src/modules/rlm_attr_filter/rlm_attr_filter.c

   1 /*
   2  * rlm_attr_filter.c  - Filter A/V Pairs received back from proxy reqs
   3  *                      before sending reply to the NAS/Server that sent
   4  *                      it to us.
   5  *
   6  * Version:      $Id$
   7  *
   8  *   This program is is free software; you can redistribute it and/or modify
   9  *   it under the terms of the GNU General Public License, version 2 if the
  10  *   License as published by the Free Software Foundation.
  11  *
  12  *   This program is distributed in the hope that it will be useful,
  13  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  *   GNU General Public License for more details.
  16  *
  17  *   You should have received a copy of the GNU General Public License
  18  *   along with this program; if not, write to the Free Software
  19  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  20  *
  21  * Copyright (C) 2001,2006 The FreeRADIUS server project
  22  * Copyright (C) 2001 Chris Parker <cparker@starnetusa.net>
  23  */
  24
  25 #include        <freeradius-devel/ident.h>
  26 RCSID("$Id$")
  27
  28 #include        <freeradius-devel/autoconf.h>
  29
  30 #include        <sys/stat.h>
  31
  32 #include        <stdlib.h>
  33 #include        <string.h>
  34 #include        <netdb.h>
  35 #include        <ctype.h>
  36 #include        <fcntl.h>
  37 #include        <limits.h>
  38
  39 #include        <freeradius-devel/radiusd.h>
  40 #include        <freeradius-devel/rad_assert.h>
  41 #include        <freeradius-devel/modules.h>
  42
  43 /*
  44  *      Define a structure with the module configuration, so it can
  45  *      be used as the instance handle.
  46  */
  47 struct attr_filter_instance {
  48         char *attrsfile;
  49         PAIR_LIST *attrs;
  50 };
  51
  52 static const CONF_PARSER module_config[] = {
  53         { "attrsfile",     PW_TYPE_FILENAME,
  54           offsetof(struct attr_filter_instance,attrsfile), NULL, "${raddbdir}/attrs" },
  55         { NULL, -1, 0, NULL, NULL }
  56 };
  57
  58 static void check_pair(VALUE_PAIR *check_item, VALUE_PAIR *reply_item,
  59                       int *pass, int *fail)
  60 {
  61         int compare;
  62
  63         if (check_item->operator == T_OP_SET) return;
  64
  65         compare = paircmp(check_item, reply_item);
  66         if (compare == 1) {
  67                 ++*(pass);
  68         } else {
  69                 ++*(fail);
  70         }
  71
  72         return;
  73 }
  74
  75 /*
  76  *      Copy the specified attribute to the specified list
  77  */
  78 static int mypairappend(VALUE_PAIR *item, VALUE_PAIR **to)
  79 {
  80         VALUE_PAIR *tmp;
  81         tmp = paircreate(item->attribute, item->type);
  82         if (!tmp) {
  83                 radlog(L_ERR|L_CONS, "no memory");
  84                 return -1;
  85         }
  86
  87         /*
  88          *      Copy EVERYTHING.
  89          */
  90         memcpy(tmp, item, sizeof(*tmp));
  91         tmp->next = NULL;
  92         *to = tmp;
  93
  94         return 0;
  95 }
  96
  97 static int getattrsfile(const char *filename, PAIR_LIST **pair_list)
  98 {
  99         int rcode;
 100         PAIR_LIST *attrs = NULL;
 101         PAIR_LIST *entry;
 102         VALUE_PAIR *vp;
 103
 104         rcode = pairlist_read(filename, &attrs, 1);
 105         if (rcode < 0) {
 106                 return -1;
 107         }
 108
 109         /*
 110          * Walk through the 'attrs' file list.
 111          */
 112
 113         entry = attrs;
 114         while (entry) {
 115
 116                 entry->check = entry->reply;
 117                 entry->reply = NULL;
 118
 119                 for (vp = entry->check; vp != NULL; vp = vp->next) {
 120
 121                     /*
 122                      * If it's NOT a vendor attribute,
 123                      * and it's NOT a wire protocol
 124                      * and we ignore Fall-Through,
 125                      * then bitch about it, giving a good warning message.
 126                      */
 127                     if (!(vp->attribute & ~0xffff) &&
 128                          (vp->attribute > 0xff) &&
 129                          (vp->attribute > 1000)) {
 130                         log_debug("[%s]:%d WARNING! Check item \"%s\"\n"
 131                                   "\tfound in filter list for realm \"%s\".\n",
 132                                   filename, entry->lineno, vp->name,
 133                                   entry->name);
 134                     }
 135                 }
 136
 137                 entry = entry->next;
 138         }
 139
 140         *pair_list = attrs;
 141         return 0;
 142 }
 143
 144
 145 /*
 146  *      Clean up.
 147  */
 148 static int attr_filter_detach(void *instance)
 149 {
 150         struct attr_filter_instance *inst = instance;
 151         pairlist_free(&inst->attrs);
 152         free(inst->attrsfile);
 153         free(inst);
 154         return 0;
 155 }
 156
 157
 158 /*
 159  *      (Re-)read the "attrs" file into memory.
 160  */
 161 static int attr_filter_instantiate(CONF_SECTION *conf, void **instance)
 162 {
 163         struct attr_filter_instance *inst;
 164         int rcode;
 165
 166         inst = rad_malloc(sizeof *inst);
 167         if (!inst) {
 168                 return -1;
 169         }
 170         memset(inst, 0, sizeof(*inst));
 171
 172         if (cf_section_parse(conf, inst, module_config) < 0) {
 173                 attr_filter_detach(inst);
 174                 return -1;
 175         }
 176
 177         rcode = getattrsfile(inst->attrsfile, &inst->attrs);
 178         if (rcode != 0) {
 179                 radlog(L_ERR|L_CONS, "Errors reading %s", inst->attrsfile);
 180                 attr_filter_detach(inst);
 181                 return -1;
 182         }
 183         *instance = inst;
 184         return 0;
 185 }
 186
 187
 188 /*
 189  *      Common attr_filter checks
 190  */
 191 static int attr_filter_common(void *instance, REQUEST *request,
 192                               VALUE_PAIR **input)
 193 {
 194         struct attr_filter_instance *inst = instance;
 195         VALUE_PAIR      *vp;
 196         VALUE_PAIR      *output = NULL;
 197         VALUE_PAIR      **output_tail;
 198         VALUE_PAIR      *check_item;
 199         PAIR_LIST       *pl;
 200         int             found = 0;
 201         int             pass, fail = 0;
 202         VALUE_PAIR      *realmpair;
 203         char            *realmname = NULL;
 204
 205         /*
 206          *      Get the realm.  Can't use request->config_items as
 207          *      that gets freed by rad_authenticate....  use the one
 208          *      set in the original request vps
 209          */
 210         realmpair = pairfind(request->packet->vps, PW_REALM);
 211         if (!realmpair) {
 212                 /* If there is no realm...NOOP */
 213                 return (RLM_MODULE_NOOP);
 214         }
 215         realmname = realmpair->vp_strvalue;
 216
 217         output_tail = &output;
 218
 219         /*
 220          *      Find the attr_filter profile entry for the realm.
 221          */
 222         for (pl = inst->attrs; pl; pl = pl->next) {
 223                 int fall_through = 0;
 224
 225                 /*
 226                  *  If the current entry is NOT a default,
 227                  *  AND the realm does NOT match the current entry,
 228                  *  then skip to the next entry.
 229                  */
 230                 if ((strcmp(pl->name, "DEFAULT") != 0) &&
 231                     (strcmp(realmname, pl->name) != 0))  {
 232                     continue;
 233                 }
 234
 235                 DEBUG2(" attr_filter: Matched entry %s at line %d", pl->name,
 236                        pl->lineno);
 237                 found = 1;
 238
 239                 for (check_item = pl->check;
 240                      check_item != NULL;
 241                      check_item = check_item->next) {
 242                         if (check_item->attribute == PW_FALL_THROUGH) {
 243                                 fall_through = 1;
 244                                 continue;
 245                         }
 246
 247                         /*
 248                          *    If it is a SET operator, add the attribute to
 249                          *    the output list without checking it.
 250                          */
 251                         if (check_item->operator == T_OP_SET ) {
 252                                 if (mypairappend(check_item, output_tail) < 0) {
 253                                         pairfree(&output);
 254                                         return RLM_MODULE_FAIL;
 255                                 }
 256                                 output_tail = &((*output_tail)->next);
 257                         }
 258                 }
 259
 260                 /*
 261                  *      Iterate through the input items, comparing
 262                  *      each item to every rule, then moving it to the
 263                  *      output list only if it matches all rules
 264                  *      for that attribute.  IE, Idle-Timeout is moved
 265                  *      only if it matches all rules that describe an
 266                  *      Idle-Timeout.
 267                  */
 268                 for (vp = *input; vp != NULL; vp = vp->next ) {
 269                         /* reset the pass,fail vars for each reply item */
 270                         pass = fail = 0;
 271
 272                         /*
 273                          *      reset the check_item pointer to
 274                          *      beginning of the list
 275                          */
 276                         for (check_item = pl->check;
 277                              check_item != NULL;
 278                              check_item = check_item->next) {
 279                                 if (vp->attribute == check_item->attribute) {
 280                                         check_pair(check_item, vp,
 281                                                    &pass, &fail);
 282                                 }
 283                         }
 284
 285                         /* only move attribute if it passed all rules */
 286                         if (fail == 0 && pass > 0) {
 287                                 if (mypairappend(vp, output_tail) < 0) {
 288                                         pairfree(&output);
 289                                         return RLM_MODULE_FAIL;
 290                                 }
 291                                 output_tail = &((*output_tail)->next);
 292                         }
 293                 }
 294
 295                 /* If we shouldn't fall through, break */
 296                 if (!fall_through)
 297                         break;
 298         }
 299
 300         /*
 301          *      No entry matched.  We didn't do anything.
 302          */
 303         if (!found) {
 304                 rad_assert(output == NULL);
 305                 return RLM_MODULE_NOOP;
 306         }
 307
 308         pairfree(input);
 309         *input = output;
 310
 311         return RLM_MODULE_UPDATED;
 312 }
 313
 314 static int attr_filter_accounting(void *instance, REQUEST *request)
 315 {
 316         return attr_filter_common(instance, request, &request->packet->vps);
 317 }
 318
 319 static int attr_filter_preproxy(void *instance, REQUEST *request)
 320 {
 321         return attr_filter_common(instance, request, &request->proxy->vps);
 322 }
 323
 324 static int attr_filter_postproxy(void *instance, REQUEST *request)
 325 {
 326         return attr_filter_common(instance, request, &request->proxy_reply->vps);
 327 }
 328
 329 static int attr_filter_postauth(void *instance, REQUEST *request)
 330 {
 331         return attr_filter_common(instance, request, &request->reply->vps);
 332 }
 333
 334
 335 /* globally exported name */
 336 module_t rlm_attr_filter = {
 337         RLM_MODULE_INIT,
 338         "attr_filter",
 339         0,                              /* type: reserved */
 340         attr_filter_instantiate,        /* instantiation */
 341         attr_filter_detach,             /* detach */
 342         {
 343                 NULL,                   /* authentication */
 344                 NULL,                   /* authorization */
 345                 NULL,                   /* preaccounting */
 346                 attr_filter_accounting, /* accounting */
 347                 NULL,                   /* checksimul */
 348                 attr_filter_preproxy,   /* pre-proxy */
 349                 attr_filter_postproxy,  /* post-proxy */
 350                 attr_filter_postauth    /* post-auth */
 351         },
 352 };
 353