FreeRADIUS/freeradius-server — pull request #103 by jdennis (2012-10-11 14:21:14+00:00)
Title: Prevent invalid config filenames from being loaded.

There are several places where configuration files are read by opening
a directory and loading every file found in that directory. However
sometimes files may be present which should not be loaded, instead
they should be excluded. We introduce a new utility function
fr_exclude_config_file() which takes a file basename and returns True
if it should be excluded from loading. We also log any files found in
a config directory which are excluded for any reason (there are other
checks for excluding a file, e.g. invalid characters in the basename
which are not part of fr_exclude_config_file()).

There are two approaches to identifying which basenames to exclude,
regular expession matching and specific checks (i.e. name begins with,
or name ends with). Regular expression matching is the most general
and likely more efficient than repeatedly testing a string for certain
substring conditions (the alternative approach). Unfortunately
regexp's are not always available (controlled by the config symbol
HAVE_REGEX_H). If regexps are available then fr_exclude_config_file()
is implemented with a single pre-compiled regexp match. If regexp's
are not available then fr_exclude_config_file() is implemented with
string utilities for testing the beginning and ending of a
string. Included are implementations of those string functions because
no such POSIX function exists nor were there any such functions
previously in FreeRADIUS.

In both cases files that are excluded are members of this hardcoded list:

Any basename beginning with a dot (.)
Any basename beginning with a hash (i.e. pound sign, octothorp) (#)
Any basename ending with a tilde (~)
Any basename ending with the substring ".rpmsave"
Any basename ending with the substring ".rpmnew"
Any basename ending with the substring ".dpkg-new"
Any basename ending with the substring ".dpkg-dist"
Any basename ending with the substring ".dpkg-old"
Any basename ending with the substring ".bak"

If the set of excluded files is updated then both implementations of
fr_exclude_config_file() should be adjusted.