crypto/dist/heimdal/lib/krb5/acl.c

   1 /*
   2  * Copyright (c) 2000 - 2002, 2004 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "krb5_locl.h"
  35 #include <fnmatch.h>
  36
  37 __RCSID("$Heimdal: acl.c 22119 2007-12-03 22:02:48Z lha $"
  38         "$NetBSD$");
  39
  40 struct acl_field {
  41     enum { acl_string, acl_fnmatch, acl_retval } type;
  42     union {
  43         const char *cstr;
  44         char **retv;
  45     } u;
  46     struct acl_field *next, **last;
  47 };
  48
  49 static void
  50 free_retv(struct acl_field *acl)
  51 {
  52     while(acl != NULL) {
  53         if (acl->type == acl_retval) {
  54             if (*acl->u.retv)
  55                 free(*acl->u.retv);
  56             *acl->u.retv = NULL;
  57         }
  58         acl = acl->next;
  59     }
  60 }
  61
  62 static void
  63 acl_free_list(struct acl_field *acl, int retv)
  64 {
  65     struct acl_field *next;
  66     if (retv)
  67         free_retv(acl);
  68     while(acl != NULL) {
  69         next = acl->next;
  70         free(acl);
  71         acl = next;
  72     }
  73 }
  74
  75 static krb5_error_code
  76 acl_parse_format(krb5_context context,
  77                  struct acl_field **acl_ret,
  78                  const char *format,
  79                  va_list ap)
  80 {
  81     const char *p;
  82     struct acl_field *acl = NULL, *tmp;
  83
  84     for(p = format; *p != '\0'; p++) {
  85         tmp = malloc(sizeof(*tmp));
  86         if(tmp == NULL) {
  87             krb5_set_error_string(context, "malloc: out of memory");
  88             acl_free_list(acl, 0);
  89             return ENOMEM;
  90         }
  91         if(*p == 's') {
  92             tmp->type = acl_string;
  93             tmp->u.cstr = va_arg(ap, const char*);
  94         } else if(*p == 'f') {
  95             tmp->type = acl_fnmatch;
  96             tmp->u.cstr = va_arg(ap, const char*);
  97         } else if(*p == 'r') {
  98             tmp->type = acl_retval;
  99             tmp->u.retv = va_arg(ap, char **);
 100             *tmp->u.retv = NULL;
 101         } else {
 102             krb5_set_error_string(context, "acl_parse_format: "
 103                                   "unknown format specifier %c", *p);
 104             acl_free_list(acl, 0);
 105             free(tmp);
 106             return EINVAL;
 107         }
 108         tmp->next = NULL;
 109         if(acl == NULL)
 110             acl = tmp;
 111         else
 112             *acl->last = tmp;
 113         acl->last = &tmp->next;
 114     }
 115     *acl_ret = acl;
 116     return 0;
 117 }
 118
 119 static krb5_boolean
 120 acl_match_field(krb5_context context,
 121                 const char *string,
 122                 struct acl_field *field)
 123 {
 124     if(field->type == acl_string) {
 125         return !strcmp(field->u.cstr, string);
 126     } else if(field->type == acl_fnmatch) {
 127         return !fnmatch(field->u.cstr, string, 0);
 128     } else if(field->type == acl_retval) {
 129         *field->u.retv = strdup(string);
 130         return TRUE;
 131     }
 132     return FALSE;
 133 }
 134
 135 static krb5_boolean
 136 acl_match_acl(krb5_context context,
 137               struct acl_field *acl,
 138               const char *string)
 139 {
 140     char buf[256];
 141     while(strsep_copy(&string, " \t", buf, sizeof(buf)) != -1) {
 142         if(buf[0] == '\0')
 143             continue; /* skip ws */
 144         if (acl == NULL)
 145             return FALSE;
 146         if(!acl_match_field(context, buf, acl)) {
 147             return FALSE;
 148         }
 149         acl = acl->next;
 150     }
 151     if (acl)
 152         return FALSE;
 153     return TRUE;
 154 }
 155
 156 /**
 157  * krb5_acl_match_string matches ACL format against a string.
 158  *
 159  * The ACL format has three format specifiers: s, f, and r.  Each
 160  * specifier will retrieve one argument from the variable arguments
 161  * for either matching or storing data.  The input string is split up
 162  * using " " (space) and "\t" (tab) as a delimiter; multiple and "\t"
 163  * in a row are considered to be the same.
 164  *
 165  * List of format specifiers:
 166  * - s Matches a string using strcmp(3) (case sensitive).
 167  * - f Matches the string with fnmatch(3). Theflags
 168  *     argument (the last argument) passed to the fnmatch function is 0.
 169  * - r Returns a copy of the string in the char ** passed in; the copy
 170  *     must be freed with free(3). There is no need to free(3) the
 171  *     string on error: the function will clean up and set the pointer
 172  *     to NULL.
 173  *
 174  * @param context Kerberos 5 context
 175  * @param string string to match with
 176  * @param format format to match
 177  * @param ... parameter to format string
 178  *
 179  * @return Return an error code or 0.
 180  *
 181  *
 182  * @code
 183  * char *s;
 184  *
 185  * ret = krb5_acl_match_string(context, "foo", "s", "foo");
 186  * if (ret)
 187  *     krb5_errx(context, 1, "acl didn't match");
 188  * ret = krb5_acl_match_string(context, "foo foo baz/kaka",
 189  *     "ss", "foo", &s, "foo/\\*");
 190  * if (ret) {
 191  *     // no need to free(s) on error
 192  *     assert(s == NULL);
 193  *     krb5_errx(context, 1, "acl didn't match");
 194  * }
 195  * free(s);
 196  * @endcode
 197  *
 198  * @sa krb5_acl_match_file
 199  * @ingroup krb5_support
 200  */
 201
 202 krb5_error_code KRB5_LIB_FUNCTION
 203 krb5_acl_match_string(krb5_context context,
 204                       const char *string,
 205                       const char *format,
 206                       ...)
 207 {
 208     krb5_error_code ret;
 209     krb5_boolean found;
 210     struct acl_field *acl;
 211
 212     va_list ap;
 213     va_start(ap, format);
 214     ret = acl_parse_format(context, &acl, format, ap);
 215     va_end(ap);
 216     if(ret)
 217         return ret;
 218
 219     found = acl_match_acl(context, acl, string);
 220     acl_free_list(acl, !found);
 221     if (found) {
 222         return 0;
 223     } else {
 224         krb5_set_error_string(context, "ACL did not match");
 225         return EACCES;
 226     }
 227 }
 228
 229 /**
 230  * krb5_acl_match_file matches ACL format against each line in a file
 231  * using krb5_acl_match_string(). Lines starting with # are treated
 232  * like comments and ignored.
 233  *
 234  * @param context Kerberos 5 context.
 235  * @param file file with acl listed in the file.
 236  * @param format format to match.
 237  * @param ... parameter to format string.
 238  *
 239  * @return Return an error code or 0.
 240  *
 241  * @sa krb5_acl_match_string
 242  * @ingroup krb5_support
 243  */
 244
 245 krb5_error_code KRB5_LIB_FUNCTION
 246 krb5_acl_match_file(krb5_context context,
 247                     const char *file,
 248                     const char *format,
 249                     ...)
 250 {
 251     krb5_error_code ret;
 252     struct acl_field *acl;
 253     char buf[256];
 254     va_list ap;
 255     FILE *f;
 256     krb5_boolean found;
 257
 258     f = fopen(file, "r");
 259     if(f == NULL) {
 260         int save_errno = errno;
 261
 262         krb5_set_error_string(context, "open(%s): %s", file,
 263                               strerror(save_errno));
 264         return save_errno;
 265     }
 266
 267     va_start(ap, format);
 268     ret = acl_parse_format(context, &acl, format, ap);
 269     va_end(ap);
 270     if(ret) {
 271         fclose(f);
 272         return ret;
 273     }
 274
 275     found = FALSE;
 276     while(fgets(buf, sizeof(buf), f)) {
 277         if(buf[0] == '#')
 278             continue;
 279         if(acl_match_acl(context, acl, buf)) {
 280             found = TRUE;
 281             break;
 282         }
 283         free_retv(acl);
 284     }
 285
 286     fclose(f);
 287     acl_free_list(acl, !found);
 288     if (found) {
 289         return 0;
 290     } else {
 291         krb5_set_error_string(context, "ACL did not match");
 292         return EACCES;
 293     }
 294 }