50 |
VALUE_PAIR *list); |
VALUE_PAIR *list); |
51 |
static int pass1(struct check_datum *datum, User_symbol *sym); |
static int pass1(struct check_datum *datum, User_symbol *sym); |
52 |
static int pass2(struct check_datum *datum, User_symbol *sym); |
static int pass2(struct check_datum *datum, User_symbol *sym); |
53 |
static void check_dup_attr(VALUE_PAIR **prev, VALUE_PAIR *ptr, int line); |
static void check_dup_attr(VALUE_PAIR **prev, VALUE_PAIR *ptr, LOCUS *loc); |
54 |
|
|
55 |
|
|
56 |
int |
int |
78 |
User_symbol *target = (User_symbol*)sym_lookup(datum->symtab, target_name); |
User_symbol *target = (User_symbol*)sym_lookup(datum->symtab, target_name); |
79 |
|
|
80 |
if (!target) { |
if (!target) { |
81 |
radlog(L_ERR, |
radlog_loc(L_ERR, &sym->loc, |
82 |
_("users:%d: Match-Profile refers to non-existing profile (%s)"), |
_("Match-Profile refers to non-existing profile (%s)"), |
83 |
sym->lineno, target_name); |
target_name); |
84 |
return; |
return; |
85 |
} |
} |
86 |
|
|
125 |
pass1(struct check_datum *datum, User_symbol *sym) |
pass1(struct check_datum *datum, User_symbol *sym) |
126 |
{ |
{ |
127 |
if (compile_pairs(sym->reply)) { |
if (compile_pairs(sym->reply)) { |
128 |
radlog(L_ERR, |
radlog_loc(L_ERR, &sym->loc, |
129 |
_("users:%d: discarding entry %s"), |
_("discarding entry %s"), |
130 |
sym->lineno, sym->name); |
sym->name); |
131 |
symtab_delete(datum->symtab, (Symbol *)sym); |
symtab_delete(datum->symtab, (Symbol *)sym); |
132 |
datum->count--; |
datum->count--; |
133 |
} |
} |
134 |
|
|
135 |
mark_list(datum, sym, sym->check); |
mark_list(datum, sym, sym->check); |
136 |
mark_list(datum, sym, sym->reply); |
mark_list(datum, sym, sym->reply); |
137 |
return 0; |
return 0; |
141 |
pass2(struct check_datum *datum, User_symbol *sym) |
pass2(struct check_datum *datum, User_symbol *sym) |
142 |
{ |
{ |
143 |
if (radck_bitisset(datum->r, datum->rlen, sym->ordnum, sym->ordnum)) { |
if (radck_bitisset(datum->r, datum->rlen, sym->ordnum, sym->ordnum)) { |
144 |
radlog(L_ERR, |
radlog_loc(L_ERR, &sym->loc, |
145 |
_("users:%d: circular dependency for %s"), |
_("circular dependency for %s"), |
146 |
sym->lineno, sym->name); |
sym->name); |
147 |
symtab_delete(datum->symtab, (Symbol *)sym); |
symtab_delete(datum->symtab, (Symbol *)sym); |
148 |
datum->count--; |
datum->count--; |
149 |
} |
} |
197 |
radlog(L_ERR, _("USER LIST IS EMPTY")); |
radlog(L_ERR, _("USER LIST IS EMPTY")); |
198 |
} |
} |
199 |
|
|
200 |
void |
static void |
201 |
check_dup_attr(VALUE_PAIR **prev, VALUE_PAIR *ptr, int line) |
check_dup_attr(VALUE_PAIR **prev, VALUE_PAIR *ptr, LOCUS *loc) |
202 |
{ |
{ |
203 |
if (*prev) { |
if (*prev) { |
204 |
radlog(L_WARN, |
radlog_loc(L_WARN, loc, |
205 |
_("users:%d: duplicate %s attribute"), |
_("duplicate %s attribute"), ptr->name); |
|
line, ptr->name); |
|
206 |
} else |
} else |
207 |
*prev = ptr; |
*prev = ptr; |
208 |
} |
} |
209 |
|
|
210 |
/*ARGSUSED*/ |
/*ARGSUSED*/ |
211 |
int |
int |
212 |
fix_check_pairs(int cf_file, char *filename, int line, char *name, |
fix_check_pairs(int cf_file, LOCUS *loc, char *name, VALUE_PAIR **pairs) |
|
VALUE_PAIR **pairs) |
|
213 |
{ |
{ |
214 |
VALUE_PAIR *p; |
VALUE_PAIR *p; |
215 |
VALUE_PAIR *auth_type = NULL; |
VALUE_PAIR *auth_type = NULL; |
227 |
dict = attr_number_to_dict(p->attribute); |
dict = attr_number_to_dict(p->attribute); |
228 |
if (dict) { |
if (dict) { |
229 |
if (!(dict->prop & AF_LHS(cf_file))) { |
if (!(dict->prop & AF_LHS(cf_file))) { |
230 |
radlog(L_ERR, |
radlog_loc(L_ERR, loc, |
231 |
_("%s:%d: attribute %s not allowed in LHS"), |
_("attribute %s not allowed in LHS"), |
232 |
filename, line, dict->name); |
dict->name); |
233 |
errcnt++; |
errcnt++; |
234 |
continue; |
continue; |
235 |
} |
} |
238 |
/* Specific attribute checks */ |
/* Specific attribute checks */ |
239 |
switch (p->attribute) { |
switch (p->attribute) { |
240 |
case DA_AUTH_TYPE: |
case DA_AUTH_TYPE: |
241 |
check_dup_attr(&auth_type, p, line); |
check_dup_attr(&auth_type, p, loc); |
242 |
break; |
break; |
243 |
|
|
244 |
case DA_AUTH_DATA: |
case DA_AUTH_DATA: |
245 |
check_dup_attr(&auth_data, p, line); |
check_dup_attr(&auth_data, p, loc); |
246 |
break; |
break; |
247 |
|
|
248 |
case DA_PAM_AUTH: |
case DA_PAM_AUTH: |
249 |
check_dup_attr(&pam_auth, p, line); |
check_dup_attr(&pam_auth, p, loc); |
250 |
break; |
break; |
251 |
|
|
252 |
case DA_USER_PASSWORD: |
case DA_USER_PASSWORD: |
253 |
check_dup_attr(&password, p, line); |
check_dup_attr(&password, p, loc); |
254 |
break; |
break; |
255 |
|
|
256 |
case DA_CRYPT_PASSWORD: |
case DA_CRYPT_PASSWORD: |
257 |
check_dup_attr(&crypt_password, p, line); |
check_dup_attr(&crypt_password, p, loc); |
258 |
break; |
break; |
259 |
|
|
260 |
case DA_PASSWORD_LOCATION: |
case DA_PASSWORD_LOCATION: |
261 |
check_dup_attr(&pass_loc, p, line); |
check_dup_attr(&pass_loc, p, loc); |
262 |
break; |
break; |
263 |
|
|
264 |
case DA_CHAP_PASSWORD: |
case DA_CHAP_PASSWORD: |
265 |
check_dup_attr(&chap_password, p, line); |
check_dup_attr(&chap_password, p, loc); |
266 |
break; |
break; |
267 |
|
|
268 |
case DA_MATCH_PROFILE: |
case DA_MATCH_PROFILE: |
269 |
if (strncmp(p->avp_strvalue, "DEFAULT", 7) == 0 || |
if (strncmp(p->avp_strvalue, "DEFAULT", 7) == 0 || |
270 |
strncmp(p->avp_strvalue, "BEGIN", 5) == 0) { |
strncmp(p->avp_strvalue, "BEGIN", 5) == 0) { |
271 |
radlog(L_ERR, |
radlog_loc(L_ERR, loc, |
272 |
"%s:%d: %s", |
"%s", |
|
filename, line, |
|
273 |
_("Match-Profile refers to a DEFAULT entry")); |
_("Match-Profile refers to a DEFAULT entry")); |
274 |
errcnt++; |
errcnt++; |
275 |
} |
} |
310 |
switch (auth_type->avp_lvalue) { |
switch (auth_type->avp_lvalue) { |
311 |
case DV_AUTH_TYPE_LOCAL: |
case DV_AUTH_TYPE_LOCAL: |
312 |
if (!password && !chap_password && !pass_loc) { |
if (!password && !chap_password && !pass_loc) { |
313 |
radlog(L_ERR, |
radlog_loc(L_ERR, loc, |
314 |
"%s:%d: %s", |
"%s", |
315 |
filename, line, |
_("No User-Password attribute in LHS")); |
|
_("No User-Password attribute in LHS")); |
|
316 |
errcnt++; |
errcnt++; |
317 |
} |
} |
318 |
break; |
break; |
321 |
case DV_AUTH_TYPE_REJECT: |
case DV_AUTH_TYPE_REJECT: |
322 |
case DV_AUTH_TYPE_ACCEPT: |
case DV_AUTH_TYPE_ACCEPT: |
323 |
if (password) { |
if (password) { |
324 |
radlog(L_WARN, |
radlog_loc(L_WARN, loc, |
325 |
"%s:%d: %s", |
"%s", |
|
filename, line, |
|
326 |
_("User-Password attribute ignored for this Auth-Type")); |
_("User-Password attribute ignored for this Auth-Type")); |
327 |
} |
} |
328 |
if (pass_loc) { |
if (pass_loc) { |
329 |
radlog(L_WARN, |
radlog_loc(L_WARN, loc, |
330 |
"%s:%d: %s", |
"%s", |
|
filename, line, |
|
331 |
_("Password-Location attribute ignored for this Auth-Type")); |
_("Password-Location attribute ignored for this Auth-Type")); |
332 |
} |
} |
333 |
break; |
break; |
334 |
|
|
335 |
case DV_AUTH_TYPE_CRYPT_LOCAL: |
case DV_AUTH_TYPE_CRYPT_LOCAL: |
336 |
if (!password && !crypt_password && !pass_loc) { |
if (!password && !crypt_password && !pass_loc) { |
337 |
radlog(L_ERR, |
radlog_loc(L_ERR, loc, |
338 |
"%s:%d: %s", |
"%s", |
|
filename, line, |
|
339 |
_("No User-Password attribute in LHS")); |
_("No User-Password attribute in LHS")); |
340 |
errcnt++; |
errcnt++; |
341 |
} |
} |
342 |
break; |
break; |
343 |
|
|
344 |
case DV_AUTH_TYPE_SECURID: |
case DV_AUTH_TYPE_SECURID: |
345 |
radlog(L_ERR, |
radlog_loc(L_ERR, loc, |
346 |
"%s:%d: %s", |
"%s", |
347 |
filename, line, |
_("Authentication type not supported")); |
|
_("Authentication type not supported")); |
|
348 |
errcnt++; |
errcnt++; |
349 |
break; |
break; |
350 |
|
|
351 |
case DV_AUTH_TYPE_SQL: |
case DV_AUTH_TYPE_SQL: |
352 |
if (password || crypt_password) { |
if (password || crypt_password) { |
353 |
radlog(L_WARN, |
radlog_loc(L_WARN, loc, |
354 |
"%s:%d: %s", |
"%s", |
|
filename, line, |
|
355 |
_("User-Password attribute ignored for this Auth-Type")); |
_("User-Password attribute ignored for this Auth-Type")); |
356 |
} |
} |
357 |
|
|
368 |
|
|
369 |
case DV_AUTH_TYPE_PAM: |
case DV_AUTH_TYPE_PAM: |
370 |
if (pam_auth && auth_data) { |
if (pam_auth && auth_data) { |
371 |
radlog(L_WARN, |
radlog_loc(L_WARN, loc, |
372 |
"%s:%d: %s", |
"%s", |
|
filename, line, |
|
373 |
_("Both Auth-Data and PAM-Auth attributes present")); |
_("Both Auth-Data and PAM-Auth attributes present")); |
374 |
auth_data = NULL; |
auth_data = NULL; |
375 |
} else |
} else |
381 |
} |
} |
382 |
|
|
383 |
int |
int |
384 |
fix_reply_pairs(int cf_file, char *filename, int line, |
fix_reply_pairs(int cf_file, LOCUS *loc, char *name, VALUE_PAIR **pairs) |
|
char *name, VALUE_PAIR **pairs) |
|
385 |
{ |
{ |
386 |
VALUE_PAIR *p; |
VALUE_PAIR *p; |
387 |
int fall_through = 0; |
int fall_through = 0; |
392 |
dict = attr_number_to_dict(p->attribute); |
dict = attr_number_to_dict(p->attribute); |
393 |
if (dict) { |
if (dict) { |
394 |
if (!(dict->prop & AF_RHS(cf_file))) { |
if (!(dict->prop & AF_RHS(cf_file))) { |
395 |
radlog(L_ERR, |
radlog_loc(L_ERR, loc, |
396 |
_("%s:%d: attribute %s not allowed in RHS"), |
_("attribute %s not allowed in RHS"), |
397 |
filename, line, dict->name); |
dict->name); |
398 |
errcnt++; |
errcnt++; |
399 |
continue; |
continue; |
400 |
} |
} |
409 |
} |
} |
410 |
|
|
411 |
if (strncmp(name, "BEGIN", 5) == 0 && fall_through == 0) { |
if (strncmp(name, "BEGIN", 5) == 0 && fall_through == 0) { |
412 |
radlog(L_WARN, |
radlog_loc(L_WARN, loc, |
413 |
"%s:%d: %s", |
"%s", |
414 |
filename, line, |
_("BEGIN without Fall-Through")); |
|
_("BEGIN without Fall-Through")); |
|
415 |
} |
} |
416 |
return errcnt; |
return errcnt; |
417 |
} |
} |