2 * rlm_protocol_filter.c
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
20 * Copyright 2004 Cladju Consulting, Inc. <aland@cladju.com>
24 #include "libradius.h"
33 static const char rcsid[] = "$Id$";
36 * Define a structure for our module configuration.
39 typedef struct rlm_protocol_filter_t {
43 } rlm_protocol_filter_t;
46 * A mapping of configuration file names to internal variables.
48 * Note that the string is dynamically allocated, so it MUST
49 * be freed. When the configuration file parse re-reads the string,
50 * it free's the old one, and strdup's the new one, placing the pointer
51 * to the strdup'd string into 'config.string'. This gets around
54 static CONF_PARSER module_config[] = {
55 { "filename", PW_TYPE_STRING_PTR,
56 offsetof(rlm_protocol_filter_t,filename), NULL,
57 "${raddbdir}/protocol_filter.conf"},
59 { "key", PW_TYPE_STRING_PTR,
60 offsetof(rlm_protocol_filter_t,key), NULL, "%{Realm:-DEFAULT}"},
62 { NULL, -1, 0, NULL, NULL } /* end the list */
65 static int filter_detach(void *instance)
67 rlm_protocol_filter_t *inst = instance;
69 if (inst->filename) free(inst->filename);
70 if (inst->key) free(inst->key);
71 if (inst->cs) cf_section_free(&(inst->cs));
79 * Do any per-module initialization that is separate to each
80 * configured instance of the module. e.g. set up connections
81 * to external databases, read configuration files, set up
82 * dictionary entries, etc.
84 * If configuration information is given in the config section
85 * that must be referenced in later calls, store a handle to it
86 * in *instance otherwise put a null pointer there.
88 static int filter_instantiate(CONF_SECTION *conf, void **instance)
90 rlm_protocol_filter_t *inst;
93 * Set up a storage area for instance data
95 inst = rad_malloc(sizeof(*inst));
99 memset(inst, 0, sizeof(*inst));
102 * If the configuration parameters can't be parsed, then
105 if (cf_section_parse(conf, inst, module_config) < 0) {
110 inst->cs = conf_read("rlm_protocol_filter", 0,
111 inst->filename, NULL);
126 static int str2sense(const char *str)
128 if (strcasecmp(str, "permit") == 0) return 1;
129 if (strcasecmp(str, "deny") == 0) return 0;
135 * Apply a subsection to a request.
136 * Returns permit/deny/error.
138 static int apply_subsection(rlm_protocol_filter_t *inst, REQUEST *request,
139 CONF_SECTION *cs, const char *name)
146 DEBUG2(" rlm_protocol_filter: Found subsection %s", name);
148 cp = cf_pair_find(cs, "key");
150 radlog(L_ERR, "rlm_protocol_filter: %s[%d]: No key defined in subsection %s",
151 inst->filename, cf_section_lineno(cs), name);
152 return RLM_MODULE_FAIL;
155 radius_xlat(keybuf, sizeof(keybuf),
156 cf_pair_value(cp), request, NULL);
158 DEBUG2(" rlm_protocol_filter: %s[%d]: subsection %s, key is empty, doing nothing.",
159 inst->filename, cf_section_lineno(cs), name);
160 return RLM_MODULE_NOOP;
163 DEBUG2(" rlm_protocol_filter: %s[%d]: subsection %s, using key %s",
164 inst->filename, cf_section_lineno(cs), name, keybuf);
167 * And repeat some of the above code.
169 cp = cf_pair_find(cs, keybuf);
174 * Maybe it has a subsection, too.
176 subcs = cf_section_sub_find(cs, keybuf);
178 return apply_subsection(inst, request, subcs, keybuf);
179 } /* it was a subsection */
183 DEBUG2(" rlm_protocol_filter: %s[%d]: subsection %s, rule not found, doing nothing.",
184 inst->filename, cf_section_lineno(cs), name);
185 return RLM_MODULE_NOOP;
188 value = cf_pair_value(cp);
189 sense = str2sense(value);
191 radlog(L_ERR, "rlm_protocol_filter: %s[%d]: Unknwn directive %s",
192 inst->filename, cf_pair_lineno(cp), value);
193 return RLM_MODULE_FAIL;
196 if (!sense) return RLM_MODULE_REJECT;
198 return RLM_MODULE_OK;
203 * Authorize the user.
205 static int filter_authorize(void *instance, REQUEST *request)
212 rlm_protocol_filter_t *inst = instance;
214 radius_xlat(keybuf, sizeof(keybuf), inst->key, request, NULL);
216 DEBUG2(" rlm_protocol_filter: key is empty");
217 return RLM_MODULE_NOOP;
219 DEBUG2(" rlm_protocol_filter: Using key %s", keybuf);
221 cs = cf_section_sub_find(inst->cs, keybuf);
223 DEBUG2(" rlm_protocol_filter: No such key in %s", inst->filename);
224 return RLM_MODULE_NOTFOUND;
228 * Walk through the list of attributes, seeing if they're
231 for (vp = request->packet->vps; vp != NULL; vp = vp->next) {
235 cp = cf_pair_find(cs, vp->name);
237 value = cf_pair_value(cp);
239 sense = str2sense(value);
241 radlog(L_ERR, "rlm_protocol_filter %s[%d]: Unknown directive %s",
245 return RLM_MODULE_FAIL;
248 if (!sense) return RLM_MODULE_REJECT;
249 continue; /* was permitted */
250 } /* else no pair was found */
253 * Maybe it has a subsection
255 subcs = cf_section_sub_find(cs, vp->name);
257 sense = apply_subsection(inst, request, subcs, vp->name);
258 if ((sense == RLM_MODULE_OK) ||
259 (sense == RLM_MODULE_NOOP)) {
264 } /* it was a subsection */
267 * Not found, must be "permit"
271 return RLM_MODULE_OK;
276 * The module name should be the only globally exported symbol.
277 * That is, everything else should be 'static'.
279 * If the module needs to temporarily modify it's instantiation
280 * data, the type should be changed to RLM_TYPE_THREAD_UNSAFE.
281 * The server will then take care of ensuring that the module
282 * is single-threaded.
284 module_t rlm_protocol_filter = {
286 RLM_TYPE_THREAD_SAFE, /* type */
287 NULL, /* initialization */
288 filter_instantiate, /* instantiation */
290 NULL, /* authentication */
291 filter_authorize, /* authorization */
292 NULL, /* preaccounting */
293 NULL, /* accounting */
294 NULL, /* checksimul */
295 NULL, /* pre-proxy */
296 NULL, /* post-proxy */
299 filter_detach, /* detach */