src/main/client.c

   1 /*
   2  * client.c     Read clients into memory.
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  * Copyright 2000,2006  The FreeRADIUS server project
  21  * Copyright 2000  Miquel van Smoorenburg <miquels@cistron.nl>
  22  * Copyright 2000  Alan DeKok <aland@ox.org>
  23  */
  24
  25 #include <freeradius-devel/ident.h>
  26 RCSID("$Id$")
  27
  28 #include <freeradius-devel/radiusd.h>
  29 #include <freeradius-devel/rad_assert.h>
  30
  31 #include <sys/stat.h>
  32
  33 #include <ctype.h>
  34 #include <fcntl.h>
  35
  36 #ifdef WITH_DYNAMIC_CLIENTS
  37 #ifdef HAVE_DIRENT_H
  38 #include <dirent.h>
  39 #endif
  40 #endif
  41
  42 struct radclient_list {
  43         /*
  44          *      FIXME: One set of trees for IPv4, and another for IPv6?
  45          */
  46         rbtree_t        *trees[129]; /* for 0..128, inclusive. */
  47         int             min_prefix;
  48 };
  49
  50
  51 #ifdef WITH_STATS
  52 static rbtree_t         *tree_num;      /* client numbers 0..N */
  53 static int              tree_num_max;
  54 #endif
  55 static RADCLIENT_LIST   *root_clients;
  56
  57 /*
  58  *      Callback for freeing a client.
  59  */
  60 void client_free(RADCLIENT *client)
  61 {
  62         free(client->longname);
  63         free(client->secret);
  64         free(client->shortname);
  65         free(client->nastype);
  66         free(client->login);
  67         free(client->password);
  68         free(client->server);
  69
  70 #ifdef WITH_STATS
  71         free(client->auth);
  72 #ifdef WITH_ACCOUNTING
  73         free(client->acct);
  74 #endif
  75 #endif
  76
  77 #ifdef WITH_DYNAMIC_CLIENTS
  78         free(client->client_server);
  79 #endif
  80
  81         free(client);
  82 }
  83
  84 /*
  85  *      Callback for comparing two clients.
  86  */
  87 static int client_ipaddr_cmp(const void *one, const void *two)
  88 {
  89         const RADCLIENT *a = one;
  90         const RADCLIENT *b = two;
  91
  92         return fr_ipaddr_cmp(&a->ipaddr, &b->ipaddr);
  93 }
  94
  95 #ifdef WITH_STATS
  96 static int client_num_cmp(const void *one, const void *two)
  97 {
  98         const RADCLIENT *a = one;
  99         const RADCLIENT *b = two;
 100
 101         return (a->number - b->number);
 102 }
 103 #endif
 104
 105 /*
 106  *      Free a RADCLIENT list.
 107  */
 108 void clients_free(RADCLIENT_LIST *clients)
 109 {
 110         int i;
 111
 112         if (!clients) return;
 113
 114         for (i = 0; i <= 128; i++) {
 115                 if (clients->trees[i]) rbtree_free(clients->trees[i]);
 116                 clients->trees[i] = NULL;
 117         }
 118
 119         if (clients == root_clients) {
 120 #ifdef WITH_STATS
 121                 if (tree_num) rbtree_free(tree_num);
 122                 tree_num = NULL;
 123                 tree_num_max = 0;
 124 #endif
 125                 root_clients = NULL;
 126         }
 127
 128         free(clients);
 129 }
 130
 131 /*
 132  *      Return a new, initialized, set of clients.
 133  */
 134 RADCLIENT_LIST *clients_init(void)
 135 {
 136         RADCLIENT_LIST *clients = calloc(1, sizeof(RADCLIENT_LIST));
 137
 138         if (!clients) return NULL;
 139
 140         clients->min_prefix = 128;
 141
 142         return clients;
 143 }
 144
 145
 146 /*
 147  *      Sanity check a client.
 148  */
 149 static int client_sane(RADCLIENT *client)
 150 {
 151         switch (client->ipaddr.af) {
 152         case AF_INET:
 153                 if (client->prefix > 32) {
 154                         return 0;
 155                 }
 156
 157                 /*
 158                  *      Zero out the subnet bits.
 159                  */
 160                 if (client->prefix == 0) {
 161                         memset(&client->ipaddr.ipaddr.ip4addr, 0,
 162                                sizeof(client->ipaddr.ipaddr.ip4addr));
 163
 164                 } else if (client->prefix < 32) {
 165                         uint32_t mask = ~0;
 166
 167                         mask <<= (32 - client->prefix);
 168                         client->ipaddr.ipaddr.ip4addr.s_addr &= htonl(mask);
 169                 }
 170                 break;
 171
 172         case AF_INET6:
 173                 if (client->prefix > 128) return 0;
 174
 175                 if (client->prefix == 0) {
 176                         memset(&client->ipaddr.ipaddr.ip6addr, 0,
 177                                sizeof(client->ipaddr.ipaddr.ip6addr));
 178
 179                 } else if (client->prefix < 128) {
 180                         int i;
 181                         uint32_t mask, *addr;
 182
 183                         addr = (uint32_t *) &client->ipaddr.ipaddr.ip6addr;
 184
 185                         for (i = client->prefix; i < 128; i += 32) {
 186                                 mask = ~0;
 187                                 mask <<= ((128 - i) & 0x1f);
 188                                 addr[i / 32] &= mask;
 189                         }
 190                 }
 191                 break;
 192
 193         default:
 194                 return 0;
 195         }
 196
 197         return 1;
 198 }
 199
 200
 201 /*
 202  *      Add a client to the tree.
 203  */
 204 int client_add(RADCLIENT_LIST *clients, RADCLIENT *client)
 205 {
 206         if (!client) {
 207                 return 0;
 208         }
 209
 210         /*
 211          *      If "clients" is NULL, it means add to the global list.
 212          */
 213         if (!clients) {
 214                 /*
 215                  *      Initialize it, if not done already.
 216                  */
 217                 if (!root_clients) {
 218                         root_clients = clients_init();
 219                         if (!root_clients) return 0;
 220                 }
 221                 clients = root_clients;
 222         }
 223
 224         if ((client->prefix < 0) || (client->prefix > 128)) {
 225                 return 0;
 226         }
 227
 228         if (!client_sane(client)) return 0;
 229
 230         /*
 231          *      Create a tree for it.
 232          */
 233         if (!clients->trees[client->prefix]) {
 234                 clients->trees[client->prefix] = rbtree_create(client_ipaddr_cmp,
 235                                                                (void *) client_free, 0);
 236                 if (!clients->trees[client->prefix]) {
 237                         return 0;
 238                 }
 239         }
 240
 241         /*
 242          *      Cannot insert the same client twice.
 243          */
 244         if (rbtree_find(clients->trees[client->prefix], client)) {
 245                 radlog(L_ERR, "Failed to add duplicate client %s",
 246                        client->shortname);
 247                 return 0;
 248         }
 249
 250         /*
 251          *      Other error adding client: likely is fatal.
 252          */
 253         if (!rbtree_insert(clients->trees[client->prefix], client)) {
 254                 return 0;
 255         }
 256
 257 #ifdef WITH_STATS
 258         if (!tree_num) {
 259                 tree_num = rbtree_create(client_num_cmp, NULL, 0);
 260         }
 261
 262
 263         /*
 264          *      Catch clients added by rlm_sql.
 265          */
 266         if (!client->auth) {
 267                 client->auth = rad_malloc(sizeof(*client->auth));
 268                 memset(client->auth, 0, sizeof(*client->auth));
 269         }
 270
 271 #ifdef WITH_ACCOUNTING
 272         if (!client->acct) {
 273                 client->acct = rad_malloc(sizeof(*client->acct));
 274                 memset(client->acct, 0, sizeof(*client->acct));
 275         }
 276 #endif
 277
 278 #ifdef WITH_DYNAMIC_CLIENTS
 279         /*
 280          *      More catching of clients added by rlm_sql.
 281          *
 282          *      The sql modules sets the dynamic flag BEFORE calling
 283          *      us.  The client_create() function sets it AFTER
 284          *      calling us.
 285          */
 286         if (client->dynamic && (client->lifetime == 0)) {
 287                 RADCLIENT *network;
 288
 289                 /*
 290                  *      If there IS an enclosing network,
 291                  *      inherit the lifetime from it.
 292                  */
 293                 network = client_find(clients, &client->ipaddr);
 294                 if (network) {
 295                         client->lifetime = network->lifetime;
 296                 }
 297         }
 298 #endif
 299
 300         client->number = tree_num_max;
 301         tree_num_max++;
 302         if (tree_num) rbtree_insert(tree_num, client);
 303 #endif
 304
 305         if (client->prefix < clients->min_prefix) {
 306                 clients->min_prefix = client->prefix;
 307         }
 308
 309         return 1;
 310 }
 311
 312
 313 #ifdef WITH_DYNAMIC_CLIENTS
 314 void client_delete(RADCLIENT_LIST *clients, RADCLIENT *client)
 315 {
 316         if (!clients || !client) return;
 317
 318         rad_assert((client->prefix >= 0) && (client->prefix <= 128));
 319
 320         rbtree_deletebydata(clients->trees[client->prefix], client);
 321 }
 322 #endif
 323
 324
 325 /*
 326  *      Find a client in the RADCLIENTS list by number.
 327  *      This is a support function for the statistics code.
 328  */
 329 RADCLIENT *client_findbynumber(const RADCLIENT_LIST *clients,
 330                                int number)
 331 {
 332 #ifdef WITH_STATS
 333         if (!clients) clients = root_clients;
 334
 335         if (!clients) return NULL;
 336
 337         if (number >= tree_num_max) return NULL;
 338
 339         if (tree_num) {
 340                 RADCLIENT myclient;
 341
 342                 myclient.number = number;
 343
 344                 return rbtree_finddata(tree_num, &myclient);
 345         }
 346 #else
 347         clients = clients;      /* -Wunused */
 348         number = number;        /* -Wunused */
 349 #endif
 350         return NULL;
 351 }
 352
 353
 354 /*
 355  *      Find a client in the RADCLIENTS list.
 356  */
 357 RADCLIENT *client_find(const RADCLIENT_LIST *clients,
 358                        const fr_ipaddr_t *ipaddr)
 359 {
 360         int i, max_prefix;
 361         RADCLIENT myclient;
 362
 363         if (!clients) clients = root_clients;
 364
 365         if (!clients || !ipaddr) return NULL;
 366
 367         switch (ipaddr->af) {
 368         case AF_INET:
 369                 max_prefix = 32;
 370                 break;
 371
 372         case AF_INET6:
 373                 max_prefix = 128;
 374                 break;
 375
 376         default :
 377                 return NULL;
 378         }
 379
 380         for (i = max_prefix; i >= clients->min_prefix; i--) {
 381                 void *data;
 382
 383                 myclient.prefix = i;
 384                 myclient.ipaddr = *ipaddr;
 385                 client_sane(&myclient); /* clean up the ipaddress */
 386
 387                 if (!clients->trees[i]) continue;
 388
 389                 data = rbtree_finddata(clients->trees[i], &myclient);
 390                 if (data) {
 391                         return data;
 392                 }
 393         }
 394
 395         return NULL;
 396 }
 397
 398
 399 /*
 400  *      Old wrapper for client_find
 401  */
 402 RADCLIENT *client_find_old(const fr_ipaddr_t *ipaddr)
 403 {
 404         return client_find(root_clients, ipaddr);
 405 }
 406
 407 static struct in_addr cl_ip4addr;
 408 static struct in6_addr cl_ip6addr;
 409
 410 static const CONF_PARSER client_config[] = {
 411         { "ipaddr",  PW_TYPE_IPADDR,
 412           0, &cl_ip4addr,  NULL },
 413         { "ipv6addr",  PW_TYPE_IPV6ADDR,
 414           0, &cl_ip6addr, NULL },
 415         { "netmask",  PW_TYPE_INTEGER,
 416           offsetof(RADCLIENT, prefix), 0, NULL },
 417
 418         { "require_message_authenticator",  PW_TYPE_BOOLEAN,
 419           offsetof(RADCLIENT, message_authenticator), 0, "no" },
 420
 421         { "secret",  PW_TYPE_STRING_PTR,
 422           offsetof(RADCLIENT, secret), 0, NULL },
 423         { "shortname",  PW_TYPE_STRING_PTR,
 424           offsetof(RADCLIENT, shortname), 0, NULL },
 425         { "nastype",  PW_TYPE_STRING_PTR,
 426           offsetof(RADCLIENT, nastype), 0, NULL },
 427         { "login",  PW_TYPE_STRING_PTR,
 428           offsetof(RADCLIENT, login), 0, NULL },
 429         { "password",  PW_TYPE_STRING_PTR,
 430           offsetof(RADCLIENT, password), 0, NULL },
 431         { "virtual_server",  PW_TYPE_STRING_PTR,
 432           offsetof(RADCLIENT, server), 0, NULL },
 433         { "server",  PW_TYPE_STRING_PTR, /* compatability with 2.0-pre */
 434           offsetof(RADCLIENT, server), 0, NULL },
 435
 436 #ifdef WITH_DYNAMIC_CLIENTS
 437         { "dynamic_clients",  PW_TYPE_STRING_PTR,
 438           offsetof(RADCLIENT, client_server), 0, NULL },
 439         { "lifetime",  PW_TYPE_INTEGER,
 440           offsetof(RADCLIENT, lifetime), 0, NULL },
 441 #endif
 442
 443 #ifdef WITH_COA
 444         { "coa_server",  PW_TYPE_STRING_PTR,
 445           offsetof(RADCLIENT, coa_name), 0, NULL },
 446 #endif
 447
 448         { NULL, -1, 0, NULL, NULL }
 449 };
 450
 451
 452 static RADCLIENT *client_parse(CONF_SECTION *cs, int in_server)
 453 {
 454         RADCLIENT       *c;
 455         const char      *name2;
 456
 457         name2 = cf_section_name2(cs);
 458         if (!name2) {
 459                 cf_log_err(cf_sectiontoitem(cs),
 460                            "Missing client name");
 461                 return NULL;
 462         }
 463
 464         /*
 465          * The size is fine.. Let's create the buffer
 466          */
 467         c = rad_malloc(sizeof(*c));
 468         memset(c, 0, sizeof(*c));
 469         c->cs = cs;
 470
 471 #ifdef WITH_STATS
 472         c->auth = rad_malloc(sizeof(*c->auth));
 473         memset(c->auth, 0, sizeof(*c->auth));
 474
 475 #ifdef WITH_ACCOUNTING
 476         c->acct = rad_malloc(sizeof(*c->acct));
 477         memset(c->acct, 0, sizeof(*c->acct));
 478 #endif
 479 #endif
 480
 481         memset(&cl_ip4addr, 0, sizeof(cl_ip4addr));
 482         memset(&cl_ip6addr, 0, sizeof(cl_ip6addr));
 483         c->prefix = -1;
 484
 485         if (cf_section_parse(cs, c, client_config) < 0) {
 486                 client_free(c);
 487                 cf_log_err(cf_sectiontoitem(cs),
 488                            "Error parsing client section.");
 489                 return NULL;
 490         }
 491
 492         /*
 493          *      Global clients can set servers to use,
 494          *      per-server clients cannot.
 495          */
 496         if (in_server && c->server) {
 497                 client_free(c);
 498                 cf_log_err(cf_sectiontoitem(cs),
 499                            "Clients inside of an server section cannot point to a server.");
 500                 return NULL;
 501         }
 502
 503         /*
 504          *      No "ipaddr" or "ipv6addr", use old-style
 505          *      "client <ipaddr> {" syntax.
 506          */
 507         if (!cf_pair_find(cs, "ipaddr") &&
 508             !cf_pair_find(cs, "ipv6addr")) {
 509                 char *prefix_ptr;
 510
 511                 prefix_ptr = strchr(name2, '/');
 512
 513                 /*
 514                  *      Look for prefixes.
 515                  */
 516                 if (prefix_ptr) {
 517                         c->prefix = atoi(prefix_ptr + 1);
 518                         if ((c->prefix < 0) || (c->prefix > 128)) {
 519                                 client_free(c);
 520                                 cf_log_err(cf_sectiontoitem(cs),
 521                                            "Invalid Prefix value '%s' for IP.",
 522                                            prefix_ptr + 1);
 523                                 return NULL;
 524                         }
 525                         /* Replace '/' with '\0' */
 526                         *prefix_ptr = '\0';
 527                 }
 528
 529                 /*
 530                  *      Always get the numeric representation of IP
 531                  */
 532                 if (ip_hton(name2, AF_UNSPEC, &c->ipaddr) < 0) {
 533                         client_free(c);
 534                         cf_log_err(cf_sectiontoitem(cs),
 535                                    "Failed to look up hostname %s: %s",
 536                                    name2, fr_strerror());
 537                         return NULL;
 538                 }
 539
 540                 if (prefix_ptr) *prefix_ptr = '/';
 541                 c->longname = strdup(name2);
 542
 543                 if (!c->shortname) c->shortname = strdup(c->longname);
 544
 545         } else {
 546                 char buffer[1024];
 547
 548                 /*
 549                  *      Figure out which one to use.
 550                  */
 551                 if (cf_pair_find(cs, "ipaddr")) {
 552                         c->ipaddr.af = AF_INET;
 553                         c->ipaddr.ipaddr.ip4addr = cl_ip4addr;
 554
 555                         if ((c->prefix < -1) || (c->prefix > 32)) {
 556                                 client_free(c);
 557                                 cf_log_err(cf_sectiontoitem(cs),
 558                                            "Netmask must be between 0 and 32");
 559                                 return NULL;
 560                         }
 561
 562                 } else if (cf_pair_find(cs, "ipv6addr")) {
 563                         c->ipaddr.af = AF_INET6;
 564                         c->ipaddr.ipaddr.ip6addr = cl_ip6addr;
 565
 566                         if ((c->prefix < -1) || (c->prefix > 128)) {
 567                                 client_free(c);
 568                                 cf_log_err(cf_sectiontoitem(cs),
 569                                            "Netmask must be between 0 and 128");
 570                                 return NULL;
 571                         }
 572                 } else {
 573                         cf_log_err(cf_sectiontoitem(cs),
 574                                    "No IP address defined for the client");
 575                         client_free(c);
 576                         return NULL;
 577                 }
 578
 579                 ip_ntoh(&c->ipaddr, buffer, sizeof(buffer));
 580                 c->longname = strdup(buffer);
 581
 582                 /*
 583                  *      Set the short name to the name2
 584                  */
 585                 if (!c->shortname) c->shortname = strdup(name2);
 586         }
 587
 588         if (c->prefix < 0) switch (c->ipaddr.af) {
 589         case AF_INET:
 590                 c->prefix = 32;
 591                 break;
 592         case AF_INET6:
 593                 c->prefix = 128;
 594                 break;
 595         default:
 596                 break;
 597         }
 598
 599 #ifdef WITH_DYNAMIC_CLIENTS
 600         if (c->client_server) {
 601                 free(c->secret);
 602                 c->secret = strdup("testing123");
 603
 604                 if (((c->ipaddr.af == AF_INET) &&
 605                      (c->prefix == 32)) ||
 606                     ((c->ipaddr.af == AF_INET6) &&
 607                      (c->prefix == 128))) {
 608                         cf_log_err(cf_sectiontoitem(cs),
 609                                    "Dynamic clients MUST be a network, not a single IP address.");
 610                         client_free(c);
 611                         return NULL;
 612                 }
 613
 614                 return c;
 615         }
 616 #endif
 617
 618         if (!c->secret || !*c->secret) {
 619 #ifdef WITH_DHCP
 620                 const char *value = NULL;
 621                 CONF_PAIR *cp = cf_pair_find(cs, "dhcp");
 622
 623                 if (cp) value = cf_pair_value(cp);
 624
 625                 /*
 626                  *      Secrets aren't needed for DHCP.
 627                  */
 628                 if (value && (strcmp(value, "yes") == 0)) return c;
 629
 630 #endif
 631                 client_free(c);
 632                 cf_log_err(cf_sectiontoitem(cs),
 633                            "secret must be at least 1 character long");
 634                 return NULL;
 635         }
 636
 637 #ifdef WITH_COA
 638         /*
 639          *      Point the client to the home server pool, OR to the
 640          *      home server.  This gets around the problem of figuring
 641          *      out which port to use.
 642          */
 643         if (c->coa_name) {
 644                 c->coa_pool = home_pool_byname(c->coa_name, HOME_TYPE_COA);
 645                 if (!c->coa_pool) {
 646                         c->coa_server = home_server_byname(c->coa_name);
 647                 }
 648                 if (!c->coa_server) {
 649                         client_free(c);
 650                         cf_log_err(cf_sectiontoitem(cs), "No such home_server or home_server_pool \"%s\"", c->coa_name);
 651                         return NULL;
 652                 }
 653         }
 654 #endif
 655
 656         return c;
 657 }
 658
 659
 660 /*
 661  *      Create the linked list of clients from the new configuration
 662  *      type.  This way we don't have to change too much in the other
 663  *      source-files.
 664  */
 665 RADCLIENT_LIST *clients_parse_section(CONF_SECTION *section)
 666 {
 667         int             global = FALSE, in_server = FALSE;
 668         CONF_SECTION    *cs;
 669         RADCLIENT       *c;
 670         RADCLIENT_LIST  *clients;
 671
 672         /*
 673          *      Be forgiving.  If there's already a clients, return
 674          *      it.  Otherwise create a new one.
 675          */
 676         clients = cf_data_find(section, "clients");
 677         if (clients) return clients;
 678
 679         clients = clients_init();
 680         if (!clients) return NULL;
 681
 682         if (cf_top_section(section) == section) global = TRUE;
 683
 684         if (strcmp("server", cf_section_name1(section)) == 0) in_server = TRUE;
 685
 686         /*
 687          *      Associate the clients structure with the section, where
 688          *      it will be freed once the section is freed.
 689          */
 690         if (cf_data_add(section, "clients", clients, (void *) clients_free) < 0) {
 691                 cf_log_err(cf_sectiontoitem(section),
 692                            "Failed to associate clients with section %s",
 693                        cf_section_name1(section));
 694                 clients_free(clients);
 695                 return NULL;
 696         }
 697
 698         for (cs = cf_subsection_find_next(section, NULL, "client");
 699              cs != NULL;
 700              cs = cf_subsection_find_next(section, cs, "client")) {
 701                 c = client_parse(cs, in_server);
 702                 if (!c) {
 703                         return NULL;
 704                 }
 705
 706                 /*
 707                  *      FIXME: Add the client as data via cf_data_add,
 708                  *      for migration issues.
 709                  */
 710
 711 #ifdef WITH_DYNAMIC_CLIENTS
 712 #ifdef HAVE_DIRENT_H
 713                 if (c->client_server) {
 714                         const char *value;
 715                         CONF_PAIR *cp;
 716                         DIR             *dir;
 717                         struct dirent   *dp;
 718                         struct stat stat_buf;
 719                         char buf2[2048];
 720
 721                         /*
 722                          *      Find the directory where individual
 723                          *      client definitions are stored.
 724                          */
 725                         cp = cf_pair_find(cs, "directory");
 726                         if (!cp) goto add_client;
 727
 728                         value = cf_pair_value(cp);
 729                         if (!value) {
 730                                 cf_log_err(cf_sectiontoitem(cs),
 731                                            "The \"directory\" entry must not be empty");
 732                                 client_free(c);
 733                                 return NULL;
 734                         }
 735
 736                         DEBUG("including dynamic clients in %s", value);
 737
 738                         dir = opendir(value);
 739                         if (!dir) {
 740                                 cf_log_err(cf_sectiontoitem(cs), "Error reading directory %s: %s", value, strerror(errno));
 741                                 client_free(c);
 742                                 return NULL;
 743                         }
 744
 745                         /*
 746                          *      Read the directory, ignoring "." files.
 747                          */
 748                         while ((dp = readdir(dir)) != NULL) {
 749                                 const char *p;
 750                                 RADCLIENT *dc;
 751
 752                                 if (dp->d_name[0] == '.') continue;
 753
 754                                 /*
 755                                  *      Check for valid characters
 756                                  */
 757                                 for (p = dp->d_name; *p != '\0'; p++) {
 758                                         if (isalpha((int)*p) ||
 759                                             isdigit((int)*p) ||
 760                                             (*p == ':') ||
 761                                             (*p == '.')) continue;
 762                                                 break;
 763                                 }
 764                                 if (*p != '\0') continue;
 765
 766                                 snprintf(buf2, sizeof(buf2), "%s/%s",
 767                                          value, dp->d_name);
 768
 769                                 if ((stat(buf2, &stat_buf) != 0) ||
 770                                     S_ISDIR(stat_buf.st_mode)) continue;
 771
 772                                 dc = client_read(buf2, in_server, TRUE);
 773                                 if (!dc) {
 774                                         cf_log_err(cf_sectiontoitem(cs),
 775                                                    "Failed reading client file \"%s\"", buf2);
 776                                         client_free(c);
 777                                         return NULL;
 778                                 }
 779
 780                                 /*
 781                                  *      Validate, and add to the list.
 782                                  */
 783                                 if (!client_validate(clients, c, dc)) {
 784
 785                                         client_free(c);
 786                                         return NULL;
 787                                 }
 788                         } /* loop over the directory */
 789                 }
 790 #endif /* HAVE_DIRENT_H */
 791 #endif /* WITH_DYNAMIC_CLIENTS */
 792
 793         add_client:
 794                 if (!client_add(clients, c)) {
 795                         cf_log_err(cf_sectiontoitem(cs),
 796                                    "Failed to add client %s",
 797                                    cf_section_name2(cs));
 798                         client_free(c);
 799                         return NULL;
 800                 }
 801
 802         }
 803
 804         /*
 805          *      Replace the global list of clients with the new one.
 806          *      The old one is still referenced from the original
 807          *      configuration, and will be freed when that is freed.
 808          */
 809         if (global) {
 810                 root_clients = clients;
 811         }
 812
 813         return clients;
 814 }
 815
 816 #ifdef WITH_DYNAMIC_CLIENTS
 817 /*
 818  *      We overload this structure a lot.
 819  */
 820 static const CONF_PARSER dynamic_config[] = {
 821         { "FreeRADIUS-Client-IP-Address",  PW_TYPE_IPADDR,
 822           offsetof(RADCLIENT, ipaddr), 0, NULL },
 823         { "FreeRADIUS-Client-IPv6-Address",  PW_TYPE_IPV6ADDR,
 824           offsetof(RADCLIENT, ipaddr), 0, NULL },
 825
 826         { "FreeRADIUS-Client-Require-MA",  PW_TYPE_BOOLEAN,
 827           offsetof(RADCLIENT, message_authenticator), NULL, NULL },
 828
 829         { "FreeRADIUS-Client-Secret",  PW_TYPE_STRING_PTR,
 830           offsetof(RADCLIENT, secret), 0, "" },
 831         { "FreeRADIUS-Client-Shortname",  PW_TYPE_STRING_PTR,
 832           offsetof(RADCLIENT, shortname), 0, "" },
 833         { "FreeRADIUS-Client-NAS-Type",  PW_TYPE_STRING_PTR,
 834           offsetof(RADCLIENT, nastype), 0, NULL },
 835         { "FreeRADIUS-Client-Virtual-Server",  PW_TYPE_STRING_PTR,
 836           offsetof(RADCLIENT, server), 0, NULL },
 837
 838         { NULL, -1, 0, NULL, NULL }
 839 };
 840
 841
 842 int client_validate(RADCLIENT_LIST *clients, RADCLIENT *master, RADCLIENT *c)
 843 {
 844         char buffer[128];
 845
 846         /*
 847          *      No virtual server defined.  Inherit the parent's
 848          *      definition.
 849          */
 850         if (master->server && !c->server) {
 851                 c->server = strdup(master->server);
 852         }
 853
 854         /*
 855          *      If the client network isn't global (not tied to a
 856          *      virtual server), then ensure that this clients server
 857          *      is the same as the enclosing networks virtual server.
 858          */
 859         if (master->server &&
 860              (strcmp(master->server, c->server) != 0)) {
 861                 DEBUG("- Cannot add client %s: Virtual server %s is not the same as the virtual server for the network.",
 862                       ip_ntoh(&c->ipaddr,
 863                               buffer, sizeof(buffer)),
 864                       c->server);
 865
 866                 goto error;
 867         }
 868
 869         if (!client_add(clients, c)) {
 870                 DEBUG("- Cannot add client %s: Internal error",
 871                       ip_ntoh(&c->ipaddr,
 872                               buffer, sizeof(buffer)));
 873
 874                 goto error;
 875         }
 876
 877         /*
 878          *      Initialize the remaining fields.
 879          */
 880         c->dynamic = TRUE;
 881         c->lifetime = master->lifetime;
 882         c->created = time(NULL);
 883         c->longname = strdup(c->shortname);
 884
 885         DEBUG("- Added client %s with shared secret %s",
 886               ip_ntoh(&c->ipaddr, buffer, sizeof(buffer)),
 887               c->secret);
 888
 889         return 1;
 890
 891  error:
 892         client_free(c);
 893         return 0;
 894 }
 895
 896
 897 RADCLIENT *client_create(RADCLIENT_LIST *clients, REQUEST *request)
 898 {
 899         int i, *pi;
 900         char **p;
 901         RADCLIENT *c;
 902         char buffer[128];
 903
 904         if (!clients || !request) return NULL;
 905
 906         c = rad_malloc(sizeof(*c));
 907         memset(c, 0, sizeof(*c));
 908         c->cs = request->client->cs;
 909         c->ipaddr.af = AF_UNSPEC;
 910
 911         for (i = 0; dynamic_config[i].name != NULL; i++) {
 912                 DICT_ATTR *da;
 913                 VALUE_PAIR *vp;
 914
 915                 da = dict_attrbyname(dynamic_config[i].name);
 916                 if (!da) {
 917                         DEBUG("- Cannot add client %s: attribute \"%s\"is not in the dictionary",
 918                               ip_ntoh(&request->packet->src_ipaddr,
 919                                       buffer, sizeof(buffer)),
 920                               dynamic_config[i].name);
 921                 error:
 922                         client_free(c);
 923                         return NULL;
 924                 }
 925
 926                 vp = pairfind(request->config_items, da->attr);
 927                 if (!vp) {
 928                         /*
 929                          *      Not required.  Skip it.
 930                          */
 931                         if (!dynamic_config[i].dflt) continue;
 932
 933                         DEBUG("- Cannot add client %s: Required attribute \"%s\" is missing.",
 934                               ip_ntoh(&request->packet->src_ipaddr,
 935                                       buffer, sizeof(buffer)),
 936                               dynamic_config[i].name);
 937                         goto error;
 938                 }
 939
 940                 switch (dynamic_config[i].type) {
 941                 case PW_TYPE_IPADDR:
 942                         c->ipaddr.af = AF_INET;
 943                         c->ipaddr.ipaddr.ip4addr.s_addr = vp->vp_ipaddr;
 944                         c->prefix = 32;
 945                         break;
 946
 947                 case PW_TYPE_IPV6ADDR:
 948                         c->ipaddr.af = AF_INET6;
 949                         c->ipaddr.ipaddr.ip6addr = vp->vp_ipv6addr;
 950                         c->prefix = 128;
 951                         break;
 952
 953                 case PW_TYPE_STRING_PTR:
 954                         p = (char **) ((char *) c + dynamic_config[i].offset);
 955                         if (*p) free(*p);
 956                         *p = strdup(vp->vp_strvalue);
 957                         break;
 958
 959                 case PW_TYPE_BOOLEAN:
 960                         pi = (int *) ((char *) c + dynamic_config[i].offset);
 961                         *pi = vp->vp_integer;
 962                         break;
 963
 964                 default:
 965                         goto error;
 966                 }
 967         }
 968
 969         if (c->ipaddr.af == AF_UNSPEC) {
 970                 DEBUG("- Cannot add client %s: No IP address was specified.",
 971                       ip_ntoh(&request->packet->src_ipaddr,
 972                               buffer, sizeof(buffer)));
 973
 974                 goto error;
 975         }
 976
 977         if (fr_ipaddr_cmp(&request->packet->src_ipaddr, &c->ipaddr) != 0) {
 978                 char buf2[128];
 979
 980                 DEBUG("- Cannot add client %s: IP address %s do not match",
 981                       ip_ntoh(&request->packet->src_ipaddr,
 982                               buffer, sizeof(buffer)),
 983                       ip_ntoh(&c->ipaddr,
 984                               buf2, sizeof(buf2)));
 985                 goto error;
 986         }
 987
 988         if (!client_validate(clients, request->client, c)) {
 989                 return NULL;
 990         }
 991
 992         return c;
 993 }
 994
 995 /*
 996  *      Read a client definition from the given filename.
 997  */
 998 RADCLIENT *client_read(const char *filename, int in_server, int flag)
 999 {
1000         const char *p;
1001         RADCLIENT *c;
1002         CONF_SECTION *cs;
1003         char buffer[256];
1004
1005         if (!filename) return NULL;
1006
1007         cs = cf_file_read(filename);
1008         if (!cs) return NULL;
1009
1010         c = client_parse(cf_section_sub_find(cs, "client"), in_server);
1011
1012         p = strrchr(filename, FR_DIR_SEP);
1013         if (p) {
1014                 p++;
1015         } else {
1016                 p = filename;
1017         }
1018
1019         if (!flag) return c;
1020
1021         /*
1022          *      Additional validations
1023          */
1024         ip_ntoh(&c->ipaddr, buffer, sizeof(buffer));
1025         if (strcmp(p, buffer) != 0) {
1026                 DEBUG("Invalid client definition in %s: IP address %s does not match name %s", filename, buffer, p);
1027                 client_free(c);
1028                 return NULL;
1029         }
1030
1031
1032
1033         return c;
1034 }
1035 #endif