xref: /openssh-portable/match.c (revision daa7505a)
1 /* $OpenBSD: match.c,v 1.39 2019/03/06 22:14:23 dtucker Exp $ */
2 /*
3  * Author: Tatu Ylonen <ylo@cs.hut.fi>
4  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5  *                    All rights reserved
6  * Simple pattern matching, with '*' and '?' as wildcards.
7  *
8  * As far as I am concerned, the code I have written for this software
9  * can be used freely for any purpose.  Any derived versions of this
10  * software must be clearly marked as such, and if the derived work is
11  * incompatible with the protocol description in the RFC file, it must be
12  * called by a name other than "ssh" or "Secure Shell".
13  */
14 /*
15  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
16  *
17  * Redistribution and use in source and binary forms, with or without
18  * modification, are permitted provided that the following conditions
19  * are met:
20  * 1. Redistributions of source code must retain the above copyright
21  *    notice, this list of conditions and the following disclaimer.
22  * 2. Redistributions in binary form must reproduce the above copyright
23  *    notice, this list of conditions and the following disclaimer in the
24  *    documentation and/or other materials provided with the distribution.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
27  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
28  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
29  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
30  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
31  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
32  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
33  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
34  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
35  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36  */
37 
38 #include "includes.h"
39 
40 #include <sys/types.h>
41 
42 #include <ctype.h>
43 #include <stdlib.h>
44 #include <string.h>
45 #include <stdio.h>
46 
47 #include "xmalloc.h"
48 #include "match.h"
49 #include "misc.h"
50 
51 /*
52  * Returns true if the given string matches the pattern (which may contain ?
53  * and * as wildcards), and zero if it does not match.
54  */
55 
56 int
match_pattern(const char * s,const char * pattern)57 match_pattern(const char *s, const char *pattern)
58 {
59 	for (;;) {
60 		/* If at end of pattern, accept if also at end of string. */
61 		if (!*pattern)
62 			return !*s;
63 
64 		if (*pattern == '*') {
65 			/* Skip the asterisk. */
66 			pattern++;
67 
68 			/* If at end of pattern, accept immediately. */
69 			if (!*pattern)
70 				return 1;
71 
72 			/* If next character in pattern is known, optimize. */
73 			if (*pattern != '?' && *pattern != '*') {
74 				/*
75 				 * Look instances of the next character in
76 				 * pattern, and try to match starting from
77 				 * those.
78 				 */
79 				for (; *s; s++)
80 					if (*s == *pattern &&
81 					    match_pattern(s + 1, pattern + 1))
82 						return 1;
83 				/* Failed. */
84 				return 0;
85 			}
86 			/*
87 			 * Move ahead one character at a time and try to
88 			 * match at each position.
89 			 */
90 			for (; *s; s++)
91 				if (match_pattern(s, pattern))
92 					return 1;
93 			/* Failed. */
94 			return 0;
95 		}
96 		/*
97 		 * There must be at least one more character in the string.
98 		 * If we are at the end, fail.
99 		 */
100 		if (!*s)
101 			return 0;
102 
103 		/* Check if the next character of the string is acceptable. */
104 		if (*pattern != '?' && *pattern != *s)
105 			return 0;
106 
107 		/* Move to the next character, both in string and in pattern. */
108 		s++;
109 		pattern++;
110 	}
111 	/* NOTREACHED */
112 }
113 
114 /*
115  * Tries to match the string against the
116  * comma-separated sequence of subpatterns (each possibly preceded by ! to
117  * indicate negation).  Returns -1 if negation matches, 1 if there is
118  * a positive match, 0 if there is no match at all.
119  */
120 int
match_pattern_list(const char * string,const char * pattern,int dolower)121 match_pattern_list(const char *string, const char *pattern, int dolower)
122 {
123 	char sub[1024];
124 	int negated;
125 	int got_positive;
126 	u_int i, subi, len = strlen(pattern);
127 
128 	got_positive = 0;
129 	for (i = 0; i < len;) {
130 		/* Check if the subpattern is negated. */
131 		if (pattern[i] == '!') {
132 			negated = 1;
133 			i++;
134 		} else
135 			negated = 0;
136 
137 		/*
138 		 * Extract the subpattern up to a comma or end.  Convert the
139 		 * subpattern to lowercase.
140 		 */
141 		for (subi = 0;
142 		    i < len && subi < sizeof(sub) - 1 && pattern[i] != ',';
143 		    subi++, i++)
144 			sub[subi] = dolower && isupper((u_char)pattern[i]) ?
145 			    tolower((u_char)pattern[i]) : pattern[i];
146 		/* If subpattern too long, return failure (no match). */
147 		if (subi >= sizeof(sub) - 1)
148 			return 0;
149 
150 		/* If the subpattern was terminated by a comma, then skip it. */
151 		if (i < len && pattern[i] == ',')
152 			i++;
153 
154 		/* Null-terminate the subpattern. */
155 		sub[subi] = '\0';
156 
157 		/* Try to match the subpattern against the string. */
158 		if (match_pattern(string, sub)) {
159 			if (negated)
160 				return -1;		/* Negative */
161 			else
162 				got_positive = 1;	/* Positive */
163 		}
164 	}
165 
166 	/*
167 	 * Return success if got a positive match.  If there was a negative
168 	 * match, we have already returned -1 and never get here.
169 	 */
170 	return got_positive;
171 }
172 
173 /* Match a list representing users or groups. */
174 int
match_usergroup_pattern_list(const char * string,const char * pattern)175 match_usergroup_pattern_list(const char *string, const char *pattern)
176 {
177 #ifdef HAVE_CYGWIN
178 	/* Windows usernames may be Unicode and are not case sensitive */
179 	return cygwin_ug_match_pattern_list(string, pattern);
180 #else
181 	/* Case insensitive match */
182 	return match_pattern_list(string, pattern, 0);
183 #endif
184 }
185 
186 /*
187  * Tries to match the host name (which must be in all lowercase) against the
188  * comma-separated sequence of subpatterns (each possibly preceded by ! to
189  * indicate negation).  Returns -1 if negation matches, 1 if there is
190  * a positive match, 0 if there is no match at all.
191  */
192 int
match_hostname(const char * host,const char * pattern)193 match_hostname(const char *host, const char *pattern)
194 {
195 	char *hostcopy = xstrdup(host);
196 	int r;
197 
198 	lowercase(hostcopy);
199 	r = match_pattern_list(hostcopy, pattern, 1);
200 	free(hostcopy);
201 	return r;
202 }
203 
204 /*
205  * returns 0 if we get a negative match for the hostname or the ip
206  * or if we get no match at all.  returns -1 on error, or 1 on
207  * successful match.
208  */
209 int
match_host_and_ip(const char * host,const char * ipaddr,const char * patterns)210 match_host_and_ip(const char *host, const char *ipaddr,
211     const char *patterns)
212 {
213 	int mhost, mip;
214 
215 	if ((mip = addr_match_list(ipaddr, patterns)) == -2)
216 		return -1; /* error in ipaddr match */
217 	else if (host == NULL || ipaddr == NULL || mip == -1)
218 		return 0; /* negative ip address match, or testing pattern */
219 
220 	/* negative hostname match */
221 	if ((mhost = match_hostname(host, patterns)) == -1)
222 		return 0;
223 	/* no match at all */
224 	if (mhost == 0 && mip == 0)
225 		return 0;
226 	return 1;
227 }
228 
229 /*
230  * Match user, user@host_or_ip, user@host_or_ip_list against pattern.
231  * If user, host and ipaddr are all NULL then validate pattern/
232  * Returns -1 on invalid pattern, 0 on no match, 1 on match.
233  */
234 int
match_user(const char * user,const char * host,const char * ipaddr,const char * pattern)235 match_user(const char *user, const char *host, const char *ipaddr,
236     const char *pattern)
237 {
238 	char *p, *pat;
239 	int ret;
240 
241 	/* test mode */
242 	if (user == NULL && host == NULL && ipaddr == NULL) {
243 		if ((p = strchr(pattern, '@')) != NULL &&
244 		    match_host_and_ip(NULL, NULL, p + 1) < 0)
245 			return -1;
246 		return 0;
247 	}
248 
249 	if ((p = strchr(pattern,'@')) == NULL)
250 		return match_pattern(user, pattern);
251 
252 	pat = xstrdup(pattern);
253 	p = strchr(pat, '@');
254 	*p++ = '\0';
255 
256 	if ((ret = match_pattern(user, pat)) == 1)
257 		ret = match_host_and_ip(host, ipaddr, p);
258 	free(pat);
259 
260 	return ret;
261 }
262 
263 /*
264  * Returns first item from client-list that is also supported by server-list,
265  * caller must free the returned string.
266  */
267 #define	MAX_PROP	40
268 #define	SEP	","
269 char *
match_list(const char * client,const char * server,u_int * next)270 match_list(const char *client, const char *server, u_int *next)
271 {
272 	char *sproposals[MAX_PROP];
273 	char *c, *s, *p, *ret, *cp, *sp;
274 	int i, j, nproposals;
275 
276 	c = cp = xstrdup(client);
277 	s = sp = xstrdup(server);
278 
279 	for ((p = strsep(&sp, SEP)), i=0; p && *p != '\0';
280 	    (p = strsep(&sp, SEP)), i++) {
281 		if (i < MAX_PROP)
282 			sproposals[i] = p;
283 		else
284 			break;
285 	}
286 	nproposals = i;
287 
288 	for ((p = strsep(&cp, SEP)), i=0; p && *p != '\0';
289 	    (p = strsep(&cp, SEP)), i++) {
290 		for (j = 0; j < nproposals; j++) {
291 			if (strcmp(p, sproposals[j]) == 0) {
292 				ret = xstrdup(p);
293 				if (next != NULL)
294 					*next = (cp == NULL) ?
295 					    strlen(c) : (u_int)(cp - c);
296 				free(c);
297 				free(s);
298 				return ret;
299 			}
300 		}
301 	}
302 	if (next != NULL)
303 		*next = strlen(c);
304 	free(c);
305 	free(s);
306 	return NULL;
307 }
308 
309 /*
310  * Filter proposal using pattern-list filter.
311  * "blacklist" determines sense of filter:
312  * non-zero indicates that items matching filter should be excluded.
313  * zero indicates that only items matching filter should be included.
314  * returns NULL on allocation error, otherwise caller must free result.
315  */
316 static char *
filter_list(const char * proposal,const char * filter,int blacklist)317 filter_list(const char *proposal, const char *filter, int blacklist)
318 {
319 	size_t len = strlen(proposal) + 1;
320 	char *fix_prop = malloc(len);
321 	char *orig_prop = strdup(proposal);
322 	char *cp, *tmp;
323 	int r;
324 
325 	if (fix_prop == NULL || orig_prop == NULL) {
326 		free(orig_prop);
327 		free(fix_prop);
328 		return NULL;
329 	}
330 
331 	tmp = orig_prop;
332 	*fix_prop = '\0';
333 	while ((cp = strsep(&tmp, ",")) != NULL) {
334 		r = match_pattern_list(cp, filter, 0);
335 		if ((blacklist && r != 1) || (!blacklist && r == 1)) {
336 			if (*fix_prop != '\0')
337 				strlcat(fix_prop, ",", len);
338 			strlcat(fix_prop, cp, len);
339 		}
340 	}
341 	free(orig_prop);
342 	return fix_prop;
343 }
344 
345 /*
346  * Filters a comma-separated list of strings, excluding any entry matching
347  * the 'filter' pattern list. Caller must free returned string.
348  */
349 char *
match_filter_blacklist(const char * proposal,const char * filter)350 match_filter_blacklist(const char *proposal, const char *filter)
351 {
352 	return filter_list(proposal, filter, 1);
353 }
354 
355 /*
356  * Filters a comma-separated list of strings, including only entries matching
357  * the 'filter' pattern list. Caller must free returned string.
358  */
359 char *
match_filter_whitelist(const char * proposal,const char * filter)360 match_filter_whitelist(const char *proposal, const char *filter)
361 {
362 	return filter_list(proposal, filter, 0);
363 }
364