1 /*
2  * Copyright (c) 2022 Omar Polo <op@omarpolo.com>
3  * Copyright (c) 2007-2016 Reyk Floeter <reyk@openbsd.org>
4  * Copyright (c) 2004, 2005 Esben Norby <norby@openbsd.org>
5  * Copyright (c) 2004 Ryan McBride <mcbride@openbsd.org>
6  * Copyright (c) 2002, 2003, 2004 Henning Brauer <henning@openbsd.org>
7  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
8  * Copyright (c) 2001 Daniel Hartmeier.  All rights reserved.
9  * Copyright (c) 2001 Theo de Raadt.  All rights reserved.
10  *
11  * Permission to use, copy, modify, and distribute this software for any
12  * purpose with or without fee is hereby granted, provided that the above
13  * copyright notice and this permission notice appear in all copies.
14  *
15  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
16  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
17  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
18  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
19  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
20  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
21  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
22  */
23 
24 %{
25 #include <sys/types.h>
26 #include <sys/queue.h>
27 #include <sys/tree.h>
28 #include <sys/uio.h>
29 
30 #include <err.h>
31 #include <event.h>
32 #include <netdb.h>
33 #include <stdio.h>
34 #include <stdlib.h>
35 #include <limits.h>
36 #include <stdarg.h>
37 #include <stdint.h>
38 #include <string.h>
39 #include <unistd.h>
40 #include <ctype.h>
41 #include <errno.h>
42 #include <fcntl.h>
43 #include <pwd.h>
44 #include <imsg.h>
45 
46 #include "log.h"
47 #include "proc.h"
48 
49 #include "galileo.h"
50 
51 TAILQ_HEAD(files, file)		 files = TAILQ_HEAD_INITIALIZER(files);
52 static struct file {
53 	TAILQ_ENTRY(file)	 entry;
54 	FILE			*stream;
55 	char			*name;
56 	size_t			 ungetpos;
57 	size_t			 ungetsize;
58 	u_char			*ungetbuf;
59 	int			 eof_reached;
60 	int			 lineno;
61 	int			 errors;
62 } *file, *topfile;
63 struct file	*pushfile(const char *, int);
64 int		 popfile(void);
65 int		 yyparse(void);
66 int		 yylex(void);
67 int		 yyerror(const char *, ...)
68     __attribute__((__format__ (printf, 1, 2)))
69     __attribute__((__nonnull__ (1)));
70 int		 kw_cmp(const void *, const void *);
71 int		 lookup(char *);
72 int		 igetc(void);
73 int		 lgetc(int);
74 void		 lungetc(int);
75 int		 findeol(void);
76 
77 TAILQ_HEAD(symhead, sym)	 symhead = TAILQ_HEAD_INITIALIZER(symhead);
78 struct sym {
79 	TAILQ_ENTRY(sym)	 entry;
80 	int			 used;
81 	int			 persist;
82 	char			*nam;
83 	char			*val;
84 };
85 int		 symset(const char *, const char *, int);
86 char		*symget(const char *);
87 
88 int		 getservice(const char *);
89 
90 static struct galileo	*conf = NULL;
91 static struct server	*srv = NULL;
92 static int		 errors;
93 
94 typedef struct {
95 	union {
96 		int64_t		 number;
97 		char		*string;
98 	} v;
99 	int lineno;
100 } YYSTYPE;
101 
102 %}
103 
104 %token	INCLUDE ERROR
105 %token	CHROOT HOSTNAME PORT PREFORK PROXY SERVER SOURCE STYLESHEET
106 %type	<v.number>	NUMBER
107 %type	<v.number>	port
108 %type	<v.string>	STRING
109 %type	<v.string>	string
110 
111 %%
112 
113 grammar		: /* empty */
114 		| grammar include '\n'
115 		| grammar '\n'
116 		| grammar varset '\n'
117 		| grammar main '\n'
118 		| grammar server '\n'
119 		| grammar error '\n'		{ file->errors++; }
120 		;
121 
122 include		: INCLUDE string {
123 			struct file *nfile;
124 
125 			if ((nfile = pushfile($2, 0)) == NULL) {
126 				yyerror("failed to include file %s", $2);
127 				free($2);
128 				YYERROR;
129 			}
130 			free($2);
131 
132 			file = nfile;
133 			lungetc('\n');
134 		}
135 		;
136 
137 varset		: STRING '=' STRING {
138 			char *s = $1;
139 			while (*s++) {
140 				if (isspace((unsigned char)*s)) {
141 					yyerror("macro name cannot contain "
142 					    "whitespace");
143 					free($1);
144 					free($3);
145 					YYERROR;
146 				}
147 			}
148 			if (symset($1, $3, 0) == -1)
149 				fatalx("cannot store variable");
150 			free($1);
151 			free($3);
152 		}
153 		;
154 
155 main		: PREFORK NUMBER {
156 			if ($2 <= 0 || $2 > PROC_MAX_INSTANCES) {
157 				yyerror("invalid number of preforked "
158 				    "servers: %lld", $2);
159 				YYERROR;
160 			}
161 			conf->sc_prefork = $2;
162 		}
163 		| CHROOT STRING {
164 			size_t n;
165 
166 			n = strlcpy(conf->sc_chroot, $2,
167 			    sizeof(conf->sc_chroot));
168 			if (n >= sizeof(conf->sc_chroot))
169 				yyerror("chroot path too long!");
170 			free($2);
171 		}
172 		;
173 
174 server		: SERVER STRING {
175 			struct server	*s;
176 			size_t		 n;
177 
178 			if ((s = calloc(1, sizeof(*s))) == NULL)
179 				fatal("calloc");
180 
181 			n = strlcpy(s->srv_conf.host, $2,
182 			    sizeof(s->srv_conf.host));
183 			if (n >= sizeof(s->srv_conf.host)) {
184 				yyerror("server name too long");
185 				free($2);
186 				free(s);
187 				YYERROR;
188 			}
189 			free($2);
190 
191 			srv = s;
192 			TAILQ_INSERT_TAIL(&conf->sc_servers, srv, srv_entry);
193 		} '{' optnl serveropts_l '}' {
194 			/* check if duplicate */
195 			/* eventually load the tls certs */
196 
197 			srv = NULL;
198 		}
199 		;
200 
201 serveropts_l	: serveropts_l serveroptsl nl
202 		| serveroptsl optnl
203 		;
204 
205 serveroptsl	: PROXY STRING	{
206 			/* ... */
207 		}
208 		| PROXY '{' optnl proxyopts_l '}'
209 		| STYLESHEET string {
210 			size_t n;
211 
212 			n = strlcpy(srv->srv_conf.stylesheet, $2,
213 			    sizeof(srv->srv_conf.stylesheet));
214 			if (n >= sizeof(srv->srv_conf.stylesheet))
215 				yyerror("stylesheet path too long!");
216 			free($2);
217 		}
218 		;
219 
220 proxyopts_l	: proxyopts_l proxyoptsl nl
221 		| proxyoptsl optnl
222 		;
223 
224 proxyoptsl	: SOURCE STRING PORT port {
225 			size_t n;
226 
227 			n = strlcpy(srv->srv_conf.proxy_addr, $2,
228 			    sizeof(srv->srv_conf.proxy_addr));
229 			if (n >= sizeof(srv->srv_conf.proxy_addr))
230 				yyerror("proxy source too long!");
231 			srv->srv_conf.proxy_port = $4;
232 
233 			free($2);
234 		}
235 		| HOSTNAME STRING {
236 			size_t n;
237 
238 			n = strlcpy(srv->srv_conf.proxy_name, $2,
239 			    sizeof(srv->srv_conf.proxy_name));
240 			if (n >= sizeof(srv->srv_conf.proxy_name))
241 				yyerror("proxy hostname too long!");
242 			free($2);
243 		}
244 		;
245 
246 port		: NUMBER {
247 			if ($1 <= 0 || $1 > (int)USHRT_MAX) {
248 				yyerror("invalid port: %lld", $1);
249 				YYERROR;
250 			}
251 			$$ = $1;
252 		}
253 		| STRING {
254 			int val;
255 
256 			if ((val = getservice($1)) == -1) {
257 				yyerror("invalid port: %s", $1);
258 				free($1);
259 				YYERROR;
260 			}
261 			free($1);
262 			$$ = val;
263 		}
264 		;
265 
266 string		: STRING string {
267 			if (asprintf(&$$, "%s%s", $1, $2) == -1)
268 				fatal("asprintf string");
269 			free($1);
270 			free($2);
271 		}
272 		| STRING
273 		;
274 
275 optnl		: '\n' optnl
276 		|
277 		;
278 
279 nl		: '\n' optnl
280 		;
281 
282 %%
283 
284 struct keywords {
285 	const char	*k_name;
286 	int		 k_val;
287 };
288 
289 int
290 yyerror(const char *fmt, ...)
291 {
292 	va_list	 ap;
293 	char	*msg;
294 
295 	file->errors++;
296 	va_start(ap, fmt);
297 	if (vasprintf(&msg, fmt, ap) == -1)
298 		fatal("yyerror vasprintf");
299 	va_end(ap);
300 	log_warnx("%s:%d: %s", file->name, yylval.lineno, msg);
301 	free(msg);
302 	return (0);
303 }
304 
305 int
306 kw_cmp(const void *k, const void *e)
307 {
308 	return (strcmp(k, ((const struct keywords *)e)->k_name));
309 }
310 
311 int
312 lookup(char *s)
313 {
314 	/* this has to be sorted always */
315 	static const struct keywords keywords[] = {
316 		{ "chroot",	CHROOT },
317 		{ "hostname",	HOSTNAME },
318 		{ "include",	INCLUDE },
319 		{ "port",	PORT },
320 		{ "prefork",	PREFORK },
321 		{ "proxy",	PROXY },
322 		{ "server",	SERVER },
323 		{ "source",	SOURCE },
324 		{ "stylesheet",	STYLESHEET},
325 	};
326 	const struct keywords	*p;
327 
328 	p = bsearch(s, keywords, nitems(keywords), sizeof(keywords[0]),
329 	    kw_cmp);
330 
331 	if (p)
332 		return (p->k_val);
333 	else
334 		return (STRING);
335 }
336 
337 #define START_EXPAND	1
338 #define DONE_EXPAND	2
339 
340 static int	expanding;
341 
342 int
343 igetc(void)
344 {
345 	int	c;
346 
347 	while (1) {
348 		if (file->ungetpos > 0)
349 			c = file->ungetbuf[--file->ungetpos];
350 		else
351 			c = getc(file->stream);
352 
353 		if (c == START_EXPAND)
354 			expanding = 1;
355 		else if (c == DONE_EXPAND)
356 			expanding = 0;
357 		else
358 			break;
359 	}
360 	return (c);
361 }
362 
363 int
364 lgetc(int quotec)
365 {
366 	int		c, next;
367 
368 	if (quotec) {
369 		if ((c = igetc()) == EOF) {
370 			yyerror("reached end of file while parsing "
371 			    "quoted string");
372 			if (file == topfile || popfile() == EOF)
373 				return (EOF);
374 			return (quotec);
375 		}
376 		return (c);
377 	}
378 
379 	while ((c = igetc()) == '\\') {
380 		next = igetc();
381 		if (next != '\n') {
382 			c = next;
383 			break;
384 		}
385 		yylval.lineno = file->lineno;
386 		file->lineno++;
387 	}
388 	if (c == '\t' || c == ' ') {
389 		/* Compress blanks to a single space. */
390 		do {
391 			c = getc(file->stream);
392 		} while (c == '\t' || c == ' ');
393 		ungetc(c, file->stream);
394 		c = ' ';
395 	}
396 
397 	if (c == EOF) {
398 		/*
399 		 * Fake EOL when hit EOF for the first time. This gets line
400 		 * count right if last line in included file is syntactically
401 		 * invalid and has no newline.
402 		 */
403 		if (file->eof_reached == 0) {
404 			file->eof_reached = 1;
405 			return ('\n');
406 		}
407 		while (c == EOF) {
408 			if (file == topfile || popfile() == EOF)
409 				return (EOF);
410 			c = igetc();
411 		}
412 	}
413 	return (c);
414 }
415 
416 void
417 lungetc(int c)
418 {
419 	if (c == EOF)
420 		return;
421 
422 	if (file->ungetpos >= file->ungetsize) {
423 		void *p = reallocarray(file->ungetbuf, file->ungetsize, 2);
424 		if (p == NULL)
425 			err(1, "%s", __func__);
426 		file->ungetbuf = p;
427 		file->ungetsize *= 2;
428 	}
429 	file->ungetbuf[file->ungetpos++] = c;
430 }
431 
432 int
433 findeol(void)
434 {
435 	int	c;
436 
437 	/* skip to either EOF or the first real EOL */
438 	while (1) {
439 		c = lgetc(0);
440 		if (c == '\n') {
441 			file->lineno++;
442 			break;
443 		}
444 		if (c == EOF)
445 			break;
446 	}
447 	return (ERROR);
448 }
449 
450 int
451 yylex(void)
452 {
453 	char	 buf[8096];
454 	char	*p, *val;
455 	int	 quotec, next, c;
456 	int	 token;
457 
458 top:
459 	p = buf;
460 	while ((c = lgetc(0)) == ' ' || c == '\t')
461 		; /* nothing */
462 
463 	yylval.lineno = file->lineno;
464 	if (c == '#')
465 		while ((c = lgetc(0)) != '\n' && c != EOF)
466 			; /* nothing */
467 	if (c == '$' && !expanding) {
468 		while (1) {
469 			if ((c = lgetc(0)) == EOF)
470 				return (0);
471 
472 			if (p + 1 >= buf + sizeof(buf) - 1) {
473 				yyerror("string too long");
474 				return (findeol());
475 			}
476 			if (isalnum(c) || c == '_') {
477 				*p++ = c;
478 				continue;
479 			}
480 			*p = '\0';
481 			lungetc(c);
482 			break;
483 		}
484 		val = symget(buf);
485 		if (val == NULL) {
486 			yyerror("macro '%s' not defined", buf);
487 			return (findeol());
488 		}
489 		p = val + strlen(val) - 1;
490 		lungetc(DONE_EXPAND);
491 		while (p >= val) {
492 			lungetc((unsigned char)*p);
493 			p--;
494 		}
495 		lungetc(START_EXPAND);
496 		goto top;
497 	}
498 
499 	switch (c) {
500 	case '\'':
501 	case '"':
502 		quotec = c;
503 		while (1) {
504 			if ((c = lgetc(quotec)) == EOF)
505 				return (0);
506 			if (c == '\n') {
507 				file->lineno++;
508 				continue;
509 			} else if (c == '\\') {
510 				if ((next = lgetc(quotec)) == EOF)
511 					return (0);
512 				if (next == quotec || next == ' ' ||
513 				    next == '\t')
514 					c = next;
515 				else if (next == '\n') {
516 					file->lineno++;
517 					continue;
518 				} else
519 					lungetc(next);
520 			} else if (c == quotec) {
521 				*p = '\0';
522 				break;
523 			} else if (c == '\0') {
524 				yyerror("syntax error");
525 				return (findeol());
526 			}
527 			if (p + 1 >= buf + sizeof(buf) - 1) {
528 				yyerror("string too long");
529 				return (findeol());
530 			}
531 			*p++ = c;
532 		}
533 		yylval.v.string = strdup(buf);
534 		if (yylval.v.string == NULL)
535 			fatal("yylex: strdup");
536 		return (STRING);
537 	}
538 
539 #define allowed_to_end_number(x) \
540 	(isspace(x) || x == ')' || x ==',' || x == '/' || x == '}' || x == '=')
541 
542 	if (c == '-' || isdigit(c)) {
543 		do {
544 			*p++ = c;
545 			if ((size_t)(p-buf) >= sizeof(buf)) {
546 				yyerror("string too long");
547 				return (findeol());
548 			}
549 		} while ((c = lgetc(0)) != EOF && isdigit(c));
550 		lungetc(c);
551 		if (p == buf + 1 && buf[0] == '-')
552 			goto nodigits;
553 		if (c == EOF || allowed_to_end_number(c)) {
554 			const char *errstr = NULL;
555 
556 			*p = '\0';
557 			yylval.v.number = strtonum(buf, LLONG_MIN,
558 			    LLONG_MAX, &errstr);
559 			if (errstr) {
560 				yyerror("\"%s\" invalid number: %s",
561 				    buf, errstr);
562 				return (findeol());
563 			}
564 			return (NUMBER);
565 		} else {
566 nodigits:
567 			while (p > buf + 1)
568 				lungetc((unsigned char)*--p);
569 			c = (unsigned char)*--p;
570 			if (c == '-')
571 				return (c);
572 		}
573 	}
574 
575 #define allowed_in_string(x) \
576 	(isalnum(x) || (ispunct(x) && x != '(' && x != ')' && \
577 	x != '{' && x != '}' && \
578 	x != '!' && x != '=' && x != '#' && \
579 	x != ','))
580 
581 	if (isalnum(c) || c == ':' || c == '_' || c == '/') {
582 		do {
583 			*p++ = c;
584 			if ((size_t)(p-buf) >= sizeof(buf)) {
585 				yyerror("string too long");
586 				return (findeol());
587 			}
588 		} while ((c = lgetc(0)) != EOF && (allowed_in_string(c)));
589 		lungetc(c);
590 		*p = '\0';
591 		if ((token = lookup(buf)) == STRING)
592 			if ((yylval.v.string = strdup(buf)) == NULL)
593 				fatal("yylex: strdup");
594 		return (token);
595 	}
596 	if (c == '\n') {
597 		yylval.lineno = file->lineno;
598 		file->lineno++;
599 	}
600 	if (c == EOF)
601 		return (0);
602 	return (c);
603 }
604 
605 struct file *
606 pushfile(const char *name, int secret)
607 {
608 	struct file	*nfile;
609 
610 	if ((nfile = calloc(1, sizeof(struct file))) == NULL) {
611 		log_warn("%s", __func__);
612 		return (NULL);
613 	}
614 	if ((nfile->name = strdup(name)) == NULL) {
615 		log_warn("%s", __func__);
616 		free(nfile);
617 		return (NULL);
618 	}
619 	if ((nfile->stream = fopen(nfile->name, "r")) == NULL) {
620 		free(nfile->name);
621 		free(nfile);
622 		return (NULL);
623 	}
624 	nfile->lineno = TAILQ_EMPTY(&files) ? 1 : 0;
625 	nfile->ungetsize = 16;
626 	nfile->ungetbuf = malloc(nfile->ungetsize);
627 	if (nfile->ungetbuf == NULL) {
628 		log_warn("%s", __func__);
629 		fclose(nfile->stream);
630 		free(nfile->name);
631 		free(nfile);
632 		return (NULL);
633 	}
634 	TAILQ_INSERT_TAIL(&files, nfile, entry);
635 	return (nfile);
636 }
637 
638 int
639 popfile(void)
640 {
641 	struct file	*prev;
642 
643 	if ((prev = TAILQ_PREV(file, files, entry)) != NULL)
644 		prev->errors += file->errors;
645 
646 	TAILQ_REMOVE(&files, file, entry);
647 	fclose(file->stream);
648 	free(file->name);
649 	free(file->ungetbuf);
650 	free(file);
651 	file = prev;
652 	return (file ? 0 : EOF);
653 }
654 
655 int
656 parse_config(const char *filename, struct galileo *env)
657 {
658 	struct sym	*sym, *next;
659 	size_t		 n;
660 
661 	conf = env;
662 
663 	n = strlcpy(conf->sc_conffile, filename, sizeof(conf->sc_conffile));
664 	if (n >= sizeof(conf->sc_conffile)) {
665 		log_warn("path too long: %s", filename);
666 		return (-1);
667 	}
668 
669 	if ((file = pushfile(filename, 0)) == NULL) {
670 		log_warn("failed to open %s", filename);
671 		return (-1);
672 	}
673 	topfile = file;
674 	setservent(1);
675 
676 	yyparse();
677 	errors = file->errors;
678 	popfile();
679 
680 	endservent();
681 
682 	/* Free macros and check which have not been used. */
683 	TAILQ_FOREACH_SAFE(sym, &symhead, entry, next) {
684 		if (!sym->used)
685 			fprintf(stderr, "warning: macro `%s' not used\n",
686 			    sym->nam);
687 		if (!sym->persist) {
688 			free(sym->nam);
689 			free(sym->val);
690 			TAILQ_REMOVE(&symhead, sym, entry);
691 			free(sym);
692 		}
693 	}
694 
695 	if (errors)
696 		return (-1);
697 
698 	return (0);
699 }
700 
701 int
702 symset(const char *nam, const char *val, int persist)
703 {
704 	struct sym	*sym;
705 
706 	TAILQ_FOREACH(sym, &symhead, entry) {
707 		if (strcmp(nam, sym->nam) == 0)
708 			break;
709 	}
710 
711 	if (sym != NULL) {
712 		if (sym->persist == 1)
713 			return (0);
714 		else {
715 			free(sym->nam);
716 			free(sym->val);
717 			TAILQ_REMOVE(&symhead, sym, entry);
718 			free(sym);
719 		}
720 	}
721 	if ((sym = calloc(1, sizeof(*sym))) == NULL)
722 		return (-1);
723 
724 	sym->nam = strdup(nam);
725 	if (sym->nam == NULL) {
726 		free(sym);
727 		return (-1);
728 	}
729 	sym->val = strdup(val);
730 	if (sym->val == NULL) {
731 		free(sym->nam);
732 		free(sym);
733 		return (-1);
734 	}
735 	sym->used = 0;
736 	sym->persist = persist;
737 	TAILQ_INSERT_TAIL(&symhead, sym, entry);
738 	return (0);
739 }
740 
741 int
742 cmdline_symset(char *s)
743 {
744 	char	*sym, *val;
745 	int	ret;
746 
747 	if ((val = strrchr(s, '=')) == NULL)
748 		return (-1);
749 	sym = strndup(s, val - s);
750 	if (sym == NULL)
751 		fatal("%s: strndup", __func__);
752 	ret = symset(sym, val + 1, 1);
753 	free(sym);
754 
755 	return (ret);
756 }
757 
758 char *
759 symget(const char *nam)
760 {
761 	struct sym	*sym;
762 
763 	TAILQ_FOREACH(sym, &symhead, entry) {
764 		if (strcmp(nam, sym->nam) == 0) {
765 			sym->used = 1;
766 			return (sym->val);
767 		}
768 	}
769 	return (NULL);
770 }
771 
772 int
773 getservice(const char *n)
774 {
775 	struct servent	*s;
776 	const char	*errstr;
777 	long long	 llval;
778 
779 	llval = strtonum(n, 0, UINT16_MAX, &errstr);
780 	if (errstr) {
781 		s = getservbyname(n, "tcp");
782 		if (s == NULL)
783 			s = getservbyname(n, "udp");
784 		if (s == NULL)
785 			return (-1);
786 		return (ntohs(s->s_port));
787 	}
788 
789 	return ((unsigned short)llval);
790 }