03-client-address-filters.patch

Copyright (c) 2020 - 2024 Matthias Pressfreund

Permission to use, copy, modify, and distribute this software for any
purpose with or without fee is hereby granted, provided that the above
copyright notice and this permission notice appear in all copies.

THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

Index: usr.sbin/httpd/httpd.conf.5
@@ -462,7 +462,8 @@
 .It Ic listen on Ar address Oo Ic tls Oc Ic port Ar number
 Set the listen address and port.
 This statement can be specified multiple times.
-.It Ic location Oo Oo Ic not Oc Ic found Oc Ar path Brq ...
+.It Ic location Oo Oo Ic not Oc Ic found Oc Ar path Oo Oo Ic not Oc Ic from
+.Ar network ... Oc Brq ...
 Specify server configuration rules for a specific location.
 The
 .Ar path
@@ -471,7 +472,30 @@
 .Ic found
 (i.e. accessible) or
 .Ic not found
-request paths only.
+request paths.
+Specifying
+.Ic from
+or
+.Ic not from
+enables client address filtering accepting or refusing connections from
+the specified (whitespace separated) list of up to 16
+.Ar network
+strings (formatted as outlined
+.Lk http://man.openbsd.org/inet_net_ntop.3#NETWORK_NUMBERS_(IP_VERSION_4) here
+with the exception that only decimal numbers are accepted) each being matched
+either against the client's IP address or, in case a
+.Ar network
+string is preceded by a
+.Sq >
+character, against the content of the
+.Ar X-Forwarded-For
+HTTP request header.
+If there was no such header transmitted or the data transmitted could not be
+read as a valid IP address, the unspecified address
+.Ar 0:0:0:0:0:0:0:0 ,
+resp.
+.Ar 0.0.0.0
+will be silently used for matching instead.
 In case of multiple location statements in the same context, the
 first matching location statement will be put into effect, while all
 later ones will be ignored.
@@ -488,7 +512,8 @@
 .Ic tcp
 and
 .Ic tls .
-.It Ic location Oo Oo Ic not Oc Ic found Oc Ic match Ar path Brq ...
+.It Ic location Oo Oo Ic not Oc Ic found Oc Ic match Ar path Oo Oo Ic not Oc
+.Ic from Ar network ... Oc Brq ...
 Like the
 .Ic location
 option,
Index: usr.sbin/httpd/httpd.h
@@ -58,6 +58,7 @@
 #define HTTPD_MAX_ALIAS_IP	16
 #define HTTPD_REALM_MAX		255
 #define HTTPD_LOCATION_MAX	255
+#define HTTPD_CLIENT_FILTER_MAX	16
 #define HTTPD_DEFAULT_TYPE	{ \
 	"bin", "application", "octet-stream", "", NULL }
 #define HTTPD_LOGVIS		VIS_NL|VIS_TAB|VIS_CSTYLE
@@ -392,6 +393,8 @@
 #define SRVFLAG_PATH_REWRITE	0x01000000
 #define SRVFLAG_NO_PATH_REWRITE	0x02000000
 #define SRVFLAG_GZIP_STATIC	0x04000000
+#define SRVFLAG_CLIENT_FROM	0x10000000
+#define SRVFLAG_CLIENT_NOT_FROM 0x20000000
 #define SRVFLAG_LOCATION_FOUND	0x40000000
 #define SRVFLAG_LOCATION_NOT_FOUND 0x80000000
 
@@ -401,7 +404,8 @@
 	"\14SYSLOG\15NO_SYSLOG\16TLS\17ACCESS_LOG\20ERROR_LOG"		\
 	"\21AUTH\22NO_AUTH\23BLOCK\24NO_BLOCK\25LOCATION_MATCH"		\
 	"\26SERVER_MATCH\27SERVER_HSTS\30DEFAULT_TYPE\31PATH\32NO_PATH" \
-	"\37LOCATION_FOUND\40LOCATION_NOT_FOUND"
+	"\35CLIENT_FROM\36CLIENT_NOT_FROM\37LOCATION_FOUND"		\
+	"\40LOCATION_NOT_FOUND"
 
 #define TCPFLAG_NODELAY		0x01
 #define TCPFLAG_NNODELAY	0x02
@@ -472,6 +476,28 @@
 };
 TAILQ_HEAD(server_fcgiparams, fastcgi_param);
 
+union addrvalue {
+	struct in_addr	 ipv4;
+	struct in6_addr	 ipv6;
+};
+
+struct client_addr {
+	union addrvalue	 value;
+	unsigned char	 family;
+};
+
+struct addr_filter {
+	union addrvalue	 first;
+	union addrvalue	 last;
+	unsigned char	 family;
+	unsigned char	 xff;
+};
+
+struct server_client_addr {
+	struct client_addr	 srv;
+	struct client_addr	 xff;
+};
+
 struct server_config {
 	uint32_t		 id;
 	uint32_t		 parent_id;
@@ -545,6 +571,7 @@
 	char			 errdocroot[HTTPD_ERRDOCROOT_MAX];
 
 	char			 fcgiscript[PATH_MAX];
+	struct addr_filter	 clientfilter[HTTPD_CLIENT_FILTER_MAX];
 
 	TAILQ_ENTRY(server_config) entry;
 };
Index: usr.sbin/httpd/parse.y
@@ -73,6 +73,10 @@
 int		 check_file_secrecy(int, const char *);
 int		 yyparse(void);
 int		 yylex(void);
+int		 normalize_addr(char *, const char *, size_t);
+struct addr_filter
+		*build_clientfilter(struct server_config *, char *);
+int		 clientfilter_cmp(struct addr_filter *, struct addr_filter *);
 int		 yyerror(const char *, ...)
     __attribute__((__format__ (printf, 1, 2)))
     __attribute__((__nonnull__ (1)));
@@ -141,7 +145,7 @@
 %token	TIMEOUT TLS TYPE TYPES HSTS MAXAGE SUBDOMAINS DEFAULT PRELOAD REQUEST
 %token	ERROR INCLUDE AUTHENTICATE WITH BLOCK DROP RETURN PASS REWRITE
 %token	CA CLIENT CRL OPTIONAL PARAM FORWARDED FOUND NOT
-%token	ERRDOCS GZIPSTATIC CACHE SCRIPT
+%token	ERRDOCS GZIPSTATIC CACHE SCRIPT FROM
 %token	<v.string>	STRING
 %token  <v.number>	NUMBER
 %type	<v.port>	port
@@ -149,6 +153,7 @@
 %type	<v.number>	opttls optmatch optfound
 %type	<v.tv>		timeout
 %type	<v.string>	numberstring optstring
+%type	<v.string>	optclientfilter clientfilters_l
 %type	<v.auth>	authopts
 
 %%
@@ -555,24 +560,27 @@
 		| authenticate
 		| gzip_static
 		| filter
-		| LOCATION optfound optmatch STRING	{
+		| LOCATION optfound optmatch STRING optclientfilter	{
 			struct server		*s;
 			struct sockaddr_un	*sun;
 
 			if (srv->srv_conf.ss.ss_family == AF_UNSPEC) {
 				yyerror("listen address not specified");
 				free($4);
+				free($5);
 				YYERROR;
 			}
 
 			if (parentsrv != NULL) {
 				yyerror("location %s inside location", $4);
 				free($4);
+				free($5);
 				YYERROR;
 			}
 
 			if (!loadcfg) {
 				free($4);
+				free($5);
 				YYACCEPT;
 			}
 
@@ -584,6 +592,7 @@
 			    sizeof(s->srv_conf.location)) {
 				yyerror("server location truncated");
 				free($4);
+				free($5);
 				free(s);
 				YYERROR;
 			}
@@ -593,6 +602,7 @@
 			    sizeof(s->srv_conf.name)) >=
 			    sizeof(s->srv_conf.name)) {
 				yyerror("server name truncated");
+				free($5);
 				free(s);
 				YYERROR;
 			}
@@ -620,6 +630,26 @@
 			}
 			if ($3)
 				s->srv_conf.flags |= SRVFLAG_LOCATION_MATCH;
+			if ($5) {
+				if (build_clientfilter(&s->srv_conf,
+				    $5 + 1) == NULL) {
+					free($5);
+					free(s);
+					YYERROR;
+				}
+				if (*$5 == '+') {
+					s->srv_conf.flags &=
+					    ~SRVFLAG_CLIENT_NOT_FROM;
+					s->srv_conf.flags |=
+					    SRVFLAG_CLIENT_FROM;
+				} else if (*$5 == '-') {
+					s->srv_conf.flags &=
+					    ~SRVFLAG_CLIENT_FROM;
+					s->srv_conf.flags |=
+					    SRVFLAG_CLIENT_NOT_FROM;
+				}
+				free($5);
+			}
 			s->srv_s = -1;
 			memcpy(&s->srv_conf.ss, &srv->srv_conf.ss,
 			    sizeof(s->srv_conf.ss));
@@ -640,7 +670,9 @@
 			struct server	*s = NULL;
 			uint32_t	 f;
 
-			f = SRVFLAG_LOCATION_FOUND |
+			f = SRVFLAG_CLIENT_FROM |
+			    SRVFLAG_CLIENT_NOT_FROM |
+			    SRVFLAG_LOCATION_FOUND |
 			    SRVFLAG_LOCATION_NOT_FOUND;
 
 			TAILQ_FOREACH(s, conf->sc_servers, srv_entry) {
@@ -651,7 +683,9 @@
 				    (s->srv_conf.flags & f) ==
 				    (srv_conf->flags & f) &&
 				    strcmp(s->srv_conf.location,
-				    srv_conf->location) == 0)
+				    srv_conf->location) == 0 &&
+				    clientfilter_cmp(s->srv_conf.clientfilter,
+				    srv_conf->clientfilter) == 0)
 					break;
 			}
 			if (s != NULL) {
@@ -692,6 +726,51 @@
 		| NOT FOUND	{ $$ = -1; }
 		;
 
+optclientfilter	: /* empty */			{
+			$$ = NULL;
+		}
+		| FROM clientfilters_l		{
+			char	*s;
+
+			if (asprintf(&s, "+%s", $2) == -1) {
+				yyerror("asprintf: \"+%s\"", $2);
+				free($2);
+				YYERROR;
+			}
+			free($2);
+			$$ = s;
+		}
+		| NOT FROM clientfilters_l	{
+			char	*s;
+
+			if (asprintf(&s, "-%s", $3) == -1) {
+				yyerror("asprintf: \"-%s\"", $3);
+				free($3);
+				YYERROR;
+			}
+			free($3);
+			$$ = s;
+		}
+		;
+
+clientfilters_l	: clientfilters_l STRING	{
+			char	*s;
+
+			if (asprintf(&s, "%s %s", $1, $2) == -1) {
+				yyerror("asprintf: \"%s %s\"", $1, $2);
+				free($1);
+				free($2);
+				YYERROR;
+			}
+			free($1);
+			free($2);
+			$$ = s;
+		}
+		| STRING			{
+			$$ = $1;
+		}
+		;
+
 hsts		: HSTS '{' optnl hstsflags_l '}'
 		| HSTS hstsflags
 		| HSTS
@@ -1425,6 +1504,168 @@
 };
 
 int
+normalize_addr(char *dst, const char *src, size_t dstsize)
+{
+	int		 bits, c, in6;
+	char		*d, *e;
+	const char	*errstr, *b;
+	size_t		 len;
+
+	in6 = strchr(src, ':') != NULL;
+	bits = (in6 ? sizeof(struct in6_addr) : sizeof(struct in_addr)) << 3;
+	/* prepare CIDR prefix length to be removed, if present */
+	d = strchr(src, '/');
+	e = d != NULL ? d : strchr(src, '\0');
+	if ((len = e - src) >= dstsize)
+		goto fail;
+
+	if (d != NULL) {
+		/* preserve CIDR prefix length to be returned later */
+		bits = strtonum(++d, 0, bits, &errstr);
+		if (errstr != NULL)
+			goto fail;
+
+	} else if (!in6) /* IPv4 only */
+		/* reduce auto CIDR prefix length by trailing zero octets */
+		while (--e >= src) {
+			while (*e == '0') /* zeros may repeat */
+				e--;
+			if (*e != '.')
+				break;
+			bits -= 8;
+		}
+
+	memcpy(dst, src, len);
+	dst[len] = '\0';
+
+	if (in6)
+		return (bits); /* leave IPv6 address as is */
+
+	/* append missing zero octets */
+	for (b = dst, c = 0;; b++, c++)
+		if ((b = strchr(b, '.')) == NULL)
+			break;
+	for (c = 3 - c; c > 0; c--) {
+		if (d == NULL) /* finalize auto IPv4 CIDR prefix length */
+			bits -= 8;
+		if (strlcat(dst, ".0", dstsize) >= dstsize)
+			goto fail;
+	}
+
+	return (bits);
+
+fail:
+	*dst = '\0';
+	return (-1);
+}
+
+struct addr_filter *
+build_clientfilter(struct server_config *sc, char *cfgstr)
+{
+	struct addr_filter	*clt_fltr = sc->clientfilter, rbuf;
+	size_t			 cfglen, span;
+	char			*cstr, buf[INET6_ADDRSTRLEN];
+	int			 i, bits, c, bytes, range;
+	unsigned char		*first, *last, b;
+
+	cfglen = strlen(cfgstr);
+	DPRINTF("%s: received \"%s\" len:%zu", __func__, cfgstr, cfglen);
+	for (cstr = cfgstr, i = 0, cfgstr += cfglen; cstr <= cfgstr &&
+	    (cstr = strpbrk(cstr, "0123456789AaBbCcDdEeFf:>")) != NULL;) {
+		if (i == HTTPD_CLIENT_FILTER_MAX) {
+			yyerror("too many client address filters");
+			return (NULL);
+		}
+		memset(&rbuf, 0, sizeof(rbuf));
+		if (*cstr == '>') {
+			rbuf.xff = 1;
+			cstr++;
+		}
+		span = strcspn(cstr, " \t");
+		cstr[span] = '\0';
+		if ((bits = normalize_addr(buf, cstr, sizeof(buf))) != -1 &&
+		    inet_pton(AF_INET, buf, &rbuf.first.ipv4) == 1) {
+			rbuf.family = AF_INET;
+			first = (unsigned char *)&rbuf.first.ipv4.s_addr;
+			last = (unsigned char *)&rbuf.last.ipv4.s_addr;
+			bytes = sizeof(struct in_addr);
+		} else if (bits != -1 &&
+		    inet_pton(AF_INET6, buf, &rbuf.first.ipv6) == 1) {
+			rbuf.family = AF_INET6;
+			first = (unsigned char *)&rbuf.first.ipv6.s6_addr;
+			last = (unsigned char *)&rbuf.last.ipv6.s6_addr;
+			bytes = sizeof(struct in6_addr);
+		} else {
+			yyerror("invalid client address filter: \"%s\"", cstr);
+			return (NULL);
+		}
+		range = bytes * 8 - bits;
+		rbuf.last = rbuf.first;
+		b = (1 << range % 8) - 1;
+		for (range /= 8; range; range--) {
+			first[--bytes] = 0x00;
+			last[bytes] = 0xff;
+		}
+		if (b) {
+			first[--bytes] &= ~b;
+			last[bytes] |= b;
+		}
+		for (c = i; c > 0;)
+			if (memcmp(&clt_fltr[--c], &rbuf, sizeof(rbuf)) == 0) {
+				DPRINTF("%s: skipping duplicate \"%s\"",
+				    __func__, cstr);
+				goto next;
+			}
+#if DEBUG
+		if (rbuf.family == AF_INET)
+			DPRINTF("%s: adding \"%s\" xff:%u family:%d bits:%d "
+			    "range:%08X...%08X",
+			    __func__, cstr, rbuf.xff, rbuf.family, bits,
+			    be32toh(rbuf.first.ipv4.s_addr),
+			    be32toh(rbuf.last.ipv4.s_addr));
+		else
+			DPRINTF("%s: adding \"%s\" xff:%u family:%d bits:%d "
+			    "range:%016llX%016llX...%016llX%016llX",
+			    __func__, cstr, rbuf.xff, rbuf.family, bits,
+			    be64toh(*(uint64_t *)rbuf.first.ipv6.s6_addr),
+			    be64toh(*(uint64_t *)&rbuf.first.ipv6.s6_addr[8]),
+			    be64toh(*(uint64_t *)rbuf.last.ipv6.s6_addr),
+			    be64toh(*(uint64_t *)&rbuf.last.ipv6.s6_addr[8]));
+#endif
+		clt_fltr[i++] = rbuf;
+next:
+		cstr += ++span;
+	}
+	if (i == 0) {
+		yyerror("empty client address filter");
+		return (NULL);
+	}
+	return (clt_fltr);
+}
+
+int
+clientfilter_cmp(struct addr_filter *a, struct addr_filter *b)
+{
+	int	 i, j, c;
+
+	for (i = 0; i < HTTPD_CLIENT_FILTER_MAX; i++) {
+		if (!a[i].family)
+			return (memcmp(&a[i], &b[i],
+			    sizeof(struct addr_filter)));
+
+		j = 0;
+		for (;;) {
+			c = memcmp(&a[i], &b[j], sizeof(struct addr_filter));
+			if (c == 0)
+				break;
+			if (!b[j].family || ++j == HTTPD_CLIENT_FILTER_MAX)
+				return (c);
+		}
+	}
+	return (0);
+}
+
+int
 yyerror(const char *fmt, ...)
 {
 	va_list		 ap;
@@ -1479,6 +1720,7 @@
 		{ "fastcgi",		FCGI },
 		{ "forwarded",		FORWARDED },
 		{ "found",		FOUND },
+		{ "from",		FROM },
 		{ "gzip-static",	GZIPSTATIC },
 		{ "hsts",		HSTS },
 		{ "include",		INCLUDE },
Index: usr.sbin/httpd/server_http.c
@@ -56,6 +56,8 @@
 char		*read_errdoc(const char *, const char *);
 int		 server_locationaccesstest(struct server_config *,
 		    const char *);
+int		 server_clientfilter(struct server_config *,
+		    struct server_client_addr *);
 
 static struct http_method	 http_methods[] = HTTP_METHODS;
 static struct http_error	 http_errors[] = HTTP_ERRORS;
@@ -1477,11 +1479,47 @@
 struct server_config *
 server_getlocation(struct client *clt, const char *path)
 {
+	struct kv			 key, *xff;
+	struct http_descriptor		*desc = clt->clt_descreq;
+	struct sockaddr_in		*sin;
+	struct sockaddr_in6		*sin6;
+	struct server_client_addr	 clt_addr;
+
 	struct server		*srv = clt->clt_srv;
 	struct server_config	*srv_conf = clt->clt_srv_conf, *location;
 	const char		*errstr = NULL;
 	int			 ret;
 
+	memset(&clt_addr, 0, sizeof(clt_addr));
+	key.kv_key = "X-Forwarded-For";
+	if ((xff = kv_find(&desc->http_headers, &key)) != NULL &&
+	    xff->kv_value != NULL) {
+		if (inet_pton(AF_INET, xff->kv_value,
+		    &clt_addr.xff.value.ipv4) == 1)
+			clt_addr.xff.family = AF_INET;
+		else if (inet_pton(AF_INET6, xff->kv_value,
+		    &clt_addr.xff.value.ipv6) == 1)
+			clt_addr.xff.family = AF_INET6;
+		else
+			return (NULL);
+	}
+	switch (clt->clt_ss.ss_family) {
+	case AF_INET:
+		sin = (struct sockaddr_in *)&clt->clt_ss;
+		clt_addr.srv.value.ipv4 = sin->sin_addr;
+		clt_addr.srv.family = AF_INET;
+		break;
+	case AF_INET6:
+		sin6 = (struct sockaddr_in6 *)&clt->clt_ss;
+		clt_addr.srv.value.ipv6 = sin6->sin6_addr;
+		clt_addr.srv.family = AF_INET6;
+		break;
+	default:
+		return (NULL);
+	}
+	if (!clt_addr.xff.family)
+		clt_addr.xff.family = clt_addr.srv.family;
+
 	/* Now search for the location */
 	TAILQ_FOREACH(location, &srv->srv_hosts, entry) {
 #ifdef DEBUG
@@ -1505,7 +1543,8 @@
 				    path)) == -1)
 					return (NULL);
 
-				if (ret)
+				if (ret || server_clientfilter(location,
+				    &clt_addr))
 					continue;
 				/* Replace host configuration */
 				clt->clt_srv_conf = srv_conf = location;
@@ -1537,6 +1576,66 @@
 	close(rootfd);
 	return ((ret == -1 && SRVFLAG_LOCATION_FOUND & srv_conf->flags) ||
 	    (ret == 0 && SRVFLAG_LOCATION_NOT_FOUND & srv_conf->flags));
+}
+
+int
+server_clientfilter(struct server_config *srv_conf,
+    struct server_client_addr *clt_addr)
+{
+	struct addr_filter	*clt_fltr;
+	int			 i;
+	struct client_addr	*caddr;
+
+	if (((SRVFLAG_CLIENT_FROM | SRVFLAG_CLIENT_NOT_FROM) &
+	    srv_conf->flags) == 0)
+		return (0);
+
+	for (clt_fltr = srv_conf->clientfilter, i = 0;
+	    i < HTTPD_CLIENT_FILTER_MAX && clt_fltr[i].family; i++) {
+		caddr = clt_fltr[i].xff ? &clt_addr->xff : &clt_addr->srv;
+		if (clt_fltr[i].family != caddr->family) {
+			DPRINTF("%s: family-mismatch: client:%u <-> range:%u",
+			    __func__, caddr->family, clt_fltr[i].family);
+			continue;
+		}
+#if DEBUG
+		if (caddr->family == AF_INET)
+			DPRINTF("%s: xff:%u family:%u client:%08X "
+			    "range:%08X...%08X",
+			    __func__, clt_fltr[i].xff, clt_fltr[i].family,
+			    be32toh(caddr->value.ipv4.s_addr),
+			    be32toh(clt_fltr[i].first.ipv4.s_addr),
+			    be32toh(clt_fltr[i].last.ipv4.s_addr));
+		else
+			DPRINTF("%s: xff:%u family:%u client:%016llX%016llX "
+			    "range:%016llX%016llX...%016llX%016llX",
+			    __func__, clt_fltr[i].xff, clt_fltr[i].family,
+			    be64toh(*(uint64_t *)
+			    caddr->value.ipv6.s6_addr),
+			    be64toh(*(uint64_t *)
+			    &caddr->value.ipv6.s6_addr[8]),
+			    be64toh(*(uint64_t *)
+			    clt_fltr[i].first.ipv6.s6_addr),
+			    be64toh(*(uint64_t *)
+			    &clt_fltr[i].first.ipv6.s6_addr[8]),
+			    be64toh(*(uint64_t *)
+			    clt_fltr[i].last.ipv6.s6_addr),
+			    be64toh(*(uint64_t *)
+			    &clt_fltr[i].last.ipv6.s6_addr[8]));
+#endif
+		if ((caddr->family == AF_INET &&
+		    memcmp(&caddr->value.ipv4, &clt_fltr[i].first.ipv4,
+		    sizeof(struct in_addr)) >= 0 &&
+		    memcmp(&caddr->value.ipv4, &clt_fltr[i].last.ipv4,
+		    sizeof(struct in_addr)) <= 0) ||
+		    (caddr->family == AF_INET6 &&
+		    memcmp(&caddr->value.ipv6, &clt_fltr[i].first.ipv6,
+		    sizeof(struct in6_addr)) >= 0 &&
+		    memcmp(&caddr->value.ipv6, &clt_fltr[i].last.ipv6,
+		    sizeof(struct in6_addr)) <= 0))
+			return ((SRVFLAG_CLIENT_FROM & srv_conf->flags) == 0);
+	}
+	return ((SRVFLAG_CLIENT_NOT_FROM & srv_conf->flags) == 0);
 }
 
 int