lib/krb5/acl.c

   1 /*
   2  * Copyright (c) 2000 - 2002, 2004 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "krb5_locl.h"
  35 #include <fnmatch.h>
  36
  37 RCSID("$Id$");
  38
  39 struct acl_field {
  40     enum { acl_string, acl_fnmatch, acl_retval } type;
  41     union {
  42         const char *cstr;
  43         char **retv;
  44     } u;
  45     struct acl_field *next, **last;
  46 };
  47
  48 static void
  49 free_retv(struct acl_field *acl)
  50 {
  51     while(acl != NULL) {
  52         if (acl->type == acl_retval) {
  53             if (*acl->u.retv)
  54                 free(*acl->u.retv);
  55             *acl->u.retv = NULL;
  56         }
  57         acl = acl->next;
  58     }
  59 }
  60
  61 static void
  62 acl_free_list(struct acl_field *acl, int retv)
  63 {
  64     struct acl_field *next;
  65     if (retv)
  66         free_retv(acl);
  67     while(acl != NULL) {
  68         next = acl->next;
  69         free(acl);
  70         acl = next;
  71     }
  72 }
  73
  74 static krb5_error_code
  75 acl_parse_format(krb5_context context,
  76                  struct acl_field **acl_ret,
  77                  const char *format,
  78                  va_list ap)
  79 {
  80     const char *p;
  81     struct acl_field *acl = NULL, *tmp;
  82
  83     for(p = format; *p != '\0'; p++) {
  84         tmp = malloc(sizeof(*tmp));
  85         if(tmp == NULL) {
  86             krb5_set_error_string(context, "malloc: out of memory");
  87             acl_free_list(acl, 0);
  88             return ENOMEM;
  89         }
  90         if(*p == 's') {
  91             tmp->type = acl_string;
  92             tmp->u.cstr = va_arg(ap, const char*);
  93         } else if(*p == 'f') {
  94             tmp->type = acl_fnmatch;
  95             tmp->u.cstr = va_arg(ap, const char*);
  96         } else if(*p == 'r') {
  97             tmp->type = acl_retval;
  98             tmp->u.retv = va_arg(ap, char **);
  99             *tmp->u.retv = NULL;
 100         } else {
 101             krb5_set_error_string(context, "acl_parse_format: "
 102                                   "unknown format specifier %c", *p);
 103             acl_free_list(acl, 0);
 104             free(tmp);
 105             return EINVAL;
 106         }
 107         tmp->next = NULL;
 108         if(acl == NULL)
 109             acl = tmp;
 110         else
 111             *acl->last = tmp;
 112         acl->last = &tmp->next;
 113     }
 114     *acl_ret = acl;
 115     return 0;
 116 }
 117
 118 static krb5_boolean
 119 acl_match_field(krb5_context context,
 120                 const char *string,
 121                 struct acl_field *field)
 122 {
 123     if(field->type == acl_string) {
 124         return !strcmp(field->u.cstr, string);
 125     } else if(field->type == acl_fnmatch) {
 126         return !fnmatch(field->u.cstr, string, 0);
 127     } else if(field->type == acl_retval) {
 128         *field->u.retv = strdup(string);
 129         return TRUE;
 130     }
 131     return FALSE;
 132 }
 133
 134 static krb5_boolean
 135 acl_match_acl(krb5_context context,
 136               struct acl_field *acl,
 137               const char *string)
 138 {
 139     char buf[256];
 140     while(strsep_copy(&string, " \t", buf, sizeof(buf)) != -1) {
 141         if(buf[0] == '\0')
 142             continue; /* skip ws */
 143         if (acl == NULL)
 144             return FALSE;
 145         if(!acl_match_field(context, buf, acl)) {
 146             return FALSE;
 147         }
 148         acl = acl->next;
 149     }
 150     if (acl)
 151         return FALSE;
 152     return TRUE;
 153 }
 154
 155 /**
 156  * krb5_acl_match_string matches ACL format against a string.
 157  *
 158  * The ACL format has three format specifiers: s, f, and r.  Each
 159  * specifier will retrieve one argument from the variable arguments
 160  * for either matching or storing data.  The input string is split up
 161  * using " " (space) and "\t" (tab) as a delimiter; multiple and "\t"
 162  * in a row are considered to be the same.
 163  *
 164  * List of format specifiers:
 165  * - s Matches a string using strcmp(3) (case sensitive).
 166  * - f Matches the string with fnmatch(3). Theflags
 167  *     argument (the last argument) passed to the fnmatch function is 0.
 168  * - r Returns a copy of the string in the char ** passed in; the copy
 169  *     must be freed with free(3). There is no need to free(3) the
 170  *     string on error: the function will clean up and set the pointer
 171  *     to NULL.
 172  *
 173  * @param context Kerberos 5 context
 174  * @param string string to match with
 175  * @param format format to match
 176  * @param ... parameter to format string
 177  *
 178  * @return Return an error code or 0.
 179  *
 180  *
 181  * @code
 182  * char *s;
 183  *
 184  * ret = krb5_acl_match_string(context, "foo", "s", "foo");
 185  * if (ret)
 186  *     krb5_errx(context, 1, "acl didn't match");
 187  * ret = krb5_acl_match_string(context, "foo foo baz/kaka",
 188  *     "ss", "foo", &s, "foo/\\*");
 189  * if (ret) {
 190  *     // no need to free(s) on error
 191  *     assert(s == NULL);
 192  *     krb5_errx(context, 1, "acl didn't match");
 193  * }
 194  * free(s);
 195  * @endcode
 196  *
 197  * @sa krb5_acl_match_file
 198  * @ingroup krb5_support
 199  */
 200
 201 krb5_error_code KRB5_LIB_FUNCTION
 202 krb5_acl_match_string(krb5_context context,
 203                       const char *string,
 204                       const char *format,
 205                       ...)
 206 {
 207     krb5_error_code ret;
 208     krb5_boolean found;
 209     struct acl_field *acl;
 210
 211     va_list ap;
 212     va_start(ap, format);
 213     ret = acl_parse_format(context, &acl, format, ap);
 214     va_end(ap);
 215     if(ret)
 216         return ret;
 217
 218     found = acl_match_acl(context, acl, string);
 219     acl_free_list(acl, !found);
 220     if (found) {
 221         return 0;
 222     } else {
 223         krb5_set_error_string(context, "ACL did not match");
 224         return EACCES;
 225     }
 226 }
 227
 228 /**
 229  * krb5_acl_match_file matches ACL format against each line in a file
 230  * using krb5_acl_match_string(). Lines starting with # are treated
 231  * like comments and ignored.
 232  *
 233  * @param context Kerberos 5 context.
 234  * @param file file with acl listed in the file.
 235  * @param format format to match.
 236  * @param ... parameter to format string.
 237  *
 238  * @return Return an error code or 0.
 239  *
 240  * @sa krb5_acl_match_string
 241  * @ingroup krb5_support
 242  */
 243
 244 krb5_error_code KRB5_LIB_FUNCTION
 245 krb5_acl_match_file(krb5_context context,
 246                     const char *file,
 247                     const char *format,
 248                     ...)
 249 {
 250     krb5_error_code ret;
 251     struct acl_field *acl;
 252     char buf[256];
 253     va_list ap;
 254     FILE *f;
 255     krb5_boolean found;
 256
 257     f = fopen(file, "r");
 258     if(f == NULL) {
 259         int save_errno = errno;
 260
 261         krb5_set_error_string(context, "open(%s): %s", file,
 262                               strerror(save_errno));
 263         return save_errno;
 264     }
 265
 266     va_start(ap, format);
 267     ret = acl_parse_format(context, &acl, format, ap);
 268     va_end(ap);
 269     if(ret) {
 270         fclose(f);
 271         return ret;
 272     }
 273
 274     found = FALSE;
 275     while(fgets(buf, sizeof(buf), f)) {
 276         if(buf[0] == '#')
 277             continue;
 278         if(acl_match_acl(context, acl, buf)) {
 279             found = TRUE;
 280             break;
 281         }
 282         free_retv(acl);
 283     }
 284
 285     fclose(f);
 286     acl_free_list(acl, !found);
 287     if (found) {
 288         return 0;
 289     } else {
 290         krb5_set_error_string(context, "ACL did not match");
 291         return EACCES;
 292     }
 293 }