1/*-
2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3 *
4 * Copyright (c) 2009 James Gritton.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 *    notice, this list of conditions and the following disclaimer in the
14 *    documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29#include <sys/cdefs.h>
30__FBSDID("$FreeBSD$");
31
32#include <sys/param.h>
33#include <sys/jail.h>
34#include <sys/linker.h>
35#include <sys/socket.h>
36#include <sys/sysctl.h>
37
38#include <arpa/inet.h>
39#include <netinet/in.h>
40
41#include <errno.h>
42#include <inttypes.h>
43#include <stdio.h>
44#include <stdarg.h>
45#include <stdlib.h>
46#include <string.h>
47
48#include "jail.h"
49
50#define	SJPARAM		"security.jail.param"
51
52#define JPS_IN_ADDR	1
53#define JPS_IN6_ADDR	2
54
55#define ARRAY_SANITY	5
56#define ARRAY_SLOP	5
57
58
59static int jailparam_import_enum(const char **values, int nvalues,
60    const char *valstr, size_t valsize, int *value);
61static int jailparam_type(struct jailparam *jp);
62static int kldload_param(const char *name);
63static char *noname(const char *name);
64static char *nononame(const char *name);
65
66char jail_errmsg[JAIL_ERRMSGLEN];
67
68static const char *bool_values[] = { "false", "true" };
69static const char *jailsys_values[] = { "disable", "new", "inherit" };
70
71
72/*
73 * Import a null-terminated parameter list and set a jail with the flags
74 * and parameters.
75 */
76int
77jail_setv(int flags, ...)
78{
79	va_list ap, tap;
80	struct jailparam *jp;
81	const char *name, *value;
82	int njp, jid;
83
84	/* Create the parameter list and import the parameters. */
85	va_start(ap, flags);
86	va_copy(tap, ap);
87	for (njp = 0; va_arg(tap, char *) != NULL; njp++)
88		(void)va_arg(tap, char *);
89	va_end(tap);
90	jp = alloca(njp * sizeof(struct jailparam));
91	for (njp = 0; (name = va_arg(ap, char *)) != NULL;) {
92		value = va_arg(ap, char *);
93		if (jailparam_init(jp + njp, name) < 0)
94			goto error;
95		if (jailparam_import(jp + njp++, value) < 0)
96			goto error;
97	}
98	va_end(ap);
99	jid = jailparam_set(jp, njp, flags);
100	jailparam_free(jp, njp);
101	return (jid);
102
103 error:
104	jailparam_free(jp, njp);
105	va_end(ap);
106	return (-1);
107}
108
109/*
110 * Read a null-terminated parameter list, get the referenced jail, and export
111 * the parameters to the list.
112 */
113int
114jail_getv(int flags, ...)
115{
116	va_list ap, tap;
117	struct jailparam *jp, *jp_lastjid, *jp_jid, *jp_name, *jp_key;
118	char *valarg, *value;
119	const char *name, *key_value, *lastjid_value, *jid_value, *name_value;
120	int njp, i, jid;
121
122	/* Create the parameter list and find the key. */
123	va_start(ap, flags);
124	va_copy(tap, ap);
125	for (njp = 0; va_arg(tap, char *) != NULL; njp++)
126		(void)va_arg(tap, char *);
127	va_end(tap);
128
129	jp = alloca(njp * sizeof(struct jailparam));
130	va_copy(tap, ap);
131	jp_lastjid = jp_jid = jp_name = NULL;
132	lastjid_value = jid_value = name_value = NULL;
133	for (njp = 0; (name = va_arg(tap, char *)) != NULL; njp++) {
134		value = va_arg(tap, char *);
135		if (jailparam_init(jp + njp, name) < 0) {
136			va_end(tap);
137			goto error;
138		}
139		if (!strcmp(jp[njp].jp_name, "lastjid")) {
140			jp_lastjid = jp + njp;
141			lastjid_value = value;
142		} else if (!strcmp(jp[njp].jp_name, "jid")) {
143			jp_jid = jp + njp;
144			jid_value = value;
145		} if (!strcmp(jp[njp].jp_name, "name")) {
146			jp_name = jp + njp;
147			name_value = value;
148		}
149	}
150	va_end(tap);
151	/* Import the key parameter. */
152	if (jp_lastjid != NULL) {
153		jp_key = jp_lastjid;
154		key_value = lastjid_value;
155	} else if (jp_jid != NULL && strtol(jid_value, NULL, 10) != 0) {
156		jp_key = jp_jid;
157		key_value = jid_value;
158	} else if (jp_name != NULL) {
159		jp_key = jp_name;
160		key_value = name_value;
161	} else {
162		strlcpy(jail_errmsg, "no jail specified", JAIL_ERRMSGLEN);
163		errno = ENOENT;
164		goto error;
165	}
166	if (jailparam_import(jp_key, key_value) < 0)
167		goto error;
168	/* Get the jail and export the parameters. */
169	jid = jailparam_get(jp, njp, flags);
170	if (jid < 0)
171		goto error;
172	for (i = 0; i < njp; i++) {
173		(void)va_arg(ap, char *);
174		valarg = va_arg(ap, char *);
175		if (jp + i != jp_key) {
176			/* It's up to the caller to ensure there's room. */
177			if ((jp[i].jp_ctltype & CTLTYPE) == CTLTYPE_STRING)
178				strcpy(valarg, jp[i].jp_value);
179			else {
180				value = jailparam_export(jp + i);
181				if (value == NULL)
182					goto error;
183				strcpy(valarg, value);
184				free(value);
185			}
186		}
187	}
188	jailparam_free(jp, njp);
189	va_end(ap);
190	return (jid);
191
192 error:
193	jailparam_free(jp, njp);
194	va_end(ap);
195	return (-1);
196}
197
198/*
199 * Return a list of all known parameters.
200 */
201int
202jailparam_all(struct jailparam **jpp)
203{
204	struct jailparam *jp, *tjp;
205	size_t mlen1, mlen2, buflen;
206	unsigned njp, nlist;
207	int mib1[CTL_MAXNAME], mib2[CTL_MAXNAME - 2];
208	char buf[MAXPATHLEN];
209
210	njp = 0;
211	nlist = 32;
212	jp = malloc(nlist * sizeof(*jp));
213	if (jp == NULL) {
214		strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
215		return (-1);
216	}
217	mib1[0] = 0;
218	mib1[1] = 2;
219	mlen1 = CTL_MAXNAME - 2;
220	if (sysctlnametomib(SJPARAM, mib1 + 2, &mlen1) < 0) {
221		snprintf(jail_errmsg, JAIL_ERRMSGLEN,
222		    "sysctlnametomib(" SJPARAM "): %s", strerror(errno));
223		goto error;
224	}
225	for (;; njp++) {
226		/* Get the next parameter. */
227		mlen2 = sizeof(mib2);
228		if (sysctl(mib1, mlen1 + 2, mib2, &mlen2, NULL, 0) < 0) {
229			if (errno == ENOENT) {
230				/* No more entries. */
231				break;
232			}
233			snprintf(jail_errmsg, JAIL_ERRMSGLEN,
234			    "sysctl(0.2): %s", strerror(errno));
235			goto error;
236		}
237		if (mib2[0] != mib1[2] ||
238		    mib2[1] != mib1[3] ||
239		    mib2[2] != mib1[4])
240			break;
241		/* Convert it to an ascii name. */
242		memcpy(mib1 + 2, mib2, mlen2);
243		mlen1 = mlen2 / sizeof(int);
244		mib1[1] = 1;
245		buflen = sizeof(buf);
246		if (sysctl(mib1, mlen1 + 2, buf, &buflen, NULL, 0) < 0) {
247			snprintf(jail_errmsg, JAIL_ERRMSGLEN,
248			    "sysctl(0.1): %s", strerror(errno));
249			goto error;
250		}
251		if (buf[buflen - 2] == '.')
252			buf[buflen - 2] = '\0';
253		/* Add the parameter to the list */
254		if (njp >= nlist) {
255			nlist *= 2;
256			tjp = reallocarray(jp, nlist, sizeof(*jp));
257			if (tjp == NULL)
258				goto error;
259			jp = tjp;
260		}
261		if (jailparam_init(jp + njp, buf + sizeof(SJPARAM)) < 0)
262			goto error;
263		mib1[1] = 2;
264	}
265	/* Just return the untrimmed buffer if reallocarray() somehow fails. */
266	tjp = reallocarray(jp, njp, sizeof(*jp));
267	if (tjp != NULL)
268		jp = tjp;
269	*jpp = jp;
270	return (njp);
271
272 error:
273	jailparam_free(jp, njp);
274	free(jp);
275	return (-1);
276}
277
278/*
279 * Clear a jail parameter and copy in its name.
280 */
281int
282jailparam_init(struct jailparam *jp, const char *name)
283{
284
285	memset(jp, 0, sizeof(*jp));
286	jp->jp_name = strdup(name);
287	if (jp->jp_name == NULL) {
288		strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
289		return (-1);
290	}
291	if (jailparam_type(jp) < 0) {
292		jailparam_free(jp, 1);
293		jp->jp_name = NULL;
294		jp->jp_value = NULL;
295		return (-1);
296	}
297	return (0);
298}
299
300/*
301 * Put a name and value into a jail parameter element, converting the value
302 * to internal form.
303 */
304int
305jailparam_import(struct jailparam *jp, const char *value)
306{
307	char *p, *ep, *tvalue;
308	const char *avalue;
309	int i, nval, fw;
310
311	if (value == NULL)
312		return (0);
313	if ((jp->jp_ctltype & CTLTYPE) == CTLTYPE_STRING) {
314		jp->jp_value = strdup(value);
315		if (jp->jp_value == NULL) {
316			strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
317			return (-1);
318		}
319		return (0);
320	}
321	nval = 1;
322	if (jp->jp_elemlen) {
323		if (value[0] == '\0' || (value[0] == '-' && value[1] == '\0')) {
324			jp->jp_value = strdup("");
325			if (jp->jp_value == NULL) {
326				strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
327				return (-1);
328			}
329			jp->jp_valuelen = 0;
330			return (0);
331		}
332		for (p = strchr(value, ','); p; p = strchr(p + 1, ','))
333			nval++;
334		jp->jp_valuelen = jp->jp_elemlen * nval;
335	}
336	jp->jp_value = malloc(jp->jp_valuelen);
337	if (jp->jp_value == NULL) {
338		strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
339		return (-1);
340	}
341	avalue = value;
342	for (i = 0; i < nval; i++) {
343		fw = nval == 1 ? strlen(avalue) : strcspn(avalue, ",");
344		switch (jp->jp_ctltype & CTLTYPE) {
345		case CTLTYPE_INT:
346			if (jp->jp_flags & (JP_BOOL | JP_NOBOOL)) {
347				if (!jailparam_import_enum(bool_values, 2,
348				    avalue, fw, &((int *)jp->jp_value)[i])) {
349					snprintf(jail_errmsg,
350					    JAIL_ERRMSGLEN, "%s: "
351					    "unknown boolean value \"%.*s\"",
352					    jp->jp_name, fw, avalue);
353					errno = EINVAL;
354					goto error;
355				}
356				break;
357			}
358			if (jp->jp_flags & JP_JAILSYS) {
359				/*
360				 * Allow setting a jailsys parameter to "new"
361				 * in a booleanesque fashion.
362				 */
363				if (value[0] == '\0')
364					((int *)jp->jp_value)[i] = JAIL_SYS_NEW;
365				else if (!jailparam_import_enum(jailsys_values,
366				    sizeof(jailsys_values) /
367				    sizeof(jailsys_values[0]), avalue, fw,
368				    &((int *)jp->jp_value)[i])) {
369					snprintf(jail_errmsg,
370					    JAIL_ERRMSGLEN, "%s: "
371					    "unknown jailsys value \"%.*s\"",
372					    jp->jp_name, fw, avalue);
373					errno = EINVAL;
374					goto error;
375				}
376				break;
377			}
378			((int *)jp->jp_value)[i] = strtol(avalue, &ep, 10);
379		integer_test:
380			if (ep != avalue + fw) {
381				snprintf(jail_errmsg, JAIL_ERRMSGLEN,
382				    "%s: non-integer value \"%.*s\"",
383				    jp->jp_name, fw, avalue);
384				errno = EINVAL;
385				goto error;
386			}
387			break;
388		case CTLTYPE_UINT:
389			((unsigned *)jp->jp_value)[i] =
390			    strtoul(avalue, &ep, 10);
391			goto integer_test;
392		case CTLTYPE_LONG:
393			((long *)jp->jp_value)[i] = strtol(avalue, &ep, 10);
394			goto integer_test;
395		case CTLTYPE_ULONG:
396			((unsigned long *)jp->jp_value)[i] =
397			    strtoul(avalue, &ep, 10);
398			goto integer_test;
399		case CTLTYPE_S64:
400			((int64_t *)jp->jp_value)[i] =
401			    strtoimax(avalue, &ep, 10);
402			goto integer_test;
403		case CTLTYPE_U64:
404			((uint64_t *)jp->jp_value)[i] =
405			    strtoumax(avalue, &ep, 10);
406			goto integer_test;
407		case CTLTYPE_STRUCT:
408			tvalue = alloca(fw + 1);
409			strlcpy(tvalue, avalue, fw + 1);
410			switch (jp->jp_structtype) {
411			case JPS_IN_ADDR:
412				if (inet_pton(AF_INET, tvalue,
413				    &((struct in_addr *)jp->jp_value)[i]) != 1)
414				{
415					snprintf(jail_errmsg,
416					    JAIL_ERRMSGLEN,
417					    "%s: not an IPv4 address: %s",
418					    jp->jp_name, tvalue);
419					errno = EINVAL;
420					goto error;
421				}
422				break;
423			case JPS_IN6_ADDR:
424				if (inet_pton(AF_INET6, tvalue,
425				    &((struct in6_addr *)jp->jp_value)[i]) != 1)
426				{
427					snprintf(jail_errmsg,
428					    JAIL_ERRMSGLEN,
429					    "%s: not an IPv6 address: %s",
430					    jp->jp_name, tvalue);
431					errno = EINVAL;
432					goto error;
433				}
434				break;
435			default:
436				goto unknown_type;
437			}
438			break;
439		default:
440		unknown_type:
441			snprintf(jail_errmsg, JAIL_ERRMSGLEN,
442			    "unknown type for %s", jp->jp_name);
443			errno = ENOENT;
444			goto error;
445		}
446		avalue += fw + 1;
447	}
448	return (0);
449
450 error:
451	free(jp->jp_value);
452	jp->jp_value = NULL;
453	return (-1);
454}
455
456static int
457jailparam_import_enum(const char **values, int nvalues, const char *valstr,
458    size_t valsize, int *value)
459{
460	char *ep;
461	int i;
462
463	for (i = 0; i < nvalues; i++)
464		if (valsize == strlen(values[i]) &&
465		    !strncasecmp(valstr, values[i], valsize)) {
466			*value = i;
467			return 1;
468		}
469	*value = strtol(valstr, &ep, 10);
470	return (ep == valstr + valsize);
471}
472
473/*
474 * Put a name and value into a jail parameter element, copying the value
475 * but not altering it.
476 */
477int
478jailparam_import_raw(struct jailparam *jp, void *value, size_t valuelen)
479{
480
481	jp->jp_value = value;
482	jp->jp_valuelen = valuelen;
483	jp->jp_flags |= JP_RAWVALUE;
484	return (0);
485}
486
487/*
488 * Run the jail_set and jail_get system calls on a parameter list.
489 */
490int
491jailparam_set(struct jailparam *jp, unsigned njp, int flags)
492{
493	struct iovec *jiov;
494	char *nname;
495	int i, jid, bool0;
496	unsigned j;
497
498	jiov = alloca(sizeof(struct iovec) * 2 * (njp + 1));
499	bool0 = 0;
500	for (i = j = 0; j < njp; j++) {
501		jiov[i].iov_base = jp[j].jp_name;
502		jiov[i].iov_len = strlen(jp[j].jp_name) + 1;
503		i++;
504		if (jp[j].jp_flags & (JP_BOOL | JP_NOBOOL)) {
505			/*
506			 * Set booleans without values.  If one has a value of
507			 * zero, change it to (or from) its "no" counterpart.
508			 */
509			jiov[i].iov_base = NULL;
510			jiov[i].iov_len = 0;
511			if (jp[j].jp_value != NULL &&
512			    jp[j].jp_valuelen == sizeof(int) &&
513			    !*(int *)jp[j].jp_value) {
514				bool0 = 1;
515				nname = jp[j].jp_flags & JP_BOOL
516				    ? noname(jp[j].jp_name)
517				    : nononame(jp[j].jp_name);
518				if (nname == NULL) {
519					njp = j;
520					jid = -1;
521					goto done;
522				}
523				jiov[i - 1].iov_base = nname;
524				jiov[i - 1].iov_len = strlen(nname) + 1;
525
526			}
527		} else {
528			/*
529			 * Try to fill in missing values with an empty string.
530			 */
531			if (jp[j].jp_value == NULL && jp[j].jp_valuelen > 0 &&
532			    jailparam_import(jp + j, "") < 0) {
533				njp = j;
534				jid = -1;
535				goto done;
536			}
537			jiov[i].iov_base = jp[j].jp_value;
538			jiov[i].iov_len =
539			    (jp[j].jp_ctltype & CTLTYPE) == CTLTYPE_STRING
540			    ? strlen(jp[j].jp_value) + 1
541			    : jp[j].jp_valuelen;
542		}
543		i++;
544	}
545	jiov[i].iov_base = __DECONST(char *, "errmsg");
546	jiov[i].iov_len = sizeof("errmsg");
547	i++;
548	jiov[i].iov_base = jail_errmsg;
549	jiov[i].iov_len = JAIL_ERRMSGLEN;
550	i++;
551	jail_errmsg[0] = 0;
552	jid = jail_set(jiov, i, flags);
553	if (jid < 0 && !jail_errmsg[0])
554		snprintf(jail_errmsg, sizeof(jail_errmsg), "jail_set: %s",
555		    strerror(errno));
556 done:
557	if (bool0)
558		for (j = 0; j < njp; j++)
559			if ((jp[j].jp_flags & (JP_BOOL | JP_NOBOOL)) &&
560			    jp[j].jp_value != NULL &&
561			    jp[j].jp_valuelen == sizeof(int) &&
562			    !*(int *)jp[j].jp_value)
563				free(jiov[j * 2].iov_base);
564	return (jid);
565}
566
567int
568jailparam_get(struct jailparam *jp, unsigned njp, int flags)
569{
570	struct iovec *jiov;
571	struct jailparam *jp_lastjid, *jp_jid, *jp_name, *jp_key;
572	int i, ai, ki, jid, arrays, sanity;
573	unsigned j;
574
575	/*
576	 * Get the types for all parameters.
577	 * Find the key and any array parameters.
578	 */
579	jiov = alloca(sizeof(struct iovec) * 2 * (njp + 1));
580	jp_lastjid = jp_jid = jp_name = NULL;
581	arrays = 0;
582	for (ai = j = 0; j < njp; j++) {
583		if (!strcmp(jp[j].jp_name, "lastjid"))
584			jp_lastjid = jp + j;
585		else if (!strcmp(jp[j].jp_name, "jid"))
586			jp_jid = jp + j;
587		else if (!strcmp(jp[j].jp_name, "name"))
588			jp_name = jp + j;
589		else if (jp[j].jp_elemlen && !(jp[j].jp_flags & JP_RAWVALUE)) {
590			arrays = 1;
591			jiov[ai].iov_base = jp[j].jp_name;
592			jiov[ai].iov_len = strlen(jp[j].jp_name) + 1;
593			ai++;
594			jiov[ai].iov_base = NULL;
595			jiov[ai].iov_len = 0;
596			ai++;
597		}
598	}
599	jp_key = jp_lastjid ? jp_lastjid :
600	    jp_jid && jp_jid->jp_valuelen == sizeof(int) &&
601	    jp_jid->jp_value && *(int *)jp_jid->jp_value ? jp_jid : jp_name;
602	if (jp_key == NULL || jp_key->jp_value == NULL) {
603		strlcpy(jail_errmsg, "no jail specified", JAIL_ERRMSGLEN);
604		errno = ENOENT;
605		return (-1);
606	}
607	ki = ai;
608	jiov[ki].iov_base = jp_key->jp_name;
609	jiov[ki].iov_len = strlen(jp_key->jp_name) + 1;
610	ki++;
611	jiov[ki].iov_base = jp_key->jp_value;
612	jiov[ki].iov_len = (jp_key->jp_ctltype & CTLTYPE) == CTLTYPE_STRING
613	    ? strlen(jp_key->jp_value) + 1 : jp_key->jp_valuelen;
614	ki++;
615	jiov[ki].iov_base = __DECONST(char *, "errmsg");
616	jiov[ki].iov_len = sizeof("errmsg");
617	ki++;
618	jiov[ki].iov_base = jail_errmsg;
619	jiov[ki].iov_len = JAIL_ERRMSGLEN;
620	ki++;
621	jail_errmsg[0] = 0;
622	if (arrays && jail_get(jiov, ki, flags) < 0) {
623		if (!jail_errmsg[0])
624			snprintf(jail_errmsg, sizeof(jail_errmsg),
625			    "jail_get: %s", strerror(errno));
626		return (-1);
627	}
628	/* Allocate storage for all parameters. */
629	for (ai = j = 0, i = ki; j < njp; j++) {
630		if (jp[j].jp_elemlen && !(jp[j].jp_flags & JP_RAWVALUE)) {
631			ai++;
632			jiov[ai].iov_len += jp[j].jp_elemlen * ARRAY_SLOP;
633			if (jp[j].jp_valuelen >= jiov[ai].iov_len)
634				jiov[ai].iov_len = jp[j].jp_valuelen;
635			else {
636				jp[j].jp_valuelen = jiov[ai].iov_len;
637				if (jp[j].jp_value != NULL)
638					free(jp[j].jp_value);
639				jp[j].jp_value = malloc(jp[j].jp_valuelen);
640				if (jp[j].jp_value == NULL) {
641					strerror_r(errno, jail_errmsg,
642					    JAIL_ERRMSGLEN);
643					return (-1);
644				}
645			}
646			jiov[ai].iov_base = jp[j].jp_value;
647			memset(jiov[ai].iov_base, 0, jiov[ai].iov_len);
648			ai++;
649		} else if (jp + j != jp_key) {
650			jiov[i].iov_base = jp[j].jp_name;
651			jiov[i].iov_len = strlen(jp[j].jp_name) + 1;
652			i++;
653			if (jp[j].jp_value == NULL &&
654			    !(jp[j].jp_flags & JP_RAWVALUE)) {
655				jp[j].jp_value = malloc(jp[j].jp_valuelen);
656				if (jp[j].jp_value == NULL) {
657					strerror_r(errno, jail_errmsg,
658					    JAIL_ERRMSGLEN);
659					return (-1);
660				}
661			}
662			jiov[i].iov_base = jp[j].jp_value;
663			jiov[i].iov_len = jp[j].jp_valuelen;
664			memset(jiov[i].iov_base, 0, jiov[i].iov_len);
665			i++;
666		}
667	}
668	/*
669	 * Get the prison.  If there are array elements, retry a few times
670	 * in case their sizes changed from under us.
671	 */
672	for (sanity = 0;; sanity++) {
673		jid = jail_get(jiov, i, flags);
674		if (jid >= 0 || !arrays || sanity == ARRAY_SANITY ||
675		    errno != EINVAL || jail_errmsg[0])
676			break;
677		for (ai = j = 0; j < njp; j++) {
678			if (jp[j].jp_elemlen &&
679			    !(jp[j].jp_flags & JP_RAWVALUE)) {
680				ai++;
681				jiov[ai].iov_base = NULL;
682				jiov[ai].iov_len = 0;
683				ai++;
684			}
685		}
686		if (jail_get(jiov, ki, flags) < 0)
687			break;
688		for (ai = j = 0; j < njp; j++) {
689			if (jp[j].jp_elemlen &&
690			    !(jp[j].jp_flags & JP_RAWVALUE)) {
691				ai++;
692				jiov[ai].iov_len +=
693				    jp[j].jp_elemlen * ARRAY_SLOP;
694				if (jp[j].jp_valuelen >= jiov[ai].iov_len)
695					jiov[ai].iov_len = jp[j].jp_valuelen;
696				else {
697					jp[j].jp_valuelen = jiov[ai].iov_len;
698					if (jp[j].jp_value != NULL)
699						free(jp[j].jp_value);
700					jp[j].jp_value =
701					    malloc(jiov[ai].iov_len);
702					if (jp[j].jp_value == NULL) {
703						strerror_r(errno, jail_errmsg,
704						    JAIL_ERRMSGLEN);
705						return (-1);
706					}
707				}
708				jiov[ai].iov_base = jp[j].jp_value;
709				memset(jiov[ai].iov_base, 0, jiov[ai].iov_len);
710				ai++;
711			}
712		}
713	}
714	if (jid < 0 && !jail_errmsg[0])
715		snprintf(jail_errmsg, sizeof(jail_errmsg),
716		    "jail_get: %s", strerror(errno));
717	for (ai = j = 0, i = ki; j < njp; j++) {
718		if (jp[j].jp_elemlen && !(jp[j].jp_flags & JP_RAWVALUE)) {
719			ai++;
720			jp[j].jp_valuelen = jiov[ai].iov_len;
721			ai++;
722		} else if (jp + j != jp_key) {
723			i++;
724			jp[j].jp_valuelen = jiov[i].iov_len;
725			i++;
726		}
727	}
728	return (jid);
729}
730
731/*
732 * Convert a jail parameter's value to external form.
733 */
734char *
735jailparam_export(struct jailparam *jp)
736{
737	size_t *valuelens;
738	char *value, *tvalue, **values;
739	size_t valuelen;
740	int i, nval, ival;
741	char valbuf[INET6_ADDRSTRLEN];
742
743	if ((jp->jp_ctltype & CTLTYPE) == CTLTYPE_STRING) {
744		value = strdup(jp->jp_value);
745		if (value == NULL)
746			strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
747		return (value);
748	}
749	nval = jp->jp_elemlen ? jp->jp_valuelen / jp->jp_elemlen : 1;
750	if (nval == 0) {
751		value = strdup("");
752		if (value == NULL)
753			strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
754		return (value);
755	}
756	values = alloca(nval * sizeof(char *));
757	valuelens = alloca(nval * sizeof(size_t));
758	valuelen = 0;
759	for (i = 0; i < nval; i++) {
760		switch (jp->jp_ctltype & CTLTYPE) {
761		case CTLTYPE_INT:
762			ival = ((int *)jp->jp_value)[i];
763			if ((jp->jp_flags & (JP_BOOL | JP_NOBOOL)) &&
764			    (unsigned)ival < 2) {
765				strlcpy(valbuf, bool_values[ival],
766				    sizeof(valbuf));
767				break;
768			}
769			if ((jp->jp_flags & JP_JAILSYS) &&
770			    (unsigned)ival < sizeof(jailsys_values) /
771			    sizeof(jailsys_values[0])) {
772				strlcpy(valbuf, jailsys_values[ival],
773				    sizeof(valbuf));
774				break;
775			}
776			snprintf(valbuf, sizeof(valbuf), "%d", ival);
777			break;
778		case CTLTYPE_UINT:
779			snprintf(valbuf, sizeof(valbuf), "%u",
780			    ((unsigned *)jp->jp_value)[i]);
781			break;
782		case CTLTYPE_LONG:
783			snprintf(valbuf, sizeof(valbuf), "%ld",
784			    ((long *)jp->jp_value)[i]);
785			break;
786		case CTLTYPE_ULONG:
787			snprintf(valbuf, sizeof(valbuf), "%lu",
788			    ((unsigned long *)jp->jp_value)[i]);
789			break;
790		case CTLTYPE_S64:
791			snprintf(valbuf, sizeof(valbuf), "%jd",
792			    (intmax_t)((int64_t *)jp->jp_value)[i]);
793			break;
794		case CTLTYPE_U64:
795			snprintf(valbuf, sizeof(valbuf), "%ju",
796			    (uintmax_t)((uint64_t *)jp->jp_value)[i]);
797			break;
798		case CTLTYPE_STRUCT:
799			switch (jp->jp_structtype) {
800			case JPS_IN_ADDR:
801				if (inet_ntop(AF_INET,
802				    &((struct in_addr *)jp->jp_value)[i],
803				    valbuf, sizeof(valbuf)) == NULL) {
804					strerror_r(errno, jail_errmsg,
805					    JAIL_ERRMSGLEN);
806					return (NULL);
807				}
808				break;
809			case JPS_IN6_ADDR:
810				if (inet_ntop(AF_INET6,
811				    &((struct in6_addr *)jp->jp_value)[i],
812				    valbuf, sizeof(valbuf)) == NULL) {
813					strerror_r(errno, jail_errmsg,
814					    JAIL_ERRMSGLEN);
815					return (NULL);
816				}
817				break;
818			default:
819				goto unknown_type;
820			}
821			break;
822		default:
823		unknown_type:
824			snprintf(jail_errmsg, JAIL_ERRMSGLEN,
825			    "unknown type for %s", jp->jp_name);
826			errno = ENOENT;
827			return (NULL);
828		}
829		valuelens[i] = strlen(valbuf) + 1;
830		valuelen += valuelens[i];
831		values[i] = alloca(valuelens[i]);
832		strcpy(values[i], valbuf);
833	}
834	value = malloc(valuelen);
835	if (value == NULL)
836		strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
837	else {
838		tvalue = value;
839		for (i = 0; i < nval; i++) {
840			strcpy(tvalue, values[i]);
841			if (i < nval - 1) {
842				tvalue += valuelens[i];
843				tvalue[-1] = ',';
844			}
845		}
846	}
847	return (value);
848}
849
850/*
851 * Free the contents of a jail parameter list (but not the list itself).
852 */
853void
854jailparam_free(struct jailparam *jp, unsigned njp)
855{
856	unsigned j;
857
858	for (j = 0; j < njp; j++) {
859		free(jp[j].jp_name);
860		if (!(jp[j].jp_flags & JP_RAWVALUE))
861			free(jp[j].jp_value);
862	}
863}
864
865/*
866 * Find a parameter's type and size from its MIB.
867 */
868static int
869jailparam_type(struct jailparam *jp)
870{
871	char *p, *name, *nname;
872	size_t miblen, desclen;
873	int i, isarray;
874	struct {
875	    int i;
876	    char s[MAXPATHLEN];
877	} desc;
878	int mib[CTL_MAXNAME];
879
880	/* The "lastjid" parameter isn't real. */
881	name = jp->jp_name;
882	if (!strcmp(name, "lastjid")) {
883		jp->jp_valuelen = sizeof(int);
884		jp->jp_ctltype = CTLTYPE_INT | CTLFLAG_WR;
885		return (0);
886	}
887
888	/* Find the sysctl that describes the parameter. */
889	mib[0] = 0;
890	mib[1] = 3;
891	snprintf(desc.s, sizeof(desc.s), SJPARAM ".%s", name);
892	miblen = sizeof(mib) - 2 * sizeof(int);
893	if (sysctl(mib, 2, mib + 2, &miblen, desc.s, strlen(desc.s)) < 0) {
894		if (errno != ENOENT) {
895			snprintf(jail_errmsg, JAIL_ERRMSGLEN,
896			    "sysctl(0.3.%s): %s", name, strerror(errno));
897			return (-1);
898		}
899		if (kldload_param(name) >= 0 && sysctl(mib, 2, mib + 2, &miblen,
900		    desc.s, strlen(desc.s)) >= 0)
901			goto mib_desc;
902		/*
903		 * The parameter probably doesn't exist.  But it might be
904		 * the "no" counterpart to a boolean.
905		 */
906		nname = nononame(name);
907		if (nname == NULL) {
908		unknown_parameter:
909			snprintf(jail_errmsg, JAIL_ERRMSGLEN,
910			    "unknown parameter: %s", jp->jp_name);
911			errno = ENOENT;
912			return (-1);
913		}
914		name = alloca(strlen(nname) + 1);
915		strcpy(name, nname);
916		free(nname);
917		snprintf(desc.s, sizeof(desc.s), SJPARAM ".%s", name);
918		miblen = sizeof(mib) - 2 * sizeof(int);
919		if (sysctl(mib, 2, mib + 2, &miblen, desc.s,
920		    strlen(desc.s)) < 0)
921			goto unknown_parameter;
922		jp->jp_flags |= JP_NOBOOL;
923	}
924 mib_desc:
925	mib[1] = 4;
926	desclen = sizeof(desc);
927	if (sysctl(mib, (miblen / sizeof(int)) + 2, &desc, &desclen,
928	    NULL, 0) < 0) {
929		snprintf(jail_errmsg, JAIL_ERRMSGLEN,
930		    "sysctl(0.4.%s): %s", name, strerror(errno));
931		return (-1);
932	}
933	jp->jp_ctltype = desc.i;
934	/* If this came from removing a "no", it better be a boolean. */
935	if (jp->jp_flags & JP_NOBOOL) {
936		if ((desc.i & CTLTYPE) == CTLTYPE_INT && desc.s[0] == 'B') {
937			jp->jp_valuelen = sizeof(int);
938			return (0);
939		}
940		else if ((desc.i & CTLTYPE) != CTLTYPE_NODE)
941			goto unknown_parameter;
942	}
943	/* See if this is an array type. */
944	p = strchr(desc.s, '\0');
945	isarray  = 0;
946	if (p - 2 < desc.s || strcmp(p - 2, ",a"))
947		isarray = 0;
948	else {
949		isarray = 1;
950		p[-2] = 0;
951	}
952	/* Look for types we understand. */
953	switch (desc.i & CTLTYPE) {
954	case CTLTYPE_INT:
955		if (desc.s[0] == 'B')
956			jp->jp_flags |= JP_BOOL;
957		else if (!strcmp(desc.s, "E,jailsys"))
958			jp->jp_flags |= JP_JAILSYS;
959	case CTLTYPE_UINT:
960		jp->jp_valuelen = sizeof(int);
961		break;
962	case CTLTYPE_LONG:
963	case CTLTYPE_ULONG:
964		jp->jp_valuelen = sizeof(long);
965		break;
966	case CTLTYPE_S64:
967	case CTLTYPE_U64:
968		jp->jp_valuelen = sizeof(int64_t);
969		break;
970	case CTLTYPE_STRING:
971		desc.s[0] = 0;
972		desclen = sizeof(desc.s);
973		if (sysctl(mib + 2, miblen / sizeof(int), desc.s, &desclen,
974		    NULL, 0) < 0) {
975			snprintf(jail_errmsg, JAIL_ERRMSGLEN,
976			    "sysctl(" SJPARAM ".%s): %s", name,
977			    strerror(errno));
978			return (-1);
979		}
980		jp->jp_valuelen = strtoul(desc.s, NULL, 10);
981		break;
982	case CTLTYPE_STRUCT:
983		if (!strcmp(desc.s, "S,in_addr")) {
984			jp->jp_structtype = JPS_IN_ADDR;
985			jp->jp_valuelen = sizeof(struct in_addr);
986		} else if (!strcmp(desc.s, "S,in6_addr")) {
987			jp->jp_structtype = JPS_IN6_ADDR;
988			jp->jp_valuelen = sizeof(struct in6_addr);
989		} else {
990			desclen = 0;
991			if (sysctl(mib + 2, miblen / sizeof(int),
992			    NULL, &jp->jp_valuelen, NULL, 0) < 0) {
993				snprintf(jail_errmsg, JAIL_ERRMSGLEN,
994				    "sysctl(" SJPARAM ".%s): %s", name,
995				    strerror(errno));
996				return (-1);
997			}
998		}
999		break;
1000	case CTLTYPE_NODE:
1001		/*
1002		 * A node might be described by an empty-named child,
1003		 * which would be immediately before or after the node itself.
1004		 */
1005		mib[1] = 1;
1006		miblen += sizeof(int);
1007		for (i = -1; i <= 1; i += 2) {
1008			mib[(miblen / sizeof(int)) + 1] =
1009			    mib[(miblen / sizeof(int))] + i;
1010			desclen = sizeof(desc.s);
1011			if (sysctl(mib, (miblen / sizeof(int)) + 2, desc.s,
1012			    &desclen, NULL, 0) < 0) {
1013				if (errno == ENOENT)
1014					continue;
1015				snprintf(jail_errmsg, JAIL_ERRMSGLEN,
1016				    "sysctl(0.1): %s", strerror(errno));
1017				return (-1);
1018			}
1019			if (desclen == sizeof(SJPARAM) + strlen(name) + 2 &&
1020			    memcmp(SJPARAM ".", desc.s, sizeof(SJPARAM)) == 0 &&
1021			    memcmp(name, desc.s + sizeof(SJPARAM),
1022			    desclen - sizeof(SJPARAM) - 2) == 0 &&
1023			    desc.s[desclen - 2] == '.')
1024				goto mib_desc;
1025		}
1026		goto unknown_parameter;
1027	default:
1028		snprintf(jail_errmsg, JAIL_ERRMSGLEN,
1029		    "unknown type for %s", jp->jp_name);
1030		errno = ENOENT;
1031		return (-1);
1032	}
1033	if (isarray) {
1034		jp->jp_elemlen = jp->jp_valuelen;
1035		jp->jp_valuelen = 0;
1036	}
1037	return (0);
1038}
1039
1040/*
1041 * Attempt to load a kernel module matching an otherwise nonexistent parameter.
1042 */
1043static int
1044kldload_param(const char *name)
1045{
1046	int kl;
1047
1048	if (strcmp(name, "linux") == 0 || strncmp(name, "linux.", 6) == 0)
1049		kl = kldload("linux");
1050	else if (strcmp(name, "sysvmsg") == 0 || strcmp(name, "sysvsem") == 0 ||
1051	    strcmp(name, "sysvshm") == 0)
1052		kl = kldload(name);
1053	else if (strncmp(name, "allow.mount.", 12) == 0) {
1054		/* Load the matching filesystem */
1055		const char *modname = name + 12;
1056
1057		kl = kldload(modname);
1058		if (kl < 0 && errno == ENOENT &&
1059		    strncmp(modname, "no", 2) == 0)
1060			kl = kldload(modname + 2);
1061	} else {
1062		errno = ENOENT;
1063		return (-1);
1064	}
1065	if (kl < 0 && errno == EEXIST) {
1066		/*
1067		 * In the module is already loaded, then it must not contain
1068		 * the parameter.
1069		 */
1070		errno = ENOENT;
1071	}
1072	return kl;
1073}
1074
1075/*
1076 * Change a boolean parameter name into its "no" counterpart or vice versa.
1077 */
1078static char *
1079noname(const char *name)
1080{
1081	char *nname, *p;
1082
1083	nname = malloc(strlen(name) + 3);
1084	if (nname == NULL) {
1085		strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
1086		return (NULL);
1087	}
1088	p = strrchr(name, '.');
1089	if (p != NULL)
1090		sprintf(nname, "%.*s.no%s", (int)(p - name), name, p + 1);
1091	else
1092		sprintf(nname, "no%s", name);
1093	return (nname);
1094}
1095
1096static char *
1097nononame(const char *name)
1098{
1099	char *p, *nname;
1100
1101	p = strrchr(name, '.');
1102	if (strncmp(p ? p + 1 : name, "no", 2)) {
1103		snprintf(jail_errmsg, sizeof(jail_errmsg),
1104		    "mismatched boolean: %s", name);
1105		errno = EINVAL;
1106		return (NULL);
1107	}
1108	nname = malloc(strlen(name) - 1);
1109	if (nname == NULL) {
1110		strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
1111		return (NULL);
1112	}
1113	if (p != NULL)
1114		sprintf(nname, "%.*s.%s", (int)(p - name), name, p + 3);
1115	else
1116		strcpy(nname, name + 2);
1117	return (nname);
1118}
1119