1*0Sstevel@tonic-gate /*
2*0Sstevel@tonic-gate * Author: Tatu Ylonen <ylo@cs.hut.fi>
3*0Sstevel@tonic-gate * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
4*0Sstevel@tonic-gate * All rights reserved
5*0Sstevel@tonic-gate * Simple pattern matching, with '*' and '?' as wildcards.
6*0Sstevel@tonic-gate *
7*0Sstevel@tonic-gate * As far as I am concerned, the code I have written for this software
8*0Sstevel@tonic-gate * can be used freely for any purpose. Any derived versions of this
9*0Sstevel@tonic-gate * software must be clearly marked as such, and if the derived work is
10*0Sstevel@tonic-gate * incompatible with the protocol description in the RFC file, it must be
11*0Sstevel@tonic-gate * called by a name other than "ssh" or "Secure Shell".
12*0Sstevel@tonic-gate */
13*0Sstevel@tonic-gate /*
14*0Sstevel@tonic-gate * Copyright (c) 2000 Markus Friedl. All rights reserved.
15*0Sstevel@tonic-gate *
16*0Sstevel@tonic-gate * Redistribution and use in source and binary forms, with or without
17*0Sstevel@tonic-gate * modification, are permitted provided that the following conditions
18*0Sstevel@tonic-gate * are met:
19*0Sstevel@tonic-gate * 1. Redistributions of source code must retain the above copyright
20*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer.
21*0Sstevel@tonic-gate * 2. Redistributions in binary form must reproduce the above copyright
22*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer in the
23*0Sstevel@tonic-gate * documentation and/or other materials provided with the distribution.
24*0Sstevel@tonic-gate *
25*0Sstevel@tonic-gate * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
26*0Sstevel@tonic-gate * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
27*0Sstevel@tonic-gate * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
28*0Sstevel@tonic-gate * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
29*0Sstevel@tonic-gate * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
30*0Sstevel@tonic-gate * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
31*0Sstevel@tonic-gate * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
32*0Sstevel@tonic-gate * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
33*0Sstevel@tonic-gate * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
34*0Sstevel@tonic-gate * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
35*0Sstevel@tonic-gate */
36*0Sstevel@tonic-gate
37*0Sstevel@tonic-gate #include "includes.h"
38*0Sstevel@tonic-gate RCSID("$OpenBSD: match.c,v 1.19 2002/03/01 13:12:10 markus Exp $");
39*0Sstevel@tonic-gate
40*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI"
41*0Sstevel@tonic-gate
42*0Sstevel@tonic-gate #include "match.h"
43*0Sstevel@tonic-gate #include "xmalloc.h"
44*0Sstevel@tonic-gate
45*0Sstevel@tonic-gate /*
46*0Sstevel@tonic-gate * Returns true if the given string matches the pattern (which may contain ?
47*0Sstevel@tonic-gate * and * as wildcards), and zero if it does not match.
48*0Sstevel@tonic-gate */
49*0Sstevel@tonic-gate
50*0Sstevel@tonic-gate int
match_pattern(const char * s,const char * pattern)51*0Sstevel@tonic-gate match_pattern(const char *s, const char *pattern)
52*0Sstevel@tonic-gate {
53*0Sstevel@tonic-gate for (;;) {
54*0Sstevel@tonic-gate /* If at end of pattern, accept if also at end of string. */
55*0Sstevel@tonic-gate if (!*pattern)
56*0Sstevel@tonic-gate return !*s;
57*0Sstevel@tonic-gate
58*0Sstevel@tonic-gate if (*pattern == '*') {
59*0Sstevel@tonic-gate /* Skip the asterisk. */
60*0Sstevel@tonic-gate pattern++;
61*0Sstevel@tonic-gate
62*0Sstevel@tonic-gate /* If at end of pattern, accept immediately. */
63*0Sstevel@tonic-gate if (!*pattern)
64*0Sstevel@tonic-gate return 1;
65*0Sstevel@tonic-gate
66*0Sstevel@tonic-gate /* If next character in pattern is known, optimize. */
67*0Sstevel@tonic-gate if (*pattern != '?' && *pattern != '*') {
68*0Sstevel@tonic-gate /*
69*0Sstevel@tonic-gate * Look instances of the next character in
70*0Sstevel@tonic-gate * pattern, and try to match starting from
71*0Sstevel@tonic-gate * those.
72*0Sstevel@tonic-gate */
73*0Sstevel@tonic-gate for (; *s; s++)
74*0Sstevel@tonic-gate if (*s == *pattern &&
75*0Sstevel@tonic-gate match_pattern(s + 1, pattern + 1))
76*0Sstevel@tonic-gate return 1;
77*0Sstevel@tonic-gate /* Failed. */
78*0Sstevel@tonic-gate return 0;
79*0Sstevel@tonic-gate }
80*0Sstevel@tonic-gate /*
81*0Sstevel@tonic-gate * Move ahead one character at a time and try to
82*0Sstevel@tonic-gate * match at each position.
83*0Sstevel@tonic-gate */
84*0Sstevel@tonic-gate for (; *s; s++)
85*0Sstevel@tonic-gate if (match_pattern(s, pattern))
86*0Sstevel@tonic-gate return 1;
87*0Sstevel@tonic-gate /* Failed. */
88*0Sstevel@tonic-gate return 0;
89*0Sstevel@tonic-gate }
90*0Sstevel@tonic-gate /*
91*0Sstevel@tonic-gate * There must be at least one more character in the string.
92*0Sstevel@tonic-gate * If we are at the end, fail.
93*0Sstevel@tonic-gate */
94*0Sstevel@tonic-gate if (!*s)
95*0Sstevel@tonic-gate return 0;
96*0Sstevel@tonic-gate
97*0Sstevel@tonic-gate /* Check if the next character of the string is acceptable. */
98*0Sstevel@tonic-gate if (*pattern != '?' && *pattern != *s)
99*0Sstevel@tonic-gate return 0;
100*0Sstevel@tonic-gate
101*0Sstevel@tonic-gate /* Move to the next character, both in string and in pattern. */
102*0Sstevel@tonic-gate s++;
103*0Sstevel@tonic-gate pattern++;
104*0Sstevel@tonic-gate }
105*0Sstevel@tonic-gate /* NOTREACHED */
106*0Sstevel@tonic-gate }
107*0Sstevel@tonic-gate
108*0Sstevel@tonic-gate /*
109*0Sstevel@tonic-gate * Tries to match the string against the
110*0Sstevel@tonic-gate * comma-separated sequence of subpatterns (each possibly preceded by ! to
111*0Sstevel@tonic-gate * indicate negation). Returns -1 if negation matches, 1 if there is
112*0Sstevel@tonic-gate * a positive match, 0 if there is no match at all.
113*0Sstevel@tonic-gate */
114*0Sstevel@tonic-gate
115*0Sstevel@tonic-gate int
match_pattern_list(const char * string,const char * pattern,u_int len,int dolower)116*0Sstevel@tonic-gate match_pattern_list(const char *string, const char *pattern, u_int len,
117*0Sstevel@tonic-gate int dolower)
118*0Sstevel@tonic-gate {
119*0Sstevel@tonic-gate char sub[1024];
120*0Sstevel@tonic-gate int negated;
121*0Sstevel@tonic-gate int got_positive;
122*0Sstevel@tonic-gate u_int i, subi;
123*0Sstevel@tonic-gate
124*0Sstevel@tonic-gate got_positive = 0;
125*0Sstevel@tonic-gate for (i = 0; i < len;) {
126*0Sstevel@tonic-gate /* Check if the subpattern is negated. */
127*0Sstevel@tonic-gate if (pattern[i] == '!') {
128*0Sstevel@tonic-gate negated = 1;
129*0Sstevel@tonic-gate i++;
130*0Sstevel@tonic-gate } else
131*0Sstevel@tonic-gate negated = 0;
132*0Sstevel@tonic-gate
133*0Sstevel@tonic-gate /*
134*0Sstevel@tonic-gate * Extract the subpattern up to a comma or end. Convert the
135*0Sstevel@tonic-gate * subpattern to lowercase.
136*0Sstevel@tonic-gate */
137*0Sstevel@tonic-gate for (subi = 0;
138*0Sstevel@tonic-gate i < len && subi < sizeof(sub) - 1 && pattern[i] != ',';
139*0Sstevel@tonic-gate subi++, i++)
140*0Sstevel@tonic-gate sub[subi] = dolower && isupper(pattern[i]) ?
141*0Sstevel@tonic-gate tolower(pattern[i]) : pattern[i];
142*0Sstevel@tonic-gate /* If subpattern too long, return failure (no match). */
143*0Sstevel@tonic-gate if (subi >= sizeof(sub) - 1)
144*0Sstevel@tonic-gate return 0;
145*0Sstevel@tonic-gate
146*0Sstevel@tonic-gate /* If the subpattern was terminated by a comma, skip the comma. */
147*0Sstevel@tonic-gate if (i < len && pattern[i] == ',')
148*0Sstevel@tonic-gate i++;
149*0Sstevel@tonic-gate
150*0Sstevel@tonic-gate /* Null-terminate the subpattern. */
151*0Sstevel@tonic-gate sub[subi] = '\0';
152*0Sstevel@tonic-gate
153*0Sstevel@tonic-gate /* Try to match the subpattern against the string. */
154*0Sstevel@tonic-gate if (match_pattern(string, sub)) {
155*0Sstevel@tonic-gate if (negated)
156*0Sstevel@tonic-gate return -1; /* Negative */
157*0Sstevel@tonic-gate else
158*0Sstevel@tonic-gate got_positive = 1; /* Positive */
159*0Sstevel@tonic-gate }
160*0Sstevel@tonic-gate }
161*0Sstevel@tonic-gate
162*0Sstevel@tonic-gate /*
163*0Sstevel@tonic-gate * Return success if got a positive match. If there was a negative
164*0Sstevel@tonic-gate * match, we have already returned -1 and never get here.
165*0Sstevel@tonic-gate */
166*0Sstevel@tonic-gate return got_positive;
167*0Sstevel@tonic-gate }
168*0Sstevel@tonic-gate
169*0Sstevel@tonic-gate /*
170*0Sstevel@tonic-gate * Tries to match the host name (which must be in all lowercase) against the
171*0Sstevel@tonic-gate * comma-separated sequence of subpatterns (each possibly preceded by ! to
172*0Sstevel@tonic-gate * indicate negation). Returns -1 if negation matches, 1 if there is
173*0Sstevel@tonic-gate * a positive match, 0 if there is no match at all.
174*0Sstevel@tonic-gate */
175*0Sstevel@tonic-gate int
match_hostname(const char * host,const char * pattern,u_int len)176*0Sstevel@tonic-gate match_hostname(const char *host, const char *pattern, u_int len)
177*0Sstevel@tonic-gate {
178*0Sstevel@tonic-gate return match_pattern_list(host, pattern, len, 1);
179*0Sstevel@tonic-gate }
180*0Sstevel@tonic-gate
181*0Sstevel@tonic-gate /*
182*0Sstevel@tonic-gate * returns 0 if we get a negative match for the hostname or the ip
183*0Sstevel@tonic-gate * or if we get no match at all. returns 1 otherwise.
184*0Sstevel@tonic-gate */
185*0Sstevel@tonic-gate int
match_host_and_ip(const char * host,const char * ipaddr,const char * patterns)186*0Sstevel@tonic-gate match_host_and_ip(const char *host, const char *ipaddr,
187*0Sstevel@tonic-gate const char *patterns)
188*0Sstevel@tonic-gate {
189*0Sstevel@tonic-gate int mhost, mip;
190*0Sstevel@tonic-gate
191*0Sstevel@tonic-gate /* negative ipaddr match */
192*0Sstevel@tonic-gate if ((mip = match_hostname(ipaddr, patterns, strlen(patterns))) == -1)
193*0Sstevel@tonic-gate return 0;
194*0Sstevel@tonic-gate /* negative hostname match */
195*0Sstevel@tonic-gate if ((mhost = match_hostname(host, patterns, strlen(patterns))) == -1)
196*0Sstevel@tonic-gate return 0;
197*0Sstevel@tonic-gate /* no match at all */
198*0Sstevel@tonic-gate if (mhost == 0 && mip == 0)
199*0Sstevel@tonic-gate return 0;
200*0Sstevel@tonic-gate return 1;
201*0Sstevel@tonic-gate }
202*0Sstevel@tonic-gate
203*0Sstevel@tonic-gate /*
204*0Sstevel@tonic-gate * match user, user@host_or_ip, user@host_or_ip_list against pattern
205*0Sstevel@tonic-gate */
206*0Sstevel@tonic-gate int
match_user(const char * user,const char * host,const char * ipaddr,const char * pattern)207*0Sstevel@tonic-gate match_user(const char *user, const char *host, const char *ipaddr,
208*0Sstevel@tonic-gate const char *pattern)
209*0Sstevel@tonic-gate {
210*0Sstevel@tonic-gate char *p, *pat;
211*0Sstevel@tonic-gate int ret;
212*0Sstevel@tonic-gate
213*0Sstevel@tonic-gate if ((p = strchr(pattern,'@')) == NULL)
214*0Sstevel@tonic-gate return match_pattern(user, pattern);
215*0Sstevel@tonic-gate
216*0Sstevel@tonic-gate pat = xstrdup(pattern);
217*0Sstevel@tonic-gate p = strchr(pat, '@');
218*0Sstevel@tonic-gate *p++ = '\0';
219*0Sstevel@tonic-gate
220*0Sstevel@tonic-gate if ((ret = match_pattern(user, pat)) == 1)
221*0Sstevel@tonic-gate ret = match_host_and_ip(host, ipaddr, p);
222*0Sstevel@tonic-gate xfree(pat);
223*0Sstevel@tonic-gate
224*0Sstevel@tonic-gate return ret;
225*0Sstevel@tonic-gate }
226*0Sstevel@tonic-gate
227*0Sstevel@tonic-gate /*
228*0Sstevel@tonic-gate * Returns first item from client-list that is also supported by server-list,
229*0Sstevel@tonic-gate * caller must xfree() returned string.
230*0Sstevel@tonic-gate */
231*0Sstevel@tonic-gate #define MAX_PROP 40
232*0Sstevel@tonic-gate #define SEP ","
233*0Sstevel@tonic-gate char *
match_list(const char * client,const char * server,u_int * next)234*0Sstevel@tonic-gate match_list(const char *client, const char *server, u_int *next)
235*0Sstevel@tonic-gate {
236*0Sstevel@tonic-gate char *sproposals[MAX_PROP];
237*0Sstevel@tonic-gate char *c, *s, *p, *ret, *cp, *sp;
238*0Sstevel@tonic-gate int i, j, nproposals;
239*0Sstevel@tonic-gate
240*0Sstevel@tonic-gate c = cp = xstrdup(client);
241*0Sstevel@tonic-gate s = sp = xstrdup(server);
242*0Sstevel@tonic-gate
243*0Sstevel@tonic-gate for ((p = strsep(&sp, SEP)), i=0; p && *p != '\0';
244*0Sstevel@tonic-gate (p = strsep(&sp, SEP)), i++) {
245*0Sstevel@tonic-gate if (i < MAX_PROP)
246*0Sstevel@tonic-gate sproposals[i] = p;
247*0Sstevel@tonic-gate else
248*0Sstevel@tonic-gate break;
249*0Sstevel@tonic-gate }
250*0Sstevel@tonic-gate nproposals = i;
251*0Sstevel@tonic-gate
252*0Sstevel@tonic-gate for ((p = strsep(&cp, SEP)), i=0; p && *p != '\0';
253*0Sstevel@tonic-gate (p = strsep(&cp, SEP)), i++) {
254*0Sstevel@tonic-gate for (j = 0; j < nproposals; j++) {
255*0Sstevel@tonic-gate if (strcmp(p, sproposals[j]) == 0) {
256*0Sstevel@tonic-gate ret = xstrdup(p);
257*0Sstevel@tonic-gate if (next != NULL)
258*0Sstevel@tonic-gate *next = (cp == NULL) ?
259*0Sstevel@tonic-gate strlen(c) : cp - c;
260*0Sstevel@tonic-gate xfree(c);
261*0Sstevel@tonic-gate xfree(s);
262*0Sstevel@tonic-gate return ret;
263*0Sstevel@tonic-gate }
264*0Sstevel@tonic-gate }
265*0Sstevel@tonic-gate }
266*0Sstevel@tonic-gate if (next != NULL)
267*0Sstevel@tonic-gate *next = strlen(c);
268*0Sstevel@tonic-gate xfree(c);
269*0Sstevel@tonic-gate xfree(s);
270*0Sstevel@tonic-gate return NULL;
271*0Sstevel@tonic-gate }
272