Esempio n. 1
0
void
accounting(u_char *pak)
{
    struct acct *acct_pak;
    u_char *p;
    HDR *hdr;
    int i, len;

    if (debug & DEBUG_ACCT_FLAG)
	report(LOG_DEBUG, "Start accounting request");

    hdr = (HDR *) pak;
    acct_pak = (struct acct *) (pak + TAC_PLUS_HDR_SIZE);

    /* Do some sanity checking on the packet */

    /* arg counts start here */
    p = pak + TAC_PLUS_HDR_SIZE + TAC_ACCT_REQ_FIXED_FIELDS_SIZE;

    /* Length checks */
    len = TAC_ACCT_REQ_FIXED_FIELDS_SIZE;
    len += acct_pak->user_len + acct_pak->port_len +
	acct_pak->rem_addr_len + acct_pak->arg_cnt;
    for (i = 0; i < (int)acct_pak->arg_cnt; i++) {
	len += p[i];
    }

    if (len != ntohl(hdr->datalength)) {
	send_error_reply(TAC_PLUS_ACCT, NULL);
	return;
    }

    account(pak);
}
Esempio n. 2
0
/* Make sure version number is kosher. Return 0 if it is */
int
bad_version_check(u_char *pak)
{
    HDR *hdr = (HDR *)pak;

    switch (hdr->type) {
    case TAC_PLUS_AUTHEN:
	/*
	 * Let authen routines take care of more sophisticated version
	 * checking as its now a bit involved.
	 */
	return(0);

    case TAC_PLUS_AUTHOR:
    case TAC_PLUS_ACCT:
	if (hdr->version != TAC_PLUS_VER_0) {
	    send_error_reply(hdr->type, "Illegal packet version");
	    return(1);
	}
	return(0);

    default:
	return(1);
    }
}
Esempio n. 3
0
static void ipmi_powernv_send(void *send_info, struct ipmi_smi_msg *msg)
{
	struct ipmi_smi_powernv *smi = send_info;
	struct opal_ipmi_msg *opal_msg;
	unsigned long flags;
	int comp, rc;
	size_t size;

	/* ensure data_len will fit in the opal_ipmi_msg buffer... */
	if (msg->data_size > IPMI_MAX_MSG_LENGTH) {
		comp = IPMI_REQ_LEN_EXCEEDED_ERR;
		goto err;
	}

	/* ... and that we at least have netfn and cmd bytes */
	if (msg->data_size < 2) {
		comp = IPMI_REQ_LEN_INVALID_ERR;
		goto err;
	}

	spin_lock_irqsave(&smi->msg_lock, flags);

	if (smi->cur_msg) {
		comp = IPMI_NODE_BUSY_ERR;
		goto err_unlock;
	}

	/* format our data for the OPAL API */
	opal_msg = smi->opal_msg;
	opal_msg->version = OPAL_IPMI_MSG_FORMAT_VERSION_1;
	opal_msg->netfn = msg->data[0];
	opal_msg->cmd = msg->data[1];
	if (msg->data_size > 2)
		memcpy(opal_msg->data, msg->data + 2, msg->data_size - 2);

	/* data_size already includes the netfn and cmd bytes */
	size = sizeof(*opal_msg) + msg->data_size - 2;

	pr_devel("%s: opal_ipmi_send(0x%llx, %p, %ld)\n", __func__,
			smi->interface_id, opal_msg, size);
	rc = opal_ipmi_send(smi->interface_id, opal_msg, size);
	pr_devel("%s:  -> %d\n", __func__, rc);

	if (!rc) {
		smi->cur_msg = msg;
		spin_unlock_irqrestore(&smi->msg_lock, flags);
		return;
	}

	comp = IPMI_ERR_UNSPECIFIED;
err_unlock:
	spin_unlock_irqrestore(&smi->msg_lock, flags);
err:
	send_error_reply(smi, msg, comp);
}
Esempio n. 4
0
/* Process client (control point) requests */
void
upnp_http_process(UPNP_CONTEXT *context, int s)
{
	context->fd = s;

	/* process HTTP header */
	if (upnp_http_fsm_engine(context, upnp_http_fsm) == -1) {
		send_error_reply(context);
	}

	close(s);
	return;
}
Esempio n. 5
0
/* ARGSUSED */
static void
ipc_action_timeout(iu_tq_t *tq, void *arg)
{
	dhcp_smach_t		*dsmp = arg;
	struct ipc_action	*ia = &dsmp->dsm_ia;

	dsmp->dsm_dflags &= ~DHCP_IF_BUSY;

	ia->ia_tid = -1;

	dhcpmsg(MSG_VERBOSE, "ipc timeout waiting for agent to complete "
	    "%s (command %d) for %s", dhcp_ipc_type_to_string(ia->ia_cmd),
	    ia->ia_cmd, dsmp->dsm_name);

	send_error_reply(ia, DHCP_IPC_E_TIMEOUT);

	async_finish(dsmp);
	release_smach(dsmp);
}
Esempio n. 6
0
void
ipc_action_finish(dhcp_smach_t *dsmp, int reason)
{
	struct ipc_action *ia = &dsmp->dsm_ia;

	dsmp->dsm_dflags &= ~DHCP_IF_BUSY;

	if (dsmp->dsm_ia.ia_fd == -1) {
		dhcpmsg(MSG_ERROR,
		    "ipc_action_finish: attempted to finish unknown action "
		    "on %s", dsmp->dsm_name);
		return;
	}

	dhcpmsg(MSG_DEBUG,
	    "ipc_action_finish: finished %s (command %d) on %s: %d",
	    dhcp_ipc_type_to_string(ia->ia_cmd), (int)ia->ia_cmd,
	    dsmp->dsm_name, reason);

	/*
	 * if we can't cancel this timer, we're really in the
	 * twilight zone.  however, as long as we don't drop the
	 * reference to the state machine, it shouldn't hurt us
	 */

	if (dsmp->dsm_ia.ia_tid != -1 &&
	    iu_cancel_timer(tq, dsmp->dsm_ia.ia_tid, NULL) == 1) {
		dsmp->dsm_ia.ia_tid = -1;
		release_smach(dsmp);
	}

	if (reason == 0)
		send_ok_reply(ia);
	else
		send_error_reply(ia, reason);

	async_finish(dsmp);
}
Esempio n. 7
0
/* ARGSUSED */
static void
ipc_event(iu_eh_t *ehp, int fd, short events, iu_event_id_t id, void *arg)
{
	dhcp_ipc_request_t	*request;
	struct ifslist		*ifsp, *primary_ifsp;
	int			error, is_priv = (int)arg;
	PKT_LIST 		*plp[2];
	dhcp_ipc_type_t		cmd;

	(void) iu_unregister_event(eh, id, NULL);

	if (dhcp_ipc_recv_request(fd, &request, DHCP_IPC_REQUEST_WAIT) != 0) {
		dhcpmsg(MSG_ERROR, "ipc_event: dhcp_ipc_recv_request failed");
		(void) dhcp_ipc_close(fd);
		return;
	}

	cmd = DHCP_IPC_CMD(request->message_type);
	if (cmd >= DHCP_NIPC) {
		send_error_reply(request, DHCP_IPC_E_CMD_UNKNOWN, &fd);
		return;
	}

	/* return EPERM for any of the privileged actions */

	if (!is_priv) {
		switch (cmd) {

		case DHCP_STATUS:
		case DHCP_PING:
		case DHCP_GET_TAG:
			break;

		default:
			dhcpmsg(MSG_WARNING, "ipc_event: privileged ipc "
			    "command (%i) attempted on %s", cmd,
			    request->ifname);

			send_error_reply(request, DHCP_IPC_E_PERM, &fd);
			return;
		}
	}

	/*
	 * try to locate the ifs associated with this command.  if the
	 * command is DHCP_START or DHCP_INFORM, then if there isn't
	 * an ifs already, make one (there may already be one from a
	 * previous failed attempt to START or INFORM).  otherwise,
	 * verify the interface is still valid.
	 */

	ifsp = lookup_ifs(request->ifname);

	switch (cmd) {

	case DHCP_START:			/* FALLTHRU */
	case DHCP_INFORM:
		/*
		 * it's possible that the interface already exists, but
		 * has been abandoned.  usually in those cases we should
		 * return DHCP_IPC_E_UNKIF, but that makes little sense
		 * in the case of "start" or "inform", so just ignore
		 * the abandoned interface and start over anew.
		 */

		if (ifsp != NULL && verify_ifs(ifsp) == 0)
			ifsp = NULL;

		/*
		 * as part of initializing the ifs, insert_ifs()
		 * creates a DLPI stream at ifsp->if_dlpi_fd.
		 */

		if (ifsp == NULL) {
			ifsp = insert_ifs(request->ifname, B_FALSE, &error);
			if (ifsp == NULL) {
				send_error_reply(request, error, &fd);
				return;
			}
		}
		break;

	default:
		if (ifsp == NULL) {
			if (request->ifname[0] == '\0')
				error = DHCP_IPC_E_NOPRIMARY;
			else
				error = DHCP_IPC_E_UNKIF;

			send_error_reply(request, error, &fd);
			return;
		}
		break;
	}

	if (verify_ifs(ifsp) == 0) {
		send_error_reply(request, DHCP_IPC_E_UNKIF, &fd);
		return;
	}

	if (ifsp->if_dflags & DHCP_IF_BOOTP) {
		switch (cmd) {

		case DHCP_EXTEND:
		case DHCP_RELEASE:
		case DHCP_INFORM:
			send_error_reply(request, DHCP_IPC_E_BOOTP, &fd);
			return;

		default:
			break;
		}
	}

	/*
	 * verify that the interface is in a state which will allow the
	 * command.  we do this up front so that we can return an error
	 * *before* needlessly cancelling an in-progress transaction.
	 */

	if (!ipc_cmd_allowed[ifsp->if_state][cmd]) {
		send_error_reply(request, DHCP_IPC_E_OUTSTATE, &fd);
		return;
	}

	if ((request->message_type & DHCP_PRIMARY) && is_priv) {
		if ((primary_ifsp = lookup_ifs("")) != NULL)
			primary_ifsp->if_dflags &= ~DHCP_IF_PRIMARY;
		ifsp->if_dflags |= DHCP_IF_PRIMARY;
	}

	/*
	 * current design dictates that there can be only one
	 * outstanding transaction per interface -- this simplifies
	 * the code considerably and also fits well with RFC2131.
	 * it is worth classifying the different DHCP commands into
	 * synchronous (those which we will handle now and be done
	 * with) and asynchronous (those which require transactions
	 * and will be completed at an indeterminate time in the
	 * future):
	 *
	 *    DROP: removes the agent's management of an interface.
	 *	    asynchronous as the script program may be invoked.
	 *
	 *    PING: checks to see if the agent controls an interface.
	 *	    synchronous, since no packets need to be sent
	 *	    to the DHCP server.
	 *
	 *  STATUS: returns information about the an interface.
	 *	    synchronous, since no packets need to be sent
	 *	    to the DHCP server.
	 *
	 * RELEASE: releases the agent's management of an interface
	 *	    and brings the interface down.  asynchronous as
	 *	    the script program may be invoked.
	 *
	 *  EXTEND: renews a lease.  asynchronous, since the agent
	 *	    needs to wait for an ACK, etc.
	 *
	 *   START: starts DHCP on an interface.  asynchronous since
	 *	    the agent needs to wait for OFFERs, ACKs, etc.
	 *
	 *  INFORM: obtains configuration parameters for an externally
	 *	    configured interface.  asynchronous, since the
	 *	    agent needs to wait for an ACK.
	 *
	 * notice that EXTEND, INFORM, START, DROP and RELEASE are
	 * asynchronous. notice also that asynchronous commands may
	 * occur from within the agent -- for instance, the agent
	 * will need to do implicit EXTENDs to extend the lease. in
	 * order to make the code simpler, the following rules apply
	 * for asynchronous commands:
	 *
	 * there can only be one asynchronous command at a time per
	 * interface.  the current asynchronous command is managed by
	 * the async_* api: async_start(), async_finish(),
	 * async_timeout(), async_cancel(), and async_pending().
	 * async_start() starts management of a new asynchronous
	 * command on an interface, which should only be done after
	 * async_pending() is called to check that there are no
	 * pending asynchronous commands on that interface.  when the
	 * command is completed, async_finish() should be called.  all
	 * asynchronous commands have an associated timer, which calls
	 * async_timeout() when it times out.  if async_timeout()
	 * decides that the asynchronous command should be cancelled
	 * (see below), it calls async_cancel() to attempt
	 * cancellation.
	 *
	 * asynchronous commands started by a user command have an
	 * associated ipc_action which provides the agent with
	 * information for how to get in touch with the user command
	 * when the action completes.  these ipc_action records also
	 * have an associated timeout which may be infinite.
	 * ipc_action_start() should be called when starting an
	 * asynchronous command requested by a user, which sets up the
	 * timer and keeps track of the ipc information (file
	 * descriptor, request type).  when the asynchronous command
	 * completes, ipc_action_finish() should be called to return a
	 * command status code to the user and close the ipc
	 * connection).  if the command does not complete before the
	 * timer fires, ipc_action_timeout() is called which closes
	 * the ipc connection and returns DHCP_IPC_E_TIMEOUT to the
	 * user.  note that independent of ipc_action_timeout(),
	 * ipc_action_finish() should be called.
	 *
	 * on a case-by-case basis, here is what happens (per interface):
	 *
	 *    o when an asynchronous command is requested, then
	 *	async_pending() is called to see if there is already
	 *	an asynchronous event.  if so, the command does not
	 *	proceed, and if there is an associated ipc_action,
	 *	the user command is sent DHCP_IPC_E_PEND.
	 *
	 *    o otherwise, the the transaction is started with
	 *	async_start().  if the transaction is on behalf
	 *	of a user, ipc_action_start() is called to keep
	 *	track of the ipc information and set up the
	 *	ipc_action timer.
	 *
	 *    o if the command completes normally and before a
	 *	timeout fires, then async_finish() is called.
	 *	if there was an associated ipc_action,
	 *	ipc_action_finish() is called to complete it.
	 *
	 *    o if the command fails before a timeout fires, then
	 *	async_finish() is called, and the interface is
	 *	is returned to a known state based on the command.
	 *	if there was an associated ipc_action,
	 *	ipc_action_finish() is called to complete it.
	 *
	 *    o if the ipc_action timer fires before command
	 *	completion, then DHCP_IPC_E_TIMEOUT is returned to
	 *	the user.  however, the transaction continues to
	 *	be carried out asynchronously.
	 *
	 *    o if async_timeout() fires before command completion,
	 *	then if the command was internal to the agent, it
	 *	is cancelled.  otherwise, if it was a user command,
	 *	then if the user is still waiting for the command
	 *	to complete, the command continues and async_timeout()
	 *	is rescheduled.
	 */

	switch (cmd) {

	case DHCP_DROP:					/* FALLTHRU */
	case DHCP_RELEASE:				/* FALLTHRU */
	case DHCP_EXTEND:				/* FALLTHRU */
	case DHCP_INFORM:				/* FALLTHRU */
	case DHCP_START:
		/*
		 * if shutdown request has been received, send back an error.
		 */
		if (shutdown_started) {
			send_error_reply(request, DHCP_IPC_E_OUTSTATE, &fd);
			return;
		}

		if (async_pending(ifsp)) {
			send_error_reply(request, DHCP_IPC_E_PEND, &fd);
			return;
		}

		if (ipc_action_start(ifsp, request, fd) == 0) {
			dhcpmsg(MSG_WARNING, "ipc_event: ipc_action_start "
			    "failed for %s", ifsp->if_name);
			send_error_reply(request, DHCP_IPC_E_MEMORY, &fd);
			return;
		}

		if (async_start(ifsp, cmd, B_TRUE) == 0) {
			ipc_action_finish(ifsp, DHCP_IPC_E_MEMORY);
			return;
		}
		break;

	default:
		break;
	}

	switch (cmd) {

	case DHCP_DROP:
		(void) script_start(ifsp, EVENT_DROP, dhcp_drop, NULL, NULL);
		return;

	case DHCP_EXTEND:
		(void) dhcp_extending(ifsp);
		break;

	case DHCP_GET_TAG: {
		dhcp_optnum_t	optnum;
		DHCP_OPT	*opt = NULL;
		boolean_t	did_alloc = B_FALSE;
		PKT_LIST	*ack = ifsp->if_ack;

		/*
		 * verify the request makes sense.
		 */

		if (request->data_type   != DHCP_TYPE_OPTNUM ||
		    request->data_length != sizeof (dhcp_optnum_t)) {
			send_error_reply(request, DHCP_IPC_E_PROTO, &fd);
			return;
		}

		(void) memcpy(&optnum, request->buffer, sizeof (dhcp_optnum_t));
load_option:
		switch (optnum.category) {

		case DSYM_SITE:			/* FALLTHRU */
		case DSYM_STANDARD:
			if (optnum.code <= DHCP_LAST_OPT)
				opt = ack->opts[optnum.code];
			break;

		case DSYM_VENDOR:
			/*
			 * the test against VS_OPTION_START is broken up into
			 * two tests to avoid compiler warnings under intel.
			 */

			if ((optnum.code > VS_OPTION_START ||
			    optnum.code == VS_OPTION_START) &&
			    optnum.code <= VS_OPTION_END)
				opt = ack->vs[optnum.code];
			break;

		case DSYM_FIELD:
			if (optnum.code + optnum.size > sizeof (PKT))
				break;

			/* + 2 to account for option code and length byte */
			opt = malloc(optnum.size + 2);
			if (opt == NULL) {
				send_error_reply(request, DHCP_IPC_E_MEMORY,
				    &fd);
				return;
			}

			did_alloc = B_TRUE;
			opt->len  = optnum.size;
			opt->code = optnum.code;
			(void) memcpy(&opt->value, (caddr_t)ack->pkt +
			    opt->code, opt->len);

			break;

		default:
			send_error_reply(request, DHCP_IPC_E_PROTO, &fd);
			return;
		}

		/*
		 * return the option payload, if there was one.  the "+ 2"
		 * accounts for the option code number and length byte.
		 */

		if (opt != NULL) {
			send_data_reply(request, &fd, 0, DHCP_TYPE_OPTION, opt,
			    opt->len + 2);

			if (did_alloc)
				free(opt);
			return;
		} else if (ack != ifsp->if_orig_ack) {
			/*
			 * There wasn't any definition for the option in the
			 * current ack, so now retry with the original ack if
			 * the original ack is not the current ack.
			 */
			ack = ifsp->if_orig_ack;
			goto load_option;
		}

		/*
		 * note that an "okay" response is returned either in
		 * the case of an unknown option or a known option
		 * with no payload.  this is okay (for now) since
		 * dhcpinfo checks whether an option is valid before
		 * ever performing ipc with the agent.
		 */

		send_ok_reply(request, &fd);
		return;
	}

	case DHCP_INFORM:
		dhcp_inform(ifsp);
		/* next destination: dhcp_acknak() */
		return;

	case DHCP_PING:
		if (ifsp->if_dflags & DHCP_IF_FAILED)
			send_error_reply(request, DHCP_IPC_E_FAILEDIF, &fd);
		else
			send_ok_reply(request, &fd);
		return;

	case DHCP_RELEASE:
		(void) script_start(ifsp, EVENT_RELEASE, dhcp_release,
		    "Finished with lease.", NULL);
		return;

	case DHCP_START:
		(void) canonize_ifs(ifsp);

		/*
		 * if we have a valid hostconf lying around, then jump
		 * into INIT_REBOOT.  if it fails, we'll end up going
		 * through the whole selecting() procedure again.
		 */

		error = read_hostconf(ifsp->if_name, plp, 2);
		if (error != -1) {
			ifsp->if_orig_ack = ifsp->if_ack = plp[0];
			if (error > 1) {
				/*
				 * Return indicated we had more than one packet
				 * second one is the original ack.  Older
				 * versions of the agent wrote only one ack
				 * to the file, we now keep both the first
				 * ack as well as the last one.
				 */
				ifsp->if_orig_ack = plp[1];
			}
			dhcp_init_reboot(ifsp);
			/* next destination: dhcp_acknak() */
			return;
		}

		/*
		 * if not debugging, wait for a few seconds before
		 * going into SELECTING.
		 */

		if (debug_level == 0) {
			if (iu_schedule_timer_ms(tq,
			    lrand48() % DHCP_SELECT_WAIT, dhcp_start, ifsp)
			    != -1) {
				hold_ifs(ifsp);
				/* next destination: dhcp_start() */
				return;
			}
		}

		dhcp_selecting(ifsp);
		/* next destination: dhcp_requesting() */
		return;

	case DHCP_STATUS: {
		dhcp_status_t	status;

		status.if_began = monosec_to_time(ifsp->if_curstart_monosec);

		if (ifsp->if_lease == DHCP_PERM) {
			status.if_t1	= DHCP_PERM;
			status.if_t2	= DHCP_PERM;
			status.if_lease	= DHCP_PERM;
		} else {
			status.if_t1	= status.if_began + ifsp->if_t1;
			status.if_t2	= status.if_began + ifsp->if_t2;
			status.if_lease	= status.if_began + ifsp->if_lease;
		}

		status.version		= DHCP_STATUS_VER;
		status.if_state		= ifsp->if_state;
		status.if_dflags	= ifsp->if_dflags;
		status.if_sent		= ifsp->if_sent;
		status.if_recv		= ifsp->if_received;
		status.if_bad_offers	= ifsp->if_bad_offers;

		(void) strlcpy(status.if_name, ifsp->if_name, IFNAMSIZ);

		send_data_reply(request, &fd, 0, DHCP_TYPE_STATUS, &status,
		    sizeof (dhcp_status_t));
		return;
	}

	default:
		return;
	}
}
Esempio n. 8
0
/* ARGSUSED */
static void
ipc_event(iu_eh_t *ehp, int fd, short events, iu_event_id_t id, void *arg)
{
	ipc_action_t		ia, *iap;
	dhcp_smach_t		*dsmp;
	int			error, is_priv = (int)arg;
	const char		*ifname;
	boolean_t		isv6;
	boolean_t		dsm_created = B_FALSE;

	ipc_action_init(&ia);
	error = dhcp_ipc_recv_request(fd, &ia.ia_request,
	    DHCP_IPC_REQUEST_WAIT);
	if (error != DHCP_IPC_SUCCESS) {
		if (error != DHCP_IPC_E_EOF) {
			dhcpmsg(MSG_ERROR,
			    "ipc_event: dhcp_ipc_recv_request failed: %s",
			    dhcp_ipc_strerror(error));
		} else {
			dhcpmsg(MSG_DEBUG, "ipc_event: connection closed");
		}
		if ((dsmp = lookup_smach_by_event(id)) != NULL) {
			ipc_action_finish(dsmp, error);
		} else {
			(void) iu_unregister_event(eh, id, NULL);
			(void) dhcp_ipc_close(fd);
		}
		return;
	}

	/* Fill in temporary ipc_action structure for utility functions */
	ia.ia_cmd = DHCP_IPC_CMD(ia.ia_request->message_type);
	ia.ia_fd = fd;
	ia.ia_eid = id;

	if (ia.ia_cmd >= DHCP_NIPC) {
		dhcpmsg(MSG_ERROR,
		    "ipc_event: invalid command (%s) attempted on %s",
		    dhcp_ipc_type_to_string(ia.ia_cmd), ia.ia_request->ifname);
		send_error_reply(&ia, DHCP_IPC_E_CMD_UNKNOWN);
		return;
	}

	/* return EPERM for any of the privileged actions */

	if (!is_priv && (ipc_cmd_flags[ia.ia_cmd] & CMD_ISPRIV)) {
		dhcpmsg(MSG_WARNING,
		    "ipc_event: privileged ipc command (%s) attempted on %s",
		    dhcp_ipc_type_to_string(ia.ia_cmd), ia.ia_request->ifname);
		send_error_reply(&ia, DHCP_IPC_E_PERM);
		return;
	}

	/*
	 * Try to locate the state machine associated with this command.  If
	 * the command is DHCP_START or DHCP_INFORM and there isn't a state
	 * machine already, make one (there may already be one from a previous
	 * failed attempt to START or INFORM).  Otherwise, verify the reference
	 * is still valid.
	 *
	 * The interface name may be blank.  In that case, we look up the
	 * primary interface, and the requested type (v4 or v6) doesn't matter.
	 */

	isv6 = (ia.ia_request->message_type & DHCP_V6) != 0;
	ifname = ia.ia_request->ifname;
	if (*ifname == '\0')
		dsmp = primary_smach(isv6);
	else
		dsmp = lookup_smach(ifname, isv6);

	if (dsmp != NULL) {
		/* Note that verify_smach drops a reference */
		hold_smach(dsmp);
		if (!verify_smach(dsmp))
			dsmp = NULL;
	}

	if (dsmp == NULL) {
		/*
		 * If the user asked for the primary DHCP interface by giving
		 * an empty string and there is no primary, then check if we're
		 * handling dhcpinfo.  If so, then simulate primary selection.
		 * Otherwise, report failure.
		 */
		if (ifname[0] == '\0') {
			if (ia.ia_cmd == DHCP_GET_TAG)
				dsmp = info_primary_smach(isv6);
			if (dsmp == NULL)
				error = DHCP_IPC_E_NOPRIMARY;

		/*
		 * If there's no interface, and we're starting up, then create
		 * it now, along with a state machine for it.  Note that if
		 * insert_smach fails, it discards the LIF reference.
		 */
		} else if (ipc_cmd_flags[ia.ia_cmd] & CMD_CREATE) {
			dhcp_lif_t *lif;

			lif = attach_lif(ifname, isv6, &error);
			if (lif != NULL &&
			    (dsmp = insert_smach(lif, &error)) != NULL) {
				/*
				 * Get client ID for logical interface.  (V4
				 * only, because V6 plumbs its own interfaces.)
				 */
				error = get_smach_cid(dsmp);
				if (error != DHCP_IPC_SUCCESS) {
					remove_smach(dsmp);
					dsmp = NULL;
				}
				dsm_created = (dsmp != NULL);
			}

		/*
		 * Otherwise, this is an operation on an unknown interface.
		 */
		} else {
			error = DHCP_IPC_E_UNKIF;
		}
		if (dsmp == NULL) {
			send_error_reply(&ia, error);
			return;
		}
	}

	/*
	 * If this is a request for DHCP to manage a lease on an address,
	 * ensure that IFF_DHCPRUNNING is set (we don't set this when the lif
	 * is created because the lif may have been created for INFORM).
	 */
	if (ia.ia_cmd == DHCP_START &&
	    (error = set_lif_dhcp(dsmp->dsm_lif)) != DHCP_IPC_SUCCESS) {
		if (dsm_created)
			remove_smach(dsmp);
		send_error_reply(&ia, error);
		return;
	}

	if ((dsmp->dsm_dflags & DHCP_IF_BOOTP) &&
	    !(ipc_cmd_flags[ia.ia_cmd] & CMD_BOOTP)) {
		dhcpmsg(MSG_ERROR, "command %s not valid for BOOTP on %s",
		    dhcp_ipc_type_to_string(ia.ia_cmd), dsmp->dsm_name);
		send_error_reply(&ia, DHCP_IPC_E_BOOTP);
		return;
	}

	/*
	 * verify that the state machine is in a state which will allow the
	 * command.  we do this up front so that we can return an error
	 * *before* needlessly cancelling an in-progress transaction.
	 */

	if (!check_cmd_allowed(dsmp->dsm_state, ia.ia_cmd)) {
		dhcpmsg(MSG_DEBUG,
		    "in state %s; not allowing %s command on %s",
		    dhcp_state_to_string(dsmp->dsm_state),
		    dhcp_ipc_type_to_string(ia.ia_cmd), dsmp->dsm_name);
		send_error_reply(&ia,
		    ia.ia_cmd == DHCP_START && dsmp->dsm_state != INIT ?
		    DHCP_IPC_E_RUNNING : DHCP_IPC_E_OUTSTATE);
		return;
	}

	dhcpmsg(MSG_DEBUG, "in state %s; allowing %s command on %s",
	    dhcp_state_to_string(dsmp->dsm_state),
	    dhcp_ipc_type_to_string(ia.ia_cmd), dsmp->dsm_name);

	if ((ia.ia_request->message_type & DHCP_PRIMARY) && is_priv)
		make_primary(dsmp);

	/*
	 * The current design dictates that there can be only one outstanding
	 * transaction per state machine -- this simplifies the code
	 * considerably and also fits well with RFCs 2131 and 3315.  It is
	 * worth classifying the different DHCP commands into synchronous
	 * (those which we will handle now and reply to immediately) and
	 * asynchronous (those which require transactions and will be completed
	 * at an indeterminate time in the future):
	 *
	 *    DROP: removes the agent's management of a state machine.
	 *	    asynchronous as the script program may be invoked.
	 *
	 *    PING: checks to see if the agent has a named state machine.
	 *	    synchronous, since no packets need to be sent
	 *	    to the DHCP server.
	 *
	 *  STATUS: returns information about a state machine.
	 *	    synchronous, since no packets need to be sent
	 *	    to the DHCP server.
	 *
	 * RELEASE: releases the agent's management of a state machine
	 *	    and brings the associated interfaces down.  asynchronous
	 *	    as the script program may be invoked.
	 *
	 *  EXTEND: renews a lease.  asynchronous, since the agent
	 *	    needs to wait for an ACK, etc.
	 *
	 *   START: starts DHCP on a named state machine.  asynchronous since
	 *	    the agent needs to wait for OFFERs, ACKs, etc.
	 *
	 *  INFORM: obtains configuration parameters for the system using
	 *	    externally configured interface.  asynchronous, since the
	 *	    agent needs to wait for an ACK.
	 *
	 * Notice that EXTEND, INFORM, START, DROP and RELEASE are
	 * asynchronous.  Notice also that asynchronous commands may occur from
	 * within the agent -- for instance, the agent will need to do implicit
	 * EXTENDs to extend the lease. In order to make the code simpler, the
	 * following rules apply for asynchronous commands:
	 *
	 * There can only be one asynchronous command at a time per state
	 * machine.  The current asynchronous command is managed by the async_*
	 * api: async_start(), async_finish(), and async_cancel().
	 * async_start() starts management of a new asynchronous command on an
	 * state machine, which should only be done after async_cancel() to
	 * terminate a previous command.  When the command is completed,
	 * async_finish() should be called.
	 *
	 * Asynchronous commands started by a user command have an associated
	 * ipc_action which provides the agent with information for how to get
	 * in touch with the user command when the action completes.  These
	 * ipc_action records also have an associated timeout which may be
	 * infinite.  ipc_action_start() should be called when starting an
	 * asynchronous command requested by a user, which sets up the timer
	 * and keeps track of the ipc information (file descriptor, request
	 * type).  When the asynchronous command completes, ipc_action_finish()
	 * should be called to return a command status code to the user and
	 * close the ipc connection).  If the command does not complete before
	 * the timer fires, ipc_action_timeout() is called which closes the ipc
	 * connection and returns DHCP_IPC_E_TIMEOUT to the user.  Note that
	 * independent of ipc_action_timeout(), ipc_action_finish() should be
	 * called.
	 *
	 * on a case-by-case basis, here is what happens (per state machine):
	 *
	 *    o When an asynchronous command is requested, then
	 *	async_cancel() is called to terminate any non-user
	 *	action in progress.  If there's a user action running,
	 *	the user command is sent DHCP_IPC_E_PEND.
	 *
	 *    o otherwise, the the transaction is started with
	 *	async_start().  if the transaction is on behalf
	 *	of a user, ipc_action_start() is called to keep
	 *	track of the ipc information and set up the
	 *	ipc_action timer.
	 *
	 *    o if the command completes normally and before a
	 *	timeout fires, then async_finish() is called.
	 *	if there was an associated ipc_action,
	 *	ipc_action_finish() is called to complete it.
	 *
	 *    o if the command fails before a timeout fires, then
	 *	async_finish() is called, and the state machine is
	 *	is returned to a known state based on the command.
	 *	if there was an associated ipc_action,
	 *	ipc_action_finish() is called to complete it.
	 *
	 *    o if the ipc_action timer fires before command
	 *	completion, then DHCP_IPC_E_TIMEOUT is returned to
	 *	the user.  however, the transaction continues to
	 *	be carried out asynchronously.
	 */

	if (ipc_cmd_flags[ia.ia_cmd] & CMD_IMMED) {
		/*
		 * Only immediate commands (ping, status, get_tag) need to
		 * worry about freeing ia through one of the reply functions
		 * before returning.
		 */
		iap = &ia;
	} else {
		/*
		 * if shutdown request has been received, send back an error.
		 */
		if (shutdown_started) {
			send_error_reply(&ia, DHCP_IPC_E_OUTSTATE);
			return;
		}

		if (dsmp->dsm_dflags & DHCP_IF_BUSY) {
			send_error_reply(&ia, DHCP_IPC_E_PEND);
			return;
		}

		if (!ipc_action_start(dsmp, &ia)) {
			dhcpmsg(MSG_WARNING, "ipc_event: ipc_action_start "
			    "failed for %s", dsmp->dsm_name);
			send_error_reply(&ia, DHCP_IPC_E_MEMORY);
			return;
		}

		/* Action structure consumed by above function */
		iap = &dsmp->dsm_ia;
	}

	switch (iap->ia_cmd) {

	case DHCP_DROP:
		if (dsmp->dsm_droprelease)
			break;
		dsmp->dsm_droprelease = B_TRUE;

		/*
		 * Ensure that a timer associated with the existing state
		 * doesn't pop while we're waiting for the script to complete.
		 * (If so, chaos can result -- e.g., a timer causes us to end
		 * up in dhcp_selecting() would start acquiring a new lease on
		 * dsmp while our DHCP_DROP dismantling is ongoing.)
		 */
		cancel_smach_timers(dsmp);
		(void) script_start(dsmp, isv6 ? EVENT_DROP6 : EVENT_DROP,
		    dhcp_drop, NULL, NULL);
		break;		/* not an immediate function */

	case DHCP_EXTEND:
		dhcp_smach_set_msg_reqhost(dsmp, iap);
		(void) dhcp_extending(dsmp);
		break;

	case DHCP_GET_TAG: {
		dhcp_optnum_t	optnum;
		void		*opt = NULL;
		uint_t		optlen;
		boolean_t	did_alloc = B_FALSE;
		PKT_LIST	*ack = dsmp->dsm_ack;
		int		i;

		/*
		 * verify the request makes sense.
		 */

		if (iap->ia_request->data_type   != DHCP_TYPE_OPTNUM ||
		    iap->ia_request->data_length != sizeof (dhcp_optnum_t)) {
			send_error_reply(iap, DHCP_IPC_E_PROTO);
			break;
		}

		(void) memcpy(&optnum, iap->ia_request->buffer,
		    sizeof (dhcp_optnum_t));

load_option:
		switch (optnum.category) {

		case DSYM_SITE:			/* FALLTHRU */
		case DSYM_STANDARD:
			for (i = 0; i < dsmp->dsm_pillen; i++) {
				if (dsmp->dsm_pil[i] == optnum.code)
					break;
			}
			if (i < dsmp->dsm_pillen)
				break;
			if (isv6) {
				opt = dhcpv6_pkt_option(ack, NULL, optnum.code,
				    NULL);
			} else {
				opt = dhcp_get_ack_or_state(dsmp, ack,
				    optnum.code, &did_alloc);
			}
			break;

		case DSYM_VENDOR:
			if (isv6) {
				dhcpv6_option_t *d6o;
				uint32_t ent;

				/*
				 * Look through vendor options to find our
				 * enterprise number.
				 */
				d6o = NULL;
				for (;;) {
					d6o = dhcpv6_pkt_option(ack, d6o,
					    DHCPV6_OPT_VENDOR_OPT, &optlen);
					if (d6o == NULL)
						break;
					optlen -= sizeof (*d6o);
					if (optlen < sizeof (ent))
						continue;
					(void) memcpy(&ent, d6o + 1,
					    sizeof (ent));
					if (ntohl(ent) != DHCPV6_SUN_ENT)
						continue;
					break;
				}
				if (d6o != NULL) {
					/*
					 * Now find the requested vendor option
					 * within the vendor options block.
					 */
					opt = dhcpv6_find_option(
					    (char *)(d6o + 1) + sizeof (ent),
					    optlen - sizeof (ent), NULL,
					    optnum.code, NULL);
				}
			} else {
				/*
				 * the test against VS_OPTION_START is broken
				 * up into two tests to avoid compiler warnings
				 * under intel.
				 */
				if ((optnum.code > VS_OPTION_START ||
				    optnum.code == VS_OPTION_START) &&
				    optnum.code <= VS_OPTION_END)
					opt = ack->vs[optnum.code];
			}
			break;

		case DSYM_FIELD:
			if (isv6) {
				dhcpv6_message_t *d6m =
				    (dhcpv6_message_t *)ack->pkt;
				dhcpv6_option_t *d6o;

				/* Validate the packet field the user wants */
				optlen = optnum.code + optnum.size;
				if (d6m->d6m_msg_type ==
				    DHCPV6_MSG_RELAY_FORW ||
				    d6m->d6m_msg_type ==
				    DHCPV6_MSG_RELAY_REPL) {
					if (optlen > sizeof (dhcpv6_relay_t))
						break;
				} else {
					if (optlen > sizeof (*d6m))
						break;
				}

				opt = malloc(sizeof (*d6o) + optnum.size);
				if (opt != NULL) {
					d6o = opt;
					d6o->d6o_code = htons(optnum.code);
					d6o->d6o_len = htons(optnum.size);
					(void) memcpy(d6o + 1, (caddr_t)d6m +
					    optnum.code, optnum.size);
				}
			} else {
				if (optnum.code + optnum.size > sizeof (PKT))
					break;

				opt = malloc(optnum.size + DHCP_OPT_META_LEN);
				if (opt != NULL) {
					DHCP_OPT *v4opt = opt;

					v4opt->len  = optnum.size;
					v4opt->code = optnum.code;
					(void) memcpy(v4opt->value,
					    (caddr_t)ack->pkt + optnum.code,
					    optnum.size);
				}
			}

			if (opt == NULL) {
				send_error_reply(iap, DHCP_IPC_E_MEMORY);
				return;
			}
			did_alloc = B_TRUE;
			break;

		default:
			send_error_reply(iap, DHCP_IPC_E_PROTO);
			return;
		}

		/*
		 * return the option payload, if there was one.
		 */

		if (opt != NULL) {
			if (isv6) {
				dhcpv6_option_t d6ov;

				(void) memcpy(&d6ov, opt, sizeof (d6ov));
				optlen = ntohs(d6ov.d6o_len) + sizeof (d6ov);
			} else {
				optlen = ((DHCP_OPT *)opt)->len +
				    DHCP_OPT_META_LEN;
			}
			send_data_reply(iap, 0, DHCP_TYPE_OPTION, opt, optlen);

			if (did_alloc)
				free(opt);
			break;
		} else if (ack != dsmp->dsm_orig_ack) {
			/*
			 * There wasn't any definition for the option in the
			 * current ack, so now retry with the original ack if
			 * the original ack is not the current ack.
			 */
			ack = dsmp->dsm_orig_ack;
			goto load_option;
		}

		/*
		 * note that an "okay" response is returned either in
		 * the case of an unknown option or a known option
		 * with no payload.  this is okay (for now) since
		 * dhcpinfo checks whether an option is valid before
		 * ever performing ipc with the agent.
		 */

		send_ok_reply(iap);
		break;
	}

	case DHCP_INFORM:
		dhcp_inform(dsmp);
		/* next destination: dhcp_acknak() */
		break;		/* not an immediate function */

	case DHCP_PING:
		if (dsmp->dsm_dflags & DHCP_IF_FAILED)
			send_error_reply(iap, DHCP_IPC_E_FAILEDIF);
		else
			send_ok_reply(iap);
		break;

	case DHCP_RELEASE:
		if (dsmp->dsm_droprelease)
			break;
		dsmp->dsm_droprelease = B_TRUE;
		cancel_smach_timers(dsmp); /* see comment in DHCP_DROP above */
		(void) script_start(dsmp, isv6 ? EVENT_RELEASE6 :
		    EVENT_RELEASE, dhcp_release, "Finished with lease.", NULL);
		break;		/* not an immediate function */

	case DHCP_START: {
		PKT_LIST *ack, *oack;
		PKT_LIST *plp[2];

		deprecate_leases(dsmp);
		dhcp_smach_set_msg_reqhost(dsmp, iap);

		/*
		 * if we have a valid hostconf lying around, then jump
		 * into INIT_REBOOT.  if it fails, we'll end up going
		 * through the whole selecting() procedure again.
		 */

		error = read_hostconf(dsmp->dsm_name, plp, 2, dsmp->dsm_isv6);
		ack = error > 0 ? plp[0] : NULL;
		oack = error > 1 ? plp[1] : NULL;

		/*
		 * If the allocation of the old ack fails, that's fine;
		 * continue without it.
		 */
		if (oack == NULL)
			oack = ack;

		/*
		 * As long as we've allocated something, start using it.
		 */
		if (ack != NULL) {
			dsmp->dsm_orig_ack = oack;
			dsmp->dsm_ack = ack;
			dhcp_init_reboot(dsmp);
			/* next destination: dhcp_acknak() */
			break;
		}

		/*
		 * if not debugging, wait for a few seconds before
		 * going into SELECTING.
		 */

		if (debug_level != 0 || !set_start_timer(dsmp)) {
			dhcp_selecting(dsmp);
			/* next destination: dhcp_requesting() */
		}
		/* else next destination: dhcp_start() */
	}
	break;

	case DHCP_STATUS: {
		dhcp_status_t	status;
		dhcp_lease_t	*dlp;

		status.if_began = monosec_to_time(dsmp->dsm_curstart_monosec);

		/*
		 * We return information on just the first lease as being
		 * representative of the lot.  A better status mechanism is
		 * needed.
		 */
		dlp = dsmp->dsm_leases;

		if (dlp == NULL ||
		    dlp->dl_lifs->lif_expire.dt_start == DHCP_PERM) {
			status.if_t1	= DHCP_PERM;
			status.if_t2	= DHCP_PERM;
			status.if_lease	= DHCP_PERM;
		} else {
			status.if_t1	= status.if_began +
			    dlp->dl_t1.dt_start;
			status.if_t2	= status.if_began +
			    dlp->dl_t2.dt_start;
			status.if_lease	= status.if_began +
			    dlp->dl_lifs->lif_expire.dt_start;
		}

		status.version		= DHCP_STATUS_VER;
		status.if_state		= dsmp->dsm_state;
		status.if_dflags	= dsmp->dsm_dflags;
		status.if_sent		= dsmp->dsm_sent;
		status.if_recv		= dsmp->dsm_received;
		status.if_bad_offers	= dsmp->dsm_bad_offers;

		(void) strlcpy(status.if_name, dsmp->dsm_name, LIFNAMSIZ);

		send_data_reply(iap, 0, DHCP_TYPE_STATUS, &status,
		    sizeof (dhcp_status_t));
		break;
	}
	}
}
Esempio n. 9
0
void
send_ok_reply(ipc_action_t *ia)
{
	send_error_reply(ia, 0);
}
static int ipmi_powernv_recv(struct ipmi_smi_powernv *smi)
{
	struct opal_ipmi_msg *opal_msg;
	struct ipmi_smi_msg *msg;
	unsigned long flags;
	uint64_t size;
	int rc;

	pr_devel("%s: opal_ipmi_recv(%llx, msg, sz)\n", __func__,
			smi->interface_id);

	spin_lock_irqsave(&smi->msg_lock, flags);

	if (!smi->cur_msg) {
		spin_unlock_irqrestore(&smi->msg_lock, flags);
		pr_warn("no current message?\n");
		return 0;
	}

	msg = smi->cur_msg;
	opal_msg = smi->opal_msg;

	size = cpu_to_be64(sizeof(*opal_msg) + IPMI_MAX_MSG_LENGTH);

	rc = opal_ipmi_recv(smi->interface_id,
			opal_msg,
			&size);
	size = be64_to_cpu(size);
	pr_devel("%s:   -> %d (size %lld)\n", __func__,
			rc, rc == 0 ? size : 0);
	if (rc) {
		/* If came via the poll, and response was not yet ready */
		if (rc == OPAL_EMPTY) {
			spin_unlock_irqrestore(&smi->msg_lock, flags);
			return 0;
		}

		smi->cur_msg = NULL;
		spin_unlock_irqrestore(&smi->msg_lock, flags);
		send_error_reply(smi, msg, IPMI_ERR_UNSPECIFIED);
		return 0;
	}

	if (size < sizeof(*opal_msg)) {
		spin_unlock_irqrestore(&smi->msg_lock, flags);
		pr_warn("unexpected IPMI message size %lld\n", size);
		return 0;
	}

	if (opal_msg->version != OPAL_IPMI_MSG_FORMAT_VERSION_1) {
		spin_unlock_irqrestore(&smi->msg_lock, flags);
		pr_warn("unexpected IPMI message format (version %d)\n",
				opal_msg->version);
		return 0;
	}

	msg->rsp[0] = opal_msg->netfn;
	msg->rsp[1] = opal_msg->cmd;
	if (size > sizeof(*opal_msg))
		memcpy(&msg->rsp[2], opal_msg->data, size - sizeof(*opal_msg));
	msg->rsp_size = 2 + size - sizeof(*opal_msg);

	smi->cur_msg = NULL;
	spin_unlock_irqrestore(&smi->msg_lock, flags);
	ipmi_smi_msg_received(smi->intf, msg);
	return 0;
}
Esempio n. 11
0
/*
 *  Come here when we receive an authorization START packet
 */
void
author(u_char *pak)
{
    HDR *hdr;
    struct author *apak;
    struct identity identity;
#ifdef ACLS
    struct authen_data authen_data;
#endif
    struct author_data author_data;
    u_char *p;
    u_char *argsizep;
    char **cmd_argp;
    int i, len;

    if (debug & DEBUG_AUTHOR_FLAG)
	report(LOG_DEBUG, "Start authorization request");

    hdr = (HDR *)pak;
    apak = (struct author *)(pak + TAC_PLUS_HDR_SIZE);

    /* Do some sanity checks */
    if (hdr->seq_no != 1) {
	send_error_reply(TAC_PLUS_AUTHOR, NULL);
	return;
    }

    /* Check if there's at least sizeof(struct author) of useful data */
    if (ntohl(hdr->datalength) < TAC_AUTHOR_REQ_FIXED_FIELDS_SIZE) {
	report(LOG_ERR, "%s: author minimum payload length: %zu, got: %u",
	       session.peer, TAC_AUTHOR_REQ_FIXED_FIELDS_SIZE,
	       ntohl(hdr->datalength));
	send_error_reply(TAC_PLUS_AUTHOR, NULL);
	return;
    }

    /* arg counts start here */
    p = pak + TAC_PLUS_HDR_SIZE + TAC_AUTHOR_REQ_FIXED_FIELDS_SIZE;

    /* Length checks */
    len = TAC_AUTHOR_REQ_FIXED_FIELDS_SIZE;
    len += apak->user_len + apak->port_len + apak->rem_addr_len + apak->arg_cnt;

    /* Is there enough space for apak->arg_cnt arguments? */
    if (ntohl(hdr->datalength) <
	(TAC_AUTHOR_REQ_FIXED_FIELDS_SIZE + apak->arg_cnt)) {
	report(LOG_ERR, "%s: author minimum payload length: %zu, got: %u",
	       session.peer, TAC_AUTHOR_REQ_FIXED_FIELDS_SIZE + apak->arg_cnt,
	       ntohl(hdr->datalength));
	send_error_reply(TAC_PLUS_AUTHOR, NULL);
	return;
    }

    for (i = 0; i < (int)apak->arg_cnt; i++) {
	len += p[i];
    }

    if (len != ntohl(hdr->datalength)) {
	send_error_reply(TAC_PLUS_AUTHOR, NULL);
	return;
    }

    /* start of variable length data is here */
    p = pak + TAC_PLUS_HDR_SIZE + TAC_AUTHOR_REQ_FIXED_FIELDS_SIZE;

    /* arg length data starts here */
    argsizep = p;

    p += apak->arg_cnt;

    memset(&author_data, 0, sizeof(struct author_data));

    /* The identity structure */

    /* zero out identity struct */
    memset(&identity, 0, sizeof(struct identity));
    identity.username = tac_make_string(p, (int)apak->user_len);
    p += apak->user_len;

    identity.NAS_name = tac_strdup(session.peer);
#ifdef ACLS
    identity.NAS_ip = tac_strdup(session.peerip);
#endif

    identity.NAS_port = tac_make_string(p, (int)apak->port_len);
    p += apak->port_len;
    if (apak->port_len <= 0) {
	strcpy(session.port, "unknown-port");
    } else {
	strcpy(session.port, identity.NAS_port);
    }

    identity.NAC_address = tac_make_string(p, (int)apak->rem_addr_len);
    p += apak->rem_addr_len;

    identity.priv_lvl = apak->priv_lvl;

    /* The author_data structure */

    author_data.id = &identity;	/* user id */

    /* FIXME: validate these fields */
    author_data.authen_method = apak->authen_method;
    author_data.authen_type = apak->authen_type;
    author_data.service = apak->service;
    author_data.num_in_args = apak->arg_cnt;

    /* Space for args + NULL */
    cmd_argp = (char **)tac_malloc(apak->arg_cnt * sizeof(char *));

    /* p points to the start of args. Step thru them making strings */
    for (i = 0; i < (int)apak->arg_cnt; i++) {
	cmd_argp[i] = tac_make_string(p, *argsizep);
	p += *argsizep++;
    }

    author_data.input_args = cmd_argp;	/* input command arguments */

#ifdef ACLS
    authen_data.NAS_id = &identity;
    if (verify_host(author_data.id->username, &authen_data, S_acl,
		    TAC_PLUS_RECURSE) != S_permit) {
	author_data.status = AUTHOR_STATUS_FAIL;
    } else
#endif
	if (do_author(&author_data)) {
	    report(LOG_ERR, "%s: do_author returned an error", session.peer);
	    send_author_reply(AUTHOR_STATUS_ERROR,
			      author_data.msg, author_data.admin_msg,
			      author_data.num_out_args,
			      author_data.output_args);
	    return;
        }

    /* Send a reply packet */
    send_author_reply(author_data.status, author_data.msg,
		      author_data.admin_msg, author_data.num_out_args,
		      author_data.output_args);

    if (debug)
	report(LOG_INFO, "authorization query for '%s' %s from %s %s",
	       author_data.id->username && author_data.id->username[0] ?
	       author_data.id->username : "******",
	       author_data.id->NAS_port && author_data.id->NAS_port[0] ?
	       author_data.id->NAS_port : "unknown",
	       session.peer,
	       (author_data.status == AUTHOR_STATUS_PASS_ADD ||
		author_data.status == AUTHOR_STATUS_PASS_REPL) ?
	       "accepted" : "rejected");

    /* free the input args */
    if (author_data.input_args) {
	for (i = 0; i < author_data.num_in_args; i++)
	    free(author_data.input_args[i]);

	free(author_data.input_args);
	author_data.input_args = NULL;
    }

    /* free the output args */
    if (author_data.output_args) {
	for (i = 0; i < author_data.num_out_args; i++)
	    free(author_data.output_args[i]);

	free(author_data.output_args);
	author_data.output_args = NULL;
    }

    if (author_data.msg)
	free(author_data.msg);

    if (author_data.admin_msg)
	free(author_data.admin_msg);

    free(identity.username);
    free(identity.NAS_name);
#ifdef ACLS
    free(identity.NAS_ip);
#endif
    free(identity.NAS_port);
    free(identity.NAC_address);
}