rlm_mruby.c

Go to the documentation of this file.

/*
 *   This program is is free software; you can redistribute it and/or modify
 *   it under the terms of the GNU General Public License as published by
 *   the Free Software Foundation; either version 2 of the License, or (at
 *   your option) any later version.
 *
 *   This program is distributed in the hope that it will be useful,
 *   but WITHOUT ANY WARRANTY; without even the implied warranty of
 *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *   GNU General Public License for more details.
 *
 *   You should have received a copy of the GNU General Public License
 *   along with this program; if not, write to the Free Software
 *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
 */
 
/**
 * $Id: 655b5ce8590b4197f0573f18cc91aa6978faa8d7 $
 * @file rlm_mruby.c
 * @brief Translates requests between the server an an mruby interpreter.
 *
 * @copyright 2016 Herwin Weststrate (freeradius@herwinw.nl)
 * @copyright 2016 The FreeRADIUS server project
 */
RCSID("$Id: 655b5ce8590b4197f0573f18cc91aa6978faa8d7 $")
 
#include <freeradius-devel/server/base.h>
#include <freeradius-devel/server/module_rlm.h>
#include <freeradius-devel/server/pairmove.h>
#include <freeradius-devel/util/debug.h>
 
#include "rlm_mruby.h"
 
typedef struct {
        char const      *function_name; //!< Name of the function being called
        char            *name1;         //!< Section name1 where this is called
        char            *name2;         //!< Section name2 where this is called
        fr_rb_node_t    node;           //!< Node in tree of function calls.
} mruby_func_def_t;
 
typedef struct {
        mruby_func_def_t        *func;
} mruby_call_env_t;
 
/*
 *      Define a structure for our module configuration.
 *
 *      These variables do not need to be in a structure, but it's
 *      a lot cleaner to do so, and a pointer to the structure can
 *      be used as the instance handle.
 */
typedef struct {
        char const *filename;
        char const *module_name;
 
        fr_rb_tree_t    funcs;                  //!< Tree of function calls found by call_env parser.
        bool            funcs_init;             //!< Has the tree been initialised.
 
        mrb_state *mrb;
 
        struct RClass *mruby_module;
        struct RClass *mruby_request;
        mrb_value mrubyconf_hash;
} rlm_mruby_t;
 
/*
 *      A mapping of configuration file names to internal variables.
 */
static const conf_parser_t module_config[] = {
        { FR_CONF_OFFSET_FLAGS("filename", CONF_FLAG_FILE_INPUT | CONF_FLAG_REQUIRED, rlm_mruby_t, filename) },
        { FR_CONF_OFFSET("module", rlm_mruby_t, module_name), .dflt = "Radiusd" },
        CONF_PARSER_TERMINATOR
};
 
/** How to compare two Ruby function calls
 *
 */
static int8_t mruby_func_def_cmp(void const *one, void const *two)
{
        mruby_func_def_t const *a = one, *b = two;
        int ret;
 
        ret = strcmp(a->name1, b->name1);
        if (ret != 0) return CMP(ret, 0);
        if (!a->name2 && !b->name2) return 0;
        if (!a->name2 || !b->name2) return a->name2 ? 1 : -1;
        ret = strcmp(a->name2, b->name2);
        return CMP(ret, 0);
}
 
static mrb_value mruby_log(mrb_state *mrb, UNUSED mrb_value self)
{
        mrb_int level;
        char *msg = NULL;
 
        mrb_get_args(mrb, "iz", &level, &msg);
        fr_log(&default_log, level, __FILE__, __LINE__, "rlm_ruby: %s", msg);
 
        return mrb_nil_value();
}
 
static void mruby_parse_config(mrb_state *mrb, CONF_SECTION *cs, int lvl, mrb_value hash)
{
        int indent_section = (lvl + 1) * 4;
        int indent_item = (lvl + 2) * 4;
        CONF_ITEM *ci = NULL;
 
        if (!cs) return;
 
        DEBUG("%*s%s {", indent_section, " ", cf_section_name1(cs));
 
        while ((ci = cf_item_next(cs, ci))) {
                if (cf_item_is_section(ci)) {
                        CONF_SECTION *sub_cs = cf_item_to_section(ci);
                        char const *key = cf_section_name1(sub_cs);
                        mrb_value sub_hash, mrubyKey;
 
                        if (!key) continue;
 
                        mrubyKey = mrb_str_new_cstr(mrb, key);
 
                        if (!mrb_nil_p(mrb_hash_get(mrb, hash, mrubyKey))) {
                                WARN("rlm_mruby: Ignoring duplicate config section '%s'", key);
                                continue;
                        }
 
                        sub_hash = mrb_hash_new(mrb);
                        mrb_hash_set(mrb, hash, mrubyKey, sub_hash);
 
                        mruby_parse_config(mrb, sub_cs, lvl + 1, sub_hash);
                } else if (cf_item_is_pair(ci)) {
                        CONF_PAIR *cp = cf_item_to_pair(ci);
                        const char *key = cf_pair_attr(cp);
                        const char *value = cf_pair_value(cp);
                        mrb_value mrubyKey, mrubyValue;
 
                        if (!key || !value) continue;
 
                        mrubyKey = mrb_str_new_cstr(mrb, key);
                        mrubyValue = mrb_str_new_cstr(mrb, value);
 
                        if (!mrb_nil_p(mrb_hash_get(mrb, hash, mrubyKey))) {
                                WARN("rlm_mruby: Ignoring duplicate config item '%s'", key);
                                continue;
                        }
 
                        mrb_hash_set(mrb, hash, mrubyKey, mrubyValue);
 
                        DEBUG("%*s%s = %s", indent_item, " ", key, value);
                }
        }
 
        DEBUG("%*s}", indent_section, " ");
}
 
/*
 *      Do any per-module initialization that is separate to each
 *      configured instance of the module.  e.g. set up connections
 *      to external databases, read configuration files, set up
 *      dictionary entries, etc.
 */
static int mod_instantiate(module_inst_ctx_t const *mctx)
{
        rlm_mruby_t *inst = talloc_get_type_abort(mctx->mi->data, rlm_mruby_t);
        mrb_state *mrb;
        CONF_SECTION *cs;
        FILE *f;
        mrb_value status;
 
        mrb = inst->mrb = mrb_open();
        if (!mrb) {
                ERROR("mruby initialization failed");
                return -1;
        }
 
        /* Define the freeradius module */
        DEBUG("Creating module %s", inst->module_name);
        inst->mruby_module = mrb_define_module(mrb, inst->module_name);
        if (!inst->mruby_module) {
                ERROR("Creating module %s failed", inst->module_name);
                return -1;
        }
 
        /* Define the log method */
        mrb_define_class_method(mrb, inst->mruby_module, "log", mruby_log, MRB_ARGS_REQ(2));
 
#define A(x) mrb_define_const(mrb, inst->mruby_module, #x, mrb_fixnum_value(x));
        /* Define the logging constants */
        A(L_DBG);
        A(L_WARN);
        A(L_INFO);
        A(L_ERR);
        A(L_WARN);
        A(L_DBG_WARN);
        A(L_DBG_ERR);
        A(L_DBG_WARN_REQ);
        A(L_DBG_ERR_REQ);
 
        /* Define the return value constants */
        A(RLM_MODULE_REJECT)
        A(RLM_MODULE_FAIL)
        A(RLM_MODULE_OK)
        A(RLM_MODULE_HANDLED)
        A(RLM_MODULE_INVALID)
        A(RLM_MODULE_DISALLOW)
        A(RLM_MODULE_NOTFOUND)
        A(RLM_MODULE_NOOP)
        A(RLM_MODULE_UPDATED)
        A(RLM_MODULE_NUMCODES)
#undef A
 
        /* Convert a FreeRADIUS config structure into a mruby hash */
        inst->mrubyconf_hash = mrb_hash_new(mrb);
        cs = cf_section_find(mctx->mi->conf, "config", NULL);
        if (cs) mruby_parse_config(mrb, cs, 0, inst->mrubyconf_hash);
 
        /* Define the Request class */
        inst->mruby_request = mruby_request_class(mrb, inst->mruby_module);
 
        DEBUG("Loading file %s...", inst->filename);
        f = fopen(inst->filename, "r");
        if (!f) {
                ERROR("Opening file failed");
                return -1;
        }
 
        status = mrb_load_file(mrb, f);
        fclose(f);
        if (mrb_undef_p(status)) {
                ERROR("Parsing file failed");
                return -1;
        }
 
        status = mrb_funcall(mrb, mrb_obj_value(inst->mruby_module), "instantiate", 0);
        if (mrb_undef_p(status)) {
                ERROR("Running instantiate failed");
                return -1;
        }
 
        return 0;
}
 
static int mruby_vps_to_array(request_t *request, mrb_value *out, mrb_state *mrb, fr_pair_list_t *vps)
{
        mrb_value       res;
        fr_pair_t       *vp;
 
        res = mrb_ary_new(mrb);
        for (vp = fr_pair_list_head(vps); vp; vp = fr_pair_list_next(vps, vp)) {
                mrb_value       tmp, key, val, to_cast;
 
                tmp = mrb_ary_new_capa(mrb, 2);
                key = mrb_str_new(mrb, vp->da->name, strlen(vp->da->name));
 
                /*
                 *      The only way to create floats, doubles, bools etc,
                 *      is to feed mruby the string representation and have
                 *      it convert to its internal types.
                 */
                switch (vp->vp_type) {
                case FR_TYPE_STRING:
                case FR_TYPE_OCTETS:
                        to_cast = mrb_str_new(mrb, vp->vp_ptr, vp->vp_length);
                        break;
 
                case FR_TYPE_BOOL:
#ifndef NDEBUG
                        to_cast = mrb_nil_value();      /* Not needed but clang flags it */
#endif
                        break;
 
                default:
                {
                        char    *in;
                        size_t  len;
 
                        len = fr_value_box_aprint(request, &in, &vp->data, NULL);
                        to_cast = mrb_str_new(mrb, in, len);
                        talloc_free(in);
                }
                        break;
                }
 
                switch (vp->vp_type) {
                case FR_TYPE_STRING:
                case FR_TYPE_OCTETS:
                case FR_TYPE_IPV4_ADDR:
                case FR_TYPE_IPV4_PREFIX:
                case FR_TYPE_IPV6_ADDR:
                case FR_TYPE_IPV6_PREFIX:
                case FR_TYPE_IFID:
                case FR_TYPE_ETHERNET:
                case FR_TYPE_COMBO_IP_ADDR:
                case FR_TYPE_COMBO_IP_PREFIX:
                        val = to_cast;          /* No conversions required */
                        break;
 
                case FR_TYPE_BOOL:
                        val = vp->vp_bool ? mrb_obj_value(mrb->true_class) : mrb_obj_value(mrb->false_class);
                        break;
 
                case FR_TYPE_UINT8:
                case FR_TYPE_UINT16:
                case FR_TYPE_UINT32:
                case FR_TYPE_UINT64:
                case FR_TYPE_INT8:
                case FR_TYPE_INT16:
                case FR_TYPE_INT32:
                case FR_TYPE_INT64:
                case FR_TYPE_DATE:
                case FR_TYPE_TIME_DELTA:
                case FR_TYPE_SIZE:
                        val = mrb_convert_type(mrb, to_cast, MRB_TT_FIXNUM, "Fixnum", "to_int");
                        break;
 
                case FR_TYPE_FLOAT32:
                case FR_TYPE_FLOAT64:
                        val = mrb_convert_type(mrb, to_cast, MRB_TT_FLOAT, "Float", "to_f");
                        break;
 
                case FR_TYPE_NON_LEAF:
                        fr_assert(0);
                        return -1;
                }
 
                mrb_ary_push(mrb, tmp, key);
                mrb_ary_push(mrb, tmp, val);
                mrb_ary_push(mrb, res, tmp);
 
                *out = res;
        }
 
        return 0;
}
 
static void add_vp_tuple(TALLOC_CTX *ctx, request_t *request, fr_pair_list_t *vps, mrb_state *mrb, mrb_value value, char const *function_name)
{
        int i;
        fr_pair_list_t tmp_list;
 
        fr_pair_list_init(&tmp_list);
 
        for (i = 0; i < RARRAY_LEN(value); i++) {
                mrb_value       tuple = mrb_ary_entry(value, i);
                mrb_value       key, val;
                char const      *ckey, *cval;
                fr_pair_t       *vp;
                tmpl_t  *dst;
                fr_token_t      op = T_OP_EQ;
 
                /* This tuple should be an array of length 2 */
                if (mrb_type(tuple) != MRB_TT_ARRAY) {
                        REDEBUG("add_vp_tuple, %s: non-array passed at index %i", function_name, i);
                        continue;
                }
 
                if (RARRAY_LEN(tuple) != 2 && RARRAY_LEN(tuple) != 3) {
                        REDEBUG("add_vp_tuple, %s: array with incorrect length passed at index "
                                "%i, expected 2 or 3, got %"PRId64, function_name, i, RARRAY_LEN(tuple));
                        continue;
                }
 
                key = mrb_ary_entry(tuple, 0);
                val = mrb_ary_entry(tuple, -1);
                if (mrb_type(key) != MRB_TT_STRING) {
                        REDEBUG("add_vp_tuple, %s: tuple element %i must have a string as first element", function_name, i);
                        continue;
                }
 
                ckey = mrb_str_to_cstr(mrb, key);
                cval = mrb_str_to_cstr(mrb, mrb_obj_as_string(mrb, val));
                if (ckey == NULL || cval == NULL) {
                        REDEBUG("%s: string conv failed", function_name);
                        continue;
                }
 
 
                if (RARRAY_LEN(tuple) == 3) {
                        if (mrb_type(mrb_ary_entry(tuple, 1)) != MRB_TT_STRING) {
                                REDEBUG("Invalid type for operator, expected string, falling back to =");
                        } else {
                                char const *cop = mrb_str_to_cstr(mrb, mrb_ary_entry(tuple, 1));
                                if (!(op = fr_table_value_by_str(fr_tokens_table, cop, 0))) {
                                        REDEBUG("Invalid operator: %s, falling back to =", cop);
                                        op = T_OP_EQ;
                                }
                        }
                }
                DEBUG("%s: %s %s %s", function_name, ckey, fr_table_str_by_value(fr_tokens_table, op, "="), cval);
 
                if (tmpl_afrom_attr_str(request, NULL, &dst, ckey,
                                        &(tmpl_rules_t){
                                                .attr = {
                                                        .dict_def = request->proto_dict,
                                                        .list_def = request_attr_reply,
                                                }
                                        }) <= 0) {
                        ERROR("Failed to find attribute %s", ckey);
                        continue;
                }
 
                if (tmpl_request_ptr(&request, tmpl_request(dst)) < 0) {
                        ERROR("Attribute name %s refers to outer request but not in a tunnel, skipping...", ckey);
                        talloc_free(dst);
                        continue;
                }
 
                MEM(vp = fr_pair_afrom_da(ctx, tmpl_attr_tail_da(dst)));
                talloc_free(dst);
 
                if (fr_pair_value_from_str(vp, cval, strlen(cval), NULL, false) < 0) {
                        REDEBUG("%s: %s = %s failed", function_name, ckey, cval);
                } else {
                        DEBUG("%s: %s = %s OK", function_name, ckey, cval);
                }
 
                fr_pair_append(&tmp_list, vp);
        }
        radius_pairmove(request, vps, &tmp_list);
}
 
static inline int mruby_set_vps(request_t *request, mrb_state *mrb, mrb_value mruby_request,
                                char const *list_name, fr_pair_list_t *vps)
{
        mrb_value res;
 
        memset(&res, 0, sizeof(res));   /* clang scan */
 
        if (mruby_vps_to_array(request, &res, mrb, vps) < 0) return -1;
 
        mrb_iv_set(mrb, mruby_request, mrb_intern_cstr(mrb, list_name), res);
 
        return 0;
}
 
static unlang_action_t CC_HINT(nonnull) mod_mruby(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
{
        rlm_mruby_t const       *inst = talloc_get_type_abort(mctx->mi->data, rlm_mruby_t);
        mruby_call_env_t        *func = talloc_get_type_abort(mctx->env_data, mruby_call_env_t);
        mrb_state *mrb = inst->mrb;
        mrb_value mruby_request, mruby_result;
 
        mruby_request = mrb_obj_new(mrb, inst->mruby_request, 0, NULL);
        mrb_iv_set(mrb, mruby_request, mrb_intern_cstr(mrb, "@frconfig"), inst->mrubyconf_hash);
        mruby_set_vps(request, mrb, mruby_request, "@request", &request->request_pairs);
        mruby_set_vps(request, mrb, mruby_request, "@reply", &request->reply_pairs);
        mruby_set_vps(request, mrb, mruby_request, "@control", &request->control_pairs);
        mruby_set_vps(request, mrb, mruby_request, "@session_state", &request->session_state_pairs);
 
DIAG_OFF(DIAG_UNKNOWN_PRAGMAS)
DIAG_OFF(class-varargs)
        mruby_result = mrb_funcall(mrb, mrb_obj_value(inst->mruby_module), func->func->function_name, 1, mruby_request);
DIAG_ON(class-varargs)
DIAG_ON(DIAG_UNKNOWN_PRAGMAS)
 
        /* Two options for the return value:
         * - a fixnum: convert to rlm_rcode_t, and return that
         * - an array: this should have exactly three items in it. The first one
         *             should be a fixnum, this will once again be converted to
         *             rlm_rcode_t and eventually returned. The other two items
         *             should be arrays. The items of the first array should be
         *             merged into reply, the second array into control.
         */
        switch (mrb_type(mruby_result)) {
                /* If it is a Fixnum: return that value */
                case MRB_TT_FIXNUM:
                        RETURN_MODULE_RCODE((rlm_rcode_t)mrb_int(mrb, mruby_result));
 
                case MRB_TT_ARRAY:
                        /* Must have exactly three items */
                        if (RARRAY_LEN(mruby_result) != 3) {
                                ERROR("Expected array to have exactly three values, got %" PRId64 " instead", RARRAY_LEN(mruby_result));
                                RETURN_MODULE_FAIL;
                        }
 
                        /* First item must be a Fixnum, this will be the return type */
                        if (mrb_type(mrb_ary_entry(mruby_result, 0)) != MRB_TT_FIXNUM) {
                                ERROR("Expected first array element to be a Fixnum, got %s instead", RSTRING_PTR(mrb_obj_as_string(mrb, mrb_ary_entry(mruby_result, 0))));
                                RETURN_MODULE_FAIL;
                        }
 
                        /* Second and third items must be Arrays, these will be the updates for reply and control */
                        if (mrb_type(mrb_ary_entry(mruby_result, 1)) != MRB_TT_ARRAY) {
                                ERROR("Expected second array element to be an Array, got %s instead", RSTRING_PTR(mrb_obj_as_string(mrb, mrb_ary_entry(mruby_result, 1))));
                                RETURN_MODULE_FAIL;
                        } else if (mrb_type(mrb_ary_entry(mruby_result, 2)) != MRB_TT_ARRAY) {
                                ERROR("Expected third array element to be an Array, got %s instead", RSTRING_PTR(mrb_obj_as_string(mrb, mrb_ary_entry(mruby_result, 2))));
                                RETURN_MODULE_FAIL;
                        }
 
                        add_vp_tuple(request->reply_ctx, request, &request->reply_pairs, mrb, mrb_ary_entry(mruby_result, 1), func->func->function_name);
                        add_vp_tuple(request->control_ctx, request, &request->control_pairs, mrb, mrb_ary_entry(mruby_result, 2), func->func->function_name);
                        RETURN_MODULE_RCODE((rlm_rcode_t)mrb_int(mrb, mrb_ary_entry(mruby_result, 0)));
 
                default:
                        /* Invalid return type */
                        ERROR("Expected return to be a Fixnum or an Array, got %s instead", RSTRING_PTR(mrb_obj_as_string(mrb, mruby_result)));
                        RETURN_MODULE_FAIL;
        }
}
 
/*
 *      Only free memory we allocated.  The strings allocated via
 *      cf_section_parse() do not need to be freed.
 */
static int mod_detach(module_detach_ctx_t const *mctx)
{
        rlm_mruby_t *inst = talloc_get_type_abort(mctx->mi->data, rlm_mruby_t);
 
        mrb_close(inst->mrb);
 
        return 0;
}
 
/*
 *      Restrict automatic Ruby function names to lowercase characters, numbers and underscore
 *      meaning that a module call in `recv Access-Request` will look for `recv_access_request`
 */
static void mruby_func_name_safe(char *name) {
        char    *p;
        size_t  i;
 
        p = name;
        for (i = 0; i < talloc_array_length(name); i++) {
                *p = tolower(*p);
                if (!strchr("abcdefghijklmnopqrstuvwxyz1234567890", *p)) *p = '_';
                p++;
        }
}
 
static int mruby_func_parse(TALLOC_CTX *ctx, call_env_parsed_head_t *out, UNUSED tmpl_rules_t const *t_rules,
                            UNUSED CONF_ITEM *ci, call_env_ctx_t const *cec, UNUSED call_env_parser_t const *rule)
{
        rlm_mruby_t             *inst = talloc_get_type_abort(cec->mi->data, rlm_mruby_t);
        call_env_parsed_t       *parsed;
        mruby_func_def_t        *func;
        void                    *found;
 
        if (!inst->funcs_init) {
                fr_rb_inline_init(&inst->funcs, mruby_func_def_t, node, mruby_func_def_cmp, NULL);
                inst->funcs_init = true;
        }
 
        MEM(parsed = call_env_parsed_add(ctx, out,
                                         &(call_env_parser_t){
                                                .name = "func",
                                                .flags = CALL_ENV_FLAG_PARSE_ONLY,
                                                .pair = {
                                                        .parsed = {
                                                                .offset = rule->pair.offset,
                                                                .type = CALL_ENV_PARSE_TYPE_VOID
                                                        }
                                                }
                                        }));
 
        MEM(func = talloc_zero(inst, mruby_func_def_t));
        func->name1 = talloc_strdup(func, cec->asked->name1);
        mruby_func_name_safe(func->name1);
        if (cec->asked->name2) {
                func->name2 = talloc_strdup(func, cec->asked->name2);
                mruby_func_name_safe(func->name2);
        }
        if (fr_rb_find_or_insert(&found, &inst->funcs, func) < 0) {
                talloc_free(func);
                return -1;
        }
 
        /*
        *       If the function call is already in the tree, use that entry.
        */
        if (found) {
                talloc_free(func);
                call_env_parsed_set_data(parsed, found);
        } else {
                call_env_parsed_set_data(parsed, func);
        }
        return 0;
}
 
static const call_env_method_t mruby_method_env = {
        FR_CALL_ENV_METHOD_OUT(mruby_call_env_t),
        .env = (call_env_parser_t[]) {
                { FR_CALL_ENV_SUBSECTION_FUNC(CF_IDENT_ANY, CF_IDENT_ANY, CALL_ENV_FLAG_PARSE_MISSING, mruby_func_parse) },
                CALL_ENV_TERMINATOR
        }
};
 
/*
 *      The module name should be the only globally exported symbol.
 *      That is, everything else should be 'static'.
 *
 *      If the module needs to temporarily modify it's instantiation
 *      data, the type should be changed to MODULE_TYPE_THREAD_UNSAFE.
 *      The server will then take care of ensuring that the module
 *      is single-threaded.
 */
extern module_rlm_t rlm_mruby;
module_rlm_t rlm_mruby = {
        .common = {
                .magic          = MODULE_MAGIC_INIT,
                .name           = "mruby",
                .flags          = MODULE_TYPE_THREAD_UNSAFE, /* Not sure */
                .inst_size      = sizeof(rlm_mruby_t),
                .config         = module_config,
                .instantiate    = mod_instantiate,
                .detach         = mod_detach,
        },
        .method_group = {
                .bindings = (module_method_binding_t[]){
                        { .section = SECTION_NAME(CF_IDENT_ANY, CF_IDENT_ANY), .method = mod_mruby, .method_env = &mruby_method_env },
                        MODULE_BINDING_TERMINATOR
                }
        }
};