/* -*-c-*-
*
- * $Id: rule.c,v 1.1 1997/07/21 13:47:45 mdw Exp $
+ * $Id: rule.c,v 1.2 1997/08/04 10:24:25 mdw Exp $
*
* Managing rule sets
*
* (c) 1997 EBI
*/
-/*----- Licencing notice --------------------------------------------------*
+/*----- Licensing notice --------------------------------------------------*
*
* This file is part of `become'
*
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
- * along with `become'; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ * along with `become'; if not, write to the Free Software Foundation,
+ * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
*/
/*----- Revision history --------------------------------------------------*
*
* $Log: rule.c,v $
- * Revision 1.1 1997/07/21 13:47:45 mdw
+ * Revision 1.2 1997/08/04 10:24:25 mdw
+ * Sources placed under CVS control.
+ *
+ * Revision 1.1 1997/07/21 13:47:45 mdw
* Initial revision
*
*/
#include <stdlib.h>
#include <string.h>
+/* --- Unix headers --- */
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <netdb.h>
+#include <unistd.h>
+
/* --- Local headers --- */
#include "become.h"
#include "class.h"
#include "rule.h"
+#include "userdb.h"
#include "utils.h"
/*----- Type definitions --------------------------------------------------*/
int rule_check(request *r)
{
- rule *rr = rule__list;
+ rule *rr;
+
+ /* --- Trace out the request we're checking --- */
+
+ IF_TRACING(TRACE_CHECK, {
+ struct passwd *pw_from = userdb_userById(r->from);
+ struct passwd *pw_to = userdb_userById(r->to);
+ struct hostent *h = gethostbyaddr((char *)&r->host, sizeof(r->host),
+ AF_INET);
+
+ trace(TRACE_CHECK, "check: request from %s (%li) to become %s (%li)",
+ pw_from ? pw_from->pw_name : "<unknown>", (long)r->from,
+ pw_to ? pw_to->pw_name : "<unknown>", (long)r->to);
+ trace(TRACE_CHECK, "check: ... at %s (%s) for `%s'",
+ h ? h->h_name : "<unknown>", inet_ntoa(r->host), r->cmd);
+ })
+
+ /* --- Search the rule list --- */
+
+ for (rr = rule__list; rr; rr = rr->next) {
+
+ /* --- Trace out the rule --- */
+
+ IF_TRACING(TRACE_RULE, {
+ trace(TRACE_RULE, "rule: check against rule...");
+ trace(TRACE_RULE, " from"); class_dump(rr->from);
+ trace(TRACE_RULE, " to"); class_dump(rr->to);
+ trace(TRACE_RULE, " cmd"); class_dump(rr->cmd);
+ trace(TRACE_RULE, " host"); class_dump(rr->host);
+ })
+
+ /* --- Check the rule --- */
- while (rr) {
if (class_userMatch(rr->from, r->from) &&
class_userMatch(rr->to, r->to) &&
class_commandMatch(rr->cmd, r->cmd) &&
- class_hostMatch(rr->host, r->host))
+ class_hostMatch(rr->host, r->host)) {
+ T( trace(TRACE_CHECK, "check: rule matched -- granting permission"); )
return (1);
- rr = rr->next;
+ }
}
+
+ /* --- Failed to match --- */
+
+ T( trace(TRACE_CHECK, "check: no rules matched -- permission denied"); )
return (0);
}
+/* --- @rule_dump@ --- *
+ *
+ * Arguments: ---
+ *
+ * Returns: ---
+ *
+ * Use: Dumps a map of the current ruleset to the trace output.
+ */
+
+void rule_dump(void)
+{
+ rule *rr = rule__list;
+
+ trace(TRACE_RULE, "rule: dumping rules");
+ while (rr) {
+ trace(TRACE_RULE, "rule dump...");
+ trace(TRACE_RULE, " from"); class_dump(rr->from);
+ trace(TRACE_RULE, " to"); class_dump(rr->to);
+ trace(TRACE_RULE, " cmd"); class_dump(rr->cmd);
+ trace(TRACE_RULE, " host"); class_dump(rr->host);
+ rr = rr->next;
+ }
+ trace(TRACE_RULE, "rule: dump finished");
+}
+
/*----- That's all, folks -------------------------------------------------*/