OCS/ocs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ocs init

Browse Source
This commit is contained in:
zhangsz
2025-03-03 11:01:26 +08:00
parent 5f1710dc22
commit dae6fc93f7
1057 changed files with 519829 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

667
plat/diameter/libfdcore/fdd.y Normal file
View File

@@ -0,0 +1,667 @@
/*********************************************************************************************************
* Software License Agreement (BSD License) *
* Author: Sebastien Decugis <sdecugis@freediameter.net> *
* *
* Copyright (c) 2015, WIDE Project and NICT *
* All rights reserved. *
* *
* Redistribution and use of this software in source and binary forms, with or without modification, are *
* permitted provided that the following conditions are met: *
* *
* * Redistributions of source code must retain the above *
* copyright notice, this list of conditions and the *
* following disclaimer. *
* *
* * Redistributions in binary form must reproduce the above *
* copyright notice, this list of conditions and the *
* following disclaimer in the documentation and/or other *
* materials provided with the distribution. *
* *
* * Neither the name of the WIDE Project or NICT nor the *
* names of its contributors may be used to endorse or *
* promote products derived from this software without *
* specific prior written permission of WIDE Project and *
* NICT. *
* *
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED *
* WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A *
* PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR *
* ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT *
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS *
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR *
* TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF *
* ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. *
*********************************************************************************************************/
/* Yacc configuration parser.
*
* This file defines the grammar of the configuration file.
* Note that each extension has a separate independant configuration file.
*
* Note : This module is NOT thread-safe. All processing must be done from one thread only.
*/
/* For development only : */
%debug
%error-verbose
%parse-param {struct fd_config * conf}
/* Keep track of location */
%locations
%pure-parser
%{
#include "fdcore-internal.h"
#include "fdd.tab.h" /* bug : bison does not define the YYLTYPE before including this bloc, so... */
/* The Lex parser prototype */
int fddlex(YYSTYPE *lvalp, YYLTYPE *llocp);
/* Function to report error */
void yyerror (YYLTYPE *ploc, struct fd_config * conf, char const *s)
{
if (ploc->first_line != ploc->last_line) {
TRACE_ERROR("%s:%d.%d-%d.%d : %s", conf->cnf_file, ploc->first_line, ploc->first_column, ploc->last_line, ploc->last_column, s);
} else if (ploc->first_column != ploc->last_column) {
TRACE_ERROR("%s:%d.%d-%d : %s", conf->cnf_file, ploc->first_line, ploc->first_column, ploc->last_column, s);
} else {
TRACE_ERROR("%s:%d.%d : %s", conf->cnf_file, ploc->first_line, ploc->first_column, s);
}
}
int got_peer_noip = 0;
int got_peer_noipv6 = 0;
int got_peer_notcp = 0;
int got_peer_nosctp = 0;
struct peer_info fddpi;
%}
/* Values returned by lex for token */
%union {
char *string; /* The string is allocated by strdup in lex.*/
int integer; /* Store integer values */
}
/* In case of error in the lexical analysis */
%token LEX_ERROR
%token <string> QSTRING
%token <integer> INTEGER
%type <string> extconf
%token IDENTITY
%token REALM
%token PORT
%token SECPORT
%token SEC3436
%token NOIP
%token NOIP6
%token NOTCP
%token NOSCTP
%token PREFERTCP
%token OLDTLS
%token NOTLS
%token SCTPSTREAMS
%token APPSERVTHREADS
%token LISTENON
%token THRPERSRV
%token TCTIMER
%token TWTIMER
%token NORELAY
%token LOADEXT
%token CONNPEER
%token CONNTO
%token TLS_CRED
%token TLS_CA
%token TLS_CRL
%token TLS_PRIO
%token TLS_DH_BITS
%token TLS_DH_FILE
/* -------------------------------------- */
%%
/* The grammar definition - Sections blocs. */
conffile: /* Empty is OK -- for simplicity here, we reject in daemon later */
| conffile identity
| conffile realm
| conffile tctimer
| conffile twtimer
| conffile port
| conffile secport
| conffile sec3436
| conffile sctpstreams
| conffile listenon
| conffile thrpersrv
| conffile norelay
| conffile appservthreads
| conffile noip
| conffile noip6
| conffile notcp
| conffile nosctp
| conffile prefertcp
| conffile oldtls
| conffile loadext
| conffile connpeer
| conffile tls_cred
| conffile tls_ca
| conffile tls_crl
| conffile tls_prio
| conffile tls_dh
| conffile errors
{
yyerror(&yylloc, conf, "An error occurred while parsing the configuration file");
return EINVAL;
}
;
/* Lexical or syntax error */
errors: LEX_ERROR
| error
;
identity: IDENTITY '=' QSTRING ';'
{
conf->cnf_diamid = $3;
}
;
realm: REALM '=' QSTRING ';'
{
conf->cnf_diamrlm = $3;
}
;
tctimer: TCTIMER '=' INTEGER ';'
{
CHECK_PARAMS_DO( ($3 > 0),
{ yyerror (&yylloc, conf, "Invalid value"); YYERROR; } );
conf->cnf_timer_tc = (unsigned int)$3;
}
;
twtimer: TWTIMER '=' INTEGER ';'
{
CHECK_PARAMS_DO( ($3 > 5),
{ yyerror (&yylloc, conf, "Invalid value"); YYERROR; } );
conf->cnf_timer_tw = (unsigned int)$3;
}
;
port: PORT '=' INTEGER ';'
{
CHECK_PARAMS_DO( ($3 >= 0) && ($3 < 1<<16),
{ yyerror (&yylloc, conf, "Invalid value"); YYERROR; } );
conf->cnf_port = (uint16_t)$3;
}
;
secport: SECPORT '=' INTEGER ';'
{
CHECK_PARAMS_DO( ($3 >= 0) && ($3 < 1<<16),
{ yyerror (&yylloc, conf, "Invalid value"); YYERROR; } );
conf->cnf_port_tls = (uint16_t)$3;
}
;
sec3436: SEC3436 '=' INTEGER ';'
{
CHECK_PARAMS_DO( ($3 >= 0) && ($3 < 1<<16),
{ yyerror (&yylloc, conf, "Invalid value"); YYERROR; } );
conf->cnf_port_3436 = (uint16_t)$3;
}
;
sctpstreams: SCTPSTREAMS '=' INTEGER ';'
{
CHECK_PARAMS_DO( ($3 > 0) && ($3 < 1<<16),
{ yyerror (&yylloc, conf, "Invalid value"); YYERROR; } );
conf->cnf_sctp_str = (uint16_t)$3;
}
;
listenon: LISTENON '=' QSTRING ';'
{
struct addrinfo hints, *ai;
int ret;
memset(&hints, 0, sizeof(hints));
hints.ai_flags = AI_PASSIVE | AI_NUMERICHOST;
ret = getaddrinfo($3, NULL, &hints, &ai);
if (ret) { yyerror (&yylloc, conf, gai_strerror(ret)); YYERROR; }
CHECK_FCT_DO( fd_ep_add_merge( &conf->cnf_endpoints, ai->ai_addr, ai->ai_addrlen, EP_FL_CONF ), YYERROR );
freeaddrinfo(ai);
free($3);
}
;
thrpersrv: THRPERSRV '=' INTEGER ';'
{
CHECK_PARAMS_DO( ($3 > 0),
{ yyerror (&yylloc, conf, "Invalid value"); YYERROR; } );
conf->cnf_thr_srv = $3;
}
;
norelay: NORELAY ';'
{
conf->cnf_flags.no_fwd = 1;
}
;
appservthreads: APPSERVTHREADS '=' INTEGER ';'
{
CHECK_PARAMS_DO( ($3 > 0) && ($3 < 256),
{ yyerror (&yylloc, conf, "Invalid value"); YYERROR; } );
conf->cnf_dispthr = (uint16_t)$3;
}
;
noip: NOIP ';'
{
if (got_peer_noipv6) {
yyerror (&yylloc, conf, "No_IP conflicts with a ConnectPeer directive No_IPv6.");
YYERROR;
}
conf->cnf_flags.no_ip4 = 1;
}
;
noip6: NOIP6 ';'
{
if (got_peer_noip) {
yyerror (&yylloc, conf, "No_IP conflicts with a ConnectPeer directive No_IP.");
YYERROR;
}
conf->cnf_flags.no_ip6 = 1;
}
;
notcp: NOTCP ';'
{
#ifdef DISABLE_SCTP
yyerror (&yylloc, conf, "No_TCP cannot be specified for daemon compiled with DISABLE_SCTP option.");
YYERROR;
#endif
if (conf->cnf_flags.no_sctp)
{
yyerror (&yylloc, conf, "No_TCP conflicts with No_SCTP directive." );
YYERROR;
}
if (got_peer_nosctp) {
yyerror (&yylloc, conf, "No_TCP conflicts with a ConnectPeer directive No_SCTP.");
YYERROR;
}
conf->cnf_flags.no_tcp = 1;
}
;
nosctp: NOSCTP ';'
{
if (conf->cnf_flags.no_tcp)
{
yyerror (&yylloc, conf, "No_SCTP conflicts with No_TCP directive." );
YYERROR;
}
if (got_peer_notcp) {
yyerror (&yylloc, conf, "No_SCTP conflicts with a ConnectPeer directive No_TCP.");
YYERROR;
}
conf->cnf_flags.no_sctp = 1;
}
;
prefertcp: PREFERTCP ';'
{
conf->cnf_flags.pr_tcp = 1;
}
;
oldtls: OLDTLS ';'
{
conf->cnf_flags.tls_alg = 1;
}
;
loadext: LOADEXT '=' QSTRING extconf ';'
{
char * fname;
char * cfname;
FILE * fd;
/* Try and open the extension file */
fname = $3;
fd = fopen(fname, "r");
if ((fd == NULL) && (*fname != '/')) {
char * bkp = fname;
CHECK_MALLOC_DO( fname = malloc( strlen(bkp) + strlen(DEFAULT_EXTENSIONS_PATH) + 2 ),
{ yyerror (&yylloc, conf, "Not enough memory"); YYERROR; } );
sprintf(fname, DEFAULT_EXTENSIONS_PATH "/%s", bkp);
fd = fopen(fname, "r");
if (fd == NULL) {
free(fname);
fname = bkp;
} else {
free(bkp);
}
}
if (fd != NULL) {
fclose(fd);
} /* otherwise, LD_LIBRARY_PATH will be tested by dl_open.
This should not give any security issue, otherwise we can add an "else fail" here. */
/* Try and open the configuration file (optional) */
cfname = $4;
if (cfname) {
fd = fopen(cfname, "r");
if ((fd == NULL) && (*cfname != '/')) {
char * test;
CHECK_MALLOC_DO( test = malloc( strlen(cfname) + strlen(DEFAULT_CONF_PATH) + 2 ),
{ yyerror (&yylloc, conf, "Not enough memory"); YYERROR; } );
sprintf(test, DEFAULT_CONF_PATH "/%s", cfname);
fd = fopen(test, "r");
if (fd) {
free(cfname);
cfname=test;
} else {
/* This is not an error, we allow an extension to wait for something else than a real conf file. */
free(test);
}
}
if (fd)
fclose(fd);
}
CHECK_FCT_DO( fd_ext_add( fname, cfname ),
{ yyerror (&yylloc, conf, "Error adding extension"); YYERROR; } );
}
;
extconf: /* empty */
{
$$ = NULL;
}
| ':' QSTRING
{
$$ = $2;
}
;
connpeer: {
memset(&fddpi, 0, sizeof(fddpi));
fddpi.config.pic_flags.persist = PI_PRST_ALWAYS;
fd_list_init( &fddpi.pi_endpoints, NULL );
}
CONNPEER '=' QSTRING peerinfo ';'
{
fddpi.pi_diamid = $4;
CHECK_FCT_DO( fd_peer_add ( &fddpi, conf->cnf_file, NULL, NULL ),
{ yyerror (&yylloc, conf, "Error adding ConnectPeer information"); YYERROR; } );
/* Now destroy any content in the structure */
free(fddpi.pi_diamid);
free(fddpi.config.pic_realm);
free(fddpi.config.pic_priority);
while (!FD_IS_LIST_EMPTY(&fddpi.pi_endpoints)) {
struct fd_list * li = fddpi.pi_endpoints.next;
fd_list_unlink(li);
free(li);
}
}
;
peerinfo: /* empty */
| '{' peerparams '}'
;
peerparams: /* empty */
| peerparams NOIP ';'
{
if ((conf->cnf_flags.no_ip6) || (fddpi.config.pic_flags.pro3 == PI_P3_IP)) {
yyerror (&yylloc, conf, "No_IP conflicts with a No_IPv6 directive.");
YYERROR;
}
got_peer_noip++;
fddpi.config.pic_flags.pro3 = PI_P3_IPv6;
}
| peerparams NOIP6 ';'
{
if ((conf->cnf_flags.no_ip4) || (fddpi.config.pic_flags.pro3 == PI_P3_IPv6)) {
yyerror (&yylloc, conf, "No_IPv6 conflicts with a No_IP directive.");
YYERROR;
}
got_peer_noipv6++;
fddpi.config.pic_flags.pro3 = PI_P3_IP;
}
| peerparams NOTCP ';'
{
#ifdef DISABLE_SCTP
yyerror (&yylloc, conf, "No_TCP cannot be specified in daemon compiled with DISABLE_SCTP option.");
YYERROR;
#endif
if ((conf->cnf_flags.no_sctp) || (fddpi.config.pic_flags.pro4 == PI_P4_TCP)) {
yyerror (&yylloc, conf, "No_TCP conflicts with a No_SCTP directive.");
YYERROR;
}
got_peer_notcp++;
fddpi.config.pic_flags.pro4 = PI_P4_SCTP;
}
| peerparams NOSCTP ';'
{
if ((conf->cnf_flags.no_tcp) || (fddpi.config.pic_flags.pro4 == PI_P4_SCTP)) {
yyerror (&yylloc, conf, "No_SCTP conflicts with a No_TCP directive.");
YYERROR;
}
got_peer_nosctp++;
fddpi.config.pic_flags.pro4 = PI_P4_TCP;
}
| peerparams PREFERTCP ';'
{
fddpi.config.pic_flags.alg = PI_ALGPREF_TCP;
}
| peerparams OLDTLS ';'
{
fddpi.config.pic_flags.sec |= PI_SEC_TLS_OLD;
}
| peerparams NOTLS ';'
{
fddpi.config.pic_flags.sec |= PI_SEC_NONE;
}
| peerparams SEC3436 ';'
{
fddpi.config.pic_flags.sctpsec |= PI_SCTPSEC_3436;
}
| peerparams REALM '=' QSTRING ';'
{
fddpi.config.pic_realm = $4;
}
| peerparams PORT '=' INTEGER ';'
{
CHECK_PARAMS_DO( ($4 > 0) && ($4 < 1<<16),
{ yyerror (&yylloc, conf, "Invalid port value"); YYERROR; } );
fddpi.config.pic_port = (uint16_t)$4;
}
| peerparams TCTIMER '=' INTEGER ';'
{
fddpi.config.pic_tctimer = $4;
}
| peerparams TWTIMER '=' INTEGER ';'
{
fddpi.config.pic_twtimer = $4;
}
| peerparams TLS_PRIO '=' QSTRING ';'
{
fddpi.config.pic_priority = $4;
}
| peerparams CONNTO '=' QSTRING ';'
{
struct addrinfo hints, *ai;
int ret;
int disc = 0;
memset(&hints, 0, sizeof(hints));
hints.ai_flags = AI_ADDRCONFIG | AI_NUMERICHOST;
ret = getaddrinfo($4, NULL, &hints, &ai);
if (ret == EAI_NONAME) {
/* The name was maybe not numeric, try again */
disc = EP_FL_DISC;
hints.ai_flags &= ~ AI_NUMERICHOST;
ret = getaddrinfo($4, NULL, &hints, &ai);
}
if (ret) { yyerror (&yylloc, conf, gai_strerror(ret)); YYERROR; }
CHECK_FCT_DO( fd_ep_add_merge( &fddpi.pi_endpoints, ai->ai_addr, ai->ai_addrlen, EP_FL_CONF | (disc ?: EP_ACCEPTALL) ), YYERROR );
free($4);
freeaddrinfo(ai);
}
;
tls_cred: TLS_CRED '=' QSTRING ',' QSTRING ';'
{
FILE * fd;
fd = fopen($3, "r");
if (fd == NULL) {
int ret = errno;
TRACE_ERROR("Unable to open certificate file %s for reading: %s", $3, strerror(ret));
yyerror (&yylloc, conf, "Error on file name");
YYERROR;
}
fclose(fd);
fd = fopen($5, "r");
if (fd == NULL) {
int ret = errno;
TRACE_ERROR("Unable to open private key file %s for reading: %s", $5, strerror(ret));
yyerror (&yylloc, conf, "Error on file name");
YYERROR;
}
fclose(fd);
conf->cnf_sec_data.cert_file = $3;
conf->cnf_sec_data.key_file = $5;
CHECK_GNUTLS_DO( gnutls_certificate_set_x509_key_file(
conf->cnf_sec_data.credentials,
conf->cnf_sec_data.cert_file,
conf->cnf_sec_data.key_file,
GNUTLS_X509_FMT_PEM),
{ yyerror (&yylloc, conf, "Error opening certificate or private key file."); YYERROR; } );
}
;
tls_ca: TLS_CA '=' QSTRING ';'
{
FILE * fd;
fd = fopen($3, "rb");
if (fd == NULL) {
int ret = errno;
TRACE_ERROR("Unable to open CA file %s for reading: %s", $3, strerror(ret));
yyerror (&yylloc, conf, "Error on file name");
YYERROR;
}
#ifdef GNUTLS_VERSION_300
{
/* We import these CA in the trust list */
gnutls_x509_crt_t * calist;
unsigned int cacount;
gnutls_datum_t cafile;
CHECK_FCT_DO( fd_conf_stream_to_gnutls_datum(fd, &cafile),
{ yyerror (&yylloc, conf, "Error reading CA file."); YYERROR; } );
CHECK_GNUTLS_DO( gnutls_x509_crt_list_import2(&calist, &cacount, &cafile, GNUTLS_X509_FMT_PEM,
GNUTLS_X509_CRT_LIST_FAIL_IF_UNSORTED),
{ yyerror (&yylloc, conf, "Error importing CA file."); YYERROR; } );
free(cafile.data);
CHECK_GNUTLS_DO( gnutls_x509_trust_list_add_cas (fd_g_config->cnf_sec_data.trustlist, calist, cacount, 0),
{ yyerror (&yylloc, conf, "Error saving CA in trust list."); YYERROR; } );
}
#endif /* GNUTLS_VERSION_300 */
fclose(fd);
conf->cnf_sec_data.ca_file = $3;
CHECK_GNUTLS_DO( conf->cnf_sec_data.ca_file_nr += gnutls_certificate_set_x509_trust_file(
conf->cnf_sec_data.credentials,
conf->cnf_sec_data.ca_file,
GNUTLS_X509_FMT_PEM),
{ yyerror (&yylloc, conf, "Error setting CA parameters."); YYERROR; } );
}
;
tls_crl: TLS_CRL '=' QSTRING ';'
{
FILE * fd;
fd = fopen($3, "rb");
if (fd == NULL) {
int ret = errno;
TRACE_ERROR("Unable to open CRL file %s for reading: %s", $3, strerror(ret));
yyerror (&yylloc, conf, "Error on file name");
YYERROR;
}
#ifdef GNUTLS_VERSION_300
{
/* We import these CRL in the trust list */
gnutls_x509_crl_t * crllist;
unsigned int crlcount;
gnutls_datum_t crlfile;
CHECK_FCT_DO( fd_conf_stream_to_gnutls_datum(fd, &crlfile),
{ yyerror (&yylloc, conf, "Error reading CRL file."); YYERROR; } );
CHECK_GNUTLS_DO( gnutls_x509_crl_list_import2(&crllist, &crlcount, &crlfile, GNUTLS_X509_FMT_PEM, 0),
{ yyerror (&yylloc, conf, "Error importing CRL file."); YYERROR; } );
free(crlfile.data);
CHECK_GNUTLS_DO( gnutls_x509_trust_list_add_crls (fd_g_config->cnf_sec_data.trustlist, crllist, crlcount,
GNUTLS_TL_VERIFY_CRL,
0),
{ yyerror (&yylloc, conf, "Error importing CRL in trust list."); YYERROR; } );
}
#endif /* GNUTLS_VERSION_300 */
fclose(fd);
conf->cnf_sec_data.crl_file = $3;
CHECK_GNUTLS_DO( gnutls_certificate_set_x509_crl_file(
conf->cnf_sec_data.credentials,
conf->cnf_sec_data.crl_file,
GNUTLS_X509_FMT_PEM),
{ yyerror (&yylloc, conf, "Error setting CRL parameters."); YYERROR; } );
}
;
tls_prio: TLS_PRIO '=' QSTRING ';'
{
const char * err_pos = NULL;
conf->cnf_sec_data.prio_string = $3;
CHECK_GNUTLS_DO( gnutls_priority_init(
&conf->cnf_sec_data.prio_cache,
conf->cnf_sec_data.prio_string,
&err_pos),
{ yyerror (&yylloc, conf, "Error setting Priority parameter.");
TRACE_ERROR("Error at position : %s", err_pos);
YYERROR; } );
}
;
tls_dh: TLS_DH_BITS '=' INTEGER ';'
{
conf->cnf_sec_data.dh_bits = $3;
}
| TLS_DH_FILE '=' QSTRING ';'
{
FILE * fd;
free(conf->cnf_sec_data.dh_file);
conf->cnf_sec_data.dh_file = $3;
fd = fopen($3, "r");
if (fd == NULL) {
int ret = errno;
TRACE_ERROR("Unable to open DH file %s for reading: %s", $3, strerror(ret));
yyerror (&yylloc, conf, "Error on file name");
YYERROR;
}
fclose(fd);
}
;