Major overhaul. Now uses DSA signatures rather than the bogus symmetric

[become] / src / bcquery.c

/* -*-c-*-
 *
 * $Id: bcquery.c,v 1.4 2003/10/12 00:14:55 mdw Exp $
 *
 * Query and dump Become's configuration file
 *
 * (c) 1998 EBI
 */

/*----- Licensing notice --------------------------------------------------*
 *
 * This file is part of `become'
 *
 * `Become' is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * `Become' is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with `become'; if not, write to the Free Software Foundation,
 * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 */

/*----- Revision history --------------------------------------------------*
 *
 * $Log: bcquery.c,v $
 * Revision 1.4  2003/10/12 00:14:55  mdw
 * Major overhaul.  Now uses DSA signatures rather than the bogus symmetric
 * encrypt-and-hope thing.  Integrated with mLib and Catacomb.
 *
 * Revision 1.3  1999/05/04 16:17:11  mdw
 * Change to header file name for parser.  See log for `parse.h' for
 * details.
 *
 * Revision 1.2  1998/06/26  10:32:31  mdw
 * Cosmetic change: use sizeof(destination) in memcpy.
 *
 * Revision 1.1  1998/04/23 13:20:20  mdw
 * Added new program to verify and query Become configuration files.
 *
 */

/*----- Header files ------------------------------------------------------*/

/* --- ANSI headers --- */

#include <ctype.h>
#include <errno.h>
#include <limits.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>

/* --- Unix headers --- */

#include <sys/types.h>
#include <sys/stat.h>
#include <sys/socket.h>
#include <sys/utsname.h>

#include <netinet/in.h>

#include <arpa/inet.h>

#include <netdb.h>
#include <grp.h>
#include <pwd.h>
#include <syslog.h>
#include <unistd.h>

/* --- mLib headers --- */

#include <mLib/alloc.h>
#include <mLib/mdwopt.h>
#include <mLib/quis.h>
#include <mLib/report.h>
#include <mLib/sym.h>

/* --- Local headers --- */

#include "become.h"
#include "class.h"
#include "config.h"
#include "daemon.h"
#include "lexer.h"
#include "name.h"
#include "netg.h"
#include "parse.h"
#include "rule.h"
#include "userdb.h"

/*----- Type definitions --------------------------------------------------*/

enum {
  cat_where = 1u,
  cat_from = 2u,
  cat_to = 4u,
  cat_what = 8u,
  cat_and = 16u,
  cat_or = 17u,
  cat_not = 18u
};

typedef struct qnode {
  unsigned q_cat;
  union {
    uid_t uid;
    struct in_addr in;
    const char *cmd;
    struct {
      struct qnode *l, *r;
    } q;
  } q;
#define q_uid q.uid
#define q_in q.in
#define q_cmd q.cmd
#define q_left q.q.l
#define q_right q.q.r
#define q_arg q_left
} qnode;

/*----- Static variables --------------------------------------------------*/

enum {
  f_dump = 1u,
  f_userdb = 2u,
  f_header = 4u,
  f_match = 8u,
  f_single = 16u,
  f_simple = 32u,
  f_force = 64u,
  f_check = 128u,
  f_nohead = 256u
};

static int ac;
static char **av;
static int opt;
static unsigned flags;
static const char *cf = file_RULES;
static unsigned outmask = cat_where | cat_from | cat_to | cat_what;

/*----- Low-level options handling ----------------------------------------*/

/* --- @optname@ --- *
 *
 * Arguments:	---
 *
 * Returns:	Pointer to a string describing the current option.
 *
 * Use:		Creates a textual description of an option for use in
 *		error messages.
 */

static const char *optname(void)
{
  static char buf[2];
  switch (opt) {
    case 'H': return ("-host");
    case 'F': return ("-from");
    case 'T': return ("-to");
    case 'C': return ("-command");
    case 0: return (optarg);
    case '(': case ')': case '&': case '|': case '!':
      buf[0] = opt;
      buf[1] = 0;
      return (buf);
    case EOF: return ("<eof>");
    default: return ("<unknown>");
  }
}

/* --- @nextopt@ --- *
 *
 * Arguments:	---
 *
 * Returns:	Next option id, or @EOF@.
 *
 * Use:		Reads the next option.  Does a lot of the messy work of
 *		options parsing.
 */

static int nextopt(void)
{
  const static struct option opts[] = {
    { "help",		0,		0,	'h' },

    { "file",		gFlag_argReq,	0,	'f' },
    { "dump",		0,		0,	'd' },
    { "check",		0,		0,	'k' },

    { "output",		gFlag_argReq,	0,	'o' },
    { "columns",	0,		0,	'|' },
    { "rows",		0,		0,	'-' },
    { "nohead",		0,		0,	'n' },

    { "host",		gFlag_argReq,	0,	'H' },
    { "from",		gFlag_argReq,	0,	'F' },
    { "to",		gFlag_argReq,	0,	'T' },
    { "command",	gFlag_argReq,	0,	'C' },

    { "and",		0,		0,	'&' },
    { "or",		0,		0,	'|' },
    { "not",		0,		0,	'!' },

    { 0,		0,		0,	0 }
  };

again:
  opt = mdwopt(ac, av, "-", opts, 0, 0, gFlag_noShorts);

  switch (opt) {
    case 'h':
      printf(""
"Usage: %s [-help]\n"
"       %s [-output COLS] [-dump] [-file FILE] [EXPR | -check]\n"
"\n"
"Reads the `become' configuration file FILE (or " file_RULES " by\n"
"default) and writes the rules which match the EXPR.\n"
"\n"
"EXPR may make use of the following operators: `-host HOST', `-from USER',\n"
"`-to USER', and `-command CMD'.  You may join them together with `-and',\n"
"`-or' and `-not' operators (which may be spelled `&', `|' and `!' if you\n"
"prefer), and group subexpressions with parentheses `(' and `)'.\n",
	     quis(), quis());
      exit(0);
    case 'd':
      flags |= f_dump;
      goto again;
    case 'f':
      cf = optarg;
     goto again;
    case '|':
      flags |= f_simple;
      /* Drop through */
    case '-':
      flags |= f_force;
      goto again;
    case 'k':
      flags |= f_check;
      goto again;
    case 'n':
      flags |= f_nohead;
      goto again;
    case 'o': {
      char *p = optarg;
      enum { m_replace, m_add, m_remove } mode = m_replace;
      unsigned bit;

      while (*p) {
	switch (*p) {
	  case '+':
	    mode = m_add;
	    break;
	  case '-':
	    mode = m_remove;
	    break;
	  case 'h':
	    bit = cat_where;
	    goto setbits;
	  case 'f':
	    bit = cat_from;
	    goto setbits;
	  case 't':
	    bit = cat_to;
	    goto setbits;
	  case 'c':
	    bit = cat_what;
	    goto setbits;
	  default:
	    die(1, "unknown column specifier `%c'", *p);
	    break;
	  setbits:
	    if (mode == m_replace) {
	      outmask = 0;
	      mode = m_add;
	    }
	    if (mode == m_add)
	      outmask |= bit;
	    else if (mode == m_remove)
	      outmask &= ~bit;
	    else
	      die(1, "bad mode while setting output mask: %u", mode);
	    break;
	}
	p++;
      }
      goto again;
    }
    case '?':
      die(1, "type `%s --help' for usage information", quis());
    case 0:
      if (optarg[0] && optarg[1] == 0) switch (optarg[0]) {
	case '(': case ')':
	case '&': case '|': case '!':
	  opt = optarg[0];
	  break;
      }
      if (!opt)
	die(1, "unexpected text `%s' found", optarg);
      break;
  }

  return (opt);	    
}

/*----- Recursive descent query parser ------------------------------------*/

/* --- @qparse@ --- *
 *
 * Arguments:	---
 *
 * Returns:	A pointer to the finished tree.
 *
 * Use:		Scans the command line arguments and makes them into a tree.
 */

static qnode *qparse_expr(void);

static qnode *qparse_atom(void)
{
  switch (opt) {
    case '(': {
      qnode *q;
      nextopt();
      q = qparse_expr();
      if (opt != ')')
	die(1, "syntax error: expected `)', found `%s'", optname());
      nextopt();
      return (q);
    }
    case 'H': {
      struct hostent *h;
      qnode *q = xmalloc(sizeof(*q));
      h = gethostbyname(optarg);
      if (!h)
	die(1, "unknown host `%s'", optarg);
      q->q_cat = cat_where;
      memcpy(&q->q_in, h->h_addr, sizeof(q->q_in));
      nextopt();
      return (q);
    }
    case 'F': case 'T': {
      qnode *q = xmalloc(sizeof(*q));
      q->q_cat = (opt == 'F' ? cat_from : cat_to);
      if (isdigit((unsigned char)optarg[0]))
	q->q_uid = atoi(optarg);
      else {
	struct passwd *pw;
	if (!(flags & f_userdb)) {
	  userdb_init();
	  userdb_local();
	  userdb_yp();
	  flags |= f_userdb;
	}
	pw = userdb_userByName(optarg);
	if (!pw)
	  die(1, "unknown user `%s'", optarg);
	q->q_uid = pw->pw_uid;
      }
      nextopt();
      return (q);
    }
    case 'C': {
      qnode *q = xmalloc(sizeof(*q));
      q->q_cat = cat_what;
      q->q_cmd = optarg;
      nextopt();
      return (q);
    }
    default:
      die(1, "unexpected token: `%s'", optname());
  }
  return (0);
}

static qnode *qparse_factor(void)
{
  if (opt == '!') {
    qnode *q = xmalloc(sizeof(*q));
    nextopt();
    q->q_cat = cat_not;
    q->q_arg = qparse_atom();
    return (q);
  } else
    return (qparse_atom());
}

static qnode *qparse_term(void)
{
  qnode *top, *q, **qq;
  qq = &top;

again:
  q = qparse_factor();
  switch (opt) {
    case '&':
      nextopt();
    case 'H': case 'F': case 'T': case 'C': case '!': case '(':
      *qq = xmalloc(sizeof(*q));
      (*qq)->q_cat = cat_and;
      (*qq)->q_left = q;
      qq = &(*qq)->q_right;
      goto again;
    default:
      *qq = q;
      break;
  }
  return (top);
}

static qnode *qparse_expr(void)
{
  qnode *top, *q, **qq;
  qq = &top;

again:
  q = qparse_term();
  switch (opt) {
    case '|':
      nextopt();
      *qq = xmalloc(sizeof(*q));
      (*qq)->q_cat = cat_or;
      (*qq)->q_left = q;
      qq = &(*qq)->q_right;
      goto again;
    default:
      *qq = q;
      break;
  }
  return (top);
}

static qnode *qparse(void)
{
  qnode *q;
  nextopt();
  if (opt == EOF)
    return (0);
  q = qparse_expr();
  if (opt != EOF)
    die(1, "syntax error: `%s' unexpected", optname());
  return (q);
}

/* --- @dumptree@ --- *
 *
 * Arguments:	@qnode *q@ = pointer to tree to dump
 *		@int indent@ = indentation for this subtree
 *
 * Returns:	---
 *
 * Use:		Dumps a tree to stdout for debugging purposes.
 */

static void dumptree(qnode *q, int indent)
{
  if (!q)
    printf("<empty> -- magic query which matches everything\n");

again:
  printf("%*s", indent * 2, "");
  indent++;
  switch (q->q_cat) {
    case cat_where:
      printf("host = %s\n", inet_ntoa(q->q_in));
      break;
    case cat_from:
      printf("from = %u\n", (unsigned)q->q_uid);
      break;
    case cat_to:
      printf("to = %u\n", (unsigned)q->q_uid);
      break;
    case cat_what:
      printf("command = `%s'\n", q->q_cmd);
      break;
    case cat_not:
      printf("not\n");
      q = q->q_arg;
      goto again;
    case cat_and:
    case cat_or: {
      unsigned cat = q->q_cat;
      printf(cat == cat_and ? "and\n" : "or\n");
      while (q->q_cat == cat) {
	dumptree(q->q_left, indent);
	q = q->q_right;
      }
      goto again;
    }
    default:
      printf("unknown type %u\n", q->q_cat);
  }
}

/*----- Recursive query matching ------------------------------------------*/

/* --- @checkrule@ --- *
 *
 * Arguments:	@rule *r@ = pointer to a rule
 *		@qnode *q@ = pointer to a query tree
 *
 * Returns:	Nonzero if the query matches the rule.
 *
 * Use:		Matches rules and queries.
 */

static int checkrule(rule *r, qnode *q)
{
again:
  switch (q->q_cat) {

    /* --- Handle the compound query types --- */

    case cat_not:
      return (!checkrule(r, q->q_arg));

    case cat_and:
      if (!checkrule(r, q->q_left))
	return (0);
      q = q->q_right;
      goto again;

    case cat_or:
      if (checkrule(r, q->q_left))
	return (1);
      q = q->q_right;
      goto again;

    /* --- And now the simple query types --- */

    case cat_where:
      return (class_matchHost(r->host, q->q_in));
    case cat_from:
      return (class_matchUser(r->from, q->q_uid));
    case cat_to:
      return (class_matchUser(r->to, q->q_uid));
    case cat_what:
      return (class_matchCommand(r->cmd, q->q_cmd));
  }

  /* --- Anything else is bogus (and a bug) --- */

  die(1, "unexpected cat code %u in checkrule", q->q_cat);
  return (-1);
}

/*----- Rule output -------------------------------------------------------*/

/* --- @showrule@ --- *
 *
 * Arguments:	@rule *r@ = pointer to a rule block
 *
 * Returns:	---
 *
 * Use:		Writes a rule block to the output in a pleasant way.
 */

static const char *xltuser(uid_t u)
{
  static char buf[16];
  struct passwd *pw = userdb_userById(u);
  if (pw)
    return (pw->pw_name);
  sprintf(buf, "%u", (unsigned)u);
  return (buf);
}

static void classfirstrow(class_node *c, const char *fmt, sym_iter *i,
			  unsigned bit, unsigned *imask)
{
  switch (c->type & clNode_mask) {
    case clNode_any:
      printf(fmt, (c == class_all ? "ALL" :
		   c == class_none ? "NONE" :
		   "<bug>"));
      break;
    case clNode_immed:
      printf(fmt, (c->type & clType_user) ? xltuser(c->v.u) : c->v.s);
      break;
    case clNode_hash: {
      sym_base *b;
      sym_mkiter(i, &c->v.t);
      b = sym_next(i);
      if (!b) {
	printf(fmt, "");
	break;
      } else if (c->type & clType_user)
	printf(fmt, xltuser(*(uid_t *)b->name));
      else
	printf(fmt, b->name);
      *imask |= bit;
    } break;
    default:
      printf(fmt, "<complex>");
      break;
  }
}

static void showclass(class_node *c,
		      void (*sc)(class_node *c),
		      void (*sh)(sym_base *b))
{
  const char *op;
  unsigned type;

  switch (c->type & clNode_mask) {
    case clNode_any:
      fputs(c == class_all ? "ALL" :
	    c == class_none ? "NONE" : "<buggy>",
	    stdout);
      break;
    case clNode_immed:
      sc(c);
      break;
    case clNode_hash: {
      sym_iter i;
      sym_base *b;
      sym_mkiter(&i, &c->v.t);
      fputc('(', stdout);
      if ((b = sym_next(&i)) != 0) {
	sh(b);
	while ((b = sym_next(&i)) != 0) {
	  fputs(", ", stdout);
	  sh(b);
	}
      }
      fputc(')', stdout);
    } break;
    case clNode_union:
      op = " | ";
      goto binop;
    case clNode_diff:
      op = " - ";
      goto binop;
    case clNode_isect:
      op = " & ";
      goto binop;
    default:
      fputs("<unknown node type>", stdout);
      break;
    binop:
      type = c->type & clNode_mask;
      fputc('(', stdout);
      do {
	showclass(c->v.c.l, sc, sh);
	fputs(op, stdout);
	c = c->v.c.r;
      } while ((c->type & clNode_mask) == type);
      showclass(c, sc, sh);
      fputc(')', stdout);
      break;
  }
}

static void showuseri(class_node *c) { fputs(xltuser(c->v.u), stdout); }

static void showuserh(sym_base *b)
{
  fputs(xltuser(*(uid_t *)b->name), stdout);
}

static void showstringi(class_node *c) { fputs(c->v.s, stdout); }

static void showstringh(sym_base *b) { fputs(b->name, stdout); }

static void showrule(rule *r)
{
  /* --- First up: display of simple classes in columns --- */
  
  if (flags & f_simple) {
    sym_iter a, b, c, d;
    sym_base *w = 0, *x = 0, *y = 0, *z = 0;
    unsigned imask = 0;

    /* --- Print the header line if necessary --- */

    if (!(flags & f_header)) {
      if (!(flags & f_nohead)) {
	if (outmask & cat_from) printf("%-15s ", "FROM");
	if (outmask & cat_to) printf("%-15s ", "TO");
	if (outmask & cat_where) printf("%-24s ", "HOST");
	if (outmask & cat_what) printf("%s", "COMMAND");
	fputc('\n', stdout);
	fputc('\n', stdout);
      }
      flags |= f_header;
    } else 
      fputc('\n', stdout);

    /* --- Print out the first row --- */

    if (outmask & cat_from)
      classfirstrow(r->from, "%-15.15s ", &a, cat_from, &imask);
    if (outmask & cat_to)
      classfirstrow(r->to, "%-15.15s ", &b, cat_to, &imask);
    if (outmask & cat_where)
      classfirstrow(r->host, "%-24.24s ", &c, cat_where, &imask);
    if (outmask & cat_what)
      classfirstrow(r->cmd, "%s", &d, cat_what, &imask);
    fputc('\n', stdout);

    /* --- And now for the rest --- */

    for (;;) {
      if ((imask & cat_from) && (w = sym_next(&a)) == 0)
	imask &= ~cat_from;
      if ((imask & cat_to) && (x = sym_next(&b)) == 0)
	imask &= ~cat_to;
      if ((imask & cat_where) && (y = sym_next(&c)) == 0)
	imask &= ~cat_where;
      if ((imask & cat_what) && (z = sym_next(&d)) == 0)
	imask &= ~cat_what;

      if (!imask)
	break;

      if (outmask & cat_from) {
	printf("%-15.15s ",
	       !(imask & cat_from) ? "" : xltuser(*(uid_t *)w->name));
      }

      if (outmask & cat_to) {
	printf("%-15.15s ",
	       !(imask & cat_to) ? "" : xltuser(*(uid_t *)x->name));
      }

      if (outmask & cat_where)
	printf("%-24.24s ", !(imask & cat_where) ? "" : y->name);

      if (outmask & cat_what)
	printf("%s", !(imask & cat_what) ? "" : z->name);

      fputc('\n', stdout);
    }
  }

  /* --- Otherwise deal with complex cases --- */

  else {
    if (flags & f_header)
      fputc('\n', stdout);
    else
      flags |= f_header;
    if (outmask & cat_from) {
      fputs("    From: ", stdout);
      showclass(r->from, showuseri, showuserh);
      fputc('\n', stdout);
    }
    if (outmask & cat_to) {
      fputs("      To: ", stdout);
      showclass(r->to, showuseri, showuserh);
      fputc('\n', stdout);
    }
    if (outmask & cat_where) {
      fputs("   Hosts: ", stdout);
      showclass(r->host, showstringi, showstringh);
      fputc('\n', stdout);
    }
    if (outmask & cat_what) {
      fputs("Commands: ", stdout);
      showclass(r->cmd, showstringi, showstringh);
      fputc('\n', stdout);
    }
  }
}

/*----- Dummy functions ---------------------------------------------------*/

void daemon_usePort(int p) { ; }
void daemon_readKey(const char *f) { ; }

/*----- Main code ---------------------------------------------------------*/

/* --- @main@ --- *
 *
 * Arguments:	@int argc@ = number of command line arguments
 *		@char *argv[]@ = pointer to command line arguments
 *
 * Returns:	Zero if all went OK.
 *
 * Use:		Verifies and queries the `become' configuration file.
 */

int main(int argc, char *argv[])
{
  qnode *qtree;

  /* --- Initialise things --- */

  ego(argv[0]);
  ac = argc; av = argv;

  /* --- Read the query tree --- */

  qtree = qparse();

  /* --- Dump the tree if so requested --- */

  if (flags & f_dump) {
    dumptree(qtree, 0);
    return (0);
  }

  /* --- Check columns requested --- */

  if (outmask == (outmask & (outmask - 1)))
    flags |= f_single;

  /* --- Read the ruleset --- */

  if (!(flags & f_userdb)) {
    userdb_init();
    userdb_local();
    userdb_yp();
  }

  netg_init();
  name_init();
  rule_init();

  {
    FILE *fp = fopen(cf, "r");
    int ok;

    if (!fp)
      die(1, "couldn't open configuration file `%s': %s", cf, strerror(errno));
    lexer_scan(fp);
    ok = parse();
    if (flags & f_check)
      exit(ok);
  }

  /* --- Now scan the query --- */

  {
    rule *rl = rule_list(), *r;

    /* --- Decide on output format if not already chosen --- */

    if (!(flags & f_force)) {
      r = rl;
      flags |= f_simple;
      while (r) {
	if ((!qtree || checkrule(r, qtree)) &&
	    ((r->host->type & clNode_mask) >= clNode_binop ||
	     (r->from->type & clNode_mask) >= clNode_binop ||
	     (r->to->type & clNode_mask) >= clNode_binop ||
	     (r->cmd->type & clNode_mask) >= clNode_binop)) {
	  flags &= ~f_simple;
	  break;
	}
	r = r->next;
      }
    }

    /* --- Now just dump the matching items --- */

    r = rl;
    while (r) {
      if (!qtree || checkrule(r, qtree)) {
	flags |= f_match;
	showrule(r);
      }
      r = r->next;
    }
  }

  /* --- Done --- */

  if (!(flags & f_match))
    die(1, "no match");
  return (0);
}

/*----- That's all, folks -------------------------------------------------*/