From: Arran Cudbard-Bell Date: Wed, 11 Nov 2020 01:58:47 +0000 (-0600) Subject: Change function signatures so that module methods can signal the interpreter directly X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0ea89c8d4d350b1fd243844e85a05a41d4cf99f2;p=thirdparty%2Ffreeradius-server.git Change function signatures so that module methods can signal the interpreter directly --- diff --git a/src/bin/radmin.c b/src/bin/radmin.c index 1edaabc15ac..d283c75538b 100644 --- a/src/bin/radmin.c +++ b/src/bin/radmin.c @@ -1133,7 +1133,7 @@ int fr_radmin_register(UNUSED TALLOC_CTX *talloc_ctx, char const *name, void *ct */ int fr_radmin_run(fr_cmd_info_t *info, FILE *fp, FILE *fp_err, char *str, bool read_only) { - int argc, rcode; + int argc, ret; argc = fr_command_str_to_argv(radmin_cmd, info, str); if (argc < 0) { @@ -1145,7 +1145,7 @@ int fr_radmin_run(fr_cmd_info_t *info, FILE *fp, FILE *fp_err, char *str, bool r return 0; } - rcode = fr_command_run(fp, fp_err, info, read_only); + ret = fr_command_run(fp, fp_err, info, read_only); fflush(fp); fflush(fp_err); @@ -1154,7 +1154,7 @@ int fr_radmin_run(fr_cmd_info_t *info, FILE *fp, FILE *fp_err, char *str, bool r */ (void) fr_command_clear(0, info); - if (rcode < 0) return rcode; + if (ret < 0) return ret; return 1; } diff --git a/src/bin/radsniff.c b/src/bin/radsniff.c index f0ba9a8a9cc..baa4743e6db 100644 --- a/src/bin/radsniff.c +++ b/src/bin/radsniff.c @@ -972,7 +972,7 @@ static int rs_get_pairs(TALLOC_CTX *ctx, fr_pair_t **out, fr_pair_t *vps, fr_dic static int _request_free(rs_request_t *request) { - bool ret; + int ret; /* * If we're attempting to cleanup the request, and it's no longer in the request_tree @@ -989,10 +989,8 @@ static int _request_free(rs_request_t *request) } if (request->event) { - int rcode; - - rcode = fr_event_timer_delete(&request->event); - if (rcode < 0) { + ret = fr_event_timer_delete(&request->event); + if (ret < 0) { fr_perror("Failed deleting timer"); RS_ASSERT(0 == 1); } @@ -1920,22 +1918,22 @@ static int _rs_event_status(UNUSED void *ctx, fr_time_delta_t wake_t) */ static int rs_rtx_cmp(rs_request_t const *a, rs_request_t const *b) { - int rcode; + int ret; RS_ASSERT(a->link_vps); RS_ASSERT(b->link_vps); - rcode = (int) a->expect->code - (int) b->expect->code; - if (rcode != 0) return rcode; + ret = (int) a->expect->code - (int) b->expect->code; + if (ret != 0) return ret; - rcode = a->expect->socket.fd - b->expect->socket.fd; - if (rcode != 0) return rcode; + ret = a->expect->socket.fd - b->expect->socket.fd; + if (ret != 0) return ret; - rcode = fr_ipaddr_cmp(&a->expect->socket.inet.src_ipaddr, &b->expect->socket.inet.src_ipaddr); - if (rcode != 0) return rcode; + ret = fr_ipaddr_cmp(&a->expect->socket.inet.src_ipaddr, &b->expect->socket.inet.src_ipaddr); + if (ret != 0) return ret; - rcode = fr_ipaddr_cmp(&a->expect->socket.inet.dst_ipaddr, &b->expect->socket.inet.dst_ipaddr); - if (rcode != 0) return rcode; + ret = fr_ipaddr_cmp(&a->expect->socket.inet.dst_ipaddr, &b->expect->socket.inet.dst_ipaddr); + if (ret != 0) return ret; return fr_pair_list_cmp(&a->link_vps, &b->link_vps); } diff --git a/src/bin/unit_test_module.c b/src/bin/unit_test_module.c index 57e56ac1892..cc93657e22c 100644 --- a/src/bin/unit_test_module.c +++ b/src/bin/unit_test_module.c @@ -463,12 +463,12 @@ static rlm_rcode_t mod_map_proc(UNUSED void *mod_inst, UNUSED void *proc_inst, U static void request_run(fr_event_list_t *el, request_t *request) { - rlm_rcode_t rcode; - module_method_t process; - void *inst; - fr_dict_enum_t *dv; - fr_heap_t *backlog; - request_t *child; + rlm_rcode_t rcode; + module_method_t process; + void *inst; + fr_dict_enum_t *dv; + fr_heap_t *backlog; + request_t *child; dv = fr_dict_enum_by_value(attr_packet_type, fr_box_uint32(request->packet->code)); if (!dv) return; @@ -482,8 +482,7 @@ static void request_run(fr_event_list_t *el, request_t *request) request->backlog = backlog; request->el = el; - rcode = process(&(module_ctx_t){ .instance = inst }, request); - if (rcode != RLM_MODULE_YIELD) goto done; + if (process(&rcode, &(module_ctx_t){ .instance = inst }, request) != UNLANG_ACTION_YIELD) goto done; while (true) { bool wait_for_event; @@ -521,8 +520,7 @@ static void request_run(fr_event_list_t *el, request_t *request) */ (void) fr_heap_extract(backlog, request); - rcode = process(&(module_ctx_t){ .instance = inst }, request); - if (rcode != RLM_MODULE_YIELD) break; + if (process(&rcode, &(module_ctx_t){ .instance = inst }, request) != UNLANG_ACTION_YIELD) break; } done: diff --git a/src/lib/eap/base.c b/src/lib/eap/base.c index 51ffe1b5cc3..4cb3bcb1949 100644 --- a/src/lib/eap/base.c +++ b/src/lib/eap/base.c @@ -426,8 +426,7 @@ rlm_rcode_t eap_virtual_server(request_t *request, eap_session_t *eap_session, c eap_session_t, eap_session->child, false, false, false); } - rcode = rad_virtual_server(request); - + rad_virtual_server(&rcode, request); eap_session_inner = request_data_get(request, NULL, REQUEST_DATA_EAP_SESSION); if (eap_session_inner) { /* diff --git a/src/lib/eap/chbind.c b/src/lib/eap/chbind.c index 3d7a8034f81..4fcb259840f 100644 --- a/src/lib/eap/chbind.c +++ b/src/lib/eap/chbind.c @@ -229,8 +229,7 @@ FR_CODE chbind_process(request_t *request, CHBIND_REQ *chbind) fake->server_cs = virtual_server_find("channel_bindings"); fake->packet->code = FR_CODE_ACCESS_REQUEST; - rcode = rad_virtual_server(fake); - + rad_virtual_server(&rcode, fake); switch (rcode) { /* If the virtual server succeeded, build a reply */ case RLM_MODULE_OK: diff --git a/src/lib/eap/compose.c b/src/lib/eap/compose.c index bd8e6e278f8..cebacd51dd0 100644 --- a/src/lib/eap/compose.c +++ b/src/lib/eap/compose.c @@ -297,7 +297,7 @@ rlm_rcode_t eap_compose(eap_session_t *eap_session) * Radius criteria, EAP-Message is invalid without Message-Authenticator * For EAP_START, send Access-Challenge with EAP Identity request. */ -int eap_start(request_t *request, rlm_eap_method_t const methods[], bool ignore_unknown_types) +rlm_rcode_t eap_start(request_t *request, rlm_eap_method_t const methods[], bool ignore_unknown_types) { fr_pair_t *vp; fr_pair_t *eap_msg; diff --git a/src/lib/eap/compose.h b/src/lib/eap/compose.h index c8dd4534112..e8e6390f035 100644 --- a/src/lib/eap/compose.h +++ b/src/lib/eap/compose.h @@ -56,7 +56,7 @@ typedef struct { #define RAD_REQUEST_OPTION_PROXY_EAP (1 << 16) -int eap_start(request_t *request, rlm_eap_method_t const methods[], bool ignore_unknown_types) CC_HINT(nonnull); +rlm_rcode_t eap_start(request_t *request, rlm_eap_method_t const methods[], bool ignore_unknown_types) CC_HINT(nonnull); rlm_rcode_t eap_continue(eap_session_t *eap_session) CC_HINT(nonnull); rlm_rcode_t eap_fail(eap_session_t *eap_session) CC_HINT(nonnull); rlm_rcode_t eap_success(eap_session_t *eap_session) CC_HINT(nonnull); diff --git a/src/lib/eap_aka_sim/decode.c b/src/lib/eap_aka_sim/decode.c index b5b1bce5b11..ddd06297d8e 100644 --- a/src/lib/eap_aka_sim/decode.c +++ b/src/lib/eap_aka_sim/decode.c @@ -305,7 +305,7 @@ static ssize_t sim_decode_array(TALLOC_CTX *ctx, fr_cursor_t *cursor, uint16_t actual_len; int elements, i; size_t element_len; - ssize_t rcode; + ssize_t ret; FR_PROTO_TRACE("Array attribute"); @@ -343,10 +343,10 @@ static ssize_t sim_decode_array(TALLOC_CTX *ctx, fr_cursor_t *cursor, if (elements < 0) return elements; for (i = 0; i < elements; i++) { - rcode = sim_decode_pair_value(ctx, cursor, parent, p, element_len, end - p, decoder_ctx); - if (rcode < 0) return rcode; + ret = sim_decode_pair_value(ctx, cursor, parent, p, element_len, end - p, decoder_ctx); + if (ret < 0) return ret; - p += rcode; + p += ret; if (!fr_cond_assert(p <= end)) break; } @@ -378,7 +378,7 @@ static ssize_t sim_decode_tlv(TALLOC_CTX *ctx, fr_cursor_t *cursor, fr_dict_attr_t const *child; fr_pair_t *head = NULL; fr_cursor_t tlv_cursor; - ssize_t rcode; + ssize_t ret; if (data_len < 2) { fr_strerror_printf("%s: Insufficient data", __FUNCTION__); @@ -499,9 +499,9 @@ static ssize_t sim_decode_tlv(TALLOC_CTX *ctx, fr_cursor_t *cursor, } FR_PROTO_TRACE("decode context changed %s -> %s", parent->name, child->name); - rcode = sim_decode_pair_value(ctx, &tlv_cursor, child, p + 2, sim_at_len - 2, (end - p) - 2, + ret = sim_decode_pair_value(ctx, &tlv_cursor, child, p + 2, sim_at_len - 2, (end - p) - 2, decoder_ctx); - if (rcode < 0) goto error; + if (ret < 0) goto error; p += sim_at_len; } fr_cursor_head(&tlv_cursor); @@ -855,7 +855,7 @@ static ssize_t sim_decode_pair_internal(TALLOC_CTX *ctx, fr_cursor_t *cursor, fr uint8_t sim_at; size_t sim_at_len; - ssize_t rcode; + ssize_t ret; fr_dict_attr_t const *da; @@ -904,13 +904,13 @@ static ssize_t sim_decode_pair_internal(TALLOC_CTX *ctx, fr_cursor_t *cursor, fr FR_PROTO_TRACE("decode context changed %s -> %s", da->parent->name, da->name); if (da->flags.array) { - rcode = sim_decode_array(ctx, cursor, da, data + 2, sim_at_len - 2, data_len - 2, decoder_ctx); + ret = sim_decode_array(ctx, cursor, da, data + 2, sim_at_len - 2, data_len - 2, decoder_ctx); } else { - rcode = sim_decode_pair_value(ctx, cursor, da, data + 2, sim_at_len - 2, data_len - 2, decoder_ctx); + ret = sim_decode_pair_value(ctx, cursor, da, data + 2, sim_at_len - 2, data_len - 2, decoder_ctx); } - if (rcode < 0) return rcode; + if (ret < 0) return ret; - return 2 + rcode; + return 2 + ret; } /** Decode SIM/AKA/AKA' attributes @@ -963,7 +963,7 @@ ssize_t fr_aka_sim_decode_pair(TALLOC_CTX *ctx, fr_cursor_t *cursor, fr_dict_t c int fr_aka_sim_decode(request_t *request, fr_cursor_t *decoded, fr_dict_t const *dict, uint8_t const *data, size_t data_len, fr_aka_sim_decode_ctx_t *decoder_ctx) { - ssize_t rcode; + ssize_t ret; uint8_t const *p = data; uint8_t const *end = p + data_len; @@ -995,15 +995,15 @@ int fr_aka_sim_decode(request_t *request, fr_cursor_t *decoded, fr_dict_t const * in the SIM/AKA/AKA' dict. */ while (p < end) { - rcode = fr_aka_sim_decode_pair(request->packet, decoded, dict, p, end - p, decoder_ctx); - if (rcode <= 0) { + ret = fr_aka_sim_decode_pair(request->packet, decoded, dict, p, end - p, decoder_ctx); + if (ret <= 0) { RPEDEBUG("Failed decoding AT"); error: fr_cursor_free_list(decoded); /* Free any attributes we added */ return -1; } - p += rcode; + p += ret; fr_assert(p <= end); } diff --git a/src/lib/eap_aka_sim/state_machine.c b/src/lib/eap_aka_sim/state_machine.c index 81e36605b7b..a6186b4d901 100644 --- a/src/lib/eap_aka_sim/state_machine.c +++ b/src/lib/eap_aka_sim/state_machine.c @@ -44,31 +44,31 @@ RCSID("$Id$") * Examples of these are the sub-state machines that deal with clearing * pseudonyms and reauthentication data. */ -typedef rlm_rcode_t(*aka_sim_state_enter_t)(module_ctx_t const *mctx, - request_t *request, eap_session_t *eap_session); - -static rlm_rcode_t common_eap_failure(module_ctx_t const *mctx, request_t *request); -static rlm_rcode_t common_failure_notification(module_ctx_t const *mctx, request_t *request); -static rlm_rcode_t common_eap_success(module_ctx_t const *mctx, request_t *request); -static rlm_rcode_t common_success_notification(module_ctx_t const *mctx, request_t *request); -static rlm_rcode_t common_reauthentication(module_ctx_t const *mctx, request_t *request); -static rlm_rcode_t aka_challenge(module_ctx_t const *mctxd, request_t *request); -static rlm_rcode_t sim_challenge(module_ctx_t const *mctx, request_t *request); -static rlm_rcode_t aka_identity(module_ctx_t const *mctx, request_t *request); -static rlm_rcode_t sim_start(module_ctx_t const *mctx, request_t *request); - -static rlm_rcode_t common_failure_notification_enter(module_ctx_t const *mctx, - request_t *request, eap_session_t *eap_session); -static rlm_rcode_t aka_challenge_enter(module_ctx_t const *mctx, - request_t *request, eap_session_t *eap_session); -static rlm_rcode_t sim_challenge_enter(module_ctx_t const *mctx, - request_t *request, eap_session_t *eap_session); -static rlm_rcode_t common_challenge_enter(module_ctx_t const *mctx, - request_t *request, eap_session_t *eap_session); -static rlm_rcode_t aka_identity_enter(module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session); -static rlm_rcode_t sim_start_enter(module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session); -static rlm_rcode_t common_identity_enter(module_ctx_t const *mctx, - request_t *request, eap_session_t *eap_session); +typedef unlang_action_t(*aka_sim_state_enter_t)(rlm_rcode_t *p_result, module_ctx_t const *mctx, + request_t *request, eap_session_t *eap_session); + +static unlang_action_t common_eap_failure(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request); +static unlang_action_t common_failure_notification(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request); +static unlang_action_t common_eap_success(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request); +static unlang_action_t common_success_notification(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request); +static unlang_action_t common_reauthentication(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request); +static unlang_action_t aka_challenge(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request); +static unlang_action_t sim_challenge(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request); +static unlang_action_t aka_identity(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request); +static unlang_action_t sim_start(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request); + +static unlang_action_t common_failure_notification_enter(rlm_rcode_t *p_result, module_ctx_t const *mctx, + request_t *request, eap_session_t *eap_session); +static unlang_action_t aka_challenge_enter(rlm_rcode_t *p_result, module_ctx_t const *mctx, + request_t *request, eap_session_t *eap_session); +static unlang_action_t sim_challenge_enter(rlm_rcode_t *p_result, module_ctx_t const *mctx, + request_t *request, eap_session_t *eap_session); +static unlang_action_t common_challenge_enter(rlm_rcode_t *p_result, module_ctx_t const *mctx, + request_t *request, eap_session_t *eap_session); +static unlang_action_t aka_identity_enter(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session); +static unlang_action_t sim_start_enter(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session); +static unlang_action_t common_identity_enter(rlm_rcode_t *p_result, module_ctx_t const *mctx, + request_t *request, eap_session_t *eap_session); static module_state_func_table_t const aka_sim_stable_table[] = { { "FAILURE-NOTIFICATION", common_failure_notification }, @@ -123,21 +123,21 @@ static inline void section_rcode_ignored(request_t *request) /** Trigger a state transition to FAILURE-NOTIFICATION if the section returned a failure code * */ -#define section_rcode_process(_inst, _request, _eap_session, _eap_aka_sim_session) \ +#define section_rcode_process(_p_result, _inst, _request, _eap_session, _eap_aka_sim_session) \ { \ if (after_authentication(_eap_aka_sim_session)) { \ switch ((_request)->rcode) { \ case RLM_MODULE_REJECT: \ case RLM_MODULE_DISALLOW: \ eap_aka_sim_session->failure_type = FR_NOTIFICATION_VALUE_TEMPORARILY_DENIED; \ - return common_failure_notification_enter(_inst, _request, _eap_session); \ + return common_failure_notification_enter(_p_result, _inst, _request, _eap_session); \ case RLM_MODULE_NOTFOUND: \ eap_aka_sim_session->failure_type = FR_NOTIFICATION_VALUE_NOT_SUBSCRIBED; \ - return common_failure_notification_enter(_inst, _request, _eap_session); \ + return common_failure_notification_enter(_p_result, _inst, _request, _eap_session); \ case RLM_MODULE_INVALID: \ case RLM_MODULE_FAIL: \ eap_aka_sim_session->failure_type = FR_NOTIFICATION_VALUE_GENERAL_FAILURE_AFTER_AUTHENTICATION;\ - return common_failure_notification_enter(_inst, _request, _eap_session); \ + return common_failure_notification_enter(_p_result, _inst, _request, _eap_session); \ default: \ break; \ } \ @@ -146,7 +146,7 @@ static inline void section_rcode_ignored(request_t *request) case RLM_MODULE_USER_SECTION_REJECT: \ REDEBUG("Section rcode (%s) indicates we should reject the user", \ fr_table_str_by_value(rcode_table, request->rcode, "")); \ - return common_failure_notification_enter(_inst, _request, _eap_session); \ + return common_failure_notification_enter(_p_result, _inst, _request, _eap_session); \ default: \ break; \ } \ @@ -466,7 +466,7 @@ static inline bool after_authentication(eap_aka_sim_session_t *eap_aka_sim_sessi /** Resume after 'store session { ... }' * */ -static rlm_rcode_t session_store_resume(module_ctx_t const *mctx, request_t *request, void *rctx) +static unlang_action_t session_store_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, void *rctx) { aka_sim_state_enter_t state_enter = (aka_sim_state_enter_t)rctx; @@ -484,13 +484,13 @@ static rlm_rcode_t session_store_resume(module_ctx_t const *mctx, request_t *req pair_delete_request(attr_eap_aka_sim_next_reauth_id); - return state_enter(mctx, request, eap_session_get(request->parent)); + return state_enter(p_result, mctx, request, eap_session_get(request->parent)); } /** Resume after 'store pseudonym { ... }' * */ -static rlm_rcode_t pseudonym_store_resume(module_ctx_t const *mctx, request_t *request, void *rctx) +static unlang_action_t pseudonym_store_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, void *rctx) { eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t); eap_session_t *eap_session = eap_session_get(request->parent); @@ -603,7 +603,8 @@ static rlm_rcode_t pseudonym_store_resume(module_ctx_t const *mctx, request_t *r vp->vp_uint16 = 0; } - return unlang_module_yield_to_section(request, + return unlang_module_yield_to_section(p_result, + request, inst->actions.store_session, RLM_MODULE_NOOP, session_store_resume, @@ -612,7 +613,7 @@ static rlm_rcode_t pseudonym_store_resume(module_ctx_t const *mctx, request_t *r } done: - return state_enter(mctx, request, eap_session_get(request->parent)); + return state_enter(p_result, mctx, request, eap_session_get(request->parent)); } /** Implements a set of states for storing pseudonym and fastauth identities @@ -630,7 +631,7 @@ done: * state. * @return RLM_MODULE_HANDLED. */ -static rlm_rcode_t session_and_pseudonym_store(module_ctx_t const *mctx, +static unlang_action_t session_and_pseudonym_store(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session, aka_sim_state_enter_t state_enter) { @@ -654,7 +655,7 @@ static rlm_rcode_t session_and_pseudonym_store(module_ctx_t const *mctx, RWDEBUG("Found empty Pseudonym-Id, and told not to generate one. " "Skipping store pseudonym { ... } section"); - return pseudonym_store_resume(mctx, request, (void *)state_enter); + return pseudonym_store_resume(p_result, mctx, request, (void *)state_enter); } MEM(identity = talloc_array(vp, char, inst->ephemeral_id_length + 2)); @@ -684,7 +685,8 @@ static rlm_rcode_t session_and_pseudonym_store(module_ctx_t const *mctx, MEM(eap_aka_sim_session->pseudonym_sent = talloc_bstrndup(eap_aka_sim_session, vp->vp_strvalue, vp->vp_length)); - return unlang_module_yield_to_section(request, + return unlang_module_yield_to_section(p_result, + request, inst->actions.store_pseudonym, RLM_MODULE_NOOP, pseudonym_store_resume, @@ -692,25 +694,25 @@ static rlm_rcode_t session_and_pseudonym_store(module_ctx_t const *mctx, (void *)state_enter); } - return pseudonym_store_resume(mctx, request, (void *)state_enter); + return pseudonym_store_resume(p_result, mctx, request, (void *)state_enter); } /** Resume after 'clear session { ... }' * */ -static rlm_rcode_t session_clear_resume(module_ctx_t const *mctx, request_t *request, void *rctx) +static unlang_action_t session_clear_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, void *rctx) { aka_sim_state_enter_t state_enter = (aka_sim_state_enter_t)rctx; pair_delete_request(attr_session_id); - return state_enter(mctx, request, eap_session_get(request->parent)); + return state_enter(p_result, mctx, request, eap_session_get(request->parent)); } /** Resume after 'clear pseudonym { ... }' * */ -static rlm_rcode_t pseudonym_clear_resume(module_ctx_t const *mctx, request_t *request, void *rctx) +static unlang_action_t pseudonym_clear_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, void *rctx) { eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t); eap_session_t *eap_session = eap_session_get(request->parent); @@ -734,7 +736,8 @@ static rlm_rcode_t pseudonym_clear_resume(module_ctx_t const *mctx, request_t *r talloc_array_length(eap_aka_sim_session->fastauth_sent) - 1, true); TALLOC_FREE(eap_aka_sim_session->fastauth_sent); - return unlang_module_yield_to_section(request, + return unlang_module_yield_to_section(p_result, + request, inst->actions.clear_session, RLM_MODULE_NOOP, session_clear_resume, @@ -742,7 +745,7 @@ static rlm_rcode_t pseudonym_clear_resume(module_ctx_t const *mctx, request_t *r rctx); } - return state_enter(mctx, request, eap_session_get(request->parent)); + return state_enter(p_result, mctx, request, eap_session_get(request->parent)); } /** Implements a set of states for clearing out pseudonym and fastauth identities @@ -759,7 +762,7 @@ static rlm_rcode_t pseudonym_clear_resume(module_ctx_t const *mctx, request_t *r * state. * @return RLM_MODULE_HANDLED. */ -static rlm_rcode_t session_and_pseudonym_clear(module_ctx_t const *mctx, +static unlang_action_t session_and_pseudonym_clear(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session, aka_sim_state_enter_t state_enter) { @@ -777,7 +780,8 @@ static rlm_rcode_t session_and_pseudonym_clear(module_ctx_t const *mctx, fr_value_box_bstrdup_buffer(vp, &vp->data, NULL, eap_aka_sim_session->pseudonym_sent, true); TALLOC_FREE(eap_aka_sim_session->pseudonym_sent); - return unlang_module_yield_to_section(request, + return unlang_module_yield_to_section(p_result, + request, inst->actions.clear_pseudonym, RLM_MODULE_NOOP, session_clear_resume, @@ -785,7 +789,7 @@ static rlm_rcode_t session_and_pseudonym_clear(module_ctx_t const *mctx, (void *)state_enter); } - return pseudonym_clear_resume(mctx, request, (void *)state_enter); + return pseudonym_clear_resume(p_result, mctx, request, (void *)state_enter); } /** Encode EAP-SIM/AKA['] attributes @@ -894,20 +898,20 @@ static int common_encode(request_t *request, eap_session_t *eap_session, uint16_ /** Send a EAP-Failure message to the supplicant * */ -static rlm_rcode_t common_eap_failure_send(request_t *request, eap_session_t *eap_session) +static unlang_action_t common_eap_failure_send(rlm_rcode_t *p_result, request_t *request, eap_session_t *eap_session) { RDEBUG2("Sending EAP-Failure"); eap_session->this_round->request->code = FR_EAP_CODE_FAILURE; eap_session->finished = true; - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; } /** Send a EAP-Request/(AKA|SIM)-Notification (Failure) message to the supplicant * */ -static rlm_rcode_t common_failure_notification_send(module_ctx_t const *mctx, +static unlang_action_t common_failure_notification_send(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session) { fr_pair_t *vp, *notification_vp; @@ -1002,10 +1006,10 @@ static rlm_rcode_t common_failure_notification_send(module_ctx_t const *mctx, * Encode the packet */ if (common_encode(request, eap_session, FR_SUBTYPE_VALUE_AKA_SIM_NOTIFICATION, NULL, 0) < 0) { - return common_failure_notification_enter(mctx, request, eap_session); + return common_failure_notification_enter(p_result, mctx, request, eap_session); } - return RLM_MODULE_HANDLED; + RETURN_MODULE_HANDLED; } /** Add MPPE keys to the request being sent to the supplicant @@ -1013,7 +1017,7 @@ static rlm_rcode_t common_failure_notification_send(module_ctx_t const *mctx, * The only work to be done is the add the appropriate SEND/RECV * attributes derived from the MSK. */ -static rlm_rcode_t common_eap_success_send(request_t *request, eap_session_t *eap_session) +static unlang_action_t common_eap_success_send(rlm_rcode_t *p_result, request_t *request, eap_session_t *eap_session) { uint8_t *p; eap_aka_sim_session_t *eap_aka_sim_session; @@ -1031,21 +1035,23 @@ static rlm_rcode_t common_eap_success_send(request_t *request, eap_session_t *ea p += EAP_TLS_MPPE_KEY_LEN; eap_add_reply(request->parent, attr_ms_mppe_send_key, p, EAP_TLS_MPPE_KEY_LEN); - return RLM_MODULE_OK; + RETURN_MODULE_OK; } /** Send a EAP-Request/(AKA|SIM)-Notification (Success) message to the supplicant * */ -static rlm_rcode_t common_success_notification_send(module_ctx_t const *mctx, - request_t *request, eap_session_t *eap_session) +static unlang_action_t common_success_notification_send(rlm_rcode_t *p_result, module_ctx_t const *mctx, + request_t *request, eap_session_t *eap_session) { eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque, eap_aka_sim_session_t); fr_pair_t *vp; eap_session->this_round->request->code = FR_EAP_CODE_REQUEST; - if (!fr_cond_assert(after_authentication(eap_aka_sim_session))) return RLM_MODULE_FAIL; + if (!fr_cond_assert(after_authentication(eap_aka_sim_session))) { + RETURN_MODULE_FAIL; + } /* * If we're in this state success bit is @@ -1090,16 +1096,16 @@ static rlm_rcode_t common_success_notification_send(module_ctx_t const *mctx, * Encode the packet */ if (common_encode(request, eap_session, FR_SUBTYPE_VALUE_AKA_SIM_NOTIFICATION, NULL, 0) < 0) { - return common_failure_notification_enter(mctx, request, eap_session); + return common_failure_notification_enter(p_result, mctx, request, eap_session); } - return RLM_MODULE_HANDLED; + RETURN_MODULE_HANDLED; } /** Called after 'store session { ... }' and 'store pseudonym { ... }' * */ -static rlm_rcode_t common_reauthentication_request_send(module_ctx_t const *mctx, +static unlang_action_t common_reauthentication_request_send(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session) { /* @@ -1107,16 +1113,16 @@ static rlm_rcode_t common_reauthentication_request_send(module_ctx_t const *mctx * by the encoder. */ if (common_encode(request, eap_session, FR_SUBTYPE_VALUE_AKA_SIM_REAUTHENTICATION, NULL, 0) < 0) { - return common_failure_notification_enter(mctx, request, eap_session); + return common_failure_notification_enter(p_result, mctx, request, eap_session); } - return RLM_MODULE_HANDLED; + RETURN_MODULE_HANDLED; } /** Send a EAP-Request/(AKA|SIM)-Reauthenticate message to the supplicant * */ -static rlm_rcode_t common_reauthentication_request_compose(module_ctx_t const *mctx, request_t *request, +static unlang_action_t common_reauthentication_request_compose(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session) { eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque, @@ -1166,7 +1172,7 @@ static rlm_rcode_t common_reauthentication_request_compose(module_ctx_t const *m "requesting additional Identity"); fr_pair_list_free(&request->reply_pairs); eap_aka_sim_session->id_req = AKA_SIM_FULLAUTH_ID_REQ; - return common_identity_enter(mctx, request, eap_session); + return common_identity_enter(p_result, mctx, request, eap_session); case AKA_SIM_FULLAUTH_ID_REQ: case AKA_SIM_PERMANENT_ID_REQ: @@ -1174,7 +1180,7 @@ static rlm_rcode_t common_reauthentication_request_compose(module_ctx_t const *m "but received, or were told we received (by policy), " "a fastauth ID. Cannot continue"); failure: - return common_failure_notification_enter(mctx, request, eap_session); + return common_failure_notification_enter(p_result, mctx, request, eap_session); } } if (fr_aka_sim_crypto_kdf_0_reauth(&eap_aka_sim_session->keys) < 0) goto request_new_id; @@ -1283,13 +1289,13 @@ static rlm_rcode_t common_reauthentication_request_compose(module_ctx_t const *m */ eap_aka_sim_session->allow_encrypted = true; - return session_and_pseudonym_store(mctx, request, eap_session, common_reauthentication_request_send); + return session_and_pseudonym_store(p_result, mctx,request, eap_session, common_reauthentication_request_send); } /** Called after 'store session { ... }' and 'store pseudonym { ... }' * */ -static rlm_rcode_t aka_challenge_request_send(module_ctx_t const *mctx, +static unlang_action_t aka_challenge_request_send(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session) { /* @@ -1297,16 +1303,16 @@ static rlm_rcode_t aka_challenge_request_send(module_ctx_t const *mctx, * by the encoder. */ if (common_encode(request, eap_session, FR_SUBTYPE_VALUE_AKA_CHALLENGE, NULL, 0) < 0) { - return common_failure_notification_enter(mctx, request, eap_session); + return common_failure_notification_enter(p_result, mctx, request, eap_session); } - return RLM_MODULE_HANDLED; + RETURN_MODULE_HANDLED; } /** Send a EAP-Request/AKA-Challenge message to the supplicant * */ -static rlm_rcode_t aka_challenge_request_compose(module_ctx_t const *mctx, +static unlang_action_t aka_challenge_request_compose(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session) { eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque, eap_aka_sim_session_t); @@ -1346,7 +1352,7 @@ static rlm_rcode_t aka_challenge_request_compose(module_ctx_t const *mctx, } else { REDEBUG("No network name available, can't set AT_KDF_INPUT"); failure: - return common_failure_notification_enter(mctx, request, eap_session); + return common_failure_notification_enter(p_result, mctx, request, eap_session); } /* @@ -1481,13 +1487,13 @@ static rlm_rcode_t aka_challenge_request_compose(module_ctx_t const *mctx, */ eap_aka_sim_session->allow_encrypted = true; - return session_and_pseudonym_store(mctx, request, eap_session, aka_challenge_request_send); + return session_and_pseudonym_store(p_result, mctx,request, eap_session, aka_challenge_request_send); } /** Called after 'store session { ... }' and 'store pseudonym { ... }' * */ -static rlm_rcode_t sim_challenge_request_send(module_ctx_t const *mctx, +static unlang_action_t sim_challenge_request_send(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session) { eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque, @@ -1499,16 +1505,16 @@ static rlm_rcode_t sim_challenge_request_send(module_ctx_t const *mctx, */ if (common_encode(request, eap_session, FR_SUBTYPE_VALUE_SIM_CHALLENGE, eap_aka_sim_session->keys.gsm.nonce_mt, sizeof(eap_aka_sim_session->keys.gsm.nonce_mt)) < 0) { - return common_failure_notification_enter(mctx, request, eap_session); + return common_failure_notification_enter(p_result, mctx, request, eap_session); } - return RLM_MODULE_HANDLED; + RETURN_MODULE_HANDLED; } /** Send a EAP-Request/SIM-Challenge message to the supplicant * */ -static rlm_rcode_t sim_challenge_request_compose(module_ctx_t const *mctx, +static unlang_action_t sim_challenge_request_compose(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session) { eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque, @@ -1540,7 +1546,7 @@ static rlm_rcode_t sim_challenge_request_compose(module_ctx_t const *mctx, (fr_aka_sim_vector_gsm_from_attrs(request, request->control_pairs, 2, &eap_aka_sim_session->keys, &src) != 0)) { REDEBUG("Failed retrieving SIM vectors"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } fr_aka_sim_crypto_gsm_kdf_0(&eap_aka_sim_session->keys); @@ -1583,7 +1589,7 @@ static rlm_rcode_t sim_challenge_request_compose(module_ctx_t const *mctx, */ eap_aka_sim_session->allow_encrypted = true; - return session_and_pseudonym_store(mctx, request, eap_session, sim_challenge_request_send); + return session_and_pseudonym_store(p_result, mctx,request, eap_session, sim_challenge_request_send); } /** Send a EAP-Request/AKA-Identity message to the supplicant @@ -1612,7 +1618,7 @@ static rlm_rcode_t sim_challenge_request_compose(module_ctx_t const *mctx, * - RLM_MODULE_HANDLED on success. * - anything else on failure. */ -static rlm_rcode_t aka_identity_request_send(module_ctx_t const *mctx, +static unlang_action_t aka_identity_request_send(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session) { eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque, @@ -1638,7 +1644,7 @@ static rlm_rcode_t aka_identity_request_send(module_ctx_t const *mctx, */ if (identity_req_pairs_add(request, eap_aka_sim_session) < 0) { failure: - return common_failure_notification_enter(mctx, request, eap_session); + return common_failure_notification_enter(p_result, mctx, request, eap_session); } eap_aka_sim_session->last_id_req = eap_aka_sim_session->id_req; /* Record what we last requested */ @@ -1664,7 +1670,7 @@ static rlm_rcode_t aka_identity_request_send(module_ctx_t const *mctx, } } - return RLM_MODULE_HANDLED; + RETURN_MODULE_HANDLED; } /** Send a EAP-Request/SIM-Start message to the supplicant @@ -1693,7 +1699,7 @@ static rlm_rcode_t aka_identity_request_send(module_ctx_t const *mctx, * - RLM_MODULE_HANDLED on success. * - anything else on failure. */ -static rlm_rcode_t sim_start_request_send(module_ctx_t const *mctx, +static unlang_action_t sim_start_request_send(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session) { eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque, @@ -1753,7 +1759,7 @@ static rlm_rcode_t sim_start_request_send(module_ctx_t const *mctx, */ if (identity_req_pairs_add(request, eap_aka_sim_session) < 0) { failure: - return common_failure_notification_enter(mctx, request, eap_session); + return common_failure_notification_enter(p_result, mctx, request, eap_session); } eap_aka_sim_session->last_id_req = eap_aka_sim_session->id_req; /* Record what we last requested */ @@ -1762,7 +1768,7 @@ static rlm_rcode_t sim_start_request_send(module_ctx_t const *mctx, */ if (common_encode(request, eap_session, FR_SUBTYPE_VALUE_SIM_START, NULL, 0) < 0) goto failure; - return RLM_MODULE_HANDLED; + RETURN_MODULE_HANDLED; } /** Print debugging information, and write new state to eap_session->process @@ -1788,20 +1794,21 @@ static inline void state_transition(request_t *request, eap_session_t *eap_sessi /** Resume after 'send EAP-Failure { ... }' * */ -static rlm_rcode_t common_eap_failure_enter_resume(UNUSED module_ctx_t const *mctx, - request_t *request, UNUSED void *rctx) +static unlang_action_t common_eap_failure_enter_resume(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, + request_t *request, UNUSED void *rctx) { eap_session_t *eap_session = eap_session_get(request->parent); section_rcode_ignored(request); - return common_eap_failure_send(request, eap_session); + return common_eap_failure_send(p_result, request, eap_session); } /** Enter EAP-FAILURE state * */ -static rlm_rcode_t common_eap_failure_enter(module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session) +static unlang_action_t common_eap_failure_enter(rlm_rcode_t *p_result, module_ctx_t const *mctx, + request_t *request, eap_session_t *eap_session) { eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t); eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque, eap_aka_sim_session_t); @@ -1816,13 +1823,14 @@ static rlm_rcode_t common_eap_failure_enter(module_ctx_t const *mctx, request_t * we sent are now invalid. */ if (eap_aka_sim_session->pseudonym_sent || eap_aka_sim_session->fastauth_sent) { - return session_and_pseudonym_clear(mctx, + return session_and_pseudonym_clear(p_result, mctx, request, eap_session, common_eap_failure_enter); /* come back when we're done */ } state_transition(request, eap_session, common_eap_failure); - return unlang_module_yield_to_section(request, + return unlang_module_yield_to_section(p_result, + request, inst->actions.send_eap_failure, RLM_MODULE_NOOP, common_eap_failure_enter_resume, @@ -1834,8 +1842,8 @@ static rlm_rcode_t common_eap_failure_enter(module_ctx_t const *mctx, request_t * * Ignores return code from send Failure-Notification { ... } section. */ -static rlm_rcode_t common_failure_notification_enter_resume(module_ctx_t const *mctx, - request_t *request, UNUSED void *rctx) +static unlang_action_t common_failure_notification_enter_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, + request_t *request, UNUSED void *rctx) { eap_session_t *eap_session = eap_session_get(request->parent); @@ -1850,14 +1858,14 @@ static rlm_rcode_t common_failure_notification_enter_resume(module_ctx_t const * * If there's an issue composing the failure * message just send an EAP-Failure instead. */ - return common_failure_notification_send(mctx, request, eap_session); + return common_failure_notification_send(p_result, mctx,request, eap_session); } /** Enter the FAILURE-NOTIFICATION state * */ -static rlm_rcode_t common_failure_notification_enter(module_ctx_t const *mctx, - request_t *request, eap_session_t *eap_session) +static unlang_action_t common_failure_notification_enter(rlm_rcode_t *p_result, module_ctx_t const *mctx, + request_t *request, eap_session_t *eap_session) { eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t); eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque, eap_aka_sim_session_t); @@ -1867,7 +1875,7 @@ static rlm_rcode_t common_failure_notification_enter(module_ctx_t const *mctx, * we sent are now invalid. */ if (eap_aka_sim_session->pseudonym_sent || eap_aka_sim_session->fastauth_sent) { - return session_and_pseudonym_clear(mctx, request, eap_session, + return session_and_pseudonym_clear(p_result, mctx,request, eap_session, common_failure_notification_enter); /* come back when we're done */ } @@ -1878,7 +1886,7 @@ static rlm_rcode_t common_failure_notification_enter(module_ctx_t const *mctx, * garbage from the supplicant. */ if (eap_session->process == common_failure_notification) { - return common_eap_failure_enter(mctx, request, eap_session); + return common_eap_failure_enter(p_result, mctx, request, eap_session); } /* @@ -1886,7 +1894,8 @@ static rlm_rcode_t common_failure_notification_enter(module_ctx_t const *mctx, */ state_transition(request, eap_session, common_failure_notification); - return unlang_module_yield_to_section(request, + return unlang_module_yield_to_section(p_result, + request, inst->actions.send_failure_notification, RLM_MODULE_NOOP, common_failure_notification_enter_resume, @@ -1897,7 +1906,7 @@ static rlm_rcode_t common_failure_notification_enter(module_ctx_t const *mctx, /** Resume after 'send EAP-Success { ... }' * */ -static rlm_rcode_t common_eap_success_enter_resume(module_ctx_t const *mctx, +static unlang_action_t common_eap_success_enter_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, UNUSED void *rctx) { eap_session_t *eap_session = eap_session_get(request->parent); @@ -1935,22 +1944,23 @@ static rlm_rcode_t common_eap_success_enter_resume(module_ctx_t const *mctx, * the end of authentication. */ } else { - section_rcode_process(mctx, request, eap_session, eap_aka_sim_session); + section_rcode_process(p_result, mctx,request, eap_session, eap_aka_sim_session); } - return common_eap_success_send(request, eap_session); + return common_eap_success_send(p_result, request, eap_session); } /** Enter EAP-SUCCESS state * */ -static rlm_rcode_t common_eap_success_enter(module_ctx_t const *mctx, request_t *request, - eap_session_t *eap_session) +static unlang_action_t common_eap_success_enter(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, + eap_session_t *eap_session) { eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t); state_transition(request, eap_session, common_eap_success); - return unlang_module_yield_to_section(request, + return unlang_module_yield_to_section(p_result, + request, inst->actions.send_eap_success, RLM_MODULE_NOOP, common_eap_success_enter_resume, @@ -1961,28 +1971,29 @@ static rlm_rcode_t common_eap_success_enter(module_ctx_t const *mctx, request_t /** Resume after 'send Success-Notification { ... }' * */ -static rlm_rcode_t common_success_notification_enter_resume(module_ctx_t const *mctx, +static unlang_action_t common_success_notification_enter_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, UNUSED void *rctx) { eap_session_t *eap_session = eap_session_get(request->parent); eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque, eap_aka_sim_session_t); - section_rcode_process(mctx, request, eap_session, eap_aka_sim_session); + section_rcode_process(p_result, mctx,request, eap_session, eap_aka_sim_session); - return common_success_notification_send(mctx, request, eap_session); + return common_success_notification_send(p_result, mctx, request, eap_session); } /** Enter the SUCCESS-NOTIFICATION state * */ -static rlm_rcode_t common_success_notification_enter(module_ctx_t const *mctx, +static unlang_action_t common_success_notification_enter(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session) { eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t); state_transition(request, eap_session, common_success_notification); - return unlang_module_yield_to_section(request, + return unlang_module_yield_to_section(p_result, + request, inst->actions.send_success_notification, RLM_MODULE_NOOP, common_success_notification_enter_resume, @@ -1993,7 +2004,7 @@ static rlm_rcode_t common_success_notification_enter(module_ctx_t const *mctx, /** Resume after 'send Reauthentication-Request { ... }' * */ -static rlm_rcode_t common_reauthentication_send_resume(module_ctx_t const *mctx, +static unlang_action_t common_reauthentication_send_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, UNUSED void *rctx) { eap_session_t *eap_session = eap_session_get(request->parent); @@ -2020,7 +2031,7 @@ static rlm_rcode_t common_reauthentication_send_resume(module_ctx_t const *mctx, fr_pair_list_free(&request->reply_pairs); eap_aka_sim_session->id_req = AKA_SIM_FULLAUTH_ID_REQ; - return common_identity_enter(mctx, request, eap_session); + return common_identity_enter(p_result, mctx, request, eap_session); case AKA_SIM_FULLAUTH_ID_REQ: case AKA_SIM_PERMANENT_ID_REQ: @@ -2028,7 +2039,7 @@ static rlm_rcode_t common_reauthentication_send_resume(module_ctx_t const *mctx, REDEBUG("Last requested Full-Auth-Id or Permanent-Identity, " "but received a Fast-Auth-Id. Cannot continue"); failure: - return common_failure_notification_enter(mctx, request, eap_session); + return common_failure_notification_enter(p_result, mctx, request, eap_session); } break; @@ -2046,14 +2057,14 @@ static rlm_rcode_t common_reauthentication_send_resume(module_ctx_t const *mctx, case RLM_MODULE_NOOP: case RLM_MODULE_OK: case RLM_MODULE_UPDATED: - return common_reauthentication_request_compose(mctx, request, eap_session); + return common_reauthentication_request_compose(p_result, mctx, request, eap_session); } } /** Resume after 'load session { ... }' * */ -static rlm_rcode_t session_load_resume(module_ctx_t const *mctx, +static unlang_action_t session_load_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, UNUSED void *rctx) { eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t); @@ -2088,13 +2099,13 @@ static rlm_rcode_t session_load_resume(module_ctx_t const *mctx, fr_table_str_by_value(rcode_table, request->rcode, "")); fr_pair_list_free(&request->reply_pairs); eap_aka_sim_session->id_req = AKA_SIM_FULLAUTH_ID_REQ; - return common_identity_enter(mctx, request, eap_session); + return common_identity_enter(p_result, mctx, request, eap_session); case AKA_SIM_FULLAUTH_ID_REQ: case AKA_SIM_PERMANENT_ID_REQ: REDEBUG("Last requested Full-Auth-Id or Permanent-Identity, " "but received a Fast-Auth-Id. Cannot continue"); - return common_failure_notification_enter(mctx, request, eap_session); + return common_failure_notification_enter(p_result, mctx, request, eap_session); } break; @@ -2105,7 +2116,7 @@ static rlm_rcode_t session_load_resume(module_ctx_t const *mctx, case RLM_MODULE_REJECT: case RLM_MODULE_DISALLOW: reject: - return common_failure_notification_enter(mctx, request, eap_session); + return common_failure_notification_enter(p_result, mctx, request, eap_session); /* * Everything OK @@ -2113,7 +2124,8 @@ static rlm_rcode_t session_load_resume(module_ctx_t const *mctx, case RLM_MODULE_OK: case RLM_MODULE_UPDATED: reauthenticate: - return unlang_module_yield_to_section(request, + return unlang_module_yield_to_section(p_result, + request, inst->actions.send_reauthentication_request, RLM_MODULE_NOOP, common_reauthentication_send_resume, @@ -2127,7 +2139,7 @@ static rlm_rcode_t session_load_resume(module_ctx_t const *mctx, /** Resume after 'load pseudonym { ... }' * */ -static rlm_rcode_t pseudonym_load_resume(module_ctx_t const *mctx, +static unlang_action_t pseudonym_load_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, void *rctx) { eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t); @@ -2144,7 +2156,7 @@ static rlm_rcode_t pseudonym_load_resume(module_ctx_t const *mctx, */ if (!inst->actions.load_pseudonym) { next_state: - return state_enter(mctx, request, eap_session); + return state_enter(p_result, mctx, request, eap_session); } switch (request->rcode) { @@ -2162,12 +2174,12 @@ static rlm_rcode_t pseudonym_load_resume(module_ctx_t const *mctx, fr_table_str_by_value(rcode_table, request->rcode, "")); fr_pair_list_free(&request->reply_pairs); eap_aka_sim_session->id_req = AKA_SIM_FULLAUTH_ID_REQ; - return common_identity_enter(mctx, request, eap_session); + return common_identity_enter(p_result, mctx, request, eap_session); case AKA_SIM_PERMANENT_ID_REQ: REDEBUG("Last requested a Permanent-Identity, but received a Pseudonym. Cannot continue"); failure: - return common_failure_notification_enter(mctx, request, eap_session); + return common_failure_notification_enter(p_result, mctx, request, eap_session); } break; @@ -2192,7 +2204,7 @@ static rlm_rcode_t pseudonym_load_resume(module_ctx_t const *mctx, /** Enter the REAUTHENTICATION state * */ -static rlm_rcode_t common_reauthentication_enter(module_ctx_t const *mctx, +static unlang_action_t common_reauthentication_enter(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session) { eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t); @@ -2210,7 +2222,8 @@ static rlm_rcode_t common_reauthentication_enter(module_ctx_t const *mctx, MEM(pair_update_request(&vp, attr_session_id) >= 0); fr_pair_value_memdup(vp, eap_aka_sim_session->keys.identity, eap_aka_sim_session->keys.identity_len, true); - return unlang_module_yield_to_section(request, + return unlang_module_yield_to_section(p_result, + request, inst->actions.load_session, RLM_MODULE_NOOP, session_load_resume, @@ -2221,21 +2234,21 @@ static rlm_rcode_t common_reauthentication_enter(module_ctx_t const *mctx, /** Resume after 'send Challenge-Request { ... }' * */ -static rlm_rcode_t aka_challenge_enter_resume(module_ctx_t const *mctx, request_t *request, UNUSED void *rctx) +static unlang_action_t aka_challenge_enter_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, UNUSED void *rctx) { eap_session_t *eap_session = eap_session_get(request->parent); eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque, eap_aka_sim_session_t); - section_rcode_process(mctx, request, eap_session, eap_aka_sim_session); + section_rcode_process(p_result, mctx,request, eap_session, eap_aka_sim_session); - return aka_challenge_request_compose(mctx, request, eap_session); + return aka_challenge_request_compose(p_result, mctx, request, eap_session); } /** Enter the AKA-CHALLENGE state * */ -static rlm_rcode_t aka_challenge_enter(module_ctx_t const *mctx, +static unlang_action_t aka_challenge_enter(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session) { eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t); @@ -2248,7 +2261,7 @@ static rlm_rcode_t aka_challenge_enter(module_ctx_t const *mctx, * that failed. */ if (eap_aka_sim_session->pseudonym_sent || eap_aka_sim_session->fastauth_sent) { - return session_and_pseudonym_clear(mctx, request, eap_session, aka_challenge_enter); /* come back when we're done */ + return session_and_pseudonym_clear(p_result, mctx,request, eap_session, aka_challenge_enter); /* come back when we're done */ } state_transition(request, eap_session, aka_challenge); @@ -2302,7 +2315,8 @@ static rlm_rcode_t aka_challenge_enter(module_ctx_t const *mctx, vp->vp_bool = true; } - return unlang_module_yield_to_section(request, + return unlang_module_yield_to_section(p_result, + request, inst->actions.send_challenge_request, RLM_MODULE_NOOP, aka_challenge_enter_resume, @@ -2313,21 +2327,21 @@ static rlm_rcode_t aka_challenge_enter(module_ctx_t const *mctx, /** Resume after 'send Challenge-Request { ... }' * */ -static rlm_rcode_t sim_challenge_enter_resume(module_ctx_t const *mctx, request_t *request, UNUSED void *rctx) +static unlang_action_t sim_challenge_enter_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, UNUSED void *rctx) { eap_session_t *eap_session = eap_session_get(request->parent); eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque, eap_aka_sim_session_t); - section_rcode_process(mctx, request, eap_session, eap_aka_sim_session); + section_rcode_process(p_result, mctx,request, eap_session, eap_aka_sim_session); - return sim_challenge_request_compose(mctx, request, eap_session); + return sim_challenge_request_compose(p_result, mctx, request, eap_session); } /** Enter the SIM-CHALLENGE state * */ -static rlm_rcode_t sim_challenge_enter(module_ctx_t const *mctx, +static unlang_action_t sim_challenge_enter(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session) { eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t); @@ -2341,7 +2355,7 @@ static rlm_rcode_t sim_challenge_enter(module_ctx_t const *mctx, * that failed. */ if (eap_aka_sim_session->pseudonym_sent || eap_aka_sim_session->fastauth_sent) { - return session_and_pseudonym_clear(mctx, request, eap_session, sim_challenge_enter); /* come back when we're done */ + return session_and_pseudonym_clear(p_result, mctx,request, eap_session, sim_challenge_enter); /* come back when we're done */ } state_transition(request, eap_session, sim_challenge); @@ -2355,7 +2369,8 @@ static rlm_rcode_t sim_challenge_enter(module_ctx_t const *mctx, vp->vp_bool = true; } - return unlang_module_yield_to_section(request, + return unlang_module_yield_to_section(p_result, + request, inst->actions.send_challenge_request, RLM_MODULE_NOOP, sim_challenge_enter_resume, @@ -2368,44 +2383,44 @@ static rlm_rcode_t sim_challenge_enter(module_ctx_t const *mctx, * Called by functions which are common to both the EAP-SIM and EAP-AKA state machines * to enter the correct challenge state. */ -static rlm_rcode_t common_challenge_enter(module_ctx_t const *mctx, +static unlang_action_t common_challenge_enter(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session) { switch (eap_session->type) { case FR_EAP_METHOD_SIM: - return sim_challenge_enter(mctx, request, eap_session); + return sim_challenge_enter(p_result, mctx, request, eap_session); case FR_EAP_METHOD_AKA: case FR_EAP_METHOD_AKA_PRIME: - return aka_challenge_enter(mctx, request, eap_session); + return aka_challenge_enter(p_result, mctx, request, eap_session); default: break; } fr_assert(0); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /** Resume after 'send Identity-Request { ... }' * */ -static rlm_rcode_t aka_identity_enter_resume(module_ctx_t const *mctx, +static unlang_action_t aka_identity_enter_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, UNUSED void *rctx) { eap_session_t *eap_session = eap_session_get(request->parent); eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque, eap_aka_sim_session_t); - section_rcode_process(mctx, request, eap_session, eap_aka_sim_session); + section_rcode_process(p_result, mctx,request, eap_session, eap_aka_sim_session); - return aka_identity_request_send(mctx, request, eap_session); + return aka_identity_request_send(p_result, mctx,request, eap_session); } /** Enter the AKA-IDENTITY state * */ -static rlm_rcode_t aka_identity_enter(module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session) +static unlang_action_t aka_identity_enter(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session) { eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t); @@ -2416,7 +2431,8 @@ static rlm_rcode_t aka_identity_enter(module_ctx_t const *mctx, request_t *reque * then run that, otherwise just run the normal * identity request section. */ - return unlang_module_yield_to_section(request, + return unlang_module_yield_to_section(p_result, + request, inst->actions.aka.send_aka_identity_request ? inst->actions.aka.send_aka_identity_request: inst->actions.send_identity_request, @@ -2429,28 +2445,29 @@ static rlm_rcode_t aka_identity_enter(module_ctx_t const *mctx, request_t *reque /** Resume after 'send Start { ... }' * */ -static rlm_rcode_t sim_start_enter_resume(module_ctx_t const *mctx, +static unlang_action_t sim_start_enter_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, UNUSED void *rctx) { eap_session_t *eap_session = eap_session_get(request->parent); eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque, eap_aka_sim_session_t); - section_rcode_process(mctx, request, eap_session, eap_aka_sim_session); + section_rcode_process(p_result, mctx,request, eap_session, eap_aka_sim_session); - return sim_start_request_send(mctx, request, eap_session); + return sim_start_request_send(p_result, mctx,request, eap_session); } /** Enter the SIM-START state * */ -static rlm_rcode_t sim_start_enter(module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session) +static unlang_action_t sim_start_enter(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session) { eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t); state_transition(request, eap_session, sim_start); - return unlang_module_yield_to_section(request, + return unlang_module_yield_to_section(p_result, + request, inst->actions.sim.send_sim_start_request ? inst->actions.sim.send_sim_start_request: inst->actions.send_identity_request, @@ -2465,29 +2482,29 @@ static rlm_rcode_t sim_start_enter(module_ctx_t const *mctx, request_t *request, * Called by functions which are common to both the EAP-SIM and EAP-AKA state machines * to enter the correct Identity-Request state. */ -static rlm_rcode_t common_identity_enter(module_ctx_t const *mctx, +static unlang_action_t common_identity_enter(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session) { switch (eap_session->type) { case FR_EAP_METHOD_SIM: - return sim_start_enter(mctx, request, eap_session); + return sim_start_enter(p_result, mctx, request, eap_session); case FR_EAP_METHOD_AKA: case FR_EAP_METHOD_AKA_PRIME: - return aka_identity_enter(mctx, request, eap_session); + return aka_identity_enter(p_result, mctx, request, eap_session); default: break; } fr_assert(0); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /** Process a EAP-Response/(AKA|SIM)-Reauthentication message - The response to our EAP-Request/(AKA|SIM)-Reauthentication message * */ -static rlm_rcode_t common_reauthentication_response_process(module_ctx_t const *mctx, request_t *request, +static unlang_action_t common_reauthentication_response_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session) { eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque, @@ -2502,7 +2519,7 @@ static rlm_rcode_t common_reauthentication_response_process(module_ctx_t const * if (!mac) { REDEBUG("Missing AT_MAC attribute"); failure: - return common_failure_notification_enter(mctx, request, eap_session); + return common_failure_notification_enter(p_result, mctx, request, eap_session); } if (mac->vp_length != AKA_SIM_MAC_DIGEST_SIZE) { REDEBUG("MAC has incorrect length, expected %u bytes got %zu bytes", @@ -2575,7 +2592,7 @@ static rlm_rcode_t common_reauthentication_response_process(module_ctx_t const * fr_aka_sim_vector_umts_reauth_clear(&eap_aka_sim_session->keys); eap_aka_sim_session->allow_encrypted = false; - return aka_challenge_enter(mctx, request, eap_session); + return aka_challenge_enter(p_result, mctx, request, eap_session); } /* @@ -2590,7 +2607,7 @@ static rlm_rcode_t common_reauthentication_response_process(module_ctx_t const * RDEBUG("We wanted to use protected result indications, but peer does not"); eap_aka_sim_session->send_result_ind = false; } else { - return common_success_notification_enter(mctx, request, eap_session); + return common_success_notification_enter(p_result, mctx, request, eap_session); } } else if (fr_pair_find_by_da(&from_peer, attr_eap_aka_sim_result_ind)) { RDEBUG("Peer wanted to use protected result indications, but we do not"); @@ -2598,14 +2615,14 @@ static rlm_rcode_t common_reauthentication_response_process(module_ctx_t const * eap_aka_sim_session->reauthentication_success = true; - return common_eap_success_enter(mctx, request, eap_session); + return common_eap_success_enter(p_result, mctx, request, eap_session); } /** Process a EAP-Response/AKA-Challenge message - The response to our EAP-Request/AKA-Challenge message * * Verify that MAC, and RES match what we expect. */ -static rlm_rcode_t aka_challenge_response_process(module_ctx_t const *mctx, +static unlang_action_t aka_challenge_response_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session) { eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque, @@ -2620,7 +2637,7 @@ static rlm_rcode_t aka_challenge_response_process(module_ctx_t const *mctx, if (!mac) { REDEBUG("Missing AT_MAC attribute"); failure: - return common_failure_notification_enter(mctx, request, eap_session); + return common_failure_notification_enter(p_result, mctx, request, eap_session); } if (mac->vp_length != AKA_SIM_MAC_DIGEST_SIZE) { REDEBUG("MAC has incorrect length, expected %u bytes got %zu bytes", @@ -2718,20 +2735,20 @@ static rlm_rcode_t aka_challenge_response_process(module_ctx_t const *mctx, RDEBUG("We wanted to use protected result indications, but peer does not"); eap_aka_sim_session->send_result_ind = false; } else { - return common_success_notification_enter(mctx, request, eap_session); + return common_success_notification_enter(p_result, mctx, request, eap_session); } } else if (fr_pair_find_by_da(&from_peer, attr_eap_aka_sim_result_ind)) { RDEBUG("Peer wanted to use protected result indications, but we do not"); } - return common_eap_success_enter(mctx, request, eap_session); + return common_eap_success_enter(p_result, mctx, request, eap_session); } /** Process a EAP-Response/SIM-Challenge message - The response to our EAP-Request/SIM-Challenge message * * Verify that MAC, and RES match what we expect. */ -static rlm_rcode_t sim_challenge_response_process(module_ctx_t const *mctx, +static unlang_action_t sim_challenge_response_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session) { eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque, @@ -2755,7 +2772,7 @@ static rlm_rcode_t sim_challenge_response_process(module_ctx_t const *mctx, if (!mac) { REDEBUG("Missing AT_MAC attribute"); failure: - return common_failure_notification_enter(mctx, request, eap_session); + return common_failure_notification_enter(p_result, mctx, request, eap_session); } if (mac->vp_length != AKA_SIM_MAC_DIGEST_SIZE) { REDEBUG("MAC has incorrect length, expected %u bytes got %zu bytes", @@ -2796,13 +2813,13 @@ static rlm_rcode_t sim_challenge_response_process(module_ctx_t const *mctx, RDEBUG("We wanted to use protected result indications, but peer does not"); eap_aka_sim_session->send_result_ind = false; } else { - return common_success_notification_enter(mctx, request, eap_session); + return common_success_notification_enter(p_result, mctx, request, eap_session); } } else if (fr_pair_find_by_da(&from_peer, attr_eap_aka_sim_result_ind)) { RDEBUG("Peer wanted to use protected result indications, but we do not"); } - return common_eap_success_enter(mctx, request, eap_session); + return common_eap_success_enter(p_result, mctx, request, eap_session); } /** Process a EAP-Response/AKA-Identity message i.e. an EAP-AKA Identity-Response @@ -2815,7 +2832,7 @@ static rlm_rcode_t sim_challenge_response_process(module_ctx_t const *mctx, * - Pseudonym - Call 'load pseudonym { ... }' * - Permanent - Enter the CHALLENGE state. */ -static rlm_rcode_t aka_identity_response_process(module_ctx_t const *mctx, +static unlang_action_t aka_identity_response_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session) { eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t); @@ -2832,7 +2849,7 @@ static rlm_rcode_t aka_identity_response_process(module_ctx_t const *mctx, eap_session->this_round->response) < 0) { RPEDEBUG("Failed updating checkcode"); failure: - return common_failure_notification_enter(mctx, request, eap_session); + return common_failure_notification_enter(p_result, mctx, request, eap_session); } } @@ -2868,7 +2885,7 @@ static rlm_rcode_t aka_identity_response_process(module_ctx_t const *mctx, fr_table_str_by_value(rcode_table, request->rcode, ""), fr_table_str_by_value(fr_aka_sim_id_request_table, eap_aka_sim_session->id_req, "")); } - return aka_identity_enter(mctx, request, eap_session); + return aka_identity_enter(p_result, mctx, request, eap_session); } /* @@ -2878,7 +2895,7 @@ static rlm_rcode_t aka_identity_response_process(module_ctx_t const *mctx, identity_type = fr_pair_find_by_da(&from_peer, attr_eap_aka_sim_identity_type); if (identity_type) switch (identity_type->vp_uint32) { case FR_IDENTITY_TYPE_VALUE_FASTAUTH: - return common_reauthentication_enter(mctx, request, eap_session); + return common_reauthentication_enter(p_result, mctx, request, eap_session); /* * It's a pseudonym, which now needs resolving. @@ -2886,7 +2903,8 @@ static rlm_rcode_t aka_identity_response_process(module_ctx_t const *mctx, * if pseudonym resolution went ok. */ case FR_IDENTITY_TYPE_VALUE_PSEUDONYM: - return unlang_module_yield_to_section(request, + return unlang_module_yield_to_section(p_result, + request, inst->actions.load_pseudonym, RLM_MODULE_NOOP, pseudonym_load_resume, @@ -2896,7 +2914,7 @@ static rlm_rcode_t aka_identity_response_process(module_ctx_t const *mctx, break; } - return aka_challenge_enter(mctx, request, eap_session); + return aka_challenge_enter(p_result, mctx, request, eap_session); } /** Helper function to check for the presence and length of AT_SELECTED_VERSION and copy its value into the keys structure @@ -2995,7 +3013,7 @@ static int sim_start_nonce_mt_check(request_t *request, fr_pair_t *from_peer, * - Pseudonym - Verify selected version and AT_NONCE_MT, then call 'load pseudonym { ... }' * - Permanent - Verify selected version and AT_NONCE_MT, then enter the CHALLENGE state. */ -static rlm_rcode_t sim_start_response_process(module_ctx_t const *mctx, +static unlang_action_t sim_start_response_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, eap_session_t *eap_session) { eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t); @@ -3032,13 +3050,13 @@ static rlm_rcode_t sim_start_response_process(module_ctx_t const *mctx, case AKA_SIM_PERMANENT_ID_REQ: REDEBUG("Peer sent no usable identities"); failure: - return common_failure_notification_enter(mctx, request, eap_session); + return common_failure_notification_enter(p_result, mctx, request, eap_session); } RDEBUG2("Previous section returned (%s), requesting next most permissive identity (%s)", fr_table_str_by_value(rcode_table, request->rcode, ""), fr_table_str_by_value(fr_aka_sim_id_request_table, eap_aka_sim_session->id_req, "")); } - return sim_start_enter(mctx, request, eap_session); + return sim_start_enter(p_result, mctx, request, eap_session); } /* @@ -3057,7 +3075,7 @@ static rlm_rcode_t sim_start_response_process(module_ctx_t const *mctx, */ if (fr_pair_find_by_da(&from_peer, attr_eap_aka_sim_nonce_mt)) { REDEBUG("AT_NONCE_MT is not allowed in EAP-Response/SIM-Reauthentication messages"); - return common_failure_notification_enter(mctx, request, eap_session); + return common_failure_notification_enter(p_result, mctx, request, eap_session); } /* @@ -3069,10 +3087,10 @@ static rlm_rcode_t sim_start_response_process(module_ctx_t const *mctx, */ if (fr_pair_find_by_da(&from_peer, attr_eap_aka_sim_selected_version)) { REDEBUG("AT_SELECTED_VERSION is not allowed in EAP-Response/SIM-Reauthentication messages"); - return common_failure_notification_enter(mctx, request, eap_session); + return common_failure_notification_enter(p_result, mctx, request, eap_session); } - return common_reauthentication_enter(mctx, request, eap_session); + return common_reauthentication_enter(p_result, mctx, request, eap_session); /* * It's a pseudonym, which now needs resolving. @@ -3083,7 +3101,8 @@ static rlm_rcode_t sim_start_response_process(module_ctx_t const *mctx, if (sim_start_selected_version_check(request, from_peer, eap_aka_sim_session) < 0) goto failure; if (sim_start_nonce_mt_check(request, from_peer, eap_aka_sim_session) < 0) goto failure; - return unlang_module_yield_to_section(request, + return unlang_module_yield_to_section(p_result, + request, inst->actions.load_pseudonym, RLM_MODULE_NOOP, pseudonym_load_resume, @@ -3105,14 +3124,14 @@ static rlm_rcode_t sim_start_response_process(module_ctx_t const *mctx, break; } - return sim_challenge_enter(mctx, request, eap_session); + return sim_challenge_enter(p_result, mctx, request, eap_session); } /** Resume after 'recv Failure-Notification-Ack { ... }' * * - Enter the EAP-FAILURE state. */ -static rlm_rcode_t common_failure_notification_recv_resume(module_ctx_t const *mctx, +static unlang_action_t common_failure_notification_recv_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, UNUSED void *rctx) { eap_session_t *eap_session = eap_session_get(request->parent); @@ -3122,14 +3141,14 @@ static rlm_rcode_t common_failure_notification_recv_resume(module_ctx_t const *m /* * Case 2 where we're allowed to send an EAP-Failure */ - return common_eap_failure_enter(mctx, request, eap_session); + return common_eap_failure_enter(p_result, mctx, request, eap_session); } /** Resume after 'recv Success-Notification-Ack { ... }' * * - Enter the EAP-SUCCESS state. */ -static rlm_rcode_t common_success_notification_ack_recv_resume(module_ctx_t const *mctx, +static unlang_action_t common_success_notification_ack_recv_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, UNUSED void *rctx) { eap_session_t *eap_session = eap_session_get(request->parent); @@ -3141,7 +3160,7 @@ static rlm_rcode_t common_success_notification_ack_recv_resume(module_ctx_t cons * next packet after we send our success notification * and always send a success. */ - return common_eap_success_enter(mctx, request, eap_session); + return common_eap_success_enter(p_result, mctx, request, eap_session); } /** Resume after 'recv Challenge-Response { ... }' @@ -3149,16 +3168,16 @@ static rlm_rcode_t common_success_notification_ack_recv_resume(module_ctx_t cons * - If the previous section returned a failure rcode, enter the FAILURE-NOTIFICATION state. * - ...or call a function to process the contents of the AKA-Challenge message. */ -static rlm_rcode_t aka_challenge_response_recv_resume(module_ctx_t const *mctx, +static unlang_action_t aka_challenge_response_recv_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, UNUSED void *rctx) { eap_session_t *eap_session = eap_session_get(request->parent); eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque, eap_aka_sim_session_t); - section_rcode_process(mctx, request, eap_session, eap_aka_sim_session); + section_rcode_process(p_result, mctx,request, eap_session, eap_aka_sim_session); - return aka_challenge_response_process(mctx, request, eap_session); + return aka_challenge_response_process(p_result, mctx,request, eap_session); } /** Resume after 'recv Challenge-Response { ... }' @@ -3166,16 +3185,16 @@ static rlm_rcode_t aka_challenge_response_recv_resume(module_ctx_t const *mctx, * - If the previous section returned a failure rcode, enter the FAILURE-NOTIFICATION state. * - ...or call a function to process the contents of the SIM-Challenge message. */ -static rlm_rcode_t sim_challenge_response_recv_resume(module_ctx_t const *mctx, +static unlang_action_t sim_challenge_response_recv_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, UNUSED void *rctx) { eap_session_t *eap_session = eap_session_get(request->parent); eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque, eap_aka_sim_session_t); - section_rcode_process(mctx, request, eap_session, eap_aka_sim_session); + section_rcode_process(p_result, mctx,request, eap_session, eap_aka_sim_session); - return sim_challenge_response_process(mctx, request, eap_session); + return sim_challenge_response_process(p_result, mctx,request, eap_session); } /** Resume after 'recv Identity-Response { ... }' or 'recv AKA-Identity { ... }' @@ -3183,16 +3202,16 @@ static rlm_rcode_t sim_challenge_response_recv_resume(module_ctx_t const *mctx, * - If the previous section returned a failure rcode, enter the FAILURE-NOTIFICATION state. * - ...or call a function to process the contents of the AKA-Identity message, mainly the AT_IDENTITY value. */ -static rlm_rcode_t aka_identity_response_recv_resume(module_ctx_t const *mctx, +static unlang_action_t aka_identity_response_recv_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, UNUSED void *rctx) { eap_session_t *eap_session = eap_session_get(request->parent); eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque, eap_aka_sim_session_t); - section_rcode_process(mctx, request, eap_session, eap_aka_sim_session); + section_rcode_process(p_result, mctx,request, eap_session, eap_aka_sim_session); - return aka_identity_response_process(mctx, request, eap_session); + return aka_identity_response_process(p_result, mctx,request, eap_session); } /** Resume after 'recv Identity-Response { ... }' or 'recv SIM-Start { ... }' @@ -3200,23 +3219,23 @@ static rlm_rcode_t aka_identity_response_recv_resume(module_ctx_t const *mctx, * - If the previous section returned a failure rcode, enter the FAILURE-NOTIFICATION state. * - ...or call a function to process the contents of the SIM-Start message, mainly the AT_IDENTITY value. */ -static rlm_rcode_t sim_start_response_recv_resume(module_ctx_t const *mctx, +static unlang_action_t sim_start_response_recv_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, UNUSED void *rctx) { eap_session_t *eap_session = eap_session_get(request->parent); eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque, eap_aka_sim_session_t); - section_rcode_process(mctx, request, eap_session, eap_aka_sim_session); + section_rcode_process(p_result, mctx,request, eap_session, eap_aka_sim_session); - return sim_start_response_process(mctx, request, eap_session); + return sim_start_response_process(p_result, mctx,request, eap_session); } /** Resume after 'recv Authentication-Reject { ... }' * * - Enter the FAILURE-NOTIFICATION state. */ -static rlm_rcode_t aka_authentication_reject_recv_resume(module_ctx_t const *mctx, +static unlang_action_t aka_authentication_reject_recv_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, UNUSED void *rctx) { eap_session_t *eap_session = eap_session_get(request->parent); @@ -3226,7 +3245,7 @@ static rlm_rcode_t aka_authentication_reject_recv_resume(module_ctx_t const *mct /* * Case 2 where we're allowed to send an EAP-Failure */ - return common_eap_failure_enter(mctx, request, eap_session); + return common_eap_failure_enter(p_result, mctx, request, eap_session); } /** Resume after 'recv Synchronization-Failure { ... }' @@ -3239,7 +3258,7 @@ static rlm_rcode_t aka_authentication_reject_recv_resume(module_ctx_t const *mct * then enter the FAILURE-NOTIFICATION state. * - ...or enter the AKA-CHALLENGE state. */ -static rlm_rcode_t aka_synchronization_failure_recv_resume(module_ctx_t const *mctx, +static unlang_action_t aka_synchronization_failure_recv_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, UNUSED void *rctx) { eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t); @@ -3248,7 +3267,7 @@ static rlm_rcode_t aka_synchronization_failure_recv_resume(module_ctx_t const *m eap_aka_sim_session_t); fr_pair_t *vp; - section_rcode_process(mctx, request, eap_session, eap_aka_sim_session); + section_rcode_process(p_result, mctx,request, eap_session, eap_aka_sim_session); /* * If there's no section to handle this, then no resynchronisation @@ -3260,7 +3279,7 @@ static rlm_rcode_t aka_synchronization_failure_recv_resume(module_ctx_t const *m */ if (!inst->actions.aka.recv_syncronization_failure || eap_aka_sim_session->prev_recv_sync_failure) { failure: - return common_failure_notification_enter(mctx, request, eap_session); + return common_failure_notification_enter(p_result, mctx, request, eap_session); } /* @@ -3281,21 +3300,21 @@ static rlm_rcode_t aka_synchronization_failure_recv_resume(module_ctx_t const *m * EAP-Response/AKA-Synchronization-Failure (Section 9.6), and the * server proceeds with a new EAP-Request/AKA-Challenge." */ - return aka_challenge_enter(mctx, request, eap_session); + return aka_challenge_enter(p_result, mctx, request, eap_session); } /** Resume after 'recv Client-Error { ... }' * * - Enter the EAP-FAILURE state. */ -static rlm_rcode_t common_client_error_recv_resume(module_ctx_t const *mctx, +static unlang_action_t common_client_error_recv_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, UNUSED void *rctx) { eap_session_t *eap_session = eap_session_get(request->parent); section_rcode_ignored(request); - return common_eap_failure_enter(mctx, request, eap_session); + return common_eap_failure_enter(p_result, mctx, request, eap_session); } /** Resume after 'recv Reauthentication-Response { ... }' @@ -3305,23 +3324,23 @@ static rlm_rcode_t common_client_error_recv_resume(module_ctx_t const *mctx, * - ...or call the EAP-Request/Reauthentication-Response function to act on the * contents of the response. */ -static rlm_rcode_t common_reauthentication_response_recv_resume(module_ctx_t const *mctx, +static unlang_action_t common_reauthentication_response_recv_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, UNUSED void *rctx) { eap_session_t *eap_session = eap_session_get(request->parent); eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque, eap_aka_sim_session_t); - section_rcode_process(mctx, request, eap_session, eap_aka_sim_session); + section_rcode_process(p_result, mctx,request, eap_session, eap_aka_sim_session); - return common_reauthentication_response_process(mctx, request, eap_session); + return common_reauthentication_response_process(p_result, mctx,request, eap_session); } /** Decode the peer's response * * This is called by the state_* functions to decode the peer's response. */ -static rlm_rcode_t common_decode(fr_pair_t **subtype_vp, fr_pair_t **vps, - module_ctx_t const *mctx, request_t *request) +static unlang_action_t common_decode(fr_pair_t **subtype_vp, fr_pair_t **vps, + rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { eap_session_t *eap_session = eap_session_get(request->parent); eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque, @@ -3352,7 +3371,7 @@ static rlm_rcode_t common_decode(fr_pair_t **subtype_vp, fr_pair_t **vps, if (ret < 0) { RPEDEBUG2("Failed decoding attributes"); failure: - return common_failure_notification_enter(mctx, request, eap_session); + return common_failure_notification_enter(p_result, mctx, request, eap_session); } /* vps is the data from the client */ aka_vps = fr_cursor_next(&cursor); @@ -3370,7 +3389,7 @@ static rlm_rcode_t common_decode(fr_pair_t **subtype_vp, fr_pair_t **vps, RDEBUG2("Received EAP-Response/%pV", &(*subtype_vp)->data); - return RLM_MODULE_OK; + RETURN_MODULE_OK; } /** FAILURE state - State machine exit point after sending EAP-Failure @@ -3379,10 +3398,10 @@ static rlm_rcode_t common_decode(fr_pair_t **subtype_vp, fr_pair_t **vps, * termination state. Could equally be a NULL pointer, but then on a logic error * we'd get a SEGV instead of a more friendly assert/failure rcode. */ -static rlm_rcode_t common_eap_failure(UNUSED module_ctx_t const *mctx, UNUSED request_t *request) +static unlang_action_t common_eap_failure(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, UNUSED request_t *request) { fr_assert(0); /* Should never actually be called */ - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /** FAILURE-NOTIFICATION state - Continue the state machine after receiving a response to our EAP-Request/(AKA|SIM)-Notification @@ -3391,25 +3410,28 @@ static rlm_rcode_t common_eap_failure(UNUSED module_ctx_t const *mctx, UNUSED re * - EAP-Response/SIM-Client-Error - Call 'recv Failure-Notification-Ack { ... }' * - Anything else, enter the FAILURE-NOTIFICATION state. */ -static rlm_rcode_t common_failure_notification(module_ctx_t const *mctx, request_t *request) +static unlang_action_t common_failure_notification(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { - rlm_rcode_t rcode; eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t); eap_session_t *eap_session = eap_session_get(request->parent); fr_pair_t *subtype_vp = NULL; fr_pair_t *vps; - rcode = common_decode(&subtype_vp, &vps, mctx, request); - if (rcode != RLM_MODULE_OK) return rcode; + common_decode(&subtype_vp, &vps, p_result, mctx, request); + if (*p_result != RLM_MODULE_OK) return UNLANG_ACTION_CALCULATE_RESULT; #ifdef __clang_analyzer__ - if (!subtype_vp) return RLM_MODULE_FAIL; + if (!subtype_vp) { + RETURN_MODULE_FAIL; + } #endif + switch (subtype_vp->vp_uint16) { case FR_SUBTYPE_VALUE_AKA_SIM_NOTIFICATION: RDEBUG2("Failure-Notification ACKed, sending EAP-Failure"); - return unlang_module_yield_to_section(request, + return unlang_module_yield_to_section(p_result, + request, inst->actions.recv_failure_notification_ack, RLM_MODULE_NOOP, common_failure_notification_recv_resume, @@ -3418,7 +3440,7 @@ static rlm_rcode_t common_failure_notification(module_ctx_t const *mctx, request default: RWDEBUG("Failure-Notification not ACKed correctly, sending EAP-Failure anyway"); - return common_eap_failure_enter(mctx, request, eap_session); + return common_eap_failure_enter(p_result, mctx, request, eap_session); } } @@ -3428,21 +3450,22 @@ static rlm_rcode_t common_failure_notification(module_ctx_t const *mctx, request * termination state. Could equally be a NULL pointer, but then on a logic error * we'd get a SEGV instead of a more friendly assert/failure rcode. */ -static rlm_rcode_t common_eap_success(UNUSED module_ctx_t const *mctx, UNUSED request_t *request) +static unlang_action_t common_eap_success(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, UNUSED request_t *request) { fr_assert(0); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /** SUCCESS-NOTIFICATION state - Continue the state machine after receiving a response to our EAP-Request/(AKA|SIM)-Notification * * - Call 'recv Success-Notification-Ack { ... }' */ -static rlm_rcode_t common_success_notification(module_ctx_t const *mctx, request_t *request) +static unlang_action_t common_success_notification(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t); - return unlang_module_yield_to_section(request, + return unlang_module_yield_to_section(p_result, + request, inst->actions.recv_success_notification_ack, RLM_MODULE_NOOP, common_success_notification_ack_recv_resume, @@ -3459,9 +3482,8 @@ static rlm_rcode_t common_success_notification(module_ctx_t const *mctx, request * send a EAP-Request/(SIM|AKA)-Notification indicating a General Failure. * - Anything else, enter the FAILURE-NOTIFICATION state. */ -static rlm_rcode_t common_reauthentication(module_ctx_t const *mctx, request_t *request) +static unlang_action_t common_reauthentication(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { - rlm_rcode_t rcode; eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t); eap_session_t *eap_session = eap_session_get(request->parent); eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque, @@ -3470,11 +3492,13 @@ static rlm_rcode_t common_reauthentication(module_ctx_t const *mctx, request_t * fr_pair_t *subtype_vp = NULL; fr_pair_t *from_peer; - rcode = common_decode(&subtype_vp, &from_peer, mctx, request); - if (rcode != RLM_MODULE_OK) return rcode; + common_decode(&subtype_vp, &from_peer, p_result, mctx, request); + if (*p_result != RLM_MODULE_OK) return UNLANG_ACTION_CALCULATE_RESULT; #ifdef __clang_analyzer__ - if (!subtype_vp) return RLM_MODULE_FAIL; + if (!subtype_vp) { + RETURN_MODULE_FAIL; + } #endif /* * These aren't allowed in Reauthentication responses as they don't apply: @@ -3488,7 +3512,8 @@ static rlm_rcode_t common_reauthentication(module_ctx_t const *mctx, request_t * * AT_COUNTER_TOO_SMALL is handled * in common_reauthentication_response_process. */ - return unlang_module_yield_to_section(request, + return unlang_module_yield_to_section(p_result, + request, inst->actions.recv_reauthentication_response, RLM_MODULE_NOOP, common_reauthentication_response_recv_resume, @@ -3503,7 +3528,8 @@ static rlm_rcode_t common_reauthentication(module_ctx_t const *mctx, request_t * eap_aka_sim_session->allow_encrypted = false; - return unlang_module_yield_to_section(request, + return unlang_module_yield_to_section(p_result, + request, inst->actions.recv_client_error, RLM_MODULE_NOOP, common_client_error_recv_resume, @@ -3517,7 +3543,7 @@ static rlm_rcode_t common_reauthentication(module_ctx_t const *mctx, request_t * default: REDEBUG("Unexpected subtype %pV", &subtype_vp->data); eap_aka_sim_session->allow_encrypted = false; - return common_failure_notification_enter(mctx, request, eap_session); + return common_failure_notification_enter(p_result, mctx, request, eap_session); } } @@ -3532,9 +3558,8 @@ static rlm_rcode_t common_reauthentication(module_ctx_t const *mctx, request_t * * send a EAP-Request/AKA-Notification indicating a General Failure. * - Anything else, enter the FAILURE-NOTIFICATION state. */ -static rlm_rcode_t aka_challenge(module_ctx_t const *mctx, request_t *request) +static unlang_action_t aka_challenge(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { - rlm_rcode_t rcode; eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t); eap_session_t *eap_session = eap_session_get(request->parent); eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque, eap_aka_sim_session_t); @@ -3543,15 +3568,19 @@ static rlm_rcode_t aka_challenge(module_ctx_t const *mctx, request_t *request) fr_pair_t *vp; fr_pair_t *from_peer; - rcode = common_decode(&subtype_vp, &from_peer, mctx, request); - if (rcode != RLM_MODULE_OK) return rcode; + common_decode(&subtype_vp, &from_peer, p_result, mctx, request); + if (*p_result != RLM_MODULE_OK) return UNLANG_ACTION_CALCULATE_RESULT; #ifdef __clang_analyzer__ - if (!subtype_vp) return RLM_MODULE_FAIL; + if (!subtype_vp) { + RETURN_MODULE_FAIL; + } #endif + switch (subtype_vp->vp_uint16) { case FR_SUBTYPE_VALUE_AKA_CHALLENGE: - return unlang_module_yield_to_section(request, + return unlang_module_yield_to_section(p_result, + request, inst->actions.recv_challenge_response, RLM_MODULE_NOOP, aka_challenge_response_recv_resume, @@ -3564,7 +3593,8 @@ static rlm_rcode_t aka_challenge(module_ctx_t const *mctx, request_t *request) case FR_SUBTYPE_VALUE_AKA_AUTHENTICATION_REJECT: eap_aka_sim_session->allow_encrypted = false; - return unlang_module_yield_to_section(request, + return unlang_module_yield_to_section(p_result, + request, inst->actions.aka.recv_authentication_reject, RLM_MODULE_NOOP, aka_authentication_reject_recv_resume, @@ -3581,7 +3611,7 @@ static rlm_rcode_t aka_challenge(module_ctx_t const *mctx, request_t *request) if (!vp) { REDEBUG("EAP-Response/AKA-Synchronisation-Failure missing AT_AUTS"); failure: - return common_failure_notification_enter(mctx, request, eap_session); + return common_failure_notification_enter(p_result, mctx, request, eap_session); } switch (fr_aka_sim_umts_resync_from_attrs(&new_sqn, @@ -3611,7 +3641,8 @@ static rlm_rcode_t aka_challenge(module_ctx_t const *mctx, request_t *request) goto failure; } - return unlang_module_yield_to_section(request, + return unlang_module_yield_to_section(p_result, + request, inst->actions.aka.recv_syncronization_failure, RLM_MODULE_NOOP, aka_synchronization_failure_recv_resume, @@ -3627,7 +3658,8 @@ static rlm_rcode_t aka_challenge(module_ctx_t const *mctx, request_t *request) eap_aka_sim_session->allow_encrypted = false; - return unlang_module_yield_to_section(request, + return unlang_module_yield_to_section(p_result, + request, inst->actions.recv_client_error, RLM_MODULE_NOOP, common_client_error_recv_resume, @@ -3653,9 +3685,8 @@ static rlm_rcode_t aka_challenge(module_ctx_t const *mctx, request_t *request) * send a EAP-Request/SIM-Notification indicating a General Failure. * - Anything else, enter the FAILURE-NOTIFICATION state. */ -static rlm_rcode_t sim_challenge(module_ctx_t const *mctx, request_t *request) +static unlang_action_t sim_challenge(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { - rlm_rcode_t rcode; eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t); eap_session_t *eap_session = eap_session_get(request->parent); eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque, @@ -3664,15 +3695,19 @@ static rlm_rcode_t sim_challenge(module_ctx_t const *mctx, request_t *request) fr_pair_t *subtype_vp = NULL; fr_pair_t *from_peer; - rcode = common_decode(&subtype_vp, &from_peer, mctx, request); - if (rcode != RLM_MODULE_OK) return rcode; + common_decode(&subtype_vp, &from_peer, p_result, mctx, request); + if (*p_result != RLM_MODULE_OK) return UNLANG_ACTION_CALCULATE_RESULT; #ifdef __clang_analyzer__ - if (!subtype_vp) return RLM_MODULE_FAIL; + if (!subtype_vp) { + RETURN_MODULE_FAIL; + } #endif + switch (subtype_vp->vp_uint16) { case FR_SUBTYPE_VALUE_SIM_CHALLENGE: - return unlang_module_yield_to_section(request, + return unlang_module_yield_to_section(p_result, + request, inst->actions.recv_challenge_response, RLM_MODULE_NOOP, sim_challenge_response_recv_resume, @@ -3687,7 +3722,8 @@ static rlm_rcode_t sim_challenge(module_ctx_t const *mctx, request_t *request) eap_aka_sim_session->allow_encrypted = false; - return unlang_module_yield_to_section(request, + return unlang_module_yield_to_section(p_result, + request, inst->actions.recv_client_error, RLM_MODULE_NOOP, common_client_error_recv_resume, @@ -3703,7 +3739,7 @@ static rlm_rcode_t sim_challenge(module_ctx_t const *mctx, request_t *request) eap_aka_sim_session->allow_encrypted = false; - return common_failure_notification_enter(mctx, request, eap_session); + return common_failure_notification_enter(p_result, mctx, request, eap_session); } } @@ -3720,9 +3756,8 @@ static rlm_rcode_t sim_challenge(module_ctx_t const *mctx, request_t *request) * send a EAP-Request/SIM-Notification indicating a General Failure. * - Anything else, enter the FAILURE-NOTIFICATION state. */ -static rlm_rcode_t aka_identity(module_ctx_t const *mctx, request_t *request) +static unlang_action_t aka_identity(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { - rlm_rcode_t rcode; eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t); eap_session_t *eap_session = eap_session_get(request->parent); eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque, @@ -3730,11 +3765,13 @@ static rlm_rcode_t aka_identity(module_ctx_t const *mctx, request_t *request) fr_pair_t *subtype_vp = NULL; fr_pair_t *from_peer; - rcode = common_decode(&subtype_vp, &from_peer, mctx, request); - if (rcode != RLM_MODULE_OK) return rcode; + common_decode(&subtype_vp, &from_peer, p_result, mctx, request); + if (*p_result != RLM_MODULE_OK) return UNLANG_ACTION_CALCULATE_RESULT; #ifdef __clang_analyzer__ - if (!subtype_vp) return RLM_MODULE_FAIL; + if (!subtype_vp) { + RETURN_MODULE_FAIL; + } #endif switch (subtype_vp->vp_uint16) { @@ -3757,7 +3794,7 @@ static rlm_rcode_t aka_identity(module_ctx_t const *mctx, request_t *request) * AT_IDENTITY is defined in Section 4.1. */ REDEBUG("EAP-Response/Identity does not contain AT_IDENTITY"); - return common_failure_notification_enter(mctx, request, eap_session); + return common_failure_notification_enter(p_result, mctx, request, eap_session); } /* @@ -3777,7 +3814,8 @@ static rlm_rcode_t aka_identity(module_ctx_t const *mctx, request_t *request) identity_to_crypto_identity(request, eap_aka_sim_session, (uint8_t const *)id->vp_strvalue, id->vp_length); - return unlang_module_yield_to_section(request, + return unlang_module_yield_to_section(p_result, + request, inst->actions.aka.recv_aka_identity_response? inst->actions.aka.recv_aka_identity_response: inst->actions.recv_identity_response, @@ -3797,7 +3835,8 @@ static rlm_rcode_t aka_identity(module_ctx_t const *mctx, request_t *request) case FR_SUBTYPE_VALUE_AKA_SIM_CLIENT_ERROR: client_error_debug(request, from_peer); - return unlang_module_yield_to_section(request, + return unlang_module_yield_to_section(p_result, + request, inst->actions.recv_client_error, RLM_MODULE_NOOP, common_client_error_recv_resume, @@ -3810,7 +3849,7 @@ static rlm_rcode_t aka_identity(module_ctx_t const *mctx, request_t *request) * send an EAP-Failure in this case. */ REDEBUG("Unexpected subtype %pV", &subtype_vp->data); - return common_failure_notification_enter(mctx, request, eap_session); + return common_failure_notification_enter(p_result, mctx, request, eap_session); } } @@ -3827,9 +3866,8 @@ static rlm_rcode_t aka_identity(module_ctx_t const *mctx, request_t *request) * send a EAP-Request/SIM-Notification indicating a General Failure. * - Anything else, enter the FAILURE-NOTIFICATION state. */ -static rlm_rcode_t sim_start(module_ctx_t const *mctx, request_t *request) +static unlang_action_t sim_start(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { - rlm_rcode_t rcode; eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t); eap_session_t *eap_session = eap_session_get(request->parent); eap_aka_sim_session_t *eap_aka_sim_session = talloc_get_type_abort(eap_session->opaque, @@ -3838,11 +3876,13 @@ static rlm_rcode_t sim_start(module_ctx_t const *mctx, request_t *request) fr_pair_t *subtype_vp = NULL; fr_pair_t *from_peer; - rcode = common_decode(&subtype_vp, &from_peer, mctx, request); - if (rcode != RLM_MODULE_OK) return rcode; + common_decode(&subtype_vp, &from_peer, p_result, mctx, request); + if (*p_result != RLM_MODULE_OK) return UNLANG_ACTION_CALCULATE_RESULT; #ifdef __clang_analyzer__ - if (!subtype_vp) return RLM_MODULE_FAIL; + if (!subtype_vp) { + RETURN_MODULE_FAIL; + } #endif switch (subtype_vp->vp_uint16) { @@ -3862,7 +3902,7 @@ static rlm_rcode_t sim_start(module_ctx_t const *mctx, request_t *request) * AT_IDENTITY is defined in Section 4.1. */ REDEBUG("EAP-Response/SIM/Start does not contain AT_IDENTITY"); - return common_failure_notification_enter(mctx, request, eap_session); + return common_failure_notification_enter(p_result, mctx, request, eap_session); } /* @@ -3882,7 +3922,8 @@ static rlm_rcode_t sim_start(module_ctx_t const *mctx, request_t *request) identity_to_crypto_identity(request, eap_aka_sim_session, (uint8_t const *)id->vp_strvalue, id->vp_length); - return unlang_module_yield_to_section(request, + return unlang_module_yield_to_section(p_result, + request, inst->actions.sim.recv_sim_start_response? inst->actions.sim.recv_sim_start_response: inst->actions.recv_identity_response, @@ -3902,7 +3943,8 @@ static rlm_rcode_t sim_start(module_ctx_t const *mctx, request_t *request) case FR_SUBTYPE_VALUE_AKA_SIM_CLIENT_ERROR: client_error_debug(request, from_peer); - return unlang_module_yield_to_section(request, + return unlang_module_yield_to_section(p_result, + request, inst->actions.recv_client_error, RLM_MODULE_NOOP, common_client_error_recv_resume, @@ -3915,7 +3957,7 @@ static rlm_rcode_t sim_start(module_ctx_t const *mctx, request_t *request) * send an EAP-Failure in this case. */ REDEBUG("Unexpected subtype %pV", &subtype_vp->data); - return common_failure_notification_enter(mctx, request, eap_session); + return common_failure_notification_enter(p_result, mctx, request, eap_session); } } @@ -3929,7 +3971,7 @@ static rlm_rcode_t sim_start(module_ctx_t const *mctx, request_t *request) * - If identity is a fastauth identity, enter the REAUTHENTICATE state. * - If identity is a permanent identity, enter the CHALLENGE state. */ -static rlm_rcode_t common_eap_identity_resume(module_ctx_t const *mctx, request_t *request, UNUSED void *rctx) +static unlang_action_t common_eap_identity_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, UNUSED void *rctx) { eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t); eap_session_t *eap_session = eap_session_get(request->parent); @@ -3939,7 +3981,7 @@ static rlm_rcode_t common_eap_identity_resume(module_ctx_t const *mctx, request_ fr_aka_sim_method_hint_t running, hinted; fr_pair_t *from_peer = request->request_pairs; - section_rcode_process(mctx, request, eap_session, eap_aka_sim_session); + section_rcode_process(p_result, mctx,request, eap_session, eap_aka_sim_session); /* * Ignore attempts to change the EAP-Type @@ -4002,7 +4044,7 @@ static rlm_rcode_t common_eap_identity_resume(module_ctx_t const *mctx, request_ default: fr_assert(0); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* @@ -4059,7 +4101,7 @@ static rlm_rcode_t common_eap_identity_resume(module_ctx_t const *mctx, request_ * can 'decorate' the identity in the identity * response. */ - if (eap_aka_sim_session->id_req != AKA_SIM_NO_ID_REQ) return common_identity_enter(mctx, request, eap_session); + if (eap_aka_sim_session->id_req != AKA_SIM_NO_ID_REQ) return common_identity_enter(p_result, mctx, request, eap_session); /* * If the identity looks like a fast re-auth id @@ -4068,7 +4110,7 @@ static rlm_rcode_t common_eap_identity_resume(module_ctx_t const *mctx, request_ identity_type = fr_pair_find_by_da(&from_peer, attr_eap_aka_sim_identity_type); if (identity_type) switch (identity_type->vp_uint32) { case FR_IDENTITY_TYPE_VALUE_FASTAUTH: - return common_reauthentication_enter(mctx, request, eap_session); + return common_reauthentication_enter(p_result, mctx, request, eap_session); /* * It's a pseudonym, which now needs resolving. @@ -4076,7 +4118,8 @@ static rlm_rcode_t common_eap_identity_resume(module_ctx_t const *mctx, request_ * if pseudonym resolution went ok. */ case FR_IDENTITY_TYPE_VALUE_PSEUDONYM: - return unlang_module_yield_to_section(request, + return unlang_module_yield_to_section(p_result, + request, inst->actions.load_pseudonym, RLM_MODULE_NOOP, pseudonym_load_resume, @@ -4090,7 +4133,7 @@ static rlm_rcode_t common_eap_identity_resume(module_ctx_t const *mctx, request_ break; } - return common_challenge_enter(mctx, request, eap_session); + return common_challenge_enter(p_result, mctx, request, eap_session); } /** Zero out the eap_aka_sim_session when we free it to clear knowledge of secret keys @@ -4109,7 +4152,7 @@ static int _eap_aka_sim_session_free(eap_aka_sim_session_t *eap_aka_sim_session) * - Process the incoming EAP-Identity-Response * - Start EAP-SIM/EAP-AKA/EAP-AKA' state machine optionally calling 'recv Identity-Response { ... }' */ -rlm_rcode_t aka_sim_state_machine_start(module_ctx_t const *mctx, request_t *request) +unlang_action_t aka_sim_state_machine_start(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { eap_aka_sim_common_conf_t *inst = talloc_get_type_abort(mctx->instance, eap_aka_sim_common_conf_t); eap_session_t *eap_session = eap_session_get(request->parent); @@ -4136,7 +4179,7 @@ rlm_rcode_t aka_sim_state_machine_start(module_ctx_t const *mctx, request_t *req */ if (!eap_session->identity) { REDEBUG("All SIM or AKA exchanges must begin with a EAP-Response/Identity message"); - return common_failure_notification_enter(mctx, request, eap_session); + return common_failure_notification_enter(p_result, mctx, request, eap_session); } /* @@ -4169,7 +4212,8 @@ rlm_rcode_t aka_sim_state_machine_start(module_ctx_t const *mctx, request_t *req * Running the same section as Identity-Response * makes policies significantly easier. */ - return unlang_module_yield_to_section(request, + return unlang_module_yield_to_section(p_result, + request, inst->actions.recv_identity_response, RLM_MODULE_NOOP, common_eap_identity_resume, diff --git a/src/lib/eap_aka_sim/state_machine.h b/src/lib/eap_aka_sim/state_machine.h index c20839fbef9..6f474af9c46 100644 --- a/src/lib/eap_aka_sim/state_machine.h +++ b/src/lib/eap_aka_sim/state_machine.h @@ -179,4 +179,4 @@ typedef struct { /* * The main entry point */ -rlm_rcode_t aka_sim_state_machine_start(module_ctx_t const *mctx, request_t *request); +unlang_action_t aka_sim_state_machine_start(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request); diff --git a/src/lib/io/master.c b/src/lib/io/master.c index b65d533ea31..07ee059ce41 100644 --- a/src/lib/io/master.c +++ b/src/lib/io/master.c @@ -175,15 +175,15 @@ static int8_t pending_packet_cmp(void const *one, void const *two) { fr_io_pending_packet_t const *a = talloc_get_type_abort_const(one, fr_io_pending_packet_t); fr_io_pending_packet_t const *b = talloc_get_type_abort_const(two, fr_io_pending_packet_t); - int rcode; + int ret; /* * Higher priority elements are larger than lower * priority elements. So if "a" is larger than "b", we * wish to prefer "a". */ - rcode = COMPARE_PREFER_LARGER(a->priority, b->priority); - if (rcode != 0) return rcode; + ret = COMPARE_PREFER_LARGER(a->priority, b->priority); + if (ret != 0) return ret; /* * Smaller numbers mean packets were received earlier. @@ -221,21 +221,21 @@ static int8_t pending_client_cmp(void const *one, void const *two) static int8_t address_cmp(void const *one, void const *two) { - int rcode; + int ret; fr_io_address_t const *a = talloc_get_type_abort_const(one, fr_io_address_t); fr_io_address_t const *b = talloc_get_type_abort_const(two, fr_io_address_t);; - rcode = STABLE_COMPARE(a->socket.inet.src_port, b->socket.inet.src_port); - if (rcode != 0) return rcode; + ret = STABLE_COMPARE(a->socket.inet.src_port, b->socket.inet.src_port); + if (ret != 0) return ret; - rcode = STABLE_COMPARE(a->socket.inet.dst_port, b->socket.inet.dst_port); - if (rcode != 0) return rcode; + ret = STABLE_COMPARE(a->socket.inet.dst_port, b->socket.inet.dst_port); + if (ret != 0) return ret; - rcode = STABLE_COMPARE(a->socket.inet.ifindex, b->socket.inet.ifindex); - if (rcode != 0) return rcode; + ret = STABLE_COMPARE(a->socket.inet.ifindex, b->socket.inet.ifindex); + if (ret != 0) return ret; - rcode = fr_ipaddr_cmp(&a->socket.inet.src_ipaddr, &b->socket.inet.src_ipaddr); - if (rcode != 0) return rcode; + ret = fr_ipaddr_cmp(&a->socket.inet.src_ipaddr, &b->socket.inet.src_ipaddr); + if (ret != 0) return ret; return fr_ipaddr_cmp(&a->socket.inet.dst_ipaddr, &b->socket.inet.dst_ipaddr); } @@ -267,7 +267,7 @@ static int track_cmp(void const *one, void const *two) { fr_io_track_t const *a = talloc_get_type_abort_const(one, fr_io_track_t); fr_io_track_t const *b = talloc_get_type_abort_const(two, fr_io_track_t); - int rcode; + int ret; fr_assert(a->client != NULL); fr_assert(b->client != NULL); @@ -279,8 +279,8 @@ static int track_cmp(void const *one, void const *two) /* * Unconnected sockets must check src/dst ip/port. */ - rcode = address_cmp(a->address, b->address); - if (rcode != 0) return rcode; + ret = address_cmp(a->address, b->address); + if (ret != 0) return ret; /* * Call the per-protocol comparison function. @@ -460,7 +460,7 @@ static fr_io_connection_t *fr_io_connection_alloc(fr_io_instance_t const *inst, fr_io_address_t *address, fr_io_connection_t *nak) { - int rcode; + int ret; fr_io_connection_t *connection; dl_module_inst_t *dl_inst = NULL; fr_listen_t *li; @@ -746,11 +746,11 @@ static fr_io_connection_t *fr_io_connection_alloc(fr_io_instance_t const *inst, */ pthread_mutex_lock(&client->mutex); if (nak) (void) fr_hash_table_delete(client->ht, nak); - rcode = fr_hash_table_insert(client->ht, connection); + ret = fr_hash_table_insert(client->ht, connection); client->ready_to_delete = false; pthread_mutex_unlock(&client->mutex); - if (rcode < 0) { + if (ret < 0) { ERROR("proto_%s - Failed inserting connection into tracking table. Closing it, and discarding all packets for connection %s.", inst->app_io->name, connection->name); goto cleanup; } @@ -2504,10 +2504,10 @@ static int mod_close(fr_listen_t *li) get_inst(li, &inst, NULL, &connection, &child); if (inst->app_io->close) { - int rcode; + int ret; - rcode = inst->app_io->close(child); - if (rcode < 0) return rcode; + ret = inst->app_io->close(child); + if (ret < 0) return ret; } else { close(child->fd); // child->fd = -1; diff --git a/src/lib/io/worker.c b/src/lib/io/worker.c index b6d7311a36e..66d64c2b1de 100644 --- a/src/lib/io/worker.c +++ b/src/lib/io/worker.c @@ -897,7 +897,7 @@ redo: /* * Everything else, run the request. */ - final = request->async->process(&(module_ctx_t){ .instance = request->async->process_inst }, request); + request->async->process(&final, &(module_ctx_t){ .instance = request->async->process_inst }, request); /* * Figure out what to do next. diff --git a/src/lib/server/auth.c b/src/lib/server/auth.c index 2a3ea8737bc..427c390063f 100644 --- a/src/lib/server/auth.c +++ b/src/lib/server/auth.c @@ -45,7 +45,7 @@ RCSID("$Id$") * Run a virtual server auth and postauth * */ -rlm_rcode_t rad_virtual_server(request_t *request) +unlang_action_t rad_virtual_server(rlm_rcode_t *p_result, request_t *request) { fr_pair_t *vp, *username, *parent_username = NULL; rlm_rcode_t final; @@ -154,7 +154,7 @@ rlm_rcode_t rad_virtual_server(request_t *request) runit: if (!request->async) { #ifdef __clang_analyzer__ - if (!request->parent) return RLM_MODULE_FAIL; + if (!request->parent) RETURN_MODULE_FAIL; #endif fr_assert(request->parent != NULL); @@ -163,21 +163,21 @@ runit: } RDEBUG("server %s {", cf_section_name2(request->server_cs)); - final = request->async->process(&(module_ctx_t){ .instance = request->async->process_inst }, request); + request->async->process(&final, &(module_ctx_t){ .instance = request->async->process_inst }, request); RDEBUG("} # server %s", cf_section_name2(request->server_cs)); fr_cond_assert(final == RLM_MODULE_OK); if (!request->reply->code || (request->reply->code == FR_CODE_ACCESS_REJECT)) { - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; } if (request->reply->code == FR_CODE_ACCESS_CHALLENGE) { - return RLM_MODULE_HANDLED; + RETURN_MODULE_HANDLED; } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } /* diff --git a/src/lib/server/auth.h b/src/lib/server/auth.h index 39c9bd9c318..ec3dbf4ba41 100644 --- a/src/lib/server/auth.h +++ b/src/lib/server/auth.h @@ -31,7 +31,7 @@ extern "C" { #include #include -rlm_rcode_t rad_virtual_server(request_t *); +unlang_action_t rad_virtual_server(rlm_rcode_t *p_result, request_t *request); #ifdef __cplusplus } diff --git a/src/lib/server/client.c b/src/lib/server/client.c index 87a1a4d438e..7c1929042df 100644 --- a/src/lib/server/client.c +++ b/src/lib/server/client.c @@ -64,12 +64,12 @@ static RADCLIENT_LIST *root_clients = NULL; //!< Global client list. #ifndef WITH_TRIE static int client_cmp(void const *one, void const *two) { - int rcode; + int ret; RADCLIENT const *a = one; RADCLIENT const *b = two; - rcode = fr_ipaddr_cmp(&a->ipaddr, &b->ipaddr); - if (rcode != 0) return rcode; + ret = fr_ipaddr_cmp(&a->ipaddr, &b->ipaddr); + if (ret != 0) return ret; /* * 0 is "wildcard", or "both" protocols diff --git a/src/lib/server/command.c b/src/lib/server/command.c index fc485b1ef9f..bfabaa49555 100644 --- a/src/lib/server/command.c +++ b/src/lib/server/command.c @@ -548,7 +548,7 @@ static int split(char **input, char **output, bool syntax_string) static int fr_command_add_syntax(TALLOC_CTX *ctx, char *syntax, fr_cmd_argv_t **head, bool allow_varargs) { - int i, rcode; + int i, ret; char *name, *p; fr_cmd_argv_t **last, *prev; @@ -560,10 +560,10 @@ static int fr_command_add_syntax(TALLOC_CTX *ctx, char *syntax, fr_cmd_argv_t ** for (i = 0; i < CMD_MAX_ARGV; i++) { fr_cmd_argv_t *argv; - rcode = split(&p, &name, true); - if (rcode < 0) return rcode; + ret = split(&p, &name, true); + if (ret < 0) return ret; - if (rcode == 0) return i; + if (ret == 0) return i; /* * Check for varargs. Which MUST NOT be @@ -615,8 +615,8 @@ static int fr_command_add_syntax(TALLOC_CTX *ctx, char *syntax, fr_cmd_argv_t ** /* * varargs can't be inside an optional block */ - rcode = fr_command_add_syntax(option, option, &child, false); - if (rcode < 0) return rcode; + ret = fr_command_add_syntax(option, option, &child, false); + if (ret < 0) return ret; argv = talloc_zero(ctx, fr_cmd_argv_t); argv->name = name; @@ -651,17 +651,17 @@ static int fr_command_add_syntax(TALLOC_CTX *ctx, char *syntax, fr_cmd_argv_t ** while (true) { fr_cmd_argv_t *choice, *sub; - rcode = split_alternation(&q, &word); - if (rcode < 0) return rcode; - if (rcode == 0) break; + ret = split_alternation(&q, &word); + if (ret < 0) return ret; + if (ret == 0) break; sub = NULL; /* * varargs can't be inside an alternation block */ - rcode = fr_command_add_syntax(option, word, &sub, false); - if (rcode < 0) return rcode; + ret = fr_command_add_syntax(option, word, &sub, false); + if (ret < 0) return ret; choice = talloc_zero(option, fr_cmd_argv_t); choice->name = word; @@ -756,16 +756,16 @@ int fr_command_add(TALLOC_CTX *talloc_ctx, fr_cmd_t **head, char const *name, vo * does not yet exist. */ if (table->parent) { - int i, rcode; + int i, ret; char *p; char *parents[CMD_MAX_ARGV]; p = talloc_strdup(talloc_ctx, table->parent); for (i = 0; i < CMD_MAX_ARGV; i++) { - rcode = split(&p, &parents[i], true); - if (rcode < 0) return -1; - if (rcode == 0) break; + ret = split(&p, &parents[i], true); + if (ret < 0) return -1; + if (ret == 0) break; if (!fr_command_valid_name(parents[i])) { fr_strerror_printf("Invalid command name '%s'", parents[i]); @@ -1014,7 +1014,7 @@ typedef struct { */ int fr_command_walk(fr_cmd_t *head, void **walk_ctx, void *ctx, fr_cmd_walk_t callback) { - int rcode; + int ret; fr_cmd_stack_t *stack; fr_cmd_t *cmd = NULL; fr_cmd_walk_info_t info; @@ -1076,11 +1076,11 @@ int fr_command_walk(fr_cmd_t *head, void **walk_ctx, void *ctx, fr_cmd_walk_t ca /* * Run the callback, but only for user-defined commands. */ - rcode = callback(ctx, &info); - if (rcode <= 0) { + ret = callback(ctx, &info); + if (ret <= 0) { talloc_free(stack); *walk_ctx = NULL; - return rcode; + return ret; } /* @@ -1182,15 +1182,15 @@ static int fr_command_tab_expand_argv(TALLOC_CTX *ctx, fr_cmd_t *cmd, fr_cmd_inf * "foo" and "bar". */ if (argv->type == FR_TYPE_ALTERNATE) { - int count, rcode; + int count, ret; fr_cmd_argv_t *child; count = 0; for (child = argv->child; child != NULL; child = child->next) { if (count >= max_expansions) return count; - rcode = fr_command_tab_expand_argv(ctx, cmd, info, name, child, max_expansions - count, &expansions[count]); - if (!rcode) continue; + ret = fr_command_tab_expand_argv(ctx, cmd, info, name, child, max_expansions - count, &expansions[count]); + if (!ret) continue; count++; } @@ -1258,16 +1258,16 @@ static int fr_command_tab_expand_argv(TALLOC_CTX *ctx, fr_cmd_t *cmd, fr_cmd_inf static int fr_command_tab_expand_syntax(TALLOC_CTX *ctx, fr_cmd_t *cmd, int syntax_offset, fr_cmd_info_t *info, int max_expansions, char const **expansions) { - int rcode; + int ret; fr_cmd_argv_t *argv = cmd->syntax_argv; - rcode = fr_command_verify_argv(info, syntax_offset, info->argc - 1, info->argc - 1, &argv, false); - if (rcode < 0) return -1; + ret = fr_command_verify_argv(info, syntax_offset, info->argc - 1, info->argc - 1, &argv, false); + if (ret < 0) return -1; /* * We've found the last argv. See if we need to expand it. */ - return fr_command_tab_expand_argv(ctx, cmd, info, info->argv[syntax_offset + rcode], argv, max_expansions, expansions); + return fr_command_tab_expand_argv(ctx, cmd, info, info->argv[syntax_offset + ret], argv, max_expansions, expansions); } @@ -1363,7 +1363,7 @@ int fr_command_tab_expand(TALLOC_CTX *ctx, fr_cmd_t *head, fr_cmd_info_t *info, static int fr_command_run_partial(FILE *fp, FILE *fp_err, fr_cmd_info_t *info, bool read_only, int offset, fr_cmd_t *head) { - int i, rcode; + int i, ret; fr_cmd_t *start, *cmd = NULL; fr_cmd_info_t my_info; @@ -1446,9 +1446,9 @@ static int fr_command_run_partial(FILE *fp, FILE *fp_err, fr_cmd_info_t *info, b my_info.runnable = true; my_info.argv = &info->argv[i + 1]; my_info.box = &info->box[i + 1]; - rcode = cmd->func(fp, fp_err, cmd->ctx, &my_info); + ret = cmd->func(fp, fp_err, cmd->ctx, &my_info); - return rcode; + return ret; } @@ -1468,7 +1468,7 @@ static int fr_command_run_partial(FILE *fp, FILE *fp_err, fr_cmd_info_t *info, b */ int fr_command_run(FILE *fp, FILE *fp_err, fr_cmd_info_t *info, bool read_only) { - int i, rcode; + int i, ret; fr_cmd_t *cmd; fr_cmd_info_t my_info; @@ -1491,8 +1491,8 @@ int fr_command_run(FILE *fp, FILE *fp_err, fr_cmd_info_t *info, bool read_only) fprintf(fp, "%s %s\n", info->argv[i - 1], cmd->name); info->argv[i] = cmd->name; - rcode = fr_command_run_partial(fp, fp_err, info, read_only, i, cmd); - if (rcode < 0) return rcode; + ret = fr_command_run_partial(fp, fp_err, info, read_only, i, cmd); + if (ret < 0) return ret; } return 0; @@ -1531,9 +1531,9 @@ int fr_command_run(FILE *fp, FILE *fp_err, fr_cmd_info_t *info, bool read_only) my_info.runnable = true; my_info.argv = &info->argv[i + 1]; my_info.box = &info->box[i + 1]; - rcode = cmd->func(fp, fp_err, cmd->ctx, &my_info); + ret = cmd->func(fp, fp_err, cmd->ctx, &my_info); - return rcode; + return ret; } @@ -1668,7 +1668,7 @@ void fr_command_list(FILE *fp, int max_depth, fr_cmd_t *head, int options) static int fr_command_verify_argv(fr_cmd_info_t *info, int start, int verify, int argc, fr_cmd_argv_t **argv_p, bool optional) { char quote; - int used = 0, rcode; + int used = 0, ret; fr_type_t type; fr_value_box_t *box, my_box; char const *name; @@ -1732,20 +1732,20 @@ redo: if (type == FR_TYPE_OPTIONAL) { child = argv->child; - rcode = fr_command_verify_argv(info, start + used, verify, argc, &child, true); - if (rcode < 0) return rcode; + ret = fr_command_verify_argv(info, start + used, verify, argc, &child, true); + if (ret < 0) return ret; /* * No match, that's OK. Skip it. */ - if (rcode == 0) { + if (ret == 0) { goto next; } /* * We've used SOME of the input. */ - used += rcode; + used += ret; /* * But perhaps not all of it. If so, remember @@ -1775,18 +1775,18 @@ redo: fr_assert(child->child != NULL); sub = child->child; - rcode = fr_command_verify_argv(info, start + used, verify, argc, &sub, true); - if (rcode <= 0) continue; + ret = fr_command_verify_argv(info, start + used, verify, argc, &sub, true); + if (ret <= 0) continue; /* * Only a partial match. Return that. */ if (sub) { *argv_p = argv; - return used + rcode; + return used + ret; } - used += rcode; + used += ret; goto next; } @@ -1899,7 +1899,7 @@ static int syntax_str_to_argv(int start_argc, fr_cmd_argv_t *start, fr_cmd_info_ char const **text, bool *runnable) { int argc = start_argc; - int rcode; + int ret; bool child_done; char const *word, *my_word, *p, *q; fr_cmd_argv_t *argv = start; @@ -1965,10 +1965,10 @@ static int syntax_str_to_argv(int start_argc, fr_cmd_argv_t *start, fr_cmd_info_ info->box[argc] = talloc_zero(info->box, fr_value_box_t); } - rcode = fr_value_box_from_str(info->box[argc], info->box[argc], + ret = fr_value_box_from_str(info->box[argc], info->box[argc], &type, NULL, word + offset, len - (offset << 1), quote, false); - if (rcode < 0) return -1; + if (ret < 0) return -1; /* * Note that argv[i] is the *input* string. @@ -2041,8 +2041,8 @@ static int syntax_str_to_argv(int start_argc, fr_cmd_argv_t *start, fr_cmd_info_ * "192.168.0.1" is not a valid * INTEGER, but it is a valid IPADDR. */ - rcode = syntax_str_to_argv(argc, sub, info, &my_word, &child_done); - if (rcode <= 0) continue; + ret = syntax_str_to_argv(argc, sub, info, &my_word, &child_done); + if (ret <= 0) continue; goto skip_child; } @@ -2063,19 +2063,19 @@ static int syntax_str_to_argv(int start_argc, fr_cmd_argv_t *start, fr_cmd_info_ child = argv->child; my_word = word; - rcode = syntax_str_to_argv(argc, child, info, &my_word, &child_done); - if (rcode < 0) return rcode; + ret = syntax_str_to_argv(argc, child, info, &my_word, &child_done); + if (ret < 0) return ret; /* * Didn't match anything, skip it. */ - if (rcode == 0) goto next; + if (ret == 0) goto next; skip_child: /* * We've eaten more input, remember that, */ - argc += rcode; + argc += ret; word = my_word; /* @@ -2133,7 +2133,7 @@ done: */ int fr_command_str_to_argv(fr_cmd_t *head, fr_cmd_info_t *info, char const *text) { - int argc, rcode; + int argc, ret; char const *word, *p, *q; fr_cmd_t *cmd; @@ -2336,10 +2336,10 @@ check_syntax: /* * Do recursive checks on the input string. */ - rcode = syntax_str_to_argv(argc, cmd->syntax_argv, info, &word, &info->runnable); - if (rcode < 0) return rcode; + ret = syntax_str_to_argv(argc, cmd->syntax_argv, info, &word, &info->runnable); + if (ret < 0) return ret; - argc += rcode; + argc += ret; /* * Run out of options to parse, but there's still more @@ -2443,17 +2443,17 @@ static int expand_all(fr_cmd_t *cmd, fr_cmd_info_t *info, fr_cmd_argv_t *argv, i } if ((argv->type < FR_TYPE_FIXED) && cmd->tab_expand) { - int rcode; + int ret; info->argv[info->argc] = ""; info->box[info->argc] = NULL; info->argc++; fr_assert(count == 0); - rcode = cmd->tab_expand(NULL, cmd->ctx, info, max_expansions - count, expansions + count); - if (rcode < 0) return rcode; + ret = cmd->tab_expand(NULL, cmd->ctx, info, max_expansions - count, expansions + count); + if (ret < 0) return ret; - return count + rcode; + return count + ret; } expansions[count] = strdup(argv->name); @@ -2523,7 +2523,7 @@ static int expand_syntax(fr_cmd_t *cmd, fr_cmd_info_t *info, fr_cmd_argv_t *argv * Check data types. */ if (argv->type < FR_TYPE_FIXED) { - int rcode; + int ret; size_t len, offset; char quote, *my_word; fr_type_t type = argv->type; @@ -2560,9 +2560,9 @@ static int expand_syntax(fr_cmd_t *cmd, fr_cmd_info_t *info, fr_cmd_argv_t *argv * Expand this thing. */ fr_assert(count == 0); - rcode = cmd->tab_expand(NULL, cmd->ctx, info, max_expansions - count, expansions + count); - if (rcode < 0) return rcode; - return count + rcode; + ret = cmd->tab_expand(NULL, cmd->ctx, info, max_expansions - count, expansions + count); + if (ret < 0) return ret; + return count + ret; } len = p - word; @@ -2583,10 +2583,10 @@ static int expand_syntax(fr_cmd_t *cmd, fr_cmd_info_t *info, fr_cmd_argv_t *argv offset = 0; } - rcode = fr_value_box_from_str(info->box[info->argc], info->box[info->argc], + ret = fr_value_box_from_str(info->box[info->argc], info->box[info->argc], &type, NULL, word + offset, len - (offset << 1), quote, false); - if (rcode < 0) return -1; + if (ret < 0) return -1; info->argc++; *word_p = word = p; continue; diff --git a/src/lib/server/module.h b/src/lib/server/module.h index deb29c48eaa..c7eb450dbe8 100644 --- a/src/lib/server/module.h +++ b/src/lib/server/module.h @@ -31,6 +31,7 @@ extern "C" { #include #include +#include #include typedef struct module_s module_t; @@ -55,7 +56,7 @@ typedef struct module_ctx_s module_ctx_t; * @param[in] request to process. * @return the appropriate rcode. */ -typedef rlm_rcode_t (*module_method_t)(module_ctx_t const *mctx, request_t *request); +typedef unlang_action_t (*module_method_t)(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request); /** Module instantiation callback * diff --git a/src/lib/server/rcode.h b/src/lib/server/rcode.h index 7c70555e93f..f1da47d2646 100644 --- a/src/lib/server/rcode.h +++ b/src/lib/server/rcode.h @@ -26,6 +26,7 @@ RCSIDH(rcode_h, "$Id$") #include +#include #ifdef __cplusplus extern "C" { @@ -51,6 +52,18 @@ typedef enum { RLM_MODULE_UNKNOWN, //!< Error resolving rcode (should not be //!< returned by modules). } rlm_rcode_t; + +#define RETURN_MODULE_REJECT do { *p_result = RLM_MODULE_REJECT; return UNLANG_ACTION_CALCULATE_RESULT; } while (0) +#define RETURN_MODULE_FAIL do { *p_result = RLM_MODULE_FAIL; return UNLANG_ACTION_CALCULATE_RESULT; } while (0) +#define RETURN_MODULE_OK do { *p_result = RLM_MODULE_OK; return UNLANG_ACTION_CALCULATE_RESULT; } while (0) +#define RETURN_MODULE_HANDLED do { *p_result = RLM_MODULE_HANDLED; return UNLANG_ACTION_CALCULATE_RESULT; } while (0) +#define RETURN_MODULE_INVALID do { *p_result = RLM_MODULE_INVALID; return UNLANG_ACTION_CALCULATE_RESULT; } while (0) +#define RETURN_MODULE_DISALLOW do { *p_result = RLM_MODULE_DISALLOW; return UNLANG_ACTION_CALCULATE_RESULT; } while (0) +#define RETURN_MODULE_NOTFOUND do { *p_result = RLM_MODULE_NOTFOUND; return UNLANG_ACTION_CALCULATE_RESULT; } while (0) +#define RETURN_MODULE_NOOP do { *p_result = RLM_MODULE_NOOP; return UNLANG_ACTION_CALCULATE_RESULT; } while (0) +#define RETURN_MODULE_UPDATED do { *p_result = RLM_MODULE_UPDATED; return UNLANG_ACTION_CALCULATE_RESULT; } while (0) +#define RETURN_MODULE_RCODE(_rcode) do { *p_result = (_rcode); return UNLANG_ACTION_CALCULATE_RESULT; } while (0) + extern fr_table_num_sorted_t const rcode_table[]; extern size_t rcode_table_len; diff --git a/src/lib/server/trigger.c b/src/lib/server/trigger.c index 13e6baacfbc..8ee55a58899 100644 --- a/src/lib/server/trigger.c +++ b/src/lib/server/trigger.c @@ -192,7 +192,7 @@ typedef struct { bool expanded; } fr_trigger_t; -static rlm_rcode_t trigger_process(module_ctx_t const *mctx, request_t *request) +static unlang_action_t trigger_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { fr_trigger_t *ctx = talloc_get_type_abort(mctx->instance, fr_trigger_t); rlm_rcode_t rcode; @@ -206,8 +206,12 @@ static rlm_rcode_t trigger_process(module_ctx_t const *mctx, request_t *request) (void) fr_pair_list_copy(request->packet, &request->request_pairs, &ctx->vps); if (unlang_interpret_push_instruction(request, NULL, - RLM_MODULE_REJECT, UNLANG_TOP_FRAME) < 0) return RLM_MODULE_FAIL; - if (unlang_xlat_push(request, &ctx->box, request, ctx->xlat, true) < 0) return RLM_MODULE_FAIL; + RLM_MODULE_REJECT, UNLANG_TOP_FRAME) < 0) { + RETURN_MODULE_FAIL; + } + if (unlang_xlat_push(request, &ctx->box, request, ctx->xlat, true) < 0) { + RETURN_MODULE_FAIL; + } ctx->expanded = true; /* @@ -215,9 +219,14 @@ static rlm_rcode_t trigger_process(module_ctx_t const *mctx, request_t *request) */ rcode = unlang_interpret(request); - if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED; + if (request->master_state == REQUEST_STOP_PROCESSING) { + RETURN_MODULE_HANDLED; + } - if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD; + if (rcode == RLM_MODULE_YIELD) { + *p_result = RLM_MODULE_YIELD; + return UNLANG_ACTION_YIELD; + } /* * Always fall through, no matter what the return code is. @@ -226,7 +235,7 @@ static rlm_rcode_t trigger_process(module_ctx_t const *mctx, request_t *request) if (!ctx->box) { RERROR("Failed trigger %s - did not expand to anything", ctx->name); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* @@ -234,10 +243,10 @@ static rlm_rcode_t trigger_process(module_ctx_t const *mctx, request_t *request) */ if (fr_exec_nowait(request, ctx->box, NULL) < 0) { RPERROR("Failed trigger %s", ctx->name); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } diff --git a/src/lib/server/trunk.c b/src/lib/server/trunk.c index a93ee82bbe2..9937ca3c5dd 100644 --- a/src/lib/server/trunk.c +++ b/src/lib/server/trunk.c @@ -1402,15 +1402,15 @@ static fr_trunk_enqueue_t trunk_request_enqueue_existing(fr_trunk_request_t *tre { fr_trunk_t *trunk = treq->pub.trunk; fr_trunk_connection_t *tconn = NULL; - fr_trunk_enqueue_t rcode; + fr_trunk_enqueue_t ret; /* * Must *NOT* still be assigned to another connection */ fr_assert(!treq->pub.tconn); - rcode = trunk_request_check_enqueue(&tconn, trunk, treq->pub.request); - switch (rcode) { + ret = trunk_request_check_enqueue(&tconn, trunk, treq->pub.request); + switch (ret) { case FR_TRUNK_ENQUEUE_OK: if (trunk->conf.always_writable) { fr_connection_signals_pause(tconn->pub.conn); @@ -1438,7 +1438,7 @@ static fr_trunk_enqueue_t trunk_request_enqueue_existing(fr_trunk_request_t *tre break; } - return rcode; + return ret; } /** Shift requests in the specified states onto new connections @@ -2269,7 +2269,7 @@ fr_trunk_enqueue_t fr_trunk_request_enqueue(fr_trunk_request_t **treq_out, fr_tr { fr_trunk_connection_t *tconn = NULL; fr_trunk_request_t *treq; - fr_trunk_enqueue_t rcode; + fr_trunk_enqueue_t ret; if (!fr_cond_assert_msg(!IN_HANDLER(trunk), "%s cannot be called within a handler", __FUNCTION__)) return FR_TRUNK_ENQUEUE_FAIL; @@ -2285,8 +2285,8 @@ fr_trunk_enqueue_t fr_trunk_request_enqueue(fr_trunk_request_t **treq_out, fr_tr if (fr_trunk_start(trunk) < 0) return FR_TRUNK_ENQUEUE_FAIL; } - rcode = trunk_request_check_enqueue(&tconn, trunk, request); - switch (rcode) { + ret = trunk_request_check_enqueue(&tconn, trunk, request); + switch (ret) { case FR_TRUNK_ENQUEUE_OK: if (*treq_out) { treq = *treq_out; @@ -2329,10 +2329,10 @@ fr_trunk_enqueue_t fr_trunk_request_enqueue(fr_trunk_request_t **treq_out, fr_tr treq->pub.preq = preq; treq->pub.rctx = rctx; } - return rcode; + return ret; } - return rcode; + return ret; } /** Re-enqueue a request on the same connection diff --git a/src/lib/server/virtual_servers.c b/src/lib/server/virtual_servers.c index 7f1ed14763f..ed5da6af488 100644 --- a/src/lib/server/virtual_servers.c +++ b/src/lib/server/virtual_servers.c @@ -1019,7 +1019,7 @@ int virtual_servers_free(void) /** */ -rlm_rcode_t process_authenticate(int auth_type, request_t *request) +unlang_action_t process_authenticate(rlm_rcode_t *p_result, int auth_type, request_t *request) { rlm_rcode_t rcode; CONF_SECTION *cs, *server_cs; @@ -1047,7 +1047,7 @@ rlm_rcode_t process_authenticate(int auth_type, request_t *request) RDEBUG2("Empty 'authenticate' section in virtual server \"%s\". Using default return value (%s)", cf_section_name2(request->server_cs), fr_table_str_by_value(rcode_table, RLM_MODULE_REJECT, "")); - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; } /* @@ -1055,21 +1055,21 @@ rlm_rcode_t process_authenticate(int auth_type, request_t *request) */ if (!auth_type) { RERROR("An 'Auth-Type' MUST be specified"); - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; } dict_internal = fr_dict_internal(); da = fr_dict_attr_child_by_num(fr_dict_root(dict_internal), FR_AUTH_TYPE); - if (!da) return RLM_MODULE_FAIL; + if (!da) RETURN_MODULE_FAIL; dv = fr_dict_enum_by_value(da, fr_box_uint32((uint32_t) auth_type)); - if (!dv) return RLM_MODULE_FAIL; + if (!dv) RETURN_MODULE_FAIL; subcs = cf_section_find(cs, da->name, dv->name); if (!subcs) { RDEBUG2("%s %s sub-section not found. Using default return values.", da->name, dv->name); - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; } RDEBUG("Running %s %s from file %s", @@ -1092,7 +1092,7 @@ rlm_rcode_t process_authenticate(int auth_type, request_t *request) request->module = module; request->server_cs = server_cs; - return rcode; + RETURN_MODULE_RCODE(rcode); } rlm_rcode_t virtual_server_process_auth(request_t *request, CONF_SECTION *virtual_server, @@ -1103,13 +1103,15 @@ rlm_rcode_t virtual_server_process_auth(request_t *request, CONF_SECTION *virtua fr_pair_t *vp; CONF_SECTION *auth_cs = NULL; char const *auth_name; + rlm_rcode_t rcode = RLM_MODULE_NOOP; vp = fr_pair_find_by_da(&request->control_pairs, attr_auth_type); if (!vp) { RDEBUG2("No &control.Auth-Type found"); fail: request->rcode = RLM_MODULE_FAIL; - return unlang_module_yield_to_section(request, NULL, RLM_MODULE_FAIL, resume, signal, rctx); + unlang_module_yield_to_section(&rcode, request, NULL, RLM_MODULE_FAIL, resume, signal, rctx); + return rcode; } auth_name = fr_dict_enum_name_by_value(attr_auth_type, &vp->data); @@ -1125,7 +1127,8 @@ rlm_rcode_t virtual_server_process_auth(request_t *request, CONF_SECTION *virtua goto fail; } - return unlang_module_yield_to_section(request, auth_cs, default_rcode, resume, signal, rctx); + unlang_module_yield_to_section(&rcode, request, auth_cs, default_rcode, resume, signal, rctx); + return rcode; } /* diff --git a/src/lib/server/virtual_servers.h b/src/lib/server/virtual_servers.h index 0febb75b735..60b50fb9acc 100644 --- a/src/lib/server/virtual_servers.h +++ b/src/lib/server/virtual_servers.h @@ -87,7 +87,7 @@ int virtual_server_has_namespace(CONF_SECTION **out, CONF_ITEM *ci); /** @} */ -rlm_rcode_t process_authenticate(int type, request_t *request); +unlang_action_t process_authenticate(rlm_rcode_t *p_result, int auth_type, request_t *request); rlm_rcode_t virtual_server_process_auth(request_t *request, CONF_SECTION *virtual_server, rlm_rcode_t default_rcode, diff --git a/src/lib/tls/base-h b/src/lib/tls/base-h index 535c337c1d0..b11bf5c371f 100644 --- a/src/lib/tls/base-h +++ b/src/lib/tls/base-h @@ -389,7 +389,7 @@ do { \ /* * tls/cache.c */ -int fr_tls_cache_process(request_t *request, CONF_SECTION *action); +unlang_action_t fr_tls_cache_process(rlm_rcode_t *p_result, request_t *request, CONF_SECTION *action); int fr_tls_cache_compile(fr_tls_cache_t *sections, CONF_SECTION *server_cs); diff --git a/src/lib/tls/cache.c b/src/lib/tls/cache.c index 82100dbb791..84f26705196 100644 --- a/src/lib/tls/cache.c +++ b/src/lib/tls/cache.c @@ -77,18 +77,18 @@ static int fr_tls_cache_session_id_to_vp(request_t *request, uint8_t const *key, /** Execute the virtual server configured to perform cache actions * + * @param[out] p_result from the virtual server. * @param[in] request The current request. * @param[in] action to execute. - * @return the rcode from the virtual server. */ -int fr_tls_cache_process(request_t *request, CONF_SECTION *action) +unlang_action_t fr_tls_cache_process(rlm_rcode_t *p_result, request_t *request, CONF_SECTION *action) { rlm_rcode_t rcode; CONF_SECTION *server_cs; char const *module; char const *component; - if (!action) return RLM_MODULE_NOOP; + if (!action) RETURN_MODULE_NOOP; /* * Save the current status of the request. @@ -112,7 +112,7 @@ int fr_tls_cache_process(request_t *request, CONF_SECTION *action) request->module = module; request->component = component; - return rcode; + RETURN_MODULE_RCODE(rcode); } /** Pre-compile unlang cache sections and store pointers to them @@ -265,6 +265,7 @@ int fr_tls_cache_write(request_t *request, fr_tls_session_t *tls_session) fr_tls_conf_t *conf; int ret = 0; fr_pair_t *vp; + rlm_rcode_t rcode; conf = SSL_get_ex_data(tls_session->ssl, FR_TLS_EX_INDEX_CONF); @@ -292,7 +293,8 @@ int fr_tls_cache_write(request_t *request, fr_tls_session_t *tls_session) /* * Call the virtual server to write the session */ - switch (fr_tls_cache_process(request, conf->session_cache.store)) { + fr_tls_cache_process(&rcode, request, conf->session_cache.store); + switch (rcode) { case RLM_MODULE_OK: case RLM_MODULE_UPDATED: break; @@ -337,6 +339,7 @@ static SSL_SESSION *fr_tls_cache_read(SSL *ssl, uint8_t const *q; fr_pair_t *vp; SSL_SESSION *sess; + rlm_rcode_t rcode; request = SSL_get_ex_data(ssl, FR_TLS_EX_INDEX_REQUEST); conf = SSL_get_ex_data(ssl, FR_TLS_EX_INDEX_CONF); @@ -351,7 +354,8 @@ static SSL_SESSION *fr_tls_cache_read(SSL *ssl, /* * Call the virtual server to read the session */ - switch (fr_tls_cache_process(request, conf->session_cache.load)) { + fr_tls_cache_process(&rcode, request, conf->session_cache.load); + switch (rcode) { case RLM_MODULE_OK: case RLM_MODULE_UPDATED: break; @@ -420,11 +424,13 @@ static SSL_SESSION *fr_tls_cache_read(SSL *ssl, static void fr_tls_cache_delete(SSL_CTX *ctx, SSL_SESSION *sess) { fr_tls_conf_t *conf; - fr_tls_session_t *tls_session; - request_t *request; + fr_tls_session_t *tls_session; + request_t *request; uint8_t const *key; ssize_t key_len; + rlm_rcode_t rcode; + conf = talloc_get_type_abort(SSL_CTX_get_app_data(ctx), fr_tls_conf_t); tls_session = talloc_get_type_abort(SSL_SESSION_get_ex_data(sess, FR_TLS_EX_INDEX_TLS_SESSION), fr_tls_session_t); request = talloc_get_type_abort(SSL_get_ex_data(tls_session->ssl, FR_TLS_EX_INDEX_REQUEST), request_t); @@ -451,7 +457,8 @@ static void fr_tls_cache_delete(SSL_CTX *ctx, SSL_SESSION *sess) /* * Call the virtual server to delete the session */ - switch (fr_tls_cache_process(request, conf->session_cache.clear)) { + fr_tls_cache_process(&rcode, request, conf->session_cache.clear); + switch (rcode) { case RLM_MODULE_OK: case RLM_MODULE_UPDATED: case RLM_MODULE_NOTFOUND: diff --git a/src/lib/tls/ocsp.c b/src/lib/tls/ocsp.c index 397e88b5bb9..51b76565cb6 100644 --- a/src/lib/tls/ocsp.c +++ b/src/lib/tls/ocsp.c @@ -354,24 +354,29 @@ int fr_tls_ocsp_check(request_t *request, SSL *ssl, fr_time_t start; fr_pair_t *vp; - if (conf->cache_server) switch (fr_tls_cache_process(request, conf->cache.load)) { - case RLM_MODULE_REJECT: - REDEBUG("Told to force OCSP validation failure from cached response"); - return OCSP_STATUS_FAILED; + if (conf->cache_server) { + rlm_rcode_t rcode; - case RLM_MODULE_OK: - case RLM_MODULE_UPDATED: - /* - * These are fine for OCSP too, we don't *expect* to always - * have a cached OCSP status. - */ - case RLM_MODULE_NOTFOUND: - case RLM_MODULE_NOOP: - break; + fr_tls_cache_process(&rcode, request, conf->cache.load); + switch (rcode) { + case RLM_MODULE_REJECT: + REDEBUG("Told to force OCSP validation failure from cached response"); + return OCSP_STATUS_FAILED; - default: - RWDEBUG("Failed retrieving cached OCSP status"); - break; + case RLM_MODULE_OK: + case RLM_MODULE_UPDATED: + /* + * These are fine for OCSP too, we don't *expect* to always + * have a cached OCSP status. + */ + case RLM_MODULE_NOTFOUND: + case RLM_MODULE_NOOP: + break; + + default: + RWDEBUG("Failed retrieving cached OCSP status"); + break; + } } /* @@ -716,16 +721,20 @@ finish: break; } - if (conf->cache_server) switch (fr_tls_cache_process(request, conf->cache.store)) { - case RLM_MODULE_OK: - case RLM_MODULE_UPDATED: - break; + if (conf->cache_server) { + rlm_rcode_t rcode; - default: - RWDEBUG("Failed writing cached OCSP status"); - break; - } + fr_tls_cache_process(&rcode, request, conf->cache.store); + switch (rcode) { + case RLM_MODULE_OK: + case RLM_MODULE_UPDATED: + break; + default: + RWDEBUG("Failed writing cached OCSP status"); + break; + } + } /* Free OCSP Stuff */ OCSP_REQUEST_free(req); OCSP_BASICRESP_free(bresp); diff --git a/src/lib/unlang/call.c b/src/lib/unlang/call.c index defbf84bdc3..e5eef50e63e 100644 --- a/src/lib/unlang/call.c +++ b/src/lib/unlang/call.c @@ -39,6 +39,7 @@ static unlang_action_t unlang_call_process(rlm_rcode_t *p_result, request_t *req unlang_group_t *g = unlang_generic_to_group(instruction); rlm_rcode_t rcode; + unlang_action_t ua; request->request_state = REQUEST_INIT; request->server_cs = state->prev_server_cs; /* So we get correct debug info */ @@ -48,8 +49,16 @@ static unlang_action_t unlang_call_process(rlm_rcode_t *p_result, request_t *req * * This is a function in the virtual server's state machine. */ - rcode = state->process(&(module_ctx_t){ .instance = state->instance }, request); - if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD; + ua = state->process(&rcode, &(module_ctx_t){ .instance = state->instance }, request); + switch (ua) { + case UNLANG_ACTION_YIELD: + case UNLANG_ACTION_STOP_PROCESSING: + case UNLANG_ACTION_PUSHED_CHILD: /* Wants to do more processing */ + return ua; + + default: + break; + } /* * Record the rcode and restore the previous virtual server diff --git a/src/lib/unlang/interpret.c b/src/lib/unlang/interpret.c index 04db3a62942..fc6c3e82b3c 100644 --- a/src/lib/unlang/interpret.c +++ b/src/lib/unlang/interpret.c @@ -872,7 +872,7 @@ rlm_rcode_t unlang_interpret_section(request_t *request, CONF_SECTION *subcs, rl * This pushes a new frame onto the stack, which is the * start of a new unlang section... */ - if (unlang_interpret_push_section(request, subcs, default_rcode, UNLANG_TOP_FRAME) < 0) return RLM_MODULE_FAIL; + if (unlang_interpret_push_section(request, subcs, default_rcode, UNLANG_TOP_FRAME) < 0)return RLM_MODULE_FAIL; return unlang_interpret(request); } @@ -939,8 +939,7 @@ rlm_rcode_t unlang_interpret_synchronous(request_t *request, CONF_SECTION *cs, r num_events = fr_event_corral(request->el, fr_time(), wait_for_event); if (num_events < 0) { RPERROR("Failed retrieving events"); - rcode = RLM_MODULE_FAIL; - break; + return RLM_MODULE_FAIL; } DEBUG3("%u event(s) pending%s", diff --git a/src/lib/unlang/io.c b/src/lib/unlang/io.c index 662de5c4b06..54e13e92ef6 100644 --- a/src/lib/unlang/io.c +++ b/src/lib/unlang/io.c @@ -33,7 +33,7 @@ RCSID("$Id$") * * This is a shim function added to 'fake' requests by the subrequest and parallel keywords. */ -rlm_rcode_t unlang_io_process_interpret(UNUSED module_ctx_t const *mctx, request_t *request) +unlang_action_t unlang_io_process_interpret(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request) { rlm_rcode_t rcode; @@ -46,7 +46,8 @@ rlm_rcode_t unlang_io_process_interpret(UNUSED module_ctx_t const *mctx, request */ if ((rcode == RLM_MODULE_YIELD) && (request->master_state != REQUEST_STOP_PROCESSING)) { - return RLM_MODULE_YIELD; + *p_result = RLM_MODULE_YIELD; + return UNLANG_ACTION_YIELD; } /* @@ -60,7 +61,7 @@ rlm_rcode_t unlang_io_process_interpret(UNUSED module_ctx_t const *mctx, request /* * Don't bother setting request->reply->code. */ - return RLM_MODULE_HANDLED; + RETURN_MODULE_HANDLED; } /** Allocate a child request based on the parent. diff --git a/src/lib/unlang/module.c b/src/lib/unlang/module.c index ec011d740f2..df583ecde99 100644 --- a/src/lib/unlang/module.c +++ b/src/lib/unlang/module.c @@ -426,13 +426,13 @@ request_t *unlang_module_subrequest_alloc(request_t *parent, fr_dict_t const *na * @param[in] session control values. Whether we restore/store session info. * @param[in] rctx to pass to the resume() and signal() callbacks. * @return - * - RLM_MODULE_YIELD. + * - UNLANG_ACTION_YIELD. */ -rlm_rcode_t unlang_module_yield_to_subrequest(rlm_rcode_t *out, request_t *child, - unlang_module_resume_t resume, - unlang_module_signal_t signal, - unlang_subrequest_session_t const *session, - void *rctx) +unlang_action_t unlang_module_yield_to_subrequest(rlm_rcode_t *out, request_t *child, + unlang_module_resume_t resume, + unlang_module_signal_t signal, + unlang_subrequest_session_t const *session, + void *rctx) { /* * Push the resumption point BEFORE adding the subrequest @@ -443,9 +443,9 @@ rlm_rcode_t unlang_module_yield_to_subrequest(rlm_rcode_t *out, request_t *child /* * Push the subrequest and immediately run it. */ - if (unlang_subrequest_push(out, child, session, UNLANG_SUB_FRAME) < 0) return RLM_MODULE_FAIL; + if (unlang_subrequest_push(out, child, session, UNLANG_SUB_FRAME) < 0) return UNLANG_ACTION_STOP_PROCESSING; - return RLM_MODULE_YIELD; + return UNLANG_ACTION_YIELD; } /** Push a pre-compiled xlat and resumption state onto the stack for evaluation @@ -471,12 +471,12 @@ rlm_rcode_t unlang_module_yield_to_subrequest(rlm_rcode_t *out, request_t *child * @param[in] signal function to call if a signal is received. * @param[in] rctx to pass to the resume() and signal() callbacks. * @return - * - RLM_MODULE_YIELD. + * - UNLANG_ACTION_YIELD */ -rlm_rcode_t unlang_module_yield_to_xlat(TALLOC_CTX *ctx, fr_value_box_t **out, - request_t *request, xlat_exp_t const *exp, - unlang_module_resume_t resume, - unlang_module_signal_t signal, void *rctx) +unlang_action_t unlang_module_yield_to_xlat(TALLOC_CTX *ctx, fr_value_box_t **out, + request_t *request, xlat_exp_t const *exp, + unlang_module_resume_t resume, + unlang_module_signal_t signal, void *rctx) { /* * Push the resumption point BEFORE pushing the xlat onto @@ -487,9 +487,9 @@ rlm_rcode_t unlang_module_yield_to_xlat(TALLOC_CTX *ctx, fr_value_box_t **out, /* * Push the xlat function */ - if (unlang_xlat_push(ctx, out, request, exp, false) < 0) return RLM_MODULE_FAIL; + if (unlang_xlat_push(ctx, out, request, exp, false) < 0) return UNLANG_ACTION_STOP_PROCESSING; - return RLM_MODULE_YIELD; + return UNLANG_ACTION_YIELD; } /** Push a pre-compiled tmpl and resumption state onto the stack for evaluation @@ -517,13 +517,13 @@ rlm_rcode_t unlang_module_yield_to_xlat(TALLOC_CTX *ctx, fr_value_box_t **out, * @param[in] signal function to call if a signal is received. * @param[in] rctx to pass to the resume() and signal() callbacks. * @return - * - RLM_MODULE_YIELD. + * - UNLANG_ACTION_YIELD */ -rlm_rcode_t unlang_module_yield_to_tmpl(TALLOC_CTX *ctx, fr_value_box_t **out, int *status, - request_t *request, tmpl_t const *vpt, - fr_pair_t *vps, - unlang_module_resume_t resume, - unlang_module_signal_t signal, void *rctx) +unlang_action_t unlang_module_yield_to_tmpl(TALLOC_CTX *ctx, fr_value_box_t **out, int *status, + request_t *request, tmpl_t const *vpt, + fr_pair_t *vps, + unlang_module_resume_t resume, + unlang_module_signal_t signal, void *rctx) { /* * Push the resumption point BEFORE pushing the xlat onto @@ -534,15 +534,16 @@ rlm_rcode_t unlang_module_yield_to_tmpl(TALLOC_CTX *ctx, fr_value_box_t **out, i /* * Push the xlat function */ - if (unlang_tmpl_push(ctx, out, request, vpt, vps, status) < 0) return RLM_MODULE_FAIL; + if (unlang_tmpl_push(ctx, out, request, vpt, vps, status) < 0) return UNLANG_ACTION_STOP_PROCESSING; - return RLM_MODULE_YIELD; + return UNLANG_ACTION_YIELD; } -rlm_rcode_t unlang_module_yield_to_section(request_t *request, CONF_SECTION *subcs, - rlm_rcode_t default_rcode, - unlang_module_resume_t resume, - unlang_module_signal_t signal, void *rctx) +unlang_action_t unlang_module_yield_to_section(rlm_rcode_t *p_result, + request_t *request, CONF_SECTION *subcs, + rlm_rcode_t default_rcode, + unlang_module_resume_t resume, + unlang_module_signal_t signal, void *rctx) { if (!subcs) { unlang_stack_t *stack = request->stack; @@ -560,7 +561,8 @@ rlm_rcode_t unlang_module_yield_to_section(request_t *request, CONF_SECTION *sub */ request->rcode = frame->result = default_rcode; - return resume(&(module_ctx_t){ + return resume(p_result, + &(module_ctx_t){ .instance = mc->instance->dl_inst->data, .thread = module_thread(mc->instance)->data }, request, rctx); @@ -572,9 +574,10 @@ rlm_rcode_t unlang_module_yield_to_section(request_t *request, CONF_SECTION *sub */ (void) unlang_module_yield(request, resume, signal, rctx); - if (unlang_interpret_push_section(request, subcs, default_rcode, UNLANG_SUB_FRAME) < 0) return RLM_MODULE_FAIL; + if (unlang_interpret_push_section(request, subcs, + default_rcode, UNLANG_SUB_FRAME) < 0) return UNLANG_ACTION_STOP_PROCESSING; - return RLM_MODULE_YIELD; + return UNLANG_ACTION_YIELD; } /* @@ -657,6 +660,7 @@ static unlang_action_t unlang_module_resume(rlm_rcode_t *p_result, request_t *re char const *caller; rlm_rcode_t rcode; int stack_depth = stack->depth; + unlang_action_t ua; fr_assert(state->resume != NULL); @@ -667,11 +671,14 @@ static unlang_action_t unlang_module_resume(rlm_rcode_t *p_result, request_t *re request->module = mc->instance->name; safe_lock(mc->instance); - rcode = request->rcode = state->resume(&(module_ctx_t){ - .instance = mc->instance->dl_inst->data, - .thread = state->thread->data - }, request, state->rctx); + ua = state->resume(&rcode, + &(module_ctx_t){ + .instance = mc->instance->dl_inst->data, + .thread = state->thread->data + }, request, state->rctx); safe_unlock(mc->instance); + + request->rcode = rcode; request->module = caller; /* @@ -680,8 +687,8 @@ static unlang_action_t unlang_module_resume(rlm_rcode_t *p_result, request_t *re * "active_callers" if it's already been cancelled in a * signal. */ - if (request->master_state == REQUEST_STOP_PROCESSING) { - RWARN("Module %s became unblocked", mc->instance->module->name); + if ((ua == UNLANG_ACTION_STOP_PROCESSING) || (request->master_state == REQUEST_STOP_PROCESSING)) { + RWARN("Module %s or worker signalled to stop processing request", mc->instance->module->name); if (state->p_result) *state->p_result = rcode; if (state->signal) state->thread->active_callers--; @@ -693,7 +700,7 @@ static unlang_action_t unlang_module_resume(rlm_rcode_t *p_result, request_t *re RDEBUG2("%s (%s)", frame->instruction->name ? frame->instruction->name : "", fr_table_str_by_value(mod_rcode_table, rcode, "")); - if (rcode == RLM_MODULE_YIELD) { + if (ua == UNLANG_ACTION_YIELD) { if (stack_depth < stack->depth) return UNLANG_ACTION_PUSHED_CHILD; fr_assert(stack_depth == stack->depth); *p_result = rcode; @@ -707,7 +714,7 @@ static unlang_action_t unlang_module_resume(rlm_rcode_t *p_result, request_t *re * more asynchronous calls onto the stack. These need to * be run before the next module runs. */ - if (stack_depth < stack->depth) { + if (ua == UNLANG_ACTION_PUSHED_CHILD) { state->rcode = rcode; repeatable_set(frame); frame->process = unlang_module_resume_final; @@ -718,7 +725,7 @@ static unlang_action_t unlang_module_resume(rlm_rcode_t *p_result, request_t *re if (state->p_result) *state->p_result = rcode; *p_result = rcode; - return UNLANG_ACTION_CALCULATE_RESULT; + return ua; /* Usually UNLANG_ACTION_CALCULATE_RESULT */ } /** Yield a request back to the interpreter from within a module @@ -736,17 +743,14 @@ static unlang_action_t unlang_module_resume(rlm_rcode_t *p_result, request_t *re * @param[in] signal Called on unlang_action(). * @param[in] rctx to pass to the callbacks. * @return - * - RLM_MODULE_YIELD on success. - * - RLM_MODULE_FAIL (or asserts) if the current frame is not a module call or - * resume frame. + * - UNLANG_ACTION_YIELD. */ -rlm_rcode_t unlang_module_yield(request_t *request, - unlang_module_resume_t resume, unlang_module_signal_t signal, void *rctx) +unlang_action_t unlang_module_yield(request_t *request, + unlang_module_resume_t resume, unlang_module_signal_t signal, void *rctx) { unlang_stack_t *stack = request->stack; unlang_stack_frame_t *frame = &stack->frame[stack->depth]; - unlang_frame_state_module_t *state = talloc_get_type_abort(frame->state, - unlang_frame_state_module_t); + unlang_frame_state_module_t *state = talloc_get_type_abort(frame->state, unlang_frame_state_module_t); REQUEST_VERIFY(request); /* Check the yielded request is sane */ @@ -765,7 +769,8 @@ rlm_rcode_t unlang_module_yield(request_t *request, */ frame->process = unlang_module_resume; repeatable_set(frame); - return RLM_MODULE_YIELD; + + return UNLANG_ACTION_YIELD; } static unlang_action_t unlang_module(rlm_rcode_t *p_result, request_t *request) @@ -777,7 +782,8 @@ static unlang_action_t unlang_module(rlm_rcode_t *p_result, request_t *request) unlang_frame_state_module_t *state = talloc_get_type_abort(frame->state, unlang_frame_state_module_t); int stack_depth = stack->depth; char const *caller; - rlm_rcode_t rcode; + rlm_rcode_t rcode = RLM_MODULE_NOOP; + unlang_action_t ua; #ifndef NDEBUG int unlang_indent = request->log.unlang_indent; @@ -805,6 +811,7 @@ static unlang_action_t unlang_module(rlm_rcode_t *p_result, request_t *request) */ if (mc->instance->force) { rcode = mc->instance->code; + ua = UNLANG_ACTION_CALCULATE_RESULT; goto done; } @@ -816,11 +823,12 @@ static unlang_action_t unlang_module(rlm_rcode_t *p_result, request_t *request) caller = request->module; request->module = mc->instance->name; safe_lock(mc->instance); /* Noop unless instance->mutex set */ - rcode = mc->method(&(module_ctx_t){ + ua = mc->method(&rcode, + &(module_ctx_t){ .instance = mc->instance->dl_inst->data, .thread = state->thread->data - }, - request); + }, + request); safe_unlock(mc->instance); request->module = caller; @@ -828,7 +836,7 @@ static unlang_action_t unlang_module(rlm_rcode_t *p_result, request_t *request) * It is now marked as "stop" when it wasn't before, we * must have been blocked. */ - if (request->master_state == REQUEST_STOP_PROCESSING) { + if ((ua == UNLANG_ACTION_STOP_PROCESSING) || (request->master_state == REQUEST_STOP_PROCESSING)) { RWARN("Module %s became unblocked", mc->instance->module->name); if (state->p_result) *state->p_result = rcode; @@ -843,11 +851,10 @@ static unlang_action_t unlang_module(rlm_rcode_t *p_result, request_t *request) fr_table_str_by_value(mod_rcode_table, rcode, "")); - if (rcode == RLM_MODULE_YIELD) { + if (ua == UNLANG_ACTION_YIELD) { state->thread->active_callers++; if (stack_depth < stack->depth) return UNLANG_ACTION_PUSHED_CHILD; fr_assert(stack_depth == stack->depth); - *p_result = rcode; frame->process = unlang_module_resume; return UNLANG_ACTION_YIELD; } @@ -862,7 +869,7 @@ done: * more asynchronous calls onto the stack. These need to * be run before the next module runs. */ - if (stack_depth < stack->depth) { + if (ua == UNLANG_ACTION_PUSHED_CHILD) { state->rcode = rcode; repeatable_set(frame); frame->process = unlang_module_resume_final; @@ -873,7 +880,7 @@ done: if (state->p_result) *state->p_result = rcode; *p_result = rcode; - return UNLANG_ACTION_CALCULATE_RESULT; + return ua; } void unlang_module_init(void) diff --git a/src/lib/unlang/module.h b/src/lib/unlang/module.h index 6f8f3d0358d..0f267120945 100644 --- a/src/lib/unlang/module.h +++ b/src/lib/unlang/module.h @@ -69,13 +69,15 @@ typedef void (*unlang_module_fd_event_t)(module_ctx_t const *mctx, request_t *re * * The resumed request cannot call the normal "authorize", etc. method. It needs a separate callback. * + * @param[out] p_result result of the operation. * @param[in] mctx calling context for the module. * Contains global, thread-specific, and call-specific data for a module. * @param[in] request the current request. * @param[in] rctx a local context for the callback. - * @return a normal rlm_rcode_t. + * @return an instruction for the interpreter. */ -typedef rlm_rcode_t (*unlang_module_resume_t)(module_ctx_t const *mctx, request_t *request, void *rctx); +typedef unlang_action_t (*unlang_module_resume_t)(rlm_rcode_t *p_result, module_ctx_t const *mctx, + request_t *request, void *rctx); /** A callback when the request gets a fr_state_signal_t. * @@ -112,29 +114,30 @@ int unlang_module_push(rlm_rcode_t *out, request_t *request, request_t *unlang_module_subrequest_alloc(request_t *parent, fr_dict_t const *namespace); -rlm_rcode_t unlang_module_yield_to_subrequest(rlm_rcode_t *out, request_t *child, +unlang_action_t unlang_module_yield_to_subrequest(rlm_rcode_t *out, request_t *child, unlang_module_resume_t resume, unlang_module_signal_t signal, unlang_subrequest_session_t const *session, void *rctx); -rlm_rcode_t unlang_module_yield_to_section(request_t *request, CONF_SECTION *subcs, +unlang_action_t unlang_module_yield_to_section(rlm_rcode_t *p_result, + request_t *request, CONF_SECTION *subcs, rlm_rcode_t default_rcode, unlang_module_resume_t resume, unlang_module_signal_t signal, void *rctx); -rlm_rcode_t unlang_module_yield_to_xlat(TALLOC_CTX *ctx, fr_value_box_t **out, +unlang_action_t unlang_module_yield_to_xlat(TALLOC_CTX *ctx, fr_value_box_t **out, request_t *request, xlat_exp_t const *xlat, unlang_module_resume_t resume, unlang_module_signal_t signal, void *rctx); -rlm_rcode_t unlang_module_yield_to_tmpl(TALLOC_CTX *ctx, fr_value_box_t **out, int *status, +unlang_action_t unlang_module_yield_to_tmpl(TALLOC_CTX *ctx, fr_value_box_t **out, int *status, request_t *request, tmpl_t const *exp, fr_pair_t *vps, unlang_module_resume_t resume, unlang_module_signal_t signal, void *rctx); -rlm_rcode_t unlang_module_yield(request_t *request, +unlang_action_t unlang_module_yield(request_t *request, unlang_module_resume_t resume, unlang_module_signal_t signal, void *rctx); diff --git a/src/lib/unlang/unlang_priv.h b/src/lib/unlang/unlang_priv.h index d67b8ee3355..72a2f8e363c 100644 --- a/src/lib/unlang/unlang_priv.h +++ b/src/lib/unlang/unlang_priv.h @@ -312,7 +312,7 @@ void unlang_op_free(void); * * @{ */ -rlm_rcode_t unlang_io_process_interpret(module_ctx_t const *mctx, request_t *request); +unlang_action_t unlang_io_process_interpret(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request); request_t *unlang_io_subrequest_alloc(request_t *parent, fr_dict_t const *namespace, bool detachable); diff --git a/src/lib/unlang/xlat_builtin.c b/src/lib/unlang/xlat_builtin.c index f0e6ecce94b..9cc09a25eba 100644 --- a/src/lib/unlang/xlat_builtin.c +++ b/src/lib/unlang/xlat_builtin.c @@ -77,7 +77,7 @@ static fr_sbuff_parse_rules_t const xlat_arg_parse_rules = { */ int xlat_fmt_get_vp(fr_pair_t **out, request_t *request, char const *name) { - int rcode; + int ret; tmpl_t *vpt; *out = NULL; @@ -88,10 +88,10 @@ int xlat_fmt_get_vp(fr_pair_t **out, request_t *request, char const *name) .prefix = TMPL_ATTR_REF_PREFIX_AUTO }) <= 0) return -4; - rcode = tmpl_find_vp(out, request, vpt); + ret = tmpl_find_vp(out, request, vpt); talloc_free(vpt); - return rcode; + return ret; } @@ -110,7 +110,7 @@ int xlat_fmt_get_vp(fr_pair_t **out, request_t *request, char const *name) */ int xlat_fmt_copy_vp(TALLOC_CTX *ctx, fr_pair_t **out, request_t *request, char const *name) { - int rcode; + int ret; tmpl_t *vpt; *out = NULL; @@ -118,10 +118,10 @@ int xlat_fmt_copy_vp(TALLOC_CTX *ctx, fr_pair_t **out, request_t *request, char if (tmpl_afrom_attr_str(request, NULL, &vpt, name, &(tmpl_rules_t){ .dict_def = request->dict }) <= 0) return -4; - rcode = tmpl_copy_pairs(ctx, out, request, vpt); + ret = tmpl_copy_pairs(ctx, out, request, vpt); talloc_free(vpt); - return rcode; + return ret; } @@ -565,7 +565,7 @@ static ssize_t xlat_redundant(TALLOC_CTX *ctx, char **out, NDEBUG_UNUSED size_t for (ci = cf_item_next(xr->cs, NULL); ci != NULL; ci = cf_item_next(xr->cs, ci)) { - ssize_t rcode; + ssize_t ret; if (!cf_item_is_pair(ci)) continue; @@ -582,12 +582,12 @@ static ssize_t xlat_redundant(TALLOC_CTX *ctx, char **out, NDEBUG_UNUSED size_t *out = NULL; } - rcode = xlat->func.sync(ctx, out, xlat->buf_len, xlat->mod_inst, NULL, request, fmt); - if (rcode <= 0) { + ret = xlat->func.sync(ctx, out, xlat->buf_len, xlat->mod_inst, NULL, request, fmt); + if (ret <= 0) { TALLOC_FREE(*out); continue; } - return rcode; + return ret; } /* @@ -672,7 +672,7 @@ static ssize_t xlat_load_balance(TALLOC_CTX *ctx, char **out, NDEBUG_UNUSED size xlat = xlat_func_find(name, -1); if (xlat) { - ssize_t rcode; + ssize_t ret; if (xlat->buf_len > 0) { *out = talloc_array(ctx, char, xlat->buf_len); @@ -680,8 +680,8 @@ static ssize_t xlat_load_balance(TALLOC_CTX *ctx, char **out, NDEBUG_UNUSED size } else { *out = NULL; } - rcode = xlat->func.sync(ctx, out, xlat->buf_len, xlat->mod_inst, NULL, request, fmt); - if (rcode > 0) return rcode; + ret = xlat->func.sync(ctx, out, xlat->buf_len, xlat->mod_inst, NULL, request, fmt); + if (ret > 0) return ret; TALLOC_FREE(*out); } diff --git a/src/lib/util/cap.c b/src/lib/util/cap.c index e37287e2103..6965251be5d 100644 --- a/src/lib/util/cap.c +++ b/src/lib/util/cap.c @@ -104,7 +104,7 @@ done: */ int fr_cap_enable(cap_value_t cap, cap_flag_t set) { - int rcode = -1; + int ret = -1; cap_t caps = NULL; cap_flag_value_t state; @@ -191,12 +191,12 @@ int fr_cap_enable(cap_value_t cap, cap_flag_t set) goto done; } - rcode = 0; + ret = 0; /* * It's already in the effective set */ } else if (state == CAP_SET) { - rcode = 0; + ret = 0; } done: @@ -204,7 +204,7 @@ done: if (caps) cap_free(caps); - return rcode; + return ret; } /** Remove a CAP_* from the permitted, effective or inheritable set @@ -220,7 +220,7 @@ done: */ int fr_cap_disable(cap_value_t cap, cap_flag_t set) { - int rcode = -1; + int ret = -1; cap_t caps; cap_flag_value_t state; @@ -271,9 +271,9 @@ int fr_cap_disable(cap_value_t cap, cap_flag_t set) goto done; } - rcode = 0; + ret = 0; } else { - rcode = 0; + ret = 0; } done: @@ -281,6 +281,6 @@ done: if (caps) cap_free(caps); - return rcode; + return ret; } #endif /* HAVE_CAPABILITY_H */ diff --git a/src/lib/util/dict_tokenize.c b/src/lib/util/dict_tokenize.c index ab2d1eec29d..5dc1cc239b5 100644 --- a/src/lib/util/dict_tokenize.c +++ b/src/lib/util/dict_tokenize.c @@ -139,7 +139,7 @@ int fr_dict_str_to_argv(char *str, char **argv, int max_argc) static int dict_read_sscanf_i(unsigned int *pvalue, char const *str) { - int rcode = 0; + int ret = 0; int base = 10; static char const *tab = "0123456789"; @@ -159,12 +159,12 @@ static int dict_read_sscanf_i(unsigned int *pvalue, char const *str) c = memchr(tab, tolower((int)*str), base); if (!c) return 0; - rcode *= base; - rcode += (c - tab); + ret *= base; + ret += (c - tab); str++; } - *pvalue = rcode; + *pvalue = ret; return 1; } @@ -2001,7 +2001,7 @@ static int _dict_from_file(dict_tokenize_ctx_t *ctx, * See if we need to import another dictionary. */ if (strncasecmp(argv[0], "$INCLUDE", 8) == 0) { - int rcode; + int ret; int stack_depth = ctx->stack_depth; /* @@ -2021,13 +2021,13 @@ static int _dict_from_file(dict_tokenize_ctx_t *ctx, * parent. */ - rcode = _dict_from_file(ctx, dir, argv[1], fn, line); - if ((rcode == -2) && (argv[0][8] == '-')) { + ret = _dict_from_file(ctx, dir, argv[1], fn, line); + if ((ret == -2) && (argv[0][8] == '-')) { fr_strerror_printf(NULL); /* delete all errors */ - rcode = 0; + ret = 0; } - if (rcode < 0) { + if (ret < 0) { fr_strerror_printf_push("from $INCLUDE at %s[%d]", fn, line); fclose(fp); return -1; @@ -2454,7 +2454,7 @@ static int dict_from_file(fr_dict_t *dict, char const *dir_name, char const *filename, char const *src_file, int src_line) { - int rcode; + int ret; dict_tokenize_ctx_t ctx; memset(&ctx, 0, sizeof(ctx)); @@ -2464,11 +2464,11 @@ static int dict_from_file(fr_dict_t *dict, ctx.stack[0].da = dict->root; ctx.stack[0].nest = FR_TYPE_MAX; - rcode = _dict_from_file(&ctx, + ret = _dict_from_file(&ctx, dir_name, filename, src_file, src_line); - if (rcode < 0) { + if (ret < 0) { talloc_free(ctx.fixup_pool); - return rcode; + return ret; } /* diff --git a/src/lib/util/dict_util.c b/src/lib/util/dict_util.c index fa044e5797f..d40a4a0ec68 100644 --- a/src/lib/util/dict_util.c +++ b/src/lib/util/dict_util.c @@ -3288,14 +3288,14 @@ static int dict_walk(fr_dict_attr_t const *da, void *ctx, fr_dict_walk_t callbac len = talloc_array_length(children); for (i = 0; i < len; i++) { - int rcode; + int ret; fr_dict_attr_t const *bin; if (!children[i]) continue; for (bin = children[i]; bin; bin = bin->next) { - rcode = dict_walk(bin, ctx, callback, depth); - if (rcode < 0) return rcode; + ret = dict_walk(bin, ctx, callback, depth); + if (ret < 0) return ret; } } diff --git a/src/lib/util/hash.c b/src/lib/util/hash.c index 5090354f56b..53663b34bfc 100644 --- a/src/lib/util/hash.c +++ b/src/lib/util/hash.c @@ -621,7 +621,7 @@ int fr_hash_table_walk(fr_hash_table_t *ht, fr_hash_table_walk_t callback, void *context) { - int i, rcode; + int i, ret; if (!ht || !callback) return 0; @@ -636,9 +636,9 @@ int fr_hash_table_walk(fr_hash_table_t *ht, for (node = ht->buckets[i]; node != &ht->null; node = next) { next = node->next; - rcode = callback(context, node->data); + ret = callback(context, node->data); - if (rcode != 0) return rcode; + if (ret != 0) return ret; } } diff --git a/src/lib/util/rbtree.c b/src/lib/util/rbtree.c index 4ceebe46d5f..799cb8d3369 100644 --- a/src/lib/util/rbtree.c +++ b/src/lib/util/rbtree.c @@ -618,23 +618,23 @@ void *rbtree_finddata(rbtree_t *tree, void const *data) */ static int walk_node_pre_order(rbnode_t *x, rb_walker_t compare, void *uctx) { - int rcode; + int ret; rbnode_t *left, *right; left = x->left; right = x->right; - rcode = compare(x->data, uctx); - if (rcode != 0) return rcode; + ret = compare(x->data, uctx); + if (ret != 0) return ret; if (left != NIL) { - rcode = walk_node_pre_order(left, compare, uctx); - if (rcode != 0) return rcode; + ret = walk_node_pre_order(left, compare, uctx); + if (ret != 0) return ret; } if (right != NIL) { - rcode = walk_node_pre_order(right, compare, uctx); - if (rcode != 0) return rcode; + ret = walk_node_pre_order(right, compare, uctx); + if (ret != 0) return ret; } return 0; /* we know everything returned zero */ @@ -645,22 +645,22 @@ static int walk_node_pre_order(rbnode_t *x, rb_walker_t compare, void *uctx) */ static int walk_node_in_order(rbnode_t *x, rb_walker_t compare, void *uctx) { - int rcode; + int ret; rbnode_t *right; if (x->left != NIL) { - rcode = walk_node_in_order(x->left, compare, uctx); - if (rcode != 0) return rcode; + ret = walk_node_in_order(x->left, compare, uctx); + if (ret != 0) return ret; } right = x->right; - rcode = compare(x->data, uctx); - if (rcode != 0) return rcode; + ret = compare(x->data, uctx); + if (ret != 0) return ret; if (right != NIL) { - rcode = walk_node_in_order(right, compare, uctx); - if (rcode != 0) return rcode; + ret = walk_node_in_order(right, compare, uctx); + if (ret != 0) return ret; } return 0; /* we know everything returned zero */ @@ -672,20 +672,20 @@ static int walk_node_in_order(rbnode_t *x, rb_walker_t compare, void *uctx) */ static int walk_node_post_order(rbnode_t *x, rb_walker_t compare, void *uctx) { - int rcode; + int ret; if (x->left != NIL) { - rcode = walk_node_post_order(x->left, compare, uctx); - if (rcode != 0) return rcode; + ret = walk_node_post_order(x->left, compare, uctx); + if (ret != 0) return ret; } if (x->right != NIL) { - rcode = walk_node_post_order(x->right, compare, uctx); - if (rcode != 0) return rcode; + ret = walk_node_post_order(x->right, compare, uctx); + if (ret != 0) return ret; } - rcode = compare(x->data, uctx); - if (rcode != 0) return rcode; + ret = compare(x->data, uctx); + if (ret != 0) return ret; return 0; /* we know everything returned zero */ } @@ -707,7 +707,7 @@ static int walk_node_post_order(rbnode_t *x, rb_walker_t compare, void *uctx) static int walk_delete_order(rbtree_t *tree, rb_walker_t compare, void *uctx) { rbnode_t *solid, *x; - int rcode = 0; + int ret = 0; /* Keep track of last node that refused deletion. */ solid = NIL; @@ -719,14 +719,14 @@ static int walk_delete_order(rbtree_t *tree, rb_walker_t compare, void *uctx) x = x->left; } visit: - rcode = compare(x->data, uctx); - if (rcode < 0) { - return rcode; + ret = compare(x->data, uctx); + if (ret < 0) { + return ret; } - if (rcode) { + if (ret) { rbtree_delete_internal(tree, x, true); - if (rcode != 2) { - return rcode; + if (ret != 2) { + return ret; } } else { solid = x; @@ -746,7 +746,7 @@ static int walk_delete_order(rbtree_t *tree, rb_walker_t compare, void *uctx) x = x->parent; } } - return rcode; + return ret; } @@ -759,7 +759,7 @@ static int walk_delete_order(rbtree_t *tree, rb_walker_t compare, void *uctx) */ int rbtree_walk(rbtree_t *tree, rb_order_t order, rb_walker_t compare, void *uctx) { - int rcode; + int ret; if (tree->root == NIL) return 0; @@ -767,28 +767,28 @@ int rbtree_walk(rbtree_t *tree, rb_order_t order, rb_walker_t compare, void *uct switch (order) { case RBTREE_PRE_ORDER: - rcode = walk_node_pre_order(tree->root, compare, uctx); + ret = walk_node_pre_order(tree->root, compare, uctx); break; case RBTREE_IN_ORDER: - rcode = walk_node_in_order(tree->root, compare, uctx); + ret = walk_node_in_order(tree->root, compare, uctx); break; case RBTREE_POST_ORDER: - rcode = walk_node_post_order(tree->root, compare, uctx); + ret = walk_node_post_order(tree->root, compare, uctx); break; case RBTREE_DELETE_ORDER: - rcode = walk_delete_order(tree, compare, uctx); + ret = walk_delete_order(tree, compare, uctx); break; default: - rcode = -1; + ret = -1; break; } if (tree->lock) pthread_mutex_unlock(&tree->mutex); - return rcode; + return ret; } uint32_t rbtree_num_elements(rbtree_t *tree) diff --git a/src/lib/util/socket.c b/src/lib/util/socket.c index a470ce70980..d0c886ed68a 100644 --- a/src/lib/util/socket.c +++ b/src/lib/util/socket.c @@ -94,15 +94,15 @@ static int socket_port_from_service(int proto, char const *port_name) #ifdef FD_CLOEXEC static int socket_dont_inherit(int sockfd) { - int rcode; + int ret; /* * We don't want child processes inheriting these * file descriptors. */ - rcode = fcntl(sockfd, F_GETFD); - if (rcode >= 0) { - if (fcntl(sockfd, F_SETFD, rcode | FD_CLOEXEC) < 0) { + ret = fcntl(sockfd, F_GETFD); + if (ret >= 0) { + if (fcntl(sockfd, F_SETFD, ret | FD_CLOEXEC) < 0) { fr_strerror_printf("Failed setting close on exec: %s", fr_syserror(errno)); return -1; } @@ -829,7 +829,7 @@ int fr_socket_server_tcp(fr_ipaddr_t const *src_ipaddr, uint16_t *src_port, char */ int fr_socket_bind(int sockfd, fr_ipaddr_t const *src_ipaddr, uint16_t *src_port, char const *interface) { - int rcode; + int ret; uint16_t my_port = 0; fr_ipaddr_t my_ipaddr; struct sockaddr_storage salocal; @@ -895,8 +895,8 @@ int fr_socket_bind(int sockfd, fr_ipaddr_t const *src_ipaddr, uint16_t *src_port * and set the scope_id. */ if (!my_ipaddr.scope_id) { - rcode = setsockopt(sockfd, SOL_SOCKET, SO_BINDTODEVICE, interface, strlen(interface)); - if (rcode < 0) { + ret = setsockopt(sockfd, SOL_SOCKET, SO_BINDTODEVICE, interface, strlen(interface)); + if (ret < 0) { fr_strerror_printf_push("Bind failed on interface %s: %s", interface, fr_syserror(errno)); return -1; @@ -991,14 +991,14 @@ int fr_socket_bind(int sockfd, fr_ipaddr_t const *src_ipaddr, uint16_t *src_port */ if (fr_ipaddr_to_sockaddr(&salocal, &salen, &my_ipaddr, my_port) < 0) return -1; - rcode = bind(sockfd, (struct sockaddr *) &salocal, salen); - if (rcode < 0) { + ret = bind(sockfd, (struct sockaddr *) &salocal, salen); + if (ret < 0) { fr_strerror_printf_push("Bind failed with source address %pV:%pV on interface %s: %s", src_ipaddr ? fr_box_ipaddr(*src_ipaddr) : fr_box_strvalue("*"), src_port ? fr_box_int16(*src_port) : fr_box_strvalue("*"), interface ? interface : "*", fr_syserror(errno)); - return rcode; + return ret; } if (!src_port) goto done; diff --git a/src/lib/util/token.c b/src/lib/util/token.c index 0b46c289468..b0360fe5cbd 100644 --- a/src/lib/util/token.c +++ b/src/lib/util/token.c @@ -263,7 +263,7 @@ static fr_token_t getthing(char const **ptr, char *buf, int buflen, bool tok, char quote; unsigned int x; size_t i; - fr_token_t rcode; + fr_token_t token; buf[0] = '\0'; @@ -286,7 +286,7 @@ static fr_token_t getthing(char const **ptr, char *buf, int buflen, bool tok, strcpy(buf, tokenlist[i].name.str); p += tokenlist[i].name.len; - rcode = tokenlist[i].value; + token = tokenlist[i].value; goto done; } } @@ -296,23 +296,23 @@ static fr_token_t getthing(char const **ptr, char *buf, int buflen, bool tok, quote = '\0'; switch (*p) { default: - rcode = T_BARE_WORD; + token = T_BARE_WORD; break; case '\'': - rcode = T_SINGLE_QUOTED_STRING; + token = T_SINGLE_QUOTED_STRING; break; case '"': - rcode = T_DOUBLE_QUOTED_STRING; + token = T_DOUBLE_QUOTED_STRING; break; case '`': - rcode = T_BACK_QUOTED_STRING; + token = T_BACK_QUOTED_STRING; break; } - if (rcode != T_BARE_WORD) { + if (token != T_BARE_WORD) { quote = *p; p++; } @@ -427,7 +427,7 @@ done: *ptr = p; - return rcode; + return token; } /* @@ -454,14 +454,14 @@ fr_token_t gettoken(char const **ptr, char *buf, int buflen, bool unescape) fr_token_t getop(char const **ptr) { char op[3]; - fr_token_t rcode; + fr_token_t token; - rcode = getthing(ptr, op, sizeof(op), true, fr_tokens_table, fr_tokens_table_len, false); - if (!fr_assignment_op[rcode] && !fr_equality_op[rcode]) { + token = getthing(ptr, op, sizeof(op), true, fr_tokens_table, fr_tokens_table_len, false); + if (!fr_assignment_op[token] && !fr_equality_op[token]) { fr_strerror_printf("Expected operator"); return T_INVALID; } - return rcode; + return token; } /* diff --git a/src/lib/util/trie.c b/src/lib/util/trie.c index 83fbf265f18..0b663cdd2b3 100644 --- a/src/lib/util/trie.c +++ b/src/lib/util/trie.c @@ -3238,7 +3238,7 @@ static fr_trie_command_t commands[] = { int main(int argc, char **argv) { int lineno = 0; - int rcode = 0; + int ret = 0; fr_trie_t *ft; FILE *fp; int my_argc; @@ -3310,7 +3310,7 @@ int main(int argc, char **argv) if (cmd < 0) { fprintf(stderr, "Unknown command '%s' at line %d\n", my_argv[0], lineno); - rcode = 1; + ret = 1; break; } @@ -3354,6 +3354,6 @@ int main(int argc, char **argv) talloc_report_full(NULL, stdout); /* Print details of any leaked memory */ talloc_disable_null_tracking(); /* Cleanup talloc null tracking context */ - return rcode; + return ret; } #endif diff --git a/src/modules/proto_arp/proto_arp_process.c b/src/modules/proto_arp/proto_arp_process.c index 5b093126d75..490b8a2d92d 100644 --- a/src/modules/proto_arp/proto_arp_process.c +++ b/src/modules/proto_arp/proto_arp_process.c @@ -46,7 +46,7 @@ fr_dict_attr_autoload_t proto_arp_process_dict_attr[] = { { NULL } }; -static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_process(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request) { rlm_rcode_t rcode; CONF_SECTION *unlang; @@ -80,7 +80,7 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque dv = fr_dict_enum_by_value(attr_arp_operation, fr_box_uint16(request->packet->code)); if (!dv) { REDEBUG("Failed to find value for &request.ARP-Operation"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } unlang = cf_section_find(request->server_cs, "recv", dv->name); @@ -92,7 +92,7 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque RDEBUG("Running 'recv %s' from file %s", cf_section_name2(unlang), cf_filename(unlang)); if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } request->request_state = REQUEST_RECV; @@ -101,9 +101,12 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque case REQUEST_RECV: rcode = unlang_interpret(request); - if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED; + if (request->master_state == REQUEST_STOP_PROCESSING) { + *p_result = RLM_MODULE_HANDLED; + return UNLANG_ACTION_STOP_PROCESSING; + } - if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD; + if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD; /* * Allow the admin to explicitly set the reply @@ -134,7 +137,7 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque * Some types don't send a reply, and don't run "send Do-Not-Respond" */ if (!request->reply->code) { - return RLM_MODULE_HANDLED; + RETURN_MODULE_HANDLED; } dv = fr_dict_enum_by_value(da, fr_box_uint8(request->reply->code)); @@ -146,7 +149,7 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque rerun_nak: RDEBUG("Running 'send %s' from file %s", cf_section_name2(unlang), cf_filename(unlang)); if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } request->request_state = REQUEST_SEND; @@ -155,9 +158,12 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque case REQUEST_SEND: rcode = unlang_interpret(request); - if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED; + if (request->master_state == REQUEST_STOP_PROCESSING) { + *p_result = RLM_MODULE_HANDLED; + return UNLANG_ACTION_STOP_PROCESSING; + } - if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD; + if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD; switch (rcode) { case RLM_MODULE_NOOP: @@ -200,7 +206,7 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque */ if (request->reply->code == FR_ARP_CODE_DO_NOT_RESPOND) { RDEBUG("Not sending reply to client"); - return RLM_MODULE_HANDLED; + RETURN_MODULE_HANDLED; } if (request->parent && RDEBUG_ENABLED) { @@ -210,10 +216,10 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque break; default: - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } diff --git a/src/modules/proto_control/radmin.c b/src/modules/proto_control/radmin.c index 746b28cab66..612bd9b4002 100644 --- a/src/modules/proto_control/radmin.c +++ b/src/modules/proto_control/radmin.c @@ -794,7 +794,7 @@ static fr_cmd_info_t local_info; static int local_command(char *line) { - int argc, rcode; + int argc, ret; argc = fr_command_str_to_argv(local_cmds, &local_info, line); if (argc < 0) { @@ -806,7 +806,7 @@ static int local_command(char *line) return 0; } - rcode = fr_command_run(stderr, stdout, &local_info, false); + ret = fr_command_run(stderr, stdout, &local_info, false); fflush(stdout); fflush(stderr); @@ -815,7 +815,7 @@ static int local_command(char *line) */ (void) fr_command_clear(0, &local_info); - if (rcode < 0) return rcode; + if (ret < 0) return ret; return 1; diff --git a/src/modules/proto_detail/proto_detail_process.c b/src/modules/proto_detail/proto_detail_process.c index 84dd3002571..8afa629e939 100644 --- a/src/modules/proto_detail/proto_detail_process.c +++ b/src/modules/proto_detail/proto_detail_process.c @@ -47,7 +47,7 @@ fr_dict_attr_autoload_t proto_detail_process_dict_attr[] = { { NULL } }; -static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { proto_detail_process_t const *inst = talloc_get_type_abort_const(mctx->instance, proto_detail_process_t); fr_pair_t *vp; @@ -68,12 +68,12 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) unlang = cf_section_find(request->server_cs, "recv", NULL); if (!unlang) { REDEBUG("Failed to find 'recv' section"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } RDEBUG("Running 'recv' from file %s", cf_filename(unlang)); if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } request->request_state = REQUEST_RECV; @@ -82,9 +82,12 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) case REQUEST_RECV: rcode = unlang_interpret(request); - if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED; + if (request->master_state == REQUEST_STOP_PROCESSING) { + *p_result = RLM_MODULE_HANDLED; + return UNLANG_ACTION_STOP_PROCESSING; + } - if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD; + if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD; switch (rcode) { /* @@ -145,7 +148,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) RDEBUG("Running 'send %s { ... }' from file %s", cf_section_name2(unlang), cf_filename(unlang)); if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } request->request_state = REQUEST_SEND; @@ -154,9 +157,12 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) case REQUEST_SEND: rcode = unlang_interpret(request); - if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED; + if (request->master_state == REQUEST_STOP_PROCESSING) { + *p_result = RLM_MODULE_HANDLED; + return UNLANG_ACTION_STOP_PROCESSING; + } - if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD; + if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD; switch (rcode) { case RLM_MODULE_NOOP: @@ -188,10 +194,10 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) break; default: - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } diff --git a/src/modules/proto_dhcpv4/proto_dhcpv4_process.c b/src/modules/proto_dhcpv4/proto_dhcpv4_process.c index 95a5ee7e8c0..81cc3b69cca 100644 --- a/src/modules/proto_dhcpv4/proto_dhcpv4_process.c +++ b/src/modules/proto_dhcpv4/proto_dhcpv4_process.c @@ -109,7 +109,7 @@ static void dhcpv4_packet_debug(request_t *request, fr_radius_packet_t *packet, } } -static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_process(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request) { rlm_rcode_t rcode; CONF_SECTION *unlang; @@ -155,7 +155,7 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque dv = fr_dict_enum_by_value(attr_message_type, fr_box_uint8(request->packet->code)); if (!dv) { REDEBUG("Failed to find value for &request.DHCP-Message-Type"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } unlang = cf_section_find(request->server_cs, "recv", dv->name); @@ -167,7 +167,7 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque RDEBUG("Running 'recv %s' from file %s", cf_section_name2(unlang), cf_filename(unlang)); if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } request->request_state = REQUEST_RECV; @@ -176,9 +176,12 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque case REQUEST_RECV: rcode = unlang_interpret(request); - if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED; + if (request->master_state == REQUEST_STOP_PROCESSING) { + *p_result = RLM_MODULE_HANDLED; + return UNLANG_ACTION_STOP_PROCESSING; + } - if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD; + if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD; /* * Allow the admin to explicitly set the reply @@ -209,7 +212,7 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque * DHCP-Release / Decline doesn't send a reply, and doesn't run "send DHCP-Do-Not-Respond" */ if (!request->reply->code) { - return RLM_MODULE_HANDLED; + RETURN_MODULE_HANDLED; } /* @@ -232,7 +235,7 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque rerun_nak: RDEBUG("Running 'send %s' from file %s", cf_section_name2(unlang), cf_filename(unlang)); if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } request->request_state = REQUEST_SEND; @@ -241,9 +244,12 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque case REQUEST_SEND: rcode = unlang_interpret(request); - if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED; + if (request->master_state == REQUEST_STOP_PROCESSING) { + *p_result = RLM_MODULE_HANDLED; + return UNLANG_ACTION_STOP_PROCESSING; + } - if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD; + if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD; switch (rcode) { case RLM_MODULE_NOOP: @@ -282,17 +288,17 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque */ if (request->reply->code == FR_DHCP_MESSAGE_TYPE_VALUE_DHCP_DO_NOT_RESPOND) { RDEBUG("Not sending reply to client"); - return RLM_MODULE_HANDLED; + RETURN_MODULE_HANDLED; } if (RDEBUG_ENABLED) dhcpv4_packet_debug(request, request->reply, false); break; default: - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } static const virtual_server_compile_t compile_list[] = { diff --git a/src/modules/proto_dhcpv4/proto_dhcpv4_udp.c b/src/modules/proto_dhcpv4/proto_dhcpv4_udp.c index 0f15e000e48..646f6cbe035 100644 --- a/src/modules/proto_dhcpv4/proto_dhcpv4_udp.c +++ b/src/modules/proto_dhcpv4/proto_dhcpv4_udp.c @@ -622,7 +622,7 @@ static void *mod_track_create(TALLOC_CTX *ctx, uint8_t const *packet, size_t pac static int mod_compare(UNUSED void const *instance, UNUSED void *thread_instance, UNUSED RADCLIENT *client, void const *one, void const *two) { - int rcode; + int ret; proto_dhcpv4_track_t const *a = one; proto_dhcpv4_track_t const *b = two; @@ -630,20 +630,20 @@ static int mod_compare(UNUSED void const *instance, UNUSED void *thread_instance * The tree is ordered by XIDs, which are (hopefully) * pseudo-randomly distributed. */ - rcode = memcmp(&a->xid, &b->xid, sizeof(a->xid)); - if (rcode != 0) return rcode; + ret = memcmp(&a->xid, &b->xid, sizeof(a->xid)); + if (ret != 0) return ret; /* * Hardware addresses should also be randomly distributed. */ - rcode = memcmp(&a->chaddr, &b->chaddr, sizeof(a->chaddr)); - if (rcode != 0) return rcode; + ret = memcmp(&a->chaddr, &b->chaddr, sizeof(a->chaddr)); + if (ret != 0) return ret; /* * Compare giaddr, but not ciaddr */ - rcode = memcmp(&a->giaddr, &b->giaddr, sizeof(a->giaddr)); - if (rcode != 0) return rcode; + ret = memcmp(&a->giaddr, &b->giaddr, sizeof(a->giaddr)); + if (ret != 0) return ret; return (a->message_type < b->message_type) - (a->message_type > b->message_type); } diff --git a/src/modules/proto_dhcpv6/proto_dhcpv6_process.c b/src/modules/proto_dhcpv6/proto_dhcpv6_process.c index 5c4e4be1c9a..af8731a5824 100644 --- a/src/modules/proto_dhcpv6/proto_dhcpv6_process.c +++ b/src/modules/proto_dhcpv6/proto_dhcpv6_process.c @@ -90,7 +90,7 @@ static void dhcpv6_packet_debug(request_t *request, fr_radius_packet_t *packet, } } -static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_process(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request) { rlm_rcode_t rcode; CONF_SECTION *unlang; @@ -140,7 +140,7 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque RDEBUG("Running 'recv %s' from file %s", cf_section_name2(unlang), cf_filename(unlang)); if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } request->request_state = REQUEST_RECV; @@ -149,9 +149,12 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque case REQUEST_RECV: rcode = unlang_interpret(request); - if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED; + if (request->master_state == REQUEST_STOP_PROCESSING) { + *p_result = RLM_MODULE_HANDLED; + return UNLANG_ACTION_STOP_PROCESSING; + } - if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD; + if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD; /* * Allow the admin to explicitly set the reply @@ -182,7 +185,7 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque * DHCP-Release / Decline doesn't send a reply, and doesn't run "send DHCP-Do-Not-Respond" */ if (!request->reply->code) { - return RLM_MODULE_HANDLED; + RETURN_MODULE_HANDLED; } dv = fr_dict_enum_by_value(attr_packet_type, fr_box_uint32(request->reply->code)); @@ -194,7 +197,7 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque rerun_nak: RDEBUG("Running 'send %s' from file %s", cf_section_name2(unlang), cf_filename(unlang)); if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } request->request_state = REQUEST_SEND; @@ -203,9 +206,12 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque case REQUEST_SEND: rcode = unlang_interpret(request); - if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED; + if (request->master_state == REQUEST_STOP_PROCESSING) { + *p_result = RLM_MODULE_HANDLED; + return UNLANG_ACTION_STOP_PROCESSING; + } - if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD; + if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD; switch (rcode) { case RLM_MODULE_NOOP: @@ -244,17 +250,17 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque */ if (request->reply->code == FR_DHCPV6_DO_NOT_RESPOND) { RDEBUG("Not sending reply to client"); - return RLM_MODULE_HANDLED; + RETURN_MODULE_HANDLED; } if (RDEBUG_ENABLED) dhcpv6_packet_debug(request, request->reply, false); break; default: - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } diff --git a/src/modules/proto_dhcpv6/proto_dhcpv6_udp.c b/src/modules/proto_dhcpv6/proto_dhcpv6_udp.c index 897136228d5..ffac9abfc5c 100644 --- a/src/modules/proto_dhcpv6/proto_dhcpv6_udp.c +++ b/src/modules/proto_dhcpv6/proto_dhcpv6_udp.c @@ -434,15 +434,15 @@ static void *mod_track_create(TALLOC_CTX *ctx, uint8_t const *packet, size_t pac static int mod_compare(UNUSED void const *instance, UNUSED void *thread_instance, UNUSED RADCLIENT *client, void const *one, void const *two) { - int rcode; + int ret; proto_dhcpv6_track_t const *a = one; proto_dhcpv6_track_t const *b = two; - rcode = memcmp(&a->header, &b->header, sizeof(a->header)); - if (rcode != 0) return rcode; + ret = memcmp(&a->header, &b->header, sizeof(a->header)); + if (ret != 0) return ret; - rcode = (a->client_id_len < b->client_id_len) - (a->client_id_len > b->client_id_len); - if (rcode != 0) return rcode; + ret = (a->client_id_len < b->client_id_len) - (a->client_id_len > b->client_id_len); + if (ret != 0) return ret; return memcmp(a->client_id, b->client_id, a->client_id_len); } diff --git a/src/modules/proto_ldap_sync/proto_ldap_sync.c b/src/modules/proto_ldap_sync/proto_ldap_sync.c index babfd52a14b..0e0c44e0a28 100644 --- a/src/modules/proto_ldap_sync/proto_ldap_sync.c +++ b/src/modules/proto_ldap_sync/proto_ldap_sync.c @@ -1205,32 +1205,32 @@ static int ldap_compile_section(CONF_SECTION *server_cs, char const *name1, char */ static int proto_ldap_listen_compile(CONF_SECTION *server_cs, UNUSED CONF_SECTION *listen_cs) { - int rcode; + int ret; int found = 0; - rcode = ldap_compile_section(server_cs, "load", "Cookie", MOD_AUTHORIZE); - if (rcode < 0) return rcode; - if (rcode > 0) found++; + ret = ldap_compile_section(server_cs, "load", "Cookie", MOD_AUTHORIZE); + if (ret < 0) return ret; + if (ret > 0) found++; - rcode = ldap_compile_section(server_cs, "store", "Cookie", MOD_AUTHORIZE); - if (rcode < 0) return rcode; - if (rcode > 0) found++; + ret = ldap_compile_section(server_cs, "store", "Cookie", MOD_AUTHORIZE); + if (ret < 0) return ret; + if (ret > 0) found++; - rcode = ldap_compile_section(server_cs, "recv", "Add", MOD_AUTHORIZE); - if (rcode < 0) return rcode; - if (rcode > 0) found++; + ret = ldap_compile_section(server_cs, "recv", "Add", MOD_AUTHORIZE); + if (ret < 0) return ret; + if (ret > 0) found++; - rcode = ldap_compile_section(server_cs, "recv", "Present", MOD_AUTHORIZE); - if (rcode < 0) return rcode; - if (rcode > 0) found++; + ret = ldap_compile_section(server_cs, "recv", "Present", MOD_AUTHORIZE); + if (ret < 0) return ret; + if (ret > 0) found++; - rcode = ldap_compile_section(server_cs, "recv", "Delete", MOD_AUTHORIZE); - if (rcode < 0) return rcode; - if (rcode > 0) found++; + ret = ldap_compile_section(server_cs, "recv", "Delete", MOD_AUTHORIZE); + if (ret < 0) return ret; + if (ret > 0) found++; - rcode = ldap_compile_section(server_cs, "recv", "Modify", MOD_AUTHORIZE); - if (rcode < 0) return rcode; - if (rcode > 0) found++; + ret = ldap_compile_section(server_cs, "recv", "Modify", MOD_AUTHORIZE); + if (ret < 0) return ret; + if (ret > 0) found++; if (found == 0) { cf_log_err(server_cs, "At least one of 'recv [Present|Add|Delete|Modify] { ... }' " diff --git a/src/modules/proto_radius/proto_radius_acct.c b/src/modules/proto_radius/proto_radius_acct.c index a11dd43539b..86c932cead0 100644 --- a/src/modules/proto_radius/proto_radius_acct.c +++ b/src/modules/proto_radius/proto_radius_acct.c @@ -49,7 +49,7 @@ fr_dict_attr_autoload_t proto_radius_acct_dict_attr[] = { }; -static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_process(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request) { fr_pair_t *vp; rlm_rcode_t rcode; @@ -76,7 +76,7 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque RDEBUG("Running 'recv Accounting-Request' from file %s", cf_filename(unlang)); if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } request->request_state = REQUEST_RECV; @@ -85,9 +85,12 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque case REQUEST_RECV: rcode = unlang_interpret(request); - if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED; + if (request->master_state == REQUEST_STOP_PROCESSING) { + *p_result = RLM_MODULE_HANDLED; + return UNLANG_ACTION_STOP_PROCESSING; + } - if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD; + if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD; switch (rcode) { /* @@ -133,7 +136,7 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque RDEBUG("Running 'accounting %s' from file %s", cf_section_name2(unlang), cf_filename(unlang)); if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } request->request_state = REQUEST_PROCESS; @@ -142,9 +145,12 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque case REQUEST_PROCESS: rcode = unlang_interpret(request); - if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED; + if (request->master_state == REQUEST_STOP_PROCESSING) { + *p_result = RLM_MODULE_HANDLED; + return UNLANG_ACTION_STOP_PROCESSING; + } - if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD; + if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD; switch (rcode) { /* @@ -187,7 +193,7 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque RDEBUG("Running 'send %s' from file %s", cf_section_name2(unlang), cf_filename(unlang)); if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } request->request_state = REQUEST_SEND; @@ -196,9 +202,12 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque case REQUEST_SEND: rcode = unlang_interpret(request); - if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED; + if (request->master_state == REQUEST_STOP_PROCESSING) { + *p_result = RLM_MODULE_HANDLED; + return UNLANG_ACTION_STOP_PROCESSING; + } - if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD; + if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD; switch (rcode) { case RLM_MODULE_NOOP: @@ -232,10 +241,10 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque break; default: - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } diff --git a/src/modules/proto_radius/proto_radius_auth.c b/src/modules/proto_radius/proto_radius_auth.c index 5207f7e538c..cda069b4ff0 100644 --- a/src/modules/proto_radius/proto_radius_auth.c +++ b/src/modules/proto_radius/proto_radius_auth.c @@ -268,7 +268,7 @@ static void CC_HINT(format (printf, 4, 5)) auth_message(proto_radius_auth_t cons talloc_free(msg); } -static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { proto_radius_auth_t const *inst = talloc_get_type_abort_const(mctx->instance, proto_radius_auth_t); fr_pair_t *vp, *auth_type; @@ -306,7 +306,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) RDEBUG("Running 'recv Access-Request' from file %s", cf_filename(inst->recv_access_request)); if (unlang_interpret_push_instruction(request, inst->unlang_access_request, RLM_MODULE_REJECT, UNLANG_TOP_FRAME) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } request->request_state = REQUEST_RECV; @@ -315,9 +315,12 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) case REQUEST_RECV: rcode = unlang_interpret(request); - if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED; + if (request->master_state == REQUEST_STOP_PROCESSING) { + *p_result = RLM_MODULE_HANDLED; + return UNLANG_ACTION_STOP_PROCESSING; + } - if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD; + if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD; switch (rcode) { case RLM_MODULE_NOOP: @@ -427,7 +430,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) RDEBUG("Running 'authenticate %s' from file %s", cf_section_name2(unlang), cf_filename(unlang)); if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOTFOUND, UNLANG_TOP_FRAME) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } request->request_state = REQUEST_PROCESS; @@ -436,9 +439,11 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) case REQUEST_PROCESS: rcode = unlang_interpret(request); - if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED; + if (request->master_state == REQUEST_STOP_PROCESSING) { + RETURN_MODULE_HANDLED; + } - if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD; + if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD; switch (rcode) { /* @@ -561,7 +566,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) RDEBUG("Running 'send %s' from file %s", cf_section_name2(unlang), cf_filename(unlang)); if (unlang_interpret_push_instruction(request, instruction, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } request->request_state = REQUEST_SEND; @@ -570,9 +575,12 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) case REQUEST_SEND: rcode = unlang_interpret(request); - if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED; + if (request->master_state == REQUEST_STOP_PROCESSING) { + *p_result = RLM_MODULE_HANDLED; + return UNLANG_ACTION_STOP_PROCESSING; + } - if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD; + if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD; switch (rcode) { case RLM_MODULE_FAIL: @@ -629,7 +637,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) */ if (fr_request_to_state(inst->state_tree, request) < 0) { request->reply->code = FR_CODE_DO_NOT_RESPOND; - return RLM_MODULE_OK; + RETURN_MODULE_OK; } } else { fr_state_discard(inst->state_tree, request); @@ -670,10 +678,10 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) break; default: - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } static const virtual_server_compile_t compile_list[] = { diff --git a/src/modules/proto_radius/proto_radius_coa.c b/src/modules/proto_radius/proto_radius_coa.c index 61dcef717e2..7d305cf2fa6 100644 --- a/src/modules/proto_radius/proto_radius_coa.c +++ b/src/modules/proto_radius/proto_radius_coa.c @@ -50,7 +50,7 @@ fr_dict_attr_autoload_t proto_radius_coa_dict_attr[] = { { NULL } }; -static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_process(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request) { fr_pair_t *vp; rlm_rcode_t rcode; @@ -74,7 +74,7 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque dv = fr_dict_enum_by_value(attr_packet_type, fr_box_uint32(request->packet->code)); if (!dv) { REDEBUG("Failed to find value for &request.Packet-Type"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* @@ -93,12 +93,12 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque unlang = cf_section_find(request->server_cs, "recv", dv->name); if (!unlang) { REDEBUG("Failed to find 'recv %s' section", dv->name); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } RDEBUG("Running 'recv %s' from file %s", dv->name, cf_filename(unlang)); if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } request->request_state = REQUEST_RECV; @@ -107,9 +107,12 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque case REQUEST_RECV: rcode = unlang_interpret(request); - if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED; + if (request->master_state == REQUEST_STOP_PROCESSING) { + *p_result = RLM_MODULE_HANDLED; + return UNLANG_ACTION_STOP_PROCESSING; + } - if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD; + if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD; switch (rcode) { case RLM_MODULE_NOOP: @@ -154,7 +157,7 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque rerun_nak: RDEBUG("Running 'send %s' from file %s", cf_section_name2(unlang), cf_filename(unlang)); if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } request->request_state = REQUEST_SEND; FALL_THROUGH; @@ -162,9 +165,12 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque case REQUEST_SEND: rcode = unlang_interpret(request); - if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED; + if (request->master_state == REQUEST_STOP_PROCESSING) { + *p_result = RLM_MODULE_HANDLED; + return UNLANG_ACTION_STOP_PROCESSING; + } - if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD; + if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD; switch (rcode) { /* @@ -229,10 +235,10 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque break; default: - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } static const virtual_server_compile_t compile_list[] = { diff --git a/src/modules/proto_radius/proto_radius_dynamic_client.c b/src/modules/proto_radius/proto_radius_dynamic_client.c index 50232306e30..87d72d751fd 100644 --- a/src/modules/proto_radius/proto_radius_dynamic_client.c +++ b/src/modules/proto_radius/proto_radius_dynamic_client.c @@ -58,7 +58,7 @@ fr_dict_attr_autoload_t proto_radius_dynamic_client_dict_attr[] = { { NULL } }; -static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_process(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request) { rlm_rcode_t rcode; CONF_SECTION *unlang; @@ -78,7 +78,7 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque RDEBUG("Running 'new client' from file %s", cf_filename(unlang)); if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } request->request_state = REQUEST_RECV; @@ -87,9 +87,12 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque case REQUEST_RECV: rcode = unlang_interpret(request); - if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED; + if (request->master_state == REQUEST_STOP_PROCESSING) { + *p_result = RLM_MODULE_HANDLED; + return UNLANG_ACTION_STOP_PROCESSING; + } - if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD; + if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD; switch (rcode) { case RLM_MODULE_OK: case RLM_MODULE_UPDATED: @@ -113,7 +116,7 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque rerun_nak: RDEBUG("Running '%s client' from file %s", cf_section_name1(unlang), cf_filename(unlang)); if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } request->request_state = REQUEST_SEND; @@ -122,9 +125,12 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque case REQUEST_SEND: rcode = unlang_interpret(request); - if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED; + if (request->master_state == REQUEST_STOP_PROCESSING) { + *p_result = RLM_MODULE_HANDLED; + return UNLANG_ACTION_STOP_PROCESSING; + } - if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD; + if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD; switch (rcode) { case RLM_MODULE_NOOP: @@ -188,10 +194,10 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque break; default: - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } diff --git a/src/modules/proto_radius/proto_radius_status.c b/src/modules/proto_radius/proto_radius_status.c index 6b9f58643af..80f600c1847 100644 --- a/src/modules/proto_radius/proto_radius_status.c +++ b/src/modules/proto_radius/proto_radius_status.c @@ -46,7 +46,7 @@ fr_dict_attr_autoload_t proto_radius_status_dict_attr[] = { { NULL } }; -static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_process(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request) { rlm_rcode_t rcode; CONF_SECTION *unlang; @@ -73,7 +73,7 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque RDEBUG("Running 'recv Status-Server' from file %s", cf_filename(unlang)); if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } request->request_state = REQUEST_RECV; FALL_THROUGH; @@ -81,9 +81,12 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque case REQUEST_RECV: rcode = unlang_interpret(request); - if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED; + if (request->master_state == REQUEST_STOP_PROCESSING) { + *p_result = RLM_MODULE_HANDLED; + return UNLANG_ACTION_STOP_PROCESSING; + } - if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD; + if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD; switch (rcode) { case RLM_MODULE_OK: @@ -117,7 +120,7 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque rerun_nak: RDEBUG("Running 'send %s' from file %s", cf_section_name2(unlang), cf_filename(unlang)); if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } request->request_state = REQUEST_SEND; @@ -126,9 +129,12 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque case REQUEST_SEND: rcode = unlang_interpret(request); - if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED; + if (request->master_state == REQUEST_STOP_PROCESSING) { + *p_result = RLM_MODULE_HANDLED; + return UNLANG_ACTION_STOP_PROCESSING; + } - if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD; + if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD; switch (rcode) { case RLM_MODULE_NOOP: @@ -179,10 +185,10 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque break; default: - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } diff --git a/src/modules/proto_radius/proto_radius_tcp.c b/src/modules/proto_radius/proto_radius_tcp.c index 5e9cbb92dfa..4d27a9c8dd6 100644 --- a/src/modules/proto_radius/proto_radius_tcp.c +++ b/src/modules/proto_radius/proto_radius_tcp.c @@ -348,7 +348,7 @@ static int mod_fd_set(fr_listen_t *li, int fd) static int mod_compare(void const *instance, UNUSED void *thread_instance, UNUSED RADCLIENT *client, void const *one, void const *two) { - int rcode; + int ret; proto_radius_tcp_t const *inst = talloc_get_type_abort_const(instance, proto_radius_tcp_t); uint8_t const *a = one; @@ -358,16 +358,16 @@ static int mod_compare(void const *instance, UNUSED void *thread_instance, UNUSE * Do a better job of deduping input packet. */ if (inst->dedup_authenticator) { - rcode = memcmp(a + 4, b + 4, RADIUS_AUTH_VECTOR_LENGTH); - if (rcode != 0) return rcode; + ret = memcmp(a + 4, b + 4, RADIUS_AUTH_VECTOR_LENGTH); + if (ret != 0) return ret; } /* * The tree is ordered by IDs, which are (hopefully) * pseudo-randomly distributed. */ - rcode = (a[1] < b[1]) - (a[1] > b[1]); - if (rcode != 0) return rcode; + ret = (a[1] < b[1]) - (a[1] > b[1]); + if (ret != 0) return ret; /* * Then ordered by code, which is usally the same. diff --git a/src/modules/proto_radius/proto_radius_udp.c b/src/modules/proto_radius/proto_radius_udp.c index 901c45fa1ca..033d6569c7f 100644 --- a/src/modules/proto_radius/proto_radius_udp.c +++ b/src/modules/proto_radius/proto_radius_udp.c @@ -387,7 +387,7 @@ static void *mod_track_create(TALLOC_CTX *ctx, uint8_t const *packet, UNUSED siz static int mod_compare(void const *instance, UNUSED void *thread_instance, UNUSED RADCLIENT *client, void const *one, void const *two) { - int rcode; + int ret; proto_radius_udp_t const *inst = talloc_get_type_abort_const(instance, proto_radius_udp_t); uint8_t const *a = one; @@ -397,16 +397,16 @@ static int mod_compare(void const *instance, UNUSED void *thread_instance, UNUSE * Do a better job of deduping input packet. */ if (inst->dedup_authenticator) { - rcode = memcmp(a + 4, b + 4, RADIUS_AUTH_VECTOR_LENGTH); - if (rcode != 0) return rcode; + ret = memcmp(a + 4, b + 4, RADIUS_AUTH_VECTOR_LENGTH); + if (ret != 0) return ret; } /* * The tree is ordered by IDs, which are (hopefully) * pseudo-randomly distributed. */ - rcode = (a[1] < b[1]) - (a[1] > b[1]); - if (rcode != 0) return rcode; + ret = (a[1] < b[1]) - (a[1] > b[1]); + if (ret != 0) return ret; /* * Then ordered by code, which is usually the same. diff --git a/src/modules/proto_tacacs/proto_tacacs_acct.c b/src/modules/proto_tacacs/proto_tacacs_acct.c index 5843b28b664..317d287238b 100644 --- a/src/modules/proto_tacacs/proto_tacacs_acct.c +++ b/src/modules/proto_tacacs/proto_tacacs_acct.c @@ -113,7 +113,7 @@ static void accounting_failed(request_t *request, char const *msg) vp->vp_uint8 = FR_TACACS_ACCOUNTING_STATUS_VALUE_ERROR; } -static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { proto_tacacs_acct_t const *inst = talloc_get_type_abort_const(mctx->instance, proto_tacacs_acct_t); rlm_rcode_t rcode; @@ -162,7 +162,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) */ RDEBUG("Running 'recv %s' from file %s", cf_section_name2(inst->recv_request), cf_filename(inst->recv_request)); if (unlang_interpret_push_instruction(request, inst->unlang_request, RLM_MODULE_REJECT, UNLANG_TOP_FRAME) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } request->request_state = REQUEST_RECV; @@ -171,9 +171,12 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) case REQUEST_RECV: rcode = unlang_interpret(request); - if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED; + if (request->master_state == REQUEST_STOP_PROCESSING) { + *p_result = RLM_MODULE_HANDLED; + return UNLANG_ACTION_STOP_PROCESSING; + } - if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD; + if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD; switch (rcode) { case RLM_MODULE_NOOP: @@ -211,7 +214,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) RDEBUG("Running 'accounting %s' from file %s", cf_section_name2(unlang), cf_filename(unlang)); if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } request->request_state = REQUEST_PROCESS; @@ -220,9 +223,12 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) case REQUEST_PROCESS: rcode = unlang_interpret(request); - if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED; + if (request->master_state == REQUEST_STOP_PROCESSING) { + *p_result = RLM_MODULE_HANDLED; + return UNLANG_ACTION_STOP_PROCESSING; + } - if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD; + if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD; switch (rcode) { /* @@ -250,7 +256,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) setup_send: RDEBUG("Running 'send %s' from file %s", cf_section_name2(inst->send_reply), cf_filename(inst->send_reply)); if (unlang_interpret_push_instruction(request, inst->unlang_reply, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } request->request_state = REQUEST_SEND; @@ -259,9 +265,12 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) case REQUEST_SEND: rcode = unlang_interpret(request); - if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED; + if (request->master_state == REQUEST_STOP_PROCESSING) { + *p_result = RLM_MODULE_HANDLED; + return UNLANG_ACTION_STOP_PROCESSING; + } - if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD; + if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD; switch (rcode) { case RLM_MODULE_FAIL: @@ -315,10 +324,10 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) break; default: - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } static int mod_instantiate(void *instance, UNUSED CONF_SECTION *process_app_cs) diff --git a/src/modules/proto_tacacs/proto_tacacs_auth.c b/src/modules/proto_tacacs/proto_tacacs_auth.c index 5ddbdb9c7f0..307106fa8f3 100644 --- a/src/modules/proto_tacacs/proto_tacacs_auth.c +++ b/src/modules/proto_tacacs/proto_tacacs_auth.c @@ -144,7 +144,7 @@ static void authentication_failed(request_t *request, char const *msg) } -static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { proto_tacacs_auth_t const *inst = talloc_get_type_abort_const(mctx->instance, proto_tacacs_auth_t); fr_pair_t *vp; @@ -205,7 +205,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) */ RDEBUG("Running 'recv %s' from file %s", cf_section_name2(auth_ctx->recv_request), cf_filename(auth_ctx->recv_request)); if (unlang_interpret_push_instruction(request, auth_ctx->unlang_request, RLM_MODULE_REJECT, UNLANG_TOP_FRAME) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } request->request_state = REQUEST_RECV; @@ -214,9 +214,12 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) case REQUEST_RECV: rcode = unlang_interpret(request); - if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED; + if (request->master_state == REQUEST_STOP_PROCESSING) { + *p_result = RLM_MODULE_HANDLED; + return UNLANG_ACTION_STOP_PROCESSING; + } - if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD; + if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD; switch (rcode) { case RLM_MODULE_NOOP: @@ -299,7 +302,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) RDEBUG("Running 'authenticate %s' from file %s", cf_section_name2(unlang), cf_filename(unlang)); if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOTFOUND, UNLANG_TOP_FRAME) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } request->request_state = REQUEST_PROCESS; @@ -308,9 +311,12 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) case REQUEST_PROCESS: rcode = unlang_interpret(request); - if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED; + if (request->master_state == REQUEST_STOP_PROCESSING) { + *p_result = RLM_MODULE_HANDLED; + return UNLANG_ACTION_STOP_PROCESSING; + } - if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD; + if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD; switch (rcode) { /* @@ -340,7 +346,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) setup_send: RDEBUG("Running 'send %s' from file %s", cf_section_name2(auth_ctx->send_reply), cf_filename(auth_ctx->send_reply)); if (unlang_interpret_push_instruction(request, auth_ctx->unlang_reply, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } request->request_state = REQUEST_SEND; @@ -349,9 +355,12 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) case REQUEST_SEND: rcode = unlang_interpret(request); - if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED; + if (request->master_state == REQUEST_STOP_PROCESSING) { + *p_result = RLM_MODULE_HANDLED; + return UNLANG_ACTION_STOP_PROCESSING; + } - if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD; + if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD; switch (rcode) { case RLM_MODULE_FAIL: @@ -404,10 +413,10 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) break; default: - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } static virtual_server_compile_t compile_list[] = { diff --git a/src/modules/proto_tacacs/proto_tacacs_autz.c b/src/modules/proto_tacacs/proto_tacacs_autz.c index c510aab7d19..e618c5bb6d2 100644 --- a/src/modules/proto_tacacs/proto_tacacs_autz.c +++ b/src/modules/proto_tacacs/proto_tacacs_autz.c @@ -97,7 +97,7 @@ static void authorization_failed(request_t *request, char const *msg) } -static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { proto_tacacs_autz_t const *inst = talloc_get_type_abort_const(mctx->instance, proto_tacacs_autz_t); rlm_rcode_t rcode; @@ -118,7 +118,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) */ RDEBUG("Running 'recv %s' from file %s", cf_section_name2(inst->recv_request), cf_filename(inst->recv_request)); if (unlang_interpret_push_instruction(request, inst->unlang_request, RLM_MODULE_REJECT, UNLANG_TOP_FRAME) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } request->request_state = REQUEST_RECV; @@ -127,9 +127,12 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) case REQUEST_RECV: rcode = unlang_interpret(request); - if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED; + if (request->master_state == REQUEST_STOP_PROCESSING) { + *p_result = RLM_MODULE_HANDLED; + return UNLANG_ACTION_STOP_PROCESSING; + } - if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD; + if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD; switch (rcode) { case RLM_MODULE_NOOP: @@ -152,7 +155,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) RDEBUG("Running 'send %s' from file %s", cf_section_name2(inst->send_reply), cf_filename(inst->send_reply)); if (unlang_interpret_push_instruction(request, inst->unlang_reply, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } request->request_state = REQUEST_SEND; @@ -161,9 +164,12 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) case REQUEST_SEND: rcode = unlang_interpret(request); - if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED; + if (request->master_state == REQUEST_STOP_PROCESSING) { + *p_result = RLM_MODULE_HANDLED; + return UNLANG_ACTION_STOP_PROCESSING; + } - if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD; + if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD; switch (rcode) { case RLM_MODULE_FAIL: @@ -194,10 +200,10 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) break; default: - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } static virtual_server_compile_t compile_list[] = { diff --git a/src/modules/proto_tacacs/proto_tacacs_tcp.c b/src/modules/proto_tacacs/proto_tacacs_tcp.c index 9612d3730c5..45702852423 100644 --- a/src/modules/proto_tacacs/proto_tacacs_tcp.c +++ b/src/modules/proto_tacacs/proto_tacacs_tcp.c @@ -361,15 +361,15 @@ static void *mod_track_create(TALLOC_CTX *ctx, uint8_t const *buffer, UNUSED siz static int mod_compare(UNUSED void const *instance, UNUSED void *thread_instance, UNUSED RADCLIENT *client, void const *one, void const *two) { - int rcode; + int ret; proto_tacacs_track_t const *a = talloc_get_type_abort_const(one, proto_tacacs_track_t); proto_tacacs_track_t const *b = talloc_get_type_abort_const(two, proto_tacacs_track_t); /* * Session IDs SHOULD be random 32-bit integers. */ - rcode = (a->session_id < b->session_id) - (a->session_id > b->session_id); - if (rcode != 0) return rcode; + ret = (a->session_id < b->session_id) - (a->session_id > b->session_id); + if (ret != 0) return ret; /* * Then ordered by our synthetic packet type. diff --git a/src/modules/proto_vmps/proto_vmps_dynamic_client.c b/src/modules/proto_vmps/proto_vmps_dynamic_client.c index b5ad9589e09..795cf3b3232 100644 --- a/src/modules/proto_vmps/proto_vmps_dynamic_client.c +++ b/src/modules/proto_vmps/proto_vmps_dynamic_client.c @@ -57,7 +57,7 @@ fr_dict_attr_autoload_t proto_vmps_dynamic_client_dict_attr[] = { #define CLIENT_ADD (1) #define CLIENT_NAK (257) -static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_process(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request) { rlm_rcode_t rcode; CONF_SECTION *unlang; @@ -80,7 +80,7 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque RDEBUG("Running 'new client' from file %s", cf_filename(unlang)); if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } request->request_state = REQUEST_RECV; @@ -89,9 +89,12 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque case REQUEST_RECV: rcode = unlang_interpret(request); - if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED; + if (request->master_state == REQUEST_STOP_PROCESSING) { + *p_result = RLM_MODULE_HANDLED; + return UNLANG_ACTION_STOP_PROCESSING; + } - if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD; + if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD; switch (rcode) { case RLM_MODULE_OK: @@ -116,7 +119,7 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque rerun_nak: RDEBUG("Running '%s client' from file %s", cf_section_name1(unlang), cf_filename(unlang)); if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } request->request_state = REQUEST_SEND; @@ -125,9 +128,12 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque case REQUEST_SEND: rcode = unlang_interpret(request); - if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED; + if (request->master_state == REQUEST_STOP_PROCESSING) { + *p_result = RLM_MODULE_HANDLED; + return UNLANG_ACTION_STOP_PROCESSING; + } - if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD; + if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD; switch (rcode) { case RLM_MODULE_NOOP: @@ -182,10 +188,10 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque break; default: - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } diff --git a/src/modules/proto_vmps/proto_vmps_process.c b/src/modules/proto_vmps/proto_vmps_process.c index 1671c9e55e4..86bcead3c27 100644 --- a/src/modules/proto_vmps/proto_vmps_process.c +++ b/src/modules/proto_vmps/proto_vmps_process.c @@ -48,7 +48,7 @@ fr_dict_attr_autoload_t proto_vmps_process_dict_attr[] = { { NULL } }; -static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_process(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request) { rlm_rcode_t rcode; CONF_SECTION *unlang; @@ -66,7 +66,7 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque dv = fr_dict_enum_by_value(attr_packet_type, fr_box_uint32(request->packet->code)); if (!dv) { REDEBUG("Failed to find value for &request.VMPS-Packet-Type"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } unlang = cf_section_find(request->server_cs, "recv", dv->name); @@ -78,7 +78,7 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque RDEBUG("Running 'recv %s' from file %s", cf_section_name2(unlang), cf_filename(unlang)); if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } request->request_state = REQUEST_RECV; @@ -87,9 +87,12 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque case REQUEST_RECV: rcode = unlang_interpret(request); - if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED; + if (request->master_state == REQUEST_STOP_PROCESSING) { + *p_result = RLM_MODULE_HANDLED; + return UNLANG_ACTION_STOP_PROCESSING; + } - if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD; + if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD; switch (rcode) { case RLM_MODULE_NOOP: @@ -123,7 +126,7 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque rerun_nak: RDEBUG("Running 'send %s' from file %s", cf_section_name2(unlang), cf_filename(unlang)); if (unlang_interpret_push_section(request, unlang, RLM_MODULE_NOOP, UNLANG_TOP_FRAME) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } request->request_state = REQUEST_SEND; @@ -132,9 +135,12 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque case REQUEST_SEND: rcode = unlang_interpret(request); - if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_HANDLED; + if (request->master_state == REQUEST_STOP_PROCESSING) { + *p_result = RLM_MODULE_HANDLED; + return UNLANG_ACTION_STOP_PROCESSING; + } - if (rcode == RLM_MODULE_YIELD) return RLM_MODULE_YIELD; + if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD; switch (rcode) { case RLM_MODULE_NOOP: @@ -175,7 +181,7 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque */ if (request->reply->code == FR_PACKET_TYPE_VALUE_DO_NOT_RESPOND) { RDEBUG("Not sending reply to client."); - return RLM_MODULE_HANDLED; + RETURN_MODULE_HANDLED; } /* @@ -192,10 +198,10 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque break; default: - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } diff --git a/src/modules/proto_vmps/proto_vmps_udp.c b/src/modules/proto_vmps/proto_vmps_udp.c index 9215c0a4980..13f7382acd9 100644 --- a/src/modules/proto_vmps/proto_vmps_udp.c +++ b/src/modules/proto_vmps/proto_vmps_udp.c @@ -383,13 +383,13 @@ static int mod_compare(UNUSED void const *instance, UNUSED void *thread_instance { proto_vmps_track_t const *a = talloc_get_type_abort_const(one, proto_vmps_track_t); proto_vmps_track_t const *b = talloc_get_type_abort_const(two, proto_vmps_track_t); - int rcode; + int ret; /* * Order by transaction ID */ - rcode = (a->transaction_id < b->transaction_id) - (a->transaction_id > b->transaction_id); - if (rcode != 0) return rcode; + ret = (a->transaction_id < b->transaction_id) - (a->transaction_id > b->transaction_id); + if (ret != 0) return ret; /* * Then ordered by opcode, which is usally the same. diff --git a/src/modules/rlm_always/rlm_always.c b/src/modules/rlm_always/rlm_always.c index 78fd687f7d9..86a86fe5362 100644 --- a/src/modules/rlm_always/rlm_always.c +++ b/src/modules/rlm_always/rlm_always.c @@ -159,11 +159,11 @@ static int mod_instantiate(void *instance, CONF_SECTION *conf) * Just return the rcode ... this function is autz, auth, acct, and * preacct! */ -static rlm_rcode_t CC_HINT(nonnull) mod_always_return(module_ctx_t const *mctx, UNUSED request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_always_return(rlm_rcode_t *p_result, module_ctx_t const *mctx, UNUSED request_t *request) { rlm_always_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_always_t); - return inst->rcode; + RETURN_MODULE_RCODE(inst->rcode); } extern module_t rlm_always; diff --git a/src/modules/rlm_attr_filter/rlm_attr_filter.c b/src/modules/rlm_attr_filter/rlm_attr_filter.c index cda5bcc704a..28e069f53c5 100644 --- a/src/modules/rlm_attr_filter/rlm_attr_filter.c +++ b/src/modules/rlm_attr_filter/rlm_attr_filter.c @@ -168,8 +168,9 @@ static int mod_instantiate(void *instance, UNUSED CONF_SECTION *conf) /* * Common attr_filter checks */ -static rlm_rcode_t CC_HINT(nonnull(1,2)) attr_filter_common(void const *instance, request_t *request, - fr_radius_packet_t *packet) +static unlang_action_t CC_HINT(nonnull(1,2)) attr_filter_common(rlm_rcode_t *p_result, + void const *instance, request_t *request, + fr_radius_packet_t *packet) { rlm_attr_filter_t const *inst = talloc_get_type_abort_const(instance, rlm_attr_filter_t); fr_pair_t *vp; @@ -182,13 +183,17 @@ static rlm_rcode_t CC_HINT(nonnull(1,2)) attr_filter_common(void const *instance char buffer[256]; ssize_t slen; - if (!packet) return RLM_MODULE_NOOP; + if (!packet) { + RETURN_MODULE_NOOP; + } slen = tmpl_expand(&keyname, buffer, sizeof(buffer), request, inst->key, NULL, NULL); - if (slen < 0) return RLM_MODULE_FAIL; + if (slen < 0) { + RETURN_MODULE_FAIL; + } if ((keyname == buffer) && is_truncated((size_t)slen, sizeof(buffer))) { REDEBUG("Key too long, expected < " STRINGIFY(sizeof(buffer)) " bytes, got %zi bytes", slen); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* @@ -306,7 +311,7 @@ static rlm_rcode_t CC_HINT(nonnull(1,2)) attr_filter_common(void const *instance */ if (!found) { fr_assert(!output); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } /* @@ -315,16 +320,16 @@ static rlm_rcode_t CC_HINT(nonnull(1,2)) attr_filter_common(void const *instance fr_pair_list_free(&packet->vps); packet->vps = output; - return RLM_MODULE_UPDATED; + RETURN_MODULE_UPDATED; error: fr_pair_list_free(&output); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } -#define RLM_AF_FUNC(_x, _y) static rlm_rcode_t CC_HINT(nonnull) mod_##_x(module_ctx_t const *mctx, request_t *request) \ +#define RLM_AF_FUNC(_x, _y) static unlang_action_t CC_HINT(nonnull) mod_##_x(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) \ { \ - return attr_filter_common(mctx->instance, request, request->_y); \ + return attr_filter_common(p_result, mctx->instance, request, request->_y); \ } RLM_AF_FUNC(authorize, packet) diff --git a/src/modules/rlm_cache/rlm_cache.c b/src/modules/rlm_cache/rlm_cache.c index 8d3e067aaf7..6bb9a4dbb4d 100644 --- a/src/modules/rlm_cache/rlm_cache.c +++ b/src/modules/rlm_cache/rlm_cache.c @@ -199,8 +199,9 @@ static rlm_rcode_t cache_merge(rlm_cache_t const *inst, request_t *request, rlm_ * - #RLM_MODULE_FAIL on failure. * - #RLM_MODULE_NOTFOUND on cache miss. */ -static rlm_rcode_t cache_find(rlm_cache_entry_t **out, rlm_cache_t const *inst, request_t *request, - rlm_cache_handle_t **handle, uint8_t const *key, size_t key_len) +static unlang_action_t cache_find(rlm_rcode_t *p_result, rlm_cache_entry_t **out, + rlm_cache_t const *inst, request_t *request, + rlm_cache_handle_t **handle, uint8_t const *key, size_t key_len) { cache_status_t ret; @@ -214,17 +215,17 @@ static rlm_rcode_t cache_find(rlm_cache_entry_t **out, rlm_cache_t const *inst, case CACHE_RECONNECT: RDEBUG2("Reconnecting..."); if (cache_reconnect(handle, inst, request) == 0) continue; - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; case CACHE_OK: break; case CACHE_MISS: RDEBUG2("No cache entry found for \"%pV\"", fr_box_strvalue_len((char const *)key, key_len)); - return RLM_MODULE_NOTFOUND; + RETURN_MODULE_NOTFOUND; default: - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } @@ -244,7 +245,7 @@ static rlm_rcode_t cache_find(rlm_cache_entry_t **out, rlm_cache_t const *inst, inst->driver->expire(&inst->config, inst->driver_inst->dl_inst->data, request, handle, c->key, c->key_len); cache_free(inst, &c); - return RLM_MODULE_NOTFOUND; /* Couldn't find a non-expired entry */ + RETURN_MODULE_NOTFOUND; /* Couldn't find a non-expired entry */ } RDEBUG2("Found entry for \"%pV\"", fr_box_strvalue_len((char const *)key, key_len)); @@ -252,7 +253,7 @@ static rlm_rcode_t cache_find(rlm_cache_entry_t **out, rlm_cache_t const *inst, c->hits++; *out = c; - return RLM_MODULE_OK; + RETURN_MODULE_OK; } /** Expire a cache entry (removing it from the datastore) @@ -262,8 +263,9 @@ static rlm_rcode_t cache_find(rlm_cache_entry_t **out, rlm_cache_t const *inst, * - #RLM_MODULE_NOTFOUND if no entry existed. * - #RLM_MODULE_FAIL on failure. */ -static rlm_rcode_t cache_expire(rlm_cache_t const *inst, request_t *request, - rlm_cache_handle_t **handle, uint8_t const *key, size_t key_len) +static unlang_action_t cache_expire(rlm_rcode_t *p_result, + rlm_cache_t const *inst, request_t *request, + rlm_cache_handle_t **handle, uint8_t const *key, size_t key_len) { RDEBUG2("Expiring cache entry"); for (;;) switch (inst->driver->expire(&inst->config, inst->driver_inst->dl_inst->data, request, @@ -273,13 +275,13 @@ static rlm_rcode_t cache_expire(rlm_cache_t const *inst, request_t *request, FALL_THROUGH; default: - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; case CACHE_OK: - return RLM_MODULE_OK; + RETURN_MODULE_OK; case CACHE_MISS: - return RLM_MODULE_NOTFOUND; + RETURN_MODULE_NOTFOUND; } } @@ -290,8 +292,9 @@ static rlm_rcode_t cache_expire(rlm_cache_t const *inst, request_t *request, * - #RLM_MODULE_UPDATED if we merged the cache entry. * - #RLM_MODULE_FAIL on failure. */ -static rlm_rcode_t cache_insert(rlm_cache_t const *inst, request_t *request, rlm_cache_handle_t **handle, - uint8_t const *key, size_t key_len, int ttl) +static unlang_action_t cache_insert(rlm_rcode_t *p_result, + rlm_cache_t const *inst, request_t *request, rlm_cache_handle_t **handle, + uint8_t const *key, size_t key_len, int ttl) { map_t const *map; map_t **last, *c_map; @@ -305,12 +308,13 @@ static rlm_rcode_t cache_insert(rlm_cache_t const *inst, request_t *request, rlm if ((inst->config.max_entries > 0) && inst->driver->count && (inst->driver->count(&inst->config, inst->driver_inst->dl_inst->data, request, handle) > inst->config.max_entries)) { RWDEBUG("Cache is full: %d entries", inst->config.max_entries); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } c = cache_alloc(inst, request); - if (!c) return RLM_MODULE_FAIL; - + if (!c) { + RETURN_MODULE_FAIL; + } c->key = talloc_memdup(c, key, key_len); c->key_len = key_len; @@ -397,7 +401,7 @@ static rlm_rcode_t cache_insert(rlm_cache_t const *inst, request_t *request, rlm error: talloc_free(pool); talloc_free(c); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } } break; @@ -439,17 +443,16 @@ static rlm_rcode_t cache_insert(rlm_cache_t const *inst, request_t *request, rlm switch (ret) { case CACHE_RECONNECT: if (cache_reconnect(handle, inst, request) == 0) continue; - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; case CACHE_OK: RDEBUG2("Committed entry, TTL %d seconds", ttl); cache_free(inst, &c); - return merge ? RLM_MODULE_UPDATED : - RLM_MODULE_OK; + RETURN_MODULE_RCODE(merge ? RLM_MODULE_UPDATED : RLM_MODULE_OK); default: talloc_free(c); /* Failed insertion - use talloc_free not the driver free */ - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } } } @@ -460,8 +463,9 @@ static rlm_rcode_t cache_insert(rlm_cache_t const *inst, request_t *request, rlm * - #RLM_MODULE_OK on success. * - #RLM_MODULE_FAIL on failure. */ -static rlm_rcode_t cache_set_ttl(rlm_cache_t const *inst, request_t *request, - rlm_cache_handle_t **handle, rlm_cache_entry_t *c) +static unlang_action_t cache_set_ttl(rlm_rcode_t *p_result, + rlm_cache_t const *inst, request_t *request, + rlm_cache_handle_t **handle, rlm_cache_entry_t *c) { /* * Call the driver's insert method to overwrite the old entry @@ -473,14 +477,14 @@ static rlm_rcode_t cache_set_ttl(rlm_cache_t const *inst, request_t *request, switch (ret) { case CACHE_RECONNECT: if (cache_reconnect(handle, inst, request) == 0) continue; - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; case CACHE_OK: RDEBUG2("Updated entry TTL"); - return RLM_MODULE_OK; + RETURN_MODULE_OK; default: - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } } @@ -495,14 +499,14 @@ static rlm_rcode_t cache_set_ttl(rlm_cache_t const *inst, request_t *request, switch (ret) { case CACHE_RECONNECT: if (cache_reconnect(handle, inst, request) == 0) continue; - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; case CACHE_OK: RDEBUG2("Updated entry TTL"); - return RLM_MODULE_OK; + RETURN_MODULE_OK; default: - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } } } @@ -531,7 +535,7 @@ static int cache_verify(map_t *map, void *ctx) * If you want to cache something different in different sections, configure * another cache module. */ -static rlm_rcode_t CC_HINT(nonnull) mod_cache_it(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_cache_it(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_cache_entry_t *c = NULL; rlm_cache_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_cache_t); @@ -553,11 +557,13 @@ static rlm_rcode_t CC_HINT(nonnull) mod_cache_it(module_ctx_t const *mctx, reque key_len = tmpl_expand((char const **)&key, (char *)buffer, sizeof(buffer), request, inst->config.key, NULL, NULL); - if (key_len < 0) return RLM_MODULE_FAIL; + if (key_len < 0) { + RETURN_MODULE_FAIL; + } if (key_len == 0) { REDEBUG("Zero length key string is invalid"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -570,9 +576,11 @@ static rlm_rcode_t CC_HINT(nonnull) mod_cache_it(module_ctx_t const *mctx, reque RDEBUG3("status-only: yes"); REXDENT(); - if (cache_acquire(&handle, inst, request) < 0) return RLM_MODULE_FAIL; + if (cache_acquire(&handle, inst, request) < 0) { + RETURN_MODULE_FAIL; + } - rcode = cache_find(&c, inst, request, &handle, key, key_len); + cache_find(&rcode, &c, inst, request, &handle, key, key_len); if (rcode == RLM_MODULE_FAIL) goto finish; fr_assert(!inst->driver->acquire || handle); @@ -610,14 +618,16 @@ static rlm_rcode_t CC_HINT(nonnull) mod_cache_it(module_ctx_t const *mctx, reque RDEBUG3("expire : %s", expire ? "yes" : "no"); RDEBUG3("ttl : %i", ttl); REXDENT(); - if (cache_acquire(&handle, inst, request) < 0) return RLM_MODULE_FAIL; + if (cache_acquire(&handle, inst, request) < 0) { + RETURN_MODULE_FAIL; + } /* * Retrieve the cache entry and merge it with the current request * recording whether the entry existed. */ if (merge) { - rcode = cache_find(&c, inst, request, &handle, key, key_len); + cache_find(&rcode, &c, inst, request, &handle, key, key_len); switch (rcode) { case RLM_MODULE_FAIL: goto finish; @@ -647,8 +657,11 @@ static rlm_rcode_t CC_HINT(nonnull) mod_cache_it(module_ctx_t const *mctx, reque */ if (expire && ((exists == -1) || (exists == 1))) { if (!insert) { + rlm_rcode_t tmp; + fr_assert(!set_ttl); - switch (cache_expire(inst, request, &handle, key, key_len)) { + cache_expire(&tmp, inst, request, &handle, key, key_len); + switch (tmp) { case RLM_MODULE_FAIL: rcode = RLM_MODULE_FAIL; goto finish; @@ -677,7 +690,10 @@ static rlm_rcode_t CC_HINT(nonnull) mod_cache_it(module_ctx_t const *mctx, reque * determine that now. */ if ((exists < 0) && (insert || set_ttl)) { - switch (cache_find(&c, inst, request, &handle, key, key_len)) { + rlm_rcode_t tmp; + + cache_find(&tmp, &c, inst, request, &handle, key, key_len); + switch (tmp) { case RLM_MODULE_FAIL: rcode = RLM_MODULE_FAIL; goto finish; @@ -701,11 +717,14 @@ static rlm_rcode_t CC_HINT(nonnull) mod_cache_it(module_ctx_t const *mctx, reque * We can only alter the TTL on an entry if it exists. */ if (set_ttl && (exists == 1)) { + rlm_rcode_t tmp; + fr_assert(c); c->expires = fr_time_to_unix_time(request->packet->timestamp) + fr_unix_time_from_sec(ttl); - switch (cache_set_ttl(inst, request, &handle, c)) { + cache_set_ttl(&tmp, inst, request, &handle, c); + switch (tmp) { case RLM_MODULE_FAIL: rcode = RLM_MODULE_FAIL; goto finish; @@ -727,7 +746,10 @@ static rlm_rcode_t CC_HINT(nonnull) mod_cache_it(module_ctx_t const *mctx, reque * insert. */ if (insert && (exists == 0)) { - switch (cache_insert(inst, request, &handle, key, key_len, ttl)) { + rlm_rcode_t tmp; + + cache_insert(&tmp, inst, request, &handle, key, key_len, ttl); + switch (tmp) { case RLM_MODULE_FAIL: rcode = RLM_MODULE_FAIL; goto finish; @@ -776,7 +798,7 @@ finish: } } - return rcode; + RETURN_MODULE_RCODE(rcode); } /** Allow single attribute values to be retrieved from the cache @@ -801,8 +823,9 @@ static ssize_t cache_xlat(TALLOC_CTX *ctx, char **out, UNUSED size_t freespace, uint8_t const *key; ssize_t key_len; - tmpl_t *target = NULL; - map_t *map = NULL; + tmpl_t *target = NULL; + map_t *map = NULL; + rlm_rcode_t rcode = RLM_MODULE_NOOP; key_len = tmpl_expand((char const **)&key, (char *)buffer, sizeof(buffer), request, inst->config.key, NULL, NULL); @@ -825,7 +848,8 @@ static ssize_t cache_xlat(TALLOC_CTX *ctx, char **out, UNUSED size_t freespace, return -1; } - switch (cache_find(&c, mod_inst, request, &handle, key, key_len)) { + cache_find(&rcode, &c, mod_inst, request, &handle, key, key_len); + switch (rcode) { case RLM_MODULE_OK: /* found */ break; diff --git a/src/modules/rlm_chap/rlm_chap.c b/src/modules/rlm_chap/rlm_chap.c index c8c39924f7c..1bdfd40d775 100644 --- a/src/modules/rlm_chap/rlm_chap.c +++ b/src/modules/rlm_chap/rlm_chap.c @@ -112,21 +112,23 @@ static xlat_action_t xlat_func_chap_password(TALLOC_CTX *ctx, fr_cursor_t *out, return XLAT_ACTION_DONE; } -static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { fr_pair_t *vp; rlm_chap_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_chap_t); if (fr_pair_find_by_da(&request->control_pairs, attr_auth_type) != NULL) { RDEBUG3("Auth-Type is already set. Not setting 'Auth-Type := %s'", inst->name); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } /* * This case means the warnings below won't be printed * unless there's a CHAP-Password in the request. */ - if (!fr_pair_find_by_da(&request->request_pairs, attr_chap_password)) return RLM_MODULE_NOOP; + if (!fr_pair_find_by_da(&request->request_pairs, attr_chap_password)) { + RETURN_MODULE_NOOP; + } /* * Create the CHAP-Challenge if it wasn't already in the packet. @@ -146,12 +148,14 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, requ if (!inst->auth_type) { WARN("No 'authenticate %s {...}' section or 'Auth-Type = %s' set. Cannot setup CHAP authentication", inst->name, inst->name); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } - if (!module_section_type_set(request, attr_auth_type, inst->auth_type)) return RLM_MODULE_NOOP; + if (!module_section_type_set(request, attr_auth_type, inst->auth_type)) { + RETURN_MODULE_NOOP; + } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } /* @@ -160,7 +164,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, requ * from the database. The authentication code only needs to check * the password, the rest is done here. */ -static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(UNUSED module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authenticate(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request) { fr_pair_t *known_good; fr_pair_t *chap, *username; @@ -177,24 +181,24 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(UNUSED module_ctx_t const * username = fr_pair_find_by_da(&request->request_pairs, attr_user_name); if (!username) { REDEBUG("&User-Name attribute is required for authentication"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } chap = fr_pair_find_by_da(&request->request_pairs, attr_chap_password); if (!chap) { REDEBUG("You set '&control.Auth-Type = CHAP' for a request that " "does not contain a CHAP-Password attribute!"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } if (chap->vp_length == 0) { REDEBUG("&request.CHAP-Password is empty"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } if (chap->vp_length != RADIUS_CHAP_CHALLENGE_LENGTH + 1) { REDEBUG("&request.CHAP-Password has invalid length"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -208,7 +212,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(UNUSED module_ctx_t const * false); if (!known_good) { REDEBUG("No \"known good\" password found for user"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* @@ -265,12 +269,12 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(UNUSED module_ctx_t const * if (ret != 0) { REDEBUG("Password comparison failed: password is incorrect"); - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; } RDEBUG2("CHAP user \"%pV\" authenticated successfully", &username->data); - return RLM_MODULE_OK; + RETURN_MODULE_OK; } static int mod_bootstrap(void *instance, CONF_SECTION *conf) diff --git a/src/modules/rlm_client/rlm_client.c b/src/modules/rlm_client/rlm_client.c index 0bf76c731e6..e754355fb28 100644 --- a/src/modules/rlm_client/rlm_client.c +++ b/src/modules/rlm_client/rlm_client.c @@ -271,7 +271,7 @@ static ssize_t xlat_client(TALLOC_CTX *ctx, char **out, UNUSED size_t outlen, /* * Find the client definition. */ -static rlm_rcode_t CC_HINT(nonnull) mod_authorize(UNUSED module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request) { size_t length; char const *value; @@ -287,30 +287,30 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(UNUSED module_ctx_t const *mct if ((request->packet->socket.inet.src_port != 0) || (request->request_pairs != NULL) || (request->parent != NULL)) { REDEBUG("Improper configuration"); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } if (!request->client || !request->client->cs) { REDEBUG("Unknown client definition"); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } cp = cf_pair_find(request->client->cs, "directory"); if (!cp) { REDEBUG("No directory configuration in the client"); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } value = cf_pair_value(cp); if (!value) { REDEBUG("No value given for the directory entry in the client"); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } length = strlen(value); if (length > (sizeof(buffer) - 256)) { REDEBUG("Directory name too long"); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } memcpy(buffer, value, length + 1); @@ -325,11 +325,11 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(UNUSED module_ctx_t const *mct } else if (request->listener) { server_cs = request->listener->server_cs; } else { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } c = client_read(buffer, server_cs, true); - if (!c) return RLM_MODULE_FAIL; + if (!c) RETURN_MODULE_FAIL; /* * Replace the client. This is more than a bit of a @@ -337,7 +337,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(UNUSED module_ctx_t const *mct */ request->client = c; - return RLM_MODULE_OK; + RETURN_MODULE_OK; } /* diff --git a/src/modules/rlm_couchbase/rlm_couchbase.c b/src/modules/rlm_couchbase/rlm_couchbase.c index b480fbf068a..2bfe706def1 100644 --- a/src/modules/rlm_couchbase/rlm_couchbase.c +++ b/src/modules/rlm_couchbase/rlm_couchbase.c @@ -97,7 +97,7 @@ fr_dict_attr_autoload_t rlm_couchbase_dict_attr[] = { * @param request The authorization request. * @return Operation status (#rlm_rcode_t). */ -static rlm_rcode_t mod_authorize(module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_couchbase_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_couchbase_t); /* our module instance */ rlm_couchbase_handle_t *handle = NULL; /* connection pool handle */ @@ -112,17 +112,17 @@ static rlm_rcode_t mod_authorize(module_ctx_t const *mctx, request_t *request) /* attempt to build document key */ slen = tmpl_expand(&dockey, buffer, sizeof(buffer), request, inst->user_key, NULL, NULL); - if (slen < 0) return RLM_MODULE_FAIL; + if (slen < 0) RETURN_MODULE_FAIL; if ((dockey == buffer) && is_truncated((size_t)slen, sizeof(buffer))) { REDEBUG("Key too long, expected < " STRINGIFY(sizeof(buffer)) " bytes, got %zi bytes", slen); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* get handle */ handle = fr_pool_connection_get(inst->pool, request); /* check handle */ - if (!handle) return RLM_MODULE_FAIL; + if (!handle) RETURN_MODULE_FAIL; /* set couchbase instance */ lcb_t cb_inst = handle->handle; @@ -217,7 +217,7 @@ finish: if (handle) fr_pool_connection_release(inst->pool, request, handle); /* return */ - return rcode; + RETURN_MODULE_RCODE(rcode); } /** Write accounting data to Couchbase documents @@ -233,7 +233,7 @@ finish: * @param request The accounting request object. * @return Operation status (#rlm_rcode_t). */ -static rlm_rcode_t mod_accounting(module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_accounting(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_couchbase_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_couchbase_t); /* our module instance */ rlm_couchbase_handle_t *handle = NULL; /* connection pool handle */ @@ -258,7 +258,7 @@ static rlm_rcode_t mod_accounting(module_ctx_t const *mctx, request_t *request) /* log debug */ RDEBUG2("could not find status type in packet"); /* return */ - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } /* set status */ @@ -269,14 +269,14 @@ static rlm_rcode_t mod_accounting(module_ctx_t const *mctx, request_t *request) /* log debug */ RDEBUG2("handling accounting on/off request without action"); /* return */ - return RLM_MODULE_OK; + RETURN_MODULE_OK; } /* get handle */ handle = fr_pool_connection_get(inst->pool, request); /* check handle */ - if (!handle) return RLM_MODULE_FAIL; + if (!handle) RETURN_MODULE_FAIL; /* set couchbase instance */ lcb_t cb_inst = handle->handle; @@ -413,7 +413,7 @@ finish: } /* return */ - return rcode; + RETURN_MODULE_RCODE(rcode); } diff --git a/src/modules/rlm_csv/rlm_csv.c b/src/modules/rlm_csv/rlm_csv.c index 0b452a77b85..f9a839491cf 100644 --- a/src/modules/rlm_csv/rlm_csv.c +++ b/src/modules/rlm_csv/rlm_csv.c @@ -1002,14 +1002,14 @@ static rlm_rcode_t mod_map_proc(void *mod_inst, UNUSED void *proc_inst, request_ } -static rlm_rcode_t CC_HINT(nonnull) mod_process(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_csv_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_csv_t); rlm_rcode_t rcode; ssize_t slen; fr_value_box_t *key; - if (!inst->map || !inst->key) return RLM_MODULE_NOOP; + if (!inst->map || !inst->key) RETURN_MODULE_NOOP; /* * Expand the key to whatever it is. For attributes, @@ -1018,7 +1018,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_process(module_ctx_t const *mctx, reques slen = tmpl_aexpand_type(request, &key, FR_TYPE_VALUE_BOX, request, inst->key, NULL, NULL); if (slen < 0) { DEBUG("Failed expanding key '%s'", inst->key->name); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* @@ -1036,7 +1036,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_process(module_ctx_t const *mctx, reques talloc_free(key); DEBUG("Failed casting %pV to data type '%s'", &key, fr_table_str_by_value(tmpl_type_table, inst->key_data_type, "")); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } } @@ -1046,7 +1046,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_process(module_ctx_t const *mctx, reques REXDENT(); talloc_free(key); - return rcode; + RETURN_MODULE_RCODE(rcode); } extern module_t rlm_csv; diff --git a/src/modules/rlm_delay/rlm_delay.c b/src/modules/rlm_delay/rlm_delay.c index 0d28daf6003..9b9ad8b0f85 100644 --- a/src/modules/rlm_delay/rlm_delay.c +++ b/src/modules/rlm_delay/rlm_delay.c @@ -117,7 +117,8 @@ static int delay_add(request_t *request, fr_time_t *resume_at, fr_time_t now, /** Called resume_at the delay is complete, and we're running from the interpreter * */ -static rlm_rcode_t mod_delay_return(UNUSED module_ctx_t const *mctx, request_t *request, void *rctx) +static unlang_action_t mod_delay_return(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, + request_t *request, void *rctx) { fr_time_t *yielded = talloc_get_type_abort(rctx, fr_time_t); @@ -127,7 +128,7 @@ static rlm_rcode_t mod_delay_return(UNUSED module_ctx_t const *mctx, request_t * RDEBUG3("Request delayed by %pV", fr_box_time_delta(fr_time() - *yielded)); talloc_free(yielded); - return RLM_MODULE_OK; + RETURN_MODULE_OK; } static void mod_delay_cancel(UNUSED module_ctx_t const *mctx, request_t *request, void *rctx, @@ -140,7 +141,7 @@ static void mod_delay_cancel(UNUSED module_ctx_t const *mctx, request_t *request (void) unlang_module_timeout_delete(request, rctx); } -static rlm_rcode_t CC_HINT(nonnull) mod_delay(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_delay(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_delay_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_delay_t); fr_time_delta_t delay; @@ -148,7 +149,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_delay(module_ctx_t const *mctx, request_ if (inst->delay) { if (tmpl_aexpand_type(request, &delay, FR_TYPE_TIME_DELTA, - request, inst->delay, NULL, NULL) < 0) return RLM_MODULE_FAIL; + request, inst->delay, NULL, NULL) < 0) RETURN_MODULE_FAIL; } else { delay = 0; } @@ -164,7 +165,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_delay(module_ctx_t const *mctx, request_ */ if (delay_add(request, &resume_at, *yielded_at, delay, inst->force_reschedule, inst->delay) != 0) { - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } /* @@ -175,7 +176,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_delay(module_ctx_t const *mctx, request_ if (unlang_module_timeout_add(request, _delay_done, yielded_at, resume_at) < 0) { RPEDEBUG("Adding event failed"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } return unlang_module_yield(request, mod_delay_return, mod_delay_cancel, yielded_at); diff --git a/src/modules/rlm_detail/rlm_detail.c b/src/modules/rlm_detail/rlm_detail.c index dc07563ee5f..be8d4614520 100644 --- a/src/modules/rlm_detail/rlm_detail.c +++ b/src/modules/rlm_detail/rlm_detail.c @@ -367,8 +367,8 @@ static int detail_write(FILE *out, rlm_detail_t const *inst, request_t *request, /* * Do detail, compatible with old accounting */ -static rlm_rcode_t CC_HINT(nonnull) detail_do(void const *instance, request_t *request, - fr_radius_packet_t *packet, bool compat) +static unlang_action_t CC_HINT(nonnull) detail_do(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, + fr_radius_packet_t *packet, bool compat) { int outfd, dupfd; char buffer[DIRLEN]; @@ -380,7 +380,7 @@ static rlm_rcode_t CC_HINT(nonnull) detail_do(void const *instance, request_t *r char *endptr; #endif - rlm_detail_t const *inst = talloc_get_type_abort_const(instance, rlm_detail_t); + rlm_detail_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_detail_t); /* * Generate the path for the detail file. Use the same @@ -388,7 +388,7 @@ static rlm_rcode_t CC_HINT(nonnull) detail_do(void const *instance, request_t *r * through xlat_eval() to expand the variables. */ if (xlat_eval(buffer, sizeof(buffer), request, inst->filename, inst->escape_func, NULL) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } RDEBUG2("%s expands to %s", inst->filename, buffer); @@ -397,7 +397,7 @@ static rlm_rcode_t CC_HINT(nonnull) detail_do(void const *instance, request_t *r if (outfd < 0) { RPERROR("Couldn't open file %s", buffer); /* coverity[missing_unlock] */ - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } if (inst->group != NULL) { @@ -430,7 +430,7 @@ skip_group: fail: if (outfp) fclose(outfp); exfile_close(inst->ef, request, outfd); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } if (detail_write(outfp, inst, request, packet, compat) < 0) goto fail; @@ -444,31 +444,31 @@ skip_group: /* * And everything is fine. */ - return RLM_MODULE_OK; + RETURN_MODULE_OK; } /* * Accounting - write the detail files. */ -static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_accounting(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { - return detail_do(mctx->instance, request, request->packet, true); + return detail_do(p_result, mctx, request, request->packet, true); } /* * Incoming Access Request - write the detail files. */ -static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { - return detail_do(mctx->instance, request, request->packet, false); + return detail_do(p_result, mctx, request, request->packet, false); } /* * Outgoing Access-Request Reply - write the detail files. */ -static rlm_rcode_t CC_HINT(nonnull) mod_post_auth(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_post_auth(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { - return detail_do(mctx->instance, request, request->reply, false); + return detail_do(p_result, mctx, request, request->reply, false); } diff --git a/src/modules/rlm_digest/rlm_digest.c b/src/modules/rlm_digest/rlm_digest.c index 2efbfccc3c6..24b119eadae 100644 --- a/src/modules/rlm_digest/rlm_digest.c +++ b/src/modules/rlm_digest/rlm_digest.c @@ -84,7 +84,7 @@ fr_dict_attr_autoload_t rlm_digest_dict_attr[] = { { NULL } }; -static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_digest_t const *inst = talloc_get_type_abort(mctx->instance, rlm_digest_t); fr_cursor_t cursor; @@ -102,26 +102,26 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, requ * For simplicity, we allow the caller to omit things * that they don't care about. */ - if (!vp) return RLM_MODULE_NOOP; + if (!vp) RETURN_MODULE_NOOP; if (!inst->auth_type) { WARN("No 'authenticate %s {...}' section or 'Auth-Type = %s' set. Cannot setup Digest authentication", inst->name, inst->name); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } /* * Everything's OK, add a digest authentication type. */ - if (!module_section_type_set(request, attr_auth_type, inst->auth_type)) return RLM_MODULE_NOOP; + if (!module_section_type_set(request, attr_auth_type, inst->auth_type)) RETURN_MODULE_NOOP; - return RLM_MODULE_OK; + RETURN_MODULE_OK; } /* * Perform all of the wondrous variants of digest authentication. */ -static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(UNUSED module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authenticate(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request) { size_t a1_len, a2_len, kd_len; uint8_t a1[(FR_MAX_STRING_LEN + 1) * 5]; /* can be 5 attributes */ @@ -139,14 +139,14 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(UNUSED module_ctx_t const * if (passwd) { if (passwd->vp_length != 32) { REDEBUG("Digest-HA1 has invalid length, authentication failed"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } } else { passwd = fr_pair_find_by_da(&request->control_pairs, attr_cleartext_password); } if (!passwd) { REDEBUG("Cleartext-Password or Digest-HA1 is required for authentication"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -155,7 +155,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(UNUSED module_ctx_t const * nonce = fr_pair_find_by_da(&request->request_pairs, attr_digest_nonce); if (!nonce) { REDEBUG("No Digest-Nonce: Cannot perform Digest authentication"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -164,7 +164,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(UNUSED module_ctx_t const * vp = fr_pair_find_by_da(&request->request_pairs, attr_digest_user_name); if (!vp) { REDEBUG("No Digest-User-Name: Cannot perform Digest authentication"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } memcpy(&a1[0], vp->vp_octets, vp->vp_length); a1_len = vp->vp_length; @@ -175,7 +175,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(UNUSED module_ctx_t const * vp = fr_pair_find_by_da(&request->request_pairs, attr_digest_realm); if (!vp) { REDEBUG("No Digest-Realm: Cannot perform Digest authentication"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } memcpy(&a1[a1_len], vp->vp_octets, vp->vp_length); a1_len += vp->vp_length; @@ -208,7 +208,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(UNUSED module_ctx_t const * if (fr_hex2bin(NULL, &FR_DBUFF_TMP(&a1[0], sizeof(a1)), &FR_SBUFF_IN(passwd->vp_strvalue, passwd->vp_length), false) != 16) { RDEBUG2("Invalid text in Digest-HA1"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } } @@ -235,7 +235,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(UNUSED module_ctx_t const * */ if ((nonce->vp_length & 1) != 0) { REDEBUG("Received Digest-Nonce hex string with invalid length: Cannot perform Digest authentication"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } memcpy(&a1[a1_len], nonce->vp_octets, nonce->vp_length); a1_len += nonce->vp_length; @@ -246,7 +246,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(UNUSED module_ctx_t const * vp = fr_pair_find_by_da(&request->request_pairs, attr_digest_cnonce); if (!vp) { REDEBUG("No Digest-CNonce: Cannot perform Digest authentication"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -254,7 +254,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(UNUSED module_ctx_t const * */ if ((vp->vp_length & 1) != 0) { REDEBUG("Received Digest-CNonce hex string with invalid length: Cannot perform Digest authentication"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } memcpy(&a1[a1_len], vp->vp_octets, vp->vp_length); a1_len += vp->vp_length; @@ -265,7 +265,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(UNUSED module_ctx_t const * * Anything else is an error. */ REDEBUG("%pP - Unknown Digest-Algorithm: Cannot perform Digest authentication", vp); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -274,7 +274,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(UNUSED module_ctx_t const * vp = fr_pair_find_by_da(&request->request_pairs, attr_digest_method); if (!vp) { REDEBUG("No Digest-Method: Cannot perform Digest authentication"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } memcpy(&a2[0], vp->vp_octets, vp->vp_length); a2_len = vp->vp_length; @@ -285,7 +285,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(UNUSED module_ctx_t const * vp = fr_pair_find_by_da(&request->request_pairs, attr_digest_uri); if (!vp) { REDEBUG("No Digest-URI: Cannot perform Digest authentication"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } memcpy(&a2[a2_len], vp->vp_octets, vp->vp_length); a2_len += vp->vp_length; @@ -310,12 +310,12 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(UNUSED module_ctx_t const * body = fr_pair_find_by_da(&request->request_pairs, attr_digest_body_digest); if (!body) { REDEBUG("No Digest-Body-Digest: Cannot perform Digest authentication"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } if ((a2_len + body->vp_length) > sizeof(a2)) { REDEBUG("Digest-Body-Digest is too long"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } memcpy(a2 + a2_len, body->vp_octets, body->vp_length); @@ -323,7 +323,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(UNUSED module_ctx_t const * } else if (strcasecmp(qop->vp_strvalue, "auth") != 0) { REDEBUG("%pP - Unknown value: Cannot perform Digest authentication", qop); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } } @@ -373,7 +373,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(UNUSED module_ctx_t const * vp = fr_pair_find_by_da(&request->request_pairs, attr_digest_nonce_count); if (!vp) { REDEBUG("No Digest-Nonce-Count: Cannot perform Digest authentication"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } memcpy(&kd[kd_len], vp->vp_octets, vp->vp_length); kd_len += vp->vp_length; @@ -384,7 +384,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(UNUSED module_ctx_t const * vp = fr_pair_find_by_da(&request->request_pairs, attr_digest_cnonce); if (!vp) { REDEBUG("No Digest-CNonce: Cannot perform Digest authentication"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } memcpy(&kd[kd_len], vp->vp_octets, vp->vp_length); kd_len += vp->vp_length; @@ -426,13 +426,13 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(UNUSED module_ctx_t const * vp = fr_pair_find_by_da(&request->request_pairs, attr_digest_response); if (!vp) { REDEBUG("No Digest-Response attribute in the request. Cannot perform digest authentication"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } if (fr_hex2bin(NULL, &FR_DBUFF_TMP(&hash[0], sizeof(hash)), &FR_SBUFF_IN(vp->vp_strvalue, vp->vp_length), false) != (ssize_t)(vp->vp_length >> 1)) { RDEBUG2("Invalid text in Digest-Response"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } RDEBUG3("Comparing hashes, received: %pV, calculated: %pH", &vp->data, fr_box_octets(kd, 16)); @@ -440,10 +440,10 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(UNUSED module_ctx_t const * /* * And finally, compare the digest in the packet with KD. */ - if (memcmp(&kd[0], &hash[0], 16) == 0) return RLM_MODULE_OK; + if (memcmp(&kd[0], &hash[0], 16) == 0) RETURN_MODULE_OK; REDEBUG("FAILED authentication"); - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; } static int mod_bootstrap(void *instance, CONF_SECTION *conf) diff --git a/src/modules/rlm_eap/rlm_eap.c b/src/modules/rlm_eap/rlm_eap.c index d013028286a..b2ab23d6b05 100644 --- a/src/modules/rlm_eap/rlm_eap.c +++ b/src/modules/rlm_eap/rlm_eap.c @@ -104,8 +104,8 @@ fr_dict_attr_autoload_t rlm_eap_dict_attr[] = { { NULL } }; -static rlm_rcode_t mod_authenticate(module_ctx_t const *mctx, request_t *request) CC_HINT(nonnull); -static rlm_rcode_t mod_authorize(module_ctx_t const *mctx, request_t *request) CC_HINT(nonnull); +static unlang_action_t mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) CC_HINT(nonnull); +static unlang_action_t mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) CC_HINT(nonnull); /** Wrapper around dl_instance which loads submodules based on type = foo pairs * @@ -374,8 +374,8 @@ static void mod_authenticate_cancel(UNUSED module_ctx_t const *mctx, request_t * * - RLM_MODULE_HANDLED if we're done with this round. * - RLM_MODULE_REJECT if the user should be rejected. */ -static rlm_rcode_t mod_authenticate_result(request_t *request, UNUSED module_ctx_t const *mctx, - eap_session_t *eap_session, rlm_rcode_t result) +static unlang_action_t mod_authenticate_result(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, + request_t *request, eap_session_t *eap_session, rlm_rcode_t result) { rlm_rcode_t rcode; @@ -457,21 +457,23 @@ static rlm_rcode_t mod_authenticate_result(request_t *request, UNUSED module_ctx eap_session_freeze(&eap_session); finish: - return rcode; + RETURN_MODULE_RCODE(rcode); } /** Call mod_authenticate_result asynchronously from the unlang interpreter * - * @param[in] request The current request. + * @param[out] p_result The result of the operation. * @param[in] mctx module calling ctx. + * @param[in] request the current request. * @param[in] rctx the eap_session_t. * @return The result of this round of authentication. */ -static rlm_rcode_t mod_authenticate_result_async(module_ctx_t const *mctx, request_t *request, void *rctx) +static unlang_action_t mod_authenticate_result_async(rlm_rcode_t *p_result, module_ctx_t const *mctx, + request_t *request, void *rctx) { eap_session_t *eap_session = talloc_get_type_abort(rctx, eap_session_t); - return mod_authenticate_result(request, mctx, eap_session, eap_session->submodule_rcode); + return mod_authenticate_result(p_result, mctx, request, eap_session, eap_session->submodule_rcode); } /** Select the correct callback based on a response @@ -481,6 +483,7 @@ static rlm_rcode_t mod_authenticate_result_async(module_ctx_t const *mctx, reque * * Default to the configured EAP-Type for all Unsupported EAP-Types. * + * @param[out] p_result the result of the operation. * @param[in] mctx module calling ctx. * @param[in] eap_session State data that persists over multiple rounds of EAP. * @return @@ -488,7 +491,7 @@ static rlm_rcode_t mod_authenticate_result_async(module_ctx_t const *mctx, reque * - RLM_MODULE_YIELD Yield control back to the interpreter so it can * call the submodule. */ -static rlm_rcode_t eap_method_select(module_ctx_t const *mctx, eap_session_t *eap_session) +static unlang_action_t eap_method_select(rlm_rcode_t *p_result, module_ctx_t const *mctx, eap_session_t *eap_session) { rlm_eap_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_eap_t); eap_type_data_t *type = &eap_session->this_round->response->type; @@ -511,7 +514,7 @@ static rlm_rcode_t eap_method_select(module_ctx_t const *mctx, eap_session_t *ea REDEBUG("Peer sent EAP type number %d, which is outside known range", type->num); is_invalid: - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -575,7 +578,7 @@ static rlm_rcode_t eap_method_select(module_ctx_t const *mctx, eap_session_t *ea */ TALLOC_FREE(eap_session->opaque); next = eap_process_nak(mctx, eap_session->request, eap_session->type, type); - if (!next) return RLM_MODULE_REJECT; + if (!next) RETURN_MODULE_REJECT; /* * Initialise the state machine for the next submodule @@ -620,7 +623,7 @@ static rlm_rcode_t eap_method_select(module_ctx_t const *mctx, eap_session_t *ea RERROR("Failed copying parent's attribute list"); fail: TALLOC_FREE(eap_session->subrequest); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } if (fr_pair_list_copy(eap_session->subrequest->packet, @@ -666,16 +669,16 @@ static rlm_rcode_t eap_method_select(module_ctx_t const *mctx, eap_session_t *ea eap_session); } -static rlm_rcode_t mod_authenticate(module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_eap_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_eap_t); eap_session_t *eap_session; eap_packet_raw_t *eap_packet; - rlm_rcode_t rcode; + unlang_action_t ua; if (!fr_pair_find_by_da(&request->request_pairs, attr_eap_message)) { REDEBUG("You set 'Auth-Type = EAP' for a request that does not contain an EAP-Message attribute!"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -686,7 +689,7 @@ static rlm_rcode_t mod_authenticate(module_ctx_t const *mctx, request_t *request eap_packet = eap_packet_from_vp(request, request->request_pairs); if (!eap_packet) { RPERROR("Malformed EAP Message"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* @@ -696,21 +699,21 @@ static rlm_rcode_t mod_authenticate(module_ctx_t const *mctx, request_t *request * data. */ eap_session = eap_session_continue(inst, &eap_packet, request); - if (!eap_session) return RLM_MODULE_INVALID; /* Don't emit error here, it will mask the real issue */ + if (!eap_session) RETURN_MODULE_INVALID; /* Don't emit error here, it will mask the real issue */ /* * Call an EAP submodule to process the request, * or with simple types like Identity and NAK, * process it ourselves. */ - rcode = eap_method_select(mctx, eap_session); - switch (rcode) { + ua = eap_method_select(p_result, mctx, eap_session); + switch (*p_result) { /* * Leave the session thawed, next state * func will need to re-freeze. */ case RLM_MODULE_YIELD: - return rcode; + return ua; case RLM_MODULE_OK: case RLM_MODULE_UPDATED: @@ -730,7 +733,7 @@ static rlm_rcode_t mod_authenticate(module_ctx_t const *mctx, request_t *request break; } - return rcode; + return ua; } /* @@ -738,7 +741,7 @@ static rlm_rcode_t mod_authenticate(module_ctx_t const *mctx, request_t *request * to check for user existence & get their configured values. * It Handles EAP-START Messages, User-Name initialization. */ -static rlm_rcode_t mod_authorize(module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_eap_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_eap_t); int status; @@ -749,13 +752,13 @@ static rlm_rcode_t mod_authorize(module_ctx_t const *mctx, request_t *request) * proxy reply (or the proxied packet) */ if (request->proxy != NULL) - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; #endif if (!inst->auth_type) { WARN("No 'authenticate %s {...}' section or 'Auth-Type = %s' set. Cannot setup EAP authentication", inst->name, inst->name); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } /* @@ -779,11 +782,11 @@ static rlm_rcode_t mod_authorize(module_ctx_t const *mctx, request_t *request) break; } - if (!module_section_type_set(request, attr_auth_type, inst->auth_type)) return RLM_MODULE_NOOP; + if (!module_section_type_set(request, attr_auth_type, inst->auth_type)) RETURN_MODULE_NOOP; - if (status == RLM_MODULE_OK) return RLM_MODULE_OK; + if (status == RLM_MODULE_OK) RETURN_MODULE_OK; - return RLM_MODULE_UPDATED; + RETURN_MODULE_UPDATED; } #if 0 @@ -791,7 +794,7 @@ static rlm_rcode_t mod_authorize(module_ctx_t const *mctx, request_t *request) * If we're proxying EAP, then there may be magic we need * to do. */ -static rlm_rcode_t mod_post_proxy(module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_post_proxy(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_eap_t const *inst = talloc_get_type_abort_const(instance->mctx, rlm_eap_t); size_t i; @@ -823,7 +826,7 @@ static rlm_rcode_t mod_post_proxy(module_ctx_t const *mctx, request_t *request) if (!data) { RERROR("Failed to retrieve callback for tunneled session!"); eap_session_destroy(&eap_session); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* @@ -880,7 +883,7 @@ static rlm_rcode_t mod_post_proxy(module_ctx_t const *mctx, request_t *request) eap_session_freeze(&eap_session); - return RLM_MODULE_OK; + RETURN_MODULE_OK; } else { RDEBUG2("No pre-existing eap_session found"); } @@ -888,11 +891,11 @@ static rlm_rcode_t mod_post_proxy(module_ctx_t const *mctx, request_t *request) /* * This is allowed. */ - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } #endif -static rlm_rcode_t mod_post_auth(module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_post_auth(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_eap_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_eap_t); fr_pair_t *vp; @@ -932,16 +935,16 @@ static rlm_rcode_t mod_post_auth(module_ctx_t const *mctx, request_t *request) * Only synthesize a failure message if something * previously rejected the request. */ - if (request->reply->code != FR_CODE_ACCESS_REJECT) return RLM_MODULE_NOOP; + if (request->reply->code != FR_CODE_ACCESS_REJECT) RETURN_MODULE_NOOP; if (!fr_pair_find_by_da(&request->request_pairs, attr_eap_message)) { RDEBUG3("Request didn't contain an EAP-Message, not inserting EAP-Failure"); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } if (fr_pair_find_by_da(&request->reply_pairs, attr_eap_message)) { RDEBUG3("Reply already contained an EAP-Message, not inserting EAP-Failure"); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } /* @@ -952,14 +955,14 @@ static rlm_rcode_t mod_post_auth(module_ctx_t const *mctx, request_t *request) eap_session = eap_session_thaw(request); if (!eap_session) { RDEBUG3("Failed to get eap_session, probably already removed, not inserting EAP-Failure"); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } /* * Already set to failure, assume something else * added EAP-Message with a failure code, do nothing. */ - if (eap_session->this_round->request->code == FR_EAP_CODE_FAILURE) return RLM_MODULE_NOOP; + if (eap_session->this_round->request->code == FR_EAP_CODE_FAILURE) RETURN_MODULE_NOOP; /* * Was *NOT* an EAP-Failure, so we now need to turn it into one. @@ -976,7 +979,7 @@ static rlm_rcode_t mod_post_auth(module_ctx_t const *mctx, request_t *request) MEM(pair_update_reply(&vp, attr_message_authenticator) >= 0); MEM(fr_pair_value_mem_alloc(vp, NULL, RADIUS_AUTH_VECTOR_LENGTH, false) == 0); - return RLM_MODULE_UPDATED; + RETURN_MODULE_UPDATED; } static int mod_instantiate(void *instance, UNUSED CONF_SECTION *cs) diff --git a/src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c b/src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c index c1d4769b5e5..6b3141d8285 100644 --- a/src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c +++ b/src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c @@ -447,7 +447,7 @@ error: /* * Do authentication, by letting EAP-TLS do most of the work. */ -static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_eap_fast_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_eap_fast_t); eap_tls_status_t status; @@ -491,7 +491,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) * do nothing. */ case EAP_TLS_HANDLED: - return RLM_MODULE_HANDLED; + RETURN_MODULE_HANDLED; /* * Handshake is done, proceed with decoding tunneled @@ -504,7 +504,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) * Anything else: fail. */ default: - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* @@ -519,7 +519,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) switch (eap_fast_process(request, eap_session, tls_session)) { case FR_CODE_ACCESS_REJECT: eap_tls_fail(request, eap_session); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; /* * Access-Challenge, continue tunneled conversation. @@ -527,14 +527,14 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) case FR_CODE_ACCESS_CHALLENGE: fr_tls_session_send(request, tls_session); eap_tls_request(request, eap_session); - return RLM_MODULE_HANDLED; + RETURN_MODULE_HANDLED; /* * Success: Automatically return MPPE keys. */ case FR_CODE_ACCESS_ACCEPT: - if (eap_tls_success(request, eap_session, NULL, 0, NULL, 0) < 0) return RLM_MODULE_FAIL; - return RLM_MODULE_OK; + if (eap_tls_success(request, eap_session, NULL, 0, NULL, 0) < 0) RETURN_MODULE_FAIL; + RETURN_MODULE_OK; /* * No response packet, MUST be proxying it. @@ -543,7 +543,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) * will proxy it, rather than returning an EAP packet. */ case FR_CODE_STATUS_CLIENT: - return RLM_MODULE_OK; + RETURN_MODULE_OK; default: break; @@ -553,13 +553,13 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) * Something we don't understand: Reject it. */ eap_tls_fail(request, eap_session); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* * Send an initial eap-tls request to the peer, using the libeap functions. */ -static rlm_rcode_t mod_session_init(module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_session_init(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_eap_fast_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_eap_fast_t); eap_session_t *eap_session = eap_session_get(request->parent); @@ -583,7 +583,7 @@ static rlm_rcode_t mod_session_init(module_ctx_t const *mctx, request_t *request } eap_session->opaque = eap_tls_session = eap_tls_session_init(request, eap_session, inst->tls_conf, client_cert); - if (!eap_tls_session) return RLM_MODULE_FAIL; + if (!eap_tls_session) RETURN_MODULE_FAIL; tls_session = eap_tls_session->tls_session; @@ -621,7 +621,7 @@ static rlm_rcode_t mod_session_init(module_ctx_t const *mctx, request_t *request &tls_session->clean_in, tls_session->clean_in.used, tls_session->clean_in.used) < 0) { talloc_free(tls_session); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } tls_session->record_init(&tls_session->clean_in); @@ -629,10 +629,10 @@ static rlm_rcode_t mod_session_init(module_ctx_t const *mctx, request_t *request if (!SSL_set_session_ticket_ext_cb(tls_session->ssl, _session_ticket, tls_session)) { RERROR("Failed setting SSL session ticket callback"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } - return RLM_MODULE_HANDLED; + RETURN_MODULE_HANDLED; } diff --git a/src/modules/rlm_eap/types/rlm_eap_gtc/rlm_eap_gtc.c b/src/modules/rlm_eap/types/rlm_eap_gtc/rlm_eap_gtc.c index ed2782189e4..e59446dfbbe 100644 --- a/src/modules/rlm_eap/types/rlm_eap_gtc/rlm_eap_gtc.c +++ b/src/modules/rlm_eap/types/rlm_eap_gtc/rlm_eap_gtc.c @@ -68,7 +68,7 @@ fr_dict_attr_autoload_t rlm_eap_gtc_dict_attr[] = { { NULL } }; -static rlm_rcode_t mod_session_init(module_ctx_t const *mctx, request_t *request); +static unlang_action_t mod_session_init(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request); /** Translate a string auth_type into an enumeration value * @@ -98,7 +98,7 @@ static int auth_type_parse(UNUSED TALLOC_CTX *ctx, void *out, UNUSED void *paren /* * Keep processing the Auth-Type until it doesn't return YIELD. */ -static rlm_rcode_t mod_process_auth_type(UNUSED module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_process_auth_type(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request) { rlm_rcode_t rcode; @@ -107,23 +107,23 @@ static rlm_rcode_t mod_process_auth_type(UNUSED module_ctx_t const *mctx, reque rcode = unlang_interpret(request); - if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_REJECT; + if (request->master_state == REQUEST_STOP_PROCESSING) return UNLANG_ACTION_STOP_PROCESSING; - if (rcode == RLM_MODULE_YIELD) return rcode; + if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD; if (rcode != RLM_MODULE_OK) { eap_round->request->code = FR_EAP_CODE_FAILURE; - return rcode; + RETURN_MODULE_RCODE(rcode); } eap_round->request->code = FR_EAP_CODE_SUCCESS; - return RLM_MODULE_OK; + RETURN_MODULE_OK; } /* * Authenticate a previously sent challenge. */ -static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_eap_gtc_t const *inst = talloc_get_type_abort(mctx->instance, rlm_eap_gtc_t); rlm_rcode_t rcode; @@ -145,7 +145,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) if (eap_round->response->length <= 4) { REDEBUG("Corrupted data"); eap_round->request->code = FR_EAP_CODE_FAILURE; - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -155,7 +155,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) if (eap_round->response->type.length > 128) { REDEBUG("Response is too large to understand"); eap_round->request->code = FR_EAP_CODE_FAILURE; - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -171,30 +171,30 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) /* * Call the authenticate section of the *current* virtual server. */ - rcode = process_authenticate(inst->auth_type->value->vb_uint32, request); + process_authenticate(&rcode, inst->auth_type->value->vb_uint32, request); if (rcode != RLM_MODULE_OK) { eap_round->request->code = FR_EAP_CODE_FAILURE; - return rcode; + RETURN_MODULE_RCODE(rcode); } eap_round->request->code = FR_EAP_CODE_SUCCESS; - return RLM_MODULE_OK; + RETURN_MODULE_OK; } if (unlang_interpret_push_section(request, unlang, RLM_MODULE_FAIL, UNLANG_TOP_FRAME) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } eap_session->process = mod_process_auth_type; - return eap_session->process(mctx, request); + return eap_session->process(p_result, mctx, request); } /* * Initiate the EAP-GTC session by sending a challenge to the peer. */ -static rlm_rcode_t mod_session_init(module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_session_init(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { eap_session_t *eap_session = eap_session_get(request->parent); char challenge_str[1024]; @@ -203,7 +203,7 @@ static rlm_rcode_t mod_session_init(module_ctx_t const *mctx, request_t *request rlm_eap_gtc_t *inst = talloc_get_type_abort(mctx->instance, rlm_eap_gtc_t); if (xlat_eval(challenge_str, sizeof(challenge_str), request, inst->challenge, NULL, NULL) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } length = strlen(challenge_str); @@ -214,7 +214,7 @@ static rlm_rcode_t mod_session_init(module_ctx_t const *mctx, request_t *request eap_round->request->code = FR_EAP_CODE_REQUEST; eap_round->request->type.data = talloc_array(eap_round->request, uint8_t, length); - if (!eap_round->request->type.data) return RLM_MODULE_FAIL; + if (!eap_round->request->type.data) RETURN_MODULE_FAIL; memcpy(eap_round->request->type.data, challenge_str, length); eap_round->request->type.length = length; @@ -228,7 +228,7 @@ static rlm_rcode_t mod_session_init(module_ctx_t const *mctx, request_t *request */ eap_session->process = mod_process; - return RLM_MODULE_HANDLED; + RETURN_MODULE_HANDLED; } /* diff --git a/src/modules/rlm_eap/types/rlm_eap_md5/rlm_eap_md5.c b/src/modules/rlm_eap/types/rlm_eap_md5/rlm_eap_md5.c index 0778fd8e890..56a9e7f93c9 100644 --- a/src/modules/rlm_eap/types/rlm_eap_md5/rlm_eap_md5.c +++ b/src/modules/rlm_eap/types/rlm_eap_md5/rlm_eap_md5.c @@ -47,7 +47,7 @@ fr_dict_attr_autoload_t rlm_eap_md5_dict_attr[] = { /* * Authenticate a previously sent challenge. */ -static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_process(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request) { eap_session_t *eap_session = eap_session_get(request->parent); MD5_PACKET *packet; @@ -66,7 +66,7 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque false); if (!known_good) { REDEBUG("No \"known good\" password found for user"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* @@ -75,7 +75,7 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque packet = eap_md5_extract(eap_session->this_round); if (!packet) { if (ephemeral) talloc_list_free(&known_good); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -104,13 +104,13 @@ static rlm_rcode_t mod_process(UNUSED module_ctx_t const *mctx, request_t *reque if (ephemeral) talloc_list_free(&known_good); - return RLM_MODULE_OK; + RETURN_MODULE_OK; } /* * Initiate the EAP-MD5 session by sending a challenge to the peer. */ -static rlm_rcode_t mod_session_init(UNUSED module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_session_init(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request) { eap_session_t *eap_session = eap_session_get(request->parent); MD5_PACKET *reply; @@ -161,7 +161,7 @@ static rlm_rcode_t mod_session_init(UNUSED module_ctx_t const *mctx, request_t * */ eap_session->process = mod_process; - return RLM_MODULE_HANDLED; + RETURN_MODULE_HANDLED; } /* diff --git a/src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c b/src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c index 57cb901c842..24cd6b61147 100644 --- a/src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c +++ b/src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c @@ -260,7 +260,7 @@ static int eap_mschapv2_compose(rlm_eap_mschapv2_t const *inst, request_t *reque } -static rlm_rcode_t CC_HINT(nonnull) mod_process(module_ctx_t const *mctx, request_t *request); +static unlang_action_t CC_HINT(nonnull) mod_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request); #ifdef WITH_PROXY /* @@ -298,7 +298,7 @@ static int CC_HINT(nonnull) mschap_postproxy(eap_session_t *eap_session, UNUSED default: case FR_CODE_ACCESS_REJECT: REDEBUG("Proxied authentication was rejected"); - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; } /* @@ -306,7 +306,7 @@ static int CC_HINT(nonnull) mschap_postproxy(eap_session_t *eap_session, UNUSED */ if (!response) { REDEBUG("Proxied reply contained no MS-CHAP2-Success or MS-CHAP-Error"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -338,17 +338,18 @@ static int CC_HINT(nonnull) mschap_postproxy(eap_session_t *eap_session, UNUSED request->reply->code = FR_CODE_ACCESS_CHALLENGE; fr_pair_list_free(&response); - return RLM_MODULE_HANDLED; + RETURN_MODULE_HANDLED; } #endif -static rlm_rcode_t mschap_finalize(request_t *request, rlm_eap_mschapv2_t const *inst, - eap_session_t *eap_session, rlm_rcode_t rcode) +static unlang_action_t mschap_finalize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, + eap_session_t *eap_session, rlm_rcode_t rcode) { - mschapv2_opaque_t *data = talloc_get_type_abort(eap_session->opaque, mschapv2_opaque_t); - eap_round_t *eap_round = eap_session->this_round; - fr_pair_t *response = NULL; + mschapv2_opaque_t *data = talloc_get_type_abort(eap_session->opaque, mschapv2_opaque_t); + eap_round_t *eap_round = eap_session->this_round; + fr_pair_t *response = NULL; + rlm_eap_mschapv2_t const *inst = mctx->instance; /* * Delete MPPE keys & encryption policy. We don't @@ -363,14 +364,14 @@ static rlm_rcode_t mschap_finalize(request_t *request, rlm_eap_mschapv2_t const if (rcode == RLM_MODULE_OK) { if (fr_pair_list_copy_by_da(data, &response, &request->reply_pairs, attr_ms_chap2_success) < 0) { RPERROR("Failed copying %s", attr_ms_chap2_success->name); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } data->code = FR_EAP_MSCHAPV2_SUCCESS; } else if (inst->send_error) { if (fr_pair_list_copy_by_da(data, &response, &request->reply_pairs, attr_ms_chap_error) < 0) { RPERROR("Failed copying %s", attr_ms_chap_error->name); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } if (response) { int n, err, retry; @@ -399,7 +400,7 @@ static rlm_rcode_t mschap_finalize(request_t *request, rlm_eap_mschapv2_t const data->code = FR_EAP_MSCHAPV2_FAILURE; } else { eap_round->request->code = FR_EAP_CODE_FAILURE; - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; } /* @@ -407,7 +408,7 @@ static rlm_rcode_t mschap_finalize(request_t *request, rlm_eap_mschapv2_t const */ if (!response) { REDEBUG("No %s or %s attributes were found", attr_ms_chap2_success->name, attr_ms_chap_error->name); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -417,35 +418,34 @@ static rlm_rcode_t mschap_finalize(request_t *request, rlm_eap_mschapv2_t const eap_mschapv2_compose(eap_session->inst, request, eap_session, response); fr_pair_list_free(&response); - return RLM_MODULE_OK; + RETURN_MODULE_OK; } /* * Keep processing the Auth-Type until it doesn't return YIELD. */ -static rlm_rcode_t mod_process_auth_type(module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_process_auth_type(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { - rlm_eap_mschapv2_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_eap_mschapv2_t); rlm_rcode_t rcode; eap_session_t *eap_session = eap_session_get(request->parent); rcode = unlang_interpret(request); - if (request->master_state == REQUEST_STOP_PROCESSING) return RLM_MODULE_REJECT; + if (request->master_state == REQUEST_STOP_PROCESSING) return UNLANG_ACTION_STOP_PROCESSING; - if (rcode == RLM_MODULE_YIELD) return rcode; + if (rcode == RLM_MODULE_YIELD) return UNLANG_ACTION_YIELD; - return mschap_finalize(request, inst, eap_session, rcode); + return mschap_finalize(p_result, mctx, request, eap_session, rcode); } /* * Authenticate a previously sent challenge. */ -static rlm_rcode_t CC_HINT(nonnull) mod_process(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_eap_mschapv2_t const *inst = talloc_get_type_abort(mctx->instance, rlm_eap_mschapv2_t); - request_t *parent = request->parent; + request_t *parent = request->parent; eap_session_t *eap_session = eap_session_get(parent); mschapv2_opaque_t *data = talloc_get_type_abort(eap_session->opaque, mschapv2_opaque_t); eap_round_t *eap_round = eap_session->this_round; @@ -465,7 +465,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_process(module_ctx_t const *mctx, reques if (eap_round->response->length < 6) { REDEBUG("Response too short, expected at least 6 bytes, got %zu bytes", eap_round->response->length); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } ccode = eap_round->response->type.data[0]; @@ -534,13 +534,13 @@ static rlm_rcode_t CC_HINT(nonnull) mod_process(module_ctx_t const *mctx, reques */ if (ccode != FR_EAP_MSCHAPV2_FAILURE) { REDEBUG("Sent FAILURE expecting FAILURE but got %d", ccode); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } failure: request->options &= ~RAD_REQUEST_OPTION_PROXY_EAP; eap_round->request->code = FR_EAP_CODE_FAILURE; - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; case FR_EAP_MSCHAPV2_SUCCESS: /* @@ -571,10 +571,10 @@ failure: request->options &= ~RAD_REQUEST_OPTION_PROXY_EAP; #endif MEM(fr_pair_list_copy(parent->reply, &parent->reply->vps, &data->reply) >= 0); - return RLM_MODULE_OK; + RETURN_MODULE_OK; } REDEBUG("Sent SUCCESS expecting SUCCESS (or ACK) but got %d", ccode); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; case FR_EAP_MSCHAPV2_CHALLENGE: if (ccode == FR_EAP_MSCHAPV2_FAILURE) goto failure; @@ -584,7 +584,7 @@ failure: */ if (ccode != FR_EAP_MSCHAPV2_RESPONSE) { REDEBUG("Sent CHALLENGE expecting RESPONSE but got %d", ccode); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* authentication happens below */ break; @@ -592,7 +592,7 @@ failure: default: /* should never happen */ REDEBUG("Unknown state %d", data->code); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } @@ -606,7 +606,7 @@ failure: */ if (eap_round->response->length < (4 + 1 + 1 + 1 + 2 + 1)) { REDEBUG("Response is too short"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -623,7 +623,7 @@ failure: if ((eap_round->response->type.data[4] != 49) && (eap_round->response->type.data[4] != 16)) { REDEBUG("Response is of incorrect length %d", eap_round->response->type.data[4]); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -633,7 +633,7 @@ failure: length = (eap_round->response->type.data[2] << 8) | eap_round->response->type.data[3]; if ((length < (5 + 49)) || (length > (256 + 5 + 49))) { REDEBUG("Response contains contradictory length %zu %d", length, 5 + 49); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -736,7 +736,7 @@ packet_ready: * to do the work below, AFTER the call to MS-CHAP * authentication... */ - return RLM_MODULE_OK; + RETURN_MODULE_OK; } #endif @@ -745,10 +745,10 @@ packet_ready: */ unlang = cf_section_find(request->server_cs, "authenticate", inst->auth_type->name); if (!unlang) { - rcode = process_authenticate(inst->auth_type->value->vb_uint32, request); + process_authenticate(&rcode, inst->auth_type->value->vb_uint32, request); } else { if (unlang_interpret_push_section(request, unlang, RLM_MODULE_FAIL, UNLANG_TOP_FRAME) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } rcode = unlang_interpret(request); @@ -758,17 +758,17 @@ packet_ready: */ if (rcode == RLM_MODULE_YIELD) { eap_session->process = mod_process_auth_type; - return rcode; + return UNLANG_ACTION_YIELD; } } - return mschap_finalize(request, inst, eap_session, rcode); + return mschap_finalize(p_result, mctx, request, eap_session, rcode); } /* * Initiate the EAP-MSCHAPV2 session by sending a challenge to the peer. */ -static rlm_rcode_t mod_session_init(module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_session_init(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { request_t *parent = request->parent; eap_session_t *eap_session = eap_session_get(parent); @@ -780,13 +780,13 @@ static rlm_rcode_t mod_session_init(module_ctx_t const *mctx, request_t *request int i; bool created_auth_challenge; - if (!fr_cond_assert(mctx->instance)) return RLM_MODULE_FAIL; + if (!fr_cond_assert(mctx->instance)) RETURN_MODULE_FAIL; /* * We're looking for attributes that should come * from the EAP-TTLS submodule. */ - if (!fr_cond_assert(parent)) return RLM_MODULE_FAIL; + if (!fr_cond_assert(parent)) RETURN_MODULE_FAIL; auth_challenge = fr_pair_find_by_da(&parent->control, attr_ms_chap_challenge); if (auth_challenge && (auth_challenge->vp_length != MSCHAPV2_CHALLENGE_LEN)) { @@ -867,7 +867,7 @@ static rlm_rcode_t mod_session_init(module_ctx_t const *mctx, request_t *request */ eap_session->process = mod_process; - return RLM_MODULE_HANDLED; + RETURN_MODULE_HANDLED; } /* diff --git a/src/modules/rlm_eap/types/rlm_eap_peap/eap_peap.h b/src/modules/rlm_eap/types/rlm_eap_peap/eap_peap.h index 9db84e97173..87d2238d180 100644 --- a/src/modules/rlm_eap/types/rlm_eap_peap/eap_peap.h +++ b/src/modules/rlm_eap/types/rlm_eap_peap/eap_peap.h @@ -75,4 +75,5 @@ extern fr_dict_attr_t const *attr_user_name; /* * Process the PEAP portion of an EAP-PEAP request. */ -rlm_rcode_t eap_peap_process(request_t *request, eap_session_t *eap_session, fr_tls_session_t *tls_session) CC_HINT(nonnull); +unlang_action_t eap_peap_process(rlm_rcode_t *p_result, request_t *request, + eap_session_t *eap_session, fr_tls_session_t *tls_session) CC_HINT(nonnull); diff --git a/src/modules/rlm_eap/types/rlm_eap_peap/peap.c b/src/modules/rlm_eap/types/rlm_eap_peap/peap.c index a68319ec114..6261d98d81b 100644 --- a/src/modules/rlm_eap/types/rlm_eap_peap/peap.c +++ b/src/modules/rlm_eap/types/rlm_eap_peap/peap.c @@ -468,16 +468,16 @@ static char const *peap_state(peap_tunnel_t *t) /* * Process the pseudo-EAP contents of the tunneled data. */ -rlm_rcode_t eap_peap_process(request_t *request, eap_session_t *eap_session, fr_tls_session_t *tls_session) +unlang_action_t eap_peap_process(rlm_rcode_t *p_result, request_t *request, + eap_session_t *eap_session, fr_tls_session_t *tls_session) { peap_tunnel_t *t = tls_session->opaque; - request_t *fake = NULL; + request_t *fake = NULL; fr_pair_t *vp; rlm_rcode_t rcode = RLM_MODULE_REJECT; uint8_t const *data; size_t data_len; - - eap_round_t *eap_round = eap_session->this_round; + eap_round_t *eap_round = eap_session->this_round; /* * Just look at the buffer directly, without doing @@ -491,7 +491,7 @@ rlm_rcode_t eap_peap_process(request_t *request, eap_session_t *eap_session, fr_ if ((t->status != PEAP_STATUS_TUNNEL_ESTABLISHED) && (eap_peap_verify(request, t, data, data_len) < 0)) { REDEBUG("Tunneled data is invalid"); - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; } switch (t->status) { @@ -559,7 +559,7 @@ rlm_rcode_t eap_peap_process(request_t *request, eap_session_t *eap_session, fr_ RDEBUG2("Sending SoH request to server %s", fake->server_cs ? cf_section_name2(fake->server_cs) : "NULL"); - rad_virtual_server(fake); + rad_virtual_server(&rcode, fake); if (fake->reply->code != FR_CODE_ACCESS_ACCEPT) { RDEBUG2("SoH was rejected"); @@ -636,7 +636,7 @@ rlm_rcode_t eap_peap_process(request_t *request, eap_session_t *eap_session, fr_ RIDEBUG("what went wrong, and how to fix the problem"); REXDENT(); - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; case PEAP_STATUS_PHASE2_INIT: RDEBUG2("In state machine in phase2 init?"); @@ -744,7 +744,7 @@ rlm_rcode_t eap_peap_process(request_t *request, eap_session_t *eap_session, fr_ finish: talloc_free(fake); - return rcode; + RETURN_MODULE_RCODE(rcode); } static int CC_HINT(nonnull) setup_fake_request(request_t *request, request_t *fake, peap_tunnel_t *t) { diff --git a/src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c b/src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c index e142220431c..344d5d1f4f2 100644 --- a/src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c +++ b/src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c @@ -124,7 +124,7 @@ static peap_tunnel_t *peap_alloc(TALLOC_CTX *ctx, rlm_eap_peap_t *inst) /* * Do authentication, by letting EAP-TLS do most of the work. */ -static rlm_rcode_t CC_HINT(nonnull) mod_process(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_eap_peap_t *inst = talloc_get_type(mctx->instance, rlm_eap_peap_t); @@ -176,7 +176,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_process(module_ctx_t const *mctx, reques * and EAP id from the inner tunnel, and update it with * the expected EAP id! */ - return RLM_MODULE_HANDLED; + RETURN_MODULE_HANDLED; /* * Handshake is done, proceed with decoding tunneled @@ -189,7 +189,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_process(module_ctx_t const *mctx, reques * Anything else: fail. */ default: - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* @@ -207,7 +207,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_process(module_ctx_t const *mctx, reques /* * Process the PEAP portion of the request. */ - rcode = eap_peap_process(request, eap_session, tls_session); + eap_peap_process(&rcode, request, eap_session, tls_session); switch (rcode) { case RLM_MODULE_REJECT: eap_tls_fail(request, eap_session); @@ -244,13 +244,13 @@ static rlm_rcode_t CC_HINT(nonnull) mod_process(module_ctx_t const *mctx, reques break; } - return rcode; + RETURN_MODULE_RCODE(rcode); } /* * Send an initial eap-tls request to the peer, using the libeap functions. */ -static rlm_rcode_t mod_session_init(module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_session_init(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_eap_peap_t *inst = talloc_get_type_abort(mctx->instance, rlm_eap_peap_t); eap_session_t *eap_session = eap_session_get(request->parent); @@ -273,7 +273,7 @@ static rlm_rcode_t mod_session_init(module_ctx_t const *mctx, request_t *request } eap_session->opaque = eap_tls_session = eap_tls_session_init(request, eap_session, inst->tls_conf, client_cert); - if (!eap_tls_session) return RLM_MODULE_FAIL; + if (!eap_tls_session) RETURN_MODULE_FAIL; /* * As it is a poorly designed protocol, PEAP uses @@ -299,12 +299,12 @@ static rlm_rcode_t mod_session_init(module_ctx_t const *mctx, request_t *request */ if (eap_tls_start(request, eap_session) < 0) { talloc_free(eap_tls_session); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } eap_session->process = mod_process; - return RLM_MODULE_HANDLED; + RETURN_MODULE_HANDLED; } /* diff --git a/src/modules/rlm_eap/types/rlm_eap_pwd/rlm_eap_pwd.c b/src/modules/rlm_eap/types/rlm_eap_pwd/rlm_eap_pwd.c index 5b6cbbbaa84..614053b9738 100644 --- a/src/modules/rlm_eap/types/rlm_eap_pwd/rlm_eap_pwd.c +++ b/src/modules/rlm_eap/types/rlm_eap_pwd/rlm_eap_pwd.c @@ -154,7 +154,7 @@ static int send_pwd_request(request_t *request, pwd_session_t *session, eap_roun return 0; } -static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_eap_pwd_t *inst = talloc_get_type_abort(mctx->instance, rlm_eap_pwd_t); eap_session_t *eap_session = eap_session_get(request->parent); @@ -183,7 +183,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) */ if (!hdr || (response->type.length < sizeof(pwd_hdr))) { REDEBUG("Packet with insufficient data"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } in = hdr->data; @@ -194,9 +194,9 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) */ if (session->out_pos) { if (in_len) REDEBUG("PWD got something more than an ACK for a fragment"); - if (send_pwd_request(request, session, eap_round) < 0) return RLM_MODULE_FAIL; + if (send_pwd_request(request, session, eap_round) < 0) RETURN_MODULE_FAIL; - return RLM_MODULE_OK; + RETURN_MODULE_OK; } /* @@ -206,18 +206,18 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) if (EAP_PWD_GET_LENGTH_BIT(hdr)) { if (session->in) { REDEBUG("PWD already alloced buffer for fragments"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } if (in_len < 2) { REDEBUG("Invalid packet: length bit set, but no length field"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } session->in_len = ntohs(in[0] * 256 | in[1]); if (!session->in_len) { DEBUG("EAP-PWD malformed packet (input length)"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } MEM(session->in = talloc_zero_array(session, uint8_t, session->in_len)); @@ -239,7 +239,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) if ((session->in_pos + in_len) > session->in_len) { REDEBUG("Fragment overflows packet"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } memcpy(session->in + session->in_pos, in, in_len); @@ -257,7 +257,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) hdr = (pwd_hdr *)eap_round->request->type.data; EAP_PWD_SET_EXCHANGE(hdr, exch); - return RLM_MODULE_OK; + RETURN_MODULE_OK; } @@ -267,7 +267,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) */ if ((session->in_pos + in_len) > session->in_len) { REDEBUG("PWD will overflow a fragment buffer"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } memcpy(session->in + session->in_pos, in, in_len); in = session->in; @@ -285,13 +285,13 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) if (EAP_PWD_GET_EXCHANGE(hdr) != EAP_PWD_EXCH_ID) { REDEBUG("PWD exchange is incorrect, Not ID"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } packet = (pwd_id_packet_t *) in; if (in_len < sizeof(*packet)) { REDEBUG("Packet is too small (%zd < %zd).", in_len, sizeof(*packet)); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } if ((packet->prf != EAP_PWD_DEF_PRF) || @@ -300,7 +300,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) (CRYPTO_memcmp(packet->token, &session->token, 4)) || (packet->group_num != ntohs(session->group_num))) { REDEBUG("PWD ID response is malformed"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -316,7 +316,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) session->peer_id_len = in_len - sizeof(pwd_id_packet_t); if (session->peer_id_len >= sizeof(session->peer_id)) { REDEBUG("PWD ID response is malformed"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } memcpy(session->peer_id, packet->identity, session->peer_id_len); @@ -326,7 +326,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) allowed_passwords, NUM_ELEMENTS(allowed_passwords), false); if (!known_good) { REDEBUG("No \"known good\" password found for user"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } ret = compute_password_element(request, session, session->group_num, @@ -337,7 +337,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) if (ephemeral) talloc_list_free(&known_good); if (ret < 0) { REDEBUG("Failed to obtain password element"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* @@ -345,7 +345,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) */ if (compute_scalar_element(request, session, inst->bnctx)) { REDEBUG("Failed to compute server's scalar and element"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } MEM(x = BN_new()); @@ -358,7 +358,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) REDEBUG("Server point assignment failed"); BN_clear_free(x); BN_clear_free(y); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* @@ -389,7 +389,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) case PWD_STATE_COMMIT: if (EAP_PWD_GET_EXCHANGE(hdr) != EAP_PWD_EXCH_COMMIT) { REDEBUG("PWD exchange is incorrect, not commit!"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -397,7 +397,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) */ if (process_peer_commit(request, session, in, in_len, inst->bnctx)) { REDEBUG("Failed processing peer's commit"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* @@ -405,7 +405,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) */ if (compute_server_confirm(request, session, session->my_confirm, inst->bnctx)) { REDEBUG("Failed computing confirm"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* @@ -424,24 +424,24 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) case PWD_STATE_CONFIRM: if (in_len < SHA256_DIGEST_LENGTH) { REDEBUG("Peer confirm is too short (%zd < %d)", in_len, SHA256_DIGEST_LENGTH); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } if (EAP_PWD_GET_EXCHANGE(hdr) != EAP_PWD_EXCH_CONFIRM) { REDEBUG("PWD exchange is incorrect, not commit"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } if (compute_peer_confirm(request, session, peer_confirm, inst->bnctx)) { REDEBUG("Cannot compute peer's confirm"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } if (CRYPTO_memcmp(peer_confirm, in, SHA256_DIGEST_LENGTH)) { REDEBUG("PWD exchange failed, peer confirm is incorrect"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } if (compute_keys(request, session, peer_confirm, msk, emsk)) { REDEBUG("Failed generating (E)MSK"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } eap_round->request->code = FR_EAP_CODE_SUCCESS; @@ -456,7 +456,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) default: REDEBUG("Unknown PWD state"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* @@ -467,7 +467,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) session->in = NULL; } - return rcode; + RETURN_MODULE_RCODE(rcode); } static int _free_pwd_session(pwd_session_t *session) @@ -486,7 +486,7 @@ static int _free_pwd_session(pwd_session_t *session) return 0; } -static rlm_rcode_t mod_session_init(module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_session_init(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_eap_pwd_t *inst = talloc_get_type_abort(mctx->instance, rlm_eap_pwd_t); eap_session_t *eap_session = eap_session_get(request->parent); @@ -537,11 +537,11 @@ static rlm_rcode_t mod_session_init(module_ctx_t const *mctx, request_t *request packet->prep = EAP_PWD_PREP_NONE; memcpy(packet->identity, inst->server_id, session->out_len - sizeof(pwd_id_packet_t) ); - if (send_pwd_request(request, session, eap_session->this_round) < 0) return RLM_MODULE_FAIL; + if (send_pwd_request(request, session, eap_session->this_round) < 0) RETURN_MODULE_FAIL; eap_session->process = mod_process; - return RLM_MODULE_HANDLED; + RETURN_MODULE_HANDLED; } static int mod_detach(void *arg) diff --git a/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c b/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c index d13117861fe..be0cb8e36c8 100644 --- a/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c +++ b/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c @@ -71,13 +71,13 @@ fr_dict_attr_autoload_t rlm_eap_tls_dict_attr[] = { /* * Do authentication, by letting EAP-TLS do most of the work. */ -static rlm_rcode_t CC_HINT(nonnull) mod_process(module_ctx_t const *mctx, request_t *request); +static unlang_action_t CC_HINT(nonnull) mod_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request); -static rlm_rcode_t eap_tls_success_with_prf(request_t *request, eap_session_t *eap_session) +static unlang_action_t eap_tls_success_with_prf(rlm_rcode_t *p_result, request_t *request, eap_session_t *eap_session) { #if OPENSSL_VERSION_NUMBER >= 0x10101000L eap_tls_session_t *eap_tls_session = talloc_get_type_abort(eap_session->opaque, eap_tls_session_t); - fr_tls_session_t *tls_session = eap_tls_session->tls_session; + fr_tls_session_t *tls_session = eap_tls_session->tls_session; /* * Set the PRF label based on the TLS version negotiated @@ -87,7 +87,7 @@ static rlm_rcode_t eap_tls_success_with_prf(request_t *request, eap_session_t *e case SSL2_VERSION: /* Should never happen */ case SSL3_VERSION: /* Should never happen */ fr_assert(0); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; case TLS1_VERSION: case TLS1_1_VERSION: @@ -98,7 +98,7 @@ static rlm_rcode_t eap_tls_success_with_prf(request_t *request, eap_session_t *e if (eap_tls_success(request, eap_session, keying_prf_label, sizeof(keying_prf_label) - 1, - NULL, 0) < 0) return RLM_MODULE_FAIL; + NULL, 0) < 0) RETURN_MODULE_FAIL; } #if OPENSSL_VERSION_NUMBER >= 0x10101000L break; @@ -111,12 +111,12 @@ static rlm_rcode_t eap_tls_success_with_prf(request_t *request, eap_session_t *e if (eap_tls_success(request, eap_session, keying_prf_label, sizeof(keying_prf_label) - 1, - sessid_prf_label, sizeof(sessid_prf_label) - 1) < 0) return RLM_MODULE_FAIL; + sessid_prf_label, sizeof(sessid_prf_label) - 1) < 0) RETURN_MODULE_FAIL; } break; } #endif - return RLM_MODULE_OK; + RETURN_MODULE_OK; } static unlang_action_t eap_tls_virtual_server_result(rlm_rcode_t *p_result, UNUSED int *priority, @@ -127,20 +127,17 @@ static unlang_action_t eap_tls_virtual_server_result(rlm_rcode_t *p_result, UNUS switch (*p_result) { case RLM_MODULE_OK: case RLM_MODULE_UPDATED: - *p_result = eap_tls_success_with_prf(request, eap_session); - break; + return eap_tls_success_with_prf(p_result, request, eap_session); default: REDEBUG2("Certificate rejected by the virtual server"); eap_tls_fail(request, eap_session); - *p_result = RLM_MODULE_REJECT; - break; + RETURN_MODULE_REJECT; } - - return UNLANG_ACTION_CALCULATE_RESULT; } -static rlm_rcode_t eap_tls_virtual_server(rlm_eap_tls_t *inst, request_t *request, eap_session_t *eap_session) +static unlang_action_t eap_tls_virtual_server(rlm_rcode_t *p_result, rlm_eap_tls_t *inst, request_t *request, + eap_session_t *eap_session) { CONF_SECTION *server_cs; CONF_SECTION *section; @@ -154,7 +151,7 @@ static rlm_rcode_t eap_tls_virtual_server(rlm_eap_tls_t *inst, request_t *reques REDEBUG2("Virtual server \"%pV\" not found", &vp->data); error: eap_tls_fail(request, eap_session); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } } else { server_cs = virtual_server_find(inst->virtual_server); @@ -180,20 +177,22 @@ static rlm_rcode_t eap_tls_virtual_server(rlm_eap_tls_t *inst, request_t *reques * Catch the interpreter on the way back up the stack */ if (unlang_interpret_push_function(request, NULL, eap_tls_virtual_server_result, eap_session) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* * Push unlang instructions for the virtual server section */ if (unlang_interpret_push_section(request, section, RLM_MODULE_NOOP, UNLANG_SUB_FRAME) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } - return RLM_MODULE_YIELD; + *p_result = RLM_MODULE_YIELD; + + return UNLANG_ACTION_YIELD; } -static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_eap_tls_t *inst = talloc_get_type_abort(mctx->instance, rlm_eap_tls_t); eap_tls_status_t status; @@ -218,8 +217,8 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) * it accepts the certificates, too. */ case EAP_TLS_ESTABLISHED: - if (inst->virtual_server) return eap_tls_virtual_server(inst, request, eap_session); - return eap_tls_success_with_prf(request, eap_session); + if (inst->virtual_server) return eap_tls_virtual_server(p_result, inst, request, eap_session); + return eap_tls_success_with_prf(p_result, request, eap_session); /* @@ -228,7 +227,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) * do nothing. */ case EAP_TLS_HANDLED: - return RLM_MODULE_HANDLED; + RETURN_MODULE_HANDLED; /* * Handshake is done, proceed with decoding tunneled @@ -238,7 +237,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) REDEBUG("Received unexpected tunneled data after successful handshake"); eap_tls_fail(request, eap_session); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; /* * Anything else: fail. @@ -249,14 +248,14 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) default: fr_tls_cache_deny(tls_session); - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; } } /* * Send an initial eap-tls request to the peer, using the libeap functions. */ -static rlm_rcode_t mod_session_init(module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_session_init(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_eap_tls_t *inst = talloc_get_type_abort(mctx->instance, rlm_eap_tls_t); eap_session_t *eap_session = eap_session_get(request->parent); @@ -282,7 +281,7 @@ static rlm_rcode_t mod_session_init(module_ctx_t const *mctx, request_t *request * EAP-TLS always requires a client certificate. */ eap_session->opaque = eap_tls_session = eap_tls_session_init(request, eap_session, inst->tls_conf, client_cert); - if (!eap_tls_session) return RLM_MODULE_FAIL; + if (!eap_tls_session) RETURN_MODULE_FAIL; eap_tls_session->include_length = inst->include_length; @@ -292,12 +291,12 @@ static rlm_rcode_t mod_session_init(module_ctx_t const *mctx, request_t *request */ if (eap_tls_start(request, eap_session) < 0) { talloc_free(eap_tls_session); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } eap_session->process = mod_process; - return RLM_MODULE_HANDLED; + RETURN_MODULE_HANDLED; } /* diff --git a/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c b/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c index 93506cac5fa..b95a897816d 100644 --- a/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c +++ b/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c @@ -129,7 +129,7 @@ static ttls_tunnel_t *ttls_alloc(TALLOC_CTX *ctx, rlm_eap_ttls_t *inst) /* * Do authentication, by letting EAP-TLS do most of the work. */ -static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_eap_ttls_t *inst = talloc_get_type_abort(mctx->instance, rlm_eap_ttls_t); @@ -177,12 +177,12 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) */ if (eap_tls_success(request, eap_session, keying_prf_label, sizeof(keying_prf_label) - 1, - NULL, 0) < 0) return RLM_MODULE_FAIL; - return RLM_MODULE_OK; + NULL, 0) < 0) RETURN_MODULE_FAIL; + RETURN_MODULE_OK; } else { eap_tls_request(request, eap_session); } - return RLM_MODULE_OK; + RETURN_MODULE_OK; /* * The TLS code is still working on the TLS @@ -190,7 +190,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) * do nothing. */ case EAP_TLS_HANDLED: - return RLM_MODULE_HANDLED; + RETURN_MODULE_HANDLED; /* * Handshake is done, proceed with decoding tunneled @@ -203,7 +203,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) * Anything else: fail. */ default: - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* @@ -224,14 +224,14 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) switch (eap_ttls_process(request, eap_session, tls_session)) { case FR_CODE_ACCESS_REJECT: eap_tls_fail(request, eap_session); - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; /* * Access-Challenge, continue tunneled conversation. */ case FR_CODE_ACCESS_CHALLENGE: eap_tls_request(request, eap_session); - return RLM_MODULE_OK; + RETURN_MODULE_OK; /* * Success: Automatically return MPPE keys. @@ -246,7 +246,7 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) * will proxy it, rather than returning an EAP packet. */ case FR_CODE_STATUS_CLIENT: - return RLM_MODULE_OK; + RETURN_MODULE_OK; default: break; @@ -256,13 +256,13 @@ static rlm_rcode_t mod_process(module_ctx_t const *mctx, request_t *request) * Something we don't understand: Reject it. */ eap_tls_fail(request, eap_session); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* * Send an initial eap-tls request to the peer, using the libeap functions. */ -static rlm_rcode_t mod_session_init(module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_session_init(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_eap_ttls_t *inst = talloc_get_type_abort(mctx->instance, rlm_eap_ttls_t); eap_session_t *eap_session = eap_session_get(request->parent); @@ -285,7 +285,7 @@ static rlm_rcode_t mod_session_init(module_ctx_t const *mctx, request_t *request } eap_session->opaque = eap_tls_session = eap_tls_session_init(request, eap_session, inst->tls_conf, client_cert); - if (!eap_tls_session) return RLM_MODULE_FAIL; + if (!eap_tls_session) RETURN_MODULE_FAIL; /* * TLS session initialization is over. Now handle TLS @@ -293,12 +293,12 @@ static rlm_rcode_t mod_session_init(module_ctx_t const *mctx, request_t *request */ if (eap_tls_start(request, eap_session) < 0) { talloc_free(eap_tls_session); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } eap_session->process = mod_process; - return RLM_MODULE_OK; + RETURN_MODULE_OK; } /* diff --git a/src/modules/rlm_exec/rlm_exec.c b/src/modules/rlm_exec/rlm_exec.c index 1f2ea33bc02..5d43115b441 100644 --- a/src/modules/rlm_exec/rlm_exec.c +++ b/src/modules/rlm_exec/rlm_exec.c @@ -255,7 +255,8 @@ static int mod_instantiate(void *instance, CONF_SECTION *conf) /** Resume a request after xlat expansion. * */ -static rlm_rcode_t mod_exec_nowait_resume(module_ctx_t const *mctx, request_t *request, void *rctx) +static unlang_action_t mod_exec_nowait_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, + request_t *request, void *rctx) { rlm_exec_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_exec_t); fr_value_box_t *box = talloc_get_type_abort(rctx, fr_value_box_t); @@ -269,7 +270,7 @@ static rlm_rcode_t mod_exec_nowait_resume(module_ctx_t const *mctx, request_t *r input_pairs = radius_list(request, inst->input_list); if (!input_pairs) { - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } env_pairs = *input_pairs; @@ -277,10 +278,10 @@ static rlm_rcode_t mod_exec_nowait_resume(module_ctx_t const *mctx, request_t *r if (fr_exec_nowait(request, box, env_pairs) < 0) { RPEDEBUG("Failed executing program"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } typedef struct { @@ -313,9 +314,7 @@ static rlm_rcode_t rlm_exec_status2rcode(request_t *request, fr_value_box_t *box { rlm_rcode_t rcode; - if (status < 0) { - return RLM_MODULE_FAIL; - } + if (status < 0) return RLM_MODULE_FAIL; /* * Exec'd programs are meant to return exit statuses that correspond @@ -348,7 +347,8 @@ static rlm_rcode_t rlm_exec_status2rcode(request_t *request, fr_value_box_t *box return rcode; } -static rlm_rcode_t mod_exec_wait_resume(module_ctx_t const *mctx, request_t *request, void *rctx) +static unlang_action_t mod_exec_wait_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, + request_t *request, void *rctx) { int status; rlm_exec_ctx_t *m = talloc_get_type_abort(rctx, rlm_exec_ctx_t); @@ -375,20 +375,20 @@ static rlm_rcode_t mod_exec_wait_resume(module_ctx_t const *mctx, request_t *req if (status < 0) { REDEBUG("Program exited with signal %d", -status); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* * The status rcodes aren't quite the same as the rcode * enumeration. */ - return rlm_exec_status2rcode(request, m->box, status); + RETURN_MODULE_RCODE(rlm_exec_status2rcode(request, m->box, status)); } /* * Dispatch an async exec method */ -static rlm_rcode_t CC_HINT(nonnull) mod_exec_dispatch(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_exec_dispatch(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_exec_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_exec_t); rlm_exec_ctx_t *m; @@ -397,7 +397,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_exec_dispatch(module_ctx_t const *mctx, if (!inst->tmpl) { RDEBUG("This module requires 'program' to be set."); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* @@ -423,14 +423,14 @@ static rlm_rcode_t CC_HINT(nonnull) mod_exec_dispatch(module_ctx_t const *mctx, fr_pair_t **input_pairs; input_pairs = radius_list(request, inst->input_list); - if (!input_pairs) return RLM_MODULE_INVALID; + if (!input_pairs) RETURN_MODULE_INVALID; env_pairs = *input_pairs; } if (inst->output) { if (!radius_list(request, inst->output_list)) { - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } } diff --git a/src/modules/rlm_expiration/rlm_expiration.c b/src/modules/rlm_expiration/rlm_expiration.c index 6f1407e7aed..19f61bfc8b9 100644 --- a/src/modules/rlm_expiration/rlm_expiration.c +++ b/src/modules/rlm_expiration/rlm_expiration.c @@ -55,7 +55,7 @@ fr_dict_attr_autoload_t rlm_expiration_dict_attr[] = { /* * Check if account has expired, and if user may login now. */ -static rlm_rcode_t CC_HINT(nonnull) mod_authorize(UNUSED module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request) { fr_pair_t *vp, *check_item = NULL; @@ -73,7 +73,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(UNUSED module_ctx_t const *mct if (check_item->vp_date <= fr_time_to_unix_time(request->packet->timestamp)) { REDEBUG("Account expired at '%pV'", &check_item->data); - return RLM_MODULE_DISALLOW; + RETURN_MODULE_DISALLOW; } RDEBUG2("Account will expire at '%pV'", &check_item->data); @@ -101,10 +101,10 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(UNUSED module_ctx_t const *mct MEM(NULL); } } else { - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } /* diff --git a/src/modules/rlm_files/rlm_files.c b/src/modules/rlm_files/rlm_files.c index 03d62d958c1..e9efb9d3518 100644 --- a/src/modules/rlm_files/rlm_files.c +++ b/src/modules/rlm_files/rlm_files.c @@ -291,23 +291,25 @@ static int mod_instantiate(void *instance, UNUSED CONF_SECTION *conf) /* * Common code called by everything below. */ -static rlm_rcode_t file_common(rlm_files_t const *inst, request_t *request, char const *filename, rbtree_t *tree, - fr_radius_packet_t *packet, fr_radius_packet_t *reply) +static unlang_action_t file_common(rlm_rcode_t *p_result, rlm_files_t const *inst, + request_t *request, char const *filename, rbtree_t *tree, + fr_radius_packet_t *packet, fr_radius_packet_t *reply) { - char const *name; - fr_pair_t *check_tmp = NULL; - fr_pair_t *reply_tmp = NULL; - PAIR_LIST const *user_pl, *default_pl; - bool found = false; - PAIR_LIST my_pl; - char buffer[256]; + char const *name; + fr_pair_t *check_tmp = NULL; + fr_pair_t *reply_tmp = NULL; + PAIR_LIST const *user_pl, *default_pl; + bool found = false; + PAIR_LIST my_pl; + char buffer[256]; + if (tmpl_expand(&name, buffer, sizeof(buffer), request, inst->key, NULL, NULL) < 0) { REDEBUG("Failed expanding key %s", inst->key->name); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } - if (!tree) return RLM_MODULE_NOOP; + if (!tree) RETURN_MODULE_NOOP; my_pl.name = name; user_pl = rbtree_finddata(tree, &my_pl); @@ -387,9 +389,9 @@ static rlm_rcode_t file_common(rlm_files_t const *inst, request_t *request, char * See if we succeeded. */ if (!found) - return RLM_MODULE_NOOP; /* on to the next module */ + RETURN_MODULE_NOOP; /* on to the next module */ - return RLM_MODULE_OK; + RETURN_MODULE_OK; } @@ -400,11 +402,11 @@ static rlm_rcode_t file_common(rlm_files_t const *inst, request_t *request, char * for this user from the database. The main code only * needs to check the password, the rest is done here. */ -static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_files_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_files_t); - return file_common(inst, request, inst->filename, + return file_common(p_result, inst, request, inst->filename, inst->users ? inst->users : inst->common, request->packet, request->reply); } @@ -415,29 +417,29 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, requ * config. Reply items are Not Recommended(TM) in acct_users, * except for Fallthrough, which should work */ -static rlm_rcode_t CC_HINT(nonnull) mod_preacct(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_preacct(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_files_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_files_t); - return file_common(inst, request, inst->acct_usersfile, + return file_common(p_result, inst, request, inst->acct_usersfile, inst->acct_users ? inst->acct_users : inst->common, request->packet, request->reply); } -static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_files_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_files_t); - return file_common(inst, request, inst->auth_usersfile, + return file_common(p_result, inst, request, inst->auth_usersfile, inst->auth_users ? inst->auth_users : inst->common, request->packet, request->reply); } -static rlm_rcode_t CC_HINT(nonnull) mod_post_auth(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_post_auth(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_files_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_files_t); - return file_common(inst, request, inst->postauth_usersfile, + return file_common(p_result, inst, request, inst->postauth_usersfile, inst->postauth_users ? inst->postauth_users : inst->common, request->packet, request->reply); } diff --git a/src/modules/rlm_imap/rlm_imap.c b/src/modules/rlm_imap/rlm_imap.c index 879c08bb6ad..ffdcf657f96 100644 --- a/src/modules/rlm_imap/rlm_imap.c +++ b/src/modules/rlm_imap/rlm_imap.c @@ -72,7 +72,8 @@ static const CONF_PARSER module_config[] = { * It checks if the response was CURLE_OK * If it wasn't we returns REJECT, if it was we returns OK */ -static rlm_rcode_t CC_HINT(nonnull) mod_authenticate_resume(module_ctx_t const *mctx, request_t *request, void *rctx) +static unlang_action_t CC_HINT(nonnull) mod_authenticate_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, + request_t *request, void *rctx) { rlm_imap_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_imap_t); fr_curl_io_request_t *randle = rctx; @@ -91,13 +92,13 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate_resume(module_ctx_t const * if (randle->result != CURLE_OK) { talloc_free(randle); - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; } if (tls->extract_cert_attrs) fr_curl_response_certinfo(request, randle); talloc_free(randle); - return RLM_MODULE_OK; + RETURN_MODULE_OK; } /* @@ -111,7 +112,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate_resume(module_ctx_t const * * Then it queues the request and yeilds until a response is given * When it responds, mod_authenticate_resume is called. */ -static rlm_rcode_t CC_HINT(nonnull(1,2)) mod_authenticate(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull(1,2)) mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_imap_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_imap_t); rlm_imap_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_imap_thread_t); @@ -123,7 +124,7 @@ static rlm_rcode_t CC_HINT(nonnull(1,2)) mod_authenticate(module_ctx_t const *mc randle = fr_curl_io_request_alloc(request); if (!randle){ error: - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } username = fr_pair_find_by_da(&request->request_pairs, attr_user_name); @@ -131,17 +132,17 @@ static rlm_rcode_t CC_HINT(nonnull(1,2)) mod_authenticate(module_ctx_t const *mc if (!username) { REDEBUG("Attribute \"User-Name\" is required for authentication"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } if (!password) { RDEBUG2("Attribute \"User-Password\" is required for authentication"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } if (password->vp_length == 0) { RDEBUG2("\"User-Password\" must not be empty"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } FR_CURL_REQUEST_SET_OPTION(CURLOPT_USERNAME, username->vp_strvalue); @@ -154,9 +155,9 @@ static rlm_rcode_t CC_HINT(nonnull(1,2)) mod_authenticate(module_ctx_t const *mc FR_CURL_REQUEST_SET_OPTION(CURLOPT_VERBOSE, 1L); - if (fr_curl_easy_tls_init(randle, &inst->tls) != 0) return RLM_MODULE_INVALID; + if (fr_curl_easy_tls_init(randle, &inst->tls) != 0) RETURN_MODULE_INVALID; - if (fr_curl_io_request_enqueue(t->mhandle, request, randle)) return RLM_MODULE_INVALID; + if (fr_curl_io_request_enqueue(t->mhandle, request, randle)) RETURN_MODULE_INVALID; return unlang_module_yield(request, mod_authenticate_resume, NULL, randle); } diff --git a/src/modules/rlm_isc_dhcp/rlm_isc_dhcp.c b/src/modules/rlm_isc_dhcp/rlm_isc_dhcp.c index ec22671d7cd..57e69d31bcb 100644 --- a/src/modules/rlm_isc_dhcp/rlm_isc_dhcp.c +++ b/src/modules/rlm_isc_dhcp/rlm_isc_dhcp.c @@ -269,12 +269,12 @@ static int skip_spaces(rlm_isc_dhcp_tokenizer_t *state, char *p) * takes care of skipping leading spaces, too. */ if (!state->eof && !*state->ptr) { - int rcode; + int ret; state->ptr = start; - rcode = refill(state); - if (rcode < 0) return -1; + ret = refill(state); + if (ret < 0) return -1; } /* @@ -348,12 +348,12 @@ redo: * If the buffer is empty, re-fill it. */ if (!*state->ptr) { - int rcode; + int ret; - rcode = refill(state); - if (rcode < 0) return rcode; + ret = refill(state); + if (ret < 0) return ret; - if (rcode == 0) { + if (ret == 0) { if (!state->allow_eof) { fr_strerror_printf("Unexpected EOF"); return -1; @@ -531,7 +531,7 @@ redo: */ static int match_subword(rlm_isc_dhcp_tokenizer_t *state, char const *cmd, rlm_isc_dhcp_info_t *info) { - int rcode, type; + int ret, type; int semicolon = NO_SEMICOLON; bool multi = false; char *p; @@ -554,8 +554,8 @@ static int match_subword(rlm_isc_dhcp_tokenizer_t *state, char const *cmd, rlm_i * Matching an in-line word. */ if (islower((int) *q)) { - rcode = read_token(state, T_BARE_WORD, semicolon, false); - if (rcode <= 0) return -1; + ret = read_token(state, T_BARE_WORD, semicolon, false); + if (ret <= 0) return -1; /* * Look for a verbatim word. @@ -600,11 +600,11 @@ static int match_subword(rlm_isc_dhcp_tokenizer_t *state, char const *cmd, rlm_i if (strcmp(q, "SECTION") == 0) { if (q[7] != '\0') return -1; /* internal error */ - rcode = read_token(state, T_LCBRACE, NO_SEMICOLON, false); - if (rcode <= 0) return rcode; + ret = read_token(state, T_LCBRACE, NO_SEMICOLON, false); + if (ret <= 0) return ret; - rcode = parse_section(state, info); - if (rcode < 0) return rcode; + ret = parse_section(state, info); + if (ret < 0) return ret; /* * Empty sections are allowed. @@ -667,8 +667,8 @@ redo_multi: * @todo - if we get fancy, dynamically expand this, too. * ISC doesn't support it, but we can. */ - rcode = read_token(state, T_DOUBLE_QUOTED_STRING, semicolon, false); - if (rcode <= 0) return rcode; + ret = read_token(state, T_DOUBLE_QUOTED_STRING, semicolon, false); + if (ret <= 0) return ret; DDEBUG("... DATA %.*s ", state->token_len, state->token); @@ -692,9 +692,9 @@ redo_multi: */ info->argv[info->argc] = talloc_zero(info, fr_value_box_t); - rcode = fr_value_box_from_str(info, info->argv[info->argc], (fr_type_t *) &type, NULL, + ret = fr_value_box_from_str(info, info->argv[info->argc], (fr_type_t *) &type, NULL, state->token, state->token_len, 0, false); - if (rcode < 0) return rcode; + if (ret < 0) return ret; info->argc++; @@ -726,7 +726,7 @@ redo_multi: */ static int parse_include(rlm_isc_dhcp_tokenizer_t *state, rlm_isc_dhcp_info_t *info) { - int rcode; + int ret; char *p, pathname[8192]; char const *name = info->argv[0]->vb_strvalue; @@ -745,8 +745,8 @@ static int parse_include(rlm_isc_dhcp_tokenizer_t *state, rlm_isc_dhcp_info_t *i * Note that we read the included file into the PARENT's * list. i.e. as if the file was included in-place. */ - rcode = read_file(state->inst, info->parent, name); - if (rcode < 0) return rcode; + ret = read_file(state->inst, info->parent, name); + if (ret < 0) return ret; /* * Even if the file was empty, we return "1" to indicate @@ -851,7 +851,7 @@ static fr_type_t isc2fr_type(rlm_isc_dhcp_tokenizer_t *state) static int parse_option_definition(rlm_isc_dhcp_info_t *parent, rlm_isc_dhcp_tokenizer_t *state, char *name) { - int rcode; + int ret; char *p; fr_type_t type; fr_dict_attr_t const *da, *root; @@ -874,23 +874,23 @@ static int parse_option_definition(rlm_isc_dhcp_info_t *parent, rlm_isc_dhcp_tok /* * Grab the integer code value. */ - rcode = read_token(state, T_BARE_WORD, NO_SEMICOLON, false); - if (rcode <= 0) { - error_rcode: + ret = read_token(state, T_BARE_WORD, NO_SEMICOLON, false); + if (ret <= 0) { + error_ret: talloc_free(name); - return rcode; + return ret; } type = FR_TYPE_UINT32; - rcode = fr_value_box_from_str(NULL, &box, &type, NULL, + ret = fr_value_box_from_str(NULL, &box, &type, NULL, state->token, state->token_len, 0, false); - if (rcode < 0) goto error; + if (ret < 0) goto error; /* * Look for '=' */ - rcode = read_token(state, T_BARE_WORD, NO_SEMICOLON, false); - if (rcode <= 0) goto error_rcode; + ret = read_token(state, T_BARE_WORD, NO_SEMICOLON, false); + if (ret <= 0) goto error_ret; if ((state->token_len != 1) || (state->token[0] != '=')) { fr_strerror_printf("expected '=' after code definition got '%.*s'", state->token_len, state->token); @@ -910,15 +910,15 @@ static int parse_option_definition(rlm_isc_dhcp_info_t *parent, rlm_isc_dhcp_tok * * array of { TYPE, ... } */ - rcode = read_token(state, T_BARE_WORD, MAYBE_SEMICOLON, false); - if (rcode <= 0) goto error_rcode; + ret = read_token(state, T_BARE_WORD, MAYBE_SEMICOLON, false); + if (ret <= 0) goto error_ret; if ((state->token_len == 5) && (memcmp(state->token, "array", 5) == 0)) { flags.array = 1; - rcode = read_token(state, T_BARE_WORD, NO_SEMICOLON, false); - if (rcode <= 0) goto error_rcode; + ret = read_token(state, T_BARE_WORD, NO_SEMICOLON, false); + if (ret <= 0) goto error_ret; if (! ((state->token_len == 2) && (memcmp(state->token, "of", 2) == 0))) { fr_strerror_printf("expected 'array of', not 'array %.*s'", @@ -929,8 +929,8 @@ static int parse_option_definition(rlm_isc_dhcp_info_t *parent, rlm_isc_dhcp_tok /* * Grab the next token. For now, it MUST have a semicolon */ - rcode = read_token(state, T_BARE_WORD, YES_SEMICOLON, false); - if (rcode <= 0) goto error_rcode; + ret = read_token(state, T_BARE_WORD, YES_SEMICOLON, false); + if (ret <= 0) goto error_ret; } if ((state->token_len == 1) && (state->token[0] == '{')) { @@ -982,9 +982,9 @@ static int parse_option_definition(rlm_isc_dhcp_info_t *parent, rlm_isc_dhcp_tok * name/code checks above. But doing so allows us to * have better error messages. */ - rcode = fr_dict_attr_add(fr_dict_unconst(dict_dhcpv4), root, name, box.vb_uint32, type, &flags); + ret = fr_dict_attr_add(fr_dict_unconst(dict_dhcpv4), root, name, box.vb_uint32, type, &flags); talloc_free(name); - if (rcode < 0) return rcode; + if (ret < 0) return ret; /* * Caller doesn't need to do anything else with the thing @@ -996,7 +996,7 @@ static int parse_option_definition(rlm_isc_dhcp_info_t *parent, rlm_isc_dhcp_tok static int parse_option(rlm_isc_dhcp_info_t *parent, rlm_isc_dhcp_tokenizer_t *state, fr_dict_attr_t const *da, char *value) { - int rcode; + int ret; fr_pair_t *vp; fr_cursor_t cursor; @@ -1015,10 +1015,10 @@ static int parse_option(rlm_isc_dhcp_info_t *parent, rlm_isc_dhcp_tokenizer_t *s /* * Add in the first value. */ - rcode = fr_pair_value_from_str(vp, value, talloc_array_length(value) - 1, '\0', false); - if (rcode < 0) { + ret = fr_pair_value_from_str(vp, value, talloc_array_length(value) - 1, '\0', false); + if (ret < 0) { talloc_free(value); - return rcode; + return ret; } vp->op = T_OP_EQ; @@ -1040,13 +1040,13 @@ static int parse_option(rlm_isc_dhcp_info_t *parent, rlm_isc_dhcp_tokenizer_t *s * For "array" types, loop through the remaining tokens. */ while (!state->saw_semicolon) { - rcode = read_token(state, T_DOUBLE_QUOTED_STRING, MAYBE_SEMICOLON, false); - if (rcode <= 0) return rcode; + ret = read_token(state, T_DOUBLE_QUOTED_STRING, MAYBE_SEMICOLON, false); + if (ret <= 0) return ret; MEM(vp = fr_pair_afrom_da(parent, da)); - rcode = fr_pair_value_from_str(vp, state->token, state->token_len, '\0', false); - if (rcode < 0) return rcode; + ret = fr_pair_value_from_str(vp, state->token, state->token_len, '\0', false); + if (ret < 0) return ret; vp->op = T_OP_EQ; @@ -1077,7 +1077,7 @@ static int parse_option(rlm_isc_dhcp_info_t *parent, rlm_isc_dhcp_tokenizer_t *s */ static int parse_options(rlm_isc_dhcp_info_t *parent, rlm_isc_dhcp_tokenizer_t *state) { - int rcode, argc = 0; + int ret, argc = 0; char *argv[2]; char name[FR_DICT_ATTR_MAX_NAME_LEN + 5]; @@ -1085,8 +1085,8 @@ static int parse_options(rlm_isc_dhcp_info_t *parent, rlm_isc_dhcp_tokenizer_t * * Since read_token() mashes the input buffer, we have to save the tokens somewhere. */ while (!state->saw_semicolon) { - rcode = read_token(state, T_BARE_WORD, MAYBE_SEMICOLON, false); - if (rcode < 0) return rcode; + ret = read_token(state, T_BARE_WORD, MAYBE_SEMICOLON, false); + if (ret < 0) return ret; argv[argc++] = talloc_strndup(parent, state->token, state->token_len); @@ -1158,7 +1158,7 @@ static int match_keyword(rlm_isc_dhcp_info_t *parent, rlm_isc_dhcp_tokenizer_t * { int start, end, half; int semicolon; - int rcode; + int ret; char const *q = NULL; rlm_isc_dhcp_info_t *info; @@ -1183,25 +1183,25 @@ static int match_keyword(rlm_isc_dhcp_info_t *parent, rlm_isc_dhcp_tokenizer_t * * of the situations. Since there are no 1 or 2 * character keywords, this always works. */ - rcode = state->token[0] - tokens[half].name[0]; - if (rcode != 0) goto recurse; + ret = state->token[0] - tokens[half].name[0]; + if (ret != 0) goto recurse; - rcode = state->token[1] - tokens[half].name[1]; - if (rcode != 0) goto recurse; + ret = state->token[1] - tokens[half].name[1]; + if (ret != 0) goto recurse; - rcode = state->token[2] - tokens[half].name[2]; - if (rcode != 0) goto recurse; + ret = state->token[2] - tokens[half].name[2]; + if (ret != 0) goto recurse; /* * Compare all of the strings. */ - rcode = strncmp(state->token, tokens[half].name, state->token_len); + ret = strncmp(state->token, tokens[half].name, state->token_len); /* * Exact match. But maybe we have "foo" input, * and "food" command? */ - if (rcode == 0) { + if (ret == 0) { char c = tokens[half].name[state->token_len]; /* @@ -1217,7 +1217,7 @@ static int match_keyword(rlm_isc_dhcp_info_t *parent, rlm_isc_dhcp_tokenizer_t * * "food". Go search the lower half of * the command table. */ - rcode = -1; + ret = -1; } recurse: @@ -1225,7 +1225,7 @@ static int match_keyword(rlm_isc_dhcp_info_t *parent, rlm_isc_dhcp_tokenizer_t * * Token is smaller than the command we checked, * go check the lower half of the table. */ - if (rcode < 0) { + if (ret < 0) { end = half - 1; } else { start = half + 1; @@ -1302,13 +1302,13 @@ static int match_keyword(rlm_isc_dhcp_info_t *parent, rlm_isc_dhcp_tokenizer_t * if (isspace((int) *q)) { if (state->saw_semicolon) goto unexpected; - rcode = match_subword(state, q, info); - if (rcode <= 0) return rcode; + ret = match_subword(state, q, info); + if (ret <= 0) return ret; /* * SUBSECTION must be at the end */ - if (rcode == 2) semicolon = NO_SEMICOLON; + if (ret == 2) semicolon = NO_SEMICOLON; } /* @@ -1334,10 +1334,10 @@ static int match_keyword(rlm_isc_dhcp_info_t *parent, rlm_isc_dhcp_tokenizer_t * * validation, etc. */ if (tokens[half].parse) { - rcode = tokens[half].parse(state, info); - if (rcode <= 0) { + ret = tokens[half].parse(state, info); + if (ret <= 0) { talloc_free(info); - return rcode; + return ret; } /* @@ -1355,7 +1355,7 @@ static int match_keyword(rlm_isc_dhcp_info_t *parent, rlm_isc_dhcp_tokenizer_t * * tiny list, which makes the O(N) * processing of it fairly minor. */ - if (rcode == 2) return 1; + if (ret == 2) return 1; } /* @@ -1532,7 +1532,7 @@ static int parse_host(rlm_isc_dhcp_tokenizer_t *state, rlm_isc_dhcp_info_t *info static int parse_subnet(rlm_isc_dhcp_tokenizer_t *state, rlm_isc_dhcp_info_t *info) { rlm_isc_dhcp_info_t *parent; - int rcode, bits; + int ret, bits; uint32_t netmask = info->argv[1]->vb_ipv4addr; /* @@ -1586,8 +1586,8 @@ static int parse_subnet(rlm_isc_dhcp_tokenizer_t *state, rlm_isc_dhcp_info_t *in * "subnet" entries in the parent->child list. */ - rcode = fr_trie_insert(parent->subnets, &(info->argv[0]->vb_ipv4addr), bits, info); - if (rcode < 0) { + ret = fr_trie_insert(parent->subnets, &(info->argv[0]->vb_ipv4addr), bits, info); + if (ret < 0) { fr_strerror_printf("Failed inserting 'subnet %pV netmask %pV' into trie", info->argv[0], info->argv[1]); return -1; @@ -1659,7 +1659,7 @@ done: static int add_option_by_da(rlm_isc_dhcp_info_t *info, fr_dict_attr_t const *da) { - int rcode; + int ret; fr_pair_t *vp; fr_cursor_t cursor; @@ -1667,8 +1667,8 @@ static int add_option_by_da(rlm_isc_dhcp_info_t *info, fr_dict_attr_t const *da) MEM(vp = fr_pair_afrom_da(info->parent, da)); - rcode = fr_value_box_copy(vp, &(vp->data), info->argv[0]); - if (rcode < 0) return rcode; + ret = fr_value_box_copy(vp, &(vp->data), info->argv[0]); + if (ret < 0) return ret; (void) fr_cursor_init(&cursor, &info->parent->options); (void) fr_cursor_tail(&cursor); @@ -1750,7 +1750,7 @@ static int parse_next_server(UNUSED rlm_isc_dhcp_tokenizer_t *state, rlm_isc_dhc */ static int apply_fixed_ip(rlm_isc_dhcp_t const *inst, request_t *request) { - int rcode; + int ret; rlm_isc_dhcp_info_t *host, *info; fr_pair_t *vp; fr_pair_t *yiaddr; @@ -1781,8 +1781,8 @@ static int apply_fixed_ip(rlm_isc_dhcp_t const *inst, request_t *request) MEM(vp = fr_pair_afrom_da(request->reply_pairs, attr_your_ip_address)); - rcode = fr_value_box_copy(vp, &(vp->data), info->argv[0]); - if (rcode < 0) return rcode; + ret = fr_value_box_copy(vp, &(vp->data), info->argv[0]); + if (ret < 0) return ret; /* * I miss pair_add() @@ -1807,11 +1807,11 @@ static int apply_fixed_ip(rlm_isc_dhcp_t const *inst, request_t *request) */ static int apply(rlm_isc_dhcp_t const *inst, request_t *request, rlm_isc_dhcp_info_t *head) { - int rcode, child_rcode; + int ret, child_ret; rlm_isc_dhcp_info_t *info; fr_pair_t *yiaddr; - rcode = 0; + ret = 0; yiaddr = fr_pair_find_by_da(&request->reply_pairs, attr_your_ip_address); /* @@ -1826,9 +1826,9 @@ static int apply(rlm_isc_dhcp_t const *inst, request_t *request, rlm_isc_dhcp_in /* * Apply any options in the "host" section. */ - child_rcode = apply(inst, request, host); - if (child_rcode < 0) return child_rcode; - if (child_rcode == 1) rcode = 1; + child_ret = apply(inst, request, host); + if (child_ret < 0) return child_ret; + if (child_ret == 1) ret = 1; } subnet: @@ -1840,9 +1840,9 @@ subnet: info = fr_trie_lookup(head->subnets, &yiaddr->vp_ipv4addr, 32); if (!info) goto recurse; - child_rcode = apply(inst, request, info); - if (child_rcode < 0) return child_rcode; - if (child_rcode == 1) rcode = 1; + child_ret = apply(inst, request, info); + if (child_ret < 0) return child_ret; + if (child_ret == 1) ret = 1; } recurse: @@ -1851,11 +1851,11 @@ recurse: if (!info->cmd->apply) continue; - child_rcode = info->cmd->apply(inst, request, info); - if (child_rcode < 0) return child_rcode; - if (child_rcode == 0) continue; + child_ret = info->cmd->apply(inst, request, info); + if (child_ret < 0) return child_ret; + if (child_ret == 0) continue; - rcode = 1; + ret = 1; } /* @@ -1921,10 +1921,10 @@ recurse: /* * We applied some options. */ - rcode = 1; + ret = 1; } - return rcode; + return ret; } #define isc_not_done ISC_NOOP, NULL, NULL @@ -2063,7 +2063,7 @@ static const rlm_isc_dhcp_cmd_t commands[] = { */ static int parse_section(rlm_isc_dhcp_tokenizer_t *state, rlm_isc_dhcp_info_t *info) { - int rcode; + int ret; int entries = 0; /* @@ -2096,18 +2096,18 @@ static int parse_section(rlm_isc_dhcp_tokenizer_t *state, rlm_isc_dhcp_info_t *i state->allow_eof = false; /* can't have EOF in the middle of a section */ while (true) { - rcode = read_token(state, T_BARE_WORD, YES_SEMICOLON, true); - if (rcode < 0) return rcode; - if (rcode == 0) break; + ret = read_token(state, T_BARE_WORD, YES_SEMICOLON, true); + if (ret < 0) return ret; + if (ret == 0) break; /* * End of section is allowed here. */ if (*state->token == '}') break; - rcode = match_keyword(info, state, commands, NUM_ELEMENTS(commands)); - if (rcode < 0) return rcode; - if (rcode == 0) break; + ret = match_keyword(info, state, commands, NUM_ELEMENTS(commands)); + if (ret < 0) return ret; + if (ret == 0) break; entries = 1; } @@ -2124,7 +2124,7 @@ static int parse_section(rlm_isc_dhcp_tokenizer_t *state, rlm_isc_dhcp_info_t *i */ static int read_file(rlm_isc_dhcp_t *inst, rlm_isc_dhcp_info_t *parent, char const *filename) { - int rcode; + int ret; FILE *fp; rlm_isc_dhcp_tokenizer_t state; rlm_isc_dhcp_info_t **last = parent->last; @@ -2163,24 +2163,24 @@ static int read_file(rlm_isc_dhcp_t *inst, rlm_isc_dhcp_info_t *parent, char con *state.ptr = '\0'; while (true) { - rcode = read_token(&state, T_BARE_WORD, YES_SEMICOLON, false); - if (rcode < 0) { + ret = read_token(&state, T_BARE_WORD, YES_SEMICOLON, false); + if (ret < 0) { fail: fr_strerror_printf("Failed reading %s:[%d] - %s", filename, state.lineno, fr_strerror()); fclose(fp); - return rcode; + return ret; } - if (rcode == 0) break; + if (ret == 0) break; /* * This will automatically re-fill the buffer, * and find a matching token. */ - rcode = match_keyword(parent, &state, commands, NUM_ELEMENTS(commands)); - if (rcode < 0) goto fail; - if (rcode == 0) break; + ret = match_keyword(parent, &state, commands, NUM_ELEMENTS(commands)); + if (ret < 0) goto fail; + if (ret == 0) break; } fclose(fp); @@ -2196,7 +2196,7 @@ static int read_file(rlm_isc_dhcp_t *inst, rlm_isc_dhcp_info_t *parent, char con static int mod_instantiate(void *instance, CONF_SECTION *conf) { - int rcode; + int ret; rlm_isc_dhcp_t *inst = instance; rlm_isc_dhcp_info_t *info; @@ -2212,13 +2212,13 @@ static int mod_instantiate(void *instance, CONF_SECTION *conf) inst->hosts_by_uid = fr_hash_table_create(inst, host_uid_hash, host_uid_cmp, NULL); if (!inst->hosts_by_uid) return -1; - rcode = read_file(inst, info, inst->filename); - if (rcode < 0) { + ret = read_file(inst, info, inst->filename); + if (ret < 0) { cf_log_err(conf, "%s", fr_strerror()); return -1; } - if (rcode == 0) { + if (ret == 0) { cf_log_warn(conf, "No configuration read from %s", inst->filename); return 0; } @@ -2226,32 +2226,32 @@ static int mod_instantiate(void *instance, CONF_SECTION *conf) return 0; } -static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_isc_dhcp_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_isc_dhcp_t); - int rcode; + int ret; - rcode = apply_fixed_ip(inst, request); - if (rcode < 0) return RLM_MODULE_FAIL; - if (rcode == 0) return RLM_MODULE_NOOP; + ret = apply_fixed_ip(inst, request); + if (ret < 0) RETURN_MODULE_FAIL; + if (ret == 0) RETURN_MODULE_NOOP; - if (rcode == 2) return RLM_MODULE_UPDATED; + if (ret == 2) RETURN_MODULE_UPDATED; - return RLM_MODULE_OK; + RETURN_MODULE_OK; } -static rlm_rcode_t CC_HINT(nonnull) mod_post_auth(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_post_auth(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_isc_dhcp_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_isc_dhcp_t); - int rcode; + int ret; - rcode = apply(inst, request, inst->head); - if (rcode < 0) return RLM_MODULE_FAIL; - if (rcode == 0) return RLM_MODULE_NOOP; + ret = apply(inst, request, inst->head); + if (ret < 0) RETURN_MODULE_FAIL; + if (ret == 0) RETURN_MODULE_NOOP; // @todo - check for subnet mask option. If none exists, use one from the enclosing network? - return RLM_MODULE_OK; + RETURN_MODULE_OK; } extern module_t rlm_isc_dhcp; diff --git a/src/modules/rlm_krb5/rlm_krb5.c b/src/modules/rlm_krb5/rlm_krb5.c index 8bb93880d2e..7464a1a810c 100644 --- a/src/modules/rlm_krb5/rlm_krb5.c +++ b/src/modules/rlm_krb5/rlm_krb5.c @@ -257,7 +257,7 @@ static rlm_rcode_t krb5_parse_user(krb5_principal *client, KRB5_UNUSED rlm_krb5_ */ if (!username) { REDEBUG("Attribute \"User-Name\" is required for authentication"); - return RLM_MODULE_INVALID; + return RLM_MODULE_FAIL; } ret = krb5_parse_name(context, username->vp_strvalue, client); @@ -290,7 +290,7 @@ static rlm_rcode_t krb5_process_error(rlm_krb5_t const *inst, request_t *request fr_assert(ret != 0); if (!fr_cond_assert(inst)) return RLM_MODULE_FAIL; - if (!fr_cond_assert(conn)) return RLM_MODULE_FAIL; /* Silences warnings */ + if (!fr_cond_assert(conn)) return RLM_MODULE_FAIL;; /* Silences warnings */ switch (ret) { case KRB5_LIBOS_BADPWDMATCH: @@ -319,7 +319,7 @@ static rlm_rcode_t krb5_process_error(rlm_krb5_t const *inst, request_t *request /* * Validate user/pass (Heimdal) */ -static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_krb5_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_krb5_t); rlm_rcode_t rcode; @@ -332,7 +332,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r if (!password) { REDEBUG("Attribute \"User-Password\" is required for authentication"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -340,7 +340,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r */ if (password->vp_length == 0) { REDEBUG("User-Password must not be empty"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -354,7 +354,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r # ifdef KRB5_IS_THREAD_SAFE conn = fr_pool_connection_get(inst->pool, request); - if (!conn) return RLM_MODULE_FAIL; + if (!conn) RETURN_MODULE_FAIL; # else conn = inst->conn; # endif @@ -402,7 +402,7 @@ cleanup: # ifdef KRB5_IS_THREAD_SAFE fr_pool_connection_release(inst->pool, request, conn); # endif - return rcode; + RETURN_MODULE_RCODE(rcode); } #else /* HEIMDAL_KRB5 */ @@ -410,7 +410,7 @@ cleanup: /* * Validate userid/passwd (MIT) */ -static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_krb5_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_krb5_t); rlm_rcode_t rcode; @@ -427,7 +427,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r if (!password) { REDEBUG("Attribute \"User-Password\" is required for authentication"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -435,7 +435,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r */ if (password->vp_length == 0) { REDEBUG("User-Password must not be empty"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -449,7 +449,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r # ifdef KRB5_IS_THREAD_SAFE conn = fr_pool_connection_get(inst->pool, request); - if (!conn) return RLM_MODULE_FAIL; + if (!conn) RETURN_MODULE_FAIL; # else conn = inst->conn; # endif @@ -489,7 +489,7 @@ cleanup: # ifdef KRB5_IS_THREAD_SAFE fr_pool_connection_release(inst->pool, request, conn); # endif - return rcode; + RETURN_MODULE_RCODE(rcode); } #endif /* MIT_KRB5 */ diff --git a/src/modules/rlm_ldap/groups.c b/src/modules/rlm_ldap/groups.c index b87995acd09..2cd6aba6a25 100644 --- a/src/modules/rlm_ldap/groups.c +++ b/src/modules/rlm_ldap/groups.c @@ -41,16 +41,19 @@ USES_APPLE_DEPRECATED_API * Given an array of group names, builds a filter matching all names, then retrieves all group objects * and stores the DN associated with each group object. * - * @param[in] inst rlm_ldap configuration. - * @param[in] request Current request. - * @param[in,out] pconn to use. May change as this function calls functions which auto re-connect. - * @param[in] names to convert to DNs (NULL terminated). - * @param[out] out Where to write the DNs. DNs must be freed with ldap_memfree(). Will be NULL terminated. - * @param[in] outlen Size of out. + * @param[out] p_result The result of trying to resolve a group name to a dn. + * @param[in] inst rlm_ldap configuration. + * @param[in] request Current request. + * @param[in,out] pconn to use. May change as this function calls functions which auto re-connect. + * @param[in] names to convert to DNs (NULL terminated). + * @param[out] out Where to write the DNs. DNs must be freed with + * ldap_memfree(). Will be NULL terminated. + * @param[in] outlen Size of out. * @return One of the RLM_MODULE_* values. */ -static rlm_rcode_t rlm_ldap_group_name2dn(rlm_ldap_t const *inst, request_t *request, fr_ldap_connection_t **pconn, - char **names, char **out, size_t outlen) +static unlang_action_t rlm_ldap_group_name2dn(rlm_rcode_t *p_result, rlm_ldap_t const *inst, request_t *request, + fr_ldap_connection_t **pconn, + char **names, char **out, size_t outlen) { rlm_rcode_t rcode = RLM_MODULE_OK; fr_ldap_rcode_t status; @@ -72,12 +75,12 @@ static rlm_rcode_t rlm_ldap_group_name2dn(rlm_ldap_t const *inst, request_t *req *dn = NULL; - if (!*names) return RLM_MODULE_OK; + if (!*names) RETURN_MODULE_OK; if (!inst->groupobj_name_attr) { REDEBUG("Told to convert group names to DNs but missing 'group.name_attribute' directive"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } RDEBUG2("Converting group name(s) to group DN(s)"); @@ -104,7 +107,7 @@ static rlm_rcode_t rlm_ldap_group_name2dn(rlm_ldap_t const *inst, request_t *req inst->groupobj_base_dn, fr_ldap_escape_func, NULL) < 0) { REDEBUG("Failed creating base_dn"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } status = fr_ldap_search(&result, request, pconn, base_dn, inst->groupobj_scope, @@ -181,7 +184,7 @@ finish: *dn = NULL; } - return rcode; + RETURN_MODULE_RCODE(rcode); } /** Convert a single group name into a DN @@ -189,15 +192,16 @@ finish: * Unlike the inverse conversion of a name to a DN, most LDAP directories don't allow filtering by DN, * so we need to search for each DN individually. * - * @param[in] inst rlm_ldap configuration. - * @param[in] request Current request. - * @param[in,out] pconn to use. May change as this function calls functions which auto re-connect. - * @param[in] dn to resolve. - * @param[out] out Where to write group name (must be freed with talloc_free). + * @param[out] p_result The result of trying to resolve a dn to a group name. + * @param[in] inst rlm_ldap configuration. + * @param[in] request Current request. + * @param[in,out] pconn to use. May change as this function calls functions which auto re-connect. + * @param[in] dn to resolve. + * @param[out] out Where to write group name (must be freed with talloc_free). * @return One of the RLM_MODULE_* values. */ -static rlm_rcode_t rlm_ldap_group_dn2name(rlm_ldap_t const *inst, request_t *request, - fr_ldap_connection_t **pconn, char const *dn, char **out) +static unlang_action_t rlm_ldap_group_dn2name(rlm_rcode_t *p_result, rlm_ldap_t const *inst, request_t *request, + fr_ldap_connection_t **pconn, char const *dn, char **out) { rlm_rcode_t rcode = RLM_MODULE_OK; fr_ldap_rcode_t status; @@ -212,7 +216,7 @@ static rlm_rcode_t rlm_ldap_group_dn2name(rlm_ldap_t const *inst, request_t *req if (!inst->groupobj_name_attr) { REDEBUG("Told to resolve group DN to name but missing 'group.name_attribute' directive"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } RDEBUG2("Resolving group DN \"%s\" to group name", dn); @@ -224,10 +228,10 @@ static rlm_rcode_t rlm_ldap_group_dn2name(rlm_ldap_t const *inst, request_t *req case LDAP_PROC_NO_RESULT: REDEBUG("Group DN \"%s\" did not resolve to an object", dn); - return inst->allow_dangling_group_refs ? RLM_MODULE_NOOP : RLM_MODULE_INVALID; + RETURN_MODULE_RCODE(inst->allow_dangling_group_refs ? RLM_MODULE_NOOP : RLM_MODULE_INVALID); default: - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } entry = ldap_first_entry((*pconn)->handle, result); @@ -255,20 +259,22 @@ finish: if (result) ldap_msgfree(result); if (values) ldap_value_free_len(values); - return rcode; + RETURN_MODULE_RCODE(rcode); } /** Convert group membership information into attributes * - * @param[in] inst rlm_ldap configuration. - * @param[in] request Current request. - * @param[in,out] pconn to use. May change as this function calls functions which auto re-connect. - * @param[in] entry retrieved by rlm_ldap_find_user or fr_ldap_search. - * @param[in] attr membership attribute to look for in the entry. + * @param[out] p_result The result of trying to resolve a dn to a group name. + * @param[in] inst rlm_ldap configuration. + * @param[in] request Current request. + * @param[in,out] pconn to use. May change as this function calls functions which auto re-connect. + * @param[in] entry retrieved by rlm_ldap_find_user or fr_ldap_search. + * @param[in] attr membership attribute to look for in the entry. * @return One of the RLM_MODULE_* values. */ -rlm_rcode_t rlm_ldap_cacheable_userobj(rlm_ldap_t const *inst, request_t *request, fr_ldap_connection_t **pconn, - LDAPMessage *entry, char const *attr) +unlang_action_t rlm_ldap_cacheable_userobj(rlm_rcode_t *p_result, rlm_ldap_t const *inst, + request_t *request, fr_ldap_connection_t **pconn, + LDAPMessage *entry, char const *attr) { rlm_rcode_t rcode = RLM_MODULE_OK; @@ -298,7 +304,7 @@ rlm_rcode_t rlm_ldap_cacheable_userobj(rlm_ldap_t const *inst, request_t *reques if (!values) { RDEBUG2("No cacheable group memberships found in user object"); - return RLM_MODULE_OK; + RETURN_MODULE_OK; } count = ldap_count_values_len(values); @@ -357,7 +363,7 @@ rlm_rcode_t rlm_ldap_cacheable_userobj(rlm_ldap_t const *inst, request_t *reques char *dn; dn = fr_ldap_berval_to_string(value_ctx, values[i]); - rcode = rlm_ldap_group_dn2name(inst, request, pconn, dn, &name); + rlm_ldap_group_dn2name(&rcode, inst, request, pconn, dn, &name); talloc_free(dn); if (rcode == RLM_MODULE_NOOP) continue; @@ -367,7 +373,7 @@ rlm_rcode_t rlm_ldap_cacheable_userobj(rlm_ldap_t const *inst, request_t *reques talloc_free(value_ctx); fr_pair_list_free(&groups); - return rcode; + RETURN_MODULE_RCODE(rcode); } MEM(vp = fr_pair_afrom_da(list_ctx, inst->cache_da)); @@ -379,12 +385,12 @@ rlm_rcode_t rlm_ldap_cacheable_userobj(rlm_ldap_t const *inst, request_t *reques } *name_p = NULL; - rcode = rlm_ldap_group_name2dn(inst, request, pconn, group_name, group_dn, sizeof(group_dn)); + rlm_ldap_group_name2dn(&rcode, inst, request, pconn, group_name, group_dn, sizeof(group_dn)); ldap_value_free_len(values); talloc_free(value_ctx); - if (rcode != RLM_MODULE_OK) return rcode; + if (rcode != RLM_MODULE_OK) RETURN_MODULE_RCODE(rcode); fr_cursor_init(&list_cursor, list); @@ -411,17 +417,19 @@ rlm_rcode_t rlm_ldap_cacheable_userobj(rlm_ldap_t const *inst, request_t *reques } REXDENT(); - return rcode; + RETURN_MODULE_RCODE(rcode); } /** Convert group membership information into attributes * - * @param[in] inst rlm_ldap configuration. - * @param[in] request Current request. - * @param[in,out] pconn to use. May change as this function calls functions which auto re-connect. + * @param[out] p_result The result of trying to resolve a dn to a group name. + * @param[in] inst rlm_ldap configuration. + * @param[in] request Current request. + * @param[in,out] pconn to use. May change as this function calls functions which auto re-connect. * @return One of the RLM_MODULE_* values. */ -rlm_rcode_t rlm_ldap_cacheable_groupobj(rlm_ldap_t const *inst, request_t *request, fr_ldap_connection_t **pconn) +unlang_action_t rlm_ldap_cacheable_groupobj(rlm_rcode_t *p_result, rlm_ldap_t const *inst, + request_t *request, fr_ldap_connection_t **pconn) { rlm_rcode_t rcode = RLM_MODULE_OK; fr_ldap_rcode_t status; @@ -446,20 +454,20 @@ rlm_rcode_t rlm_ldap_cacheable_groupobj(rlm_ldap_t const *inst, request_t *reque if (!inst->groupobj_membership_filter) { RDEBUG2("Skipping caching group objects as directive 'group.membership_filter' is not set"); - return RLM_MODULE_OK; + RETURN_MODULE_OK; } if (fr_ldap_xlat_filter(request, filters, NUM_ELEMENTS(filters), filter, sizeof(filter)) < 0) { - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } if (tmpl_expand(&base_dn, base_dn_buff, sizeof(base_dn_buff), request, inst->groupobj_base_dn, fr_ldap_escape_func, NULL) < 0) { REDEBUG("Failed creating base_dn"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } status = fr_ldap_search(&result, request, pconn, base_dn, @@ -526,7 +534,7 @@ rlm_rcode_t rlm_ldap_cacheable_groupobj(rlm_ldap_t const *inst, request_t *reque finish: if (result) ldap_msgfree(result); - return rcode; + RETURN_MODULE_RCODE(rcode); } /** Query the LDAP directory to check if a group object includes a user object as a member @@ -537,9 +545,8 @@ finish: * @param[in] check vp containing the group value (name or dn). * @return One of the RLM_MODULE_* values. */ -rlm_rcode_t rlm_ldap_check_groupobj_dynamic(rlm_ldap_t const *inst, request_t *request, fr_ldap_connection_t **pconn, - fr_pair_t *check) - +unlang_action_t rlm_ldap_check_groupobj_dynamic(rlm_rcode_t *p_result, rlm_ldap_t const *inst, request_t *request, + fr_ldap_connection_t **pconn, fr_pair_t *check) { fr_ldap_rcode_t status; @@ -575,7 +582,7 @@ rlm_rcode_t rlm_ldap_check_groupobj_dynamic(rlm_ldap_t const *inst, request_t *r filter, sizeof(filter)); REXDENT(); - if (ret < 0) return RLM_MODULE_INVALID; + if (ret < 0) RETURN_MODULE_INVALID; base_dn = check->vp_strvalue; } else { @@ -586,7 +593,7 @@ rlm_rcode_t rlm_ldap_check_groupobj_dynamic(rlm_ldap_t const *inst, request_t *r REDEBUG("Told to search for group by name, but missing 'group.name_attribute' " "directive"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } snprintf(name_filter, sizeof(name_filter), "(%s=%s)", inst->groupobj_name_attr, check->vp_strvalue); @@ -595,7 +602,7 @@ rlm_rcode_t rlm_ldap_check_groupobj_dynamic(rlm_ldap_t const *inst, request_t *r filters, NUM_ELEMENTS(filters), filter, sizeof(filter)); REXDENT(); - if (ret < 0) return RLM_MODULE_INVALID; + if (ret < 0) RETURN_MODULE_INVALID; /* @@ -608,7 +615,7 @@ rlm_rcode_t rlm_ldap_check_groupobj_dynamic(rlm_ldap_t const *inst, request_t *r if (ret < 0) { REDEBUG("Failed creating base_dn"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } } @@ -621,26 +628,27 @@ rlm_rcode_t rlm_ldap_check_groupobj_dynamic(rlm_ldap_t const *inst, request_t *r break; case LDAP_PROC_NO_RESULT: - return RLM_MODULE_NOTFOUND; + RETURN_MODULE_NOTFOUND; default: - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } /** Query the LDAP directory to check if a user object is a member of a group * - * @param[in] inst rlm_ldap configuration. - * @param[in] request Current request. - * @param[in,out] pconn to use. May change as this function calls functions which auto re-connect. - * @param[in] dn of user object. - * @param[in] check vp containing the group value (name or dn). + * @param[in] inst rlm_ldap configuration. + * @param[in] request Current request. + * @param[in,out] pconn to use. May change as this function calls functions which auto re-connect. + * @param[in] dn of user object. + * @param[in] check vp containing the group value (name or dn). * @return One of the RLM_MODULE_* values. */ -rlm_rcode_t rlm_ldap_check_userobj_dynamic(rlm_ldap_t const *inst, request_t *request, fr_ldap_connection_t **pconn, - char const *dn, fr_pair_t *check) +unlang_action_t rlm_ldap_check_userobj_dynamic(rlm_rcode_t *p_result, rlm_ldap_t const *inst, request_t *request, + fr_ldap_connection_t **pconn, + char const *dn, fr_pair_t *check) { rlm_rcode_t rcode = RLM_MODULE_NOTFOUND, ret; fr_ldap_rcode_t status; @@ -748,7 +756,7 @@ rlm_rcode_t rlm_ldap_check_userobj_dynamic(rlm_ldap_t const *inst, request_t *re bool eq = false; RINDENT(); - ret = rlm_ldap_group_dn2name(inst, request, pconn, check->vp_strvalue, &resolved); + rlm_ldap_group_dn2name(&ret, inst, request, pconn, check->vp_strvalue, &resolved); REXDENT(); if (ret == RLM_MODULE_NOOP) continue; @@ -784,7 +792,7 @@ rlm_rcode_t rlm_ldap_check_userobj_dynamic(rlm_ldap_t const *inst, request_t *re value = fr_ldap_berval_to_string(request, values[i]); RINDENT(); - ret = rlm_ldap_group_dn2name(inst, request, pconn, value, &resolved); + rlm_ldap_group_dn2name(&ret, inst, request, pconn, value, &resolved); REXDENT(); talloc_free(value); @@ -815,7 +823,7 @@ finish: if (values) ldap_value_free_len(values); if (result) ldap_msgfree(result); - return rcode; + RETURN_MODULE_RCODE(rcode); } /** Check group membership attributes to see if a user is a member. @@ -826,7 +834,8 @@ finish: * * @return One of the RLM_MODULE_* values. */ -rlm_rcode_t rlm_ldap_check_cached(rlm_ldap_t const *inst, request_t *request, fr_pair_t *check) +unlang_action_t rlm_ldap_check_cached(rlm_rcode_t *p_result, + rlm_ldap_t const *inst, request_t *request, fr_pair_t *check) { fr_pair_t *vp; int ret; @@ -837,7 +846,7 @@ rlm_rcode_t rlm_ldap_check_cached(rlm_ldap_t const *inst, request_t *request, fr * the caller should try a dynamic group lookup instead. */ vp = fr_cursor_iter_by_da_init(&cursor, &request->control_pairs, inst->cache_da); - if (!vp) return RLM_MODULE_INVALID; + if (!vp) RETURN_MODULE_INVALID; for (vp = fr_cursor_current(&cursor); vp; @@ -845,13 +854,13 @@ rlm_rcode_t rlm_ldap_check_cached(rlm_ldap_t const *inst, request_t *request, fr ret = fr_pair_cmp_op(T_OP_CMP_EQ, vp, check); if (ret == 1) { RDEBUG2("User found. Matched cached membership"); - return RLM_MODULE_OK; + RETURN_MODULE_OK; } - if (ret < -1) return RLM_MODULE_FAIL; + if (ret < -1) RETURN_MODULE_FAIL; } RDEBUG2("Cached membership not found"); - return RLM_MODULE_NOTFOUND; + RETURN_MODULE_NOTFOUND; } diff --git a/src/modules/rlm_ldap/rlm_ldap.c b/src/modules/rlm_ldap/rlm_ldap.c index f69b1e51d68..20250ba11cf 100644 --- a/src/modules/rlm_ldap/rlm_ldap.c +++ b/src/modules/rlm_ldap/rlm_ldap.c @@ -632,7 +632,10 @@ static int rlm_ldap_groupcmp(void *instance, request_t *request, UNUSED fr_pair_ fr_pair_value_bstr_realloc(check, NULL, len); } if ((check_is_dn && inst->cacheable_group_dn) || (!check_is_dn && inst->cacheable_group_name)) { - switch (rlm_ldap_check_cached(inst, request, check)) { + rlm_rcode_t our_rcode; + + rlm_ldap_check_cached(&our_rcode, inst, request, check); + switch (our_rcode) { case RLM_MODULE_NOTFOUND: found = false; goto finish; @@ -668,7 +671,10 @@ static int rlm_ldap_groupcmp(void *instance, request_t *request, UNUSED fr_pair_ * Check groupobj user membership */ if (inst->groupobj_membership_filter) { - switch (rlm_ldap_check_groupobj_dynamic(inst, request, &conn, check)) { + rlm_rcode_t our_rcode; + + rlm_ldap_check_groupobj_dynamic(&our_rcode, inst, request, &conn, check); + switch (our_rcode) { case RLM_MODULE_NOTFOUND: break; @@ -687,7 +693,10 @@ static int rlm_ldap_groupcmp(void *instance, request_t *request, UNUSED fr_pair_ * Check userobj group membership */ if (inst->userobj_membership_attr) { - switch (rlm_ldap_check_userobj_dynamic(inst, request, &conn, user_dn, check)) { + rlm_rcode_t our_rcode; + + rlm_ldap_check_userobj_dynamic(&our_rcode, inst, request, &conn, user_dn, check); + switch (our_rcode) { case RLM_MODULE_NOTFOUND: break; @@ -714,7 +723,7 @@ finish: return 0; } -static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_ldap_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_ldap_t); rlm_rcode_t rcode; @@ -737,7 +746,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r */ if (!username) { REDEBUG("Attribute \"User-Name\" is required for authentication"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } if (!password) { @@ -749,7 +758,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r RWDEBUG("*********************************************"); REDEBUG("Attribute \"User-Password\" is required for authentication"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -757,7 +766,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r */ if (password->vp_length == 0) { REDEBUG("User-Password must not be empty"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -770,7 +779,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r } conn = mod_conn_get(inst, request); - if (!conn) return RLM_MODULE_FAIL; + if (!conn) RETURN_MODULE_FAIL; /* * Expand dynamic SASL fields @@ -813,7 +822,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r if (!dn) { ldap_mod_conn_release(inst, request, conn); - return rcode; + RETURN_MODULE_RCODE(rcode); } conn->rebound = true; status = fr_ldap_bind(request, @@ -852,7 +861,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r finish: ldap_mod_conn_release(inst, request, conn); - return rcode; + RETURN_MODULE_RCODE(rcode); } /** Search for and apply an LDAP profile @@ -860,16 +869,18 @@ finish: * LDAP profiles are mapped using the same attribute map as user objects, they're used to add common * sets of attributes to the request. * - * @param[in] inst rlm_ldap configuration. - * @param[in] request Current request. - * @param[in,out] pconn to use. May change as this function calls functions which auto re-connect. - * @param[in] dn of profile object to apply. - * @param[in] expanded Structure containing a list of xlat expanded attribute names and mapping -information. + * @param[out] p_result the result of applying the profile. + * @param[in] inst rlm_ldap configuration. + * @param[in] request Current request. + * @param[in,out] pconn to use. May change as this function calls functions which auto re-connect. + * @param[in] dn of profile object to apply. + * @param[in] expanded Structure containing a list of xlat + * expanded attribute names and mapping information. * @return One of the RLM_MODULE_* values. */ -static rlm_rcode_t rlm_ldap_map_profile(rlm_ldap_t const *inst, request_t *request, fr_ldap_connection_t **pconn, - char const *dn, fr_ldap_map_exp_t const *expanded) +static unlang_action_t rlm_ldap_map_profile(rlm_rcode_t *p_result, rlm_ldap_t const *inst, + request_t *request, fr_ldap_connection_t **pconn, + char const *dn, fr_ldap_map_exp_t const *expanded) { rlm_rcode_t rcode = RLM_MODULE_OK; fr_ldap_rcode_t status; @@ -881,13 +892,13 @@ static rlm_rcode_t rlm_ldap_map_profile(rlm_ldap_t const *inst, request_t *reque fr_assert(inst->profile_filter); /* We always have a default filter set */ - if (!dn || !*dn) return RLM_MODULE_OK; + if (!dn || !*dn) RETURN_MODULE_OK; if (tmpl_expand(&filter, filter_buff, sizeof(filter_buff), request, inst->profile_filter, fr_ldap_escape_func, NULL) < 0) { REDEBUG("Failed creating profile filter"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } status = fr_ldap_search(&result, request, pconn, dn, @@ -899,10 +910,10 @@ static rlm_rcode_t rlm_ldap_map_profile(rlm_ldap_t const *inst, request_t *reque case LDAP_PROC_BAD_DN: case LDAP_PROC_NO_RESULT: RDEBUG2("Profile object \"%s\" not found", dn); - return RLM_MODULE_NOTFOUND; + RETURN_MODULE_NOTFOUND; default: - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } fr_assert(*pconn); @@ -926,10 +937,10 @@ static rlm_rcode_t rlm_ldap_map_profile(rlm_ldap_t const *inst, request_t *reque free_result: ldap_msgfree(result); - return rcode; + RETURN_MODULE_RCODE(rcode); } -static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_ldap_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_ldap_t); rlm_rcode_t rcode = RLM_MODULE_OK; @@ -950,10 +961,10 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, requ * for many things besides searching for users. */ - if (fr_ldap_map_expand(&expanded, request, inst->user_map) < 0) return RLM_MODULE_FAIL; + if (fr_ldap_map_expand(&expanded, request, inst->user_map) < 0) RETURN_MODULE_FAIL; conn = mod_conn_get(inst, request); - if (!conn) return RLM_MODULE_FAIL; + if (!conn) RETURN_MODULE_FAIL; /* * Add any additional attributes we need for checking access, memberships, and profiles @@ -1004,13 +1015,13 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, requ */ if (inst->cacheable_group_dn || inst->cacheable_group_name) { if (inst->userobj_membership_attr) { - rcode = rlm_ldap_cacheable_userobj(inst, request, &conn, entry, inst->userobj_membership_attr); + rlm_ldap_cacheable_userobj(&rcode, inst, request, &conn, entry, inst->userobj_membership_attr); if (rcode != RLM_MODULE_OK) { goto finish; } } - rcode = rlm_ldap_cacheable_groupobj(inst, request, &conn); + rlm_ldap_cacheable_groupobj(&rcode, inst, request, &conn); if (rcode != RLM_MODULE_OK) { goto finish; } @@ -1097,8 +1108,9 @@ skip_edir: * Apply ONE user profile, or a default user profile. */ if (inst->default_profile) { - char const *profile; - char profile_buff[1024]; + char const *profile; + char profile_buff[1024]; + rlm_rcode_t ret; if (tmpl_expand(&profile, profile_buff, sizeof(profile_buff), request, inst->default_profile, NULL, NULL) < 0) { @@ -1108,7 +1120,8 @@ skip_edir: goto finish; } - switch (rlm_ldap_map_profile(inst, request, &conn, profile, &expanded)) { + rlm_ldap_map_profile(&ret, inst, request, &conn, profile, &expanded); + switch (ret) { case RLM_MODULE_INVALID: rcode = RLM_MODULE_INVALID; goto finish; @@ -1136,7 +1149,7 @@ skip_edir: char *value; value = fr_ldap_berval_to_string(request, values[i]); - ret = rlm_ldap_map_profile(inst, request, &conn, value, &expanded); + rlm_ldap_map_profile(&ret, inst, request, &conn, value, &expanded); talloc_free(value); if (ret == RLM_MODULE_FAIL) { ldap_value_free_len(values); @@ -1163,19 +1176,21 @@ finish: if (result) ldap_msgfree(result); ldap_mod_conn_release(inst, request, conn); - return rcode; + RETURN_MODULE_RCODE(rcode); } /** Modify user's object in LDAP * * Process a modifcation map to update a user object in the LDAP directory. * - * @param inst rlm_ldap instance. - * @param request Current request. - * @param section that holds the map to process. + * @param[out] p_result the result of the modification. + * @param[in] inst rlm_ldap instance. + * @param[in] request Current request. + * @param[in] section that holds the map to process. * @return one of the RLM_MODULE_* values. */ -static rlm_rcode_t user_modify(rlm_ldap_t const *inst, request_t *request, ldap_acct_section_t *section) +static unlang_action_t user_modify(rlm_rcode_t *p_result, rlm_ldap_t const *inst, + request_t *request, ldap_acct_section_t *section) { rlm_rcode_t rcode = RLM_MODULE_OK; fr_ldap_rcode_t status; @@ -1361,7 +1376,7 @@ static rlm_rcode_t user_modify(rlm_ldap_t const *inst, request_t *request, ldap_ mod_p[total] = NULL; conn = mod_conn_get(inst, request); - if (!conn) return RLM_MODULE_FAIL; + if (!conn) RETURN_MODULE_FAIL; dn = rlm_ldap_find_user(inst, request, &conn, NULL, false, NULL, &rcode); @@ -1393,25 +1408,25 @@ error: ldap_mod_conn_release(inst, request, conn); - return rcode; + RETURN_MODULE_RCODE(rcode); } -static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_accounting(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_ldap_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_ldap_t); - if (inst->accounting) return user_modify(inst, request, inst->accounting); + if (inst->accounting) return user_modify(p_result, inst, request, inst->accounting); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } -static rlm_rcode_t CC_HINT(nonnull) mod_post_auth(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_post_auth(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_ldap_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_ldap_t); - if (inst->postauth) return user_modify(inst, request, inst->postauth); + if (inst->postauth) return user_modify(p_result, inst, request, inst->postauth); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } diff --git a/src/modules/rlm_ldap/rlm_ldap.h b/src/modules/rlm_ldap/rlm_ldap.h index d754e437183..dcdf53743a0 100644 --- a/src/modules/rlm_ldap/rlm_ldap.h +++ b/src/modules/rlm_ldap/rlm_ldap.h @@ -174,18 +174,23 @@ void rlm_ldap_check_reply(rlm_ldap_t const *inst, request_t *request, fr_ldap_co /* * groups.c - Group membership functions. */ -rlm_rcode_t rlm_ldap_cacheable_userobj(rlm_ldap_t const *inst, request_t *request, fr_ldap_connection_t **pconn, - LDAPMessage *entry, char const *attr); +unlang_action_t rlm_ldap_cacheable_userobj(rlm_rcode_t *p_result, rlm_ldap_t const *inst, + request_t *request, fr_ldap_connection_t **pconn, + LDAPMessage *entry, char const *attr); -rlm_rcode_t rlm_ldap_cacheable_groupobj(rlm_ldap_t const *inst, request_t *request, fr_ldap_connection_t **pconn); +unlang_action_t rlm_ldap_cacheable_groupobj(rlm_rcode_t *p_result, + rlm_ldap_t const *inst, request_t *request, fr_ldap_connection_t **pconn); -rlm_rcode_t rlm_ldap_check_groupobj_dynamic(rlm_ldap_t const *inst, request_t *request, fr_ldap_connection_t **pconn, - fr_pair_t *check); +unlang_action_t rlm_ldap_check_groupobj_dynamic(rlm_rcode_t *p_result, + rlm_ldap_t const *inst, request_t *request, fr_ldap_connection_t **pconn, + fr_pair_t *check); -rlm_rcode_t rlm_ldap_check_userobj_dynamic(rlm_ldap_t const *inst, request_t *request, fr_ldap_connection_t **pconn, - char const *dn, fr_pair_t *check); +unlang_action_t rlm_ldap_check_userobj_dynamic(rlm_rcode_t *p_result, + rlm_ldap_t const *inst, request_t *request, fr_ldap_connection_t **pconn, + char const *dn, fr_pair_t *check); -rlm_rcode_t rlm_ldap_check_cached(rlm_ldap_t const *inst, request_t *request, fr_pair_t *check); +unlang_action_t rlm_ldap_check_cached(rlm_rcode_t *p_result, + rlm_ldap_t const *inst, request_t *request, fr_pair_t *check); /* * conn.c - Connection wrappers. diff --git a/src/modules/rlm_linelog/rlm_linelog.c b/src/modules/rlm_linelog/rlm_linelog.c index 3fb50e32fd0..e06e1e31e53 100644 --- a/src/modules/rlm_linelog/rlm_linelog.c +++ b/src/modules/rlm_linelog/rlm_linelog.c @@ -446,7 +446,7 @@ static size_t linelog_escape_func(UNUSED request_t *request, * - #RLM_MODULE_FAIL if we failed writing the message. * - #RLM_MODULE_OK on success. */ -static rlm_rcode_t CC_HINT(nonnull) mod_do_linelog(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_do_linelog(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_linelog_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_linelog_t); linelog_conn_t *conn; @@ -480,7 +480,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_do_linelog(module_ctx_t const *mctx, req if (tmpl_expand(&path, buff + 1, sizeof(buff) - 1, request, inst->log_ref, linelog_escape_func, NULL) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } if (path != buff + 1) strlcpy(buff + 1, path, sizeof(buff) - 1); @@ -492,7 +492,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_do_linelog(module_ctx_t const *mctx, req */ if (buff[2] == '.') { REDEBUG("Invalid path \"%s\"", p); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } ci = cf_reference_item(NULL, inst->cs, p); @@ -503,7 +503,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_do_linelog(module_ctx_t const *mctx, req if (!cf_item_is_pair(ci)) { REDEBUG("Path \"%s\" resolves to a section (should be a pair)", p); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } cp = cf_item_to_pair(ci); @@ -532,7 +532,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_do_linelog(module_ctx_t const *mctx, req }); if (slen <= 0) { REMARKER(tmpl_str, -slen, "%s", fr_strerror()); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } vpt_p = vpt; } else { @@ -542,7 +542,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_do_linelog(module_ctx_t const *mctx, req */ if (!inst->log_src) { RDEBUG2("No default message configured"); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } /* * Use the pre-parsed format template @@ -647,7 +647,7 @@ build_vector: char path[2048]; if (xlat_eval(path, sizeof(path), request, inst->file.name, inst->file.escape_func, NULL) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* check path and eventually create subdirs */ @@ -680,7 +680,7 @@ build_vector: /* Assert on the extra fatal errors */ fr_assert((errno != EINVAL) && (errno != EFAULT)); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } exfile_close(inst->file.ef, request, fd); @@ -782,7 +782,7 @@ finish: talloc_free(vector); /* coverity[missing_unlock] */ - return rcode; + RETURN_MODULE_RCODE(rcode); } diff --git a/src/modules/rlm_logintime/rlm_logintime.c b/src/modules/rlm_logintime/rlm_logintime.c index ee617126f16..da32b65429a 100644 --- a/src/modules/rlm_logintime/rlm_logintime.c +++ b/src/modules/rlm_logintime/rlm_logintime.c @@ -151,14 +151,14 @@ static int time_of_day(UNUSED void *instance, request_t *request, /* * Check if account has expired, and if user may login now. */ -static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_logintime_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_logintime_t); fr_pair_t *ends, *vp; int32_t left; ends = fr_pair_find_by_da(&request->control_pairs, attr_login_time); - if (!ends) return RLM_MODULE_NOOP; + if (!ends) RETURN_MODULE_NOOP; /* * Authentication is OK. Now see if this user may login at this time of the day. @@ -169,12 +169,12 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, requ * Compare the time the request was received with the current Login-Time value */ left = timestr_match(ends->vp_strvalue, fr_time_to_sec(request->packet->timestamp)); - if (left < 0) return RLM_MODULE_DISALLOW; /* outside of the allowed time */ + if (left < 0) RETURN_MODULE_DISALLOW; /* outside of the allowed time */ /* * Do nothing, login time is not controlled (unendsed). */ - if (left == 0) return RLM_MODULE_OK; + if (left == 0) RETURN_MODULE_OK; /* * The min_time setting is to deal with NAS that won't allow Session-vp values below a certain value @@ -186,7 +186,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, requ REDEBUG("Login outside of allowed time-slot (session end %s, with lockout %i seconds before)", ends->vp_strvalue, inst->min_time); - return RLM_MODULE_DISALLOW; + RETURN_MODULE_DISALLOW; } /* else left > inst->min_time */ @@ -215,7 +215,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, requ MEM(NULL); } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } diff --git a/src/modules/rlm_logtee/rlm_logtee.c b/src/modules/rlm_logtee/rlm_logtee.c index a7a1e5f681d..76eb8af139e 100644 --- a/src/modules/rlm_logtee/rlm_logtee.c +++ b/src/modules/rlm_logtee/rlm_logtee.c @@ -205,7 +205,7 @@ static void logtee_it(fr_log_type_t type, fr_log_lvl_t lvl, request_t *request, char const *fmt, va_list ap, void *uctx) CC_HINT(format (printf, 6, 0)) CC_HINT(nonnull (3, 6)); -static rlm_rcode_t mod_insert_logtee(module_ctx_t const *mctx, request_t *request) CC_HINT(nonnull); +static unlang_action_t mod_insert_logtee(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) CC_HINT(nonnull); /** Connection errored * @@ -522,7 +522,7 @@ finish: * - #RLM_MODULE_NOOP if log destination already exists. * - #RLM_MODULE_OK if we added a new destination. */ -static rlm_rcode_t mod_insert_logtee(module_ctx_t const *mctx, request_t *request) +static unlang_action_t mod_insert_logtee(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { fr_cursor_t cursor; log_dst_t *dst; @@ -532,7 +532,7 @@ static rlm_rcode_t mod_insert_logtee(module_ctx_t const *mctx, request_t *reques if (dst->uctx == mctx->thread) exists = true; } - if (exists) return RLM_MODULE_NOOP; + if (exists) RETURN_MODULE_NOOP; dst = talloc_zero(request, log_dst_t); dst->func = logtee_it; @@ -540,7 +540,7 @@ static rlm_rcode_t mod_insert_logtee(module_ctx_t const *mctx, request_t *reques fr_cursor_append(&cursor, dst); - return RLM_MODULE_OK; + RETURN_MODULE_OK; } /** Create thread-specific connections and buffers diff --git a/src/modules/rlm_lua/lua.c b/src/modules/rlm_lua/lua.c index 1e02ff8caa7..931f182a7b4 100644 --- a/src/modules/rlm_lua/lua.c +++ b/src/modules/rlm_lua/lua.c @@ -736,12 +736,12 @@ static void _lua_fr_request_register(lua_State *L, request_t *request) lua_setfield(L, -2, "request"); } -int fr_lua_run(module_ctx_t const *mctx, request_t *request, char const *funcname) +unlang_action_t fr_lua_run(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, char const *funcname) { rlm_lua_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_lua_t); rlm_lua_thread_t *thread = talloc_get_type_abort(mctx->thread, rlm_lua_thread_t); lua_State *L = thread->interpreter; - int ret = RLM_MODULE_OK; + rlm_rcode_t rcode = RLM_MODULE_OK; fr_lua_util_set_inst(inst); fr_lua_util_set_request(request); @@ -758,7 +758,7 @@ error: fr_lua_util_set_inst(NULL); fr_lua_util_set_request(NULL); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } if (!lua_isfunction(L, -1)) { @@ -776,26 +776,26 @@ error: } /* - * functions without return or returning none/nil will be RLM_MODULE_OK + * functions without rcodeurn or rcodeurning none/nil will be RLM_MODULE_OK */ if (!lua_isnoneornil(L, -1)) { /* - * e.g: return 2, return "2", return fr.handled, fr.fail, ... + * e.g: rcodeurn 2, rcodeurn "2", rcodeurn fr.handled, fr.fail, ... */ if (lua_isnumber(L, -1)) { - ret = lua_tointeger(L, -1); - if (fr_table_str_by_value(rcode_table, ret, NULL) != NULL) goto done; + rcode = lua_tointeger(L, -1); + if (fr_table_str_by_value(rcode_table, rcode, NULL) != NULL) goto done; } /* - * e.g: return "handled", "ok", "fail", ... + * e.g: rcodeurn "handled", "ok", "fail", ... */ if (lua_isstring(L, -1)) { - ret = fr_table_value_by_str(rcode_table, lua_tostring(L, -1), -1); - if (ret != -1) goto done; + rcode = fr_table_value_by_str(rcode_table, lua_tostring(L, -1), -1); + if ((int)rcode != -1) goto done; } - ROPTIONAL(RDEBUG2, DEBUG2, "Lua function %s() returned invalid rcode \"%s\"", funcname, lua_tostring(L, -1)); + ROPTIONAL(RDEBUG2, DEBUG2, "Lua function %s() rcodeurned invalid rcode \"%s\"", funcname, lua_tostring(L, -1)); goto error; } @@ -803,7 +803,7 @@ done: fr_lua_util_set_inst(NULL); fr_lua_util_set_request(NULL); - return ret; + RETURN_MODULE_RCODE(rcode); } /* diff --git a/src/modules/rlm_lua/lua.h b/src/modules/rlm_lua/lua.h index 71d6c55fade..99613f63883 100644 --- a/src/modules/rlm_lua/lua.h +++ b/src/modules/rlm_lua/lua.h @@ -66,7 +66,7 @@ typedef struct { /* lua.c */ int fr_lua_init(lua_State **out, rlm_lua_t const *instance); -int fr_lua_run(module_ctx_t const *mctx, request_t *request, char const *funcname); +unlang_action_t fr_lua_run(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, char const *funcname); bool fr_lua_isjit(lua_State *L); char const *fr_lua_version(lua_State *L); diff --git a/src/modules/rlm_lua/rlm_lua.c b/src/modules/rlm_lua/rlm_lua.c index 96169feab55..cc23b1fcd71 100644 --- a/src/modules/rlm_lua/rlm_lua.c +++ b/src/modules/rlm_lua/rlm_lua.c @@ -57,11 +57,11 @@ static const CONF_PARSER module_config[] = { }; #define DO_LUA(_s)\ -static rlm_rcode_t mod_##_s(module_ctx_t const *mctx, request_t *request) \ +static unlang_action_t mod_##_s(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) \ {\ rlm_lua_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_lua_t);\ - if (!inst->func_##_s) return RLM_MODULE_NOOP;\ - return fr_lua_run(mctx, request, inst->func_##_s);\ + if (!inst->func_##_s) RETURN_MODULE_NOOP;\ + return fr_lua_run(p_result, mctx, request, inst->func_##_s);\ } DO_LUA(authorize) @@ -112,20 +112,21 @@ static int mod_thread_instantiate(UNUSED CONF_SECTION const *conf, void *instanc static int mod_detach(void *instance) { rlm_lua_t *inst = instance; - int ret = 0; + rlm_rcode_t ret = 0; /* * May be NULL if fr_lua_init failed */ if (inst->interpreter) { - if (inst->func_detach) ret = fr_lua_run(&(module_ctx_t){ - .instance = inst, - .thread = &(rlm_lua_thread_t){ - .interpreter = inst->interpreter - } - }, - NULL, inst->func_detach); - + if (inst->func_detach) { + fr_lua_run(&ret, &(module_ctx_t){ + .instance = inst, + .thread = &(rlm_lua_thread_t){ + .interpreter = inst->interpreter + } + }, + NULL, inst->func_detach); + } lua_close(inst->interpreter); } @@ -135,6 +136,7 @@ static int mod_detach(void *instance) static int mod_instantiate(void *instance, CONF_SECTION *conf) { rlm_lua_t *inst = instance; + rlm_rcode_t rcode; inst->xlat_name = cf_section_name2(conf); if (!inst->xlat_name) inst->xlat_name = cf_section_name1(conf); @@ -148,13 +150,15 @@ static int mod_instantiate(void *instance, CONF_SECTION *conf) DEBUG("Using %s interpreter", fr_lua_version(inst->interpreter)); - if (inst->func_instantiate) return fr_lua_run(&(module_ctx_t){ - .instance = inst, - .thread = &(rlm_lua_thread_t){ - .interpreter = inst->interpreter - } - }, - NULL, inst->func_instantiate); + if (inst->func_instantiate) { + fr_lua_run(&rcode, &(module_ctx_t){ + .instance = inst, + .thread = &(rlm_lua_thread_t){ + .interpreter = inst->interpreter + } + }, + NULL, inst->func_instantiate); + } return 0; } diff --git a/src/modules/rlm_mruby/rlm_mruby.c b/src/modules/rlm_mruby/rlm_mruby.c index 831a584f3eb..93a0d2ea163 100644 --- a/src/modules/rlm_mruby/rlm_mruby.c +++ b/src/modules/rlm_mruby/rlm_mruby.c @@ -430,22 +430,22 @@ DIAG_ON(class-varargs) /* Must have exactly three items */ if (RARRAY_LEN(mruby_result) != 3) { ERROR("Expected array to have exactly three values, got %" PRId64 " instead", RARRAY_LEN(mruby_result)); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* First item must be a Fixnum, this will be the return type */ if (mrb_type(mrb_ary_entry(mruby_result, 0)) != MRB_TT_FIXNUM) { ERROR("Expected first array element to be a Fixnum, got %s instead", RSTRING_PTR(mrb_obj_as_string(mrb, mrb_ary_entry(mruby_result, 0)))); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* Second and third items must be Arrays, these will be the updates for reply and control */ if (mrb_type(mrb_ary_entry(mruby_result, 1)) != MRB_TT_ARRAY) { ERROR("Expected second array element to be an Array, got %s instead", RSTRING_PTR(mrb_obj_as_string(mrb, mrb_ary_entry(mruby_result, 1)))); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } else if (mrb_type(mrb_ary_entry(mruby_result, 2)) != MRB_TT_ARRAY) { ERROR("Expected third array element to be an Array, got %s instead", RSTRING_PTR(mrb_obj_as_string(mrb, mrb_ary_entry(mruby_result, 2)))); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } add_vp_tuple(request->reply, request, &request->reply_pairs, mrb, mrb_ary_entry(mruby_result, 1), function_name); @@ -455,12 +455,12 @@ DIAG_ON(class-varargs) default: /* Invalid return type */ ERROR("Expected return to be a Fixnum or an Array, got %s instead", RSTRING_PTR(mrb_obj_as_string(mrb, mruby_result))); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } } -#define RLM_MRUBY_FUNC(foo) static rlm_rcode_t CC_HINT(nonnull) mod_##foo(module_ctx_t const *mctx, request_t *request) \ +#define RLM_MRUBY_FUNC(foo) static unlang_action_t CC_HINT(nonnull) mod_##foo(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) \ { \ return do_mruby(request, \ (rlm_mruby_t const *)mctx->instance, \ diff --git a/src/modules/rlm_mschap/opendir.c b/src/modules/rlm_mschap/opendir.c index 42cf16c9c1d..8b6bcb3760d 100644 --- a/src/modules/rlm_mschap/opendir.c +++ b/src/modules/rlm_mschap/opendir.c @@ -39,11 +39,11 @@ USES_APPLE_DEPRECATED_API /* * Only used by rlm_mschap.c */ -rlm_rcode_t od_mschap_auth(request_t *request, fr_pair_t *challenge, fr_pair_t * usernamepair); +unlang_action_t od_mschap_auth(rlm_rcode_t *p_result, request_t *request, fr_pair_t *challenge, fr_pair_t * usernamepair); -static rlm_rcode_t getUserNodeRef(request_t *request, char* inUserName, char **outUserName, - tDirNodeReference* userNodeRef, tDirReference dsRef) +static unlang_action_t getUserNodeRef(rlm_rcode_t *p_result, request_t *request, char* inUserName, char **outUserName, + tDirNodeReference* userNodeRef, tDirReference dsRef) { tDataBuffer *tDataBuff = NULL; tDirNodeReference nodeRef = 0; @@ -68,13 +68,13 @@ static rlm_rcode_t getUserNodeRef(request_t *request, char* inUserName, char **o if (!inUserName) { REDEBUG("getUserNodeRef(): No username"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } tDataBuff = dsDataBufferAllocate(dsRef, 4096); if (!tDataBuff) { REDEBUG("Failed allocating buffer"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } do { @@ -218,10 +218,10 @@ static rlm_rcode_t getUserNodeRef(request_t *request, char* inUserName, char **o } if (nodeRef != 0) dsCloseDirNode(nodeRef); - return result; + RETURN_MODULE_RCODE(result); } -rlm_rcode_t od_mschap_auth(request_t *request, fr_pair_t *challenge, fr_pair_t * usernamepair) +unlang_action_t od_mschap_auth(rlm_rcode_t *p_result, request_t *request, fr_pair_t *challenge, fr_pair_t * usernamepair) { rlm_rcode_t rcode = RLM_MODULE_OK; tDirStatus status = eDSNoErr; @@ -242,7 +242,7 @@ rlm_rcode_t od_mschap_auth(request_t *request, fr_pair_t *challenge, fr_pair_t * response = fr_pair_find_by_da(&request->request_pairs, attr_ms_chap2_response); username_string = talloc_array(request, char, usernamepair->vp_length + 1); - if (!username_string) return RLM_MODULE_FAIL; + if (!username_string) RETURN_MODULE_FAIL; strlcpy(username_string, usernamepair->vp_strvalue, usernamepair->vp_length + 1); @@ -250,10 +250,10 @@ rlm_rcode_t od_mschap_auth(request_t *request, fr_pair_t *challenge, fr_pair_t * if (status != eDSNoErr) { talloc_free(username_string); RERROR("Failed opening directory service"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } - rcode = getUserNodeRef(request, username_string, &short_user_name, &userNodeRef, dsRef); + getUserNodeRef(&rcode, request, username_string, &short_user_name, &userNodeRef, dsRef); if (rcode != RLM_MODULE_OK) { if (rcode != RLM_MODULE_NOOP) { RDEBUG2("od_mschap_auth: getUserNodeRef() failed"); @@ -262,7 +262,7 @@ rlm_rcode_t od_mschap_auth(request_t *request, fr_pair_t *challenge, fr_pair_t * talloc_free(username_string); if (dsRef != 0) dsCloseDirService(dsRef); - return rcode; + RETURN_MODULE_RCODE(rcode); } /* We got a node; fill the stepBuffer @@ -401,10 +401,10 @@ rlm_rcode_t od_mschap_auth(request_t *request, fr_pair_t *challenge, fr_pair_t * char *status_name = dsCopyDirStatusName(status); RERROR("Authentication failed - status = %s", status_name); free(status_name); - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } #endif /* __APPLE__ */ diff --git a/src/modules/rlm_mschap/rlm_mschap.c b/src/modules/rlm_mschap/rlm_mschap.c index fc01b0e2a40..0f2206d485f 100644 --- a/src/modules/rlm_mschap/rlm_mschap.c +++ b/src/modules/rlm_mschap/rlm_mschap.c @@ -1067,9 +1067,11 @@ ntlm_auth_err: * authentication is in one place, and we can perhaps later replace * it with code to call winbindd, or something similar. */ -static int CC_HINT(nonnull (1, 2, 4, 5, 6)) do_mschap(rlm_mschap_t const *inst, request_t *request, +static int CC_HINT(nonnull (1, 2, 4, 5, 6)) do_mschap(rlm_mschap_t const *inst, + request_t *request, fr_pair_t *password, - uint8_t const *challenge, uint8_t const *response, + uint8_t const *challenge, + uint8_t const *response, uint8_t nthashhash[static NT_DIGEST_LENGTH], MSCHAP_AUTH_METHOD method) { @@ -1128,25 +1130,25 @@ static int CC_HINT(nonnull (1, 2, 4, 5, 6)) do_mschap(rlm_mschap_t const *inst, */ p = strcasestr(buffer, "0xC0000"); if (p) { - int rcode = 0; + result = 0; p += 7; if (strcmp(p, "224") == 0) { - rcode = -648; + result = -648; } else if (strcmp(p, "234") == 0) { - rcode = -647; + result = -647; } else if (strcmp(p, "072") == 0) { - rcode = -691; + result = -691; } else if (strcasecmp(p, "05E") == 0) { - rcode = -2; + result = -2; } - if (rcode != 0) { + if (result != 0) { REDEBUG2("%s", buffer); - return rcode; + return result; } /* @@ -1370,34 +1372,34 @@ static void mppe_chap2_gen_keys128(uint8_t const *nt_hashhash, uint8_t const *re * it later. Add Auth-Type attribute if present in module * configuration (usually Auth-Type must be "MS-CHAP") */ -static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_mschap_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_mschap_t); fr_pair_t *challenge = NULL; challenge = fr_pair_find_by_da(&request->request_pairs, attr_ms_chap_challenge); - if (!challenge) return RLM_MODULE_NOOP; + if (!challenge) RETURN_MODULE_NOOP; if (!fr_pair_find_by_da(&request->request_pairs, attr_ms_chap_response) && !fr_pair_find_by_da(&request->request_pairs, attr_ms_chap2_response) && !fr_pair_find_by_da(&request->request_pairs, attr_ms_chap2_cpw)) { RDEBUG2("Found MS-CHAP-Challenge, but no MS-CHAP response or Change-Password"); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } if (!inst->auth_type) { WARN("No 'authenticate %s {...}' section or 'Auth-Type = %s' set. Cannot setup MS-CHAP authentication", inst->name, inst->name); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } - if (!module_section_type_set(request, attr_auth_type, inst->auth_type)) return RLM_MODULE_NOOP; + if (!module_section_type_set(request, attr_auth_type, inst->auth_type)) RETURN_MODULE_NOOP; - return RLM_MODULE_OK; + RETURN_MODULE_OK; } -static rlm_rcode_t mschap_error(rlm_mschap_t const *inst, request_t *request, unsigned char ident, - int mschap_result, int mschap_version, fr_pair_t *smb_ctrl) +static unlang_action_t mschap_error(rlm_rcode_t *p_result, rlm_mschap_t const *inst, request_t *request, + unsigned char ident, int mschap_result, int mschap_version, fr_pair_t *smb_ctrl) { rlm_rcode_t rcode = RLM_MODULE_OK; int error = 0; @@ -1458,7 +1460,7 @@ static rlm_rcode_t mschap_error(rlm_mschap_t const *inst, request_t *request, un rcode = RLM_MODULE_REJECT; } - if (rcode == RLM_MODULE_OK) return RLM_MODULE_OK; + if (rcode == RLM_MODULE_OK) RETURN_MODULE_OK; switch (mschap_version) { case 1: @@ -1474,11 +1476,11 @@ static rlm_rcode_t mschap_error(rlm_mschap_t const *inst, request_t *request, un break; default: - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } mschap_add_reply(request, ident, attr_ms_chap_error, buffer, strlen(buffer)); - return rcode; + RETURN_MODULE_RCODE(rcode); } @@ -1582,10 +1584,11 @@ found_password: * mschap_cpw_request_process() - do the work to handle an MS-CHAP password * change request. */ -static rlm_rcode_t CC_HINT(nonnull) mschap_process_cpw_request(rlm_mschap_t const *inst, - request_t *request, - fr_pair_t *cpw, - fr_pair_t *nt_password) +static unlang_action_t CC_HINT(nonnull) mschap_process_cpw_request(rlm_rcode_t *p_result, + rlm_mschap_t const *inst, + request_t *request, + fr_pair_t *cpw, + fr_pair_t *nt_password) { uint8_t new_nt_encrypted[516], old_nt_encrypted[NT_DIGEST_LENGTH]; fr_pair_t *nt_enc=NULL; @@ -1603,12 +1606,12 @@ static rlm_rcode_t CC_HINT(nonnull) mschap_process_cpw_request(rlm_mschap_t cons if (cpw->vp_length != 68) { REDEBUG("MS-CHAP2-CPW has the wrong format: length %zu != 68", cpw->vp_length); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } if (cpw->vp_octets[0] != 7) { REDEBUG("MS-CHAP2-CPW has the wrong format: code %d != 7", cpw->vp_octets[0]); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -1634,12 +1637,12 @@ static rlm_rcode_t CC_HINT(nonnull) mschap_process_cpw_request(rlm_mschap_t cons if (nt_enc->vp_length < 4) { REDEBUG("MS-CHAP-NT-Enc-PW with invalid format"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } if (nt_enc->vp_octets[0] != 6) { REDEBUG("MS-CHAP-NT-Enc-PW with invalid format"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } if ((nt_enc->vp_octets[2] == 0) && (nt_enc->vp_octets[3] == seq)) { @@ -1650,12 +1653,12 @@ static rlm_rcode_t CC_HINT(nonnull) mschap_process_cpw_request(rlm_mschap_t cons if (!found) { REDEBUG("Could not find MS-CHAP-NT-Enc-PW w/ sequence number %d", seq); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } if ((new_nt_enc_len + nt_enc->vp_length - 4) > sizeof(new_nt_encrypted)) { REDEBUG("Unpacked MS-CHAP-NT-Enc-PW length > 516"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } memcpy(new_nt_encrypted + new_nt_enc_len, nt_enc->vp_octets + 4, nt_enc->vp_length - 4); @@ -1664,7 +1667,7 @@ static rlm_rcode_t CC_HINT(nonnull) mschap_process_cpw_request(rlm_mschap_t cons if (new_nt_enc_len != 516) { REDEBUG("Unpacked MS-CHAP-NT-Enc-PW length != 516"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -1696,26 +1699,27 @@ static rlm_rcode_t CC_HINT(nonnull) mschap_process_cpw_request(rlm_mschap_t cons snprintf(buffer, sizeof(buffer), "E=709 R=0 M=Password change failed"); mschap_add_reply(request, cpw->vp_octets[1], attr_ms_chap_error, buffer, strlen(buffer)); - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; } RDEBUG2("Password change successful"); - return RLM_MODULE_OK; + RETURN_MODULE_OK; } -static rlm_rcode_t CC_HINT(nonnull(1,2,3,4,7,8)) mschap_process_response(int *mschap_version, - uint8_t nthashhash[static NT_DIGEST_LENGTH], - rlm_mschap_t const *inst, - request_t *request, - fr_pair_t *smb_ctrl, - fr_pair_t *nt_password, - fr_pair_t *challenge, - fr_pair_t *response, - MSCHAP_AUTH_METHOD method) +static CC_HINT(nonnull(1,2,3,4,5,8,9)) unlang_action_t mschap_process_response(rlm_rcode_t *p_result, + int *mschap_version, + uint8_t nthashhash[static NT_DIGEST_LENGTH], + rlm_mschap_t const *inst, + request_t *request, + fr_pair_t *smb_ctrl, + fr_pair_t *nt_password, + fr_pair_t *challenge, + fr_pair_t *response, + MSCHAP_AUTH_METHOD method) { int offset; - int mschap_result; + rlm_rcode_t mschap_result; *mschap_version = 1; @@ -1726,7 +1730,7 @@ static rlm_rcode_t CC_HINT(nonnull(1,2,3,4,7,8)) mschap_process_response(int *ms */ if (challenge->vp_length < 8) { REDEBUG("MS-CHAP-Challenge has the wrong format"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -1734,7 +1738,7 @@ static rlm_rcode_t CC_HINT(nonnull(1,2,3,4,7,8)) mschap_process_response(int *ms */ if (response->vp_length < 50) { REDEBUG("MS-CHAP-Response has the wrong format"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -1743,7 +1747,7 @@ static rlm_rcode_t CC_HINT(nonnull(1,2,3,4,7,8)) mschap_process_response(int *ms */ if (!(response->vp_octets[1] & 0x01)) { REDEBUG2("Client used unsupported method LM-Password"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } offset = 26; @@ -1753,21 +1757,23 @@ static rlm_rcode_t CC_HINT(nonnull(1,2,3,4,7,8)) mschap_process_response(int *ms */ mschap_result = do_mschap(inst, request, nt_password, challenge->vp_octets, response->vp_octets + offset, nthashhash, method); + /* * Check for errors, and add MSCHAP-Error if necessary. */ - return mschap_error(inst, request, *response->vp_octets, mschap_result, *mschap_version, smb_ctrl); + return mschap_error(p_result, inst, request, *response->vp_octets, mschap_result, *mschap_version, smb_ctrl); } -static rlm_rcode_t CC_HINT(nonnull(1,2,3,4,7,8)) mschap_process_v2_response(int *mschap_version, - uint8_t nthashhash[static NT_DIGEST_LENGTH], - rlm_mschap_t const *inst, - request_t *request, - fr_pair_t *smb_ctrl, - fr_pair_t *nt_password, - fr_pair_t *challenge, - fr_pair_t *response, - MSCHAP_AUTH_METHOD method) +static unlang_action_t CC_HINT(nonnull(1,2,3,4,5,8,9)) mschap_process_v2_response(rlm_rcode_t *p_result, + int *mschap_version, + uint8_t nthashhash[static NT_DIGEST_LENGTH], + rlm_mschap_t const *inst, + request_t *request, + fr_pair_t *smb_ctrl, + fr_pair_t *nt_password, + fr_pair_t *challenge, + fr_pair_t *response, + MSCHAP_AUTH_METHOD method) { uint8_t mschap_challenge[16]; fr_pair_t *user_name, *name_vp, *response_name, *peer_challenge_attr; @@ -1787,7 +1793,7 @@ static rlm_rcode_t CC_HINT(nonnull(1,2,3,4,7,8)) mschap_process_v2_response(int */ if (challenge->vp_length < 16) { REDEBUG("MS-CHAP-Challenge has the wrong format"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -1795,14 +1801,14 @@ static rlm_rcode_t CC_HINT(nonnull(1,2,3,4,7,8)) mschap_process_v2_response(int */ if (response->vp_length < 50) { REDEBUG("MS-CHAP-Response has the wrong format"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* * We also require a User-Name */ user_name = mschap_identity_find(request); - if (!user_name) return RLM_MODULE_FAIL; + if (!user_name) RETURN_MODULE_FAIL; /* * Check for MS-CHAP-User-Name and if found, use it @@ -1848,7 +1854,7 @@ static rlm_rcode_t CC_HINT(nonnull(1,2,3,4,7,8)) mschap_process_v2_response(int if (!nt_password && inst->open_directory) { RDEBUG2("No NT-Password available. Trying OpenDirectory Authentication"); rcode = od_mschap_auth(request, challenge, user_name); - if (rcode != RLM_MODULE_NOOP) return rcode; + if (rcode != RLM_MODULE_NOOP) RETURN_MODULE_RCODE(rcode); } #endif peer_challenge = response->vp_octets + 2; @@ -1879,9 +1885,9 @@ static rlm_rcode_t CC_HINT(nonnull(1,2,3,4,7,8)) mschap_process_v2_response(int /* * Check for errors, and add MSCHAP-Error if necessary. */ - rcode = mschap_error(inst, request, *response->vp_octets, - mschap_result, *mschap_version, smb_ctrl); - if (rcode != RLM_MODULE_OK) return rcode; + mschap_error(&rcode, inst, request, *response->vp_octets, + mschap_result, *mschap_version, smb_ctrl); + if (rcode != RLM_MODULE_OK) RETURN_MODULE_RCODE(rcode); #ifdef WITH_AUTH_WINBIND if (inst->wb_retry_with_normalised_username) { @@ -1906,7 +1912,7 @@ static rlm_rcode_t CC_HINT(nonnull(1,2,3,4,7,8)) mschap_process_v2_response(int msch2resp); /* calculated MPPE key */ mschap_add_reply(request, *response->vp_octets, attr_ms_chap2_success, msch2resp, 42); - return RLM_MODULE_OK; + RETURN_MODULE_OK; } /* @@ -1925,7 +1931,7 @@ static rlm_rcode_t CC_HINT(nonnull(1,2,3,4,7,8)) mschap_process_v2_response(int * MS-CHAP-Error for MS-CHAP or MS-CHAP v2 * If MS-CHAP2 succeeds we MUST return MS-CHAP2-Success */ -static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_mschap_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_mschap_t); fr_pair_t *challenge = NULL; @@ -1979,7 +1985,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r */ if ((smb_ctrl->vp_uint32 & ACB_PWNOTREQ) != 0) { RDEBUG2("SMB-Account-Ctrl says no password is required"); - return RLM_MODULE_OK; + RETURN_MODULE_OK; } } @@ -1990,7 +1996,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r * input attribute, and we're calling out to an * external password store. */ - if (nt_password_find(&ephemeral, &nt_password, mctx->instance, request) < 0) return RLM_MODULE_FAIL; + if (nt_password_find(&ephemeral, &nt_password, mctx->instance, request) < 0) RETURN_MODULE_FAIL; /* * Check to see if this is a change password request, and process @@ -2000,7 +2006,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r if (cpw) { uint8_t *p; - rcode = mschap_process_cpw_request(mctx->instance, request, cpw, nt_password); + mschap_process_cpw_request(&rcode, mctx->instance, request, cpw, nt_password); if (rcode != RLM_MODULE_OK) goto finish; /* @@ -2040,18 +2046,20 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r * We also require an MS-CHAP-Response. */ if ((response = fr_pair_find_by_da(&request->request_pairs, attr_ms_chap_response))) { - rcode = mschap_process_response(&mschap_version, nthashhash, - inst, request, - smb_ctrl, nt_password, - challenge, response, - method); + mschap_process_response(&rcode, + &mschap_version, nthashhash, + inst, request, + smb_ctrl, nt_password, + challenge, response, + method); if (rcode != RLM_MODULE_OK) goto finish; } else if ((response = fr_pair_find_by_da(&request->request_pairs, attr_ms_chap2_response))) { - rcode = mschap_process_v2_response(&mschap_version, nthashhash, - inst, request, - smb_ctrl, nt_password, - challenge, response, - method); + mschap_process_v2_response(&rcode, + &mschap_version, nthashhash, + inst, request, + smb_ctrl, nt_password, + challenge, response, + method); if (rcode != RLM_MODULE_OK) goto finish; } else { /* Neither CHAPv1 or CHAPv2 response: die */ REDEBUG("&control.Auth-Type = %s set for a request that does not contain &%s or &%s attributes", @@ -2110,7 +2118,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r finish: if (ephemeral) talloc_list_free(&nt_password); - return rcode; + RETURN_MODULE_RCODE(rcode); } /* diff --git a/src/modules/rlm_opendirectory/rlm_opendirectory.c b/src/modules/rlm_opendirectory/rlm_opendirectory.c index 67b960e8275..44530c8764a 100644 --- a/src/modules/rlm_opendirectory/rlm_opendirectory.c +++ b/src/modules/rlm_opendirectory/rlm_opendirectory.c @@ -306,7 +306,7 @@ static long od_check_passwd(request_t *request, char const *uname, char const *p * Check the users password against the standard UNIX * password table. */ -static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(UNUSED module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authenticate(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request) { int ret; long odResult = eDSAuthFailed; @@ -321,12 +321,12 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(UNUSED module_ctx_t const * */ if (!username) { REDEBUG("Attribute \"User-Name\" is required for authentication"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } if (!password) { REDEBUG("Attribute \"User-Password\" is required for authentication"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -334,7 +334,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(UNUSED module_ctx_t const * */ if (password->vp_length == 0) { REDEBUG("User-Password must not be empty"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -375,14 +375,14 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(UNUSED module_ctx_t const * return ret; } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } /* * member of the radius group? */ -static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_opendirectory_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_opendirectory_t); struct passwd *userdata = NULL; @@ -403,7 +403,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, requ username = fr_pair_find_by_da(&request->request_pairs, attr_user_name); if (!username) { RDEBUG2("OpenDirectory requires a User-Name attribute"); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } /* resolve SACL */ @@ -415,7 +415,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, requ err = mbr_gid_to_uuid(gid, guid_sacl); if (err != 0) { REDEBUG("The group \"%s\" does not have a GUID", kRadiusSACLName); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } } @@ -434,12 +434,12 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, requ groupdata = getgrnam(rad_client->community); if (!groupdata) { REDEBUG("The group \"%s\" does not exist on this system", rad_client->community); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } err = mbr_gid_to_uuid(groupdata->gr_gid, guid_nasgroup); if (err != 0) { REDEBUG("The group \"%s\" does not have a GUID", rad_client->community); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } } } @@ -473,19 +473,19 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, requ if (uuid_is_null(uuid)) { REDEBUG("Could not get the user's uuid"); - return RLM_MODULE_NOTFOUND; + RETURN_MODULE_NOTFOUND; } if (!uuid_is_null(guid_sacl)) { err = mbr_check_service_membership(uuid, kRadiusServiceName, &ismember); if (err != 0) { REDEBUG("Failed to check group membership"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } if (ismember == 0) { REDEBUG("User is not authorized"); - return RLM_MODULE_DISALLOW; + RETURN_MODULE_DISALLOW; } } @@ -493,12 +493,12 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, requ err = mbr_check_membership_refresh(uuid, guid_nasgroup, &ismember); if (err != 0) { REDEBUG("Failed to check group membership"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } if (ismember == 0) { REDEBUG("User is not authorized"); - return RLM_MODULE_DISALLOW; + RETURN_MODULE_DISALLOW; } } @@ -506,12 +506,12 @@ setup_auth_type: if (!inst->auth_type) { WARN("No 'authenticate %s {...}' section or 'Auth-Type = %s' set. Cannot setup OpenDirectory authentication", inst->name, inst->name); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } - if (!module_section_type_set(request, attr_auth_type, inst->auth_type)) return RLM_MODULE_NOOP; + if (!module_section_type_set(request, attr_auth_type, inst->auth_type)) RETURN_MODULE_NOOP; - return RLM_MODULE_OK; + RETURN_MODULE_OK; } static int mod_bootstrap(void *instance, CONF_SECTION *conf) diff --git a/src/modules/rlm_pam/rlm_pam.c b/src/modules/rlm_pam/rlm_pam.c index f00fdfeb942..2d2ce3fa51f 100644 --- a/src/modules/rlm_pam/rlm_pam.c +++ b/src/modules/rlm_pam/rlm_pam.c @@ -211,7 +211,7 @@ static int do_pam(request_t *request, char const *username, char const *passwd, return 0; } -static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_pam_t const *data = talloc_get_type_abort_const(mctx->instance, rlm_pam_t); int ret; @@ -229,12 +229,12 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r */ if (!username) { REDEBUG("Attribute \"User-Name\" is required for authentication"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } if (!password) { REDEBUG("Attribute \"User-Password\" is required for authentication"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -242,7 +242,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r */ if (password->vp_length == 0) { REDEBUG("User-Password must not be empty"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -262,9 +262,9 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r if (pair) pam_auth_string = pair->vp_strvalue; ret = do_pam(request, username->vp_strvalue, password->vp_strvalue, pam_auth_string); - if (ret < 0) return RLM_MODULE_REJECT; + if (ret < 0) RETURN_MODULE_REJECT; - return RLM_MODULE_OK; + RETURN_MODULE_OK; } extern module_t rlm_pam; diff --git a/src/modules/rlm_pap/rlm_pap.c b/src/modules/rlm_pap/rlm_pap.c index 57e54d20392..4cef97092f8 100644 --- a/src/modules/rlm_pap/rlm_pap.c +++ b/src/modules/rlm_pap/rlm_pap.c @@ -59,7 +59,7 @@ typedef struct { bool normify; } rlm_pap_t; -typedef rlm_rcode_t (*pap_auth_func_t)(rlm_pap_t const *, request_t *, fr_pair_t const *, fr_pair_t const *); +typedef unlang_action_t (*pap_auth_func_t)(rlm_rcode_t *p_result, rlm_pap_t const *inst, request_t *request, fr_pair_t const *, fr_pair_t const *); static const CONF_PARSER module_config[] = { { FR_CONF_OFFSET("normalise", FR_TYPE_BOOL, rlm_pap_t, normify), .dflt = "yes" }, @@ -121,70 +121,73 @@ static fr_dict_attr_t const **pap_allowed_passwords; * This isn't strictly necessary, but it does make the * server simpler to configure. */ -static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_pap_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_pap_t); fr_pair_t *password; if (fr_pair_find_by_da(&request->control_pairs, attr_auth_type) != NULL) { RDEBUG3("Auth-Type is already set. Not setting 'Auth-Type := %s'", inst->name); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } password = fr_pair_find_by_da(&request->request_pairs, attr_user_password); if (!password) { RDEBUG2("No %s attribute in the request. Cannot do PAP", attr_user_password->name); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } if (!inst->auth_type) { WARN("No 'authenticate %s {...}' section or 'Auth-Type = %s' set. Cannot setup PAP authentication.", inst->name, inst->name); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } - if (!module_section_type_set(request, attr_auth_type, inst->auth_type)) return RLM_MODULE_NOOP; + if (!module_section_type_set(request, attr_auth_type, inst->auth_type)) RETURN_MODULE_NOOP; - return RLM_MODULE_UPDATED; + RETURN_MODULE_UPDATED; } /* * PAP authentication functions */ -static rlm_rcode_t CC_HINT(nonnull) pap_auth_clear(UNUSED rlm_pap_t const *inst, request_t *request, - fr_pair_t const *known_good, fr_pair_t const *password) +static unlang_action_t CC_HINT(nonnull) pap_auth_clear(rlm_rcode_t *p_result, + UNUSED rlm_pap_t const *inst, request_t *request, + fr_pair_t const *known_good, fr_pair_t const *password) { if ((known_good->vp_length != password->vp_length) || (fr_digest_cmp(known_good->vp_octets, password->vp_octets, known_good->vp_length) != 0)) { REDEBUG("Cleartext password does not match \"known good\" password"); REDEBUG3("Password : %pV", &password->data); REDEBUG3("Expected : %pV", &known_good->data); - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } #ifdef HAVE_CRYPT -static rlm_rcode_t CC_HINT(nonnull) pap_auth_crypt(UNUSED rlm_pap_t const *inst, request_t *request, - fr_pair_t const *known_good, fr_pair_t const *password) +static unlang_action_t CC_HINT(nonnull) pap_auth_crypt(rlm_rcode_t *p_result, + UNUSED rlm_pap_t const *inst, request_t *request, + fr_pair_t const *known_good, fr_pair_t const *password) { if (fr_crypt_check(password->vp_strvalue, known_good->vp_strvalue) != 0) { REDEBUG("Crypt digest does not match \"known good\" digest"); - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } #endif -static rlm_rcode_t CC_HINT(nonnull) pap_auth_md5(UNUSED rlm_pap_t const *inst, request_t *request, - fr_pair_t const *known_good, fr_pair_t const *password) +static unlang_action_t CC_HINT(nonnull) pap_auth_md5(rlm_rcode_t *p_result, + UNUSED rlm_pap_t const *inst, request_t *request, + fr_pair_t const *known_good, fr_pair_t const *password) { uint8_t digest[MD5_DIGEST_LENGTH]; if (known_good->vp_length != MD5_DIGEST_LENGTH) { REDEBUG("\"known-good\" MD5 password has incorrect length, expected 16 got %zu", known_good->vp_length); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } fr_md5_calc(digest, password->vp_octets, password->vp_length); @@ -194,22 +197,23 @@ static rlm_rcode_t CC_HINT(nonnull) pap_auth_md5(UNUSED rlm_pap_t const *inst, r REDEBUG3("Password : %pV", &password->data); REDEBUG3("Calculated : %pH", fr_box_octets(digest, MD5_DIGEST_LENGTH)); REDEBUG3("Expected : %pH", fr_box_octets(known_good->vp_octets, MD5_DIGEST_LENGTH)); - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } -static rlm_rcode_t CC_HINT(nonnull) pap_auth_smd5(UNUSED rlm_pap_t const *inst, request_t *request, - fr_pair_t const *known_good, fr_pair_t const *password) +static unlang_action_t CC_HINT(nonnull) pap_auth_smd5(rlm_rcode_t *p_result, + UNUSED rlm_pap_t const *inst, request_t *request, + fr_pair_t const *known_good, fr_pair_t const *password) { fr_md5_ctx_t *md5_ctx; uint8_t digest[MD5_DIGEST_LENGTH]; if (known_good->vp_length <= MD5_DIGEST_LENGTH) { REDEBUG("\"known-good\" SMD5-Password has incorrect length, expected 16 got %zu", known_good->vp_length); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } md5_ctx = fr_md5_ctx_alloc(true); @@ -226,21 +230,22 @@ static rlm_rcode_t CC_HINT(nonnull) pap_auth_smd5(UNUSED rlm_pap_t const *inst, REDEBUG3("Password : %pV", &password->data); REDEBUG3("Calculated : %pH", fr_box_octets(digest, MD5_DIGEST_LENGTH)); REDEBUG3("Expected : %pH", fr_box_octets(known_good->vp_octets, MD5_DIGEST_LENGTH)); - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } -static rlm_rcode_t CC_HINT(nonnull) pap_auth_sha1(UNUSED rlm_pap_t const *inst, request_t *request, - fr_pair_t const *known_good, fr_pair_t const *password) +static unlang_action_t CC_HINT(nonnull) pap_auth_sha1(rlm_rcode_t *p_result, + UNUSED rlm_pap_t const *inst, request_t *request, + fr_pair_t const *known_good, fr_pair_t const *password) { fr_sha1_ctx sha1_context; uint8_t digest[SHA1_DIGEST_LENGTH]; if (known_good->vp_length != SHA1_DIGEST_LENGTH) { REDEBUG("\"known-good\" SHA1-password has incorrect length, expected 20 got %zu", known_good->vp_length); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } fr_sha1_init(&sha1_context); @@ -252,21 +257,22 @@ static rlm_rcode_t CC_HINT(nonnull) pap_auth_sha1(UNUSED rlm_pap_t const *inst, REDEBUG3("Password : %pV", &password->data); REDEBUG3("Calculated : %pH", fr_box_octets(digest, SHA1_DIGEST_LENGTH)); REDEBUG3("Expected : %pH", fr_box_octets(known_good->vp_octets, SHA1_DIGEST_LENGTH)); - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } -static rlm_rcode_t CC_HINT(nonnull) pap_auth_ssha1(UNUSED rlm_pap_t const *inst, request_t *request, - fr_pair_t const *known_good, fr_pair_t const *password) +static unlang_action_t CC_HINT(nonnull) pap_auth_ssha1(rlm_rcode_t *p_result, + UNUSED rlm_pap_t const *inst, request_t *request, + fr_pair_t const *known_good, fr_pair_t const *password) { fr_sha1_ctx sha1_context; uint8_t digest[SHA1_DIGEST_LENGTH]; if (known_good->vp_length <= SHA1_DIGEST_LENGTH) { REDEBUG("\"known-good\" SSHA-Password has incorrect length, expected > 20 got %zu", known_good->vp_length); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } fr_sha1_init(&sha1_context); @@ -282,16 +288,17 @@ static rlm_rcode_t CC_HINT(nonnull) pap_auth_ssha1(UNUSED rlm_pap_t const *inst, known_good->vp_length - SHA1_DIGEST_LENGTH)); REDEBUG3("Calculated : %pH", fr_box_octets(digest, SHA1_DIGEST_LENGTH)); REDEBUG3("Expected : %pH", fr_box_octets(known_good->vp_octets, SHA1_DIGEST_LENGTH)); - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } #ifdef HAVE_OPENSSL_EVP_H -static rlm_rcode_t CC_HINT(nonnull) pap_auth_evp_md(UNUSED rlm_pap_t const *inst, request_t *request, - fr_pair_t const *known_good, fr_pair_t const *password, - char const *name, EVP_MD const *md) +static unlang_action_t CC_HINT(nonnull) pap_auth_evp_md(rlm_rcode_t *p_result, + UNUSED rlm_pap_t const *inst, request_t *request, + fr_pair_t const *known_good, fr_pair_t const *password, + char const *name, EVP_MD const *md) { EVP_MD_CTX *ctx; uint8_t digest[EVP_MAX_MD_SIZE]; @@ -310,15 +317,16 @@ static rlm_rcode_t CC_HINT(nonnull) pap_auth_evp_md(UNUSED rlm_pap_t const *inst REDEBUG3("Password : %pV", &password->data); REDEBUG3("Calculated : %pH", fr_box_octets(digest, digest_len)); REDEBUG3("Expected : %pH", &known_good->data); - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } -static rlm_rcode_t CC_HINT(nonnull) pap_auth_evp_md_salted(UNUSED rlm_pap_t const *inst, request_t *request, - fr_pair_t const *known_good, fr_pair_t const *password, - char const *name, EVP_MD const *md) +static unlang_action_t CC_HINT(nonnull) pap_auth_evp_md_salted(rlm_rcode_t *p_result, + UNUSED rlm_pap_t const *inst, request_t *request, + fr_pair_t const *known_good, fr_pair_t const *password, + char const *name, EVP_MD const *md) { EVP_MD_CTX *ctx; uint8_t digest[EVP_MAX_MD_SIZE]; @@ -344,20 +352,21 @@ static rlm_rcode_t CC_HINT(nonnull) pap_auth_evp_md_salted(UNUSED rlm_pap_t cons fr_box_octets(known_good->vp_octets + digest_len, known_good->vp_length - digest_len)); REDEBUG3("Calculated : %pH", fr_box_octets(digest, digest_len)); REDEBUG3("Expected : %pH", fr_box_octets(known_good->vp_octets, digest_len)); - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } /** Define a new OpenSSL EVP based password hashing function * */ #define PAP_AUTH_EVP_MD(_func, _new_func, _name, _md) \ -static rlm_rcode_t CC_HINT(nonnull) _new_func(rlm_pap_t const *inst, request_t *request, \ - fr_pair_t const *known_good, fr_pair_t const *password) \ -{ \ - return _func(inst, request, known_good, password, _name, _md); \ +static unlang_action_t CC_HINT(nonnull) _new_func(rlm_rcode_t *p_result, \ + rlm_pap_t const *inst, request_t *request, \ + fr_pair_t const *known_good, fr_pair_t const *password) \ +{ \ + return _func(p_result, inst, request, known_good, password, _name, _md); \ } PAP_AUTH_EVP_MD(pap_auth_evp_md, pap_auth_sha2_224, "SHA2-224", EVP_sha224()) @@ -382,6 +391,7 @@ PAP_AUTH_EVP_MD(pap_auth_evp_md_salted, pap_auth_ssha3_512, "SSHA3-512", EVP_sha /** Validates Crypt::PBKDF2 LDAP format strings * + * @param[out] p_result The result of comparing the pbkdf2 hash with the password. * @param[in] request The current request. * @param[in] str Raw PBKDF2 string. * @param[in] len Length of string. @@ -396,10 +406,11 @@ PAP_AUTH_EVP_MD(pap_auth_evp_md_salted, pap_auth_ssha3_512, "SSHA3-512", EVP_sha * - RLM_MODULE_REJECT * - RLM_MODULE_OK */ -static inline rlm_rcode_t CC_HINT(nonnull) pap_auth_pbkdf2_parse(request_t *request, const uint8_t *str, size_t len, - fr_table_num_sorted_t const hash_names[], size_t hash_names_len, - char scheme_sep, char iter_sep, char salt_sep, - bool iter_is_base64, fr_pair_t const *password) +static inline CC_HINT(nonnull) unlang_action_t pap_auth_pbkdf2_parse(rlm_rcode_t *p_result, + request_t *request, const uint8_t *str, size_t len, + fr_table_num_sorted_t const hash_names[], size_t hash_names_len, + char scheme_sep, char iter_sep, char salt_sep, + bool iter_is_base64, fr_pair_t const *password) { rlm_rcode_t rcode = RLM_MODULE_INVALID; @@ -607,18 +618,19 @@ static inline rlm_rcode_t CC_HINT(nonnull) pap_auth_pbkdf2_parse(request_t *requ finish: talloc_free(salt); - return rcode; + RETURN_MODULE_RCODE(rcode); } -static inline rlm_rcode_t CC_HINT(nonnull) pap_auth_pbkdf2(UNUSED rlm_pap_t const *inst, - request_t *request, - fr_pair_t const *known_good, fr_pair_t const *password) +static inline unlang_action_t CC_HINT(nonnull) pap_auth_pbkdf2(rlm_rcode_t *p_result, + UNUSED rlm_pap_t const *inst, + request_t *request, + fr_pair_t const *known_good, fr_pair_t const *password) { uint8_t const *p = known_good->vp_octets, *q, *end = p + known_good->vp_length; if (end - p < 2) { REDEBUG("PBKDF2-Password too short"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -635,7 +647,7 @@ static inline rlm_rcode_t CC_HINT(nonnull) pap_auth_pbkdf2(UNUSED rlm_pap_t cons q = memchr(p, '}', end - p); p = q + 1; } - return pap_auth_pbkdf2_parse(request, p, end - p, + return pap_auth_pbkdf2_parse(p_result, request, p, end - p, pbkdf2_crypt_names, pbkdf2_crypt_names_len, ':', ':', ':', true, password); } @@ -647,7 +659,7 @@ static inline rlm_rcode_t CC_HINT(nonnull) pap_auth_pbkdf2(UNUSED rlm_pap_t cons */ if ((size_t)(end - p) >= sizeof("$PBKDF2$") && (memcmp(p, "$PBKDF2$", sizeof("$PBKDF2$") - 1) == 0)) { p += sizeof("$PBKDF2$") - 1; - return pap_auth_pbkdf2_parse(request, p, end - p, + return pap_auth_pbkdf2_parse(p_result, request, p, end - p, pbkdf2_crypt_names, pbkdf2_crypt_names_len, ':', ':', '$', false, password); } @@ -661,19 +673,20 @@ static inline rlm_rcode_t CC_HINT(nonnull) pap_auth_pbkdf2(UNUSED rlm_pap_t cons */ if ((size_t)(end - p) >= sizeof("$pbkdf2-") && (memcmp(p, "$pbkdf2-", sizeof("$pbkdf2-") - 1) == 0)) { p += sizeof("$pbkdf2-") - 1; - return pap_auth_pbkdf2_parse(request, p, end - p, + return pap_auth_pbkdf2_parse(p_result, request, p, end - p, pbkdf2_passlib_names, pbkdf2_passlib_names_len, '$', '$', '$', false, password); } REDEBUG("Can't determine format of PBKDF2-Password"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } #endif -static rlm_rcode_t CC_HINT(nonnull) pap_auth_nt(UNUSED rlm_pap_t const *inst, request_t *request, - fr_pair_t const *known_good, fr_pair_t const *password) +static unlang_action_t CC_HINT(nonnull) pap_auth_nt(rlm_rcode_t *p_result, + UNUSED rlm_pap_t const *inst, request_t *request, + fr_pair_t const *known_good, fr_pair_t const *password) { ssize_t len; uint8_t digest[MD4_DIGEST_LENGTH]; @@ -685,14 +698,14 @@ static rlm_rcode_t CC_HINT(nonnull) pap_auth_nt(UNUSED rlm_pap_t const *inst, re if (known_good->vp_length != MD4_DIGEST_LENGTH) { REDEBUG("\"known good\" NT-Password has incorrect length, expected 16 got %zu", known_good->vp_length); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } len = fr_utf8_to_ucs2(ucs2_password, sizeof(ucs2_password), password->vp_strvalue, password->vp_length); if (len < 0) { REDEBUG("User-Password is not in UCS2 format"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } fr_md4_calc(digest, (uint8_t *)ucs2_password, len); @@ -701,14 +714,15 @@ static rlm_rcode_t CC_HINT(nonnull) pap_auth_nt(UNUSED rlm_pap_t const *inst, re REDEBUG("NT digest does not match \"known good\" digest"); REDEBUG3("Calculated : %pH", fr_box_octets(digest, sizeof(digest))); REDEBUG3("Expected : %pH", &known_good->data); - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } -static rlm_rcode_t CC_HINT(nonnull) pap_auth_lm(UNUSED rlm_pap_t const *inst, request_t *request, - fr_pair_t const *known_good, UNUSED fr_pair_t const *password) +static unlang_action_t CC_HINT(nonnull) pap_auth_lm(rlm_rcode_t *p_result, + UNUSED rlm_pap_t const *inst, request_t *request, + fr_pair_t const *known_good, UNUSED fr_pair_t const *password) { uint8_t digest[MD4_DIGEST_LENGTH]; char charbuf[32 + 1]; @@ -718,11 +732,11 @@ static rlm_rcode_t CC_HINT(nonnull) pap_auth_lm(UNUSED rlm_pap_t const *inst, re if (known_good->vp_length != MD4_DIGEST_LENGTH) { REDEBUG("\"known good\" LM-Password has incorrect length, expected 16 got %zu", known_good->vp_length); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } len = xlat_eval(charbuf, sizeof(charbuf), request, "%{mschap:LM-Hash %{User-Password}}", NULL, NULL); - if (len < 0) return RLM_MODULE_FAIL; + if (len < 0) RETURN_MODULE_FAIL; if ((fr_hex2bin(NULL, &FR_DBUFF_TMP(digest, sizeof(digest)), &FR_SBUFF_IN(charbuf, len), false) != (ssize_t)known_good->vp_length) || @@ -730,14 +744,15 @@ static rlm_rcode_t CC_HINT(nonnull) pap_auth_lm(UNUSED rlm_pap_t const *inst, re REDEBUG("LM digest does not match \"known good\" digest"); REDEBUG3("Calculated : %pH", fr_box_octets(digest, sizeof(digest))); REDEBUG3("Expected : %pH", &known_good->data); - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } -static rlm_rcode_t CC_HINT(nonnull) pap_auth_ns_mta_md5(UNUSED rlm_pap_t const *inst, request_t *request, - fr_pair_t const *known_good, fr_pair_t const *password) +static unlang_action_t CC_HINT(nonnull) pap_auth_ns_mta_md5(rlm_rcode_t *p_result, + UNUSED rlm_pap_t const *inst, request_t *request, + fr_pair_t const *known_good, fr_pair_t const *password) { uint8_t digest[128]; uint8_t buff[FR_MAX_STRING_LEN]; @@ -748,7 +763,7 @@ static rlm_rcode_t CC_HINT(nonnull) pap_auth_ns_mta_md5(UNUSED rlm_pap_t const * if (known_good->vp_length != 64) { REDEBUG("\"known good\" NS-MTA-MD5-Password has incorrect length, expected 64 got %zu", known_good->vp_length); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -757,7 +772,7 @@ static rlm_rcode_t CC_HINT(nonnull) pap_auth_ns_mta_md5(UNUSED rlm_pap_t const * if (fr_hex2bin(NULL, &FR_DBUFF_TMP(digest, sizeof(digest)), &FR_SBUFF_IN(known_good->vp_strvalue, known_good->vp_length), false) != 16) { REDEBUG("\"known good\" NS-MTA-MD5-Password has invalid value"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -767,7 +782,7 @@ static rlm_rcode_t CC_HINT(nonnull) pap_auth_ns_mta_md5(UNUSED rlm_pap_t const * */ if (password->vp_length >= (sizeof(buff) - 2 - 2 * 32)) { REDEBUG("\"known good\" NS-MTA-MD5-Password is too long"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -790,19 +805,20 @@ static rlm_rcode_t CC_HINT(nonnull) pap_auth_ns_mta_md5(UNUSED rlm_pap_t const * if (fr_digest_cmp(digest, buff, 16) != 0) { REDEBUG("NS-MTA-MD5 digest does not match \"known good\" digest"); - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } /** Auth func for password types that should have been normalised away * */ -static rlm_rcode_t CC_HINT(nonnull) pap_auth_dummy(UNUSED rlm_pap_t const *inst, UNUSED request_t *request, - UNUSED fr_pair_t const *known_good, UNUSED fr_pair_t const *password) +static unlang_action_t CC_HINT(nonnull) pap_auth_dummy(rlm_rcode_t *p_result, + UNUSED rlm_pap_t const *inst, UNUSED request_t *request, + UNUSED fr_pair_t const *known_good, UNUSED fr_pair_t const *password) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /** Table of password types we can process @@ -852,7 +868,7 @@ static const pap_auth_func_t auth_func_table[] = { /* * Authenticate the user via one of any well-known password. */ -static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_pap_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_pap_t); fr_pair_t *known_good; @@ -864,7 +880,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r password = fr_pair_find_by_da(&request->request_pairs, attr_user_password); if (!password) { REDEBUG("You set 'Auth-Type = PAP' for a request that does not contain a User-Password attribute!"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -872,7 +888,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r */ if (password->vp_length == 0) { REDEBUG("Password must not be empty"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } if (RDEBUG_ENABLED3) { @@ -892,7 +908,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r inst->normify); if (!known_good) { REDEBUG("No \"known good\" password found for user"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } fr_assert(known_good->da->attr < NUM_ELEMENTS(auth_func_table)); @@ -909,7 +925,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r /* * Authenticate, and return. */ - rcode = auth_func(inst, request, known_good, password); + auth_func(&rcode, inst, request, known_good, password); if (ephemeral) talloc_list_free(&known_good); switch (rcode) { case RLM_MODULE_REJECT: @@ -924,7 +940,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r break; } - return rcode; + RETURN_MODULE_RCODE(rcode); } static int mod_bootstrap(void *instance, CONF_SECTION *conf) diff --git a/src/modules/rlm_passwd/rlm_passwd.c b/src/modules/rlm_passwd/rlm_passwd.c index c3c0091ea4c..bee77d99d19 100644 --- a/src/modules/rlm_passwd/rlm_passwd.c +++ b/src/modules/rlm_passwd/rlm_passwd.c @@ -532,7 +532,7 @@ static void result_add(TALLOC_CTX *ctx, rlm_passwd_t const *inst, request_t *req } } -static rlm_rcode_t CC_HINT(nonnull) mod_passwd_map(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_passwd_map(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_passwd_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_passwd_t); @@ -543,7 +543,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_passwd_map(module_ctx_t const *mctx, req int found = 0; key = fr_pair_find_by_da(&request->request_pairs, inst->keyattr); - if (!key) return RLM_MODULE_NOTFOUND; + if (!key) RETURN_MODULE_NOTFOUND; for (i = fr_cursor_iter_by_da_init(&cursor, &key, inst->keyattr); i; @@ -573,9 +573,9 @@ static rlm_rcode_t CC_HINT(nonnull) mod_passwd_map(module_ctx_t const *mctx, req if (!inst->allow_multiple) break; } - if (!found) return RLM_MODULE_NOTFOUND; + if (!found) RETURN_MODULE_NOTFOUND; - return RLM_MODULE_OK; + RETURN_MODULE_OK; } extern module_t rlm_passwd; diff --git a/src/modules/rlm_perl/rlm_perl.c b/src/modules/rlm_perl/rlm_perl.c index 3039f35cca6..db27e9af5e2 100644 --- a/src/modules/rlm_perl/rlm_perl.c +++ b/src/modules/rlm_perl/rlm_perl.c @@ -821,7 +821,7 @@ static int get_hv_content(TALLOC_CTX *ctx, request_t *request, HV *my_hv, fr_pai * Store all vps in hashes %RAD_CONFIG %RAD_REPLY %RAD_REQUEST * */ -static int do_perl(void *instance, request_t *request, char const *function_name) +static unlang_action_t do_perl(rlm_rcode_t *p_result, void *instance, request_t *request, char const *function_name) { rlm_perl_t *inst = instance; @@ -838,7 +838,7 @@ static int do_perl(void *instance, request_t *request, char const *function_name * Radius has told us to call this function, but none * is defined. */ - if (!function_name) return RLM_MODULE_FAIL; + if (!function_name) RETURN_MODULE_FAIL; #ifdef USE_ITHREADS pthread_mutex_lock(&inst->clone_mutex); @@ -934,14 +934,14 @@ static int do_perl(void *instance, request_t *request, char const *function_name vp = NULL; } } - return exitstatus; + RETURN_MODULE_RCODE(exitstatus); } #define RLM_PERL_FUNC(_x) \ -static rlm_rcode_t CC_HINT(nonnull) mod_##_x(module_ctx_t const *mctx, request_t *request) \ +static unlang_action_t CC_HINT(nonnull) mod_##_x(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) \ { \ rlm_perl_t *inst = talloc_get_type_abort(mctx->instance, rlm_perl_t); \ - return do_perl(inst, request, inst->func_##_x); \ + return do_perl(p_result, inst, request, inst->func_##_x); \ } RLM_PERL_FUNC(authorize) @@ -952,7 +952,7 @@ RLM_PERL_FUNC(preacct) /* * Write accounting information to this modules database. */ -static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_accounting(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_perl_t *inst = talloc_get_type_abort(mctx->instance, rlm_perl_t); fr_pair_t *pair; @@ -963,26 +963,26 @@ static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, req acct_status_type = pair->vp_uint32; } else { REDEBUG("Invalid Accounting Packet"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } switch (acct_status_type) { case FR_STATUS_START: if (inst->func_start_accounting) { - return do_perl(inst, request, inst->func_start_accounting); + return do_perl(p_result, inst, request, inst->func_start_accounting); } else { - return do_perl(inst, request, inst->func_accounting); + return do_perl(p_result, inst, request, inst->func_accounting); } case FR_STATUS_STOP: if (inst->func_stop_accounting) { - return do_perl(inst, request, inst->func_stop_accounting); + return do_perl(p_result, inst, request, inst->func_stop_accounting); } else { - return do_perl(inst, request, inst->func_accounting); + return do_perl(p_result, inst, request, inst->func_accounting); } default: - return do_perl(inst, request, inst->func_accounting); + return do_perl(p_result, inst, request, inst->func_accounting); } } diff --git a/src/modules/rlm_python/rlm_python.c b/src/modules/rlm_python/rlm_python.c index a7b0e705b32..1a9b7610143 100644 --- a/src/modules/rlm_python/rlm_python.c +++ b/src/modules/rlm_python/rlm_python.c @@ -488,7 +488,8 @@ static int mod_populate_vptuple(rlm_python_t const *inst, request_t *request, Py return 0; } -static rlm_rcode_t do_python_single(rlm_python_t const *inst, request_t *request, PyObject *p_func, char const *funcname) +static unlang_action_t do_python_single(rlm_rcode_t *p_result, + rlm_python_t const *inst, request_t *request, PyObject *p_func, char const *funcname) { fr_cursor_t cursor; fr_pair_t *vp; @@ -614,38 +615,38 @@ finish: Py_XDECREF(p_arg); Py_XDECREF(p_ret); - return rcode; + RETURN_MODULE_RCODE(rcode); } /** Thread safe call to a python function * * Will swap in thread state specific to module/thread. */ -static rlm_rcode_t do_python(rlm_python_t const *inst, rlm_python_thread_t *this_thread, - request_t *request, PyObject *p_func, char const *funcname) +static unlang_action_t do_python(rlm_rcode_t *p_result, rlm_python_t const *inst, rlm_python_thread_t *this_thread, + request_t *request, PyObject *p_func, char const *funcname) { rlm_rcode_t rcode; /* * It's a NOOP if the function wasn't defined */ - if (!p_func) return RLM_MODULE_NOOP; + if (!p_func) RETURN_MODULE_NOOP; RDEBUG3("Using thread state %p/%p", inst, this_thread->state); PyEval_RestoreThread(this_thread->state); /* Swap in our local thread state */ - rcode = do_python_single(inst, request, p_func, funcname); + do_python_single(&rcode, inst, request, p_func, funcname); (void)fr_cond_assert(PyEval_SaveThread() == this_thread->state); - return rcode; + RETURN_MODULE_RCODE(rcode); } #define MOD_FUNC(x) \ -static rlm_rcode_t CC_HINT(nonnull) mod_##x(module_ctx_t const *mctx, request_t *request) \ +static unlang_action_t CC_HINT(nonnull) mod_##x(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) \ { \ rlm_python_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_python_t); \ rlm_python_thread_t *thread = talloc_get_type_abort(mctx->thread, rlm_python_thread_t); \ - return do_python(inst, thread, request, inst->x.function, #x);\ + return do_python(p_result, inst, thread, request, inst->x.function, #x);\ } MOD_FUNC(authenticate) @@ -1110,7 +1111,7 @@ static int mod_instantiate(void *instance, CONF_SECTION *conf) if (inst->instantiate.function) { rlm_rcode_t rcode; - rcode = do_python_single(inst, NULL, inst->instantiate.function, "instantiate"); + do_python_single(&rcode, inst, NULL, inst->instantiate.function, "instantiate"); switch (rcode) { case RLM_MODULE_FAIL: case RLM_MODULE_REJECT: @@ -1152,7 +1153,11 @@ static int mod_detach(void *instance) /* * We don't care if this fails. */ - if (inst->detach.function) (void)do_python_single(inst, NULL, inst->detach.function, "detach"); + if (inst->detach.function) { + rlm_rcode_t rcode; + + (void)do_python_single(&rcode, inst, NULL, inst->detach.function, "detach"); + } #define PYTHON_FUNC_DESTROY(_x) python_function_destroy(&inst->_x) PYTHON_FUNC_DESTROY(instantiate); diff --git a/src/modules/rlm_radius/rlm_radius.c b/src/modules/rlm_radius/rlm_radius.c index f664c518f83..8fddd740f6a 100644 --- a/src/modules/rlm_radius/rlm_radius.c +++ b/src/modules/rlm_radius/rlm_radius.c @@ -384,12 +384,12 @@ static void mod_radius_signal(module_ctx_t const *mctx, request_t *request, void /** Continue after unlang_interpret_resumable() * */ -static rlm_rcode_t mod_radius_resume(module_ctx_t const *mctx, request_t *request, void *ctx) +static unlang_action_t mod_radius_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, void *ctx) { rlm_radius_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_radius_t); rlm_radius_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_radius_thread_t); - return inst->io->resume(&(module_ctx_t){.instance = inst->io_instance, .thread = t->io_thread }, request, ctx); + return inst->io->resume(p_result, &(module_ctx_t){.instance = inst->io_instance, .thread = t->io_thread }, request, ctx); } /** Do any RADIUS-layer fixups for proxying. @@ -430,7 +430,7 @@ static void radius_fixups(rlm_radius_t const *inst, request_t *request) /** Send packets outbound. * */ -static rlm_rcode_t CC_HINT(nonnull) mod_process(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_process(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_radius_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_radius_t); rlm_radius_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_radius_thread_t); @@ -440,7 +440,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_process(module_ctx_t const *mctx, reques if (!request->packet->code) { REDEBUG("You MUST specify a packet code"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* @@ -449,24 +449,24 @@ static rlm_rcode_t CC_HINT(nonnull) mod_process(module_ctx_t const *mctx, reques */ if (request->packet->code == FR_CODE_STATUS_SERVER) { REDEBUG("Cannot proxy Status-Server packets"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } if ((request->packet->code >= FR_RADIUS_MAX_PACKET_CODE) || !inst->retry[request->packet->code].irt) { /* can't be zero */ REDEBUG("Invalid packet code %d", request->packet->code); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } if (!inst->allowed[request->packet->code]) { REDEBUG("Packet code %s is disallowed by the configuration", fr_packet_codes[request->packet->code]); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } if (request->client->dynamic && !request->client->active) { REDEBUG("Cannot proxy packets which define dynamic clients"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* @@ -483,10 +483,10 @@ static rlm_rcode_t CC_HINT(nonnull) mod_process(module_ctx_t const *mctx, reques * return another code which indicates what happened to * the request...b */ - rcode = inst->io->enqueue(&rctx, inst->io_instance, t->io_thread, request); + inst->io->enqueue(&rcode, &rctx, inst->io_instance, t->io_thread, request); if (rcode != RLM_MODULE_YIELD) { fr_assert(rctx == NULL); - return rcode; + RETURN_MODULE_RCODE(rcode); } return unlang_module_yield(request, mod_radius_resume, mod_radius_signal, rctx); diff --git a/src/modules/rlm_radius/rlm_radius.h b/src/modules/rlm_radius/rlm_radius.h index 4b5691ffe9a..ac53908d48a 100644 --- a/src/modules/rlm_radius/rlm_radius.h +++ b/src/modules/rlm_radius/rlm_radius.h @@ -82,7 +82,7 @@ struct rlm_radius_s { /** Enqueue a request_t to an IO submodule * */ -typedef rlm_rcode_t (*rlm_radius_io_enqueue_t)(void **rctx, void *instance, void *thread, request_t *request); +typedef unlang_action_t (*rlm_radius_io_enqueue_t)(rlm_rcode_t *p_result, void **rctx, void *instance, void *thread, request_t *request); /** Public structure describing an I/O path for an outgoing socket. * diff --git a/src/modules/rlm_radius/rlm_radius_udp.c b/src/modules/rlm_radius/rlm_radius_udp.c index 955b71b458b..bf767c2166a 100644 --- a/src/modules/rlm_radius/rlm_radius_udp.c +++ b/src/modules/rlm_radius/rlm_radius_udp.c @@ -1137,21 +1137,21 @@ static int8_t request_prioritise(void const *one, void const *two) { udp_request_t const *a = one; udp_request_t const *b = two; - int8_t rcode; + int8_t ret; // @todo - prioritize packets if there's a state? /* * Prioritise status check packets */ - rcode = (b->status_check - a->status_check);; - if (rcode != 0) return rcode; + ret = (b->status_check - a->status_check);; + if (ret != 0) return ret; /* * Larger priority is more important. */ - rcode = (a->priority < b->priority) - (a->priority > b->priority); - if (rcode != 0) return rcode; + ret = (a->priority < b->priority) - (a->priority > b->priority); + if (ret != 0) return ret; /* * Smaller timestamp (i.e. earlier) is more important. @@ -2590,14 +2590,14 @@ static void request_free(UNUSED request_t *request, void *preq_to_free, UNUSED v /** Resume execution of the request, returning the rcode set during trunk execution * */ -static rlm_rcode_t mod_resume(UNUSED module_ctx_t const *mctx, UNUSED request_t *request, void *rctx) +static unlang_action_t mod_resume(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, UNUSED request_t *request, void *rctx) { udp_result_t *r = talloc_get_type_abort(rctx, udp_result_t); rlm_rcode_t rcode = r->rcode; talloc_free(rctx); - return rcode; + RETURN_MODULE_RCODE(rcode); } static void mod_signal(module_ctx_t const *mctx, UNUSED request_t *request, @@ -2664,7 +2664,7 @@ static int _udp_request_free(udp_request_t *u) return 0; } -static rlm_rcode_t mod_enqueue(void **rctx_out, void *instance, void *thread, request_t *request) +static unlang_action_t mod_enqueue(rlm_rcode_t *p_result, void **rctx_out, void *instance, void *thread, request_t *request) { rlm_radius_udp_t *inst = talloc_get_type_abort(instance, rlm_radius_udp_t); udp_thread_t *t = talloc_get_type_abort(thread, udp_thread_t); @@ -2677,11 +2677,11 @@ static rlm_rcode_t mod_enqueue(void **rctx_out, void *instance, void *thread, re if (request->packet->code == FR_CODE_STATUS_SERVER) { RWDEBUG("Status-Server is reserved for internal use, and cannot be sent manually."); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } treq = fr_trunk_request_alloc(t->trunk, request); - if (!treq) return RLM_MODULE_FAIL; + if (!treq) RETURN_MODULE_FAIL; MEM(r = talloc_zero(request, udp_result_t)); MEM(u = talloc(treq, udp_request_t)); @@ -2714,7 +2714,7 @@ static rlm_rcode_t mod_enqueue(void **rctx_out, void *instance, void *thread, re fr_assert(!u->rr && !u->packet); /* Should not have been fed to the muxer */ fr_trunk_request_free(&treq); /* Return to the free list */ talloc_free(r); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } r->treq = treq; /* Remember for signalling purposes */ @@ -2722,7 +2722,7 @@ static rlm_rcode_t mod_enqueue(void **rctx_out, void *instance, void *thread, re *rctx_out = r; - return RLM_MODULE_YIELD; + return UNLANG_ACTION_YIELD; } /** Instantiate thread data for the submodule. diff --git a/src/modules/rlm_radutmp/rlm_radutmp.c b/src/modules/rlm_radutmp/rlm_radutmp.c index c5f052e29a7..9b90907fa11 100644 --- a/src/modules/rlm_radutmp/rlm_radutmp.c +++ b/src/modules/rlm_radutmp/rlm_radutmp.c @@ -104,7 +104,7 @@ fr_dict_attr_autoload_t rlm_radutmp_dict_attr[] = { /* * Zap all users on a NAS from the radutmp file. */ -static rlm_rcode_t radutmp_zap(request_t *request, char const *filename, uint32_t nasaddr, time_t t) +static unlang_action_t radutmp_zap(rlm_rcode_t *p_result, request_t *request, char const *filename, uint32_t nasaddr, time_t t) { struct radutmp u; int fd; @@ -114,7 +114,7 @@ static rlm_rcode_t radutmp_zap(request_t *request, char const *filename, uint32_ fd = open(filename, O_RDWR); if (fd < 0) { REDEBUG("Error accessing file %s: %s", filename, fr_syserror(errno)); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* @@ -123,7 +123,7 @@ static rlm_rcode_t radutmp_zap(request_t *request, char const *filename, uint32_ if (rad_lockfd(fd, LOCK_LEN) < 0) { REDEBUG("Failed to acquire lock on file %s: %s", filename, fr_syserror(errno)); close(fd); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* @@ -147,12 +147,12 @@ static rlm_rcode_t radutmp_zap(request_t *request, char const *filename, uint32_ REDEBUG("Failed writing: %s", fr_syserror(errno)); close(fd); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } } close(fd); /* and implicitely release the locks */ - return RLM_MODULE_OK; + RETURN_MODULE_OK; } /* @@ -175,7 +175,7 @@ static NAS_PORT *nas_port_find(NAS_PORT *nas_port_list, uint32_t nasaddr, uint16 /* * Store logins in the RADIUS utmp file. */ -static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_accounting(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_radutmp_t *inst = talloc_get_type_abort(mctx->instance, rlm_radutmp_t); rlm_rcode_t rcode = RLM_MODULE_OK; @@ -198,7 +198,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, req if (request->packet->socket.inet.src_ipaddr.af != AF_INET) { RDEBUG2("IPv6 not supported!"); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } /* @@ -206,7 +206,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, req */ if ((vp = fr_pair_find_by_da(&request->request_pairs, attr_acct_status_type)) == NULL) { RDEBUG2("No Accounting-Status-Type record"); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } status = vp->vp_uint32; @@ -325,7 +325,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, req */ filename = NULL; if (xlat_aeval(request, &filename, request, inst->filename, NULL, NULL) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* @@ -336,14 +336,14 @@ static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, req */ if (status == FR_STATUS_ACCOUNTING_ON && (ut.nas_address != htonl(INADDR_NONE))) { RIDEBUG("NAS %s restarted (Accounting-On packet seen)", nas); - rcode = radutmp_zap(request, filename, ut.nas_address, ut.time); + radutmp_zap(&rcode, request, filename, ut.nas_address, ut.time); goto finish; } if (status == FR_STATUS_ACCOUNTING_OFF && (ut.nas_address != htonl(INADDR_NONE))) { RIDEBUG("NAS %s rebooted (Accounting-Off packet seen)", nas); - rcode = radutmp_zap(request, filename, ut.nas_address, ut.time); + radutmp_zap(&rcode, request, filename, ut.nas_address, ut.time); goto finish; } @@ -544,7 +544,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, req close(fd); /* and implicitely release the locks */ } - return rcode; + RETURN_MODULE_RCODE(rcode); } /* globally exported name */ diff --git a/src/modules/rlm_redis_ippool/rlm_redis_ippool.c b/src/modules/rlm_redis_ippool/rlm_redis_ippool.c index 3f5eac9ed1a..8e181826539 100644 --- a/src/modules/rlm_redis_ippool/rlm_redis_ippool.c +++ b/src/modules/rlm_redis_ippool/rlm_redis_ippool.c @@ -1046,7 +1046,7 @@ static inline ssize_t ippool_pool_name(uint8_t const **out, uint8_t buff[], size return slen; } -static rlm_rcode_t mod_action(rlm_redis_ippool_t const *inst, request_t *request, ippool_action_t action) +static unlang_action_t mod_action(rlm_rcode_t *p_result, rlm_redis_ippool_t const *inst, request_t *request, ippool_action_t action) { uint8_t key_prefix_buff[IPPOOL_MAX_KEY_PREFIX_SIZE], owner_buff[256], gateway_id_buff[256]; uint8_t const *key_prefix, *owner = NULL, *gateway_id = NULL; @@ -1059,8 +1059,8 @@ static rlm_rcode_t mod_action(rlm_redis_ippool_t const *inst, request_t *request char *q; slen = ippool_pool_name(&key_prefix, (uint8_t *)&key_prefix_buff, sizeof(key_prefix_len), inst, request); - if (slen < 0) return RLM_MODULE_FAIL; - if (slen == 0) return RLM_MODULE_NOOP; + if (slen < 0) RETURN_MODULE_FAIL; + if (slen == 0) RETURN_MODULE_NOOP; key_prefix_len = (size_t)slen; @@ -1070,7 +1070,7 @@ static rlm_rcode_t mod_action(rlm_redis_ippool_t const *inst, request_t *request request, inst->owner, NULL, NULL); if (slen < 0) { REDEBUG("Failed expanding device (%s)", inst->owner->name); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } owner_len = (size_t)slen; } @@ -1081,7 +1081,7 @@ static rlm_rcode_t mod_action(rlm_redis_ippool_t const *inst, request_t *request request, inst->gateway_id, NULL, NULL); if (slen < 0) { REDEBUG("Failed expanding gateway (%s)", inst->gateway_id->name); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } gateway_id_len = (size_t)slen; } @@ -1091,13 +1091,13 @@ static rlm_rcode_t mod_action(rlm_redis_ippool_t const *inst, request_t *request if (tmpl_expand(&expires_str, expires_buff, sizeof(expires_buff), request, inst->offer_time, NULL, NULL) < 0) { REDEBUG("Failed expanding offer_time (%s)", inst->offer_time->name); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } expires = strtoul(expires_str, &q, 10); if (q != (expires_str + strlen(expires_str))) { REDEBUG("Invalid offer_time. Must be an integer value"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } ippool_action_print(request, action, L_DBG_LVL_2, key_prefix, key_prefix_len, NULL, @@ -1107,14 +1107,14 @@ static rlm_rcode_t mod_action(rlm_redis_ippool_t const *inst, request_t *request gateway_id, gateway_id_len, (uint32_t)expires)) { case IPPOOL_RCODE_SUCCESS: RDEBUG2("IP address lease allocated"); - return RLM_MODULE_UPDATED; + RETURN_MODULE_UPDATED; case IPPOOL_RCODE_POOL_EMPTY: RWDEBUG("Pool contains no free addresses"); - return RLM_MODULE_NOTFOUND; + RETURN_MODULE_NOTFOUND; default: - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } case POOL_ACTION_UPDATE: @@ -1125,23 +1125,23 @@ static rlm_rcode_t mod_action(rlm_redis_ippool_t const *inst, request_t *request if (tmpl_expand(&expires_str, expires_buff, sizeof(expires_buff), request, inst->lease_time, NULL, NULL) < 0) { REDEBUG("Failed expanding lease_time (%s)", inst->lease_time->name); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } expires = strtoul(expires_str, &q, 10); if (q != (expires_str + strlen(expires_str))) { REDEBUG("Invalid expires. Must be an integer value"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } if (tmpl_expand(&ip_str, ip_buff, sizeof(ip_buff), request, inst->requested_address, NULL, NULL) < 0) { REDEBUG("Failed expanding requested_address (%s)", inst->requested_address->name); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } if (fr_inet_pton(&ip, ip_str, -1, AF_UNSPEC, false, true) < 0) { RPEDEBUG("Failed parsing address"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } ippool_action_print(request, action, L_DBG_LVL_2, key_prefix, key_prefix_len, @@ -1169,9 +1169,9 @@ static rlm_rcode_t mod_action(rlm_redis_ippool_t const *inst, request_t *request fr_value_box_strdup_shallow(&ip_rhs.data.literal, NULL, ip_str, false); - if (map_to_request(request, &ip_map, map_to_vp, NULL) < 0) return RLM_MODULE_FAIL; + if (map_to_request(request, &ip_map, map_to_vp, NULL) < 0) RETURN_MODULE_FAIL; } - return RLM_MODULE_UPDATED; + RETURN_MODULE_UPDATED; /* * It's useful to be able to identify the 'not found' case @@ -1180,18 +1180,18 @@ static rlm_rcode_t mod_action(rlm_redis_ippool_t const *inst, request_t *request */ case IPPOOL_RCODE_NOT_FOUND: REDEBUG("Requested IP address \"%s\" is not a member of the specified pool", ip_str); - return RLM_MODULE_NOTFOUND; + RETURN_MODULE_NOTFOUND; case IPPOOL_RCODE_EXPIRED: REDEBUG("Requested IP address' \"%s\" lease already expired at time of renewal", ip_str); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; case IPPOOL_RCODE_DEVICE_MISMATCH: REDEBUG("Requested IP address' \"%s\" lease allocated to another device", ip_str); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; default: - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } } @@ -1202,12 +1202,12 @@ static rlm_rcode_t mod_action(rlm_redis_ippool_t const *inst, request_t *request if (tmpl_expand(&ip_str, ip_buff, sizeof(ip_buff), request, inst->requested_address, NULL, NULL) < 0) { REDEBUG("Failed expanding requested_address (%s)", inst->requested_address->name); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } if (fr_inet_pton(&ip, ip_str, -1, AF_UNSPEC, false, true) < 0) { RPEDEBUG("Failed parsing address"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } ippool_action_print(request, action, L_DBG_LVL_2, key_prefix, key_prefix_len, @@ -1216,7 +1216,7 @@ static rlm_rcode_t mod_action(rlm_redis_ippool_t const *inst, request_t *request &ip, owner, owner_len)) { case IPPOOL_RCODE_SUCCESS: RDEBUG2("IP address \"%s\" released", ip_str); - return RLM_MODULE_UPDATED; + RETURN_MODULE_UPDATED; /* * It's useful to be able to identify the 'not found' case @@ -1225,28 +1225,28 @@ static rlm_rcode_t mod_action(rlm_redis_ippool_t const *inst, request_t *request */ case IPPOOL_RCODE_NOT_FOUND: REDEBUG("Requested IP address \"%s\" is not a member of the specified pool", ip_str); - return RLM_MODULE_NOTFOUND; + RETURN_MODULE_NOTFOUND; case IPPOOL_RCODE_DEVICE_MISMATCH: REDEBUG("Requested IP address' \"%s\" lease allocated to another device", ip_str); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; default: - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } } case POOL_ACTION_BULK_RELEASE: RDEBUG2("Bulk release not yet implemented"); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; default: fr_assert(0); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } } -static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_accounting(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_redis_ippool_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_redis_ippool_t); fr_pair_t *vp; @@ -1255,7 +1255,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, req * Pool-Action override */ vp = fr_pair_find_by_da(&request->control_pairs, attr_pool_action); - if (vp) return mod_action(inst, request, vp->vp_uint32); + if (vp) return mod_action(p_result, inst, request, vp->vp_uint32); /* * Otherwise, guess the action by Acct-Status-Type @@ -1263,27 +1263,27 @@ static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, req vp = fr_pair_find_by_da(&request->request_pairs, attr_acct_status_type); if (!vp) { RDEBUG2("Couldn't find &request.Acct-Status-Type or &control.Pool-Action, doing nothing..."); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } switch (vp->vp_uint32) { case FR_STATUS_START: case FR_STATUS_ALIVE: - return mod_action(inst, request, POOL_ACTION_UPDATE); + return mod_action(p_result, inst, request, POOL_ACTION_UPDATE); case FR_STATUS_STOP: - return mod_action(inst, request, POOL_ACTION_RELEASE); + return mod_action(p_result, inst, request, POOL_ACTION_RELEASE); case FR_STATUS_ACCOUNTING_OFF: case FR_STATUS_ACCOUNTING_ON: - return mod_action(inst, request, POOL_ACTION_BULK_RELEASE); + return mod_action(p_result, inst, request, POOL_ACTION_BULK_RELEASE); default: - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } } -static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_redis_ippool_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_redis_ippool_t); fr_pair_t *vp; @@ -1293,10 +1293,10 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, requ * when called in Post-Auth. */ vp = fr_pair_find_by_da(&request->control_pairs, attr_pool_action); - return mod_action(inst, request, vp ? vp->vp_uint32 : POOL_ACTION_ALLOCATE); + return mod_action(p_result, inst, request, vp ? vp->vp_uint32 : POOL_ACTION_ALLOCATE); } -static rlm_rcode_t CC_HINT(nonnull) mod_post_auth(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_post_auth(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_redis_ippool_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_redis_ippool_t); fr_pair_t *vp; @@ -1313,7 +1313,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_post_auth(module_ctx_t const *mctx, requ } else { RWDEBUG("Ignoring invalid action %d", vp->vp_uint32); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } } else if (request->dict == dict_dhcpv4) { @@ -1324,10 +1324,10 @@ static rlm_rcode_t CC_HINT(nonnull) mod_post_auth(module_ctx_t const *mctx, requ } run: - return mod_action(inst, request, action); + return mod_action(p_result, inst, request, action); } -static rlm_rcode_t CC_HINT(nonnull) mod_request(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_request(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_redis_ippool_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_redis_ippool_t); fr_pair_t *vp; @@ -1338,7 +1338,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_request(module_ctx_t const *mctx, reques */ vp = fr_pair_find_by_da(&request->control_pairs, attr_pool_action); - return mod_action(inst, request, vp ? vp->vp_uint32 : POOL_ACTION_UPDATE); + return mod_action(p_result, inst, request, vp ? vp->vp_uint32 : POOL_ACTION_UPDATE); } static int mod_instantiate(void *instance, CONF_SECTION *conf) diff --git a/src/modules/rlm_rediswho/rlm_rediswho.c b/src/modules/rlm_rediswho/rlm_rediswho.c index 593e4e55001..5178d314094 100644 --- a/src/modules/rlm_rediswho/rlm_rediswho.c +++ b/src/modules/rlm_rediswho/rlm_rediswho.c @@ -177,26 +177,26 @@ static int rediswho_command(rlm_rediswho_t const *inst, request_t *request, char return ret; } -static rlm_rcode_t mod_accounting_all(rlm_rediswho_t const *inst, request_t *request, - char const *insert, - char const *trim, - char const *expire) +static unlang_action_t mod_accounting_all(rlm_rcode_t *p_result, rlm_rediswho_t const *inst, request_t *request, + char const *insert, + char const *trim, + char const *expire) { int ret; ret = rediswho_command(inst, request, insert); - if (ret < 0) return RLM_MODULE_FAIL; + if (ret < 0) RETURN_MODULE_FAIL; /* Only trim if necessary */ if ((inst->trim_count >= 0) && (ret > inst->trim_count)) { - if (rediswho_command(inst, request, trim) < 0) return RLM_MODULE_FAIL; + if (rediswho_command(inst, request, trim) < 0) RETURN_MODULE_FAIL; } - if (rediswho_command(inst, request, expire) < 0) return RLM_MODULE_FAIL; - return RLM_MODULE_OK; + if (rediswho_command(inst, request, expire) < 0) RETURN_MODULE_FAIL; + RETURN_MODULE_OK; } -static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_accounting(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_rediswho_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_rediswho_t); rlm_rcode_t rcode; @@ -208,28 +208,26 @@ static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, req vp = fr_pair_find_by_da(&request->request_pairs, attr_acct_status_type); if (!vp) { RDEBUG2("Could not find account status type in packet"); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } dv = fr_dict_enum_by_value(vp->da, &vp->data); if (!dv) { RDEBUG2("Unknown Acct-Status-Type %u", vp->vp_uint32); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } cs = cf_section_find(inst->cs, dv->name, NULL); if (!cs) { RDEBUG2("No subsection %s", dv->name); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } insert = cf_pair_value(cf_pair_find(cs, "insert")); trim = cf_pair_value(cf_pair_find(cs, "trim")); expire = cf_pair_value(cf_pair_find(cs, "expire")); - rcode = mod_accounting_all(inst, request, insert, trim, expire); - - return rcode; + return mod_accounting_all(&rcode, inst, request, insert, trim, expire); } static int mod_bootstrap(void *instance, CONF_SECTION *conf) diff --git a/src/modules/rlm_rest/rlm_rest.c b/src/modules/rlm_rest/rlm_rest.c index 1e462e4a54b..1aa1c6264c2 100644 --- a/src/modules/rlm_rest/rlm_rest.c +++ b/src/modules/rlm_rest/rlm_rest.c @@ -424,7 +424,7 @@ static xlat_action_t rest_xlat(TALLOC_CTX *ctx, UNUSED fr_cursor_t *out, return unlang_xlat_yield(request, rest_xlat_resume, rest_io_xlat_signal, rctx); } -static rlm_rcode_t mod_authorize_result(module_ctx_t const *mctx, request_t *request, void *rctx) +static unlang_action_t mod_authorize_result(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, void *rctx) { rlm_rest_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_rest_t); rlm_rest_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_rest_thread_t); @@ -432,7 +432,7 @@ static rlm_rcode_t mod_authorize_result(module_ctx_t const *mctx, request_t *req fr_curl_io_request_t *handle = talloc_get_type_abort(rctx, fr_curl_io_request_t); int hcode; - int rcode = RLM_MODULE_OK; + rlm_rcode_t rcode = RLM_MODULE_OK; int ret; if (section->tls.extract_cert_attrs) fr_curl_response_certinfo(request, handle); @@ -504,7 +504,7 @@ finish: fr_pool_connection_release(t->pool, request, handle); - return rcode; + RETURN_MODULE_RCODE(rcode); } /* @@ -513,7 +513,7 @@ finish: * from the database. The authentication code only needs to check * the password, the rest is done here. */ -static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_rest_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_rest_t); rlm_rest_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_rest_thread_t); @@ -522,23 +522,24 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, requ void *handle; int ret; - if (!section->name) return RLM_MODULE_NOOP; + if (!section->name) RETURN_MODULE_NOOP; handle = fr_pool_connection_get(t->pool, request); - if (!handle) return RLM_MODULE_FAIL; + if (!handle) RETURN_MODULE_FAIL; ret = rlm_rest_perform(inst, t, section, handle, request, NULL, NULL); if (ret < 0) { rest_request_cleanup(inst, handle); fr_pool_connection_release(t->pool, request, handle); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } return unlang_module_yield(request, mod_authorize_result, rest_io_module_action, handle); } -static rlm_rcode_t mod_authenticate_result(module_ctx_t const *mctx, request_t *request, void *rctx) +static unlang_action_t mod_authenticate_result(rlm_rcode_t *p_result, + module_ctx_t const *mctx, request_t *request, void *rctx) { rlm_rest_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_rest_t); rlm_rest_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_rest_thread_t); @@ -618,13 +619,13 @@ finish: fr_pool_connection_release(t->pool, request, handle); - return rcode; + RETURN_MODULE_RCODE(rcode); } /* * Authenticate the user with the given password. */ -static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_rest_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_rest_t); rlm_rest_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_rest_thread_t); @@ -636,7 +637,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r fr_pair_t const *username; fr_pair_t const *password; - if (!section->name) return RLM_MODULE_NOOP; + if (!section->name) RETURN_MODULE_NOOP; username = fr_pair_find_by_da(&request->request_pairs, attr_user_name); password = fr_pair_find_by_da(&request->request_pairs, attr_user_password); @@ -647,12 +648,12 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r */ if (!username) { REDEBUG("Attribute \"User-Name\" is required for authentication"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } if (!password) { REDEBUG("Attribute \"User-Password\" is required for authentication"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -660,7 +661,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r */ if (password->vp_length == 0) { REDEBUG("User-Password must not be empty"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -673,7 +674,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r } handle = fr_pool_connection_get(t->pool, request); - if (!handle) return RLM_MODULE_FAIL; + if (!handle) RETURN_MODULE_FAIL; ret = rlm_rest_perform(inst, t, section, handle, request, username->vp_strvalue, password->vp_strvalue); @@ -681,13 +682,14 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r rest_request_cleanup(inst, handle); fr_pool_connection_release(t->pool, request, handle); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } return unlang_module_yield(request, mod_authenticate_result, NULL, handle); } -static rlm_rcode_t mod_accounting_result(module_ctx_t const *mctx, request_t *request, void *rctx) +static unlang_action_t mod_accounting_result(rlm_rcode_t *p_result, + module_ctx_t const *mctx, request_t *request, void *rctx) { rlm_rest_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_rest_t); rlm_rest_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_rest_thread_t); @@ -735,13 +737,13 @@ finish: fr_pool_connection_release(t->pool, request, handle); - return rcode; + RETURN_MODULE_RCODE(rcode); } /* * Send accounting info to a REST API endpoint */ -static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_accounting(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_rest_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_rest_t); rlm_rest_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_rest_thread_t); @@ -750,23 +752,24 @@ static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, req void *handle; int ret; - if (!section->name) return RLM_MODULE_NOOP; + if (!section->name) RETURN_MODULE_NOOP; handle = fr_pool_connection_get(t->pool, request); - if (!handle) return RLM_MODULE_FAIL; + if (!handle) RETURN_MODULE_FAIL; ret = rlm_rest_perform(inst, t, section, handle, request, NULL, NULL); if (ret < 0) { rest_request_cleanup(inst, handle); fr_pool_connection_release(t->pool, request, handle); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } return unlang_module_yield(request, mod_accounting_result, NULL, handle); } -static rlm_rcode_t mod_post_auth_result(module_ctx_t const *mctx, request_t *request, void *rctx) +static unlang_action_t mod_post_auth_result(rlm_rcode_t *p_result, module_ctx_t const *mctx, + request_t *request, void *rctx) { rlm_rest_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_rest_t); rlm_rest_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_rest_thread_t); @@ -814,13 +817,13 @@ finish: fr_pool_connection_release(t->pool, request, handle); - return rcode; + RETURN_MODULE_RCODE(rcode); } /* * Send post-auth info to a REST API endpoint */ -static rlm_rcode_t CC_HINT(nonnull) mod_post_auth(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_post_auth(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_rest_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_rest_t); rlm_rest_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_rest_thread_t); @@ -829,10 +832,10 @@ static rlm_rcode_t CC_HINT(nonnull) mod_post_auth(module_ctx_t const *mctx, requ void *handle; int ret; - if (!section->name) return RLM_MODULE_NOOP; + if (!section->name) RETURN_MODULE_NOOP; handle = fr_pool_connection_get(t->pool, request); - if (!handle) return RLM_MODULE_FAIL; + if (!handle) RETURN_MODULE_FAIL; ret = rlm_rest_perform(inst, t, section, handle, request, NULL, NULL); if (ret < 0) { @@ -840,7 +843,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_post_auth(module_ctx_t const *mctx, requ fr_pool_connection_release(t->pool, request, handle); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } return unlang_module_yield(request, mod_post_auth_result, NULL, handle); diff --git a/src/modules/rlm_securid/rlm_securid.c b/src/modules/rlm_securid/rlm_securid.c index c65daa216e2..ed94e442202 100644 --- a/src/modules/rlm_securid/rlm_securid.c +++ b/src/modules/rlm_securid/rlm_securid.c @@ -78,15 +78,15 @@ static SD_CHAR empty_pin[] = ""; /* comparison function to find session in the tree */ static int securid_session_cmp(void const *a, void const *b) { - int rcode; + int ret; SECURID_SESSION const *one = a; SECURID_SESSION const *two = b; fr_assert(one != NULL); fr_assert(two != NULL); - rcode = fr_ipaddr_cmp(&one->src_ipaddr, &two->src_ipaddr); - if (rcode != 0) return rcode; + ret = fr_ipaddr_cmp(&one->src_ipaddr, &two->src_ipaddr); + if (ret != 0) return ret; return memcmp(one->state, two->state, sizeof(one->state)); } @@ -465,7 +465,7 @@ static int mod_instantiate(void *instance, UNUSED CONF_SECTION *conf) /* * Authenticate the user via one of any well-known password. */ -static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { int rcode; rlm_securid_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_securid_t); @@ -482,12 +482,12 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r */ if (!username) { REDEBUG("Attribute \"User-Name\" is required for authentication"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } if (!password) { REDEBUG("Attribute \"User-Password\" is required for authentication"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -495,7 +495,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r */ if (password->vp_length == 0) { REDEBUG("Password should not be empty"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } if (RDEBUG_ENABLED3) { @@ -537,7 +537,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r MEM(pair_update_reply(&vp, attr_reply_message) >= 0); fr_pair_value_strdup(vp, buffer); } - return rcode; + RETURN_MODULE_RCODE(rcode); } diff --git a/src/modules/rlm_sigtran/client.c b/src/modules/rlm_sigtran/client.c index cb5616be0e8..63d6824e9f5 100644 --- a/src/modules/rlm_sigtran/client.c +++ b/src/modules/rlm_sigtran/client.c @@ -284,7 +284,7 @@ static void sigtran_client_signal(UNUSED module_ctx_t const *mctx, UNUSED reques txn->ctx.request = NULL; /* remove the link to the (now dead) request */ } -static rlm_rcode_t sigtran_client_map_resume(UNUSED module_ctx_t const *mctx, request_t *request, void *rctx) +static unlang_action_t sigtran_client_map_resume(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request, void *rctx) { sigtran_transaction_t *txn = talloc_get_type_abort(rctx, sigtran_transaction_t); rlm_rcode_t rcode; @@ -401,7 +401,7 @@ static rlm_rcode_t sigtran_client_map_resume(UNUSED module_ctx_t const *mctx, re } talloc_free(txn); - return rcode; + RETURN_MODULE_RCODE(rcode); } /** Create a MAP_SEND_AUTH_INFO request @@ -434,7 +434,7 @@ rlm_rcode_t sigtran_client_map_send_auth_info(rlm_sigtran_t const *inst, request ERROR("Failed retrieving version"); error: talloc_free(txn); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } switch (req->version) { diff --git a/src/modules/rlm_sigtran/rlm_sigtran.c b/src/modules/rlm_sigtran/rlm_sigtran.c index b5787f34dfb..a106a42e85b 100644 --- a/src/modules/rlm_sigtran/rlm_sigtran.c +++ b/src/modules/rlm_sigtran/rlm_sigtran.c @@ -198,7 +198,7 @@ fr_dict_attr_autoload_t rlm_sigtran_dict_attr[] = { { NULL } }; -static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_sigtran_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_sigtran_t); rlm_sigtran_thread_t const *t = talloc_get_type_abort_const(mctx->thread, rlm_sigtran_thread_t); diff --git a/src/modules/rlm_smtp/rlm_smtp.c b/src/modules/rlm_smtp/rlm_smtp.c index 50c3ab24da9..2b8d00158fa 100644 --- a/src/modules/rlm_smtp/rlm_smtp.c +++ b/src/modules/rlm_smtp/rlm_smtp.c @@ -105,12 +105,12 @@ typedef struct { static int cf_table_parse_tmpl(UNUSED TALLOC_CTX *ctx, void *out, UNUSED void *parent, CONF_ITEM *ci, CONF_PARSER const *rule) { - int rcode = 0; - ssize_t slen; - int type = rule->type; - bool tmpl = (type & FR_TYPE_TMPL); - CONF_PAIR *cp = cf_item_to_pair(ci); - tmpl_t *vpt; + int ret = 0; + ssize_t slen; + int type = rule->type; + bool tmpl = (type & FR_TYPE_TMPL); + CONF_PAIR *cp = cf_item_to_pair(ci); + tmpl_t *vpt; static tmpl_rules_t rules = { .allow_unknown = true, @@ -120,7 +120,7 @@ static int cf_table_parse_tmpl(UNUSED TALLOC_CTX *ctx, void *out, UNUSED void *p if (!tmpl) { cf_log_err(cp, "Failed parsing attribute reference"); - rcode = -1; + ret = -1; goto finish; } @@ -142,19 +142,19 @@ static int cf_table_parse_tmpl(UNUSED TALLOC_CTX *ctx, void *out, UNUSED void *p talloc_free(spaces); talloc_free(text); /* Return error */ - rcode = -1; + ret = -1; goto finish; } if(tmpl_is_list(vpt)) { - rcode = -1; + ret = -1; goto finish; } /* Only string values should be used for SMTP components */ if(tmpl_expanded_type(vpt) != FR_TYPE_STRING) { cf_log_err(cp, "Attribute reference must be a string"); - rcode = -1; + ret = -1; goto finish; } @@ -163,7 +163,7 @@ static int cf_table_parse_tmpl(UNUSED TALLOC_CTX *ctx, void *out, UNUSED void *p cp->parsed = true; finish: - return rcode; + return ret; } /* @@ -690,7 +690,7 @@ static int _free_mail_ctx(fr_mail_ctx *uctx) /* * Check if the email was successfully sent, and if the certificate information was extracted */ -static rlm_rcode_t mod_authorize_result(module_ctx_t const *mctx, request_t *request, void *rctx) +static unlang_action_t mod_authorize_result(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request, void *rctx) { fr_mail_ctx *mail_ctx = rctx; rlm_smtp_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_smtp_t); @@ -709,13 +709,13 @@ static rlm_rcode_t mod_authorize_result(module_ctx_t const *mctx, request_t *req if (randle->result != CURLE_OK) { talloc_free(randle); - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; } if (tls->extract_cert_attrs) fr_curl_response_certinfo(request, randle); talloc_free(randle); - return RLM_MODULE_OK; + RETURN_MODULE_OK; } /* @@ -732,7 +732,7 @@ static rlm_rcode_t mod_authorize_result(module_ctx_t const *mctx, request_t *req * Then it queues the request and yeilds until a response is given * When it responds, mod_authorize_resume is called. */ -static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_smtp_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_smtp_t); rlm_smtp_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_smtp_thread_t); @@ -744,7 +744,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, requ if (fr_pair_find_by_da(&request->control, attr_auth_type) != NULL) { RDEBUG3("Auth-Type is already set. Not setting 'Auth-Type := %s'", inst->name); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } /* Elements provided by the request */ @@ -755,18 +755,18 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, requ /* Make sure all of the essential email components are present and possible*/ if(!smtp_body) { RDEBUG2("Attribute \"smtp-body\" is required for smtp"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } if (!inst->sender_address && !inst->envelope_address) { RDEBUG2("At least one of \"sender_address\" or \"envelope_address\" in the config, or \"SMTP-Sender-Address\" in the request is needed"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* allocate the handle and set the curl options */ randle = fr_curl_io_request_alloc(request); if (!randle){ RDEBUG2("A handle could not be allocated for the request"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* Initialize the uctx to perform the email */ @@ -839,13 +839,13 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, requ FR_CURL_REQUEST_SET_OPTION(CURLOPT_MIMEPOST, mail_ctx->mime); /* Initialize tls if it has been set up */ - if (fr_curl_easy_tls_init(randle, &inst->tls) != 0) return RLM_MODULE_INVALID; + if (fr_curl_easy_tls_init(randle, &inst->tls) != 0) RETURN_MODULE_INVALID; - if (fr_curl_io_request_enqueue(t->mhandle, request, randle)) return RLM_MODULE_INVALID; + if (fr_curl_io_request_enqueue(t->mhandle, request, randle)) RETURN_MODULE_INVALID; return unlang_module_yield(request, mod_authorize_result, NULL, mail_ctx); error: - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -855,7 +855,8 @@ error: * If the response was not OK, we REJECT the request * This does not confirm an email may be sent, only that the provided login credentials are valid for the server */ -static rlm_rcode_t CC_HINT(nonnull) mod_authenticate_resume(module_ctx_t const *mctx, request_t *request, void *rctx) +static unlang_action_t CC_HINT(nonnull) mod_authenticate_resume(rlm_rcode_t *p_result, + module_ctx_t const *mctx, request_t *request, void *rctx) { rlm_smtp_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_smtp_t); fr_curl_io_request_t *randle = rctx; @@ -874,13 +875,13 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate_resume(module_ctx_t const * if (randle->result != CURLE_OK) { talloc_free(randle); - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; } if (tls->extract_cert_attrs) fr_curl_response_certinfo(request, randle); talloc_free(randle); - return RLM_MODULE_OK; + RETURN_MODULE_OK; } /* @@ -894,7 +895,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate_resume(module_ctx_t const * * Then it queues the request and yeilds until a response is given * When it responds, mod_authenticate_resume is called. */ -static rlm_rcode_t CC_HINT(nonnull(1,2)) mod_authenticate(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull(1,2)) mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_smtp_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_smtp_t); rlm_smtp_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_smtp_thread_t); @@ -904,7 +905,7 @@ static rlm_rcode_t CC_HINT(nonnull(1,2)) mod_authenticate(module_ctx_t const *mc randle = fr_curl_io_request_alloc(request); if (!randle){ error: - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } username = fr_pair_find_by_da(&request->request_pairs, attr_user_name); @@ -913,15 +914,15 @@ static rlm_rcode_t CC_HINT(nonnull(1,2)) mod_authenticate(module_ctx_t const *mc /* Make sure we have a user-name and user-password, and that they are possible */ if (!username) { REDEBUG("Attribute \"User-Name\" is required for authentication"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } if (username->vp_length == 0) { RDEBUG2("\"User-Password\" must not be empty"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } if (!password) { RDEBUG2("Attribute \"User-Password\" is required for authentication"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } FR_CURL_REQUEST_SET_OPTION(CURLOPT_DEFAULT_PROTOCOL, "smtp"); @@ -931,9 +932,9 @@ static rlm_rcode_t CC_HINT(nonnull(1,2)) mod_authenticate(module_ctx_t const *mc FR_CURL_REQUEST_SET_OPTION(CURLOPT_VERBOSE, 1L); - if (fr_curl_easy_tls_init(randle, &inst->tls) != 0) return RLM_MODULE_INVALID; + if (fr_curl_easy_tls_init(randle, &inst->tls) != 0) RETURN_MODULE_INVALID; - if (fr_curl_io_request_enqueue(t->mhandle, request, randle)) return RLM_MODULE_INVALID; + if (fr_curl_io_request_enqueue(t->mhandle, request, randle)) RETURN_MODULE_INVALID; return unlang_module_yield(request, mod_authenticate_resume, NULL, randle); } diff --git a/src/modules/rlm_soh/rlm_soh.c b/src/modules/rlm_soh/rlm_soh.c index f2566f3d479..f138af9f62c 100644 --- a/src/modules/rlm_soh/rlm_soh.c +++ b/src/modules/rlm_soh/rlm_soh.c @@ -142,13 +142,13 @@ static const CONF_PARSER module_config[] = { CONF_PARSER_TERMINATOR }; -static rlm_rcode_t CC_HINT(nonnull) mod_post_auth(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_post_auth(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { int rcode; fr_pair_t *vp; rlm_soh_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_soh_t); - if (!inst->dhcp) return RLM_MODULE_NOOP; + if (!inst->dhcp) RETURN_MODULE_NOOP; vp = fr_pair_find_by_da(&request->request_pairs, attr_dhcp_vendor); if (vp) { @@ -188,7 +188,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_post_auth(module_ctx_t const *mctx, requ /* SoH payload */ rcode = soh_verify(request, data, vlen); if (rcode < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } } break; @@ -199,13 +199,13 @@ static rlm_rcode_t CC_HINT(nonnull) mod_post_auth(module_ctx_t const *mctx, requ } data += vlen; } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } -static rlm_rcode_t CC_HINT(nonnull) mod_authorize(UNUSED module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request) { fr_pair_t *vp; int rv; @@ -214,17 +214,17 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(UNUSED module_ctx_t const *mct vp = fr_pair_find_by_da(&request->request_pairs, attr_ms_quarantine_soh); if (!vp) { RDEBUG2("SoH radius VP not found"); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } RDEBUG2("SoH radius VP found"); /* decode it */ rv = soh_verify(request, vp->vp_octets, vp->vp_length); if (rv < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } static int mod_bootstrap(void *instance, CONF_SECTION *conf) diff --git a/src/modules/rlm_sometimes/rlm_sometimes.c b/src/modules/rlm_sometimes/rlm_sometimes.c index 373cff70392..612a7b99543 100644 --- a/src/modules/rlm_sometimes/rlm_sometimes.c +++ b/src/modules/rlm_sometimes/rlm_sometimes.c @@ -69,7 +69,8 @@ static int mod_instantiate(void *instance, CONF_SECTION *conf) /* * A lie! It always returns! */ -static rlm_rcode_t sometimes_return(void const *instance, request_t *request, fr_radius_packet_t *packet, fr_radius_packet_t *reply) +static unlang_action_t sometimes_return(rlm_rcode_t *p_result, void const *instance, request_t *request, + fr_radius_packet_t *packet, fr_radius_packet_t *reply) { uint32_t hash; rlm_sometimes_t const *inst = talloc_get_type_abort_const(instance, rlm_sometimes_t); @@ -79,13 +80,13 @@ static rlm_rcode_t sometimes_return(void const *instance, request_t *request, fr /* * Set it to NOOP and the module will always do nothing */ - if (inst->rcode == RLM_MODULE_NOOP) return inst->rcode; + if (inst->rcode == RLM_MODULE_NOOP) RETURN_MODULE_RCODE(inst->rcode); /* * Hash based on the given key. Usually User-Name. */ tmpl_find_vp(&vp, request, inst->key); - if (!vp) return RLM_MODULE_NOOP; + if (!vp) RETURN_MODULE_NOOP; switch (vp->vp_type) { case FR_TYPE_OCTETS: @@ -94,7 +95,7 @@ static rlm_rcode_t sometimes_return(void const *instance, request_t *request, fr break; case FR_TYPE_STRUCTURAL: - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; default: hash = fr_hash(&vp->data.datum, fr_value_box_field_sizes[vp->vp_type]); @@ -106,7 +107,7 @@ static rlm_rcode_t sometimes_return(void const *instance, request_t *request, fr value /= (1 << 16); value *= 100; - if (value > inst->percentage) return RLM_MODULE_NOOP; + if (value > inst->percentage) RETURN_MODULE_NOOP; /* * If we're returning "handled", then set the packet @@ -135,17 +136,17 @@ static rlm_rcode_t sometimes_return(void const *instance, request_t *request, fr } } - return inst->rcode; + RETURN_MODULE_RCODE(inst->rcode); } -static rlm_rcode_t CC_HINT(nonnull) mod_sometimes_packet(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_sometimes_packet(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { - return sometimes_return(mctx->instance, request, request->packet, request->reply); + return sometimes_return(p_result, mctx->instance, request, request->packet, request->reply); } -static rlm_rcode_t CC_HINT(nonnull) mod_sometimes_reply(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_sometimes_reply(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { - return sometimes_return(mctx->instance, request, request->reply, NULL); + return sometimes_return(p_result, mctx->instance, request, request->reply, NULL); } extern module_t rlm_sometimes; diff --git a/src/modules/rlm_sql/rlm_sql.c b/src/modules/rlm_sql/rlm_sql.c index 6462761c445..cfa6fc30660 100644 --- a/src/modules/rlm_sql/rlm_sql.c +++ b/src/modules/rlm_sql/rlm_sql.c @@ -795,8 +795,9 @@ static int sql_groupcmp(void *instance, request_t *request, UNUSED fr_pair_t *re return 1; } -static rlm_rcode_t rlm_sql_process_groups(rlm_sql_t const *inst, request_t *request, rlm_sql_handle_t **handle, - sql_fall_through_t *do_fall_through) +static unlang_action_t rlm_sql_process_groups(rlm_rcode_t *p_result, + rlm_sql_t const *inst, request_t *request, rlm_sql_handle_t **handle, + sql_fall_through_t *do_fall_through) { rlm_rcode_t rcode = RLM_MODULE_NOOP; fr_pair_t *check_tmp = NULL, *reply_tmp = NULL, *sql_group = NULL; @@ -817,7 +818,7 @@ static rlm_rcode_t rlm_sql_process_groups(rlm_sql_t const *inst, request_t *requ * Didn't add group attributes or allocate * memory, so don't do anything else. */ - return RLM_MODULE_NOTFOUND; + RETURN_MODULE_NOTFOUND; } /* @@ -827,7 +828,7 @@ static rlm_rcode_t rlm_sql_process_groups(rlm_sql_t const *inst, request_t *requ if (rows < 0) { REDEBUG("Error retrieving group list"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } if (rows == 0) { RDEBUG2("User not found in any groups"); @@ -958,7 +959,7 @@ finish: talloc_free(head); pair_delete_request(inst->group_da); - return rcode; + RETURN_MODULE_RCODE(rcode); } @@ -1175,10 +1176,10 @@ static int mod_instantiate(void *instance, CONF_SECTION *conf) inst->pool = module_connection_pool_init(inst->cs, inst, sql_mod_conn_create, NULL, NULL, NULL, NULL); if (!inst->pool) return -1; - return RLM_MODULE_OK; + return 0; } -static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_rcode_t rcode = RLM_MODULE_NOOP; @@ -1204,13 +1205,13 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, requ !inst->config->read_groups && !inst->config->read_profiles) { RWDEBUG("No authorization checks configured, returning noop"); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } /* * Set, escape, and check the user attr here */ - if (sql_set_user(inst, request, NULL) < 0) return RLM_MODULE_FAIL; + if (sql_set_user(inst, request, NULL) < 0) RETURN_MODULE_FAIL; /* * Reserve a socket @@ -1221,7 +1222,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, requ handle = fr_pool_connection_get(inst->pool, request); if (!handle) { sql_unset_user(inst, request); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* @@ -1243,7 +1244,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, requ fr_pool_connection_release(inst->pool, request, handle); - return rcode; + RETURN_MODULE_RCODE(rcode); } fr_cursor_init(&cursor, &check_tmp); @@ -1332,7 +1333,7 @@ skip_reply: rlm_rcode_t ret; RDEBUG3("... falling-through to group processing"); - ret = rlm_sql_process_groups(inst, request, &handle, &do_fall_through); + rlm_sql_process_groups(&ret, inst, request, &handle, &do_fall_through); switch (ret) { /* @@ -1387,7 +1388,7 @@ skip_reply: goto error; } - ret = rlm_sql_process_groups(inst, request, &handle, &do_fall_through); + rlm_sql_process_groups(&ret, inst, request, &handle, &do_fall_through); switch (ret) { /* * Nothing bad happened, continue... @@ -1423,7 +1424,7 @@ release: fr_pool_connection_release(inst->pool, request, handle); sql_unset_user(inst, request); - return rcode; + RETURN_MODULE_RCODE(rcode); } /* @@ -1436,7 +1437,7 @@ release: * doesn't update any rows, the next matching config item is used. * */ -static int acct_redundant(rlm_sql_t const *inst, request_t *request, sql_acct_section_t *section) +static unlang_action_t acct_redundant(rlm_rcode_t *p_result, rlm_sql_t const *inst, request_t *request, sql_acct_section_t *section) { rlm_rcode_t rcode = RLM_MODULE_OK; @@ -1591,35 +1592,35 @@ finish: fr_pool_connection_release(inst->pool, request, handle); sql_unset_user(inst, request); - return rcode; + RETURN_MODULE_RCODE(rcode); } /* * Accounting: Insert or update session data in our sql table */ -static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_accounting(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_sql_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_sql_t); if (inst->config->accounting.reference_cp) { - return acct_redundant(inst, request, &inst->config->accounting); + return acct_redundant(p_result, inst, request, &inst->config->accounting); } - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } /* * Postauth: Write a record of the authentication attempt */ -static rlm_rcode_t CC_HINT(nonnull) mod_post_auth(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_post_auth(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_sql_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_sql_t); if (inst->config->postauth.reference_cp) { - return acct_redundant(inst, request, &inst->config->postauth); + return acct_redundant(p_result, inst, request, &inst->config->postauth); } - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } /* diff --git a/src/modules/rlm_sqlcounter/rlm_sqlcounter.c b/src/modules/rlm_sqlcounter/rlm_sqlcounter.c index 5f6ec0555b9..75fcd5b7be1 100644 --- a/src/modules/rlm_sqlcounter/rlm_sqlcounter.c +++ b/src/modules/rlm_sqlcounter/rlm_sqlcounter.c @@ -354,7 +354,7 @@ static int counter_cmp(void *instance, request_t *request, UNUSED fr_pair_t *req if (sqlcounter_expand(subst, sizeof(subst), inst, request, inst->query) <= 0) { REDEBUG("Insufficient query buffer space"); - return RLM_MODULE_FAIL; + return -1; } /* Then combine that with the name of the module were using to do the query */ @@ -362,12 +362,12 @@ static int counter_cmp(void *instance, request_t *request, UNUSED fr_pair_t *req if (len >= sizeof(query) - 1) { REDEBUG("Insufficient query buffer space"); - return RLM_MODULE_FAIL; + return -1; } /* Finally, xlat resulting SQL query */ if (xlat_aeval(request, &expanded, request, query, NULL, NULL) < 0) { - return RLM_MODULE_FAIL; + return -1; } if (sscanf(expanded, "%" PRIu64, &counter) != 1) { @@ -386,7 +386,7 @@ static int counter_cmp(void *instance, request_t *request, UNUSED fr_pair_t *req * from the database. The authentication code only needs to check * the password, the rest is done here. */ -static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_sqlcounter_t *inst = talloc_get_type_abort(mctx->instance, rlm_sqlcounter_t); uint64_t counter, res; @@ -414,14 +414,14 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, requ if (tmpl_find_vp(&limit, request, inst->limit_attr) < 0) { RWDEBUG2("Couldn't find limit attribute, %s, doing nothing...", inst->limit_attr->name); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } /* First, expand %k, %b and %e in query */ if (sqlcounter_expand(subst, sizeof(subst), inst, request, inst->query) <= 0) { REDEBUG("Insufficient query buffer space"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* Then combine that with the name of the module were using to do the query */ @@ -429,12 +429,12 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, requ if (len >= (sizeof(query) - 1)) { REDEBUG("Insufficient query buffer space"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* Finally, xlat resulting SQL query */ if (xlat_aeval(request, &expanded, request, query, NULL, NULL) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } talloc_free(expanded); @@ -460,7 +460,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, requ REDEBUG2("Rejecting user, %s value (%" PRIu64 ") is less than counter value (%" PRIu64 ")", inst->limit_attr->name, limit->vp_uint64, counter); - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; } res = limit->vp_uint64 - counter; @@ -501,25 +501,25 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, requ if (reply_item->vp_uint64 <= res) { RDEBUG2("Leaving existing %s value of %" PRIu64, inst->reply_attr->name, reply_item->vp_uint64); - return RLM_MODULE_OK; + RETURN_MODULE_OK; } break; case -1: /* alloc failed */ REDEBUG("Error allocating attribute %s", inst->reply_attr->name); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; default: /* request or list unavailable */ RDEBUG2("List or request context not available for %s, skipping...", inst->reply_attr->name); - return RLM_MODULE_OK; + RETURN_MODULE_OK; } reply_item->vp_uint64 = res; RDEBUG2("&%pP", reply_item); - return RLM_MODULE_UPDATED; + RETURN_MODULE_UPDATED; } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } /* diff --git a/src/modules/rlm_sqlippool/rlm_sqlippool.c b/src/modules/rlm_sqlippool/rlm_sqlippool.c index cd8d962ed29..389082e69b7 100644 --- a/src/modules/rlm_sqlippool/rlm_sqlippool.c +++ b/src/modules/rlm_sqlippool/rlm_sqlippool.c @@ -468,28 +468,29 @@ static int mod_instantiate(void *instance, CONF_SECTION *conf) * If we have something to log, then we log it. * Otherwise we return the retcode as soon as possible */ -static int do_logging(UNUSED rlm_sqlippool_t const *inst, request_t *request, char const *str, int rcode) +static unlang_action_t do_logging(rlm_rcode_t *p_result, UNUSED rlm_sqlippool_t const *inst, request_t *request, + char const *str, rlm_rcode_t rcode) { char *expanded = NULL; fr_pair_t *vp; - if (!str || !*str) return rcode; + if (!str || !*str) RETURN_MODULE_RCODE(rcode); MEM(pair_add_request(&vp, attr_module_success_message) == 0); if (xlat_aeval(request, &expanded, request, str, NULL, NULL) < 0) { pair_delete_request(vp); - return rcode; + RETURN_MODULE_RCODE(rcode); } fr_pair_value_bstrdup_buffer_shallow(vp, expanded, true); - return rcode; + RETURN_MODULE_RCODE(rcode); } /* * Allocate an IP number from the pool. */ -static rlm_rcode_t CC_HINT(nonnull) mod_alloc(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_alloc(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_sqlippool_t *inst = talloc_get_type_abort(mctx->instance, rlm_sqlippool_t); char allocation[FR_MAX_STRING_LEN]; @@ -503,23 +504,23 @@ static rlm_rcode_t CC_HINT(nonnull) mod_alloc(module_ctx_t const *mctx, request_ if (fr_pair_find_by_da(&request->reply_pairs, inst->allocated_address_da) != NULL) { RDEBUG2("%s already exists", inst->allocated_address_da->name); - return do_logging(inst, request, inst->log_exists, RLM_MODULE_NOOP); + return do_logging(p_result, inst, request, inst->log_exists, RLM_MODULE_NOOP); } if (fr_pair_find_by_da(&request->control_pairs, attr_pool_name) == NULL) { RDEBUG2("No %s defined", attr_pool_name->name); - return do_logging(inst, request, inst->log_nopool, RLM_MODULE_NOOP); + return do_logging(p_result, inst, request, inst->log_nopool, RLM_MODULE_NOOP); } handle = fr_pool_connection_get(inst->sql_inst->pool, request); if (!handle) { REDEBUG("Failed reserving SQL connection"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } if (inst->sql_inst->sql_set_user(inst->sql_inst, request, NULL) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } DO_PART(alloc_begin); @@ -532,7 +533,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_alloc(module_ctx_t const *mctx, request_ allocation_len = sqlippool_query1(allocation, sizeof(allocation), inst->alloc_existing, &handle, inst, request, (char *) NULL, 0); - if (!handle) return RLM_MODULE_FAIL; + if (!handle) RETURN_MODULE_FAIL; } else { allocation_len = 0; } @@ -547,13 +548,13 @@ static rlm_rcode_t CC_HINT(nonnull) mod_alloc(module_ctx_t const *mctx, request_ ssize_t slen; slen = tmpl_expand(&ip, buffer, sizeof(buffer), request, inst->requested_address, NULL, NULL); - if (slen < 0) return RLM_MODULE_FAIL; + if (slen < 0) RETURN_MODULE_FAIL; if (slen > 0) { allocation_len = sqlippool_query1(allocation, sizeof(allocation), inst->alloc_requested, &handle, inst, request, (char *) NULL, 0); - if (!handle) return RLM_MODULE_FAIL; + if (!handle) RETURN_MODULE_FAIL; } } @@ -565,7 +566,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_alloc(module_ctx_t const *mctx, request_ allocation_len = sqlippool_query1(allocation, sizeof(allocation), inst->alloc_find, &handle, inst, request, (char *) NULL, 0); - if (!handle) return RLM_MODULE_FAIL; + if (!handle) RETURN_MODULE_FAIL; } /* @@ -586,7 +587,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_alloc(module_ctx_t const *mctx, request_ allocation_len = sqlippool_query1(allocation, sizeof(allocation), inst->pool_check, &handle, inst, request, (char *) NULL, 0); - if (!handle) return RLM_MODULE_FAIL; + if (!handle) RETURN_MODULE_FAIL; fr_pool_connection_release(inst->sql_inst->pool, request, handle); @@ -601,8 +602,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_alloc(module_ctx_t const *mctx, request_ * NOTFOUND */ RDEBUG2("pool appears to be full"); - return do_logging(inst, request, inst->log_failed, RLM_MODULE_NOTFOUND); - + return do_logging(p_result, inst, request, inst->log_failed, RLM_MODULE_NOTFOUND); } /* @@ -612,14 +612,14 @@ static rlm_rcode_t CC_HINT(nonnull) mod_alloc(module_ctx_t const *mctx, request_ * allocation failure and return NOOP */ RDEBUG2("IP address could not be allocated as no pool exists with that name"); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } fr_pool_connection_release(inst->sql_inst->pool, request, handle); RDEBUG2("IP address could not be allocated"); - return do_logging(inst, request, inst->log_failed, RLM_MODULE_NOOP); + return do_logging(p_result, inst, request, inst->log_failed, RLM_MODULE_NOOP); } /* @@ -632,7 +632,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_alloc(module_ctx_t const *mctx, request_ RDEBUG2("Invalid IP number [%s] returned from instbase query.", allocation); fr_pool_connection_release(inst->sql_inst->pool, request, handle); - return do_logging(inst, request, inst->log_failed, RLM_MODULE_NOOP); + return do_logging(p_result, inst, request, inst->log_failed, RLM_MODULE_NOOP); } RDEBUG2("Allocated IP %s", allocation); @@ -645,20 +645,20 @@ static rlm_rcode_t CC_HINT(nonnull) mod_alloc(module_ctx_t const *mctx, request_ allocation, allocation_len) < 0) { error: if (handle) fr_pool_connection_release(inst->sql_inst->pool, request, handle); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } DO_PART(alloc_commit); if (handle) fr_pool_connection_release(inst->sql_inst->pool, request, handle); - return do_logging(inst, request, inst->log_success, RLM_MODULE_OK); + return do_logging(p_result, inst, request, inst->log_success, RLM_MODULE_OK); } /* * Update a lease. */ -static rlm_rcode_t CC_HINT(nonnull) mod_update(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_update(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_sqlippool_t *inst = talloc_get_type_abort(mctx->instance, rlm_sqlippool_t); rlm_sql_handle_t *handle; @@ -667,11 +667,11 @@ static rlm_rcode_t CC_HINT(nonnull) mod_update(module_ctx_t const *mctx, request handle = fr_pool_connection_get(inst->sql_inst->pool, request); if (!handle) { REDEBUG("Failed reserving SQL connection"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } if (inst->sql_inst->sql_set_user(inst->sql_inst, request, NULL) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } DO_PART(update_begin); @@ -688,7 +688,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_update(module_ctx_t const *mctx, request if (affected < 0) { error: if (handle) fr_pool_connection_release(inst->sql_inst->pool, request, handle); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } DO_PART(update_commit); @@ -699,19 +699,19 @@ static rlm_rcode_t CC_HINT(nonnull) mod_update(module_ctx_t const *mctx, request /* * The lease has been updated - return OK */ - return do_logging(inst, request, inst->log_success, RLM_MODULE_OK); + return do_logging(p_result, inst, request, inst->log_success, RLM_MODULE_OK); } else { /* * The lease could not be updated - return notfound */ - return do_logging(inst, request, inst->log_failed, RLM_MODULE_NOTFOUND); + return do_logging(p_result, inst, request, inst->log_failed, RLM_MODULE_NOTFOUND); } } /* * Release a lease. */ -static rlm_rcode_t CC_HINT(nonnull) mod_release(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_release(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_sqlippool_t *inst = talloc_get_type_abort(mctx->instance, rlm_sqlippool_t); rlm_sql_handle_t *handle; @@ -719,11 +719,11 @@ static rlm_rcode_t CC_HINT(nonnull) mod_release(module_ctx_t const *mctx, reques handle = fr_pool_connection_get(inst->sql_inst->pool, request); if (!handle) { REDEBUG("Failed reserving SQL connection"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } if (inst->sql_inst->sql_set_user(inst->sql_inst, request, NULL) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } DO_PART(release_begin); @@ -731,17 +731,17 @@ static rlm_rcode_t CC_HINT(nonnull) mod_release(module_ctx_t const *mctx, reques DO_PART(release_commit); if (handle) fr_pool_connection_release(inst->sql_inst->pool, request, handle); - return RLM_MODULE_OK; + RETURN_MODULE_OK; error: if (handle) fr_pool_connection_release(inst->sql_inst->pool, request, handle); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* * Release a collection of leases. */ -static rlm_rcode_t CC_HINT(nonnull) mod_bulk_release(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_bulk_release(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_sqlippool_t *inst = talloc_get_type_abort(mctx->instance, rlm_sqlippool_t); rlm_sql_handle_t *handle; @@ -749,11 +749,11 @@ static rlm_rcode_t CC_HINT(nonnull) mod_bulk_release(module_ctx_t const *mctx, r handle = fr_pool_connection_get(inst->sql_inst->pool, request); if (!handle) { REDEBUG("Failed reserving SQL connection"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } if (inst->sql_inst->sql_set_user(inst->sql_inst, request, NULL) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } DO_PART(bulk_release_begin); @@ -761,18 +761,18 @@ static rlm_rcode_t CC_HINT(nonnull) mod_bulk_release(module_ctx_t const *mctx, r DO_PART(bulk_release_commit); if (handle) fr_pool_connection_release(inst->sql_inst->pool, request, handle); - return RLM_MODULE_OK; + RETURN_MODULE_OK; error: if (handle) fr_pool_connection_release(inst->sql_inst->pool, request, handle); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* * Mark a lease. Typically for DHCP Decline where IPs need to be marked * as invalid */ -static rlm_rcode_t CC_HINT(nonnull) mod_mark(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_mark(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_sqlippool_t *inst = talloc_get_type_abort(mctx->instance, rlm_sqlippool_t); rlm_sql_handle_t *handle; @@ -780,11 +780,11 @@ static rlm_rcode_t CC_HINT(nonnull) mod_mark(module_ctx_t const *mctx, request_t handle = fr_pool_connection_get(inst->sql_inst->pool, request); if (!handle) { REDEBUG("Failed reserving SQL connection"); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } if (inst->sql_inst->sql_set_user(inst->sql_inst, request, NULL) < 0) { - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } DO_PART(mark_begin); @@ -792,20 +792,19 @@ static rlm_rcode_t CC_HINT(nonnull) mod_mark(module_ctx_t const *mctx, request_t DO_PART(mark_commit); if (handle) fr_pool_connection_release(inst->sql_inst->pool, request, handle); - return RLM_MODULE_OK; + RETURN_MODULE_OK; error: if (handle) fr_pool_connection_release(inst->sql_inst->pool, request, handle); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } /* * Check Accounting packets for their accoutning status * Call the relevant module based on the status */ -static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_accounting(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { - int rcode = RLM_MODULE_NOOP; fr_pair_t *vp; int acct_status_type; @@ -813,7 +812,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, req vp = fr_pair_find_by_da(&request->request_pairs, attr_acct_status_type); if (!vp) { RDEBUG2("Could not find account status type in packet"); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } acct_status_type = vp->vp_uint32; @@ -821,24 +820,19 @@ static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, req switch (acct_status_type) { case FR_STATUS_START: case FR_STATUS_ALIVE: - rcode = mod_update(mctx, request); - break; + return mod_update(p_result, mctx, request); case FR_STATUS_STOP: - rcode = mod_release(mctx, request); - break; + return mod_release(p_result, mctx, request); case FR_STATUS_ACCOUNTING_ON: case FR_STATUS_ACCOUNTING_OFF: - rcode = mod_bulk_release(mctx, request); - break; + return mod_bulk_release(p_result, mctx, request); default: /* We don't care about any other accounting packet */ - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } - - return rcode; } /* diff --git a/src/modules/rlm_stats/rlm_stats.c b/src/modules/rlm_stats/rlm_stats.c index 04c46addf75..0ff8d4225f2 100644 --- a/src/modules/rlm_stats/rlm_stats.c +++ b/src/modules/rlm_stats/rlm_stats.c @@ -144,7 +144,7 @@ static void coalesce(uint64_t final_stats[FR_RADIUS_MAX_PACKET_CODE], rlm_stats_ /* * Do the statistics */ -static rlm_rcode_t CC_HINT(nonnull) mod_stats(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_stats(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_stats_t *inst = talloc_get_type_abort(mctx->instance, rlm_stats_t); rlm_stats_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_stats_thread_t); @@ -216,7 +216,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_stats(module_ctx_t const *mctx, request_ */ if ((t->last_global_update + NSEC) > request->async->recv_time) { - return RLM_MODULE_UPDATED; + RETURN_MODULE_UPDATED; } t->last_global_update = request->async->recv_time; @@ -228,7 +228,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_stats(module_ctx_t const *mctx, request_ } pthread_mutex_unlock(&inst->mutex); - return RLM_MODULE_UPDATED; + RETURN_MODULE_UPDATED; } /* @@ -236,7 +236,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_stats(module_ctx_t const *mctx, request_ */ if ((request->request_state != REQUEST_RECV) || (request->packet->code != FR_CODE_STATUS_SERVER)) { - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } vp = fr_pair_find_by_da(&request->request_pairs, attr_freeradius_stats4_type); @@ -275,7 +275,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_stats(module_ctx_t const *mctx, request_ case FR_FREERADIUS_STATS4_TYPE_VALUE_CLIENT: /* src */ vp = fr_pair_find_by_da(&request->request_pairs, attr_freeradius_stats4_ipv4_address); if (!vp) vp = fr_pair_find_by_da(&request->request_pairs, attr_freeradius_stats4_ipv6_address); - if (!vp) return RLM_MODULE_NOOP; + if (!vp) RETURN_MODULE_NOOP; mydata.ipaddr = vp->vp_ip; coalesce(local_stats, t, offsetof(rlm_stats_thread_t, src), &mydata); @@ -284,7 +284,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_stats(module_ctx_t const *mctx, request_ case FR_FREERADIUS_STATS4_TYPE_VALUE_LISTENER: /* dst */ vp = fr_pair_find_by_da(&request->request_pairs, attr_freeradius_stats4_ipv4_address); if (!vp) vp = fr_pair_find_by_da(&request->request_pairs, attr_freeradius_stats4_ipv6_address); - if (!vp) return RLM_MODULE_NOOP; + if (!vp) RETURN_MODULE_NOOP; mydata.ipaddr = vp->vp_ip; coalesce(local_stats, t, offsetof(rlm_stats_thread_t, dst), &mydata); @@ -292,7 +292,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_stats(module_ctx_t const *mctx, request_ default: REDEBUG("Invalid value '%d' for FreeRADIUS-Stats4-type", stats_type); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } if (vp ) { @@ -321,7 +321,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_stats(module_ctx_t const *mctx, request_ (void) fr_cursor_tail(&cursor); } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } diff --git a/src/modules/rlm_test/rlm_test.c b/src/modules/rlm_test/rlm_test.c index 89f6d75abfe..7e2ae270f56 100644 --- a/src/modules/rlm_test/rlm_test.c +++ b/src/modules/rlm_test/rlm_test.c @@ -217,7 +217,7 @@ static int mod_thread_detach(UNUSED fr_event_list_t *el, void *thread) INFO("Performing detach for thread %p", (void *)t->value); - if (!fr_cond_assert(t->value == pthread_self())) return RLM_MODULE_FAIL; + if (!fr_cond_assert(t->value == pthread_self())) return -1; return 0; } @@ -277,7 +277,7 @@ static int mod_bootstrap(void *instance, UNUSED CONF_SECTION *conf) * from the database. The authentication code only needs to check * the password, the rest is done here. */ -static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_test_thread_t *t = mctx->thread; @@ -302,53 +302,53 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, requ REXDENT(); REDEBUG4("RDEBUG4 error message"); - if (!fr_cond_assert(t->value == pthread_self())) return RLM_MODULE_FAIL; + if (!fr_cond_assert(t->value == pthread_self())) RETURN_MODULE_FAIL; - return RLM_MODULE_OK; + RETURN_MODULE_OK; } /* * Authenticate the user with the given password. */ -static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, UNUSED request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, UNUSED request_t *request) { rlm_test_thread_t *t = mctx->thread; - if (!fr_cond_assert(t->value == pthread_self())) return RLM_MODULE_FAIL; + if (!fr_cond_assert(t->value == pthread_self())) RETURN_MODULE_FAIL; - return RLM_MODULE_OK; + RETURN_MODULE_OK; } /* * Massage the request before recording it or proxying it */ -static rlm_rcode_t CC_HINT(nonnull) mod_preacct(module_ctx_t const *mctx, UNUSED request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_preacct(rlm_rcode_t *p_result, module_ctx_t const *mctx, UNUSED request_t *request) { rlm_test_thread_t *t = mctx->thread; - if (!fr_cond_assert(t->value == pthread_self())) return RLM_MODULE_FAIL; + if (!fr_cond_assert(t->value == pthread_self())) RETURN_MODULE_FAIL; - return RLM_MODULE_OK; + RETURN_MODULE_OK; } /* * Write accounting information to this modules database. */ -static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, UNUSED request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_accounting(rlm_rcode_t *p_result, module_ctx_t const *mctx, UNUSED request_t *request) { rlm_test_thread_t *t = mctx->thread; - if (!fr_cond_assert(t->value == pthread_self())) return RLM_MODULE_FAIL; + if (!fr_cond_assert(t->value == pthread_self())) RETURN_MODULE_FAIL; - return RLM_MODULE_OK; + RETURN_MODULE_OK; } /* * Write accounting information to this modules database. */ -static rlm_rcode_t CC_HINT(nonnull) mod_return(UNUSED module_ctx_t const *mctx, UNUSED request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_return(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, UNUSED request_t *request) { - return RLM_MODULE_OK; + RETURN_MODULE_OK; } static int mod_detach(UNUSED void *instance) diff --git a/src/modules/rlm_unix/rlm_unix.c b/src/modules/rlm_unix/rlm_unix.c index 90188f6aadb..646d7a23d40 100644 --- a/src/modules/rlm_unix/rlm_unix.c +++ b/src/modules/rlm_unix/rlm_unix.c @@ -183,7 +183,7 @@ static int mod_bootstrap(void *instance, CONF_SECTION *conf) * Pull the users password from where-ever, and add it to * the given vp list. */ -static rlm_rcode_t CC_HINT(nonnull) mod_authorize(UNUSED module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request) { char const *name; char const *encrypted_pass; @@ -202,13 +202,13 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(UNUSED module_ctx_t const *mct * a User-Name attribute. */ username = fr_pair_find_by_da(&request->request_pairs, attr_user_name); - if (!username) return RLM_MODULE_NOOP; + if (!username) RETURN_MODULE_NOOP; name = username->vp_strvalue; encrypted_pass = NULL; if ((pwd = getpwnam(name)) == NULL) { - return RLM_MODULE_NOTFOUND; + RETURN_MODULE_NOTFOUND; } encrypted_pass = pwd->pw_passwd; @@ -224,7 +224,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(UNUSED module_ctx_t const *mct */ if ((!encrypted_pass) || (strlen(encrypted_pass) < 10)) { if ((spwd = getspnam(name)) == NULL) { - return RLM_MODULE_NOTFOUND; + RETURN_MODULE_NOTFOUND; } encrypted_pass = spwd->sp_pwdp; } @@ -236,7 +236,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(UNUSED module_ctx_t const *mct */ if (strcmp(pwd->pw_shell, DENY_SHELL) == 0) { REDEBUG("Invalid shell", name); - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; } #endif @@ -254,7 +254,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(UNUSED module_ctx_t const *mct endusershell(); if (!shell) { REDEBUG("[%s]: invalid shell [%s]", name, pwd->pw_shell); - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; } #endif @@ -265,7 +265,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(UNUSED module_ctx_t const *mct if (spwd && spwd->sp_lstchg > 0 && spwd->sp_max >= 0 && (fr_time_to_sec(request->packet->timestamp) / 86400) > (spwd->sp_lstchg + spwd->sp_max)) { REDEBUG("[%s]: password has expired", name); - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; } /* * Check if account has expired. @@ -273,7 +273,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(UNUSED module_ctx_t const *mct if (spwd && spwd->sp_expire > 0 && (fr_time_to_sec(request->packet->timestamp) / 86400) > spwd->sp_expire) { REDEBUG("[%s]: account has expired", name); - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; } #endif @@ -284,7 +284,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(UNUSED module_ctx_t const *mct if ((pwd->pw_expire > 0) && (fr_time_to_sec(request->packet->timestamp) > pwd->pw_expire)) { REDEBUG("[%s]: password has expired", name); - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; } #endif @@ -294,12 +294,12 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(UNUSED module_ctx_t const *mct * FIXME: Maybe add Auth-Type := Accept? */ if (encrypted_pass[0] == 0) - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; MEM(pair_update_control(&vp, attr_crypt_password) >= 0); fr_pair_value_strdup(vp, encrypted_pass); - return RLM_MODULE_UPDATED; + RETURN_MODULE_UPDATED; } @@ -335,7 +335,7 @@ static char *uue(void *in) /* * Unix accounting - write a wtmp file. */ -static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_accounting(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_unix_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_unix_t); fr_pair_t *vp; @@ -361,12 +361,12 @@ static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, req */ if (!inst->radwtmp) { RDEBUG2("No radwtmp file configured. Ignoring accounting request"); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } if (request->packet->socket.inet.src_ipaddr.af != AF_INET) { RDEBUG2("IPv6 is not supported!"); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } /* @@ -374,7 +374,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, req */ if ((vp = fr_pair_find_by_da(&request->request_pairs, attr_acct_status_type)) == NULL) { RDEBUG2("no Accounting-Status-Type attribute in request"); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } status = vp->vp_uint32; @@ -383,14 +383,14 @@ static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, req */ if (status != FR_STATUS_START && status != FR_STATUS_STOP) - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; /* * We're only interested in accounting messages * with a username in it. */ if (fr_pair_find_by_da(&request->request_pairs, attr_user_name) == NULL) - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; t = fr_time_to_sec(request->packet->timestamp); memset(&ut, 0, sizeof(ut)); @@ -433,7 +433,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, req * where we didn't see a NAS-Port attribute. */ if (strncmp(ut.ut_name, "!root", sizeof(ut.ut_name)) == 0 || !port_seen) - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; /* * If we didn't find out the NAS address, use the @@ -498,13 +498,13 @@ static rlm_rcode_t CC_HINT(nonnull) mod_accounting(module_ctx_t const *mctx, req if ((fp = fopen(inst->radwtmp, "a")) != NULL) { if ((fwrite(&ut, sizeof(ut), 1, fp)) != 1) { fclose(fp); - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; } fclose(fp); } else - return RLM_MODULE_FAIL; + RETURN_MODULE_FAIL; - return RLM_MODULE_OK; + RETURN_MODULE_OK; } /* globally exported name */ diff --git a/src/modules/rlm_utf8/rlm_utf8.c b/src/modules/rlm_utf8/rlm_utf8.c index 985e176e4dd..7d2a1e1ea87 100644 --- a/src/modules/rlm_utf8/rlm_utf8.c +++ b/src/modules/rlm_utf8/rlm_utf8.c @@ -29,7 +29,7 @@ RCSID("$Id$") /* * Reject any non-UTF8 data. */ -static rlm_rcode_t CC_HINT(nonnull) mod_utf8_clean(UNUSED module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_utf8_clean(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request) { size_t i, len; fr_pair_t *vp; @@ -42,11 +42,11 @@ static rlm_rcode_t CC_HINT(nonnull) mod_utf8_clean(UNUSED module_ctx_t const *mc for (i = 0; i < vp->vp_length; i += len) { len = fr_utf8_char(&vp->vp_octets[i], -1); - if (len == 0) return RLM_MODULE_FAIL; + if (len == 0) RETURN_MODULE_FAIL; } } - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } /* diff --git a/src/modules/rlm_wimax/rlm_wimax.c b/src/modules/rlm_wimax/rlm_wimax.c index 92b34d7a275..95fec6a96ef 100644 --- a/src/modules/rlm_wimax/rlm_wimax.c +++ b/src/modules/rlm_wimax/rlm_wimax.c @@ -116,7 +116,7 @@ fr_dict_attr_autoload_t rlm_wimax_dict_attr[] = { * from the database. The authentication code only needs to check * the password, the rest is done here. */ -static rlm_rcode_t CC_HINT(nonnull) mod_authorize(UNUSED module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, UNUSED module_ctx_t const *mctx, request_t *request) { fr_pair_t *vp; @@ -144,24 +144,24 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(UNUSED module_ctx_t const *mct } DEBUG2("Fixing WiMAX binary Calling-Station-Id to %pV", &vp->data); - return RLM_MODULE_OK; + RETURN_MODULE_OK; } - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } /* * Massage the request before recording it or proxying it */ -static rlm_rcode_t CC_HINT(nonnull) mod_preacct(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_preacct(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { - return mod_authorize(mctx, request); + return mod_authorize(p_result, mctx, request); } /* * Generate the keys after the user has been authenticated. */ -static rlm_rcode_t CC_HINT(nonnull) mod_post_auth(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_post_auth(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_wimax_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_wimax_t); fr_pair_t *msk, *emsk, *vp; @@ -177,7 +177,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_post_auth(module_ctx_t const *mctx, requ emsk = fr_pair_find_by_da(&request->reply_pairs, attr_eap_emsk); if (!msk || !emsk) { REDEBUG2("No EAP-MSK or EAP-EMSK. Cannot create WiMAX keys"); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } /* @@ -430,7 +430,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_post_auth(module_ctx_t const *mctx, requ */ HMAC_CTX_free(hmac); - return RLM_MODULE_UPDATED; + RETURN_MODULE_UPDATED; } /* diff --git a/src/modules/rlm_winbind/auth_wbclient_pap.c b/src/modules/rlm_winbind/auth_wbclient_pap.c index d3f6e92be88..4204a439159 100644 --- a/src/modules/rlm_winbind/auth_wbclient_pap.c +++ b/src/modules/rlm_winbind/auth_wbclient_pap.c @@ -49,7 +49,7 @@ RCSID("$Id$") */ int do_auth_wbclient_pap(rlm_winbind_t const *inst, request_t *request, fr_pair_t *password) { - int rcode = -1; + int ret = -1; struct wbcContext *wb_ctx; struct wbcAuthUserParams authparams; wbcErr err; @@ -130,7 +130,7 @@ int do_auth_wbclient_pap(rlm_winbind_t const *inst, request_t *request, fr_pair_ */ switch (err) { case WBC_ERR_SUCCESS: - rcode = 0; + ret = 0; RDEBUG2("Authenticated successfully"); break; @@ -151,11 +151,11 @@ int do_auth_wbclient_pap(rlm_winbind_t const *inst, request_t *request, fr_pair_ } /* - * The password needs to be changed, set rcode appropriately. + * The password needs to be changed, set ret appropriately. */ if (error->nt_status == NT_STATUS_PASSWORD_EXPIRED || error->nt_status == NT_STATUS_PASSWORD_MUST_CHANGE) { - rcode = -648; + ret = -648; } /* @@ -188,6 +188,6 @@ done: if (info) wbcFreeMemory(info); if (error) wbcFreeMemory(error); - return rcode; + return ret; } diff --git a/src/modules/rlm_winbind/rlm_winbind.c b/src/modules/rlm_winbind/rlm_winbind.c index a954d3cc35f..ee177cd2ce6 100644 --- a/src/modules/rlm_winbind/rlm_winbind.c +++ b/src/modules/rlm_winbind/rlm_winbind.c @@ -88,7 +88,7 @@ static int winbind_group_cmp(void *instance, request_t *request, UNUSED fr_pair_ UNUSED fr_pair_t *check_list) { rlm_winbind_t *inst = instance; - rlm_rcode_t rcode = 1; + int ret = 1; struct wbcContext *wb_ctx; wbcErr err; uint32_t num_groups, i; @@ -175,7 +175,7 @@ static int winbind_group_cmp(void *instance, request_t *request, UNUSED fr_pair_ err = wbcCtxGetGroups(wb_ctx, username, &num_groups, &wb_groups); switch (err) { case WBC_ERR_SUCCESS: - rcode = 0; + ret = 0; REDEBUG2("Successfully retrieved user's groups"); break; @@ -199,8 +199,8 @@ static int winbind_group_cmp(void *instance, request_t *request, UNUSED fr_pair_ if (!num_groups) REDEBUG2("No groups returned"); - if (rcode) goto finish; - rcode = 1; + if (ret) goto finish; + ret = 1; /* * See if any of the groups match @@ -250,7 +250,7 @@ static int winbind_group_cmp(void *instance, request_t *request, UNUSED fr_pair_ if (!strcasecmp(group_name, check->vp_strvalue)) { REDEBUG2("Found matching group: %s", group_name); found = true; - rcode = 0; + ret = 0; } wbcFreeMemory(group); @@ -258,7 +258,7 @@ static int winbind_group_cmp(void *instance, request_t *request, UNUSED fr_pair_ if (found) break; } - if (rcode) REDEBUG2("No groups found that match"); + if (ret) REDEBUG2("No groups found that match"); finish: wbcFreeMemory(wb_groups); @@ -270,7 +270,7 @@ error: talloc_const_free(domain); REXDENT(); - return rcode; + return ret; } @@ -464,7 +464,7 @@ static int mod_detach(void *instance) * - #RLM_MODULE_NOOP unable to use winbind authentication * - #RLM_MODULE_OK Auth-Type has been set to winbind */ -static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_winbind_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_winbind_t); fr_pair_t *vp; @@ -472,18 +472,18 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, requ vp = fr_pair_find_by_da(&request->request_pairs, attr_user_password); if (!vp) { REDEBUG2("No User-Password found in the request; not doing winbind authentication."); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } if (!inst->auth_type) { WARN("No 'authenticate %s {...}' section or 'Auth-Type = %s' set. Cannot setup Winbind authentication", inst->name, inst->name); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } - if (!module_section_type_set(request, attr_auth_type, inst->auth_type)) return RLM_MODULE_NOOP; + if (!module_section_type_set(request, attr_auth_type, inst->auth_type)) RETURN_MODULE_NOOP; - return RLM_MODULE_OK; + RETURN_MODULE_OK; } @@ -494,7 +494,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, requ * * @return One of the RLM_MODULE_* values */ -static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_winbind_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_winbind_t); fr_pair_t *username, *password; @@ -508,12 +508,12 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r */ if (!username) { REDEBUG("Attribute \"User-Name\" is required for authentication"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } if (!password) { REDEBUG("Attribute \"User-Password\" is required for authentication"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -521,7 +521,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r */ if (password->vp_length == 0) { REDEBUG("User-Password must not be empty"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } /* @@ -540,10 +540,10 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r */ if (do_auth_wbclient_pap(inst, request, password) == 0) { REDEBUG2("User authenticated successfully using winbind"); - return RLM_MODULE_OK; + RETURN_MODULE_OK; } - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; } diff --git a/src/modules/rlm_yubikey/decrypt.c b/src/modules/rlm_yubikey/decrypt.c index 60f2f4ab2a4..8708d3a6059 100644 --- a/src/modules/rlm_yubikey/decrypt.c +++ b/src/modules/rlm_yubikey/decrypt.c @@ -23,7 +23,7 @@ extern fr_dict_attr_t const *attr_yubikey_counter; * @param passcode string to decrypt. * @return one of the RLM_RCODE_* constants. */ -rlm_rcode_t rlm_yubikey_decrypt(rlm_yubikey_t const *inst, request_t *request, char const *passcode) +unlang_action_t rlm_yubikey_decrypt(rlm_rcode_t *p_result, rlm_yubikey_t const *inst, request_t *request, char const *passcode) { uint32_t counter, timestamp; yubikey_token_st token; @@ -33,12 +33,12 @@ rlm_rcode_t rlm_yubikey_decrypt(rlm_yubikey_t const *inst, request_t *request, c key = fr_pair_find_by_da(&request->control_pairs, attr_yubikey_key); if (!key) { REDEBUG("Yubikey-Key attribute not found in control list, can't decrypt OTP data"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } if (key->vp_length != YUBIKEY_KEY_SIZE) { REDEBUG("Yubikey-Key length incorrect, expected %u got %zu", YUBIKEY_KEY_SIZE, key->vp_length); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } yubikey_parse((uint8_t const *) passcode + inst->id_len, key->vp_octets, &token); @@ -48,7 +48,7 @@ rlm_rcode_t rlm_yubikey_decrypt(rlm_yubikey_t const *inst, request_t *request, c */ if (!yubikey_crc_ok_p((uint8_t *) &token)) { REDEBUG("Decrypting OTP token data failed, rejecting"); - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; } RDEBUG2("Token data decrypted successfully"); @@ -95,15 +95,15 @@ rlm_rcode_t rlm_yubikey_decrypt(rlm_yubikey_t const *inst, request_t *request, c vp = fr_pair_find_by_da(&request->control_pairs, attr_yubikey_counter); if (!vp) { RWDEBUG("Yubikey-Counter not found in control list, skipping replay attack checks"); - return RLM_MODULE_OK; + RETURN_MODULE_OK; } if (counter <= vp->vp_uint32) { REDEBUG("Replay attack detected! Counter value %u, is lt or eq to last known counter value %u", counter, vp->vp_uint32); - return RLM_MODULE_REJECT; + RETURN_MODULE_REJECT; } - return RLM_MODULE_OK; + RETURN_MODULE_OK; } #endif diff --git a/src/modules/rlm_yubikey/rlm_yubikey.c b/src/modules/rlm_yubikey/rlm_yubikey.c index e2b80a6ceaf..c193dddb273 100644 --- a/src/modules/rlm_yubikey/rlm_yubikey.c +++ b/src/modules/rlm_yubikey/rlm_yubikey.c @@ -244,7 +244,7 @@ static int CC_HINT(nonnull) otp_string_valid(rlm_yubikey_t const *inst, char con * from the database. The authentication code only needs to check * the password, the rest is done here. */ -static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_yubikey_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_yubikey_t); char const *passcode; @@ -267,7 +267,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, requ RDEBUG2("No cleartext password in the request. Can't do Yubikey authentication"); } - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } passcode = password->vp_strvalue; @@ -283,7 +283,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, requ if (len < (inst->id_len + YUBIKEY_TOKEN_LEN)) { RDEBUG2("User-Password value is not the correct length, expected at least %u bytes, got %zu bytes", inst->id_len + YUBIKEY_TOKEN_LEN, len); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } password_len = (len - (inst->id_len + YUBIKEY_TOKEN_LEN)); @@ -295,7 +295,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, requ } else { RDEBUG2("User-Password (aes-block) value contains non modhex chars"); } - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } /* May be a concatenation, check the last 32 bytes are modhex */ @@ -343,19 +343,19 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(module_ctx_t const *mctx, requ if (!inst->auth_type) { WARN("No 'authenticate %s {...}' section or 'Auth-Type = %s' set. Cannot setup Yubikey authentication", inst->name, inst->name); - return RLM_MODULE_NOOP; + RETURN_MODULE_NOOP; } - if (!module_section_type_set(request, attr_auth_type, inst->auth_type)) return RLM_MODULE_NOOP; + if (!module_section_type_set(request, attr_auth_type, inst->auth_type)) RETURN_MODULE_NOOP; - return RLM_MODULE_OK; + RETURN_MODULE_OK; } /* * Authenticate the user with the given password. */ -static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, request_t *request) +static unlang_action_t CC_HINT(nonnull) mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request) { rlm_yubikey_t const *inst = talloc_get_type_abort_const(mctx->instance, rlm_yubikey_t); rlm_rcode_t rcode = RLM_MODULE_NOOP; @@ -373,7 +373,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r vp = fr_pair_find_by_da(&request->request_pairs, attr_user_password); if (!vp) { REDEBUG("No User-Password in the request. Can't do Yubikey authentication"); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } } @@ -389,7 +389,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r if (len != (inst->id_len + YUBIKEY_TOKEN_LEN)) { REDEBUG("%s value is not the correct length, expected bytes %u, got bytes %zu", vp->da->name, inst->id_len + YUBIKEY_TOKEN_LEN, len); - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } ret = otp_string_valid(inst, passcode, (inst->id_len + YUBIKEY_TOKEN_LEN)); @@ -399,25 +399,22 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(module_ctx_t const *mctx, r } else { RERROR("Passcode (aes-block) value contains non modhex chars"); } - return RLM_MODULE_INVALID; + RETURN_MODULE_INVALID; } #ifdef HAVE_YUBIKEY if (inst->decrypt) { - rcode = rlm_yubikey_decrypt(inst, request, passcode); - if (rcode != RLM_MODULE_OK) { - return rcode; - } + + rlm_yubikey_decrypt(&rcode, inst, request, passcode); + if (rcode != RLM_MODULE_OK) RETURN_MODULE_RCODE(rcode); /* Fall-Through to doing ykclient auth in addition to local auth */ } #endif #ifdef HAVE_YKCLIENT - if (inst->validate) { - return rlm_yubikey_validate(inst, request, passcode); - } + if (inst->validate) return rlm_yubikey_validate(p_result, inst, request, passcode); #endif - return rcode; + RETURN_MODULE_RCODE(rcode); } /* diff --git a/src/modules/rlm_yubikey/rlm_yubikey.h b/src/modules/rlm_yubikey/rlm_yubikey.h index a5634f216b8..fd3cb1d4f42 100644 --- a/src/modules/rlm_yubikey/rlm_yubikey.h +++ b/src/modules/rlm_yubikey/rlm_yubikey.h @@ -58,7 +58,7 @@ typedef struct { /* * decrypt.c - Decryption functions */ -rlm_rcode_t rlm_yubikey_decrypt(rlm_yubikey_t const *inst, request_t *request, char const *passcode); +unlang_action_t rlm_yubikey_decrypt(rlm_rcode_t *p_result, rlm_yubikey_t const *inst, request_t *request, char const *passcode); /* * validate.c - Connection pool and validation functions @@ -67,4 +67,4 @@ int rlm_yubikey_ykclient_init(CONF_SECTION *conf, rlm_yubikey_t *inst); int rlm_yubikey_ykclient_detach(rlm_yubikey_t *inst); -rlm_rcode_t rlm_yubikey_validate(rlm_yubikey_t const *inst, request_t *request, char const *passcode); +unlang_action_t rlm_yubikey_validate(rlm_rcode_t *p_result, rlm_yubikey_t const *inst, request_t *request, char const *passcode); diff --git a/src/modules/rlm_yubikey/validate.c b/src/modules/rlm_yubikey/validate.c index 81351d79e7b..de56b5b1dc7 100644 --- a/src/modules/rlm_yubikey/validate.c +++ b/src/modules/rlm_yubikey/validate.c @@ -147,14 +147,14 @@ int rlm_yubikey_ykclient_detach(rlm_yubikey_t *inst) return 0; } -rlm_rcode_t rlm_yubikey_validate(rlm_yubikey_t const *inst, request_t *request, char const *passcode) +unlang_action_t rlm_yubikey_validate(rlm_rcode_t *p_result, rlm_yubikey_t const *inst, request_t *request, char const *passcode) { rlm_rcode_t rcode = RLM_MODULE_OK; ykclient_rc status; ykclient_handle_t *yandle; yandle = fr_pool_connection_get(inst->pool, request); - if (!yandle) return RLM_MODULE_FAIL; + if (!yandle) RETURN_MODULE_FAIL; /* * The libcurl multi-handle interface will tear down the TCP sockets for any partially completed @@ -192,6 +192,6 @@ rlm_rcode_t rlm_yubikey_validate(rlm_yubikey_t const *inst, request_t *request, fr_pool_connection_release(inst->pool, request, yandle); - return rcode; + RETURN_MODULE_RCODE(rcode); } #endif diff --git a/src/protocols/radius/abinary.c b/src/protocols/radius/abinary.c index b869fc825b5..b35ede52c39 100644 --- a/src/protocols/radius/abinary.c +++ b/src/protocols/radius/abinary.c @@ -552,7 +552,7 @@ static int ascend_parse_ipx_net(int argc, char **argv, */ static int ascend_parse_ipx(int argc, char **argv, ascend_ipx_filter_t *filter) { - int rcode; + int slen; int token; int flags = 0; @@ -578,23 +578,23 @@ duplicate: fr_strerror_printf("Duplicate field when parsing 'abinary' IPX type"); return -1; } - rcode = ascend_parse_ipx_net(argc - 1, argv + 1, + slen = ascend_parse_ipx_net(argc - 1, argv + 1, &(filter->src), &(filter->srcSocComp)); - if (rcode < 0) return -1; - argc -= (rcode + 1); - argv += rcode + 1; + if (slen < 0) return -1; + argc -= (slen + 1); + argv += slen + 1; flags |= 0x01; break; case FILTER_IPX_DST_IPXNET: if (flags & 0x02) goto duplicate; - rcode = ascend_parse_ipx_net(argc - 1, argv + 1, + slen = ascend_parse_ipx_net(argc - 1, argv + 1, &(filter->dst), &(filter->dstSocComp)); - if (rcode < 0) return -1; - argc -= (rcode + 1); - argv += rcode + 1; + if (slen < 0) return -1; + argc -= (slen + 1); + argv += slen + 1; flags |= 0x02; break; @@ -736,15 +736,15 @@ static int ascend_parse_ipaddr(uint32_t *ipaddr, char *str) */ static int ascend_parse_port(uint16_t *port, char *compare, char *str) { - int rcode, token; + int slen, token; /* * There MUST be a comparison string. */ - rcode = fr_table_value_by_str(filterCompare, compare, -1); - if (rcode < 0) { + slen = fr_table_value_by_str(filterCompare, compare, -1); + if (slen < 0) { fr_strerror_printf("Unknown comparison operator '%s'", str); - return rcode; + return slen; } if (strspn(str, "0123456789") == strlen(str)) { @@ -761,7 +761,7 @@ static int ascend_parse_port(uint16_t *port, char *compare, char *str) *port = token; *port = htons(*port); - return rcode; + return slen; } @@ -809,7 +809,7 @@ static int ascend_parse_port(uint16_t *port, char *compare, char *str) */ static int ascend_parse_ip(int argc, char **argv, ascend_ip_filter_t *filter) { - int rcode; + int slen; int token; int flags; @@ -837,10 +837,10 @@ static int ascend_parse_ip(int argc, char **argv, ascend_ip_filter_t *filter) return -1; } - rcode = ascend_parse_ipaddr(&filter->srcip, argv[1]); - if (rcode < 0) return rcode; + slen = ascend_parse_ipaddr(&filter->srcip, argv[1]); + if (slen < 0) return slen; - filter->srcmask = rcode; + filter->srcmask = slen; flags |= IP_SRC_ADDR_FLAG; argv += 2; argc -= 2; @@ -850,10 +850,10 @@ static int ascend_parse_ip(int argc, char **argv, ascend_ip_filter_t *filter) if (flags & IP_DEST_ADDR_FLAG) goto duplicate; if (argc < 2) goto insufficient; - rcode = ascend_parse_ipaddr(&filter->dstip, argv[1]); - if (rcode < 0) return rcode; + slen = ascend_parse_ipaddr(&filter->dstip, argv[1]); + if (slen < 0) return slen; - filter->dstmask = rcode; + filter->dstmask = slen; flags |= IP_DEST_ADDR_FLAG; argv += 2; argc -= 2; @@ -863,10 +863,10 @@ static int ascend_parse_ip(int argc, char **argv, ascend_ip_filter_t *filter) if (flags & IP_SRC_PORT_FLAG) goto duplicate; if (argc < 3) goto insufficient; - rcode = ascend_parse_port(&filter->srcport, + slen = ascend_parse_port(&filter->srcport, argv[1], argv[2]); - if (rcode < 0) return rcode; - filter->srcPortComp = rcode; + if (slen < 0) return slen; + filter->srcPortComp = slen; flags |= IP_SRC_PORT_FLAG; argv += 3; @@ -877,10 +877,10 @@ static int ascend_parse_ip(int argc, char **argv, ascend_ip_filter_t *filter) if (flags & IP_DEST_PORT_FLAG) goto duplicate; if (argc < 3) goto insufficient; - rcode = ascend_parse_port(&filter->dstport, + slen = ascend_parse_port(&filter->dstport, argv[1], argv[2]); - if (rcode < 0) return rcode; - filter->dstPortComp = rcode; + if (slen < 0) return slen; + filter->dstPortComp = slen; flags |= IP_DEST_PORT_FLAG; argv += 3; @@ -937,7 +937,7 @@ static int ascend_parse_ip(int argc, char **argv, ascend_ip_filter_t *filter) */ static int ascend_parse_ipv6(int argc, char **argv, ascend_ipv6_filter_t *filter) { - int rcode; + ssize_t slen; int token; int flags; @@ -993,10 +993,10 @@ static int ascend_parse_ipv6(int argc, char **argv, ascend_ipv6_filter_t *filter if (flags & IP_SRC_PORT_FLAG) goto duplicate; if (argc < 3) goto insufficient; - rcode = ascend_parse_port(&filter->srcport, + slen = ascend_parse_port(&filter->srcport, argv[1], argv[2]); - if (rcode < 0) return rcode; - filter->srcPortComp = rcode; + if (slen < 0) return slen; + filter->srcPortComp = slen; flags |= IP_SRC_PORT_FLAG; argv += 3; @@ -1007,10 +1007,10 @@ static int ascend_parse_ipv6(int argc, char **argv, ascend_ipv6_filter_t *filter if (flags & IP_DEST_PORT_FLAG) goto duplicate; if (argc < 3) goto insufficient; - rcode = ascend_parse_port(&filter->dstport, + slen = ascend_parse_port(&filter->dstport, argv[1], argv[2]); - if (rcode < 0) return rcode; - filter->dstPortComp = rcode; + if (slen < 0) return slen; + filter->dstPortComp = slen; flags |= IP_DEST_PORT_FLAG; argv += 3; @@ -1085,7 +1085,7 @@ static int ascend_parse_ipv6(int argc, char **argv, ascend_ipv6_filter_t *filter static int ascend_parse_generic(int argc, char **argv, ascend_generic_filter_t *filter) { - int rcode; + int slen; int token; int flags; @@ -1119,18 +1119,18 @@ static int ascend_parse_generic(int argc, char **argv, return -1; } - rcode = atoi(argv[0]); - if (rcode > 65535) goto invalid; + slen = atoi(argv[0]); + if (slen > 65535) goto invalid; - filter->offset = rcode; + filter->offset = slen; filter->offset = htons(filter->offset); - rcode = fr_hex2bin(NULL, + slen = fr_hex2bin(NULL, &FR_DBUFF_TMP(filter->mask, sizeof(filter->mask)), &FR_SBUFF_IN(argv[1], strlen(argv[1])), false); - if (rcode != sizeof(filter->mask)) { + if (slen != sizeof(filter->mask)) { fr_strerror_printf("Invalid filter mask '%s'", argv[1]); - return -1; + return -1; } token = fr_hex2bin(NULL, @@ -1141,7 +1141,7 @@ static int ascend_parse_generic(int argc, char **argv, return -1; } - filter->len = rcode; + filter->len = slen; filter->len = htons(filter->len); /* @@ -1206,7 +1206,7 @@ static int ascend_parse_generic(int argc, char **argv, ssize_t fr_radius_encode_abinary(fr_pair_t const *vp, uint8_t *out, size_t outlen) { int token, type; - int rcode; + int slen; int argc; char *argv[32]; ascend_filter_t filter; @@ -1289,27 +1289,27 @@ ssize_t fr_radius_encode_abinary(fr_pair_t const *vp, uint8_t *out, size_t outle switch (type) { case ASCEND_FILTER_GENERIC: - rcode = ascend_parse_generic(argc - 3, &argv[3], &filter.generic); + slen = ascend_parse_generic(argc - 3, &argv[3], &filter.generic); size = 32; break; case ASCEND_FILTER_IP: - rcode = ascend_parse_ip(argc - 3, &argv[3], &filter.ip); + slen = ascend_parse_ip(argc - 3, &argv[3], &filter.ip); size = 32; break; case ASCEND_FILTER_IPX: - rcode = ascend_parse_ipx(argc - 3, &argv[3], &filter.ipx); + slen = ascend_parse_ipx(argc - 3, &argv[3], &filter.ipx); size = 32; break; case ASCEND_FILTER_IPV6: - rcode = ascend_parse_ipv6(argc - 3, &argv[3], &filter.ipv6); + slen = ascend_parse_ipv6(argc - 3, &argv[3], &filter.ipv6); size = sizeof(filter); break; } - if (rcode < 0) goto fail; + if (slen < 0) goto fail; talloc_free(p); diff --git a/src/protocols/radius/decode.c b/src/protocols/radius/decode.c index 8443aa903f9..2adad28d58e 100644 --- a/src/protocols/radius/decode.c +++ b/src/protocols/radius/decode.c @@ -579,7 +579,7 @@ static ssize_t decode_extended(TALLOC_CTX *ctx, fr_cursor_t *cursor, fr_dict_t c uint8_t const *data, size_t attr_len, size_t packet_len, void *decoder_ctx) { - ssize_t rcode; + ssize_t ret; size_t fraglen; uint8_t *head, *tail; uint8_t const *frag, *end; @@ -597,9 +597,9 @@ static ssize_t decode_extended(TALLOC_CTX *ctx, fr_cursor_t *cursor, fr_dict_t c * No continuation, just decode the attributre in place. */ if ((data[1] & 0x80) == 0) { - rcode = fr_radius_decode_pair_value(ctx, cursor, dict, + ret = fr_radius_decode_pair_value(ctx, cursor, dict, parent, data + 2, attr_len - 2, attr_len - 2, decoder_ctx); - if (rcode < 0) return -1; + if (ret < 0) return -1; return attr_len; } @@ -654,10 +654,10 @@ static ssize_t decode_extended(TALLOC_CTX *ctx, fr_cursor_t *cursor, fr_dict_t c FR_PROTO_HEX_DUMP(head, fraglen, "long-extended fragments"); - rcode = fr_radius_decode_pair_value(ctx, cursor, dict, + ret = fr_radius_decode_pair_value(ctx, cursor, dict, parent, head, fraglen, fraglen, decoder_ctx); talloc_free(head); - if (rcode < 0) return rcode; + if (ret < 0) return ret; return end - data; } @@ -670,7 +670,7 @@ static ssize_t decode_wimax(TALLOC_CTX *ctx, fr_cursor_t *cursor, fr_dict_t cons fr_dict_attr_t const *parent, uint8_t const *data, size_t attr_len, size_t packet_len, void *decoder_ctx, uint32_t vendor) { - ssize_t rcode; + ssize_t ret; size_t wimax_len; bool more; uint8_t *head, *tail; @@ -706,9 +706,9 @@ static ssize_t decode_wimax(TALLOC_CTX *ctx, fr_cursor_t *cursor, fr_dict_t cons * No continuation, just decode the attributre in place. */ if ((data[6] & 0x80) == 0) { - rcode = fr_radius_decode_pair_value(ctx, cursor, dict, + ret = fr_radius_decode_pair_value(ctx, cursor, dict, da, data + 7, data[5] - 3, data[5] - 3, decoder_ctx); - if (rcode < 0) return rcode; + if (ret < 0) return ret; return attr_len; } @@ -824,10 +824,10 @@ static ssize_t decode_wimax(TALLOC_CTX *ctx, fr_cursor_t *cursor, fr_dict_t cons FR_PROTO_HEX_DUMP(head, wimax_len, "Wimax fragments"); - rcode = fr_radius_decode_pair_value(ctx, cursor, dict, + ret = fr_radius_decode_pair_value(ctx, cursor, dict, da, head, wimax_len, wimax_len, decoder_ctx); talloc_free(head); - if (rcode < 0) return rcode; + if (ret < 0) return ret; return end - data; } @@ -842,7 +842,7 @@ static ssize_t decode_vsa(TALLOC_CTX *ctx, fr_cursor_t *cursor, fr_dict_t const void *decoder_ctx) { size_t total; - ssize_t rcode; + ssize_t ret; uint32_t vendor; fr_dict_vendor_t const *dv; fr_pair_t *head = NULL; @@ -917,9 +917,9 @@ static ssize_t decode_vsa(TALLOC_CTX *ctx, fr_cursor_t *cursor, fr_dict_t const * WiMAX craziness */ if ((vendor == VENDORPEC_WIMAX) && dv->flags) { - rcode = decode_wimax(ctx, cursor, dict, + ret = decode_wimax(ctx, cursor, dict, vendor_da, data, attr_len, packet_len, decoder_ctx, vendor); - return rcode; + return ret; } /* @@ -1007,7 +1007,7 @@ ssize_t fr_radius_decode_pair_value(TALLOC_CTX *ctx, fr_cursor_t *cursor, fr_dic { int8_t tag = 0; size_t data_len; - ssize_t rcode; + ssize_t ret; uint32_t vendor; fr_dict_attr_t const *child; fr_pair_t *vp = NULL; @@ -1269,9 +1269,9 @@ ssize_t fr_radius_decode_pair_value(TALLOC_CTX *ctx, fr_cursor_t *cursor, fr_dic * VSAs can be WiMAX, in which case they don't * fit into one attribute. */ - rcode = decode_vsa(ctx, cursor, dict, parent, p, attr_len, packet_len, decoder_ctx); - if (rcode < 0) goto raw; - return rcode; + ret = decode_vsa(ctx, cursor, dict, parent, p, attr_len, packet_len, decoder_ctx); + if (ret < 0) goto raw; + return ret; } else { fr_dict_attr_t const *vendor_child; @@ -1322,10 +1322,10 @@ ssize_t fr_radius_decode_pair_value(TALLOC_CTX *ctx, fr_cursor_t *cursor, fr_dic * Everything was found in the dictionary, we can * now recurse to decode the value. */ - rcode = fr_radius_decode_pair_value(ctx, cursor, dict, + ret = fr_radius_decode_pair_value(ctx, cursor, dict, child, p + 5, attr_len - 5, attr_len - 5, decoder_ctx); - if (rcode < 0) goto raw; + if (ret < 0) goto raw; return attr_len; } @@ -1336,8 +1336,8 @@ ssize_t fr_radius_decode_pair_value(TALLOC_CTX *ctx, fr_cursor_t *cursor, fr_dic * attribute, OR they've already been grouped * into a contiguous memory buffer. */ - rcode = fr_radius_decode_tlv(ctx, cursor, dict, parent, p, attr_len, decoder_ctx); - if (rcode < 0) goto raw; + ret = fr_radius_decode_tlv(ctx, cursor, dict, parent, p, attr_len, decoder_ctx); + if (ret < 0) goto raw; return attr_len; } @@ -1365,10 +1365,10 @@ ssize_t fr_radius_decode_pair_value(TALLOC_CTX *ctx, fr_cursor_t *cursor, fr_dic * set. Just decode it. */ if (!extra || ((p[1] & 0x80) == 0)) { - rcode = fr_radius_decode_pair_value(ctx, cursor, dict, child, + ret = fr_radius_decode_pair_value(ctx, cursor, dict, child, p + min, attr_len - min, attr_len - min, decoder_ctx); - if (rcode < 0) goto invalid_extended; + if (ret < 0) goto invalid_extended; return attr_len; } @@ -1385,8 +1385,8 @@ ssize_t fr_radius_decode_pair_value(TALLOC_CTX *ctx, fr_cursor_t *cursor, fr_dic * MUST have the "more" bit set. So we * don't check it again here. */ - rcode = decode_extended(ctx, cursor, dict, child, data, attr_len, packet_len, decoder_ctx); - if (rcode >= 0) return rcode; /* which may be LONGER than attr_len */ + ret = decode_extended(ctx, cursor, dict, child, data, attr_len, packet_len, decoder_ctx); + if (ret >= 0) return ret; /* which may be LONGER than attr_len */ /* Fall through to invalid extended attribute */ } else { @@ -1412,14 +1412,14 @@ ssize_t fr_radius_decode_pair_value(TALLOC_CTX *ctx, fr_cursor_t *cursor, fr_dic * "long" extended. Decode the value. */ if (extra) { - rcode = decode_extended(ctx, cursor, dict, child, data, attr_len, packet_len, decoder_ctx); - if (rcode >= 0) return rcode; /* which may be LONGER than attr_len */ + ret = decode_extended(ctx, cursor, dict, child, data, attr_len, packet_len, decoder_ctx); + if (ret >= 0) return ret; /* which may be LONGER than attr_len */ } - rcode = fr_radius_decode_pair_value(ctx, cursor, dict, child, + ret = fr_radius_decode_pair_value(ctx, cursor, dict, child, p + min, attr_len - min, attr_len - min, decoder_ctx); - if (rcode < 0) return -1; + if (ret < 0) return -1; return attr_len; case FR_TYPE_STRUCT: @@ -1428,9 +1428,9 @@ ssize_t fr_radius_decode_pair_value(TALLOC_CTX *ctx, fr_cursor_t *cursor, fr_dic * attribute, OR it's already been grouped * into a contiguous memory buffer. */ - rcode = fr_struct_from_network(ctx, cursor, parent, p, attr_len, &child, + ret = fr_struct_from_network(ctx, cursor, parent, p, attr_len, &child, decode_value, decoder_ctx); - if (rcode < 0) goto raw; + if (ret < 0) goto raw; /* * The above function only decodes fixed fields @@ -1438,17 +1438,17 @@ ssize_t fr_radius_decode_pair_value(TALLOC_CTX *ctx, fr_cursor_t *cursor, fr_dic * the struct, we have to decode them manually * here. */ - if (child && ((size_t) rcode < attr_len)) { + if (child && ((size_t) ret < attr_len)) { ssize_t tlv_len; /* * Try to decode the TLVs */ tlv_len = fr_radius_decode_tlv(ctx, cursor, dict, - child, p + rcode, attr_len - rcode, + child, p + ret, attr_len - ret, decoder_ctx); if (tlv_len < 0) { - vp = fr_unknown_from_network(ctx, child, p + rcode, attr_len - rcode); + vp = fr_unknown_from_network(ctx, child, p + ret, attr_len - ret); if (vp) fr_cursor_append(cursor, vp); } } @@ -1617,7 +1617,7 @@ ssize_t fr_radius_decode_pair_value(TALLOC_CTX *ctx, fr_cursor_t *cursor, fr_dic ssize_t fr_radius_decode_pair(TALLOC_CTX *ctx, fr_cursor_t *cursor, fr_dict_t const *dict, uint8_t const *data, size_t data_len, void *decoder_ctx) { - ssize_t rcode; + ssize_t ret; fr_dict_attr_t const *da; fr_radius_ctx_t *packet_ctx = decoder_ctx; @@ -1680,12 +1680,12 @@ ssize_t fr_radius_decode_pair(TALLOC_CTX *ctx, fr_cursor_t *cursor, fr_dict_t co * attributes may have the "continuation" bit set, and * will thus be more than one attribute in length. */ - rcode = fr_radius_decode_pair_value(ctx, cursor, dict, + ret = fr_radius_decode_pair_value(ctx, cursor, dict, da, data + 2, data[1] - 2, data_len - 2, decoder_ctx); - if (rcode < 0) return rcode; + if (ret < 0) return ret; - return 2 + rcode; + return 2 + ret; } static int _test_ctx_free(UNUSED fr_radius_ctx_t *ctx) diff --git a/src/protocols/radius/list.c b/src/protocols/radius/list.c index 84dd8f16468..57d0b4e5dbf 100644 --- a/src/protocols/radius/list.c +++ b/src/protocols/radius/list.c @@ -41,7 +41,7 @@ RCSID("$Id$") */ int fr_packet_cmp(fr_radius_packet_t const *a, fr_radius_packet_t const *b) { - int rcode; + int ret; /* * 256-way fanout. @@ -55,22 +55,22 @@ int fr_packet_cmp(fr_radius_packet_t const *a, fr_radius_packet_t const *b) /* * Source ports are pretty much random. */ - rcode = (int) a->socket.inet.src_port - (int) b->socket.inet.src_port; - if (rcode != 0) return rcode; + ret = (int) a->socket.inet.src_port - (int) b->socket.inet.src_port; + if (ret != 0) return ret; /* * Usually many client IPs, and few server IPs */ - rcode = fr_ipaddr_cmp(&a->socket.inet.src_ipaddr, &b->socket.inet.src_ipaddr); - if (rcode != 0) return rcode; + ret = fr_ipaddr_cmp(&a->socket.inet.src_ipaddr, &b->socket.inet.src_ipaddr); + if (ret != 0) return ret; /* * One socket can receive packets for multiple * destination IPs, so we check that before checking the * file descriptor. */ - rcode = fr_ipaddr_cmp(&a->socket.inet.dst_ipaddr, &b->socket.inet.dst_ipaddr); - if (rcode != 0) return rcode; + ret = fr_ipaddr_cmp(&a->socket.inet.dst_ipaddr, &b->socket.inet.dst_ipaddr); + if (ret != 0) return ret; /* * At this point, the order of comparing socket FDs @@ -78,8 +78,8 @@ int fr_packet_cmp(fr_radius_packet_t const *a, fr_radius_packet_t const *b) * fields will make the socket unique, and the other is * pretty much redundant. */ - rcode = (int) a->socket.inet.dst_port - (int) b->socket.inet.dst_port; - return rcode; + ret = (int) a->socket.inet.dst_port - (int) b->socket.inet.dst_port; + return ret; } /* diff --git a/src/protocols/radius/packet.c b/src/protocols/radius/packet.c index d1ff93c1e24..5fd88003a5e 100644 --- a/src/protocols/radius/packet.c +++ b/src/protocols/radius/packet.c @@ -308,7 +308,7 @@ int fr_radius_packet_verify(fr_radius_packet_t *packet, fr_radius_packet_t *orig int fr_radius_packet_sign(fr_radius_packet_t *packet, fr_radius_packet_t const *original, char const *secret) { - int rcode; + int ret; uint8_t const *original_data; if (original) { @@ -327,9 +327,9 @@ int fr_radius_packet_sign(fr_radius_packet_t *packet, fr_radius_packet_t const * memcpy(packet->data + 4, packet->vector, sizeof(packet->vector)); } - rcode = fr_radius_sign(packet->data, original_data, + ret = fr_radius_sign(packet->data, original_data, (uint8_t const *) secret, talloc_array_length(secret) - 1); - if (rcode < 0) return rcode; + if (ret < 0) return ret; memcpy(packet->vector, packet->data + 4, RADIUS_AUTH_VECTOR_LENGTH); return 0; @@ -494,10 +494,10 @@ int fr_radius_packet_send(fr_radius_packet_t *packet, fr_radius_packet_t const * * is allowed on some platforms, but it's not nice. */ if (packet->socket.proto == IPPROTO_TCP) { - ssize_t rcode; + ssize_t ret; - rcode = write(packet->socket.fd, packet->data, packet->data_len); - if (rcode >= 0) return rcode; + ret = write(packet->socket.fd, packet->data, packet->data_len); + if (ret >= 0) return ret; fr_strerror_printf("sendto failed: %s", fr_syserror(errno)); return -1; diff --git a/src/tests/keywords/map-xlat-nested b/src/tests/keywords/map-xlat-nested new file mode 100644 index 00000000000..379385168b3 --- /dev/null +++ b/src/tests/keywords/map-xlat-nested @@ -0,0 +1,14 @@ +# +# PRE: update +# +# Test the map xlat +# +update { + &Tmp-String-0 := "request.Tmp-Group-0.Tmp-String-1 = 'testing123'" +} + +if ("%{map:%{Tmp-String-0}}" != 1) { + test_fail +} + +success diff --git a/src/tests/util/atomic_queue_test.c b/src/tests/util/atomic_queue_test.c index 131ebec3897..6e8d2ed9ed7 100644 --- a/src/tests/util/atomic_queue_test.c +++ b/src/tests/util/atomic_queue_test.c @@ -74,7 +74,7 @@ static void NEVER_RETURNS usage(void) int main(int argc, char *argv[]) { - int c, i, rcode = 0; + int c, i, ret = 0; int size; intptr_t val; void *data; @@ -190,6 +190,6 @@ int main(int argc, char *argv[]) } #endif - return rcode; + return ret; } diff --git a/src/tests/util/message_set_test.c b/src/tests/util/message_set_test.c index 96915aa291e..5e1b2e28e4e 100644 --- a/src/tests/util/message_set_test.c +++ b/src/tests/util/message_set_test.c @@ -152,7 +152,7 @@ static void free_blocks(UNUSED fr_message_set_t *ms, UNUSED uint32_t *seed, int for (i = 0; i < my_alloc_size; i++) { int index; - int rcode; + int ret; fr_message_t *m; index = (*start + i) & (MY_ARRAY_SIZE - 1); @@ -161,11 +161,11 @@ static void free_blocks(UNUSED fr_message_set_t *ms, UNUSED uint32_t *seed, int fr_assert(m->status == FR_MESSAGE_USED); - rcode = fr_message_done(m); + ret = fr_message_done(m); #ifndef NDEBUG - fr_assert(rcode == 0); + fr_assert(ret == 0); #else - if (rcode != 0) fr_exit_now(EXIT_FAILURE); + if (ret != 0) fr_exit_now(EXIT_FAILURE); #endif used -= array[index]; @@ -196,7 +196,7 @@ static void NEVER_RETURNS usage(void) int main(int argc, char *argv[]) { int c; - int i, start, end, rcode; + int i, start, end, ret; fr_message_set_t *ms; uint32_t seed; @@ -409,9 +409,9 @@ int main(int argc, char *argv[]) /* * After the garbage collection, all messages marked "done" MUST also be marked "free". */ - rcode = fr_message_set_messages_used(ms); - fr_assert(rcode == 0); + ret = fr_message_set_messages_used(ms); + fr_assert(ret == 0); - return rcode; + return ret; } diff --git a/src/tests/util/radius1_test.c b/src/tests/util/radius1_test.c index 05a555caf83..9bd221aa189 100644 --- a/src/tests/util/radius1_test.c +++ b/src/tests/util/radius1_test.c @@ -93,7 +93,7 @@ static void NEVER_RETURNS usage(void) static rlm_rcode_t test_process(UNUSED void const *instance, request_t *request, fr_io_action_t action) { MPRINT1("\t\tPROCESS --- request %"PRIu64" action %d\n", request->number, action); - return RLM_MODULE_OK; + RETURN_MODULE_OK; } diff --git a/src/tests/util/radius_schedule_test.c b/src/tests/util/radius_schedule_test.c index 667e0b7aeb8..7c8ddf0f1f7 100644 --- a/src/tests/util/radius_schedule_test.c +++ b/src/tests/util/radius_schedule_test.c @@ -64,7 +64,7 @@ static fr_test_packet_ctx_t tpc; static rlm_rcode_t test_process(UNUSED void const *instance, request_t *request, fr_io_action_t action) { MPRINT1("\t\tPROCESS --- request %"PRIu64" action %d\n", request->number, action); - return RLM_MODULE_OK; + RETURN_MODULE_OK; } static int test_decode(void const *instance, request_t *request, uint8_t *const data, size_t data_len) diff --git a/src/tests/util/worker_test.c b/src/tests/util/worker_test.c index 36a3e4f4ea7..3d15454b24a 100644 --- a/src/tests/util/worker_test.c +++ b/src/tests/util/worker_test.c @@ -103,7 +103,7 @@ static void NEVER_RETURNS usage(void) static rlm_rcode_t test_process(UNUSED void const *inst, request_t *request, fr_io_action_t action) { MPRINT1("\t\tPROCESS --- request %"PRIu64" action %d\n", request->number, action); - return RLM_MODULE_OK; + RETURN_MODULE_OK; } static int test_decode(UNUSED void const *instance, request_t *request, uint8_t *const data, size_t data_len)