nginx/src/http/modules/ngx_http_access_module.c

   1
   2 /*
   3  * Copyright (C) Igor Sysoev
   4  */
   5
   6
   7 #include <ngx_config.h>
   8 #include <ngx_core.h>
   9 #include <ngx_http.h>
  10
  11
  12 typedef struct {
  13     in_addr_t     mask;
  14     in_addr_t     addr;
  15     ngx_uint_t    deny;      /* unsigned  deny:1; */
  16 } ngx_http_access_rule_t;
  17
  18
  19 typedef struct {
  20     ngx_array_t  *rules;     /* array of ngx_http_access_rule_t */
  21 } ngx_http_access_loc_conf_t;
  22
  23
  24 static ngx_int_t ngx_http_access_handler(ngx_http_request_t *r);
  25 static char *ngx_http_access_rule(ngx_conf_t *cf, ngx_command_t *cmd,
  26     void *conf);
  27 static void *ngx_http_access_create_loc_conf(ngx_conf_t *cf);
  28 static char *ngx_http_access_merge_loc_conf(ngx_conf_t *cf,
  29     void *parent, void *child);
  30 static ngx_int_t ngx_http_access_init(ngx_conf_t *cf);
  31
  32
  33 static ngx_command_t  ngx_http_access_commands[] = {
  34
  35     { ngx_string("allow"),
  36       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LMT_CONF
  37                         |NGX_CONF_TAKE1,
  38       ngx_http_access_rule,
  39       NGX_HTTP_LOC_CONF_OFFSET,
  40       0,
  41       NULL },
  42
  43     { ngx_string("deny"),
  44       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LMT_CONF
  45                         |NGX_CONF_TAKE1,
  46       ngx_http_access_rule,
  47       NGX_HTTP_LOC_CONF_OFFSET,
  48       0,
  49       NULL },
  50
  51       ngx_null_command
  52 };
  53
  54
  55
  56 static ngx_http_module_t  ngx_http_access_module_ctx = {
  57     NULL,                                  /* preconfiguration */
  58     ngx_http_access_init,                  /* postconfiguration */
  59
  60     NULL,                                  /* create main configuration */
  61     NULL,                                  /* init main configuration */
  62
  63     NULL,                                  /* create server configuration */
  64     NULL,                                  /* merge server configuration */
  65
  66     ngx_http_access_create_loc_conf,       /* create location configuration */
  67     ngx_http_access_merge_loc_conf         /* merge location configuration */
  68 };
  69
  70
  71 ngx_module_t  ngx_http_access_module = {
  72     NGX_MODULE_V1,
  73     &ngx_http_access_module_ctx,           /* module context */
  74     ngx_http_access_commands,              /* module directives */
  75     NGX_HTTP_MODULE,                       /* module type */
  76     NULL,                                  /* init master */
  77     NULL,                                  /* init module */
  78     NULL,                                  /* init process */
  79     NULL,                                  /* init thread */
  80     NULL,                                  /* exit thread */
  81     NULL,                                  /* exit process */
  82     NULL,                                  /* exit master */
  83     NGX_MODULE_V1_PADDING
  84 };
  85
  86
  87 static ngx_int_t
  88 ngx_http_access_handler(ngx_http_request_t *r)
  89 {
  90     ngx_uint_t                   i;
  91     struct sockaddr_in          *sin;
  92     ngx_http_access_rule_t      *rule;
  93     ngx_http_core_loc_conf_t    *clcf;
  94     ngx_http_access_loc_conf_t  *alcf;
  95
  96     alcf = ngx_http_get_module_loc_conf(r, ngx_http_access_module);
  97
  98     if (alcf->rules == NULL) {
  99         return NGX_DECLINED;
 100     }
 101
 102     /* AF_INET only */
 103
 104     if (r->connection->sockaddr->sa_family != AF_INET) {
 105         return NGX_DECLINED;
 106     }
 107
 108     sin = (struct sockaddr_in *) r->connection->sockaddr;
 109
 110     rule = alcf->rules->elts;
 111     for (i = 0; i < alcf->rules->nelts; i++) {
 112
 113         ngx_log_debug3(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
 114                        "access: %08XD %08XD %08XD",
 115                        sin->sin_addr.s_addr, rule[i].mask, rule[i].addr);
 116
 117         if ((sin->sin_addr.s_addr & rule[i].mask) == rule[i].addr) {
 118             if (rule[i].deny) {
 119                 clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);
 120
 121                 if (clcf->satisfy == NGX_HTTP_SATISFY_ALL) {
 122                     ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
 123                                   "access forbidden by rule");
 124                 }
 125
 126                 return NGX_HTTP_FORBIDDEN;
 127             }
 128
 129             return NGX_OK;
 130         }
 131     }
 132
 133     return NGX_DECLINED;
 134 }
 135
 136
 137 static char *
 138 ngx_http_access_rule(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
 139 {
 140     ngx_http_access_loc_conf_t *alcf = conf;
 141
 142     ngx_int_t                rc;
 143     ngx_str_t               *value;
 144     ngx_inet_cidr_t          in_cidr;
 145     ngx_http_access_rule_t  *rule;
 146
 147     if (alcf->rules == NULL) {
 148         alcf->rules = ngx_array_create(cf->pool, 4,
 149                                        sizeof(ngx_http_access_rule_t));
 150         if (alcf->rules == NULL) {
 151             return NGX_CONF_ERROR;
 152         }
 153     }
 154
 155     rule = ngx_array_push(alcf->rules);
 156     if (rule == NULL) {
 157         return NGX_CONF_ERROR;
 158     }
 159
 160     value = cf->args->elts;
 161
 162     rule->deny = (value[0].data[0] == 'd') ? 1 : 0;
 163
 164     if (value[1].len == 3 && ngx_strcmp(value[1].data, "all") == 0) {
 165         rule->mask = 0;
 166         rule->addr = 0;
 167
 168         return NGX_CONF_OK;
 169     }
 170
 171     rc = ngx_ptocidr(&value[1], &in_cidr);
 172
 173     if (rc == NGX_ERROR) {
 174         ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, "invalid parameter \"%V\"",
 175                            &value[1]);
 176         return NGX_CONF_ERROR;
 177     }
 178
 179     if (rc == NGX_DONE) {
 180         ngx_conf_log_error(NGX_LOG_WARN, cf, 0,
 181                            "low address bits of %V are meaningless", &value[1]);
 182     }
 183
 184     rule->mask = in_cidr.mask;
 185     rule->addr = in_cidr.addr;
 186
 187     return NGX_CONF_OK;
 188 }
 189
 190
 191 static void *
 192 ngx_http_access_create_loc_conf(ngx_conf_t *cf)
 193 {
 194     ngx_http_access_loc_conf_t  *conf;
 195
 196     conf = ngx_pcalloc(cf->pool, sizeof(ngx_http_access_loc_conf_t));
 197     if (conf == NULL) {
 198         return NGX_CONF_ERROR;
 199     }
 200
 201     return conf;
 202 }
 203
 204
 205 static char *
 206 ngx_http_access_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
 207 {
 208     ngx_http_access_loc_conf_t  *prev = parent;
 209     ngx_http_access_loc_conf_t  *conf = child;
 210
 211     if (conf->rules == NULL) {
 212         conf->rules = prev->rules;
 213     }
 214
 215     return NGX_CONF_OK;
 216 }
 217
 218
 219 static ngx_int_t
 220 ngx_http_access_init(ngx_conf_t *cf)
 221 {
 222     ngx_http_handler_pt        *h;
 223     ngx_http_core_main_conf_t  *cmcf;
 224
 225     cmcf = ngx_http_conf_get_module_main_conf(cf, ngx_http_core_module);
 226
 227     h = ngx_array_push(&cmcf->phases[NGX_HTTP_ACCESS_PHASE].handlers);
 228     if (h == NULL) {
 229         return NGX_ERROR;
 230     }
 231
 232     *h = ngx_http_access_handler;
 233
 234     return NGX_OK;
 235 }