*/
int fr_radmin_run(fr_cmd_info_t *info, FILE *fp, FILE *fp_err, char *str, bool read_only)
{
- int argc, rcode;
+ int argc, ret;
argc = fr_command_str_to_argv(radmin_cmd, info, str);
if (argc < 0) {
return 0;
}
- rcode = fr_command_run(fp, fp_err, info, read_only);
+ ret = fr_command_run(fp, fp_err, info, read_only);
fflush(fp);
fflush(fp_err);
*/
(void) fr_command_clear(0, info);
- if (rcode < 0) return rcode;
+ if (ret < 0) return ret;
return 1;
}
static int _request_free(rs_request_t *request)
{
- bool ret;
+ int ret;
/*
* If we're attempting to cleanup the request, and it's no longer in the request_tree
}
if (request->event) {
- int rcode;
-
- rcode = fr_event_timer_delete(&request->event);
- if (rcode < 0) {
+ ret = fr_event_timer_delete(&request->event);
+ if (ret < 0) {
fr_perror("Failed deleting timer");
RS_ASSERT(0 == 1);
}
*/
static int rs_rtx_cmp(rs_request_t const *a, rs_request_t const *b)
{
- int rcode;
+ int ret;
RS_ASSERT(a->link_vps);
RS_ASSERT(b->link_vps);
- rcode = (int) a->expect->code - (int) b->expect->code;
- if (rcode != 0) return rcode;
+ ret = (int) a->expect->code - (int) b->expect->code;
+ if (ret != 0) return ret;
- rcode = a->expect->socket.fd - b->expect->socket.fd;
- if (rcode != 0) return rcode;
+ ret = a->expect->socket.fd - b->expect->socket.fd;
+ if (ret != 0) return ret;
- rcode = fr_ipaddr_cmp(&a->expect->socket.inet.src_ipaddr, &b->expect->socket.inet.src_ipaddr);
- if (rcode != 0) return rcode;
+ ret = fr_ipaddr_cmp(&a->expect->socket.inet.src_ipaddr, &b->expect->socket.inet.src_ipaddr);
+ if (ret != 0) return ret;
- rcode = fr_ipaddr_cmp(&a->expect->socket.inet.dst_ipaddr, &b->expect->socket.inet.dst_ipaddr);
- if (rcode != 0) return rcode;
+ ret = fr_ipaddr_cmp(&a->expect->socket.inet.dst_ipaddr, &b->expect->socket.inet.dst_ipaddr);
+ if (ret != 0) return ret;
return fr_pair_list_cmp(&a->link_vps, &b->link_vps);
}
static void request_run(fr_event_list_t *el, request_t *request)
{
- rlm_rcode_t rcode;
- module_method_t process;
- void *inst;
- fr_dict_enum_t *dv;
- fr_heap_t *backlog;
- request_t *child;
+ rlm_rcode_t rcode;
+ module_method_t process;
+ void *inst;
+ fr_dict_enum_t *dv;
+ fr_heap_t *backlog;
+ request_t *child;
dv = fr_dict_enum_by_value(attr_packet_type, fr_box_uint32(request->packet->code));
if (!dv) return;
request->backlog = backlog;
request->el = el;
- rcode = process(&(module_ctx_t){ .instance = inst }, request);
- if (rcode != RLM_MODULE_YIELD) goto done;
+ if (process(&rcode, &(module_ctx_t){ .instance = inst }, request) != UNLANG_ACTION_YIELD) goto done;
while (true) {
bool wait_for_event;
*/
(void) fr_heap_extract(backlog, request);
- rcode = process(&(module_ctx_t){ .instance = inst }, request);
- if (rcode != RLM_MODULE_YIELD) break;
+ if (process(&rcode, &(module_ctx_t){ .instance = inst }, request) != UNLANG_ACTION_YIELD) break;
}
done:
eap_session_t, eap_session->child, false, false, false);
}
- rcode = rad_virtual_server(request);
-
+ rad_virtual_server(&rcode, request);
eap_session_inner = request_data_get(request, NULL, REQUEST_DATA_EAP_SESSION);
if (eap_session_inner) {
/*
fake->server_cs = virtual_server_find("channel_bindings");
fake->packet->code = FR_CODE_ACCESS_REQUEST;
- rcode = rad_virtual_server(fake);
-
+ rad_virtual_server(&rcode, fake);
switch (rcode) {
/* If the virtual server succeeded, build a reply */
case RLM_MODULE_OK:
* Radius criteria, EAP-Message is invalid without Message-Authenticator
* For EAP_START, send Access-Challenge with EAP Identity request.
*/
-int eap_start(request_t *request, rlm_eap_method_t const methods[], bool ignore_unknown_types)
+rlm_rcode_t eap_start(request_t *request, rlm_eap_method_t const methods[], bool ignore_unknown_types)
{
fr_pair_t *vp;
fr_pair_t *eap_msg;
#define RAD_REQUEST_OPTION_PROXY_EAP (1 << 16)
-int eap_start(request_t *request, rlm_eap_method_t const methods[], bool ignore_unknown_types) CC_HINT(nonnull);
+rlm_rcode_t eap_start(request_t *request, rlm_eap_method_t const methods[], bool ignore_unknown_types) CC_HINT(nonnull);
rlm_rcode_t eap_continue(eap_session_t *eap_session) CC_HINT(nonnull);
rlm_rcode_t eap_fail(eap_session_t *eap_session) CC_HINT(nonnull);
rlm_rcode_t eap_success(eap_session_t *eap_session) CC_HINT(nonnull);
uint16_t actual_len;
int elements, i;
size_t element_len;
- ssize_t rcode;
+ ssize_t ret;
FR_PROTO_TRACE("Array attribute");
if (elements < 0) return elements;
for (i = 0; i < elements; i++) {
- rcode = sim_decode_pair_value(ctx, cursor, parent, p, element_len, end - p, decoder_ctx);
- if (rcode < 0) return rcode;
+ ret = sim_decode_pair_value(ctx, cursor, parent, p, element_len, end - p, decoder_ctx);
+ if (ret < 0) return ret;
- p += rcode;
+ p += ret;
if (!fr_cond_assert(p <= end)) break;
}
fr_dict_attr_t const *child;
fr_pair_t *head = NULL;
fr_cursor_t tlv_cursor;
- ssize_t rcode;
+ ssize_t ret;
if (data_len < 2) {
fr_strerror_printf("%s: Insufficient data", __FUNCTION__);
}
FR_PROTO_TRACE("decode context changed %s -> %s", parent->name, child->name);
- rcode = sim_decode_pair_value(ctx, &tlv_cursor, child, p + 2, sim_at_len - 2, (end - p) - 2,
+ ret = sim_decode_pair_value(ctx, &tlv_cursor, child, p + 2, sim_at_len - 2, (end - p) - 2,
decoder_ctx);
- if (rcode < 0) goto error;
+ if (ret < 0) goto error;
p += sim_at_len;
}
fr_cursor_head(&tlv_cursor);
uint8_t sim_at;
size_t sim_at_len;
- ssize_t rcode;
+ ssize_t ret;
fr_dict_attr_t const *da;
FR_PROTO_TRACE("decode context changed %s -> %s", da->parent->name, da->name);
if (da->flags.array) {
- rcode = sim_decode_array(ctx, cursor, da, data + 2, sim_at_len - 2, data_len - 2, decoder_ctx);
+ ret = sim_decode_array(ctx, cursor, da, data + 2, sim_at_len - 2, data_len - 2, decoder_ctx);
} else {
- rcode = sim_decode_pair_value(ctx, cursor, da, data + 2, sim_at_len - 2, data_len - 2, decoder_ctx);
+ ret = sim_decode_pair_value(ctx, cursor, da, data + 2, sim_at_len - 2, data_len - 2, decoder_ctx);
}
- if (rcode < 0) return rcode;
+ if (ret < 0) return ret;
- return 2 + rcode;
+ return 2 + ret;
}
/** Decode SIM/AKA/AKA' attributes
int fr_aka_sim_decode(request_t *request, fr_cursor_t *decoded, fr_dict_t const *dict,
uint8_t const *data, size_t data_len, fr_aka_sim_decode_ctx_t *decoder_ctx)
{
- ssize_t rcode;
+ ssize_t ret;
uint8_t const *p = data;
uint8_t const *end = p + data_len;
* in the SIM/AKA/AKA' dict.
*/
while (p < end) {
- rcode = fr_aka_sim_decode_pair(request->packet, decoded, dict, p, end - p, decoder_ctx);
- if (rcode <= 0) {
+ ret = fr_aka_sim_decode_pair(request->packet, decoded, dict, p, end - p, decoder_ctx);
+ if (ret <= 0) {
RPEDEBUG("Failed decoding AT");
error:
fr_cursor_free_list(decoded); /* Free any attributes we added */
return -1;
}
- p += rcode;
+ p += ret;
fr_assert(p <= end);
}
* Examples of these are the sub-state machines that deal with clearing
* pseudonyms and reauthentication data.
*/
-typedef rlm_rcode_t(*aka_sim_state_enter_t)(module_ctx_t const *mctx,
- request_t *request, eap_session_t *eap_session);
-
-static rlm_rcode_t common_eap_failure(module_ctx_t const *mctx, request_t *request);
-static rlm_rcode_t common_failure_notification(module_ctx_t const *mctx, request_t *request);
-static rlm_rcode_t common_eap_success(module_ctx_t const *mctx, request_t *request);
-static rlm_rcode_t common_success_notification(module_ctx_t const *mctx, request_t *request);
-static rlm_rcode_t common_reauthentication(module_ctx_t const *mctx, request_t *request);
-static rlm_rcode_t aka_challenge(module_ctx_t const *mctxd, request_t *request);
-static rlm_rcode_t sim_challenge(module_ctx_t const *mctx, request_t *request);
-static rlm_rcode_t aka_identity(module_ctx_t const *mctx, request_t *request);
-static rlm_rcode_t sim_start(module_ctx_t const *mctx, request_t *request);
-
-static rlm_rcode_t common_failure_notification_enter(module_ctx_t const *mctx,
- request_t *request, eap_session_t *eap_session);
-static rlm_rcode_t aka_challenge_enter(module_ctx_t const *mctx,
- request_t *request, eap_session_t *eap_session);
-static rlm_rcode_t sim_challenge_enter(module_ctx_t const *mctx,
- request_t *request, eap_session_t *eap_session);
-static rlm_rcode_t common_challenge_enter(module_ctx_t const *mctx,
- request_t *request, eap_session_t *eap_session);
-static rlm_rcode_t aka_identity_enter(module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session);
-static rlm_rcode_t sim_start_enter(module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session);
-static rlm_rcode_t common_identity_enter(module_ctx_t const *mctx,
- request_t *request, eap_session_t *eap_session);
+typedef unlang_action_t(*aka_sim_state_enter_t)(rlm_rcode_t *p_result, module_ctx_t const *mctx,
+ request_t *request, eap_session_t *eap_session);
+
+static unlang_action_t common_eap_failure(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request);
+static unlang_action_t common_failure_notification(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request);
+static unlang_action_t common_eap_success(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request);
+static unlang_action_t common_success_notification(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request);
+static unlang_action_t common_reauthentication(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request);
+static unlang_action_t aka_challenge(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request);
+static unlang_action_t sim_challenge(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request);
+static unlang_action_t aka_identity(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request);
+static unlang_action_t sim_start(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request);
+
+static unlang_action_t common_failure_notification_enter(rlm_rcode_t *p_result, module_ctx_t const *mctx,
+ request_t *request, eap_session_t *eap_session);
+static unlang_action_t aka_challenge_enter(rlm_rcode_t *p_result, module_ctx_t const *mctx,
+ request_t *request, eap_session_t *eap_session);
+static unlang_action_t sim_challenge_enter(rlm_rcode_t *p_result, module_ctx_t const *mctx,
+ request_t *request, eap_session_t *eap_session);
+static unlang_action_t common_challenge_enter(rlm_rcode_t *p_result, module_ctx_t const *mctx,
+ request_t *request, eap_session_t *eap_session);
+static unlang_action_t aka_identity_enter(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session);
+static unlang_action_t sim_start_enter(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session);
+static unlang_action_t common_identity_enter(rlm_rcode_t *p_result, module_ctx_t const *mctx,
+ request_t *request, eap_session_t *eap_session);
static module_state_func_table_t const aka_sim_stable_table[] = {
{ "FAILURE-NOTIFICATION", common_failure_notification },
/** Trigger a state transition to FAILURE-NOTIFICATION if the section returned a failure code
*
*/
-#define section_rcode_process(_inst, _request, _eap_session, _eap_aka_sim_session) \
+#define section_rcode_process(_p_result, _inst, _request, _eap_session, _eap_aka_sim_session) \
{ \
if (after_authentication(_eap_aka_sim_session)) { \
switch ((_request)->rcode) { \
case RLM_MODULE_REJECT: \
case RLM_MODULE_DISALLOW: \
eap_aka_sim_session->failure_type = FR_NOTIFICATION_VALUE_TEMPORARILY_DENIED; \
- return common_failure_notification_enter(_inst, _request, _eap_session); \
+ return common_failure_notification_enter(_p_result, _inst, _request, _eap_session); \
case RLM_MODULE_NOTFOUND: \
eap_aka_sim_session->failure_type = FR_NOTIFICATION_VALUE_NOT_SUBSCRIBED; \
- return common_failure_notification_enter(_inst, _request, _eap_session); \
+ return common_failure_notification_enter(_p_result, _inst, _request, _eap_session); \
case RLM_MODULE_INVALID: \
case RLM_MODULE_FAIL: \
eap_aka_sim_session->failure_type = FR_NOTIFICATION_VALUE_GENERAL_FAILURE_AFTER_AUTHENTICATION;\
- return common_failure_notification_enter(_inst, _request, _eap_session); \
+ return common_failure_notification_enter(_p_result, _inst, _request, _eap_session); \
default: \
break; \
} \
case RLM_MODULE_USER_SECTION_REJECT: \
REDEBUG("Section rcode (%s) indicates we should reject the user", \
fr_table_str_by_value(rcode_table, request->rcode, "<INVALID>")); \
- return common_failure_notification_enter(_inst, _request, _eap_session); \
+ return common_failure_notification_enter(_p_result, _inst, _request, _eap_session); \
default: \
break; \
} \
/** Resume after 'store session { ... }'
*
*/
-static rlm_rcode_t session_store_resume(module_ctx_t const *mctx, request_t *request, void *rctx)
+static unlang_action_t session_store_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, void *rctx)
{
aka_sim_state_enter_t state_enter = (aka_sim_state_enter_t)rctx;
pair_delete_request(attr_eap_aka_sim_next_reauth_id);
- return state_enter(mctx, request, eap_session_get(request->parent));
+ return state_enter(p_result, mctx, request, eap_session_get(request->parent));
}
/** Resume after 'store pseudonym { ... }'
*
*/
-static rlm_rcode_t pseudonym_store_resume(module_ctx_t const *mctx, request_t *request, void *rctx)
+static unlang_action_t pseudonym_store_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, void *rctx)
{
eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t);
eap_session_t *eap_session = eap_session_get(request->parent);
vp->vp_uint16 = 0;
}
- return unlang_module_yield_to_section(request,
+ return unlang_module_yield_to_section(p_result,
+ request,
inst->actions.store_session,
RLM_MODULE_NOOP,
session_store_resume,
}
done:
- return state_enter(mctx, request, eap_session_get(request->parent));
+ return state_enter(p_result, mctx, request, eap_session_get(request->parent));
}
/** Implements a set of states for storing pseudonym and fastauth identities
* state.
* @return RLM_MODULE_HANDLED.
*/
-static rlm_rcode_t session_and_pseudonym_store(module_ctx_t const *mctx,
+static unlang_action_t session_and_pseudonym_store(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, eap_session_t *eap_session,
aka_sim_state_enter_t state_enter)
{
RWDEBUG("Found empty Pseudonym-Id, and told not to generate one. "
"Skipping store pseudonym { ... } section");
- return pseudonym_store_resume(mctx, request, (void *)state_enter);
+ return pseudonym_store_resume(p_result, mctx, request, (void *)state_enter);
}
MEM(identity = talloc_array(vp, char, inst->ephemeral_id_length + 2));
MEM(eap_aka_sim_session->pseudonym_sent = talloc_bstrndup(eap_aka_sim_session,
vp->vp_strvalue, vp->vp_length));
- return unlang_module_yield_to_section(request,
+ return unlang_module_yield_to_section(p_result,
+ request,
inst->actions.store_pseudonym,
RLM_MODULE_NOOP,
pseudonym_store_resume,
(void *)state_enter);
}
- return pseudonym_store_resume(mctx, request, (void *)state_enter);
+ return pseudonym_store_resume(p_result, mctx, request, (void *)state_enter);
}
/** Resume after 'clear session { ... }'
*
*/
-static rlm_rcode_t session_clear_resume(module_ctx_t const *mctx, request_t *request, void *rctx)
+static unlang_action_t session_clear_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, void *rctx)
{
aka_sim_state_enter_t state_enter = (aka_sim_state_enter_t)rctx;
pair_delete_request(attr_session_id);
- return state_enter(mctx, request, eap_session_get(request->parent));
+ return state_enter(p_result, mctx, request, eap_session_get(request->parent));
}
/** Resume after 'clear pseudonym { ... }'
*
*/
-static rlm_rcode_t pseudonym_clear_resume(module_ctx_t const *mctx, request_t *request, void *rctx)
+static unlang_action_t pseudonym_clear_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, void *rctx)
{
eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t);
eap_session_t *eap_session = eap_session_get(request->parent);
talloc_array_length(eap_aka_sim_session->fastauth_sent) - 1, true);
TALLOC_FREE(eap_aka_sim_session->fastauth_sent);
- return unlang_module_yield_to_section(request,
+ return unlang_module_yield_to_section(p_result,
+ request,
inst->actions.clear_session,
RLM_MODULE_NOOP,
session_clear_resume,
rctx);
}
- return state_enter(mctx, request, eap_session_get(request->parent));
+ return state_enter(p_result, mctx, request, eap_session_get(request->parent));
}
/** Implements a set of states for clearing out pseudonym and fastauth identities
* state.
* @return RLM_MODULE_HANDLED.
*/
-static rlm_rcode_t session_and_pseudonym_clear(module_ctx_t const *mctx,
+static unlang_action_t session_and_pseudonym_clear(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, eap_session_t *eap_session,
aka_sim_state_enter_t state_enter)
{
fr_value_box_bstrdup_buffer(vp, &vp->data, NULL, eap_aka_sim_session->pseudonym_sent, true);
TALLOC_FREE(eap_aka_sim_session->pseudonym_sent);
- return unlang_module_yield_to_section(request,
+ return unlang_module_yield_to_section(p_result,
+ request,
inst->actions.clear_pseudonym,
RLM_MODULE_NOOP,
session_clear_resume,
(void *)state_enter);
}
- return pseudonym_clear_resume(mctx, request, (void *)state_enter);
+ return pseudonym_clear_resume(p_result, mctx, request, (void *)state_enter);
}
/** Encode EAP-SIM/AKA['] attributes
/** Send a EAP-Failure message to the supplicant
*
*/
-static rlm_rcode_t common_eap_failure_send(request_t *request, eap_session_t *eap_session)
+static unlang_action_t common_eap_failure_send(rlm_rcode_t *p_result, request_t *request, eap_session_t *eap_session)
{
RDEBUG2("Sending EAP-Failure");
eap_session->this_round->request->code = FR_EAP_CODE_FAILURE;
eap_session->finished = true;
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
}
/** Send a EAP-Request/(AKA|SIM)-Notification (Failure) message to the supplicant
*
*/
-static rlm_rcode_t common_failure_notification_send(module_ctx_t const *mctx,
+static unlang_action_t common_failure_notification_send(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, eap_session_t *eap_session)
{
fr_pair_t *vp, *notification_vp;
* Encode the packet
*/
if (common_encode(request, eap_session, FR_SUBTYPE_VALUE_AKA_SIM_NOTIFICATION, NULL, 0) < 0) {
- return common_failure_notification_enter(mctx, request, eap_session);
+ return common_failure_notification_enter(p_result, mctx, request, eap_session);
}
- return RLM_MODULE_HANDLED;
+ RETURN_MODULE_HANDLED;
}
/** Add MPPE keys to the request being sent to the supplicant
* The only work to be done is the add the appropriate SEND/RECV
* attributes derived from the MSK.
*/
-static rlm_rcode_t common_eap_success_send(request_t *request, eap_session_t *eap_session)
+static unlang_action_t common_eap_success_send(rlm_rcode_t *p_result, request_t *request, eap_session_t *eap_session)
{
uint8_t *p;
eap_aka_sim_session_t *eap_aka_sim_session;
p += EAP_TLS_MPPE_KEY_LEN;
eap_add_reply(request->parent, attr_ms_mppe_send_key, p, EAP_TLS_MPPE_KEY_LEN);
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
/** Send a EAP-Request/(AKA|SIM)-Notification (Success) message to the supplicant
*
*/
-static rlm_rcode_t common_success_notification_send(module_ctx_t const *mctx,
- request_t *request, eap_session_t *eap_session)
+static unlang_action_t common_success_notification_send(rlm_rcode_t *p_result, module_ctx_t const *mctx,
+ request_t *request, eap_session_t *eap_session)
{
eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque, eap_aka_sim_session_t);
fr_pair_t *vp;
eap_session->this_round->request->code = FR_EAP_CODE_REQUEST;
- if (!fr_cond_assert(after_authentication(eap_aka_sim_session))) return RLM_MODULE_FAIL;
+ if (!fr_cond_assert(after_authentication(eap_aka_sim_session))) {
+ RETURN_MODULE_FAIL;
+ }
/*
* If we're in this state success bit is
* Encode the packet
*/
if (common_encode(request, eap_session, FR_SUBTYPE_VALUE_AKA_SIM_NOTIFICATION, NULL, 0) < 0) {
- return common_failure_notification_enter(mctx, request, eap_session);
+ return common_failure_notification_enter(p_result, mctx, request, eap_session);
}
- return RLM_MODULE_HANDLED;
+ RETURN_MODULE_HANDLED;
}
/** Called after 'store session { ... }' and 'store pseudonym { ... }'
*
*/
-static rlm_rcode_t common_reauthentication_request_send(module_ctx_t const *mctx,
+static unlang_action_t common_reauthentication_request_send(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, eap_session_t *eap_session)
{
/*
* by the encoder.
*/
if (common_encode(request, eap_session, FR_SUBTYPE_VALUE_AKA_SIM_REAUTHENTICATION, NULL, 0) < 0) {
- return common_failure_notification_enter(mctx, request, eap_session);
+ return common_failure_notification_enter(p_result, mctx, request, eap_session);
}
- return RLM_MODULE_HANDLED;
+ RETURN_MODULE_HANDLED;
}
/** Send a EAP-Request/(AKA|SIM)-Reauthenticate message to the supplicant
*
*/
-static rlm_rcode_t common_reauthentication_request_compose(module_ctx_t const *mctx, request_t *request,
+static unlang_action_t common_reauthentication_request_compose(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request,
eap_session_t *eap_session)
{
eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque,
"requesting additional Identity");
fr_pair_list_free(&request->reply_pairs);
eap_aka_sim_session->id_req = AKA_SIM_FULLAUTH_ID_REQ;
- return common_identity_enter(mctx, request, eap_session);
+ return common_identity_enter(p_result, mctx, request, eap_session);
case AKA_SIM_FULLAUTH_ID_REQ:
case AKA_SIM_PERMANENT_ID_REQ:
"but received, or were told we received (by policy), "
"a fastauth ID. Cannot continue");
failure:
- return common_failure_notification_enter(mctx, request, eap_session);
+ return common_failure_notification_enter(p_result, mctx, request, eap_session);
}
}
if (fr_aka_sim_crypto_kdf_0_reauth(&eap_aka_sim_session->keys) < 0) goto request_new_id;
*/
eap_aka_sim_session->allow_encrypted = true;
- return session_and_pseudonym_store(mctx, request, eap_session, common_reauthentication_request_send);
+ return session_and_pseudonym_store(p_result, mctx,request, eap_session, common_reauthentication_request_send);
}
/** Called after 'store session { ... }' and 'store pseudonym { ... }'
*
*/
-static rlm_rcode_t aka_challenge_request_send(module_ctx_t const *mctx,
+static unlang_action_t aka_challenge_request_send(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, eap_session_t *eap_session)
{
/*
* by the encoder.
*/
if (common_encode(request, eap_session, FR_SUBTYPE_VALUE_AKA_CHALLENGE, NULL, 0) < 0) {
- return common_failure_notification_enter(mctx, request, eap_session);
+ return common_failure_notification_enter(p_result, mctx, request, eap_session);
}
- return RLM_MODULE_HANDLED;
+ RETURN_MODULE_HANDLED;
}
/** Send a EAP-Request/AKA-Challenge message to the supplicant
*
*/
-static rlm_rcode_t aka_challenge_request_compose(module_ctx_t const *mctx,
+static unlang_action_t aka_challenge_request_compose(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, eap_session_t *eap_session)
{
eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque, eap_aka_sim_session_t);
} else {
REDEBUG("No network name available, can't set AT_KDF_INPUT");
failure:
- return common_failure_notification_enter(mctx, request, eap_session);
+ return common_failure_notification_enter(p_result, mctx, request, eap_session);
}
/*
*/
eap_aka_sim_session->allow_encrypted = true;
- return session_and_pseudonym_store(mctx, request, eap_session, aka_challenge_request_send);
+ return session_and_pseudonym_store(p_result, mctx,request, eap_session, aka_challenge_request_send);
}
/** Called after 'store session { ... }' and 'store pseudonym { ... }'
*
*/
-static rlm_rcode_t sim_challenge_request_send(module_ctx_t const *mctx,
+static unlang_action_t sim_challenge_request_send(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, eap_session_t *eap_session)
{
eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque,
*/
if (common_encode(request, eap_session, FR_SUBTYPE_VALUE_SIM_CHALLENGE,
eap_aka_sim_session->keys.gsm.nonce_mt, sizeof(eap_aka_sim_session->keys.gsm.nonce_mt)) < 0) {
- return common_failure_notification_enter(mctx, request, eap_session);
+ return common_failure_notification_enter(p_result, mctx, request, eap_session);
}
- return RLM_MODULE_HANDLED;
+ RETURN_MODULE_HANDLED;
}
/** Send a EAP-Request/SIM-Challenge message to the supplicant
*
*/
-static rlm_rcode_t sim_challenge_request_compose(module_ctx_t const *mctx,
+static unlang_action_t sim_challenge_request_compose(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, eap_session_t *eap_session)
{
eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque,
(fr_aka_sim_vector_gsm_from_attrs(request, request->control_pairs, 2,
&eap_aka_sim_session->keys, &src) != 0)) {
REDEBUG("Failed retrieving SIM vectors");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
fr_aka_sim_crypto_gsm_kdf_0(&eap_aka_sim_session->keys);
*/
eap_aka_sim_session->allow_encrypted = true;
- return session_and_pseudonym_store(mctx, request, eap_session, sim_challenge_request_send);
+ return session_and_pseudonym_store(p_result, mctx,request, eap_session, sim_challenge_request_send);
}
/** Send a EAP-Request/AKA-Identity message to the supplicant
* - RLM_MODULE_HANDLED on success.
* - anything else on failure.
*/
-static rlm_rcode_t aka_identity_request_send(module_ctx_t const *mctx,
+static unlang_action_t aka_identity_request_send(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, eap_session_t *eap_session)
{
eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque,
*/
if (identity_req_pairs_add(request, eap_aka_sim_session) < 0) {
failure:
- return common_failure_notification_enter(mctx, request, eap_session);
+ return common_failure_notification_enter(p_result, mctx, request, eap_session);
}
eap_aka_sim_session->last_id_req = eap_aka_sim_session->id_req; /* Record what we last requested */
}
}
- return RLM_MODULE_HANDLED;
+ RETURN_MODULE_HANDLED;
}
/** Send a EAP-Request/SIM-Start message to the supplicant
* - RLM_MODULE_HANDLED on success.
* - anything else on failure.
*/
-static rlm_rcode_t sim_start_request_send(module_ctx_t const *mctx,
+static unlang_action_t sim_start_request_send(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, eap_session_t *eap_session)
{
eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque,
*/
if (identity_req_pairs_add(request, eap_aka_sim_session) < 0) {
failure:
- return common_failure_notification_enter(mctx, request, eap_session);
+ return common_failure_notification_enter(p_result, mctx, request, eap_session);
}
eap_aka_sim_session->last_id_req = eap_aka_sim_session->id_req; /* Record what we last requested */
*/
if (common_encode(request, eap_session, FR_SUBTYPE_VALUE_SIM_START, NULL, 0) < 0) goto failure;
- return RLM_MODULE_HANDLED;
+ RETURN_MODULE_HANDLED;
}
/** Print debugging information, and write new state to eap_session->process
/** Resume after 'send EAP-Failure { ... }'
*
*/
-static rlm_rcode_t common_eap_failure_enter_resume(UNUSED module_ctx_t const *mctx,
- request_t *request, UNUSED void *rctx)
+static unlang_action_t common_eap_failure_enter_resume(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx,
+ request_t *request, UNUSED void *rctx)
{
eap_session_t *eap_session = eap_session_get(request->parent);
section_rcode_ignored(request);
- return common_eap_failure_send(request, eap_session);
+ return common_eap_failure_send(p_result, request, eap_session);
}
/** Enter EAP-FAILURE state
*
*/
-static rlm_rcode_t common_eap_failure_enter(module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session)
+static unlang_action_t common_eap_failure_enter(rlm_rcode_t *p_result, module_ctx_t const *mctx,
+ request_t *request, eap_session_t *eap_session)
{
eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t);
eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque, eap_aka_sim_session_t);
* we sent are now invalid.
*/
if (eap_aka_sim_session->pseudonym_sent || eap_aka_sim_session->fastauth_sent) {
- return session_and_pseudonym_clear(mctx,
+ return session_and_pseudonym_clear(p_result, mctx,
request, eap_session, common_eap_failure_enter); /* come back when we're done */
}
state_transition(request, eap_session, common_eap_failure);
- return unlang_module_yield_to_section(request,
+ return unlang_module_yield_to_section(p_result,
+ request,
inst->actions.send_eap_failure,
RLM_MODULE_NOOP,
common_eap_failure_enter_resume,
*
* Ignores return code from send Failure-Notification { ... } section.
*/
-static rlm_rcode_t common_failure_notification_enter_resume(module_ctx_t const *mctx,
- request_t *request, UNUSED void *rctx)
+static unlang_action_t common_failure_notification_enter_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx,
+ request_t *request, UNUSED void *rctx)
{
eap_session_t *eap_session = eap_session_get(request->parent);
* If there's an issue composing the failure
* message just send an EAP-Failure instead.
*/
- return common_failure_notification_send(mctx, request, eap_session);
+ return common_failure_notification_send(p_result, mctx,request, eap_session);
}
/** Enter the FAILURE-NOTIFICATION state
*
*/
-static rlm_rcode_t common_failure_notification_enter(module_ctx_t const *mctx,
- request_t *request, eap_session_t *eap_session)
+static unlang_action_t common_failure_notification_enter(rlm_rcode_t *p_result, module_ctx_t const *mctx,
+ request_t *request, eap_session_t *eap_session)
{
eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t);
eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque, eap_aka_sim_session_t);
* we sent are now invalid.
*/
if (eap_aka_sim_session->pseudonym_sent || eap_aka_sim_session->fastauth_sent) {
- return session_and_pseudonym_clear(mctx, request, eap_session,
+ return session_and_pseudonym_clear(p_result, mctx,request, eap_session,
common_failure_notification_enter); /* come back when we're done */
}
* garbage from the supplicant.
*/
if (eap_session->process == common_failure_notification) {
- return common_eap_failure_enter(mctx, request, eap_session);
+ return common_eap_failure_enter(p_result, mctx, request, eap_session);
}
/*
*/
state_transition(request, eap_session, common_failure_notification);
- return unlang_module_yield_to_section(request,
+ return unlang_module_yield_to_section(p_result,
+ request,
inst->actions.send_failure_notification,
RLM_MODULE_NOOP,
common_failure_notification_enter_resume,
/** Resume after 'send EAP-Success { ... }'
*
*/
-static rlm_rcode_t common_eap_success_enter_resume(module_ctx_t const *mctx,
+static unlang_action_t common_eap_success_enter_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, UNUSED void *rctx)
{
eap_session_t *eap_session = eap_session_get(request->parent);
* the end of authentication.
*/
} else {
- section_rcode_process(mctx, request, eap_session, eap_aka_sim_session);
+ section_rcode_process(p_result, mctx,request, eap_session, eap_aka_sim_session);
}
- return common_eap_success_send(request, eap_session);
+ return common_eap_success_send(p_result, request, eap_session);
}
/** Enter EAP-SUCCESS state
*
*/
-static rlm_rcode_t common_eap_success_enter(module_ctx_t const *mctx, request_t *request,
- eap_session_t *eap_session)
+static unlang_action_t common_eap_success_enter(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request,
+ eap_session_t *eap_session)
{
eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t);
state_transition(request, eap_session, common_eap_success);
- return unlang_module_yield_to_section(request,
+ return unlang_module_yield_to_section(p_result,
+ request,
inst->actions.send_eap_success,
RLM_MODULE_NOOP,
common_eap_success_enter_resume,
/** Resume after 'send Success-Notification { ... }'
*
*/
-static rlm_rcode_t common_success_notification_enter_resume(module_ctx_t const *mctx,
+static unlang_action_t common_success_notification_enter_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, UNUSED void *rctx)
{
eap_session_t *eap_session = eap_session_get(request->parent);
eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque,
eap_aka_sim_session_t);
- section_rcode_process(mctx, request, eap_session, eap_aka_sim_session);
+ section_rcode_process(p_result, mctx,request, eap_session, eap_aka_sim_session);
- return common_success_notification_send(mctx, request, eap_session);
+ return common_success_notification_send(p_result, mctx, request, eap_session);
}
/** Enter the SUCCESS-NOTIFICATION state
*
*/
-static rlm_rcode_t common_success_notification_enter(module_ctx_t const *mctx,
+static unlang_action_t common_success_notification_enter(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, eap_session_t *eap_session)
{
eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t);
state_transition(request, eap_session, common_success_notification);
- return unlang_module_yield_to_section(request,
+ return unlang_module_yield_to_section(p_result,
+ request,
inst->actions.send_success_notification,
RLM_MODULE_NOOP,
common_success_notification_enter_resume,
/** Resume after 'send Reauthentication-Request { ... }'
*
*/
-static rlm_rcode_t common_reauthentication_send_resume(module_ctx_t const *mctx,
+static unlang_action_t common_reauthentication_send_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, UNUSED void *rctx)
{
eap_session_t *eap_session = eap_session_get(request->parent);
fr_pair_list_free(&request->reply_pairs);
eap_aka_sim_session->id_req = AKA_SIM_FULLAUTH_ID_REQ;
- return common_identity_enter(mctx, request, eap_session);
+ return common_identity_enter(p_result, mctx, request, eap_session);
case AKA_SIM_FULLAUTH_ID_REQ:
case AKA_SIM_PERMANENT_ID_REQ:
REDEBUG("Last requested Full-Auth-Id or Permanent-Identity, "
"but received a Fast-Auth-Id. Cannot continue");
failure:
- return common_failure_notification_enter(mctx, request, eap_session);
+ return common_failure_notification_enter(p_result, mctx, request, eap_session);
}
break;
case RLM_MODULE_NOOP:
case RLM_MODULE_OK:
case RLM_MODULE_UPDATED:
- return common_reauthentication_request_compose(mctx, request, eap_session);
+ return common_reauthentication_request_compose(p_result, mctx, request, eap_session);
}
}
/** Resume after 'load session { ... }'
*
*/
-static rlm_rcode_t session_load_resume(module_ctx_t const *mctx,
+static unlang_action_t session_load_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, UNUSED void *rctx)
{
eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t);
fr_table_str_by_value(rcode_table, request->rcode, "<INVALID>"));
fr_pair_list_free(&request->reply_pairs);
eap_aka_sim_session->id_req = AKA_SIM_FULLAUTH_ID_REQ;
- return common_identity_enter(mctx, request, eap_session);
+ return common_identity_enter(p_result, mctx, request, eap_session);
case AKA_SIM_FULLAUTH_ID_REQ:
case AKA_SIM_PERMANENT_ID_REQ:
REDEBUG("Last requested Full-Auth-Id or Permanent-Identity, "
"but received a Fast-Auth-Id. Cannot continue");
- return common_failure_notification_enter(mctx, request, eap_session);
+ return common_failure_notification_enter(p_result, mctx, request, eap_session);
}
break;
case RLM_MODULE_REJECT:
case RLM_MODULE_DISALLOW:
reject:
- return common_failure_notification_enter(mctx, request, eap_session);
+ return common_failure_notification_enter(p_result, mctx, request, eap_session);
/*
* Everything OK
case RLM_MODULE_OK:
case RLM_MODULE_UPDATED:
reauthenticate:
- return unlang_module_yield_to_section(request,
+ return unlang_module_yield_to_section(p_result,
+ request,
inst->actions.send_reauthentication_request,
RLM_MODULE_NOOP,
common_reauthentication_send_resume,
/** Resume after 'load pseudonym { ... }'
*
*/
-static rlm_rcode_t pseudonym_load_resume(module_ctx_t const *mctx,
+static unlang_action_t pseudonym_load_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, void *rctx)
{
eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t);
*/
if (!inst->actions.load_pseudonym) {
next_state:
- return state_enter(mctx, request, eap_session);
+ return state_enter(p_result, mctx, request, eap_session);
}
switch (request->rcode) {
fr_table_str_by_value(rcode_table, request->rcode, "<INVALID>"));
fr_pair_list_free(&request->reply_pairs);
eap_aka_sim_session->id_req = AKA_SIM_FULLAUTH_ID_REQ;
- return common_identity_enter(mctx, request, eap_session);
+ return common_identity_enter(p_result, mctx, request, eap_session);
case AKA_SIM_PERMANENT_ID_REQ:
REDEBUG("Last requested a Permanent-Identity, but received a Pseudonym. Cannot continue");
failure:
- return common_failure_notification_enter(mctx, request, eap_session);
+ return common_failure_notification_enter(p_result, mctx, request, eap_session);
}
break;
/** Enter the REAUTHENTICATION state
*
*/
-static rlm_rcode_t common_reauthentication_enter(module_ctx_t const *mctx,
+static unlang_action_t common_reauthentication_enter(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, eap_session_t *eap_session)
{
eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t);
MEM(pair_update_request(&vp, attr_session_id) >= 0);
fr_pair_value_memdup(vp, eap_aka_sim_session->keys.identity, eap_aka_sim_session->keys.identity_len, true);
- return unlang_module_yield_to_section(request,
+ return unlang_module_yield_to_section(p_result,
+ request,
inst->actions.load_session,
RLM_MODULE_NOOP,
session_load_resume,
/** Resume after 'send Challenge-Request { ... }'
*
*/
-static rlm_rcode_t aka_challenge_enter_resume(module_ctx_t const *mctx, request_t *request, UNUSED void *rctx)
+static unlang_action_t aka_challenge_enter_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, UNUSED void *rctx)
{
eap_session_t *eap_session = eap_session_get(request->parent);
eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque,
eap_aka_sim_session_t);
- section_rcode_process(mctx, request, eap_session, eap_aka_sim_session);
+ section_rcode_process(p_result, mctx,request, eap_session, eap_aka_sim_session);
- return aka_challenge_request_compose(mctx, request, eap_session);
+ return aka_challenge_request_compose(p_result, mctx, request, eap_session);
}
/** Enter the AKA-CHALLENGE state
*
*/
-static rlm_rcode_t aka_challenge_enter(module_ctx_t const *mctx,
+static unlang_action_t aka_challenge_enter(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, eap_session_t *eap_session)
{
eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t);
* that failed.
*/
if (eap_aka_sim_session->pseudonym_sent || eap_aka_sim_session->fastauth_sent) {
- return session_and_pseudonym_clear(mctx, request, eap_session, aka_challenge_enter); /* come back when we're done */
+ return session_and_pseudonym_clear(p_result, mctx,request, eap_session, aka_challenge_enter); /* come back when we're done */
}
state_transition(request, eap_session, aka_challenge);
vp->vp_bool = true;
}
- return unlang_module_yield_to_section(request,
+ return unlang_module_yield_to_section(p_result,
+ request,
inst->actions.send_challenge_request,
RLM_MODULE_NOOP,
aka_challenge_enter_resume,
/** Resume after 'send Challenge-Request { ... }'
*
*/
-static rlm_rcode_t sim_challenge_enter_resume(module_ctx_t const *mctx, request_t *request, UNUSED void *rctx)
+static unlang_action_t sim_challenge_enter_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, UNUSED void *rctx)
{
eap_session_t *eap_session = eap_session_get(request->parent);
eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque,
eap_aka_sim_session_t);
- section_rcode_process(mctx, request, eap_session, eap_aka_sim_session);
+ section_rcode_process(p_result, mctx,request, eap_session, eap_aka_sim_session);
- return sim_challenge_request_compose(mctx, request, eap_session);
+ return sim_challenge_request_compose(p_result, mctx, request, eap_session);
}
/** Enter the SIM-CHALLENGE state
*
*/
-static rlm_rcode_t sim_challenge_enter(module_ctx_t const *mctx,
+static unlang_action_t sim_challenge_enter(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, eap_session_t *eap_session)
{
eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t);
* that failed.
*/
if (eap_aka_sim_session->pseudonym_sent || eap_aka_sim_session->fastauth_sent) {
- return session_and_pseudonym_clear(mctx, request, eap_session, sim_challenge_enter); /* come back when we're done */
+ return session_and_pseudonym_clear(p_result, mctx,request, eap_session, sim_challenge_enter); /* come back when we're done */
}
state_transition(request, eap_session, sim_challenge);
vp->vp_bool = true;
}
- return unlang_module_yield_to_section(request,
+ return unlang_module_yield_to_section(p_result,
+ request,
inst->actions.send_challenge_request,
RLM_MODULE_NOOP,
sim_challenge_enter_resume,
* Called by functions which are common to both the EAP-SIM and EAP-AKA state machines
* to enter the correct challenge state.
*/
-static rlm_rcode_t common_challenge_enter(module_ctx_t const *mctx,
+static unlang_action_t common_challenge_enter(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, eap_session_t *eap_session)
{
switch (eap_session->type) {
case FR_EAP_METHOD_SIM:
- return sim_challenge_enter(mctx, request, eap_session);
+ return sim_challenge_enter(p_result, mctx, request, eap_session);
case FR_EAP_METHOD_AKA:
case FR_EAP_METHOD_AKA_PRIME:
- return aka_challenge_enter(mctx, request, eap_session);
+ return aka_challenge_enter(p_result, mctx, request, eap_session);
default:
break;
}
fr_assert(0);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/** Resume after 'send Identity-Request { ... }'
*
*/
-static rlm_rcode_t aka_identity_enter_resume(module_ctx_t const *mctx,
+static unlang_action_t aka_identity_enter_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, UNUSED void *rctx)
{
eap_session_t *eap_session = eap_session_get(request->parent);
eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque,
eap_aka_sim_session_t);
- section_rcode_process(mctx, request, eap_session, eap_aka_sim_session);
+ section_rcode_process(p_result, mctx,request, eap_session, eap_aka_sim_session);
- return aka_identity_request_send(mctx, request, eap_session);
+ return aka_identity_request_send(p_result, mctx,request, eap_session);
}
/** Enter the AKA-IDENTITY state
*
*/
-static rlm_rcode_t aka_identity_enter(module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session)
+static unlang_action_t aka_identity_enter(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session)
{
eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t);
* then run that, otherwise just run the normal
* identity request section.
*/
- return unlang_module_yield_to_section(request,
+ return unlang_module_yield_to_section(p_result,
+ request,
inst->actions.aka.send_aka_identity_request ?
inst->actions.aka.send_aka_identity_request:
inst->actions.send_identity_request,
/** Resume after 'send Start { ... }'
*
*/
-static rlm_rcode_t sim_start_enter_resume(module_ctx_t const *mctx,
+static unlang_action_t sim_start_enter_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, UNUSED void *rctx)
{
eap_session_t *eap_session = eap_session_get(request->parent);
eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque,
eap_aka_sim_session_t);
- section_rcode_process(mctx, request, eap_session, eap_aka_sim_session);
+ section_rcode_process(p_result, mctx,request, eap_session, eap_aka_sim_session);
- return sim_start_request_send(mctx, request, eap_session);
+ return sim_start_request_send(p_result, mctx,request, eap_session);
}
/** Enter the SIM-START state
*
*/
-static rlm_rcode_t sim_start_enter(module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session)
+static unlang_action_t sim_start_enter(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session)
{
eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t);
state_transition(request, eap_session, sim_start);
- return unlang_module_yield_to_section(request,
+ return unlang_module_yield_to_section(p_result,
+ request,
inst->actions.sim.send_sim_start_request ?
inst->actions.sim.send_sim_start_request:
inst->actions.send_identity_request,
* Called by functions which are common to both the EAP-SIM and EAP-AKA state machines
* to enter the correct Identity-Request state.
*/
-static rlm_rcode_t common_identity_enter(module_ctx_t const *mctx,
+static unlang_action_t common_identity_enter(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, eap_session_t *eap_session)
{
switch (eap_session->type) {
case FR_EAP_METHOD_SIM:
- return sim_start_enter(mctx, request, eap_session);
+ return sim_start_enter(p_result, mctx, request, eap_session);
case FR_EAP_METHOD_AKA:
case FR_EAP_METHOD_AKA_PRIME:
- return aka_identity_enter(mctx, request, eap_session);
+ return aka_identity_enter(p_result, mctx, request, eap_session);
default:
break;
}
fr_assert(0);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/** Process a EAP-Response/(AKA|SIM)-Reauthentication message - The response to our EAP-Request/(AKA|SIM)-Reauthentication message
*
*/
-static rlm_rcode_t common_reauthentication_response_process(module_ctx_t const *mctx, request_t *request,
+static unlang_action_t common_reauthentication_response_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request,
eap_session_t *eap_session)
{
eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque,
if (!mac) {
REDEBUG("Missing AT_MAC attribute");
failure:
- return common_failure_notification_enter(mctx, request, eap_session);
+ return common_failure_notification_enter(p_result, mctx, request, eap_session);
}
if (mac->vp_length != AKA_SIM_MAC_DIGEST_SIZE) {
REDEBUG("MAC has incorrect length, expected %u bytes got %zu bytes",
fr_aka_sim_vector_umts_reauth_clear(&eap_aka_sim_session->keys);
eap_aka_sim_session->allow_encrypted = false;
- return aka_challenge_enter(mctx, request, eap_session);
+ return aka_challenge_enter(p_result, mctx, request, eap_session);
}
/*
RDEBUG("We wanted to use protected result indications, but peer does not");
eap_aka_sim_session->send_result_ind = false;
} else {
- return common_success_notification_enter(mctx, request, eap_session);
+ return common_success_notification_enter(p_result, mctx, request, eap_session);
}
} else if (fr_pair_find_by_da(&from_peer, attr_eap_aka_sim_result_ind)) {
RDEBUG("Peer wanted to use protected result indications, but we do not");
eap_aka_sim_session->reauthentication_success = true;
- return common_eap_success_enter(mctx, request, eap_session);
+ return common_eap_success_enter(p_result, mctx, request, eap_session);
}
/** Process a EAP-Response/AKA-Challenge message - The response to our EAP-Request/AKA-Challenge message
*
* Verify that MAC, and RES match what we expect.
*/
-static rlm_rcode_t aka_challenge_response_process(module_ctx_t const *mctx,
+static unlang_action_t aka_challenge_response_process(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, eap_session_t *eap_session)
{
eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque,
if (!mac) {
REDEBUG("Missing AT_MAC attribute");
failure:
- return common_failure_notification_enter(mctx, request, eap_session);
+ return common_failure_notification_enter(p_result, mctx, request, eap_session);
}
if (mac->vp_length != AKA_SIM_MAC_DIGEST_SIZE) {
REDEBUG("MAC has incorrect length, expected %u bytes got %zu bytes",
RDEBUG("We wanted to use protected result indications, but peer does not");
eap_aka_sim_session->send_result_ind = false;
} else {
- return common_success_notification_enter(mctx, request, eap_session);
+ return common_success_notification_enter(p_result, mctx, request, eap_session);
}
} else if (fr_pair_find_by_da(&from_peer, attr_eap_aka_sim_result_ind)) {
RDEBUG("Peer wanted to use protected result indications, but we do not");
}
- return common_eap_success_enter(mctx, request, eap_session);
+ return common_eap_success_enter(p_result, mctx, request, eap_session);
}
/** Process a EAP-Response/SIM-Challenge message - The response to our EAP-Request/SIM-Challenge message
*
* Verify that MAC, and RES match what we expect.
*/
-static rlm_rcode_t sim_challenge_response_process(module_ctx_t const *mctx,
+static unlang_action_t sim_challenge_response_process(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, eap_session_t *eap_session)
{
eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque,
if (!mac) {
REDEBUG("Missing AT_MAC attribute");
failure:
- return common_failure_notification_enter(mctx, request, eap_session);
+ return common_failure_notification_enter(p_result, mctx, request, eap_session);
}
if (mac->vp_length != AKA_SIM_MAC_DIGEST_SIZE) {
REDEBUG("MAC has incorrect length, expected %u bytes got %zu bytes",
RDEBUG("We wanted to use protected result indications, but peer does not");
eap_aka_sim_session->send_result_ind = false;
} else {
- return common_success_notification_enter(mctx, request, eap_session);
+ return common_success_notification_enter(p_result, mctx, request, eap_session);
}
} else if (fr_pair_find_by_da(&from_peer, attr_eap_aka_sim_result_ind)) {
RDEBUG("Peer wanted to use protected result indications, but we do not");
}
- return common_eap_success_enter(mctx, request, eap_session);
+ return common_eap_success_enter(p_result, mctx, request, eap_session);
}
/** Process a EAP-Response/AKA-Identity message i.e. an EAP-AKA Identity-Response
* - Pseudonym - Call 'load pseudonym { ... }'
* - Permanent - Enter the CHALLENGE state.
*/
-static rlm_rcode_t aka_identity_response_process(module_ctx_t const *mctx,
+static unlang_action_t aka_identity_response_process(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, eap_session_t *eap_session)
{
eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t);
eap_session->this_round->response) < 0) {
RPEDEBUG("Failed updating checkcode");
failure:
- return common_failure_notification_enter(mctx, request, eap_session);
+ return common_failure_notification_enter(p_result, mctx, request, eap_session);
}
}
fr_table_str_by_value(rcode_table, request->rcode, "<INVALID>"),
fr_table_str_by_value(fr_aka_sim_id_request_table, eap_aka_sim_session->id_req, "<INVALID>"));
}
- return aka_identity_enter(mctx, request, eap_session);
+ return aka_identity_enter(p_result, mctx, request, eap_session);
}
/*
identity_type = fr_pair_find_by_da(&from_peer, attr_eap_aka_sim_identity_type);
if (identity_type) switch (identity_type->vp_uint32) {
case FR_IDENTITY_TYPE_VALUE_FASTAUTH:
- return common_reauthentication_enter(mctx, request, eap_session);
+ return common_reauthentication_enter(p_result, mctx, request, eap_session);
/*
* It's a pseudonym, which now needs resolving.
* if pseudonym resolution went ok.
*/
case FR_IDENTITY_TYPE_VALUE_PSEUDONYM:
- return unlang_module_yield_to_section(request,
+ return unlang_module_yield_to_section(p_result,
+ request,
inst->actions.load_pseudonym,
RLM_MODULE_NOOP,
pseudonym_load_resume,
break;
}
- return aka_challenge_enter(mctx, request, eap_session);
+ return aka_challenge_enter(p_result, mctx, request, eap_session);
}
/** Helper function to check for the presence and length of AT_SELECTED_VERSION and copy its value into the keys structure
* - Pseudonym - Verify selected version and AT_NONCE_MT, then call 'load pseudonym { ... }'
* - Permanent - Verify selected version and AT_NONCE_MT, then enter the CHALLENGE state.
*/
-static rlm_rcode_t sim_start_response_process(module_ctx_t const *mctx,
+static unlang_action_t sim_start_response_process(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, eap_session_t *eap_session)
{
eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t);
case AKA_SIM_PERMANENT_ID_REQ:
REDEBUG("Peer sent no usable identities");
failure:
- return common_failure_notification_enter(mctx, request, eap_session);
+ return common_failure_notification_enter(p_result, mctx, request, eap_session);
}
RDEBUG2("Previous section returned (%s), requesting next most permissive identity (%s)",
fr_table_str_by_value(rcode_table, request->rcode, "<INVALID>"),
fr_table_str_by_value(fr_aka_sim_id_request_table, eap_aka_sim_session->id_req, "<INVALID>"));
}
- return sim_start_enter(mctx, request, eap_session);
+ return sim_start_enter(p_result, mctx, request, eap_session);
}
/*
*/
if (fr_pair_find_by_da(&from_peer, attr_eap_aka_sim_nonce_mt)) {
REDEBUG("AT_NONCE_MT is not allowed in EAP-Response/SIM-Reauthentication messages");
- return common_failure_notification_enter(mctx, request, eap_session);
+ return common_failure_notification_enter(p_result, mctx, request, eap_session);
}
/*
*/
if (fr_pair_find_by_da(&from_peer, attr_eap_aka_sim_selected_version)) {
REDEBUG("AT_SELECTED_VERSION is not allowed in EAP-Response/SIM-Reauthentication messages");
- return common_failure_notification_enter(mctx, request, eap_session);
+ return common_failure_notification_enter(p_result, mctx, request, eap_session);
}
- return common_reauthentication_enter(mctx, request, eap_session);
+ return common_reauthentication_enter(p_result, mctx, request, eap_session);
/*
* It's a pseudonym, which now needs resolving.
if (sim_start_selected_version_check(request, from_peer, eap_aka_sim_session) < 0) goto failure;
if (sim_start_nonce_mt_check(request, from_peer, eap_aka_sim_session) < 0) goto failure;
- return unlang_module_yield_to_section(request,
+ return unlang_module_yield_to_section(p_result,
+ request,
inst->actions.load_pseudonym,
RLM_MODULE_NOOP,
pseudonym_load_resume,
break;
}
- return sim_challenge_enter(mctx, request, eap_session);
+ return sim_challenge_enter(p_result, mctx, request, eap_session);
}
/** Resume after 'recv Failure-Notification-Ack { ... }'
*
* - Enter the EAP-FAILURE state.
*/
-static rlm_rcode_t common_failure_notification_recv_resume(module_ctx_t const *mctx,
+static unlang_action_t common_failure_notification_recv_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, UNUSED void *rctx)
{
eap_session_t *eap_session = eap_session_get(request->parent);
/*
* Case 2 where we're allowed to send an EAP-Failure
*/
- return common_eap_failure_enter(mctx, request, eap_session);
+ return common_eap_failure_enter(p_result, mctx, request, eap_session);
}
/** Resume after 'recv Success-Notification-Ack { ... }'
*
* - Enter the EAP-SUCCESS state.
*/
-static rlm_rcode_t common_success_notification_ack_recv_resume(module_ctx_t const *mctx,
+static unlang_action_t common_success_notification_ack_recv_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, UNUSED void *rctx)
{
eap_session_t *eap_session = eap_session_get(request->parent);
* next packet after we send our success notification
* and always send a success.
*/
- return common_eap_success_enter(mctx, request, eap_session);
+ return common_eap_success_enter(p_result, mctx, request, eap_session);
}
/** Resume after 'recv Challenge-Response { ... }'
* - If the previous section returned a failure rcode, enter the FAILURE-NOTIFICATION state.
* - ...or call a function to process the contents of the AKA-Challenge message.
*/
-static rlm_rcode_t aka_challenge_response_recv_resume(module_ctx_t const *mctx,
+static unlang_action_t aka_challenge_response_recv_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, UNUSED void *rctx)
{
eap_session_t *eap_session = eap_session_get(request->parent);
eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque,
eap_aka_sim_session_t);
- section_rcode_process(mctx, request, eap_session, eap_aka_sim_session);
+ section_rcode_process(p_result, mctx,request, eap_session, eap_aka_sim_session);
- return aka_challenge_response_process(mctx, request, eap_session);
+ return aka_challenge_response_process(p_result, mctx,request, eap_session);
}
/** Resume after 'recv Challenge-Response { ... }'
* - If the previous section returned a failure rcode, enter the FAILURE-NOTIFICATION state.
* - ...or call a function to process the contents of the SIM-Challenge message.
*/
-static rlm_rcode_t sim_challenge_response_recv_resume(module_ctx_t const *mctx,
+static unlang_action_t sim_challenge_response_recv_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, UNUSED void *rctx)
{
eap_session_t *eap_session = eap_session_get(request->parent);
eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque,
eap_aka_sim_session_t);
- section_rcode_process(mctx, request, eap_session, eap_aka_sim_session);
+ section_rcode_process(p_result, mctx,request, eap_session, eap_aka_sim_session);
- return sim_challenge_response_process(mctx, request, eap_session);
+ return sim_challenge_response_process(p_result, mctx,request, eap_session);
}
/** Resume after 'recv Identity-Response { ... }' or 'recv AKA-Identity { ... }'
* - If the previous section returned a failure rcode, enter the FAILURE-NOTIFICATION state.
* - ...or call a function to process the contents of the AKA-Identity message, mainly the AT_IDENTITY value.
*/
-static rlm_rcode_t aka_identity_response_recv_resume(module_ctx_t const *mctx,
+static unlang_action_t aka_identity_response_recv_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, UNUSED void *rctx)
{
eap_session_t *eap_session = eap_session_get(request->parent);
eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque,
eap_aka_sim_session_t);
- section_rcode_process(mctx, request, eap_session, eap_aka_sim_session);
+ section_rcode_process(p_result, mctx,request, eap_session, eap_aka_sim_session);
- return aka_identity_response_process(mctx, request, eap_session);
+ return aka_identity_response_process(p_result, mctx,request, eap_session);
}
/** Resume after 'recv Identity-Response { ... }' or 'recv SIM-Start { ... }'
* - If the previous section returned a failure rcode, enter the FAILURE-NOTIFICATION state.
* - ...or call a function to process the contents of the SIM-Start message, mainly the AT_IDENTITY value.
*/
-static rlm_rcode_t sim_start_response_recv_resume(module_ctx_t const *mctx,
+static unlang_action_t sim_start_response_recv_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, UNUSED void *rctx)
{
eap_session_t *eap_session = eap_session_get(request->parent);
eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque,
eap_aka_sim_session_t);
- section_rcode_process(mctx, request, eap_session, eap_aka_sim_session);
+ section_rcode_process(p_result, mctx,request, eap_session, eap_aka_sim_session);
- return sim_start_response_process(mctx, request, eap_session);
+ return sim_start_response_process(p_result, mctx,request, eap_session);
}
/** Resume after 'recv Authentication-Reject { ... }'
*
* - Enter the FAILURE-NOTIFICATION state.
*/
-static rlm_rcode_t aka_authentication_reject_recv_resume(module_ctx_t const *mctx,
+static unlang_action_t aka_authentication_reject_recv_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, UNUSED void *rctx)
{
eap_session_t *eap_session = eap_session_get(request->parent);
/*
* Case 2 where we're allowed to send an EAP-Failure
*/
- return common_eap_failure_enter(mctx, request, eap_session);
+ return common_eap_failure_enter(p_result, mctx, request, eap_session);
}
/** Resume after 'recv Synchronization-Failure { ... }'
* then enter the FAILURE-NOTIFICATION state.
* - ...or enter the AKA-CHALLENGE state.
*/
-static rlm_rcode_t aka_synchronization_failure_recv_resume(module_ctx_t const *mctx,
+static unlang_action_t aka_synchronization_failure_recv_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, UNUSED void *rctx)
{
eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t);
eap_aka_sim_session_t);
fr_pair_t *vp;
- section_rcode_process(mctx, request, eap_session, eap_aka_sim_session);
+ section_rcode_process(p_result, mctx,request, eap_session, eap_aka_sim_session);
/*
* If there's no section to handle this, then no resynchronisation
*/
if (!inst->actions.aka.recv_syncronization_failure || eap_aka_sim_session->prev_recv_sync_failure) {
failure:
- return common_failure_notification_enter(mctx, request, eap_session);
+ return common_failure_notification_enter(p_result, mctx, request, eap_session);
}
/*
* EAP-Response/AKA-Synchronization-Failure (Section 9.6), and the
* server proceeds with a new EAP-Request/AKA-Challenge."
*/
- return aka_challenge_enter(mctx, request, eap_session);
+ return aka_challenge_enter(p_result, mctx, request, eap_session);
}
/** Resume after 'recv Client-Error { ... }'
*
* - Enter the EAP-FAILURE state.
*/
-static rlm_rcode_t common_client_error_recv_resume(module_ctx_t const *mctx,
+static unlang_action_t common_client_error_recv_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, UNUSED void *rctx)
{
eap_session_t *eap_session = eap_session_get(request->parent);
section_rcode_ignored(request);
- return common_eap_failure_enter(mctx, request, eap_session);
+ return common_eap_failure_enter(p_result, mctx, request, eap_session);
}
/** Resume after 'recv Reauthentication-Response { ... }'
* - ...or call the EAP-Request/Reauthentication-Response function to act on the
* contents of the response.
*/
-static rlm_rcode_t common_reauthentication_response_recv_resume(module_ctx_t const *mctx,
+static unlang_action_t common_reauthentication_response_recv_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx,
request_t *request, UNUSED void *rctx)
{
eap_session_t *eap_session = eap_session_get(request->parent);
eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque,
eap_aka_sim_session_t);
- section_rcode_process(mctx, request, eap_session, eap_aka_sim_session);
+ section_rcode_process(p_result, mctx,request, eap_session, eap_aka_sim_session);
- return common_reauthentication_response_process(mctx, request, eap_session);
+ return common_reauthentication_response_process(p_result, mctx,request, eap_session);
}
/** Decode the peer's response
*
* This is called by the state_* functions to decode the peer's response.
*/
-static rlm_rcode_t common_decode(fr_pair_t **subtype_vp, fr_pair_t **vps,
- module_ctx_t const *mctx, request_t *request)
+static unlang_action_t common_decode(fr_pair_t **subtype_vp, fr_pair_t **vps,
+ rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
eap_session_t *eap_session = eap_session_get(request->parent);
eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque,
if (ret < 0) {
RPEDEBUG2("Failed decoding attributes");
failure:
- return common_failure_notification_enter(mctx, request, eap_session);
+ return common_failure_notification_enter(p_result, mctx, request, eap_session);
}
/* vps is the data from the client */
aka_vps = fr_cursor_next(&cursor);
RDEBUG2("Received EAP-Response/%pV", &(*subtype_vp)->data);
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
/** FAILURE state - State machine exit point after sending EAP-Failure
* termination state. Could equally be a NULL pointer, but then on a logic error
* we'd get a SEGV instead of a more friendly assert/failure rcode.
*/
-static rlm_rcode_t common_eap_failure(UNUSED module_ctx_t const *mctx, UNUSED request_t *request)
+static unlang_action_t common_eap_failure(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, UNUSED request_t *request)
{
fr_assert(0); /* Should never actually be called */
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/** FAILURE-NOTIFICATION state - Continue the state machine after receiving a response to our EAP-Request/(AKA|SIM)-Notification
* - EAP-Response/SIM-Client-Error - Call 'recv Failure-Notification-Ack { ... }'
* - Anything else, enter the FAILURE-NOTIFICATION state.
*/
-static rlm_rcode_t common_failure_notification(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t common_failure_notification(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
- rlm_rcode_t rcode;
eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t);
eap_session_t *eap_session = eap_session_get(request->parent);
fr_pair_t *subtype_vp = NULL;
fr_pair_t *vps;
- rcode = common_decode(&subtype_vp, &vps, mctx, request);
- if (rcode != RLM_MODULE_OK) return rcode;
+ common_decode(&subtype_vp, &vps, p_result, mctx, request);
+ if (*p_result != RLM_MODULE_OK) return UNLANG_ACTION_CALCULATE_RESULT;
#ifdef __clang_analyzer__
- if (!subtype_vp) return RLM_MODULE_FAIL;
+ if (!subtype_vp) {
+ RETURN_MODULE_FAIL;
+ }
#endif
+
switch (subtype_vp->vp_uint16) {
case FR_SUBTYPE_VALUE_AKA_SIM_NOTIFICATION:
RDEBUG2("Failure-Notification ACKed, sending EAP-Failure");
- return unlang_module_yield_to_section(request,
+ return unlang_module_yield_to_section(p_result,
+ request,
inst->actions.recv_failure_notification_ack,
RLM_MODULE_NOOP,
common_failure_notification_recv_resume,
default:
RWDEBUG("Failure-Notification not ACKed correctly, sending EAP-Failure anyway");
- return common_eap_failure_enter(mctx, request, eap_session);
+ return common_eap_failure_enter(p_result, mctx, request, eap_session);
}
}
* termination state. Could equally be a NULL pointer, but then on a logic error
* we'd get a SEGV instead of a more friendly assert/failure rcode.
*/
-static rlm_rcode_t common_eap_success(UNUSED module_ctx_t const *mctx, UNUSED request_t *request)
+static unlang_action_t common_eap_success(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, UNUSED request_t *request)
{
fr_assert(0);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/** SUCCESS-NOTIFICATION state - Continue the state machine after receiving a response to our EAP-Request/(AKA|SIM)-Notification
*
* - Call 'recv Success-Notification-Ack { ... }'
*/
-static rlm_rcode_t common_success_notification(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t common_success_notification(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t);
- return unlang_module_yield_to_section(request,
+ return unlang_module_yield_to_section(p_result,
+ request,
inst->actions.recv_success_notification_ack,
RLM_MODULE_NOOP,
common_success_notification_ack_recv_resume,
* send a EAP-Request/(SIM|AKA)-Notification indicating a General Failure.
* - Anything else, enter the FAILURE-NOTIFICATION state.
*/
-static rlm_rcode_t common_reauthentication(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t common_reauthentication(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
- rlm_rcode_t rcode;
eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t);
eap_session_t *eap_session = eap_session_get(request->parent);
eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque,
fr_pair_t *subtype_vp = NULL;
fr_pair_t *from_peer;
- rcode = common_decode(&subtype_vp, &from_peer, mctx, request);
- if (rcode != RLM_MODULE_OK) return rcode;
+ common_decode(&subtype_vp, &from_peer, p_result, mctx, request);
+ if (*p_result != RLM_MODULE_OK) return UNLANG_ACTION_CALCULATE_RESULT;
#ifdef __clang_analyzer__
- if (!subtype_vp) return RLM_MODULE_FAIL;
+ if (!subtype_vp) {
+ RETURN_MODULE_FAIL;
+ }
#endif
/*
* These aren't allowed in Reauthentication responses as they don't apply:
* AT_COUNTER_TOO_SMALL is handled
* in common_reauthentication_response_process.
*/
- return unlang_module_yield_to_section(request,
+ return unlang_module_yield_to_section(p_result,
+ request,
inst->actions.recv_reauthentication_response,
RLM_MODULE_NOOP,
common_reauthentication_response_recv_resume,
eap_aka_sim_session->allow_encrypted = false;
- return unlang_module_yield_to_section(request,
+ return unlang_module_yield_to_section(p_result,
+ request,
inst->actions.recv_client_error,
RLM_MODULE_NOOP,
common_client_error_recv_resume,
default:
REDEBUG("Unexpected subtype %pV", &subtype_vp->data);
eap_aka_sim_session->allow_encrypted = false;
- return common_failure_notification_enter(mctx, request, eap_session);
+ return common_failure_notification_enter(p_result, mctx, request, eap_session);
}
}
* send a EAP-Request/AKA-Notification indicating a General Failure.
* - Anything else, enter the FAILURE-NOTIFICATION state.
*/
-static rlm_rcode_t aka_challenge(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t aka_challenge(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
- rlm_rcode_t rcode;
eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t);
eap_session_t *eap_session = eap_session_get(request->parent);
eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque, eap_aka_sim_session_t);
fr_pair_t *vp;
fr_pair_t *from_peer;
- rcode = common_decode(&subtype_vp, &from_peer, mctx, request);
- if (rcode != RLM_MODULE_OK) return rcode;
+ common_decode(&subtype_vp, &from_peer, p_result, mctx, request);
+ if (*p_result != RLM_MODULE_OK) return UNLANG_ACTION_CALCULATE_RESULT;
#ifdef __clang_analyzer__
- if (!subtype_vp) return RLM_MODULE_FAIL;
+ if (!subtype_vp) {
+ RETURN_MODULE_FAIL;
+ }
#endif
+
switch (subtype_vp->vp_uint16) {
case FR_SUBTYPE_VALUE_AKA_CHALLENGE:
- return unlang_module_yield_to_section(request,
+ return unlang_module_yield_to_section(p_result,
+ request,
inst->actions.recv_challenge_response,
RLM_MODULE_NOOP,
aka_challenge_response_recv_resume,
case FR_SUBTYPE_VALUE_AKA_AUTHENTICATION_REJECT:
eap_aka_sim_session->allow_encrypted = false;
- return unlang_module_yield_to_section(request,
+ return unlang_module_yield_to_section(p_result,
+ request,
inst->actions.aka.recv_authentication_reject,
RLM_MODULE_NOOP,
aka_authentication_reject_recv_resume,
if (!vp) {
REDEBUG("EAP-Response/AKA-Synchronisation-Failure missing AT_AUTS");
failure:
- return common_failure_notification_enter(mctx, request, eap_session);
+ return common_failure_notification_enter(p_result, mctx, request, eap_session);
}
switch (fr_aka_sim_umts_resync_from_attrs(&new_sqn,
goto failure;
}
- return unlang_module_yield_to_section(request,
+ return unlang_module_yield_to_section(p_result,
+ request,
inst->actions.aka.recv_syncronization_failure,
RLM_MODULE_NOOP,
aka_synchronization_failure_recv_resume,
eap_aka_sim_session->allow_encrypted = false;
- return unlang_module_yield_to_section(request,
+ return unlang_module_yield_to_section(p_result,
+ request,
inst->actions.recv_client_error,
RLM_MODULE_NOOP,
common_client_error_recv_resume,
* send a EAP-Request/SIM-Notification indicating a General Failure.
* - Anything else, enter the FAILURE-NOTIFICATION state.
*/
-static rlm_rcode_t sim_challenge(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t sim_challenge(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
- rlm_rcode_t rcode;
eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t);
eap_session_t *eap_session = eap_session_get(request->parent);
eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque,
fr_pair_t *subtype_vp = NULL;
fr_pair_t *from_peer;
- rcode = common_decode(&subtype_vp, &from_peer, mctx, request);
- if (rcode != RLM_MODULE_OK) return rcode;
+ common_decode(&subtype_vp, &from_peer, p_result, mctx, request);
+ if (*p_result != RLM_MODULE_OK) return UNLANG_ACTION_CALCULATE_RESULT;
#ifdef __clang_analyzer__
- if (!subtype_vp) return RLM_MODULE_FAIL;
+ if (!subtype_vp) {
+ RETURN_MODULE_FAIL;
+ }
#endif
+
switch (subtype_vp->vp_uint16) {
case FR_SUBTYPE_VALUE_SIM_CHALLENGE:
- return unlang_module_yield_to_section(request,
+ return unlang_module_yield_to_section(p_result,
+ request,
inst->actions.recv_challenge_response,
RLM_MODULE_NOOP,
sim_challenge_response_recv_resume,
eap_aka_sim_session->allow_encrypted = false;
- return unlang_module_yield_to_section(request,
+ return unlang_module_yield_to_section(p_result,
+ request,
inst->actions.recv_client_error,
RLM_MODULE_NOOP,
common_client_error_recv_resume,
eap_aka_sim_session->allow_encrypted = false;
- return common_failure_notification_enter(mctx, request, eap_session);
+ return common_failure_notification_enter(p_result, mctx, request, eap_session);
}
}
* send a EAP-Request/SIM-Notification indicating a General Failure.
* - Anything else, enter the FAILURE-NOTIFICATION state.
*/
-static rlm_rcode_t aka_identity(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t aka_identity(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
- rlm_rcode_t rcode;
eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t);
eap_session_t *eap_session = eap_session_get(request->parent);
eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque,
fr_pair_t *subtype_vp = NULL;
fr_pair_t *from_peer;
- rcode = common_decode(&subtype_vp, &from_peer, mctx, request);
- if (rcode != RLM_MODULE_OK) return rcode;
+ common_decode(&subtype_vp, &from_peer, p_result, mctx, request);
+ if (*p_result != RLM_MODULE_OK) return UNLANG_ACTION_CALCULATE_RESULT;
#ifdef __clang_analyzer__
- if (!subtype_vp) return RLM_MODULE_FAIL;
+ if (!subtype_vp) {
+ RETURN_MODULE_FAIL;
+ }
#endif
switch (subtype_vp->vp_uint16) {
* AT_IDENTITY is defined in Section 4.1.
*/
REDEBUG("EAP-Response/Identity does not contain AT_IDENTITY");
- return common_failure_notification_enter(mctx, request, eap_session);
+ return common_failure_notification_enter(p_result, mctx, request, eap_session);
}
/*
identity_to_crypto_identity(request, eap_aka_sim_session,
(uint8_t const *)id->vp_strvalue, id->vp_length);
- return unlang_module_yield_to_section(request,
+ return unlang_module_yield_to_section(p_result,
+ request,
inst->actions.aka.recv_aka_identity_response?
inst->actions.aka.recv_aka_identity_response:
inst->actions.recv_identity_response,
case FR_SUBTYPE_VALUE_AKA_SIM_CLIENT_ERROR:
client_error_debug(request, from_peer);
- return unlang_module_yield_to_section(request,
+ return unlang_module_yield_to_section(p_result,
+ request,
inst->actions.recv_client_error,
RLM_MODULE_NOOP,
common_client_error_recv_resume,
* send an EAP-Failure in this case.
*/
REDEBUG("Unexpected subtype %pV", &subtype_vp->data);
- return common_failure_notification_enter(mctx, request, eap_session);
+ return common_failure_notification_enter(p_result, mctx, request, eap_session);
}
}
* send a EAP-Request/SIM-Notification indicating a General Failure.
* - Anything else, enter the FAILURE-NOTIFICATION state.
*/
-static rlm_rcode_t sim_start(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t sim_start(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
- rlm_rcode_t rcode;
eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t);
eap_session_t *eap_session = eap_session_get(request->parent);
eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque,
fr_pair_t *subtype_vp = NULL;
fr_pair_t *from_peer;
- rcode = common_decode(&subtype_vp, &from_peer, mctx, request);
- if (rcode != RLM_MODULE_OK) return rcode;
+ common_decode(&subtype_vp, &from_peer, p_result, mctx, request);
+ if (*p_result != RLM_MODULE_OK) return UNLANG_ACTION_CALCULATE_RESULT;
#ifdef __clang_analyzer__
- if (!subtype_vp) return RLM_MODULE_FAIL;
+ if (!subtype_vp) {
+ RETURN_MODULE_FAIL;
+ }
#endif
switch (subtype_vp->vp_uint16) {
* AT_IDENTITY is defined in Section 4.1.
*/
REDEBUG("EAP-Response/SIM/Start does not contain AT_IDENTITY");
- return common_failure_notification_enter(mctx, request, eap_session);
+ return common_failure_notification_enter(p_result, mctx, request, eap_session);
}
/*
identity_to_crypto_identity(request, eap_aka_sim_session,
(uint8_t const *)id->vp_strvalue, id->vp_length);
- return unlang_module_yield_to_section(request,
+ return unlang_module_yield_to_section(p_result,
+ request,
inst->actions.sim.recv_sim_start_response?
inst->actions.sim.recv_sim_start_response:
inst->actions.recv_identity_response,
case FR_SUBTYPE_VALUE_AKA_SIM_CLIENT_ERROR:
client_error_debug(request, from_peer);
- return unlang_module_yield_to_section(request,
+ return unlang_module_yield_to_section(p_result,
+ request,
inst->actions.recv_client_error,
RLM_MODULE_NOOP,
common_client_error_recv_resume,
* send an EAP-Failure in this case.
*/
REDEBUG("Unexpected subtype %pV", &subtype_vp->data);
- return common_failure_notification_enter(mctx, request, eap_session);
+ return common_failure_notification_enter(p_result, mctx, request, eap_session);
}
}
* - If identity is a fastauth identity, enter the REAUTHENTICATE state.
* - If identity is a permanent identity, enter the CHALLENGE state.
*/
-static rlm_rcode_t common_eap_identity_resume(module_ctx_t const *mctx, request_t *request, UNUSED void *rctx)
+static unlang_action_t common_eap_identity_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, UNUSED void *rctx)
{
eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t);
eap_session_t *eap_session = eap_session_get(request->parent);
fr_aka_sim_method_hint_t running, hinted;
fr_pair_t *from_peer = request->request_pairs;
- section_rcode_process(mctx, request, eap_session, eap_aka_sim_session);
+ section_rcode_process(p_result, mctx,request, eap_session, eap_aka_sim_session);
/*
* Ignore attempts to change the EAP-Type
default:
fr_assert(0);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/*
* can 'decorate' the identity in the identity
* response.
*/
- if (eap_aka_sim_session->id_req != AKA_SIM_NO_ID_REQ) return common_identity_enter(mctx, request, eap_session);
+ if (eap_aka_sim_session->id_req != AKA_SIM_NO_ID_REQ) return common_identity_enter(p_result, mctx, request, eap_session);
/*
* If the identity looks like a fast re-auth id
identity_type = fr_pair_find_by_da(&from_peer, attr_eap_aka_sim_identity_type);
if (identity_type) switch (identity_type->vp_uint32) {
case FR_IDENTITY_TYPE_VALUE_FASTAUTH:
- return common_reauthentication_enter(mctx, request, eap_session);
+ return common_reauthentication_enter(p_result, mctx, request, eap_session);
/*
* It's a pseudonym, which now needs resolving.
* if pseudonym resolution went ok.
*/
case FR_IDENTITY_TYPE_VALUE_PSEUDONYM:
- return unlang_module_yield_to_section(request,
+ return unlang_module_yield_to_section(p_result,
+ request,
inst->actions.load_pseudonym,
RLM_MODULE_NOOP,
pseudonym_load_resume,
break;
}
- return common_challenge_enter(mctx, request, eap_session);
+ return common_challenge_enter(p_result, mctx, request, eap_session);
}
/** Zero out the eap_aka_sim_session when we free it to clear knowledge of secret keys
* - Process the incoming EAP-Identity-Response
* - Start EAP-SIM/EAP-AKA/EAP-AKA' state machine optionally calling 'recv Identity-Response { ... }'
*/
-rlm_rcode_t aka_sim_state_machine_start(module_ctx_t const *mctx, request_t *request)
+unlang_action_t aka_sim_state_machine_start(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t);
eap_session_t *eap_session = eap_session_get(request->parent);
*/
if (!eap_session->identity) {
REDEBUG("All SIM or AKA exchanges must begin with a EAP-Response/Identity message");
- return common_failure_notification_enter(mctx, request, eap_session);
+ return common_failure_notification_enter(p_result, mctx, request, eap_session);
}
/*
* Running the same section as Identity-Response
* makes policies significantly easier.
*/
- return unlang_module_yield_to_section(request,
+ return unlang_module_yield_to_section(p_result,
+ request,
inst->actions.recv_identity_response,
RLM_MODULE_NOOP,
common_eap_identity_resume,
/*
* The main entry point
*/
-rlm_rcode_t aka_sim_state_machine_start(module_ctx_t const *mctx, request_t *request);
+unlang_action_t aka_sim_state_machine_start(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request);
{
fr_io_pending_packet_t const *a = talloc_get_type_abort_const(one, fr_io_pending_packet_t);
fr_io_pending_packet_t const *b = talloc_get_type_abort_const(two, fr_io_pending_packet_t);
- int rcode;
+ int ret;
/*
* Higher priority elements are larger than lower
* priority elements. So if "a" is larger than "b", we
* wish to prefer "a".
*/
- rcode = COMPARE_PREFER_LARGER(a->priority, b->priority);
- if (rcode != 0) return rcode;
+ ret = COMPARE_PREFER_LARGER(a->priority, b->priority);
+ if (ret != 0) return ret;
/*
* Smaller numbers mean packets were received earlier.
static int8_t address_cmp(void const *one, void const *two)
{
- int rcode;
+ int ret;
fr_io_address_t const *a = talloc_get_type_abort_const(one, fr_io_address_t);
fr_io_address_t const *b = talloc_get_type_abort_const(two, fr_io_address_t);;
- rcode = STABLE_COMPARE(a->socket.inet.src_port, b->socket.inet.src_port);
- if (rcode != 0) return rcode;
+ ret = STABLE_COMPARE(a->socket.inet.src_port, b->socket.inet.src_port);
+ if (ret != 0) return ret;
- rcode = STABLE_COMPARE(a->socket.inet.dst_port, b->socket.inet.dst_port);
- if (rcode != 0) return rcode;
+ ret = STABLE_COMPARE(a->socket.inet.dst_port, b->socket.inet.dst_port);
+ if (ret != 0) return ret;
- rcode = STABLE_COMPARE(a->socket.inet.ifindex, b->socket.inet.ifindex);
- if (rcode != 0) return rcode;
+ ret = STABLE_COMPARE(a->socket.inet.ifindex, b->socket.inet.ifindex);
+ if (ret != 0) return ret;
- rcode = fr_ipaddr_cmp(&a->socket.inet.src_ipaddr, &b->socket.inet.src_ipaddr);
- if (rcode != 0) return rcode;
+ ret = fr_ipaddr_cmp(&a->socket.inet.src_ipaddr, &b->socket.inet.src_ipaddr);
+ if (ret != 0) return ret;
return fr_ipaddr_cmp(&a->socket.inet.dst_ipaddr, &b->socket.inet.dst_ipaddr);
}
{
fr_io_track_t const *a = talloc_get_type_abort_const(one, fr_io_track_t);
fr_io_track_t const *b = talloc_get_type_abort_const(two, fr_io_track_t);
- int rcode;
+ int ret;
fr_assert(a->client != NULL);
fr_assert(b->client != NULL);
/*
* Unconnected sockets must check src/dst ip/port.
*/
- rcode = address_cmp(a->address, b->address);
- if (rcode != 0) return rcode;
+ ret = address_cmp(a->address, b->address);
+ if (ret != 0) return ret;
/*
* Call the per-protocol comparison function.
fr_io_address_t *address,
fr_io_connection_t *nak)
{
- int rcode;
+ int ret;
fr_io_connection_t *connection;
dl_module_inst_t *dl_inst = NULL;
fr_listen_t *li;
*/
pthread_mutex_lock(&client->mutex);
if (nak) (void) fr_hash_table_delete(client->ht, nak);
- rcode = fr_hash_table_insert(client->ht, connection);
+ ret = fr_hash_table_insert(client->ht, connection);
client->ready_to_delete = false;
pthread_mutex_unlock(&client->mutex);
- if (rcode < 0) {
+ if (ret < 0) {
ERROR("proto_%s - Failed inserting connection into tracking table. Closing it, and discarding all packets for connection %s.", inst->app_io->name, connection->name);
goto cleanup;
}
get_inst(li, &inst, NULL, &connection, &child);
if (inst->app_io->close) {
- int rcode;
+ int ret;
- rcode = inst->app_io->close(child);
- if (rcode < 0) return rcode;
+ ret = inst->app_io->close(child);
+ if (ret < 0) return ret;
} else {
close(child->fd);
// child->fd = -1;
/*
* Everything else, run the request.
*/
- final = request->async->process(&(module_ctx_t){ .instance = request->async->process_inst }, request);
+ request->async->process(&final, &(module_ctx_t){ .instance = request->async->process_inst }, request);
/*
* Figure out what to do next.
* Run a virtual server auth and postauth
*
*/
-rlm_rcode_t rad_virtual_server(request_t *request)
+unlang_action_t rad_virtual_server(rlm_rcode_t *p_result, request_t *request)
{
fr_pair_t *vp, *username, *parent_username = NULL;
rlm_rcode_t final;
runit:
if (!request->async) {
#ifdef __clang_analyzer__
- if (!request->parent) return RLM_MODULE_FAIL;
+ if (!request->parent) RETURN_MODULE_FAIL;
#endif
fr_assert(request->parent != NULL);
}
RDEBUG("server %s {", cf_section_name2(request->server_cs));
- final = request->async->process(&(module_ctx_t){ .instance = request->async->process_inst }, request);
+ request->async->process(&final, &(module_ctx_t){ .instance = request->async->process_inst }, request);
RDEBUG("} # server %s", cf_section_name2(request->server_cs));
fr_cond_assert(final == RLM_MODULE_OK);
if (!request->reply->code ||
(request->reply->code == FR_CODE_ACCESS_REJECT)) {
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
}
if (request->reply->code == FR_CODE_ACCESS_CHALLENGE) {
- return RLM_MODULE_HANDLED;
+ RETURN_MODULE_HANDLED;
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
/*
#include <freeradius-devel/server/request.h>
#include <freeradius-devel/server/rcode.h>
-rlm_rcode_t rad_virtual_server(request_t *);
+unlang_action_t rad_virtual_server(rlm_rcode_t *p_result, request_t *request);
#ifdef __cplusplus
}
#ifndef WITH_TRIE
static int client_cmp(void const *one, void const *two)
{
- int rcode;
+ int ret;
RADCLIENT const *a = one;
RADCLIENT const *b = two;
- rcode = fr_ipaddr_cmp(&a->ipaddr, &b->ipaddr);
- if (rcode != 0) return rcode;
+ ret = fr_ipaddr_cmp(&a->ipaddr, &b->ipaddr);
+ if (ret != 0) return ret;
/*
* 0 is "wildcard", or "both" protocols
static int fr_command_add_syntax(TALLOC_CTX *ctx, char *syntax, fr_cmd_argv_t **head, bool allow_varargs)
{
- int i, rcode;
+ int i, ret;
char *name, *p;
fr_cmd_argv_t **last, *prev;
for (i = 0; i < CMD_MAX_ARGV; i++) {
fr_cmd_argv_t *argv;
- rcode = split(&p, &name, true);
- if (rcode < 0) return rcode;
+ ret = split(&p, &name, true);
+ if (ret < 0) return ret;
- if (rcode == 0) return i;
+ if (ret == 0) return i;
/*
* Check for varargs. Which MUST NOT be
/*
* varargs can't be inside an optional block
*/
- rcode = fr_command_add_syntax(option, option, &child, false);
- if (rcode < 0) return rcode;
+ ret = fr_command_add_syntax(option, option, &child, false);
+ if (ret < 0) return ret;
argv = talloc_zero(ctx, fr_cmd_argv_t);
argv->name = name;
while (true) {
fr_cmd_argv_t *choice, *sub;
- rcode = split_alternation(&q, &word);
- if (rcode < 0) return rcode;
- if (rcode == 0) break;
+ ret = split_alternation(&q, &word);
+ if (ret < 0) return ret;
+ if (ret == 0) break;
sub = NULL;
/*
* varargs can't be inside an alternation block
*/
- rcode = fr_command_add_syntax(option, word, &sub, false);
- if (rcode < 0) return rcode;
+ ret = fr_command_add_syntax(option, word, &sub, false);
+ if (ret < 0) return ret;
choice = talloc_zero(option, fr_cmd_argv_t);
choice->name = word;
* does not yet exist.
*/
if (table->parent) {
- int i, rcode;
+ int i, ret;
char *p;
char *parents[CMD_MAX_ARGV];
p = talloc_strdup(talloc_ctx, table->parent);
for (i = 0; i < CMD_MAX_ARGV; i++) {
- rcode = split(&p, &parents[i], true);
- if (rcode < 0) return -1;
- if (rcode == 0) break;
+ ret = split(&p, &parents[i], true);
+ if (ret < 0) return -1;
+ if (ret == 0) break;
if (!fr_command_valid_name(parents[i])) {
fr_strerror_printf("Invalid command name '%s'", parents[i]);
*/
int fr_command_walk(fr_cmd_t *head, void **walk_ctx, void *ctx, fr_cmd_walk_t callback)
{
- int rcode;
+ int ret;
fr_cmd_stack_t *stack;
fr_cmd_t *cmd = NULL;
fr_cmd_walk_info_t info;
/*
* Run the callback, but only for user-defined commands.
*/
- rcode = callback(ctx, &info);
- if (rcode <= 0) {
+ ret = callback(ctx, &info);
+ if (ret <= 0) {
talloc_free(stack);
*walk_ctx = NULL;
- return rcode;
+ return ret;
}
/*
* "foo" and "bar".
*/
if (argv->type == FR_TYPE_ALTERNATE) {
- int count, rcode;
+ int count, ret;
fr_cmd_argv_t *child;
count = 0;
for (child = argv->child; child != NULL; child = child->next) {
if (count >= max_expansions) return count;
- rcode = fr_command_tab_expand_argv(ctx, cmd, info, name, child, max_expansions - count, &expansions[count]);
- if (!rcode) continue;
+ ret = fr_command_tab_expand_argv(ctx, cmd, info, name, child, max_expansions - count, &expansions[count]);
+ if (!ret) continue;
count++;
}
static int fr_command_tab_expand_syntax(TALLOC_CTX *ctx, fr_cmd_t *cmd, int syntax_offset, fr_cmd_info_t *info,
int max_expansions, char const **expansions)
{
- int rcode;
+ int ret;
fr_cmd_argv_t *argv = cmd->syntax_argv;
- rcode = fr_command_verify_argv(info, syntax_offset, info->argc - 1, info->argc - 1, &argv, false);
- if (rcode < 0) return -1;
+ ret = fr_command_verify_argv(info, syntax_offset, info->argc - 1, info->argc - 1, &argv, false);
+ if (ret < 0) return -1;
/*
* We've found the last argv. See if we need to expand it.
*/
- return fr_command_tab_expand_argv(ctx, cmd, info, info->argv[syntax_offset + rcode], argv, max_expansions, expansions);
+ return fr_command_tab_expand_argv(ctx, cmd, info, info->argv[syntax_offset + ret], argv, max_expansions, expansions);
}
static int fr_command_run_partial(FILE *fp, FILE *fp_err, fr_cmd_info_t *info, bool read_only, int offset, fr_cmd_t *head)
{
- int i, rcode;
+ int i, ret;
fr_cmd_t *start, *cmd = NULL;
fr_cmd_info_t my_info;
my_info.runnable = true;
my_info.argv = &info->argv[i + 1];
my_info.box = &info->box[i + 1];
- rcode = cmd->func(fp, fp_err, cmd->ctx, &my_info);
+ ret = cmd->func(fp, fp_err, cmd->ctx, &my_info);
- return rcode;
+ return ret;
}
*/
int fr_command_run(FILE *fp, FILE *fp_err, fr_cmd_info_t *info, bool read_only)
{
- int i, rcode;
+ int i, ret;
fr_cmd_t *cmd;
fr_cmd_info_t my_info;
fprintf(fp, "%s %s\n", info->argv[i - 1], cmd->name);
info->argv[i] = cmd->name;
- rcode = fr_command_run_partial(fp, fp_err, info, read_only, i, cmd);
- if (rcode < 0) return rcode;
+ ret = fr_command_run_partial(fp, fp_err, info, read_only, i, cmd);
+ if (ret < 0) return ret;
}
return 0;
my_info.runnable = true;
my_info.argv = &info->argv[i + 1];
my_info.box = &info->box[i + 1];
- rcode = cmd->func(fp, fp_err, cmd->ctx, &my_info);
+ ret = cmd->func(fp, fp_err, cmd->ctx, &my_info);
- return rcode;
+ return ret;
}
static int fr_command_verify_argv(fr_cmd_info_t *info, int start, int verify, int argc, fr_cmd_argv_t **argv_p, bool optional)
{
char quote;
- int used = 0, rcode;
+ int used = 0, ret;
fr_type_t type;
fr_value_box_t *box, my_box;
char const *name;
if (type == FR_TYPE_OPTIONAL) {
child = argv->child;
- rcode = fr_command_verify_argv(info, start + used, verify, argc, &child, true);
- if (rcode < 0) return rcode;
+ ret = fr_command_verify_argv(info, start + used, verify, argc, &child, true);
+ if (ret < 0) return ret;
/*
* No match, that's OK. Skip it.
*/
- if (rcode == 0) {
+ if (ret == 0) {
goto next;
}
/*
* We've used SOME of the input.
*/
- used += rcode;
+ used += ret;
/*
* But perhaps not all of it. If so, remember
fr_assert(child->child != NULL);
sub = child->child;
- rcode = fr_command_verify_argv(info, start + used, verify, argc, &sub, true);
- if (rcode <= 0) continue;
+ ret = fr_command_verify_argv(info, start + used, verify, argc, &sub, true);
+ if (ret <= 0) continue;
/*
* Only a partial match. Return that.
*/
if (sub) {
*argv_p = argv;
- return used + rcode;
+ return used + ret;
}
- used += rcode;
+ used += ret;
goto next;
}
char const **text, bool *runnable)
{
int argc = start_argc;
- int rcode;
+ int ret;
bool child_done;
char const *word, *my_word, *p, *q;
fr_cmd_argv_t *argv = start;
info->box[argc] = talloc_zero(info->box, fr_value_box_t);
}
- rcode = fr_value_box_from_str(info->box[argc], info->box[argc],
+ ret = fr_value_box_from_str(info->box[argc], info->box[argc],
&type, NULL,
word + offset, len - (offset << 1), quote, false);
- if (rcode < 0) return -1;
+ if (ret < 0) return -1;
/*
* Note that argv[i] is the *input* string.
* "192.168.0.1" is not a valid
* INTEGER, but it is a valid IPADDR.
*/
- rcode = syntax_str_to_argv(argc, sub, info, &my_word, &child_done);
- if (rcode <= 0) continue;
+ ret = syntax_str_to_argv(argc, sub, info, &my_word, &child_done);
+ if (ret <= 0) continue;
goto skip_child;
}
child = argv->child;
my_word = word;
- rcode = syntax_str_to_argv(argc, child, info, &my_word, &child_done);
- if (rcode < 0) return rcode;
+ ret = syntax_str_to_argv(argc, child, info, &my_word, &child_done);
+ if (ret < 0) return ret;
/*
* Didn't match anything, skip it.
*/
- if (rcode == 0) goto next;
+ if (ret == 0) goto next;
skip_child:
/*
* We've eaten more input, remember that,
*/
- argc += rcode;
+ argc += ret;
word = my_word;
/*
*/
int fr_command_str_to_argv(fr_cmd_t *head, fr_cmd_info_t *info, char const *text)
{
- int argc, rcode;
+ int argc, ret;
char const *word, *p, *q;
fr_cmd_t *cmd;
/*
* Do recursive checks on the input string.
*/
- rcode = syntax_str_to_argv(argc, cmd->syntax_argv, info, &word, &info->runnable);
- if (rcode < 0) return rcode;
+ ret = syntax_str_to_argv(argc, cmd->syntax_argv, info, &word, &info->runnable);
+ if (ret < 0) return ret;
- argc += rcode;
+ argc += ret;
/*
* Run out of options to parse, but there's still more
}
if ((argv->type < FR_TYPE_FIXED) && cmd->tab_expand) {
- int rcode;
+ int ret;
info->argv[info->argc] = "";
info->box[info->argc] = NULL;
info->argc++;
fr_assert(count == 0);
- rcode = cmd->tab_expand(NULL, cmd->ctx, info, max_expansions - count, expansions + count);
- if (rcode < 0) return rcode;
+ ret = cmd->tab_expand(NULL, cmd->ctx, info, max_expansions - count, expansions + count);
+ if (ret < 0) return ret;
- return count + rcode;
+ return count + ret;
}
expansions[count] = strdup(argv->name);
* Check data types.
*/
if (argv->type < FR_TYPE_FIXED) {
- int rcode;
+ int ret;
size_t len, offset;
char quote, *my_word;
fr_type_t type = argv->type;
* Expand this thing.
*/
fr_assert(count == 0);
- rcode = cmd->tab_expand(NULL, cmd->ctx, info, max_expansions - count, expansions + count);
- if (rcode < 0) return rcode;
- return count + rcode;
+ ret = cmd->tab_expand(NULL, cmd->ctx, info, max_expansions - count, expansions + count);
+ if (ret < 0) return ret;
+ return count + ret;
}
len = p - word;
offset = 0;
}
- rcode = fr_value_box_from_str(info->box[info->argc], info->box[info->argc],
+ ret = fr_value_box_from_str(info->box[info->argc], info->box[info->argc],
&type, NULL,
word + offset, len - (offset << 1), quote, false);
- if (rcode < 0) return -1;
+ if (ret < 0) return -1;
info->argc++;
*word_p = word = p;
continue;
#include <freeradius-devel/server/cf_util.h>
#include <freeradius-devel/server/request.h>
+#include <freeradius-devel/unlang/action.h>
#include <freeradius-devel/util/event.h>
typedef struct module_s module_t;
* @param[in] request to process.
* @return the appropriate rcode.
*/
-typedef rlm_rcode_t (*module_method_t)(module_ctx_t const *mctx, request_t *request);
+typedef unlang_action_t (*module_method_t)(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request);
/** Module instantiation callback
*
RCSIDH(rcode_h, "$Id$")
#include <freeradius-devel/util/table.h>
+#include <freeradius-devel/unlang/action.h>
#ifdef __cplusplus
extern "C" {
RLM_MODULE_UNKNOWN, //!< Error resolving rcode (should not be
//!< returned by modules).
} rlm_rcode_t;
+
+#define RETURN_MODULE_REJECT do { *p_result = RLM_MODULE_REJECT; return UNLANG_ACTION_CALCULATE_RESULT; } while (0)
+#define RETURN_MODULE_FAIL do { *p_result = RLM_MODULE_FAIL; return UNLANG_ACTION_CALCULATE_RESULT; } while (0)
+#define RETURN_MODULE_OK do { *p_result = RLM_MODULE_OK; return UNLANG_ACTION_CALCULATE_RESULT; } while (0)
+#define RETURN_MODULE_HANDLED do { *p_result = RLM_MODULE_HANDLED; return UNLANG_ACTION_CALCULATE_RESULT; } while (0)
+#define RETURN_MODULE_INVALID do { *p_result = RLM_MODULE_INVALID; return UNLANG_ACTION_CALCULATE_RESULT; } while (0)
+#define RETURN_MODULE_DISALLOW do { *p_result = RLM_MODULE_DISALLOW; return UNLANG_ACTION_CALCULATE_RESULT; } while (0)
+#define RETURN_MODULE_NOTFOUND do { *p_result = RLM_MODULE_NOTFOUND; return UNLANG_ACTION_CALCULATE_RESULT; } while (0)
+#define RETURN_MODULE_NOOP do { *p_result = RLM_MODULE_NOOP; return UNLANG_ACTION_CALCULATE_RESULT; } while (0)
+#define RETURN_MODULE_UPDATED do { *p_result = RLM_MODULE_UPDATED; return UNLANG_ACTION_CALCULATE_RESULT; } while (0)
+#define RETURN_MODULE_RCODE(_rcode) do { *p_result = (_rcode); return UNLANG_ACTION_CALCULATE_RESULT; } while (0)
+
extern fr_table_num_sorted_t const rcode_table[];
extern size_t rcode_table_len;
bool expanded;
} fr_trigger_t;
-static rlm_rcode_t trigger_process(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t trigger_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
fr_trigger_t *ctx = talloc_get_type_abort(mctx->instance, fr_trigger_t);
rlm_rcode_t rcode;
(void) fr_pair_list_copy(request->packet, &request->request_pairs, &ctx->vps);
if (unlang_interpret_push_instruction(request, NULL,
- RLM_MODULE_REJECT, UNLANG_TOP_FRAME) < 0) return RLM_MODULE_FAIL;
- if (unlang_xlat_push(request, &ctx->box, request, ctx->xlat, true) < 0) return RLM_MODULE_FAIL;
+ RLM_MODULE_REJECT, UNLANG_TOP_FRAME) < 0) {
+ RETURN_MODULE_FAIL;
+ }
+ if (unlang_xlat_push(request, &ctx->box, request, ctx->xlat, true) < 0) {
+ RETURN_MODULE_FAIL;
+ }
ctx->expanded = true;
/*
*/
rcode = unlang_interpret(request);
- if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED;
+ if (request->master_state == REQUEST_STOP_PROCESSING) {
+ RETURN_MODULE_HANDLED;
+ }
- if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD;
+ if (rcode == RLM_MODULE_YIELD) {
+ *p_result = RLM_MODULE_YIELD;
+ return UNLANG_ACTION_YIELD;
+ }
/*
* Always fall through, no matter what the return code is.
if (!ctx->box) {
RERROR("Failed trigger %s - did not expand to anything", ctx->name);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/*
*/
if (fr_exec_nowait(request, ctx->box, NULL) < 0) {
RPERROR("Failed trigger %s", ctx->name);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
{
fr_trunk_t *trunk = treq->pub.trunk;
fr_trunk_connection_t *tconn = NULL;
- fr_trunk_enqueue_t rcode;
+ fr_trunk_enqueue_t ret;
/*
* Must *NOT* still be assigned to another connection
*/
fr_assert(!treq->pub.tconn);
- rcode = trunk_request_check_enqueue(&tconn, trunk, treq->pub.request);
- switch (rcode) {
+ ret = trunk_request_check_enqueue(&tconn, trunk, treq->pub.request);
+ switch (ret) {
case FR_TRUNK_ENQUEUE_OK:
if (trunk->conf.always_writable) {
fr_connection_signals_pause(tconn->pub.conn);
break;
}
- return rcode;
+ return ret;
}
/** Shift requests in the specified states onto new connections
{
fr_trunk_connection_t *tconn = NULL;
fr_trunk_request_t *treq;
- fr_trunk_enqueue_t rcode;
+ fr_trunk_enqueue_t ret;
if (!fr_cond_assert_msg(!IN_HANDLER(trunk),
"%s cannot be called within a handler", __FUNCTION__)) return FR_TRUNK_ENQUEUE_FAIL;
if (fr_trunk_start(trunk) < 0) return FR_TRUNK_ENQUEUE_FAIL;
}
- rcode = trunk_request_check_enqueue(&tconn, trunk, request);
- switch (rcode) {
+ ret = trunk_request_check_enqueue(&tconn, trunk, request);
+ switch (ret) {
case FR_TRUNK_ENQUEUE_OK:
if (*treq_out) {
treq = *treq_out;
treq->pub.preq = preq;
treq->pub.rctx = rctx;
}
- return rcode;
+ return ret;
}
- return rcode;
+ return ret;
}
/** Re-enqueue a request on the same connection
/**
*/
-rlm_rcode_t process_authenticate(int auth_type, request_t *request)
+unlang_action_t process_authenticate(rlm_rcode_t *p_result, int auth_type, request_t *request)
{
rlm_rcode_t rcode;
CONF_SECTION *cs, *server_cs;
RDEBUG2("Empty 'authenticate' section in virtual server \"%s\". Using default return value (%s)",
cf_section_name2(request->server_cs),
fr_table_str_by_value(rcode_table, RLM_MODULE_REJECT, "<invalid>"));
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
}
/*
*/
if (!auth_type) {
RERROR("An 'Auth-Type' MUST be specified");
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
}
dict_internal = fr_dict_internal();
da = fr_dict_attr_child_by_num(fr_dict_root(dict_internal), FR_AUTH_TYPE);
- if (!da) return RLM_MODULE_FAIL;
+ if (!da) RETURN_MODULE_FAIL;
dv = fr_dict_enum_by_value(da, fr_box_uint32((uint32_t) auth_type));
- if (!dv) return RLM_MODULE_FAIL;
+ if (!dv) RETURN_MODULE_FAIL;
subcs = cf_section_find(cs, da->name, dv->name);
if (!subcs) {
RDEBUG2("%s %s sub-section not found. Using default return values.",
da->name, dv->name);
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
}
RDEBUG("Running %s %s from file %s",
request->module = module;
request->server_cs = server_cs;
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
rlm_rcode_t virtual_server_process_auth(request_t *request, CONF_SECTION *virtual_server,
fr_pair_t *vp;
CONF_SECTION *auth_cs = NULL;
char const *auth_name;
+ rlm_rcode_t rcode = RLM_MODULE_NOOP;
vp = fr_pair_find_by_da(&request->control_pairs, attr_auth_type);
if (!vp) {
RDEBUG2("No &control.Auth-Type found");
fail:
request->rcode = RLM_MODULE_FAIL;
- return unlang_module_yield_to_section(request, NULL, RLM_MODULE_FAIL, resume, signal, rctx);
+ unlang_module_yield_to_section(&rcode, request, NULL, RLM_MODULE_FAIL, resume, signal, rctx);
+ return rcode;
}
auth_name = fr_dict_enum_name_by_value(attr_auth_type, &vp->data);
goto fail;
}
- return unlang_module_yield_to_section(request, auth_cs, default_rcode, resume, signal, rctx);
+ unlang_module_yield_to_section(&rcode, request, auth_cs, default_rcode, resume, signal, rctx);
+ return rcode;
}
/*
CONF_ITEM *ci);
/** @} */
-rlm_rcode_t process_authenticate(int type, request_t *request);
+unlang_action_t process_authenticate(rlm_rcode_t *p_result, int auth_type, request_t *request);
rlm_rcode_t virtual_server_process_auth(request_t *request, CONF_SECTION *virtual_server,
rlm_rcode_t default_rcode,
/*
* tls/cache.c
*/
-int fr_tls_cache_process(request_t *request, CONF_SECTION *action);
+unlang_action_t fr_tls_cache_process(rlm_rcode_t *p_result, request_t *request, CONF_SECTION *action);
int fr_tls_cache_compile(fr_tls_cache_t *sections, CONF_SECTION *server_cs);
/** Execute the virtual server configured to perform cache actions
*
+ * @param[out] p_result from the virtual server.
* @param[in] request The current request.
* @param[in] action to execute.
- * @return the rcode from the virtual server.
*/
-int fr_tls_cache_process(request_t *request, CONF_SECTION *action)
+unlang_action_t fr_tls_cache_process(rlm_rcode_t *p_result, request_t *request, CONF_SECTION *action)
{
rlm_rcode_t rcode;
CONF_SECTION *server_cs;
char const *module;
char const *component;
- if (!action) return RLM_MODULE_NOOP;
+ if (!action) RETURN_MODULE_NOOP;
/*
* Save the current status of the request.
request->module = module;
request->component = component;
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
/** Pre-compile unlang cache sections and store pointers to them
fr_tls_conf_t *conf;
int ret = 0;
fr_pair_t *vp;
+ rlm_rcode_t rcode;
conf = SSL_get_ex_data(tls_session->ssl, FR_TLS_EX_INDEX_CONF);
/*
* Call the virtual server to write the session
*/
- switch (fr_tls_cache_process(request, conf->session_cache.store)) {
+ fr_tls_cache_process(&rcode, request, conf->session_cache.store);
+ switch (rcode) {
case RLM_MODULE_OK:
case RLM_MODULE_UPDATED:
break;
uint8_t const *q;
fr_pair_t *vp;
SSL_SESSION *sess;
+ rlm_rcode_t rcode;
request = SSL_get_ex_data(ssl, FR_TLS_EX_INDEX_REQUEST);
conf = SSL_get_ex_data(ssl, FR_TLS_EX_INDEX_CONF);
/*
* Call the virtual server to read the session
*/
- switch (fr_tls_cache_process(request, conf->session_cache.load)) {
+ fr_tls_cache_process(&rcode, request, conf->session_cache.load);
+ switch (rcode) {
case RLM_MODULE_OK:
case RLM_MODULE_UPDATED:
break;
static void fr_tls_cache_delete(SSL_CTX *ctx, SSL_SESSION *sess)
{
fr_tls_conf_t *conf;
- fr_tls_session_t *tls_session;
- request_t *request;
+ fr_tls_session_t *tls_session;
+ request_t *request;
uint8_t const *key;
ssize_t key_len;
+ rlm_rcode_t rcode;
+
conf = talloc_get_type_abort(SSL_CTX_get_app_data(ctx), fr_tls_conf_t);
tls_session = talloc_get_type_abort(SSL_SESSION_get_ex_data(sess, FR_TLS_EX_INDEX_TLS_SESSION), fr_tls_session_t);
request = talloc_get_type_abort(SSL_get_ex_data(tls_session->ssl, FR_TLS_EX_INDEX_REQUEST), request_t);
/*
* Call the virtual server to delete the session
*/
- switch (fr_tls_cache_process(request, conf->session_cache.clear)) {
+ fr_tls_cache_process(&rcode, request, conf->session_cache.clear);
+ switch (rcode) {
case RLM_MODULE_OK:
case RLM_MODULE_UPDATED:
case RLM_MODULE_NOTFOUND:
fr_time_t start;
fr_pair_t *vp;
- if (conf->cache_server) switch (fr_tls_cache_process(request, conf->cache.load)) {
- case RLM_MODULE_REJECT:
- REDEBUG("Told to force OCSP validation failure from cached response");
- return OCSP_STATUS_FAILED;
+ if (conf->cache_server) {
+ rlm_rcode_t rcode;
- case RLM_MODULE_OK:
- case RLM_MODULE_UPDATED:
- /*
- * These are fine for OCSP too, we don't *expect* to always
- * have a cached OCSP status.
- */
- case RLM_MODULE_NOTFOUND:
- case RLM_MODULE_NOOP:
- break;
+ fr_tls_cache_process(&rcode, request, conf->cache.load);
+ switch (rcode) {
+ case RLM_MODULE_REJECT:
+ REDEBUG("Told to force OCSP validation failure from cached response");
+ return OCSP_STATUS_FAILED;
- default:
- RWDEBUG("Failed retrieving cached OCSP status");
- break;
+ case RLM_MODULE_OK:
+ case RLM_MODULE_UPDATED:
+ /*
+ * These are fine for OCSP too, we don't *expect* to always
+ * have a cached OCSP status.
+ */
+ case RLM_MODULE_NOTFOUND:
+ case RLM_MODULE_NOOP:
+ break;
+
+ default:
+ RWDEBUG("Failed retrieving cached OCSP status");
+ break;
+ }
}
/*
break;
}
- if (conf->cache_server) switch (fr_tls_cache_process(request, conf->cache.store)) {
- case RLM_MODULE_OK:
- case RLM_MODULE_UPDATED:
- break;
+ if (conf->cache_server) {
+ rlm_rcode_t rcode;
- default:
- RWDEBUG("Failed writing cached OCSP status");
- break;
- }
+ fr_tls_cache_process(&rcode, request, conf->cache.store);
+ switch (rcode) {
+ case RLM_MODULE_OK:
+ case RLM_MODULE_UPDATED:
+ break;
+ default:
+ RWDEBUG("Failed writing cached OCSP status");
+ break;
+ }
+ }
/* Free OCSP Stuff */
OCSP_REQUEST_free(req);
OCSP_BASICRESP_free(bresp);
unlang_group_t *g = unlang_generic_to_group(instruction);
rlm_rcode_t rcode;
+ unlang_action_t ua;
request->request_state = REQUEST_INIT;
request->server_cs = state->prev_server_cs; /* So we get correct debug info */
*
* This is a function in the virtual server's state machine.
*/
- rcode = state->process(&(module_ctx_t){ .instance = state->instance }, request);
- if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD;
+ ua = state->process(&rcode, &(module_ctx_t){ .instance = state->instance }, request);
+ switch (ua) {
+ case UNLANG_ACTION_YIELD:
+ case UNLANG_ACTION_STOP_PROCESSING:
+ case UNLANG_ACTION_PUSHED_CHILD: /* Wants to do more processing */
+ return ua;
+
+ default:
+ break;
+ }
/*
* Record the rcode and restore the previous virtual server
* This pushes a new frame onto the stack, which is the
* start of a new unlang section...
*/
- if (unlang_interpret_push_section(request, subcs, default_rcode, UNLANG_TOP_FRAME) < 0) return RLM_MODULE_FAIL;
+ if (unlang_interpret_push_section(request, subcs, default_rcode, UNLANG_TOP_FRAME) < 0)return RLM_MODULE_FAIL;
return unlang_interpret(request);
}
num_events = fr_event_corral(request->el, fr_time(), wait_for_event);
if (num_events < 0) {
RPERROR("Failed retrieving events");
- rcode = RLM_MODULE_FAIL;
- break;
+ return RLM_MODULE_FAIL;
}
DEBUG3("%u event(s) pending%s",
*
* This is a shim function added to 'fake' requests by the subrequest and parallel keywords.
*/
-rlm_rcode_t unlang_io_process_interpret(UNUSED module_ctx_t const *mctx, request_t *request)
+unlang_action_t unlang_io_process_interpret(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request)
{
rlm_rcode_t rcode;
*/
if ((rcode == RLM_MODULE_YIELD) &&
(request->master_state != REQUEST_STOP_PROCESSING)) {
- return RLM_MODULE_YIELD;
+ *p_result = RLM_MODULE_YIELD;
+ return UNLANG_ACTION_YIELD;
}
/*
/*
* Don't bother setting request->reply->code.
*/
- return RLM_MODULE_HANDLED;
+ RETURN_MODULE_HANDLED;
}
/** Allocate a child request based on the parent.
* @param[in] session control values. Whether we restore/store session info.
* @param[in] rctx to pass to the resume() and signal() callbacks.
* @return
- * - RLM_MODULE_YIELD.
+ * - UNLANG_ACTION_YIELD.
*/
-rlm_rcode_t unlang_module_yield_to_subrequest(rlm_rcode_t *out, request_t *child,
- unlang_module_resume_t resume,
- unlang_module_signal_t signal,
- unlang_subrequest_session_t const *session,
- void *rctx)
+unlang_action_t unlang_module_yield_to_subrequest(rlm_rcode_t *out, request_t *child,
+ unlang_module_resume_t resume,
+ unlang_module_signal_t signal,
+ unlang_subrequest_session_t const *session,
+ void *rctx)
{
/*
* Push the resumption point BEFORE adding the subrequest
/*
* Push the subrequest and immediately run it.
*/
- if (unlang_subrequest_push(out, child, session, UNLANG_SUB_FRAME) < 0) return RLM_MODULE_FAIL;
+ if (unlang_subrequest_push(out, child, session, UNLANG_SUB_FRAME) < 0) return UNLANG_ACTION_STOP_PROCESSING;
- return RLM_MODULE_YIELD;
+ return UNLANG_ACTION_YIELD;
}
/** Push a pre-compiled xlat and resumption state onto the stack for evaluation
* @param[in] signal function to call if a signal is received.
* @param[in] rctx to pass to the resume() and signal() callbacks.
* @return
- * - RLM_MODULE_YIELD.
+ * - UNLANG_ACTION_YIELD
*/
-rlm_rcode_t unlang_module_yield_to_xlat(TALLOC_CTX *ctx, fr_value_box_t **out,
- request_t *request, xlat_exp_t const *exp,
- unlang_module_resume_t resume,
- unlang_module_signal_t signal, void *rctx)
+unlang_action_t unlang_module_yield_to_xlat(TALLOC_CTX *ctx, fr_value_box_t **out,
+ request_t *request, xlat_exp_t const *exp,
+ unlang_module_resume_t resume,
+ unlang_module_signal_t signal, void *rctx)
{
/*
* Push the resumption point BEFORE pushing the xlat onto
/*
* Push the xlat function
*/
- if (unlang_xlat_push(ctx, out, request, exp, false) < 0) return RLM_MODULE_FAIL;
+ if (unlang_xlat_push(ctx, out, request, exp, false) < 0) return UNLANG_ACTION_STOP_PROCESSING;
- return RLM_MODULE_YIELD;
+ return UNLANG_ACTION_YIELD;
}
/** Push a pre-compiled tmpl and resumption state onto the stack for evaluation
* @param[in] signal function to call if a signal is received.
* @param[in] rctx to pass to the resume() and signal() callbacks.
* @return
- * - RLM_MODULE_YIELD.
+ * - UNLANG_ACTION_YIELD
*/
-rlm_rcode_t unlang_module_yield_to_tmpl(TALLOC_CTX *ctx, fr_value_box_t **out, int *status,
- request_t *request, tmpl_t const *vpt,
- fr_pair_t *vps,
- unlang_module_resume_t resume,
- unlang_module_signal_t signal, void *rctx)
+unlang_action_t unlang_module_yield_to_tmpl(TALLOC_CTX *ctx, fr_value_box_t **out, int *status,
+ request_t *request, tmpl_t const *vpt,
+ fr_pair_t *vps,
+ unlang_module_resume_t resume,
+ unlang_module_signal_t signal, void *rctx)
{
/*
* Push the resumption point BEFORE pushing the xlat onto
/*
* Push the xlat function
*/
- if (unlang_tmpl_push(ctx, out, request, vpt, vps, status) < 0) return RLM_MODULE_FAIL;
+ if (unlang_tmpl_push(ctx, out, request, vpt, vps, status) < 0) return UNLANG_ACTION_STOP_PROCESSING;
- return RLM_MODULE_YIELD;
+ return UNLANG_ACTION_YIELD;
}
-rlm_rcode_t unlang_module_yield_to_section(request_t *request, CONF_SECTION *subcs,
- rlm_rcode_t default_rcode,
- unlang_module_resume_t resume,
- unlang_module_signal_t signal, void *rctx)
+unlang_action_t unlang_module_yield_to_section(rlm_rcode_t *p_result,
+ request_t *request, CONF_SECTION *subcs,
+ rlm_rcode_t default_rcode,
+ unlang_module_resume_t resume,
+ unlang_module_signal_t signal, void *rctx)
{
if (!subcs) {
unlang_stack_t *stack = request->stack;
*/
request->rcode = frame->result = default_rcode;
- return resume(&(module_ctx_t){
+ return resume(p_result,
+ &(module_ctx_t){
.instance = mc->instance->dl_inst->data,
.thread = module_thread(mc->instance)->data
}, request, rctx);
*/
(void) unlang_module_yield(request, resume, signal, rctx);
- if (unlang_interpret_push_section(request, subcs, default_rcode, UNLANG_SUB_FRAME) < 0) return RLM_MODULE_FAIL;
+ if (unlang_interpret_push_section(request, subcs,
+ default_rcode, UNLANG_SUB_FRAME) < 0) return UNLANG_ACTION_STOP_PROCESSING;
- return RLM_MODULE_YIELD;
+ return UNLANG_ACTION_YIELD;
}
/*
char const *caller;
rlm_rcode_t rcode;
int stack_depth = stack->depth;
+ unlang_action_t ua;
fr_assert(state->resume != NULL);
request->module = mc->instance->name;
safe_lock(mc->instance);
- rcode = request->rcode = state->resume(&(module_ctx_t){
- .instance = mc->instance->dl_inst->data,
- .thread = state->thread->data
- }, request, state->rctx);
+ ua = state->resume(&rcode,
+ &(module_ctx_t){
+ .instance = mc->instance->dl_inst->data,
+ .thread = state->thread->data
+ }, request, state->rctx);
safe_unlock(mc->instance);
+
+ request->rcode = rcode;
request->module = caller;
/*
* "active_callers" if it's already been cancelled in a
* signal.
*/
- if (request->master_state == REQUEST_STOP_PROCESSING) {
- RWARN("Module %s became unblocked", mc->instance->module->name);
+ if ((ua == UNLANG_ACTION_STOP_PROCESSING) || (request->master_state == REQUEST_STOP_PROCESSING)) {
+ RWARN("Module %s or worker signalled to stop processing request", mc->instance->module->name);
if (state->p_result) *state->p_result = rcode;
if (state->signal) state->thread->active_callers--;
RDEBUG2("%s (%s)", frame->instruction->name ? frame->instruction->name : "",
fr_table_str_by_value(mod_rcode_table, rcode, "<invalid>"));
- if (rcode == RLM_MODULE_YIELD) {
+ if (ua == UNLANG_ACTION_YIELD) {
if (stack_depth < stack->depth) return UNLANG_ACTION_PUSHED_CHILD;
fr_assert(stack_depth == stack->depth);
*p_result = rcode;
* more asynchronous calls onto the stack. These need to
* be run before the next module runs.
*/
- if (stack_depth < stack->depth) {
+ if (ua == UNLANG_ACTION_PUSHED_CHILD) {
state->rcode = rcode;
repeatable_set(frame);
frame->process = unlang_module_resume_final;
if (state->p_result) *state->p_result = rcode;
*p_result = rcode;
- return UNLANG_ACTION_CALCULATE_RESULT;
+ return ua; /* Usually UNLANG_ACTION_CALCULATE_RESULT */
}
/** Yield a request back to the interpreter from within a module
* @param[in] signal Called on unlang_action().
* @param[in] rctx to pass to the callbacks.
* @return
- * - RLM_MODULE_YIELD on success.
- * - RLM_MODULE_FAIL (or asserts) if the current frame is not a module call or
- * resume frame.
+ * - UNLANG_ACTION_YIELD.
*/
-rlm_rcode_t unlang_module_yield(request_t *request,
- unlang_module_resume_t resume, unlang_module_signal_t signal, void *rctx)
+unlang_action_t unlang_module_yield(request_t *request,
+ unlang_module_resume_t resume, unlang_module_signal_t signal, void *rctx)
{
unlang_stack_t *stack = request->stack;
unlang_stack_frame_t *frame = &stack->frame[stack->depth];
- unlang_frame_state_module_t *state = talloc_get_type_abort(frame->state,
- unlang_frame_state_module_t);
+ unlang_frame_state_module_t *state = talloc_get_type_abort(frame->state, unlang_frame_state_module_t);
REQUEST_VERIFY(request); /* Check the yielded request is sane */
*/
frame->process = unlang_module_resume;
repeatable_set(frame);
- return RLM_MODULE_YIELD;
+
+ return UNLANG_ACTION_YIELD;
}
static unlang_action_t unlang_module(rlm_rcode_t *p_result, request_t *request)
unlang_frame_state_module_t *state = talloc_get_type_abort(frame->state, unlang_frame_state_module_t);
int stack_depth = stack->depth;
char const *caller;
- rlm_rcode_t rcode;
+ rlm_rcode_t rcode = RLM_MODULE_NOOP;
+ unlang_action_t ua;
#ifndef NDEBUG
int unlang_indent = request->log.unlang_indent;
*/
if (mc->instance->force) {
rcode = mc->instance->code;
+ ua = UNLANG_ACTION_CALCULATE_RESULT;
goto done;
}
caller = request->module;
request->module = mc->instance->name;
safe_lock(mc->instance); /* Noop unless instance->mutex set */
- rcode = mc->method(&(module_ctx_t){
+ ua = mc->method(&rcode,
+ &(module_ctx_t){
.instance = mc->instance->dl_inst->data,
.thread = state->thread->data
- },
- request);
+ },
+ request);
safe_unlock(mc->instance);
request->module = caller;
* It is now marked as "stop" when it wasn't before, we
* must have been blocked.
*/
- if (request->master_state == REQUEST_STOP_PROCESSING) {
+ if ((ua == UNLANG_ACTION_STOP_PROCESSING) || (request->master_state == REQUEST_STOP_PROCESSING)) {
RWARN("Module %s became unblocked", mc->instance->module->name);
if (state->p_result) *state->p_result = rcode;
fr_table_str_by_value(mod_rcode_table, rcode, "<invalid>"));
- if (rcode == RLM_MODULE_YIELD) {
+ if (ua == UNLANG_ACTION_YIELD) {
state->thread->active_callers++;
if (stack_depth < stack->depth) return UNLANG_ACTION_PUSHED_CHILD;
fr_assert(stack_depth == stack->depth);
- *p_result = rcode;
frame->process = unlang_module_resume;
return UNLANG_ACTION_YIELD;
}
* more asynchronous calls onto the stack. These need to
* be run before the next module runs.
*/
- if (stack_depth < stack->depth) {
+ if (ua == UNLANG_ACTION_PUSHED_CHILD) {
state->rcode = rcode;
repeatable_set(frame);
frame->process = unlang_module_resume_final;
if (state->p_result) *state->p_result = rcode;
*p_result = rcode;
- return UNLANG_ACTION_CALCULATE_RESULT;
+ return ua;
}
void unlang_module_init(void)
*
* The resumed request cannot call the normal "authorize", etc. method. It needs a separate callback.
*
+ * @param[out] p_result result of the operation.
* @param[in] mctx calling context for the module.
* Contains global, thread-specific, and call-specific data for a module.
* @param[in] request the current request.
* @param[in] rctx a local context for the callback.
- * @return a normal rlm_rcode_t.
+ * @return an instruction for the interpreter.
*/
-typedef rlm_rcode_t (*unlang_module_resume_t)(module_ctx_t const *mctx, request_t *request, void *rctx);
+typedef unlang_action_t (*unlang_module_resume_t)(rlm_rcode_t *p_result, module_ctx_t const *mctx,
+ request_t *request, void *rctx);
/** A callback when the request gets a fr_state_signal_t.
*
request_t *unlang_module_subrequest_alloc(request_t *parent, fr_dict_t const *namespace);
-rlm_rcode_t unlang_module_yield_to_subrequest(rlm_rcode_t *out, request_t *child,
+unlang_action_t unlang_module_yield_to_subrequest(rlm_rcode_t *out, request_t *child,
unlang_module_resume_t resume,
unlang_module_signal_t signal,
unlang_subrequest_session_t const *session,
void *rctx);
-rlm_rcode_t unlang_module_yield_to_section(request_t *request, CONF_SECTION *subcs,
+unlang_action_t unlang_module_yield_to_section(rlm_rcode_t *p_result,
+ request_t *request, CONF_SECTION *subcs,
rlm_rcode_t default_rcode,
unlang_module_resume_t resume,
unlang_module_signal_t signal, void *rctx);
-rlm_rcode_t unlang_module_yield_to_xlat(TALLOC_CTX *ctx, fr_value_box_t **out,
+unlang_action_t unlang_module_yield_to_xlat(TALLOC_CTX *ctx, fr_value_box_t **out,
request_t *request, xlat_exp_t const *xlat,
unlang_module_resume_t resume,
unlang_module_signal_t signal, void *rctx);
-rlm_rcode_t unlang_module_yield_to_tmpl(TALLOC_CTX *ctx, fr_value_box_t **out, int *status,
+unlang_action_t unlang_module_yield_to_tmpl(TALLOC_CTX *ctx, fr_value_box_t **out, int *status,
request_t *request, tmpl_t const *exp,
fr_pair_t *vps,
unlang_module_resume_t resume,
unlang_module_signal_t signal, void *rctx);
-rlm_rcode_t unlang_module_yield(request_t *request,
+unlang_action_t unlang_module_yield(request_t *request,
unlang_module_resume_t resume,
unlang_module_signal_t signal, void *rctx);
*
* @{
*/
-rlm_rcode_t unlang_io_process_interpret(module_ctx_t const *mctx, request_t *request);
+unlang_action_t unlang_io_process_interpret(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request);
request_t *unlang_io_subrequest_alloc(request_t *parent, fr_dict_t const *namespace, bool detachable);
*/
int xlat_fmt_get_vp(fr_pair_t **out, request_t *request, char const *name)
{
- int rcode;
+ int ret;
tmpl_t *vpt;
*out = NULL;
.prefix = TMPL_ATTR_REF_PREFIX_AUTO
}) <= 0) return -4;
- rcode = tmpl_find_vp(out, request, vpt);
+ ret = tmpl_find_vp(out, request, vpt);
talloc_free(vpt);
- return rcode;
+ return ret;
}
*/
int xlat_fmt_copy_vp(TALLOC_CTX *ctx, fr_pair_t **out, request_t *request, char const *name)
{
- int rcode;
+ int ret;
tmpl_t *vpt;
*out = NULL;
if (tmpl_afrom_attr_str(request, NULL,
&vpt, name, &(tmpl_rules_t){ .dict_def = request->dict }) <= 0) return -4;
- rcode = tmpl_copy_pairs(ctx, out, request, vpt);
+ ret = tmpl_copy_pairs(ctx, out, request, vpt);
talloc_free(vpt);
- return rcode;
+ return ret;
}
for (ci = cf_item_next(xr->cs, NULL);
ci != NULL;
ci = cf_item_next(xr->cs, ci)) {
- ssize_t rcode;
+ ssize_t ret;
if (!cf_item_is_pair(ci)) continue;
*out = NULL;
}
- rcode = xlat->func.sync(ctx, out, xlat->buf_len, xlat->mod_inst, NULL, request, fmt);
- if (rcode <= 0) {
+ ret = xlat->func.sync(ctx, out, xlat->buf_len, xlat->mod_inst, NULL, request, fmt);
+ if (ret <= 0) {
TALLOC_FREE(*out);
continue;
}
- return rcode;
+ return ret;
}
/*
xlat = xlat_func_find(name, -1);
if (xlat) {
- ssize_t rcode;
+ ssize_t ret;
if (xlat->buf_len > 0) {
*out = talloc_array(ctx, char, xlat->buf_len);
} else {
*out = NULL;
}
- rcode = xlat->func.sync(ctx, out, xlat->buf_len, xlat->mod_inst, NULL, request, fmt);
- if (rcode > 0) return rcode;
+ ret = xlat->func.sync(ctx, out, xlat->buf_len, xlat->mod_inst, NULL, request, fmt);
+ if (ret > 0) return ret;
TALLOC_FREE(*out);
}
*/
int fr_cap_enable(cap_value_t cap, cap_flag_t set)
{
- int rcode = -1;
+ int ret = -1;
cap_t caps = NULL;
cap_flag_value_t state;
goto done;
}
- rcode = 0;
+ ret = 0;
/*
* It's already in the effective set
*/
} else if (state == CAP_SET) {
- rcode = 0;
+ ret = 0;
}
done:
if (caps) cap_free(caps);
- return rcode;
+ return ret;
}
/** Remove a CAP_* from the permitted, effective or inheritable set
*/
int fr_cap_disable(cap_value_t cap, cap_flag_t set)
{
- int rcode = -1;
+ int ret = -1;
cap_t caps;
cap_flag_value_t state;
goto done;
}
- rcode = 0;
+ ret = 0;
} else {
- rcode = 0;
+ ret = 0;
}
done:
if (caps) cap_free(caps);
- return rcode;
+ return ret;
}
#endif /* HAVE_CAPABILITY_H */
static int dict_read_sscanf_i(unsigned int *pvalue, char const *str)
{
- int rcode = 0;
+ int ret = 0;
int base = 10;
static char const *tab = "0123456789";
c = memchr(tab, tolower((int)*str), base);
if (!c) return 0;
- rcode *= base;
- rcode += (c - tab);
+ ret *= base;
+ ret += (c - tab);
str++;
}
- *pvalue = rcode;
+ *pvalue = ret;
return 1;
}
* See if we need to import another dictionary.
*/
if (strncasecmp(argv[0], "$INCLUDE", 8) == 0) {
- int rcode;
+ int ret;
int stack_depth = ctx->stack_depth;
/*
* parent.
*/
- rcode = _dict_from_file(ctx, dir, argv[1], fn, line);
- if ((rcode == -2) && (argv[0][8] == '-')) {
+ ret = _dict_from_file(ctx, dir, argv[1], fn, line);
+ if ((ret == -2) && (argv[0][8] == '-')) {
fr_strerror_printf(NULL); /* delete all errors */
- rcode = 0;
+ ret = 0;
}
- if (rcode < 0) {
+ if (ret < 0) {
fr_strerror_printf_push("from $INCLUDE at %s[%d]", fn, line);
fclose(fp);
return -1;
char const *dir_name, char const *filename,
char const *src_file, int src_line)
{
- int rcode;
+ int ret;
dict_tokenize_ctx_t ctx;
memset(&ctx, 0, sizeof(ctx));
ctx.stack[0].da = dict->root;
ctx.stack[0].nest = FR_TYPE_MAX;
- rcode = _dict_from_file(&ctx,
+ ret = _dict_from_file(&ctx,
dir_name, filename, src_file, src_line);
- if (rcode < 0) {
+ if (ret < 0) {
talloc_free(ctx.fixup_pool);
- return rcode;
+ return ret;
}
/*
len = talloc_array_length(children);
for (i = 0; i < len; i++) {
- int rcode;
+ int ret;
fr_dict_attr_t const *bin;
if (!children[i]) continue;
for (bin = children[i]; bin; bin = bin->next) {
- rcode = dict_walk(bin, ctx, callback, depth);
- if (rcode < 0) return rcode;
+ ret = dict_walk(bin, ctx, callback, depth);
+ if (ret < 0) return ret;
}
}
fr_hash_table_walk_t callback,
void *context)
{
- int i, rcode;
+ int i, ret;
if (!ht || !callback) return 0;
for (node = ht->buckets[i]; node != &ht->null; node = next) {
next = node->next;
- rcode = callback(context, node->data);
+ ret = callback(context, node->data);
- if (rcode != 0) return rcode;
+ if (ret != 0) return ret;
}
}
*/
static int walk_node_pre_order(rbnode_t *x, rb_walker_t compare, void *uctx)
{
- int rcode;
+ int ret;
rbnode_t *left, *right;
left = x->left;
right = x->right;
- rcode = compare(x->data, uctx);
- if (rcode != 0) return rcode;
+ ret = compare(x->data, uctx);
+ if (ret != 0) return ret;
if (left != NIL) {
- rcode = walk_node_pre_order(left, compare, uctx);
- if (rcode != 0) return rcode;
+ ret = walk_node_pre_order(left, compare, uctx);
+ if (ret != 0) return ret;
}
if (right != NIL) {
- rcode = walk_node_pre_order(right, compare, uctx);
- if (rcode != 0) return rcode;
+ ret = walk_node_pre_order(right, compare, uctx);
+ if (ret != 0) return ret;
}
return 0; /* we know everything returned zero */
*/
static int walk_node_in_order(rbnode_t *x, rb_walker_t compare, void *uctx)
{
- int rcode;
+ int ret;
rbnode_t *right;
if (x->left != NIL) {
- rcode = walk_node_in_order(x->left, compare, uctx);
- if (rcode != 0) return rcode;
+ ret = walk_node_in_order(x->left, compare, uctx);
+ if (ret != 0) return ret;
}
right = x->right;
- rcode = compare(x->data, uctx);
- if (rcode != 0) return rcode;
+ ret = compare(x->data, uctx);
+ if (ret != 0) return ret;
if (right != NIL) {
- rcode = walk_node_in_order(right, compare, uctx);
- if (rcode != 0) return rcode;
+ ret = walk_node_in_order(right, compare, uctx);
+ if (ret != 0) return ret;
}
return 0; /* we know everything returned zero */
*/
static int walk_node_post_order(rbnode_t *x, rb_walker_t compare, void *uctx)
{
- int rcode;
+ int ret;
if (x->left != NIL) {
- rcode = walk_node_post_order(x->left, compare, uctx);
- if (rcode != 0) return rcode;
+ ret = walk_node_post_order(x->left, compare, uctx);
+ if (ret != 0) return ret;
}
if (x->right != NIL) {
- rcode = walk_node_post_order(x->right, compare, uctx);
- if (rcode != 0) return rcode;
+ ret = walk_node_post_order(x->right, compare, uctx);
+ if (ret != 0) return ret;
}
- rcode = compare(x->data, uctx);
- if (rcode != 0) return rcode;
+ ret = compare(x->data, uctx);
+ if (ret != 0) return ret;
return 0; /* we know everything returned zero */
}
static int walk_delete_order(rbtree_t *tree, rb_walker_t compare, void *uctx)
{
rbnode_t *solid, *x;
- int rcode = 0;
+ int ret = 0;
/* Keep track of last node that refused deletion. */
solid = NIL;
x = x->left;
}
visit:
- rcode = compare(x->data, uctx);
- if (rcode < 0) {
- return rcode;
+ ret = compare(x->data, uctx);
+ if (ret < 0) {
+ return ret;
}
- if (rcode) {
+ if (ret) {
rbtree_delete_internal(tree, x, true);
- if (rcode != 2) {
- return rcode;
+ if (ret != 2) {
+ return ret;
}
} else {
solid = x;
x = x->parent;
}
}
- return rcode;
+ return ret;
}
*/
int rbtree_walk(rbtree_t *tree, rb_order_t order, rb_walker_t compare, void *uctx)
{
- int rcode;
+ int ret;
if (tree->root == NIL) return 0;
switch (order) {
case RBTREE_PRE_ORDER:
- rcode = walk_node_pre_order(tree->root, compare, uctx);
+ ret = walk_node_pre_order(tree->root, compare, uctx);
break;
case RBTREE_IN_ORDER:
- rcode = walk_node_in_order(tree->root, compare, uctx);
+ ret = walk_node_in_order(tree->root, compare, uctx);
break;
case RBTREE_POST_ORDER:
- rcode = walk_node_post_order(tree->root, compare, uctx);
+ ret = walk_node_post_order(tree->root, compare, uctx);
break;
case RBTREE_DELETE_ORDER:
- rcode = walk_delete_order(tree, compare, uctx);
+ ret = walk_delete_order(tree, compare, uctx);
break;
default:
- rcode = -1;
+ ret = -1;
break;
}
if (tree->lock) pthread_mutex_unlock(&tree->mutex);
- return rcode;
+ return ret;
}
uint32_t rbtree_num_elements(rbtree_t *tree)
#ifdef FD_CLOEXEC
static int socket_dont_inherit(int sockfd)
{
- int rcode;
+ int ret;
/*
* We don't want child processes inheriting these
* file descriptors.
*/
- rcode = fcntl(sockfd, F_GETFD);
- if (rcode >= 0) {
- if (fcntl(sockfd, F_SETFD, rcode | FD_CLOEXEC) < 0) {
+ ret = fcntl(sockfd, F_GETFD);
+ if (ret >= 0) {
+ if (fcntl(sockfd, F_SETFD, ret | FD_CLOEXEC) < 0) {
fr_strerror_printf("Failed setting close on exec: %s", fr_syserror(errno));
return -1;
}
*/
int fr_socket_bind(int sockfd, fr_ipaddr_t const *src_ipaddr, uint16_t *src_port, char const *interface)
{
- int rcode;
+ int ret;
uint16_t my_port = 0;
fr_ipaddr_t my_ipaddr;
struct sockaddr_storage salocal;
* and set the scope_id.
*/
if (!my_ipaddr.scope_id) {
- rcode = setsockopt(sockfd, SOL_SOCKET, SO_BINDTODEVICE, interface, strlen(interface));
- if (rcode < 0) {
+ ret = setsockopt(sockfd, SOL_SOCKET, SO_BINDTODEVICE, interface, strlen(interface));
+ if (ret < 0) {
fr_strerror_printf_push("Bind failed on interface %s: %s",
interface, fr_syserror(errno));
return -1;
*/
if (fr_ipaddr_to_sockaddr(&salocal, &salen, &my_ipaddr, my_port) < 0) return -1;
- rcode = bind(sockfd, (struct sockaddr *) &salocal, salen);
- if (rcode < 0) {
+ ret = bind(sockfd, (struct sockaddr *) &salocal, salen);
+ if (ret < 0) {
fr_strerror_printf_push("Bind failed with source address %pV:%pV on interface %s: %s",
src_ipaddr ? fr_box_ipaddr(*src_ipaddr) : fr_box_strvalue("*"),
src_port ? fr_box_int16(*src_port) : fr_box_strvalue("*"),
interface ? interface : "*",
fr_syserror(errno));
- return rcode;
+ return ret;
}
if (!src_port) goto done;
char quote;
unsigned int x;
size_t i;
- fr_token_t rcode;
+ fr_token_t token;
buf[0] = '\0';
strcpy(buf, tokenlist[i].name.str);
p += tokenlist[i].name.len;
- rcode = tokenlist[i].value;
+ token = tokenlist[i].value;
goto done;
}
}
quote = '\0';
switch (*p) {
default:
- rcode = T_BARE_WORD;
+ token = T_BARE_WORD;
break;
case '\'':
- rcode = T_SINGLE_QUOTED_STRING;
+ token = T_SINGLE_QUOTED_STRING;
break;
case '"':
- rcode = T_DOUBLE_QUOTED_STRING;
+ token = T_DOUBLE_QUOTED_STRING;
break;
case '`':
- rcode = T_BACK_QUOTED_STRING;
+ token = T_BACK_QUOTED_STRING;
break;
}
- if (rcode != T_BARE_WORD) {
+ if (token != T_BARE_WORD) {
quote = *p;
p++;
}
*ptr = p;
- return rcode;
+ return token;
}
/*
fr_token_t getop(char const **ptr)
{
char op[3];
- fr_token_t rcode;
+ fr_token_t token;
- rcode = getthing(ptr, op, sizeof(op), true, fr_tokens_table, fr_tokens_table_len, false);
- if (!fr_assignment_op[rcode] && !fr_equality_op[rcode]) {
+ token = getthing(ptr, op, sizeof(op), true, fr_tokens_table, fr_tokens_table_len, false);
+ if (!fr_assignment_op[token] && !fr_equality_op[token]) {
fr_strerror_printf("Expected operator");
return T_INVALID;
}
- return rcode;
+ return token;
}
/*
int main(int argc, char **argv)
{
int lineno = 0;
- int rcode = 0;
+ int ret = 0;
fr_trie_t *ft;
FILE *fp;
int my_argc;
if (cmd < 0) {
fprintf(stderr, "Unknown command '%s' at line %d\n",
my_argv[0], lineno);
- rcode = 1;
+ ret = 1;
break;
}
talloc_report_full(NULL, stdout); /* Print details of any leaked memory */
talloc_disable_null_tracking(); /* Cleanup talloc null tracking context */
- return rcode;
+ return ret;
}
#endif
{ NULL }
};
-static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_process(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request)
{
rlm_rcode_t rcode;
CONF_SECTION *unlang;
dv = fr_dict_enum_by_value(attr_arp_operation, fr_box_uint16(request->packet->code));
if (!dv) {
REDEBUG("Failed to find value for &request.ARP-Operation");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
unlang = cf_section_find(request->server_cs, "recv", dv->name);
RDEBUG("Running 'recv %s' from file %s", cf_section_name2(unlang), cf_filename(unlang));
if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
request->request_state = REQUEST_RECV;
case REQUEST_RECV:
rcode = unlang_interpret(request);
- if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED;
+ if (request->master_state == REQUEST_STOP_PROCESSING) {
+ *p_result = RLM_MODULE_HANDLED;
+ return UNLANG_ACTION_STOP_PROCESSING;
+ }
- if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD;
+ if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD;
/*
* Allow the admin to explicitly set the reply
* Some types don't send a reply, and don't run "send Do-Not-Respond"
*/
if (!request->reply->code) {
- return RLM_MODULE_HANDLED;
+ RETURN_MODULE_HANDLED;
}
dv = fr_dict_enum_by_value(da, fr_box_uint8(request->reply->code));
rerun_nak:
RDEBUG("Running 'send %s' from file %s", cf_section_name2(unlang), cf_filename(unlang));
if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
request->request_state = REQUEST_SEND;
case REQUEST_SEND:
rcode = unlang_interpret(request);
- if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED;
+ if (request->master_state == REQUEST_STOP_PROCESSING) {
+ *p_result = RLM_MODULE_HANDLED;
+ return UNLANG_ACTION_STOP_PROCESSING;
+ }
- if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD;
+ if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD;
switch (rcode) {
case RLM_MODULE_NOOP:
*/
if (request->reply->code == FR_ARP_CODE_DO_NOT_RESPOND) {
RDEBUG("Not sending reply to client");
- return RLM_MODULE_HANDLED;
+ RETURN_MODULE_HANDLED;
}
if (request->parent && RDEBUG_ENABLED) {
break;
default:
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
static int local_command(char *line)
{
- int argc, rcode;
+ int argc, ret;
argc = fr_command_str_to_argv(local_cmds, &local_info, line);
if (argc < 0) {
return 0;
}
- rcode = fr_command_run(stderr, stdout, &local_info, false);
+ ret = fr_command_run(stderr, stdout, &local_info, false);
fflush(stdout);
fflush(stderr);
*/
(void) fr_command_clear(0, &local_info);
- if (rcode < 0) return rcode;
+ if (ret < 0) return ret;
return 1;
{ NULL }
};
-static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
proto_detail_process_t const *inst = talloc_get_type_abort_const(mctx->instance, proto_detail_process_t);
fr_pair_t *vp;
unlang = cf_section_find(request->server_cs, "recv", NULL);
if (!unlang) {
REDEBUG("Failed to find 'recv' section");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
RDEBUG("Running 'recv' from file %s", cf_filename(unlang));
if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
request->request_state = REQUEST_RECV;
case REQUEST_RECV:
rcode = unlang_interpret(request);
- if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED;
+ if (request->master_state == REQUEST_STOP_PROCESSING) {
+ *p_result = RLM_MODULE_HANDLED;
+ return UNLANG_ACTION_STOP_PROCESSING;
+ }
- if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD;
+ if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD;
switch (rcode) {
/*
RDEBUG("Running 'send %s { ... }' from file %s", cf_section_name2(unlang), cf_filename(unlang));
if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
request->request_state = REQUEST_SEND;
case REQUEST_SEND:
rcode = unlang_interpret(request);
- if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED;
+ if (request->master_state == REQUEST_STOP_PROCESSING) {
+ *p_result = RLM_MODULE_HANDLED;
+ return UNLANG_ACTION_STOP_PROCESSING;
+ }
- if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD;
+ if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD;
switch (rcode) {
case RLM_MODULE_NOOP:
break;
default:
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
}
}
-static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_process(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request)
{
rlm_rcode_t rcode;
CONF_SECTION *unlang;
dv = fr_dict_enum_by_value(attr_message_type, fr_box_uint8(request->packet->code));
if (!dv) {
REDEBUG("Failed to find value for &request.DHCP-Message-Type");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
unlang = cf_section_find(request->server_cs, "recv", dv->name);
RDEBUG("Running 'recv %s' from file %s", cf_section_name2(unlang), cf_filename(unlang));
if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
request->request_state = REQUEST_RECV;
case REQUEST_RECV:
rcode = unlang_interpret(request);
- if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED;
+ if (request->master_state == REQUEST_STOP_PROCESSING) {
+ *p_result = RLM_MODULE_HANDLED;
+ return UNLANG_ACTION_STOP_PROCESSING;
+ }
- if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD;
+ if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD;
/*
* Allow the admin to explicitly set the reply
* DHCP-Release / Decline doesn't send a reply, and doesn't run "send DHCP-Do-Not-Respond"
*/
if (!request->reply->code) {
- return RLM_MODULE_HANDLED;
+ RETURN_MODULE_HANDLED;
}
/*
rerun_nak:
RDEBUG("Running 'send %s' from file %s", cf_section_name2(unlang), cf_filename(unlang));
if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
request->request_state = REQUEST_SEND;
case REQUEST_SEND:
rcode = unlang_interpret(request);
- if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED;
+ if (request->master_state == REQUEST_STOP_PROCESSING) {
+ *p_result = RLM_MODULE_HANDLED;
+ return UNLANG_ACTION_STOP_PROCESSING;
+ }
- if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD;
+ if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD;
switch (rcode) {
case RLM_MODULE_NOOP:
*/
if (request->reply->code == FR_DHCP_MESSAGE_TYPE_VALUE_DHCP_DO_NOT_RESPOND) {
RDEBUG("Not sending reply to client");
- return RLM_MODULE_HANDLED;
+ RETURN_MODULE_HANDLED;
}
if (RDEBUG_ENABLED) dhcpv4_packet_debug(request, request->reply, false);
break;
default:
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
static const virtual_server_compile_t compile_list[] = {
static int mod_compare(UNUSED void const *instance, UNUSED void *thread_instance, UNUSED RADCLIENT *client,
void const *one, void const *two)
{
- int rcode;
+ int ret;
proto_dhcpv4_track_t const *a = one;
proto_dhcpv4_track_t const *b = two;
* The tree is ordered by XIDs, which are (hopefully)
* pseudo-randomly distributed.
*/
- rcode = memcmp(&a->xid, &b->xid, sizeof(a->xid));
- if (rcode != 0) return rcode;
+ ret = memcmp(&a->xid, &b->xid, sizeof(a->xid));
+ if (ret != 0) return ret;
/*
* Hardware addresses should also be randomly distributed.
*/
- rcode = memcmp(&a->chaddr, &b->chaddr, sizeof(a->chaddr));
- if (rcode != 0) return rcode;
+ ret = memcmp(&a->chaddr, &b->chaddr, sizeof(a->chaddr));
+ if (ret != 0) return ret;
/*
* Compare giaddr, but not ciaddr
*/
- rcode = memcmp(&a->giaddr, &b->giaddr, sizeof(a->giaddr));
- if (rcode != 0) return rcode;
+ ret = memcmp(&a->giaddr, &b->giaddr, sizeof(a->giaddr));
+ if (ret != 0) return ret;
return (a->message_type < b->message_type) - (a->message_type > b->message_type);
}
}
}
-static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_process(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request)
{
rlm_rcode_t rcode;
CONF_SECTION *unlang;
RDEBUG("Running 'recv %s' from file %s", cf_section_name2(unlang), cf_filename(unlang));
if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
request->request_state = REQUEST_RECV;
case REQUEST_RECV:
rcode = unlang_interpret(request);
- if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED;
+ if (request->master_state == REQUEST_STOP_PROCESSING) {
+ *p_result = RLM_MODULE_HANDLED;
+ return UNLANG_ACTION_STOP_PROCESSING;
+ }
- if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD;
+ if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD;
/*
* Allow the admin to explicitly set the reply
* DHCP-Release / Decline doesn't send a reply, and doesn't run "send DHCP-Do-Not-Respond"
*/
if (!request->reply->code) {
- return RLM_MODULE_HANDLED;
+ RETURN_MODULE_HANDLED;
}
dv = fr_dict_enum_by_value(attr_packet_type, fr_box_uint32(request->reply->code));
rerun_nak:
RDEBUG("Running 'send %s' from file %s", cf_section_name2(unlang), cf_filename(unlang));
if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
request->request_state = REQUEST_SEND;
case REQUEST_SEND:
rcode = unlang_interpret(request);
- if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED;
+ if (request->master_state == REQUEST_STOP_PROCESSING) {
+ *p_result = RLM_MODULE_HANDLED;
+ return UNLANG_ACTION_STOP_PROCESSING;
+ }
- if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD;
+ if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD;
switch (rcode) {
case RLM_MODULE_NOOP:
*/
if (request->reply->code == FR_DHCPV6_DO_NOT_RESPOND) {
RDEBUG("Not sending reply to client");
- return RLM_MODULE_HANDLED;
+ RETURN_MODULE_HANDLED;
}
if (RDEBUG_ENABLED) dhcpv6_packet_debug(request, request->reply, false);
break;
default:
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
static int mod_compare(UNUSED void const *instance, UNUSED void *thread_instance, UNUSED RADCLIENT *client,
void const *one, void const *two)
{
- int rcode;
+ int ret;
proto_dhcpv6_track_t const *a = one;
proto_dhcpv6_track_t const *b = two;
- rcode = memcmp(&a->header, &b->header, sizeof(a->header));
- if (rcode != 0) return rcode;
+ ret = memcmp(&a->header, &b->header, sizeof(a->header));
+ if (ret != 0) return ret;
- rcode = (a->client_id_len < b->client_id_len) - (a->client_id_len > b->client_id_len);
- if (rcode != 0) return rcode;
+ ret = (a->client_id_len < b->client_id_len) - (a->client_id_len > b->client_id_len);
+ if (ret != 0) return ret;
return memcmp(a->client_id, b->client_id, a->client_id_len);
}
*/
static int proto_ldap_listen_compile(CONF_SECTION *server_cs, UNUSED CONF_SECTION *listen_cs)
{
- int rcode;
+ int ret;
int found = 0;
- rcode = ldap_compile_section(server_cs, "load", "Cookie", MOD_AUTHORIZE);
- if (rcode < 0) return rcode;
- if (rcode > 0) found++;
+ ret = ldap_compile_section(server_cs, "load", "Cookie", MOD_AUTHORIZE);
+ if (ret < 0) return ret;
+ if (ret > 0) found++;
- rcode = ldap_compile_section(server_cs, "store", "Cookie", MOD_AUTHORIZE);
- if (rcode < 0) return rcode;
- if (rcode > 0) found++;
+ ret = ldap_compile_section(server_cs, "store", "Cookie", MOD_AUTHORIZE);
+ if (ret < 0) return ret;
+ if (ret > 0) found++;
- rcode = ldap_compile_section(server_cs, "recv", "Add", MOD_AUTHORIZE);
- if (rcode < 0) return rcode;
- if (rcode > 0) found++;
+ ret = ldap_compile_section(server_cs, "recv", "Add", MOD_AUTHORIZE);
+ if (ret < 0) return ret;
+ if (ret > 0) found++;
- rcode = ldap_compile_section(server_cs, "recv", "Present", MOD_AUTHORIZE);
- if (rcode < 0) return rcode;
- if (rcode > 0) found++;
+ ret = ldap_compile_section(server_cs, "recv", "Present", MOD_AUTHORIZE);
+ if (ret < 0) return ret;
+ if (ret > 0) found++;
- rcode = ldap_compile_section(server_cs, "recv", "Delete", MOD_AUTHORIZE);
- if (rcode < 0) return rcode;
- if (rcode > 0) found++;
+ ret = ldap_compile_section(server_cs, "recv", "Delete", MOD_AUTHORIZE);
+ if (ret < 0) return ret;
+ if (ret > 0) found++;
- rcode = ldap_compile_section(server_cs, "recv", "Modify", MOD_AUTHORIZE);
- if (rcode < 0) return rcode;
- if (rcode > 0) found++;
+ ret = ldap_compile_section(server_cs, "recv", "Modify", MOD_AUTHORIZE);
+ if (ret < 0) return ret;
+ if (ret > 0) found++;
if (found == 0) {
cf_log_err(server_cs, "At least one of 'recv [Present|Add|Delete|Modify] { ... }' "
};
-static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_process(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request)
{
fr_pair_t *vp;
rlm_rcode_t rcode;
RDEBUG("Running 'recv Accounting-Request' from file %s", cf_filename(unlang));
if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
request->request_state = REQUEST_RECV;
case REQUEST_RECV:
rcode = unlang_interpret(request);
- if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED;
+ if (request->master_state == REQUEST_STOP_PROCESSING) {
+ *p_result = RLM_MODULE_HANDLED;
+ return UNLANG_ACTION_STOP_PROCESSING;
+ }
- if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD;
+ if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD;
switch (rcode) {
/*
RDEBUG("Running 'accounting %s' from file %s", cf_section_name2(unlang), cf_filename(unlang));
if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
request->request_state = REQUEST_PROCESS;
case REQUEST_PROCESS:
rcode = unlang_interpret(request);
- if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED;
+ if (request->master_state == REQUEST_STOP_PROCESSING) {
+ *p_result = RLM_MODULE_HANDLED;
+ return UNLANG_ACTION_STOP_PROCESSING;
+ }
- if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD;
+ if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD;
switch (rcode) {
/*
RDEBUG("Running 'send %s' from file %s", cf_section_name2(unlang), cf_filename(unlang));
if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
request->request_state = REQUEST_SEND;
case REQUEST_SEND:
rcode = unlang_interpret(request);
- if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED;
+ if (request->master_state == REQUEST_STOP_PROCESSING) {
+ *p_result = RLM_MODULE_HANDLED;
+ return UNLANG_ACTION_STOP_PROCESSING;
+ }
- if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD;
+ if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD;
switch (rcode) {
case RLM_MODULE_NOOP:
break;
default:
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
talloc_free(msg);
}
-static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
proto_radius_auth_t const *inst = talloc_get_type_abort_const(mctx->instance, proto_radius_auth_t);
fr_pair_t *vp, *auth_type;
RDEBUG("Running 'recv Access-Request' from file %s", cf_filename(inst->recv_access_request));
if (unlang_interpret_push_instruction(request, inst->unlang_access_request,
RLM_MODULE_REJECT, UNLANG_TOP_FRAME) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
request->request_state = REQUEST_RECV;
case REQUEST_RECV:
rcode = unlang_interpret(request);
- if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED;
+ if (request->master_state == REQUEST_STOP_PROCESSING) {
+ *p_result = RLM_MODULE_HANDLED;
+ return UNLANG_ACTION_STOP_PROCESSING;
+ }
- if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD;
+ if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD;
switch (rcode) {
case RLM_MODULE_NOOP:
RDEBUG("Running 'authenticate %s' from file %s", cf_section_name2(unlang), cf_filename(unlang));
if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOTFOUND, UNLANG_TOP_FRAME) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
request->request_state = REQUEST_PROCESS;
case REQUEST_PROCESS:
rcode = unlang_interpret(request);
- if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED;
+ if (request->master_state == REQUEST_STOP_PROCESSING) {
+ RETURN_MODULE_HANDLED;
+ }
- if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD;
+ if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD;
switch (rcode) {
/*
RDEBUG("Running 'send %s' from file %s", cf_section_name2(unlang), cf_filename(unlang));
if (unlang_interpret_push_instruction(request, instruction, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
request->request_state = REQUEST_SEND;
case REQUEST_SEND:
rcode = unlang_interpret(request);
- if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED;
+ if (request->master_state == REQUEST_STOP_PROCESSING) {
+ *p_result = RLM_MODULE_HANDLED;
+ return UNLANG_ACTION_STOP_PROCESSING;
+ }
- if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD;
+ if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD;
switch (rcode) {
case RLM_MODULE_FAIL:
*/
if (fr_request_to_state(inst->state_tree, request) < 0) {
request->reply->code = FR_CODE_DO_NOT_RESPOND;
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
} else {
fr_state_discard(inst->state_tree, request);
break;
default:
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
static const virtual_server_compile_t compile_list[] = {
{ NULL }
};
-static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_process(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request)
{
fr_pair_t *vp;
rlm_rcode_t rcode;
dv = fr_dict_enum_by_value(attr_packet_type, fr_box_uint32(request->packet->code));
if (!dv) {
REDEBUG("Failed to find value for &request.Packet-Type");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/*
unlang = cf_section_find(request->server_cs, "recv", dv->name);
if (!unlang) {
REDEBUG("Failed to find 'recv %s' section", dv->name);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
RDEBUG("Running 'recv %s' from file %s", dv->name, cf_filename(unlang));
if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
request->request_state = REQUEST_RECV;
case REQUEST_RECV:
rcode = unlang_interpret(request);
- if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED;
+ if (request->master_state == REQUEST_STOP_PROCESSING) {
+ *p_result = RLM_MODULE_HANDLED;
+ return UNLANG_ACTION_STOP_PROCESSING;
+ }
- if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD;
+ if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD;
switch (rcode) {
case RLM_MODULE_NOOP:
rerun_nak:
RDEBUG("Running 'send %s' from file %s", cf_section_name2(unlang), cf_filename(unlang));
if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
request->request_state = REQUEST_SEND;
FALL_THROUGH;
case REQUEST_SEND:
rcode = unlang_interpret(request);
- if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED;
+ if (request->master_state == REQUEST_STOP_PROCESSING) {
+ *p_result = RLM_MODULE_HANDLED;
+ return UNLANG_ACTION_STOP_PROCESSING;
+ }
- if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD;
+ if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD;
switch (rcode) {
/*
break;
default:
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
static const virtual_server_compile_t compile_list[] = {
{ NULL }
};
-static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_process(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request)
{
rlm_rcode_t rcode;
CONF_SECTION *unlang;
RDEBUG("Running 'new client' from file %s", cf_filename(unlang));
if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
request->request_state = REQUEST_RECV;
case REQUEST_RECV:
rcode = unlang_interpret(request);
- if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED;
+ if (request->master_state == REQUEST_STOP_PROCESSING) {
+ *p_result = RLM_MODULE_HANDLED;
+ return UNLANG_ACTION_STOP_PROCESSING;
+ }
- if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD;
+ if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD;
switch (rcode) {
case RLM_MODULE_OK:
case RLM_MODULE_UPDATED:
rerun_nak:
RDEBUG("Running '%s client' from file %s", cf_section_name1(unlang), cf_filename(unlang));
if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
request->request_state = REQUEST_SEND;
case REQUEST_SEND:
rcode = unlang_interpret(request);
- if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED;
+ if (request->master_state == REQUEST_STOP_PROCESSING) {
+ *p_result = RLM_MODULE_HANDLED;
+ return UNLANG_ACTION_STOP_PROCESSING;
+ }
- if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD;
+ if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD;
switch (rcode) {
case RLM_MODULE_NOOP:
break;
default:
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
{ NULL }
};
-static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_process(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request)
{
rlm_rcode_t rcode;
CONF_SECTION *unlang;
RDEBUG("Running 'recv Status-Server' from file %s", cf_filename(unlang));
if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
request->request_state = REQUEST_RECV;
FALL_THROUGH;
case REQUEST_RECV:
rcode = unlang_interpret(request);
- if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED;
+ if (request->master_state == REQUEST_STOP_PROCESSING) {
+ *p_result = RLM_MODULE_HANDLED;
+ return UNLANG_ACTION_STOP_PROCESSING;
+ }
- if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD;
+ if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD;
switch (rcode) {
case RLM_MODULE_OK:
rerun_nak:
RDEBUG("Running 'send %s' from file %s", cf_section_name2(unlang), cf_filename(unlang));
if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
request->request_state = REQUEST_SEND;
case REQUEST_SEND:
rcode = unlang_interpret(request);
- if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED;
+ if (request->master_state == REQUEST_STOP_PROCESSING) {
+ *p_result = RLM_MODULE_HANDLED;
+ return UNLANG_ACTION_STOP_PROCESSING;
+ }
- if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD;
+ if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD;
switch (rcode) {
case RLM_MODULE_NOOP:
break;
default:
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
static int mod_compare(void const *instance, UNUSED void *thread_instance, UNUSED RADCLIENT *client,
void const *one, void const *two)
{
- int rcode;
+ int ret;
proto_radius_tcp_t const *inst = talloc_get_type_abort_const(instance, proto_radius_tcp_t);
uint8_t const *a = one;
* Do a better job of deduping input packet.
*/
if (inst->dedup_authenticator) {
- rcode = memcmp(a + 4, b + 4, RADIUS_AUTH_VECTOR_LENGTH);
- if (rcode != 0) return rcode;
+ ret = memcmp(a + 4, b + 4, RADIUS_AUTH_VECTOR_LENGTH);
+ if (ret != 0) return ret;
}
/*
* The tree is ordered by IDs, which are (hopefully)
* pseudo-randomly distributed.
*/
- rcode = (a[1] < b[1]) - (a[1] > b[1]);
- if (rcode != 0) return rcode;
+ ret = (a[1] < b[1]) - (a[1] > b[1]);
+ if (ret != 0) return ret;
/*
* Then ordered by code, which is usally the same.
static int mod_compare(void const *instance, UNUSED void *thread_instance, UNUSED RADCLIENT *client,
void const *one, void const *two)
{
- int rcode;
+ int ret;
proto_radius_udp_t const *inst = talloc_get_type_abort_const(instance, proto_radius_udp_t);
uint8_t const *a = one;
* Do a better job of deduping input packet.
*/
if (inst->dedup_authenticator) {
- rcode = memcmp(a + 4, b + 4, RADIUS_AUTH_VECTOR_LENGTH);
- if (rcode != 0) return rcode;
+ ret = memcmp(a + 4, b + 4, RADIUS_AUTH_VECTOR_LENGTH);
+ if (ret != 0) return ret;
}
/*
* The tree is ordered by IDs, which are (hopefully)
* pseudo-randomly distributed.
*/
- rcode = (a[1] < b[1]) - (a[1] > b[1]);
- if (rcode != 0) return rcode;
+ ret = (a[1] < b[1]) - (a[1] > b[1]);
+ if (ret != 0) return ret;
/*
* Then ordered by code, which is usually the same.
vp->vp_uint8 = FR_TACACS_ACCOUNTING_STATUS_VALUE_ERROR;
}
-static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
proto_tacacs_acct_t const *inst = talloc_get_type_abort_const(mctx->instance, proto_tacacs_acct_t);
rlm_rcode_t rcode;
*/
RDEBUG("Running 'recv %s' from file %s", cf_section_name2(inst->recv_request), cf_filename(inst->recv_request));
if (unlang_interpret_push_instruction(request, inst->unlang_request, RLM_MODULE_REJECT, UNLANG_TOP_FRAME) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
request->request_state = REQUEST_RECV;
case REQUEST_RECV:
rcode = unlang_interpret(request);
- if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED;
+ if (request->master_state == REQUEST_STOP_PROCESSING) {
+ *p_result = RLM_MODULE_HANDLED;
+ return UNLANG_ACTION_STOP_PROCESSING;
+ }
- if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD;
+ if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD;
switch (rcode) {
case RLM_MODULE_NOOP:
RDEBUG("Running 'accounting %s' from file %s", cf_section_name2(unlang), cf_filename(unlang));
if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
request->request_state = REQUEST_PROCESS;
case REQUEST_PROCESS:
rcode = unlang_interpret(request);
- if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED;
+ if (request->master_state == REQUEST_STOP_PROCESSING) {
+ *p_result = RLM_MODULE_HANDLED;
+ return UNLANG_ACTION_STOP_PROCESSING;
+ }
- if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD;
+ if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD;
switch (rcode) {
/*
setup_send:
RDEBUG("Running 'send %s' from file %s", cf_section_name2(inst->send_reply), cf_filename(inst->send_reply));
if (unlang_interpret_push_instruction(request, inst->unlang_reply, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
request->request_state = REQUEST_SEND;
case REQUEST_SEND:
rcode = unlang_interpret(request);
- if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED;
+ if (request->master_state == REQUEST_STOP_PROCESSING) {
+ *p_result = RLM_MODULE_HANDLED;
+ return UNLANG_ACTION_STOP_PROCESSING;
+ }
- if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD;
+ if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD;
switch (rcode) {
case RLM_MODULE_FAIL:
break;
default:
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
static int mod_instantiate(void *instance, UNUSED CONF_SECTION *process_app_cs)
}
-static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
proto_tacacs_auth_t const *inst = talloc_get_type_abort_const(mctx->instance, proto_tacacs_auth_t);
fr_pair_t *vp;
*/
RDEBUG("Running 'recv %s' from file %s", cf_section_name2(auth_ctx->recv_request), cf_filename(auth_ctx->recv_request));
if (unlang_interpret_push_instruction(request, auth_ctx->unlang_request, RLM_MODULE_REJECT, UNLANG_TOP_FRAME) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
request->request_state = REQUEST_RECV;
case REQUEST_RECV:
rcode = unlang_interpret(request);
- if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED;
+ if (request->master_state == REQUEST_STOP_PROCESSING) {
+ *p_result = RLM_MODULE_HANDLED;
+ return UNLANG_ACTION_STOP_PROCESSING;
+ }
- if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD;
+ if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD;
switch (rcode) {
case RLM_MODULE_NOOP:
RDEBUG("Running 'authenticate %s' from file %s", cf_section_name2(unlang), cf_filename(unlang));
if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOTFOUND, UNLANG_TOP_FRAME) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
request->request_state = REQUEST_PROCESS;
case REQUEST_PROCESS:
rcode = unlang_interpret(request);
- if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED;
+ if (request->master_state == REQUEST_STOP_PROCESSING) {
+ *p_result = RLM_MODULE_HANDLED;
+ return UNLANG_ACTION_STOP_PROCESSING;
+ }
- if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD;
+ if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD;
switch (rcode) {
/*
setup_send:
RDEBUG("Running 'send %s' from file %s", cf_section_name2(auth_ctx->send_reply), cf_filename(auth_ctx->send_reply));
if (unlang_interpret_push_instruction(request, auth_ctx->unlang_reply, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
request->request_state = REQUEST_SEND;
case REQUEST_SEND:
rcode = unlang_interpret(request);
- if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED;
+ if (request->master_state == REQUEST_STOP_PROCESSING) {
+ *p_result = RLM_MODULE_HANDLED;
+ return UNLANG_ACTION_STOP_PROCESSING;
+ }
- if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD;
+ if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD;
switch (rcode) {
case RLM_MODULE_FAIL:
break;
default:
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
static virtual_server_compile_t compile_list[] = {
}
-static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
proto_tacacs_autz_t const *inst = talloc_get_type_abort_const(mctx->instance, proto_tacacs_autz_t);
rlm_rcode_t rcode;
*/
RDEBUG("Running 'recv %s' from file %s", cf_section_name2(inst->recv_request), cf_filename(inst->recv_request));
if (unlang_interpret_push_instruction(request, inst->unlang_request, RLM_MODULE_REJECT, UNLANG_TOP_FRAME) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
request->request_state = REQUEST_RECV;
case REQUEST_RECV:
rcode = unlang_interpret(request);
- if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED;
+ if (request->master_state == REQUEST_STOP_PROCESSING) {
+ *p_result = RLM_MODULE_HANDLED;
+ return UNLANG_ACTION_STOP_PROCESSING;
+ }
- if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD;
+ if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD;
switch (rcode) {
case RLM_MODULE_NOOP:
RDEBUG("Running 'send %s' from file %s", cf_section_name2(inst->send_reply), cf_filename(inst->send_reply));
if (unlang_interpret_push_instruction(request, inst->unlang_reply, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
request->request_state = REQUEST_SEND;
case REQUEST_SEND:
rcode = unlang_interpret(request);
- if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED;
+ if (request->master_state == REQUEST_STOP_PROCESSING) {
+ *p_result = RLM_MODULE_HANDLED;
+ return UNLANG_ACTION_STOP_PROCESSING;
+ }
- if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD;
+ if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD;
switch (rcode) {
case RLM_MODULE_FAIL:
break;
default:
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
static virtual_server_compile_t compile_list[] = {
static int mod_compare(UNUSED void const *instance, UNUSED void *thread_instance, UNUSED RADCLIENT *client,
void const *one, void const *two)
{
- int rcode;
+ int ret;
proto_tacacs_track_t const *a = talloc_get_type_abort_const(one, proto_tacacs_track_t);
proto_tacacs_track_t const *b = talloc_get_type_abort_const(two, proto_tacacs_track_t);
/*
* Session IDs SHOULD be random 32-bit integers.
*/
- rcode = (a->session_id < b->session_id) - (a->session_id > b->session_id);
- if (rcode != 0) return rcode;
+ ret = (a->session_id < b->session_id) - (a->session_id > b->session_id);
+ if (ret != 0) return ret;
/*
* Then ordered by our synthetic packet type.
#define CLIENT_ADD (1)
#define CLIENT_NAK (257)
-static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_process(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request)
{
rlm_rcode_t rcode;
CONF_SECTION *unlang;
RDEBUG("Running 'new client' from file %s", cf_filename(unlang));
if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
request->request_state = REQUEST_RECV;
case REQUEST_RECV:
rcode = unlang_interpret(request);
- if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED;
+ if (request->master_state == REQUEST_STOP_PROCESSING) {
+ *p_result = RLM_MODULE_HANDLED;
+ return UNLANG_ACTION_STOP_PROCESSING;
+ }
- if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD;
+ if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD;
switch (rcode) {
case RLM_MODULE_OK:
rerun_nak:
RDEBUG("Running '%s client' from file %s", cf_section_name1(unlang), cf_filename(unlang));
if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
request->request_state = REQUEST_SEND;
case REQUEST_SEND:
rcode = unlang_interpret(request);
- if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED;
+ if (request->master_state == REQUEST_STOP_PROCESSING) {
+ *p_result = RLM_MODULE_HANDLED;
+ return UNLANG_ACTION_STOP_PROCESSING;
+ }
- if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD;
+ if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD;
switch (rcode) {
case RLM_MODULE_NOOP:
break;
default:
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
{ NULL }
};
-static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_process(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request)
{
rlm_rcode_t rcode;
CONF_SECTION *unlang;
dv = fr_dict_enum_by_value(attr_packet_type, fr_box_uint32(request->packet->code));
if (!dv) {
REDEBUG("Failed to find value for &request.VMPS-Packet-Type");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
unlang = cf_section_find(request->server_cs, "recv", dv->name);
RDEBUG("Running 'recv %s' from file %s", cf_section_name2(unlang), cf_filename(unlang));
if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
request->request_state = REQUEST_RECV;
case REQUEST_RECV:
rcode = unlang_interpret(request);
- if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED;
+ if (request->master_state == REQUEST_STOP_PROCESSING) {
+ *p_result = RLM_MODULE_HANDLED;
+ return UNLANG_ACTION_STOP_PROCESSING;
+ }
- if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD;
+ if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD;
switch (rcode) {
case RLM_MODULE_NOOP:
rerun_nak:
RDEBUG("Running 'send %s' from file %s", cf_section_name2(unlang), cf_filename(unlang));
if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
request->request_state = REQUEST_SEND;
case REQUEST_SEND:
rcode = unlang_interpret(request);
- if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED;
+ if (request->master_state == REQUEST_STOP_PROCESSING) {
+ *p_result = RLM_MODULE_HANDLED;
+ return UNLANG_ACTION_STOP_PROCESSING;
+ }
- if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD;
+ if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD;
switch (rcode) {
case RLM_MODULE_NOOP:
*/
if (request->reply->code == FR_PACKET_TYPE_VALUE_DO_NOT_RESPOND) {
RDEBUG("Not sending reply to client.");
- return RLM_MODULE_HANDLED;
+ RETURN_MODULE_HANDLED;
}
/*
break;
default:
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
{
proto_vmps_track_t const *a = talloc_get_type_abort_const(one, proto_vmps_track_t);
proto_vmps_track_t const *b = talloc_get_type_abort_const(two, proto_vmps_track_t);
- int rcode;
+ int ret;
/*
* Order by transaction ID
*/
- rcode = (a->transaction_id < b->transaction_id) - (a->transaction_id > b->transaction_id);
- if (rcode != 0) return rcode;
+ ret = (a->transaction_id < b->transaction_id) - (a->transaction_id > b->transaction_id);
+ if (ret != 0) return ret;
/*
* Then ordered by opcode, which is usally the same.
* Just return the rcode ... this function is autz, auth, acct, and
* preacct!
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_always_return(module_ctx_t const *mctx, UNUSED request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_always_return(rlm_rcode_t *p_result, module_ctx_t const *mctx, UNUSED request_t *request)
{
rlm_always_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_always_t);
- return inst->rcode;
+ RETURN_MODULE_RCODE(inst->rcode);
}
extern module_t rlm_always;
/*
* Common attr_filter checks
*/
-static rlm_rcode_t CC_HINT(nonnull(1,2)) attr_filter_common(void const *instance, request_t *request,
- fr_radius_packet_t *packet)
+static unlang_action_t CC_HINT(nonnull(1,2)) attr_filter_common(rlm_rcode_t *p_result,
+ void const *instance, request_t *request,
+ fr_radius_packet_t *packet)
{
rlm_attr_filter_t const *inst = talloc_get_type_abort_const(instance, rlm_attr_filter_t);
fr_pair_t *vp;
char buffer[256];
ssize_t slen;
- if (!packet) return RLM_MODULE_NOOP;
+ if (!packet) {
+ RETURN_MODULE_NOOP;
+ }
slen = tmpl_expand(&keyname, buffer, sizeof(buffer), request, inst->key, NULL, NULL);
- if (slen < 0) return RLM_MODULE_FAIL;
+ if (slen < 0) {
+ RETURN_MODULE_FAIL;
+ }
if ((keyname == buffer) && is_truncated((size_t)slen, sizeof(buffer))) {
REDEBUG("Key too long, expected < " STRINGIFY(sizeof(buffer)) " bytes, got %zi bytes", slen);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/*
*/
if (!found) {
fr_assert(!output);
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
/*
fr_pair_list_free(&packet->vps);
packet->vps = output;
- return RLM_MODULE_UPDATED;
+ RETURN_MODULE_UPDATED;
error:
fr_pair_list_free(&output);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
-#define RLM_AF_FUNC(_x, _y) static rlm_rcode_t CC_HINT(nonnull) mod_##_x(module_ctx_t const *mctx, request_t *request) \
+#define RLM_AF_FUNC(_x, _y) static unlang_action_t CC_HINT(nonnull) mod_##_x(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) \
{ \
- return attr_filter_common(mctx->instance, request, request->_y); \
+ return attr_filter_common(p_result, mctx->instance, request, request->_y); \
}
RLM_AF_FUNC(authorize, packet)
* - #RLM_MODULE_FAIL on failure.
* - #RLM_MODULE_NOTFOUND on cache miss.
*/
-static rlm_rcode_t cache_find(rlm_cache_entry_t **out, rlm_cache_t const *inst, request_t *request,
- rlm_cache_handle_t **handle, uint8_t const *key, size_t key_len)
+static unlang_action_t cache_find(rlm_rcode_t *p_result, rlm_cache_entry_t **out,
+ rlm_cache_t const *inst, request_t *request,
+ rlm_cache_handle_t **handle, uint8_t const *key, size_t key_len)
{
cache_status_t ret;
case CACHE_RECONNECT:
RDEBUG2("Reconnecting...");
if (cache_reconnect(handle, inst, request) == 0) continue;
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
case CACHE_OK:
break;
case CACHE_MISS:
RDEBUG2("No cache entry found for \"%pV\"", fr_box_strvalue_len((char const *)key, key_len));
- return RLM_MODULE_NOTFOUND;
+ RETURN_MODULE_NOTFOUND;
default:
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
inst->driver->expire(&inst->config, inst->driver_inst->dl_inst->data, request, handle, c->key, c->key_len);
cache_free(inst, &c);
- return RLM_MODULE_NOTFOUND; /* Couldn't find a non-expired entry */
+ RETURN_MODULE_NOTFOUND; /* Couldn't find a non-expired entry */
}
RDEBUG2("Found entry for \"%pV\"", fr_box_strvalue_len((char const *)key, key_len));
c->hits++;
*out = c;
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
/** Expire a cache entry (removing it from the datastore)
* - #RLM_MODULE_NOTFOUND if no entry existed.
* - #RLM_MODULE_FAIL on failure.
*/
-static rlm_rcode_t cache_expire(rlm_cache_t const *inst, request_t *request,
- rlm_cache_handle_t **handle, uint8_t const *key, size_t key_len)
+static unlang_action_t cache_expire(rlm_rcode_t *p_result,
+ rlm_cache_t const *inst, request_t *request,
+ rlm_cache_handle_t **handle, uint8_t const *key, size_t key_len)
{
RDEBUG2("Expiring cache entry");
for (;;) switch (inst->driver->expire(&inst->config, inst->driver_inst->dl_inst->data, request,
FALL_THROUGH;
default:
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
case CACHE_OK:
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
case CACHE_MISS:
- return RLM_MODULE_NOTFOUND;
+ RETURN_MODULE_NOTFOUND;
}
}
* - #RLM_MODULE_UPDATED if we merged the cache entry.
* - #RLM_MODULE_FAIL on failure.
*/
-static rlm_rcode_t cache_insert(rlm_cache_t const *inst, request_t *request, rlm_cache_handle_t **handle,
- uint8_t const *key, size_t key_len, int ttl)
+static unlang_action_t cache_insert(rlm_rcode_t *p_result,
+ rlm_cache_t const *inst, request_t *request, rlm_cache_handle_t **handle,
+ uint8_t const *key, size_t key_len, int ttl)
{
map_t const *map;
map_t **last, *c_map;
if ((inst->config.max_entries > 0) && inst->driver->count &&
(inst->driver->count(&inst->config, inst->driver_inst->dl_inst->data, request, handle) > inst->config.max_entries)) {
RWDEBUG("Cache is full: %d entries", inst->config.max_entries);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
c = cache_alloc(inst, request);
- if (!c) return RLM_MODULE_FAIL;
-
+ if (!c) {
+ RETURN_MODULE_FAIL;
+ }
c->key = talloc_memdup(c, key, key_len);
c->key_len = key_len;
error:
talloc_free(pool);
talloc_free(c);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
}
break;
switch (ret) {
case CACHE_RECONNECT:
if (cache_reconnect(handle, inst, request) == 0) continue;
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
case CACHE_OK:
RDEBUG2("Committed entry, TTL %d seconds", ttl);
cache_free(inst, &c);
- return merge ? RLM_MODULE_UPDATED :
- RLM_MODULE_OK;
+ RETURN_MODULE_RCODE(merge ? RLM_MODULE_UPDATED : RLM_MODULE_OK);
default:
talloc_free(c); /* Failed insertion - use talloc_free not the driver free */
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
}
}
* - #RLM_MODULE_OK on success.
* - #RLM_MODULE_FAIL on failure.
*/
-static rlm_rcode_t cache_set_ttl(rlm_cache_t const *inst, request_t *request,
- rlm_cache_handle_t **handle, rlm_cache_entry_t *c)
+static unlang_action_t cache_set_ttl(rlm_rcode_t *p_result,
+ rlm_cache_t const *inst, request_t *request,
+ rlm_cache_handle_t **handle, rlm_cache_entry_t *c)
{
/*
* Call the driver's insert method to overwrite the old entry
switch (ret) {
case CACHE_RECONNECT:
if (cache_reconnect(handle, inst, request) == 0) continue;
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
case CACHE_OK:
RDEBUG2("Updated entry TTL");
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
default:
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
}
switch (ret) {
case CACHE_RECONNECT:
if (cache_reconnect(handle, inst, request) == 0) continue;
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
case CACHE_OK:
RDEBUG2("Updated entry TTL");
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
default:
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
}
}
* If you want to cache something different in different sections, configure
* another cache module.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_cache_it(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_cache_it(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_cache_entry_t *c = NULL;
rlm_cache_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_cache_t);
key_len = tmpl_expand((char const **)&key, (char *)buffer, sizeof(buffer),
request, inst->config.key, NULL, NULL);
- if (key_len < 0) return RLM_MODULE_FAIL;
+ if (key_len < 0) {
+ RETURN_MODULE_FAIL;
+ }
if (key_len == 0) {
REDEBUG("Zero length key string is invalid");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
RDEBUG3("status-only: yes");
REXDENT();
- if (cache_acquire(&handle, inst, request) < 0) return RLM_MODULE_FAIL;
+ if (cache_acquire(&handle, inst, request) < 0) {
+ RETURN_MODULE_FAIL;
+ }
- rcode = cache_find(&c, inst, request, &handle, key, key_len);
+ cache_find(&rcode, &c, inst, request, &handle, key, key_len);
if (rcode == RLM_MODULE_FAIL) goto finish;
fr_assert(!inst->driver->acquire || handle);
RDEBUG3("expire : %s", expire ? "yes" : "no");
RDEBUG3("ttl : %i", ttl);
REXDENT();
- if (cache_acquire(&handle, inst, request) < 0) return RLM_MODULE_FAIL;
+ if (cache_acquire(&handle, inst, request) < 0) {
+ RETURN_MODULE_FAIL;
+ }
/*
* Retrieve the cache entry and merge it with the current request
* recording whether the entry existed.
*/
if (merge) {
- rcode = cache_find(&c, inst, request, &handle, key, key_len);
+ cache_find(&rcode, &c, inst, request, &handle, key, key_len);
switch (rcode) {
case RLM_MODULE_FAIL:
goto finish;
*/
if (expire && ((exists == -1) || (exists == 1))) {
if (!insert) {
+ rlm_rcode_t tmp;
+
fr_assert(!set_ttl);
- switch (cache_expire(inst, request, &handle, key, key_len)) {
+ cache_expire(&tmp, inst, request, &handle, key, key_len);
+ switch (tmp) {
case RLM_MODULE_FAIL:
rcode = RLM_MODULE_FAIL;
goto finish;
* determine that now.
*/
if ((exists < 0) && (insert || set_ttl)) {
- switch (cache_find(&c, inst, request, &handle, key, key_len)) {
+ rlm_rcode_t tmp;
+
+ cache_find(&tmp, &c, inst, request, &handle, key, key_len);
+ switch (tmp) {
case RLM_MODULE_FAIL:
rcode = RLM_MODULE_FAIL;
goto finish;
* We can only alter the TTL on an entry if it exists.
*/
if (set_ttl && (exists == 1)) {
+ rlm_rcode_t tmp;
+
fr_assert(c);
c->expires = fr_time_to_unix_time(request->packet->timestamp) + fr_unix_time_from_sec(ttl);
- switch (cache_set_ttl(inst, request, &handle, c)) {
+ cache_set_ttl(&tmp, inst, request, &handle, c);
+ switch (tmp) {
case RLM_MODULE_FAIL:
rcode = RLM_MODULE_FAIL;
goto finish;
* insert.
*/
if (insert && (exists == 0)) {
- switch (cache_insert(inst, request, &handle, key, key_len, ttl)) {
+ rlm_rcode_t tmp;
+
+ cache_insert(&tmp, inst, request, &handle, key, key_len, ttl);
+ switch (tmp) {
case RLM_MODULE_FAIL:
rcode = RLM_MODULE_FAIL;
goto finish;
}
}
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
/** Allow single attribute values to be retrieved from the cache
uint8_t const *key;
ssize_t key_len;
- tmpl_t *target = NULL;
- map_t *map = NULL;
+ tmpl_t *target = NULL;
+ map_t *map = NULL;
+ rlm_rcode_t rcode = RLM_MODULE_NOOP;
key_len = tmpl_expand((char const **)&key, (char *)buffer, sizeof(buffer),
request, inst->config.key, NULL, NULL);
return -1;
}
- switch (cache_find(&c, mod_inst, request, &handle, key, key_len)) {
+ cache_find(&rcode, &c, mod_inst, request, &handle, key, key_len);
+ switch (rcode) {
case RLM_MODULE_OK: /* found */
break;
return XLAT_ACTION_DONE;
}
-static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
fr_pair_t *vp;
rlm_chap_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_chap_t);
if (fr_pair_find_by_da(&request->control_pairs, attr_auth_type) != NULL) {
RDEBUG3("Auth-Type is already set. Not setting 'Auth-Type := %s'", inst->name);
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
/*
* This case means the warnings below won't be printed
* unless there's a CHAP-Password in the request.
*/
- if (!fr_pair_find_by_da(&request->request_pairs, attr_chap_password)) return RLM_MODULE_NOOP;
+ if (!fr_pair_find_by_da(&request->request_pairs, attr_chap_password)) {
+ RETURN_MODULE_NOOP;
+ }
/*
* Create the CHAP-Challenge if it wasn't already in the packet.
if (!inst->auth_type) {
WARN("No 'authenticate %s {...}' section or 'Auth-Type = %s' set. Cannot setup CHAP authentication",
inst->name, inst->name);
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
- if (!module_section_type_set(request, attr_auth_type, inst->auth_type)) return RLM_MODULE_NOOP;
+ if (!module_section_type_set(request, attr_auth_type, inst->auth_type)) {
+ RETURN_MODULE_NOOP;
+ }
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
/*
* from the database. The authentication code only needs to check
* the password, the rest is done here.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(UNUSED module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authenticate(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request)
{
fr_pair_t *known_good;
fr_pair_t *chap, *username;
username = fr_pair_find_by_da(&request->request_pairs, attr_user_name);
if (!username) {
REDEBUG("&User-Name attribute is required for authentication");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
chap = fr_pair_find_by_da(&request->request_pairs, attr_chap_password);
if (!chap) {
REDEBUG("You set '&control.Auth-Type = CHAP' for a request that "
"does not contain a CHAP-Password attribute!");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
if (chap->vp_length == 0) {
REDEBUG("&request.CHAP-Password is empty");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
if (chap->vp_length != RADIUS_CHAP_CHALLENGE_LENGTH + 1) {
REDEBUG("&request.CHAP-Password has invalid length");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
false);
if (!known_good) {
REDEBUG("No \"known good\" password found for user");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/*
if (ret != 0) {
REDEBUG("Password comparison failed: password is incorrect");
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
}
RDEBUG2("CHAP user \"%pV\" authenticated successfully", &username->data);
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
static int mod_bootstrap(void *instance, CONF_SECTION *conf)
/*
* Find the client definition.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_authorize(UNUSED module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request)
{
size_t length;
char const *value;
if ((request->packet->socket.inet.src_port != 0) || (request->request_pairs != NULL) ||
(request->parent != NULL)) {
REDEBUG("Improper configuration");
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
if (!request->client || !request->client->cs) {
REDEBUG("Unknown client definition");
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
cp = cf_pair_find(request->client->cs, "directory");
if (!cp) {
REDEBUG("No directory configuration in the client");
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
value = cf_pair_value(cp);
if (!value) {
REDEBUG("No value given for the directory entry in the client");
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
length = strlen(value);
if (length > (sizeof(buffer) - 256)) {
REDEBUG("Directory name too long");
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
memcpy(buffer, value, length + 1);
} else if (request->listener) {
server_cs = request->listener->server_cs;
} else {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
c = client_read(buffer, server_cs, true);
- if (!c) return RLM_MODULE_FAIL;
+ if (!c) RETURN_MODULE_FAIL;
/*
* Replace the client. This is more than a bit of a
*/
request->client = c;
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
/*
* @param request The authorization request.
* @return Operation status (#rlm_rcode_t).
*/
-static rlm_rcode_t mod_authorize(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_couchbase_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_couchbase_t); /* our module instance */
rlm_couchbase_handle_t *handle = NULL; /* connection pool handle */
/* attempt to build document key */
slen = tmpl_expand(&dockey, buffer, sizeof(buffer), request, inst->user_key, NULL, NULL);
- if (slen < 0) return RLM_MODULE_FAIL;
+ if (slen < 0) RETURN_MODULE_FAIL;
if ((dockey == buffer) && is_truncated((size_t)slen, sizeof(buffer))) {
REDEBUG("Key too long, expected < " STRINGIFY(sizeof(buffer)) " bytes, got %zi bytes", slen);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/* get handle */
handle = fr_pool_connection_get(inst->pool, request);
/* check handle */
- if (!handle) return RLM_MODULE_FAIL;
+ if (!handle) RETURN_MODULE_FAIL;
/* set couchbase instance */
lcb_t cb_inst = handle->handle;
if (handle) fr_pool_connection_release(inst->pool, request, handle);
/* return */
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
/** Write accounting data to Couchbase documents
* @param request The accounting request object.
* @return Operation status (#rlm_rcode_t).
*/
-static rlm_rcode_t mod_accounting(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_accounting(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_couchbase_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_couchbase_t); /* our module instance */
rlm_couchbase_handle_t *handle = NULL; /* connection pool handle */
/* log debug */
RDEBUG2("could not find status type in packet");
/* return */
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
/* set status */
/* log debug */
RDEBUG2("handling accounting on/off request without action");
/* return */
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
/* get handle */
handle = fr_pool_connection_get(inst->pool, request);
/* check handle */
- if (!handle) return RLM_MODULE_FAIL;
+ if (!handle) RETURN_MODULE_FAIL;
/* set couchbase instance */
lcb_t cb_inst = handle->handle;
}
/* return */
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
}
-static rlm_rcode_t CC_HINT(nonnull) mod_process(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_csv_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_csv_t);
rlm_rcode_t rcode;
ssize_t slen;
fr_value_box_t *key;
- if (!inst->map || !inst->key) return RLM_MODULE_NOOP;
+ if (!inst->map || !inst->key) RETURN_MODULE_NOOP;
/*
* Expand the key to whatever it is. For attributes,
slen = tmpl_aexpand_type(request, &key, FR_TYPE_VALUE_BOX, request, inst->key, NULL, NULL);
if (slen < 0) {
DEBUG("Failed expanding key '%s'", inst->key->name);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/*
talloc_free(key);
DEBUG("Failed casting %pV to data type '%s'",
&key, fr_table_str_by_value(tmpl_type_table, inst->key_data_type, "<INVALID>"));
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
}
REXDENT();
talloc_free(key);
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
extern module_t rlm_csv;
/** Called resume_at the delay is complete, and we're running from the interpreter
*
*/
-static rlm_rcode_t mod_delay_return(UNUSED module_ctx_t const *mctx, request_t *request, void *rctx)
+static unlang_action_t mod_delay_return(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx,
+ request_t *request, void *rctx)
{
fr_time_t *yielded = talloc_get_type_abort(rctx, fr_time_t);
RDEBUG3("Request delayed by %pV", fr_box_time_delta(fr_time() - *yielded));
talloc_free(yielded);
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
static void mod_delay_cancel(UNUSED module_ctx_t const *mctx, request_t *request, void *rctx,
(void) unlang_module_timeout_delete(request, rctx);
}
-static rlm_rcode_t CC_HINT(nonnull) mod_delay(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_delay(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_delay_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_delay_t);
fr_time_delta_t delay;
if (inst->delay) {
if (tmpl_aexpand_type(request, &delay, FR_TYPE_TIME_DELTA,
- request, inst->delay, NULL, NULL) < 0) return RLM_MODULE_FAIL;
+ request, inst->delay, NULL, NULL) < 0) RETURN_MODULE_FAIL;
} else {
delay = 0;
}
*/
if (delay_add(request, &resume_at, *yielded_at, delay,
inst->force_reschedule, inst->delay) != 0) {
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
/*
if (unlang_module_timeout_add(request, _delay_done, yielded_at, resume_at) < 0) {
RPEDEBUG("Adding event failed");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
return unlang_module_yield(request, mod_delay_return, mod_delay_cancel, yielded_at);
/*
* Do detail, compatible with old accounting
*/
-static rlm_rcode_t CC_HINT(nonnull) detail_do(void const *instance, request_t *request,
- fr_radius_packet_t *packet, bool compat)
+static unlang_action_t CC_HINT(nonnull) detail_do(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request,
+ fr_radius_packet_t *packet, bool compat)
{
int outfd, dupfd;
char buffer[DIRLEN];
char *endptr;
#endif
- rlm_detail_t const *inst = talloc_get_type_abort_const(instance, rlm_detail_t);
+ rlm_detail_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_detail_t);
/*
* Generate the path for the detail file. Use the same
* through xlat_eval() to expand the variables.
*/
if (xlat_eval(buffer, sizeof(buffer), request, inst->filename, inst->escape_func, NULL) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
RDEBUG2("%s expands to %s", inst->filename, buffer);
if (outfd < 0) {
RPERROR("Couldn't open file %s", buffer);
/* coverity[missing_unlock] */
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
if (inst->group != NULL) {
fail:
if (outfp) fclose(outfp);
exfile_close(inst->ef, request, outfd);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
if (detail_write(outfp, inst, request, packet, compat) < 0) goto fail;
/*
* And everything is fine.
*/
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
/*
* Accounting - write the detail files.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_accounting(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
- return detail_do(mctx->instance, request, request->packet, true);
+ return detail_do(p_result, mctx, request, request->packet, true);
}
/*
* Incoming Access Request - write the detail files.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
- return detail_do(mctx->instance, request, request->packet, false);
+ return detail_do(p_result, mctx, request, request->packet, false);
}
/*
* Outgoing Access-Request Reply - write the detail files.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_post_auth(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_post_auth(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
- return detail_do(mctx->instance, request, request->reply, false);
+ return detail_do(p_result, mctx, request, request->reply, false);
}
{ NULL }
};
-static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_digest_t const *inst = talloc_get_type_abort(mctx->instance, rlm_digest_t);
fr_cursor_t cursor;
* For simplicity, we allow the caller to omit things
* that they don't care about.
*/
- if (!vp) return RLM_MODULE_NOOP;
+ if (!vp) RETURN_MODULE_NOOP;
if (!inst->auth_type) {
WARN("No 'authenticate %s {...}' section or 'Auth-Type = %s' set. Cannot setup Digest authentication",
inst->name, inst->name);
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
/*
* Everything's OK, add a digest authentication type.
*/
- if (!module_section_type_set(request, attr_auth_type, inst->auth_type)) return RLM_MODULE_NOOP;
+ if (!module_section_type_set(request, attr_auth_type, inst->auth_type)) RETURN_MODULE_NOOP;
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
/*
* Perform all of the wondrous variants of digest authentication.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(UNUSED module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authenticate(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request)
{
size_t a1_len, a2_len, kd_len;
uint8_t a1[(FR_MAX_STRING_LEN + 1) * 5]; /* can be 5 attributes */
if (passwd) {
if (passwd->vp_length != 32) {
REDEBUG("Digest-HA1 has invalid length, authentication failed");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
} else {
passwd = fr_pair_find_by_da(&request->control_pairs, attr_cleartext_password);
}
if (!passwd) {
REDEBUG("Cleartext-Password or Digest-HA1 is required for authentication");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
nonce = fr_pair_find_by_da(&request->request_pairs, attr_digest_nonce);
if (!nonce) {
REDEBUG("No Digest-Nonce: Cannot perform Digest authentication");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
vp = fr_pair_find_by_da(&request->request_pairs, attr_digest_user_name);
if (!vp) {
REDEBUG("No Digest-User-Name: Cannot perform Digest authentication");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
memcpy(&a1[0], vp->vp_octets, vp->vp_length);
a1_len = vp->vp_length;
vp = fr_pair_find_by_da(&request->request_pairs, attr_digest_realm);
if (!vp) {
REDEBUG("No Digest-Realm: Cannot perform Digest authentication");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
memcpy(&a1[a1_len], vp->vp_octets, vp->vp_length);
a1_len += vp->vp_length;
if (fr_hex2bin(NULL, &FR_DBUFF_TMP(&a1[0], sizeof(a1)),
&FR_SBUFF_IN(passwd->vp_strvalue, passwd->vp_length), false) != 16) {
RDEBUG2("Invalid text in Digest-HA1");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
}
*/
if ((nonce->vp_length & 1) != 0) {
REDEBUG("Received Digest-Nonce hex string with invalid length: Cannot perform Digest authentication");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
memcpy(&a1[a1_len], nonce->vp_octets, nonce->vp_length);
a1_len += nonce->vp_length;
vp = fr_pair_find_by_da(&request->request_pairs, attr_digest_cnonce);
if (!vp) {
REDEBUG("No Digest-CNonce: Cannot perform Digest authentication");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
*/
if ((vp->vp_length & 1) != 0) {
REDEBUG("Received Digest-CNonce hex string with invalid length: Cannot perform Digest authentication");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
memcpy(&a1[a1_len], vp->vp_octets, vp->vp_length);
a1_len += vp->vp_length;
* Anything else is an error.
*/
REDEBUG("%pP - Unknown Digest-Algorithm: Cannot perform Digest authentication", vp);
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
vp = fr_pair_find_by_da(&request->request_pairs, attr_digest_method);
if (!vp) {
REDEBUG("No Digest-Method: Cannot perform Digest authentication");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
memcpy(&a2[0], vp->vp_octets, vp->vp_length);
a2_len = vp->vp_length;
vp = fr_pair_find_by_da(&request->request_pairs, attr_digest_uri);
if (!vp) {
REDEBUG("No Digest-URI: Cannot perform Digest authentication");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
memcpy(&a2[a2_len], vp->vp_octets, vp->vp_length);
a2_len += vp->vp_length;
body = fr_pair_find_by_da(&request->request_pairs, attr_digest_body_digest);
if (!body) {
REDEBUG("No Digest-Body-Digest: Cannot perform Digest authentication");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
if ((a2_len + body->vp_length) > sizeof(a2)) {
REDEBUG("Digest-Body-Digest is too long");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
memcpy(a2 + a2_len, body->vp_octets, body->vp_length);
} else if (strcasecmp(qop->vp_strvalue, "auth") != 0) {
REDEBUG("%pP - Unknown value: Cannot perform Digest authentication", qop);
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
}
vp = fr_pair_find_by_da(&request->request_pairs, attr_digest_nonce_count);
if (!vp) {
REDEBUG("No Digest-Nonce-Count: Cannot perform Digest authentication");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
memcpy(&kd[kd_len], vp->vp_octets, vp->vp_length);
kd_len += vp->vp_length;
vp = fr_pair_find_by_da(&request->request_pairs, attr_digest_cnonce);
if (!vp) {
REDEBUG("No Digest-CNonce: Cannot perform Digest authentication");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
memcpy(&kd[kd_len], vp->vp_octets, vp->vp_length);
kd_len += vp->vp_length;
vp = fr_pair_find_by_da(&request->request_pairs, attr_digest_response);
if (!vp) {
REDEBUG("No Digest-Response attribute in the request. Cannot perform digest authentication");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
if (fr_hex2bin(NULL, &FR_DBUFF_TMP(&hash[0], sizeof(hash)),
&FR_SBUFF_IN(vp->vp_strvalue, vp->vp_length), false) != (ssize_t)(vp->vp_length >> 1)) {
RDEBUG2("Invalid text in Digest-Response");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
RDEBUG3("Comparing hashes, received: %pV, calculated: %pH", &vp->data, fr_box_octets(kd, 16));
/*
* And finally, compare the digest in the packet with KD.
*/
- if (memcmp(&kd[0], &hash[0], 16) == 0) return RLM_MODULE_OK;
+ if (memcmp(&kd[0], &hash[0], 16) == 0) RETURN_MODULE_OK;
REDEBUG("FAILED authentication");
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
}
static int mod_bootstrap(void *instance, CONF_SECTION *conf)
{ NULL }
};
-static rlm_rcode_t mod_authenticate(module_ctx_t const *mctx, request_t *request) CC_HINT(nonnull);
-static rlm_rcode_t mod_authorize(module_ctx_t const *mctx, request_t *request) CC_HINT(nonnull);
+static unlang_action_t mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) CC_HINT(nonnull);
+static unlang_action_t mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) CC_HINT(nonnull);
/** Wrapper around dl_instance which loads submodules based on type = foo pairs
*
* - RLM_MODULE_HANDLED if we're done with this round.
* - RLM_MODULE_REJECT if the user should be rejected.
*/
-static rlm_rcode_t mod_authenticate_result(request_t *request, UNUSED module_ctx_t const *mctx,
- eap_session_t *eap_session, rlm_rcode_t result)
+static unlang_action_t mod_authenticate_result(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx,
+ request_t *request, eap_session_t *eap_session, rlm_rcode_t result)
{
rlm_rcode_t rcode;
eap_session_freeze(&eap_session);
finish:
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
/** Call mod_authenticate_result asynchronously from the unlang interpreter
*
- * @param[in] request The current request.
+ * @param[out] p_result The result of the operation.
* @param[in] mctx module calling ctx.
+ * @param[in] request the current request.
* @param[in] rctx the eap_session_t.
* @return The result of this round of authentication.
*/
-static rlm_rcode_t mod_authenticate_result_async(module_ctx_t const *mctx, request_t *request, void *rctx)
+static unlang_action_t mod_authenticate_result_async(rlm_rcode_t *p_result, module_ctx_t const *mctx,
+ request_t *request, void *rctx)
{
eap_session_t *eap_session = talloc_get_type_abort(rctx, eap_session_t);
- return mod_authenticate_result(request, mctx, eap_session, eap_session->submodule_rcode);
+ return mod_authenticate_result(p_result, mctx, request, eap_session, eap_session->submodule_rcode);
}
/** Select the correct callback based on a response
*
* Default to the configured EAP-Type for all Unsupported EAP-Types.
*
+ * @param[out] p_result the result of the operation.
* @param[in] mctx module calling ctx.
* @param[in] eap_session State data that persists over multiple rounds of EAP.
* @return
* - RLM_MODULE_YIELD Yield control back to the interpreter so it can
* call the submodule.
*/
-static rlm_rcode_t eap_method_select(module_ctx_t const *mctx, eap_session_t *eap_session)
+static unlang_action_t eap_method_select(rlm_rcode_t *p_result, module_ctx_t const *mctx, eap_session_t *eap_session)
{
rlm_eap_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_eap_t);
eap_type_data_t *type = &eap_session->this_round->response->type;
REDEBUG("Peer sent EAP type number %d, which is outside known range", type->num);
is_invalid:
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
*/
TALLOC_FREE(eap_session->opaque);
next = eap_process_nak(mctx, eap_session->request, eap_session->type, type);
- if (!next) return RLM_MODULE_REJECT;
+ if (!next) RETURN_MODULE_REJECT;
/*
* Initialise the state machine for the next submodule
RERROR("Failed copying parent's attribute list");
fail:
TALLOC_FREE(eap_session->subrequest);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
if (fr_pair_list_copy(eap_session->subrequest->packet,
eap_session);
}
-static rlm_rcode_t mod_authenticate(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_eap_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_eap_t);
eap_session_t *eap_session;
eap_packet_raw_t *eap_packet;
- rlm_rcode_t rcode;
+ unlang_action_t ua;
if (!fr_pair_find_by_da(&request->request_pairs, attr_eap_message)) {
REDEBUG("You set 'Auth-Type = EAP' for a request that does not contain an EAP-Message attribute!");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
eap_packet = eap_packet_from_vp(request, request->request_pairs);
if (!eap_packet) {
RPERROR("Malformed EAP Message");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/*
* data.
*/
eap_session = eap_session_continue(inst, &eap_packet, request);
- if (!eap_session) return RLM_MODULE_INVALID; /* Don't emit error here, it will mask the real issue */
+ if (!eap_session) RETURN_MODULE_INVALID; /* Don't emit error here, it will mask the real issue */
/*
* Call an EAP submodule to process the request,
* or with simple types like Identity and NAK,
* process it ourselves.
*/
- rcode = eap_method_select(mctx, eap_session);
- switch (rcode) {
+ ua = eap_method_select(p_result, mctx, eap_session);
+ switch (*p_result) {
/*
* Leave the session thawed, next state
* func will need to re-freeze.
*/
case RLM_MODULE_YIELD:
- return rcode;
+ return ua;
case RLM_MODULE_OK:
case RLM_MODULE_UPDATED:
break;
}
- return rcode;
+ return ua;
}
/*
* to check for user existence & get their configured values.
* It Handles EAP-START Messages, User-Name initialization.
*/
-static rlm_rcode_t mod_authorize(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_eap_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_eap_t);
int status;
* proxy reply (or the proxied packet)
*/
if (request->proxy != NULL)
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
#endif
if (!inst->auth_type) {
WARN("No 'authenticate %s {...}' section or 'Auth-Type = %s' set. Cannot setup EAP authentication",
inst->name, inst->name);
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
/*
break;
}
- if (!module_section_type_set(request, attr_auth_type, inst->auth_type)) return RLM_MODULE_NOOP;
+ if (!module_section_type_set(request, attr_auth_type, inst->auth_type)) RETURN_MODULE_NOOP;
- if (status == RLM_MODULE_OK) return RLM_MODULE_OK;
+ if (status == RLM_MODULE_OK) RETURN_MODULE_OK;
- return RLM_MODULE_UPDATED;
+ RETURN_MODULE_UPDATED;
}
#if 0
* If we're proxying EAP, then there may be magic we need
* to do.
*/
-static rlm_rcode_t mod_post_proxy(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_post_proxy(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_eap_t const *inst = talloc_get_type_abort_const(instance->mctx, rlm_eap_t);
size_t i;
if (!data) {
RERROR("Failed to retrieve callback for tunneled session!");
eap_session_destroy(&eap_session);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/*
eap_session_freeze(&eap_session);
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
} else {
RDEBUG2("No pre-existing eap_session found");
}
/*
* This is allowed.
*/
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
#endif
-static rlm_rcode_t mod_post_auth(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_post_auth(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_eap_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_eap_t);
fr_pair_t *vp;
* Only synthesize a failure message if something
* previously rejected the request.
*/
- if (request->reply->code != FR_CODE_ACCESS_REJECT) return RLM_MODULE_NOOP;
+ if (request->reply->code != FR_CODE_ACCESS_REJECT) RETURN_MODULE_NOOP;
if (!fr_pair_find_by_da(&request->request_pairs, attr_eap_message)) {
RDEBUG3("Request didn't contain an EAP-Message, not inserting EAP-Failure");
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
if (fr_pair_find_by_da(&request->reply_pairs, attr_eap_message)) {
RDEBUG3("Reply already contained an EAP-Message, not inserting EAP-Failure");
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
/*
eap_session = eap_session_thaw(request);
if (!eap_session) {
RDEBUG3("Failed to get eap_session, probably already removed, not inserting EAP-Failure");
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
/*
* Already set to failure, assume something else
* added EAP-Message with a failure code, do nothing.
*/
- if (eap_session->this_round->request->code == FR_EAP_CODE_FAILURE) return RLM_MODULE_NOOP;
+ if (eap_session->this_round->request->code == FR_EAP_CODE_FAILURE) RETURN_MODULE_NOOP;
/*
* Was *NOT* an EAP-Failure, so we now need to turn it into one.
MEM(pair_update_reply(&vp, attr_message_authenticator) >= 0);
MEM(fr_pair_value_mem_alloc(vp, NULL, RADIUS_AUTH_VECTOR_LENGTH, false) == 0);
- return RLM_MODULE_UPDATED;
+ RETURN_MODULE_UPDATED;
}
static int mod_instantiate(void *instance, UNUSED CONF_SECTION *cs)
/*
* Do authentication, by letting EAP-TLS do most of the work.
*/
-static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_eap_fast_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_eap_fast_t);
eap_tls_status_t status;
* do nothing.
*/
case EAP_TLS_HANDLED:
- return RLM_MODULE_HANDLED;
+ RETURN_MODULE_HANDLED;
/*
* Handshake is done, proceed with decoding tunneled
* Anything else: fail.
*/
default:
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/*
switch (eap_fast_process(request, eap_session, tls_session)) {
case FR_CODE_ACCESS_REJECT:
eap_tls_fail(request, eap_session);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
/*
* Access-Challenge, continue tunneled conversation.
case FR_CODE_ACCESS_CHALLENGE:
fr_tls_session_send(request, tls_session);
eap_tls_request(request, eap_session);
- return RLM_MODULE_HANDLED;
+ RETURN_MODULE_HANDLED;
/*
* Success: Automatically return MPPE keys.
*/
case FR_CODE_ACCESS_ACCEPT:
- if (eap_tls_success(request, eap_session, NULL, 0, NULL, 0) < 0) return RLM_MODULE_FAIL;
- return RLM_MODULE_OK;
+ if (eap_tls_success(request, eap_session, NULL, 0, NULL, 0) < 0) RETURN_MODULE_FAIL;
+ RETURN_MODULE_OK;
/*
* No response packet, MUST be proxying it.
* will proxy it, rather than returning an EAP packet.
*/
case FR_CODE_STATUS_CLIENT:
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
default:
break;
* Something we don't understand: Reject it.
*/
eap_tls_fail(request, eap_session);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/*
* Send an initial eap-tls request to the peer, using the libeap functions.
*/
-static rlm_rcode_t mod_session_init(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_session_init(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_eap_fast_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_eap_fast_t);
eap_session_t *eap_session = eap_session_get(request->parent);
}
eap_session->opaque = eap_tls_session = eap_tls_session_init(request, eap_session, inst->tls_conf, client_cert);
- if (!eap_tls_session) return RLM_MODULE_FAIL;
+ if (!eap_tls_session) RETURN_MODULE_FAIL;
tls_session = eap_tls_session->tls_session;
&tls_session->clean_in, tls_session->clean_in.used,
tls_session->clean_in.used) < 0) {
talloc_free(tls_session);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
tls_session->record_init(&tls_session->clean_in);
if (!SSL_set_session_ticket_ext_cb(tls_session->ssl, _session_ticket, tls_session)) {
RERROR("Failed setting SSL session ticket callback");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
- return RLM_MODULE_HANDLED;
+ RETURN_MODULE_HANDLED;
}
{ NULL }
};
-static rlm_rcode_t mod_session_init(module_ctx_t const *mctx, request_t *request);
+static unlang_action_t mod_session_init(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request);
/** Translate a string auth_type into an enumeration value
*
/*
* Keep processing the Auth-Type until it doesn't return YIELD.
*/
-static rlm_rcode_t mod_process_auth_type(UNUSED module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_process_auth_type(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request)
{
rlm_rcode_t rcode;
rcode = unlang_interpret(request);
- if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_REJECT;
+ if (request->master_state == REQUEST_STOP_PROCESSING) return UNLANG_ACTION_STOP_PROCESSING;
- if (rcode == RLM_MODULE_YIELD) return rcode;
+ if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD;
if (rcode != RLM_MODULE_OK) {
eap_round->request->code = FR_EAP_CODE_FAILURE;
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
eap_round->request->code = FR_EAP_CODE_SUCCESS;
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
/*
* Authenticate a previously sent challenge.
*/
-static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_eap_gtc_t const *inst = talloc_get_type_abort(mctx->instance, rlm_eap_gtc_t);
rlm_rcode_t rcode;
if (eap_round->response->length <= 4) {
REDEBUG("Corrupted data");
eap_round->request->code = FR_EAP_CODE_FAILURE;
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
if (eap_round->response->type.length > 128) {
REDEBUG("Response is too large to understand");
eap_round->request->code = FR_EAP_CODE_FAILURE;
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
/*
* Call the authenticate section of the *current* virtual server.
*/
- rcode = process_authenticate(inst->auth_type->value->vb_uint32, request);
+ process_authenticate(&rcode, inst->auth_type->value->vb_uint32, request);
if (rcode != RLM_MODULE_OK) {
eap_round->request->code = FR_EAP_CODE_FAILURE;
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
eap_round->request->code = FR_EAP_CODE_SUCCESS;
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
if (unlang_interpret_push_section(request, unlang, RLM_MODULE_FAIL, UNLANG_TOP_FRAME) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
eap_session->process = mod_process_auth_type;
- return eap_session->process(mctx, request);
+ return eap_session->process(p_result, mctx, request);
}
/*
* Initiate the EAP-GTC session by sending a challenge to the peer.
*/
-static rlm_rcode_t mod_session_init(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_session_init(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
eap_session_t *eap_session = eap_session_get(request->parent);
char challenge_str[1024];
rlm_eap_gtc_t *inst = talloc_get_type_abort(mctx->instance, rlm_eap_gtc_t);
if (xlat_eval(challenge_str, sizeof(challenge_str), request, inst->challenge, NULL, NULL) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
length = strlen(challenge_str);
eap_round->request->code = FR_EAP_CODE_REQUEST;
eap_round->request->type.data = talloc_array(eap_round->request, uint8_t, length);
- if (!eap_round->request->type.data) return RLM_MODULE_FAIL;
+ if (!eap_round->request->type.data) RETURN_MODULE_FAIL;
memcpy(eap_round->request->type.data, challenge_str, length);
eap_round->request->type.length = length;
*/
eap_session->process = mod_process;
- return RLM_MODULE_HANDLED;
+ RETURN_MODULE_HANDLED;
}
/*
/*
* Authenticate a previously sent challenge.
*/
-static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_process(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request)
{
eap_session_t *eap_session = eap_session_get(request->parent);
MD5_PACKET *packet;
false);
if (!known_good) {
REDEBUG("No \"known good\" password found for user");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/*
packet = eap_md5_extract(eap_session->this_round);
if (!packet) {
if (ephemeral) talloc_list_free(&known_good);
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
if (ephemeral) talloc_list_free(&known_good);
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
/*
* Initiate the EAP-MD5 session by sending a challenge to the peer.
*/
-static rlm_rcode_t mod_session_init(UNUSED module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_session_init(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request)
{
eap_session_t *eap_session = eap_session_get(request->parent);
MD5_PACKET *reply;
*/
eap_session->process = mod_process;
- return RLM_MODULE_HANDLED;
+ RETURN_MODULE_HANDLED;
}
/*
}
-static rlm_rcode_t CC_HINT(nonnull) mod_process(module_ctx_t const *mctx, request_t *request);
+static unlang_action_t CC_HINT(nonnull) mod_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request);
#ifdef WITH_PROXY
/*
default:
case FR_CODE_ACCESS_REJECT:
REDEBUG("Proxied authentication was rejected");
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
}
/*
*/
if (!response) {
REDEBUG("Proxied reply contained no MS-CHAP2-Success or MS-CHAP-Error");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
request->reply->code = FR_CODE_ACCESS_CHALLENGE;
fr_pair_list_free(&response);
- return RLM_MODULE_HANDLED;
+ RETURN_MODULE_HANDLED;
}
#endif
-static rlm_rcode_t mschap_finalize(request_t *request, rlm_eap_mschapv2_t const *inst,
- eap_session_t *eap_session, rlm_rcode_t rcode)
+static unlang_action_t mschap_finalize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request,
+ eap_session_t *eap_session, rlm_rcode_t rcode)
{
- mschapv2_opaque_t *data = talloc_get_type_abort(eap_session->opaque, mschapv2_opaque_t);
- eap_round_t *eap_round = eap_session->this_round;
- fr_pair_t *response = NULL;
+ mschapv2_opaque_t *data = talloc_get_type_abort(eap_session->opaque, mschapv2_opaque_t);
+ eap_round_t *eap_round = eap_session->this_round;
+ fr_pair_t *response = NULL;
+ rlm_eap_mschapv2_t const *inst = mctx->instance;
/*
* Delete MPPE keys & encryption policy. We don't
if (rcode == RLM_MODULE_OK) {
if (fr_pair_list_copy_by_da(data, &response, &request->reply_pairs, attr_ms_chap2_success) < 0) {
RPERROR("Failed copying %s", attr_ms_chap2_success->name);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
data->code = FR_EAP_MSCHAPV2_SUCCESS;
} else if (inst->send_error) {
if (fr_pair_list_copy_by_da(data, &response, &request->reply_pairs, attr_ms_chap_error) < 0) {
RPERROR("Failed copying %s", attr_ms_chap_error->name);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
if (response) {
int n, err, retry;
data->code = FR_EAP_MSCHAPV2_FAILURE;
} else {
eap_round->request->code = FR_EAP_CODE_FAILURE;
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
}
/*
*/
if (!response) {
REDEBUG("No %s or %s attributes were found", attr_ms_chap2_success->name, attr_ms_chap_error->name);
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
eap_mschapv2_compose(eap_session->inst, request, eap_session, response);
fr_pair_list_free(&response);
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
/*
* Keep processing the Auth-Type until it doesn't return YIELD.
*/
-static rlm_rcode_t mod_process_auth_type(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_process_auth_type(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
- rlm_eap_mschapv2_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_eap_mschapv2_t);
rlm_rcode_t rcode;
eap_session_t *eap_session = eap_session_get(request->parent);
rcode = unlang_interpret(request);
- if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_REJECT;
+ if (request->master_state == REQUEST_STOP_PROCESSING) return UNLANG_ACTION_STOP_PROCESSING;
- if (rcode == RLM_MODULE_YIELD) return rcode;
+ if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD;
- return mschap_finalize(request, inst, eap_session, rcode);
+ return mschap_finalize(p_result, mctx, request, eap_session, rcode);
}
/*
* Authenticate a previously sent challenge.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_process(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_eap_mschapv2_t const *inst = talloc_get_type_abort(mctx->instance, rlm_eap_mschapv2_t);
- request_t *parent = request->parent;
+ request_t *parent = request->parent;
eap_session_t *eap_session = eap_session_get(parent);
mschapv2_opaque_t *data = talloc_get_type_abort(eap_session->opaque, mschapv2_opaque_t);
eap_round_t *eap_round = eap_session->this_round;
if (eap_round->response->length < 6) {
REDEBUG("Response too short, expected at least 6 bytes, got %zu bytes",
eap_round->response->length);
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
ccode = eap_round->response->type.data[0];
*/
if (ccode != FR_EAP_MSCHAPV2_FAILURE) {
REDEBUG("Sent FAILURE expecting FAILURE but got %d", ccode);
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
failure:
request->options &= ~RAD_REQUEST_OPTION_PROXY_EAP;
eap_round->request->code = FR_EAP_CODE_FAILURE;
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
case FR_EAP_MSCHAPV2_SUCCESS:
/*
request->options &= ~RAD_REQUEST_OPTION_PROXY_EAP;
#endif
MEM(fr_pair_list_copy(parent->reply, &parent->reply->vps, &data->reply) >= 0);
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
REDEBUG("Sent SUCCESS expecting SUCCESS (or ACK) but got %d", ccode);
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
case FR_EAP_MSCHAPV2_CHALLENGE:
if (ccode == FR_EAP_MSCHAPV2_FAILURE) goto failure;
*/
if (ccode != FR_EAP_MSCHAPV2_RESPONSE) {
REDEBUG("Sent CHALLENGE expecting RESPONSE but got %d", ccode);
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/* authentication happens below */
break;
default:
/* should never happen */
REDEBUG("Unknown state %d", data->code);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
*/
if (eap_round->response->length < (4 + 1 + 1 + 1 + 2 + 1)) {
REDEBUG("Response is too short");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
if ((eap_round->response->type.data[4] != 49) &&
(eap_round->response->type.data[4] != 16)) {
REDEBUG("Response is of incorrect length %d", eap_round->response->type.data[4]);
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
length = (eap_round->response->type.data[2] << 8) | eap_round->response->type.data[3];
if ((length < (5 + 49)) || (length > (256 + 5 + 49))) {
REDEBUG("Response contains contradictory length %zu %d", length, 5 + 49);
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
* to do the work below, AFTER the call to MS-CHAP
* authentication...
*/
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
#endif
*/
unlang = cf_section_find(request->server_cs, "authenticate", inst->auth_type->name);
if (!unlang) {
- rcode = process_authenticate(inst->auth_type->value->vb_uint32, request);
+ process_authenticate(&rcode, inst->auth_type->value->vb_uint32, request);
} else {
if (unlang_interpret_push_section(request, unlang, RLM_MODULE_FAIL, UNLANG_TOP_FRAME) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
rcode = unlang_interpret(request);
*/
if (rcode == RLM_MODULE_YIELD) {
eap_session->process = mod_process_auth_type;
- return rcode;
+ return UNLANG_ACTION_YIELD;
}
}
- return mschap_finalize(request, inst, eap_session, rcode);
+ return mschap_finalize(p_result, mctx, request, eap_session, rcode);
}
/*
* Initiate the EAP-MSCHAPV2 session by sending a challenge to the peer.
*/
-static rlm_rcode_t mod_session_init(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_session_init(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
request_t *parent = request->parent;
eap_session_t *eap_session = eap_session_get(parent);
int i;
bool created_auth_challenge;
- if (!fr_cond_assert(mctx->instance)) return RLM_MODULE_FAIL;
+ if (!fr_cond_assert(mctx->instance)) RETURN_MODULE_FAIL;
/*
* We're looking for attributes that should come
* from the EAP-TTLS submodule.
*/
- if (!fr_cond_assert(parent)) return RLM_MODULE_FAIL;
+ if (!fr_cond_assert(parent)) RETURN_MODULE_FAIL;
auth_challenge = fr_pair_find_by_da(&parent->control, attr_ms_chap_challenge);
if (auth_challenge && (auth_challenge->vp_length != MSCHAPV2_CHALLENGE_LEN)) {
*/
eap_session->process = mod_process;
- return RLM_MODULE_HANDLED;
+ RETURN_MODULE_HANDLED;
}
/*
/*
* Process the PEAP portion of an EAP-PEAP request.
*/
-rlm_rcode_t eap_peap_process(request_t *request, eap_session_t *eap_session, fr_tls_session_t *tls_session) CC_HINT(nonnull);
+unlang_action_t eap_peap_process(rlm_rcode_t *p_result, request_t *request,
+ eap_session_t *eap_session, fr_tls_session_t *tls_session) CC_HINT(nonnull);
/*
* Process the pseudo-EAP contents of the tunneled data.
*/
-rlm_rcode_t eap_peap_process(request_t *request, eap_session_t *eap_session, fr_tls_session_t *tls_session)
+unlang_action_t eap_peap_process(rlm_rcode_t *p_result, request_t *request,
+ eap_session_t *eap_session, fr_tls_session_t *tls_session)
{
peap_tunnel_t *t = tls_session->opaque;
- request_t *fake = NULL;
+ request_t *fake = NULL;
fr_pair_t *vp;
rlm_rcode_t rcode = RLM_MODULE_REJECT;
uint8_t const *data;
size_t data_len;
-
- eap_round_t *eap_round = eap_session->this_round;
+ eap_round_t *eap_round = eap_session->this_round;
/*
* Just look at the buffer directly, without doing
if ((t->status != PEAP_STATUS_TUNNEL_ESTABLISHED) && (eap_peap_verify(request, t, data, data_len) < 0)) {
REDEBUG("Tunneled data is invalid");
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
}
switch (t->status) {
RDEBUG2("Sending SoH request to server %s",
fake->server_cs ? cf_section_name2(fake->server_cs) : "NULL");
- rad_virtual_server(fake);
+ rad_virtual_server(&rcode, fake);
if (fake->reply->code != FR_CODE_ACCESS_ACCEPT) {
RDEBUG2("SoH was rejected");
RIDEBUG("what went wrong, and how to fix the problem");
REXDENT();
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
case PEAP_STATUS_PHASE2_INIT:
RDEBUG2("In state machine in phase2 init?");
finish:
talloc_free(fake);
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
static int CC_HINT(nonnull) setup_fake_request(request_t *request, request_t *fake, peap_tunnel_t *t) {
/*
* Do authentication, by letting EAP-TLS do most of the work.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_process(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_eap_peap_t *inst = talloc_get_type(mctx->instance, rlm_eap_peap_t);
* and EAP id from the inner tunnel, and update it with
* the expected EAP id!
*/
- return RLM_MODULE_HANDLED;
+ RETURN_MODULE_HANDLED;
/*
* Handshake is done, proceed with decoding tunneled
* Anything else: fail.
*/
default:
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/*
/*
* Process the PEAP portion of the request.
*/
- rcode = eap_peap_process(request, eap_session, tls_session);
+ eap_peap_process(&rcode, request, eap_session, tls_session);
switch (rcode) {
case RLM_MODULE_REJECT:
eap_tls_fail(request, eap_session);
break;
}
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
/*
* Send an initial eap-tls request to the peer, using the libeap functions.
*/
-static rlm_rcode_t mod_session_init(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_session_init(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_eap_peap_t *inst = talloc_get_type_abort(mctx->instance, rlm_eap_peap_t);
eap_session_t *eap_session = eap_session_get(request->parent);
}
eap_session->opaque = eap_tls_session = eap_tls_session_init(request, eap_session, inst->tls_conf, client_cert);
- if (!eap_tls_session) return RLM_MODULE_FAIL;
+ if (!eap_tls_session) RETURN_MODULE_FAIL;
/*
* As it is a poorly designed protocol, PEAP uses
*/
if (eap_tls_start(request, eap_session) < 0) {
talloc_free(eap_tls_session);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
eap_session->process = mod_process;
- return RLM_MODULE_HANDLED;
+ RETURN_MODULE_HANDLED;
}
/*
return 0;
}
-static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_eap_pwd_t *inst = talloc_get_type_abort(mctx->instance, rlm_eap_pwd_t);
eap_session_t *eap_session = eap_session_get(request->parent);
*/
if (!hdr || (response->type.length < sizeof(pwd_hdr))) {
REDEBUG("Packet with insufficient data");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
in = hdr->data;
*/
if (session->out_pos) {
if (in_len) REDEBUG("PWD got something more than an ACK for a fragment");
- if (send_pwd_request(request, session, eap_round) < 0) return RLM_MODULE_FAIL;
+ if (send_pwd_request(request, session, eap_round) < 0) RETURN_MODULE_FAIL;
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
/*
if (EAP_PWD_GET_LENGTH_BIT(hdr)) {
if (session->in) {
REDEBUG("PWD already alloced buffer for fragments");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
if (in_len < 2) {
REDEBUG("Invalid packet: length bit set, but no length field");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
session->in_len = ntohs(in[0] * 256 | in[1]);
if (!session->in_len) {
DEBUG("EAP-PWD malformed packet (input length)");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
MEM(session->in = talloc_zero_array(session, uint8_t, session->in_len));
if ((session->in_pos + in_len) > session->in_len) {
REDEBUG("Fragment overflows packet");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
memcpy(session->in + session->in_pos, in, in_len);
hdr = (pwd_hdr *)eap_round->request->type.data;
EAP_PWD_SET_EXCHANGE(hdr, exch);
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
*/
if ((session->in_pos + in_len) > session->in_len) {
REDEBUG("PWD will overflow a fragment buffer");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
memcpy(session->in + session->in_pos, in, in_len);
in = session->in;
if (EAP_PWD_GET_EXCHANGE(hdr) != EAP_PWD_EXCH_ID) {
REDEBUG("PWD exchange is incorrect, Not ID");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
packet = (pwd_id_packet_t *) in;
if (in_len < sizeof(*packet)) {
REDEBUG("Packet is too small (%zd < %zd).", in_len, sizeof(*packet));
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
if ((packet->prf != EAP_PWD_DEF_PRF) ||
(CRYPTO_memcmp(packet->token, &session->token, 4)) ||
(packet->group_num != ntohs(session->group_num))) {
REDEBUG("PWD ID response is malformed");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
session->peer_id_len = in_len - sizeof(pwd_id_packet_t);
if (session->peer_id_len >= sizeof(session->peer_id)) {
REDEBUG("PWD ID response is malformed");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
memcpy(session->peer_id, packet->identity, session->peer_id_len);
allowed_passwords, NUM_ELEMENTS(allowed_passwords), false);
if (!known_good) {
REDEBUG("No \"known good\" password found for user");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
ret = compute_password_element(request, session, session->group_num,
if (ephemeral) talloc_list_free(&known_good);
if (ret < 0) {
REDEBUG("Failed to obtain password element");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/*
*/
if (compute_scalar_element(request, session, inst->bnctx)) {
REDEBUG("Failed to compute server's scalar and element");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
MEM(x = BN_new());
REDEBUG("Server point assignment failed");
BN_clear_free(x);
BN_clear_free(y);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/*
case PWD_STATE_COMMIT:
if (EAP_PWD_GET_EXCHANGE(hdr) != EAP_PWD_EXCH_COMMIT) {
REDEBUG("PWD exchange is incorrect, not commit!");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
*/
if (process_peer_commit(request, session, in, in_len, inst->bnctx)) {
REDEBUG("Failed processing peer's commit");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/*
*/
if (compute_server_confirm(request, session, session->my_confirm, inst->bnctx)) {
REDEBUG("Failed computing confirm");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/*
case PWD_STATE_CONFIRM:
if (in_len < SHA256_DIGEST_LENGTH) {
REDEBUG("Peer confirm is too short (%zd < %d)", in_len, SHA256_DIGEST_LENGTH);
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
if (EAP_PWD_GET_EXCHANGE(hdr) != EAP_PWD_EXCH_CONFIRM) {
REDEBUG("PWD exchange is incorrect, not commit");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
if (compute_peer_confirm(request, session, peer_confirm, inst->bnctx)) {
REDEBUG("Cannot compute peer's confirm");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
if (CRYPTO_memcmp(peer_confirm, in, SHA256_DIGEST_LENGTH)) {
REDEBUG("PWD exchange failed, peer confirm is incorrect");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
if (compute_keys(request, session, peer_confirm, msk, emsk)) {
REDEBUG("Failed generating (E)MSK");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
eap_round->request->code = FR_EAP_CODE_SUCCESS;
default:
REDEBUG("Unknown PWD state");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/*
session->in = NULL;
}
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
static int _free_pwd_session(pwd_session_t *session)
return 0;
}
-static rlm_rcode_t mod_session_init(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_session_init(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_eap_pwd_t *inst = talloc_get_type_abort(mctx->instance, rlm_eap_pwd_t);
eap_session_t *eap_session = eap_session_get(request->parent);
packet->prep = EAP_PWD_PREP_NONE;
memcpy(packet->identity, inst->server_id, session->out_len - sizeof(pwd_id_packet_t) );
- if (send_pwd_request(request, session, eap_session->this_round) < 0) return RLM_MODULE_FAIL;
+ if (send_pwd_request(request, session, eap_session->this_round) < 0) RETURN_MODULE_FAIL;
eap_session->process = mod_process;
- return RLM_MODULE_HANDLED;
+ RETURN_MODULE_HANDLED;
}
static int mod_detach(void *arg)
/*
* Do authentication, by letting EAP-TLS do most of the work.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_process(module_ctx_t const *mctx, request_t *request);
+static unlang_action_t CC_HINT(nonnull) mod_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request);
-static rlm_rcode_t eap_tls_success_with_prf(request_t *request, eap_session_t *eap_session)
+static unlang_action_t eap_tls_success_with_prf(rlm_rcode_t *p_result, request_t *request, eap_session_t *eap_session)
{
#if OPENSSL_VERSION_NUMBER >= 0x10101000L
eap_tls_session_t *eap_tls_session = talloc_get_type_abort(eap_session->opaque, eap_tls_session_t);
- fr_tls_session_t *tls_session = eap_tls_session->tls_session;
+ fr_tls_session_t *tls_session = eap_tls_session->tls_session;
/*
* Set the PRF label based on the TLS version negotiated
case SSL2_VERSION: /* Should never happen */
case SSL3_VERSION: /* Should never happen */
fr_assert(0);
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
case TLS1_VERSION:
case TLS1_1_VERSION:
if (eap_tls_success(request, eap_session,
keying_prf_label, sizeof(keying_prf_label) - 1,
- NULL, 0) < 0) return RLM_MODULE_FAIL;
+ NULL, 0) < 0) RETURN_MODULE_FAIL;
}
#if OPENSSL_VERSION_NUMBER >= 0x10101000L
break;
if (eap_tls_success(request, eap_session,
keying_prf_label, sizeof(keying_prf_label) - 1,
- sessid_prf_label, sizeof(sessid_prf_label) - 1) < 0) return RLM_MODULE_FAIL;
+ sessid_prf_label, sizeof(sessid_prf_label) - 1) < 0) RETURN_MODULE_FAIL;
}
break;
}
#endif
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
static unlang_action_t eap_tls_virtual_server_result(rlm_rcode_t *p_result, UNUSED int *priority,
switch (*p_result) {
case RLM_MODULE_OK:
case RLM_MODULE_UPDATED:
- *p_result = eap_tls_success_with_prf(request, eap_session);
- break;
+ return eap_tls_success_with_prf(p_result, request, eap_session);
default:
REDEBUG2("Certificate rejected by the virtual server");
eap_tls_fail(request, eap_session);
- *p_result = RLM_MODULE_REJECT;
- break;
+ RETURN_MODULE_REJECT;
}
-
- return UNLANG_ACTION_CALCULATE_RESULT;
}
-static rlm_rcode_t eap_tls_virtual_server(rlm_eap_tls_t *inst, request_t *request, eap_session_t *eap_session)
+static unlang_action_t eap_tls_virtual_server(rlm_rcode_t *p_result, rlm_eap_tls_t *inst, request_t *request,
+ eap_session_t *eap_session)
{
CONF_SECTION *server_cs;
CONF_SECTION *section;
REDEBUG2("Virtual server \"%pV\" not found", &vp->data);
error:
eap_tls_fail(request, eap_session);
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
} else {
server_cs = virtual_server_find(inst->virtual_server);
* Catch the interpreter on the way back up the stack
*/
if (unlang_interpret_push_function(request, NULL, eap_tls_virtual_server_result, eap_session) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/*
* Push unlang instructions for the virtual server section
*/
if (unlang_interpret_push_section(request, section, RLM_MODULE_NOOP, UNLANG_SUB_FRAME) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
- return RLM_MODULE_YIELD;
+ *p_result = RLM_MODULE_YIELD;
+
+ return UNLANG_ACTION_YIELD;
}
-static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_eap_tls_t *inst = talloc_get_type_abort(mctx->instance, rlm_eap_tls_t);
eap_tls_status_t status;
* it accepts the certificates, too.
*/
case EAP_TLS_ESTABLISHED:
- if (inst->virtual_server) return eap_tls_virtual_server(inst, request, eap_session);
- return eap_tls_success_with_prf(request, eap_session);
+ if (inst->virtual_server) return eap_tls_virtual_server(p_result, inst, request, eap_session);
+ return eap_tls_success_with_prf(p_result, request, eap_session);
/*
* do nothing.
*/
case EAP_TLS_HANDLED:
- return RLM_MODULE_HANDLED;
+ RETURN_MODULE_HANDLED;
/*
* Handshake is done, proceed with decoding tunneled
REDEBUG("Received unexpected tunneled data after successful handshake");
eap_tls_fail(request, eap_session);
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
/*
* Anything else: fail.
default:
fr_tls_cache_deny(tls_session);
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
}
}
/*
* Send an initial eap-tls request to the peer, using the libeap functions.
*/
-static rlm_rcode_t mod_session_init(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_session_init(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_eap_tls_t *inst = talloc_get_type_abort(mctx->instance, rlm_eap_tls_t);
eap_session_t *eap_session = eap_session_get(request->parent);
* EAP-TLS always requires a client certificate.
*/
eap_session->opaque = eap_tls_session = eap_tls_session_init(request, eap_session, inst->tls_conf, client_cert);
- if (!eap_tls_session) return RLM_MODULE_FAIL;
+ if (!eap_tls_session) RETURN_MODULE_FAIL;
eap_tls_session->include_length = inst->include_length;
*/
if (eap_tls_start(request, eap_session) < 0) {
talloc_free(eap_tls_session);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
eap_session->process = mod_process;
- return RLM_MODULE_HANDLED;
+ RETURN_MODULE_HANDLED;
}
/*
/*
* Do authentication, by letting EAP-TLS do most of the work.
*/
-static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_eap_ttls_t *inst = talloc_get_type_abort(mctx->instance, rlm_eap_ttls_t);
*/
if (eap_tls_success(request, eap_session,
keying_prf_label, sizeof(keying_prf_label) - 1,
- NULL, 0) < 0) return RLM_MODULE_FAIL;
- return RLM_MODULE_OK;
+ NULL, 0) < 0) RETURN_MODULE_FAIL;
+ RETURN_MODULE_OK;
} else {
eap_tls_request(request, eap_session);
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
/*
* The TLS code is still working on the TLS
* do nothing.
*/
case EAP_TLS_HANDLED:
- return RLM_MODULE_HANDLED;
+ RETURN_MODULE_HANDLED;
/*
* Handshake is done, proceed with decoding tunneled
* Anything else: fail.
*/
default:
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/*
switch (eap_ttls_process(request, eap_session, tls_session)) {
case FR_CODE_ACCESS_REJECT:
eap_tls_fail(request, eap_session);
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
/*
* Access-Challenge, continue tunneled conversation.
*/
case FR_CODE_ACCESS_CHALLENGE:
eap_tls_request(request, eap_session);
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
/*
* Success: Automatically return MPPE keys.
* will proxy it, rather than returning an EAP packet.
*/
case FR_CODE_STATUS_CLIENT:
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
default:
break;
* Something we don't understand: Reject it.
*/
eap_tls_fail(request, eap_session);
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
* Send an initial eap-tls request to the peer, using the libeap functions.
*/
-static rlm_rcode_t mod_session_init(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_session_init(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_eap_ttls_t *inst = talloc_get_type_abort(mctx->instance, rlm_eap_ttls_t);
eap_session_t *eap_session = eap_session_get(request->parent);
}
eap_session->opaque = eap_tls_session = eap_tls_session_init(request, eap_session, inst->tls_conf, client_cert);
- if (!eap_tls_session) return RLM_MODULE_FAIL;
+ if (!eap_tls_session) RETURN_MODULE_FAIL;
/*
* TLS session initialization is over. Now handle TLS
*/
if (eap_tls_start(request, eap_session) < 0) {
talloc_free(eap_tls_session);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
eap_session->process = mod_process;
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
/*
/** Resume a request after xlat expansion.
*
*/
-static rlm_rcode_t mod_exec_nowait_resume(module_ctx_t const *mctx, request_t *request, void *rctx)
+static unlang_action_t mod_exec_nowait_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx,
+ request_t *request, void *rctx)
{
rlm_exec_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_exec_t);
fr_value_box_t *box = talloc_get_type_abort(rctx, fr_value_box_t);
input_pairs = radius_list(request, inst->input_list);
if (!input_pairs) {
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
env_pairs = *input_pairs;
if (fr_exec_nowait(request, box, env_pairs) < 0) {
RPEDEBUG("Failed executing program");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
typedef struct {
{
rlm_rcode_t rcode;
- if (status < 0) {
- return RLM_MODULE_FAIL;
- }
+ if (status < 0) return RLM_MODULE_FAIL;
/*
* Exec'd programs are meant to return exit statuses that correspond
return rcode;
}
-static rlm_rcode_t mod_exec_wait_resume(module_ctx_t const *mctx, request_t *request, void *rctx)
+static unlang_action_t mod_exec_wait_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx,
+ request_t *request, void *rctx)
{
int status;
rlm_exec_ctx_t *m = talloc_get_type_abort(rctx, rlm_exec_ctx_t);
if (status < 0) {
REDEBUG("Program exited with signal %d", -status);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/*
* The status rcodes aren't quite the same as the rcode
* enumeration.
*/
- return rlm_exec_status2rcode(request, m->box, status);
+ RETURN_MODULE_RCODE(rlm_exec_status2rcode(request, m->box, status));
}
/*
* Dispatch an async exec method
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_exec_dispatch(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_exec_dispatch(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_exec_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_exec_t);
rlm_exec_ctx_t *m;
if (!inst->tmpl) {
RDEBUG("This module requires 'program' to be set.");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/*
fr_pair_t **input_pairs;
input_pairs = radius_list(request, inst->input_list);
- if (!input_pairs) return RLM_MODULE_INVALID;
+ if (!input_pairs) RETURN_MODULE_INVALID;
env_pairs = *input_pairs;
}
if (inst->output) {
if (!radius_list(request, inst->output_list)) {
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
}
/*
* Check if account has expired, and if user may login now.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_authorize(UNUSED module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request)
{
fr_pair_t *vp, *check_item = NULL;
if (check_item->vp_date <= fr_time_to_unix_time(request->packet->timestamp)) {
REDEBUG("Account expired at '%pV'", &check_item->data);
- return RLM_MODULE_DISALLOW;
+ RETURN_MODULE_DISALLOW;
}
RDEBUG2("Account will expire at '%pV'", &check_item->data);
MEM(NULL);
}
} else {
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
/*
/*
* Common code called by everything below.
*/
-static rlm_rcode_t file_common(rlm_files_t const *inst, request_t *request, char const *filename, rbtree_t *tree,
- fr_radius_packet_t *packet, fr_radius_packet_t *reply)
+static unlang_action_t file_common(rlm_rcode_t *p_result, rlm_files_t const *inst,
+ request_t *request, char const *filename, rbtree_t *tree,
+ fr_radius_packet_t *packet, fr_radius_packet_t *reply)
{
- char const *name;
- fr_pair_t *check_tmp = NULL;
- fr_pair_t *reply_tmp = NULL;
- PAIR_LIST const *user_pl, *default_pl;
- bool found = false;
- PAIR_LIST my_pl;
- char buffer[256];
+ char const *name;
+ fr_pair_t *check_tmp = NULL;
+ fr_pair_t *reply_tmp = NULL;
+ PAIR_LIST const *user_pl, *default_pl;
+ bool found = false;
+ PAIR_LIST my_pl;
+ char buffer[256];
+
if (tmpl_expand(&name, buffer, sizeof(buffer), request, inst->key, NULL, NULL) < 0) {
REDEBUG("Failed expanding key %s", inst->key->name);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
- if (!tree) return RLM_MODULE_NOOP;
+ if (!tree) RETURN_MODULE_NOOP;
my_pl.name = name;
user_pl = rbtree_finddata(tree, &my_pl);
* See if we succeeded.
*/
if (!found)
- return RLM_MODULE_NOOP; /* on to the next module */
+ RETURN_MODULE_NOOP; /* on to the next module */
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
* for this user from the database. The main code only
* needs to check the password, the rest is done here.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_files_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_files_t);
- return file_common(inst, request, inst->filename,
+ return file_common(p_result, inst, request, inst->filename,
inst->users ? inst->users : inst->common,
request->packet, request->reply);
}
* config. Reply items are Not Recommended(TM) in acct_users,
* except for Fallthrough, which should work
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_preacct(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_preacct(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_files_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_files_t);
- return file_common(inst, request, inst->acct_usersfile,
+ return file_common(p_result, inst, request, inst->acct_usersfile,
inst->acct_users ? inst->acct_users : inst->common,
request->packet, request->reply);
}
-static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_files_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_files_t);
- return file_common(inst, request, inst->auth_usersfile,
+ return file_common(p_result, inst, request, inst->auth_usersfile,
inst->auth_users ? inst->auth_users : inst->common,
request->packet, request->reply);
}
-static rlm_rcode_t CC_HINT(nonnull) mod_post_auth(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_post_auth(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_files_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_files_t);
- return file_common(inst, request, inst->postauth_usersfile,
+ return file_common(p_result, inst, request, inst->postauth_usersfile,
inst->postauth_users ? inst->postauth_users : inst->common,
request->packet, request->reply);
}
* It checks if the response was CURLE_OK
* If it wasn't we returns REJECT, if it was we returns OK
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_authenticate_resume(module_ctx_t const *mctx, request_t *request, void *rctx)
+static unlang_action_t CC_HINT(nonnull) mod_authenticate_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx,
+ request_t *request, void *rctx)
{
rlm_imap_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_imap_t);
fr_curl_io_request_t *randle = rctx;
if (randle->result != CURLE_OK) {
talloc_free(randle);
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
}
if (tls->extract_cert_attrs) fr_curl_response_certinfo(request, randle);
talloc_free(randle);
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
/*
* Then it queues the request and yeilds until a response is given
* When it responds, mod_authenticate_resume is called.
*/
-static rlm_rcode_t CC_HINT(nonnull(1,2)) mod_authenticate(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull(1,2)) mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_imap_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_imap_t);
rlm_imap_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_imap_thread_t);
randle = fr_curl_io_request_alloc(request);
if (!randle){
error:
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
username = fr_pair_find_by_da(&request->request_pairs, attr_user_name);
if (!username) {
REDEBUG("Attribute \"User-Name\" is required for authentication");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
if (!password) {
RDEBUG2("Attribute \"User-Password\" is required for authentication");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
if (password->vp_length == 0) {
RDEBUG2("\"User-Password\" must not be empty");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
FR_CURL_REQUEST_SET_OPTION(CURLOPT_USERNAME, username->vp_strvalue);
FR_CURL_REQUEST_SET_OPTION(CURLOPT_VERBOSE, 1L);
- if (fr_curl_easy_tls_init(randle, &inst->tls) != 0) return RLM_MODULE_INVALID;
+ if (fr_curl_easy_tls_init(randle, &inst->tls) != 0) RETURN_MODULE_INVALID;
- if (fr_curl_io_request_enqueue(t->mhandle, request, randle)) return RLM_MODULE_INVALID;
+ if (fr_curl_io_request_enqueue(t->mhandle, request, randle)) RETURN_MODULE_INVALID;
return unlang_module_yield(request, mod_authenticate_resume, NULL, randle);
}
* takes care of skipping leading spaces, too.
*/
if (!state->eof && !*state->ptr) {
- int rcode;
+ int ret;
state->ptr = start;
- rcode = refill(state);
- if (rcode < 0) return -1;
+ ret = refill(state);
+ if (ret < 0) return -1;
}
/*
* If the buffer is empty, re-fill it.
*/
if (!*state->ptr) {
- int rcode;
+ int ret;
- rcode = refill(state);
- if (rcode < 0) return rcode;
+ ret = refill(state);
+ if (ret < 0) return ret;
- if (rcode == 0) {
+ if (ret == 0) {
if (!state->allow_eof) {
fr_strerror_printf("Unexpected EOF");
return -1;
*/
static int match_subword(rlm_isc_dhcp_tokenizer_t *state, char const *cmd, rlm_isc_dhcp_info_t *info)
{
- int rcode, type;
+ int ret, type;
int semicolon = NO_SEMICOLON;
bool multi = false;
char *p;
* Matching an in-line word.
*/
if (islower((int) *q)) {
- rcode = read_token(state, T_BARE_WORD, semicolon, false);
- if (rcode <= 0) return -1;
+ ret = read_token(state, T_BARE_WORD, semicolon, false);
+ if (ret <= 0) return -1;
/*
* Look for a verbatim word.
if (strcmp(q, "SECTION") == 0) {
if (q[7] != '\0') return -1; /* internal error */
- rcode = read_token(state, T_LCBRACE, NO_SEMICOLON, false);
- if (rcode <= 0) return rcode;
+ ret = read_token(state, T_LCBRACE, NO_SEMICOLON, false);
+ if (ret <= 0) return ret;
- rcode = parse_section(state, info);
- if (rcode < 0) return rcode;
+ ret = parse_section(state, info);
+ if (ret < 0) return ret;
/*
* Empty sections are allowed.
* @todo - if we get fancy, dynamically expand this, too.
* ISC doesn't support it, but we can.
*/
- rcode = read_token(state, T_DOUBLE_QUOTED_STRING, semicolon, false);
- if (rcode <= 0) return rcode;
+ ret = read_token(state, T_DOUBLE_QUOTED_STRING, semicolon, false);
+ if (ret <= 0) return ret;
DDEBUG("... DATA %.*s ", state->token_len, state->token);
*/
info->argv[info->argc] = talloc_zero(info, fr_value_box_t);
- rcode = fr_value_box_from_str(info, info->argv[info->argc], (fr_type_t *) &type, NULL,
+ ret = fr_value_box_from_str(info, info->argv[info->argc], (fr_type_t *) &type, NULL,
state->token, state->token_len, 0, false);
- if (rcode < 0) return rcode;
+ if (ret < 0) return ret;
info->argc++;
*/
static int parse_include(rlm_isc_dhcp_tokenizer_t *state, rlm_isc_dhcp_info_t *info)
{
- int rcode;
+ int ret;
char *p, pathname[8192];
char const *name = info->argv[0]->vb_strvalue;
* Note that we read the included file into the PARENT's
* list. i.e. as if the file was included in-place.
*/
- rcode = read_file(state->inst, info->parent, name);
- if (rcode < 0) return rcode;
+ ret = read_file(state->inst, info->parent, name);
+ if (ret < 0) return ret;
/*
* Even if the file was empty, we return "1" to indicate
static int parse_option_definition(rlm_isc_dhcp_info_t *parent, rlm_isc_dhcp_tokenizer_t *state,
char *name)
{
- int rcode;
+ int ret;
char *p;
fr_type_t type;
fr_dict_attr_t const *da, *root;
/*
* Grab the integer code value.
*/
- rcode = read_token(state, T_BARE_WORD, NO_SEMICOLON, false);
- if (rcode <= 0) {
- error_rcode:
+ ret = read_token(state, T_BARE_WORD, NO_SEMICOLON, false);
+ if (ret <= 0) {
+ error_ret:
talloc_free(name);
- return rcode;
+ return ret;
}
type = FR_TYPE_UINT32;
- rcode = fr_value_box_from_str(NULL, &box, &type, NULL,
+ ret = fr_value_box_from_str(NULL, &box, &type, NULL,
state->token, state->token_len, 0, false);
- if (rcode < 0) goto error;
+ if (ret < 0) goto error;
/*
* Look for '='
*/
- rcode = read_token(state, T_BARE_WORD, NO_SEMICOLON, false);
- if (rcode <= 0) goto error_rcode;
+ ret = read_token(state, T_BARE_WORD, NO_SEMICOLON, false);
+ if (ret <= 0) goto error_ret;
if ((state->token_len != 1) || (state->token[0] != '=')) {
fr_strerror_printf("expected '=' after code definition got '%.*s'", state->token_len, state->token);
*
* array of { TYPE, ... }
*/
- rcode = read_token(state, T_BARE_WORD, MAYBE_SEMICOLON, false);
- if (rcode <= 0) goto error_rcode;
+ ret = read_token(state, T_BARE_WORD, MAYBE_SEMICOLON, false);
+ if (ret <= 0) goto error_ret;
if ((state->token_len == 5) && (memcmp(state->token, "array", 5) == 0)) {
flags.array = 1;
- rcode = read_token(state, T_BARE_WORD, NO_SEMICOLON, false);
- if (rcode <= 0) goto error_rcode;
+ ret = read_token(state, T_BARE_WORD, NO_SEMICOLON, false);
+ if (ret <= 0) goto error_ret;
if (! ((state->token_len == 2) && (memcmp(state->token, "of", 2) == 0))) {
fr_strerror_printf("expected 'array of', not 'array %.*s'",
/*
* Grab the next token. For now, it MUST have a semicolon
*/
- rcode = read_token(state, T_BARE_WORD, YES_SEMICOLON, false);
- if (rcode <= 0) goto error_rcode;
+ ret = read_token(state, T_BARE_WORD, YES_SEMICOLON, false);
+ if (ret <= 0) goto error_ret;
}
if ((state->token_len == 1) && (state->token[0] == '{')) {
* name/code checks above. But doing so allows us to
* have better error messages.
*/
- rcode = fr_dict_attr_add(fr_dict_unconst(dict_dhcpv4), root, name, box.vb_uint32, type, &flags);
+ ret = fr_dict_attr_add(fr_dict_unconst(dict_dhcpv4), root, name, box.vb_uint32, type, &flags);
talloc_free(name);
- if (rcode < 0) return rcode;
+ if (ret < 0) return ret;
/*
* Caller doesn't need to do anything else with the thing
static int parse_option(rlm_isc_dhcp_info_t *parent, rlm_isc_dhcp_tokenizer_t *state,
fr_dict_attr_t const *da, char *value)
{
- int rcode;
+ int ret;
fr_pair_t *vp;
fr_cursor_t cursor;
/*
* Add in the first value.
*/
- rcode = fr_pair_value_from_str(vp, value, talloc_array_length(value) - 1, '\0', false);
- if (rcode < 0) {
+ ret = fr_pair_value_from_str(vp, value, talloc_array_length(value) - 1, '\0', false);
+ if (ret < 0) {
talloc_free(value);
- return rcode;
+ return ret;
}
vp->op = T_OP_EQ;
* For "array" types, loop through the remaining tokens.
*/
while (!state->saw_semicolon) {
- rcode = read_token(state, T_DOUBLE_QUOTED_STRING, MAYBE_SEMICOLON, false);
- if (rcode <= 0) return rcode;
+ ret = read_token(state, T_DOUBLE_QUOTED_STRING, MAYBE_SEMICOLON, false);
+ if (ret <= 0) return ret;
MEM(vp = fr_pair_afrom_da(parent, da));
- rcode = fr_pair_value_from_str(vp, state->token, state->token_len, '\0', false);
- if (rcode < 0) return rcode;
+ ret = fr_pair_value_from_str(vp, state->token, state->token_len, '\0', false);
+ if (ret < 0) return ret;
vp->op = T_OP_EQ;
*/
static int parse_options(rlm_isc_dhcp_info_t *parent, rlm_isc_dhcp_tokenizer_t *state)
{
- int rcode, argc = 0;
+ int ret, argc = 0;
char *argv[2];
char name[FR_DICT_ATTR_MAX_NAME_LEN + 5];
* Since read_token() mashes the input buffer, we have to save the tokens somewhere.
*/
while (!state->saw_semicolon) {
- rcode = read_token(state, T_BARE_WORD, MAYBE_SEMICOLON, false);
- if (rcode < 0) return rcode;
+ ret = read_token(state, T_BARE_WORD, MAYBE_SEMICOLON, false);
+ if (ret < 0) return ret;
argv[argc++] = talloc_strndup(parent, state->token, state->token_len);
{
int start, end, half;
int semicolon;
- int rcode;
+ int ret;
char const *q = NULL;
rlm_isc_dhcp_info_t *info;
* of the situations. Since there are no 1 or 2
* character keywords, this always works.
*/
- rcode = state->token[0] - tokens[half].name[0];
- if (rcode != 0) goto recurse;
+ ret = state->token[0] - tokens[half].name[0];
+ if (ret != 0) goto recurse;
- rcode = state->token[1] - tokens[half].name[1];
- if (rcode != 0) goto recurse;
+ ret = state->token[1] - tokens[half].name[1];
+ if (ret != 0) goto recurse;
- rcode = state->token[2] - tokens[half].name[2];
- if (rcode != 0) goto recurse;
+ ret = state->token[2] - tokens[half].name[2];
+ if (ret != 0) goto recurse;
/*
* Compare all of the strings.
*/
- rcode = strncmp(state->token, tokens[half].name, state->token_len);
+ ret = strncmp(state->token, tokens[half].name, state->token_len);
/*
* Exact match. But maybe we have "foo" input,
* and "food" command?
*/
- if (rcode == 0) {
+ if (ret == 0) {
char c = tokens[half].name[state->token_len];
/*
* "food". Go search the lower half of
* the command table.
*/
- rcode = -1;
+ ret = -1;
}
recurse:
* Token is smaller than the command we checked,
* go check the lower half of the table.
*/
- if (rcode < 0) {
+ if (ret < 0) {
end = half - 1;
} else {
start = half + 1;
if (isspace((int) *q)) {
if (state->saw_semicolon) goto unexpected;
- rcode = match_subword(state, q, info);
- if (rcode <= 0) return rcode;
+ ret = match_subword(state, q, info);
+ if (ret <= 0) return ret;
/*
* SUBSECTION must be at the end
*/
- if (rcode == 2) semicolon = NO_SEMICOLON;
+ if (ret == 2) semicolon = NO_SEMICOLON;
}
/*
* validation, etc.
*/
if (tokens[half].parse) {
- rcode = tokens[half].parse(state, info);
- if (rcode <= 0) {
+ ret = tokens[half].parse(state, info);
+ if (ret <= 0) {
talloc_free(info);
- return rcode;
+ return ret;
}
/*
* tiny list, which makes the O(N)
* processing of it fairly minor.
*/
- if (rcode == 2) return 1;
+ if (ret == 2) return 1;
}
/*
static int parse_subnet(rlm_isc_dhcp_tokenizer_t *state, rlm_isc_dhcp_info_t *info)
{
rlm_isc_dhcp_info_t *parent;
- int rcode, bits;
+ int ret, bits;
uint32_t netmask = info->argv[1]->vb_ipv4addr;
/*
* "subnet" entries in the parent->child list.
*/
- rcode = fr_trie_insert(parent->subnets, &(info->argv[0]->vb_ipv4addr), bits, info);
- if (rcode < 0) {
+ ret = fr_trie_insert(parent->subnets, &(info->argv[0]->vb_ipv4addr), bits, info);
+ if (ret < 0) {
fr_strerror_printf("Failed inserting 'subnet %pV netmask %pV' into trie",
info->argv[0], info->argv[1]);
return -1;
static int add_option_by_da(rlm_isc_dhcp_info_t *info, fr_dict_attr_t const *da)
{
- int rcode;
+ int ret;
fr_pair_t *vp;
fr_cursor_t cursor;
MEM(vp = fr_pair_afrom_da(info->parent, da));
- rcode = fr_value_box_copy(vp, &(vp->data), info->argv[0]);
- if (rcode < 0) return rcode;
+ ret = fr_value_box_copy(vp, &(vp->data), info->argv[0]);
+ if (ret < 0) return ret;
(void) fr_cursor_init(&cursor, &info->parent->options);
(void) fr_cursor_tail(&cursor);
*/
static int apply_fixed_ip(rlm_isc_dhcp_t const *inst, request_t *request)
{
- int rcode;
+ int ret;
rlm_isc_dhcp_info_t *host, *info;
fr_pair_t *vp;
fr_pair_t *yiaddr;
MEM(vp = fr_pair_afrom_da(request->reply_pairs, attr_your_ip_address));
- rcode = fr_value_box_copy(vp, &(vp->data), info->argv[0]);
- if (rcode < 0) return rcode;
+ ret = fr_value_box_copy(vp, &(vp->data), info->argv[0]);
+ if (ret < 0) return ret;
/*
* <sigh> I miss pair_add()
*/
static int apply(rlm_isc_dhcp_t const *inst, request_t *request, rlm_isc_dhcp_info_t *head)
{
- int rcode, child_rcode;
+ int ret, child_ret;
rlm_isc_dhcp_info_t *info;
fr_pair_t *yiaddr;
- rcode = 0;
+ ret = 0;
yiaddr = fr_pair_find_by_da(&request->reply_pairs, attr_your_ip_address);
/*
/*
* Apply any options in the "host" section.
*/
- child_rcode = apply(inst, request, host);
- if (child_rcode < 0) return child_rcode;
- if (child_rcode == 1) rcode = 1;
+ child_ret = apply(inst, request, host);
+ if (child_ret < 0) return child_ret;
+ if (child_ret == 1) ret = 1;
}
subnet:
info = fr_trie_lookup(head->subnets, &yiaddr->vp_ipv4addr, 32);
if (!info) goto recurse;
- child_rcode = apply(inst, request, info);
- if (child_rcode < 0) return child_rcode;
- if (child_rcode == 1) rcode = 1;
+ child_ret = apply(inst, request, info);
+ if (child_ret < 0) return child_ret;
+ if (child_ret == 1) ret = 1;
}
recurse:
if (!info->cmd->apply) continue;
- child_rcode = info->cmd->apply(inst, request, info);
- if (child_rcode < 0) return child_rcode;
- if (child_rcode == 0) continue;
+ child_ret = info->cmd->apply(inst, request, info);
+ if (child_ret < 0) return child_ret;
+ if (child_ret == 0) continue;
- rcode = 1;
+ ret = 1;
}
/*
/*
* We applied some options.
*/
- rcode = 1;
+ ret = 1;
}
- return rcode;
+ return ret;
}
#define isc_not_done ISC_NOOP, NULL, NULL
*/
static int parse_section(rlm_isc_dhcp_tokenizer_t *state, rlm_isc_dhcp_info_t *info)
{
- int rcode;
+ int ret;
int entries = 0;
/*
state->allow_eof = false; /* can't have EOF in the middle of a section */
while (true) {
- rcode = read_token(state, T_BARE_WORD, YES_SEMICOLON, true);
- if (rcode < 0) return rcode;
- if (rcode == 0) break;
+ ret = read_token(state, T_BARE_WORD, YES_SEMICOLON, true);
+ if (ret < 0) return ret;
+ if (ret == 0) break;
/*
* End of section is allowed here.
*/
if (*state->token == '}') break;
- rcode = match_keyword(info, state, commands, NUM_ELEMENTS(commands));
- if (rcode < 0) return rcode;
- if (rcode == 0) break;
+ ret = match_keyword(info, state, commands, NUM_ELEMENTS(commands));
+ if (ret < 0) return ret;
+ if (ret == 0) break;
entries = 1;
}
*/
static int read_file(rlm_isc_dhcp_t *inst, rlm_isc_dhcp_info_t *parent, char const *filename)
{
- int rcode;
+ int ret;
FILE *fp;
rlm_isc_dhcp_tokenizer_t state;
rlm_isc_dhcp_info_t **last = parent->last;
*state.ptr = '\0';
while (true) {
- rcode = read_token(&state, T_BARE_WORD, YES_SEMICOLON, false);
- if (rcode < 0) {
+ ret = read_token(&state, T_BARE_WORD, YES_SEMICOLON, false);
+ if (ret < 0) {
fail:
fr_strerror_printf("Failed reading %s:[%d] - %s",
filename, state.lineno,
fr_strerror());
fclose(fp);
- return rcode;
+ return ret;
}
- if (rcode == 0) break;
+ if (ret == 0) break;
/*
* This will automatically re-fill the buffer,
* and find a matching token.
*/
- rcode = match_keyword(parent, &state, commands, NUM_ELEMENTS(commands));
- if (rcode < 0) goto fail;
- if (rcode == 0) break;
+ ret = match_keyword(parent, &state, commands, NUM_ELEMENTS(commands));
+ if (ret < 0) goto fail;
+ if (ret == 0) break;
}
fclose(fp);
static int mod_instantiate(void *instance, CONF_SECTION *conf)
{
- int rcode;
+ int ret;
rlm_isc_dhcp_t *inst = instance;
rlm_isc_dhcp_info_t *info;
inst->hosts_by_uid = fr_hash_table_create(inst, host_uid_hash, host_uid_cmp, NULL);
if (!inst->hosts_by_uid) return -1;
- rcode = read_file(inst, info, inst->filename);
- if (rcode < 0) {
+ ret = read_file(inst, info, inst->filename);
+ if (ret < 0) {
cf_log_err(conf, "%s", fr_strerror());
return -1;
}
- if (rcode == 0) {
+ if (ret == 0) {
cf_log_warn(conf, "No configuration read from %s", inst->filename);
return 0;
}
return 0;
}
-static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_isc_dhcp_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_isc_dhcp_t);
- int rcode;
+ int ret;
- rcode = apply_fixed_ip(inst, request);
- if (rcode < 0) return RLM_MODULE_FAIL;
- if (rcode == 0) return RLM_MODULE_NOOP;
+ ret = apply_fixed_ip(inst, request);
+ if (ret < 0) RETURN_MODULE_FAIL;
+ if (ret == 0) RETURN_MODULE_NOOP;
- if (rcode == 2) return RLM_MODULE_UPDATED;
+ if (ret == 2) RETURN_MODULE_UPDATED;
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
-static rlm_rcode_t CC_HINT(nonnull) mod_post_auth(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_post_auth(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_isc_dhcp_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_isc_dhcp_t);
- int rcode;
+ int ret;
- rcode = apply(inst, request, inst->head);
- if (rcode < 0) return RLM_MODULE_FAIL;
- if (rcode == 0) return RLM_MODULE_NOOP;
+ ret = apply(inst, request, inst->head);
+ if (ret < 0) RETURN_MODULE_FAIL;
+ if (ret == 0) RETURN_MODULE_NOOP;
// @todo - check for subnet mask option. If none exists, use one from the enclosing network?
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
extern module_t rlm_isc_dhcp;
*/
if (!username) {
REDEBUG("Attribute \"User-Name\" is required for authentication");
- return RLM_MODULE_INVALID;
+ return RLM_MODULE_FAIL;
}
ret = krb5_parse_name(context, username->vp_strvalue, client);
fr_assert(ret != 0);
if (!fr_cond_assert(inst)) return RLM_MODULE_FAIL;
- if (!fr_cond_assert(conn)) return RLM_MODULE_FAIL; /* Silences warnings */
+ if (!fr_cond_assert(conn)) return RLM_MODULE_FAIL;; /* Silences warnings */
switch (ret) {
case KRB5_LIBOS_BADPWDMATCH:
/*
* Validate user/pass (Heimdal)
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_krb5_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_krb5_t);
rlm_rcode_t rcode;
if (!password) {
REDEBUG("Attribute \"User-Password\" is required for authentication");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
*/
if (password->vp_length == 0) {
REDEBUG("User-Password must not be empty");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
# ifdef KRB5_IS_THREAD_SAFE
conn = fr_pool_connection_get(inst->pool, request);
- if (!conn) return RLM_MODULE_FAIL;
+ if (!conn) RETURN_MODULE_FAIL;
# else
conn = inst->conn;
# endif
# ifdef KRB5_IS_THREAD_SAFE
fr_pool_connection_release(inst->pool, request, conn);
# endif
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
#else /* HEIMDAL_KRB5 */
/*
* Validate userid/passwd (MIT)
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_krb5_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_krb5_t);
rlm_rcode_t rcode;
if (!password) {
REDEBUG("Attribute \"User-Password\" is required for authentication");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
*/
if (password->vp_length == 0) {
REDEBUG("User-Password must not be empty");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
# ifdef KRB5_IS_THREAD_SAFE
conn = fr_pool_connection_get(inst->pool, request);
- if (!conn) return RLM_MODULE_FAIL;
+ if (!conn) RETURN_MODULE_FAIL;
# else
conn = inst->conn;
# endif
# ifdef KRB5_IS_THREAD_SAFE
fr_pool_connection_release(inst->pool, request, conn);
# endif
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
#endif /* MIT_KRB5 */
* Given an array of group names, builds a filter matching all names, then retrieves all group objects
* and stores the DN associated with each group object.
*
- * @param[in] inst rlm_ldap configuration.
- * @param[in] request Current request.
- * @param[in,out] pconn to use. May change as this function calls functions which auto re-connect.
- * @param[in] names to convert to DNs (NULL terminated).
- * @param[out] out Where to write the DNs. DNs must be freed with ldap_memfree(). Will be NULL terminated.
- * @param[in] outlen Size of out.
+ * @param[out] p_result The result of trying to resolve a group name to a dn.
+ * @param[in] inst rlm_ldap configuration.
+ * @param[in] request Current request.
+ * @param[in,out] pconn to use. May change as this function calls functions which auto re-connect.
+ * @param[in] names to convert to DNs (NULL terminated).
+ * @param[out] out Where to write the DNs. DNs must be freed with
+ * ldap_memfree(). Will be NULL terminated.
+ * @param[in] outlen Size of out.
* @return One of the RLM_MODULE_* values.
*/
-static rlm_rcode_t rlm_ldap_group_name2dn(rlm_ldap_t const *inst, request_t *request, fr_ldap_connection_t **pconn,
- char **names, char **out, size_t outlen)
+static unlang_action_t rlm_ldap_group_name2dn(rlm_rcode_t *p_result, rlm_ldap_t const *inst, request_t *request,
+ fr_ldap_connection_t **pconn,
+ char **names, char **out, size_t outlen)
{
rlm_rcode_t rcode = RLM_MODULE_OK;
fr_ldap_rcode_t status;
*dn = NULL;
- if (!*names) return RLM_MODULE_OK;
+ if (!*names) RETURN_MODULE_OK;
if (!inst->groupobj_name_attr) {
REDEBUG("Told to convert group names to DNs but missing 'group.name_attribute' directive");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
RDEBUG2("Converting group name(s) to group DN(s)");
inst->groupobj_base_dn, fr_ldap_escape_func, NULL) < 0) {
REDEBUG("Failed creating base_dn");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
status = fr_ldap_search(&result, request, pconn, base_dn, inst->groupobj_scope,
*dn = NULL;
}
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
/** Convert a single group name into a DN
* Unlike the inverse conversion of a name to a DN, most LDAP directories don't allow filtering by DN,
* so we need to search for each DN individually.
*
- * @param[in] inst rlm_ldap configuration.
- * @param[in] request Current request.
- * @param[in,out] pconn to use. May change as this function calls functions which auto re-connect.
- * @param[in] dn to resolve.
- * @param[out] out Where to write group name (must be freed with talloc_free).
+ * @param[out] p_result The result of trying to resolve a dn to a group name.
+ * @param[in] inst rlm_ldap configuration.
+ * @param[in] request Current request.
+ * @param[in,out] pconn to use. May change as this function calls functions which auto re-connect.
+ * @param[in] dn to resolve.
+ * @param[out] out Where to write group name (must be freed with talloc_free).
* @return One of the RLM_MODULE_* values.
*/
-static rlm_rcode_t rlm_ldap_group_dn2name(rlm_ldap_t const *inst, request_t *request,
- fr_ldap_connection_t **pconn, char const *dn, char **out)
+static unlang_action_t rlm_ldap_group_dn2name(rlm_rcode_t *p_result, rlm_ldap_t const *inst, request_t *request,
+ fr_ldap_connection_t **pconn, char const *dn, char **out)
{
rlm_rcode_t rcode = RLM_MODULE_OK;
fr_ldap_rcode_t status;
if (!inst->groupobj_name_attr) {
REDEBUG("Told to resolve group DN to name but missing 'group.name_attribute' directive");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
RDEBUG2("Resolving group DN \"%s\" to group name", dn);
case LDAP_PROC_NO_RESULT:
REDEBUG("Group DN \"%s\" did not resolve to an object", dn);
- return inst->allow_dangling_group_refs ? RLM_MODULE_NOOP : RLM_MODULE_INVALID;
+ RETURN_MODULE_RCODE(inst->allow_dangling_group_refs ? RLM_MODULE_NOOP : RLM_MODULE_INVALID);
default:
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
entry = ldap_first_entry((*pconn)->handle, result);
if (result) ldap_msgfree(result);
if (values) ldap_value_free_len(values);
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
/** Convert group membership information into attributes
*
- * @param[in] inst rlm_ldap configuration.
- * @param[in] request Current request.
- * @param[in,out] pconn to use. May change as this function calls functions which auto re-connect.
- * @param[in] entry retrieved by rlm_ldap_find_user or fr_ldap_search.
- * @param[in] attr membership attribute to look for in the entry.
+ * @param[out] p_result The result of trying to resolve a dn to a group name.
+ * @param[in] inst rlm_ldap configuration.
+ * @param[in] request Current request.
+ * @param[in,out] pconn to use. May change as this function calls functions which auto re-connect.
+ * @param[in] entry retrieved by rlm_ldap_find_user or fr_ldap_search.
+ * @param[in] attr membership attribute to look for in the entry.
* @return One of the RLM_MODULE_* values.
*/
-rlm_rcode_t rlm_ldap_cacheable_userobj(rlm_ldap_t const *inst, request_t *request, fr_ldap_connection_t **pconn,
- LDAPMessage *entry, char const *attr)
+unlang_action_t rlm_ldap_cacheable_userobj(rlm_rcode_t *p_result, rlm_ldap_t const *inst,
+ request_t *request, fr_ldap_connection_t **pconn,
+ LDAPMessage *entry, char const *attr)
{
rlm_rcode_t rcode = RLM_MODULE_OK;
if (!values) {
RDEBUG2("No cacheable group memberships found in user object");
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
count = ldap_count_values_len(values);
char *dn;
dn = fr_ldap_berval_to_string(value_ctx, values[i]);
- rcode = rlm_ldap_group_dn2name(inst, request, pconn, dn, &name);
+ rlm_ldap_group_dn2name(&rcode, inst, request, pconn, dn, &name);
talloc_free(dn);
if (rcode == RLM_MODULE_NOOP) continue;
talloc_free(value_ctx);
fr_pair_list_free(&groups);
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
MEM(vp = fr_pair_afrom_da(list_ctx, inst->cache_da));
}
*name_p = NULL;
- rcode = rlm_ldap_group_name2dn(inst, request, pconn, group_name, group_dn, sizeof(group_dn));
+ rlm_ldap_group_name2dn(&rcode, inst, request, pconn, group_name, group_dn, sizeof(group_dn));
ldap_value_free_len(values);
talloc_free(value_ctx);
- if (rcode != RLM_MODULE_OK) return rcode;
+ if (rcode != RLM_MODULE_OK) RETURN_MODULE_RCODE(rcode);
fr_cursor_init(&list_cursor, list);
}
REXDENT();
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
/** Convert group membership information into attributes
*
- * @param[in] inst rlm_ldap configuration.
- * @param[in] request Current request.
- * @param[in,out] pconn to use. May change as this function calls functions which auto re-connect.
+ * @param[out] p_result The result of trying to resolve a dn to a group name.
+ * @param[in] inst rlm_ldap configuration.
+ * @param[in] request Current request.
+ * @param[in,out] pconn to use. May change as this function calls functions which auto re-connect.
* @return One of the RLM_MODULE_* values.
*/
-rlm_rcode_t rlm_ldap_cacheable_groupobj(rlm_ldap_t const *inst, request_t *request, fr_ldap_connection_t **pconn)
+unlang_action_t rlm_ldap_cacheable_groupobj(rlm_rcode_t *p_result, rlm_ldap_t const *inst,
+ request_t *request, fr_ldap_connection_t **pconn)
{
rlm_rcode_t rcode = RLM_MODULE_OK;
fr_ldap_rcode_t status;
if (!inst->groupobj_membership_filter) {
RDEBUG2("Skipping caching group objects as directive 'group.membership_filter' is not set");
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
if (fr_ldap_xlat_filter(request,
filters, NUM_ELEMENTS(filters),
filter, sizeof(filter)) < 0) {
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
if (tmpl_expand(&base_dn, base_dn_buff, sizeof(base_dn_buff), request,
inst->groupobj_base_dn, fr_ldap_escape_func, NULL) < 0) {
REDEBUG("Failed creating base_dn");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
status = fr_ldap_search(&result, request, pconn, base_dn,
finish:
if (result) ldap_msgfree(result);
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
/** Query the LDAP directory to check if a group object includes a user object as a member
* @param[in] check vp containing the group value (name or dn).
* @return One of the RLM_MODULE_* values.
*/
-rlm_rcode_t rlm_ldap_check_groupobj_dynamic(rlm_ldap_t const *inst, request_t *request, fr_ldap_connection_t **pconn,
- fr_pair_t *check)
-
+unlang_action_t rlm_ldap_check_groupobj_dynamic(rlm_rcode_t *p_result, rlm_ldap_t const *inst, request_t *request,
+ fr_ldap_connection_t **pconn, fr_pair_t *check)
{
fr_ldap_rcode_t status;
filter, sizeof(filter));
REXDENT();
- if (ret < 0) return RLM_MODULE_INVALID;
+ if (ret < 0) RETURN_MODULE_INVALID;
base_dn = check->vp_strvalue;
} else {
REDEBUG("Told to search for group by name, but missing 'group.name_attribute' "
"directive");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
snprintf(name_filter, sizeof(name_filter), "(%s=%s)", inst->groupobj_name_attr, check->vp_strvalue);
filters, NUM_ELEMENTS(filters),
filter, sizeof(filter));
REXDENT();
- if (ret < 0) return RLM_MODULE_INVALID;
+ if (ret < 0) RETURN_MODULE_INVALID;
/*
if (ret < 0) {
REDEBUG("Failed creating base_dn");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
}
break;
case LDAP_PROC_NO_RESULT:
- return RLM_MODULE_NOTFOUND;
+ RETURN_MODULE_NOTFOUND;
default:
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
/** Query the LDAP directory to check if a user object is a member of a group
*
- * @param[in] inst rlm_ldap configuration.
- * @param[in] request Current request.
- * @param[in,out] pconn to use. May change as this function calls functions which auto re-connect.
- * @param[in] dn of user object.
- * @param[in] check vp containing the group value (name or dn).
+ * @param[in] inst rlm_ldap configuration.
+ * @param[in] request Current request.
+ * @param[in,out] pconn to use. May change as this function calls functions which auto re-connect.
+ * @param[in] dn of user object.
+ * @param[in] check vp containing the group value (name or dn).
* @return One of the RLM_MODULE_* values.
*/
-rlm_rcode_t rlm_ldap_check_userobj_dynamic(rlm_ldap_t const *inst, request_t *request, fr_ldap_connection_t **pconn,
- char const *dn, fr_pair_t *check)
+unlang_action_t rlm_ldap_check_userobj_dynamic(rlm_rcode_t *p_result, rlm_ldap_t const *inst, request_t *request,
+ fr_ldap_connection_t **pconn,
+ char const *dn, fr_pair_t *check)
{
rlm_rcode_t rcode = RLM_MODULE_NOTFOUND, ret;
fr_ldap_rcode_t status;
bool eq = false;
RINDENT();
- ret = rlm_ldap_group_dn2name(inst, request, pconn, check->vp_strvalue, &resolved);
+ rlm_ldap_group_dn2name(&ret, inst, request, pconn, check->vp_strvalue, &resolved);
REXDENT();
if (ret == RLM_MODULE_NOOP) continue;
value = fr_ldap_berval_to_string(request, values[i]);
RINDENT();
- ret = rlm_ldap_group_dn2name(inst, request, pconn, value, &resolved);
+ rlm_ldap_group_dn2name(&ret, inst, request, pconn, value, &resolved);
REXDENT();
talloc_free(value);
if (values) ldap_value_free_len(values);
if (result) ldap_msgfree(result);
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
/** Check group membership attributes to see if a user is a member.
*
* @return One of the RLM_MODULE_* values.
*/
-rlm_rcode_t rlm_ldap_check_cached(rlm_ldap_t const *inst, request_t *request, fr_pair_t *check)
+unlang_action_t rlm_ldap_check_cached(rlm_rcode_t *p_result,
+ rlm_ldap_t const *inst, request_t *request, fr_pair_t *check)
{
fr_pair_t *vp;
int ret;
* the caller should try a dynamic group lookup instead.
*/
vp = fr_cursor_iter_by_da_init(&cursor, &request->control_pairs, inst->cache_da);
- if (!vp) return RLM_MODULE_INVALID;
+ if (!vp) RETURN_MODULE_INVALID;
for (vp = fr_cursor_current(&cursor);
vp;
ret = fr_pair_cmp_op(T_OP_CMP_EQ, vp, check);
if (ret == 1) {
RDEBUG2("User found. Matched cached membership");
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
- if (ret < -1) return RLM_MODULE_FAIL;
+ if (ret < -1) RETURN_MODULE_FAIL;
}
RDEBUG2("Cached membership not found");
- return RLM_MODULE_NOTFOUND;
+ RETURN_MODULE_NOTFOUND;
}
fr_pair_value_bstr_realloc(check, NULL, len);
}
if ((check_is_dn && inst->cacheable_group_dn) || (!check_is_dn && inst->cacheable_group_name)) {
- switch (rlm_ldap_check_cached(inst, request, check)) {
+ rlm_rcode_t our_rcode;
+
+ rlm_ldap_check_cached(&our_rcode, inst, request, check);
+ switch (our_rcode) {
case RLM_MODULE_NOTFOUND:
found = false;
goto finish;
* Check groupobj user membership
*/
if (inst->groupobj_membership_filter) {
- switch (rlm_ldap_check_groupobj_dynamic(inst, request, &conn, check)) {
+ rlm_rcode_t our_rcode;
+
+ rlm_ldap_check_groupobj_dynamic(&our_rcode, inst, request, &conn, check);
+ switch (our_rcode) {
case RLM_MODULE_NOTFOUND:
break;
* Check userobj group membership
*/
if (inst->userobj_membership_attr) {
- switch (rlm_ldap_check_userobj_dynamic(inst, request, &conn, user_dn, check)) {
+ rlm_rcode_t our_rcode;
+
+ rlm_ldap_check_userobj_dynamic(&our_rcode, inst, request, &conn, user_dn, check);
+ switch (our_rcode) {
case RLM_MODULE_NOTFOUND:
break;
return 0;
}
-static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_ldap_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_ldap_t);
rlm_rcode_t rcode;
*/
if (!username) {
REDEBUG("Attribute \"User-Name\" is required for authentication");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
if (!password) {
RWDEBUG("*********************************************");
REDEBUG("Attribute \"User-Password\" is required for authentication");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
*/
if (password->vp_length == 0) {
REDEBUG("User-Password must not be empty");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
}
conn = mod_conn_get(inst, request);
- if (!conn) return RLM_MODULE_FAIL;
+ if (!conn) RETURN_MODULE_FAIL;
/*
* Expand dynamic SASL fields
if (!dn) {
ldap_mod_conn_release(inst, request, conn);
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
conn->rebound = true;
status = fr_ldap_bind(request,
finish:
ldap_mod_conn_release(inst, request, conn);
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
/** Search for and apply an LDAP profile
* LDAP profiles are mapped using the same attribute map as user objects, they're used to add common
* sets of attributes to the request.
*
- * @param[in] inst rlm_ldap configuration.
- * @param[in] request Current request.
- * @param[in,out] pconn to use. May change as this function calls functions which auto re-connect.
- * @param[in] dn of profile object to apply.
- * @param[in] expanded Structure containing a list of xlat expanded attribute names and mapping
-information.
+ * @param[out] p_result the result of applying the profile.
+ * @param[in] inst rlm_ldap configuration.
+ * @param[in] request Current request.
+ * @param[in,out] pconn to use. May change as this function calls functions which auto re-connect.
+ * @param[in] dn of profile object to apply.
+ * @param[in] expanded Structure containing a list of xlat
+ * expanded attribute names and mapping information.
* @return One of the RLM_MODULE_* values.
*/
-static rlm_rcode_t rlm_ldap_map_profile(rlm_ldap_t const *inst, request_t *request, fr_ldap_connection_t **pconn,
- char const *dn, fr_ldap_map_exp_t const *expanded)
+static unlang_action_t rlm_ldap_map_profile(rlm_rcode_t *p_result, rlm_ldap_t const *inst,
+ request_t *request, fr_ldap_connection_t **pconn,
+ char const *dn, fr_ldap_map_exp_t const *expanded)
{
rlm_rcode_t rcode = RLM_MODULE_OK;
fr_ldap_rcode_t status;
fr_assert(inst->profile_filter); /* We always have a default filter set */
- if (!dn || !*dn) return RLM_MODULE_OK;
+ if (!dn || !*dn) RETURN_MODULE_OK;
if (tmpl_expand(&filter, filter_buff, sizeof(filter_buff), request,
inst->profile_filter, fr_ldap_escape_func, NULL) < 0) {
REDEBUG("Failed creating profile filter");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
status = fr_ldap_search(&result, request, pconn, dn,
case LDAP_PROC_BAD_DN:
case LDAP_PROC_NO_RESULT:
RDEBUG2("Profile object \"%s\" not found", dn);
- return RLM_MODULE_NOTFOUND;
+ RETURN_MODULE_NOTFOUND;
default:
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
fr_assert(*pconn);
free_result:
ldap_msgfree(result);
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
-static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_ldap_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_ldap_t);
rlm_rcode_t rcode = RLM_MODULE_OK;
* for many things besides searching for users.
*/
- if (fr_ldap_map_expand(&expanded, request, inst->user_map) < 0) return RLM_MODULE_FAIL;
+ if (fr_ldap_map_expand(&expanded, request, inst->user_map) < 0) RETURN_MODULE_FAIL;
conn = mod_conn_get(inst, request);
- if (!conn) return RLM_MODULE_FAIL;
+ if (!conn) RETURN_MODULE_FAIL;
/*
* Add any additional attributes we need for checking access, memberships, and profiles
*/
if (inst->cacheable_group_dn || inst->cacheable_group_name) {
if (inst->userobj_membership_attr) {
- rcode = rlm_ldap_cacheable_userobj(inst, request, &conn, entry, inst->userobj_membership_attr);
+ rlm_ldap_cacheable_userobj(&rcode, inst, request, &conn, entry, inst->userobj_membership_attr);
if (rcode != RLM_MODULE_OK) {
goto finish;
}
}
- rcode = rlm_ldap_cacheable_groupobj(inst, request, &conn);
+ rlm_ldap_cacheable_groupobj(&rcode, inst, request, &conn);
if (rcode != RLM_MODULE_OK) {
goto finish;
}
* Apply ONE user profile, or a default user profile.
*/
if (inst->default_profile) {
- char const *profile;
- char profile_buff[1024];
+ char const *profile;
+ char profile_buff[1024];
+ rlm_rcode_t ret;
if (tmpl_expand(&profile, profile_buff, sizeof(profile_buff),
request, inst->default_profile, NULL, NULL) < 0) {
goto finish;
}
- switch (rlm_ldap_map_profile(inst, request, &conn, profile, &expanded)) {
+ rlm_ldap_map_profile(&ret, inst, request, &conn, profile, &expanded);
+ switch (ret) {
case RLM_MODULE_INVALID:
rcode = RLM_MODULE_INVALID;
goto finish;
char *value;
value = fr_ldap_berval_to_string(request, values[i]);
- ret = rlm_ldap_map_profile(inst, request, &conn, value, &expanded);
+ rlm_ldap_map_profile(&ret, inst, request, &conn, value, &expanded);
talloc_free(value);
if (ret == RLM_MODULE_FAIL) {
ldap_value_free_len(values);
if (result) ldap_msgfree(result);
ldap_mod_conn_release(inst, request, conn);
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
/** Modify user's object in LDAP
*
* Process a modifcation map to update a user object in the LDAP directory.
*
- * @param inst rlm_ldap instance.
- * @param request Current request.
- * @param section that holds the map to process.
+ * @param[out] p_result the result of the modification.
+ * @param[in] inst rlm_ldap instance.
+ * @param[in] request Current request.
+ * @param[in] section that holds the map to process.
* @return one of the RLM_MODULE_* values.
*/
-static rlm_rcode_t user_modify(rlm_ldap_t const *inst, request_t *request, ldap_acct_section_t *section)
+static unlang_action_t user_modify(rlm_rcode_t *p_result, rlm_ldap_t const *inst,
+ request_t *request, ldap_acct_section_t *section)
{
rlm_rcode_t rcode = RLM_MODULE_OK;
fr_ldap_rcode_t status;
mod_p[total] = NULL;
conn = mod_conn_get(inst, request);
- if (!conn) return RLM_MODULE_FAIL;
+ if (!conn) RETURN_MODULE_FAIL;
dn = rlm_ldap_find_user(inst, request, &conn, NULL, false, NULL, &rcode);
ldap_mod_conn_release(inst, request, conn);
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
-static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_accounting(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_ldap_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_ldap_t);
- if (inst->accounting) return user_modify(inst, request, inst->accounting);
+ if (inst->accounting) return user_modify(p_result, inst, request, inst->accounting);
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
-static rlm_rcode_t CC_HINT(nonnull) mod_post_auth(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_post_auth(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_ldap_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_ldap_t);
- if (inst->postauth) return user_modify(inst, request, inst->postauth);
+ if (inst->postauth) return user_modify(p_result, inst, request, inst->postauth);
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
/*
* groups.c - Group membership functions.
*/
-rlm_rcode_t rlm_ldap_cacheable_userobj(rlm_ldap_t const *inst, request_t *request, fr_ldap_connection_t **pconn,
- LDAPMessage *entry, char const *attr);
+unlang_action_t rlm_ldap_cacheable_userobj(rlm_rcode_t *p_result, rlm_ldap_t const *inst,
+ request_t *request, fr_ldap_connection_t **pconn,
+ LDAPMessage *entry, char const *attr);
-rlm_rcode_t rlm_ldap_cacheable_groupobj(rlm_ldap_t const *inst, request_t *request, fr_ldap_connection_t **pconn);
+unlang_action_t rlm_ldap_cacheable_groupobj(rlm_rcode_t *p_result,
+ rlm_ldap_t const *inst, request_t *request, fr_ldap_connection_t **pconn);
-rlm_rcode_t rlm_ldap_check_groupobj_dynamic(rlm_ldap_t const *inst, request_t *request, fr_ldap_connection_t **pconn,
- fr_pair_t *check);
+unlang_action_t rlm_ldap_check_groupobj_dynamic(rlm_rcode_t *p_result,
+ rlm_ldap_t const *inst, request_t *request, fr_ldap_connection_t **pconn,
+ fr_pair_t *check);
-rlm_rcode_t rlm_ldap_check_userobj_dynamic(rlm_ldap_t const *inst, request_t *request, fr_ldap_connection_t **pconn,
- char const *dn, fr_pair_t *check);
+unlang_action_t rlm_ldap_check_userobj_dynamic(rlm_rcode_t *p_result,
+ rlm_ldap_t const *inst, request_t *request, fr_ldap_connection_t **pconn,
+ char const *dn, fr_pair_t *check);
-rlm_rcode_t rlm_ldap_check_cached(rlm_ldap_t const *inst, request_t *request, fr_pair_t *check);
+unlang_action_t rlm_ldap_check_cached(rlm_rcode_t *p_result,
+ rlm_ldap_t const *inst, request_t *request, fr_pair_t *check);
/*
* conn.c - Connection wrappers.
* - #RLM_MODULE_FAIL if we failed writing the message.
* - #RLM_MODULE_OK on success.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_do_linelog(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_do_linelog(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_linelog_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_linelog_t);
linelog_conn_t *conn;
if (tmpl_expand(&path, buff + 1, sizeof(buff) - 1,
request, inst->log_ref, linelog_escape_func, NULL) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
if (path != buff + 1) strlcpy(buff + 1, path, sizeof(buff) - 1);
*/
if (buff[2] == '.') {
REDEBUG("Invalid path \"%s\"", p);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
ci = cf_reference_item(NULL, inst->cs, p);
if (!cf_item_is_pair(ci)) {
REDEBUG("Path \"%s\" resolves to a section (should be a pair)", p);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
cp = cf_item_to_pair(ci);
});
if (slen <= 0) {
REMARKER(tmpl_str, -slen, "%s", fr_strerror());
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
vpt_p = vpt;
} else {
*/
if (!inst->log_src) {
RDEBUG2("No default message configured");
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
/*
* Use the pre-parsed format template
char path[2048];
if (xlat_eval(path, sizeof(path), request, inst->file.name, inst->file.escape_func, NULL) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/* check path and eventually create subdirs */
/* Assert on the extra fatal errors */
fr_assert((errno != EINVAL) && (errno != EFAULT));
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
exfile_close(inst->file.ef, request, fd);
talloc_free(vector);
/* coverity[missing_unlock] */
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
/*
* Check if account has expired, and if user may login now.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_logintime_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_logintime_t);
fr_pair_t *ends, *vp;
int32_t left;
ends = fr_pair_find_by_da(&request->control_pairs, attr_login_time);
- if (!ends) return RLM_MODULE_NOOP;
+ if (!ends) RETURN_MODULE_NOOP;
/*
* Authentication is OK. Now see if this user may login at this time of the day.
* Compare the time the request was received with the current Login-Time value
*/
left = timestr_match(ends->vp_strvalue, fr_time_to_sec(request->packet->timestamp));
- if (left < 0) return RLM_MODULE_DISALLOW; /* outside of the allowed time */
+ if (left < 0) RETURN_MODULE_DISALLOW; /* outside of the allowed time */
/*
* Do nothing, login time is not controlled (unendsed).
*/
- if (left == 0) return RLM_MODULE_OK;
+ if (left == 0) RETURN_MODULE_OK;
/*
* The min_time setting is to deal with NAS that won't allow Session-vp values below a certain value
REDEBUG("Login outside of allowed time-slot (session end %s, with lockout %i seconds before)",
ends->vp_strvalue, inst->min_time);
- return RLM_MODULE_DISALLOW;
+ RETURN_MODULE_DISALLOW;
}
/* else left > inst->min_time */
MEM(NULL);
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
char const *fmt, va_list ap, void *uctx)
CC_HINT(format (printf, 6, 0)) CC_HINT(nonnull (3, 6));
-static rlm_rcode_t mod_insert_logtee(module_ctx_t const *mctx, request_t *request) CC_HINT(nonnull);
+static unlang_action_t mod_insert_logtee(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) CC_HINT(nonnull);
/** Connection errored
*
* - #RLM_MODULE_NOOP if log destination already exists.
* - #RLM_MODULE_OK if we added a new destination.
*/
-static rlm_rcode_t mod_insert_logtee(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t mod_insert_logtee(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
fr_cursor_t cursor;
log_dst_t *dst;
if (dst->uctx == mctx->thread) exists = true;
}
- if (exists) return RLM_MODULE_NOOP;
+ if (exists) RETURN_MODULE_NOOP;
dst = talloc_zero(request, log_dst_t);
dst->func = logtee_it;
fr_cursor_append(&cursor, dst);
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
/** Create thread-specific connections and buffers
lua_setfield(L, -2, "request");
}
-int fr_lua_run(module_ctx_t const *mctx, request_t *request, char const *funcname)
+unlang_action_t fr_lua_run(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, char const *funcname)
{
rlm_lua_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_lua_t);
rlm_lua_thread_t *thread = talloc_get_type_abort(mctx->thread, rlm_lua_thread_t);
lua_State *L = thread->interpreter;
- int ret = RLM_MODULE_OK;
+ rlm_rcode_t rcode = RLM_MODULE_OK;
fr_lua_util_set_inst(inst);
fr_lua_util_set_request(request);
fr_lua_util_set_inst(NULL);
fr_lua_util_set_request(NULL);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
if (!lua_isfunction(L, -1)) {
}
/*
- * functions without return or returning none/nil will be RLM_MODULE_OK
+ * functions without rcodeurn or rcodeurning none/nil will be RLM_MODULE_OK
*/
if (!lua_isnoneornil(L, -1)) {
/*
- * e.g: return 2, return "2", return fr.handled, fr.fail, ...
+ * e.g: rcodeurn 2, rcodeurn "2", rcodeurn fr.handled, fr.fail, ...
*/
if (lua_isnumber(L, -1)) {
- ret = lua_tointeger(L, -1);
- if (fr_table_str_by_value(rcode_table, ret, NULL) != NULL) goto done;
+ rcode = lua_tointeger(L, -1);
+ if (fr_table_str_by_value(rcode_table, rcode, NULL) != NULL) goto done;
}
/*
- * e.g: return "handled", "ok", "fail", ...
+ * e.g: rcodeurn "handled", "ok", "fail", ...
*/
if (lua_isstring(L, -1)) {
- ret = fr_table_value_by_str(rcode_table, lua_tostring(L, -1), -1);
- if (ret != -1) goto done;
+ rcode = fr_table_value_by_str(rcode_table, lua_tostring(L, -1), -1);
+ if ((int)rcode != -1) goto done;
}
- ROPTIONAL(RDEBUG2, DEBUG2, "Lua function %s() returned invalid rcode \"%s\"", funcname, lua_tostring(L, -1));
+ ROPTIONAL(RDEBUG2, DEBUG2, "Lua function %s() rcodeurned invalid rcode \"%s\"", funcname, lua_tostring(L, -1));
goto error;
}
fr_lua_util_set_inst(NULL);
fr_lua_util_set_request(NULL);
- return ret;
+ RETURN_MODULE_RCODE(rcode);
}
/*
/* lua.c */
int fr_lua_init(lua_State **out, rlm_lua_t const *instance);
-int fr_lua_run(module_ctx_t const *mctx, request_t *request, char const *funcname);
+unlang_action_t fr_lua_run(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, char const *funcname);
bool fr_lua_isjit(lua_State *L);
char const *fr_lua_version(lua_State *L);
};
#define DO_LUA(_s)\
-static rlm_rcode_t mod_##_s(module_ctx_t const *mctx, request_t *request) \
+static unlang_action_t mod_##_s(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) \
{\
rlm_lua_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_lua_t);\
- if (!inst->func_##_s) return RLM_MODULE_NOOP;\
- return fr_lua_run(mctx, request, inst->func_##_s);\
+ if (!inst->func_##_s) RETURN_MODULE_NOOP;\
+ return fr_lua_run(p_result, mctx, request, inst->func_##_s);\
}
DO_LUA(authorize)
static int mod_detach(void *instance)
{
rlm_lua_t *inst = instance;
- int ret = 0;
+ rlm_rcode_t ret = 0;
/*
* May be NULL if fr_lua_init failed
*/
if (inst->interpreter) {
- if (inst->func_detach) ret = fr_lua_run(&(module_ctx_t){
- .instance = inst,
- .thread = &(rlm_lua_thread_t){
- .interpreter = inst->interpreter
- }
- },
- NULL, inst->func_detach);
-
+ if (inst->func_detach) {
+ fr_lua_run(&ret, &(module_ctx_t){
+ .instance = inst,
+ .thread = &(rlm_lua_thread_t){
+ .interpreter = inst->interpreter
+ }
+ },
+ NULL, inst->func_detach);
+ }
lua_close(inst->interpreter);
}
static int mod_instantiate(void *instance, CONF_SECTION *conf)
{
rlm_lua_t *inst = instance;
+ rlm_rcode_t rcode;
inst->xlat_name = cf_section_name2(conf);
if (!inst->xlat_name) inst->xlat_name = cf_section_name1(conf);
DEBUG("Using %s interpreter", fr_lua_version(inst->interpreter));
- if (inst->func_instantiate) return fr_lua_run(&(module_ctx_t){
- .instance = inst,
- .thread = &(rlm_lua_thread_t){
- .interpreter = inst->interpreter
- }
- },
- NULL, inst->func_instantiate);
+ if (inst->func_instantiate) {
+ fr_lua_run(&rcode, &(module_ctx_t){
+ .instance = inst,
+ .thread = &(rlm_lua_thread_t){
+ .interpreter = inst->interpreter
+ }
+ },
+ NULL, inst->func_instantiate);
+ }
return 0;
}
/* Must have exactly three items */
if (RARRAY_LEN(mruby_result) != 3) {
ERROR("Expected array to have exactly three values, got %" PRId64 " instead", RARRAY_LEN(mruby_result));
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/* First item must be a Fixnum, this will be the return type */
if (mrb_type(mrb_ary_entry(mruby_result, 0)) != MRB_TT_FIXNUM) {
ERROR("Expected first array element to be a Fixnum, got %s instead", RSTRING_PTR(mrb_obj_as_string(mrb, mrb_ary_entry(mruby_result, 0))));
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/* Second and third items must be Arrays, these will be the updates for reply and control */
if (mrb_type(mrb_ary_entry(mruby_result, 1)) != MRB_TT_ARRAY) {
ERROR("Expected second array element to be an Array, got %s instead", RSTRING_PTR(mrb_obj_as_string(mrb, mrb_ary_entry(mruby_result, 1))));
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
} else if (mrb_type(mrb_ary_entry(mruby_result, 2)) != MRB_TT_ARRAY) {
ERROR("Expected third array element to be an Array, got %s instead", RSTRING_PTR(mrb_obj_as_string(mrb, mrb_ary_entry(mruby_result, 2))));
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
add_vp_tuple(request->reply, request, &request->reply_pairs, mrb, mrb_ary_entry(mruby_result, 1), function_name);
default:
/* Invalid return type */
ERROR("Expected return to be a Fixnum or an Array, got %s instead", RSTRING_PTR(mrb_obj_as_string(mrb, mruby_result)));
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
}
-#define RLM_MRUBY_FUNC(foo) static rlm_rcode_t CC_HINT(nonnull) mod_##foo(module_ctx_t const *mctx, request_t *request) \
+#define RLM_MRUBY_FUNC(foo) static unlang_action_t CC_HINT(nonnull) mod_##foo(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) \
{ \
return do_mruby(request, \
(rlm_mruby_t const *)mctx->instance, \
/*
* Only used by rlm_mschap.c
*/
-rlm_rcode_t od_mschap_auth(request_t *request, fr_pair_t *challenge, fr_pair_t * usernamepair);
+unlang_action_t od_mschap_auth(rlm_rcode_t *p_result, request_t *request, fr_pair_t *challenge, fr_pair_t * usernamepair);
-static rlm_rcode_t getUserNodeRef(request_t *request, char* inUserName, char **outUserName,
- tDirNodeReference* userNodeRef, tDirReference dsRef)
+static unlang_action_t getUserNodeRef(rlm_rcode_t *p_result, request_t *request, char* inUserName, char **outUserName,
+ tDirNodeReference* userNodeRef, tDirReference dsRef)
{
tDataBuffer *tDataBuff = NULL;
tDirNodeReference nodeRef = 0;
if (!inUserName) {
REDEBUG("getUserNodeRef(): No username");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
tDataBuff = dsDataBufferAllocate(dsRef, 4096);
if (!tDataBuff) {
REDEBUG("Failed allocating buffer");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
do {
}
if (nodeRef != 0) dsCloseDirNode(nodeRef);
- return result;
+ RETURN_MODULE_RCODE(result);
}
-rlm_rcode_t od_mschap_auth(request_t *request, fr_pair_t *challenge, fr_pair_t * usernamepair)
+unlang_action_t od_mschap_auth(rlm_rcode_t *p_result, request_t *request, fr_pair_t *challenge, fr_pair_t * usernamepair)
{
rlm_rcode_t rcode = RLM_MODULE_OK;
tDirStatus status = eDSNoErr;
response = fr_pair_find_by_da(&request->request_pairs, attr_ms_chap2_response);
username_string = talloc_array(request, char, usernamepair->vp_length + 1);
- if (!username_string) return RLM_MODULE_FAIL;
+ if (!username_string) RETURN_MODULE_FAIL;
strlcpy(username_string, usernamepair->vp_strvalue, usernamepair->vp_length + 1);
if (status != eDSNoErr) {
talloc_free(username_string);
RERROR("Failed opening directory service");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
- rcode = getUserNodeRef(request, username_string, &short_user_name, &userNodeRef, dsRef);
+ getUserNodeRef(&rcode, request, username_string, &short_user_name, &userNodeRef, dsRef);
if (rcode != RLM_MODULE_OK) {
if (rcode != RLM_MODULE_NOOP) {
RDEBUG2("od_mschap_auth: getUserNodeRef() failed");
talloc_free(username_string);
if (dsRef != 0)
dsCloseDirService(dsRef);
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
/* We got a node; fill the stepBuffer
char *status_name = dsCopyDirStatusName(status);
RERROR("Authentication failed - status = %s", status_name);
free(status_name);
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
#endif /* __APPLE__ */
* authentication is in one place, and we can perhaps later replace
* it with code to call winbindd, or something similar.
*/
-static int CC_HINT(nonnull (1, 2, 4, 5, 6)) do_mschap(rlm_mschap_t const *inst, request_t *request,
+static int CC_HINT(nonnull (1, 2, 4, 5, 6)) do_mschap(rlm_mschap_t const *inst,
+ request_t *request,
fr_pair_t *password,
- uint8_t const *challenge, uint8_t const *response,
+ uint8_t const *challenge,
+ uint8_t const *response,
uint8_t nthashhash[static NT_DIGEST_LENGTH],
MSCHAP_AUTH_METHOD method)
{
*/
p = strcasestr(buffer, "0xC0000");
if (p) {
- int rcode = 0;
+ result = 0;
p += 7;
if (strcmp(p, "224") == 0) {
- rcode = -648;
+ result = -648;
} else if (strcmp(p, "234") == 0) {
- rcode = -647;
+ result = -647;
} else if (strcmp(p, "072") == 0) {
- rcode = -691;
+ result = -691;
} else if (strcasecmp(p, "05E") == 0) {
- rcode = -2;
+ result = -2;
}
- if (rcode != 0) {
+ if (result != 0) {
REDEBUG2("%s", buffer);
- return rcode;
+ return result;
}
/*
* it later. Add Auth-Type attribute if present in module
* configuration (usually Auth-Type must be "MS-CHAP")
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_mschap_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_mschap_t);
fr_pair_t *challenge = NULL;
challenge = fr_pair_find_by_da(&request->request_pairs, attr_ms_chap_challenge);
- if (!challenge) return RLM_MODULE_NOOP;
+ if (!challenge) RETURN_MODULE_NOOP;
if (!fr_pair_find_by_da(&request->request_pairs, attr_ms_chap_response) &&
!fr_pair_find_by_da(&request->request_pairs, attr_ms_chap2_response) &&
!fr_pair_find_by_da(&request->request_pairs, attr_ms_chap2_cpw)) {
RDEBUG2("Found MS-CHAP-Challenge, but no MS-CHAP response or Change-Password");
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
if (!inst->auth_type) {
WARN("No 'authenticate %s {...}' section or 'Auth-Type = %s' set. Cannot setup MS-CHAP authentication",
inst->name, inst->name);
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
- if (!module_section_type_set(request, attr_auth_type, inst->auth_type)) return RLM_MODULE_NOOP;
+ if (!module_section_type_set(request, attr_auth_type, inst->auth_type)) RETURN_MODULE_NOOP;
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
-static rlm_rcode_t mschap_error(rlm_mschap_t const *inst, request_t *request, unsigned char ident,
- int mschap_result, int mschap_version, fr_pair_t *smb_ctrl)
+static unlang_action_t mschap_error(rlm_rcode_t *p_result, rlm_mschap_t const *inst, request_t *request,
+ unsigned char ident, int mschap_result, int mschap_version, fr_pair_t *smb_ctrl)
{
rlm_rcode_t rcode = RLM_MODULE_OK;
int error = 0;
rcode = RLM_MODULE_REJECT;
}
- if (rcode == RLM_MODULE_OK) return RLM_MODULE_OK;
+ if (rcode == RLM_MODULE_OK) RETURN_MODULE_OK;
switch (mschap_version) {
case 1:
break;
default:
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
mschap_add_reply(request, ident, attr_ms_chap_error, buffer, strlen(buffer));
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
* mschap_cpw_request_process() - do the work to handle an MS-CHAP password
* change request.
*/
-static rlm_rcode_t CC_HINT(nonnull) mschap_process_cpw_request(rlm_mschap_t const *inst,
- request_t *request,
- fr_pair_t *cpw,
- fr_pair_t *nt_password)
+static unlang_action_t CC_HINT(nonnull) mschap_process_cpw_request(rlm_rcode_t *p_result,
+ rlm_mschap_t const *inst,
+ request_t *request,
+ fr_pair_t *cpw,
+ fr_pair_t *nt_password)
{
uint8_t new_nt_encrypted[516], old_nt_encrypted[NT_DIGEST_LENGTH];
fr_pair_t *nt_enc=NULL;
if (cpw->vp_length != 68) {
REDEBUG("MS-CHAP2-CPW has the wrong format: length %zu != 68", cpw->vp_length);
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
if (cpw->vp_octets[0] != 7) {
REDEBUG("MS-CHAP2-CPW has the wrong format: code %d != 7", cpw->vp_octets[0]);
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
if (nt_enc->vp_length < 4) {
REDEBUG("MS-CHAP-NT-Enc-PW with invalid format");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
if (nt_enc->vp_octets[0] != 6) {
REDEBUG("MS-CHAP-NT-Enc-PW with invalid format");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
if ((nt_enc->vp_octets[2] == 0) && (nt_enc->vp_octets[3] == seq)) {
if (!found) {
REDEBUG("Could not find MS-CHAP-NT-Enc-PW w/ sequence number %d", seq);
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
if ((new_nt_enc_len + nt_enc->vp_length - 4) > sizeof(new_nt_encrypted)) {
REDEBUG("Unpacked MS-CHAP-NT-Enc-PW length > 516");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
memcpy(new_nt_encrypted + new_nt_enc_len, nt_enc->vp_octets + 4, nt_enc->vp_length - 4);
if (new_nt_enc_len != 516) {
REDEBUG("Unpacked MS-CHAP-NT-Enc-PW length != 516");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
snprintf(buffer, sizeof(buffer), "E=709 R=0 M=Password change failed");
mschap_add_reply(request, cpw->vp_octets[1], attr_ms_chap_error, buffer, strlen(buffer));
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
}
RDEBUG2("Password change successful");
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
-static rlm_rcode_t CC_HINT(nonnull(1,2,3,4,7,8)) mschap_process_response(int *mschap_version,
- uint8_t nthashhash[static NT_DIGEST_LENGTH],
- rlm_mschap_t const *inst,
- request_t *request,
- fr_pair_t *smb_ctrl,
- fr_pair_t *nt_password,
- fr_pair_t *challenge,
- fr_pair_t *response,
- MSCHAP_AUTH_METHOD method)
+static CC_HINT(nonnull(1,2,3,4,5,8,9)) unlang_action_t mschap_process_response(rlm_rcode_t *p_result,
+ int *mschap_version,
+ uint8_t nthashhash[static NT_DIGEST_LENGTH],
+ rlm_mschap_t const *inst,
+ request_t *request,
+ fr_pair_t *smb_ctrl,
+ fr_pair_t *nt_password,
+ fr_pair_t *challenge,
+ fr_pair_t *response,
+ MSCHAP_AUTH_METHOD method)
{
int offset;
- int mschap_result;
+ rlm_rcode_t mschap_result;
*mschap_version = 1;
*/
if (challenge->vp_length < 8) {
REDEBUG("MS-CHAP-Challenge has the wrong format");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
*/
if (response->vp_length < 50) {
REDEBUG("MS-CHAP-Response has the wrong format");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
*/
if (!(response->vp_octets[1] & 0x01)) {
REDEBUG2("Client used unsupported method LM-Password");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
offset = 26;
*/
mschap_result = do_mschap(inst, request, nt_password, challenge->vp_octets,
response->vp_octets + offset, nthashhash, method);
+
/*
* Check for errors, and add MSCHAP-Error if necessary.
*/
- return mschap_error(inst, request, *response->vp_octets, mschap_result, *mschap_version, smb_ctrl);
+ return mschap_error(p_result, inst, request, *response->vp_octets, mschap_result, *mschap_version, smb_ctrl);
}
-static rlm_rcode_t CC_HINT(nonnull(1,2,3,4,7,8)) mschap_process_v2_response(int *mschap_version,
- uint8_t nthashhash[static NT_DIGEST_LENGTH],
- rlm_mschap_t const *inst,
- request_t *request,
- fr_pair_t *smb_ctrl,
- fr_pair_t *nt_password,
- fr_pair_t *challenge,
- fr_pair_t *response,
- MSCHAP_AUTH_METHOD method)
+static unlang_action_t CC_HINT(nonnull(1,2,3,4,5,8,9)) mschap_process_v2_response(rlm_rcode_t *p_result,
+ int *mschap_version,
+ uint8_t nthashhash[static NT_DIGEST_LENGTH],
+ rlm_mschap_t const *inst,
+ request_t *request,
+ fr_pair_t *smb_ctrl,
+ fr_pair_t *nt_password,
+ fr_pair_t *challenge,
+ fr_pair_t *response,
+ MSCHAP_AUTH_METHOD method)
{
uint8_t mschap_challenge[16];
fr_pair_t *user_name, *name_vp, *response_name, *peer_challenge_attr;
*/
if (challenge->vp_length < 16) {
REDEBUG("MS-CHAP-Challenge has the wrong format");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
*/
if (response->vp_length < 50) {
REDEBUG("MS-CHAP-Response has the wrong format");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
* We also require a User-Name
*/
user_name = mschap_identity_find(request);
- if (!user_name) return RLM_MODULE_FAIL;
+ if (!user_name) RETURN_MODULE_FAIL;
/*
* Check for MS-CHAP-User-Name and if found, use it
if (!nt_password && inst->open_directory) {
RDEBUG2("No NT-Password available. Trying OpenDirectory Authentication");
rcode = od_mschap_auth(request, challenge, user_name);
- if (rcode != RLM_MODULE_NOOP) return rcode;
+ if (rcode != RLM_MODULE_NOOP) RETURN_MODULE_RCODE(rcode);
}
#endif
peer_challenge = response->vp_octets + 2;
/*
* Check for errors, and add MSCHAP-Error if necessary.
*/
- rcode = mschap_error(inst, request, *response->vp_octets,
- mschap_result, *mschap_version, smb_ctrl);
- if (rcode != RLM_MODULE_OK) return rcode;
+ mschap_error(&rcode, inst, request, *response->vp_octets,
+ mschap_result, *mschap_version, smb_ctrl);
+ if (rcode != RLM_MODULE_OK) RETURN_MODULE_RCODE(rcode);
#ifdef WITH_AUTH_WINBIND
if (inst->wb_retry_with_normalised_username) {
msch2resp); /* calculated MPPE key */
mschap_add_reply(request, *response->vp_octets, attr_ms_chap2_success, msch2resp, 42);
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
/*
* MS-CHAP-Error for MS-CHAP or MS-CHAP v2
* If MS-CHAP2 succeeds we MUST return MS-CHAP2-Success
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_mschap_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_mschap_t);
fr_pair_t *challenge = NULL;
*/
if ((smb_ctrl->vp_uint32 & ACB_PWNOTREQ) != 0) {
RDEBUG2("SMB-Account-Ctrl says no password is required");
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
}
* input attribute, and we're calling out to an
* external password store.
*/
- if (nt_password_find(&ephemeral, &nt_password, mctx->instance, request) < 0) return RLM_MODULE_FAIL;
+ if (nt_password_find(&ephemeral, &nt_password, mctx->instance, request) < 0) RETURN_MODULE_FAIL;
/*
* Check to see if this is a change password request, and process
if (cpw) {
uint8_t *p;
- rcode = mschap_process_cpw_request(mctx->instance, request, cpw, nt_password);
+ mschap_process_cpw_request(&rcode, mctx->instance, request, cpw, nt_password);
if (rcode != RLM_MODULE_OK) goto finish;
/*
* We also require an MS-CHAP-Response.
*/
if ((response = fr_pair_find_by_da(&request->request_pairs, attr_ms_chap_response))) {
- rcode = mschap_process_response(&mschap_version, nthashhash,
- inst, request,
- smb_ctrl, nt_password,
- challenge, response,
- method);
+ mschap_process_response(&rcode,
+ &mschap_version, nthashhash,
+ inst, request,
+ smb_ctrl, nt_password,
+ challenge, response,
+ method);
if (rcode != RLM_MODULE_OK) goto finish;
} else if ((response = fr_pair_find_by_da(&request->request_pairs, attr_ms_chap2_response))) {
- rcode = mschap_process_v2_response(&mschap_version, nthashhash,
- inst, request,
- smb_ctrl, nt_password,
- challenge, response,
- method);
+ mschap_process_v2_response(&rcode,
+ &mschap_version, nthashhash,
+ inst, request,
+ smb_ctrl, nt_password,
+ challenge, response,
+ method);
if (rcode != RLM_MODULE_OK) goto finish;
} else { /* Neither CHAPv1 or CHAPv2 response: die */
REDEBUG("&control.Auth-Type = %s set for a request that does not contain &%s or &%s attributes",
finish:
if (ephemeral) talloc_list_free(&nt_password);
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
/*
* Check the users password against the standard UNIX
* password table.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(UNUSED module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authenticate(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request)
{
int ret;
long odResult = eDSAuthFailed;
*/
if (!username) {
REDEBUG("Attribute \"User-Name\" is required for authentication");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
if (!password) {
REDEBUG("Attribute \"User-Password\" is required for authentication");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
*/
if (password->vp_length == 0) {
REDEBUG("User-Password must not be empty");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
return ret;
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
/*
* member of the radius group?
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_opendirectory_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_opendirectory_t);
struct passwd *userdata = NULL;
username = fr_pair_find_by_da(&request->request_pairs, attr_user_name);
if (!username) {
RDEBUG2("OpenDirectory requires a User-Name attribute");
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
/* resolve SACL */
err = mbr_gid_to_uuid(gid, guid_sacl);
if (err != 0) {
REDEBUG("The group \"%s\" does not have a GUID", kRadiusSACLName);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
}
groupdata = getgrnam(rad_client->community);
if (!groupdata) {
REDEBUG("The group \"%s\" does not exist on this system", rad_client->community);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
err = mbr_gid_to_uuid(groupdata->gr_gid, guid_nasgroup);
if (err != 0) {
REDEBUG("The group \"%s\" does not have a GUID", rad_client->community);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
}
}
if (uuid_is_null(uuid)) {
REDEBUG("Could not get the user's uuid");
- return RLM_MODULE_NOTFOUND;
+ RETURN_MODULE_NOTFOUND;
}
if (!uuid_is_null(guid_sacl)) {
err = mbr_check_service_membership(uuid, kRadiusServiceName, &ismember);
if (err != 0) {
REDEBUG("Failed to check group membership");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
if (ismember == 0) {
REDEBUG("User is not authorized");
- return RLM_MODULE_DISALLOW;
+ RETURN_MODULE_DISALLOW;
}
}
err = mbr_check_membership_refresh(uuid, guid_nasgroup, &ismember);
if (err != 0) {
REDEBUG("Failed to check group membership");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
if (ismember == 0) {
REDEBUG("User is not authorized");
- return RLM_MODULE_DISALLOW;
+ RETURN_MODULE_DISALLOW;
}
}
if (!inst->auth_type) {
WARN("No 'authenticate %s {...}' section or 'Auth-Type = %s' set. Cannot setup OpenDirectory authentication",
inst->name, inst->name);
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
- if (!module_section_type_set(request, attr_auth_type, inst->auth_type)) return RLM_MODULE_NOOP;
+ if (!module_section_type_set(request, attr_auth_type, inst->auth_type)) RETURN_MODULE_NOOP;
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
static int mod_bootstrap(void *instance, CONF_SECTION *conf)
return 0;
}
-static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_pam_t const *data = talloc_get_type_abort_const(mctx->instance, rlm_pam_t);
int ret;
*/
if (!username) {
REDEBUG("Attribute \"User-Name\" is required for authentication");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
if (!password) {
REDEBUG("Attribute \"User-Password\" is required for authentication");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
*/
if (password->vp_length == 0) {
REDEBUG("User-Password must not be empty");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
if (pair) pam_auth_string = pair->vp_strvalue;
ret = do_pam(request, username->vp_strvalue, password->vp_strvalue, pam_auth_string);
- if (ret < 0) return RLM_MODULE_REJECT;
+ if (ret < 0) RETURN_MODULE_REJECT;
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
extern module_t rlm_pam;
bool normify;
} rlm_pap_t;
-typedef rlm_rcode_t (*pap_auth_func_t)(rlm_pap_t const *, request_t *, fr_pair_t const *, fr_pair_t const *);
+typedef unlang_action_t (*pap_auth_func_t)(rlm_rcode_t *p_result, rlm_pap_t const *inst, request_t *request, fr_pair_t const *, fr_pair_t const *);
static const CONF_PARSER module_config[] = {
{ FR_CONF_OFFSET("normalise", FR_TYPE_BOOL, rlm_pap_t, normify), .dflt = "yes" },
* This isn't strictly necessary, but it does make the
* server simpler to configure.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_pap_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_pap_t);
fr_pair_t *password;
if (fr_pair_find_by_da(&request->control_pairs, attr_auth_type) != NULL) {
RDEBUG3("Auth-Type is already set. Not setting 'Auth-Type := %s'", inst->name);
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
password = fr_pair_find_by_da(&request->request_pairs, attr_user_password);
if (!password) {
RDEBUG2("No %s attribute in the request. Cannot do PAP", attr_user_password->name);
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
if (!inst->auth_type) {
WARN("No 'authenticate %s {...}' section or 'Auth-Type = %s' set. Cannot setup PAP authentication.",
inst->name, inst->name);
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
- if (!module_section_type_set(request, attr_auth_type, inst->auth_type)) return RLM_MODULE_NOOP;
+ if (!module_section_type_set(request, attr_auth_type, inst->auth_type)) RETURN_MODULE_NOOP;
- return RLM_MODULE_UPDATED;
+ RETURN_MODULE_UPDATED;
}
/*
* PAP authentication functions
*/
-static rlm_rcode_t CC_HINT(nonnull) pap_auth_clear(UNUSED rlm_pap_t const *inst, request_t *request,
- fr_pair_t const *known_good, fr_pair_t const *password)
+static unlang_action_t CC_HINT(nonnull) pap_auth_clear(rlm_rcode_t *p_result,
+ UNUSED rlm_pap_t const *inst, request_t *request,
+ fr_pair_t const *known_good, fr_pair_t const *password)
{
if ((known_good->vp_length != password->vp_length) ||
(fr_digest_cmp(known_good->vp_octets, password->vp_octets, known_good->vp_length) != 0)) {
REDEBUG("Cleartext password does not match \"known good\" password");
REDEBUG3("Password : %pV", &password->data);
REDEBUG3("Expected : %pV", &known_good->data);
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
#ifdef HAVE_CRYPT
-static rlm_rcode_t CC_HINT(nonnull) pap_auth_crypt(UNUSED rlm_pap_t const *inst, request_t *request,
- fr_pair_t const *known_good, fr_pair_t const *password)
+static unlang_action_t CC_HINT(nonnull) pap_auth_crypt(rlm_rcode_t *p_result,
+ UNUSED rlm_pap_t const *inst, request_t *request,
+ fr_pair_t const *known_good, fr_pair_t const *password)
{
if (fr_crypt_check(password->vp_strvalue, known_good->vp_strvalue) != 0) {
REDEBUG("Crypt digest does not match \"known good\" digest");
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
#endif
-static rlm_rcode_t CC_HINT(nonnull) pap_auth_md5(UNUSED rlm_pap_t const *inst, request_t *request,
- fr_pair_t const *known_good, fr_pair_t const *password)
+static unlang_action_t CC_HINT(nonnull) pap_auth_md5(rlm_rcode_t *p_result,
+ UNUSED rlm_pap_t const *inst, request_t *request,
+ fr_pair_t const *known_good, fr_pair_t const *password)
{
uint8_t digest[MD5_DIGEST_LENGTH];
if (known_good->vp_length != MD5_DIGEST_LENGTH) {
REDEBUG("\"known-good\" MD5 password has incorrect length, expected 16 got %zu", known_good->vp_length);
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
fr_md5_calc(digest, password->vp_octets, password->vp_length);
REDEBUG3("Password : %pV", &password->data);
REDEBUG3("Calculated : %pH", fr_box_octets(digest, MD5_DIGEST_LENGTH));
REDEBUG3("Expected : %pH", fr_box_octets(known_good->vp_octets, MD5_DIGEST_LENGTH));
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
-static rlm_rcode_t CC_HINT(nonnull) pap_auth_smd5(UNUSED rlm_pap_t const *inst, request_t *request,
- fr_pair_t const *known_good, fr_pair_t const *password)
+static unlang_action_t CC_HINT(nonnull) pap_auth_smd5(rlm_rcode_t *p_result,
+ UNUSED rlm_pap_t const *inst, request_t *request,
+ fr_pair_t const *known_good, fr_pair_t const *password)
{
fr_md5_ctx_t *md5_ctx;
uint8_t digest[MD5_DIGEST_LENGTH];
if (known_good->vp_length <= MD5_DIGEST_LENGTH) {
REDEBUG("\"known-good\" SMD5-Password has incorrect length, expected 16 got %zu", known_good->vp_length);
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
md5_ctx = fr_md5_ctx_alloc(true);
REDEBUG3("Password : %pV", &password->data);
REDEBUG3("Calculated : %pH", fr_box_octets(digest, MD5_DIGEST_LENGTH));
REDEBUG3("Expected : %pH", fr_box_octets(known_good->vp_octets, MD5_DIGEST_LENGTH));
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
-static rlm_rcode_t CC_HINT(nonnull) pap_auth_sha1(UNUSED rlm_pap_t const *inst, request_t *request,
- fr_pair_t const *known_good, fr_pair_t const *password)
+static unlang_action_t CC_HINT(nonnull) pap_auth_sha1(rlm_rcode_t *p_result,
+ UNUSED rlm_pap_t const *inst, request_t *request,
+ fr_pair_t const *known_good, fr_pair_t const *password)
{
fr_sha1_ctx sha1_context;
uint8_t digest[SHA1_DIGEST_LENGTH];
if (known_good->vp_length != SHA1_DIGEST_LENGTH) {
REDEBUG("\"known-good\" SHA1-password has incorrect length, expected 20 got %zu", known_good->vp_length);
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
fr_sha1_init(&sha1_context);
REDEBUG3("Password : %pV", &password->data);
REDEBUG3("Calculated : %pH", fr_box_octets(digest, SHA1_DIGEST_LENGTH));
REDEBUG3("Expected : %pH", fr_box_octets(known_good->vp_octets, SHA1_DIGEST_LENGTH));
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
-static rlm_rcode_t CC_HINT(nonnull) pap_auth_ssha1(UNUSED rlm_pap_t const *inst, request_t *request,
- fr_pair_t const *known_good, fr_pair_t const *password)
+static unlang_action_t CC_HINT(nonnull) pap_auth_ssha1(rlm_rcode_t *p_result,
+ UNUSED rlm_pap_t const *inst, request_t *request,
+ fr_pair_t const *known_good, fr_pair_t const *password)
{
fr_sha1_ctx sha1_context;
uint8_t digest[SHA1_DIGEST_LENGTH];
if (known_good->vp_length <= SHA1_DIGEST_LENGTH) {
REDEBUG("\"known-good\" SSHA-Password has incorrect length, expected > 20 got %zu", known_good->vp_length);
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
fr_sha1_init(&sha1_context);
known_good->vp_length - SHA1_DIGEST_LENGTH));
REDEBUG3("Calculated : %pH", fr_box_octets(digest, SHA1_DIGEST_LENGTH));
REDEBUG3("Expected : %pH", fr_box_octets(known_good->vp_octets, SHA1_DIGEST_LENGTH));
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
#ifdef HAVE_OPENSSL_EVP_H
-static rlm_rcode_t CC_HINT(nonnull) pap_auth_evp_md(UNUSED rlm_pap_t const *inst, request_t *request,
- fr_pair_t const *known_good, fr_pair_t const *password,
- char const *name, EVP_MD const *md)
+static unlang_action_t CC_HINT(nonnull) pap_auth_evp_md(rlm_rcode_t *p_result,
+ UNUSED rlm_pap_t const *inst, request_t *request,
+ fr_pair_t const *known_good, fr_pair_t const *password,
+ char const *name, EVP_MD const *md)
{
EVP_MD_CTX *ctx;
uint8_t digest[EVP_MAX_MD_SIZE];
REDEBUG3("Password : %pV", &password->data);
REDEBUG3("Calculated : %pH", fr_box_octets(digest, digest_len));
REDEBUG3("Expected : %pH", &known_good->data);
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
-static rlm_rcode_t CC_HINT(nonnull) pap_auth_evp_md_salted(UNUSED rlm_pap_t const *inst, request_t *request,
- fr_pair_t const *known_good, fr_pair_t const *password,
- char const *name, EVP_MD const *md)
+static unlang_action_t CC_HINT(nonnull) pap_auth_evp_md_salted(rlm_rcode_t *p_result,
+ UNUSED rlm_pap_t const *inst, request_t *request,
+ fr_pair_t const *known_good, fr_pair_t const *password,
+ char const *name, EVP_MD const *md)
{
EVP_MD_CTX *ctx;
uint8_t digest[EVP_MAX_MD_SIZE];
fr_box_octets(known_good->vp_octets + digest_len, known_good->vp_length - digest_len));
REDEBUG3("Calculated : %pH", fr_box_octets(digest, digest_len));
REDEBUG3("Expected : %pH", fr_box_octets(known_good->vp_octets, digest_len));
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
/** Define a new OpenSSL EVP based password hashing function
*
*/
#define PAP_AUTH_EVP_MD(_func, _new_func, _name, _md) \
-static rlm_rcode_t CC_HINT(nonnull) _new_func(rlm_pap_t const *inst, request_t *request, \
- fr_pair_t const *known_good, fr_pair_t const *password) \
-{ \
- return _func(inst, request, known_good, password, _name, _md); \
+static unlang_action_t CC_HINT(nonnull) _new_func(rlm_rcode_t *p_result, \
+ rlm_pap_t const *inst, request_t *request, \
+ fr_pair_t const *known_good, fr_pair_t const *password) \
+{ \
+ return _func(p_result, inst, request, known_good, password, _name, _md); \
}
PAP_AUTH_EVP_MD(pap_auth_evp_md, pap_auth_sha2_224, "SHA2-224", EVP_sha224())
/** Validates Crypt::PBKDF2 LDAP format strings
*
+ * @param[out] p_result The result of comparing the pbkdf2 hash with the password.
* @param[in] request The current request.
* @param[in] str Raw PBKDF2 string.
* @param[in] len Length of string.
* - RLM_MODULE_REJECT
* - RLM_MODULE_OK
*/
-static inline rlm_rcode_t CC_HINT(nonnull) pap_auth_pbkdf2_parse(request_t *request, const uint8_t *str, size_t len,
- fr_table_num_sorted_t const hash_names[], size_t hash_names_len,
- char scheme_sep, char iter_sep, char salt_sep,
- bool iter_is_base64, fr_pair_t const *password)
+static inline CC_HINT(nonnull) unlang_action_t pap_auth_pbkdf2_parse(rlm_rcode_t *p_result,
+ request_t *request, const uint8_t *str, size_t len,
+ fr_table_num_sorted_t const hash_names[], size_t hash_names_len,
+ char scheme_sep, char iter_sep, char salt_sep,
+ bool iter_is_base64, fr_pair_t const *password)
{
rlm_rcode_t rcode = RLM_MODULE_INVALID;
finish:
talloc_free(salt);
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
-static inline rlm_rcode_t CC_HINT(nonnull) pap_auth_pbkdf2(UNUSED rlm_pap_t const *inst,
- request_t *request,
- fr_pair_t const *known_good, fr_pair_t const *password)
+static inline unlang_action_t CC_HINT(nonnull) pap_auth_pbkdf2(rlm_rcode_t *p_result,
+ UNUSED rlm_pap_t const *inst,
+ request_t *request,
+ fr_pair_t const *known_good, fr_pair_t const *password)
{
uint8_t const *p = known_good->vp_octets, *q, *end = p + known_good->vp_length;
if (end - p < 2) {
REDEBUG("PBKDF2-Password too short");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
q = memchr(p, '}', end - p);
p = q + 1;
}
- return pap_auth_pbkdf2_parse(request, p, end - p,
+ return pap_auth_pbkdf2_parse(p_result, request, p, end - p,
pbkdf2_crypt_names, pbkdf2_crypt_names_len,
':', ':', ':', true, password);
}
*/
if ((size_t)(end - p) >= sizeof("$PBKDF2$") && (memcmp(p, "$PBKDF2$", sizeof("$PBKDF2$") - 1) == 0)) {
p += sizeof("$PBKDF2$") - 1;
- return pap_auth_pbkdf2_parse(request, p, end - p,
+ return pap_auth_pbkdf2_parse(p_result, request, p, end - p,
pbkdf2_crypt_names, pbkdf2_crypt_names_len,
':', ':', '$', false, password);
}
*/
if ((size_t)(end - p) >= sizeof("$pbkdf2-") && (memcmp(p, "$pbkdf2-", sizeof("$pbkdf2-") - 1) == 0)) {
p += sizeof("$pbkdf2-") - 1;
- return pap_auth_pbkdf2_parse(request, p, end - p,
+ return pap_auth_pbkdf2_parse(p_result, request, p, end - p,
pbkdf2_passlib_names, pbkdf2_passlib_names_len,
'$', '$', '$', false, password);
}
REDEBUG("Can't determine format of PBKDF2-Password");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
#endif
-static rlm_rcode_t CC_HINT(nonnull) pap_auth_nt(UNUSED rlm_pap_t const *inst, request_t *request,
- fr_pair_t const *known_good, fr_pair_t const *password)
+static unlang_action_t CC_HINT(nonnull) pap_auth_nt(rlm_rcode_t *p_result,
+ UNUSED rlm_pap_t const *inst, request_t *request,
+ fr_pair_t const *known_good, fr_pair_t const *password)
{
ssize_t len;
uint8_t digest[MD4_DIGEST_LENGTH];
if (known_good->vp_length != MD4_DIGEST_LENGTH) {
REDEBUG("\"known good\" NT-Password has incorrect length, expected 16 got %zu", known_good->vp_length);
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
len = fr_utf8_to_ucs2(ucs2_password, sizeof(ucs2_password),
password->vp_strvalue, password->vp_length);
if (len < 0) {
REDEBUG("User-Password is not in UCS2 format");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
fr_md4_calc(digest, (uint8_t *)ucs2_password, len);
REDEBUG("NT digest does not match \"known good\" digest");
REDEBUG3("Calculated : %pH", fr_box_octets(digest, sizeof(digest)));
REDEBUG3("Expected : %pH", &known_good->data);
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
-static rlm_rcode_t CC_HINT(nonnull) pap_auth_lm(UNUSED rlm_pap_t const *inst, request_t *request,
- fr_pair_t const *known_good, UNUSED fr_pair_t const *password)
+static unlang_action_t CC_HINT(nonnull) pap_auth_lm(rlm_rcode_t *p_result,
+ UNUSED rlm_pap_t const *inst, request_t *request,
+ fr_pair_t const *known_good, UNUSED fr_pair_t const *password)
{
uint8_t digest[MD4_DIGEST_LENGTH];
char charbuf[32 + 1];
if (known_good->vp_length != MD4_DIGEST_LENGTH) {
REDEBUG("\"known good\" LM-Password has incorrect length, expected 16 got %zu", known_good->vp_length);
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
len = xlat_eval(charbuf, sizeof(charbuf), request, "%{mschap:LM-Hash %{User-Password}}", NULL, NULL);
- if (len < 0) return RLM_MODULE_FAIL;
+ if (len < 0) RETURN_MODULE_FAIL;
if ((fr_hex2bin(NULL, &FR_DBUFF_TMP(digest, sizeof(digest)), &FR_SBUFF_IN(charbuf, len), false) !=
(ssize_t)known_good->vp_length) ||
REDEBUG("LM digest does not match \"known good\" digest");
REDEBUG3("Calculated : %pH", fr_box_octets(digest, sizeof(digest)));
REDEBUG3("Expected : %pH", &known_good->data);
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
-static rlm_rcode_t CC_HINT(nonnull) pap_auth_ns_mta_md5(UNUSED rlm_pap_t const *inst, request_t *request,
- fr_pair_t const *known_good, fr_pair_t const *password)
+static unlang_action_t CC_HINT(nonnull) pap_auth_ns_mta_md5(rlm_rcode_t *p_result,
+ UNUSED rlm_pap_t const *inst, request_t *request,
+ fr_pair_t const *known_good, fr_pair_t const *password)
{
uint8_t digest[128];
uint8_t buff[FR_MAX_STRING_LEN];
if (known_good->vp_length != 64) {
REDEBUG("\"known good\" NS-MTA-MD5-Password has incorrect length, expected 64 got %zu",
known_good->vp_length);
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
if (fr_hex2bin(NULL, &FR_DBUFF_TMP(digest, sizeof(digest)),
&FR_SBUFF_IN(known_good->vp_strvalue, known_good->vp_length), false) != 16) {
REDEBUG("\"known good\" NS-MTA-MD5-Password has invalid value");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
*/
if (password->vp_length >= (sizeof(buff) - 2 - 2 * 32)) {
REDEBUG("\"known good\" NS-MTA-MD5-Password is too long");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
if (fr_digest_cmp(digest, buff, 16) != 0) {
REDEBUG("NS-MTA-MD5 digest does not match \"known good\" digest");
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
/** Auth func for password types that should have been normalised away
*
*/
-static rlm_rcode_t CC_HINT(nonnull) pap_auth_dummy(UNUSED rlm_pap_t const *inst, UNUSED request_t *request,
- UNUSED fr_pair_t const *known_good, UNUSED fr_pair_t const *password)
+static unlang_action_t CC_HINT(nonnull) pap_auth_dummy(rlm_rcode_t *p_result,
+ UNUSED rlm_pap_t const *inst, UNUSED request_t *request,
+ UNUSED fr_pair_t const *known_good, UNUSED fr_pair_t const *password)
{
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/** Table of password types we can process
/*
* Authenticate the user via one of any well-known password.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_pap_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_pap_t);
fr_pair_t *known_good;
password = fr_pair_find_by_da(&request->request_pairs, attr_user_password);
if (!password) {
REDEBUG("You set 'Auth-Type = PAP' for a request that does not contain a User-Password attribute!");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
*/
if (password->vp_length == 0) {
REDEBUG("Password must not be empty");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
if (RDEBUG_ENABLED3) {
inst->normify);
if (!known_good) {
REDEBUG("No \"known good\" password found for user");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
fr_assert(known_good->da->attr < NUM_ELEMENTS(auth_func_table));
/*
* Authenticate, and return.
*/
- rcode = auth_func(inst, request, known_good, password);
+ auth_func(&rcode, inst, request, known_good, password);
if (ephemeral) talloc_list_free(&known_good);
switch (rcode) {
case RLM_MODULE_REJECT:
break;
}
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
static int mod_bootstrap(void *instance, CONF_SECTION *conf)
}
}
-static rlm_rcode_t CC_HINT(nonnull) mod_passwd_map(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_passwd_map(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_passwd_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_passwd_t);
int found = 0;
key = fr_pair_find_by_da(&request->request_pairs, inst->keyattr);
- if (!key) return RLM_MODULE_NOTFOUND;
+ if (!key) RETURN_MODULE_NOTFOUND;
for (i = fr_cursor_iter_by_da_init(&cursor, &key, inst->keyattr);
i;
if (!inst->allow_multiple) break;
}
- if (!found) return RLM_MODULE_NOTFOUND;
+ if (!found) RETURN_MODULE_NOTFOUND;
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
extern module_t rlm_passwd;
* Store all vps in hashes %RAD_CONFIG %RAD_REPLY %RAD_REQUEST
*
*/
-static int do_perl(void *instance, request_t *request, char const *function_name)
+static unlang_action_t do_perl(rlm_rcode_t *p_result, void *instance, request_t *request, char const *function_name)
{
rlm_perl_t *inst = instance;
* Radius has told us to call this function, but none
* is defined.
*/
- if (!function_name) return RLM_MODULE_FAIL;
+ if (!function_name) RETURN_MODULE_FAIL;
#ifdef USE_ITHREADS
pthread_mutex_lock(&inst->clone_mutex);
vp = NULL;
}
}
- return exitstatus;
+ RETURN_MODULE_RCODE(exitstatus);
}
#define RLM_PERL_FUNC(_x) \
-static rlm_rcode_t CC_HINT(nonnull) mod_##_x(module_ctx_t const *mctx, request_t *request) \
+static unlang_action_t CC_HINT(nonnull) mod_##_x(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) \
{ \
rlm_perl_t *inst = talloc_get_type_abort(mctx->instance, rlm_perl_t); \
- return do_perl(inst, request, inst->func_##_x); \
+ return do_perl(p_result, inst, request, inst->func_##_x); \
}
RLM_PERL_FUNC(authorize)
/*
* Write accounting information to this modules database.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_accounting(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_perl_t *inst = talloc_get_type_abort(mctx->instance, rlm_perl_t);
fr_pair_t *pair;
acct_status_type = pair->vp_uint32;
} else {
REDEBUG("Invalid Accounting Packet");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
switch (acct_status_type) {
case FR_STATUS_START:
if (inst->func_start_accounting) {
- return do_perl(inst, request, inst->func_start_accounting);
+ return do_perl(p_result, inst, request, inst->func_start_accounting);
} else {
- return do_perl(inst, request, inst->func_accounting);
+ return do_perl(p_result, inst, request, inst->func_accounting);
}
case FR_STATUS_STOP:
if (inst->func_stop_accounting) {
- return do_perl(inst, request, inst->func_stop_accounting);
+ return do_perl(p_result, inst, request, inst->func_stop_accounting);
} else {
- return do_perl(inst, request, inst->func_accounting);
+ return do_perl(p_result, inst, request, inst->func_accounting);
}
default:
- return do_perl(inst, request, inst->func_accounting);
+ return do_perl(p_result, inst, request, inst->func_accounting);
}
}
return 0;
}
-static rlm_rcode_t do_python_single(rlm_python_t const *inst, request_t *request, PyObject *p_func, char const *funcname)
+static unlang_action_t do_python_single(rlm_rcode_t *p_result,
+ rlm_python_t const *inst, request_t *request, PyObject *p_func, char const *funcname)
{
fr_cursor_t cursor;
fr_pair_t *vp;
Py_XDECREF(p_arg);
Py_XDECREF(p_ret);
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
/** Thread safe call to a python function
*
* Will swap in thread state specific to module/thread.
*/
-static rlm_rcode_t do_python(rlm_python_t const *inst, rlm_python_thread_t *this_thread,
- request_t *request, PyObject *p_func, char const *funcname)
+static unlang_action_t do_python(rlm_rcode_t *p_result, rlm_python_t const *inst, rlm_python_thread_t *this_thread,
+ request_t *request, PyObject *p_func, char const *funcname)
{
rlm_rcode_t rcode;
/*
* It's a NOOP if the function wasn't defined
*/
- if (!p_func) return RLM_MODULE_NOOP;
+ if (!p_func) RETURN_MODULE_NOOP;
RDEBUG3("Using thread state %p/%p", inst, this_thread->state);
PyEval_RestoreThread(this_thread->state); /* Swap in our local thread state */
- rcode = do_python_single(inst, request, p_func, funcname);
+ do_python_single(&rcode, inst, request, p_func, funcname);
(void)fr_cond_assert(PyEval_SaveThread() == this_thread->state);
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
#define MOD_FUNC(x) \
-static rlm_rcode_t CC_HINT(nonnull) mod_##x(module_ctx_t const *mctx, request_t *request) \
+static unlang_action_t CC_HINT(nonnull) mod_##x(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) \
{ \
rlm_python_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_python_t); \
rlm_python_thread_t *thread = talloc_get_type_abort(mctx->thread, rlm_python_thread_t); \
- return do_python(inst, thread, request, inst->x.function, #x);\
+ return do_python(p_result, inst, thread, request, inst->x.function, #x);\
}
MOD_FUNC(authenticate)
if (inst->instantiate.function) {
rlm_rcode_t rcode;
- rcode = do_python_single(inst, NULL, inst->instantiate.function, "instantiate");
+ do_python_single(&rcode, inst, NULL, inst->instantiate.function, "instantiate");
switch (rcode) {
case RLM_MODULE_FAIL:
case RLM_MODULE_REJECT:
/*
* We don't care if this fails.
*/
- if (inst->detach.function) (void)do_python_single(inst, NULL, inst->detach.function, "detach");
+ if (inst->detach.function) {
+ rlm_rcode_t rcode;
+
+ (void)do_python_single(&rcode, inst, NULL, inst->detach.function, "detach");
+ }
#define PYTHON_FUNC_DESTROY(_x) python_function_destroy(&inst->_x)
PYTHON_FUNC_DESTROY(instantiate);
/** Continue after unlang_interpret_resumable()
*
*/
-static rlm_rcode_t mod_radius_resume(module_ctx_t const *mctx, request_t *request, void *ctx)
+static unlang_action_t mod_radius_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, void *ctx)
{
rlm_radius_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_radius_t);
rlm_radius_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_radius_thread_t);
- return inst->io->resume(&(module_ctx_t){.instance = inst->io_instance, .thread = t->io_thread }, request, ctx);
+ return inst->io->resume(p_result, &(module_ctx_t){.instance = inst->io_instance, .thread = t->io_thread }, request, ctx);
}
/** Do any RADIUS-layer fixups for proxying.
/** Send packets outbound.
*
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_process(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_radius_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_radius_t);
rlm_radius_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_radius_thread_t);
if (!request->packet->code) {
REDEBUG("You MUST specify a packet code");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/*
*/
if (request->packet->code == FR_CODE_STATUS_SERVER) {
REDEBUG("Cannot proxy Status-Server packets");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
if ((request->packet->code >= FR_RADIUS_MAX_PACKET_CODE) ||
!inst->retry[request->packet->code].irt) { /* can't be zero */
REDEBUG("Invalid packet code %d", request->packet->code);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
if (!inst->allowed[request->packet->code]) {
REDEBUG("Packet code %s is disallowed by the configuration",
fr_packet_codes[request->packet->code]);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
if (request->client->dynamic && !request->client->active) {
REDEBUG("Cannot proxy packets which define dynamic clients");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/*
* return another code which indicates what happened to
* the request...b
*/
- rcode = inst->io->enqueue(&rctx, inst->io_instance, t->io_thread, request);
+ inst->io->enqueue(&rcode, &rctx, inst->io_instance, t->io_thread, request);
if (rcode != RLM_MODULE_YIELD) {
fr_assert(rctx == NULL);
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
return unlang_module_yield(request, mod_radius_resume, mod_radius_signal, rctx);
/** Enqueue a request_t to an IO submodule
*
*/
-typedef rlm_rcode_t (*rlm_radius_io_enqueue_t)(void **rctx, void *instance, void *thread, request_t *request);
+typedef unlang_action_t (*rlm_radius_io_enqueue_t)(rlm_rcode_t *p_result, void **rctx, void *instance, void *thread, request_t *request);
/** Public structure describing an I/O path for an outgoing socket.
*
{
udp_request_t const *a = one;
udp_request_t const *b = two;
- int8_t rcode;
+ int8_t ret;
// @todo - prioritize packets if there's a state?
/*
* Prioritise status check packets
*/
- rcode = (b->status_check - a->status_check);;
- if (rcode != 0) return rcode;
+ ret = (b->status_check - a->status_check);;
+ if (ret != 0) return ret;
/*
* Larger priority is more important.
*/
- rcode = (a->priority < b->priority) - (a->priority > b->priority);
- if (rcode != 0) return rcode;
+ ret = (a->priority < b->priority) - (a->priority > b->priority);
+ if (ret != 0) return ret;
/*
* Smaller timestamp (i.e. earlier) is more important.
/** Resume execution of the request, returning the rcode set during trunk execution
*
*/
-static rlm_rcode_t mod_resume(UNUSED module_ctx_t const *mctx, UNUSED request_t *request, void *rctx)
+static unlang_action_t mod_resume(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, UNUSED request_t *request, void *rctx)
{
udp_result_t *r = talloc_get_type_abort(rctx, udp_result_t);
rlm_rcode_t rcode = r->rcode;
talloc_free(rctx);
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
static void mod_signal(module_ctx_t const *mctx, UNUSED request_t *request,
return 0;
}
-static rlm_rcode_t mod_enqueue(void **rctx_out, void *instance, void *thread, request_t *request)
+static unlang_action_t mod_enqueue(rlm_rcode_t *p_result, void **rctx_out, void *instance, void *thread, request_t *request)
{
rlm_radius_udp_t *inst = talloc_get_type_abort(instance, rlm_radius_udp_t);
udp_thread_t *t = talloc_get_type_abort(thread, udp_thread_t);
if (request->packet->code == FR_CODE_STATUS_SERVER) {
RWDEBUG("Status-Server is reserved for internal use, and cannot be sent manually.");
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
treq = fr_trunk_request_alloc(t->trunk, request);
- if (!treq) return RLM_MODULE_FAIL;
+ if (!treq) RETURN_MODULE_FAIL;
MEM(r = talloc_zero(request, udp_result_t));
MEM(u = talloc(treq, udp_request_t));
fr_assert(!u->rr && !u->packet); /* Should not have been fed to the muxer */
fr_trunk_request_free(&treq); /* Return to the free list */
talloc_free(r);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
r->treq = treq; /* Remember for signalling purposes */
*rctx_out = r;
- return RLM_MODULE_YIELD;
+ return UNLANG_ACTION_YIELD;
}
/** Instantiate thread data for the submodule.
/*
* Zap all users on a NAS from the radutmp file.
*/
-static rlm_rcode_t radutmp_zap(request_t *request, char const *filename, uint32_t nasaddr, time_t t)
+static unlang_action_t radutmp_zap(rlm_rcode_t *p_result, request_t *request, char const *filename, uint32_t nasaddr, time_t t)
{
struct radutmp u;
int fd;
fd = open(filename, O_RDWR);
if (fd < 0) {
REDEBUG("Error accessing file %s: %s", filename, fr_syserror(errno));
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/*
if (rad_lockfd(fd, LOCK_LEN) < 0) {
REDEBUG("Failed to acquire lock on file %s: %s", filename, fr_syserror(errno));
close(fd);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/*
REDEBUG("Failed writing: %s", fr_syserror(errno));
close(fd);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
}
close(fd); /* and implicitely release the locks */
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
/*
/*
* Store logins in the RADIUS utmp file.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_accounting(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_radutmp_t *inst = talloc_get_type_abort(mctx->instance, rlm_radutmp_t);
rlm_rcode_t rcode = RLM_MODULE_OK;
if (request->packet->socket.inet.src_ipaddr.af != AF_INET) {
RDEBUG2("IPv6 not supported!");
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
/*
*/
if ((vp = fr_pair_find_by_da(&request->request_pairs, attr_acct_status_type)) == NULL) {
RDEBUG2("No Accounting-Status-Type record");
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
status = vp->vp_uint32;
*/
filename = NULL;
if (xlat_aeval(request, &filename, request, inst->filename, NULL, NULL) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/*
*/
if (status == FR_STATUS_ACCOUNTING_ON && (ut.nas_address != htonl(INADDR_NONE))) {
RIDEBUG("NAS %s restarted (Accounting-On packet seen)", nas);
- rcode = radutmp_zap(request, filename, ut.nas_address, ut.time);
+ radutmp_zap(&rcode, request, filename, ut.nas_address, ut.time);
goto finish;
}
if (status == FR_STATUS_ACCOUNTING_OFF && (ut.nas_address != htonl(INADDR_NONE))) {
RIDEBUG("NAS %s rebooted (Accounting-Off packet seen)", nas);
- rcode = radutmp_zap(request, filename, ut.nas_address, ut.time);
+ radutmp_zap(&rcode, request, filename, ut.nas_address, ut.time);
goto finish;
}
close(fd); /* and implicitely release the locks */
}
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
/* globally exported name */
return slen;
}
-static rlm_rcode_t mod_action(rlm_redis_ippool_t const *inst, request_t *request, ippool_action_t action)
+static unlang_action_t mod_action(rlm_rcode_t *p_result, rlm_redis_ippool_t const *inst, request_t *request, ippool_action_t action)
{
uint8_t key_prefix_buff[IPPOOL_MAX_KEY_PREFIX_SIZE], owner_buff[256], gateway_id_buff[256];
uint8_t const *key_prefix, *owner = NULL, *gateway_id = NULL;
char *q;
slen = ippool_pool_name(&key_prefix, (uint8_t *)&key_prefix_buff, sizeof(key_prefix_len), inst, request);
- if (slen < 0) return RLM_MODULE_FAIL;
- if (slen == 0) return RLM_MODULE_NOOP;
+ if (slen < 0) RETURN_MODULE_FAIL;
+ if (slen == 0) RETURN_MODULE_NOOP;
key_prefix_len = (size_t)slen;
request, inst->owner, NULL, NULL);
if (slen < 0) {
REDEBUG("Failed expanding device (%s)", inst->owner->name);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
owner_len = (size_t)slen;
}
request, inst->gateway_id, NULL, NULL);
if (slen < 0) {
REDEBUG("Failed expanding gateway (%s)", inst->gateway_id->name);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
gateway_id_len = (size_t)slen;
}
if (tmpl_expand(&expires_str, expires_buff, sizeof(expires_buff),
request, inst->offer_time, NULL, NULL) < 0) {
REDEBUG("Failed expanding offer_time (%s)", inst->offer_time->name);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
expires = strtoul(expires_str, &q, 10);
if (q != (expires_str + strlen(expires_str))) {
REDEBUG("Invalid offer_time. Must be an integer value");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
ippool_action_print(request, action, L_DBG_LVL_2, key_prefix, key_prefix_len, NULL,
gateway_id, gateway_id_len, (uint32_t)expires)) {
case IPPOOL_RCODE_SUCCESS:
RDEBUG2("IP address lease allocated");
- return RLM_MODULE_UPDATED;
+ RETURN_MODULE_UPDATED;
case IPPOOL_RCODE_POOL_EMPTY:
RWDEBUG("Pool contains no free addresses");
- return RLM_MODULE_NOTFOUND;
+ RETURN_MODULE_NOTFOUND;
default:
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
case POOL_ACTION_UPDATE:
if (tmpl_expand(&expires_str, expires_buff, sizeof(expires_buff),
request, inst->lease_time, NULL, NULL) < 0) {
REDEBUG("Failed expanding lease_time (%s)", inst->lease_time->name);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
expires = strtoul(expires_str, &q, 10);
if (q != (expires_str + strlen(expires_str))) {
REDEBUG("Invalid expires. Must be an integer value");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
if (tmpl_expand(&ip_str, ip_buff, sizeof(ip_buff), request, inst->requested_address, NULL, NULL) < 0) {
REDEBUG("Failed expanding requested_address (%s)", inst->requested_address->name);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
if (fr_inet_pton(&ip, ip_str, -1, AF_UNSPEC, false, true) < 0) {
RPEDEBUG("Failed parsing address");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
ippool_action_print(request, action, L_DBG_LVL_2, key_prefix, key_prefix_len,
fr_value_box_strdup_shallow(&ip_rhs.data.literal, NULL, ip_str, false);
- if (map_to_request(request, &ip_map, map_to_vp, NULL) < 0) return RLM_MODULE_FAIL;
+ if (map_to_request(request, &ip_map, map_to_vp, NULL) < 0) RETURN_MODULE_FAIL;
}
- return RLM_MODULE_UPDATED;
+ RETURN_MODULE_UPDATED;
/*
* It's useful to be able to identify the 'not found' case
*/
case IPPOOL_RCODE_NOT_FOUND:
REDEBUG("Requested IP address \"%s\" is not a member of the specified pool", ip_str);
- return RLM_MODULE_NOTFOUND;
+ RETURN_MODULE_NOTFOUND;
case IPPOOL_RCODE_EXPIRED:
REDEBUG("Requested IP address' \"%s\" lease already expired at time of renewal", ip_str);
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
case IPPOOL_RCODE_DEVICE_MISMATCH:
REDEBUG("Requested IP address' \"%s\" lease allocated to another device", ip_str);
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
default:
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
}
if (tmpl_expand(&ip_str, ip_buff, sizeof(ip_buff), request, inst->requested_address, NULL, NULL) < 0) {
REDEBUG("Failed expanding requested_address (%s)", inst->requested_address->name);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
if (fr_inet_pton(&ip, ip_str, -1, AF_UNSPEC, false, true) < 0) {
RPEDEBUG("Failed parsing address");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
ippool_action_print(request, action, L_DBG_LVL_2, key_prefix, key_prefix_len,
&ip, owner, owner_len)) {
case IPPOOL_RCODE_SUCCESS:
RDEBUG2("IP address \"%s\" released", ip_str);
- return RLM_MODULE_UPDATED;
+ RETURN_MODULE_UPDATED;
/*
* It's useful to be able to identify the 'not found' case
*/
case IPPOOL_RCODE_NOT_FOUND:
REDEBUG("Requested IP address \"%s\" is not a member of the specified pool", ip_str);
- return RLM_MODULE_NOTFOUND;
+ RETURN_MODULE_NOTFOUND;
case IPPOOL_RCODE_DEVICE_MISMATCH:
REDEBUG("Requested IP address' \"%s\" lease allocated to another device", ip_str);
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
default:
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
}
case POOL_ACTION_BULK_RELEASE:
RDEBUG2("Bulk release not yet implemented");
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
default:
fr_assert(0);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
}
-static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_accounting(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_redis_ippool_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_redis_ippool_t);
fr_pair_t *vp;
* Pool-Action override
*/
vp = fr_pair_find_by_da(&request->control_pairs, attr_pool_action);
- if (vp) return mod_action(inst, request, vp->vp_uint32);
+ if (vp) return mod_action(p_result, inst, request, vp->vp_uint32);
/*
* Otherwise, guess the action by Acct-Status-Type
vp = fr_pair_find_by_da(&request->request_pairs, attr_acct_status_type);
if (!vp) {
RDEBUG2("Couldn't find &request.Acct-Status-Type or &control.Pool-Action, doing nothing...");
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
switch (vp->vp_uint32) {
case FR_STATUS_START:
case FR_STATUS_ALIVE:
- return mod_action(inst, request, POOL_ACTION_UPDATE);
+ return mod_action(p_result, inst, request, POOL_ACTION_UPDATE);
case FR_STATUS_STOP:
- return mod_action(inst, request, POOL_ACTION_RELEASE);
+ return mod_action(p_result, inst, request, POOL_ACTION_RELEASE);
case FR_STATUS_ACCOUNTING_OFF:
case FR_STATUS_ACCOUNTING_ON:
- return mod_action(inst, request, POOL_ACTION_BULK_RELEASE);
+ return mod_action(p_result, inst, request, POOL_ACTION_BULK_RELEASE);
default:
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
}
-static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_redis_ippool_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_redis_ippool_t);
fr_pair_t *vp;
* when called in Post-Auth.
*/
vp = fr_pair_find_by_da(&request->control_pairs, attr_pool_action);
- return mod_action(inst, request, vp ? vp->vp_uint32 : POOL_ACTION_ALLOCATE);
+ return mod_action(p_result, inst, request, vp ? vp->vp_uint32 : POOL_ACTION_ALLOCATE);
}
-static rlm_rcode_t CC_HINT(nonnull) mod_post_auth(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_post_auth(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_redis_ippool_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_redis_ippool_t);
fr_pair_t *vp;
} else {
RWDEBUG("Ignoring invalid action %d", vp->vp_uint32);
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
} else if (request->dict == dict_dhcpv4) {
}
run:
- return mod_action(inst, request, action);
+ return mod_action(p_result, inst, request, action);
}
-static rlm_rcode_t CC_HINT(nonnull) mod_request(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_request(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_redis_ippool_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_redis_ippool_t);
fr_pair_t *vp;
*/
vp = fr_pair_find_by_da(&request->control_pairs, attr_pool_action);
- return mod_action(inst, request, vp ? vp->vp_uint32 : POOL_ACTION_UPDATE);
+ return mod_action(p_result, inst, request, vp ? vp->vp_uint32 : POOL_ACTION_UPDATE);
}
static int mod_instantiate(void *instance, CONF_SECTION *conf)
return ret;
}
-static rlm_rcode_t mod_accounting_all(rlm_rediswho_t const *inst, request_t *request,
- char const *insert,
- char const *trim,
- char const *expire)
+static unlang_action_t mod_accounting_all(rlm_rcode_t *p_result, rlm_rediswho_t const *inst, request_t *request,
+ char const *insert,
+ char const *trim,
+ char const *expire)
{
int ret;
ret = rediswho_command(inst, request, insert);
- if (ret < 0) return RLM_MODULE_FAIL;
+ if (ret < 0) RETURN_MODULE_FAIL;
/* Only trim if necessary */
if ((inst->trim_count >= 0) && (ret > inst->trim_count)) {
- if (rediswho_command(inst, request, trim) < 0) return RLM_MODULE_FAIL;
+ if (rediswho_command(inst, request, trim) < 0) RETURN_MODULE_FAIL;
}
- if (rediswho_command(inst, request, expire) < 0) return RLM_MODULE_FAIL;
- return RLM_MODULE_OK;
+ if (rediswho_command(inst, request, expire) < 0) RETURN_MODULE_FAIL;
+ RETURN_MODULE_OK;
}
-static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_accounting(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_rediswho_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_rediswho_t);
rlm_rcode_t rcode;
vp = fr_pair_find_by_da(&request->request_pairs, attr_acct_status_type);
if (!vp) {
RDEBUG2("Could not find account status type in packet");
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
dv = fr_dict_enum_by_value(vp->da, &vp->data);
if (!dv) {
RDEBUG2("Unknown Acct-Status-Type %u", vp->vp_uint32);
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
cs = cf_section_find(inst->cs, dv->name, NULL);
if (!cs) {
RDEBUG2("No subsection %s", dv->name);
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
insert = cf_pair_value(cf_pair_find(cs, "insert"));
trim = cf_pair_value(cf_pair_find(cs, "trim"));
expire = cf_pair_value(cf_pair_find(cs, "expire"));
- rcode = mod_accounting_all(inst, request, insert, trim, expire);
-
- return rcode;
+ return mod_accounting_all(&rcode, inst, request, insert, trim, expire);
}
static int mod_bootstrap(void *instance, CONF_SECTION *conf)
return unlang_xlat_yield(request, rest_xlat_resume, rest_io_xlat_signal, rctx);
}
-static rlm_rcode_t mod_authorize_result(module_ctx_t const *mctx, request_t *request, void *rctx)
+static unlang_action_t mod_authorize_result(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, void *rctx)
{
rlm_rest_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_rest_t);
rlm_rest_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_rest_thread_t);
fr_curl_io_request_t *handle = talloc_get_type_abort(rctx, fr_curl_io_request_t);
int hcode;
- int rcode = RLM_MODULE_OK;
+ rlm_rcode_t rcode = RLM_MODULE_OK;
int ret;
if (section->tls.extract_cert_attrs) fr_curl_response_certinfo(request, handle);
fr_pool_connection_release(t->pool, request, handle);
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
/*
* from the database. The authentication code only needs to check
* the password, the rest is done here.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_rest_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_rest_t);
rlm_rest_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_rest_thread_t);
void *handle;
int ret;
- if (!section->name) return RLM_MODULE_NOOP;
+ if (!section->name) RETURN_MODULE_NOOP;
handle = fr_pool_connection_get(t->pool, request);
- if (!handle) return RLM_MODULE_FAIL;
+ if (!handle) RETURN_MODULE_FAIL;
ret = rlm_rest_perform(inst, t, section, handle, request, NULL, NULL);
if (ret < 0) {
rest_request_cleanup(inst, handle);
fr_pool_connection_release(t->pool, request, handle);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
return unlang_module_yield(request, mod_authorize_result, rest_io_module_action, handle);
}
-static rlm_rcode_t mod_authenticate_result(module_ctx_t const *mctx, request_t *request, void *rctx)
+static unlang_action_t mod_authenticate_result(rlm_rcode_t *p_result,
+ module_ctx_t const *mctx, request_t *request, void *rctx)
{
rlm_rest_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_rest_t);
rlm_rest_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_rest_thread_t);
fr_pool_connection_release(t->pool, request, handle);
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
/*
* Authenticate the user with the given password.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_rest_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_rest_t);
rlm_rest_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_rest_thread_t);
fr_pair_t const *username;
fr_pair_t const *password;
- if (!section->name) return RLM_MODULE_NOOP;
+ if (!section->name) RETURN_MODULE_NOOP;
username = fr_pair_find_by_da(&request->request_pairs, attr_user_name);
password = fr_pair_find_by_da(&request->request_pairs, attr_user_password);
*/
if (!username) {
REDEBUG("Attribute \"User-Name\" is required for authentication");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
if (!password) {
REDEBUG("Attribute \"User-Password\" is required for authentication");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
*/
if (password->vp_length == 0) {
REDEBUG("User-Password must not be empty");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
}
handle = fr_pool_connection_get(t->pool, request);
- if (!handle) return RLM_MODULE_FAIL;
+ if (!handle) RETURN_MODULE_FAIL;
ret = rlm_rest_perform(inst, t, section,
handle, request, username->vp_strvalue, password->vp_strvalue);
rest_request_cleanup(inst, handle);
fr_pool_connection_release(t->pool, request, handle);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
return unlang_module_yield(request, mod_authenticate_result, NULL, handle);
}
-static rlm_rcode_t mod_accounting_result(module_ctx_t const *mctx, request_t *request, void *rctx)
+static unlang_action_t mod_accounting_result(rlm_rcode_t *p_result,
+ module_ctx_t const *mctx, request_t *request, void *rctx)
{
rlm_rest_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_rest_t);
rlm_rest_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_rest_thread_t);
fr_pool_connection_release(t->pool, request, handle);
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
/*
* Send accounting info to a REST API endpoint
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_accounting(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_rest_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_rest_t);
rlm_rest_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_rest_thread_t);
void *handle;
int ret;
- if (!section->name) return RLM_MODULE_NOOP;
+ if (!section->name) RETURN_MODULE_NOOP;
handle = fr_pool_connection_get(t->pool, request);
- if (!handle) return RLM_MODULE_FAIL;
+ if (!handle) RETURN_MODULE_FAIL;
ret = rlm_rest_perform(inst, t, section, handle, request, NULL, NULL);
if (ret < 0) {
rest_request_cleanup(inst, handle);
fr_pool_connection_release(t->pool, request, handle);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
return unlang_module_yield(request, mod_accounting_result, NULL, handle);
}
-static rlm_rcode_t mod_post_auth_result(module_ctx_t const *mctx, request_t *request, void *rctx)
+static unlang_action_t mod_post_auth_result(rlm_rcode_t *p_result, module_ctx_t const *mctx,
+ request_t *request, void *rctx)
{
rlm_rest_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_rest_t);
rlm_rest_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_rest_thread_t);
fr_pool_connection_release(t->pool, request, handle);
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
/*
* Send post-auth info to a REST API endpoint
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_post_auth(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_post_auth(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_rest_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_rest_t);
rlm_rest_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_rest_thread_t);
void *handle;
int ret;
- if (!section->name) return RLM_MODULE_NOOP;
+ if (!section->name) RETURN_MODULE_NOOP;
handle = fr_pool_connection_get(t->pool, request);
- if (!handle) return RLM_MODULE_FAIL;
+ if (!handle) RETURN_MODULE_FAIL;
ret = rlm_rest_perform(inst, t, section, handle, request, NULL, NULL);
if (ret < 0) {
fr_pool_connection_release(t->pool, request, handle);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
return unlang_module_yield(request, mod_post_auth_result, NULL, handle);
/* comparison function to find session in the tree */
static int securid_session_cmp(void const *a, void const *b)
{
- int rcode;
+ int ret;
SECURID_SESSION const *one = a;
SECURID_SESSION const *two = b;
fr_assert(one != NULL);
fr_assert(two != NULL);
- rcode = fr_ipaddr_cmp(&one->src_ipaddr, &two->src_ipaddr);
- if (rcode != 0) return rcode;
+ ret = fr_ipaddr_cmp(&one->src_ipaddr, &two->src_ipaddr);
+ if (ret != 0) return ret;
return memcmp(one->state, two->state, sizeof(one->state));
}
/*
* Authenticate the user via one of any well-known password.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
int rcode;
rlm_securid_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_securid_t);
*/
if (!username) {
REDEBUG("Attribute \"User-Name\" is required for authentication");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
if (!password) {
REDEBUG("Attribute \"User-Password\" is required for authentication");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
*/
if (password->vp_length == 0) {
REDEBUG("Password should not be empty");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
if (RDEBUG_ENABLED3) {
MEM(pair_update_reply(&vp, attr_reply_message) >= 0);
fr_pair_value_strdup(vp, buffer);
}
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
txn->ctx.request = NULL; /* remove the link to the (now dead) request */
}
-static rlm_rcode_t sigtran_client_map_resume(UNUSED module_ctx_t const *mctx, request_t *request, void *rctx)
+static unlang_action_t sigtran_client_map_resume(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request, void *rctx)
{
sigtran_transaction_t *txn = talloc_get_type_abort(rctx, sigtran_transaction_t);
rlm_rcode_t rcode;
}
talloc_free(txn);
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
/** Create a MAP_SEND_AUTH_INFO request
ERROR("Failed retrieving version");
error:
talloc_free(txn);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
switch (req->version) {
{ NULL }
};
-static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_sigtran_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_sigtran_t);
rlm_sigtran_thread_t const *t = talloc_get_type_abort_const(mctx->thread, rlm_sigtran_thread_t);
static int cf_table_parse_tmpl(UNUSED TALLOC_CTX *ctx, void *out, UNUSED void *parent,
CONF_ITEM *ci, CONF_PARSER const *rule)
{
- int rcode = 0;
- ssize_t slen;
- int type = rule->type;
- bool tmpl = (type & FR_TYPE_TMPL);
- CONF_PAIR *cp = cf_item_to_pair(ci);
- tmpl_t *vpt;
+ int ret = 0;
+ ssize_t slen;
+ int type = rule->type;
+ bool tmpl = (type & FR_TYPE_TMPL);
+ CONF_PAIR *cp = cf_item_to_pair(ci);
+ tmpl_t *vpt;
static tmpl_rules_t rules = {
.allow_unknown = true,
if (!tmpl) {
cf_log_err(cp, "Failed parsing attribute reference");
- rcode = -1;
+ ret = -1;
goto finish;
}
talloc_free(spaces);
talloc_free(text);
/* Return error */
- rcode = -1;
+ ret = -1;
goto finish;
}
if(tmpl_is_list(vpt)) {
- rcode = -1;
+ ret = -1;
goto finish;
}
/* Only string values should be used for SMTP components */
if(tmpl_expanded_type(vpt) != FR_TYPE_STRING) {
cf_log_err(cp, "Attribute reference must be a string");
- rcode = -1;
+ ret = -1;
goto finish;
}
cp->parsed = true;
finish:
- return rcode;
+ return ret;
}
/*
/*
* Check if the email was successfully sent, and if the certificate information was extracted
*/
-static rlm_rcode_t mod_authorize_result(module_ctx_t const *mctx, request_t *request, void *rctx)
+static unlang_action_t mod_authorize_result(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, void *rctx)
{
fr_mail_ctx *mail_ctx = rctx;
rlm_smtp_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_smtp_t);
if (randle->result != CURLE_OK) {
talloc_free(randle);
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
}
if (tls->extract_cert_attrs) fr_curl_response_certinfo(request, randle);
talloc_free(randle);
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
/*
* Then it queues the request and yeilds until a response is given
* When it responds, mod_authorize_resume is called.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_smtp_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_smtp_t);
rlm_smtp_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_smtp_thread_t);
if (fr_pair_find_by_da(&request->control, attr_auth_type) != NULL) {
RDEBUG3("Auth-Type is already set. Not setting 'Auth-Type := %s'", inst->name);
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
/* Elements provided by the request */
/* Make sure all of the essential email components are present and possible*/
if(!smtp_body) {
RDEBUG2("Attribute \"smtp-body\" is required for smtp");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
if (!inst->sender_address && !inst->envelope_address) {
RDEBUG2("At least one of \"sender_address\" or \"envelope_address\" in the config, or \"SMTP-Sender-Address\" in the request is needed");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/* allocate the handle and set the curl options */
randle = fr_curl_io_request_alloc(request);
if (!randle){
RDEBUG2("A handle could not be allocated for the request");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/* Initialize the uctx to perform the email */
FR_CURL_REQUEST_SET_OPTION(CURLOPT_MIMEPOST, mail_ctx->mime);
/* Initialize tls if it has been set up */
- if (fr_curl_easy_tls_init(randle, &inst->tls) != 0) return RLM_MODULE_INVALID;
+ if (fr_curl_easy_tls_init(randle, &inst->tls) != 0) RETURN_MODULE_INVALID;
- if (fr_curl_io_request_enqueue(t->mhandle, request, randle)) return RLM_MODULE_INVALID;
+ if (fr_curl_io_request_enqueue(t->mhandle, request, randle)) RETURN_MODULE_INVALID;
return unlang_module_yield(request, mod_authorize_result, NULL, mail_ctx);
error:
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
* If the response was not OK, we REJECT the request
* This does not confirm an email may be sent, only that the provided login credentials are valid for the server
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_authenticate_resume(module_ctx_t const *mctx, request_t *request, void *rctx)
+static unlang_action_t CC_HINT(nonnull) mod_authenticate_resume(rlm_rcode_t *p_result,
+ module_ctx_t const *mctx, request_t *request, void *rctx)
{
rlm_smtp_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_smtp_t);
fr_curl_io_request_t *randle = rctx;
if (randle->result != CURLE_OK) {
talloc_free(randle);
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
}
if (tls->extract_cert_attrs) fr_curl_response_certinfo(request, randle);
talloc_free(randle);
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
/*
* Then it queues the request and yeilds until a response is given
* When it responds, mod_authenticate_resume is called.
*/
-static rlm_rcode_t CC_HINT(nonnull(1,2)) mod_authenticate(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull(1,2)) mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_smtp_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_smtp_t);
rlm_smtp_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_smtp_thread_t);
randle = fr_curl_io_request_alloc(request);
if (!randle){
error:
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
username = fr_pair_find_by_da(&request->request_pairs, attr_user_name);
/* Make sure we have a user-name and user-password, and that they are possible */
if (!username) {
REDEBUG("Attribute \"User-Name\" is required for authentication");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
if (username->vp_length == 0) {
RDEBUG2("\"User-Password\" must not be empty");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
if (!password) {
RDEBUG2("Attribute \"User-Password\" is required for authentication");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
FR_CURL_REQUEST_SET_OPTION(CURLOPT_DEFAULT_PROTOCOL, "smtp");
FR_CURL_REQUEST_SET_OPTION(CURLOPT_VERBOSE, 1L);
- if (fr_curl_easy_tls_init(randle, &inst->tls) != 0) return RLM_MODULE_INVALID;
+ if (fr_curl_easy_tls_init(randle, &inst->tls) != 0) RETURN_MODULE_INVALID;
- if (fr_curl_io_request_enqueue(t->mhandle, request, randle)) return RLM_MODULE_INVALID;
+ if (fr_curl_io_request_enqueue(t->mhandle, request, randle)) RETURN_MODULE_INVALID;
return unlang_module_yield(request, mod_authenticate_resume, NULL, randle);
}
CONF_PARSER_TERMINATOR
};
-static rlm_rcode_t CC_HINT(nonnull) mod_post_auth(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_post_auth(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
int rcode;
fr_pair_t *vp;
rlm_soh_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_soh_t);
- if (!inst->dhcp) return RLM_MODULE_NOOP;
+ if (!inst->dhcp) RETURN_MODULE_NOOP;
vp = fr_pair_find_by_da(&request->request_pairs, attr_dhcp_vendor);
if (vp) {
/* SoH payload */
rcode = soh_verify(request, data, vlen);
if (rcode < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
}
break;
}
data += vlen;
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
-static rlm_rcode_t CC_HINT(nonnull) mod_authorize(UNUSED module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request)
{
fr_pair_t *vp;
int rv;
vp = fr_pair_find_by_da(&request->request_pairs, attr_ms_quarantine_soh);
if (!vp) {
RDEBUG2("SoH radius VP not found");
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
RDEBUG2("SoH radius VP found");
/* decode it */
rv = soh_verify(request, vp->vp_octets, vp->vp_length);
if (rv < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
static int mod_bootstrap(void *instance, CONF_SECTION *conf)
/*
* A lie! It always returns!
*/
-static rlm_rcode_t sometimes_return(void const *instance, request_t *request, fr_radius_packet_t *packet, fr_radius_packet_t *reply)
+static unlang_action_t sometimes_return(rlm_rcode_t *p_result, void const *instance, request_t *request,
+ fr_radius_packet_t *packet, fr_radius_packet_t *reply)
{
uint32_t hash;
rlm_sometimes_t const *inst = talloc_get_type_abort_const(instance, rlm_sometimes_t);
/*
* Set it to NOOP and the module will always do nothing
*/
- if (inst->rcode == RLM_MODULE_NOOP) return inst->rcode;
+ if (inst->rcode == RLM_MODULE_NOOP) RETURN_MODULE_RCODE(inst->rcode);
/*
* Hash based on the given key. Usually User-Name.
*/
tmpl_find_vp(&vp, request, inst->key);
- if (!vp) return RLM_MODULE_NOOP;
+ if (!vp) RETURN_MODULE_NOOP;
switch (vp->vp_type) {
case FR_TYPE_OCTETS:
break;
case FR_TYPE_STRUCTURAL:
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
default:
hash = fr_hash(&vp->data.datum, fr_value_box_field_sizes[vp->vp_type]);
value /= (1 << 16);
value *= 100;
- if (value > inst->percentage) return RLM_MODULE_NOOP;
+ if (value > inst->percentage) RETURN_MODULE_NOOP;
/*
* If we're returning "handled", then set the packet
}
}
- return inst->rcode;
+ RETURN_MODULE_RCODE(inst->rcode);
}
-static rlm_rcode_t CC_HINT(nonnull) mod_sometimes_packet(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_sometimes_packet(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
- return sometimes_return(mctx->instance, request, request->packet, request->reply);
+ return sometimes_return(p_result, mctx->instance, request, request->packet, request->reply);
}
-static rlm_rcode_t CC_HINT(nonnull) mod_sometimes_reply(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_sometimes_reply(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
- return sometimes_return(mctx->instance, request, request->reply, NULL);
+ return sometimes_return(p_result, mctx->instance, request, request->reply, NULL);
}
extern module_t rlm_sometimes;
return 1;
}
-static rlm_rcode_t rlm_sql_process_groups(rlm_sql_t const *inst, request_t *request, rlm_sql_handle_t **handle,
- sql_fall_through_t *do_fall_through)
+static unlang_action_t rlm_sql_process_groups(rlm_rcode_t *p_result,
+ rlm_sql_t const *inst, request_t *request, rlm_sql_handle_t **handle,
+ sql_fall_through_t *do_fall_through)
{
rlm_rcode_t rcode = RLM_MODULE_NOOP;
fr_pair_t *check_tmp = NULL, *reply_tmp = NULL, *sql_group = NULL;
* Didn't add group attributes or allocate
* memory, so don't do anything else.
*/
- return RLM_MODULE_NOTFOUND;
+ RETURN_MODULE_NOTFOUND;
}
/*
if (rows < 0) {
REDEBUG("Error retrieving group list");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
if (rows == 0) {
RDEBUG2("User not found in any groups");
talloc_free(head);
pair_delete_request(inst->group_da);
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
inst->pool = module_connection_pool_init(inst->cs, inst, sql_mod_conn_create, NULL, NULL, NULL, NULL);
if (!inst->pool) return -1;
- return RLM_MODULE_OK;
+ return 0;
}
-static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_rcode_t rcode = RLM_MODULE_NOOP;
!inst->config->read_groups && !inst->config->read_profiles) {
RWDEBUG("No authorization checks configured, returning noop");
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
/*
* Set, escape, and check the user attr here
*/
- if (sql_set_user(inst, request, NULL) < 0) return RLM_MODULE_FAIL;
+ if (sql_set_user(inst, request, NULL) < 0) RETURN_MODULE_FAIL;
/*
* Reserve a socket
handle = fr_pool_connection_get(inst->pool, request);
if (!handle) {
sql_unset_user(inst, request);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/*
fr_pool_connection_release(inst->pool, request, handle);
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
fr_cursor_init(&cursor, &check_tmp);
rlm_rcode_t ret;
RDEBUG3("... falling-through to group processing");
- ret = rlm_sql_process_groups(inst, request, &handle, &do_fall_through);
+ rlm_sql_process_groups(&ret, inst, request, &handle, &do_fall_through);
switch (ret) {
/*
goto error;
}
- ret = rlm_sql_process_groups(inst, request, &handle, &do_fall_through);
+ rlm_sql_process_groups(&ret, inst, request, &handle, &do_fall_through);
switch (ret) {
/*
* Nothing bad happened, continue...
fr_pool_connection_release(inst->pool, request, handle);
sql_unset_user(inst, request);
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
/*
* doesn't update any rows, the next matching config item is used.
*
*/
-static int acct_redundant(rlm_sql_t const *inst, request_t *request, sql_acct_section_t *section)
+static unlang_action_t acct_redundant(rlm_rcode_t *p_result, rlm_sql_t const *inst, request_t *request, sql_acct_section_t *section)
{
rlm_rcode_t rcode = RLM_MODULE_OK;
fr_pool_connection_release(inst->pool, request, handle);
sql_unset_user(inst, request);
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
/*
* Accounting: Insert or update session data in our sql table
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_accounting(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_sql_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_sql_t);
if (inst->config->accounting.reference_cp) {
- return acct_redundant(inst, request, &inst->config->accounting);
+ return acct_redundant(p_result, inst, request, &inst->config->accounting);
}
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
/*
* Postauth: Write a record of the authentication attempt
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_post_auth(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_post_auth(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_sql_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_sql_t);
if (inst->config->postauth.reference_cp) {
- return acct_redundant(inst, request, &inst->config->postauth);
+ return acct_redundant(p_result, inst, request, &inst->config->postauth);
}
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
/*
if (sqlcounter_expand(subst, sizeof(subst), inst, request, inst->query) <= 0) {
REDEBUG("Insufficient query buffer space");
- return RLM_MODULE_FAIL;
+ return -1;
}
/* Then combine that with the name of the module were using to do the query */
if (len >= sizeof(query) - 1) {
REDEBUG("Insufficient query buffer space");
- return RLM_MODULE_FAIL;
+ return -1;
}
/* Finally, xlat resulting SQL query */
if (xlat_aeval(request, &expanded, request, query, NULL, NULL) < 0) {
- return RLM_MODULE_FAIL;
+ return -1;
}
if (sscanf(expanded, "%" PRIu64, &counter) != 1) {
* from the database. The authentication code only needs to check
* the password, the rest is done here.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_sqlcounter_t *inst = talloc_get_type_abort(mctx->instance, rlm_sqlcounter_t);
uint64_t counter, res;
if (tmpl_find_vp(&limit, request, inst->limit_attr) < 0) {
RWDEBUG2("Couldn't find limit attribute, %s, doing nothing...", inst->limit_attr->name);
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
/* First, expand %k, %b and %e in query */
if (sqlcounter_expand(subst, sizeof(subst), inst, request, inst->query) <= 0) {
REDEBUG("Insufficient query buffer space");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/* Then combine that with the name of the module were using to do the query */
if (len >= (sizeof(query) - 1)) {
REDEBUG("Insufficient query buffer space");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/* Finally, xlat resulting SQL query */
if (xlat_aeval(request, &expanded, request, query, NULL, NULL) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
talloc_free(expanded);
REDEBUG2("Rejecting user, %s value (%" PRIu64 ") is less than counter value (%" PRIu64 ")",
inst->limit_attr->name, limit->vp_uint64, counter);
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
}
res = limit->vp_uint64 - counter;
if (reply_item->vp_uint64 <= res) {
RDEBUG2("Leaving existing %s value of %" PRIu64, inst->reply_attr->name,
reply_item->vp_uint64);
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
break;
case -1: /* alloc failed */
REDEBUG("Error allocating attribute %s", inst->reply_attr->name);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
default: /* request or list unavailable */
RDEBUG2("List or request context not available for %s, skipping...", inst->reply_attr->name);
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
reply_item->vp_uint64 = res;
RDEBUG2("&%pP", reply_item);
- return RLM_MODULE_UPDATED;
+ RETURN_MODULE_UPDATED;
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
/*
* If we have something to log, then we log it.
* Otherwise we return the retcode as soon as possible
*/
-static int do_logging(UNUSED rlm_sqlippool_t const *inst, request_t *request, char const *str, int rcode)
+static unlang_action_t do_logging(rlm_rcode_t *p_result, UNUSED rlm_sqlippool_t const *inst, request_t *request,
+ char const *str, rlm_rcode_t rcode)
{
char *expanded = NULL;
fr_pair_t *vp;
- if (!str || !*str) return rcode;
+ if (!str || !*str) RETURN_MODULE_RCODE(rcode);
MEM(pair_add_request(&vp, attr_module_success_message) == 0);
if (xlat_aeval(request, &expanded, request, str, NULL, NULL) < 0) {
pair_delete_request(vp);
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
fr_pair_value_bstrdup_buffer_shallow(vp, expanded, true);
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
/*
* Allocate an IP number from the pool.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_alloc(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_alloc(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_sqlippool_t *inst = talloc_get_type_abort(mctx->instance, rlm_sqlippool_t);
char allocation[FR_MAX_STRING_LEN];
if (fr_pair_find_by_da(&request->reply_pairs, inst->allocated_address_da) != NULL) {
RDEBUG2("%s already exists", inst->allocated_address_da->name);
- return do_logging(inst, request, inst->log_exists, RLM_MODULE_NOOP);
+ return do_logging(p_result, inst, request, inst->log_exists, RLM_MODULE_NOOP);
}
if (fr_pair_find_by_da(&request->control_pairs, attr_pool_name) == NULL) {
RDEBUG2("No %s defined", attr_pool_name->name);
- return do_logging(inst, request, inst->log_nopool, RLM_MODULE_NOOP);
+ return do_logging(p_result, inst, request, inst->log_nopool, RLM_MODULE_NOOP);
}
handle = fr_pool_connection_get(inst->sql_inst->pool, request);
if (!handle) {
REDEBUG("Failed reserving SQL connection");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
if (inst->sql_inst->sql_set_user(inst->sql_inst, request, NULL) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
DO_PART(alloc_begin);
allocation_len = sqlippool_query1(allocation, sizeof(allocation),
inst->alloc_existing, &handle,
inst, request, (char *) NULL, 0);
- if (!handle) return RLM_MODULE_FAIL;
+ if (!handle) RETURN_MODULE_FAIL;
} else {
allocation_len = 0;
}
ssize_t slen;
slen = tmpl_expand(&ip, buffer, sizeof(buffer), request, inst->requested_address, NULL, NULL);
- if (slen < 0) return RLM_MODULE_FAIL;
+ if (slen < 0) RETURN_MODULE_FAIL;
if (slen > 0) {
allocation_len = sqlippool_query1(allocation, sizeof(allocation),
inst->alloc_requested, &handle,
inst, request, (char *) NULL, 0);
- if (!handle) return RLM_MODULE_FAIL;
+ if (!handle) RETURN_MODULE_FAIL;
}
}
allocation_len = sqlippool_query1(allocation, sizeof(allocation),
inst->alloc_find, &handle,
inst, request, (char *) NULL, 0);
- if (!handle) return RLM_MODULE_FAIL;
+ if (!handle) RETURN_MODULE_FAIL;
}
/*
allocation_len = sqlippool_query1(allocation, sizeof(allocation),
inst->pool_check, &handle, inst, request,
(char *) NULL, 0);
- if (!handle) return RLM_MODULE_FAIL;
+ if (!handle) RETURN_MODULE_FAIL;
fr_pool_connection_release(inst->sql_inst->pool, request, handle);
* NOTFOUND
*/
RDEBUG2("pool appears to be full");
- return do_logging(inst, request, inst->log_failed, RLM_MODULE_NOTFOUND);
-
+ return do_logging(p_result, inst, request, inst->log_failed, RLM_MODULE_NOTFOUND);
}
/*
* allocation failure and return NOOP
*/
RDEBUG2("IP address could not be allocated as no pool exists with that name");
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
fr_pool_connection_release(inst->sql_inst->pool, request, handle);
RDEBUG2("IP address could not be allocated");
- return do_logging(inst, request, inst->log_failed, RLM_MODULE_NOOP);
+ return do_logging(p_result, inst, request, inst->log_failed, RLM_MODULE_NOOP);
}
/*
RDEBUG2("Invalid IP number [%s] returned from instbase query.", allocation);
fr_pool_connection_release(inst->sql_inst->pool, request, handle);
- return do_logging(inst, request, inst->log_failed, RLM_MODULE_NOOP);
+ return do_logging(p_result, inst, request, inst->log_failed, RLM_MODULE_NOOP);
}
RDEBUG2("Allocated IP %s", allocation);
allocation, allocation_len) < 0) {
error:
if (handle) fr_pool_connection_release(inst->sql_inst->pool, request, handle);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
DO_PART(alloc_commit);
if (handle) fr_pool_connection_release(inst->sql_inst->pool, request, handle);
- return do_logging(inst, request, inst->log_success, RLM_MODULE_OK);
+ return do_logging(p_result, inst, request, inst->log_success, RLM_MODULE_OK);
}
/*
* Update a lease.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_update(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_update(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_sqlippool_t *inst = talloc_get_type_abort(mctx->instance, rlm_sqlippool_t);
rlm_sql_handle_t *handle;
handle = fr_pool_connection_get(inst->sql_inst->pool, request);
if (!handle) {
REDEBUG("Failed reserving SQL connection");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
if (inst->sql_inst->sql_set_user(inst->sql_inst, request, NULL) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
DO_PART(update_begin);
if (affected < 0) {
error:
if (handle) fr_pool_connection_release(inst->sql_inst->pool, request, handle);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
DO_PART(update_commit);
/*
* The lease has been updated - return OK
*/
- return do_logging(inst, request, inst->log_success, RLM_MODULE_OK);
+ return do_logging(p_result, inst, request, inst->log_success, RLM_MODULE_OK);
} else {
/*
* The lease could not be updated - return notfound
*/
- return do_logging(inst, request, inst->log_failed, RLM_MODULE_NOTFOUND);
+ return do_logging(p_result, inst, request, inst->log_failed, RLM_MODULE_NOTFOUND);
}
}
/*
* Release a lease.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_release(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_release(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_sqlippool_t *inst = talloc_get_type_abort(mctx->instance, rlm_sqlippool_t);
rlm_sql_handle_t *handle;
handle = fr_pool_connection_get(inst->sql_inst->pool, request);
if (!handle) {
REDEBUG("Failed reserving SQL connection");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
if (inst->sql_inst->sql_set_user(inst->sql_inst, request, NULL) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
DO_PART(release_begin);
DO_PART(release_commit);
if (handle) fr_pool_connection_release(inst->sql_inst->pool, request, handle);
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
error:
if (handle) fr_pool_connection_release(inst->sql_inst->pool, request, handle);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/*
* Release a collection of leases.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_bulk_release(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_bulk_release(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_sqlippool_t *inst = talloc_get_type_abort(mctx->instance, rlm_sqlippool_t);
rlm_sql_handle_t *handle;
handle = fr_pool_connection_get(inst->sql_inst->pool, request);
if (!handle) {
REDEBUG("Failed reserving SQL connection");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
if (inst->sql_inst->sql_set_user(inst->sql_inst, request, NULL) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
DO_PART(bulk_release_begin);
DO_PART(bulk_release_commit);
if (handle) fr_pool_connection_release(inst->sql_inst->pool, request, handle);
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
error:
if (handle) fr_pool_connection_release(inst->sql_inst->pool, request, handle);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/*
* Mark a lease. Typically for DHCP Decline where IPs need to be marked
* as invalid
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_mark(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_mark(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_sqlippool_t *inst = talloc_get_type_abort(mctx->instance, rlm_sqlippool_t);
rlm_sql_handle_t *handle;
handle = fr_pool_connection_get(inst->sql_inst->pool, request);
if (!handle) {
REDEBUG("Failed reserving SQL connection");
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
if (inst->sql_inst->sql_set_user(inst->sql_inst, request, NULL) < 0) {
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
DO_PART(mark_begin);
DO_PART(mark_commit);
if (handle) fr_pool_connection_release(inst->sql_inst->pool, request, handle);
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
error:
if (handle) fr_pool_connection_release(inst->sql_inst->pool, request, handle);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
/*
* Check Accounting packets for their accoutning status
* Call the relevant module based on the status
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_accounting(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
- int rcode = RLM_MODULE_NOOP;
fr_pair_t *vp;
int acct_status_type;
vp = fr_pair_find_by_da(&request->request_pairs, attr_acct_status_type);
if (!vp) {
RDEBUG2("Could not find account status type in packet");
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
acct_status_type = vp->vp_uint32;
switch (acct_status_type) {
case FR_STATUS_START:
case FR_STATUS_ALIVE:
- rcode = mod_update(mctx, request);
- break;
+ return mod_update(p_result, mctx, request);
case FR_STATUS_STOP:
- rcode = mod_release(mctx, request);
- break;
+ return mod_release(p_result, mctx, request);
case FR_STATUS_ACCOUNTING_ON:
case FR_STATUS_ACCOUNTING_OFF:
- rcode = mod_bulk_release(mctx, request);
- break;
+ return mod_bulk_release(p_result, mctx, request);
default:
/* We don't care about any other accounting packet */
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
-
- return rcode;
}
/*
/*
* Do the statistics
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_stats(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_stats(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_stats_t *inst = talloc_get_type_abort(mctx->instance, rlm_stats_t);
rlm_stats_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_stats_thread_t);
*/
if ((t->last_global_update + NSEC) > request->async->recv_time) {
- return RLM_MODULE_UPDATED;
+ RETURN_MODULE_UPDATED;
}
t->last_global_update = request->async->recv_time;
}
pthread_mutex_unlock(&inst->mutex);
- return RLM_MODULE_UPDATED;
+ RETURN_MODULE_UPDATED;
}
/*
*/
if ((request->request_state != REQUEST_RECV) ||
(request->packet->code != FR_CODE_STATUS_SERVER)) {
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
vp = fr_pair_find_by_da(&request->request_pairs, attr_freeradius_stats4_type);
case FR_FREERADIUS_STATS4_TYPE_VALUE_CLIENT: /* src */
vp = fr_pair_find_by_da(&request->request_pairs, attr_freeradius_stats4_ipv4_address);
if (!vp) vp = fr_pair_find_by_da(&request->request_pairs, attr_freeradius_stats4_ipv6_address);
- if (!vp) return RLM_MODULE_NOOP;
+ if (!vp) RETURN_MODULE_NOOP;
mydata.ipaddr = vp->vp_ip;
coalesce(local_stats, t, offsetof(rlm_stats_thread_t, src), &mydata);
case FR_FREERADIUS_STATS4_TYPE_VALUE_LISTENER: /* dst */
vp = fr_pair_find_by_da(&request->request_pairs, attr_freeradius_stats4_ipv4_address);
if (!vp) vp = fr_pair_find_by_da(&request->request_pairs, attr_freeradius_stats4_ipv6_address);
- if (!vp) return RLM_MODULE_NOOP;
+ if (!vp) RETURN_MODULE_NOOP;
mydata.ipaddr = vp->vp_ip;
coalesce(local_stats, t, offsetof(rlm_stats_thread_t, dst), &mydata);
default:
REDEBUG("Invalid value '%d' for FreeRADIUS-Stats4-type", stats_type);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
if (vp ) {
(void) fr_cursor_tail(&cursor);
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
INFO("Performing detach for thread %p", (void *)t->value);
- if (!fr_cond_assert(t->value == pthread_self())) return RLM_MODULE_FAIL;
+ if (!fr_cond_assert(t->value == pthread_self())) return -1;
return 0;
}
* from the database. The authentication code only needs to check
* the password, the rest is done here.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_test_thread_t *t = mctx->thread;
REXDENT();
REDEBUG4("RDEBUG4 error message");
- if (!fr_cond_assert(t->value == pthread_self())) return RLM_MODULE_FAIL;
+ if (!fr_cond_assert(t->value == pthread_self())) RETURN_MODULE_FAIL;
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
/*
* Authenticate the user with the given password.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, UNUSED request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, UNUSED request_t *request)
{
rlm_test_thread_t *t = mctx->thread;
- if (!fr_cond_assert(t->value == pthread_self())) return RLM_MODULE_FAIL;
+ if (!fr_cond_assert(t->value == pthread_self())) RETURN_MODULE_FAIL;
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
/*
* Massage the request before recording it or proxying it
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_preacct(module_ctx_t const *mctx, UNUSED request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_preacct(rlm_rcode_t *p_result, module_ctx_t const *mctx, UNUSED request_t *request)
{
rlm_test_thread_t *t = mctx->thread;
- if (!fr_cond_assert(t->value == pthread_self())) return RLM_MODULE_FAIL;
+ if (!fr_cond_assert(t->value == pthread_self())) RETURN_MODULE_FAIL;
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
/*
* Write accounting information to this modules database.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, UNUSED request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_accounting(rlm_rcode_t *p_result, module_ctx_t const *mctx, UNUSED request_t *request)
{
rlm_test_thread_t *t = mctx->thread;
- if (!fr_cond_assert(t->value == pthread_self())) return RLM_MODULE_FAIL;
+ if (!fr_cond_assert(t->value == pthread_self())) RETURN_MODULE_FAIL;
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
/*
* Write accounting information to this modules database.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_return(UNUSED module_ctx_t const *mctx, UNUSED request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_return(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, UNUSED request_t *request)
{
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
static int mod_detach(UNUSED void *instance)
* Pull the users password from where-ever, and add it to
* the given vp list.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_authorize(UNUSED module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request)
{
char const *name;
char const *encrypted_pass;
* a User-Name attribute.
*/
username = fr_pair_find_by_da(&request->request_pairs, attr_user_name);
- if (!username) return RLM_MODULE_NOOP;
+ if (!username) RETURN_MODULE_NOOP;
name = username->vp_strvalue;
encrypted_pass = NULL;
if ((pwd = getpwnam(name)) == NULL) {
- return RLM_MODULE_NOTFOUND;
+ RETURN_MODULE_NOTFOUND;
}
encrypted_pass = pwd->pw_passwd;
*/
if ((!encrypted_pass) || (strlen(encrypted_pass) < 10)) {
if ((spwd = getspnam(name)) == NULL) {
- return RLM_MODULE_NOTFOUND;
+ RETURN_MODULE_NOTFOUND;
}
encrypted_pass = spwd->sp_pwdp;
}
*/
if (strcmp(pwd->pw_shell, DENY_SHELL) == 0) {
REDEBUG("Invalid shell", name);
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
}
#endif
endusershell();
if (!shell) {
REDEBUG("[%s]: invalid shell [%s]", name, pwd->pw_shell);
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
}
#endif
if (spwd && spwd->sp_lstchg > 0 && spwd->sp_max >= 0 &&
(fr_time_to_sec(request->packet->timestamp) / 86400) > (spwd->sp_lstchg + spwd->sp_max)) {
REDEBUG("[%s]: password has expired", name);
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
}
/*
* Check if account has expired.
if (spwd && spwd->sp_expire > 0 &&
(fr_time_to_sec(request->packet->timestamp) / 86400) > spwd->sp_expire) {
REDEBUG("[%s]: account has expired", name);
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
}
#endif
if ((pwd->pw_expire > 0) &&
(fr_time_to_sec(request->packet->timestamp) > pwd->pw_expire)) {
REDEBUG("[%s]: password has expired", name);
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
}
#endif
* FIXME: Maybe add Auth-Type := Accept?
*/
if (encrypted_pass[0] == 0)
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
MEM(pair_update_control(&vp, attr_crypt_password) >= 0);
fr_pair_value_strdup(vp, encrypted_pass);
- return RLM_MODULE_UPDATED;
+ RETURN_MODULE_UPDATED;
}
/*
* Unix accounting - write a wtmp file.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_accounting(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_unix_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_unix_t);
fr_pair_t *vp;
*/
if (!inst->radwtmp) {
RDEBUG2("No radwtmp file configured. Ignoring accounting request");
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
if (request->packet->socket.inet.src_ipaddr.af != AF_INET) {
RDEBUG2("IPv6 is not supported!");
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
/*
*/
if ((vp = fr_pair_find_by_da(&request->request_pairs, attr_acct_status_type)) == NULL) {
RDEBUG2("no Accounting-Status-Type attribute in request");
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
status = vp->vp_uint32;
*/
if (status != FR_STATUS_START &&
status != FR_STATUS_STOP)
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
/*
* We're only interested in accounting messages
* with a username in it.
*/
if (fr_pair_find_by_da(&request->request_pairs, attr_user_name) == NULL)
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
t = fr_time_to_sec(request->packet->timestamp);
memset(&ut, 0, sizeof(ut));
* where we didn't see a NAS-Port attribute.
*/
if (strncmp(ut.ut_name, "!root", sizeof(ut.ut_name)) == 0 || !port_seen)
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
/*
* If we didn't find out the NAS address, use the
if ((fp = fopen(inst->radwtmp, "a")) != NULL) {
if ((fwrite(&ut, sizeof(ut), 1, fp)) != 1) {
fclose(fp);
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
}
fclose(fp);
} else
- return RLM_MODULE_FAIL;
+ RETURN_MODULE_FAIL;
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
/* globally exported name */
/*
* Reject any non-UTF8 data.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_utf8_clean(UNUSED module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_utf8_clean(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request)
{
size_t i, len;
fr_pair_t *vp;
for (i = 0; i < vp->vp_length; i += len) {
len = fr_utf8_char(&vp->vp_octets[i], -1);
- if (len == 0) return RLM_MODULE_FAIL;
+ if (len == 0) RETURN_MODULE_FAIL;
}
}
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
/*
* from the database. The authentication code only needs to check
* the password, the rest is done here.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_authorize(UNUSED module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request)
{
fr_pair_t *vp;
}
DEBUG2("Fixing WiMAX binary Calling-Station-Id to %pV", &vp->data);
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
/*
* Massage the request before recording it or proxying it
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_preacct(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_preacct(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
- return mod_authorize(mctx, request);
+ return mod_authorize(p_result, mctx, request);
}
/*
* Generate the keys after the user has been authenticated.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_post_auth(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_post_auth(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_wimax_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_wimax_t);
fr_pair_t *msk, *emsk, *vp;
emsk = fr_pair_find_by_da(&request->reply_pairs, attr_eap_emsk);
if (!msk || !emsk) {
REDEBUG2("No EAP-MSK or EAP-EMSK. Cannot create WiMAX keys");
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
/*
*/
HMAC_CTX_free(hmac);
- return RLM_MODULE_UPDATED;
+ RETURN_MODULE_UPDATED;
}
/*
*/
int do_auth_wbclient_pap(rlm_winbind_t const *inst, request_t *request, fr_pair_t *password)
{
- int rcode = -1;
+ int ret = -1;
struct wbcContext *wb_ctx;
struct wbcAuthUserParams authparams;
wbcErr err;
*/
switch (err) {
case WBC_ERR_SUCCESS:
- rcode = 0;
+ ret = 0;
RDEBUG2("Authenticated successfully");
break;
}
/*
- * The password needs to be changed, set rcode appropriately.
+ * The password needs to be changed, set ret appropriately.
*/
if (error->nt_status == NT_STATUS_PASSWORD_EXPIRED ||
error->nt_status == NT_STATUS_PASSWORD_MUST_CHANGE) {
- rcode = -648;
+ ret = -648;
}
/*
if (info) wbcFreeMemory(info);
if (error) wbcFreeMemory(error);
- return rcode;
+ return ret;
}
UNUSED fr_pair_t *check_list)
{
rlm_winbind_t *inst = instance;
- rlm_rcode_t rcode = 1;
+ int ret = 1;
struct wbcContext *wb_ctx;
wbcErr err;
uint32_t num_groups, i;
err = wbcCtxGetGroups(wb_ctx, username, &num_groups, &wb_groups);
switch (err) {
case WBC_ERR_SUCCESS:
- rcode = 0;
+ ret = 0;
REDEBUG2("Successfully retrieved user's groups");
break;
if (!num_groups) REDEBUG2("No groups returned");
- if (rcode) goto finish;
- rcode = 1;
+ if (ret) goto finish;
+ ret = 1;
/*
* See if any of the groups match
if (!strcasecmp(group_name, check->vp_strvalue)) {
REDEBUG2("Found matching group: %s", group_name);
found = true;
- rcode = 0;
+ ret = 0;
}
wbcFreeMemory(group);
if (found) break;
}
- if (rcode) REDEBUG2("No groups found that match");
+ if (ret) REDEBUG2("No groups found that match");
finish:
wbcFreeMemory(wb_groups);
talloc_const_free(domain);
REXDENT();
- return rcode;
+ return ret;
}
* - #RLM_MODULE_NOOP unable to use winbind authentication
* - #RLM_MODULE_OK Auth-Type has been set to winbind
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_winbind_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_winbind_t);
fr_pair_t *vp;
vp = fr_pair_find_by_da(&request->request_pairs, attr_user_password);
if (!vp) {
REDEBUG2("No User-Password found in the request; not doing winbind authentication.");
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
if (!inst->auth_type) {
WARN("No 'authenticate %s {...}' section or 'Auth-Type = %s' set. Cannot setup Winbind authentication",
inst->name, inst->name);
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
- if (!module_section_type_set(request, attr_auth_type, inst->auth_type)) return RLM_MODULE_NOOP;
+ if (!module_section_type_set(request, attr_auth_type, inst->auth_type)) RETURN_MODULE_NOOP;
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
*
* @return One of the RLM_MODULE_* values
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_winbind_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_winbind_t);
fr_pair_t *username, *password;
*/
if (!username) {
REDEBUG("Attribute \"User-Name\" is required for authentication");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
if (!password) {
REDEBUG("Attribute \"User-Password\" is required for authentication");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
*/
if (password->vp_length == 0) {
REDEBUG("User-Password must not be empty");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
/*
*/
if (do_auth_wbclient_pap(inst, request, password) == 0) {
REDEBUG2("User authenticated successfully using winbind");
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
}
* @param passcode string to decrypt.
* @return one of the RLM_RCODE_* constants.
*/
-rlm_rcode_t rlm_yubikey_decrypt(rlm_yubikey_t const *inst, request_t *request, char const *passcode)
+unlang_action_t rlm_yubikey_decrypt(rlm_rcode_t *p_result, rlm_yubikey_t const *inst, request_t *request, char const *passcode)
{
uint32_t counter, timestamp;
yubikey_token_st token;
key = fr_pair_find_by_da(&request->control_pairs, attr_yubikey_key);
if (!key) {
REDEBUG("Yubikey-Key attribute not found in control list, can't decrypt OTP data");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
if (key->vp_length != YUBIKEY_KEY_SIZE) {
REDEBUG("Yubikey-Key length incorrect, expected %u got %zu", YUBIKEY_KEY_SIZE, key->vp_length);
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
yubikey_parse((uint8_t const *) passcode + inst->id_len, key->vp_octets, &token);
*/
if (!yubikey_crc_ok_p((uint8_t *) &token)) {
REDEBUG("Decrypting OTP token data failed, rejecting");
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
}
RDEBUG2("Token data decrypted successfully");
vp = fr_pair_find_by_da(&request->control_pairs, attr_yubikey_counter);
if (!vp) {
RWDEBUG("Yubikey-Counter not found in control list, skipping replay attack checks");
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
if (counter <= vp->vp_uint32) {
REDEBUG("Replay attack detected! Counter value %u, is lt or eq to last known counter value %u",
counter, vp->vp_uint32);
- return RLM_MODULE_REJECT;
+ RETURN_MODULE_REJECT;
}
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
#endif
* from the database. The authentication code only needs to check
* the password, the rest is done here.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_yubikey_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_yubikey_t);
char const *passcode;
RDEBUG2("No cleartext password in the request. Can't do Yubikey authentication");
}
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
passcode = password->vp_strvalue;
if (len < (inst->id_len + YUBIKEY_TOKEN_LEN)) {
RDEBUG2("User-Password value is not the correct length, expected at least %u bytes, got %zu bytes",
inst->id_len + YUBIKEY_TOKEN_LEN, len);
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
password_len = (len - (inst->id_len + YUBIKEY_TOKEN_LEN));
} else {
RDEBUG2("User-Password (aes-block) value contains non modhex chars");
}
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
/* May be a concatenation, check the last 32 bytes are modhex */
if (!inst->auth_type) {
WARN("No 'authenticate %s {...}' section or 'Auth-Type = %s' set. Cannot setup Yubikey authentication",
inst->name, inst->name);
- return RLM_MODULE_NOOP;
+ RETURN_MODULE_NOOP;
}
- if (!module_section_type_set(request, attr_auth_type, inst->auth_type)) return RLM_MODULE_NOOP;
+ if (!module_section_type_set(request, attr_auth_type, inst->auth_type)) RETURN_MODULE_NOOP;
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
/*
* Authenticate the user with the given password.
*/
-static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, request_t *request)
+static unlang_action_t CC_HINT(nonnull) mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
rlm_yubikey_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_yubikey_t);
rlm_rcode_t rcode = RLM_MODULE_NOOP;
vp = fr_pair_find_by_da(&request->request_pairs, attr_user_password);
if (!vp) {
REDEBUG("No User-Password in the request. Can't do Yubikey authentication");
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
}
if (len != (inst->id_len + YUBIKEY_TOKEN_LEN)) {
REDEBUG("%s value is not the correct length, expected bytes %u, got bytes %zu",
vp->da->name, inst->id_len + YUBIKEY_TOKEN_LEN, len);
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
ret = otp_string_valid(inst, passcode, (inst->id_len + YUBIKEY_TOKEN_LEN));
} else {
RERROR("Passcode (aes-block) value contains non modhex chars");
}
- return RLM_MODULE_INVALID;
+ RETURN_MODULE_INVALID;
}
#ifdef HAVE_YUBIKEY
if (inst->decrypt) {
- rcode = rlm_yubikey_decrypt(inst, request, passcode);
- if (rcode != RLM_MODULE_OK) {
- return rcode;
- }
+
+ rlm_yubikey_decrypt(&rcode, inst, request, passcode);
+ if (rcode != RLM_MODULE_OK) RETURN_MODULE_RCODE(rcode);
/* Fall-Through to doing ykclient auth in addition to local auth */
}
#endif
#ifdef HAVE_YKCLIENT
- if (inst->validate) {
- return rlm_yubikey_validate(inst, request, passcode);
- }
+ if (inst->validate) return rlm_yubikey_validate(p_result, inst, request, passcode);
#endif
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
/*
/*
* decrypt.c - Decryption functions
*/
-rlm_rcode_t rlm_yubikey_decrypt(rlm_yubikey_t const *inst, request_t *request, char const *passcode);
+unlang_action_t rlm_yubikey_decrypt(rlm_rcode_t *p_result, rlm_yubikey_t const *inst, request_t *request, char const *passcode);
/*
* validate.c - Connection pool and validation functions
int rlm_yubikey_ykclient_detach(rlm_yubikey_t *inst);
-rlm_rcode_t rlm_yubikey_validate(rlm_yubikey_t const *inst, request_t *request, char const *passcode);
+unlang_action_t rlm_yubikey_validate(rlm_rcode_t *p_result, rlm_yubikey_t const *inst, request_t *request, char const *passcode);
return 0;
}
-rlm_rcode_t rlm_yubikey_validate(rlm_yubikey_t const *inst, request_t *request, char const *passcode)
+unlang_action_t rlm_yubikey_validate(rlm_rcode_t *p_result, rlm_yubikey_t const *inst, request_t *request, char const *passcode)
{
rlm_rcode_t rcode = RLM_MODULE_OK;
ykclient_rc status;
ykclient_handle_t *yandle;
yandle = fr_pool_connection_get(inst->pool, request);
- if (!yandle) return RLM_MODULE_FAIL;
+ if (!yandle) RETURN_MODULE_FAIL;
/*
* The libcurl multi-handle interface will tear down the TCP sockets for any partially completed
fr_pool_connection_release(inst->pool, request, yandle);
- return rcode;
+ RETURN_MODULE_RCODE(rcode);
}
#endif
*/
static int ascend_parse_ipx(int argc, char **argv, ascend_ipx_filter_t *filter)
{
- int rcode;
+ int slen;
int token;
int flags = 0;
fr_strerror_printf("Duplicate field when parsing 'abinary' IPX type");
return -1;
}
- rcode = ascend_parse_ipx_net(argc - 1, argv + 1,
+ slen = ascend_parse_ipx_net(argc - 1, argv + 1,
&(filter->src),
&(filter->srcSocComp));
- if (rcode < 0) return -1;
- argc -= (rcode + 1);
- argv += rcode + 1;
+ if (slen < 0) return -1;
+ argc -= (slen + 1);
+ argv += slen + 1;
flags |= 0x01;
break;
case FILTER_IPX_DST_IPXNET:
if (flags & 0x02) goto duplicate;
- rcode = ascend_parse_ipx_net(argc - 1, argv + 1,
+ slen = ascend_parse_ipx_net(argc - 1, argv + 1,
&(filter->dst),
&(filter->dstSocComp));
- if (rcode < 0) return -1;
- argc -= (rcode + 1);
- argv += rcode + 1;
+ if (slen < 0) return -1;
+ argc -= (slen + 1);
+ argv += slen + 1;
flags |= 0x02;
break;
*/
static int ascend_parse_port(uint16_t *port, char *compare, char *str)
{
- int rcode, token;
+ int slen, token;
/*
* There MUST be a comparison string.
*/
- rcode = fr_table_value_by_str(filterCompare, compare, -1);
- if (rcode < 0) {
+ slen = fr_table_value_by_str(filterCompare, compare, -1);
+ if (slen < 0) {
fr_strerror_printf("Unknown comparison operator '%s'", str);
- return rcode;
+ return slen;
}
if (strspn(str, "0123456789") == strlen(str)) {
*port = token;
*port = htons(*port);
- return rcode;
+ return slen;
}
*/
static int ascend_parse_ip(int argc, char **argv, ascend_ip_filter_t *filter)
{
- int rcode;
+ int slen;
int token;
int flags;
return -1;
}
- rcode = ascend_parse_ipaddr(&filter->srcip, argv[1]);
- if (rcode < 0) return rcode;
+ slen = ascend_parse_ipaddr(&filter->srcip, argv[1]);
+ if (slen < 0) return slen;
- filter->srcmask = rcode;
+ filter->srcmask = slen;
flags |= IP_SRC_ADDR_FLAG;
argv += 2;
argc -= 2;
if (flags & IP_DEST_ADDR_FLAG) goto duplicate;
if (argc < 2) goto insufficient;
- rcode = ascend_parse_ipaddr(&filter->dstip, argv[1]);
- if (rcode < 0) return rcode;
+ slen = ascend_parse_ipaddr(&filter->dstip, argv[1]);
+ if (slen < 0) return slen;
- filter->dstmask = rcode;
+ filter->dstmask = slen;
flags |= IP_DEST_ADDR_FLAG;
argv += 2;
argc -= 2;
if (flags & IP_SRC_PORT_FLAG) goto duplicate;
if (argc < 3) goto insufficient;
- rcode = ascend_parse_port(&filter->srcport,
+ slen = ascend_parse_port(&filter->srcport,
argv[1], argv[2]);
- if (rcode < 0) return rcode;
- filter->srcPortComp = rcode;
+ if (slen < 0) return slen;
+ filter->srcPortComp = slen;
flags |= IP_SRC_PORT_FLAG;
argv += 3;
if (flags & IP_DEST_PORT_FLAG) goto duplicate;
if (argc < 3) goto insufficient;
- rcode = ascend_parse_port(&filter->dstport,
+ slen = ascend_parse_port(&filter->dstport,
argv[1], argv[2]);
- if (rcode < 0) return rcode;
- filter->dstPortComp = rcode;
+ if (slen < 0) return slen;
+ filter->dstPortComp = slen;
flags |= IP_DEST_PORT_FLAG;
argv += 3;
*/
static int ascend_parse_ipv6(int argc, char **argv, ascend_ipv6_filter_t *filter)
{
- int rcode;
+ ssize_t slen;
int token;
int flags;
if (flags & IP_SRC_PORT_FLAG) goto duplicate;
if (argc < 3) goto insufficient;
- rcode = ascend_parse_port(&filter->srcport,
+ slen = ascend_parse_port(&filter->srcport,
argv[1], argv[2]);
- if (rcode < 0) return rcode;
- filter->srcPortComp = rcode;
+ if (slen < 0) return slen;
+ filter->srcPortComp = slen;
flags |= IP_SRC_PORT_FLAG;
argv += 3;
if (flags & IP_DEST_PORT_FLAG) goto duplicate;
if (argc < 3) goto insufficient;
- rcode = ascend_parse_port(&filter->dstport,
+ slen = ascend_parse_port(&filter->dstport,
argv[1], argv[2]);
- if (rcode < 0) return rcode;
- filter->dstPortComp = rcode;
+ if (slen < 0) return slen;
+ filter->dstPortComp = slen;
flags |= IP_DEST_PORT_FLAG;
argv += 3;
static int ascend_parse_generic(int argc, char **argv,
ascend_generic_filter_t *filter)
{
- int rcode;
+ int slen;
int token;
int flags;
return -1;
}
- rcode = atoi(argv[0]);
- if (rcode > 65535) goto invalid;
+ slen = atoi(argv[0]);
+ if (slen > 65535) goto invalid;
- filter->offset = rcode;
+ filter->offset = slen;
filter->offset = htons(filter->offset);
- rcode = fr_hex2bin(NULL,
+ slen = fr_hex2bin(NULL,
&FR_DBUFF_TMP(filter->mask, sizeof(filter->mask)),
&FR_SBUFF_IN(argv[1], strlen(argv[1])), false);
- if (rcode != sizeof(filter->mask)) {
+ if (slen != sizeof(filter->mask)) {
fr_strerror_printf("Invalid filter mask '%s'", argv[1]);
- return -1;
+ return -1;
}
token = fr_hex2bin(NULL,
return -1;
}
- filter->len = rcode;
+ filter->len = slen;
filter->len = htons(filter->len);
/*
ssize_t fr_radius_encode_abinary(fr_pair_t const *vp, uint8_t *out, size_t outlen)
{
int token, type;
- int rcode;
+ int slen;
int argc;
char *argv[32];
ascend_filter_t filter;
switch (type) {
case ASCEND_FILTER_GENERIC:
- rcode = ascend_parse_generic(argc - 3, &argv[3], &filter.generic);
+ slen = ascend_parse_generic(argc - 3, &argv[3], &filter.generic);
size = 32;
break;
case ASCEND_FILTER_IP:
- rcode = ascend_parse_ip(argc - 3, &argv[3], &filter.ip);
+ slen = ascend_parse_ip(argc - 3, &argv[3], &filter.ip);
size = 32;
break;
case ASCEND_FILTER_IPX:
- rcode = ascend_parse_ipx(argc - 3, &argv[3], &filter.ipx);
+ slen = ascend_parse_ipx(argc - 3, &argv[3], &filter.ipx);
size = 32;
break;
case ASCEND_FILTER_IPV6:
- rcode = ascend_parse_ipv6(argc - 3, &argv[3], &filter.ipv6);
+ slen = ascend_parse_ipv6(argc - 3, &argv[3], &filter.ipv6);
size = sizeof(filter);
break;
}
- if (rcode < 0) goto fail;
+ if (slen < 0) goto fail;
talloc_free(p);
uint8_t const *data, size_t attr_len, size_t packet_len,
void *decoder_ctx)
{
- ssize_t rcode;
+ ssize_t ret;
size_t fraglen;
uint8_t *head, *tail;
uint8_t const *frag, *end;
* No continuation, just decode the attributre in place.
*/
if ((data[1] & 0x80) == 0) {
- rcode = fr_radius_decode_pair_value(ctx, cursor, dict,
+ ret = fr_radius_decode_pair_value(ctx, cursor, dict,
parent, data + 2, attr_len - 2, attr_len - 2, decoder_ctx);
- if (rcode < 0) return -1;
+ if (ret < 0) return -1;
return attr_len;
}
FR_PROTO_HEX_DUMP(head, fraglen, "long-extended fragments");
- rcode = fr_radius_decode_pair_value(ctx, cursor, dict,
+ ret = fr_radius_decode_pair_value(ctx, cursor, dict,
parent, head, fraglen, fraglen, decoder_ctx);
talloc_free(head);
- if (rcode < 0) return rcode;
+ if (ret < 0) return ret;
return end - data;
}
fr_dict_attr_t const *parent,
uint8_t const *data, size_t attr_len, size_t packet_len, void *decoder_ctx, uint32_t vendor)
{
- ssize_t rcode;
+ ssize_t ret;
size_t wimax_len;
bool more;
uint8_t *head, *tail;
* No continuation, just decode the attributre in place.
*/
if ((data[6] & 0x80) == 0) {
- rcode = fr_radius_decode_pair_value(ctx, cursor, dict,
+ ret = fr_radius_decode_pair_value(ctx, cursor, dict,
da, data + 7, data[5] - 3, data[5] - 3, decoder_ctx);
- if (rcode < 0) return rcode;
+ if (ret < 0) return ret;
return attr_len;
}
FR_PROTO_HEX_DUMP(head, wimax_len, "Wimax fragments");
- rcode = fr_radius_decode_pair_value(ctx, cursor, dict,
+ ret = fr_radius_decode_pair_value(ctx, cursor, dict,
da, head, wimax_len, wimax_len, decoder_ctx);
talloc_free(head);
- if (rcode < 0) return rcode;
+ if (ret < 0) return ret;
return end - data;
}
void *decoder_ctx)
{
size_t total;
- ssize_t rcode;
+ ssize_t ret;
uint32_t vendor;
fr_dict_vendor_t const *dv;
fr_pair_t *head = NULL;
* WiMAX craziness
*/
if ((vendor == VENDORPEC_WIMAX) && dv->flags) {
- rcode = decode_wimax(ctx, cursor, dict,
+ ret = decode_wimax(ctx, cursor, dict,
vendor_da, data, attr_len, packet_len, decoder_ctx, vendor);
- return rcode;
+ return ret;
}
/*
{
int8_t tag = 0;
size_t data_len;
- ssize_t rcode;
+ ssize_t ret;
uint32_t vendor;
fr_dict_attr_t const *child;
fr_pair_t *vp = NULL;
* VSAs can be WiMAX, in which case they don't
* fit into one attribute.
*/
- rcode = decode_vsa(ctx, cursor, dict, parent, p, attr_len, packet_len, decoder_ctx);
- if (rcode < 0) goto raw;
- return rcode;
+ ret = decode_vsa(ctx, cursor, dict, parent, p, attr_len, packet_len, decoder_ctx);
+ if (ret < 0) goto raw;
+ return ret;
} else {
fr_dict_attr_t const *vendor_child;
* Everything was found in the dictionary, we can
* now recurse to decode the value.
*/
- rcode = fr_radius_decode_pair_value(ctx, cursor, dict,
+ ret = fr_radius_decode_pair_value(ctx, cursor, dict,
child, p + 5, attr_len - 5, attr_len - 5,
decoder_ctx);
- if (rcode < 0) goto raw;
+ if (ret < 0) goto raw;
return attr_len;
}
* attribute, OR they've already been grouped
* into a contiguous memory buffer.
*/
- rcode = fr_radius_decode_tlv(ctx, cursor, dict, parent, p, attr_len, decoder_ctx);
- if (rcode < 0) goto raw;
+ ret = fr_radius_decode_tlv(ctx, cursor, dict, parent, p, attr_len, decoder_ctx);
+ if (ret < 0) goto raw;
return attr_len;
}
* set. Just decode it.
*/
if (!extra || ((p[1] & 0x80) == 0)) {
- rcode = fr_radius_decode_pair_value(ctx, cursor, dict, child,
+ ret = fr_radius_decode_pair_value(ctx, cursor, dict, child,
p + min, attr_len - min, attr_len - min,
decoder_ctx);
- if (rcode < 0) goto invalid_extended;
+ if (ret < 0) goto invalid_extended;
return attr_len;
}
* MUST have the "more" bit set. So we
* don't check it again here.
*/
- rcode = decode_extended(ctx, cursor, dict, child, data, attr_len, packet_len, decoder_ctx);
- if (rcode >= 0) return rcode; /* which may be LONGER than attr_len */
+ ret = decode_extended(ctx, cursor, dict, child, data, attr_len, packet_len, decoder_ctx);
+ if (ret >= 0) return ret; /* which may be LONGER than attr_len */
/* Fall through to invalid extended attribute */
} else {
* "long" extended. Decode the value.
*/
if (extra) {
- rcode = decode_extended(ctx, cursor, dict, child, data, attr_len, packet_len, decoder_ctx);
- if (rcode >= 0) return rcode; /* which may be LONGER than attr_len */
+ ret = decode_extended(ctx, cursor, dict, child, data, attr_len, packet_len, decoder_ctx);
+ if (ret >= 0) return ret; /* which may be LONGER than attr_len */
}
- rcode = fr_radius_decode_pair_value(ctx, cursor, dict, child,
+ ret = fr_radius_decode_pair_value(ctx, cursor, dict, child,
p + min, attr_len - min, attr_len - min,
decoder_ctx);
- if (rcode < 0) return -1;
+ if (ret < 0) return -1;
return attr_len;
case FR_TYPE_STRUCT:
* attribute, OR it's already been grouped
* into a contiguous memory buffer.
*/
- rcode = fr_struct_from_network(ctx, cursor, parent, p, attr_len, &child,
+ ret = fr_struct_from_network(ctx, cursor, parent, p, attr_len, &child,
decode_value, decoder_ctx);
- if (rcode < 0) goto raw;
+ if (ret < 0) goto raw;
/*
* The above function only decodes fixed fields
* the struct, we have to decode them manually
* here.
*/
- if (child && ((size_t) rcode < attr_len)) {
+ if (child && ((size_t) ret < attr_len)) {
ssize_t tlv_len;
/*
* Try to decode the TLVs
*/
tlv_len = fr_radius_decode_tlv(ctx, cursor, dict,
- child, p + rcode, attr_len - rcode,
+ child, p + ret, attr_len - ret,
decoder_ctx);
if (tlv_len < 0) {
- vp = fr_unknown_from_network(ctx, child, p + rcode, attr_len - rcode);
+ vp = fr_unknown_from_network(ctx, child, p + ret, attr_len - ret);
if (vp) fr_cursor_append(cursor, vp);
}
}
ssize_t fr_radius_decode_pair(TALLOC_CTX *ctx, fr_cursor_t *cursor, fr_dict_t const *dict,
uint8_t const *data, size_t data_len, void *decoder_ctx)
{
- ssize_t rcode;
+ ssize_t ret;
fr_dict_attr_t const *da;
fr_radius_ctx_t *packet_ctx = decoder_ctx;
* attributes may have the "continuation" bit set, and
* will thus be more than one attribute in length.
*/
- rcode = fr_radius_decode_pair_value(ctx, cursor, dict,
+ ret = fr_radius_decode_pair_value(ctx, cursor, dict,
da, data + 2, data[1] - 2, data_len - 2,
decoder_ctx);
- if (rcode < 0) return rcode;
+ if (ret < 0) return ret;
- return 2 + rcode;
+ return 2 + ret;
}
static int _test_ctx_free(UNUSED fr_radius_ctx_t *ctx)
*/
int fr_packet_cmp(fr_radius_packet_t const *a, fr_radius_packet_t const *b)
{
- int rcode;
+ int ret;
/*
* 256-way fanout.
/*
* Source ports are pretty much random.
*/
- rcode = (int) a->socket.inet.src_port - (int) b->socket.inet.src_port;
- if (rcode != 0) return rcode;
+ ret = (int) a->socket.inet.src_port - (int) b->socket.inet.src_port;
+ if (ret != 0) return ret;
/*
* Usually many client IPs, and few server IPs
*/
- rcode = fr_ipaddr_cmp(&a->socket.inet.src_ipaddr, &b->socket.inet.src_ipaddr);
- if (rcode != 0) return rcode;
+ ret = fr_ipaddr_cmp(&a->socket.inet.src_ipaddr, &b->socket.inet.src_ipaddr);
+ if (ret != 0) return ret;
/*
* One socket can receive packets for multiple
* destination IPs, so we check that before checking the
* file descriptor.
*/
- rcode = fr_ipaddr_cmp(&a->socket.inet.dst_ipaddr, &b->socket.inet.dst_ipaddr);
- if (rcode != 0) return rcode;
+ ret = fr_ipaddr_cmp(&a->socket.inet.dst_ipaddr, &b->socket.inet.dst_ipaddr);
+ if (ret != 0) return ret;
/*
* At this point, the order of comparing socket FDs
* fields will make the socket unique, and the other is
* pretty much redundant.
*/
- rcode = (int) a->socket.inet.dst_port - (int) b->socket.inet.dst_port;
- return rcode;
+ ret = (int) a->socket.inet.dst_port - (int) b->socket.inet.dst_port;
+ return ret;
}
/*
int fr_radius_packet_sign(fr_radius_packet_t *packet, fr_radius_packet_t const *original,
char const *secret)
{
- int rcode;
+ int ret;
uint8_t const *original_data;
if (original) {
memcpy(packet->data + 4, packet->vector, sizeof(packet->vector));
}
- rcode = fr_radius_sign(packet->data, original_data,
+ ret = fr_radius_sign(packet->data, original_data,
(uint8_t const *) secret, talloc_array_length(secret) - 1);
- if (rcode < 0) return rcode;
+ if (ret < 0) return ret;
memcpy(packet->vector, packet->data + 4, RADIUS_AUTH_VECTOR_LENGTH);
return 0;
* is allowed on some platforms, but it's not nice.
*/
if (packet->socket.proto == IPPROTO_TCP) {
- ssize_t rcode;
+ ssize_t ret;
- rcode = write(packet->socket.fd, packet->data, packet->data_len);
- if (rcode >= 0) return rcode;
+ ret = write(packet->socket.fd, packet->data, packet->data_len);
+ if (ret >= 0) return ret;
fr_strerror_printf("sendto failed: %s", fr_syserror(errno));
return -1;
--- /dev/null
+#
+# PRE: update
+#
+# Test the map xlat
+#
+update {
+ &Tmp-String-0 := "request.Tmp-Group-0.Tmp-String-1 = 'testing123'"
+}
+
+if ("%{map:%{Tmp-String-0}}" != 1) {
+ test_fail
+}
+
+success
int main(int argc, char *argv[])
{
- int c, i, rcode = 0;
+ int c, i, ret = 0;
int size;
intptr_t val;
void *data;
}
#endif
- return rcode;
+ return ret;
}
for (i = 0; i < my_alloc_size; i++) {
int index;
- int rcode;
+ int ret;
fr_message_t *m;
index = (*start + i) & (MY_ARRAY_SIZE - 1);
fr_assert(m->status == FR_MESSAGE_USED);
- rcode = fr_message_done(m);
+ ret = fr_message_done(m);
#ifndef NDEBUG
- fr_assert(rcode == 0);
+ fr_assert(ret == 0);
#else
- if (rcode != 0) fr_exit_now(EXIT_FAILURE);
+ if (ret != 0) fr_exit_now(EXIT_FAILURE);
#endif
used -= array[index];
int main(int argc, char *argv[])
{
int c;
- int i, start, end, rcode;
+ int i, start, end, ret;
fr_message_set_t *ms;
uint32_t seed;
/*
* After the garbage collection, all messages marked "done" MUST also be marked "free".
*/
- rcode = fr_message_set_messages_used(ms);
- fr_assert(rcode == 0);
+ ret = fr_message_set_messages_used(ms);
+ fr_assert(ret == 0);
- return rcode;
+ return ret;
}
static rlm_rcode_t test_process(UNUSED void const *instance, request_t *request, fr_io_action_t action)
{
MPRINT1("\t\tPROCESS --- request %"PRIu64" action %d\n", request->number, action);
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
static rlm_rcode_t test_process(UNUSED void const *instance, request_t *request, fr_io_action_t action)
{
MPRINT1("\t\tPROCESS --- request %"PRIu64" action %d\n", request->number, action);
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
static int test_decode(void const *instance, request_t *request, uint8_t *const data, size_t data_len)
static rlm_rcode_t test_process(UNUSED void const *inst, request_t *request, fr_io_action_t action)
{
MPRINT1("\t\tPROCESS --- request %"PRIu64" action %d\n", request->number, action);
- return RLM_MODULE_OK;
+ RETURN_MODULE_OK;
}
static int test_decode(UNUSED void const *instance, request_t *request, uint8_t *const data, size_t data_len)
projects / thirdparty / freeradius-server.git / commitdiff
