From fda8b94bdf5ebf5da8cbdd7a3a971df23022a3e4 Mon Sep 17 00:00:00 2001 From: Mark Spencer Date: Mon, 5 May 2003 06:14:25 +0000 Subject: Add access control to management interface git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@961 65c4cc65-6c06-0410-ace0-fbb531ad65f3 --- acl.c | 2 +- configs/manager.conf.sample | 2 ++ manager.c | 22 +++++++++++++++++++++- 3 files changed, 24 insertions(+), 2 deletions(-) diff --git a/acl.c b/acl.c index ae81cc913..9f876c90a 100755 --- a/acl.c +++ b/acl.c @@ -98,7 +98,7 @@ struct ast_ha *ast_append_ha(char *sense, char *stuff, struct ast_ha *path) else ret = ha; } - return NULL; + return ret; } int ast_apply_ha(struct ast_ha *ha, struct sockaddr_in *sin) diff --git a/configs/manager.conf.sample b/configs/manager.conf.sample index a55b9986f..4560904e2 100755 --- a/configs/manager.conf.sample +++ b/configs/manager.conf.sample @@ -8,5 +8,7 @@ bindaddr = 0.0.0.0 ;[mark] ;secret = mysecret +;deny=0.0.0.0/0.0.0.0 +;permit=209.16.236.73/255.255.255.0 ;read = system,call,log,verbose,command,agent,user ;write = system,call,log,verbose,command,agent,user diff --git a/manager.c b/manager.c index 3a2754d38..15b51681d 100755 --- a/manager.c +++ b/manager.c @@ -36,6 +36,7 @@ #include #include #include +#include static int enabled = 0; static int portno = DEFAULT_MANAGER_PORT; @@ -207,7 +208,26 @@ static int authenticate(struct mansession *s, struct message *m) if (strcasecmp(cat, "general")) { /* This is a user */ if (!strcasecmp(cat, user)) { - char *password = ast_variable_retrieve(cfg, cat, "secret"); + struct ast_variable *v; + struct ast_ha *ha = NULL; + char *password = NULL; + v = ast_variable_browse(cfg, cat); + while (v) { + if (!strcasecmp(v->name, "secret")) { + password = v->value; + } else if (!strcasecmp(v->name, "permit") || + !strcasecmp(v->name, "deny")) { + ha = ast_append_ha(v->name, v->value, ha); + } + v = v->next; + } + if (ha && !ast_apply_ha(ha, &(s->sin))) { + ast_log(LOG_NOTICE, "%s failed to pass IP ACL as '%s'\n", inet_ntoa(s->sin.sin_addr), user); + ast_free_ha(ha); + ast_destroy(cfg); + return -1; + } else if (ha) + ast_free_ha(ha); if (!strcasecmp(authtype, "MD5")) { if (key && strlen(key) && s->challenge) { int x; -- cgit v1.2.3