proftpd-mod_tcpd.c

   1 /*
   2  * ProFTPD: mod_tcpd -- use TCPD library for access control
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License as published by
   6  * the Free Software Foundation; either version 2 of the License, or
   7  * (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, write to the Free Software
  16  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307, USA.
  17  *
  18  * -- DO NOT MODIFY THE TWO LINES BELOW --
  19  * $Libraries: -lwrap$
  20  * $Id$
  21  *
  22  */
  23
  24 #include "conf.h"
  25 #include "privs.h"
  26 #include "tcpd.h"
  27
  28 #ifndef TCPD_ALLOW
  29 int allow_severity = LOG_INFO;
  30 int deny_severity = LOG_WARNING;
  31 #endif
  32 /*
  33  * -------------------------------------------------------------------------
  34  *   Configuration Handlers
  35  * -------------------------------------------------------------------------
  36  */
  37
  38 MODRET set_tcpd(cmd_rec * cmd)
  39 {
  40         int b;
  41
  42         CHECK_ARGS(cmd, 1);
  43         CHECK_CONF(cmd, CONF_ROOT | CONF_VIRTUAL | CONF_GLOBAL);
  44
  45         if ((b = get_boolean(cmd, 1)) == -1)
  46                 CONF_ERROR(cmd, "expected boolean argument.");
  47
  48         add_config_param("UseTCPD", 1, (void *) b);
  49
  50         return HANDLED(cmd);
  51 }
  52
  53 MODRET set_tcpd_service(cmd_rec * cmd)
  54 {
  55         char *service_name;
  56
  57         CHECK_ARGS(cmd, 1);
  58         CHECK_CONF(cmd, CONF_ROOT | CONF_VIRTUAL | CONF_GLOBAL);
  59
  60         service_name = cmd->argv[1];
  61
  62         add_config_param_str("TCPDServiceName", 1, (void *) service_name);
  63
  64         return HANDLED(cmd);
  65 }
  66
  67 /*
  68  * These two functions are copied, almost verbatim, from the set_sysloglevel()
  69  * function in modules/mod_core.c.  I hereby cite the source for this code
  70  * as MacGuyver <macguyver@tos.net>. =)
  71  */
  72
  73 MODRET set_allow_syslog_level(cmd_rec * cmd)
  74 {
  75         CHECK_ARGS(cmd, 1);
  76         CHECK_CONF(cmd, CONF_ROOT | CONF_VIRTUAL | CONF_ANON);
  77
  78         if (!strcasecmp(cmd->argv[1], "emerg")) {
  79                 add_config_param("HostsAllowSyslogLevel", 1,
  80                                  (void *) PR_LOG_EMERG);
  81
  82         } else if (!strcasecmp(cmd->argv[1], "alert")) {
  83                 add_config_param("HostsAllowSyslogLevel", 1,
  84                                  (void *) PR_LOG_ALERT);
  85
  86         } else if (!strcasecmp(cmd->argv[1], "crit")) {
  87                 add_config_param("HostsAllowSyslogLevel", 1,
  88                                  (void *) PR_LOG_CRIT);
  89
  90         } else if (!strcasecmp(cmd->argv[1], "error")) {
  91                 add_config_param("HostsAllowSyslogLevel", 1,
  92                                  (void *) PR_LOG_ERR);
  93
  94         } else if (!strcasecmp(cmd->argv[1], "warn")) {
  95                 add_config_param("HostsAllowSyslogLevel", 1,
  96                                  (void *) PR_LOG_WARNING);
  97
  98         } else if (!strcasecmp(cmd->argv[1], "notice")) {
  99                 add_config_param("HostsAllowSyslogLevel", 1,
 100                                  (void *) PR_LOG_NOTICE);
 101
 102         } else if (!strcasecmp(cmd->argv[1], "info")) {
 103                 add_config_param("HostsAllowSyslogLevel", 1,
 104                                  (void *) PR_LOG_INFO);
 105
 106         } else if (!strcasecmp(cmd->argv[1], "debug")) {
 107                 add_config_param("HostsAllowSyslogLevel", 1,
 108                                  (void *) PR_LOG_DEBUG);
 109
 110         } else {
 111                 CONF_ERROR(cmd, "HostsAllowSyslogLevel requires level keyword: "
 112                                 "one of emerg/alert/crit/error/warn/notice/info/debug");
 113         }
 114
 115         return HANDLED(cmd);
 116 }
 117
 118 MODRET set_deny_syslog_level(cmd_rec * cmd)
 119 {
 120         CHECK_ARGS(cmd, 1);
 121         CHECK_CONF(cmd, CONF_ROOT | CONF_VIRTUAL | CONF_ANON);
 122
 123         if (!strcasecmp(cmd->argv[1], "emerg")) {
 124                 add_config_param("HostsDenySyslogLevel", 1,
 125                                  (void *) PR_LOG_EMERG);
 126
 127         } else if (!strcasecmp(cmd->argv[1], "alert")) {
 128                 add_config_param("HostsDenySyslogLevel", 1,
 129                                  (void *) PR_LOG_ALERT);
 130
 131         } else if (!strcasecmp(cmd->argv[1], "crit")) {
 132                 add_config_param("HostsDenySyslogLevel", 1,
 133                                  (void *) PR_LOG_CRIT);
 134
 135         } else if (!strcasecmp(cmd->argv[1], "error")) {
 136                 add_config_param("HostsDenySyslogLevel", 1,
 137                                  (void *) PR_LOG_ERR);
 138
 139         } else if (!strcasecmp(cmd->argv[1], "warn")) {
 140                 add_config_param("HostsDenySyslogLevel", 1,
 141                                  (void *) PR_LOG_WARNING);
 142
 143         } else if (!strcasecmp(cmd->argv[1], "notice")) {
 144                 add_config_param("HostsDenySyslogLevel", 1,
 145                                  (void *) PR_LOG_NOTICE);
 146
 147         } else if (!strcasecmp(cmd->argv[1], "info")) {
 148                 add_config_param("HostsDenySyslogLevel", 1,
 149                                  (void *) PR_LOG_INFO);
 150
 151         } else if (!strcasecmp(cmd->argv[1], "debug")) {
 152                 add_config_param("HostsDenySyslogLevel", 1,
 153                                  (void *) PR_LOG_DEBUG);
 154
 155         } else {
 156                 CONF_ERROR(cmd, "HostsDenySyslogLevel requires level keyword: "
 157                                 "one of emerg/alert/crit/error/warn/notice/info/debug");
 158         }
 159
 160         return HANDLED(cmd);
 161 }
 162
 163 /*
 164  * -------------------------------------------------------------------------
 165  *  Command Handlers
 166  * -------------------------------------------------------------------------
 167  */
 168
 169 MODRET handle_request(cmd_rec * cmd)
 170 {
 171         struct request_info request;
 172         char *service_name;
 173
 174         /*
 175          * If we haven't been explicitly disabled, enable us by default.
 176          */
 177         if(get_param_int(TOPLEVEL_CONF, "UseTCPD", FALSE) == 0)
 178                 return DECLINED(cmd);
 179
 180         if ((allow_severity = get_param_int(CURRENT_CONF, "HostsAllowSyslogLevel",
 181                                         FALSE)) == -1)
 182                 allow_severity = LOG_INFO;
 183
 184         if ((deny_severity = get_param_int(CURRENT_CONF, "HostsDenySyslogLevel",
 185                                         FALSE)) == -1)
 186                 deny_severity = LOG_WARNING;
 187
 188         if ((service_name = (char *)get_param_ptr(CURRENT_CONF, "TCPDServiceName",
 189                                         FALSE)) == NULL)
 190                 service_name = "proftpd";
 191
 192         request_init(&request, RQ_DAEMON, service_name,
 193                         RQ_FILE, session.c->rfd,
 194                         RQ_CLIENT_SIN, session.c->remote_ipaddr,
 195                         NULL);
 196
 197         fromhost(&request);
 198
 199         if (!hosts_access(&request)) {
 200                 add_response_err(R_550,
 201                                  "Unable to connect to %s: connection refused",
 202                                  cmd->server->ServerFQDN);
 203                 add_response_err(R_DUP,
 204                                  "Please contact %s for more information",
 205                                  cmd->server->ServerAdmin);
 206                 refuse(&request);
 207
 208                 return ERROR(cmd);
 209         }
 210
 211         /*
 212          * if request is allowable, return DECLINED (for engine to act as if this
 213          * handler was never called, else ERROR (for engine to abort processing and
 214          * deny request.
 215          */
 216
 217         /* log the accepted connection */
 218 #ifdef TCPD_ALLOW
 219         tcpd_allowlog(&request);
 220 #else
 221         log_pri(allow_severity, "connect from %s", eval_client(&request));
 222 #endif
 223
 224         return HANDLED(cmd);
 225 }
 226
 227 static conftable tcpd_conftab[] = {
 228         {"HostsAllowSyslogLevel", set_allow_syslog_level, NULL},
 229         {"HostsDenySyslogLevel", set_deny_syslog_level, NULL},
 230         {"UseTCPD", set_tcpd, NULL},
 231         {"TCPDServiceName", set_tcpd_service, NULL},
 232         {NULL}
 233 };
 234
 235 static cmdtable tcpd_cmdtab[] = {
 236         {PRE_CMD, C_PASS, G_NONE, handle_request, FALSE, FALSE},
 237         {0, NULL}
 238 };
 239
 240 module tcpd_module = {
 241         NULL,
 242         NULL,
 243         0x20,
 244         "tcpd",
 245         tcpd_conftab,
 246         tcpd_cmdtab,
 247         NULL,
 248         NULL,
 249         NULL
 250 };