Merge lp:~sjinks/ngx-tcpwrappers/lp625299 into lp:ngx-tcpwrappers

[Volodymyr Kolesnykov]

[Volodymyr Kolesnykov (sjinks)]

review: Approve

=== modified file 'ngx_tcpwrappers.c'
--- ngx_tcpwrappers.c	2010-08-25 04:29:23 +0000
+++ ngx_tcpwrappers.c	2010-08-27 15:56:41 +0000
@@ -8,6 +8,7 @@
 #include <ngx_http.h>
 #include <ngx_inet.h>
 #include <tcpd.h>
+#include <syslog.h>
 
 /**
  * @brief Default daemon name for libwrap
@@ -18,78 +19,48 @@
 static ngx_mutex_t* libwrap_mutex;
 #endif
 
-/**
- * @param daemon Daemon name
- * @param client_addr Client IP address
- * @return Whether access should be granted
- * @retval 0 No
- * @retval 1 Yes
- */
-static int my_hosts_ctl(char* daemon, char* client_addr)
-{
-	int res;
-
-#if (NGX_THREADS)
-	ngx_mutex_lock(libwrap_mutex);
-#endif
-
-	res = hosts_ctl(daemon, "", client_addr, "");
-
-#if (NGX_THREADS)
-	ngx_mutex_unlock(libwrap_mutex);
-#endif
-	return res;
-}
-
-/**
- * @param daemon Daemon name
- * @param conn nginx connection structure
- * @return Whether access should be granted
- * @retval 0 No
- * @retval 1 Yes
- */
-static int my_hosts_access(char* daemon, ngx_connection_t* conn)
-{
-	int res;
-	struct request_info request_info;
-
-#if (NGX_THREADS)
-	ngx_mutex_lock(libwrap_mutex);
-#endif
-
-	request_init(
-		&request_info,
-		RQ_DAEMON, daemon,
-		RQ_USER, STRING_UNKNOWN,
-		RQ_CLIENT_SIN, conn->local_sockaddr,
-		RQ_SERVER_SIN, conn->sockaddr,
-		RQ_FILE, conn->fd,
-		NULL
-	);
-
-	fromhost(&request_info);
-
-	res = hosts_access(&request_info);
-
-#if (NGX_THREADS)
-	ngx_mutex_unlock(libwrap_mutex);
-#endif
-	return res;
-}
+static int orig_allow_severity;
+static int orig_deny_severity;
+static int orig_hosts_access_verbose;
+static char* orig_allow_table;
+static char* orig_deny_table;
 
 /**
  * @brief Module configuration structure
  */
 typedef struct {
-	ngx_flag_t enabled;    /**< tcpwrappers on */
-	ngx_flag_t thorough;   /**< tcpwrappers_thorough on */
-	ngx_str_t daemon;      /**< tcpwrappers_daemon */
+	ngx_flag_t enabled;        /**< tcpwrappers */
+	ngx_flag_t thorough;       /**< tcpwrappers_thorough */
+	ngx_str_t daemon;          /**< tcpwrappers_daemon */
+	ngx_uint_t allow_severity; /**< tcpwrappers_allow_severity */
+	ngx_uint_t deny_severity;  /**< tcpwrappers_deny_severity */
+	ngx_flag_t verbose_access; /**< tcpwrappers_verbose */
+	ngx_str_t allow_file;      /**< tcpwrappers_allow_file */
+	ngx_str_t deny_file;       /**< tcpwrappers_deny_file */
 } ngx_http_tcpwrappers_conf_t;
 
+/* Forward declarations */
 static ngx_int_t ngx_http_tcpwrappers_handler(ngx_http_request_t* r);
 static ngx_int_t ngx_http_tcpwrappers_init(ngx_conf_t* cf);
 static void* ngx_http_tcpwrappers_create_loc_conf(ngx_conf_t* cf);
 static char* ngx_http_tcpwrappers_merge_loc_conf(ngx_conf_t* cf, void* parent, void* child);
+static int my_hosts_ctl(char* daemon, ngx_connection_t* conn, char* client_addr, ngx_http_tcpwrappers_conf_t* config);
+static int my_hosts_access(char* daemon, ngx_connection_t* conn, ngx_http_tcpwrappers_conf_t* config);
+
+/**
+ * @brief Severities for @c tcpwrappers_allow_severity and tcpwrappers_deny_severity
+ */
+static ngx_conf_enum_t severities[] = {
+	{ ngx_string("emerg"),   LOG_EMERG },
+	{ ngx_string("alert"),   LOG_ALERT },
+	{ ngx_string("crit"),    LOG_CRIT },
+	{ ngx_string("err"),     LOG_ERR },
+	{ ngx_string("warning"), LOG_WARNING },
+	{ ngx_string("notice"),  LOG_NOTICE },
+	{ ngx_string("info"),    LOG_INFO },
+	{ ngx_string("debug"),   LOG_DEBUG },
+	{ ngx_null_string,       0 }
+};
 
 /**
  * @brief Configuration directives
@@ -122,6 +93,51 @@
 		NULL
 	},
 
+	{
+		ngx_string("tcpwrappers_allow_severity"),
+		NGX_HTTP_MAIN_CONF | NGX_HTTP_SRV_CONF | NGX_HTTP_LOC_CONF | NGX_HTTP_LMT_CONF | NGX_CONF_TAKE1,
+		ngx_conf_set_enum_slot,
+		NGX_HTTP_LOC_CONF_OFFSET,
+		offsetof(ngx_http_tcpwrappers_conf_t, allow_severity),
+		&severities
+	},
+
+	{
+		ngx_string("tcpwrappers_deny_severity"),
+		NGX_HTTP_MAIN_CONF | NGX_HTTP_SRV_CONF | NGX_HTTP_LOC_CONF | NGX_HTTP_LMT_CONF | NGX_CONF_TAKE1,
+		ngx_conf_set_enum_slot,
+		NGX_HTTP_LOC_CONF_OFFSET,
+		offsetof(ngx_http_tcpwrappers_conf_t, deny_severity),
+		&severities
+	},
+
+	{
+		ngx_string("tcpwrappers_verbose"),
+		NGX_HTTP_MAIN_CONF | NGX_HTTP_SRV_CONF | NGX_HTTP_LOC_CONF | NGX_HTTP_LMT_CONF | NGX_CONF_TAKE1,
+		ngx_conf_set_flag_slot,
+		NGX_HTTP_LOC_CONF_OFFSET,
+		offsetof(ngx_http_tcpwrappers_conf_t, verbose_access),
+		NULL
+	},
+
+	{
+		ngx_string("tcpwrappers_allow_file"),
+		NGX_HTTP_MAIN_CONF | NGX_HTTP_SRV_CONF | NGX_HTTP_LOC_CONF | NGX_HTTP_LMT_CONF | NGX_CONF_TAKE1,
+		ngx_conf_set_str_slot,
+		NGX_HTTP_LOC_CONF_OFFSET,
+		offsetof(ngx_http_tcpwrappers_conf_t, allow_file),
+		NULL
+	},
+
+	{
+		ngx_string("tcpwrappers_deny_file"),
+		NGX_HTTP_MAIN_CONF | NGX_HTTP_SRV_CONF | NGX_HTTP_LOC_CONF | NGX_HTTP_LMT_CONF | NGX_CONF_TAKE1,
+		ngx_conf_set_str_slot,
+		NGX_HTTP_LOC_CONF_OFFSET,
+		offsetof(ngx_http_tcpwrappers_conf_t, deny_file),
+		NULL
+	},
+
 	ngx_null_command
 };
 
@@ -173,6 +189,7 @@
 	ngx_http_tcpwrappers_conf_t* config = ngx_http_get_module_loc_conf(r, ngx_tcpwrappers_module);
 	int res;
 	char* daemon_name;
+	char* p;
 
 	if (1 != config->enabled || !config->daemon.len) {
 		return NGX_DECLINED;
@@ -189,11 +206,11 @@
 	}
 
 	daemon_name = (char*)alloca(config->daemon.len + 1);
-	memcpy(daemon_name, config->daemon.data, config->daemon.len);
-	daemon_name[config->daemon.len] = '\0';
+	p = ngx_cpymem(daemon_name, config->daemon.data, config->daemon.len);
+	*p = '\0';
 
 	if (1 == config->thorough) {
-		res = my_hosts_access(daemon_name, r->connection);
+		res = my_hosts_access(daemon_name, r->connection, config);
 	}
 	else {
 		char* client_addr = STRING_UNKNOWN;
@@ -205,7 +222,7 @@
 			client_addr = addr;
 		}
 
-		res = my_hosts_ctl(daemon_name, client_addr);
+		res = my_hosts_ctl(daemon_name, r->connection, client_addr, config);
 	}
 
 	if (!res) {
@@ -226,6 +243,8 @@
  * @return Whether initialization succeeded
  * @retval NGX_OK Yes
  * @retval NGX_ERROR No
+ * @sa orig_allow_severity
+ * @sa orig_deny_severity
  */
 static ngx_int_t ngx_http_tcpwrappers_init(ngx_conf_t* cf)
 {
@@ -261,10 +280,23 @@
 static void* ngx_http_tcpwrappers_create_loc_conf(ngx_conf_t* cf)
 {
 	ngx_http_tcpwrappers_conf_t* conf = ngx_pcalloc(cf->pool, sizeof(ngx_http_tcpwrappers_conf_t));
+
+	orig_allow_severity       = allow_severity;
+	orig_deny_severity        = deny_severity;
+	resident                  = 1;
+	orig_hosts_access_verbose = hosts_access_verbose;
+	orig_allow_table          = hosts_allow_table;
+	orig_deny_table           = hosts_deny_table;
+
 	if (NULL != conf) {
 		conf->enabled  = NGX_CONF_UNSET;
 		conf->thorough = NGX_CONF_UNSET;
 		ngx_str_null(&conf->daemon);
+		conf->allow_severity = NGX_CONF_UNSET;
+		conf->deny_severity  = NGX_CONF_UNSET;
+		conf->verbose_access = NGX_CONF_UNSET;
+		ngx_str_null(&conf->allow_file);
+		ngx_str_null(&conf->deny_file);
 	}
 
 	return conf;
@@ -287,6 +319,150 @@
 	ngx_conf_merge_value(conf->enabled, prev->enabled, 0);
 	ngx_conf_merge_value(conf->thorough, prev->thorough, 0);
 	ngx_conf_merge_str_value(conf->daemon, prev->daemon, NGX_TCPWRAPPERS_DAEMON);
+	ngx_conf_merge_value(conf->allow_severity, prev->allow_severity, orig_allow_severity);
+	ngx_conf_merge_value(conf->deny_severity,  prev->deny_severity,  orig_deny_severity);
+	ngx_conf_merge_value(conf->verbose_access, prev->verbose_access, orig_hosts_access_verbose);
+
+	if (!conf->allow_file.data) {
+		if (prev->allow_file.data) {
+			conf->allow_file.len  = prev->allow_file.len;
+			conf->allow_file.data = prev->allow_file.data;
+		}
+		else {
+			conf->allow_file.len  = strlen(orig_allow_table);
+			conf->allow_file.data = (u_char*)orig_allow_table;
+		}
+	}
+
+	if (!conf->deny_file.data) {
+		if (prev->deny_file.data) {
+			conf->deny_file.len  = prev->deny_file.len;
+			conf->deny_file.data = prev->deny_file.data;
+		}
+		else {
+			conf->deny_file.len  = strlen(orig_deny_table);
+			conf->deny_file.data = (u_char*)orig_deny_table;
+		}
+	}
 
 	return NGX_CONF_OK;
 }
+
+/**
+ * @param daemon Daemon name
+ * @param client_addr Client IP address
+ * @return Whether access should be granted
+ * @retval 0 No
+ * @retval 1 Yes
+ */
+static int my_hosts_ctl(char* daemon, ngx_connection_t* conn, char* client_addr, ngx_http_tcpwrappers_conf_t* config)
+{
+	int res;
+	char* p;
+	char* allow_file;
+	char* deny_file;
+
+	p = alloca(config->allow_file.len + config->deny_file.len + 2);
+	allow_file = p;
+
+	p = ngx_cpymem(p, config->allow_file.data, config->allow_file.len);
+	*p = '\0';
+	++p;
+	deny_file = p;
+	p = ngx_cpymem(p, config->deny_file.data, config->deny_file.len);
+	*p = '\0';
+
+	ngx_log_debug4(
+		NGX_LOG_DEBUG_HTTP,
+		conn->log,
+		0,
+		"ngx_tcpwrappers: daemon: %s, allow file: %s, deny file: %s, verbosity: %d",
+		daemon,
+		allow_file,
+		deny_file,
+		config->verbose_access
+	);
+
+#if (NGX_THREADS)
+	ngx_mutex_lock(libwrap_mutex);
+#endif
+
+	allow_severity       = config->allow_severity;
+	deny_severity        = config->deny_severity;
+	hosts_access_verbose = config->verbose_access;
+	hosts_allow_table    = allow_file;
+	hosts_deny_table     = deny_file;
+
+	res = hosts_ctl(daemon, "", client_addr, "");
+
+#if (NGX_THREADS)
+	ngx_mutex_unlock(libwrap_mutex);
+#endif
+	return res;
+}
+
+/**
+ * @param daemon Daemon name
+ * @param conn nginx connection structure
+ * @return Whether access should be granted
+ * @retval 0 No
+ * @retval 1 Yes
+ */
+static int my_hosts_access(char* daemon, ngx_connection_t* conn, ngx_http_tcpwrappers_conf_t* config)
+{
+	int res;
+	char* p;
+	char* allow_file;
+	char* deny_file;
+	struct request_info request_info;
+
+	p = alloca(config->allow_file.len + config->deny_file.len + 2);
+	allow_file = p;
+
+	p = ngx_cpymem(p, config->allow_file.data, config->allow_file.len);
+	*p = '\0';
+	++p;
+	deny_file = p;
+	p = ngx_cpymem(p, config->deny_file.data, config->deny_file.len);
+	*p = '\0';
+
+	ngx_log_debug4(
+		NGX_LOG_DEBUG_HTTP,
+		conn->log,
+		0,
+		"ngx_tcpwrappers: daemon: %s, allow file: %s, deny file: %s, verbosity: %d",
+		daemon,
+		allow_file,
+		deny_file,
+		config->verbose_access
+	);
+
+#if (NGX_THREADS)
+	ngx_mutex_lock(libwrap_mutex);
+#endif
+
+	allow_severity       = config->allow_severity;
+	deny_severity        = config->deny_severity;
+	hosts_access_verbose = config->verbose_access;
+	hosts_allow_table    = allow_file;
+	hosts_deny_table     = deny_file;
+
+	request_init(
+		&request_info,
+		RQ_DAEMON, daemon,
+		RQ_USER, STRING_UNKNOWN,
+		RQ_CLIENT_SIN, conn->local_sockaddr,
+		RQ_SERVER_SIN, conn->sockaddr,
+		RQ_FILE, conn->fd,
+		NULL
+	);
+
+	fromhost(&request_info);
+
+	res = hosts_access(&request_info);
+
+#if (NGX_THREADS)
+	ngx_mutex_unlock(libwrap_mutex);
+#endif
+	return res;
+}