src/modules/rlm_attr_filter/rlm_attr_filter.c

   1 /*
   2  * rlm_attr_filter.c  - Filter A/V Pairs received back from proxy reqs
   3  *                      before sending reply to the NAS/Server that sent
   4  *                      it to us.
   5  *
   6  * Version:      $Id$
   7  *
   8  *   This program is is free software; you can redistribute it and/or modify
   9  *   it under the terms of the GNU General Public License, version 2 if the
  10  *   License as published by the Free Software Foundation.
  11  *
  12  *   This program is distributed in the hope that it will be useful,
  13  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  *   GNU General Public License for more details.
  16  *
  17  *   You should have received a copy of the GNU General Public License
  18  *   along with this program; if not, write to the Free Software
  19  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  20  *
  21  * Copyright (C) 2001,2006 The FreeRADIUS server project
  22  * Copyright (C) 2001 Chris Parker <cparker@starnetusa.net>
  23  */
  24
  25 #include        <freeradius-devel/ident.h>
  26 RCSID("$Id$")
  27
  28 #include        <freeradius-devel/autoconf.h>
  29
  30 #include        <sys/stat.h>
  31
  32 #include        <stdlib.h>
  33 #include        <string.h>
  34 #include        <netdb.h>
  35 #include        <ctype.h>
  36 #include        <fcntl.h>
  37 #include        <limits.h>
  38
  39 #include        <freeradius-devel/radiusd.h>
  40 #include        <freeradius-devel/rad_assert.h>
  41 #include        <freeradius-devel/modules.h>
  42
  43 /*
  44  *      Define a structure with the module configuration, so it can
  45  *      be used as the instance handle.
  46  */
  47 struct attr_filter_instance {
  48         char *attrsfile;
  49         char *key;
  50         PAIR_LIST *attrs;
  51 };
  52
  53 static const CONF_PARSER module_config[] = {
  54         { "attrsfile",     PW_TYPE_FILENAME,
  55           offsetof(struct attr_filter_instance,attrsfile), NULL, "${raddbdir}/attrs" },
  56         { "key",     PW_TYPE_STRING_PTR,
  57           offsetof(struct attr_filter_instance,key), NULL, "%{Realm}" },
  58         { NULL, -1, 0, NULL, NULL }
  59 };
  60
  61 static void check_pair(VALUE_PAIR *check_item, VALUE_PAIR *reply_item,
  62                       int *pass, int *fail)
  63 {
  64         int compare;
  65
  66         if (check_item->operator == T_OP_SET) return;
  67
  68         compare = paircmp(check_item, reply_item);
  69         if (compare == 1) {
  70                 ++*(pass);
  71         } else {
  72                 ++*(fail);
  73         }
  74
  75         return;
  76 }
  77
  78 /*
  79  *      Copy the specified attribute to the specified list
  80  */
  81 static int mypairappend(VALUE_PAIR *item, VALUE_PAIR **to)
  82 {
  83         VALUE_PAIR *tmp;
  84         tmp = paircreate(item->attribute, item->type);
  85         if (!tmp) {
  86                 radlog(L_ERR|L_CONS, "no memory");
  87                 return -1;
  88         }
  89
  90         /*
  91          *      Copy EVERYTHING.
  92          */
  93         memcpy(tmp, item, sizeof(*tmp));
  94         tmp->next = NULL;
  95         *to = tmp;
  96
  97         return 0;
  98 }
  99
 100 static int getattrsfile(const char *filename, PAIR_LIST **pair_list)
 101 {
 102         int rcode;
 103         PAIR_LIST *attrs = NULL;
 104         PAIR_LIST *entry;
 105         VALUE_PAIR *vp;
 106
 107         rcode = pairlist_read(filename, &attrs, 1);
 108         if (rcode < 0) {
 109                 return -1;
 110         }
 111
 112         /*
 113          * Walk through the 'attrs' file list.
 114          */
 115
 116         entry = attrs;
 117         while (entry) {
 118
 119                 entry->check = entry->reply;
 120                 entry->reply = NULL;
 121
 122                 for (vp = entry->check; vp != NULL; vp = vp->next) {
 123
 124                     /*
 125                      * If it's NOT a vendor attribute,
 126                      * and it's NOT a wire protocol
 127                      * and we ignore Fall-Through,
 128                      * then bitch about it, giving a good warning message.
 129                      */
 130                     if (!(vp->attribute & ~0xffff) &&
 131                          (vp->attribute > 0xff) &&
 132                          (vp->attribute > 1000)) {
 133                         log_debug("[%s]:%d WARNING! Check item \"%s\"\n"
 134                                   "\tfound in filter list for realm \"%s\".\n",
 135                                   filename, entry->lineno, vp->name,
 136                                   entry->name);
 137                     }
 138                 }
 139
 140                 entry = entry->next;
 141         }
 142
 143         *pair_list = attrs;
 144         return 0;
 145 }
 146
 147
 148 /*
 149  *      Clean up.
 150  */
 151 static int attr_filter_detach(void *instance)
 152 {
 153         struct attr_filter_instance *inst = instance;
 154         pairlist_free(&inst->attrs);
 155         free(inst->attrsfile);
 156         free(inst->key);
 157         free(inst);
 158         return 0;
 159 }
 160
 161
 162 /*
 163  *      (Re-)read the "attrs" file into memory.
 164  */
 165 static int attr_filter_instantiate(CONF_SECTION *conf, void **instance)
 166 {
 167         struct attr_filter_instance *inst;
 168         int rcode;
 169
 170         inst = rad_malloc(sizeof *inst);
 171         if (!inst) {
 172                 return -1;
 173         }
 174         memset(inst, 0, sizeof(*inst));
 175
 176         if (cf_section_parse(conf, inst, module_config) < 0) {
 177                 attr_filter_detach(inst);
 178                 return -1;
 179         }
 180
 181         rcode = getattrsfile(inst->attrsfile, &inst->attrs);
 182         if (rcode != 0) {
 183                 radlog(L_ERR|L_CONS, "Errors reading %s", inst->attrsfile);
 184                 attr_filter_detach(inst);
 185                 return -1;
 186         }
 187         *instance = inst;
 188         return 0;
 189 }
 190
 191
 192 /*
 193  *      Common attr_filter checks
 194  */
 195 static int attr_filter_common(void *instance, REQUEST *request,
 196                               VALUE_PAIR **input)
 197 {
 198         struct attr_filter_instance *inst = instance;
 199         VALUE_PAIR      *vp;
 200         VALUE_PAIR      *output = NULL;
 201         VALUE_PAIR      **output_tail;
 202         VALUE_PAIR      *check_item;
 203         PAIR_LIST       *pl;
 204         int             found = 0;
 205         int             pass, fail = 0;
 206         char            *keyname = NULL;
 207         char            buffer[256];
 208
 209         if (!inst->key) {
 210                 VALUE_PAIR      *namepair;
 211
 212                 namepair = pairfind(request->packet->vps, PW_REALM);
 213                 if (!namepair) {
 214                         return (RLM_MODULE_NOOP);
 215                 }
 216                 keyname = namepair->vp_strvalue;
 217         } else {
 218                 int len;
 219
 220                 len = radius_xlat(buffer, sizeof(buffer), inst->key,
 221                                   request, NULL);
 222                 if (!len) {
 223                         return RLM_MODULE_NOOP;
 224                 }
 225                 keyname = buffer;
 226         }
 227
 228         output_tail = &output;
 229
 230         /*
 231          *      Find the attr_filter profile entry for the entry.
 232          */
 233         for (pl = inst->attrs; pl; pl = pl->next) {
 234                 int fall_through = 0;
 235
 236                 /*
 237                  *  If the current entry is NOT a default,
 238                  *  AND the realm does NOT match the current entry,
 239                  *  then skip to the next entry.
 240                  */
 241                 if ((strcmp(pl->name, "DEFAULT") != 0) &&
 242                     (strcmp(keyname, pl->name) != 0))  {
 243                     continue;
 244                 }
 245
 246                 DEBUG2(" attr_filter: Matched entry %s at line %d", pl->name,
 247                        pl->lineno);
 248                 found = 1;
 249
 250                 for (check_item = pl->check;
 251                      check_item != NULL;
 252                      check_item = check_item->next) {
 253                         if (check_item->attribute == PW_FALL_THROUGH) {
 254                                 fall_through = 1;
 255                                 continue;
 256                         }
 257
 258                         /*
 259                          *    If it is a SET operator, add the attribute to
 260                          *    the output list without checking it.
 261                          */
 262                         if (check_item->operator == T_OP_SET ) {
 263                                 if (mypairappend(check_item, output_tail) < 0) {
 264                                         pairfree(&output);
 265                                         return RLM_MODULE_FAIL;
 266                                 }
 267                                 output_tail = &((*output_tail)->next);
 268                         }
 269                 }
 270
 271                 /*
 272                  *      Iterate through the input items, comparing
 273                  *      each item to every rule, then moving it to the
 274                  *      output list only if it matches all rules
 275                  *      for that attribute.  IE, Idle-Timeout is moved
 276                  *      only if it matches all rules that describe an
 277                  *      Idle-Timeout.
 278                  */
 279                 for (vp = *input; vp != NULL; vp = vp->next ) {
 280                         /* reset the pass,fail vars for each reply item */
 281                         pass = fail = 0;
 282
 283                         /*
 284                          *      reset the check_item pointer to
 285                          *      beginning of the list
 286                          */
 287                         for (check_item = pl->check;
 288                              check_item != NULL;
 289                              check_item = check_item->next) {
 290                                 /*
 291                                  *      Vendor-Specific is special, and
 292                                  *      matches any VSA if the comparison
 293                                  *      is always true.
 294                                  */
 295                                 if ((check_item->attribute == PW_VENDOR_SPECIFIC) &&
 296                                     (VENDOR(vp->attribute) != 0) &&
 297                                     (check_item->operator == T_OP_CMP_TRUE)) {
 298                                         pass++;
 299                                         continue;
 300                                 }
 301
 302                                 if (vp->attribute == check_item->attribute) {
 303                                         check_pair(check_item, vp,
 304                                                    &pass, &fail);
 305                                 }
 306                         }
 307
 308                         /* only move attribute if it passed all rules */
 309                         if (fail == 0 && pass > 0) {
 310                                 if (mypairappend(vp, output_tail) < 0) {
 311                                         pairfree(&output);
 312                                         return RLM_MODULE_FAIL;
 313                                 }
 314                                 output_tail = &((*output_tail)->next);
 315                         }
 316                 }
 317
 318                 /* If we shouldn't fall through, break */
 319                 if (!fall_through)
 320                         break;
 321         }
 322
 323         /*
 324          *      No entry matched.  We didn't do anything.
 325          */
 326         if (!found) {
 327                 rad_assert(output == NULL);
 328                 return RLM_MODULE_NOOP;
 329         }
 330
 331         pairfree(input);
 332         *input = output;
 333
 334         return RLM_MODULE_UPDATED;
 335 }
 336
 337 static int attr_filter_accounting(void *instance, REQUEST *request)
 338 {
 339         return attr_filter_common(instance, request, &request->packet->vps);
 340 }
 341
 342 static int attr_filter_preproxy(void *instance, REQUEST *request)
 343 {
 344         return attr_filter_common(instance, request, &request->proxy->vps);
 345 }
 346
 347 static int attr_filter_postproxy(void *instance, REQUEST *request)
 348 {
 349         return attr_filter_common(instance, request, &request->proxy_reply->vps);
 350 }
 351
 352 static int attr_filter_postauth(void *instance, REQUEST *request)
 353 {
 354         return attr_filter_common(instance, request, &request->reply->vps);
 355 }
 356
 357
 358 /* globally exported name */
 359 module_t rlm_attr_filter = {
 360         RLM_MODULE_INIT,
 361         "attr_filter",
 362         0,                              /* type: reserved */
 363         attr_filter_instantiate,        /* instantiation */
 364         attr_filter_detach,             /* detach */
 365         {
 366                 NULL,                   /* authentication */
 367                 NULL,                   /* authorization */
 368                 NULL,                   /* preaccounting */
 369                 attr_filter_accounting, /* accounting */
 370                 NULL,                   /* checksimul */
 371                 attr_filter_preproxy,   /* pre-proxy */
 372                 attr_filter_postproxy,  /* post-proxy */
 373                 attr_filter_postauth    /* post-auth */
 374         },
 375 };
 376