bytemark/flexnbd-c
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

acls: Add a default-deny option, which allows you to specify what an empty ACL means.

Browse Source 
When this option is specified, an empty ACL means "reject all clients". Without it,
an empty ACL means "accept all clients"
This commit is contained in:
nick
2012-06-01 14:48:34 +01:00
parent 71e755906b
commit 04d67b3bab
4 changed files with 41 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
src/serve.c
View File

@@ -452,6 +452,8 @@ void accept_nbd_client(struct mode_serve_params* params, int client_fd, union my
struct client_params* client_params;
int slot = cleanup_and_find_client_slot(params);
char s_client_address[64];
int acl_passed = 0;
if (inet_ntop(client_address->generic.sa_family, sockaddr_address_data(&client_address->generic), s_client_address, 64) == NULL) {
write(client_fd, "Bad client_address", 18);
@@ -459,12 +461,21 @@ void accept_nbd_client(struct mode_serve_params* params, int client_fd, union my
return;
}
if (params->acl &&
!is_included_in_acl(params->acl_entries, params->acl, client_address)) {
write(client_fd, "Access control error", 20);
close(client_fd);
return;
if (params->acl) {
if (is_included_in_acl(params->acl_entries, params->acl, client_address))
acl_passed = 1;
} else {
if (!params->default_deny)
acl_passed = 1;
}
if (!acl_passed) {
write(client_fd, "Access control error", 20);
close(client_fd);
return;
}
if (slot < 0) {
write(client_fd, "Too many clients", 16);