int
set_entry(krb5_context contextp,
kadm5_principal_ent_t ent,
int *mask,
const char *max_ticket_life,
const char *max_renewable_life,
const char *expiration,
const char *pw_expiration,
const char *attributes,
const char *policy)
{
if (max_ticket_life != NULL) {
if (parse_deltat (max_ticket_life, &ent->max_life,
mask, KADM5_MAX_LIFE)) {
krb5_warnx (contextp, "unable to parse `%s'", max_ticket_life);
return 1;
}
}
if (max_renewable_life != NULL) {
if (parse_deltat (max_renewable_life, &ent->max_renewable_life,
mask, KADM5_MAX_RLIFE)) {
krb5_warnx (contextp, "unable to parse `%s'", max_renewable_life);
return 1;
}
}
if (expiration) {
if (parse_timet (expiration, &ent->princ_expire_time,
mask, KADM5_PRINC_EXPIRE_TIME)) {
krb5_warnx (contextp, "unable to parse `%s'", expiration);
return 1;
}
}
if (pw_expiration) {
if (parse_timet (pw_expiration, &ent->pw_expiration,
mask, KADM5_PW_EXPIRATION)) {
krb5_warnx (contextp, "unable to parse `%s'", pw_expiration);
return 1;
}
}
if (attributes != NULL) {
if (parse_attributes (attributes, &ent->attributes,
mask, KADM5_ATTRIBUTES)) {
krb5_warnx (contextp, "unable to parse `%s'", attributes);
return 1;
}
}
if (policy != NULL) {
if (parse_policy (policy, &ent->policy,
mask, KADM5_POLICY)) {
krb5_warnx (contextp, "unable to parse `%s'", policy);
return 1;
}
}
return 0;
}
/*
* Create a new policy
*/
int
edit_policy(isns_client_t *clnt, int argc, char **argv)
{
isns_attr_list_t attrs = ISNS_ATTR_LIST_INIT;
int status;
if (!parse_policy(argc, argv, &attrs,
"Edit an existing policy",
"--edit-policy"))
isns_fatal("Cannot parse policy\n");
status = __create_policy(clnt, &attrs);
isns_attr_list_destroy(&attrs);
return status;
}
/*
* Enroll a new client
*/
int
enroll_client(isns_client_t *clnt, int argc, char **argv)
{
isns_attr_list_t attrs = ISNS_ATTR_LIST_INIT;
const char *client_name;
int status;
if (argc == 0)
usage(1, "Missing client name");
client_name = *argv++; --argc;
isns_attr_list_append_string(&attrs,
OPENISNS_TAG_POLICY_SPI,
client_name);
#if 0
isns_attr_list_append_string(&attrs,
OPENISNS_TAG_POLICY_SOURCE_NAME,
client_name);
#endif
if (!opt_keyfile) {
static char namebuf[PATH_MAX];
snprintf(namebuf, sizeof(namebuf), "%s.key", client_name);
opt_keyfile = namebuf;
}
if (argc && !parse_policy(argc, argv, &attrs,
"Enroll an iSNS client",
"--enroll hostname"))
isns_fatal("Cannot parse policy\n");
/* If no key is given, generate one */
if (!isns_attr_list_contains(&attrs, OPENISNS_TAG_POLICY_KEY)) {
printf("No key given, generating one\n");
isns_attr_list_append_attr(&attrs,
generate_key_callback());
}
status = __create_policy(clnt, &attrs);
isns_attr_list_destroy(&attrs);
return status;
}
int
edit_policy (const char *prompt, char **policy, int *mask, int bit)
{
char buf[1024], resp[1024];
if (mask && (*mask & bit))
return 0;
buf[0] = '\0';
strlcpy(buf, "default", sizeof (buf));
for (;;) {
if(get_response("Policy", buf, resp, sizeof(resp)) != 0)
return 1;
if (resp[0] == '\0')
break;
if (parse_policy (resp, policy, mask, bit) == 0)
break;
}
return 0;
}
void parse_policies(const char *policy_path)
{
xmlDocPtr doc;
xmlNodePtr cur;
policy_t *policy = &policy_list;
eval_t head = EVAL_HEAD;
doc = xmlParseFile(policy_path);
check(doc, "Failed to parse policy file %s", policy_path);
cur = xmlDocGetRootElement(doc);
check(cur, "The policy file %s is empty", policy_path);
check(xmlStrcmp(cur->name, (const xmlChar *)"UserPolicies") == 0,
"Policy file of the wrong type, root node != UserPolicies");
cur = cur->xmlChildrenNode;
while (cur != NULL) {
//debug("%s", cur->name);
if (!xmlStrcmp(cur->name, (const xmlChar *)"policy")) {
//debug("new policy found");
policy->next = malloc(sizeof(policy_t));
policy = policy->next;
policy->appID = -1;
memcpy(&policy->eval_list, &head, sizeof(eval_t));
policy->next = NULL;
parse_policy(doc, cur, policy);
}
cur = cur->next;
}
dump_policies();
error:
if (doc)
xmlFreeDoc(doc);
/* TODO: return parse failure */
}
/*
* Load the device policy.
* The device policy currently makes nu distinction between the
* block and characters devices; that is generally not a problem
* as the names of those devices cannot clash.
*/
int
devpolicy_load(int nitems, size_t sz, devplcysys_t *uitmp)
{
int i, j;
int nmaj = 0;
major_t lastmajor;
devplcysys_t *items;
size_t mem;
major_t curmaj;
devplcyent_t **last, *de;
tableent_t *newpolicy, *oldpolicy;
devplcy_t *newnull, *newdflt, *oldnull, *olddflt;
int oldcnt;
int lastlen;
int lastwild;
#ifdef lint
/* Lint can't figure out that the "i == 1" test protects all */
lastlen = 0;
lastwild = 0;
lastmajor = 0;
#endif
/*
* The application must agree with the kernel on the size of each
* item; it must not exceed the maximum number and must be
* at least 1 item in size.
*/
if (sz != sizeof (devplcysys_t) || nitems > maxdevpolicy || nitems < 1)
return (EINVAL);
mem = nitems * sz;
items = kmem_alloc(mem, KM_SLEEP);
if (copyin(uitmp, items, mem)) {
kmem_free(items, mem);
return (EFAULT);
}
/* Check for default policy, it must exist and be sorted first */
if (items[0].dps_maj != DEVPOLICY_DFLT_MAJ) {
kmem_free(items, mem);
return (EINVAL);
}
/*
* Application must deliver entries sorted.
* Sorted meaning here:
* In major number order
* For each major number, we first need to have the explicit
* entries, then the wild card entries, longest first.
*/
for (i = 1; i < nitems; i++) {
int len, wild;
char *tmp;
curmaj = items[i].dps_maj;
len = strlen(items[i].dps_minornm);
wild = len > 0 &&
(tmp = strchr(items[i].dps_minornm, '*')) != NULL;
/* Another default major, string too long or too many ``*'' */
if (curmaj == DEVPOLICY_DFLT_MAJ ||
len >= sizeof (items[i].dps_minornm) ||
wild && strchr(tmp + 1, '*') != NULL) {
kmem_free(items, mem);
return (EINVAL);
}
if (i == 1 || lastmajor < curmaj) {
lastmajor = curmaj;
nmaj++;
} else if (lastmajor > curmaj || lastwild > wild ||
lastwild && lastlen < len) {
kmem_free(items, mem);
return (EINVAL);
}
lastlen = len;
lastwild = wild;
}
if (AU_AUDITING())
audit_devpolicy(nitems, items);
/*
* Parse the policy. We create an array for all major numbers
* and in each major number bucket we'll have a linked list of
* entries. Each item may contain either a lo,hi minor pair
* or a string/wild card matching a minor node.
*/
if (nmaj > 0)
newpolicy = kmem_zalloc(nmaj * sizeof (tableent_t), KM_SLEEP);
/*
* We want to lock out concurrent updates but we don't want to
* lock out device opens while we still need to allocate memory.
* As soon as we allocate new devplcy_t's we commit to the next
* generation number, so we must lock out other updates from here.
*/
mutex_enter(&policymutex);
/* New default and NULL policy */
newnull = dpget();
if (priv_isemptyset(&items[0].dps_rdp) &&
priv_isemptyset(&items[0].dps_wrp)) {
newdflt = newnull;
dphold(newdflt);
} else {
newdflt = dpget();
newdflt->dp_rdp = items[0].dps_rdp;
newdflt->dp_wrp = items[0].dps_wrp;
}
j = -1;
/* Userland made sure sorting was ok */
for (i = 1; i < nitems; i++) {
de = parse_policy(&items[i], newnull, newdflt);
if (j == -1 || curmaj != items[i].dps_maj) {
j++;
newpolicy[j].t_major = curmaj = items[i].dps_maj;
last = &newpolicy[j].t_ent;
}
*last = de;
last = &de->dpe_next;
}
/* Done parsing, throw away input */
kmem_free(items, mem);
/* Lock out all devpolicy_find()s */
rw_enter(&policyrw, RW_WRITER);
/* Install the new global data */
oldnull = nullpolicy;
nullpolicy = newnull;
olddflt = dfltpolicy;
dfltpolicy = newdflt;
oldcnt = ntabent;
ntabent = nmaj;
totitems = nitems;
oldpolicy = devpolicy;
devpolicy = newpolicy;
/* Force all calls by devpolicy_find() */
devplcy_gen++;
/* Reenable policy finds */
rw_exit(&policyrw);
mutex_exit(&policymutex);
/* Free old stuff */
if (oldcnt != 0) {
for (i = 0; i < oldcnt; i++)
freechain(oldpolicy[i].t_ent);
kmem_free(oldpolicy, oldcnt * sizeof (*oldpolicy));
}
dpfree(oldnull);
dpfree(olddflt);
return (0);
}
static int parse(int c, char **argv, int invert, unsigned int *flags,
const struct ipt_entry *entry,
unsigned int *nfcache,
struct ipt_entry_match **match)
{
struct ipt_policy_info *info = (void *)(*match)->data;
struct ipt_policy_elem *e = &info->pol[info->len];
struct in_addr *addr = NULL, mask;
unsigned int naddr = 0;
int mode;
check_inverse(optarg, &invert, &optind, 0);
switch (c) {
case '1':
if (info->flags & (IPT_POLICY_MATCH_IN|IPT_POLICY_MATCH_OUT))
exit_error(PARAMETER_PROBLEM,
"policy match: double --dir option");
if (invert)
exit_error(PARAMETER_PROBLEM,
"policy match: can't invert --dir option");
info->flags |= parse_direction(argv[optind-1]);
break;
case '2':
if (invert)
exit_error(PARAMETER_PROBLEM,
"policy match: can't invert --policy option");
info->flags |= parse_policy(argv[optind-1]);
break;
case '3':
if (info->flags & IPT_POLICY_MATCH_STRICT)
exit_error(PARAMETER_PROBLEM,
"policy match: double --strict option");
if (invert)
exit_error(PARAMETER_PROBLEM,
"policy match: can't invert --strict option");
info->flags |= IPT_POLICY_MATCH_STRICT;
break;
case '4':
if (e->match.reqid)
exit_error(PARAMETER_PROBLEM,
"policy match: double --reqid option");
e->match.reqid = 1;
e->invert.reqid = invert;
e->reqid = strtol(argv[optind-1], NULL, 10);
break;
case '5':
if (e->match.spi)
exit_error(PARAMETER_PROBLEM,
"policy match: double --spi option");
e->match.spi = 1;
e->invert.spi = invert;
e->spi = strtol(argv[optind-1], NULL, 0x10);
break;
case '6':
if (e->match.saddr)
exit_error(PARAMETER_PROBLEM,
"policy match: double --tunnel-src option");
parse_hostnetworkmask(argv[optind-1], &addr, &mask, &naddr);
if (naddr > 1)
exit_error(PARAMETER_PROBLEM,
"policy match: name resolves to multiple IPs");
e->match.saddr = 1;
e->invert.saddr = invert;
e->saddr.a4 = addr[0];
e->smask.a4 = mask;
break;
case '7':
if (e->match.daddr)
exit_error(PARAMETER_PROBLEM,
"policy match: double --tunnel-dst option");
parse_hostnetworkmask(argv[optind-1], &addr, &mask, &naddr);
if (naddr > 1)
exit_error(PARAMETER_PROBLEM,
"policy match: name resolves to multiple IPs");
e->match.daddr = 1;
e->invert.daddr = invert;
e->daddr.a4 = addr[0];
e->dmask.a4 = mask;
break;
case '8':
if (e->match.proto)
exit_error(PARAMETER_PROBLEM,
"policy match: double --proto option");
e->proto = parse_protocol(argv[optind-1]);
if (e->proto != IPPROTO_AH && e->proto != IPPROTO_ESP &&
e->proto != IPPROTO_COMP)
exit_error(PARAMETER_PROBLEM,
"policy match: protocol must ah/esp/ipcomp");
e->match.proto = 1;
e->invert.proto = invert;
break;
case '9':
if (e->match.mode)
exit_error(PARAMETER_PROBLEM,
"policy match: double --mode option");
mode = parse_mode(argv[optind-1]);
e->match.mode = 1;
e->invert.mode = invert;
e->mode = mode;
break;
case 'a':
if (invert)
exit_error(PARAMETER_PROBLEM,
"policy match: can't invert --next option");
if (++info->len == IPT_POLICY_MAX_ELEM)
exit_error(PARAMETER_PROBLEM,
"policy match: maximum policy depth reached");
break;
default:
return 0;
}
policy_info = info;
return 1;
}
static int policy_parse(int c, int invert, unsigned int *flags,
struct xt_policy_info *info, uint8_t family)
{
struct xt_policy_elem *e = &info->pol[info->len];
struct in_addr *addr = NULL, mask;
struct in6_addr *addr6 = NULL, mask6;
unsigned int naddr = 0, num;
int mode;
xtables_check_inverse(optarg, &invert, &optind, 0);
switch (c) {
case '1':
if (info->flags & (XT_POLICY_MATCH_IN | XT_POLICY_MATCH_OUT))
xtables_error(PARAMETER_PROBLEM,
"policy match: double --dir option");
if (invert)
xtables_error(PARAMETER_PROBLEM,
"policy match: can't invert --dir option");
info->flags |= parse_direction(optarg);
break;
case '2':
if (invert)
xtables_error(PARAMETER_PROBLEM,
"policy match: can't invert --policy option");
info->flags |= parse_policy(optarg);
break;
case '3':
if (info->flags & XT_POLICY_MATCH_STRICT)
xtables_error(PARAMETER_PROBLEM,
"policy match: double --strict option");
if (invert)
xtables_error(PARAMETER_PROBLEM,
"policy match: can't invert --strict option");
info->flags |= XT_POLICY_MATCH_STRICT;
break;
case '4':
if (e->match.reqid)
xtables_error(PARAMETER_PROBLEM,
"policy match: double --reqid option");
e->match.reqid = 1;
e->invert.reqid = invert;
if (!xtables_strtoui(optarg, NULL, &num, 0, UINT32_MAX))
xtables_param_act(XTF_BAD_VALUE, "policy", "--spi", optarg);
e->reqid = num;
break;
case '5':
if (e->match.spi)
xtables_error(PARAMETER_PROBLEM,
"policy match: double --spi option");
e->match.spi = 1;
e->invert.spi = invert;
if (!xtables_strtoui(optarg, NULL, &num, 0, UINT32_MAX))
xtables_param_act(XTF_BAD_VALUE, "policy", "--spi", optarg);
e->spi = num;
break;
case '6':
if (e->match.saddr)
xtables_error(PARAMETER_PROBLEM,
"policy match: double --tunnel-src option");
if (family == NFPROTO_IPV6)
xtables_ip6parse_any(optarg, &addr6, &mask6, &naddr);
else
xtables_ipparse_any(optarg, &addr, &mask, &naddr);
if (naddr > 1)
xtables_error(PARAMETER_PROBLEM,
"policy match: name resolves to multiple IPs");
e->match.saddr = 1;
e->invert.saddr = invert;
if (family == NFPROTO_IPV6) {
memcpy(&e->saddr.a6, addr6, sizeof(*addr6));
memcpy(&e->smask.a6, &mask6, sizeof(mask6));
} else {
e->saddr.a4 = addr[0];
e->smask.a4 = mask;
}
break;
case '7':
if (e->match.daddr)
xtables_error(PARAMETER_PROBLEM,
"policy match: double --tunnel-dst option");
if (family == NFPROTO_IPV6)
xtables_ip6parse_any(optarg, &addr6, &mask6, &naddr);
else
xtables_ipparse_any(optarg, &addr, &mask, &naddr);
if (naddr > 1)
xtables_error(PARAMETER_PROBLEM,
"policy match: name resolves to multiple IPs");
e->match.daddr = 1;
e->invert.daddr = invert;
if (family == NFPROTO_IPV6) {
memcpy(&e->daddr.a6, addr6, sizeof(*addr6));
memcpy(&e->dmask.a6, &mask6, sizeof(mask6));
} else {
e->daddr.a4 = addr[0];
e->dmask.a4 = mask;
}
break;
case '8':
if (e->match.proto)
xtables_error(PARAMETER_PROBLEM,
"policy match: double --proto option");
e->proto = xtables_parse_protocol(optarg);
if (e->proto != IPPROTO_AH && e->proto != IPPROTO_ESP &&
e->proto != IPPROTO_COMP)
xtables_error(PARAMETER_PROBLEM,
"policy match: protocol must ah/esp/ipcomp");
e->match.proto = 1;
e->invert.proto = invert;
break;
case '9':
if (e->match.mode)
xtables_error(PARAMETER_PROBLEM,
"policy match: double --mode option");
mode = parse_mode(optarg);
e->match.mode = 1;
e->invert.mode = invert;
e->mode = mode;
break;
case 'a':
if (invert)
xtables_error(PARAMETER_PROBLEM,
"policy match: can't invert --next option");
if (++info->len == XT_POLICY_MAX_ELEM)
xtables_error(PARAMETER_PROBLEM,
"policy match: maximum policy depth reached");
break;
default:
return 0;
}
return 1;
}
static void parse_cmdline(int argc, char **argp)
{
unsigned int i = 1;
if(argc < 2) {
show_usage(1);
}
if (!strcmp(argp[i], "-h")) {
show_usage(0);
}
else if (!strcmp(argp[i], "-srq")) {
command = COM_SRQ;
i++;
if(argc != 5)
show_usage(1);
parse_port(argp[i++]);
parse_q(argp[i++]);
parse_pt(argp[i++]);
}
else if (!strcmp(argp[i], "-sq")) {
command = COM_SQ;
i++;
if(argc != 6)
show_usage(1);
parse_port(argp[i++]);
parse_q(argp[i++]);
parse_mac(argp[i++], mac);
}
else if (!strcmp(argp[i], "-srp")) {
command = COM_SRP;
i++;
if(argc != 4)
show_usage(1);
parse_port(argp[i++]);
parse_policy(argp[i++]);
}
else if (!strcmp(argp[i], "-srqw")) {
command = COM_SRQW;
i++;
if(argc != 5)
show_usage(1);
parse_port(argp[i++]);
parse_q(argp[i++]);
parse_hex_val(argp[i++], &weight);
}
else if (!strcmp(argp[i], "-stp")) {
command = COM_STP;
i++;
if(argc != 6)
show_usage(1);
parse_port(argp[i++]);
parse_q(argp[i++]);
parse_hex_val(argp[i++], &weight);
parse_policy(argp[i++]);
}
else if (!strcmp(argp[i], "-fprs")) {
command = COM_IP_RULE_SET;
i++;
if(argc != 8)
show_usage(1);
parse_dec_val(argp[i++], &inport);
parse_dec_val(argp[i++], &outport);
parse_ip(argp[i++], &dip);
parse_ip(argp[i++], &sip);
parse_mac(argp[i++], da);
parse_mac(argp[i++], sa);
}
else if (!strcmp(argp[i], "-fprd")) {
command = COM_IP_RULE_DEL;
i++;
if(argc != 4)
show_usage(1);
parse_ip(argp[i++], &dip);
parse_ip(argp[i++], &sip);
}
else if (!strcmp(argp[i], "-fp_st")) {
command = COM_NFP_STATUS;
if(argc != 2)
show_usage(1);
}
else if (!strcmp(argp[i], "-fp_print")) {
command = COM_NFP_PRINT;
i++;
if (argc != 3)
show_usage(1);
parse_db_name(argp[i++]);
}
else if (!strcmp(argp[i], "-txdone")) {
command = COM_TXDONE_Q;
i++;
if(argc != 3)
show_usage(1);
parse_dec_val(argp[i++], &value);
}
else if (!strcmp(argp[i], "-txen")) {
command = COM_TX_EN;
i++;
if(argc != 4)
show_usage(1);
parse_port(argp[i++]);
parse_dec_val(argp[i++], &value);
}
else if (!strcmp(argp[i], "-lro")) {
command = COM_LRO;
i++;
if(argc != 4)
show_usage(1);
parse_port(argp[i++]);
parse_dec_val(argp[i++], &value);
}
else if (!strcmp(argp[i], "-lro_desc")) {
command = COM_LRO_DESC;
i++;
if(argc != 4)
show_usage(1);
parse_port(argp[i++]);
parse_dec_val(argp[i++], &value);
}
else if (!strcmp(argp[i], "-reuse")) {
command = COM_SKB_REUSE;
i++;
if(argc != 3)
show_usage(1);
parse_dec_val(argp[i++], &value);
}
else if (!strcmp(argp[i], "-recycle")) {
command = COM_SKB_RECYCLE;
i++;
if(argc != 3)
show_usage(1);
parse_dec_val(argp[i++], &value);
}
else if (!strcmp(argp[i], "-nfp")) {
command = COM_NFP;
i++;
if(argc != 3)
show_usage(1);
parse_dec_val(argp[i++], &value);
}
else if (!strcmp(argp[i], "-rxcoal")) {
command = COM_RX_COAL;
i++;
if(argc != 4)
show_usage(1);
parse_port(argp[i++]);
parse_dec_val(argp[i++], &value);
}
else if (!strcmp(argp[i], "-txcoal")) {
command = COM_TX_COAL;
i++;
if(argc != 4)
show_usage(1);
parse_port(argp[i++]);
parse_dec_val(argp[i++], &value);
}
else if (!strcmp(argp[i], "-ejp")) {
command = COM_EJP_MODE;
i++;
if(argc != 4)
show_usage(1);
parse_port(argp[i++]);
parse_dec_val(argp[i++], &value);
}
else if (!strcmp(argp[i], "-tos")) {
command = COM_TOS_MAP;
i++;
if(argc != 5)
show_usage(1);
parse_port(argp[i++]);
parse_q(argp[i++]);
parse_hex_val(argp[i++], &value);
}
else if (!strcmp(argp[i], "-tx_noq")) {
command = COM_TX_NOQUEUE;
i++;
if(argc != 4)
show_usage(1);
parse_port(argp[i++]);
parse_dec_val(argp[i++], &value);
}
else if (!strcmp(argp[i], "-St")) {
command = COM_STS;
i++;
if(argc < 4)
show_usage(1);
parse_status(argp[i++]);
if( status == STS_PORT_Q ) {
if(argc != 5)
show_usage(1);
parse_q(argp[i++]);
}
else if(argc != 4)
show_usage(1);
parse_port(argp[i++]);
}
else {
show_usage(i++);
}
}
