src/main/valuepair.c

   1 /*
   2  * valuepair.c  Valuepair functions that are radiusd-specific
   3  *              and as such do not belong in the library.
   4  *
   5  * Version:     $Id$
   6  *
   7  *   This program is free software; you can redistribute it and/or modify
   8  *   it under the terms of the GNU General Public License as published by
   9  *   the Free Software Foundation; either version 2 of the License, or
  10  *   (at your option) any later version.
  11  *
  12  *   This program is distributed in the hope that it will be useful,
  13  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  *   GNU General Public License for more details.
  16  *
  17  *   You should have received a copy of the GNU General Public License
  18  *   along with this program; if not, write to the Free Software
  19  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  20  *
  21  * Copyright 2000  The FreeRADIUS server project
  22  * Copyright 2000  Alan DeKok <aland@ox.org>
  23  */
  24
  25 static const char rcsid[] = "$Id$";
  26
  27 #include "autoconf.h"
  28 #include "libradius.h"
  29
  30 #include <stdio.h>
  31 #include <stdlib.h>
  32 #include <string.h>
  33
  34 #ifdef HAVE_NETINET_IN_H
  35 #       include <netinet/in.h>
  36 #endif
  37
  38 #ifdef HAVE_REGEX_H
  39 #       include <regex.h>
  40
  41 /*
  42  *  For POSIX Regular expressions.
  43  *  (0) Means no extended regular expressions.
  44  *  REG_EXTENDED means use extended regular expressions.
  45  */
  46 #ifndef REG_EXTENDED
  47 #define REG_EXTENDED (0)
  48 #endif
  49
  50 #ifndef REG_NOSUB
  51 #define REG_NOSUB (0)
  52 #endif
  53 #endif
  54
  55 #include "radiusd.h"
  56
  57 struct cmp {
  58         int attribute;
  59         int otherattr;
  60         void *instance; /* module instance */
  61         RAD_COMPARE_FUNC compare;
  62         struct cmp *next;
  63 };
  64 static struct cmp *cmp;
  65
  66
  67 /*
  68  *      Compare 2 attributes. May call the attribute compare function.
  69  */
  70 static int paircompare(REQUEST *req, VALUE_PAIR *request, VALUE_PAIR *check,
  71                        VALUE_PAIR *check_pairs, VALUE_PAIR **reply_pairs)
  72 {
  73         int ret = -2;
  74         struct cmp *c;
  75
  76         /*
  77          *      Sanity check.
  78          */
  79 #if 0
  80         if (request->attribute != check->attribute)
  81                 return -2;
  82 #endif
  83
  84         /*
  85          *      Check for =* and !* and return appropriately
  86          */
  87         if( check->operator == T_OP_CMP_TRUE )
  88                  return 0;  /* always return 0/EQUAL */
  89         if( check->operator == T_OP_CMP_FALSE )
  90                  return 1;  /* always return 1/NOT EQUAL */
  91
  92         /*
  93          *      See if there is a special compare function.
  94          */
  95         for (c = cmp; c; c = c->next)
  96                 if (c->attribute == check->attribute)
  97                         return (c->compare)(c->instance, req, request, check,
  98                                 check_pairs, reply_pairs);
  99
 100         switch(check->type) {
 101 #ifdef ASCEND_BINARY
 102                 /*
 103                  *      Ascend binary attributes can be treated
 104                  *      as opaque objects, I guess...
 105                  */
 106                 case PW_TYPE_ABINARY:
 107 #endif
 108                 case PW_TYPE_OCTETS:
 109                         if (request->length != check->length) {
 110                                 ret = 1; /* NOT equal */
 111                                 break;
 112                         }
 113                         ret = memcmp(request->strvalue, check->strvalue,
 114                                         request->length);
 115                         break;
 116                 case PW_TYPE_STRING:
 117                         ret = strcmp((char *)request->strvalue,
 118                                         (char *)check->strvalue);
 119                         break;
 120                 case PW_TYPE_INTEGER:
 121                 case PW_TYPE_DATE:
 122                         ret = request->lvalue - check->lvalue;
 123                         break;
 124                 case PW_TYPE_IPADDR:
 125                         ret = ntohl(request->lvalue) - ntohl(check->lvalue);
 126                         break;
 127                 default:
 128                         break;
 129         }
 130
 131         return ret;
 132 }
 133
 134
 135 /*
 136  *      See what attribute we want to compare with.
 137  */
 138 static int otherattr(int attr)
 139 {
 140         struct cmp      *c;
 141
 142         for (c = cmp; c; c = c->next) {
 143                 if (c->attribute == attr)
 144                         return c->otherattr;
 145         }
 146
 147         return attr;
 148 }
 149
 150 /*
 151  *      Register a function as compare function.
 152  *      compare_attr is the attribute in the request we want to
 153  *      compare with. Normally this is the same as "attr".
 154  *      You can set this to:
 155  *
 156  *      -1   the same as "attr"
 157  *      0    always call compare function, not tied to request attribute
 158  *      >0   Attribute to compare with.
 159  *
 160  *      For example, PW_GROUP in a check item needs to be compared
 161  *      with PW_USER_NAME in the incoming request.
 162  */
 163 int paircompare_register(int attr, int compare_attr, RAD_COMPARE_FUNC fun, void *instance)
 164 {
 165         struct cmp      *c;
 166
 167         paircompare_unregister(attr, fun);
 168
 169         c = rad_malloc(sizeof(struct cmp));
 170
 171         if (compare_attr < 0)
 172                 compare_attr = attr;
 173         c->compare = fun;
 174         c->attribute = attr;
 175         c->otherattr = compare_attr;
 176         c->instance = instance;
 177         c->next = cmp;
 178         cmp = c;
 179
 180         return 0;
 181 }
 182
 183 /*
 184  *      Unregister a function.
 185  */
 186 void paircompare_unregister(int attr, RAD_COMPARE_FUNC fun)
 187 {
 188         struct cmp      *c, *last;
 189
 190         last = NULL;
 191         for (c = cmp; c; c = c->next) {
 192                 if (c->attribute == attr && c->compare == fun)
 193                         break;
 194                 last = c;
 195         }
 196
 197         if (c == NULL) return;
 198
 199         if (last != NULL)
 200                 last->next = c->next;
 201         else
 202                 cmp = c->next;
 203
 204         free(c);
 205 }
 206
 207 /*
 208  *      Compare two pair lists except for the password information.
 209  *      For every element in "check" at least one matching copy must
 210  *      be present in "reply".
 211  *
 212  *      Return 0 on match.
 213  */
 214 int paircmp(REQUEST *req, VALUE_PAIR *request, VALUE_PAIR *check, VALUE_PAIR **reply)
 215 {
 216         VALUE_PAIR *check_item;
 217         VALUE_PAIR *auth_item;
 218         int result = 0;
 219         int compare;
 220         int other;
 221 #ifdef HAVE_REGEX_H
 222         regex_t reg;
 223 #endif
 224
 225         for (check_item = check; check_item != NULL; check_item = check_item->next) {
 226                 /*
 227                  *      If the user is setting a configuration value,
 228                  *      then don't bother comparing it to any attributes
 229                  *      sent to us by the user.  It ALWAYS matches.
 230                  */
 231                 if ((check_item->operator == T_OP_SET) ||
 232                     (check_item->operator == T_OP_ADD)) {
 233                         continue;
 234                 }
 235
 236                 switch (check_item->attribute) {
 237                         /*
 238                          *      Attributes we skip during comparison.
 239                          *      These are "server" check items.
 240                          */
 241                         case PW_CRYPT_PASSWORD:
 242                         case PW_AUTH_TYPE:
 243                         case PW_AUTZ_TYPE:
 244                         case PW_ACCT_TYPE:
 245                         case PW_SESSION_TYPE:
 246                         case PW_STRIP_USER_NAME:
 247                                 continue;
 248                                 break;
 249
 250                         /*
 251                          *      IF the password attribute exists, THEN
 252                          *      we can do comparisons against it.  If not,
 253                          *      then the request did NOT contain a
 254                          *      User-Password attribute, so we CANNOT do
 255                          *      comparisons against it.
 256                          *
 257                          *      This hack makes CHAP-Password work..
 258                          */
 259                         case PW_PASSWORD:
 260                                 if (pairfind(request, PW_PASSWORD) == NULL) {
 261                                         continue;
 262                                 }
 263                                 break;
 264                 }
 265
 266                 /*
 267                  *      See if this item is present in the request.
 268                  */
 269                 other = otherattr(check_item->attribute);
 270
 271                 auth_item = request;
 272         try_again:
 273                 for (; auth_item != NULL; auth_item = auth_item->next) {
 274                         if (auth_item->attribute == other || other == 0)
 275                                 break;
 276                 }
 277
 278                 /*
 279                  *      Not found, it's not a match.
 280                  */
 281                 if (auth_item == NULL) {
 282                         /*
 283                          *      Didn't find it.  If we were *trying*
 284                          *      to not find it, then we succeeded.
 285                          */
 286                         if (check_item->operator == T_OP_CMP_FALSE)
 287                                 return 0;
 288                         else
 289                                 return -1;
 290                 }
 291
 292                 /*
 293                  *      Else we found it, but we were trying to not
 294                  *      find it, so we failed.
 295                  */
 296                 if (check_item->operator == T_OP_CMP_FALSE)
 297                         return -1;
 298
 299
 300                 /*
 301                  *      We've got to xlat the string before doing
 302                  *      the comparison.
 303                  */
 304                 if (check_item->flags.do_xlat) {
 305                         int rcode;
 306                         char buffer[sizeof(check_item->strvalue)];
 307
 308                         check_item->flags.do_xlat = 0;
 309                         rcode = radius_xlat(buffer, sizeof(buffer),
 310                                             check_item->strvalue,
 311                                             req, NULL);
 312
 313                         /*
 314                          *      Parse the string into a new value.
 315                          */
 316                         pairparsevalue(check_item, buffer);
 317                 }
 318
 319                 /*
 320                  *      OK it is present now compare them.
 321                  */
 322                 compare = paircompare(req, auth_item, check_item, check, reply);
 323
 324                 switch (check_item->operator) {
 325                         case T_OP_EQ:
 326                         default:
 327                                 radlog(L_ERR,  "Invalid operator for item %s: "
 328                                                 "reverting to '=='", check_item->name);
 329                                 /*FALLTHRU*/
 330                         case T_OP_CMP_TRUE:    /* compare always == 0 */
 331                         case T_OP_CMP_FALSE:   /* compare always == 1 */
 332                         case T_OP_CMP_EQ:
 333                                 if (compare != 0) result = -1;
 334                                 break;
 335
 336                         case T_OP_NE:
 337                                 if (compare == 0) result = -1;
 338                                 break;
 339
 340                         case T_OP_LT:
 341                                 if (compare >= 0) result = -1;
 342                                 break;
 343
 344                         case T_OP_GT:
 345                                 if (compare <= 0) result = -1;
 346                                 break;
 347
 348                         case T_OP_LE:
 349                                 if (compare > 0) result = -1;
 350                                 break;
 351
 352                         case T_OP_GE:
 353                                 if (compare < 0) result = -1;
 354                                 break;
 355
 356 #ifdef HAVE_REGEX_H
 357                         case T_OP_REG_EQ:
 358                         {
 359                                 int i;
 360                                 regmatch_t rxmatch[16];
 361
 362                                 /*
 363                                  *      Include substring matches.
 364                                  */
 365                                 regcomp(&reg, (char *)check_item->strvalue,
 366                                         REG_EXTENDED);
 367                                 compare = regexec(&reg,
 368                                                   (char *)auth_item->strvalue,
 369                                                   16, rxmatch, 0);
 370                                 regfree(&reg);
 371
 372                                 /*
 373                                  *      Add %{0}, %{1}, etc.
 374                                  */
 375                                 for (i = 0; i < 16; i++) {
 376                                         char *p;
 377                                         char buffer[sizeof(check_item->strvalue)];
 378
 379                                         /*
 380                                          *      -1 is end of matching.
 381                                          */
 382                                         if (rxmatch[i].rm_so == -1) break;
 383
 384                                         /*
 385                                          *      Copy substring into buffer.
 386                                          */
 387                                         memcpy(buffer,
 388                                                auth_item->strvalue + rxmatch[i].rm_so,
 389                                                rxmatch[i].rm_eo);
 390                                         buffer[rxmatch[i].rm_eo] = '\0';
 391
 392                                         /*
 393                                          *      Copy substring, and add it to
 394                                          *      the request.
 395                                          *
 396                                          *      Note that we don't check
 397                                          *      for out of memory, which is
 398                                          *      the only error we can get...
 399                                          */
 400                                         p = strdup(buffer);
 401                                         request_data_add(request,
 402                                                          request,
 403                                                          REQUEST_DATA_REGEX | i,
 404                                                          p, free);
 405                                 }
 406                         }
 407                                 if (compare != 0) result = -1;
 408                                 break;
 409
 410                         case T_OP_REG_NE:
 411                                 regcomp(&reg, (char *)check_item->strvalue, REG_EXTENDED|REG_NOSUB);
 412                                 compare = regexec(&reg, (char *)auth_item->strvalue,
 413                                                 0, NULL, 0);
 414                                 regfree(&reg);
 415                                 if (compare == 0) result = -1;
 416                                 break;
 417 #endif
 418
 419                 } /* switch over the operator of the check item */
 420
 421                 /*
 422                  *      This attribute didn't match, but maybe there's
 423                  *      another of the same attribute, which DOES match.
 424                  */
 425                 if (result != 0) {
 426                         auth_item = auth_item->next;
 427                         result = 0;
 428                         goto try_again;
 429                 }
 430
 431         } /* for every entry in the check item list */
 432
 433         return 0;               /* it matched */
 434 }
 435
 436 /*
 437  *      Compare two attributes simply.  Calls paircompare.
 438  */
 439
 440 int simplepaircmp(REQUEST *req, VALUE_PAIR *first, VALUE_PAIR *second)
 441 {
 442         return paircompare( req, first, second, NULL, NULL );
 443 }
 444
 445
 446 /*
 447  *      Compare a Connect-Info and a Connect-Rate
 448  */
 449 static int connectcmp(void *instance,
 450                       REQUEST *req UNUSED,
 451                       VALUE_PAIR *request,
 452                       VALUE_PAIR *check,
 453                       VALUE_PAIR *check_pairs,
 454                       VALUE_PAIR **reply_pairs)
 455 {
 456         int rate;
 457
 458         instance = instance;
 459         check_pairs = check_pairs; /* shut the compiler up */
 460         reply_pairs = reply_pairs;
 461
 462         rate = atoi((char *)request->strvalue);
 463         return rate - check->lvalue;
 464 }
 465
 466
 467 /*
 468  *      Compare a portno with a range.
 469  */
 470 static int portcmp(void *instance,
 471                    REQUEST *req UNUSED, VALUE_PAIR *request, VALUE_PAIR *check,
 472         VALUE_PAIR *check_pairs, VALUE_PAIR **reply_pairs)
 473 {
 474         char buf[MAX_STRING_LEN];
 475         char *s, *p;
 476         uint32_t lo, hi;
 477         uint32_t port = request->lvalue;
 478
 479         instance = instance;
 480         check_pairs = check_pairs; /* shut the compiler up */
 481         reply_pairs = reply_pairs;
 482
 483         if ((strchr((char *)check->strvalue, ',') == NULL) &&
 484                         (strchr((char *)check->strvalue, '-') == NULL)) {
 485                 return (request->lvalue - check->lvalue);
 486         }
 487
 488         /* Same size */
 489         strcpy(buf, (char *)check->strvalue);
 490         s = strtok(buf, ",");
 491
 492         while (s != NULL) {
 493                 if ((p = strchr(s, '-')) != NULL)
 494                         p++;
 495                 else
 496                         p = s;
 497                 lo = strtoul(s, NULL, 10);
 498                 hi = strtoul(p, NULL, 10);
 499                 if (lo <= port && port <= hi) {
 500                         return 0;
 501                 }
 502                 s = strtok(NULL, ",");
 503         }
 504
 505         return -1;
 506 }
 507
 508 /*
 509  *      Compare prefix/suffix.
 510  *
 511  *      If they compare:
 512  *      - if PW_STRIP_USER_NAME is present in check_pairs,
 513  *        strip the username of prefix/suffix.
 514  *      - if PW_STRIP_USER_NAME is not present in check_pairs,
 515  *        add a PW_STRIPPED_USER_NAME to the request.
 516  */
 517 static int presufcmp(void *instance,
 518                      REQUEST *req UNUSED,
 519                      VALUE_PAIR *request, VALUE_PAIR *check,
 520         VALUE_PAIR *check_pairs, VALUE_PAIR **reply_pairs)
 521 {
 522         VALUE_PAIR *vp;
 523         char *name = (char *)request->strvalue;
 524         char rest[MAX_STRING_LEN];
 525         int len, namelen;
 526         int ret = -1;
 527
 528         instance = instance;
 529         reply_pairs = reply_pairs; /* shut the compiler up */
 530
 531 #if 0 /* DEBUG */
 532         printf("Comparing %s and %s, check->attr is %d\n",
 533                 name, check->strvalue, check->attribute);
 534 #endif
 535
 536         len = strlen((char *)check->strvalue);
 537         switch (check->attribute) {
 538                 case PW_PREFIX:
 539                         ret = strncmp(name, (char *)check->strvalue, len);
 540                         if (ret == 0 && rest)
 541                                 strcpy(rest, name + len);
 542                         break;
 543                 case PW_SUFFIX:
 544                         namelen = strlen(name);
 545                         if (namelen < len)
 546                                 break;
 547                         ret = strcmp(name + namelen - len,
 548                                         (char *)check->strvalue);
 549                         if (ret == 0 && rest) {
 550                                 strNcpy(rest, name, namelen - len + 1);
 551                         }
 552                         break;
 553         }
 554         if (ret != 0)
 555                 return ret;
 556
 557         if (pairfind(check_pairs, PW_STRIP_USER_NAME)) {
 558                 /*
 559                  *      I don't think we want to update the User-Name
 560                  *      attribute in place... - atd
 561                  */
 562                 strcpy((char *)request->strvalue, rest);
 563                 request->length = strlen(rest);
 564         } else {
 565                 if ((vp = pairfind(check_pairs, PW_STRIPPED_USER_NAME)) != NULL){
 566                         strcpy((char *)vp->strvalue, rest);
 567                         vp->length = strlen(rest);
 568                 } else if ((vp = paircreate(PW_STRIPPED_USER_NAME,
 569                                 PW_TYPE_STRING)) != NULL) {
 570                         strcpy((char *)vp->strvalue, rest);
 571                         vp->length = strlen(rest);
 572                         pairadd(&request, vp);
 573                 } /* else no memory! Die, die!: FIXME!! */
 574         }
 575
 576         return ret;
 577 }
 578
 579
 580 /*
 581  *      Compare the current time to a range.
 582  *      Hmm... it would save work, and probably be better,
 583  *      if we were passed the REQUEST data structure, so we
 584  *      could use it's 'timestamp' element.  That way, we could
 585  *      do the comparison against when the packet came in, not now,
 586  *      and have one less system call to do.
 587  */
 588 static int timecmp(void *instance,
 589                    REQUEST *req UNUSED,
 590                    VALUE_PAIR *request, VALUE_PAIR *check,
 591         VALUE_PAIR *check_pairs, VALUE_PAIR **reply_pairs)
 592 {
 593         instance = instance;
 594         request = request;      /* shut the compiler up */
 595         check_pairs = check_pairs;
 596         reply_pairs = reply_pairs;
 597
 598         if (timestr_match((char *)check->strvalue, time(NULL)) >= 0) {
 599                 return 0;
 600         }
 601         return -1;
 602 }
 603
 604 /*
 605  *      Matches if there is NO SUCH ATTRIBUTE as the one named
 606  *      in check->strvalue.  If there IS such an attribute, it
 607  *      doesn't match.
 608  *
 609  *      This is ugly, and definitely non-optimal.  We should be
 610  *      doing the lookup only ONCE, and storing the result
 611  *      in check->lvalue...
 612  */
 613 static int attrcmp(void *instance,
 614                    REQUEST *req UNUSED,
 615                    VALUE_PAIR *request, VALUE_PAIR *check,
 616                    VALUE_PAIR *check_pairs, VALUE_PAIR **reply_pairs)
 617 {
 618         VALUE_PAIR *pair;
 619         DICT_ATTR  *dict;
 620         int attr;
 621
 622         instance = instance;
 623         check_pairs = check_pairs; /* shut the compiler up */
 624         reply_pairs = reply_pairs;
 625
 626         if (check->lvalue == 0) {
 627                 dict = dict_attrbyname((char *)check->strvalue);
 628                 if (dict == NULL) {
 629                         return -1;
 630                 }
 631                 attr = dict->attr;
 632         } else {
 633                 attr = check->lvalue;
 634         }
 635
 636         /*
 637          *      If there's no such attribute, then return MATCH,
 638          *      else FAILURE.
 639          */
 640         pair = pairfind(request, attr);
 641         if (pair == NULL) {
 642                 return 0;
 643         }
 644
 645         return -1;
 646 }
 647
 648 /*
 649  *      Compare the expiration date.
 650  */
 651 static int expirecmp(void *instance, REQUEST *req UNUSED,
 652                      VALUE_PAIR *request, VALUE_PAIR *check,
 653                      VALUE_PAIR *check_pairs, VALUE_PAIR **reply_pairs)
 654 {
 655         time_t now;
 656
 657         instance = instance;
 658         request = request;      /* shut the compiler up */
 659         check_pairs = check_pairs;
 660         reply_pairs = reply_pairs;
 661
 662         /*
 663          *  FIXME!  This should be request->timestamp!
 664          */
 665         now = time(NULL);
 666
 667         if (now <= (signed)check->lvalue) {
 668                 return 0;
 669         }
 670
 671         return +1;
 672 }
 673
 674 /*
 675  *      Compare the request packet type.
 676  */
 677 static int packetcmp(void *instance UNUSED, REQUEST *req,
 678                      VALUE_PAIR *request UNUSED,
 679                      VALUE_PAIR *check,
 680                      VALUE_PAIR *check_pairs UNUSED,
 681                      VALUE_PAIR **reply_pairs UNUSED)
 682 {
 683         if (req->packet->code == check->lvalue) {
 684                 return 0;
 685         }
 686
 687         return 1;
 688 }
 689
 690 /*
 691  *      Compare the response packet type.
 692  */
 693 static int responsecmp(void *instance UNUSED,
 694                        REQUEST *req,
 695                        VALUE_PAIR *request UNUSED,
 696                        VALUE_PAIR *check,
 697                        VALUE_PAIR *check_pairs UNUSED,
 698                        VALUE_PAIR **reply_pairs UNUSED)
 699 {
 700         if (req->reply->code == check->lvalue) {
 701                 return 0;
 702         }
 703
 704         return 1;
 705 }
 706
 707 /*
 708  *      Register server-builtin special attributes.
 709  */
 710 void pair_builtincompare_init(void)
 711 {
 712         paircompare_register(PW_NAS_PORT, -1, portcmp, NULL);
 713         paircompare_register(PW_PREFIX, PW_USER_NAME, presufcmp, NULL);
 714         paircompare_register(PW_SUFFIX, PW_USER_NAME, presufcmp, NULL);
 715         paircompare_register(PW_CONNECT_RATE, PW_CONNECT_INFO, connectcmp, NULL);
 716         paircompare_register(PW_CURRENT_TIME, 0, timecmp, NULL);
 717         paircompare_register(PW_NO_SUCH_ATTRIBUTE, 0, attrcmp, NULL);
 718         paircompare_register(PW_EXPIRATION, 0, expirecmp, NULL);
 719         paircompare_register(PW_PACKET_TYPE, 0, packetcmp, NULL);
 720         paircompare_register(PW_RESPONSE_PACKET_TYPE, 0, responsecmp, NULL);
 721 }
 722
 723 /*
 724  *      Move pairs, replacing/over-writing them, and doing xlat.
 725  */
 726 /*
 727  *      Move attributes from one list to the other
 728  *      if not already present.
 729  */
 730 void pairxlatmove(REQUEST *req, VALUE_PAIR **to, VALUE_PAIR **from)
 731 {
 732         VALUE_PAIR **tailto, *i, *j, *next;
 733         VALUE_PAIR *tailfrom = NULL;
 734         VALUE_PAIR *found;
 735
 736         /*
 737          *      Point "tailto" to the end of the "to" list.
 738          */
 739         tailto = to;
 740         for(i = *to; i; i = i->next) {
 741                 tailto = &i->next;
 742         }
 743
 744         /*
 745          *      Loop over the "from" list.
 746          */
 747         for(i = *from; i; i = next) {
 748                 next = i->next;
 749
 750                 /*
 751                  *      Don't move 'fallthrough' over.
 752                  */
 753                 if (i->attribute == PW_FALL_THROUGH) {
 754                         continue;
 755                 }
 756
 757                 /*
 758                  *      We've got to xlat the string before moving
 759                  *      it over.
 760                  */
 761                 if (i->flags.do_xlat) {
 762                         int rcode;
 763                         char buffer[sizeof(i->strvalue)];
 764
 765                         i->flags.do_xlat = 0;
 766                         rcode = radius_xlat(buffer, sizeof(buffer),
 767                                             i->strvalue,
 768                                             req, NULL);
 769
 770                         /*
 771                          *      Parse the string into a new value.
 772                          */
 773                         pairparsevalue(i, buffer);
 774                 }
 775
 776                 found = pairfind(*to, i->attribute);
 777                 switch (i->operator) {
 778
 779                         /*
 780                          *  If a similar attribute is found,
 781                          *  delete it.
 782                          */
 783                 case T_OP_SUB:          /* -= */
 784                         if (found) {
 785                                 if (!i->strvalue[0] ||
 786                                     (strcmp((char *)found->strvalue,
 787                                             (char *)i->strvalue) == 0)){
 788                                         pairdelete(to, found->attribute);
 789
 790                                         /*
 791                                          *      'tailto' may have been
 792                                          *      deleted...
 793                                          */
 794                                         tailto = to;
 795                                         for(j = *to; j; j = j->next) {
 796                                                 tailto = &j->next;
 797                                         }
 798                                 }
 799                         }
 800                         tailfrom = i;
 801                         continue;
 802                         break;
 803
 804                         /*
 805                          *  Add it, if it's not already there.
 806                          */
 807                 case T_OP_EQ:           /* = */
 808                         if (found) {
 809                                 tailfrom = i;
 810                                 continue; /* with the loop */
 811                         }
 812                         break;
 813
 814                         /*
 815                          *  If a similar attribute is found,
 816                          *  replace it with the new one.  Otherwise,
 817                          *  add the new one to the list.
 818                          */
 819                 case T_OP_SET:          /* := */
 820                         if (found) {
 821                                 VALUE_PAIR *vp;
 822
 823                                 vp = found->next;
 824                                 memcpy(found, i, sizeof(*found));
 825                                 found->next = vp;
 826                                 continue;
 827                         }
 828                         break;
 829
 830                         /*
 831                          *  FIXME: Add support for <=, >=, <, >
 832                          *
 833                          *  which will mean (for integers)
 834                          *  'make the attribute the smaller, etc'
 835                          */
 836
 837                         /*
 838                          *  Add the new element to the list, even
 839                          *  if similar ones already exist.
 840                          */
 841                 default:
 842                 case T_OP_ADD:          /* += */
 843                         break;
 844                 }
 845
 846                 if (tailfrom)
 847                         tailfrom->next = next;
 848                 else
 849                         *from = next;
 850
 851                 /*
 852                  *      If ALL of the 'to' attributes have been deleted,
 853                  *      then ensure that the 'tail' is updated to point
 854                  *      to the head.
 855                  */
 856                 if (!*to) {
 857                         tailto = to;
 858                 }
 859                 *tailto = i;
 860                 if (i) {
 861                         i->next = NULL;
 862                         tailto = &i->next;
 863                 }
 864         } /* loop over the 'from' list */
 865 }