lib/krb5/acl.c

   1 /*
   2  * Copyright (c) 2000 - 2002, 2004 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "krb5_locl.h"
  35 #include <fnmatch.h>
  36
  37 struct acl_field {
  38     enum { acl_string, acl_fnmatch, acl_retval } type;
  39     union {
  40         const char *cstr;
  41         char **retv;
  42     } u;
  43     struct acl_field *next, **last;
  44 };
  45
  46 static void
  47 free_retv(struct acl_field *acl)
  48 {
  49     while(acl != NULL) {
  50         if (acl->type == acl_retval) {
  51             if (*acl->u.retv)
  52                 free(*acl->u.retv);
  53             *acl->u.retv = NULL;
  54         }
  55         acl = acl->next;
  56     }
  57 }
  58
  59 static void
  60 acl_free_list(struct acl_field *acl, int retv)
  61 {
  62     struct acl_field *next;
  63     if (retv)
  64         free_retv(acl);
  65     while(acl != NULL) {
  66         next = acl->next;
  67         free(acl);
  68         acl = next;
  69     }
  70 }
  71
  72 static krb5_error_code
  73 acl_parse_format(krb5_context context,
  74                  struct acl_field **acl_ret,
  75                  const char *format,
  76                  va_list ap)
  77 {
  78     const char *p;
  79     struct acl_field *acl = NULL, *tmp;
  80
  81     for(p = format; *p != '\0'; p++) {
  82         tmp = malloc(sizeof(*tmp));
  83         if(tmp == NULL) {
  84             acl_free_list(acl, 0);
  85             return krb5_enomem(context);
  86         }
  87         if(*p == 's') {
  88             tmp->type = acl_string;
  89             tmp->u.cstr = va_arg(ap, const char*);
  90         } else if(*p == 'f') {
  91             tmp->type = acl_fnmatch;
  92             tmp->u.cstr = va_arg(ap, const char*);
  93         } else if(*p == 'r') {
  94             tmp->type = acl_retval;
  95             tmp->u.retv = va_arg(ap, char **);
  96             *tmp->u.retv = NULL;
  97         } else {
  98             krb5_set_error_message(context, EINVAL,
  99                                    N_("Unknown format specifier %c while "
 100                                      "parsing ACL", "specifier"), *p);
 101             acl_free_list(acl, 0);
 102             free(tmp);
 103             return EINVAL;
 104         }
 105         tmp->next = NULL;
 106         if(acl == NULL)
 107             acl = tmp;
 108         else
 109             *acl->last = tmp;
 110         acl->last = &tmp->next;
 111     }
 112     *acl_ret = acl;
 113     return 0;
 114 }
 115
 116 static krb5_boolean
 117 acl_match_field(krb5_context context,
 118                 const char *string,
 119                 struct acl_field *field)
 120 {
 121     if(field->type == acl_string) {
 122         return !strcmp(field->u.cstr, string);
 123     } else if(field->type == acl_fnmatch) {
 124         return !fnmatch(field->u.cstr, string, 0);
 125     } else if(field->type == acl_retval) {
 126         *field->u.retv = strdup(string);
 127         return TRUE;
 128     }
 129     return FALSE;
 130 }
 131
 132 static krb5_boolean
 133 acl_match_acl(krb5_context context,
 134               struct acl_field *acl,
 135               const char *string)
 136 {
 137     char buf[256];
 138     while(strsep_copy(&string, " \t", buf, sizeof(buf)) != -1) {
 139         if(buf[0] == '\0')
 140             continue; /* skip ws */
 141         if (acl == NULL)
 142             return FALSE;
 143         if(!acl_match_field(context, buf, acl)) {
 144             return FALSE;
 145         }
 146         acl = acl->next;
 147     }
 148     if (acl)
 149         return FALSE;
 150     return TRUE;
 151 }
 152
 153 /**
 154  * krb5_acl_match_string matches ACL format against a string.
 155  *
 156  * The ACL format has three format specifiers: s, f, and r.  Each
 157  * specifier will retrieve one argument from the variable arguments
 158  * for either matching or storing data.  The input string is split up
 159  * using " " (space) and "\t" (tab) as a delimiter; multiple and "\t"
 160  * in a row are considered to be the same.
 161  *
 162  * List of format specifiers:
 163  * - s Matches a string using strcmp(3) (case sensitive).
 164  * - f Matches the string with fnmatch(3). Theflags
 165  *     argument (the last argument) passed to the fnmatch function is 0.
 166  * - r Returns a copy of the string in the char ** passed in; the copy
 167  *     must be freed with free(3). There is no need to free(3) the
 168  *     string on error: the function will clean up and set the pointer
 169  *     to NULL.
 170  *
 171  * @param context Kerberos 5 context
 172  * @param string string to match with
 173  * @param format format to match
 174  * @param ... parameter to format string
 175  *
 176  * @return Return an error code or 0.
 177  *
 178  *
 179  * @code
 180  * char *s;
 181  *
 182  * ret = krb5_acl_match_string(context, "foo", "s", "foo");
 183  * if (ret)
 184  *     krb5_errx(context, 1, "acl didn't match");
 185  * ret = krb5_acl_match_string(context, "foo foo baz/kaka",
 186  *     "ss", "foo", &s, "foo/\\*");
 187  * if (ret) {
 188  *     // no need to free(s) on error
 189  *     assert(s == NULL);
 190  *     krb5_errx(context, 1, "acl didn't match");
 191  * }
 192  * free(s);
 193  * @endcode
 194  *
 195  * @sa krb5_acl_match_file
 196  * @ingroup krb5_support
 197  */
 198
 199 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 200 krb5_acl_match_string(krb5_context context,
 201                       const char *string,
 202                       const char *format,
 203                       ...)
 204 {
 205     krb5_error_code ret;
 206     krb5_boolean found;
 207     struct acl_field *acl;
 208
 209     va_list ap;
 210     va_start(ap, format);
 211     ret = acl_parse_format(context, &acl, format, ap);
 212     va_end(ap);
 213     if(ret)
 214         return ret;
 215
 216     found = acl_match_acl(context, acl, string);
 217     acl_free_list(acl, !found);
 218     if (found) {
 219         return 0;
 220     } else {
 221         krb5_set_error_message(context, EACCES, N_("ACL did not match", ""));
 222         return EACCES;
 223     }
 224 }
 225
 226 /**
 227  * krb5_acl_match_file matches ACL format against each line in a file
 228  * using krb5_acl_match_string(). Lines starting with # are treated
 229  * like comments and ignored.
 230  *
 231  * @param context Kerberos 5 context.
 232  * @param file file with acl listed in the file.
 233  * @param format format to match.
 234  * @param ... parameter to format string.
 235  *
 236  * @return Return an error code or 0.
 237  *
 238  * @sa krb5_acl_match_string
 239  * @ingroup krb5_support
 240  */
 241
 242 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 243 krb5_acl_match_file(krb5_context context,
 244                     const char *file,
 245                     const char *format,
 246                     ...)
 247 {
 248     krb5_error_code ret;
 249     struct acl_field *acl;
 250     char buf[256];
 251     va_list ap;
 252     FILE *f;
 253     krb5_boolean found;
 254
 255     f = fopen(file, "r");
 256     if(f == NULL) {
 257         int save_errno = errno;
 258         rk_strerror_r(save_errno, buf, sizeof(buf));
 259         krb5_set_error_message(context, save_errno,
 260                                N_("open(%s): %s", "file, errno"),
 261                                file, buf);
 262         return save_errno;
 263     }
 264     rk_cloexec_file(f);
 265
 266     va_start(ap, format);
 267     ret = acl_parse_format(context, &acl, format, ap);
 268     va_end(ap);
 269     if(ret) {
 270         fclose(f);
 271         return ret;
 272     }
 273
 274     found = FALSE;
 275     while(fgets(buf, sizeof(buf), f)) {
 276         if(buf[0] == '#')
 277             continue;
 278         if(acl_match_acl(context, acl, buf)) {
 279             found = TRUE;
 280             break;
 281         }
 282         free_retv(acl);
 283     }
 284
 285     fclose(f);
 286     acl_free_list(acl, !found);
 287     if (found) {
 288         return 0;
 289     } else {
 290         krb5_set_error_message(context, EACCES, N_("ACL did not match", ""));
 291         return EACCES;
 292     }
 293 }