src/main/conffile.c

   1 /*
   2  * conffile.c   Read the radiusd.conf file.
   3  *
   4  *              Yep I should learn to use lex & yacc, or at least
   5  *              write a decent parser. I know how to do that, really :)
   6  *              miquels@cistron.nl
   7  *
   8  * Version:     $Id$
   9  *
  10  *   This program is free software; you can redistribute it and/or modify
  11  *   it under the terms of the GNU General Public License as published by
  12  *   the Free Software Foundation; either version 2 of the License, or
  13  *   (at your option) any later version.
  14  *
  15  *   This program is distributed in the hope that it will be useful,
  16  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  *   GNU General Public License for more details.
  19  *
  20  *   You should have received a copy of the GNU General Public License
  21  *   along with this program; if not, write to the Free Software
  22  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  23  *
  24  * Copyright 2000,2006  The FreeRADIUS server project
  25  * Copyright 2000  Miquel van Smoorenburg <miquels@cistron.nl>
  26  * Copyright 2000  Alan DeKok <aland@ox.org>
  27  */
  28
  29 RCSID("$Id$")
  30
  31 #include <freeradius-devel/radiusd.h>
  32 #include <freeradius-devel/parser.h>
  33 #include <freeradius-devel/rad_assert.h>
  34
  35 #ifdef HAVE_DIRENT_H
  36 #include <dirent.h>
  37 #endif
  38
  39 #ifdef HAVE_SYS_STAT_H
  40 #include <sys/stat.h>
  41 #endif
  42
  43 #include <ctype.h>
  44
  45 typedef enum conf_property {
  46         CONF_PROPERTY_INVALID = 0,
  47         CONF_PROPERTY_NAME,
  48         CONF_PROPERTY_INSTANCE,
  49 } CONF_PROPERTY;
  50
  51 static const FR_NAME_NUMBER conf_property_name[] = {
  52         { "name",       CONF_PROPERTY_NAME},
  53         { "instance",   CONF_PROPERTY_INSTANCE},
  54
  55         {  NULL , -1 }
  56 };
  57
  58 typedef enum conf_type {
  59         CONF_ITEM_INVALID = 0,
  60         CONF_ITEM_PAIR,
  61         CONF_ITEM_SECTION,
  62         CONF_ITEM_DATA
  63 } CONF_ITEM_TYPE;
  64
  65 struct conf_item {
  66         struct conf_item *next;         //!< Sibling.
  67         struct conf_part *parent;       //!< Parent.
  68         int lineno;                     //!< The line number the config item began on.
  69         char const *filename;           //!< The file the config item was parsed from.
  70         CONF_ITEM_TYPE type;            //!< Whether the config item is a config_pair, conf_section or conf_data.
  71 };
  72
  73 /** Configuration AVP similar to a VALUE_PAIR
  74  *
  75  */
  76 struct conf_pair {
  77         CONF_ITEM       item;
  78         char const      *attr;          //!< Attribute name
  79         char const      *value;         //!< Attribute value
  80         FR_TOKEN        op;             //!< Operator e.g. =, :=
  81         FR_TOKEN        lhs_type;       //!< Name quoting style T_(DOUBLE|SINGLE|BACK)_QUOTE_STRING or T_BARE_WORD.
  82         FR_TOKEN        rhs_type;       //!< Value Quoting style T_(DOUBLE|SINGLE|BACK)_QUOTE_STRING or T_BARE_WORD.
  83         bool            pass2;          //!< do expansion in pass2.
  84         bool            parsed;         //!< Was this item used during parsing?
  85 };
  86
  87 /** Internal data that is associated with a configuration section
  88  *
  89  */
  90 struct conf_data {
  91         CONF_ITEM       item;
  92         char const      *name;
  93         int             flag;
  94         void            *data;          //!< User data
  95         void            (*free)(void *);        //!< Free user data function
  96 };
  97
  98 struct conf_part {
  99         CONF_ITEM       item;
 100         char const      *name1;         //!< First name token.  Given ``foo bar {}`` would be ``foo``.
 101         char const      *name2;         //!< Second name token. Given ``foo bar {}`` would be ``bar``.
 102
 103         FR_TOKEN        name2_type;     //!< The type of quoting around name2.
 104
 105         CONF_ITEM       *children;
 106         CONF_ITEM       *tail;          //!< For speed.
 107         CONF_SECTION    *template;
 108
 109         rbtree_t        *pair_tree;     //!< and a partridge..
 110         rbtree_t        *section_tree;  //!< no jokes here.
 111         rbtree_t        *name2_tree;    //!< for sections of the same name2
 112         rbtree_t        *data_tree;
 113
 114         void            *base;
 115         int             depth;
 116
 117         CONF_PARSER const *variables;
 118 };
 119
 120 typedef struct cf_file_t {
 121         char const      *filename;
 122         struct stat     buf;
 123 } cf_file_t;
 124
 125 CONF_SECTION *root_config = NULL;
 126 bool cf_new_escape = false;
 127
 128
 129 static int              cf_data_add_internal(CONF_SECTION *cs, char const *name, void *data,
 130                                              void (*data_free)(void *), int flag);
 131
 132 static void             *cf_data_find_internal(CONF_SECTION const *cs, char const *name, int flag);
 133
 134 static char const       *cf_expand_variables(char const *cf, int *lineno,
 135                                              CONF_SECTION *outercs,
 136                                              char *output, size_t outsize,
 137                                              char const *input, bool *soft_fail);
 138
 139 static int cf_file_include(CONF_SECTION *cs, char const *filename_in);
 140
 141
 142
 143 /*
 144  *      Isolate the scary casts in these tiny provably-safe functions
 145  */
 146
 147 /** Cast a CONF_ITEM to a CONF_PAIR
 148  *
 149  */
 150 CONF_PAIR *cf_item_to_pair(CONF_ITEM const *ci)
 151 {
 152         CONF_PAIR *out;
 153
 154         if (ci == NULL) return NULL;
 155
 156         rad_assert(ci->type == CONF_ITEM_PAIR);
 157
 158         memcpy(&out, &ci, sizeof(out));
 159         return out;
 160 }
 161
 162 /** Cast a CONF_ITEM to a CONF_SECTION
 163  *
 164  */
 165 CONF_SECTION *cf_item_to_section(CONF_ITEM const *ci)
 166 {
 167         CONF_SECTION *out;
 168
 169         if (ci == NULL) return NULL;
 170
 171         rad_assert(ci->type == CONF_ITEM_SECTION);
 172
 173         memcpy(&out, &ci, sizeof(out));
 174         return out;
 175 }
 176
 177 /** Cast a CONF_PAIR to a CONF_ITEM
 178  *
 179  */
 180 CONF_ITEM *cf_pair_to_item(CONF_PAIR const *cp)
 181 {
 182         CONF_ITEM *out;
 183
 184         if (cp == NULL) return NULL;
 185
 186         memcpy(&out, &cp, sizeof(out));
 187         return out;
 188 }
 189
 190 /** Cast a CONF_SECTION to a CONF_ITEM
 191  *
 192  */
 193 CONF_ITEM *cf_section_to_item(CONF_SECTION const *cs)
 194 {
 195         CONF_ITEM *out;
 196
 197         if (cs == NULL) return NULL;
 198
 199         memcpy(&out, &cs, sizeof(out));
 200         return out;
 201 }
 202
 203 /** Cast CONF_DATA to a CONF_ITEM
 204  *
 205  */
 206 static CONF_ITEM *cf_data_to_item(CONF_DATA const *cd)
 207 {
 208         CONF_ITEM *out;
 209
 210         if (cd == NULL) {
 211                 return NULL;
 212         }
 213
 214         memcpy(&out, &cd, sizeof(out));
 215         return out;
 216 }
 217
 218 static int _cf_data_free(CONF_DATA *cd)
 219 {
 220         if (cd->free) cd->free(cd->data);
 221
 222         return 0;
 223 }
 224
 225 /*
 226  *      rbtree callback function
 227  */
 228 static int pair_cmp(void const *a, void const *b)
 229 {
 230         CONF_PAIR const *one = a;
 231         CONF_PAIR const *two = b;
 232
 233         return strcmp(one->attr, two->attr);
 234 }
 235
 236
 237 /*
 238  *      rbtree callback function
 239  */
 240 static int section_cmp(void const *a, void const *b)
 241 {
 242         CONF_SECTION const *one = a;
 243         CONF_SECTION const *two = b;
 244
 245         return strcmp(one->name1, two->name1);
 246 }
 247
 248
 249 /*
 250  *      rbtree callback function
 251  */
 252 static int name2_cmp(void const *a, void const *b)
 253 {
 254         CONF_SECTION const *one = a;
 255         CONF_SECTION const *two = b;
 256
 257         rad_assert(strcmp(one->name1, two->name1) == 0);
 258
 259         if (!one->name2 && !two->name2) return 0;
 260         if (one->name2 && !two->name2) return -1;
 261         if (!one->name2 && two->name2) return +1;
 262
 263         return strcmp(one->name2, two->name2);
 264 }
 265
 266
 267 /*
 268  *      rbtree callback function
 269  */
 270 static int data_cmp(void const *a, void const *b)
 271 {
 272         int rcode;
 273
 274         CONF_DATA const *one = a;
 275         CONF_DATA const *two = b;
 276
 277         rcode = one->flag - two->flag;
 278         if (rcode != 0) return rcode;
 279
 280         return strcmp(one->name, two->name);
 281 }
 282
 283 /*
 284  *      Functions for tracking filenames.
 285  */
 286 static int filename_cmp(void const *a, void const *b)
 287 {
 288         cf_file_t const *one = a;
 289         cf_file_t const *two = b;
 290
 291         if (one->buf.st_dev < two->buf.st_dev) return -1;
 292         if (one->buf.st_dev > two->buf.st_dev) return +1;
 293
 294         if (one->buf.st_ino < two->buf.st_ino) return -1;
 295         if (one->buf.st_ino > two->buf.st_ino) return +1;
 296
 297         return 0;
 298 }
 299
 300 static FILE *cf_file_open(CONF_SECTION *cs, char const *filename)
 301 {
 302         cf_file_t *file;
 303         CONF_DATA *cd;
 304         CONF_SECTION *top;
 305         rbtree_t *tree;
 306         int fd;
 307         FILE *fp;
 308
 309         top = cf_top_section(cs);
 310         cd = cf_data_find_internal(top, "filename", 0);
 311         if (!cd) return NULL;
 312
 313         tree = cd->data;
 314
 315         fp = fopen(filename, "r");
 316         if (!fp) {
 317                 ERROR("Unable to open file \"%s\": %s",
 318                       filename, fr_syserror(errno));
 319                 return NULL;
 320         }
 321
 322         fd = fileno(fp);
 323
 324         file = talloc(tree, cf_file_t);
 325         if (!file) {
 326                 fclose(fp);
 327                 return NULL;
 328         }
 329         file->filename = filename;
 330
 331         if (fstat(fd, &file->buf) == 0) {
 332 #ifdef S_IWOTH
 333                 if ((file->buf.st_mode & S_IWOTH) != 0) {
 334                         fclose(fp);
 335                         ERROR("Configuration file %s is globally writable.  "
 336                               "Refusing to start due to insecure configuration.", filename);
 337                         return NULL;
 338                 }
 339 #endif
 340         }
 341
 342         if (!rbtree_insert(tree, file)) {
 343                 ERROR("Cannot include the same file twice: \"%s\"", filename);
 344                 talloc_free(file);
 345                 fclose(fp);
 346                 return NULL;
 347         }
 348
 349         return fp;
 350 }
 351
 352 static int _cf_section_free(CONF_SECTION *cs)
 353 {
 354         /*
 355          *      Name1 and name2 are allocated contiguous with
 356          *      cs.
 357          */
 358         if (cs->pair_tree) {
 359                 rbtree_free(cs->pair_tree);
 360                 cs->pair_tree = NULL;
 361         }
 362         if (cs->section_tree) {
 363                 rbtree_free(cs->section_tree);
 364                 cs->section_tree = NULL;
 365         }
 366         if (cs->name2_tree) {
 367                 rbtree_free(cs->name2_tree);
 368                 cs->name2_tree = NULL;
 369         }
 370         if (cs->data_tree) {
 371                 rbtree_free(cs->data_tree);
 372                 cs->data_tree = NULL;
 373         }
 374
 375         return 0;
 376 }
 377
 378 /** Allocate a CONF_PAIR
 379  *
 380  * @param parent CONF_SECTION to hang this CONF_PAIR off of.
 381  * @param attr name.
 382  * @param value of CONF_PAIR.
 383  * @param op T_OP_EQ, T_OP_SET etc.
 384  * @param lhs_type T_BARE_WORD, T_DOUBLE_QUOTED_STRING, T_BACK_QUOTED_STRING
 385  * @param rhs_type T_BARE_WORD, T_DOUBLE_QUOTED_STRING, T_BACK_QUOTED_STRING
 386  * @return NULL on error, else a new CONF_SECTION parented by parent.
 387  */
 388 CONF_PAIR *cf_pair_alloc(CONF_SECTION *parent, char const *attr, char const *value,
 389                          FR_TOKEN op, FR_TOKEN lhs_type, FR_TOKEN rhs_type)
 390 {
 391         CONF_PAIR *cp;
 392
 393         rad_assert(fr_equality_op[op] || fr_assignment_op[op]);
 394         if (!attr) return NULL;
 395
 396         cp = talloc_zero(parent, CONF_PAIR);
 397         if (!cp) return NULL;
 398
 399         cp->item.type = CONF_ITEM_PAIR;
 400         cp->item.parent = parent;
 401         cp->lhs_type = lhs_type;
 402         cp->rhs_type = rhs_type;
 403         cp->op = op;
 404
 405         cp->attr = talloc_typed_strdup(cp, attr);
 406         if (!cp->attr) {
 407         error:
 408                 talloc_free(cp);
 409                 return NULL;
 410         }
 411
 412         if (value) {
 413                 cp->value = talloc_typed_strdup(cp, value);
 414                 if (!cp->value) goto error;
 415         }
 416
 417         return cp;
 418 }
 419
 420 /** Duplicate a CONF_PAIR
 421  *
 422  * @param parent to allocate new pair in.
 423  * @param cp to duplicate.
 424  * @return NULL on error, else a duplicate of the input pair.
 425  */
 426 CONF_PAIR *cf_pair_dup(CONF_SECTION *parent, CONF_PAIR *cp)
 427 {
 428         CONF_PAIR *new;
 429
 430         rad_assert(parent);
 431         rad_assert(cp);
 432
 433         new = cf_pair_alloc(parent, cp->attr, cf_pair_value(cp),
 434                             cp->op, cp->lhs_type, cp->rhs_type);
 435         if (!new) return NULL;
 436
 437         new->parsed = cp->parsed;
 438         new->item.lineno = cp->item.lineno;
 439
 440         /*
 441          *      Avoid mallocs if possible.
 442          */
 443         if (!cp->item.filename || (strcmp(parent->item.filename, cp->item.filename) == 0)) {
 444                 new->item.filename = parent->item.filename;
 445         } else {
 446                 new->item.filename = talloc_strdup(new, cp->item.filename);
 447         }
 448
 449         return new;
 450 }
 451
 452 /** Add a configuration pair to a section
 453  *
 454  * @param parent section to add pair to.
 455  * @param cp to add.
 456  */
 457 void cf_pair_add(CONF_SECTION *parent, CONF_PAIR *cp)
 458 {
 459         cf_item_add(parent, cf_pair_to_item(cp));
 460 }
 461
 462 /** Allocate a CONF_SECTION
 463  *
 464  * @param parent CONF_SECTION to hang this CONF_SECTION off of.
 465  * @param name1 Primary name.
 466  * @param name2 Secondary name.
 467  * @return NULL on error, else a new CONF_SECTION parented by parent.
 468  */
 469 CONF_SECTION *cf_section_alloc(CONF_SECTION *parent, char const *name1, char const *name2)
 470 {
 471         CONF_SECTION *cs;
 472         char buffer[1024];
 473
 474         if (!name1) return NULL;
 475
 476         if (name2 && parent) {
 477                 if (strchr(name2, '$')) {
 478                         name2 = cf_expand_variables(parent->item.filename,
 479                                                     &parent->item.lineno,
 480                                                     parent,
 481                                                     buffer, sizeof(buffer), name2, NULL);
 482                         if (!name2) {
 483                                 ERROR("Failed expanding section name");
 484                                 return NULL;
 485                         }
 486                 }
 487         }
 488
 489         cs = talloc_zero(parent, CONF_SECTION);
 490         if (!cs) return NULL;
 491
 492         cs->item.type = CONF_ITEM_SECTION;
 493         cs->item.parent = parent;
 494
 495         cs->name1 = talloc_typed_strdup(cs, name1);
 496         if (!cs->name1) {
 497         error:
 498                 talloc_free(cs);
 499                 return NULL;
 500         }
 501
 502         if (name2) {
 503                 cs->name2 = talloc_typed_strdup(cs, name2);
 504                 if (!cs->name2) goto error;
 505         }
 506
 507         cs->pair_tree = rbtree_create(cs, pair_cmp, NULL, 0);
 508         if (!cs->pair_tree) goto error;
 509
 510         talloc_set_destructor(cs, _cf_section_free);
 511
 512         /*
 513          *      Don't create a data tree, it may not be needed.
 514          */
 515
 516         /*
 517          *      Don't create the section tree here, it may not
 518          *      be needed.
 519          */
 520
 521         if (parent) cs->depth = parent->depth + 1;
 522
 523         return cs;
 524 }
 525
 526 /** Duplicate a configuration section
 527  *
 528  * @note recursively duplicates any child sections.
 529  * @note does not duplicate any data associated with a section, or its child sections.
 530  *
 531  * @param parent section (may be NULL).
 532  * @param cs to duplicate.
 533  * @param name1 of new section.
 534  * @param name2 of new section.
 535  * @param copy_meta Copy additional meta data for a section (like template, base, depth and variables).
 536  * @return a duplicate of the existing section, or NULL on error.
 537  */
 538 CONF_SECTION *cf_section_dup(CONF_SECTION *parent, CONF_SECTION const *cs,
 539                              char const *name1, char const *name2, bool copy_meta)
 540 {
 541         CONF_SECTION *new, *subcs;
 542         CONF_PAIR *cp;
 543         CONF_ITEM *ci;
 544
 545         new = cf_section_alloc(parent, name1, name2);
 546
 547         if (copy_meta) {
 548                 new->template = cs->template;
 549                 new->base = cs->base;
 550                 new->depth = cs->depth;
 551                 new->variables = cs->variables;
 552         }
 553
 554         new->item.lineno = cs->item.lineno;
 555
 556         if (!cs->item.filename || (parent && (strcmp(parent->item.filename, cs->item.filename) == 0))) {
 557                 new->item.filename = parent->item.filename;
 558         } else {
 559                 new->item.filename = talloc_strdup(new, cs->item.filename);
 560         }
 561
 562         for (ci = cs->children; ci; ci = ci->next) {
 563                 switch (ci->type) {
 564                 case CONF_ITEM_SECTION:
 565                         subcs = cf_item_to_section(ci);
 566                         subcs = cf_section_dup(new, subcs,
 567                                                cf_section_name1(subcs), cf_section_name2(subcs),
 568                                                copy_meta);
 569                         if (!subcs) {
 570                                 talloc_free(new);
 571                                 return NULL;
 572                         }
 573                         cf_section_add(new, subcs);
 574                         break;
 575
 576                 case CONF_ITEM_PAIR:
 577                         cp = cf_pair_dup(new, cf_item_to_pair(ci));
 578                         if (!cp) {
 579                                 talloc_free(new);
 580                                 return NULL;
 581                         }
 582                         cf_pair_add(new, cp);
 583                         break;
 584
 585                 case CONF_ITEM_DATA: /* Skip data */
 586                         break;
 587
 588                 case CONF_ITEM_INVALID:
 589                         rad_assert(0);
 590                 }
 591         }
 592
 593         return new;
 594 }
 595
 596 void cf_section_add(CONF_SECTION *parent, CONF_SECTION *cs)
 597 {
 598         cf_item_add(parent, &(cs->item));
 599 }
 600
 601 /** Replace pair in a given section with a new pair, of the given value.
 602  *
 603  * @param cs to replace pair in.
 604  * @param cp to replace.
 605  * @param value New value to assign to cp.
 606  * @return 0 on success, -1 on failure.
 607  */
 608 int cf_pair_replace(CONF_SECTION *cs, CONF_PAIR *cp, char const *value)
 609 {
 610         CONF_PAIR *newp;
 611         CONF_ITEM *ci, *cn, **last;
 612
 613         newp = cf_pair_alloc(cs, cp->attr, value, cp->op, cp->lhs_type, cp->rhs_type);
 614         if (!newp) return -1;
 615
 616         ci = &(cp->item);
 617         cn = &(newp->item);
 618
 619         /*
 620          *      Find the old one from the linked list, and replace it
 621          *      with the new one.
 622          */
 623         for (last = &cs->children; (*last) != NULL; last = &(*last)->next) {
 624                 if (*last == ci) {
 625                         cn->next = (*last)->next;
 626                         *last = cn;
 627                         ci->next = NULL;
 628                         break;
 629                 }
 630         }
 631
 632         rbtree_deletebydata(cs->pair_tree, ci);
 633
 634         rbtree_insert(cs->pair_tree, cn);
 635
 636         return 0;
 637 }
 638
 639
 640 /*
 641  *      Add an item to a configuration section.
 642  */
 643 void cf_item_add(CONF_SECTION *cs, CONF_ITEM *ci)
 644 {
 645 #ifndef NDEBUG
 646         CONF_ITEM *first = ci;
 647 #endif
 648
 649         rad_assert((void *)cs != (void *)ci);
 650
 651         if (!cs || !ci) return;
 652
 653         if (!cs->children) {
 654                 rad_assert(cs->tail == NULL);
 655                 cs->children = ci;
 656         } else {
 657                 rad_assert(cs->tail != NULL);
 658                 cs->tail->next = ci;
 659         }
 660
 661         /*
 662          *      Update the trees (and tail) for each item added.
 663          */
 664         for (/* nothing */; ci != NULL; ci = ci->next) {
 665                 rad_assert(ci->next != first);  /* simple cycle detection */
 666
 667                 cs->tail = ci;
 668
 669                 /*
 670                  *      For fast lookups, pairs and sections get
 671                  *      added to rbtree's.
 672                  */
 673                 switch (ci->type) {
 674                 case CONF_ITEM_PAIR:
 675                         if (!rbtree_insert(cs->pair_tree, ci)) {
 676                                 CONF_PAIR *cp = cf_item_to_pair(ci);
 677
 678                                 if (strcmp(cp->attr, "confdir") == 0) break;
 679                                 if (!cp->value) break; /* module name, "ok", etc. */
 680                         }
 681                         break;
 682
 683                 case CONF_ITEM_SECTION: {
 684                         CONF_SECTION *cs_new = cf_item_to_section(ci);
 685                         CONF_SECTION *name1_cs;
 686
 687                         if (!cs->section_tree) {
 688                                 cs->section_tree = rbtree_create(cs, section_cmp, NULL, 0);
 689                                 if (!cs->section_tree) {
 690                                         ERROR("Out of memory");
 691                                         fr_exit_now(1);
 692                                 }
 693                         }
 694
 695                         name1_cs = rbtree_finddata(cs->section_tree, cs_new);
 696                         if (!name1_cs) {
 697                                 if (!rbtree_insert(cs->section_tree, cs_new)) {
 698                                         ERROR("Failed inserting section into tree");
 699                                         fr_exit_now(1);
 700                                 }
 701                                 break;
 702                         }
 703
 704                         /*
 705                          *      We already have a section of
 706                          *      this "name1".  Add a new
 707                          *      sub-section based on name2.
 708                          */
 709                         if (!name1_cs->name2_tree) {
 710                                 name1_cs->name2_tree = rbtree_create(name1_cs, name2_cmp, NULL, 0);
 711                                 if (!name1_cs->name2_tree) {
 712                                         ERROR("Out of memory");
 713                                         fr_exit_now(1);
 714                                 }
 715                         }
 716
 717                         /*
 718                          *      We don't care if this fails.
 719                          *      If the user tries to create
 720                          *      two sections of the same
 721                          *      name1/name2, the duplicate
 722                          *      section is just silently
 723                          *      ignored.
 724                          */
 725                         rbtree_insert(name1_cs->name2_tree, cs_new);
 726                         break;
 727                 } /* was a section */
 728
 729                 case CONF_ITEM_DATA:
 730                         if (!cs->data_tree) {
 731                                 cs->data_tree = rbtree_create(cs, data_cmp, NULL, 0);
 732                         }
 733                         if (cs->data_tree) {
 734                                 rbtree_insert(cs->data_tree, ci);
 735                         }
 736                         break;
 737
 738                 default: /* FIXME: assert & error! */
 739                         break;
 740
 741                 } /* switch over conf types */
 742         } /* loop over ci */
 743 }
 744
 745
 746 CONF_ITEM *cf_reference_item(CONF_SECTION const *parentcs,
 747                              CONF_SECTION *outercs,
 748                              char const *ptr)
 749 {
 750         CONF_PAIR *cp;
 751         CONF_SECTION *next;
 752         CONF_SECTION const *cs = outercs;
 753         char name[8192];
 754         char *p;
 755
 756         if (!cs) goto no_such_item;
 757
 758         strlcpy(name, ptr, sizeof(name));
 759         p = name;
 760
 761         /*
 762          *      ".foo" means "foo from the current section"
 763          */
 764         if (*p == '.') {
 765                 p++;
 766
 767                 /*
 768                  *      Just '.' means the current section
 769                  */
 770                 if (*p == '\0') {
 771                         return cf_section_to_item(cs);
 772                 }
 773
 774                 /*
 775                  *      ..foo means "foo from the section
 776                  *      enclosing this section" (etc.)
 777                  */
 778                 while (*p == '.') {
 779                         if (cs->item.parent) {
 780                                 cs = cs->item.parent;
 781                         }
 782
 783                         /*
 784                          *      .. means the section
 785                          *      enclosing this section
 786                          */
 787                         if (!*++p) {
 788                                 return cf_section_to_item(cs);
 789                         }
 790                 }
 791
 792                 /*
 793                  *      "foo.bar.baz" means "from the root"
 794                  */
 795         } else if (strchr(p, '.') != NULL) {
 796                 if (!parentcs) goto no_such_item;
 797
 798                 cs = parentcs;
 799         }
 800
 801         while (*p) {
 802                 char *q, *r;
 803
 804                 r = strchr(p, '[');
 805                 q = strchr(p, '.');
 806                 if (!r && !q) break;
 807
 808                 if (r && q > r) q = NULL;
 809                 if (q && q < r) r = NULL;
 810
 811                 /*
 812                  *      Split off name2.
 813                  */
 814                 if (r) {
 815                         q = strchr(r + 1, ']');
 816                         if (!q) return NULL; /* parse error */
 817
 818                         /*
 819                          *      Points to foo[bar]xx: parse error,
 820                          *      it should be foo[bar] or foo[bar].baz
 821                          */
 822                         if (q[1] && q[1] != '.') goto no_such_item;
 823
 824                         *r = '\0';
 825                         *q = '\0';
 826                         next = cf_section_sub_find_name2(cs, p, r + 1);
 827                         *r = '[';
 828                         *q = ']';
 829
 830                         /*
 831                          *      Points to a named instance of a section.
 832                          */
 833                         if (!q[1]) {
 834                                 if (!next) goto no_such_item;
 835                                 return &(next->item);
 836                         }
 837
 838                         q++;    /* ensure we skip the ']' and '.' */
 839
 840                 } else {
 841                         *q = '\0';
 842                         next = cf_section_sub_find(cs, p);
 843                         *q = '.';
 844                 }
 845
 846                 if (!next) break; /* it MAY be a pair in this section! */
 847
 848                 cs = next;
 849                 p = q + 1;
 850         }
 851
 852         if (!*p) goto no_such_item;
 853
 854  retry:
 855         /*
 856          *      Find it in the current referenced
 857          *      section.
 858          */
 859         cp = cf_pair_find(cs, p);
 860         if (cp) {
 861                 cp->parsed = true;      /* conf pairs which are referenced count as parsed */
 862                 return &(cp->item);
 863         }
 864
 865         next = cf_section_sub_find(cs, p);
 866         if (next) return &(next->item);
 867
 868         /*
 869          *      "foo" is "in the current section, OR in main".
 870          */
 871         if ((p == name) && (parentcs != NULL) && (cs != parentcs)) {
 872                 cs = parentcs;
 873                 goto retry;
 874         }
 875
 876 no_such_item:
 877         return NULL;
 878 }
 879
 880
 881 CONF_SECTION *cf_top_section(CONF_SECTION *cs)
 882 {
 883         if (!cs) return NULL;
 884
 885         while (cs->item.parent != NULL) {
 886                 cs = cs->item.parent;
 887         }
 888
 889         return cs;
 890 }
 891
 892
 893 /*
 894  *      Expand the variables in an input string.
 895  */
 896 static char const *cf_expand_variables(char const *cf, int *lineno,
 897                                        CONF_SECTION *outercs,
 898                                        char *output, size_t outsize,
 899                                        char const *input, bool *soft_fail)
 900 {
 901         char *p;
 902         char const *end, *ptr;
 903         CONF_SECTION const *parentcs;
 904         char name[8192];
 905
 906         if (soft_fail) *soft_fail = false;
 907
 908         /*
 909          *      Find the master parent conf section.
 910          *      We can't use main_config.config, because we're in the
 911          *      process of re-building it, and it isn't set up yet...
 912          */
 913         parentcs = cf_top_section(outercs);
 914
 915         p = output;
 916         ptr = input;
 917         while (*ptr) {
 918                 /*
 919                  *      Ignore anything other than "${"
 920                  */
 921                 if ((*ptr == '$') && (ptr[1] == '{')) {
 922                         CONF_ITEM *ci;
 923                         CONF_PAIR *cp;
 924                         char *q;
 925
 926                         /*
 927                          *      FIXME: Add support for ${foo:-bar},
 928                          *      like in xlat.c
 929                          */
 930
 931                         /*
 932                          *      Look for trailing '}', and log a
 933                          *      warning for anything that doesn't match,
 934                          *      and exit with a fatal error.
 935                          */
 936                         end = strchr(ptr, '}');
 937                         if (end == NULL) {
 938                                 *p = '\0';
 939                                 INFO("%s[%d]: Variable expansion missing }",
 940                                        cf, *lineno);
 941                                 return NULL;
 942                         }
 943
 944                         ptr += 2;
 945
 946                         /*
 947                          *      Can't really happen because input lines are
 948                          *      capped at 8k, which is sizeof(name)
 949                          */
 950                         if ((size_t) (end - ptr) >= sizeof(name)) {
 951                                 ERROR("%s[%d]: Reference string is too large",
 952                                       cf, *lineno);
 953                                 return NULL;
 954                         }
 955
 956                         memcpy(name, ptr, end - ptr);
 957                         name[end - ptr] = '\0';
 958
 959                         q = strchr(name, ':');
 960                         if (q) {
 961                                 *(q++) = '\0';
 962                         }
 963
 964                         ci = cf_reference_item(parentcs, outercs, name);
 965                         if (!ci) {
 966                                 if (soft_fail) *soft_fail = true;
 967                                 ERROR("%s[%d]: Reference \"%s\" not found", cf, *lineno, input);
 968                                 return NULL;
 969                         }
 970
 971                         /*
 972                          *      The expansion doesn't refer to another item or section
 973                          *      it's the property of a section.
 974                          */
 975                         if (q) {
 976                                 CONF_SECTION *mycs = cf_item_to_section(ci);
 977
 978                                 if (ci->type != CONF_ITEM_SECTION) {
 979                                         ERROR("%s[%d]: Can only reference properties of sections", cf, *lineno);
 980                                         return NULL;
 981                                 }
 982
 983                                 switch (fr_str2int(conf_property_name, q, CONF_PROPERTY_INVALID)) {
 984                                 case CONF_PROPERTY_NAME:
 985                                         strcpy(p, mycs->name1);
 986                                         break;
 987
 988                                 case CONF_PROPERTY_INSTANCE:
 989                                         strcpy(p, mycs->name2 ? mycs->name2 : mycs->name1);
 990                                         break;
 991
 992                                 default:
 993                                         ERROR("%s[%d]: Invalid property '%s'", cf, *lineno, q);
 994                                         return NULL;
 995                                 }
 996                                 p += strlen(p);
 997                                 ptr = end + 1;
 998
 999                         } else if (ci->type == CONF_ITEM_PAIR) {
1000                                 /*
1001                                  *  Substitute the value of the variable.
1002                                  */
1003                                 cp = cf_item_to_pair(ci);
1004
1005                                 /*
1006                                  *      If the thing we reference is
1007                                  *      marked up as being expanded in
1008                                  *      pass2, don't expand it now.
1009                                  *      Let it be expanded in pass2.
1010                                  */
1011                                 if (cp->pass2) {
1012                                         if (soft_fail) *soft_fail = true;
1013
1014                                         ERROR("%s[%d]: Reference \"%s\" points to a variable which has not been expanded.",
1015                                               cf, *lineno, input);
1016                                         return NULL;
1017                                 }
1018
1019                                 if (!cp->value) {
1020                                         ERROR("%s[%d]: Reference \"%s\" has no value",
1021                                                cf, *lineno, input);
1022                                         return NULL;
1023                                 }
1024
1025                                 if (p + strlen(cp->value) >= output + outsize) {
1026                                         ERROR("%s[%d]: Reference \"%s\" is too long",
1027                                                cf, *lineno, input);
1028                                         return NULL;
1029                                 }
1030
1031                                 strcpy(p, cp->value);
1032                                 p += strlen(p);
1033                                 ptr = end + 1;
1034
1035                         } else if (ci->type == CONF_ITEM_SECTION) {
1036                                 CONF_SECTION *subcs;
1037
1038                                 /*
1039                                  *      Adding an entry again to a
1040                                  *      section is wrong.  We don't
1041                                  *      want an infinite loop.
1042                                  */
1043                                 if (ci->parent == outercs) {
1044                                         ERROR("%s[%d]: Cannot reference different item in same section", cf, *lineno);
1045                                         return NULL;
1046                                 }
1047
1048                                 /*
1049                                  *      Copy the section instead of
1050                                  *      referencing it.
1051                                  */
1052                                 subcs = cf_item_to_section(ci);
1053                                 subcs = cf_section_dup(outercs, subcs,
1054                                                        cf_section_name1(subcs), cf_section_name2(subcs),
1055                                                        false);
1056                                 if (!subcs) {
1057                                         ERROR("%s[%d]: Failed copying reference %s", cf, *lineno, name);
1058                                         return NULL;
1059                                 }
1060
1061                                 subcs->item.filename = ci->filename;
1062                                 subcs->item.lineno = ci->lineno;
1063                                 cf_item_add(outercs, &(subcs->item));
1064
1065                                 ptr = end + 1;
1066
1067                         } else {
1068                                 ERROR("%s[%d]: Reference \"%s\" type is invalid", cf, *lineno, input);
1069                                 return NULL;
1070                         }
1071                 } else if (memcmp(ptr, "$ENV{", 5) == 0) {
1072                         char *env;
1073
1074                         ptr += 5;
1075
1076                         /*
1077                          *      Look for trailing '}', and log a
1078                          *      warning for anything that doesn't match,
1079                          *      and exit with a fatal error.
1080                          */
1081                         end = strchr(ptr, '}');
1082                         if (end == NULL) {
1083                                 *p = '\0';
1084                                 INFO("%s[%d]: Environment variable expansion missing }",
1085                                        cf, *lineno);
1086                                 return NULL;
1087                         }
1088
1089                         /*
1090                          *      Can't really happen because input lines are
1091                          *      capped at 8k, which is sizeof(name)
1092                          */
1093                         if ((size_t) (end - ptr) >= sizeof(name)) {
1094                                 ERROR("%s[%d]: Environment variable name is too large",
1095                                        cf, *lineno);
1096                                 return NULL;
1097                         }
1098
1099                         memcpy(name, ptr, end - ptr);
1100                         name[end - ptr] = '\0';
1101
1102                         /*
1103                          *      Get the environment variable.
1104                          *      If none exists, then make it an empty string.
1105                          */
1106                         env = getenv(name);
1107                         if (env == NULL) {
1108                                 *name = '\0';
1109                                 env = name;
1110                         }
1111
1112                         if (p + strlen(env) >= output + outsize) {
1113                                 ERROR("%s[%d]: Reference \"%s\" is too long",
1114                                        cf, *lineno, input);
1115                                 return NULL;
1116                         }
1117
1118                         strcpy(p, env);
1119                         p += strlen(p);
1120                         ptr = end + 1;
1121
1122                 } else {
1123                         /*
1124                          *      Copy it over verbatim.
1125                          */
1126                         *(p++) = *(ptr++);
1127                 }
1128
1129
1130                 if (p >= (output + outsize)) {
1131                         ERROR("%s[%d]: Reference \"%s\" is too long",
1132                                cf, *lineno, input);
1133                         return NULL;
1134                 }
1135         } /* loop over all of the input string. */
1136
1137         *p = '\0';
1138
1139         return output;
1140 }
1141
1142 static char const parse_spaces[] = "                                                                                                                                                                                                                                                                ";
1143
1144 /** Validation function for ipaddr conffile types
1145  *
1146  */
1147 static inline int fr_item_validate_ipaddr(CONF_SECTION *cs, char const *name, PW_TYPE type, char const *value,
1148                                           fr_ipaddr_t *ipaddr)
1149 {
1150         char ipbuf[128];
1151
1152         if (strcmp(value, "*") == 0) {
1153                 cf_log_info(cs, "%.*s\t%s = *", cs->depth, parse_spaces, name);
1154         } else if (strspn(value, ".0123456789abdefABCDEF:%[]/") == strlen(value)) {
1155                 cf_log_info(cs, "%.*s\t%s = %s", cs->depth, parse_spaces, name, value);
1156         } else {
1157                 cf_log_info(cs, "%.*s\t%s = %s IPv%s address [%s]", cs->depth, parse_spaces, name, value,
1158                             (ipaddr->af == AF_INET ? "4" : " 6"), ip_ntoh(ipaddr, ipbuf, sizeof(ipbuf)));
1159         }
1160
1161         switch (type) {
1162         case PW_TYPE_IPV4_ADDR:
1163         case PW_TYPE_IPV6_ADDR:
1164         case PW_TYPE_COMBO_IP_ADDR:
1165                 switch (ipaddr->af) {
1166                 case AF_INET:
1167                 if (ipaddr->prefix != 32) {
1168                         ERROR("Invalid IPv4 mask length \"/%i\".  Only \"/32\" permitted for non-prefix types",
1169                               ipaddr->prefix);
1170
1171                         return -1;
1172                 }
1173                         break;
1174
1175                 case AF_INET6:
1176                 if (ipaddr->prefix != 128) {
1177                         ERROR("Invalid IPv6 mask length \"/%i\".  Only \"/128\" permitted for non-prefix types",
1178                               ipaddr->prefix);
1179
1180                         return -1;
1181                 }
1182                         break;
1183
1184                 default:
1185                         return -1;
1186                 }
1187         default:
1188                 return 0;
1189         }
1190 }
1191
1192 /** Parses a #CONF_PAIR into a C data type, with a default value.
1193  *
1194  * Takes fields from a #CONF_PARSER struct and uses them to parse the string value
1195  * of a #CONF_PAIR into a C data type matching the type argument.
1196  *
1197  * The format of the types are the same as #value_data_t types.
1198  *
1199  * @note The dflt value will only be used if no matching #CONF_PAIR is found. Empty strings will not
1200  *       result in the dflt value being used.
1201  *
1202  * @param cs to search for matching #CONF_PAIR in.
1203  * @param name of #CONF_PAIR to search for.
1204  * @param type Data type to parse #CONF_PAIR value as.
1205  *      Should be one of the following ``data`` types, and one or more of the following ``flag`` types or'd together:
1206  *      - ``data`` #PW_TYPE_TMPL                - @copybrief PW_TYPE_TMPL
1207                                                   Feeds the value into #tmpl_afrom_str. Value can be
1208  *                                                obtained when processing requests, with #tmpl_expand or #tmpl_aexpand.
1209  *      - ``data`` #PW_TYPE_BOOLEAN             - @copybrief PW_TYPE_BOOLEAN
1210  *      - ``data`` #PW_TYPE_INTEGER             - @copybrief PW_TYPE_INTEGER
1211  *      - ``data`` #PW_TYPE_SHORT               - @copybrief PW_TYPE_SHORT
1212  *      - ``data`` #PW_TYPE_INTEGER64           - @copybrief PW_TYPE_INTEGER64
1213  *      - ``data`` #PW_TYPE_SIGNED              - @copybrief PW_TYPE_SIGNED
1214  *      - ``data`` #PW_TYPE_STRING              - @copybrief PW_TYPE_STRING
1215  *      - ``data`` #PW_TYPE_IPV4_ADDR           - @copybrief PW_TYPE_IPV4_ADDR (IPv4 address with prefix 32).
1216  *      - ``data`` #PW_TYPE_IPV4_PREFIX         - @copybrief PW_TYPE_IPV4_PREFIX (IPv4 address with variable prefix).
1217  *      - ``data`` #PW_TYPE_IPV6_ADDR           - @copybrief PW_TYPE_IPV6_ADDR (IPv6 address with prefix 128).
1218  *      - ``data`` #PW_TYPE_COMBO_IP_ADDR       - @copybrief PW_TYPE_COMBO_IP_ADDR (IPv4/IPv6 address with
1219                                                   prefix 32/128).
1220  *      - ``data`` #PW_TYPE_COMBO_IP_PREFIX     - @copybrief PW_TYPE_COMBO_IP_PREFIX (IPv4/IPv6 address with
1221  *                                                variable prefix).
1222  *      - ``data`` #PW_TYPE_TIMEVAL             - @copybrief PW_TYPE_TIMEVAL
1223  *      - ``flag`` #PW_TYPE_DEPRECATED          - @copybrief PW_TYPE_DEPRECATED
1224  *      - ``flag`` #PW_TYPE_REQUIRED            - @copybrief PW_TYPE_REQUIRED
1225  *      - ``flag`` #PW_TYPE_ATTRIBUTE           - @copybrief PW_TYPE_ATTRIBUTE
1226  *      - ``flag`` #PW_TYPE_SECRET              - @copybrief PW_TYPE_SECRET
1227  *      - ``flag`` #PW_TYPE_FILE_INPUT          - @copybrief PW_TYPE_FILE_INPUT
1228  *      - ``flag`` #PW_TYPE_NOT_EMPTY           - @copybrief PW_TYPE_NOT_EMPTY
1229  * @param data Pointer to a global variable, or pointer to a field in the struct being populated with values.
1230  * @param dflt value to use, if no #CONF_PAIR is found.
1231  * @return -1 on error, -2 if deprecated, 0 on success (correctly parsed), 1 if default value was used.
1232  */
1233 int cf_item_parse(CONF_SECTION *cs, char const *name, unsigned int type, void *data, char const *dflt)
1234 {
1235         int rcode;
1236         bool deprecated, required, attribute, secret, file_input, cant_be_empty, tmpl, multi;
1237         char **q;
1238         char const *value;
1239         CONF_PAIR *cp = NULL;
1240         fr_ipaddr_t *ipaddr;
1241         char buffer[8192];
1242
1243         if (!cs) return -1;
1244
1245         deprecated = (type & PW_TYPE_DEPRECATED);
1246         required = (type & PW_TYPE_REQUIRED);
1247         attribute = (type & PW_TYPE_ATTRIBUTE);
1248         secret = (type & PW_TYPE_SECRET);
1249         file_input = (type == PW_TYPE_FILE_INPUT);      /* check, not and */
1250         cant_be_empty = (type & PW_TYPE_NOT_EMPTY);
1251         tmpl = (type & PW_TYPE_TMPL);
1252         multi = (type & PW_TYPE_MULTI);
1253
1254         if (attribute) required = true;
1255         if (required) cant_be_empty = true;     /* May want to review this in the future... */
1256
1257         /*
1258          *      Everything except templates must have a base type.
1259          */
1260         if (!(type & 0xff) && !tmpl) {
1261                 cf_log_err(&(cs->item), "Configuration item '%s' must have a data type", name);
1262                 return -1;
1263         }
1264
1265         type &= 0xff;                           /* normal types are small */
1266
1267         rcode = 0;
1268
1269         cp = cf_pair_find(cs, name);
1270
1271         /*
1272          *      No pairs match the configuration item name in the current
1273          *      section, use the default value.
1274          */
1275         if (!cp) {
1276                 rcode = 1;
1277                 value = dflt;
1278         /*
1279          *      Something matched, used the CONF_PAIR value.
1280          */
1281         } else {
1282                 CONF_PAIR *next = cp;
1283                 value = cp->value;
1284                 cp->parsed = true;
1285
1286                 /*
1287                  *      @fixme We should actually validate
1288                  *      the value of the pairs too
1289                  */
1290                 if (multi) while ((next = cf_pair_find_next(cs, next, name))) {
1291                         next->parsed = true;
1292                 }
1293         }
1294
1295         if (!value) {
1296                 if (required) {
1297                 is_required:
1298                         if (!cp) {
1299                                 cf_log_err(&(cs->item), "Configuration item '%s' must have a value", name);
1300                         } else {
1301                                 cf_log_err(&(cp->item), "Configuration item '%s' must have a value", name);
1302                         }
1303                         return -1;
1304                 }
1305                 return rcode;
1306         }
1307
1308         if ((value[0] == '\0') && cant_be_empty) {
1309         cant_be_empty:
1310                 if (!cp) {
1311                         cf_log_err(&(cs->item), "Configuration item '%s' must not be empty (zero length)", name);
1312                         if (!required) cf_log_err(&(cs->item), "Comment item to silence this message");
1313                 } else {
1314                         cf_log_err(&(cp->item), "Configuration item '%s' must not be empty (zero length)", name);
1315                         if (!required) cf_log_err(&(cp->item), "Comment item to silence this message");
1316                 }
1317                 return -1;
1318         }
1319
1320         if (deprecated) {
1321                 cf_log_err(&(cs->item), "Configuration item \"%s\" is deprecated", name);
1322
1323                 return -2;
1324         }
1325
1326         /*
1327          *      Process a value as a LITERAL template.  Once all of
1328          *      the attrs and xlats are defined, the pass2 code
1329          *      converts it to the appropriate type.
1330          */
1331         if (tmpl) {
1332                 vp_tmpl_t *vpt;
1333
1334                 if (!value) {
1335                         *(vp_tmpl_t **)data = NULL;
1336                         return 0;
1337                 }
1338
1339                 rad_assert(!attribute);
1340                 vpt = tmpl_alloc(cs, TMPL_TYPE_LITERAL, value, strlen(value));
1341                 *(vp_tmpl_t **)data = vpt;
1342
1343                 return 0;
1344         }
1345
1346         switch (type) {
1347         case PW_TYPE_BOOLEAN:
1348                 /*
1349                  *      Allow yes/no, true/false, and on/off
1350                  */
1351                 if ((strcasecmp(value, "yes") == 0) ||
1352                     (strcasecmp(value, "true") == 0) ||
1353                     (strcasecmp(value, "on") == 0)) {
1354                         *(bool *)data = true;
1355                 } else if ((strcasecmp(value, "no") == 0) ||
1356                            (strcasecmp(value, "false") == 0) ||
1357                            (strcasecmp(value, "off") == 0)) {
1358                         *(bool *)data = false;
1359                 } else {
1360                         *(bool *)data = false;
1361                         cf_log_err(&(cs->item), "Invalid value \"%s\" for boolean "
1362                                "variable %s", value, name);
1363                         return -1;
1364                 }
1365                 cf_log_info(cs, "%.*s\t%s = %s",
1366                             cs->depth, parse_spaces, name, value);
1367                 break;
1368
1369         case PW_TYPE_INTEGER:
1370         {
1371                 unsigned long v = strtoul(value, 0, 0);
1372
1373                 /*
1374                  *      Restrict integer values to 0-INT32_MAX, this means
1375                  *      it will always be safe to cast them to a signed type
1376                  *      for comparisons, and imposes the same range limit as
1377                  *      before we switched to using an unsigned type to
1378                  *      represent config item integers.
1379                  */
1380                 if (v > INT32_MAX) {
1381                         cf_log_err(&(cs->item), "Invalid value \"%s\" for variable %s, must be between 0-%u", value,
1382                                    name, INT32_MAX);
1383                         return -1;
1384                 }
1385
1386                 *(uint32_t *)data = v;
1387                 cf_log_info(cs, "%.*s\t%s = %u", cs->depth, parse_spaces, name, *(uint32_t *)data);
1388         }
1389                 break;
1390
1391         case PW_TYPE_SHORT:
1392         {
1393                 unsigned long v = strtoul(value, 0, 0);
1394
1395                 if (v > UINT16_MAX) {
1396                         cf_log_err(&(cs->item), "Invalid value \"%s\" for variable %s, must be between 0-%u", value,
1397                                    name, UINT16_MAX);
1398                         return -1;
1399                 }
1400                 *(uint16_t *)data = (uint16_t) v;
1401                 cf_log_info(cs, "%.*s\t%s = %u", cs->depth, parse_spaces, name, *(uint16_t *)data);
1402         }
1403                 break;
1404
1405         case PW_TYPE_INTEGER64:
1406                 *(uint64_t *)data = strtoull(value, 0, 0);
1407                 cf_log_info(cs, "%.*s\t%s = %" PRIu64, cs->depth, parse_spaces, name, *(uint64_t *)data);
1408                 break;
1409
1410         case PW_TYPE_SIGNED:
1411                 *(int32_t *)data = strtol(value, 0, 0);
1412                 cf_log_info(cs, "%.*s\t%s = %d", cs->depth, parse_spaces, name, *(int32_t *)data);
1413                 break;
1414
1415         case PW_TYPE_STRING:
1416                 q = (char **) data;
1417                 if (*q != NULL) {
1418                         talloc_free(*q);
1419                 }
1420
1421                 /*
1422                  *      Expand variables which haven't already been
1423                  *      expanded automagically when the configuration
1424                  *      file was read.
1425                  */
1426                 if (value == dflt) {
1427                         int lineno = 0;
1428
1429                         lineno = cs->item.lineno;
1430
1431                         value = cf_expand_variables("<internal>",
1432                                                     &lineno,
1433                                                     cs, buffer, sizeof(buffer),
1434                                                     value, NULL);
1435                         if (!value) {
1436                                 cf_log_err(&(cs->item),"Failed expanding variable %s", name);
1437                                 return -1;
1438                         }
1439                 }
1440
1441                 if (required && !value) goto is_required;
1442                 if (cant_be_empty && (value[0] == '\0')) goto cant_be_empty;
1443
1444                 if (attribute) {
1445                         if (!dict_attrbyname(value)) {
1446                                 if (!cp) {
1447                                         cf_log_err(&(cs->item), "No such attribute '%s' for configuration '%s'",
1448                                                    value, name);
1449                                 } else {
1450                                         cf_log_err(&(cp->item), "No such attribute '%s'", value);
1451                                 }
1452                                 return -1;
1453                         }
1454                 }
1455
1456                 /*
1457                  *      Hide secrets when using "radiusd -X".
1458                  */
1459                 if (secret && (rad_debug_lvl <= 2)) {
1460                         cf_log_info(cs, "%.*s\t%s = <<< secret >>>",
1461                                     cs->depth, parse_spaces, name);
1462                 } else {
1463                         cf_log_info(cs, "%.*s\t%s = \"%s\"",
1464                                     cs->depth, parse_spaces, name, value ? value : "(null)");
1465                 }
1466                 *q = value ? talloc_typed_strdup(cs, value) : NULL;
1467
1468                 /*
1469                  *      If there's data AND it's an input file, check
1470                  *      that we can read it.  This check allows errors
1471                  *      to be caught as early as possible, during
1472                  *      server startup.
1473                  */
1474                 if (*q && file_input) {
1475                         struct stat buf;
1476
1477                         if (stat(*q, &buf) < 0) {
1478                                 char user[255], group[255];
1479
1480                                 ERROR("Unable to open file \"%s\": %s", value, fr_syserror(errno));
1481                                 ERROR("Our effective user and group was %s:%s",
1482                                       (rad_prints_uid(NULL, user, sizeof(user), geteuid()) < 0) ?
1483                                       "unknown" : user,
1484                                       (rad_prints_gid(NULL, group, sizeof(group), getegid()) < 0) ?
1485                                       "unknown" : group );
1486
1487                                 return -1;
1488                         }
1489                 }
1490                 break;
1491
1492         case PW_TYPE_IPV4_ADDR:
1493         case PW_TYPE_IPV4_PREFIX:
1494                 ipaddr = data;
1495
1496                 if (fr_pton4(ipaddr, value, -1, true, false) < 0) {
1497                         ERROR("%s", fr_strerror());
1498                         return -1;
1499                 }
1500                 if (fr_item_validate_ipaddr(cs, name, type, value, ipaddr) < 0) return -1;
1501                 break;
1502
1503         case PW_TYPE_IPV6_ADDR:
1504         case PW_TYPE_IPV6_PREFIX:
1505                 ipaddr = data;
1506
1507                 if (fr_pton6(ipaddr, value, -1, true, false) < 0) {
1508                         ERROR("%s", fr_strerror());
1509                         return -1;
1510                 }
1511                 if (fr_item_validate_ipaddr(cs, name, type, value, ipaddr) < 0) return -1;
1512                 break;
1513
1514         case PW_TYPE_COMBO_IP_ADDR:
1515         case PW_TYPE_COMBO_IP_PREFIX:
1516                 ipaddr = data;
1517
1518                 if (fr_pton(ipaddr, value, -1, true) < 0) {
1519                         ERROR("%s", fr_strerror());
1520                         return -1;
1521                 }
1522                 if (fr_item_validate_ipaddr(cs, name, type, value, ipaddr) < 0) return -1;
1523                 break;
1524
1525         case PW_TYPE_TIMEVAL: {
1526                 int sec;
1527                 char *end;
1528                 struct timeval tv;
1529
1530                 sec = strtoul(value, &end, 10);
1531                 tv.tv_sec = sec;
1532                 tv.tv_usec = 0;
1533                 if (*end == '.') {
1534                         size_t len;
1535
1536                         len = strlen(end + 1);
1537
1538                         if (len > 6) {
1539                                 ERROR("Too much precision for timeval");
1540                                 return -1;
1541                         }
1542
1543                         /*
1544                          *      If they write "0.1", that means
1545                          *      "10000" microseconds.
1546                          */
1547                         sec = strtoul(end + 1, NULL, 10);
1548                         while (len < 6) {
1549                                 sec *= 10;
1550                                 len++;
1551                         }
1552
1553                         tv.tv_usec = sec;
1554                 }
1555                 cf_log_info(cs, "%.*s\t%s = %d.%06d",
1556                             cs->depth, parse_spaces, name, (int) tv.tv_sec, (int) tv.tv_usec);
1557                 memcpy(data, &tv, sizeof(tv));
1558                 }
1559                 break;
1560
1561         default:
1562                 /*
1563                  *      If we get here, it's a sanity check error.
1564                  *      It's not an error parsing the configuration
1565                  *      file.
1566                  */
1567                 rad_assert(type > PW_TYPE_INVALID);
1568                 rad_assert(type < PW_TYPE_MAX);
1569
1570                 ERROR("type '%s' is not supported in the configuration files",
1571                        fr_int2str(dict_attr_types, type, "?Unknown?"));
1572                 return -1;
1573         } /* switch over variable type */
1574
1575         if (!cp) {
1576                 CONF_PAIR *cpn;
1577
1578                 cpn = cf_pair_alloc(cs, name, value, T_OP_SET, T_BARE_WORD, T_BARE_WORD);
1579                 if (!cpn) return -1;
1580                 cpn->parsed = true;
1581                 cpn->item.filename = "<internal>";
1582                 cpn->item.lineno = 0;
1583                 cf_item_add(cs, &(cpn->item));
1584         }
1585
1586         return rcode;
1587 }
1588
1589
1590 /*
1591  *      A copy of cf_section_parse that initializes pointers before
1592  *      parsing them.
1593  */
1594 static void cf_section_parse_init(CONF_SECTION *cs, void *base,
1595                                   CONF_PARSER const *variables)
1596 {
1597         int i;
1598
1599         for (i = 0; variables[i].name != NULL; i++) {
1600                 if (variables[i].type == PW_TYPE_SUBSECTION) {
1601                         CONF_SECTION *subcs;
1602
1603                         if (!variables[i].dflt) continue;
1604
1605                         subcs = cf_section_sub_find(cs, variables[i].name);
1606
1607                         /*
1608                          *      If there's no subsection in the
1609                          *      config, BUT the CONF_PARSER wants one,
1610                          *      then create an empty one.  This is so
1611                          *      that we can track the strings,
1612                          *      etc. allocated in the subsection.
1613                          */
1614                         if (!subcs) {
1615                                 subcs = cf_section_alloc(cs, variables[i].name, NULL);
1616                                 if (!subcs) return;
1617
1618                                 subcs->item.filename = cs->item.filename;
1619                                 subcs->item.lineno = cs->item.lineno;
1620                                 cf_item_add(cs, &(subcs->item));
1621                         }
1622
1623                         cf_section_parse_init(subcs, (uint8_t *)base + variables[i].offset,
1624                                               (CONF_PARSER const *) variables[i].dflt);
1625                         continue;
1626                 }
1627
1628                 if ((variables[i].type != PW_TYPE_STRING) &&
1629                     (variables[i].type != PW_TYPE_FILE_INPUT) &&
1630                     (variables[i].type != PW_TYPE_FILE_OUTPUT)) {
1631                         continue;
1632                 }
1633
1634                 if (variables[i].data) {
1635                         *(char **) variables[i].data = NULL;
1636                 } else if (base) {
1637                         *(char **) (((char *)base) + variables[i].offset) = NULL;
1638                 } else {
1639                         continue;
1640                 }
1641         } /* for all variables in the configuration section */
1642 }
1643
1644
1645 static void cf_section_parse_warn(CONF_SECTION *cs)
1646 {
1647         CONF_ITEM *ci;
1648
1649         for (ci = cs->children; ci; ci = ci->next) {
1650                 /*
1651                  *      Don't recurse on sections. We can only safely
1652                  *      check conf pairs at the same level as the
1653                  *      section that was just parsed.
1654                  */
1655                 if (ci->type == CONF_ITEM_SECTION) continue;
1656                 if (ci->type == CONF_ITEM_PAIR) {
1657                         CONF_PAIR *cp;
1658
1659                         cp = cf_item_to_pair(ci);
1660                         if (cp->parsed) continue;
1661
1662                         WARN("%s[%d]: The item '%s' is defined, but is unused by the configuration",
1663                              cp->item.filename ? cp->item.filename : "unknown",
1664                              cp->item.lineno ? cp->item.lineno : 0,
1665                                 cp->attr);
1666                 }
1667
1668                 /*
1669                  *      Skip everything else.
1670                  */
1671         }
1672 }
1673
1674 /*
1675  *      Parse a configuration section into user-supplied variables.
1676  */
1677 int cf_section_parse(CONF_SECTION *cs, void *base,
1678                      CONF_PARSER const *variables)
1679 {
1680         int ret;
1681         int i;
1682         void *data;
1683
1684         cs->variables = variables; /* this doesn't hurt anything */
1685
1686         if (!cs->name2) {
1687                 cf_log_info(cs, "%.*s%s {", cs->depth, parse_spaces,
1688                        cs->name1);
1689         } else {
1690                 cf_log_info(cs, "%.*s%s %s {", cs->depth, parse_spaces,
1691                        cs->name1, cs->name2);
1692         }
1693
1694         cf_section_parse_init(cs, base, variables);
1695
1696         /*
1697          *      Handle the known configuration parameters.
1698          */
1699         for (i = 0; variables[i].name != NULL; i++) {
1700                 /*
1701                  *      Handle subsections specially
1702                  */
1703                 if (variables[i].type == PW_TYPE_SUBSECTION) {
1704                         CONF_SECTION *subcs;
1705
1706                         subcs = cf_section_sub_find(cs, variables[i].name);
1707                         /*
1708                          *      Default in this case is overloaded to mean a pointer
1709                          *      to the CONF_PARSER struct for the subsection.
1710                          */
1711                         if (!variables[i].dflt || !subcs) {
1712                                 ERROR("Internal sanity check 1 failed in cf_section_parse %s", variables[i].name);
1713                                 goto error;
1714                         }
1715
1716                         if (cf_section_parse(subcs, (uint8_t *)base + variables[i].offset,
1717                                              (CONF_PARSER const *) variables[i].dflt) < 0) goto error;
1718                         continue;
1719                 } /* else it's a CONF_PAIR */
1720
1721                 if (variables[i].data) {
1722                         data = variables[i].data; /* prefer this. */
1723                 } else if (base) {
1724                         data = ((char *)base) + variables[i].offset;
1725                 } else {
1726                         DEBUG2("Internal sanity check 2 failed in cf_section_parse");
1727                         goto error;
1728                 }
1729
1730                 /*
1731                  *      Parse the pair we found, or a default value.
1732                  */
1733                 ret = cf_item_parse(cs, variables[i].name, variables[i].type, data, variables[i].dflt);
1734                 if (ret < 0) {
1735                         /*
1736                          *      Be nice, and print the name of the new config item.
1737                          */
1738                         if ((ret == -2) && (variables[i + 1].offset == variables[i].offset) &&
1739                             (variables[i + 1].data == variables[i].data)) {
1740                                 cf_log_err(&(cs->item), "Replace \"%s\" with \"%s\"", variables[i].name,
1741                                            variables[i + 1].name);
1742                         }
1743
1744                         goto error;
1745                 }
1746         } /* for all variables in the configuration section */
1747
1748         /*
1749          *      Warn about items in the configuration which weren't
1750          *      checked during parsing.
1751          */
1752         if (rad_debug_lvl >= 3) cf_section_parse_warn(cs);
1753
1754         cf_log_info(cs, "%.*s}", cs->depth, parse_spaces);
1755
1756         cs->base = base;
1757
1758         return 0;
1759
1760  error:
1761         cf_log_info(cs, "%.*s}", cs->depth, parse_spaces);
1762         return -1;
1763 }
1764
1765
1766 /*
1767  *      Check XLAT things in pass 2.  But don't cache the xlat stuff anywhere.
1768  */
1769 int cf_section_parse_pass2(CONF_SECTION *cs, void *base, CONF_PARSER const *variables)
1770 {
1771         int i;
1772         ssize_t slen;
1773         char const *error;
1774         char *value = NULL;
1775         xlat_exp_t *xlat;
1776
1777         /*
1778          *      Handle the known configuration parameters.
1779          */
1780         for (i = 0; variables[i].name != NULL; i++) {
1781                 CONF_PAIR *cp;
1782                 void *data;
1783
1784                 /*
1785                  *      Handle subsections specially
1786                  */
1787                 if (variables[i].type == PW_TYPE_SUBSECTION) {
1788                         CONF_SECTION *subcs;
1789                         subcs = cf_section_sub_find(cs, variables[i].name);
1790
1791                         if (cf_section_parse_pass2(subcs, (uint8_t *)base + variables[i].offset,
1792                                                    (CONF_PARSER const *) variables[i].dflt) < 0) {
1793                                 return -1;
1794                         }
1795                         continue;
1796                 } /* else it's a CONF_PAIR */
1797
1798                 /*
1799                  *      Figure out which data we need to fix.
1800                  */
1801                 if (variables[i].data) {
1802                         data = variables[i].data; /* prefer this. */
1803                 } else if (base) {
1804                         data = ((char *)base) + variables[i].offset;
1805                 } else {
1806                         data = NULL;
1807                 }
1808
1809                 cp = cf_pair_find(cs, variables[i].name);
1810                 xlat = NULL;
1811
1812         redo:
1813                 if (!cp || !cp->value || !data) continue;
1814
1815                 if ((cp->rhs_type != T_DOUBLE_QUOTED_STRING) &&
1816                     (cp->rhs_type != T_BARE_WORD)) continue;
1817
1818                 /*
1819                  *      Non-xlat expansions shouldn't have xlat!
1820                  */
1821                 if (((variables[i].type & PW_TYPE_XLAT) == 0) &&
1822                     ((variables[i].type & PW_TYPE_TMPL) == 0)) {
1823                         /*
1824                          *      Ignore %{... in shared secrets.
1825                          *      They're never dynamically expanded.
1826                          */
1827                         if ((variables[i].type & PW_TYPE_SECRET) != 0) continue;
1828
1829                         if (strstr(cp->value, "%{") != NULL) {
1830                                 WARN("%s[%d]: Found dynamic expansion in string which will not be dynamically expanded",
1831                                      cp->item.filename ? cp->item.filename : "unknown",
1832                                      cp->item.lineno ? cp->item.lineno : 0);
1833                         }
1834                         continue;
1835                 }
1836
1837                 /*
1838                  *      Parse (and throw away) the xlat string.
1839                  *
1840                  *      FIXME: All of these should be converted from PW_TYPE_XLAT
1841                  *      to PW_TYPE_TMPL.
1842                  */
1843                 if ((variables[i].type & PW_TYPE_XLAT) != 0) {
1844                         /*
1845                          *      xlat expansions should be parseable.
1846                          */
1847                         value = talloc_strdup(cs, cp->value); /* modified by xlat_tokenize */
1848                         xlat = NULL;
1849
1850                         slen = xlat_tokenize(cs, value, &xlat, &error);
1851                         if (slen < 0) {
1852                                 char *spaces, *text;
1853
1854                         error:
1855                                 fr_canonicalize_error(cs, &spaces, &text, slen, cp->value);
1856
1857                                 cf_log_err(&cp->item, "Failed parsing expanded string:");
1858                                 cf_log_err(&cp->item, "%s", text);
1859                                 cf_log_err(&cp->item, "%s^ %s", spaces, error);
1860
1861                                 talloc_free(spaces);
1862                                 talloc_free(text);
1863                                 talloc_free(value);
1864                                 talloc_free(xlat);
1865                                 return -1;
1866                         }
1867
1868                         talloc_free(value);
1869                         talloc_free(xlat);
1870                 }
1871
1872                 /*
1873                  *      Convert the LITERAL template to the actual
1874                  *      type.
1875                  */
1876                 if ((variables[i].type & PW_TYPE_TMPL) != 0) {
1877                         vp_tmpl_t *vpt;
1878
1879                         slen = tmpl_afrom_str(cs, &vpt, cp->value, talloc_array_length(cp->value) - 1,
1880                                               cp->rhs_type,
1881                                               REQUEST_CURRENT, PAIR_LIST_REQUEST, true);
1882                         if (slen < 0) {
1883                                 error = fr_strerror();
1884                                 goto error;
1885                         }
1886
1887                         /*
1888                          *      Sanity check
1889                          *
1890                          *      Don't add default - update with new types.
1891                          */
1892                         switch (vpt->type) {
1893                         /*
1894                          *      All attributes should have been defined by this point.
1895                          */
1896                         case TMPL_TYPE_ATTR_UNDEFINED:
1897                                 cf_log_err(&cp->item, "Unknown attribute '%s'", vpt->tmpl_unknown_name);
1898                                 return -1;
1899
1900                         case TMPL_TYPE_LITERAL:
1901                         case TMPL_TYPE_ATTR:
1902                         case TMPL_TYPE_LIST:
1903                         case TMPL_TYPE_DATA:
1904                         case TMPL_TYPE_EXEC:
1905                         case TMPL_TYPE_XLAT:
1906                         case TMPL_TYPE_XLAT_STRUCT:
1907                                 break;
1908
1909                         case TMPL_TYPE_UNKNOWN:
1910                         case TMPL_TYPE_REGEX:
1911                         case TMPL_TYPE_REGEX_STRUCT:
1912                         case TMPL_TYPE_NULL:
1913                                 rad_assert(0);
1914                         }
1915
1916                         talloc_free(*(vp_tmpl_t **)data);
1917                         *(vp_tmpl_t **)data = vpt;
1918                 }
1919
1920                 /*
1921                  *      If the "multi" flag is set, check all of them.
1922                  */
1923                 if ((variables[i].type & PW_TYPE_MULTI) != 0) {
1924                         cp = cf_pair_find_next(cs, cp, cp->attr);
1925                         goto redo;
1926                 }
1927         } /* for all variables in the configuration section */
1928
1929         return 0;
1930 }
1931
1932 /*
1933  *      Merge the template so everyting else "just works".
1934  */
1935 static bool cf_template_merge(CONF_SECTION *cs, CONF_SECTION const *template)
1936 {
1937         CONF_ITEM *ci;
1938
1939         if (!cs || !template) return true;
1940
1941         cs->template = NULL;
1942
1943         /*
1944          *      Walk over the template, adding its' entries to the
1945          *      current section.  But only if the entries don't
1946          *      already exist in the current section.
1947          */
1948         for (ci = template->children; ci; ci = ci->next) {
1949                 if (ci->type == CONF_ITEM_PAIR) {
1950                         CONF_PAIR *cp1, *cp2;
1951
1952                         /*
1953                          *      It exists, don't over-write it.
1954                          */
1955                         cp1 = cf_item_to_pair(ci);
1956                         if (cf_pair_find(cs, cp1->attr)) {
1957                                 continue;
1958                         }
1959
1960                         /*
1961                          *      Create a new pair with all of the data
1962                          *      of the old one.
1963                          */
1964                         cp2 = cf_pair_dup(cs, cp1);
1965                         if (!cp2) return false;
1966
1967                         cp2->item.filename = cp1->item.filename;
1968                         cp2->item.lineno = cp1->item.lineno;
1969
1970                         cf_item_add(cs, &(cp2->item));
1971                         continue;
1972                 }
1973
1974                 if (ci->type == CONF_ITEM_SECTION) {
1975                         CONF_SECTION *subcs1, *subcs2;
1976
1977                         subcs1 = cf_item_to_section(ci);
1978                         rad_assert(subcs1 != NULL);
1979
1980                         subcs2 = cf_section_sub_find_name2(cs, subcs1->name1, subcs1->name2);
1981                         if (subcs2) {
1982                                 /*
1983                                  *      sub-sections get merged.
1984                                  */
1985                                 if (!cf_template_merge(subcs2, subcs1)) {
1986                                         return false;
1987                                 }
1988                                 continue;
1989                         }
1990
1991                         /*
1992                          *      Our section doesn't have a matching
1993                          *      sub-section.  Copy it verbatim from
1994                          *      the template.
1995                          */
1996                         subcs2 = cf_section_dup(cs, subcs1,
1997                                                 cf_section_name1(subcs1), cf_section_name2(subcs1),
1998                                                 false);
1999                         if (!subcs2) return false;
2000
2001                         subcs2->item.filename = subcs1->item.filename;
2002                         subcs2->item.lineno = subcs1->item.lineno;
2003
2004                         cf_item_add(cs, &(subcs2->item));
2005                         continue;
2006                 }
2007
2008                 /* ignore everything else */
2009         }
2010
2011         return true;
2012 }
2013
2014 static char const *cf_local_file(char const *base, char const *filename,
2015                                  char *buffer, size_t bufsize)
2016 {
2017         size_t dirsize;
2018         char *p;
2019
2020         strlcpy(buffer, base, bufsize);
2021
2022         p = strrchr(buffer, FR_DIR_SEP);
2023         if (!p) return filename;
2024         if (p[1]) {             /* ./foo */
2025                 p[1] = '\0';
2026         }
2027
2028         dirsize = (p - buffer) + 1;
2029
2030         if ((dirsize + strlen(filename)) >= bufsize) {
2031                 return NULL;
2032         }
2033
2034         strlcpy(p + 1, filename, bufsize - dirsize);
2035
2036         return buffer;
2037 }
2038
2039
2040 /*
2041  *      Read a part of the config file.
2042  */
2043 static int cf_section_read(char const *filename, int *lineno, FILE *fp,
2044                            CONF_SECTION *current)
2045
2046 {
2047         CONF_SECTION *this, *css;
2048         CONF_PAIR *cpn;
2049         char const *ptr;
2050         char const *value;
2051         char buf[8192];
2052         char buf1[8192];
2053         char buf2[8192];
2054         char buf3[8192];
2055         char buf4[8192];
2056         FR_TOKEN t1 = T_INVALID, t2, t3;
2057         bool has_spaces = false;
2058         bool pass2;
2059         char *cbuf = buf;
2060         size_t len;
2061
2062         this = current;         /* add items here */
2063
2064         /*
2065          *      Read, checking for line continuations ('\\' at EOL)
2066          */
2067         for (;;) {
2068                 int at_eof;
2069                 css = NULL;
2070
2071                 /*
2072                  *      Get data, and remember if we are at EOF.
2073                  */
2074                 at_eof = (fgets(cbuf, sizeof(buf) - (cbuf - buf), fp) == NULL);
2075                 (*lineno)++;
2076
2077                 /*
2078                  *      We read the entire 8k worth of data: complain.
2079                  *      Note that we don't care if the last character
2080                  *      is \n: it's still forbidden.  This means that
2081                  *      the maximum allowed length of text is 8k-1, which
2082                  *      should be plenty.
2083                  */
2084                 len = strlen(cbuf);
2085                 if ((cbuf + len + 1) >= (buf + sizeof(buf))) {
2086                         ERROR("%s[%d]: Line too long",
2087                                filename, *lineno);
2088                         return -1;
2089                 }
2090
2091                 if (has_spaces) {
2092                         ptr = cbuf;
2093                         while (isspace((int) *ptr)) ptr++;
2094
2095                         if (ptr > cbuf) {
2096                                 memmove(cbuf, ptr, len - (ptr - cbuf));
2097                                 len -= (ptr - cbuf);
2098                         }
2099                 }
2100
2101                 /*
2102                  *      Not doing continuations: check for edge
2103                  *      conditions.
2104                  */
2105                 if (cbuf == buf) {
2106                         if (at_eof) break;
2107
2108                         ptr = buf;
2109                         while (*ptr && isspace((int) *ptr)) ptr++;
2110
2111                         if (!*ptr || (*ptr == '#')) continue;
2112
2113                 } else if (at_eof || (len == 0)) {
2114                         ERROR("%s[%d]: Continuation at EOF is illegal",
2115                                filename, *lineno);
2116                         return -1;
2117                 }
2118
2119                 /*
2120                  *      See if there's a continuation.
2121                  */
2122                 while ((len > 0) &&
2123                        ((cbuf[len - 1] == '\n') || (cbuf[len - 1] == '\r'))) {
2124                         len--;
2125                         cbuf[len] = '\0';
2126                 }
2127
2128                 if ((len > 0) && (cbuf[len - 1] == '\\')) {
2129                         /*
2130                          *      Check for "suppress spaces" magic.
2131                          */
2132                         if (!has_spaces && (len > 2) && (cbuf[len - 2] == '"')) {
2133                                 has_spaces = true;
2134                         }
2135
2136                         cbuf[len - 1] = '\0';
2137                         cbuf += len - 1;
2138                         continue;
2139                 }
2140
2141                 ptr = cbuf = buf;
2142                 has_spaces = false;
2143
2144         get_more:
2145                 pass2 = false;
2146
2147                 /*
2148                  *      The parser is getting to be evil.
2149                  */
2150                 while ((*ptr == ' ') || (*ptr == '\t')) ptr++;
2151
2152                 if (((ptr[0] == '%') && (ptr[1] == '{')) ||
2153                     (ptr[0] == '`')) {
2154                         int hack;
2155
2156                         if (ptr[0] == '%') {
2157                                 hack = rad_copy_variable(buf1, ptr);
2158                         } else {
2159                                 hack = rad_copy_string(buf1, ptr);
2160                         }
2161                         if (hack < 0) {
2162                                 ERROR("%s[%d]: Invalid expansion: %s",
2163                                        filename, *lineno, ptr);
2164                                 return -1;
2165                         }
2166
2167                         ptr += hack;
2168
2169                         t2 = gettoken(&ptr, buf2, sizeof(buf2), true);
2170                         switch (t2) {
2171                         case T_EOL:
2172                         case T_HASH:
2173                                 goto do_bare_word;
2174
2175                         default:
2176                                 ERROR("%s[%d]: Invalid expansion: %s",
2177                                        filename, *lineno, ptr);
2178                                 return -1;
2179                         }
2180                 } else {
2181                         t1 = gettoken(&ptr, buf1, sizeof(buf1), true);
2182                 }
2183
2184                 /*
2185                  *      The caller eats "name1 name2 {", and calls us
2186                  *      for the data inside of the section.  So if we
2187                  *      receive a closing brace, then it must mean the
2188                  *      end of the section.
2189                  */
2190                if (t1 == T_RCBRACE) {
2191                        if (this == current) {
2192                                ERROR("%s[%d]: Too many closing braces",
2193                                       filename, *lineno);
2194                                return -1;
2195                        }
2196
2197                        /*
2198                         *       Merge the template into the existing
2199                         *       section.  This uses more memory, but
2200                         *       means that templates now work with
2201                         *       sub-sections, etc.
2202                         */
2203                        if (!cf_template_merge(this, this->template)) {
2204                                return -1;
2205                        }
2206
2207                        this = this->item.parent;
2208                        goto check_for_more;
2209                }
2210
2211                if (t1 != T_BARE_WORD) goto skip_keywords;
2212
2213                 /*
2214                  *      Allow for $INCLUDE files
2215                  *
2216                  *      This *SHOULD* work for any level include.
2217                  *      I really really really hate this file.  -cparker
2218                  */
2219                if ((strcasecmp(buf1, "$INCLUDE") == 0) ||
2220                    (strcasecmp(buf1, "$-INCLUDE") == 0)) {
2221                         bool relative = true;
2222
2223                         t2 = getword(&ptr, buf2, sizeof(buf2), true);
2224                         if (t2 != T_EOL) {
2225                                ERROR("%s[%d]: Unexpected text after $INCLUDE",
2226                                      filename, *lineno);
2227                                return -1;
2228                         }
2229
2230                         if (buf2[0] == '$') relative = false;
2231
2232                         value = cf_expand_variables(filename, lineno, this, buf4, sizeof(buf4), buf2, NULL);
2233                         if (!value) return -1;
2234
2235                         if (!FR_DIR_IS_RELATIVE(value)) relative = false;
2236
2237                         if (relative) {
2238                                 value = cf_local_file(filename, value, buf3,
2239                                                       sizeof(buf3));
2240                                 if (!value) {
2241                                         ERROR("%s[%d]: Directories too deep.",
2242                                                filename, *lineno);
2243                                         return -1;
2244                                 }
2245                         }
2246
2247
2248 #ifdef HAVE_DIRENT_H
2249                         /*
2250                          *      $INCLUDE foo/
2251                          *
2252                          *      Include ALL non-"dot" files in the directory.
2253                          *      careful!
2254                          */
2255                         if (value[strlen(value) - 1] == '/') {
2256                                 DIR             *dir;
2257                                 struct dirent   *dp;
2258                                 struct stat stat_buf;
2259
2260                                 DEBUG2("including files in directory %s", value );
2261 #ifdef S_IWOTH
2262                                 /*
2263                                  *      Security checks.
2264                                  */
2265                                 if (stat(value, &stat_buf) < 0) {
2266                                         ERROR("%s[%d]: Failed reading directory %s: %s",
2267                                                filename, *lineno,
2268                                                value, fr_syserror(errno));
2269                                         return -1;
2270                                 }
2271
2272                                 if ((stat_buf.st_mode & S_IWOTH) != 0) {
2273                                         ERROR("%s[%d]: Directory %s is globally writable.  Refusing to start due to "
2274                                               "insecure configuration", filename, *lineno, value);
2275                                         return -1;
2276                                 }
2277 #endif
2278                                 dir = opendir(value);
2279                                 if (!dir) {
2280                                         ERROR("%s[%d]: Error reading directory %s: %s",
2281                                                filename, *lineno, value,
2282                                                fr_syserror(errno));
2283                                         return -1;
2284                                 }
2285
2286                                 /*
2287                                  *      Read the directory, ignoring "." files.
2288                                  */
2289                                 while ((dp = readdir(dir)) != NULL) {
2290                                         char const *p;
2291
2292                                         if (dp->d_name[0] == '.') continue;
2293
2294                                         /*
2295                                          *      Check for valid characters
2296                                          */
2297                                         for (p = dp->d_name; *p != '\0'; p++) {
2298                                                 if (isalpha((int)*p) ||
2299                                                     isdigit((int)*p) ||
2300                                                     (*p == '-') ||
2301                                                     (*p == '_') ||
2302                                                     (*p == '.')) continue;
2303                                                 break;
2304                                         }
2305                                         if (*p != '\0') continue;
2306
2307                                         snprintf(buf2, sizeof(buf2), "%s%s",
2308                                                  value, dp->d_name);
2309                                         if ((stat(buf2, &stat_buf) != 0) ||
2310                                             S_ISDIR(stat_buf.st_mode)) continue;
2311                                         /*
2312                                          *      Read the file into the current
2313                                          *      configuration section.
2314                                          */
2315                                         if (cf_file_include(this, buf2) < 0) {
2316                                                 closedir(dir);
2317                                                 return -1;
2318                                         }
2319                                 }
2320                                 closedir(dir);
2321                         }  else
2322 #endif
2323                         { /* it was a normal file */
2324                                 if (buf1[1] == '-') {
2325                                         struct stat statbuf;
2326
2327                                         if (stat(value, &statbuf) < 0) {
2328                                                 WARN("Not including file %s: %s", value, fr_syserror(errno));
2329                                                 continue;
2330                                         }
2331                                 }
2332
2333                                 if (cf_file_include(this, value) < 0) {
2334                                         return -1;
2335                                 }
2336                         }
2337                         continue;
2338                 } /* we were in an include */
2339
2340                if (strcasecmp(buf1, "$template") == 0) {
2341                        CONF_ITEM *ci;
2342                        CONF_SECTION *parentcs, *templatecs;
2343                        t2 = getword(&ptr, buf2, sizeof(buf2), true);
2344
2345                        if (t2 != T_EOL) {
2346                                ERROR("%s[%d]: Unexpected text after $TEMPLATE", filename, *lineno);
2347                                return -1;
2348                        }
2349
2350                        parentcs = cf_top_section(current);
2351
2352                        templatecs = cf_section_sub_find(parentcs, "templates");
2353                        if (!templatecs) {
2354                                 ERROR("%s[%d]: No \"templates\" section for reference \"%s\"", filename, *lineno, buf2);
2355                                 return -1;
2356                        }
2357
2358                        ci = cf_reference_item(parentcs, templatecs, buf2);
2359                        if (!ci || (ci->type != CONF_ITEM_SECTION)) {
2360                                 ERROR("%s[%d]: Reference \"%s\" not found", filename, *lineno, buf2);
2361                                 return -1;
2362                        }
2363
2364                        if (!this) {
2365                                 ERROR("%s[%d]: Internal sanity check error in template reference", filename, *lineno);
2366                                 return -1;
2367                        }
2368
2369                        if (this->template) {
2370                                 ERROR("%s[%d]: Section already has a template", filename, *lineno);
2371                                 return -1;
2372                        }
2373
2374                        this->template = cf_item_to_section(ci);
2375                        continue;
2376                }
2377
2378                 /*
2379                  *      Ensure that the user can't add CONF_PAIRs
2380                  *      with 'internal' names;
2381                  */
2382                 if (buf1[0] == '_') {
2383                         ERROR("%s[%d]: Illegal configuration pair name \"%s\"", filename, *lineno, buf1);
2384                         return -1;
2385                 }
2386
2387                 /*
2388                  *      Handle if/elsif specially.
2389                  */
2390                 if ((strcmp(buf1, "if") == 0) || (strcmp(buf1, "elsif") == 0)) {
2391                         ssize_t slen;
2392                         char const *error = NULL;
2393                         char *p;
2394                         CONF_SECTION *server;
2395                         fr_cond_t *cond = NULL;
2396
2397                         /*
2398                          *      if / elsif MUST be inside of a
2399                          *      processing section, which MUST in turn
2400                          *      be inside of a "server" directive.
2401                          */
2402                         if (!this->item.parent) {
2403                         invalid_location:
2404                                 ERROR("%s[%d]: Invalid location for '%s'",
2405                                        filename, *lineno, buf1);
2406                                 return -1;
2407                         }
2408
2409                         /*
2410                          *      Can only have "if" in 3 named sections.
2411                          */
2412                         server = this->item.parent;
2413                         while (server &&
2414                                (strcmp(server->name1, "server") != 0) &&
2415                                (strcmp(server->name1, "policy") != 0) &&
2416                                (strcmp(server->name1, "instantiate") != 0)) {
2417                                 server = server->item.parent;
2418                                 if (!server) goto invalid_location;
2419                         }
2420
2421                         /*
2422                          *      Skip (...) to find the {
2423                          */
2424                         slen = fr_condition_tokenize(this, cf_section_to_item(this), ptr, &cond,
2425                                                      &error, FR_COND_TWO_PASS);
2426                         memcpy(&p, &ptr, sizeof(p));
2427
2428                         if (slen < 0) {
2429                                 if (p[-slen] != '{') goto cond_error;
2430                                 slen = -slen;
2431                         }
2432                         TALLOC_FREE(cond);
2433
2434                         /*
2435                          *      This hack is so that the NEXT stage
2436                          *      doesn't go "too far" in expanding the
2437                          *      variable.  We can parse the conditions
2438                          *      without expanding the ${...} stuff.
2439                          *      BUT we don't want to expand all of the
2440                          *      stuff AFTER the condition.  So we do
2441                          *      two passes.
2442                          *
2443                          *      The first pass is to discover the end
2444                          *      of the condition.  We then expand THAT
2445                          *      string, and do a second pass parsing
2446                          *      the expanded condition.
2447                          */
2448                         p += slen;
2449                         *p = '\0';
2450
2451                         /*
2452                          *      If there's a ${...}.  If so, expand it.
2453                          */
2454                         if (strchr(ptr, '$') != NULL) {
2455                                 ptr = cf_expand_variables(filename, lineno,
2456                                                           this,
2457                                                           buf3, sizeof(buf3),
2458                                                           ptr, NULL);
2459                                 if (!ptr) {
2460                                         ERROR("%s[%d]: Parse error expanding ${...} in condition",
2461                                               filename, *lineno);
2462                                         return -1;
2463                                 }
2464                         } /* else leave it alone */
2465
2466                         css = cf_section_alloc(this, buf1, ptr);
2467                         if (!css) {
2468                                 ERROR("%s[%d]: Failed allocating memory for section",
2469                                       filename, *lineno);
2470                                 return -1;
2471                         }
2472                         css->item.filename = filename;
2473                         css->item.lineno = *lineno;
2474
2475                         slen = fr_condition_tokenize(css, cf_section_to_item(css), ptr, &cond,
2476                                                      &error, FR_COND_TWO_PASS);
2477                         *p = '{'; /* put it back */
2478
2479                 cond_error:
2480                         if (slen < 0) {
2481                                 char *spaces, *text;
2482
2483                                 fr_canonicalize_error(this, &spaces, &text, slen, ptr);
2484
2485                                 ERROR("%s[%d]: Parse error in condition",
2486                                       filename, *lineno);
2487                                 ERROR("%s[%d]: %s", filename, *lineno, text);
2488                                 ERROR("%s[%d]: %s^ %s", filename, *lineno, spaces, error);
2489
2490                                 talloc_free(spaces);
2491                                 talloc_free(text);
2492                                 talloc_free(css);
2493                                 return -1;
2494                         }
2495
2496                         if ((size_t) slen >= (sizeof(buf2) - 1)) {
2497                                 talloc_free(css);
2498                                 ERROR("%s[%d]: Condition is too large after \"%s\"",
2499                                        filename, *lineno, buf1);
2500                                 return -1;
2501                         }
2502
2503                         /*
2504                          *      Copy the expanded and parsed condition
2505                          *      into buf2.  Then, parse the text after
2506                          *      the condition, which now MUST be a '{.
2507                          *
2508                          *      If it wasn't '{' it would have been
2509                          *      caught in the first pass of
2510                          *      conditional parsing, above.
2511                          */
2512                         memcpy(buf2, ptr, slen);
2513                         buf2[slen] = '\0';
2514                         ptr = p;
2515
2516                         if ((t3 = gettoken(&ptr, buf3, sizeof(buf3), true)) != T_LCBRACE) {
2517                                 talloc_free(css);
2518                                 ERROR("%s[%d]: Expected '{' %d",
2519                                       filename, *lineno, t3);
2520                                 return -1;
2521                         }
2522
2523                         /*
2524                          *      Swap the condition with trailing stuff for
2525                          *      the final condition.
2526                          */
2527                         memcpy(&p, &css->name2, sizeof(css->name2));
2528                         talloc_free(p);
2529                         css->name2 = talloc_typed_strdup(css, buf2);
2530
2531                         cf_item_add(this, &(css->item));
2532                         cf_data_add_internal(css, "if", cond, NULL, false);
2533
2534                         /*
2535                          *      The current section is now the child section.
2536                          */
2537                         this = css;
2538                         css = NULL;
2539                         goto check_for_more;
2540                 }
2541
2542         skip_keywords:
2543                 /*
2544                  *      Grab the next token.
2545                  */
2546                 t2 = gettoken(&ptr, buf2, sizeof(buf2), !cf_new_escape);
2547                 switch (t2) {
2548                 case T_EOL:
2549                 case T_HASH:
2550                 case T_COMMA:
2551                 do_bare_word:
2552                         t3 = t2;
2553                         t2 = T_OP_EQ;
2554                         value = NULL;
2555                         goto do_set;
2556
2557                 case T_OP_INCRM:
2558                 case T_OP_ADD:
2559                 case T_OP_CMP_EQ:
2560                 case T_OP_SUB:
2561                 case T_OP_LE:
2562                 case T_OP_GE:
2563                 case T_OP_CMP_FALSE:
2564                         if (!this || (strcmp(this->name1, "update") != 0)) {
2565                                 ERROR("%s[%d]: Invalid operator in assignment",
2566                                        filename, *lineno);
2567                                 return -1;
2568                         }
2569                         /* FALL-THROUGH */
2570
2571                 case T_OP_EQ:
2572                 case T_OP_SET:
2573                         while (isspace((int) *ptr)) ptr++;
2574
2575                         /*
2576                          *      New parser: non-quoted strings are
2577                          *      bare words, and we parse everything
2578                          *      until the next newline, or the next
2579                          *      comma.  If they have { or } in a bare
2580                          *      word, well... too bad.
2581                          */
2582                         if (cf_new_escape && (*ptr != '"') && (*ptr != '\'')
2583                             && (*ptr != '`') && (*ptr != '/')) {
2584                                 const char *q = ptr;
2585
2586                                 t3 = T_BARE_WORD;
2587                                 while (*q && (*q >= ' ') && (*q != ',') &&
2588                                        !isspace(*q)) q++;
2589
2590                                 if ((size_t) (q - ptr) >= sizeof(buf3)) {
2591                                         ERROR("%s[%d]: Parse error: value too long",
2592                                               filename, *lineno);
2593                                         return -1;
2594                                 }
2595
2596                                 memcpy(buf3, ptr, (q - ptr));
2597                                 buf3[q - ptr] = '\0';
2598                                 ptr = q;
2599
2600                         } else {
2601                                 t3 = getstring(&ptr, buf3, sizeof(buf3), !cf_new_escape);
2602                         }
2603
2604                         if (t3 == T_INVALID) {
2605                                 ERROR("%s[%d]: Parse error: %s",
2606                                        filename, *lineno,
2607                                        fr_strerror());
2608                                 return -1;
2609                         }
2610
2611                         /*
2612                          *      Allow "foo" by itself, or "foo = bar"
2613                          */
2614                         switch (t3) {
2615                                 bool soft_fail;
2616
2617                         case T_BARE_WORD:
2618                         case T_DOUBLE_QUOTED_STRING:
2619                         case T_BACK_QUOTED_STRING:
2620                                 value = cf_expand_variables(filename, lineno, this, buf4, sizeof(buf4), buf3, &soft_fail);
2621                                 if (!value) {
2622                                         if (!soft_fail) return -1;
2623
2624                                         /*
2625                                          *      References an item which doesn't exist,
2626                                          *      or which is already marked up as being
2627                                          *      expanded in pass2.  Wait for pass2 to
2628                                          *      do the expansions.
2629                                          */
2630                                         pass2 = true;
2631                                         value = buf3;
2632                                 }
2633                                 break;
2634
2635                         case T_EOL:
2636                         case T_HASH:
2637                                 value = NULL;
2638                                 break;
2639
2640                         default:
2641                                 value = buf3;
2642                                 break;
2643                         }
2644
2645                         /*
2646                          *      Add this CONF_PAIR to our CONF_SECTION
2647                          */
2648                 do_set:
2649                         cpn = cf_pair_alloc(this, buf1, value, t2, t1, t3);
2650                         if (!cpn) return -1;
2651                         cpn->item.filename = filename;
2652                         cpn->item.lineno = *lineno;
2653                         cpn->pass2 = pass2;
2654                         cf_item_add(this, &(cpn->item));
2655
2656                         /*
2657                          *      Hacks for escaping
2658                          */
2659                         if (!cf_new_escape && !this->item.parent && value &&
2660                             (strcmp(buf1, "correct_escapes") == 0) &&
2661                             ((strcmp(value, "true") == 0) ||
2662                              (strcmp(value, "yes") == 0) ||
2663                              (strcmp(value, "1") == 0))) {
2664                                 cf_new_escape = true;
2665                         }
2666
2667                         /*
2668                          *      Require a comma, unless there's a comment.
2669                          */
2670                         while (isspace(*ptr)) ptr++;
2671
2672                         if (*ptr == ',') {
2673                                 ptr++;
2674                                 break;
2675                         }
2676
2677                         /*
2678                          *      module # stuff!
2679                          *      foo = bar # other stuff
2680                          */
2681                         if ((t3 == T_HASH) || (t3 == T_COMMA) || (t3 == T_EOL) || (*ptr == '#')) continue;
2682
2683                         if (!*ptr || (*ptr == '}')) break;
2684
2685                         ERROR("%s[%d]: Syntax error: Expected comma after '%s': %s",
2686                               filename, *lineno, value, ptr);
2687                         return -1;
2688
2689                         /*
2690                          *      No '=', must be a section or sub-section.
2691                          */
2692                 case T_BARE_WORD:
2693                 case T_DOUBLE_QUOTED_STRING:
2694                 case T_SINGLE_QUOTED_STRING:
2695                         t3 = gettoken(&ptr, buf3, sizeof(buf3), true);
2696                         if (t3 != T_LCBRACE) {
2697                                 ERROR("%s[%d]: Expecting section start brace '{' after \"%s %s\"",
2698                                        filename, *lineno, buf1, buf2);
2699                                 return -1;
2700                         }
2701                         /* FALL-THROUGH */
2702
2703                 case T_LCBRACE:
2704                         css = cf_section_alloc(this, buf1,
2705                                                t2 == T_LCBRACE ? NULL : buf2);
2706                         if (!css) {
2707                                 ERROR("%s[%d]: Failed allocating memory for section",
2708                                       filename, *lineno);
2709                                 return -1;
2710                         }
2711
2712                         css->item.filename = filename;
2713                         css->item.lineno = *lineno;
2714                         cf_item_add(this, &(css->item));
2715
2716                         /*
2717                          *      There may not be a name2
2718                          */
2719                         css->name2_type = (t2 == T_LCBRACE) ? T_INVALID : t2;
2720
2721                         /*
2722                          *      The current section is now the child section.
2723                          */
2724                         this = css;
2725                         break;
2726
2727                 case T_INVALID:
2728                         ERROR("%s[%d]: Syntax error in '%s': %s", filename, *lineno, ptr, fr_strerror());
2729
2730                         return -1;
2731
2732                 default:
2733                         ERROR("%s[%d]: Parse error after \"%s\": unexpected token \"%s\"",
2734                               filename, *lineno, buf1, fr_int2str(fr_tokens, t2, "<INVALID>"));
2735
2736                         return -1;
2737                 }
2738
2739         check_for_more:
2740                 /*
2741                  *      Done parsing one thing.  Skip to EOL if possible.
2742                  */
2743                 while (isspace(*ptr)) ptr++;
2744
2745                 if (*ptr == '#') continue;
2746
2747                 if (*ptr) {
2748                         goto get_more;
2749                 }
2750
2751         }
2752
2753         /*
2754          *      See if EOF was unexpected ..
2755          */
2756         if (feof(fp) && (this != current)) {
2757                 ERROR("%s[%d]: EOF reached without closing brace for section %s starting at line %d",
2758                       filename, *lineno, cf_section_name1(this), cf_section_lineno(this));
2759                 return -1;
2760         }
2761
2762         return 0;
2763 }
2764
2765 /*
2766  *      Include one config file in another.
2767  */
2768 static int cf_file_include(CONF_SECTION *cs, char const *filename_in)
2769 {
2770         FILE            *fp;
2771         int             lineno = 0;
2772         char const      *filename;
2773
2774         /*
2775          *      So we only need to do this once.
2776          */
2777         filename = talloc_strdup(cs, filename_in);
2778
2779         DEBUG2("including configuration file %s", filename);
2780
2781         fp = cf_file_open(cs, filename);
2782         if (!fp) return -1;
2783
2784         if (!cs->item.filename) cs->item.filename = filename;
2785
2786         /*
2787          *      Read the section.  It's OK to have EOF without a
2788          *      matching close brace.
2789          */
2790         if (cf_section_read(filename, &lineno, fp, cs) < 0) {
2791                 fclose(fp);
2792                 return -1;
2793         }
2794
2795         fclose(fp);
2796         return 0;
2797 }
2798
2799
2800 /*
2801  *      Do variable expansion in pass2.
2802  *
2803  *      This is a breadth-first expansion.  "deep
2804  */
2805 static int cf_section_pass2(CONF_SECTION *cs)
2806 {
2807         CONF_ITEM *ci;
2808
2809         for (ci = cs->children; ci; ci = ci->next) {
2810                 char const *value;
2811                 CONF_PAIR *cp;
2812                 char buffer[8192];
2813
2814                 if (ci->type != CONF_ITEM_PAIR) continue;
2815
2816                 cp = cf_item_to_pair(ci);
2817                 if (!cp->value || !cp->pass2) continue;
2818
2819                 rad_assert((cp->rhs_type == T_BARE_WORD) ||
2820                            (cp->rhs_type == T_DOUBLE_QUOTED_STRING) ||
2821                            (cp->rhs_type == T_BACK_QUOTED_STRING));
2822
2823                 value = cf_expand_variables(ci->filename, &ci->lineno, cs, buffer, sizeof(buffer), cp->value, NULL);
2824                 if (!value) return -1;
2825
2826                 rad_const_free(cp->value);
2827                 cp->value = talloc_typed_strdup(cp, value);
2828         }
2829
2830         for (ci = cs->children; ci; ci = ci->next) {
2831                 if (ci->type != CONF_ITEM_SECTION) continue;
2832
2833                 if (cf_section_pass2(cf_item_to_section(ci)) < 0) return -1;
2834         }
2835
2836         return 0;
2837 }
2838
2839
2840 /*
2841  *      Bootstrap a config file.
2842  */
2843 int cf_file_read(CONF_SECTION *cs, char const *filename)
2844 {
2845         char *p;
2846         CONF_PAIR *cp;
2847         rbtree_t *tree;
2848
2849         cp = cf_pair_alloc(cs, "confdir", filename, T_OP_SET, T_BARE_WORD, T_SINGLE_QUOTED_STRING);
2850         if (!cp) return -1;
2851
2852         p = strrchr(cp->value, FR_DIR_SEP);
2853         if (p) *p = '\0';
2854
2855         cp->item.filename = "<internal>";
2856         cp->item.lineno = -1;
2857         cf_item_add(cs, &(cp->item));
2858
2859         tree = rbtree_create(cs, filename_cmp, NULL, 0);
2860         if (!tree) return -1;
2861
2862         cf_data_add_internal(cs, "filename", tree, NULL, 0);
2863
2864         if (cf_file_include(cs, filename) < 0) return -1;
2865
2866         /*
2867          *      Now that we've read the file, go back through it and
2868          *      expand the variables.
2869          */
2870         if (cf_section_pass2(cs) < 0) return -1;
2871
2872         return 0;
2873 }
2874
2875
2876 void cf_file_free(CONF_SECTION *cs)
2877 {
2878         talloc_free(cs);
2879 }
2880
2881
2882 /*
2883  * Return a CONF_PAIR within a CONF_SECTION.
2884  */
2885 CONF_PAIR *cf_pair_find(CONF_SECTION const *cs, char const *name)
2886 {
2887         CONF_PAIR *cp, mycp;
2888
2889         if (!cs || !name) return NULL;
2890
2891         mycp.attr = name;
2892         cp = rbtree_finddata(cs->pair_tree, &mycp);
2893         if (cp) return cp;
2894
2895         if (!cs->template) return NULL;
2896
2897         return rbtree_finddata(cs->template->pair_tree, &mycp);
2898 }
2899
2900 /*
2901  * Return the attr of a CONF_PAIR
2902  */
2903
2904 char const *cf_pair_attr(CONF_PAIR const *pair)
2905 {
2906         return (pair ? pair->attr : NULL);
2907 }
2908
2909 /*
2910  * Return the value of a CONF_PAIR
2911  */
2912
2913 char const *cf_pair_value(CONF_PAIR const *pair)
2914 {
2915         return (pair ? pair->value : NULL);
2916 }
2917
2918 FR_TOKEN cf_pair_operator(CONF_PAIR const *pair)
2919 {
2920         return (pair ? pair->op : T_INVALID);
2921 }
2922
2923 /** Return the value (lhs) type
2924  *
2925  * @param pair to extract value type from.
2926  * @return one of T_BARE_WORD, T_SINGLE_QUOTED_STRING, T_BACK_QUOTED_STRING
2927  *      T_DOUBLE_QUOTED_STRING or T_INVALID if the pair is NULL.
2928  */
2929 FR_TOKEN cf_pair_attr_type(CONF_PAIR const *pair)
2930 {
2931         return (pair ? pair->lhs_type : T_INVALID);
2932 }
2933
2934 /** Return the value (rhs) type
2935  *
2936  * @param pair to extract value type from.
2937  * @return one of T_BARE_WORD, T_SINGLE_QUOTED_STRING, T_BACK_QUOTED_STRING
2938  *      T_DOUBLE_QUOTED_STRING or T_INVALID if the pair is NULL.
2939  */
2940 FR_TOKEN cf_pair_value_type(CONF_PAIR const *pair)
2941 {
2942         return (pair ? pair->rhs_type : T_INVALID);
2943 }
2944
2945 /*
2946  * Turn a CONF_PAIR into a VALUE_PAIR
2947  * For now, ignore the "value_type" field...
2948  */
2949 VALUE_PAIR *cf_pairtovp(CONF_PAIR *pair)
2950 {
2951         if (!pair) {
2952                 fr_strerror_printf("Internal error");
2953                 return NULL;
2954         }
2955
2956         if (!pair->value) {
2957                 fr_strerror_printf("No value given for attribute %s", pair->attr);
2958                 return NULL;
2959         }
2960
2961         /*
2962          *      false comparisons never match.  BUT if it's a "string"
2963          *      or `string`, then remember to expand it later.
2964          */
2965         if ((pair->op != T_OP_CMP_FALSE) &&
2966             ((pair->rhs_type == T_DOUBLE_QUOTED_STRING) ||
2967              (pair->rhs_type == T_BACK_QUOTED_STRING))) {
2968                 VALUE_PAIR *vp;
2969
2970                 vp = pairmake(pair, NULL, pair->attr, NULL, pair->op);
2971                 if (!vp) {
2972                         return NULL;
2973                 }
2974
2975                 if (pairmark_xlat(vp, pair->value) < 0) {
2976                         talloc_free(vp);
2977
2978                         return NULL;
2979                 }
2980
2981                 return vp;
2982         }
2983
2984         return pairmake(pair, NULL, pair->attr, pair->value, pair->op);
2985 }
2986
2987 /*
2988  * Return the first label of a CONF_SECTION
2989  */
2990
2991 char const *cf_section_name1(CONF_SECTION const *cs)
2992 {
2993         return (cs ? cs->name1 : NULL);
2994 }
2995
2996 /*
2997  * Return the second label of a CONF_SECTION
2998  */
2999
3000 char const *cf_section_name2(CONF_SECTION const *cs)
3001 {
3002         return (cs ? cs->name2 : NULL);
3003 }
3004
3005 /** Return name2 if set, else name1
3006  *
3007  */
3008 char const *cf_section_name(CONF_SECTION const *cs)
3009 {
3010         char const *name;
3011
3012         name = cf_section_name2(cs);
3013         if (name) return name;
3014
3015         return cf_section_name1(cs);
3016 }
3017
3018 /*
3019  * Find a value in a CONF_SECTION
3020  */
3021 char const *cf_section_value_find(CONF_SECTION const *cs, char const *attr)
3022 {
3023         CONF_PAIR       *cp;
3024
3025         cp = cf_pair_find(cs, attr);
3026
3027         return (cp ? cp->value : NULL);
3028 }
3029
3030
3031 CONF_SECTION *cf_section_find_name2(CONF_SECTION const *cs,
3032                                     char const *name1, char const *name2)
3033 {
3034         char const      *their2;
3035         CONF_ITEM const *ci;
3036
3037         if (!cs || !name1) return NULL;
3038
3039         for (ci = &(cs->item); ci; ci = ci->next) {
3040                 if (ci->type != CONF_ITEM_SECTION)
3041                         continue;
3042
3043                 if (strcmp(cf_item_to_section(ci)->name1, name1) != 0) {
3044                         continue;
3045                 }
3046
3047                 their2 = cf_item_to_section(ci)->name2;
3048
3049                 if ((!name2 && !their2) ||
3050                     (name2 && their2 && (strcmp(name2, their2) == 0))) {
3051                         return cf_item_to_section(ci);
3052                 }
3053         }
3054
3055         return NULL;
3056 }
3057
3058 /** Find a pair with a name matching attr, after specified pair.
3059  *
3060  * @param cs to search in.
3061  * @param pair to search from (may be NULL).
3062  * @param attr to find (may be NULL in which case any attribute matches).
3063  * @return the next matching CONF_PAIR or NULL if none matched.
3064  */
3065 CONF_PAIR *cf_pair_find_next(CONF_SECTION const *cs,
3066                              CONF_PAIR const *pair, char const *attr)
3067 {
3068         CONF_ITEM       *ci;
3069
3070         if (!cs) return NULL;
3071
3072         /*
3073          *      If pair is NULL and we're trying to find a specific
3074          *      attribute this must be a first time run.
3075          *
3076          *      Find the pair with correct name.
3077          */
3078         if (!pair && attr) return cf_pair_find(cs, attr);
3079
3080         /*
3081          *      Start searching from the next child, or from the head
3082          *      of the list of children (if no pair was provided).
3083          */
3084         for (ci = pair ? pair->item.next : cs->children;
3085              ci;
3086              ci = ci->next) {
3087                 if (ci->type != CONF_ITEM_PAIR) continue;
3088
3089                 if (!attr || strcmp(cf_item_to_pair(ci)->attr, attr) == 0) break;
3090         }
3091
3092         return cf_item_to_pair(ci);
3093 }
3094
3095 /*
3096  * Find a CONF_SECTION, or return the root if name is NULL
3097  */
3098
3099 CONF_SECTION *cf_section_find(char const *name)
3100 {
3101         if (name)
3102                 return cf_section_sub_find(root_config, name);
3103         else
3104                 return root_config;
3105 }
3106
3107 /** Find a sub-section in a section
3108  *
3109  *      This finds ANY section having the same first name.
3110  *      The second name is ignored.
3111  */
3112 CONF_SECTION *cf_section_sub_find(CONF_SECTION const *cs, char const *name)
3113 {
3114         CONF_SECTION mycs;
3115
3116         if (!cs || !name) return NULL;  /* can't find an un-named section */
3117
3118         /*
3119          *      No sub-sections have been defined, so none exist.
3120          */
3121         if (!cs->section_tree) return NULL;
3122
3123         mycs.name1 = name;
3124         mycs.name2 = NULL;
3125         return rbtree_finddata(cs->section_tree, &mycs);
3126 }
3127
3128
3129 /** Find a CONF_SECTION with both names.
3130  *
3131  */
3132 CONF_SECTION *cf_section_sub_find_name2(CONF_SECTION const *cs,
3133                                         char const *name1, char const *name2)
3134 {
3135         CONF_ITEM    *ci;
3136
3137         if (!cs) cs = root_config;
3138         if (!cs) return NULL;
3139
3140         if (name1) {
3141                 CONF_SECTION mycs, *master_cs;
3142
3143                 if (!cs->section_tree) return NULL;
3144
3145                 mycs.name1 = name1;
3146                 mycs.name2 = name2;
3147
3148                 master_cs = rbtree_finddata(cs->section_tree, &mycs);
3149                 if (!master_cs) return NULL;
3150
3151                 /*
3152                  *      Look it up in the name2 tree.  If it's there,
3153                  *      return it.
3154                  */
3155                 if (master_cs->name2_tree) {
3156                         CONF_SECTION *subcs;
3157
3158                         subcs = rbtree_finddata(master_cs->name2_tree, &mycs);
3159                         if (subcs) return subcs;
3160                 }
3161
3162                 /*
3163                  *      We don't insert ourselves into the name2 tree.
3164                  *      So if there's nothing in the name2 tree, maybe
3165                  *      *we* are the answer.
3166                  */
3167                 if (!master_cs->name2 && name2) return NULL;
3168                 if (master_cs->name2 && !name2) return NULL;
3169                 if (!master_cs->name2 && !name2) return master_cs;
3170
3171                 if (strcmp(master_cs->name2, name2) == 0) {
3172                         return master_cs;
3173                 }
3174
3175                 return NULL;
3176         }
3177
3178         /*
3179          *      Else do it the old-fashioned way.
3180          */
3181         for (ci = cs->children; ci; ci = ci->next) {
3182                 CONF_SECTION *subcs;
3183
3184                 if (ci->type != CONF_ITEM_SECTION)
3185                         continue;
3186
3187                 subcs = cf_item_to_section(ci);
3188                 if (!subcs->name2) {
3189                         if (strcmp(subcs->name1, name2) == 0) break;
3190                 } else {
3191                         if (strcmp(subcs->name2, name2) == 0) break;
3192                 }
3193         }
3194
3195         return cf_item_to_section(ci);
3196 }
3197
3198 /*
3199  * Return the next subsection after a CONF_SECTION
3200  * with a certain name1 (char *name1). If the requested
3201  * name1 is NULL, any name1 matches.
3202  */
3203
3204 CONF_SECTION *cf_subsection_find_next(CONF_SECTION const *section,
3205                                       CONF_SECTION const *subsection,
3206                                       char const *name1)
3207 {
3208         CONF_ITEM       *ci;
3209
3210         if (!section) return NULL;
3211
3212         /*
3213          * If subsection is NULL this must be a first time run
3214          * Find the subsection with correct name
3215          */
3216
3217         if (!subsection) {
3218                 ci = section->children;
3219         } else {
3220                 ci = subsection->item.next;
3221         }
3222
3223         for (; ci; ci = ci->next) {
3224                 if (ci->type != CONF_ITEM_SECTION)
3225                         continue;
3226                 if ((name1 == NULL) ||
3227                     (strcmp(cf_item_to_section(ci)->name1, name1) == 0))
3228                         break;
3229         }
3230
3231         return cf_item_to_section(ci);
3232 }
3233
3234
3235 /*
3236  * Return the next section after a CONF_SECTION
3237  * with a certain name1 (char *name1). If the requested
3238  * name1 is NULL, any name1 matches.
3239  */
3240
3241 CONF_SECTION *cf_section_find_next(CONF_SECTION const *section,
3242                                    CONF_SECTION const *subsection,
3243                                    char const *name1)
3244 {
3245         if (!section) return NULL;
3246
3247         if (!section->item.parent) return NULL;
3248
3249         return cf_subsection_find_next(section->item.parent, subsection, name1);
3250 }
3251
3252 /** Return the next item after a CONF_ITEM.
3253  *
3254  */
3255 CONF_ITEM *cf_item_find_next(CONF_SECTION const *section, CONF_ITEM const *item)
3256 {
3257         if (!section) return NULL;
3258
3259         /*
3260          *      If item is NULL this must be a first time run
3261          *      Return the first item
3262          */
3263         if (item == NULL) {
3264                 return section->children;
3265         } else {
3266                 return item->next;
3267         }
3268 }
3269
3270 static void _pair_count(int *count, CONF_SECTION const *cs)
3271 {
3272         CONF_ITEM const *ci;
3273
3274         for (ci = cf_item_find_next(cs, NULL);
3275              ci != NULL;
3276              ci = cf_item_find_next(cs, ci)) {
3277
3278                 if (cf_item_is_section(ci)) {
3279                         _pair_count(count, cf_item_to_section(ci));
3280                         continue;
3281                 }
3282
3283                 (*count)++;
3284         }
3285 }
3286
3287 /** Count the number of conf pairs beneath a section
3288  *
3289  * @param[in] cs to search for items in.
3290  * @return number of pairs nested within section.
3291  */
3292 int cf_pair_count(CONF_SECTION const *cs)
3293 {
3294         int count = 0;
3295
3296         _pair_count(&count, cs);
3297
3298         return count;
3299 }
3300
3301 CONF_SECTION *cf_item_parent(CONF_ITEM const *ci)
3302 {
3303         if (!ci) return NULL;
3304
3305         return ci->parent;
3306 }
3307
3308 int cf_section_lineno(CONF_SECTION const *section)
3309 {
3310         return section->item.lineno;
3311 }
3312
3313 char const *cf_pair_filename(CONF_PAIR const *pair)
3314 {
3315         return pair->item.filename;
3316 }
3317
3318 char const *cf_section_filename(CONF_SECTION const *section)
3319 {
3320         return section->item.filename;
3321 }
3322
3323 int cf_pair_lineno(CONF_PAIR const *pair)
3324 {
3325         return pair->item.lineno;
3326 }
3327
3328 bool cf_item_is_section(CONF_ITEM const *item)
3329 {
3330         return item->type == CONF_ITEM_SECTION;
3331 }
3332
3333 bool cf_item_is_pair(CONF_ITEM const *item)
3334 {
3335         return item->type == CONF_ITEM_PAIR;
3336 }
3337
3338
3339 static CONF_DATA *cf_data_alloc(CONF_SECTION *parent, char const *name,
3340                                 void *data, void (*data_free)(void *))
3341 {
3342         CONF_DATA *cd;
3343
3344         cd = talloc_zero(parent, CONF_DATA);
3345         if (!cd) return NULL;
3346
3347         cd->item.type = CONF_ITEM_DATA;
3348         cd->item.parent = parent;
3349         cd->name = talloc_typed_strdup(cd, name);
3350         if (!cd->name) {
3351                 talloc_free(cd);
3352                 return NULL;
3353         }
3354
3355         cd->data = data;
3356         cd->free = data_free;
3357
3358         if (cd->free) {
3359                 talloc_set_destructor(cd, _cf_data_free);
3360         }
3361
3362         return cd;
3363 }
3364
3365 static void *cf_data_find_internal(CONF_SECTION const *cs, char const *name, int flag)
3366 {
3367         if (!cs || !name) return NULL;
3368
3369         /*
3370          *      Find the name in the tree, for speed.
3371          */
3372         if (cs->data_tree) {
3373                 CONF_DATA mycd;
3374
3375                 mycd.name = name;
3376                 mycd.flag = flag;
3377                 return rbtree_finddata(cs->data_tree, &mycd);
3378         }
3379
3380         return NULL;
3381 }
3382
3383 /*
3384  *      Find data from a particular section.
3385  */
3386 void *cf_data_find(CONF_SECTION const *cs, char const *name)
3387 {
3388         CONF_DATA *cd = cf_data_find_internal(cs, name, 0);
3389
3390         if (cd) return cd->data;
3391         return NULL;
3392 }
3393
3394
3395 /*
3396  *      Add named data to a configuration section.
3397  */
3398 static int cf_data_add_internal(CONF_SECTION *cs, char const *name,
3399                                 void *data, void (*data_free)(void *),
3400                                 int flag)
3401 {
3402         CONF_DATA *cd;
3403
3404         if (!cs || !name) return -1;
3405
3406         /*
3407          *      Already exists.  Can't add it.
3408          */
3409         if (cf_data_find_internal(cs, name, flag) != NULL) return -1;
3410
3411         cd = cf_data_alloc(cs, name, data, data_free);
3412         if (!cd) return -1;
3413         cd->flag = flag;
3414
3415         cf_item_add(cs, cf_data_to_item(cd));
3416
3417         return 0;
3418 }
3419
3420 /*
3421  *      Add named data to a configuration section.
3422  */
3423 int cf_data_add(CONF_SECTION *cs, char const *name,
3424                 void *data, void (*data_free)(void *))
3425 {
3426         return cf_data_add_internal(cs, name, data, data_free, 0);
3427 }
3428
3429 /** Remove named data from a configuration section
3430  *
3431  */
3432 void *cf_data_remove(CONF_SECTION *cs, char const *name)
3433 {
3434         CONF_DATA mycd;
3435         CONF_DATA *cd;
3436         void *data;
3437
3438         if (!cs || !name) return NULL;
3439         if (!cs->data_tree) return NULL;
3440
3441         /*
3442          *      Find the name in the tree, for speed.
3443          */
3444         mycd.name = name;
3445         mycd.flag = 0;
3446         cd = rbtree_finddata(cs->data_tree, &mycd);
3447         if (!cd) return NULL;
3448
3449         talloc_set_destructor(cd, NULL);        /* Disarm the destructor */
3450         rbtree_deletebydata(cs->data_tree, &mycd);
3451
3452         data = cd->data;
3453         talloc_free(cd);
3454
3455         return data;
3456 }
3457
3458 /*
3459  *      This is here to make the rest of the code easier to read.  It
3460  *      ties conffile.c to log.c, but it means we don't have to
3461  *      pollute every other function with the knowledge of the
3462  *      configuration internals.
3463  */
3464 void cf_log_err(CONF_ITEM const *ci, char const *fmt, ...)
3465 {
3466         va_list ap;
3467         char buffer[256];
3468
3469         va_start(ap, fmt);
3470         vsnprintf(buffer, sizeof(buffer), fmt, ap);
3471         va_end(ap);
3472
3473         if (ci) {
3474                 ERROR("%s[%d]: %s",
3475                        ci->filename ? ci->filename : "unknown",
3476                        ci->lineno ? ci->lineno : 0,
3477                        buffer);
3478         } else {
3479                 ERROR("<unknown>[*]: %s", buffer);
3480         }
3481 }
3482
3483 void cf_log_err_cs(CONF_SECTION const *cs, char const *fmt, ...)
3484 {
3485         va_list ap;
3486         char buffer[256];
3487
3488         va_start(ap, fmt);
3489         vsnprintf(buffer, sizeof(buffer), fmt, ap);
3490         va_end(ap);
3491
3492         rad_assert(cs != NULL);
3493
3494         ERROR("%s[%d]: %s",
3495                cs->item.filename ? cs->item.filename : "unknown",
3496                cs->item.lineno ? cs->item.lineno : 0,
3497                buffer);
3498 }
3499
3500 void cf_log_err_cp(CONF_PAIR const *cp, char const *fmt, ...)
3501 {
3502         va_list ap;
3503         char buffer[256];
3504
3505         va_start(ap, fmt);
3506         vsnprintf(buffer, sizeof(buffer), fmt, ap);
3507         va_end(ap);
3508
3509         rad_assert(cp != NULL);
3510
3511         ERROR("%s[%d]: %s",
3512                cp->item.filename ? cp->item.filename : "unknown",
3513                cp->item.lineno ? cp->item.lineno : 0,
3514                buffer);
3515 }
3516
3517 void cf_log_info(CONF_SECTION const *cs, char const *fmt, ...)
3518 {
3519         va_list ap;
3520
3521         va_start(ap, fmt);
3522         if ((rad_debug_lvl > 1) && cs) vradlog(L_DBG, fmt, ap);
3523         va_end(ap);
3524 }
3525
3526 /*
3527  *      Wrapper to simplify the code.
3528  */
3529 void cf_log_module(CONF_SECTION const *cs, char const *fmt, ...)
3530 {
3531         va_list ap;
3532         char buffer[256];
3533
3534         va_start(ap, fmt);
3535         if (rad_debug_lvl > 1 && cs) {
3536                 vsnprintf(buffer, sizeof(buffer), fmt, ap);
3537
3538                 DEBUG("%.*s# %s", cs->depth, parse_spaces, buffer);
3539         }
3540         va_end(ap);
3541 }
3542
3543 const CONF_PARSER *cf_section_parse_table(CONF_SECTION *cs)
3544 {
3545         if (!cs) return NULL;
3546
3547         return cs->variables;
3548 }
3549
3550 /*
3551  *      For "switch" and "case" statements.
3552  */
3553 FR_TOKEN cf_section_name2_type(CONF_SECTION const *cs)
3554 {
3555         if (!cs) return T_INVALID;
3556
3557         return cs->name2_type;
3558 }