![[BACK]](/icons/back.gif){kind=icon}
Return to toke.l CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / sudo|
Return to toke.l CVS log | Up to [local] / src / usr.bin / sudo |
1.1 millert 1: %{
2: /*
1.4 millert 3: * Copyright (c) 1996, 1998-2005, 2007-2009
1.1 millert 4: * Todd C. Miller <Todd.Miller@courtesan.com>
5: *
6: * Permission to use, copy, modify, and distribute this software for any
7: * purpose with or without fee is hereby granted, provided that the above
8: * copyright notice and this permission notice appear in all copies.
9: *
10: * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11: * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12: * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13: * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14: * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15: * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16: * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17: * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
18: * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
19: * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
20: *
21: * Sponsored in part by the Defense Advanced Research Projects
22: * Agency (DARPA) and Air Force Research Laboratory, Air Force
23: * Materiel Command, USAF, under agreement number F39502-99-1-0512.
24: */
25:
26: #include <config.h>
27:
28: #include <sys/types.h>
29: #include <sys/param.h>
1.4 millert 30: #include <sys/stat.h>
1.1 millert 31: #include <stdio.h>
32: #ifdef STDC_HEADERS
33: # include <stdlib.h>
34: # include <stddef.h>
35: #else
36: # ifdef HAVE_STDLIB_H
37: # include <stdlib.h>
38: # endif
39: #endif /* STDC_HEADERS */
40: #ifdef HAVE_STRING_H
41: # include <string.h>
42: #else
43: # ifdef HAVE_STRINGS_H
44: # include <strings.h>
45: # endif
46: #endif /* HAVE_STRING_H */
47: #ifdef HAVE_UNISTD_H
48: # include <unistd.h>
49: #endif /* HAVE_UNISTD_H */
50: #if defined(HAVE_MALLOC_H) && !defined(STDC_HEADERS)
51: # include <malloc.h>
52: #endif /* HAVE_MALLOC_H && !STDC_HEADERS */
1.4 millert 53: #ifdef HAVE_DIRENT_H
54: # include <dirent.h>
55: # define NAMLEN(dirent) strlen((dirent)->d_name)
56: #else
57: # define dirent direct
58: # define NAMLEN(dirent) (dirent)->d_namlen
59: # ifdef HAVE_SYS_NDIR_H
60: # include <sys/ndir.h>
61: # endif
62: # ifdef HAVE_SYS_DIR_H
63: # include <sys/dir.h>
64: # endif
65: # ifdef HAVE_NDIR_H
66: # include <ndir.h>
67: # endif
68: #endif
1.1 millert 69: #include <ctype.h>
70: #include "sudo.h"
71: #include "parse.h"
72: #include <gram.h>
73:
74: extern YYSTYPE yylval;
1.6 millert 75: extern int parse_error;
1.1 millert 76: int sudolineno = 1;
77: char *sudoers;
78: static int sawspace = 0;
79: static int arg_len = 0;
80: static int arg_size = 0;
81:
82: static int append __P((char *, int));
83: static int _fill __P((char *, int, int));
84: static int fill_cmnd __P((char *, int));
85: static int fill_args __P((char *, int, int));
1.4 millert 86: static int _push_include __P((char *, int));
87: static int pop_include __P((void));
1.1 millert 88: static int ipv6_valid __P((const char *s));
89: static char *parse_include __P((char *));
90: extern void yyerror __P((const char *));
91:
92: #define fill(a, b) _fill(a, b, 0)
93:
1.4 millert 94: #define push_include(_p) (_push_include((_p), FALSE))
95: #define push_includedir(_p) (_push_include((_p), TRUE))
1.1 millert 96:
97: /* realloc() to size + COMMANDARGINC to make room for command args */
98: #define COMMANDARGINC 64
99:
100: #ifdef TRACELEXER
101: #define LEXTRACE(msg) fputs(msg, stderr)
102: #else
103: #define LEXTRACE(msg)
104: #endif
105: %}
106:
107: HEX16 [0-9A-Fa-f]{1,4}
108: OCTET (1?[0-9]{1,2})|(2[0-4][0-9])|(25[0-5])
109: IPV4ADDR {OCTET}(\.{OCTET}){3}
110: IPV6ADDR ({HEX16}?:){2,7}{HEX16}?|({HEX16}?:){2,6}:{IPV4ADDR}
111:
112: HOSTNAME [[:alnum:]_-]+
113: WORD ([^#>!=:,\(\) \t\n\\]|\\[^\n])+
114: ID #-?[0-9]+
115: PATH \/(\\[\,:= \t#]|[^\,:=\\ \t\n#])+
116: ENVAR ([^#!=, \t\n\\\"]|\\[^\n])([^#=, \t\n\\\"]|\\[^\n])*
117: DEFVAR [a-z_]+
118:
119: %option nounput
120: %option noyywrap
121:
122: %s GOTDEFS
123: %x GOTCMND
124: %x STARTDEFS
125: %x INDEFS
126: %x INSTR
127:
128: %%
129: <GOTDEFS>[[:blank:]]+ BEGIN STARTDEFS;
130:
131: <STARTDEFS>{DEFVAR} {
132: BEGIN INDEFS;
133: LEXTRACE("DEFVAR ");
134: if (!fill(yytext, yyleng))
135: yyterminate();
136: return(DEFVAR);
137: }
138:
139: <INDEFS>{
140: , {
141: BEGIN STARTDEFS;
142: LEXTRACE(", ");
143: return(',');
144: } /* return ',' */
145:
146: = {
147: LEXTRACE("= ");
148: return('=');
149: } /* return '=' */
150:
151: \+= {
152: LEXTRACE("+= ");
153: return('+');
154: } /* return '+' */
155:
156: -= {
157: LEXTRACE("-= ");
158: return('-');
159: } /* return '-' */
160:
161: \" {
162: LEXTRACE("BEGINSTR ");
163: yylval.string = NULL;
164: BEGIN INSTR;
165: }
166:
167: {ENVAR} {
168: LEXTRACE("WORD(2) ");
169: if (!fill(yytext, yyleng))
170: yyterminate();
171: return(WORD);
172: }
173: }
174:
175: <INSTR>{
176: \\[[:blank:]]*\n[[:blank:]]* {
177: /* Line continuation char followed by newline. */
178: ++sudolineno;
179: LEXTRACE("\n");
180: }
181:
182: \" {
183: LEXTRACE("ENDSTR ");
184: BEGIN INDEFS;
185: return(WORD);
186: }
187:
188: \\ {
189: LEXTRACE("BACKSLASH ");
190: if (!append(yytext, yyleng))
191: yyterminate();
192: }
193:
194: ([^\"\n\\]|\\\")+ {
195: LEXTRACE("STRBODY ");
196: if (!append(yytext, yyleng))
197: yyterminate();
198: }
199: }
200:
201: <GOTCMND>{
202: \\[\*\?\[\]\!] {
203: /* quoted fnmatch glob char, pass verbatim */
204: LEXTRACE("QUOTEDCHAR ");
205: if (!fill_args(yytext, 2, sawspace))
206: yyterminate();
207: sawspace = FALSE;
208: }
209:
210: \\[:\\,= \t#] {
211: /* quoted sudoers special char, strip backslash */
212: LEXTRACE("QUOTEDCHAR ");
213: if (!fill_args(yytext + 1, 1, sawspace))
214: yyterminate();
215: sawspace = FALSE;
216: }
217:
218: [#:\,=\n] {
219: BEGIN INITIAL;
220: yyless(0);
221: return(COMMAND);
222: } /* end of command line args */
223:
224: [^\\:, \t\n]+ {
225: LEXTRACE("ARG ");
226: if (!fill_args(yytext, yyleng, sawspace))
227: yyterminate();
228: sawspace = FALSE;
229: } /* a command line arg */
230: }
231:
232: <INITIAL>^#include[[:blank:]]+\/.*\n {
233: char *path;
234:
235: if ((path = parse_include(yytext)) == NULL)
236: yyterminate();
237:
238: LEXTRACE("INCLUDE\n");
239:
240: /* Push current buffer and switch to include file */
241: if (!push_include(path))
242: yyterminate();
243: }
244:
1.4 millert 245: <INITIAL>^#includedir[[:blank:]]+\/.*\n {
246: char *path;
247:
248: if ((path = parse_include(yytext)) == NULL)
249: yyterminate();
250:
251: LEXTRACE("INCLUDEDIR\n");
252:
1.6 millert 253: /*
254: * Push current buffer and switch to include file.
255: * We simply ignore empty directories.
256: */
257: if (!push_includedir(path) && parse_error)
1.4 millert 258: yyterminate();
259: }
260:
1.1 millert 261: <INITIAL>^[[:blank:]]*Defaults([:@>\!]{WORD})? {
262: int n;
263: for (n = 0; isblank((unsigned char)yytext[n]); n++)
264: continue;
265: n += 8;
266: BEGIN GOTDEFS;
267: switch (yytext[n++]) {
268: case ':':
269: yyless(n);
270: LEXTRACE("DEFAULTS_USER ");
271: return(DEFAULTS_USER);
272: case '>':
273: yyless(n);
274: LEXTRACE("DEFAULTS_RUNAS ");
275: return(DEFAULTS_RUNAS);
276: case '@':
277: yyless(n);
278: LEXTRACE("DEFAULTS_HOST ");
279: return(DEFAULTS_HOST);
280: case '!':
281: yyless(n);
282: LEXTRACE("DEFAULTS_CMND ");
283: return(DEFAULTS_CMND);
284: default:
285: LEXTRACE("DEFAULTS ");
286: return(DEFAULTS);
287: }
288: }
289:
290: <INITIAL>^[[:blank:]]*(Host|Cmnd|User|Runas)_Alias {
291: int n;
292: for (n = 0; isblank((unsigned char)yytext[n]); n++)
293: continue;
294: switch (yytext[n]) {
295: case 'H':
296: LEXTRACE("HOSTALIAS ");
297: return(HOSTALIAS);
298: case 'C':
299: LEXTRACE("CMNDALIAS ");
300: return(CMNDALIAS);
301: case 'U':
302: LEXTRACE("USERALIAS ");
303: return(USERALIAS);
304: case 'R':
305: LEXTRACE("RUNASALIAS ");
306: return(RUNASALIAS);
307: }
308: }
309:
310: NOPASSWD[[:blank:]]*: {
311: /* cmnd does not require passwd for this user */
312: LEXTRACE("NOPASSWD ");
313: return(NOPASSWD);
314: }
315:
316: PASSWD[[:blank:]]*: {
317: /* cmnd requires passwd for this user */
318: LEXTRACE("PASSWD ");
319: return(PASSWD);
320: }
321:
322: NOEXEC[[:blank:]]*: {
323: LEXTRACE("NOEXEC ");
324: return(NOEXEC);
325: }
326:
327: EXEC[[:blank:]]*: {
328: LEXTRACE("EXEC ");
329: return(EXEC);
330: }
331:
332: SETENV[[:blank:]]*: {
333: LEXTRACE("SETENV ");
334: return(SETENV);
335: }
336:
337: NOSETENV[[:blank:]]*: {
338: LEXTRACE("NOSETENV ");
339: return(NOSETENV);
340: }
341:
342: \+{WORD} {
343: /* netgroup */
344: if (!fill(yytext, yyleng))
345: yyterminate();
346: LEXTRACE("NETGROUP ");
347: return(NETGROUP);
348: }
349:
1.4 millert 350: \%:?{WORD} {
1.1 millert 351: /* UN*X group */
352: if (!fill(yytext, yyleng))
353: yyterminate();
354: LEXTRACE("USERGROUP ");
355: return(USERGROUP);
356: }
357:
358: {IPV4ADDR}(\/{IPV4ADDR})? {
359: if (!fill(yytext, yyleng))
360: yyterminate();
361: LEXTRACE("NTWKADDR ");
362: return(NTWKADDR);
363: }
364:
1.9 espie 365: {IPV4ADDR}\/([12]?[0-9]|3[0-2]) {
1.1 millert 366: if (!fill(yytext, yyleng))
367: yyterminate();
368: LEXTRACE("NTWKADDR ");
369: return(NTWKADDR);
370: }
371:
372: {IPV6ADDR}(\/{IPV6ADDR})? {
373: if (!ipv6_valid(yytext)) {
374: LEXTRACE("ERROR ");
375: return(ERROR);
376: }
377: if (!fill(yytext, yyleng))
378: yyterminate();
379: LEXTRACE("NTWKADDR ");
380: return(NTWKADDR);
381: }
382:
383: {IPV6ADDR}\/([0-9]|[1-9][0-9]|1[01][0-9]|12[0-8]) {
384: if (!ipv6_valid(yytext)) {
385: LEXTRACE("ERROR ");
386: return(ERROR);
387: }
388: if (!fill(yytext, yyleng))
389: yyterminate();
390: LEXTRACE("NTWKADDR ");
391: return(NTWKADDR);
392: }
393:
1.10 ! millert 394: ALL {
! 395: LEXTRACE("ALL ");
! 396: return(ALL);
! 397:
! 398: }
! 399:
! 400: <INITIAL>ROLE {
! 401: #ifdef HAVE_SELINUX
! 402: LEXTRACE("ROLE ");
! 403: return(ROLE);
! 404: #else
! 405: goto got_alias;
! 406: #endif
! 407: }
! 408:
! 409: <INITIAL>TYPE {
! 410: #ifdef HAVE_SELINUX
! 411: LEXTRACE("TYPE ");
! 412: return(TYPE);
! 413: #else
! 414: goto got_alias;
! 415: #endif
! 416: }
! 417:
1.1 millert 418: [[:upper:]][[:upper:][:digit:]_]* {
1.10 ! millert 419: got_alias:
1.1 millert 420: if (!fill(yytext, yyleng))
421: yyterminate();
422: LEXTRACE("ALIAS ");
423: return(ALIAS);
424: }
425:
426: <GOTDEFS>({PATH}|sudoedit) {
427: /* no command args allowed for Defaults!/path */
428: if (!fill_cmnd(yytext, yyleng))
429: yyterminate();
430: LEXTRACE("COMMAND ");
431: return(COMMAND);
432: }
433:
434: sudoedit {
435: BEGIN GOTCMND;
436: LEXTRACE("COMMAND ");
437: if (!fill_cmnd(yytext, yyleng))
438: yyterminate();
439: } /* sudo -e */
440:
441: {PATH} {
442: /* directories can't have args... */
443: if (yytext[yyleng - 1] == '/') {
444: LEXTRACE("COMMAND ");
445: if (!fill_cmnd(yytext, yyleng))
446: yyterminate();
447: return(COMMAND);
448: } else {
449: BEGIN GOTCMND;
450: LEXTRACE("COMMAND ");
451: if (!fill_cmnd(yytext, yyleng))
452: yyterminate();
453: }
454: } /* a pathname */
455:
1.4 millert 456: <INITIAL,GOTDEFS>\"[^"\n]+\" {
457: /* a quoted user/group name */
458: if (!fill(yytext + 1, yyleng - 2))
459: yyterminate();
460: switch (yytext[1]) {
461: case '%':
462: LEXTRACE("USERGROUP ");
463: return(USERGROUP);
464: case '+':
465: LEXTRACE("NETGROUP ");
466: return(NETGROUP);
467: default:
468: LEXTRACE("WORD(4) ");
469: return(WORD);
470: }
471: }
472:
1.1 millert 473: <INITIAL,GOTDEFS>({ID}|{WORD}) {
474: /* a word */
475: if (!fill(yytext, yyleng))
476: yyterminate();
1.4 millert 477: LEXTRACE("WORD(5) ");
1.1 millert 478: return(WORD);
479: }
480:
481: \( {
482: LEXTRACE("( ");
483: return ('(');
484: }
485:
486: \) {
487: LEXTRACE(") ");
488: return(')');
489: }
490:
491: , {
492: LEXTRACE(", ");
493: return(',');
494: } /* return ',' */
495:
496: = {
497: LEXTRACE("= ");
498: return('=');
499: } /* return '=' */
500:
501: : {
502: LEXTRACE(": ");
503: return(':');
504: } /* return ':' */
505:
506: <*>!+ {
507: if (yyleng % 2 == 1)
508: return('!'); /* return '!' */
509: }
510:
511: <*>\n {
512: BEGIN INITIAL;
513: ++sudolineno;
514: LEXTRACE("\n");
515: return(COMMENT);
516: } /* return newline */
517:
518: <*>[[:blank:]]+ { /* throw away space/tabs */
519: sawspace = TRUE; /* but remember for fill_args */
520: }
521:
522: <*>\\[[:blank:]]*\n {
523: sawspace = TRUE; /* remember for fill_args */
524: ++sudolineno;
525: LEXTRACE("\n\t");
526: } /* throw away EOL after \ */
527:
1.3 millert 528: <INITIAL,STARTDEFS,INDEFS>#(-[^\n0-9].*|[^\n0-9-].*)?\n {
1.1 millert 529: BEGIN INITIAL;
530: ++sudolineno;
531: LEXTRACE("\n");
532: return(COMMENT);
1.3 millert 533: } /* comment, not uid/gid */
1.1 millert 534:
535: <*>. {
536: LEXTRACE("ERROR ");
537: return(ERROR);
538: } /* parse error */
539:
540: <*><<EOF>> {
541: if (YY_START != INITIAL) {
542: BEGIN INITIAL;
543: LEXTRACE("ERROR ");
544: return(ERROR);
545: }
546: if (!pop_include())
547: yyterminate();
548: }
549:
550: %%
1.4 millert 551: static unsigned char
552: hexchar(s)
553: const char *s;
554: {
555: int i;
556: int result = 0;
557:
558: s += 2; /* skip \\x */
559: for (i = 0; i < 2; i++) {
560: switch (*s) {
561: case 'A':
562: case 'a':
563: result += 10;
564: break;
565: case 'B':
566: case 'b':
567: result += 11;
568: break;
569: case 'C':
570: case 'c':
571: result += 12;
572: break;
573: case 'D':
574: case 'd':
575: result += 13;
576: break;
577: case 'E':
578: case 'e':
579: result += 14;
580: break;
581: case 'F':
582: case 'f':
583: result += 15;
584: break;
585: default:
586: result += *s - '0';
587: break;
588: }
589: if (i == 0) {
590: result *= 16;
591: s++;
592: }
593: }
594: return((unsigned char)result);
595: }
596:
1.1 millert 597: static int
598: _fill(src, len, olen)
599: char *src;
600: int len, olen;
601: {
602: char *dst;
603:
604: dst = olen ? realloc(yylval.string, olen + len + 1) : malloc(len + 1);
605: if (dst == NULL) {
606: yyerror("unable to allocate memory");
607: return(FALSE);
608: }
609: yylval.string = dst;
610:
611: /* Copy the string and collapse any escaped characters. */
612: dst += olen;
1.4 millert 613: while (len--) {
614: if (*src == '\\' && len) {
615: if (src[1] == 'x' && len >= 3 &&
616: isxdigit((unsigned char) src[2]) &&
617: isxdigit((unsigned char) src[3])) {
618: *dst++ = hexchar(src);
619: src += 4;
620: len -= 3;
621: } else {
622: src++;
623: len--;
624: *dst++ = *src++;
625: }
626: } else {
627: *dst++ = *src++;
628: }
1.1 millert 629: }
1.4 millert 630: *dst = '\0';
1.1 millert 631: return(TRUE);
632: }
633:
634: static int
635: append(src, len)
636: char *src;
637: int len;
638: {
639: int olen = 0;
640:
641: if (yylval.string != NULL)
642: olen = strlen(yylval.string);
643:
644: return(_fill(src, len, olen));
645: }
646:
647: #define SPECIAL(c) \
648: ((c) == ',' || (c) == ':' || (c) == '=' || (c) == ' ' || (c) == '\t' || (c) == '#')
649:
650: static int
651: fill_cmnd(src, len)
652: char *src;
653: int len;
654: {
655: char *dst;
656: int i;
657:
658: arg_len = arg_size = 0;
659:
660: dst = yylval.command.cmnd = (char *) malloc(len + 1);
661: if (yylval.command.cmnd == NULL) {
662: yyerror("unable to allocate memory");
663: return(FALSE);
664: }
665:
666: /* Copy the string and collapse any escaped sudo-specific characters. */
667: for (i = 0; i < len; i++) {
668: if (src[i] == '\\' && i != len - 1 && SPECIAL(src[i + 1]))
669: *dst++ = src[++i];
670: else
671: *dst++ = src[i];
672: }
673: *dst = '\0';
674:
675: yylval.command.args = NULL;
676: return(TRUE);
677: }
678:
679: static int
680: fill_args(s, len, addspace)
681: char *s;
682: int len;
683: int addspace;
684: {
685: int new_len;
686: char *p;
687:
688: if (yylval.command.args == NULL) {
689: addspace = 0;
690: new_len = len;
691: } else
692: new_len = arg_len + len + addspace;
693:
694: if (new_len >= arg_size) {
695: /* Allocate more space than we need for subsequent args */
696: while (new_len >= (arg_size += COMMANDARGINC))
697: ;
698:
699: p = yylval.command.args ?
700: (char *) realloc(yylval.command.args, arg_size) :
701: (char *) malloc(arg_size);
702: if (p == NULL) {
703: efree(yylval.command.args);
704: yyerror("unable to allocate memory");
705: return(FALSE);
706: } else
707: yylval.command.args = p;
708: }
709:
710: /* Efficiently append the arg (with a leading space if needed). */
711: p = yylval.command.args + arg_len;
712: if (addspace)
713: *p++ = ' ';
714: if (strlcpy(p, s, arg_size - (p - yylval.command.args)) != len) {
715: yyerror("fill_args: buffer overflow"); /* paranoia */
716: return(FALSE);
717: }
718: arg_len = new_len;
719: return(TRUE);
720: }
721:
1.4 millert 722: struct path_list {
723: char *path;
724: struct path_list *next;
725: };
726:
727: struct include_stack {
1.1 millert 728: YY_BUFFER_STATE bs;
729: char *path;
1.4 millert 730: struct path_list *more; /* more files in case of includedir */
1.1 millert 731: int lineno;
1.4 millert 732: int keepopen;
1.1 millert 733: };
734:
1.4 millert 735: static int
736: pl_compare(v1, v2)
737: const void *v1;
738: const void *v2;
739: {
740: const struct path_list * const *p1 = v1;
741: const struct path_list * const *p2 = v2;
742:
743: return(strcmp((*p1)->path, (*p2)->path));
744: }
745:
746: static char *
747: switch_dir(stack, dirpath)
748: struct include_stack *stack;
749: char *dirpath;
750: {
751: DIR *dir;
752: int i, count = 0;
753: char *path = NULL;
754: struct dirent *dent;
755: struct stat sb;
756: struct path_list *pl, *first = NULL;
757: struct path_list **sorted = NULL;
758:
759: if (!(dir = opendir(dirpath))) {
760: yyerror(dirpath);
1.6 millert 761: return(NULL);
1.4 millert 762: }
763: while ((dent = readdir(dir))) {
764: /* Ignore files that end in '~' or have a '.' in them. */
765: if (dent->d_name[0] == '\0' || dent->d_name[NAMLEN(dent) - 1] == '~'
766: || strchr(dent->d_name, '.') != NULL) {
767: continue;
768: }
769: if (asprintf(&path, "%s/%s", dirpath, dent->d_name) == -1) {
770: closedir(dir);
771: goto bad;
772: }
773: if (stat(path, &sb) != 0 || !S_ISREG(sb.st_mode)) {
774: efree(path);
775: continue;
776: }
777: pl = malloc(sizeof(*pl));
778: if (pl == NULL)
779: goto bad;
780: pl->path = path;
781: pl->next = first;
782: first = pl;
783: count++;
784: }
785: closedir(dir);
786:
787: if (count == 0)
788: goto done;
789:
790: /* Sort the list as an array. */
791: sorted = malloc(sizeof(*sorted) * count);
792: if (sorted == NULL)
793: goto bad;
794: pl = first;
795: for (i = 0; i < count; i++) {
796: sorted[i] = pl;
797: pl = pl->next;
798: }
799: qsort(sorted, count, sizeof(*sorted), pl_compare);
800:
801: /* Apply sorting to the list. */
802: first = sorted[0];
803: sorted[count - 1]->next = NULL;
804: for (i = 1; i < count; i++)
805: sorted[i - 1]->next = sorted[i];
806: efree(sorted);
807:
808: /* Pull out the first element for parsing, leave the rest for later. */
809: if (count) {
810: path = first->path;
811: pl = first->next;
812: efree(first);
813: stack->more = pl;
814: } else {
815: path = NULL;
816: }
817: done:
818: efree(dirpath);
819: return(path);
820: bad:
821: while (first != NULL) {
822: pl = first;
823: first = pl->next;
824: free(pl->path);
825: free(pl);
826: }
827: efree(sorted);
828: efree(dirpath);
829: efree(path);
830: return(NULL);
831: }
832:
1.1 millert 833: #define MAX_SUDOERS_DEPTH 128
834: #define SUDOERS_STACK_INCREMENT 16
835:
1.4 millert 836: static size_t istacksize, idepth;
837: static struct include_stack *istack;
838: static int keepopen;
839:
840: void
841: init_lexer()
842: {
843: struct path_list *pl;
844:
845: while (idepth) {
846: idepth--;
847: while ((pl = istack[idepth].more) != NULL) {
848: istack[idepth].more = pl->next;
849: efree(pl->path);
850: efree(pl);
851: }
852: efree(istack[idepth].path);
1.7 millert 853: if (idepth && !istack[idepth].keepopen)
1.4 millert 854: fclose(istack[idepth].bs->yy_input_file);
855: yy_delete_buffer(istack[idepth].bs);
856: }
857: efree(istack);
858: istack = NULL;
859: istacksize = idepth = 0;
860: keepopen = FALSE;
861: }
862:
1.1 millert 863: static int
1.4 millert 864: _push_include(path, isdir)
1.1 millert 865: char *path;
1.4 millert 866: int isdir;
1.1 millert 867: {
868: FILE *fp;
869:
1.4 millert 870: /* push current state onto stack */
871: if (idepth >= istacksize) {
872: if (idepth > MAX_SUDOERS_DEPTH) {
873: yyerror("too many levels of includes");
874: return(FALSE);
875: }
876: istacksize += SUDOERS_STACK_INCREMENT;
877: istack = (struct include_stack *) realloc(istack,
1.7 millert 878: sizeof(*istack) * istacksize);
1.4 millert 879: if (istack == NULL) {
880: yyerror("unable to allocate memory");
881: return(FALSE);
882: }
883: }
884: if (isdir) {
885: if (!(path = switch_dir(&istack[idepth], path))) {
1.6 millert 886: /* switch_dir() called yyerror() for us */
1.4 millert 887: return(FALSE);
888: }
889: if ((fp = open_sudoers(path, FALSE, &keepopen)) == NULL) {
890: yyerror(path);
1.6 millert 891: return(FALSE); /* XXX - just to go next one */
1.1 millert 892: }
1.4 millert 893: } else {
894: if ((fp = open_sudoers(path, TRUE, &keepopen)) == NULL) {
1.1 millert 895: yyerror(path);
896: return(FALSE);
897: }
1.4 millert 898: istack[idepth].more = NULL;
899: }
900: /* Push the old (current) file and open the new one. */
901: istack[idepth].path = sudoers; /* push old path */
902: istack[idepth].bs = YY_CURRENT_BUFFER;
903: istack[idepth].lineno = sudolineno;
904: istack[idepth].keepopen = keepopen;
905: idepth++;
906: sudolineno = 1;
907: sudoers = path;
908: yy_switch_to_buffer(yy_create_buffer(fp, YY_BUF_SIZE));
909:
910: return(TRUE);
911: }
912:
913: static int
914: pop_include()
915: {
916: struct path_list *pl;
917: FILE *fp;
918:
919: if (idepth == 0)
920: return(FALSE);
921:
922: if (!keepopen)
923: fclose(YY_CURRENT_BUFFER->yy_input_file);
924: yy_delete_buffer(YY_CURRENT_BUFFER);
925: keepopen = FALSE;
926: if ((pl = istack[idepth - 1].more) != NULL) {
927: /* Move to next file in the dir. */
928: istack[idepth - 1].more = pl->next;
929: if ((fp = open_sudoers(pl->path, FALSE, &keepopen)) == NULL) {
930: yyerror(pl->path);
1.6 millert 931: return(FALSE); /* XXX - just to go next one */
1.4 millert 932: }
933: efree(sudoers);
934: sudoers = pl->path;
1.1 millert 935: sudolineno = 1;
936: yy_switch_to_buffer(yy_create_buffer(fp, YY_BUF_SIZE));
1.4 millert 937: efree(pl);
1.1 millert 938: } else {
1.4 millert 939: idepth--;
940: yy_switch_to_buffer(istack[idepth].bs);
1.1 millert 941: efree(sudoers);
1.4 millert 942: sudoers = istack[idepth].path;
943: sudolineno = istack[idepth].lineno;
1.1 millert 944: }
945: return(TRUE);
946: }
947:
948: static char *
949: parse_include(base)
950: char *base;
951: {
952: char *cp, *ep, *path;
1.3 millert 953: int len = 0, subst = 0;
954: size_t shost_len = 0;
1.1 millert 955:
956: /* Pull out path from #include line. */
957: cp = base + sizeof("#include");
1.4 millert 958: if (*cp == 'i')
959: cp += 3; /* includedir */
1.1 millert 960: while (isblank((unsigned char) *cp))
961: cp++;
962: ep = cp;
1.3 millert 963: while (*ep != '\0' && !isspace((unsigned char) *ep)) {
964: if (ep[0] == '%' && ep[1] == 'h') {
965: shost_len = strlen(user_shost);
966: len += shost_len - 2;
967: subst = 1;
968: }
1.1 millert 969: ep++;
1.3 millert 970: }
1.1 millert 971:
972: /* Make a copy of path and return it. */
1.3 millert 973: len += (int)(ep - cp);
1.1 millert 974: if ((path = malloc(len + 1)) == NULL)
975: yyerror("unable to allocate memory");
1.3 millert 976: if (subst) {
977: /* substitute for %h */
978: char *pp = path;
979: while (cp < ep) {
980: if (cp[0] == '%' && cp[1] == 'h') {
981: memcpy(pp, user_shost, shost_len);
982: pp += shost_len;
983: cp += 2;
1.5 millert 984: continue;
1.3 millert 985: }
986: *pp++ = *cp++;
987: }
988: *pp = '\0';
989: } else {
990: memcpy(path, cp, len);
991: path[len] = '\0';
992: }
1.1 millert 993:
994: /* Push any excess characters (e.g. comment, newline) back to the lexer */
995: if (*ep != '\0')
996: yyless((int)(ep - base));
997:
998: return(path);
999: }
1000:
1001: /*
1002: * Check to make sure an IPv6 address does not contain multiple instances
1003: * of the string "::". Assumes strlen(s) >= 1.
1004: * Returns TRUE if address is valid else FALSE.
1005: */
1006: static int
1007: ipv6_valid(s)
1008: const char *s;
1009: {
1010: int nmatch = 0;
1011:
1012: for (; *s != '\0'; s++) {
1013: if (s[0] == ':' && s[1] == ':') {
1014: if (++nmatch > 1)
1015: break;
1016: }
1017: if (s[0] == '/')
1018: nmatch = 0; /* reset if we hit netmask */
1019: }
1020:
1021: return (nmatch <= 1);
1022: }