[yaid] / yaid.h

/* -*-c-*-
 *
 * Common definitions for YAID
 *
 * (c) 2012 Straylight/Edgeware
 */

/*----- Licensing notice --------------------------------------------------*
 *
 * This file is part of Yet Another Ident Daemon (YAID).
 *
 * YAID is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * YAID is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with YAID; if not, write to the Free Software Foundation,
 * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 */

#ifndef YAID_H
#define YAID_H

#ifdef __cplusplus
  extern "C" {
#endif

/*----- Header files ------------------------------------------------------*/

#include "config.h"

#include <assert.h>
#include <ctype.h>
#include <errno.h>
#include <limits.h>
#include <stdarg.h>
#include <stdio.h>
#include <string.h>
#include <string.h>
#include <time.h>

#include <sys/types.h>
#include <sys/time.h>
#include <unistd.h>
#include <fcntl.h>

#include <pwd.h>

#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>

#include <syslog.h>

#include <mLib/bits.h>
#include <mLib/conn.h>
#include <mLib/darray.h>
#include <mLib/dstr.h>
#include <mLib/fdflags.h>
#include <mLib/fwatch.h>
#include <mLib/quis.h>
#include <mLib/report.h>
#include <mLib/sel.h>
#include <mLib/selbuf.h>

/*----- Address family handling -------------------------------------------*/

/* The maximum length of an address formatted as a text string, including the
 * terminating null byte.
 */
#define ADDRLEN 64

/* A list of address types. */
#define ADDRTYPES(_)                                                    \
  _(ipv4, IPV4)                                                         \
  _(ipv6, IPV6)

/* Address types for the various families, in the form acceptable to
 * inet_ntop(3) and inet_pton(3). */
#define TYPE_IPV4 struct in_addr
#define TYPE_IPV6 struct in6_addr

/* A union of address types. */
union addr {
#define UMEMB(ty, TY) TYPE_##TY ty;
  ADDRTYPES(UMEMB)
#undef UMEMB
};

/* A socket holds an address and a port number. */
struct socket {
  union addr addr;                      /* The address */
  unsigned port;                        /* The port, in /host/ byte order */
};

/* An address pattern consists of an address and a prefix length: the
 * pattern matches an address if they agree in the first LEN bits.
 */
struct addrpat {
  union addr addr;                      /* The base address */
  unsigned len;                         /* The prefix length */
};

/* A port pattern matches a port if the port is within the stated (inclusive)
 * bounds.
 */
struct portpat {
  unsigned lo, hi;
};

/* A socket pattern consists simply of an address pattern and a port pattern:
 * it matches a socket componentwise.
 */
struct sockpat {
  struct addrpat addr;
  struct portpat port;
};

/* The table of address-type operations.  Each address family has one of
 * these, so that most of the program doesn't need to worry about these
 * details.
 */
struct addrops {
  int af;                               /* The AF_* constant */
  const char *name;                     /* Name of the protocol, for logs */
  unsigned len;                         /* Length of an address, in bits */
  const union addr *any;                /* A wildcard address */
  const struct addrops_sys *sys;        /* Pointer to system-specific ops */

  int (*addreq)(const union addr *, const union addr *);
        /* Return nonzero if the two addresses are equal. */

  int (*match_addrpat)(const struct addrpat *, const union addr *);
        /* Return nonzero if the pattern matches the address. */

  void (*socket_to_sockaddr)(const struct socket *s, void *, size_t *);
        /* Convert a socket structure to a `struct sockaddr', and return the
         * size of the latter.
         */

  void (*sockaddr_to_addr)(const void *, union addr *);
        /* Extract the address from a `struct sockaddr'. */

  int (*init_listen_socket)(int);
        /* Perform any necessary extra operations on a socket which is going
         * to be used to listen for incoming connections.
         */
};

/* A handy constant for each address family.  These are more useful than the
 * AF_* constants in that they form a dense sequence.
 */
enum {
#define DEFADDR(ty, TY) ADDR_##TY,
  ADDRTYPES(DEFADDR)
#undef DEFADDR
  ADDR_LIMIT
};

/* The table of address operations, indexed by the ADDR_* constants defined
 * just above.
 */
extern const struct addrops addroptab[];

/* System-specific operations, provided by the system-specific code for its
 * own purposes.
 */
#define OPS_SYS(ty, TY)                                                 \
  extern const struct addrops_sys addrops_sys_##ty;
ADDRTYPES(OPS_SYS)
#undef OPS_SYS

/* Answer whether the sockets SA and SB are equal. */
extern int sockeq(const struct addrops */*ao*/,
                  const struct socket */*sa*/, const struct socket */*sb*/);

/* Write a textual description of S to the string D. */
extern void dputsock(dstr */*d*/, const struct addrops */*ao*/,
                     const struct socket */*s*/);

/*----- Queries and responses ---------------------------------------------*/

/* Constants for describing the `L'ocal and `R'emote ends of a connection. */
enum { L, R, NDIR };

/* Response types, and the data needed to represent any associated data.  A
 * U(MEMB, TYPE) constructs a union member; an N means no associated data.
 */
#define RESPONSE(_)                                                     \
  _(ERROR, U(error, unsigned))                                          \
  _(UID, U(uid, uid_t))                                                 \
  _(NAT, U(nat, struct socket))

enum {
#define DEFENUM(what, branch) R_##what,
  RESPONSE(DEFENUM)
#undef DEFENUM
  R_LIMIT
};

/* Protocol error tokens. */
#define ERROR(_)                                                        \
  _(INVPORT, "INVALID-PORT")                                            \
  _(NOUSER, "NO-USER")                                                  \
  _(HIDDEN, "HIDDEN-USER")                                              \
  _(UNKNOWN, "UNKNOWN-ERROR")

enum {
#define DEFENUM(err, tok) E_##err,
  ERROR(DEFENUM)
#undef DEFENUM
  E_LIMIT
};

extern const char *const errtok[];

/* The query structure keeps together the parameters to the client's query
 * and our response to it.
 */
struct query {
  const struct addrops *ao;             /* Address family operations */
  struct socket s[NDIR];                /* The local and remote ends */
  unsigned resp;                        /* Our response type */
  union {                               /* A union of response data */
#define DEFBRANCH(WHAT, branch) branch
#define U(memb, ty) ty memb;
#define N
    RESPONSE(DEFBRANCH)
#undef U
#undef N
#undef DEFBRANCH
  } u;
} query;

/*----- Common utility functions ------------------------------------------*/

/* Format and log MSG somewhere sensible, at the syslog(3) priority PRIO.
 * Prefix it with a description of the query Q, if non-null.
 */
extern void logmsg(const struct query */*q*/,
                   int /*prio*/, const char */*msg*/, ...);

/*----- System-specific connection identification code --------------------*/

/* Find out who is responsible for the connection described in the query Q.
 * Write the answer to Q.  Errors are logged and reported via the query
 * structure.
 */
extern void identify(struct query */*q*/);

/* Initialize the system-specific code. */
extern void init_sys(void);

/*----- Policy management -------------------------------------------------*/

/* The possible policy actions and their names. */
#define ACTIONS(_)                                                      \
  _(USER, "user")                                                       \
  _(TOKEN, "token")                                                     \
  _(NAME, "name")                                                       \
  _(DENY, "deny")                                                       \
  _(HIDE, "hide")                                                       \
  _(LIE, "lie")

enum {
#define DEFENUM(tag, word) A_##tag,
  ACTIONS(DEFENUM)
#undef DEFENUM
  A_LIMIT
};

/* A policy action. */
struct action {
  unsigned act;
  union {
    unsigned user;                      /* Bitmask of permitted actions */
    char *lie;                          /* The user name to impersonate */
  } u;
};

/* A user pattern matches a user if the uid is within the given bounds. */
struct userpat {
  unsigned lo, hi;
};

/* A policy rule: if the query matches the pattern, then perform the
 * action.
 */
struct policy {
  const struct addrops *ao;
  struct sockpat sp[NDIR];
  struct userpat up;
  struct action act;
};
#define POLICY_INIT(a) { .act.act = a }
DA_DECL(policy_v, struct policy);

/* Initialize a policy structure.  In this state, it doesn't actually have
 * any resources allocated (so can be simply discarded) but it's safe to free
 * (using `free_policy').
 */
extern void init_policy(struct policy */*p*/);

/* Free a policy structure, resetting it to its freshly-initialized state.
 * This function is idempotent.
 */
extern void free_policy(struct policy */*p*/);

/* Print a policy rule to standard output. */
extern void print_policy(const struct policy */*p*/);

/* Return true if the query matches the patterns in the policy rule. */
extern int match_policy(const struct policy */*p*/,
                        const struct query */*q*/);

/*----- Parsing policy files ----------------------------------------------*/

/* Possible results from a parse. */
enum {
  T_OK,                                 /* Successful: results returned */
  T_EOL,                                /* End-of-line found immediately */
  T_EOF,                                /* End-of-file found immediately */
  T_ERROR                               /* Some kind of error occurred */
};

/* A context for parsing a policy file. */
struct policy_file {
  FILE *fp;                             /* The file to read from */
  const struct query *q;                /* A query to use for logging */
  const char *name;                     /* The name of the file */
  const char *what;                     /* A description of the file */
  int err;                              /* Have there been any errors? */
  int lno;                              /* The current line number */
  struct policy p;                      /* Parsed policy rule goes here */
};

/* Open a policy file by NAME.  The description WHAT and query Q are used for
 * formatting error messages for the log.
 */
extern int open_policy_file(struct policy_file */*pf*/, const char */*name*/,
                            const char */*what*/, const struct query */*q*/);

/* Read a policy rule from the file, storing it in PF->p.  Return one of the
 * T_* codes.
 */
extern int read_policy_file(struct policy_file */*pf*/);

/* Close a policy file.  It doesn't matter whether the file was completely
 * read.
 */
extern void close_policy_file(struct policy_file */*pf*/);

/* Load a policy file, writing a vector of records into PV.  If the policy
 * file has errors, then leave PV unchanged and return nonzero.
 */
extern int load_policy_file(const char */*file*/, policy_v */*pv*/);

/*----- That's all, folks -------------------------------------------------*/

#ifdef __cplusplus
  }
#endif

#endif