src/main/valuepair.c

   1 /*
   2  * valuepair.c  Valuepair functions that are radiusd-specific
   3  *              and as such do not belong in the library.
   4  *
   5  * Version:     $Id$
   6  *
   7  *   This program is free software; you can redistribute it and/or modify
   8  *   it under the terms of the GNU General Public License as published by
   9  *   the Free Software Foundation; either version 2 of the License, or
  10  *   (at your option) any later version.
  11  *
  12  *   This program is distributed in the hope that it will be useful,
  13  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  *   GNU General Public License for more details.
  16  *
  17  *   You should have received a copy of the GNU General Public License
  18  *   along with this program; if not, write to the Free Software
  19  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  20  *
  21  * Copyright 2000  The FreeRADIUS server project
  22  * Copyright 2000  Alan DeKok <aland@ox.org>
  23  */
  24
  25 static const char rcsid[] = "$Id$";
  26
  27 #include "autoconf.h"
  28
  29 #include <stdio.h>
  30 #include <stdlib.h>
  31 #include <string.h>
  32
  33 #ifdef HAVE_NETINET_IN_H
  34 #       include <netinet/in.h>
  35 #endif
  36
  37 #ifdef HAVE_REGEX_H
  38 #       include <regex.h>
  39
  40 /*
  41  *  For POSIX Regular expressions.
  42  *  (0) Means no extended regular expressions.
  43  *  REG_EXTENDED means use extended regular expressions.
  44  */
  45 #ifndef REG_EXTENDED
  46 #define REG_EXTENDED (0)
  47 #endif
  48
  49 #ifndef REG_NOSUB
  50 #define REG_NOSUB (0)
  51 #endif
  52 #endif
  53
  54 #include "radiusd.h"
  55
  56 struct cmp {
  57         int attribute;
  58         int otherattr;
  59         void *instance; /* module instance */
  60         RAD_COMPARE_FUNC compare;
  61         struct cmp *next;
  62 };
  63 static struct cmp *cmp;
  64
  65
  66 /*
  67  *      Compare 2 attributes. May call the attribute compare function.
  68  */
  69 static int paircompare(REQUEST *req, VALUE_PAIR *request, VALUE_PAIR *check,
  70                        VALUE_PAIR *check_pairs, VALUE_PAIR **reply_pairs)
  71 {
  72         int ret = -2;
  73         struct cmp *c;
  74
  75         /*
  76          *      Sanity check.
  77          */
  78 #if 0
  79         if (request->attribute != check->attribute)
  80                 return -2;
  81 #endif
  82
  83         /*
  84          *      Check for =* and !* and return appropriately
  85          */
  86         if( check->operator == T_OP_CMP_TRUE )
  87                  return 0;  /* always return 0/EQUAL */
  88         if( check->operator == T_OP_CMP_FALSE )
  89                  return 1;  /* always return 1/NOT EQUAL */
  90
  91         /*
  92          *      See if there is a special compare function.
  93          *
  94          *      FIXME: use new RB-Tree code.
  95          */
  96         for (c = cmp; c; c = c->next)
  97                 if (c->attribute == check->attribute)
  98                         return (c->compare)(c->instance, req, request, check,
  99                                 check_pairs, reply_pairs);
 100
 101         if (!request) return -1; /* doesn't exist, don't compare it */
 102
 103         switch(check->type) {
 104 #ifdef ASCEND_BINARY
 105                 /*
 106                  *      Ascend binary attributes can be treated
 107                  *      as opaque objects, I guess...
 108                  */
 109                 case PW_TYPE_ABINARY:
 110 #endif
 111                 case PW_TYPE_OCTETS:
 112                         if (request->length != check->length) {
 113                                 ret = 1; /* NOT equal */
 114                                 break;
 115                         }
 116                         ret = memcmp(request->strvalue, check->strvalue,
 117                                         request->length);
 118                         break;
 119                 case PW_TYPE_STRING:
 120                         if (check->flags.caseless) {
 121                                 ret = strcasecmp((char *)request->strvalue,
 122                                                  (char *)check->strvalue);
 123                         } else {
 124                                 ret = strcmp((char *)request->strvalue,
 125                                              (char *)check->strvalue);
 126                         }
 127                         break;
 128                 case PW_TYPE_INTEGER:
 129                 case PW_TYPE_DATE:
 130                         ret = request->lvalue - check->lvalue;
 131                         break;
 132                 case PW_TYPE_IPADDR:
 133                         ret = ntohl(request->lvalue) - ntohl(check->lvalue);
 134                         break;
 135                 default:
 136                         break;
 137         }
 138
 139         return ret;
 140 }
 141
 142
 143 /*
 144  *      See what attribute we want to compare with.
 145  */
 146 static int otherattr(int attr)
 147 {
 148         struct cmp      *c;
 149
 150         for (c = cmp; c; c = c->next) {
 151                 if (c->attribute == attr)
 152                         return c->otherattr;
 153         }
 154
 155         return attr;
 156 }
 157
 158 /*
 159  *      Register a function as compare function.
 160  *      compare_attr is the attribute in the request we want to
 161  *      compare with. Normally this is the same as "attr".
 162  *      You can set this to:
 163  *
 164  *      -1   the same as "attr"
 165  *      0    always call compare function, not tied to request attribute
 166  *      >0   Attribute to compare with.
 167  *
 168  *      For example, PW_GROUP in a check item needs to be compared
 169  *      with PW_USER_NAME in the incoming request.
 170  */
 171 int paircompare_register(int attr, int compare_attr, RAD_COMPARE_FUNC fun, void *instance)
 172 {
 173         struct cmp      *c;
 174
 175         paircompare_unregister(attr, fun);
 176
 177         c = rad_malloc(sizeof(struct cmp));
 178
 179         if (compare_attr < 0)
 180                 compare_attr = attr;
 181         c->compare = fun;
 182         c->attribute = attr;
 183         c->otherattr = compare_attr;
 184         c->instance = instance;
 185         c->next = cmp;
 186         cmp = c;
 187
 188         return 0;
 189 }
 190
 191 /*
 192  *      Unregister a function.
 193  */
 194 void paircompare_unregister(int attr, RAD_COMPARE_FUNC fun)
 195 {
 196         struct cmp      *c, *last;
 197
 198         last = NULL;
 199         for (c = cmp; c; c = c->next) {
 200                 if (c->attribute == attr && c->compare == fun)
 201                         break;
 202                 last = c;
 203         }
 204
 205         if (c == NULL) return;
 206
 207         if (last != NULL)
 208                 last->next = c->next;
 209         else
 210                 cmp = c->next;
 211
 212         free(c);
 213 }
 214
 215 /*
 216  *      Compare two pair lists except for the password information.
 217  *      For every element in "check" at least one matching copy must
 218  *      be present in "reply".
 219  *
 220  *      Return 0 on match.
 221  */
 222 int paircmp(REQUEST *req, VALUE_PAIR *request, VALUE_PAIR *check, VALUE_PAIR **reply)
 223 {
 224         VALUE_PAIR *check_item;
 225         VALUE_PAIR *auth_item;
 226         int result = 0;
 227         int compare;
 228         int other;
 229 #ifdef HAVE_REGEX_H
 230         regex_t reg;
 231 #endif
 232
 233         for (check_item = check; check_item != NULL; check_item = check_item->next) {
 234                 /*
 235                  *      If the user is setting a configuration value,
 236                  *      then don't bother comparing it to any attributes
 237                  *      sent to us by the user.  It ALWAYS matches.
 238                  */
 239                 if ((check_item->operator == T_OP_SET) ||
 240                     (check_item->operator == T_OP_ADD)) {
 241                         continue;
 242                 }
 243
 244                 switch (check_item->attribute) {
 245                         /*
 246                          *      Attributes we skip during comparison.
 247                          *      These are "server" check items.
 248                          */
 249                         case PW_CRYPT_PASSWORD:
 250                         case PW_AUTH_TYPE:
 251                         case PW_AUTZ_TYPE:
 252                         case PW_ACCT_TYPE:
 253                         case PW_SESSION_TYPE:
 254                         case PW_STRIP_USER_NAME:
 255                                 continue;
 256                                 break;
 257
 258                         /*
 259                          *      IF the password attribute exists, THEN
 260                          *      we can do comparisons against it.  If not,
 261                          *      then the request did NOT contain a
 262                          *      User-Password attribute, so we CANNOT do
 263                          *      comparisons against it.
 264                          *
 265                          *      This hack makes CHAP-Password work..
 266                          */
 267                         case PW_PASSWORD:
 268                                 if (pairfind(request, PW_PASSWORD) == NULL) {
 269                                         continue;
 270                                 }
 271                                 break;
 272                 }
 273
 274                 /*
 275                  *      See if this item is present in the request.
 276                  */
 277                 other = otherattr(check_item->attribute);
 278
 279                 auth_item = request;
 280         try_again:
 281                 for (; auth_item != NULL; auth_item = auth_item->next) {
 282                         if (auth_item->attribute == other || other == 0)
 283                                 break;
 284                 }
 285
 286                 /*
 287                  *      Not found, it's not a match.
 288                  */
 289                 if (auth_item == NULL) {
 290                         /*
 291                          *      Didn't find it.  If we were *trying*
 292                          *      to not find it, then we succeeded.
 293                          */
 294                         if (check_item->operator == T_OP_CMP_FALSE)
 295                                 return 0;
 296                         else
 297                                 return -1;
 298                 }
 299
 300                 /*
 301                  *      Else we found it, but we were trying to not
 302                  *      find it, so we failed.
 303                  */
 304                 if (check_item->operator == T_OP_CMP_FALSE)
 305                         return -1;
 306
 307
 308                 /*
 309                  *      We've got to xlat the string before doing
 310                  *      the comparison.
 311                  */
 312                 if (check_item->flags.do_xlat) {
 313                         int rcode;
 314                         char buffer[sizeof(check_item->strvalue)];
 315
 316                         check_item->flags.do_xlat = 0;
 317                         rcode = radius_xlat(buffer, sizeof(buffer),
 318                                             check_item->strvalue,
 319                                             req, NULL);
 320
 321                         /*
 322                          *      Parse the string into a new value.
 323                          */
 324                         pairparsevalue(check_item, buffer);
 325                 }
 326
 327                 /*
 328                  *      OK it is present now compare them.
 329                  */
 330                 compare = paircompare(req, auth_item, check_item, check, reply);
 331
 332                 switch (check_item->operator) {
 333                         case T_OP_EQ:
 334                         default:
 335                                 radlog(L_INFO,  "Invalid operator for item %s: "
 336                                                 "reverting to '=='", check_item->name);
 337                                 /*FALLTHRU*/
 338                         case T_OP_CMP_TRUE:    /* compare always == 0 */
 339                         case T_OP_CMP_FALSE:   /* compare always == 1 */
 340                         case T_OP_CMP_EQ:
 341                                 if (compare != 0) result = -1;
 342                                 break;
 343
 344                         case T_OP_NE:
 345                                 if (compare == 0) result = -1;
 346                                 break;
 347
 348                         case T_OP_LT:
 349                                 if (compare >= 0) result = -1;
 350                                 break;
 351
 352                         case T_OP_GT:
 353                                 if (compare <= 0) result = -1;
 354                                 break;
 355
 356                         case T_OP_LE:
 357                                 if (compare > 0) result = -1;
 358                                 break;
 359
 360                         case T_OP_GE:
 361                                 if (compare < 0) result = -1;
 362                                 break;
 363
 364 #ifdef HAVE_REGEX_H
 365                         case T_OP_REG_EQ:
 366                         {
 367                                 int i;
 368                                 regmatch_t rxmatch[REQUEST_MAX_REGEX + 1];
 369
 370                                 /*
 371                                  *      Include substring matches.
 372                                  */
 373                                 regcomp(&reg, (char *)check_item->strvalue,
 374                                         REG_EXTENDED);
 375                                 compare = regexec(&reg,
 376                                                   (char *)auth_item->strvalue,
 377                                                   REQUEST_MAX_REGEX + 1,
 378                                                   rxmatch, 0);
 379                                 regfree(&reg);
 380
 381                                 /*
 382                                  *      Add %{0}, %{1}, etc.
 383                                  */
 384                                 for (i = 0; i <= REQUEST_MAX_REGEX; i++) {
 385                                         char *p;
 386                                         char buffer[sizeof(check_item->strvalue)];
 387
 388                                         /*
 389                                          *      Didn't match: delete old
 390                                          *      match, if it existed.
 391                                          */
 392                                         if ((compare != 0) ||
 393                                             (rxmatch[i].rm_so == -1)) {
 394                                                 p = request_data_get(req, req,
 395                                                                      REQUEST_DATA_REGEX | i);
 396                                                 if (p) {
 397                                                         free(p);
 398                                                         continue;
 399                                                 }
 400
 401                                                 /*
 402                                                  *      No previous match
 403                                                  *      to delete, stop.
 404                                                  */
 405                                                 break;
 406                                         }
 407
 408                                         /*
 409                                          *      Copy substring into buffer.
 410                                          */
 411                                         memcpy(buffer,
 412                                                auth_item->strvalue + rxmatch[i].rm_so,
 413                                                rxmatch[i].rm_eo - rxmatch[i].rm_so);
 414                                         buffer[rxmatch[i].rm_eo - rxmatch[i].rm_so] = '\0';
 415
 416                                         /*
 417                                          *      Copy substring, and add it to
 418                                          *      the request.
 419                                          *
 420                                          *      Note that we don't check
 421                                          *      for out of memory, which is
 422                                          *      the only error we can get...
 423                                          */
 424                                         p = strdup(buffer);
 425                                         request_data_add(req,
 426                                                          req,
 427                                                          REQUEST_DATA_REGEX | i,
 428                                                          p, free);
 429                                 }
 430                         }
 431                                 if (compare != 0) result = -1;
 432                                 break;
 433
 434                         case T_OP_REG_NE:
 435                                 regcomp(&reg, (char *)check_item->strvalue, REG_EXTENDED|REG_NOSUB);
 436                                 compare = regexec(&reg, (char *)auth_item->strvalue,
 437                                                 0, NULL, 0);
 438                                 regfree(&reg);
 439                                 if (compare == 0) result = -1;
 440                                 break;
 441 #endif
 442
 443                 } /* switch over the operator of the check item */
 444
 445                 /*
 446                  *      This attribute didn't match, but maybe there's
 447                  *      another of the same attribute, which DOES match.
 448                  */
 449                 if (result != 0) {
 450                         auth_item = auth_item->next;
 451                         result = 0;
 452                         goto try_again;
 453                 }
 454
 455         } /* for every entry in the check item list */
 456
 457         return 0;               /* it matched */
 458 }
 459
 460 /*
 461  *      Compare two attributes simply.  Calls paircompare.
 462  */
 463
 464 int simplepaircmp(REQUEST *req, VALUE_PAIR *first, VALUE_PAIR *second)
 465 {
 466         return paircompare( req, first, second, NULL, NULL );
 467 }
 468
 469
 470 /*
 471  *      Move pairs, replacing/over-writing them, and doing xlat.
 472  */
 473 /*
 474  *      Move attributes from one list to the other
 475  *      if not already present.
 476  */
 477 void pairxlatmove(REQUEST *req, VALUE_PAIR **to, VALUE_PAIR **from)
 478 {
 479         VALUE_PAIR **tailto, *i, *j, *next;
 480         VALUE_PAIR *tailfrom = NULL;
 481         VALUE_PAIR *found;
 482
 483         /*
 484          *      Point "tailto" to the end of the "to" list.
 485          */
 486         tailto = to;
 487         for(i = *to; i; i = i->next) {
 488                 tailto = &i->next;
 489         }
 490
 491         /*
 492          *      Loop over the "from" list.
 493          */
 494         for(i = *from; i; i = next) {
 495                 next = i->next;
 496
 497                 /*
 498                  *      Don't move 'fallthrough' over.
 499                  */
 500                 if (i->attribute == PW_FALL_THROUGH) {
 501                         continue;
 502                 }
 503
 504                 /*
 505                  *      We've got to xlat the string before moving
 506                  *      it over.
 507                  */
 508                 if (i->flags.do_xlat) {
 509                         int rcode;
 510                         char buffer[sizeof(i->strvalue)];
 511
 512                         i->flags.do_xlat = 0;
 513                         rcode = radius_xlat(buffer, sizeof(buffer),
 514                                             i->strvalue,
 515                                             req, NULL);
 516
 517                         /*
 518                          *      Parse the string into a new value.
 519                          */
 520                         pairparsevalue(i, buffer);
 521                 }
 522
 523                 found = pairfind(*to, i->attribute);
 524                 switch (i->operator) {
 525
 526                         /*
 527                          *  If a similar attribute is found,
 528                          *  delete it.
 529                          */
 530                 case T_OP_SUB:          /* -= */
 531                         if (found) {
 532                                 if (!i->strvalue[0] ||
 533                                     (strcmp((char *)found->strvalue,
 534                                             (char *)i->strvalue) == 0)){
 535                                         pairdelete(to, found->attribute);
 536
 537                                         /*
 538                                          *      'tailto' may have been
 539                                          *      deleted...
 540                                          */
 541                                         tailto = to;
 542                                         for(j = *to; j; j = j->next) {
 543                                                 tailto = &j->next;
 544                                         }
 545                                 }
 546                         }
 547                         tailfrom = i;
 548                         continue;
 549                         break;
 550
 551                         /*
 552                          *  Add it, if it's not already there.
 553                          */
 554                 case T_OP_EQ:           /* = */
 555                         if (found) {
 556                                 tailfrom = i;
 557                                 continue; /* with the loop */
 558                         }
 559                         break;
 560
 561                         /*
 562                          *  If a similar attribute is found,
 563                          *  replace it with the new one.  Otherwise,
 564                          *  add the new one to the list.
 565                          */
 566                 case T_OP_SET:          /* := */
 567                         if (found) {
 568                                 VALUE_PAIR *vp;
 569
 570                                 vp = found->next;
 571                                 memcpy(found, i, sizeof(*found));
 572                                 found->next = vp;
 573                                 continue;
 574                         }
 575                         break;
 576
 577                         /*
 578                          *  FIXME: Add support for <=, >=, <, >
 579                          *
 580                          *  which will mean (for integers)
 581                          *  'make the attribute the smaller, etc'
 582                          */
 583
 584                         /*
 585                          *  Add the new element to the list, even
 586                          *  if similar ones already exist.
 587                          */
 588                 default:
 589                 case T_OP_ADD:          /* += */
 590                         break;
 591                 }
 592
 593                 if (tailfrom)
 594                         tailfrom->next = next;
 595                 else
 596                         *from = next;
 597
 598                 /*
 599                  *      If ALL of the 'to' attributes have been deleted,
 600                  *      then ensure that the 'tail' is updated to point
 601                  *      to the head.
 602                  */
 603                 if (!*to) {
 604                         tailto = to;
 605                 }
 606                 *tailto = i;
 607                 if (i) {
 608                         i->next = NULL;
 609                         tailto = &i->next;
 610                 }
 611         } /* loop over the 'from' list */
 612 }