src/main/client.c

   1 /*
   2  * client.c     Read clients into memory.
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  * Copyright 2000,2006  The FreeRADIUS server project
  21  * Copyright 2000  Miquel van Smoorenburg <miquels@cistron.nl>
  22  * Copyright 2000  Alan DeKok <aland@ox.org>
  23  */
  24
  25 #include <freeradius-devel/ident.h>
  26 RCSID("$Id$")
  27
  28 #include <freeradius-devel/radiusd.h>
  29 #include <freeradius-devel/rad_assert.h>
  30
  31 #include <sys/stat.h>
  32
  33 #include <ctype.h>
  34 #include <fcntl.h>
  35
  36 #ifdef WITH_DYNAMIC_CLIENTS
  37 #ifdef HAVE_DIRENT_H
  38 #include <dirent.h>
  39 #endif
  40 #endif
  41
  42 struct radclient_list {
  43         /*
  44          *      FIXME: One set of trees for IPv4, and another for IPv6?
  45          */
  46         rbtree_t        *trees[129]; /* for 0..128, inclusive. */
  47         int             min_prefix;
  48 };
  49
  50
  51 #ifdef WITH_STATS
  52 static rbtree_t         *tree_num = NULL;     /* client numbers 0..N */
  53 static int              tree_num_max = 0;
  54 #endif
  55 static RADCLIENT_LIST   *root_clients = NULL;
  56
  57 #ifdef WITH_DYNAMIC_CLIENTS
  58 static fr_fifo_t        *deleted_clients = NULL;
  59 #endif
  60
  61 /*
  62  *      Callback for freeing a client.
  63  */
  64 void client_free(RADCLIENT *client)
  65 {
  66 #ifdef WITH_DYNAMIC_CLIENTS
  67         if (client->dynamic == 2) {
  68                 time_t now;
  69
  70                 if (!deleted_clients) {
  71                         deleted_clients = fr_fifo_create(1024,
  72                                                          (void *) client_free);
  73                         if (!deleted_clients) return; /* MEMLEAK */
  74                 }
  75
  76                 /*
  77                  *      Mark it as in the fifo, and remember when we
  78                  *      pushed it.
  79                  */
  80                 client->dynamic = 3;
  81                 client->created = now = time(NULL); /* re-set it */
  82                 fr_fifo_push(deleted_clients, client);
  83
  84                 /*
  85                  *      Peek at the head of the fifo.  If it might
  86                  *      still be in use, return.  Otherwise, pop it
  87                  *      from the queue and delete it.
  88                  */
  89                 client = fr_fifo_peek(deleted_clients);
  90                 if ((client->created + 120) >= now) return;
  91
  92                 client = fr_fifo_pop(deleted_clients);
  93                 rad_assert(client != NULL);
  94         }
  95 #endif
  96
  97         free(client->longname);
  98         free(client->secret);
  99         free(client->shortname);
 100         free(client->nastype);
 101         free(client->login);
 102         free(client->password);
 103         free(client->server);
 104
 105 #ifdef WITH_STATS
 106         free(client->auth);
 107 #ifdef WITH_ACCOUNTING
 108         free(client->acct);
 109 #endif
 110 #endif
 111
 112 #ifdef WITH_DYNAMIC_CLIENTS
 113         free(client->client_server);
 114 #endif
 115
 116         free(client);
 117 }
 118
 119 /*
 120  *      Callback for comparing two clients.
 121  */
 122 static int client_ipaddr_cmp(const void *one, const void *two)
 123 {
 124         const RADCLIENT *a = one;
 125         const RADCLIENT *b = two;
 126
 127         return fr_ipaddr_cmp(&a->ipaddr, &b->ipaddr);
 128 }
 129
 130 #ifdef WITH_STATS
 131 static int client_num_cmp(const void *one, const void *two)
 132 {
 133         const RADCLIENT *a = one;
 134         const RADCLIENT *b = two;
 135
 136         return (a->number - b->number);
 137 }
 138 #endif
 139
 140 /*
 141  *      Free a RADCLIENT list.
 142  */
 143 void clients_free(RADCLIENT_LIST *clients)
 144 {
 145         int i;
 146
 147         if (!clients) return;
 148
 149         for (i = 0; i <= 128; i++) {
 150                 if (clients->trees[i]) rbtree_free(clients->trees[i]);
 151                 clients->trees[i] = NULL;
 152         }
 153
 154         if (clients == root_clients) {
 155 #ifdef WITH_STATS
 156                 if (tree_num) rbtree_free(tree_num);
 157                 tree_num = NULL;
 158                 tree_num_max = 0;
 159 #endif
 160                 root_clients = NULL;
 161         }
 162
 163 #ifdef WITH_DYNAMIC_CLIENTS
 164         /*
 165          *      FIXME: No fr_fifo_delete()
 166          */
 167 #endif
 168
 169         free(clients);
 170 }
 171
 172 /*
 173  *      Return a new, initialized, set of clients.
 174  */
 175 RADCLIENT_LIST *clients_init(void)
 176 {
 177         RADCLIENT_LIST *clients = calloc(1, sizeof(RADCLIENT_LIST));
 178
 179         if (!clients) return NULL;
 180
 181         clients->min_prefix = 128;
 182
 183         return clients;
 184 }
 185
 186
 187 /*
 188  *      Sanity check a client.
 189  */
 190 static int client_sane(RADCLIENT *client)
 191 {
 192         switch (client->ipaddr.af) {
 193         case AF_INET:
 194                 if (client->prefix > 32) {
 195                         return 0;
 196                 }
 197
 198                 /*
 199                  *      Zero out the subnet bits.
 200                  */
 201                 if (client->prefix == 0) {
 202                         memset(&client->ipaddr.ipaddr.ip4addr, 0,
 203                                sizeof(client->ipaddr.ipaddr.ip4addr));
 204
 205                 } else if (client->prefix < 32) {
 206                         uint32_t mask = ~0;
 207
 208                         mask <<= (32 - client->prefix);
 209                         client->ipaddr.ipaddr.ip4addr.s_addr &= htonl(mask);
 210                 }
 211                 break;
 212
 213         case AF_INET6:
 214                 if (client->prefix > 128) return 0;
 215
 216                 if (client->prefix == 0) {
 217                         memset(&client->ipaddr.ipaddr.ip6addr, 0,
 218                                sizeof(client->ipaddr.ipaddr.ip6addr));
 219
 220                 } else if (client->prefix < 128) {
 221                         uint32_t mask, *addr;
 222
 223                         addr = (uint32_t *) &client->ipaddr.ipaddr.ip6addr;
 224
 225                         if ((client->prefix & 0x1f) == 0) {
 226                                 mask = 0;
 227                         } else {
 228                                 mask = ~ ((uint32_t) 0);
 229                                 mask <<= (32 - (client->prefix & 0x1f));
 230                                 mask = htonl(mask);
 231                         }
 232
 233                         switch (client->prefix >> 5) {
 234                         case 0:
 235                                 addr[0] &= mask;
 236                                 mask = 0;
 237                                 /* FALL-THROUGH */
 238                         case 1:
 239                                 addr[1] &= mask;
 240                                 mask = 0;
 241                                 /* FALL-THROUGH */
 242                         case 2:
 243                                 addr[2] &= mask;
 244                                 mask = 0;
 245                                 /* FALL-THROUGH */
 246                         case 3:
 247                                 addr[3] &= mask;
 248                           break;
 249                         }
 250                 }
 251                 break;
 252
 253         default:
 254                 return 0;
 255         }
 256
 257         return 1;
 258 }
 259
 260
 261 /*
 262  *      Add a client to the tree.
 263  */
 264 int client_add(RADCLIENT_LIST *clients, RADCLIENT *client)
 265 {
 266         RADCLIENT *old;
 267
 268         if (!client) {
 269                 return 0;
 270         }
 271
 272         /*
 273          *      If "clients" is NULL, it means add to the global list.
 274          */
 275         if (!clients) {
 276                 /*
 277                  *      Initialize it, if not done already.
 278                  */
 279                 if (!root_clients) {
 280                         root_clients = clients_init();
 281                         if (!root_clients) return 0;
 282                 }
 283                 clients = root_clients;
 284         }
 285
 286         if ((client->prefix < 0) || (client->prefix > 128)) {
 287                 return 0;
 288         }
 289
 290         if (!client_sane(client)) return 0;
 291
 292         /*
 293          *      Create a tree for it.
 294          */
 295         if (!clients->trees[client->prefix]) {
 296                 clients->trees[client->prefix] = rbtree_create(client_ipaddr_cmp,
 297                                                                (void *) client_free, 0);
 298                 if (!clients->trees[client->prefix]) {
 299                         return 0;
 300                 }
 301         }
 302
 303 #define namecmp(a) ((!old->a && !client->a) || (old->a && client->a && (strcmp(old->a, client->a) == 0)))
 304
 305         /*
 306          *      Cannot insert the same client twice.
 307          */
 308         old = rbtree_finddata(clients->trees[client->prefix], client);
 309         if (old) {
 310                 /*
 311                  *      If it's a complete duplicate, then free the new
 312                  *      one, and return "OK".
 313                  */
 314                 if ((fr_ipaddr_cmp(&old->ipaddr, &client->ipaddr) == 0) &&
 315                     (old->prefix == client->prefix) &&
 316                     namecmp(longname) && namecmp(secret) &&
 317                     namecmp(shortname) && namecmp(nastype) &&
 318                     namecmp(login) && namecmp(password) && namecmp(server) &&
 319 #ifdef WITH_DYNAMIC_CLIENTS
 320                     (old->lifetime == client->lifetime) &&
 321                     namecmp(client_server) &&
 322 #endif
 323 #ifdef WITH_COA
 324                     namecmp(coa_name) &&
 325                     (old->coa_server == client->coa_server) &&
 326                     (old->coa_pool == client->coa_pool) &&
 327 #endif
 328                     (old->message_authenticator == client->message_authenticator)) {
 329                         DEBUG("WARNING: Ignoring duplicate client %s", client->longname);
 330                         client_free(client);
 331                         return 1;
 332                 }
 333
 334                 radlog(L_ERR, "Failed to add duplicate client %s",
 335                        client->shortname);
 336                 return 0;
 337         }
 338 #undef namecmp
 339
 340         /*
 341          *      Other error adding client: likely is fatal.
 342          */
 343         if (!rbtree_insert(clients->trees[client->prefix], client)) {
 344                 return 0;
 345         }
 346
 347 #ifdef WITH_STATS
 348         if (!tree_num) {
 349                 tree_num = rbtree_create(client_num_cmp, NULL, 0);
 350         }
 351
 352
 353         /*
 354          *      Catch clients added by rlm_sql.
 355          */
 356         if (!client->auth) {
 357                 client->auth = rad_malloc(sizeof(*client->auth));
 358                 memset(client->auth, 0, sizeof(*client->auth));
 359         }
 360
 361 #ifdef WITH_ACCOUNTING
 362         if (!client->acct) {
 363                 client->acct = rad_malloc(sizeof(*client->acct));
 364                 memset(client->acct, 0, sizeof(*client->acct));
 365         }
 366 #endif
 367
 368 #ifdef WITH_DYNAMIC_CLIENTS
 369         /*
 370          *      More catching of clients added by rlm_sql.
 371          *
 372          *      The sql modules sets the dynamic flag BEFORE calling
 373          *      us.  The client_create() function sets it AFTER
 374          *      calling us.
 375          */
 376         if (client->dynamic && (client->lifetime == 0)) {
 377                 RADCLIENT *network;
 378
 379                 /*
 380                  *      If there IS an enclosing network,
 381                  *      inherit the lifetime from it.
 382                  */
 383                 network = client_find(clients, &client->ipaddr);
 384                 if (network) {
 385                         client->lifetime = network->lifetime;
 386                 }
 387         }
 388 #endif
 389
 390         client->number = tree_num_max;
 391         tree_num_max++;
 392         if (tree_num) rbtree_insert(tree_num, client);
 393 #endif
 394
 395         if (client->prefix < clients->min_prefix) {
 396                 clients->min_prefix = client->prefix;
 397         }
 398
 399         return 1;
 400 }
 401
 402
 403 #ifdef WITH_DYNAMIC_CLIENTS
 404 void client_delete(RADCLIENT_LIST *clients, RADCLIENT *client)
 405 {
 406         if (!client) return;
 407
 408         if (!clients) clients = root_clients;
 409
 410         if (!client->dynamic) return;
 411
 412         rad_assert((client->prefix >= 0) && (client->prefix <= 128));
 413
 414         client->dynamic = 2;    /* signal to client_free */
 415
 416         rbtree_deletebydata(tree_num, client);
 417         rbtree_deletebydata(clients->trees[client->prefix], client);
 418 }
 419 #endif
 420
 421
 422 /*
 423  *      Find a client in the RADCLIENTS list by number.
 424  *      This is a support function for the statistics code.
 425  */
 426 RADCLIENT *client_findbynumber(const RADCLIENT_LIST *clients,
 427                                int number)
 428 {
 429 #ifdef WITH_STATS
 430         if (!clients) clients = root_clients;
 431
 432         if (!clients) return NULL;
 433
 434         if (number >= tree_num_max) return NULL;
 435
 436         if (tree_num) {
 437                 RADCLIENT myclient;
 438
 439                 myclient.number = number;
 440
 441                 return rbtree_finddata(tree_num, &myclient);
 442         }
 443 #else
 444         clients = clients;      /* -Wunused */
 445         number = number;        /* -Wunused */
 446 #endif
 447         return NULL;
 448 }
 449
 450
 451 /*
 452  *      Find a client in the RADCLIENTS list.
 453  */
 454 RADCLIENT *client_find(const RADCLIENT_LIST *clients,
 455                        const fr_ipaddr_t *ipaddr)
 456 {
 457         int i, max_prefix;
 458         RADCLIENT myclient;
 459
 460         if (!clients) clients = root_clients;
 461
 462         if (!clients || !ipaddr) return NULL;
 463
 464         switch (ipaddr->af) {
 465         case AF_INET:
 466                 max_prefix = 32;
 467                 break;
 468
 469         case AF_INET6:
 470                 max_prefix = 128;
 471                 break;
 472
 473         default :
 474                 return NULL;
 475         }
 476
 477         for (i = max_prefix; i >= clients->min_prefix; i--) {
 478                 void *data;
 479
 480                 myclient.prefix = i;
 481                 myclient.ipaddr = *ipaddr;
 482                 client_sane(&myclient); /* clean up the ipaddress */
 483
 484                 if (!clients->trees[i]) continue;
 485
 486                 data = rbtree_finddata(clients->trees[i], &myclient);
 487                 if (data) {
 488                         return data;
 489                 }
 490         }
 491
 492         return NULL;
 493 }
 494
 495
 496 /*
 497  *      Old wrapper for client_find
 498  */
 499 RADCLIENT *client_find_old(const fr_ipaddr_t *ipaddr)
 500 {
 501         return client_find(root_clients, ipaddr);
 502 }
 503
 504 static struct in_addr cl_ip4addr;
 505 static struct in6_addr cl_ip6addr;
 506
 507 static const CONF_PARSER client_config[] = {
 508         { "ipaddr",  PW_TYPE_IPADDR,
 509           0, &cl_ip4addr,  NULL },
 510         { "ipv6addr",  PW_TYPE_IPV6ADDR,
 511           0, &cl_ip6addr, NULL },
 512         { "netmask",  PW_TYPE_INTEGER,
 513           offsetof(RADCLIENT, prefix), 0, NULL },
 514
 515         { "require_message_authenticator",  PW_TYPE_BOOLEAN,
 516           offsetof(RADCLIENT, message_authenticator), 0, "no" },
 517
 518         { "secret",  PW_TYPE_STRING_PTR,
 519           offsetof(RADCLIENT, secret), 0, NULL },
 520         { "shortname",  PW_TYPE_STRING_PTR,
 521           offsetof(RADCLIENT, shortname), 0, NULL },
 522         { "nastype",  PW_TYPE_STRING_PTR,
 523           offsetof(RADCLIENT, nastype), 0, NULL },
 524         { "login",  PW_TYPE_STRING_PTR,
 525           offsetof(RADCLIENT, login), 0, NULL },
 526         { "password",  PW_TYPE_STRING_PTR,
 527           offsetof(RADCLIENT, password), 0, NULL },
 528         { "virtual_server",  PW_TYPE_STRING_PTR,
 529           offsetof(RADCLIENT, server), 0, NULL },
 530         { "server",  PW_TYPE_STRING_PTR, /* compatability with 2.0-pre */
 531           offsetof(RADCLIENT, server), 0, NULL },
 532
 533 #ifdef WITH_DYNAMIC_CLIENTS
 534         { "dynamic_clients",  PW_TYPE_STRING_PTR,
 535           offsetof(RADCLIENT, client_server), 0, NULL },
 536         { "lifetime",  PW_TYPE_INTEGER,
 537           offsetof(RADCLIENT, lifetime), 0, NULL },
 538         { "rate_limit",  PW_TYPE_BOOLEAN,
 539           offsetof(RADCLIENT, rate_limit), 0, NULL },
 540 #endif
 541
 542 #ifdef WITH_COA
 543         { "coa_server",  PW_TYPE_STRING_PTR,
 544           offsetof(RADCLIENT, coa_name), 0, NULL },
 545 #endif
 546
 547         { NULL, -1, 0, NULL, NULL }
 548 };
 549
 550
 551 static RADCLIENT *client_parse(CONF_SECTION *cs, int in_server)
 552 {
 553         RADCLIENT       *c;
 554         const char      *name2;
 555
 556         name2 = cf_section_name2(cs);
 557         if (!name2) {
 558                 cf_log_err(cf_sectiontoitem(cs),
 559                            "Missing client name");
 560                 return NULL;
 561         }
 562
 563         /*
 564          * The size is fine.. Let's create the buffer
 565          */
 566         c = rad_malloc(sizeof(*c));
 567         memset(c, 0, sizeof(*c));
 568         c->cs = cs;
 569
 570 #ifdef WITH_STATS
 571         c->auth = rad_malloc(sizeof(*c->auth));
 572         memset(c->auth, 0, sizeof(*c->auth));
 573
 574 #ifdef WITH_ACCOUNTING
 575         c->acct = rad_malloc(sizeof(*c->acct));
 576         memset(c->acct, 0, sizeof(*c->acct));
 577 #endif
 578 #endif
 579
 580         memset(&cl_ip4addr, 0, sizeof(cl_ip4addr));
 581         memset(&cl_ip6addr, 0, sizeof(cl_ip6addr));
 582         c->prefix = -1;
 583
 584         if (cf_section_parse(cs, c, client_config) < 0) {
 585                 client_free(c);
 586                 cf_log_err(cf_sectiontoitem(cs),
 587                            "Error parsing client section.");
 588                 return NULL;
 589         }
 590
 591         /*
 592          *      Global clients can set servers to use,
 593          *      per-server clients cannot.
 594          */
 595         if (in_server && c->server) {
 596                 client_free(c);
 597                 cf_log_err(cf_sectiontoitem(cs),
 598                            "Clients inside of an server section cannot point to a server.");
 599                 return NULL;
 600         }
 601
 602         /*
 603          *      No "ipaddr" or "ipv6addr", use old-style
 604          *      "client <ipaddr> {" syntax.
 605          */
 606         if (!cf_pair_find(cs, "ipaddr") &&
 607             !cf_pair_find(cs, "ipv6addr")) {
 608                 char *prefix_ptr;
 609
 610                 prefix_ptr = strchr(name2, '/');
 611
 612                 /*
 613                  *      Look for prefixes.
 614                  */
 615                 if (prefix_ptr) {
 616                         c->prefix = atoi(prefix_ptr + 1);
 617                         if ((c->prefix < 0) || (c->prefix > 128)) {
 618                                 client_free(c);
 619                                 cf_log_err(cf_sectiontoitem(cs),
 620                                            "Invalid Prefix value '%s' for IP.",
 621                                            prefix_ptr + 1);
 622                                 return NULL;
 623                         }
 624                         /* Replace '/' with '\0' */
 625                         *prefix_ptr = '\0';
 626                 }
 627
 628                 /*
 629                  *      Always get the numeric representation of IP
 630                  */
 631                 if (ip_hton(name2, AF_UNSPEC, &c->ipaddr) < 0) {
 632                         client_free(c);
 633                         cf_log_err(cf_sectiontoitem(cs),
 634                                    "Failed to look up hostname %s: %s",
 635                                    name2, fr_strerror());
 636                         return NULL;
 637                 }
 638
 639                 if (prefix_ptr) *prefix_ptr = '/';
 640                 c->longname = strdup(name2);
 641
 642                 if (!c->shortname) c->shortname = strdup(c->longname);
 643
 644         } else {
 645                 char buffer[1024];
 646
 647                 /*
 648                  *      Figure out which one to use.
 649                  */
 650                 if (cf_pair_find(cs, "ipaddr")) {
 651                         c->ipaddr.af = AF_INET;
 652                         c->ipaddr.ipaddr.ip4addr = cl_ip4addr;
 653
 654                         if ((c->prefix < -1) || (c->prefix > 32)) {
 655                                 client_free(c);
 656                                 cf_log_err(cf_sectiontoitem(cs),
 657                                            "Netmask must be between 0 and 32");
 658                                 return NULL;
 659                         }
 660
 661                 } else if (cf_pair_find(cs, "ipv6addr")) {
 662                         c->ipaddr.af = AF_INET6;
 663                         c->ipaddr.ipaddr.ip6addr = cl_ip6addr;
 664
 665                         if ((c->prefix < -1) || (c->prefix > 128)) {
 666                                 client_free(c);
 667                                 cf_log_err(cf_sectiontoitem(cs),
 668                                            "Netmask must be between 0 and 128");
 669                                 return NULL;
 670                         }
 671                 } else {
 672                         cf_log_err(cf_sectiontoitem(cs),
 673                                    "No IP address defined for the client");
 674                         client_free(c);
 675                         return NULL;
 676                 }
 677
 678                 ip_ntoh(&c->ipaddr, buffer, sizeof(buffer));
 679                 c->longname = strdup(buffer);
 680
 681                 /*
 682                  *      Set the short name to the name2
 683                  */
 684                 if (!c->shortname) c->shortname = strdup(name2);
 685         }
 686
 687         if (c->prefix < 0) switch (c->ipaddr.af) {
 688         case AF_INET:
 689                 c->prefix = 32;
 690                 break;
 691         case AF_INET6:
 692                 c->prefix = 128;
 693                 break;
 694         default:
 695                 break;
 696         }
 697
 698 #ifdef WITH_DYNAMIC_CLIENTS
 699         if (c->client_server) {
 700                 free(c->secret);
 701                 c->secret = strdup("testing123");
 702
 703                 if (((c->ipaddr.af == AF_INET) &&
 704                      (c->prefix == 32)) ||
 705                     ((c->ipaddr.af == AF_INET6) &&
 706                      (c->prefix == 128))) {
 707                         cf_log_err(cf_sectiontoitem(cs),
 708                                    "Dynamic clients MUST be a network, not a single IP address.");
 709                         client_free(c);
 710                         return NULL;
 711                 }
 712
 713                 return c;
 714         }
 715 #endif
 716
 717         if (!c->secret || !*c->secret) {
 718 #ifdef WITH_DHCP
 719                 const char *value = NULL;
 720                 CONF_PAIR *cp = cf_pair_find(cs, "dhcp");
 721
 722                 if (cp) value = cf_pair_value(cp);
 723
 724                 /*
 725                  *      Secrets aren't needed for DHCP.
 726                  */
 727                 if (value && (strcmp(value, "yes") == 0)) return c;
 728
 729 #endif
 730                 client_free(c);
 731                 cf_log_err(cf_sectiontoitem(cs),
 732                            "secret must be at least 1 character long");
 733                 return NULL;
 734         }
 735
 736 #ifdef WITH_COA
 737         /*
 738          *      Point the client to the home server pool, OR to the
 739          *      home server.  This gets around the problem of figuring
 740          *      out which port to use.
 741          */
 742         if (c->coa_name) {
 743                 c->coa_pool = home_pool_byname(c->coa_name, HOME_TYPE_COA);
 744                 if (!c->coa_pool) {
 745                         c->coa_server = home_server_byname(c->coa_name,
 746                                                            HOME_TYPE_COA);
 747                 }
 748                 if (!c->coa_pool && !c->coa_server) {
 749                         client_free(c);
 750                         cf_log_err(cf_sectiontoitem(cs), "No such home_server or home_server_pool \"%s\"", c->coa_name);
 751                         return NULL;
 752                 }
 753         }
 754 #endif
 755
 756         return c;
 757 }
 758
 759
 760 /*
 761  *      Create the linked list of clients from the new configuration
 762  *      type.  This way we don't have to change too much in the other
 763  *      source-files.
 764  */
 765 RADCLIENT_LIST *clients_parse_section(CONF_SECTION *section)
 766 {
 767         int             global = FALSE, in_server = FALSE;
 768         CONF_SECTION    *cs;
 769         RADCLIENT       *c;
 770         RADCLIENT_LIST  *clients;
 771
 772         /*
 773          *      Be forgiving.  If there's already a clients, return
 774          *      it.  Otherwise create a new one.
 775          */
 776         clients = cf_data_find(section, "clients");
 777         if (clients) return clients;
 778
 779         clients = clients_init();
 780         if (!clients) return NULL;
 781
 782         if (cf_top_section(section) == section) global = TRUE;
 783
 784         if (strcmp("server", cf_section_name1(section)) == 0) in_server = TRUE;
 785
 786         /*
 787          *      Associate the clients structure with the section, where
 788          *      it will be freed once the section is freed.
 789          */
 790         if (cf_data_add(section, "clients", clients, (void *) clients_free) < 0) {
 791                 cf_log_err(cf_sectiontoitem(section),
 792                            "Failed to associate clients with section %s",
 793                        cf_section_name1(section));
 794                 clients_free(clients);
 795                 return NULL;
 796         }
 797
 798         for (cs = cf_subsection_find_next(section, NULL, "client");
 799              cs != NULL;
 800              cs = cf_subsection_find_next(section, cs, "client")) {
 801                 c = client_parse(cs, in_server);
 802                 if (!c) {
 803                         return NULL;
 804                 }
 805
 806                 /*
 807                  *      FIXME: Add the client as data via cf_data_add,
 808                  *      for migration issues.
 809                  */
 810
 811 #ifdef WITH_DYNAMIC_CLIENTS
 812 #ifdef HAVE_DIRENT_H
 813                 if (c->client_server) {
 814                         const char *value;
 815                         CONF_PAIR *cp;
 816                         DIR             *dir;
 817                         struct dirent   *dp;
 818                         struct stat stat_buf;
 819                         char buf2[2048];
 820
 821                         /*
 822                          *      Find the directory where individual
 823                          *      client definitions are stored.
 824                          */
 825                         cp = cf_pair_find(cs, "directory");
 826                         if (!cp) goto add_client;
 827
 828                         value = cf_pair_value(cp);
 829                         if (!value) {
 830                                 cf_log_err(cf_sectiontoitem(cs),
 831                                            "The \"directory\" entry must not be empty");
 832                                 client_free(c);
 833                                 return NULL;
 834                         }
 835
 836                         DEBUG("including dynamic clients in %s", value);
 837
 838                         dir = opendir(value);
 839                         if (!dir) {
 840                                 cf_log_err(cf_sectiontoitem(cs), "Error reading directory %s: %s", value, strerror(errno));
 841                                 client_free(c);
 842                                 return NULL;
 843                         }
 844
 845                         /*
 846                          *      Read the directory, ignoring "." files.
 847                          */
 848                         while ((dp = readdir(dir)) != NULL) {
 849                                 const char *p;
 850                                 RADCLIENT *dc;
 851
 852                                 if (dp->d_name[0] == '.') continue;
 853
 854                                 /*
 855                                  *      Check for valid characters
 856                                  */
 857                                 for (p = dp->d_name; *p != '\0'; p++) {
 858                                         if (isalpha((int)*p) ||
 859                                             isdigit((int)*p) ||
 860                                             (*p == ':') ||
 861                                             (*p == '.')) continue;
 862                                                 break;
 863                                 }
 864                                 if (*p != '\0') continue;
 865
 866                                 snprintf(buf2, sizeof(buf2), "%s/%s",
 867                                          value, dp->d_name);
 868
 869                                 if ((stat(buf2, &stat_buf) != 0) ||
 870                                     S_ISDIR(stat_buf.st_mode)) continue;
 871
 872                                 dc = client_read(buf2, in_server, TRUE);
 873                                 if (!dc) {
 874                                         cf_log_err(cf_sectiontoitem(cs),
 875                                                    "Failed reading client file \"%s\"", buf2);
 876                                         client_free(c);
 877                                         return NULL;
 878                                 }
 879
 880                                 /*
 881                                  *      Validate, and add to the list.
 882                                  */
 883                                 if (!client_validate(clients, c, dc)) {
 884
 885                                         client_free(c);
 886                                         return NULL;
 887                                 }
 888                         } /* loop over the directory */
 889                 }
 890 #endif /* HAVE_DIRENT_H */
 891 #endif /* WITH_DYNAMIC_CLIENTS */
 892
 893         add_client:
 894                 if (!client_add(clients, c)) {
 895                         cf_log_err(cf_sectiontoitem(cs),
 896                                    "Failed to add client %s",
 897                                    cf_section_name2(cs));
 898                         client_free(c);
 899                         return NULL;
 900                 }
 901
 902         }
 903
 904         /*
 905          *      Replace the global list of clients with the new one.
 906          *      The old one is still referenced from the original
 907          *      configuration, and will be freed when that is freed.
 908          */
 909         if (global) {
 910                 root_clients = clients;
 911         }
 912
 913         return clients;
 914 }
 915
 916 #ifdef WITH_DYNAMIC_CLIENTS
 917 /*
 918  *      We overload this structure a lot.
 919  */
 920 static const CONF_PARSER dynamic_config[] = {
 921         { "FreeRADIUS-Client-IP-Address",  PW_TYPE_IPADDR,
 922           offsetof(RADCLIENT, ipaddr), 0, NULL },
 923         { "FreeRADIUS-Client-IPv6-Address",  PW_TYPE_IPV6ADDR,
 924           offsetof(RADCLIENT, ipaddr), 0, NULL },
 925
 926         { "FreeRADIUS-Client-Require-MA",  PW_TYPE_BOOLEAN,
 927           offsetof(RADCLIENT, message_authenticator), NULL, NULL },
 928
 929         { "FreeRADIUS-Client-Secret",  PW_TYPE_STRING_PTR,
 930           offsetof(RADCLIENT, secret), 0, "" },
 931         { "FreeRADIUS-Client-Shortname",  PW_TYPE_STRING_PTR,
 932           offsetof(RADCLIENT, shortname), 0, "" },
 933         { "FreeRADIUS-Client-NAS-Type",  PW_TYPE_STRING_PTR,
 934           offsetof(RADCLIENT, nastype), 0, NULL },
 935         { "FreeRADIUS-Client-Virtual-Server",  PW_TYPE_STRING_PTR,
 936           offsetof(RADCLIENT, server), 0, NULL },
 937
 938         { NULL, -1, 0, NULL, NULL }
 939 };
 940
 941
 942 int client_validate(RADCLIENT_LIST *clients, RADCLIENT *master, RADCLIENT *c)
 943 {
 944         char buffer[128];
 945
 946         /*
 947          *      No virtual server defined.  Inherit the parent's
 948          *      definition.
 949          */
 950         if (master->server && !c->server) {
 951                 c->server = strdup(master->server);
 952         }
 953
 954         /*
 955          *      If the client network isn't global (not tied to a
 956          *      virtual server), then ensure that this clients server
 957          *      is the same as the enclosing networks virtual server.
 958          */
 959         if (master->server &&
 960              (strcmp(master->server, c->server) != 0)) {
 961                 DEBUG("- Cannot add client %s: Virtual server %s is not the same as the virtual server for the network.",
 962                       ip_ntoh(&c->ipaddr,
 963                               buffer, sizeof(buffer)),
 964                       c->server);
 965
 966                 goto error;
 967         }
 968
 969         if (!client_add(clients, c)) {
 970                 DEBUG("- Cannot add client %s: Internal error",
 971                       ip_ntoh(&c->ipaddr,
 972                               buffer, sizeof(buffer)));
 973
 974                 goto error;
 975         }
 976
 977         /*
 978          *      Initialize the remaining fields.
 979          */
 980         c->dynamic = TRUE;
 981         c->lifetime = master->lifetime;
 982         c->created = time(NULL);
 983         c->longname = strdup(c->shortname);
 984
 985         DEBUG("- Added client %s with shared secret %s",
 986               ip_ntoh(&c->ipaddr, buffer, sizeof(buffer)),
 987               c->secret);
 988
 989         return 1;
 990
 991  error:
 992         client_free(c);
 993         return 0;
 994 }
 995
 996
 997 RADCLIENT *client_create(RADCLIENT_LIST *clients, REQUEST *request)
 998 {
 999         int i, *pi;
1000         char **p;
1001         RADCLIENT *c;
1002         char buffer[128];
1003
1004         if (!clients || !request) return NULL;
1005
1006         c = rad_malloc(sizeof(*c));
1007         memset(c, 0, sizeof(*c));
1008         c->cs = request->client->cs;
1009         c->ipaddr.af = AF_UNSPEC;
1010
1011         for (i = 0; dynamic_config[i].name != NULL; i++) {
1012                 DICT_ATTR *da;
1013                 VALUE_PAIR *vp;
1014
1015                 da = dict_attrbyname(dynamic_config[i].name);
1016                 if (!da) {
1017                         DEBUG("- Cannot add client %s: attribute \"%s\"is not in the dictionary",
1018                               ip_ntoh(&request->packet->src_ipaddr,
1019                                       buffer, sizeof(buffer)),
1020                               dynamic_config[i].name);
1021                 error:
1022                         client_free(c);
1023                         return NULL;
1024                 }
1025
1026                 vp = pairfind(request->config_items, da->attr);
1027                 if (!vp) {
1028                         /*
1029                          *      Not required.  Skip it.
1030                          */
1031                         if (!dynamic_config[i].dflt) continue;
1032
1033                         DEBUG("- Cannot add client %s: Required attribute \"%s\" is missing.",
1034                               ip_ntoh(&request->packet->src_ipaddr,
1035                                       buffer, sizeof(buffer)),
1036                               dynamic_config[i].name);
1037                         goto error;
1038                 }
1039
1040                 switch (dynamic_config[i].type) {
1041                 case PW_TYPE_IPADDR:
1042                         c->ipaddr.af = AF_INET;
1043                         c->ipaddr.ipaddr.ip4addr.s_addr = vp->vp_ipaddr;
1044                         c->prefix = 32;
1045                         break;
1046
1047                 case PW_TYPE_IPV6ADDR:
1048                         c->ipaddr.af = AF_INET6;
1049                         c->ipaddr.ipaddr.ip6addr = vp->vp_ipv6addr;
1050                         c->prefix = 128;
1051                         break;
1052
1053                 case PW_TYPE_STRING_PTR:
1054                         p = (char **) ((char *) c + dynamic_config[i].offset);
1055                         if (*p) free(*p);
1056                         *p = strdup(vp->vp_strvalue);
1057                         break;
1058
1059                 case PW_TYPE_BOOLEAN:
1060                         pi = (int *) ((char *) c + dynamic_config[i].offset);
1061                         *pi = vp->vp_integer;
1062                         break;
1063
1064                 default:
1065                         goto error;
1066                 }
1067         }
1068
1069         if (c->ipaddr.af == AF_UNSPEC) {
1070                 DEBUG("- Cannot add client %s: No IP address was specified.",
1071                       ip_ntoh(&request->packet->src_ipaddr,
1072                               buffer, sizeof(buffer)));
1073
1074                 goto error;
1075         }
1076
1077         if (fr_ipaddr_cmp(&request->packet->src_ipaddr, &c->ipaddr) != 0) {
1078                 char buf2[128];
1079
1080                 DEBUG("- Cannot add client %s: IP address %s do not match",
1081                       ip_ntoh(&request->packet->src_ipaddr,
1082                               buffer, sizeof(buffer)),
1083                       ip_ntoh(&c->ipaddr,
1084                               buf2, sizeof(buf2)));
1085                 goto error;
1086         }
1087
1088         if (!client_validate(clients, request->client, c)) {
1089                 return NULL;
1090         }
1091
1092         return c;
1093 }
1094
1095 /*
1096  *      Read a client definition from the given filename.
1097  */
1098 RADCLIENT *client_read(const char *filename, int in_server, int flag)
1099 {
1100         const char *p;
1101         RADCLIENT *c;
1102         CONF_SECTION *cs;
1103         char buffer[256];
1104
1105         if (!filename) return NULL;
1106
1107         cs = cf_file_read(filename);
1108         if (!cs) return NULL;
1109
1110         c = client_parse(cf_section_sub_find(cs, "client"), in_server);
1111
1112         p = strrchr(filename, FR_DIR_SEP);
1113         if (p) {
1114                 p++;
1115         } else {
1116                 p = filename;
1117         }
1118
1119         if (!flag) return c;
1120
1121         /*
1122          *      Additional validations
1123          */
1124         ip_ntoh(&c->ipaddr, buffer, sizeof(buffer));
1125         if (strcmp(p, buffer) != 0) {
1126                 DEBUG("Invalid client definition in %s: IP address %s does not match name %s", filename, buffer, p);
1127                 client_free(c);
1128                 return NULL;
1129         }
1130
1131
1132
1133         return c;
1134 }
1135 #endif