d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd/*
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd SSSD
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
a1d62218cdb0efd0f02da1b54fd3eda91a681d98nd IPA Backend Module -- Access control
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
acc36ab93565d2880447d535da6ca6e5feac7a70nd Authors:
031b91a62d25106ae69d4693475c79618dd5e884fielding Sumit Bose <sbose@redhat.com>
031b91a62d25106ae69d4693475c79618dd5e884fielding Stephen Gallagher <sgallagh@redhat.com>
031b91a62d25106ae69d4693475c79618dd5e884fielding
031b91a62d25106ae69d4693475c79618dd5e884fielding Copyright (C) 2011 Red Hat
031b91a62d25106ae69d4693475c79618dd5e884fielding
031b91a62d25106ae69d4693475c79618dd5e884fielding This program is free software; you can redistribute it and/or modify
acc36ab93565d2880447d535da6ca6e5feac7a70nd it under the terms of the GNU General Public License as published by
acc36ab93565d2880447d535da6ca6e5feac7a70nd the Free Software Foundation; either version 3 of the License, or
acc36ab93565d2880447d535da6ca6e5feac7a70nd (at your option) any later version.
acc36ab93565d2880447d535da6ca6e5feac7a70nd
acc36ab93565d2880447d535da6ca6e5feac7a70nd This program is distributed in the hope that it will be useful,
acc36ab93565d2880447d535da6ca6e5feac7a70nd but WITHOUT ANY WARRANTY; without even the implied warranty of
acc36ab93565d2880447d535da6ca6e5feac7a70nd MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
acc36ab93565d2880447d535da6ca6e5feac7a70nd GNU General Public License for more details.
acc36ab93565d2880447d535da6ca6e5feac7a70nd
acc36ab93565d2880447d535da6ca6e5feac7a70nd You should have received a copy of the GNU General Public License
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd along with this program. If not, see <http://www.gnu.org/licenses/>.
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd*/
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd#include "config.h" /* for HAVE_FUNCTION_ATTRIBUTE_FORMAT in "ipa_hbac.h" */
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd#include <stdlib.h>
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd#include <string.h>
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd#include <errno.h>
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd#include "ipa_hbac.h"
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd#include "sss_utf8.h"
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd#ifndef HAVE_ERRNO_T
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd#define HAVE_ERRNO_T
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniaktypedef int errno_t;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd#endif
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd#ifndef EOK
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd#define EOK 0
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd#endif
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd/* HBAC logging system */
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd/* debug macro */
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd#define HBAC_DEBUG(level, format, ...) do { \
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniak if (hbac_debug_fn != NULL) { \
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd hbac_debug_fn(__FILE__, __LINE__, __FUNCTION__, \
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd level, format, ##__VA_ARGS__); \
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniak } \
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd} while (0)
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd/* static pointer to external logging function */
d78d735dbf7c5ce5ae545eecd8ee2c052224db77ndstatic hbac_debug_fn_t hbac_debug_fn = NULL;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd/* setup function for external logging function */
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniakvoid hbac_enable_debug(hbac_debug_fn_t external_debug_fn)
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd{
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd hbac_debug_fn = external_debug_fn;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd}
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd/* auxiliary function for hbac_request_element logging */
d78d735dbf7c5ce5ae545eecd8ee2c052224db77ndstatic void hbac_request_element_debug_print(struct hbac_request_element *el,
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd const char *label);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd/* auxiliary function for hbac_eval_req logging */
d78d735dbf7c5ce5ae545eecd8ee2c052224db77ndstatic void hbac_req_debug_print(struct hbac_eval_req *req);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd/* auxiliary function for hbac_rule_element logging */
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniakstatic void hbac_rule_element_debug_print(struct hbac_rule_element *el,
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd const char *label);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd/* auxiliary function for hbac_rule logging */
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniakstatic void hbac_rule_debug_print(struct hbac_rule *rule);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd/* Placeholder structure for future HBAC time-based
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd * evaluation rules
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd */
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniakstruct hbac_time_rules {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd int not_yet_implemented;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd};
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77ndenum hbac_eval_result_int {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_EVAL_MATCH_ERROR = -1,
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_EVAL_MATCHED,
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_EVAL_UNMATCHED
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd};
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77ndstatic bool hbac_rule_element_is_complete(struct hbac_rule_element *el)
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd{
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (el == NULL) return false;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (el->category == HBAC_CATEGORY_ALL) return true;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (el->names == NULL && el->groups == NULL) return false;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if ((el->names && el->names[0] != NULL)
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd || (el->groups && el->groups[0] != NULL))
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd return true;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniak /* If other categories are added, handle them here */
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd return false;
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniak}
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77ndbool hbac_rule_is_complete(struct hbac_rule *rule, uint32_t *missing_attrs)
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd{
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd bool complete = true;
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniak
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd *missing_attrs = 0;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniak if (rule == NULL) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd /* No rule passed in? */
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd return false;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd /* Make sure we have all elements */
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (!hbac_rule_element_is_complete(rule->users)) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd complete = false;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd *missing_attrs |= HBAC_RULE_ELEMENT_USERS;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (!hbac_rule_element_is_complete(rule->services)) {
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniak complete = false;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd *missing_attrs |= HBAC_RULE_ELEMENT_SERVICES;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (!hbac_rule_element_is_complete(rule->targethosts)) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd complete = false;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd *missing_attrs |= HBAC_RULE_ELEMENT_TARGETHOSTS;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (!hbac_rule_element_is_complete(rule->srchosts)) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd complete = false;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd *missing_attrs |= HBAC_RULE_ELEMENT_SOURCEHOSTS;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd return complete;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd}
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniak
d78d735dbf7c5ce5ae545eecd8ee2c052224db77ndenum hbac_eval_result_int hbac_evaluate_rule(struct hbac_rule *rule,
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd struct hbac_eval_req *hbac_req,
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd enum hbac_error_code *error);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77ndenum hbac_eval_result hbac_evaluate(struct hbac_rule **rules,
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd struct hbac_eval_req *hbac_req,
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd struct hbac_info **info)
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd{
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd uint32_t i;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd enum hbac_error_code ret;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd enum hbac_eval_result result = HBAC_EVAL_DENY;
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniak enum hbac_eval_result_int intermediate_result;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_DEBUG(HBAC_DBG_INFO, "[< hbac_evaluate()\n");
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniak hbac_req_debug_print(hbac_req);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (info) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd *info = malloc(sizeof(struct hbac_info));
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (!*info) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_DEBUG(HBAC_DBG_ERROR, "Out of memory.\n");
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd return HBAC_EVAL_OOM;
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniak }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd (*info)->code = HBAC_ERROR_UNKNOWN;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd (*info)->rule_name = NULL;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd for (i = 0; rules[i]; i++) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd hbac_rule_debug_print(rules[i]);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd intermediate_result = hbac_evaluate_rule(rules[i], hbac_req, &ret);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (intermediate_result == HBAC_EVAL_UNMATCHED) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd /* This rule did not match at all. Skip it */
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_DEBUG(HBAC_DBG_INFO, "The rule [%s] did not match.\n",
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd rules[i]->name);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd continue;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd } else if (intermediate_result == HBAC_EVAL_MATCHED) {
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniak HBAC_DEBUG(HBAC_DBG_INFO, "ALLOWED by rule [%s].\n", rules[i]->name);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd result = HBAC_EVAL_ALLOW;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (info) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd (*info)->code = HBAC_SUCCESS;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd (*info)->rule_name = strdup(rules[i]->name);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (!(*info)->rule_name) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_DEBUG(HBAC_DBG_ERROR, "Out of memory.\n");
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd result = HBAC_EVAL_ERROR;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd (*info)->code = HBAC_ERROR_OUT_OF_MEMORY;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniak }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd break;
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniak } else {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd /* An error occurred processing this rule */
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_DEBUG(HBAC_DBG_ERROR,
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd "Error %d occurred during evaluating of rule [%s].\n",
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd ret, rules[i]->name);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd result = HBAC_EVAL_ERROR;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (info) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd (*info)->code = ret;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd (*info)->rule_name = strdup(rules[i]->name);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd /* Explicitly not checking the result of strdup(), since if
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd * it's NULL, we can't do anything anyway.
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd */
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd goto done;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd /* If we've reached the end of the loop, we have either set the
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd * result to ALLOW explicitly or we'll stick with the default DENY.
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd */
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nddone:
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_DEBUG(HBAC_DBG_INFO, "hbac_evaluate() >]\n");
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd return result;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd}
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77ndstatic errno_t hbac_evaluate_element(struct hbac_rule_element *rule_el,
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd struct hbac_request_element *req_el,
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd bool *matched);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77ndenum hbac_eval_result_int hbac_evaluate_rule(struct hbac_rule *rule,
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd struct hbac_eval_req *hbac_req,
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd enum hbac_error_code *error)
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd{
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd errno_t ret;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd bool matched;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (!rule->enabled) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_DEBUG(HBAC_DBG_INFO, "Rule [%s] is not enabled\n", rule->name);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd return HBAC_EVAL_UNMATCHED;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd /* Make sure we have all elements */
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (!rule->users
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd || !rule->services
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd || !rule->targethosts
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd || !rule->srchosts) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_DEBUG(HBAC_DBG_INFO,
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd "Rule [%s] cannot be parsed, some elements are empty\n",
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd rule->name);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd *error = HBAC_ERROR_UNPARSEABLE_RULE;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd return HBAC_EVAL_MATCH_ERROR;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd /* Check users */
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd ret = hbac_evaluate_element(rule->users,
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd hbac_req->user,
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd &matched);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (ret != EOK) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_DEBUG(HBAC_DBG_ERROR,
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd "Cannot parse user elements of rule [%s]\n", rule->name);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd *error = HBAC_ERROR_UNPARSEABLE_RULE;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd return HBAC_EVAL_MATCH_ERROR;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd } else if (!matched) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd return HBAC_EVAL_UNMATCHED;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd /* Check services */
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd ret = hbac_evaluate_element(rule->services,
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd hbac_req->service,
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd &matched);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (ret != EOK) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_DEBUG(HBAC_DBG_ERROR,
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd "Cannot parse service elements of rule [%s]\n", rule->name);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd *error = HBAC_ERROR_UNPARSEABLE_RULE;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd return HBAC_EVAL_MATCH_ERROR;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd } else if (!matched) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd return HBAC_EVAL_UNMATCHED;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd /* Check target hosts */
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd ret = hbac_evaluate_element(rule->targethosts,
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd hbac_req->targethost,
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd &matched);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (ret != EOK) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_DEBUG(HBAC_DBG_ERROR,
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd "Cannot parse targethost elements of rule [%s]\n",
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd rule->name);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd *error = HBAC_ERROR_UNPARSEABLE_RULE;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd return HBAC_EVAL_MATCH_ERROR;
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniak } else if (!matched) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd return HBAC_EVAL_UNMATCHED;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniak
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd /* Check source hosts */
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd ret = hbac_evaluate_element(rule->srchosts,
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd hbac_req->srchost,
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd &matched);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (ret != EOK) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_DEBUG(HBAC_DBG_ERROR,
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd "Cannot parse srchost elements of rule [%s]\n",
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd rule->name);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd *error = HBAC_ERROR_UNPARSEABLE_RULE;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd return HBAC_EVAL_MATCH_ERROR;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd } else if (!matched) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd return HBAC_EVAL_UNMATCHED;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd return HBAC_EVAL_MATCHED;
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniak}
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77ndstatic errno_t hbac_evaluate_element(struct hbac_rule_element *rule_el,
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd struct hbac_request_element *req_el,
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd bool *matched)
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd{
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd size_t i, j;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd const uint8_t *rule_name;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd const uint8_t *req_name;
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniak int ret;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (rule_el->category & HBAC_CATEGORY_ALL) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd *matched = true;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd return EOK;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd /* First check the name list */
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (rule_el->names) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd for (i = 0; rule_el->names[i]; i++) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (req_el->name != NULL) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd rule_name = (const uint8_t *) rule_el->names[i];
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd req_name = (const uint8_t *) req_el->name;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd /* Do a case-insensitive comparison. */
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd ret = sss_utf8_case_eq(rule_name, req_name);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (ret != EOK && ret != ENOMATCH) {
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniak return ret;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd } else if (ret == EOK) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd *matched = true;
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniak return EOK;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (rule_el->groups) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd /* Not found in the name list
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd * Check for group membership
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd */
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd for (i = 0; rule_el->groups[i]; i++) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd rule_name = (const uint8_t *) rule_el->groups[i];
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd for (j = 0; req_el->groups[j]; j++) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd req_name = (const uint8_t *) req_el->groups[j];
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd /* Do a case-insensitive comparison. */
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd ret = sss_utf8_case_eq(rule_name, req_name);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (ret != EOK && ret != ENOMATCH) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd return ret;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd } else if (ret == EOK) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd *matched = true;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd return EOK;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniak }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniak
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd /* Not found in groups either */
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd *matched = false;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd return EOK;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd}
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77ndconst char *hbac_result_string(enum hbac_eval_result result)
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd{
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd switch (result) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd case HBAC_EVAL_ALLOW:
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd return "HBAC_EVAL_ALLOW";
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd case HBAC_EVAL_DENY:
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd return "HBAC_EVAL_DENY";
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd case HBAC_EVAL_ERROR:
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd return "HBAC_EVAL_ERROR";
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd case HBAC_EVAL_OOM:
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd return "Could not allocate memory for hbac_info object";
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd return "HBAC_EVAL_ERROR";
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd}
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77ndvoid hbac_free_info(struct hbac_info *info)
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd{
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (info == NULL) return;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd free(info->rule_name);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd free(info);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd}
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77ndconst char *hbac_error_string(enum hbac_error_code code)
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd{
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd switch (code) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd case HBAC_SUCCESS:
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd return "Success";
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd case HBAC_ERROR_NOT_IMPLEMENTED:
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniak return "Function is not yet implemented";
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd case HBAC_ERROR_OUT_OF_MEMORY:
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd return "Out of memory";
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniak case HBAC_ERROR_UNPARSEABLE_RULE:
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd return "Rule could not be evaluated";
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd case HBAC_ERROR_UNKNOWN:
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd default:
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd return "Unknown error code";
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd}
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77ndstatic void hbac_request_element_debug_print(struct hbac_request_element *el,
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd const char *label)
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd{
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd int i;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (el) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (el->name) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_DEBUG(HBAC_DBG_TRACE, "\t\t%s [%s]\n", label, el->name);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (el->groups) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (el->groups[0]) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_DEBUG(HBAC_DBG_TRACE, "\t\t%s_group:\n", label);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd for (i = 0; el->groups[i]; i++) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_DEBUG(HBAC_DBG_TRACE, "\t\t\t[%s]\n", el->groups[i]);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd } else {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_DEBUG(HBAC_DBG_TRACE, "\t\t%s_group (none)\n", label);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd } else {
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniak HBAC_DEBUG(HBAC_DBG_TRACE, "\t%s (none)\n", label);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd}
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniak
d78d735dbf7c5ce5ae545eecd8ee2c052224db77ndstatic void hbac_req_debug_print(struct hbac_eval_req *req)
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd{
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_DEBUG(HBAC_DBG_TRACE, "\tREQUEST:\n");
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (req) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd struct tm *local_time = NULL;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd size_t ret;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd const size_t buff_size = 100;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd char time_buff[buff_size];
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd hbac_request_element_debug_print(req->service, "service");
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd hbac_request_element_debug_print(req->user, "user");
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd hbac_request_element_debug_print(req->targethost, "targethost");
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd hbac_request_element_debug_print(req->srchost, "srchost");
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd local_time = localtime(&req->request_time);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (local_time == NULL) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd return;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd ret = strftime(time_buff, buff_size, "%Y-%m-%d %H:%M:%S", local_time);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (ret <= 0) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd return;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_DEBUG(HBAC_DBG_TRACE, "\t\trequest time %s\n", time_buff);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd } else {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_DEBUG(HBAC_DBG_TRACE, "\tRequest is EMPTY.\n");
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniak}
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77ndstatic void hbac_rule_element_debug_print(struct hbac_rule_element *el,
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd const char *label)
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd{
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd int i;
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (el) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_DEBUG(HBAC_DBG_TRACE, "\t\tcategory [%#x] [%s]\n", el->category,
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniak (el->category == HBAC_CATEGORY_ALL) ? "ALL" : "NONE");
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (el->names) {
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniak if (el->names[0]) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_DEBUG(HBAC_DBG_TRACE, "\t\t%s_names:\n", label);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd for (i = 0; el->names[i]; i++) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_DEBUG(HBAC_DBG_TRACE, "\t\t\t[%s]\n", el->names[i]);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd } else {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_DEBUG(HBAC_DBG_TRACE, "\t\t%s_names (none)\n", label);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (el->groups) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (el->groups[0]) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_DEBUG(HBAC_DBG_TRACE, "\t\t%s_groups:\n", label);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd for (i = 0; el->groups[i]; i++) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_DEBUG(HBAC_DBG_TRACE, "\t\t\t[%s]\n", el->groups[i]);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd } else {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_DEBUG(HBAC_DBG_TRACE, "\t\t%s_groups (none)\n", label);
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd}
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77ndstatic void hbac_rule_debug_print(struct hbac_rule *rule)
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd{
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (rule) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_DEBUG(HBAC_DBG_TRACE, "\tRULE [%s] [%s]:\n",
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd rule->name, (rule->enabled) ? "ENABLED" : "DISABLED");
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (rule->services) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_DEBUG(HBAC_DBG_TRACE, "\tservices:\n");
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd hbac_rule_element_debug_print(rule->services, "services");
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd } else {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_DEBUG(HBAC_DBG_TRACE, "\tservices (none)\n");
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniak
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (rule->users) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_DEBUG(HBAC_DBG_TRACE, "\tusers:\n");
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniak hbac_rule_element_debug_print(rule->users, "users");
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd } else {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_DEBUG(HBAC_DBG_TRACE, "\tusers (none)\n");
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (rule->targethosts) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_DEBUG(HBAC_DBG_TRACE, "\ttargethosts:\n");
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd hbac_rule_element_debug_print(rule->targethosts, "targethosts");
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd } else {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_DEBUG(HBAC_DBG_TRACE, "\ttargethosts (none)\n");
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd if (rule->srchosts) {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_DEBUG(HBAC_DBG_TRACE, "\tsrchosts:\n");
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd hbac_rule_element_debug_print(rule->srchosts, "srchosts");
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniak } else {
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd HBAC_DEBUG(HBAC_DBG_TRACE, "\tsrchosts (none)\n");
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd }
5652dbe450e4fcfdf36d4cfb42d7f2345ded29a4maczniak }
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd}
d78d735dbf7c5ce5ae545eecd8ee2c052224db77nd