src/main/client.c

   1 /*
   2  * client.c     Read clients into memory.
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  * Copyright 2000,2006  The FreeRADIUS server project
  21  * Copyright 2000  Miquel van Smoorenburg <miquels@cistron.nl>
  22  * Copyright 2000  Alan DeKok <aland@ox.org>
  23  */
  24
  25 #include <freeradius-devel/ident.h>
  26 RCSID("$Id$")
  27
  28 #include <freeradius-devel/radiusd.h>
  29 #include <freeradius-devel/rad_assert.h>
  30
  31 #include <sys/stat.h>
  32
  33 #include <ctype.h>
  34 #include <fcntl.h>
  35
  36 #ifdef WITH_DYNAMIC_CLIENTS
  37 #ifdef HAVE_DIRENT_H
  38 #include <dirent.h>
  39 #endif
  40 #endif
  41
  42 struct radclient_list {
  43         /*
  44          *      FIXME: One set of trees for IPv4, and another for IPv6?
  45          */
  46         rbtree_t        *trees[129]; /* for 0..128, inclusive. */
  47         int             min_prefix;
  48 };
  49
  50
  51 #ifdef WITH_STATS
  52 static rbtree_t         *tree_num = NULL;     /* client numbers 0..N */
  53 static int              tree_num_max = 0;
  54 #endif
  55 static RADCLIENT_LIST   *root_clients = NULL;
  56
  57 #ifdef WITH_DYNAMIC_CLIENTS
  58 static fr_fifo_t        *deleted_clients = NULL;
  59 #endif
  60
  61 /*
  62  *      Callback for freeing a client.
  63  */
  64 void client_free(RADCLIENT *client)
  65 {
  66 #ifdef WITH_DYNAMIC_CLIENTS
  67         if (client->dynamic == 2) {
  68                 time_t now;
  69
  70                 if (!deleted_clients) {
  71                         deleted_clients = fr_fifo_create(1024,
  72                                                          (void *) client_free);
  73                         if (!deleted_clients) return; /* MEMLEAK */
  74                 }
  75
  76                 /*
  77                  *      Mark it as in the fifo, and remember when we
  78                  *      pushed it.
  79                  */
  80                 client->dynamic = 3;
  81                 client->created = now = time(NULL); /* re-set it */
  82                 fr_fifo_push(deleted_clients, client);
  83
  84                 /*
  85                  *      Peek at the head of the fifo.  If it might
  86                  *      still be in use, return.  Otherwise, pop it
  87                  *      from the queue and delete it.
  88                  */
  89                 client = fr_fifo_peek(deleted_clients);
  90                 if ((client->created + 120) >= now) return;
  91
  92                 client = fr_fifo_pop(deleted_clients);
  93                 rad_assert(client != NULL);
  94         }
  95 #endif
  96
  97         free(client->longname);
  98         free(client->secret);
  99         free(client->shortname);
 100         free(client->nastype);
 101         free(client->login);
 102         free(client->password);
 103         free(client->server);
 104
 105 #ifdef WITH_STATS
 106         free(client->auth);
 107 #ifdef WITH_ACCOUNTING
 108         free(client->acct);
 109 #endif
 110 #endif
 111
 112 #ifdef WITH_DYNAMIC_CLIENTS
 113         free(client->client_server);
 114 #endif
 115
 116         free(client);
 117 }
 118
 119 /*
 120  *      Callback for comparing two clients.
 121  */
 122 static int client_ipaddr_cmp(const void *one, const void *two)
 123 {
 124         const RADCLIENT *a = one;
 125         const RADCLIENT *b = two;
 126 #ifndef WITH_TCP
 127
 128         return fr_ipaddr_cmp(&a->ipaddr, &b->ipaddr);
 129 #else
 130         int rcode;
 131
 132         rcode = fr_ipaddr_cmp(&a->ipaddr, &b->ipaddr);
 133         if (rcode != 0) return rcode;
 134
 135         /*
 136          *      Wildcard match
 137          */
 138         if ((a->proto == IPPROTO_IP) ||
 139             (b->proto == IPPROTO_IP)) return 0;
 140
 141         return (a->proto - b->proto);
 142 #endif
 143 }
 144
 145 #ifdef WITH_STATS
 146 static int client_num_cmp(const void *one, const void *two)
 147 {
 148         const RADCLIENT *a = one;
 149         const RADCLIENT *b = two;
 150
 151         return (a->number - b->number);
 152 }
 153 #endif
 154
 155 /*
 156  *      Free a RADCLIENT list.
 157  */
 158 void clients_free(RADCLIENT_LIST *clients)
 159 {
 160         int i;
 161
 162         if (!clients) return;
 163
 164         for (i = 0; i <= 128; i++) {
 165                 if (clients->trees[i]) rbtree_free(clients->trees[i]);
 166                 clients->trees[i] = NULL;
 167         }
 168
 169         if (clients == root_clients) {
 170 #ifdef WITH_STATS
 171                 if (tree_num) rbtree_free(tree_num);
 172                 tree_num = NULL;
 173                 tree_num_max = 0;
 174 #endif
 175                 root_clients = NULL;
 176         }
 177
 178 #ifdef WITH_DYNAMIC_CLIENTS
 179         /*
 180          *      FIXME: No fr_fifo_delete()
 181          */
 182 #endif
 183
 184         free(clients);
 185 }
 186
 187 /*
 188  *      Return a new, initialized, set of clients.
 189  */
 190 RADCLIENT_LIST *clients_init(void)
 191 {
 192         RADCLIENT_LIST *clients = calloc(1, sizeof(RADCLIENT_LIST));
 193
 194         if (!clients) return NULL;
 195
 196         clients->min_prefix = 128;
 197
 198         return clients;
 199 }
 200
 201
 202 /*
 203  *      Sanity check a client.
 204  */
 205 static int client_sane(RADCLIENT *client)
 206 {
 207         switch (client->ipaddr.af) {
 208         case AF_INET:
 209                 if (client->prefix > 32) {
 210                         return 0;
 211                 }
 212
 213                 /*
 214                  *      Zero out the subnet bits.
 215                  */
 216                 if (client->prefix == 0) {
 217                         memset(&client->ipaddr.ipaddr.ip4addr, 0,
 218                                sizeof(client->ipaddr.ipaddr.ip4addr));
 219
 220                 } else if (client->prefix < 32) {
 221                         uint32_t mask = ~0;
 222
 223                         mask <<= (32 - client->prefix);
 224                         client->ipaddr.ipaddr.ip4addr.s_addr &= htonl(mask);
 225                 }
 226                 break;
 227
 228         case AF_INET6:
 229                 if (client->prefix > 128) return 0;
 230
 231                 if (client->prefix == 0) {
 232                         memset(&client->ipaddr.ipaddr.ip6addr, 0,
 233                                sizeof(client->ipaddr.ipaddr.ip6addr));
 234
 235                 } else if (client->prefix < 128) {
 236                         uint32_t mask, *addr;
 237
 238                         addr = (uint32_t *) &client->ipaddr.ipaddr.ip6addr;
 239
 240                         if ((client->prefix & 0x1f) == 0) {
 241                                 mask = 0;
 242                         } else {
 243                                 mask = ~ ((uint32_t) 0);
 244                                 mask <<= (32 - (client->prefix & 0x1f));
 245                                 mask = htonl(mask);
 246                         }
 247
 248                         switch (client->prefix >> 5) {
 249                         case 0:
 250                                 addr[0] &= mask;
 251                                 mask = 0;
 252                                 /* FALL-THROUGH */
 253                         case 1:
 254                                 addr[1] &= mask;
 255                                 mask = 0;
 256                                 /* FALL-THROUGH */
 257                         case 2:
 258                                 addr[2] &= mask;
 259                                 mask = 0;
 260                                 /* FALL-THROUGH */
 261                         case 3:
 262                                 addr[3] &= mask;
 263                           break;
 264                         }
 265                 }
 266                 break;
 267
 268         default:
 269                 return 0;
 270         }
 271
 272         return 1;
 273 }
 274
 275
 276 /*
 277  *      Add a client to the tree.
 278  */
 279 int client_add(RADCLIENT_LIST *clients, RADCLIENT *client)
 280 {
 281         RADCLIENT *old;
 282
 283         if (!client) {
 284                 return 0;
 285         }
 286
 287         /*
 288          *      If "clients" is NULL, it means add to the global list.
 289          */
 290         if (!clients) {
 291                 /*
 292                  *      Initialize it, if not done already.
 293                  */
 294                 if (!root_clients) {
 295                         root_clients = clients_init();
 296                         if (!root_clients) return 0;
 297                 }
 298                 clients = root_clients;
 299         }
 300
 301         if ((client->prefix < 0) || (client->prefix > 128)) {
 302                 return 0;
 303         }
 304
 305         if (!client_sane(client)) return 0;
 306
 307         /*
 308          *      Create a tree for it.
 309          */
 310         if (!clients->trees[client->prefix]) {
 311                 clients->trees[client->prefix] = rbtree_create(client_ipaddr_cmp,
 312                                                                (void *) client_free, 0);
 313                 if (!clients->trees[client->prefix]) {
 314                         return 0;
 315                 }
 316         }
 317
 318 #define namecmp(a) ((!old->a && !client->a) || (old->a && client->a && (strcmp(old->a, client->a) == 0)))
 319
 320         /*
 321          *      Cannot insert the same client twice.
 322          */
 323         old = rbtree_finddata(clients->trees[client->prefix], client);
 324         if (old) {
 325                 /*
 326                  *      If it's a complete duplicate, then free the new
 327                  *      one, and return "OK".
 328                  */
 329                 if ((fr_ipaddr_cmp(&old->ipaddr, &client->ipaddr) == 0) &&
 330                     (old->prefix == client->prefix) &&
 331                     namecmp(longname) && namecmp(secret) &&
 332                     namecmp(shortname) && namecmp(nastype) &&
 333                     namecmp(login) && namecmp(password) && namecmp(server) &&
 334 #ifdef WITH_DYNAMIC_CLIENTS
 335                     (old->lifetime == client->lifetime) &&
 336                     namecmp(client_server) &&
 337 #endif
 338 #ifdef WITH_COA
 339                     namecmp(coa_name) &&
 340                     (old->coa_server == client->coa_server) &&
 341                     (old->coa_pool == client->coa_pool) &&
 342 #endif
 343                     (old->message_authenticator == client->message_authenticator)) {
 344                         DEBUG("WARNING: Ignoring duplicate client %s", client->longname);
 345                         client_free(client);
 346                         return 1;
 347                 }
 348
 349                 radlog(L_ERR, "Failed to add duplicate client %s",
 350                        client->shortname);
 351                 return 0;
 352         }
 353 #undef namecmp
 354
 355         /*
 356          *      Other error adding client: likely is fatal.
 357          */
 358         if (!rbtree_insert(clients->trees[client->prefix], client)) {
 359                 return 0;
 360         }
 361
 362 #ifdef WITH_STATS
 363         if (!tree_num) {
 364                 tree_num = rbtree_create(client_num_cmp, NULL, 0);
 365         }
 366
 367
 368         /*
 369          *      Catch clients added by rlm_sql.
 370          */
 371         if (!client->auth) {
 372                 client->auth = rad_malloc(sizeof(*client->auth));
 373                 memset(client->auth, 0, sizeof(*client->auth));
 374         }
 375
 376 #ifdef WITH_ACCOUNTING
 377         if (!client->acct) {
 378                 client->acct = rad_malloc(sizeof(*client->acct));
 379                 memset(client->acct, 0, sizeof(*client->acct));
 380         }
 381 #endif
 382
 383 #ifdef WITH_DYNAMIC_CLIENTS
 384         /*
 385          *      More catching of clients added by rlm_sql.
 386          *
 387          *      The sql modules sets the dynamic flag BEFORE calling
 388          *      us.  The client_create() function sets it AFTER
 389          *      calling us.
 390          */
 391         if (client->dynamic && (client->lifetime == 0)) {
 392                 RADCLIENT *network;
 393
 394                 /*
 395                  *      If there IS an enclosing network,
 396                  *      inherit the lifetime from it.
 397                  */
 398                 network = client_find(clients, &client->ipaddr, client->proto);
 399                 if (network) {
 400                         client->lifetime = network->lifetime;
 401                 }
 402         }
 403 #endif
 404
 405         client->number = tree_num_max;
 406         tree_num_max++;
 407         if (tree_num) rbtree_insert(tree_num, client);
 408 #endif
 409
 410         if (client->prefix < clients->min_prefix) {
 411                 clients->min_prefix = client->prefix;
 412         }
 413
 414         return 1;
 415 }
 416
 417
 418 #ifdef WITH_DYNAMIC_CLIENTS
 419 void client_delete(RADCLIENT_LIST *clients, RADCLIENT *client)
 420 {
 421         if (!client) return;
 422
 423         if (!clients) clients = root_clients;
 424
 425         if (!client->dynamic) return;
 426
 427         rad_assert((client->prefix >= 0) && (client->prefix <= 128));
 428
 429         client->dynamic = 2;    /* signal to client_free */
 430
 431 #ifdef WITH_STATS
 432         rbtree_deletebydata(tree_num, client);
 433 #endif
 434         rbtree_deletebydata(clients->trees[client->prefix], client);
 435 }
 436 #endif
 437
 438
 439 /*
 440  *      Find a client in the RADCLIENTS list by number.
 441  *      This is a support function for the statistics code.
 442  */
 443 RADCLIENT *client_findbynumber(const RADCLIENT_LIST *clients,
 444                                int number)
 445 {
 446 #ifdef WITH_STATS
 447         if (!clients) clients = root_clients;
 448
 449         if (!clients) return NULL;
 450
 451         if (number >= tree_num_max) return NULL;
 452
 453         if (tree_num) {
 454                 RADCLIENT myclient;
 455
 456                 myclient.number = number;
 457
 458                 return rbtree_finddata(tree_num, &myclient);
 459         }
 460 #else
 461         clients = clients;      /* -Wunused */
 462         number = number;        /* -Wunused */
 463 #endif
 464         return NULL;
 465 }
 466
 467
 468 /*
 469  *      Find a client in the RADCLIENTS list.
 470  */
 471 RADCLIENT *client_find(const RADCLIENT_LIST *clients,
 472                        const fr_ipaddr_t *ipaddr, int proto)
 473 {
 474         int i, max_prefix;
 475         RADCLIENT myclient;
 476
 477         if (!clients) clients = root_clients;
 478
 479         if (!clients || !ipaddr) return NULL;
 480
 481         switch (ipaddr->af) {
 482         case AF_INET:
 483                 max_prefix = 32;
 484                 break;
 485
 486         case AF_INET6:
 487                 max_prefix = 128;
 488                 break;
 489
 490         default :
 491                 return NULL;
 492         }
 493
 494         for (i = max_prefix; i >= clients->min_prefix; i--) {
 495                 void *data;
 496
 497                 myclient.prefix = i;
 498                 myclient.ipaddr = *ipaddr;
 499                 myclient.proto = proto;
 500                 client_sane(&myclient); /* clean up the ipaddress */
 501
 502                 if (!clients->trees[i]) continue;
 503
 504                 data = rbtree_finddata(clients->trees[i], &myclient);
 505                 if (data) {
 506                         return data;
 507                 }
 508         }
 509
 510         return NULL;
 511 }
 512
 513
 514 /*
 515  *      Old wrapper for client_find
 516  */
 517 RADCLIENT *client_find_old(const fr_ipaddr_t *ipaddr)
 518 {
 519         return client_find(root_clients, ipaddr, IPPROTO_UDP);
 520 }
 521
 522 static struct in_addr cl_ip4addr;
 523 static struct in6_addr cl_ip6addr;
 524 #ifdef WITH_TCP
 525 static char *hs_proto = NULL;
 526 #endif
 527
 528 static const CONF_PARSER client_config[] = {
 529         { "ipaddr",  PW_TYPE_IPADDR,
 530           0, &cl_ip4addr,  NULL },
 531         { "ipv6addr",  PW_TYPE_IPV6ADDR,
 532           0, &cl_ip6addr, NULL },
 533         { "netmask",  PW_TYPE_INTEGER,
 534           offsetof(RADCLIENT, prefix), 0, NULL },
 535
 536         { "require_message_authenticator",  PW_TYPE_BOOLEAN,
 537           offsetof(RADCLIENT, message_authenticator), 0, "no" },
 538
 539         { "secret",  PW_TYPE_STRING_PTR,
 540           offsetof(RADCLIENT, secret), 0, NULL },
 541         { "shortname",  PW_TYPE_STRING_PTR,
 542           offsetof(RADCLIENT, shortname), 0, NULL },
 543         { "nastype",  PW_TYPE_STRING_PTR,
 544           offsetof(RADCLIENT, nastype), 0, NULL },
 545         { "login",  PW_TYPE_STRING_PTR,
 546           offsetof(RADCLIENT, login), 0, NULL },
 547         { "password",  PW_TYPE_STRING_PTR,
 548           offsetof(RADCLIENT, password), 0, NULL },
 549         { "virtual_server",  PW_TYPE_STRING_PTR,
 550           offsetof(RADCLIENT, server), 0, NULL },
 551         { "server",  PW_TYPE_STRING_PTR, /* compatability with 2.0-pre */
 552           offsetof(RADCLIENT, server), 0, NULL },
 553
 554 #ifdef WITH_TCP
 555         { "proto",  PW_TYPE_STRING_PTR,
 556           0, &hs_proto, NULL },
 557         { "max_connections",  PW_TYPE_INTEGER,
 558           offsetof(RADCLIENT, max_connections), 0, "16" },
 559 #endif
 560
 561 #ifdef WITH_DYNAMIC_CLIENTS
 562         { "dynamic_clients",  PW_TYPE_STRING_PTR,
 563           offsetof(RADCLIENT, client_server), 0, NULL },
 564         { "lifetime",  PW_TYPE_INTEGER,
 565           offsetof(RADCLIENT, lifetime), 0, NULL },
 566         { "rate_limit",  PW_TYPE_BOOLEAN,
 567           offsetof(RADCLIENT, rate_limit), 0, NULL },
 568 #endif
 569
 570 #ifdef WITH_COA
 571         { "coa_server",  PW_TYPE_STRING_PTR,
 572           offsetof(RADCLIENT, coa_name), 0, NULL },
 573 #endif
 574
 575         { NULL, -1, 0, NULL, NULL }
 576 };
 577
 578
 579 static RADCLIENT *client_parse(CONF_SECTION *cs, int in_server)
 580 {
 581         RADCLIENT       *c;
 582         const char      *name2;
 583
 584         name2 = cf_section_name2(cs);
 585         if (!name2) {
 586                 cf_log_err(cf_sectiontoitem(cs),
 587                            "Missing client name");
 588                 return NULL;
 589         }
 590
 591         /*
 592          * The size is fine.. Let's create the buffer
 593          */
 594         c = rad_malloc(sizeof(*c));
 595         memset(c, 0, sizeof(*c));
 596         c->cs = cs;
 597
 598 #ifdef WITH_STATS
 599         c->auth = rad_malloc(sizeof(*c->auth));
 600         memset(c->auth, 0, sizeof(*c->auth));
 601
 602 #ifdef WITH_ACCOUNTING
 603         c->acct = rad_malloc(sizeof(*c->acct));
 604         memset(c->acct, 0, sizeof(*c->acct));
 605 #endif
 606 #endif
 607
 608         memset(&cl_ip4addr, 0, sizeof(cl_ip4addr));
 609         memset(&cl_ip6addr, 0, sizeof(cl_ip6addr));
 610         c->prefix = -1;
 611
 612         if (cf_section_parse(cs, c, client_config) < 0) {
 613                 cf_log_err(cf_sectiontoitem(cs),
 614                            "Error parsing client section.");
 615         error:
 616                 client_free(c);
 617 #ifdef WITH_TCP
 618                 free(hs_proto);
 619                 hs_proto = NULL;
 620 #endif
 621
 622                 return NULL;
 623         }
 624
 625         /*
 626          *      Global clients can set servers to use,
 627          *      per-server clients cannot.
 628          */
 629         if (in_server && c->server) {
 630                 cf_log_err(cf_sectiontoitem(cs),
 631                            "Clients inside of an server section cannot point to a server.");
 632                 goto error;
 633         }
 634
 635         /*
 636          *      No "ipaddr" or "ipv6addr", use old-style
 637          *      "client <ipaddr> {" syntax.
 638          */
 639         if (!cf_pair_find(cs, "ipaddr") &&
 640             !cf_pair_find(cs, "ipv6addr")) {
 641                 char *prefix_ptr;
 642
 643                 prefix_ptr = strchr(name2, '/');
 644
 645                 /*
 646                  *      Look for prefixes.
 647                  */
 648                 if (prefix_ptr) {
 649                         c->prefix = atoi(prefix_ptr + 1);
 650                         if ((c->prefix < 0) || (c->prefix > 128)) {
 651                                 cf_log_err(cf_sectiontoitem(cs),
 652                                            "Invalid Prefix value '%s' for IP.",
 653                                            prefix_ptr + 1);
 654                                 goto error;
 655                         }
 656                         /* Replace '/' with '\0' */
 657                         *prefix_ptr = '\0';
 658                 }
 659
 660                 /*
 661                  *      Always get the numeric representation of IP
 662                  */
 663                 if (ip_hton(name2, AF_UNSPEC, &c->ipaddr) < 0) {
 664                         cf_log_err(cf_sectiontoitem(cs),
 665                                    "Failed to look up hostname %s: %s",
 666                                    name2, fr_strerror());
 667                         goto error;
 668                 }
 669
 670                 if (prefix_ptr) *prefix_ptr = '/';
 671                 c->longname = strdup(name2);
 672
 673                 if (!c->shortname) c->shortname = strdup(c->longname);
 674
 675         } else {
 676                 char buffer[1024];
 677
 678                 /*
 679                  *      Figure out which one to use.
 680                  */
 681                 if (cf_pair_find(cs, "ipaddr")) {
 682                         c->ipaddr.af = AF_INET;
 683                         c->ipaddr.ipaddr.ip4addr = cl_ip4addr;
 684
 685                         if ((c->prefix < -1) || (c->prefix > 32)) {
 686                                 cf_log_err(cf_sectiontoitem(cs),
 687                                            "Netmask must be between 0 and 32");
 688                                 goto error;
 689                         }
 690
 691                 } else if (cf_pair_find(cs, "ipv6addr")) {
 692                         c->ipaddr.af = AF_INET6;
 693                         c->ipaddr.ipaddr.ip6addr = cl_ip6addr;
 694
 695                         if ((c->prefix < -1) || (c->prefix > 128)) {
 696                                 cf_log_err(cf_sectiontoitem(cs),
 697                                            "Netmask must be between 0 and 128");
 698                                 goto error;
 699                         }
 700                 } else {
 701                         cf_log_err(cf_sectiontoitem(cs),
 702                                    "No IP address defined for the client");
 703                         goto error;
 704                 }
 705
 706                 ip_ntoh(&c->ipaddr, buffer, sizeof(buffer));
 707                 c->longname = strdup(buffer);
 708
 709                 /*
 710                  *      Set the short name to the name2
 711                  */
 712                 if (!c->shortname) c->shortname = strdup(name2);
 713
 714                 c->proto = IPPROTO_UDP;
 715 #ifdef WITH_TCP
 716                 if (hs_proto) {
 717                         if (strcmp(hs_proto, "udp") == 0) {
 718                                 free(hs_proto);
 719                                 hs_proto = NULL;
 720
 721                         } else if (strcmp(hs_proto, "tcp") == 0) {
 722                                 free(hs_proto);
 723                                 hs_proto = NULL;
 724                                 c->proto = IPPROTO_TCP;
 725
 726                         } else if (strcmp(hs_proto, "*") == 0) {
 727                                 free(hs_proto);
 728                                 hs_proto = NULL;
 729                                 c->proto = IPPROTO_IP; /* fake for dual */
 730
 731                         } else {
 732                                 cf_log_err(cf_sectiontoitem(cs),
 733                                            "Unknown proto \"%s\".", hs_proto);
 734                                 goto error;
 735                         }
 736                 }
 737 #endif
 738         }
 739
 740         if (c->prefix < 0) switch (c->ipaddr.af) {
 741         case AF_INET:
 742                 c->prefix = 32;
 743                 break;
 744         case AF_INET6:
 745                 c->prefix = 128;
 746                 break;
 747         default:
 748                 break;
 749         }
 750
 751 #ifdef WITH_DYNAMIC_CLIENTS
 752         if (c->client_server) {
 753                 free(c->secret);
 754                 c->secret = strdup("testing123");
 755
 756                 if (((c->ipaddr.af == AF_INET) &&
 757                      (c->prefix == 32)) ||
 758                     ((c->ipaddr.af == AF_INET6) &&
 759                      (c->prefix == 128))) {
 760                         cf_log_err(cf_sectiontoitem(cs),
 761                                    "Dynamic clients MUST be a network, not a single IP address.");
 762                         goto error;
 763                 }
 764
 765                 return c;
 766         }
 767 #endif
 768
 769         if (!c->secret || !*c->secret) {
 770 #ifdef WITH_DHCP
 771                 const char *value = NULL;
 772                 CONF_PAIR *cp = cf_pair_find(cs, "dhcp");
 773
 774                 if (cp) value = cf_pair_value(cp);
 775
 776                 /*
 777                  *      Secrets aren't needed for DHCP.
 778                  */
 779                 if (value && (strcmp(value, "yes") == 0)) return c;
 780
 781 #endif
 782                 cf_log_err(cf_sectiontoitem(cs),
 783                            "secret must be at least 1 character long");
 784                 goto error;
 785         }
 786
 787 #ifdef WITH_COA
 788         /*
 789          *      Point the client to the home server pool, OR to the
 790          *      home server.  This gets around the problem of figuring
 791          *      out which port to use.
 792          */
 793         if (c->coa_name) {
 794                 c->coa_pool = home_pool_byname(c->coa_name, HOME_TYPE_COA);
 795                 if (!c->coa_pool) {
 796                         c->coa_server = home_server_byname(c->coa_name,
 797                                                            HOME_TYPE_COA);
 798                 }
 799                 if (!c->coa_pool && !c->coa_server) {
 800                         cf_log_err(cf_sectiontoitem(cs), "No such home_server or home_server_pool \"%s\"", c->coa_name);
 801                         goto error;
 802                 }
 803         }
 804 #endif
 805
 806         return c;
 807 }
 808
 809
 810 /*
 811  *      Create the linked list of clients from the new configuration
 812  *      type.  This way we don't have to change too much in the other
 813  *      source-files.
 814  */
 815 RADCLIENT_LIST *clients_parse_section(CONF_SECTION *section)
 816 {
 817         int             global = FALSE, in_server = FALSE;
 818         CONF_SECTION    *cs;
 819         RADCLIENT       *c;
 820         RADCLIENT_LIST  *clients;
 821
 822         /*
 823          *      Be forgiving.  If there's already a clients, return
 824          *      it.  Otherwise create a new one.
 825          */
 826         clients = cf_data_find(section, "clients");
 827         if (clients) return clients;
 828
 829         clients = clients_init();
 830         if (!clients) return NULL;
 831
 832         if (cf_top_section(section) == section) global = TRUE;
 833
 834         if (strcmp("server", cf_section_name1(section)) == 0) in_server = TRUE;
 835
 836         /*
 837          *      Associate the clients structure with the section, where
 838          *      it will be freed once the section is freed.
 839          */
 840         if (cf_data_add(section, "clients", clients, (void *) clients_free) < 0) {
 841                 cf_log_err(cf_sectiontoitem(section),
 842                            "Failed to associate clients with section %s",
 843                        cf_section_name1(section));
 844                 clients_free(clients);
 845                 return NULL;
 846         }
 847
 848         for (cs = cf_subsection_find_next(section, NULL, "client");
 849              cs != NULL;
 850              cs = cf_subsection_find_next(section, cs, "client")) {
 851                 c = client_parse(cs, in_server);
 852                 if (!c) {
 853                         return NULL;
 854                 }
 855
 856                 /*
 857                  *      FIXME: Add the client as data via cf_data_add,
 858                  *      for migration issues.
 859                  */
 860
 861 #ifdef WITH_DYNAMIC_CLIENTS
 862 #ifdef HAVE_DIRENT_H
 863                 if (c->client_server) {
 864                         const char *value;
 865                         CONF_PAIR *cp;
 866                         DIR             *dir;
 867                         struct dirent   *dp;
 868                         struct stat stat_buf;
 869                         char buf2[2048];
 870
 871                         /*
 872                          *      Find the directory where individual
 873                          *      client definitions are stored.
 874                          */
 875                         cp = cf_pair_find(cs, "directory");
 876                         if (!cp) goto add_client;
 877
 878                         value = cf_pair_value(cp);
 879                         if (!value) {
 880                                 cf_log_err(cf_sectiontoitem(cs),
 881                                            "The \"directory\" entry must not be empty");
 882                                 client_free(c);
 883                                 return NULL;
 884                         }
 885
 886                         DEBUG("including dynamic clients in %s", value);
 887
 888                         dir = opendir(value);
 889                         if (!dir) {
 890                                 cf_log_err(cf_sectiontoitem(cs), "Error reading directory %s: %s", value, strerror(errno));
 891                                 client_free(c);
 892                                 return NULL;
 893                         }
 894
 895                         /*
 896                          *      Read the directory, ignoring "." files.
 897                          */
 898                         while ((dp = readdir(dir)) != NULL) {
 899                                 const char *p;
 900                                 RADCLIENT *dc;
 901
 902                                 if (dp->d_name[0] == '.') continue;
 903
 904                                 /*
 905                                  *      Check for valid characters
 906                                  */
 907                                 for (p = dp->d_name; *p != '\0'; p++) {
 908                                         if (isalpha((int)*p) ||
 909                                             isdigit((int)*p) ||
 910                                             (*p == ':') ||
 911                                             (*p == '.')) continue;
 912                                                 break;
 913                                 }
 914                                 if (*p != '\0') continue;
 915
 916                                 snprintf(buf2, sizeof(buf2), "%s/%s",
 917                                          value, dp->d_name);
 918
 919                                 if ((stat(buf2, &stat_buf) != 0) ||
 920                                     S_ISDIR(stat_buf.st_mode)) continue;
 921
 922                                 dc = client_read(buf2, in_server, TRUE);
 923                                 if (!dc) {
 924                                         cf_log_err(cf_sectiontoitem(cs),
 925                                                    "Failed reading client file \"%s\"", buf2);
 926                                         client_free(c);
 927                                         return NULL;
 928                                 }
 929
 930                                 /*
 931                                  *      Validate, and add to the list.
 932                                  */
 933                                 if (!client_validate(clients, c, dc)) {
 934
 935                                         client_free(c);
 936                                         return NULL;
 937                                 }
 938                         } /* loop over the directory */
 939                 }
 940 #endif /* HAVE_DIRENT_H */
 941 #endif /* WITH_DYNAMIC_CLIENTS */
 942
 943         add_client:
 944                 if (!client_add(clients, c)) {
 945                         cf_log_err(cf_sectiontoitem(cs),
 946                                    "Failed to add client %s",
 947                                    cf_section_name2(cs));
 948                         client_free(c);
 949                         return NULL;
 950                 }
 951
 952         }
 953
 954         /*
 955          *      Replace the global list of clients with the new one.
 956          *      The old one is still referenced from the original
 957          *      configuration, and will be freed when that is freed.
 958          */
 959         if (global) {
 960                 root_clients = clients;
 961         }
 962
 963         return clients;
 964 }
 965
 966 #ifdef WITH_DYNAMIC_CLIENTS
 967 /*
 968  *      We overload this structure a lot.
 969  */
 970 static const CONF_PARSER dynamic_config[] = {
 971         { "FreeRADIUS-Client-IP-Address",  PW_TYPE_IPADDR,
 972           offsetof(RADCLIENT, ipaddr), 0, NULL },
 973         { "FreeRADIUS-Client-IPv6-Address",  PW_TYPE_IPV6ADDR,
 974           offsetof(RADCLIENT, ipaddr), 0, NULL },
 975
 976         { "FreeRADIUS-Client-Require-MA",  PW_TYPE_BOOLEAN,
 977           offsetof(RADCLIENT, message_authenticator), NULL, NULL },
 978
 979         { "FreeRADIUS-Client-Secret",  PW_TYPE_STRING_PTR,
 980           offsetof(RADCLIENT, secret), 0, "" },
 981         { "FreeRADIUS-Client-Shortname",  PW_TYPE_STRING_PTR,
 982           offsetof(RADCLIENT, shortname), 0, "" },
 983         { "FreeRADIUS-Client-NAS-Type",  PW_TYPE_STRING_PTR,
 984           offsetof(RADCLIENT, nastype), 0, NULL },
 985         { "FreeRADIUS-Client-Virtual-Server",  PW_TYPE_STRING_PTR,
 986           offsetof(RADCLIENT, server), 0, NULL },
 987
 988         { NULL, -1, 0, NULL, NULL }
 989 };
 990
 991
 992 int client_validate(RADCLIENT_LIST *clients, RADCLIENT *master, RADCLIENT *c)
 993 {
 994         char buffer[128];
 995
 996         /*
 997          *      No virtual server defined.  Inherit the parent's
 998          *      definition.
 999          */
1000         if (master->server && !c->server) {
1001                 c->server = strdup(master->server);
1002         }
1003
1004         /*
1005          *      If the client network isn't global (not tied to a
1006          *      virtual server), then ensure that this clients server
1007          *      is the same as the enclosing networks virtual server.
1008          */
1009         if (master->server &&
1010              (strcmp(master->server, c->server) != 0)) {
1011                 DEBUG("- Cannot add client %s: Virtual server %s is not the same as the virtual server for the network.",
1012                       ip_ntoh(&c->ipaddr,
1013                               buffer, sizeof(buffer)),
1014                       c->server);
1015
1016                 goto error;
1017         }
1018
1019         if (!client_add(clients, c)) {
1020                 DEBUG("- Cannot add client %s: Internal error",
1021                       ip_ntoh(&c->ipaddr,
1022                               buffer, sizeof(buffer)));
1023
1024                 goto error;
1025         }
1026
1027         /*
1028          *      Initialize the remaining fields.
1029          */
1030         c->dynamic = TRUE;
1031         c->lifetime = master->lifetime;
1032         c->created = time(NULL);
1033         c->longname = strdup(c->shortname);
1034
1035         DEBUG("- Added client %s with shared secret %s",
1036               ip_ntoh(&c->ipaddr, buffer, sizeof(buffer)),
1037               c->secret);
1038
1039         return 1;
1040
1041  error:
1042         client_free(c);
1043         return 0;
1044 }
1045
1046
1047 RADCLIENT *client_create(RADCLIENT_LIST *clients, REQUEST *request)
1048 {
1049         int i, *pi;
1050         char **p;
1051         RADCLIENT *c;
1052         char buffer[128];
1053
1054         if (!clients || !request) return NULL;
1055
1056         c = rad_malloc(sizeof(*c));
1057         memset(c, 0, sizeof(*c));
1058         c->cs = request->client->cs;
1059         c->ipaddr.af = AF_UNSPEC;
1060
1061         for (i = 0; dynamic_config[i].name != NULL; i++) {
1062                 DICT_ATTR *da;
1063                 VALUE_PAIR *vp;
1064
1065                 da = dict_attrbyname(dynamic_config[i].name);
1066                 if (!da) {
1067                         DEBUG("- Cannot add client %s: attribute \"%s\"is not in the dictionary",
1068                               ip_ntoh(&request->packet->src_ipaddr,
1069                                       buffer, sizeof(buffer)),
1070                               dynamic_config[i].name);
1071                 error:
1072                         client_free(c);
1073                         return NULL;
1074                 }
1075
1076                 vp = pairfind(request->config_items, da->attr, da->vendor);
1077                 if (!vp) {
1078                         /*
1079                          *      Not required.  Skip it.
1080                          */
1081                         if (!dynamic_config[i].dflt) continue;
1082
1083                         DEBUG("- Cannot add client %s: Required attribute \"%s\" is missing.",
1084                               ip_ntoh(&request->packet->src_ipaddr,
1085                                       buffer, sizeof(buffer)),
1086                               dynamic_config[i].name);
1087                         goto error;
1088                 }
1089
1090                 switch (dynamic_config[i].type) {
1091                 case PW_TYPE_IPADDR:
1092                         c->ipaddr.af = AF_INET;
1093                         c->ipaddr.ipaddr.ip4addr.s_addr = vp->vp_ipaddr;
1094                         c->prefix = 32;
1095                         break;
1096
1097                 case PW_TYPE_IPV6ADDR:
1098                         c->ipaddr.af = AF_INET6;
1099                         c->ipaddr.ipaddr.ip6addr = vp->vp_ipv6addr;
1100                         c->prefix = 128;
1101                         break;
1102
1103                 case PW_TYPE_STRING_PTR:
1104                         p = (char **) ((char *) c + dynamic_config[i].offset);
1105                         if (*p) free(*p);
1106                         *p = strdup(vp->vp_strvalue);
1107                         break;
1108
1109                 case PW_TYPE_BOOLEAN:
1110                         pi = (int *) ((char *) c + dynamic_config[i].offset);
1111                         *pi = vp->vp_integer;
1112                         break;
1113
1114                 default:
1115                         goto error;
1116                 }
1117         }
1118
1119         if (c->ipaddr.af == AF_UNSPEC) {
1120                 DEBUG("- Cannot add client %s: No IP address was specified.",
1121                       ip_ntoh(&request->packet->src_ipaddr,
1122                               buffer, sizeof(buffer)));
1123
1124                 goto error;
1125         }
1126
1127         if (fr_ipaddr_cmp(&request->packet->src_ipaddr, &c->ipaddr) != 0) {
1128                 char buf2[128];
1129
1130                 DEBUG("- Cannot add client %s: IP address %s do not match",
1131                       ip_ntoh(&request->packet->src_ipaddr,
1132                               buffer, sizeof(buffer)),
1133                       ip_ntoh(&c->ipaddr,
1134                               buf2, sizeof(buf2)));
1135                 goto error;
1136         }
1137
1138         if (!client_validate(clients, request->client, c)) {
1139                 return NULL;
1140         }
1141
1142         return c;
1143 }
1144
1145 /*
1146  *      Read a client definition from the given filename.
1147  */
1148 RADCLIENT *client_read(const char *filename, int in_server, int flag)
1149 {
1150         const char *p;
1151         RADCLIENT *c;
1152         CONF_SECTION *cs;
1153         char buffer[256];
1154
1155         if (!filename) return NULL;
1156
1157         cs = cf_file_read(filename);
1158         if (!cs) return NULL;
1159
1160         c = client_parse(cf_section_sub_find(cs, "client"), in_server);
1161
1162         p = strrchr(filename, FR_DIR_SEP);
1163         if (p) {
1164                 p++;
1165         } else {
1166                 p = filename;
1167         }
1168
1169         if (!flag) return c;
1170
1171         /*
1172          *      Additional validations
1173          */
1174         ip_ntoh(&c->ipaddr, buffer, sizeof(buffer));
1175         if (strcmp(p, buffer) != 0) {
1176                 DEBUG("Invalid client definition in %s: IP address %s does not match name %s", filename, buffer, p);
1177                 client_free(c);
1178                 return NULL;
1179         }
1180
1181
1182
1183         return c;
1184 }
1185 #endif