3 * Policy parsing and implementation
5 * (c) 2012 Straylight/Edgeware
8 /*----- Licensing notice --------------------------------------------------*
10 * This file is part of Yet Another Ident Daemon (YAID).
12 * YAID is free software; you can redistribute it and/or modify
13 * it under the terms of the GNU General Public License as published by
14 * the Free Software Foundation; either version 2 of the License, or
15 * (at your option) any later version.
17 * YAID is distributed in the hope that it will be useful,
18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 * GNU General Public License for more details.
22 * You should have received a copy of the GNU General Public License
23 * along with YAID; if not, write to the Free Software Foundation,
24 * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
27 /*----- Header files ------------------------------------------------------*/
31 /*----- Data structures ---------------------------------------------------*/
33 /*----- Static variables --------------------------------------------------*/
35 /*----- Main code ---------------------------------------------------------*/
37 /* syntax: addrpat portpat addrpar portpat policy
39 * local address/port first, then remote
40 * addrpat ::= addr [/ len]
41 * portpat ::= num | num - num | *
42 * policy ::= user policy* | token | name | deny | hide |
45 void init_policy(struct policy
*p
) { p
->act
.act
= A_LIMIT
; }
47 static void free_action(struct action
*a
)
57 void free_policy(struct policy
*p
)
58 { free_action(&p
->act
); }
60 static void print_addrpat(int af
, const struct addrpat
*ap
)
64 if (ap
->len
== 0) putchar('*');
65 else printf("%s/%u", inet_ntop(af
, &ap
->addr
, buf
, sizeof(buf
)), ap
->len
);
68 static void print_portpat(const struct portpat
*pp
)
70 if (pp
->lo
== 0 && pp
->hi
== 65535) putchar('*');
71 else if (pp
->lo
== pp
->hi
) printf("%u", pp
->lo
);
72 else printf("%u-%u", pp
->lo
, pp
->hi
);
75 static void print_sockpat(int af
, const struct sockpat
*sp
)
76 { print_addrpat(af
, &sp
->addr
); putchar(' '); print_portpat(&sp
->port
); }
78 static const char *const acttab
[] = {
79 #define DEFACT(tag, name) name,
85 static void print_action(const struct action
*act
)
87 assert(act
->act
< A_LIMIT
);
88 printf("%s", acttab
[act
->act
]);
93 for (i
= 0, m
= 1; i
< A_LIMIT
; i
++, m
<<= 1)
94 if (act
->u
.user
& m
) printf(" %s", acttab
[i
]);
97 printf(" %s", act
->u
.lie
);
102 void print_policy(const struct policy
*p
)
104 print_sockpat(p
->af
, &p
->sp
[L
]); putchar(' ');
105 print_sockpat(p
->af
, &p
->sp
[R
]); putchar(' ');
106 print_action(&p
->act
); putchar('\n');
109 static int match_addrpat(int af
, const struct addrpat
*ap
,
116 unsigned mask
= htonl((MASK32
<< (32 - ap
->len
)) & MASK32
);
117 return (((ap
->addr
.ipv4
.s_addr
^ a
->ipv4
.s_addr
) & mask
) == 0);
125 static int match_portpat(const struct portpat
*pp
, unsigned port
)
126 { return (pp
->lo
<= port
&& port
<= pp
->hi
); }
128 static int match_sockpat(int af
, const struct sockpat
*sp
,
129 const struct socket
*s
)
131 return (match_addrpat(af
, &sp
->addr
, &s
->addr
) &&
132 match_portpat(&sp
->port
, s
->port
));
135 int match_policy(const struct policy
*p
, const struct query
*q
)
137 return ((!p
->af
|| p
->af
== q
->af
) &&
138 match_sockpat(p
->af
, &p
->sp
[L
], &q
->s
[L
]) &&
139 match_sockpat(p
->af
, &p
->sp
[R
], &q
->s
[R
]));
142 static void nextline(FILE *fp
)
146 if (ch
== '\n' || ch
== EOF
) break;
150 static int scan(FILE *fp
, char *buf
, size_t sz
)
163 return (ferror(fp
) ? T_ERROR
: T_EOF
);
167 if (ch
== '\n') goto newline
;
168 else if (ch
== EOF
) goto eof
;
171 if (isspace(ch
)) goto skip_ws
;
176 if (sz
) { *buf
++ = ch
; sz
--; }
185 if (isspace(ch
)) goto done
;
199 static int parse_actname(FILE *fp
, unsigned *act
)
203 const char *const *p
;
205 if ((t
= scan(fp
, buf
, sizeof(buf
))) != 0) return (t
);
206 for (p
= acttab
; *p
; p
++)
207 if (strcmp(buf
, *p
) == 0) { *act
= p
- acttab
; return (0); }
211 static int parse_action(FILE *fp
, struct action
*act
)
218 if ((t
= parse_actname(fp
, &a
)) != 0) return (t
);
223 if ((t
= parse_actname(fp
, &a
)) != 0) break;
226 if (t
!= T_EOL
&& t
!= T_EOF
) return (t
);
237 if ((t
= scan(fp
, buf
, sizeof(buf
))) != 0) return (t
);
239 act
->u
.lie
= xstrdup(buf
);
242 t
= scan(fp
, buf
, sizeof(buf
));
243 if (t
!= T_EOF
&& t
!= T_EOL
) {
250 static int parse_sockpat(FILE *fp
, int *afp
, struct sockpat
*sp
)
259 if ((t
= scan(fp
, buf
, sizeof(buf
))) != 0) return (t
);
260 if (strcmp(buf
, "*") == 0)
263 if (strchr(buf
, ':')) {
270 if (!*afp
) *afp
= af
;
271 else if (*afp
!= af
) return (T_ERROR
);
272 delim
= strchr(buf
, '/');
273 if (delim
) *delim
++ = 0;
274 if (!inet_pton(af
, buf
, &sp
->addr
.addr
)) return (T_ERROR
);
275 if (!delim
) n
= alen
;
276 else n
= strtol(delim
, 0, 10);
277 if (n
< 0 || n
> alen
) return (T_ERROR
);
281 if ((t
= scan(fp
, buf
, sizeof(buf
))) != 0) return (T_ERROR
);
282 if (strcmp(buf
, "*") == 0) {
286 delim
= strchr(buf
, '-');
287 if (delim
) *delim
++ = 0;
288 n
= strtol(buf
, 0, 0);
289 if (n
< 0 || n
> 65535) return (T_ERROR
);
294 n
= strtol(delim
, 0, 0);
295 if (n
< 0 || n
> 65535) return (T_ERROR
);
302 int parse_policy(FILE *fp
, struct policy
*p
)
309 if ((t
= parse_sockpat(fp
, &p
->af
, &p
->sp
[L
])) != 0) goto fail
;
310 if ((t
= parse_sockpat(fp
, &p
->af
, &p
->sp
[R
])) != 0) goto err
;
311 if ((t
= parse_action(fp
, &p
->act
)) != 0) goto err
;
321 int open_policy_file(struct policy_file
*pf
, const char *name
,
322 const char *what
, const struct query
*q
)
324 if ((pf
->fp
= fopen(name
, "r")) == 0) {
325 logmsg(q
, LOG_ERR
, "failed to open %s `%s': %s",
326 what
, name
, strerror(errno
));
339 int read_policy_file(struct policy_file
*pf
)
345 t
= parse_policy(pf
->fp
, &pf
->p
);
351 logmsg(pf
->q
, LOG_ERR
, "%s:%d: parse error in %s",
352 pf
->name
, pf
->lno
, pf
->what
);
356 if (ferror(pf
->fp
)) {
357 logmsg(pf
->q
, LOG_ERR
, "failed to read %s `%s': %s",
358 pf
->what
, pf
->name
, strerror(errno
));
370 void close_policy_file(struct policy_file
*pf
)
376 int load_policy_file(const char *file
, policy_v
*pv
)
378 struct policy_file pf
;
379 policy_v v
= DA_INIT
;
381 if (open_policy_file(&pf
, file
, "policy file", 0))
383 while (!read_policy_file(&pf
)) {
387 close_policy_file(&pf
);
398 /*----- That's all, folks -------------------------------------------------*/