config.c revision 278484 
1/*-
2 * Copyright (c) 2011 James Gritton
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 *    notice, this list of conditions and the following disclaimer in the
12 *    documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24 * SUCH DAMAGE.
25 */
26
27#include <sys/cdefs.h>
28__FBSDID("$FreeBSD: stable/10/usr.sbin/jail/config.c 278484 2015-02-10 01:05:51Z jamie $");
29
30#include <sys/types.h>
31#include <sys/errno.h>
32#include <sys/socket.h>
33#include <sys/sysctl.h>
34
35#include <arpa/inet.h>
36#include <netinet/in.h>
37
38#include <err.h>
39#include <netdb.h>
40#include <stdio.h>
41#include <stdlib.h>
42#include <string.h>
43#include <unistd.h>
44
45#include "jailp.h"
46
47struct ipspec {
48	const char	*name;
49	unsigned	flags;
50};
51
52extern FILE *yyin;
53extern int yynerrs;
54
55extern int yyparse(void);
56
57struct cfjails cfjails = TAILQ_HEAD_INITIALIZER(cfjails);
58
59static void free_param(struct cfparams *pp, struct cfparam *p);
60static void free_param_strings(struct cfparam *p);
61
62static const struct ipspec intparams[] = {
63    [IP_ALLOW_DYING] =		{"allow.dying",		PF_INTERNAL | PF_BOOL},
64    [IP_COMMAND] =		{"command",		PF_INTERNAL},
65    [IP_DEPEND] =		{"depend",		PF_INTERNAL},
66    [IP_EXEC_CLEAN] =		{"exec.clean",		PF_INTERNAL | PF_BOOL},
67    [IP_EXEC_CONSOLELOG] =	{"exec.consolelog",	PF_INTERNAL},
68    [IP_EXEC_FIB] =		{"exec.fib",		PF_INTERNAL | PF_INT},
69    [IP_EXEC_JAIL_USER] =	{"exec.jail_user",	PF_INTERNAL},
70    [IP_EXEC_POSTSTART] =	{"exec.poststart",	PF_INTERNAL},
71    [IP_EXEC_POSTSTOP] =	{"exec.poststop",	PF_INTERNAL},
72    [IP_EXEC_PRESTART] =	{"exec.prestart",	PF_INTERNAL},
73    [IP_EXEC_PRESTOP] =		{"exec.prestop",	PF_INTERNAL},
74    [IP_EXEC_START] =		{"exec.start",		PF_INTERNAL},
75    [IP_EXEC_STOP] =		{"exec.stop",		PF_INTERNAL},
76    [IP_EXEC_SYSTEM_JAIL_USER]=	{"exec.system_jail_user",
77							PF_INTERNAL | PF_BOOL},
78    [IP_EXEC_SYSTEM_USER] =	{"exec.system_user",	PF_INTERNAL},
79    [IP_EXEC_TIMEOUT] =		{"exec.timeout",	PF_INTERNAL | PF_INT},
80#if defined(INET) || defined(INET6)
81    [IP_INTERFACE] =		{"interface",		PF_INTERNAL},
82    [IP_IP_HOSTNAME] =		{"ip_hostname",		PF_INTERNAL | PF_BOOL},
83#endif
84    [IP_MOUNT] =		{"mount",		PF_INTERNAL | PF_REV},
85    [IP_MOUNT_DEVFS] =		{"mount.devfs",		PF_INTERNAL | PF_BOOL},
86    [IP_MOUNT_FDESCFS] =	{"mount.fdescfs",	PF_INTERNAL | PF_BOOL},
87    [IP_MOUNT_PROCFS] =		{"mount.procfs",	PF_INTERNAL | PF_BOOL},
88    [IP_MOUNT_FSTAB] =		{"mount.fstab",		PF_INTERNAL},
89    [IP_STOP_TIMEOUT] =		{"stop.timeout",	PF_INTERNAL | PF_INT},
90    [IP_VNET_INTERFACE] =	{"vnet.interface",	PF_INTERNAL},
91#ifdef INET
92    [IP__IP4_IFADDR] =		{"ip4.addr",	PF_INTERNAL | PF_CONV | PF_REV},
93#endif
94#ifdef INET6
95    [IP__IP6_IFADDR] =		{"ip6.addr",	PF_INTERNAL | PF_CONV | PF_REV},
96#endif
97    [IP__MOUNT_FROM_FSTAB] =	{"mount.fstab",	PF_INTERNAL | PF_CONV | PF_REV},
98    [IP__OP] =			{NULL,			PF_CONV},
99    [KP_ALLOW_CHFLAGS] =	{"allow.chflags",	0},
100    [KP_ALLOW_MOUNT] =		{"allow.mount",		0},
101    [KP_ALLOW_RAW_SOCKETS] =	{"allow.raw_sockets",	0},
102    [KP_ALLOW_SET_HOSTNAME]=	{"allow.set_hostname",	0},
103    [KP_ALLOW_SOCKET_AF] =	{"allow.socket_af",	0},
104    [KP_ALLOW_SYSVIPC] =	{"allow.sysvipc",	0},
105    [KP_DEVFS_RULESET] =	{"devfs_ruleset",	0},
106    [KP_ENFORCE_STATFS] =	{"enforce_statfs",	0},
107    [KP_HOST_HOSTNAME] =	{"host.hostname",	0},
108#ifdef INET
109    [KP_IP4_ADDR] =		{"ip4.addr",		0},
110#endif
111#ifdef INET6
112    [KP_IP6_ADDR] =		{"ip6.addr",		0},
113#endif
114    [KP_JID] =			{"jid",			0},
115    [KP_NAME] =			{"name",		0},
116    [KP_PATH] =			{"path",		0},
117    [KP_PERSIST] =		{"persist",		0},
118    [KP_SECURELEVEL] =		{"securelevel",		0},
119    [KP_VNET] =			{"vnet",		0},
120};
121
122/*
123 * Parse the jail configuration file.
124 */
125void
126load_config(void)
127{
128	struct cfjails wild;
129	struct cfparams opp;
130	struct cfjail *j, *tj, *wj;
131	struct cfparam *p, *vp, *tp;
132	struct cfstring *s, *vs, *ns;
133	struct cfvar *v;
134	char *ep;
135	size_t varoff;
136	int did_self, jseq, pgen;
137
138	if (!strcmp(cfname, "-")) {
139		cfname = "STDIN";
140		yyin = stdin;
141	} else {
142		yyin = fopen(cfname, "r");
143		if (!yyin)
144			err(1, "%s", cfname);
145	}
146	if (yyparse() || yynerrs)
147		exit(1);
148
149	/* Separate the wildcard jails out from the actual jails. */
150	jseq = 0;
151	TAILQ_INIT(&wild);
152	TAILQ_FOREACH_SAFE(j, &cfjails, tq, tj) {
153		j->seq = ++jseq;
154		if (wild_jail_name(j->name))
155			requeue(j, &wild);
156	}
157
158	TAILQ_FOREACH(j, &cfjails, tq) {
159		/* Set aside the jail's parameters. */
160		TAILQ_INIT(&opp);
161		TAILQ_CONCAT(&opp, &j->params, tq);
162		/*
163		 * The jail name implies its "name" or "jid" parameter,
164		 * though they may also be explicitly set later on.
165		 */
166		add_param(j, NULL,
167		    strtol(j->name, &ep, 10) && !*ep ? KP_JID : KP_NAME,
168		    j->name);
169		/*
170		 * Collect parameters for the jail, global parameters/variables,
171		 * and any matching wildcard jails.
172		 */
173		did_self = 0;
174		TAILQ_FOREACH(wj, &wild, tq) {
175			if (j->seq < wj->seq && !did_self) {
176				TAILQ_FOREACH(p, &opp, tq)
177					add_param(j, p, 0, NULL);
178				did_self = 1;
179			}
180			if (wild_jail_match(j->name, wj->name))
181				TAILQ_FOREACH(p, &wj->params, tq)
182					add_param(j, p, 0, NULL);
183		}
184		if (!did_self)
185			TAILQ_FOREACH(p, &opp, tq)
186				add_param(j, p, 0, NULL);
187
188		/* Resolve any variable substitutions. */
189		pgen = 0;
190		TAILQ_FOREACH(p, &j->params, tq) {
191		    p->gen = ++pgen;
192		find_vars:
193		    TAILQ_FOREACH(s, &p->val, tq) {
194			varoff = 0;
195			while ((v = STAILQ_FIRST(&s->vars))) {
196				TAILQ_FOREACH(vp, &j->params, tq)
197					if (!strcmp(vp->name, v->name))
198						break;
199				if (!vp) {
200					jail_warnx(j,
201					    "%s: variable \"%s\" not found",
202					    p->name, v->name);
203				bad_var:
204					j->flags |= JF_FAILED;
205					TAILQ_FOREACH(vp, &j->params, tq)
206						if (vp->gen == pgen)
207							vp->flags |= PF_BAD;
208					goto free_var;
209				}
210				if (vp->flags & PF_BAD)
211					goto bad_var;
212				if (vp->gen == pgen) {
213					jail_warnx(j, "%s: variable loop",
214					    v->name);
215					goto bad_var;
216				}
217				TAILQ_FOREACH(vs, &vp->val, tq)
218					if (!STAILQ_EMPTY(&vs->vars)) {
219						vp->gen = pgen;
220						TAILQ_REMOVE(&j->params, vp,
221						    tq);
222						TAILQ_INSERT_BEFORE(p, vp, tq);
223						p = vp;
224						goto find_vars;
225					}
226				vs = TAILQ_FIRST(&vp->val);
227				if (TAILQ_NEXT(vs, tq) != NULL &&
228				    (s->s[0] != '\0' ||
229				     STAILQ_NEXT(v, tq))) {
230					jail_warnx(j, "%s: array cannot be "
231					    "substituted inline",
232					    p->name);
233					goto bad_var;
234				}
235				s->s = erealloc(s->s, s->len + vs->len + 1);
236				memmove(s->s + v->pos + varoff + vs->len,
237				    s->s + v->pos + varoff,
238				    s->len - (v->pos + varoff) + 1);
239				memcpy(s->s + v->pos + varoff, vs->s, vs->len);
240				varoff += vs->len;
241				s->len += vs->len;
242				while ((vs = TAILQ_NEXT(vs, tq))) {
243					ns = emalloc(sizeof(struct cfstring));
244					ns->s = estrdup(vs->s);
245					ns->len = vs->len;
246					STAILQ_INIT(&ns->vars);
247					TAILQ_INSERT_AFTER(&p->val, s, ns, tq);
248					s = ns;
249				}
250			free_var:
251				free(v->name);
252				STAILQ_REMOVE_HEAD(&s->vars, tq);
253				free(v);
254			}
255		    }
256		}
257
258		/* Free the jail's original parameter list and any variables. */
259		while ((p = TAILQ_FIRST(&opp)))
260			free_param(&opp, p);
261		TAILQ_FOREACH_SAFE(p, &j->params, tq, tp)
262			if (p->flags & PF_VAR)
263				free_param(&j->params, p);
264	}
265	while ((wj = TAILQ_FIRST(&wild))) {
266		free(wj->name);
267		while ((p = TAILQ_FIRST(&wj->params)))
268			free_param(&wj->params, p);
269		TAILQ_REMOVE(&wild, wj, tq);
270	}
271}
272
273/*
274 * Create a new jail record.
275 */
276struct cfjail *
277add_jail(void)
278{
279	struct cfjail *j;
280
281	j = emalloc(sizeof(struct cfjail));
282	memset(j, 0, sizeof(struct cfjail));
283	TAILQ_INIT(&j->params);
284	STAILQ_INIT(&j->dep[DEP_FROM]);
285	STAILQ_INIT(&j->dep[DEP_TO]);
286	j->queue = &cfjails;
287	TAILQ_INSERT_TAIL(&cfjails, j, tq);
288	return j;
289}
290
291/*
292 * Add a parameter to a jail.
293 */
294void
295add_param(struct cfjail *j, const struct cfparam *p, enum intparam ipnum,
296    const char *value)
297{
298	struct cfstrings nss;
299	struct cfparam *dp, *np;
300	struct cfstring *s, *ns;
301	struct cfvar *v, *nv;
302	const char *name;
303	char *cs, *tname;
304	unsigned flags;
305
306	if (j == NULL) {
307		/* Create a single anonymous jail if one doesn't yet exist. */
308		j = TAILQ_LAST(&cfjails, cfjails);
309		if (j == NULL)
310			j = add_jail();
311	}
312	TAILQ_INIT(&nss);
313	if (p != NULL) {
314		name = p->name;
315		flags = p->flags;
316		/*
317		 * Make a copy of the parameter's string list,
318		 * which may be freed if it's overridden later.
319		 */
320		TAILQ_FOREACH(s, &p->val, tq) {
321			ns = emalloc(sizeof(struct cfstring));
322			ns->s = estrdup(s->s);
323			ns->len = s->len;
324			STAILQ_INIT(&ns->vars);
325			STAILQ_FOREACH(v, &s->vars, tq) {
326				nv = emalloc(sizeof(struct cfvar));
327				nv->name = strdup(v->name);
328				nv->pos = v->pos;
329				STAILQ_INSERT_TAIL(&ns->vars, nv, tq);
330			}
331			TAILQ_INSERT_TAIL(&nss, ns, tq);
332		}
333	} else {
334		flags = PF_APPEND;
335		if (ipnum != IP__NULL) {
336			name = intparams[ipnum].name;
337			flags |= intparams[ipnum].flags;
338		} else if ((cs = strchr(value, '='))) {
339			tname = alloca(cs - value + 1);
340			strlcpy(tname, value, cs - value + 1);
341			name = tname;
342			value = cs + 1;
343		} else {
344			name = value;
345			value = NULL;
346		}
347		if (value != NULL) {
348			ns = emalloc(sizeof(struct cfstring));
349			ns->s = estrdup(value);
350			ns->len = strlen(value);
351			STAILQ_INIT(&ns->vars);
352			TAILQ_INSERT_TAIL(&nss, ns, tq);
353		}
354	}
355
356	/* See if this parameter has already been added. */
357	if (ipnum != IP__NULL)
358		dp = j->intparams[ipnum];
359	else
360		TAILQ_FOREACH(dp, &j->params, tq)
361			if (!(dp->flags & PF_CONV) && equalopts(dp->name, name))
362				break;
363	if (dp != NULL) {
364		/* Found it - append or replace. */
365		if (strcmp(dp->name, name)) {
366			free(dp->name);
367			dp->name = estrdup(name);
368		}
369		if (!(flags & PF_APPEND) || TAILQ_EMPTY(&nss))
370			free_param_strings(dp);
371		TAILQ_CONCAT(&dp->val, &nss, tq);
372		dp->flags |= flags;
373	} else {
374		/* Not found - add it. */
375		np = emalloc(sizeof(struct cfparam));
376		np->name = estrdup(name);
377		TAILQ_INIT(&np->val);
378		TAILQ_CONCAT(&np->val, &nss, tq);
379		np->flags = flags;
380		np->gen = 0;
381		TAILQ_INSERT_TAIL(&j->params, np, tq);
382		if (ipnum != IP__NULL)
383			j->intparams[ipnum] = np;
384		else
385			for (ipnum = IP__NULL + 1; ipnum < IP_NPARAM; ipnum++)
386				if (!(intparams[ipnum].flags & PF_CONV) &&
387				    equalopts(name, intparams[ipnum].name)) {
388					j->intparams[ipnum] = np;
389					np->flags |= intparams[ipnum].flags;
390					break;
391				}
392	}
393}
394
395/*
396 * Return if a boolean parameter exists and is true.
397 */
398int
399bool_param(const struct cfparam *p)
400{
401	const char *cs;
402
403	if (p == NULL)
404		return 0;
405	cs = strrchr(p->name, '.');
406	return !strncmp(cs ? cs + 1 : p->name, "no", 2) ^
407	    (TAILQ_EMPTY(&p->val) ||
408	     !strcasecmp(TAILQ_LAST(&p->val, cfstrings)->s, "true") ||
409	     (strtol(TAILQ_LAST(&p->val, cfstrings)->s, NULL, 10)));
410}
411
412/*
413 * Set an integer if a parameter if it exists.
414 */
415int
416int_param(const struct cfparam *p, int *ip)
417{
418	if (p == NULL || TAILQ_EMPTY(&p->val))
419		return 0;
420	*ip = strtol(TAILQ_LAST(&p->val, cfstrings)->s, NULL, 10);
421	return 1;
422}
423
424/*
425 * Return the string value of a scalar parameter if it exists.
426 */
427const char *
428string_param(const struct cfparam *p)
429{
430	return (p && !TAILQ_EMPTY(&p->val)
431	    ? TAILQ_LAST(&p->val, cfstrings)->s : NULL);
432}
433
434/*
435 * Check syntax and values of internal parameters.  Set some internal
436 * parameters based on the values of others.
437 */
438int
439check_intparams(struct cfjail *j)
440{
441	struct cfparam *p;
442	struct cfstring *s;
443	FILE *f;
444	const char *val;
445	char *cs, *ep, *ln;
446	size_t lnlen;
447	int error;
448#if defined(INET) || defined(INET6)
449	struct addrinfo hints;
450	struct addrinfo *ai0, *ai;
451	const char *hostname;
452	int gicode, defif, prefix;
453#endif
454#ifdef INET
455	struct in_addr addr4;
456	int ip4ok;
457	char avalue4[INET_ADDRSTRLEN];
458#endif
459#ifdef INET6
460	struct in6_addr addr6;
461	int ip6ok;
462	char avalue6[INET6_ADDRSTRLEN];
463#endif
464
465	error = 0;
466	/* Check format of boolan and integer values. */
467	TAILQ_FOREACH(p, &j->params, tq) {
468		if (!TAILQ_EMPTY(&p->val) && (p->flags & (PF_BOOL | PF_INT))) {
469			val = TAILQ_LAST(&p->val, cfstrings)->s;
470			if (p->flags & PF_BOOL) {
471				if (strcasecmp(val, "false") &&
472				    strcasecmp(val, "true") &&
473				    ((void)strtol(val, &ep, 10), *ep)) {
474					jail_warnx(j,
475					    "%s: unknown boolean value \"%s\"",
476					    p->name, val);
477					error = -1;
478				}
479			} else {
480				(void)strtol(val, &ep, 10);
481				if (ep == val || *ep) {
482					jail_warnx(j,
483					    "%s: non-integer value \"%s\"",
484					    p->name, val);
485					error = -1;
486				}
487			}
488		}
489	}
490
491#if defined(INET) || defined(INET6)
492	/*
493	 * The ip_hostname parameter looks up the hostname, and adds parameters
494	 * for any IP addresses it finds.
495	 */
496	if (((j->flags & JF_OP_MASK) != JF_STOP ||
497	    j->intparams[IP_INTERFACE] != NULL) &&
498	    bool_param(j->intparams[IP_IP_HOSTNAME]) &&
499	    (hostname = string_param(j->intparams[KP_HOST_HOSTNAME]))) {
500		j->intparams[IP_IP_HOSTNAME] = NULL;
501		/*
502		 * Silently ignore unsupported address families from
503		 * DNS lookups.
504		 */
505#ifdef INET
506		ip4ok = feature_present("inet");
507#endif
508#ifdef INET6
509		ip6ok = feature_present("inet6");
510#endif
511		if (
512#if defined(INET) && defined(INET6)
513		    ip4ok || ip6ok
514#elif defined(INET)
515		    ip4ok
516#elif defined(INET6)
517		    ip6ok
518#endif
519			 ) {
520			/* Look up the hostname (or get the address) */
521			memset(&hints, 0, sizeof(hints));
522			hints.ai_socktype = SOCK_STREAM;
523			hints.ai_family =
524#if defined(INET) && defined(INET6)
525			    ip4ok ? (ip6ok ? PF_UNSPEC : PF_INET) :  PF_INET6;
526#elif defined(INET)
527			    PF_INET;
528#elif defined(INET6)
529			    PF_INET6;
530#endif
531			gicode = getaddrinfo(hostname, NULL, &hints, &ai0);
532			if (gicode != 0) {
533				jail_warnx(j, "host.hostname %s: %s", hostname,
534				    gai_strerror(gicode));
535				error = -1;
536			} else {
537				/*
538				 * Convert the addresses to ASCII so jailparam
539				 * can convert them back.  Errors are not
540				 * expected here.
541				 */
542				for (ai = ai0; ai; ai = ai->ai_next)
543					switch (ai->ai_family) {
544#ifdef INET
545					case AF_INET:
546						memcpy(&addr4,
547						    &((struct sockaddr_in *)
548						    (void *)ai->ai_addr)->
549						    sin_addr, sizeof(addr4));
550						if (inet_ntop(AF_INET,
551						    &addr4, avalue4,
552						    INET_ADDRSTRLEN) == NULL)
553							err(1, "inet_ntop");
554						add_param(j, NULL, KP_IP4_ADDR,
555						    avalue4);
556						break;
557#endif
558#ifdef INET6
559					case AF_INET6:
560						memcpy(&addr6,
561						    &((struct sockaddr_in6 *)
562						    (void *)ai->ai_addr)->
563						    sin6_addr, sizeof(addr6));
564						if (inet_ntop(AF_INET6,
565						    &addr6, avalue6,
566						    INET6_ADDRSTRLEN) == NULL)
567							err(1, "inet_ntop");
568						add_param(j, NULL, KP_IP6_ADDR,
569						    avalue6);
570						break;
571#endif
572					}
573				freeaddrinfo(ai0);
574			}
575		}
576	}
577
578	/*
579	 * IP addresses may include an interface to set that address on,
580	 * a netmask/suffix for that address and options for ifconfig.
581	 * These are copied to an internal command parameter and then stripped
582	 * so they won't be passed on to jailparam_set.
583	 */
584	defif = string_param(j->intparams[IP_INTERFACE]) != NULL;
585#ifdef INET
586	if (j->intparams[KP_IP4_ADDR] != NULL) {
587		TAILQ_FOREACH(s, &j->intparams[KP_IP4_ADDR]->val, tq) {
588			cs = strchr(s->s, '|');
589			if (cs || defif)
590				add_param(j, NULL, IP__IP4_IFADDR, s->s);
591			if (cs) {
592				strcpy(s->s, cs + 1);
593				s->len -= cs + 1 - s->s;
594			}
595			if ((cs = strchr(s->s, '/'))) {
596				prefix = strtol(cs + 1, &ep, 10);
597				if (*ep == '.'
598				    ? inet_pton(AF_INET, cs + 1, &addr4) != 1
599				    : *ep || prefix < 0 || prefix > 32) {
600					jail_warnx(j,
601					    "ip4.addr: bad netmask \"%s\"", cs);
602					error = -1;
603				}
604				*cs = '\0';
605				s->len = cs - s->s;
606			}
607			if ((cs = strchr(s->s, ' ')) != NULL) {
608				*cs = '\0';
609				s->len = cs - s->s;
610			}
611		}
612	}
613#endif
614#ifdef INET6
615	if (j->intparams[KP_IP6_ADDR] != NULL) {
616		TAILQ_FOREACH(s, &j->intparams[KP_IP6_ADDR]->val, tq) {
617			cs = strchr(s->s, '|');
618			if (cs || defif)
619				add_param(j, NULL, IP__IP6_IFADDR, s->s);
620			if (cs) {
621				strcpy(s->s, cs + 1);
622				s->len -= cs + 1 - s->s;
623			}
624			if ((cs = strchr(s->s, '/'))) {
625				prefix = strtol(cs + 1, &ep, 10);
626				if (*ep || prefix < 0 || prefix > 128) {
627					jail_warnx(j,
628					    "ip6.addr: bad prefixlen \"%s\"",
629					    cs);
630					error = -1;
631				}
632				*cs = '\0';
633				s->len = cs - s->s;
634			}
635			if ((cs = strchr(s->s, ' ')) != NULL) {
636				*cs = '\0';
637				s->len = cs - s->s;
638			}
639		}
640	}
641#endif
642#endif
643
644	/*
645	 * Read mount.fstab file(s), and treat each line as its own mount
646	 * parameter.
647	 */
648	if (j->intparams[IP_MOUNT_FSTAB] != NULL) {
649		TAILQ_FOREACH(s, &j->intparams[IP_MOUNT_FSTAB]->val, tq) {
650			if (s->len == 0)
651				continue;
652			f = fopen(s->s, "r");
653			if (f == NULL) {
654				jail_warnx(j, "mount.fstab: %s: %s",
655				    s->s, strerror(errno));
656				error = -1;
657				continue;
658			}
659			while ((ln = fgetln(f, &lnlen))) {
660				if ((cs = memchr(ln, '#', lnlen - 1)))
661					lnlen = cs - ln + 1;
662				if (ln[lnlen - 1] == '\n' ||
663				    ln[lnlen - 1] == '#')
664					ln[lnlen - 1] = '\0';
665				else {
666					cs = alloca(lnlen + 1);
667					strlcpy(cs, ln, lnlen + 1);
668					ln = cs;
669				}
670				add_param(j, NULL, IP__MOUNT_FROM_FSTAB, ln);
671			}
672			fclose(f);
673		}
674	}
675	if (error)
676		failed(j);
677	return error;
678}
679
680/*
681 * Import parameters into libjail's binary jailparam format.
682 */
683int
684import_params(struct cfjail *j)
685{
686	struct cfparam *p;
687	struct cfstring *s, *ts;
688	struct jailparam *jp;
689	char *value, *cs;
690	size_t vallen;
691	int error;
692
693	error = 0;
694	j->njp = 0;
695	TAILQ_FOREACH(p, &j->params, tq)
696		if (!(p->flags & PF_INTERNAL))
697			j->njp++;
698	j->jp = jp = emalloc(j->njp * sizeof(struct jailparam));
699	TAILQ_FOREACH(p, &j->params, tq) {
700		if (p->flags & PF_INTERNAL)
701			continue;
702		if (jailparam_init(jp, p->name) < 0) {
703			error = -1;
704			jail_warnx(j, "%s", jail_errmsg);
705			jp++;
706			continue;
707		}
708		if (TAILQ_EMPTY(&p->val))
709			value = NULL;
710		else if (!jp->jp_elemlen ||
711			 !TAILQ_NEXT(TAILQ_FIRST(&p->val), tq)) {
712			/*
713			 * Scalar parameters silently discard multiple (array)
714			 * values, keeping only the last value added.  This
715			 * lets values added from the command line append to
716			 * arrays wthout pre-checking the type.
717			 */
718			value = TAILQ_LAST(&p->val, cfstrings)->s;
719		} else {
720			/*
721			 * Convert arrays into comma-separated strings, which
722			 * jailparam_import will then convert back into arrays.
723			 */
724			vallen = 0;
725			TAILQ_FOREACH(s, &p->val, tq)
726				vallen += s->len + 1;
727			value = alloca(vallen);
728			cs = value;
729			TAILQ_FOREACH_SAFE(s, &p->val, tq, ts) {
730				memcpy(cs, s->s, s->len);
731				cs += s->len + 1;
732				cs[-1] = ',';
733			}
734			value[vallen - 1] = '\0';
735		}
736		if (jailparam_import(jp, value) < 0) {
737			error = -1;
738			jail_warnx(j, "%s", jail_errmsg);
739		}
740		jp++;
741	}
742	if (error) {
743		jailparam_free(j->jp, j->njp);
744		free(j->jp);
745		j->jp = NULL;
746		failed(j);
747	}
748	return error;
749}
750
751/*
752 * Check if options are equal (with or without the "no" prefix).
753 */
754int
755equalopts(const char *opt1, const char *opt2)
756{
757	char *p;
758
759	/* "opt" vs. "opt" or "noopt" vs. "noopt" */
760	if (strcmp(opt1, opt2) == 0)
761		return (1);
762	/* "noopt" vs. "opt" */
763	if (strncmp(opt1, "no", 2) == 0 && strcmp(opt1 + 2, opt2) == 0)
764		return (1);
765	/* "opt" vs. "noopt" */
766	if (strncmp(opt2, "no", 2) == 0 && strcmp(opt1, opt2 + 2) == 0)
767		return (1);
768	while ((p = strchr(opt1, '.')) != NULL &&
769	    !strncmp(opt1, opt2, ++p - opt1)) {
770		opt2 += p - opt1;
771		opt1 = p;
772		/* "foo.noopt" vs. "foo.opt" */
773		if (strncmp(opt1, "no", 2) == 0 && strcmp(opt1 + 2, opt2) == 0)
774			return (1);
775		/* "foo.opt" vs. "foo.noopt" */
776		if (strncmp(opt2, "no", 2) == 0 && strcmp(opt1, opt2 + 2) == 0)
777			return (1);
778	}
779	return (0);
780}
781
782/*
783 * See if a jail name matches a wildcard.
784 */
785int
786wild_jail_match(const char *jname, const char *wname)
787{
788	const char *jc, *jd, *wc, *wd;
789
790	/*
791	 * A non-final "*" component in the wild name matches a single jail
792	 * component, and a final "*" matches one or more jail components.
793	 */
794	for (jc = jname, wc = wname;
795	     (jd = strchr(jc, '.')) && (wd = strchr(wc, '.'));
796	     jc = jd + 1, wc = wd + 1)
797		if (strncmp(jc, wc, jd - jc + 1) && strncmp(wc, "*.", 2))
798			return 0;
799	return (!strcmp(jc, wc) || !strcmp(wc, "*"));
800}
801
802/*
803 * Return if a jail name is a wildcard.
804 */
805int
806wild_jail_name(const char *wname)
807{
808	const char *wc;
809
810	for (wc = strchr(wname, '*'); wc; wc = strchr(wc + 1, '*'))
811		if ((wc == wname || wc[-1] == '.') &&
812		    (wc[1] == '\0' || wc[1] == '.'))
813			return 1;
814	return 0;
815}
816
817/*
818 * Free a parameter record and all its strings and variables.
819 */
820static void
821free_param(struct cfparams *pp, struct cfparam *p)
822{
823	free(p->name);
824	free_param_strings(p);
825	TAILQ_REMOVE(pp, p, tq);
826	free(p);
827}
828
829static void
830free_param_strings(struct cfparam *p)
831{
832	struct cfstring *s;
833	struct cfvar *v;
834
835	while ((s = TAILQ_FIRST(&p->val))) {
836		free(s->s);
837		while ((v = STAILQ_FIRST(&s->vars))) {
838			free(v->name);
839			STAILQ_REMOVE_HEAD(&s->vars, tq);
840			free(v);
841		}
842		TAILQ_REMOVE(&p->val, s, tq);
843		free(s);
844	}
845}
846