Add mg_check_ip_acl()

src/util.c

@@ -127,7 +127,7 @@ uint32_t mg_ntohl(uint32_t net) {
 uint16_t mg_ntohs(uint16_t net) {
   uint8_t data[2] = {0, 0};
   memcpy(&data, &net, sizeof(data));
-  return (uint16_t)((uint16_t) data[1] | (((uint16_t) data[0]) << 8));
+  return (uint16_t) ((uint16_t) data[1] | (((uint16_t) data[0]) << 8));
 }
 
 char *mg_hexdump(const void *buf, size_t len) {
@@ -170,10 +170,9 @@ char *mg_hex(const void *buf, size_t len, char *to) {
 }
 
 static unsigned char mg_unhex_nimble(unsigned char c) {
-  return (c >= '0' && c <= '9')
-             ? (unsigned char) (c - '0')
-             : (c >= 'A' && c <= 'F') ? (unsigned char) (c - '7')
-                                      : (unsigned char) (c - 'W');
+  return (c >= '0' && c <= '9')   ? (unsigned char) (c - '0')
+         : (c >= 'A' && c <= 'F') ? (unsigned char) (c - '7')
+                                  : (unsigned char) (c - 'W');
 }
 
 unsigned long mg_unhexn(const char *s, size_t len) {
@@ -266,6 +265,36 @@ uint32_t mg_crc32(uint32_t crc, const char *buf, size_t len) {
   return ~crc;
 }
 
+static int isbyte(int n) {
+  return n >= 0 && n <= 255;
+}
+
+static int parse_net(const char *spec, uint32_t *net, uint32_t *mask) {
+  int n, a, b, c, d, slash = 32, len = 0;
+  if ((sscanf(spec, "%d.%d.%d.%d/%d%n", &a, &b, &c, &d, &slash, &n) == 5 ||
+       sscanf(spec, "%d.%d.%d.%d%n", &a, &b, &c, &d, &n) == 4) &&
+      isbyte(a) && isbyte(b) && isbyte(c) && isbyte(d) && slash >= 0 &&
+      slash < 33) {
+    len = n;
+    *net = ((uint32_t) a << 24) | ((uint32_t) b << 16) | ((uint32_t) c << 8) |
+           (uint32_t) d;
+    *mask = slash ? (uint32_t) (0xffffffffU << (32 - slash)) : (uint32_t) 0;
+  }
+  return len;
+}
+
+int mg_check_ip_acl(struct mg_str acl, uint32_t remote_ip) {
+  struct mg_str k, v;
+  int allowed = acl.len == 0 ? '+' : '-';  // If any ACL is set, deny by default
+  while (mg_comma(&acl, &k, &v)) {
+    uint32_t net, mask;
+    if (k.ptr[0] != '+' && k.ptr[0] != '-') return -1;
+    if (parse_net(&k.ptr[1], &net, &mask) == 0) return -2;
+    if ((remote_ip & mask) == net) allowed = k.ptr[0];
+  }
+  return allowed == '+';
+}
+
 double mg_time(void) {
 #if MG_ARCH == MG_ARCH_WIN32
   SYSTEMTIME sysnow;

src/util.h

@@ -19,6 +19,7 @@ unsigned long mg_unhexn(const char *s, size_t len);
 int mg_asprintf(char **buf, size_t size, const char *fmt, ...);
 int mg_vasprintf(char **buf, size_t size, const char *fmt, va_list ap);
 int64_t mg_to64(struct mg_str str);
+int mg_check_ip_acl(struct mg_str acl, uint32_t remote_ip);
 double mg_time(void);
 unsigned long mg_millis(void);
 void mg_usleep(unsigned long usecs);