1/*-
2 * Copyright (c) 2006 Robert N. M. Watson
3 * All rights reserved.
4 *
5 * This software was developed by Robert Watson for the TrustedBSD Project.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 *    notice, this list of conditions and the following disclaimer in the
14 *    documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29/*
30 * Configuration file parser for auditfilterd.  The configuration file is a
31 * very simple format, similar to other BSM configuration files, consisting
32 * of configuration entries of one line each.  The configuration function is
33 * aware of previous runs, and will update the current configuration as
34 * needed.
35 *
36 * Modules are in one of two states: attached, or detached.  If attach fails,
37 * detach is not called because it was not attached.  If a module is attached
38 * and a call to its reinit method fails, we will detach it.
39 *
40 * Modules are passed a (void *) reference to their configuration state so
41 * that they may pass this into any common APIs we provide which may rely on
42 * that state.  Currently, the only such API is the cookie API, which allows
43 * per-instance state to be maintained by a module.  In the future, this will
44 * also be used to support per-instance preselection state.
45 */
46
47#include <sys/types.h>
48
49#include <config/config.h>
50#ifdef HAVE_FULL_QUEUE_H
51#include <sys/queue.h>
52#else
53#include <compat/queue.h>
54#endif
55
56#include <bsm/libbsm.h>
57#include <bsm/audit_filter.h>
58
59#include <dlfcn.h>
60#include <err.h>
61#include <errno.h>
62#include <limits.h>
63#include <stdio.h>
64#include <stdlib.h>
65#include <string.h>
66
67#include "auditfilterd.h"
68
69/*
70 * Free an individual auditfilter_module structure.  Will not shut down the
71 * module, just frees the memory.  Does so conditional on pointers being
72 * non-NULL so that it can be used on partially allocated structures.
73 */
74static void
75auditfilter_module_free(struct auditfilter_module *am)
76{
77
78	if (am->am_modulename != NULL)
79		free(am->am_modulename);
80	if (am->am_arg_buffer != NULL)
81		free(am->am_arg_buffer);
82	if (am->am_argv != NULL)
83		free(am->am_argv);
84}
85
86/*
87 * Free all memory associated with an auditfilter_module list.  Does not
88 * dlclose() or shut down the modules, just free the memory.  Use
89 * auditfilter_module_list_detach() for that, if required.
90 */
91static void
92auditfilter_module_list_free(struct auditfilter_module_list *list)
93{
94	struct auditfilter_module *am;
95
96	while (!(TAILQ_EMPTY(list))) {
97		am = TAILQ_FIRST(list);
98		TAILQ_REMOVE(list, am, am_list);
99		auditfilter_module_free(am);
100	}
101}
102
103/*
104 * Detach an attached module from an auditfilter_module structure.  Does not
105 * free the data structure itself.
106 */
107static void
108auditfilter_module_detach(struct auditfilter_module *am)
109{
110
111	if (am->am_detach != NULL)
112		am->am_detach(am);
113	am->am_cookie = NULL;
114	(void)dlclose(am->am_dlhandle);
115	am->am_dlhandle = NULL;
116}
117
118/*
119 * Walk an auditfilter_module list, detaching each module.  Intended to be
120 * combined with auditfilter_module_list_free().
121 */
122static void
123auditfilter_module_list_detach(struct auditfilter_module_list *list)
124{
125	struct auditfilter_module *am;
126
127	TAILQ_FOREACH(am, list, am_list)
128		auditfilter_module_detach(am);
129}
130
131/*
132 * Given a filled out auditfilter_module, use dlopen() and dlsym() to attach
133 * the module.  If we fail, leave fields in the state we found them.
134 *
135 * XXXRW: Need a better way to report errors.
136 */
137static int
138auditfilter_module_attach(struct auditfilter_module *am)
139{
140
141	am->am_dlhandle = dlopen(am->am_modulename, RTLD_NOW);
142	if (am->am_dlhandle == NULL) {
143		warnx("auditfilter_module_attach: %s: %s", am->am_modulename,
144		    dlerror());
145		return (-1);
146	}
147
148	/*
149	 * Not implementing these is not considered a failure condition,
150	 * although we might want to consider warning if obvious stuff is
151	 * not implemented, such as am_record.
152	 */
153	am->am_attach = dlsym(am->am_dlhandle, AUDIT_FILTER_ATTACH_STRING);
154	am->am_reinit = dlsym(am->am_dlhandle, AUDIT_FILTER_REINIT_STRING);
155	am->am_record = dlsym(am->am_dlhandle, AUDIT_FILTER_RECORD_STRING);
156	am->am_rawrecord = dlsym(am->am_dlhandle,
157	    AUDIT_FILTER_RAWRECORD_STRING);
158	am->am_detach = dlsym(am->am_dlhandle, AUDIT_FILTER_DETACH_STRING);
159
160	if (am->am_attach != NULL) {
161		if (am->am_attach(am, am->am_argc, am->am_argv)
162		    != AUDIT_FILTER_SUCCESS) {
163			warnx("auditfilter_module_attach: %s: failed",
164			    am->am_modulename);
165			dlclose(am->am_dlhandle);
166			am->am_dlhandle = NULL;
167			am->am_cookie = NULL;
168			am->am_attach = NULL;
169			am->am_reinit = NULL;
170			am->am_record = NULL;
171			am->am_rawrecord = NULL;
172			am->am_detach = NULL;
173			return (-1);
174		}
175	}
176
177	return (0);
178}
179
180/*
181 * When the arguments for a module are changed, we notify the module through
182 * a call to its reinit method, if any.  Return 0 on success, or -1 on
183 * failure.
184 */
185static int
186auditfilter_module_reinit(struct auditfilter_module *am)
187{
188
189	if (am->am_reinit == NULL)
190		return (0);
191
192	if (am->am_reinit(am, am->am_argc, am->am_argv) !=
193	    AUDIT_FILTER_SUCCESS) {
194		warnx("auditfilter_module_reinit: %s: failed",
195		    am->am_modulename);
196		return (-1);
197	}
198
199	return (0);
200}
201
202/*
203 * Given a configuration line, generate an auditfilter_module structure that
204 * describes it; caller will not pass comments in, so they are not looked
205 * for.  Do not attempt to instantiate it.  Will destroy the contents of
206 * 'buffer'.
207 *
208 * Configuration lines consist of two parts: the module name and arguments
209 * separated by a ':', and then a ','-delimited list of arguments.
210 *
211 * XXXRW: Need to decide where to send the warning output -- stderr for now.
212 */
213struct auditfilter_module *
214auditfilter_module_parse(const char *filename, int linenumber, char *buffer)
215{
216	char *arguments, *module, **ap;
217	struct auditfilter_module *am;
218
219	am = malloc(sizeof(*am));
220	if (am == NULL) {
221		warn("auditfilter_module_parse: %s:%d", filename, linenumber);
222		return (NULL);
223	}
224	bzero(am, sizeof(*am));
225
226	/*
227	 * First, break out the module and arguments strings.  We look for
228	 * one extra argument to make sure there are no more :'s in the line.
229	 * That way, we prevent modules from using argument strings that, in
230	 * the future, may cause problems for adding additional columns.
231	 */
232	arguments = buffer;
233	module = strsep(&arguments, ":");
234	if (module == NULL || arguments == NULL) {
235		warnx("auditfilter_module_parse: %s:%d: parse error",
236		    filename, linenumber);
237		return (NULL);
238	}
239
240	am->am_modulename = strdup(module);
241	if (am->am_modulename == NULL) {
242		warn("auditfilter_module_parse: %s:%d", filename, linenumber);
243		auditfilter_module_free(am);
244		return (NULL);
245	}
246
247	am->am_arg_buffer = strdup(buffer);
248	if (am->am_arg_buffer == NULL) {
249		warn("auditfilter_module_parse: %s:%d", filename, linenumber);
250		auditfilter_module_free(am);
251		return (NULL);
252	}
253
254	/*
255	 * Now, break out the arguments string into a series of arguments.
256	 * This is a bit more complicated, and requires cleanup if things go
257	 * wrong.
258	 */
259	am->am_argv = malloc(sizeof(char *) * AUDITFILTERD_CONF_MAXARGS);
260	if (am->am_argv == NULL) {
261		warn("auditfilter_module_parse: %s:%d", filename, linenumber);
262		auditfilter_module_free(am);
263		return (NULL);
264	}
265	bzero(am->am_argv, sizeof(char *) * AUDITFILTERD_CONF_MAXARGS);
266	am->am_argc = 0;
267	for (ap = am->am_argv; (*ap = strsep(&arguments, " \t")) != NULL;) {
268		if (**ap != '\0') {
269			am->am_argc++;
270			if (++ap >= &am->am_argv[AUDITFILTERD_CONF_MAXARGS])
271				break;
272		}
273	}
274	if (ap >= &am->am_argv[AUDITFILTERD_CONF_MAXARGS]) {
275		warnx("auditfilter_module_parse: %s:%d: too many arguments",
276		    filename, linenumber);
277		auditfilter_module_free(am);
278		return (NULL);
279	}
280
281	return (am);
282}
283
284/*
285 * Read a configuration file, and populate 'list' with the configuration
286 * lines.  Does not attempt to instantiate the configuration, just read it
287 * into a useful set of data structures.
288 */
289static int
290auditfilterd_conf_read(const char *filename, FILE *fp,
291    struct auditfilter_module_list *list)
292{
293	int error, linenumber, syntaxerror;
294	struct auditfilter_module *am;
295	char buffer[LINE_MAX];
296
297	syntaxerror = 0;
298	linenumber = 0;
299	while (!feof(fp) && !ferror(fp)) {
300		if (fgets(buffer, LINE_MAX, fp) == NULL)
301			break;
302		linenumber++;
303		if (buffer[0] == '#' || strlen(buffer) < 1)
304			continue;
305		buffer[strlen(buffer)-1] = '\0';
306		am = auditfilter_module_parse(filename, linenumber, buffer);
307		if (am == NULL) {
308			syntaxerror = 1;
309			break;
310		}
311		TAILQ_INSERT_HEAD(list, am, am_list);
312	}
313
314	/*
315	 * File I/O error.
316	 */
317	if (ferror(fp)) {
318		error = errno;
319		auditfilter_module_list_free(list);
320		errno = error;
321		return (-1);
322	}
323
324	/*
325	 * Syntax error.
326	 */
327	if (syntaxerror) {
328		auditfilter_module_list_free(list);
329		errno = EINVAL;
330		return (-1);
331	}
332	return (0);
333}
334
335/*
336 * Apply changes necessary to bring a new configuration into force.  The new
337 * configuration data is passed in, and the current configuration is updated
338 * to match it.  The contents of 'list' are freed or otherwise disposed of
339 * before return.
340 *
341 * The algorithms here are not very efficient, but this is an infrequent
342 * operation on very short lists.
343 */
344static void
345auditfilterd_conf_apply(struct auditfilter_module_list *list)
346{
347	struct auditfilter_module *am1, *am2, *am_tmp;
348	int argc_tmp, found;
349	char **argv_tmp;
350
351	/*
352	 * First, remove remove and detach any entries that appear in the
353	 * current configuration, but not the new configuration.
354	 */
355	TAILQ_FOREACH_SAFE(am1, &filter_list, am_list, am_tmp) {
356		found = 0;
357		TAILQ_FOREACH(am2, list, am_list) {
358			if (strcmp(am1->am_modulename, am2->am_modulename)
359			    == 0) {
360				found = 1;
361				break;
362			}
363		}
364		if (found)
365			continue;
366
367		/*
368		 * am1 appears in filter_list, but not the new list, detach
369		 * and free the module.
370		 */
371		warnx("detaching module %s", am1->am_modulename);
372		TAILQ_REMOVE(&filter_list, am1, am_list);
373		auditfilter_module_detach(am1);
374		auditfilter_module_free(am1);
375	}
376
377	/*
378	 * Next, update the configuration of any modules that appear in both
379	 * lists.  We do this by swapping the two argc and argv values and
380	 * freeing the new one, rather than detaching the old one and
381	 * attaching the new one.  That way module state is preserved.
382	 */
383	TAILQ_FOREACH(am1, &filter_list, am_list) {
384		found = 0;
385		TAILQ_FOREACH(am2, list, am_list) {
386			if (strcmp(am1->am_modulename, am2->am_modulename)
387			    == 0) {
388				found = 1;
389				break;
390			}
391		}
392		if (!found)
393			continue;
394
395		/*
396		 * Swap the arguments.
397		 */
398		argc_tmp = am1->am_argc;
399		argv_tmp = am1->am_argv;
400		am1->am_argc = am2->am_argc;
401		am1->am_argv = am2->am_argv;
402		am2->am_argc = argc_tmp;
403		am2->am_argv = argv_tmp;
404
405		/*
406		 * The reinit is a bit tricky: if reinit fails, we actually
407		 * remove the old entry and detach that, as we don't allow
408		 * running modules to be out of sync with the configuration
409		 * file.
410		 */
411		warnx("reiniting module %s", am1->am_modulename);
412		if (auditfilter_module_reinit(am1) != 0) {
413			warnx("reinit failed for module %s, detaching",
414			    am1->am_modulename);
415			TAILQ_REMOVE(&filter_list, am1, am_list);
416			auditfilter_module_detach(am1);
417			auditfilter_module_free(am1);
418		}
419
420		/*
421		 * Free the entry from the new list, which will discard the
422		 * old arguments.  No need to detach, as it was never
423		 * attached in the first place.
424		 */
425		TAILQ_REMOVE(list, am2, am_list);
426		auditfilter_module_free(am2);
427	}
428
429	/*
430	 * Finally, attach any new entries that don't appear in the old
431	 * configuration, and if they attach successfully, move them to the
432	 * real configuration list.
433	 */
434	TAILQ_FOREACH(am1, list, am_list) {
435		found = 0;
436		TAILQ_FOREACH(am2, &filter_list, am_list) {
437			if (strcmp(am1->am_modulename, am2->am_modulename)
438			    == 0) {
439				found = 1;
440				break;
441			}
442		}
443		if (found)
444			continue;
445		/*
446		 * Attach the entry.  If it succeeds, add to filter_list,
447		 * otherwise, free.  No need to detach if attach failed.
448		 */
449		warnx("attaching module %s", am1->am_modulename);
450		TAILQ_REMOVE(list, am1, am_list);
451		if (auditfilter_module_attach(am1) != 0) {
452			warnx("attaching module %s failed",
453			    am1->am_modulename);
454			auditfilter_module_free(am1);
455		} else
456			TAILQ_INSERT_HEAD(&filter_list, am1, am_list);
457	}
458
459	if (TAILQ_FIRST(list) != NULL)
460		warnx("auditfilterd_conf_apply: new list not empty\n");
461}
462
463/*
464 * Read the new configuration file into a local list.  If the configuration
465 * file is parsed OK, then apply the changes.
466 */
467int
468auditfilterd_conf(const char *filename, FILE *fp)
469{
470	struct auditfilter_module_list list;
471
472	TAILQ_INIT(&list);
473	if (auditfilterd_conf_read(filename, fp, &list) < 0)
474		return (-1);
475
476	auditfilterd_conf_apply(&list);
477
478	return (0);
479}
480
481/*
482 * Detach and free all active filter modules for daemon shutdown.
483 */
484void
485auditfilterd_conf_shutdown(void)
486{
487
488	auditfilter_module_list_detach(&filter_list);
489	auditfilter_module_list_free(&filter_list);
490}
491
492/*
493 * APIs to allow modules to query and set their per-instance cookie.
494 */
495void
496audit_filter_getcookie(void *instance, void **cookie)
497{
498	struct auditfilter_module *am;
499
500	am = (struct auditfilter_module *)instance;
501	*cookie = am->am_cookie;
502}
503
504void
505audit_filter_setcookie(void *instance, void *cookie)
506{
507	struct auditfilter_module *am;
508
509	am = (struct auditfilter_module *)instance;
510	am->am_cookie = cookie;
511}
512