1/*-
2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3 *
4 * Copyright (c) 2011 James Gritton
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 *    notice, this list of conditions and the following disclaimer in the
14 *    documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29#include <sys/cdefs.h>
30__FBSDID("$FreeBSD$");
31
32#include <sys/types.h>
33#include <sys/errno.h>
34#include <sys/socket.h>
35#include <sys/sysctl.h>
36
37#include <arpa/inet.h>
38#include <netinet/in.h>
39
40#include <err.h>
41#include <netdb.h>
42#include <stdio.h>
43#include <stdlib.h>
44#include <string.h>
45#include <unistd.h>
46
47#include "jailp.h"
48
49struct ipspec {
50	const char	*name;
51	unsigned	flags;
52};
53
54extern FILE *yyin;
55extern int yynerrs;
56
57extern int yyparse(void);
58
59struct cfjails cfjails = TAILQ_HEAD_INITIALIZER(cfjails);
60
61static void free_param(struct cfparams *pp, struct cfparam *p);
62static void free_param_strings(struct cfparam *p);
63
64static const struct ipspec intparams[] = {
65    [IP_ALLOW_DYING] =		{"allow.dying",		PF_INTERNAL | PF_BOOL},
66    [IP_COMMAND] =		{"command",		PF_INTERNAL},
67    [IP_DEPEND] =		{"depend",		PF_INTERNAL},
68    [IP_EXEC_CLEAN] =		{"exec.clean",		PF_INTERNAL | PF_BOOL},
69    [IP_EXEC_CONSOLELOG] =	{"exec.consolelog",	PF_INTERNAL},
70    [IP_EXEC_FIB] =		{"exec.fib",		PF_INTERNAL | PF_INT},
71    [IP_EXEC_JAIL_USER] =	{"exec.jail_user",	PF_INTERNAL},
72    [IP_EXEC_POSTSTART] =	{"exec.poststart",	PF_INTERNAL},
73    [IP_EXEC_POSTSTOP] =	{"exec.poststop",	PF_INTERNAL},
74    [IP_EXEC_PRESTART] =	{"exec.prestart",	PF_INTERNAL},
75    [IP_EXEC_PRESTOP] =		{"exec.prestop",	PF_INTERNAL},
76    [IP_EXEC_CREATED] =		{"exec.created",	PF_INTERNAL},
77    [IP_EXEC_START] =		{"exec.start",		PF_INTERNAL},
78    [IP_EXEC_STOP] =		{"exec.stop",		PF_INTERNAL},
79    [IP_EXEC_SYSTEM_JAIL_USER]=	{"exec.system_jail_user",
80							PF_INTERNAL | PF_BOOL},
81    [IP_EXEC_SYSTEM_USER] =	{"exec.system_user",	PF_INTERNAL},
82    [IP_EXEC_TIMEOUT] =		{"exec.timeout",	PF_INTERNAL | PF_INT},
83#if defined(INET) || defined(INET6)
84    [IP_INTERFACE] =		{"interface",		PF_INTERNAL},
85    [IP_IP_HOSTNAME] =		{"ip_hostname",		PF_INTERNAL | PF_BOOL},
86#endif
87    [IP_MOUNT] =		{"mount",		PF_INTERNAL | PF_REV},
88    [IP_MOUNT_DEVFS] =		{"mount.devfs",		PF_INTERNAL | PF_BOOL},
89    [IP_MOUNT_FDESCFS] =	{"mount.fdescfs",	PF_INTERNAL | PF_BOOL},
90    [IP_MOUNT_PROCFS] =		{"mount.procfs",	PF_INTERNAL | PF_BOOL},
91    [IP_MOUNT_FSTAB] =		{"mount.fstab",		PF_INTERNAL},
92    [IP_STOP_TIMEOUT] =		{"stop.timeout",	PF_INTERNAL | PF_INT},
93    [IP_VNET_INTERFACE] =	{"vnet.interface",	PF_INTERNAL},
94#ifdef INET
95    [IP__IP4_IFADDR] =		{"ip4.addr",	PF_INTERNAL | PF_CONV | PF_REV},
96#endif
97#ifdef INET6
98    [IP__IP6_IFADDR] =		{"ip6.addr",	PF_INTERNAL | PF_CONV | PF_REV},
99#endif
100    [IP__MOUNT_FROM_FSTAB] =	{"mount.fstab",	PF_INTERNAL | PF_CONV | PF_REV},
101    [IP__OP] =			{NULL,			PF_CONV},
102    [KP_ALLOW_CHFLAGS] =	{"allow.chflags",	0},
103    [KP_ALLOW_MOUNT] =		{"allow.mount",		0},
104    [KP_ALLOW_RAW_SOCKETS] =	{"allow.raw_sockets",	0},
105    [KP_ALLOW_SET_HOSTNAME]=	{"allow.set_hostname",	0},
106    [KP_ALLOW_SOCKET_AF] =	{"allow.socket_af",	0},
107    [KP_ALLOW_SYSVIPC] =	{"allow.sysvipc",	0},
108    [KP_DEVFS_RULESET] =	{"devfs_ruleset",	0},
109    [KP_HOST_HOSTNAME] =	{"host.hostname",	0},
110#ifdef INET
111    [KP_IP4_ADDR] =		{"ip4.addr",		0},
112#endif
113#ifdef INET6
114    [KP_IP6_ADDR] =		{"ip6.addr",		0},
115#endif
116    [KP_JID] =			{"jid",			PF_IMMUTABLE},
117    [KP_NAME] =			{"name",		PF_IMMUTABLE},
118    [KP_PATH] =			{"path",		0},
119    [KP_PERSIST] =		{"persist",		0},
120    [KP_SECURELEVEL] =		{"securelevel",		0},
121    [KP_VNET] =			{"vnet",		0},
122};
123
124/*
125 * Parse the jail configuration file.
126 */
127void
128load_config(void)
129{
130	struct cfjails wild;
131	struct cfparams opp;
132	struct cfjail *j, *tj, *wj;
133	struct cfparam *p, *vp, *tp;
134	struct cfstring *s, *vs, *ns;
135	struct cfvar *v, *vv;
136	char *ep;
137	int did_self, jseq, pgen;
138
139	if (!strcmp(cfname, "-")) {
140		cfname = "STDIN";
141		yyin = stdin;
142	} else {
143		yyin = fopen(cfname, "r");
144		if (!yyin)
145			err(1, "%s", cfname);
146	}
147	if (yyparse() || yynerrs)
148		exit(1);
149
150	/* Separate the wildcard jails out from the actual jails. */
151	jseq = 0;
152	TAILQ_INIT(&wild);
153	TAILQ_FOREACH_SAFE(j, &cfjails, tq, tj) {
154		j->seq = ++jseq;
155		if (wild_jail_name(j->name))
156			requeue(j, &wild);
157	}
158
159	TAILQ_FOREACH(j, &cfjails, tq) {
160		/* Set aside the jail's parameters. */
161		TAILQ_INIT(&opp);
162		TAILQ_CONCAT(&opp, &j->params, tq);
163		/*
164		 * The jail name implies its "name" or "jid" parameter,
165		 * though they may also be explicitly set later on.
166		 */
167		add_param(j, NULL,
168		    strtol(j->name, &ep, 10) && !*ep ? KP_JID : KP_NAME,
169		    j->name);
170		/*
171		 * Collect parameters for the jail, global parameters/variables,
172		 * and any matching wildcard jails.
173		 */
174		did_self = 0;
175		TAILQ_FOREACH(wj, &wild, tq) {
176			if (j->seq < wj->seq && !did_self) {
177				TAILQ_FOREACH(p, &opp, tq)
178					add_param(j, p, 0, NULL);
179				did_self = 1;
180			}
181			if (wild_jail_match(j->name, wj->name))
182				TAILQ_FOREACH(p, &wj->params, tq)
183					add_param(j, p, 0, NULL);
184		}
185		if (!did_self)
186			TAILQ_FOREACH(p, &opp, tq)
187				add_param(j, p, 0, NULL);
188
189		/* Resolve any variable substitutions. */
190		pgen = 0;
191		TAILQ_FOREACH(p, &j->params, tq) {
192		    p->gen = ++pgen;
193		find_vars:
194		    TAILQ_FOREACH(s, &p->val, tq) {
195			while ((v = STAILQ_FIRST(&s->vars))) {
196				TAILQ_FOREACH(vp, &j->params, tq)
197					if (!strcmp(vp->name, v->name))
198						break;
199				if (!vp) {
200					jail_warnx(j,
201					    "%s: variable \"%s\" not found",
202					    p->name, v->name);
203				bad_var:
204					j->flags |= JF_FAILED;
205					TAILQ_FOREACH(vp, &j->params, tq)
206						if (vp->gen == pgen)
207							vp->flags |= PF_BAD;
208					goto free_var;
209				}
210				if (vp->flags & PF_BAD)
211					goto bad_var;
212				if (vp->gen == pgen) {
213					jail_warnx(j, "%s: variable loop",
214					    v->name);
215					goto bad_var;
216				}
217				TAILQ_FOREACH(vs, &vp->val, tq)
218					if (!STAILQ_EMPTY(&vs->vars)) {
219						vp->gen = pgen;
220						TAILQ_REMOVE(&j->params, vp,
221						    tq);
222						TAILQ_INSERT_BEFORE(p, vp, tq);
223						p = vp;
224						goto find_vars;
225					}
226				vs = TAILQ_FIRST(&vp->val);
227				if (TAILQ_NEXT(vs, tq) != NULL &&
228				    (s->s[0] != '\0' ||
229				     STAILQ_NEXT(v, tq))) {
230					jail_warnx(j, "%s: array cannot be "
231					    "substituted inline",
232					    p->name);
233					goto bad_var;
234				}
235				s->s = erealloc(s->s, s->len + vs->len + 1);
236				memmove(s->s + v->pos + vs->len,
237				    s->s + v->pos,
238				    s->len - v->pos + 1);
239				memcpy(s->s + v->pos, vs->s, vs->len);
240				vv = v;
241				while ((vv = STAILQ_NEXT(vv, tq)))
242					vv->pos += vs->len;
243				s->len += vs->len;
244				while ((vs = TAILQ_NEXT(vs, tq))) {
245					ns = emalloc(sizeof(struct cfstring));
246					ns->s = estrdup(vs->s);
247					ns->len = vs->len;
248					STAILQ_INIT(&ns->vars);
249					TAILQ_INSERT_AFTER(&p->val, s, ns, tq);
250					s = ns;
251				}
252			free_var:
253				free(v->name);
254				STAILQ_REMOVE_HEAD(&s->vars, tq);
255				free(v);
256			}
257		    }
258		}
259
260		/* Free the jail's original parameter list and any variables. */
261		while ((p = TAILQ_FIRST(&opp)))
262			free_param(&opp, p);
263		TAILQ_FOREACH_SAFE(p, &j->params, tq, tp)
264			if (p->flags & PF_VAR)
265				free_param(&j->params, p);
266	}
267	while ((wj = TAILQ_FIRST(&wild))) {
268		free(wj->name);
269		while ((p = TAILQ_FIRST(&wj->params)))
270			free_param(&wj->params, p);
271		TAILQ_REMOVE(&wild, wj, tq);
272	}
273}
274
275/*
276 * Create a new jail record.
277 */
278struct cfjail *
279add_jail(void)
280{
281	struct cfjail *j;
282
283	j = emalloc(sizeof(struct cfjail));
284	memset(j, 0, sizeof(struct cfjail));
285	TAILQ_INIT(&j->params);
286	STAILQ_INIT(&j->dep[DEP_FROM]);
287	STAILQ_INIT(&j->dep[DEP_TO]);
288	j->queue = &cfjails;
289	TAILQ_INSERT_TAIL(&cfjails, j, tq);
290	return j;
291}
292
293/*
294 * Add a parameter to a jail.
295 */
296void
297add_param(struct cfjail *j, const struct cfparam *p, enum intparam ipnum,
298    const char *value)
299{
300	struct cfstrings nss;
301	struct cfparam *dp, *np;
302	struct cfstring *s, *ns;
303	struct cfvar *v, *nv;
304	const char *name;
305	char *cs, *tname;
306	unsigned flags;
307
308	if (j == NULL) {
309		/* Create a single anonymous jail if one doesn't yet exist. */
310		j = TAILQ_LAST(&cfjails, cfjails);
311		if (j == NULL)
312			j = add_jail();
313	}
314	TAILQ_INIT(&nss);
315	if (p != NULL) {
316		name = p->name;
317		flags = p->flags;
318		/*
319		 * Make a copy of the parameter's string list,
320		 * which may be freed if it's overridden later.
321		 */
322		TAILQ_FOREACH(s, &p->val, tq) {
323			ns = emalloc(sizeof(struct cfstring));
324			ns->s = estrdup(s->s);
325			ns->len = s->len;
326			STAILQ_INIT(&ns->vars);
327			STAILQ_FOREACH(v, &s->vars, tq) {
328				nv = emalloc(sizeof(struct cfvar));
329				nv->name = strdup(v->name);
330				nv->pos = v->pos;
331				STAILQ_INSERT_TAIL(&ns->vars, nv, tq);
332			}
333			TAILQ_INSERT_TAIL(&nss, ns, tq);
334		}
335	} else {
336		flags = PF_APPEND;
337		if (ipnum != IP__NULL) {
338			name = intparams[ipnum].name;
339			flags |= intparams[ipnum].flags;
340		} else if ((cs = strchr(value, '='))) {
341			tname = alloca(cs - value + 1);
342			strlcpy(tname, value, cs - value + 1);
343			name = tname;
344			value = cs + 1;
345		} else {
346			name = value;
347			value = NULL;
348		}
349		if (value != NULL) {
350			ns = emalloc(sizeof(struct cfstring));
351			ns->s = estrdup(value);
352			ns->len = strlen(value);
353			STAILQ_INIT(&ns->vars);
354			TAILQ_INSERT_TAIL(&nss, ns, tq);
355		}
356	}
357
358	/* See if this parameter has already been added. */
359	if (ipnum != IP__NULL)
360		dp = j->intparams[ipnum];
361	else
362		TAILQ_FOREACH(dp, &j->params, tq)
363			if (!(dp->flags & PF_CONV) && equalopts(dp->name, name))
364				break;
365	if (dp != NULL) {
366		/* Found it - append or replace. */
367		if (dp->flags & PF_IMMUTABLE) {
368			jail_warnx(j, "cannot redefine variable \"%s\".",
369			    dp->name);
370			return;
371		}
372		if (strcmp(dp->name, name)) {
373			free(dp->name);
374			dp->name = estrdup(name);
375		}
376		if (!(flags & PF_APPEND) || TAILQ_EMPTY(&nss))
377			free_param_strings(dp);
378		TAILQ_CONCAT(&dp->val, &nss, tq);
379		dp->flags |= flags;
380	} else {
381		/* Not found - add it. */
382		np = emalloc(sizeof(struct cfparam));
383		np->name = estrdup(name);
384		TAILQ_INIT(&np->val);
385		TAILQ_CONCAT(&np->val, &nss, tq);
386		np->flags = flags;
387		np->gen = 0;
388		TAILQ_INSERT_TAIL(&j->params, np, tq);
389		if (ipnum != IP__NULL)
390			j->intparams[ipnum] = np;
391		else
392			for (ipnum = IP__NULL + 1; ipnum < IP_NPARAM; ipnum++)
393				if (!(intparams[ipnum].flags & PF_CONV) &&
394				    equalopts(name, intparams[ipnum].name)) {
395					j->intparams[ipnum] = np;
396					np->flags |= intparams[ipnum].flags;
397					break;
398				}
399	}
400}
401
402/*
403 * Return if a boolean parameter exists and is true.
404 */
405int
406bool_param(const struct cfparam *p)
407{
408	const char *cs;
409
410	if (p == NULL)
411		return 0;
412	cs = strrchr(p->name, '.');
413	return !strncmp(cs ? cs + 1 : p->name, "no", 2) ^
414	    (TAILQ_EMPTY(&p->val) ||
415	     !strcasecmp(TAILQ_LAST(&p->val, cfstrings)->s, "true") ||
416	     (strtol(TAILQ_LAST(&p->val, cfstrings)->s, NULL, 10)));
417}
418
419/*
420 * Set an integer if a parameter if it exists.
421 */
422int
423int_param(const struct cfparam *p, int *ip)
424{
425	if (p == NULL || TAILQ_EMPTY(&p->val))
426		return 0;
427	*ip = strtol(TAILQ_LAST(&p->val, cfstrings)->s, NULL, 10);
428	return 1;
429}
430
431/*
432 * Return the string value of a scalar parameter if it exists.
433 */
434const char *
435string_param(const struct cfparam *p)
436{
437	return (p && !TAILQ_EMPTY(&p->val)
438	    ? TAILQ_LAST(&p->val, cfstrings)->s : NULL);
439}
440
441/*
442 * Check syntax and values of internal parameters.  Set some internal
443 * parameters based on the values of others.
444 */
445int
446check_intparams(struct cfjail *j)
447{
448	struct cfparam *p;
449	struct cfstring *s;
450	FILE *f;
451	const char *val;
452	char *cs, *ep, *ln;
453	size_t lnlen;
454	int error;
455#if defined(INET) || defined(INET6)
456	struct addrinfo hints;
457	struct addrinfo *ai0, *ai;
458	const char *hostname;
459	int gicode, defif;
460#endif
461#ifdef INET
462	struct in_addr addr4;
463	int ip4ok;
464	char avalue4[INET_ADDRSTRLEN];
465#endif
466#ifdef INET6
467	struct in6_addr addr6;
468	int ip6ok;
469	char avalue6[INET6_ADDRSTRLEN];
470#endif
471
472	error = 0;
473	/* Check format of boolan and integer values. */
474	TAILQ_FOREACH(p, &j->params, tq) {
475		if (!TAILQ_EMPTY(&p->val) && (p->flags & (PF_BOOL | PF_INT))) {
476			val = TAILQ_LAST(&p->val, cfstrings)->s;
477			if (p->flags & PF_BOOL) {
478				if (strcasecmp(val, "false") &&
479				    strcasecmp(val, "true") &&
480				    ((void)strtol(val, &ep, 10), *ep)) {
481					jail_warnx(j,
482					    "%s: unknown boolean value \"%s\"",
483					    p->name, val);
484					error = -1;
485				}
486			} else {
487				(void)strtol(val, &ep, 10);
488				if (ep == val || *ep) {
489					jail_warnx(j,
490					    "%s: non-integer value \"%s\"",
491					    p->name, val);
492					error = -1;
493				}
494			}
495		}
496	}
497
498#if defined(INET) || defined(INET6)
499	/*
500	 * The ip_hostname parameter looks up the hostname, and adds parameters
501	 * for any IP addresses it finds.
502	 */
503	if (((j->flags & JF_OP_MASK) != JF_STOP ||
504	    j->intparams[IP_INTERFACE] != NULL) &&
505	    bool_param(j->intparams[IP_IP_HOSTNAME]) &&
506	    (hostname = string_param(j->intparams[KP_HOST_HOSTNAME]))) {
507		j->intparams[IP_IP_HOSTNAME] = NULL;
508		/*
509		 * Silently ignore unsupported address families from
510		 * DNS lookups.
511		 */
512#ifdef INET
513		ip4ok = feature_present("inet");
514#endif
515#ifdef INET6
516		ip6ok = feature_present("inet6");
517#endif
518		if (
519#if defined(INET) && defined(INET6)
520		    ip4ok || ip6ok
521#elif defined(INET)
522		    ip4ok
523#elif defined(INET6)
524		    ip6ok
525#endif
526			 ) {
527			/* Look up the hostname (or get the address) */
528			memset(&hints, 0, sizeof(hints));
529			hints.ai_socktype = SOCK_STREAM;
530			hints.ai_family =
531#if defined(INET) && defined(INET6)
532			    ip4ok ? (ip6ok ? PF_UNSPEC : PF_INET) :  PF_INET6;
533#elif defined(INET)
534			    PF_INET;
535#elif defined(INET6)
536			    PF_INET6;
537#endif
538			gicode = getaddrinfo(hostname, NULL, &hints, &ai0);
539			if (gicode != 0) {
540				jail_warnx(j, "host.hostname %s: %s", hostname,
541				    gai_strerror(gicode));
542				error = -1;
543			} else {
544				/*
545				 * Convert the addresses to ASCII so jailparam
546				 * can convert them back.  Errors are not
547				 * expected here.
548				 */
549				for (ai = ai0; ai; ai = ai->ai_next)
550					switch (ai->ai_family) {
551#ifdef INET
552					case AF_INET:
553						memcpy(&addr4,
554						    &((struct sockaddr_in *)
555						    (void *)ai->ai_addr)->
556						    sin_addr, sizeof(addr4));
557						if (inet_ntop(AF_INET,
558						    &addr4, avalue4,
559						    INET_ADDRSTRLEN) == NULL)
560							err(1, "inet_ntop");
561						add_param(j, NULL, KP_IP4_ADDR,
562						    avalue4);
563						break;
564#endif
565#ifdef INET6
566					case AF_INET6:
567						memcpy(&addr6,
568						    &((struct sockaddr_in6 *)
569						    (void *)ai->ai_addr)->
570						    sin6_addr, sizeof(addr6));
571						if (inet_ntop(AF_INET6,
572						    &addr6, avalue6,
573						    INET6_ADDRSTRLEN) == NULL)
574							err(1, "inet_ntop");
575						add_param(j, NULL, KP_IP6_ADDR,
576						    avalue6);
577						break;
578#endif
579					}
580				freeaddrinfo(ai0);
581			}
582		}
583	}
584
585	/*
586	 * IP addresses may include an interface to set that address on,
587	 * a netmask/suffix for that address and options for ifconfig.
588	 * These are copied to an internal command parameter and then stripped
589	 * so they won't be passed on to jailparam_set.
590	 */
591	defif = string_param(j->intparams[IP_INTERFACE]) != NULL;
592#ifdef INET
593	if (j->intparams[KP_IP4_ADDR] != NULL) {
594		TAILQ_FOREACH(s, &j->intparams[KP_IP4_ADDR]->val, tq) {
595			cs = strchr(s->s, '|');
596			if (cs || defif)
597				add_param(j, NULL, IP__IP4_IFADDR, s->s);
598			if (cs) {
599				strcpy(s->s, cs + 1);
600				s->len -= cs + 1 - s->s;
601			}
602			if ((cs = strchr(s->s, '/')) != NULL) {
603				*cs = '\0';
604				s->len = cs - s->s;
605			}
606			if ((cs = strchr(s->s, ' ')) != NULL) {
607				*cs = '\0';
608				s->len = cs - s->s;
609			}
610		}
611	}
612#endif
613#ifdef INET6
614	if (j->intparams[KP_IP6_ADDR] != NULL) {
615		TAILQ_FOREACH(s, &j->intparams[KP_IP6_ADDR]->val, tq) {
616			cs = strchr(s->s, '|');
617			if (cs || defif)
618				add_param(j, NULL, IP__IP6_IFADDR, s->s);
619			if (cs) {
620				strcpy(s->s, cs + 1);
621				s->len -= cs + 1 - s->s;
622			}
623			if ((cs = strchr(s->s, '/')) != NULL) {
624				*cs = '\0';
625				s->len = cs - s->s;
626			}
627			if ((cs = strchr(s->s, ' ')) != NULL) {
628				*cs = '\0';
629				s->len = cs - s->s;
630			}
631		}
632	}
633#endif
634#endif
635
636	/*
637	 * Read mount.fstab file(s), and treat each line as its own mount
638	 * parameter.
639	 */
640	if (j->intparams[IP_MOUNT_FSTAB] != NULL) {
641		TAILQ_FOREACH(s, &j->intparams[IP_MOUNT_FSTAB]->val, tq) {
642			if (s->len == 0)
643				continue;
644			f = fopen(s->s, "r");
645			if (f == NULL) {
646				jail_warnx(j, "mount.fstab: %s: %s",
647				    s->s, strerror(errno));
648				error = -1;
649				continue;
650			}
651			while ((ln = fgetln(f, &lnlen))) {
652				if ((cs = memchr(ln, '#', lnlen - 1)))
653					lnlen = cs - ln + 1;
654				if (ln[lnlen - 1] == '\n' ||
655				    ln[lnlen - 1] == '#')
656					ln[lnlen - 1] = '\0';
657				else {
658					cs = alloca(lnlen + 1);
659					strlcpy(cs, ln, lnlen + 1);
660					ln = cs;
661				}
662				add_param(j, NULL, IP__MOUNT_FROM_FSTAB, ln);
663			}
664			fclose(f);
665		}
666	}
667	if (error)
668		failed(j);
669	return error;
670}
671
672/*
673 * Import parameters into libjail's binary jailparam format.
674 */
675int
676import_params(struct cfjail *j)
677{
678	struct cfparam *p;
679	struct cfstring *s, *ts;
680	struct jailparam *jp;
681	char *value, *cs;
682	size_t vallen;
683	int error;
684
685	error = 0;
686	j->njp = 0;
687	TAILQ_FOREACH(p, &j->params, tq)
688		if (!(p->flags & PF_INTERNAL))
689			j->njp++;
690	j->jp = jp = emalloc(j->njp * sizeof(struct jailparam));
691	TAILQ_FOREACH(p, &j->params, tq) {
692		if (p->flags & PF_INTERNAL)
693			continue;
694		if (jailparam_init(jp, p->name) < 0) {
695			error = -1;
696			jail_warnx(j, "%s", jail_errmsg);
697			jp++;
698			continue;
699		}
700		if (TAILQ_EMPTY(&p->val))
701			value = NULL;
702		else if (!jp->jp_elemlen ||
703			 !TAILQ_NEXT(TAILQ_FIRST(&p->val), tq)) {
704			/*
705			 * Scalar parameters silently discard multiple (array)
706			 * values, keeping only the last value added.  This
707			 * lets values added from the command line append to
708			 * arrays wthout pre-checking the type.
709			 */
710			value = TAILQ_LAST(&p->val, cfstrings)->s;
711		} else {
712			/*
713			 * Convert arrays into comma-separated strings, which
714			 * jailparam_import will then convert back into arrays.
715			 */
716			vallen = 0;
717			TAILQ_FOREACH(s, &p->val, tq)
718				vallen += s->len + 1;
719			value = alloca(vallen);
720			cs = value;
721			TAILQ_FOREACH_SAFE(s, &p->val, tq, ts) {
722				memcpy(cs, s->s, s->len);
723				cs += s->len + 1;
724				cs[-1] = ',';
725			}
726			value[vallen - 1] = '\0';
727		}
728		if (jailparam_import(jp, value) < 0) {
729			error = -1;
730			jail_warnx(j, "%s", jail_errmsg);
731		}
732		jp++;
733	}
734	if (error) {
735		jailparam_free(j->jp, j->njp);
736		free(j->jp);
737		j->jp = NULL;
738		failed(j);
739	}
740	return error;
741}
742
743/*
744 * Check if options are equal (with or without the "no" prefix).
745 */
746int
747equalopts(const char *opt1, const char *opt2)
748{
749	char *p;
750
751	/* "opt" vs. "opt" or "noopt" vs. "noopt" */
752	if (strcmp(opt1, opt2) == 0)
753		return (1);
754	/* "noopt" vs. "opt" */
755	if (strncmp(opt1, "no", 2) == 0 && strcmp(opt1 + 2, opt2) == 0)
756		return (1);
757	/* "opt" vs. "noopt" */
758	if (strncmp(opt2, "no", 2) == 0 && strcmp(opt1, opt2 + 2) == 0)
759		return (1);
760	while ((p = strchr(opt1, '.')) != NULL &&
761	    !strncmp(opt1, opt2, ++p - opt1)) {
762		opt2 += p - opt1;
763		opt1 = p;
764		/* "foo.noopt" vs. "foo.opt" */
765		if (strncmp(opt1, "no", 2) == 0 && strcmp(opt1 + 2, opt2) == 0)
766			return (1);
767		/* "foo.opt" vs. "foo.noopt" */
768		if (strncmp(opt2, "no", 2) == 0 && strcmp(opt1, opt2 + 2) == 0)
769			return (1);
770	}
771	return (0);
772}
773
774/*
775 * See if a jail name matches a wildcard.
776 */
777int
778wild_jail_match(const char *jname, const char *wname)
779{
780	const char *jc, *jd, *wc, *wd;
781
782	/*
783	 * A non-final "*" component in the wild name matches a single jail
784	 * component, and a final "*" matches one or more jail components.
785	 */
786	for (jc = jname, wc = wname;
787	     (jd = strchr(jc, '.')) && (wd = strchr(wc, '.'));
788	     jc = jd + 1, wc = wd + 1)
789		if (strncmp(jc, wc, jd - jc + 1) && strncmp(wc, "*.", 2))
790			return 0;
791	return (!strcmp(jc, wc) || !strcmp(wc, "*"));
792}
793
794/*
795 * Return if a jail name is a wildcard.
796 */
797int
798wild_jail_name(const char *wname)
799{
800	const char *wc;
801
802	for (wc = strchr(wname, '*'); wc; wc = strchr(wc + 1, '*'))
803		if ((wc == wname || wc[-1] == '.') &&
804		    (wc[1] == '\0' || wc[1] == '.'))
805			return 1;
806	return 0;
807}
808
809/*
810 * Free a parameter record and all its strings and variables.
811 */
812static void
813free_param(struct cfparams *pp, struct cfparam *p)
814{
815	free(p->name);
816	free_param_strings(p);
817	TAILQ_REMOVE(pp, p, tq);
818	free(p);
819}
820
821static void
822free_param_strings(struct cfparam *p)
823{
824	struct cfstring *s;
825	struct cfvar *v;
826
827	while ((s = TAILQ_FIRST(&p->val))) {
828		free(s->s);
829		while ((v = STAILQ_FIRST(&s->vars))) {
830			free(v->name);
831			STAILQ_REMOVE_HEAD(&s->vars, tq);
832			free(v);
833		}
834		TAILQ_REMOVE(&p->val, s, tq);
835		free(s);
836	}
837}
838