diff options
Diffstat (limited to 'src/include')
61 files changed, 9731 insertions, 0 deletions
diff --git a/src/include/.gitignore b/src/include/.gitignore new file mode 100644 index 0000000..c140a2c --- /dev/null +++ b/src/include/.gitignore @@ -0,0 +1,21 @@ +# Autoconf headers +autoconf.h +autoconf.sed + +# Dynamically generated headers +attributes.h +rfc*.h +missing.h +tls.h +features.h +radpaths.h +vqp.h +freeradius.h + +# Headers from v3.1.x +freeradius.snmp.h +util + +# Build scripts +build-radpaths-h +stamp-h diff --git a/src/include/all.mk b/src/include/all.mk new file mode 100644 index 0000000..e666f14 --- /dev/null +++ b/src/include/all.mk @@ -0,0 +1,168 @@ +# +# Version: $Id$ +# + +# +# Build dynamic headers by substituting various values from autoconf.h, these +# get installed with the library files, so external programs can tell what +# the server library was built with. +# +# The RFC headers are dynamic, too. +# +# The rest of the headers are static. +# + +HEADERS_DY = attributes.h features.h missing.h radpaths.h tls.h + +HEADERS = \ + autoconf.h \ + build.h \ + conf.h \ + conffile.h \ + detail.h \ + event.h \ + hash.h \ + heap.h \ + libradius.h \ + md4.h \ + md5.h \ + modcall.h \ + modules.h \ + packet.h \ + rad_assert.h \ + radius.h \ + radiusd.h \ + radutmp.h \ + realms.h \ + regex.h \ + sha1.h \ + stats.h \ + sysutmp.h \ + tcp.h \ + threads.h \ + token.h \ + udpfromto.h \ + base64.h \ + map.h \ + $(HEADERS_DY) + +# +# Solaris awk doesn't recognise [[:blank:]] hence [\t ] +# +src/include/autoconf.sed: src/include/autoconf.h + @grep ^#define $< | sed 's,/\*\*/,1,;' | awk '{print "'\ + 's,#[\\t ]*ifdef[\\t ]*" $$2 "$$,#if "$$3 ",g;'\ + 's,#[\\t ]*ifndef[\\t ]*" $$2 "$$,#if !"$$3 ",g;'\ + 's,defined(" $$2 ")," $$3 ",g;"}' > $@ + @grep -o '#undef [^ ]*' $< | sed 's,/#undef /,,;' | awk '{print "'\ + 's,#[\\t ]*ifdef[\\t ]*" $$2 "$$,#if 0,g;'\ + 's,#[\\t ]*ifndef[\\t ]*" $$2 "$$,#if 1,g;'\ + 's,defined(" $$2 "),0,g;"}' >> $@ + + +###################################################################### +# +# Create the header files from the dictionaries. +# + +RFC_DICTS := $(filter-out %~,$(wildcard share/dictionary.rfc*)) share/dictionary.vqp share/dictionary.freeradius +HEADERS_RFC := $(patsubst share/dictionary.%,src/include/%.h,$(RFC_DICTS)) +HEADERS += $(notdir ${HEADERS_RFC}) + +.PRECIOUS: $(HEADERS_RFC) + +src/include/attributes.h: share/dictionary.freeradius.internal + @$(ECHO) HEADER $@ + @echo "/* AUTO-GENERATED HEADER FILE. DO NOT EDIT. */" > $@ + @grep ^ATTRIBUTE $< | awk '{print "PW_"$$2 " " $$3 }' | tr '[:lower:]' '[:upper:]' | tr -- - _ | sed 's/^/#define /' >> $@ + @echo " " >> $@ + @grep -- 'Auth-Type' $< | grep ^VALUE | awk '{print "PW_"$$2 "_" $$3 " " $$4 }' | tr '[:lower:]' '[:upper:]' | tr -- - _ | sed 's/^/#define /' >> $@ + +src/include/%.h: share/dictionary.% share/dictionary.vqp + @$(ECHO) HEADER $@ + @echo "/* AUTO-GENERATED HEADER FILE. DO NOT EDIT. */" > $@ + @grep ^ATTRIBUTE $< | awk '{print "PW_"$$2 " " $$3 } ' | tr '[:lower:]' '[:upper:]' | tr -- - _ | sed 's/^/#define /' >> $@ + +# +# Build features.h by copying over WITH_* and RADIUSD_VERSION_* +# preprocessor macros from autoconf.h +# This means we don't need to include autoconf.h in installed headers. +# +# We use simple patterns here to work with the lowest common +# denominator's grep (Solaris). +# +src/include/features.h: src/include/features-h src/include/autoconf.h + @$(ECHO) HEADER $@ + @cp $< $@ + @grep "^#define[ ]*WITH_" src/include/autoconf.h >> $@ + @grep "^#define[ ]*RADIUSD_VERSION" src/include/autoconf.h >> $@ + +# +# Use the SED script we built earlier to make permanent substitutions +# of definitions in missing-h to build missing.h +# +src/include/missing.h: src/include/missing-h src/include/autoconf.sed + @$(ECHO) HEADER $@ + @sed -f src/include/autoconf.sed < $< > $@ + +src/include/tls.h: src/include/tls-h src/include/autoconf.sed + @$(ECHO) HEADER $@ + @sed -f src/include/autoconf.sed < $< > $@ + +src/include/radpaths.h: src/include/build-radpaths-h + @$(ECHO) HEADER $@ + @cd src/include && /bin/sh build-radpaths-h + +# +# Create the soft link for the fake include file path. +# +src/freeradius-devel: + @[ -e $@ ] || ln -s include $@ + +# +# Ensure we set up the build environment +# +BOOTSTRAP_BUILD += src/freeradius-devel $(addprefix src/include/,$(HEADERS_DY)) $(HEADERS_RFC) +scan: $(BOOTSTRAP_BUILD) + +###################################################################### +# +# Installation +# +# define the installation directory +SRC_INCLUDE_DIR := ${R}${includedir}/freeradius + +$(SRC_INCLUDE_DIR): + @$(INSTALL) -d -m 755 ${SRC_INCLUDE_DIR} + +# +# install the headers by re-writing the local files +# +# install-sh function for creating directories gets confused +# if there's a trailing slash, tries to create a directory +# it already created, and fails... +# +${SRC_INCLUDE_DIR}/%.h: src/include/%.h | $(SRC_INCLUDE_DIR) + @echo INSTALL $(notdir $<) + @$(INSTALL) -d -m 755 `echo $(dir $@) | sed 's/\/$$//'` +# Expression must deal with indentation after the hash and copy it to the substitution string. +# Hash not anchored to allow substitution in function documentation. + @sed -e 's/#\([\\t ]*\)include <freeradius-devel\/\([^>]*\)>/#\1include <freeradius\/\2>/g' < $< > $@ + @chmod 644 $@ + +install.src.include: $(addprefix ${SRC_INCLUDE_DIR}/,${HEADERS}) +install: install.src.include + +# +# Cleaning +# +.PHONY: clean.src.include distclean.src.include +clean.src.include: + @rm -f $(addprefix src/include/,$(HEADERS_DY)) $(HEADERS_RFC) + +clean: clean.src.include + +distclean.src.include: clean.src.include + @rm -f autoconf.sed + +distclean: distclean.src.include diff --git a/src/include/atomic_queue.h b/src/include/atomic_queue.h new file mode 100644 index 0000000..9fbcfe7 --- /dev/null +++ b/src/include/atomic_queue.h @@ -0,0 +1,79 @@ +#pragma once +/* + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + */ + +/** + * $Id$ + * + * @file atomic_queue.h + * @brief Thread-safe queues. + * + * @copyright 2016 Alan DeKok (aland@freeradius.org) + */ +RCSIDH(atomic_queue_h, "$Id$") + +#ifdef HAVE_WDOCUMENTATION +DIAG_OFF(documentation) +#endif +#include <talloc.h> +#ifdef HAVE_WDOCUMENTATION +DIAG_ON(documentation) +#endif +#include <stdbool.h> + +#ifdef HAVE_STDATOMIC_H +# include <stdatomic.h> +#else +# include <freeradius-devel/stdatomic.h> +#endif + +/* + * Some macros to make our life easier. + */ +#define atomic_int64_t _Atomic(int64_t) +#define atomic_uint32_t _Atomic(uint32_t) +#define atomic_uint64_t _Atomic(uint64_t) + +#define cas_incr(_store, _var) atomic_compare_exchange_strong_explicit(&_store, &_var, _var + 1, memory_order_release, memory_order_relaxed) +#define cas_decr(_store, _var) atomic_compare_exchange_strong_explicit(&_store, &_var, _var - 1, memory_order_release, memory_order_relaxed) +#define load(_var) atomic_load_explicit(&_var, memory_order_relaxed) +#define aquire(_var) atomic_load_explicit(&_var, memory_order_acquire) +#define store(_store, _var) atomic_store_explicit(&_store, _var, memory_order_release); + +#ifdef __cplusplus +extern "C" { +#endif + +typedef struct fr_atomic_queue_s fr_atomic_queue_t; + +fr_atomic_queue_t *fr_atomic_queue_alloc(TALLOC_CTX *ctx, size_t size); +void fr_atomic_queue_free(fr_atomic_queue_t **aq); +bool fr_atomic_queue_push(fr_atomic_queue_t *aq, void *data); +bool fr_atomic_queue_pop(fr_atomic_queue_t *aq, void **p_data); +size_t fr_atomic_queue_size(fr_atomic_queue_t *aq); + +#ifdef WITH_VERIFY_PTR +void fr_atomic_queue_verify(fr_atomic_queue_t *aq); +#endif + +#ifndef NDEBUG +void fr_atomic_queue_debug(fr_atomic_queue_t *aq, FILE *fp); +#endif + + +#ifdef __cplusplus +} +#endif diff --git a/src/include/autoconf.h.in b/src/include/autoconf.h.in new file mode 100644 index 0000000..4774482 --- /dev/null +++ b/src/include/autoconf.h.in @@ -0,0 +1,748 @@ +/* src/include/autoconf.h.in. Generated from configure.ac by autoheader. */ + +/* Define if building universal (internal helper macro) */ +#undef AC_APPLE_UNIVERSAL_BUILD + +/* BSD-Style get*byaddr_r */ +#undef BSDSTYLE + +/* style of ctime_r function */ +#undef CTIMERSTYLE + +/* Define to 1 to have OpenSSL version check enabled */ +#undef ENABLE_OPENSSL_VERSION_CHECK + +/* Define to ensure each build is the same */ +#undef ENABLE_REPRODUCIBLE_BUILDS + +/* Define if your processor stores words with the most significant byte first + */ +#undef FR_BIG_ENDIAN + +/* Define if your processor stores words with the least significant byte first + */ +#undef FR_LITTLE_ENDIAN + +/* style of gethostbyaddr_r functions */ +#undef GETHOSTBYADDRRSTYLE + +/* style of gethostbyname_r functions */ +#undef GETHOSTBYNAMERSTYLE + +/* GNU-Style get*byaddr_r */ +#undef GNUSTYLE + +/* Define to 1 if you have the <arpa/inet.h> header file. */ +#undef HAVE_ARPA_INET_H + +/* Define to 1 if you have the `ASN1_STRING_get0_data' function. */ +#undef HAVE_ASN1_STRING_GET0_DATA + +/* Define if your compiler supports the __bounded__ attribute (usually OpenBSD + gcc). */ +#undef HAVE_ATTRIBUTE_BOUNDED + +/* Define to 1 if you have the `bindat' function. */ +#undef HAVE_BINDAT + +/* Define if we have a binary safe regular expression library */ +#undef HAVE_BINSAFE_REGEX + +/* Define if the compiler supports __builtin_bswap64 */ +#undef HAVE_BUILTIN_BSWAP_64 + +/* Define if the compiler supports __builtin_choose_expr */ +#undef HAVE_BUILTIN_CHOOSE_EXPR + +/* Define if the compiler supports __builtin_types_compatible_p */ +#undef HAVE_BUILTIN_TYPES_COMPATIBLE_P + +/* Define to 1 if you have the <sys/capability.h> header file. */ +#undef HAVE_CAPABILITY_H + +/* Define to 1 if you have the `clock_gettime' function. */ +#undef HAVE_CLOCK_GETTIME + +/* Define to 1 if you have the `closefrom' function. */ +#undef HAVE_CLOSEFROM + +/* Define to 1 if you have the `collectdclient' library (-lcollectdclient). */ +#undef HAVE_COLLECTDC_H + +/* Define to 1 if you have the `CONF_modules_load_file' function. */ +#undef HAVE_CONF_MODULES_LOAD_FILE + +/* Do we have the crypt function */ +#undef HAVE_CRYPT + +/* Define to 1 if you have the `CRYPTO_set_id_callback' function. */ +#undef HAVE_CRYPTO_SET_ID_CALLBACK + +/* Define to 1 if you have the `CRYPTO_set_locking_callback' function. */ +#undef HAVE_CRYPTO_SET_LOCKING_CALLBACK + +/* Define to 1 if you have the <crypt.h> header file. */ +#undef HAVE_CRYPT_H + +/* Do we have the crypt_r function */ +#undef HAVE_CRYPT_R + +/* Define to 1 if you have the `ctime_r' function. */ +#undef HAVE_CTIME_R + +/* Define to 1 if you have the declaration of `gethostbyaddr_r', and to 0 if + you don't. */ +#undef HAVE_DECL_GETHOSTBYADDR_R + +/* Define to 1 if you have the <dirent.h> header file, and it defines `DIR'. + */ +#undef HAVE_DIRENT_H + +/* Define to 1 if you have the `dladdr' function. */ +#undef HAVE_DLADDR + +/* Define to 1 if you have the <dlfcn.h> header file. */ +#undef HAVE_DLFCN_H + +/* Define to 1 if you have the <errno.h> header file. */ +#undef HAVE_ERRNO_H + +/* define this if we have <execinfo.h> and symbols */ +#undef HAVE_EXECINFO + +/* Define to 1 if you have the `fcntl' function. */ +#undef HAVE_FCNTL + +/* Define to 1 if you have the <fcntl.h> header file. */ +#undef HAVE_FCNTL_H + +/* Define to 1 if you have the <features.h> header file. */ +#undef HAVE_FEATURES_H + +/* Define to 1 if you have the <fnmatch.h> header file. */ +#undef HAVE_FNMATCH_H + +/* Define to 1 if you have the `fopencookie' function. */ +#undef HAVE_FOPENCOOKIE + +/* Define to 1 if you have the `funopen' function. */ +#undef HAVE_FUNOPEN + +/* Define to 1 if you have the `getaddrinfo' function. */ +#undef HAVE_GETADDRINFO + +/* Define to 1 if you have the getgrnam_r. */ +#undef HAVE_GETGRNAM_R + +/* Define to 1 if you have the `getnameinfo' function. */ +#undef HAVE_GETNAMEINFO + +/* Define to 1 if you have the <getopt.h> header file. */ +#undef HAVE_GETOPT_H + +/* Define to 1 if you have the `getopt_long' function. */ +#undef HAVE_GETOPT_LONG + +/* Define to 1 if you have the `getpeereid' function. */ +#undef HAVE_GETPEEREID + +/* Define to 1 if you have the getpwnam_r. */ +#undef HAVE_GETPWNAM_R + +/* Define to 1 if you have the `getresuid' function. */ +#undef HAVE_GETRESUID + +/* Define to 1 if you have the `gettimeofday' function. */ +#undef HAVE_GETTIMEOFDAY + +/* Define to 1 if you have the `getusershell' function. */ +#undef HAVE_GETUSERSHELL + +/* Define to 1 if you have the <glob.h> header file. */ +#undef HAVE_GLOB_H + +/* Define to 1 if you have the `gmtime_r' function. */ +#undef HAVE_GMTIME_R + +/* Define to 1 if you have the <grp.h> header file. */ +#undef HAVE_GRP_H + +/* Define to 1 if you have the <history.h> header file. */ +#undef HAVE_HISTORY_H + +/* Define to 1 if you have the `HMAC_CTX_free' function. */ +#undef HAVE_HMAC_CTX_FREE + +/* Define to 1 if you have the `HMAC_CTX_new' function. */ +#undef HAVE_HMAC_CTX_NEW + +/* Define if the function (or macro) htonll exists. */ +#undef HAVE_HTONLL + +/* Define if the function (or macro) htonlll exists. */ +#undef HAVE_HTONLLL + +/* Define to 1 if you have the `if_indextoname' function. */ +#undef HAVE_IF_INDEXTONAME + +/* define if you have IN6_PKTINFO (Linux) */ +#undef HAVE_IN6_PKTINFO + +/* Define to 1 if you have the `inet_aton' function. */ +#undef HAVE_INET_ATON + +/* Define to 1 if you have the `inet_ntop' function. */ +#undef HAVE_INET_NTOP + +/* Define to 1 if you have the `inet_pton' function. */ +#undef HAVE_INET_PTON + +/* Define to 1 if you have the `initgroups' function. */ +#undef HAVE_INITGROUPS + +/* Define to 1 if you have the <inttypes.h> header file. */ +#undef HAVE_INTTYPES_H + +/* define if you have IP_PKTINFO (Linux) */ +#undef HAVE_IP_PKTINFO + +/* Define to 1 if you have the `kqueue' function. */ +#undef HAVE_KQUEUE + +/* Define to 1 if you have the `cap' library (-lcap). */ +#undef HAVE_LIBCAP + +/* Define to 1 if you have the `crypto' library (-lcrypto). */ +#undef HAVE_LIBCRYPTO + +/* Define to 1 if you have the `dl' library (-ldl). */ +#undef HAVE_LIBDL + +/* Define to 1 if you have the `nsl' library (-lnsl). */ +#undef HAVE_LIBNSL + +/* Define to 1 if you have the `pcap' library (-lpcap) and header file + <pcap.h>. */ +#undef HAVE_LIBPCAP + +/* Define if you have a readline compatible library */ +#undef HAVE_LIBREADLINE + +/* Define to 1 if you have the `resolv' library (-lresolv). */ +#undef HAVE_LIBRESOLV + +/* Define to 1 if you have the `socket' library (-lsocket). */ +#undef HAVE_LIBSOCKET + +/* Define to 1 if you have the `ssl' library (-lssl). */ +#undef HAVE_LIBSSL + +/* Define to 1 if you have the `ws2_32' library (-lws2_32). */ +#undef HAVE_LIBWS2_32 + +/* Define to 1 if you have the <limits.h> header file. */ +#undef HAVE_LIMITS_H + +/* Define to 1 if you have the <linux/if_packet.h> header file. */ +#undef HAVE_LINUX_IF_PACKET_H + +/* Define to 1 if you have the `localtime_r' function. */ +#undef HAVE_LOCALTIME_R + +/* Define to 1 if you have the <malloc.h> header file. */ +#undef HAVE_MALLOC_H + +/* Define to 1 if you have the `mallopt' function. */ +#undef HAVE_MALLOPT + +/* Define to 1 if you have the <memory.h> header file. */ +#undef HAVE_MEMORY_H + +/* Define to 1 if you have the `mkdirat' function. */ +#undef HAVE_MKDIRAT + +/* Define to 1 if you have the <ndir.h> header file, and it defines `DIR'. */ +#undef HAVE_NDIR_H + +/* Define to 1 if you have the <netdb.h> header file. */ +#undef HAVE_NETDB_H + +/* Define to 1 if you have the <netinet/in.h> header file. */ +#undef HAVE_NETINET_IN_H + +/* Define to 1 if you have the <net/if.h> header file. */ +#undef HAVE_NET_IF_H + +/* Define to 1 if you have the `openat' function. */ +#undef HAVE_OPENAT + +/* Define to 1 if you have the <openssl/asn1.h> header file. */ +#undef HAVE_OPENSSL_ASN1_H + +/* Define to 1 if you have the <openssl/conf.h> header file. */ +#undef HAVE_OPENSSL_CONF_H + +/* Define to 1 if you have the <openssl/crypto.h> header file. */ +#undef HAVE_OPENSSL_CRYPTO_H + +/* Define to 1 if you have the <openssl/engine.h> header file. */ +#undef HAVE_OPENSSL_ENGINE_H + +/* Define to 1 if you have the <openssl/err.h> header file. */ +#undef HAVE_OPENSSL_ERR_H + +/* Define to 1 if you have the <openssl/evp.h> header file. */ +#undef HAVE_OPENSSL_EVP_H + +/* Define to 1 if you have the <openssl/hmac.h> header file. */ +#undef HAVE_OPENSSL_HMAC_H + +/* Define to 1 if you have the <openssl/md4.h> header file. */ +#undef HAVE_OPENSSL_MD4_H + +/* Define to 1 if you have the <openssl/md5.h> header file. */ +#undef HAVE_OPENSSL_MD5_H + +/* Define to 1 if you have the <openssl/ocsp.h> header file. */ +#undef HAVE_OPENSSL_OCSP_H + +/* Define to 1 if you have the <openssl/rand.h> header file. */ +#undef HAVE_OPENSSL_RAND_H + +/* Define to 1 if you have the <openssl/sha.h> header file. */ +#undef HAVE_OPENSSL_SHA_H + +/* Define to 1 if you have the <openssl/ssl.h> header file. */ +#undef HAVE_OPENSSL_SSL_H + +/* Define to 1 if you have the `pcap_activate' function. */ +#undef HAVE_PCAP_ACTIVATE + +/* Define to 1 if you have the `pcap_create' function. */ +#undef HAVE_PCAP_CREATE + +/* Define to 1 if you have the `pcap_dump_fopen' function. */ +#undef HAVE_PCAP_DUMP_FOPEN + +/* Define to 1 if you have the `pcap_fopen_offline' function. */ +#undef HAVE_PCAP_FOPEN_OFFLINE + +/* define this if we have libpcre */ +#undef HAVE_PCRE + +/* Define to 1 if you have the <prot.h> header file. */ +#undef HAVE_PROT_H + +/* Define to 1 if you have the <pthread.h> header file. */ +#undef HAVE_PTHREAD_H + +/* Define to 1 if you have the `pthread_sigmask' function. */ +#undef HAVE_PTHREAD_SIGMASK + +/* Define to 1 if you have the <pwd.h> header file. */ +#undef HAVE_PWD_H + +/* Define to 1 if you have the <readline.h> header file. */ +#undef HAVE_READLINE_H + +/* Define if your readline library has \`add_history' */ +#undef HAVE_READLINE_HISTORY + +/* Define to 1 if you have the <readline/history.h> header file. */ +#undef HAVE_READLINE_HISTORY_H + +/* Define to 1 if you have the <readline/readline.h> header file. */ +#undef HAVE_READLINE_READLINE_H + +/* Define if we have any regular expression library */ +#undef HAVE_REGEX + +/* Define to 1 if you have the `regncomp' function. */ +#undef HAVE_REGNCOMP + +/* Define to 1 if you have the `regnexec' function. */ +#undef HAVE_REGNEXEC + +/* define this if we have REG_EXTENDED (from <regex.h>) */ +#undef HAVE_REG_EXTENDED + +/* Define to 1 if you have the <resource.h> header file. */ +#undef HAVE_RESOURCE_H + +/* Define to 1 if you have the <sanitizer/lsan_interface.h> header file. */ +#undef HAVE_SANITIZER_LSAN_INTERFACE_H + +/* Define to 1 if you have the <semaphore.h> header file. */ +#undef HAVE_SEMAPHORE_H + +/* Define to 1 if you have the `setlinebuf' function. */ +#undef HAVE_SETLINEBUF + +/* Define to 1 if you have the `setresuid' function. */ +#undef HAVE_SETRESUID + +/* Define to 1 if you have the `setsid' function. */ +#undef HAVE_SETSID + +/* Define to 1 if you have the `setuid' function. */ +#undef HAVE_SETUID + +/* Define to 1 if you have the `setvbuf' function. */ +#undef HAVE_SETVBUF + +/* Define to 1 if you have the <siad.h> header file. */ +#undef HAVE_SIAD_H + +/* Define to 1 if you have the <sia.h> header file. */ +#undef HAVE_SIA_H + +/* Define to 1 if you have the `sigaction' function. */ +#undef HAVE_SIGACTION + +/* Define to 1 if you have the <signal.h> header file. */ +#undef HAVE_SIGNAL_H + +/* Define to 1 if you have the `sigprocmask' function. */ +#undef HAVE_SIGPROCMASK + +/* Define if the type sig_t is defined by signal.h */ +#undef HAVE_SIG_T + +/* Define to 1 if you have the `snprintf' function. */ +#undef HAVE_SNPRINTF + +/* Define to 1 if you have the `SSL_get_client_random' function. */ +#undef HAVE_SSL_GET_CLIENT_RANDOM + +/* Define to 1 if you have the `SSL_get_server_random' function. */ +#undef HAVE_SSL_GET_SERVER_RANDOM + +/* Define to 1 if you have the `SSL_SESSION_get_master_key' function. */ +#undef HAVE_SSL_SESSION_GET_MASTER_KEY + +/* Define to 1 if you have the <stdalign.h> header file. */ +#undef HAVE_STDALIGN_H + +/* Define to 1 if you have the <stdatomic.h> header file. */ +#undef HAVE_STDATOMIC_H + +/* Define to 1 if you have the <stdbool.h> header file. */ +#undef HAVE_STDBOOL_H + +/* Define to 1 if you have the <stddef.h> header file. */ +#undef HAVE_STDDEF_H + +/* Define to 1 if you have the <stdint.h> header file. */ +#undef HAVE_STDINT_H + +/* Define to 1 if you have the <stdio.h> header file. */ +#undef HAVE_STDIO_H + +/* Define to 1 if you have the <stdlib.h> header file. */ +#undef HAVE_STDLIB_H + +/* Define to 1 if you have the `strcasecmp' function. */ +#undef HAVE_STRCASECMP + +/* Define to 1 if you have the <strings.h> header file. */ +#undef HAVE_STRINGS_H + +/* Define to 1 if you have the <string.h> header file. */ +#undef HAVE_STRING_H + +/* Define to 1 if you have the `strlcat' function. */ +#undef HAVE_STRLCAT + +/* Define to 1 if you have the `strlcpy' function. */ +#undef HAVE_STRLCPY + +/* Define to 1 if you have the `strncasecmp' function. */ +#undef HAVE_STRNCASECMP + +/* Define to 1 if you have the `strsep' function. */ +#undef HAVE_STRSEP + +/* Define to 1 if you have the `strsignal' function. */ +#undef HAVE_STRSIGNAL + +/* Generic DNS lookups */ +#undef HAVE_STRUCT_ADDRINFO + +/* IPv6 address structure */ +#undef HAVE_STRUCT_IN6_ADDR + +/* IPv6 socket addresses */ +#undef HAVE_STRUCT_SOCKADDR_IN6 + +/* Generic socket addresses */ +#undef HAVE_STRUCT_SOCKADDR_STORAGE + +/* Define to 1 if you have the <syslog.h> header file. */ +#undef HAVE_SYSLOG_H + +/* Define to 1 if you have the `systemd' library (-lsystemd). */ +#undef HAVE_SYSTEMD + +/* Define to 1 if you have the <systemd/sd-daemon.h> header file. */ +#undef HAVE_SYSTEMD_SD_DAEMON_H + +/* Define to 1 if you have watchdog support in the `systemd' library + (-lsystemd). */ +#undef HAVE_SYSTEMD_WATCHDOG + +/* Define to 1 if you have the <sys/dir.h> header file, and it defines `DIR'. + */ +#undef HAVE_SYS_DIR_H + +/* Define to 1 if you have the <sys/event.h> header file. */ +#undef HAVE_SYS_EVENT_H + +/* Define to 1 if you have the <sys/fcntl.h> header file. */ +#undef HAVE_SYS_FCNTL_H + +/* Define to 1 if you have the <sys/ndir.h> header file, and it defines `DIR'. + */ +#undef HAVE_SYS_NDIR_H + +/* Define to 1 if you have the <sys/prctl.h> header file. */ +#undef HAVE_SYS_PRCTL_H + +/* Define to 1 if you have the <sys/procctl.h> header file. */ +#undef HAVE_SYS_PROCCTL_H + +/* Define to 1 if you have the <sys/ptrace.h> header file. */ +#undef HAVE_SYS_PTRACE_H + +/* Define to 1 if you have the <sys/resource.h> header file. */ +#undef HAVE_SYS_RESOURCE_H + +/* Define to 1 if you have the <sys/security.h> header file. */ +#undef HAVE_SYS_SECURITY_H + +/* Define to 1 if you have the <sys/select.h> header file. */ +#undef HAVE_SYS_SELECT_H + +/* Define to 1 if you have the <sys/socket.h> header file. */ +#undef HAVE_SYS_SOCKET_H + +/* Define to 1 if you have the <sys/stat.h> header file. */ +#undef HAVE_SYS_STAT_H + +/* Define to 1 if you have the <sys/time.h> header file. */ +#undef HAVE_SYS_TIME_H + +/* Define to 1 if you have the <sys/types.h> header file. */ +#undef HAVE_SYS_TYPES_H + +/* Define to 1 if you have the <sys/un.h> header file. */ +#undef HAVE_SYS_UN_H + +/* Define to 1 if you have the <sys/wait.h> header file. */ +#undef HAVE_SYS_WAIT_H + +/* Define to 1 if you have the function talloc_set_memlimit. */ +#undef HAVE_TALLOC_SET_MEMLIMIT + +/* 128 bit unsigned integer */ +#undef HAVE_UINT128_T + +/* Define to 1 if you have the <unistd.h> header file. */ +#undef HAVE_UNISTD_H + +/* Define to 1 if you have the `unlinkat' function. */ +#undef HAVE_UNLINKAT + +/* Define to 1 if you have the <utime.h> header file. */ +#undef HAVE_UTIME_H + +/* Define to 1 if you have the <utmpx.h> header file. */ +#undef HAVE_UTMPX_H + +/* Define to 1 if you have the <utmp.h> header file. */ +#undef HAVE_UTMP_H + +/* Define to 1 if you have the `vdprintf' function. */ +#undef HAVE_VDPRINTF + +/* Define to 1 if you have the `vsnprintf' function. */ +#undef HAVE_VSNPRINTF + +/* Define if the compiler supports -Wdocumentation */ +#undef HAVE_WDOCUMENTATION + +/* Define to 1 if you have the <winsock.h> header file. */ +#undef HAVE_WINSOCK_H + +/* compiler specific 128 bit unsigned integer */ +#undef HAVE___UINT128_T + +/* define if you have OSFC2 authentication */ +#undef OSFC2 + +/* define if you have OSFSIA authentication */ +#undef OSFSIA + +/* Define to the address where bug reports for this package should be sent. */ +#undef PACKAGE_BUGREPORT + +/* Define to the full name of this package. */ +#undef PACKAGE_NAME + +/* Define to the full name and version of this package. */ +#undef PACKAGE_STRING + +/* Define to the one symbol short name of this package. */ +#undef PACKAGE_TARNAME + +/* Define to the home page for this package. */ +#undef PACKAGE_URL + +/* Define to the version of this package. */ +#undef PACKAGE_VERSION + +/* Posix-Style ctime_r */ +#undef POSIXSTYLE + +/* Version integer in format <ma><ma><mi><mi><in><in> */ +#undef RADIUSD_VERSION + +/* Commit HEAD at time of configuring */ +#undef RADIUSD_VERSION_COMMIT + +/* Raw version string from VERSION file */ +#undef RADIUSD_VERSION_STRING + +/* Solaris-Style ctime_r */ +#undef SOLARISSTYLE + +/* Define to 1 if you have the ANSI C header files. */ +#undef STDC_HEADERS + +/* SYSV-Style get*byaddr_r */ +#undef SYSVSTYLE + +/* Define to 1 if you can safely include both <sys/time.h> and <time.h>. */ +#undef TIME_WITH_SYS_TIME + +/* Define if the compiler supports a thread local storage class */ +#undef TLS_STORAGE_CLASS + +/* Enable extensions on AIX 3, Interix. */ +#ifndef _ALL_SOURCE +# undef _ALL_SOURCE +#endif +/* Enable GNU extensions on systems that have them. */ +#ifndef _GNU_SOURCE +# undef _GNU_SOURCE +#endif +/* Enable threading extensions on Solaris. */ +#ifndef _POSIX_PTHREAD_SEMANTICS +# undef _POSIX_PTHREAD_SEMANTICS +#endif +/* Enable extensions on HP NonStop. */ +#ifndef _TANDEM_SOURCE +# undef _TANDEM_SOURCE +#endif +/* Enable general extensions on Solaris. */ +#ifndef __EXTENSIONS__ +# undef __EXTENSIONS__ +#endif + + +/* include support for Ascend binary filter attributes */ +#undef WITH_ASCEND_BINARY + +/* define if you want DHCP support */ +#undef WITH_DHCP + +/* define if the server was built with -DNDEBUG */ +#undef WITH_NDEBUG + +/* define if you want RADIUSv11 support (For RADSec et al) */ +#undef WITH_RADIUSV11 + +/* define if you want TCP support (For RADSec et al) */ +#undef WITH_TCP + +/* define if you want thread support */ +#undef WITH_THREADS + +/* define if you want udpfromto */ +#undef WITH_UDPFROMTO + +/* define if you want VMPS support */ +#undef WITH_VMPS + +/* Define WORDS_BIGENDIAN to 1 if your processor stores words with the most + significant byte first (like Motorola and SPARC, unlike Intel). */ +#if defined AC_APPLE_UNIVERSAL_BUILD +# if defined __BIG_ENDIAN__ +# define WORDS_BIGENDIAN 1 +# endif +#else +# ifndef WORDS_BIGENDIAN +# undef WORDS_BIGENDIAN +# endif +#endif + +/* Enable large inode numbers on Mac OS X 10.5. */ +#ifndef _DARWIN_USE_64_BIT_INODE +# define _DARWIN_USE_64_BIT_INODE 1 +#endif + +/* Number of bits in a file offset, on hosts where this is settable. */ +#undef _FILE_OFFSET_BITS + +/* Define for large files, on AIX-style hosts. */ +#undef _LARGE_FILES + +/* Define to 1 if on MINIX. */ +#undef _MINIX + +/* Define to 2 if the system does not provide POSIX.1 features except with + this defined. */ +#undef _POSIX_1_SOURCE + +/* Define to 1 if you need to in order for `stat' and other things to work. */ +#undef _POSIX_SOURCE + +/* Force OSX >= 10.7 Lion to use RFC2292 IPv6 socket options */ +#undef __APPLE_USE_RFC_3542 + +/* Define to empty if `const' does not conform to ANSI C. */ +#undef const + +/* Define to `int' if <sys/types.h> doesn't define. */ +#undef gid_t + +/* Define to `long int' if <sys/types.h> does not define. */ +#undef off_t + +/* Define to `int' if <sys/types.h> does not define. */ +#undef pid_t + +/* Define to `unsigned int' if <sys/types.h> does not define. */ +#undef size_t + +/* socklen_t is generally 'int' on systems which don't use it */ +#undef socklen_t + +/* Define to `int' if <sys/types.h> doesn't define. */ +#undef uid_t + +/* uint16_t should be the canonical '2 octets' for network traffic */ +#undef uint16_t + +/* uint32_t should be the canonical 'network integer' */ +#undef uint32_t + +/* uint64_t is required for larger counters */ +#undef uint64_t + +/* uint8_t should be the canonical 'octet' for network traffic */ +#undef uint8_t + +/* define to something if you don't have ut_xtime in struct utmpx */ +#undef ut_xtime + +#include <freeradius-devel/automask.h> diff --git a/src/include/automask.h b/src/include/automask.h new file mode 100644 index 0000000..87ffdfc --- /dev/null +++ b/src/include/automask.h @@ -0,0 +1,21 @@ +/* + * C Preprocessor definitions we do *NOT* want to leave defined autoconf.h + * Which are dependent on where the header is being used. + * + * Version: $Id$ + */ + + +/* + * If were building a module we may have local PACKAGE_* defines if + * AC_INIT() was called with full arguments. + */ +#ifdef IS_MODULE +# undef PACKAGE_BUGREPORT +# undef PACKAGE_NAME +# undef PACKAGE_STRING +# undef PACKAGE_TARNAME +# undef PACKAGE_URL +# undef PACKAGE_VERSION +#endif + diff --git a/src/include/base64.h b/src/include/base64.h new file mode 100644 index 0000000..c83cfc9 --- /dev/null +++ b/src/include/base64.h @@ -0,0 +1,38 @@ +/* + * Copyright (C) 2004, 2005, 2006 Free Software Foundation, Inc. + * Written by Simon Josefsson. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2, or (at your option) + * any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software Foundation, + * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. + */ +#ifndef _FR_BASE64_H +#define _FR_BASE64_H + +RCSIDH(base64_h, "$Id$") + +#include <stddef.h> +#include <stdint.h> + +/* This uses that the expression (n+(k-1))/k means the smallest + integer >= n/k, i.e., the ceiling of n/k. */ +#define FR_BASE64_ENC_LENGTH(inlen) ((((inlen) + 2) / 3) * 4) +#define FR_BASE64_DEC_LENGTH(inlen) ((3 * (inlen / 4)) + 2) + +bool fr_is_base64(char c); + +ssize_t fr_base64_encode(char *out, size_t outlen, uint8_t const *in, size_t inlen); + +ssize_t fr_base64_decode(uint8_t *out, size_t outlen, char const *in, size_t inlen); + +#endif /* _FR_BASE64_H */ diff --git a/src/include/build-radpaths-h.in b/src/include/build-radpaths-h.in new file mode 100644 index 0000000..506a21b --- /dev/null +++ b/src/include/build-radpaths-h.in @@ -0,0 +1,37 @@ +#! /bin/sh +# +# build-radpaths-h +# Script to generate radpaths.h file. This is needed to +# work around the weird way "autoconf" substitutes things +# that are generated in anyway from a command line +# argument having to do with a path (--prefix etc) +# +# Version: $Id$ +# + +# Location of files. +prefix=@prefix@ +exec_prefix=@exec_prefix@ +sysconfdir=@sysconfdir@ +localstatedir=@localstatedir@ +libdir=@libdir@ +bindir=@bindir@ +sbindir=@sbindir@ +mandir=@mandir@ +logdir=@logdir@ +raddbdir=@raddbdir@ +dictdir=@dictdir@ +radacctdir=@radacctdir@ +datarootdir=@datarootdir@ + +cat <<EOF > radpaths.h +/* Automatically generated by "build-radpaths-h" */ +#define LOGDIR "@logdir@" +#define LIBDIR "@libdir@" +#define RADDBDIR "@raddbdir@" +#define RUNDIR "@localstatedir@/run" +#define SBINDIR "@sbindir@" +#define RADIR "@radacctdir@" +#define DICTDIR "@dictdir@" +EOF + diff --git a/src/include/build.h b/src/include/build.h new file mode 100644 index 0000000..c5eaa45 --- /dev/null +++ b/src/include/build.h @@ -0,0 +1,168 @@ +/** + * $Id$ + * + * @brief Source control functions + * + * @copyright 2013 The FreeRADIUS server project + */ +#ifndef _BUILD_H +#define _BUILD_H +#ifdef __cplusplus +extern "C" { +#endif +#include <freeradius-devel/autoconf.h> /* Needed for endian macros */ + +/* + * The ubiquitous stringify macros + */ +#define XSTRINGIFY(x) #x +#define STRINGIFY(x) XSTRINGIFY(x) +#define JOINSTR(x,y) XSTRINGIFY(x ## y) + +/* + * HEX concatenation macros + */ +#ifndef HEXIFY +# define XHEXIFY4(b1,b2,b3,b4) (0x ## b1 ## b2 ## b3 ## b4) +# define HEXIFY4(b1,b2,b3,b4) XHEXIFY4(b1, b2, b3, b4) + +# define XHEXIFY3(b1,b2,b3) (0x ## b1 ## b2 ## b3) +# define HEXIFY3(b1,b2,b3) XHEXIFY3(b1, b2, b3) + +# define XHEXIFY2(b1,b2) (0x ## b1 ## b2) +# define HEXIFY2(b1,b2) XHEXIFY2(b1, b2) + +# define XHEXIFY(b1) (0x ## b1) +# define HEXIFY(b1) XHEXIFY(b1) +#endif + +/* + * struct field size + */ +#define SIZEOF_MEMBER(_t, _m) sizeof(((_t *)0)->_m) + +/* + * Only use GCC __attribute__ if were building with a GCClike + * compiler. + */ +#ifdef __GNUC__ +# define CC_HINT(...) __attribute__ ((__VA_ARGS__)) +# define likely(_x) __builtin_expect((_x), 1) +# define unlikely(_x) __builtin_expect((_x), 0) +#else +# define CC_HINT(...) +# define likely(_x) _x +# define unlikely(_x) _x +#endif + +#ifdef HAVE_ATTRIBUTE_BOUNDED +# define CC_BOUNDED(_x, ...) CC_HINT(__bounded__(_x, ## __VA_ARGS__)) +#else +# define CC_BOUNDED(...) +#endif + +/* + * GCC uses __SANITIZE_ADDRESS__, clang uses __has_feature, which + * GCC complains about. + */ +#ifndef __SANITIZE_ADDRESS__ +#ifdef __has_feature +#if __has_feature(address_sanitizer) +#define __SANITIZE_ADDRESS__ (1) +#endif +#endif +#endif + +/* + * Macros to add pragmas + */ +#define PRAGMA(_x) _Pragma(#_x) + +/* + * Macros for controlling warnings in GCC >= 4.2 and clang >= 2.8 + */ +#if defined(__GNUC__) && ((__GNUC__ * 100) + __GNUC_MINOR__) >= 402 +# define DIAG_UNKNOWN_PRAGMAS pragmas +# define DIAG_PRAGMA(_x) PRAGMA(GCC diagnostic _x) +# if ((__GNUC__ * 100) + __GNUC_MINOR__) >= 406 +# define DIAG_OFF(_x) DIAG_PRAGMA(push) DIAG_PRAGMA(ignored JOINSTR(-W,_x)) +# define DIAG_ON(_x) DIAG_PRAGMA(pop) +# else +# define DIAG_OFF(_x) DIAG_PRAGMA(ignored JOINSTR(-W,_x)) +# define DIAG_ON(_x) DIAG_PRAGMA(warning JOINSTR(-W,_x)) +# endif +#elif defined(__clang__) && ((__clang_major__ * 100) + __clang_minor__ >= 208) +# define DIAG_UNKNOWN_PRAGMAS unknown-pragmas +# define DIAG_PRAGMA(_x) PRAGMA(clang diagnostic _x) +# define DIAG_OFF(_x) DIAG_PRAGMA(push) DIAG_PRAGMA(ignored JOINSTR(-W,_x)) +# define DIAG_ON(_x) DIAG_PRAGMA(pop) +#else +# define DIAG_UNKNOWN_PRAGMAS +# define DIAG_OFF(_x) +# define DIAG_ON(_x) +#endif + +/* + * GCC and clang use different macros + */ +#ifdef __clang__ +# define DIAG_OPTIONAL DIAG_OFF(unknown-pragmas) +#else +# define DIAG_OPTIONAL DIAG_OFF(pragmas) +#endif + +/* + * For dealing with APIs which are only deprecated in OSX (like the OpenSSL API) + */ +#ifdef __APPLE__ +# define USES_APPLE_DEPRECATED_API DIAG_OFF(deprecated-declarations) +# define USES_APPLE_RST DIAG_ON(deprecated-declarations) +#else +# define USES_APPLE_DEPRECATED_API +# define USES_APPLE_RST +#endif + +#if defined(__GNUC__) +/* force inclusion of ident keywords in the face of optimization */ +# define RCSID(id) static char const rcsid[] __attribute__ ((used)) = id; +# define RCSIDH(h, id) static char const rcsid_ ## h [] __attribute__ ((used)) = id; +#elif defined(__SUNPRO_C) +/* put ident keyword into comment section (nicer than gcc way) */ +# define RCSID(id) PRAGMA(sun ident id) +# define RCSIDH(h, id) PRAGMA(sun ident id) +#else +# define RCSID(id) +# define RCSIDH(h, id) +#endif + +/* + * Try and determine endianness of the target system. + * + * Other projects seem to use endian.h and variants, but these are + * in non standard locations, and may mess up cross compiling. + * + * Here at least the endianness can be set explicitly with + * -DLITTLE_ENDIAN or -DBIG_ENDIAN. + */ +#if !defined(FR_LITTLE_ENDIAN) && !defined(FR_BIG_ENDIAN) +# if defined(__LITTLE_ENDIAN__) || \ + (defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__)) +# define FR_LITTLE_ENDIAN 1 +# elif defined(__BIG_ENDIAN__) || \ + (defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __ORDER_BIG_ENDIAN__)) +# define FR_BIG_ENDIAN 1 +# else +# error Failed determining endianness of system +# endif +#endif + +#define PRINTF_LIKE(n) CC_HINT(format(printf, n, n+1)) +#define NEVER_RETURNS CC_HINT(noreturn) +#define HIDDEN CC_HINT(visibility("hidden")) +#define UNUSED CC_HINT(unused) +#define BLANK_FORMAT " " /* GCC_LINT whines about empty formats */ + +#ifdef __cplusplus +} +#endif +#endif /* _BUILD_H */ diff --git a/src/include/channel.h b/src/include/channel.h new file mode 100644 index 0000000..5b2d7d5 --- /dev/null +++ b/src/include/channel.h @@ -0,0 +1,55 @@ +#ifndef CHANNEL_H +#define CHANNEL_H + +/* + * channel.h For radmin / server channels. + * Version: $Id$ + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + * + * Copyright 2015 Alan DeKok <aland@deployingradius.com> + */ + +RCSIDH(heap_h, "$Id$") + +#ifdef __cplusplus +extern "C" { +#endif + +typedef enum fr_channel_type_t { + FR_CHANNEL_STDIN = 0, + FR_CHANNEL_STDOUT, + FR_CHANNEL_STDERR, + FR_CHANNEL_CMD_STATUS, + FR_CHANNEL_INIT_ACK, + FR_CHANNEL_AUTH_CHALLENGE, + FR_CHANNEL_AUTH_RESPONSE, + FR_CHANNEL_WANT_MORE +} fr_channel_type_t; + +typedef enum fr_channel_result_t { + FR_CHANNEL_FAIL = 0, + FR_CHANNEL_SUCCESS +} fr_channel_result_t; + +ssize_t fr_channel_drain(int fd, fr_channel_type_t *pchannel, void *inbuf, size_t buflen, uint8_t **outbuf, size_t have_read); +ssize_t fr_channel_read(int fd, fr_channel_type_t *pchannel, void *buffer, size_t buflen); +ssize_t fr_channel_write(int fd, fr_channel_type_t channel, void const *buffer, size_t buflen); + +#ifdef __cplusplus +} +#endif + +#endif /* CHANNEL_H */ diff --git a/src/include/clients.h b/src/include/clients.h new file mode 100644 index 0000000..46b5b3b --- /dev/null +++ b/src/include/clients.h @@ -0,0 +1,174 @@ +/* + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * the Free Software Foundation; either version 2 of the License, or (at + * your option) any later version. either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + */ +#ifndef CLIENTS_H +#define CLIENTS_H +/* + * $Id$ + * + * @file clients.h + * @brief Function declarations and structures to manage clients. + * + * @author Arran Cudbard-Bell <a.cudbardb@freeradius.org> + * @copyright 2015 The FreeRADIUS server project + */ + +typedef struct radclient_list RADCLIENT_LIST; + + +/** Describes a host allowed to send packets to the server + * + */ +typedef struct radclient { + RADCLIENT_LIST *list; //!< parent list + fr_ipaddr_t ipaddr; //!< IPv4/IPv6 address of the host. + fr_ipaddr_t src_ipaddr; //!< IPv4/IPv6 address to send responses + //!< from (family must match ipaddr). + + char const *longname; //!< Client identifier. + char const *shortname; //!< Client nickname. + + char const *secret; //!< Secret PSK. + + bool message_authenticator; //!< Require RADIUS message authenticator in requests. + + char const *nas_type; //!< Type of client (arbitrary). + + char const *login; //!< Username to use for simultaneous use checks. + char const *password; //!< Password to use for simultaneous use checks. + + char const *server; //!< Virtual server client is associated with. + + int number; //!< Unique client number. + + CONF_SECTION *cs; //!< CONF_SECTION that was parsed to generate the client. + +#ifdef WITH_STATS + fr_stats_t auth; //!< Authentication stats. +# ifdef WITH_ACCOUNTING + fr_stats_t acct; //!< Accounting stats. +# endif +# ifdef WITH_COA + fr_stats_t coa; //!< Change of Authorization stats. + fr_stats_t dsc; //!< Disconnect-Request stats. +# endif +#endif + + struct timeval response_window; //!< How long the client has to respond. + + int proto; //!< Protocol number. +#ifdef WITH_TCP + fr_socket_limit_t limit; //!< Connections per client (TCP clients only). +#endif +#ifdef WITH_TLS + bool tls_required; //!< whether TLS encryption is required. + +#ifdef WITH_RADIUSV11 + char const *radiusv11_name; + fr_radiusv11_t radiusv11; +#endif +#endif + +#ifdef WITH_DYNAMIC_CLIENTS + uint32_t lifetime; //!< How long before the client is removed. + uint32_t dynamic; //!< Whether the client was dynamically defined. + time_t created; //!< When the client was created. + + time_t last_new_client; //!< Used for relate limiting addition and deletion of + //!< dynamic clients. + + char const *client_server; //!< Virtual server associated with this dynamic client. + //!< Only used where client specifies a network of potential + //!< clients. + + bool rate_limit; //!< Where addition of clients should be rate limited. + fr_event_t *ev; //!< for deleting dynamic clients +#endif + +#ifdef WITH_COA + char const *coa_name; //!< Name of the CoA home server or pool. + home_server_t *coa_home_server; //!< The CoA home_server_t the client is associated with. + //!< Must be used exclusively from coa_pool. + home_pool_t *coa_home_pool; //!< The CoA home_pool_t the client is associated with. + //!< Must be used exclusively from coa_server. + bool defines_coa_server; //!< Client also defines a home_server. +#endif +} RADCLIENT; + +/** Callback for retrieving values when building client sections + * + * Example: + @code{.c} + int _client_value_cb(char **out, CONF_PAIR const *cp, void *data) + { + my_result *result = data; + char *value; + + value = get_attribute_from_result(result, cf_pair_value(cp)); + if (!value) { + *out = NULL; + return 0; + } + + *out = talloc_strdup(value); + free_attribute(value); + + if (!*out) return -1; + return 0; + } + @endcode + * + * @param[out] out Where to write a pointer to the talloced value buffer. + * @param[in] cp The value of the CONF_PAIR specifies the attribute name to retrieve from the result. + * @param[in] data Pointer to the result struct to copy values from. + * @return 0 on success -1 on failure. + */ +typedef int (*client_value_cb_t)(char **out, CONF_PAIR const *cp, void *data); + +RADCLIENT_LIST *client_list_init(CONF_SECTION *cs); + +void client_list_free(RADCLIENT_LIST *clients); + +RADCLIENT_LIST *client_list_parse_section(CONF_SECTION *section, bool tls_required); + +void client_free(RADCLIENT *client); + +bool client_add(RADCLIENT_LIST *clients, RADCLIENT *client); + +#ifdef WITH_DYNAMIC_CLIENTS +void client_delete(RADCLIENT_LIST *clients, RADCLIENT *client); + +RADCLIENT *client_afrom_request(RADCLIENT_LIST *clients, REQUEST *request); +#endif + +int client_map_section(CONF_SECTION *out, CONF_SECTION const *map, client_value_cb_t func, void *data); + +RADCLIENT *client_afrom_cs(TALLOC_CTX *ctx, CONF_SECTION *cs, bool in_server, bool with_coa); + +RADCLIENT *client_afrom_query(TALLOC_CTX *ctx, char const *identifier, char const *secret, char const *shortname, + char const *type, char const *server, bool require_ma) + CC_HINT(nonnull(2, 3)); + +RADCLIENT *client_find(RADCLIENT_LIST const *clients, fr_ipaddr_t const *ipaddr, int proto); + +RADCLIENT *client_findbynumber(RADCLIENT_LIST const *clients, int number); + +RADCLIENT *client_find_old(fr_ipaddr_t const *ipaddr); + +bool client_add_dynamic(RADCLIENT_LIST *clients, RADCLIENT *master, RADCLIENT *c); + +RADCLIENT *client_read(char const *filename, int in_server, int flag); +#endif /* CLIENTS_H */ diff --git a/src/include/conf.h b/src/include/conf.h new file mode 100644 index 0000000..95005d5 --- /dev/null +++ b/src/include/conf.h @@ -0,0 +1,23 @@ +/* Default Database File Names */ + +#define RADIUS_DIR RADDBDIR +#define RADACCT_DIR RADIR +#define L_DST_DIR LOGDIR + +#define RADIUS_DICTIONARY "dictionary" +#define RADIUS_CLIENTS "clients" +#define RADIUS_NASLIST "naslist" +#define RADIUS_REALMS "realms" + +#define RADUTMP LOGDIR "/radutmp" +#define SRADUTMP LOGDIR "/sradutmp" +#define RADWTMP LOGDIR "/radwtmp" +#define SRADWTMP LOGDIR "/sradwtmp" + +#ifdef __APPLE__ +# define LT_SHREXT ".dylib" +#elif defined (WIN32) +# define LT_SHREXT ".dll" +#else +# define LT_SHREXT ".so" +#endif diff --git a/src/include/conffile.h b/src/include/conffile.h new file mode 100644 index 0000000..b996881 --- /dev/null +++ b/src/include/conffile.h @@ -0,0 +1,306 @@ +#ifndef _CONFFILE_H +#define _CONFFILE_H + +/* + * conffile.h Defines for the conffile parsing routines. + * + * Version: $Id$ + * + */ + +RCSIDH(conffile_h, "$Id$") + +#include <stddef.h> +#include <freeradius-devel/token.h> +#include <sys/time.h> + +#ifdef __cplusplus +extern "C" { +#endif + +/* + * Export the minimum amount of information about these structs + */ +typedef struct conf_item CONF_ITEM; //!< Generic configuration element, extended to become + ///< a #CONF_PAIR, a #CONF_SECTION or #CONF_DATA. +typedef struct conf_pair CONF_PAIR; //!< #CONF_ITEM with an attribute, an operator and a value. +typedef struct conf_part CONF_SECTION; //!< #CONF_ITEM used to group multiple #CONF_PAIR and #CONF_SECTION, together. +typedef struct conf_data CONF_DATA; //!< #CONF_ITEM used to associate arbitrary data + ///< with a #CONF_PAIR or #CONF_SECTION. + + +typedef void conf_type_mismatch; //!< Dummy type used to indicate PW_TYPE_*/C type mismatch. +typedef void conf_type_invalid; //!< Dummy type used to indicate invalid PW_TYPE_*. + +#if defined(HAVE_BUILTIN_CHOOSE_EXPR) && defined(HAVE_BUILTIN_TYPES_COMPATIBLE_P) +/* + * Dumb hack for GCC which explodes with lots of errors masking the real + * error cause, if we don't use typdefs for these structures. + */ +typedef struct timeval _timeval_t; + +/** Check the type #_t matches the destination data type + * + * Validation macro to check the type of the pointer or offset #_p passed in + * matches the type #_t of the configuration item. + * + * Uses various magic builtin precompilation functions, so will likely only + * work with recent versions of clang and gcc. + * + * @note The warnings/errors emitted are usually awful. + * + * @param _t a #PW_TYPE value with optional PW_TYPE_* flags. + * @param _ct data type of global or struct field, obtained with ``__typeof__``. + * @param _p Pointer or offset. + */ +# define FR_CONF_TYPE_CHECK(_t, _ct, _p) \ + __builtin_choose_expr((_t & PW_TYPE_TMPL),\ + __builtin_choose_expr(__builtin_types_compatible_p(vp_tmpl_t **, _ct), _p, (conf_type_mismatch) 0),\ + __builtin_choose_expr((((_t) & 0xff) == PW_TYPE_STRING),\ + __builtin_choose_expr(__builtin_types_compatible_p(char const **, _ct), _p, (conf_type_mismatch) 0),\ + __builtin_choose_expr((((_t) & 0xff) == PW_TYPE_BOOLEAN),\ + __builtin_choose_expr(__builtin_types_compatible_p(bool *, _ct), _p, (conf_type_mismatch) 0),\ + __builtin_choose_expr((((_t) & 0xff) == PW_TYPE_SUBSECTION),\ + _p,\ + __builtin_choose_expr((((_t) & 0xff) == PW_TYPE_INTEGER),\ + __builtin_choose_expr(__builtin_types_compatible_p(uint32_t *, _ct), _p, (conf_type_mismatch) 0),\ + __builtin_choose_expr((((_t) & 0xff) == PW_TYPE_IPV4_ADDR),\ + __builtin_choose_expr(__builtin_types_compatible_p(fr_ipaddr_t *, _ct), _p, (conf_type_mismatch) 0),\ + __builtin_choose_expr((((_t) & 0xff) == PW_TYPE_DATE),\ + __builtin_choose_expr(__builtin_types_compatible_p(uint32_t *, _ct), _p, (conf_type_mismatch) 0),\ + __builtin_choose_expr((((_t) & 0xff) == PW_TYPE_ABINARY),\ + __builtin_choose_expr(__builtin_types_compatible_p(size_t[32/sizeof(size_t)], _ct), _p, (conf_type_mismatch) 0),\ + __builtin_choose_expr((((_t) & 0xff) == PW_TYPE_OCTETS),\ + __builtin_choose_expr(__builtin_types_compatible_p(uint8_t *, _ct), _p, (conf_type_mismatch) 0),\ + __builtin_choose_expr((((_t) & 0xff) == PW_TYPE_IFID),\ + __builtin_choose_expr(__builtin_types_compatible_p(uint8_t[8], _ct), _p, (conf_type_mismatch) 0),\ + __builtin_choose_expr((((_t) & 0xff) == PW_TYPE_IPV6_ADDR),\ + __builtin_choose_expr(__builtin_types_compatible_p(fr_ipaddr_t *, _ct), _p, (conf_type_mismatch) 0),\ + __builtin_choose_expr((((_t) & 0xff) == PW_TYPE_IPV6_PREFIX),\ + __builtin_choose_expr(__builtin_types_compatible_p(fr_ipaddr_t *, _ct), _p, (conf_type_mismatch) 0),\ + __builtin_choose_expr((((_t) & 0xff) == PW_TYPE_BYTE),\ + __builtin_choose_expr(__builtin_types_compatible_p(uint8_t *, _ct), _p, (conf_type_mismatch) 0),\ + __builtin_choose_expr((((_t) & 0xff) == PW_TYPE_SHORT),\ + __builtin_choose_expr(__builtin_types_compatible_p(uint16_t *, _ct), _p, (conf_type_mismatch) 0),\ + __builtin_choose_expr((((_t) & 0xff) == PW_TYPE_ETHERNET),\ + __builtin_choose_expr(__builtin_types_compatible_p(uint8_t[6], _ct), _p, (conf_type_mismatch) 0),\ + __builtin_choose_expr((((_t) & 0xff) == PW_TYPE_SIGNED),\ + __builtin_choose_expr(__builtin_types_compatible_p(int32_t *, _ct), _p, (conf_type_mismatch) 0),\ + __builtin_choose_expr((((_t) & 0xff) == PW_TYPE_COMBO_IP_ADDR),\ + __builtin_choose_expr(__builtin_types_compatible_p(fr_ipaddr_t *, _ct), _p, (conf_type_mismatch) 0),\ + __builtin_choose_expr((((_t) & 0xff) == PW_TYPE_INTEGER64),\ + __builtin_choose_expr(__builtin_types_compatible_p(uint64_t *, _ct), _p, (conf_type_mismatch) 0),\ + __builtin_choose_expr((((_t) & 0xff) == PW_TYPE_IPV4_PREFIX),\ + __builtin_choose_expr(__builtin_types_compatible_p(fr_ipaddr_t *, _ct), _p, (conf_type_mismatch) 0),\ + __builtin_choose_expr((((_t) & 0xff) == PW_TYPE_TIMEVAL),\ + __builtin_choose_expr(__builtin_types_compatible_p(_timeval_t *, _ct), _p, (conf_type_mismatch) 0),\ + __builtin_choose_expr((((_t) & 0xff) == PW_TYPE_COMBO_IP_PREFIX),\ + __builtin_choose_expr(__builtin_types_compatible_p(fr_ipaddr_t *, _ct), _p, (conf_type_mismatch) 0),\ + (conf_type_invalid) 0\ + ))))))))))))))))))))) + +# define FR_CONF_OFFSET(_t, _s, _f) _t, FR_CONF_TYPE_CHECK((_t), __typeof__(&(((_s *)NULL)->_f)), offsetof(_s, _f)), NULL +# define FR_CONF_POINTER(_t, _p) _t, 0, FR_CONF_TYPE_CHECK((_t), __typeof__(_p), _p) +# define FR_ITEM_POINTER(_t, _p) _t, FR_CONF_TYPE_CHECK((_t), __typeof__(_p), _p) +#else +# define FR_CONF_OFFSET(_t, _s, _f) _t, offsetof(_s, _f), NULL +# define FR_CONF_POINTER(_t, _p) _t, 0, _p +# define FR_ITEM_POINTER(_t, _p) _t, _p +#endif + +#define FR_CONF_DEPRECATED(_t, _p, _f) (_t) | PW_TYPE_DEPRECATED, 0, NULL + +/* + * Instead of putting the information into a configuration structure, + * the configuration file routines MAY just parse it directly into + * user-supplied variables. + */ +#define PW_TYPE_SUBSECTION 102 + +/** @name #CONF_PARSER type flags + * + * These flags should be or'd with another PW_TYPE_* value to create validation + * rules for the #cf_item_parse function. + * + * @note File PW_TYPE_FILE_* types have a base type of string, so they're validated + * correctly by the config parser. + * @{ + */ +#define PW_TYPE_DEPRECATED (1 << 10) //!< If a matching #CONF_PAIR is found, error out with a deprecated message. +#define PW_TYPE_REQUIRED (1 << 11) //!< Error out if no matching #CONF_PAIR is found, and no dflt value is set. +#define PW_TYPE_ATTRIBUTE (1 << 12) //!< Value must resolve to attribute in dict (deprecated, use #PW_TYPE_TMPL). +#define PW_TYPE_SECRET (1 << 13) //!< Only print value if debug level >= 3. + +#define PW_TYPE_FILE_INPUT ((1 << 14) | PW_TYPE_STRING) //!< File matching value must exist, and must be readable. +#define PW_TYPE_FILE_OUTPUT ((1 << 15) | PW_TYPE_STRING) //!< File matching value must exist, and must be writeable. + +#define PW_TYPE_XLAT (1 << 16) //!< string will be dynamically expanded. +#define PW_TYPE_TMPL (1 << 17) //!< CONF_PAIR should be parsed as a template. + +#define PW_TYPE_MULTI (1 << 18) //!< CONF_PAIR can have multiple copies. +#define PW_TYPE_NOT_EMPTY (1 << 19) //!< CONF_PAIR is required to have a non zero length value. +#define PW_TYPE_FILE_EXISTS ((1 << 20) | PW_TYPE_STRING) //!< File matching value must exist +/* @} **/ + +#define FR_INTEGER_COND_CHECK(_name, _var, _cond, _new)\ +do {\ + if (!(_cond)) {\ + WARN("Ignoring \"" _name " = %i\", forcing to \"" _name " = %i\"", _var, _new);\ + _var = _new;\ + }\ +} while (0) + +#define FR_INTEGER_BOUND_CHECK(_name, _var, _op, _bound) FR_INTEGER_COND_CHECK(_name, _var, (_var _op _bound), _bound) + +#define FR_TIMEVAL_BOUND_CHECK(_name, _var, _op, _bound_sec, _bound_usec)\ +do {\ + struct timeval _bound = {_bound_sec, _bound_usec};\ + if (!timercmp(_var, &_bound, _op)) {\ + WARN("Ignoring \"" _name " = %d.%.06d\", forcing to \"" _name " = %d.%06d\"",\ + (int)(_var)->tv_sec, (int)(_var)->tv_usec,\ + (int)_bound.tv_sec, (int)_bound.tv_usec);\ + *_var = _bound;\ + }\ +} while (0) + +#define FR_TIMEVAL_TO_MS(_x) (((_x)->tv_usec * 1000) + ((_x)->tv_sec / 1000)) +extern bool check_config; + +/** Defines a #CONF_PAIR to C data type mapping + * + * Is typically used to define mappings between module sections, and module instance structs. + * May also be used to set global configuration options. + * + * Offset/data values should be set using #FR_CONF_OFFSET or #FR_CONF_POINTER. + * + * Example with #FR_CONF_OFFSET : + @code{.c} + static CONF_PARSER module_config[] = { + { "example", FR_CONF_OFFSET(PW_TYPE_STRING | PW_TYPE_NOT_EMPTY, example_instance_t, example), "default_value" }, + CONF_PARSER_TERMINATOR + } + @endcode + * + * Example with #FR_CONF_POINTER : + @code{.c} + static CONF_PARSER global_config[] = { + { "example", FR_CONF_POINTER(PW_TYPE_STRING | PW_TYPE_NOT_EMPTY, &my_global), "default_value" }, + CONF_PARSER_TERMINATOR + } + @endcode + * + * @see FR_CONF_OFFSET + * @see FR_CONF_POINTER + * @see cf_section_parse + * @see cf_item_parse + */ +typedef struct CONF_PARSER { + char const *name; //!< Name of the #CONF_ITEM to parse. + int type; //!< A #PW_TYPE value, may be or'd with one or more PW_TYPE_* flags. + //!< @see cf_item_parse. + + size_t offset; //!< Relative offset of field or structure to write the parsed value to. + //!< When #type is set to #PW_TYPE_SUBSECTION, may be used to specify + //!< a base offset to add to all offsets contained within the + //!< subsection. + //!< @note Must be used exclusively to #data. + + void *data; //!< Pointer to a static variable to write the parsed value to. + //!< @note Must be used exclusively to #offset. + + const void *dflt; //!< Default as it would appear in radiusd.conf. + //!< When #type is set to #PW_TYPE_SUBSECTION, should be a pointer + //!< to the start of another array of #CONF_PARSER structs, forming + //!< the subsection. +} CONF_PARSER; + +#define CONF_PARSER_TERMINATOR { NULL, -1, 0, NULL, NULL } + +CONF_PAIR *cf_pair_alloc(CONF_SECTION *parent, char const *attr, char const *value, + FR_TOKEN op, FR_TOKEN lhs_type, FR_TOKEN rhs_type); +CONF_PAIR *cf_pair_dup(CONF_SECTION *parent, CONF_PAIR *cp); +void cf_pair_add(CONF_SECTION *parent, CONF_PAIR *cp); + +CONF_SECTION *cf_section_alloc(CONF_SECTION *parent, char const *name1, char const *name2); +CONF_SECTION *cf_section_dup(CONF_SECTION *parent, CONF_SECTION const *cs, + char const *name1, char const *name2, bool copy_meta); +void cf_section_add(CONF_SECTION *parent, CONF_SECTION *cs); +int cf_pair_replace(CONF_SECTION *cs, CONF_PAIR *cp, char const *value); +int cf_item_parse(CONF_SECTION *cs, char const *name, unsigned int type, void *data, char const *dflt); +int cf_section_parse(CONF_SECTION *, void *base, CONF_PARSER const *variables); +int cf_section_parse_pass2(CONF_SECTION *, void *base, CONF_PARSER const *variables); +const CONF_PARSER *cf_section_parse_table(CONF_SECTION *cs); +int cf_file_read(CONF_SECTION *cs, char const *file); +void cf_file_free(CONF_SECTION *cs); + +CONF_PAIR *cf_pair_find(CONF_SECTION const *, char const *name); +CONF_PAIR *cf_pair_find_next(CONF_SECTION const *, CONF_PAIR const *, char const *name); +CONF_SECTION *cf_section_find(char const *name); +CONF_SECTION *cf_section_find_name2(CONF_SECTION const *section, + char const *name1, char const *name2); +CONF_SECTION *cf_section_sub_find(CONF_SECTION const *, char const *name); +CONF_SECTION *cf_section_sub_find_name2(CONF_SECTION const *, char const *name1, char const *name2); +char const *cf_section_value_find(CONF_SECTION const *, char const *attr); +CONF_SECTION *cf_top_section(CONF_SECTION *cs); + +void *cf_data_find(CONF_SECTION const *, char const *); +int cf_data_add(CONF_SECTION *, char const *, void *, void (*)(void *)); +void *cf_data_remove(CONF_SECTION *cs, char const *name); + +char const *cf_pair_attr(CONF_PAIR const *pair); +char const *cf_pair_value(CONF_PAIR const *pair); +FR_TOKEN cf_pair_operator(CONF_PAIR const *pair); +FR_TOKEN cf_pair_attr_type(CONF_PAIR const *pair); +FR_TOKEN cf_pair_value_type(CONF_PAIR const *pair); +VALUE_PAIR *cf_pairtovp(CONF_PAIR *pair); +char const *cf_section_name1(CONF_SECTION const *cs); +char const *cf_section_name2(CONF_SECTION const *cs); +char const *cf_section_name(CONF_SECTION const *cs); +FR_TOKEN cf_section_name2_type(CONF_SECTION const *cs); +int dump_config(CONF_SECTION const *cs); +CONF_SECTION *cf_subsection_find_next(CONF_SECTION const *section, + CONF_SECTION const *subsection, + char const *name1); +CONF_SECTION *cf_section_find_next(CONF_SECTION const *section, + CONF_SECTION const *subsection, + char const *name1); +int cf_section_lineno(CONF_SECTION const *section); +int cf_pair_lineno(CONF_PAIR const *pair); +char const *cf_pair_filename(CONF_PAIR const *pair); +char const *cf_section_filename(CONF_SECTION const *section); +CONF_ITEM *cf_item_find_next(CONF_SECTION const *section, CONF_ITEM const *item); +int cf_pair_count(CONF_SECTION const *cs); +CONF_SECTION *cf_item_parent(CONF_ITEM const *ci); +bool cf_item_is_section(CONF_ITEM const *item); +bool cf_item_is_pair(CONF_ITEM const *item); +bool cf_item_is_data(CONF_ITEM const *item); +CONF_PAIR *cf_item_to_pair(CONF_ITEM const *item); +CONF_SECTION *cf_item_to_section(CONF_ITEM const *item); +CONF_ITEM *cf_pair_to_item(CONF_PAIR const *cp); +CONF_ITEM *cf_section_to_item(CONF_SECTION const *cs); + +void cf_log_err(CONF_ITEM const *ci, char const *fmt, ...) CC_HINT(format (printf, 2, 3)); +void cf_log_err_cs(CONF_SECTION const *cs, char const *fmt, ...) CC_HINT(format (printf, 2, 3)); +void cf_log_err_cp(CONF_PAIR const *cp, char const *fmt, ...) CC_HINT(format (printf, 2, 3)); +void cf_log_info(CONF_SECTION const *cs, char const *fmt, ...) CC_HINT(format (printf, 2, 3)); +void cf_log_module(CONF_SECTION const *cs, char const *fmt, ...) CC_HINT(format (printf, 2, 3)); + +void cf_item_add(CONF_SECTION *cs, CONF_ITEM *ci); +CONF_ITEM *cf_reference_item(CONF_SECTION const *parentcs, + CONF_SECTION *outercs, + char const *ptr); + +#define CF_FILE_NONE (0) +#define CF_FILE_ERROR (1) +#define CF_FILE_CONFIG (1 << 2) +#define CF_FILE_MODULE (1 << 3) +int cf_file_changed(CONF_SECTION *cs, rb_walker_t callback); + +extern CONF_SECTION *root_config; +extern bool cf_new_escape; + +#ifdef __cplusplus +} +#endif + +#endif /* _CONFFILE_H */ diff --git a/src/include/connection.h b/src/include/connection.h new file mode 100644 index 0000000..1fd4be4 --- /dev/null +++ b/src/include/connection.h @@ -0,0 +1,131 @@ +/* + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + */ +#ifndef FR_CONNECTION_H +#define FR_CONNECTION_H +/** + * $Id$ + * + * @file connection.h + * @brief Structures, prototypes and global variables for server connection pools. + * + * @copyright 2012 The FreeRADIUS server project + * @copyright 2012 Alan DeKok <aland@deployingradius.com> + */ + +RCSIDH(connection_h, "$Id$") + +#include <freeradius-devel/conffile.h> + +#ifdef __cplusplus +extern "C" { +#endif + +typedef struct fr_connection_pool_t fr_connection_pool_t; + +/** Create a new connection handle + * + * This function will be called whenever the connection pool manager needs + * to spawn a new connection, and on reconnect. + * + * Memory should be talloced in the parent context to hold the module's + * connection structure. The parent context is allocated in the NULL + * context, but will be freed when fr_connection_t is freed. + * + * There is no delete callback, so operations such as closing sockets and + * freeing library connection handles should be done by a destructor attached + * to memory allocated beneath ctx. + * + * @note A function pointer matching this prototype must be passed + * to fr_connection_pool_init. + * + * @param[in,out] ctx to allocate memory in. + * @param[in] opaque pointer passed to fr_connection_pool_init. + * @return NULL on error, else a connection handle. + */ +typedef void *(*fr_connection_create_t)(TALLOC_CTX *ctx, void *opaque); + +/** Check a connection handle is still viable + * + * Should check the state of a connection handle. + * + * @note NULL may be passed to fr_connection_pool_init, if there is no way to check + * the state of a connection handle. + * @note Not currently use by connection pool manager. + * @param[in] opaque pointer passed to fr_connection_pool_init. + * @param[in] connection handle returned by fr_connection_create_t. + * @return < 0 on error or if the connection is unusable, else 0. + */ +typedef int (*fr_connection_alive_t)(void *opaque, void *connection); + +/* + * Pool allocation/initialisation + */ +fr_connection_pool_t *fr_connection_pool_module_init(CONF_SECTION *module, + void *opaque, + fr_connection_create_t c, + fr_connection_alive_t a, + char const *prefix); + +/* + * Pool getters + */ +int fr_connection_pool_get_num(fr_connection_pool_t *pool); + +int fr_connection_pool_get_retries(fr_connection_pool_t *pool); + +/* + * Pool management + */ +void fr_connection_pool_free(fr_connection_pool_t *pool); + +/* + * Connection lifecycle + */ +void *fr_connection_get(fr_connection_pool_t *pool); + +void fr_connection_release(fr_connection_pool_t *pool, void *conn); + +void *fr_connection_reconnect(fr_connection_pool_t *pool, void *conn); + +int fr_connection_close(fr_connection_pool_t *pool, void *conn, char const *msg); + +typedef struct { + time_t last_checked; //!< Last time we pruned the connection pool. + time_t last_opened; //!< Last time we opened a connection. + time_t last_closed; //!< Last time we closed a connection. + time_t last_failed; //!< Last time we tried to spawn a connection but failed. + time_t last_throttled; //!< Last time we refused to spawn a connection because + //!< the last connection failed, or we were already spawning + //!< a connection. + time_t last_at_max; //!< Last time we hit the maximum number of allowed + //!< connections. + + uint64_t opened; //!< Number of connections opened over the lifetime + //!< of the pool. + uint64_t closed; //!< Number of connections which were closed for this pool + uint64_t failed; //!< Number of failed connections for this pool. + + uint32_t num; //!< Number of connections in the pool. + uint32_t active; //!< Number of currently reserved connections. +} fr_connection_pool_stats_t; + +fr_connection_pool_stats_t const *fr_connection_pool_stats(CONF_SECTION *cs); + +#ifdef __cplusplus +} +#endif + +#endif /* FR_CONNECTION_H*/ diff --git a/src/include/detail.h b/src/include/detail.h new file mode 100644 index 0000000..5b5539b --- /dev/null +++ b/src/include/detail.h @@ -0,0 +1,97 @@ +#ifndef DETAIL_H +#define DETAIL_H +/* + * detail.h Routines to handle detail files. + * + * Version: $Id$ + * + */ + +RCSIDH(detail_h, "$Id$") + +#ifdef __cplusplus +extern "C" { +#endif + +typedef enum detail_state_t { + STATE_UNOPENED = 0, + STATE_UNLOCKED, + STATE_HEADER, + STATE_READING, + STATE_QUEUED, + STATE_RUNNING, + STATE_NO_REPLY, + STATE_REPLIED +} detail_state_t; + +/* + * Allow people to revert to the old behavior if desired. + * Also, use the old code if we don't have threads. + * FIXME: delete the old (crappy) code, and enable the new + * code to work without threads. One thing at a time... + */ +#ifndef WITHOUT_DETAIL_THREAD +# ifdef HAVE_PTHREAD_H +# define WITH_DETAIL_THREAD (1) +# endif +#endif + +typedef struct listen_detail_t { + fr_event_t *ev; /* has to be first entry (ugh) */ + char const *name; //!< Identifier used in log messages + int delay_time; + char const *filename; + char const *filename_work; + + TALLOC_CTX *ctx; + VALUE_PAIR *vps; + int work_fd; + +#ifdef WITH_DETAIL_THREAD + int master_pipe[2]; + int child_pipe[2]; + pthread_t pthread_id; +#endif + + FILE *fp; + off_t offset; + detail_state_t state; + time_t timestamp; + time_t running; + fr_ipaddr_t client_ip; + + off_t last_offset; + off_t timestamp_offset; + bool done_entry; //!< Are we done reading this entry? + bool track; //!< Do we track progress through the file? + + uint32_t load_factor; /* 1..100 */ + uint32_t poll_interval; + uint32_t retry_interval; + + int signal; + int packets; + int tries; + bool one_shot; + int outstanding; + int has_rtt; + int srtt; + int rttvar; + uint32_t counter; + struct timeval last_packet; + RADCLIENT detail_client; +} listen_detail_t; + +int detail_recv(rad_listen_t *listener); +int detail_send(rad_listen_t *listener, REQUEST *request); +void detail_free(rad_listen_t *this); +int detail_print(rad_listen_t const *this, char *buffer, size_t bufsize); +int detail_encode(UNUSED rad_listen_t *this, UNUSED REQUEST *request); +int detail_decode(UNUSED rad_listen_t *this, UNUSED REQUEST *request); +int detail_parse(CONF_SECTION *cs, rad_listen_t *this); + +#ifdef __cplusplus +} +#endif + +#endif /* DETAIL_H */ diff --git a/src/include/dhcp.h b/src/include/dhcp.h new file mode 100644 index 0000000..01fa781 --- /dev/null +++ b/src/include/dhcp.h @@ -0,0 +1,85 @@ +#ifndef FR_DHCP_H +#define FR_DHCP_H + +/* + * dhcp.h Structures and prototypes for DHCP. + * Why DHCP in a RADIUS server? + * Why not? + * + * Version: $Id$ + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + * + * Copyright 2008 The FreeRADIUS server project + * Copyright 2008 Alan DeKok <aland@deployingradius.com> + */ +RCSIDH(dhcp_h, "$Id$") + +#ifdef __cplusplus +extern "C" { +#endif + +/* + * Not for production use. + */ +RADIUS_PACKET *fr_dhcp_recv(int sockfd); +int fr_dhcp_send(RADIUS_PACKET *packet); + +int fr_dhcp_add_arp_entry(int fd, char const *interface, VALUE_PAIR *hwvp, VALUE_PAIR *clvp); + +int8_t fr_dhcp_attr_cmp(void const *a, void const *b); +ssize_t fr_dhcp_encode_option(TALLOC_CTX *ctx, uint8_t *out, size_t outlen, vp_cursor_t *cursor); +int fr_dhcp_encode(RADIUS_PACKET *packet); +ssize_t fr_dhcp_decode_options(TALLOC_CTX *ctx, VALUE_PAIR **out, uint8_t const *data, size_t len); +int fr_dhcp_decode(RADIUS_PACKET *packet); + +#ifdef HAVE_LINUX_IF_PACKET_H +#include <linux/if_packet.h> +int fr_socket_packet(int iface_index, struct sockaddr_ll *p_ll); +int fr_dhcp_send_raw_packet(int sockfd, struct sockaddr_ll *p_ll, RADIUS_PACKET *packet); +RADIUS_PACKET *fr_dhcp_recv_raw_packet(int sockfd, struct sockaddr_ll *p_ll, RADIUS_PACKET *request); +#endif + +/* + * This is a horrible hack. + */ +#define PW_DHCP_OFFSET (1024) +#define PW_DHCP_DISCOVER (1024 + 1) +#define PW_DHCP_OFFER (1024 + 2) +#define PW_DHCP_REQUEST (1024 + 3) +#define PW_DHCP_DECLINE (1024 + 4) +#define PW_DHCP_ACK (1024 + 5) +#define PW_DHCP_NAK (1024 + 6) +#define PW_DHCP_RELEASE (1024 + 7) +#define PW_DHCP_INFORM (1024 + 8) +#define PW_DHCP_LEASE_QUERY (1024 + 10) + +#define DHCP_MAGIC_VENDOR (54) + +#define PW_DHCP_OPTION_82 (82) +#define DHCP_PACK_OPTION1(x,y) ((x) | ((y) << 8)) +#define DHCP_BASE_ATTR(x) (x & 0xff) +#define DHCP_UNPACK_OPTION1(x) (((x) & 0xff00) >> 8) + +#define PW_DHCP_MESSAGE_TYPE (53) +#define PW_DHCP_YOUR_IP_ADDRESS (264) +#define PW_DHCP_SUBNET_MASK (1) +#define PW_DHCP_IP_ADDRESS_LEASE_TIME (51) + +#ifdef __cplusplus +} +#endif + +#endif /* FR_DHCP_H */ diff --git a/src/include/event.h b/src/include/event.h new file mode 100644 index 0000000..0409728 --- /dev/null +++ b/src/include/event.h @@ -0,0 +1,67 @@ +#ifndef FR_EVENT_H +#define FR_EVENT_H + +/* + * event.h Simple event queue + * + * Version: $Id$ + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + * + * Copyright 2007 The FreeRADIUS server project + * Copyright 2007 Alan DeKok <aland@deployingradius.com> + */ + +RCSIDH(event_h, "$Id$") + +#ifdef __cplusplus +extern "C" { +#endif + +typedef struct fr_event_list_t fr_event_list_t; +typedef struct fr_event_t fr_event_t; + +typedef void (*fr_event_callback_t)(void *); +typedef void (*fr_event_status_t)(struct timeval *); +typedef void (*fr_event_fd_handler_t)(fr_event_list_t *el, int sock, void *ctx); + +fr_event_list_t *fr_event_list_create(TALLOC_CTX *ctx, fr_event_status_t status); + +int fr_event_list_num_fds(fr_event_list_t *el); +int fr_event_list_num_elements(fr_event_list_t *el); + +int fr_event_insert(fr_event_list_t *el, + fr_event_callback_t callback, + void *ctx, struct timeval *when, fr_event_t **parent); +int fr_event_delete(fr_event_list_t *el, fr_event_t **parent); + +int fr_event_run(fr_event_list_t *el, struct timeval *when); + +int fr_event_now(fr_event_list_t *el, struct timeval *when); + +int fr_event_fd_insert(fr_event_list_t *el, int type, int fd, + fr_event_fd_handler_t handler, void *ctx); +int fr_event_fd_write_handler(fr_event_list_t *el, int type, int fd, + fr_event_fd_handler_t write_handler, void *ctx); +int fr_event_fd_delete(fr_event_list_t *el, int type, int fd); +int fr_event_loop(fr_event_list_t *el); +void fr_event_loop_exit(fr_event_list_t *el, int code); +bool fr_event_loop_exiting(fr_event_list_t *el); + +#ifdef __cplusplus +} +#endif + +#endif /* FR_HASH_H */ diff --git a/src/include/exfile.h b/src/include/exfile.h new file mode 100644 index 0000000..febe2e6 --- /dev/null +++ b/src/include/exfile.h @@ -0,0 +1,45 @@ +/* + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + */ +#ifndef EXFILE_H +#define EXFILE_H +/* + * $Id$ + * + * @file exfile.h + * @brief Functions for managing concurrent file access. + * + * @copyright 2014 The FreeRADIUS server project + */ +RCSIDH(exfile_h, "$Id$") + +#ifdef __cplusplus +extern "C" { +#endif + + +/* + * Multiple threads logging to one or more files. + */ +typedef struct exfile_t exfile_t; + +exfile_t *exfile_init(TALLOC_CTX *ctx, uint32_t entries, uint32_t idle, bool locking); +int exfile_open(exfile_t *lf, char const *filename, mode_t permissions, off_t *offset); +int exfile_close(exfile_t *lf, int fd); + +#ifdef __cplusplus +} +#endif +#endif diff --git a/src/include/features-h b/src/include/features-h new file mode 100644 index 0000000..158541f --- /dev/null +++ b/src/include/features-h @@ -0,0 +1,97 @@ +/* + * New defines for minimizing the size of the server, to strip + * out functionality. + * + * This is a hack and should be removed when the protocols are moved + * into individual modules. + */ +#ifndef WITHOUT_PROXY +# define WITH_PROXY (1) +#else +# define WITHOUT_COA (1) +#endif + +#ifndef WITHOUT_UNLANG +# define WITH_UNLANG (1) +#endif + +#ifndef WITHOUT_ACCOUNTING +# define WITH_ACCOUNTING (1) +#endif + +#ifdef WITH_ACCOUNTING +# ifndef WITHOUT_DETAIL +# define WITH_DETAIL (1) +# endif +#endif + +#ifdef WITH_ACCOUNTING +# ifndef WITHOUT_SESSION_MGMT +# define WITH_SESSION_MGMT (1) +# endif +#endif + +#ifndef WITHOUT_DYNAMIC_CLIENTS +# define WITH_DYNAMIC_CLIENTS (1) +#endif + +#ifndef WITHOUT_STATS +# define WITH_STATS +#endif + +#ifndef WITHOUT_COMMAND_SOCKET +# ifdef HAVE_SYS_UN_H +# define WITH_COMMAND_SOCKET (1) +# endif +#endif + +#ifndef WITHOUT_COA +# define WITH_COA (1) +# ifndef WITH_PROXY +# error WITH_COA requires WITH_PROXY +# endif +#endif + +#ifdef WITHOUT_TLS +# ifndef HAVE_OPENSSL_SSL_H +# error TLS requires OpenSSL +# endif +#else +# ifdef HAVE_OPENSSL_SSL_H +# ifndef WITH_TLS +# ifndef NO_OPENSSL +# define WITH_TLS (1) +# endif +# endif +# endif +#endif + +#ifdef WITH_TLS +# ifdef WITH_COA +# ifndef WITHOUT_COA_TUNNEL +# define WITH_COA_TUNNEL (1) +# endif +# endif +#endif + +#ifdef WITH_COA_TUNNEL +# ifdef WITHOUT_TLS +# error Reverse CoA requests requires TLS +# endif +#endif + +#ifdef WITH_RADIUSV11_ONLY +# define WITH_RADIUSV11 +#else +# ifndef WITHOUT_RADIUSV11 +# ifdef WITH_TLS +//# define WITH_RADIUSV11 +# endif +# endif +#endif + +#ifdef WITH_RADIUSV11 +# ifndef WITH_TLS +# error RADIUSv11 requires TLS +# endif +#endif diff --git a/src/include/hash.h b/src/include/hash.h new file mode 100644 index 0000000..71c8658 --- /dev/null +++ b/src/include/hash.h @@ -0,0 +1,75 @@ +#ifndef FR_HASH_H +#define FR_HASH_H + +/* + * hash.h Structures and prototypes + * for fast hashing. + * + * Version: $Id$ + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + * + * Copyright 2005,2006 The FreeRADIUS server project + */ + +RCSIDH(hash_h, "$Id$") + +#ifdef __cplusplus +extern "C" { +#endif + +/* + * Fast hash, which isn't too bad. Don't use for cryptography, + * just for hashing internal data. + */ +uint32_t fr_hash(void const *, size_t); +uint32_t fr_hash_update(void const *data, size_t size, uint32_t hash); +uint32_t fr_hash_string(char const *p); + +typedef struct fr_hash_table_t fr_hash_table_t; +typedef void (*fr_hash_table_free_t)(void *); +typedef uint32_t (*fr_hash_table_hash_t)(void const *); +typedef int (*fr_hash_table_cmp_t)(void const *, void const *); +typedef int (*fr_hash_table_walk_t)(void * /* ctx */, void * /* data */); + +fr_hash_table_t *fr_hash_table_create(fr_hash_table_hash_t hashNode, + fr_hash_table_cmp_t cmpNode, + fr_hash_table_free_t freeNode); +void fr_hash_table_free(fr_hash_table_t *ht); +int fr_hash_table_insert(fr_hash_table_t *ht, void const *data); +int fr_hash_table_delete(fr_hash_table_t *ht, void const *data); +void *fr_hash_table_yank(fr_hash_table_t *ht, void const *data); +int fr_hash_table_replace(fr_hash_table_t *ht, void const *data); +void *fr_hash_table_finddata(fr_hash_table_t *ht, void const *data); +int fr_hash_table_num_elements(fr_hash_table_t *ht); +int fr_hash_table_walk(fr_hash_table_t *ht, + fr_hash_table_walk_t callback, + void *ctx); + +typedef struct fr_hash_entry_s fr_hash_entry_t; + +typedef struct fr_hash_iter_s { + uint32_t bucket; + fr_hash_entry_t *node; +} fr_hash_iter_t; + +void *fr_hash_table_iter_init(fr_hash_table_t *ht, fr_hash_iter_t *iter); +void *fr_hash_table_iter_next(fr_hash_table_t *ht, fr_hash_iter_t *iter); + +#ifdef __cplusplus +} +#endif + +#endif /* FR_HASH_H */ diff --git a/src/include/heap.h b/src/include/heap.h new file mode 100644 index 0000000..d980adb --- /dev/null +++ b/src/include/heap.h @@ -0,0 +1,46 @@ +#ifndef LRAD_HEAP_H +#define LRAD_HEAP_H + +/* + * heap.h Structures and prototypes for binary heaps. + * Version: $Id$ + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + * + * Copyright 2007 Alan DeKok + */ + +RCSIDH(heap_h, "$Id$") + +#ifdef __cplusplus +extern "C" { +#endif + +typedef int (*fr_heap_cmp_t)(void const *, void const *); + +typedef struct fr_heap_t fr_heap_t; +fr_heap_t *fr_heap_create(fr_heap_cmp_t cmp, size_t offset); +void fr_heap_delete(fr_heap_t *hp); + +int fr_heap_insert(fr_heap_t *hp, void *data); +int fr_heap_extract(fr_heap_t *hp, void *data); +void *fr_heap_peek(fr_heap_t *hp); +int fr_heap_num_elements(fr_heap_t *hp); + +#ifdef __cplusplus +} +#endif + +#endif /* LRAD_HEAP_H */ diff --git a/src/include/libradius.h b/src/include/libradius.h new file mode 100644 index 0000000..777927e --- /dev/null +++ b/src/include/libradius.h @@ -0,0 +1,967 @@ +/* + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + */ +#ifndef LIBRADIUS_H +#define LIBRADIUS_H +/* + * $Id$ + * + * @file libradius.h + * @brief Structures and prototypes for the radius library. + * + * @copyright 1999-2014 The FreeRADIUS server project + */ +RCSIDH(libradius_h, "$Id$") + +/* + * Compiler hinting macros. Included here for 3rd party consumers + * of libradius.h. + */ +#include <freeradius-devel/build.h> + +/* + * Let any external program building against the library know what + * features the library was built with. + */ +#include <freeradius-devel/features.h> + +#ifdef WITHOUT_VERSION_CHECK +# define RADIUSD_MAGIC_NUMBER ((uint64_t) (0xf4ee4ad3f4ee4ad3)) +# define MAGIC_PREFIX(_x) ((uint8_t) 0x00) +# define MAGIC_VERSION(_x) ((uint32_t) 0x00000000) +# define MAGIC_COMMIT(_x) ((uint32_t) 0x00000000) +#else +# ifdef RADIUSD_VERSION_COMMIT +# define RADIUSD_MAGIC_NUMBER ((uint64_t) HEXIFY3(f, RADIUSD_VERSION, RADIUSD_VERSION_COMMIT)) +# else +# define RADIUSD_MAGIC_NUMBER ((uint64_t) HEXIFY3(f, RADIUSD_VERSION, 00000)) +# endif +# define MAGIC_PREFIX(_x) ((uint8_t) (_x >> 56)) +# define MAGIC_VERSION(_x) ((uint32_t) ((_x >> 32) & 0x00ffffff)) +# define MAGIC_COMMIT(_x) ((uint32_t) (_x & 0xffffffff)) +#endif + +/* + * Talloc memory allocation is used in preference to malloc throughout + * the libraries and server. + */ +#ifdef HAVE_WDOCUMENTATION +DIAG_OFF(documentation) +#endif +#include <talloc.h> +#ifdef HAVE_WDOCUMENTATION +DIAG_ON(documentation) +#endif + +/* + * Defines signatures for any missing functions. + */ +#include <freeradius-devel/missing.h> + +/* + * Include system headers. + */ +#include <stdio.h> +#include <stdlib.h> +#include <stdarg.h> +#include <stdbool.h> +#include <signal.h> + +#ifdef HAVE_LIMITS_H +# include <limits.h> +#endif + +#include <freeradius-devel/threads.h> +#include <freeradius-devel/radius.h> +#include <freeradius-devel/token.h> +#include <freeradius-devel/hash.h> +#include <freeradius-devel/regex.h> + +#ifdef SIZEOF_UNSIGNED_INT +# if SIZEOF_UNSIGNED_INT != 4 +# error FATAL: sizeof(unsigned int) != 4 +# endif +#endif + +/* + * Include for modules. + */ +#include <freeradius-devel/sha1.h> +#include <freeradius-devel/md4.h> + +#ifdef __cplusplus +extern "C" { +#endif + +#ifndef HAVE_SIG_T +typedef void (*sig_t)(int); +#endif + +#if defined(WITH_VERIFY_PTR) +# define FREE_MAGIC (0xF4EEF4EE) + +/* + * @FIXME + * Add if (_x->da) (void) talloc_get_type_abort(_x->da, DICT_ATTR); + * to the macro below when dictionaries are talloced. + */ +# define VERIFY_VP(_x) fr_pair_verify(__FILE__, __LINE__, _x) +# define VERIFY_LIST(_x, _name) fr_pair_list_verify(__FILE__, __LINE__, NULL, _x, _name) +# define VERIFY_PACKET(_x) (void) talloc_get_type_abort(_x, RADIUS_PACKET) +#else +/* + * Even if were building without WITH_VERIFY_PTR + * the pointer must not be NULL when these various macros are used + * so we can add some sneaky soft asserts. + */ +# define VERIFY_VP(_x) fr_assert(_x) +# define VERIFY_LIST(_x, _name) fr_assert(_x) +# define VERIFY_PACKET(_x) fr_assert(_x) +#endif + +#define AUTH_VECTOR_LEN 16 +#define CHAP_VALUE_LENGTH 16 +#define MAX_STRING_LEN 254 /* RFC2138: string 0-253 octets */ +#define FR_MAX_VENDOR (1 << 24) /* RFC limitations */ + +#ifdef _LIBRADIUS +# define RADIUS_HDR_LEN 20 +# define VENDORPEC_USR 429 +# define VENDORPEC_LUCENT 4846 +# define VENDORPEC_STARENT 8164 +# define DEBUG if (fr_debug_lvl && fr_log_fp) fr_printf_log +#endif + +# define debug_pair(vp) do { if (fr_debug_lvl && fr_log_fp) { \ + vp_print(fr_log_fp, vp); \ + } \ + } while(0) + +#define TAG_VALID(x) ((x) > 0 && (x) < 0x20) +#define TAG_VALID_ZERO(x) ((x) < 0x20) +#define TAG_ANY INT8_MIN +#define TAG_NONE 0 +/** Check if tags are equal + * + * @param _x tag were matching on. + * @param _y tag belonging to the attribute were checking. + */ +#define TAG_EQ(_x, _y) ((_x == _y) || (_x == TAG_ANY) || ((_x == TAG_NONE) && (_y == TAG_ANY))) +#define ATTRIBUTE_EQ(_x, _y) ((_x && _y) && (_x->da == _y->da) && (!_x->da->flags.has_tag || TAG_EQ(_x->tag, _y->tag))) + +#define NUM_ANY INT_MIN +#define NUM_ALL (INT_MIN + 1) +#define NUM_COUNT (INT_MIN + 2) +#define NUM_LAST (INT_MIN + 3) + +#define PAD(_x, _y) (_y - ((_x) % _y)) + +typedef struct attr_flags { + unsigned int is_unknown : 1; //!< Attribute number or vendor is unknown. + unsigned int is_tlv : 1; //!< Is a sub attribute. + + unsigned int has_tag : 1; //!< Tagged attribute. + unsigned int array : 1; //!< Pack multiples into 1 attr. + unsigned int has_value : 1; //!< Has a value. + unsigned int has_value_alias : 1; //!< Has a value alias. + unsigned int has_tlv : 1; //!< Has sub attributes. + + unsigned int extended : 1; //!< Extended attribute. + unsigned int long_extended : 1; //!< Long format. + unsigned int evs : 1; //!< Extended VSA. + unsigned int wimax: 1; //!< WiMAX format=1,1,c. + + unsigned int concat : 1; //!< concatenate multiple instances + unsigned int is_pointer : 1; //!< data is a pointer + + unsigned int virtual : 1; //!< for dynamic expansion + + unsigned int compare : 1; //!< has a paircompare registered + + unsigned int is_dup : 1; //!< is a duplicate of another attribute + + unsigned int secret : 1; //!< is a secret thingy + + uint8_t encrypt; //!< Ecryption method. + uint8_t length; +} ATTR_FLAGS; + +/* + * Values of the encryption flags. + */ +#define FLAG_ENCRYPT_NONE (0) +#define FLAG_ENCRYPT_USER_PASSWORD (1) +#define FLAG_ENCRYPT_TUNNEL_PASSWORD (2) +#define FLAG_ENCRYPT_ASCEND_SECRET (3) + +extern const FR_NAME_NUMBER dict_attr_types[]; +extern const size_t dict_attr_sizes[PW_TYPE_MAX][2]; +extern const int fr_attr_max_tlv; +extern const int fr_attr_shift[]; +extern const unsigned int fr_attr_mask[]; + +/** dictionary attribute + * + */ +typedef struct dict_attr { + unsigned int attr; + PW_TYPE type; + unsigned int vendor; + ATTR_FLAGS flags; + char name[1]; +} DICT_ATTR; + +/** value of an enumerated attribute + * + */ +typedef struct dict_value { + unsigned int attr; + unsigned int vendor; + int value; + char name[1]; +} DICT_VALUE; + +/** dictionary vendor + * + */ +typedef struct dict_vendor { + unsigned int vendorpec; + size_t type; //!< Length of type data + size_t length; //!< Length of length data + size_t flags; + char name[1]; +} DICT_VENDOR; + +/** Union containing all data types supported by the server + * + * This union contains all data types that can be represented by VALUE_PAIRs. It may also be used in other parts + * of the server where values of different types need to be stored. + * + * PW_TYPE should be an enumeration of the values in this union. + */ +typedef union value_data { + char const *strvalue; //!< Pointer to UTF-8 string. + uint8_t const *octets; //!< Pointer to binary string. + uint32_t integer; //!< 32bit unsigned integer. + struct in_addr ipaddr; //!< IPv4 Address. + uint32_t date; //!< Date (32bit Unix timestamp). + size_t filter[32/sizeof(size_t)]; //!< Ascend binary format a packed data + //!< structure. + + uint8_t ifid[8]; //!< IPv6 interface ID (should be struct?). + struct in6_addr ipv6addr; //!< IPv6 Address. + uint8_t ipv6prefix[18]; //!< IPv6 prefix (should be struct?). + + uint8_t byte; //!< 8bit unsigned integer. + uint16_t ushort; //!< 16bit unsigned integer. + + uint8_t ether[6]; //!< Ethernet (MAC) address. + + int32_t sinteger; //!< 32bit signed integer. + uint64_t integer64; //!< 64bit unsigned integer. + + uint8_t ipv4prefix[6]; //!< IPv4 prefix (should be struct?). + + void *ptr; //!< generic pointer. +} value_data_t; + +/** The type of value a VALUE_PAIR contains + * + * This is used to add structure to nested VALUE_PAIRs and specifies what type of node it is (set, list, data). + * + * xlat is another type of data node which must first be expanded before use. + */ +typedef enum value_type { + VT_NONE = 0, //!< VALUE_PAIR has no value. + VT_SET, //!< VALUE_PAIR has children. + VT_LIST, //!< VALUE_PAIR has multiple values. + VT_DATA, //!< VALUE_PAIR has a single value. + VT_XLAT //!< valuepair value must be xlat expanded when it's + //!< added to VALUE_PAIR tree. +} value_type_t; + +/** Stores an attribute, a value and various bits of other data + * + * VALUE_PAIRs are the main data structure used in the server + * + * They also specify what behaviour should be used when the attribute is merged into a new list/tree. + */ +typedef struct value_pair { + DICT_ATTR const *da; //!< Dictionary attribute defines the attribute + //!< number, vendor and type of the attribute. + + struct value_pair *next; + + FR_TOKEN op; //!< Operator to use when moving or inserting + //!< valuepair into a list. + + int8_t tag; //!< Tag value used to group valuepairs. + + union { + // VALUE_SET *set; //!< Set of child attributes. + // VALUE_LIST *list; //!< List of values for + //!< multivalued attribute. + // value_data_t *data; //!< Value data for this attribute. + + char const *xlat; //!< Source string for xlat expansion. + } value; + + value_type_t type; //!< Type of pointer in value union. + + size_t length; //!< of Data field. + value_data_t data; +} VALUE_PAIR; + +/** Abstraction to allow iterating over different configurations of VALUE_PAIRs + * + * This allows functions which do not care about the structure of collections of VALUE_PAIRs + * to iterate over all members in a collection. + * + * Field within a vp_cursor should not be accessed directly, and vp_cursors should only be + * manipulated with the pair* functions. + */ +typedef struct vp_cursor { + VALUE_PAIR **first; + VALUE_PAIR *found; //!< pairfind marker. + VALUE_PAIR *last; //!< Temporary only used for fr_cursor_insert + VALUE_PAIR *current; //!< The current attribute. + VALUE_PAIR *next; //!< Next attribute to process. +} vp_cursor_t; + +/** A VALUE_PAIR in string format. + * + * Used to represent pairs in the legacy 'users' file format. + */ +typedef struct value_pair_raw { + char l_opand[256]; //!< Left hand side of the pair. + char r_opand[1024]; //!< Right hand side of the pair. + + FR_TOKEN quote; //!< Type of quoting around the r_opand. + + FR_TOKEN op; //!< Operator. +} VALUE_PAIR_RAW; + +#define vp_strvalue data.strvalue +#define vp_integer data.integer +#define vp_ipaddr data.ipaddr.s_addr +#define vp_date data.date +#define vp_filter data.filter +#define vp_octets data.octets +#define vp_ifid data.ifid +#define vp_ipv6addr data.ipv6addr +#define vp_ipv6prefix data.ipv6prefix +#define vp_byte data.byte +#define vp_short data.ushort +#define vp_ether data.ether +#define vp_signed data.sinteger +#define vp_integer64 data.integer64 +#define vp_ipv4prefix data.ipv4prefix +#define vp_length length + +typedef struct fr_ipaddr_t { + int af; /* address family */ + union { + struct in_addr ip4addr; + struct in6_addr ip6addr; /* maybe defined in missing.h */ + } ipaddr; + uint8_t prefix; + uint32_t scope; /* for IPv6 */ +} fr_ipaddr_t; + +/* + * vector: Request authenticator from access-request packet + * Put in there by rad_decode, and must be put in the + * response RADIUS_PACKET as well before calling rad_send + * + * verified: Filled in by rad_decode for accounting-request packets + * + * data,data_len: Used between rad_recv and rad_decode. + */ +typedef struct radius_packet { + int sockfd; + fr_ipaddr_t src_ipaddr; + fr_ipaddr_t dst_ipaddr; + uint16_t src_port; + uint16_t dst_port; + int id; + unsigned int code; + uint8_t vector[AUTH_VECTOR_LEN]; + struct timeval timestamp; + uint8_t *data; + size_t data_len; + VALUE_PAIR *vps; + ssize_t offset; +#ifdef WITH_TCP + size_t partial; + int proto; +#endif +#ifdef WITH_RADIUSV11 + bool radiusv11; +#endif +} RADIUS_PACKET; + +typedef enum { + DECODE_FAIL_NONE = 0, + DECODE_FAIL_MIN_LENGTH_PACKET, + DECODE_FAIL_MIN_LENGTH_FIELD, + DECODE_FAIL_MIN_LENGTH_MISMATCH, + DECODE_FAIL_HEADER_OVERFLOW, + DECODE_FAIL_UNKNOWN_PACKET_CODE, + DECODE_FAIL_INVALID_ATTRIBUTE, + DECODE_FAIL_ATTRIBUTE_TOO_SHORT, + DECODE_FAIL_ATTRIBUTE_OVERFLOW, + DECODE_FAIL_MA_INVALID_LENGTH, + DECODE_FAIL_ATTRIBUTE_UNDERFLOW, + DECODE_FAIL_TOO_MANY_ATTRIBUTES, + DECODE_FAIL_MA_MISSING, + DECODE_FAIL_TOO_MANY_AUTH, + DECODE_FAIL_MAX +} decode_fail_t; + +#ifdef WITH_RADIUSV11 +typedef enum { + FR_RADIUSV11_FORBID = 0, + FR_RADIUSV11_ALLOW, + FR_RADIUSV11_REQUIRE, +} fr_radiusv11_t; + +extern const FR_NAME_NUMBER radiusv11_types[]; +#endif + +/* + * Version check. + */ +int fr_check_lib_magic(uint64_t magic); + +/* + * Printing functions. + */ +int fr_utf8_char(uint8_t const *str, ssize_t inlen); +char const *fr_utf8_strchr(int *chr_len, char const *str, char const *chr); +size_t fr_prints(char *out, size_t outlen, char const *in, ssize_t inlen, char quote); +size_t fr_prints_len(char const *in, ssize_t inlen, char quote); +char *fr_aprints(TALLOC_CTX *ctx, char const *in, ssize_t inlen, char quote); + +#define is_truncated(_ret, _max) ((_ret) >= (_max)) +#define truncate_len(_ret, _max) (((_ret) >= (_max)) ? ((_max) - 1) : _ret) +size_t vp_prints_value(char *out, size_t outlen, VALUE_PAIR const *vp, char quote); + + +char *vp_aprints_value(TALLOC_CTX *ctx, VALUE_PAIR const *vp, char quote); + +size_t vp_prints_value_json(char *out, size_t outlen, VALUE_PAIR const *vp, bool raw_value); +size_t vp_prints(char *out, size_t outlen, VALUE_PAIR const *vp); +void vp_print(FILE *, VALUE_PAIR const *); +void vp_printlist(FILE *, VALUE_PAIR const *); +char *vp_aprints_type(TALLOC_CTX *ctx, PW_TYPE type); + +char *vp_aprints(TALLOC_CTX *ctx, VALUE_PAIR const *vp, char quote); +#define fprint_attr_val vp_print + +/* + * Dictionary functions. + */ +#define DICT_VALUE_MAX_NAME_LEN (128) +#define DICT_VENDOR_MAX_NAME_LEN (128) +#define DICT_ATTR_MAX_NAME_LEN (128) + +#define DICT_ATTR_SIZE sizeof(DICT_ATTR) + DICT_ATTR_MAX_NAME_LEN + +extern const int dict_attr_allowed_chars[256]; +int dict_valid_name(char const *name); +int str2argv(char *str, char **argv, int max_argc); +int dict_str2oid(char const *ptr, unsigned int *pattr, + unsigned int *pvendor, int tlv_depth); +int dict_addvendor(char const *name, unsigned int value); +int dict_addattr(char const *name, int attr, unsigned int vendor, PW_TYPE type, ATTR_FLAGS flags); +int dict_addvalue(char const *namestr, char const *attrstr, int value); +int dict_init(char const *dir, char const *fn); +void dict_free(void); +int dict_read(char const *dir, char const *filename); +size_t dict_print_oid(char *buffer, size_t buflen, DICT_ATTR const *da); +int dict_walk(fr_hash_table_walk_t callback, void *context); + +void dict_attr_free(DICT_ATTR const **da); +int dict_unknown_from_fields(DICT_ATTR *da, unsigned int attr, unsigned int vendor); +DICT_ATTR const *dict_unknown_afrom_fields(TALLOC_CTX *ctx, unsigned int attr, unsigned int vendor); +int dict_unknown_from_str(DICT_ATTR *da, char const *name); +int dict_unknown_from_substr(DICT_ATTR *da, char const **name); +DICT_ATTR const *dict_unknown_afrom_str(TALLOC_CTX *ctx, char const *name); +DICT_ATTR const *dict_unknown_add(DICT_ATTR const *old); + +DICT_ATTR const *dict_attrbyvalue(unsigned int attr, unsigned int vendor); +DICT_ATTR const *dict_attrbyname(char const *attr); +DICT_ATTR const *dict_attrbyname_substr(char const **name); +DICT_ATTR const *dict_attrbytype(unsigned int attr, unsigned int vendor, + PW_TYPE type); +DICT_ATTR const *dict_attrbyparent(DICT_ATTR const *parent, unsigned int attr, + unsigned int vendor); +DICT_ATTR const *dict_parent(unsigned int attr, unsigned int vendor); +int dict_attr_child(DICT_ATTR const *parent, + unsigned int *pattr, unsigned int *pvendor); +DICT_VALUE *dict_valbyattr(unsigned int attr, unsigned int vendor, int val); +DICT_VALUE *dict_valbyname(unsigned int attr, unsigned int vendor, char const *val); +char const *dict_valnamebyattr(unsigned int attr, unsigned int vendor, int value); +int dict_vendorbyname(char const *name); +DICT_VENDOR *dict_vendorbyvalue(int vendor); + +#if 1 /* FIXME: compat */ +#define dict_attrget dict_attrbyvalue +#define dict_attrfind dict_attrbyname +#define dict_valfind dict_valbyname +/*#define dict_valget dict_valbyattr almost but not quite*/ +#endif + +/* radius.c */ +int rad_send(RADIUS_PACKET *, RADIUS_PACKET const *, char const *secret); +bool rad_packet_ok(RADIUS_PACKET *packet, int flags, decode_fail_t *reason); +RADIUS_PACKET *rad_recv(TALLOC_CTX *ctx, int fd, int flags); +ssize_t rad_recv_header(int sockfd, fr_ipaddr_t *src_ipaddr, uint16_t *src_port, int *code); +void rad_recv_discard(int sockfd); +int rad_verify(RADIUS_PACKET *packet, RADIUS_PACKET *original, + char const *secret); +int rad_decode(RADIUS_PACKET *packet, RADIUS_PACKET *original, char const *secret); +int rad_encode(RADIUS_PACKET *packet, RADIUS_PACKET const *original, + char const *secret); +int rad_sign(RADIUS_PACKET *packet, RADIUS_PACKET const *original, + char const *secret); + +int rad_digest_cmp(uint8_t const *a, uint8_t const *b, size_t length); +RADIUS_PACKET *rad_alloc(TALLOC_CTX *ctx, bool new_vector); +RADIUS_PACKET *rad_alloc_reply(TALLOC_CTX *ctx, RADIUS_PACKET *); +RADIUS_PACKET *rad_copy_packet(TALLOC_CTX *ctx, RADIUS_PACKET const *in); + +void rad_free(RADIUS_PACKET **); + +#ifndef WITH_RADIUSV11_ONLY +int rad_pwencode(char *encpw, size_t *len, char const *secret, + uint8_t const *vector); +int rad_pwdecode(char *encpw, size_t len, char const *secret, + uint8_t const *vector); + +#define FR_TUNNEL_PW_ENC_LENGTH(_x) (2 + 1 + _x + PAD(_x + 1, 16)) +ssize_t rad_tunnel_pwencode(char *encpw, size_t *len, char const *secret, + uint8_t const *vector); +ssize_t rad_tunnel_pwdecode(uint8_t *encpw, size_t *len, + char const *secret, uint8_t const *vector); +int rad_chap_encode(RADIUS_PACKET *packet, uint8_t *output, + int id, VALUE_PAIR *password); +#endif + +int rad_attr_ok(RADIUS_PACKET const *packet, RADIUS_PACKET const *original, + DICT_ATTR *da, uint8_t const *data, size_t length); +int rad_tlv_ok(uint8_t const *data, size_t length, + size_t dv_type, size_t dv_length); + +ssize_t data2vp(TALLOC_CTX *ctx, + RADIUS_PACKET *packet, RADIUS_PACKET const *original, + char const *secret, + DICT_ATTR const *da, uint8_t const *start, + size_t const attrlen, size_t const packetlen, + VALUE_PAIR **pvp); + +ssize_t rad_attr2vp(TALLOC_CTX *ctx, + RADIUS_PACKET *packet, RADIUS_PACKET const *original, + char const *secret, + uint8_t const *data, size_t length, + VALUE_PAIR **pvp); + +ssize_t rad_data2vp_tlvs(TALLOC_CTX *ctx, + RADIUS_PACKET *packet, RADIUS_PACKET const *original, + char const *secret, DICT_ATTR const *da, + uint8_t const *start, size_t length, + VALUE_PAIR **pvp); + +ssize_t rad_vp2data(uint8_t const **out, VALUE_PAIR const *vp); + +int rad_vp2extended(RADIUS_PACKET const *packet, + RADIUS_PACKET const *original, + char const *secret, VALUE_PAIR const **pvp, + uint8_t *ptr, size_t room); +int rad_vp2wimax(RADIUS_PACKET const *packet, + RADIUS_PACKET const *original, + char const *secret, VALUE_PAIR const **pvp, + uint8_t *ptr, size_t room); + +int rad_vp2vsa(RADIUS_PACKET const *packet, RADIUS_PACKET const *original, + char const *secret, VALUE_PAIR const **pvp, uint8_t *start, + size_t room); + +int rad_vp2rfc(RADIUS_PACKET const *packet, + RADIUS_PACKET const *original, + char const *secret, VALUE_PAIR const **pvp, + uint8_t *ptr, size_t room); + +int rad_vp2attr(RADIUS_PACKET const *packet, + RADIUS_PACKET const *original, char const *secret, + VALUE_PAIR const **pvp, uint8_t *ptr, size_t room); + +/* pair.c */ +VALUE_PAIR *fr_pair_alloc(TALLOC_CTX *ctx); +VALUE_PAIR *fr_pair_afrom_da(TALLOC_CTX *ctx, DICT_ATTR const *da); +VALUE_PAIR *fr_pair_afrom_num(TALLOC_CTX *ctx, unsigned int attr, unsigned int vendor); +int fr_pair_to_unknown(VALUE_PAIR *vp); +void fr_pair_list_free(VALUE_PAIR **); +VALUE_PAIR *fr_pair_find_by_num(VALUE_PAIR *, unsigned int attr, unsigned int vendor, int8_t tag); +VALUE_PAIR *fr_pair_find_by_da(VALUE_PAIR *, DICT_ATTR const *da, int8_t tag); + +VALUE_PAIR *fr_cursor_init(vp_cursor_t *cursor, VALUE_PAIR * const *node); +void fr_cursor_copy(vp_cursor_t *out, vp_cursor_t *in); +VALUE_PAIR *fr_cursor_first(vp_cursor_t *cursor); +VALUE_PAIR *fr_cursor_last(vp_cursor_t *cursor); +VALUE_PAIR *fr_cursor_next_by_num(vp_cursor_t *cursor, unsigned int attr, unsigned int vendor, int8_t tag); + +VALUE_PAIR *fr_cursor_next_by_da(vp_cursor_t *cursor, DICT_ATTR const *da, int8_t tag) + CC_HINT(nonnull); + +VALUE_PAIR *fr_cursor_next(vp_cursor_t *cursor); +VALUE_PAIR *fr_cursor_next_peek(vp_cursor_t *cursor); +VALUE_PAIR *fr_cursor_current(vp_cursor_t *cursor); +void fr_cursor_insert(vp_cursor_t *cursor, VALUE_PAIR *vp); +void fr_cursor_merge(vp_cursor_t *cursor, VALUE_PAIR *vp); +VALUE_PAIR *fr_cursor_remove(vp_cursor_t *cursor); +VALUE_PAIR *fr_cursor_replace(vp_cursor_t *cursor, VALUE_PAIR *new); +void fr_pair_delete_by_num(VALUE_PAIR **, unsigned int attr, unsigned int vendor, int8_t tag); +void fr_pair_delete_by_da(VALUE_PAIR **first, DICT_ATTR const *da); +void fr_pair_add(VALUE_PAIR **, VALUE_PAIR *); +void fr_pair_prepend(VALUE_PAIR **, VALUE_PAIR *); +void fr_pair_replace(VALUE_PAIR **first, VALUE_PAIR *add); +int fr_pair_cmp(VALUE_PAIR *a, VALUE_PAIR *b); +int fr_pair_list_cmp(VALUE_PAIR *a, VALUE_PAIR *b); + +typedef int8_t (*fr_cmp_t)(void const *a, void const *b); +int8_t attrcmp(void const *a, void const *b); +int8_t fr_pair_cmp_by_da_tag(void const *a, void const *b); +void fr_pair_list_sort(VALUE_PAIR **vps, fr_cmp_t cmp); +void fr_pair_validate_debug(TALLOC_CTX *ctx, VALUE_PAIR const *failed[2]); +bool fr_pair_validate(VALUE_PAIR const *failed[2], VALUE_PAIR *filter, VALUE_PAIR *list); +bool fr_pair_validate_relaxed(VALUE_PAIR const *failed[2], VALUE_PAIR *filter, VALUE_PAIR *list); +VALUE_PAIR *fr_pair_copy(TALLOC_CTX *ctx, VALUE_PAIR const *vp); +VALUE_PAIR *fr_pair_list_copy(TALLOC_CTX *ctx, VALUE_PAIR *from); +VALUE_PAIR *fr_pair_list_copy_by_num(TALLOC_CTX *ctx, VALUE_PAIR *from, unsigned int attr, unsigned int vendor, int8_t tag); +void fr_pair_steal(TALLOC_CTX *ctx, VALUE_PAIR *vp); +void fr_pair_value_memcpy(VALUE_PAIR *vp, uint8_t const * src, size_t len); +void fr_pair_value_memsteal(VALUE_PAIR *vp, uint8_t const *src); +void fr_pair_value_strsteal(VALUE_PAIR *vp, char const *src); +void fr_pair_value_strcpy(VALUE_PAIR *vp, char const * src); +void fr_pair_value_bstrncpy(VALUE_PAIR *vp, void const * src, size_t len); +void fr_pair_value_sprintf(VALUE_PAIR *vp, char const * fmt, ...) CC_HINT(format (printf, 2, 3)); +void fr_pair_list_move(TALLOC_CTX *ctx, VALUE_PAIR **to, VALUE_PAIR **from, FR_TOKEN op); +void fr_pair_list_move_by_num(TALLOC_CTX *ctx, VALUE_PAIR **to, VALUE_PAIR **from, + unsigned int attr, unsigned int vendor, int8_t tag); +void fr_pair_list_mcopy_by_num(TALLOC_CTX *ctx, VALUE_PAIR **to, VALUE_PAIR **from, + unsigned int attr, unsigned int vendor, int8_t tag); +VALUE_PAIR *fr_pair_afrom_ip_str(TALLOC_CTX *ctx, char const *value, + DICT_ATTR *ipv4, DICT_ATTR *ipv6, DICT_ATTR *ipv4_prefix, DICT_ATTR *ipv6_prefix); +int fr_pair_value_from_str(VALUE_PAIR *vp, char const *value, size_t len); +VALUE_PAIR *fr_pair_make(TALLOC_CTX *ctx, VALUE_PAIR **vps, char const *attribute, char const *value, FR_TOKEN op); +int fr_pair_mark_xlat(VALUE_PAIR *vp, char const *value); +FR_TOKEN fr_pair_raw_from_str(char const **ptr, VALUE_PAIR_RAW *raw); +FR_TOKEN fr_pair_list_afrom_str(TALLOC_CTX *ctx, char const *buffer, VALUE_PAIR **head); +int fr_pair_list_afrom_file(TALLOC_CTX *ctx, VALUE_PAIR **out, FILE *fp, bool *pfiledone); + + +/** Compare two attributes using and operator. + * + * @return 1 if equal, 0 if not eaqual, -1 on error. + */ +#define fr_pair_cmp_op(_op, _a, _b) value_data_cmp_op(_op, _a->da->type, &_a->data, _a->vp_length, _b->da->type, &_b->data, _b->vp_length) + +/* value.c */ +int value_data_cmp(PW_TYPE a_type, value_data_t const *a, size_t a_len, + PW_TYPE b_type, value_data_t const *b, size_t b_len); + +int value_data_cmp_op(FR_TOKEN op, + PW_TYPE a_type, value_data_t const *a, size_t a_len, + PW_TYPE b_type, value_data_t const *b, size_t b_len); + +ssize_t value_data_from_str(TALLOC_CTX *ctx, value_data_t *dst, + PW_TYPE *src_type, DICT_ATTR const *src_enumv, + char const *src, ssize_t src_len, char quote); + +ssize_t value_data_cast(TALLOC_CTX *ctx, value_data_t *dst, + PW_TYPE dst_type, DICT_ATTR const *dst_enumv, + PW_TYPE src_type, DICT_ATTR const *src_enumv, + value_data_t const *src, size_t src_len); + +ssize_t value_data_copy(TALLOC_CTX *ctx, value_data_t *dst, PW_TYPE type, + const value_data_t *src, size_t src_len); + +size_t value_data_prints(char *out, size_t outlen, + PW_TYPE type, DICT_ATTR const *enumv, + value_data_t const *data, ssize_t inlen, char quote); + +char *value_data_aprints(TALLOC_CTX *ctx, + PW_TYPE type, DICT_ATTR const *enumv, value_data_t const *data, + size_t inlen, char quote); + +/* + * Error functions. + */ +void fr_strerror_printf(char const *, ...) CC_HINT(format (printf, 1, 2)); +void fr_perror(char const *, ...) CC_HINT(format (printf, 1, 2)); + + +char const *fr_strerror(void); +char const *fr_syserror(int num); +extern bool fr_dns_lookups; /* do IP -> hostname lookups? */ +extern bool fr_hostname_lookups; /* do hostname -> IP lookups? */ +extern int fr_debug_lvl; /* 0 = no debugging information */ +extern uint32_t fr_max_attributes; /* per incoming packet */ +#define FR_MAX_PACKET_CODE (52) +extern char const *fr_packet_codes[FR_MAX_PACKET_CODE]; +#define is_radius_code(_x) ((_x > 0) && (_x < FR_MAX_PACKET_CODE)) +extern FILE *fr_log_fp; +void rad_print_hex(RADIUS_PACKET const *packet); +void fr_printf_log(char const *, ...) CC_HINT(format (printf, 1, 2)); + +/* + * Several handy miscellaneous functions. + */ +int fr_set_signal(int sig, sig_t func); +int fr_unset_signal(int sig); +int fr_link_talloc_ctx_free(TALLOC_CTX *parent, TALLOC_CTX *child); +char const *fr_inet_ntop(int af, void const *src); +char const *ip_ntoa(char *, uint32_t); +int fr_pton4(fr_ipaddr_t *out, char const *value, ssize_t inlen, bool resolve, bool fallback); +int fr_pton6(fr_ipaddr_t *out, char const *value, ssize_t inlen, bool resolve, bool fallback); +int fr_pton(fr_ipaddr_t *out, char const *value, ssize_t inlen, int af, bool resolve); +int fr_pton_port(fr_ipaddr_t *out, uint16_t *port_out, char const *value, ssize_t inlen, int af, + bool resolve); +int fr_ntop(char *out, size_t outlen, fr_ipaddr_t const *addr); +char *ifid_ntoa(char *buffer, size_t size, uint8_t const *ifid); +uint8_t *ifid_aton(char const *ifid_str, uint8_t *ifid); +int rad_lockfd(int fd, int lock_len); +int rad_lockfd_nonblock(int fd, int lock_len); +int rad_unlockfd(int fd, int lock_len); +char *fr_abin2hex(TALLOC_CTX *ctx, uint8_t const *bin, size_t inlen); +size_t fr_bin2hex(char *hex, uint8_t const *bin, size_t inlen); +size_t fr_hex2bin(uint8_t *bin, size_t outlen, char const *hex, size_t inlen); +uint32_t fr_strtoul(char const *value, char **end); +bool is_whitespace(char const *value); +bool is_printable(void const *value, size_t len); +bool is_integer(char const *value); +bool is_zero(char const *value); + +int fr_ipaddr_cmp(fr_ipaddr_t const *a, fr_ipaddr_t const *b); + +int ip_hton(fr_ipaddr_t *out, int af, char const *hostname, bool fallback); +char const *ip_ntoh(fr_ipaddr_t const *src, char *dst, size_t cnt); +struct in_addr fr_inaddr_mask(struct in_addr const *ipaddr, uint8_t prefix); +struct in6_addr fr_in6addr_mask(struct in6_addr const *ipaddr, uint8_t prefix); +void fr_ipaddr_mask(fr_ipaddr_t *addr, uint8_t prefix); +int fr_ipaddr2sockaddr(fr_ipaddr_t const *ipaddr, uint16_t port, + struct sockaddr_storage *sa, socklen_t *salen); +int fr_sockaddr2ipaddr(struct sockaddr_storage const *sa, socklen_t salen, + fr_ipaddr_t *ipaddr, uint16_t *port); +int fr_nonblock(int fd); +int fr_blocking(int fd); +ssize_t fr_writev(int fd, struct iovec[], int iovcnt, struct timeval *timeout); + +ssize_t fr_utf8_to_ucs2(uint8_t *out, size_t outlen, char const *in, size_t inlen); +size_t fr_prints_uint128(char *out, size_t outlen, uint128_t const num); +int fr_get_time(char const *date_str, time_t *date); +int8_t fr_pointer_cmp(void const *a, void const *b); +void fr_quick_sort(void const *to_sort[], int min_idx, int max_idx, fr_cmp_t cmp); + +void fr_timeval_from_ms(struct timeval *out, uint64_t ms); +void fr_timeval_from_usec(struct timeval *out, uint64_t usec); + +/* + * Define TALLOC_DEBUG to check overflows with talloc. + * we can't use valgrind, because the memory used by + * talloc is valid memory... just not for us. + */ +#ifdef TALLOC_DEBUG +void fr_talloc_verify_cb(const void *ptr, int depth, + int max_depth, int is_ref, + void *private_data); +#define VERIFY_ALL_TALLOC talloc_report_depth_cb(NULL, 0, -1, fr_talloc_verify_cb, NULL) +#else +#define VERIFY_ALL_TALLOC +#endif + +#ifdef WITH_ASCEND_BINARY +/* filters.c */ +int ascend_parse_filter(value_data_t *out, char const *value, size_t len); +void print_abinary(char *out, size_t outlen, uint8_t const *data, size_t len, int8_t quote); +#endif /*WITH_ASCEND_BINARY*/ + +/* random numbers in isaac.c */ +/* context of random number generator */ +typedef struct fr_randctx { + uint32_t randcnt; + uint32_t randrsl[256]; + uint32_t randmem[256]; + uint32_t randa; + uint32_t randb; + uint32_t randc; +} fr_randctx; + +void fr_isaac(fr_randctx *ctx); +void fr_randinit(fr_randctx *ctx, int flag); +uint32_t fr_rand(void); /* like rand(), but better. */ +void fr_rand_seed(void const *, size_t ); /* seed the random pool */ + + +/* crypt wrapper from crypt.c */ +int fr_crypt_check(char const *key, char const *salt); + +/* cbuff.c */ + +typedef struct fr_cbuff fr_cbuff_t; + +fr_cbuff_t *fr_cbuff_alloc(TALLOC_CTX *ctx, uint32_t size, bool lock); +void fr_cbuff_rp_insert(fr_cbuff_t *cbuff, void *obj); +void *fr_cbuff_rp_next(fr_cbuff_t *cbuff, TALLOC_CTX *ctx); + +/* debug.c */ +typedef enum { + DEBUG_STATE_UNKNOWN_NO_PTRACE = -3, //!< We don't have ptrace so can't check. + DEBUG_STATE_UNKNOWN_NO_PTRACE_CAP = -2, //!< CAP_SYS_PTRACE not set for the process. + DEBUG_STATE_UNKNOWN = -1, //!< Unknown, likely fr_get_debug_state() not called yet. + DEBUG_STATE_NOT_ATTACHED = 0, //!< We can attach, so a debugger must not be. + DEBUG_STATE_ATTACHED = 1 //!< We can't attach, it's likely a debugger is already tracing. +} fr_debug_state_t; + +#define FR_FAULT_LOG(fmt, ...) fr_fault_log(fmt "\n", ## __VA_ARGS__) +typedef void (*fr_fault_log_t)(char const *msg, ...) CC_HINT(format (printf, 1, 2)); +extern fr_debug_state_t fr_debug_state; + +/** Optional callback passed to fr_fault_setup + * + * Allows optional logic to be run before calling the main fault handler. + * + * If the callback returns < 0, the main fault handler will not be called. + * + * @param signum signal raised. + * @return 0 on success < 0 on failure. + */ +typedef int (*fr_fault_cb_t)(int signum); +typedef struct fr_bt_marker fr_bt_marker_t; + +void fr_store_debug_state(void); +char const *fr_debug_state_to_msg(fr_debug_state_t state); +void fr_debug_break(bool always); +void backtrace_print(fr_cbuff_t *cbuff, void *obj); +int fr_backtrace_do(fr_bt_marker_t *marker); +fr_bt_marker_t *fr_backtrace_attach(fr_cbuff_t **cbuff, TALLOC_CTX *obj); + +void fr_panic_on_free(TALLOC_CTX *ctx); +int fr_set_dumpable_init(void); +int fr_set_dumpable(bool allow_core_dumps); +int fr_reset_dumpable(void); +int fr_log_talloc_report(TALLOC_CTX *ctx); +void fr_fault(int sig); +void fr_talloc_fault_setup(void); +int fr_fault_setup(char const *cmd, char const *program); +void fr_fault_set_cb(fr_fault_cb_t func); +void fr_fault_set_log_fd(int fd); +void fr_fault_log(char const *msg, ...) CC_HINT(format (printf, 1, 2)); + +# ifdef WITH_VERIFY_PTR +void fr_pair_verify(char const *file, int line, VALUE_PAIR const *vp); +void fr_pair_list_verify(char const *file, int line, TALLOC_CTX *expected, VALUE_PAIR *vps, char const *name); +# endif + +bool fr_assert_cond(char const *file, int line, char const *expr, bool cond); +# define fr_assert(_x) fr_assert_cond(__FILE__, __LINE__, #_x, (_x)) + +void NEVER_RETURNS _fr_exit(char const *file, int line, int status); +# define fr_exit(_x) _fr_exit(__FILE__, __LINE__, (_x)) + +void NEVER_RETURNS _fr_exit_now(char const *file, int line, int status); +# define fr_exit_now(_x) _fr_exit_now(__FILE__, __LINE__, (_x)) + +/* rbtree.c */ +typedef struct rbtree_t rbtree_t; +typedef struct rbnode_t rbnode_t; + +/* callback order for walking */ +typedef enum { + RBTREE_PRE_ORDER, + RBTREE_IN_ORDER, + RBTREE_POST_ORDER, + RBTREE_DELETE_ORDER +} rb_order_t; + +#define RBTREE_FLAG_NONE (0) +#define RBTREE_FLAG_REPLACE (1 << 0) +#define RBTREE_FLAG_LOCK (1 << 1) + +typedef int (*rb_comparator_t)(void const *ctx, void const *data); +typedef int (*rb_walker_t)(void *ctx, void *data); +typedef void (*rb_free_t)(void *data); + +rbtree_t *rbtree_create(TALLOC_CTX *ctx, rb_comparator_t compare, rb_free_t node_free, int flags); +void rbtree_free(rbtree_t *tree); +bool rbtree_insert(rbtree_t *tree, void *data); +rbnode_t *rbtree_insert_node(rbtree_t *tree, void *data); +void rbtree_delete(rbtree_t *tree, rbnode_t *z); +bool rbtree_deletebydata(rbtree_t *tree, void const *data); +rbnode_t *rbtree_find(rbtree_t *tree, void const *data); +void *rbtree_finddata(rbtree_t *tree, void const *data); +uint32_t rbtree_num_elements(rbtree_t *tree); +void *rbtree_node2data(rbtree_t *tree, rbnode_t *node); + +/* + * The callback should be declared as: + * int callback(void *context, void *data) + * + * The "context" is some user-defined context. + * The "data" is the pointer to the user data in the node, + * NOT the node itself. + * + * It should return 0 if all is OK, and !0 for any error. + * The walking will stop on any error. + * + * Except with RBTREE_DELETE_ORDER, where the callback should return <0 for + * errors, and may return 1 to delete the current node and halt, + * or 2 to delete the current node and continue. This may be + * used to batch-delete select nodes from a locked rbtree. + */ +int rbtree_walk(rbtree_t *tree, rb_order_t order, rb_walker_t compare, void *context); + +/* + * FIFOs + */ +typedef struct fr_fifo_t fr_fifo_t; +typedef void (*fr_fifo_free_t)(void *); +fr_fifo_t *fr_fifo_create(TALLOC_CTX *ctx, int max_entries, fr_fifo_free_t freeNode); +void fr_fifo_free(fr_fifo_t *fi); +int fr_fifo_push(fr_fifo_t *fi, void *data); +void *fr_fifo_pop(fr_fifo_t *fi); +void *fr_fifo_peek(fr_fifo_t *fi); +unsigned int fr_fifo_num_elements(fr_fifo_t *fi); + +/* + * socket.c + */ +int fr_socket_client_unix(char const *path, bool async); +int fr_socket_client_udp(fr_ipaddr_t *src_ipaddr, fr_ipaddr_t *dst_ipaddr, uint16_t dst_port, bool async); +int fr_socket_client_tcp(fr_ipaddr_t *src_ipaddr, fr_ipaddr_t *dst_ipaddr, uint16_t dst_port, bool async); +int fr_socket_wait_for_connect(int sockfd, struct timeval *timeout); + +#ifdef __cplusplus +} +#endif + +#include <freeradius-devel/packet.h> + +#ifdef WITH_TCP +# include <freeradius-devel/tcp.h> +#endif + +#endif /*LIBRADIUS_H*/ diff --git a/src/include/listen.h b/src/include/listen.h new file mode 100644 index 0000000..a82b91d --- /dev/null +++ b/src/include/listen.h @@ -0,0 +1,206 @@ +/* + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + */ +#ifndef LISTEN_H +#define LISTEN_H +/** + * $Id$ + * + * @file listen.h + * @brief The listener API. + * + * @copyright 2015 The FreeRADIUS server project + */ + +/* + * Types of listeners. + * + * Ordered by priority! + */ +typedef enum RAD_LISTEN_TYPE { + RAD_LISTEN_NONE = 0, + RAD_LISTEN_PROXY, + RAD_LISTEN_AUTH, + RAD_LISTEN_ACCT, + RAD_LISTEN_DETAIL, + RAD_LISTEN_VQP, + RAD_LISTEN_DHCP, + RAD_LISTEN_COMMAND, + RAD_LISTEN_COA, + RAD_LISTEN_MAX +} RAD_LISTEN_TYPE; + +typedef enum RAD_LISTEN_STATUS { + RAD_LISTEN_STATUS_INIT = 0, + RAD_LISTEN_STATUS_KNOWN, + RAD_LISTEN_STATUS_PAUSE, + RAD_LISTEN_STATUS_RESUME, + RAD_LISTEN_STATUS_FROZEN, + RAD_LISTEN_STATUS_EOL, + RAD_LISTEN_STATUS_REMOVE_NOW +} RAD_LISTEN_STATUS; + +typedef struct rad_listen rad_listen_t; + +typedef int (*rad_listen_recv_t)(rad_listen_t *); +typedef int (*rad_listen_send_t)(rad_listen_t *, REQUEST *); +typedef int (*rad_listen_print_t)(rad_listen_t const *, char *, size_t); +typedef int (*rad_listen_encode_t)(rad_listen_t *, REQUEST *); +typedef int (*rad_listen_decode_t)(rad_listen_t *, REQUEST *); + +struct rad_listen { + rad_listen_t *next; /* should be rbtree stuff */ + + /* + * For normal sockets. + */ + RAD_LISTEN_TYPE type; + int fd; + char const *server; + int status; + int count; +#ifdef WITH_TCP + rbtree_t *children; + rad_listen_t *parent; + + bool dual; + bool proxy_protocol; //!< haproxy protocol +#endif + bool nodup; + bool synchronous; + bool dead; + uint32_t workers; + +#ifdef WITH_TLS + fr_tls_server_conf_t *tls; + bool check_client_connections; + bool nonblock; + bool blocked; +#ifdef WITH_RADIUSV11 + fr_radiusv11_t radiusv11; +#endif + +#ifdef WITH_COA_TUNNEL + char const *key; /* Originating-Realm-Key */ + bool send_coa; /* to the NAS */ + + uint32_t coa_irt; + uint32_t coa_mrc; + uint32_t coa_mrt; + uint32_t coa_mrd; + + int num_ids_used; /* for proxying CoA packets */ +#endif +#endif + + rad_listen_recv_t recv; + rad_listen_send_t send; + + /* + * We don't need a proxy_recv, because the main loop in + * process.c calls listener->recv(), and we don't know + * what kind of packet we're receiving until we receive + * it. + */ + rad_listen_send_t proxy_send; + + + rad_listen_encode_t encode; + rad_listen_decode_t decode; + rad_listen_encode_t proxy_encode; + rad_listen_decode_t proxy_decode; + rad_listen_print_t print; + + CONF_SECTION const *cs; + void *data; + +#ifdef WITH_STATS + fr_stats_t stats; +#endif +}; + +/* + * This shouldn't really be exposed... + */ +typedef struct listen_socket_t { + /* + * For normal sockets. + */ + fr_ipaddr_t my_ipaddr; + uint16_t my_port; + + char const *interface; +#ifdef SO_BROADCAST + int broadcast; +#endif + + int recv_buff; + + time_t rate_time; + uint32_t rate_pps_old; + uint32_t rate_pps_now; + uint32_t max_rate; + + /* for outgoing sockets */ + home_server_t *home; + fr_ipaddr_t other_ipaddr; + uint16_t other_port; + + int proto; + +#ifdef WITH_TCP + /* for a proxy connecting to home servers */ + time_t last_packet; + time_t opened; + fr_event_t *ev; + + fr_socket_limit_t limit; + + struct listen_socket_t *parent; + RADCLIENT *client; + + RADIUS_PACKET *packet; /* for reading partial packets */ + + fr_ipaddr_t haproxy_src_ipaddr; //!< for proxy_protocol + fr_ipaddr_t haproxy_dst_ipaddr; + uint16_t haproxy_src_port; + uint16_t haproxy_dst_port; +#endif + +#ifdef WITH_TLS + tls_session_t *ssn; + REQUEST *request; /* horrible hacks */ + VALUE_PAIR *certs; + uint32_t connect_timeout; + pthread_mutex_t mutex; + uint8_t *data; + size_t partial; + enum { + LISTEN_TLS_INIT = 0, + LISTEN_TLS_CHECKING, + LISTEN_TLS_SETUP, + LISTEN_TLS_RUNNING, + } state; + +#ifdef WITH_RADIUSV11 + bool alpn_checked; + bool radiusv11; //!< defaults to "no"! +#endif +#endif + + RADCLIENT_LIST *clients; +} listen_socket_t; +#endif /* LISTEN_H */ + diff --git a/src/include/log.h b/src/include/log.h new file mode 100644 index 0000000..2736591 --- /dev/null +++ b/src/include/log.h @@ -0,0 +1,390 @@ +/* + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + */ +#ifndef FR_LOG_H +#define FR_LOG_H +/** + * $Id$ + * + * @file log.h + * @brief Macros and function definitions to write log messages, and control the logging system. + * + * @copyright 2015 Arran Cudbard-Bell <a.cudbardb@freeradius.org> + * @copyright 2013 Alan DeKok <aland@freeradius.org> + */ +RCSIDH(log_h, "$Id$") + +#ifdef __cplusplus +extern "C" { +#endif + +typedef enum log_type { + L_AUTH = 2, //!< Authentication message. + L_INFO = 3, //!< Informational message. + L_ERR = 4, //!< Error message. + L_WARN = 5, //!< Warning. + L_PROXY = 6, //!< Proxy messages + L_ACCT = 7, //!< Accounting messages + + L_DBG = 16, //!< Only displayed when debugging is enabled. + L_DBG_WARN = 17, //!< Warning only displayed when debugging is enabled. + L_DBG_ERR = 18, //!< Error only displayed when debugging is enabled. + L_DBG_WARN_REQ = 19, //!< Less severe warning only displayed when debugging is enabled. + L_DBG_ERR_REQ = 20 //!< Less severe error only displayed when debugging is enabled. +} log_type_t; + +typedef enum log_lvl { + L_DBG_LVL_DISABLE = -1, //!< Don't print messages. + L_DBG_LVL_OFF = 0, //!< No debug messages. + L_DBG_LVL_1, //!< Highest priority debug messages (-x). + L_DBG_LVL_2, //!< 2nd highest priority debug messages (-xx | -X). + L_DBG_LVL_3, //!< 3rd highest priority debug messages (-xxx | -Xx). + L_DBG_LVL_MAX //!< Lowest priority debug messages (-xxxx | -Xxx). +} log_lvl_t; + +typedef enum log_dst { + L_DST_STDOUT = 0, //!< Log to stdout. + L_DST_FILES, //!< Log to a file on disk. + L_DST_SYSLOG, //!< Log to syslog. + L_DST_STDERR, //!< Log to stderr. + L_DST_NULL, //!< Discard log messages. + L_DST_NUM_DEST +} log_dst_t; + +typedef struct fr_log_t { + bool colourise; //!< Prefix log messages with VT100 escape codes to change text + //!< colour. + int fd; //!< File descriptor to write messages to. + log_dst_t dst; //!< Log destination. + char const *file; //!< Path to log file. + char const *debug_file; //!< Path to debug log file. +} fr_log_t; + +typedef void (*radlog_func_t)(log_type_t lvl, log_lvl_t priority, REQUEST *, char const *, va_list ap); + +extern FR_NAME_NUMBER const syslog_facility_table[]; +extern FR_NAME_NUMBER const syslog_severity_table[]; +extern FR_NAME_NUMBER const log_str2dst[]; +extern fr_log_t default_log; + +int radlog_init(fr_log_t *log, bool daemonize); + +int vradlog(log_type_t lvl, char const *fmt, va_list ap) + CC_HINT(format (printf, 2, 0)) CC_HINT(nonnull); +int radlog(log_type_t lvl, char const *fmt, ...) + CC_HINT(format (printf, 2, 3)) CC_HINT(nonnull (2)); + +bool debug_enabled(log_type_t type, log_lvl_t lvl); + +bool rate_limit_enabled(void); + +bool radlog_debug_enabled(log_type_t type, log_lvl_t lvl, REQUEST *request) + CC_HINT(nonnull); + +void vradlog_request(log_type_t type, log_lvl_t lvl, REQUEST *request, char const *msg, va_list ap) + CC_HINT(format (printf, 4, 0)) CC_HINT(nonnull (3, 4)); + +void radlog_request(log_type_t type, log_lvl_t lvl, REQUEST *request, char const *msg, ...) + CC_HINT(format (printf, 4, 5)) CC_HINT(nonnull (3, 4)); + +void radlog_request_error(log_type_t type, log_lvl_t lvl, REQUEST *request, char const *msg, ...) + CC_HINT(format (printf, 4, 5)) CC_HINT(nonnull (3, 4)); + +void radlog_request_marker(log_type_t type, log_lvl_t lvl, REQUEST *request, + char const *fmt, size_t indent, char const *error) + CC_HINT(nonnull); + +void fr_canonicalize_error(TALLOC_CTX *ctx, char **spaces, char **text, ssize_t slen, char const *msg); + +/** @name Log global messages + * + * Write to the global log. + * + * Messages will always be written irrespective of the debugging level set with ``-x`` or ``-X``. + * + * @warning If a REQUEST * is **NOT** available, these macros **MUST** be used. + * + * @note These macros should only be used for important global events. + * + * **Debug categories** + * Name | Syslog severity | Colour/style | When to use + * -------- | ----------------------- | ------------ | ----------- + * AUTH | LOG_NOTICE | Bold | Never - Deprecated + * ACCT | LOG_NOTICE | Bold | Never - Deprecated + * PROXY | LOG_NOTICE | Bold | Never - Deprecated + * INFO | LOG_INFO | Bold | TBD + * WARN | LOG_WARNING | Yellow | Warnings. Impending resource exhaustion, resource exhaustion + * ERROR | LOG_ERR | Red | Critical server errors. Malformed queries, failed operations, connection errors, packet processing errors + * + * @{ + */ +#define AUTH(fmt, ...) radlog(L_AUTH, fmt, ## __VA_ARGS__) +#define ACCT(fmt, ...) radlog(L_ACCT, fmt, ## __VA_ARGS__) +#define PROXY(fmt, ...) radlog(L_PROXY, fmt, ## __VA_ARGS__) + +#define INFO(fmt, ...) radlog(L_INFO, fmt, ## __VA_ARGS__) +#define WARN(fmt, ...) radlog(L_WARN, fmt, ## __VA_ARGS__) +#define ERROR(fmt, ...) radlog(L_ERR, fmt, ## __VA_ARGS__) +/** @} */ + +/** @name Log global debug messages (DEBUG*) + * + * Write debugging messages to the global log. + * + * Messages will be written if the debug level is high enough. + * + * **Debug categories** + * Name | Syslog severity | Colour/style | When to use + * -------- | ----------------------- | -------------| ----------- + * DEBUG | LOG_DEBUG | Regular | Normal debug output + * + * **Debug levels** + * Level | Debug arguments | Macro(s) enabled | When to use + * -------- | ----------------------- | ----------------------------- | ----------- + * 1 | ``-x`` | DEBUG | Never - Deprecated + * 2 | ``-xx`` or ``-X`` | DEBUG, DEBUG2 | Interactions with external entities. Connection management, control socket, triggers, etc... + * 3 | ``-xxx`` or ``-Xx`` | DEBUG, DEBUG2, DEBUG3 | Lower priority events. Polling for detail files, cleanups, etc... + * 4 | ``-xxxx`` or ``-Xxx`` | DEBUG, DEBUG2, DEBUG3, DEBUG4 | Internal server state debugging. + * + * @{ + */ +#define DEBUG_ENABLED debug_enabled(L_DBG, L_DBG_LVL_1) //!< True if global debug level 1 messages are enabled +#define DEBUG_ENABLED2 debug_enabled(L_DBG, L_DBG_LVL_2) //!< True if global debug level 1-2 messages are enabled +#define DEBUG_ENABLED3 debug_enabled(L_DBG, L_DBG_LVL_3) //!< True if global debug level 1-3 messages are enabled +#define DEBUG_ENABLED4 debug_enabled(L_DBG, L_DBG_LVL_MAX) //!< True if global debug level 1-4 messages are enabled + +#define _SL(_l, _p, _f, ...) if (rad_debug_lvl >= _p) radlog(_l, _f, ## __VA_ARGS__) +#define DEBUG(fmt, ...) _SL(L_DBG, L_DBG_LVL_1, fmt, ## __VA_ARGS__) +#define DEBUG2(fmt, ...) _SL(L_DBG, L_DBG_LVL_2, fmt, ## __VA_ARGS__) +#define DEBUG3(fmt, ...) _SL(L_DBG, L_DBG_LVL_3, fmt, ## __VA_ARGS__) +#define DEBUG4(fmt, ...) _SL(L_DBG, L_DBG_LVL_MAX, fmt, ## __VA_ARGS__) +/** @} */ + +/** @name Log request-specific messages (R*) + * + * Write to the request log, or the global log if a request logging function is not set. + * + * Messages will always be written irrespective of the debugging level set with ``-x`` or ``-X``. + * + * @note Automatically prepends date (at lvl >= 3), request number, and module, to the log message. + * @note If a REQUEST * is available, these macros should be used. + * @note These macros should only be used for important global events. + * + * **Debug categories** + * Name | Syslog severity | Colour/style | When to use + * -------- | ----------------------- | -------------| ----------- + * RAUTH | LOG_NOTICE | Bold | Never - Deprecated + * RACCT | LOG_NOTICE | Bold | Never - Deprecated + * RPROXY | LOG_NOTICE | Bold | Never - Deprecated + * RINFO | LOG_INFO | Bold | TBD + * RWARN | LOG_WARNING | Yellow/Bold | Warnings. Impending resource exhaustion, or resource exhaustion. + * RERROR | LOG_ERR | Red/Bold | Critical server errors. Malformed queries, failed operations, connection errors, packet processing errors. + * @{ + */ +#define RAUTH(fmt, ...) radlog_request(L_AUTH, L_DBG_LVL_OFF, request, fmt, ## __VA_ARGS__) +#define RACCT(fmt, ...) radlog_request(L_ACCT, L_DBG_LVL_OFF, request, fmt, ## __VA_ARGS__) +#define RPROXY(fmt, ...) radlog_request(L_PROXY, L_DBG_LVL_OFF, request, fmt, ## __VA_ARGS__) +#define RINFO(fmt, ...) radlog_request(L_INFO, L_DBG_LVL_OFF, request, fmt, ## __VA_ARGS__) +#define RWARN(fmt, ...) radlog_request(L_DBG_WARN, L_DBG_LVL_OFF, request, fmt, ## __VA_ARGS__) +#define RERROR(fmt, ...) radlog_request_error(L_DBG_ERR, L_DBG_LVL_OFF, request, fmt, ## __VA_ARGS__) +/** @} */ + +/** @name Log request-specific debug (R*DEBUG*) + * + * Write debug messages to the request log. + * + * Messages will only be written if a request log function is set and the request or global + * debug level is high enough. + * + * @note Automatically prepends date (at lvl >= 3), request number, and module, to the log message. + * + * **Debug categories** + * Name | Syslog severity | Colour and style | When to use + * -------- | ----------------------- | -----------------| ----------- + * RDEBUG* | LOG_DEBUG | Regular | Normal debugging messages + * RIDEBUG* | LOG_DEBUG | Bold | Informational messages. + * RWDEBUG* | LOG_DEBUG | Yellow/Bold | Warnings. Invalid configuration, missing or invalid attributes etc... + * REDEBUG* | LOG_DEBUG | Red/Bold | Errors. Reject messages, bad values etc... + * + * **Debug levels** + * Level | Debug arguments | Macro(s) enabled | When to use + * -------- | ----------------------- | -------------------------------------- | ----------- + * 1 | ``-x`` | R*DEBUG | Never - Deprecated + * 2 | ``-xx`` or ``-X`` | R*DEBUG, R*DEBUG2 | Normal request flow. Operations, Results of queries, or execs, etc... + * 3 | ``-xxx`` or ``-Xx`` | R*DEBUG, R*DEBUG2, R*DEBUG3 | Internal server state or packet input. State machine changes, extra attribute info, etc... + * 4 | ``-xxxx`` or ``-Xxx`` | R*DEBUG, R*DEBUG2, R*DEBUG3, R*DEBUG4 | Verbose internal server state messages or packet input. Hex dumps, structure dumps, pointer values. + * + * @{ + */ +#define RDEBUG_ENABLED radlog_debug_enabled(L_DBG, L_DBG_LVL_1, request) //!< True if request debug level 1 messages are enabled +#define RDEBUG_ENABLED2 radlog_debug_enabled(L_DBG, L_DBG_LVL_2, request) //!< True if request debug level 1-2 messages are enabled +#define RDEBUG_ENABLED3 radlog_debug_enabled(L_DBG, L_DBG_LVL_3, request) //!< True if request debug level 1-3 messages are enabled +#define RDEBUG_ENABLED4 radlog_debug_enabled(L_DBG, L_DBG_LVL_MAX, request) //!< True if request debug level 1-4 messages are enabled + +#define RDEBUGX(_l, fmt, ...) radlog_request(L_DBG, _l, request, fmt, ## __VA_ARGS__) +#define RDEBUG(fmt, ...) if (rad_debug_lvl || request->log.lvl) radlog_request(L_DBG, L_DBG_LVL_1, request, fmt, ## __VA_ARGS__) +#define RDEBUG2(fmt, ...) if (rad_debug_lvl || request->log.lvl) radlog_request(L_DBG, L_DBG_LVL_2, request, fmt, ## __VA_ARGS__) +#define RDEBUG3(fmt, ...) if (rad_debug_lvl || request->log.lvl) radlog_request(L_DBG, L_DBG_LVL_3, request, fmt, ## __VA_ARGS__) +#define RDEBUG4(fmt, ...) if (rad_debug_lvl || request->log.lvl) radlog_request(L_DBG, L_DBG_LVL_MAX, request, fmt, ## __VA_ARGS__) + +#define RIDEBUG(fmt, ...) radlog_request(L_INFO, L_DBG_LVL_1, request, fmt, ## __VA_ARGS__) +#define RIDEBUG2(fmt, ...) radlog_request(L_INFO, L_DBG_LVL_2, request, fmt, ## __VA_ARGS__) + +#define RWDEBUG(fmt, ...) if (rad_debug_lvl || request->log.lvl) radlog_request(L_DBG_WARN, L_DBG_LVL_1, request, fmt, ## __VA_ARGS__) +#define RWDEBUG2(fmt, ...) if (rad_debug_lvl || request->log.lvl) radlog_request(L_DBG_WARN, L_DBG_LVL_2, request, fmt, ## __VA_ARGS__) + +#define REDEBUG(fmt, ...) radlog_request_error(L_DBG_ERR, L_DBG_LVL_1, request, fmt, ## __VA_ARGS__) +#define REDEBUG2(fmt, ...) radlog_request_error(L_DBG_ERR, L_DBG_LVL_2, request, fmt, ## __VA_ARGS__) +#define REDEBUG3(fmt, ...) radlog_request_error(L_DBG_ERR, L_DBG_LVL_3, request, fmt, ## __VA_ARGS__) +#define REDEBUG4(fmt, ...) radlog_request_error(L_DBG_ERR, L_DBG_LVL_MAX, request, fmt, ## __VA_ARGS__) +/** @} */ + +/** Indent R* messages by one level + * + * @note Has no effect on the indentation of INFO, WARN, ERROR, DEBUG messages, + * only RINFO, RWARN, RERROR etc... + */ +#define RINDENT() (request->log.indent += 2) + +/** Exdent (unindent) R* messages by one level + * + * @note Has no effect on the indentation of INFO, WARN, ERROR, DEBUG messages, + * only RINFO, RWARN, RERROR etc... + */ +#define REXDENT() (request->log.indent -= 2) + +/** Output string with error marker, showing where format error occurred + * + @verbatim + my pet kitty + ^ kitties are not pets, are nature devouring hell beasts + @endverbatim + * + * @warning If a REQUEST * is **NOT** available, or is NULL, this macro must **NOT** be used. + * + * @param _l log category, a log_type_t value. + * @param _p log priority, a log_lvl_t value. + * @param _m string to mark e.g. "my pet kitty". + * @param _i index e.g. 3 (starts from 0). + * @param _e error e.g. "kitties are not pets, are nature devouring hell beasts". + */ +#define RMARKER(_l, _p, _m, _i, _e) radlog_request_marker(_l, _p, request, _m, _i, _e) + +/** Output string with error marker, showing where format error occurred + * + * These are logged as RERROR messages. + * + @verbatim + my pet kitty + ^ kitties are not pets, are nature devouring hell beasts + @endverbatim + * + * @warning If a REQUEST * is **NOT** available, or is NULL, this macro must **NOT** be used. + * + * @param _m string to mark e.g. "my pet kitty". + * @param _i index e.g. 3 (starts from 0). + * @param _e error e.g. "kitties are not pets, are nature devouring hell beasts". + */ +#define REMARKER(_m, _i, _e) RMARKER(L_DBG_ERR, L_DBG_LVL_1, _m, _i, _e) + +/** Output string with error marker, showing where format error occurred + * + * These are logged as RDEBUG messages. + * + @verbatim + my pet kitty + ^ kitties are not pets, are nature devouring hell beasts + @endverbatim + * + * @warning If a REQUEST * is **NOT** available, or is NULL, this macro must **NOT** be used. + * + * @param _m string to mark e.g. "my pet kitty". + * @param _i index e.g. 3 (starts from 0). + * @param _e error e.g. "kitties are not pets, are nature devouring hell beasts". + */ +#define RDMARKER(_m, _i, _e) RMARKER(L_DBG, L_DBG_LVL_1, _m, _i, _e) + +/** Use different logging functions depending on whether request is NULL or not. + * + * @note The module must define MOD_PREFIX as its name (do this in the module + * header file) e.g. @code{.c}#define MOD_PREFIX "rlm_example"@endcode + * + * This is useful for areas of code which are run on server startup, and when + * processing requests. + * + * @param _l_request The name of a R* logging macro e.g. RDEBUG3. + * @param _l_global The name of a global logging macro e.g. DEBUG3. + * @param fmt printf style format string. + * @param ... printf arguments. + */ + #define MOD_ROPTIONAL(_l_request, _l_global, fmt, ...) \ +do {\ + if (request) {\ + _l_request(fmt, ## __VA_ARGS__);\ + } else {\ + _l_global(MOD_PREFIX " (%s): " fmt, inst->name, ## __VA_ARGS__);\ + }\ +} while (0) + +/** Use different logging functions depending on whether request is NULL or not. + * + * This is useful for areas of code which are run on server startup, and when + * processing requests. + * + * @param _l_request The name of a R* logging macro e.g. RDEBUG3. + * @param _l_global The name of a global logging macro e.g. DEBUG3. + * @param fmt printf style format string. + * @param ... printf arguments. + */ + #define ROPTIONAL(_l_request, _l_global, fmt, ...) \ +do {\ + if (request) {\ + _l_request(fmt, ## __VA_ARGS__);\ + } else {\ + _l_global(LOG_PREFIX ": " fmt, ## __VA_ARGS__);\ + }\ +} while (0) + +#define RATE_LIMIT_ENABLED rate_limit_enabled() //!< True if rate limiting is enabled. +/** Rate limit messages + * + * Rate limit log messages so they're written a maximum of once per second. + * + @code{.c} + RATE_LIMIT(RERROR("Home servers alive in pool %s", pool->name)); + @endcode + * @note Rate limits the macro, not the message. If five different messages are + * produced using the same macro in the same second, only the first will + * be written to the log. + * + * @param _x Logging macro to limit. + */ +#define RATE_LIMIT(_x) \ +do {\ + if (RATE_LIMIT_ENABLED) {\ + static time_t _last_complained = 0;\ + time_t _now = time(NULL);\ + if (_now != _last_complained) {\ + _last_complained = _now;\ + _x;\ + }\ + } else _x;\ +} while (0) + +#ifdef __cplusplus +} +#endif + +#endif /* FR_LOG_H */ diff --git a/src/include/map.h b/src/include/map.h new file mode 100644 index 0000000..584c76b --- /dev/null +++ b/src/include/map.h @@ -0,0 +1,111 @@ +/* + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + */ +#ifndef MAP_H +#define MAP_H +/** + * $Id$ + * + * @file map.h + * @brief Structures and prototypes for maps + * + * @copyright 2015 The FreeRADIUS server project + * @copyright 2015 Arran Cudbard-bell <a.cudbardb@freeradius.org> + */ + +RCSIDH(map_h, "$Id$") + +#include <freeradius-devel/conffile.h> +#include <freeradius-devel/tmpl.h> + +#ifdef __cplusplus +extern "C" { +#endif + +/** Value pair map + * + * Value pair maps contain a pair of templates, that describe a src attribute + * or value, and a destination attribute. + * + * Neither src or dst need to be an FR attribute, and their type can be inferred + * from whether map->da is NULL (not FR). + * + * @see vp_tmpl_t + */ +typedef struct vp_map { + vp_tmpl_t *lhs; //!< Typically describes the attribute to add, modify or compare. + vp_tmpl_t *rhs; //!< Typically describes a literal value or a src attribute to copy or compare. + + FR_TOKEN op; //!< The operator that controls insertion of the dst attribute. + + CONF_ITEM *ci; //!< Config item that the map was created from. Mainly used for + //!< logging validation errors. + + struct vp_map *next; //!< The next valuepair map. +} vp_map_t; + +#ifndef WITH_VERIFY_PTR +# define VERIFY_MAP(_x) rad_assert((_x)->lhs) +#else +# define VERIFY_MAP(_x) do { \ + VERIFY_TMPL((_x)->lhs); \ + if ((_x)->rhs) VERIFY_TMPL((_x)->rhs); \ +} while (0) +#endif + +typedef int (*map_validate_t)(vp_map_t *map, void *ctx); +typedef int (*radius_map_getvalue_t)(TALLOC_CTX *ctx, VALUE_PAIR **out, REQUEST *request, + vp_map_t const *map, void *uctx); + +int map_afrom_cp(TALLOC_CTX *ctx, vp_map_t **out, CONF_PAIR *cp, + request_refs_t dst_request_def, pair_lists_t dst_list_def, + request_refs_t src_request_def, pair_lists_t src_list_def); + +int map_afrom_fields(TALLOC_CTX *ctx, vp_map_t **out, char const *lhs, FR_TOKEN lhs_type, + FR_TOKEN op, char const *rhs, FR_TOKEN rhs_type, + request_refs_t dst_request_def, pair_lists_t dst_list_def, + request_refs_t src_request_def, pair_lists_t src_list_def); + +int map_afrom_cs(vp_map_t **out, CONF_SECTION *cs, + pair_lists_t dst_list_def, pair_lists_t src_list_def, + map_validate_t validate, void *ctx, unsigned int max) CC_HINT(nonnull(1, 2)); + +int map_afrom_attr_str(TALLOC_CTX *ctx, vp_map_t **out, char const *raw, + request_refs_t dst_request_def, pair_lists_t dst_list_def, + request_refs_t src_request_def, pair_lists_t src_list_def); + +int8_t map_cmp_by_lhs_attr(void const *a, void const *b); + +void map_sort(vp_map_t **maps, fr_cmp_t cmp); + +int map_to_vp(TALLOC_CTX *ctx, VALUE_PAIR **out, REQUEST *request, + vp_map_t const *map, void *uctx) CC_HINT(nonnull (2,3,4)); + +int map_to_request(REQUEST *request, vp_map_t const *map, + radius_map_getvalue_t func, void *ctx); + +bool map_dst_valid(REQUEST *request, vp_map_t const *map); + +size_t map_prints(char *buffer, size_t bufsize, vp_map_t const *map); + +void map_debug_log(REQUEST *request, vp_map_t const *map, + VALUE_PAIR const *vp) CC_HINT(nonnull(1, 2)); + +bool map_cast_from_hex(vp_map_t *map, FR_TOKEN rhs_type, char const *rhs); +#ifdef __cplusplus +} +#endif + +#endif /* MAP_H */ diff --git a/src/include/math.h b/src/include/math.h new file mode 100644 index 0000000..dc7b197 --- /dev/null +++ b/src/include/math.h @@ -0,0 +1,161 @@ +#pragma once +/* + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + */ + +/** Various miscellaneous utility functions + * + * @file src/lib/util/misc.h + * + * @copyright 2000,2006 The FreeRADIUS server project + */ +RCSIDH(math_h, "$Id$") + +#ifdef __cplusplus +extern "C" { +#endif + +#include <stdio.h> +#include <stdlib.h> +#include <stdint.h> + +/** Find the highest order high bit in an unsigned 64 bit integer + * + * @return 0-64 indicating the position of the highest bit, + * with 0 indicating no high bits, 1 indicating the 1st + * bit and 64 indicating the last bit. + */ +static inline uint8_t fr_high_bit_pos(uint64_t num) +{ + if (num == 0) return 0; /* num being zero is undefined behaviour for __builtin_clzll */ + +#ifdef HAVE_BUILTIN_CLZLL + return (64 - __builtin_clzll(num)); +#else + uint8_t ret = 1; + while (num >>= 1) ret++; + return ret; +#endif +} + +/** Find the lowest order high bit in an unsigned 64 bit integer + * + * @return 0-64 indicating the position of the lowest bit, + * with 0 indicating no high bits, 1 indicating the 1st + * bit and 64 indicating the last bit. + */ +static inline uint8_t fr_low_bit_pos(uint64_t num) +{ + if (num == 0) return 0; + +#ifdef HAVE_BUILTIN_CLZLL + return __builtin_ctzll(num) + 1; +#else + uint8_t ret = 1; + + do { + if (num & 0x01) break; + ret++; + } while (num >>= 1); + + return ret; +#endif +} + +/** Efficient calculation of log10 of a unsigned 64bit integer + * + * @param[in] num to calculate log10 of. + * @return log10 of the integer + */ +static inline uint8_t fr_log10(uint64_t num) +{ + static uint64_t const pow_of_10[] = + { + 1ULL, + 10ULL, + 100ULL, + 1000ULL, + 10000ULL, + 100000ULL, + 1000000ULL, + 10000000ULL, + 100000000ULL, + 1000000000ULL, + 10000000000ULL, + 100000000000ULL, + 1000000000000ULL, + 10000000000000ULL, + 100000000000000ULL, + 1000000000000000ULL, + 10000000000000000ULL, + 100000000000000000ULL, + 1000000000000000000ULL, + 10000000000000000000ULL + }; + uint64_t tmp; + + tmp = (fr_high_bit_pos(num) * 1233) >> 12; + return tmp - (num < pow_of_10[tmp]); +} + +/** Multiplies two integers together + * + * @param[in] _out Where to store the result. + * @param[in] _a first argument to multiply. + * @param[in] _b second argument to multiply. + * @return + * - false on overflow. + * - true if there was no overflow. + */ +#define fr_multiply(_out, _a, _b) !__builtin_mul_overflow(_a, _b, _out) + +/** Adds two integers + * + * @param[in] _out Where to store the result. + * @param[in] _a first argument to add. + * @param[in] _b second argument to add. + * @return + * - false on overflow. + * - true if there was no overflow. + */ +#define fr_add(_out, _a, _b) !__builtin_add_overflow(_a, _b, _out) + +/** Subtracts two integers + * + * @param[in] _out Where to store the result. + * @param[in] _a first argument to subtract. + * @param[in] _b second argument to subtract. + * @return + * - false on overflow. + * - true if there was no overflow. + */ +#define fr_sub(_out, _a, _b) !__builtin_sub_overflow(_a, _b, _out) + +/** Round up - Only works if _mul is a power of 2 but avoids division + */ +#define ROUND_UP_POW2(_num, _mul) (((_num) + ((_mul) - 1)) & ~((_mul) - 1)) + +/** Round up - Works in all cases, but is slower + */ +#define ROUND_UP(_num, _mul) (((((_num) + ((_mul) - 1))) / (_mul)) * (_mul)) + +/** Get the ceiling value of integer division + * + */ +#define ROUND_UP_DIV(_x, _y) (1 + (((_x) - 1) / (_y))) + +#ifdef __cplusplus +} +#endif diff --git a/src/include/md4.h b/src/include/md4.h new file mode 100644 index 0000000..1492bd4 --- /dev/null +++ b/src/include/md4.h @@ -0,0 +1,137 @@ +/** + * $Id$ + * + * @note license is LGPL, but largely derived from a public domain source. + * + * @file md4.h + * @brief Structures and prototypes for md4. + */ + +#ifndef _FR_MD4_H +#define _FR_MD4_H + +RCSIDH(md4_h, "$Id$") + +#ifdef HAVE_INTTYPES_H +# include <inttypes.h> +#endif + +#ifdef HAVE_SYS_TYPES_H +# include <sys/types.h> +#endif + +#ifdef HAVE_STDINT_H +# include <stdint.h> +#endif + +#include <string.h> + +#ifdef WITH_FIPS +#undef HAVE_OPENSSL_MD4_H +#endif + +#ifdef HAVE_OPENSSL_MD4_H +# include <openssl/md4.h> +#endif + +#ifdef __cplusplus +extern "C" { +#endif + +#ifndef MD4_DIGEST_LENGTH +# define MD4_DIGEST_LENGTH 16 +#endif + +#ifndef HAVE_OPENSSL_MD4_H +/* + * The MD5 code used here and in md4.c was originally retrieved from: + * http://www.openbsd.org/cgi-bin/cvsweb/src/include/md4.h?rev=1.12 + * + * This code implements the MD4 message-digest algorithm. + * The algorithm is due to Ron Rivest. This code was + * written by Colin Plumb in 1993, no copyright is claimed. + * This code is in the public domain; do with it what you wish. + * Todd C. Miller modified the MD5 code to do MD4 based on RFC 1186. + * + * Equivalent code is available from RSA Data Security, Inc. + * This code has been tested against that, and is equivalent, + * except that you don't need to include two pages of legalese + * with every copy. + */ +# define MD4_BLOCK_LENGTH 64 +# define MD4_DIGEST_STRING_LENGTH (MD4_DIGEST_LENGTH * 2 + 1) + +typedef struct FR_MD4Context { + uint32_t state[4]; //!< State. + uint32_t count[2]; //!< Number of bits, mod 2^64. + uint8_t buffer[MD4_BLOCK_LENGTH]; //!< Input buffer. +} FR_MD4_CTX; + +void fr_md4_init(FR_MD4_CTX *ctx); +void fr_md4_update(FR_MD4_CTX *ctx, uint8_t const *in, size_t inlen) + CC_BOUNDED(__string__, 2, 3); +void fr_md4_final(uint8_t out[MD4_DIGEST_LENGTH], FR_MD4_CTX *ctx) + CC_BOUNDED(__minbytes__, 1, MD4_DIGEST_LENGTH); +void fr_md4_transform(uint32_t buf[4], uint8_t const inc[MD4_BLOCK_LENGTH]) + CC_BOUNDED(__size__, 1, 4, 4) + CC_BOUNDED(__minbytes__, 2, MD4_BLOCK_LENGTH); +# define fr_md4_destroy(_x) +#else /* HAVE_OPENSSL_MD4_H */ +#if OPENSSL_VERSION_NUMBER < 0x30000000L +USES_APPLE_DEPRECATED_API +# define FR_MD4_CTX MD4_CTX +# define fr_md4_init MD4_Init +# define fr_md4_update MD4_Update +# define fr_md4_final MD4_Final +# define fr_md4_transform MD4_Transform +# define fr_md4_destroy(_x) +#else +#include <openssl/evp.h> + +/* + * Wrappers for OpenSSL3, so we don't have to butcher the rest of + * the code too much. + */ +typedef struct FR_MD4_CTX { + EVP_MD_CTX *ctx; + EVP_MD const *md; + unsigned int len; +} FR_MD4_CTX; + +static inline void fr_md4_init(FR_MD4_CTX *ctx) +{ + ctx->ctx = EVP_MD_CTX_new(); +// ctx->md = EVP_MD_fetch(NULL, "MD4", "provider=legacy"); + ctx->md = EVP_md4(); + ctx->len = MD4_DIGEST_LENGTH; + + EVP_MD_CTX_set_flags(ctx->ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW); + EVP_DigestInit_ex(ctx->ctx, ctx->md, NULL); +} + +static inline void fr_md4_update(FR_MD4_CTX *ctx, uint8_t const *in, size_t inlen) +{ + EVP_DigestUpdate(ctx->ctx, in, inlen); +} + +static inline void fr_md4_final(uint8_t out[MD4_DIGEST_LENGTH], FR_MD4_CTX *ctx) +{ + EVP_DigestFinal_ex(ctx->ctx, out, &(ctx->len)); +} + +static inline void fr_md4_destroy(FR_MD4_CTX *ctx) +{ + EVP_MD_CTX_destroy(ctx->ctx); +// EVP_MD_free(ctx->md); +} + +#endif /* OPENSSL3 */ +#endif /* HAVE_OPENSSL_MD4_H */ + +/* md4.c */ +void fr_md4_calc(uint8_t out[MD4_DIGEST_LENGTH], uint8_t const *in, size_t inlen); + +#ifdef __cplusplus +} +#endif +#endif /* _FR_MD4_H */ diff --git a/src/include/md5.h b/src/include/md5.h new file mode 100644 index 0000000..b7d571a --- /dev/null +++ b/src/include/md5.h @@ -0,0 +1,123 @@ +/** + * $Id$ + * + * @note license is LGPL, but largely derived from a public domain source. + * + * @file md5.h + * @brief Structures and prototypes for md5. + */ + +#ifndef _FR_MD5_H +#define _FR_MD5_H + +RCSIDH(md5_h, "$Id$") + +#ifdef HAVE_INTTYPES_H +# include <inttypes.h> +#endif + +#ifdef HAVE_SYS_TYPES_H +# include <sys/types.h> +#endif + +#ifdef HAVE_STDINT_H +# include <stdint.h> +#endif + +# include <string.h> + +#ifdef WITH_FIPS +#undef HAVE_OPENSSL_MD5_H +#endif + +#ifdef HAVE_OPENSSL_MD5_H +# include <openssl/md5.h> +#endif + +#ifdef __cplusplus +extern "C" { +#endif + +#ifndef MD5_DIGEST_LENGTH +# define MD5_DIGEST_LENGTH 16 +#endif + +#ifndef HAVE_OPENSSL_MD5_H +/* + * The MD5 code used here and in md5.c was originally retrieved from: + * http://www.openbsd.org/cgi-bin/cvsweb/~checkout~/src/sys/crypto/md5.h?rev=1.1 + * + * This code implements the MD5 message-digest algorithm. + * The algorithm is due to Ron Rivest. This code was + * written by Colin Plumb in 1993, no copyright is claimed. + * This code is in the public domain; do with it what you wish. + * + * Equivalent code is available from RSA Data Security, Inc. + * This code has been tested against that, and is equivalent, + * except that you don't need to include two pages of legalese + * with every copy. + */ +# define MD5_BLOCK_LENGTH 64 +typedef struct FR_MD5Context { + uint32_t state[4]; //!< State. + uint32_t count[2]; //!< Number of bits, mod 2^64. + uint8_t buffer[MD5_BLOCK_LENGTH]; //!< Input buffer. +} FR_MD5_CTX; + +void fr_md5_init(FR_MD5_CTX *ctx); +void fr_md5_update(FR_MD5_CTX *ctx, uint8_t const *in, size_t inlen) + CC_BOUNDED(__string__, 2, 3); +void fr_md5_final(uint8_t out[MD5_DIGEST_LENGTH], FR_MD5_CTX *ctx) + CC_BOUNDED(__minbytes__, 1, MD5_DIGEST_LENGTH); +void fr_md5_transform(uint32_t state[4], uint8_t const block[MD5_BLOCK_LENGTH]) + CC_BOUNDED(__size__, 1, 4, 4) + CC_BOUNDED(__minbytes__, 2, MD5_BLOCK_LENGTH); +# define fr_md5_destroy(_x) +# define fr_md5_copy(_dst, _src) _dst = _src +#else /* HAVE_OPENSSL_MD5_H */ +#if OPENSSL_VERSION_NUMBER < 0x30000000L +USES_APPLE_DEPRECATED_API +# define FR_MD5_CTX MD5_CTX +# define fr_md5_init MD5_Init +# define fr_md5_update MD5_Update +# define fr_md5_final MD5_Final +# define fr_md5_transform MD5_Transform +# define fr_md5_copy(_dst, _src) _dst = _src +# define fr_md5_destroy(_x) +#else +#include <openssl/evp.h> + +/* + * Wrappers for OpenSSL3, so we don't have to butcher the rest of + * the code too much. + */ +typedef EVP_MD_CTX* FR_MD5_CTX; + +# define fr_md5_init(_ctx) \ + do { \ + *_ctx = EVP_MD_CTX_new(); \ + EVP_MD_CTX_set_flags(*_ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW); \ + EVP_DigestInit_ex(*_ctx, EVP_md5(), NULL); \ + } while (0) +# define fr_md5_update(_ctx, _str, _len) \ + EVP_DigestUpdate(*_ctx, _str, _len) +# define fr_md5_final(_out, _ctx) \ + EVP_DigestFinal_ex(*_ctx, _out, NULL) +# define fr_md5_destroy(_ctx) EVP_MD_CTX_destroy(*_ctx) +# define fr_md5_copy(_dst, _src) EVP_MD_CTX_copy_ex(_dst, _src) +#endif /* OPENSSL3 */ +#endif /* HAVE_OPENSSL_MD5_H */ + +/* hmac.c */ +void fr_hmac_md5(uint8_t digest[MD5_DIGEST_LENGTH], uint8_t const *text, size_t text_len, + uint8_t const *key, size_t key_len) + CC_BOUNDED(__minbytes__, 1, MD5_DIGEST_LENGTH); + +/* md5.c */ +void fr_md5_calc(uint8_t *out, uint8_t const *in, size_t inlen); + +#ifdef __cplusplus +} +#endif + +#endif /* _FR_MD5_H */ diff --git a/src/include/missing-h b/src/include/missing-h new file mode 100644 index 0000000..5698797 --- /dev/null +++ b/src/include/missing-h @@ -0,0 +1,530 @@ +#ifndef _FR_MISSING_H +#define _FR_MISSING_H + +/* + * missing.h Replacements for functions that are or can be + * missing on some platforms. + * HAVE_* and WITH_* defines are substituted at + * build time by make with values from autoconf.h. + * + * Version: $Id$ + * + */ +RCSIDH(missing_h, "$Id$") + +#ifdef HAVE_STDINT_H +# include <stdint.h> +#endif + +#ifdef HAVE_STDDEF_H +# include <stddef.h> +#endif + +#ifdef HAVE_SYS_TYPES_H +# include <sys/types.h> +#endif + +#ifdef HAVE_INTTYPES_H +# include <inttypes.h> +#endif + +#ifdef HAVE_STRINGS_H +# include <strings.h> +#endif + +#ifdef HAVE_STRING_H +# include <string.h> +#endif + +#ifdef HAVE_NETDB_H +# include <netdb.h> +#endif + +#ifdef HAVE_NETINET_IN_H +# include <netinet/in.h> +#endif + +#ifdef HAVE_ARPA_INET_H +# include <arpa/inet.h> +#endif + +#ifdef HAVE_SYS_SELECT_H +# include <sys/select.h> +#endif + +#ifdef HAVE_SYS_SOCKET_H +# include <sys/socket.h> +#endif + +#ifdef HAVE_UNISTD_H +# include <unistd.h> +#endif + +#ifndef HAVE_VSNPRINTF +# include <stdarg.h> +#endif + +#ifdef HAVE_ERRNO_H +# include <errno.h> +#endif + +/* + * Check for inclusion of <time.h>, versus <sys/time.h> + * Taken verbatim from the autoconf manual. + */ +#ifdef TIME_WITH_SYS_TIME +# include <sys/time.h> +# include <time.h> +#else +# if HAVE_SYS_TIME_H +# include <sys/time.h> +# else +# include <time.h> +# endif +#endif + +#ifdef HAVE_OPENSSL_SSL_H +# include <openssl/ssl.h> +#endif + +#ifdef HAVE_OPENSSL_HMAC_H +# include <openssl/hmac.h> +#endif + +#ifdef HAVE_OPENSSL_ASN1_H +# include <openssl/asn1.h> +#endif + +#ifdef HAVE_OPENSSL_CONF_H +# include <openssl/conf.h> +#endif + +/* + * Don't look for winsock.h if we're on cygwin. + */ +#if !defined(__CYGWIN__) && defined(HAVE_WINSOCK_H) +# include <winsock.h> +#endif + +#ifdef __APPLE__ +#undef DARWIN +#define DARWIN (1) +#endif + +#ifdef __cplusplus +extern "C" { +#endif + +/* + * Functions from missing.c + */ +#ifndef HAVE_STRNCASECMP +int strncasecmp(char *s1, char *s2, int n); +#endif + +#ifndef HAVE_STRCASECMP +int strcasecmp(char *s1, char *s2); +#endif + +#ifndef HAVE_STRSEP +char *strsep(char **stringp, char const *delim); +#endif + +#ifndef HAVE_LOCALTIME_R +struct tm; +struct tm *localtime_r(time_t const *l_clock, struct tm *result); +#endif + +#ifndef HAVE_CTIME_R +char *ctime_r(time_t const *l_clock, char *l_buf); +#endif + +#ifndef HAVE_INET_PTON +int inet_pton(int af, char const *src, void *dst); +#endif +#ifndef HAVE_INET_NTOP +char const *inet_ntop(int af, void const *src, char *dst, size_t cnt); +#endif +#ifndef HAVE_CLOSEFROM +int closefrom(int fd); +#endif + +#ifndef HAVE_SETLINEBUF +# ifdef HAVE_SETVBUF +# define setlinebuf(x) setvbuf(x, NULL, _IOLBF, 0) +# else +# define setlinebuf(x) 0 +# endif +#endif + +#ifndef INADDR_ANY +# define INADDR_ANY ((uint32_t) 0x00000000) +#endif + +#ifndef INADDR_LOOPBACK +# define INADDR_LOOPBACK ((uint32_t) 0x7f000001) /* Inet 127.0.0.1 */ +#endif + +#ifndef INADDR_NONE +# define INADDR_NONE ((uint32_t) 0xffffffff) +#endif + +#ifndef INADDRSZ +# define INADDRSZ 4 +#endif + +#ifndef INET_ADDRSTRLEN +# define INET_ADDRSTRLEN 16 +#endif + +#ifndef AF_UNSPEC +# define AF_UNSPEC 0 +#endif + +#ifndef AF_INET6 +# define AF_INET6 10 +#endif + +#ifndef HAVE_STRUCT_IN6_ADDR +struct in6_addr +{ + union { + uint8_t u6_addr8[16]; + uint16_t u6_addr16[8]; + uint32_t u6_addr32[4]; + } in6_u; +# define s6_addr in6_u.u6_addr8 +# define s6_addr16 in6_u.u6_addr16 +# define s6_addr32 in6_u.u6_addr32 +}; + +# ifndef IN6ADDRSZ +# define IN6ADDRSZ 16 +# endif + +# ifndef INET6_ADDRSTRLEN +# define INET6_ADDRSTRLEN 46 +# endif + +# ifndef IN6ADDR_ANY_INIT +# define IN6ADDR_ANY_INIT {{{ 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 }}} +# endif + +# ifndef IN6ADDR_LOOPBACK_INIT +# define IN6ADDR_LOOPBACK_INIT {{{ 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1 }}} +# endif + +# ifndef IN6_IS_ADDR_UNSPECIFIED +# define IN6_IS_ADDR_UNSPECIFIED(a) \ + (((__const uint32_t *) (a))[0] == 0 \ + && ((__const uint32_t *) (a))[1] == 0 \ + && ((__const uint32_t *) (a))[2] == 0 \ + && ((__const uint32_t *) (a))[3] == 0) +# endif + +# ifndef IN6_IS_ADDR_LOOPBACK +# define IN6_IS_ADDR_LOOPBACK(a) \ + (((__const uint32_t *) (a))[0] == 0 \ + && ((__const uint32_t *) (a))[1] == 0 \ + && ((__const uint32_t *) (a))[2] == 0 \ + && ((__const uint32_t *) (a))[3] == htonl (1)) +# endif + +# ifndef IN6_IS_ADDR_MULTICAST +# define IN6_IS_ADDR_MULTICAST(a) (((__const uint8_t *) (a))[0] == 0xff) +# endif + +# ifndef IN6_IS_ADDR_LINKLOCAL +# define IN6_IS_ADDR_LINKLOCAL(a) \ + ((((__const uint32_t *) (a))[0] & htonl (0xffc00000)) \ + == htonl (0xfe800000)) +# endif + +# ifndef IN6_IS_ADDR_SITELOCAL +# define IN6_IS_ADDR_SITELOCAL(a) \ + ((((__const uint32_t *) (a))[0] & htonl (0xffc00000)) \ + == htonl (0xfec00000)) +# endif + +# ifndef IN6_IS_ADDR_V4MAPPED +# define IN6_IS_ADDR_V4MAPPED(a) \ + ((((__const uint32_t *) (a))[0] == 0) \ + && (((__const uint32_t *) (a))[1] == 0) \ + && (((__const uint32_t *) (a))[2] == htonl (0xffff))) +# endif + +# ifndef IN6_IS_ADDR_V4COMPAT +# define IN6_IS_ADDR_V4COMPAT(a) \ + ((((__const uint32_t *) (a))[0] == 0) \ + && (((__const uint32_t *) (a))[1] == 0) \ + && (((__const uint32_t *) (a))[2] == 0) \ + && (ntohl (((__const uint32_t *) (a))[3]) > 1)) +# endif + +# ifndef IN6_ARE_ADDR_EQUAL +# define IN6_ARE_ADDR_EQUAL(a,b) \ + ((((__const uint32_t *) (a))[0] == ((__const uint32_t *) (b))[0]) \ + && (((__const uint32_t *) (a))[1] == ((__const uint32_t *) (b))[1]) \ + && (((__const uint32_t *) (a))[2] == ((__const uint32_t *) (b))[2]) \ + && (((__const uint32_t *) (a))[3] == ((__const uint32_t *) (b))[3])) +# endif +#endif /* HAVE_STRUCT_IN6_ADDR */ + +/* + * Functions from getaddrinfo.c + */ + +#ifndef HAVE_STRUCT_SOCKADDR_STORAGE +struct sockaddr_storage +{ + uint16_t ss_family; /* Address family, etc. */ + char ss_padding[128 - (sizeof(uint16_t))]; +}; +#endif + +#ifndef HAVE_STRUCT_ADDRINFO +/* for old netdb.h */ +# ifndef EAI_SERVICE +# define EAI_MEMORY 2 +# define EAI_FAMILY 5 /* ai_family not supported */ +# define EAI_NONAME 8 /* hostname nor servname provided, or not known */ +# define EAI_SERVICE 9 /* servname not supported for ai_socktype */ +# endif + +/* dummy value for old netdb.h */ +# ifndef AI_PASSIVE +# define AI_PASSIVE 1 +# define AI_CANONNAME 2 +# define AI_NUMERICHOST 4 +# define NI_NUMERICHOST 2 +# define NI_NAMEREQD 4 +# define NI_NUMERICSERV 8 + +struct addrinfo +{ + int ai_flags; /* Input flags. */ + int ai_family; /* Protocol family for socket. */ + int ai_socktype; /* Socket type. */ + int ai_protocol; /* Protocol for socket. */ + socklen_t ai_addrlen; /* Length of socket address. */ + struct sockaddr *ai_addr; /* Socket address for socket. */ + char *ai_canonname; /* Canonical name for service location. */ + struct addrinfo *ai_next; /* Pointer to next in list. */ +}; + +# endif /* AI_PASSIVE */ +#endif /* HAVE_STRUCT_ADDRINFO */ + +/* Translate name of a service location and/or a service name to set of + socket addresses. */ +#ifndef HAVE_GETADDRINFO +int getaddrinfo(char const *__name, char const *__service, + struct addrinfo const *__req, + struct addrinfo **__pai); + +/* Free `addrinfo' structure AI including associated storage. */ +void freeaddrinfo (struct addrinfo *__ai); + +/* Convert error return from getaddrinfo() to a string. */ +char const *gai_strerror (int __ecode); +#endif + +/* Translate a socket address to a location and service name. */ +#ifndef HAVE_GETNAMEINFO +int getnameinfo(struct sockaddr const *__sa, + socklen_t __salen, char *__host, + size_t __hostlen, char *__serv, + size_t __servlen, unsigned int __flags); +#endif + +/* + * Functions from snprintf.c + */ +#ifndef HAVE_VSNPRINTF +int vsnprintf(char *str, size_t count, char const *fmt, va_list arg); +#endif + +#ifndef HAVE_SNPRINTF +int snprintf(char *str, size_t count, char const *fmt, ...); +#endif + +/* + * Functions from strl{cat,cpy}.c + */ +#ifndef HAVE_STRLCPY +size_t strlcpy(char *dst, char const *src, size_t siz); +#endif + +#ifndef HAVE_STRLCAT +size_t strlcat(char *dst, char const *src, size_t siz); +#endif + +#ifndef INT16SZ +# define INT16SZ (2) +#endif + +#ifndef HAVE_GMTIME_R +struct tm *gmtime_r(time_t const *l_clock, struct tm *result); +#endif + +#ifndef HAVE_VDPRINTF +int vdprintf (int fd, char const *format, va_list args); +#endif + +#ifndef HAVE_GETTIMEOFDAY +int gettimeofday (struct timeval *tv, void *tz); +#endif + +/* + * Work around different ctime_r styles + */ +#if defined(CTIMERSTYLE) && (CTIMERSTYLE == SOLARISSTYLE) +# define CTIME_R(a,b,c) ctime_r(a,b,c) +# define ASCTIME_R(a,b,c) asctime_r(a,b,c) +#else +# define CTIME_R(a,b,c) ctime_r(a,b) +# define ASCTIME_R(a,b,c) asctime_r(a,b) +#endif + +#ifdef WIN32 +# undef interface +# undef mkdir +# define mkdir(_d, _p) mkdir(_d) +# define FR_DIR_SEP '\\' +# define FR_DIR_IS_RELATIVE(p) ((*p && (p[1] != ':')) || ((*p != '\\') && (*p != '\\'))) +#else +# define FR_DIR_SEP '/' +# define FR_DIR_IS_RELATIVE(p) ((*p) != '/') +#endif + +#ifndef offsetof +# define offsetof(TYPE, MEMBER) ((size_t) &((TYPE *)0)->MEMBER) +#endif + +void timeval2ntp(struct timeval const *tv, uint8_t *ntp); +void ntp2timeval(struct timeval *tv, char const *ntp); + +/* + * This is really hacky. Any code needing to perform operations on 128bit integers, + * or return 128BIT integers should check for HAVE_128BIT_INTEGERS. + */ +#ifndef HAVE_UINT128_T +# ifdef HAVE___UINT128_T +# define HAVE_128BIT_INTEGERS +# define uint128_t __uint128_t +# define int128_t __int128_t +# else +typedef struct uint128_t { uint8_t v[16]; } uint128_t; +typedef struct int128_t { uint8_t v[16]; } int128_t; +# endif +#else +# define HAVE_128BIT_INTEGERS +#endif + +/* abcd efgh -> dcba hgfe -> hgfe dcba */ +#ifndef HAVE_HTONLL +# ifdef FR_LITTLE_ENDIAN +# ifdef HAVE_BUILTIN_BSWAP64 +# define ntohll(x) __builtin_bswap64(x) +# else +# define ntohll(x) (((uint64_t)ntohl((uint32_t)(x >> 32))) | (((uint64_t)ntohl(((uint32_t) x)) << 32))) +# endif +# else +# define ntohll(x) (x) +# endif +# define htonll(x) ntohll(x) +#endif + +#ifndef HAVE_HTONLLL +# ifdef FR_LITTLE_ENDIAN +# ifdef HAVE_128BIT_INTEGERS +# define ntohlll(x) (((uint128_t)ntohll((uint64_t)(x >> 64))) | (((uint128_t)ntohll(((uint64_t) x)) << 64))) +# else +uint128_t ntohlll(uint128_t num); +# endif +# else +# define ntohlll(x) (x) +# endif +# define htonlll(x) htohlll(x) +#endif + +#ifndef HAVE_SIG_T +typedef void(*sig_t)(int); +#endif + +#ifdef HAVE_OPENSSL_HMAC_H +# ifndef HAVE_HMAC_CTX_NEW +HMAC_CTX *HMAC_CTX_new(void); +# endif +# ifndef HAVE_HMAC_CTX_FREE +void HMAC_CTX_free(HMAC_CTX *ctx); +# endif +#endif + +#ifdef HAVE_OPENSSL_ASN1_H +# ifndef HAVE_ASN1_STRING_GET0_DATA +static inline const unsigned char *ASN1_STRING_get0_data(const ASN1_STRING *x) +{ + /* + * Trick the compiler into not issuing the warning on qualifier stripping. + * We know that ASN1_STRING_data doesn't change x, and we're casting + * the return value back to const immediately, so it's OK. + */ + union { + const ASN1_STRING *c; + ASN1_STRING *nc; + } const_strip = {.c = x}; + return ASN1_STRING_data(const_strip.nc); +} +# endif +#endif + +#ifdef HAVE_OPENSSL_CONF_H +# ifndef HAVE_CONF_MODULES_LOAD_FILE +static inline int CONF_modules_load_file(const char *filename, + const char *appname, + unsigned long flags) +{ + (void)filename; + (void)flags; + return OPENSSL_config(appname); +} +# endif +#endif + +#ifdef __cplusplus +} +#endif + +#ifdef HAVE_OPENSSL_SSL_H +# ifndef HAVE_SSL_GET_CLIENT_RANDOM +size_t SSL_get_client_random(const SSL *s, unsigned char *out, size_t outlen); +# endif +# ifndef HAVE_SSL_GET_SERVER_RANDOM +size_t SSL_get_server_random(const SSL *s, unsigned char *out, size_t outlen); +# endif +# ifndef HAVE_SSL_SESSION_GET_MASTER_KEY +size_t SSL_SESSION_get_master_key(const SSL_SESSION *s, + unsigned char *out, size_t outlen); +# endif +#endif + +/* + * NetBSD doesn't have O_DIRECTORY. + */ +#ifndef O_DIRECTORY +#define O_DIRECTORY 0 +#endif + +#ifndef O_NOFOLLOW +#define O_NOFOLLOW 0 +#endif + +/* + * Not really missing, but may be submitted as patches + * to the talloc project at some point in the future. + */ +char *talloc_typed_strdup(const void *t, const char *p); +char *talloc_typed_asprintf(const void *t, const char *fmt, ...) CC_HINT(format (printf, 2, 3)); +char *talloc_bstrndup(const void *t, char const *in, size_t inlen); +#endif /* _FR_MISSING_H */ diff --git a/src/include/modcall.h b/src/include/modcall.h new file mode 100644 index 0000000..7486ef1 --- /dev/null +++ b/src/include/modcall.h @@ -0,0 +1,55 @@ +#ifndef FR_MODCALL_H +#define FR_MODCALL_H + +/* modcall.h: the outside interface to the module-calling tree. Includes + * functions to build the tree from the config file, and to call it by + * feeding it REQUESTs. + * + * Version: $Id$ */ + +#include <freeradius-devel/conffile.h> /* Need CONF_* definitions */ +#include <freeradius-devel/modules.h> + +#ifdef __cplusplus +extern "C" { +#endif + +/* + * For each authorize/authtype/etc, we have an ordered + * tree of instances to call. This data structure keeps track + * of that order. + */ +typedef struct modcallable modcallable; + +int modcall_fixup_update(vp_map_t *map, void *ctx); + +int modcall(rlm_components_t component, modcallable *c, REQUEST *request); + +/* Parse a module-method's config section (e.g. authorize{}) into a tree that + * may be called with modcall() */ +modcallable *compile_modgroup(modcallable *parent, + rlm_components_t component, CONF_SECTION *cs); + +/* Create a single modcallable node that references a module instance. This + * may be a CONF_SECTION containing action specifiers like "notfound = return" + * or a simple CONF_PAIR, in which case the default actions are used. */ +modcallable *compile_modsingle(TALLOC_CTX *ctx, modcallable **parent, rlm_components_t component, CONF_ITEM *ci, + char const **modname); + +/* + * Do the second pass on compiling the modules. + */ +bool modcall_pass2(modcallable *mc); + +/* Add an entry to the end of a modgroup */ +void add_to_modcallable(modcallable *parent, modcallable *this); + +void modcall_debug(modcallable *mc, int depth); + +int modcall_pass2_condition(fr_cond_t *c); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/src/include/modpriv.h b/src/include/modpriv.h new file mode 100644 index 0000000..f69b47c --- /dev/null +++ b/src/include/modpriv.h @@ -0,0 +1,69 @@ +/* modpriv.h: Stuff needed by both modules.c and modcall.c, but should not be + * accessed from anywhere else. + * + * Version: $Id$ */ +#ifndef FR_MODPRIV_H +#define FR_MODPRIV_H + +#include <freeradius-devel/radiusd.h> +#include <freeradius-devel/modules.h> + +#ifndef HAVE_DLFCN_H +#error FreeRADIUS needs either libltdl, or a working dlopen() +#else +#include <dlfcn.h> +#endif + +#ifdef __cplusplus +extern "C" { +#endif + +typedef void *fr_dlhandle; + +fr_dlhandle fr_dlopenext(char const *name); +void *fr_dlsym(fr_dlhandle handle, char const *symbol); +int fr_dlclose(fr_dlhandle handle); +char const *fr_dlerror(void); + +/* + * Keep track of which modules we've loaded. + */ +typedef struct module_entry_t { + char name[MAX_STRING_LEN]; + module_t const *module; + fr_dlhandle handle; +} module_entry_t; + +typedef struct fr_module_hup_t fr_module_hup_t; + +/* + * Per-instance data structure, to correlate the modules + * with the instance names (may NOT be the module names!), + * and the per-instance data structures. + */ +typedef struct module_instance_t { + char name[MAX_STRING_LEN]; + module_entry_t *entry; + void *insthandle; +#ifdef HAVE_PTHREAD_H + pthread_mutex_t *mutex; +#endif + CONF_SECTION *cs; + time_t last_hup; + bool instantiated; + bool force; + rlm_rcode_t code; + fr_module_hup_t *mh; +} module_instance_t; + +module_instance_t *module_instantiate(CONF_SECTION *modules, char const *askedname); +module_instance_t *module_instantiate_method(CONF_SECTION *modules, char const *askedname, rlm_components_t *method); +module_instance_t *module_find(CONF_SECTION *modules, char const *askedname); +int find_module_sibling_section(CONF_SECTION **out, CONF_SECTION *module, char const *name); +int module_hup_module(CONF_SECTION *cs, module_instance_t *node, time_t when); + +#ifdef __cplusplus +} +#endif + +#endif /* FR_MODPRIV_H */ diff --git a/src/include/modules.h b/src/include/modules.h new file mode 100644 index 0000000..9ba81b3 --- /dev/null +++ b/src/include/modules.h @@ -0,0 +1,175 @@ +/* + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + */ + +/** + * $Id$ + * + * @file modules.h + * @brief Interface to the RADIUS module system. + * + * @copyright 2013 The FreeRADIUS server project + */ + +#ifndef RADIUS_MODULES_H +#define RADIUS_MODULES_H + +RCSIDH(modules_h, "$Id$") + +#include <freeradius-devel/conffile.h> +#include <freeradius-devel/features.h> + +#ifdef __cplusplus +extern "C" { +#endif + +/** The different section components of the server + * + * Used as indexes in the methods array in the module_t struct. + */ +typedef enum rlm_components { + MOD_AUTHENTICATE = 0, //!< 0 methods index for authenticate section. + MOD_AUTHORIZE, //!< 1 methods index for authorize section. + MOD_PREACCT, //!< 2 methods index for preacct section. + MOD_ACCOUNTING, //!< 3 methods index for accounting section. + MOD_SESSION, //!< 4 methods index for checksimul section. + MOD_PRE_PROXY, //!< 5 methods index for preproxy section. + MOD_POST_PROXY, //!< 6 methods index for postproxy section. + MOD_POST_AUTH, //!< 7 methods index for postauth section. +#ifdef WITH_COA + MOD_RECV_COA, //!< 8 methods index for recvcoa section. + MOD_SEND_COA, //!< 9 methods index for sendcoa section. +#endif + MOD_COUNT //!< 10 how many components there are. +} rlm_components_t; + +extern const FR_NAME_NUMBER mod_rcode_table[]; + +/** Map a section name, to a section typename, to an attribute number + * + * Used by modules.c to define the mappings between names, types and control + * attributes. + */ +typedef struct section_type_value_t { + char const *section; //!< Section name e.g. "Authorize". + char const *typename; //!< Type name e.g. "Auth-Type". + int attr; //!< Attribute number. +} section_type_value_t; + +/** Mappings between section names, typenames and control attributes + * + * Defined in modules.c. + */ +extern const section_type_value_t section_type_value[]; + +#define RLM_TYPE_THREAD_SAFE (0 << 0) //!< Module is threadsafe. +#define RLM_TYPE_THREAD_UNSAFE (1 << 0) //!< Module is not threadsafe. + //!< Server will protect calls + //!< with mutex. +#define RLM_TYPE_HUP_SAFE (1 << 2) //!< Will be restarted on HUP. + //!< Server will instantiated + //!< new instance, and then + //!< destroy old instance. + + +/* Stop people using different module/library/server versions together */ +#define RLM_MODULE_INIT RADIUSD_MAGIC_NUMBER + +/** Module section callback + * + * Is called when the module is listed in a particular section of a virtual + * server, and the request has reached the module call. + * + * @param[in] instance created in instantiated, holds module config. + * @param[in,out] request being processed. + * @return the appropriate rcode. + */ +typedef rlm_rcode_t (*packetmethod)(void *instance, REQUEST *request); + +/** Module instantiation callback + * + * Is called once per module instance. Is not called when new threads are + * spawned. Modules that require separate thread contexts should use the + * connection pool API. + * + * @param[in] mod_cs Module instance's configuration section. + * @param[out] instance Module instance's configuration structure, should be + * alloced by by callback and freed by detach. + * @return -1 if instantiation failed, else 0. + */ +typedef int (*instantiate_t)(CONF_SECTION *mod_cs, void *instance); + +/** Module detach callback + * + * Is called just before the server exits, and after re-instantiation on HUP, + * to free the old module instance. + * + * Detach should close all handles associated with the module instance, and + * free any memory allocated during instantiate. + * + * @param[in] instance to free. + * @return -1 if detach failed, else 0. + */ +typedef int (*detach_t)(void *instance); + +/** Metadata exported by the module + * + * This determines the capabilities of the module, and maps internal functions + * within the module to different sections. + */ +typedef struct module_t { + uint64_t magic; //!< Used to validate module struct. + char const *name; //!< The name of the module (without rlm_ prefix). + int type; //!< One or more of the RLM_TYPE_* constants. + size_t inst_size; //!< Size of the instance data + CONF_PARSER const *config; //!< Configuration information + instantiate_t bootstrap; //!< register dynamic attrs, etc. + instantiate_t instantiate; //!< Function to use for instantiation. + detach_t detach; //!< Function to use to free module instance. + packetmethod methods[MOD_COUNT]; //!< Pointers to the various section functions. +} module_t; + +int modules_init(CONF_SECTION *); +int modules_free(void); +int modules_hup(CONF_SECTION *modules); +rlm_rcode_t process_authorize(int type, REQUEST *request); +rlm_rcode_t process_authenticate(int type, REQUEST *request); +rlm_rcode_t module_preacct(REQUEST *request); +rlm_rcode_t process_accounting(int type, REQUEST *request); +int process_checksimul(int type, REQUEST *request, int maxsimul); +rlm_rcode_t process_pre_proxy(int type, REQUEST *request); +rlm_rcode_t process_post_proxy(int type, REQUEST *request); +rlm_rcode_t process_post_auth(int type, REQUEST *request); +#ifdef WITH_COA +rlm_rcode_t process_recv_coa(int type, REQUEST *request); +rlm_rcode_t process_send_coa(int type, REQUEST *request); +#define MODULE_NULL_COA_FUNCS ,NULL,NULL +#else +#define MODULE_NULL_COA_FUNCS +#endif + +rlm_rcode_t indexed_modcall(rlm_components_t comp, int idx, REQUEST *request); + +/* + * For now, these are strongly tied together. + */ +int virtual_servers_load(CONF_SECTION *config); +void virtual_servers_free(time_t when); + +#ifdef __cplusplus +} +#endif + +#endif /* RADIUS_MODULES_H */ diff --git a/src/include/net.h b/src/include/net.h new file mode 100644 index 0000000..2d87b4c --- /dev/null +++ b/src/include/net.h @@ -0,0 +1,140 @@ +#ifndef FR_NET_H +#define FR_NET_H +/* + * This program is is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License, version 2 of the + * License as published by the Free Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + */ + +/** + * $Id$ + * @file include/net.h + * @brief Structures and functions for parsing raw network packets. + * + * @author Arran Cudbard-Bell <a.cudbardb@freeradius.org> + * @copyright 2014 Arran Cudbard-Bell <a.cudbardb@freeradius.org> + */ + +/* + * If we don't have libpcap, we still need an enumeration of link layers. + */ +#ifdef HAVE_LIBPCAP +# include <pcap.h> +#else +typedef enum { + DLT_RAW, + DLT_NULL, + DLT_LOOP, + DLT_EN10MB, + DLT_LINUX_SLL, + DLT_PFLOG +} fr_dlt; +#endif + +/* + * The number of bytes in an ethernet (MAC) address. + */ +#define ETHER_ADDR_LEN 6 + +/* + * Length of a DEC/Intel/Xerox or 802.3 Ethernet header. + * Note that some compilers may pad "struct ether_header" to + * a multiple of 4 *bytes, for example, so "sizeof (struct + * ether_header)" may not give the right answer. + * + * 6 Byte SRC, 6 Byte DST, 2 Byte Ether type, 4 Byte CVID, 4 Byte SVID + */ +#define ETHER_HDR_LEN 22 +#define IP_HDR_LEN 60 + +/* + * The number of bytes in a RADIUS packet header. + */ +#define RADIUS_HDR_LEN 20 + +/* + * RADIUS packet length. + * RFC 2865, Section 3., subsection 'length' says: + * " ... and maximum length is 4096." + */ +#define MAX_RADIUS_LEN 4096 +#define MIN_RADIUS_LEN 20 + + +#define IP_V(ip) (((ip)->ip_vhl & 0xf0) >> 4) +#define IP_HL(ip) ((ip)->ip_vhl & 0x0f) + +#define IP_VHL(v, hl) ((v & 0x0f) << 4) | (hl & 0x0f) + +#define I_DF 0x4000 //!< Dont fragment flag. +#define IP_MF 0x2000 //!< More fragments flag. +#define IP_OFFMASK 0x1fff //!< Mask for fragmenting bits. + +/* + * Structure of a DEC/Intel/Xerox or 802.3 Ethernet header. + */ +typedef struct CC_HINT(__packed__) ethernet_header { + uint8_t ether_dst[ETHER_ADDR_LEN]; + uint8_t ether_src[ETHER_ADDR_LEN]; + uint16_t ether_type; +} ethernet_header_t; + +/* + * Structure of an internet header, naked of options. + */ +typedef struct CC_HINT(__packed__) ip_header { + uint8_t ip_vhl; //!< Header length, version. + + uint8_t ip_tos; //!< Type of service. + uint16_t ip_len; //!< Total length. + uint16_t ip_id; //!< identification. + uint16_t ip_off; //!< Fragment offset field. + + uint8_t ip_ttl; //!< Time To Live. + uint8_t ip_p; //!< Protocol. + uint16_t ip_sum; //!< Checksum. + struct in_addr ip_src, ip_dst; //!< Src and Dst address +} ip_header_t; + +typedef struct CC_HINT(__packed__) ip_header6 { + uint32_t ip_vtcfl; //!< Version, traffic class, flow label. + uint16_t ip_len; //!< Payload length + + uint8_t ip_next; //!< Next header (protocol) + uint8_t ip_hopl; //!< IP Hop Limit + + struct in6_addr ip_src, ip_dst; //!< Src and Dst address +} ip_header6_t; + +/* + * UDP protocol header. + * Per RFC 768, September, 1981. + */ +typedef struct CC_HINT(__packed__) udp_header { + uint16_t src; //!< Source port. + uint16_t dst; //!< Destination port. + uint16_t len; //!< UDP length. + uint16_t checksum; //!< UDP checksum. +} udp_header_t; + +typedef struct CC_HINT(__packed__) radius_packet_t { + uint8_t code; + uint8_t id; + uint8_t length[2]; + uint8_t vector[AUTH_VECTOR_LEN]; + uint8_t data[]; +} radius_packet_t; + +uint16_t fr_udp_checksum(uint8_t const *data, uint16_t len, uint16_t checksum, + struct in_addr const src_addr, struct in_addr const dst_addr); +uint16_t fr_iph_checksum(uint8_t const *data, uint8_t ihl); +#endif /* FR_NET_H */ diff --git a/src/include/openssl3.h b/src/include/openssl3.h new file mode 100644 index 0000000..4423ee5 --- /dev/null +++ b/src/include/openssl3.h @@ -0,0 +1,109 @@ +/* + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + */ +#ifndef FR_OPENSSL3_H +#define FR_OPENSSL3_H +/** + * $Id$ + * + * @file openssl3.h + * @brief Wrappers to shut up OpenSSL3 + * + * @copyright 2021 Network RADIUS SAS (legal@networkradius.com) + */ + +RCSIDH(openssl3_h, "$Id$") + +/* + * The HMAC APIs are deprecated in OpenSSL3. We don't want to + * fill the code with ifdef's, so we define some horrific + * wrappers here. + * + * This file should be included AFTER all OpenSSL header files. + */ +#ifdef HAVE_OPENSSL_SSL_H +#if OPENSSL_VERSION_NUMBER >= 0x30000000L +#include <string.h> +#include <openssl/evp.h> +#include <openssl/core_names.h> + +typedef struct { + EVP_MAC *mac; + EVP_MAC_CTX *ctx; +} HMAC3_CTX; +#define HMAC_CTX HMAC3_CTX + +#define HMAC_CTX_new HMAC3_CTX_new +static inline HMAC3_CTX *HMAC3_CTX_new(void) +{ + HMAC3_CTX *h = calloc(1, sizeof(*h)); + + return h; +} + +#define HMAC_Init_ex(_ctx, _key, _keylen, _md, _engine) HMAC3_Init_ex(_ctx, _key, _keylen, _md, _engine) +static inline int HMAC3_Init_ex(HMAC3_CTX *ctx, const unsigned char *key, unsigned int keylen, const EVP_MD *md, UNUSED void *engine) +{ + OSSL_PARAM params[2], *p = params; + char const *name; + char *unconst; + + ctx->mac = EVP_MAC_fetch(NULL, "HMAC", NULL); + if (!ctx->mac) return 0; + + ctx->ctx = EVP_MAC_CTX_new(ctx->mac); + if (!ctx->ctx) return 0; + + name = EVP_MD_get0_name(md); + memcpy(&unconst, &name, sizeof(name)); /* const issues */ + + p[0] = OSSL_PARAM_construct_utf8_string(OSSL_ALG_PARAM_DIGEST, unconst, 0); + p[1] = OSSL_PARAM_construct_end(); + + return EVP_MAC_init(ctx->ctx, key, keylen, params); +} + +#define HMAC_Update HMAC3_Update +static inline int HMAC3_Update(HMAC3_CTX *ctx, const unsigned char *data, unsigned int datalen) +{ + return EVP_MAC_update(ctx->ctx, data, datalen); +} + +#define HMAC_Final HMAC3_Final +static inline int HMAC3_Final(HMAC3_CTX *ctx, unsigned char *out, unsigned int *len) +{ + size_t mylen = *len; + + if (!EVP_MAC_final(ctx->ctx, out, &mylen, mylen)) return 0; + + *len = mylen; + return 1; +} + +#define HMAC_CTX_free HMAC3_CTX_free +static inline void HMAC3_CTX_free(HMAC3_CTX *ctx) +{ + if (!ctx) return; + + EVP_MAC_free(ctx->mac); + EVP_MAC_CTX_free(ctx->ctx); + free(ctx); +} + +#define HMAC_CTX_set_flags(_ctx, _flags) + +#endif /* OPENSSL_VERSION_NUMBER */ +#endif +#endif /* FR_OPENSSL3_H */ diff --git a/src/include/packet.h b/src/include/packet.h new file mode 100644 index 0000000..5b41498 --- /dev/null +++ b/src/include/packet.h @@ -0,0 +1,87 @@ +#ifndef FR_PACKET_H +#define FR_PACKET_H + +/* + * packet.h Structures and prototypes + * for packet manipulation + * + * Version: $Id$ + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + * + * Copyright 2001,2002,2003,2004,2005,2006 The FreeRADIUS server project + */ + +RCSIDH(packet_h, "$Id$") + +#ifdef __cplusplus +extern "C" { +#endif + +int fr_packet_cmp(RADIUS_PACKET const *a, RADIUS_PACKET const *b); +int fr_inaddr_any(fr_ipaddr_t *ipaddr); +void fr_request_from_reply(RADIUS_PACKET *request, + RADIUS_PACKET const *reply); +int fr_socket(fr_ipaddr_t *ipaddr, uint16_t port); + +typedef struct fr_packet_list_t fr_packet_list_t; + +fr_packet_list_t *fr_packet_list_create(int alloc_id); +void fr_packet_list_free(fr_packet_list_t *pl); +bool fr_packet_list_insert(fr_packet_list_t *pl, + RADIUS_PACKET **request_p); + +RADIUS_PACKET **fr_packet_list_find(fr_packet_list_t *pl, + RADIUS_PACKET *request); +RADIUS_PACKET **fr_packet_list_find_byreply(fr_packet_list_t *pl, + RADIUS_PACKET *reply); +bool fr_packet_list_yank(fr_packet_list_t *pl, + RADIUS_PACKET *request); +uint32_t fr_packet_list_num_elements(fr_packet_list_t *pl); +bool fr_packet_list_id_alloc(fr_packet_list_t *pl, int proto, + RADIUS_PACKET **request_p, void **pctx); +bool fr_packet_list_id_free(fr_packet_list_t *pl, + RADIUS_PACKET *request, bool yank); +bool fr_packet_list_socket_add(fr_packet_list_t *pl, int sockfd, int proto, +#ifdef WITH_RADIUSV11 + bool radiusv11, +#endif + fr_ipaddr_t *dst_ipaddr, uint16_t dst_port, + void *ctx); +bool fr_packet_list_socket_del(fr_packet_list_t *pl, int sockfd); +bool fr_packet_list_socket_freeze(fr_packet_list_t *pl, int sockfd); +bool fr_packet_list_socket_thaw(fr_packet_list_t *pl, int sockfd); +int fr_packet_list_walk(fr_packet_list_t *pl, void *ctx, rb_walker_t callback); +int fr_packet_list_fd_set(fr_packet_list_t *pl, fd_set *set); +RADIUS_PACKET *fr_packet_list_recv(fr_packet_list_t *pl, fd_set *set); + +uint32_t fr_packet_list_num_incoming(fr_packet_list_t *pl); +uint32_t fr_packet_list_num_outgoing(fr_packet_list_t *pl); +void fr_packet_header_print(FILE *fp, RADIUS_PACKET *packet, bool received); + +/* + * "find" returns a pointer to the RADIUS_PACKET* member in the + * caller's structure. In order to get the pointer to the *top* + * of the caller's structure, you have to subtract the offset to + * the member from the returned pointer, and cast it to the + * required type. + */ +# define fr_packet2myptr(TYPE, MEMBER, PTR) (TYPE *) (((char *)PTR) - offsetof(TYPE, MEMBER)) + +#ifdef __cplusplus +} +#endif + +#endif /* FR_PACKET_H */ diff --git a/src/include/parser.h b/src/include/parser.h new file mode 100644 index 0000000..9f3fdeb --- /dev/null +++ b/src/include/parser.h @@ -0,0 +1,111 @@ +#ifndef FR_PARSER_H +#define FR_PARSER_H + +/* + * parser.h Structures and prototypes for parsing + * Version: $Id$ + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + * + * Copyright 2013 Alan DeKok <aland@freeradius.org> + */ + +RCSIDH(parser_h, "$Id$") + +#include <freeradius-devel/map.h> + +#ifdef __cplusplus +extern "C" { +#endif + +#ifndef RADIUSD_H +/* + * Also defined in radiusd.h for radius_evalute_cond() + */ +typedef struct fr_cond_t fr_cond_t; +#endif + +typedef enum { + COND_NONE = 0, + COND_AND = '&', + COND_OR = '|' +} fr_cond_op_t; + + +typedef enum { + COND_TYPE_INVALID = 0, + COND_TYPE_TRUE, + COND_TYPE_FALSE, + COND_TYPE_EXISTS, + COND_TYPE_MAP, + COND_TYPE_CHILD +} fr_cond_type_t; + +typedef enum { + PASS2_FIXUP_NONE = 0, + PASS2_FIXUP_ATTR, + PASS2_FIXUP_TYPE, + PASS2_PAIRCOMPARE +} fr_cond_pass2_t; + +/* + * Allow for the following structures: + * + * FOO no OP, RHS is NULL + * FOO OP BAR + * (COND) no LHS/RHS, child is COND, child OP is true + * (!(COND)) no LHS/RHS, child is COND, child OP is NOT + * (COND1 OP COND2) no LHS/RHS, next is COND2, next OP is OP + */ +struct fr_cond_t { + fr_cond_type_t type; + + CONF_ITEM const *ci; + union { + vp_map_t *map; + vp_tmpl_t *vpt; + fr_cond_t *child; + } data; + + bool negate; + fr_cond_pass2_t pass2_fixup; + + DICT_ATTR const *cast; + + fr_cond_op_t next_op; + fr_cond_t *next; +}; + + +/* + * One pass over the conditions means that all references must + * exist at parse time. + * + * Two pass means "soft fail", that some invalid references are + * left for pass 2. + */ +#define FR_COND_ONE_PASS (0) +#define FR_COND_TWO_PASS (1) + +ssize_t fr_condition_tokenize(TALLOC_CTX *ctx, CONF_ITEM *ci, char const *start, fr_cond_t **head, char const **error, int flag); +size_t fr_cond_sprint(char *buffer, size_t bufsize, fr_cond_t const *c); + +bool fr_condition_walk(fr_cond_t *head, bool (*callback)(void *, fr_cond_t *), void *ctx); + +#ifdef __cplusplus +} +#endif + +#endif /* FR_PARSER_H */ diff --git a/src/include/pcap.h b/src/include/pcap.h new file mode 100644 index 0000000..1d57d93 --- /dev/null +++ b/src/include/pcap.h @@ -0,0 +1,101 @@ +#ifndef FR_PCAP_H +#define FR_PCAP_H +#ifdef HAVE_LIBPCAP +/* + * This program is is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License, version 2 of the + * License as published by the Free Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + */ + +/** + * $Id$ + * @file include/pcap.h + * @brief Prototypes and constants for PCAP functions. + * + * @author Arran Cudbard-Bell <a.cudbardb@freeradius.org> + * @copyright 2013 Arran Cudbard-Bell <a.cudbardb@freeradius.org> + */ +#include <freeradius-devel/libradius.h> +#include <freeradius-devel/net.h> + +#include <sys/types.h> +#include <pcap.h> + +#define SNAPLEN ETHER_HDR_LEN + IP_HDR_LEN + sizeof(struct udp_header) + MAX_RADIUS_LEN +#define PCAP_BUFFER_DEFAULT (10000) +/* + * It's unclear why this differs between platforms + */ +#ifndef __linux__ +# define PCAP_NONBLOCK_TIMEOUT (0) +#else +# define PCAP_NONBLOCK_TIMEOUT (-1) +#endif + +#ifndef BIOCIMMEDIATE +# define BIOCIMMEDIATE (2147762800) +#endif + +/* + * Older versions of libpcap don't define this + */ +#ifndef PCAP_NETMASK_UNKNOWN +# define PCAP_NETMASK_UNKNOWN 0 +#endif + +typedef enum { + PCAP_INVALID = 0, + PCAP_INTERFACE_IN, + PCAP_FILE_IN, + PCAP_STDIO_IN, + PCAP_INTERFACE_OUT, + PCAP_FILE_OUT, + PCAP_STDIO_OUT +} fr_pcap_type_t; + +extern const FR_NAME_NUMBER pcap_types[]; + +/* + * Internal pcap structures + */ +typedef struct fr_pcap fr_pcap_t; +struct fr_pcap { + char errbuf[PCAP_ERRBUF_SIZE]; //!< Last error on this interface. + fr_pcap_type_t type; //!< What type of handle this is. + char *name; //!< Name of file or interface. + bool promiscuous; //!< Whether the interface is in promiscuous mode. + //!< Only valid for live capture handles. + int buffer_pkts; //!< How big to make the PCAP ring buffer. + //!< Actual buffer size is SNAPLEN * buffer. + //!< Only valid for live capture handles. + + pcap_t *handle; //!< libpcap handle. + pcap_dumper_t *dumper; //!< libpcap dumper handle. + + int link_layer; //!< Link layer type. + + int fd; //!< Selectable file descriptor we feed to select. + struct pcap_stat pstats; //!< The last set of pcap stats for this handle. + + fr_pcap_t *next; //!< Next handle in collection. +}; + +int fr_pcap_if_link_layer(char *errbuff, pcap_if_t *dev); +fr_pcap_t *fr_pcap_init(TALLOC_CTX *ctx, char const *name, fr_pcap_type_t type); +int fr_pcap_open(fr_pcap_t *handle); +int fr_pcap_apply_filter(fr_pcap_t *handle, char const *expression); +char *fr_pcap_device_names(TALLOC_CTX *ctx, fr_pcap_t *handle, char c); + +bool fr_pcap_link_layer_supported(int link_layer); +ssize_t fr_pcap_link_layer_offset(uint8_t const *data, size_t len, int link_layer); +#endif +#endif diff --git a/src/include/process.h b/src/include/process.h new file mode 100644 index 0000000..35a91bf --- /dev/null +++ b/src/include/process.h @@ -0,0 +1,87 @@ +#ifndef FR_PROCESS_H +#define FR_PROCESS_H + +/* + * process.h State machine for a server to process packets. + * + * Version: $Id$ + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + * + * Copyright 2012 The FreeRADIUS server project + * Copyright 2012 Alan DeKok <aland@deployingradius.com> + */ + +RCSIDH(process_h, "$Id$") + +#include <freeradius-devel/clients.h> +#include <freeradius-devel/listen.h> + +#ifdef __cplusplus +extern "C" { +#endif + +#ifdef HAVE_SYSTEMD_WATCHDOG +extern struct timeval sd_watchdog_interval; +#endif + +typedef enum fr_state_action_t { /* server action */ + FR_ACTION_INVALID = 0, + FR_ACTION_RUN, + FR_ACTION_DONE, + FR_ACTION_DUP, + FR_ACTION_TIMER, +#ifdef WITH_PROXY + FR_ACTION_PROXY_REPLY, +#endif + FR_ACTION_CANCELLED, + FR_ACTION_CONFLICT, + FR_ACTION_MAX_TIME, + FR_ACTION_INTERNAL_FAILURE, + FR_ACTION_CLEANUP_DELAY, + FR_ACTION_COA_CANCELLED, +} fr_state_action_t; + +/* + * Function handler for requests. + */ +typedef int (*RAD_REQUEST_FUNP)(REQUEST *); +typedef void (*fr_request_process_t)(REQUEST *, int); + +extern time_t fr_start_time; + +#ifdef HAVE_PTHREAD_H +/* + * In threads.c + */ +int request_enqueue(REQUEST *request); +#endif + +int request_receive(TALLOC_CTX *ctx, rad_listen_t *listener, RADIUS_PACKET *packet, + RADCLIENT *client, RAD_REQUEST_FUNP fun); +void request_inject(REQUEST *request); + +#ifdef WITH_PROXY +int request_proxy_reply(RADIUS_PACKET *packet); + +void proxy_listener_freeze(rad_listen_t *listener, fr_event_fd_handler_t write_handler); +void proxy_listener_thaw(rad_listen_t *listener); +#endif + +#ifdef __cplusplus +} +#endif + +#endif /* FR_PROCESS_H */ diff --git a/src/include/protocol.h b/src/include/protocol.h new file mode 100644 index 0000000..f09ea4a --- /dev/null +++ b/src/include/protocol.h @@ -0,0 +1,63 @@ +#ifndef FR_PROTOCOL_H +#define FR_PROTOCOL_H + +/* + * heap.h Structures and prototypes for plug-in protocols + * Version: $Id$ + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + * + * Copyright 2013 Alan DeKok + */ + +RCSIDH(protocol_h, "$Id$") + +#ifdef __cplusplus +extern "C" { +#endif + +/* + * We'll use this below. + */ +typedef int (*rad_listen_parse_t)(CONF_SECTION *, rad_listen_t *); +typedef void (*rad_listen_free_t)(rad_listen_t *); + +typedef struct fr_protocol_t { + uint64_t magic; //!< Used to validate loaded library + char const *name; //!< The name of the protocol + size_t inst_size; + CONF_PARSER *proto_config; + + rad_listen_parse_t parse; + rad_listen_free_t free; + rad_listen_recv_t recv; + rad_listen_send_t send; + rad_listen_print_t print; + rad_listen_encode_t encode; + rad_listen_decode_t decode; +} fr_protocol_t; + +/* + * @todo: fix for later + */ +int common_socket_parse(CONF_SECTION *cs, rad_listen_t *this); +int common_socket_print(rad_listen_t const *this, char *buffer, size_t bufsize); + + +#ifdef __cplusplus +} +#endif + +#endif /* FR_PROTOCOL_H */ diff --git a/src/include/rad_assert.h b/src/include/rad_assert.h new file mode 100644 index 0000000..0c16e59 --- /dev/null +++ b/src/include/rad_assert.h @@ -0,0 +1,50 @@ +#ifndef RAD_ASSERT_H +#define RAD_ASSERT_H +/* + * rad_assert.h Debug assertions, with logging. + * + * Version: $Id$ + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + * + * Copyright 2000,2001,2006 The FreeRADIUS server project + */ + +RCSIDH(rad_assert_h, "$Id$") + +#ifdef __cplusplus +extern "C" { +#endif + +void rad_assert_fail(char const *file, unsigned int line, char const *expr) CC_HINT(noreturn); + +#ifdef NDEBUG + #define rad_assert(expr) ((void) (0)) + +#elif !defined(__clang_analyzer__) + #define rad_assert(expr) \ + ((void) ((expr) ? (void) 0 : \ + (void) rad_assert_fail (__FILE__, __LINE__, #expr))) + +#else +#include <assert.h> +#define rad_assert assert +#endif + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/src/include/radclient.h b/src/include/radclient.h new file mode 100644 index 0000000..1eb10f3 --- /dev/null +++ b/src/include/radclient.h @@ -0,0 +1,93 @@ +/* + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + */ +#ifndef _RADCLIENT_H +#define _RADCLIENT_H +/** + * $Id$ + * + * @file radclient.h + * @brief Structures for the radclient utility. + * + * @copyright 2014 The FreeRADIUS server project + */ +#include <freeradius-devel/libradius.h> + +#ifdef __cplusplus +extern "C" { +#endif + +/* + * Logging macros + */ + #undef DEBUG +#define DEBUG(fmt, ...) if (do_output && (fr_debug_lvl > 0)) fprintf(fr_log_fp, fmt "\n", ## __VA_ARGS__) +#undef DEBUG2 +#define DEBUG2(fmt, ...) if (do_output && (fr_debug_lvl > 1)) fprintf(fr_log_fp, fmt "\n", ## __VA_ARGS__) + + +#define ERROR(fmt, ...) if (do_output) fr_perror("radclient: " fmt, ## __VA_ARGS__) + +#define RDEBUG_ENABLED() (do_output && (fr_debug_lvl > 0)) +#define RDEBUG_ENABLED2() (do_output && (fr_debug_lvl > 1)) + +#define REDEBUG(fmt, ...) if (do_output) fr_perror("(%" PRIu64 ") " fmt , request->num, ## __VA_ARGS__) +#define RDEBUG(fmt, ...) if (do_output && (fr_debug_lvl > 0)) fprintf(fr_log_fp, "(%" PRIu64 ") " fmt "\n", request->num, ## __VA_ARGS__) +#define RDEBUG2(fmt, ...) if (do_output && (fr_debug_lvl > 1)) fprintf(fr_log_fp, "(%" PRIu64 ") " fmt "\n", request->num, ## __VA_ARGS__) + +typedef struct rc_stats { + uint64_t accepted; //!< Requests to which we received a accept + uint64_t rejected; //!< Requests to which we received a reject + uint64_t lost; //!< Requests to which we received no response + uint64_t passed; //!< Requests which passed a filter + uint64_t failed; //!< Requests which failed a fitler +} rc_stats_t; + +typedef struct rc_file_pair { + char const *packets; //!< The file containing the request packet + char const *filters; //!< The file containing the definition of the + //!< packet we want to match. +} rc_file_pair_t; + +typedef struct rc_request rc_request_t; + +struct rc_request { + uint64_t num; //!< The number (within the file) of the request were reading. + + rc_request_t *prev; + rc_request_t *next; + + rc_file_pair_t *files; //!< Request and response file names. + + VALUE_PAIR *password; //!< Cleartext-Password + time_t timestamp; + + RADIUS_PACKET *packet; //!< The outgoing request. + RADIUS_PACKET *reply; //!< The incoming response. + VALUE_PAIR *filter; //!< If the reply passes the filter, then the request passes. + PW_CODE filter_code; //!< Expected code of the response packet. + + int resend; + int tries; + bool done; //!< Whether the request is complete. + + char const *name; //!< Test name (as specified in the request). +}; + +#ifdef __cplusplus +} +#endif + +#endif /* _RADCLIENT_H */ diff --git a/src/include/radius.h b/src/include/radius.h new file mode 100644 index 0000000..473528d --- /dev/null +++ b/src/include/radius.h @@ -0,0 +1,186 @@ +/* + * radius.h Constants of the radius protocol. + * + * Version: $Id$ + * + */ + +/** Internal data types used within libfreeradius + * + */ +typedef enum { + PW_TYPE_INVALID = 0, //!< Invalid (uninitialised) attribute type. + PW_TYPE_STRING, //!< String of printable characters. + PW_TYPE_INTEGER, //!< 32 Bit unsigned integer. + PW_TYPE_IPV4_ADDR, //!< 32 Bit IPv4 Address. + PW_TYPE_DATE, //!< 32 Bit Unix timestamp. + PW_TYPE_ABINARY, //!< Ascend binary format a packed data structure. + PW_TYPE_OCTETS, //!< Raw octets. + PW_TYPE_IFID, //!< Interface ID. + PW_TYPE_IPV6_ADDR, //!< 128 Bit IPv6 Address. + PW_TYPE_IPV6_PREFIX, //!< IPv6 Prefix. + PW_TYPE_BYTE, //!< 8 Bit unsigned integer. + PW_TYPE_SHORT, //!< 16 Bit unsigned integer. + PW_TYPE_ETHERNET, //!< 48 Bit Mac-Address. + PW_TYPE_SIGNED, //!< 32 Bit signed integer. + PW_TYPE_COMBO_IP_ADDR, //!< WiMAX IPv4 or IPv6 address depending on length. + PW_TYPE_TLV, //!< Contains nested attributes. + PW_TYPE_EXTENDED, //!< Extended attribute space attribute. + PW_TYPE_LONG_EXTENDED, //!< Long extended attribute space attribute. + PW_TYPE_EVS, //!< Extended attribute, vendor specific. + PW_TYPE_INTEGER64, //!< 64 Bit unsigned integer. + PW_TYPE_IPV4_PREFIX, //!< IPv4 Prefix. + PW_TYPE_VSA, //!< Vendor-Specific, for RADIUS attribute 26. + PW_TYPE_TIMEVAL, //!< Time value (struct timeval), only for config items. + PW_TYPE_BOOLEAN, //!< A truth value. + PW_TYPE_COMBO_IP_PREFIX, //!< WiMAX IPv4 or IPv6 address prefix depending on length. + PW_TYPE_MAX //!< Number of defined data types. +} PW_TYPE; + +/** RADIUS packet codes + * + */ +typedef enum { + PW_CODE_UNDEFINED = 0, //!< Packet code has not been set + PW_CODE_ACCESS_REQUEST = 1, //!< RFC2865 - Access-Request + PW_CODE_ACCESS_ACCEPT = 2, //!< RFC2865 - Access-Accept + PW_CODE_ACCESS_REJECT = 3, //!< RFC2865 - Access-Reject + PW_CODE_ACCOUNTING_REQUEST = 4, //!< RFC2866 - Accounting-Request + PW_CODE_ACCOUNTING_RESPONSE = 5, //!< RFC2866 - Accounting-Response + PW_CODE_ACCOUNTING_STATUS = 6, //!< RFC3575 - Reserved + PW_CODE_PASSWORD_REQUEST = 7, //!< RFC3575 - Reserved + PW_CODE_PASSWORD_ACK = 8, //!< RFC3575 - Reserved + PW_CODE_PASSWORD_REJECT = 9, //!< RFC3575 - Reserved + PW_CODE_ACCOUNTING_MESSAGE = 10, //!< RFC3575 - Reserved + PW_CODE_ACCESS_CHALLENGE = 11, //!< RFC2865 - Access-Challenge + PW_CODE_STATUS_SERVER = 12, //!< RFC2865/RFC5997 - Status Server (request) + PW_CODE_STATUS_CLIENT = 13, //!< RFC2865/RFC5997 - Status Server (response) + PW_CODE_DISCONNECT_REQUEST = 40, //!< RFC3575/RFC5176 - Disconnect-Request + PW_CODE_DISCONNECT_ACK = 41, //!< RFC3575/RFC5176 - Disconnect-Ack (positive) + PW_CODE_DISCONNECT_NAK = 42, //!< RFC3575/RFC5176 - Disconnect-Nak (not willing to perform) + PW_CODE_COA_REQUEST = 43, //!< RFC3575/RFC5176 - CoA-Request + PW_CODE_COA_ACK = 44, //!< RFC3575/RFC5176 - CoA-Ack (positive) + PW_CODE_COA_NAK = 45, //!< RFC3575/RFC5176 - CoA-Nak (not willing to perform) + PW_CODE_MAX = 255, //!< Maximum possible code +} PW_CODE; + +#define PW_AUTH_UDP_PORT 1812 +#define PW_AUTH_UDP_PORT_ALT 1645 +#define PW_ACCT_UDP_PORT 1813 +#define PW_ACCT_UDP_PORT_ALT 1646 +#define PW_POD_UDP_PORT 3799 +#define PW_RADIUS_TLS_PORT 2083 +#define PW_COA_UDP_PORT 3799 + +/* + * The RFC says 4096 octets max, and most packets are less than 256. + */ +#define MAX_PACKET_LEN 4096 + +#include <freeradius-devel/rfc2865.h> +#include <freeradius-devel/rfc2866.h> +#include <freeradius-devel/rfc2867.h> +#include <freeradius-devel/rfc2868.h> +#include <freeradius-devel/rfc2869.h> + +#include <freeradius-devel/rfc3162.h> +#include <freeradius-devel/rfc3576.h> +#include <freeradius-devel/rfc3580.h> + +#include <freeradius-devel/rfc4072.h> +#include <freeradius-devel/rfc4372.h> + +#define PW_CUI PW_CHARGEABLE_USER_IDENTITY + +#include <freeradius-devel/rfc4675.h> +#include <freeradius-devel/rfc4818.h> +#include <freeradius-devel/rfc4849.h> + +#include <freeradius-devel/rfc5580.h> +#include <freeradius-devel/rfc5607.h> +#include <freeradius-devel/rfc5904.h> + +#include <freeradius-devel/rfc6572.h> +#include <freeradius-devel/rfc6677.h> +#include <freeradius-devel/rfc6911.h> +#include <freeradius-devel/rfc6929.h> +#include <freeradius-devel/rfc6930.h> + +#include <freeradius-devel/rfc7055.h> +#include <freeradius-devel/rfc7155.h> +#include <freeradius-devel/rfc7268.h> + +/* + * All internal attributes are now defined in this file. + */ +#include <freeradius-devel/attributes.h> + +#include <freeradius-devel/freeradius.h> + +#include <freeradius-devel/vqp.h> + +#define PW_DIGEST_RESPONSE 206 +#define PW_DIGEST_ATTRIBUTES 207 + +/* + * Integer Translations + */ + +/* User Types */ + +#define PW_LOGIN_USER 1 +#define PW_FRAMED_USER 2 +#define PW_CALLBACK_LOGIN_USER 3 +#define PW_CALLBACK_FRAMED_USER 4 +#define PW_OUTBOUND_USER 5 +#define PW_ADMINISTRATIVE_USER 6 +#define PW_NAS_PROMPT_USER 7 +#define PW_AUTHENTICATE_ONLY 8 +#define PW_CALLBACK_NAS_PROMPT 9 +#define PW_AUTHORIZE_ONLY 17 + +/* Framed Protocols */ + +#define PW_PPP 1 +#define PW_SLIP 2 + +/* Status Types */ + +#define PW_STATUS_START 1 +#define PW_STATUS_STOP 2 +#define PW_STATUS_ALIVE 3 +#define PW_STATUS_ACCOUNTING_ON 7 +#define PW_STATUS_ACCOUNTING_OFF 8 + +/* + * Vendor Private Enterprise Codes + */ +#define VENDORPEC_MICROSOFT 311 +#define VENDORPEC_FREERADIUS 11344 +#define VENDORPEC_WIMAX 24757 +#define VENDORPEC_UKERNA 25622 + +/* + * Microsoft has vendor code 311. + */ +#define PW_MSCHAP_RESPONSE 1 +#define PW_MSCHAP_ERROR 2 +#define PW_MSCHAP_CPW_1 3 +#define PW_MSCHAP_CPW_2 4 +#define PW_MSCHAP_NT_ENC_PW 6 +#define PW_MSCHAP_MPPE_ENCRYPTION_POLICY 7 +#define PW_MSCHAP_MPPE_ENCRYPTION_TYPES 8 +#define PW_MSCHAP_CHALLENGE 11 +#define PW_MSCHAP_MPPE_SEND_KEY 16 +#define PW_MSCHAP_MPPE_RECV_KEY 17 +#define PW_MSCHAP2_RESPONSE 25 +#define PW_MSCHAP2_SUCCESS 26 +#define PW_MSCHAP2_CPW 27 +#define PW_MS_QUARANTINE_SOH 55 + +/* + * JANET's code for transporting eap channel binding data over ttls + */ + +#define PW_UKERNA_CHBIND 135 +#define PW_UKERNA_TR_COI 136 diff --git a/src/include/radiusd.h b/src/include/radiusd.h new file mode 100644 index 0000000..594a6bd --- /dev/null +++ b/src/include/radiusd.h @@ -0,0 +1,631 @@ +/* + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + */ +#ifndef RADIUSD_H +#define RADIUSD_H +/** + * $Id$ + * + * @file radiusd.h + * @brief Structures, prototypes and global variables for the FreeRADIUS server. + * + * @copyright 1999-2000,2002-2008 The FreeRADIUS server project + */ + +RCSIDH(radiusd_h, "$Id$") + +#include <freeradius-devel/libradius.h> +#include <freeradius-devel/radpaths.h> +#include <freeradius-devel/conf.h> +#include <freeradius-devel/conffile.h> +#include <freeradius-devel/event.h> +#include <freeradius-devel/connection.h> + +typedef struct rad_request REQUEST; + +#include <freeradius-devel/log.h> + +#ifdef HAVE_PTHREAD_H +# include <pthread.h> +#else +# include <sys/wait.h> +#endif + +#ifndef NDEBUG +# define REQUEST_MAGIC (0xdeadbeef) +#endif + +/* + * WITH_VMPS is handled by src/include/features.h + */ +#ifdef WITHOUT_VMPS +# undef WITH_VMPS +#endif + +#ifdef WITH_TLS +# include <freeradius-devel/tls.h> +#endif + +#include <freeradius-devel/stats.h> +#include <freeradius-devel/realms.h> +#include <freeradius-devel/xlat.h> +#include <freeradius-devel/tmpl.h> +#include <freeradius-devel/map.h> +#include <freeradius-devel/clients.h> +#include <freeradius-devel/process.h> +/* + * All POSIX systems should have these headers + */ +#include <pwd.h> +#include <grp.h> + +#ifdef __cplusplus +extern "C" { +#endif + +/* + * See util.c + */ +typedef struct request_data_t request_data_t; + +/** Return codes indicating the result of the module call + * + * All module functions must return one of the codes listed below (apart from + * RLM_MODULE_NUMCODES, which is used to check for validity). + */ +typedef enum rlm_rcodes { + RLM_MODULE_REJECT = 0, //!< Immediately reject the request. + RLM_MODULE_FAIL, //!< Module failed, don't reply. + RLM_MODULE_OK, //!< The module is OK, continue. + RLM_MODULE_HANDLED, //!< The module handled the request, so stop. + RLM_MODULE_INVALID, //!< The module considers the request invalid. + RLM_MODULE_USERLOCK, //!< Reject the request (user is locked out). + RLM_MODULE_NOTFOUND, //!< User not found. + RLM_MODULE_NOOP, //!< Module succeeded without doing anything. + RLM_MODULE_UPDATED, //!< OK (pairs modified). + RLM_MODULE_NUMCODES, //!< How many valid return codes there are. + RLM_MODULE_UNKNOWN //!< Error resolving rcode (should not be + //!< returned by modules). +} rlm_rcode_t; +extern const FR_NAME_NUMBER modreturn_table[]; + +/** Main server configuration + * + * The parsed version of the main server config. + */ +typedef struct main_config { + struct main_config *next; //!< Next version of the main_config. + + char const *name; //!< Name of the daemon, usually 'radiusd'. + CONF_SECTION *config; //!< Root of the server config. + + fr_ipaddr_t myip; //!< IP to bind to. Set on command line. + uint16_t port; //!< Port to bind to. Set on command line. + + bool suppress_secrets; //!< for debug levels < 3 + bool log_auth; //!< Log all authentication attempts. + bool log_accept; //!< Log Access-Accept + bool log_reject; //!< Log Access-Reject + bool log_auth_badpass; //!< Log successful authentications. + bool log_auth_goodpass; //!< Log failed authentications. + char const *auth_badpass_msg; //!< Additional text to append to successful auth messages. + char const *auth_goodpass_msg; //!< Additional text to append to failed auth messages. + + char const *denied_msg; //!< Additional text to append if the user is already logged + //!< in (simultaneous use check failed). + + bool daemonize; //!< Should the server daemonize on startup. + char const *pid_file; //!< Path to write out PID file. + +#ifdef WITH_PROXY + bool proxy_requests; //!< Toggle to enable/disable proxying globally. +#endif + struct timeval reject_delay; //!< How long to wait before sending an Access-Reject. + bool status_server; //!< Whether to respond to status-server messages. + + + uint32_t max_request_time; //!< How long a request can be processed for before + //!< timing out. + uint32_t cleanup_delay; //!< How long before cleaning up cached responses. + uint32_t max_requests; + + bool postauth_client_lost; //!< Whether to run Post-Auth-Type Client-Lost section + + uint32_t debug_level; + char const *log_file; + int syslog_facility; + + char const *dictionary_dir; //!< Where to load dictionaries from. + + char const *checkrad; //!< Script to use to determine if a user is already + //!< connected. + + rad_listen_t *listen; //!< Head of a linked list of listeners. + + + char const *panic_action; //!< Command to execute if the server receives a fatal + //!< signal. + + struct timeval init_delay; //!< Initial request processing delay. + + uint32_t talloc_pool_size; //!< Size of pool to allocate to hold each #REQUEST. + bool debug_memory; //!< Cleanup the server properly on exit, freeing + //!< up any memory we allocated. + bool memory_report; //!< Print a memory report on what's left unfreed. + //!< Can only be used when the server is running in single + //!< threaded mode. + + bool allow_core_dumps; //!< Whether the server is allowed to drop a core when + //!< receiving a fatal signal. + + bool write_pid; //!< write the PID file + + bool exiting; //!< are we exiting? + + +#ifdef ENABLE_OPENSSL_VERSION_CHECK + char const *allow_vulnerable_openssl; //!< The CVE number of the last security issue acknowledged. +#endif +} main_config_t; + +#if defined(WITH_VERIFY_PTR) +# define VERIFY_REQUEST(_x) verify_request(__FILE__, __LINE__, _x) +#else +/* + * Even if were building without WITH_VERIFY_PTR + * the pointer must not be NULL when these various macros are used + * so we can add some sneaky asserts. + */ +# define VERIFY_REQUEST(_x) rad_assert(_x) +#endif + +typedef enum { + REQUEST_ACTIVE = 1, + REQUEST_STOP_PROCESSING, + REQUEST_COUNTED +} rad_master_state_t; +#define REQUEST_MASTER_NUM_STATES (REQUEST_COUNTED + 1) + +typedef enum { + REQUEST_QUEUED = 1, + REQUEST_RUNNING, + REQUEST_PROXIED, + REQUEST_RESPONSE_DELAY, + REQUEST_CLEANUP_DELAY, + REQUEST_DONE +} rad_child_state_t; +#define REQUEST_CHILD_NUM_STATES (REQUEST_DONE + 1) + +struct rad_request { +#ifndef NDEBUG + uint32_t magic; //!< Magic number used to detect memory corruption, + //!< or request structs that have not been properly initialised. +#endif + unsigned int number; //!< Monotonically increasing request number. Reset on server restart. + time_t timestamp; //!< When the request was received. + + request_data_t *data; //!< Request metadata. + + rad_listen_t *listener; //!< The listener that received the request. + RADCLIENT *client; //!< The client that originally sent us the request. + + RADIUS_PACKET *packet; //!< Incoming request. + VALUE_PAIR *username; //!< Cached username #VALUE_PAIR from request #RADIUS_PACKET. + VALUE_PAIR *password; //!< Cached password #VALUE_PAIR from request #RADIUS_PACKET. + + RADIUS_PACKET *reply; //!< Outgoing response. + + VALUE_PAIR *config; //!< #VALUE_PAIR (s) used to set per request parameters + //!< for modules and the server core at runtime. + + TALLOC_CTX *state_ctx; //!< for request->state + VALUE_PAIR *state; //!< #VALUE_PAIR (s) available over the lifetime of the authentication + //!< attempt. Useful where the attempt involves a sequence of + //!< many request/challenge packets, like OTP, and EAP. + +#ifdef WITH_PROXY + rad_listen_t *proxy_listener;//!< Listener for outgoing requests. + RADIUS_PACKET *proxy; //!< Outgoing request to proxy server. + RADIUS_PACKET *proxy_reply; //!< Incoming response from proxy server. + + home_server_t *home_server; + home_pool_t *home_pool; //!< For dynamic failover +#endif + + fr_request_process_t process; //!< The function to call to move the request through the state machine. + + struct timeval response_delay; //!< How long to wait before sending Access-Rejects. + fr_state_action_t timer_action; //!< What action to perform when the timer event fires. + fr_event_t *ev; //!< Event in event loop tied to this request. + + RAD_REQUEST_FUNP handle; //!< The function to call to move the request through the + //!< various server configuration sections. + rlm_rcode_t rcode; //!< Last rcode returned by a module + char const *module; //!< Module the request is currently being processed by. + char const *component; //!< Section the request is in. + + int delay; + + rad_master_state_t master_state; //!< Set by the master thread to signal the child that's currently + //!< working with the request, to do something. + rad_child_state_t child_state; + +#ifdef HAVE_PTHREAD_H + pthread_t child_pid; //!< Current thread handling the request. +#endif + + main_config_t *root; //!< Pointer to the main config hack to try and deal with hup. + + + int simul_max; //!< Maximum number of concurrent sessions for this user. +#ifdef WITH_SESSION_MGMT + int simul_count; //!< The current number of sessions for this user. + int simul_mpp; //!< WEIRD: 1 is false, 2 is true. +#endif + + RAD_LISTEN_TYPE priority; + + bool max_time; //!< did we hit max time? + + bool in_request_hash; +#ifdef WITH_PROXY + bool in_proxy_hash; + + uint32_t num_proxied_requests; //!< How many times this request was proxied. + //!< Retransmissions are driven by requests from the NAS. + uint32_t num_proxied_responses; +#endif + + char const *server; + REQUEST *parent; + + struct { + radlog_func_t func; //!< Function to call to output log messages about this + //!< request. + + log_lvl_t lvl; //!< Controls the verbosity of debug statements regarding + //!< the request. + + uint8_t indent; //!< By how much to indent log messages. uin8_t so it's obvious + //!< when a request has been exdented too much. + } log; + + uint32_t options; //!< mainly for proxying EAP-MSCHAPv2. + +#ifdef WITH_COA + REQUEST *coa; //!< CoA request originated by this request. + uint32_t num_coa_requests;//!< Counter for number of requests sent including + //!< retransmits. +#endif +}; /* REQUEST typedef */ + +#define RAD_REQUEST_LVL_NONE (0) //!< No debug messages should be printed. +#define RAD_REQUEST_LVL_DEBUG (1) +#define RAD_REQUEST_LVL_DEBUG2 (2) +#define RAD_REQUEST_LVL_DEBUG3 (3) +#define RAD_REQUEST_LVL_DEBUG4 (4) + +#define RAD_REQUEST_OPTION_COA (1 << 0) +#define RAD_REQUEST_OPTION_CTX (1 << 1) +#define RAD_REQUEST_OPTION_CANCELLED (1 << 2) + +#define SECONDS_PER_DAY 86400 +#define MAX_REQUEST_TIME 30 +#define CLEANUP_DELAY 5 +#define MAX_REQUESTS 256 +#define RETRY_DELAY 5 +#define RETRY_COUNT 3 +#define DEAD_TIME 120 +#define EXEC_TIMEOUT 10 + +/* for paircompare_register */ +typedef int (*RAD_COMPARE_FUNC)(void *instance, REQUEST *,VALUE_PAIR *, VALUE_PAIR *, VALUE_PAIR *, VALUE_PAIR **); + +typedef enum request_fail { + REQUEST_FAIL_UNKNOWN = 0, + REQUEST_FAIL_NO_THREADS, //!< No threads to handle it. + REQUEST_FAIL_DECODE, //!< Rad_decode didn't like it. + REQUEST_FAIL_PROXY, //!< Call to proxy modules failed. + REQUEST_FAIL_PROXY_SEND, //!< Proxy_send didn't like it. + REQUEST_FAIL_NO_RESPONSE, //!< We weren't told to respond, so we reject. + REQUEST_FAIL_HOME_SERVER, //!< The home server didn't respond. + REQUEST_FAIL_HOME_SERVER2, //!< Another case of the above. + REQUEST_FAIL_HOME_SERVER3, //!< Another case of the above. + REQUEST_FAIL_NORMAL_REJECT, //!< Authentication failure. + REQUEST_FAIL_SERVER_TIMEOUT //!< The server took too long to process the request. +} request_fail_t; + +/* + * Global variables. + * + * We really shouldn't have this many. + */ +extern log_lvl_t rad_debug_lvl; +extern char const *radacct_dir; +extern char const *radlog_dir; +extern char const *radlib_dir; +extern bool log_stripped_names; +extern HIDDEN char const *radiusd_version; +extern HIDDEN char const *radiusd_version_short; +void radius_signal_self(int flag); + +typedef enum { + RADIUS_SIGNAL_SELF_NONE = (0), + RADIUS_SIGNAL_SELF_HUP = (1 << 0), + RADIUS_SIGNAL_SELF_TERM = (1 << 1), + RADIUS_SIGNAL_SELF_EXIT = (1 << 2), + RADIUS_SIGNAL_SELF_DETAIL = (1 << 3), + RADIUS_SIGNAL_SELF_NEW_FD = (1 << 4), + RADIUS_SIGNAL_SELF_MAX = (1 << 5) +} radius_signal_t; +/* + * Function prototypes. + */ + +/* acct.c */ +int rad_accounting(REQUEST *); + +int rad_coa_recv(REQUEST *request); + +/* session.c */ +int rad_check_ts(fr_ipaddr_t const *nas_addr, uint32_t nas_port, char const *nas_port_id, char const *user, char const *sessionid); +int session_zap(REQUEST *request, fr_ipaddr_t const *nas_addr, + uint32_t nas_port, char const *nas_port_id, char const *user, + char const *sessionid, uint32_t cliaddr, + char proto, int session_time); + +/* radiusd.c */ +#undef debug_pair +void debug_pair(VALUE_PAIR *); +void rdebug_pair(log_lvl_t level, REQUEST *, VALUE_PAIR *, char const *); +void rdebug_pair_list(log_lvl_t level, REQUEST *, VALUE_PAIR *, char const *); +void rdebug_proto_pair_list(log_lvl_t level, REQUEST *, VALUE_PAIR *); +int log_err (char *); + +/* util.c */ +#define MEM(x) if (!(x)) { ERROR("%s[%u] OUT OF MEMORY", __FILE__, __LINE__); _fr_exit_now(__FILE__, __LINE__, 1); } +void (*reset_signal(int signo, void (*func)(int)))(int); +int rad_mkdir(char *directory, mode_t mode, uid_t uid, gid_t gid); +size_t rad_filename_make_safe(UNUSED REQUEST *request, char *out, size_t outlen, + char const *in, UNUSED void *arg); +size_t rad_filename_escape(UNUSED REQUEST *request, char *out, size_t outlen, + char const *in, UNUSED void *arg); +ssize_t rad_filename_unescape(char *out, size_t outlen, char const *in, size_t inlen); +void *rad_malloc(size_t size); /* calls exit(1) on error! */ +void rad_const_free(void const *ptr); +REQUEST *request_alloc(TALLOC_CTX *ctx); +REQUEST *request_alloc_fake(REQUEST *oldreq); +REQUEST *request_alloc_coa(REQUEST *request); +int request_data_add(REQUEST *request, + void *unique_ptr, int unique_int, + void *opaque, bool free_opaque); +void *request_data_get(REQUEST *request, + void *unique_ptr, int unique_int); +void *request_data_reference(REQUEST *request, + void *unique_ptr, int unique_int); +int rad_copy_string(char *dst, char const *src); +int rad_copy_string_bare(char *dst, char const *src); +int rad_copy_variable(char *dst, char const *from); +uint32_t rad_pps(uint32_t *past, uint32_t *present, time_t *then, struct timeval *now); +int rad_expand_xlat(REQUEST *request, char const *cmd, + int max_argc, char const *argv[], bool can_fail, + size_t argv_buflen, char *argv_buf); +void rad_tv_sub(struct timeval const *end, struct timeval const *start, struct timeval *elapsed); + +void verify_request(char const *file, int line, REQUEST *request); /* only for special debug builds */ +void rad_mode_to_str(char out[10], mode_t mode); +void rad_mode_to_oct(char out[5], mode_t mode); +int rad_getpwuid(TALLOC_CTX *ctx, struct passwd **out, uid_t uid); +int rad_getpwnam(TALLOC_CTX *ctx, struct passwd **out, char const *name); +int rad_getgrgid(TALLOC_CTX *ctx, struct group **out, gid_t gid); +int rad_getgrnam(TALLOC_CTX *ctx, struct group **out, char const *name); +int rad_getgid(TALLOC_CTX *ctx, gid_t *out, char const *name); +int rad_prints_uid(TALLOC_CTX *ctx, char *out, size_t outlen, uid_t uid); +int rad_prints_gid(TALLOC_CTX *ctx, char *out, size_t outlen, gid_t gid); +int rad_seuid(uid_t uid); +int rad_segid(gid_t gid); + +void rad_suid_set_down_uid(uid_t uid); +void rad_suid_down(void); +void rad_suid_up(void); +void rad_suid_down_permanent(void); +/* regex.c */ + +#ifdef HAVE_REGEX +/* + * Increasing this is essentially free + * It just increases memory usage. 12-16 bytes for each additional subcapture. + */ +# define REQUEST_MAX_REGEX 32 + +void regex_sub_to_request(REQUEST *request, regex_t **preg, char const *value, + size_t len, regmatch_t rxmatch[], size_t nmatch); + +int regex_request_to_sub(TALLOC_CTX *ctx, char **out, REQUEST *request, uint32_t num); + +/* + * Named capture groups only supported by PCRE. + */ +# ifdef HAVE_PCRE +int regex_request_to_sub_named(TALLOC_CTX *ctx, char **out, REQUEST *request, char const *name); +# endif +#endif + +/* files.c */ +int pairlist_read(TALLOC_CTX *ctx, char const *file, PAIR_LIST **list, int complain); +void pairlist_free(PAIR_LIST **); + +/* version.c */ +int rad_check_lib_magic(uint64_t magic); +int ssl_check_consistency(void); +char const *ssl_version_by_num(uint32_t version); +char const *ssl_version_num(void); +char const *ssl_version_range(uint32_t low, uint32_t high); +char const *ssl_version(void); +int version_add_feature(CONF_SECTION *cs, char const *name, bool enabled); +int version_add_number(CONF_SECTION *cs, char const *name, char const *version); +void version_init_features(CONF_SECTION *cs); +void version_init_numbers(CONF_SECTION *cs); +void version_print(void); + +/* auth.c */ +char *auth_name(char *buf, size_t buflen, REQUEST *request, bool do_cli); +int rad_authenticate (REQUEST *); +int rad_postauth(REQUEST *); +int rad_virtual_server(REQUEST *); + +/* exec.c */ +pid_t radius_start_program(char const *cmd, REQUEST *request, bool exec_wait, + int *input_fd, int *output_fd, + VALUE_PAIR *input_pairs, bool shell_escape); +int radius_readfrom_program(int fd, pid_t pid, int timeout, + char *answer, int left); +int radius_exec_program(TALLOC_CTX *ctx, char *out, size_t outlen, VALUE_PAIR **output_pairs, + REQUEST *request, char const *cmd, VALUE_PAIR *input_pairs, + bool exec_wait, bool shell_escape, int timeout) CC_HINT(nonnull (5, 6)); +void exec_trigger(REQUEST *request, CONF_SECTION *cs, char const *name, int quench) + CC_HINT(nonnull (3)); + +/* valuepair.c */ +int paircompare_register_byname(char const *name, DICT_ATTR const *from, + bool first_only, RAD_COMPARE_FUNC func, void *instance); +int paircompare_register(DICT_ATTR const *attribute, DICT_ATTR const *from, + bool first_only, RAD_COMPARE_FUNC func, void *instance); +void paircompare_unregister(DICT_ATTR const *attr, RAD_COMPARE_FUNC func); +void paircompare_unregister_instance(void *instance); +int paircompare(REQUEST *request, VALUE_PAIR *req_list, + VALUE_PAIR *check, VALUE_PAIR **rep_list); +vp_tmpl_t *xlat_to_tmpl_attr(TALLOC_CTX *ctx, xlat_exp_t *xlat); +xlat_exp_t *xlat_from_tmpl_attr(TALLOC_CTX *ctx, vp_tmpl_t *vpt); +int radius_xlat_do(REQUEST *request, VALUE_PAIR *vp); +int radius_compare_vps(REQUEST *request, VALUE_PAIR *check, VALUE_PAIR *vp); +int radius_callback_compare(REQUEST *request, VALUE_PAIR *req, + VALUE_PAIR *check, VALUE_PAIR *check_pairs, + VALUE_PAIR **reply_pairs); +int radius_find_compare(DICT_ATTR const *attribute); +VALUE_PAIR *radius_pair_create(TALLOC_CTX *ctx, VALUE_PAIR **vps, unsigned int attribute, unsigned int vendor); + +void module_failure_msg(REQUEST *request, char const *fmt, ...) CC_HINT(format (printf, 2, 3)); +void vmodule_failure_msg(REQUEST *request, char const *fmt, va_list ap) CC_HINT(format (printf, 2, 0)); + +int radius_get_vp(VALUE_PAIR **out, REQUEST *request, char const *name); +int radius_copy_vp(TALLOC_CTX *ctx, VALUE_PAIR **out, REQUEST *request, char const *name); + + +/* + * Less code == fewer bugs + * + * @param _a attribute + * @param _b value + * @param _c op + */ +#define pair_make_request(_a, _b, _c) fr_pair_make(request->packet, &request->packet->vps, _a, _b, _c) +#define pair_make_reply(_a, _b, _c) fr_pair_make(request->reply, &request->reply->vps, _a, _b, _c) +#define pair_make_config(_a, _b, _c) fr_pair_make(request, &request->config, _a, _b, _c) + +/* threads.c */ +int thread_pool_init(CONF_SECTION *cs, bool *spawn_flag); +void thread_pool_stop(void); +int thread_pool_addrequest(REQUEST *, RAD_REQUEST_FUNP); +pid_t rad_fork(void); +pid_t rad_waitpid(pid_t pid, int *status); +int total_active_threads(void); +void thread_pool_lock(void); +void thread_pool_unlock(void); +void thread_pool_queue_stats(int array[RAD_LISTEN_MAX], int pps[2]); +void thread_pool_thread_stats(int stats[3]); + +#ifndef HAVE_PTHREAD_H +# define rad_fork(n) fork() +# define rad_waitpid(a,b) waitpid(a,b, 0) +#endif + +/* main_config.c */ +/* Define a global config structure */ +extern bool log_dates_utc; +extern main_config_t main_config; +extern bool event_loop_started; + +void set_radius_dir(TALLOC_CTX *ctx, char const *path); +char const *get_radius_dir(void); +int main_config_init(void); +int main_config_free(void); +void main_config_hup(void); +void hup_logfile(void); + +/* listen.c */ +void listen_free(rad_listen_t **head); +int listen_init(CONF_SECTION *cs, rad_listen_t **head, bool spawn_flag); +rad_listen_t *proxy_new_listener(TALLOC_CTX *ctx, home_server_t *home, uint16_t src_port); +RADCLIENT *client_listener_find(rad_listen_t *listener, fr_ipaddr_t const *ipaddr, uint16_t src_port); + +#ifdef WITH_STATS +RADCLIENT_LIST *listener_find_client_list(fr_ipaddr_t const *ipaddr, uint16_t port, int proto); +#endif +rad_listen_t *listener_find_byipaddr(fr_ipaddr_t const *ipaddr, uint16_t port, int proto); +int rad_status_server(REQUEST *request); + +/* event.c */ +typedef enum event_corral_t { + EVENT_CORRAL_MAIN = 0, //!< Always main thread event list + EVENT_CORRAL_AUX //!< Maybe main thread or one shared by modules +} event_corral_t; + +fr_event_list_t *radius_event_list_corral(event_corral_t hint); +int radius_event_init(TALLOC_CTX *ctx); +int radius_event_start(CONF_SECTION *cs, bool spawn_flag); +void radius_event_free(void); +int radius_event_process(void); +void radius_update_listener(rad_listen_t *listener); +void revive_home_server(void *ctx); +void mark_home_server_dead(home_server_t *home, struct timeval *when, bool down); + +/* evaluate.c */ +typedef struct fr_cond_t fr_cond_t; +int radius_evaluate_tmpl(REQUEST *request, int modreturn, int depth, + vp_tmpl_t const *vpt); +int radius_evaluate_map(REQUEST *request, int modreturn, int depth, + fr_cond_t const *c); +int radius_evaluate_cond(REQUEST *request, int modreturn, int depth, + fr_cond_t const *c); +void radius_pairmove(REQUEST *request, VALUE_PAIR **to, VALUE_PAIR *from, bool do_xlat) CC_HINT(nonnull); + +#ifdef WITH_TLS +/* + * For run-time patching of which function handles which socket. + */ +int dual_tls_recv(rad_listen_t *listener); +int dual_tls_send(rad_listen_t *listener, REQUEST *request); +int proxy_tls_recv(rad_listen_t *listener); +int proxy_tls_send(rad_listen_t *listener, REQUEST *request); +#ifdef WITH_COA_TUNNEL +int proxy_tls_send_reply(rad_listen_t *listener, REQUEST *request); +int dual_tls_send_coa_request(rad_listen_t *listener, REQUEST *request); +void listen_coa_free(void); +void listen_coa_add(rad_listen_t *listener, char const *key); +int listen_coa_find(REQUEST *request, char const *key); +#endif +#endif + +/* + * For radmin over TCP. + */ +#define PW_RADMIN_PORT 18120 + +#ifdef __cplusplus +} +#endif + +#endif /*RADIUSD_H*/ diff --git a/src/include/radsniff.h b/src/include/radsniff.h new file mode 100644 index 0000000..c909ecd --- /dev/null +++ b/src/include/radsniff.h @@ -0,0 +1,323 @@ +/* + * This program is is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License, version 2 of the + * License as published by the Free Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + */ + +/** + * $Id$ + * @file radsniff.h + * @brief Structures and prototypes for the RADIUS sniffer. + * + * @copyright 2013 Arran Cudbard-Bell <arran.cudbardb@freeradius.org> + * @copyright 2006 The FreeRADIUS server project + * @copyright 2006 Nicolas Baradakis <nicolas.baradakis@cegetel.net> + */ + +RCSIDH(radsniff_h, "$Id$") + +#include <sys/types.h> + +#include <freeradius-devel/libradius.h> +#include <freeradius-devel/pcap.h> +#include <freeradius-devel/event.h> + +#ifdef HAVE_COLLECTDC_H +# include <collectd/client.h> +#endif + +#define RS_DEFAULT_PREFIX "radsniff" //!< Default instance +#define RS_DEFAULT_SECRET "testing123" //!< Default secret +#define RS_DEFAULT_TIMEOUT 5200 //!< Standard timeout of 5s + 300ms to cover network latency +#define RS_FORCE_YIELD 1000 //!< Service another descriptor every X number of packets +#define RS_RETRANSMIT_MAX 5 //!< Maximum number of times we expect to see a packet retransmitted +#define RS_MAX_ATTRS 50 //!< Maximum number of attributes we can filter on. +#define RS_SOCKET_REOPEN_DELAY 5000 //!< How long we delay re-opening a collectd socket. + +/* + * Logging macros + */ +#undef DEBUG2 +#define DEBUG2(fmt, ...) if (fr_debug_lvl > 2) fprintf(fr_log_fp , fmt "\n", ## __VA_ARGS__) +#undef DEBUG +#define DEBUG(fmt, ...) if (fr_debug_lvl > 1) fprintf(fr_log_fp , fmt "\n", ## __VA_ARGS__) +#undef INFO +#define INFO(fmt, ...) if (fr_debug_lvl > 0) fprintf(fr_log_fp , fmt "\n", ## __VA_ARGS__) + +#define ERROR(fmt, ...) fr_perror("radsniff: " fmt, ## __VA_ARGS__) + +#define RIDEBUG_ENABLED() (conf->print_packet && (fr_debug_lvl > 0)) +#define RDEBUG_ENABLED() (conf->print_packet && (fr_debug_lvl > 1)) +#define RDEBUG_ENABLED2() (conf->print_packet && (fr_debug_lvl > 2)) + +#define REDEBUG(fmt, ...) if (conf->print_packet) fr_perror("%s (%" PRIu64 ") " fmt , timestr, count, ## __VA_ARGS__) +#define RIDEBUG(fmt, ...) if (conf->print_packet && (fr_debug_lvl > 0)) fprintf(fr_log_fp , "%s (%" PRIu64 ") " fmt "\n", timestr, count, ## __VA_ARGS__) +#define RDEBUG(fmt, ...) if (conf->print_packet && (fr_debug_lvl > 1)) fprintf(fr_log_fp , "%s (%" PRIu64 ") " fmt "\n", timestr, count, ## __VA_ARGS__) +#define RDEBUG2(fmt, ...) if (conf->print_packet && (fr_debug_lvl > 2)) fprintf(fr_log_fp , "%s (%" PRIu64 ") " fmt "\n", timestr, count, ## __VA_ARGS__) + +typedef enum { + RS_NORMAL = 0x01, + RS_UNLINKED = 0x02, + RS_RTX = 0x04, + RS_REUSED = 0x08, + RS_ERROR = 0x10, + RS_LOST = 0x20 +} rs_status_t; + +typedef void (*rs_packet_logger_t)(uint64_t count, rs_status_t status, fr_pcap_t *handle, RADIUS_PACKET *packet, + struct timeval *elapsed, struct timeval *latency, bool response, bool body); +typedef enum { +#ifdef HAVE_COLLECTDC_H + RS_STATS_OUT_COLLECTD = 1, +#endif + RS_STATS_OUT_STDIO +} stats_out_t; + +typedef struct rs rs_t; + +#ifdef HAVE_COLLECTDC_H +typedef struct rs_stats_tmpl rs_stats_tmpl_t; +typedef struct rs_stats_value_tmpl rs_stats_value_tmpl_t; +#endif + +typedef struct rs_counters { + uint64_t type[PW_CODE_MAX]; +} rs_counters_t; + +/** Stats for a single interval + * + * And interval is defined as the time between a call to the stats output function. + */ +typedef struct rs_latency { + int intervals; //!< Number of stats intervals. + + double latency_smoothed; //!< Smoothed moving average. + uint64_t latency_smoothed_count; //!< Number of CMA datapoints processed. + + struct { + uint64_t received_total; //!< Total received over interval. + uint64_t linked_total; //!< Total request/response pairs over interval. + uint64_t unlinked_total; //!< Total unlinked over interval. + uint64_t reused_total; //!< Total reused over interval. + uint64_t lost_total; //!< Total packets definitely lost in this interval. + uint64_t rt_total[RS_RETRANSMIT_MAX + 1]; //!< Number of RTX until complete + //!< over interval. + + + double received; //!< Number of this type of packet we've received. + double linked; //!< Number of request/response pairs + double unlinked; //!< Response with no request. + double reused; //!< ID re-used too quickly. + double lost; //!< Never got a response to a request. + double rt[RS_RETRANSMIT_MAX + 1]; //!< Number of times we saw the same + //!< request packet. + + long double latency_total; //!< Total latency between requests/responses in the + //!< interval. + double latency_average; //!< Average latency (this iteration). + + double latency_high; //!< Latency high water mark. + double latency_low; //!< Latency low water mark. + } interval; +} rs_latency_t; + +typedef struct rs_malformed { + uint64_t min_length_packet; + uint64_t min_length_field; + uint64_t min_length_mimatch; + uint64_t header_overflow; + uint64_t invalid_attribute; + uint64_t attribute_too_short; + uint64_t attribute_overflow; + uint64_t ma_invalid_length; + uint64_t attribute_underflow; + uint64_t too_many_attributes; + uint64_t ma_missing; +} rs_malformed_t; + +/** One set of statistics + * + */ +typedef struct rs_stats { + int intervals; //!< Number of stats intervals. + + rs_latency_t exchange[PW_CODE_MAX]; //!< We end up allocating ~16K, but memory is cheap so + //!< what the hell. This is required because instances of + //!< FreeRADIUS delay Access-Rejects, which would artificially + //!< increase latency stats for Access-Requests. + + struct timeval quiet; //!< We may need to 'mute' the stats if libpcap starts + //!< dropping packets, or we run out of memory. +} rs_stats_t; + +typedef struct rs_capture { + struct pcap_pkthdr *header; //!< PCAP packet header. + uint8_t *data; //!< PCAP packet data. +} rs_capture_t; + +/** Wrapper for RADIUS_PACKET + * + * Allows an event to be associated with a request packet. This is required because we need to disarm + * the event timer when a response is received, so we don't erroneously log the response as lost. + */ +typedef struct rs_request { + uint64_t id; //!< Monotonically increasing packet counter. + fr_event_t *event; //!< Event created when we received the original request. + + bool logged; //!< Whether any messages regarding this request were logged. + + struct timeval when; //!< Time when the packet was received, or next time an event + //!< is scheduled. + fr_pcap_t *in; //!< PCAP handle the original request was received on. + RADIUS_PACKET *packet; //!< The original packet. + RADIUS_PACKET *expect; //!< Request/response. + RADIUS_PACKET *linked; //!< The subsequent response or forwarded request the packet + //!< was linked against. + + + rs_capture_t capture[RS_RETRANSMIT_MAX]; //!< Buffered request packets (if a response filter + //!< has been applied). + rs_capture_t *capture_p; //!< Next packet slot. + + uint64_t rt_req; //!< Number of times we saw the same request packet. + uint64_t rt_rsp; //!< Number of times we saw a retransmitted response + //!< packet. + rs_latency_t *stats_req; //!< Latency entry for the request type. + rs_latency_t *stats_rsp; //!< Latency entry for the request type. + + bool silent_cleanup; //!< Cleanup was forced before normal expiry period, + //!< ignore stats about packet loss. + + VALUE_PAIR *link_vps; //!< VALUE_PAIRs used to link retransmissions. + + bool in_request_tree; //!< Whether the request is currently in the request tree. + bool in_link_tree; //!< Whether the request is currently in the linked tree. +} rs_request_t; + +/** Statistic write/print event + * + */ +typedef struct rs_event { + fr_event_list_t *list; //!< The event list. + + fr_pcap_t *in; //!< PCAP handle event occurred on. + fr_pcap_t *out; //!< Where to write output. + + rs_stats_t *stats; //!< Where to write stats. +} rs_event_t; + +/** FD data which gets passed to callbacks + * + */ +typedef struct rs_update { + fr_event_list_t *list; //!< List to insert new event into. + + fr_pcap_t *in; //!< Linked list of PCAP handles to check for drops. + rs_stats_t *stats; //!< Stats to process. +} rs_update_t; + + +struct rs { + bool from_file; //!< Were reading pcap data from files. + bool from_dev; //!< Were reading pcap data from devices. + bool from_stdin; //!< Were reading pcap data from stdin. + bool to_file; //!< Were writing pcap data to files. + bool to_stdout; //!< Were writing pcap data to stdout. + + bool daemonize; //!< Daemonize and write PID out to file. + char const *pidfile; //!< File to write PID to. + + bool from_auto; //!< From list was auto-generated. + bool promiscuous; //!< Capture in promiscuous mode. + bool print_packet; //!< Print packet info, disabled with -W + bool decode_attrs; //!< Whether we should decode attributes in the request + //!< and response. + bool verify_udp_checksum; //!< Check UDP checksum in packets. + + char const *radius_secret; //!< Secret to decode encrypted attributes. + + char *pcap_filter; //!< PCAP filter string applied to live capture devices. + + char *list_attributes; //!< Raw attribute filter string. + DICT_ATTR const *list_da[RS_MAX_ATTRS]; //!< Output CSV with these attribute values. + int list_da_num; + + char *link_attributes; //!< Names of DICT_ATTRs to use for rtx. + DICT_ATTR const *link_da[RS_MAX_ATTRS]; //!< DICT_ATTRs to link on. + int link_da_num; //!< Number of rtx DICT_ATTRs. + + char const *filter_request; //!< Raw request filter string. + char const *filter_response; //!< Raw response filter string. + + VALUE_PAIR *filter_request_vps; //!< Sorted filter vps. + VALUE_PAIR *filter_response_vps; //!< Sorted filter vps. + PW_CODE filter_request_code; //!< Filter request packets by code. + PW_CODE filter_response_code; //!< Filter response packets by code. + + rs_status_t event_flags; //!< Events we log and capture on. + rs_packet_logger_t logger; //!< Packet logger + + int buffer_pkts; //!< Size of the ring buffer to setup for live capture. + uint64_t limit; //!< Maximum number of packets to capture + + struct { + int interval; //!< Time between stats updates in seconds. + stats_out_t out; //!< Where to write stats. + int timeout; //!< Maximum length of time we wait for a response. + +#ifdef HAVE_COLLECTDC_H + char const *collectd; //!< Collectd server/port/unixsocket + char const *prefix; //!< Prefix collectd stats with this value. + lcc_connection_t *handle; //!< Collectd client handle. + rs_stats_tmpl_t *tmpl; //!< The stats templates we created on startup. +#endif + } stats; +}; + +#ifdef HAVE_COLLECTDC_H + +/** Callback for processing stats values. + * + */ +typedef void (*rs_stats_cb_t)(rs_t *conf, rs_stats_value_tmpl_t *tmpl); +struct rs_stats_value_tmpl { + void *src; //!< Pointer to source field in struct. Must be set by + //!< stats_collectdc_init caller. + int type; //!< Stats type. + rs_stats_cb_t cb; //!< Callback used to process stats + void *dst; //!< Pointer to dst field in value struct. Must be set + //!< by stats_collectdc_init caller. +}; + +/** Stats templates + * + * This gets processed to turn radsniff stats structures into collectd lcc_value_list_t structures. + */ +struct rs_stats_tmpl +{ + rs_stats_value_tmpl_t *value_tmpl; //!< Value template + void *stats; //!< Struct containing the raw stats to process + lcc_value_list_t *value; //!< Collectd stats struct to populate + + rs_stats_tmpl_t *next; //!< Next... +}; + +/* + * collectd.c - Registration and processing functions + */ +rs_stats_tmpl_t *rs_stats_collectd_init_latency(TALLOC_CTX *ctx, rs_stats_tmpl_t **out, rs_t *conf, + char const *type, rs_latency_t *stats, PW_CODE code); +void rs_stats_collectd_do_stats(rs_t *conf, rs_stats_tmpl_t *tmpls, struct timeval *now); +int rs_stats_collectd_open(rs_t *conf); +int rs_stats_collectd_close(rs_t *conf); + +#endif diff --git a/src/include/radutmp.h b/src/include/radutmp.h new file mode 100644 index 0000000..77b7551 --- /dev/null +++ b/src/include/radutmp.h @@ -0,0 +1,65 @@ +/* + * radutmp.h Definitions for the Radius UTMP file. + * + * Version: $Id$ + */ + +#ifndef _RADUTMP_H +#define _RADUTMP_H + +RCSIDH(radutmp_h, "$Id$") + +#ifdef __cplusplus +extern "C" { +#endif + +/* + * Types of connection. + */ +#ifndef P_UNKNOWN +# define P_UNKNOWN 0 +# define P_LOCAL 'L' +# define P_RLOGIN 'R' +# define P_SLIP 'S' +# define P_CSLIP 'C' +# define P_PPP 'P' +# define P_AUTOPPP 'A' +# define P_TELNET 'E' +# define P_TCPCLEAR 'T' +# define P_TCPLOGIN 'U' +# define P_CONSOLE '!' +# define P_SHELL 'X' +#endif + +#define P_IDLE 0 +#define P_LOGIN 1 + +struct radutmp { + char login[32]; /* Loginname */ + /* FIXME: extend to 48 or 64 bytes */ + unsigned int nas_port; /* Port on the terminal server (32 bits). */ + char session_id[8]; /* Radius session ID (first 8 bytes at least)*/ + /* FIXME: extend to 16 or 32 bytes */ + unsigned int nas_address; /* IP of portmaster. */ + unsigned int framed_address; /* SLIP/PPP address or login-host. */ + int proto; /* Protocol. */ + time_t time; /* Time entry was last updated. */ + time_t delay; /* Delay time of request */ + int type; /* Type of entry (login/logout) */ + char porttype; /* Porttype (I=ISDN A=Async T=Async-ISDN */ + char res1,res2,res3; /* Fills up to one int */ + char caller_id[16]; /* Calling-Station-ID */ + char reserved[12]; /* 3 ints reserved */ +}; + +/* + * Take the size of the structure from the actual structure definition. + */ +#define RUT_NAMESIZE sizeof(((struct radutmp *) NULL)->login) +#define RUT_SESSSIZE sizeof(((struct radutmp *) NULL)->session_id) + +#ifdef __cplusplus +} +#endif + +#endif /* _RADUTMP_H */ diff --git a/src/include/realms.h b/src/include/realms.h new file mode 100644 index 0000000..23806f4 --- /dev/null +++ b/src/include/realms.h @@ -0,0 +1,235 @@ +#ifndef REALMS_H +#define REALMS_H + +/* + * realms.h Structures, prototypes and global variables + * for realms + * + * Version: $Id$ + * + */ + +RCSIDH(realms_h, "$Id$") + +#ifdef __cplusplus +extern "C" { +#endif + +extern bool home_servers_udp; //!< Whether there are any UDP home servers + +typedef enum { + HOME_TYPE_INVALID = 0, + HOME_TYPE_AUTH, //!< Authentication server + HOME_TYPE_ACCT, //!< Accounting server + HOME_TYPE_AUTH_ACCT, //!< Authentication and accounting server + +#ifdef WITH_COA + HOME_TYPE_COA, //!< CoA destination (NAS or Proxy) + +#ifdef WITH_COA_TUNNEL + HOME_TYPE_AUTH_COA, //!< auth + coa + HOME_TYPE_AUTH_ACCT_COA, //!< auth + acct + coa +#endif +#endif +} home_type_t; + +typedef enum { + HOME_PING_CHECK_INVALID = 0, + HOME_PING_CHECK_NONE, + HOME_PING_CHECK_STATUS_SERVER, + HOME_PING_CHECK_REQUEST +} home_ping_check_t; + +typedef enum { + HOME_STATE_ALIVE = 0, + HOME_STATE_ZOMBIE, + HOME_STATE_IS_DEAD, + HOME_STATE_UNKNOWN, + HOME_STATE_ADMIN_DOWN, + HOME_STATE_CONNECTION_FAIL, +} home_state_t; + +#define HOME_SERVER_IS_DEAD(_x) (((_x)->state == HOME_STATE_IS_DEAD) || ((_x)->state == HOME_STATE_ADMIN_DOWN) || ((_x)->state == HOME_STATE_CONNECTION_FAIL)) + +typedef struct fr_socket_limit_t { + uint32_t max_connections; + uint32_t num_connections; + uint32_t max_requests; + uint32_t num_requests; + uint32_t lifetime; + uint32_t idle_timeout; +} fr_socket_limit_t; + +typedef struct home_server { + char const *log_name; //!< The name used for log messages. + + char const *name; //!< Name the server may be referenced by for querying + //!< stats or when specifying home servers for a pool. + + bool dual; //!< One of a pair of homeservers on consecutive ports. + bool dynamic; //!< is this a dynamically added home server? + bool nonblock; //!< Enable a socket non-blocking to the home server. +#ifdef WITH_COA_TUNNEL + bool recv_coa; //!< receive CoA packets, too +#endif + char const *virtual_server; //!< For internal proxying + char const *parent_server; + + fr_ipaddr_t ipaddr; //!< IP address of home server. + uint16_t port; + + char const *type_str; //!< String representation of type. + home_type_t type; //!< Auth, Acct, CoA etc. + + char const *src_ipaddr_str; //!< Need to parse the string specially as it may + //!< require a DNS lookup and the address family for that + //!< is the same as ipaddr. + fr_ipaddr_t src_ipaddr; //!< Resolved version of src_ipaddr_str. Preferred source + //!< IP address (useful for multihomed systems). + + char const *proto_str; //!< String representation of protocol. + int proto; //!< TCP or UDP. + + fr_socket_limit_t limit; + + char const *secret; + + fr_event_t *ev; + struct timeval when; + + struct timeval response_window; + uint32_t response_timeouts; + uint32_t max_response_timeouts; + uint32_t max_outstanding; //!< Maximum outstanding requests. + uint32_t currently_outstanding; + + time_t last_packet_sent; + time_t last_packet_recv; + time_t last_failed_open; + struct timeval revive_time; + struct timeval zombie_period_start; + uint32_t zombie_period; //!< Unresponsive for T, mark it dead. + + int state; + + char const *ping_check_str; + home_ping_check_t ping_check; //!< What method we use to perform the 'ping' + //!< none, status-server or fake request. + + char const *ping_user_name; + char const *ping_user_password; + + uint32_t ping_interval; + uint32_t num_pings_to_alive; + uint32_t num_sent_pings; + uint32_t num_received_pings; + uint32_t ping_timeout; + + uint32_t revive_interval; //!< How often we revive it (if it doesn't support pings). + CONF_SECTION *cs; +#ifdef WITH_COA + uint32_t coa_irt; + uint32_t coa_mrc; + uint32_t coa_mrt; + uint32_t coa_mrd; +#ifdef WITH_COA_TUNNEL + char const *recv_coa_server; //!< for accepting incoming CoA requests +#endif +#endif +#ifdef WITH_TLS + fr_tls_server_conf_t *tls; + uint32_t connect_timeout; + rbtree_t *listeners; +#endif + +#ifdef WITH_STATS + int number; + + fr_stats_t stats; + + fr_stats_ema_t ema; +#endif +#ifdef HAVE_TRUST_ROUTER_TR_DH_H + time_t expiration; +#endif + +} home_server_t; + + +typedef enum home_pool_type_t { + HOME_POOL_INVALID = 0, + HOME_POOL_LOAD_BALANCE, + HOME_POOL_FAIL_OVER, + HOME_POOL_CLIENT_BALANCE, + HOME_POOL_CLIENT_PORT_BALANCE, + HOME_POOL_KEYED_BALANCE +} home_pool_type_t; + + +typedef struct home_pool_t { + char const *name; + home_pool_type_t type; + + home_type_t server_type; + CONF_SECTION *cs; + + char const *virtual_server; /* for pre/post-proxy */ + + home_server_t *fallback; + int in_fallback; + time_t time_all_dead; + time_t last_serviced; + + int num_home_servers; + home_server_t *servers[1]; +} home_pool_t; + + +typedef struct _realm { + char const *name; + + bool strip_realm; + + home_pool_t *auth_pool; + home_pool_t *acct_pool; +#ifdef WITH_COA + home_pool_t *coa_pool; +#endif +} REALM; + +typedef struct realm_config realm_config_t; + +int realms_init(CONF_SECTION *config); +void realms_free(void); +REALM *realm_find(char const *name); /* name is from a packet */ +REALM *realm_find2(char const *name); /* ... with name taken from realm_find */ + +void realm_home_server_sanitize(home_server_t *home, CONF_SECTION *cs); +int realm_pool_add(home_pool_t *pool, CONF_SECTION *cs); +void realm_pool_free(home_pool_t *pool); +bool realm_home_server_add(home_server_t *home); +int realm_realm_add( REALM *r, CONF_SECTION *cs); + +void home_server_update_request(home_server_t *home, REQUEST *request); +home_server_t *home_server_ldb(char const *realmname, home_pool_t *pool, REQUEST *request); +home_server_t *home_server_find(fr_ipaddr_t *ipaddr, uint16_t port, int proto); +home_server_t *home_server_find_bysrc(fr_ipaddr_t *ipaddr, uint16_t port, int proto, fr_ipaddr_t *src_ipaddr); +home_server_t *home_server_afrom_cs(TALLOC_CTX *ctx, realm_config_t *rc, CONF_SECTION *cs); +CONF_SECTION *home_server_cs_afrom_client(CONF_SECTION *client); +#ifdef WITH_COA +home_server_t *home_server_byname(char const *name, int type); +#endif +#ifdef WITH_STATS +extern int home_server_max_number; +home_server_t *home_server_bynumber(int number); +#endif +home_pool_t *home_pool_byname(char const *name, int type); + +int home_server_afrom_file(char const *filename); +int home_server_delete(char const *name, char const *type); + +#ifdef __cplusplus +} +#endif + +#endif /* REALMS_H */ diff --git a/src/include/regex.h b/src/include/regex.h new file mode 100644 index 0000000..efb7b86 --- /dev/null +++ b/src/include/regex.h @@ -0,0 +1,77 @@ +/* + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + */ +#ifndef REGEX_H +#define REGEX_H +#ifdef HAVE_REGEX +/* + * $Id$ + * + * @file regex.h + * @brief Wrappers around various regular expression libraries. + * + * @copyright 2014 The FreeRADIUS server project + */ +RCSIDH(regex_h, "$Id$") + +# ifdef __cplusplus +extern "C" { +# endif +# ifdef HAVE_PCRE +# include <pcre.h> +/* + * Versions older then 8.20 didn't have the JIT functionality + * gracefully degrade. + */ +# ifndef PCRE_STUDY_JIT_COMPILE +# define PCRE_STUDY_JIT_COMPILE 0 +# endif +/* + * libpcre defines its matches as an array of ints which is a + * multiple of three. + */ +typedef struct regmatch { + int a; + int b; + int c; +} regmatch_t; + +typedef struct regex { + bool precompiled; //!< Whether this regex was precompiled, or compiled for one of evaluation. + pcre *compiled; //!< Compiled regular expression. + pcre_extra *extra; //!< Result of studying a regular expression. +} regex_t; +# else +# include <regex.h> +/* + * Allow REG_EXTENDED and REG_NOSUB to be or'd with flags + * if they're not defined. + */ +# ifndef REG_EXTENDED +# define REG_EXTENDED (0) +# endif + +# ifndef REG_NOSUB +# define REG_NOSUB (0) +# endif +# endif +ssize_t regex_compile(TALLOC_CTX *ctx, regex_t **out, char const *pattern, size_t len, + bool ignore_case, bool multiline, bool subcaptures, bool runtime); +int regex_exec(regex_t *preg, char const *string, size_t len, regmatch_t pmatch[], size_t *nmatch); +# ifdef __cplusplus +} +# endif +#endif +#endif diff --git a/src/include/sha1.h b/src/include/sha1.h new file mode 100644 index 0000000..86c3d9f --- /dev/null +++ b/src/include/sha1.h @@ -0,0 +1,57 @@ +#ifndef _FR_SHA1_H +#define _FR_SHA1_H + +#ifdef WITH_OPENSSL_SHA1 +#include <openssl/sha.h> +#endif + +#ifdef __cplusplus +extern "C" { +#endif + +#ifndef SHA1_DIGEST_LENGTH +# define SHA1_DIGEST_LENGTH 20 +#endif + +#ifndef WITH_OPENSSL_SHA1 +typedef struct { + uint32_t state[5]; + uint32_t count[2]; + uint8_t buffer[64]; +} fr_sha1_ctx; + +void fr_sha1_transform(uint32_t state[5], uint8_t const buffer[64]); +void fr_sha1_init(fr_sha1_ctx *context); +void fr_sha1_update(fr_sha1_ctx *context, uint8_t const *data, size_t len); +void fr_sha1_final(uint8_t digest[20], fr_sha1_ctx *context); + +/* + * this version implements a raw SHA1 transform, no length is appended, + * nor any 128s out to the block size. + */ +void fr_sha1_final_no_len(uint8_t digest[20], fr_sha1_ctx* context); + +#else /* WITH_OPENSSL_SHA1 */ +USES_APPLE_DEPRECATED_API +#define fr_sha1_ctx SHA_CTX +#define fr_sha1_init SHA1_Init +#define fr_sha1_update SHA1_Update +#define fr_sha1_final SHA1_Final +#define fr_sha1_transform SHA1_Transform +#endif + +/* + * FIPS 186-2 PRF based upon SHA1. + */ +void fips186_2prf(uint8_t mk[20], uint8_t finalkey[160]); + +/* hmacsha1.c */ + +void fr_hmac_sha1(uint8_t digest[SHA1_DIGEST_LENGTH], uint8_t const *text, size_t text_len, + uint8_t const *key, size_t key_len); + +#ifdef __cplusplus +} +#endif + +#endif /* _FR_SHA1_H */ diff --git a/src/include/socket.h b/src/include/socket.h new file mode 100644 index 0000000..821c2a0 --- /dev/null +++ b/src/include/socket.h @@ -0,0 +1,53 @@ +#pragma once + +/* + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or (at + * your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + */ + +/** Functions for establishing and managing low level sockets + * + * @file src/include/socket.h + * + * @author Arran Cudbard-Bell (a.cudbardb@freeradius.org) + * @author Alan DeKok (aland@freeradius.org) + * + * @copyright 2015 The FreeRADIUS project + */ +RCSIDH(socket_h, "$Id$") + +#ifdef __cplusplus +extern "C" { +#endif + +#include <freeradius-devel/build.h> +#include <freeradius-devel/missing.h> + +#ifdef HAVE_SYS_UN_H +# include <sys/un.h> +/* + * The linux headers define the macro as: + * + * # define SUN_LEN(ptr) ((size_t) (((struct sockaddr_un *) 0)->sun_path) \ + * + strlen ((ptr)->sun_path)) + * + * Which trips UBSAN, because it sees an operation on a NULL pointer. + */ +# undef SUN_LEN +# define SUN_LEN(su) (sizeof(*(su)) - sizeof((su)->sun_path) + strlen((su)->sun_path)) +#endif + +#ifdef __cplusplus +} +#endif diff --git a/src/include/soh.h b/src/include/soh.h new file mode 100644 index 0000000..c1187cc --- /dev/null +++ b/src/include/soh.h @@ -0,0 +1,42 @@ +/* + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + */ +#ifndef FR_SOH_H +#define FR_SOH_H +/** + * $Id$ + * + * @file soh.h + * @brief Microsoft SoH support + * + * @copyright 2010 Phil Mayers <p.mayers@imperial.ac.uk> + */ + +RCSIDH(soh_h, "$Id$") + +#ifdef __cplusplus +extern "C" { +#endif + +int soh_verify(REQUEST *request, uint8_t const *data, unsigned int data_len) CC_HINT(nonnull); +uint16_t soh_pull_be_16(uint8_t const *p); +uint32_t soh_pull_be_24(uint8_t const *p); +uint32_t soh_pull_be_32(uint8_t const *p); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/src/include/state.h b/src/include/state.h new file mode 100644 index 0000000..d9b47a0 --- /dev/null +++ b/src/include/state.h @@ -0,0 +1,47 @@ +#ifndef FR_STATE_H +#define FR_STATE_H + +/* + * state.h handle multi-packet state + * + * Version: $Id$ + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + * + * Copyright 2014 The FreeRADIUS server project + * Copyright 2014 Alan DeKok <aland@deployingradius.com> + */ + +RCSIDH(state_h, "$Id$") + +#ifdef __cplusplus +extern "C" { +#endif + +typedef struct fr_state_t fr_state_t; + +fr_state_t *fr_state_init(TALLOC_CTX *ctx); +void fr_state_delete(fr_state_t *state); + +void fr_state_discard(REQUEST *request, RADIUS_PACKET *original); + +void fr_state_get_vps(REQUEST *request, RADIUS_PACKET *packet); +bool fr_state_put_vps(REQUEST *request, RADIUS_PACKET *original, RADIUS_PACKET *packet); + +#ifdef __cplusplus +} +#endif + +#endif /* FR_HASH_H */ diff --git a/src/include/stats.h b/src/include/stats.h new file mode 100644 index 0000000..68903f9 --- /dev/null +++ b/src/include/stats.h @@ -0,0 +1,101 @@ +#ifndef FR_STATS_H +#define FR_STATS_H + +/* + * stats.h Structures and functions for statistics. + * + * Version: $Id$ + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + * + * Copyright 2005,2006,2007,2008 The FreeRADIUS server project + */ + +RCSIDH(stats_h, "$Id$") + +#ifdef __cplusplus +extern "C" { +#endif + +#ifdef WITH_STATS +typedef struct fr_stats_t { + uint64_t total_requests; + uint64_t total_invalid_requests; + uint64_t total_dup_requests; + uint64_t total_responses; + uint64_t total_access_accepts; + uint64_t total_access_rejects; + uint64_t total_access_challenges; + uint64_t total_malformed_requests; + uint64_t total_bad_authenticators; + uint64_t total_packets_dropped; + uint64_t total_no_records; + uint64_t total_unknown_types; + uint64_t total_timeouts; + uint64_t total_conflicts; + uint64_t unresponsive_child; + time_t last_packet; + uint64_t elapsed[8]; +} fr_stats_t; + +typedef struct fr_stats_ema_t { + uint32_t window; + + uint32_t f1, f10; + uint32_t ema1, ema10; +} fr_stats_ema_t; + +extern fr_stats_t radius_auth_stats; +#ifdef WITH_ACCOUNTING +extern fr_stats_t radius_acct_stats; +#endif +#ifdef WITH_COA +extern fr_stats_t radius_coa_stats; +extern fr_stats_t radius_dsc_stats; +#endif +#ifdef WITH_PROXY +extern fr_stats_t proxy_auth_stats; +#ifdef WITH_ACCOUNTING +extern fr_stats_t proxy_acct_stats; +#endif +#ifdef WITH_COA +extern fr_stats_t proxy_coa_stats; +extern fr_stats_t proxy_dsc_stats; +#endif +#endif + +void radius_stats_init(int flag); +void request_stats_final(REQUEST *request); +void request_stats_reply(REQUEST *request); +void radius_stats_ema(fr_stats_ema_t *ema, + struct timeval *start, struct timeval *end); + +#define FR_STATS_INC(_x, _y) radius_ ## _x ## _stats._y++;if (listener) listener->stats._y++;if (client) client->_x._y++; +#define FR_STATS_TYPE_INC(_x) _x++ + +#else /* WITH_STATS */ +#define request_stats_init(_x) +#define request_stats_final(_x) + +#define FR_STATS_INC(_x, _y) +#define FR_STATS_TYPE_INC(_x) + +#endif + +#ifdef __cplusplus +} +#endif + +#endif /* FR_STATS_H */ diff --git a/src/include/stdatomic.h b/src/include/stdatomic.h new file mode 100644 index 0000000..780e5a0 --- /dev/null +++ b/src/include/stdatomic.h @@ -0,0 +1,364 @@ +#pragma once +/* + * An implementation of C11 stdatomic.h directly borrowed from FreeBSD + * (original copyright follows), with minor modifications for + * portability to other systems. Works for recent Clang (that + * implement the feature c_atomic) and GCC 4.7+; includes + * compatibility for GCC below 4.7 but I wouldn't recommend it. + * + * Caveats and limitations: + * - Only the ``_Atomic parentheses'' notation is implemented, while + * the ``_Atomic space'' one is not. + * - _Atomic types must be typedef'ed, or programs using them will + * not type check correctly (incompatible anonymous structure + * types). + * - Non-scalar _Atomic types would require runtime support for + * runtime locking, which, as far as I know, is not currently + * available on any system. + */ + +/*- + * @copyright (c) 2011 Ed Schouten <ed@FreeBSD.org> + * David Chisnall <theraven@FreeBSD.org> + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * $FreeBSD: src/include/stdatomic.h,v 1.10.2.2 2012/05/30 19:21:54 theraven Exp $ + */ +#include <stddef.h> +#include <stdint.h> + +#if !defined(__has_feature) +#define __has_feature(x) 0 +#endif +#if !defined(__has_builtin) +#define __has_builtin(x) 0 +#endif +#if !defined(__GNUC_PREREQ__) +#if defined(__GNUC__) && defined(__GNUC_MINOR__) +#define __GNUC_PREREQ__(maj, min) \ + ((__GNUC__ << 16) + __GNUC_MINOR__ >= ((maj) << 16) + (min)) +#else +#define __GNUC_PREREQ__(maj, min) 0 +#endif +#endif + +#if !defined(__CLANG_ATOMICS) && !defined(__GNUC_ATOMICS) +#if __has_feature(c_atomic) +#define __CLANG_ATOMICS +#elif __GNUC_PREREQ__(4, 7) +#define __GNUC_ATOMICS +#elif !defined(__GNUC__) +#error "stdatomic.h does not support your compiler" +#endif +#endif + +#if !defined(__CLANG_ATOMICS) +#define _Atomic(T) struct { volatile __typeof__(T) __val; } +#endif + +/* + * 7.17.2 Initialization. + */ + +#if defined(__CLANG_ATOMICS) +#define ATOMIC_VAR_INIT(value) (value) +#define atomic_init(obj, value) __c11_atomic_init(obj, value) +#else +#define ATOMIC_VAR_INIT(value) { .__val = (value) } +#define atomic_init(obj, value) do { \ + (obj)->__val = (value); \ +} while (0) +#endif + +/* + * Clang and recent GCC both provide predefined macros for the memory + * orderings. If we are using a compiler that doesn't define them, use the + * clang values - these will be ignored in the fallback path. + */ + +#ifndef __ATOMIC_RELAXED +#define __ATOMIC_RELAXED 0 +#endif +#ifndef __ATOMIC_CONSUME +#define __ATOMIC_CONSUME 1 +#endif +#ifndef __ATOMIC_ACQUIRE +#define __ATOMIC_ACQUIRE 2 +#endif +#ifndef __ATOMIC_RELEASE +#define __ATOMIC_RELEASE 3 +#endif +#ifndef __ATOMIC_ACQ_REL +#define __ATOMIC_ACQ_REL 4 +#endif +#ifndef __ATOMIC_SEQ_CST +#define __ATOMIC_SEQ_CST 5 +#endif + +/* + * 7.17.3 Order and consistency. + * + * The memory_order_* constants that denote the barrier behaviour of the + * atomic operations. + */ + +enum memory_order { + memory_order_relaxed = __ATOMIC_RELAXED, + memory_order_consume = __ATOMIC_CONSUME, + memory_order_acquire = __ATOMIC_ACQUIRE, + memory_order_release = __ATOMIC_RELEASE, + memory_order_acq_rel = __ATOMIC_ACQ_REL, + memory_order_seq_cst = __ATOMIC_SEQ_CST +}; + +typedef enum memory_order memory_order; + +/* + * 7.17.4 Fences. + */ + +#ifdef __CLANG_ATOMICS +#define atomic_thread_fence(order) __c11_atomic_thread_fence(order) +#define atomic_signal_fence(order) __c11_atomic_signal_fence(order) +#elif defined(__GNUC_ATOMICS) +#define atomic_thread_fence(order) __atomic_thread_fence(order) +#define atomic_signal_fence(order) __atomic_signal_fence(order) +#else +#define atomic_thread_fence(order) __sync_synchronize() +#define atomic_signal_fence(order) __asm volatile ("" : : : "memory") +#endif + +/* + * 7.17.5 Lock-free property. + */ + +#if defined(__CLANG_ATOMICS) +#define atomic_is_lock_free(obj) \ + __c11_atomic_is_lock_free(sizeof(obj)) +#elif defined(__GNUC_ATOMICS) +#define atomic_is_lock_free(obj) \ + __atomic_is_lock_free(sizeof((obj)->__val)) +#else +#define atomic_is_lock_free(obj) \ + (sizeof((obj)->__val) <= sizeof(void *)) +#endif + +/* + * 7.17.6 Atomic integer types. + */ + +typedef _Atomic(_Bool) atomic_bool; +typedef _Atomic(char) atomic_char; +typedef _Atomic(signed char) atomic_schar; +typedef _Atomic(unsigned char) atomic_uchar; +typedef _Atomic(short) atomic_short; +typedef _Atomic(unsigned short) atomic_ushort; +typedef _Atomic(int) atomic_int; +typedef _Atomic(unsigned int) atomic_uint; +typedef _Atomic(long) atomic_long; +typedef _Atomic(unsigned long) atomic_ulong; +typedef _Atomic(long long) atomic_llong; +typedef _Atomic(unsigned long long) atomic_ullong; +#if 0 +typedef _Atomic(char16_t) atomic_char16_t; +typedef _Atomic(char32_t) atomic_char32_t; +#endif +typedef _Atomic(wchar_t) atomic_wchar_t; +typedef _Atomic(int_least8_t) atomic_int_least8_t; +typedef _Atomic(uint_least8_t) atomic_uint_least8_t; +typedef _Atomic(int_least16_t) atomic_int_least16_t; +typedef _Atomic(uint_least16_t) atomic_uint_least16_t; +typedef _Atomic(int_least32_t) atomic_int_least32_t; +typedef _Atomic(uint_least32_t) atomic_uint_least32_t; +typedef _Atomic(int_least64_t) atomic_int_least64_t; +typedef _Atomic(uint_least64_t) atomic_uint_least64_t; +typedef _Atomic(int_fast8_t) atomic_int_fast8_t; +typedef _Atomic(uint_fast8_t) atomic_uint_fast8_t; +typedef _Atomic(int_fast16_t) atomic_int_fast16_t; +typedef _Atomic(uint_fast16_t) atomic_uint_fast16_t; +typedef _Atomic(int_fast32_t) atomic_int_fast32_t; +typedef _Atomic(uint_fast32_t) atomic_uint_fast32_t; +typedef _Atomic(int_fast64_t) atomic_int_fast64_t; +typedef _Atomic(uint_fast64_t) atomic_uint_fast64_t; +typedef _Atomic(intptr_t) atomic_intptr_t; +typedef _Atomic(uintptr_t) atomic_uintptr_t; +typedef _Atomic(size_t) atomic_size_t; +typedef _Atomic(ptrdiff_t) atomic_ptrdiff_t; +typedef _Atomic(intmax_t) atomic_intmax_t; +typedef _Atomic(uintmax_t) atomic_uintmax_t; + +/* + * 7.17.7 Operations on atomic types. + */ + +/* + * Compiler-specific operations. + */ + +#if defined(__CLANG_ATOMICS) +#define atomic_compare_exchange_strong_explicit(object, expected, \ + desired, success, failure) \ + __c11_atomic_compare_exchange_strong(object, expected, desired, \ + success, failure) +#define atomic_compare_exchange_weak_explicit(object, expected, \ + desired, success, failure) \ + __c11_atomic_compare_exchange_weak(object, expected, desired, \ + success, failure) +#define atomic_exchange_explicit(object, desired, order) \ + __c11_atomic_exchange(object, desired, order) +#define atomic_fetch_add_explicit(object, operand, order) \ + __c11_atomic_fetch_add(object, operand, order) +#define atomic_fetch_and_explicit(object, operand, order) \ + __c11_atomic_fetch_and(object, operand, order) +#define atomic_fetch_or_explicit(object, operand, order) \ + __c11_atomic_fetch_or(object, operand, order) +#define atomic_fetch_sub_explicit(object, operand, order) \ + __c11_atomic_fetch_sub(object, operand, order) +#define atomic_fetch_xor_explicit(object, operand, order) \ + __c11_atomic_fetch_xor(object, operand, order) +#define atomic_load_explicit(object, order) \ + __c11_atomic_load(object, order) +#define atomic_store_explicit(object, desired, order) \ + __c11_atomic_store(object, desired, order) +#elif defined(__GNUC_ATOMICS) +#define atomic_compare_exchange_strong_explicit(object, expected, \ + desired, success, failure) \ + __atomic_compare_exchange_n(&(object)->__val, expected, \ + desired, 0, success, failure) +#define atomic_compare_exchange_weak_explicit(object, expected, \ + desired, success, failure) \ + __atomic_compare_exchange_n(&(object)->__val, expected, \ + desired, 1, success, failure) +#define atomic_exchange_explicit(object, desired, order) \ + __atomic_exchange_n(&(object)->__val, desired, order) +#define atomic_fetch_add_explicit(object, operand, order) \ + __atomic_fetch_add(&(object)->__val, operand, order) +#define atomic_fetch_and_explicit(object, operand, order) \ + __atomic_fetch_and(&(object)->__val, operand, order) +#define atomic_fetch_or_explicit(object, operand, order) \ + __atomic_fetch_or(&(object)->__val, operand, order) +#define atomic_fetch_sub_explicit(object, operand, order) \ + __atomic_fetch_sub(&(object)->__val, operand, order) +#define atomic_fetch_xor_explicit(object, operand, order) \ + __atomic_fetch_xor(&(object)->__val, operand, order) +#define atomic_load_explicit(object, order) \ + __atomic_load_n(&(object)->__val, order) +#define atomic_store_explicit(object, desired, order) \ + __atomic_store_n(&(object)->__val, desired, order) +#else +#define atomic_compare_exchange_strong_explicit(object, expected, \ + desired, success, failure) ({ \ + __typeof__((object)->__val) __v; \ + _Bool __r; \ + __v = __sync_val_compare_and_swap(&(object)->__val, \ + *(expected), desired); \ + __r = *(expected) == __v; \ + *(expected) = __v; \ + __r; \ +}) + +#define atomic_compare_exchange_weak_explicit(object, expected, \ + desired, success, failure) \ + atomic_compare_exchange_strong_explicit(object, expected, \ + desired, success, failure) +#if __has_builtin(__sync_swap) +/* Clang provides a full-barrier atomic exchange - use it if available. */ +#define atomic_exchange_explicit(object, desired, order) \ + __sync_swap(&(object)->__val, desired) +#else +/* + * __sync_lock_test_and_set() is only an acquire barrier in theory (although in + * practice it is usually a full barrier) so we need an explicit barrier after + * it. + */ +#define atomic_exchange_explicit(object, desired, order) ({ \ + __typeof__((object)->__val) __v; \ + __v = __sync_lock_test_and_set(&(object)->__val, desired); \ + __sync_synchronize(); \ + __v; \ +}) +#endif +#define atomic_fetch_add_explicit(object, operand, order) \ + __sync_fetch_and_add(&(object)->__val, operand) +#define atomic_fetch_and_explicit(object, operand, order) \ + __sync_fetch_and_and(&(object)->__val, operand) +#define atomic_fetch_or_explicit(object, operand, order) \ + __sync_fetch_and_or(&(object)->__val, operand) +#define atomic_fetch_sub_explicit(object, operand, order) \ + __sync_fetch_and_sub(&(object)->__val, operand) +#define atomic_fetch_xor_explicit(object, operand, order) \ + __sync_fetch_and_xor(&(object)->__val, operand) +#define atomic_load_explicit(object, order) \ + __sync_fetch_and_add(&(object)->__val, 0) +#define atomic_store_explicit(object, desired, order) do { \ + __sync_synchronize(); \ + (object)->__val = (desired); \ + __sync_synchronize(); \ +} while (0) +#endif + +/* + * Convenience functions. + */ + +#define atomic_compare_exchange_strong(object, expected, desired) \ + atomic_compare_exchange_strong_explicit(object, expected, \ + desired, memory_order_seq_cst, memory_order_seq_cst) +#define atomic_compare_exchange_weak(object, expected, desired) \ + atomic_compare_exchange_weak_explicit(object, expected, \ + desired, memory_order_seq_cst, memory_order_seq_cst) +#define atomic_exchange(object, desired) \ + atomic_exchange_explicit(object, desired, memory_order_seq_cst) +#define atomic_fetch_add(object, operand) \ + atomic_fetch_add_explicit(object, operand, memory_order_seq_cst) +#define atomic_fetch_and(object, operand) \ + atomic_fetch_and_explicit(object, operand, memory_order_seq_cst) +#define atomic_fetch_or(object, operand) \ + atomic_fetch_or_explicit(object, operand, memory_order_seq_cst) +#define atomic_fetch_sub(object, operand) \ + atomic_fetch_sub_explicit(object, operand, memory_order_seq_cst) +#define atomic_fetch_xor(object, operand) \ + atomic_fetch_xor_explicit(object, operand, memory_order_seq_cst) +#define atomic_load(object) \ + atomic_load_explicit(object, memory_order_seq_cst) +#define atomic_store(object, desired) \ + atomic_store_explicit(object, desired, memory_order_seq_cst) + +/* + * 7.17.8 Atomic flag type and operations. + */ + +typedef atomic_bool atomic_flag; + +#define ATOMIC_FLAG_INIT ATOMIC_VAR_INIT(0) + +#define atomic_flag_clear_explicit(object, order) \ + atomic_store_explicit(object, 0, order) +#define atomic_flag_test_and_set_explicit(object, order) \ + atomic_compare_exchange_strong_explicit(object, 0, 1, order, order) + +#define atomic_flag_clear(object) \ + atomic_flag_clear_explicit(object, memory_order_seq_cst) +#define atomic_flag_test_and_set(object) \ + atomic_flag_test_and_set_explicit(object, memory_order_seq_cst) diff --git a/src/include/sysutmp.h b/src/include/sysutmp.h new file mode 100644 index 0000000..13a47b5 --- /dev/null +++ b/src/include/sysutmp.h @@ -0,0 +1,108 @@ +/* + * sysutmp.h Compatibility stuff for the different UTMP systems. + * + * Version: $Id$ + */ + +#ifndef SYSUTMP_H_INCLUDED +#define SYSUTMP_H_INCLUDED + +RCSIDH(sysutmp_h, "$Id$") + +/* + * If we have BOTH utmp.h and utmpx.h, then + * we prefer to use utmp.h, but only on systems other than Solaris. + */ +#if !defined(__sun) && !defined(sgi) && !defined(hpux) +# ifdef HAVE_UTMP_H +# undef HAVE_UTMPX_H +# endif +#endif + +#if defined(HAVE_UTMP_H) || defined(HAVE_UTMPX_H) + +/* UTMP stuff. Uses utmpx on svr4 */ +#ifdef HAVE_UTMPX_H +# include <utmpx.h> +# include <sys/fcntl.h> +# define utmp utmpx +# define UT_NAMESIZE 32 +# define UT_LINESIZE 32 +# define UT_HOSTSIZE 257 +#if defined(hpux) || defined(__FreeBSD__) +# define ut_name ut_user +#endif +#else +# include <utmp.h> +#endif + +#ifdef __cplusplus +extern "C" { +#endif + +#ifdef __osf__ +# define UT_NAMESIZE 32 +# define UT_LINESIZE 32 +# define UT_HOSTSIZE 64 +#endif + +#if (defined(__FreeBSD__) && !defined(HAVE_UTMPX_H)) || defined(__NetBSD__) || defined(bsdi) || defined(__OpenBSD__) || defined(__APPLE__) +# ifndef UTMP_FILE +# define UTMP_FILE "/var/run/utmp" +# endif +# define ut_user ut_name +#endif + +/* + * Generate definitions for systems which are too broken to + * do it themselves. + * + * Hmm... this means that we can probably get rid of a lot of + * the static defines above, as the following lines will generate + * the proper defines for any system. + */ +#ifndef UT_LINESIZE +#define UT_LINESIZE sizeof(((struct utmp *) NULL)->ut_line) +#endif + +#ifndef UT_NAMESIZE +#define UT_NAMESIZE sizeof(((struct utmp *) NULL)->ut_user) +#endif + +#ifndef UT_HOSTSIZE +#define UT_HOSTSIZE sizeof(((struct utmp *) NULL)->ut_host) +#endif + +#else /* HAVE_UTMP_H */ + +/* + * No <utmp.h> file - define stuff ourselves (minimally). + */ +#define UT_LINESIZE 16 +#define UT_NAMESIZE 16 +#define UT_HOSTSIZE 16 + +#define USER_PROCESS 7 +#define DEAD_PROCESS 8 + +#define UTMP_FILE "/var/run/utmp" +#define ut_name ut_user + +struct utmp { + short ut_type; + int ut_pid; + char ut_line[UT_LINESIZE]; + char ut_id[4]; + long ut_time; + char ut_user[UT_NAMESIZE]; + char ut_host[UT_HOSTSIZE]; + long ut_addr; +}; + +#endif /* HAVE_UTMP_H */ + +#ifdef __cplusplus +} +#endif + +#endif /* SYSUTMP_H_INCLUDED */ diff --git a/src/include/talloc.h b/src/include/talloc.h new file mode 100644 index 0000000..b9e6abd --- /dev/null +++ b/src/include/talloc.h @@ -0,0 +1,51 @@ +#pragma once +/* + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + */ + +/** Functions which we wish were included in the standard talloc distribution + * + * @file src/lib/util/talloc.h + * + * @copyright 2017 The FreeRADIUS server project + * @copyright 2017 Arran Cudbard-Bell (a.cudbardb@freeradius.org) + */ +RCSIDH(talloc_h, "$Id$") + +#ifdef __cplusplus +extern "C" { +#endif + +#include <ctype.h> +#include <stdbool.h> +#include <stdint.h> + +#ifdef HAVE_WDOCUMENTATION +DIAG_OFF(documentation) +#endif +#include <talloc.h> +#ifdef HAVE_WDOCUMENTATION +DIAG_ON(documentation) +#endif + +#include <freeradius-devel/autoconf.h> /* Very easy to miss including in special builds */ +#include <freeradius-devel/build.h> +#include <freeradius-devel/missing.h> + +TALLOC_CTX *talloc_aligned_array(TALLOC_CTX *ctx, void **start, size_t alignment, size_t size); + +#ifdef __cplusplus +} +#endif diff --git a/src/include/tcp.h b/src/include/tcp.h new file mode 100644 index 0000000..624560e --- /dev/null +++ b/src/include/tcp.h @@ -0,0 +1,31 @@ +/* + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + */ +#ifndef FR_TCP_H +#define FR_TCP_H +/** + * $Id$ + * + * @file tcp.h + * @brief RADIUS over TCP + * + * @copyright 2009 Dante http://dante.net + */ + +RCSIDH(tcp_h, "$Id$") + +int fr_tcp_read_packet(RADIUS_PACKET *packet, int flags); +RADIUS_PACKET *fr_tcp_recv(int sockfd, int flags); +#endif /* FR_TCP_H */ diff --git a/src/include/threads.h b/src/include/threads.h new file mode 100644 index 0000000..f2aea77 --- /dev/null +++ b/src/include/threads.h @@ -0,0 +1,119 @@ +#ifndef FR_THREADS_H +#define FR_THREADS_H +/* + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + */ + +/** + * $Id$ + * + * @file threads.h + * @brief Macros to abstract Thread Local Storage + * + * @copyright 2013 The FreeRADIUS server project + */ +typedef void (*pthread_destructor_t)(void*); + +#if !defined(HAVE_PTHREAD_H) && defined(WITH_THREADS) +# error WITH_THREADS defined, but pthreads not available +#endif + +/* + * First figure whether we have compiler support this is usually the case except on OSX, + * where we need to use pthreads. + */ +#ifdef TLS_STORAGE_CLASS +# define __THREAD TLS_STORAGE_CLASS +#endif + +/* + * Now we define three macros for initialisation, updating, and retrieving + */ +#ifndef WITH_THREADS +# define fr_thread_local_setup(_t, _n) static _t _n;\ +static inline int __fr_thread_local_destructor_##_n(pthread_destructor_t *ctx)\ +{\ + pthread_destructor_t func = *ctx;\ + func(_n);\ + return 0;\ +}\ +DIAG_OFF(deprecated-declarations) \ +static inline _t __fr_thread_local_init_##_n(pthread_destructor_t func)\ +{\ + static pthread_destructor_t *ctx;\ + if (!ctx) {\ + ctx = talloc(talloc_autofree_context(), pthread_destructor_t);\ + talloc_set_destructor(ctx, __fr_thread_local_destructor_##_n);\ + *ctx = func;\ + }\ + return _n;\ +} \ +DIAG_ON(deprecated-declarations) + +# define fr_thread_local_init(_n, _f) __fr_thread_local_init_##_n(_f) +# define fr_thread_local_set(_n, _v) ((int)!((_n = _v) || 1)) +# define fr_thread_local_get(_n) _n +#elif defined(__THREAD) +# include <pthread.h> +# define fr_thread_local_setup(_t, _n) static __THREAD _t _n;\ +static pthread_key_t __fr_thread_local_key_##_n;\ +static pthread_once_t __fr_thread_local_once_##_n = PTHREAD_ONCE_INIT;\ +static pthread_destructor_t __fr_thread_local_destructor_##_n = NULL;\ +static void __fr_thread_local_destroy_##_n(UNUSED void *unused)\ +{\ + __fr_thread_local_destructor_##_n(_n);\ +}\ +static void __fr_thread_local_key_init_##_n(void)\ +{\ + (void) pthread_key_create(&__fr_thread_local_key_##_n, __fr_thread_local_destroy_##_n);\ +}\ +static _t __fr_thread_local_init_##_n(pthread_destructor_t func)\ +{\ + __fr_thread_local_destructor_##_n = func;\ + if (_n) return _n; \ + (void) pthread_once(&__fr_thread_local_once_##_n, __fr_thread_local_key_init_##_n);\ + (void) pthread_setspecific(__fr_thread_local_key_##_n, &(_n));\ + return _n;\ +} +# define fr_thread_local_init(_n, _f) __fr_thread_local_init_##_n(_f) +# define fr_thread_local_set(_n, _v) ((int)!((_n = _v) || 1)) +# define fr_thread_local_get(_n) _n +#elif defined(HAVE_PTHREAD_H) +# include <pthread.h> +# define fr_thread_local_setup(_t, _n) \ +static pthread_key_t __fr_thread_local_key_##_n;\ +static pthread_once_t __fr_thread_local_once_##_n = PTHREAD_ONCE_INIT;\ +static pthread_destructor_t __fr_thread_local_destructor_##_n = NULL;\ +static void __fr_thread_local_destroy_##_n(UNUSED void *unused)\ +{\ + __fr_thread_local_destructor_##_n(_n);\ +}\ +static void __fr_thread_local_key_init_##_n(void)\ +{\ + (void) pthread_key_create(&__fr_thread_local_key_##_n, __fr_thread_local_destroy_##_n);\ + (void) pthread_setspecific(__fr_thread_local_key_##_n, &(_n));\ +}\ +static _t __fr_thread_local_init_##_n(pthread_destructor_t func)\ +{\ + __fr_thread_local_destructor_##_n = func;\ + if (_n) return _n; \ + (void) pthread_once(&__fr_thread_local_once_##_n, __fr_thread_local_key_init_##_n);\ + return _n;\ +} +# define fr_thread_local_init(_n, _f) __fr_thread_local_init_##_n(_f) +# define fr_thread_local_set(_n, _v) __fr_thread_local_set_##_n(_v) +# define fr_thread_local_get(_n) __fr_thread_local_get_##_n() +#endif +#endif diff --git a/src/include/tls-h b/src/include/tls-h new file mode 100644 index 0000000..4bf1665 --- /dev/null +++ b/src/include/tls-h @@ -0,0 +1,453 @@ +/* + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + */ +#ifndef FR_TLS_H +#define FR_TLS_H + +#ifdef WITH_TLS +/** + * $Id$ + * + * @file tls.h + * @brief Structures and prototypes for TLS wrappers + * + * @copyright 2010 Network RADIUS SARL <info@networkradius.com> + */ + +RCSIDH(tls_h, "$Id$") + +#include <freeradius-devel/conffile.h> + +/* + * For RH 9, which apparently needs this. + */ +#ifndef OPENSSL_NO_KRB5 +# define OPENSSL_NO_KRB5 +#endif +#include <openssl/err.h> +#ifdef HAVE_OPENSSL_ENGINE_H +# include <openssl/engine.h> +#endif +#include <openssl/ssl.h> + +#ifdef __cplusplus +extern "C" { +#endif + +typedef struct fr_tls_server_conf_t fr_tls_server_conf_t; + +typedef enum { + FR_TLS_INVALID = 0, //!< Invalid, don't reply. + FR_TLS_REQUEST, //!< Request, ok to send, invalid to receive. + FR_TLS_RESPONSE, //!< Response, ok to receive, invalid to send. + FR_TLS_SUCCESS, //!< Success, send success. + FR_TLS_FAIL, //!< Fail, send fail. + FR_TLS_NOOP, //!< Noop, continue. + + FR_TLS_START, //!< Start, ok to send, invalid to receive. + FR_TLS_OK, //!< Ok, continue. + FR_TLS_ACK, //!< Acknowledge, continue. + FR_TLS_FIRST_FRAGMENT, //!< First fragment. + FR_TLS_MORE_FRAGMENTS, //!< More fragments, to send/receive. + FR_TLS_LENGTH_INCLUDED, //!< Length included. + FR_TLS_MORE_FRAGMENTS_WITH_LENGTH, //!< More fragments with length. + FR_TLS_HANDLED //!< TLS code has handled it. +} fr_tls_status_t; +extern FR_NAME_NUMBER const fr_tls_status_table[]; + +#define MAX_RECORD_SIZE 65536 + +/* + * A single TLS record may be up to 16384 octets in length, but a + * TLS message may span multiple TLS records, and a TLS + * certificate message may in principle be as long as 16MB. + * + * However, note that in order to protect against reassembly + * lockup and denial of service attacks, it may be desirable for + * an implementation to set a maximum size for one such group of + * TLS messages. + * + * The TLS Message Length field is four octets, and provides the + * total length of the TLS message or set of messages that is + * being fragmented; this simplifies buffer allocation. + */ + +/* + * FIXME: Dynamic allocation of buffer to overcome MAX_RECORD_SIZE overflows. + * or configure TLS not to exceed MAX_RECORD_SIZE. + */ +typedef struct _record_t { + size_t used; + uint8_t data[MAX_RECORD_SIZE]; +} record_t; + +typedef struct _tls_info_t { + int origin; // 0 - received (from peer), 1 - sending (to peer) + int content_type; + uint8_t handshake_type; + uint8_t alert_level; + uint8_t alert_description; + bool initialized; + + char info_description[256]; + size_t record_len; +} tls_info_t; + +#if OPENSSL_VERSION_NUMBER < 0x10001000L +#define ssl_session ssl->session +#else +#define ssl_session session +#endif + +/** Contains EAP-REQUEST specific data (ie FR_TLS_DATA(fragment), EAPTLS-ALERT, EAPTLS-REQUEST ...) + * + * The tls_session_t Structure gets stored as opaque in eap_handler_t + */ +typedef struct _tls_session_t { + SSL_CTX *ctx; + SSL *ssl; +#if OPENSSL_VERSION_NUMBER >= 0x10001000L + SSL_SESSION *session; +#endif + tls_info_t info; + + BIO *into_ssl; + BIO *from_ssl; + record_t clean_in; //!< Data that needs to be sent but only after it is soiled. + record_t clean_out; //!< Data that is cleaned after receiving. + record_t dirty_in; //!< Data EAP server receives. + record_t dirty_out; //!< Data EAP server sends. + + void (*record_init)(record_t *buf); + void (*record_close)(record_t *buf); + unsigned int (*record_plus)(record_t *buf, void const *ptr, unsigned int size); + unsigned int (*record_minus)(record_t *buf, void *ptr, unsigned int size); + + bool invalid_hb_used; //!< Whether heartbleed attack was detected. + bool connected; //!< whether the outgoing socket is connected + bool is_init_finished; //!< whether or not init is finished + bool client_cert_ok; //!< whether or not we validated the client certificate + bool authentication_success; //!< whether or not the user was authenticated (cert or PW) + bool quick_session_tickets; //!< for EAP-TLS. + + /* + * Framed-MTU attribute in RADIUS, if present, can also be used to set this + */ + size_t mtu; //!< Current fragment size transmitted. + size_t tls_msg_len; //!< Actual/Total TLS message length. + bool fragment; //!< Flag, In fragment mode or not. + bool length_flag; //!< A flag to include length in every TLS Data/Alert packet. + //!< If set to no then only the first fragment contains length. + int peap_flag; + + size_t tls_record_in_total_len; //!< How long the peer indicated the complete tls record + //!< would be. + size_t tls_record_in_recvd_len; //!< How much of the record we've received so far. + + /* + * Used by TTLS & PEAP to keep track of other per-session data. + */ + void *opaque; + void (*free_opaque)(void *opaque); + + char const *label; + bool allow_session_resumption; //!< Whether session resumption is allowed. + bool session_not_resumed; //!< Whether our session was not resumed. + + fr_tls_server_conf_t const *conf; //! for better complaints +} tls_session_t; + +/* + * RFC 2716, Section 4.2: + * + * Flags + * + * 0 1 2 3 4 5 6 7 8 + * +-+-+-+-+-+-+-+-+ + * |L M S R R R R R| + * +-+-+-+-+-+-+-+-+ + * + * L = Length included + * M = More fragments + * S = EAP-TLS start + * R = Reserved + */ +#define TLS_START(x) (((x) & 0x20) != 0) +#define TLS_MORE_FRAGMENTS(x) (((x) & 0x40) != 0) +#define TLS_LENGTH_INCLUDED(x) (((x) & 0x80) != 0) + +#define TLS_CHANGE_CIPHER_SPEC(x) (((x) & 0x0014) == 0x0014) +#define TLS_ALERT(x) (((x) & 0x0015) == 0x0015) +#define TLS_HANDSHAKE(x) (((x) & 0x0016) == 0x0016) + +#define SET_START(x) ((x) | (0x20)) +#define SET_MORE_FRAGMENTS(x) ((x) | (0x40)) +#define SET_LENGTH_INCLUDED(x) ((x) | (0x80)) + +/* + * Following enums from rfc2246 + * + * Hmm... since we dpeend on OpenSSL, it would be smarter to + * use the OpenSSL names for these. + */ +enum ContentType { + change_cipher_spec = 20, + alert = 21, + handshake = 22, + application_data = 23 +}; + +enum AlertLevel { + warning = 1, + fatal = 2 +}; + +enum AlertDescription { + close_notify = 0, + unexpected_message = 10, + bad_record_mac = 20, + decryption_failed = 21, + record_overflow = 22, + decompression_failure = 30, + handshake_failure = 40, + bad_certificate = 42, + unsupported_certificate = 43, + certificate_revoked = 44, + certificate_expired = 45, + certificate_unknown = 46, + illegal_parameter = 47, + unknown_ca = 48, + access_denied = 49, + decode_error = 50, + decrypt_error = 51, + export_restriction = 60, + protocol_version = 70, + insufficient_security = 71, + internal_error = 80, + user_canceled = 90, + no_renegotiation = 100 +}; + +enum HandshakeType { + hello_request = 0, + client_hello = 1, + server_hello = 2, + certificate = 11, + server_key_exchange = 12, + certificate_request = 13, + server_hello_done = 14, + certificate_verify = 15, + client_key_exchange = 16, + handshake_finished = 20 +}; + + +/* + * From rfc + Flags + + 0 1 2 3 4 5 6 7 8 + +-+-+-+-+-+-+-+-+ + |L M S R R R R R| + +-+-+-+-+-+-+-+-+ + + L = Length included + M = More fragments + S = EAP-TLS start + R = Reserved + + The L bit (length included) is set to indicate the presence of the + four octet TLS Message Length field, and MUST be set for the first + fragment of a fragmented TLS message or set of messages. The M bit + (more fragments) is set on all but the last fragment. The S bit + (EAP-TLS start) is set in an EAP-TLS Start message. This + differentiates the EAP-TLS Start message from a fragment + acknowledgement. + + TLS Message Length + + The TLS Message Length field is four octets, and is present only + if the L bit is set. This field provides the total length of the + TLS message or set of messages that is being fragmented. + + TLS data + + The TLS data consists of the encapsulated TLS packet in TLS record + format. + * + * The data structures present here + * maps only to the typedata in the EAP packet + * + * Based on the L bit flag, first 4 bytes of data indicate the length + */ + +/* Callbacks */ +int cbtls_password(char *buf, int num, int rwflag, void *userdata); +void cbtls_info(SSL const *s, int where, int ret); +void cbtls_msg(int write_p, int msg_version, int content_type, void const *buf, size_t len, SSL *ssl, + void *arg); +int cbtls_verify(int ok, X509_STORE_CTX *ctx); + +/* threads.c */ +int tls_mutexes_init(void); + +/* TLS */ +int tls_global_init(bool spawn_flag, bool check); +#ifdef ENABLE_OPENSSL_VERSION_CHECK +int tls_global_version_check(char const *acknowledged); +#endif + +int tls_error_log(REQUEST *request, char const *msg, ...) CC_HINT(format (printf, 2, 3)); +int tls_error_io_log(REQUEST *request, tls_session_t *session, int ret, char const *msg, ...) + CC_HINT(format (printf, 4, 5)); + +void tls_global_cleanup(void); +tls_session_t *tls_new_session(TALLOC_CTX *ctx, fr_tls_server_conf_t *conf, REQUEST *request, bool client_cert, bool allow_tls13); +tls_session_t *tls_new_client_session(TALLOC_CTX *ctx, fr_tls_server_conf_t *conf, int fd, VALUE_PAIR **certs); +fr_tls_server_conf_t *tls_server_conf_parse(CONF_SECTION *cs); +fr_tls_server_conf_t *tls_client_conf_parse(CONF_SECTION *cs); +fr_tls_server_conf_t *tls_server_conf_alloc(TALLOC_CTX *ctx); +SSL_CTX *tls_init_ctx(fr_tls_server_conf_t *conf, int client, char const *chain_file, char const *private_key_file); +int tls_handshake_recv(REQUEST *, tls_session_t *ssn); +int tls_handshake_send(REQUEST *, tls_session_t *ssn); +void tls_session_information(tls_session_t *ssn); +void tls_session_id(SSL_SESSION *ssn, char *buffer, size_t bufsize); +X509_STORE *fr_init_x509_store(fr_tls_server_conf_t *conf); + +/* + * Low-level TLS stuff + */ +int tls_success(tls_session_t *ssn, REQUEST *request); +void tls_fail(tls_session_t *ssn); +fr_tls_status_t tls_ack_handler(tls_session_t *tls_session, REQUEST *request); +fr_tls_status_t tls_application_data(tls_session_t *ssn, REQUEST *request); + +#define FR_TLS_EX_INDEX_HANDLER (10) +#define FR_TLS_EX_INDEX_CONF (11) +#define FR_TLS_EX_INDEX_REQUEST (12) +#define FR_TLS_EX_INDEX_IDENTITY (13) +#define FR_TLS_EX_INDEX_STORE (14) +#define FR_TLS_EX_INDEX_SSN (15) +#define FR_TLS_EX_INDEX_TALLOC (16) +#define FR_TLS_EX_INDEX_FIX_CERT_ORDER (17) + +extern int fr_tls_ex_index_certs; +extern int fr_tls_ex_index_vps; + +/* configured values goes right here */ +struct fr_tls_server_conf_t { + SSL_CTX *ctx; + CONF_SECTION *cs; + + char const *private_key_password; + char const *private_key_file; + char const *certificate_file; + char const *random_file; + char const *ca_path; + char const *ca_file; + char const *dh_file; + char const *rsa_file; + uint32_t verify_depth; + bool file_type; + bool include_length; + bool auto_chain; + bool disable_single_dh_use; + bool disable_tlsv1; + bool disable_tlsv1_1; + bool disable_tlsv1_2; + bool disallow_untrusted; //!< allow untrusted CAs to issue client certificates + + int min_version; + int max_version; + + char const *tls_min_version; + char const *tls_max_version; + + /* + * Always < 4096 (due to radius limit), 0 by default = 1024 + */ + uint32_t fragment_size; + bool check_crl; + bool check_all_crl; + bool allow_expired_crl; + uint32_t ca_path_reload_interval; + uint32_t ca_path_last_reload; + X509_STORE *old_x509_store; + char const *check_cert_cn; + char const *cipher_list; + bool cipher_server_preference; + char const *check_cert_issuer; + char const *sigalgs_list; + + bool session_cache_enable; + uint32_t session_lifetime; + uint32_t session_cache_size; + char const *session_id_name; + char const *session_cache_path; + char const *session_cache_server; + fr_hash_table_t *cache_ht; + char session_context_id[SSL_MAX_SSL_SESSION_ID_LENGTH]; + + bool verify_skip_if_ocsp_ok; + char const *verify_tmp_dir; + char const *verify_client_cert_cmd; + bool require_client_cert; + + bool fix_cert_order; + + pthread_mutex_t mutex; + +#ifdef HAVE_OPENSSL_OCSP_H + /* + * OCSP Configuration + */ + bool ocsp_enable; + bool ocsp_override_url; + char const *ocsp_url; + bool ocsp_use_nonce; + X509_STORE *ocsp_store; + uint32_t ocsp_timeout; + bool ocsp_softfail; +#endif + +#if OPENSSL_VERSION_NUMBER >= 0x0090800fL +#ifndef OPENSSL_NO_ECDH + char const *ecdh_curve; +#endif +#endif + +#ifdef PSK_MAX_IDENTITY_LEN + char const *psk_identity; + char const *psk_password; + char const *psk_query; +#endif + + char const *realm_dir; + fr_hash_table_t *realms; + + char const *client_hostname; + +#ifdef WITH_RADIUSV11 + char const *radiusv11_name; + fr_radiusv11_t radiusv11; +#endif +}; + +#ifdef __cplusplus +} +#endif + +#endif /* WITH_TLS */ +#endif /* FR_TLS_H */ diff --git a/src/include/tmpl.h b/src/include/tmpl.h new file mode 100644 index 0000000..92884b1 --- /dev/null +++ b/src/include/tmpl.h @@ -0,0 +1,345 @@ +/* + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + */ +#ifndef TMPL_H +#define TMPL_H +/** + * $Id$ + * + * @file tmpl.h + * @brief Structures and prototypes for templates + * + * These functions are used to work with #vp_tmpl_t structs. + * + * #vp_tmpl_t (VPTs) specify either a data source, or a data sink. + * + * Examples of sources are #TMPL_TYPE_XLAT, #TMPL_TYPE_EXEC and #TMPL_TYPE_ATTR. + * Examples of sinks are #TMPL_TYPE_ATTR, #TMPL_TYPE_LIST. + * + * VPTs are used to gather values or attributes for evaluation, or copying, and to specify + * where values or #VALUE_PAIR should be copied to. + * + * To create new #vp_tmpl_t use one of the tmpl_*from_* functions. These parse + * strings into VPTs. The main parsing function is #tmpl_afrom_str, which can produce + * most types of VPTs. It uses the type of quoting (passed as an #FR_TOKEN) to determine + * what type of VPT to parse the string as. For example a #T_DOUBLE_QUOTED_STRING will + * produce either a #TMPL_TYPE_XLAT or a #TMPL_TYPE_LITERAL (depending if the string + * contained a non-literal expansion). + * + * @see tmpl_afrom_str + * @see tmpl_afrom_attr_str + * @see tmpl_from_attr_str + * @see tmpl_from_attr_substr + * + * In the case of #TMPL_TYPE_ATTR and #TMPL_TYPE_LIST, there are special cursor overlay + * functions which can be used to iterate over only the #VALUE_PAIR that match a + * vp_tmpl_t in a given list. + * + * @see tmpl_cursor_init + * @see tmpl_cursor_next + * + * Or for simplicity, there are functions which wrap the cursor functions, to copy or + * return the #VALUE_PAIR that match the VPT. + * + * @see tmpl_copy_vps + * @see tmpl_find_vp + * + * If you just need the string value of whatever the VPT refers to, the tmpl_*expand + * functions may be used. These functions evaluate the VPT, execing, and xlat expanding + * as necessary. In the case of #TMPL_TYPE_ATTR, and #PW_TYPE_STRING or #PW_TYPE_OCTETS + * #tmpl_expand will return a pointer to the raw #VALUE_PAIR buffer. This can be very + * useful when using the #PW_TYPE_TMPL type in #CONF_PARSER structs, as it allows the + * user to determine whether they want the module to sanitise the value using presentation + * format specific #xlat_escape_t function, or to operate on the raw value. + * + * @see tmpl_expand + * @see tmpl_aexpand + * + * @copyright 2014-2015 The FreeRADIUS server project + */ + +RCSIDH(tmpl_h, "$Id$") + +#include <freeradius-devel/xlat.h> + +#ifdef __cplusplus +extern "C" { +#endif +# +typedef enum pair_lists { + PAIR_LIST_UNKNOWN = 0, //!< Unknown list. + PAIR_LIST_REQUEST, //!< Attributes in incoming or internally proxied + ///< request. + PAIR_LIST_REPLY, //!< Attributes to send in the response. + PAIR_LIST_CONTROL, //!< Attributes that change the behaviour of + ///< modules. + PAIR_LIST_STATE, //!< Attributes to store multiple rounds of + ///< challenges/responses. +#ifdef WITH_PROXY + PAIR_LIST_PROXY_REQUEST, //!< A copy of attributes in the request list + ///< that may be modified in pre-proxy before + //!< proxying the request. + PAIR_LIST_PROXY_REPLY, //!< Attributes sent in response to the proxied + ///< request. +#endif +#ifdef WITH_COA + PAIR_LIST_COA, //!< Attributes to send in a forked CoA-Request. + PAIR_LIST_COA_REPLY, //!< Attributes sent in response to the forked + ///< CoA-Request. + PAIR_LIST_DM, //!< Attributes to send in a forked Disconnect-Request. + PAIR_LIST_DM_REPLY //!< Attributes sent in response to the forked + //!< Disconnect-Request. +#endif +} pair_lists_t; + +extern const FR_NAME_NUMBER pair_lists[]; + +typedef enum requests { + REQUEST_UNKNOWN = 0, //!< Unknown request. + REQUEST_OUTER, //!< #REQUEST containing the outer layer of the EAP + //!< conversation. Usually the RADIUS request sent + //!< by the NAS. + REQUEST_CURRENT, //!< The current request. + REQUEST_PARENT //!< Not currently used. +} request_refs_t; + +extern const FR_NAME_NUMBER request_refs[]; + +typedef struct pair_list { + char const *name; + VALUE_PAIR *check; + VALUE_PAIR *reply; + int order; /* for ordering! */ + int lineno; + struct pair_list *next; +} PAIR_LIST; + +/** Types of #vp_tmpl_t + */ +typedef enum tmpl_type { + TMPL_TYPE_UNKNOWN = 0, //!< Uninitialised. + TMPL_TYPE_LITERAL, //!< Literal string. + TMPL_TYPE_XLAT, //!< XLAT expansion. + TMPL_TYPE_ATTR, //!< Dictionary attribute. + TMPL_TYPE_ATTR_UNDEFINED, //!< Attribute not found in the global dictionary. + TMPL_TYPE_LIST, //!< Attribute list. + TMPL_TYPE_REGEX, //!< Regular expression. + TMPL_TYPE_EXEC, //!< Callout to an external script or program. + TMPL_TYPE_DATA, //!< Value in native format. + TMPL_TYPE_XLAT_STRUCT, //!< Pre-parsed XLAT expansion. + TMPL_TYPE_REGEX_STRUCT, //!< Pre-parsed regular expression. + TMPL_TYPE_NULL //!< Has no value. +} tmpl_type_t; + +extern const FR_NAME_NUMBER tmpl_names[]; + +/** Describes a #TMPL_TYPE_ATTR, #TMPL_TYPE_ATTR_UNDEFINED or #TMPL_TYPE_LIST + */ +typedef struct { + request_refs_t request; //!< Request to search or insert in. + pair_lists_t list; //!< List to search or insert in. + + DICT_ATTR const *da; //!< Resolved dictionary attribute. + union { + uint8_t da[DICT_ATTR_SIZE]; //!< Unknown dictionary attribute buffer. + char name[DICT_ATTR_SIZE]; //!< Raw unknown dictionary name. + } unknown; + int num; //!< For array references. + int8_t tag; //!< For tag references. +} value_pair_tmpl_attr_t; + +/** A source or sink of value data. + * + * Is used as both the RHS and LHS of a map (both update, and conditional types) + * + * @section update_maps Use in update vp_map_t + * When used on the LHS it describes an attribute to create and should be one of these types: + * - #TMPL_TYPE_ATTR + * - #TMPL_TYPE_LIST + * + * When used on the RHS it describes the value to assign to the attribute being created and + * should be one of these types: + * - #TMPL_TYPE_LITERAL + * - #TMPL_TYPE_XLAT + * - #TMPL_TYPE_ATTR + * - #TMPL_TYPE_LIST + * - #TMPL_TYPE_EXEC + * - #TMPL_TYPE_DATA + * - #TMPL_TYPE_XLAT_STRUCT (pre-parsed xlat) + * + * @section conditional_maps Use in conditional vp_map_t + * When used as part of a condition it may be any of the RHS side types, as well as: + * - #TMPL_TYPE_REGEX_STRUCT (pre-parsed regex) + * + * @see vp_map_t + */ +typedef struct vp_tmpl_t { + tmpl_type_t type; //!< What type of value tmpl refers to. + char const *name; //!< Original attribute ref string, or + //!< where this refers to a none FR + //!< attribute, just the string id for + //!< the attribute. + size_t len; //!< Name length. + char quote; //!< Quotation character for "name" + bool auto_converted; //!< Attr-26.9.1 --> Cisco-AVPair + +#ifdef HAVE_REGEX + bool iflag; //!< regex - case insensitive (if operand is used in regex comparison) + bool mflag; //!< regex - multiline flags (controls $ matching) +#endif + + union { + /* + * Attribute reference. Either an attribute currently in the request + * or an attribute to create. + */ + value_pair_tmpl_attr_t attribute; + + /* + * Attribute value. Typically used as the RHS of an update map. + */ + struct { + PW_TYPE type; //!< Type of data. + size_t length; //!< of the vpd data. + value_data_t data; //!< Value data. + } literal; + + xlat_exp_t *xlat; //!< pre-parsed xlat_exp_t + +#ifdef HAVE_REGEX + regex_t *preg; //!< pre-parsed regex_t +#endif + } data; +} vp_tmpl_t; + +/** @name Field accessors for #TMPL_TYPE_ATTR, #TMPL_TYPE_ATTR_UNDEFINED, #TMPL_TYPE_LIST + * + * @{ + */ +#define tmpl_request data.attribute.request +#define tmpl_list data.attribute.list +#define tmpl_da data.attribute.da +#define tmpl_unknown data.attribute.unknown.da +#define tmpl_unknown_name data.attribute.unknown.name +#define tmpl_num data.attribute.num +#define tmpl_tag data.attribute.tag +/* @} **/ + +/** @name Field accessors for #TMPL_TYPE_XLAT_STRUCT + * + * @{ + */ +#define tmpl_xlat data.xlat +/* @} **/ + +/** @name Field accessors for #TMPL_TYPE_DATA + * + * @{ + */ +#define tmpl_data data.literal +#define tmpl_data_type data.literal.type +#define tmpl_data_length data.literal.length +#define tmpl_data_value data.literal.data +/* @} **/ + +/** @name Field accessors for #TMPL_TYPE_REGEX_STRUCT and #TMPL_TYPE_REGEX + * + * @{ + */ +#ifdef HAVE_REGEX +# define tmpl_preg data.preg //!< #TMPL_TYPE_REGEX_STRUCT only. +# define tmpl_iflag iflag +# define tmpl_mflag mflag +#endif +/* @} **/ + +#ifndef WITH_VERIFY_PTR +# define VERIFY_TMPL(_x) +#else +# define VERIFY_TMPL(_x) tmpl_verify(__FILE__, __LINE__, _x) +void tmpl_verify(char const *file, int line, vp_tmpl_t const *vpt); +#endif + +VALUE_PAIR **radius_list(REQUEST *request, pair_lists_t list); + +RADIUS_PACKET *radius_packet(REQUEST *request, pair_lists_t list_name); + +TALLOC_CTX *radius_list_ctx(REQUEST *request, pair_lists_t list_name); + +size_t radius_list_name(pair_lists_t *out, char const *name, pair_lists_t default_list); + +int radius_request(REQUEST **request, request_refs_t name); + +size_t radius_request_name(request_refs_t *out, char const *name, request_refs_t unknown); + +vp_tmpl_t *tmpl_init(vp_tmpl_t *vpt, tmpl_type_t type, + char const *name, ssize_t len); + +vp_tmpl_t *tmpl_alloc(TALLOC_CTX *ctx, tmpl_type_t type, char const *name, + ssize_t len); + +ssize_t tmpl_from_attr_substr(vp_tmpl_t *vpt, char const *name, + request_refs_t request_def, pair_lists_t list_def, + bool allow_unknown, bool allow_undefined); + +ssize_t tmpl_from_attr_str(vp_tmpl_t *vpt, char const *name, + request_refs_t request_def, + pair_lists_t list_def, + bool allow_unknown, bool allow_undefined); + +ssize_t tmpl_afrom_attr_substr(TALLOC_CTX *ctx, vp_tmpl_t **out, char const *name, + request_refs_t request_def, pair_lists_t list_def, + bool allow_unknown, bool allow_undefined); + +ssize_t tmpl_afrom_attr_str(TALLOC_CTX *ctx, vp_tmpl_t **out, char const *name, + request_refs_t request_def, + pair_lists_t list_def, + bool allow_unknown, bool allow_undefined); + +ssize_t tmpl_afrom_str(TALLOC_CTX *ctx, vp_tmpl_t **out, char const *name, size_t inlen, + FR_TOKEN type, request_refs_t request_def, pair_lists_t list_def, bool do_escape); + +int tmpl_cast_in_place(vp_tmpl_t *vpt, PW_TYPE type, DICT_ATTR const *enumv); + +void tmpl_cast_in_place_str(vp_tmpl_t *vpt); + +int tmpl_cast_to_vp(VALUE_PAIR **out, REQUEST *request, + vp_tmpl_t const *vpt, DICT_ATTR const *cast); + +size_t tmpl_prints(char *buffer, size_t bufsize, vp_tmpl_t const *vpt, + DICT_ATTR const *values); + +ssize_t tmpl_expand(char const **out, char *buff, size_t outlen, REQUEST *request, + vp_tmpl_t const *vpt, xlat_escape_t escape, void *escape_ctx); + +ssize_t tmpl_aexpand(TALLOC_CTX *ctx, char **out, REQUEST *request, vp_tmpl_t const *vpt, + xlat_escape_t escape, void *escape_ctx); + +VALUE_PAIR *tmpl_cursor_init(int *err, vp_cursor_t *cursor, REQUEST *request, + vp_tmpl_t const *vpt); + +VALUE_PAIR *tmpl_cursor_next(vp_cursor_t *cursor, vp_tmpl_t const *vpt); + +int tmpl_copy_vps(TALLOC_CTX *ctx, VALUE_PAIR **out, REQUEST *request, + vp_tmpl_t const *vpt); + +int tmpl_find_vp(VALUE_PAIR **out, REQUEST *request, vp_tmpl_t const *vpt); + +int tmpl_define_unknown_attr(vp_tmpl_t *vpt); + +#ifdef __cplusplus +} +#endif +#endif /* TMPL_H */ diff --git a/src/include/token.h b/src/include/token.h new file mode 100644 index 0000000..c8bb748 --- /dev/null +++ b/src/include/token.h @@ -0,0 +1,95 @@ +/* + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + */ +#ifndef FR_TOKEN_H +#define FR_TOKEN_H + +/** + * $Id$ + * + * @file token.h + * @brief Tokenisation code and constants. + * + * @copyright 2001,2006 The FreeRADIUS server project + */ + +RCSIDH(token_h, "$Id$") + +#ifdef __cplusplus +extern "C" { +#endif + +typedef enum fr_token_t { + T_INVALID = 0, /* invalid token */ + T_EOL, /* end of line */ + T_LCBRACE, /* { */ + T_RCBRACE, /* } */ + T_LBRACE, /* ( */ + T_RBRACE, /* ) 5 */ + T_COMMA, /* , */ + T_SEMICOLON, /* ; */ + + T_OP_INCRM, /* ++ */ + T_OP_ADD, /* += */ + T_OP_SUB, /* -= 10 */ + T_OP_SET, /* := */ + T_OP_EQ, /* = */ + T_OP_NE, /* != */ + T_OP_GE, /* >= */ + T_OP_GT, /* > 15 */ + T_OP_LE, /* <= */ + T_OP_LT, /* < */ + T_OP_REG_EQ, /* =~ */ + T_OP_REG_NE, /* !~ */ + T_OP_CMP_TRUE, /* =* 20 */ + T_OP_CMP_FALSE, /* !* */ + T_OP_CMP_EQ, /* == */ + T_OP_PREPEND, /* ^= */ + T_HASH, /* # */ + T_BARE_WORD, /* bare word 25 */ + T_DOUBLE_QUOTED_STRING, /* "foo" */ + T_SINGLE_QUOTED_STRING, /* 'foo' */ + T_BACK_QUOTED_STRING, /* `foo` */ + T_TOKEN_LAST +} FR_TOKEN; + +#define T_EQSTART T_OP_ADD +#define T_EQEND (T_OP_PREPEND + 1) + +typedef struct FR_NAME_NUMBER { + char const *name; + int number; +} FR_NAME_NUMBER; + +extern const FR_NAME_NUMBER fr_tokens[]; +extern const bool fr_assignment_op[]; +extern const bool fr_equality_op[]; +extern const bool fr_str_tok[]; + +int fr_str2int(FR_NAME_NUMBER const *table, char const *name, int def); +int fr_substr2int(FR_NAME_NUMBER const *table, char const *name, int def, int len); +char const *fr_int2str(FR_NAME_NUMBER const *table, int number, char const *def); + +int getword (char const **ptr, char *buf, int buflen, bool unescape); +FR_TOKEN gettoken(char const **ptr, char *buf, int buflen, bool unescape); +FR_TOKEN getop(char const **ptr); +FR_TOKEN getstring(char const **ptr, char *buf, int buflen, bool unescape); +char const *fr_token_name(int); + +#ifdef __cplusplus +} +#endif + +#endif /* FR_TOKEN_H */ diff --git a/src/include/udpfromto.h b/src/include/udpfromto.h new file mode 100644 index 0000000..7b029cd --- /dev/null +++ b/src/include/udpfromto.h @@ -0,0 +1,31 @@ +#ifndef UDPFROMTO_H +#define UDPFROMTO_H +/* + * $Id$ + * + * @file udpfromto.h + */ + +RCSIDH(udpfromtoh, "$Id$") + +#include <freeradius-devel/libradius.h> + +#ifdef __cplusplus +extern "C" { +#endif + +#ifdef WITH_UDPFROMTO +int udpfromto_init(int s); +int recvfromto(int s, void *buf, size_t len, int flags, + struct sockaddr *from, socklen_t *fromlen, + struct sockaddr *to, socklen_t *tolen); +int sendfromto(int s, void *buf, size_t len, int flags, + struct sockaddr *from, socklen_t fromlen, + struct sockaddr *to, socklen_t tolen); +#endif + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/src/include/xlat.h b/src/include/xlat.h new file mode 100644 index 0000000..535dd81 --- /dev/null +++ b/src/include/xlat.h @@ -0,0 +1,71 @@ +/* + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + */ +#ifndef XLAT_H +#define XLAT_H + +/** + * $Id$ + * + * @file xlat.h + * @brief Structures and prototypes for templates + * + * @copyright 2015 The FreeRADIUS server project + */ + +RCSIDH(xlat_h, "$Id$") + +#ifdef __cplusplus +extern "C" { +#endif + +#include <freeradius-devel/conffile.h> + +typedef struct xlat_exp xlat_exp_t; + +typedef size_t (*xlat_escape_t)(REQUEST *, char *out, size_t outlen, char const *in, void *arg); +typedef ssize_t (*xlat_func_t)(void *instance, REQUEST *, char const *, char *, size_t); + +ssize_t radius_xlat(char *out, size_t outlen, REQUEST *request, char const *fmt, xlat_escape_t escape, + void *escape_ctx) + CC_HINT(nonnull (1 ,3 ,4)); + +ssize_t radius_xlat_struct(char *out, size_t outlen, REQUEST *request, xlat_exp_t const *xlat, + xlat_escape_t escape, void *ctx) + CC_HINT(nonnull (1 ,3 ,4)); + +ssize_t radius_axlat(char **out, REQUEST *request, char const *fmt, xlat_escape_t escape, void *escape_ctx) + CC_HINT(nonnull (1, 2, 3)); + +ssize_t radius_axlat_struct(char **out, REQUEST *request, xlat_exp_t const *xlat, xlat_escape_t escape, + void *ctx) + CC_HINT(nonnull (1, 2, 3)); + +ssize_t xlat_tokenize(TALLOC_CTX *ctx, char *fmt, xlat_exp_t **head, char const **error); + +size_t xlat_sprint(char *buffer, size_t bufsize, xlat_exp_t const *node); + +int xlat_register(char const *module, xlat_func_t func, xlat_escape_t escape, + void *instance); +void xlat_unregister(char const *module, xlat_func_t func, void *instance); +void xlat_unregister_module(void *instance); +bool xlat_register_redundant(CONF_SECTION *cs); +ssize_t xlat_fmt_to_ref(uint8_t const **out, REQUEST *request, char const *fmt); +void xlat_free(void); + +#ifdef __cplusplus +} +#endif +#endif /* TMPL_H */ |