1 /* 2 * System configuration routines 3 * 4 * Written by Toshiharu OHNO (tony-o@iij.ad.jp) 5 * 6 * Copyright (C) 1993, Internet Initiative Japan, Inc. All rights reserverd. 7 * 8 * Redistribution and use in source and binary forms are permitted 9 * provided that the above copyright notice and this paragraph are 10 * duplicated in all such forms and that any documentation, 11 * advertising materials, and other materials related to such 12 * distribution and use acknowledge that the software was developed 13 * by the Internet Initiative Japan, Inc. The name of the 14 * IIJ may not be used to endorse or promote products derived 15 * from this software without specific prior written permission. 16 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR 17 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED 18 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. 19 * 20 * $FreeBSD$ 21 * 22 * TODO: 23 */ 24 #include <sys/param.h> 25 26 #include <ctype.h> 27 #include <pwd.h> 28 #include <stdio.h> 29 #include <stdlib.h> 30 #include <string.h> 31 #include <termios.h> 32 #include <unistd.h> 33 34 #include "defs.h" 35 #include "command.h" 36 #include "log.h" 37 #include "id.h" 38 #include "systems.h" 39 40 #define issep(ch) ((ch) == ' ' || (ch) == '\t') 41 42 FILE * 43 OpenSecret(const char *file) 44 { 45 FILE *fp; 46 char line[100]; 47 48 snprintf(line, sizeof line, "%s/%s", _PATH_PPP, file); 49 fp = ID0fopen(line, "r"); 50 if (fp == NULL) 51 log_Printf(LogWARN, "OpenSecret: Can't open %s.\n", line); 52 return (fp); 53 } 54 55 void 56 CloseSecret(FILE *fp) 57 { 58 fclose(fp); 59 } 60 61 /* Move string from ``from'' to ``to'', interpreting ``~'' and $.... */ 62 const char * 63 InterpretArg(const char *from, char *to) 64 { 65 char *ptr, *startto, *endto; 66 struct passwd *pwd; 67 int len, instring; 68 const char *env; 69 70 instring = 0; 71 startto = to; 72 endto = to + LINE_LEN - 1; 73 74 while(issep(*from)) 75 from++; 76 77 while (*from != '\0') { 78 switch (*from) { 79 case '"': 80 instring = !instring; 81 *to++ = *from++; 82 break; 83 case '\\': 84 switch (*++from) { 85 case '$': 86 case '~': 87 break; /* Swallow the escapes */ 88 89 default: 90 *to++ = '\\'; /* Pass the escapes on, maybe skipping \# */ 91 break; 92 } 93 *to++ = *from++; 94 break; 95 case '$': 96 if (from[1] == '$') { 97 *to = '\0'; /* For an empty var name below */ 98 from += 2; 99 } else if (from[1] == '{') { 100 ptr = strchr(from+2, '}'); 101 if (ptr) { 102 len = ptr - from - 2; 103 if (endto - to < len ) 104 len = endto - to; 105 if (len) { 106 strncpy(to, from+2, len); 107 to[len] = '\0'; 108 from = ptr+1; 109 } else { 110 *to++ = *from++; 111 continue; 112 } 113 } else { 114 *to++ = *from++; 115 continue; 116 } 117 } else { 118 ptr = to; 119 for (from++; (isalnum(*from) || *from == '_') && ptr < endto; from++) 120 *ptr++ = *from; 121 *ptr = '\0'; 122 } 123 if (*to == '\0') 124 *to++ = '$'; 125 else if ((env = getenv(to)) != NULL) { 126 strncpy(to, env, endto - to); 127 *endto = '\0'; 128 to += strlen(to); 129 } 130 break; 131 132 case '~': 133 ptr = strchr(++from, '/'); 134 len = ptr ? ptr - from : strlen(from); 135 if (len == 0) 136 pwd = getpwuid(ID0realuid()); 137 else { 138 strncpy(to, from, len); 139 to[len] = '\0'; 140 pwd = getpwnam(to); 141 } 142 if (pwd == NULL) 143 *to++ = '~'; 144 else { 145 strncpy(to, pwd->pw_dir, endto - to); 146 *endto = '\0'; 147 to += strlen(to); 148 from += len; 149 } 150 endpwent(); 151 break; 152 153 default: 154 *to++ = *from++; 155 break; 156 } 157 } 158 159 while (to > startto) { 160 to--; 161 if (!issep(*to)) { 162 to++; 163 break; 164 } 165 } 166 *to = '\0'; 167 168 return from; 169 } 170 171 #define CTRL_UNKNOWN (0) 172 #define CTRL_INCLUDE (1) 173 174 static int 175 DecodeCtrlCommand(char *line, char *arg) 176 { 177 const char *end; 178 179 if (!strncasecmp(line, "include", 7) && issep(line[7])) { 180 end = InterpretArg(line+8, arg); 181 if (*end && *end != '#') 182 log_Printf(LogWARN, "Usage: !include filename\n"); 183 else 184 return CTRL_INCLUDE; 185 } 186 return CTRL_UNKNOWN; 187 } 188 189 /* 190 * Initialised in system_IsValid(), set in ReadSystem(), 191 * used by system_IsValid() 192 */ 193 static int modeok; 194 static int userok; 195 static int modereq; 196 197 int 198 AllowUsers(struct cmdargs const *arg) 199 { 200 /* arg->bundle may be NULL (see system_IsValid()) ! */ 201 int f; 202 struct passwd *pwd; 203 204 userok = 0; 205 pwd = getpwuid(ID0realuid()); 206 if (pwd != NULL) 207 for (f = arg->argn; f < arg->argc; f++) 208 if (!strcmp("*", arg->argv[f]) || !strcmp(pwd->pw_name, arg->argv[f])) { 209 userok = 1; 210 break; 211 } 212 endpwent(); 213 214 return 0; 215 } 216 217 int 218 AllowModes(struct cmdargs const *arg) 219 { 220 /* arg->bundle may be NULL (see system_IsValid()) ! */ 221 int f, mode, allowed; 222 223 allowed = 0; 224 for (f = arg->argn; f < arg->argc; f++) { 225 mode = Nam2mode(arg->argv[f]); 226 if (mode == PHYS_NONE || mode == PHYS_ALL) 227 log_Printf(LogWARN, "allow modes: %s: Invalid mode\n", arg->argv[f]); 228 else 229 allowed |= mode; 230 } 231 232 modeok = modereq & allowed ? 1 : 0; 233 return 0; 234 } 235 236 static char * 237 strip(char *line) 238 { 239 int len; 240 241 len = strlen(line); 242 while (len && (line[len-1] == '\n' || line[len-1] == '\r' || 243 issep(line[len-1]))) 244 line[--len] = '\0'; 245 246 while (issep(*line)) 247 line++; 248 249 if (*line == '#') 250 *line = '\0'; 251 252 return line; 253 } 254 255 static int 256 xgets(char *buf, int buflen, FILE *fp) 257 { 258 int len, n; 259 260 n = 0; 261 while (fgets(buf, buflen-1, fp)) { 262 n++; 263 buf[buflen-1] = '\0'; 264 len = strlen(buf); 265 while (len && (buf[len-1] == '\n' || buf[len-1] == '\r')) 266 buf[--len] = '\0'; 267 if (len && buf[len-1] == '\\') { 268 buf += len - 1; 269 buflen -= len - 1; 270 if (!buflen) /* No buffer space */ 271 break; 272 } else 273 break; 274 } 275 return n; 276 } 277 278 /* Values for ``how'' in ReadSystem */ 279 #define SYSTEM_EXISTS 1 280 #define SYSTEM_VALIDATE 2 281 #define SYSTEM_EXEC 3 282 283 static char * 284 GetLabel(char *line, const char *filename, int linenum) 285 { 286 char *argv[MAXARGS]; 287 int argc, len; 288 289 argc = MakeArgs(line, argv, MAXARGS, PARSE_REDUCE); 290 291 if (argc == 2 && !strcmp(argv[1], ":")) 292 return argv[0]; 293 294 if (argc != 1 || (len = strlen(argv[0])) < 2 || argv[0][len-1] != ':') { 295 log_Printf(LogWARN, "Bad label in %s (line %d) - missing colon\n", 296 filename, linenum); 297 return NULL; 298 } 299 argv[0][len-1] = '\0'; /* Lose the ':' */ 300 301 return argv[0]; 302 } 303 304 /* Returns -2 for ``file not found'' and -1 for ``label not found'' */ 305 306 static int 307 ReadSystem(struct bundle *bundle, const char *name, const char *file, 308 struct prompt *prompt, struct datalink *cx, int how) 309 { 310 FILE *fp; 311 char *cp; 312 int n, len; 313 char line[LINE_LEN]; 314 char filename[MAXPATHLEN]; 315 int linenum; 316 int argc; 317 char *argv[MAXARGS]; 318 int allowcmd; 319 int indent; 320 char arg[LINE_LEN]; 321 struct prompt *op; 322 323 if (*file == '/') 324 snprintf(filename, sizeof filename, "%s", file); 325 else 326 snprintf(filename, sizeof filename, "%s/%s", _PATH_PPP, file); 327 fp = ID0fopen(filename, "r"); 328 if (fp == NULL) { 329 log_Printf(LogDEBUG, "ReadSystem: Can't open %s.\n", filename); 330 return -2; 331 } 332 log_Printf(LogDEBUG, "ReadSystem: Checking %s (%s).\n", name, filename); 333 334 linenum = 0; 335 while ((n = xgets(line, sizeof line, fp))) { 336 linenum += n; 337 if (issep(*line)) 338 continue; 339 340 cp = strip(line); 341 342 switch (*cp) { 343 case '\0': /* empty/comment */ 344 break; 345 346 case '!': 347 switch (DecodeCtrlCommand(cp+1, arg)) { 348 case CTRL_INCLUDE: 349 log_Printf(LogCOMMAND, "%s: Including \"%s\"\n", filename, arg); 350 n = ReadSystem(bundle, name, arg, prompt, cx, how); 351 log_Printf(LogCOMMAND, "%s: Done include of \"%s\"\n", filename, arg); 352 if (!n) { 353 fclose(fp); 354 return 0; /* got it */ 355 } 356 break; 357 default: 358 log_Printf(LogWARN, "%s: %s: Invalid command\n", filename, cp); 359 break; 360 } 361 break; 362 363 default: 364 if ((cp = GetLabel(cp, filename, linenum)) == NULL) 365 continue; 366 367 if (strcmp(cp, name) == 0) { 368 /* We're in business */ 369 if (how == SYSTEM_EXISTS) { 370 fclose(fp); 371 return 0; 372 } 373 while ((n = xgets(line, sizeof line, fp))) { 374 linenum += n; 375 indent = issep(*line); 376 cp = strip(line); 377 378 if (*cp == '\0') /* empty / comment */ 379 continue; 380 381 if (!indent) { /* start of next section */ 382 if (*cp != '!' && how == SYSTEM_EXEC) 383 cp = GetLabel(cp, filename, linenum); 384 break; 385 } 386 387 len = strlen(cp); 388 if ((argc = command_Expand_Interpret(cp, len, argv, cp - line)) < 0) 389 log_Printf(LogWARN, "%s: %d: Syntax error\n", filename, linenum); 390 else { 391 allowcmd = argc > 0 && !strcasecmp(argv[0], "allow"); 392 if ((how != SYSTEM_EXEC && allowcmd) || 393 (how == SYSTEM_EXEC && !allowcmd)) { 394 /* 395 * Disable any context so that warnings are given to everyone, 396 * including syslog. 397 */ 398 op = log_PromptContext; 399 log_PromptContext = NULL; 400 command_Run(bundle, argc, (char const *const *)argv, prompt, 401 name, cx); 402 log_PromptContext = op; 403 } 404 } 405 } 406 407 fclose(fp); /* everything read - get out */ 408 return 0; 409 } 410 break; 411 } 412 } 413 fclose(fp); 414 return -1; 415 } 416 417 const char * 418 system_IsValid(const char *name, struct prompt *prompt, int mode) 419 { 420 /* 421 * Note: The ReadSystem() calls only result in calls to the Allow* 422 * functions. arg->bundle will be set to NULL for these commands ! 423 */ 424 int def, how, rs; 425 426 def = !strcmp(name, "default"); 427 how = ID0realuid() == 0 ? SYSTEM_EXISTS : SYSTEM_VALIDATE; 428 userok = 0; 429 modeok = 1; 430 modereq = mode; 431 432 rs = ReadSystem(NULL, "default", CONFFILE, prompt, NULL, how); 433 434 if (!def) { 435 if (rs == -1) 436 rs = 0; /* we don't care that ``default'' doesn't exist */ 437 438 if (rs == 0) 439 rs = ReadSystem(NULL, name, CONFFILE, prompt, NULL, how); 440 441 if (rs == -1) 442 return "Configuration label not found"; 443 444 if (rs == -2) 445 return _PATH_PPP "/" CONFFILE ": File not found"; 446 } 447 448 if (how == SYSTEM_EXISTS) 449 userok = modeok = 1; 450 451 if (!userok) 452 return "User access denied"; 453 454 if (!modeok) 455 return "Mode denied for this label"; 456 457 return NULL; 458 } 459 460 int 461 system_Select(struct bundle *bundle, const char *name, const char *file, 462 struct prompt *prompt, struct datalink *cx) 463 { 464 userok = modeok = 1; 465 modereq = PHYS_ALL; 466 return ReadSystem(bundle, name, file, prompt, cx, SYSTEM_EXEC); 467 } 468