lib/libwrap/options.c

   1 /*      $NetBSD: options.c,v 1.13 2005/04/19 03:38:19 lukem Exp $       */
   2
   3  /*
   4   * General skeleton for adding options to the access control language. The
   5   * features offered by this module are documented in the hosts_options(5)
   6   * manual page (source file: hosts_options.5, "nroff -man" format).
   7   *
   8   * Notes and warnings for those who want to add features:
   9   *
  10   * In case of errors, abort options processing and deny access. There are too
  11   * many irreversible side effects to make error recovery feasible. For
  12   * example, it makes no sense to continue after we have already changed the
  13   * userid.
  14   *
  15   * In case of errors, do not terminate the process: the routines might be
  16   * called from a long-running daemon that should run forever. Instead, call
  17   * tcpd_jump() which does a non-local goto back into the hosts_access()
  18   * routine.
  19   *
  20   * In case of severe errors, use clean_exit() instead of directly calling
  21   * exit(), or the inetd may loop on an UDP request.
  22   *
  23   * In verification mode (for example, with the "tcpdmatch" command) the
  24   * "dry_run" flag is set. In this mode, an option function should just "say"
  25   * what it is going to do instead of really doing it.
  26   *
  27   * Some option functions do not return (for example, the twist option passes
  28   * control to another program). In verification mode (dry_run flag is set)
  29   * such options should clear the "dry_run" flag to inform the caller of this
  30   * course of action.
  31   */
  32
  33 #include <sys/cdefs.h>
  34 #ifndef lint
  35 #if 0
  36 static char sccsid[] = "@(#) options.c 1.17 96/02/11 17:01:31";
  37 #else
  38 __RCSID("$NetBSD: options.c,v 1.13 2005/04/19 03:38:19 lukem Exp $");
  39 #endif
  40 #endif
  41
  42 /* System libraries. */
  43
  44 #include <sys/types.h>
  45 #include <sys/param.h>
  46 #include <sys/socket.h>
  47 #include <sys/stat.h>
  48 #include <netinet/in.h>
  49 #include <netdb.h>
  50 #include <stdio.h>
  51 #include <syslog.h>
  52 #include <unistd.h>
  53 #include <stdlib.h>
  54 #include <pwd.h>
  55 #include <grp.h>
  56 #include <ctype.h>
  57 #include <setjmp.h>
  58 #include <string.h>
  59
  60 /* Local stuff. */
  61
  62 #include "tcpd.h"
  63
  64 /* Options runtime support. */
  65
  66 int     dry_run = 0;                    /* flag set in verification mode */
  67 extern jmp_buf tcpd_buf;                /* tcpd_jump() support */
  68
  69 /* Options parser support. */
  70
  71 static char whitespace_eq[] = "= \t\r\n";
  72 #define whitespace (whitespace_eq + 1)
  73
  74 static char *get_field                  /* chew :-delimited field off string */
  75                 __P((char *));
  76 static char *chop_string                /* strip leading and trailing blanks */
  77                 __P((char *));
  78 struct syslog_names;
  79 static int severity_map
  80                 __P((struct syslog_names *, char *));
  81
  82 /* List of functions that implement the options. Add yours here. */
  83
  84 static void user_option                 /* execute "user name.group" option */
  85                 __P((char *, struct request_info *));
  86 static void group_option                /* execute "group name" option */
  87                 __P((char *, struct request_info *));
  88 static void umask_option                /* execute "umask mask" option */
  89                 __P((char *, struct request_info *));
  90 static void linger_option               /* execute "linger time" option */
  91                 __P((char *, struct request_info *));
  92 static void keepalive_option            /* execute "keepalive" option */
  93                 __P((char *, struct request_info *));
  94 static void spawn_option                /* execute "spawn command" option */
  95                 __P((char *, struct request_info *));
  96 static void twist_option                /* execute "twist command" option */
  97                 __P((char *, struct request_info *));
  98 static void rfc931_option               /* execute "rfc931" option */
  99                 __P((char *, struct request_info *));
 100 static void setenv_option               /* execute "setenv name value" */
 101                 __P((char *, struct request_info *));
 102 static void nice_option                 /* execute "nice" option */
 103                 __P((char *, struct request_info *));
 104 static void severity_option             /* execute "severity value" */
 105                 __P((char *, struct request_info *));
 106 static void allow_option                /* execute "allow" option */
 107                 __P((char *, struct request_info *));
 108 static void deny_option                 /* execute "deny" option */
 109                 __P((char *, struct request_info *));
 110 static void banners_option              /* execute "banners path" option */
 111                 __P((char *, struct request_info *));
 112
 113 /* Structure of the options table. */
 114
 115 struct option {
 116     char   *name;                       /* keyword name, case is ignored */
 117     void  (*func)                       /* function that does the real work */
 118                 __P((char *, struct request_info *));
 119     int     flags;                      /* see below... */
 120 };
 121
 122 #define NEED_ARG        (1<<1)          /* option requires argument */
 123 #define USE_LAST        (1<<2)          /* option must be last */
 124 #define OPT_ARG         (1<<3)          /* option has optional argument */
 125 #define EXPAND_ARG      (1<<4)          /* do %x expansion on argument */
 126
 127 #define need_arg(o)     ((o)->flags & NEED_ARG)
 128 #define opt_arg(o)      ((o)->flags & OPT_ARG)
 129 #define permit_arg(o)   ((o)->flags & (NEED_ARG | OPT_ARG))
 130 #define use_last(o)     ((o)->flags & USE_LAST)
 131 #define expand_arg(o)   ((o)->flags & EXPAND_ARG)
 132
 133 /* List of known keywords. Add yours here. */
 134
 135 static struct option option_table[] = {
 136     { "user", user_option, NEED_ARG },
 137     { "group", group_option, NEED_ARG },
 138     { "umask", umask_option, NEED_ARG },
 139     { "linger", linger_option, NEED_ARG },
 140     { "keepalive", keepalive_option, 0 },
 141     { "spawn", spawn_option, NEED_ARG | EXPAND_ARG },
 142     { "twist", twist_option, NEED_ARG | EXPAND_ARG | USE_LAST },
 143     { "rfc931", rfc931_option, OPT_ARG },
 144     { "setenv", setenv_option, NEED_ARG | EXPAND_ARG },
 145     { "nice", nice_option, OPT_ARG },
 146     { "severity", severity_option, NEED_ARG },
 147     { "allow", allow_option, USE_LAST },
 148     { "deny", deny_option, USE_LAST },
 149     { "banners", banners_option, NEED_ARG },
 150     { NULL, NULL, 0 }
 151 };
 152
 153 /* process_options - process access control options */
 154
 155 void    process_options(options, request)
 156 char   *options;
 157 struct request_info *request;
 158 {
 159     char   *key;
 160     char   *value;
 161     char   *curr_opt;
 162     char   *next_opt;
 163     struct option *op;
 164     char    bf[BUFSIZ];
 165
 166     for (curr_opt = get_field(options); curr_opt; curr_opt = next_opt) {
 167         next_opt = get_field((char *) 0);
 168
 169         /*
 170          * Separate the option into name and value parts. For backwards
 171          * compatibility we ignore exactly one '=' between name and value.
 172          */
 173         curr_opt = chop_string(curr_opt);
 174         if (*(value = curr_opt + strcspn(curr_opt, whitespace_eq))) {
 175             if (*value != '=') {
 176                 *value++ = 0;
 177                 value += strspn(value, whitespace);
 178             }
 179             if (*value == '=') {
 180                 *value++ = 0;
 181                 value += strspn(value, whitespace);
 182             }
 183         }
 184         if (*value == 0)
 185             value = 0;
 186         key = curr_opt;
 187
 188         /*
 189          * Disallow missing option names (and empty option fields).
 190          */
 191         if (*key == 0)
 192             tcpd_jump("missing option name");
 193
 194         /*
 195          * Lookup the option-specific info and do some common error checks.
 196          * Delegate option-specific processing to the specific functions.
 197          */
 198
 199         for (op = option_table; op->name && STR_NE(op->name, key); op++)
 200              /* VOID */ ;
 201         if (op->name == 0)
 202             tcpd_jump("bad option name: \"%s\"", key);
 203         if (!value && need_arg(op))
 204             tcpd_jump("option \"%s\" requires value", key);
 205         if (value && !permit_arg(op))
 206             tcpd_jump("option \"%s\" requires no value", key);
 207         if (next_opt && use_last(op))
 208             tcpd_jump("option \"%s\" must be at end", key);
 209         if (value && expand_arg(op))
 210             value = chop_string(percent_x(bf, sizeof(bf), value, request));
 211         if (hosts_access_verbose)
 212             syslog(LOG_DEBUG, "option:   %s %s", key, value ? value : "");
 213         (*(op->func)) (value, request);
 214     }
 215 }
 216
 217 /* allow_option - grant access */
 218
 219 /* ARGSUSED */
 220
 221 static void allow_option(value, request)
 222 char   *value;
 223 struct request_info *request;
 224 {
 225     longjmp(tcpd_buf, AC_PERMIT);
 226 }
 227
 228 /* deny_option - deny access */
 229
 230 /* ARGSUSED */
 231
 232 static void deny_option(value, request)
 233 char   *value;
 234 struct request_info *request;
 235 {
 236     longjmp(tcpd_buf, AC_DENY);
 237 }
 238
 239 /* banners_option - expand %<char>, terminate each line with CRLF */
 240
 241 static void banners_option(value, request)
 242 char   *value;
 243 struct request_info *request;
 244 {
 245     char    path[MAXPATHLEN];
 246     char    ibuf[BUFSIZ];
 247     char    obuf[2 * BUFSIZ];
 248     struct stat st;
 249     int     ch;
 250     FILE   *fp;
 251
 252     (void)snprintf(path, sizeof path, "%s/%s", value, eval_daemon(request));
 253     if ((fp = fopen(path, "r")) != 0) {
 254         while ((ch = fgetc(fp)) == 0)
 255             write(request->fd, "", 1);
 256         ungetc(ch, fp);
 257         while (fgets(ibuf, sizeof(ibuf) - 2, fp)) {
 258             if (split_at(ibuf, '\n'))
 259                 strcat(ibuf, "\r\n");   /* XXX strcat is safe */
 260             percent_x(obuf, sizeof(obuf), ibuf, request);
 261             write(request->fd, obuf, strlen(obuf));
 262         }
 263         fclose(fp);
 264     } else if (stat(value, &st) < 0) {
 265         tcpd_warn("%s: %m", value);
 266     }
 267 }
 268
 269 /* group_option - switch group id */
 270
 271 /* ARGSUSED */
 272
 273 static void group_option(value, request)
 274 char   *value;
 275 struct request_info *request;
 276 {
 277     struct group grs, *grp;
 278     char grbuf[1024];
 279
 280     (void)getgrnam_r(value, &grs, grbuf, sizeof(grbuf), &grp);
 281     if (grp == NULL)
 282         tcpd_jump("unknown group: \"%s\"", value);
 283
 284     if (dry_run == 0 && setgid(grp->gr_gid))
 285         tcpd_jump("setgid(%s): %m", value);
 286 }
 287
 288 /* user_option - switch user id */
 289
 290 /* ARGSUSED */
 291
 292 static void user_option(value, request)
 293 char   *value;
 294 struct request_info *request;
 295 {
 296     struct passwd *pwd, pws;
 297     char   *group;
 298     char   pwbuf[1024];
 299
 300     if ((group = split_at(value, '.')) != 0)
 301         group_option(group, request);
 302     (void)getpwnam_r(value, &pws, pwbuf, sizeof(pwbuf), &pwd);
 303     if (pwd == NULL)
 304         tcpd_jump("unknown user: \"%s\"", value);
 305
 306     if (dry_run == 0 && setuid(pwd->pw_uid))
 307         tcpd_jump("setuid(%s): %m", value);
 308 }
 309
 310 /* umask_option - set file creation mask */
 311
 312 /* ARGSUSED */
 313
 314 static void umask_option(value, request)
 315 char   *value;
 316 struct request_info *request;
 317 {
 318     unsigned mask;
 319     char    junk;
 320
 321     if (sscanf(value, "%o%c", &mask, &junk) != 1 || (mask & 0777) != mask)
 322         tcpd_jump("bad umask value: \"%s\"", value);
 323     (void) umask(mask);
 324 }
 325
 326 /* spawn_option - spawn a shell command and wait */
 327
 328 /* ARGSUSED */
 329
 330 static void spawn_option(value, request)
 331 char   *value;
 332 struct request_info *request;
 333 {
 334     if (dry_run == 0)
 335         shell_cmd(value);
 336 }
 337
 338 /* linger_option - set the socket linger time (Marc Boucher <marc@cam.org>) */
 339
 340 /* ARGSUSED */
 341
 342 static void linger_option(value, request)
 343 char   *value;
 344 struct request_info *request;
 345 {
 346     struct linger linger;
 347     char    junk;
 348
 349     if (sscanf(value, "%d%c", &linger.l_linger, &junk) != 1
 350         || linger.l_linger < 0)
 351         tcpd_jump("bad linger value: \"%s\"", value);
 352     if (dry_run == 0) {
 353         linger.l_onoff = (linger.l_linger != 0);
 354         if (setsockopt(request->fd, SOL_SOCKET, SO_LINGER, (char *) &linger,
 355                        sizeof(linger)) < 0)
 356             tcpd_warn("setsockopt SO_LINGER %d: %m", linger.l_linger);
 357     }
 358 }
 359
 360 /* keepalive_option - set the socket keepalive option */
 361
 362 /* ARGSUSED */
 363
 364 static void keepalive_option(value, request)
 365 char   *value;
 366 struct request_info *request;
 367 {
 368     static int on = 1;
 369
 370     if (dry_run == 0 && setsockopt(request->fd, SOL_SOCKET, SO_KEEPALIVE,
 371                                    (char *) &on, sizeof(on)) < 0)
 372         tcpd_warn("setsockopt SO_KEEPALIVE: %m");
 373 }
 374
 375 /* nice_option - set nice value */
 376
 377 /* ARGSUSED */
 378
 379 static void nice_option(value, request)
 380 char   *value;
 381 struct request_info *request;
 382 {
 383     int     niceval = 10;
 384     char    junk;
 385
 386     if (value != 0 && sscanf(value, "%d%c", &niceval, &junk) != 1)
 387         tcpd_jump("bad nice value: \"%s\"", value);
 388     if (dry_run == 0 && nice(niceval) < 0)
 389         tcpd_warn("nice(%d): %m", niceval);
 390 }
 391
 392 /* twist_option - replace process by shell command */
 393
 394 static void twist_option(value, request)
 395 char   *value;
 396 struct request_info *request;
 397 {
 398     if (dry_run != 0) {
 399         dry_run = 0;
 400     } else {
 401         if (resident > 0)
 402             tcpd_jump("twist option in resident process");
 403
 404         syslog(deny_severity, "twist %s to %s", eval_client(request), value);
 405
 406         /* Before switching to the shell, set up stdin, stdout and stderr. */
 407
 408 #define maybe_dup2(from, to) ((from == to) ? to : (close(to), dup(from)))
 409
 410         if (maybe_dup2(request->fd, 0) != 0 ||
 411             maybe_dup2(request->fd, 1) != 1 ||
 412             maybe_dup2(request->fd, 2) != 2) {
 413             tcpd_warn("twist_option: dup: %m");
 414         } else {
 415             if (request->fd > 2)
 416                 close(request->fd);
 417             (void) execl("/bin/sh", "sh", "-c", value, (char *) 0);
 418             tcpd_warn("twist_option: /bin/sh: %m");
 419         }
 420
 421         /* Something went wrong: we MUST terminate the process. */
 422         clean_exit(request);
 423     }
 424 }
 425
 426 /* rfc931_option - look up remote user name */
 427
 428 static void rfc931_option(value, request)
 429 char   *value;
 430 struct request_info *request;
 431 {
 432     int     timeout;
 433     char    junk;
 434
 435     if (value != 0) {
 436         if (sscanf(value, "%d%c", &timeout, &junk) != 1 || timeout <= 0)
 437             tcpd_jump("bad rfc931 timeout: \"%s\"", value);
 438         rfc931_timeout = timeout;
 439     }
 440     (void) eval_user(request);
 441 }
 442
 443 /* setenv_option - set environment variable */
 444
 445 /* ARGSUSED */
 446
 447 static void setenv_option(value, request)
 448 char   *value;
 449 struct request_info *request;
 450 {
 451     char   *var_value;
 452
 453     if (*(var_value = value + strcspn(value, whitespace)))
 454         *var_value++ = 0;
 455     if (setenv(chop_string(value), chop_string(var_value), 1))
 456         tcpd_jump("memory allocation failure");
 457 }
 458
 459  /*
 460   * The severity option goes last because it comes with a huge amount of ugly
 461   * #ifdefs and tables.
 462   */
 463
 464 struct syslog_names {
 465     char   *name;
 466     int     value;
 467 };
 468
 469 static struct syslog_names log_fac[] = {
 470 #ifdef LOG_KERN
 471     { "kern", LOG_KERN },
 472 #endif
 473 #ifdef LOG_USER
 474     { "user", LOG_USER },
 475 #endif
 476 #ifdef LOG_MAIL
 477     { "mail", LOG_MAIL },
 478 #endif
 479 #ifdef LOG_DAEMON
 480     { "daemon", LOG_DAEMON },
 481 #endif
 482 #ifdef LOG_AUTH
 483     { "auth", LOG_AUTH },
 484 #endif
 485 #ifdef LOG_LPR
 486     { "lpr", LOG_LPR },
 487 #endif
 488 #ifdef LOG_NEWS
 489     { "news", LOG_NEWS },
 490 #endif
 491 #ifdef LOG_UUCP
 492     { "uucp", LOG_UUCP },
 493 #endif
 494 #ifdef LOG_CRON
 495     { "cron", LOG_CRON },
 496 #endif
 497 #ifdef LOG_AUTHPRIV
 498     { "authpriv", LOG_AUTHPRIV },
 499 #endif
 500 #ifdef LOG_FTP
 501     { "ftp", LOG_FTP },
 502 #endif
 503 #ifdef LOG_LOCAL0
 504     { "local0", LOG_LOCAL0 },
 505 #endif
 506 #ifdef LOG_LOCAL1
 507     { "local1", LOG_LOCAL1 },
 508 #endif
 509 #ifdef LOG_LOCAL2
 510     { "local2", LOG_LOCAL2 },
 511 #endif
 512 #ifdef LOG_LOCAL3
 513     { "local3", LOG_LOCAL3 },
 514 #endif
 515 #ifdef LOG_LOCAL4
 516     { "local4", LOG_LOCAL4 },
 517 #endif
 518 #ifdef LOG_LOCAL5
 519     { "local5", LOG_LOCAL5 },
 520 #endif
 521 #ifdef LOG_LOCAL6
 522     { "local6", LOG_LOCAL6 },
 523 #endif
 524 #ifdef LOG_LOCAL7
 525     { "local7", LOG_LOCAL7 },
 526 #endif
 527     { NULL, 0 }
 528 };
 529
 530 static struct syslog_names log_sev[] = {
 531 #ifdef LOG_EMERG
 532     { "emerg", LOG_EMERG },
 533 #endif
 534 #ifdef LOG_ALERT
 535     { "alert", LOG_ALERT },
 536 #endif
 537 #ifdef LOG_CRIT
 538     { "crit", LOG_CRIT },
 539 #endif
 540 #ifdef LOG_ERR
 541     { "err", LOG_ERR },
 542 #endif
 543 #ifdef LOG_WARNING
 544     { "warning", LOG_WARNING },
 545 #endif
 546 #ifdef LOG_NOTICE
 547     { "notice", LOG_NOTICE },
 548 #endif
 549 #ifdef LOG_INFO
 550     { "info", LOG_INFO },
 551 #endif
 552 #ifdef LOG_DEBUG
 553     { "debug", LOG_DEBUG },
 554 #endif
 555     { NULL, 0 }
 556 };
 557
 558 /* severity_map - lookup facility or severity value */
 559
 560 static int severity_map(table, name)
 561 struct syslog_names *table;
 562 char   *name;
 563 {
 564     struct syslog_names *t;
 565
 566     for (t = table; t->name; t++)
 567         if (STR_EQ(t->name, name))
 568             return (t->value);
 569     tcpd_jump("bad syslog facility or severity: \"%s\"", name);
 570     /* NOTREACHED */
 571     return -1;
 572 }
 573
 574 /* severity_option - change logging severity for this event (Dave Mitchell) */
 575
 576 /* ARGSUSED */
 577
 578 static void severity_option(value, request)
 579 char   *value;
 580 struct request_info *request;
 581 {
 582     char   *level = split_at(value, '.');
 583
 584     allow_severity = deny_severity = level ?
 585         severity_map(log_fac, value) | severity_map(log_sev, level) :
 586         severity_map(log_sev, value);
 587 }
 588
 589 /* get_field - return pointer to next field in string */
 590
 591 static char *get_field(string)
 592 char   *string;
 593 {
 594     static char *last = "";
 595     char   *src;
 596     char   *dst;
 597     char   *ret;
 598     int     ch;
 599
 600     /*
 601      * This function returns pointers to successive fields within a given
 602      * string. ":" is the field separator; warn if the rule ends in one. It
 603      * replaces a "\:" sequence by ":", without treating the result of
 604      * substitution as field terminator. A null argument means resume search
 605      * where the previous call terminated. This function destroys its
 606      * argument.
 607      *
 608      * Work from explicit source or from memory. While processing \: we
 609      * overwrite the input. This way we do not have to maintain buffers for
 610      * copies of input fields.
 611      */
 612
 613     src = dst = ret = (string ? string : last);
 614     if (src[0] == 0)
 615         return (0);
 616
 617     while ((ch = *src) != '\0') {
 618         if (ch == ':') {
 619             if (*++src == 0)
 620                 tcpd_warn("rule ends in \":\"");
 621             break;
 622         }
 623         if (ch == '\\' && src[1] == ':')
 624             src++;
 625         *dst++ = *src++;
 626     }
 627     last = src;
 628     *dst = 0;
 629     return (ret);
 630 }
 631
 632 /* chop_string - strip leading and trailing blanks from string */
 633
 634 static char *chop_string(string)
 635 register char *string;
 636 {
 637     char   *start = NULL;
 638     char   *end = NULL;
 639     char   *cp;
 640
 641     for (cp = string; *cp; cp++) {
 642         if (!isspace((unsigned char) *cp)) {
 643             if (start == 0)
 644                 start = cp;
 645             end = cp;
 646         }
 647     }
 648     return (start ? (end[1] = 0, start) : cp);
 649 }