Both.
Federal law controls automatic weapons but it is possible to own them after jumping through the proper hoops.
Other things can be had as well.
ie. I met a man once with a 30mm anti tank rifle that the Fins made to fight the Russians.
It was classified as a destructive device and there were other requirements as far as I know.
states and cities can enact their own controls.
An example of a city is NY, NY.
no firearms
here is a decent (omg this shit can be confusing) link
http://forums.impactguns.com/archive...php/t-293.html
as you may have figured out, much of the control comes from it just being such a damn pain in the ass.