3 * Policy parsing and implementation
5 * (c) 2012 Straylight/Edgeware
8 /*----- Licensing notice --------------------------------------------------*
10 * This file is part of Yet Another Ident Daemon (YAID).
12 * YAID is free software; you can redistribute it and/or modify
13 * it under the terms of the GNU General Public License as published by
14 * the Free Software Foundation; either version 2 of the License, or
15 * (at your option) any later version.
17 * YAID is distributed in the hope that it will be useful,
18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 * GNU General Public License for more details.
22 * You should have received a copy of the GNU General Public License
23 * along with YAID; if not, write to the Free Software Foundation,
24 * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
27 /*----- Header files ------------------------------------------------------*/
31 /*----- Memory management -------------------------------------------------*/
33 /* Initialize a policy structure. In this state, it doesn't actually have
34 * any resources allocated (so can be simply discarded) but it's safe to free
35 * (using `free_policy').
37 void init_policy(struct policy
*p
) { p
->act
.act
= A_LIMIT
; }
39 /* Free an action structure, resetting it to a safe state. This function is
42 static void free_action(struct action
*a
)
52 /* Free a policy structure, resetting it to its freshly-initialized state.
53 * This function is idempotent.
55 void free_policy(struct policy
*p
)
56 { free_action(&p
->act
); }
58 /*----- Diagnostics -------------------------------------------------------*/
60 static void print_addrpat(const struct addrops
*ao
, const struct addrpat
*ap
)
68 inet_ntop(ao
->af
, &ap
->addr
, buf
, sizeof(buf
)),
73 static void print_portpat(const struct portpat
*pp
)
75 if (pp
->lo
== 0 && pp
->hi
== 65535) putchar('*');
76 else if (pp
->lo
== pp
->hi
) printf("%u", pp
->lo
);
77 else printf("%u-%u", pp
->lo
, pp
->hi
);
80 static void print_sockpat(const struct addrops
*ao
, const struct sockpat
*sp
)
81 { print_addrpat(ao
, &sp
->addr
); putchar(' '); print_portpat(&sp
->port
); }
83 static void print_userpat(const struct userpat
*up
)
85 if (up
->lo
== up
->hi
) printf("%d", up
->lo
);
86 else printf("%u-%u", up
->lo
, up
->hi
);
89 static const char *const acttab
[] = {
90 #define DEFACT(tag, name) name,
96 static void print_action(const struct action
*act
)
98 assert(act
->act
< A_LIMIT
);
99 printf("%s", acttab
[act
->act
]);
104 for (i
= 0, m
= 1; i
< A_LIMIT
; i
++, m
<<= 1)
105 if (act
->u
.user
& m
) printf(" %s", acttab
[i
]);
108 printf(" %s", act
->u
.lie
);
113 /* Print a policy rule to standard output. */
114 void print_policy(const struct policy
*p
)
116 print_sockpat(p
->ao
, &p
->sp
[L
]); putchar(' ');
117 print_sockpat(p
->ao
, &p
->sp
[R
]); putchar(' ');
118 print_userpat(&p
->up
); putchar(' ');
119 print_action(&p
->act
); putchar('\n');
122 /*----- Matching ----------------------------------------------------------*/
124 /* Return true if the port matches the pattern. */
125 static int match_portpat(const struct portpat
*pp
, unsigned port
)
126 { return (pp
->lo
<= port
&& port
<= pp
->hi
); }
128 /* Return true if the socket matches the pattern. */
129 static int match_sockpat(const struct addrops
*ao
,
130 const struct sockpat
*sp
, const struct socket
*s
)
132 return (ao
->match_addrpat(&sp
->addr
, &s
->addr
) &&
133 match_portpat(&sp
->port
, s
->port
));
136 /* Return true if the uid matches the pattern. */
137 static int match_userpat(const struct userpat
*up
, uid_t u
)
138 { unsigned uu
= u
; return (up
->lo
<= uu
&& uu
<= up
->hi
); }
140 /* Return true if the query matches the patterns in the policy rule. */
141 int match_policy(const struct policy
*p
, const struct query
*q
)
143 return ((!p
->ao
|| p
->ao
== q
->ao
) &&
144 match_sockpat(q
->ao
, &p
->sp
[L
], &q
->s
[L
]) &&
145 match_sockpat(q
->ao
, &p
->sp
[R
], &q
->s
[R
]) &&
146 match_userpat(&p
->up
, q
->u
.uid
));
149 /*----- Parsing -----------------------------------------------------------*/
151 /* Advance FP to the next line. */
152 static void nextline(FILE *fp
)
156 if (ch
== '\n' || ch
== EOF
) break;
160 /* Scan a whitespace-separated token from FP, writing it to BUF. The token
161 * must fit in a buffer of size SZ, including a terminating null. Return
162 * an appropriate T_* error code.
164 static int scan(FILE *fp
, char *buf
, size_t sz
)
169 /* Before we start grabbing a token proper, find out what's in store. */
175 /* Found a newline. Leave it where it is and report it. */
181 /* Found end-of-file, or an I/O error. Return an appropriate code. */
182 return (ferror(fp
) ? T_ERROR
: T_EOF
);
185 /* Found a comment. Consume it, and continue appropriately: it must
186 * be terminated either by a newline or end-of-file.
190 if (ch
== '\n') goto newline
;
191 else if (ch
== EOF
) goto eof
;
195 /* Whitespace means we just continue around. Anything else and we
198 if (isspace(ch
)) goto skip_ws
;
204 /* If there's buffer space left, store the character. */
205 if (sz
) { *buf
++ = ch
; sz
--; }
207 /* Get a new one, and find out what to do about it. */
216 if (isspace(ch
)) goto done
;
222 /* If there's no space for a terminating null then report an error. */
223 if (!sz
) return (T_ERROR
);
230 /* Parse an action name, storing the code in *ACT. Return an appropriate T_*
233 static int parse_actname(FILE *fp
, unsigned *act
)
237 const char *const *p
;
239 if ((t
= scan(fp
, buf
, sizeof(buf
))) != 0) return (t
);
240 for (p
= acttab
; *p
; p
++)
241 if (strcmp(buf
, *p
) == 0) { *act
= p
- acttab
; return (0); }
245 /* Parse an action, returning a T_* code. */
246 static int parse_action(FILE *fp
, struct action
*act
)
253 /* Collect the action name. */
254 if ((t
= parse_actname(fp
, &a
)) != 0) return (t
);
256 /* Parse parameters, if there are any. */
260 /* `user ACTION ACTION ...': store permitted actions in a bitmask. */
263 if ((t
= parse_actname(fp
, &a
)) != 0) break;
264 if (a
== A_USER
) return (T_ERROR
);
267 if (t
!= T_EOL
&& t
!= T_EOF
) return (t
);
276 /* Dull actions which don't accept parameters. */
281 /* `lie NAME': store the string we're to report. */
282 if ((t
= scan(fp
, buf
, sizeof(buf
))) != 0) return (t
);
284 act
->u
.lie
= xstrdup(buf
);
288 /* Make sure we've reached the end of the line. */
289 t
= scan(fp
, buf
, sizeof(buf
));
290 if (t
!= T_EOF
&& t
!= T_EOL
) {
299 /* Parse an address pattern, writing it to AP. If the pattern has an
300 * identifiable address family, update *AOP to point to its operations table;
301 * if *AOP is already set to something different then report an error.
303 static int parse_addrpat(FILE *fp
, const struct addrops
**aop
,
308 const struct addrops
*ao
;
312 /* Scan a token for the address pattern. */
313 if ((t
= scan(fp
, buf
, sizeof(buf
))) != 0) return (t
);
315 /* If this is a wildcard, then leave everything as it is. */
316 if (strcmp(buf
, "*") == 0) {
321 /* Decide what kind of address this must be. A bit grim, sorry. */
322 if (strchr(buf
, ':'))
323 ao
= &addroptab
[ADDR_IPV6
];
325 ao
= &addroptab
[ADDR_IPV4
];
327 /* Update the caller's idea of the address family in use. */
328 if (!*aop
) *aop
= ao
;
329 else if (*aop
!= ao
) return (T_ERROR
);
331 /* See whether there's a prefix length. If so, clobber it. */
332 delim
= strchr(buf
, '/');
333 if (delim
) *delim
++ = 0;
335 /* Parse the address. */
336 if (!inet_pton(ao
->af
, buf
, &ap
->addr
)) return (T_ERROR
);
338 /* Parse the prefix length, or use the maximum one. */
339 if (!delim
) n
= ao
->len
;
340 else n
= strtol(delim
, 0, 10);
341 if (n
< 0 || n
> ao
->len
) return (T_ERROR
);
348 static int parse_portpat(FILE *fp
, struct portpat
*pp
)
355 /* Parse a token for the pattern. */
356 if ((t
= scan(fp
, buf
, sizeof(buf
))) != 0) return (T_ERROR
);
358 /* If this is a wildcard, then we're done. */
359 if (strcmp(buf
, "*") == 0) {
365 /* Find a range delimiter. */
366 delim
= strchr(buf
, '-');
367 if (delim
) *delim
++ = 0;
369 /* Parse the only or low end of the range. */
370 n
= strtol(buf
, 0, 0);
371 if (n
< 0 || n
> 65535) return (T_ERROR
);
374 /* If there's no delimiter, then the high end is equal to the low end;
375 * otherwise, parse the high end.
380 n
= strtol(delim
, 0, 0);
381 if (n
< pp
->lo
|| n
> 65535) return (T_ERROR
);
389 /* Parse a socket pattern, writing it to SP. */
390 static int parse_sockpat(FILE *fp
, const struct addrops
**aop
,
395 if ((t
= parse_addrpat(fp
, aop
, &sp
->addr
)) != 0) return (t
);
396 if ((t
= parse_portpat(fp
, &sp
->port
)) != 0) return (T_ERROR
);
400 /* Parse a user pattern, writing it to UP. */
401 static int parse_userpat(FILE *fp
, struct userpat
*up
)
408 if ((t
= scan(fp
, buf
, sizeof(buf
))) != 0) return (t
);
409 if (!strcmp(buf
, "*")) { up
->lo
= 0; up
->hi
= UINT_MAX
; }
410 else if ((pw
= getpwnam(buf
)) != 0) up
->lo
= up
->hi
= pw
->pw_uid
;
412 if ((delim
= strchr(buf
, '-')) != 0) *delim
++ = 0;
413 up
->lo
= strtoul(buf
, 0, 0);
414 if (!delim
) up
->hi
= up
->lo
;
415 else if (!*delim
) up
->hi
= UINT_MAX
;
416 else up
->hi
= strtoul(delim
, 0, 0);
421 /* Parse a policy rule line, writing it to P. */
422 static int parse_policy(FILE *fp
, struct policy
*p
)
429 if ((t
= parse_sockpat(fp
, &p
->ao
, &p
->sp
[L
])) != 0) goto fail
;
430 if ((t
= parse_sockpat(fp
, &p
->ao
, &p
->sp
[R
])) != 0) goto err
;
431 if ((t
= parse_userpat(fp
, &p
->up
)) != 0) goto err
;
432 if ((t
= parse_action(fp
, &p
->act
)) != 0) goto err
;
442 /* Open a policy file by NAME. The description WHAT and query Q are used for
443 * formatting error messages for the log.
445 int open_policy_file(struct policy_file
*pf
, const char *name
,
446 const char *what
, const struct query
*q
, unsigned f
)
450 if ((pf
->fp
= fopen(name
, "r")) == 0) {
451 if (errno
!= ENOENT
|| !(f
& OPF_NOENTOK
)) {
452 logmsg(q
, LOG_ERR
, "failed to open %s `%s': %s",
453 what
, name
, strerror(errno
));
458 if (fstat(fileno(pf
->fp
), &st
)) {
459 logmsg(q
, LOG_ERR
, "failed to read information about %s `%s': %s",
460 what
, name
, strerror(errno
));
463 if (!S_ISREG(st
.st_mode
)) {
464 logmsg(q
, LOG_ERR
, "object `%s', used as %s, is not a regular file",
483 /* Read a policy rule from the file, storing it in PF->p. Return one of the
486 int read_policy_file(struct policy_file
*pf
)
492 t
= parse_policy(pf
->fp
, &pf
->p
);
499 logmsg(pf
->q
, LOG_ERR
, "%s:%d: parse error in %s",
500 pf
->name
, pf
->lno
, pf
->what
);
504 if (ferror(pf
->fp
)) {
505 logmsg(pf
->q
, LOG_ERR
, "failed to read %s `%s': %s",
506 pf
->what
, pf
->name
, strerror(errno
));
515 /* Close a policy file. It doesn't matter whether the file was completely
518 void close_policy_file(struct policy_file
*pf
)
524 /* Load a policy file, writing a vector of records into PV. If the policy
525 * file has errors, then leave PV unchanged and return nonzero.
527 int load_policy_file(const char *file
, policy_v
*pv
)
529 struct policy_file pf
;
530 policy_v v
= DA_INIT
;
533 if (open_policy_file(&pf
, file
, "policy file", 0, 0))
535 while ((t
= read_policy_file(&pf
)) < T_EOF
) {
541 close_policy_file(&pf
);
552 /*----- That's all, folks -------------------------------------------------*/