This file is indexed.

/usr/include/ptclib/ipacl.h is in libpt-dev 2.10.11~dfsg-2.1.

This file is owned by root:root, with mode 0o644.

The actual contents of the file can be viewed below.

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
/*
 * ipacl.h
 *
 * IP Access Control Lists
 *
 * Portable Windows Library
 *
 * Copyright (c) 1998-2002 Equivalence Pty. Ltd.
 *
 * The contents of this file are subject to the Mozilla Public License
 * Version 1.0 (the "License"); you may not use this file except in
 * compliance with the License. You may obtain a copy of the License at
 * http://www.mozilla.org/MPL/
 *
 * Software distributed under the License is distributed on an "AS IS"
 * basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
 * the License for the specific language governing rights and limitations
 * under the License.
 *
 * The Original Code is Portable Windows Library.
 *
 * The Initial Developer of the Original Code is Equivalence Pty. Ltd.
 *
 * Contributor(s): ______________________________________.
 *
 * $Revision: 24177 $
 * $Author: rjongbloed $
 * $Date: 2010-04-05 06:52:04 -0500 (Mon, 05 Apr 2010) $
 */

#ifndef PTLIB_IPACL_H
#define PTLIB_IPACL_H


#include <ptlib/sockets.h>


/** This class is a single IP access control specification.
 */
class PIpAccessControlEntry : public PObject
{
  PCLASSINFO(PIpAccessControlEntry, PObject)

  public:
    /** Create a new IP access control specification. See the Parse() function
       for more details on the format of the <CODE>description</CODE>
       parameter.
     */
    PIpAccessControlEntry(
      PIPSocket::Address addr,
      PIPSocket::Address msk,
      PBoolean allow
    );
    PIpAccessControlEntry(
      const PString & description
    );

    /** Set a new IP access control specification. See the Parse() function
       for more details on the format of the <CODE>pstr</CODE> and
       <CODE>cstr</CODE> parameters.
     */
    PIpAccessControlEntry & operator=(
      const PString & pstr
    );
    PIpAccessControlEntry & operator=(
      const char * cstr
    );

    /** Compare the two objects and return their relative rank.

       @return
       <CODE>LessThan</CODE>, <CODE>EqualTo</CODE> or <CODE>GreaterThan</CODE>
       according to the relative rank of the objects.
     */
    virtual Comparison Compare(
      const PObject & obj   ///< Object to compare against.
    ) const;

    /** Output the contents of the object to the stream. This outputs the same
       format as the AsString() function.
     */
    virtual void PrintOn(
      ostream &strm   ///< Stream to print the object into.
    ) const;

    /** Input the contents of the object from the stream. This expects the
       next space delimited entry in the stream to be as described in the
       Parse() function.
     */
    virtual void ReadFrom(
      istream &strm   ///< Stream to read the objects contents from.
    );

    /** Convert the specification to a string, that can be processed by the
       Parse() function.

       @return
       PString representation of the entry.
     */
    PString AsString() const;

    /** Check the internal fields of the specification for validity.

       @return
       true if entry is valid.
     */
    PBoolean IsValid();

    /** Parse the description string into this IP access control specification.
       The string may be of several forms:
          n.n.n.n         Simple IP number, this has an implicit mask of
                          255.255.255.255
          n.n.            IP with trailing dot, assumes a mask equal to the
                          number of specified octets eg 10.1. is equivalent
                          to 10.1.0.0/255.255.0.0
          n.n.n.n/b       An IP network using b bits of mask, for example
                          10.1.0.0/14 is equivalent to 10.0.1.0/255.248.0.0
          n.n.n.n/m.m.m.m An IP network using the specified mask
          hostname        A specific host name, this has an implicit mask of
                          255.255.255.255
          .domain.dom     Matches an IP number whose cannonical name (found
                          using a reverse DNS lookup) ends with the specified
                          domain.

       @return
       true if entry is valid.
     */
    PBoolean Parse(
      const PString & description   ///< Description of the specification
    );


    /** Check to see if the specified IP address match any of the conditions
       specifed in the Parse() function for this entry.

       @return
       true if entry can match the address.
     */
    PBoolean Match(
      PIPSocket::Address & address    ///< Address to search for
    );

    /**Get the domain part of entry.
      */
    const PString & GetDomain() const { return domain; }

    /**Get the address part of entry.
      */
    const PIPSocket::Address & GetAddress() const { return address; }

    /**Get the mask part of entry.
      */
    const PIPSocket::Address & GetMask() const { return mask; }

    /**Get the allowed flag of entry.
      */
    PBoolean IsAllowed() const { return allowed; }

    /**Get the hidden flag of entry.
      */
    PBoolean IsHidden()  const { return hidden; }

  protected:
    PString            domain;
    PIPSocket::Address address;
    PIPSocket::Address mask;
    PBoolean               allowed;
    PBoolean               hidden;
};

PSORTED_LIST(PIpAccessControlList_base, PIpAccessControlEntry);


/** This class is a list of IP address mask specifications used to validate if
   an address may or may not be used in a connection.

   The list may be totally internal to the application, or may use system
   wide files commonly use under Linux (hosts.allow and hosts.deny file). These
   will be used regardless of the platform.

   When a search is done using IsAllowed() function, the first entry that
   matches the specified IP address is found, and its allow flag returned. The
   list sorted so that the most specific IP number specification is first and
   the broadest onse later. The entry with the value having a mask of zero,
   that is the match all entry, is always last.
 */
class PIpAccessControlList : public PIpAccessControlList_base
{

  PCLASSINFO(PIpAccessControlList, PIpAccessControlList_base)

  public:
    /** Create a new, empty, access control list.
     */
    PIpAccessControlList(
      PBoolean defaultAllowance = true
    );

    /** Load the system wide files commonly use under Linux (hosts.allow and
       hosts.deny file) for IP access. See the Linux man entries on these
       files for more information. Note, these files will be loaded regardless
       of the actual platform used. The directory returned by the
       PProcess::GetOSConfigDir() function is searched for the files.

       The <CODE>daemonName</CODE> parameter is used as the search argument in
       the hosts.allow/hosts.deny file. If this is NULL then the
       PProcess::GetName() function is used.

       @return
       true if all the entries in the file were added, if any failed then
       false is returned.
     */
    PBoolean LoadHostsAccess(
      const char * daemonName = NULL    ///< Name of "daemon" application
    );

#ifdef P_CONFIG_FILE

    /** Load entries in the list from the configuration file specified. This is
       equivalent to Load(cfg, "IP Access Control List").

       @return
       true if all the entries in the file were added, if any failed then
       false is returned.
     */
    PBoolean Load(
      PConfig & cfg   ///< Configuration file to load entries from.
    );

    /** Load entries in the list from the configuration file specified, using
       the base name for the array of configuration file values. The format of
       entries in the configuration file are suitable for use with the
       PHTTPConfig classes.

       @return
       true if all the entries in the file were added, if any failed then
       false is returned.
     */
    PBoolean Load(
      PConfig & cfg,            ///< Configuration file to load entries from.
      const PString & baseName  ///< Base name string for each entry in file.
    );

    /** Save entries in the list to the configuration file specified. This is
       equivalent to Save(cfg, "IP Access Control List").
     */
    void Save(
      PConfig & cfg   ///< Configuration file to save entries to.
    );

    /** Save entries in the list to the configuration file specified, using
       the base name for the array of configuration file values. The format of
       entries in the configuration file are suitable for use with the
       PHTTPConfig classes.
     */
    void Save(
      PConfig & cfg,            ///< Configuration file to save entries to.
      const PString & baseName  ///< Base name string for each entry in file.
    );

#endif // P_CONFIG_FILE

    /** Add the specified entry into the list. See the PIpAccessControlEntry
       class for more details on the format of the <CODE>description</CODE>
       field.

       @return
       true if the entries was successfully added.
     */
    PBoolean Add(
      PIpAccessControlEntry * entry ///< Entry for IP match parameters
    );
    PBoolean Add(
      const PString & description   ///< Description of the IP match parameters
    );
    PBoolean Add(
      PIPSocket::Address address,   ///< IP network address
      PIPSocket::Address mask,      ///< Mask for IP network
      PBoolean allow                    ///< Flag for if network is allowed or not
    );

    /** Remove the specified entry into the list. See the PIpAccessControlEntry
       class for more details on the format of the <CODE>description</CODE>
       field.

       @return
       true if the entries was successfully removed.
     */
    PBoolean Remove(
      const PString & description   ///< Description of the IP match parameters
    );
    PBoolean Remove(
      PIPSocket::Address address,   ///< IP network address
      PIPSocket::Address mask       ///< Mask for IP network
    );


    /**Create a new PIpAccessControl specification entry object.
       This may be used by an application to create descendents of
       PIpAccessControlEntry when extra information/functionality is required.

       The default behaviour creates a PIpAccessControlEntry.
      */
    virtual PIpAccessControlEntry * CreateControlEntry(
      const PString & description
    );

    /**Find the PIpAccessControl specification for the address.
      */
    PIpAccessControlEntry * Find(
      PIPSocket::Address address    ///< IP Address to find
    ) const;

    /** Test the address/connection for if it is allowed within this access
       control list. If the <CODE>socket</CODE> form is used the peer address
       of the connection is tested.

       If the list is empty then true is returned. If the list is not empty,
       but the IP address does not match any entries in the list, then false
       is returned. If a match is made then the allow state of that entry is
       returned.

       @return
       true if the remote host address is allowed.
     */
    PBoolean IsAllowed(
      PTCPSocket & socket           ///< Socket to test
    ) const;
    PBoolean IsAllowed(
      PIPSocket::Address address    ///< IP Address to test
    ) const;


    /**Get the default state for allowed access if the list is empty.
      */
    PBoolean GetDefaultAllowance() const { return defaultAllowance; }

    /**Set the default state for allowed access if the list is empty.
      */
    void SetDefaultAllowance(PBoolean defAllow) { defaultAllowance = defAllow; }

  private:
    PBoolean InternalLoadHostsAccess(const PString & daemon, const char * file, PBoolean allow);
    PBoolean InternalRemoveEntry(PIpAccessControlEntry & entry);

  protected:
    PBoolean defaultAllowance;
};


#endif  // PTLIB_IPACL_H


// End of File ///////////////////////////////////////////////////////////////