Home | History | Annotate | Download | only in common
      1 /*
      2  * CDDL HEADER START
      3  *
      4  * The contents of this file are subject to the terms of the
      5  * Common Development and Distribution License (the "License").
      6  * You may not use this file except in compliance with the License.
      7  *
      8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
      9  * or http://www.opensolaris.org/os/licensing.
     10  * See the License for the specific language governing permissions
     11  * and limitations under the License.
     12  *
     13  * When distributing Covered Code, include this CDDL HEADER in each
     14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
     15  * If applicable, add the following below this CDDL HEADER, with the
     16  * fields enclosed by brackets "[]" replaced with your own identifying
     17  * information: Portions Copyright [yyyy] [name of copyright owner]
     18  *
     19  * CDDL HEADER END
     20  */
     21 
     22 /*
     23  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
     24  * Use is subject to license terms.
     25  */
     26 
     27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
     28 
     29 #include <sys/types.h>
     30 #include <sys/socket.h>
     31 #include <netdb.h>
     32 #include <netinet/in.h>
     33 #include <string.h>
     34 #include <syslog.h>
     35 #include <addr_match.h>
     36 
     37 /*
     38  * Function to compare IP addresses.  It walks the list provided in
     39  * the res parameter, comparing to the original address in sin or sin6,
     40  * with some addition guidance provided by fromp.  It returns B_TRUE
     41  * if a match is found, otherwise B_FALSE.
     42  */
     43 
     44 static boolean_t
     45 find_match(const struct addrinfo *res,
     46     const struct sockaddr_storage *fromp,
     47     const struct sockaddr_in *sin,
     48     const struct sockaddr_in6 *sin6)
     49 {
     50 	const struct addrinfo *ai;
     51 
     52 	/* This is the moral equivalent of an assert. */
     53 	if ((fromp->ss_family == AF_INET && sin == NULL) ||
     54 	    (fromp->ss_family == AF_INET6 && sin6 == NULL))
     55 		return (B_FALSE);
     56 
     57 	for (ai = res; ai != NULL; ai = ai->ai_next) {
     58 		struct sockaddr_in *s4;
     59 		struct sockaddr_in6 *s6;
     60 		void *addr1, *addr2;
     61 		size_t size;
     62 
     63 		if (ai->ai_family != fromp->ss_family)
     64 			continue;
     65 		if (ai->ai_family == AF_INET) {
     66 			/* LINTED E_BAD_PTR_CAST_ALIGN */
     67 			s4 = (struct sockaddr_in *)ai->ai_addr;
     68 			addr1 = &s4->sin_addr;
     69 			addr2 = &((struct sockaddr_in *)sin)->sin_addr;
     70 			size = sizeof (struct in_addr);
     71 		} else if (ai->ai_family == AF_INET6) {
     72 			/* LINTED E_BAD_PTR_CAST_ALIGN */
     73 			s6 = (struct sockaddr_in6 *)ai->ai_addr;
     74 			addr1 = &s6->sin6_addr;
     75 			addr2 = &((struct sockaddr_in6 *)sin6)->sin6_addr;
     76 			size = sizeof (struct in6_addr);
     77 		} else {
     78 			continue;
     79 		}
     80 		if (memcmp(addr1, addr2, size) == 0)
     81 			return (B_TRUE);
     82 	}
     83 	return (B_FALSE);
     84 }
     85 
     86 void
     87 check_address(const char *prog,
     88     const struct sockaddr_storage *fromp,
     89     const struct sockaddr_in *sin,
     90     const struct sockaddr_in6 *sin6,
     91     const char *printable_addr,
     92     char *hostname,
     93     size_t hostsize)
     94 {
     95 	/*
     96 	 * We have to check for spoofing.  So take hostname, look up its
     97 	 * address(es), and walk the list until we have a match with the
     98 	 * original IP address.  If no match is found, log a warning and
     99 	 * use the original IP address for authentication purposes.
    100 	 */
    101 	struct addrinfo *res, hints;
    102 	boolean_t match_found = B_FALSE;
    103 
    104 	(void) memset(&hints, 0, sizeof (hints));
    105 	hints.ai_flags = AI_CANONNAME|AI_V4MAPPED|AI_ADDRCONFIG|AI_ALL;
    106 	hints.ai_family = fromp->ss_family;
    107 	if (getaddrinfo(hostname, NULL, &hints, &res) == 0) {
    108 		match_found = find_match(res, fromp, sin, sin6);
    109 		freeaddrinfo(res);
    110 	}
    111 	if (!match_found) {
    112 		syslog(LOG_WARNING, "%s: IP address '%s' maps to host "
    113 		    "name '%s',\r\n but that host name does not map to "
    114 		    "the same IP address.", prog, printable_addr, hostname);
    115 		(void) strlcpy(hostname, printable_addr, hostsize);
    116 	}
    117 }
    118