tsol/tnchkdb/tnchkdb.c

	tnchkdb.c revision 96b5b3ca87222b74a6d5ea4acab6642410bac158
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 *  Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 *  Use is subject to license terms.
 */

/*
 * tnchkdb.c - Trusted network database checking utility
 */
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <locale.h>
#include <malloc.h>
#include <string.h>
#include <libtsnet.h>
#include <netinet/in.h>
#include <nss_dbdefs.h>

static void usage(void);
static void check_tnrhtp(const char *);
static void check_tnrhdb(const char *);
static void check_tnzonecfg(const char *);

static boolean_t tnrhtp_bad;
static int exitval;

struct tsol_name_list {
    struct tsol_name_list *next;
    int linenum;
    char name[TNTNAMSIZ];
};

struct tsol_addr_list {
    struct tsol_addr_list *next;
    int linenum;
    int prefix_len;
    in6_addr_t addr;
};

static struct tsol_name_list *tp_list_head;
static struct tsol_addr_list *rh_list_head;
static struct tsol_name_list *zc_list_head;

typedef struct mlp_info_list_s {
    struct mlp_info_list_s *next;
    int linenum;
    tsol_mlp_t mlp;
    char name[TNTNAMSIZ];
} mlp_info_list_t;

static mlp_info_list_t *global_mlps;

static void
add_name(struct tsol_name_list **head, const char *name, int linenum)
{
    int err;
    struct tsol_name_list *entry;

    entry = malloc(sizeof (struct tsol_name_list));
    if (entry == NULL) {
        err = errno;

        (void) fprintf(stderr,
            gettext("tnchkdb: allocating name list: %s\n"),
            strerror(err));
        exit(1);
    }
    (void) strlcpy(entry->name, name, sizeof (entry->name));
    entry->next = *head;
    entry->linenum = linenum;
    *head = entry;
}

static struct tsol_name_list *
find_name(struct tsol_name_list *head, const char *name)
{
    struct tsol_name_list *entry;

    for (entry = head; entry != NULL; entry = entry->next)
        if (strcmp(entry->name, name) == 0)
            break;
    return (entry);
}

static void
add_addr(struct tsol_addr_list **head, int prefix_len, in6_addr_t addr,
    int linenum)
{
    int err;
    struct tsol_addr_list *entry;

    entry = malloc(sizeof (struct tsol_addr_list));
    if (entry == NULL) {
        err = errno;

        (void) fprintf(stderr,
            gettext("tnchkdb: allocating addr list: %s\n"),
            strerror(err));
        exit(2);
    }
    entry->prefix_len = prefix_len;
    entry->addr = addr;
    entry->next = *head;
    entry->linenum = linenum;
    *head = entry;
}

static struct tsol_addr_list *
find_addr(struct tsol_addr_list *head, int prefix_len, in6_addr_t addr)
{
    struct tsol_addr_list *entry;

    for (entry = head; entry != NULL; entry = entry->next)
        if (entry->prefix_len == prefix_len &&
            IN6_ARE_ADDR_EQUAL(&entry->addr, &addr))
            break;
    return (entry);
}

static void
add_template(const char *name, int linenum)
{
    add_name(&tp_list_head, name, linenum);
}

static struct tsol_name_list *
find_template(const char *name)
{
    return (find_name(tp_list_head, name));
}

static void
add_host(int prefix_len, in6_addr_t addr, int linenum)
{
    add_addr(&rh_list_head, prefix_len, addr, linenum);
}

static struct tsol_addr_list *
find_host(int prefix_len, in6_addr_t addr)
{
    return (find_addr(rh_list_head, prefix_len, addr));
}

static void
add_zone(const char *name, int linenum)
{
    add_name(&zc_list_head, name, linenum);
}

static struct tsol_name_list *
find_zone(const char *name)
{
    return (find_name(zc_list_head, name));
}

int
main(int argc, char **argv)
{
    const char *tnrhdb_file = TNRHDB_PATH;
    const char *tnrhtp_file = TNRHTP_PATH;
    const char *tnzonecfg_file = TNZONECFG_PATH;
    int chr;

    /* set the locale for only the messages system (all else is clean) */
    (void) setlocale(LC_ALL, "");
#ifndef TEXT_DOMAIN     /* Should be defined by cc -D */
#define TEXT_DOMAIN "SYS_TEST"  /* Use this only if it wasn't */
#endif
    (void) textdomain(TEXT_DOMAIN);

    while ((chr = getopt(argc, argv, "h:t:z:")) != EOF) {
        switch (chr) {
        case 'h':
            tnrhdb_file = optarg;
            break;
        case 't':
            tnrhtp_file = optarg;
            break;
        case 'z':
            tnzonecfg_file = optarg;
            break;
        default:
            usage();
        }
    }

    check_tnrhtp(tnrhtp_file);
    check_tnrhdb(tnrhdb_file);
    check_tnzonecfg(tnzonecfg_file);

    return (exitval);
}

static void
usage(void)
{
    (void) fprintf(stderr, gettext(
        "usage: tnchkdb [-h path] [-t path] [-z path]\n"));
    exit(2);
}

static void
print_error(int linenum, int err, const char *errstr)
{
    (void) fprintf(stderr, gettext("line %1$d: %2$s: %.32s\n"), linenum,
        tsol_strerror(err, errno), errstr);
}

static void
cipso_representable(const bslabel_t *lab, int linenum, const char *template,
    const char *name)
{
    const _blevel_impl_t *blab = (const _blevel_impl_t *)lab;
    int lclass;
    uint32_t c8;

    if (!bltype(lab, SUN_SL_ID)) {
        (void) fprintf(stderr, gettext("tnchkdb: "
            "%1$s type %2$d is invalid for cipso labels: "
            "line %3$d entry %4$s\n"), name, GETBLTYPE(lab), linenum,
            template);
        exitval = 1;
    }
    lclass = LCLASS(blab);
    if (lclass & 0xff00) {
        (void) fprintf(stderr, gettext("tnchkdb: "
            "%1$s classification %2$x is invalid for cipso labels: "
            "line %3$d entry %4$s\n"), name, lclass, linenum,
            template);
        exitval = 1;
    }
    c8 = blab->compartments.c8;
#ifdef  _BIG_ENDIAN
    if (c8 & 0x0000ffff) {
#else
    if (c8 & 0xffff0000) {
#endif
        (void) fprintf(stderr, gettext("tnchkdb: %1$s "
            "compartments 241-256 must be zero for cipso labels: "
            "line %2$d entry %3$s\n"), name, linenum, template);
        exitval = 1;
    }
}

static void
check_tnrhtp(const char *file)
{
    tsol_tpent_t *tpentp;
    tsol_tpstr_t tpstr;
    int err;
    char *errstr;
    FILE *fp;
    blevel_t *l1, *l2;
    char line[2048], *cp;
    int linenum = 0;
    struct tsol_name_list *tnl;
    char buf[NSS_BUFLEN_TSOL_TP];
    uint32_t initial_doi = 0;
    boolean_t multiple_doi_found = B_FALSE;
    boolean_t doi_zero_found = B_FALSE;

    (void) printf(gettext("checking %s ...\n"), file);

    if ((fp = fopen(file, "r")) == NULL) {
        err = errno;
        (void) fprintf(stderr,
            gettext("tnchkdb: failed to open %1$s: %2$s\n"), file,
            strerror(err));
        exitval = 2;
        tnrhtp_bad = B_TRUE;
        return;
    }

    while (fgets(line, sizeof (line), fp) != NULL) {
        linenum++;
        if (line[0] == '#')
            continue;
        if ((cp = strchr(line, '\n')) != NULL)
            *cp = '\0';
        (void) str_to_tpstr(line, strlen(line), &tpstr, buf,
            sizeof (buf));
        tpentp = tpstr_to_ent(&tpstr, &err, &errstr);
        if (tpentp == NULL) {
            if (err == LTSNET_EMPTY)
                continue;
            print_error(linenum, err, errstr);
            exitval = 1;
            /*
             * Flag is set *only* for parsing errors, which result
             * in omitting the entry from tsol_name_list.
             */
            tnrhtp_bad = B_TRUE;
            continue;
        }

        switch (tpentp->host_type) {
        case UNLABELED:
            /*
             * check doi
             */
            if (initial_doi == 0)
                initial_doi = tpentp->tp_cipso_doi_unl;
            if (tpentp->tp_cipso_doi_unl != initial_doi)
                multiple_doi_found = B_TRUE;
            if (tpentp->tp_cipso_doi_unl == 0)
                doi_zero_found = B_TRUE;

            cipso_representable(&tpentp->tp_def_label, linenum,
                tpentp->name, TP_DEFLABEL);

            /*
             * check max_sl dominates min_sl
             */
            l1 = &tpentp->tp_gw_sl_range.lower_bound;
            l2 = &tpentp->tp_gw_sl_range.upper_bound;
            if (!bldominates(l2, l1)) {
                (void) fprintf(stderr,
                    gettext("tnchkdb: max_sl does not "
                    "dominate min_sl: line %1$d entry %2$s\n"),
                    linenum, tpentp->name);
                exitval = 1;
            }

            cipso_representable(l1, linenum, tpentp->name,
                TP_MINLABEL);
            l1 = (blevel_t *)&tpentp->tp_gw_sl_set[0];
            l2 = (blevel_t *)&tpentp->tp_gw_sl_set[NSLS_MAX];
            for (; l1 < l2; l1++) {
                if (bisinvalid(l1))
                    break;
                cipso_representable(l1, linenum, tpentp->name,
                    TP_SET);
            }
            break;

        case SUN_CIPSO:
            /*
             * check max_sl dominates min_sl
             */
            l1 = &tpentp->tp_sl_range_cipso.lower_bound;
            l2 = &tpentp->tp_sl_range_cipso.upper_bound;
            if (!bldominates(l2, l1)) {
                (void) fprintf(stderr,
                    gettext("tnchkdb: max_sl does not "
                    "dominate min_sl: line %1$d entry %2$s\n"),
                    linenum, tpentp->name);
                exitval = 1;
            }

            cipso_representable(l1, linenum, tpentp->name,
                TP_MINLABEL);

            l1 = (blevel_t *)&tpentp->tp_sl_set_cipso[0];
            l2 = (blevel_t *)&tpentp->tp_sl_set_cipso[NSLS_MAX];
            for (; l1 < l2; l1++) {
                if (bisinvalid(l1))
                    break;
                cipso_representable(l1, linenum, tpentp->name,
                    TP_SET);
            }

            /*
             * check doi
             */
            if (initial_doi == 0)
                initial_doi = tpentp->tp_cipso_doi_cipso;
            if (tpentp->tp_cipso_doi_cipso != initial_doi)
                multiple_doi_found = B_TRUE;
            if (tpentp->tp_cipso_doi_cipso == 0)
                doi_zero_found = B_TRUE;
            break;

        default:
            (void) fprintf(stderr, gettext("tnchkdb: unknown host "
                "type %1$d: line %2$d entry %3$s\n"),
                tpentp->host_type, linenum, tpentp->name);
            exitval = 1;
        } /* switch */

        /*
         * check if a duplicated entry
         */
        if ((tnl = find_template(tpentp->name)) != NULL) {
            (void) fprintf(stderr, gettext("tnchkdb: duplicated "
                "entry: %1$s at lines %2$d and %3$d\n"),
                tpentp->name, tnl->linenum, linenum);
            exitval = 1;
        } else {
            add_template(tpentp->name, linenum);
        }
        tsol_freetpent(tpentp);
    }
    if (multiple_doi_found == B_TRUE) {
        (void) fprintf(stderr,
            gettext("tnchkdb: Warning: tnrhtp entries do not all "
            "contain the same DOI value\n"));
    }
    if (doi_zero_found == B_TRUE) {
        (void) fprintf(stderr,
            gettext("tnchkdb: Warning: DOI=0 found in some "
            "tnrhtp entries\n"));
    }
    (void) fclose(fp);
}

static void
check_tnrhdb(const char *file)
{
    tsol_rhent_t *rhentp;
    tsol_rhstr_t rhstr;
    int err;
    char *errstr;
    FILE *fp;
    char line[2048], *cp;
    int linenum;
    in6_addr_t addr;
    struct tsol_addr_list *tal;
    char buf[NSS_BUFLEN_TSOL_RH];

    (void) printf(gettext("checking %s ...\n"), file);

    if ((fp = fopen(file, "r")) == NULL) {
        err = errno;
        (void) fprintf(stderr,
            gettext("tnchkdb: failed to open %s: %s\n"), file,
            strerror(err));
        exitval = 2;
        return;
    }

    /*
     * check that all templates used in tnrhdb file are defined by tnrhtp
     */
    linenum = 0;
    while (fgets(line, sizeof (line), fp) != NULL) {
        linenum++;
        if (line[0] == '#')
            continue;
        if ((cp = strchr(line, '\n')) != NULL)
            *cp = '\0';
        (void) str_to_rhstr(line, strlen(line), &rhstr, buf,
            sizeof (buf));
        rhentp = rhstr_to_ent(&rhstr, &err, &errstr);
        if (rhentp == NULL) {
            if (err == LTSNET_EMPTY)
                continue;
            print_error(linenum, err, errstr);
            exitval = 1;
            continue;
        }

        if (rhentp->rh_address.ta_family == AF_INET) {
            IN6_INADDR_TO_V4MAPPED(&rhentp->rh_address.ta_addr_v4,
                &addr);
        } else {
            addr = rhentp->rh_address.ta_addr_v6;
        }
        if ((tal = find_host(rhentp->rh_prefix, addr)) != NULL) {
            (void) fprintf(stderr,
                gettext("tnchkdb: duplicate entry: lines %1$d and "
                "%2$d\n"), tal->linenum, linenum);
            exitval = 1;
        } else {
            add_host(rhentp->rh_prefix, addr, linenum);
        }

        if (!tnrhtp_bad && find_template(rhentp->rh_template) == NULL) {
            (void) fprintf(stderr,
                gettext("tnchkdb: unknown template name: %1$s at "
                "line %2$d\n"), rhentp->rh_template, linenum);
            exitval = 1;
        }

        tsol_freerhent(rhentp);
    }
    (void) fclose(fp);
}

static void
check_mlp_conflicts(tsol_mlp_t *mlps, boolean_t isglobal, const char *name,
    int linenum)
{
    tsol_mlp_t *mlpptr, *mlp2;
    mlp_info_list_t *mil;

    for (mlpptr = mlps; !TSOL_MLP_END(mlpptr); mlpptr++) {
        if (mlpptr->mlp_port_upper == 0)
            mlpptr->mlp_port_upper = mlpptr->mlp_port;

        /* First, validate against self for duplicates */
        for (mlp2 = mlps; mlp2 < mlpptr; mlp2++) {
            if (mlp2->mlp_ipp == mlpptr->mlp_ipp &&
                !(mlp2->mlp_port_upper < mlpptr->mlp_port ||
                mlp2->mlp_port > mlpptr->mlp_port_upper))
                break;
        }

        if (mlp2 < mlpptr) {
            (void) fprintf(stderr, gettext("tnchkdb: self-overlap "
                "of %1$s MLP protocol %2$d port %3$d-%4$d with "
                "%5$d-%6$d: zone %7$s line %8$d\n"),
                gettext(isglobal ? "global" : "zone-specific"),
                mlpptr->mlp_ipp, mlpptr->mlp_port,
                mlpptr->mlp_port_upper, mlp2->mlp_port,
                mlp2->mlp_port_upper, name, linenum);
            exitval = 1;
        }

        if (isglobal) {
            /* Next, validate against list for duplicates */
            for (mil = global_mlps; mil != NULL; mil = mil->next) {
                if (strcmp(mil->name, name) == 0)
                    continue;
                if (mil->mlp.mlp_ipp == mlpptr->mlp_ipp &&
                    !(mil->mlp.mlp_port_upper <
                    mlpptr->mlp_port ||
                    mil->mlp.mlp_port >
                    mlpptr->mlp_port_upper))
                    break;
            }

            if (mil != NULL) {
                (void) fprintf(stderr, gettext("tnchkdb: "
                    "overlap of global MLP protocol %1$d port "
                    "%2$d-%3$d with zone %4$s %5$d-%6$d: zone "
                    "%7$s lines %8$d and %9$d\n"),
                    mlpptr->mlp_ipp, mlpptr->mlp_port,
                    mlpptr->mlp_port_upper, mil->name,
                    mil->mlp.mlp_port, mil->mlp.mlp_port_upper,
                    name, mil->linenum, linenum);
                exitval = 1;
            }

            /* Now throw into list */
            if ((mil = malloc(sizeof (*mil))) == NULL) {
                (void) fprintf(stderr, gettext("tnchkdb: "
                    "malloc error: %s\n"), strerror(errno));
                exit(2);
            }
            (void) strlcpy(mil->name, name, sizeof (mil->name));
            mil->linenum = linenum;
            mil->mlp = *mlpptr;
            mil->next = global_mlps;
            global_mlps = mil;
        }
    }
}

static void
check_tnzonecfg(const char *file)
{
    tsol_zcent_t *zc;
    int err;
    char *errstr;
    FILE *fp;
    char line[2048], *cp;
    int linenum;
    boolean_t saw_global;
    struct tsol_name_list *tnl;

    (void) printf(gettext("checking %s ...\n"), file);

    if ((fp = fopen(file, "r")) == NULL) {
        err = errno;
        (void) fprintf(stderr,
            gettext("tnchkdb: failed to open %s: %s\n"), file,
            strerror(err));
        exitval = 2;
        return;
    }

    saw_global = B_FALSE;
    linenum = 0;
    while (fgets(line, sizeof (line), fp) != NULL) {
        if ((cp = strchr(line, '\n')) != NULL)
            *cp = '\0';

        linenum++;
        if ((zc = tsol_sgetzcent(line, &err, &errstr)) == NULL) {
            if (err == LTSNET_EMPTY)
                continue;
            print_error(linenum, err, errstr);
            exitval = 1;
            continue;
        }

        cipso_representable(&zc->zc_label, linenum, zc->zc_name,
            "label");

        if (strcmp(zc->zc_name, "global") == 0)
            saw_global = B_TRUE;

        if ((tnl = find_zone(zc->zc_name)) != NULL) {
            (void) fprintf(stderr,
                gettext("tnchkdb: duplicate zones: %1$s at lines "
                "%2$d and %3$d\n"), zc->zc_name, tnl->linenum,
                linenum);
            exitval = 1;
        } else {
            add_zone(zc->zc_name, linenum);
        }

        if (zc->zc_private_mlp != NULL)
            check_mlp_conflicts(zc->zc_private_mlp, B_FALSE,
                zc->zc_name, linenum);
        if (zc->zc_shared_mlp != NULL)
            check_mlp_conflicts(zc->zc_shared_mlp, B_TRUE,
                zc->zc_name, linenum);

        tsol_freezcent(zc);
    }
    (void) fclose(fp);

    if (!saw_global) {
        (void) fprintf(stderr, gettext("tnchkdb: missing required "
            "entry for global zone in %s\n"), file);
        exitval = 1;
    }
}