Date: Thu, 21 Nov 2002 22:53:01 -0800 (PST) From: Adam Migus <amigus@FreeBSD.org> To: Perforce Change Reviews <perforce@FreeBSD.org> Subject: PERFORCE change 21367 for review Message-ID: <200211220653.gAM6r1eD032322@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
http://perforce.freebsd.org/chv.cgi?CH=21367 Change 21367 by amigus@amigus_beetle on 2002/11/21 22:52:51 Clean up parsing code (use strsep()) and introduce compartment range declaration and display. Biba/MLS now accepts and reports compartment sets using a '++' notation. For example "mls/10:1++64" would denote level 10 wih compartments 1 to 64. Affected files ... .. //depot/projects/trustedbsd/mac/sys/security/mac_biba/mac_biba.c#189 edit .. //depot/projects/trustedbsd/mac/sys/security/mac_mls/mac_mls.c#150 edit Differences ... ==== //depot/projects/trustedbsd/mac/sys/security/mac_biba/mac_biba.c#189 (text+ko) ==== @@ -199,9 +199,10 @@ case MAC_BIBA_TYPE_GRADE: for (bit = 1; bit <= MAC_BIBA_MAX_COMPARTMENTS; bit++) - if (!MAC_BIBA_BIT_TEST(bit, + if (MAC_BIBA_BIT_TEST(bit, a->mbe_compartments) && - MAC_BIBA_BIT_TEST(bit, b->mbe_compartments)) + !MAC_BIBA_BIT_TEST(bit, + b->mbe_compartments)) return (0); return (a->mbe_grade >= b->mbe_grade); @@ -536,7 +537,9 @@ mac_biba_element_to_string(char *string, size_t size, struct mac_biba_element *element) { - int pos, bit = 1; + int r, bit, pbit; + size_t left, len; + char *p; switch (element->mbe_type) { case MAC_BIBA_TYPE_HIGH: @@ -549,15 +552,39 @@ return (snprintf(string, size, "equal")); case MAC_BIBA_TYPE_GRADE: - pos = snprintf(string, size, "%d:", element->mbe_grade); - for (bit = 1; bit <= MAC_BIBA_MAX_COMPARTMENTS; bit++) { - if (MAC_BIBA_BIT_TEST(bit, element->mbe_compartments)) - pos += snprintf(string + pos, size - pos, - "%d+", bit); - } - if (string[pos - 1] == '+' || string[pos - 1] == ':') - string[--pos] = '\0'; - return (pos); + bit = pbit = r = 0; + left = size; + + p = string + (len = snprintf(string, left, "%d:", + element->mbe_grade)); + left -= len; + + do { + pbit = bit++; + len = 0; + if (bit <= MAC_BIBA_MAX_COMPARTMENTS && + MAC_BIBA_BIT_TEST(bit, element->mbe_compartments)) { + if (pbit == bit - 1) { + if (r == 0) + p += len = snprintf(p, left, + "%d+", bit); + r++; + } + } else { + if (r > 2) + p += len = snprintf(p, left, "+%d+", + pbit); + else if (r > 1) + p += len = snprintf(p, left, "%d+", + pbit); + r = 0; + } + left -= len; + } while(bit <= MAC_BIBA_MAX_COMPARTMENTS); + + len = size - left - 1; + string[len] = '\0'; + return (len); default: panic("mac_biba_element_to_string: invalid type (%d)", @@ -647,6 +674,8 @@ static int mac_biba_parse_element(struct mac_biba_element *element, char *string) { + char *p, *tp, *np; + int crange, d, i; if (strcmp(string, "high") == 0 || strcmp(string, "hi") == 0) { @@ -661,41 +690,39 @@ element->mbe_type = MAC_BIBA_TYPE_EQUAL; element->mbe_grade = MAC_BIBA_TYPE_UNDEF; } else { - char *p0, *p1; - int d; - - p0 = string; - d = strtol(p0, &p1, 10); - + d = strtol(string, &p, 10); if (d < 0 || d > 65535) return (EINVAL); + element->mbe_type = MAC_BIBA_TYPE_GRADE; element->mbe_grade = d; - if (*p1 != ':') { - if (p1 == p0 || *p1 != '\0') + if (p == string || *p == '\0') + return (0); + if (*p != ':') + return (EINVAL); + np = ++p; + if (np == NULL || *np == '\0') + return (0); + crange = d = 0; + while ((tp = strsep(&np, "+")) != NULL) { + d = strtol(tp, &p, 10); + if (*p != '\0' || d < 1 || + d > MAC_BIBA_MAX_COMPARTMENTS || crange >= d) return (EINVAL); - else - return (0); + if (crange > 0) { + for (i = crange; i <= d; i++) + MAC_BIBA_BIT_SET(i, + element->mbe_compartments); + crange = 0; + } + if (np != NULL && *np == '+') { + ++np; + crange = d; + } else + MAC_BIBA_BIT_SET(d, element->mbe_compartments); } - else - if (*(p1 + 1) == '\0') - return (0); - - while ((p0 = ++p1)) { - d = strtol(p0, &p1, 10); - if (d < 1 || d > MAC_BIBA_MAX_COMPARTMENTS) - return (EINVAL); - - MAC_BIBA_BIT_SET(d, element->mbe_compartments); - - if (*p1 == '\0') - break; - if (p1 == p0 || *p1 != '+') - return (EINVAL); - } } - return (0); } @@ -1124,60 +1151,49 @@ static void mac_biba_create_ifnet(struct ifnet *ifnet, struct label *ifnetlabel) { - char tifname[IFNAMSIZ], ifname[IFNAMSIZ], *p, *q; - char tiflist[sizeof(trusted_interfaces)]; + char tiflist[sizeof(trusted_interfaces)], ifname[IFNAMSIZ], *p, *q; struct mac_biba *dest; - int len, grade; + int type; dest = SLOT(ifnetlabel); if (ifnet->if_type == IFT_LOOP) { - grade = MAC_BIBA_TYPE_EQUAL; + type = MAC_BIBA_TYPE_EQUAL; goto set; } if (trust_all_interfaces) { - grade = MAC_BIBA_TYPE_HIGH; + type = MAC_BIBA_TYPE_HIGH; goto set; } - grade = MAC_BIBA_TYPE_LOW; + type = MAC_BIBA_TYPE_LOW; if (trusted_interfaces[0] == '\0' || !strvalid(trusted_interfaces, sizeof(trusted_interfaces))) goto set; bzero(tiflist, sizeof(tiflist)); - for (p = trusted_interfaces, q = tiflist; *p != '\0'; p++, q++) - if(*p != ' ' && *p != '\t') - *q = *p; + bcopy(trusted_interfaces,tiflist, sizeof(tiflist)); snprintf(ifname, IFNAMSIZ, "%s%d", ifnet->if_name, ifnet->if_unit); - for (p = q = tiflist;; p++) { - if (*p == ',' || *p == '\0') { - len = p - q; - if (len < IFNAMSIZ) { - bzero(tifname, sizeof(tifname)); - bcopy(q, tifname, len); - if (strcmp(tifname, ifname) == 0) { - grade = MAC_BIBA_TYPE_HIGH; - break; - } - } else { - *p = '\0'; - printf("mac_biba warning: interface name " - "\"%s\" is too long (must be < %d)\n", - q, IFNAMSIZ); + p = q = tiflist; + while ((p = strsep(&q, ", \t")) != NULL) { + if (strlen(p) < IFNAMSIZ) { + if (strcmp(p, ifname) == 0) { + type = MAC_BIBA_TYPE_HIGH; + break; } if (*p == '\0') break; q = p + 1; } + p = q; } set: - mac_biba_set_single(dest, grade, 0, NULL); - mac_biba_set_range(dest, grade, 0, NULL, grade, 0, NULL); + mac_biba_set_single(dest, type, 0, NULL); + mac_biba_set_range(dest, type, 0, NULL, type, 0, NULL); } static void ==== //depot/projects/trustedbsd/mac/sys/security/mac_mls/mac_mls.c#150 (text+ko) ==== @@ -501,7 +501,9 @@ mac_mls_element_to_string(char *string, size_t size, struct mac_mls_element *element) { - int pos, bit = 1; + int r, bit, pbit; + size_t left, len; + char *p; switch (element->mme_type) { case MAC_MLS_TYPE_HIGH: @@ -514,15 +516,39 @@ return (snprintf(string, size, "equal")); case MAC_MLS_TYPE_LEVEL: - pos = snprintf(string, size, "%d:", element->mme_level); - for (bit = 1; bit <= MAC_MLS_MAX_COMPARTMENTS; bit++) { - if (MAC_MLS_BIT_TEST(bit, element->mme_compartments)) - pos += snprintf(string + pos, size - pos, - "%d+", bit); - } - if (string[pos - 1] == '+' || string[pos - 1] == ':') - string[--pos] = NULL; - return (pos); + bit = pbit = r = 0; + left = size; + + p = string + (len = snprintf(string, left, "%d:", + element->mme_level)); + left -= len; + + do { + pbit = bit++; + len = 0; + if (bit <= MAC_MLS_MAX_COMPARTMENTS && + MAC_MLS_BIT_TEST(bit, element->mme_compartments)) { + if (pbit == bit - 1) { + if (r == 0) + p += len = snprintf(p, left, + "%d+", bit); + r++; + } + } else { + if (r > 2) + p += len = snprintf(p, left, "+%d+", + pbit); + else if (r > 1) + p += len = snprintf(p, left, "%d+", + pbit); + r = 0; + } + left -= len; + } while(bit <= MAC_MLS_MAX_COMPARTMENTS); + + len = size - left - 1; + string[len] = '\0'; + return (len); default: panic("mac_mls_element_to_string: invalid type (%d)", @@ -613,6 +639,8 @@ static int mac_mls_parse_element(struct mac_mls_element *element, char *string) { + char *p, *tp, *np; + int crange, d, i; if (strcmp(string, "high") == 0 || strcmp(string, "hi") == 0) { @@ -626,42 +654,42 @@ strcmp(string, "eq") == 0) { element->mme_type = MAC_MLS_TYPE_EQUAL; element->mme_level = MAC_MLS_TYPE_UNDEF; + } else { - char *p0, *p1; - int d; - - p0 = string; - d = strtol(p0, &p1, 10); - + d = strtol(string, &p, 10); if (d < 0 || d > 65535) return (EINVAL); + element->mme_type = MAC_MLS_TYPE_LEVEL; element->mme_level = d; - if (*p1 != ':') { - if (p1 == p0 || *p1 != '\0') + if (p == string || *p == '\0') + return (0); + if (*p != ':') + return (EINVAL); + np = ++p; + if (np == NULL || *np == '\0') + return (0); + crange = d = 0; + while ((tp = strsep(&np, "+")) != NULL) { + d = strtol(tp, &p, 10); + if (*p != '\0' || d < 1 || + d > MAC_MLS_MAX_COMPARTMENTS || crange >= d) return (EINVAL); - else - return (0); + if (crange > 0) { + for (i = crange; i <= d; i++) + MAC_MLS_BIT_SET(i, + element->mme_compartments); + crange = 0; + } + if (np != NULL && *np == '+') { + ++np; + crange = d; + } else + MAC_MLS_BIT_SET(d, element->mme_compartments); } - else - if (*(p1 + 1) == '\0') - return (0); - while ((p0 = ++p1)) { - d = strtol(p0, &p1, 10); - if (d < 1 || d > MAC_MLS_MAX_COMPARTMENTS) - return (EINVAL); - - MAC_MLS_BIT_SET(d, element->mme_compartments); - - if (*p1 == '\0') - break; - if (p1 == p0 || *p1 != '+') - return (EINVAL); - } } - return (0); } To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe p4-projects" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200211220653.gAM6r1eD032322>