/*
   Copyright (c) 1995-1998 by Cisco systems, Inc.

   Permission to use, copy, modify, and distribute this software for
   any purpose and without fee is hereby granted, provided that this
   copyright and permission notice appear on all copies of the
   software and supporting documentation, the name of Cisco Systems,
   Inc. not be used in advertising or publicity pertaining to
   distribution of the program without specific prior permission, and
   notice be given in supporting documentation that modification,
   copying and distribution is by permission of Cisco Systems, Inc.

   Cisco Systems, Inc. makes no representations about the suitability
   of this software for any purpose.  THIS SOFTWARE IS PROVIDED ``AS
   IS'' AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING,
   WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
   FITNESS FOR A PARTICULAR PURPOSE.
*/

#include "tac_plus.h"
#include <stdio.h>
#include <errno.h>
#include "regexp.h"

/*
   <config>         := <decl>*

   <decl>           := <top_level_decl> | <user_decl>

   <top_level_decl> := <authen_default> |
                       accounting file = <string>
                       default authorization = permit |
                       key = <string>

   <authen_default> := default authentication = file <filename> 
#if defined(DB)
		    | db <string> )
#endif
   
<permission>     := permit | deny

   <filename>       := <string>

   <password>       := <string>

   <user_decl>      := user = <string> {
                        [ default service = [ permit | deny ] ]
                        <user_attr>*
                        <svc>*
                   }

   <password_spec>  := file <filename> | 
		       skey | 
		       cleartext <password> |
		       des <password> |

#ifdef USE_PAM		
		       pam <pam_service> |
#endif 		
#if defined(DB)		
			db <string>
#endif
		       nopassword

   <user_attr>      :=   name     = <string> |
                         login    = <password_spec> |
        	         member   = <string> |
        	         expires  = <string> |
                	 arap     = cleartext <string> |
	                 chap     = cleartext <string> |
#ifdef MSCHAP
	                 ms-chap  = cleartext <string> |
#endif
	                 pap      = cleartext <string> |
	                 pap      = des <string> |
#ifdef USE_PAM	
	                 pap      = pam <pam_service> |
#endif 		
	                 opap     = cleartext <string> |
	                 global   = cleartext <string> |
        	         msg      = <string>
			 before authorization = <string> |
			 after authorization = <string>

   <svc>            := <svc_auth> | <cmd_auth>

   <cmd_auth>       := cmd = <string> {
                        <cmd-match>*
                    }

   <cmd-match>      := <permission> <string>

   <svc_auth>       := service = ( exec | arap | slip | ppp protocol = <string> {
                        [ default attribute = permit ]
                        <attr_value_pair>*
                    }

   <attr_value_pair> := [ optional ] <string> = <string>

*/

static char sym_buf[MAX_INPUT_LINE_LEN];	/* parse buffer */
static int sym_pos=0;           /* current place in sym_buf */
static int sym_ch;		/* current parse character */
static int sym_code;		/* parser output */
static int sym_line = 1;	/* current line number for parsing */
static FILE *cf = NULL;		/* config file pointer */
static int sym_error = 0;	/* a parsing error has occurred */
static int no_user_dflt = 0;	/* default if user doesn't exist */
static char *authen_default = NULL;	/* top level authentication default */
static int authen_default_method = 0; /*For method check */
static char *nopasswd_str = "nopassword";

/* A host definition structure. Currently unused, but when we start
   configuring host-specific information e.g. per-host keys, this is
   where it should be kept.

   The first 2 fields (name and hash) are used by the hash table
   routines to hash this structure into a table.  Do not (re)move them */

struct host {
    char *name;			/* host name */
    void *hash;			/* hash table next pointer */
    int line;			/* line number defined on */
    char *key;			/* host spesific key */
    char *type;			/* host type	     */
};

/* A user or group definition

   The first 2 fields (name and hash) are used by the hash table
   routines to hash this structure into a table.  Move them at your
   peril */

struct user {
    char *name;			/* username */
    void *hash;			/* hash table next pointer */
    int line;			/* line number defined on */
    long flags;			/* flags field */

#define FLAG_ISUSER  1		/* this structure represents a user */
#define FLAG_ISGROUP 2		/* this structure represents a group */
#define FLAG_SEEN    4		/* for circular definition detection */

    char *full_name;		/* users full name */
    char *login;		/* Login password */
    int nopasswd;               /* user requires no password */
    char *global;		/* password to use if none set */
    char *member;		/* group we are a member of */
    char *expires;		/* expiration date */
    char *arap;			/* our arap secret */
    char *pap;			/* our pap secret */
    char *opap;			/* our outbound pap secret */
    char *chap;			/* our chap secret */
#ifdef MSCHAP
    char *mschap;		/* our mschap secret */
#endif /* MSCHAP */
    char *msg;			/* a message for this user */
    char *before_author;	/* command to run before authorization */
    char *after_author;		/* command to run after authorization */
    int svc_dflt;		/* default authorization behaviour for svc or
				 * cmd */
    NODE *svcs;			/* pointer to svc nodes */
#ifdef MAXSESS
    int maxsess;		/* Max sessions/user */
#endif /* MAXSESS */
    char *time;		/* Timestamp  */
};

typedef struct host HOST;
typedef struct user USER;

/* Only the first 2 fields (name and hash) are used by the hash table
   routines to hashh structures into a table.
*/

union hash {
    struct user u;
    struct host h;
};

typedef union hash HASH;

void *grouptable[HASH_TAB_SIZE];/* Table of group declarations */
void *usertable[HASH_TAB_SIZE];	/* Table of user declarations */
void *hosttable[HASH_TAB_SIZE];	/* Table of host declarations */


static void
 sym_get();


#ifdef __STDC__
#include <stdarg.h>		/* ANSI C, variable length args */
static void
parse_error(char *fmt,...)
#else
#include <varargs.h>		/* has 'vararg' definitions */
/* VARARGS2 */
static void
parse_error(fmt, va_alist)
char *fmt;

va_dcl				/* no terminating semi-colon */
#endif
{
    char msg[256];		/* temporary string */
    va_list ap;

#ifdef __STDC__
    va_start(ap, fmt);
#else
    va_start(ap);
#endif
    vsprintf(msg, fmt, ap);
    va_end(ap);

    report(LOG_ERR, "%s", msg);
    fprintf(stderr, "Error: %s\n", msg);
    tac_exit(1);
}

char *
cfg_nodestring(type)
    int type;
{
    switch (type) {
    default:
	return ("unknown node type");
    case N_arg:
	return ("N_arg");
    case N_optarg:
	return ("N_optarg");
    case N_svc:
	return ("N_svc");
    case N_svc_exec:
	return ("N_svc_exec");
    case N_svc_slip:
	return ("N_svc_slip");
    case N_svc_ppp:
	return ("N_svc_ppp");
    case N_svc_arap:
	return ("N_svc_arap");
    case N_svc_cmd:
	return ("N_svc_cmd");
    case N_permit:
	return ("N_permit");
    case N_deny:
	return ("N_deny");
    }
}

static void
free_attrs(node)
NODE *node;
{
    NODE *next;

    while (node) {
	switch (node->type) {
	case N_optarg:
	case N_arg:
	    if (debug & DEBUG_CLEAN_FLAG)
		report(LOG_DEBUG, "free_cmd_match %s %s",
		       cfg_nodestring(node->type),
		       node->value);
	    break;
	default:
	    report(LOG_ERR, "Illegal node type %s for free_attrs", 
		   cfg_nodestring(node->type));
	    return;
	}

	free(node->value);
	next = node->next;
	free(node);
	node = next;
    }
}

static void
free_cmd_matches(node)
NODE *node;
{
    NODE *next;

    while (node) {
	if (debug & DEBUG_CLEAN_FLAG)
	    report(LOG_DEBUG, "free_cmd_match %s %s",
		   cfg_nodestring(node->type),
		   node->value);

	free(node->value);	/* text */
	free(node->value1);	/* regexp compiled text */
	next = node->next;
	free(node);
	node = next;
    }
}

static void
free_svcs(node)
NODE *node;
{
    NODE *next;

    while (node) {

	switch (node->type) {
	case N_svc_cmd:
	    if (debug & DEBUG_CLEAN_FLAG)
		report(LOG_DEBUG, "free %s %s",
		       cfg_nodestring(node->type), node->value);
	    free(node->value);	/* cmd name */
	    free_cmd_matches(node->value1);
	    next = node->next;
	    free(node);
	    node = next;
	    continue;

	case N_svc:
	case N_svc_ppp:
	    free(node->value1);
	    /* FALL-THROUGH */
	case N_svc_exec:
	case N_svc_arap:
	case N_svc_slip:
	    if (debug & DEBUG_CLEAN_FLAG)
		report(LOG_DEBUG, "free %s", cfg_nodestring(node->type));
	    free_attrs(node->value);
	    next = node->next;
	    free(node);
	    node = next;
	    continue;

	default:
	    report(LOG_ERR, "Illegal node type %d for free_svcs", node->type);
	    return;
	}
    }
}

static void
free_userstruct(user)
USER *user;
{
    if (debug & DEBUG_CLEAN_FLAG)
	report(LOG_DEBUG, "free %s %s",
	       (user->flags & FLAG_ISUSER) ? "user" : "group",
	       user->name);

    if (user->name)
	free(user->name);
    if (user->full_name)
	free(user->full_name);
    if (user->login)
	free(user->login);
    if (user->member)
	free(user->member);
    if (user->expires)
	free(user->expires);
    if (user->time)
	free(user->time);
    if (user->arap)
	free(user->arap);
    if (user->chap)
	free(user->chap);
#ifdef MSCHAP
    if (user->mschap)
	free(user->mschap);
#endif /* MSCHAP */
    if (user->pap)
	free(user->pap);
    if (user->opap)
	free(user->opap);
    if (user->global)
	free(user->global);
    if (user->msg)
	free(user->msg);
    if (user->before_author)
	free(user->before_author);
    if (user->after_author)
	free(user->after_author);
    free_svcs(user->svcs);
}

static void
free_hoststruct(host)
HOST *host;
{
    if (debug & DEBUG_CLEAN_FLAG)
	report(LOG_DEBUG, "free %s",
		host->name);

    if (host->name)
	free(host->name);
    
    if (host->key)
	free(host->key);
    
    if (host->type)
	free(host->type);
}

/*
 * Exported routines
 */

/* Free all allocated structures preparatory to re-reading the config file */
void
cfg_clean_config()
{
    int i;
    USER *entry, *next;
    HOST *host_entry,*hn;

    if (authen_default) {
	free(authen_default);
	authen_default = NULL;
    }
   
   if (authen_default_method) {
	authen_default_method = 0;
    }

    if (session.key) {
	free(session.key);
	session.key = NULL;
    }

    if (session.acctfile) {
	free(session.acctfile);
	session.acctfile = NULL;
    }
    
    if (session.db_acct) {
	free(session.db_acct);
	session.db_acct = NULL;
    }

    /* clean the hosttable */
    for (i = 0; i < HASH_TAB_SIZE; i++) {
	host_entry = (HOST *) hosttable[i];
	while (host_entry) {
	    hn = host_entry->hash;
	    free_hoststruct(host_entry);
	    free(host_entry);
	    host_entry = hn;
	}
	hosttable[i] = NULL;
    }

    /* the grouptable */
    for (i = 0; i < HASH_TAB_SIZE; i++) {
	entry = (USER *) grouptable[i];
	while (entry) {
	    next = entry->hash;
	    free_userstruct(entry);
	    free(entry);
	    entry = next;
	}
	grouptable[i] = NULL;
    }

    /* the usertable */
    for (i = 0; i < HASH_TAB_SIZE; i++) {
	entry = (USER *) usertable[i];
	while (entry) {
	    next = entry->hash;
	    free_userstruct(entry);
	    free(entry);
	    entry = next;
	}
	usertable[i] = NULL;
    }
}

static int
parse_permission()
{
    int symbol = sym_code;

    if (sym_code != S_permit && sym_code != S_deny) {
	parse_error("expecting permit or deny but found '%s' on line %d",
		    sym_buf, sym_line);
	return (0);
    }
    sym_get();

    return (symbol);
}

static int
parse(symbol)
int symbol;

{
    if (sym_code != symbol) {
	parse_error("expecting '%s' but found '%s' on line %d",
		    (symbol == S_string ? "string" : codestring(symbol)),
		    sym_buf, sym_line);
	return (1);
    }
    sym_get();
    return (0);
}

static int
parse_opt_svc_default()
{
    if (sym_code != S_default) {
	return (0);
    }

    parse(S_default);
    parse(S_svc);
    parse(S_separator);
    if (sym_code == S_permit) {
	parse(S_permit);
	return (S_permit);
    }
    parse(S_deny);
    return (S_deny);
}

static int
parse_opt_attr_default()
{
    if (sym_code != S_default)
	return (S_deny);

    parse(S_default);
    parse(S_attr);
    parse(S_separator);
    parse(S_permit);
    return (S_permit);
}

static int parse_user();
static int parse_host();

static void
 rch();

/*
   Parse lines in the config file, creating data structures
   Return 1 on error, otherwise 0 */

static int
parse_decls()
{
    no_user_dflt = 0; /* default if user doesn't exist */

    sym_code = 0;
    rch();

    bzero(grouptable, sizeof(grouptable));
    bzero(usertable, sizeof(usertable));
    bzero(hosttable, sizeof(hosttable)); 

    sym_get();

    /* Top level of parser */
    while (1) {

	switch (sym_code) {
	case S_eof:
	    return (0);

	case S_accounting:
	    sym_get();
	    parse(S_file);
	    parse(S_separator);
	    if (session.acctfile) 
		free(session.acctfile);
	    session.acctfile = tac_strdup(sym_buf);
	    sym_get();
	    continue;

#ifdef DB	
	case S_db_accounting:
	    sym_get();
	    parse(S_separator);
	    if (session.db_acct) 
		free(session.db_acct);
	    session.db_acct = tac_strdup(sym_buf);
	    sym_get();
	    continue;
#endif

	case S_default:
	    sym_get();
	    switch (sym_code) {
	    default:
		parse_error(
	        "Expecting default authorization/authentication on lines %d",
			    sym_line);
		return (1);

	    case S_authentication:
		if (authen_default) {
		    parse_error(
		    "Multiply defined authentication default on line %d",
				sym_line);
		    return (1);
		}
		parse(S_authentication);
		parse(S_separator);

	        switch(sym_code) {
                
		case S_file:
#ifdef DB
		case S_db:
#endif
#ifdef USE_LDAP
		case S_ldap;
#endif
#ifdef USE_PAM
		case S_pam:
#endif
                authen_default_method = sym_code;
		break;

		default:
                parse_error("expecting default_method keyword after 'default authentication = ' on line %d",sym_line);
		return (1);
                }
                sym_get();

		authen_default = tac_strdup(sym_buf);
		sym_get();
		continue;

	    case S_authorization:
		parse(S_authorization);
		parse(S_separator);
		parse(S_permit);
		no_user_dflt = S_permit;
		report(LOG_INFO, 
		       "default authorization = permit is now deprecated. Please use user = DEFAULT instead");
		continue;
	    }

	case S_key:
	    /* Process a key declaration. */
	    sym_get();
	    parse(S_separator);
	    if (session.key) {
		parse_error("multiply defined key on lines %d and %d",
			    session.keyline, sym_line);
		return (1);
	    }
	    session.key = tac_strdup(sym_buf);
	    session.keyline = sym_line;
	    sym_get();
	    continue;
	
	case S_host:
	    parse_host();
	    continue;
	
	case S_user:
	case S_group:
	    parse_user();
	    continue;

	    /* case S_host: parse_host(); continue; */

	default:
	    parse_error("Unrecognised token %s on line %d", sym_buf, sym_line);
	    return (1);
	}
    }
}

static NODE *parse_svcs();

/* Assign a value to a field. Issue an error message and return 1 if
   it's already been assigned. This is a macro because I was sick of
   repeating the same code fragment over and over */

#define ASSIGN(field) \
sym_get(); parse(S_separator); if (field) { \
	parse_error("Duplicate value for %s %s and %s on line %d", \
		    codestring(sym_code), field, sym_buf, sym_line); \
        tac_exit(1); \
    } \
    field = tac_strdup(sym_buf);

static int
parse_host()
{
    HOST *h;
    HOST *host = (HOST *) tac_malloc(sizeof(HOST));
    int save_sym;
    char buf[MAX_INPUT_LINE_LEN];

    bzero(host, sizeof(HOST));

    sym_get();
    parse(S_separator);
    host->name = tac_strdup(sym_buf);
    host->line = sym_line;
    
    h = hash_add_entry(hosttable, (void *) host);
    
    if (h) {
        parse_error("multiply defined %s on lines %d and %d",
                    host->name, h->line, sym_line);
        return (1);
    }

    sym_get();
    parse(S_openbra);
    
    while (1) {
	switch (sym_code) {
        case S_eof:
            return (0);
	case S_key:
	    ASSIGN(host->key);
            sym_get();
            continue;
	case S_type:
	    ASSIGN(host->type);
            sym_get();
            continue;
	
	case S_closebra:
            parse(S_closebra);
            return (0);

	default:
	    parse_error("Unrecognised keyword %s for host %s on line %d",
                        sym_buf, host->name,sym_line);

            return (0);
        }
    } /* while */
} /* finish parse_host */


static int
parse_user()
{
    USER *n;
    int isuser;
    USER *user = (USER *) tac_malloc(sizeof(USER));
    int save_sym;
    char **fieldp;
    char buf[MAX_INPUT_LINE_LEN];

    bzero(user, sizeof(USER));

    isuser = (sym_code == S_user);

    sym_get();
    parse(S_separator);
    user->name = tac_strdup(sym_buf);
    user->line = sym_line;

    if (isuser) {
	user->flags |= FLAG_ISUSER;
	n = hash_add_entry(usertable, (void *) user);
    } else {
	user->flags |= FLAG_ISGROUP;
	n = hash_add_entry(grouptable, (void *) user);
    }

    if (n) {
	parse_error("multiply defined %s %s on lines %d and %d",
		    isuser ? "user" : "group",
		    user->name, n->line, sym_line);
	return (1);
    }
    sym_get();
    parse(S_openbra);

    /* Is the default deny for svcs or cmds to be overridden? */
    user->svc_dflt = parse_opt_svc_default();

    while (1) {
	switch (sym_code) {
	case S_eof:
	    return (0);
	
	case S_time:
	   ASSIGN(user->time);
	   sym_get(); 
	   continue;

	case S_before:
	    sym_get();
	    parse(S_authorization);
	    if (user->before_author)
		free(user->before_author);
	    user->before_author = tac_strdup(sym_buf);
	    sym_get();
	    continue;

	case S_after:
	    sym_get();
	    parse(S_authorization);
	    if (user->after_author)
		free(user->after_author);
	    user->after_author = tac_strdup(sym_buf);
	    sym_get();
	    continue;

	case S_svc:
	case S_cmd:
	    
	    if (user->svcs) {   
		/* 
		 * Already parsed some services/commands. Thanks to Gabor Kiss
		 * who found this bug.
		 */
		NODE *p;
		for (p=user->svcs; p->next; p=p->next) 
		    /* NULL STMT */;
		p->next = parse_svcs();
	    } else {
		user->svcs = parse_svcs();
	    }
	    continue;

	case S_login:
	    if (user->login) {
		parse_error("Duplicate value for %s %s and %s on line %d",
			    codestring(sym_code), user->login,
			    sym_buf, sym_line);
		tac_exit(1);
	    }
	    sym_get();
	    parse(S_separator);
	    switch(sym_code) {

	    case S_skey:
		user->login = tac_strdup(sym_buf);
		break;

	    case S_nopasswd:
		/* set to dummy string, so that we detect a duplicate
		 * password definition attempt
		 */
		user->login = tac_strdup(nopasswd_str);
		user->nopasswd = 1;
		break;
		
	    case S_file:
	    case S_cleartext:
	    case S_des:
#ifdef USE_PAM	
	    case S_pam:	
#endif /* USE_PAM */		
#ifdef DB
	    case S_db:
#endif /* USE DB */
		sprintf(buf, "%s ", sym_buf);
		sym_get();
		strcat(buf, sym_buf);
		user->login = tac_strdup(buf);
		break;
	
	    default:
#ifdef USE_PAM
		parse_error(
 "expecting 'file', 'cleartext', 'pam'.'nopassword', 'skey', or 'des' keyword after 'login =' on line %d",
			    sym_line);
#else	
		parse_error(
 "expecting 'file', 'cleartext', 'nopassword', 'skey', or 'des' keyword after 'login =' on line %d", 
			    sym_line);
#endif /* USE_PAM */			
	    }
	    sym_get();
	    continue;

	case S_pap:
	    if (user->pap) {
		parse_error("Duplicate value for %s %s and %s on line %d",
			    codestring(sym_code), user->pap,
			    sym_buf, sym_line);
		tac_exit(1);
	    }
	    sym_get();
	    parse(S_separator);
	    switch(sym_code) {

	    case S_cleartext:
	    case S_des:
#ifdef USE_PAM	
	    case S_pam:
#endif /*USE_PAM */		    	
		sprintf(buf, "%s ", sym_buf);
		sym_get();
		strcat(buf, sym_buf);
		user->pap = tac_strdup(buf);
		break;	

		sprintf(buf, "%s ", sym_buf);
		user->pap = tac_strdup(buf);
		break;

	    default:
#ifdef USE_PAM
      		parse_error(
 "expecting 'cleartext', 'pam', or 'des' keyword after 'pap =' on line %d",
 sym_line);
#else
		parse_error(
 "expecting 'cleartext', or 'des' keyword after 'pap =' on line %d", 
 sym_line);
#endif /*USE_PAM */
	    }
	    sym_get();
	    continue;

	case S_name:
	    ASSIGN(user->full_name);
	    sym_get();
	    continue;

	case S_member:
	    ASSIGN(user->member);
	    sym_get();
	    continue;
	

	case S_expires:
	    ASSIGN(user->expires);
	    sym_get();
	    continue;
	
	case S_message:
	    ASSIGN(user->msg);
	    sym_get();
	    continue;

	case S_arap:
	case S_chap:
#ifdef MSCHAP
	case S_mschap:
#endif /* MSCHAP */
	case S_opap:
	case S_global:
	    save_sym = sym_code;
	    sym_get(); 
	    parse(S_separator); 
	    sprintf(buf, "%s ", sym_buf);
	    parse(S_cleartext);
	    strcat(buf, sym_buf);

	    if (save_sym == S_arap)
		fieldp = &user->arap;
	    if (save_sym == S_chap)
		fieldp = &user->chap;
#ifdef MSCHAP
	    if (save_sym == S_mschap)
		fieldp = &user->mschap;
#endif /* MSCHAP */
	    if (save_sym == S_pap)
		fieldp = &user->pap;
	    if (save_sym == S_opap)
		fieldp = &user->opap;
	    if (save_sym == S_global)
		fieldp = &user->global;

	    if (*fieldp) {
		parse_error("Duplicate value for %s %s and %s on line %d",
			    codestring(save_sym), *fieldp, sym_buf, sym_line);
		tac_exit(1);
	    }
	    *fieldp = tac_strdup(buf);
	    sym_get();
	    continue;

	case S_closebra:
	    parse(S_closebra);
	    return (0);

#ifdef MAXSESS
	case S_maxsess:
	    sym_get(); 
	    parse(S_separator);
	    if (sscanf(sym_buf, "%d", &user->maxsess) != 1) {
		parse_error("expecting integer, found '%s' on line %d",
		    sym_buf, sym_line);
	    }
	    sym_get();
	    continue;
#endif /* MAXSESS */
 
	default:
	    if (STREQ(sym_buf, "password")) {
		fprintf(stderr,
			"\npassword = <string> is obsolete. Use login = des <string>\n");
	    }
	    parse_error("Unrecognised keyword %s for user on line %d",
			sym_buf, sym_line);

	    return (0);
	}
    }
}

static NODE *parse_attrs();
static NODE *parse_cmd_matches();

static NODE *
parse_svcs()
{
    NODE *result;

    switch (sym_code) {
    default:
	return (NULL);
    case S_svc:
    case S_cmd:
	break;
    }

    result = (NODE *) tac_malloc(sizeof(NODE));

    bzero(result, sizeof(NODE));
    result->line = sym_line;

    /* cmd declaration */
    if (sym_code == S_cmd) {
	parse(S_cmd);
	parse(S_separator);
	result->value = tac_strdup(sym_buf);

	sym_get();
	parse(S_openbra);

	result->value1 = parse_cmd_matches();
	result->type = N_svc_cmd;

	parse(S_closebra);
	result->next = parse_svcs();
	return (result);
    }

    /* svc declaration */
    parse(S_svc);
    parse(S_separator);
    switch (sym_code) {
    default:
	parse_error("expecting service type but found %s on line %d",
		    sym_buf, sym_line);
	return (NULL);

    case S_string:
	result->type = N_svc;
	/* should perhaps check that this is an allowable service name */
	result->value1 = tac_strdup(sym_buf);
	break;
    case S_exec:
	result->type = N_svc_exec;
	break;
    case S_arap:
	result->type = N_svc_arap;
	break;
    case S_slip:
	result->type = N_svc_slip;
	break;
    case S_ppp:
	result->type = N_svc_ppp;
	parse(S_ppp);
	parse(S_protocol);
	parse(S_separator);
	/* Should perhaps check that this is a known PPP protocol name */
	result->value1 = tac_strdup(sym_buf);
	break;
    }
    sym_get();
    parse(S_openbra);
    result->dflt = parse_opt_attr_default();
    result->value = parse_attrs();
    parse(S_closebra);
    result->next = parse_svcs();
    return (result);
}

/*  <cmd-match>	 := <permission> <string> */

static NODE *
parse_cmd_matches()
{
    NODE *result;

    if (sym_code != S_permit && sym_code != S_deny) {
	return (NULL);
    }
    result = (NODE *) tac_malloc(sizeof(NODE));

    bzero(result, sizeof(NODE));
    result->line = sym_line;

    result->type = (parse_permission() == S_permit) ? N_permit : N_deny;
    result->value = tac_strdup(sym_buf);

    result->value1 = (void *) regcomp(result->value);
    if (!result->value1) {
	report(LOG_ERR, "in regular expression %s on line %d",
	       sym_buf, sym_line);
	tac_exit(1);
    }
    sym_get();

    result->next = parse_cmd_matches();

    return (result);
}

static NODE *
parse_attrs()
{
    NODE *result;
    char buf[MAX_INPUT_LINE_LEN];
    int optional = 0;

    if (sym_code == S_closebra) {
	return (NULL);
    }
    result = (NODE *) tac_malloc(sizeof(NODE));

    bzero(result, sizeof(NODE));
    result->line = sym_line;

    if (sym_code == S_optional) {
	optional++;
	sym_get();
    }
    result->type = optional ? N_optarg : N_arg;

    strcpy(buf, sym_buf);
    parse(S_string);
    strcat(buf, sym_buf);
    parse(S_separator);
    strcat(buf, sym_buf);
    parse(S_string);

    result->value = tac_strdup(buf);
    result->next = parse_attrs();
    return (result);
}


static void
 getsym();

static void
sym_get()
{
    getsym();

    if (debug & DEBUG_PARSE_FLAG) {
	report(LOG_DEBUG, "line=%d sym=%s code=%d buf='%s'",
	       sym_line, codestring(sym_code), sym_code, sym_buf);
    }
}

static char *
sym_buf_add(c)
char c;
{
    if (sym_pos >= MAX_INPUT_LINE_LEN) {
	sym_buf[MAX_INPUT_LINE_LEN-1] = '\0';
	if (debug & DEBUG_PARSE_FLAG) {
	    report(LOG_DEBUG, "line too long: line=%d sym=%s code=%d buf='%s'",
		   sym_line, codestring(sym_code), sym_code, sym_buf);
	}
	return(NULL);
    }

    sym_buf[sym_pos++] = c;
    return(sym_buf);
}
    
static void
getsym()
{

next:
    switch (sym_ch) {

    case EOF:
	sym_code = S_eof;
	return;

    case '\n':
	sym_line++;
	rch();
	goto next;

    case '\t':
    case ' ':
	while (sym_ch == ' ' || sym_ch == '\t')
	    rch();
	goto next;

    case '=':
	strcpy(sym_buf, "=");
	sym_code = S_separator;
	rch();
	return;

    case '{':
	strcpy(sym_buf, "{");
	sym_code = S_openbra;
	rch();
	return;

    case '}':
	strcpy(sym_buf, "}");
	sym_code = S_closebra;
	rch();
	return;

    case '#':
	while ((sym_ch != '\n') && (sym_ch != EOF))
	    rch();
	goto next;

    case '"':
	rch();
	sym_pos = 0;
	while (1) {

	    if (sym_ch == '"') {
		break;
	    }

	    /* backslash-double-quote is supported inside strings */
	    /* also allow \n */
	    if (sym_ch == '\\') {
		rch();
		switch (sym_ch) {
		case 'n':
		    /* preserve the slash for \n */
		    if (!sym_buf_add('\\')) {
			sym_code = S_unknown;
			rch();
			return;
		    }
		    
		    /* fall through */
		case '"':
		    if (!sym_buf_add(sym_ch)) {
			sym_code = S_unknown;
			rch();
			return;
		    }
		    rch();
		    continue;
		default:
		    sym_code = S_unknown;
		    rch();
		    return;
		}
	    }
	    if (!sym_buf_add(sym_ch)) {
		sym_code = S_unknown;
		rch();
		return;
	    }
	    rch();
	}
	rch();

	if (!sym_buf_add('\0')) {
	    sym_code = S_unknown;
	    rch();
	    return;
	}
	sym_code = S_string;
	return;

    default:
	sym_pos = 0;
	while (sym_ch != '\t' && sym_ch != ' ' && sym_ch != '='
	       && sym_ch != '\n') {

	    if (!sym_buf_add(sym_ch)) {
		sym_code = S_unknown;
		rch();
		return;
	    }
	    rch();
	}

	if (!sym_buf_add('\0')) {
	    sym_code = S_unknown;
	    rch();
	    return;
	}
	sym_code = keycode(sym_buf);
	if (sym_code == S_unknown)
	    sym_code = S_string;
	return;
    }
}

static void
rch()
{
    if (sym_error) {
	sym_ch = EOF;
	return;
    }
    sym_ch = getc(cf);

    if (parse_only && sym_ch != EOF)
	fprintf(stderr, "%c", sym_ch);
}


/* For a user or group, find the value of a field. Does not recurse. */
VALUE
get_value(user, field)
USER *user;
int field;
{
    VALUE v;

    v.intval = 0;

    if (!user) {
	parse_error("get_value: illegal user");
	return (v);
    }
    switch (field) {

    case S_name:
	v.pval = user->name;
	break;

    case S_login:
	v.pval = user->login;
	break;

    case S_global:
	v.pval = user->global;
	break;

    case S_member:
	v.pval = user->member;
	break;

    case S_expires:
	v.pval = user->expires;
	break;

    case S_arap:
	v.pval = user->arap;
	break;

    case S_chap:
	v.pval = user->chap;
	break;

#ifdef MSCHAP
    case S_mschap:
	v.pval = user->mschap;
	break;
#endif /* MSCHAP */

    case S_pap:
	v.pval = user->pap;
	break;

    case S_opap:
	v.pval = user->opap;
	break;

    case S_message:
	v.pval = user->msg;
	break;

    case S_svc:
	v.pval = user->svcs;
	break;

    case S_before:
	v.pval = user->before_author;
	break;

    case S_after:
	v.pval = user->after_author;
	break;

    case S_svc_dflt:
	v.intval = user->svc_dflt;
	break;

#ifdef MAXSESS
    case S_maxsess:
	v.intval = user->maxsess;
	break;
#endif 

    case S_nopasswd:
	v.intval = user->nopasswd;
	break;
	
    case S_time:
	v.pval = user->time;
	break;

    default:
	report(LOG_ERR, "get_value: unknown field %d", field);
	break;
    }
    return (v);
}

/* For host , find value of field. Doesn't recursive */
VALUE
get_hvalue(host, field)
HOST *host;
int field;
{
    VALUE v;
    v.intval = 0;
    if(!host) {
	parse_error("get_hvalue: illegal host");
        return (v);
    }
    switch (field) {
	case S_name:
        v.pval = host->name;
        break;
	
	case S_key:
	v.pval = host->key;
    	break;
	
	default:
        report(LOG_ERR, "get_value: unknown field %d", field);
        break;
    }
    return (v);
}


/* For each user, check she doesn't circularly reference a
   group. Return 1 if it does */
static int
circularity_check()
{
    USER *user, *entry, *group;
    USER **users = (USER **) hash_get_entries(usertable);
    USER **groups = (USER **) hash_get_entries(grouptable);
    USER **p, **q;

    /* users */
    for (p = users; *p; p++) {
	user = *p;

	if (debug & DEBUG_PARSE_FLAG)
	    report(LOG_DEBUG, "circularity_check: user=%s", user->name);

	/* Initialise all groups "seen" flags to zero */
	for (q = groups; *q; q++) {
	    group = *q;
	    group->flags &= ~FLAG_SEEN;
	}

	entry = user;

	while (entry) {
	    /* check groups we are a member of */
	    char *groupname = entry->member;

	    if (debug & DEBUG_PARSE_FLAG)
		report(LOG_DEBUG, "\tmember of group %s",
		       groupname ? groupname : "<none>");


	    /* if not a member of any groups, go on to next user */
	    if (!groupname)
		break;

	    group = (USER *) hash_lookup(grouptable, groupname);
	    if (!group) {
		report(LOG_ERR, "%s=%s, group %s does not exist",
		       (entry->flags & FLAG_ISUSER) ? "user" : "group",
		       entry->name, groupname);
		free(users);
		free(groups);
		return (1);
	    }
	    if (group->flags & FLAG_SEEN) {
		report(LOG_ERR, "recursively defined groups");

		/* print all seen "groups" */
		for (q = groups; *q; q++) {
		    group = *q;
		    if (group->flags & FLAG_SEEN)
			report(LOG_ERR, "%s", group->name);
		}
		free(users);
		free(groups);
		return (1);
	    }
	    group->flags |= FLAG_SEEN;	/* mark group as seen */
	    entry = group;
	}
    }
    free(users);
    free(groups);
    return (0);
}


/* Return a value for a group or user (isuser says if
   this name is a group or a user name).

   If no value exists, and recurse is true, also check groups we are a
   member of, recursively.

   Returns void * because it can return a string or a node pointer
   (should really return a union pointer).
*/
static VALUE
cfg_get_value(name, isuser, attr, recurse)
char *name;
int isuser, attr, recurse;
{
    USER *user, *group;
    VALUE value;

    value.pval = NULL;

    if (debug & DEBUG_CONFIG_FLAG)
	report(LOG_DEBUG, "cfg_get_value: name=%s isuser=%d attr=%s rec=%d",
	       name, isuser, codestring(attr), recurse);

    /* find the user/group entry */

    user = (USER *) hash_lookup(isuser ? usertable : grouptable, name);

    if (!user) {
	if (debug & DEBUG_CONFIG_FLAG)
	    report(LOG_DEBUG, "cfg_get_value: no user/group named %s", name);
	return (value);
    }

    /* found the entry. Lookup value from attr=value */
    value = get_value(user, attr);

    if (value.pval || !recurse) {
	return (value);
    }
    /* no value. Check containing group */
    if (user->member)
	group = (USER *) hash_lookup(grouptable, user->member);
    else
	group = NULL;

    while (group) {
	if (debug & DEBUG_CONFIG_FLAG)
	    report(LOG_DEBUG, "cfg_get_value: recurse group = %s",
		   group->name);

	value = get_value(group, attr);

	if (value.pval) {
	    return (value);
	}
	/* still nothing. Check containing group and so on */

	if (group->member)
	    group = (USER *) hash_lookup(grouptable, group->member);
	else
	    group = NULL;
    }

    /* no value for this user or her containing groups */
    value.pval = NULL;
    return (value);
}


/* Wrappers for cfg_get_value */
int
cfg_get_intvalue(name, isuser, attr, recurse)
char *name;
int isuser, attr, recurse;
{
    int val = cfg_get_value(name, isuser, attr, recurse).intval;

    if (debug & DEBUG_CONFIG_FLAG)
	report(LOG_DEBUG, "cfg_get_intvalue: returns %d", val);
    return(val);
}

char *
cfg_get_pvalue(name, isuser, attr, recurse)
char *name;
int isuser, attr, recurse;
{
    char *p = cfg_get_value(name, isuser, attr, recurse).pval;

    if (debug & DEBUG_CONFIG_FLAG)
	report(LOG_DEBUG, "cfg_get_pvalue: returns %s", 
	       p ? p : "NULL");
    return(p);
}

/* For getting host values */
static VALUE
cfg_get_hvalue(name, attr)
char *name;
int attr;
{
    HOST *host;
    VALUE value;

    value.pval = NULL;
    if (debug & DEBUG_CONFIG_FLAG)
        report(LOG_DEBUG, "cfg_get_hvalue: name=%s attr=%s ",
               name, codestring(attr));
    
    /* find the host entry in hash table */

    host = (HOST *) hash_lookup( hosttable, name);

    if (!host) {
        if (debug & DEBUG_CONFIG_FLAG)
            report(LOG_DEBUG, "cfg_get_hvalue: no host named %s", name);
        return (value);
    }

    /* found the entry. Lookup value from attr=value */
    value = get_hvalue(host, attr);

    if (value.pval) {
        return (value);
    }
    /* No any value for this host */    
    value.pval = NULL;
    return (value);
}

/* Wrappers for cfg_get_hvalue */
char *
cfg_get_phvalue(name, attr)
char *name;
int attr;
{
    char *p = cfg_get_hvalue(name, attr).pval;

    if (debug & DEBUG_CONFIG_FLAG)
	report(LOG_DEBUG, "cfg_get_phvalue: returns %s", 
	       p ? p : "NULL");
    return(p);
}

/*
   Read the config file and do some basic sanity checking on
   it. Return 1 if we find any errors. */

cfg_read_config(cfile)
char *cfile;
{
    sym_line = 1;

    if ((cf = fopen(cfile, "r")) == NULL) {
	report(LOG_ERR, "read_config: fopen() error for file %s %s, exiting",
	       cfile, sys_errlist[errno]);
	return (1);
    }
    if (parse_decls() || sym_error) {
	fclose(cf);
	return (1);
    }

    if (circularity_check()) {
	fclose(cf);
	return (1);
    }

    fclose(cf);
    return (0);
}

/* return 1 if user exists, 0 otherwise */
int
cfg_user_exists(username)
char *username;
{
    USER *user = (USER *) hash_lookup(usertable, username);

    return (user != NULL);
}

/* return expiry string of user. If none, try groups she is a member
   on, and so on, recursively if recurse is non-zero */
char *
cfg_get_expires(username, recurse)
char *username;

{
    return (cfg_get_pvalue(username, TAC_IS_USER, S_expires, recurse));
}

/* return time string of user. If none, try groups she is a member
   on, and so on, recursively if recurse is non-zero */
char *
cfg_get_timestamp(username, recurse)
char *username;
{
    return (cfg_get_pvalue(username, TAC_IS_USER, S_time, recurse));
}


/* return password string of user. If none, try groups she is a member
   on, and so on, recursively if recurse is non-zero */
char *
cfg_get_login_secret(user, recurse)
char *user;

{
    return (cfg_get_pvalue(user, TAC_IS_USER, S_login, recurse));
}

/* return value of the nopasswd field. If none, try groups she is a member
   on, and so on, recursively if recurse is non-zero */
int
cfg_get_user_nopasswd(user, recurse)
    char *user;
{
    return (cfg_get_intvalue(user, TAC_IS_USER, S_nopasswd, recurse));
}

/* return user's secret. If none, try groups she is a member
   on, and so on, recursively if recurse is non-zero */
char *
cfg_get_arap_secret(user, recurse)
char *user;

{
    return (cfg_get_pvalue(user, TAC_IS_USER, S_arap, recurse));
}

char *
cfg_get_chap_secret(user, recurse)
char *user;

{
    return (cfg_get_pvalue(user, TAC_IS_USER, S_chap, recurse));
}

#ifdef MSCHAP
char *
cfg_get_mschap_secret(user, recurse)
char *user;

{
    return (cfg_get_pvalue(user, TAC_IS_USER, S_mschap, recurse));
}
#endif /* MSCHAP */

char *
cfg_get_pap_secret(user, recurse)
char *user;
{
    return (cfg_get_pvalue(user, TAC_IS_USER, S_pap, recurse));
}

char *
cfg_get_opap_secret(user, recurse)
char *user;
{
    return (cfg_get_pvalue(user, TAC_IS_USER, S_opap, recurse));
}

/* return the global password for the user (or the group, etc.) */

char *
cfg_get_global_secret(user, recurse)
char *user;

{
    return (cfg_get_pvalue(user, TAC_IS_USER, S_global, recurse));
}

#ifdef USE_PAM
/* Return a pointer to a node representing a PAM Service name */
char *
cfg_get_pam_service(user,recurse)
char *user;

{
 char *cfg_passwd;
 char *p;   

cfg_passwd = cfg_get_pap_secret(user, recurse);
 
if (!cfg_passwd) {
        	cfg_passwd = cfg_get_global_secret(user, recurse);
}
 
if (!cfg_passwd && !cfg_user_exists(user)) {
        cfg_passwd = cfg_get_authen_default();
        switch (cfg_get_authen_default_method()) {
		case (S_pam): 
			if (debug & DEBUG_AUTHOR_FLAG)
                        report(LOG_DEBUG, "Get Default PAM Service :%s",cfg_passwd);
			return(cfg_passwd);
			break;
		default:
			if (debug & DEBUG_AUTHOR_FLAG)
                        report(LOG_DEBUG, "I havent find any PAM Service!!");
			return(NULL);/* Haven't any PAM Service!! */
	}
}

p=tac_find_substring("pam ", cfg_passwd);

if(p) {  /* We find PAM services */
	if (debug & DEBUG_AUTHOR_FLAG)
		report(LOG_DEBUG, "I get PAM sevice:%s",p);
return (p);
}

if (debug & DEBUG_AUTHOR_FLAG)
	report(LOG_DEBUG, "No any PAM Sevice");

return(NULL);
}

#endif /* For PAM */
	


/* Return a pointer to a node representing a given service
   authorization, taking care of recursion issues correctly. Protocol
   is only read if the type is N_svc_ppp. svcname is only read if type
   is N_svc.
*/

NODE *
cfg_get_svc_node(username, type, protocol, svcname, recurse)
char *username;
int type;
char *protocol, *svcname;
int recurse;
{
    USER *user, *group;
    NODE *svc;

    if (debug & DEBUG_CONFIG_FLAG)
	report(LOG_DEBUG, 
	       "cfg_get_svc_node: username=%s %s proto=%s svcname=%s rec=%d",
	       username, 
	       cfg_nodestring(type), 
	       protocol ? protocol : "", 
	       svcname ? svcname : "", 
	       recurse);

    /* find the user/group entry */
    user = (USER *) hash_lookup(usertable, username);

    if (!user) {
	if (debug & DEBUG_CONFIG_FLAG)
	    report(LOG_DEBUG, "cfg_get_svc_node: no user named %s", username);
	return (NULL);
    }

    /* found the user entry. Find svc node */
    for(svc = (NODE *) get_value(user, S_svc).pval; svc; svc = svc->next) {

	if (svc->type != type) 
	    continue;

	if (type == N_svc_ppp && !STREQ(svc->value1, protocol)) {
	    continue;
	}

	if (type == N_svc && !STREQ(svc->value1, svcname)) {
	    continue;
	}

	if (debug & DEBUG_CONFIG_FLAG)
	    report(LOG_DEBUG, 
		   "cfg_get_svc_node: found %s proto=%s svcname=%s",
		   cfg_nodestring(type), 
		   protocol ? protocol : "", 
		   svcname ? svcname : "");

	return(svc);
    }

    if (!recurse) {
	if (debug & DEBUG_CONFIG_FLAG)
	    report(LOG_DEBUG, "cfg_get_svc_node: returns NULL");
	return (NULL);
    }

    /* no matching node. Check containing group */
    if (user->member)
	group = (USER *) hash_lookup(grouptable, user->member);
    else
	group = NULL;

    while (group) {
	if (debug & DEBUG_CONFIG_FLAG)
	    report(LOG_DEBUG, "cfg_get_svc_node: recurse group = %s",
		   group->name);

	for(svc = (NODE *) get_value(group, S_svc).pval; svc; svc = svc->next) {

	    if (svc->type != type) 
		continue;

	    if (type == N_svc_ppp && !STREQ(svc->value1, protocol)) {
		continue;
	    }

	    if (type == N_svc && !STREQ(svc->value1, svcname)) {
		continue;
	    }

	    if (debug & DEBUG_CONFIG_FLAG)
		report(LOG_DEBUG, 
		       "cfg_get_svc_node: found %s proto=%s svcname=%s",
		       cfg_nodestring(type), 
		       protocol ? protocol : "", 
		       svcname ? svcname : "");

	    return(svc);
	}

	/* still nothing. Check containing group and so on */

	if (group->member)
	    group = (USER *) hash_lookup(grouptable, group->member);
	else
	    group = NULL;
    }

    if (debug & DEBUG_CONFIG_FLAG)
	report(LOG_DEBUG, "cfg_get_svc_node: returns NULL");

    /* no matching svc node for this user or her containing groups */
    return (NULL);
}

/* Return a pointer to the node representing a set of command regexp
   matches for a user and command, handling recursion issues correctly */
NODE *
cfg_get_cmd_node(name, cmdname, recurse)
char *name, *cmdname;
int recurse;

{
    USER *user, *group;
    NODE *svc;

    if (debug & DEBUG_CONFIG_FLAG)
	report(LOG_DEBUG, "cfg_get_cmd_node: name=%s cmdname=%s rec=%d",
	       name, cmdname, recurse);

    /* find the user/group entry */
    user = (USER *) hash_lookup(usertable, name);

    if (!user) {
	if (debug & DEBUG_CONFIG_FLAG)
	    report(LOG_DEBUG, "cfg_get_cmd_node: no user named %s", name);
	return (NULL);
    }
    /* found the user entry. Find svc node */
    svc = (NODE *) get_value(user, S_svc).pval;

    while (svc) {
	if (svc->type == N_svc_cmd && STREQ(svc->value, cmdname)) {
	    if (debug & DEBUG_CONFIG_FLAG)
		report(LOG_DEBUG, "cfg_get_cmd_node: found cmd %s %s node",
		       cmdname, cfg_nodestring(svc->type));
	    return (svc);
	}
	svc = svc->next;
    }

    if (!recurse) {
	if (debug & DEBUG_CONFIG_FLAG)
	    report(LOG_DEBUG, "cfg_get_cmd_node: returns NULL");
	return (NULL);
    }
    /* no matching node. Check containing group */
    if (user->member)
	group = (USER *) hash_lookup(grouptable, user->member);
    else
	group = NULL;

    while (group) {
	if (debug & DEBUG_CONFIG_FLAG)
	    report(LOG_DEBUG, "cfg_get_cmd_node: recurse group = %s",
		   group->name);

	svc = get_value(group, S_svc).pval;

	while (svc) {
	    if (svc->type == N_svc_cmd && STREQ(svc->value, cmdname)) {
		if (debug & DEBUG_CONFIG_FLAG)
		    report(LOG_DEBUG, "cfg_get_cmd_node: found cmd %s node %s",
			   cmdname, cfg_nodestring(svc->type));
		return (svc);
	    }
	    svc = svc->next;
	}

	/* still nothing. Check containing group and so on */

	if (group->member)
	    group = (USER *) hash_lookup(grouptable, group->member);
	else
	    group = NULL;
    }

    if (debug & DEBUG_CONFIG_FLAG)
	report(LOG_DEBUG, "cfg_get_cmd_node: returns NULL");

    /* no matching cmd node for this user or her containing groups */
    return (NULL);
}

/* Return an array of character strings representing configured AV
 * pairs, given a username and a service node. 
 *
 * In the AV strings returned, manipulate the separator character to
 * indicate which args are optional and which are mandatory.
 *
 * Lastly, indicate what default permission was configured by setting
 * denyp */

char **
cfg_get_svc_attrs(svcnode, denyp)
NODE *svcnode;
int *denyp;
{
    int i;
    NODE *node;
    char **args;

    *denyp = 1;

    if (!svcnode)
	return (NULL);

    *denyp = (svcnode->dflt == S_deny);

    i = 0;
    for (node = svcnode->value; node; node = node->next)
	i++;

    args = (char **) tac_malloc(sizeof(char *) * (i + 1));

    i = 0;
    for (node = svcnode->value; node; node = node->next) {
	char *arg = tac_strdup(node->value);
	char *p = index(arg, '=');

	if (p && node->type == N_optarg)
	    *p = '*';
	args[i++] = arg;
    }
    args[i] = NULL;
    return (args);
}


int
cfg_user_svc_default_is_permit(user)
char *user;

{
    int permit = cfg_get_intvalue(user, TAC_IS_USER, S_svc_dflt,
			       TAC_PLUS_RECURSE);

    switch (permit) {
    default:			/* default is deny */
    case S_deny:
	return (0);
    case S_permit:
	return (1);
    }
}

int
cfg_no_user_permitted()
{
    if (no_user_dflt == S_permit)
	return (1);
    return (0);
}


char *
cfg_get_authen_default()
{
    return (authen_default);
}

/* For describe authentication method(pam,file,db..etc) */
int 
cfg_get_authen_default_method()
{
   return (authen_default_method);
}


/* Return 1 if this user has any ppp services configured. Used for
   authorizing ppp/lcp requests */
int
cfg_ppp_is_configured(username, recurse)
    char *username;
    int recurse;
{
    USER *user, *group;
    NODE *svc;

    if (debug & DEBUG_CONFIG_FLAG)
	report(LOG_DEBUG, "cfg_ppp_is_configured: username=%s rec=%d",
	       username, recurse);

    /* find the user/group entry */
    user = (USER *) hash_lookup(usertable, username);

    if (!user) {
	if (debug & DEBUG_CONFIG_FLAG)
	    report(LOG_DEBUG, "cfg_ppp_is_configured: no user named %s", 
		   username);
	return (0);
    }

    /* found the user entry. Find svc node */
    for(svc = (NODE *) get_value(user, S_svc).pval; svc; svc = svc->next) {

	if (svc->type != N_svc_ppp) 
	    continue;

	if (debug & DEBUG_CONFIG_FLAG)
	    report(LOG_DEBUG, "cfg_ppp_is_configured: found svc ppp %s node",
		   svc->value1);
	
	return(1);
    }

    if (!recurse) {
	if (debug & DEBUG_CONFIG_FLAG)
	    report(LOG_DEBUG, "cfg_ppp_is_configured: returns 0");
	return (0);
    }

    /* no matching node. Check containing group */
    if (user->member)
	group = (USER *) hash_lookup(grouptable, user->member);
    else
	group = NULL;

    while (group) {
	if (debug & DEBUG_CONFIG_FLAG)
	    report(LOG_DEBUG, "cfg_ppp_is_configured: recurse group = %s",
		   group->name);

	for(svc = (NODE *) get_value(group, S_svc).pval; svc; svc = svc->next) {

	    if (svc->type != N_svc_ppp)
		continue;

	    if (debug & DEBUG_CONFIG_FLAG)
		report(LOG_DEBUG, "cfg_ppp_is_configured: found svc ppp %s node",
		       svc->value1);
	
	    return(1);
	}

	/* still nothing. Check containing group and so on */

	if (group->member)
	    group = (USER *) hash_lookup(grouptable, group->member);
	else
	    group = NULL;
    }

    if (debug & DEBUG_CONFIG_FLAG)
	report(LOG_DEBUG, "cfg_ppp_is_configured: returns 0");

    /* no PPP svc nodes for this user or her containing groups */
    return (0);
}

/* For getting host key */
char *
cfg_get_host_key(host)
char *host;
{
    return (cfg_get_phvalue(host, S_key));
}