policy.h: Don't allow `user' actions in user policy files.

[yaid] / policy.c

/* -*-c-*-
 *
 * Policy parsing and implementation
 *
 * (c) 2012 Straylight/Edgeware
 */

/*----- Licensing notice --------------------------------------------------*
 *
 * This file is part of Yet Another Ident Daemon (YAID).
 *
 * YAID is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * YAID is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with YAID; if not, write to the Free Software Foundation,
 * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 */

/*----- Header files ------------------------------------------------------*/

#include "yaid.h"

/*----- Memory management -------------------------------------------------*/

/* Initialize a policy structure.  In this state, it doesn't actually have
 * any resources allocated (so can be simply discarded) but it's safe to free
 * (using `free_policy').
 */
void init_policy(struct policy *p) { p->act.act = A_LIMIT; }

/* Free an action structure, resetting it to a safe state.  This function is
 * idempotent.
 */
static void free_action(struct action *a)
{
  switch (a->act) {
    case A_LIE:
      xfree(a->u.lie);
      break;
  }
  a->act = A_LIMIT;
}

/* Free a policy structure, resetting it to its freshly-initialized state.
 * This function is idempotent.
 */
void free_policy(struct policy *p)
  { free_action(&p->act); }

/*----- Diagnostics -------------------------------------------------------*/

static void print_addrpat(const struct addrops *ao, const struct addrpat *ap)
{
  char buf[ADDRLEN];

  if (ap->len == 0)
    putchar('*');
  else {
    printf("%s/%u",
	   inet_ntop(ao->af, &ap->addr, buf, sizeof(buf)),
	   ap->len);
  }
}

static void print_portpat(const struct portpat *pp)
{
  if (pp->lo == 0 && pp->hi == 65535) putchar('*');
  else if (pp->lo == pp->hi) printf("%u", pp->lo);
  else printf("%u-%u", pp->lo, pp->hi);
}

static void print_sockpat(const struct addrops *ao, const struct sockpat *sp)
  { print_addrpat(ao, &sp->addr); putchar(' '); print_portpat(&sp->port); }

static const char *const acttab[] = {
#define DEFACT(tag, name) name,
  ACTIONS(DEFACT)
#undef DEFACT
  0
};

static void print_action(const struct action *act)
{
  assert(act->act < A_LIMIT);
  printf("%s", acttab[act->act]);
  switch (act->act) {
    case A_USER: {
      int i;
      unsigned m;
      for (i = 0, m = 1; i < A_LIMIT; i++, m <<= 1)
	if (act->u.user & m) printf(" %s", acttab[i]);
    } break;
    case A_LIE:
      printf(" %s", act->u.lie);
      break;
  }
}

/* Print a policy rule to standard output. */
void print_policy(const struct policy *p)
{
  print_sockpat(p->ao, &p->sp[L]); putchar(' ');
  print_sockpat(p->ao, &p->sp[R]); putchar(' ');
  print_action(&p->act); putchar('\n');
}

/*----- Matching ----------------------------------------------------------*/

/* Return true if the port matches the pattern. */
static int match_portpat(const struct portpat *pp, unsigned port)
  { return (pp->lo <= port && port <= pp->hi); }

/* Return true if the socket matches the pattern. */
static int match_sockpat(const struct addrops *ao,
			 const struct sockpat *sp, const struct socket *s)
{
  return (ao->match_addrpat(&sp->addr, &s->addr) &&
	  match_portpat(&sp->port, s->port));
}

/* Return true if the query matches the patterns in the policy rule. */
int match_policy(const struct policy *p, const struct query *q)
{
  return ((!p->ao || p->ao == q->ao) &&
	  match_sockpat(q->ao, &p->sp[L], &q->s[L]) &&
	  match_sockpat(q->ao, &p->sp[R], &q->s[R]));
}

/*----- Parsing -----------------------------------------------------------*/

/* Advance FP to the next line. */
static void nextline(FILE *fp)
{
  for (;;) {
    int ch = getc(fp);
    if (ch == '\n' || ch == EOF) break;
  }
}

/* Scan a whitespace-separated token from FP, writing it to BUF.  The token
 * must fit in a buffer of size SZ, including a terminating null.  Return
 * an appropriate T_* error code.
 */
static int scan(FILE *fp, char *buf, size_t sz)
{
  int ch;

skip_ws:
  /* Before we start grabbing a token proper, find out what's in store. */
  ch = getc(fp);
  switch (ch) {

    case '\n':
    newline:
      /* Found a newline.  Leave it where it is and report it. */
      ungetc(ch, fp);
      return (T_EOL);

    case EOF:
    eof:
      /* Found end-of-file, or an I/O error.  Return an appropriate code. */
      return (ferror(fp) ? T_ERROR : T_EOF);

    case '#':
      /* Found a comment.  Consume it, and continue appropriately: it must
       * be terminated either by a newline or end-of-file.
       */
      for (;;) {
	ch = getc(fp);
	if (ch == '\n') goto newline;
	else if (ch == EOF) goto eof;
      }

    default:
      /* Whitespace means we just continue around.  Anything else and we
       * start snarfing.
       */
      if (isspace(ch)) goto skip_ws;
      break;
  }

  for (;;) {

    /* If there's buffer space left, store the character. */
    if (sz) { *buf++ = ch; sz--; }

    /* Get a new one, and find out what to do about it. */
    ch = getc(fp);
    switch (ch) {
      case '\n':
	ungetc(ch, fp);
	goto done;
      case EOF:
	goto done;
      default:
	if (isspace(ch)) goto done;
	break;
    }
  }

done:
  /* If there's no space for a terminating null then report an error. */
  if (!sz) return (T_ERROR);

  /* All done. */
  *buf++ = 0; sz--;
  return (T_OK);
}

/* Parse an action name, storing the code in *ACT.  Return an appropriate T_*
 * code.
 */
static int parse_actname(FILE *fp, unsigned *act)
{
  char buf[32];
  int t;
  const char *const *p;

  if ((t = scan(fp, buf, sizeof(buf))) != 0) return (t);
  for (p = acttab; *p; p++)
    if (strcmp(buf, *p) == 0) { *act = p - acttab; return (0); }
  return (T_ERROR);
}

/* Parse an action, returning a T_* code. */
static int parse_action(FILE *fp, struct action *act)
{
  char buf[32];
  int t;
  unsigned a;
  unsigned long m;

  /* Collect the action name. */
  if ((t = parse_actname(fp, &a)) != 0) return (t);

  /* Parse parameters, if there are any. */
  switch (a) {

    case A_USER:
      /* `user ACTION ACTION ...': store permitted actions in a bitmask. */
      m = 0;
      for (;;) {
	if ((t = parse_actname(fp, &a)) != 0) break;
	if (a == A_USER) return (T_ERROR);
	m |= (1 << a);
      }
      if (t != T_EOL && t != T_EOF) return (t);
      act->act = A_USER;
      act->u.user = m;
      break;

    case A_TOKEN:
    case A_NAME:
    case A_DENY:
    case A_HIDE:
      /* Dull actions which don't accept parameters. */
      act->act = a;
      break;

    case A_LIE:
      /* `lie NAME': store the string we're to report. */
      if ((t = scan(fp, buf, sizeof(buf))) != 0) return (t);
      act->act = a;
      act->u.lie = xstrdup(buf);
      break;
  }

  /* Make sure we've reached the end of the line. */
  t = scan(fp, buf, sizeof(buf));
  if (t != T_EOF && t != T_EOL) {
    free_action(act);
    return (T_ERROR);
  }

  /* Done. */
  return (0);
}

/* Parse an address pattern, writing it to AP.  If the pattern has an
 * identifiable address family, update *AOP to point to its operations table;
 * if *AOP is already set to something different then report an error.
 */
static int parse_addrpat(FILE *fp, const struct addrops **aop,
			 struct addrpat *ap)
{
  char buf[64];
  int t;
  const struct addrops *ao;
  long n;
  char *delim;

  /* Scan a token for the address pattern. */
  if ((t = scan(fp, buf, sizeof(buf))) != 0) return (t);

  /* If this is a wildcard, then leave everything as it is. */
  if (strcmp(buf, "*") == 0) {
    ap->len = 0;
    return (T_OK);
  }

  /* Decide what kind of address this must be.  A bit grim, sorry. */
  if (strchr(buf, ':'))
    ao = &addroptab[ADDR_IPV6];
  else
    ao = &addroptab[ADDR_IPV4];

  /* Update the caller's idea of the address family in use. */
  if (!*aop) *aop = ao;
  else if (*aop != ao) return (T_ERROR);

  /* See whether there's a prefix length.  If so, clobber it. */
  delim = strchr(buf, '/');
  if (delim) *delim++ = 0;

  /* Parse the address. */
  if (!inet_pton(ao->af, buf, &ap->addr)) return (T_ERROR);

  /* Parse the prefix length, or use the maximum one. */
  if (!delim) n = ao->len;
  else n = strtol(delim, 0, 10);
  if (n < 0 || n > ao->len) return (T_ERROR);
  ap->len = n;

  /* Done. */
  return (T_OK);
}

static int parse_portpat(FILE *fp, struct portpat *pp)
{
  char buf[64];
  int t;
  long n;
  char *delim;

  /* Parse a token for the pattern. */
  if ((t = scan(fp, buf, sizeof(buf))) != 0) return (T_ERROR);

  /* If this is a wildcard, then we're done. */
  if (strcmp(buf, "*") == 0) {
    pp->lo = 0;
    pp->hi = 65535;
    return (T_OK);
  }

  /* Find a range delimiter. */
  delim = strchr(buf, '-');
  if (delim) *delim++ = 0;

  /* Parse the only or low end of the range. */
  n = strtol(buf, 0, 0);
  if (n < 0 || n > 65535) return (T_ERROR);
  pp->lo = n;

  /* If there's no delimiter, then the high end is equal to the low end;
   * otherwise, parse the high end.
   */
  if (!delim)
    pp->hi = n;
  else {
    n = strtol(delim, 0, 0);
    if (n < pp->lo || n > 65535) return (T_ERROR);
    pp->hi = n;
  }

  /* Done. */
  return (T_OK);
}

/* Parse a socket pattern, writing it to SP. */
static int parse_sockpat(FILE *fp, const struct addrops **aop,
			 struct sockpat *sp)
{
  int t;

  if ((t = parse_addrpat(fp, aop, &sp->addr)) != 0) return (t);
  if ((t = parse_portpat(fp, &sp->port)) != 0) return (T_ERROR);
  return (T_OK);
}

/* Parse a policy rule line, writing it to P. */
static int parse_policy(FILE *fp, struct policy *p)
{
  int t;

  p->ao = 0;
  free_policy(p);

  if ((t = parse_sockpat(fp, &p->ao, &p->sp[L])) != 0) goto fail;
  if ((t = parse_sockpat(fp, &p->ao, &p->sp[R])) != 0) goto err;
  if ((t = parse_action(fp, &p->act)) != 0) goto err;
  return (0);

err:
  t = T_ERROR;
fail:
  free_policy(p);
  return (t);
}

/* Open a policy file by NAME.  The description WHAT and query Q are used for
 * formatting error messages for the log.
 */
int open_policy_file(struct policy_file *pf, const char *name,
		     const char *what, const struct query *q)
{
  if ((pf->fp = fopen(name, "r")) == 0) {
    logmsg(q, LOG_ERR, "failed to open %s `%s': %s",
	   what, name, strerror(errno));
    return (-1);
  }

  pf->name = name;
  pf->what = what;
  pf->q = q;
  pf->err = 0;
  pf->lno = 0;
  init_policy(&pf->p);
  return (0);
}

/* Read a policy rule from the file, storing it in PF->p.  Return one of the
 * T_* codes.
 */
int read_policy_file(struct policy_file *pf)
{
  int t;

  for (;;) {
    pf->lno++;
    t = parse_policy(pf->fp, &pf->p);
    switch (t) {
      case T_OK:
	nextline(pf->fp);
	return (0);
      case T_ERROR:
	logmsg(pf->q, LOG_ERR, "%s:%d: parse error in %s",
	       pf->name, pf->lno, pf->what);
	pf->err = 1;
	break;
      case T_EOF:
	if (ferror(pf->fp)) {
	  logmsg(pf->q, LOG_ERR, "failed to read %s `%s': %s",
		 pf->what, pf->name, strerror(errno));
	}
	return (-1);
      case T_EOL:
	nextline(pf->fp);
	break;
      default:
	abort();
    }
  }
}

/* Close a policy file.  It doesn't matter whether the file was completely
 * read.
 */
void close_policy_file(struct policy_file *pf)
{
  fclose(pf->fp);
  free_policy(&pf->p);
}

/* Load a policy file, writing a vector of records into PV.  If the policy
 * file has errors, then leave PV unchanged and return nonzero.
 */
int load_policy_file(const char *file, policy_v *pv)
{
  struct policy_file pf;
  policy_v v = DA_INIT;

  if (open_policy_file(&pf, file, "policy file", 0))
    return (-1);
  while (!read_policy_file(&pf)) {
    DA_PUSH(&v, pf.p);
    init_policy(&pf.p);
  }
  close_policy_file(&pf);
  if (!pf.err) {
    DA_DESTROY(pv);
    *pv = v;
    return (0);
  } else {
    DA_DESTROY(&v);
    return (-1);
  }
}

/*----- That's all, folks -------------------------------------------------*/