Merge remote-tracking branch 'sektioneins/master'

1 files changed, 131 insertions, 117 deletions

diff --git a/src/sp_config.h b/src/sp_config.h
index e7b1473..6d48240 100644
--- a/src/sp_config.h
+++ b/src/sp_config.h
@@ -5,15 +5,6 @@
 #include <netinet/in.h>
 #include <sys/socket.h>
 
-extern size_t sp_line_no;
-
-typedef enum {
-  SP_TYPE_STR = 0,
-  SP_TYPE_REGEXP,
-  SP_TYPE_INT,
-  SP_TYPE_EMPTY
-} sp_type;
-
 typedef enum {
   SP_PHP_TYPE_UNDEF = IS_UNDEF,
   SP_PHP_TYPE_NULL = IS_NULL,
@@ -30,6 +21,8 @@ typedef enum {
 
 typedef enum { SP_ZEND = 0, SP_SYSLOG = 1 } sp_log_media;
 
+typedef enum { SP_UNSET = 0, SP_READONLY = 1, SP_READWRITE = -1 } sp_ini_permission;
+
 typedef struct {
   int ip_version;
   union {
@@ -40,11 +33,6 @@ typedef struct {
 } sp_cidr;
 
 typedef struct {
-  zend_string *encryption_key;
-  zend_string *cookies_env_var;
-} sp_config_global;
-
-typedef struct {
   bool enable;
   bool simulation;
   zend_string *dump;
@@ -69,13 +57,13 @@ typedef struct {
 
 typedef struct {
   bool enable;
-} sp_config_disable_xxe;
+} sp_config_xxe_protection;
 
 typedef struct {
   enum samesite_type { strict = 1, lax = 2 } samesite;
   bool encrypt;
   zend_string *name;
-  sp_pcre *name_r;
+  sp_regexp *name_r;
   bool simulation;
 } sp_cookie;
 
@@ -88,6 +76,8 @@ typedef struct {
 typedef struct {
   bool encrypt;
   bool simulation;
+  u_long sid_min_length;
+  u_long sid_max_length;
 } sp_config_session;
 
 typedef struct {
@@ -101,37 +91,37 @@ typedef struct {
   zend_string *textual_representation;
 
   zend_string *filename;
-  sp_pcre *r_filename;
+  sp_regexp *r_filename;
 
   zend_string *function;
-  sp_pcre *r_function;
+  sp_regexp *r_function;
   sp_list_node *functions_list;
 
   zend_string *hash;
   int simulation;
 
   sp_tree *param;
-  sp_pcre *r_param;
+  sp_regexp *r_param;
   sp_php_type param_type;
   int pos;
   unsigned int line;
 
-  sp_pcre *r_ret;
+  sp_regexp *r_ret;
   zend_string *ret;
   sp_php_type ret_type;
 
-  sp_pcre *r_value;
+  sp_regexp *r_value;
   zend_string *value;
 
-  sp_pcre *r_key;
+  sp_regexp *r_key;
   zend_string *key;
 
   zend_string *dump;
   zend_string *alias;
   bool param_is_array;
   bool var_is_array;
-  sp_list_node *param_array_keys;
-  sp_list_node *var_array_keys;
+  // sp_list_node *param_array_keys;
+  // sp_list_node *var_array_keys;
 
   bool allow;
 
@@ -163,125 +153,149 @@ typedef struct {
 } sp_config_upload_validation;
 
 typedef struct {
-  sp_config_random *config_random;
-  sp_config_sloppy *config_sloppy;
-  sp_config_unserialize *config_unserialize;
-  sp_config_readonly_exec *config_readonly_exec;
-  sp_config_upload_validation *config_upload_validation;
-  sp_config_cookie *config_cookie;
-  sp_config_global *config_snuffleupagus;
-  sp_config_auto_cookie_secure *config_auto_cookie_secure;
-  sp_config_global_strict *config_global_strict;
-  sp_config_disable_xxe *config_disable_xxe;
-  sp_config_eval *config_eval;
-  sp_config_wrapper *config_wrapper;
-  sp_config_session *config_session;
-  bool hook_execute;
-  char log_media;
+  zend_string *key;
+  sp_ini_permission access;
+  zend_string *min;
+  zend_string *max;
+  sp_regexp *regexp;
+  zend_string *msg;
+  zend_string *set;
+  bool allow_null;
+  bool simulation;
+  bool drop;
+  PHP_INI_MH((*orig_onmodify));
+} sp_ini_entry;
+
+typedef struct {
+  bool enable;
+  bool simulation;
+  bool policy_readonly;
+  bool policy_silent_ro;
+  bool policy_silent_fail;
+  bool policy_drop;
+  HashTable *entries;  // ht of sp_ini_entry
+} sp_config_ini;
 
-  HashTable *config_disabled_functions;
-  HashTable *config_disabled_functions_hooked;
-  HashTable *config_disabled_functions_ret;
-  HashTable *config_disabled_functions_ret_hooked;
-  sp_config_disabled_functions *config_disabled_functions_reg;
-  sp_config_disabled_functions *config_disabled_functions_reg_ret;
-} sp_config;
+#define SP_PARSE_FN_(fname, kwvar) int fname(char *token, sp_parsed_keyword *kwvar, void *retval)
+#define SP_PARSE_FN(fname) SP_PARSE_FN_(fname, parsed_rule)
+#define SP_PARSEKW_FN(fname) SP_PARSE_FN_(fname, kw)
 
 typedef struct {
-  int (*func)(char *, char *, void *);
+  SP_PARSE_FN((*func));
   char *token;
   void *retval;
-} sp_config_functions;
+} sp_config_keyword;
 
-typedef struct {
-  int (*func)(char *);
-  char *token;
-} sp_config_tokens;
+#define SP_PARSER_SUCCESS 0
+#define SP_PARSER_ERROR -1
+#define SP_PARSER_STOP 1
 
-#define SP_TOKEN_BASE "sp"
+// #define SP_TOKEN_BASE "sp"
 
-#define SP_TOKEN_AUTO_COOKIE_SECURE ".auto_cookie_secure"
-#define SP_TOKEN_COOKIE_ENCRYPTION ".cookie"
-#define SP_TOKEN_SESSION_ENCRYPTION ".session"
-#define SP_TOKEN_DISABLE_FUNC ".disable_function"
-#define SP_TOKEN_GLOBAL ".global"
-#define SP_TOKEN_GLOBAL_STRICT ".global_strict"
-#define SP_TOKEN_HARDEN_RANDOM ".harden_random"
-#define SP_TOKEN_READONLY_EXEC ".readonly_exec"
-#define SP_TOKEN_UNSERIALIZE_HMAC ".unserialize_hmac"
-#define SP_TOKEN_UPLOAD_VALIDATION ".upload_validation"
-#define SP_TOKEN_DISABLE_XXE ".disable_xxe"
-#define SP_TOKEN_EVAL_BLACKLIST ".eval_blacklist"
-#define SP_TOKEN_EVAL_WHITELIST ".eval_whitelist"
-#define SP_TOKEN_SLOPPY_COMPARISON ".sloppy_comparison"
-#define SP_TOKEN_ALLOW_WRAPPERS ".wrappers_whitelist"
+#define SP_TOKEN_AUTO_COOKIE_SECURE "auto_cookie_secure"
+#define SP_TOKEN_COOKIE_ENCRYPTION "cookie"
+#define SP_TOKEN_SESSION_ENCRYPTION "session"
+#define SP_TOKEN_DISABLE_FUNC "disable_function"
+#define SP_TOKEN_GLOBAL "global"
+#define SP_TOKEN_GLOBAL_STRICT "global_strict"
+#define SP_TOKEN_HARDEN_RANDOM "harden_random"
+#define SP_TOKEN_READONLY_EXEC "readonly_exec"
+#define SP_TOKEN_UNSERIALIZE_HMAC "unserialize_hmac"
+#define SP_TOKEN_UPLOAD_VALIDATION "upload_validation"
+#define SP_TOKEN_XXE_PROTECTION "xxe_protection"
+#define SP_TOKEN_EVAL_BLACKLIST "eval_blacklist"
+#define SP_TOKEN_EVAL_WHITELIST "eval_whitelist"
+#define SP_TOKEN_SLOPPY_COMPARISON "sloppy_comparison"
+#define SP_TOKEN_ALLOW_WRAPPERS "wrappers_whitelist"
+#define SP_TOKEN_INI_PROTECTION "ini_protection"
+#define SP_TOKEN_INI "ini"
 
 // common tokens
-#define SP_TOKEN_ENABLE ".enable("
-#define SP_TOKEN_DISABLE ".disable("
-#define SP_TOKEN_SIMULATION ".simulation("
-#define SP_TOKEN_TRUE "1"
-#define SP_TOKEN_FALSE "0"
-#define SP_TOKEN_DUMP ".dump("
-#define SP_TOKEN_ALIAS ".alias("
-#define SP_TOKEN_ALLOW ".allow("
-#define SP_TOKEN_DROP ".drop("
-
-#define SP_TOKEN_END_PARAM ')'
+#define SP_TOKEN_ENABLE "enable"
+#define SP_TOKEN_DISABLE "disable"
+#define SP_TOKEN_SIMULATION "simulation"
+#define SP_TOKEN_SIM "sim"
+// #define SP_TOKEN_TRUE "1"
+// #define SP_TOKEN_FALSE "0"
+#define SP_TOKEN_DUMP "dump"
+#define SP_TOKEN_ALIAS "alias"
+#define SP_TOKEN_ALLOW "allow"
+#define SP_TOKEN_DROP "drop"
 
 // disable_function
-#define SP_TOKEN_CIDR ".cidr("
-#define SP_TOKEN_FILENAME ".filename("
-#define SP_TOKEN_FILENAME_REGEXP ".filename_r("
-#define SP_TOKEN_FUNCTION ".function("
-#define SP_TOKEN_FUNCTION_REGEXP ".function_r("
-#define SP_TOKEN_HASH ".hash("
-#define SP_TOKEN_LOCAL_VAR ".var("
-#define SP_TOKEN_PARAM ".param("
-#define SP_TOKEN_PARAM_REGEXP ".param_r("
-#define SP_TOKEN_PARAM_TYPE ".param_type("
-#define SP_TOKEN_RET ".ret("
-#define SP_TOKEN_RET_REGEXP ".ret_r("
-#define SP_TOKEN_RET_TYPE ".ret_type("
-#define SP_TOKEN_VALUE ".value("
-#define SP_TOKEN_VALUE_REGEXP ".value_r("
-#define SP_TOKEN_KEY ".key("
-#define SP_TOKEN_KEY_REGEXP ".key_r("
-#define SP_TOKEN_VALUE_ARG_POS ".pos("
-#define SP_TOKEN_LINE_NUMBER ".line("
+#define SP_TOKEN_CIDR "cidr"
+#define SP_TOKEN_FILENAME "filename"
+#define SP_TOKEN_FILENAME_REGEXP "filename_r"
+#define SP_TOKEN_FUNCTION "function"
+#define SP_TOKEN_FUNCTION_REGEXP "function_r"
+#define SP_TOKEN_HASH "hash"
+#define SP_TOKEN_LOCAL_VAR "var"
+#define SP_TOKEN_PARAM "param"
+#define SP_TOKEN_PARAM_REGEXP "param_r"
+#define SP_TOKEN_PARAM_TYPE "param_type"
+#define SP_TOKEN_RET "ret"
+#define SP_TOKEN_RET_REGEXP "ret_r"
+#define SP_TOKEN_RET_TYPE "ret_type"
+#define SP_TOKEN_VALUE "value"
+#define SP_TOKEN_VALUE_REGEXP "value_r"
+#define SP_TOKEN_KEY "key"
+#define SP_TOKEN_KEY_REGEXP "key_r"
+#define SP_TOKEN_VALUE_ARG_POS "pos"
+#define SP_TOKEN_LINE_NUMBER "line"
 
 // cookies encryption
-#define SP_TOKEN_NAME ".name("
-#define SP_TOKEN_NAME_REGEXP ".name_r("
+#define SP_TOKEN_NAME "name"
+#define SP_TOKEN_NAME_REGEXP "name_r"
 
 // cookies samesite
-#define SP_TOKEN_SAMESITE ".samesite("
-#define SP_TOKEN_ENCRYPT ".encrypt("
+#define SP_TOKEN_SAMESITE "samesite"
+#define SP_TOKEN_ENCRYPT "encrypt"
 #define SP_TOKEN_SAMESITE_LAX "Lax"
 #define SP_TOKEN_SAMESITE_STRICT "Strict"
 
 // Global configuration options
-#define SP_TOKEN_ENCRYPTION_KEY ".secret_key("
-#define SP_TOKEN_ENV_VAR ".cookie_env_var("
-#define SP_TOKEN_LOG_MEDIA ".log_media("
+#define SP_TOKEN_ENCRYPTION_KEY "secret_key"
+#define SP_TOKEN_ENV_VAR "cookie_env_var"
+#define SP_TOKEN_LOG_MEDIA "log_media"
+#define SP_TOKEN_MAX_EXECUTION_DEPTH "max_execution_depth"
+#define SP_TOKEN_SERVER_ENCODE "server_encode"
+#define SP_TOKEN_SERVER_STRIP "server_strip"
+#define SP_TOKEN_SID_MIN_LENGTH "sid_min_length"
+#define SP_TOKEN_SID_MAX_LENGTH "sid_max_length"
+#define SP_TOKEN_SHOW_OLD_PHP_WARNING "show_old_php_warning"
 
 // upload_validator
-#define SP_TOKEN_UPLOAD_SCRIPT ".script("
+#define SP_TOKEN_UPLOAD_SCRIPT "script"
+
+#define SP_TOKEN_LIST "list"
+
+zend_result sp_process_rule(sp_parsed_keyword *parsed_rule, sp_config_keyword *config_keywords);
+
+zend_result sp_parse_config(const char *filename);
 
-#define SP_TOKEN_LIST ".list("
+#define SP_PARSE_CHECK_ARG_EXISTS(value) \
+if (!value) { \
+  sp_log_err("config", "Missing argument to keyword '%s' - it should be '%s(\"...\")' on line %zu", token, token, kw->lineno); \
+  return SP_PARSER_ERROR; \
+}
 
-int sp_parse_config(const char *);
-int parse_array(sp_disabled_function *);
+#define SP_PARSE_ARG(value) \
+  zend_string *value = sp_get_arg_string(kw); \
+  SP_PARSE_CHECK_ARG_EXISTS(value);
 
-int parse_str(char *restrict, char *restrict, void *);
-int parse_regexp(char *restrict, char *restrict, void *);
-int parse_empty(char *restrict, char *restrict, void *);
-int parse_cidr(char *restrict, char *restrict, void *);
-int parse_php_type(char *restrict, char *restrict, void *);
-int parse_list(char *restrict, char *restrict, void *);
+SP_PARSEKW_FN(parse_str);
+SP_PARSEKW_FN(parse_regexp);
+SP_PARSEKW_FN(parse_empty);
+SP_PARSEKW_FN(parse_int);
+SP_PARSEKW_FN(parse_ulong);
+SP_PARSEKW_FN(parse_php_type);
+SP_PARSEKW_FN(parse_cidr);
+SP_PARSEKW_FN(parse_list);
 
 // cleanup
-void sp_disabled_function_list_free(sp_list_node *);
-void sp_cookie_list_free(sp_list_node *);
+void sp_free_disabled_function(void *data);
+void sp_free_cookie(void *data);
+void sp_free_zstr(void *data);
+void sp_free_ini_entry(void *data);
 
 #endif /* SP_CONFIG_H */