src/main/client.c

   1 /*
   2  * client.c     Read clients into memory.
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  * Copyright 2000,2006  The FreeRADIUS server project
  21  * Copyright 2000  Miquel van Smoorenburg <miquels@cistron.nl>
  22  * Copyright 2000  Alan DeKok <aland@ox.org>
  23  */
  24
  25 #include <freeradius-devel/ident.h>
  26 RCSID("$Id$")
  27
  28 #include <freeradius-devel/radiusd.h>
  29 #include <freeradius-devel/radius_snmp.h>
  30 #include <freeradius-devel/rad_assert.h>
  31
  32 #include <sys/stat.h>
  33
  34 #include <ctype.h>
  35 #include <fcntl.h>
  36
  37 struct radclient_list {
  38         /*
  39          *      FIXME: One set of trees for IPv4, and another for IPv6?
  40          */
  41         rbtree_t        *trees[129]; /* for 0..128, inclusive. */
  42         int             min_prefix;
  43 };
  44
  45
  46 #ifdef WITH_SNMP
  47 static rbtree_t         *tree_num;      /* client numbers 0..N */
  48 static int              tree_num_max;
  49 #endif
  50
  51 /*
  52  *      Callback for freeing a client.
  53  */
  54 void client_free(RADCLIENT *client)
  55 {
  56         free(client->longname);
  57         free(client->secret);
  58         free(client->shortname);
  59         free(client->nastype);
  60         free(client->login);
  61         free(client->password);
  62
  63 #ifdef WITH_SNMP
  64         free(client->auth);
  65         free(client->acct);
  66 #endif
  67
  68         free(client);
  69 }
  70
  71
  72 /*
  73  *      Callback for comparing two clients.
  74  */
  75 static int client_ipaddr_cmp(const void *one, const void *two)
  76 {
  77         const RADCLIENT *a = one;
  78         const RADCLIENT *b = two;
  79
  80         return lrad_ipaddr_cmp(&a->ipaddr, &b->ipaddr);
  81 }
  82
  83 #ifdef WITH_SNMP
  84 static int client_num_cmp(const void *one, const void *two)
  85 {
  86         const RADCLIENT *a = one;
  87         const RADCLIENT *b = two;
  88
  89         return (a->number - b->number);
  90 }
  91 #endif
  92
  93 /*
  94  *      Free a RADCLIENT list.
  95  */
  96 void clients_free(RADCLIENT_LIST *clients)
  97 {
  98         int i;
  99
 100         if (!clients) return;
 101
 102         for (i = 0; i <= 128; i++) {
 103                 if (clients->trees[i]) rbtree_free(clients->trees[i]);
 104                 clients->trees[i] = NULL;
 105         }
 106
 107         if (clients == mainconfig.clients) {
 108 #ifdef WITH_SNMP
 109                 if (tree_num) rbtree_free(tree_num);
 110                 tree_num = NULL;
 111                 tree_num_max = 0;
 112 #endif
 113                 mainconfig.clients = NULL;
 114         }
 115
 116         free(clients);
 117 }
 118
 119 /*
 120  *      Return a new, initialized, set of clients.
 121  */
 122 RADCLIENT_LIST *clients_init(void)
 123 {
 124         RADCLIENT_LIST *clients = calloc(1, sizeof(RADCLIENT_LIST));
 125
 126         if (!clients) return NULL;
 127
 128         clients->min_prefix = 128;
 129
 130         return clients;
 131 }
 132
 133
 134 /*
 135  *      Sanity check a client.
 136  */
 137 static int client_sane(RADCLIENT *client)
 138 {
 139         switch (client->ipaddr.af) {
 140         case AF_INET:
 141                 if (client->prefix > 32) {
 142                         return 0;
 143                 }
 144
 145                 /*
 146                  *      Zero out the subnet bits.
 147                  */
 148                 if (client->prefix < 32) {
 149                         uint32_t mask = ~0;
 150
 151                         mask <<= (32 - client->prefix);
 152                         client->ipaddr.ipaddr.ip4addr.s_addr &= htonl(mask);
 153                 }
 154                 break;
 155
 156         case AF_INET6:
 157                 if (client->prefix > 128) return 0;
 158
 159                 if (client->prefix < 128) {
 160                         int i;
 161                         uint32_t mask, *addr;
 162
 163                         addr = (uint32_t *) &client->ipaddr.ipaddr.ip6addr;
 164
 165                         for (i = client->prefix; i < 128; i += 32) {
 166                                 mask = ~0;
 167                                 mask <<= ((128 - i) & 0x1f);
 168                                 addr[i / 32] &= mask;
 169                         }
 170                 }
 171                 break;
 172
 173         default:
 174                 return 0;
 175         }
 176
 177         return 1;
 178 }
 179
 180
 181 /*
 182  *      Add a client to the tree.
 183  */
 184 int client_add(RADCLIENT_LIST *clients, RADCLIENT *client)
 185 {
 186         /*
 187          *      Allow clients to be NULL if mainconfig.clients is NULL.
 188          */
 189
 190         if (!client || (!clients && (mainconfig.clients != NULL))) {
 191                 return 0;
 192         }
 193
 194         if (!clients) {
 195                 clients = clients_init();
 196                 if (!clients) return 0;
 197                 rad_assert(mainconfig.clients == NULL);
 198                 mainconfig.clients = clients;
 199         }
 200
 201         if (client->prefix < 0) {
 202                 return 0;
 203         }
 204
 205         if (!client_sane(client)) return 0;
 206
 207         /*
 208          *      Create a tree for it.
 209          */
 210         if (!clients->trees[client->prefix]) {
 211                 clients->trees[client->prefix] = rbtree_create(client_ipaddr_cmp,
 212                                                                client_free, 0);
 213                 if (!clients->trees[client->prefix]) {
 214                         return 0;
 215                 }
 216         }
 217
 218         /*
 219          *      Duplicate?
 220          */
 221         if (!rbtree_insert(clients->trees[client->prefix], client)) {
 222                 return 0;
 223         }
 224
 225 #ifdef WITH_SNMP
 226         if (!tree_num) {
 227                 tree_num = rbtree_create(client_num_cmp, NULL, 0);
 228         }
 229
 230
 231         /*
 232          *      Catch clients added by rlm_sql.
 233          */
 234         if (!client->auth) {
 235                 client->auth = rad_malloc(sizeof(*client->auth));
 236                 memset(client->auth, 0, sizeof(*client->auth));
 237         }
 238
 239         if (!client->acct) {
 240                 client->acct = rad_malloc(sizeof(*client->acct));
 241                 memset(client->acct, 0, sizeof(*client->acct));
 242         }
 243
 244
 245         client->number = tree_num_max;
 246         tree_num_max++;
 247         if (tree_num) rbtree_insert(tree_num, client);
 248 #endif
 249
 250         if (client->prefix < clients->min_prefix) {
 251                 clients->min_prefix = client->prefix;
 252         }
 253
 254         return 1;
 255 }
 256
 257
 258 /*
 259  *      Find a client in the RADCLIENTS list by number.
 260  *      This is a support function for the SNMP code.
 261  */
 262 RADCLIENT *client_findbynumber(const RADCLIENT_LIST *clients,
 263                                int number)
 264 {
 265 #ifdef WITH_SNMP
 266         if (!clients) return NULL;
 267
 268         if (number >= tree_num_max) return NULL;
 269
 270         if (tree_num) {
 271                 RADCLIENT myclient;
 272
 273                 myclient.number = number;
 274
 275                 return rbtree_finddata(tree_num, &myclient);
 276         }
 277 #else
 278         clients = clients;      /* -Wunused */
 279         number = number;        /* -Wunused */
 280 #endif
 281         return NULL;
 282 }
 283
 284
 285 /*
 286  *      Find a client in the RADCLIENTS list.
 287  */
 288 RADCLIENT *client_find(const RADCLIENT_LIST *clients,
 289                        const lrad_ipaddr_t *ipaddr)
 290 {
 291         int i, max_prefix;
 292         RADCLIENT myclient;
 293
 294         if (!clients || !ipaddr) return NULL;
 295
 296         switch (ipaddr->af) {
 297         case AF_INET:
 298                 max_prefix = 32;
 299                 break;
 300
 301         case AF_INET6:
 302                 max_prefix = 128;
 303                 break;
 304
 305         default :
 306                 return NULL;
 307         }
 308
 309         for (i = max_prefix; i >= clients->min_prefix; i--) {
 310                 void *data;
 311
 312                 myclient.prefix = i;
 313                 myclient.ipaddr = *ipaddr;
 314                 client_sane(&myclient); /* clean up the ipaddress */
 315
 316                 if (!clients->trees[i]) continue;
 317
 318                 data = rbtree_finddata(clients->trees[i], &myclient);
 319                 if (data) {
 320                         return data;
 321                 }
 322         }
 323
 324         return NULL;
 325 }
 326
 327
 328 /*
 329  *      Old wrapper for client_find
 330  */
 331 RADCLIENT *client_find_old(const lrad_ipaddr_t *ipaddr)
 332 {
 333         return client_find(mainconfig.clients, ipaddr);
 334 }
 335
 336
 337 /*
 338  *      Find the name of a client (prefer short name).
 339  */
 340 const char *client_name(const RADCLIENT_LIST *clients,
 341                         const lrad_ipaddr_t *ipaddr)
 342 {
 343         /* We don't call this unless we should know about the client. */
 344         RADCLIENT *cl;
 345         char host_ipaddr[128];
 346
 347         if ((cl = client_find(clients, ipaddr)) != NULL) {
 348                 if (cl->shortname && cl->shortname[0])
 349                         return cl->shortname;
 350                 else
 351                         return cl->longname;
 352         }
 353
 354         /*
 355          * this isn't normally reachable, but if a loggable event happens just
 356          * after a client list change and a HUP, then we may not know this
 357          * information any more.
 358          *
 359          * If you see lots of these, then there's something wrong.
 360          */
 361         radlog(L_ERR, "Trying to look up name of unknown client %s.\n",
 362                ip_ntoh(ipaddr, host_ipaddr, sizeof(host_ipaddr)));
 363
 364         return "UNKNOWN-CLIENT";
 365 }
 366
 367 const char *client_name_old(const lrad_ipaddr_t *ipaddr)
 368 {
 369         return client_name(mainconfig.clients, ipaddr);
 370 }
 371
 372 static struct in_addr cl_ip4addr;
 373 static struct in6_addr cl_ip6addr;
 374
 375 static const CONF_PARSER client_config[] = {
 376         { "ipaddr",  PW_TYPE_IPADDR,
 377           0, &cl_ip4addr,  NULL },
 378         { "ipv6addr",  PW_TYPE_IPV6ADDR,
 379           0, &cl_ip6addr, NULL },
 380         { "netmask",  PW_TYPE_INTEGER,
 381           offsetof(RADCLIENT, prefix), 0, NULL },
 382
 383         { "secret",  PW_TYPE_STRING_PTR,
 384           offsetof(RADCLIENT, secret), 0, NULL },
 385         { "shortname",  PW_TYPE_STRING_PTR,
 386           offsetof(RADCLIENT, shortname), 0, NULL },
 387         { "nastype",  PW_TYPE_STRING_PTR,
 388           offsetof(RADCLIENT, nastype), 0, NULL },
 389         { "login",  PW_TYPE_STRING_PTR,
 390           offsetof(RADCLIENT, login), 0, NULL },
 391         { "password",  PW_TYPE_STRING_PTR,
 392           offsetof(RADCLIENT, password), 0, NULL },
 393         { "server",  PW_TYPE_STRING_PTR,
 394           offsetof(RADCLIENT, server), 0, NULL },
 395
 396         { NULL, -1, 0, NULL, NULL }
 397 };
 398
 399
 400 /*
 401  *      Create the linked list of clients from the new configuration
 402  *      type.  This way we don't have to change too much in the other
 403  *      source-files.
 404  */
 405 RADCLIENT_LIST *clients_parse_section(CONF_SECTION *section)
 406 {
 407         CONF_SECTION    *cs;
 408         RADCLIENT       *c;
 409         const char      *name2;
 410         RADCLIENT_LIST  *clients;
 411
 412         /*
 413          *      Be forgiving.  If there's already a clients, return
 414          *      it.  Otherwise create a new one.
 415          */
 416         clients = cf_data_find(section, "clients");
 417         if (clients) return clients;
 418
 419         clients = clients_init();
 420         if (!clients) return NULL;
 421
 422         /*
 423          *      Associate the clients structure with the section, where
 424          *      it will be freed once the section is freed.
 425          */
 426         if (cf_data_add(section, "clients", clients, clients_free) < 0) {
 427                 cf_log_err(cf_sectiontoitem(section),
 428                            "Failed to associate clients with section %s",
 429                        cf_section_name1(section));
 430                 clients_free(clients);
 431                 return NULL;
 432         }
 433
 434         for (cs = cf_subsection_find_next(section, NULL, "client");
 435              cs != NULL;
 436              cs = cf_subsection_find_next(section, cs, "client")) {
 437
 438                 name2 = cf_section_name2(cs);
 439                 if (!name2) {
 440                         cf_log_err(cf_sectiontoitem(cs),
 441                                    "Missing client name");
 442                         return NULL;
 443                 }
 444
 445                 /*
 446                  * The size is fine.. Let's create the buffer
 447                  */
 448                 c = rad_malloc(sizeof(*c));
 449                 memset(c, 0, sizeof(*c));
 450
 451 #ifdef WITH_SNMP
 452                 c->auth = rad_malloc(sizeof(*c->auth));
 453                 memset(c->auth, 0, sizeof(*c->auth));
 454
 455                 c->acct = rad_malloc(sizeof(*c->acct));
 456                 memset(c->acct, 0, sizeof(*c->acct));
 457 #endif
 458
 459                 memset(&cl_ip4addr, 0, sizeof(cl_ip4addr));
 460                 memset(&cl_ip6addr, 0, sizeof(cl_ip6addr));
 461                 c->prefix = -1;
 462
 463                 if (cf_section_parse(cs, c, client_config) < 0) {
 464                         client_free(c);
 465                         cf_log_err(cf_sectiontoitem(cs),
 466                                    "Error parsing client section.");
 467                         return NULL;
 468                 }
 469
 470                 /*
 471                  *      Global clients can set servers to use,
 472                  *      per-server clients cannot.
 473                  */
 474                 if ((section != mainconfig.config) && c->server) {
 475                         client_free(c);
 476                         cf_log_err(cf_sectiontoitem(cs),
 477                                    "Clients inside of an server section cannot point to another server.");
 478                         return NULL;
 479                 }
 480
 481                 /*
 482                  *      No "ipaddr" or "ipv6addr", use old-style
 483                  *      "client <ipaddr> {" syntax.
 484                  */
 485                 if (!cf_pair_find(cs, "ipaddr") &&
 486                     !cf_pair_find(cs, "ipv6addr")) {
 487                         char *prefix_ptr;
 488
 489                         prefix_ptr = strchr(name2, '/');
 490
 491                         /*
 492                          *      Look for prefixes.
 493                          */
 494                         if (prefix_ptr) {
 495                                 c->prefix = atoi(prefix_ptr + 1);
 496                                 if ((c->prefix < 0) || (c->prefix > 128)) {
 497                                         client_free(c);
 498                                         cf_log_err(cf_sectiontoitem(cs),
 499                                                    "Invalid Prefix value '%s' for IP.",
 500                                                    prefix_ptr + 1);
 501                                         return NULL;
 502                                 }
 503                                 /* Replace '/' with '\0' */
 504                                 *prefix_ptr = '\0';
 505                         }
 506
 507                         /*
 508                          *      Always get the numeric representation of IP
 509                          */
 510                         if (ip_hton(name2, AF_UNSPEC, &c->ipaddr) < 0) {
 511                                 client_free(c);
 512                                 cf_log_err(cf_sectiontoitem(cs),
 513                                            "Failed to look up hostname %s: %s",
 514                                            name2, librad_errstr);
 515                                 return NULL;
 516                         }
 517
 518                         if (prefix_ptr) *prefix_ptr = '/';
 519                         c->longname = strdup(name2);
 520
 521                         if (!c->shortname) c->shortname = strdup(c->longname);
 522
 523                 } else {
 524                         char buffer[1024];
 525
 526                         /*
 527                          *      Figure out which one to use.
 528                          */
 529                         if (cf_pair_find(cs, "ipaddr")) {
 530                                 c->ipaddr.af = AF_INET;
 531                                 c->ipaddr.ipaddr.ip4addr = cl_ip4addr;
 532
 533                                 if ((c->prefix < -1) || (c->prefix > 32)) {
 534                                         client_free(c);
 535                                         cf_log_err(cf_sectiontoitem(cs),
 536                                                    "Netmask must be between 0 and 32");
 537                                         return NULL;
 538                                 }
 539
 540                         } else if (cf_pair_find(cs, "ipv6addr")) {
 541                                 c->ipaddr.af = AF_INET6;
 542                                 c->ipaddr.ipaddr.ip6addr = cl_ip6addr;
 543
 544                                 if ((c->prefix < -1) || (c->prefix > 128)) {
 545                                         client_free(c);
 546                                         cf_log_err(cf_sectiontoitem(cs),
 547                                                    "Netmask must be between 0 and 128");
 548                                         return NULL;
 549                                 }
 550                         } else {
 551                                 client_free(c); /* a fairly bad error */
 552                                 return NULL;
 553                         }
 554
 555                         ip_ntoh(&c->ipaddr, buffer, sizeof(buffer));
 556                         c->longname = strdup(buffer);
 557
 558                         /*
 559                          *      Set the short name to the name2
 560                          */
 561                         if (!c->shortname) c->shortname = strdup(name2);
 562                 }
 563
 564                 if (c->prefix < 0) switch (c->ipaddr.af) {
 565                 case AF_INET:
 566                         c->prefix = 32;
 567                         break;
 568                 case AF_INET6:
 569                         c->prefix = 128;
 570                         break;
 571                 default:
 572                         break;
 573                 }
 574
 575                 /*
 576                  *      FIXME: Add the client as data via cf_data_add,
 577                  *      for migration issues.
 578                  */
 579
 580                 if (!client_add(clients, c)) {
 581                         cf_log_err(cf_sectiontoitem(cs),
 582                                    "Failed to add client %s", name2);
 583                         client_free(c);
 584                         return NULL;
 585                 }
 586         }
 587
 588         return clients;
 589 }