From 42da8c69631787acd53e60e9f1a16f304fb47b7d Mon Sep 17 00:00:00 2001 From: venaas Date: Mon, 2 Jun 2008 13:11:11 +0000 Subject: cleaned up the initial dynamic server discovery code a bit git-svn-id: https://svn.testnett.uninett.no/radsecproxy/trunk@269 e88ac4ed-0b26-0410-9574-a7f39faa03bf --- radsecproxy.c | 419 +++++++++++++++++++++++++++------------------------------- radsecproxy.h | 7 +- 2 files changed, 198 insertions(+), 228 deletions(-) diff --git a/radsecproxy.c b/radsecproxy.c index f4b330a..e430054 100644 --- a/radsecproxy.c +++ b/radsecproxy.c @@ -81,8 +81,7 @@ extern char *optarg; /* minimum required declarations to avoid reordering code */ void adddynamicrealmserver(struct realm *realm, struct clsrvconf *conf, char *id); void dynamicconfig(struct server *server); -int addmatchcertattr(struct clsrvconf *conf, char *matchcertattr); -struct rewrite *getrewrite(char *alt1, char *alt2); +int confserver_cb(struct gconffile **cf, void *arg, char *block, char *opt, char *val); /* callbacks for making OpenSSL thread safe */ unsigned long ssl_thread_id() { @@ -2646,25 +2645,9 @@ void tlsadd(char *value, char *cacertfile, char *cacertpath, char *certfile, cha if (!new->name) debugx(1, DBG_ERR, "malloc failed"); new->ctx = ctx; - new->count = 0; debug(DBG_DBG, "tlsadd: added TLS context %s", value); } -void tlsfree() { - struct list_node *entry; - struct tls *t; - - for (entry = list_first(tlsconfs); entry; entry = list_next(entry)) { - t = (struct tls *)entry->data; - if (t->name) - free(t->name); - if (!t->count) - SSL_CTX_free(t->ctx); - } - list_destroy(tlsconfs); - tlsconfs = NULL; -} - SSL_CTX *tlsgetctx(char *alt1, char *alt2) { struct list_node *entry; struct tls *t, *t1 = NULL, *t2 = NULL; @@ -2682,7 +2665,6 @@ SSL_CTX *tlsgetctx(char *alt1, char *alt2) { t = (t1 ? t1 : t2); if (!t) return NULL; - t->count++; return t->ctx; } @@ -2913,126 +2895,6 @@ void adddynamicrealmserver(struct realm *realm, struct clsrvconf *conf, char *id pthread_mutex_unlock(&realm->subrealms_mutex); } -void freeclsrvconf(struct clsrvconf *conf) { - free(conf->name); - free(conf->host); - free(conf->port); - free(conf->secret); - if (conf->certcnregex) - regfree(conf->certcnregex); - if (conf->certuriregex) - regfree(conf->certuriregex); - if (conf->rewriteattrregex) - regfree(conf->rewriteattrregex); - free(conf->rewriteattrreplacement); - free(conf->dynamiclookupcommand); - if (conf->ssl_ctx) - SSL_CTX_free(conf->ssl_ctx); - free(conf->rewrite); - if (conf->addrinfo) - freeaddrinfo(conf->addrinfo); - list_destroy(conf->clients); - free(conf->servers); - free(conf); -} - -int dynconfserver_cb(struct gconffile **cf, void *arg, char *block, char *opt, char *val) { - char *type = NULL, *tls = NULL, *matchcertattr = NULL, *rewrite = NULL; - struct clsrvconf *conf, *resconf; - - debug(DBG_DBG, "dynconfserver_cb called for %s", block); - - conf = malloc(sizeof(struct clsrvconf)); - if (!conf) { - debug(DBG_ERR, "malloc failed"); - return 0; - } - memset(conf, 0, sizeof(struct clsrvconf)); - - resconf = (struct clsrvconf *)arg; - conf->statusserver = resconf->statusserver; - conf->certnamecheck = resconf->certnamecheck; - - if (!getgenericconfig(cf, block, - "type", CONF_STR, &type, - "host", CONF_STR, &conf->host, - "port", CONF_STR, &conf->port, - "secret", CONF_STR, &conf->secret, - "tls", CONF_STR, &tls, - "MatchCertificateAttribute", CONF_STR, &matchcertattr, - "rewrite", CONF_STR, &rewrite, - "StatusServer", CONF_BLN, &conf->statusserver, - "CertificateNameCheck", CONF_BLN, &conf->certnamecheck, - NULL - )) { - free(type); - freeclsrvconf(conf); - debug(DBG_ERR, "configuration error"); - return 0; - } - - if (type && strcasecmp(type, "tls")) { - free(type); - freeclsrvconf(conf); - debug(DBG_ERR, "Only type TLS supported for dynamic servers for now"); - return 0; - } - - /* need to handle possible stringcopy() failure */ - conf->name = stringcopy(val, 0); - if (!conf->host) - conf->host = stringcopy(val, 0); - resconf->name = conf->name; - /* ignoring type, leaving as T */ - free(type); - resconf->host = conf->host; - resconf->port = conf->port ? conf->port : stringcopy(resconf->port, 0); - resconf->secret = conf->secret ? conf->secret : stringcopy(resconf->secret, 0); - - if (tls) { - if (resconf->ssl_ctx) - SSL_CTX_free(resconf->ssl_ctx); - resconf->ssl_ctx = tlsgetctx(tls, NULL); - free(tls); - if (!resconf->ssl_ctx) { - debug(DBG_ERR, "error in block %s, no tls context defined", block); - free(matchcertattr); - free(rewrite); - free(conf); - return 0; - } - } - if (matchcertattr) { - if (resconf->certcnregex) - regfree(resconf->certcnregex); - if (resconf->certuriregex) - regfree(resconf->certuriregex); - if (!addmatchcertattr(resconf, matchcertattr)) { - debug(DBG_ERR, "error in block %s, invalid MatchCertificateAttributeValue", block); - free(matchcertattr); - free(rewrite); - free(conf); - return 0; - } - free(matchcertattr); - } - - if (rewrite) { - free(resconf->rewrite); - resconf->rewrite = getrewrite(rewrite, NULL); - free(rewrite); - } - - resconf->statusserver = conf->statusserver; - resconf->certnamecheck = conf->certnamecheck; - if (resconf->addrinfo) { - freeaddrinfo(resconf->addrinfo); - resconf->addrinfo = NULL; - } - free(conf); - return 1; -} - void dynamicconfig(struct server *server) { int ok, fd[2]; pid_t pid; @@ -3065,7 +2927,7 @@ void dynamicconfig(struct server *server) { close(fd[1]); pushgconffile(&cf, fdopen(fd[0], "r"), conf->dynamiclookupcommand); ok = getgenericconfig(&cf, NULL, - "Server", CONF_CBK, dynconfserver_cb, (void *)conf, + "Server", CONF_CBK, confserver_cb, (void *)conf, NULL ); freegconf(&cf); @@ -3083,16 +2945,16 @@ void dynamicconfig(struct server *server) { debug(DBG_WARN, "dynamicconfig: failed to obtain dynamic server config"); } -int addmatchcertattr(struct clsrvconf *conf, char *matchcertattr) { +int addmatchcertattr(struct clsrvconf *conf) { char *v; regex_t **r; - if (!strncasecmp(matchcertattr, "CN:/", 4)) { + if (!strncasecmp(conf->matchcertattr, "CN:/", 4)) { r = &conf->certcnregex; - v = matchcertattr + 4; - } else if (!strncasecmp(matchcertattr, "SubjectAltName:URI:/", 20)) { + v = conf->matchcertattr + 4; + } else if (!strncasecmp(conf->matchcertattr, "SubjectAltName:URI:/", 20)) { r = &conf->certuriregex; - v = matchcertattr + 20; + v = conf->matchcertattr + 20; } else return 0; if (!*v) @@ -3117,11 +2979,11 @@ int addmatchcertattr(struct clsrvconf *conf, char *matchcertattr) { return 1; } -int addrewriteattr(struct clsrvconf *conf, char *rewriteattr) { +int addrewriteattr(struct clsrvconf *conf) { char *v, *w; - v = rewriteattr + 11; - if (strncasecmp(rewriteattr, "User-Name:/", 11) || !*v) + v = conf->rewriteattr + 11; + if (strncasecmp(conf->rewriteattr, "User-Name:/", 11) || !*v) return 0; /* regexp, remove optional trailing / if present */ if (v[strlen(v) - 1] == '/') @@ -3180,21 +3042,6 @@ int vattrname2val(char *attrname, uint32_t *vendor, uint32_t *type) { return *type >= 0 && *type < 256; } -void rewritefree() { - struct list_node *entry; - struct rewriteconf *r; - - for (entry = list_first(rewriteconfs); entry; entry = list_next(entry)) { - r = (struct rewriteconf *)entry->data; - if (r->name) - free(r->name); - if (!r->count) - free(r->rewrite); - } - list_destroy(rewriteconfs); - rewriteconfs = NULL; -} - struct rewrite *getrewrite(char *alt1, char *alt2) { struct list_node *entry; struct rewriteconf *r, *r1 = NULL, *r2 = NULL; @@ -3212,7 +3059,6 @@ struct rewrite *getrewrite(char *alt1, char *alt2) { r = (r1 ? r1 : r2); if (!r) return NULL; - r->count++; return r->rewrite; } @@ -3276,8 +3122,70 @@ void addrewrite(char *value, char **attrs, char **vattrs) { debug(DBG_DBG, "addrewrite: added rewrite block %s", value); } +void freeclsrvconf(struct clsrvconf *conf) { + free(conf->name); + free(conf->conftype); + free(conf->host); + free(conf->port); + free(conf->secret); + free(conf->tls); + free(conf->matchcertattr); + if (conf->certcnregex) + regfree(conf->certcnregex); + if (conf->certuriregex) + regfree(conf->certuriregex); + free(conf->confrewrite); + free(conf->rewriteattr); + if (conf->rewriteattrregex) + regfree(conf->rewriteattrregex); + free(conf->rewriteattrreplacement); + free(conf->dynamiclookupcommand); + if (conf->ssl_ctx) + SSL_CTX_free(conf->ssl_ctx); + free(conf->rewrite); + if (conf->addrinfo) + freeaddrinfo(conf->addrinfo); + list_destroy(conf->clients); + free(conf->servers); + free(conf); +} + +int mergeconfstring(char **dst, char **src) { + char *t; + + if (*src) { + *dst = *src; + *src = NULL; + return 1; + } + if (*dst) { + t = stringcopy(*dst, 0); + if (!t) { + debug(DBG_ERR, "malloc failed"); + return 0; + } + *dst = t; + } + return 1; +} + +/* assumes dst is a shallow copy */ +int mergesrvconf(struct clsrvconf *dst, struct clsrvconf *src) { + if (!mergeconfstring(&dst->name, &src->name) || + !mergeconfstring(&dst->conftype, &src->conftype) || + !mergeconfstring(&dst->host, &src->host) || + !mergeconfstring(&dst->port, &src->port) || + !mergeconfstring(&dst->secret, &src->secret) || + !mergeconfstring(&dst->tls, &src->tls) || + !mergeconfstring(&dst->matchcertattr, &src->matchcertattr) || + !mergeconfstring(&dst->confrewrite, &src->confrewrite)) + return 0; + dst->statusserver = src->statusserver; + dst->certnamecheck = src->certnamecheck; + return 1; +} + int confclient_cb(struct gconffile **cf, void *arg, char *block, char *opt, char *val) { - char *type = NULL, *tls = NULL, *matchcertattr = NULL, *rewrite = NULL, *rewriteattr = NULL; struct clsrvconf *conf; debug(DBG_DBG, "confclient_cb called for %s", block); @@ -3289,14 +3197,14 @@ int confclient_cb(struct gconffile **cf, void *arg, char *block, char *opt, char conf->certnamecheck = 1; if (!getgenericconfig(cf, block, - "type", CONF_STR, &type, + "type", CONF_STR, &conf->conftype, "host", CONF_STR, &conf->host, "secret", CONF_STR, &conf->secret, - "tls", CONF_STR, &tls, - "matchcertificateattribute", CONF_STR, &matchcertattr, + "tls", CONF_STR, &conf->tls, + "matchcertificateattribute", CONF_STR, &conf->matchcertattr, "CertificateNameCheck", CONF_BLN, &conf->certnamecheck, - "rewrite", CONF_STR, &rewrite, - "rewriteattribute", CONF_STR, &rewriteattr, + "rewrite", CONF_STR, &conf->confrewrite, + "rewriteattribute", CONF_STR, &conf->rewriteattr, NULL )) debugx(1, DBG_ERR, "configuration error"); @@ -3305,31 +3213,25 @@ int confclient_cb(struct gconffile **cf, void *arg, char *block, char *opt, char if (!conf->host) conf->host = stringcopy(val, 0); - if (type && !strcasecmp(type, "udp")) { + if (conf->conftype && !strcasecmp(conf->conftype, "udp")) { conf->type = 'U'; client_udp_count++; - } else if (type && !strcasecmp(type, "tls")) { - conf->ssl_ctx = tls ? tlsgetctx(tls, NULL) : tlsgetctx("defaultclient", "default"); + } else if (conf->conftype && !strcasecmp(conf->conftype, "tls")) { + conf->ssl_ctx = conf->tls ? tlsgetctx(conf->tls, NULL) : tlsgetctx("defaultclient", "default"); if (!conf->ssl_ctx) debugx(1, DBG_ERR, "error in block %s, no tls context defined", block); - if (matchcertattr && !addmatchcertattr(conf, matchcertattr)) + if (conf->matchcertattr && !addmatchcertattr(conf)) debugx(1, DBG_ERR, "error in block %s, invalid MatchCertificateAttributeValue", block); conf->type = 'T'; client_tls_count++; } else debugx(1, DBG_ERR, "error in block %s, type must be set to UDP or TLS", block); - free(type); - if (tls) - free(tls); - if (matchcertattr) - free(matchcertattr); - conf->rewrite = rewrite ? getrewrite(rewrite, NULL) : getrewrite("defaultclient", "default"); + conf->rewrite = conf->confrewrite ? getrewrite(conf->confrewrite, NULL) : getrewrite("defaultclient", "default"); - if (rewriteattr) { - if (!addrewriteattr(conf, rewriteattr)) + if (conf->rewriteattr) { + if (!addrewriteattr(conf)) debugx(1, DBG_ERR, "error in block %s, invalid RewriteAttributeValue", block); - free(rewriteattr); } if (!resolvepeer(conf, 0)) @@ -3343,71 +3245,138 @@ int confclient_cb(struct gconffile **cf, void *arg, char *block, char *opt, char return 1; } +int compileserverconfig(struct clsrvconf *conf, const char *block) { + switch (conf->type) { + case 'U': + if (!conf->port) + conf->port = stringcopy(DEFAULT_UDP_PORT, 0); + break; + case 'T': + conf->ssl_ctx = conf->tls ? tlsgetctx(conf->tls, NULL) : tlsgetctx("defaultserver", "default"); + if (!conf->ssl_ctx) { + debug(DBG_ERR, "error in block %s, no tls context defined", block); + return 0; + } + if (conf->matchcertattr && !addmatchcertattr(conf)) { + debug(DBG_ERR, "error in block %s, invalid MatchCertificateAttributeValue", block); + return 0; + } + if (!conf->port) + conf->port = stringcopy(DEFAULT_TLS_PORT, 0); + break; + } + + conf->rewrite = conf->confrewrite ? getrewrite(conf->confrewrite, NULL) : getrewrite("defaultserver", "default"); + + if (!conf->secret) { + if (conf->type == 'U') + debug(DBG_ERR, "error in block %s, secret must be specified for UDP", block); + conf->secret = stringcopy(DEFAULT_TLS_SECRET, 0); + if (!conf->secret) { + debug(DBG_ERR, "malloc failed"); + return 0; + } + } + + if (!conf->dynamiclookupcommand && !resolvepeer(conf, 0)) { + debug(DBG_ERR, "failed to resolve host %s port %s, exiting", conf->host ? conf->host : "(null)", conf->port ? conf->port : "(null)"); + return 0; + } + return 1; +} + int confserver_cb(struct gconffile **cf, void *arg, char *block, char *opt, char *val) { - char *type = NULL, *tls = NULL, *matchcertattr = NULL, *rewrite = NULL; - struct clsrvconf *conf; + struct clsrvconf *conf, *resconf; debug(DBG_DBG, "confserver_cb called for %s", block); conf = malloc(sizeof(struct clsrvconf)); - if (!conf || !list_push(srvconfs, conf)) - debugx(1, DBG_ERR, "malloc failed"); + if (!conf) { + debug(DBG_ERR, "malloc failed"); + return 0; + } memset(conf, 0, sizeof(struct clsrvconf)); - conf->certnamecheck = 1; + resconf = (struct clsrvconf *)arg; + if (resconf) { + conf->statusserver = resconf->statusserver; + conf->certnamecheck = resconf->certnamecheck; + } else + conf->certnamecheck = 1; if (!getgenericconfig(cf, block, - "type", CONF_STR, &type, + "type", CONF_STR, &conf->conftype, "host", CONF_STR, &conf->host, "port", CONF_STR, &conf->port, "secret", CONF_STR, &conf->secret, - "tls", CONF_STR, &tls, - "MatchCertificateAttribute", CONF_STR, &matchcertattr, - "rewrite", CONF_STR, &rewrite, + "tls", CONF_STR, &conf->tls, + "MatchCertificateAttribute", CONF_STR, &conf->matchcertattr, + "rewrite", CONF_STR, &conf->confrewrite, "StatusServer", CONF_BLN, &conf->statusserver, "CertificateNameCheck", CONF_BLN, &conf->certnamecheck, "DynamicLookupCommand", CONF_STR, &conf->dynamiclookupcommand, NULL - )) - debugx(1, DBG_ERR, "configuration error"); - + )) { + debug(DBG_ERR, "configuration error"); + goto errexit; + } + conf->name = stringcopy(val, 0); - if (!conf->host) + if (!conf->name) { + debug(DBG_ERR, "malloc failed"); + goto errexit; + } + if (!conf->host) { conf->host = stringcopy(val, 0); - - if (type && !strcasecmp(type, "udp")) { + if (!conf->host) { + debug(DBG_ERR, "malloc failed"); + goto errexit; + } + } + + if (resconf) { + if (!mergesrvconf(resconf, conf)) + goto errexit; + free(conf); + conf = resconf; + } + + if (conf->conftype && !strcasecmp(conf->conftype, "udp")) conf->type = 'U'; - server_udp_count++; - if (!conf->port) - conf->port = stringcopy(DEFAULT_UDP_PORT, 0); - } else if (type && !strcasecmp(type, "tls")) { - conf->ssl_ctx = tls ? tlsgetctx(tls, NULL) : tlsgetctx("defaultserver", "default"); - if (!conf->ssl_ctx) - debugx(1, DBG_ERR, "error in block %s, no tls context defined", block); - if (matchcertattr && !addmatchcertattr(conf, matchcertattr)) - debugx(1, DBG_ERR, "error in block %s, invalid MatchCertificateAttributeValue", block); - if (!conf->port) - conf->port = stringcopy(DEFAULT_TLS_PORT, 0); + else if (conf->conftype && !strcasecmp(conf->conftype, "tls")) conf->type = 'T'; - server_tls_count++; - } else - debugx(1, DBG_ERR, "error in block %s, type must be set to UDP or TLS", block); - free(type); - if (tls) - free(tls); - if (matchcertattr) - free(matchcertattr); + else { + debug(DBG_ERR, "error in block %s, type must be set to UDP or TLS", block); + goto errexit; + } - conf->rewrite = rewrite ? getrewrite(rewrite, NULL) : getrewrite("defaultserver", "default"); + if (resconf || !conf->dynamiclookupcommand) { + if (!compileserverconfig(conf, block)) + goto errexit; + } - if (!conf->dynamiclookupcommand && !resolvepeer(conf, 0)) - debugx(1, DBG_ERR, "failed to resolve host %s port %s, exiting", conf->host ? conf->host : "(null)", conf->port ? conf->port : "(null)"); + if (resconf) + return 1; + + switch (conf->type) { + case 'U': + server_udp_count++; + break; + case 'T': + server_tls_count++; + break; + default: + goto errexit; + } - if (!conf->secret) { - if (conf->type == 'U') - debugx(1, DBG_ERR, "error in block %s, secret must be specified for UDP", block); - conf->secret = stringcopy(DEFAULT_TLS_SECRET, 0); + if (!list_push(srvconfs, conf)) { + debug(DBG_ERR, "malloc failed"); + goto errexit; } return 1; + + errexit: + freeclsrvconf(conf); + return 0; } int confrealm_cb(struct gconffile **cf, void *arg, char *block, char *opt, char *val) { @@ -3509,8 +3478,6 @@ void getmainconfig(const char *configfile) { NULL )) debugx(1, DBG_ERR, "configuration error"); - tlsfree(); - rewritefree(); if (loglevel) { if (strlen(loglevel) != 1 || *loglevel < '1' || *loglevel > '4') diff --git a/radsecproxy.h b/radsecproxy.h index 71b17bd..ca114c8 100644 --- a/radsecproxy.h +++ b/radsecproxy.h @@ -75,12 +75,17 @@ struct replyq { struct clsrvconf { char *name; + char *conftype; char type; /* U for UDP, T for TLS */ char *host; char *port; char *secret; + char *tls; + char *matchcertattr; regex_t *certcnregex; regex_t *certuriregex; + char *confrewrite; + char *rewriteattr; regex_t *rewriteattrregex; char *rewriteattrreplacement; char *dynamiclookupcommand; @@ -130,7 +135,6 @@ struct realm { struct tls { char *name; SSL_CTX *ctx; - int count; }; struct rewrite { @@ -141,7 +145,6 @@ struct rewrite { struct rewriteconf { char *name; struct rewrite *rewrite; - int count; }; #define RADLEN(x) ntohs(((uint16_t *)(x))[1]) -- cgit v1.1