1
2 /* Copyright (c) 2008-2009 Nall Design Works
3 Copyright 2006 Trusted Computer Solutions, Inc. */
4
5 /*
6 Exported Interface
7
8 int init_translations(void);
9 void finish_context_translations(void);
10 int trans_context(const char *, char **);
11 int untrans_context(const char *, char **);
12
13 */
14
15 #include <math.h>
16 #include <glob.h>
17 #include <values.h>
18 #include <unistd.h>
19 #include <fcntl.h>
20 #include <stdlib.h>
21 #include <string.h>
22 #include <stdio.h>
23 #include <stdio_ext.h>
24 #include <ctype.h>
25 #include <selinux/selinux.h>
26 #include <selinux/context.h>
27 #include <syslog.h>
28 #include <errno.h>
29 #include <pcre2.h>
30 #include <ctype.h>
31 #include <time.h>
32 #include <sys/time.h>
33
34
35 #include "mls_level.h"
36 #include "mcstrans.h"
37
38 #define N_BUCKETS 1453
39
40 #define log_error(fmt, ...) fprintf(stderr, fmt, __VA_ARGS__)
41
42 #ifdef DEBUG
43 #define log_debug(fmt, ...) fprintf(stderr, fmt, __VA_ARGS__)
44 #else
45 #define log_debug(fmt, ...) do {} while (0)
46 #endif
47
48 static unsigned int maxbit=0;
49
50 /* Define data structures */
51 typedef struct context_map {
52 char *raw;
53 char *trans;
54 } context_map_t;
55
56 typedef struct context_map_node {
57 char *key;
58 context_map_t *map;
59 struct context_map_node *next;
60 } context_map_node_t;
61
62 typedef struct affix {
63 char *text;
64 struct affix *next;
65 } affix_t;
66
67 typedef struct word {
68 char *text;
69 ebitmap_t cat;
70 ebitmap_t normal;
71 ebitmap_t inverse;
72 struct word *next;
73 } word_t;
74
75 typedef struct word_group {
76 char *name;
77 char *whitespace;
78 char *join;
79
80 affix_t *prefixes;
81 affix_t *suffixes;
82 word_t *words;
83
84 pcre2_code *prefix_regexp;
85 pcre2_code *word_regexp;
86 pcre2_code *suffix_regexp;
87
88 ebitmap_t def;
89
90 word_t **sword;
91 unsigned int sword_len;
92
93 struct word_group *next;
94 } word_group_t;
95
96 typedef struct base_classification {
97 char *trans;
98 mls_level_t *level;
99 struct base_classification *next;
100 } base_classification_t;
101
102 typedef struct domain {
103 char *name;
104
105 context_map_node_t *raw_to_trans[N_BUCKETS];
106 context_map_node_t *trans_to_raw[N_BUCKETS];
107
108 base_classification_t *base_classifications;
109 word_group_t *groups;
110
111 pcre2_code *base_classification_regexp;
112 struct domain *next;
113 } domain_t;
114
115 static domain_t *domains;
116
117 typedef struct sens_constraint {
118 char op;
119 char *text;
120 unsigned int sens;
121 ebitmap_t cat;
122 struct sens_constraint *next;
123 } sens_constraint_t;
124
125 static sens_constraint_t *sens_constraints;
126
127 typedef struct cat_constraint {
128 char op;
129 char *text;
130 int nbits;
131 ebitmap_t mask;
132 ebitmap_t cat;
133 struct cat_constraint *next;
134 } cat_constraint_t;
135
136 static cat_constraint_t *cat_constraints;
137
138 static unsigned int
hash(const char * str)139 hash(const char *str) {
140 unsigned int hash = 5381;
141 int c;
142
143 while ((c = *(unsigned const char *)str++))
144 hash = ((hash << 5) + hash) + c;
145
146 return hash;
147 }
148
149 static int
add_to_hashtable(context_map_node_t ** table,char * key,context_map_t * map)150 add_to_hashtable(context_map_node_t **table, char *key, context_map_t *map) {
151 unsigned int bucket = hash(key) % N_BUCKETS;
152 context_map_node_t **n;
153 for (n = &table[bucket]; *n; n = &(*n)->next)
154 ;
155 *n = malloc(sizeof(context_map_node_t));
156 if (! *n)
157 goto err;
158 (*n)->key = key;
159 (*n)->map = map;
160 (*n)->next = NULL;
161 return 0;
162 err:
163 syslog(LOG_ERR, "add_to_hashtable: allocation error");
164 return -1;
165 }
166
167 static int
numdigits(unsigned int n)168 numdigits(unsigned int n)
169 {
170 int count = 1;
171 while ((n = n / 10))
172 count++;
173 return count;
174 }
175
176 static int
parse_category(ebitmap_t * e,const char * raw,int allowinverse)177 parse_category(ebitmap_t *e, const char *raw, int allowinverse)
178 {
179 int inverse = 0;
180 unsigned int low, high;
181 while (*raw) {
182 if (allowinverse && *raw == '~') {
183 inverse = !inverse;
184 raw++;
185 continue;
186 }
187 if (sscanf(raw,"c%u", &low) != 1)
188 return -1;
189 raw += numdigits(low) + 1;
190 if (*raw == '.') {
191 raw++;
192 if (sscanf(raw,"c%u", &high) != 1)
193 return -1;
194 raw += numdigits(high) + 1;
195 } else {
196 high = low;
197 }
198 while (low <= high) {
199 if (low >= maxbit)
200 maxbit = low + 1;
201 if (ebitmap_set_bit(e, low, inverse ? 0 : 1) < 0)
202 return -1;
203 low++;
204 }
205 if (*raw == ',') {
206 raw++;
207 inverse = 0;
208 } else if (*raw != '\0') {
209 return -1;
210 }
211 }
212 return 0;
213 }
214
215 static int
parse_ebitmap(ebitmap_t * e,ebitmap_t * def,const char * raw)216 parse_ebitmap(ebitmap_t *e, ebitmap_t *def, const char *raw) {
217 int rc = ebitmap_cpy(e, def);
218 if (rc < 0)
219 return rc;
220 rc = parse_category(e, raw, 1);
221 if (rc < 0)
222 return rc;
223 return 0;
224 }
225
226 static mls_level_t *
parse_raw(const char * raw)227 parse_raw(const char *raw) {
228 mls_level_t *mls = calloc(1, sizeof(mls_level_t));
229 if (!mls)
230 goto err;
231 if (sscanf(raw,"s%u", &mls->sens) != 1)
232 goto err;
233 raw += numdigits(mls->sens) + 1;
234 if (*raw == ':') {
235 raw++;
236 if (parse_category(&mls->cat, raw, 0) < 0)
237 goto err;
238 } else if (*raw != '\0') {
239 goto err;
240 }
241
242 return mls;
243
244 err:
245 ebitmap_destroy(&mls->cat);
246 free(mls);
247 return NULL;
248 }
249
250 static void
destroy_word(word_t ** list,word_t * word)251 destroy_word(word_t **list, word_t *word) {
252 if (!word) {
253 return;
254 }
255 for (; list && *list; list = &(*list)->next) {
256 if (*list == word) {
257 *list = word->next;
258 break;
259 }
260 }
261 free(word->text);
262 ebitmap_destroy(&word->cat);
263 ebitmap_destroy(&word->normal);
264 ebitmap_destroy(&word->inverse);
265 memset(word, 0, sizeof(word_t));
266 free(word);
267 }
268
269 static word_t *
create_word(word_t ** list,const char * text)270 create_word(word_t **list, const char *text) {
271 word_t *w = calloc(1, sizeof(word_t));
272 if (!w) {
273 goto err;
274 }
275 w->text = strdup(text);
276 if (!w->text) {
277 goto err;
278 }
279 if (list) {
280 for (; *list; list = &(*list)->next)
281 ;
282 *list = w;
283 }
284
285 return w;
286
287 err:
288 log_error("create_word: allocation error %s", strerror(errno));
289 destroy_word(NULL, w);
290 return NULL;
291 }
292
293 static void
destroy_group(word_group_t ** list,word_group_t * group)294 destroy_group(word_group_t **list, word_group_t *group) {
295 for (; list && *list; list = &(*list)->next) {
296 if (*list == group) {
297 *list = group->next;
298 break;
299 }
300 }
301 while(group->prefixes) {
302 affix_t *next = group->prefixes->next;
303 free(group->prefixes->text);
304 free(group->prefixes);
305 group->prefixes=next;
306 }
307 while(group->suffixes) {
308 affix_t *next = group->suffixes->next;
309 free(group->suffixes->text);
310 free(group->suffixes);
311 group->suffixes=next;
312 }
313 while(group->words)
314 destroy_word(&group->words, group->words);
315 free(group->whitespace);
316 free(group->name);
317 free(group->sword);
318 free(group->join);
319 pcre2_code_free(group->prefix_regexp);
320 pcre2_code_free(group->word_regexp);
321 pcre2_code_free(group->suffix_regexp);
322 ebitmap_destroy(&group->def);
323 free(group);
324 }
325
326 static word_group_t *
create_group(word_group_t ** list,const char * name)327 create_group(word_group_t **list, const char *name) {
328 word_group_t *group = calloc(1, sizeof(word_group_t));
329 if (!group)
330 return NULL;
331 group->name = strdup(name);
332 if (!group->name) {
333 goto err;
334 }
335 group->join = strdup(" ");
336 if (!group->join) {
337 goto err;
338 }
339 group->whitespace = strdup(" ");
340 if (!group->whitespace) {
341 goto err;
342 }
343 group->sword = NULL;
344
345 if (list) {
346 for (; *list; list = &(*list)->next)
347 ;
348 *list = group;
349 }
350
351 return group;
352
353 err:
354 log_error("allocation error %s", strerror(errno));
355 destroy_group(NULL, group);
356 return NULL;
357 }
358
359 static void
destroy_domain(domain_t * domain)360 destroy_domain(domain_t *domain) {
361 int i;
362 unsigned int rt = 0, tr = 0;
363 for (i=0; i < N_BUCKETS; i++) {
364 context_map_node_t *ptr;
365 for (ptr = domain->trans_to_raw[i]; ptr;) {
366 context_map_node_t *t = ptr->next;
367 free(ptr);
368 ptr = t;
369 tr++;
370 }
371 domain->trans_to_raw[i] = NULL;
372 }
373 for (i=0; i < N_BUCKETS; i++) {
374 context_map_node_t *ptr;
375 for (ptr = domain->raw_to_trans[i]; ptr;) {
376 context_map_node_t *t = ptr->next;
377 free(ptr->map->raw);
378 free(ptr->map->trans);
379 free(ptr->map);
380 free(ptr);
381 ptr = t;
382 rt++;
383 }
384 domain->raw_to_trans[i] = NULL;
385 }
386 while (domain->base_classifications) {
387 base_classification_t *next = domain->base_classifications->next;
388 free(domain->base_classifications->trans);
389 ebitmap_destroy(&domain->base_classifications->level->cat);
390 free(domain->base_classifications->level);
391 free(domain->base_classifications);
392 domain->base_classifications = next;
393 }
394 pcre2_code_free(domain->base_classification_regexp);
395 while (domain->groups)
396 destroy_group(&domain->groups, domain->groups);
397 free(domain->name);
398 free(domain);
399
400 syslog(LOG_INFO, "cache sizes: tr = %u, rt = %u", tr, rt);
401 }
402
403 static domain_t *
create_domain(const char * name)404 create_domain(const char *name) {
405 domain_t *domain = calloc(1, sizeof(domain_t));
406 if (!domain) {
407 goto err;
408 }
409 domain->name = strdup(name);
410 if (!domain->name) {
411 goto err;
412 }
413
414 domain_t **d = &domains;
415 for (; *d; d = &(*d)->next)
416 ;
417 *d = domain;
418
419 return domain;
420
421 err:
422 log_error("allocation error %s", strerror(errno));
423 destroy_domain(domain);
424 return NULL;
425 }
426
427 static int
add_word(word_group_t * group,char * raw,char * trans)428 add_word(word_group_t *group, char *raw, char *trans) {
429 if (strchr(trans,'-')) {
430 log_error("'%s'is invalid because '-' is illegal in modifiers.\n", trans);
431 return -1;
432 }
433 word_t *word = create_word(&group->words, trans);
434 int rc = parse_ebitmap(&word->cat, &group->def, raw);
435 if (rc < 0) {
436 log_error(" syntax error in %s\n", raw);
437 destroy_word(&group->words, word);
438 return -1;
439 }
440 if (ebitmap_andnot(&word->normal, &word->cat, &group->def, maxbit) < 0)
441 return -1;
442
443 ebitmap_t temp;
444 if (ebitmap_xor(&temp, &word->cat, &group->def) < 0)
445 return -1;
446 if (ebitmap_and(&word->inverse, &temp, &group->def) < 0)
447 return -1;
448 ebitmap_destroy(&temp);
449
450 return 0;
451 }
452
453 static int
add_constraint(char op,char * raw,char * tok)454 add_constraint(char op, char *raw, char *tok) {
455 log_debug("%s\n", "add_constraint");
456 ebitmap_t empty;
457 ebitmap_init(&empty);
458 if (!raw || !*raw) {
459 syslog(LOG_ERR, "unable to parse line");
460 return -1;
461 }
462 if (*raw == 's') {
463 sens_constraint_t *constraint = calloc(1, sizeof(sens_constraint_t));
464 if (!constraint) {
465 log_error("allocation error %s", strerror(errno));
466 return -1;
467 }
468 if (sscanf(raw,"s%u", &constraint->sens) != 1) {
469 syslog(LOG_ERR, "unable to parse level");
470 free(constraint);
471 return -1;
472 }
473 if (parse_ebitmap(&constraint->cat, &empty, tok) < 0) {
474 syslog(LOG_ERR, "unable to parse cat");
475 free(constraint);
476 return -1;
477 }
478 if (asprintf(&constraint->text, "%s%c%s", raw, op, tok) < 0) {
479 log_error("asprintf failed %s", strerror(errno));
480 return -1;
481 }
482 constraint->op = op;
483 sens_constraint_t **p;
484 for (p= &sens_constraints; *p; p = &(*p)->next)
485 ;
486 *p = constraint;
487 return 0;
488 } else if (*raw == 'c' ) {
489 cat_constraint_t *constraint = calloc(1, sizeof(cat_constraint_t));
490 if (!constraint) {
491 log_error("allocation error %s", strerror(errno));
492 return -1;
493 }
494 if (parse_ebitmap(&constraint->mask, &empty, raw) < 0) {
495 syslog(LOG_ERR, "unable to parse mask");
496 free(constraint);
497 return -1;
498 }
499 if (parse_ebitmap(&constraint->cat, &empty, tok) < 0) {
500 syslog(LOG_ERR, "unable to parse cat");
501 ebitmap_destroy(&constraint->mask);
502 free(constraint);
503 return -1;
504 }
505 if (asprintf(&constraint->text, "%s%c%s", raw, op, tok) < 0) {
506 log_error("asprintf failed %s", strerror(errno));
507 return -1;
508 }
509 constraint->nbits = ebitmap_cardinality(&constraint->cat);
510 constraint->op = op;
511 cat_constraint_t **p;
512 for (p= &cat_constraints; *p; p = &(*p)->next)
513 ;
514 *p = constraint;
515 return 0;
516 } else {
517 return -1;
518 }
519
520 return 0;
521 }
522
523 static int
violates_constraints(mls_level_t * l)524 violates_constraints(mls_level_t *l) {
525 int nbits;
526 sens_constraint_t *s;
527 ebitmap_t common;
528 for (s=sens_constraints; s; s=s->next) {
529 if (s->sens == l->sens) {
530 if (ebitmap_and(&common, &s->cat, &l->cat) < 0)
531 return 1;
532 nbits = ebitmap_cardinality(&common);
533 ebitmap_destroy(&common);
534 if (nbits) {
535 char *text = mls_level_to_string(l);
536 syslog(LOG_WARNING, "%s violates %s", text, s->text);
537 free(text);
538 return 1;
539 }
540 }
541 }
542 cat_constraint_t *c;
543 for (c=cat_constraints; c; c=c->next) {
544 if (ebitmap_and(&common, &c->mask, &l->cat) < 0)
545 return 1;
546 nbits = ebitmap_cardinality(&common);
547 ebitmap_destroy(&common);
548 if (nbits > 0) {
549 if (ebitmap_and(&common, &c->cat, &l->cat) < 0)
550 return 1;
551 nbits = ebitmap_cardinality(&common);
552 ebitmap_destroy(&common);
553 if ((c->op == '!' && nbits) ||
554 (c->op == '>' && nbits != c->nbits)) {
555 char *text = mls_level_to_string(l);
556 syslog(LOG_WARNING, "%s violates %s (%d,%d)", text, c->text, nbits, c->nbits);
557 free(text);
558 return 1;
559 }
560 }
561 }
562 return 0;
563 }
564
565 static void
destroy_sens_constraint(sens_constraint_t ** list,sens_constraint_t * constraint)566 destroy_sens_constraint(sens_constraint_t **list, sens_constraint_t *constraint) {
567 if (!constraint) {
568 return;
569 }
570 for (; list && *list; list = &(*list)->next) {
571 if (*list == constraint) {
572 *list = constraint->next;
573 break;
574 }
575 }
576 ebitmap_destroy(&constraint->cat);
577 free(constraint->text);
578 memset(constraint, 0, sizeof(sens_constraint_t));
579 free(constraint);
580 }
581
582 static void
destroy_cat_constraint(cat_constraint_t ** list,cat_constraint_t * constraint)583 destroy_cat_constraint(cat_constraint_t **list, cat_constraint_t *constraint) {
584 if (!constraint) {
585 return;
586 }
587 for (; list && *list; list = &(*list)->next) {
588 if (*list == constraint) {
589 *list = constraint->next;
590 break;
591 }
592 }
593 ebitmap_destroy(&constraint->mask);
594 ebitmap_destroy(&constraint->cat);
595 free(constraint->text);
596 memset(constraint, 0, sizeof(cat_constraint_t));
597 free(constraint);
598 }
599
600
601 static int
add_base_classification(domain_t * domain,char * raw,char * trans)602 add_base_classification(domain_t *domain, char *raw, char *trans) {
603 mls_level_t *level = parse_raw(raw);
604 if (level) {
605 base_classification_t **i;
606 base_classification_t *base_classification = calloc(1, sizeof(base_classification_t));
607 if (!base_classification) {
608 log_error("allocation error %s", strerror(errno));
609 return -1;
610 }
611 base_classification->trans=strdup(trans);
612 if (!base_classification->trans) {
613 log_error("allocation error %s", strerror(errno));
614 free(base_classification);
615 return -1;
616 }
617 base_classification->level=level;
618
619 for (i=&domain->base_classifications; *i; i=&(*i)->next)
620 ;
621 *i = base_classification;
622 return 0;
623 }
624 log_error(" add_base_classification error %s %s\n", raw, trans);
625 return -1;
626 }
627
628 static int
add_cache(domain_t * domain,char * raw,char * trans)629 add_cache(domain_t *domain, char *raw, char *trans) {
630 context_map_t *map = calloc(1, sizeof(context_map_t));
631 if (!map) goto err;
632
633 map->raw = strdup(raw);
634 if (!map->raw) {
635 free(map);
636 goto err;
637 }
638 map->trans = strdup(trans);
639 if (!map->trans) {
640 free(map->raw);
641 free(map);
642 goto err;
643 }
644
645 log_debug(" add_cache (%s,%s)\n", raw, trans);
646 if (add_to_hashtable(domain->raw_to_trans, map->raw, map) < 0) {
647 free(map->trans);
648 free(map->raw);
649 free(map);
650 goto err;
651 }
652
653 if (add_to_hashtable(domain->trans_to_raw, map->trans, map) < 0)
654 goto err;
655
656 return 0;
657 err:
658 log_error("%s: allocation error", "add_cache");
659 return -1;
660 }
661
662 static context_map_t *
find_in_table(context_map_node_t ** table,const char * key)663 find_in_table(context_map_node_t **table, const char *key) {
664 unsigned int bucket = hash(key) % N_BUCKETS;
665 context_map_node_t **n;
666 for (n = &table[bucket]; *n; n = &(*n)->next)
667 if (!strcmp((*n)->key, key))
668 return (*n)->map;
669 return NULL;
670 }
671
672 static char *
trim(char * str,const char * whitespace)673 trim(char *str, const char *whitespace) {
674 char *p = str + strlen(str);
675
676 while (p > str && strchr(whitespace, *(p-1)) != NULL)
677 *--p = 0;
678 return str;
679 }
680
681 static char *
triml(char * str,const char * whitespace)682 triml(char *str, const char *whitespace) {
683 char *p = str;
684
685 while (*p && (strchr(whitespace, *p) != NULL))
686 p++;
687 return p;
688 }
689
690 static int
update(char ** p,char * const val)691 update(char **p, char *const val) {
692 free (*p);
693 *p = strdup(val);
694 if (!*p) {
695 log_error("allocation error %s", strerror(errno));
696 return -1;
697 }
698 return 0;
699 }
700
701 static int
append(affix_t ** affixes,const char * val)702 append(affix_t **affixes, const char *val) {
703 affix_t *affix = calloc(1, sizeof(affix_t));
704 if (!affix) {
705 goto err;
706 }
707 affix->text = strdup(val);
708 if (!affix->text)
709 goto err;
710 for (;*affixes; affixes = &(*affixes)->next)
711 ;
712 *affixes = affix;
713 return 0;
714
715 err:
716 log_error("allocation error %s", strerror(errno));
717 free(affix);
718 return -1;
719 }
720
721 static int read_translations(const char *filename);
722
723 /* Process line from translation file.
724 Remove white space and set raw do data before the "=" and tok to data after it
725 Modifies the data pointed to by the buffer parameter
726 */
727 static int
process_trans(char * buffer)728 process_trans(char *buffer) {
729 static domain_t *domain;
730 static word_group_t *group;
731 static int base_classification;
732 static int lineno = 0;
733 char op='\0';
734
735 lineno++;
736 log_debug("%d: %s", lineno, buffer);
737
738 /* zap leading whitespace */
739 buffer = triml(buffer, "\t ");
740
741 /* Ignore comments */
742 if (*buffer == '#') return 0;
743 char *comment = strpbrk (buffer, "#");
744 if (comment) {
745 *comment = '\0';
746 }
747
748 /* zap trailing whitespace */
749 buffer = trim(buffer, "\t \r\n");
750
751 if (*buffer == 0) return 0;
752
753 char *delim = strpbrk (buffer, "=!>");
754 if (! delim) {
755 syslog(LOG_ERR, "invalid line (no !, = or >) %d", lineno);
756 return -1;
757 }
758
759 op = *delim;
760 *delim = '\0';
761 char *raw = buffer;
762 char *tok = delim+1;
763
764 /* remove trailing/leading whitespace from the split tokens */
765 trim(raw, "\t ");
766 tok = triml(tok, "\t ");
767
768 if (! *raw) {
769 syslog(LOG_ERR, "invalid line %d", lineno);
770 return -1;
771 }
772
773 if (! *tok) {
774 syslog(LOG_ERR, "invalid line %d", lineno);
775 return -1;
776 }
777
778 /* constraints have different syntax */
779 if (op == '!' || op == '>') {
780 return add_constraint(op, raw, tok);
781 }
782
783 if (!strcmp(raw, "Domain")) {
784 domain = create_domain(tok);
785 group = NULL;
786 return 0;
787 }
788
789 if (!domain) {
790 domain = create_domain("Default");
791 if (!domain)
792 return -1;
793 group = NULL;
794 }
795
796 if (!group &&
797 (!strcmp(raw, "Whitespace") || !strcmp(raw, "Join") ||
798 !strcmp(raw, "Prefix") || !strcmp(raw, "Suffix") ||
799 !strcmp(raw, "Default"))) {
800 syslog(LOG_ERR, "expected ModifierGroup declaration on line %d", lineno);
801 return -1;
802 }
803
804 if (!strcmp(raw, "Include")) {
805 unsigned int n;
806 glob_t g;
807 g.gl_offs = 0;
808 if (glob(tok, GLOB_ERR, NULL, &g) < 0) {
809 globfree(&g);
810 return -1;
811 }
812 for (n=0; n < g.gl_pathc; n++) {
813 if (read_translations(g.gl_pathv[n]) < 0) {
814 globfree(&g);
815 return -1;
816 }
817 }
818 globfree(&g);
819 } else if (!strcmp(raw, "Base")) {
820 base_classification = 1;
821 } else if (!strcmp(raw, "ModifierGroup")) {
822 group = create_group(&domain->groups, tok);
823 if (!group)
824 return -1;
825 base_classification = 0;
826 } else if (!strcmp(raw, "Whitespace")) {
827 if (update (&group->whitespace, tok) < 0)
828 return -1;
829 } else if (!strcmp(raw, "Join")) {
830 if (update (&group->join, tok) < 0)
831 return -1;
832 } else if (!strcmp(raw, "Prefix")) {
833 if (append (&group->prefixes, tok) < 0)
834 return -1;
835 } else if (!strcmp(raw, "Suffix")) {
836 if (append (&group->suffixes, tok) < 0)
837 return -1;
838 } else if (!strcmp(raw, "Default")) {
839 ebitmap_t empty;
840 ebitmap_init(&empty);
841 if (parse_ebitmap(&group->def, &empty, tok) < 0) {
842 syslog(LOG_ERR, "unable to parse Default %d", lineno);
843 return -1;
844 }
845 } else if (group) {
846 if (add_word(group, raw, tok) < 0) {
847 syslog(LOG_ERR, "unable to add base_classification on line %d", lineno);
848 return -1;
849 }
850 } else {
851 if (base_classification) {
852 if (add_base_classification(domain, raw, tok) < 0) {
853 syslog(LOG_ERR, "unable to add base_classification on line %d", lineno);
854 return -1;
855 }
856 }
857 if (add_cache(domain, raw, tok) < 0)
858 return -1;
859 }
860 return 0;
861 }
862
863 int
read_translations(const char * filename)864 read_translations(const char *filename) {
865 size_t size = 0;
866 char *buffer = NULL;
867 int rval = 0;
868
869 FILE *cfg = fopen(filename,"r");
870 if (!cfg) {
871 syslog(LOG_ERR, "%s file open failed", filename);
872 return -1;
873 }
874
875 __fsetlocking(cfg, FSETLOCKING_BYCALLER);
876 while (getline(&buffer, &size, cfg) > 0) {
877 if( process_trans(buffer) < 0 ) {
878 syslog(LOG_ERR, "%s file read failed", filename);
879 rval = -1;
880 break;
881 }
882 }
883 free(buffer);
884 fclose(cfg);
885 return rval;
886 }
887
888 int
init_translations(void)889 init_translations(void) {
890 if (is_selinux_mls_enabled() <= 0)
891 return -1;
892
893 return(read_translations(selinux_translations_path()));
894 }
895
896 static char *
extract_range(const char * incon)897 extract_range(const char *incon) {
898 context_t con = context_new(incon);
899 if (!con) {
900 syslog(LOG_ERR, "extract_range context_new(%s) failed: %s", incon, strerror(errno));
901 return NULL;
902 }
903
904 const char *range = context_range_get(con);
905 if (!range) {
906 syslog(LOG_ERR, "extract_range: context_range_get(%s) failed: %m", incon);
907 context_free(con);
908 return NULL;
909 }
910 char *r = strdup(range);
911 if (!r) {
912 log_error("extract_range: allocation error %s", strerror(errno));
913 return NULL;
914 }
915 context_free(con);
916 return r;
917 }
918
919 static char *
new_context_str(const char * incon,const char * range)920 new_context_str(const char *incon, const char *range) {
921 char *rcon = NULL;
922 context_t con = context_new(incon);
923 if (!con) {
924 goto exit;
925 }
926 context_range_set(con, range);
927 rcon = strdup(context_str(con));
928 context_free(con);
929 if (!rcon) {
930 goto exit;
931 }
932
933 return rcon;
934
935 exit:
936 log_error("new_context_str: %s %s", incon, strerror(errno));
937 return NULL;
938 }
939
940 static char *
find_in_hashtable(const char * range,domain_t * domain,context_map_node_t ** table)941 find_in_hashtable(const char *range, domain_t *domain, context_map_node_t **table) {
942 char *trans = NULL;
943 context_map_t *map = find_in_table(table, range);
944 if (map) {
945 trans = strdup((table == domain->raw_to_trans) ? map->trans: map->raw);
946 if (!trans) {
947 log_error("find_in_hashtable: allocation error %s", strerror(errno));
948 return NULL;
949 }
950 log_debug(" found %s in hashtable returning %s\n", range, trans);
951 }
952 return trans;
953 }
954
955 static int
string_size(const void * p1,const void * p2)956 string_size(const void *p1, const void *p2) {
957 return strlen(*(char **)p2) - strlen(*(char **)p1);
958 }
959
960 static int
word_size(const void * p1,const void * p2)961 word_size(const void *p1, const void *p2) {
962 word_t *w1 = *(word_t **)p1;
963 word_t *w2 = *(word_t **)p2;
964 int w1_len=strlen(w1->text);
965 int w2_len=strlen(w2->text);
966 if (w1_len == w2_len)
967 return strcmp(w1->text, w2->text);
968 return (w2_len - w1_len);
969 }
970
971 static void
build_regexp(pcre2_code ** r,char * buffer)972 build_regexp(pcre2_code **r, char *buffer) {
973 int error;
974 PCRE2_SIZE error_offset;
975 if (*r)
976 pcre2_code_free(*r);
977 *r = pcre2_compile((PCRE2_SPTR8) buffer, PCRE2_ZERO_TERMINATED, PCRE2_CASELESS, &error, &error_offset, NULL);
978 if (!*r) {
979 PCRE2_UCHAR errbuf[256];
980 pcre2_get_error_message(error, errbuf, sizeof(errbuf));
981 log_error("pcre compilation of '%s' failed at offset %zu: %s\n", buffer, error_offset, errbuf);
982 }
983 buffer[0] = '\0';
984 }
985
986 static int
build_regexps(domain_t * domain)987 build_regexps(domain_t *domain) {
988 char buffer[1024 * 128];
989 buffer[0] = '\0';
990 base_classification_t *bc;
991 word_group_t *g;
992 affix_t *a;
993 word_t *w;
994 size_t n_el, i;
995
996 for (n_el = 0, bc = domain->base_classifications; bc; bc = bc->next) {
997 n_el++;
998 }
999
1000 char **sortable = calloc(n_el, sizeof(char *));
1001 if (!sortable) {
1002 log_error("allocation error %s", strerror(errno));
1003 return -1;
1004 }
1005
1006 for (i=0, bc = domain->base_classifications; bc; bc = bc->next) {
1007 sortable[i++] = bc->trans;
1008 }
1009
1010 qsort(sortable, n_el, sizeof(char *), string_size);
1011
1012 for (i = 0; i < n_el; i++) {
1013 strcat(buffer, sortable[i]);
1014 if (i < n_el) strcat(buffer,"|");
1015 }
1016
1017 free(sortable);
1018
1019 log_debug(">>> %s classification regexp=%s\n", domain->name, buffer);
1020 build_regexp(&domain->base_classification_regexp, buffer);
1021
1022 for (g = domain->groups; g; g = g->next) {
1023 if (g->prefixes) {
1024 strcat(buffer,"(?:");
1025 for (a = g->prefixes; a; a = a->next) {
1026 strcat(buffer, a->text);
1027 if (a->next) strcat(buffer,"|");
1028 }
1029 strcat(buffer,")");
1030 strcat(buffer,"[ ]+");
1031 log_debug(">>> %s %s prefix regexp=%s\n", domain->name, g->name, buffer);
1032 build_regexp(&g->prefix_regexp, buffer);
1033 }
1034
1035 if (g->prefixes)
1036 strcat(buffer, "^");
1037 strcat(buffer, "(?:");
1038
1039 g->sword_len=0;
1040 for (w = g->words; w; w = w->next)
1041 g->sword_len++;
1042
1043 g->sword = calloc(g->sword_len, sizeof(word_t *));
1044 if (!g->sword) {
1045 log_error("allocation error %s", strerror(errno));
1046 return -1;
1047 }
1048
1049 i=0;
1050 for (w = g->words; w; w = w->next)
1051 g->sword[i++]=w;
1052
1053 qsort(g->sword, g->sword_len, sizeof(word_t *), word_size);
1054
1055 for (i=0; i < g->sword_len; i++) {
1056 if (i) strcat(buffer,"|");
1057 strcat(buffer,"\\b");
1058 strcat(buffer, g->sword[i]->text);
1059 strcat(buffer,"\\b");
1060 }
1061
1062 if (g->whitespace) {
1063 strcat(buffer,"|[");
1064 strcat(buffer, g->whitespace);
1065 strcat(buffer, "]+");
1066 }
1067
1068 strcat(buffer, ")+");
1069 if (g->suffixes)
1070 strcat(buffer, "$");
1071
1072 log_debug(">>> %s %s modifier regexp=%s\n", domain->name, g->name, buffer);
1073 build_regexp(&g->word_regexp, buffer);
1074 if (g->suffixes) {
1075 strcat(buffer,"[ ]+");
1076 strcat(buffer,"(?:");
1077 for (a = g->suffixes; a; a = a->next) {
1078 strcat(buffer, a->text);
1079 if (a->next) strcat(buffer,"|");
1080 }
1081 strcat(buffer,")");
1082 log_debug(">>> %s %s suffix regexp=%s\n", domain->name, g->name, buffer);
1083 build_regexp(&g->suffix_regexp, buffer);
1084 }
1085 }
1086
1087 return 0;
1088 }
1089
1090 static char *
compute_raw_from_trans(const char * level,domain_t * domain)1091 compute_raw_from_trans(const char *level, domain_t *domain) {
1092
1093 #ifdef DEBUG
1094 struct timeval startTime;
1095 gettimeofday(&startTime, 0);
1096 #endif
1097
1098 int rc = 0;
1099 pcre2_match_data *match_data = NULL;
1100 word_group_t *g = NULL;
1101 char *work = NULL;
1102 char *r = NULL;
1103 char *match = NULL;
1104 size_t work_len;
1105 mls_level_t *mraw = NULL;
1106 ebitmap_t set, clear, tmp;
1107
1108 ebitmap_init(&set);
1109 ebitmap_init(&clear);
1110 ebitmap_init(&tmp);
1111
1112 work = strdup(level);
1113 if (!work) {
1114 log_error("compute_raw_from_trans: allocation error %s", strerror(errno));
1115 goto err;
1116 }
1117 work_len = strlen(work);
1118
1119 if (!domain->base_classification_regexp)
1120 if (build_regexps(domain) < 0)
1121 goto err;
1122 if (!domain->base_classification_regexp)
1123 goto err;
1124 log_debug(" compute_raw_from_trans work = %s\n", work);
1125 match_data = pcre2_match_data_create_from_pattern(domain->base_classification_regexp, NULL);
1126 if (!match_data) {
1127 log_error("allocation error %s", strerror(errno));
1128 goto err;
1129 }
1130 rc = pcre2_match(domain->base_classification_regexp, (PCRE2_SPTR8)work, work_len, 0, PCRE2_ANCHORED, match_data, NULL);
1131 if (rc > 0) {
1132 const PCRE2_SIZE *ovector = pcre2_get_ovector_pointer(match_data);
1133 match = strndup(work + ovector[0], ovector[1] - ovector[0]);
1134 if (!match) {
1135 log_error("allocation error %s", strerror(errno));
1136 goto err;
1137 }
1138 log_debug(" compute_raw_from_trans match = %s len = %zu\n", match, strlen(match));
1139 base_classification_t *bc;
1140 for (bc = domain->base_classifications; bc; bc = bc->next) {
1141 if (!strcmp(bc->trans, match)) {
1142 log_debug(" compute_raw_from_trans base classification %s matched %s\n", level, bc->trans);
1143 mraw = malloc(sizeof(mls_level_t));
1144 if (!mraw) {
1145 log_error("allocation error %s", strerror(errno));
1146 goto err;
1147 }
1148 if (mls_level_cpy(mraw, bc->level) < 0)
1149 goto err;
1150 break;
1151 }
1152 }
1153
1154 memset(work + ovector[0], '#', ovector[1] - ovector[0]);
1155 char *p=work + ovector[0] + ovector[1];
1156 while (*p && (strchr(" ", *p) != NULL))
1157 *p++ = '#';
1158
1159 free(match);
1160 match = NULL;
1161 } else {
1162 switch (rc) {
1163 case PCRE2_ERROR_NOMATCH:
1164 log_debug(" compute_raw_from_trans no base classification matched %s\n", level);
1165 break;
1166 default:
1167 log_error("compute_raw_from_trans: base matching error for input '%s': %d\n", level, rc);
1168 break;
1169 }
1170 }
1171
1172 pcre2_match_data_free(match_data);
1173 match_data = NULL;
1174
1175 if (mraw == NULL) {
1176 goto err;
1177 }
1178
1179 int complete = 0;
1180 int change = 1;
1181 while(change && !complete) {
1182 change = 0;
1183 for (g = domain->groups; g && !change && !complete; g = g->next) {
1184 int prefix = 0, suffix = 0;
1185 PCRE2_SIZE prefix_offset = 0, prefix_len = 0;
1186 PCRE2_SIZE suffix_offset = 0, suffix_len = 0;
1187 if (g->prefix_regexp) {
1188 match_data = pcre2_match_data_create_from_pattern(g->prefix_regexp, NULL);
1189 if (!match_data) {
1190 log_error("allocation error %s", strerror(errno));
1191 goto err;
1192 }
1193 rc = pcre2_match(g->prefix_regexp, (PCRE2_SPTR8)work, work_len, 0, 0, match_data, NULL);
1194 if (rc > 0) {
1195 const PCRE2_SIZE *ovector = pcre2_get_ovector_pointer(match_data);
1196 prefix = 1;
1197 prefix_offset = ovector[0];
1198 prefix_len = ovector[1] - ovector[0];
1199 } else if (rc != PCRE2_ERROR_NOMATCH) {
1200 log_error("compute_raw_from_trans: prefix matching error for input '%s': %d\n", level, rc);
1201 }
1202 pcre2_match_data_free(match_data);
1203 match_data = NULL;
1204 }
1205 if (g->suffix_regexp) {
1206 match_data = pcre2_match_data_create_from_pattern(g->suffix_regexp, NULL);
1207 if (!match_data) {
1208 log_error("allocation error %s", strerror(errno));
1209 goto err;
1210 }
1211 rc = pcre2_match(g->suffix_regexp, (PCRE2_SPTR8)work, work_len, 0, 0, match_data, NULL);
1212 if (rc > 0) {
1213 const PCRE2_SIZE *ovector = pcre2_get_ovector_pointer(match_data);
1214 suffix = 1;
1215 suffix_offset = ovector[0];
1216 suffix_len = ovector[1] - ovector[0];
1217 } else if (rc != PCRE2_ERROR_NOMATCH) {
1218 log_error("compute_raw_from_trans: suffix matching error for input '%s': %d\n", level, rc);
1219 }
1220 pcre2_match_data_free(match_data);
1221 match_data = NULL;
1222 }
1223
1224 /* anchors prefix ^, suffix $ */
1225 if (((!g->prefixes && !g->suffixes) ||
1226 (g->prefixes && prefix) ||
1227 (g->suffixes && suffix)) &&
1228 g->word_regexp) {
1229 char *s = work + prefix_offset + prefix_len;
1230 PCRE2_SIZE len = (suffix_len ? suffix_offset : work_len) - prefix_len - prefix_offset;
1231 match_data = pcre2_match_data_create_from_pattern(g->word_regexp, NULL);
1232 if (!match_data) {
1233 log_error("allocation error %s", strerror(errno));
1234 goto err;
1235 }
1236 rc = pcre2_match(g->word_regexp, (PCRE2_SPTR8)s, len, 0, 0, match_data, NULL);
1237 if (rc > 0) {
1238 const PCRE2_SIZE *ovector = pcre2_get_ovector_pointer(match_data);
1239 match = strndup(s + ovector[0], ovector[1] - ovector[0]);
1240 if (!match) {
1241 log_error("allocation error %s", strerror(errno));
1242 goto err;
1243 }
1244 trim(match, g->whitespace);
1245 if (*match) {
1246 char *p = triml(match, g->whitespace);
1247 while (p && *p) {
1248 int plen = strlen(p);
1249 unsigned int i;
1250 for (i = 0; i < g->sword_len; i++) {
1251 word_t *w = g->sword[i];
1252 int wlen = strlen(w->text);
1253 if (plen >= wlen && !strncmp(w->text, p, strlen(w->text))){
1254 if (ebitmap_andnot(&set, &w->cat, &g->def, maxbit) < 0) goto err;
1255
1256 if (ebitmap_xor(&tmp, &w->cat, &g->def) < 0) goto err;
1257 if (ebitmap_and(&clear, &tmp, &g->def) < 0) goto err;
1258 if (ebitmap_union(&mraw->cat, &set) < 0) goto err;
1259
1260 ebitmap_destroy(&tmp);
1261 if (ebitmap_cpy(&tmp, &mraw->cat) < 0) goto err;
1262 ebitmap_destroy(&mraw->cat);
1263 if (ebitmap_andnot(&mraw->cat, &tmp, &clear, maxbit) < 0) goto err;
1264
1265 ebitmap_destroy(&tmp);
1266 ebitmap_destroy(&set);
1267 ebitmap_destroy(&clear);
1268 p += strlen(w->text);
1269 change++;
1270 break;
1271 }
1272 }
1273 if (i == g->sword_len) {
1274 syslog(LOG_ERR, "conversion error");
1275 break;
1276 }
1277 p = triml(p, g->whitespace);
1278 }
1279 memset(work + prefix_offset, '#', prefix_len);
1280 memset(work + suffix_offset, '#', suffix_len);
1281 memset(s + ovector[0], '#', ovector[1] - ovector[0]);
1282 }
1283 free(match);
1284 match = NULL;
1285 } else if (rc != PCRE2_ERROR_NOMATCH) {
1286 log_error("compute_raw_from_trans: word matching error for input '%s' for substring '%s': %d\n", level, s, rc);
1287 }
1288 pcre2_match_data_free(match_data);
1289 match_data = NULL;
1290 }
1291 /* YYY */
1292 complete=1;
1293 char *p = work;
1294 while(*p) {
1295 if (isalnum(*p++)) {
1296 complete=0;
1297 break;
1298 }
1299 }
1300 }
1301 }
1302 free(work);
1303 if (violates_constraints(mraw)) {
1304 complete = 0;
1305 }
1306 if (complete)
1307 r = mls_level_to_string(mraw);
1308 mls_level_destroy(mraw);
1309 free(mraw);
1310
1311 #ifdef DEBUG
1312 struct timeval stopTime;
1313 gettimeofday(&stopTime, 0);
1314 long int ms;
1315 if (startTime.tv_usec > stopTime.tv_usec)
1316 ms = (stopTime.tv_sec - startTime.tv_sec - 1) * 1000 + (stopTime.tv_usec/1000 + 1000 - startTime.tv_usec/1000);
1317 else
1318 ms = (stopTime.tv_sec - startTime.tv_sec ) * 1000 + (stopTime.tv_usec/1000 - startTime.tv_usec/1000);
1319 log_debug(" compute_raw_from_trans in %ld ms'\n", ms);
1320 #endif
1321
1322 return r;
1323
1324 err:
1325 mls_level_destroy(mraw);
1326 free(mraw);
1327 free(work);
1328 free(match);
1329 ebitmap_destroy(&tmp);
1330 ebitmap_destroy(&set);
1331 ebitmap_destroy(&clear);
1332 pcre2_match_data_free(match_data);
1333 return NULL;
1334 }
1335
1336 static char *
compute_trans_from_raw(const char * level,domain_t * domain)1337 compute_trans_from_raw(const char *level, domain_t *domain) {
1338
1339 #ifdef DEBUG
1340 struct timeval startTime;
1341 gettimeofday(&startTime, 0);
1342 #endif
1343
1344 word_group_t *g;
1345 mls_level_t *l = NULL;
1346 char *rval = NULL;
1347 word_group_t *groups = NULL;
1348 ebitmap_t bit_diff, temp, handled, nothandled, unhandled, orig_unhandled;
1349
1350 ebitmap_init(&bit_diff);
1351 ebitmap_init(&temp);
1352 ebitmap_init(&handled);
1353 ebitmap_init(¬handled);
1354 ebitmap_init(&unhandled);
1355 ebitmap_init(&orig_unhandled);
1356
1357 if (!level)
1358 goto err;
1359
1360 l = parse_raw(level);
1361 if (!l)
1362 goto err;
1363 log_debug(" compute_trans_from_raw raw = %s\n", level);
1364
1365 /* YYY */
1366 /* check constraints */
1367 if (violates_constraints(l)) {
1368 syslog(LOG_ERR, "%s violates constraints", level);
1369 goto err;
1370 }
1371
1372 int doInverse = l->sens > 0;
1373
1374 base_classification_t *bc, *last = NULL;
1375 int done = 0;
1376 for (bc = domain->base_classifications; bc && !done; bc = bc->next) {
1377 if (l->sens == bc->level->sens) {
1378 /* skip if alias of last bc */
1379 if (last &&
1380 last->level->sens == bc->level->sens &&
1381 ebitmap_cmp(&last->level->cat, &bc->level->cat) == 0)
1382 continue;
1383
1384 /* compute bits not consumed by base classification */
1385 if (ebitmap_xor(&unhandled, &l->cat, &bc->level->cat) < 0)
1386 goto err;
1387 if (ebitmap_cpy(&orig_unhandled, &unhandled) < 0)
1388 goto err;
1389
1390 /* prebuild groups */
1391 for (g = domain->groups; g; g = g->next) {
1392 word_group_t **t;
1393 for (t = &groups; *t; t = &(*t)->next)
1394 if (!strcmp(g->name, (*t)->name))
1395 break;
1396
1397 if (! *t) {
1398 word_group_t *wg = create_group(&groups, g->name);
1399 if (g->prefixes)
1400 if (append(&wg->prefixes, g->prefixes->text) < 0)
1401 goto err;
1402 if (g->suffixes)
1403 if (append(&wg->suffixes, g->suffixes->text) < 0)
1404 goto err;
1405 if (g->join)
1406 if (update(&wg->join, g->join) < 0)
1407 goto err;
1408 }
1409 }
1410
1411 int loops, hamming, change=1;
1412 for (loops = 50; ebitmap_cardinality(&unhandled) && loops > 0 && change; loops--) {
1413 change = 0;
1414 hamming = 10000;
1415 if (ebitmap_xor(&handled, &unhandled, &orig_unhandled) < 0)
1416 goto err;
1417 if (ebitmap_not(¬handled, &handled, maxbit) < 0)
1418 goto err;
1419 word_group_t *currentGroup = NULL;
1420 word_t *currentWord = NULL;
1421 for (g = domain->groups; g && hamming; g = g->next) {
1422 word_t *w;
1423 for (w = g->words; w && hamming; w = w->next) {
1424 int cardinality = ebitmap_cardinality(&w->normal);
1425 /* If the word is all inverse bits and the level does not have inverse bits - skip */
1426 if (cardinality && !doInverse) {
1427 continue;
1428 }
1429
1430 /* if only unhandled bits are different */
1431 if (ebitmap_or(&temp, &w->normal, &w->inverse) < 0)
1432 goto err;
1433 if (ebitmap_and(&bit_diff, &temp, ¬handled) < 0)
1434 goto err;
1435 ebitmap_destroy(&temp);
1436 // xor bit_diff handled?
1437 if (ebitmap_and(&temp, &bit_diff, &unhandled) < 0)
1438 goto err;
1439 if (ebitmap_cmp(&bit_diff, &temp)) {
1440 int h = ebitmap_hamming_distance(&bit_diff, &unhandled);
1441 if (h < hamming) {
1442 hamming = h;
1443 currentGroup = g;
1444 currentWord = w;
1445 }
1446 }
1447 ebitmap_destroy(&bit_diff);
1448 ebitmap_destroy(&temp);
1449 }
1450 }
1451 ebitmap_destroy(&handled);
1452 ebitmap_destroy(¬handled);
1453
1454 if (currentWord) {
1455 if (ebitmap_xor(&bit_diff, ¤tWord->cat, &bc->level->cat) < 0)
1456 goto err;
1457
1458 if (ebitmap_cpy(&temp, &unhandled) < 0)
1459 goto err;
1460 ebitmap_destroy(&unhandled);
1461 if (ebitmap_andnot(&unhandled, &temp, &bit_diff, maxbit) < 0)
1462 goto err;
1463
1464 ebitmap_destroy(&bit_diff);
1465 ebitmap_destroy(&temp);
1466
1467 word_group_t **t;
1468 for (t = &groups; *t; t = &(*t)->next)
1469 if (!strcmp(currentGroup->name, (*t)->name))
1470 break;
1471 create_word(&(*t)->words, currentWord->text);
1472 change++;
1473 }
1474 }
1475
1476 done = (ebitmap_cardinality(&unhandled) == 0);
1477 ebitmap_destroy(&unhandled);
1478 ebitmap_destroy(&orig_unhandled);
1479 if (done) {
1480 char buffer[9999];
1481 buffer[0] = 0;
1482 strcat(buffer, bc->trans);
1483 strcat(buffer, " ");
1484 for (g=groups; g; g = g->next) {
1485 if (g->words && g->prefixes) {
1486 strcat(buffer, g->prefixes->text);
1487 strcat(buffer, " ");
1488 }
1489 word_t *w;
1490 for (w=g->words; w; w = w->next) {
1491 strcat(buffer, w->text);
1492 if (w->next)
1493 strcat(buffer, g->join);
1494 }
1495 if (g->words && g->suffixes) {
1496 strcat(buffer, " ");
1497 strcat(buffer, g->suffixes->text);
1498 }
1499 word_group_t *n = g->next;
1500 while(g->words && n) {
1501 if (n->words) {
1502 strcat(buffer, " ");
1503 break;
1504 }
1505 n = n->next;
1506 }
1507 }
1508 rval = strdup(buffer);
1509 if (!rval) {
1510 log_error("compute_trans_from_raw: allocation error %s", strerror(errno));
1511 goto err;
1512 }
1513 }
1514 /* clean up */
1515 while (groups)
1516 destroy_group(&groups, groups);
1517 }
1518 last = bc;
1519 }
1520 if (l) {
1521 mls_level_destroy(l);
1522 free(l);
1523 }
1524
1525 #ifdef DEBUG
1526 struct timeval stopTime;
1527 gettimeofday(&stopTime, 0);
1528 long int ms;
1529 if (startTime.tv_usec > stopTime.tv_usec)
1530 ms = (stopTime.tv_sec - startTime.tv_sec - 1) * 1000 + (stopTime.tv_usec/1000 + 1000 - startTime.tv_usec/1000);
1531 else
1532 ms = (stopTime.tv_sec - startTime.tv_sec ) * 1000 + (stopTime.tv_usec/1000 - startTime.tv_usec/1000);
1533
1534 log_debug(" compute_trans_from_raw in %ld ms'\n", ms);
1535 #endif
1536
1537 return rval;
1538
1539 err:
1540 while (groups)
1541 destroy_group(&groups, groups);
1542 mls_level_destroy(l);
1543 free(l);
1544 return NULL;
1545 }
1546
1547 int
trans_context(const char * incon,char ** rcon)1548 trans_context(const char *incon, char **rcon) {
1549 char *trans = NULL;
1550 *rcon = NULL;
1551
1552 #ifdef DEBUG
1553 struct timeval startTime;
1554 gettimeofday(&startTime, 0);
1555 #endif
1556
1557 log_debug(" trans_context input = %s\n", incon);
1558 char *range = extract_range(incon);
1559 if (!range) return -1;
1560
1561 domain_t *domain = domains;
1562 for (;domain; domain = domain->next) {
1563 trans = find_in_hashtable(range, domain, domain->raw_to_trans);
1564 if (trans) break;
1565
1566 /* try split and translate */
1567 char *lrange = NULL, *urange = NULL;
1568 char *ltrans = NULL, *utrans = NULL;
1569 char *dashp = strchr(range,'-');
1570 if (dashp) {
1571 *dashp = 0;
1572 lrange = range;
1573 urange = dashp+1;
1574 } else {
1575 trans = compute_trans_from_raw(range, domain);
1576 if (trans)
1577 if (add_cache(domain, range, trans) < 0) {
1578 free(trans);
1579 free(range);
1580 return -1;
1581 }
1582 }
1583
1584 if (lrange && urange) {
1585 ltrans = find_in_hashtable(lrange, domain, domain->raw_to_trans);
1586 if (! ltrans) {
1587 ltrans = compute_trans_from_raw(lrange, domain);
1588 if (ltrans) {
1589 if (add_cache(domain, lrange, ltrans) < 0) {
1590 free(ltrans);
1591 free(range);
1592 return -1;
1593 }
1594 } else {
1595 ltrans = strdup(lrange);
1596 if (! ltrans) {
1597 log_error("strdup failed %s", strerror(errno));
1598 free(range);
1599 return -1;
1600 }
1601 }
1602 }
1603
1604 utrans = find_in_hashtable(urange, domain, domain->raw_to_trans);
1605 if (! utrans) {
1606 utrans = compute_trans_from_raw(urange, domain);
1607 if (utrans) {
1608 if (add_cache(domain, urange, utrans) < 0) {
1609 free(utrans);
1610 free(ltrans);
1611 free(range);
1612 return -1;
1613 }
1614 } else {
1615 utrans = strdup(urange);
1616 if (! utrans) {
1617 log_error("strdup failed %s", strerror(errno));
1618 free(ltrans);
1619 free(range);
1620 return -1;
1621 }
1622 }
1623 }
1624
1625 if (strcmp(ltrans, utrans) == 0) {
1626 if (asprintf(&trans, "%s", ltrans) < 0) {
1627 log_error("asprintf failed %s", strerror(errno));
1628 free(utrans);
1629 free(ltrans);
1630 free(range);
1631 return -1;
1632 }
1633 } else {
1634 if (asprintf(&trans, "%s-%s", ltrans, utrans) < 0) {
1635 log_error("asprintf failed %s", strerror(errno));
1636 free(utrans);
1637 free(ltrans);
1638 free(range);
1639 return -1;
1640 }
1641 }
1642 free(ltrans);
1643 free(utrans);
1644 *dashp = '-';
1645 break;
1646 }
1647 if (dashp)
1648 *dashp = '-';
1649 if (trans) {
1650 free(trans);
1651 trans = NULL;
1652 }
1653 }
1654
1655 if (trans) {
1656 *rcon = new_context_str(incon, trans);
1657 free(trans);
1658 } else {
1659 *rcon = new_context_str(incon, range);
1660 }
1661 free(range);
1662
1663 #ifdef DEBUG
1664 struct timeval stopTime;
1665 gettimeofday(&stopTime, 0);
1666 long int ms;
1667 if (startTime.tv_usec > stopTime.tv_usec)
1668 ms = (stopTime.tv_sec - startTime.tv_sec - 1) * 1000 + (stopTime.tv_usec/1000 + 1000 - startTime.tv_usec/1000);
1669 else
1670 ms = (stopTime.tv_sec - startTime.tv_sec ) * 1000 + (stopTime.tv_usec/1000 - startTime.tv_usec/1000);
1671
1672 log_debug(" trans_context input='%s' output='%s in %ld ms'\n", incon, *rcon, ms);
1673 #endif
1674 return 0;
1675 }
1676
1677 int
untrans_context(const char * incon,char ** rcon)1678 untrans_context(const char *incon, char **rcon) {
1679 char *raw = NULL;
1680 *rcon = NULL;
1681
1682 #ifdef DEBUG
1683 struct timeval startTime;
1684 gettimeofday(&startTime, 0);
1685 #endif
1686
1687 log_debug(" untrans_context incon = %s\n", incon);
1688 char *range = extract_range(incon);
1689 if (!range) return -1;
1690 log_debug(" untrans_context range = %s\n", range);
1691
1692 domain_t *domain = domains;
1693 for (;domain; domain = domain->next) {
1694 raw = find_in_hashtable(range, domain, domain->trans_to_raw);
1695 if (raw) break;
1696
1697 /* try split and translate */
1698 char *lrange = NULL, *urange = NULL;
1699 char *lraw = NULL, *uraw = NULL;
1700 char *dashp = strchr(range,'-');
1701 if (dashp) {
1702 *dashp = 0;
1703 lrange = range;
1704 urange = dashp+1;
1705 } else {
1706 raw = compute_raw_from_trans(range, domain);
1707 if (raw) {
1708 char *canonical = find_in_hashtable(raw, domain, domain->raw_to_trans);
1709 if (!canonical) {
1710 canonical = compute_trans_from_raw(raw, domain);
1711 if (canonical && strcmp(canonical, range))
1712 if (add_cache(domain, raw, canonical) < 0) {
1713 free(canonical);
1714 free(range);
1715 free(raw);
1716 return -1;
1717 }
1718 }
1719 if (canonical)
1720 free(canonical);
1721 if (add_cache(domain, raw, range) < 0) {
1722 free(range);
1723 free(raw);
1724 return -1;
1725 }
1726 } else {
1727 log_debug("untrans_context unable to compute raw context %s\n", range);
1728 }
1729 }
1730
1731 if (lrange && urange) {
1732 lraw = find_in_hashtable(lrange, domain, domain->trans_to_raw);
1733 if (! lraw) {
1734 lraw = compute_raw_from_trans(lrange, domain);
1735 if (lraw) {
1736 char *canonical = find_in_hashtable(lraw, domain, domain->raw_to_trans);
1737 if (!canonical) {
1738 canonical = compute_trans_from_raw(lraw, domain);
1739 if (canonical)
1740 if (add_cache(domain, lraw, canonical) < 0) {
1741 free(canonical);
1742 free(lraw);
1743 free(range);
1744 return -1;
1745 }
1746 }
1747 if (canonical)
1748 free(canonical);
1749 if (add_cache(domain, lraw, lrange) < 0) {
1750 free(lraw);
1751 free(range);
1752 return -1;
1753 }
1754 } else {
1755 lraw = strdup(lrange);
1756 if (! lraw) {
1757 log_error("strdup failed %s", strerror(errno));
1758 free(range);
1759 return -1;
1760 }
1761 }
1762 }
1763
1764 uraw = find_in_hashtable(urange, domain, domain->trans_to_raw);
1765 if (! uraw) {
1766 uraw = compute_raw_from_trans(urange, domain);
1767 if (uraw) {
1768 char *canonical = find_in_hashtable(uraw, domain, domain->raw_to_trans);
1769 if (!canonical) {
1770 canonical = compute_trans_from_raw(uraw, domain);
1771 if (canonical)
1772 if (add_cache(domain, uraw, canonical) < 0) {
1773 free(canonical);
1774 free(uraw);
1775 free(lraw);
1776 free(range);
1777 return -1;
1778 }
1779 }
1780 if (canonical)
1781 free(canonical);
1782 if (add_cache(domain, uraw, urange) < 0) {
1783 free(uraw);
1784 free(lraw);
1785 free(range);
1786 return -1;
1787 }
1788 } else {
1789 uraw = strdup(urange);
1790 if (! uraw) {
1791 log_error("strdup failed %s", strerror(errno));
1792 free(lraw);
1793 free(range);
1794 return -1;
1795 }
1796 }
1797 }
1798
1799
1800 if (strcmp(lraw, uraw) == 0) {
1801 if (asprintf(&raw, "%s", lraw) < 0) {
1802 log_error("asprintf failed %s", strerror(errno));
1803 free(uraw);
1804 free(lraw);
1805 free(range);
1806 return -1;
1807 }
1808 } else {
1809 if (asprintf(&raw, "%s-%s", lraw, uraw) < 0) {
1810 log_error("asprintf failed %s", strerror(errno));
1811 free(uraw);
1812 free(lraw);
1813 free(range);
1814 return -1;
1815 }
1816 }
1817 free(lraw);
1818 free(uraw);
1819 *dashp = '-';
1820 break;
1821 }
1822 if (dashp)
1823 *dashp = '-';
1824 if (raw) {
1825 free(raw);
1826 raw = NULL;
1827 }
1828 }
1829
1830 if (raw) {
1831 *rcon = new_context_str(incon, raw);
1832 free(raw);
1833 } else {
1834 *rcon = new_context_str(incon, range);
1835 }
1836 free(range);
1837
1838 #ifdef DEBUG
1839 struct timeval stopTime;
1840 gettimeofday(&stopTime, 0);
1841 long int ms;
1842 if (startTime.tv_usec > stopTime.tv_usec)
1843 ms = (stopTime.tv_sec - startTime.tv_sec - 1) * 1000 + (stopTime.tv_usec/1000 + 1000 - startTime.tv_usec/1000);
1844 else
1845 ms = (stopTime.tv_sec - startTime.tv_sec ) * 1000 + (stopTime.tv_usec/1000 - startTime.tv_usec/1000);
1846
1847 log_debug(" untrans_context input='%s' output='%s' n %ld ms\n", incon, *rcon, ms);
1848 #endif
1849 return 0;
1850 }
1851
1852 void
finish_context_translations(void)1853 finish_context_translations(void) {
1854 while(domains) {
1855 domain_t *next = domains->next;
1856 destroy_domain(domains);
1857 domains = next;
1858 }
1859 while(sens_constraints) {
1860 sens_constraint_t *next = sens_constraints->next;
1861 destroy_sens_constraint(&sens_constraints, sens_constraints);
1862 sens_constraints = next;
1863 }
1864 while(cat_constraints) {
1865 cat_constraint_t *next = cat_constraints->next;
1866 destroy_cat_constraint(&cat_constraints, cat_constraints);
1867 cat_constraints = next;
1868 }
1869 }
1870
1871