) and Air Force Research Laboratory, Air Force
+ * Materiel Command, USAF, under agreement number F39502-99-1-0512.
+ */
+
+/*
+ * This is an open source non-commercial project. Dear PVS-Studio, please check it.
+ * PVS-Studio Static Code Analyzer for C, C++ and C#: http://www.viva64.com
+ */
+
+#include <config.h>
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <stdio.h>
+#include <stdlib.h>
+#ifdef HAVE_STRING_H
+# include <string.h>
+#endif /* HAVE_STRING_H */
+#ifdef HAVE_STRINGS_H
+# include <strings.h>
+#endif /* HAVE_STRINGS_H */
+#include <unistd.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#ifdef NEED_RESOLV_H
+# include <arpa/nameser.h>
+# include <resolv.h>
+#endif /* NEED_RESOLV_H */
+
+#include "sudoers.h"
+#include "interfaces.h"
+
+static bool
+addr_matches_if(const char *n)
+{
+    union sudo_in_addr_un addr;
+    struct interface *ifp;
+#ifdef HAVE_STRUCT_IN6_ADDR
+    unsigned int j;
+#endif
+    unsigned int family;
+    debug_decl(addr_matches_if, SUDOERS_DEBUG_MATCH)
+
+#ifdef HAVE_STRUCT_IN6_ADDR
+    if (inet_pton(AF_INET6, n, &addr.ip6) == 1) {
+	family = AF_INET6;
+    } else
+#endif /* HAVE_STRUCT_IN6_ADDR */
+    if (inet_pton(AF_INET, n, &addr.ip4) == 1) {
+	family = AF_INET;
+    } else {
+	debug_return_bool(false);
+    }
+
+    SLIST_FOREACH(ifp, get_interfaces(), entries) {
+	if (ifp->family != family)
+	    continue;
+	switch (family) {
+	    case AF_INET:
+		if (ifp->addr.ip4.s_addr == addr.ip4.s_addr ||
+		    (ifp->addr.ip4.s_addr & ifp->netmask.ip4.s_addr)
+		    == addr.ip4.s_addr)
+		    debug_return_bool(true);
+		break;
+#ifdef HAVE_STRUCT_IN6_ADDR
+	    case AF_INET6:
+		if (memcmp(ifp->addr.ip6.s6_addr, addr.ip6.s6_addr,
+		    sizeof(addr.ip6.s6_addr)) == 0)
+		    debug_return_bool(true);
+		for (j = 0; j < sizeof(addr.ip6.s6_addr); j++) {
+		    if ((ifp->addr.ip6.s6_addr[j] & ifp->netmask.ip6.s6_addr[j]) != addr.ip6.s6_addr[j])
+			break;
+		}
+		if (j == sizeof(addr.ip6.s6_addr))
+		    debug_return_bool(true);
+		break;
+#endif /* HAVE_STRUCT_IN6_ADDR */
+	}
+    }
+
+    debug_return_bool(false);
+}
+
+static bool
+addr_matches_if_netmask(const char *n, const char *m)
+{
+    unsigned int i;
+    union sudo_in_addr_un addr, mask;
+    struct interface *ifp;
+#ifdef HAVE_STRUCT_IN6_ADDR
+    unsigned int j;
+#endif
+    unsigned int family;
+    const char *errstr;
+    debug_decl(addr_matches_if, SUDOERS_DEBUG_MATCH)
+
+#ifdef HAVE_STRUCT_IN6_ADDR
+    if (inet_pton(AF_INET6, n, &addr.ip6) == 1)
+	family = AF_INET6;
+    else
+#endif /* HAVE_STRUCT_IN6_ADDR */
+    if (inet_pton(AF_INET, n, &addr.ip4) == 1) {
+	family = AF_INET;
+    } else {
+	debug_return_bool(false);
+    }
+
+    if (family == AF_INET) {
+	if (strchr(m, '.')) {
+	    if (inet_pton(AF_INET, m, &mask.ip4) != 1) {
+		sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
+		    "IPv4 netmask %s: %s", m, "invalid value");
+		debug_return_bool(false);
+	    }
+	} else {
+	    i = strtonum(m, 1, 32, &errstr);
+	    if (errstr != NULL) {
+		sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
+		    "IPv4 netmask %s: %s", m, errstr);
+		debug_return_bool(false);
+	    }
+	    mask.ip4.s_addr = htonl(0xffffffffU << (32 - i));
+	}
+	addr.ip4.s_addr &= mask.ip4.s_addr;
+    }
+#ifdef HAVE_STRUCT_IN6_ADDR
+    else {
+	if (inet_pton(AF_INET6, m, &mask.ip6) != 1) {
+	    j = strtonum(m, 1, 128, &errstr);
+	    if (errstr != NULL) {
+		sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
+		    "IPv6 netmask %s: %s", m, errstr);
+		debug_return_bool(false);
+	    }
+	    for (i = 0; i < sizeof(addr.ip6.s6_addr); i++) {
+		if (j < i * 8)
+		    mask.ip6.s6_addr[i] = 0;
+		else if (i * 8 + 8 <= j)
+		    mask.ip6.s6_addr[i] = 0xff;
+		else
+		    mask.ip6.s6_addr[i] = 0xff00 >> (j - i * 8);
+		addr.ip6.s6_addr[i] &= mask.ip6.s6_addr[i];
+	    }
+	}
+    }
+#endif /* HAVE_STRUCT_IN6_ADDR */
+
+    SLIST_FOREACH(ifp, get_interfaces(), entries) {
+	if (ifp->family != family)
+	    continue;
+	switch (family) {
+	    case AF_INET:
+		if ((ifp->addr.ip4.s_addr & mask.ip4.s_addr) == addr.ip4.s_addr)
+		    debug_return_bool(true);
+		break;
+#ifdef HAVE_STRUCT_IN6_ADDR
+	    case AF_INET6:
+		for (j = 0; j < sizeof(addr.ip6.s6_addr); j++) {
+		    if ((ifp->addr.ip6.s6_addr[j] & mask.ip6.s6_addr[j]) != addr.ip6.s6_addr[j])
+			break;
+		}
+		if (j == sizeof(addr.ip6.s6_addr))
+		    debug_return_bool(true);
+		break;
+#endif /* HAVE_STRUCT_IN6_ADDR */
+	}
+    }
+
+    debug_return_bool(false);
+}
+
+/*
+ * Returns true if "n" is one of our ip addresses or if
+ * "n" is a network that we are on, else returns false.
+ */
+bool
+addr_matches(char *n)
+{
+    char *m;
+    bool rc;
+    debug_decl(addr_matches, SUDOERS_DEBUG_MATCH)
+
+    /* If there's an explicit netmask, use it. */
+    if ((m = strchr(n, '/'))) {
+	*m++ = '\0';
+	rc = addr_matches_if_netmask(n, m);
+	*(m - 1) = '/';
+    } else
+	rc = addr_matches_if(n);
+
+    sudo_debug_printf(SUDO_DEBUG_DEBUG|SUDO_DEBUG_LINENO,
+	"IP address %s matches local host: %s", n, rc ? "true" : "false");
+    debug_return_bool(rc);
+}