usr.sbin/jail/config.c

   1 /*-
   2  * Copyright (c) 2011 James Gritton
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  *
  14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  24  * SUCH DAMAGE.
  25  */
  26
  27 #include <sys/cdefs.h>
  28 __FBSDID("$FreeBSD$");
  29
  30 #include <sys/types.h>
  31 #include <sys/errno.h>
  32 #include <sys/socket.h>
  33 #include <sys/sysctl.h>
  34
  35 #include <arpa/inet.h>
  36 #include <netinet/in.h>
  37
  38 #include <err.h>
  39 #include <netdb.h>
  40 #include <stdio.h>
  41 #include <stdlib.h>
  42 #include <string.h>
  43 #include <unistd.h>
  44
  45 #include "jailp.h"
  46
  47 struct ipspec {
  48         const char      *name;
  49         unsigned        flags;
  50 };
  51
  52 extern FILE *yyin;
  53 extern int yynerrs;
  54
  55 extern int yyparse(void);
  56
  57 struct cfjails cfjails = TAILQ_HEAD_INITIALIZER(cfjails);
  58
  59 static void free_param(struct cfparams *pp, struct cfparam *p);
  60 static void free_param_strings(struct cfparam *p);
  61
  62 static const struct ipspec intparams[] = {
  63     [IP_ALLOW_DYING] =          {"allow.dying",         PF_INTERNAL | PF_BOOL},
  64     [IP_COMMAND] =              {"command",             PF_INTERNAL},
  65     [IP_DEPEND] =               {"depend",              PF_INTERNAL},
  66     [IP_EXEC_CLEAN] =           {"exec.clean",          PF_INTERNAL | PF_BOOL},
  67     [IP_EXEC_CONSOLELOG] =      {"exec.consolelog",     PF_INTERNAL},
  68     [IP_EXEC_FIB] =             {"exec.fib",            PF_INTERNAL | PF_INT},
  69     [IP_EXEC_JAIL_USER] =       {"exec.jail_user",      PF_INTERNAL},
  70     [IP_EXEC_POSTSTART] =       {"exec.poststart",      PF_INTERNAL},
  71     [IP_EXEC_POSTSTOP] =        {"exec.poststop",       PF_INTERNAL},
  72     [IP_EXEC_PRESTART] =        {"exec.prestart",       PF_INTERNAL},
  73     [IP_EXEC_PRESTOP] =         {"exec.prestop",        PF_INTERNAL},
  74     [IP_EXEC_START] =           {"exec.start",          PF_INTERNAL},
  75     [IP_EXEC_STOP] =            {"exec.stop",           PF_INTERNAL},
  76     [IP_EXEC_SYSTEM_JAIL_USER]= {"exec.system_jail_user",
  77                                                         PF_INTERNAL | PF_BOOL},
  78     [IP_EXEC_SYSTEM_USER] =     {"exec.system_user",    PF_INTERNAL},
  79     [IP_EXEC_TIMEOUT] =         {"exec.timeout",        PF_INTERNAL | PF_INT},
  80 #if defined(INET) || defined(INET6)
  81     [IP_INTERFACE] =            {"interface",           PF_INTERNAL},
  82     [IP_IP_HOSTNAME] =          {"ip_hostname",         PF_INTERNAL | PF_BOOL},
  83 #endif
  84     [IP_MOUNT] =                {"mount",               PF_INTERNAL | PF_REV},
  85     [IP_MOUNT_DEVFS] =          {"mount.devfs",         PF_INTERNAL | PF_BOOL},
  86     [IP_MOUNT_FSTAB] =          {"mount.fstab",         PF_INTERNAL},
  87     [IP_STOP_TIMEOUT] =         {"stop.timeout",        PF_INTERNAL | PF_INT},
  88     [IP_VNET_INTERFACE] =       {"vnet.interface",      PF_INTERNAL},
  89 #ifdef INET
  90     [IP__IP4_IFADDR] =          {"ip4.addr",    PF_INTERNAL | PF_CONV | PF_REV},
  91 #endif
  92 #ifdef INET6
  93     [IP__IP6_IFADDR] =          {"ip6.addr",    PF_INTERNAL | PF_CONV | PF_REV},
  94 #endif
  95     [IP__MOUNT_FROM_FSTAB] =    {"mount.fstab", PF_INTERNAL | PF_CONV | PF_REV},
  96     [IP__OP] =                  {NULL,                  PF_CONV},
  97     [KP_ALLOW_CHFLAGS] =        {"allow.chflags",       0},
  98     [KP_ALLOW_MOUNT] =          {"allow.mount",         0},
  99     [KP_ALLOW_RAW_SOCKETS] =    {"allow.raw_sockets",   0},
 100     [KP_ALLOW_SET_HOSTNAME]=    {"allow.set_hostname",  0},
 101     [KP_ALLOW_SOCKET_AF] =      {"allow.socket_af",     0},
 102     [KP_ALLOW_SYSVIPC] =        {"allow.sysvipc",       0},
 103     [KP_DEVFS_RULESET] =        {"devfs_ruleset",       0},
 104     [KP_ENFORCE_STATFS] =       {"enforce_statfs",      0},
 105     [KP_HOST_HOSTNAME] =        {"host.hostname",       0},
 106 #ifdef INET
 107     [KP_IP4_ADDR] =             {"ip4.addr",            0},
 108 #endif
 109 #ifdef INET6
 110     [KP_IP6_ADDR] =             {"ip6.addr",            0},
 111 #endif
 112     [KP_JID] =                  {"jid",                 0},
 113     [KP_NAME] =                 {"name",                0},
 114     [KP_PATH] =                 {"path",                0},
 115     [KP_PERSIST] =              {"persist",             0},
 116     [KP_SECURELEVEL] =          {"securelevel",         0},
 117     [KP_VNET] =                 {"vnet",                0},
 118 };
 119
 120 /*
 121  * Parse the jail configuration file.
 122  */
 123 void
 124 load_config(void)
 125 {
 126         struct cfjails wild;
 127         struct cfparams opp;
 128         struct cfjail *j, *tj, *wj;
 129         struct cfparam *p, *vp, *tp;
 130         struct cfstring *s, *vs, *ns;
 131         struct cfvar *v;
 132         char *ep;
 133         size_t varoff;
 134         int did_self, jseq, pgen;
 135
 136         if (!strcmp(cfname, "-")) {
 137                 cfname = "STDIN";
 138                 yyin = stdin;
 139         } else {
 140                 yyin = fopen(cfname, "r");
 141                 if (!yyin)
 142                         err(1, "%s", cfname);
 143         }
 144         if (yyparse() || yynerrs)
 145                 exit(1);
 146
 147         /* Separate the wildcard jails out from the actual jails. */
 148         jseq = 0;
 149         TAILQ_INIT(&wild);
 150         TAILQ_FOREACH_SAFE(j, &cfjails, tq, tj) {
 151                 j->seq = ++jseq;
 152                 if (wild_jail_name(j->name))
 153                         requeue(j, &wild);
 154         }
 155
 156         TAILQ_FOREACH(j, &cfjails, tq) {
 157                 /* Set aside the jail's parameters. */
 158                 TAILQ_INIT(&opp);
 159                 TAILQ_CONCAT(&opp, &j->params, tq);
 160                 /*
 161                  * The jail name implies its "name" or "jid" parameter,
 162                  * though they may also be explicitly set later on.
 163                  */
 164                 add_param(j, NULL,
 165                     strtol(j->name, &ep, 10) && !*ep ? KP_JID : KP_NAME,
 166                     j->name);
 167                 /*
 168                  * Collect parameters for the jail, global parameters/variables,
 169                  * and any matching wildcard jails.
 170                  */
 171                 did_self = 0;
 172                 TAILQ_FOREACH(wj, &wild, tq) {
 173                         if (j->seq < wj->seq && !did_self) {
 174                                 TAILQ_FOREACH(p, &opp, tq)
 175                                         add_param(j, p, 0, NULL);
 176                                 did_self = 1;
 177                         }
 178                         if (wild_jail_match(j->name, wj->name))
 179                                 TAILQ_FOREACH(p, &wj->params, tq)
 180                                         add_param(j, p, 0, NULL);
 181                 }
 182                 if (!did_self)
 183                         TAILQ_FOREACH(p, &opp, tq)
 184                                 add_param(j, p, 0, NULL);
 185
 186                 /* Resolve any variable substitutions. */
 187                 pgen = 0;
 188                 TAILQ_FOREACH(p, &j->params, tq) {
 189                     p->gen = ++pgen;
 190                 find_vars:
 191                     TAILQ_FOREACH(s, &p->val, tq) {
 192                         varoff = 0;
 193                         while ((v = STAILQ_FIRST(&s->vars))) {
 194                                 TAILQ_FOREACH(vp, &j->params, tq)
 195                                         if (!strcmp(vp->name, v->name))
 196                                                 break;
 197                                 if (!vp) {
 198                                         jail_warnx(j,
 199                                             "%s: variable \"%s\" not found",
 200                                             p->name, v->name);
 201                                 bad_var:
 202                                         j->flags |= JF_FAILED;
 203                                         TAILQ_FOREACH(vp, &j->params, tq)
 204                                                 if (vp->gen == pgen)
 205                                                         vp->flags |= PF_BAD;
 206                                         goto free_var;
 207                                 }
 208                                 if (vp->flags & PF_BAD)
 209                                         goto bad_var;
 210                                 if (vp->gen == pgen) {
 211                                         jail_warnx(j, "%s: variable loop",
 212                                             v->name);
 213                                         goto bad_var;
 214                                 }
 215                                 TAILQ_FOREACH(vs, &vp->val, tq)
 216                                         if (!STAILQ_EMPTY(&vs->vars)) {
 217                                                 vp->gen = pgen;
 218                                                 TAILQ_REMOVE(&j->params, vp,
 219                                                     tq);
 220                                                 TAILQ_INSERT_BEFORE(p, vp, tq);
 221                                                 p = vp;
 222                                                 goto find_vars;
 223                                         }
 224                                 vs = TAILQ_FIRST(&vp->val);
 225                                 if (TAILQ_NEXT(vs, tq) != NULL &&
 226                                     (s->s[0] != '\0' ||
 227                                      STAILQ_NEXT(v, tq))) {
 228                                         jail_warnx(j, "%s: array cannot be "
 229                                             "substituted inline",
 230                                             p->name);
 231                                         goto bad_var;
 232                                 }
 233                                 s->s = erealloc(s->s, s->len + vs->len + 1);
 234                                 memmove(s->s + v->pos + varoff + vs->len,
 235                                     s->s + v->pos + varoff,
 236                                     s->len - (v->pos + varoff) + 1);
 237                                 memcpy(s->s + v->pos + varoff, vs->s, vs->len);
 238                                 varoff += vs->len;
 239                                 s->len += vs->len;
 240                                 while ((vs = TAILQ_NEXT(vs, tq))) {
 241                                         ns = emalloc(sizeof(struct cfstring));
 242                                         ns->s = estrdup(vs->s);
 243                                         ns->len = vs->len;
 244                                         STAILQ_INIT(&ns->vars);
 245                                         TAILQ_INSERT_AFTER(&p->val, s, ns, tq);
 246                                         s = ns;
 247                                 }
 248                         free_var:
 249                                 free(v->name);
 250                                 STAILQ_REMOVE_HEAD(&s->vars, tq);
 251                                 free(v);
 252                         }
 253                     }
 254                 }
 255
 256                 /* Free the jail's original parameter list and any variables. */
 257                 while ((p = TAILQ_FIRST(&opp)))
 258                         free_param(&opp, p);
 259                 TAILQ_FOREACH_SAFE(p, &j->params, tq, tp)
 260                         if (p->flags & PF_VAR)
 261                                 free_param(&j->params, p);
 262         }
 263         while ((wj = TAILQ_FIRST(&wild))) {
 264                 free(wj->name);
 265                 while ((p = TAILQ_FIRST(&wj->params)))
 266                         free_param(&wj->params, p);
 267                 TAILQ_REMOVE(&wild, wj, tq);
 268         }
 269 }
 270
 271 /*
 272  * Create a new jail record.
 273  */
 274 struct cfjail *
 275 add_jail(void)
 276 {
 277         struct cfjail *j;
 278
 279         j = emalloc(sizeof(struct cfjail));
 280         memset(j, 0, sizeof(struct cfjail));
 281         TAILQ_INIT(&j->params);
 282         STAILQ_INIT(&j->dep[DEP_FROM]);
 283         STAILQ_INIT(&j->dep[DEP_TO]);
 284         j->queue = &cfjails;
 285         TAILQ_INSERT_TAIL(&cfjails, j, tq);
 286         return j;
 287 }
 288
 289 /*
 290  * Add a parameter to a jail.
 291  */
 292 void
 293 add_param(struct cfjail *j, const struct cfparam *p, enum intparam ipnum,
 294     const char *value)
 295 {
 296         struct cfstrings nss;
 297         struct cfparam *dp, *np;
 298         struct cfstring *s, *ns;
 299         struct cfvar *v, *nv;
 300         const char *name;
 301         char *cs, *tname;
 302         unsigned flags;
 303
 304         if (j == NULL) {
 305                 /* Create a single anonymous jail if one doesn't yet exist. */
 306                 j = TAILQ_LAST(&cfjails, cfjails);
 307                 if (j == NULL)
 308                         j = add_jail();
 309         }
 310         TAILQ_INIT(&nss);
 311         if (p != NULL) {
 312                 name = p->name;
 313                 flags = p->flags;
 314                 /*
 315                  * Make a copy of the parameter's string list,
 316                  * which may be freed if it's overridden later.
 317                  */
 318                 TAILQ_FOREACH(s, &p->val, tq) {
 319                         ns = emalloc(sizeof(struct cfstring));
 320                         ns->s = estrdup(s->s);
 321                         ns->len = s->len;
 322                         STAILQ_INIT(&ns->vars);
 323                         STAILQ_FOREACH(v, &s->vars, tq) {
 324                                 nv = emalloc(sizeof(struct cfvar));
 325                                 nv->name = strdup(v->name);
 326                                 nv->pos = v->pos;
 327                                 STAILQ_INSERT_TAIL(&ns->vars, nv, tq);
 328                         }
 329                         TAILQ_INSERT_TAIL(&nss, ns, tq);
 330                 }
 331         } else {
 332                 flags = PF_APPEND;
 333                 if (ipnum != IP__NULL) {
 334                         name = intparams[ipnum].name;
 335                         flags |= intparams[ipnum].flags;
 336                 } else if ((cs = strchr(value, '='))) {
 337                         tname = alloca(cs - value + 1);
 338                         strlcpy(tname, value, cs - value + 1);
 339                         name = tname;
 340                         value = cs + 1;
 341                 } else {
 342                         name = value;
 343                         value = NULL;
 344                 }
 345                 if (value != NULL) {
 346                         ns = emalloc(sizeof(struct cfstring));
 347                         ns->s = estrdup(value);
 348                         ns->len = strlen(value);
 349                         STAILQ_INIT(&ns->vars);
 350                         TAILQ_INSERT_TAIL(&nss, ns, tq);
 351                 }
 352         }
 353
 354         /* See if this parameter has already been added. */
 355         if (ipnum != IP__NULL)
 356                 dp = j->intparams[ipnum];
 357         else
 358                 TAILQ_FOREACH(dp, &j->params, tq)
 359                         if (!(dp->flags & PF_CONV) && equalopts(dp->name, name))
 360                                 break;
 361         if (dp != NULL) {
 362                 /* Found it - append or replace. */
 363                 if (strcmp(dp->name, name)) {
 364                         free(dp->name);
 365                         dp->name = estrdup(name);
 366                 }
 367                 if (!(flags & PF_APPEND) || TAILQ_EMPTY(&nss))
 368                         free_param_strings(dp);
 369                 TAILQ_CONCAT(&dp->val, &nss, tq);
 370                 dp->flags |= flags;
 371         } else {
 372                 /* Not found - add it. */
 373                 np = emalloc(sizeof(struct cfparam));
 374                 np->name = estrdup(name);
 375                 TAILQ_INIT(&np->val);
 376                 TAILQ_CONCAT(&np->val, &nss, tq);
 377                 np->flags = flags;
 378                 np->gen = 0;
 379                 TAILQ_INSERT_TAIL(&j->params, np, tq);
 380                 if (ipnum != IP__NULL)
 381                         j->intparams[ipnum] = np;
 382                 else
 383                         for (ipnum = IP__NULL + 1; ipnum < IP_NPARAM; ipnum++)
 384                                 if (!(intparams[ipnum].flags & PF_CONV) &&
 385                                     equalopts(name, intparams[ipnum].name)) {
 386                                         j->intparams[ipnum] = np;
 387                                         np->flags |= intparams[ipnum].flags;
 388                                         break;
 389                                 }
 390         }
 391 }
 392
 393 /*
 394  * Return if a boolean parameter exists and is true.
 395  */
 396 int
 397 bool_param(const struct cfparam *p)
 398 {
 399         const char *cs;
 400
 401         if (p == NULL)
 402                 return 0;
 403         cs = strrchr(p->name, '.');
 404         return !strncmp(cs ? cs + 1 : p->name, "no", 2) ^
 405             (TAILQ_EMPTY(&p->val) ||
 406              !strcasecmp(TAILQ_LAST(&p->val, cfstrings)->s, "true") ||
 407              (strtol(TAILQ_LAST(&p->val, cfstrings)->s, NULL, 10)));
 408 }
 409
 410 /*
 411  * Set an integer if a parameter if it exists.
 412  */
 413 int
 414 int_param(const struct cfparam *p, int *ip)
 415 {
 416         if (p == NULL || TAILQ_EMPTY(&p->val))
 417                 return 0;
 418         *ip = strtol(TAILQ_LAST(&p->val, cfstrings)->s, NULL, 10);
 419         return 1;
 420 }
 421
 422 /*
 423  * Return the string value of a scalar parameter if it exists.
 424  */
 425 const char *
 426 string_param(const struct cfparam *p)
 427 {
 428         return (p && !TAILQ_EMPTY(&p->val)
 429             ? TAILQ_LAST(&p->val, cfstrings)->s : NULL);
 430 }
 431
 432 /*
 433  * Check syntax and values of internal parameters.  Set some internal
 434  * parameters based on the values of others.
 435  */
 436 int
 437 check_intparams(struct cfjail *j)
 438 {
 439         struct cfparam *p;
 440         struct cfstring *s;
 441         FILE *f;
 442         const char *val;
 443         char *cs, *ep, *ln;
 444         size_t lnlen;
 445         int error;
 446 #if defined(INET) || defined(INET6)
 447         struct addrinfo hints;
 448         struct addrinfo *ai0, *ai;
 449         const char *hostname;
 450         int gicode, defif, prefix;
 451 #endif
 452 #ifdef INET
 453         struct in_addr addr4;
 454         int ip4ok;
 455         char avalue4[INET_ADDRSTRLEN];
 456 #endif
 457 #ifdef INET6
 458         struct in6_addr addr6;
 459         int ip6ok;
 460         char avalue6[INET6_ADDRSTRLEN];
 461 #endif
 462
 463         error = 0;
 464         /* Check format of boolan and integer values. */
 465         TAILQ_FOREACH(p, &j->params, tq) {
 466                 if (!TAILQ_EMPTY(&p->val) && (p->flags & (PF_BOOL | PF_INT))) {
 467                         val = TAILQ_LAST(&p->val, cfstrings)->s;
 468                         if (p->flags & PF_BOOL) {
 469                                 if (strcasecmp(val, "false") &&
 470                                     strcasecmp(val, "true") &&
 471                                     ((void)strtol(val, &ep, 10), *ep)) {
 472                                         jail_warnx(j,
 473                                             "%s: unknown boolean value \"%s\"",
 474                                             p->name, val);
 475                                         error = -1;
 476                                 }
 477                         } else {
 478                                 (void)strtol(val, &ep, 10);
 479                                 if (ep == val || *ep) {
 480                                         jail_warnx(j,
 481                                             "%s: non-integer value \"%s\"",
 482                                             p->name, val);
 483                                         error = -1;
 484                                 }
 485                         }
 486                 }
 487         }
 488
 489 #if defined(INET) || defined(INET6)
 490         /*
 491          * The ip_hostname parameter looks up the hostname, and adds parameters
 492          * for any IP addresses it finds.
 493          */
 494         if (((j->flags & JF_OP_MASK) != JF_STOP ||
 495             j->intparams[IP_INTERFACE] != NULL) &&
 496             bool_param(j->intparams[IP_IP_HOSTNAME]) &&
 497             (hostname = string_param(j->intparams[KP_HOST_HOSTNAME]))) {
 498                 j->intparams[IP_IP_HOSTNAME] = NULL;
 499                 /*
 500                  * Silently ignore unsupported address families from
 501                  * DNS lookups.
 502                  */
 503 #ifdef INET
 504                 ip4ok = feature_present("inet");
 505 #endif
 506 #ifdef INET6
 507                 ip6ok = feature_present("inet6");
 508 #endif
 509                 if (
 510 #if defined(INET) && defined(INET6)
 511                     ip4ok || ip6ok
 512 #elif defined(INET)
 513                     ip4ok
 514 #elif defined(INET6)
 515                     ip6ok
 516 #endif
 517                          ) {
 518                         /* Look up the hostname (or get the address) */
 519                         memset(&hints, 0, sizeof(hints));
 520                         hints.ai_socktype = SOCK_STREAM;
 521                         hints.ai_family =
 522 #if defined(INET) && defined(INET6)
 523                             ip4ok ? (ip6ok ? PF_UNSPEC : PF_INET) :  PF_INET6;
 524 #elif defined(INET)
 525                             PF_INET;
 526 #elif defined(INET6)
 527                             PF_INET6;
 528 #endif
 529                         gicode = getaddrinfo(hostname, NULL, &hints, &ai0);
 530                         if (gicode != 0) {
 531                                 jail_warnx(j, "host.hostname %s: %s", hostname,
 532                                     gai_strerror(gicode));
 533                                 error = -1;
 534                         } else {
 535                                 /*
 536                                  * Convert the addresses to ASCII so jailparam
 537                                  * can convert them back.  Errors are not
 538                                  * expected here.
 539                                  */
 540                                 for (ai = ai0; ai; ai = ai->ai_next)
 541                                         switch (ai->ai_family) {
 542 #ifdef INET
 543                                         case AF_INET:
 544                                                 memcpy(&addr4,
 545                                                     &((struct sockaddr_in *)
 546                                                     (void *)ai->ai_addr)->
 547                                                     sin_addr, sizeof(addr4));
 548                                                 if (inet_ntop(AF_INET,
 549                                                     &addr4, avalue4,
 550                                                     INET_ADDRSTRLEN) == NULL)
 551                                                         err(1, "inet_ntop");
 552                                                 add_param(j, NULL, KP_IP4_ADDR,
 553                                                     avalue4);
 554                                                 break;
 555 #endif
 556 #ifdef INET6
 557                                         case AF_INET6:
 558                                                 memcpy(&addr6,
 559                                                     &((struct sockaddr_in6 *)
 560                                                     (void *)ai->ai_addr)->
 561                                                     sin6_addr, sizeof(addr6));
 562                                                 if (inet_ntop(AF_INET6,
 563                                                     &addr6, avalue6,
 564                                                     INET6_ADDRSTRLEN) == NULL)
 565                                                         err(1, "inet_ntop");
 566                                                 add_param(j, NULL, KP_IP6_ADDR,
 567                                                     avalue6);
 568                                                 break;
 569 #endif
 570                                         }
 571                                 freeaddrinfo(ai0);
 572                         }
 573                 }
 574         }
 575
 576         /*
 577          * IP addresses may include an interface to set that address on,
 578          * and a netmask/suffix for that address.
 579          */
 580         defif = string_param(j->intparams[IP_INTERFACE]) != NULL;
 581 #ifdef INET
 582         if (j->intparams[KP_IP4_ADDR] != NULL) {
 583                 TAILQ_FOREACH(s, &j->intparams[KP_IP4_ADDR]->val, tq) {
 584                         cs = strchr(s->s, '|');
 585                         if (cs || defif)
 586                                 add_param(j, NULL, IP__IP4_IFADDR, s->s);
 587                         if (cs) {
 588                                 strcpy(s->s, cs + 1);
 589                                 s->len -= cs + 1 - s->s;
 590                         }
 591                         if ((cs = strchr(s->s, '/'))) {
 592                                 prefix = strtol(cs + 1, &ep, 10);
 593                                 if (*ep == '.'
 594                                     ? inet_pton(AF_INET, cs + 1, &addr4) != 1
 595                                     : *ep || prefix < 0 || prefix > 32) {
 596                                         jail_warnx(j,
 597                                             "ip4.addr: bad netmask \"%s\"", cs);
 598                                         error = -1;
 599                                 }
 600                                 *cs = '\0';
 601                                 s->len = cs - s->s;
 602                         }
 603                 }
 604         }
 605 #endif
 606 #ifdef INET6
 607         if (j->intparams[KP_IP6_ADDR] != NULL) {
 608                 TAILQ_FOREACH(s, &j->intparams[KP_IP6_ADDR]->val, tq) {
 609                         cs = strchr(s->s, '|');
 610                         if (cs || defif)
 611                                 add_param(j, NULL, IP__IP6_IFADDR, s->s);
 612                         if (cs) {
 613                                 strcpy(s->s, cs + 1);
 614                                 s->len -= cs + 1 - s->s;
 615                         }
 616                         if ((cs = strchr(s->s, '/'))) {
 617                                 prefix = strtol(cs + 1, &ep, 10);
 618                                 if (*ep || prefix < 0 || prefix > 128) {
 619                                         jail_warnx(j,
 620                                             "ip6.addr: bad prefixlen \"%s\"",
 621                                             cs);
 622                                         error = -1;
 623                                 }
 624                                 *cs = '\0';
 625                                 s->len = cs - s->s;
 626                         }
 627                 }
 628         }
 629 #endif
 630 #endif
 631
 632         /*
 633          * Read mount.fstab file(s), and treat each line as its own mount
 634          * parameter.
 635          */
 636         if (j->intparams[IP_MOUNT_FSTAB] != NULL) {
 637                 TAILQ_FOREACH(s, &j->intparams[IP_MOUNT_FSTAB]->val, tq) {
 638                         if (s->len == 0)
 639                                 continue;
 640                         f = fopen(s->s, "r");
 641                         if (f == NULL) {
 642                                 jail_warnx(j, "mount.fstab: %s: %s",
 643                                     s->s, strerror(errno));
 644                                 error = -1;
 645                                 continue;
 646                         }
 647                         while ((ln = fgetln(f, &lnlen))) {
 648                                 if ((cs = memchr(ln, '#', lnlen - 1)))
 649                                         lnlen = cs - ln + 1;
 650                                 if (ln[lnlen - 1] == '\n' ||
 651                                     ln[lnlen - 1] == '#')
 652                                         ln[lnlen - 1] = '\0';
 653                                 else {
 654                                         cs = alloca(lnlen + 1);
 655                                         strlcpy(cs, ln, lnlen + 1);
 656                                         ln = cs;
 657                                 }
 658                                 add_param(j, NULL, IP__MOUNT_FROM_FSTAB, ln);
 659                         }
 660                         fclose(f);
 661                 }
 662         }
 663         if (error)
 664                 failed(j);
 665         return error;
 666 }
 667
 668 /*
 669  * Import parameters into libjail's binary jailparam format.
 670  */
 671 int
 672 import_params(struct cfjail *j)
 673 {
 674         struct cfparam *p;
 675         struct cfstring *s, *ts;
 676         struct jailparam *jp;
 677         char *value, *cs;
 678         size_t vallen;
 679         int error;
 680
 681         error = 0;
 682         j->njp = 0;
 683         TAILQ_FOREACH(p, &j->params, tq)
 684                 if (!(p->flags & PF_INTERNAL))
 685                         j->njp++;
 686         j->jp = jp = emalloc(j->njp * sizeof(struct jailparam));
 687         TAILQ_FOREACH(p, &j->params, tq) {
 688                 if (p->flags & PF_INTERNAL)
 689                         continue;
 690                 if (jailparam_init(jp, p->name) < 0) {
 691                         error = -1;
 692                         jail_warnx(j, "%s", jail_errmsg);
 693                         jp++;
 694                         continue;
 695                 }
 696                 if (TAILQ_EMPTY(&p->val))
 697                         value = NULL;
 698                 else if (!jp->jp_elemlen ||
 699                          !TAILQ_NEXT(TAILQ_FIRST(&p->val), tq)) {
 700                         /*
 701                          * Scalar parameters silently discard multiple (array)
 702                          * values, keeping only the last value added.  This
 703                          * lets values added from the command line append to
 704                          * arrays wthout pre-checking the type.
 705                          */
 706                         value = TAILQ_LAST(&p->val, cfstrings)->s;
 707                 } else {
 708                         /*
 709                          * Convert arrays into comma-separated strings, which
 710                          * jailparam_import will then convert back into arrays.
 711                          */
 712                         vallen = 0;
 713                         TAILQ_FOREACH(s, &p->val, tq)
 714                                 vallen += s->len + 1;
 715                         value = alloca(vallen);
 716                         cs = value;
 717                         TAILQ_FOREACH_SAFE(s, &p->val, tq, ts) {
 718                                 memcpy(cs, s->s, s->len);
 719                                 cs += s->len + 1;
 720                                 cs[-1] = ',';
 721                         }
 722                         value[vallen - 1] = '\0';
 723                 }
 724                 if (jailparam_import(jp, value) < 0) {
 725                         error = -1;
 726                         jail_warnx(j, "%s", jail_errmsg);
 727                 }
 728                 jp++;
 729         }
 730         if (error) {
 731                 jailparam_free(j->jp, j->njp);
 732                 free(j->jp);
 733                 j->jp = NULL;
 734                 failed(j);
 735         }
 736         return error;
 737 }
 738
 739 /*
 740  * Check if options are equal (with or without the "no" prefix).
 741  */
 742 int
 743 equalopts(const char *opt1, const char *opt2)
 744 {
 745         char *p;
 746
 747         /* "opt" vs. "opt" or "noopt" vs. "noopt" */
 748         if (strcmp(opt1, opt2) == 0)
 749                 return (1);
 750         /* "noopt" vs. "opt" */
 751         if (strncmp(opt1, "no", 2) == 0 && strcmp(opt1 + 2, opt2) == 0)
 752                 return (1);
 753         /* "opt" vs. "noopt" */
 754         if (strncmp(opt2, "no", 2) == 0 && strcmp(opt1, opt2 + 2) == 0)
 755                 return (1);
 756         while ((p = strchr(opt1, '.')) != NULL &&
 757             !strncmp(opt1, opt2, ++p - opt1)) {
 758                 opt2 += p - opt1;
 759                 opt1 = p;
 760                 /* "foo.noopt" vs. "foo.opt" */
 761                 if (strncmp(opt1, "no", 2) == 0 && strcmp(opt1 + 2, opt2) == 0)
 762                         return (1);
 763                 /* "foo.opt" vs. "foo.noopt" */
 764                 if (strncmp(opt2, "no", 2) == 0 && strcmp(opt1, opt2 + 2) == 0)
 765                         return (1);
 766         }
 767         return (0);
 768 }
 769
 770 /*
 771  * See if a jail name matches a wildcard.
 772  */
 773 int
 774 wild_jail_match(const char *jname, const char *wname)
 775 {
 776         const char *jc, *jd, *wc, *wd;
 777
 778         /*
 779          * A non-final "*" component in the wild name matches a single jail
 780          * component, and a final "*" matches one or more jail components.
 781          */
 782         for (jc = jname, wc = wname;
 783              (jd = strchr(jc, '.')) && (wd = strchr(wc, '.'));
 784              jc = jd + 1, wc = wd + 1)
 785                 if (strncmp(jc, wc, jd - jc + 1) && strncmp(wc, "*.", 2))
 786                         return 0;
 787         return (!strcmp(jc, wc) || !strcmp(wc, "*"));
 788 }
 789
 790 /*
 791  * Return if a jail name is a wildcard.
 792  */
 793 int
 794 wild_jail_name(const char *wname)
 795 {
 796         const char *wc;
 797
 798         for (wc = strchr(wname, '*'); wc; wc = strchr(wc + 1, '*'))
 799                 if ((wc == wname || wc[-1] == '.') &&
 800                     (wc[1] == '\0' || wc[1] == '.'))
 801                         return 1;
 802         return 0;
 803 }
 804
 805 /*
 806  * Free a parameter record and all its strings and variables.
 807  */
 808 static void
 809 free_param(struct cfparams *pp, struct cfparam *p)
 810 {
 811         free(p->name);
 812         free_param_strings(p);
 813         TAILQ_REMOVE(pp, p, tq);
 814         free(p);
 815 }
 816
 817 static void
 818 free_param_strings(struct cfparam *p)
 819 {
 820         struct cfstring *s;
 821         struct cfvar *v;
 822
 823         while ((s = TAILQ_FIRST(&p->val))) {
 824                 free(s->s);
 825                 while ((v = STAILQ_FIRST(&s->vars))) {
 826                         free(v->name);
 827                         STAILQ_REMOVE_HEAD(&s->vars, tq);
 828                         free(v);
 829                 }
 830                 TAILQ_REMOVE(&p->val, s, tq);
 831                 free(s);
 832         }
 833 }