~sapidlib-dev-core/sapidlib/devel

/* valid.c
 *
 * Tacitus @ LPUniversity
 * 23-APR-05
 * Valid hooks, inherited by Master Obj
 *
 * Changed by Tricky @ Rock the Halo
 * 13-JAN-2012
 * Now inherits the valid_* files, rather than all in one file.
 *
 */

#include "valid.h"

/* Inherits */
/* No reason for the order. */
inherit "/adm/obj/valid/file";
inherit "/adm/obj/valid/function";
inherit "/adm/obj/valid/network";
inherit "/adm/obj/valid/object";
inherit "/adm/obj/valid/security";

/* Global Variable */
mapping Access = ([ ]);
mapping Groups = ([ ]);

/* Function prototypes */
void parse_groups();
void parse_access();
string array parse(string str);
string array query_group(string group);
string array track_member(string id, string directory);
int query_access(string directory, string id, int type);
int isMember(string user, string group);

/* Functions */
void create()
{
  if (!mapp(Groups) || sizeof(Groups) < 1) parse_groups();
  if (!mapp(Access) || sizeof(Access) < 1) parse_access();
}

void parse_groups()
{
  string array lines = parse(read_file(FILE_GROUPDATA));
  int          linenum = 1;

  DEBUG("Debug [groups]: Parsing group data file...\n");
  Groups = ([ ]);

  foreach (string line in lines)
  {
    string array members;
    string       group, str;

    if (sscanf(line, "(%s)%s", group, str) != 2)
    {
      message("warning", "[groups]: Invalid format of data in group data.");
      message("warning", "[groups]: Security alert: Ignoring group on line " + linenum);

      continue;
    }

    members = explode(str, ":");

    DEBUG("Debug [groups]: Adding group '" + group + "' with " + sizeof(members) + " members.\n");

    foreach (string member in members)
    {
      if (!file_size(user_data_file(member)) && !sscanf(member, "[%*s]"))
      {
        message("warning", "[groups]: Unknown user detected.");
        message(
          "warning",
          "[groups]: Security alert: User '" + member + "' ignored for group '" + group + "'."
        );
        members -= ({ member });

        continue;
      }

      DEBUG("Debug [groups]: Adding user '" + member + "' to group '" + group + "'.\n");
    }

    Groups += ([ group: members ]);
    linenum++;
  }
}

void parse_access()
{
  string array lines = parse(read_file(FILE_ACCESSDATA));
  int          linenum = 1;

  DEBUG("Debug [access]: Parsing access data file...\n");
  Access = ([ ]);

  foreach (string line in lines)
  {
    mapping      data;
    string array entries;
    string       directory, str;

    data = ([ ]);

    if (sscanf(line, "(%s)%s", directory, str) != 2)
    {
      message("error", "[access]: Invalid format of data in access data.");
      error("Security alert: Fatal error parsing access data on line " + linenum + "\n");
    }

    if (str[<1] == ':')
    {
      message("error", "[access]: Incomplete data in access data (trailing ':').");
      error("Security alert: Fatal error parsing access data on line " + linenum + "\n");
    }

    DEBUG("Debug [access]: Parsing data for directory '" + directory + "'.\n");

    entries = explode(str, ":");

    foreach (string entry in entries)
    {
      string identity, permissions;

      if (sscanf(entry, "%s[%s]", identity, permissions) != 2)
      {
        message("error", "[access]: Invalid entry(" + entry + ") data format in access data.");
        error("Security alert: Fatal error parsing access data on line " + linenum + "\n");
      }

      DEBUG("Debug [access]: Adding identity '" + identity + "' with permission string of '" + permissions + "'.\n");

      data += ([ identity: explode(permissions, "") ]);
    }

    Access += ([ directory: data ]);
    linenum++;
  }
}

string array parse(string str)
{
  string array lines, ret = ({ });

  if (!stringp(str) || str == "") return ({ });

  lines = explode(str, "\n");

  foreach (string line in lines)
  {
    line = replace_string(line, " ", "");
    line = replace_string(line, "\t", "");

    /* Remove empty lines and lines starting with '#' */
    if (sizeof(line) && line != "" && line[0] != '#')
      ret += ({ line });
  }

  return ret;
}

int query_access(string directory, string id, int type)
{
  mapping data;
  string array permissions;

  DEBUG(
    "Debug [security]: Permission query for '" + id + "' in '" + directory + "'.\n"
  );
  data = Access[directory];

  if (!mapp(data))
  {
    string array exp;
    int sz_exp, i;

    DEBUG(
      "Debug [query_access]: " + directory +
      " not in mapping. Searching for parent permissions.\n"
    );
    exp = explode(directory, "/");
    sz_exp = sizeof(exp);

    while (!Access[directory] && sz_exp--)
    {
      directory = "/";

      for (i = 0 ; i < sz_exp ; i ++)
        directory += exp[i] + "/";
    }

    if (!Access[directory]) directory = "/";
  }

  if (!Access[directory]) return 0;
  else data = Access[directory];

  DEBUG(
    "Debug [query_access]: Final directory set to '" + directory + "'.\n"
  );
  permissions = data[id];

  if (!permissions || !arrayp(permissions) || sizeof(permissions) < 1)
    permissions = track_member(id, directory);

  if (sizeof(permissions) < 1)
  {
    DEBUG(
      "Debug [security]: Using defalt permissions for '" + id +
      "' in '" + directory + "'.\n"
    );
    permissions = data["(all)"];
  }

  if (sizeof(permissions) < 1 || !arrayp(permissions))
  {
    DEBUG(
      "Debug [security]: No permissions found for '" + id +
      "' in '" + directory + "'.\n"
    );

    return 0;
  }

  switch (type)
  {
    /* read, write, network, shadow, link, execute, bind, ownership */
    case P_READ:
      if (member_array("r", permissions) != -1)
      {
        DEBUG(
          "Debug [query_access]: Permission granted to read for " +
          directory + "\n"
        );

        return 1;
      }

      break;
    case P_WRITE:
      if (member_array("w", permissions) != -1)
      {
        DEBUG(
          "Debug [query_access]: Permission granted to write for " +
          directory + "\n"
        );

        return 1;
      }

      break;
    case P_NETWORK:
      if (member_array("n", permissions) != -1)
      {
        DEBUG(
          "Debug [query_access]: Permission granted to access network for " +
          directory + "\n"
        );

        return 1;
      }

      break;
    case P_SHADOW:
      if (member_array("s", permissions) != -1)
      {
        DEBUG(
          "Debug [query_access]: Permission granted to shadow for " +
          directory + "\n"
        );

        return 1;
      }

      break;
    case P_LINK:
      if (member_array("l", permissions) != -1)
      {
        DEBUG(
          "Debug [query_access]: Permission granted to link for " +
          directory + "\n"
        );

        return 1;
      }

      break;
    case P_EXECUTE:
      if (member_array("e", permissions) != -1)
      {
        DEBUG(
          "Debug [query_access]: Permission granted to execute for " +
          directory + "\n"
        );

        return 1;
      }

      break;
    case P_BIND:
      if (member_array("b", permissions) != -1)
      {
        DEBUG(
          "Debug [query_access]: Permission granted to bind for " +
          directory + "\n"
        );

        return 1;
      }

      break;
    case P_OWNERSHIP:
      if (member_array("o", permissions) != -1)
      {
        DEBUG(
          "Debug [query_access]: Permission granted as ownership for " +
          directory + "\n"
        );

        return 1;
      }

      break;
  }

  DEBUG("Debug [query_access]: Permission denied (" + type + ").\n");

  return 0;
}

string array track_member(string id, string directory)
{
  mapping data = Access[directory];
  string array ks = keys(data);
  string array groupData;
  int i, sz_ks = sizeof(ks);

  DEBUG(
    "Debug [security]: Tracking member '" + id +
    "' for '" + directory + "'.\n"
  );

  for (i = 0 ; i < sz_ks ; i++)
  {
    groupData = query_group(ks[i]);

    if (!arrayp(groupData) || sizeof(groupData) < 1) continue;
    if (member_array(id, groupData) != -1) return data[ks[i]];
  }

  return ({ });
}

string array query_group(string group)
{
  if (!Groups[group]) sscanf(group, "(%s)", group);

  return Groups[group];
}

int isMember(string user, string group)
{
  string array data;
  int i;

  if (!user || !group) return 0;

  data = Groups[group];

  if (!arrayp(data)) return 0;

  for (i = 0 ; i < sizeof(data) ; i++)
  {
    string group_name;

    if (!stringp(data[i])) continue;
    if (sscanf(data[i], "(%s)", group_name))
      data += Groups[group_name];
  }

  if (member_array(user, data) != -1) return 1;
  else return 0;
}