#include <freeradius-devel/modcall.h>
#include <freeradius-devel/rad_assert.h>
+extern int radius_get_vp(REQUEST *request, const char *name, VALUE_PAIR **vp_p);
/* mutually-recursive static functions need a prototype up front */
static modcallable *do_compile_modgroup(modcallable *,
modcallable *parent;
struct modcallable *next;
const char *name;
- int lineno;
+ enum { MOD_SINGLE = 1, MOD_GROUP, MOD_LOAD_BALANCE, MOD_REDUNDANT_LOAD_BALANCE,
+#ifdef WITH_UNLANG
+ MOD_IF, MOD_ELSE, MOD_ELSIF, MOD_UPDATE, MOD_SWITCH, MOD_CASE,
+#endif
+ MOD_POLICY, MOD_REFERENCE, MOD_XLAT } type;
+ int method;
int actions[RLM_MODULE_NUMCODES];
- enum { MOD_SINGLE = 1, MOD_GROUP, MOD_LOAD_BALANCE, MOD_REDUNDANT_LOAD_BALANCE, MOD_IF, MOD_ELSE, MOD_ELSIF, MOD_UPDATE, MOD_SWITCH, MOD_CASE } type;
};
#define GROUPTYPE_SIMPLE 0
module_instance_t *modinst;
} modsingle;
-static const LRAD_NAME_NUMBER grouptype_table[] = {
+typedef struct {
+ modcallable mc;
+ const char *ref_name;
+ CONF_SECTION *ref_cs;
+} modref;
+
+typedef struct {
+ modcallable mc;
+ int exec;
+ char *xlat_name;
+} modxlat;
+
+static const FR_NAME_NUMBER grouptype_table[] = {
{ "", GROUPTYPE_SIMPLE },
{ "redundant ", GROUPTYPE_REDUNDANT },
{ "append ", GROUPTYPE_APPEND },
}
static modgroup *mod_callabletogroup(modcallable *p)
{
- rad_assert((p->type > MOD_SINGLE) && (p->type <= MOD_CASE));
+ rad_assert((p->type > MOD_SINGLE) && (p->type <= MOD_POLICY));
return (modgroup *)p;
}
return (modcallable *)p;
}
+static modref *mod_callabletoref(modcallable *p)
+{
+ rad_assert(p->type==MOD_REFERENCE);
+ return (modref *)p;
+}
+static modcallable *mod_reftocallable(modref *p)
+{
+ return (modcallable *)p;
+}
+
+static modxlat *mod_callabletoxlat(modcallable *p)
+{
+ rad_assert(p->type==MOD_XLAT);
+ return (modxlat *)p;
+}
+static modcallable *mod_xlattocallable(modxlat *p)
+{
+ return (modcallable *)p;
+}
+
/* modgroups are grown by adding a modcallable to the end */
+/* FIXME: This is O(N^2) */
static void add_child(modgroup *g, modcallable *c)
{
modcallable **head = &g->children;
/* Here's where we recognize all of our keywords: first the rcodes, then the
* actions */
-static const LRAD_NAME_NUMBER rcode_table[] = {
+static const FR_NAME_NUMBER rcode_table[] = {
{ "reject", RLM_MODULE_REJECT },
{ "fail", RLM_MODULE_FAIL },
{ "ok", RLM_MODULE_OK },
attr = cf_pair_attr(cp);
value = cf_pair_value(cp);
+ if (!value) return 0;
if (!strcasecmp(value, "return"))
action = MOD_ACTION_RETURN;
+ else if (!strcasecmp(value, "break"))
+ action = MOD_ACTION_RETURN;
+
else if (!strcasecmp(value, "reject"))
action = MOD_ACTION_REJECT;
*/
if (action == 0) return 0;
} else {
- radlog(L_ERR|L_CONS,
- "%s[%d]: Unknown action '%s'.\n",
- cf_pair_filename(cp), cf_pair_lineno(cp), value);
+ cf_log_err(cf_pairtoitem(cp), "Unknown action '%s'.\n",
+ value);
return 0;
}
if (strcasecmp(attr, "default") != 0) {
int rcode;
- rcode = lrad_str2int(rcode_table, attr, -1);
+ rcode = fr_str2int(rcode_table, attr, -1);
if (rcode < 0) {
- radlog(L_ERR|L_CONS,
- "%s[%d]: Unknown module rcode '%s'.\n",
- cf_pair_filename(cp), cf_pair_lineno(cp), attr);
+ cf_log_err(cf_pairtoitem(cp),
+ "Unknown module rcode '%s'.\n",
+ attr);
return 0;
}
c->actions[rcode] = action;
"pre-proxy",
"post-proxy",
"post-auth"
+#ifdef WITH_COA
+ ,
+ "recv-coa",
+ "send-coa"
+#endif
};
#ifdef HAVE_PTHREAD_H
#define safe_unlock(foo)
#endif
-static int call_modsingle(int component, modsingle *sp, REQUEST *request,
- int default_result)
+static int call_modsingle(int component, modsingle *sp, REQUEST *request)
{
- int myresult = default_result;
+ int myresult;
+ int blocked;
+
+ rad_assert(request != NULL);
+
+ /*
+ * If the request should stop, refuse to do anything.
+ */
+ blocked = (request->master_state == REQUEST_STOP_PROCESSING);
+ if (blocked) return RLM_MODULE_NOOP;
- DEBUG3(" modsingle[%s]: calling %s (%s) for request %d",
+ RDEBUG3(" modsingle[%s]: calling %s (%s) for request %d",
comp2str[component], sp->modinst->name,
sp->modinst->entry->name, request->number);
+
+ if (sp->modinst->force) {
+ myresult = sp->modinst->code;
+ goto fail;
+ }
+
safe_lock(sp->modinst);
/*
myresult = sp->modinst->entry->module->methods[component](
sp->modinst->insthandle, request);
- request->module = "<server-core>";
+ request->module = "";
safe_unlock(sp->modinst);
- DEBUG3(" modsingle[%s]: returned from %s (%s) for request %d",
+
+ /*
+ * Wasn't blocked, and now is. Complain!
+ */
+ blocked = (request->master_state == REQUEST_STOP_PROCESSING);
+ if (blocked) {
+ radlog(L_INFO, "WARNING: Module %s became unblocked for request %u",
+ sp->modinst->entry->name, request->number);
+ }
+
+ fail:
+ RDEBUG3(" modsingle[%s]: returned from %s (%s) for request %d",
comp2str[component], sp->modinst->name,
sp->modinst->entry->name, request->number);
RLM_MODULE_FAIL, /* SESS */
RLM_MODULE_NOOP, /* PRE_PROXY */
RLM_MODULE_NOOP, /* POST_PROXY */
- RLM_MODULE_NOOP /* POST_AUTH */
+ RLM_MODULE_NOOP /* POST_AUTH */
+#ifdef WITH_COA
+ ,
+ RLM_MODULE_NOOP, /* RECV_COA_TYPE */
+ RLM_MODULE_NOOP /* SEND_COA_TYPE */
+#endif
};
"group",
"load-balance group",
"redundant-load-balance group",
+#ifdef WITH_UNLANG
"if",
"else",
"elsif",
"update",
"switch",
- "case"
+ "case",
+#endif
+ "policy"
+};
+
+/* Here's where we recognize all of our keywords: first the rcodes, then the
+ * actions */
+const FR_NAME_NUMBER mod_rcode_table[] = {
+ { "reject", RLM_MODULE_REJECT },
+ { "fail", RLM_MODULE_FAIL },
+ { "ok", RLM_MODULE_OK },
+ { "handled", RLM_MODULE_HANDLED },
+ { "invalid", RLM_MODULE_INVALID },
+ { "userlock", RLM_MODULE_USERLOCK },
+ { "notfound", RLM_MODULE_NOTFOUND },
+ { "noop", RLM_MODULE_NOOP },
+ { "updated", RLM_MODULE_UPDATED },
+ { NULL, 0 }
};
static const char *modcall_spaces = "++++++++++++++++++++++++++++++++";
#define MODCALL_STACK_MAX (32)
+#define MOD_LOG_OPEN_BRACE(_name) RDEBUG2("%.*s%s %s {", depth + 1, modcall_spaces, _name, c->name)
+#define MOD_LOG_CLOSE_BRACE() RDEBUG2("%.*s} # %s %s = %s", depth + 1, modcall_spaces, \
+ group_name[c->type], c->name ? c->name : "", \
+ fr_int2str(mod_rcode_table, result, "<invalid>"))
+
/*
* Don't call the modules recursively. Instead, do them
* iteratively, and manage the call stack ourselves.
*/
-typedef struct modcall_stack {
- int pointer;
+typedef struct modcall_stack_entry_t {
+ int result;
+ int priority;
+ modcallable *c;
+} modcall_stack_entry_t;
- int priority[MODCALL_STACK_MAX];
- int result[MODCALL_STACK_MAX];
- modcallable *children[MODCALL_STACK_MAX];
- modcallable *start[MODCALL_STACK_MAX];
-} modcall_stack;
+static int modcall_recurse(REQUEST *request, int component, int depth,
+ modcall_stack_entry_t *entry, int do_next_sibling);
/*
- * Call a module, iteratively, with a local stack, rather than
- * recursively. What did Paul Graham say about Lisp...?
+ * Call a child of a block.
*/
-int modcall(int component, modcallable *c, REQUEST *request)
+static void modcall_child(REQUEST *request, int component, int depth,
+ modcall_stack_entry_t *entry, modcallable *c,
+ int *result, int do_next_sibling)
{
- int myresult;
- modcall_stack stack;
- modcallable *parent, *child;
- modsingle *sp;
- int if_taken, was_if;
-
- stack.pointer = 0;
+ modcall_stack_entry_t *next;
- if ((component < 0) || (component >= RLM_COMPONENT_COUNT)) {
- return RLM_MODULE_FAIL;
+ if (depth >= MODCALL_STACK_MAX) {
+ radlog(L_ERR, "Internal sanity check failed: module stack is too deep");
+ exit(1);
}
- if (!c) {
- return default_component_results[component];
+ /*
+ * Initialize the childs stack frame.
+ */
+ next = entry + 1;
+ next->c = c;
+ next->result = entry->result;
+ next->priority = 0;
+
+ if (!modcall_recurse(request, component,
+ depth, next, do_next_sibling)) {
+ *result = RLM_MODULE_FAIL;
+ return;
}
- stack.priority[0] = 0;
- stack.children[0] = c;
- myresult = stack.result[0] = default_component_results[component];
+ *result = next->result;
+
+ return;
+}
+
+/*
+ * Interpret the various types of blocks.
+ */
+static int modcall_recurse(REQUEST *request, int component, int depth,
+ modcall_stack_entry_t *entry, int do_next_sibling)
+{
+ int if_taken, was_if;
+ modcallable *c;
+ int result, priority;
+
was_if = if_taken = FALSE;
+ result = RLM_MODULE_FAIL;
- while (1) {
- /*
- * A module has taken too long to process the request,
- * and we've been told to stop processing it.
- */
- if (request->master_state == REQUEST_STOP_PROCESSING) {
- myresult = RLM_MODULE_FAIL;
- break;
- }
+redo:
+ priority = -1;
+ c = entry->c;
- child = stack.children[stack.pointer];
- rad_assert(child != NULL);
- parent = child->parent;
-
- if ((child->type == MOD_ELSE) || (child->type == MOD_ELSIF)) {
- if (!was_if) { /* error */
- DEBUG2("%.*s ... skipping %s for request %d: No preceding \"if\"",
- stack.pointer + 1, modcall_spaces,
- group_name[child->type],
- request->number);
- goto unroll;
- }
- if (if_taken) {
- DEBUG2("%.*s ... skipping %s for request %d: Preceding \"if\" was taken",
- stack.pointer + 1, modcall_spaces,
- group_name[child->type],
- request->number);
- goto unroll;
- }
- }
+ /*
+ * Nothing more to do. Return the code and priority
+ * which was set by the caller.
+ */
+ if (!c) return TRUE;
- /*
- * "if" or "elsif". Evaluate the condition.
- */
- if ((child->type == MOD_IF) || (child->type == MOD_ELSIF)) {
- int condition = TRUE;
- const char *p = child->name;
-
- DEBUG2("%.*s? %s %s",
- stack.pointer + 1, modcall_spaces,
- (child->type == MOD_IF) ? "if" : "elsif",
- child->name);
-
- if (radius_evaluate_condition(request, 0, &p,
- TRUE, &condition)) {
- DEBUG2("%.*s? %s %s -> %s",
- stack.pointer + 1, modcall_spaces,
- (child->type == MOD_IF) ? "if" : "elsif",
- child->name, (condition != FALSE) ? "TRUE" : "FALSE");
- } else {
- /*
- * This should never happen, the
- * condition is checked when the
- * module section is loaded.
- */
- condition = FALSE;
- }
+ /*
+ * We've been asked to stop. Do so.
+ */
+ if ((request->master_state == REQUEST_STOP_PROCESSING) ||
+ (request->parent &&
+ (request->parent->master_state == REQUEST_STOP_PROCESSING))) {
+ entry->result = RLM_MODULE_FAIL;
+ entry->priority = 9999;
+ return TRUE;
+ }
- if (!condition) {
- stack.children[stack.pointer] = NULL;
- was_if = TRUE;
- if_taken = FALSE;
- goto unroll;
- } /* else process it as a simple group */
+ /*
+ * Handle "if" conditions.
+ */
+ if (c->type == MOD_IF) {
+ int condition;
+ modgroup *g;
+ const char *p;
+
+ mod_if:
+ g = mod_callabletogroup(c);
+ p = c->name;
+
+ RDEBUG2("%.*s? %s %s", depth + 1, modcall_spaces,
+ group_name[c->type], c->name);
+
+ if (radius_evaluate_condition(request, result,
+ 0, &p, TRUE, &condition)) {
+ RDEBUG2("%.*s? %s %s -> %s", depth + 1, modcall_spaces,
+ group_name[c->type],
+ c->name, condition ? "TRUE" : "FALSE");
+ } else {
+ condition = FALSE;
}
- if (child->type == MOD_UPDATE) {
- modgroup *g = mod_callabletogroup(child);
-
- myresult = radius_update_attrlist(request, g->cs,
- g->vps, child->name);
- goto handle_result;
+ /*
+ * Didn't pass. Remember that.
+ */
+ if (!condition) {
+ was_if = TRUE;
+ if_taken = FALSE;
+ goto next_sibling;
}
/*
- * Child is a group that has children of it's own.
+ * We took the "if". Go recurse into its' children.
*/
- if (child->type != MOD_SINGLE) {
- int count = 1;
- modcallable *p, *q, *null_case;
- modgroup *g = mod_callabletogroup(child);
+ was_if = TRUE;
+ if_taken = TRUE;
+ goto do_children;
+ } /* MOD_IF */
- stack.pointer++;
+ /*
+ * "else" if the previous "if" was taken.
+ * "if" if the previous if wasn't taken.
+ */
+ if (c->type == MOD_ELSIF) {
+ if (!was_if) goto elsif_error;
- /*
- * Catastrophic error. This SHOULD have
- * been caught when we were reading in the
- * conf files.
- *
- * FIXME: Do so.
- */
- if (stack.pointer >= MODCALL_STACK_MAX) {
- radlog(L_ERR, "Internal sanity check failed: module stack is too deep");
- exit(1);
- }
+ /*
+ * Like MOD_ELSE, but allow for a later "else"
+ */
+ if (if_taken) {
+ RDEBUG2("%.*s ... skipping %s for request %d: Preceding \"if\" was taken",
+ depth + 1, modcall_spaces,
+ group_name[c->type], request->number);
+ was_if = TRUE;
+ if_taken = TRUE;
+ goto next_sibling;
+ }
- stack.priority[stack.pointer] = 0;
- stack.result[stack.pointer] = default_component_results[component];
- switch (child->type) {
- char buffer[1024];
-
- case MOD_IF:
- case MOD_ELSE:
- case MOD_ELSIF:
- case MOD_CASE:
- case MOD_GROUP:
- stack.children[stack.pointer] = g->children;
- break;
+ /*
+ * Check the "if" condition.
+ */
+ goto mod_if;
+ } /* MOD_ELSIF */
- /*
- * See the "camel book" for why
- * this works.
- *
- * If (rand(0..n) < 1), pick the
- * current realm. We add a scale
- * factor of 65536, to avoid
- * floating point.
- */
- case MOD_LOAD_BALANCE:
- case MOD_REDUNDANT_LOAD_BALANCE:
- q = NULL;
- for(p = g->children; p; p = p->next) {
- if (!q) {
- q = p;
- count = 1;
- continue;
- }
-
- count++;
-
- if ((count * (lrad_rand() & 0xffff)) < (uint32_t) 0x10000) {
- q = p;
- }
- }
- stack.children[stack.pointer] = q;
- break;
+ /*
+ * "else" for a preceding "if".
+ */
+ if (c->type == MOD_ELSE) {
+ if (!was_if) { /* error */
+ elsif_error:
+ RDEBUG2("%.*s ... skipping %s for request %d: No preceding \"if\"",
+ depth + 1, modcall_spaces,
+ group_name[c->type], request->number);
+ goto next_sibling;
+ }
- case MOD_SWITCH:
- radius_xlat(buffer, sizeof(buffer),
- child->name, request, NULL);
-
- null_case = q = NULL;
- for(p = g->children; p; p = p->next) {
- if (!p->name) {
- if (!null_case) null_case = p;
- continue;
- }
- if (strcmp(buffer, p->name) == 0) {
- q = p;
- break;
- }
- }
+ if (if_taken) {
+ RDEBUG2("%.*s ... skipping %s for request %d: Preceding \"if\" was taken",
+ depth + 1, modcall_spaces,
+ group_name[c->type], request->number);
+ was_if = FALSE;
+ if_taken = FALSE;
+ goto next_sibling;
+ }
- if (!q) q = null_case;
+ /*
+ * We need to process it. Go do that.
+ */
+ was_if = FALSE;
+ if_taken = FALSE;
+ goto do_children;
+ } /* MOD_ELSE */
- stack.children[stack.pointer] = q;
- break;
+ /*
+ * We're no longer processing if/else/elsif. Reset the
+ * trackers for those conditions.
+ */
+ was_if = FALSE;
+ if_taken = FALSE;
- default:
- DEBUG2("Internal sanity check failed in modcall %d", child->type);
- exit(1); /* internal sanity check failure */
- break;
- }
+ if (c->type == MOD_SINGLE) {
+ modsingle *sp;
+ /*
+ * Process a stand-alone child, and fall through
+ * to dealing with it's parent.
+ */
+ sp = mod_callabletosingle(c);
+
+ result = call_modsingle(c->method, sp, request);
+ RDEBUG2("%.*s[%s] = %s", depth + 1, modcall_spaces, c->name ? c->name : "",
+ fr_int2str(mod_rcode_table, result, "<invalid>"));
+ goto calculate_result;
+ } /* MOD_SINGLE */
- stack.start[stack.pointer] = stack.children[stack.pointer];
+ /*
+ * Update attribute(s)
+ */
+ if (c->type == MOD_UPDATE) {
+ int rcode;
+ modgroup *g = mod_callabletogroup(c);
- DEBUG2("%.*s- entering %s %s",
- stack.pointer, modcall_spaces,
- group_name[child->type],
- child->name ? child->name : "");
+ MOD_LOG_OPEN_BRACE("update");
+ rcode = radius_update_attrlist(request, g->cs,
+ g->vps, c->name);
+ if (rcode != RLM_MODULE_UPDATED) {
+ result = rcode;
+ } else {
+ result = RLM_MODULE_NOOP;
+ }
+ MOD_LOG_CLOSE_BRACE();
+ goto calculate_result;
+ } /* MOD_IF */
- /*
- * Catch the special case of a NULL group.
- */
- if (!stack.children[stack.pointer]) {
- /*
- * Print message for NULL group
- */
- DEBUG2("%.*s- %s %s returns %s",
- stack.pointer + 1, modcall_spaces,
- group_name[child->type],
- child->name ? child->name : "",
- lrad_int2str(rcode_table,
- stack.result[stack.pointer],
- "??"));
- goto do_return;
- }
+ /*
+ * Child is a group that has children of it's own.
+ */
+ if ((c->type == MOD_GROUP) || (c->type == MOD_POLICY) ||
+ (c->type == MOD_CASE)) {
+ modgroup *g;
- /*
- * The child may be a group, so we want to
- * recurse into it's children, rather than
- * falling through to the code below.
- */
- continue;
- }
+ do_children:
+ g = mod_callabletogroup(c);
/*
- * Process a stand-alone child, and fall through
- * to dealing with it's parent.
+ * This should really have been caught in the
+ * compiler, and the node never generated. But
+ * doing that requires changing it's API so that
+ * it returns a flag instead of the compiled
+ * MOD_GROUP.
*/
- sp = mod_callabletosingle(child);
+ if (!g->children) {
+ RDEBUG2("%.*s%s %s { ... } # empty sub-section is ignored",
+ depth + 1, modcall_spaces, group_name[c->type], c->name);
+ goto next_sibling;
+ }
- myresult = call_modsingle(component, sp, request,
- default_component_results[component]);
- handle_result:
- DEBUG2("%.*s[%s] returns %s",
- stack.pointer + 1, modcall_spaces,
- child->name ? child->name : "",
- lrad_int2str(rcode_table, myresult, "??"));
+ MOD_LOG_OPEN_BRACE(group_name[c->type]);
+ modcall_child(request, component,
+ depth + 1, entry, g->children,
+ &result, TRUE);
+ MOD_LOG_CLOSE_BRACE();
+ goto calculate_result;
+ } /* MOD_GROUP */
+ if (c->type == MOD_SWITCH) {
+ modcallable *this, *found, *null_case;
+ modgroup *g;
+ char buffer[1024];
- /*
- * FIXME: Allow modules to push a modcallable
- * onto this stack. This should simplify
- * configuration a LOT!
- *
- * Once we do that, we can't do load-time
- * checking of the maximum stack depth, and we've
- * got to cache the stack pointer before storing
- * myresult.
- *
- * Also, if the stack changed, we need to set
- * children[ptr] to NULL, and process the next
- * entry on the stack, rather than falling
- * through to finalize the processing of this
- * entry.
- *
- * Don't put "myresult" on the stack here,
- * we have to do so with priority.
- */
+ MOD_LOG_OPEN_BRACE("switch");
/*
- * We roll back up the stack at this point.
+ * If there's no %, it refers to an attribute.
+ * Otherwise, expand it.
*/
- unroll:
- /*
- * The child's action says return. Do so.
- */
- if (child->actions[myresult] == MOD_ACTION_RETURN) {
- stack.result[stack.pointer] = myresult;
- stack.children[stack.pointer] = NULL;
- goto do_return;
+ if (!strchr(c->name, '%')) {
+ VALUE_PAIR *vp = NULL;
+
+ if (radius_get_vp(request, c->name, &vp) && vp) {
+ vp_prints_value(buffer,
+ sizeof(buffer),
+ vp, 0);
+ } else {
+ *buffer = '\0';
+ }
+ } else {
+ radius_xlat(buffer, sizeof(buffer),
+ c->name, request, NULL);
}
/*
- * If "reject", break out of the loop and return
- * reject.
+ * Find either the exact matching name, or the
+ * "case {...}" statement.
*/
- if (child->actions[myresult] == MOD_ACTION_REJECT) {
- stack.children[stack.pointer] = NULL;
- stack.result[stack.pointer] = RLM_MODULE_REJECT;
- goto do_return;
+ g = mod_callabletogroup(c);
+ null_case = found = NULL;
+ for (this = g->children; this; this = this->next) {
+ if (!this->name) {
+ if (!null_case) null_case = this;
+ continue;
+ }
+ if (strcmp(buffer, this->name) == 0) {
+ found = this;
+ break;
+ }
}
+
+ if (!found) found = null_case;
+
+ MOD_LOG_OPEN_BRACE(group_name[c->type]);
+ modcall_child(request, component,
+ depth + 1, entry, found,
+ &result, TRUE);
+ MOD_LOG_CLOSE_BRACE();
+ goto calculate_result;
+ } /* MOD_SWITCH */
+
+ if ((c->type == MOD_LOAD_BALANCE) ||
+ (c->type == MOD_REDUNDANT_LOAD_BALANCE)) {
+ int count = 0;
+ modcallable *this, *found;
+ modgroup *g;
+
+ MOD_LOG_OPEN_BRACE("load-balance");
+
+ g = mod_callabletogroup(c);
+ found = NULL;
+ for (this = g->children; this; this = this->next) {
+ if (!found) {
+ found = this;
+ count = 1;
+ continue;
+ }
+ count++;
- /*
- * Otherwise, the action is a number, the
- * preference level of this return code. If no
- * higher preference has been seen yet, remember
- * this one.
- */
- if (child->actions[myresult] >= stack.priority[stack.pointer]) {
- stack.result[stack.pointer] = myresult;
- stack.priority[stack.pointer] = child->actions[myresult];
+ if ((count * (fr_rand() & 0xffff)) < (uint32_t) 0x10000) {
+ found = this;
+ }
}
- /*
- * No parent, we must be done.
- */
- if (!parent) {
- rad_assert(stack.pointer == 0);
- myresult = stack.result[0];
- break;
+ MOD_LOG_OPEN_BRACE(group_name[c->type]);
+
+ if (c->type == MOD_LOAD_BALANCE) {
+ modcall_child(request, component,
+ depth + 1, entry, found,
+ &result, FALSE);
+
+ } else {
+ this = found;
+
+ do {
+ modcall_child(request, component,
+ depth + 1, entry, found,
+ &result, FALSE);
+ if (found->actions[result] == MOD_ACTION_RETURN) {
+ priority = -1;
+ break;
+ }
+
+ this = this->next;
+ if (!this) this = g->children;
+ } while (this != found);
}
+ MOD_LOG_CLOSE_BRACE();
+ goto calculate_result;
+ } /* MOD_LOAD_BALANCE */
- rad_assert(child != NULL);
+ /*
+ * Reference another virtual server.
+ *
+ * This should really be deleted, and replaced with a
+ * more abstracted / functional version.
+ */
+ if (c->type == MOD_REFERENCE) {
+ modref *mr = mod_callabletoref(c);
+ char const *server = request->server;
- /*
- * Go to the "next" child, whatever that is.
- */
- switch (parent->type) {
- case MOD_IF:
- case MOD_ELSE:
- case MOD_ELSIF:
- case MOD_CASE:
- case MOD_GROUP:
- stack.children[stack.pointer] = child->next;
- break;
+ if (server == mr->ref_name) {
+ radlog(L_INFO, "WARNING: Suppressing recursive call to server %s", server);
+ goto next_sibling;
+ }
- case MOD_SWITCH:
- case MOD_LOAD_BALANCE:
- stack.children[stack.pointer] = NULL;
- break;
+ request->server = mr->ref_name;
+ RDEBUG("server %s { # nested call", mr->ref_name);
+ result = indexed_modcall(component, 0, request);
+ RDEBUG("} # server %s with nested call", mr->ref_name);
+ request->server = server;
+ goto calculate_result;
+ } /* MOD_REFERENCE */
- case MOD_REDUNDANT_LOAD_BALANCE:
- if (child->next) {
- stack.children[stack.pointer] = child->next;
- } else {
- modgroup *g = mod_callabletogroup(parent);
+ /*
+ * xlat a string without doing anything else
+ *
+ * This should really be deleted, and replaced with a
+ * more abstracted / functional version.
+ */
+ if (c->type == MOD_XLAT) {
+ modxlat *mx = mod_callabletoxlat(c);
+ char buffer[128];
- stack.children[stack.pointer] = g->children;
- }
- if (stack.children[stack.pointer] == stack.start[stack.pointer]) {
- stack.children[stack.pointer] = NULL;
- }
- break;
- default:
- DEBUG2("Internal sanity check failed in modcall next %d", child->type);
- exit(1);
+ if (!mx->exec) {
+ radius_xlat(buffer, sizeof(buffer),
+ mx->xlat_name, request, NULL);
+ } else {
+ RDEBUG("`%s`", mx->xlat_name);
+ radius_exec_program(mx->xlat_name, request,
+ 0, NULL, 0,
+ EXEC_TIMEOUT,
+ request->packet->vps,
+ NULL, 1);
}
- /*
- * No child, we're done this group, and we return
- * "myresult" to the caller by pushing it back up
- * the stack.
- */
- if (!stack.children[stack.pointer]) {
- do_return:
- rad_assert(stack.pointer > 0);
- myresult = stack.result[stack.pointer];
- stack.pointer--;
-
- if (stack.pointer == 0) break;
-
- DEBUG2("%.*s- %s %s returns %s",
- stack.pointer + 1, modcall_spaces,
- group_name[parent->type],
- parent->name ? parent->name : "",
- lrad_int2str(rcode_table, myresult, "??"));
-
- if ((parent->type == MOD_IF) ||
- (parent->type == MOD_ELSIF)) {
- if_taken = was_if = TRUE;
- } else {
- if_taken = was_if = FALSE;
- }
+ goto next_sibling;
+ } /* MOD_XLAT */
+
+ /*
+ * Add new module types here.
+ */
- /*
- * Unroll the stack.
- */
- child = stack.children[stack.pointer];
- parent = child->parent;
- goto unroll;
- }
+calculate_result:
+#if 0
+ RDEBUG("(%s, %d) ? (%s, %d)",
+ fr_int2str(mod_rcode_table, result, "<invalid>"),
+ priority,
+ fr_int2str(mod_rcode_table, entry->result, "<invalid>"),
+ entry->priority);
+#endif
- } /* loop until done */
+ /*
+ * The child's action says return. Do so.
+ */
+ if ((c->actions[result] == MOD_ACTION_RETURN) &&
+ (priority <= 0)) {
+ entry->result = result;
+ return TRUE;
+ }
- return myresult;
+ /*
+ * If "reject", break out of the loop and return
+ * reject.
+ */
+ if (c->actions[result] == MOD_ACTION_REJECT) {
+ entry->result = RLM_MODULE_REJECT;
+ return TRUE;
+ }
+
+ /*
+ * The array holds a default priority for this return
+ * code. Grab it in preference to any unset priority.
+ */
+ if (priority < 0) {
+ priority = c->actions[result];
+ }
+
+ /*
+ * We're higher than any previous priority, remember this
+ * return code and priority.
+ */
+ if (priority > entry->priority) {
+ entry->result = result;
+ entry->priority = priority;
+ }
+
+ /*
+ * If we're processing a "case" statement, we return once
+ * it's done, rather than going to the next "case" statement.
+ */
+ if (c->type == MOD_CASE) return TRUE;
+
+next_sibling:
+ if (do_next_sibling) {
+ entry->c = entry->c->next;
+
+ if (entry->c) goto redo;
+ }
+
+ /*
+ * And we're done!
+ */
+ return TRUE;
}
+/**
+ * @brief Call a module, iteratively, with a local stack, rather than
+ * recursively. What did Paul Graham say about Lisp...?
+ */
+int modcall(int component, modcallable *c, REQUEST *request)
+{
+ modcall_stack_entry_t stack[MODCALL_STACK_MAX];
+
+ if ((component < 0) || (component >= RLM_COMPONENT_COUNT)) {
+ return RLM_MODULE_FAIL;
+ }
+
+ /*
+ * Set up the initial stack frame.
+ */
+ stack[0].c = c;
+ stack[0].result = default_component_results[component];
+ stack[0].priority = 0;
+
+ /*
+ * Call the main handler.
+ */
+ if (!modcall_recurse(request, component, 0, &stack[0], TRUE)) {
+ return RLM_MODULE_FAIL;
+ }
+
+ /*
+ * Return the result.
+ */
+ return stack[0].result;
+}
+
#if 0
static const char *action2str(int action)
{
modsingle *single = mod_callabletosingle(c);
DEBUG("%.*s%s {", indent, "\t\t\t\t\t\t\t\t\t\t\t",
single->modinst->name);
- } else {
+ } else if ((c->type > MOD_SINGLE) && (c->type <= MOD_POLICY)) {
modgroup *g = mod_callabletogroup(c);
modcallable *p;
DEBUG("%.*s%s {", indent, "\t\t\t\t\t\t\t\t\t\t\t",
group_name[c->type]);
for(p = g->children;p;p = p->next)
dump_mc(p, indent+1);
- }
+ } /* else ignore it for now */
for(i = 0; i<RLM_MODULE_NUMCODES; ++i) {
DEBUG("%.*s%s = %s", indent+1, "\t\t\t\t\t\t\t\t\t\t\t",
- lrad_int2str(rcode_table, i, "??"),
+ fr_int2str(rcode_table, i, "??"),
action2str(c->actions[i]));
}
static void dump_tree(int comp, modcallable *c)
{
- DEBUG("[%s]", comp2str[comp]);
+ RDEBUG("[%s]", comp2str[comp]);
dump_mc(c, 0);
}
#else
MOD_ACTION_RETURN /* updated */
}
}
+#ifdef WITH_COA
+ ,
+ /* recv-coa */
+ {
+ /* group */
+ {
+ MOD_ACTION_RETURN, /* reject */
+ MOD_ACTION_RETURN, /* fail */
+ 3, /* ok */
+ MOD_ACTION_RETURN, /* handled */
+ MOD_ACTION_RETURN, /* invalid */
+ MOD_ACTION_RETURN, /* userlock */
+ 1, /* notfound */
+ 2, /* noop */
+ 4 /* updated */
+ },
+ /* redundant */
+ {
+ MOD_ACTION_RETURN, /* reject */
+ 1, /* fail */
+ MOD_ACTION_RETURN, /* ok */
+ MOD_ACTION_RETURN, /* handled */
+ MOD_ACTION_RETURN, /* invalid */
+ MOD_ACTION_RETURN, /* userlock */
+ MOD_ACTION_RETURN, /* notfound */
+ MOD_ACTION_RETURN, /* noop */
+ MOD_ACTION_RETURN /* updated */
+ },
+ /* append */
+ {
+ MOD_ACTION_RETURN, /* reject */
+ 1, /* fail */
+ MOD_ACTION_RETURN, /* ok */
+ MOD_ACTION_RETURN, /* handled */
+ MOD_ACTION_RETURN, /* invalid */
+ MOD_ACTION_RETURN, /* userlock */
+ 2, /* notfound */
+ MOD_ACTION_RETURN, /* noop */
+ MOD_ACTION_RETURN /* updated */
+ }
+ },
+ /* send-coa */
+ {
+ /* group */
+ {
+ MOD_ACTION_RETURN, /* reject */
+ MOD_ACTION_RETURN, /* fail */
+ 3, /* ok */
+ MOD_ACTION_RETURN, /* handled */
+ MOD_ACTION_RETURN, /* invalid */
+ MOD_ACTION_RETURN, /* userlock */
+ 1, /* notfound */
+ 2, /* noop */
+ 4 /* updated */
+ },
+ /* redundant */
+ {
+ MOD_ACTION_RETURN, /* reject */
+ 1, /* fail */
+ MOD_ACTION_RETURN, /* ok */
+ MOD_ACTION_RETURN, /* handled */
+ MOD_ACTION_RETURN, /* invalid */
+ MOD_ACTION_RETURN, /* userlock */
+ MOD_ACTION_RETURN, /* notfound */
+ MOD_ACTION_RETURN, /* noop */
+ MOD_ACTION_RETURN /* updated */
+ },
+ /* append */
+ {
+ MOD_ACTION_RETURN, /* reject */
+ 1, /* fail */
+ MOD_ACTION_RETURN, /* ok */
+ MOD_ACTION_RETURN, /* handled */
+ MOD_ACTION_RETURN, /* invalid */
+ MOD_ACTION_RETURN, /* userlock */
+ 2, /* notfound */
+ MOD_ACTION_RETURN, /* noop */
+ MOD_ACTION_RETURN /* updated */
+ }
+ }
+#endif
};
+#ifdef WITH_UNLANG
static modcallable *do_compile_modupdate(modcallable *parent,
int component, CONF_SECTION *cs,
const char *name2)
{
int i, ok = FALSE;
+ const char *vp_name;
modgroup *g;
modcallable *csingle;
CONF_ITEM *ci;
static const char *attrlist_names[] = {
"request", "reply", "proxy-request", "proxy-reply",
- "config", "control", NULL
+ "config", "control",
+ "coa", "coa-reply", "disconnect", "disconnect-reply",
+ NULL
};
component = component; /* -Wunused */
if (!cf_section_name2(cs)) {
- radlog(L_ERR|L_CONS,
- "%s[%d] Require list name for 'update'.\n",
- cf_section_filename(cs), cf_section_lineno(cs));
+ cf_log_err(cf_sectiontoitem(cs),
+ "Require list name for 'update'.\n");
return NULL;
}
+ vp_name = name2;
+ if (strncmp(vp_name, "outer.", 6) == 0) {
+ vp_name += 6;
+ }
+
for (i = 0; attrlist_names[i] != NULL; i++) {
- if (strcmp(name2, attrlist_names[i]) == 0) {
+ if (strcmp(vp_name, attrlist_names[i]) == 0) {
ok = TRUE;
break;
}
}
if (!ok) {
- radlog(L_ERR, "%s[%d]: Unknown attribute list \"%s\"",
- cf_section_filename(cs), cf_section_lineno(cs), name2);
+ cf_log_err(cf_sectiontoitem(cs),
+ "Unknown attribute list \"%s\"",
+ name2);
return NULL;
}
VALUE_PAIR *vp;
if (cf_item_is_section(ci)) {
- radlog(L_ERR|L_CONS,
- "%s[%d]: \"update\" sections cannot have subsections",
- cf_section_filename(cf_itemtosection(ci)),
- cf_section_lineno(cf_itemtosection(ci)));
+ cf_log_err(ci, "\"update\" sections cannot have subsections");
return NULL;
}
+ if (!cf_item_is_pair(ci)) continue;
+
cp = cf_itemtopair(ci); /* can't return NULL */
vp = cf_pairtovp(cp);
if (!vp) {
pairfree(&head);
- radlog(L_ERR|L_CONS, "%s[%d]: ERROR: %s",
- cf_pair_filename(cp), cf_pair_lineno(cp), librad_errstr);
+ cf_log_err(ci, "ERROR: %s", fr_strerror());
return NULL;
}
if ((vp->operator != T_OP_EQ) &&
+ (vp->operator != T_OP_CMP_EQ) &&
(vp->operator != T_OP_ADD) &&
(vp->operator != T_OP_SUB) &&
(vp->operator != T_OP_LE) &&
(vp->operator != T_OP_GE) &&
+ (vp->operator != T_OP_CMP_FALSE) &&
(vp->operator != T_OP_SET)) {
pairfree(&head);
- radlog(L_ERR|L_CONS, "%s[%d]: Invalid operator for attribute",
- cf_pair_filename(cp), cf_pair_lineno(cp));
+ pairfree(&vp);
+ cf_log_err(ci, "Invalid operator for attribute");
return NULL;
}
(vp->type != PW_TYPE_SHORT) &&
(vp->type != PW_TYPE_INTEGER)) {
pairfree(&head);
- radlog(L_ERR|L_CONS, "%s[%d]: Enforcment of <= or >= is possible only for integer attributes",
- cf_pair_filename(cp), cf_pair_lineno(cp));
+ pairfree(&vp);
+ cf_log_err(ci, "Enforcment of <= or >= is possible only for integer attributes");
return NULL;
}
}
}
if (!head) {
- radlog(L_ERR|L_CONS,
- "%s[%d]: ERROR: update %s section cannot be empty",
- cf_section_filename(cs), cf_section_lineno(cs), name2);
+ cf_log_err(cf_sectiontoitem(cs),
+ "ERROR: update %s section cannot be empty",
+ name2);
return NULL;
}
csingle->parent = parent;
csingle->next = NULL;
csingle->name = name2;
- csingle->lineno = cf_section_lineno(cs);
csingle->type = MOD_UPDATE;
+ csingle->method = component;
+
+ memcpy(csingle->actions, defaultactions[component][GROUPTYPE_SIMPLE],
+ sizeof(csingle->actions));
g->grouptype = GROUPTYPE_SIMPLE;
g->children = NULL;
static modcallable *do_compile_modswitch(modcallable *parent,
- int component, CONF_SECTION *cs)
+ int component, CONF_SECTION *cs)
{
modcallable *csingle;
CONF_ITEM *ci;
component = component; /* -Wunused */
if (!cf_section_name2(cs)) {
- radlog(L_ERR|L_CONS,
- "%s[%d] Require variable to switch over for 'switch'.",
- cf_section_filename(cs), cf_section_lineno(cs));
+ cf_log_err(cf_sectiontoitem(cs),
+ "You must specify a variable to switch over for 'switch'.");
return NULL;
}
if (!cf_item_find_next(cs, NULL)) {
- radlog(L_ERR|L_CONS,
- "%s[%d] 'switch' statments cannot be empty.",
- cf_section_filename(cs), cf_section_lineno(cs));
+ cf_log_err(cf_sectiontoitem(cs), "'switch' statments cannot be empty.");
return NULL;
}
const char *name1, *name2;
if (!cf_item_is_section(ci)) {
- radlog(L_ERR|L_CONS,
- "%s[%d]: \"switch\" sections can only have \"case\" subsections",
- cf_pair_filename(cf_itemtopair(ci)),
- cf_pair_lineno(cf_itemtopair(ci)));
+ if (!cf_item_is_pair(ci)) continue;
+
+ cf_log_err(ci, "\"switch\" sections can only have \"case\" subsections");
return NULL;
}
name1 = cf_section_name1(subcs);
if (strcmp(name1, "case") != 0) {
- radlog(L_ERR|L_CONS,
- "%s[%d]: \"switch\" sections can only have \"case\" subsections",
- cf_section_filename(cf_itemtosection(ci)),
- cf_section_lineno(cf_itemtosection(ci)));
+ cf_log_err(ci, "\"switch\" sections can only have \"case\" subsections");
return NULL;
}
}
if (!name2 || (name2[0] == '\0')) {
- radlog(L_ERR|L_CONS,
- "%s[%d]: \"case\" sections must have a name",
- cf_section_filename(cf_itemtosection(ci)),
- cf_section_lineno(cf_itemtosection(ci)));
+ cf_log_err(ci, "\"case\" sections must have a name");
return NULL;
}
}
csingle->type = MOD_SWITCH;
return csingle;
}
+#endif
+
+static modcallable *do_compile_modserver(modcallable *parent,
+ int component, CONF_ITEM *ci,
+ const char *name,
+ CONF_SECTION *cs,
+ const char *server)
+{
+ modcallable *csingle;
+ CONF_SECTION *subcs;
+ modref *mr;
+
+ subcs = cf_section_sub_find_name2(cs, comp2str[component], NULL);
+ if (!subcs) {
+ cf_log_err(ci, "Server %s has no %s section",
+ server, comp2str[component]);
+ return NULL;
+ }
+
+ mr = rad_malloc(sizeof(*mr));
+ memset(mr, 0, sizeof(*mr));
+
+ csingle = mod_reftocallable(mr);
+ csingle->parent = parent;
+ csingle->next = NULL;
+ csingle->name = name;
+ csingle->type = MOD_REFERENCE;
+ csingle->method = component;
+
+ memcpy(csingle->actions, defaultactions[component][GROUPTYPE_SIMPLE],
+ sizeof(csingle->actions));
+
+ mr->ref_name = strdup(server);
+ mr->ref_cs = cs;
+
+ return csingle;
+}
+
+static modcallable *do_compile_modxlat(modcallable *parent,
+ int component, const char *fmt)
+{
+ modcallable *csingle;
+ modxlat *mx;
+
+ mx = rad_malloc(sizeof(*mx));
+ memset(mx, 0, sizeof(*mx));
+
+ csingle = mod_xlattocallable(mx);
+ csingle->parent = parent;
+ csingle->next = NULL;
+ csingle->name = "expand";
+ csingle->type = MOD_XLAT;
+ csingle->method = component;
+
+ memcpy(csingle->actions, defaultactions[component][GROUPTYPE_SIMPLE],
+ sizeof(csingle->actions));
+
+ mx->xlat_name = strdup(fmt);
+ if (fmt[0] != '%') {
+ char *p;
+ mx->exec = TRUE;
+
+ strcpy(mx->xlat_name, fmt + 1);
+ p = strrchr(mx->xlat_name, '`');
+ if (p) *p = '\0';
+ }
+
+ return csingle;
+}
/*
* redundant, etc. can refer to modules or groups, but not much else.
for (ci=cf_item_find_next(cs, NULL);
ci != NULL;
ci=cf_item_find_next(cs, ci)) {
- CONF_PAIR *cp;
-
/*
* If we're a redundant, etc. group, then the
* intention is to call modules, rather than
*/
if (cf_item_is_section(ci)) {
CONF_SECTION *subcs = cf_itemtosection(ci);
- const char *name1 = cf_section_name1(cs);
+ const char *name1 = cf_section_name1(subcs);
if ((strcmp(name1, "if") == 0) ||
(strcmp(name1, "else") == 0) ||
(strcmp(name1, "update") == 0) ||
(strcmp(name1, "switch") == 0) ||
(strcmp(name1, "case") == 0)) {
- radlog(L_ERR, "%s[%d]: %s sections cannot contain a \"%s\" statement",
- cf_section_filename(subcs),
- cf_section_lineno(subcs),
+ cf_log_err(ci, "%s sections cannot contain a \"%s\" statement",
name, name1);
- return NULL;
+ return 0;
}
continue;
}
if (cf_item_is_pair(ci)) {
CONF_PAIR *cp = cf_itemtopair(ci);
if (cf_pair_value(cp) != NULL) {
- radlog(L_ERR, "%s[%d]: Invalid entry in %s section",
- cf_pair_filename(cp), cf_pair_lineno(cp), name);
+ cf_log_err(ci,
+ "Entry with no value is invalid");
return 0;
}
}
int grouptype,
const char **modname)
{
- int lineno, result;
- const char *modrefname, *filename;
+#ifdef WITH_UNLANG
+ int result;
+#endif
+ const char *modrefname;
modsingle *single;
modcallable *csingle;
module_instance_t *this;
- CONF_SECTION *cs, *subcs;
+ CONF_SECTION *cs, *subcs, *modules;
if (cf_item_is_section(ci)) {
- cs = cf_itemtosection(ci);
- const char *name2 = cf_section_name2(cs);
+ const char *name2;
- filename = cf_section_filename(cs);
- lineno = cf_section_lineno(cs);
+ cs = cf_itemtosection(ci);
modrefname = cf_section_name1(cs);
+ name2 = cf_section_name2(cs);
if (!name2) name2 = "_UnNamedGroup";
/*
csingle->type = MOD_REDUNDANT_LOAD_BALANCE;
return csingle;
+#ifdef WITH_UNLANG
} else if (strcmp(modrefname, "if") == 0) {
if (!cf_section_name2(cs)) {
- radlog(L_ERR|L_CONS,
- "%s[%d]: 'if' without condition.",
- filename, lineno);
+ cf_log_err(ci, "'if' without condition.");
return NULL;
}
if (!csingle) return NULL;
csingle->type = MOD_IF;
- if (!radius_evaluate_condition(NULL, 0, modname,
+ if (!radius_evaluate_condition(NULL, 0, 0, modname,
FALSE, &result)) {
modcallable_free(&csingle);
return NULL;
if (parent &&
((parent->type == MOD_LOAD_BALANCE) ||
(parent->type == MOD_REDUNDANT_LOAD_BALANCE))) {
- radlog(L_ERR|L_CONS,
- "%s[%d] 'elsif' cannot be used in this section section.",
- filename, lineno);
+ cf_log_err(ci, "'elsif' cannot be used in this section.");
return NULL;
}
if (!cf_section_name2(cs)) {
- radlog(L_ERR|L_CONS,
- "%s[%d] 'elsif' without condition.",
- filename, lineno);
+ cf_log_err(ci, "'elsif' without condition.");
return NULL;
}
if (!csingle) return NULL;
csingle->type = MOD_ELSIF;
- if (!radius_evaluate_condition(NULL, 0, modname,
+ if (!radius_evaluate_condition(NULL, 0, 0, modname,
FALSE, &result)) {
modcallable_free(&csingle);
return NULL;
if (parent &&
((parent->type == MOD_LOAD_BALANCE) ||
(parent->type == MOD_REDUNDANT_LOAD_BALANCE))) {
- radlog(L_ERR|L_CONS,
- "%s[%d] 'else' cannot be used in this section section.",
- filename, lineno);
+ cf_log_err(ci, "'else' cannot be used in this section section.");
return NULL;
}
if (cf_section_name2(cs)) {
- radlog(L_ERR|L_CONS,
- "%s[%d] Cannot have conditions on 'else'.",
- filename, lineno);
+ cf_log_err(ci, "Cannot have conditions on 'else'.");
return NULL;
}
* be a "switch" statement?
*/
if (!parent) {
- radlog(L_ERR, "%s[%d]: \"case\" statements may only appear within a \"switch\" section",
- filename, lineno);
+ cf_log_err(ci, "\"case\" statements may only appear within a \"switch\" section");
return NULL;
}
}
return csingle;
- }
+#endif
+ } /* else it's something like sql { fail = 1 ...} */
+
+ } else if (!cf_item_is_pair(ci)) { /* CONF_DATA or some such */
+ return NULL;
/*
* Else it's a module reference, with updated return
* codes.
*/
} else {
+ CONF_SECTION *loop;
CONF_PAIR *cp = cf_itemtopair(ci);
- filename = cf_pair_filename(cp);
- lineno = cf_pair_lineno(cp);
modrefname = cf_pair_attr(cp);
- }
- /*
- * See if the module is a virtual one. If so, return that,
- * rather than doing anything here.
- */
- if (((cs = cf_section_find("instantiate")) != NULL) &&
- (subcs = cf_section_sub_find_name2(cs, NULL, modrefname)) != NULL) {
- DEBUG2(" Module: Loading virtual module %s", modrefname);
+ /*
+ * Actions (ok = 1), etc. are orthoganal to just
+ * about everything else.
+ */
+ if (cf_pair_value(cp) != NULL) {
+ cf_log_err(ci, "Entry is not a reference to a module");
+ return NULL;
+ }
+
+ if (((modrefname[0] == '%') && (modrefname[1] == '{')) ||
+ (modrefname[0] == '`')) {
+ return do_compile_modxlat(parent, component,
+ modrefname);
+ }
+
+ /*
+ * See if the module is a virtual one. If so,
+ * return that, rather than doing anything here.
+ */
+ subcs = NULL;
+ cs = cf_section_find("instantiate");
+ if (cs) subcs = cf_section_sub_find_name2(cs, NULL,
+ modrefname);
+ if (!subcs &&
+ (cs = cf_section_find("policy")) != NULL) {
+ char buffer[256];
+
+ snprintf(buffer, sizeof(buffer), "%s.%s",
+ modrefname, comp2str[component]);
+
+ /*
+ * Prefer name.section, then name.
+ */
+ subcs = cf_section_sub_find_name2(cs, NULL,
+ buffer);
+ if (!subcs) {
+ subcs = cf_section_sub_find_name2(cs, NULL,
+ modrefname);
+ }
+ }
/*
- * As it's sole configuration, the
- * virtual module takes a section which
- * contains the
+ * Allow policies to over-ride module names.
+ * i.e. the "sql" policy can do some extra things,
+ * and then call the "sql" module.
*/
- return do_compile_modsingle(parent,
- component,
- cf_sectiontoitem(subcs),
- grouptype,
- modname);
+ for (loop = cf_item_parent(ci);
+ loop && subcs;
+ loop = cf_item_parent(cf_sectiontoitem(loop))) {
+ if (loop == subcs) {
+ subcs = NULL;
+ }
+ }
+
+ if (subcs) {
+ DEBUG2(" Module: Loading virtual module %s",
+ modrefname);
+
+ /*
+ * redundant foo {} is a single.
+ */
+ if (cf_section_name2(subcs)) {
+ return do_compile_modsingle(parent,
+ component,
+ cf_sectiontoitem(subcs),
+ grouptype,
+ modname);
+ } else {
+ /*
+ * foo {} is a group.
+ */
+ return do_compile_modgroup(parent,
+ component,
+ subcs,
+ GROUPTYPE_SIMPLE,
+ grouptype);
+ }
+ }
}
/*
* Not a virtual module. It must be a real module.
*/
- this = find_module_instance(cf_section_find("modules"), modrefname);
- if (!this) {
+ modules = cf_section_find("modules");
+ this = NULL;
+
+ if (modules && cf_section_sub_find_name2(modules, NULL, modrefname)) {
+ this = find_module_instance(modules, modrefname, 1);
+ }
+
+ if (!this) do {
+ int i;
+ char *p;
+
+ /*
+ * Maybe it's module.method
+ */
+ p = strrchr(modrefname, '.');
+ if (p) for (i = RLM_COMPONENT_AUTH;
+ i < RLM_COMPONENT_COUNT;
+ i++) {
+ if (strcmp(p + 1, comp2str[i]) == 0) {
+ char buffer[256];
+
+ strlcpy(buffer, modrefname, sizeof(buffer));
+ buffer[p - modrefname] = '\0';
+ component = i;
+
+ this = find_module_instance(cf_section_find("modules"), buffer, 1);
+ if (this &&
+ !this->entry->module->methods[i]) {
+ *modname = NULL;
+ cf_log_err(ci, "Module %s has no such method %s", buffer, comp2str[i]);
+ return NULL;
+ }
+ break;
+ }
+ }
+ if (this) break;
+
+ if (strncmp(modrefname, "server[", 7) == 0) {
+ char buffer[256];
+
+ strlcpy(buffer, modrefname + 7, sizeof(buffer));
+ p = strrchr(buffer, ']');
+ if (!p || p[1] != '\0' || (p == buffer)) {
+ cf_log_err(ci, "Invalid server reference in \"%s\".", modrefname);
+ return NULL;
+ }
+ *p = '\0';
+
+ cs = cf_section_sub_find_name2(NULL, "server", buffer);
+ if (!cs) {
+ cf_log_err(ci, "No such server \"%s\".", buffer);
+ return NULL;
+ }
+
+ return do_compile_modserver(parent, component, ci,
+ modrefname, cs, buffer);
+ }
+
*modname = NULL;
- radlog(L_ERR|L_CONS, "%s[%d] Failed to find module \"%s\".",
- filename, lineno, modrefname);
+ cf_log_err(ci, "Failed to find \"%s\" in the \"modules\" section.", modrefname);
return NULL;
- }
+ } while (0);
/*
* We know it's all OK, allocate the structures, and fill
csingle = mod_singletocallable(single);
csingle->parent = parent;
csingle->next = NULL;
- csingle->lineno = lineno;
- memcpy(csingle->actions, defaultactions[component][grouptype],
- sizeof csingle->actions);
+ if (!parent || (component != RLM_COMPONENT_AUTH)) {
+ memcpy(csingle->actions, defaultactions[component][grouptype],
+ sizeof csingle->actions);
+ } else { /* inside Auth-Type has different rules */
+ memcpy(csingle->actions, defaultactions[RLM_COMPONENT_AUTZ][grouptype],
+ sizeof csingle->actions);
+ }
rad_assert(modrefname != NULL);
csingle->name = modrefname;
csingle->type = MOD_SINGLE;
+ csingle->method = component;
/*
* Singles can override the actions, virtual modules cannot.
* maybe a csingle as a ref?
*/
if (cf_item_is_section(ci)) {
+ CONF_ITEM *csi;
+
cs = cf_itemtosection(ci);
+ for (csi=cf_item_find_next(cs, NULL);
+ csi != NULL;
+ csi=cf_item_find_next(cs, csi)) {
- for (ci=cf_item_find_next(cs, NULL);
- ci != NULL;
- ci=cf_item_find_next(cs, ci)) {
-
- if (cf_item_is_section(ci)) {
- radlog(L_ERR|L_CONS,
- "%s[%d] Subsection of module instance call "
- "not allowed",
- cf_section_filename(cf_itemtosection(ci)),
- cf_section_lineno(cf_itemtosection(ci)));
+ if (cf_item_is_section(csi)) {
+ cf_log_err(csi, "Subsection of module instance call not allowed");
modcallable_free(&csingle);
return NULL;
}
- if (!compile_action(csingle, cf_itemtopair(ci))) {
+ if (!cf_item_is_pair(csi)) continue;
+
+ if (!compile_action(csingle, cf_itemtopair(csi))) {
modcallable_free(&csingle);
return NULL;
}
* wanted component
*/
if (!this->entry->module->methods[component]) {
- radlog(L_ERR|L_CONS,
- "%s[%d]: \"%s\" modules aren't allowed in '%s' sections -- they have no such method.",
- filename, lineno, this->entry->module->name,
+ cf_log_err(ci, "\"%s\" modules aren't allowed in '%s' sections -- they have no such method.", this->entry->module->name,
comp2str[component]);
modcallable_free(&csingle);
return NULL;
c = mod_grouptocallable(g);
c->parent = parent;
+ c->type = MOD_GROUP;
c->next = NULL;
- c->lineno = cf_section_lineno(cs);
memset(c->actions, 0, sizeof(c->actions));
/*
* rbtree, so that groups can reference each other...
*/
c->name = cf_section_name2(cs);
- if (!c->name) c->name = "";
- c->type = MOD_GROUP;
+ if (!c->name) {
+ c->name = cf_section_name1(cs);
+ if (strcmp(c->name, "group") == 0) {
+ c->name = "";
+ } else {
+ c->type = MOD_POLICY;
+ }
+ }
g->children = NULL;
/*
if (cf_item_is_section(ci)) {
const char *junk = NULL;
modcallable *single;
- int lineno;
CONF_SECTION *subcs = cf_itemtosection(ci);
- lineno = cf_section_lineno(subcs);
-
single = do_compile_modsingle(c, component, ci,
grouptype, &junk);
if (!single) {
- radlog(L_ERR|L_CONS,
- "%s[%d] Failed to parse \"%s\" subsection.",
- cf_section_filename(subcs),
- cf_section_lineno(subcs),
+ cf_log_err(ci, "Failed to parse \"%s\" subsection.",
cf_section_name1(subcs));
modcallable_free(&c);
return NULL;
}
add_child(g, single);
+ } else if (!cf_item_is_pair(ci)) { /* CONF_DATA */
+ continue;
+
} else {
const char *attr, *value;
CONF_PAIR *cp = cf_itemtopair(ci);
* instance with no actions
* specified ...
*/
- if (value[0] == 0) {
+ if (!value) {
modcallable *single;
const char *junk = NULL;
grouptype,
&junk);
if (!single) {
- radlog(L_ERR|L_CONS,
- "%s[%d] Failed to parse \"%s\" entry.",
- cf_pair_filename(cp),
- cf_pair_lineno(cp), attr);
+ cf_log_err(ci,
+ "Failed to parse \"%s\" entry.",
+ attr);
modcallable_free(&c);
return NULL;
}
*/
for (i = 0; i < RLM_MODULE_NUMCODES; i++) {
if (!c->actions[i]) {
- c->actions[i] = defaultactions[component][parentgrouptype][i];
+ if (!parent || (component != RLM_COMPONENT_AUTH)) {
+ c->actions[i] = defaultactions[component][parentgrouptype][i];
+ } else { /* inside Auth-Type has different rules */
+ c->actions[i] = defaultactions[RLM_COMPONENT_AUTZ][parentgrouptype][i];
+ }
}
}
rad_assert(name != NULL);
c->name = name;
c->type = MOD_GROUP;
+ c->method = component;
g->children = NULL;
*parent = mod_grouptocallable(g);
void modcallable_free(modcallable **pc)
{
modcallable *c, *loop, *next;
+
+ if (!pc || !*pc) return;
+
c = *pc;
- if (c->type != MOD_SINGLE) {
+
+ if ((c->type > MOD_SINGLE) && (c->type <= MOD_POLICY)) {
modgroup *g = mod_callabletogroup(c);
- for(loop = g->children;
+ if (g->children) for (loop = g->children;
loop ;
loop = next) {
next = loop->next;
projects / freeradius.git / blobdiff