src/main/conffile.c

   1 /*
   2  * conffile.c   Read the radiusd.conf file.
   3  *
   4  *              Yep I should learn to use lex & yacc, or at least
   5  *              write a decent parser. I know how to do that, really :)
   6  *              miquels@cistron.nl
   7  *
   8  * Version:     $Id$
   9  *
  10  *   This program is free software; you can redistribute it and/or modify
  11  *   it under the terms of the GNU General Public License as published by
  12  *   the Free Software Foundation; either version 2 of the License, or
  13  *   (at your option) any later version.
  14  *
  15  *   This program is distributed in the hope that it will be useful,
  16  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  *   GNU General Public License for more details.
  19  *
  20  *   You should have received a copy of the GNU General Public License
  21  *   along with this program; if not, write to the Free Software
  22  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  23  *
  24  * Copyright 2000,2006  The FreeRADIUS server project
  25  * Copyright 2000  Miquel van Smoorenburg <miquels@cistron.nl>
  26  * Copyright 2000  Alan DeKok <aland@ox.org>
  27  */
  28
  29 RCSID("$Id$")
  30
  31 #include <freeradius-devel/radiusd.h>
  32 #include <freeradius-devel/parser.h>
  33 #include <freeradius-devel/rad_assert.h>
  34
  35 #ifdef HAVE_DIRENT_H
  36 #include <dirent.h>
  37 #endif
  38
  39 #ifdef HAVE_SYS_STAT_H
  40 #include <sys/stat.h>
  41 #endif
  42
  43 #include <ctype.h>
  44
  45 typedef enum conf_property {
  46         CONF_PROPERTY_INVALID = 0,
  47         CONF_PROPERTY_NAME,
  48         CONF_PROPERTY_INSTANCE,
  49 } CONF_PROPERTY;
  50
  51 static const FR_NAME_NUMBER conf_property_name[] = {
  52         { "name",       CONF_PROPERTY_NAME},
  53         { "instance",   CONF_PROPERTY_INSTANCE},
  54
  55         {  NULL , -1 }
  56 };
  57
  58 typedef enum conf_type {
  59         CONF_ITEM_INVALID = 0,
  60         CONF_ITEM_PAIR,
  61         CONF_ITEM_SECTION,
  62         CONF_ITEM_DATA
  63 } CONF_ITEM_TYPE;
  64
  65 struct conf_item {
  66         struct conf_item *next;         //!< Sibling.
  67         struct conf_part *parent;       //!< Parent.
  68         int lineno;                     //!< The line number the config item began on.
  69         char const *filename;           //!< The file the config item was parsed from.
  70         CONF_ITEM_TYPE type;            //!< Whether the config item is a config_pair, conf_section or conf_data.
  71 };
  72
  73 /** Configuration AVP similar to a VALUE_PAIR
  74  *
  75  */
  76 struct conf_pair {
  77         CONF_ITEM item;
  78         char const *attr;               //!< Attribute name
  79         char const *value;              //!< Attribute value
  80         FR_TOKEN op;                    //!< Operator e.g. =, :=
  81         FR_TOKEN lhs_type;              //!< Name quoting style T_(DOUBLE|SINGLE|BACK)_QUOTE_STRING or T_BARE_WORD.
  82         FR_TOKEN rhs_type;              //!< Value Quoting style T_(DOUBLE|SINGLE|BACK)_QUOTE_STRING or T_BARE_WORD.
  83         bool pass2;                     //!< do expansion in pass2.
  84 };
  85
  86 /** Internal data that is associated with a configuration section
  87  *
  88  */
  89 struct conf_data {
  90         CONF_ITEM  item;
  91         char const *name;
  92         int        flag;
  93         void       *data;               //!< User data
  94         void       (*free)(void *);     //!< Free user data function
  95 };
  96
  97 struct conf_part {
  98         CONF_ITEM item;
  99         char const      *name1;
 100         char const      *name2;
 101         FR_TOKEN        name2_type;
 102
 103         CONF_ITEM       *children;
 104         CONF_ITEM       *tail;          //!< For speed.
 105         CONF_SECTION    *template;
 106
 107         rbtree_t        *pair_tree;     //!< and a partridge..
 108         rbtree_t        *section_tree;  //!< no jokes here.
 109         rbtree_t        *name2_tree;    //!< for sections of the same name2
 110         rbtree_t        *data_tree;
 111
 112         void            *base;
 113         int             depth;
 114
 115         CONF_PARSER const *variables;
 116 };
 117
 118 CONF_SECTION *root_config = NULL;
 119 bool cf_new_escape = false;
 120
 121
 122 static int              cf_data_add_internal(CONF_SECTION *cs, char const *name, void *data,
 123                                              void (*data_free)(void *), int flag);
 124
 125 static void             *cf_data_find_internal(CONF_SECTION const *cs, char const *name, int flag);
 126
 127 static char const       *cf_expand_variables(char const *cf, int *lineno,
 128                                              CONF_SECTION *outercs,
 129                                              char *output, size_t outsize,
 130                                              char const *input, bool *soft_fail);
 131
 132 /*
 133  *      Isolate the scary casts in these tiny provably-safe functions
 134  */
 135
 136 /** Cast a CONF_ITEM to a CONF_PAIR
 137  *
 138  */
 139 CONF_PAIR *cf_item_to_pair(CONF_ITEM const *ci)
 140 {
 141         CONF_PAIR *out;
 142
 143         if (ci == NULL) return NULL;
 144
 145         rad_assert(ci->type == CONF_ITEM_PAIR);
 146
 147         memcpy(&out, &ci, sizeof(out));
 148         return out;
 149 }
 150
 151 /** Cast a CONF_ITEM to a CONF_SECTION
 152  *
 153  */
 154 CONF_SECTION *cf_item_to_section(CONF_ITEM const *ci)
 155 {
 156         CONF_SECTION *out;
 157
 158         if (ci == NULL) return NULL;
 159
 160         rad_assert(ci->type == CONF_ITEM_SECTION);
 161
 162         memcpy(&out, &ci, sizeof(out));
 163         return out;
 164 }
 165
 166 /** Cast a CONF_PAIR to a CONF_ITEM
 167  *
 168  */
 169 CONF_ITEM *cf_pair_to_item(CONF_PAIR const *cp)
 170 {
 171         CONF_ITEM *out;
 172
 173         if (cp == NULL) return NULL;
 174
 175         memcpy(&out, &cp, sizeof(out));
 176         return out;
 177 }
 178
 179 /** Cast a CONF_SECTION to a CONF_ITEM
 180  *
 181  */
 182 CONF_ITEM *cf_section_to_item(CONF_SECTION const *cs)
 183 {
 184         CONF_ITEM *out;
 185
 186         if (cs == NULL) return NULL;
 187
 188         memcpy(&out, &cs, sizeof(out));
 189         return out;
 190 }
 191
 192 /** Cast CONF_DATA to a CONF_ITEM
 193  *
 194  */
 195 static CONF_ITEM *cf_data_to_item(CONF_DATA const *cd)
 196 {
 197         CONF_ITEM *out;
 198
 199         if (cd == NULL) {
 200                 return NULL;
 201         }
 202
 203         memcpy(&out, &cd, sizeof(out));
 204         return out;
 205 }
 206
 207 static int _cf_data_free(CONF_DATA *cd)
 208 {
 209         if (cd->free) cd->free(cd->data);
 210
 211         return 0;
 212 }
 213
 214 /*
 215  *      rbtree callback function
 216  */
 217 static int pair_cmp(void const *a, void const *b)
 218 {
 219         CONF_PAIR const *one = a;
 220         CONF_PAIR const *two = b;
 221
 222         return strcmp(one->attr, two->attr);
 223 }
 224
 225
 226 /*
 227  *      rbtree callback function
 228  */
 229 static int section_cmp(void const *a, void const *b)
 230 {
 231         CONF_SECTION const *one = a;
 232         CONF_SECTION const *two = b;
 233
 234         return strcmp(one->name1, two->name1);
 235 }
 236
 237
 238 /*
 239  *      rbtree callback function
 240  */
 241 static int name2_cmp(void const *a, void const *b)
 242 {
 243         CONF_SECTION const *one = a;
 244         CONF_SECTION const *two = b;
 245
 246         rad_assert(strcmp(one->name1, two->name1) == 0);
 247
 248         if (!one->name2 && !two->name2) return 0;
 249         if (one->name2 && !two->name2) return -1;
 250         if (!one->name2 && two->name2) return +1;
 251
 252         return strcmp(one->name2, two->name2);
 253 }
 254
 255
 256 /*
 257  *      rbtree callback function
 258  */
 259 static int data_cmp(void const *a, void const *b)
 260 {
 261         int rcode;
 262
 263         CONF_DATA const *one = a;
 264         CONF_DATA const *two = b;
 265
 266         rcode = one->flag - two->flag;
 267         if (rcode != 0) return rcode;
 268
 269         return strcmp(one->name, two->name);
 270 }
 271
 272 static int _cf_section_free(CONF_SECTION *cs)
 273 {
 274         /*
 275          *      Name1 and name2 are allocated contiguous with
 276          *      cs.
 277          */
 278         if (cs->pair_tree) {
 279                 rbtree_free(cs->pair_tree);
 280                 cs->pair_tree = NULL;
 281         }
 282         if (cs->section_tree) {
 283                 rbtree_free(cs->section_tree);
 284                 cs->section_tree = NULL;
 285         }
 286         if (cs->name2_tree) {
 287                 rbtree_free(cs->name2_tree);
 288                 cs->name2_tree = NULL;
 289         }
 290         if (cs->data_tree) {
 291                 rbtree_free(cs->data_tree);
 292                 cs->data_tree = NULL;
 293         }
 294
 295         return 0;
 296 }
 297
 298 /** Allocate a CONF_PAIR
 299  *
 300  * @param parent CONF_SECTION to hang this CONF_PAIR off of.
 301  * @param attr name.
 302  * @param value of CONF_PAIR.
 303  * @param op T_OP_EQ, T_OP_SET etc.
 304  * @param lhs_type T_BARE_WORD, T_DOUBLE_QUOTED_STRING, T_BACK_QUOTED_STRING
 305  * @param rhs_type T_BARE_WORD, T_DOUBLE_QUOTED_STRING, T_BACK_QUOTED_STRING
 306  * @return NULL on error, else a new CONF_SECTION parented by parent.
 307  */
 308 CONF_PAIR *cf_pair_alloc(CONF_SECTION *parent, char const *attr, char const *value,
 309                          FR_TOKEN op, FR_TOKEN lhs_type, FR_TOKEN rhs_type)
 310 {
 311         CONF_PAIR *cp;
 312
 313         rad_assert(fr_equality_op[op] || fr_assignment_op[op]);
 314         if (!attr) return NULL;
 315
 316         cp = talloc_zero(parent, CONF_PAIR);
 317         if (!cp) return NULL;
 318
 319         cp->item.type = CONF_ITEM_PAIR;
 320         cp->item.parent = parent;
 321         cp->lhs_type = lhs_type;
 322         cp->rhs_type = rhs_type;
 323         cp->op = op;
 324
 325         cp->attr = talloc_typed_strdup(cp, attr);
 326         if (!cp->attr) {
 327         error:
 328                 talloc_free(cp);
 329                 return NULL;
 330         }
 331
 332         if (value) {
 333                 cp->value = talloc_typed_strdup(cp, value);
 334                 if (!cp->value) goto error;
 335         }
 336
 337         return cp;
 338 }
 339
 340 /** Duplicate a CONF_PAIR
 341  *
 342  * @param parent to allocate new pair in.
 343  * @param cp to duplicate.
 344  * @return NULL on error, else a duplicate of the input pair.
 345  */
 346 CONF_PAIR *cf_pair_dup(CONF_SECTION *parent, CONF_PAIR *cp)
 347 {
 348         CONF_PAIR *new;
 349
 350         rad_assert(parent);
 351         rad_assert(cp);
 352
 353         new = cf_pair_alloc(parent, cp->attr, cf_pair_value(cp),
 354                             cp->op, cp->lhs_type, cp->rhs_type);
 355         if (new) {
 356                 new->item.lineno = cp->item.lineno;
 357                 new->item.filename = talloc_strdup(new, cp->item.filename);
 358         }
 359
 360         return new;
 361 }
 362
 363 /** Add a configuration pair to a section
 364  *
 365  * @param parent section to add pair to.
 366  * @param cp to add.
 367  */
 368 void cf_pair_add(CONF_SECTION *parent, CONF_PAIR *cp)
 369 {
 370         cf_item_add(parent, cf_pair_to_item(cp));
 371 }
 372
 373 /** Allocate a CONF_SECTION
 374  *
 375  * @param parent CONF_SECTION to hang this CONF_SECTION off of.
 376  * @param name1 Primary name.
 377  * @param name2 Secondary name.
 378  * @return NULL on error, else a new CONF_SECTION parented by parent.
 379  */
 380 CONF_SECTION *cf_section_alloc(CONF_SECTION *parent, char const *name1, char const *name2)
 381 {
 382         CONF_SECTION *cs;
 383         char buffer[1024];
 384
 385         if (!name1) return NULL;
 386
 387         if (name2) {
 388                 if (strchr(name2, '$')) {
 389                         name2 = cf_expand_variables(parent->item.filename,
 390                                                 &parent->item.lineno,
 391                                                 parent,
 392                                                 buffer, sizeof(buffer), name2, NULL);
 393                         if (!name2) {
 394                                 ERROR("Failed expanding section name");
 395                                 return NULL;
 396                         }
 397                 }
 398         }
 399
 400         cs = talloc_zero(parent, CONF_SECTION);
 401         if (!cs) return NULL;
 402
 403         cs->item.type = CONF_ITEM_SECTION;
 404         cs->item.parent = parent;
 405
 406         cs->name1 = talloc_typed_strdup(cs, name1);
 407         if (!cs->name1) {
 408         error:
 409                 talloc_free(cs);
 410                 return NULL;
 411         }
 412
 413         if (name2) {
 414                 cs->name2 = talloc_typed_strdup(cs, name2);
 415                 if (!cs->name2) goto error;
 416         }
 417
 418         cs->pair_tree = rbtree_create(cs, pair_cmp, NULL, 0);
 419         if (!cs->pair_tree) goto error;
 420
 421         talloc_set_destructor(cs, _cf_section_free);
 422
 423         /*
 424          *      Don't create a data tree, it may not be needed.
 425          */
 426
 427         /*
 428          *      Don't create the section tree here, it may not
 429          *      be needed.
 430          */
 431
 432         if (parent) cs->depth = parent->depth + 1;
 433
 434         return cs;
 435 }
 436
 437 /** Duplicate a configuration section
 438  *
 439  * @note recursively duplicates any child sections.
 440  * @note does not duplicate any data associated with a section, or its child sections.
 441  *
 442  * @param parent section.
 443  * @param cs to duplicate.
 444  * @param name1 of new section.
 445  * @param name2 of new section.
 446  * @param copy_meta Copy additional meta data for a section (like template, base, depth and variables).
 447  * @return a duplicate of the existing section, or NULL on error.
 448  */
 449 CONF_SECTION *cf_section_dup(CONF_SECTION *parent, CONF_SECTION const *cs,
 450                              char const *name1, char const *name2, bool copy_meta)
 451 {
 452         CONF_SECTION *new, *subcs;
 453         CONF_PAIR *cp;
 454         CONF_ITEM *ci;
 455
 456         new = cf_section_alloc(parent, name1, name2);
 457
 458         if (copy_meta) {
 459                 new->template = cs->template;
 460                 new->base = cs->base;
 461                 new->depth = cs->depth;
 462                 new->variables = cs->variables;
 463         }
 464
 465         new->item.lineno = cs->item.lineno;
 466         new->item.filename = talloc_strdup(new, cs->item.filename);
 467
 468         for (ci = cs->children; ci; ci = ci->next) {
 469                 switch (ci->type) {
 470                 case CONF_ITEM_SECTION:
 471                         subcs = cf_item_to_section(ci);
 472                         subcs = cf_section_dup(new, subcs,
 473                                                cf_section_name1(subcs), cf_section_name2(subcs),
 474                                                copy_meta);
 475                         if (!subcs) {
 476                                 talloc_free(new);
 477                                 return NULL;
 478                         }
 479                         cf_section_add(new, subcs);
 480                         break;
 481
 482                 case CONF_ITEM_PAIR:
 483                         cp = cf_pair_dup(new, cf_item_to_pair(ci));
 484                         if (!cp) {
 485                                 talloc_free(new);
 486                                 return NULL;
 487                         }
 488                         cf_pair_add(new, cp);
 489                         break;
 490
 491                 case CONF_ITEM_DATA: /* Skip data */
 492                         break;
 493
 494                 case CONF_ITEM_INVALID:
 495                         rad_assert(0);
 496                 }
 497         }
 498
 499         return new;
 500 }
 501
 502 void cf_section_add(CONF_SECTION *parent, CONF_SECTION *cs)
 503 {
 504         cf_item_add(parent, &(cs->item));
 505 }
 506
 507 /** Replace pair in a given section with a new pair, of the given value.
 508  *
 509  * @param cs to replace pair in.
 510  * @param cp to replace.
 511  * @param value New value to assign to cp.
 512  * @return 0 on success, -1 on failure.
 513  */
 514 int cf_pair_replace(CONF_SECTION *cs, CONF_PAIR *cp, char const *value)
 515 {
 516         CONF_PAIR *newp;
 517         CONF_ITEM *ci, *cn, **last;
 518
 519         newp = cf_pair_alloc(cs, cp->attr, value, cp->op, cp->lhs_type, cp->rhs_type);
 520         if (!newp) return -1;
 521
 522         ci = &(cp->item);
 523         cn = &(newp->item);
 524
 525         /*
 526          *      Find the old one from the linked list, and replace it
 527          *      with the new one.
 528          */
 529         for (last = &cs->children; (*last) != NULL; last = &(*last)->next) {
 530                 if (*last == ci) {
 531                         cn->next = (*last)->next;
 532                         *last = cn;
 533                         ci->next = NULL;
 534                         break;
 535                 }
 536         }
 537
 538         rbtree_deletebydata(cs->pair_tree, ci);
 539
 540         rbtree_insert(cs->pair_tree, cn);
 541
 542         return 0;
 543 }
 544
 545
 546 /*
 547  *      Add an item to a configuration section.
 548  */
 549 void cf_item_add(CONF_SECTION *cs, CONF_ITEM *ci)
 550 {
 551 #ifndef NDEBUG
 552         CONF_ITEM *first = ci;
 553 #endif
 554
 555         rad_assert((void *)cs != (void *)ci);
 556
 557         if (!cs || !ci) return;
 558
 559         if (!cs->children) {
 560                 rad_assert(cs->tail == NULL);
 561                 cs->children = ci;
 562         } else {
 563                 rad_assert(cs->tail != NULL);
 564                 cs->tail->next = ci;
 565         }
 566
 567         /*
 568          *      Update the trees (and tail) for each item added.
 569          */
 570         for (/* nothing */; ci != NULL; ci = ci->next) {
 571                 rad_assert(ci->next != first);  /* simple cycle detection */
 572
 573                 cs->tail = ci;
 574
 575                 /*
 576                  *      For fast lookups, pairs and sections get
 577                  *      added to rbtree's.
 578                  */
 579                 switch (ci->type) {
 580                 case CONF_ITEM_PAIR:
 581                         if (!rbtree_insert(cs->pair_tree, ci)) {
 582                                 CONF_PAIR *cp = cf_item_to_pair(ci);
 583
 584                                 if (strcmp(cp->attr, "confdir") == 0) break;
 585                                 if (!cp->value) break; /* module name, "ok", etc. */
 586                         }
 587                         break;
 588
 589                 case CONF_ITEM_SECTION: {
 590                         CONF_SECTION *cs_new = cf_item_to_section(ci);
 591                         CONF_SECTION *name1_cs;
 592
 593                         if (!cs->section_tree) {
 594                                 cs->section_tree = rbtree_create(cs, section_cmp, NULL, 0);
 595                                 if (!cs->section_tree) {
 596                                         ERROR("Out of memory");
 597                                         fr_exit_now(1);
 598                                 }
 599                         }
 600
 601                         name1_cs = rbtree_finddata(cs->section_tree, cs_new);
 602                         if (!name1_cs) {
 603                                 if (!rbtree_insert(cs->section_tree, cs_new)) {
 604                                         ERROR("Failed inserting section into tree");
 605                                         fr_exit_now(1);
 606                                 }
 607                                 break;
 608                         }
 609
 610                         /*
 611                          *      We already have a section of
 612                          *      this "name1".  Add a new
 613                          *      sub-section based on name2.
 614                          */
 615                         if (!name1_cs->name2_tree) {
 616                                 name1_cs->name2_tree = rbtree_create(name1_cs, name2_cmp, NULL, 0);
 617                                 if (!name1_cs->name2_tree) {
 618                                         ERROR("Out of memory");
 619                                         fr_exit_now(1);
 620                                 }
 621                         }
 622
 623                         /*
 624                          *      We don't care if this fails.
 625                          *      If the user tries to create
 626                          *      two sections of the same
 627                          *      name1/name2, the duplicate
 628                          *      section is just silently
 629                          *      ignored.
 630                          */
 631                         rbtree_insert(name1_cs->name2_tree, cs_new);
 632                         break;
 633                 } /* was a section */
 634
 635                 case CONF_ITEM_DATA:
 636                         if (!cs->data_tree) {
 637                                 cs->data_tree = rbtree_create(cs, data_cmp, NULL, 0);
 638                         }
 639                         if (cs->data_tree) {
 640                                 rbtree_insert(cs->data_tree, ci);
 641                         }
 642                         break;
 643
 644                 default: /* FIXME: assert & error! */
 645                         break;
 646
 647                 } /* switch over conf types */
 648         } /* loop over ci */
 649 }
 650
 651
 652 CONF_ITEM *cf_reference_item(CONF_SECTION const *parentcs,
 653                              CONF_SECTION *outercs,
 654                              char const *ptr)
 655 {
 656         CONF_PAIR *cp;
 657         CONF_SECTION *next;
 658         CONF_SECTION const *cs = outercs;
 659         char name[8192];
 660         char *p;
 661
 662         if (!cs) goto no_such_item;
 663
 664         strlcpy(name, ptr, sizeof(name));
 665         p = name;
 666
 667         /*
 668          *      ".foo" means "foo from the current section"
 669          */
 670         if (*p == '.') {
 671                 p++;
 672
 673                 /*
 674                  *      Just '.' means the current section
 675                  */
 676                 if (*p == '\0') {
 677                         return cf_section_to_item(cs);
 678                 }
 679
 680                 /*
 681                  *      ..foo means "foo from the section
 682                  *      enclosing this section" (etc.)
 683                  */
 684                 while (*p == '.') {
 685                         if (cs->item.parent) {
 686                                 cs = cs->item.parent;
 687                         }
 688
 689                         /*
 690                          *      .. means the section
 691                          *      enclosing this section
 692                          */
 693                         if (!*++p) {
 694                                 return cf_section_to_item(cs);
 695                         }
 696                 }
 697
 698                 /*
 699                  *      "foo.bar.baz" means "from the root"
 700                  */
 701         } else if (strchr(p, '.') != NULL) {
 702                 if (!parentcs) goto no_such_item;
 703
 704                 cs = parentcs;
 705         }
 706
 707         while (*p) {
 708                 char *q, *r;
 709
 710                 r = strchr(p, '[');
 711                 q = strchr(p, '.');
 712                 if (!r && !q) break;
 713
 714                 if (r && q > r) q = NULL;
 715                 if (q && q < r) r = NULL;
 716
 717                 /*
 718                  *      Split off name2.
 719                  */
 720                 if (r) {
 721                         q = strchr(r + 1, ']');
 722                         if (!q) return NULL; /* parse error */
 723
 724                         /*
 725                          *      Points to foo[bar]xx: parse error,
 726                          *      it should be foo[bar] or foo[bar].baz
 727                          */
 728                         if (q[1] && q[1] != '.') goto no_such_item;
 729
 730                         *r = '\0';
 731                         *q = '\0';
 732                         next = cf_section_sub_find_name2(cs, p, r + 1);
 733                         *r = '[';
 734                         *q = ']';
 735
 736                         /*
 737                          *      Points to a named instance of a section.
 738                          */
 739                         if (!q[1]) {
 740                                 if (!next) goto no_such_item;
 741                                 return &(next->item);
 742                         }
 743
 744                         q++;    /* ensure we skip the ']' and '.' */
 745
 746                 } else {
 747                         *q = '\0';
 748                         next = cf_section_sub_find(cs, p);
 749                         *q = '.';
 750                 }
 751
 752                 if (!next) break; /* it MAY be a pair in this section! */
 753
 754                 cs = next;
 755                 p = q + 1;
 756         }
 757
 758         if (!*p) goto no_such_item;
 759
 760  retry:
 761         /*
 762          *      Find it in the current referenced
 763          *      section.
 764          */
 765         cp = cf_pair_find(cs, p);
 766         if (cp) return &(cp->item);
 767
 768         next = cf_section_sub_find(cs, p);
 769         if (next) return &(next->item);
 770
 771         /*
 772          *      "foo" is "in the current section, OR in main".
 773          */
 774         if ((p == name) && (parentcs != NULL) && (cs != parentcs)) {
 775                 cs = parentcs;
 776                 goto retry;
 777         }
 778
 779 no_such_item:
 780         WARN("No such configuration item %s", ptr);
 781         return NULL;
 782 }
 783
 784
 785 CONF_SECTION *cf_top_section(CONF_SECTION *cs)
 786 {
 787         if (!cs) return NULL;
 788
 789         while (cs->item.parent != NULL) {
 790                 cs = cs->item.parent;
 791         }
 792
 793         return cs;
 794 }
 795
 796
 797 /*
 798  *      Expand the variables in an input string.
 799  */
 800 static char const *cf_expand_variables(char const *cf, int *lineno,
 801                                        CONF_SECTION *outercs,
 802                                        char *output, size_t outsize,
 803                                        char const *input, bool *soft_fail)
 804 {
 805         char *p;
 806         char const *end, *ptr;
 807         CONF_SECTION const *parentcs;
 808         char name[8192];
 809
 810         if (soft_fail) *soft_fail = false;
 811
 812         /*
 813          *      Find the master parent conf section.
 814          *      We can't use main_config.config, because we're in the
 815          *      process of re-building it, and it isn't set up yet...
 816          */
 817         parentcs = cf_top_section(outercs);
 818
 819         p = output;
 820         ptr = input;
 821         while (*ptr) {
 822                 /*
 823                  *      Ignore anything other than "${"
 824                  */
 825                 if ((*ptr == '$') && (ptr[1] == '{')) {
 826                         CONF_ITEM *ci;
 827                         CONF_PAIR *cp;
 828                         char *q;
 829
 830                         /*
 831                          *      FIXME: Add support for ${foo:-bar},
 832                          *      like in xlat.c
 833                          */
 834
 835                         /*
 836                          *      Look for trailing '}', and log a
 837                          *      warning for anything that doesn't match,
 838                          *      and exit with a fatal error.
 839                          */
 840                         end = strchr(ptr, '}');
 841                         if (end == NULL) {
 842                                 *p = '\0';
 843                                 INFO("%s[%d]: Variable expansion missing }",
 844                                        cf, *lineno);
 845                                 return NULL;
 846                         }
 847
 848                         ptr += 2;
 849
 850                         /*
 851                          *      Can't really happen because input lines are
 852                          *      capped at 8k, which is sizeof(name)
 853                          */
 854                         if ((size_t) (end - ptr) >= sizeof(name)) {
 855                                 ERROR("%s[%d]: Reference string is too large",
 856                                       cf, *lineno);
 857                                 return NULL;
 858                         }
 859
 860                         memcpy(name, ptr, end - ptr);
 861                         name[end - ptr] = '\0';
 862
 863                         q = strchr(name, ':');
 864                         if (q) {
 865                                 *(q++) = '\0';
 866                         }
 867
 868                         ci = cf_reference_item(parentcs, outercs, name);
 869                         if (!ci) {
 870                                 if (soft_fail) *soft_fail = true;
 871                                 ERROR("%s[%d]: Reference \"%s\" not found", cf, *lineno, input);
 872                                 return NULL;
 873                         }
 874
 875                         /*
 876                          *      The expansion doesn't refer to another item or section
 877                          *      it's the property of a section.
 878                          */
 879                         if (q) {
 880                                 CONF_SECTION *mycs = cf_item_to_section(ci);
 881
 882                                 if (ci->type != CONF_ITEM_SECTION) {
 883                                         ERROR("%s[%d]: Can only reference properties of sections", cf, *lineno);
 884                                         return NULL;
 885                                 }
 886
 887                                 switch (fr_str2int(conf_property_name, q, CONF_PROPERTY_INVALID)) {
 888                                 case CONF_PROPERTY_NAME:
 889                                         strcpy(p, mycs->name1);
 890                                         break;
 891
 892                                 case CONF_PROPERTY_INSTANCE:
 893                                         strcpy(p, mycs->name2 ? mycs->name2 : mycs->name1);
 894                                         break;
 895
 896                                 default:
 897                                         ERROR("%s[%d]: Invalid property '%s'", cf, *lineno, q);
 898                                         return NULL;
 899                                 }
 900                                 p += strlen(p);
 901                                 ptr = end + 1;
 902
 903                         } else if (ci->type == CONF_ITEM_PAIR) {
 904                                 /*
 905                                  *  Substitute the value of the variable.
 906                                  */
 907                                 cp = cf_item_to_pair(ci);
 908
 909                                 /*
 910                                  *      If the thing we reference is
 911                                  *      marked up as being expanded in
 912                                  *      pass2, don't expand it now.
 913                                  *      Let it be expanded in pass2.
 914                                  */
 915                                 if (cp->pass2) {
 916                                         if (soft_fail) *soft_fail = true;
 917
 918                                         ERROR("%s[%d]: Reference \"%s\" points to a variable which has not been expanded.",
 919                                               cf, *lineno, input);
 920                                         return NULL;
 921                                 }
 922
 923                                 if (!cp->value) {
 924                                         ERROR("%s[%d]: Reference \"%s\" has no value",
 925                                                cf, *lineno, input);
 926                                         return NULL;
 927                                 }
 928
 929                                 if (p + strlen(cp->value) >= output + outsize) {
 930                                         ERROR("%s[%d]: Reference \"%s\" is too long",
 931                                                cf, *lineno, input);
 932                                         return NULL;
 933                                 }
 934
 935                                 strcpy(p, cp->value);
 936                                 p += strlen(p);
 937                                 ptr = end + 1;
 938
 939                         } else if (ci->type == CONF_ITEM_SECTION) {
 940                                 CONF_SECTION *subcs;
 941
 942                                 /*
 943                                  *      Adding an entry again to a
 944                                  *      section is wrong.  We don't
 945                                  *      want an infinite loop.
 946                                  */
 947                                 if (ci->parent == outercs) {
 948                                         ERROR("%s[%d]: Cannot reference different item in same section", cf, *lineno);
 949                                         return NULL;
 950                                 }
 951
 952                                 /*
 953                                  *      Copy the section instead of
 954                                  *      referencing it.
 955                                  */
 956                                 subcs = cf_item_to_section(ci);
 957                                 subcs = cf_section_dup(outercs, subcs,
 958                                                        cf_section_name1(subcs), cf_section_name2(subcs),
 959                                                        false);
 960                                 if (!subcs) {
 961                                         ERROR("%s[%d]: Failed copying reference %s", cf, *lineno, name);
 962                                         return NULL;
 963                                 }
 964
 965                                 subcs->item.filename = ci->filename;
 966                                 subcs->item.lineno = ci->lineno;
 967                                 cf_item_add(outercs, &(subcs->item));
 968
 969                                 ptr = end + 1;
 970
 971                         } else {
 972                                 ERROR("%s[%d]: Reference \"%s\" type is invalid", cf, *lineno, input);
 973                                 return NULL;
 974                         }
 975                 } else if (memcmp(ptr, "$ENV{", 5) == 0) {
 976                         char *env;
 977
 978                         ptr += 5;
 979
 980                         /*
 981                          *      Look for trailing '}', and log a
 982                          *      warning for anything that doesn't match,
 983                          *      and exit with a fatal error.
 984                          */
 985                         end = strchr(ptr, '}');
 986                         if (end == NULL) {
 987                                 *p = '\0';
 988                                 INFO("%s[%d]: Environment variable expansion missing }",
 989                                        cf, *lineno);
 990                                 return NULL;
 991                         }
 992
 993                         /*
 994                          *      Can't really happen because input lines are
 995                          *      capped at 8k, which is sizeof(name)
 996                          */
 997                         if ((size_t) (end - ptr) >= sizeof(name)) {
 998                                 ERROR("%s[%d]: Environment variable name is too large",
 999                                        cf, *lineno);
1000                                 return NULL;
1001                         }
1002
1003                         memcpy(name, ptr, end - ptr);
1004                         name[end - ptr] = '\0';
1005
1006                         /*
1007                          *      Get the environment variable.
1008                          *      If none exists, then make it an empty string.
1009                          */
1010                         env = getenv(name);
1011                         if (env == NULL) {
1012                                 *name = '\0';
1013                                 env = name;
1014                         }
1015
1016                         if (p + strlen(env) >= output + outsize) {
1017                                 ERROR("%s[%d]: Reference \"%s\" is too long",
1018                                        cf, *lineno, input);
1019                                 return NULL;
1020                         }
1021
1022                         strcpy(p, env);
1023                         p += strlen(p);
1024                         ptr = end + 1;
1025
1026                 } else {
1027                         /*
1028                          *      Copy it over verbatim.
1029                          */
1030                         *(p++) = *(ptr++);
1031                 }
1032
1033
1034                 if (p >= (output + outsize)) {
1035                         ERROR("%s[%d]: Reference \"%s\" is too long",
1036                                cf, *lineno, input);
1037                         return NULL;
1038                 }
1039         } /* loop over all of the input string. */
1040
1041         *p = '\0';
1042
1043         return output;
1044 }
1045
1046 static char const parse_spaces[] = "                                                                                                                                                                                                                                                                ";
1047
1048 /** Validation function for ipaddr conffile types
1049  *
1050  */
1051 static inline int fr_item_validate_ipaddr(CONF_SECTION *cs, char const *name, PW_TYPE type, char const *value,
1052                                           fr_ipaddr_t *ipaddr)
1053 {
1054         char ipbuf[128];
1055
1056         if (strcmp(value, "*") == 0) {
1057                 cf_log_info(cs, "%.*s\t%s = *", cs->depth, parse_spaces, name);
1058         } else if (strspn(value, ".0123456789abdefABCDEF:%[]/") == strlen(value)) {
1059                 cf_log_info(cs, "%.*s\t%s = %s", cs->depth, parse_spaces, name, value);
1060         } else {
1061                 cf_log_info(cs, "%.*s\t%s = %s IPv%s address [%s]", cs->depth, parse_spaces, name, value,
1062                             (ipaddr->af == AF_INET ? "4" : " 6"), ip_ntoh(ipaddr, ipbuf, sizeof(ipbuf)));
1063         }
1064
1065         switch (type) {
1066         case PW_TYPE_IPV4_ADDR:
1067         case PW_TYPE_IPV6_ADDR:
1068         case PW_TYPE_COMBO_IP_ADDR:
1069                 switch (ipaddr->af) {
1070                 case AF_INET:
1071                 if (ipaddr->prefix != 32) {
1072                         ERROR("Invalid IPv4 mask length \"/%i\".  Only \"/32\" permitted for non-prefix types",
1073                               ipaddr->prefix);
1074
1075                         return -1;
1076                 }
1077                         break;
1078
1079                 case AF_INET6:
1080                 if (ipaddr->prefix != 128) {
1081                         ERROR("Invalid IPv6 mask length \"/%i\".  Only \"/128\" permitted for non-prefix types",
1082                               ipaddr->prefix);
1083
1084                         return -1;
1085                 }
1086                         break;
1087
1088                 default:
1089                         return -1;
1090                 }
1091         default:
1092                 return 0;
1093         }
1094 }
1095
1096 /*
1097  *      Parses an item (not a CONF_ITEM) into the specified format,
1098  *      with a default value.
1099  *
1100  *      Returns -1 on error, -2 if deprecated, 0 for correctly parsed,
1101  *      and 1 if the default value was used.  Note that the default
1102  *      value will be used ONLY if the CONF_PAIR is NULL.
1103  */
1104 int cf_item_parse(CONF_SECTION *cs, char const *name, unsigned int type, void *data, char const *dflt)
1105 {
1106         int rcode;
1107         bool deprecated, required, attribute, secret, file_input, cant_be_empty, tmpl, xlat;
1108         char **q;
1109         char const *value;
1110         CONF_PAIR const *cp = NULL;
1111         fr_ipaddr_t *ipaddr;
1112         char buffer[8192];
1113
1114         if (!cs) return -1;
1115
1116         deprecated = (type & PW_TYPE_DEPRECATED);
1117         required = (type & PW_TYPE_REQUIRED);
1118         attribute = (type & PW_TYPE_ATTRIBUTE);
1119         secret = (type & PW_TYPE_SECRET);
1120         file_input = (type == PW_TYPE_FILE_INPUT);      /* check, not and */
1121         cant_be_empty = (type & PW_TYPE_NOT_EMPTY);
1122         tmpl = (type & PW_TYPE_TMPL);
1123         xlat = (type & PW_TYPE_XLAT);
1124
1125         if (attribute) required = true;
1126         if (required) cant_be_empty = true;     /* May want to review this in the future... */
1127
1128         type &= 0xff;                           /* normal types are small */
1129         rcode = 0;
1130
1131         cp = cf_pair_find(cs, name);
1132         if (cp) {
1133                 value = cp->value;
1134         } else {
1135                 rcode = 1;
1136                 value = dflt;
1137         }
1138
1139         if (!value) {
1140                 if (required) {
1141                 is_required:
1142                         if (!cp) {
1143                                 cf_log_err(&(cs->item), "Configuration item '%s' must have a value", name);
1144                         } else {
1145                                 cf_log_err(&(cp->item), "Configuration item '%s' must have a value", name);
1146                         }
1147                         return -1;
1148                 }
1149                 return rcode;
1150         }
1151
1152         if ((value[0] == '\0') && cant_be_empty) {
1153         cant_be_empty:
1154                 if (!cp) {
1155                         cf_log_err(&(cs->item), "Configuration item '%s' must not be empty (zero length)", name);
1156                         if (!required) cf_log_err(&(cs->item), "Comment item to silence this message");
1157                 } else {
1158                         cf_log_err(&(cp->item), "Configuration item '%s' must not be empty (zero length)", name);
1159                         if (!required) cf_log_err(&(cp->item), "Comment item to silence this message");
1160                 }
1161                 return -1;
1162         }
1163
1164         if (deprecated) {
1165                 cf_log_err(&(cs->item), "Configuration item \"%s\" is deprecated", name);
1166
1167                 return -2;
1168         }
1169
1170         /*
1171          *
1172          */
1173         if (tmpl) {
1174                 ssize_t slen;
1175                 value_pair_tmpl_t *vpt;
1176
1177                 if (!value || (cf_pair_value_type(cp) == T_INVALID)) {
1178                         *(value_pair_tmpl_t **)data = NULL;
1179                         return 0;
1180                 }
1181
1182                 slen = tmpl_afrom_str(cs, &vpt, value, strlen(value),
1183                                       cf_pair_value_type(cp), REQUEST_CURRENT, PAIR_LIST_REQUEST, true);
1184                 if (slen < 0) {
1185                         char *spaces, *text;
1186
1187                         fr_canonicalize_error(cs, &spaces, &text, slen, fr_strerror());
1188
1189                         cf_log_err_cs(cs, "Failed parsing configuration item '%s'", name);
1190                         cf_log_err_cs(cs, "%s", value);
1191                         cf_log_err_cs(cs, "%s^ %s", spaces, text);
1192
1193                         talloc_free(spaces);
1194                         talloc_free(text);
1195
1196                         return -1;
1197                 }
1198
1199                 /*
1200                  *      Sanity check
1201                  *
1202                  *      Don't add default - update with new types.
1203                  */
1204                 switch (vpt->type) {
1205                 case TMPL_TYPE_LITERAL:
1206                 case TMPL_TYPE_ATTR:
1207                 case TMPL_TYPE_ATTR_UNDEFINED:
1208                 case TMPL_TYPE_LIST:
1209                 case TMPL_TYPE_DATA:
1210                 case TMPL_TYPE_EXEC:
1211                 case TMPL_TYPE_XLAT:
1212                 case TMPL_TYPE_XLAT_STRUCT:
1213                         break;
1214
1215                 case TMPL_TYPE_UNKNOWN:
1216                 case TMPL_TYPE_REGEX:
1217                 case TMPL_TYPE_REGEX_STRUCT:
1218                 case TMPL_TYPE_NULL:
1219                         rad_assert(0);
1220                 }
1221
1222                 /*
1223                  *      If the attribute flag is set, the template must be an
1224                  *      attribute reference.
1225                  */
1226                 if (attribute && (vpt->type != TMPL_TYPE_ATTR)) {
1227                         cf_log_err(&(cs->item), "Configuration item '%s' must be an attr "
1228                                    "but is an %s", name, fr_int2str(tmpl_names, vpt->type, "<INVALID>"));
1229                         talloc_free(vpt);
1230                         return -1;
1231                 }
1232
1233                 /*
1234                  *      If the xlat flag is set, the template must be an xlat
1235                  */
1236                 if (xlat && (vpt->type != TMPL_TYPE_XLAT_STRUCT)) {
1237                         cf_log_err(&(cs->item), "Configuration item '%s' must be an xlat expansion but is an %s",
1238                                    name, fr_int2str(tmpl_names, vpt->type, "<INVALID>"));
1239                         talloc_free(vpt);
1240                         return -1;
1241                 }
1242
1243                 /*
1244                  *      If we have a type, and the template is an attribute reference
1245                  *      check that the attribute reference matches the type.
1246                  */
1247                 if ((type > 0) && (vpt->type == TMPL_TYPE_ATTR) && (vpt->tmpl_da->type != type)) {
1248                         cf_log_err(&(cs->item), "Configuration item '%s' attr must be an %s, but is an %s",
1249                                    name, fr_int2str(dict_attr_types, type, "<INVALID>"),
1250                                    fr_int2str(dict_attr_types, vpt->tmpl_da->type, "<INVALID>"));
1251                         talloc_free(vpt);
1252                         return -1;
1253                 }
1254                 *(value_pair_tmpl_t **)data = vpt;
1255
1256                 return 0;
1257         }
1258
1259         switch (type) {
1260         case PW_TYPE_BOOLEAN:
1261                 /*
1262                  *      Allow yes/no and on/off
1263                  */
1264                 if ((strcasecmp(value, "yes") == 0) ||
1265                     (strcasecmp(value, "on") == 0)) {
1266                         *(bool *)data = true;
1267                 } else if ((strcasecmp(value, "no") == 0) ||
1268                            (strcasecmp(value, "off") == 0)) {
1269                         *(bool *)data = false;
1270                 } else {
1271                         *(bool *)data = false;
1272                         cf_log_err(&(cs->item), "Invalid value \"%s\" for boolean "
1273                                "variable %s", value, name);
1274                         return -1;
1275                 }
1276                 cf_log_info(cs, "%.*s\t%s = %s",
1277                             cs->depth, parse_spaces, name, value);
1278                 break;
1279
1280         case PW_TYPE_INTEGER:
1281         {
1282                 unsigned long v = strtoul(value, 0, 0);
1283
1284                 /*
1285                  *      Restrict integer values to 0-INT32_MAX, this means
1286                  *      it will always be safe to cast them to a signed type
1287                  *      for comparisons, and imposes the same range limit as
1288                  *      before we switched to using an unsigned type to
1289                  *      represent config item integers.
1290                  */
1291                 if (v > INT32_MAX) {
1292                         cf_log_err(&(cs->item), "Invalid value \"%s\" for variable %s, must be between 0-%u", value,
1293                                    name, INT32_MAX);
1294                         return -1;
1295                 }
1296
1297                 *(uint32_t *)data = v;
1298                 cf_log_info(cs, "%.*s\t%s = %u", cs->depth, parse_spaces, name, *(uint32_t *)data);
1299         }
1300                 break;
1301
1302         case PW_TYPE_SHORT:
1303         {
1304                 unsigned long v = strtoul(value, 0, 0);
1305
1306                 if (v > UINT16_MAX) {
1307                         cf_log_err(&(cs->item), "Invalid value \"%s\" for variable %s, must be between 0-%u", value,
1308                                    name, UINT16_MAX);
1309                         return -1;
1310                 }
1311                 *(uint16_t *)data = (uint16_t) v;
1312                 cf_log_info(cs, "%.*s\t%s = %u", cs->depth, parse_spaces, name, *(uint16_t *)data);
1313         }
1314                 break;
1315
1316         case PW_TYPE_INTEGER64:
1317                 *(uint64_t *)data = strtoull(value, 0, 0);
1318                 cf_log_info(cs, "%.*s\t%s = %" PRIu64, cs->depth, parse_spaces, name, *(uint64_t *)data);
1319                 break;
1320
1321         case PW_TYPE_SIGNED:
1322                 *(int32_t *)data = strtol(value, 0, 0);
1323                 cf_log_info(cs, "%.*s\t%s = %d", cs->depth, parse_spaces, name, *(int32_t *)data);
1324                 break;
1325
1326         case PW_TYPE_STRING:
1327                 q = (char **) data;
1328                 if (*q != NULL) {
1329                         talloc_free(*q);
1330                 }
1331
1332                 /*
1333                  *      Expand variables which haven't already been
1334                  *      expanded automagically when the configuration
1335                  *      file was read.
1336                  */
1337                 if (value == dflt) {
1338                         int lineno = 0;
1339
1340                         lineno = cs->item.lineno;
1341
1342                         value = cf_expand_variables("<internal>",
1343                                                     &lineno,
1344                                                     cs, buffer, sizeof(buffer),
1345                                                     value, NULL);
1346                         if (!value) {
1347                                 cf_log_err(&(cs->item),"Failed expanding variable %s", name);
1348                                 return -1;
1349                         }
1350                 }
1351
1352                 if (required && !value) goto is_required;
1353                 if (cant_be_empty && (value[0] == '\0')) goto cant_be_empty;
1354
1355                 if (attribute) {
1356                         if (!dict_attrbyname(value)) {
1357                                 if (!cp) {
1358                                         cf_log_err(&(cs->item), "No such attribute '%s' for configuration '%s'",
1359                                                    value, name);
1360                                 } else {
1361                                         cf_log_err(&(cp->item), "No such attribute '%s'", value);
1362                                 }
1363                                 return -1;
1364                         }
1365                 }
1366
1367                 /*
1368                  *      Hide secrets when using "radiusd -X".
1369                  */
1370                 if (secret && (debug_flag <= 2)) {
1371                         cf_log_info(cs, "%.*s\t%s = <<< secret >>>",
1372                                     cs->depth, parse_spaces, name);
1373                 } else {
1374                         cf_log_info(cs, "%.*s\t%s = \"%s\"",
1375                                     cs->depth, parse_spaces, name, value ? value : "(null)");
1376                 }
1377                 *q = value ? talloc_typed_strdup(cs, value) : NULL;
1378
1379                 /*
1380                  *      If there's data AND it's an input file, check
1381                  *      that we can read it.  This check allows errors
1382                  *      to be caught as early as possible, during
1383                  *      server startup.
1384                  */
1385                 if (*q && file_input) {
1386                         struct stat buf;
1387
1388                         if (stat(*q, &buf) < 0) {
1389                                 char user[255], group[255];
1390
1391                                 ERROR("Unable to open file \"%s\": %s", value, fr_syserror(errno));
1392                                 ERROR("Our effective user and group was %s:%s",
1393                                       (rad_prints_uid(NULL, user, sizeof(user), geteuid()) < 0) ?
1394                                       "unknown" : user,
1395                                       (rad_prints_gid(NULL, group, sizeof(group), getegid()) < 0) ?
1396                                       "unknown" : group );
1397
1398                                 return -1;
1399                         }
1400                 }
1401                 break;
1402
1403         case PW_TYPE_IPV4_ADDR:
1404         case PW_TYPE_IPV4_PREFIX:
1405                 ipaddr = data;
1406
1407                 if (fr_pton4(ipaddr, value, -1, true, false) < 0) {
1408                         ERROR("%s", fr_strerror());
1409                         return -1;
1410                 }
1411                 if (fr_item_validate_ipaddr(cs, name, type, value, ipaddr) < 0) return -1;
1412                 break;
1413
1414         case PW_TYPE_IPV6_ADDR:
1415         case PW_TYPE_IPV6_PREFIX:
1416                 ipaddr = data;
1417
1418                 if (fr_pton6(ipaddr, value, -1, true, false) < 0) {
1419                         ERROR("%s", fr_strerror());
1420                         return -1;
1421                 }
1422                 if (fr_item_validate_ipaddr(cs, name, type, value, ipaddr) < 0) return -1;
1423                 break;
1424
1425         case PW_TYPE_COMBO_IP_ADDR:
1426         case PW_TYPE_COMBO_IP_PREFIX:
1427                 ipaddr = data;
1428
1429                 if (fr_pton(ipaddr, value, -1, true) < 0) {
1430                         ERROR("%s", fr_strerror());
1431                         return -1;
1432                 }
1433                 if (fr_item_validate_ipaddr(cs, name, type, value, ipaddr) < 0) return -1;
1434                 break;
1435
1436         case PW_TYPE_TIMEVAL: {
1437                 int sec;
1438                 char *end;
1439                 struct timeval tv;
1440
1441                 sec = strtoul(value, &end, 10);
1442                 tv.tv_sec = sec;
1443                 tv.tv_usec = 0;
1444                 if (*end == '.') {
1445                         size_t len;
1446
1447                         len = strlen(end + 1);
1448
1449                         if (len > 6) {
1450                                 ERROR("Too much precision for timeval");
1451                                 return -1;
1452                         }
1453
1454                         /*
1455                          *      If they write "0.1", that means
1456                          *      "10000" microseconds.
1457                          */
1458                         sec = strtoul(end + 1, NULL, 10);
1459                         while (len < 6) {
1460                                 sec *= 10;
1461                                 len++;
1462                         }
1463
1464                         tv.tv_usec = sec;
1465                 }
1466                 cf_log_info(cs, "%.*s\t%s = %d.%06d",
1467                             cs->depth, parse_spaces, name, (int) tv.tv_sec, (int) tv.tv_usec);
1468                 memcpy(data, &tv, sizeof(tv));
1469                 }
1470                 break;
1471
1472         default:
1473                 /*
1474                  *      If we get here, it's a sanity check error.
1475                  *      It's not an error parsing the configuration
1476                  *      file.
1477                  */
1478                 rad_assert(type > PW_TYPE_INVALID);
1479                 rad_assert(type < PW_TYPE_MAX);
1480
1481                 ERROR("type '%s' is not supported in the configuration files",
1482                        fr_int2str(dict_attr_types, type, "?Unknown?"));
1483                 return -1;
1484         } /* switch over variable type */
1485
1486         if (!cp) {
1487                 CONF_PAIR *cpn;
1488
1489                 cpn = cf_pair_alloc(cs, name, value, T_OP_SET, T_BARE_WORD, T_BARE_WORD);
1490                 if (!cpn) return -1;
1491                 cpn->item.filename = "<internal>";
1492                 cpn->item.lineno = 0;
1493                 cf_item_add(cs, &(cpn->item));
1494         }
1495
1496         return rcode;
1497 }
1498
1499
1500 /*
1501  *      A copy of cf_section_parse that initializes pointers before
1502  *      parsing them.
1503  */
1504 static void cf_section_parse_init(CONF_SECTION *cs, void *base,
1505                                   CONF_PARSER const *variables)
1506 {
1507         int i;
1508
1509         for (i = 0; variables[i].name != NULL; i++) {
1510                 if (variables[i].type == PW_TYPE_SUBSECTION) {
1511                         CONF_SECTION *subcs;
1512
1513                         if (!variables[i].dflt) continue;
1514
1515                         subcs = cf_section_sub_find(cs, variables[i].name);
1516
1517                         /*
1518                          *      If there's no subsection in the
1519                          *      config, BUT the CONF_PARSER wants one,
1520                          *      then create an empty one.  This is so
1521                          *      that we can track the strings,
1522                          *      etc. allocated in the subsection.
1523                          */
1524                         if (!subcs) {
1525                                 subcs = cf_section_alloc(cs, variables[i].name, NULL);
1526                                 if (!subcs) return;
1527
1528                                 subcs->item.filename = cs->item.filename;
1529                                 subcs->item.lineno = cs->item.lineno;
1530                                 cf_item_add(cs, &(subcs->item));
1531                         }
1532
1533                         cf_section_parse_init(subcs, (uint8_t *)base + variables[i].offset,
1534                                               (CONF_PARSER const *) variables[i].dflt);
1535                         continue;
1536                 }
1537
1538                 if ((variables[i].type != PW_TYPE_STRING) &&
1539                     (variables[i].type != PW_TYPE_FILE_INPUT) &&
1540                     (variables[i].type != PW_TYPE_FILE_OUTPUT)) {
1541                         continue;
1542                 }
1543
1544                 if (variables[i].data) {
1545                         *(char **) variables[i].data = NULL;
1546                 } else if (base) {
1547                         *(char **) (((char *)base) + variables[i].offset) = NULL;
1548                 } else {
1549                         continue;
1550                 }
1551         } /* for all variables in the configuration section */
1552 }
1553
1554
1555 /*
1556  *      Parse a configuration section into user-supplied variables.
1557  */
1558 int cf_section_parse(CONF_SECTION *cs, void *base,
1559                      CONF_PARSER const *variables)
1560 {
1561         int ret;
1562         int i;
1563         void *data;
1564
1565         cs->variables = variables; /* this doesn't hurt anything */
1566
1567         if (!cs->name2) {
1568                 cf_log_info(cs, "%.*s%s {", cs->depth, parse_spaces,
1569                        cs->name1);
1570         } else {
1571                 cf_log_info(cs, "%.*s%s %s {", cs->depth, parse_spaces,
1572                        cs->name1, cs->name2);
1573         }
1574
1575         cf_section_parse_init(cs, base, variables);
1576
1577         /*
1578          *      Handle the known configuration parameters.
1579          */
1580         for (i = 0; variables[i].name != NULL; i++) {
1581                 /*
1582                  *      Handle subsections specially
1583                  */
1584                 if (variables[i].type == PW_TYPE_SUBSECTION) {
1585                         CONF_SECTION *subcs;
1586
1587                         subcs = cf_section_sub_find(cs, variables[i].name);
1588                         /*
1589                          *      Default in this case is overloaded to mean a pointer
1590                          *      to the CONF_PARSER struct for the subsection.
1591                          */
1592                         if (!variables[i].dflt || !subcs) {
1593                                 ERROR("Internal sanity check 1 failed in cf_section_parse %s", variables[i].name);
1594                                 goto error;
1595                         }
1596
1597                         if (cf_section_parse(subcs, (uint8_t *)base + variables[i].offset,
1598                                              (CONF_PARSER const *) variables[i].dflt) < 0) goto error;
1599                         continue;
1600                 } /* else it's a CONF_PAIR */
1601
1602                 if (variables[i].data) {
1603                         data = variables[i].data; /* prefer this. */
1604                 } else if (base) {
1605                         data = ((char *)base) + variables[i].offset;
1606                 } else {
1607                         DEBUG2("Internal sanity check 2 failed in cf_section_parse");
1608                         goto error;
1609                 }
1610
1611                 /*
1612                  *      Parse the pair we found, or a default value.
1613                  */
1614                 ret = cf_item_parse(cs, variables[i].name, variables[i].type, data, variables[i].dflt);
1615                 if (ret < 0) {
1616                         /*
1617                          *      Be nice, and print the name of the new config item.
1618                          */
1619                         if ((ret == -2) && (variables[i + 1].offset == variables[i].offset) &&
1620                             (variables[i + 1].data == variables[i].data)) {
1621                                 cf_log_err(&(cs->item), "Replace \"%s\" with \"%s\"", variables[i].name,
1622                                            variables[i + 1].name);
1623                         }
1624
1625                         goto error;
1626                 }
1627         } /* for all variables in the configuration section */
1628
1629         cf_log_info(cs, "%.*s}", cs->depth, parse_spaces);
1630
1631         cs->base = base;
1632
1633         return 0;
1634
1635  error:
1636         cf_log_info(cs, "%.*s}", cs->depth, parse_spaces);
1637         return -1;
1638 }
1639
1640
1641 /*
1642  *      Check XLAT things in pass 2.  But don't cache the xlat stuff anywhere.
1643  */
1644 int cf_section_parse_pass2(CONF_SECTION *cs, void *base, CONF_PARSER const *variables)
1645 {
1646         int i;
1647         ssize_t slen;
1648         char const *error;
1649         char *value = NULL;
1650         xlat_exp_t *xlat;
1651
1652         /*
1653          *      Handle the known configuration parameters.
1654          */
1655         for (i = 0; variables[i].name != NULL; i++) {
1656                 CONF_PAIR *cp;
1657
1658                 /*
1659                  *      Handle subsections specially
1660                  */
1661                 if (variables[i].type == PW_TYPE_SUBSECTION) {
1662                         CONF_SECTION *subcs;
1663                         subcs = cf_section_sub_find(cs, variables[i].name);
1664
1665                         if (cf_section_parse_pass2(subcs, (uint8_t *)base + variables[i].offset,
1666                                                    (CONF_PARSER const *) variables[i].dflt) < 0) {
1667                                 return -1;
1668                         }
1669                         continue;
1670                 } /* else it's a CONF_PAIR */
1671
1672                 cp = cf_pair_find(cs, variables[i].name);
1673
1674         redo:
1675                 if (!cp || !cp->value) continue;
1676
1677                 if ((cp->rhs_type != T_DOUBLE_QUOTED_STRING) &&
1678                     (cp->rhs_type != T_BARE_WORD)) continue;
1679
1680                 /*
1681                  *      Non-xlat expansions shouldn't have xlat!
1682                  */
1683                 if (((variables[i].type & PW_TYPE_XLAT) == 0) &&
1684                     ((variables[i].type & PW_TYPE_TMPL) == 0)) {
1685                         /*
1686                          *      Ignore %{... in shared secrets.
1687                          *      They're never dynamically expanded.
1688                          */
1689                         if ((variables[i].type & PW_TYPE_SECRET) != 0) continue;
1690
1691                         if (strstr(cp->value, "%{") != NULL) {
1692                                 WARN("%s[%d]: Found dynamic expansion in string which will not be dynamically expanded",
1693                                      cp->item.filename ? cp->item.filename : "unknown",
1694                                      cp->item.lineno ? cp->item.lineno : 0);
1695                         }
1696                         continue;
1697                 }
1698
1699                 /*
1700                  *      xlat expansions should be parseable.
1701                  */
1702                 value = talloc_strdup(cs, cp->value); /* modified by xlat_tokenize */
1703                 xlat = NULL;
1704
1705                 slen = xlat_tokenize(cs, value, &xlat, &error);
1706                 if (slen < 0) {
1707                         char *spaces, *text;
1708
1709                         fr_canonicalize_error(cs, &spaces, &text, slen, cp->value);
1710
1711                         cf_log_err(&cp->item, "Failed parsing expanded string:");
1712                         cf_log_err(&cp->item, "%s", text);
1713                         cf_log_err(&cp->item, "%s^ %s", spaces, error);
1714
1715                         talloc_free(spaces);
1716                         talloc_free(text);
1717                         talloc_free(value);
1718                         talloc_free(xlat);
1719                         return -1;
1720                 }
1721
1722                 talloc_free(value);
1723                 talloc_free(xlat);
1724
1725                 /*
1726                  *      If the "multi" flag is set, check all of them.
1727                  */
1728                 if ((variables[i].type & PW_TYPE_MULTI) != 0) {
1729                         cp = cf_pair_find_next(cs, cp, cp->attr);
1730                         goto redo;
1731                 }
1732         } /* for all variables in the configuration section */
1733
1734         return 0;
1735 }
1736
1737 /*
1738  *      Merge the template so everyting else "just works".
1739  */
1740 static bool cf_template_merge(CONF_SECTION *cs, CONF_SECTION const *template)
1741 {
1742         CONF_ITEM *ci;
1743
1744         if (!cs || !template) return true;
1745
1746         cs->template = NULL;
1747
1748         /*
1749          *      Walk over the template, adding its' entries to the
1750          *      current section.  But only if the entries don't
1751          *      already exist in the current section.
1752          */
1753         for (ci = template->children; ci; ci = ci->next) {
1754                 if (ci->type == CONF_ITEM_PAIR) {
1755                         CONF_PAIR *cp1, *cp2;
1756
1757                         /*
1758                          *      It exists, don't over-write it.
1759                          */
1760                         cp1 = cf_item_to_pair(ci);
1761                         if (cf_pair_find(cs, cp1->attr)) {
1762                                 continue;
1763                         }
1764
1765                         /*
1766                          *      Create a new pair with all of the data
1767                          *      of the old one.
1768                          */
1769                         cp2 = cf_pair_dup(cs, cp1);
1770                         if (!cp2) return false;
1771
1772                         cp2->item.filename = cp1->item.filename;
1773                         cp2->item.lineno = cp1->item.lineno;
1774
1775                         cf_item_add(cs, &(cp2->item));
1776                         continue;
1777                 }
1778
1779                 if (ci->type == CONF_ITEM_SECTION) {
1780                         CONF_SECTION *subcs1, *subcs2;
1781
1782                         subcs1 = cf_item_to_section(ci);
1783                         rad_assert(subcs1 != NULL);
1784
1785                         subcs2 = cf_section_sub_find_name2(cs, subcs1->name1, subcs1->name2);
1786                         if (subcs2) {
1787                                 /*
1788                                  *      sub-sections get merged.
1789                                  */
1790                                 if (!cf_template_merge(subcs2, subcs1)) {
1791                                         return false;
1792                                 }
1793                                 continue;
1794                         }
1795
1796                         /*
1797                          *      Our section doesn't have a matching
1798                          *      sub-section.  Copy it verbatim from
1799                          *      the template.
1800                          */
1801                         subcs2 = cf_section_dup(cs, subcs1,
1802                                                 cf_section_name1(subcs1), cf_section_name2(subcs1),
1803                                                 false);
1804                         if (!subcs2) return false;
1805
1806                         subcs2->item.filename = subcs1->item.filename;
1807                         subcs2->item.lineno = subcs1->item.lineno;
1808
1809                         cf_item_add(cs, &(subcs2->item));
1810                         continue;
1811                 }
1812
1813                 /* ignore everything else */
1814         }
1815
1816         return true;
1817 }
1818
1819 static char const *cf_local_file(char const *base, char const *filename,
1820                                  char *buffer, size_t bufsize)
1821 {
1822         size_t dirsize;
1823         char *p;
1824
1825         strlcpy(buffer, base, bufsize);
1826
1827         p = strrchr(buffer, FR_DIR_SEP);
1828         if (!p) return filename;
1829         if (p[1]) {             /* ./foo */
1830                 p[1] = '\0';
1831         }
1832
1833         dirsize = (p - buffer) + 1;
1834
1835         if ((dirsize + strlen(filename)) >= bufsize) {
1836                 return NULL;
1837         }
1838
1839         strlcpy(p + 1, filename, bufsize - dirsize);
1840
1841         return buffer;
1842 }
1843
1844
1845 /*
1846  *      Read a part of the config file.
1847  */
1848 static int cf_section_read(char const *filename, int *lineno, FILE *fp,
1849                            CONF_SECTION *current)
1850
1851 {
1852         CONF_SECTION *this, *css, *nextcs;
1853         CONF_PAIR *cpn;
1854         char const *ptr;
1855         char const *value;
1856         char buf[8192];
1857         char buf1[8192];
1858         char buf2[8192];
1859         char buf3[8192];
1860         char buf4[8192];
1861         FR_TOKEN t1 = T_INVALID, t2, t3;
1862         bool has_spaces = false;
1863         bool pass2;
1864         char *cbuf = buf;
1865         size_t len;
1866         fr_cond_t *cond = NULL;
1867
1868         this = current;         /* add items here */
1869
1870         /*
1871          *      Read, checking for line continuations ('\\' at EOL)
1872          */
1873         for (;;) {
1874                 int at_eof;
1875                 nextcs = NULL;
1876
1877                 /*
1878                  *      Get data, and remember if we are at EOF.
1879                  */
1880                 at_eof = (fgets(cbuf, sizeof(buf) - (cbuf - buf), fp) == NULL);
1881                 (*lineno)++;
1882
1883                 /*
1884                  *      We read the entire 8k worth of data: complain.
1885                  *      Note that we don't care if the last character
1886                  *      is \n: it's still forbidden.  This means that
1887                  *      the maximum allowed length of text is 8k-1, which
1888                  *      should be plenty.
1889                  */
1890                 len = strlen(cbuf);
1891                 if ((cbuf + len + 1) >= (buf + sizeof(buf))) {
1892                         ERROR("%s[%d]: Line too long",
1893                                filename, *lineno);
1894                         return -1;
1895                 }
1896
1897                 if (has_spaces) {
1898                         ptr = cbuf;
1899                         while (isspace((int) *ptr)) ptr++;
1900
1901                         if (ptr > cbuf) {
1902                                 memmove(cbuf, ptr, len - (ptr - cbuf));
1903                                 len -= (ptr - cbuf);
1904                         }
1905                 }
1906
1907                 /*
1908                  *      Not doing continuations: check for edge
1909                  *      conditions.
1910                  */
1911                 if (cbuf == buf) {
1912                         if (at_eof) break;
1913
1914                         ptr = buf;
1915                         while (*ptr && isspace((int) *ptr)) ptr++;
1916
1917                         if (!*ptr || (*ptr == '#')) continue;
1918
1919                 } else if (at_eof || (len == 0)) {
1920                         ERROR("%s[%d]: Continuation at EOF is illegal",
1921                                filename, *lineno);
1922                         return -1;
1923                 }
1924
1925                 /*
1926                  *      See if there's a continuation.
1927                  */
1928                 while ((len > 0) &&
1929                        ((cbuf[len - 1] == '\n') || (cbuf[len - 1] == '\r'))) {
1930                         len--;
1931                         cbuf[len] = '\0';
1932                 }
1933
1934                 if ((len > 0) && (cbuf[len - 1] == '\\')) {
1935                         /*
1936                          *      Check for "suppress spaces" magic.
1937                          */
1938                         if (!has_spaces && (len > 2) && (cbuf[len - 2] == '"')) {
1939                                 has_spaces = true;
1940                         }
1941
1942                         cbuf[len - 1] = '\0';
1943                         cbuf += len - 1;
1944                         continue;
1945                 }
1946
1947                 ptr = cbuf = buf;
1948                 has_spaces = false;
1949
1950         get_more:
1951                 pass2 = false;
1952
1953                 /*
1954                  *      The parser is getting to be evil.
1955                  */
1956                 while ((*ptr == ' ') || (*ptr == '\t')) ptr++;
1957
1958                 if (((ptr[0] == '%') && (ptr[1] == '{')) ||
1959                     (ptr[0] == '`')) {
1960                         int hack;
1961
1962                         if (ptr[0] == '%') {
1963                                 hack = rad_copy_variable(buf1, ptr);
1964                         } else {
1965                                 hack = rad_copy_string(buf1, ptr);
1966                         }
1967                         if (hack < 0) {
1968                                 ERROR("%s[%d]: Invalid expansion: %s",
1969                                        filename, *lineno, ptr);
1970                                 return -1;
1971                         }
1972
1973                         ptr += hack;
1974
1975                         t2 = gettoken(&ptr, buf2, sizeof(buf2), true);
1976                         switch (t2) {
1977                         case T_EOL:
1978                         case T_HASH:
1979                                 goto do_bare_word;
1980
1981                         default:
1982                                 ERROR("%s[%d]: Invalid expansion: %s",
1983                                        filename, *lineno, ptr);
1984                                 return -1;
1985                         }
1986                 } else {
1987                         t1 = gettoken(&ptr, buf1, sizeof(buf1), true);
1988                 }
1989
1990                 /*
1991                  *      The caller eats "name1 name2 {", and calls us
1992                  *      for the data inside of the section.  So if we
1993                  *      receive a closing brace, then it must mean the
1994                  *      end of the section.
1995                  */
1996                if (t1 == T_RCBRACE) {
1997                        if (this == current) {
1998                                ERROR("%s[%d]: Too many closing braces",
1999                                       filename, *lineno);
2000                                return -1;
2001                        }
2002
2003                        /*
2004                         *       Merge the template into the existing
2005                         *       section.  This uses more memory, but
2006                         *       means that templates now work with
2007                         *       sub-sections, etc.
2008                         */
2009                        if (!cf_template_merge(this, this->template)) {
2010                                return -1;
2011                        }
2012
2013                        this = this->item.parent;
2014                        goto check_for_more;
2015                }
2016
2017                 /*
2018                  *      Allow for $INCLUDE files
2019                  *
2020                  *      This *SHOULD* work for any level include.
2021                  *      I really really really hate this file.  -cparker
2022                  */
2023                if ((strcasecmp(buf1, "$INCLUDE") == 0) ||
2024                    (strcasecmp(buf1, "$-INCLUDE") == 0)) {
2025                         bool relative = true;
2026
2027                         t2 = getword(&ptr, buf2, sizeof(buf2), true);
2028                         if (t2 != T_EOL) {
2029                                ERROR("%s[%d]: Unexpected text after $INCLUDE",
2030                                      filename, *lineno);
2031                                return -1;
2032                         }
2033
2034                         if (buf2[0] == '$') relative = false;
2035
2036                         value = cf_expand_variables(filename, lineno, this, buf4, sizeof(buf4), buf2, NULL);
2037                         if (!value) return -1;
2038
2039                         if (!FR_DIR_IS_RELATIVE(value)) relative = false;
2040
2041                         if (relative) {
2042                                 value = cf_local_file(filename, value, buf3,
2043                                                       sizeof(buf3));
2044                                 if (!value) {
2045                                         ERROR("%s[%d]: Directories too deep.",
2046                                                filename, *lineno);
2047                                         return -1;
2048                                 }
2049                         }
2050
2051
2052 #ifdef HAVE_DIRENT_H
2053                         /*
2054                          *      $INCLUDE foo/
2055                          *
2056                          *      Include ALL non-"dot" files in the directory.
2057                          *      careful!
2058                          */
2059                         if (value[strlen(value) - 1] == '/') {
2060                                 DIR             *dir;
2061                                 struct dirent   *dp;
2062                                 struct stat stat_buf;
2063
2064                                 DEBUG2("including files in directory %s", value );
2065 #ifdef S_IWOTH
2066                                 /*
2067                                  *      Security checks.
2068                                  */
2069                                 if (stat(value, &stat_buf) < 0) {
2070                                         ERROR("%s[%d]: Failed reading directory %s: %s",
2071                                                filename, *lineno,
2072                                                value, fr_syserror(errno));
2073                                         return -1;
2074                                 }
2075
2076                                 if ((stat_buf.st_mode & S_IWOTH) != 0) {
2077                                         ERROR("%s[%d]: Directory %s is globally writable.  Refusing to start due to "
2078                                               "insecure configuration", filename, *lineno, value);
2079                                         return -1;
2080                                 }
2081 #endif
2082                                 dir = opendir(value);
2083                                 if (!dir) {
2084                                         ERROR("%s[%d]: Error reading directory %s: %s",
2085                                                filename, *lineno, value,
2086                                                fr_syserror(errno));
2087                                         return -1;
2088                                 }
2089
2090                                 /*
2091                                  *      Read the directory, ignoring "." files.
2092                                  */
2093                                 while ((dp = readdir(dir)) != NULL) {
2094                                         char const *p;
2095
2096                                         if (dp->d_name[0] == '.') continue;
2097
2098                                         /*
2099                                          *      Check for valid characters
2100                                          */
2101                                         for (p = dp->d_name; *p != '\0'; p++) {
2102                                                 if (isalpha((int)*p) ||
2103                                                     isdigit((int)*p) ||
2104                                                     (*p == '-') ||
2105                                                     (*p == '_') ||
2106                                                     (*p == '.')) continue;
2107                                                 break;
2108                                         }
2109                                         if (*p != '\0') continue;
2110
2111                                         snprintf(buf2, sizeof(buf2), "%s%s",
2112                                                  value, dp->d_name);
2113                                         if ((stat(buf2, &stat_buf) != 0) ||
2114                                             S_ISDIR(stat_buf.st_mode)) continue;
2115                                         /*
2116                                          *      Read the file into the current
2117                                          *      configuration section.
2118                                          */
2119                                         if (cf_file_include(this, buf2) < 0) {
2120                                                 closedir(dir);
2121                                                 return -1;
2122                                         }
2123                                 }
2124                                 closedir(dir);
2125                         }  else
2126 #endif
2127                         { /* it was a normal file */
2128                                 if (buf1[1] == '-') {
2129                                         struct stat statbuf;
2130
2131                                         if (stat(value, &statbuf) < 0) {
2132                                                 WARN("Not including file %s: %s", value, fr_syserror(errno));
2133                                                 continue;
2134                                         }
2135                                 }
2136
2137                                 if (cf_file_include(this, value) < 0) {
2138                                         return -1;
2139                                 }
2140                         }
2141                         continue;
2142                 } /* we were in an include */
2143
2144                if (strcasecmp(buf1, "$template") == 0) {
2145                        CONF_ITEM *ci;
2146                        CONF_SECTION *parentcs, *templatecs;
2147                        t2 = getword(&ptr, buf2, sizeof(buf2), true);
2148
2149                        if (t2 != T_EOL) {
2150                                ERROR("%s[%d]: Unexpected text after $TEMPLATE", filename, *lineno);
2151                                return -1;
2152                        }
2153
2154                        parentcs = cf_top_section(current);
2155
2156                        templatecs = cf_section_sub_find(parentcs, "templates");
2157                        if (!templatecs) {
2158                                 ERROR("%s[%d]: No \"templates\" section for reference \"%s\"", filename, *lineno, buf2);
2159                                 return -1;
2160                        }
2161
2162                        ci = cf_reference_item(parentcs, templatecs, buf2);
2163                        if (!ci || (ci->type != CONF_ITEM_SECTION)) {
2164                                 ERROR("%s[%d]: Reference \"%s\" not found", filename, *lineno, buf2);
2165                                 return -1;
2166                        }
2167
2168                        if (!this) {
2169                                 ERROR("%s[%d]: Internal sanity check error in template reference", filename, *lineno);
2170                                 return -1;
2171                        }
2172
2173                        if (this->template) {
2174                                 ERROR("%s[%d]: Section already has a template", filename, *lineno);
2175                                 return -1;
2176                        }
2177
2178                        this->template = cf_item_to_section(ci);
2179                        continue;
2180                }
2181
2182                 /*
2183                  *      Ensure that the user can't add CONF_PAIRs
2184                  *      with 'internal' names;
2185                  */
2186                 if (buf1[0] == '_') {
2187                         ERROR("%s[%d]: Illegal configuration pair name \"%s\"", filename, *lineno, buf1);
2188                         return -1;
2189                 }
2190
2191                 /*
2192                  *      Handle if/elsif specially.
2193                  */
2194                 if ((strcmp(buf1, "if") == 0) || (strcmp(buf1, "elsif") == 0)) {
2195                         ssize_t slen;
2196                         char const *error = NULL;
2197                         char *p;
2198                         CONF_SECTION *server;
2199
2200                         /*
2201                          *      if / elsif MUST be inside of a
2202                          *      processing section, which MUST in turn
2203                          *      be inside of a "server" directive.
2204                          */
2205                         if (!this->item.parent) {
2206                         invalid_location:
2207                                 ERROR("%s[%d]: Invalid location for '%s'",
2208                                        filename, *lineno, buf1);
2209                                 return -1;
2210                         }
2211
2212                         /*
2213                          *      Skip (...) to find the {
2214                          */
2215                         slen = fr_condition_tokenize(nextcs, cf_section_to_item(nextcs), ptr, &cond,
2216                                                      &error, FR_COND_TWO_PASS);
2217                         memcpy(&p, &ptr, sizeof(p));
2218
2219                         if (slen < 0) {
2220                                 if (p[-slen] != '{') goto cond_error;
2221                                 slen = -slen;
2222                         }
2223                         TALLOC_FREE(cond);
2224
2225                         /*
2226                          *      This hack is so that the NEXT stage
2227                          *      doesn't go "too far" in expanding the
2228                          *      variable.  We can parse the conditions
2229                          *      without expanding the ${...} stuff.
2230                          *      BUT we don't want to expand all of the
2231                          *      stuff AFTER the condition.  So we do
2232                          *      two passes.
2233                          *
2234                          *      The first pass is to discover the end
2235                          *      of the condition.  We then expand THAT
2236                          *      string, and do a second pass parsing
2237                          *      the expanded condition.
2238                          */
2239                         p += slen;
2240                         *p = '\0';
2241
2242                         /*
2243                          *      If there's a ${...}.  If so, expand it.
2244                          */
2245                         if (strchr(ptr, '$') != NULL) {
2246                                 ptr = cf_expand_variables(filename, lineno,
2247                                                           this,
2248                                                           buf3, sizeof(buf3),
2249                                                           ptr, NULL);
2250                                 if (!ptr) {
2251                                         ERROR("%s[%d]: Parse error expanding ${...} in condition",
2252                                               filename, *lineno);
2253                                         return -1;
2254                                 }
2255                         } /* else leave it alone */
2256
2257                         server = this->item.parent;
2258                         while ((strcmp(server->name1, "server") != 0) &&
2259                                (strcmp(server->name1, "policy") != 0) &&
2260                                (strcmp(server->name1, "instantiate") != 0)) {
2261                                 server = server->item.parent;
2262                                 if (!server) goto invalid_location;
2263                         }
2264
2265                         nextcs = cf_section_alloc(this, buf1, ptr);
2266                         if (!nextcs) {
2267                                 ERROR("%s[%d]: Failed allocating memory for section",
2268                                       filename, *lineno);
2269                                 return -1;
2270                         }
2271                         nextcs->item.filename = talloc_strdup(nextcs, filename);
2272                         nextcs->item.lineno = *lineno;
2273
2274                         slen = fr_condition_tokenize(nextcs, cf_section_to_item(nextcs), ptr, &cond,
2275                                                      &error, FR_COND_TWO_PASS);
2276                         *p = '{'; /* put it back */
2277
2278                 cond_error:
2279                         if (slen < 0) {
2280                                 char *spaces, *text;
2281
2282                                 fr_canonicalize_error(nextcs, &spaces, &text, slen, ptr);
2283
2284                                 ERROR("%s[%d]: Parse error in condition",
2285                                       filename, *lineno);
2286                                 ERROR("%s[%d]: %s", filename, *lineno, text);
2287                                 ERROR("%s[%d]: %s^ %s", filename, *lineno, spaces, error);
2288
2289                                 talloc_free(spaces);
2290                                 talloc_free(text);
2291                                 talloc_free(nextcs);
2292                                 return -1;
2293                         }
2294
2295                         if ((size_t) slen >= (sizeof(buf2) - 1)) {
2296                                 talloc_free(nextcs);
2297                                 ERROR("%s[%d]: Condition is too large after \"%s\"",
2298                                        filename, *lineno, buf1);
2299                                 return -1;
2300                         }
2301
2302                         /*
2303                          *      Copy the expanded and parsed condition
2304                          *      into buf2.  Then, parse the text after
2305                          *      the condition, which now MUST be a '{.
2306                          *
2307                          *      If it wasn't '{' it would have been
2308                          *      caught in the first pass of
2309                          *      conditional parsing, above.
2310                          */
2311                         memcpy(buf2, ptr, slen);
2312                         buf2[slen] = '\0';
2313                         ptr = p;
2314                         t2 = T_BARE_WORD;
2315
2316                         if ((t3 = gettoken(&ptr, buf3, sizeof(buf3), true)) != T_LCBRACE) {
2317                                 talloc_free(nextcs);
2318                                 ERROR("%s[%d]: Expected '{' %d",
2319                                       filename, *lineno, t3);
2320                                 return -1;
2321                         }
2322
2323                         /*
2324                          *      Swap the condition with trailing stuff for
2325                          *      the final condition.
2326                          */
2327                         memcpy(&p, &nextcs->name2, sizeof(nextcs->name2));
2328                         talloc_free(p);
2329                         nextcs->name2 = talloc_typed_strdup(nextcs, buf2);
2330
2331                         goto section_alloc;
2332                 }
2333
2334                 /*
2335                  *      Grab the next token.
2336                  */
2337                 t2 = gettoken(&ptr, buf2, sizeof(buf2), !cf_new_escape);
2338                 switch (t2) {
2339                 case T_EOL:
2340                 case T_HASH:
2341                 case T_COMMA:
2342                 do_bare_word:
2343                         t3 = t2;
2344                         t2 = T_OP_EQ;
2345                         value = NULL;
2346                         goto do_set;
2347
2348                 case T_OP_INCRM:
2349                 case T_OP_ADD:
2350                 case T_OP_CMP_EQ:
2351                 case T_OP_SUB:
2352                 case T_OP_LE:
2353                 case T_OP_GE:
2354                 case T_OP_CMP_FALSE:
2355                         if (!this || (strcmp(this->name1, "update") != 0)) {
2356                                 ERROR("%s[%d]: Invalid operator in assignment",
2357                                        filename, *lineno);
2358                                 return -1;
2359                         }
2360                         /* FALL-THROUGH */
2361
2362                 case T_OP_EQ:
2363                 case T_OP_SET:
2364                         while (isspace((int) *ptr)) ptr++;
2365
2366                         /*
2367                          *      New parser: non-quoted strings are
2368                          *      bare words, and we parse everything
2369                          *      until the next newline, or the next
2370                          *      comma.  If they have { or } in a bare
2371                          *      word, well... too bad.
2372                          */
2373                         if (cf_new_escape && (*ptr != '"') && (*ptr != '\'')
2374                             && (*ptr != '`') && (*ptr != '/')) {
2375                                 const char *q = ptr;
2376
2377                                 t3 = T_BARE_WORD;
2378                                 while (*q && (*q >= ' ') && (*q != ',') &&
2379                                        !isspace(*q)) q++;
2380
2381                                 if ((size_t) (q - ptr) >= sizeof(buf3)) {
2382                                         ERROR("%s[%d]: Parse error: value too long",
2383                                               filename, *lineno);
2384                                         return -1;
2385                                 }
2386
2387                                 memcpy(buf3, ptr, (q - ptr));
2388                                 buf3[q - ptr] = '\0';
2389                                 ptr = q;
2390
2391                         } else {
2392                                 t3 = getstring(&ptr, buf3, sizeof(buf3), !cf_new_escape);
2393                         }
2394
2395                         if (t3 == T_INVALID) {
2396                                 ERROR("%s[%d]: Parse error: %s",
2397                                        filename, *lineno,
2398                                        fr_strerror());
2399                                 return -1;
2400                         }
2401
2402                         /*
2403                          *      These are not allowed.  Print a
2404                          *      helpful error message.
2405                          */
2406                         if ((t3 == T_BACK_QUOTED_STRING) &&
2407                             (!this || (strcmp(this->name1, "update") != 0))) {
2408                                 ERROR("%s[%d]: Syntax error: Invalid string `...` in assignment",
2409                                        filename, *lineno);
2410                                 return -1;
2411                         }
2412
2413                         /*
2414                          *      Allow "foo" by itself, or "foo = bar"
2415                          */
2416                         switch (t3) {
2417                                 bool soft_fail;
2418
2419                         case T_BARE_WORD:
2420                         case T_DOUBLE_QUOTED_STRING:
2421                         case T_BACK_QUOTED_STRING:
2422                                 value = cf_expand_variables(filename, lineno, this, buf4, sizeof(buf4), buf3, &soft_fail);
2423                                 if (!value) {
2424                                         if (!soft_fail) return -1;
2425
2426                                         /*
2427                                          *      References an item which doesn't exist,
2428                                          *      or which is already marked up as being
2429                                          *      expanded in pass2.  Wait for pass2 to
2430                                          *      do the expansions.
2431                                          */
2432                                         pass2 = true;
2433                                         value = buf3;
2434                                 }
2435                                 break;
2436
2437                         case T_EOL:
2438                         case T_HASH:
2439                                 value = NULL;
2440                                 break;
2441
2442                         default:
2443                                 value = buf3;
2444                                 break;
2445                         }
2446
2447                         /*
2448                          *      Add this CONF_PAIR to our CONF_SECTION
2449                          */
2450                 do_set:
2451                         cpn = cf_pair_alloc(this, buf1, value, t2, t1, t3);
2452                         if (!cpn) return -1;
2453                         cpn->item.filename = talloc_strdup(cpn, filename);
2454                         cpn->item.lineno = *lineno;
2455                         cpn->pass2 = pass2;
2456                         cf_item_add(this, &(cpn->item));
2457
2458                         /*
2459                          *      Hacks for escaping
2460                          */
2461                         if (!cf_new_escape && !this->item.parent && value &&
2462                             (strcmp(buf1, "correct_escapes") == 0) &&
2463                             ((strcmp(value, "true") == 0) ||
2464                              (strcmp(value, "yes") == 0) ||
2465                              (strcmp(value, "1") == 0))) {
2466                                 cf_new_escape = true;
2467                         }
2468
2469                         /*
2470                          *      Require a comma, unless there's a comment.
2471                          */
2472                         while (isspace(*ptr)) ptr++;
2473
2474                         if (*ptr == ',') {
2475                                 ptr++;
2476                                 break;
2477                         }
2478
2479                         /*
2480                          *      module # stuff!
2481                          *      foo = bar # other stuff
2482                          */
2483                         if ((t3 == T_HASH) || (t3 == T_COMMA) || (t3 == T_EOL) || (*ptr == '#')) continue;
2484
2485                         if (!*ptr || (*ptr == '}')) break;
2486
2487                         ERROR("%s[%d]: Syntax error: Expected comma after '%s': %s",
2488                               filename, *lineno, value, ptr);
2489                         return -1;
2490
2491                         /*
2492                          *      No '=', must be a section or sub-section.
2493                          */
2494                 case T_BARE_WORD:
2495                 case T_DOUBLE_QUOTED_STRING:
2496                 case T_SINGLE_QUOTED_STRING:
2497                         t3 = gettoken(&ptr, buf3, sizeof(buf3), true);
2498                         if (t3 != T_LCBRACE) {
2499                                 ERROR("%s[%d]: Expecting section start brace '{' after \"%s %s\"",
2500                                        filename, *lineno, buf1, buf2);
2501                                 return -1;
2502                         }
2503                         /* FALL-THROUGH */
2504
2505                 case T_LCBRACE:
2506                 section_alloc:
2507                         if (!cond) {
2508                                 css = cf_section_alloc(this, buf1,
2509                                                        t2 == T_LCBRACE ? NULL : buf2);
2510                                 if (!css) {
2511                                         ERROR("%s[%d]: Failed allocating memory for section",
2512                                               filename, *lineno);
2513                                         return -1;
2514                                 }
2515
2516                                 css->item.filename = talloc_strdup(css, filename);
2517                                 css->item.lineno = *lineno;
2518                                 cf_item_add(this, &(css->item));
2519
2520                         } else {
2521                                 css = nextcs;
2522                                 nextcs = NULL;
2523
2524                                 cf_item_add(this, &(css->item));
2525                                 cf_data_add_internal(css, "if", cond, NULL, false);
2526                                 cond = NULL; /* eaten by the above line */
2527                         }
2528
2529                         /*
2530                          *      There may not be a name2
2531                          */
2532                         css->name2_type = (t2 == T_LCBRACE) ? T_INVALID : t2;
2533
2534                         /*
2535                          *      The current section is now the child section.
2536                          */
2537                         this = css;
2538                         break;
2539
2540                 case T_INVALID:
2541                         ERROR("%s[%d]: Syntax error in '%s': %s", filename, *lineno, ptr, fr_strerror());
2542
2543                         return -1;
2544
2545                 default:
2546                         ERROR("%s[%d]: Parse error after \"%s\": unexpected token \"%s\"",
2547                               filename, *lineno, buf1, fr_int2str(fr_tokens, t2, "<INVALID>"));
2548
2549                         return -1;
2550                 }
2551
2552         check_for_more:
2553                 /*
2554                  *      Done parsing one thing.  Skip to EOL if possible.
2555                  */
2556                 while (isspace(*ptr)) ptr++;
2557
2558                 if (*ptr == '#') continue;
2559
2560                 if (*ptr) {
2561                         goto get_more;
2562                 }
2563
2564         }
2565
2566         /*
2567          *      See if EOF was unexpected ..
2568          */
2569         if (feof(fp) && (this != current)) {
2570                 ERROR("%s[%d]: EOF reached without closing brace for section %s starting at line %d",
2571                       filename, *lineno, cf_section_name1(this), cf_section_lineno(this));
2572                 return -1;
2573         }
2574
2575         return 0;
2576 }
2577
2578 /*
2579  *      Include one config file in another.
2580  */
2581 int cf_file_include(CONF_SECTION *cs, char const *filename)
2582 {
2583         FILE            *fp;
2584         int             lineno = 0;
2585         struct stat     statbuf;
2586         time_t          *mtime;
2587         CONF_DATA       *cd;
2588
2589         DEBUG2("including configuration file %s", filename);
2590
2591         fp = fopen(filename, "r");
2592         if (!fp) {
2593                 ERROR("Unable to open file \"%s\": %s",
2594                        filename, fr_syserror(errno));
2595                 return -1;
2596         }
2597
2598         if (stat(filename, &statbuf) == 0) {
2599 #ifdef S_IWOTH
2600                 if ((statbuf.st_mode & S_IWOTH) != 0) {
2601                         fclose(fp);
2602                         ERROR("Configuration file %s is globally writable.  "
2603                               "Refusing to start due to insecure configuration.", filename);
2604                         return -1;
2605                 }
2606 #endif
2607
2608 #if 0 && defined(S_IROTH)
2609                 if (statbuf.st_mode & S_IROTH) != 0) {
2610                         fclose(fp);
2611                         ERROR("Configuration file %s is globally readable.  "
2612                               "Refusing to start due to insecure configuration", filename);
2613                         return -1;
2614                 }
2615 #endif
2616         }
2617
2618         if (cf_data_find_internal(cs, filename, PW_TYPE_FILE_INPUT)) {
2619                 fclose(fp);
2620                 ERROR("Cannot include the same file twice: \"%s\"", filename);
2621
2622                 return -1;
2623         }
2624
2625         /*
2626          *      Add the filename to the section
2627          */
2628         mtime = talloc(cs, time_t);
2629         *mtime = statbuf.st_mtime;
2630
2631         if (cf_data_add_internal(cs, filename, mtime, NULL, PW_TYPE_FILE_INPUT) < 0) {
2632                 fclose(fp);
2633                 ERROR("Internal error opening file \"%s\"",
2634                        filename);
2635                 return -1;
2636         }
2637
2638         cd = cf_data_find_internal(cs, filename, PW_TYPE_FILE_INPUT);
2639         if (!cd) {
2640                 fclose(fp);
2641                 ERROR("Internal error opening file \"%s\"",
2642                        filename);
2643                 return -1;
2644         }
2645
2646         if (!cs->item.filename) cs->item.filename = talloc_strdup(cs, filename);
2647
2648         /*
2649          *      Read the section.  It's OK to have EOF without a
2650          *      matching close brace.
2651          */
2652         if (cf_section_read(cd->name, &lineno, fp, cs) < 0) {
2653                 fclose(fp);
2654                 return -1;
2655         }
2656
2657         fclose(fp);
2658         return 0;
2659 }
2660
2661
2662 /*
2663  *      Do variable expansion in pass2.
2664  *
2665  *      This is a breadth-first expansion.  "deep
2666  */
2667 static int cf_section_pass2(CONF_SECTION *cs)
2668 {
2669         CONF_ITEM *ci;
2670
2671         for (ci = cs->children; ci; ci = ci->next) {
2672                 char const *value;
2673                 CONF_PAIR *cp;
2674                 char buffer[8192];
2675
2676                 if (ci->type != CONF_ITEM_PAIR) continue;
2677
2678                 cp = cf_item_to_pair(ci);
2679                 if (!cp->value || !cp->pass2) continue;
2680
2681                 rad_assert((cp->rhs_type == T_BARE_WORD) ||
2682                            (cp->rhs_type == T_DOUBLE_QUOTED_STRING) ||
2683                            (cp->rhs_type == T_BACK_QUOTED_STRING));
2684
2685                 value = cf_expand_variables(ci->filename, &ci->lineno, cs, buffer, sizeof(buffer), cp->value, NULL);
2686                 if (!value) return -1;
2687
2688                 rad_const_free(cp->value);
2689                 cp->value = talloc_typed_strdup(cp, value);
2690         }
2691
2692         for (ci = cs->children; ci; ci = ci->next) {
2693                 if (ci->type != CONF_ITEM_SECTION) continue;
2694
2695                 if (cf_section_pass2(cf_item_to_section(ci)) < 0) return -1;
2696         }
2697
2698         return 0;
2699 }
2700
2701
2702 /*
2703  *      Bootstrap a config file.
2704  */
2705 int cf_file_read(CONF_SECTION *cs, char const *filename)
2706 {
2707         char *p;
2708         CONF_PAIR *cp;
2709
2710         cp = cf_pair_alloc(cs, "confdir", filename, T_OP_SET, T_BARE_WORD, T_SINGLE_QUOTED_STRING);
2711         if (!cp) return -1;
2712
2713         p = strrchr(cp->value, FR_DIR_SEP);
2714         if (p) *p = '\0';
2715
2716         cp->item.filename = "internal";
2717         cp->item.lineno = -1;
2718         cf_item_add(cs, &(cp->item));
2719
2720         if (cf_file_include(cs, filename) < 0) return -1;
2721
2722         /*
2723          *      Now that we've read the file, go back through it and
2724          *      expand the variables.
2725          */
2726         if (cf_section_pass2(cs) < 0) {
2727                 talloc_free(cs);
2728                 return -1;
2729         }
2730
2731         return 0;
2732 }
2733
2734
2735 void cf_file_free(CONF_SECTION *cs)
2736 {
2737         talloc_free(cs);
2738 }
2739
2740
2741 /*
2742  * Return a CONF_PAIR within a CONF_SECTION.
2743  */
2744 CONF_PAIR *cf_pair_find(CONF_SECTION const *cs, char const *name)
2745 {
2746         CONF_PAIR *cp, mycp;
2747
2748         if (!cs || !name) return NULL;
2749
2750         mycp.attr = name;
2751         cp = rbtree_finddata(cs->pair_tree, &mycp);
2752         if (cp) return cp;
2753
2754         if (!cs->template) return NULL;
2755
2756         return rbtree_finddata(cs->template->pair_tree, &mycp);
2757 }
2758
2759 /*
2760  * Return the attr of a CONF_PAIR
2761  */
2762
2763 char const *cf_pair_attr(CONF_PAIR const *pair)
2764 {
2765         return (pair ? pair->attr : NULL);
2766 }
2767
2768 /*
2769  * Return the value of a CONF_PAIR
2770  */
2771
2772 char const *cf_pair_value(CONF_PAIR const *pair)
2773 {
2774         return (pair ? pair->value : NULL);
2775 }
2776
2777 FR_TOKEN cf_pair_operator(CONF_PAIR const *pair)
2778 {
2779         return (pair ? pair->op : T_INVALID);
2780 }
2781
2782 /** Return the value (lhs) type
2783  *
2784  * @param pair to extract value type from.
2785  * @return one of T_BARE_WORD, T_SINGLE_QUOTED_STRING, T_BACK_QUOTED_STRING
2786  *      T_DOUBLE_QUOTED_STRING or T_INVALID if the pair is NULL.
2787  */
2788 FR_TOKEN cf_pair_attr_type(CONF_PAIR const *pair)
2789 {
2790         return (pair ? pair->lhs_type : T_INVALID);
2791 }
2792
2793 /** Return the value (rhs) type
2794  *
2795  * @param pair to extract value type from.
2796  * @return one of T_BARE_WORD, T_SINGLE_QUOTED_STRING, T_BACK_QUOTED_STRING
2797  *      T_DOUBLE_QUOTED_STRING or T_INVALID if the pair is NULL.
2798  */
2799 FR_TOKEN cf_pair_value_type(CONF_PAIR const *pair)
2800 {
2801         return (pair ? pair->rhs_type : T_INVALID);
2802 }
2803
2804 /*
2805  * Turn a CONF_PAIR into a VALUE_PAIR
2806  * For now, ignore the "value_type" field...
2807  */
2808 VALUE_PAIR *cf_pairtovp(CONF_PAIR *pair)
2809 {
2810         if (!pair) {
2811                 fr_strerror_printf("Internal error");
2812                 return NULL;
2813         }
2814
2815         if (!pair->value) {
2816                 fr_strerror_printf("No value given for attribute %s", pair->attr);
2817                 return NULL;
2818         }
2819
2820         /*
2821          *      false comparisons never match.  BUT if it's a "string"
2822          *      or `string`, then remember to expand it later.
2823          */
2824         if ((pair->op != T_OP_CMP_FALSE) &&
2825             ((pair->rhs_type == T_DOUBLE_QUOTED_STRING) ||
2826              (pair->rhs_type == T_BACK_QUOTED_STRING))) {
2827                 VALUE_PAIR *vp;
2828
2829                 vp = pairmake(pair, NULL, pair->attr, NULL, pair->op);
2830                 if (!vp) {
2831                         return NULL;
2832                 }
2833
2834                 if (pairmark_xlat(vp, pair->value) < 0) {
2835                         talloc_free(vp);
2836
2837                         return NULL;
2838                 }
2839
2840                 return vp;
2841         }
2842
2843         return pairmake(pair, NULL, pair->attr, pair->value, pair->op);
2844 }
2845
2846 /*
2847  * Return the first label of a CONF_SECTION
2848  */
2849
2850 char const *cf_section_name1(CONF_SECTION const *cs)
2851 {
2852         return (cs ? cs->name1 : NULL);
2853 }
2854
2855 /*
2856  * Return the second label of a CONF_SECTION
2857  */
2858
2859 char const *cf_section_name2(CONF_SECTION const *cs)
2860 {
2861         return (cs ? cs->name2 : NULL);
2862 }
2863
2864 /** Return name2 if set, else name1
2865  *
2866  */
2867 char const *cf_section_name(CONF_SECTION const *cs)
2868 {
2869         char const *name;
2870
2871         name = cf_section_name2(cs);
2872         if (name) return name;
2873
2874         return cf_section_name1(cs);
2875 }
2876
2877 /*
2878  * Find a value in a CONF_SECTION
2879  */
2880 char const *cf_section_value_find(CONF_SECTION const *cs, char const *attr)
2881 {
2882         CONF_PAIR       *cp;
2883
2884         cp = cf_pair_find(cs, attr);
2885
2886         return (cp ? cp->value : NULL);
2887 }
2888
2889
2890 CONF_SECTION *cf_section_find_name2(CONF_SECTION const *cs,
2891                                     char const *name1, char const *name2)
2892 {
2893         char const      *their2;
2894         CONF_ITEM const *ci;
2895
2896         if (!cs || !name1) return NULL;
2897
2898         for (ci = &(cs->item); ci; ci = ci->next) {
2899                 if (ci->type != CONF_ITEM_SECTION)
2900                         continue;
2901
2902                 if (strcmp(cf_item_to_section(ci)->name1, name1) != 0) {
2903                         continue;
2904                 }
2905
2906                 their2 = cf_item_to_section(ci)->name2;
2907
2908                 if ((!name2 && !their2) ||
2909                     (name2 && their2 && (strcmp(name2, their2) == 0))) {
2910                         return cf_item_to_section(ci);
2911                 }
2912         }
2913
2914         return NULL;
2915 }
2916
2917 /** Find a pair with a name matching attr, after specified pair.
2918  *
2919  * @param cs to search in.
2920  * @param pair to search from (may be NULL).
2921  * @param attr to find (may be NULL in which case any attribute matches).
2922  * @return the next matching CONF_PAIR or NULL if none matched.
2923  */
2924 CONF_PAIR *cf_pair_find_next(CONF_SECTION const *cs,
2925                              CONF_PAIR const *pair, char const *attr)
2926 {
2927         CONF_ITEM       *ci;
2928
2929         if (!cs) return NULL;
2930
2931         /*
2932          *      If pair is NULL and we're trying to find a specific
2933          *      attribute this must be a first time run.
2934          *
2935          *      Find the pair with correct name.
2936          */
2937         if (!pair && attr) return cf_pair_find(cs, attr);
2938
2939         /*
2940          *      Start searching from the next child, or from the head
2941          *      of the list of children (if no pair was provided).
2942          */
2943         for (ci = pair ? pair->item.next : cs->children;
2944              ci;
2945              ci = ci->next) {
2946                 if (ci->type != CONF_ITEM_PAIR) continue;
2947
2948                 if (!attr || strcmp(cf_item_to_pair(ci)->attr, attr) == 0) break;
2949         }
2950
2951         return cf_item_to_pair(ci);
2952 }
2953
2954 /*
2955  * Find a CONF_SECTION, or return the root if name is NULL
2956  */
2957
2958 CONF_SECTION *cf_section_find(char const *name)
2959 {
2960         if (name)
2961                 return cf_section_sub_find(root_config, name);
2962         else
2963                 return root_config;
2964 }
2965
2966 /** Find a sub-section in a section
2967  *
2968  *      This finds ANY section having the same first name.
2969  *      The second name is ignored.
2970  */
2971 CONF_SECTION *cf_section_sub_find(CONF_SECTION const *cs, char const *name)
2972 {
2973         CONF_SECTION mycs;
2974
2975         if (!cs || !name) return NULL;  /* can't find an un-named section */
2976
2977         /*
2978          *      No sub-sections have been defined, so none exist.
2979          */
2980         if (!cs->section_tree) return NULL;
2981
2982         mycs.name1 = name;
2983         mycs.name2 = NULL;
2984         return rbtree_finddata(cs->section_tree, &mycs);
2985 }
2986
2987
2988 /** Find a CONF_SECTION with both names.
2989  *
2990  */
2991 CONF_SECTION *cf_section_sub_find_name2(CONF_SECTION const *cs,
2992                                         char const *name1, char const *name2)
2993 {
2994         CONF_ITEM    *ci;
2995
2996         if (!cs) cs = root_config;
2997         if (!cs) return NULL;
2998
2999         if (name1) {
3000                 CONF_SECTION mycs, *master_cs;
3001
3002                 if (!cs->section_tree) return NULL;
3003
3004                 mycs.name1 = name1;
3005                 mycs.name2 = name2;
3006
3007                 master_cs = rbtree_finddata(cs->section_tree, &mycs);
3008                 if (!master_cs) return NULL;
3009
3010                 /*
3011                  *      Look it up in the name2 tree.  If it's there,
3012                  *      return it.
3013                  */
3014                 if (master_cs->name2_tree) {
3015                         CONF_SECTION *subcs;
3016
3017                         subcs = rbtree_finddata(master_cs->name2_tree, &mycs);
3018                         if (subcs) return subcs;
3019                 }
3020
3021                 /*
3022                  *      We don't insert ourselves into the name2 tree.
3023                  *      So if there's nothing in the name2 tree, maybe
3024                  *      *we* are the answer.
3025                  */
3026                 if (!master_cs->name2 && name2) return NULL;
3027                 if (master_cs->name2 && !name2) return NULL;
3028                 if (!master_cs->name2 && !name2) return master_cs;
3029
3030                 if (strcmp(master_cs->name2, name2) == 0) {
3031                         return master_cs;
3032                 }
3033
3034                 return NULL;
3035         }
3036
3037         /*
3038          *      Else do it the old-fashioned way.
3039          */
3040         for (ci = cs->children; ci; ci = ci->next) {
3041                 CONF_SECTION *subcs;
3042
3043                 if (ci->type != CONF_ITEM_SECTION)
3044                         continue;
3045
3046                 subcs = cf_item_to_section(ci);
3047                 if (!subcs->name2) {
3048                         if (strcmp(subcs->name1, name2) == 0) break;
3049                 } else {
3050                         if (strcmp(subcs->name2, name2) == 0) break;
3051                 }
3052         }
3053
3054         return cf_item_to_section(ci);
3055 }
3056
3057 /*
3058  * Return the next subsection after a CONF_SECTION
3059  * with a certain name1 (char *name1). If the requested
3060  * name1 is NULL, any name1 matches.
3061  */
3062
3063 CONF_SECTION *cf_subsection_find_next(CONF_SECTION const *section,
3064                                       CONF_SECTION const *subsection,
3065                                       char const *name1)
3066 {
3067         CONF_ITEM       *ci;
3068
3069         if (!section) return NULL;
3070
3071         /*
3072          * If subsection is NULL this must be a first time run
3073          * Find the subsection with correct name
3074          */
3075
3076         if (!subsection) {
3077                 ci = section->children;
3078         } else {
3079                 ci = subsection->item.next;
3080         }
3081
3082         for (; ci; ci = ci->next) {
3083                 if (ci->type != CONF_ITEM_SECTION)
3084                         continue;
3085                 if ((name1 == NULL) ||
3086                     (strcmp(cf_item_to_section(ci)->name1, name1) == 0))
3087                         break;
3088         }
3089
3090         return cf_item_to_section(ci);
3091 }
3092
3093
3094 /*
3095  * Return the next section after a CONF_SECTION
3096  * with a certain name1 (char *name1). If the requested
3097  * name1 is NULL, any name1 matches.
3098  */
3099
3100 CONF_SECTION *cf_section_find_next(CONF_SECTION const *section,
3101                                    CONF_SECTION const *subsection,
3102                                    char const *name1)
3103 {
3104         if (!section) return NULL;
3105
3106         if (!section->item.parent) return NULL;
3107
3108         return cf_subsection_find_next(section->item.parent, subsection, name1);
3109 }
3110
3111 /** Return the next item after a CONF_ITEM.
3112  *
3113  */
3114 CONF_ITEM *cf_item_find_next(CONF_SECTION const *section, CONF_ITEM const *item)
3115 {
3116         if (!section) return NULL;
3117
3118         /*
3119          *      If item is NULL this must be a first time run
3120          *      Return the first item
3121          */
3122         if (item == NULL) {
3123                 return section->children;
3124         } else {
3125                 return item->next;
3126         }
3127 }
3128
3129 static void _pair_count(int *count, CONF_SECTION const *cs)
3130 {
3131         CONF_ITEM const *ci;
3132
3133         for (ci = cf_item_find_next(cs, NULL);
3134              ci != NULL;
3135              ci = cf_item_find_next(cs, ci)) {
3136
3137                 if (cf_item_is_section(ci)) {
3138                         _pair_count(count, cf_item_to_section(ci));
3139                         continue;
3140                 }
3141
3142                 (*count)++;
3143         }
3144 }
3145
3146 /** Count the number of conf pairs beneath a section
3147  *
3148  * @param[in] cs to search for items in.
3149  * @return number of pairs nested within section.
3150  */
3151 int cf_pair_count(CONF_SECTION const *cs)
3152 {
3153         int count = 0;
3154
3155         _pair_count(&count, cs);
3156
3157         return count;
3158 }
3159
3160 CONF_SECTION *cf_item_parent(CONF_ITEM const *ci)
3161 {
3162         if (!ci) return NULL;
3163
3164         return ci->parent;
3165 }
3166
3167 int cf_section_lineno(CONF_SECTION const *section)
3168 {
3169         return section->item.lineno;
3170 }
3171
3172 char const *cf_pair_filename(CONF_PAIR const *pair)
3173 {
3174         return pair->item.filename;
3175 }
3176
3177 char const *cf_section_filename(CONF_SECTION const *section)
3178 {
3179         return section->item.filename;
3180 }
3181
3182 int cf_pair_lineno(CONF_PAIR const *pair)
3183 {
3184         return pair->item.lineno;
3185 }
3186
3187 bool cf_item_is_section(CONF_ITEM const *item)
3188 {
3189         return item->type == CONF_ITEM_SECTION;
3190 }
3191
3192 bool cf_item_is_pair(CONF_ITEM const *item)
3193 {
3194         return item->type == CONF_ITEM_PAIR;
3195 }
3196
3197
3198 static CONF_DATA *cf_data_alloc(CONF_SECTION *parent, char const *name,
3199                                 void *data, void (*data_free)(void *))
3200 {
3201         CONF_DATA *cd;
3202
3203         cd = talloc_zero(parent, CONF_DATA);
3204         if (!cd) return NULL;
3205
3206         cd->item.type = CONF_ITEM_DATA;
3207         cd->item.parent = parent;
3208         cd->name = talloc_typed_strdup(cd, name);
3209         if (!cd->name) {
3210                 talloc_free(cd);
3211                 return NULL;
3212         }
3213
3214         cd->data = data;
3215         cd->free = data_free;
3216
3217         if (cd->free) {
3218                 talloc_set_destructor(cd, _cf_data_free);
3219         }
3220
3221         return cd;
3222 }
3223
3224 static void *cf_data_find_internal(CONF_SECTION const *cs, char const *name, int flag)
3225 {
3226         if (!cs || !name) return NULL;
3227
3228         /*
3229          *      Find the name in the tree, for speed.
3230          */
3231         if (cs->data_tree) {
3232                 CONF_DATA mycd;
3233
3234                 mycd.name = name;
3235                 mycd.flag = flag;
3236                 return rbtree_finddata(cs->data_tree, &mycd);
3237         }
3238
3239         return NULL;
3240 }
3241
3242 /*
3243  *      Find data from a particular section.
3244  */
3245 void *cf_data_find(CONF_SECTION const *cs, char const *name)
3246 {
3247         CONF_DATA *cd = cf_data_find_internal(cs, name, 0);
3248
3249         if (cd) return cd->data;
3250         return NULL;
3251 }
3252
3253
3254 /*
3255  *      Add named data to a configuration section.
3256  */
3257 static int cf_data_add_internal(CONF_SECTION *cs, char const *name,
3258                                 void *data, void (*data_free)(void *),
3259                                 int flag)
3260 {
3261         CONF_DATA *cd;
3262
3263         if (!cs || !name) return -1;
3264
3265         /*
3266          *      Already exists.  Can't add it.
3267          */
3268         if (cf_data_find_internal(cs, name, flag) != NULL) return -1;
3269
3270         cd = cf_data_alloc(cs, name, data, data_free);
3271         if (!cd) return -1;
3272         cd->flag = flag;
3273
3274         cf_item_add(cs, cf_data_to_item(cd));
3275
3276         return 0;
3277 }
3278
3279 /*
3280  *      Add named data to a configuration section.
3281  */
3282 int cf_data_add(CONF_SECTION *cs, char const *name,
3283                 void *data, void (*data_free)(void *))
3284 {
3285         return cf_data_add_internal(cs, name, data, data_free, 0);
3286 }
3287
3288 /** Remove named data from a configuration section
3289  *
3290  */
3291 void *cf_data_remove(CONF_SECTION *cs, char const *name)
3292 {
3293         CONF_DATA mycd;
3294         CONF_DATA *cd;
3295         void *data;
3296
3297         if (!cs || !name) return NULL;
3298         if (!cs->data_tree) return NULL;
3299
3300         /*
3301          *      Find the name in the tree, for speed.
3302          */
3303         mycd.name = name;
3304         mycd.flag = 0;
3305         cd = rbtree_finddata(cs->data_tree, &mycd);
3306         if (!cd) return NULL;
3307
3308         talloc_set_destructor(cd, NULL);        /* Disarm the destructor */
3309         rbtree_deletebydata(cs->data_tree, &mycd);
3310
3311         data = cd->data;
3312         talloc_free(cd);
3313
3314         return data;
3315 }
3316
3317 /*
3318  *      This is here to make the rest of the code easier to read.  It
3319  *      ties conffile.c to log.c, but it means we don't have to
3320  *      pollute every other function with the knowledge of the
3321  *      configuration internals.
3322  */
3323 void cf_log_err(CONF_ITEM const *ci, char const *fmt, ...)
3324 {
3325         va_list ap;
3326         char buffer[256];
3327
3328         va_start(ap, fmt);
3329         vsnprintf(buffer, sizeof(buffer), fmt, ap);
3330         va_end(ap);
3331
3332         if (ci) {
3333                 ERROR("%s[%d]: %s",
3334                        ci->filename ? ci->filename : "unknown",
3335                        ci->lineno ? ci->lineno : 0,
3336                        buffer);
3337         } else {
3338                 ERROR("<unknown>[*]: %s", buffer);
3339         }
3340 }
3341
3342 void cf_log_err_cs(CONF_SECTION const *cs, char const *fmt, ...)
3343 {
3344         va_list ap;
3345         char buffer[256];
3346
3347         va_start(ap, fmt);
3348         vsnprintf(buffer, sizeof(buffer), fmt, ap);
3349         va_end(ap);
3350
3351         rad_assert(cs != NULL);
3352
3353         ERROR("%s[%d]: %s",
3354                cs->item.filename ? cs->item.filename : "unknown",
3355                cs->item.lineno ? cs->item.lineno : 0,
3356                buffer);
3357 }
3358
3359 void cf_log_err_cp(CONF_PAIR const *cp, char const *fmt, ...)
3360 {
3361         va_list ap;
3362         char buffer[256];
3363
3364         va_start(ap, fmt);
3365         vsnprintf(buffer, sizeof(buffer), fmt, ap);
3366         va_end(ap);
3367
3368         rad_assert(cp != NULL);
3369
3370         ERROR("%s[%d]: %s",
3371                cp->item.filename ? cp->item.filename : "unknown",
3372                cp->item.lineno ? cp->item.lineno : 0,
3373                buffer);
3374 }
3375
3376 void cf_log_info(CONF_SECTION const *cs, char const *fmt, ...)
3377 {
3378         va_list ap;
3379
3380         va_start(ap, fmt);
3381         if ((debug_flag > 1) && cs) vradlog(L_DBG, fmt, ap);
3382         va_end(ap);
3383 }
3384
3385 /*
3386  *      Wrapper to simplify the code.
3387  */
3388 void cf_log_module(CONF_SECTION const *cs, char const *fmt, ...)
3389 {
3390         va_list ap;
3391         char buffer[256];
3392
3393         va_start(ap, fmt);
3394         if (debug_flag > 1 && cs) {
3395                 vsnprintf(buffer, sizeof(buffer), fmt, ap);
3396
3397                 DEBUG("%.*s# %s", cs->depth, parse_spaces, buffer);
3398         }
3399         va_end(ap);
3400 }
3401
3402 const CONF_PARSER *cf_section_parse_table(CONF_SECTION *cs)
3403 {
3404         if (!cs) return NULL;
3405
3406         return cs->variables;
3407 }
3408
3409 /*
3410  *      For "switch" and "case" statements.
3411  */
3412 FR_TOKEN cf_section_name2_type(CONF_SECTION const *cs)
3413 {
3414         if (!cs) return T_INVALID;
3415
3416         return cs->name2_type;
3417 }