1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2011 James Gritton
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29 #include <sys/types.h>
30 #include <sys/errno.h>
31 #include <sys/socket.h>
32 #include <sys/sysctl.h>
33
34 #include <arpa/inet.h>
35 #include <netinet/in.h>
36
37 #include <err.h>
38 #include <glob.h>
39 #include <netdb.h>
40 #include <stdio.h>
41 #include <stdlib.h>
42 #include <string.h>
43 #include <unistd.h>
44
45 #include "jailp.h"
46
47 #define MAX_INCLUDE_DEPTH 32
48
49 struct ipspec {
50 const char *name;
51 unsigned flags;
52 };
53
54 extern int yylex_init_extra(struct cflex *extra, void *scanner);
55 extern int yylex_destroy(void *scanner);
56 extern int yyparse(void *scanner);
57 extern int yyset_in(FILE *fp, void *scanner);
58
59 struct cfjails cfjails = TAILQ_HEAD_INITIALIZER(cfjails);
60
61 static void parse_config(const char *fname, int is_stdin);
62 static void free_param(struct cfparams *pp, struct cfparam *p);
63
64 static const struct ipspec intparams[] = {
65 [IP_ALLOW_DYING] = {"allow.dying", PF_INTERNAL | PF_BOOL},
66 [IP_COMMAND] = {"command", PF_INTERNAL},
67 [IP_DEPEND] = {"depend", PF_INTERNAL},
68 [IP_EXEC_CLEAN] = {"exec.clean", PF_INTERNAL | PF_BOOL},
69 [IP_EXEC_CONSOLELOG] = {"exec.consolelog", PF_INTERNAL},
70 [IP_EXEC_FIB] = {"exec.fib", PF_INTERNAL | PF_INT},
71 [IP_EXEC_JAIL_USER] = {"exec.jail_user", PF_INTERNAL},
72 [IP_EXEC_POSTSTART] = {"exec.poststart", PF_INTERNAL},
73 [IP_EXEC_POSTSTOP] = {"exec.poststop", PF_INTERNAL},
74 [IP_EXEC_PREPARE] = {"exec.prepare", PF_INTERNAL},
75 [IP_EXEC_PRESTART] = {"exec.prestart", PF_INTERNAL},
76 [IP_EXEC_PRESTOP] = {"exec.prestop", PF_INTERNAL},
77 [IP_EXEC_RELEASE] = {"exec.release", PF_INTERNAL},
78 [IP_EXEC_CREATED] = {"exec.created", PF_INTERNAL},
79 [IP_EXEC_START] = {"exec.start", PF_INTERNAL},
80 [IP_EXEC_STOP] = {"exec.stop", PF_INTERNAL},
81 [IP_EXEC_SYSTEM_JAIL_USER]= {"exec.system_jail_user",
82 PF_INTERNAL | PF_BOOL},
83 [IP_EXEC_SYSTEM_USER] = {"exec.system_user", PF_INTERNAL},
84 [IP_EXEC_TIMEOUT] = {"exec.timeout", PF_INTERNAL | PF_INT},
85 #if defined(INET) || defined(INET6)
86 [IP_INTERFACE] = {"interface", PF_INTERNAL},
87 [IP_IP_HOSTNAME] = {"ip_hostname", PF_INTERNAL | PF_BOOL},
88 #endif
89 [IP_MOUNT] = {"mount", PF_INTERNAL | PF_REV},
90 [IP_MOUNT_DEVFS] = {"mount.devfs", PF_INTERNAL | PF_BOOL},
91 [IP_MOUNT_FDESCFS] = {"mount.fdescfs", PF_INTERNAL | PF_BOOL},
92 [IP_MOUNT_PROCFS] = {"mount.procfs", PF_INTERNAL | PF_BOOL},
93 [IP_MOUNT_FSTAB] = {"mount.fstab", PF_INTERNAL},
94 [IP_STOP_TIMEOUT] = {"stop.timeout", PF_INTERNAL | PF_INT},
95 [IP_VNET_INTERFACE] = {"vnet.interface", PF_INTERNAL},
96 [IP_ZFS_DATASET] = {"zfs.dataset", PF_INTERNAL},
97 #ifdef INET
98 [IP__IP4_IFADDR] = {"ip4.addr", PF_INTERNAL | PF_CONV | PF_REV},
99 #endif
100 #ifdef INET6
101 [IP__IP6_IFADDR] = {"ip6.addr", PF_INTERNAL | PF_CONV | PF_REV},
102 #endif
103 [IP__MOUNT_FROM_FSTAB] = {"mount.fstab", PF_INTERNAL | PF_CONV | PF_REV},
104 [IP__OP] = {NULL, PF_CONV},
105 [KP_ALLOW_CHFLAGS] = {"allow.chflags", 0},
106 [KP_ALLOW_MOUNT] = {"allow.mount", 0},
107 [KP_ALLOW_RAW_SOCKETS] = {"allow.raw_sockets", 0},
108 [KP_ALLOW_SET_HOSTNAME]= {"allow.set_hostname", 0},
109 [KP_ALLOW_SOCKET_AF] = {"allow.socket_af", 0},
110 [KP_ALLOW_SYSVIPC] = {"allow.sysvipc", 0},
111 [KP_DEVFS_RULESET] = {"devfs_ruleset", 0},
112 [KP_HOST_HOSTNAME] = {"host.hostname", 0},
113 #ifdef INET
114 [KP_IP4_ADDR] = {"ip4.addr", 0},
115 #endif
116 #ifdef INET6
117 [KP_IP6_ADDR] = {"ip6.addr", 0},
118 #endif
119 [KP_JID] = {"jid", PF_IMMUTABLE},
120 [KP_NAME] = {"name", PF_IMMUTABLE},
121 [KP_PATH] = {"path", 0},
122 [KP_PERSIST] = {"persist", 0},
123 [KP_SECURELEVEL] = {"securelevel", 0},
124 [KP_VNET] = {"vnet", 0},
125 };
126
127 /*
128 * Parse the jail configuration file.
129 */
130 void
load_config(const char * cfname)131 load_config(const char *cfname)
132 {
133 struct cfjails wild;
134 struct cfparams opp;
135 struct cfjail *j, *tj, *wj;
136 struct cfparam *p, *vp, *tp;
137 struct cfstring *s, *vs, *ns, *cs;
138 struct cfvar *v, *vv;
139 char *ep;
140 int did_self, jseq, pgen;
141
142 parse_config(cfname, !strcmp(cfname, "-"));
143
144 /* Separate the wildcard jails out from the actual jails. */
145 jseq = 0;
146 TAILQ_INIT(&wild);
147 TAILQ_FOREACH_SAFE(j, &cfjails, tq, tj) {
148 j->seq = ++jseq;
149 if (wild_jail_name(j->name))
150 requeue(j, &wild);
151 }
152
153 TAILQ_FOREACH(j, &cfjails, tq) {
154 /* Set aside the jail's parameters. */
155 TAILQ_INIT(&opp);
156 TAILQ_CONCAT(&opp, &j->params, tq);
157 /*
158 * The jail name implies its "name" or "jid" parameter,
159 * though they may also be explicitly set later on. After we
160 * collect other parameters, we'll go back and ensure they're
161 * both set if we need to do so here.
162 */
163 add_param(j, NULL,
164 strtol(j->name, &ep, 10) && !*ep ? KP_JID : KP_NAME,
165 j->name);
166
167 /*
168 * Collect parameters for the jail, global parameters/variables,
169 * and any matching wildcard jails.
170 */
171 did_self = 0;
172 TAILQ_FOREACH(wj, &wild, tq) {
173 if (j->seq < wj->seq && !did_self) {
174 TAILQ_FOREACH(p, &opp, tq)
175 add_param(j, p, 0, NULL);
176 did_self = 1;
177 }
178 if (wild_jail_match(j->name, wj->name))
179 TAILQ_FOREACH(p, &wj->params, tq)
180 add_param(j, p, 0, NULL);
181 }
182 if (!did_self)
183 TAILQ_FOREACH(p, &opp, tq)
184 add_param(j, p, 0, NULL);
185
186 /*
187 * We only backfill if it's the name that wasn't set; if it was
188 * the jid, we can assume that will be populated later when the
189 * jail is created or found.
190 */
191 if (j->intparams[KP_NAME] == NULL)
192 add_param(j, NULL, KP_NAME, j->name);
193
194 /* Resolve any variable substitutions. */
195 pgen = 0;
196 TAILQ_FOREACH(p, &j->params, tq) {
197 p->gen = ++pgen;
198 find_vars:
199 TAILQ_FOREACH(s, &p->val, tq) {
200 while ((v = STAILQ_FIRST(&s->vars))) {
201 TAILQ_FOREACH(vp, &j->params, tq)
202 if (!strcmp(vp->name, v->name))
203 break;
204 if (!vp || TAILQ_EMPTY(&vp->val)) {
205 jail_warnx(j,
206 "%s: variable \"%s\" not found",
207 p->name, v->name);
208 bad_var:
209 j->flags |= JF_FAILED;
210 TAILQ_FOREACH(vp, &j->params, tq)
211 if (vp->gen == pgen)
212 vp->flags |= PF_BAD;
213 goto free_var;
214 }
215 if (vp->flags & PF_BAD)
216 goto bad_var;
217 if (vp->gen == pgen) {
218 jail_warnx(j, "%s: variable loop",
219 v->name);
220 goto bad_var;
221 }
222 TAILQ_FOREACH(vs, &vp->val, tq)
223 if (!STAILQ_EMPTY(&vs->vars)) {
224 vp->gen = pgen;
225 TAILQ_REMOVE(&j->params, vp,
226 tq);
227 TAILQ_INSERT_BEFORE(p, vp, tq);
228 p = vp;
229 goto find_vars;
230 }
231 vs = TAILQ_FIRST(&vp->val);
232 if (TAILQ_NEXT(vs, tq) != NULL &&
233 (s->s[0] != '\0' ||
234 STAILQ_NEXT(v, tq))) {
235 jail_warnx(j, "%s: array cannot be "
236 "substituted inline",
237 p->name);
238 goto bad_var;
239 }
240 s->s = erealloc(s->s, s->len + vs->len + 1);
241 memmove(s->s + v->pos + vs->len,
242 s->s + v->pos,
243 s->len - v->pos + 1);
244 memcpy(s->s + v->pos, vs->s, vs->len);
245 vv = v;
246 while ((vv = STAILQ_NEXT(vv, tq)))
247 vv->pos += vs->len;
248 s->len += vs->len;
249 cs = s;
250 while ((vs = TAILQ_NEXT(vs, tq))) {
251 ns = emalloc(sizeof(struct cfstring));
252 ns->s = estrdup(vs->s);
253 ns->len = vs->len;
254 STAILQ_INIT(&ns->vars);
255 TAILQ_INSERT_AFTER(&p->val, cs, ns, tq);
256 cs = ns;
257 }
258 free_var:
259 free(v->name);
260 STAILQ_REMOVE_HEAD(&s->vars, tq);
261 free(v);
262 }
263 }
264 }
265
266 /* Free the jail's original parameter list and any variables. */
267 while ((p = TAILQ_FIRST(&opp)))
268 free_param(&opp, p);
269 TAILQ_FOREACH_SAFE(p, &j->params, tq, tp)
270 if (p->flags & PF_VAR)
271 free_param(&j->params, p);
272 }
273 while ((wj = TAILQ_FIRST(&wild))) {
274 free(wj->name);
275 while ((p = TAILQ_FIRST(&wj->params)))
276 free_param(&wj->params, p);
277 TAILQ_REMOVE(&wild, wj, tq);
278 }
279 }
280
281 void
include_config(void * scanner,const char * cfname)282 include_config(void *scanner, const char *cfname)
283 {
284 static unsigned int depth;
285 glob_t g = {0};
286 const char *slash;
287 char *fullpath = NULL;
288
289 /* Simple sanity check for include loops. */
290 if (++depth > MAX_INCLUDE_DEPTH)
291 errx(1, "maximum include depth exceeded");
292 /* Base relative pathnames on the current config file. */
293 if (yyget_in(scanner) != stdin && cfname[0] != '/') {
294 const char *outer_cfname = yyget_extra(scanner)->cfname;
295 if ((slash = strrchr(outer_cfname, '/')) != NULL) {
296 size_t dirlen = (slash - outer_cfname) + 1;
297
298 fullpath = emalloc(dirlen + strlen(cfname) + 1);
299 strncpy(fullpath, outer_cfname, dirlen);
300 strcpy(fullpath + dirlen, cfname);
301 cfname = fullpath;
302 }
303 }
304 /*
305 * Check if the include statement had a filename glob.
306 * Globbing doesn't need to catch any files, but a non-glob
307 * file needs to exist (enforced by parse_config).
308 */
309 if (glob(cfname, GLOB_NOCHECK, NULL, &g) != 0)
310 errx(1, "%s: filename glob failed", cfname);
311 if (g.gl_flags & GLOB_MAGCHAR) {
312 for (size_t gi = 0; gi < g.gl_matchc; gi++)
313 parse_config(g.gl_pathv[gi], 0);
314 } else
315 parse_config(cfname, 0);
316 if (fullpath)
317 free(fullpath);
318 --depth;
319 }
320
321 static void
parse_config(const char * cfname,int is_stdin)322 parse_config(const char *cfname, int is_stdin)
323 {
324 struct cflex cflex = {.cfname = cfname, .error = 0};
325 FILE *yfp = NULL;
326 void *scanner;
327
328 yylex_init_extra(&cflex, &scanner);
329 if (is_stdin) {
330 cflex.cfname = "STDIN";
331 yyset_in(stdin, scanner);
332 } else {
333 yfp = fopen(cfname, "re");
334 if (!yfp)
335 err(1, "%s", cfname);
336 yyset_in(yfp, scanner);
337 }
338 if (yyparse(scanner) || cflex.error)
339 exit(1);
340 yylex_destroy(scanner);
341 if (yfp != NULL)
342 fclose(yfp);
343 }
344
345 /*
346 * Create a new jail record.
347 */
348 struct cfjail *
add_jail(void)349 add_jail(void)
350 {
351 struct cfjail *j;
352
353 j = emalloc(sizeof(struct cfjail));
354 memset(j, 0, sizeof(struct cfjail));
355 TAILQ_INIT(&j->params);
356 STAILQ_INIT(&j->dep[DEP_FROM]);
357 STAILQ_INIT(&j->dep[DEP_TO]);
358 j->queue = &cfjails;
359 TAILQ_INSERT_TAIL(&cfjails, j, tq);
360 return j;
361 }
362
363 /*
364 * Add a parameter to a jail.
365 */
366 void
add_param(struct cfjail * j,const struct cfparam * p,enum intparam ipnum,const char * value)367 add_param(struct cfjail *j, const struct cfparam *p, enum intparam ipnum,
368 const char *value)
369 {
370 struct cfstrings nss;
371 struct cfparam *dp, *np;
372 struct cfstring *s, *ns;
373 struct cfvar *v, *nv;
374 const char *name;
375 char *cs, *tname;
376 unsigned flags;
377
378 if (j == NULL) {
379 /* Create a single anonymous jail if one doesn't yet exist. */
380 j = TAILQ_LAST(&cfjails, cfjails);
381 if (j == NULL)
382 j = add_jail();
383 }
384 TAILQ_INIT(&nss);
385 if (p != NULL) {
386 name = p->name;
387 flags = p->flags;
388 /*
389 * Make a copy of the parameter's string list,
390 * which may be freed if it's overridden later.
391 */
392 TAILQ_FOREACH(s, &p->val, tq) {
393 ns = emalloc(sizeof(struct cfstring));
394 ns->s = estrdup(s->s);
395 ns->len = s->len;
396 STAILQ_INIT(&ns->vars);
397 STAILQ_FOREACH(v, &s->vars, tq) {
398 nv = emalloc(sizeof(struct cfvar));
399 nv->name = strdup(v->name);
400 nv->pos = v->pos;
401 STAILQ_INSERT_TAIL(&ns->vars, nv, tq);
402 }
403 TAILQ_INSERT_TAIL(&nss, ns, tq);
404 }
405 } else {
406 flags = PF_APPEND;
407 if (ipnum != IP__NULL) {
408 name = intparams[ipnum].name;
409 flags |= intparams[ipnum].flags;
410 } else if ((cs = strchr(value, '='))) {
411 tname = alloca(cs - value + 1);
412 strlcpy(tname, value, cs - value + 1);
413 name = tname;
414 value = cs + 1;
415 } else {
416 name = value;
417 value = NULL;
418 }
419 if (value != NULL) {
420 ns = emalloc(sizeof(struct cfstring));
421 ns->s = estrdup(value);
422 ns->len = strlen(value);
423 STAILQ_INIT(&ns->vars);
424 TAILQ_INSERT_TAIL(&nss, ns, tq);
425 }
426 }
427
428 /* See if this parameter has already been added. */
429 if (ipnum != IP__NULL)
430 dp = j->intparams[ipnum];
431 else
432 TAILQ_FOREACH(dp, &j->params, tq)
433 if (!(dp->flags & PF_CONV) && equalopts(dp->name, name))
434 break;
435 if (dp != NULL) {
436 /* Found it - append or replace. */
437 if ((flags ^ dp->flags) & PF_VAR) {
438 jail_warnx(j, "variable \"$%s\" cannot have the same "
439 "name as a parameter.", name);
440 j->flags |= JF_FAILED;
441 return;
442 }
443 if (dp->flags & PF_IMMUTABLE) {
444 jail_warnx(j, "cannot redefine parameter \"%s\".",
445 dp->name);
446 j->flags |= JF_FAILED;
447 return;
448 }
449 if (strcmp(dp->name, name)) {
450 free(dp->name);
451 dp->name = estrdup(name);
452 }
453 if (!(flags & PF_APPEND) || TAILQ_EMPTY(&nss))
454 free_param_strings(dp);
455 TAILQ_CONCAT(&dp->val, &nss, tq);
456 dp->flags |= flags;
457 } else {
458 /* Not found - add it. */
459 np = emalloc(sizeof(struct cfparam));
460 np->name = estrdup(name);
461 TAILQ_INIT(&np->val);
462 TAILQ_CONCAT(&np->val, &nss, tq);
463 np->flags = flags;
464 np->gen = 0;
465 TAILQ_INSERT_TAIL(&j->params, np, tq);
466 if (ipnum != IP__NULL)
467 j->intparams[ipnum] = np;
468 else
469 for (ipnum = IP__NULL + 1; ipnum < IP_NPARAM; ipnum++)
470 if (!(intparams[ipnum].flags & PF_CONV) &&
471 equalopts(name, intparams[ipnum].name)) {
472 if (flags & PF_VAR) {
473 jail_warnx(j,
474 "variable \"$%s\" "
475 "cannot have the same "
476 "name as a parameter.",
477 name);
478 j->flags |= JF_FAILED;
479 return;
480 }
481 j->intparams[ipnum] = np;
482 np->flags |= intparams[ipnum].flags;
483 break;
484 }
485 }
486 }
487
488 /*
489 * Return if a boolean parameter exists and is true.
490 */
491 int
bool_param(const struct cfparam * p)492 bool_param(const struct cfparam *p)
493 {
494 const char *cs;
495
496 if (p == NULL)
497 return 0;
498 cs = strrchr(p->name, '.');
499 return !strncmp(cs ? cs + 1 : p->name, "no", 2) ^
500 (TAILQ_EMPTY(&p->val) ||
501 !strcasecmp(TAILQ_LAST(&p->val, cfstrings)->s, "true") ||
502 (strtol(TAILQ_LAST(&p->val, cfstrings)->s, NULL, 10)));
503 }
504
505 /*
506 * Set an integer if a parameter if it exists.
507 */
508 int
int_param(const struct cfparam * p,int * ip)509 int_param(const struct cfparam *p, int *ip)
510 {
511 if (p == NULL || TAILQ_EMPTY(&p->val))
512 return 0;
513 *ip = strtol(TAILQ_LAST(&p->val, cfstrings)->s, NULL, 10);
514 return 1;
515 }
516
517 /*
518 * Return the string value of a scalar parameter if it exists.
519 */
520 const char *
string_param(const struct cfparam * p)521 string_param(const struct cfparam *p)
522 {
523 return (p && !TAILQ_EMPTY(&p->val)
524 ? TAILQ_LAST(&p->val, cfstrings)->s : NULL);
525 }
526
527 /*
528 * Check syntax and values of internal parameters. Set some internal
529 * parameters based on the values of others.
530 */
531 int
check_intparams(struct cfjail * j)532 check_intparams(struct cfjail *j)
533 {
534 struct cfparam *p;
535 struct cfstring *s;
536 FILE *f;
537 const char *val;
538 char *cs, *ep, *ln;
539 size_t lnlen;
540 int error;
541 #if defined(INET) || defined(INET6)
542 struct addrinfo hints;
543 struct addrinfo *ai0, *ai;
544 const char *hostname;
545 int gicode, defif;
546 #endif
547 #ifdef INET
548 struct in_addr addr4;
549 int ip4ok;
550 char avalue4[INET_ADDRSTRLEN];
551 #endif
552 #ifdef INET6
553 struct in6_addr addr6;
554 int ip6ok;
555 char avalue6[INET6_ADDRSTRLEN];
556 #endif
557
558 error = 0;
559 /* Check format of boolan and integer values. */
560 TAILQ_FOREACH(p, &j->params, tq) {
561 if (!TAILQ_EMPTY(&p->val) && (p->flags & (PF_BOOL | PF_INT))) {
562 val = TAILQ_LAST(&p->val, cfstrings)->s;
563 if (p->flags & PF_BOOL) {
564 if (strcasecmp(val, "false") &&
565 strcasecmp(val, "true") &&
566 ((void)strtol(val, &ep, 10), *ep)) {
567 jail_warnx(j,
568 "%s: unknown boolean value \"%s\"",
569 p->name, val);
570 error = -1;
571 }
572 } else {
573 (void)strtol(val, &ep, 10);
574 if (ep == val || *ep) {
575 jail_warnx(j,
576 "%s: non-integer value \"%s\"",
577 p->name, val);
578 error = -1;
579 }
580 }
581 }
582 }
583
584 #if defined(INET) || defined(INET6)
585 /*
586 * The ip_hostname parameter looks up the hostname, and adds parameters
587 * for any IP addresses it finds.
588 */
589 if (((j->flags & JF_OP_MASK) != JF_STOP ||
590 j->intparams[IP_INTERFACE] != NULL) &&
591 bool_param(j->intparams[IP_IP_HOSTNAME]) &&
592 (hostname = string_param(j->intparams[KP_HOST_HOSTNAME]))) {
593 j->intparams[IP_IP_HOSTNAME] = NULL;
594 /*
595 * Silently ignore unsupported address families from
596 * DNS lookups.
597 */
598 #ifdef INET
599 ip4ok = feature_present("inet");
600 #endif
601 #ifdef INET6
602 ip6ok = feature_present("inet6");
603 #endif
604 if (
605 #if defined(INET) && defined(INET6)
606 ip4ok || ip6ok
607 #elif defined(INET)
608 ip4ok
609 #elif defined(INET6)
610 ip6ok
611 #endif
612 ) {
613 /* Look up the hostname (or get the address) */
614 memset(&hints, 0, sizeof(hints));
615 hints.ai_socktype = SOCK_STREAM;
616 hints.ai_family =
617 #if defined(INET) && defined(INET6)
618 ip4ok ? (ip6ok ? PF_UNSPEC : PF_INET) : PF_INET6;
619 #elif defined(INET)
620 PF_INET;
621 #elif defined(INET6)
622 PF_INET6;
623 #endif
624 gicode = getaddrinfo(hostname, NULL, &hints, &ai0);
625 if (gicode != 0) {
626 jail_warnx(j, "host.hostname %s: %s", hostname,
627 gai_strerror(gicode));
628 error = -1;
629 } else {
630 /*
631 * Convert the addresses to ASCII so jailparam
632 * can convert them back. Errors are not
633 * expected here.
634 */
635 for (ai = ai0; ai; ai = ai->ai_next)
636 switch (ai->ai_family) {
637 #ifdef INET
638 case AF_INET:
639 memcpy(&addr4,
640 &((struct sockaddr_in *)
641 (void *)ai->ai_addr)->
642 sin_addr, sizeof(addr4));
643 if (inet_ntop(AF_INET,
644 &addr4, avalue4,
645 INET_ADDRSTRLEN) == NULL)
646 err(1, "inet_ntop");
647 add_param(j, NULL, KP_IP4_ADDR,
648 avalue4);
649 break;
650 #endif
651 #ifdef INET6
652 case AF_INET6:
653 memcpy(&addr6,
654 &((struct sockaddr_in6 *)
655 (void *)ai->ai_addr)->
656 sin6_addr, sizeof(addr6));
657 if (inet_ntop(AF_INET6,
658 &addr6, avalue6,
659 INET6_ADDRSTRLEN) == NULL)
660 err(1, "inet_ntop");
661 add_param(j, NULL, KP_IP6_ADDR,
662 avalue6);
663 break;
664 #endif
665 }
666 freeaddrinfo(ai0);
667 }
668 }
669 }
670
671 /*
672 * IP addresses may include an interface to set that address on,
673 * a netmask/suffix for that address and options for ifconfig.
674 * These are copied to an internal command parameter and then stripped
675 * so they won't be passed on to jailparam_set.
676 */
677 defif = string_param(j->intparams[IP_INTERFACE]) != NULL;
678 #ifdef INET
679 if (j->intparams[KP_IP4_ADDR] != NULL) {
680 TAILQ_FOREACH(s, &j->intparams[KP_IP4_ADDR]->val, tq) {
681 cs = strchr(s->s, '|');
682 if (cs || defif)
683 add_param(j, NULL, IP__IP4_IFADDR, s->s);
684 if (cs) {
685 s->len -= cs + 1 - s->s;
686 memmove(s->s, cs + 1, s->len + 1);
687 }
688 if ((cs = strchr(s->s, '/')) != NULL) {
689 *cs = '\0';
690 s->len = cs - s->s;
691 }
692 if ((cs = strchr(s->s, ' ')) != NULL) {
693 *cs = '\0';
694 s->len = cs - s->s;
695 }
696 }
697 }
698 #endif
699 #ifdef INET6
700 if (j->intparams[KP_IP6_ADDR] != NULL) {
701 TAILQ_FOREACH(s, &j->intparams[KP_IP6_ADDR]->val, tq) {
702 cs = strchr(s->s, '|');
703 if (cs || defif)
704 add_param(j, NULL, IP__IP6_IFADDR, s->s);
705 if (cs) {
706 s->len -= cs + 1 - s->s;
707 memmove(s->s, cs + 1, s->len + 1);
708 }
709 if ((cs = strchr(s->s, '/')) != NULL) {
710 *cs = '\0';
711 s->len = cs - s->s;
712 }
713 if ((cs = strchr(s->s, ' ')) != NULL) {
714 *cs = '\0';
715 s->len = cs - s->s;
716 }
717 }
718 }
719 #endif
720 #endif
721
722 /*
723 * Read mount.fstab file(s), and treat each line as its own mount
724 * parameter.
725 */
726 if (j->intparams[IP_MOUNT_FSTAB] != NULL) {
727 TAILQ_FOREACH(s, &j->intparams[IP_MOUNT_FSTAB]->val, tq) {
728 if (s->len == 0)
729 continue;
730 f = fopen(s->s, "re");
731 if (f == NULL) {
732 jail_warnx(j, "mount.fstab: %s: %s",
733 s->s, strerror(errno));
734 error = -1;
735 continue;
736 }
737 while ((ln = fgetln(f, &lnlen))) {
738 if ((cs = memchr(ln, '#', lnlen - 1)))
739 lnlen = cs - ln + 1;
740 if (ln[lnlen - 1] == '\n' ||
741 ln[lnlen - 1] == '#')
742 ln[lnlen - 1] = '\0';
743 else {
744 cs = alloca(lnlen + 1);
745 strlcpy(cs, ln, lnlen + 1);
746 ln = cs;
747 }
748 add_param(j, NULL, IP__MOUNT_FROM_FSTAB, ln);
749 }
750 fclose(f);
751 }
752 }
753 if (error)
754 failed(j);
755 return error;
756 }
757
758 /*
759 * Import parameters into libjail's binary jailparam format.
760 */
761 int
import_params(struct cfjail * j)762 import_params(struct cfjail *j)
763 {
764 struct cfparam *p;
765 struct cfstring *s, *ts;
766 struct jailparam *jp;
767 char *value, *cs;
768 size_t vallen;
769 int error;
770
771 error = 0;
772 j->njp = 0;
773 TAILQ_FOREACH(p, &j->params, tq)
774 if (!(p->flags & PF_INTERNAL))
775 j->njp++;
776 j->jp = jp = emalloc(j->njp * sizeof(struct jailparam));
777 TAILQ_FOREACH(p, &j->params, tq) {
778 if (p->flags & PF_INTERNAL)
779 continue;
780 if (jailparam_init(jp, p->name) < 0) {
781 error = -1;
782 jail_warnx(j, "%s", jail_errmsg);
783 jp++;
784 continue;
785 }
786 if (TAILQ_EMPTY(&p->val))
787 value = NULL;
788 else if (!jp->jp_elemlen ||
789 !TAILQ_NEXT(TAILQ_FIRST(&p->val), tq)) {
790 /*
791 * Scalar parameters silently discard multiple (array)
792 * values, keeping only the last value added. This
793 * lets values added from the command line append to
794 * arrays wthout pre-checking the type.
795 */
796 value = TAILQ_LAST(&p->val, cfstrings)->s;
797 } else {
798 /*
799 * Convert arrays into comma-separated strings, which
800 * jailparam_import will then convert back into arrays.
801 */
802 vallen = 0;
803 TAILQ_FOREACH(s, &p->val, tq)
804 vallen += s->len + 1;
805 value = alloca(vallen);
806 cs = value;
807 TAILQ_FOREACH_SAFE(s, &p->val, tq, ts) {
808 memcpy(cs, s->s, s->len);
809 cs += s->len + 1;
810 cs[-1] = ',';
811 }
812 value[vallen - 1] = '\0';
813 }
814 if (jailparam_import(jp, value) < 0) {
815 error = -1;
816 jail_warnx(j, "%s", jail_errmsg);
817 }
818 jp++;
819 }
820 if (error) {
821 jailparam_free(j->jp, j->njp);
822 free(j->jp);
823 j->jp = NULL;
824 failed(j);
825 }
826 return error;
827 }
828
829 /*
830 * Check if options are equal (with or without the "no" prefix).
831 */
832 int
equalopts(const char * opt1,const char * opt2)833 equalopts(const char *opt1, const char *opt2)
834 {
835 char *p;
836
837 /* "opt" vs. "opt" or "noopt" vs. "noopt" */
838 if (strcmp(opt1, opt2) == 0)
839 return (1);
840 /* "noopt" vs. "opt" */
841 if (strncmp(opt1, "no", 2) == 0 && strcmp(opt1 + 2, opt2) == 0)
842 return (1);
843 /* "opt" vs. "noopt" */
844 if (strncmp(opt2, "no", 2) == 0 && strcmp(opt1, opt2 + 2) == 0)
845 return (1);
846 while ((p = strchr(opt1, '.')) != NULL &&
847 !strncmp(opt1, opt2, ++p - opt1)) {
848 opt2 += p - opt1;
849 opt1 = p;
850 /* "foo.noopt" vs. "foo.opt" */
851 if (strncmp(opt1, "no", 2) == 0 && strcmp(opt1 + 2, opt2) == 0)
852 return (1);
853 /* "foo.opt" vs. "foo.noopt" */
854 if (strncmp(opt2, "no", 2) == 0 && strcmp(opt1, opt2 + 2) == 0)
855 return (1);
856 }
857 return (0);
858 }
859
860 /*
861 * See if a jail name matches a wildcard.
862 */
863 int
wild_jail_match(const char * jname,const char * wname)864 wild_jail_match(const char *jname, const char *wname)
865 {
866 const char *jc, *jd, *wc, *wd;
867
868 /*
869 * A non-final "*" component in the wild name matches a single jail
870 * component, and a final "*" matches one or more jail components.
871 */
872 for (jc = jname, wc = wname;
873 (jd = strchr(jc, '.')) && (wd = strchr(wc, '.'));
874 jc = jd + 1, wc = wd + 1)
875 if (strncmp(jc, wc, jd - jc + 1) && strncmp(wc, "*.", 2))
876 return 0;
877 return (!strcmp(jc, wc) || !strcmp(wc, "*"));
878 }
879
880 /*
881 * Return if a jail name is a wildcard.
882 */
883 int
wild_jail_name(const char * wname)884 wild_jail_name(const char *wname)
885 {
886 const char *wc;
887
888 for (wc = strchr(wname, '*'); wc; wc = strchr(wc + 1, '*'))
889 if ((wc == wname || wc[-1] == '.') &&
890 (wc[1] == '\0' || wc[1] == '.'))
891 return 1;
892 return 0;
893 }
894
895 /*
896 * Free a parameter record and all its strings and variables.
897 */
898 static void
free_param(struct cfparams * pp,struct cfparam * p)899 free_param(struct cfparams *pp, struct cfparam *p)
900 {
901 free(p->name);
902 free_param_strings(p);
903 TAILQ_REMOVE(pp, p, tq);
904 free(p);
905 }
906
907 void
free_param_strings(struct cfparam * p)908 free_param_strings(struct cfparam *p)
909 {
910 struct cfstring *s;
911 struct cfvar *v;
912
913 while ((s = TAILQ_FIRST(&p->val))) {
914 free(s->s);
915 while ((v = STAILQ_FIRST(&s->vars))) {
916 free(v->name);
917 STAILQ_REMOVE_HEAD(&s->vars, tq);
918 free(v);
919 }
920 TAILQ_REMOVE(&p->val, s, tq);
921 free(s);
922 }
923 }
924