xref: /netbsd-src/usr.sbin/inetd/parse.c (revision 71fa92b75e339b362b9e5081fd71c1d9745d93ad)
1 /*	$NetBSD: parse.c,v 1.5 2022/08/10 08:37:53 christos Exp $	*/
2 
3 /*-
4  * Copyright (c) 1998, 2003 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Jason R. Thorpe of the Numerical Aerospace Simulation Facility,
9  * NASA Ames Research Center and by Matthias Scheler.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
22  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
23  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
24  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30  * POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 /*
34  * Copyright (c) 1983, 1991, 1993, 1994
35  *	The Regents of the University of California.  All rights reserved.
36  *
37  * Redistribution and use in source and binary forms, with or without
38  * modification, are permitted provided that the following conditions
39  * are met:
40  * 1. Redistributions of source code must retain the above copyright
41  *    notice, this list of conditions and the following disclaimer.
42  * 2. Redistributions in binary form must reproduce the above copyright
43  *    notice, this list of conditions and the following disclaimer in the
44  *    documentation and/or other materials provided with the distribution.
45  * 3. Neither the name of the University nor the names of its contributors
46  *    may be used to endorse or promote products derived from this software
47  *    without specific prior written permission.
48  *
49  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
50  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
51  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
52  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
53  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
54  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
55  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
56  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
58  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
59  * SUCH DAMAGE.
60  */
61 
62 #include <sys/cdefs.h>
63 #ifndef lint
64 #if 0
65 static char sccsid[] = "@(#)inetd.c	8.4 (Berkeley) 4/13/94";
66 #else
67 __RCSID("$NetBSD: parse.c,v 1.5 2022/08/10 08:37:53 christos Exp $");
68 #endif
69 #endif /* not lint */
70 
71 /*
72  * This file contains code and state for loading and managing servtabs.
73  * The "positional" syntax parsing is performed in this file. See parse_v2.c
74  * for "key-values" syntax parsing.
75  */
76 
77 #include <sys/param.h>
78 #include <sys/stat.h>
79 #include <sys/socket.h>
80 #include <sys/queue.h>
81 
82 #include <ctype.h>
83 #include <err.h>
84 #include <errno.h>
85 #include <fcntl.h>
86 #include <glob.h>
87 #include <libgen.h>
88 #include <stdio.h>
89 #include <stdlib.h>
90 #include <string.h>
91 #include <syslog.h>
92 #include <unistd.h>
93 
94 #include "inetd.h"
95 
96 static void	config(void);
97 static void	endconfig(void);
98 static struct servtab	*enter(struct servtab *);
99 static struct servtab	*getconfigent(char **);
100 #ifdef DEBUG_ENABLE
101 static void	print_service(const char *, struct servtab *);
102 #endif
103 static struct servtab	init_servtab(void);
104 static void	include_configs(char *);
105 static int	glob_error(const char *, int);
106 static void	read_glob_configs(char *);
107 static void	prepare_next_config(const char*);
108 static bool	is_same_service(const struct servtab *, const struct servtab *);
109 static char	*gen_file_pattern(const char *, const char *);
110 static bool	check_no_reinclude(const char *);
111 static void	include_matched_path(char *);
112 static void	purge_unchecked(void);
113 static void	freeconfig(struct servtab *);
114 static char	*skip(char **);
115 
116 size_t	line_number;
117 FILE	*fconfig;
118 /* Temporary storage for new servtab */
119 static struct	servtab serv;
120 /* Current line from current config file */
121 static char	line[LINE_MAX];
122 char    *defhost;
123 #ifdef IPSEC
124 char *policy;
125 #endif
126 
127 /*
128  * Recursively merge loaded service definitions with any defined
129  * in the current or included config files.
130  */
131 static void
config(void)132 config(void)
133 {
134 	struct servtab *sep, *cp;
135 	/*
136 	 * Current position in line, used with key-values notation,
137 	 * saves cp across getconfigent calls.
138 	 */
139 	char *current_pos;
140 	size_t n;
141 
142 	/* open config file from beginning */
143 	fconfig = fopen(CONFIG, "r");
144 	if (fconfig == NULL) {
145 		DPRINTF("Could not open file \"%s\": %s",
146 		    CONFIG, strerror(errno));
147 		syslog(LOG_ERR, "%s: %m", CONFIG);
148 		return;
149 	}
150 
151 	/* First call to nextline will advance line_number to 1 */
152 	line_number = 0;
153 
154 	/* Start parsing at the beginning of the first line */
155 	current_pos = nextline(fconfig);
156 
157 	while ((cp = getconfigent(&current_pos)) != NULL) {
158 		/* Find an already existing service definition */
159 		for (sep = servtab; sep != NULL; sep = sep->se_next)
160 			if (is_same_service(sep, cp))
161 				break;
162 		if (sep != NULL) {
163 			int i;
164 
165 #define SWAP(type, a, b) {type c = a; a = b; b = c;}
166 
167 			/*
168 			 * sep->se_wait may be holding the pid of a daemon
169 			 * that we're waiting for.  If so, don't overwrite
170 			 * it unless the config file explicitly says don't
171 			 * wait.
172 			 */
173 			if (cp->se_bi == 0 &&
174 			    (sep->se_wait == 1 || cp->se_wait == 0))
175 				sep->se_wait = cp->se_wait;
176 			SWAP(char *, sep->se_user, cp->se_user);
177 			SWAP(char *, sep->se_group, cp->se_group);
178 			SWAP(char *, sep->se_server, cp->se_server);
179 			for (i = 0; i < MAXARGV; i++)
180 				SWAP(char *, sep->se_argv[i], cp->se_argv[i]);
181 #ifdef IPSEC
182 			SWAP(char *, sep->se_policy, cp->se_policy);
183 #endif
184 			SWAP(service_type, cp->se_type, sep->se_type);
185 			SWAP(size_t, cp->se_service_max, sep->se_service_max);
186 			SWAP(size_t, cp->se_ip_max, sep->se_ip_max);
187 #undef SWAP
188 			if (isrpcservice(sep))
189 				unregister_rpc(sep);
190 			sep->se_rpcversl = cp->se_rpcversl;
191 			sep->se_rpcversh = cp->se_rpcversh;
192 			freeconfig(cp);
193 #ifdef DEBUG_ENABLE
194 			if (debug)
195 				print_service("REDO", sep);
196 #endif
197 		} else {
198 			sep = enter(cp);
199 #ifdef DEBUG_ENABLE
200 			if (debug)
201 				print_service("ADD ", sep);
202 #endif
203 		}
204 		sep->se_checked = 1;
205 
206 		/*
207 		 * Remainder of config(void) checks validity of servtab options
208 		 * and sets up the service by setting up sockets
209 		 * (in setup(servtab)).
210 		 */
211 		switch (sep->se_family) {
212 		case AF_LOCAL:
213 			if (sep->se_fd != -1)
214 				break;
215 			n = strlen(sep->se_service);
216 			if (n >= sizeof(sep->se_ctrladdr_un.sun_path)) {
217 				syslog(LOG_ERR, "%s/%s: address too long",
218 				    sep->se_service, sep->se_proto);
219 				sep->se_checked = 0;
220 				continue;
221 			}
222 			(void)unlink(sep->se_service);
223 			strlcpy(sep->se_ctrladdr_un.sun_path,
224 			    sep->se_service, n + 1);
225 			sep->se_ctrladdr_un.sun_family = AF_LOCAL;
226 			sep->se_ctrladdr_size = (socklen_t)(n +
227 			    sizeof(sep->se_ctrladdr_un) -
228 			    sizeof(sep->se_ctrladdr_un.sun_path));
229 			if (!ISMUX(sep))
230 				setup(sep);
231 			break;
232 		case AF_INET:
233 #ifdef INET6
234 		case AF_INET6:
235 #endif
236 		    {
237 			struct addrinfo hints, *res;
238 			char *host;
239 			const char *port;
240 			int error;
241 			int s;
242 
243 			/* check if the family is supported */
244 			s = socket(sep->se_family, SOCK_DGRAM, 0);
245 			if (s < 0) {
246 				syslog(LOG_WARNING,
247 				    "%s/%s: %s: the address family is not "
248 				    "supported by the kernel",
249 				    sep->se_service, sep->se_proto,
250 				    sep->se_hostaddr);
251 				sep->se_checked = false;
252 				continue;
253 			}
254 			close(s);
255 
256 			memset(&hints, 0, sizeof(hints));
257 			hints.ai_family = sep->se_family;
258 			hints.ai_socktype = sep->se_socktype;
259 			hints.ai_flags = AI_PASSIVE;
260 			if (strcmp(sep->se_hostaddr, "*") == 0)
261 				host = NULL;
262 			else
263 				host = sep->se_hostaddr;
264 			if (isrpcservice(sep) || ISMUX(sep))
265 				port = "0";
266 			else
267 				port = sep->se_service;
268 			error = getaddrinfo(host, port, &hints, &res);
269 			if (error != 0) {
270 				if (error == EAI_SERVICE) {
271 					/* gai_strerror not friendly enough */
272 					syslog(LOG_WARNING, SERV_FMT ": "
273 					    "unknown service",
274 					    SERV_PARAMS(sep));
275 				} else {
276 					syslog(LOG_ERR, SERV_FMT ": %s: %s",
277 					    SERV_PARAMS(sep),
278 					    sep->se_hostaddr,
279 					    gai_strerror(error));
280 				}
281 				sep->se_checked = false;
282 				continue;
283 			}
284 			if (res->ai_next != NULL) {
285 				syslog(LOG_ERR, SERV_FMT
286 				    ": %s: resolved to multiple addr",
287 				    SERV_PARAMS(sep),
288 				    sep->se_hostaddr);
289 				sep->se_checked = false;
290 				freeaddrinfo(res);
291 				continue;
292 			}
293 			memcpy(&sep->se_ctrladdr, res->ai_addr,
294 				res->ai_addrlen);
295 			if (ISMUX(sep)) {
296 				sep->se_fd = -1;
297 				freeaddrinfo(res);
298 				continue;
299 			}
300 			sep->se_ctrladdr_size = res->ai_addrlen;
301 			freeaddrinfo(res);
302 #ifdef RPC
303 			if (isrpcservice(sep)) {
304 				struct rpcent *rp;
305 
306 				sep->se_rpcprog = atoi(sep->se_service);
307 				if (sep->se_rpcprog == 0) {
308 					rp = getrpcbyname(sep->se_service);
309 					if (rp == 0) {
310 						syslog(LOG_ERR,
311 						    SERV_FMT
312 						    ": unknown service",
313 						    SERV_PARAMS(sep));
314 						sep->se_checked = false;
315 						continue;
316 					}
317 					sep->se_rpcprog = rp->r_number;
318 				}
319 				if (sep->se_fd == -1 && !ISMUX(sep))
320 					setup(sep);
321 				if (sep->se_fd != -1)
322 					register_rpc(sep);
323 			} else
324 #endif /* RPC */
325 			{
326 				if (sep->se_fd >= 0)
327 					close_sep(sep);
328 				if (sep->se_fd == -1 && !ISMUX(sep))
329 					setup(sep);
330 			}
331 		    }
332 		}
333 	}
334 	endconfig();
335 }
336 
337 static struct servtab *
enter(struct servtab * cp)338 enter(struct servtab *cp)
339 {
340 	struct servtab *sep;
341 
342 	sep = malloc(sizeof (*sep));
343 	if (sep == NULL) {
344 		syslog(LOG_ERR, "Out of memory.");
345 		exit(EXIT_FAILURE);
346 	}
347 	*sep = *cp;
348 	sep->se_fd = -1;
349 	sep->se_rpcprog = -1;
350 	sep->se_next = servtab;
351 	servtab = sep;
352 	return (sep);
353 }
354 
355 static void
endconfig(void)356 endconfig(void)
357 {
358 	if (fconfig != NULL) {
359 		(void) fclose(fconfig);
360 		fconfig = NULL;
361 	}
362 	if (defhost != NULL) {
363 		free(defhost);
364 		defhost = NULL;
365 	}
366 
367 #ifdef IPSEC
368 	if (policy != NULL) {
369 		free(policy);
370 		policy = NULL;
371 	}
372 #endif
373 
374 }
375 
376 #define LOG_EARLY_ENDCONF() \
377 	ERR("Exiting %s early. Some services will be unavailable", CONFIG)
378 
379 #define LOG_TOO_FEW_ARGS() \
380 	ERR("Expected more arguments")
381 
382 /* Parse the next service and apply any directives, and returns it as servtab */
383 static struct servtab *
getconfigent(char ** current_pos)384 getconfigent(char **current_pos)
385 {
386 	struct servtab *sep = &serv;
387 	int argc, val;
388 	char *cp, *cp0, *arg, *buf0, *buf1, *sz0, *sz1;
389 	static char TCPMUX_TOKEN[] = "tcpmux/";
390 #define MUX_LEN		(sizeof(TCPMUX_TOKEN)-1)
391 	char *hostdelim;
392 
393 	/*
394 	 * Pre-condition: current_pos points into line,
395 	 * line contains config line. Continue where the last getconfigent
396 	 * left off. Allows for multiple service definitions per line.
397 	 */
398 	cp = *current_pos;
399 
400 	if (/*CONSTCOND*/false) {
401 		/*
402 		 * Go to the next line, but only after attempting to read the
403 		 * current one! Keep reading until we find a valid definition
404 		 * or EOF.
405 		 */
406 more:
407 		cp = nextline(fconfig);
408 	}
409 
410 	if (cp == NULL) {
411 		/* EOF or I/O error, let config() know to exit the file */
412 		return NULL;
413 	}
414 
415 	/* Comments and IPsec policies */
416 	if (cp[0] == '#') {
417 #ifdef IPSEC
418 		/* lines starting with #@ is not a comment, but the policy */
419 		if (cp[1] == '@') {
420 			char *p;
421 			for (p = cp + 2; isspace((unsigned char)*p); p++)
422 				;
423 			if (*p == '\0') {
424 				if (policy)
425 					free(policy);
426 				policy = NULL;
427 			} else {
428 				if (ipsecsetup_test(p) < 0) {
429 					ERR("Invalid IPsec policy \"%s\"", p);
430 					LOG_EARLY_ENDCONF();
431 					/*
432 					 * Stop reading the current config to
433 					 * prevent services from being run
434 					 * without IPsec.
435 					 */
436 					return NULL;
437 				} else {
438 					if (policy)
439 						free(policy);
440 					policy = newstr(p);
441 				}
442 			}
443 		}
444 #endif
445 
446 		goto more;
447 	}
448 
449 	/* Parse next token: listen-addr/hostname, service-spec, .include */
450 	arg = skip(&cp);
451 
452 	if (cp == NULL) {
453 		goto more;
454 	}
455 
456 	if (arg[0] == '.') {
457 		if (strcmp(&arg[1], "include") == 0) {
458 			/* include directive */
459 			arg = skip(&cp);
460 			if (arg == NULL) {
461 				LOG_TOO_FEW_ARGS();
462 				return NULL;
463 			}
464 			include_configs(arg);
465 			goto more;
466 		} else {
467 			ERR("Unknown directive '%s'", &arg[1]);
468 			goto more;
469 		}
470 	}
471 
472 	/* After this point, we might need to store data in a servtab */
473 	*sep = init_servtab();
474 
475 	/* Check for a host name. */
476 	hostdelim = strrchr(arg, ':');
477 	if (hostdelim != NULL) {
478 		*hostdelim = '\0';
479 		if (arg[0] == '[' && hostdelim > arg && hostdelim[-1] == ']') {
480 			hostdelim[-1] = '\0';
481 			sep->se_hostaddr = newstr(arg + 1);
482 		} else
483 			sep->se_hostaddr = newstr(arg);
484 		arg = hostdelim + 1;
485 		/*
486 		 * If the line is of the form `host:', then just change the
487 		 * default host for the following lines.
488 		 */
489 		if (*arg == '\0') {
490 			arg = skip(&cp);
491 			if (cp == NULL) {
492 				free(defhost);
493 				defhost = sep->se_hostaddr;
494 				goto more;
495 			}
496 		}
497 	} else {
498 		/* No host address found, set it to NULL to indicate absence */
499 		sep->se_hostaddr = NULL;
500 	}
501 	if (strncmp(arg, TCPMUX_TOKEN, MUX_LEN) == 0) {
502 		char *c = arg + MUX_LEN;
503 		if (*c == '+') {
504 			sep->se_type = MUXPLUS_TYPE;
505 			c++;
506 		} else
507 			sep->se_type = MUX_TYPE;
508 		sep->se_service = newstr(c);
509 	} else {
510 		sep->se_service = newstr(arg);
511 		sep->se_type = NORM_TYPE;
512 	}
513 
514 	DPRINTCONF("Found service definition '%s'", sep->se_service);
515 
516 	/* on/off/socktype */
517 	arg = skip(&cp);
518 	if (arg == NULL) {
519 		LOG_TOO_FEW_ARGS();
520 		freeconfig(sep);
521 		goto more;
522 	}
523 
524 	/* Check for new v2 syntax */
525 	if (strcmp(arg, "on") == 0 || strncmp(arg, "on#", 3) == 0) {
526 
527 		if (arg[2] == '#') {
528 			cp = nextline(fconfig);
529 		}
530 
531 		switch(parse_syntax_v2(sep, &cp)) {
532 		case V2_SUCCESS:
533 			*current_pos = cp;
534 			return sep;
535 		case V2_SKIP:
536 			/*
537 			 * Skip invalid definitions, freeconfig is called in
538 			 * parse_v2.c
539 			 */
540 			*current_pos = cp;
541 			freeconfig(sep);
542 			goto more;
543 		case V2_ERROR:
544 			/*
545 			 * Unrecoverable error, stop reading. freeconfig
546 			 * is called in parse_v2.c
547 			 */
548 			LOG_EARLY_ENDCONF();
549 			freeconfig(sep);
550 			return NULL;
551 		}
552 	} else if (strcmp(arg, "off") == 0 || strncmp(arg, "off#", 4) == 0) {
553 
554 		if (arg[3] == '#') {
555 			cp = nextline(fconfig);
556 		}
557 
558 		/* Parse syntax the same as with 'on', but ignore the result */
559 		switch(parse_syntax_v2(sep, &cp)) {
560 		case V2_SUCCESS:
561 		case V2_SKIP:
562 			*current_pos = cp;
563 			freeconfig(sep);
564 			goto more;
565 		case V2_ERROR:
566 			/* Unrecoverable error, stop reading */
567 			LOG_EARLY_ENDCONF();
568 			freeconfig(sep);
569 			return NULL;
570 		}
571 	} else {
572 		/* continue parsing v1 */
573 		parse_socktype(arg, sep);
574 		if (sep->se_socktype == SOCK_STREAM) {
575 			parse_accept_filter(arg, sep);
576 		}
577 		if (sep->se_hostaddr == NULL) {
578 			/* Set host to current default */
579 			sep->se_hostaddr = newstr(defhost);
580 		}
581 	}
582 
583 	/* protocol */
584 	arg = skip(&cp);
585 	if (arg == NULL) {
586 		LOG_TOO_FEW_ARGS();
587 		freeconfig(sep);
588 		goto more;
589 	}
590 	if (sep->se_type == NORM_TYPE &&
591 	    strncmp(arg, "faith/", strlen("faith/")) == 0) {
592 		arg += strlen("faith/");
593 		sep->se_type = FAITH_TYPE;
594 	}
595 	sep->se_proto = newstr(arg);
596 
597 #define	MALFORMED(arg) \
598 do { \
599 	ERR("%s: malformed buffer size option `%s'", \
600 	    sep->se_service, (arg)); \
601 	freeconfig(sep); \
602 	goto more; \
603 } while (false)
604 
605 #define	GETVAL(arg) \
606 do { \
607 	if (!isdigit((unsigned char)*(arg))) \
608 		MALFORMED(arg); \
609 	val = (int)strtol((arg), &cp0, 10); \
610 	if (cp0 != NULL) { \
611 		if (cp0[1] != '\0') \
612 			MALFORMED((arg)); \
613 		if (cp0[0] == 'k') \
614 			val *= 1024; \
615 		if (cp0[0] == 'm') \
616 			val *= 1024 * 1024; \
617 	} \
618 	if (val < 1) { \
619 		ERR("%s: invalid buffer size `%s'", \
620 		    sep->se_service, (arg)); \
621 		freeconfig(sep); \
622 		goto more; \
623 	} \
624 } while (false)
625 
626 #define	ASSIGN(arg) \
627 do { \
628 	if (strcmp((arg), "sndbuf") == 0) \
629 		sep->se_sndbuf = val; \
630 	else if (strcmp((arg), "rcvbuf") == 0) \
631 		sep->se_rcvbuf = val; \
632 	else \
633 		MALFORMED((arg)); \
634 } while (false)
635 
636 	/*
637 	 * Extract the send and receive buffer sizes before parsing
638 	 * the protocol.
639 	 */
640 	sep->se_sndbuf = sep->se_rcvbuf = 0;
641 	buf0 = buf1 = sz0 = sz1 = NULL;
642 	if ((buf0 = strchr(sep->se_proto, ',')) != NULL) {
643 		/* Not meaningful for Tcpmux services. */
644 		if (ISMUX(sep)) {
645 			ERR("%s: can't specify buffer sizes for "
646 			    "tcpmux services", sep->se_service);
647 			goto more;
648 		}
649 
650 		/* Skip the , */
651 		*buf0++ = '\0';
652 
653 		/* Check to see if another socket buffer size was specified. */
654 		if ((buf1 = strchr(buf0, ',')) != NULL) {
655 			/* Skip the , */
656 			*buf1++ = '\0';
657 
658 			/* Make sure a 3rd one wasn't specified. */
659 			if (strchr(buf1, ',') != NULL) {
660 				ERR("%s: too many buffer sizes",
661 				    sep->se_service);
662 				goto more;
663 			}
664 
665 			/* Locate the size. */
666 			if ((sz1 = strchr(buf1, '=')) == NULL)
667 				MALFORMED(buf1);
668 
669 			/* Skip the = */
670 			*sz1++ = '\0';
671 		}
672 
673 		/* Locate the size. */
674 		if ((sz0 = strchr(buf0, '=')) == NULL)
675 			MALFORMED(buf0);
676 
677 		/* Skip the = */
678 		*sz0++ = '\0';
679 
680 		GETVAL(sz0);
681 		ASSIGN(buf0);
682 
683 		if (buf1 != NULL) {
684 			GETVAL(sz1);
685 			ASSIGN(buf1);
686 		}
687 	}
688 
689 #undef ASSIGN
690 #undef GETVAL
691 #undef MALFORMED
692 
693 	if (parse_protocol(sep)) {
694 		freeconfig(sep);
695 		goto more;
696 	}
697 
698 	/* wait/nowait:max */
699 	arg = skip(&cp);
700 	if (arg == NULL) {
701 		LOG_TOO_FEW_ARGS();
702 		freeconfig(sep);
703 		goto more;
704 	}
705 
706 	/* Rate limiting parsing */ {
707 		char *cp1;
708 		if ((cp1 = strchr(arg, ':')) == NULL)
709 			cp1 = strchr(arg, '.');
710 		if (cp1 != NULL) {
711 			int rstatus;
712 			*cp1++ = '\0';
713 			sep->se_service_max = (size_t)strtou(cp1, NULL, 10, 0,
714 			    SERVTAB_COUNT_MAX, &rstatus);
715 
716 			if (rstatus != 0) {
717 				if (rstatus != ERANGE) {
718 					/* For compatibility w/ atoi parsing */
719 					sep->se_service_max = 0;
720 				}
721 
722 				WRN("Improper \"max\" value '%s', "
723 				    "using '%zu' instead: %s",
724 				    cp1,
725 				    sep->se_service_max,
726 				    strerror(rstatus));
727 			}
728 
729 		} else
730 			sep->se_service_max = TOOMANY;
731 	}
732 	if (parse_wait(sep, strcmp(arg, "wait") == 0)) {
733 		freeconfig(sep);
734 		goto more;
735 	}
736 
737 	/* Parse user:group token */
738 	arg = skip(&cp);
739 	if (arg == NULL) {
740 		LOG_TOO_FEW_ARGS();
741 		freeconfig(sep);
742 		goto more;
743 	}
744 	char* separator = strchr(arg, ':');
745 	if (separator == NULL) {
746 		/* Backwards compatibility, allow dot instead of colon */
747 		separator = strchr(arg, '.');
748 	}
749 
750 	if (separator == NULL) {
751 		/* Only user was specified */
752 		sep->se_group = NULL;
753 	} else {
754 		*separator = '\0';
755 		sep->se_group = newstr(separator + 1);
756 	}
757 
758 	sep->se_user = newstr(arg);
759 
760 	/* Parser server-program (path to binary or "internal") */
761 	arg = skip(&cp);
762 	if (arg == NULL) {
763 		LOG_TOO_FEW_ARGS();
764 		freeconfig(sep);
765 		goto more;
766 	}
767 	if (parse_server(sep, arg)) {
768 		freeconfig(sep);
769 		goto more;
770 	}
771 
772 	argc = 0;
773 	for (arg = skip(&cp); cp != NULL; arg = skip(&cp)) {
774 		if (argc < MAXARGV)
775 			sep->se_argv[argc++] = newstr(arg);
776 	}
777 	while (argc <= MAXARGV)
778 		sep->se_argv[argc++] = NULL;
779 #ifdef IPSEC
780 	sep->se_policy = policy != NULL ? newstr(policy) : NULL;
781 #endif
782 	/* getconfigent read a positional service def, move to next line */
783 	*current_pos = nextline(fconfig);
784 	return (sep);
785 }
786 
787 void
freeconfig(struct servtab * cp)788 freeconfig(struct servtab *cp)
789 {
790 	int i;
791 
792 	free(cp->se_hostaddr);
793 	free(cp->se_service);
794 	free(cp->se_proto);
795 	free(cp->se_user);
796 	free(cp->se_group);
797 	free(cp->se_server);
798 	for (i = 0; i < MAXARGV; i++)
799 		free(cp->se_argv[i]);
800 #ifdef IPSEC
801 	free(cp->se_policy);
802 #endif
803 }
804 
805 /*
806  * Get next token *in the current service definition* from config file.
807  * Allows multi-line parse if single space or single tab-indented.
808  * Things in quotes are considered single token.
809  * Advances cp to next token.
810  */
811 static char *
skip(char ** cpp)812 skip(char **cpp)
813 {
814 	char *cp = *cpp;
815 	char *start;
816 	char quote;
817 
818 	if (*cpp == NULL)
819 		return (NULL);
820 
821 again:
822 	while (*cp == ' ' || *cp == '\t')
823 		cp++;
824 	if (*cp == '\0') {
825 		int c;
826 
827 		c = getc(fconfig);
828 		(void) ungetc(c, fconfig);
829 		if (c == ' ' || c == '\t')
830 			if ((cp = nextline(fconfig)) != NULL)
831 				goto again;
832 		*cpp = NULL;
833 		return (NULL);
834 	}
835 	start = cp;
836 	/* Parse shell-style quotes */
837 	quote = '\0';
838 	while (*cp != '\0' && (quote != '\0' || (*cp != ' ' && *cp != '\t'))) {
839 		if (*cp == '\'' || *cp == '"') {
840 			if (quote != '\0' && *cp != quote)
841 				cp++;
842 			else {
843 				if (quote != '\0')
844 					quote = '\0';
845 				else
846 					quote = *cp;
847 				memmove(cp, cp+1, strlen(cp));
848 			}
849 		} else
850 			cp++;
851 	}
852 	if (*cp != '\0')
853 		*cp++ = '\0';
854 	*cpp = cp;
855 	return (start);
856 }
857 
858 char *
nextline(FILE * fd)859 nextline(FILE *fd)
860 {
861 	char *cp;
862 
863 	if (fgets(line, (int)sizeof(line), fd) == NULL) {
864 		if (ferror(fd) != 0) {
865 			ERR("Error when reading next line: %s",
866 			    strerror(errno));
867 		}
868 		return NULL;
869 	}
870 	cp = strchr(line, '\n');
871 	if (cp != NULL)
872 		*cp = '\0';
873 	line_number++;
874 	return line;
875 }
876 
877 char *
newstr(const char * cp)878 newstr(const char *cp)
879 {
880 	char *dp;
881 	if ((dp = strdup((cp != NULL) ? cp : "")) != NULL)
882 		return (dp);
883 	syslog(LOG_ERR, "strdup: %m");
884 	exit(EXIT_FAILURE);
885 	/*NOTREACHED*/
886 }
887 
888 #ifdef DEBUG_ENABLE
889 /*
890  * print_service:
891  *	Dump relevant information to stderr
892  */
893 static void
print_service(const char * action,struct servtab * sep)894 print_service(const char *action, struct servtab *sep)
895 {
896 
897 	if (isrpcservice(sep))
898 		fprintf(stderr,
899 		    "%s: %s rpcprog=%d, rpcvers = %d/%d, proto=%s, "
900 		    "wait.max=%d.%zu, "
901 		    "user:group=%s:%s builtin=%lx server=%s"
902 #ifdef IPSEC
903 		    " policy=\"%s\""
904 #endif
905 		    "\n",
906 		    action, sep->se_service,
907 		    sep->se_rpcprog, sep->se_rpcversh, sep->se_rpcversl,
908 		    sep->se_proto, sep->se_wait, sep->se_service_max,
909 		    sep->se_user, sep->se_group,
910 		    (long)sep->se_bi, sep->se_server
911 #ifdef IPSEC
912 		    , (sep->se_policy != NULL ? sep->se_policy : "")
913 #endif
914 		    );
915 	else
916 		fprintf(stderr,
917 		    "%s: %s:%s proto=%s%s, wait.max=%d.%zu, user:group=%s:%s "
918 		    "builtin=%lx "
919 		    "server=%s"
920 #ifdef IPSEC
921 		    " policy=%s"
922 #endif
923 		    "\n",
924 		    action, sep->se_hostaddr, sep->se_service,
925 		    sep->se_type == FAITH_TYPE ? "faith/" : "",
926 		    sep->se_proto,
927 		    sep->se_wait, sep->se_service_max, sep->se_user,
928 		    sep->se_group, (long)sep->se_bi, sep->se_server
929 #ifdef IPSEC
930 		    , (sep->se_policy != NULL ? sep->se_policy : "")
931 #endif
932 		    );
933 }
934 #endif
935 
936 void
config_root(void)937 config_root(void)
938 {
939 	struct servtab *sep;
940 	/* Uncheck services */
941 	for (sep = servtab; sep != NULL; sep = sep->se_next) {
942 		sep->se_checked = false;
943 	}
944 	defhost = newstr("*");
945 #ifdef IPSEC
946 	policy = NULL;
947 #endif
948 	fconfig = NULL;
949 	config();
950 	purge_unchecked();
951 }
952 
953 static void
purge_unchecked(void)954 purge_unchecked(void)
955 {
956 	struct servtab *sep, **sepp = &servtab;
957 	int servtab_count = 0;
958 	while ((sep = *sepp) != NULL) {
959 		if (sep->se_checked) {
960 			sepp = &sep->se_next;
961 			servtab_count++;
962 			continue;
963 		}
964 		*sepp = sep->se_next;
965 		if (sep->se_fd >= 0)
966 			close_sep(sep);
967 		if (isrpcservice(sep))
968 			unregister_rpc(sep);
969 		if (sep->se_family == AF_LOCAL)
970 			(void)unlink(sep->se_service);
971 #ifdef DEBUG_ENABLE
972 		if (debug)
973 			print_service("FREE", sep);
974 #endif
975 		freeconfig(sep);
976 		free(sep);
977 	}
978 	DPRINTF("%d service(s) loaded.", servtab_count);
979 }
980 
981 static bool
is_same_service(const struct servtab * sep,const struct servtab * cp)982 is_same_service(const struct servtab *sep, const struct servtab *cp)
983 {
984 	return
985 	    strcmp(sep->se_service, cp->se_service) == 0 &&
986 	    strcmp(sep->se_hostaddr, cp->se_hostaddr) == 0 &&
987 	    strcmp(sep->se_proto, cp->se_proto) == 0 &&
988 	    sep->se_family == cp->se_family &&
989 	    ISMUX(sep) == ISMUX(cp);
990 }
991 
992 int
parse_protocol(struct servtab * sep)993 parse_protocol(struct servtab *sep)
994 {
995 	int val;
996 
997 	if (strcmp(sep->se_proto, "unix") == 0) {
998 		sep->se_family = AF_LOCAL;
999 	} else {
1000 		val = (int)strlen(sep->se_proto);
1001 		if (val == 0) {
1002 			ERR("%s: invalid protocol specified",
1003 			    sep->se_service);
1004 			return -1;
1005 		}
1006 		val = sep->se_proto[val - 1];
1007 		switch (val) {
1008 		case '4':	/*tcp4 or udp4*/
1009 			sep->se_family = AF_INET;
1010 			break;
1011 #ifdef INET6
1012 		case '6':	/*tcp6 or udp6*/
1013 			sep->se_family = AF_INET6;
1014 			break;
1015 #endif
1016 		default:
1017 			/*
1018 			 * Use 'default' IP version which is IPv4, may
1019 			 * eventually be changed to AF_INET6
1020 			 */
1021 			sep->se_family = AF_INET;
1022 			break;
1023 		}
1024 		if (strncmp(sep->se_proto, "rpc/", 4) == 0) {
1025 #ifdef RPC
1026 			char *cp1, *ccp;
1027 			cp1 = strchr(sep->se_service, '/');
1028 			if (cp1 == 0) {
1029 				ERR("%s: no rpc version",
1030 				    sep->se_service);
1031 				return -1;
1032 			}
1033 			*cp1++ = '\0';
1034 			sep->se_rpcversl = sep->se_rpcversh =
1035 			    (int)strtol(cp1, &ccp, 0);
1036 			if (ccp == cp1) {
1037 		badafterall:
1038 				ERR("%s/%s: bad rpc version",
1039 				    sep->se_service, cp1);
1040 				return -1;
1041 			}
1042 			if (*ccp == '-') {
1043 				cp1 = ccp + 1;
1044 				sep->se_rpcversh = (int)strtol(cp1, &ccp, 0);
1045 				if (ccp == cp1)
1046 					goto badafterall;
1047 			}
1048 #else
1049 			ERR("%s: rpc services not supported",
1050 			    sep->se_service);
1051 			return -1;
1052 #endif /* RPC */
1053 		}
1054 	}
1055 	return 0;
1056 }
1057 
1058 int
parse_wait(struct servtab * sep,int wait)1059 parse_wait(struct servtab *sep, int wait)
1060 {
1061 	if (!ISMUX(sep)) {
1062 		sep->se_wait = wait;
1063 		return 0;
1064 	}
1065 	/*
1066 	 * Silently enforce "nowait" for TCPMUX services since
1067 	 * they don't have an assigned port to listen on.
1068 	 */
1069 	sep->se_wait = 0;
1070 
1071 	if (strncmp(sep->se_proto, "tcp", 3)) {
1072 		ERR("bad protocol for tcpmux service %s",
1073 			sep->se_service);
1074 		return -1;
1075 	}
1076 	if (sep->se_socktype != SOCK_STREAM) {
1077 		ERR("bad socket type for tcpmux service %s",
1078 		    sep->se_service);
1079 		return -1;
1080 	}
1081 	return 0;
1082 }
1083 
1084 int
parse_server(struct servtab * sep,const char * arg)1085 parse_server(struct servtab *sep, const char *arg)
1086 {
1087 	sep->se_server = newstr(arg);
1088 	if (strcmp(sep->se_server, "internal") != 0) {
1089 		sep->se_bi = NULL;
1090 		return 0;
1091 	}
1092 
1093 	if (!try_biltin(sep)) {
1094 		ERR("Internal service %s unknown", sep->se_service);
1095 		return -1;
1096 	}
1097 	return 0;
1098 }
1099 
1100 /* TODO test to make sure accept filter still works */
1101 void
parse_accept_filter(char * arg,struct servtab * sep)1102 parse_accept_filter(char *arg, struct servtab *sep)
1103 {
1104 	char *accf, *accf_arg;
1105 	/* one and only one accept filter */
1106 	accf = strchr(arg, ':');
1107 	if (accf == NULL)
1108 		return;
1109 	if (accf != strrchr(arg, ':') || *(accf + 1) == '\0') {
1110 		/* more than one ||  nothing beyond */
1111 		sep->se_socktype = -1;
1112 		return;
1113 	}
1114 
1115 	accf++;			/* skip delimiter */
1116 	strlcpy(sep->se_accf.af_name, accf, sizeof(sep->se_accf.af_name));
1117 	accf_arg = strchr(accf, ',');
1118 	if (accf_arg == NULL)	/* zero or one arg, no more */
1119 		return;
1120 
1121 	if (strrchr(accf, ',') != accf_arg) {
1122 		sep->se_socktype = -1;
1123 	} else {
1124 		accf_arg++;
1125 		strlcpy(sep->se_accf.af_arg, accf_arg,
1126 		    sizeof(sep->se_accf.af_arg));
1127 	}
1128 }
1129 
1130 void
parse_socktype(char * arg,struct servtab * sep)1131 parse_socktype(char* arg, struct servtab* sep)
1132 {
1133 	/* stream socket may have an accept filter, only check first chars */
1134 	if (strncmp(arg, "stream", sizeof("stream") - 1) == 0)
1135 		sep->se_socktype = SOCK_STREAM;
1136 	else if (strcmp(arg, "dgram") == 0)
1137 		sep->se_socktype = SOCK_DGRAM;
1138 	else if (strcmp(arg, "rdm") == 0)
1139 		sep->se_socktype = SOCK_RDM;
1140 	else if (strcmp(arg, "seqpacket") == 0)
1141 		sep->se_socktype = SOCK_SEQPACKET;
1142 	else if (strcmp(arg, "raw") == 0)
1143 		sep->se_socktype = SOCK_RAW;
1144 	else
1145 		sep->se_socktype = -1;
1146 }
1147 
1148 static struct servtab
init_servtab(void)1149 init_servtab(void)
1150 {
1151 	/* This does not set every field to default. See enter() as well */
1152 	return (struct servtab) {
1153 		/*
1154 		 * Set se_max to non-zero so uninitialized value is not
1155 	 	 * a valid value. Useful in v2 syntax parsing.
1156 		 */
1157 		.se_service_max = SERVTAB_UNSPEC_SIZE_T,
1158 		.se_ip_max = SERVTAB_UNSPEC_SIZE_T,
1159 		.se_wait = SERVTAB_UNSPEC_VAL,
1160 		.se_socktype = SERVTAB_UNSPEC_VAL,
1161 		.se_rl_ip_list = SLIST_HEAD_INITIALIZER(se_ip_list_head)
1162 		/* All other fields initialized to 0 or null */
1163 	};
1164 }
1165 
1166 /* Include directives bookkeeping structure */
1167 struct file_list {
1168 	/* Absolute path used for checking for circular references */
1169 	char *abs;
1170 	/* Pointer to the absolute path of the parent config file,
1171 	 * on the stack */
1172 	struct file_list *next;
1173 } *file_list_head;
1174 
1175 static void
include_configs(char * pattern)1176 include_configs(char *pattern)
1177 {
1178 	/* Allocate global per-config state on the thread stack */
1179 	const char* save_CONFIG;
1180 	FILE	*save_fconfig;
1181 	size_t	save_line_number;
1182 	char    *save_defhost;
1183 	struct	file_list new_file;
1184 #ifdef IPSEC
1185 	char *save_policy;
1186 #endif
1187 
1188 	/* Store current globals on the stack */
1189 	save_CONFIG = CONFIG;
1190 	save_fconfig = fconfig;
1191 	save_line_number = line_number;
1192 	save_defhost = defhost;
1193 	new_file.abs = realpath(CONFIG, NULL);
1194 	new_file.next = file_list_head;
1195 #ifdef IPSEC
1196 	save_policy = policy;
1197 #endif
1198 	/* Put new_file at the top of the config stack */
1199 	file_list_head = &new_file;
1200 	read_glob_configs(pattern);
1201 	free(new_file.abs);
1202 	/* Pop new_file off the stack */
1203 	file_list_head = new_file.next;
1204 
1205 	/* Restore global per-config state */
1206 	CONFIG = save_CONFIG;
1207 	fconfig = save_fconfig;
1208 	line_number = save_line_number;
1209 	defhost = save_defhost;
1210 #ifdef IPSEC
1211 	policy = save_policy;
1212 #endif
1213 }
1214 
1215 static void
prepare_next_config(const char * file_name)1216 prepare_next_config(const char *file_name)
1217 {
1218 	/* Setup new state that is normally only done in main */
1219 	CONFIG = file_name;
1220 
1221 	/* Inherit default host and IPsec policy */
1222 	defhost = newstr(defhost);
1223 
1224 #ifdef IPSEC
1225 	policy = (policy == NULL) ? NULL : newstr(policy);
1226 #endif
1227 }
1228 
1229 static void
read_glob_configs(char * pattern)1230 read_glob_configs(char *pattern)
1231 {
1232 	glob_t results;
1233 	char *full_pattern;
1234 	int glob_result;
1235 	full_pattern = gen_file_pattern(CONFIG, pattern);
1236 
1237 	DPRINTCONF("Found include directive '%s'", full_pattern);
1238 
1239 	glob_result = glob(full_pattern, GLOB_NOSORT, glob_error, &results);
1240 	switch(glob_result) {
1241 	case 0:
1242 		/* No glob errors */
1243 		break;
1244 	case GLOB_ABORTED:
1245 		ERR("Error while searching for include files");
1246 		break;
1247 	case GLOB_NOMATCH:
1248 		/* It's fine if no files were matched. */
1249 		DPRINTCONF("No files matched pattern '%s'", full_pattern);
1250 		break;
1251 	case GLOB_NOSPACE:
1252 		ERR("Error when searching for include files: %s",
1253 		    strerror(errno));
1254 		break;
1255 	default:
1256 		ERR("Unknown glob(3) error %d", errno);
1257 		break;
1258 	}
1259 	free(full_pattern);
1260 
1261 	for (size_t i = 0; i < results.gl_pathc; i++) {
1262 		include_matched_path(results.gl_pathv[i]);
1263 	}
1264 
1265 	globfree(&results);
1266 }
1267 
1268 static void
include_matched_path(char * glob_path)1269 include_matched_path(char *glob_path)
1270 {
1271 	struct stat sb;
1272 	char *tmp;
1273 
1274 	if (lstat(glob_path, &sb) != 0) {
1275 		ERR("Error calling stat on path '%s': %s", glob_path,
1276 		    strerror(errno));
1277 		return;
1278 	}
1279 
1280 	if (!S_ISREG(sb.st_mode) && !S_ISLNK(sb.st_mode)) {
1281 		DPRINTCONF("'%s' is not a file.", glob_path);
1282 		ERR("The matched path '%s' is not a regular file", glob_path);
1283 		return;
1284 	}
1285 
1286 	DPRINTCONF("Include '%s'", glob_path);
1287 
1288 	if (S_ISLNK(sb.st_mode)) {
1289 		tmp = glob_path;
1290 		glob_path = realpath(tmp, NULL);
1291 	}
1292 
1293 	/* Ensure the file is not being reincluded .*/
1294 	if (check_no_reinclude(glob_path)) {
1295 		prepare_next_config(glob_path);
1296 		config();
1297 	} else {
1298 		DPRINTCONF("File '%s' already included in current include "
1299 		    "chain", glob_path);
1300 		WRN("Including file '%s' would cause a circular "
1301 		    "dependency", glob_path);
1302 	}
1303 
1304 	if (S_ISLNK(sb.st_mode)) {
1305 		free(glob_path);
1306 		glob_path = tmp;
1307 	}
1308 }
1309 
1310 static bool
check_no_reinclude(const char * glob_path)1311 check_no_reinclude(const char *glob_path)
1312 {
1313 	struct file_list *cur = file_list_head;
1314 	char *abs_path = realpath(glob_path, NULL);
1315 
1316 	if (abs_path == NULL) {
1317 		ERR("Error checking real path for '%s': %s",
1318 			glob_path, strerror(errno));
1319 		return false;
1320 	}
1321 
1322 	DPRINTCONF("Absolute path '%s'", abs_path);
1323 
1324 	for (cur = file_list_head; cur != NULL; cur = cur->next) {
1325 		if (strcmp(cur->abs, abs_path) == 0) {
1326 			/* file included more than once */
1327 			/* TODO relative or abs path for logging error? */
1328 			free(abs_path);
1329 			return false;
1330 		}
1331 	}
1332 	free(abs_path);
1333 	return true;
1334 }
1335 
1336 /* Resolve the pattern relative to the config file the pattern is from  */
1337 static char *
gen_file_pattern(const char * cur_config,const char * pattern)1338 gen_file_pattern(const char *cur_config, const char *pattern)
1339 {
1340 	if (pattern[0] == '/') {
1341 		/* Absolute paths don't need any normalization */
1342 		return newstr(pattern);
1343 	}
1344 
1345 	/* pattern is relative */
1346 	/* Find the end of the file's directory */
1347 	size_t i, last = 0;
1348 	for (i = 0; cur_config[i] != '\0'; i++) {
1349 		if (cur_config[i] == '/') {
1350 			last = i;
1351 		}
1352 	}
1353 
1354 	if (last == 0) {
1355 		/* cur_config is just a filename, pattern already correct */
1356 		return newstr(pattern);
1357 	}
1358 
1359 	/* Relativize pattern to cur_config file's directory */
1360 	char *full_pattern = malloc(last + 1 + strlen(pattern) + 1);
1361 	if (full_pattern == NULL) {
1362 		syslog(LOG_ERR, "Out of memory.");
1363 		exit(EXIT_FAILURE);
1364 	}
1365 	memcpy(full_pattern, cur_config, last);
1366 	full_pattern[last] = '/';
1367 	strcpy(&full_pattern[last + 1], pattern);
1368 	return full_pattern;
1369 }
1370 
1371 static int
glob_error(const char * path,int error)1372 glob_error(const char *path, int error)
1373 {
1374 	WRN("Error while resolving path '%s': %s", path, strerror(error));
1375 	return 0;
1376 }
1377