src/modules/rlm_attr_rewrite/rlm_attr_rewrite.c

   1 /*
   2  * rlm_attr_rewrite.c
   3  *
   4  * Version:  $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  * Copyright 2002,2006  The FreeRADIUS server project
  21  * Copyright 2002  Kostas Kalevras <kkalev@noc.ntua.gr>
  22  */
  23
  24 #include <freeradius-devel/ident.h>
  25 RCSID("$Id$")
  26
  27 #include <freeradius-devel/radiusd.h>
  28 #include <freeradius-devel/modules.h>
  29
  30 #ifdef HAVE_REGEX_H
  31 #       include <regex.h>
  32 #endif
  33
  34 #define RLM_REGEX_INPACKET 0
  35 #define RLM_REGEX_INCONFIG 1
  36 #define RLM_REGEX_INREPLY  2
  37 #define RLM_REGEX_INPROXY 3
  38 #define RLM_REGEX_INPROXYREPLY 4
  39
  40 typedef struct rlm_attr_rewrite_t {
  41         char *attribute;        /* The attribute to search for */
  42         DICT_ATTR *da;          /* The attribute definition */
  43         char *search;           /* The pattern to search for */
  44         int search_len;         /* The length of the search pattern */
  45         char *searchin_str;     /* The VALUE_PAIR list to search in. Can be either packet,reply,proxy,proxy_reply or control (plus it's alias 'config') */
  46         char searchin;          /* The same as above just coded as a number for speed */
  47         char *replace;          /* The replacement */
  48         int replace_len;        /* The length of the replacement string */
  49         int  append;            /* Switch to control append mode (1,0) */
  50         int  nocase;            /* Ignore case */
  51         int  new_attr;          /* Boolean. Do we create a new attribute or not? */
  52         int  num_matches;       /* Maximum number of matches */
  53         const char *name;       /* The module name */
  54 } rlm_attr_rewrite_t;
  55
  56 static const CONF_PARSER module_config[] = {
  57   { "attribute", PW_TYPE_STRING_PTR, offsetof(rlm_attr_rewrite_t,attribute), NULL, NULL },
  58   { "searchfor", PW_TYPE_STRING_PTR, offsetof(rlm_attr_rewrite_t,search), NULL, NULL },
  59   { "searchin",  PW_TYPE_STRING_PTR, offsetof(rlm_attr_rewrite_t,searchin_str), NULL, "packet" },
  60   { "replacewith", PW_TYPE_STRING_PTR, offsetof(rlm_attr_rewrite_t,replace), NULL, NULL },
  61   { "append", PW_TYPE_BOOLEAN, offsetof(rlm_attr_rewrite_t,append),NULL, "no" },
  62   { "ignore_case", PW_TYPE_BOOLEAN, offsetof(rlm_attr_rewrite_t,nocase), NULL, "yes" },
  63   { "new_attribute", PW_TYPE_BOOLEAN, offsetof(rlm_attr_rewrite_t,new_attr), NULL, "no" },
  64   { "max_matches", PW_TYPE_INTEGER, offsetof(rlm_attr_rewrite_t,num_matches), NULL, "10" },
  65   { NULL, -1, 0, NULL, NULL }
  66 };
  67
  68 static int attr_rewrite_instantiate(CONF_SECTION *conf, void **instance)
  69 {
  70         rlm_attr_rewrite_t *data;
  71         DICT_ATTR *dattr;
  72
  73         /*
  74          *      Set up a storage area for instance data
  75          */
  76         data = rad_malloc(sizeof(*data));
  77         if (!data) {
  78                 return -1;
  79         }
  80         memset(data, 0, sizeof(*data));
  81
  82         /*
  83          *      If the configuration parameters can't be parsed, then
  84          *      fail.
  85          */
  86         if (cf_section_parse(conf, data, module_config) < 0) {
  87                 free(data);
  88                 return -1;
  89         }
  90
  91         /*
  92          *      Discover the attribute number of the key.
  93          */
  94         if (data->attribute == NULL) {
  95                 radlog(L_ERR, "rlm_attr_rewrite: 'attribute' must be set.");
  96                 return -1;
  97         }
  98         if (data->search == NULL || data->replace == NULL) {
  99                 radlog(L_ERR, "rlm_attr_rewrite: search/replace strings must be set.");
 100                 return -1;
 101         }
 102         data->search_len = strlen(data->search);
 103         data->replace_len = strlen(data->replace);
 104
 105         if (data->replace_len == 0 && data->new_attr){
 106                 radlog(L_ERR, "rlm_attr_rewrite: replace string must not be zero length in order to create new attribute.");
 107                 return -1;
 108         }
 109
 110         if (data->num_matches < 1 || data->num_matches > MAX_STRING_LEN) {
 111                 radlog(L_ERR, "rlm_attr_rewrite: Illegal range for match number.");
 112                 return -1;
 113         }
 114         if (data->searchin_str == NULL) {
 115                 radlog(L_ERR, "rlm_attr_rewrite: Illegal searchin directive given. Assuming packet.");
 116                 data->searchin = RLM_REGEX_INPACKET;
 117         }
 118         else{
 119                 if (strcmp(data->searchin_str, "packet") == 0)
 120                         data->searchin = RLM_REGEX_INPACKET;
 121                 else if (strcmp(data->searchin_str, "config") == 0)
 122                         data->searchin = RLM_REGEX_INCONFIG;
 123                 else if (strcmp(data->searchin_str, "control") == 0)
 124                         data->searchin = RLM_REGEX_INCONFIG;
 125                 else if (strcmp(data->searchin_str, "reply") == 0)
 126                         data->searchin = RLM_REGEX_INREPLY;
 127 #ifdef WITH_PROXY
 128                 else if (strcmp(data->searchin_str, "proxy") == 0)
 129                         data->searchin = RLM_REGEX_INPROXY;
 130                 else if (strcmp(data->searchin_str, "proxy_reply") == 0)
 131                         data->searchin = RLM_REGEX_INPROXYREPLY;
 132 #endif
 133                 else {
 134                         radlog(L_ERR, "rlm_attr_rewrite: Illegal searchin directive given. Assuming packet.");
 135                         data->searchin = RLM_REGEX_INPACKET;
 136                 }
 137         }
 138         dattr = dict_attrbyname(data->attribute);
 139         if (dattr == NULL) {
 140                 radlog(L_ERR, "rlm_attr_rewrite: No such attribute %s",
 141                                 data->attribute);
 142                 return -1;
 143         }
 144         data->da = dattr;
 145         /* Add the module instance name */
 146         data->name = cf_section_name2(conf); /* may be NULL */
 147
 148         *instance = data;
 149
 150         return 0;
 151 }
 152
 153 static int do_attr_rewrite(void *instance, REQUEST *request)
 154 {
 155         rlm_attr_rewrite_t *data = (rlm_attr_rewrite_t *) instance;
 156         int ret = RLM_MODULE_NOOP;
 157         VALUE_PAIR *attr_vp = NULL;
 158         VALUE_PAIR *tmp = NULL;
 159         regex_t preg;
 160         regmatch_t pmatch[9];
 161         int cflags = 0;
 162         int err = 0;
 163         char done_xlat = 0;
 164         unsigned int len = 0;
 165         char err_msg[MAX_STRING_LEN];
 166         unsigned int i = 0;
 167         unsigned int j = 0;
 168         unsigned int counter = 0;
 169         char new_str[MAX_STRING_LEN];
 170         char *ptr, *ptr2;
 171         char search_STR[MAX_STRING_LEN];
 172         char replace_STR[MAX_STRING_LEN];
 173
 174         if ((attr_vp = pairfind(request->config_items, PW_REWRITE_RULE, 0)) != NULL){
 175                 if (data->name == NULL || strcmp(data->name,attr_vp->vp_strvalue))
 176                         return RLM_MODULE_NOOP;
 177         }
 178
 179         if (data->new_attr){
 180                 /* new_attribute = yes */
 181                 if (!radius_xlat(replace_STR, sizeof(replace_STR), data->replace, request, NULL)) {
 182                         DEBUG2("%s: xlat on replace string failed.", data->name);
 183                         return ret;
 184                 }
 185                 attr_vp = pairmake(data->attribute,replace_STR,0);
 186                 if (attr_vp == NULL){
 187                         DEBUG2("%s: Could not add new attribute %s with value '%s'", data->name,
 188                                 data->attribute,replace_STR);
 189                         return ret;
 190                 }
 191                 switch(data->searchin){
 192                         case RLM_REGEX_INPACKET:
 193                                 pairadd(&request->packet->vps,attr_vp);
 194                                 break;
 195                         case RLM_REGEX_INCONFIG:
 196                                 pairadd(&request->config_items,attr_vp);
 197                                 break;
 198                         case RLM_REGEX_INREPLY:
 199                                 pairadd(&request->reply->vps,attr_vp);
 200                                 break;
 201 #ifdef WITH_PROXY
 202                         case RLM_REGEX_INPROXY:
 203                                 if (!request->proxy) {
 204                                         pairbasicfree(attr_vp);
 205                                         return RLM_MODULE_NOOP;
 206                                 }
 207                                 pairadd(&request->proxy->vps, attr_vp);
 208                                 break;
 209                         case RLM_REGEX_INPROXYREPLY:
 210                                 if (!request->proxy_reply) {
 211                                         pairbasicfree(attr_vp);
 212                                         return RLM_MODULE_NOOP;
 213                                 }
 214                                 pairadd(&request->proxy_reply->vps, attr_vp);
 215                                 break;
 216 #endif
 217                         default:
 218                                 radlog(L_ERR, "%s: Illegal value for searchin. Changing to packet.", data->name);
 219                                 data->searchin = RLM_REGEX_INPACKET;
 220                                 pairadd(&request->packet->vps,attr_vp);
 221                                 break;
 222                 }
 223                 DEBUG2("%s: Added attribute %s with value '%s'", data->name,data->attribute,replace_STR);
 224                 ret = RLM_MODULE_OK;
 225         } else {
 226                 int replace_len = 0;
 227
 228                 /* new_attribute = no */
 229                 switch (data->searchin) {
 230                         case RLM_REGEX_INPACKET:
 231                                 if (!data->da->vendor && (data->da->attr == PW_USER_NAME))
 232                                         attr_vp = request->username;
 233                                 else if (!data->da->vendor && (data->da->attr == PW_USER_PASSWORD))
 234                                         attr_vp = request->password;
 235                                 else
 236                                         tmp = request->packet->vps;
 237                                 break;
 238                         case RLM_REGEX_INCONFIG:
 239                                 tmp = request->config_items;
 240                                 break;
 241                         case RLM_REGEX_INREPLY:
 242                                 tmp = request->reply->vps;
 243                                 break;
 244 #ifdef WITH_PROXY
 245                         case RLM_REGEX_INPROXYREPLY:
 246                                 if (!request->proxy_reply)
 247                                         return RLM_MODULE_NOOP;
 248                                 tmp = request->proxy_reply->vps;
 249                                 break;
 250                         case RLM_REGEX_INPROXY:
 251                                 if (!request->proxy)
 252                                         return RLM_MODULE_NOOP;
 253                                 tmp = request->proxy->vps;
 254                                 break;
 255 #endif
 256                         default:
 257                                 radlog(L_ERR, "%s: Illegal value for searchin. Changing to packet.", data->name);
 258                                 data->searchin = RLM_REGEX_INPACKET;
 259                                 attr_vp = pairfind(request->packet->vps, data->da->attr, data->da->vendor);
 260                                 break;
 261                 }
 262 do_again:
 263                 if (tmp != NULL)
 264                         attr_vp = pairfind(tmp, data->da->attr, data->da->vendor);
 265                 if (attr_vp == NULL) {
 266                         DEBUG2("%s: Could not find value pair for attribute %s", data->name,data->attribute);
 267                         return ret;
 268                 }
 269                 if (attr_vp->vp_strvalue == NULL || attr_vp->length == 0){
 270                         DEBUG2("%s: Attribute %s string value NULL or of zero length", data->name,data->attribute);
 271                         return ret;
 272                 }
 273                 cflags |= REG_EXTENDED;
 274                 if (data->nocase)
 275                         cflags |= REG_ICASE;
 276
 277                 if (!radius_xlat(search_STR, sizeof(search_STR), data->search, request, NULL) && data->search_len != 0) {
 278                         DEBUG2("%s: xlat on search string failed.", data->name);
 279                         return ret;
 280                 }
 281
 282                 if ((err = regcomp(&preg,search_STR,cflags))) {
 283                         regerror(err, &preg, err_msg, MAX_STRING_LEN);
 284                         DEBUG2("%s: regcomp() returned error: %s", data->name,err_msg);
 285                         return ret;
 286                 }
 287
 288                 if ((attr_vp->type == PW_TYPE_IPADDR) &&
 289                     (attr_vp->vp_strvalue[0] == '\0')) {
 290                         inet_ntop(AF_INET, &(attr_vp->vp_ipaddr),
 291                                   attr_vp->vp_strvalue,
 292                                   sizeof(attr_vp->vp_strvalue));
 293                 }
 294
 295                 ptr = new_str;
 296                 ptr2 = attr_vp->vp_strvalue;
 297                 counter = 0;
 298
 299                 for ( i = 0 ;i < (unsigned)data->num_matches; i++) {
 300                         err = regexec(&preg, ptr2, REQUEST_MAX_REGEX, pmatch, 0);
 301                         if (err == REG_NOMATCH) {
 302                                 if (i == 0) {
 303                                         DEBUG2("%s: Does not match: %s = %s", data->name,
 304                                                         data->attribute, attr_vp->vp_strvalue);
 305                                         regfree(&preg);
 306                                         goto to_do_again;
 307                                 } else
 308                                         break;
 309                         }
 310                         if (err != 0) {
 311                                 regfree(&preg);
 312                                 radlog(L_ERR, "%s: match failure for attribute %s with value '%s'", data->name,
 313                                                 data->attribute, attr_vp->vp_strvalue);
 314                                 return ret;
 315                         }
 316                         if (pmatch[0].rm_so == -1)
 317                                 break;
 318                         len = pmatch[0].rm_so;
 319                         if (data->append) {
 320                                 len = len + (pmatch[0].rm_eo - pmatch[0].rm_so);
 321                         }
 322                         counter += len;
 323                         if (counter >= MAX_STRING_LEN) {
 324                                 regfree(&preg);
 325                                 DEBUG2("%s: Replacement out of limits for attribute %s with value '%s'", data->name,
 326                                                 data->attribute, attr_vp->vp_strvalue);
 327                                 return ret;
 328                         }
 329
 330                         memcpy(ptr, ptr2,len);
 331                         ptr += len;
 332                         *ptr = '\0';
 333                         ptr2 += pmatch[0].rm_eo;
 334
 335                         if (i == 0){
 336                                 /*
 337                                  * We only run on the first match, sorry
 338                                  */
 339                                 for(j = 0; j <= REQUEST_MAX_REGEX; j++){
 340                                         char *p;
 341                                         char buffer[sizeof(attr_vp->vp_strvalue)];
 342
 343                                         /*
 344                                          * Stolen from src/main/valuepair.c, paircompare()
 345                                          */
 346
 347                                         /*
 348                                          * Delete old matches if the corresponding match does not
 349                                          * exist in the current regex
 350                                          */
 351                                         if (pmatch[j].rm_so == -1){
 352                                                 p = request_data_get(request,request,REQUEST_DATA_REGEX | j);
 353                                                 if (p){
 354                                                         free(p);
 355                                                         continue;
 356                                                 }
 357                                                 break;
 358                                         }
 359                                         memcpy(buffer,
 360                                                attr_vp->vp_strvalue + pmatch[j].rm_so,
 361                                                pmatch[j].rm_eo - pmatch[j].rm_so);
 362                                         buffer[pmatch[j].rm_eo - pmatch[j].rm_so] = '\0';
 363                                         p = strdup(buffer);
 364                                         request_data_add(request,request,REQUEST_DATA_REGEX | j,p,free);
 365                                 }
 366                         }
 367
 368                         if (!done_xlat){
 369                                 if (data->replace_len != 0 &&
 370                                 radius_xlat(replace_STR, sizeof(replace_STR), data->replace, request, NULL) == 0) {
 371                                         DEBUG2("%s: xlat on replace string failed.", data->name);
 372                                         return ret;
 373                                 }
 374                                 replace_len = (data->replace_len != 0) ? strlen(replace_STR) : 0;
 375                                 done_xlat = 1;
 376                         }
 377
 378                         counter += replace_len;
 379                         if (counter >= MAX_STRING_LEN) {
 380                                 regfree(&preg);
 381                                 DEBUG2("%s: Replacement out of limits for attribute %s with value '%s'", data->name,
 382                                                 data->attribute, attr_vp->vp_strvalue);
 383                                 return ret;
 384                         }
 385                         if (replace_len){
 386                                 memcpy(ptr, replace_STR, replace_len);
 387                                 ptr += replace_len;
 388                                 *ptr = '\0';
 389                         }
 390                 }
 391                 regfree(&preg);
 392                 len = strlen(ptr2) + 1;         /* We add the ending NULL */
 393                 counter += len;
 394                 if (counter >= MAX_STRING_LEN){
 395                         DEBUG2("%s: Replacement out of limits for attribute %s with value '%s'", data->name,
 396                                         data->attribute, attr_vp->vp_strvalue);
 397                         return ret;
 398                 }
 399                 memcpy(ptr, ptr2, len);
 400                 ptr[len] = '\0';
 401
 402                 DEBUG2("%s: Changed value for attribute %s from '%s' to '%s'", data->name,
 403                                 data->attribute, attr_vp->vp_strvalue, new_str);
 404                 if (pairparsevalue(attr_vp, new_str) == NULL) {
 405                         DEBUG2("%s: Could not write value '%s' into attribute %s: %s", data->name, new_str, data->attribute, fr_strerror());
 406                         return ret;
 407                 }
 408
 409 to_do_again:
 410                 ret = RLM_MODULE_OK;
 411
 412                 if (tmp != NULL){
 413                         tmp = attr_vp->next;
 414                         if (tmp != NULL)
 415                                 goto do_again;
 416                 }
 417         }
 418
 419         return ret;
 420 }
 421
 422 static int attr_rewrite_accounting(void *instance, REQUEST *request)
 423 {
 424         return do_attr_rewrite(instance, request);
 425 }
 426
 427 static int attr_rewrite_authorize(void *instance, REQUEST *request)
 428 {
 429         return do_attr_rewrite(instance, request);
 430 }
 431
 432 static int attr_rewrite_authenticate(void *instance, REQUEST *request)
 433 {
 434         return do_attr_rewrite(instance, request);
 435 }
 436
 437 static int attr_rewrite_preacct(void *instance, REQUEST *request)
 438 {
 439         return do_attr_rewrite(instance, request);
 440 }
 441
 442 static int attr_rewrite_checksimul(void *instance, REQUEST *request)
 443 {
 444         return do_attr_rewrite(instance, request);
 445 }
 446
 447 #ifdef WITH_PROXY
 448 static int attr_rewrite_preproxy(void *instance, REQUEST *request)
 449 {
 450         return do_attr_rewrite(instance, request);
 451 }
 452
 453 static int attr_rewrite_postproxy(void *instance, REQUEST *request)
 454 {
 455         return do_attr_rewrite(instance, request);
 456 }
 457 #endif
 458
 459 static int attr_rewrite_postauth(void *instance, REQUEST *request)
 460 {
 461         return do_attr_rewrite(instance, request);
 462 }
 463
 464 static int attr_rewrite_detach(void *instance)
 465 {
 466         free(instance);
 467         return 0;
 468 }
 469
 470 /*
 471  *      The module name should be the only globally exported symbol.
 472  *      That is, everything else should be 'static'.
 473  *
 474  *      If the module needs to temporarily modify it's instantiation
 475  *      data, the type should be changed to RLM_TYPE_THREAD_UNSAFE.
 476  *      The server will then take care of ensuring that the module
 477  *      is single-threaded.
 478  */
 479 module_t rlm_attr_rewrite = {
 480         RLM_MODULE_INIT,
 481         "attr_rewrite",
 482         RLM_TYPE_THREAD_UNSAFE,         /* type */
 483         attr_rewrite_instantiate,               /* instantiation */
 484         attr_rewrite_detach,                    /* detach */
 485         {
 486                 attr_rewrite_authenticate,      /* authentication */
 487                 attr_rewrite_authorize,         /* authorization */
 488                 attr_rewrite_preacct,           /* preaccounting */
 489                 attr_rewrite_accounting,        /* accounting */
 490                 attr_rewrite_checksimul,        /* checksimul */
 491 #ifdef WITH_PROXY
 492                 attr_rewrite_preproxy,          /* pre-proxy */
 493                 attr_rewrite_postproxy,         /* post-proxy */
 494 #else
 495                 NULL, NULL,
 496 #endif
 497                 attr_rewrite_postauth           /* post-auth */
 498         },
 499 };