src/main/client.c

   1 /*
   2  * client.c     Read clients into memory.
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  * Copyright 2000,2006  The FreeRADIUS server project
  21  * Copyright 2000  Miquel van Smoorenburg <miquels@cistron.nl>
  22  * Copyright 2000  Alan DeKok <aland@ox.org>
  23  */
  24
  25 #include <freeradius-devel/ident.h>
  26 RCSID("$Id$")
  27
  28 #include <freeradius-devel/radiusd.h>
  29 #include <freeradius-devel/rad_assert.h>
  30
  31 #include <sys/stat.h>
  32
  33 #include <ctype.h>
  34 #include <fcntl.h>
  35
  36 #ifdef WITH_DYNAMIC_CLIENTS
  37 #ifdef HAVE_DIRENT_H
  38 #include <dirent.h>
  39 #endif
  40 #endif
  41
  42 struct radclient_list {
  43         /*
  44          *      FIXME: One set of trees for IPv4, and another for IPv6?
  45          */
  46         rbtree_t        *trees[129]; /* for 0..128, inclusive. */
  47         int             min_prefix;
  48 };
  49
  50
  51 #ifdef WITH_STATS
  52 static rbtree_t         *tree_num;      /* client numbers 0..N */
  53 static int              tree_num_max;
  54 #endif
  55 static RADCLIENT_LIST   *root_clients;
  56
  57 /*
  58  *      Callback for freeing a client.
  59  */
  60 void client_free(RADCLIENT *client)
  61 {
  62         free(client->longname);
  63         free(client->secret);
  64         free(client->shortname);
  65         free(client->nastype);
  66         free(client->login);
  67         free(client->password);
  68         free(client->server);
  69
  70 #ifdef WITH_STATS
  71         free(client->auth);
  72 #ifdef WITH_ACCOUNTING
  73         free(client->acct);
  74 #endif
  75 #endif
  76
  77 #ifdef WITH_DYNAMIC_CLIENTS
  78         free(client->client_server);
  79 #endif
  80
  81         free(client);
  82 }
  83
  84 /*
  85  *      Callback for comparing two clients.
  86  */
  87 static int client_ipaddr_cmp(const void *one, const void *two)
  88 {
  89         const RADCLIENT *a = one;
  90         const RADCLIENT *b = two;
  91
  92         return fr_ipaddr_cmp(&a->ipaddr, &b->ipaddr);
  93 }
  94
  95 #ifdef WITH_STATS
  96 static int client_num_cmp(const void *one, const void *two)
  97 {
  98         const RADCLIENT *a = one;
  99         const RADCLIENT *b = two;
 100
 101         return (a->number - b->number);
 102 }
 103 #endif
 104
 105 /*
 106  *      Free a RADCLIENT list.
 107  */
 108 void clients_free(RADCLIENT_LIST *clients)
 109 {
 110         int i;
 111
 112         if (!clients) return;
 113
 114         for (i = 0; i <= 128; i++) {
 115                 if (clients->trees[i]) rbtree_free(clients->trees[i]);
 116                 clients->trees[i] = NULL;
 117         }
 118
 119         if (clients == root_clients) {
 120 #ifdef WITH_STATS
 121                 if (tree_num) rbtree_free(tree_num);
 122                 tree_num = NULL;
 123                 tree_num_max = 0;
 124 #endif
 125                 root_clients = NULL;
 126         }
 127
 128         free(clients);
 129 }
 130
 131 /*
 132  *      Return a new, initialized, set of clients.
 133  */
 134 RADCLIENT_LIST *clients_init(void)
 135 {
 136         RADCLIENT_LIST *clients = calloc(1, sizeof(RADCLIENT_LIST));
 137
 138         if (!clients) return NULL;
 139
 140         clients->min_prefix = 128;
 141
 142         return clients;
 143 }
 144
 145
 146 /*
 147  *      Sanity check a client.
 148  */
 149 static int client_sane(RADCLIENT *client)
 150 {
 151         switch (client->ipaddr.af) {
 152         case AF_INET:
 153                 if (client->prefix > 32) {
 154                         return 0;
 155                 }
 156
 157                 /*
 158                  *      Zero out the subnet bits.
 159                  */
 160                 if (client->prefix == 0) {
 161                         memset(&client->ipaddr.ipaddr.ip4addr, 0,
 162                                sizeof(client->ipaddr.ipaddr.ip4addr));
 163
 164                 } else if (client->prefix < 32) {
 165                         uint32_t mask = ~0;
 166
 167                         mask <<= (32 - client->prefix);
 168                         client->ipaddr.ipaddr.ip4addr.s_addr &= htonl(mask);
 169                 }
 170                 break;
 171
 172         case AF_INET6:
 173                 if (client->prefix > 128) return 0;
 174
 175                 if (client->prefix == 0) {
 176                         memset(&client->ipaddr.ipaddr.ip6addr, 0,
 177                                sizeof(client->ipaddr.ipaddr.ip6addr));
 178
 179                 } else if (client->prefix < 128) {
 180                         int i;
 181                         uint32_t mask, *addr;
 182
 183                         addr = (uint32_t *) &client->ipaddr.ipaddr.ip6addr;
 184
 185                         for (i = client->prefix; i < 128; i += 32) {
 186                                 mask = ~0;
 187                                 mask <<= ((128 - i) & 0x1f);
 188                                 addr[i / 32] &= mask;
 189                         }
 190                 }
 191                 break;
 192
 193         default:
 194                 return 0;
 195         }
 196
 197         return 1;
 198 }
 199
 200
 201 /*
 202  *      Add a client to the tree.
 203  */
 204 int client_add(RADCLIENT_LIST *clients, RADCLIENT *client)
 205 {
 206         if (!client) {
 207                 return 0;
 208         }
 209
 210         /*
 211          *      If "clients" is NULL, it means add to the global list.
 212          */
 213         if (!clients) {
 214                 /*
 215                  *      Initialize it, if not done already.
 216                  */
 217                 if (!root_clients) {
 218                         root_clients = clients_init();
 219                         if (!root_clients) return 0;
 220                 }
 221                 clients = root_clients;
 222         }
 223
 224         if ((client->prefix < 0) || (client->prefix > 128)) {
 225                 return 0;
 226         }
 227
 228         if (!client_sane(client)) return 0;
 229
 230         /*
 231          *      Create a tree for it.
 232          */
 233         if (!clients->trees[client->prefix]) {
 234                 clients->trees[client->prefix] = rbtree_create(client_ipaddr_cmp,
 235                                                                (void *) client_free, 0);
 236                 if (!clients->trees[client->prefix]) {
 237                         return 0;
 238                 }
 239         }
 240
 241         /*
 242          *      Cannot insert the same client twice.
 243          */
 244         if (rbtree_find(clients->trees[client->prefix], client)) {
 245                 radlog(L_ERR, "Failed to add duplicate client %s",
 246                        client->shortname);
 247                 return 0;
 248         }
 249
 250         /*
 251          *      Other error adding client: likely is fatal.
 252          */
 253         if (!rbtree_insert(clients->trees[client->prefix], client)) {
 254                 return 0;
 255         }
 256
 257 #ifdef WITH_STATS
 258         if (!tree_num) {
 259                 tree_num = rbtree_create(client_num_cmp, NULL, 0);
 260         }
 261
 262
 263         /*
 264          *      Catch clients added by rlm_sql.
 265          */
 266         if (!client->auth) {
 267                 client->auth = rad_malloc(sizeof(*client->auth));
 268                 memset(client->auth, 0, sizeof(*client->auth));
 269         }
 270
 271 #ifdef WITH_ACCOUNTING
 272         if (!client->acct) {
 273                 client->acct = rad_malloc(sizeof(*client->acct));
 274                 memset(client->acct, 0, sizeof(*client->acct));
 275         }
 276 #endif
 277
 278 #ifdef WITH_DYNAMIC_CLIENTS
 279         /*
 280          *      More catching of clients added by rlm_sql.
 281          *
 282          *      The sql modules sets the dynamic flag BEFORE calling
 283          *      us.  The client_create() function sets it AFTER
 284          *      calling us.
 285          */
 286         if (client->dynamic && (client->lifetime == 0)) {
 287                 RADCLIENT *network;
 288
 289                 /*
 290                  *      If there IS an enclosing network,
 291                  *      inherit the lifetime from it.
 292                  */
 293                 network = client_find(clients, &client->ipaddr);
 294                 if (network) {
 295                         client->lifetime = network->lifetime;
 296                 }
 297         }
 298 #endif
 299
 300         client->number = tree_num_max;
 301         tree_num_max++;
 302         if (tree_num) rbtree_insert(tree_num, client);
 303 #endif
 304
 305         if (client->prefix < clients->min_prefix) {
 306                 clients->min_prefix = client->prefix;
 307         }
 308
 309         return 1;
 310 }
 311
 312
 313 #ifdef WITH_DYNAMIC_CLIENTS
 314 void client_delete(RADCLIENT_LIST *clients, RADCLIENT *client)
 315 {
 316         if (!clients || !client) return;
 317
 318         rad_assert((client->prefix >= 0) && (client->prefix <= 128));
 319
 320         rbtree_deletebydata(clients->trees[client->prefix], client);
 321 }
 322 #endif
 323
 324
 325 /*
 326  *      Find a client in the RADCLIENTS list by number.
 327  *      This is a support function for the statistics code.
 328  */
 329 RADCLIENT *client_findbynumber(const RADCLIENT_LIST *clients,
 330                                int number)
 331 {
 332 #ifdef WITH_STATS
 333         if (!clients) clients = root_clients;
 334
 335         if (!clients) return NULL;
 336
 337         if (number >= tree_num_max) return NULL;
 338
 339         if (tree_num) {
 340                 RADCLIENT myclient;
 341
 342                 myclient.number = number;
 343
 344                 return rbtree_finddata(tree_num, &myclient);
 345         }
 346 #else
 347         clients = clients;      /* -Wunused */
 348         number = number;        /* -Wunused */
 349 #endif
 350         return NULL;
 351 }
 352
 353
 354 /*
 355  *      Find a client in the RADCLIENTS list.
 356  */
 357 RADCLIENT *client_find(const RADCLIENT_LIST *clients,
 358                        const fr_ipaddr_t *ipaddr)
 359 {
 360         int i, max_prefix;
 361         RADCLIENT myclient;
 362
 363         if (!clients) clients = root_clients;
 364
 365         if (!clients || !ipaddr) return NULL;
 366
 367         switch (ipaddr->af) {
 368         case AF_INET:
 369                 max_prefix = 32;
 370                 break;
 371
 372         case AF_INET6:
 373                 max_prefix = 128;
 374                 break;
 375
 376         default :
 377                 return NULL;
 378         }
 379
 380         for (i = max_prefix; i >= clients->min_prefix; i--) {
 381                 void *data;
 382
 383                 myclient.prefix = i;
 384                 myclient.ipaddr = *ipaddr;
 385                 client_sane(&myclient); /* clean up the ipaddress */
 386
 387                 if (!clients->trees[i]) continue;
 388
 389                 data = rbtree_finddata(clients->trees[i], &myclient);
 390                 if (data) {
 391                         return data;
 392                 }
 393         }
 394
 395         return NULL;
 396 }
 397
 398
 399 /*
 400  *      Old wrapper for client_find
 401  */
 402 RADCLIENT *client_find_old(const fr_ipaddr_t *ipaddr)
 403 {
 404         return client_find(root_clients, ipaddr);
 405 }
 406
 407 static struct in_addr cl_ip4addr;
 408 static struct in6_addr cl_ip6addr;
 409
 410 static const CONF_PARSER client_config[] = {
 411         { "ipaddr",  PW_TYPE_IPADDR,
 412           0, &cl_ip4addr,  NULL },
 413         { "ipv6addr",  PW_TYPE_IPV6ADDR,
 414           0, &cl_ip6addr, NULL },
 415         { "netmask",  PW_TYPE_INTEGER,
 416           offsetof(RADCLIENT, prefix), 0, NULL },
 417
 418         { "require_message_authenticator",  PW_TYPE_BOOLEAN,
 419           offsetof(RADCLIENT, message_authenticator), 0, "no" },
 420
 421         { "secret",  PW_TYPE_STRING_PTR,
 422           offsetof(RADCLIENT, secret), 0, NULL },
 423         { "shortname",  PW_TYPE_STRING_PTR,
 424           offsetof(RADCLIENT, shortname), 0, NULL },
 425         { "nastype",  PW_TYPE_STRING_PTR,
 426           offsetof(RADCLIENT, nastype), 0, NULL },
 427         { "login",  PW_TYPE_STRING_PTR,
 428           offsetof(RADCLIENT, login), 0, NULL },
 429         { "password",  PW_TYPE_STRING_PTR,
 430           offsetof(RADCLIENT, password), 0, NULL },
 431         { "virtual_server",  PW_TYPE_STRING_PTR,
 432           offsetof(RADCLIENT, server), 0, NULL },
 433         { "server",  PW_TYPE_STRING_PTR, /* compatability with 2.0-pre */
 434           offsetof(RADCLIENT, server), 0, NULL },
 435
 436 #ifdef WITH_DYNAMIC_CLIENTS
 437         { "dynamic_clients",  PW_TYPE_STRING_PTR,
 438           offsetof(RADCLIENT, client_server), 0, NULL },
 439         { "lifetime",  PW_TYPE_INTEGER,
 440           offsetof(RADCLIENT, lifetime), 0, NULL },
 441 #endif
 442
 443         { NULL, -1, 0, NULL, NULL }
 444 };
 445
 446
 447 static RADCLIENT *client_parse(CONF_SECTION *cs, int in_server)
 448 {
 449         RADCLIENT       *c;
 450         const char      *name2;
 451
 452         name2 = cf_section_name2(cs);
 453         if (!name2) {
 454                 cf_log_err(cf_sectiontoitem(cs),
 455                            "Missing client name");
 456                 return NULL;
 457         }
 458
 459         /*
 460          * The size is fine.. Let's create the buffer
 461          */
 462         c = rad_malloc(sizeof(*c));
 463         memset(c, 0, sizeof(*c));
 464         c->cs = cs;
 465
 466 #ifdef WITH_STATS
 467         c->auth = rad_malloc(sizeof(*c->auth));
 468         memset(c->auth, 0, sizeof(*c->auth));
 469
 470 #ifdef WITH_ACCOUNTING
 471         c->acct = rad_malloc(sizeof(*c->acct));
 472         memset(c->acct, 0, sizeof(*c->acct));
 473 #endif
 474 #endif
 475
 476         memset(&cl_ip4addr, 0, sizeof(cl_ip4addr));
 477         memset(&cl_ip6addr, 0, sizeof(cl_ip6addr));
 478         c->prefix = -1;
 479
 480         if (cf_section_parse(cs, c, client_config) < 0) {
 481                 client_free(c);
 482                 cf_log_err(cf_sectiontoitem(cs),
 483                            "Error parsing client section.");
 484                 return NULL;
 485         }
 486
 487         /*
 488          *      Global clients can set servers to use,
 489          *      per-server clients cannot.
 490          */
 491         if (in_server && c->server) {
 492                 client_free(c);
 493                 cf_log_err(cf_sectiontoitem(cs),
 494                            "Clients inside of an server section cannot point to a server.");
 495                 return NULL;
 496         }
 497
 498         /*
 499          *      No "ipaddr" or "ipv6addr", use old-style
 500          *      "client <ipaddr> {" syntax.
 501          */
 502         if (!cf_pair_find(cs, "ipaddr") &&
 503             !cf_pair_find(cs, "ipv6addr")) {
 504                 char *prefix_ptr;
 505
 506                 prefix_ptr = strchr(name2, '/');
 507
 508                 /*
 509                  *      Look for prefixes.
 510                  */
 511                 if (prefix_ptr) {
 512                         c->prefix = atoi(prefix_ptr + 1);
 513                         if ((c->prefix < 0) || (c->prefix > 128)) {
 514                                 client_free(c);
 515                                 cf_log_err(cf_sectiontoitem(cs),
 516                                            "Invalid Prefix value '%s' for IP.",
 517                                            prefix_ptr + 1);
 518                                 return NULL;
 519                         }
 520                         /* Replace '/' with '\0' */
 521                         *prefix_ptr = '\0';
 522                 }
 523
 524                 /*
 525                  *      Always get the numeric representation of IP
 526                  */
 527                 if (ip_hton(name2, AF_UNSPEC, &c->ipaddr) < 0) {
 528                         client_free(c);
 529                         cf_log_err(cf_sectiontoitem(cs),
 530                                    "Failed to look up hostname %s: %s",
 531                                    name2, fr_strerror());
 532                         return NULL;
 533                 }
 534
 535                 if (prefix_ptr) *prefix_ptr = '/';
 536                 c->longname = strdup(name2);
 537
 538                 if (!c->shortname) c->shortname = strdup(c->longname);
 539
 540         } else {
 541                 char buffer[1024];
 542
 543                 /*
 544                  *      Figure out which one to use.
 545                  */
 546                 if (cf_pair_find(cs, "ipaddr")) {
 547                         c->ipaddr.af = AF_INET;
 548                         c->ipaddr.ipaddr.ip4addr = cl_ip4addr;
 549
 550                         if ((c->prefix < -1) || (c->prefix > 32)) {
 551                                 client_free(c);
 552                                 cf_log_err(cf_sectiontoitem(cs),
 553                                            "Netmask must be between 0 and 32");
 554                                 return NULL;
 555                         }
 556
 557                 } else if (cf_pair_find(cs, "ipv6addr")) {
 558                         c->ipaddr.af = AF_INET6;
 559                         c->ipaddr.ipaddr.ip6addr = cl_ip6addr;
 560
 561                         if ((c->prefix < -1) || (c->prefix > 128)) {
 562                                 client_free(c);
 563                                 cf_log_err(cf_sectiontoitem(cs),
 564                                            "Netmask must be between 0 and 128");
 565                                 return NULL;
 566                         }
 567                 } else {
 568                         cf_log_err(cf_sectiontoitem(cs),
 569                                    "No IP address defined for the client");
 570                         client_free(c);
 571                         return NULL;
 572                 }
 573
 574                 ip_ntoh(&c->ipaddr, buffer, sizeof(buffer));
 575                 c->longname = strdup(buffer);
 576
 577                 /*
 578                  *      Set the short name to the name2
 579                  */
 580                 if (!c->shortname) c->shortname = strdup(name2);
 581         }
 582
 583         if (c->prefix < 0) switch (c->ipaddr.af) {
 584         case AF_INET:
 585                 c->prefix = 32;
 586                 break;
 587         case AF_INET6:
 588                 c->prefix = 128;
 589                 break;
 590         default:
 591                 break;
 592         }
 593
 594 #ifdef WITH_DYNAMIC_CLIENTS
 595         if (c->client_server) {
 596                 free(c->secret);
 597                 c->secret = strdup("testing123");
 598
 599                 if (((c->ipaddr.af == AF_INET) &&
 600                      (c->prefix == 32)) ||
 601                     ((c->ipaddr.af == AF_INET6) &&
 602                      (c->prefix == 128))) {
 603                         cf_log_err(cf_sectiontoitem(cs),
 604                                    "Dynamic clients MUST be a network, not a single IP address.");
 605                         client_free(c);
 606                         return NULL;
 607                 }
 608
 609                 return c;
 610         }
 611 #endif
 612
 613         if (!c->secret || !*c->secret) {
 614 #ifdef WITH_DHCP
 615                 const char *value = NULL;
 616                 CONF_PAIR *cp = cf_pair_find(cs, "dhcp");
 617
 618                 if (cp) value = cf_pair_value(cp);
 619
 620                 /*
 621                  *      Secrets aren't needed for DHCP.
 622                  */
 623                 if (value && (strcmp(value, "yes") == 0)) return c;
 624
 625 #endif
 626                 client_free(c);
 627                 cf_log_err(cf_sectiontoitem(cs),
 628                            "secret must be at least 1 character long");
 629                 return NULL;
 630         }
 631
 632
 633         return c;
 634 }
 635
 636
 637 /*
 638  *      Create the linked list of clients from the new configuration
 639  *      type.  This way we don't have to change too much in the other
 640  *      source-files.
 641  */
 642 RADCLIENT_LIST *clients_parse_section(CONF_SECTION *section)
 643 {
 644         int             global = FALSE, in_server = FALSE;
 645         CONF_SECTION    *cs;
 646         RADCLIENT       *c;
 647         RADCLIENT_LIST  *clients;
 648
 649         /*
 650          *      Be forgiving.  If there's already a clients, return
 651          *      it.  Otherwise create a new one.
 652          */
 653         clients = cf_data_find(section, "clients");
 654         if (clients) return clients;
 655
 656         clients = clients_init();
 657         if (!clients) return NULL;
 658
 659         if (cf_top_section(section) == section) global = TRUE;
 660
 661         if (strcmp("server", cf_section_name1(section)) == 0) in_server = TRUE;
 662
 663         /*
 664          *      Associate the clients structure with the section, where
 665          *      it will be freed once the section is freed.
 666          */
 667         if (cf_data_add(section, "clients", clients, (void *) clients_free) < 0) {
 668                 cf_log_err(cf_sectiontoitem(section),
 669                            "Failed to associate clients with section %s",
 670                        cf_section_name1(section));
 671                 clients_free(clients);
 672                 return NULL;
 673         }
 674
 675         for (cs = cf_subsection_find_next(section, NULL, "client");
 676              cs != NULL;
 677              cs = cf_subsection_find_next(section, cs, "client")) {
 678                 c = client_parse(cs, in_server);
 679                 if (!c) {
 680                         return NULL;
 681                 }
 682
 683                 /*
 684                  *      FIXME: Add the client as data via cf_data_add,
 685                  *      for migration issues.
 686                  */
 687
 688 #ifdef WITH_DYNAMIC_CLIENTS
 689 #ifdef HAVE_DIRENT_H
 690                 if (c->client_server) {
 691                         const char *value;
 692                         CONF_PAIR *cp;
 693                         DIR             *dir;
 694                         struct dirent   *dp;
 695                         struct stat stat_buf;
 696                         char buf2[2048];
 697
 698                         /*
 699                          *      Find the directory where individual
 700                          *      client definitions are stored.
 701                          */
 702                         cp = cf_pair_find(cs, "directory");
 703                         if (!cp) continue;
 704
 705                         value = cf_pair_value(cp);
 706                         if (!value) {
 707                                 cf_log_err(cf_sectiontoitem(cs),
 708                                            "The \"directory\" entry must not be empty");
 709                                 client_free(c);
 710                                 return NULL;
 711                         }
 712
 713                         DEBUG("including dynamic clients in %s", value);
 714
 715                         dir = opendir(value);
 716                         if (!dir) {
 717                                 cf_log_err(cf_sectiontoitem(cs), "Error reading directory %s: %s", value, strerror(errno));
 718                                 client_free(c);
 719                                 return NULL;
 720                         }
 721
 722                         /*
 723                          *      Read the directory, ignoring "." files.
 724                          */
 725                         while ((dp = readdir(dir)) != NULL) {
 726                                 const char *p;
 727                                 RADCLIENT *dc;
 728
 729                                 if (dp->d_name[0] == '.') continue;
 730
 731                                 /*
 732                                  *      Check for valid characters
 733                                  */
 734                                 for (p = dp->d_name; *p != '\0'; p++) {
 735                                         if (isalpha((int)*p) ||
 736                                             isdigit((int)*p) ||
 737                                             (*p == ':') ||
 738                                             (*p == '.')) continue;
 739                                                 break;
 740                                 }
 741                                 if (*p != '\0') continue;
 742
 743                                 snprintf(buf2, sizeof(buf2), "%s/%s",
 744                                          value, dp->d_name);
 745
 746                                 if ((stat(buf2, &stat_buf) != 0) ||
 747                                     S_ISDIR(stat_buf.st_mode)) continue;
 748
 749                                 dc = client_read(buf2, in_server);
 750                                 if (!dc) {
 751                                         cf_log_err(cf_sectiontoitem(cs),
 752                                                    "Failed reading client file \"%s\"", buf2);
 753                                         client_free(c);
 754                                         return NULL;
 755                                 }
 756
 757                                 /*
 758                                  *      Validate, and add to the list.
 759                                  */
 760                                 if (!client_validate(clients, c, dc)) {
 761
 762                                         client_free(c);
 763                                         return NULL;
 764                                 }
 765                         } /* loop over the directory */
 766                 }
 767 #endif /* HAVE_DIRENT_H */
 768 #endif /* WITH_DYNAMIC_CLIENTS */
 769
 770                 if (!client_add(clients, c)) {
 771                         cf_log_err(cf_sectiontoitem(cs),
 772                                    "Failed to add client %s",
 773                                    cf_section_name2(cs));
 774                         client_free(c);
 775                         return NULL;
 776                 }
 777
 778         }
 779
 780         /*
 781          *      Replace the global list of clients with the new one.
 782          *      The old one is still referenced from the original
 783          *      configuration, and will be freed when that is freed.
 784          */
 785         if (global) {
 786                 root_clients = clients;
 787         }
 788
 789         return clients;
 790 }
 791
 792 #ifdef WITH_DYNAMIC_CLIENTS
 793 /*
 794  *      We overload this structure a lot.
 795  */
 796 static const CONF_PARSER dynamic_config[] = {
 797         { "FreeRADIUS-Client-IP-Address",  PW_TYPE_IPADDR,
 798           offsetof(RADCLIENT, ipaddr), 0, NULL },
 799         { "FreeRADIUS-Client-IPv6-Address",  PW_TYPE_IPV6ADDR,
 800           offsetof(RADCLIENT, ipaddr), 0, NULL },
 801
 802         { "FreeRADIUS-Client-Require-MA",  PW_TYPE_BOOLEAN,
 803           offsetof(RADCLIENT, message_authenticator), NULL, NULL },
 804
 805         { "FreeRADIUS-Client-Secret",  PW_TYPE_STRING_PTR,
 806           offsetof(RADCLIENT, secret), 0, "" },
 807         { "FreeRADIUS-Client-Shortname",  PW_TYPE_STRING_PTR,
 808           offsetof(RADCLIENT, shortname), 0, "" },
 809         { "FreeRADIUS-Client-NAS-Type",  PW_TYPE_STRING_PTR,
 810           offsetof(RADCLIENT, nastype), 0, NULL },
 811         { "FreeRADIUS-Client-Virtual-Server",  PW_TYPE_STRING_PTR,
 812           offsetof(RADCLIENT, server), 0, NULL },
 813
 814         { NULL, -1, 0, NULL, NULL }
 815 };
 816
 817
 818 int client_validate(RADCLIENT_LIST *clients, RADCLIENT *master, RADCLIENT *c)
 819 {
 820         char buffer[128];
 821
 822         /*
 823          *      No virtual server defined.  Inherit the parent's
 824          *      definition.
 825          */
 826         if (master->server && !c->server) {
 827                 c->server = strdup(master->server);
 828         }
 829
 830         /*
 831          *      If the client network isn't global (not tied to a
 832          *      virtual server), then ensure that this clients server
 833          *      is the same as the enclosing networks virtual server.
 834          */
 835         if (master->server &&
 836              (strcmp(master->server, c->server) != 0)) {
 837                 DEBUG("- Cannot add client %s: Virtual server %s is not the same as the virtual server for the network.",
 838                       ip_ntoh(&c->ipaddr,
 839                               buffer, sizeof(buffer)),
 840                       c->server);
 841
 842                 goto error;
 843         }
 844
 845         if (!client_add(clients, c)) {
 846                 DEBUG("- Cannot add client %s: Internal error",
 847                       ip_ntoh(&c->ipaddr,
 848                               buffer, sizeof(buffer)));
 849
 850                 goto error;
 851         }
 852
 853         /*
 854          *      Initialize the remaining fields.
 855          */
 856         c->dynamic = TRUE;
 857         c->lifetime = master->lifetime;
 858         c->created = time(NULL);
 859         c->longname = strdup(c->shortname);
 860
 861         DEBUG("- Added client %s with shared secret %s",
 862               ip_ntoh(&c->ipaddr, buffer, sizeof(buffer)),
 863               c->secret);
 864
 865         return 1;
 866
 867  error:
 868         client_free(c);
 869         return 0;
 870 }
 871
 872
 873 RADCLIENT *client_create(RADCLIENT_LIST *clients, REQUEST *request)
 874 {
 875         int i, *pi;
 876         char **p;
 877         RADCLIENT *c;
 878         char buffer[128];
 879
 880         if (!clients || !request) return NULL;
 881
 882         c = rad_malloc(sizeof(*c));
 883         memset(c, 0, sizeof(*c));
 884         c->cs = request->client->cs;
 885         c->ipaddr.af = AF_UNSPEC;
 886
 887         for (i = 0; dynamic_config[i].name != NULL; i++) {
 888                 DICT_ATTR *da;
 889                 VALUE_PAIR *vp;
 890
 891                 da = dict_attrbyname(dynamic_config[i].name);
 892                 if (!da) {
 893                         DEBUG("- Cannot add client %s: attribute \"%s\"is not in the dictionary",
 894                               ip_ntoh(&request->packet->src_ipaddr,
 895                                       buffer, sizeof(buffer)),
 896                               dynamic_config[i].name);
 897                 error:
 898                         client_free(c);
 899                         return NULL;
 900                 }
 901
 902                 vp = pairfind(request->config_items, da->attr);
 903                 if (!vp) {
 904                         /*
 905                          *      Not required.  Skip it.
 906                          */
 907                         if (!dynamic_config[i].dflt) continue;
 908
 909                         DEBUG("- Cannot add client %s: Required attribute \"%s\" is missing.",
 910                               ip_ntoh(&request->packet->src_ipaddr,
 911                                       buffer, sizeof(buffer)),
 912                               dynamic_config[i].name);
 913                         goto error;
 914                 }
 915
 916                 switch (dynamic_config[i].type) {
 917                 case PW_TYPE_IPADDR:
 918                         c->ipaddr.af = AF_INET;
 919                         c->ipaddr.ipaddr.ip4addr.s_addr = vp->vp_ipaddr;
 920                         c->prefix = 32;
 921                         break;
 922
 923                 case PW_TYPE_IPV6ADDR:
 924                         c->ipaddr.af = AF_INET6;
 925                         c->ipaddr.ipaddr.ip6addr = vp->vp_ipv6addr;
 926                         c->prefix = 128;
 927                         break;
 928
 929                 case PW_TYPE_STRING_PTR:
 930                         p = (char **) ((char *) c + dynamic_config[i].offset);
 931                         if (*p) free(*p);
 932                         *p = strdup(vp->vp_strvalue);
 933                         break;
 934
 935                 case PW_TYPE_BOOLEAN:
 936                         pi = (int *) ((char *) c + dynamic_config[i].offset);
 937                         *pi = vp->vp_integer;
 938                         break;
 939
 940                 default:
 941                         goto error;
 942                 }
 943         }
 944
 945         if (c->ipaddr.af == AF_UNSPEC) {
 946                 DEBUG("- Cannot add client %s: No IP address was specified.",
 947                       ip_ntoh(&request->packet->src_ipaddr,
 948                               buffer, sizeof(buffer)));
 949
 950                 goto error;
 951         }
 952
 953         if (fr_ipaddr_cmp(&request->packet->src_ipaddr, &c->ipaddr) != 0) {
 954                 char buf2[128];
 955
 956                 DEBUG("- Cannot add client %s: IP address %s do not match",
 957                       ip_ntoh(&request->packet->src_ipaddr,
 958                               buffer, sizeof(buffer)),
 959                       ip_ntoh(&c->ipaddr,
 960                               buf2, sizeof(buf2)));
 961                 goto error;
 962         }
 963
 964         if (!client_validate(clients, request->client, c)) {
 965                 return NULL;
 966         }
 967
 968         return c;
 969 }
 970
 971 /*
 972  *      Read a client definition from the given filename.
 973  */
 974 RADCLIENT *client_read(const char *filename, int in_server)
 975 {
 976         const char *p;
 977         RADCLIENT *c;
 978         CONF_SECTION *cs;
 979         char buffer[256];
 980
 981         if (!filename) return NULL;
 982
 983         cs = cf_file_read(filename);
 984         if (!cs) return NULL;
 985
 986         c = client_parse(cf_section_sub_find(cs, "client"), in_server);
 987
 988         p = strrchr(filename, FR_DIR_SEP);
 989         if (p) {
 990                 p++;
 991         } else {
 992                 p = filename;
 993         }
 994
 995         /*
 996          *      Additional validations
 997          */
 998         ip_ntoh(&c->ipaddr, buffer, sizeof(buffer));
 999         if (strcmp(p, buffer) != 0) {
1000                 DEBUG("Invalid client definition in %s: IP address %s does not match name %s", filename, buffer, p);
1001                 client_free(c);
1002                 return NULL;
1003         }
1004
1005
1006
1007         return c;
1008 }
1009 #endif