2 * Copyright (c) 2012-2018, JANET(UK)
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
16 * 3. Neither the name of JANET(UK) nor the names of its contributors
17 * may be used to endorse or promote products derived from this software
18 * without specific prior written permission.
20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
24 * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
25 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
26 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
27 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
29 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
30 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
31 * OF THE POSSIBILITY OF SUCH DAMAGE.
41 #include <tr_cfgwatch.h>
43 #include <tr_config.h>
44 #include <tr_gss_names.h>
46 #include <tr_filter.h>
47 #include <trust_router/tr_constraint.h>
50 #include <trust_router/trp.h>
52 #if JANSSON_VERSION_HEX < 0x020500
53 #include "jansson_iterators.h"
56 TR_CFG_RC tr_cfg_parse_default_servers (TR_CFG *trc, json_t *jcfg)
59 TR_CFG_RC rc = TR_CFG_SUCCESS;
60 TR_AAA_SERVER *ds = NULL;
63 if ((!trc) || (!jcfg))
64 return TR_CFG_BAD_PARAMS;
66 /* If there are default servers, store them */
67 if ((NULL != (jdss = json_object_get(jcfg, "default_servers"))) &&
68 (json_is_array(jdss)) &&
69 (0 < json_array_size(jdss))) {
71 for (i = 0; i < json_array_size(jdss); i++) {
72 if (NULL == (ds = tr_cfg_parse_one_aaa_server(trc,
73 json_array_get(jdss, i),
77 tr_debug("tr_cfg_parse_default_servers: Default server configured: %s", ds->hostname->buf);
78 ds->next = trc->default_servers;
79 trc->default_servers = ds;
83 tr_debug("tr_cfg_parse_default_servers: Finished (rc=%d)", rc);
87 static void tr_cfg_parse_comm_idps(TR_CFG *trc, json_t *jidps, TR_COMM *comm, TR_CFG_RC *rc)
89 TR_IDP_REALM *found_idp=NULL;
90 json_t *jidp_name=NULL;
91 TR_NAME *idp_name=NULL;
96 (!json_is_array(jidps))) {
98 *rc = TR_CFG_BAD_PARAMS;
102 json_array_foreach(jidps, ii, jidp_name) {
103 idp_name=tr_new_name(json_string_value(jidp_name));
104 if (idp_name==NULL) {
108 found_idp=tr_cfg_find_idp(trc, idp_name, rc);
109 tr_free_name(idp_name);
111 if ((found_idp==NULL) || (*rc!=TR_CFG_SUCCESS)) {
112 tr_debug("tr_cfg_parse_comm_idps: Unknown IDP %s.", json_string_value(jidp_name));
116 tr_comm_add_idp_realm(trc->ctable, comm, found_idp, 0, NULL, NULL); /* no provenance, never expires */
123 static void tr_cfg_parse_comm_rps(TR_CFG *trc, json_t *jrps, TR_COMM *comm, TR_CFG_RC *rc)
125 TR_RP_REALM *found_rp=NULL;
126 TR_RP_REALM *new_rp=NULL;
127 TR_NAME *rp_name=NULL;
133 (!json_is_array(jrps))) {
135 *rc = TR_CFG_BAD_PARAMS;
139 for (ii=0; ii<json_array_size(jrps); ii++) {
140 /* get the RP name as a string */
141 s=json_string_value(json_array_get(jrps, ii));
143 tr_notice("tr_cfg_parse_comm_rps: null RP found in community %.*s, ignoring.",
144 tr_comm_get_id(comm)->len, tr_comm_get_id(comm)->buf);
148 /* convert string to TR_NAME */
149 rp_name=tr_new_name(s);
151 tr_err("tr_cfg_parse_comm_rps: unable to allocate RP name for %s in community %.*s.",
152 s, tr_comm_get_id(comm)->len, tr_comm_get_id(comm)->buf);
155 /* see if we already have this RP in this community */
156 found_rp=tr_comm_find_rp(trc->ctable, comm, rp_name);
157 if (found_rp!=NULL) {
158 tr_notice("tr_cfg_parse_comm_rps: RP %s repeated in community %.*s.",
159 s, tr_comm_get_id(comm)->len, tr_comm_get_id(comm)->buf);
160 tr_free_name(rp_name);
164 /* Add the RP to the community, first see if we have the RP in any community */
165 found_rp=tr_rp_realm_lookup(trc->ctable->rp_realms, rp_name);
166 if (found_rp!=NULL) {
167 tr_debug("tr_cfg_parse_comm_rps: RP realm %s already exists.", s);
168 new_rp=found_rp; /* use it rather than creating a new realm record */
170 new_rp=tr_rp_realm_new(NULL);
172 tr_err("tr_cfg_parse_comm_rps: unable to allocate RP record for %s in community %.*s.",
173 s, tr_comm_get_id(comm)->len, tr_comm_get_id(comm)->buf);
175 tr_debug("tr_cfg_parse_comm_rps: setting name to %s", rp_name->buf);
176 tr_rp_realm_set_id(new_rp, rp_name);
177 rp_name=NULL; /* rp_name no longer belongs to us */
178 tr_rp_realm_add(trc->ctable->rp_realms, new_rp);
179 talloc_steal(trc->ctable, trc->ctable->rp_realms); /* make sure head is in the right context */
181 tr_comm_add_rp_realm(trc->ctable, comm, new_rp, 0, NULL, NULL);
185 static TR_COMM *tr_cfg_parse_one_comm (TALLOC_CTX *mem_ctx, TR_CFG *trc, json_t *jcomm, TR_CFG_RC *rc)
187 TALLOC_CTX *tmp_ctx=talloc_new(NULL);
188 TR_COMM *comm = NULL;
190 json_t *jtype = NULL;
191 json_t *japcs = NULL;
192 json_t *jidps = NULL;
195 if ((!trc) || (!jcomm) || (!rc)) {
196 tr_debug("tr_cfg_parse_one_comm: Bad parameters.");
198 *rc = TR_CFG_BAD_PARAMS;
202 comm=tr_comm_new(tmp_ctx);
204 tr_crit("tr_cfg_parse_one_comm: Out of memory.");
210 if ((NULL == (jid = json_object_get(jcomm, "community_id"))) ||
211 (!json_is_string(jid)) ||
212 (NULL == (jtype = json_object_get(jcomm, "type"))) ||
213 (!json_is_string(jtype)) ||
214 (NULL == (japcs = json_object_get(jcomm, "apcs"))) ||
215 (!json_is_array(japcs)) ||
216 (NULL == (jidps = json_object_get(jcomm, "idp_realms"))) ||
217 (!json_is_array(jidps)) ||
218 (NULL == (jrps = json_object_get(jcomm, "rp_realms"))) ||
219 (!json_is_array(jrps))) {
220 tr_debug("tr_cfg_parse_one_comm: Error parsing Communities configuration.");
221 *rc = TR_CFG_NOPARSE;
226 tr_comm_set_id(comm, tr_new_name(json_string_value(jid)));
227 if (NULL == tr_comm_get_id(comm)) {
228 tr_debug("tr_cfg_parse_one_comm: No memory for community id.");
234 if (0 == strcmp(json_string_value(jtype), "apc")) {
235 comm->type = TR_COMM_APC;
236 } else if (0 == strcmp(json_string_value(jtype), "coi")) {
237 comm->type = TR_COMM_COI;
238 if (NULL == (comm->apcs = tr_cfg_parse_apcs(trc, japcs, rc))) {
239 tr_debug("tr_cfg_parse_one_comm: Can't parse APCs for COI %s.",
240 tr_comm_get_id(comm)->buf);
245 tr_debug("tr_cfg_parse_one_comm: Invalid community type, comm = %s, type = %s",
246 tr_comm_get_id(comm)->buf, json_string_value(jtype));
247 *rc = TR_CFG_NOPARSE;
252 tr_cfg_parse_comm_idps(trc, jidps, comm, rc);
253 if (TR_CFG_SUCCESS != *rc) {
254 tr_debug("tr_cfg_parse_one_comm: Can't parse IDP realms for comm %s.",
255 tr_comm_get_id(comm)->buf);
260 tr_cfg_parse_comm_rps(trc, jrps, comm, rc);
261 if (TR_CFG_SUCCESS != *rc) {
262 tr_debug("tr_cfg_parse_one_comm: Can't parse RP realms for comm %s .",
263 tr_comm_get_id(comm)->buf);
268 if (TR_COMM_APC == comm->type) {
269 json_t *jexpire = json_object_get(jcomm, "expiration_interval");
270 comm->expiration_interval = 43200; /*30 days*/
272 if (!json_is_integer(jexpire)) {
273 tr_err("tr_parse_one_comm: expiration_interval is not an integer for comm %.*s",
274 tr_comm_get_id(comm)->len, tr_comm_get_id(comm)->buf);
278 comm->expiration_interval = json_integer_value(jexpire);
279 if (comm->expiration_interval <= 10) {
280 comm->expiration_interval = 11; /* Freeradius waits 10 minutes between successful TR queries*/
282 "tr_parse_one_comm: expiration interval for %.*s less than minimum of 11 minutes; using 11 minutes instead.",
283 tr_comm_get_id(comm)->len, tr_comm_get_id(comm)->buf);
285 if (comm->expiration_interval > 129600) {
287 comm->expiration_interval = 129600;
289 "tr_parse_one_comm: expiration interval for %.*s exceeds maximum of 90 days; using 90 days instead.",
290 tr_comm_get_id(comm)->len, tr_comm_get_id(comm)->buf);
297 talloc_steal(mem_ctx, comm);
298 talloc_free(tmp_ctx);
302 TR_CFG_RC tr_cfg_parse_comms (TR_CFG *trc, json_t *jcfg)
304 json_t *jcomms = NULL;
305 TR_CFG_RC rc = TR_CFG_SUCCESS;
306 TR_COMM *comm = NULL;
309 if ((!trc) || (!jcfg)) {
310 tr_debug("tr_cfg_parse_comms: Bad Parameters.");
311 return TR_CFG_BAD_PARAMS;
314 if (NULL != (jcomms = json_object_get(jcfg, "communities"))) {
315 if (!json_is_array(jcomms)) {
316 return TR_CFG_NOPARSE;
319 for (i = 0; i < json_array_size(jcomms); i++) {
320 if (NULL == (comm = tr_cfg_parse_one_comm(NULL, /* TODO: use a talloc context */
322 json_array_get(jcomms, i),
326 if (tr_comm_table_add_comm(trc->ctable, comm) != 0) {
327 tr_debug("tr_cfg_parse_comms: Duplicate community %s.", tr_comm_get_id(comm)->buf);
328 return TR_CFG_NOPARSE;
331 tr_debug("tr_cfg_parse_comms: Community configured: %s.",
332 tr_comm_get_id(comm)->buf);
335 tr_debug("tr_cfg_parse_comms: Finished (rc=%d)", rc);
339 TR_IDP_REALM *tr_cfg_find_idp (TR_CFG *tr_cfg, TR_NAME *idp_id, TR_CFG_RC *rc)
342 TR_IDP_REALM *cfg_idp;
344 if ((!tr_cfg) || (!idp_id)) {
346 *rc = TR_CFG_BAD_PARAMS;
350 for (cfg_idp = tr_cfg->ctable->idp_realms; NULL != cfg_idp; cfg_idp = cfg_idp->next) {
351 if (!tr_name_cmp (idp_id, cfg_idp->realm_id)) {
352 tr_debug("tr_cfg_find_idp: Found %s.", idp_id->buf);
356 /* if we didn't find one, return NULL */
360 TR_RP_CLIENT *tr_cfg_find_rp (TR_CFG *tr_cfg, TR_NAME *rp_gss, TR_CFG_RC *rc)
362 TR_RP_CLIENT *cfg_rp;
364 if ((!tr_cfg) || (!rp_gss)) {
366 *rc = TR_CFG_BAD_PARAMS;
370 for (cfg_rp = tr_cfg->rp_clients; NULL != cfg_rp; cfg_rp = cfg_rp->next) {
371 if (tr_gss_names_matches(cfg_rp->gss_names, rp_gss)) {
372 tr_debug("tr_cfg_find_rp: Found %s.", rp_gss->buf);
376 /* if we didn't find one, return NULL */