xref: /freebsd/usr.sbin/jail/config.c (revision 724b4bfdf1306e4f2c451b6d146fe0fe0353b2c8)
1 /*-
2  * Copyright (c) 2011 James Gritton
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24  * SUCH DAMAGE.
25  */
26 
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
29 
30 #include <sys/types.h>
31 #include <sys/errno.h>
32 #include <sys/socket.h>
33 #include <sys/sysctl.h>
34 
35 #include <arpa/inet.h>
36 #include <netinet/in.h>
37 
38 #include <err.h>
39 #include <netdb.h>
40 #include <stdio.h>
41 #include <stdlib.h>
42 #include <string.h>
43 #include <unistd.h>
44 
45 #include "jailp.h"
46 
47 struct ipspec {
48 	const char	*name;
49 	unsigned	flags;
50 };
51 
52 extern FILE *yyin;
53 extern int yynerrs;
54 
55 extern int yyparse(void);
56 
57 struct cfjails cfjails = TAILQ_HEAD_INITIALIZER(cfjails);
58 
59 static void free_param(struct cfparams *pp, struct cfparam *p);
60 static void free_param_strings(struct cfparam *p);
61 
62 static const struct ipspec intparams[] = {
63     [IP_ALLOW_DYING] =		{"allow.dying",		PF_INTERNAL | PF_BOOL},
64     [IP_COMMAND] =		{"command",		PF_INTERNAL},
65     [IP_DEPEND] =		{"depend",		PF_INTERNAL},
66     [IP_EXEC_CLEAN] =		{"exec.clean",		PF_INTERNAL | PF_BOOL},
67     [IP_EXEC_CONSOLELOG] =	{"exec.consolelog",	PF_INTERNAL},
68     [IP_EXEC_FIB] =		{"exec.fib",		PF_INTERNAL | PF_INT},
69     [IP_EXEC_JAIL_USER] =	{"exec.jail_user",	PF_INTERNAL},
70     [IP_EXEC_POSTSTART] =	{"exec.poststart",	PF_INTERNAL},
71     [IP_EXEC_POSTSTOP] =	{"exec.poststop",	PF_INTERNAL},
72     [IP_EXEC_PRESTART] =	{"exec.prestart",	PF_INTERNAL},
73     [IP_EXEC_PRESTOP] =		{"exec.prestop",	PF_INTERNAL},
74     [IP_EXEC_START] =		{"exec.start",		PF_INTERNAL},
75     [IP_EXEC_STOP] =		{"exec.stop",		PF_INTERNAL},
76     [IP_EXEC_SYSTEM_JAIL_USER]=	{"exec.system_jail_user",
77 							PF_INTERNAL | PF_BOOL},
78     [IP_EXEC_SYSTEM_USER] =	{"exec.system_user",	PF_INTERNAL},
79     [IP_EXEC_TIMEOUT] =		{"exec.timeout",	PF_INTERNAL | PF_INT},
80 #if defined(INET) || defined(INET6)
81     [IP_INTERFACE] =		{"interface",		PF_INTERNAL},
82     [IP_IP_HOSTNAME] =		{"ip_hostname",		PF_INTERNAL | PF_BOOL},
83 #endif
84     [IP_MOUNT] =		{"mount",		PF_INTERNAL},
85     [IP_MOUNT_DEVFS] =		{"mount.devfs",		PF_INTERNAL | PF_BOOL},
86     [IP_MOUNT_FSTAB] =		{"mount.fstab",		PF_INTERNAL},
87     [IP_STOP_TIMEOUT] =		{"stop.timeout",	PF_INTERNAL | PF_INT},
88     [IP_VNET_INTERFACE] =	{"vnet.interface",	PF_INTERNAL},
89 #ifdef INET
90     [IP__IP4_IFADDR] =		{"ip4.addr",		PF_INTERNAL | PF_CONV},
91 #endif
92 #ifdef INET6
93     [IP__IP6_IFADDR] =		{"ip6.addr",		PF_INTERNAL | PF_CONV},
94 #endif
95     [IP__MOUNT_FROM_FSTAB] =	{"mount.fstab",		PF_INTERNAL | PF_CONV},
96     [IP__OP] =			{NULL,			PF_CONV},
97     [KP_ALLOW_CHFLAGS] =	{"allow.chflags",	0},
98     [KP_ALLOW_MOUNT] =		{"allow.mount",		0},
99     [KP_ALLOW_RAW_SOCKETS] =	{"allow.raw_sockets",	0},
100     [KP_ALLOW_SET_HOSTNAME]=	{"allow.set_hostname",	0},
101     [KP_ALLOW_SOCKET_AF] =	{"allow.socket_af",	0},
102     [KP_ALLOW_SYSVIPC] =	{"allow.sysvipc",	0},
103     [KP_DEVFS_RULESET] =	{"devfs_ruleset",	0},
104     [KP_ENFORCE_STATFS] =	{"enforce_statfs",	0},
105     [KP_HOST_HOSTNAME] =	{"host.hostname",	0},
106 #ifdef INET
107     [KP_IP4_ADDR] =		{"ip4.addr",		0},
108 #endif
109 #ifdef INET6
110     [KP_IP6_ADDR] =		{"ip6.addr",		0},
111 #endif
112     [KP_JID] =			{"jid",			0},
113     [KP_NAME] =			{"name",		0},
114     [KP_PATH] =			{"path",		0},
115     [KP_PERSIST] =		{"persist",		0},
116     [KP_SECURELEVEL] =		{"securelevel",		0},
117     [KP_VNET] =			{"vnet",		0},
118 };
119 
120 /*
121  * Parse the jail configuration file.
122  */
123 void
124 load_config(void)
125 {
126 	struct cfjails wild;
127 	struct cfparams opp;
128 	struct cfjail *j, *tj, *wj;
129 	struct cfparam *p, *vp, *tp;
130 	struct cfstring *s, *vs, *ns;
131 	struct cfvar *v;
132 	char *ep;
133 	size_t varoff;
134 	int did_self, jseq, pgen;
135 
136 	if (!strcmp(cfname, "-")) {
137 		cfname = "STDIN";
138 		yyin = stdin;
139 	} else {
140 		yyin = fopen(cfname, "r");
141 		if (!yyin)
142 			err(1, "%s", cfname);
143 	}
144 	if (yyparse() || yynerrs)
145 		exit(1);
146 
147 	/* Separate the wildcard jails out from the actual jails. */
148 	jseq = 0;
149 	TAILQ_INIT(&wild);
150 	TAILQ_FOREACH_SAFE(j, &cfjails, tq, tj) {
151 		j->seq = ++jseq;
152 		if (wild_jail_name(j->name))
153 			requeue(j, &wild);
154 	}
155 
156 	TAILQ_FOREACH(j, &cfjails, tq) {
157 		/* Set aside the jail's parameters. */
158 		TAILQ_INIT(&opp);
159 		TAILQ_CONCAT(&opp, &j->params, tq);
160 		/*
161 		 * The jail name implies its "name" or "jid" parameter,
162 		 * though they may also be explicitly set later on.
163 		 */
164 		add_param(j, NULL,
165 		    strtol(j->name, &ep, 10) && !*ep ? KP_JID : KP_NAME,
166 		    j->name);
167 		/*
168 		 * Collect parameters for the jail, global parameters/variables,
169 		 * and any matching wildcard jails.
170 		 */
171 		did_self = 0;
172 		TAILQ_FOREACH(wj, &wild, tq) {
173 			if (j->seq < wj->seq && !did_self) {
174 				TAILQ_FOREACH(p, &opp, tq)
175 					add_param(j, p, 0, NULL);
176 				did_self = 1;
177 			}
178 			if (wild_jail_match(j->name, wj->name))
179 				TAILQ_FOREACH(p, &wj->params, tq)
180 					add_param(j, p, 0, NULL);
181 		}
182 		if (!did_self)
183 			TAILQ_FOREACH(p, &opp, tq)
184 				add_param(j, p, 0, NULL);
185 
186 		/* Resolve any variable substitutions. */
187 		pgen = 0;
188 		TAILQ_FOREACH(p, &j->params, tq) {
189 		    p->gen = ++pgen;
190 		find_vars:
191 		    TAILQ_FOREACH(s, &p->val, tq) {
192 			varoff = 0;
193 			while ((v = STAILQ_FIRST(&s->vars))) {
194 				TAILQ_FOREACH(vp, &j->params, tq)
195 					if (!strcmp(vp->name, v->name))
196 						break;
197 				if (!vp) {
198 					jail_warnx(j,
199 					    "%s: variable \"%s\" not found",
200 					    p->name, v->name);
201 				bad_var:
202 					j->flags |= JF_FAILED;
203 					TAILQ_FOREACH(vp, &j->params, tq)
204 						if (vp->gen == pgen)
205 							vp->flags |= PF_BAD;
206 					goto free_var;
207 				}
208 				if (vp->flags & PF_BAD)
209 					goto bad_var;
210 				if (vp->gen == pgen) {
211 					jail_warnx(j, "%s: variable loop",
212 					    v->name);
213 					goto bad_var;
214 				}
215 				TAILQ_FOREACH(vs, &vp->val, tq)
216 					if (!STAILQ_EMPTY(&vs->vars)) {
217 						vp->gen = pgen;
218 						TAILQ_REMOVE(&j->params, vp,
219 						    tq);
220 						TAILQ_INSERT_BEFORE(p, vp, tq);
221 						p = vp;
222 						goto find_vars;
223 					}
224 				vs = TAILQ_FIRST(&vp->val);
225 				if (TAILQ_NEXT(vs, tq) != NULL &&
226 				    (s->s[0] != '\0' ||
227 				     STAILQ_NEXT(v, tq))) {
228 					jail_warnx(j, "%s: array cannot be "
229 					    "substituted inline",
230 					    p->name);
231 					goto bad_var;
232 				}
233 				s->s = erealloc(s->s, s->len + vs->len + 1);
234 				memmove(s->s + v->pos + varoff + vs->len,
235 				    s->s + v->pos + varoff,
236 				    s->len - (v->pos + varoff) + 1);
237 				memcpy(s->s + v->pos + varoff, vs->s, vs->len);
238 				varoff += vs->len;
239 				s->len += vs->len;
240 				while ((vs = TAILQ_NEXT(vs, tq))) {
241 					ns = emalloc(sizeof(struct cfstring));
242 					ns->s = estrdup(vs->s);
243 					ns->len = vs->len;
244 					STAILQ_INIT(&ns->vars);
245 					TAILQ_INSERT_AFTER(&p->val, s, ns, tq);
246 					s = ns;
247 				}
248 			free_var:
249 				free(v->name);
250 				STAILQ_REMOVE_HEAD(&s->vars, tq);
251 				free(v);
252 			}
253 		    }
254 		}
255 
256 		/* Free the jail's original parameter list and any variables. */
257 		while ((p = TAILQ_FIRST(&opp)))
258 			free_param(&opp, p);
259 		TAILQ_FOREACH_SAFE(p, &j->params, tq, tp)
260 			if (p->flags & PF_VAR)
261 				free_param(&j->params, p);
262 	}
263 	while ((wj = TAILQ_FIRST(&wild))) {
264 		free(wj->name);
265 		while ((p = TAILQ_FIRST(&wj->params)))
266 			free_param(&wj->params, p);
267 		TAILQ_REMOVE(&wild, wj, tq);
268 	}
269 }
270 
271 /*
272  * Create a new jail record.
273  */
274 struct cfjail *
275 add_jail(void)
276 {
277 	struct cfjail *j;
278 
279 	j = emalloc(sizeof(struct cfjail));
280 	memset(j, 0, sizeof(struct cfjail));
281 	TAILQ_INIT(&j->params);
282 	STAILQ_INIT(&j->dep[DEP_FROM]);
283 	STAILQ_INIT(&j->dep[DEP_TO]);
284 	j->queue = &cfjails;
285 	TAILQ_INSERT_TAIL(&cfjails, j, tq);
286 	return j;
287 }
288 
289 /*
290  * Add a parameter to a jail.
291  */
292 void
293 add_param(struct cfjail *j, const struct cfparam *p, enum intparam ipnum,
294     const char *value)
295 {
296 	struct cfstrings nss;
297 	struct cfparam *dp, *np;
298 	struct cfstring *s, *ns;
299 	struct cfvar *v, *nv;
300 	const char *name;
301 	char *cs, *tname;
302 	unsigned flags;
303 
304 	if (j == NULL) {
305 		/* Create a single anonymous jail if one doesn't yet exist. */
306 		j = TAILQ_LAST(&cfjails, cfjails);
307 		if (j == NULL)
308 			j = add_jail();
309 	}
310 	TAILQ_INIT(&nss);
311 	if (p != NULL) {
312 		name = p->name;
313 		flags = p->flags;
314 		/*
315 		 * Make a copy of the parameter's string list,
316 		 * which may be freed if it's overridden later.
317 		 */
318 		TAILQ_FOREACH(s, &p->val, tq) {
319 			ns = emalloc(sizeof(struct cfstring));
320 			ns->s = estrdup(s->s);
321 			ns->len = s->len;
322 			STAILQ_INIT(&ns->vars);
323 			STAILQ_FOREACH(v, &s->vars, tq) {
324 				nv = emalloc(sizeof(struct cfvar));
325 				nv->name = strdup(v->name);
326 				nv->pos = v->pos;
327 				STAILQ_INSERT_TAIL(&ns->vars, nv, tq);
328 			}
329 			TAILQ_INSERT_TAIL(&nss, ns, tq);
330 		}
331 	} else {
332 		flags = PF_APPEND;
333 		if (ipnum != IP__NULL) {
334 			name = intparams[ipnum].name;
335 			flags |= intparams[ipnum].flags;
336 		} else if ((cs = strchr(value, '='))) {
337 			tname = alloca(cs - value + 1);
338 			strlcpy(tname, value, cs - value + 1);
339 			name = tname;
340 			value = cs + 1;
341 		} else {
342 			name = value;
343 			value = NULL;
344 		}
345 		if (value != NULL) {
346 			ns = emalloc(sizeof(struct cfstring));
347 			ns->s = estrdup(value);
348 			ns->len = strlen(value);
349 			STAILQ_INIT(&ns->vars);
350 			TAILQ_INSERT_TAIL(&nss, ns, tq);
351 		}
352 	}
353 
354 	/* See if this parameter has already been added. */
355 	if (ipnum != IP__NULL)
356 		dp = j->intparams[ipnum];
357 	else
358 		TAILQ_FOREACH(dp, &j->params, tq)
359 			if (!(dp->flags & PF_CONV) && equalopts(dp->name, name))
360 				break;
361 	if (dp != NULL) {
362 		/* Found it - append or replace. */
363 		if (strcmp(dp->name, name)) {
364 			free(dp->name);
365 			dp->name = estrdup(name);
366 		}
367 		if (!(flags & PF_APPEND) || TAILQ_EMPTY(&nss))
368 			free_param_strings(dp);
369 		TAILQ_CONCAT(&dp->val, &nss, tq);
370 		dp->flags |= flags;
371 	} else {
372 		/* Not found - add it. */
373 		np = emalloc(sizeof(struct cfparam));
374 		np->name = estrdup(name);
375 		TAILQ_INIT(&np->val);
376 		TAILQ_CONCAT(&np->val, &nss, tq);
377 		np->flags = flags;
378 		np->gen = 0;
379 		TAILQ_INSERT_TAIL(&j->params, np, tq);
380 		if (ipnum != IP__NULL)
381 			j->intparams[ipnum] = np;
382 		else
383 			for (ipnum = IP__NULL + 1; ipnum < IP_NPARAM; ipnum++)
384 				if (!(intparams[ipnum].flags & PF_CONV) &&
385 				    equalopts(name, intparams[ipnum].name)) {
386 					j->intparams[ipnum] = np;
387 					np->flags |= intparams[ipnum].flags;
388 					break;
389 				}
390 	}
391 }
392 
393 /*
394  * Return if a boolean parameter exists and is true.
395  */
396 int
397 bool_param(const struct cfparam *p)
398 {
399 	const char *cs;
400 
401 	if (p == NULL)
402 		return 0;
403 	cs = strrchr(p->name, '.');
404 	return !strncmp(cs ? cs + 1 : p->name, "no", 2) ^
405 	    (TAILQ_EMPTY(&p->val) ||
406 	     !strcasecmp(TAILQ_LAST(&p->val, cfstrings)->s, "true") ||
407 	     (strtol(TAILQ_LAST(&p->val, cfstrings)->s, NULL, 10)));
408 }
409 
410 /*
411  * Set an integer if a parameter if it exists.
412  */
413 int
414 int_param(const struct cfparam *p, int *ip)
415 {
416 	if (p == NULL || TAILQ_EMPTY(&p->val))
417 		return 0;
418 	*ip = strtol(TAILQ_LAST(&p->val, cfstrings)->s, NULL, 10);
419 	return 1;
420 }
421 
422 /*
423  * Return the string value of a scalar parameter if it exists.
424  */
425 const char *
426 string_param(const struct cfparam *p)
427 {
428 	return (p && !TAILQ_EMPTY(&p->val)
429 	    ? TAILQ_LAST(&p->val, cfstrings)->s : NULL);
430 }
431 
432 /*
433  * Check syntax and values of internal parameters.  Set some internal
434  * parameters based on the values of others.
435  */
436 int
437 check_intparams(struct cfjail *j)
438 {
439 	struct cfparam *p;
440 	struct cfstring *s;
441 	FILE *f;
442 	const char *val;
443 	char *cs, *ep, *ln;
444 	size_t lnlen;
445 	int error;
446 #if defined(INET) || defined(INET6)
447 	struct addrinfo hints;
448 	struct addrinfo *ai0, *ai;
449 	const char *hostname;
450 	int gicode, defif, prefix;
451 #endif
452 #ifdef INET
453 	struct in_addr addr4;
454 	int ip4ok;
455 	char avalue4[INET_ADDRSTRLEN];
456 #endif
457 #ifdef INET6
458 	struct in6_addr addr6;
459 	int ip6ok;
460 	char avalue6[INET6_ADDRSTRLEN];
461 #endif
462 
463 	error = 0;
464 	/* Check format of boolan and integer values. */
465 	TAILQ_FOREACH(p, &j->params, tq) {
466 		if (!TAILQ_EMPTY(&p->val) && (p->flags & (PF_BOOL | PF_INT))) {
467 			val = TAILQ_LAST(&p->val, cfstrings)->s;
468 			if (p->flags & PF_BOOL) {
469 				if (strcasecmp(val, "false") &&
470 				    strcasecmp(val, "true") &&
471 				    ((void)strtol(val, &ep, 10), *ep)) {
472 					jail_warnx(j,
473 					    "%s: unknown boolean value \"%s\"",
474 					    p->name, val);
475 					error = -1;
476 				}
477 			} else {
478 				(void)strtol(val, &ep, 10);
479 				if (ep == val || *ep) {
480 					jail_warnx(j,
481 					    "%s: non-integer value \"%s\"",
482 					    p->name, val);
483 					error = -1;
484 				}
485 			}
486 		}
487 	}
488 
489 #if defined(INET) || defined(INET6)
490 	/*
491 	 * The ip_hostname parameter looks up the hostname, and adds parameters
492 	 * for any IP addresses it finds.
493 	 */
494 	if (((j->flags & JF_OP_MASK) != JF_STOP ||
495 	    j->intparams[IP_INTERFACE] != NULL) &&
496 	    bool_param(j->intparams[IP_IP_HOSTNAME]) &&
497 	    (hostname = string_param(j->intparams[KP_HOST_HOSTNAME]))) {
498 		j->intparams[IP_IP_HOSTNAME] = NULL;
499 		/*
500 		 * Silently ignore unsupported address families from
501 		 * DNS lookups.
502 		 */
503 #ifdef INET
504 		ip4ok = feature_present("inet");
505 #endif
506 #ifdef INET6
507 		ip6ok = feature_present("inet6");
508 #endif
509 		if (
510 #if defined(INET) && defined(INET6)
511 		    ip4ok || ip6ok
512 #elif defined(INET)
513 		    ip4ok
514 #elif defined(INET6)
515 		    ip6ok
516 #endif
517 			 ) {
518 			/* Look up the hostname (or get the address) */
519 			memset(&hints, 0, sizeof(hints));
520 			hints.ai_socktype = SOCK_STREAM;
521 			hints.ai_family =
522 #if defined(INET) && defined(INET6)
523 			    ip4ok ? (ip6ok ? PF_UNSPEC : PF_INET) :  PF_INET6;
524 #elif defined(INET)
525 			    PF_INET;
526 #elif defined(INET6)
527 			    PF_INET6;
528 #endif
529 			gicode = getaddrinfo(hostname, NULL, &hints, &ai0);
530 			if (gicode != 0) {
531 				jail_warnx(j, "host.hostname %s: %s", hostname,
532 				    gai_strerror(gicode));
533 				error = -1;
534 			} else {
535 				/*
536 				 * Convert the addresses to ASCII so jailparam
537 				 * can convert them back.  Errors are not
538 				 * expected here.
539 				 */
540 				for (ai = ai0; ai; ai = ai->ai_next)
541 					switch (ai->ai_family) {
542 #ifdef INET
543 					case AF_INET:
544 						memcpy(&addr4,
545 						    &((struct sockaddr_in *)
546 						    (void *)ai->ai_addr)->
547 						    sin_addr, sizeof(addr4));
548 						if (inet_ntop(AF_INET,
549 						    &addr4, avalue4,
550 						    INET_ADDRSTRLEN) == NULL)
551 							err(1, "inet_ntop");
552 						add_param(j, NULL, KP_IP4_ADDR,
553 						    avalue4);
554 						break;
555 #endif
556 #ifdef INET6
557 					case AF_INET6:
558 						memcpy(&addr6,
559 						    &((struct sockaddr_in6 *)
560 						    (void *)ai->ai_addr)->
561 						    sin6_addr, sizeof(addr6));
562 						if (inet_ntop(AF_INET6,
563 						    &addr6, avalue6,
564 						    INET6_ADDRSTRLEN) == NULL)
565 							err(1, "inet_ntop");
566 						add_param(j, NULL, KP_IP6_ADDR,
567 						    avalue6);
568 						break;
569 #endif
570 					}
571 				freeaddrinfo(ai0);
572 			}
573 		}
574 	}
575 
576 	/*
577 	 * IP addresses may include an interface to set that address on,
578 	 * and a netmask/suffix for that address.
579 	 */
580 	defif = string_param(j->intparams[IP_INTERFACE]) != NULL;
581 #ifdef INET
582 	if (j->intparams[KP_IP4_ADDR] != NULL) {
583 		TAILQ_FOREACH(s, &j->intparams[KP_IP4_ADDR]->val, tq) {
584 			cs = strchr(s->s, '|');
585 			if (cs || defif)
586 				add_param(j, NULL, IP__IP4_IFADDR, s->s);
587 			if (cs) {
588 				strcpy(s->s, cs + 1);
589 				s->len -= cs + 1 - s->s;
590 			}
591 			if ((cs = strchr(s->s, '/'))) {
592 				prefix = strtol(cs + 1, &ep, 10);
593 				if (*ep == '.'
594 				    ? inet_pton(AF_INET, cs + 1, &addr4) != 1
595 				    : *ep || prefix < 0 || prefix > 32) {
596 					jail_warnx(j,
597 					    "ip4.addr: bad netmask \"%s\"", cs);
598 					error = -1;
599 				}
600 				*cs = '\0';
601 				s->len = cs - s->s;
602 			}
603 		}
604 	}
605 #endif
606 #ifdef INET6
607 	if (j->intparams[KP_IP6_ADDR] != NULL) {
608 		TAILQ_FOREACH(s, &j->intparams[KP_IP6_ADDR]->val, tq) {
609 			cs = strchr(s->s, '|');
610 			if (cs || defif)
611 				add_param(j, NULL, IP__IP6_IFADDR, s->s);
612 			if (cs) {
613 				strcpy(s->s, cs + 1);
614 				s->len -= cs + 1 - s->s;
615 			}
616 			if ((cs = strchr(s->s, '/'))) {
617 				prefix = strtol(cs + 1, &ep, 10);
618 				if (*ep || prefix < 0 || prefix > 128) {
619 					jail_warnx(j,
620 					    "ip6.addr: bad prefixlen \"%s\"",
621 					    cs);
622 					error = -1;
623 				}
624 				*cs = '\0';
625 				s->len = cs - s->s;
626 			}
627 		}
628 	}
629 #endif
630 #endif
631 
632 	/*
633 	 * Read mount.fstab file(s), and treat each line as its own mount
634 	 * parameter.
635 	 */
636 	if (j->intparams[IP_MOUNT_FSTAB] != NULL) {
637 		TAILQ_FOREACH(s, &j->intparams[IP_MOUNT_FSTAB]->val, tq) {
638 			if (s->len == 0)
639 				continue;
640 			f = fopen(s->s, "r");
641 			if (f == NULL) {
642 				jail_warnx(j, "mount.fstab: %s: %s",
643 				    s->s, strerror(errno));
644 				error = -1;
645 				continue;
646 			}
647 			while ((ln = fgetln(f, &lnlen))) {
648 				if ((cs = memchr(ln, '#', lnlen - 1)))
649 					lnlen = cs - ln + 1;
650 				if (ln[lnlen - 1] == '\n' ||
651 				    ln[lnlen - 1] == '#')
652 					ln[lnlen - 1] = '\0';
653 				else {
654 					cs = alloca(lnlen + 1);
655 					strlcpy(cs, ln, lnlen + 1);
656 					ln = cs;
657 				}
658 				add_param(j, NULL, IP__MOUNT_FROM_FSTAB, ln);
659 			}
660 			fclose(f);
661 		}
662 	}
663 	if (error)
664 		failed(j);
665 	return error;
666 }
667 
668 /*
669  * Import parameters into libjail's binary jailparam format.
670  */
671 int
672 import_params(struct cfjail *j)
673 {
674 	struct cfparam *p;
675 	struct cfstring *s, *ts;
676 	struct jailparam *jp;
677 	char *value, *cs;
678 	size_t vallen;
679 	int error;
680 
681 	error = 0;
682 	j->njp = 0;
683 	TAILQ_FOREACH(p, &j->params, tq)
684 		if (!(p->flags & PF_INTERNAL))
685 			j->njp++;
686 	j->jp = jp = emalloc(j->njp * sizeof(struct jailparam));
687 	TAILQ_FOREACH(p, &j->params, tq) {
688 		if (p->flags & PF_INTERNAL)
689 			continue;
690 		if (jailparam_init(jp, p->name) < 0) {
691 			error = -1;
692 			jail_warnx(j, "%s", jail_errmsg);
693 			jp++;
694 			continue;
695 		}
696 		if (TAILQ_EMPTY(&p->val))
697 			value = NULL;
698 		else if (!jp->jp_elemlen ||
699 			 !TAILQ_NEXT(TAILQ_FIRST(&p->val), tq)) {
700 			/*
701 			 * Scalar parameters silently discard multiple (array)
702 			 * values, keeping only the last value added.  This
703 			 * lets values added from the command line append to
704 			 * arrays wthout pre-checking the type.
705 			 */
706 			value = TAILQ_LAST(&p->val, cfstrings)->s;
707 		} else {
708 			/*
709 			 * Convert arrays into comma-separated strings, which
710 			 * jailparam_import will then convert back into arrays.
711 			 */
712 			vallen = 0;
713 			TAILQ_FOREACH(s, &p->val, tq)
714 				vallen += s->len + 1;
715 			value = alloca(vallen);
716 			cs = value;
717 			TAILQ_FOREACH_SAFE(s, &p->val, tq, ts) {
718 				memcpy(cs, s->s, s->len);
719 				cs += s->len + 1;
720 				cs[-1] = ',';
721 			}
722 			value[vallen - 1] = '\0';
723 		}
724 		if (jailparam_import(jp, value) < 0) {
725 			error = -1;
726 			jail_warnx(j, "%s", jail_errmsg);
727 		}
728 		jp++;
729 	}
730 	if (error) {
731 		jailparam_free(j->jp, j->njp);
732 		free(j->jp);
733 		j->jp = NULL;
734 		failed(j);
735 	}
736 	return error;
737 }
738 
739 /*
740  * Check if options are equal (with or without the "no" prefix).
741  */
742 int
743 equalopts(const char *opt1, const char *opt2)
744 {
745 	char *p;
746 
747 	/* "opt" vs. "opt" or "noopt" vs. "noopt" */
748 	if (strcmp(opt1, opt2) == 0)
749 		return (1);
750 	/* "noopt" vs. "opt" */
751 	if (strncmp(opt1, "no", 2) == 0 && strcmp(opt1 + 2, opt2) == 0)
752 		return (1);
753 	/* "opt" vs. "noopt" */
754 	if (strncmp(opt2, "no", 2) == 0 && strcmp(opt1, opt2 + 2) == 0)
755 		return (1);
756 	while ((p = strchr(opt1, '.')) != NULL &&
757 	    !strncmp(opt1, opt2, ++p - opt1)) {
758 		opt2 += p - opt1;
759 		opt1 = p;
760 		/* "foo.noopt" vs. "foo.opt" */
761 		if (strncmp(opt1, "no", 2) == 0 && strcmp(opt1 + 2, opt2) == 0)
762 			return (1);
763 		/* "foo.opt" vs. "foo.noopt" */
764 		if (strncmp(opt2, "no", 2) == 0 && strcmp(opt1, opt2 + 2) == 0)
765 			return (1);
766 	}
767 	return (0);
768 }
769 
770 /*
771  * See if a jail name matches a wildcard.
772  */
773 int
774 wild_jail_match(const char *jname, const char *wname)
775 {
776 	const char *jc, *jd, *wc, *wd;
777 
778 	/*
779 	 * A non-final "*" component in the wild name matches a single jail
780 	 * component, and a final "*" matches one or more jail components.
781 	 */
782 	for (jc = jname, wc = wname;
783 	     (jd = strchr(jc, '.')) && (wd = strchr(wc, '.'));
784 	     jc = jd + 1, wc = wd + 1)
785 		if (strncmp(jc, wc, jd - jc + 1) && strncmp(wc, "*.", 2))
786 			return 0;
787 	return (!strcmp(jc, wc) || !strcmp(wc, "*"));
788 }
789 
790 /*
791  * Return if a jail name is a wildcard.
792  */
793 int
794 wild_jail_name(const char *wname)
795 {
796 	const char *wc;
797 
798 	for (wc = strchr(wname, '*'); wc; wc = strchr(wc + 1, '*'))
799 		if ((wc == wname || wc[-1] == '.') &&
800 		    (wc[1] == '\0' || wc[1] == '.'))
801 			return 1;
802 	return 0;
803 }
804 
805 /*
806  * Free a parameter record and all its strings and variables.
807  */
808 static void
809 free_param(struct cfparams *pp, struct cfparam *p)
810 {
811 	free(p->name);
812 	free_param_strings(p);
813 	TAILQ_REMOVE(pp, p, tq);
814 	free(p);
815 }
816 
817 static void
818 free_param_strings(struct cfparam *p)
819 {
820 	struct cfstring *s;
821 	struct cfvar *v;
822 
823 	while ((s = TAILQ_FIRST(&p->val))) {
824 		free(s->s);
825 		while ((v = STAILQ_FIRST(&s->vars))) {
826 			free(v->name);
827 			STAILQ_REMOVE_HEAD(&s->vars, tq);
828 			free(v);
829 		}
830 		TAILQ_REMOVE(&p->val, s, tq);
831 		free(s);
832 	}
833 }
834