src/main/conffile.c

   1 /*
   2  * conffile.c   Read the radiusd.conf file.
   3  *
   4  *              Yep I should learn to use lex & yacc, or at least
   5  *              write a decent parser. I know how to do that, really :)
   6  *              miquels@cistron.nl
   7  *
   8  * Version:     $Id$
   9  *
  10  *   This program is free software; you can redistribute it and/or modify
  11  *   it under the terms of the GNU General Public License as published by
  12  *   the Free Software Foundation; either version 2 of the License, or
  13  *   (at your option) any later version.
  14  *
  15  *   This program is distributed in the hope that it will be useful,
  16  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  *   GNU General Public License for more details.
  19  *
  20  *   You should have received a copy of the GNU General Public License
  21  *   along with this program; if not, write to the Free Software
  22  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  23  *
  24  * Copyright 2000,2006  The FreeRADIUS server project
  25  * Copyright 2000  Miquel van Smoorenburg <miquels@cistron.nl>
  26  * Copyright 2000  Alan DeKok <aland@ox.org>
  27  */
  28
  29 RCSID("$Id$")
  30
  31 #include <freeradius-devel/radiusd.h>
  32 #include <freeradius-devel/parser.h>
  33 #include <freeradius-devel/rad_assert.h>
  34
  35 #ifdef HAVE_DIRENT_H
  36 #include <dirent.h>
  37 #endif
  38
  39 #ifdef HAVE_SYS_STAT_H
  40 #include <sys/stat.h>
  41 #endif
  42
  43 #include <ctype.h>
  44
  45 typedef enum conf_property {
  46         CONF_PROPERTY_INVALID = 0,
  47         CONF_PROPERTY_NAME,
  48         CONF_PROPERTY_INSTANCE,
  49 } CONF_PROPERTY;
  50
  51 static const FR_NAME_NUMBER conf_property_name[] = {
  52         { "name",       CONF_PROPERTY_NAME},
  53         { "instance",   CONF_PROPERTY_INSTANCE},
  54
  55         {  NULL , -1 }
  56 };
  57
  58 typedef enum conf_type {
  59         CONF_ITEM_INVALID = 0,
  60         CONF_ITEM_PAIR,
  61         CONF_ITEM_SECTION,
  62         CONF_ITEM_DATA
  63 } CONF_ITEM_TYPE;
  64
  65 struct conf_item {
  66         struct conf_item *next;         //!< Sibling.
  67         struct conf_part *parent;       //!< Parent.
  68         int lineno;                     //!< The line number the config item began on.
  69         char const *filename;           //!< The file the config item was parsed from.
  70         CONF_ITEM_TYPE type;            //!< Whether the config item is a config_pair, conf_section or conf_data.
  71 };
  72
  73 /** Configuration AVP similar to a VALUE_PAIR
  74  *
  75  */
  76 struct conf_pair {
  77         CONF_ITEM       item;
  78         char const      *attr;          //!< Attribute name
  79         char const      *value;         //!< Attribute value
  80         FR_TOKEN        op;             //!< Operator e.g. =, :=
  81         FR_TOKEN        lhs_type;       //!< Name quoting style T_(DOUBLE|SINGLE|BACK)_QUOTE_STRING or T_BARE_WORD.
  82         FR_TOKEN        rhs_type;       //!< Value Quoting style T_(DOUBLE|SINGLE|BACK)_QUOTE_STRING or T_BARE_WORD.
  83         bool            pass2;          //!< do expansion in pass2.
  84         bool            parsed;         //!< Was this item used during parsing?
  85 };
  86
  87 /** Internal data that is associated with a configuration section
  88  *
  89  */
  90 struct conf_data {
  91         CONF_ITEM       item;
  92         char const      *name;
  93         int             flag;
  94         void            *data;          //!< User data
  95         void            (*free)(void *);        //!< Free user data function
  96 };
  97
  98 struct conf_part {
  99         CONF_ITEM       item;
 100         char const      *name1;         //!< First name token.  Given ``foo bar {}`` would be ``foo``.
 101         char const      *name2;         //!< Second name token. Given ``foo bar {}`` would be ``bar``.
 102
 103         FR_TOKEN        name2_type;     //!< The type of quoting around name2.
 104
 105         CONF_ITEM       *children;
 106         CONF_ITEM       *tail;          //!< For speed.
 107         CONF_SECTION    *template;
 108
 109         rbtree_t        *pair_tree;     //!< and a partridge..
 110         rbtree_t        *section_tree;  //!< no jokes here.
 111         rbtree_t        *name2_tree;    //!< for sections of the same name2
 112         rbtree_t        *data_tree;
 113
 114         void            *base;
 115         int             depth;
 116
 117         CONF_PARSER const *variables;
 118 };
 119
 120 CONF_SECTION *root_config = NULL;
 121 bool cf_new_escape = false;
 122
 123
 124 static int              cf_data_add_internal(CONF_SECTION *cs, char const *name, void *data,
 125                                              void (*data_free)(void *), int flag);
 126
 127 static void             *cf_data_find_internal(CONF_SECTION const *cs, char const *name, int flag);
 128
 129 static char const       *cf_expand_variables(char const *cf, int *lineno,
 130                                              CONF_SECTION *outercs,
 131                                              char *output, size_t outsize,
 132                                              char const *input, bool *soft_fail);
 133
 134 /*
 135  *      Isolate the scary casts in these tiny provably-safe functions
 136  */
 137
 138 /** Cast a CONF_ITEM to a CONF_PAIR
 139  *
 140  */
 141 CONF_PAIR *cf_item_to_pair(CONF_ITEM const *ci)
 142 {
 143         CONF_PAIR *out;
 144
 145         if (ci == NULL) return NULL;
 146
 147         rad_assert(ci->type == CONF_ITEM_PAIR);
 148
 149         memcpy(&out, &ci, sizeof(out));
 150         return out;
 151 }
 152
 153 /** Cast a CONF_ITEM to a CONF_SECTION
 154  *
 155  */
 156 CONF_SECTION *cf_item_to_section(CONF_ITEM const *ci)
 157 {
 158         CONF_SECTION *out;
 159
 160         if (ci == NULL) return NULL;
 161
 162         rad_assert(ci->type == CONF_ITEM_SECTION);
 163
 164         memcpy(&out, &ci, sizeof(out));
 165         return out;
 166 }
 167
 168 /** Cast a CONF_PAIR to a CONF_ITEM
 169  *
 170  */
 171 CONF_ITEM *cf_pair_to_item(CONF_PAIR const *cp)
 172 {
 173         CONF_ITEM *out;
 174
 175         if (cp == NULL) return NULL;
 176
 177         memcpy(&out, &cp, sizeof(out));
 178         return out;
 179 }
 180
 181 /** Cast a CONF_SECTION to a CONF_ITEM
 182  *
 183  */
 184 CONF_ITEM *cf_section_to_item(CONF_SECTION const *cs)
 185 {
 186         CONF_ITEM *out;
 187
 188         if (cs == NULL) return NULL;
 189
 190         memcpy(&out, &cs, sizeof(out));
 191         return out;
 192 }
 193
 194 /** Cast CONF_DATA to a CONF_ITEM
 195  *
 196  */
 197 static CONF_ITEM *cf_data_to_item(CONF_DATA const *cd)
 198 {
 199         CONF_ITEM *out;
 200
 201         if (cd == NULL) {
 202                 return NULL;
 203         }
 204
 205         memcpy(&out, &cd, sizeof(out));
 206         return out;
 207 }
 208
 209 static int _cf_data_free(CONF_DATA *cd)
 210 {
 211         if (cd->free) cd->free(cd->data);
 212
 213         return 0;
 214 }
 215
 216 /*
 217  *      rbtree callback function
 218  */
 219 static int pair_cmp(void const *a, void const *b)
 220 {
 221         CONF_PAIR const *one = a;
 222         CONF_PAIR const *two = b;
 223
 224         return strcmp(one->attr, two->attr);
 225 }
 226
 227
 228 /*
 229  *      rbtree callback function
 230  */
 231 static int section_cmp(void const *a, void const *b)
 232 {
 233         CONF_SECTION const *one = a;
 234         CONF_SECTION const *two = b;
 235
 236         return strcmp(one->name1, two->name1);
 237 }
 238
 239
 240 /*
 241  *      rbtree callback function
 242  */
 243 static int name2_cmp(void const *a, void const *b)
 244 {
 245         CONF_SECTION const *one = a;
 246         CONF_SECTION const *two = b;
 247
 248         rad_assert(strcmp(one->name1, two->name1) == 0);
 249
 250         if (!one->name2 && !two->name2) return 0;
 251         if (one->name2 && !two->name2) return -1;
 252         if (!one->name2 && two->name2) return +1;
 253
 254         return strcmp(one->name2, two->name2);
 255 }
 256
 257
 258 /*
 259  *      rbtree callback function
 260  */
 261 static int data_cmp(void const *a, void const *b)
 262 {
 263         int rcode;
 264
 265         CONF_DATA const *one = a;
 266         CONF_DATA const *two = b;
 267
 268         rcode = one->flag - two->flag;
 269         if (rcode != 0) return rcode;
 270
 271         return strcmp(one->name, two->name);
 272 }
 273
 274 static int _cf_section_free(CONF_SECTION *cs)
 275 {
 276         /*
 277          *      Name1 and name2 are allocated contiguous with
 278          *      cs.
 279          */
 280         if (cs->pair_tree) {
 281                 rbtree_free(cs->pair_tree);
 282                 cs->pair_tree = NULL;
 283         }
 284         if (cs->section_tree) {
 285                 rbtree_free(cs->section_tree);
 286                 cs->section_tree = NULL;
 287         }
 288         if (cs->name2_tree) {
 289                 rbtree_free(cs->name2_tree);
 290                 cs->name2_tree = NULL;
 291         }
 292         if (cs->data_tree) {
 293                 rbtree_free(cs->data_tree);
 294                 cs->data_tree = NULL;
 295         }
 296
 297         return 0;
 298 }
 299
 300 /** Allocate a CONF_PAIR
 301  *
 302  * @param parent CONF_SECTION to hang this CONF_PAIR off of.
 303  * @param attr name.
 304  * @param value of CONF_PAIR.
 305  * @param op T_OP_EQ, T_OP_SET etc.
 306  * @param lhs_type T_BARE_WORD, T_DOUBLE_QUOTED_STRING, T_BACK_QUOTED_STRING
 307  * @param rhs_type T_BARE_WORD, T_DOUBLE_QUOTED_STRING, T_BACK_QUOTED_STRING
 308  * @return NULL on error, else a new CONF_SECTION parented by parent.
 309  */
 310 CONF_PAIR *cf_pair_alloc(CONF_SECTION *parent, char const *attr, char const *value,
 311                          FR_TOKEN op, FR_TOKEN lhs_type, FR_TOKEN rhs_type)
 312 {
 313         CONF_PAIR *cp;
 314
 315         rad_assert(fr_equality_op[op] || fr_assignment_op[op]);
 316         if (!attr) return NULL;
 317
 318         cp = talloc_zero(parent, CONF_PAIR);
 319         if (!cp) return NULL;
 320
 321         cp->item.type = CONF_ITEM_PAIR;
 322         cp->item.parent = parent;
 323         cp->lhs_type = lhs_type;
 324         cp->rhs_type = rhs_type;
 325         cp->op = op;
 326
 327         cp->attr = talloc_typed_strdup(cp, attr);
 328         if (!cp->attr) {
 329         error:
 330                 talloc_free(cp);
 331                 return NULL;
 332         }
 333
 334         if (value) {
 335                 cp->value = talloc_typed_strdup(cp, value);
 336                 if (!cp->value) goto error;
 337         }
 338
 339         return cp;
 340 }
 341
 342 /** Duplicate a CONF_PAIR
 343  *
 344  * @param parent to allocate new pair in.
 345  * @param cp to duplicate.
 346  * @return NULL on error, else a duplicate of the input pair.
 347  */
 348 CONF_PAIR *cf_pair_dup(CONF_SECTION *parent, CONF_PAIR *cp)
 349 {
 350         CONF_PAIR *new;
 351
 352         rad_assert(parent);
 353         rad_assert(cp);
 354
 355         new = cf_pair_alloc(parent, cp->attr, cf_pair_value(cp),
 356                             cp->op, cp->lhs_type, cp->rhs_type);
 357         if (new) {
 358                 new->parsed = cp->parsed;
 359                 new->item.lineno = cp->item.lineno;
 360                 new->item.filename = talloc_strdup(new, cp->item.filename);
 361         }
 362
 363         return new;
 364 }
 365
 366 /** Add a configuration pair to a section
 367  *
 368  * @param parent section to add pair to.
 369  * @param cp to add.
 370  */
 371 void cf_pair_add(CONF_SECTION *parent, CONF_PAIR *cp)
 372 {
 373         cf_item_add(parent, cf_pair_to_item(cp));
 374 }
 375
 376 /** Allocate a CONF_SECTION
 377  *
 378  * @param parent CONF_SECTION to hang this CONF_SECTION off of.
 379  * @param name1 Primary name.
 380  * @param name2 Secondary name.
 381  * @return NULL on error, else a new CONF_SECTION parented by parent.
 382  */
 383 CONF_SECTION *cf_section_alloc(CONF_SECTION *parent, char const *name1, char const *name2)
 384 {
 385         CONF_SECTION *cs;
 386         char buffer[1024];
 387
 388         if (!name1) return NULL;
 389
 390         if (name2) {
 391                 if (strchr(name2, '$')) {
 392                         name2 = cf_expand_variables(parent->item.filename,
 393                                                 &parent->item.lineno,
 394                                                 parent,
 395                                                 buffer, sizeof(buffer), name2, NULL);
 396                         if (!name2) {
 397                                 ERROR("Failed expanding section name");
 398                                 return NULL;
 399                         }
 400                 }
 401         }
 402
 403         cs = talloc_zero(parent, CONF_SECTION);
 404         if (!cs) return NULL;
 405
 406         cs->item.type = CONF_ITEM_SECTION;
 407         cs->item.parent = parent;
 408
 409         cs->name1 = talloc_typed_strdup(cs, name1);
 410         if (!cs->name1) {
 411         error:
 412                 talloc_free(cs);
 413                 return NULL;
 414         }
 415
 416         if (name2) {
 417                 cs->name2 = talloc_typed_strdup(cs, name2);
 418                 if (!cs->name2) goto error;
 419         }
 420
 421         cs->pair_tree = rbtree_create(cs, pair_cmp, NULL, 0);
 422         if (!cs->pair_tree) goto error;
 423
 424         talloc_set_destructor(cs, _cf_section_free);
 425
 426         /*
 427          *      Don't create a data tree, it may not be needed.
 428          */
 429
 430         /*
 431          *      Don't create the section tree here, it may not
 432          *      be needed.
 433          */
 434
 435         if (parent) cs->depth = parent->depth + 1;
 436
 437         return cs;
 438 }
 439
 440 /** Duplicate a configuration section
 441  *
 442  * @note recursively duplicates any child sections.
 443  * @note does not duplicate any data associated with a section, or its child sections.
 444  *
 445  * @param parent section.
 446  * @param cs to duplicate.
 447  * @param name1 of new section.
 448  * @param name2 of new section.
 449  * @param copy_meta Copy additional meta data for a section (like template, base, depth and variables).
 450  * @return a duplicate of the existing section, or NULL on error.
 451  */
 452 CONF_SECTION *cf_section_dup(CONF_SECTION *parent, CONF_SECTION const *cs,
 453                              char const *name1, char const *name2, bool copy_meta)
 454 {
 455         CONF_SECTION *new, *subcs;
 456         CONF_PAIR *cp;
 457         CONF_ITEM *ci;
 458
 459         new = cf_section_alloc(parent, name1, name2);
 460
 461         if (copy_meta) {
 462                 new->template = cs->template;
 463                 new->base = cs->base;
 464                 new->depth = cs->depth;
 465                 new->variables = cs->variables;
 466         }
 467
 468         new->item.lineno = cs->item.lineno;
 469         new->item.filename = talloc_strdup(new, cs->item.filename);
 470
 471         for (ci = cs->children; ci; ci = ci->next) {
 472                 switch (ci->type) {
 473                 case CONF_ITEM_SECTION:
 474                         subcs = cf_item_to_section(ci);
 475                         subcs = cf_section_dup(new, subcs,
 476                                                cf_section_name1(subcs), cf_section_name2(subcs),
 477                                                copy_meta);
 478                         if (!subcs) {
 479                                 talloc_free(new);
 480                                 return NULL;
 481                         }
 482                         cf_section_add(new, subcs);
 483                         break;
 484
 485                 case CONF_ITEM_PAIR:
 486                         cp = cf_pair_dup(new, cf_item_to_pair(ci));
 487                         if (!cp) {
 488                                 talloc_free(new);
 489                                 return NULL;
 490                         }
 491                         cf_pair_add(new, cp);
 492                         break;
 493
 494                 case CONF_ITEM_DATA: /* Skip data */
 495                         break;
 496
 497                 case CONF_ITEM_INVALID:
 498                         rad_assert(0);
 499                 }
 500         }
 501
 502         return new;
 503 }
 504
 505 void cf_section_add(CONF_SECTION *parent, CONF_SECTION *cs)
 506 {
 507         cf_item_add(parent, &(cs->item));
 508 }
 509
 510 /** Replace pair in a given section with a new pair, of the given value.
 511  *
 512  * @param cs to replace pair in.
 513  * @param cp to replace.
 514  * @param value New value to assign to cp.
 515  * @return 0 on success, -1 on failure.
 516  */
 517 int cf_pair_replace(CONF_SECTION *cs, CONF_PAIR *cp, char const *value)
 518 {
 519         CONF_PAIR *newp;
 520         CONF_ITEM *ci, *cn, **last;
 521
 522         newp = cf_pair_alloc(cs, cp->attr, value, cp->op, cp->lhs_type, cp->rhs_type);
 523         if (!newp) return -1;
 524
 525         ci = &(cp->item);
 526         cn = &(newp->item);
 527
 528         /*
 529          *      Find the old one from the linked list, and replace it
 530          *      with the new one.
 531          */
 532         for (last = &cs->children; (*last) != NULL; last = &(*last)->next) {
 533                 if (*last == ci) {
 534                         cn->next = (*last)->next;
 535                         *last = cn;
 536                         ci->next = NULL;
 537                         break;
 538                 }
 539         }
 540
 541         rbtree_deletebydata(cs->pair_tree, ci);
 542
 543         rbtree_insert(cs->pair_tree, cn);
 544
 545         return 0;
 546 }
 547
 548
 549 /*
 550  *      Add an item to a configuration section.
 551  */
 552 void cf_item_add(CONF_SECTION *cs, CONF_ITEM *ci)
 553 {
 554 #ifndef NDEBUG
 555         CONF_ITEM *first = ci;
 556 #endif
 557
 558         rad_assert((void *)cs != (void *)ci);
 559
 560         if (!cs || !ci) return;
 561
 562         if (!cs->children) {
 563                 rad_assert(cs->tail == NULL);
 564                 cs->children = ci;
 565         } else {
 566                 rad_assert(cs->tail != NULL);
 567                 cs->tail->next = ci;
 568         }
 569
 570         /*
 571          *      Update the trees (and tail) for each item added.
 572          */
 573         for (/* nothing */; ci != NULL; ci = ci->next) {
 574                 rad_assert(ci->next != first);  /* simple cycle detection */
 575
 576                 cs->tail = ci;
 577
 578                 /*
 579                  *      For fast lookups, pairs and sections get
 580                  *      added to rbtree's.
 581                  */
 582                 switch (ci->type) {
 583                 case CONF_ITEM_PAIR:
 584                         if (!rbtree_insert(cs->pair_tree, ci)) {
 585                                 CONF_PAIR *cp = cf_item_to_pair(ci);
 586
 587                                 if (strcmp(cp->attr, "confdir") == 0) break;
 588                                 if (!cp->value) break; /* module name, "ok", etc. */
 589                         }
 590                         break;
 591
 592                 case CONF_ITEM_SECTION: {
 593                         CONF_SECTION *cs_new = cf_item_to_section(ci);
 594                         CONF_SECTION *name1_cs;
 595
 596                         if (!cs->section_tree) {
 597                                 cs->section_tree = rbtree_create(cs, section_cmp, NULL, 0);
 598                                 if (!cs->section_tree) {
 599                                         ERROR("Out of memory");
 600                                         fr_exit_now(1);
 601                                 }
 602                         }
 603
 604                         name1_cs = rbtree_finddata(cs->section_tree, cs_new);
 605                         if (!name1_cs) {
 606                                 if (!rbtree_insert(cs->section_tree, cs_new)) {
 607                                         ERROR("Failed inserting section into tree");
 608                                         fr_exit_now(1);
 609                                 }
 610                                 break;
 611                         }
 612
 613                         /*
 614                          *      We already have a section of
 615                          *      this "name1".  Add a new
 616                          *      sub-section based on name2.
 617                          */
 618                         if (!name1_cs->name2_tree) {
 619                                 name1_cs->name2_tree = rbtree_create(name1_cs, name2_cmp, NULL, 0);
 620                                 if (!name1_cs->name2_tree) {
 621                                         ERROR("Out of memory");
 622                                         fr_exit_now(1);
 623                                 }
 624                         }
 625
 626                         /*
 627                          *      We don't care if this fails.
 628                          *      If the user tries to create
 629                          *      two sections of the same
 630                          *      name1/name2, the duplicate
 631                          *      section is just silently
 632                          *      ignored.
 633                          */
 634                         rbtree_insert(name1_cs->name2_tree, cs_new);
 635                         break;
 636                 } /* was a section */
 637
 638                 case CONF_ITEM_DATA:
 639                         if (!cs->data_tree) {
 640                                 cs->data_tree = rbtree_create(cs, data_cmp, NULL, 0);
 641                         }
 642                         if (cs->data_tree) {
 643                                 rbtree_insert(cs->data_tree, ci);
 644                         }
 645                         break;
 646
 647                 default: /* FIXME: assert & error! */
 648                         break;
 649
 650                 } /* switch over conf types */
 651         } /* loop over ci */
 652 }
 653
 654
 655 CONF_ITEM *cf_reference_item(CONF_SECTION const *parentcs,
 656                              CONF_SECTION *outercs,
 657                              char const *ptr)
 658 {
 659         CONF_PAIR *cp;
 660         CONF_SECTION *next;
 661         CONF_SECTION const *cs = outercs;
 662         char name[8192];
 663         char *p;
 664
 665         if (!cs) goto no_such_item;
 666
 667         strlcpy(name, ptr, sizeof(name));
 668         p = name;
 669
 670         /*
 671          *      ".foo" means "foo from the current section"
 672          */
 673         if (*p == '.') {
 674                 p++;
 675
 676                 /*
 677                  *      Just '.' means the current section
 678                  */
 679                 if (*p == '\0') {
 680                         return cf_section_to_item(cs);
 681                 }
 682
 683                 /*
 684                  *      ..foo means "foo from the section
 685                  *      enclosing this section" (etc.)
 686                  */
 687                 while (*p == '.') {
 688                         if (cs->item.parent) {
 689                                 cs = cs->item.parent;
 690                         }
 691
 692                         /*
 693                          *      .. means the section
 694                          *      enclosing this section
 695                          */
 696                         if (!*++p) {
 697                                 return cf_section_to_item(cs);
 698                         }
 699                 }
 700
 701                 /*
 702                  *      "foo.bar.baz" means "from the root"
 703                  */
 704         } else if (strchr(p, '.') != NULL) {
 705                 if (!parentcs) goto no_such_item;
 706
 707                 cs = parentcs;
 708         }
 709
 710         while (*p) {
 711                 char *q, *r;
 712
 713                 r = strchr(p, '[');
 714                 q = strchr(p, '.');
 715                 if (!r && !q) break;
 716
 717                 if (r && q > r) q = NULL;
 718                 if (q && q < r) r = NULL;
 719
 720                 /*
 721                  *      Split off name2.
 722                  */
 723                 if (r) {
 724                         q = strchr(r + 1, ']');
 725                         if (!q) return NULL; /* parse error */
 726
 727                         /*
 728                          *      Points to foo[bar]xx: parse error,
 729                          *      it should be foo[bar] or foo[bar].baz
 730                          */
 731                         if (q[1] && q[1] != '.') goto no_such_item;
 732
 733                         *r = '\0';
 734                         *q = '\0';
 735                         next = cf_section_sub_find_name2(cs, p, r + 1);
 736                         *r = '[';
 737                         *q = ']';
 738
 739                         /*
 740                          *      Points to a named instance of a section.
 741                          */
 742                         if (!q[1]) {
 743                                 if (!next) goto no_such_item;
 744                                 return &(next->item);
 745                         }
 746
 747                         q++;    /* ensure we skip the ']' and '.' */
 748
 749                 } else {
 750                         *q = '\0';
 751                         next = cf_section_sub_find(cs, p);
 752                         *q = '.';
 753                 }
 754
 755                 if (!next) break; /* it MAY be a pair in this section! */
 756
 757                 cs = next;
 758                 p = q + 1;
 759         }
 760
 761         if (!*p) goto no_such_item;
 762
 763  retry:
 764         /*
 765          *      Find it in the current referenced
 766          *      section.
 767          */
 768         cp = cf_pair_find(cs, p);
 769         if (cp) {
 770                 cp->parsed = true;      /* conf pairs which are referenced count as parsed */
 771                 return &(cp->item);
 772         }
 773
 774         next = cf_section_sub_find(cs, p);
 775         if (next) return &(next->item);
 776
 777         /*
 778          *      "foo" is "in the current section, OR in main".
 779          */
 780         if ((p == name) && (parentcs != NULL) && (cs != parentcs)) {
 781                 cs = parentcs;
 782                 goto retry;
 783         }
 784
 785 no_such_item:
 786         return NULL;
 787 }
 788
 789
 790 CONF_SECTION *cf_top_section(CONF_SECTION *cs)
 791 {
 792         if (!cs) return NULL;
 793
 794         while (cs->item.parent != NULL) {
 795                 cs = cs->item.parent;
 796         }
 797
 798         return cs;
 799 }
 800
 801
 802 /*
 803  *      Expand the variables in an input string.
 804  */
 805 static char const *cf_expand_variables(char const *cf, int *lineno,
 806                                        CONF_SECTION *outercs,
 807                                        char *output, size_t outsize,
 808                                        char const *input, bool *soft_fail)
 809 {
 810         char *p;
 811         char const *end, *ptr;
 812         CONF_SECTION const *parentcs;
 813         char name[8192];
 814
 815         if (soft_fail) *soft_fail = false;
 816
 817         /*
 818          *      Find the master parent conf section.
 819          *      We can't use main_config.config, because we're in the
 820          *      process of re-building it, and it isn't set up yet...
 821          */
 822         parentcs = cf_top_section(outercs);
 823
 824         p = output;
 825         ptr = input;
 826         while (*ptr) {
 827                 /*
 828                  *      Ignore anything other than "${"
 829                  */
 830                 if ((*ptr == '$') && (ptr[1] == '{')) {
 831                         CONF_ITEM *ci;
 832                         CONF_PAIR *cp;
 833                         char *q;
 834
 835                         /*
 836                          *      FIXME: Add support for ${foo:-bar},
 837                          *      like in xlat.c
 838                          */
 839
 840                         /*
 841                          *      Look for trailing '}', and log a
 842                          *      warning for anything that doesn't match,
 843                          *      and exit with a fatal error.
 844                          */
 845                         end = strchr(ptr, '}');
 846                         if (end == NULL) {
 847                                 *p = '\0';
 848                                 INFO("%s[%d]: Variable expansion missing }",
 849                                        cf, *lineno);
 850                                 return NULL;
 851                         }
 852
 853                         ptr += 2;
 854
 855                         /*
 856                          *      Can't really happen because input lines are
 857                          *      capped at 8k, which is sizeof(name)
 858                          */
 859                         if ((size_t) (end - ptr) >= sizeof(name)) {
 860                                 ERROR("%s[%d]: Reference string is too large",
 861                                       cf, *lineno);
 862                                 return NULL;
 863                         }
 864
 865                         memcpy(name, ptr, end - ptr);
 866                         name[end - ptr] = '\0';
 867
 868                         q = strchr(name, ':');
 869                         if (q) {
 870                                 *(q++) = '\0';
 871                         }
 872
 873                         ci = cf_reference_item(parentcs, outercs, name);
 874                         if (!ci) {
 875                                 if (soft_fail) *soft_fail = true;
 876                                 ERROR("%s[%d]: Reference \"%s\" not found", cf, *lineno, input);
 877                                 return NULL;
 878                         }
 879
 880                         /*
 881                          *      The expansion doesn't refer to another item or section
 882                          *      it's the property of a section.
 883                          */
 884                         if (q) {
 885                                 CONF_SECTION *mycs = cf_item_to_section(ci);
 886
 887                                 if (ci->type != CONF_ITEM_SECTION) {
 888                                         ERROR("%s[%d]: Can only reference properties of sections", cf, *lineno);
 889                                         return NULL;
 890                                 }
 891
 892                                 switch (fr_str2int(conf_property_name, q, CONF_PROPERTY_INVALID)) {
 893                                 case CONF_PROPERTY_NAME:
 894                                         strcpy(p, mycs->name1);
 895                                         break;
 896
 897                                 case CONF_PROPERTY_INSTANCE:
 898                                         strcpy(p, mycs->name2 ? mycs->name2 : mycs->name1);
 899                                         break;
 900
 901                                 default:
 902                                         ERROR("%s[%d]: Invalid property '%s'", cf, *lineno, q);
 903                                         return NULL;
 904                                 }
 905                                 p += strlen(p);
 906                                 ptr = end + 1;
 907
 908                         } else if (ci->type == CONF_ITEM_PAIR) {
 909                                 /*
 910                                  *  Substitute the value of the variable.
 911                                  */
 912                                 cp = cf_item_to_pair(ci);
 913
 914                                 /*
 915                                  *      If the thing we reference is
 916                                  *      marked up as being expanded in
 917                                  *      pass2, don't expand it now.
 918                                  *      Let it be expanded in pass2.
 919                                  */
 920                                 if (cp->pass2) {
 921                                         if (soft_fail) *soft_fail = true;
 922
 923                                         ERROR("%s[%d]: Reference \"%s\" points to a variable which has not been expanded.",
 924                                               cf, *lineno, input);
 925                                         return NULL;
 926                                 }
 927
 928                                 if (!cp->value) {
 929                                         ERROR("%s[%d]: Reference \"%s\" has no value",
 930                                                cf, *lineno, input);
 931                                         return NULL;
 932                                 }
 933
 934                                 if (p + strlen(cp->value) >= output + outsize) {
 935                                         ERROR("%s[%d]: Reference \"%s\" is too long",
 936                                                cf, *lineno, input);
 937                                         return NULL;
 938                                 }
 939
 940                                 strcpy(p, cp->value);
 941                                 p += strlen(p);
 942                                 ptr = end + 1;
 943
 944                         } else if (ci->type == CONF_ITEM_SECTION) {
 945                                 CONF_SECTION *subcs;
 946
 947                                 /*
 948                                  *      Adding an entry again to a
 949                                  *      section is wrong.  We don't
 950                                  *      want an infinite loop.
 951                                  */
 952                                 if (ci->parent == outercs) {
 953                                         ERROR("%s[%d]: Cannot reference different item in same section", cf, *lineno);
 954                                         return NULL;
 955                                 }
 956
 957                                 /*
 958                                  *      Copy the section instead of
 959                                  *      referencing it.
 960                                  */
 961                                 subcs = cf_item_to_section(ci);
 962                                 subcs = cf_section_dup(outercs, subcs,
 963                                                        cf_section_name1(subcs), cf_section_name2(subcs),
 964                                                        false);
 965                                 if (!subcs) {
 966                                         ERROR("%s[%d]: Failed copying reference %s", cf, *lineno, name);
 967                                         return NULL;
 968                                 }
 969
 970                                 subcs->item.filename = ci->filename;
 971                                 subcs->item.lineno = ci->lineno;
 972                                 cf_item_add(outercs, &(subcs->item));
 973
 974                                 ptr = end + 1;
 975
 976                         } else {
 977                                 ERROR("%s[%d]: Reference \"%s\" type is invalid", cf, *lineno, input);
 978                                 return NULL;
 979                         }
 980                 } else if (memcmp(ptr, "$ENV{", 5) == 0) {
 981                         char *env;
 982
 983                         ptr += 5;
 984
 985                         /*
 986                          *      Look for trailing '}', and log a
 987                          *      warning for anything that doesn't match,
 988                          *      and exit with a fatal error.
 989                          */
 990                         end = strchr(ptr, '}');
 991                         if (end == NULL) {
 992                                 *p = '\0';
 993                                 INFO("%s[%d]: Environment variable expansion missing }",
 994                                        cf, *lineno);
 995                                 return NULL;
 996                         }
 997
 998                         /*
 999                          *      Can't really happen because input lines are
1000                          *      capped at 8k, which is sizeof(name)
1001                          */
1002                         if ((size_t) (end - ptr) >= sizeof(name)) {
1003                                 ERROR("%s[%d]: Environment variable name is too large",
1004                                        cf, *lineno);
1005                                 return NULL;
1006                         }
1007
1008                         memcpy(name, ptr, end - ptr);
1009                         name[end - ptr] = '\0';
1010
1011                         /*
1012                          *      Get the environment variable.
1013                          *      If none exists, then make it an empty string.
1014                          */
1015                         env = getenv(name);
1016                         if (env == NULL) {
1017                                 *name = '\0';
1018                                 env = name;
1019                         }
1020
1021                         if (p + strlen(env) >= output + outsize) {
1022                                 ERROR("%s[%d]: Reference \"%s\" is too long",
1023                                        cf, *lineno, input);
1024                                 return NULL;
1025                         }
1026
1027                         strcpy(p, env);
1028                         p += strlen(p);
1029                         ptr = end + 1;
1030
1031                 } else {
1032                         /*
1033                          *      Copy it over verbatim.
1034                          */
1035                         *(p++) = *(ptr++);
1036                 }
1037
1038
1039                 if (p >= (output + outsize)) {
1040                         ERROR("%s[%d]: Reference \"%s\" is too long",
1041                                cf, *lineno, input);
1042                         return NULL;
1043                 }
1044         } /* loop over all of the input string. */
1045
1046         *p = '\0';
1047
1048         return output;
1049 }
1050
1051 static char const parse_spaces[] = "                                                                                                                                                                                                                                                                ";
1052
1053 /** Validation function for ipaddr conffile types
1054  *
1055  */
1056 static inline int fr_item_validate_ipaddr(CONF_SECTION *cs, char const *name, PW_TYPE type, char const *value,
1057                                           fr_ipaddr_t *ipaddr)
1058 {
1059         char ipbuf[128];
1060
1061         if (strcmp(value, "*") == 0) {
1062                 cf_log_info(cs, "%.*s\t%s = *", cs->depth, parse_spaces, name);
1063         } else if (strspn(value, ".0123456789abdefABCDEF:%[]/") == strlen(value)) {
1064                 cf_log_info(cs, "%.*s\t%s = %s", cs->depth, parse_spaces, name, value);
1065         } else {
1066                 cf_log_info(cs, "%.*s\t%s = %s IPv%s address [%s]", cs->depth, parse_spaces, name, value,
1067                             (ipaddr->af == AF_INET ? "4" : " 6"), ip_ntoh(ipaddr, ipbuf, sizeof(ipbuf)));
1068         }
1069
1070         switch (type) {
1071         case PW_TYPE_IPV4_ADDR:
1072         case PW_TYPE_IPV6_ADDR:
1073         case PW_TYPE_COMBO_IP_ADDR:
1074                 switch (ipaddr->af) {
1075                 case AF_INET:
1076                 if (ipaddr->prefix != 32) {
1077                         ERROR("Invalid IPv4 mask length \"/%i\".  Only \"/32\" permitted for non-prefix types",
1078                               ipaddr->prefix);
1079
1080                         return -1;
1081                 }
1082                         break;
1083
1084                 case AF_INET6:
1085                 if (ipaddr->prefix != 128) {
1086                         ERROR("Invalid IPv6 mask length \"/%i\".  Only \"/128\" permitted for non-prefix types",
1087                               ipaddr->prefix);
1088
1089                         return -1;
1090                 }
1091                         break;
1092
1093                 default:
1094                         return -1;
1095                 }
1096         default:
1097                 return 0;
1098         }
1099 }
1100
1101 /** Parses a #CONF_PAIR into a C data type, with a default value.
1102  *
1103  * Takes fields from a #CONF_PARSER struct and uses them to parse the string value
1104  * of a #CONF_PAIR into a C data type matching the type argument.
1105  *
1106  * The format of the types are the same as #value_data_t types.
1107  *
1108  * @note The dflt value will only be used if no matching #CONF_PAIR is found. Empty strings will not
1109  *       result in the dflt value being used.
1110  *
1111  * @param cs to search for matching #CONF_PAIR in.
1112  * @param name of #CONF_PAIR to search for.
1113  * @param type Data type to parse #CONF_PAIR value as.
1114  *      Should be one of the following ``data`` types, and one or more of the following ``flag`` types or'd together:
1115  *      - ``data`` #PW_TYPE_TMPL                - @copybrief PW_TYPE_TMPL
1116                                                   Feeds the value into #tmpl_afrom_str. Value can be
1117  *                                                obtained when processing requests, with #tmpl_expand or #tmpl_aexpand.
1118  *      - ``data`` #PW_TYPE_BOOLEAN             - @copybrief PW_TYPE_BOOLEAN
1119  *      - ``data`` #PW_TYPE_INTEGER             - @copybrief PW_TYPE_INTEGER
1120  *      - ``data`` #PW_TYPE_SHORT               - @copybrief PW_TYPE_SHORT
1121  *      - ``data`` #PW_TYPE_INTEGER64           - @copybrief PW_TYPE_INTEGER64
1122  *      - ``data`` #PW_TYPE_SIGNED              - @copybrief PW_TYPE_SIGNED
1123  *      - ``data`` #PW_TYPE_STRING              - @copybrief PW_TYPE_STRING
1124  *      - ``data`` #PW_TYPE_IPV4_ADDR           - @copybrief PW_TYPE_IPV4_ADDR (IPv4 address with prefix 32).
1125  *      - ``data`` #PW_TYPE_IPV4_PREFIX         - @copybrief PW_TYPE_IPV4_PREFIX (IPv4 address with variable prefix).
1126  *      - ``data`` #PW_TYPE_IPV6_ADDR           - @copybrief PW_TYPE_IPV6_ADDR (IPv6 address with prefix 128).
1127  *      - ``data`` #PW_TYPE_COMBO_IP_ADDR       - @copybrief PW_TYPE_COMBO_IP_ADDR (IPv4/IPv6 address with
1128                                                   prefix 32/128).
1129  *      - ``data`` #PW_TYPE_COMBO_IP_PREFIX     - @copybrief PW_TYPE_COMBO_IP_PREFIX (IPv4/IPv6 address with
1130  *                                                variable prefix).
1131  *      - ``data`` #PW_TYPE_TIMEVAL             - @copybrief PW_TYPE_TIMEVAL
1132  *      - ``flag`` #PW_TYPE_DEPRECATED          - @copybrief PW_TYPE_DEPRECATED
1133  *      - ``flag`` #PW_TYPE_REQUIRED            - @copybrief PW_TYPE_REQUIRED
1134  *      - ``flag`` #PW_TYPE_ATTRIBUTE           - @copybrief PW_TYPE_ATTRIBUTE
1135  *      - ``flag`` #PW_TYPE_SECRET              - @copybrief PW_TYPE_SECRET
1136  *      - ``flag`` #PW_TYPE_FILE_INPUT          - @copybrief PW_TYPE_FILE_INPUT
1137  *      - ``flag`` #PW_TYPE_NOT_EMPTY           - @copybrief PW_TYPE_NOT_EMPTY
1138  * @param data Pointer to a global variable, or pointer to a field in the struct being populated with values.
1139  * @param dflt value to use, if no #CONF_PAIR is found.
1140  * @return -1 on error, -2 if deprecated, 0 on success (correctly parsed), 1 if default value was used.
1141  */
1142 int cf_item_parse(CONF_SECTION *cs, char const *name, unsigned int type, void *data, char const *dflt)
1143 {
1144         int rcode;
1145         bool deprecated, required, attribute, secret, file_input, cant_be_empty, tmpl, xlat, multi;
1146         char **q;
1147         char const *value;
1148         CONF_PAIR *cp = NULL;
1149         fr_ipaddr_t *ipaddr;
1150         char buffer[8192];
1151
1152         if (!cs) return -1;
1153
1154         deprecated = (type & PW_TYPE_DEPRECATED);
1155         required = (type & PW_TYPE_REQUIRED);
1156         attribute = (type & PW_TYPE_ATTRIBUTE);
1157         secret = (type & PW_TYPE_SECRET);
1158         file_input = (type == PW_TYPE_FILE_INPUT);      /* check, not and */
1159         cant_be_empty = (type & PW_TYPE_NOT_EMPTY);
1160         tmpl = (type & PW_TYPE_TMPL);
1161         xlat = (type & PW_TYPE_XLAT);
1162         multi = (type & PW_TYPE_MULTI);
1163
1164         if (attribute) required = true;
1165         if (required) cant_be_empty = true;     /* May want to review this in the future... */
1166
1167         type &= 0xff;                           /* normal types are small */
1168         rcode = 0;
1169
1170         cp = cf_pair_find(cs, name);
1171
1172         /*
1173          *      No pairs match the configuration item name in the current
1174          *      section, use the default value.
1175          */
1176         if (!cp) {
1177                 rcode = 1;
1178                 value = dflt;
1179         /*
1180          *      Something matched, used the CONF_PAIR value.
1181          */
1182         } else {
1183                 CONF_PAIR *next = cp;
1184                 value = cp->value;
1185                 cp->parsed = true;
1186
1187                 /*
1188                  *      @fixme We should actually validate
1189                  *      the value of the pairs too
1190                  */
1191                 if (multi) while ((next = cf_pair_find_next(cs, next, name))) {
1192                         next->parsed = true;
1193                 }
1194         }
1195
1196         if (!value) {
1197                 if (required) {
1198                 is_required:
1199                         if (!cp) {
1200                                 cf_log_err(&(cs->item), "Configuration item '%s' must have a value", name);
1201                         } else {
1202                                 cf_log_err(&(cp->item), "Configuration item '%s' must have a value", name);
1203                         }
1204                         return -1;
1205                 }
1206                 return rcode;
1207         }
1208
1209         if ((value[0] == '\0') && cant_be_empty) {
1210         cant_be_empty:
1211                 if (!cp) {
1212                         cf_log_err(&(cs->item), "Configuration item '%s' must not be empty (zero length)", name);
1213                         if (!required) cf_log_err(&(cs->item), "Comment item to silence this message");
1214                 } else {
1215                         cf_log_err(&(cp->item), "Configuration item '%s' must not be empty (zero length)", name);
1216                         if (!required) cf_log_err(&(cp->item), "Comment item to silence this message");
1217                 }
1218                 return -1;
1219         }
1220
1221         if (deprecated) {
1222                 cf_log_err(&(cs->item), "Configuration item \"%s\" is deprecated", name);
1223
1224                 return -2;
1225         }
1226
1227         /*
1228          *      Process a value as a template.
1229          */
1230         if (tmpl) {
1231                 ssize_t slen;
1232                 vp_tmpl_t *vpt;
1233
1234                 if (!value) {
1235                         *(vp_tmpl_t **)data = NULL;
1236                         return 0;
1237                 }
1238
1239                 slen = tmpl_afrom_str(cs, &vpt, value, strlen(value),
1240                                       cp ? cf_pair_value_type(cp) : T_DOUBLE_QUOTED_STRING,
1241                                       REQUEST_CURRENT, PAIR_LIST_REQUEST, true);
1242                 if (slen < 0) {
1243                         char *spaces, *text;
1244
1245                         fr_canonicalize_error(cs, &spaces, &text, slen, fr_strerror());
1246
1247                         cf_log_err_cs(cs, "Failed parsing configuration item '%s'", name);
1248                         cf_log_err_cs(cs, "%s", value);
1249                         cf_log_err_cs(cs, "%s^ %s", spaces, text);
1250
1251                         talloc_free(spaces);
1252                         talloc_free(text);
1253
1254                         return -1;
1255                 }
1256
1257                 /*
1258                  *      Sanity check
1259                  *
1260                  *      Don't add default - update with new types.
1261                  */
1262                 switch (vpt->type) {
1263                 case TMPL_TYPE_LITERAL:
1264                 case TMPL_TYPE_ATTR:
1265                 case TMPL_TYPE_ATTR_UNDEFINED:
1266                 case TMPL_TYPE_LIST:
1267                 case TMPL_TYPE_DATA:
1268                 case TMPL_TYPE_EXEC:
1269                 case TMPL_TYPE_XLAT:
1270                 case TMPL_TYPE_XLAT_STRUCT:
1271                         break;
1272
1273                 case TMPL_TYPE_UNKNOWN:
1274                 case TMPL_TYPE_REGEX:
1275                 case TMPL_TYPE_REGEX_STRUCT:
1276                 case TMPL_TYPE_NULL:
1277                         rad_assert(0);
1278                 }
1279
1280                 /*
1281                  *      If the attribute flag is set, the template must be an
1282                  *      attribute reference.
1283                  */
1284                 if (attribute && (vpt->type != TMPL_TYPE_ATTR)) {
1285                         cf_log_err(&(cs->item), "Configuration item '%s' must be an attr "
1286                                    "but is an %s", name, fr_int2str(tmpl_names, vpt->type, "<INVALID>"));
1287                         talloc_free(vpt);
1288                         return -1;
1289                 }
1290
1291                 /*
1292                  *      If the xlat flag is set, the template must be an xlat
1293                  */
1294                 if (xlat && (vpt->type != TMPL_TYPE_XLAT_STRUCT)) {
1295                         cf_log_err(&(cs->item), "Configuration item '%s' must be an xlat expansion but is an %s",
1296                                    name, fr_int2str(tmpl_names, vpt->type, "<INVALID>"));
1297                         talloc_free(vpt);
1298                         return -1;
1299                 }
1300
1301                 /*
1302                  *      If we have a type, and the template is an attribute reference
1303                  *      check that the attribute reference matches the type.
1304                  */
1305                 if ((type > 0) && (vpt->type == TMPL_TYPE_ATTR) && (vpt->tmpl_da->type != type)) {
1306                         cf_log_err(&(cs->item), "Configuration item '%s' attr must be an %s, but is an %s",
1307                                    name, fr_int2str(dict_attr_types, type, "<INVALID>"),
1308                                    fr_int2str(dict_attr_types, vpt->tmpl_da->type, "<INVALID>"));
1309                         talloc_free(vpt);
1310                         return -1;
1311                 }
1312                 *(vp_tmpl_t **)data = vpt;
1313
1314                 return 0;
1315         }
1316
1317         switch (type) {
1318         case PW_TYPE_BOOLEAN:
1319                 /*
1320                  *      Allow yes/no, true/false, and on/off
1321                  */
1322                 if ((strcasecmp(value, "yes") == 0) ||
1323                     (strcasecmp(value, "true") == 0) ||
1324                     (strcasecmp(value, "on") == 0)) {
1325                         *(bool *)data = true;
1326                 } else if ((strcasecmp(value, "no") == 0) ||
1327                            (strcasecmp(value, "false") == 0) ||
1328                            (strcasecmp(value, "off") == 0)) {
1329                         *(bool *)data = false;
1330                 } else {
1331                         *(bool *)data = false;
1332                         cf_log_err(&(cs->item), "Invalid value \"%s\" for boolean "
1333                                "variable %s", value, name);
1334                         return -1;
1335                 }
1336                 cf_log_info(cs, "%.*s\t%s = %s",
1337                             cs->depth, parse_spaces, name, value);
1338                 break;
1339
1340         case PW_TYPE_INTEGER:
1341         {
1342                 unsigned long v = strtoul(value, 0, 0);
1343
1344                 /*
1345                  *      Restrict integer values to 0-INT32_MAX, this means
1346                  *      it will always be safe to cast them to a signed type
1347                  *      for comparisons, and imposes the same range limit as
1348                  *      before we switched to using an unsigned type to
1349                  *      represent config item integers.
1350                  */
1351                 if (v > INT32_MAX) {
1352                         cf_log_err(&(cs->item), "Invalid value \"%s\" for variable %s, must be between 0-%u", value,
1353                                    name, INT32_MAX);
1354                         return -1;
1355                 }
1356
1357                 *(uint32_t *)data = v;
1358                 cf_log_info(cs, "%.*s\t%s = %u", cs->depth, parse_spaces, name, *(uint32_t *)data);
1359         }
1360                 break;
1361
1362         case PW_TYPE_SHORT:
1363         {
1364                 unsigned long v = strtoul(value, 0, 0);
1365
1366                 if (v > UINT16_MAX) {
1367                         cf_log_err(&(cs->item), "Invalid value \"%s\" for variable %s, must be between 0-%u", value,
1368                                    name, UINT16_MAX);
1369                         return -1;
1370                 }
1371                 *(uint16_t *)data = (uint16_t) v;
1372                 cf_log_info(cs, "%.*s\t%s = %u", cs->depth, parse_spaces, name, *(uint16_t *)data);
1373         }
1374                 break;
1375
1376         case PW_TYPE_INTEGER64:
1377                 *(uint64_t *)data = strtoull(value, 0, 0);
1378                 cf_log_info(cs, "%.*s\t%s = %" PRIu64, cs->depth, parse_spaces, name, *(uint64_t *)data);
1379                 break;
1380
1381         case PW_TYPE_SIGNED:
1382                 *(int32_t *)data = strtol(value, 0, 0);
1383                 cf_log_info(cs, "%.*s\t%s = %d", cs->depth, parse_spaces, name, *(int32_t *)data);
1384                 break;
1385
1386         case PW_TYPE_STRING:
1387                 q = (char **) data;
1388                 if (*q != NULL) {
1389                         talloc_free(*q);
1390                 }
1391
1392                 /*
1393                  *      Expand variables which haven't already been
1394                  *      expanded automagically when the configuration
1395                  *      file was read.
1396                  */
1397                 if (value == dflt) {
1398                         int lineno = 0;
1399
1400                         lineno = cs->item.lineno;
1401
1402                         value = cf_expand_variables("<internal>",
1403                                                     &lineno,
1404                                                     cs, buffer, sizeof(buffer),
1405                                                     value, NULL);
1406                         if (!value) {
1407                                 cf_log_err(&(cs->item),"Failed expanding variable %s", name);
1408                                 return -1;
1409                         }
1410                 }
1411
1412                 if (required && !value) goto is_required;
1413                 if (cant_be_empty && (value[0] == '\0')) goto cant_be_empty;
1414
1415                 if (attribute) {
1416                         if (!dict_attrbyname(value)) {
1417                                 if (!cp) {
1418                                         cf_log_err(&(cs->item), "No such attribute '%s' for configuration '%s'",
1419                                                    value, name);
1420                                 } else {
1421                                         cf_log_err(&(cp->item), "No such attribute '%s'", value);
1422                                 }
1423                                 return -1;
1424                         }
1425                 }
1426
1427                 /*
1428                  *      Hide secrets when using "radiusd -X".
1429                  */
1430                 if (secret && (rad_debug_lvl <= 2)) {
1431                         cf_log_info(cs, "%.*s\t%s = <<< secret >>>",
1432                                     cs->depth, parse_spaces, name);
1433                 } else {
1434                         cf_log_info(cs, "%.*s\t%s = \"%s\"",
1435                                     cs->depth, parse_spaces, name, value ? value : "(null)");
1436                 }
1437                 *q = value ? talloc_typed_strdup(cs, value) : NULL;
1438
1439                 /*
1440                  *      If there's data AND it's an input file, check
1441                  *      that we can read it.  This check allows errors
1442                  *      to be caught as early as possible, during
1443                  *      server startup.
1444                  */
1445                 if (*q && file_input) {
1446                         struct stat buf;
1447
1448                         if (stat(*q, &buf) < 0) {
1449                                 char user[255], group[255];
1450
1451                                 ERROR("Unable to open file \"%s\": %s", value, fr_syserror(errno));
1452                                 ERROR("Our effective user and group was %s:%s",
1453                                       (rad_prints_uid(NULL, user, sizeof(user), geteuid()) < 0) ?
1454                                       "unknown" : user,
1455                                       (rad_prints_gid(NULL, group, sizeof(group), getegid()) < 0) ?
1456                                       "unknown" : group );
1457
1458                                 return -1;
1459                         }
1460                 }
1461                 break;
1462
1463         case PW_TYPE_IPV4_ADDR:
1464         case PW_TYPE_IPV4_PREFIX:
1465                 ipaddr = data;
1466
1467                 if (fr_pton4(ipaddr, value, -1, true, false) < 0) {
1468                         ERROR("%s", fr_strerror());
1469                         return -1;
1470                 }
1471                 if (fr_item_validate_ipaddr(cs, name, type, value, ipaddr) < 0) return -1;
1472                 break;
1473
1474         case PW_TYPE_IPV6_ADDR:
1475         case PW_TYPE_IPV6_PREFIX:
1476                 ipaddr = data;
1477
1478                 if (fr_pton6(ipaddr, value, -1, true, false) < 0) {
1479                         ERROR("%s", fr_strerror());
1480                         return -1;
1481                 }
1482                 if (fr_item_validate_ipaddr(cs, name, type, value, ipaddr) < 0) return -1;
1483                 break;
1484
1485         case PW_TYPE_COMBO_IP_ADDR:
1486         case PW_TYPE_COMBO_IP_PREFIX:
1487                 ipaddr = data;
1488
1489                 if (fr_pton(ipaddr, value, -1, true) < 0) {
1490                         ERROR("%s", fr_strerror());
1491                         return -1;
1492                 }
1493                 if (fr_item_validate_ipaddr(cs, name, type, value, ipaddr) < 0) return -1;
1494                 break;
1495
1496         case PW_TYPE_TIMEVAL: {
1497                 int sec;
1498                 char *end;
1499                 struct timeval tv;
1500
1501                 sec = strtoul(value, &end, 10);
1502                 tv.tv_sec = sec;
1503                 tv.tv_usec = 0;
1504                 if (*end == '.') {
1505                         size_t len;
1506
1507                         len = strlen(end + 1);
1508
1509                         if (len > 6) {
1510                                 ERROR("Too much precision for timeval");
1511                                 return -1;
1512                         }
1513
1514                         /*
1515                          *      If they write "0.1", that means
1516                          *      "10000" microseconds.
1517                          */
1518                         sec = strtoul(end + 1, NULL, 10);
1519                         while (len < 6) {
1520                                 sec *= 10;
1521                                 len++;
1522                         }
1523
1524                         tv.tv_usec = sec;
1525                 }
1526                 cf_log_info(cs, "%.*s\t%s = %d.%06d",
1527                             cs->depth, parse_spaces, name, (int) tv.tv_sec, (int) tv.tv_usec);
1528                 memcpy(data, &tv, sizeof(tv));
1529                 }
1530                 break;
1531
1532         default:
1533                 /*
1534                  *      If we get here, it's a sanity check error.
1535                  *      It's not an error parsing the configuration
1536                  *      file.
1537                  */
1538                 rad_assert(type > PW_TYPE_INVALID);
1539                 rad_assert(type < PW_TYPE_MAX);
1540
1541                 ERROR("type '%s' is not supported in the configuration files",
1542                        fr_int2str(dict_attr_types, type, "?Unknown?"));
1543                 return -1;
1544         } /* switch over variable type */
1545
1546         if (!cp) {
1547                 CONF_PAIR *cpn;
1548
1549                 cpn = cf_pair_alloc(cs, name, value, T_OP_SET, T_BARE_WORD, T_BARE_WORD);
1550                 if (!cpn) return -1;
1551                 cpn->parsed = true;
1552                 cpn->item.filename = "<internal>";
1553                 cpn->item.lineno = 0;
1554                 cf_item_add(cs, &(cpn->item));
1555         }
1556
1557         return rcode;
1558 }
1559
1560
1561 /*
1562  *      A copy of cf_section_parse that initializes pointers before
1563  *      parsing them.
1564  */
1565 static void cf_section_parse_init(CONF_SECTION *cs, void *base,
1566                                   CONF_PARSER const *variables)
1567 {
1568         int i;
1569
1570         for (i = 0; variables[i].name != NULL; i++) {
1571                 if (variables[i].type == PW_TYPE_SUBSECTION) {
1572                         CONF_SECTION *subcs;
1573
1574                         if (!variables[i].dflt) continue;
1575
1576                         subcs = cf_section_sub_find(cs, variables[i].name);
1577
1578                         /*
1579                          *      If there's no subsection in the
1580                          *      config, BUT the CONF_PARSER wants one,
1581                          *      then create an empty one.  This is so
1582                          *      that we can track the strings,
1583                          *      etc. allocated in the subsection.
1584                          */
1585                         if (!subcs) {
1586                                 subcs = cf_section_alloc(cs, variables[i].name, NULL);
1587                                 if (!subcs) return;
1588
1589                                 subcs->item.filename = cs->item.filename;
1590                                 subcs->item.lineno = cs->item.lineno;
1591                                 cf_item_add(cs, &(subcs->item));
1592                         }
1593
1594                         cf_section_parse_init(subcs, (uint8_t *)base + variables[i].offset,
1595                                               (CONF_PARSER const *) variables[i].dflt);
1596                         continue;
1597                 }
1598
1599                 if ((variables[i].type != PW_TYPE_STRING) &&
1600                     (variables[i].type != PW_TYPE_FILE_INPUT) &&
1601                     (variables[i].type != PW_TYPE_FILE_OUTPUT)) {
1602                         continue;
1603                 }
1604
1605                 if (variables[i].data) {
1606                         *(char **) variables[i].data = NULL;
1607                 } else if (base) {
1608                         *(char **) (((char *)base) + variables[i].offset) = NULL;
1609                 } else {
1610                         continue;
1611                 }
1612         } /* for all variables in the configuration section */
1613 }
1614
1615
1616 static void cf_section_parse_warn(CONF_SECTION *cs)
1617 {
1618         CONF_ITEM *ci;
1619
1620         for (ci = cs->children; ci; ci = ci->next) {
1621                 /*
1622                  *      Don't recurse on sections. We can only safely
1623                  *      check conf pairs at the same level as the
1624                  *      section that was just parsed.
1625                  */
1626                 if (ci->type == CONF_ITEM_SECTION) continue;
1627                 if (ci->type == CONF_ITEM_PAIR) {
1628                         CONF_PAIR *cp;
1629
1630                         cp = cf_item_to_pair(ci);
1631                         if (cp->parsed) continue;
1632
1633                         WARN("%s[%d]: The item '%s' is defined, but is unused by the configuration",
1634                              cp->item.filename ? cp->item.filename : "unknown",
1635                              cp->item.lineno ? cp->item.lineno : 0,
1636                                 cp->attr);
1637                 }
1638
1639                 /*
1640                  *      Skip everything else.
1641                  */
1642         }
1643 }
1644
1645 /*
1646  *      Parse a configuration section into user-supplied variables.
1647  */
1648 int cf_section_parse(CONF_SECTION *cs, void *base,
1649                      CONF_PARSER const *variables)
1650 {
1651         int ret;
1652         int i;
1653         void *data;
1654
1655         cs->variables = variables; /* this doesn't hurt anything */
1656
1657         if (!cs->name2) {
1658                 cf_log_info(cs, "%.*s%s {", cs->depth, parse_spaces,
1659                        cs->name1);
1660         } else {
1661                 cf_log_info(cs, "%.*s%s %s {", cs->depth, parse_spaces,
1662                        cs->name1, cs->name2);
1663         }
1664
1665         cf_section_parse_init(cs, base, variables);
1666
1667         /*
1668          *      Handle the known configuration parameters.
1669          */
1670         for (i = 0; variables[i].name != NULL; i++) {
1671                 /*
1672                  *      Handle subsections specially
1673                  */
1674                 if (variables[i].type == PW_TYPE_SUBSECTION) {
1675                         CONF_SECTION *subcs;
1676
1677                         subcs = cf_section_sub_find(cs, variables[i].name);
1678                         /*
1679                          *      Default in this case is overloaded to mean a pointer
1680                          *      to the CONF_PARSER struct for the subsection.
1681                          */
1682                         if (!variables[i].dflt || !subcs) {
1683                                 ERROR("Internal sanity check 1 failed in cf_section_parse %s", variables[i].name);
1684                                 goto error;
1685                         }
1686
1687                         if (cf_section_parse(subcs, (uint8_t *)base + variables[i].offset,
1688                                              (CONF_PARSER const *) variables[i].dflt) < 0) goto error;
1689                         continue;
1690                 } /* else it's a CONF_PAIR */
1691
1692                 if (variables[i].data) {
1693                         data = variables[i].data; /* prefer this. */
1694                 } else if (base) {
1695                         data = ((char *)base) + variables[i].offset;
1696                 } else {
1697                         DEBUG2("Internal sanity check 2 failed in cf_section_parse");
1698                         goto error;
1699                 }
1700
1701                 /*
1702                  *      Parse the pair we found, or a default value.
1703                  */
1704                 ret = cf_item_parse(cs, variables[i].name, variables[i].type, data, variables[i].dflt);
1705                 if (ret < 0) {
1706                         /*
1707                          *      Be nice, and print the name of the new config item.
1708                          */
1709                         if ((ret == -2) && (variables[i + 1].offset == variables[i].offset) &&
1710                             (variables[i + 1].data == variables[i].data)) {
1711                                 cf_log_err(&(cs->item), "Replace \"%s\" with \"%s\"", variables[i].name,
1712                                            variables[i + 1].name);
1713                         }
1714
1715                         goto error;
1716                 }
1717         } /* for all variables in the configuration section */
1718
1719         /*
1720          *      Warn about items in the configuration which weren't
1721          *      checked during parsing.
1722          */
1723         if (rad_debug_lvl >= 3) cf_section_parse_warn(cs);
1724
1725         cf_log_info(cs, "%.*s}", cs->depth, parse_spaces);
1726
1727         cs->base = base;
1728
1729         return 0;
1730
1731  error:
1732         cf_log_info(cs, "%.*s}", cs->depth, parse_spaces);
1733         return -1;
1734 }
1735
1736
1737 /*
1738  *      Check XLAT things in pass 2.  But don't cache the xlat stuff anywhere.
1739  */
1740 int cf_section_parse_pass2(CONF_SECTION *cs, void *base, CONF_PARSER const *variables)
1741 {
1742         int i;
1743         ssize_t slen;
1744         char const *error;
1745         char *value = NULL;
1746         xlat_exp_t *xlat;
1747
1748         /*
1749          *      Handle the known configuration parameters.
1750          */
1751         for (i = 0; variables[i].name != NULL; i++) {
1752                 CONF_PAIR *cp;
1753
1754                 /*
1755                  *      Handle subsections specially
1756                  */
1757                 if (variables[i].type == PW_TYPE_SUBSECTION) {
1758                         CONF_SECTION *subcs;
1759                         subcs = cf_section_sub_find(cs, variables[i].name);
1760
1761                         if (cf_section_parse_pass2(subcs, (uint8_t *)base + variables[i].offset,
1762                                                    (CONF_PARSER const *) variables[i].dflt) < 0) {
1763                                 return -1;
1764                         }
1765                         continue;
1766                 } /* else it's a CONF_PAIR */
1767
1768                 cp = cf_pair_find(cs, variables[i].name);
1769
1770         redo:
1771                 if (!cp || !cp->value) continue;
1772
1773                 if ((cp->rhs_type != T_DOUBLE_QUOTED_STRING) &&
1774                     (cp->rhs_type != T_BARE_WORD)) continue;
1775
1776                 /*
1777                  *      Non-xlat expansions shouldn't have xlat!
1778                  */
1779                 if (((variables[i].type & PW_TYPE_XLAT) == 0) &&
1780                     ((variables[i].type & PW_TYPE_TMPL) == 0)) {
1781                         /*
1782                          *      Ignore %{... in shared secrets.
1783                          *      They're never dynamically expanded.
1784                          */
1785                         if ((variables[i].type & PW_TYPE_SECRET) != 0) continue;
1786
1787                         if (strstr(cp->value, "%{") != NULL) {
1788                                 WARN("%s[%d]: Found dynamic expansion in string which will not be dynamically expanded",
1789                                      cp->item.filename ? cp->item.filename : "unknown",
1790                                      cp->item.lineno ? cp->item.lineno : 0);
1791                         }
1792                         continue;
1793                 }
1794
1795                 /*
1796                  *      xlat expansions should be parseable.
1797                  */
1798                 value = talloc_strdup(cs, cp->value); /* modified by xlat_tokenize */
1799                 xlat = NULL;
1800
1801                 slen = xlat_tokenize(cs, value, &xlat, &error);
1802                 if (slen < 0) {
1803                         char *spaces, *text;
1804
1805                         fr_canonicalize_error(cs, &spaces, &text, slen, cp->value);
1806
1807                         cf_log_err(&cp->item, "Failed parsing expanded string:");
1808                         cf_log_err(&cp->item, "%s", text);
1809                         cf_log_err(&cp->item, "%s^ %s", spaces, error);
1810
1811                         talloc_free(spaces);
1812                         talloc_free(text);
1813                         talloc_free(value);
1814                         talloc_free(xlat);
1815                         return -1;
1816                 }
1817
1818                 talloc_free(value);
1819                 talloc_free(xlat);
1820
1821                 /*
1822                  *      If the "multi" flag is set, check all of them.
1823                  */
1824                 if ((variables[i].type & PW_TYPE_MULTI) != 0) {
1825                         cp = cf_pair_find_next(cs, cp, cp->attr);
1826                         goto redo;
1827                 }
1828         } /* for all variables in the configuration section */
1829
1830         return 0;
1831 }
1832
1833 /*
1834  *      Merge the template so everyting else "just works".
1835  */
1836 static bool cf_template_merge(CONF_SECTION *cs, CONF_SECTION const *template)
1837 {
1838         CONF_ITEM *ci;
1839
1840         if (!cs || !template) return true;
1841
1842         cs->template = NULL;
1843
1844         /*
1845          *      Walk over the template, adding its' entries to the
1846          *      current section.  But only if the entries don't
1847          *      already exist in the current section.
1848          */
1849         for (ci = template->children; ci; ci = ci->next) {
1850                 if (ci->type == CONF_ITEM_PAIR) {
1851                         CONF_PAIR *cp1, *cp2;
1852
1853                         /*
1854                          *      It exists, don't over-write it.
1855                          */
1856                         cp1 = cf_item_to_pair(ci);
1857                         if (cf_pair_find(cs, cp1->attr)) {
1858                                 continue;
1859                         }
1860
1861                         /*
1862                          *      Create a new pair with all of the data
1863                          *      of the old one.
1864                          */
1865                         cp2 = cf_pair_dup(cs, cp1);
1866                         if (!cp2) return false;
1867
1868                         cp2->item.filename = cp1->item.filename;
1869                         cp2->item.lineno = cp1->item.lineno;
1870
1871                         cf_item_add(cs, &(cp2->item));
1872                         continue;
1873                 }
1874
1875                 if (ci->type == CONF_ITEM_SECTION) {
1876                         CONF_SECTION *subcs1, *subcs2;
1877
1878                         subcs1 = cf_item_to_section(ci);
1879                         rad_assert(subcs1 != NULL);
1880
1881                         subcs2 = cf_section_sub_find_name2(cs, subcs1->name1, subcs1->name2);
1882                         if (subcs2) {
1883                                 /*
1884                                  *      sub-sections get merged.
1885                                  */
1886                                 if (!cf_template_merge(subcs2, subcs1)) {
1887                                         return false;
1888                                 }
1889                                 continue;
1890                         }
1891
1892                         /*
1893                          *      Our section doesn't have a matching
1894                          *      sub-section.  Copy it verbatim from
1895                          *      the template.
1896                          */
1897                         subcs2 = cf_section_dup(cs, subcs1,
1898                                                 cf_section_name1(subcs1), cf_section_name2(subcs1),
1899                                                 false);
1900                         if (!subcs2) return false;
1901
1902                         subcs2->item.filename = subcs1->item.filename;
1903                         subcs2->item.lineno = subcs1->item.lineno;
1904
1905                         cf_item_add(cs, &(subcs2->item));
1906                         continue;
1907                 }
1908
1909                 /* ignore everything else */
1910         }
1911
1912         return true;
1913 }
1914
1915 static char const *cf_local_file(char const *base, char const *filename,
1916                                  char *buffer, size_t bufsize)
1917 {
1918         size_t dirsize;
1919         char *p;
1920
1921         strlcpy(buffer, base, bufsize);
1922
1923         p = strrchr(buffer, FR_DIR_SEP);
1924         if (!p) return filename;
1925         if (p[1]) {             /* ./foo */
1926                 p[1] = '\0';
1927         }
1928
1929         dirsize = (p - buffer) + 1;
1930
1931         if ((dirsize + strlen(filename)) >= bufsize) {
1932                 return NULL;
1933         }
1934
1935         strlcpy(p + 1, filename, bufsize - dirsize);
1936
1937         return buffer;
1938 }
1939
1940
1941 /*
1942  *      Read a part of the config file.
1943  */
1944 static int cf_section_read(char const *filename, int *lineno, FILE *fp,
1945                            CONF_SECTION *current)
1946
1947 {
1948         CONF_SECTION *this, *css, *nextcs;
1949         CONF_PAIR *cpn;
1950         char const *ptr;
1951         char const *value;
1952         char buf[8192];
1953         char buf1[8192];
1954         char buf2[8192];
1955         char buf3[8192];
1956         char buf4[8192];
1957         FR_TOKEN t1 = T_INVALID, t2, t3;
1958         bool has_spaces = false;
1959         bool pass2;
1960         char *cbuf = buf;
1961         size_t len;
1962         fr_cond_t *cond = NULL;
1963
1964         this = current;         /* add items here */
1965
1966         /*
1967          *      Read, checking for line continuations ('\\' at EOL)
1968          */
1969         for (;;) {
1970                 int at_eof;
1971                 nextcs = NULL;
1972
1973                 /*
1974                  *      Get data, and remember if we are at EOF.
1975                  */
1976                 at_eof = (fgets(cbuf, sizeof(buf) - (cbuf - buf), fp) == NULL);
1977                 (*lineno)++;
1978
1979                 /*
1980                  *      We read the entire 8k worth of data: complain.
1981                  *      Note that we don't care if the last character
1982                  *      is \n: it's still forbidden.  This means that
1983                  *      the maximum allowed length of text is 8k-1, which
1984                  *      should be plenty.
1985                  */
1986                 len = strlen(cbuf);
1987                 if ((cbuf + len + 1) >= (buf + sizeof(buf))) {
1988                         ERROR("%s[%d]: Line too long",
1989                                filename, *lineno);
1990                         return -1;
1991                 }
1992
1993                 if (has_spaces) {
1994                         ptr = cbuf;
1995                         while (isspace((int) *ptr)) ptr++;
1996
1997                         if (ptr > cbuf) {
1998                                 memmove(cbuf, ptr, len - (ptr - cbuf));
1999                                 len -= (ptr - cbuf);
2000                         }
2001                 }
2002
2003                 /*
2004                  *      Not doing continuations: check for edge
2005                  *      conditions.
2006                  */
2007                 if (cbuf == buf) {
2008                         if (at_eof) break;
2009
2010                         ptr = buf;
2011                         while (*ptr && isspace((int) *ptr)) ptr++;
2012
2013                         if (!*ptr || (*ptr == '#')) continue;
2014
2015                 } else if (at_eof || (len == 0)) {
2016                         ERROR("%s[%d]: Continuation at EOF is illegal",
2017                                filename, *lineno);
2018                         return -1;
2019                 }
2020
2021                 /*
2022                  *      See if there's a continuation.
2023                  */
2024                 while ((len > 0) &&
2025                        ((cbuf[len - 1] == '\n') || (cbuf[len - 1] == '\r'))) {
2026                         len--;
2027                         cbuf[len] = '\0';
2028                 }
2029
2030                 if ((len > 0) && (cbuf[len - 1] == '\\')) {
2031                         /*
2032                          *      Check for "suppress spaces" magic.
2033                          */
2034                         if (!has_spaces && (len > 2) && (cbuf[len - 2] == '"')) {
2035                                 has_spaces = true;
2036                         }
2037
2038                         cbuf[len - 1] = '\0';
2039                         cbuf += len - 1;
2040                         continue;
2041                 }
2042
2043                 ptr = cbuf = buf;
2044                 has_spaces = false;
2045
2046         get_more:
2047                 pass2 = false;
2048
2049                 /*
2050                  *      The parser is getting to be evil.
2051                  */
2052                 while ((*ptr == ' ') || (*ptr == '\t')) ptr++;
2053
2054                 if (((ptr[0] == '%') && (ptr[1] == '{')) ||
2055                     (ptr[0] == '`')) {
2056                         int hack;
2057
2058                         if (ptr[0] == '%') {
2059                                 hack = rad_copy_variable(buf1, ptr);
2060                         } else {
2061                                 hack = rad_copy_string(buf1, ptr);
2062                         }
2063                         if (hack < 0) {
2064                                 ERROR("%s[%d]: Invalid expansion: %s",
2065                                        filename, *lineno, ptr);
2066                                 return -1;
2067                         }
2068
2069                         ptr += hack;
2070
2071                         t2 = gettoken(&ptr, buf2, sizeof(buf2), true);
2072                         switch (t2) {
2073                         case T_EOL:
2074                         case T_HASH:
2075                                 goto do_bare_word;
2076
2077                         default:
2078                                 ERROR("%s[%d]: Invalid expansion: %s",
2079                                        filename, *lineno, ptr);
2080                                 return -1;
2081                         }
2082                 } else {
2083                         t1 = gettoken(&ptr, buf1, sizeof(buf1), true);
2084                 }
2085
2086                 /*
2087                  *      The caller eats "name1 name2 {", and calls us
2088                  *      for the data inside of the section.  So if we
2089                  *      receive a closing brace, then it must mean the
2090                  *      end of the section.
2091                  */
2092                if (t1 == T_RCBRACE) {
2093                        if (this == current) {
2094                                ERROR("%s[%d]: Too many closing braces",
2095                                       filename, *lineno);
2096                                return -1;
2097                        }
2098
2099                        /*
2100                         *       Merge the template into the existing
2101                         *       section.  This uses more memory, but
2102                         *       means that templates now work with
2103                         *       sub-sections, etc.
2104                         */
2105                        if (!cf_template_merge(this, this->template)) {
2106                                return -1;
2107                        }
2108
2109                        this = this->item.parent;
2110                        goto check_for_more;
2111                }
2112
2113                if (t1 != T_BARE_WORD) goto skip_keywords;
2114
2115                 /*
2116                  *      Allow for $INCLUDE files
2117                  *
2118                  *      This *SHOULD* work for any level include.
2119                  *      I really really really hate this file.  -cparker
2120                  */
2121                if ((strcasecmp(buf1, "$INCLUDE") == 0) ||
2122                    (strcasecmp(buf1, "$-INCLUDE") == 0)) {
2123                         bool relative = true;
2124
2125                         t2 = getword(&ptr, buf2, sizeof(buf2), true);
2126                         if (t2 != T_EOL) {
2127                                ERROR("%s[%d]: Unexpected text after $INCLUDE",
2128                                      filename, *lineno);
2129                                return -1;
2130                         }
2131
2132                         if (buf2[0] == '$') relative = false;
2133
2134                         value = cf_expand_variables(filename, lineno, this, buf4, sizeof(buf4), buf2, NULL);
2135                         if (!value) return -1;
2136
2137                         if (!FR_DIR_IS_RELATIVE(value)) relative = false;
2138
2139                         if (relative) {
2140                                 value = cf_local_file(filename, value, buf3,
2141                                                       sizeof(buf3));
2142                                 if (!value) {
2143                                         ERROR("%s[%d]: Directories too deep.",
2144                                                filename, *lineno);
2145                                         return -1;
2146                                 }
2147                         }
2148
2149
2150 #ifdef HAVE_DIRENT_H
2151                         /*
2152                          *      $INCLUDE foo/
2153                          *
2154                          *      Include ALL non-"dot" files in the directory.
2155                          *      careful!
2156                          */
2157                         if (value[strlen(value) - 1] == '/') {
2158                                 DIR             *dir;
2159                                 struct dirent   *dp;
2160                                 struct stat stat_buf;
2161
2162                                 DEBUG2("including files in directory %s", value );
2163 #ifdef S_IWOTH
2164                                 /*
2165                                  *      Security checks.
2166                                  */
2167                                 if (stat(value, &stat_buf) < 0) {
2168                                         ERROR("%s[%d]: Failed reading directory %s: %s",
2169                                                filename, *lineno,
2170                                                value, fr_syserror(errno));
2171                                         return -1;
2172                                 }
2173
2174                                 if ((stat_buf.st_mode & S_IWOTH) != 0) {
2175                                         ERROR("%s[%d]: Directory %s is globally writable.  Refusing to start due to "
2176                                               "insecure configuration", filename, *lineno, value);
2177                                         return -1;
2178                                 }
2179 #endif
2180                                 dir = opendir(value);
2181                                 if (!dir) {
2182                                         ERROR("%s[%d]: Error reading directory %s: %s",
2183                                                filename, *lineno, value,
2184                                                fr_syserror(errno));
2185                                         return -1;
2186                                 }
2187
2188                                 /*
2189                                  *      Read the directory, ignoring "." files.
2190                                  */
2191                                 while ((dp = readdir(dir)) != NULL) {
2192                                         char const *p;
2193
2194                                         if (dp->d_name[0] == '.') continue;
2195
2196                                         /*
2197                                          *      Check for valid characters
2198                                          */
2199                                         for (p = dp->d_name; *p != '\0'; p++) {
2200                                                 if (isalpha((int)*p) ||
2201                                                     isdigit((int)*p) ||
2202                                                     (*p == '-') ||
2203                                                     (*p == '_') ||
2204                                                     (*p == '.')) continue;
2205                                                 break;
2206                                         }
2207                                         if (*p != '\0') continue;
2208
2209                                         snprintf(buf2, sizeof(buf2), "%s%s",
2210                                                  value, dp->d_name);
2211                                         if ((stat(buf2, &stat_buf) != 0) ||
2212                                             S_ISDIR(stat_buf.st_mode)) continue;
2213                                         /*
2214                                          *      Read the file into the current
2215                                          *      configuration section.
2216                                          */
2217                                         if (cf_file_include(this, buf2) < 0) {
2218                                                 closedir(dir);
2219                                                 return -1;
2220                                         }
2221                                 }
2222                                 closedir(dir);
2223                         }  else
2224 #endif
2225                         { /* it was a normal file */
2226                                 if (buf1[1] == '-') {
2227                                         struct stat statbuf;
2228
2229                                         if (stat(value, &statbuf) < 0) {
2230                                                 WARN("Not including file %s: %s", value, fr_syserror(errno));
2231                                                 continue;
2232                                         }
2233                                 }
2234
2235                                 if (cf_file_include(this, value) < 0) {
2236                                         return -1;
2237                                 }
2238                         }
2239                         continue;
2240                 } /* we were in an include */
2241
2242                if (strcasecmp(buf1, "$template") == 0) {
2243                        CONF_ITEM *ci;
2244                        CONF_SECTION *parentcs, *templatecs;
2245                        t2 = getword(&ptr, buf2, sizeof(buf2), true);
2246
2247                        if (t2 != T_EOL) {
2248                                ERROR("%s[%d]: Unexpected text after $TEMPLATE", filename, *lineno);
2249                                return -1;
2250                        }
2251
2252                        parentcs = cf_top_section(current);
2253
2254                        templatecs = cf_section_sub_find(parentcs, "templates");
2255                        if (!templatecs) {
2256                                 ERROR("%s[%d]: No \"templates\" section for reference \"%s\"", filename, *lineno, buf2);
2257                                 return -1;
2258                        }
2259
2260                        ci = cf_reference_item(parentcs, templatecs, buf2);
2261                        if (!ci || (ci->type != CONF_ITEM_SECTION)) {
2262                                 ERROR("%s[%d]: Reference \"%s\" not found", filename, *lineno, buf2);
2263                                 return -1;
2264                        }
2265
2266                        if (!this) {
2267                                 ERROR("%s[%d]: Internal sanity check error in template reference", filename, *lineno);
2268                                 return -1;
2269                        }
2270
2271                        if (this->template) {
2272                                 ERROR("%s[%d]: Section already has a template", filename, *lineno);
2273                                 return -1;
2274                        }
2275
2276                        this->template = cf_item_to_section(ci);
2277                        continue;
2278                }
2279
2280                 /*
2281                  *      Ensure that the user can't add CONF_PAIRs
2282                  *      with 'internal' names;
2283                  */
2284                 if (buf1[0] == '_') {
2285                         ERROR("%s[%d]: Illegal configuration pair name \"%s\"", filename, *lineno, buf1);
2286                         return -1;
2287                 }
2288
2289                 /*
2290                  *      Handle if/elsif specially.
2291                  */
2292                 if ((strcmp(buf1, "if") == 0) || (strcmp(buf1, "elsif") == 0)) {
2293                         ssize_t slen;
2294                         char const *error = NULL;
2295                         char *p;
2296                         CONF_SECTION *server;
2297
2298                         /*
2299                          *      if / elsif MUST be inside of a
2300                          *      processing section, which MUST in turn
2301                          *      be inside of a "server" directive.
2302                          */
2303                         if (!this->item.parent) {
2304                         invalid_location:
2305                                 ERROR("%s[%d]: Invalid location for '%s'",
2306                                        filename, *lineno, buf1);
2307                                 return -1;
2308                         }
2309
2310                         /*
2311                          *      Can only have "if" in 3 named sections.
2312                          */
2313                         server = this->item.parent;
2314                         while ((strcmp(server->name1, "server") != 0) &&
2315                                (strcmp(server->name1, "policy") != 0) &&
2316                                (strcmp(server->name1, "instantiate") != 0)) {
2317                                 server = server->item.parent;
2318                                 if (!server) goto invalid_location;
2319                         }
2320
2321                         /*
2322                          *      Skip (...) to find the {
2323                          */
2324                         slen = fr_condition_tokenize(nextcs, cf_section_to_item(nextcs), ptr, &cond,
2325                                                      &error, FR_COND_TWO_PASS);
2326                         memcpy(&p, &ptr, sizeof(p));
2327
2328                         if (slen < 0) {
2329                                 if (p[-slen] != '{') goto cond_error;
2330                                 slen = -slen;
2331                         }
2332                         TALLOC_FREE(cond);
2333
2334                         /*
2335                          *      This hack is so that the NEXT stage
2336                          *      doesn't go "too far" in expanding the
2337                          *      variable.  We can parse the conditions
2338                          *      without expanding the ${...} stuff.
2339                          *      BUT we don't want to expand all of the
2340                          *      stuff AFTER the condition.  So we do
2341                          *      two passes.
2342                          *
2343                          *      The first pass is to discover the end
2344                          *      of the condition.  We then expand THAT
2345                          *      string, and do a second pass parsing
2346                          *      the expanded condition.
2347                          */
2348                         p += slen;
2349                         *p = '\0';
2350
2351                         /*
2352                          *      If there's a ${...}.  If so, expand it.
2353                          */
2354                         if (strchr(ptr, '$') != NULL) {
2355                                 ptr = cf_expand_variables(filename, lineno,
2356                                                           this,
2357                                                           buf3, sizeof(buf3),
2358                                                           ptr, NULL);
2359                                 if (!ptr) {
2360                                         ERROR("%s[%d]: Parse error expanding ${...} in condition",
2361                                               filename, *lineno);
2362                                         return -1;
2363                                 }
2364                         } /* else leave it alone */
2365
2366                         nextcs = cf_section_alloc(this, buf1, ptr);
2367                         if (!nextcs) {
2368                                 ERROR("%s[%d]: Failed allocating memory for section",
2369                                       filename, *lineno);
2370                                 return -1;
2371                         }
2372                         nextcs->item.filename = talloc_strdup(nextcs, filename);
2373                         nextcs->item.lineno = *lineno;
2374
2375                         slen = fr_condition_tokenize(nextcs, cf_section_to_item(nextcs), ptr, &cond,
2376                                                      &error, FR_COND_TWO_PASS);
2377                         *p = '{'; /* put it back */
2378
2379                 cond_error:
2380                         if (slen < 0) {
2381                                 char *spaces, *text;
2382
2383                                 fr_canonicalize_error(nextcs, &spaces, &text, slen, ptr);
2384
2385                                 ERROR("%s[%d]: Parse error in condition",
2386                                       filename, *lineno);
2387                                 ERROR("%s[%d]: %s", filename, *lineno, text);
2388                                 ERROR("%s[%d]: %s^ %s", filename, *lineno, spaces, error);
2389
2390                                 talloc_free(spaces);
2391                                 talloc_free(text);
2392                                 talloc_free(nextcs);
2393                                 return -1;
2394                         }
2395
2396                         if ((size_t) slen >= (sizeof(buf2) - 1)) {
2397                                 talloc_free(nextcs);
2398                                 ERROR("%s[%d]: Condition is too large after \"%s\"",
2399                                        filename, *lineno, buf1);
2400                                 return -1;
2401                         }
2402
2403                         /*
2404                          *      Copy the expanded and parsed condition
2405                          *      into buf2.  Then, parse the text after
2406                          *      the condition, which now MUST be a '{.
2407                          *
2408                          *      If it wasn't '{' it would have been
2409                          *      caught in the first pass of
2410                          *      conditional parsing, above.
2411                          */
2412                         memcpy(buf2, ptr, slen);
2413                         buf2[slen] = '\0';
2414                         ptr = p;
2415                         t2 = T_BARE_WORD;
2416
2417                         if ((t3 = gettoken(&ptr, buf3, sizeof(buf3), true)) != T_LCBRACE) {
2418                                 talloc_free(nextcs);
2419                                 ERROR("%s[%d]: Expected '{' %d",
2420                                       filename, *lineno, t3);
2421                                 return -1;
2422                         }
2423
2424                         /*
2425                          *      Swap the condition with trailing stuff for
2426                          *      the final condition.
2427                          */
2428                         memcpy(&p, &nextcs->name2, sizeof(nextcs->name2));
2429                         talloc_free(p);
2430                         nextcs->name2 = talloc_typed_strdup(nextcs, buf2);
2431
2432                         goto section_alloc;
2433                 }
2434
2435         skip_keywords:
2436                 /*
2437                  *      Grab the next token.
2438                  */
2439                 t2 = gettoken(&ptr, buf2, sizeof(buf2), !cf_new_escape);
2440                 switch (t2) {
2441                 case T_EOL:
2442                 case T_HASH:
2443                 case T_COMMA:
2444                 do_bare_word:
2445                         t3 = t2;
2446                         t2 = T_OP_EQ;
2447                         value = NULL;
2448                         goto do_set;
2449
2450                 case T_OP_INCRM:
2451                 case T_OP_ADD:
2452                 case T_OP_CMP_EQ:
2453                 case T_OP_SUB:
2454                 case T_OP_LE:
2455                 case T_OP_GE:
2456                 case T_OP_CMP_FALSE:
2457                         if (!this || (strcmp(this->name1, "update") != 0)) {
2458                                 ERROR("%s[%d]: Invalid operator in assignment",
2459                                        filename, *lineno);
2460                                 return -1;
2461                         }
2462                         /* FALL-THROUGH */
2463
2464                 case T_OP_EQ:
2465                 case T_OP_SET:
2466                         while (isspace((int) *ptr)) ptr++;
2467
2468                         /*
2469                          *      New parser: non-quoted strings are
2470                          *      bare words, and we parse everything
2471                          *      until the next newline, or the next
2472                          *      comma.  If they have { or } in a bare
2473                          *      word, well... too bad.
2474                          */
2475                         if (cf_new_escape && (*ptr != '"') && (*ptr != '\'')
2476                             && (*ptr != '`') && (*ptr != '/')) {
2477                                 const char *q = ptr;
2478
2479                                 t3 = T_BARE_WORD;
2480                                 while (*q && (*q >= ' ') && (*q != ',') &&
2481                                        !isspace(*q)) q++;
2482
2483                                 if ((size_t) (q - ptr) >= sizeof(buf3)) {
2484                                         ERROR("%s[%d]: Parse error: value too long",
2485                                               filename, *lineno);
2486                                         return -1;
2487                                 }
2488
2489                                 memcpy(buf3, ptr, (q - ptr));
2490                                 buf3[q - ptr] = '\0';
2491                                 ptr = q;
2492
2493                         } else {
2494                                 t3 = getstring(&ptr, buf3, sizeof(buf3), !cf_new_escape);
2495                         }
2496
2497                         if (t3 == T_INVALID) {
2498                                 ERROR("%s[%d]: Parse error: %s",
2499                                        filename, *lineno,
2500                                        fr_strerror());
2501                                 return -1;
2502                         }
2503
2504                         /*
2505                          *      Allow "foo" by itself, or "foo = bar"
2506                          */
2507                         switch (t3) {
2508                                 bool soft_fail;
2509
2510                         case T_BARE_WORD:
2511                         case T_DOUBLE_QUOTED_STRING:
2512                         case T_BACK_QUOTED_STRING:
2513                                 value = cf_expand_variables(filename, lineno, this, buf4, sizeof(buf4), buf3, &soft_fail);
2514                                 if (!value) {
2515                                         if (!soft_fail) return -1;
2516
2517                                         /*
2518                                          *      References an item which doesn't exist,
2519                                          *      or which is already marked up as being
2520                                          *      expanded in pass2.  Wait for pass2 to
2521                                          *      do the expansions.
2522                                          */
2523                                         pass2 = true;
2524                                         value = buf3;
2525                                 }
2526                                 break;
2527
2528                         case T_EOL:
2529                         case T_HASH:
2530                                 value = NULL;
2531                                 break;
2532
2533                         default:
2534                                 value = buf3;
2535                                 break;
2536                         }
2537
2538                         /*
2539                          *      Add this CONF_PAIR to our CONF_SECTION
2540                          */
2541                 do_set:
2542                         cpn = cf_pair_alloc(this, buf1, value, t2, t1, t3);
2543                         if (!cpn) return -1;
2544                         cpn->item.filename = talloc_strdup(cpn, filename);
2545                         cpn->item.lineno = *lineno;
2546                         cpn->pass2 = pass2;
2547                         cf_item_add(this, &(cpn->item));
2548
2549                         /*
2550                          *      Hacks for escaping
2551                          */
2552                         if (!cf_new_escape && !this->item.parent && value &&
2553                             (strcmp(buf1, "correct_escapes") == 0) &&
2554                             ((strcmp(value, "true") == 0) ||
2555                              (strcmp(value, "yes") == 0) ||
2556                              (strcmp(value, "1") == 0))) {
2557                                 cf_new_escape = true;
2558                         }
2559
2560                         /*
2561                          *      Require a comma, unless there's a comment.
2562                          */
2563                         while (isspace(*ptr)) ptr++;
2564
2565                         if (*ptr == ',') {
2566                                 ptr++;
2567                                 break;
2568                         }
2569
2570                         /*
2571                          *      module # stuff!
2572                          *      foo = bar # other stuff
2573                          */
2574                         if ((t3 == T_HASH) || (t3 == T_COMMA) || (t3 == T_EOL) || (*ptr == '#')) continue;
2575
2576                         if (!*ptr || (*ptr == '}')) break;
2577
2578                         ERROR("%s[%d]: Syntax error: Expected comma after '%s': %s",
2579                               filename, *lineno, value, ptr);
2580                         return -1;
2581
2582                         /*
2583                          *      No '=', must be a section or sub-section.
2584                          */
2585                 case T_BARE_WORD:
2586                 case T_DOUBLE_QUOTED_STRING:
2587                 case T_SINGLE_QUOTED_STRING:
2588                         t3 = gettoken(&ptr, buf3, sizeof(buf3), true);
2589                         if (t3 != T_LCBRACE) {
2590                                 ERROR("%s[%d]: Expecting section start brace '{' after \"%s %s\"",
2591                                        filename, *lineno, buf1, buf2);
2592                                 return -1;
2593                         }
2594                         /* FALL-THROUGH */
2595
2596                 case T_LCBRACE:
2597                 section_alloc:
2598                         if (!cond) {
2599                                 css = cf_section_alloc(this, buf1,
2600                                                        t2 == T_LCBRACE ? NULL : buf2);
2601                                 if (!css) {
2602                                         ERROR("%s[%d]: Failed allocating memory for section",
2603                                               filename, *lineno);
2604                                         return -1;
2605                                 }
2606
2607                                 css->item.filename = talloc_strdup(css, filename);
2608                                 css->item.lineno = *lineno;
2609                                 cf_item_add(this, &(css->item));
2610
2611                         } else {
2612                                 css = nextcs;
2613                                 nextcs = NULL;
2614
2615                                 cf_item_add(this, &(css->item));
2616                                 cf_data_add_internal(css, "if", cond, NULL, false);
2617                                 cond = NULL; /* eaten by the above line */
2618                         }
2619
2620                         /*
2621                          *      There may not be a name2
2622                          */
2623                         css->name2_type = (t2 == T_LCBRACE) ? T_INVALID : t2;
2624
2625                         /*
2626                          *      The current section is now the child section.
2627                          */
2628                         this = css;
2629                         break;
2630
2631                 case T_INVALID:
2632                         ERROR("%s[%d]: Syntax error in '%s': %s", filename, *lineno, ptr, fr_strerror());
2633
2634                         return -1;
2635
2636                 default:
2637                         ERROR("%s[%d]: Parse error after \"%s\": unexpected token \"%s\"",
2638                               filename, *lineno, buf1, fr_int2str(fr_tokens, t2, "<INVALID>"));
2639
2640                         return -1;
2641                 }
2642
2643         check_for_more:
2644                 /*
2645                  *      Done parsing one thing.  Skip to EOL if possible.
2646                  */
2647                 while (isspace(*ptr)) ptr++;
2648
2649                 if (*ptr == '#') continue;
2650
2651                 if (*ptr) {
2652                         goto get_more;
2653                 }
2654
2655         }
2656
2657         /*
2658          *      See if EOF was unexpected ..
2659          */
2660         if (feof(fp) && (this != current)) {
2661                 ERROR("%s[%d]: EOF reached without closing brace for section %s starting at line %d",
2662                       filename, *lineno, cf_section_name1(this), cf_section_lineno(this));
2663                 return -1;
2664         }
2665
2666         return 0;
2667 }
2668
2669 /*
2670  *      Include one config file in another.
2671  */
2672 int cf_file_include(CONF_SECTION *cs, char const *filename)
2673 {
2674         FILE            *fp;
2675         int             lineno = 0;
2676         struct stat     statbuf;
2677         time_t          *mtime;
2678         CONF_DATA       *cd;
2679
2680         DEBUG2("including configuration file %s", filename);
2681
2682         fp = fopen(filename, "r");
2683         if (!fp) {
2684                 ERROR("Unable to open file \"%s\": %s",
2685                        filename, fr_syserror(errno));
2686                 return -1;
2687         }
2688
2689         if (stat(filename, &statbuf) == 0) {
2690 #ifdef S_IWOTH
2691                 if ((statbuf.st_mode & S_IWOTH) != 0) {
2692                         fclose(fp);
2693                         ERROR("Configuration file %s is globally writable.  "
2694                               "Refusing to start due to insecure configuration.", filename);
2695                         return -1;
2696                 }
2697 #endif
2698
2699 #if 0 && defined(S_IROTH)
2700                 if (statbuf.st_mode & S_IROTH) != 0) {
2701                         fclose(fp);
2702                         ERROR("Configuration file %s is globally readable.  "
2703                               "Refusing to start due to insecure configuration", filename);
2704                         return -1;
2705                 }
2706 #endif
2707         }
2708
2709         if (cf_data_find_internal(cs, filename, PW_TYPE_FILE_INPUT)) {
2710                 fclose(fp);
2711                 ERROR("Cannot include the same file twice: \"%s\"", filename);
2712
2713                 return -1;
2714         }
2715
2716         /*
2717          *      Add the filename to the section
2718          */
2719         mtime = talloc(cs, time_t);
2720         *mtime = statbuf.st_mtime;
2721
2722         if (cf_data_add_internal(cs, filename, mtime, NULL, PW_TYPE_FILE_INPUT) < 0) {
2723                 fclose(fp);
2724                 ERROR("Internal error opening file \"%s\"",
2725                        filename);
2726                 return -1;
2727         }
2728
2729         cd = cf_data_find_internal(cs, filename, PW_TYPE_FILE_INPUT);
2730         if (!cd) {
2731                 fclose(fp);
2732                 ERROR("Internal error opening file \"%s\"",
2733                        filename);
2734                 return -1;
2735         }
2736
2737         if (!cs->item.filename) cs->item.filename = talloc_strdup(cs, filename);
2738
2739         /*
2740          *      Read the section.  It's OK to have EOF without a
2741          *      matching close brace.
2742          */
2743         if (cf_section_read(cd->name, &lineno, fp, cs) < 0) {
2744                 fclose(fp);
2745                 return -1;
2746         }
2747
2748         fclose(fp);
2749         return 0;
2750 }
2751
2752
2753 /*
2754  *      Do variable expansion in pass2.
2755  *
2756  *      This is a breadth-first expansion.  "deep
2757  */
2758 static int cf_section_pass2(CONF_SECTION *cs)
2759 {
2760         CONF_ITEM *ci;
2761
2762         for (ci = cs->children; ci; ci = ci->next) {
2763                 char const *value;
2764                 CONF_PAIR *cp;
2765                 char buffer[8192];
2766
2767                 if (ci->type != CONF_ITEM_PAIR) continue;
2768
2769                 cp = cf_item_to_pair(ci);
2770                 if (!cp->value || !cp->pass2) continue;
2771
2772                 rad_assert((cp->rhs_type == T_BARE_WORD) ||
2773                            (cp->rhs_type == T_DOUBLE_QUOTED_STRING) ||
2774                            (cp->rhs_type == T_BACK_QUOTED_STRING));
2775
2776                 value = cf_expand_variables(ci->filename, &ci->lineno, cs, buffer, sizeof(buffer), cp->value, NULL);
2777                 if (!value) return -1;
2778
2779                 rad_const_free(cp->value);
2780                 cp->value = talloc_typed_strdup(cp, value);
2781         }
2782
2783         for (ci = cs->children; ci; ci = ci->next) {
2784                 if (ci->type != CONF_ITEM_SECTION) continue;
2785
2786                 if (cf_section_pass2(cf_item_to_section(ci)) < 0) return -1;
2787         }
2788
2789         return 0;
2790 }
2791
2792
2793 /*
2794  *      Bootstrap a config file.
2795  */
2796 int cf_file_read(CONF_SECTION *cs, char const *filename)
2797 {
2798         char *p;
2799         CONF_PAIR *cp;
2800
2801         cp = cf_pair_alloc(cs, "confdir", filename, T_OP_SET, T_BARE_WORD, T_SINGLE_QUOTED_STRING);
2802         if (!cp) return -1;
2803
2804         p = strrchr(cp->value, FR_DIR_SEP);
2805         if (p) *p = '\0';
2806
2807         cp->item.filename = "internal";
2808         cp->item.lineno = -1;
2809         cf_item_add(cs, &(cp->item));
2810
2811         if (cf_file_include(cs, filename) < 0) return -1;
2812
2813         /*
2814          *      Now that we've read the file, go back through it and
2815          *      expand the variables.
2816          */
2817         if (cf_section_pass2(cs) < 0) {
2818                 talloc_free(cs);
2819                 return -1;
2820         }
2821
2822         return 0;
2823 }
2824
2825
2826 void cf_file_free(CONF_SECTION *cs)
2827 {
2828         talloc_free(cs);
2829 }
2830
2831
2832 /*
2833  * Return a CONF_PAIR within a CONF_SECTION.
2834  */
2835 CONF_PAIR *cf_pair_find(CONF_SECTION const *cs, char const *name)
2836 {
2837         CONF_PAIR *cp, mycp;
2838
2839         if (!cs || !name) return NULL;
2840
2841         mycp.attr = name;
2842         cp = rbtree_finddata(cs->pair_tree, &mycp);
2843         if (cp) return cp;
2844
2845         if (!cs->template) return NULL;
2846
2847         return rbtree_finddata(cs->template->pair_tree, &mycp);
2848 }
2849
2850 /*
2851  * Return the attr of a CONF_PAIR
2852  */
2853
2854 char const *cf_pair_attr(CONF_PAIR const *pair)
2855 {
2856         return (pair ? pair->attr : NULL);
2857 }
2858
2859 /*
2860  * Return the value of a CONF_PAIR
2861  */
2862
2863 char const *cf_pair_value(CONF_PAIR const *pair)
2864 {
2865         return (pair ? pair->value : NULL);
2866 }
2867
2868 FR_TOKEN cf_pair_operator(CONF_PAIR const *pair)
2869 {
2870         return (pair ? pair->op : T_INVALID);
2871 }
2872
2873 /** Return the value (lhs) type
2874  *
2875  * @param pair to extract value type from.
2876  * @return one of T_BARE_WORD, T_SINGLE_QUOTED_STRING, T_BACK_QUOTED_STRING
2877  *      T_DOUBLE_QUOTED_STRING or T_INVALID if the pair is NULL.
2878  */
2879 FR_TOKEN cf_pair_attr_type(CONF_PAIR const *pair)
2880 {
2881         return (pair ? pair->lhs_type : T_INVALID);
2882 }
2883
2884 /** Return the value (rhs) type
2885  *
2886  * @param pair to extract value type from.
2887  * @return one of T_BARE_WORD, T_SINGLE_QUOTED_STRING, T_BACK_QUOTED_STRING
2888  *      T_DOUBLE_QUOTED_STRING or T_INVALID if the pair is NULL.
2889  */
2890 FR_TOKEN cf_pair_value_type(CONF_PAIR const *pair)
2891 {
2892         return (pair ? pair->rhs_type : T_INVALID);
2893 }
2894
2895 /*
2896  * Turn a CONF_PAIR into a VALUE_PAIR
2897  * For now, ignore the "value_type" field...
2898  */
2899 VALUE_PAIR *cf_pairtovp(CONF_PAIR *pair)
2900 {
2901         if (!pair) {
2902                 fr_strerror_printf("Internal error");
2903                 return NULL;
2904         }
2905
2906         if (!pair->value) {
2907                 fr_strerror_printf("No value given for attribute %s", pair->attr);
2908                 return NULL;
2909         }
2910
2911         /*
2912          *      false comparisons never match.  BUT if it's a "string"
2913          *      or `string`, then remember to expand it later.
2914          */
2915         if ((pair->op != T_OP_CMP_FALSE) &&
2916             ((pair->rhs_type == T_DOUBLE_QUOTED_STRING) ||
2917              (pair->rhs_type == T_BACK_QUOTED_STRING))) {
2918                 VALUE_PAIR *vp;
2919
2920                 vp = pairmake(pair, NULL, pair->attr, NULL, pair->op);
2921                 if (!vp) {
2922                         return NULL;
2923                 }
2924
2925                 if (pairmark_xlat(vp, pair->value) < 0) {
2926                         talloc_free(vp);
2927
2928                         return NULL;
2929                 }
2930
2931                 return vp;
2932         }
2933
2934         return pairmake(pair, NULL, pair->attr, pair->value, pair->op);
2935 }
2936
2937 /*
2938  * Return the first label of a CONF_SECTION
2939  */
2940
2941 char const *cf_section_name1(CONF_SECTION const *cs)
2942 {
2943         return (cs ? cs->name1 : NULL);
2944 }
2945
2946 /*
2947  * Return the second label of a CONF_SECTION
2948  */
2949
2950 char const *cf_section_name2(CONF_SECTION const *cs)
2951 {
2952         return (cs ? cs->name2 : NULL);
2953 }
2954
2955 /** Return name2 if set, else name1
2956  *
2957  */
2958 char const *cf_section_name(CONF_SECTION const *cs)
2959 {
2960         char const *name;
2961
2962         name = cf_section_name2(cs);
2963         if (name) return name;
2964
2965         return cf_section_name1(cs);
2966 }
2967
2968 /*
2969  * Find a value in a CONF_SECTION
2970  */
2971 char const *cf_section_value_find(CONF_SECTION const *cs, char const *attr)
2972 {
2973         CONF_PAIR       *cp;
2974
2975         cp = cf_pair_find(cs, attr);
2976
2977         return (cp ? cp->value : NULL);
2978 }
2979
2980
2981 CONF_SECTION *cf_section_find_name2(CONF_SECTION const *cs,
2982                                     char const *name1, char const *name2)
2983 {
2984         char const      *their2;
2985         CONF_ITEM const *ci;
2986
2987         if (!cs || !name1) return NULL;
2988
2989         for (ci = &(cs->item); ci; ci = ci->next) {
2990                 if (ci->type != CONF_ITEM_SECTION)
2991                         continue;
2992
2993                 if (strcmp(cf_item_to_section(ci)->name1, name1) != 0) {
2994                         continue;
2995                 }
2996
2997                 their2 = cf_item_to_section(ci)->name2;
2998
2999                 if ((!name2 && !their2) ||
3000                     (name2 && their2 && (strcmp(name2, their2) == 0))) {
3001                         return cf_item_to_section(ci);
3002                 }
3003         }
3004
3005         return NULL;
3006 }
3007
3008 /** Find a pair with a name matching attr, after specified pair.
3009  *
3010  * @param cs to search in.
3011  * @param pair to search from (may be NULL).
3012  * @param attr to find (may be NULL in which case any attribute matches).
3013  * @return the next matching CONF_PAIR or NULL if none matched.
3014  */
3015 CONF_PAIR *cf_pair_find_next(CONF_SECTION const *cs,
3016                              CONF_PAIR const *pair, char const *attr)
3017 {
3018         CONF_ITEM       *ci;
3019
3020         if (!cs) return NULL;
3021
3022         /*
3023          *      If pair is NULL and we're trying to find a specific
3024          *      attribute this must be a first time run.
3025          *
3026          *      Find the pair with correct name.
3027          */
3028         if (!pair && attr) return cf_pair_find(cs, attr);
3029
3030         /*
3031          *      Start searching from the next child, or from the head
3032          *      of the list of children (if no pair was provided).
3033          */
3034         for (ci = pair ? pair->item.next : cs->children;
3035              ci;
3036              ci = ci->next) {
3037                 if (ci->type != CONF_ITEM_PAIR) continue;
3038
3039                 if (!attr || strcmp(cf_item_to_pair(ci)->attr, attr) == 0) break;
3040         }
3041
3042         return cf_item_to_pair(ci);
3043 }
3044
3045 /*
3046  * Find a CONF_SECTION, or return the root if name is NULL
3047  */
3048
3049 CONF_SECTION *cf_section_find(char const *name)
3050 {
3051         if (name)
3052                 return cf_section_sub_find(root_config, name);
3053         else
3054                 return root_config;
3055 }
3056
3057 /** Find a sub-section in a section
3058  *
3059  *      This finds ANY section having the same first name.
3060  *      The second name is ignored.
3061  */
3062 CONF_SECTION *cf_section_sub_find(CONF_SECTION const *cs, char const *name)
3063 {
3064         CONF_SECTION mycs;
3065
3066         if (!cs || !name) return NULL;  /* can't find an un-named section */
3067
3068         /*
3069          *      No sub-sections have been defined, so none exist.
3070          */
3071         if (!cs->section_tree) return NULL;
3072
3073         mycs.name1 = name;
3074         mycs.name2 = NULL;
3075         return rbtree_finddata(cs->section_tree, &mycs);
3076 }
3077
3078
3079 /** Find a CONF_SECTION with both names.
3080  *
3081  */
3082 CONF_SECTION *cf_section_sub_find_name2(CONF_SECTION const *cs,
3083                                         char const *name1, char const *name2)
3084 {
3085         CONF_ITEM    *ci;
3086
3087         if (!cs) cs = root_config;
3088         if (!cs) return NULL;
3089
3090         if (name1) {
3091                 CONF_SECTION mycs, *master_cs;
3092
3093                 if (!cs->section_tree) return NULL;
3094
3095                 mycs.name1 = name1;
3096                 mycs.name2 = name2;
3097
3098                 master_cs = rbtree_finddata(cs->section_tree, &mycs);
3099                 if (!master_cs) return NULL;
3100
3101                 /*
3102                  *      Look it up in the name2 tree.  If it's there,
3103                  *      return it.
3104                  */
3105                 if (master_cs->name2_tree) {
3106                         CONF_SECTION *subcs;
3107
3108                         subcs = rbtree_finddata(master_cs->name2_tree, &mycs);
3109                         if (subcs) return subcs;
3110                 }
3111
3112                 /*
3113                  *      We don't insert ourselves into the name2 tree.
3114                  *      So if there's nothing in the name2 tree, maybe
3115                  *      *we* are the answer.
3116                  */
3117                 if (!master_cs->name2 && name2) return NULL;
3118                 if (master_cs->name2 && !name2) return NULL;
3119                 if (!master_cs->name2 && !name2) return master_cs;
3120
3121                 if (strcmp(master_cs->name2, name2) == 0) {
3122                         return master_cs;
3123                 }
3124
3125                 return NULL;
3126         }
3127
3128         /*
3129          *      Else do it the old-fashioned way.
3130          */
3131         for (ci = cs->children; ci; ci = ci->next) {
3132                 CONF_SECTION *subcs;
3133
3134                 if (ci->type != CONF_ITEM_SECTION)
3135                         continue;
3136
3137                 subcs = cf_item_to_section(ci);
3138                 if (!subcs->name2) {
3139                         if (strcmp(subcs->name1, name2) == 0) break;
3140                 } else {
3141                         if (strcmp(subcs->name2, name2) == 0) break;
3142                 }
3143         }
3144
3145         return cf_item_to_section(ci);
3146 }
3147
3148 /*
3149  * Return the next subsection after a CONF_SECTION
3150  * with a certain name1 (char *name1). If the requested
3151  * name1 is NULL, any name1 matches.
3152  */
3153
3154 CONF_SECTION *cf_subsection_find_next(CONF_SECTION const *section,
3155                                       CONF_SECTION const *subsection,
3156                                       char const *name1)
3157 {
3158         CONF_ITEM       *ci;
3159
3160         if (!section) return NULL;
3161
3162         /*
3163          * If subsection is NULL this must be a first time run
3164          * Find the subsection with correct name
3165          */
3166
3167         if (!subsection) {
3168                 ci = section->children;
3169         } else {
3170                 ci = subsection->item.next;
3171         }
3172
3173         for (; ci; ci = ci->next) {
3174                 if (ci->type != CONF_ITEM_SECTION)
3175                         continue;
3176                 if ((name1 == NULL) ||
3177                     (strcmp(cf_item_to_section(ci)->name1, name1) == 0))
3178                         break;
3179         }
3180
3181         return cf_item_to_section(ci);
3182 }
3183
3184
3185 /*
3186  * Return the next section after a CONF_SECTION
3187  * with a certain name1 (char *name1). If the requested
3188  * name1 is NULL, any name1 matches.
3189  */
3190
3191 CONF_SECTION *cf_section_find_next(CONF_SECTION const *section,
3192                                    CONF_SECTION const *subsection,
3193                                    char const *name1)
3194 {
3195         if (!section) return NULL;
3196
3197         if (!section->item.parent) return NULL;
3198
3199         return cf_subsection_find_next(section->item.parent, subsection, name1);
3200 }
3201
3202 /** Return the next item after a CONF_ITEM.
3203  *
3204  */
3205 CONF_ITEM *cf_item_find_next(CONF_SECTION const *section, CONF_ITEM const *item)
3206 {
3207         if (!section) return NULL;
3208
3209         /*
3210          *      If item is NULL this must be a first time run
3211          *      Return the first item
3212          */
3213         if (item == NULL) {
3214                 return section->children;
3215         } else {
3216                 return item->next;
3217         }
3218 }
3219
3220 static void _pair_count(int *count, CONF_SECTION const *cs)
3221 {
3222         CONF_ITEM const *ci;
3223
3224         for (ci = cf_item_find_next(cs, NULL);
3225              ci != NULL;
3226              ci = cf_item_find_next(cs, ci)) {
3227
3228                 if (cf_item_is_section(ci)) {
3229                         _pair_count(count, cf_item_to_section(ci));
3230                         continue;
3231                 }
3232
3233                 (*count)++;
3234         }
3235 }
3236
3237 /** Count the number of conf pairs beneath a section
3238  *
3239  * @param[in] cs to search for items in.
3240  * @return number of pairs nested within section.
3241  */
3242 int cf_pair_count(CONF_SECTION const *cs)
3243 {
3244         int count = 0;
3245
3246         _pair_count(&count, cs);
3247
3248         return count;
3249 }
3250
3251 CONF_SECTION *cf_item_parent(CONF_ITEM const *ci)
3252 {
3253         if (!ci) return NULL;
3254
3255         return ci->parent;
3256 }
3257
3258 int cf_section_lineno(CONF_SECTION const *section)
3259 {
3260         return section->item.lineno;
3261 }
3262
3263 char const *cf_pair_filename(CONF_PAIR const *pair)
3264 {
3265         return pair->item.filename;
3266 }
3267
3268 char const *cf_section_filename(CONF_SECTION const *section)
3269 {
3270         return section->item.filename;
3271 }
3272
3273 int cf_pair_lineno(CONF_PAIR const *pair)
3274 {
3275         return pair->item.lineno;
3276 }
3277
3278 bool cf_item_is_section(CONF_ITEM const *item)
3279 {
3280         return item->type == CONF_ITEM_SECTION;
3281 }
3282
3283 bool cf_item_is_pair(CONF_ITEM const *item)
3284 {
3285         return item->type == CONF_ITEM_PAIR;
3286 }
3287
3288
3289 static CONF_DATA *cf_data_alloc(CONF_SECTION *parent, char const *name,
3290                                 void *data, void (*data_free)(void *))
3291 {
3292         CONF_DATA *cd;
3293
3294         cd = talloc_zero(parent, CONF_DATA);
3295         if (!cd) return NULL;
3296
3297         cd->item.type = CONF_ITEM_DATA;
3298         cd->item.parent = parent;
3299         cd->name = talloc_typed_strdup(cd, name);
3300         if (!cd->name) {
3301                 talloc_free(cd);
3302                 return NULL;
3303         }
3304
3305         cd->data = data;
3306         cd->free = data_free;
3307
3308         if (cd->free) {
3309                 talloc_set_destructor(cd, _cf_data_free);
3310         }
3311
3312         return cd;
3313 }
3314
3315 static void *cf_data_find_internal(CONF_SECTION const *cs, char const *name, int flag)
3316 {
3317         if (!cs || !name) return NULL;
3318
3319         /*
3320          *      Find the name in the tree, for speed.
3321          */
3322         if (cs->data_tree) {
3323                 CONF_DATA mycd;
3324
3325                 mycd.name = name;
3326                 mycd.flag = flag;
3327                 return rbtree_finddata(cs->data_tree, &mycd);
3328         }
3329
3330         return NULL;
3331 }
3332
3333 /*
3334  *      Find data from a particular section.
3335  */
3336 void *cf_data_find(CONF_SECTION const *cs, char const *name)
3337 {
3338         CONF_DATA *cd = cf_data_find_internal(cs, name, 0);
3339
3340         if (cd) return cd->data;
3341         return NULL;
3342 }
3343
3344
3345 /*
3346  *      Add named data to a configuration section.
3347  */
3348 static int cf_data_add_internal(CONF_SECTION *cs, char const *name,
3349                                 void *data, void (*data_free)(void *),
3350                                 int flag)
3351 {
3352         CONF_DATA *cd;
3353
3354         if (!cs || !name) return -1;
3355
3356         /*
3357          *      Already exists.  Can't add it.
3358          */
3359         if (cf_data_find_internal(cs, name, flag) != NULL) return -1;
3360
3361         cd = cf_data_alloc(cs, name, data, data_free);
3362         if (!cd) return -1;
3363         cd->flag = flag;
3364
3365         cf_item_add(cs, cf_data_to_item(cd));
3366
3367         return 0;
3368 }
3369
3370 /*
3371  *      Add named data to a configuration section.
3372  */
3373 int cf_data_add(CONF_SECTION *cs, char const *name,
3374                 void *data, void (*data_free)(void *))
3375 {
3376         return cf_data_add_internal(cs, name, data, data_free, 0);
3377 }
3378
3379 /** Remove named data from a configuration section
3380  *
3381  */
3382 void *cf_data_remove(CONF_SECTION *cs, char const *name)
3383 {
3384         CONF_DATA mycd;
3385         CONF_DATA *cd;
3386         void *data;
3387
3388         if (!cs || !name) return NULL;
3389         if (!cs->data_tree) return NULL;
3390
3391         /*
3392          *      Find the name in the tree, for speed.
3393          */
3394         mycd.name = name;
3395         mycd.flag = 0;
3396         cd = rbtree_finddata(cs->data_tree, &mycd);
3397         if (!cd) return NULL;
3398
3399         talloc_set_destructor(cd, NULL);        /* Disarm the destructor */
3400         rbtree_deletebydata(cs->data_tree, &mycd);
3401
3402         data = cd->data;
3403         talloc_free(cd);
3404
3405         return data;
3406 }
3407
3408 /*
3409  *      This is here to make the rest of the code easier to read.  It
3410  *      ties conffile.c to log.c, but it means we don't have to
3411  *      pollute every other function with the knowledge of the
3412  *      configuration internals.
3413  */
3414 void cf_log_err(CONF_ITEM const *ci, char const *fmt, ...)
3415 {
3416         va_list ap;
3417         char buffer[256];
3418
3419         va_start(ap, fmt);
3420         vsnprintf(buffer, sizeof(buffer), fmt, ap);
3421         va_end(ap);
3422
3423         if (ci) {
3424                 ERROR("%s[%d]: %s",
3425                        ci->filename ? ci->filename : "unknown",
3426                        ci->lineno ? ci->lineno : 0,
3427                        buffer);
3428         } else {
3429                 ERROR("<unknown>[*]: %s", buffer);
3430         }
3431 }
3432
3433 void cf_log_err_cs(CONF_SECTION const *cs, char const *fmt, ...)
3434 {
3435         va_list ap;
3436         char buffer[256];
3437
3438         va_start(ap, fmt);
3439         vsnprintf(buffer, sizeof(buffer), fmt, ap);
3440         va_end(ap);
3441
3442         rad_assert(cs != NULL);
3443
3444         ERROR("%s[%d]: %s",
3445                cs->item.filename ? cs->item.filename : "unknown",
3446                cs->item.lineno ? cs->item.lineno : 0,
3447                buffer);
3448 }
3449
3450 void cf_log_err_cp(CONF_PAIR const *cp, char const *fmt, ...)
3451 {
3452         va_list ap;
3453         char buffer[256];
3454
3455         va_start(ap, fmt);
3456         vsnprintf(buffer, sizeof(buffer), fmt, ap);
3457         va_end(ap);
3458
3459         rad_assert(cp != NULL);
3460
3461         ERROR("%s[%d]: %s",
3462                cp->item.filename ? cp->item.filename : "unknown",
3463                cp->item.lineno ? cp->item.lineno : 0,
3464                buffer);
3465 }
3466
3467 void cf_log_info(CONF_SECTION const *cs, char const *fmt, ...)
3468 {
3469         va_list ap;
3470
3471         va_start(ap, fmt);
3472         if ((rad_debug_lvl > 1) && cs) vradlog(L_DBG, fmt, ap);
3473         va_end(ap);
3474 }
3475
3476 /*
3477  *      Wrapper to simplify the code.
3478  */
3479 void cf_log_module(CONF_SECTION const *cs, char const *fmt, ...)
3480 {
3481         va_list ap;
3482         char buffer[256];
3483
3484         va_start(ap, fmt);
3485         if (rad_debug_lvl > 1 && cs) {
3486                 vsnprintf(buffer, sizeof(buffer), fmt, ap);
3487
3488                 DEBUG("%.*s# %s", cs->depth, parse_spaces, buffer);
3489         }
3490         va_end(ap);
3491 }
3492
3493 const CONF_PARSER *cf_section_parse_table(CONF_SECTION *cs)
3494 {
3495         if (!cs) return NULL;
3496
3497         return cs->variables;
3498 }
3499
3500 /*
3501  *      For "switch" and "case" statements.
3502  */
3503 FR_TOKEN cf_section_name2_type(CONF_SECTION const *cs)
3504 {
3505         if (!cs) return T_INVALID;
3506
3507         return cs->name2_type;
3508 }