1 /* Copyright 2010, 2011 NORDUnet A/S. All rights reserved.
2 See the file COPYING for licensing information. */
4 #if defined HAVE_CONFIG_H
11 #include <radsec/radsec.h>
12 #include <radsec/radsec-impl.h>
17 # common config options
20 # common realm config options
22 type = "UDP"|"TCP"|"TLS"|"DTLS"
29 pskstr = STRING # Transport pre-shared key, ASCII (UTF-8?) string form.
30 pskhexstr = STRING # Transport pre-shared key, hexadecimal string form.
32 pskex = "PSK"|"DHE_PSK"|"RSA_PSK"
35 # client specific realm config options
40 secret = STRING # RADIUS secret
45 /* FIXME: Leaking memory in error cases? */
47 rs_context_read_config(struct rs_context *ctx, const char *config_file)
49 cfg_t *cfg, *cfg_realm, *cfg_server;
53 struct rs_config *config = NULL;
55 cfg_opt_t server_opts[] =
57 CFG_STR ("hostname", NULL, CFGF_NONE),
58 CFG_STR ("service", "2083", CFGF_NONE),
59 CFG_STR ("secret", "radsec", CFGF_NONE),
62 cfg_opt_t realm_opts[] =
64 CFG_STR ("type", "UDP", CFGF_NONE),
65 CFG_INT ("timeout", 2, CFGF_NONE), /* FIXME: Remove? */
66 CFG_INT ("retries", 2, CFGF_NONE), /* FIXME: Remove? */
67 CFG_STR ("cacertfile", NULL, CFGF_NONE),
68 /*CFG_STR ("cacertpath", NULL, CFGF_NONE),*/
69 CFG_STR ("certfile", NULL, CFGF_NONE),
70 CFG_STR ("certkeyfile", NULL, CFGF_NONE),
71 CFG_STR ("pskstr", NULL, CFGF_NONE),
72 CFG_STR ("pskhexstr", NULL, CFGF_NONE),
73 CFG_STR ("pskid", NULL, CFGF_NONE),
74 CFG_STR ("pskex", "PSK", CFGF_NONE),
75 CFG_SEC ("server", server_opts, CFGF_MULTI),
80 CFG_STR ("dictionary", NULL, CFGF_NONE),
81 CFG_SEC ("realm", realm_opts, CFGF_TITLE | CFGF_MULTI),
85 cfg = cfg_init (opts, CFGF_NONE);
87 return rs_err_ctx_push (ctx, RSE_CONFIG, "unable to initialize libconfuse");
88 err = cfg_parse (cfg, config_file);
94 return rs_err_ctx_push (ctx, RSE_CONFIG,
95 "%s: unable to open configuration file",
98 return rs_err_ctx_push (ctx, RSE_CONFIG, "%s: invalid configuration file",
101 return rs_err_ctx_push (ctx, RSE_CONFIG, "%s: unknown parse error",
105 config = rs_calloc (ctx, 1, sizeof (*config));
107 return rs_err_ctx_push_fl (ctx, RSE_NOMEM, __FILE__, __LINE__, NULL);
108 ctx->config = config;
109 config->dictionary = cfg_getstr (cfg, "dictionary");
111 for (i = 0; i < cfg_size (cfg, "realm"); i++)
113 struct rs_realm *r = NULL;
115 char *pskstr = NULL, *pskhexstr = NULL;
117 r = rs_calloc (ctx, 1, sizeof(*r));
119 return rs_err_ctx_push_fl (ctx, RSE_NOMEM, __FILE__, __LINE__, NULL);
120 if (config->realms != NULL)
122 r->next = config->realms->next;
123 config->realms->next = r;
129 cfg_realm = cfg_getnsec (cfg, "realm", i);
130 s = cfg_title (cfg_realm);
132 return rs_err_ctx_push_fl (ctx, RSE_CONFIG, __FILE__, __LINE__,
133 "missing realm name");
134 /* We use a copy of the return value of cfg_title() since it's const. */
135 r->name = strdup (s);
137 return rs_err_ctx_push_fl (ctx, RSE_NOMEM, __FILE__, __LINE__, NULL);
139 typestr = cfg_getstr (cfg_realm, "type");
140 if (strcmp (typestr, "UDP") == 0)
141 r->type = RS_CONN_TYPE_UDP;
142 else if (strcmp (typestr, "TCP") == 0)
143 r->type = RS_CONN_TYPE_TCP;
144 else if (strcmp (typestr, "TLS") == 0)
145 r->type = RS_CONN_TYPE_TLS;
146 else if (strcmp (typestr, "DTLS") == 0)
147 r->type = RS_CONN_TYPE_DTLS;
149 return rs_err_ctx_push_fl (ctx, RSE_CONFIG, __FILE__, __LINE__,
150 "invalid connection type: %s", typestr);
151 r->timeout = cfg_getint (cfg_realm, "timeout");
152 r->retries = cfg_getint (cfg_realm, "retries");
154 r->cacertfile = cfg_getstr (cfg_realm, "cacertfile");
155 /*r->cacertpath = cfg_getstr (cfg_realm, "cacertpath");*/
156 r->certfile = cfg_getstr (cfg_realm, "certfile");
157 r->certkeyfile = cfg_getstr (cfg_realm, "certkeyfile");
159 pskstr = cfg_getstr (cfg_realm, "pskstr");
160 pskhexstr = cfg_getstr (cfg_realm, "pskhexstr");
161 if (pskstr || pskhexstr)
163 char *kex = cfg_getstr (cfg_realm, "pskex");
164 rs_cred_type_t type = RS_CRED_NONE;
165 struct rs_credentials *cred = NULL;
166 assert (kex != NULL);
168 if (!strcmp (kex, "PSK"))
169 type = RS_CRED_TLS_PSK;
172 /* TODO: push a warning, using a separate warn stack or
173 onto the ordinary error stack? */
174 /* rs_err_ctx_push (ctx, FIXME, "%s: unsupported PSK key exchange"
175 " algorithm -- PSK not used", kex);*/
178 if (type != RS_CRED_NONE)
180 cred = rs_calloc (ctx, 1, sizeof (*cred));
182 return rs_err_ctx_push_fl (ctx, RSE_NOMEM, __FILE__, __LINE__,
185 cred->identity = cfg_getstr (cfg_realm, "pskid");
188 cred->secret_encoding = RS_KEY_ENCODING_ASCII_HEX;
189 cred->secret = pskhexstr;
191 ; /* TODO: warn that we're ignoring pskstr */
195 cred->secret_encoding = RS_KEY_ENCODING_UTF8;
196 cred->secret = pskstr;
199 r->transport_cred = cred;
203 /* Add peers, one per server stanza. */
204 for (j = 0; j < cfg_size (cfg_realm, "server"); j++)
206 struct rs_peer *p = peer_create (ctx, &r->peers);
208 return rs_err_ctx_push_fl (ctx, RSE_NOMEM, __FILE__, __LINE__,
212 cfg_server = cfg_getnsec (cfg_realm, "server", j);
213 /* FIXME: Handle resolve errors, possibly by postponing name
215 rs_resolv (&p->addr, r->type, cfg_getstr (cfg_server, "hostname"),
216 cfg_getstr (cfg_server, "service"));
217 p->secret = cfg_getstr (cfg_server, "secret");
221 /* Save config object in context, for freeing in rs_context_destroy(). */
222 ctx->config->cfg = cfg;
228 rs_conf_find_realm(struct rs_context *ctx, const char *name)
232 for (r = ctx->config->realms; r; r = r->next)
233 if (strcmp (r->name, name) == 0)