config.c revision 223188 
1/*-
2 * Copyright (c) 2010 James Gritton
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 *    notice, this list of conditions and the following disclaimer in the
12 *    documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24 * SUCH DAMAGE.
25 */
26
27#include <sys/cdefs.h>
28__FBSDID("$FreeBSD: projects/jailconf/usr.sbin/jail/config.c 223188 2011-06-17 16:06:13Z jamie $");
29
30#include <sys/types.h>
31#include <sys/errno.h>
32#include <sys/socket.h>
33#include <sys/sysctl.h>
34
35#include <arpa/inet.h>
36#include <netinet/in.h>
37
38#include <err.h>
39#include <netdb.h>
40#include <stdio.h>
41#include <stdlib.h>
42#include <string.h>
43
44#include "jailp.h"
45
46struct ipspec {
47	const char	*name;
48	unsigned	flags;
49};
50
51extern FILE *yyin;
52extern int yynerrs;
53
54struct cfjails cfjails = TAILQ_HEAD_INITIALIZER(cfjails);
55
56static void free_param(struct cfparams *pp, struct cfparam *p);
57static void free_param_strings(struct cfparam *p);
58
59static const struct ipspec intparams[] = {
60    [IP_ALLOW_DYING] =		{"allow.dying",		PF_INTERNAL | PF_BOOL},
61    [IP_COMMAND] =		{"command",		PF_INTERNAL},
62    [IP_DEPEND] =		{"depend",		PF_INTERNAL},
63    [IP_EXEC_CLEAN] =		{"exec.clean",		PF_INTERNAL | PF_BOOL},
64    [IP_EXEC_CONSOLELOG] =	{"exec.consolelog",	PF_INTERNAL},
65    [IP_EXEC_FIB] =		{"exec.fib",		PF_INTERNAL | PF_INT},
66    [IP_EXEC_JAIL_USER] =	{"exec.jail_user",	PF_INTERNAL},
67    [IP_EXEC_POSTSTART] =	{"exec.poststart",	PF_INTERNAL},
68    [IP_EXEC_POSTSTOP] =	{"exec.poststop",	PF_INTERNAL},
69    [IP_EXEC_PRESTART] =	{"exec.prestart",	PF_INTERNAL},
70    [IP_EXEC_PRESTOP] =		{"exec.prestop",	PF_INTERNAL},
71    [IP_EXEC_START] =		{"exec.start",		PF_INTERNAL},
72    [IP_EXEC_STOP] =		{"exec.stop",		PF_INTERNAL},
73    [IP_EXEC_SYSTEM_JAIL_USER]=	{"exec.system_jail_user",
74							PF_INTERNAL | PF_BOOL},
75    [IP_EXEC_SYSTEM_USER] =	{"exec.system_user",	PF_INTERNAL},
76    [IP_EXEC_TIMEOUT] =		{"exec.timeout",	PF_INTERNAL | PF_INT},
77    [IP_INTERFACE] =		{"interface",		PF_INTERNAL},
78    [IP_IP_HOSTNAME] =		{"ip_hostname",		PF_INTERNAL | PF_BOOL},
79    [IP_MOUNT] =		{"mount",		PF_INTERNAL},
80    [IP_MOUNT_DEVFS] =		{"mount.devfs",		PF_INTERNAL | PF_BOOL},
81    [IP_MOUNT_DEVFS_RULESET]=	{"mount.devfs.ruleset",	PF_INTERNAL},
82    [IP_MOUNT_FSTAB] =		{"mount.fstab",		PF_INTERNAL},
83    [IP_STOP_TIMEOUT] =		{"stop.timeout",	PF_INTERNAL | PF_INT},
84    [IP_VNET_INTERFACE] =	{"vnet.interface",	PF_INTERNAL},
85    [IP__IP4_IFADDR] =		{"ip4.addr",		PF_INTERNAL | PF_CONV},
86#ifdef INET6
87    [IP__IP6_IFADDR] =		{"ip6.addr",		PF_INTERNAL | PF_CONV},
88#endif
89    [IP__MOUNT_FROM_FSTAB] =	{"mount.fstab",		PF_INTERNAL | PF_CONV},
90    [KP_ALLOW_CHFLAGS] =	{"allow.chflags",	0},
91    [KP_ALLOW_MOUNT] =		{"allow.mount",		0},
92    [KP_ALLOW_RAW_SOCKETS] =	{"allow.raw_sockets",	0},
93    [KP_ALLOW_SET_HOSTNAME]=	{"allow.set_hostname",	0},
94    [KP_ALLOW_SOCKET_AF] =	{"allow.socket_af",	0},
95    [KP_ALLOW_SYSVIPC] =	{"allow.sysvipc",	0},
96    [KP_ENFORCE_STATFS] =	{"enforce_statfs",	0},
97    [KP_HOST_HOSTNAME] =	{"host.hostname",	0},
98    [KP_IP4_ADDR] =		{"ip4.addr",		0},
99#ifdef INET6
100    [KP_IP6_ADDR] =		{"ip6.addr",		0},
101#endif
102    [KP_JID] =			{"jid",			0},
103    [KP_NAME] =			{"name",		0},
104    [KP_PATH] =			{"path",		0},
105    [KP_PERSIST] =		{"persist",		0},
106    [KP_SECURELEVEL] =		{"securelevel",		0},
107    [KP_VNET] =			{"vnet",		0},
108};
109
110/*
111 * Parse the jail configuration file.
112 */
113void
114load_config(void)
115{
116	struct cfjails wild;
117	struct cfparams opp;
118	struct cfjail *j, *tj, *wj;
119	struct cfparam *p, *vp, *tp;
120	struct cfstring *s, *vs, *ns;
121	struct cfvar *v;
122	char *ep;
123	size_t varoff;
124	int did_self, jseq, pgen;
125
126	if (!strcmp(cfname, "-")) {
127		cfname = "STDIN";
128		yyin = stdin;
129	} else {
130		yyin = fopen(cfname, "r");
131		if (!yyin)
132			err(1, "%s", cfname);
133	}
134	if (yyparse() || yynerrs)
135		exit(1);
136
137	/* Separate the wildcard jails out from the actual jails. */
138	jseq = 0;
139	TAILQ_INIT(&wild);
140	TAILQ_FOREACH_SAFE(j, &cfjails, tq, tj) {
141		j->seq = ++jseq;
142		if (wild_jail_name(j->name))
143			requeue(j, &wild);
144	}
145
146	TAILQ_FOREACH(j, &cfjails, tq) {
147		/* Set aside the jail's parameters. */
148		TAILQ_INIT(&opp);
149		TAILQ_CONCAT(&opp, &j->params, tq);
150		/*
151		 * The jail name implies its "name" or "jid" parameter,
152		 * though they may also be explicitly set later on.
153		 */
154		add_param(j, NULL,
155		    strtol(j->name, &ep, 10) && !*ep ? KP_JID : KP_NAME,
156		    j->name);
157		/*
158		 * Collect parameters for the jail, global parameters/variables,
159		 * and any matching wildcard jails.
160		 */
161		did_self = 0;
162		TAILQ_FOREACH(wj, &wild, tq) {
163			if (j->seq < wj->seq && !did_self) {
164				TAILQ_FOREACH(p, &opp, tq)
165					add_param(j, p, 0, NULL);
166				did_self = 1;
167			}
168			if (wild_jail_match(j->name, wj->name))
169				TAILQ_FOREACH(p, &wj->params, tq)
170					add_param(j, p, 0, NULL);
171		}
172		if (!did_self)
173			TAILQ_FOREACH(p, &opp, tq)
174				add_param(j, p, 0, NULL);
175
176		/* Resolve any variable substitutions. */
177		pgen = 0;
178		TAILQ_FOREACH(p, &j->params, tq) {
179		    p->gen = ++pgen;
180		find_vars:
181		    TAILQ_FOREACH(s, &p->val, tq) {
182			varoff = 0;
183			while ((v = STAILQ_FIRST(&s->vars))) {
184				TAILQ_FOREACH(vp, &j->params, tq)
185					if (!strcmp(vp->name, v->name))
186						break;
187				if (!vp) {
188					jail_warnx(j,
189					    "%s: variable \"%s\" not found",
190					    p->name, v->name);
191				bad_var:
192					j->flags |= JF_FAILED;
193					TAILQ_FOREACH(vp, &j->params, tq)
194						if (vp->gen == pgen)
195							vp->flags |= PF_BAD;
196					goto free_var;
197				}
198				if (vp->flags & PF_BAD)
199					goto bad_var;
200				if (vp->gen == pgen) {
201					jail_warnx(j, "%s: variable loop",
202					    v->name);
203					goto bad_var;
204				}
205				TAILQ_FOREACH(vs, &vp->val, tq)
206					if (!STAILQ_EMPTY(&vs->vars)) {
207						vp->gen = pgen;
208						TAILQ_REMOVE(&j->params, vp,
209						    tq);
210						TAILQ_INSERT_BEFORE(p, vp, tq);
211						p = vp;
212						goto find_vars;
213					}
214				vs = TAILQ_FIRST(&vp->val);
215				if (TAILQ_NEXT(vs, tq) != NULL &&
216				    (s->s[0] != '\0' ||
217				     STAILQ_NEXT(v, tq))) {
218					jail_warnx(j, "%s: array cannot be "
219					    "substituted inline",
220					    p->name);
221					goto bad_var;
222				}
223				s->s = erealloc(s->s, s->len + vs->len + 1);
224				memmove(s->s + v->pos + varoff + vs->len,
225				    s->s + v->pos + varoff,
226				    s->len - (v->pos + varoff) + 1);
227				memcpy(s->s + v->pos + varoff, vs->s, vs->len);
228				varoff += vs->len;
229				s->len += vs->len;
230				while ((vs = TAILQ_NEXT(vs, tq))) {
231					ns = emalloc(sizeof(struct cfstring));
232					ns->s = estrdup(vs->s);
233					ns->len = vs->len;
234					STAILQ_INIT(&ns->vars);
235					TAILQ_INSERT_AFTER(&p->val, s, ns, tq);
236					s = ns;
237				}
238			free_var:
239				free(v->name);
240				STAILQ_REMOVE_HEAD(&s->vars, tq);
241				free(v);
242			}
243		    }
244		}
245
246		/* Free the jail's original parameter list and any variables. */
247		while ((p = TAILQ_FIRST(&opp)))
248			free_param(&opp, p);
249		TAILQ_FOREACH_SAFE(p, &j->params, tq, tp)
250			if (p->flags & PF_VAR)
251				free_param(&j->params, p);
252	}
253	while ((wj = TAILQ_FIRST(&wild))) {
254		free(wj->name);
255		while ((p = TAILQ_FIRST(&wj->params)))
256			free_param(&wj->params, p);
257		TAILQ_REMOVE(&wild, wj, tq);
258	}
259}
260
261/*
262 * Create a new jail record.
263 */
264struct cfjail *
265add_jail(void)
266{
267	struct cfjail *j;
268
269	j = emalloc(sizeof(struct cfjail));
270	memset(j, 0, sizeof(struct cfjail));
271	TAILQ_INIT(&j->params);
272	STAILQ_INIT(&j->dep[DEP_FROM]);
273	STAILQ_INIT(&j->dep[DEP_TO]);
274	j->queue = &cfjails;
275	TAILQ_INSERT_TAIL(&cfjails, j, tq);
276	return j;
277}
278
279/*
280 * Add a parameter to a jail.
281 */
282void
283add_param(struct cfjail *j, const struct cfparam *p, enum intparam ipnum,
284    const char *value)
285{
286	struct cfstrings nss;
287	struct cfparam *dp, *np;
288	struct cfstring *s, *ns;
289	struct cfvar *v, *nv;
290	struct ipspec *ips;
291	const char *name;
292	char *cs, *tname;
293	unsigned flags;
294
295	if (j == NULL) {
296		/* Create a single anonymous jail if one doesn't yet exist. */
297		j = TAILQ_LAST(&cfjails, cfjails);
298		if (j == NULL)
299			j = add_jail();
300	}
301	TAILQ_INIT(&nss);
302	if (p != NULL) {
303		name = p->name;
304		flags = p->flags;
305		/*
306		 * Make a copy of the parameter's string list,
307		 * which may be freed if it's overridden later.
308		 */
309		TAILQ_FOREACH(s, &p->val, tq) {
310			ns = emalloc(sizeof(struct cfstring));
311			ns->s = estrdup(s->s);
312			ns->len = s->len;
313			STAILQ_INIT(&ns->vars);
314			STAILQ_FOREACH(v, &s->vars, tq) {
315				nv = emalloc(sizeof(struct cfvar));
316				nv->name = strdup(v->name);
317				nv->pos = v->pos;
318				STAILQ_INSERT_TAIL(&ns->vars, nv, tq);
319			}
320			TAILQ_INSERT_TAIL(&nss, ns, tq);
321		}
322	} else {
323		flags = PF_APPEND;
324		if (ipnum != 0) {
325			name = intparams[ipnum].name;
326			flags |= intparams[ipnum].flags;
327		} else if ((cs = strchr(value, '='))) {
328			tname = alloca(cs - value + 1);
329			strlcpy(tname, value, cs - value + 1);
330			name = tname;
331			value = cs + 1;
332		} else {
333			name = value;
334			value = NULL;
335		}
336		if (value != NULL) {
337			ns = emalloc(sizeof(struct cfstring));
338			ns->s = estrdup(value);
339			ns->len = strlen(value);
340			STAILQ_INIT(&ns->vars);
341			TAILQ_INSERT_TAIL(&nss, ns, tq);
342		}
343	}
344
345	/* See if this parameter has already been added. */
346	if (ipnum != 0)
347		dp = j->intparams[ipnum];
348	else
349		TAILQ_FOREACH(dp, &j->params, tq)
350			if (!(dp->flags & PF_CONV) && equalopts(dp->name, name))
351				break;
352	if (dp != NULL) {
353		/* Found it - append or replace. */
354		if (strcmp(dp->name, name)) {
355			free(dp->name);
356			dp->name = estrdup(name);
357		}
358		if (!(flags & PF_APPEND) || TAILQ_EMPTY(&nss))
359			free_param_strings(dp);
360		TAILQ_CONCAT(&dp->val, &nss, tq);
361		dp->flags |= flags;
362	} else {
363		/* Not found - add it. */
364		np = emalloc(sizeof(struct cfparam));
365		np->name = estrdup(name);
366		TAILQ_INIT(&np->val);
367		TAILQ_CONCAT(&np->val, &nss, tq);
368		np->flags = flags;
369		np->gen = 0;
370		TAILQ_INSERT_TAIL(&j->params, np, tq);
371		if (ipnum != 0)
372			j->intparams[ipnum] = np;
373		else
374			for (ipnum = 1; ipnum < IP_NPARAM; ipnum++)
375				if (!(intparams[ipnum].flags & PF_CONV) &&
376				    equalopts(name, intparams[ipnum].name)) {
377					j->intparams[ipnum] = np;
378					np->flags |= intparams[ipnum].flags;
379					break;
380				}
381	}
382}
383
384/*
385 * Return if a boolean parameter exists and is true.
386 */
387int
388bool_param(const struct cfparam *p)
389{
390	const char *cs;
391
392	if (p == NULL)
393		return 0;
394	cs = strrchr(p->name, '.');
395	return !strncmp(cs ? cs + 1 : p->name, "no", 2) ^
396	    (TAILQ_EMPTY(&p->val) ||
397	     !strcasecmp(TAILQ_LAST(&p->val, cfstrings)->s, "true") ||
398	     (strtol(TAILQ_LAST(&p->val, cfstrings)->s, NULL, 10)));
399}
400
401/*
402 * Set an integer if a parameter if it exists.
403 */
404int
405int_param(const struct cfparam *p, int *ip)
406{
407	if (p == NULL || TAILQ_EMPTY(&p->val))
408		return 0;
409	*ip = strtol(TAILQ_LAST(&p->val, cfstrings)->s, NULL, 10);
410	return 1;
411}
412
413/*
414 * Return the string value of a scalar parameter if it exists.
415 */
416const char *
417string_param(const struct cfparam *p)
418{
419	return (p && !TAILQ_EMPTY(&p->val)
420	    ? TAILQ_LAST(&p->val, cfstrings)->s : NULL);
421}
422
423/*
424 * Check syntax and values of internal parameters.  Set some internal
425 * parameters based on the values of others.
426 */
427int
428check_intparams(struct cfjail *j)
429{
430	struct in_addr addr4;
431	struct addrinfo hints;
432	struct addrinfo *ai0, *ai;
433	struct cfparam *p;
434	struct cfstring *s, *ns;
435	FILE *f;
436	const char *hostname, *val;
437	char *cs, *ep, *ln;
438	size_t size, lnlen;
439	int error, gicode, ip4ok, defif, prefix;
440	int mib[4];
441	char avalue4[INET_ADDRSTRLEN];
442#ifdef INET6
443	struct in6_addr addr6;
444	int ip6ok, isip6;
445	char avalue6[INET6_ADDRSTRLEN];
446#endif
447
448	error = 0;
449	/* Check format of boolan and integer values. */
450	TAILQ_FOREACH(p, &j->params, tq) {
451		if (!TAILQ_EMPTY(&p->val) && (p->flags & (PF_BOOL | PF_INT))) {
452			val = TAILQ_LAST(&p->val, cfstrings)->s;
453			if (p->flags & PF_BOOL) {
454				if (strcasecmp(val, "false") &&
455				    strcasecmp(val, "true") &&
456				    ((void)strtol(val, &ep, 10), *ep)) {
457					jail_warnx(j,
458					    "%s: unknown boolean value \"%s\"",
459					    p->name, val);
460					error = -1;
461				}
462			} else {
463				(void)strtol(val, &ep, 10);
464				if (ep == val || *ep) {
465					jail_warnx(j,
466					    "%s: non-integer value \"%s\"",
467					    p->name, val);
468					error = -1;
469				}
470			}
471		}
472	}
473
474	/*
475	 * The ip_hostname parameter looks up the hostname, and adds parameters
476	 * for any IP addresses it finds.
477	 */
478	if (((j->flags & JF_OP_MASK) != JF_STOP ||
479	    j->intparams[IP_INTERFACE] != NULL) &&
480	    bool_param(j->intparams[IP_IP_HOSTNAME]) &&
481	    (hostname = string_param(j->intparams[KP_HOST_HOSTNAME]))) {
482		j->intparams[IP_IP_HOSTNAME] = NULL;
483		/*
484		 * Silently ignore unsupported address families from
485		 * DNS lookups.
486		 */
487		size = 4;
488		ip4ok = sysctlnametomib("security.jail.param.ip4", mib, &size)
489		    == 0;
490#ifdef INET6
491		size = 4;
492		ip6ok = sysctlnametomib("security.jail.param.ip6", mib, &size)
493		    == 0;
494#endif
495		if (ip4ok
496#ifdef INET6
497		    || ip6ok
498#endif
499			    ) {
500			/* Look up the hostname (or get the address) */
501			memset(&hints, 0, sizeof(hints));
502			hints.ai_socktype = SOCK_STREAM;
503			hints.ai_family =
504#ifdef INET6
505			    ip6ok ? (ip4ok ? PF_UNSPEC : PF_INET6) :
506#endif
507			    PF_INET;
508			gicode = getaddrinfo(hostname, NULL, &hints, &ai0);
509			if (gicode != 0) {
510				jail_warnx(j, "host.hostname %s: %s", hostname,
511				    gai_strerror(gicode));
512				error = -1;
513			} else {
514				/*
515				 * Convert the addresses to ASCII so jailparam
516				 * can convert them back.  Errors are not
517				 * expected here.
518				 */
519				for (ai = ai0; ai; ai = ai->ai_next)
520					switch (ai->ai_family) {
521					case AF_INET:
522						memcpy(&addr4,
523						    &((struct sockaddr_in *)
524						    (void *)ai->ai_addr)->
525						    sin_addr, sizeof(addr4));
526						if (inet_ntop(AF_INET,
527						    &addr4, avalue4,
528						    INET_ADDRSTRLEN) == NULL)
529							err(1, "inet_ntop");
530						add_param(j, NULL, KP_IP4_ADDR,
531						    avalue4);
532						break;
533#ifdef INET6
534					case AF_INET6:
535						memcpy(&addr6,
536						    &((struct sockaddr_in6 *)
537						    (void *)ai->ai_addr)->
538						    sin6_addr, sizeof(addr6));
539						if (inet_ntop(AF_INET6,
540						    &addr6, avalue6,
541						    INET6_ADDRSTRLEN) == NULL)
542							err(1, "inet_ntop");
543						add_param(j, NULL, KP_IP6_ADDR,
544						    avalue6);
545						break;
546#endif
547					}
548				freeaddrinfo(ai0);
549			}
550		}
551	}
552
553	/*
554	 * IP addresses may include an interface to set that address on,
555	 * and a netmask/suffix for that address.
556	 */
557	defif = string_param(j->intparams[IP_INTERFACE]) != NULL;
558#ifdef INET6
559	for (isip6 = 0; isip6 <= 1; isip6++)
560#else
561#define isip6 0
562	do
563#endif
564	{
565		if (j->intparams[KP_IP4_ADDR + isip6] == NULL)
566			continue;
567		TAILQ_FOREACH(s, &j->intparams[KP_IP4_ADDR + isip6]->val, tq) {
568			cs = strchr(s->s, '|');
569			if (cs || defif)
570				add_param(j, NULL, IP__IP4_IFADDR + isip6,
571				    s->s);
572			if (cs) {
573				strcpy(s->s, cs + 1);
574				s->len -= cs + 1 - s->s;
575			}
576			if ((cs = strchr(s->s, '/'))) {
577				prefix = strtol(cs + 1, &ep, 10);
578				if (
579#ifdef INET6
580				    !isip6 &&
581#endif
582				    *ep == '.'
583				    ? inet_pton(AF_INET, cs + 1, &addr4) != 1
584				    : *ep || prefix < 0 || prefix > (
585#ifdef INET6
586				      isip6 ? 128 :
587#endif
588				      32)) {
589					jail_warnx(j,
590#ifdef INET6
591					    isip6
592					    ? "ip6.addr: bad prefixlen \"%s\"" :
593#endif
594					    "ip4.addr: bad netmask \"%s\"",
595					    cs);
596					error = -1;
597				}
598				*cs = '\0';
599				s->len = cs - s->s + 1;
600			}
601		}
602	}
603#ifndef INET6
604	while (0);
605#endif
606
607	/*
608	 * Read mount.fstab file(s), and treat each line as its own mount
609	 * parameter.
610	 */
611	if (j->intparams[IP_MOUNT_FSTAB] != NULL) {
612		TAILQ_FOREACH(s, &j->intparams[IP_MOUNT_FSTAB]->val, tq) {
613			if (s->len == 0)
614				continue;
615			f = fopen(s->s, "r");
616			if (f == NULL) {
617				jail_warnx(j, "mount.fstab: %s: %s",
618				    s->s, strerror(errno));
619				error = -1;
620				continue;
621			}
622			while ((ln = fgetln(f, &lnlen))) {
623				if ((cs = memchr(ln, '#', lnlen - 1)))
624					lnlen = cs - ln + 1;
625				if (ln[lnlen - 1] == '\n' ||
626				    ln[lnlen - 1] == '#')
627					ln[lnlen - 1] = '\0';
628				else {
629					cs = alloca(lnlen + 1);
630					strlcpy(cs, ln, lnlen + 1);
631					ln = cs;
632				}
633				add_param(j, NULL, IP__MOUNT_FROM_FSTAB, ln);
634			}
635			fclose(f);
636		}
637	}
638	if (error)
639		failed(j);
640	return error;
641}
642
643/*
644 * Import parameters into libjail's binary jailparam format.
645 */
646int
647import_params(struct cfjail *j)
648{
649	struct cfparam *p;
650	struct cfstring *s, *ts;
651	struct jailparam *jp;
652	char *value, *cs;
653	size_t vallen;
654	int error;
655
656	error = 0;
657	j->njp = 0;
658	TAILQ_FOREACH(p, &j->params, tq)
659		if (!(p->flags & PF_INTERNAL))
660			j->njp++;
661	j->jp = jp = emalloc(j->njp * sizeof(struct jailparam));
662	TAILQ_FOREACH(p, &j->params, tq) {
663		if (p->flags & PF_INTERNAL)
664			continue;
665		if (jailparam_init(jp, p->name) < 0) {
666			error = -1;
667			jail_warnx(j, "%s", jail_errmsg);
668			continue;
669		}
670		if (TAILQ_EMPTY(&p->val))
671			value = NULL;
672		else if (!jp->jp_elemlen ||
673			 !TAILQ_NEXT(TAILQ_FIRST(&p->val), tq)) {
674			/*
675			 * Scalar parameters silently discard multiple (array)
676			 * values, keeping only the last value added.  This
677			 * lets values added from the command line append to
678			 * arrays wthout pre-checking the type.
679			 */
680			value = TAILQ_LAST(&p->val, cfstrings)->s;
681		} else {
682			/*
683			 * Convert arrays into comma-separated strings, which
684			 * jailparam_import will then convert back into arrays.
685			 */
686			vallen = 0;
687			TAILQ_FOREACH(s, &p->val, tq)
688				vallen += s->len + 1;
689			value = alloca(vallen);
690			cs = value;
691			TAILQ_FOREACH_SAFE(s, &p->val, tq, ts) {
692				strcpy(cs, s->s);
693				if (ts != NULL) {
694					cs += s->len + 1;
695					cs[-1] = ',';
696				}
697			}
698		}
699		if (jailparam_import(jp, value) < 0) {
700			error = -1;
701			jail_warnx(j, "%s", jail_errmsg);
702		}
703		jp++;
704	}
705	if (error) {
706		jailparam_free(j->jp, j->njp);
707		free(j->jp);
708		j->jp = NULL;
709		failed(j);
710	}
711	return error;
712}
713
714/*
715 * Check if options are equal (with or without the "no" prefix).
716 */
717int
718equalopts(const char *opt1, const char *opt2)
719{
720	char *p;
721
722	/* "opt" vs. "opt" or "noopt" vs. "noopt" */
723	if (strcmp(opt1, opt2) == 0)
724		return (1);
725	/* "noopt" vs. "opt" */
726	if (strncmp(opt1, "no", 2) == 0 && strcmp(opt1 + 2, opt2) == 0)
727		return (1);
728	/* "opt" vs. "noopt" */
729	if (strncmp(opt2, "no", 2) == 0 && strcmp(opt1, opt2 + 2) == 0)
730		return (1);
731	while ((p = strchr(opt1, '.')) != NULL &&
732	    !strncmp(opt1, opt2, ++p - opt1)) {
733		opt2 += p - opt1;
734		opt1 = p;
735		/* "foo.noopt" vs. "foo.opt" */
736		if (strncmp(opt1, "no", 2) == 0 && strcmp(opt1 + 2, opt2) == 0)
737			return (1);
738		/* "foo.opt" vs. "foo.noopt" */
739		if (strncmp(opt2, "no", 2) == 0 && strcmp(opt1, opt2 + 2) == 0)
740			return (1);
741	}
742	return (0);
743}
744
745/*
746 * See if a jail name matches a wildcard.
747 */
748int
749wild_jail_match(const char *jname, const char *wname)
750{
751	const char *jc, *jd, *wc, *wd;
752
753	/*
754	 * A non-final "*" component in the wild name matches a single jail
755	 * component, and a final "*" matches one or more jail components.
756	 */
757	for (jc = jname, wc = wname;
758	     (jd = strchr(jc, '.')) && (wd = strchr(wc, '.'));
759	     jc = jd + 1, wc = wd + 1)
760		if (strncmp(jc, wc, jd - jc + 1) && strncmp(wc, "*.", 2))
761			return 0;
762	return (!strcmp(jc, wc) || !strcmp(wc, "*"));
763}
764
765/*
766 * Return if a jail name is a wildcard.
767 */
768int
769wild_jail_name(const char *wname)
770{
771	const char *wc;
772
773	for (wc = strchr(wname, '*'); wc; wc = strchr(wc + 1, '*'))
774		if ((wc == wname || wc[-1] == '.') &&
775		    (wc[1] == '\0' || wc[1] == '.'))
776			return 1;
777	return 0;
778}
779
780/*
781 * Free a parameter record and all its strings and variables.
782 */
783static void
784free_param(struct cfparams *pp, struct cfparam *p)
785{
786	free(p->name);
787	free_param_strings(p);
788	TAILQ_REMOVE(pp, p, tq);
789	free(p);
790}
791
792static void
793free_param_strings(struct cfparam *p)
794{
795	struct cfstring *s;
796	struct cfvar *v;
797
798	while ((s = TAILQ_FIRST(&p->val))) {
799		free(s->s);
800		while ((v = STAILQ_FIRST(&s->vars))) {
801			free(v->name);
802			STAILQ_REMOVE_HEAD(&s->vars, tq);
803			free(v);
804		}
805		TAILQ_REMOVE(&p->val, s, tq);
806		free(s);
807	}
808}
809