diff options
Diffstat (limited to 'src/main/realms.c')
| -rw-r--r-- | src/main/realms.c | 3247 |
1 files changed, 3247 insertions, 0 deletions
diff --git a/src/main/realms.c b/src/main/realms.c new file mode 100644 index 0000000..2959d82 --- /dev/null +++ b/src/main/realms.c @@ -0,0 +1,3247 @@ +/* + * realms.c Realm handling code + * + * Version: $Id$ + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + * + * Copyright 2007 The FreeRADIUS server project + * Copyright 2007 Alan DeKok <aland@deployingradius.com> + */ + +RCSID("$Id$") + +#include <freeradius-devel/radiusd.h> +#include <freeradius-devel/realms.h> +#include <freeradius-devel/rad_assert.h> + +#include <sys/stat.h> + +#include <ctype.h> +#include <fcntl.h> + +static rbtree_t *realms_byname = NULL; +#ifdef WITH_TCP +bool home_servers_udp = false; +#endif + +#ifdef HAVE_DIRENT_H +#include <dirent.h> +#endif + +#ifdef HAVE_REGEX +typedef struct realm_regex realm_regex_t; + +/** Regular expression associated with a realm + * + */ +struct realm_regex { + REALM *realm; //!< The realm this regex matches. + regex_t *preg; //!< The pre-compiled regular expression. + realm_regex_t *next; //!< The next realm in the list of regular expressions. +}; +static realm_regex_t *realms_regex = NULL; +#endif /* HAVE_REGEX */ + +struct realm_config { + CONF_SECTION *cs; +#ifdef HAVE_DIRENT_H + char const *directory; +#endif + uint32_t dead_time; + uint32_t retry_count; + uint32_t retry_delay; + bool dynamic; + bool fallback; + bool wake_all_if_all_dead; +}; + +static const FR_NAME_NUMBER home_server_types[] = { + { "auth", HOME_TYPE_AUTH }, + { "acct", HOME_TYPE_ACCT }, + { "auth+acct", HOME_TYPE_AUTH_ACCT }, + { "coa", HOME_TYPE_COA }, +#ifdef WITH_COA_TUNNEL + { "auth+coa", HOME_TYPE_AUTH_COA }, + { "auth+acct+coa", HOME_TYPE_AUTH_ACCT_COA }, +#endif + { NULL, 0 } +}; + +static const FR_NAME_NUMBER home_ping_check[] = { + { "none", HOME_PING_CHECK_NONE }, + { "status-server", HOME_PING_CHECK_STATUS_SERVER }, + { "request", HOME_PING_CHECK_REQUEST }, + { NULL, 0 } +}; + +static const FR_NAME_NUMBER home_proto[] = { + { "UDP", IPPROTO_UDP }, + { "TCP", IPPROTO_TCP }, + { NULL, 0 } +}; + +#ifdef WITH_RADIUSV11 +extern int fr_radiusv11_client_init(fr_tls_server_conf_t *tls); +#endif + +static realm_config_t *realm_config = NULL; + +#ifdef WITH_PROXY +static rbtree_t *home_servers_byaddr = NULL; +static rbtree_t *home_servers_byname = NULL; +#ifdef WITH_STATS +int home_server_max_number = 0; +static rbtree_t *home_servers_bynumber = NULL; +#endif + +static rbtree_t *home_pools_byname = NULL; + +/* + * Map the proxy server configuration parameters to variables. + */ +static const CONF_PARSER proxy_config[] = { + { "retry_delay", FR_CONF_OFFSET(PW_TYPE_INTEGER, realm_config_t, retry_delay), STRINGIFY(RETRY_DELAY) }, + + { "retry_count", FR_CONF_OFFSET(PW_TYPE_INTEGER, realm_config_t, retry_count), STRINGIFY(RETRY_COUNT) }, + + { "default_fallback", FR_CONF_OFFSET(PW_TYPE_BOOLEAN, realm_config_t, fallback), "no" }, + + { "dynamic", FR_CONF_OFFSET(PW_TYPE_BOOLEAN, realm_config_t, dynamic), NULL }, + +#ifdef HAVE_DIRENT_H + { "directory", FR_CONF_OFFSET(PW_TYPE_STRING, realm_config_t, directory), NULL }, +#endif + + { "dead_time", FR_CONF_OFFSET(PW_TYPE_INTEGER, realm_config_t, dead_time), STRINGIFY(DEAD_TIME) }, + + { "wake_all_if_all_dead", FR_CONF_OFFSET(PW_TYPE_BOOLEAN, realm_config_t, wake_all_if_all_dead), "no" }, + CONF_PARSER_TERMINATOR +}; +#endif + +static int realm_name_cmp(void const *one, void const *two) +{ + REALM const *a = one; + REALM const *b = two; + + return strcasecmp(a->name, b->name); +} + + +#ifdef WITH_PROXY +static void home_server_free(void *data) +{ + home_server_t *home = talloc_get_type_abort(data, home_server_t); + + talloc_free(home); +} + +static int home_server_name_cmp(void const *one, void const *two) +{ + home_server_t const *a = one; + home_server_t const *b = two; + + if (a->type < b->type) return -1; + if (a->type > b->type) return +1; + + return strcasecmp(a->name, b->name); +} + +static int home_server_addr_cmp(void const *one, void const *two) +{ + int rcode; + home_server_t const *a = one; + home_server_t const *b = two; + + if (a->virtual_server && !b->virtual_server) return -1; + if (!a->virtual_server && b->virtual_server) return +1; + if (a->virtual_server && b->virtual_server) { + rcode = a->type - b->type; + if (rcode != 0) return rcode; + return strcmp(a->virtual_server, b->virtual_server); + } + + if (a->port < b->port) return -1; + if (a->port > b->port) return +1; + +#ifdef WITH_TCP + if (a->proto < b->proto) return -1; + if (a->proto > b->proto) return +1; +#endif + + rcode = fr_ipaddr_cmp(&a->src_ipaddr, &b->src_ipaddr); + if (rcode != 0) return rcode; + + return fr_ipaddr_cmp(&a->ipaddr, &b->ipaddr); +} + +#ifdef WITH_STATS +static int home_server_number_cmp(void const *one, void const *two) +{ + home_server_t const *a = one; + home_server_t const *b = two; + + return (a->number - b->number); +} +#endif + +static int home_pool_name_cmp(void const *one, void const *two) +{ + home_pool_t const *a = one; + home_pool_t const *b = two; + + if (a->server_type < b->server_type) return -1; + if (a->server_type > b->server_type) return +1; + + return strcasecmp(a->name, b->name); +} + + +static size_t xlat_cs(CONF_SECTION *cs, char const *fmt, char *out, size_t outlen) +{ + char const *value = NULL; + + if (!fmt) { + DEBUG("No configuration item requested. Ignoring."); + + *out = '\0'; + return 0; + } + + /* + * Instance name + */ + if (strcmp(fmt, "instance") == 0) { + value = cf_section_name2(cs); + if (!value) { + *out = '\0'; + return 0; + } + } else { + CONF_PAIR *cp; + + cp = cf_pair_find(cs, fmt); + if (!cp || !(value = cf_pair_value(cp))) { + *out = '\0'; + return 0; + } + } + + strlcpy(out, value, outlen); + + return strlen(out); +} + + +/* + * Xlat for %{home_server:foo} + */ +static ssize_t xlat_home_server(UNUSED void *instance, REQUEST *request, + char const *fmt, char *out, size_t outlen) +{ + if (!request->home_server) { + RWDEBUG("No home_server associated with this request"); + + *out = '\0'; + return 0; + } + + if (!fmt) { + RWDEBUG("No configuration item requested. Ignoring."); + + *out = '\0'; + return 0; + } + + if (strcmp(fmt, "state") == 0) { + char const *state; + + switch (request->home_server->state) { + case HOME_STATE_ALIVE: + state = "alive"; + break; + + case HOME_STATE_ZOMBIE: + state = "zombie"; + break; + + case HOME_STATE_IS_DEAD: + state = "dead"; + break; + + case HOME_STATE_CONNECTION_FAIL: + state = "fail"; + break; + + case HOME_STATE_ADMIN_DOWN: + state = "down"; + break; + + default: + state = "unknown"; + break; + } + + strlcpy(out, state, outlen); + return strlen(out); + } + + return xlat_cs(request->home_server->cs, fmt, out, outlen); +} + + +/* + * Xlat for %{home_server_pool:foo} + */ +static ssize_t xlat_server_pool(UNUSED void *instance, REQUEST *request, + char const *fmt, char *out, size_t outlen) +{ + if (!request->home_pool) { + RWDEBUG("No home_pool associated with this request"); + + *out = '\0'; + return 0; + } + + if (!fmt) { + RWDEBUG("No configuration item requested. Ignoring."); + + *out = '\0'; + return 0; + } + + if (strcmp(fmt, "state") == 0) { + char const *state; + + if (request->home_pool->in_fallback) { + state = "fallback"; + + } else { + state = "alive"; + } + + strlcpy(out, state, outlen); + return strlen(out); + } + + return xlat_cs(request->home_pool->cs, fmt, out, outlen); +} + + +/* + * Xlat for %{home_server_dynamic:foo} + */ +static ssize_t xlat_home_server_dynamic(UNUSED void *instance, REQUEST *request, + char const *fmt, char *out, size_t outlen) +{ + int type; + char const *p, *name; + home_server_t *home; + char buffer[1024]; + + if (outlen < 2) return 0; + + switch (request->packet->code) { + case PW_CODE_ACCESS_REQUEST: + type = HOME_TYPE_AUTH; + break; + +#ifdef WITH_ACCOUNTING + case PW_CODE_ACCOUNTING_REQUEST: + type = HOME_TYPE_ACCT; + break; +#endif + +#ifdef WITH_COA + case PW_CODE_COA_REQUEST: + case PW_CODE_DISCONNECT_REQUEST: + type = HOME_TYPE_COA; + break; +#endif + + default: + *out = '\0'; + return 0; + } + + p = fmt; + while (isspace((uint8_t) *p)) p++; + + /* + * Allow for dynamic strings as arguments. + */ + if (*p == '&') { + VALUE_PAIR *vp; + + if ((radius_get_vp(&vp, request, p) < 0) || !vp || + (vp->da->type != PW_TYPE_STRING)) { + return -1; + } + name = vp->vp_strvalue; + + } else if (*p == '%') { + if (radius_xlat(buffer, sizeof(buffer), request, p, NULL, NULL) < 0) { + return -1; + } + name = buffer; + + } else { + name = p; + } + + home = home_server_byname(name, type); + if (!home) { + *out = '\0'; + return 0; + } + + /* + * 1 for dynamic, 0 for static + */ + out[0] = '0' + home->dynamic; + out[1] = '\0'; + + return 1; +} +#endif + +void realms_free(void) +{ +#ifdef WITH_PROXY +# ifdef WITH_STATS + rbtree_free(home_servers_bynumber); + home_servers_bynumber = NULL; +# endif + + rbtree_free(home_servers_byname); + home_servers_byname = NULL; + + rbtree_free(home_servers_byaddr); + home_servers_byaddr = NULL; + + rbtree_free(home_pools_byname); + home_pools_byname = NULL; +#endif + + rbtree_free(realms_byname); + realms_byname = NULL; + + realm_pool_free(NULL); + + talloc_free(realm_config); + realm_config = NULL; +} + + +#ifdef WITH_PROXY +static CONF_PARSER limit_config[] = { + { "max_connections", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, limit.max_connections), "16" }, + { "max_requests", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, limit.max_requests), "0" }, + { "lifetime", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, limit.lifetime), "0" }, + { "idle_timeout", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, limit.idle_timeout), "0" }, + CONF_PARSER_TERMINATOR +}; + +#ifdef WITH_COA +static CONF_PARSER home_server_coa[] = { + { "irt", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, coa_irt), STRINGIFY(2) }, + { "mrt", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, coa_mrt), STRINGIFY(16) }, + { "mrc", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, coa_mrc), STRINGIFY(5) }, + { "mrd", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, coa_mrd), STRINGIFY(30) }, + CONF_PARSER_TERMINATOR +}; + + + +#ifdef WITH_COA_TUNNEL +static CONF_PARSER home_server_recv_coa[] = { + { "virtual_server", FR_CONF_OFFSET(PW_TYPE_STRING, home_server_t, recv_coa_server), NULL }, + CONF_PARSER_TERMINATOR +}; +#endif + +#endif + +static CONF_PARSER home_server_config[] = { + { "nonblock", FR_CONF_OFFSET(PW_TYPE_BOOLEAN, home_server_t, nonblock), "no" }, + { "ipaddr", FR_CONF_OFFSET(PW_TYPE_COMBO_IP_ADDR, home_server_t, ipaddr), NULL }, + { "ipv4addr", FR_CONF_OFFSET(PW_TYPE_IPV4_ADDR, home_server_t, ipaddr), NULL }, + { "ipv6addr", FR_CONF_OFFSET(PW_TYPE_IPV6_ADDR, home_server_t, ipaddr), NULL }, + { "virtual_server", FR_CONF_OFFSET(PW_TYPE_STRING | PW_TYPE_NOT_EMPTY, home_server_t, virtual_server), NULL }, + + { "port", FR_CONF_OFFSET(PW_TYPE_SHORT, home_server_t, port), "0" }, + + { "type", FR_CONF_OFFSET(PW_TYPE_STRING, home_server_t, type_str), NULL }, + +#ifdef WITH_TCP + { "proto", FR_CONF_OFFSET(PW_TYPE_STRING | PW_TYPE_NOT_EMPTY, home_server_t, proto_str), NULL }, +#endif + + { "secret", FR_CONF_OFFSET(PW_TYPE_STRING | PW_TYPE_SECRET, home_server_t, secret), NULL }, + + { "src_ipaddr", FR_CONF_OFFSET(PW_TYPE_STRING, home_server_t, src_ipaddr_str), NULL }, + + { "response_window", FR_CONF_OFFSET(PW_TYPE_TIMEVAL, home_server_t, response_window), "30" }, + { "response_timeouts", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, max_response_timeouts), "1" }, + { "max_outstanding", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, max_outstanding), "65536" }, + + { "zombie_period", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, zombie_period), "40" }, + + { "status_check", FR_CONF_OFFSET(PW_TYPE_STRING, home_server_t, ping_check_str), "none" }, + { "ping_check", FR_CONF_OFFSET(PW_TYPE_STRING, home_server_t, ping_check_str), NULL }, + + { "ping_interval", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, ping_interval), "30" }, + { "check_interval", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, ping_interval), NULL }, + + { "check_timeout", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, ping_timeout), "4" }, + { "status_check_timeout", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, ping_timeout), NULL }, + + { "num_answers_to_alive", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, num_pings_to_alive), "3" }, + { "revive_interval", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, revive_interval), "300" }, + + { "username", FR_CONF_OFFSET(PW_TYPE_STRING | PW_TYPE_NOT_EMPTY, home_server_t, ping_user_name), NULL }, + { "password", FR_CONF_OFFSET(PW_TYPE_STRING | PW_TYPE_NOT_EMPTY, home_server_t, ping_user_password), NULL }, + +#ifdef WITH_STATS + { "historic_average_window", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, ema.window), NULL }, +#endif + + { "limit", FR_CONF_POINTER(PW_TYPE_SUBSECTION, NULL), (void const *) limit_config }, + +#ifdef WITH_COA + { "coa", FR_CONF_POINTER(PW_TYPE_SUBSECTION, NULL), (void const *) home_server_coa }, +#ifdef WITH_COA_TUNNEL + { "recv_coa", FR_CONF_POINTER(PW_TYPE_SUBSECTION, NULL), (void const *) home_server_recv_coa }, +#endif +#endif + + CONF_PARSER_TERMINATOR +}; + + +static void null_free(UNUSED void *data) +{ +} + +/* + * Ensure that all of the parameters in the home server are OK. + */ +void realm_home_server_sanitize(home_server_t *home, CONF_SECTION *cs) +{ + CONF_SECTION *parent = NULL; + + FR_INTEGER_BOUND_CHECK("max_outstanding", home->max_outstanding, >=, 8); + FR_INTEGER_BOUND_CHECK("max_outstanding", home->max_outstanding, <=, 65536*16); + + FR_INTEGER_BOUND_CHECK("ping_interval", home->ping_interval, >=, 6); + FR_INTEGER_BOUND_CHECK("ping_interval", home->ping_interval, <=, 120); + + FR_TIMEVAL_BOUND_CHECK("response_window", &home->response_window, >=, 0, 1000); + FR_TIMEVAL_BOUND_CHECK("response_window", &home->response_window, <=, + main_config.max_request_time, 0); + FR_TIMEVAL_BOUND_CHECK("response_window", &home->response_window, <=, 60, 0); + + FR_INTEGER_BOUND_CHECK("response_timeouts", home->max_response_timeouts, >=, 1); + FR_INTEGER_BOUND_CHECK("response_timeouts", home->max_response_timeouts, <=, 1000); + + /* + * Track the minimum response window, so that we can + * correctly set the timers in process.c + */ + if (timercmp(&main_config.init_delay, &home->response_window, >)) { + main_config.init_delay = home->response_window; + } + + FR_INTEGER_BOUND_CHECK("zombie_period", home->zombie_period, >=, 1); + FR_INTEGER_BOUND_CHECK("zombie_period", home->zombie_period, <=, 120); + FR_INTEGER_BOUND_CHECK("zombie_period", home->zombie_period, >=, (uint32_t) home->response_window.tv_sec); + + FR_INTEGER_BOUND_CHECK("num_pings_to_alive", home->num_pings_to_alive, >=, 3); + FR_INTEGER_BOUND_CHECK("num_pings_to_alive", home->num_pings_to_alive, <=, 10); + + FR_INTEGER_BOUND_CHECK("check_timeout", home->ping_timeout, >=, 1); + FR_INTEGER_BOUND_CHECK("check_timeout", home->ping_timeout, <=, 10); + + FR_INTEGER_BOUND_CHECK("revive_interval", home->revive_interval, >=, 10); + FR_INTEGER_BOUND_CHECK("revive_interval", home->revive_interval, <=, 3600); + +#ifdef WITH_COA + FR_INTEGER_BOUND_CHECK("coa_irt", home->coa_irt, >=, 1); + FR_INTEGER_BOUND_CHECK("coa_irt", home->coa_irt, <=, 5); + + FR_INTEGER_BOUND_CHECK("coa_mrc", home->coa_mrc, <=, 20); + + FR_INTEGER_BOUND_CHECK("coa_mrt", home->coa_mrt, <=, 30); + + FR_INTEGER_BOUND_CHECK("coa_mrd", home->coa_mrd, >=, 5); + FR_INTEGER_BOUND_CHECK("coa_mrd", home->coa_mrd, <=, 60); +#endif + + FR_INTEGER_BOUND_CHECK("max_connections", home->limit.max_connections, <=, 1024); + +#ifdef WITH_TCP + /* + * UDP sockets can't be connection limited. + */ + if (home->proto != IPPROTO_TCP) home->limit.max_connections = 0; +#endif + + if ((home->limit.idle_timeout > 0) && (home->limit.idle_timeout < 5)) + home->limit.idle_timeout = 5; + if ((home->limit.lifetime > 0) && (home->limit.lifetime < 5)) + home->limit.lifetime = 5; + if ((home->limit.lifetime > 0) && (home->limit.idle_timeout > home->limit.lifetime)) + home->limit.idle_timeout = 0; + + /* + * Make sure that this is set. + */ + if (home->src_ipaddr.af == AF_UNSPEC) { + home->src_ipaddr.af = home->ipaddr.af; + } + + parent = cf_item_parent(cf_section_to_item(cs)); + if (parent && strcmp(cf_section_name1(parent), "server") == 0) { + home->parent_server = cf_section_name2(parent); + } +} + +/** Insert a new home server into the various internal lookup trees + * + * @param home server to add. + * @param cs That defined the home server. + * @return true on success else false. + */ +static bool home_server_insert(home_server_t *home, CONF_SECTION *cs) +{ + if (home->name && !rbtree_insert(home_servers_byname, home)) { + cf_log_err_cs(cs, "Internal error %d adding home server %s", __LINE__, home->log_name); + return false; + } + + if (!home->virtual_server && !rbtree_insert(home_servers_byaddr, home)) { + rbtree_deletebydata(home_servers_byname, home); + cf_log_err_cs(cs, "Internal error %d adding home server %s", __LINE__, home->log_name); + return false; + } + +#ifdef WITH_STATS + home->number = home_server_max_number++; + if (!rbtree_insert(home_servers_bynumber, home)) { + rbtree_deletebydata(home_servers_byname, home); + if (home->ipaddr.af != AF_UNSPEC) { + rbtree_deletebydata(home_servers_byname, home); + } + cf_log_err_cs(cs, "Internal error %d adding home server %s", __LINE__, home->log_name); + return false; + } +#endif + + return true; +} + +/** Add an already allocate home_server_t to the various trees + * + * @param home server to add. + * @return true on success, else false on error. + */ +bool realm_home_server_add(home_server_t *home) +{ + /* + * The structs aren't mutex protected. Refuse to destroy + * the server. + */ + if (event_loop_started && !realm_config->dynamic) { + ERROR("Failed to add dynamic home server, \"dynamic = yes\" must be set in proxy.conf"); + return false; + } + + if (home->name && (rbtree_finddata(home_servers_byname, home) != NULL)) { + cf_log_err_cs(home->cs, "Duplicate home server name %s", home->name); + return false; + } + + if (!home->virtual_server && (rbtree_finddata(home_servers_byaddr, home) != NULL)) { + char buffer[INET6_ADDRSTRLEN + 3]; + + inet_ntop(home->ipaddr.af, &home->ipaddr.ipaddr, buffer, sizeof(buffer)); + + cf_log_err_cs(home->cs, "Duplicate home server address%s%s%s: %s:%s%s/%i", + home->name ? " (already in use by " : "", + home->name ? home->name : "", + home->name ? ")" : "", + buffer, + fr_int2str(home_proto, home->proto, "<INVALID>"), +#ifdef WITH_TLS + home->tls ? "+tls" : "", +#else + "", +#endif + home->port); + + return false; + } + + if (!home_server_insert(home, home->cs)) return false; + + /* + * Dual home servers cause us to auto-create an + * accounting server for UDP sockets, and leave + * everything alone for TLS sockets. + */ + if (home->dual +#ifdef WITH_TLS + && !home->tls +#endif +) { + home_server_t *home2 = talloc(talloc_parent(home), home_server_t); + + memcpy(home2, home, sizeof(*home2)); + + home2->type = HOME_TYPE_ACCT; + home2->dual = true; + home2->port++; + + home2->ping_user_password = NULL; + home2->cs = home->cs; + home2->parent_server = home->parent_server; + + if (!home_server_insert(home2, home->cs)) { + talloc_free(home2); + return false; + } + } + +#ifdef WITH_COA_TUNNEL + if (home->recv_coa) { + if (!home->tls) { + ERROR("TLS is required in order to accept CoA requests from a home server"); + return false; + } + + if (!home->recv_coa_server) { + ERROR("A 'virtual_server' configuration is required in order to accept CoA requests from a home server"); + return false; + } + } +#endif + + /* + * Mark it as already processed + */ + cf_data_add(home->cs, "home_server", (void *)null_free, null_free); + + return true; +} + +#ifdef WITH_TLS +/* + * The listeners are always different. And we always look them up by *known* listener. And not "find me some random thing". + */ +static int listener_cmp(void const *one, void const *two) +{ + if (one < two) return -1; + if (one > two) return +1; + + return 0; +} +#endif + +/** Alloc a new home server defined by a CONF_SECTION + * + * @param ctx to allocate home_server_t in. + * @param rc Realm config, may be NULL in which case the global realm_config will be used. + * @param cs Configuration section containing home server parameters. + * @return a new home_server_t alloced in the context of the realm_config, or NULL on error. + */ +home_server_t *home_server_afrom_cs(TALLOC_CTX *ctx, realm_config_t *rc, CONF_SECTION *cs) +{ + home_server_t *home; + CONF_SECTION *tls; + + if (!rc) rc = realm_config; /* Use the global config */ + + home = talloc_zero(ctx, home_server_t); + home->name = cf_section_name2(cs); + home->log_name = talloc_typed_strdup(home, home->name); + home->cs = cs; + home->state = HOME_STATE_UNKNOWN; + home->proto = IPPROTO_UDP; + + /* + * Parse the configuration into the home server + * struct. + */ + if (cf_section_parse(cs, home, home_server_config) < 0) goto error; + + /* + * It has an IP address, it must be a remote server. + */ + if (cf_pair_find(cs, "ipaddr") || cf_pair_find(cs, "ipv4addr") || cf_pair_find(cs, "ipv6addr")) { + if (fr_inaddr_any(&home->ipaddr) == 1) { + cf_log_err_cs(cs, "Wildcard '*' addresses are not permitted for home servers"); + goto error; + } + + if (!home->log_name) { + char buffer[INET6_ADDRSTRLEN + 3]; + + fr_ntop(buffer, sizeof(buffer), &home->ipaddr); + + home->log_name = talloc_asprintf(home, "%s:%i", buffer, home->port); + } + /* + * If it has a 'virtual_Server' config item, it's + * a loopback into a virtual server. + */ + } else if (cf_pair_find(cs, "virtual_server") != NULL) { + home->ipaddr.af = AF_UNSPEC; /* mark ipaddr as unused */ + + if (!home->virtual_server) { + cf_log_err_cs(cs, "Invalid value for virtual_server"); + goto error; + } + + /* + * Try and find a "server" section off the root of + * the config with a name that matches the + * virtual_server. + */ + if (!rc) goto error; + + if (!cf_section_sub_find_name2(rc->cs, "server", home->virtual_server)) { + cf_log_err_cs(cs, "No such server %s", home->virtual_server); + goto error; + } + + home->secret = ""; + home->log_name = talloc_typed_strdup(home, home->virtual_server); + /* + * Otherwise it's an invalid config section and we + * raise an error. + */ + } else { + cf_log_err_cs(cs, "No ipaddr, ipv4addr, ipv6addr, or virtual_server defined " + "for home server"); + error: + talloc_free(home); + return false; + } + + { + home_type_t type = HOME_TYPE_AUTH_ACCT; + + if (home->type_str) type = fr_str2int(home_server_types, home->type_str, HOME_TYPE_INVALID); + + home->type = type; + + switch (type) { + case HOME_TYPE_AUTH_ACCT: + home->dual = true; + break; + + case HOME_TYPE_AUTH: + case HOME_TYPE_ACCT: + break; + +#ifdef WITH_COA + case HOME_TYPE_COA: + if (home->virtual_server != NULL) { + cf_log_err_cs(cs, "Home servers of type \"coa\" cannot point to a virtual server"); + goto error; + } + break; + +#ifdef WITH_COA_TUNNEL + case HOME_TYPE_AUTH_ACCT_COA: + home->dual = true; + home->recv_coa = true; + break; + + case HOME_TYPE_AUTH_COA: + home->recv_coa = true; + break; +#endif +#endif + + case HOME_TYPE_INVALID: + cf_log_err_cs(cs, "Invalid type \"%s\" for home server %s", home->type_str, home->log_name); + goto error; + } + } + + { + home_ping_check_t type = HOME_PING_CHECK_NONE; + + if (home->ping_check_str) type = fr_str2int(home_ping_check, home->ping_check_str, + HOME_PING_CHECK_INVALID); + + switch (type) { + case HOME_PING_CHECK_STATUS_SERVER: + case HOME_PING_CHECK_NONE: + break; + + case HOME_PING_CHECK_REQUEST: + if (!home->ping_user_name) { + cf_log_err_cs(cs, "You must supply a 'username' to enable status_check=request"); + goto error; + } + + if (((home->type == HOME_TYPE_AUTH) || +#ifdef WITH_COA_TUNNEL + (home->type == HOME_TYPE_AUTH_COA) || + (home->type == HOME_TYPE_AUTH_ACCT_COA) || +#endif + (home->type == HOME_TYPE_AUTH_ACCT)) && !home->ping_user_password) { + cf_log_err_cs(cs, "You must supply a 'password' to enable status_check=request"); + goto error; + } + + break; + + case HOME_PING_CHECK_INVALID: + cf_log_err_cs(cs, "Invalid status_check \"%s\" for home server %s", + home->ping_check_str, home->log_name); + goto error; + } + + home->ping_check = type; + } + + { + int proto = IPPROTO_UDP; + + if (home->proto_str) proto = fr_str2int(home_proto, home->proto_str, -1); + + switch (proto) { + case IPPROTO_UDP: +#ifdef WITH_TCP + home_servers_udp = true; +#endif + break; + + case IPPROTO_TCP: +#ifndef WITH_TCP + cf_log_err_cs(cs, "Server not built with support for RADIUS over TCP"); + goto error; +#endif + if ((home->ping_check != HOME_PING_CHECK_NONE) && + (home->ping_check != HOME_PING_CHECK_STATUS_SERVER)) { + cf_log_err_cs(cs, "Only 'status_check = status-server' is allowed for home " + "servers with 'proto = tcp'"); + goto error; + } + break; + + default: + cf_log_err_cs(cs, "Unknown proto \"%s\"", home->proto_str); + goto error; + } + + home->proto = proto; + } + + if (!home->virtual_server && rbtree_finddata(home_servers_byaddr, home)) { + cf_log_err_cs(cs, "Duplicate home server"); + goto error; + } + + /* + * Check the TLS configuration. + */ + tls = cf_section_sub_find(cs, "tls"); +#ifndef WITH_TLS + if (tls) { + cf_log_err_cs(cs, "TLS transport is not available in this executable"); + goto error; + } +#endif + + /* + * Check the reverse CoA configuration. + */ +#ifdef WITH_COA_TUNNEL + if (home->recv_coa) { + if (!tls) { + ERROR("TLS is required in order to accept CoA requests from a home server"); + goto error; + } + + if (!home->recv_coa_server) { + ERROR("A 'virtual_server' configuration is required in order to accept CoA requests from a home server"); + goto error; + } + + /* + * Try and find a 'server' section off the root of + * the config with a name that matches the coa + * virtual_server. + */ + if (!rc) { + ERROR("Dynamic home servers cannot accept CoA requests"); + goto error; + } + + if (!cf_section_sub_find_name2(rc->cs, "server", home->recv_coa_server)) { + cf_log_err_cs(cs, "No such coa server %s", home->recv_coa_server); + goto error; + } + } +#endif + + /* + * If were doing RADSEC (tls+tcp) the secret should default + * to radsec, else a secret must be set. + */ + if (!home->secret) { +#ifdef WITH_TLS + if (tls && (home->proto == IPPROTO_TCP)) { + home->secret = "radsec"; + } else +#endif + { + cf_log_err_cs(cs, "No shared secret defined for home server %s", home->log_name); + goto error; + } + } + + /* + * Virtual servers have some TLS restrictions. + */ + if (home->virtual_server) { + if (tls) { + cf_log_err_cs(cs, "Virtual home_servers cannot have a \"tls\" subsection"); + goto error; + } + } else { + /* + * If the home is not a virtual server, guess the port + * and look up the source ip address. + */ + rad_assert(home->ipaddr.af != AF_UNSPEC); + +#ifdef WITH_TLS + if (tls && (home->proto != IPPROTO_TCP)) { + cf_log_err_cs(cs, "TLS transport is not available for UDP sockets"); + goto error; + } +#endif + + /* + * Set the default port if necessary. + */ + if (home->port == 0) { + char buffer[INET6_ADDRSTRLEN + 3]; + + /* + * For RADSEC we use the special RADIUS over TCP/TLS port + * for both accounting and authentication, but for some + * bizarre reason for RADIUS over plain TCP we use separate + * ports 1812 and 1813. + */ +#ifdef WITH_TLS + if (tls) { + home->port = PW_RADIUS_TLS_PORT; + } else +#endif + switch (home->type) { + default: + rad_assert(0); + /* FALL-THROUGH */ + + /* + * One is added to get the accounting port + * for home->dual. + */ + case HOME_TYPE_AUTH_ACCT: + case HOME_TYPE_AUTH: + home->port = PW_AUTH_UDP_PORT; + break; + + case HOME_TYPE_ACCT: + home->port = PW_ACCT_UDP_PORT; + break; + + case HOME_TYPE_COA: + home->port = PW_COA_UDP_PORT; + break; + } + + /* + * Now that we have a real port, use that. + */ + rad_const_free(home->log_name); + + fr_ntop(buffer, sizeof(buffer), &home->ipaddr); + + home->log_name = talloc_asprintf(home, "%s:%i", buffer, home->port); + } + + /* + * If we have a src_ipaddr_str resolve it to + * the same address family as the destination + * IP. + */ + if (home->src_ipaddr_str) { + if (ip_hton(&home->src_ipaddr, home->ipaddr.af, home->src_ipaddr_str, false) < 0) { + cf_log_err_cs(cs, "Failed parsing src_ipaddr"); + goto error; + } + /* + * Source isn't specified, set it to the + * correct address family, but leave it as + * zeroes. + */ + } else { + home->src_ipaddr.af = home->ipaddr.af; + } + +#ifdef WITH_TLS + /* + * Parse the SSL client configuration. + */ + if (tls) { + int rcode; + + home->tls = tls_client_conf_parse(tls); + if (!home->tls) { + goto error; + } + + /* + * Connection timeouts for outgoing TLS connections. + */ + + rcode = cf_item_parse(tls, "connect_timeout", FR_ITEM_POINTER(PW_TYPE_INTEGER, &home->connect_timeout), NULL); + if (rcode < 0) goto error; + + if (!home->connect_timeout || (home->connect_timeout > 30)) home->connect_timeout = 30; + + home->listeners = rbtree_create(home, listener_cmp, NULL, RBTREE_FLAG_LOCK); + if (!home->listeners) goto error; + +#ifdef WITH_RADIUSV11 + if (home->tls->radiusv11_name) { + rcode = fr_str2int(radiusv11_types, home->tls->radiusv11_name, -1); + if (rcode < 0) { + cf_log_err_cs(cs, "Invalid value for 'radiusv11'"); + goto error; + } + + home->tls->radiusv11 = rcode; + + if (fr_radiusv11_client_init(home->tls) < 0) { + cf_log_err_cs(cs, "Failed setting OpenSSL callbacks for radiusv11"); + goto error; + } + } +#endif + + } +#endif + } /* end of parse home server */ + + realm_home_server_sanitize(home, cs); + + return home; +} + +/** Fixup a client configuration section to specify a home server + * + * This is used to create the equivalent CoA home server entry for a client, + * so that the server can originate CoA messages. + * + * The server section automatically inherits the following fields from the client: + * - ipaddr/ipv4addr/ipv6addr + * - secret + * - src_ipaddr + * + * @note new CONF_SECTION will be allocated in the context of the client, but the client + * CONF_SECTION will not be modified. + * + * @param client CONF_SECTION to inherit values from. + * @return a new server CONF_SCTION, or a pointer to the existing CONF_SECTION in the client. + */ +CONF_SECTION *home_server_cs_afrom_client(CONF_SECTION *client) +{ + CONF_SECTION *server, *cs; + CONF_PAIR *cp; + + /* + * Alloc a plain home server for both cases + * + * There's no way these can be referenced by a pool, + * and they may conflict with home servers in proxy.conf + * so it's easier to not set a name. + */ + + /* + * + * Duplicate the server section, so we don't mangle + * the client CONF_SECTION we were passed. + */ + cs = cf_section_sub_find(client, "coa_server"); + if (cs) { + server = cf_section_dup(client, cs, "home_server", NULL, true); + } else { + server = cf_section_alloc(client, "home_server", cf_section_name2(client)); + } + + if (!cs || (!cf_pair_find(cs, "ipaddr") && !cf_pair_find(cs, "ipv4addr") && !cf_pair_find(cs, "ipv6addr"))) { + cp = cf_pair_find(client, "ipaddr"); + if (!cp) cp = cf_pair_find(client, "ipv4addr"); + if (!cp) cp = cf_pair_find(client, "ipv6addr"); + + cf_pair_add(server, cf_pair_dup(server, cp)); + } + + if (!cs || !cf_pair_find(cs, "secret")) { + cp = cf_pair_find(client, "secret"); + if (cp) cf_pair_add(server, cp); + } + + if (!cs || !cf_pair_find(cs, "src_ipaddr")) { + cp = cf_pair_find(client, "src_ipaddr"); + if (cp) cf_pair_add(server, cf_pair_dup(server, cp)); + } + + if (!cs || !(cp = cf_pair_find(cs, "type"))) { + cp = cf_pair_alloc(server, "type", "coa", T_OP_EQ, T_BARE_WORD, T_SINGLE_QUOTED_STRING); + if (cp) cf_pair_add(server, cf_pair_dup(server, cp)); + } else if (strcmp(cf_pair_value(cp), "coa") != 0) { + talloc_free(server); + cf_log_err_cs(server, "server.type must be \"coa\""); + return NULL; + } + + return server; +} + +static home_pool_t *server_pool_alloc(char const *name, home_pool_type_t type, + home_type_t server_type, int num_home_servers) +{ + home_pool_t *pool; + + pool = rad_malloc(sizeof(*pool) + (sizeof(pool->servers[0]) * num_home_servers)); + if (!pool) return NULL; /* just for pairanoia */ + + memset(pool, 0, sizeof(*pool) + (sizeof(pool->servers[0]) * num_home_servers)); + + pool->name = name; + pool->type = type; + pool->server_type = server_type; + pool->num_home_servers = num_home_servers; + + return pool; +} + +/* + * Ensure any home_server clauses in a home_server_pool section reference + * defined home servers, which should already have been created, regardless + * of where they appear in the configuration. + */ +static int pool_check_home_server(UNUSED realm_config_t *rc, CONF_PAIR *cp, + char const *name, home_type_t server_type, + home_server_t **phome) +{ + home_server_t myhome, *home; + + if (!name) { + cf_log_err_cp(cp, + "No value given for home_server"); + return 0; + } + + myhome.name = name; + myhome.type = server_type; + home = rbtree_finddata(home_servers_byname, &myhome); + if (home) { + *phome = home; + return 1; + } + + switch (server_type) { + case HOME_TYPE_AUTH: + case HOME_TYPE_ACCT: + myhome.type = HOME_TYPE_AUTH_ACCT; + home = rbtree_finddata(home_servers_byname, &myhome); +#ifdef WITH_COA_TUNNEL + if (!home) { + myhome.type = HOME_TYPE_AUTH_COA; + home = rbtree_finddata(home_servers_byname, &myhome); + if(!home) { + myhome.type = HOME_TYPE_AUTH_ACCT_COA; + home = rbtree_finddata(home_servers_byname, &myhome); + } + } +#endif + if (home) { + *phome = home; + return 1; + } + break; + + default: + break; + } + + cf_log_err_cp(cp, "Unknown home_server \"%s\".", name); + return 0; +} + + +#ifndef HAVE_PTHREAD_H +void realm_pool_free(home_pool_t *pool) +{ + if (!event_loop_started) return; + if (!realm_config->dynamic) return; + + talloc_free(pool); +} +#else /* HAVE_PTHREAD_H */ +typedef struct pool_list_t pool_list_t; + +struct pool_list_t { + pool_list_t *next; + home_pool_t *pool; + time_t when; +}; + +static bool pool_free_init = false; +static pthread_mutex_t pool_free_mutex; +static pool_list_t *pool_list = NULL; + +void realm_pool_free(home_pool_t *pool) +{ + int i; + time_t now; + pool_list_t *this, **last; + + if (!event_loop_started) return; + if (!realm_config->dynamic) return; + + if (pool) { + /* + * Double-check that the realm wasn't loaded from the + * configuration files. + */ + for (i = 0; i < pool->num_home_servers; i++) { + if (pool->servers[i]->cs) { + rad_assert(0 == 1); + return; + } + } + } + + if (!pool_free_init) { + pthread_mutex_init(&pool_free_mutex, NULL); + pool_free_init = true; + } + + /* + * Ensure only one caller at a time is freeing a pool. + */ + pthread_mutex_lock(&pool_free_mutex); + + /* + * Free all of the pools. + */ + if (!pool) { + while ((this = pool_list) != NULL) { + pool_list = this->next; + talloc_free(this->pool); + talloc_free(this); + } + pthread_mutex_unlock(&pool_free_mutex); + return; + } + + now = time(NULL); + + /* + * Free the oldest pool(s) + */ + while ((this = pool_list) != NULL) { + if (this->when > now) break; + + pool_list = this->next; + talloc_free(this->pool); + talloc_free(this); + } + + /* + * Add this pool to the end of the list. + */ + for (last = &pool_list; + *last != NULL; + last = &((*last))->next) { + /* do nothing */ + } + + *last = this = talloc(NULL, pool_list_t); + if (!this) { + talloc_free(pool); /* hope for the best */ + pthread_mutex_unlock(&pool_free_mutex); + return; + } + + this->next = NULL; + this->when = now + 300; + this->pool = pool; + pthread_mutex_unlock(&pool_free_mutex); +} +#endif /* HAVE_PTHREAD_H */ + +int realm_pool_add(home_pool_t *pool, CONF_SECTION *cs) +{ + home_pool_t *old; + + old = rbtree_finddata(home_pools_byname, pool); + if (old) { + cf_log_err_cs(cs, "Cannot add duplicate home server %s, original is at %s[%d]", pool->name, + cf_section_filename(old->cs), cf_section_lineno(old->cs)); + return 0; + } + + /* + * The structs aren't mutex protected. Refuse to destroy + * the server. + */ + if (event_loop_started && !realm_config->dynamic) { + DEBUG("Must set \"dynamic = true\" in proxy.conf"); + return 0; + } + + if (!rbtree_insert(home_pools_byname, pool)) { + rad_assert("Internal sanity check failed" == NULL); + return 0; + } + + return 1; +} + +static int server_pool_add(realm_config_t *rc, + CONF_SECTION *cs, home_type_t server_type, bool do_print) +{ + char const *name2; + home_pool_t *pool = NULL; + char const *value; + CONF_PAIR *cp; + int num_home_servers; + home_server_t *home; + + name2 = cf_section_name1(cs); + if (!name2 || ((strcasecmp(name2, "server_pool") != 0) && + (strcasecmp(name2, "home_server_pool") != 0))) { + cf_log_err_cs(cs, + "Section is not a home_server_pool"); + return 0; + } + + name2 = cf_section_name2(cs); + if (!name2) { + cf_log_err_cs(cs, + "Server pool section is missing a name"); + return 0; + } + + /* + * Count the home servers and initalize them. + */ + num_home_servers = 0; + for (cp = cf_pair_find(cs, "home_server"); + cp != NULL; + cp = cf_pair_find_next(cs, cp, "home_server")) { + num_home_servers++; + + if (!pool_check_home_server(rc, cp, cf_pair_value(cp), + server_type, &home)) { + return 0; + } + } + + if (num_home_servers == 0) { + cf_log_err_cs(cs, + "No home servers defined in pool %s", + name2); + goto error; + } + + pool = server_pool_alloc(name2, HOME_POOL_FAIL_OVER, server_type, + num_home_servers); + if (!pool) { + cf_log_err_cs(cs, "Failed allocating memory for pool"); + goto error; + } + pool->cs = cs; + + + /* + * Fallback servers must be defined, and must be + * virtual servers. + */ + cp = cf_pair_find(cs, "fallback"); + if (cp) { +#ifdef WITH_COA + if (server_type == HOME_TYPE_COA) { + cf_log_err_cs(cs, "Home server pools of type \"coa\" cannot have a fallback virtual server"); + goto error; + } +#endif + + if (!pool_check_home_server(rc, cp, cf_pair_value(cp), server_type, &pool->fallback)) { + goto error; + } + + if (!pool->fallback->virtual_server) { + cf_log_err_cs(cs, "Fallback home_server %s does NOT contain a virtual_server directive", + pool->fallback->log_name); + goto error; + } + } + + if (do_print) cf_log_info(cs, " home_server_pool %s {", name2); + + cp = cf_pair_find(cs, "type"); + if (cp) { + static FR_NAME_NUMBER pool_types[] = { + { "load-balance", HOME_POOL_LOAD_BALANCE }, + + { "fail-over", HOME_POOL_FAIL_OVER }, + { "fail_over", HOME_POOL_FAIL_OVER }, + + { "round-robin", HOME_POOL_LOAD_BALANCE }, + { "round_robin", HOME_POOL_LOAD_BALANCE }, + + { "client-balance", HOME_POOL_CLIENT_BALANCE }, + { "client-port-balance", HOME_POOL_CLIENT_PORT_BALANCE }, + { "keyed-balance", HOME_POOL_KEYED_BALANCE }, + { NULL, 0 } + }; + + value = cf_pair_value(cp); + if (!value) { + cf_log_err_cp(cp, + "No value given for type"); + goto error; + } + + pool->type = fr_str2int(pool_types, value, 0); + if (!pool->type) { + cf_log_err_cp(cp, + "Unknown type \"%s\".", + value); + goto error; + } + + if (do_print) cf_log_info(cs, "\ttype = %s", value); + } + + cp = cf_pair_find(cs, "virtual_server"); + if (cp) { + pool->virtual_server = cf_pair_value(cp); + if (!pool->virtual_server) { + cf_log_err_cp(cp, "No value given for virtual_server"); + goto error; + } + + if (do_print) { + cf_log_info(cs, "\tvirtual_server = %s", pool->virtual_server); + } + + if (!cf_section_sub_find_name2(rc->cs, "server", pool->virtual_server)) { + cf_log_err_cp(cp, "No such server %s", pool->virtual_server); + goto error; + } + + } + + num_home_servers = 0; + for (cp = cf_pair_find(cs, "home_server"); + cp != NULL; + cp = cf_pair_find_next(cs, cp, "home_server")) { + home_server_t myhome; + + value = cf_pair_value(cp); + + memset(&myhome, 0, sizeof(myhome)); + myhome.name = value; + myhome.type = server_type; + + home = rbtree_finddata(home_servers_byname, &myhome); + if (!home) { + switch (server_type) { + case HOME_TYPE_AUTH: + case HOME_TYPE_ACCT: + myhome.type = HOME_TYPE_AUTH_ACCT; + home = rbtree_finddata(home_servers_byname, &myhome); +#ifdef WITH_COA_TUNNEL + if (!home) { + myhome.type = HOME_TYPE_AUTH_COA; + home = rbtree_finddata(home_servers_byname, &myhome); + if (!home) { + myhome.type = HOME_TYPE_AUTH_ACCT_COA; + home = rbtree_finddata(home_servers_byname, &myhome); + } + } +#endif + break; + + default: + break; + } + } + + if (!home) { + ERROR("Failed to find home server %s", value); + goto error; + } + + if (do_print) cf_log_info(cs, "\thome_server = %s", home->name); + pool->servers[num_home_servers++] = home; + } /* loop over home_server's */ + + if (pool->fallback && do_print) { + cf_log_info(cs, "\tfallback = %s", pool->fallback->name); + } + + if (!realm_pool_add(pool, cs)) goto error; + + if (do_print) cf_log_info(cs, " }"); + + cf_data_add(cs, "home_server_pool", pool, free); + + rad_assert(pool->server_type != 0); + + return 1; + + error: + if (do_print) cf_log_info(cs, " }"); + free(pool); + return 0; +} +#endif + +static int old_server_add(realm_config_t *rc, CONF_SECTION *cs, + char const *realm, + char const *name, char const *secret, + home_pool_type_t ldflag, home_pool_t **pool_p, + home_type_t type, char const *server) +{ +#ifdef WITH_PROXY + int i, insert_point, num_home_servers; + home_server_t myhome, *home; + home_pool_t mypool, *pool; + CONF_SECTION *subcs; +#else + (void) rc; /* -Wunused */ + (void) realm; + (void) secret; + (void) ldflag; + (void) type; + (void) server; +#endif + + /* + * LOCAL realms get sanity checked, and nothing else happens. + */ + if (strcmp(name, "LOCAL") == 0) { + if (*pool_p) { + cf_log_err_cs(cs, "Realm \"%s\" cannot be both LOCAL and remote", name); + return 0; + } + return 1; + } + +#ifndef WITH_PROXY + return 0; /* Not proxying. Can't do non-LOCAL realms */ + +#else + mypool.name = realm; + mypool.server_type = type; + pool = rbtree_finddata(home_pools_byname, &mypool); + if (pool) { + if (pool->type != ldflag) { + cf_log_err_cs(cs, "Inconsistent ldflag for server pool \"%s\"", name); + return 0; + } + + if (pool->server_type != type) { + cf_log_err_cs(cs, "Inconsistent home server type for server pool \"%s\"", name); + return 0; + } + } + + myhome.name = name; + myhome.type = type; + home = rbtree_finddata(home_servers_byname, &myhome); + if (home) { + WARN("Please use pools instead of authhost and accthost"); + + if (secret && (strcmp(home->secret, secret) != 0)) { + cf_log_err_cs(cs, "Inconsistent shared secret for home server \"%s\"", name); + return 0; + } + + if (home->type != type) { + cf_log_err_cs(cs, "Inconsistent type for home server \"%s\"", name); + return 0; + } + + /* + * Don't check for duplicate home servers. If + * the user specifies that, well, they can do it. + * + * Allowing duplicates means that all of the + * realm->server[] entries are filled, which is + * what the rest of the code assumes. + */ + } + + /* + * If we do have a pool, check that there is room to + * insert the home server we've found, or the one that we + * create here. + * + * Note that we insert it into the LAST available + * position, in order to maintain the same order as in + * the configuration files. + */ + insert_point = -1; + if (pool) { + for (i = pool->num_home_servers - 1; i >= 0; i--) { + if (pool->servers[i]) break; + + if (!pool->servers[i]) { + insert_point = i; + } + } + + if (insert_point < 0) { + cf_log_err_cs(cs, "No room in pool to add home server \"%s\". Please update the realm configuration to use the new-style home servers and server pools.", name); + return 0; + } + } + + /* + * No home server, allocate one. + */ + if (!home) { + char const *p; + char *q; + + home = talloc_zero(rc, home_server_t); + home->name = name; + home->type = type; + home->secret = secret; + home->cs = cs; + home->proto = IPPROTO_UDP; + + p = strchr(name, ':'); + if (!p) { + if (type == HOME_TYPE_AUTH) { + home->port = PW_AUTH_UDP_PORT; + } else { + home->port = PW_ACCT_UDP_PORT; + } + + p = name; + q = NULL; + + } else if (p == name) { + cf_log_err_cs(cs, "Invalid hostname %s", name); + talloc_free(home); + return 0; + } else { + unsigned long port = strtoul(p + 1, NULL, 0); + if ((port == 0) || (port > 65535)) { + cf_log_err_cs(cs, "Invalid port %s", p + 1); + talloc_free(home); + return 0; + } + + home->port = (uint16_t)port; + q = talloc_array(home, char, (p - name) + 1); + memcpy(q, name, (p - name)); + q[p - name] = '\0'; + p = q; + } + + if (!server) { + if (ip_hton(&home->ipaddr, AF_UNSPEC, p, false) < 0) { + cf_log_err_cs(cs, + "Failed looking up hostname %s.", + p); + talloc_free(home); + talloc_free(q); + return 0; + } + home->src_ipaddr.af = home->ipaddr.af; + } else { + home->ipaddr.af = AF_UNSPEC; + home->virtual_server = server; + } + talloc_free(q); + + /* + * Use the old-style configuration. + */ + home->max_outstanding = 65535*16; + home->zombie_period = rc->retry_delay * rc->retry_count; + if (home->zombie_period < 2) home->zombie_period = 30; + home->response_window.tv_sec = home->zombie_period - 1; + home->response_window.tv_usec = 0; + + home->ping_check = HOME_PING_CHECK_NONE; + + home->revive_interval = rc->dead_time; + + if (rbtree_finddata(home_servers_byaddr, home)) { + cf_log_err_cs(cs, "Home server %s has the same IP address and/or port as another home server.", name); + talloc_free(home); + return 0; + } + + if (!rbtree_insert(home_servers_byname, home)) { + cf_log_err_cs(cs, "Internal error %d adding home server %s.", __LINE__, name); + talloc_free(home); + return 0; + } + + if (!rbtree_insert(home_servers_byaddr, home)) { + rbtree_deletebydata(home_servers_byname, home); + cf_log_err_cs(cs, "Internal error %d adding home server %s.", __LINE__, name); + talloc_free(home); + return 0; + } + +#ifdef WITH_STATS + home->number = home_server_max_number++; + if (!rbtree_insert(home_servers_bynumber, home)) { + rbtree_deletebydata(home_servers_byname, home); + if (home->ipaddr.af != AF_UNSPEC) { + rbtree_deletebydata(home_servers_byname, home); + } + cf_log_err_cs(cs, + "Internal error %d adding home server %s.", + __LINE__, name); + talloc_free(home); + return 0; + } +#endif + } + + /* + * We now have a home server, see if we can insert it + * into pre-existing pool. + */ + if (insert_point >= 0) { + rad_assert(pool != NULL); + pool->servers[insert_point] = home; + return 1; + } + + rad_assert(pool == NULL); + rad_assert(home != NULL); + + /* + * Count the old-style realms of this name. + */ + num_home_servers = 0; + for (subcs = cf_section_find_next(cs, NULL, "realm"); + subcs != NULL; + subcs = cf_section_find_next(cs, subcs, "realm")) { + char const *this = cf_section_name2(subcs); + + if (!this || (strcmp(this, realm) != 0)) continue; + num_home_servers++; + } + + if (num_home_servers == 0) { + cf_log_err_cs(cs, "Internal error counting pools for home server %s.", name); + talloc_free(home); + return 0; + } + + pool = server_pool_alloc(realm, ldflag, type, num_home_servers); + if (!pool) { + cf_log_err_cs(cs, "Out of memory"); + return 0; + } + + pool->cs = cs; + + pool->servers[0] = home; + + if (!rbtree_insert(home_pools_byname, pool)) { + rad_assert("Internal sanity check failed" == NULL); + return 0; + } + + *pool_p = pool; + + return 1; +#endif +} + +static int old_realm_config(realm_config_t *rc, CONF_SECTION *cs, REALM *r) +{ + char const *host; + char const *secret = NULL; + home_pool_type_t ldflag; + CONF_PAIR *cp; + + cp = cf_pair_find(cs, "ldflag"); + ldflag = HOME_POOL_FAIL_OVER; + if (cp) { + host = cf_pair_value(cp); + if (!host) { + cf_log_err_cp(cp, "No value specified for ldflag"); + return 0; + } + + if (strcasecmp(host, "fail_over") == 0) { + cf_log_info(cs, "\tldflag = fail_over"); + + } else if (strcasecmp(host, "round_robin") == 0) { + ldflag = HOME_POOL_LOAD_BALANCE; + cf_log_info(cs, "\tldflag = round_robin"); + + } else { + cf_log_err_cs(cs, "Unknown value \"%s\" for ldflag", host); + return 0; + } + } /* else don't print it. */ + + /* + * Allow old-style if it doesn't exist, or if it exists and + * it's LOCAL. + */ + cp = cf_pair_find(cs, "authhost"); + if (cp) { + host = cf_pair_value(cp); + if (!host) { + cf_log_err_cp(cp, "No value specified for authhost"); + return 0; + } + + if (strcmp(host, "LOCAL") != 0) { + cp = cf_pair_find(cs, "secret"); + if (!cp) { + cf_log_err_cs(cs, "No shared secret supplied for realm: %s", r->name); + return 0; + } + + secret = cf_pair_value(cp); + if (!secret) { + cf_log_err_cp(cp, "No value specified for secret"); + return 0; + } + } + + cf_log_info(cs, "\tauthhost = %s", host); + + if (!old_server_add(rc, cs, r->name, host, secret, ldflag, + &r->auth_pool, HOME_TYPE_AUTH, NULL)) { + return 0; + } + } + + cp = cf_pair_find(cs, "accthost"); + if (cp) { + host = cf_pair_value(cp); + if (!host) { + cf_log_err_cp(cp, "No value specified for accthost"); + return 0; + } + + /* + * Don't look for a secret again if it was found + * above. + */ + if ((strcmp(host, "LOCAL") != 0) && !secret) { + cp = cf_pair_find(cs, "secret"); + if (!cp) { + cf_log_err_cs(cs, "No shared secret supplied for realm: %s", r->name); + return 0; + } + + secret = cf_pair_value(cp); + if (!secret) { + cf_log_err_cp(cp, "No value specified for secret"); + return 0; + } + } + + cf_log_info(cs, "\taccthost = %s", host); + + if (!old_server_add(rc, cs, r->name, host, secret, ldflag, + &r->acct_pool, HOME_TYPE_ACCT, NULL)) { + return 0; + } + } + + cp = cf_pair_find(cs, "virtual_server"); + if (cp) { + host = cf_pair_value(cp); + if (!host) { + cf_log_err_cp(cp, "No value specified for virtual_server"); + return 0; + } + + cf_log_info(cs, "\tvirtual_server = %s", host); + + if (!old_server_add(rc, cs, r->name, host, "", ldflag, + &r->auth_pool, HOME_TYPE_AUTH, host)) { + return 0; + } + if (!old_server_add(rc, cs, r->name, host, "", ldflag, + &r->acct_pool, HOME_TYPE_ACCT, host)) { + return 0; + } + } + + if (secret) { + if (rad_debug_lvl <= 2) { + cf_log_info(cs, "\tsecret = <<< secret >>>"); + } else { + cf_log_info(cs, "\tsecret = %s", secret); + } + } + + return 1; + +} + + +#ifdef WITH_PROXY +static int add_pool_to_realm(realm_config_t *rc, CONF_SECTION *cs, + char const *name, home_pool_t **dest, + home_type_t server_type, bool do_print) +{ + home_pool_t mypool, *pool; + + mypool.name = name; + mypool.server_type = server_type; + + pool = rbtree_finddata(home_pools_byname, &mypool); + if (!pool) { + CONF_SECTION *pool_cs; + + pool_cs = cf_section_sub_find_name2(rc->cs, + "home_server_pool", + name); + if (!pool_cs) { + pool_cs = cf_section_sub_find_name2(rc->cs, + "server_pool", + name); + } + if (!pool_cs) { + cf_log_err_cs(cs, "Failed to find home_server_pool \"%s\"", name); + return 0; + } + + if (!server_pool_add(rc, pool_cs, server_type, do_print)) { + return 0; + } + + pool = rbtree_finddata(home_pools_byname, &mypool); + if (!pool) { + ERROR("Internal sanity check failed in add_pool_to_realm"); + return 0; + } + } + + if (pool->server_type != server_type) { + cf_log_err_cs(cs, "Incompatible home_server_pool \"%s\" (mixed auth_pool / acct_pool)", name); + return 0; + } + + *dest = pool; + + return 1; +} +#endif + + +static int realm_add(realm_config_t *rc, CONF_SECTION *cs) +{ + char const *name2; + REALM *r = NULL; + CONF_PAIR *cp; +#ifdef WITH_PROXY + home_pool_t *auth_pool, *acct_pool; + char const *auth_pool_name, *acct_pool_name; +#ifdef WITH_COA + char const *coa_pool_name; + home_pool_t *coa_pool; +#endif +#endif + + name2 = cf_section_name1(cs); + if (!name2 || (strcasecmp(name2, "realm") != 0)) { + cf_log_err_cs(cs, "Section is not a realm"); + return 0; + } + + name2 = cf_section_name2(cs); + if (!name2) { + cf_log_err_cs(cs, "Realm section is missing the realm name"); + return 0; + } + +#ifdef WITH_PROXY + auth_pool = acct_pool = NULL; + auth_pool_name = acct_pool_name = NULL; +#ifdef WITH_COA + coa_pool = NULL; + coa_pool_name = NULL; +#endif + + /* + * Prefer new configuration to old one. + */ + cp = cf_pair_find(cs, "pool"); + if (!cp) cp = cf_pair_find(cs, "home_server_pool"); + if (cp) auth_pool_name = cf_pair_value(cp); + if (cp && auth_pool_name) { + acct_pool_name = auth_pool_name; + if (!add_pool_to_realm(rc, cs, + auth_pool_name, &auth_pool, + HOME_TYPE_AUTH, 1)) { + return 0; + } + if (!add_pool_to_realm(rc, cs, + auth_pool_name, &acct_pool, + HOME_TYPE_ACCT, 0)) { + return 0; + } + } + + cp = cf_pair_find(cs, "auth_pool"); + if (cp) auth_pool_name = cf_pair_value(cp); + if (cp && auth_pool_name) { + if (auth_pool) { + cf_log_err_cs(cs, "Cannot use \"pool\" and \"auth_pool\" at the same time"); + return 0; + } + if (!add_pool_to_realm(rc, cs, + auth_pool_name, &auth_pool, + HOME_TYPE_AUTH, 1)) { + return 0; + } + } + + cp = cf_pair_find(cs, "acct_pool"); + if (cp) acct_pool_name = cf_pair_value(cp); + if (cp && acct_pool_name) { + bool do_print = true; + + if (acct_pool) { + cf_log_err_cs(cs, "Cannot use \"pool\" and \"acct_pool\" at the same time"); + return 0; + } + + if (!auth_pool || + (auth_pool_name && + (strcmp(auth_pool_name, acct_pool_name) != 0))) { + do_print = true; + } + + if (!add_pool_to_realm(rc, cs, + acct_pool_name, &acct_pool, + HOME_TYPE_ACCT, do_print)) { + return 0; + } + } + +#ifdef WITH_COA + cp = cf_pair_find(cs, "coa_pool"); + if (cp) coa_pool_name = cf_pair_value(cp); + if (cp && coa_pool_name) { + bool do_print = true; + + if (!add_pool_to_realm(rc, cs, + coa_pool_name, &coa_pool, + HOME_TYPE_COA, do_print)) { + return 0; + } + } +#endif +#endif + + cf_log_info(cs, " realm %s {", name2); + +#ifdef WITH_PROXY + /* + * The realm MAY already exist if it's an old-style realm. + * In that case, merge the old-style realm with this one. + */ + r = realm_find2(name2); + if (r && (strcmp(r->name, name2) == 0)) { + if (cf_pair_find(cs, "auth_pool") || + cf_pair_find(cs, "acct_pool")) { + cf_log_err_cs(cs, "Duplicate realm \"%s\"", name2); + goto error; + } + + if (!old_realm_config(rc, cs, r)) { + goto error; + } + + cf_log_info(cs, " } # realm %s", name2); + return 1; + } +#endif + + r = talloc_zero(rc, REALM); + r->name = name2; + r->strip_realm = true; +#ifdef WITH_PROXY + r->auth_pool = auth_pool; + r->acct_pool = acct_pool; +#ifdef WITH_COA + r->coa_pool = coa_pool; +#endif + + if (auth_pool_name && + (auth_pool_name == acct_pool_name)) { /* yes, ptr comparison */ + cf_log_info(cs, "\tpool = %s", auth_pool_name); + } else { + if (auth_pool_name) cf_log_info(cs, "\tauth_pool = %s", auth_pool_name); + if (acct_pool_name) cf_log_info(cs, "\tacct_pool = %s", acct_pool_name); +#ifdef WITH_COA + if (coa_pool_name) cf_log_info(cs, "\tcoa_pool = %s", coa_pool_name); +#endif + } +#endif + + cp = cf_pair_find(cs, "nostrip"); + if (cp && (cf_pair_value(cp) == NULL)) { + r->strip_realm = false; + cf_log_info(cs, "\tnostrip"); + } + + /* + * We're a new-style realm. Complain if we see the old + * directives. + */ + if (r->auth_pool || r->acct_pool) { + if (((cp = cf_pair_find(cs, "authhost")) != NULL) || + ((cp = cf_pair_find(cs, "accthost")) != NULL) || + ((cp = cf_pair_find(cs, "secret")) != NULL) || + ((cp = cf_pair_find(cs, "ldflag")) != NULL)) { + WARN("Ignoring old-style configuration entry \"%s\" in realm \"%s\"", cf_pair_attr(cp), r->name); + } + + + /* + * The realm MAY be an old-style realm, as there + * was no auth_pool or acct_pool. Double-check + * it, just to be safe. + */ + } else if (!old_realm_config(rc, cs, r)) { + goto error; + } + + if (!realm_realm_add(r, cs)) { + goto error; + } + + cf_log_info(cs, " }"); + + return 1; + + error: + cf_log_info(cs, " } # realm %s", name2); + return 0; +} + +#ifdef HAVE_REGEX +int realm_realm_add(REALM *r, CONF_SECTION *cs) +#else +int realm_realm_add(REALM *r, UNUSED CONF_SECTION *cs) +#endif +{ + /* + * The structs aren't mutex protected. Refuse to destroy + * the server. + */ + if (event_loop_started && !realm_config->dynamic) { + DEBUG("Must set \"dynamic = true\" in proxy.conf"); + return 0; + } + +#ifdef HAVE_REGEX + /* + * It's a regex. Sanity check it, and add it to a + * separate list. + */ + if (r->name[0] == '~') { + ssize_t slen; + realm_regex_t *rr, **last; + + rr = talloc(r, realm_regex_t); + + /* + * Include substring matches. + */ + slen = regex_compile(rr, &rr->preg, r->name + 1, strlen(r->name) - 1, true, false, false, false); + if (slen <= 0) { + char *spaces, *text; + + fr_canonicalize_error(r, &spaces, &text, slen, r->name + 1); + + cf_log_err_cs(cs, "Invalid regular expression:"); + cf_log_err_cs(cs, "%s", text); + cf_log_err_cs(cs, "%s^ %s", spaces, fr_strerror()); + + talloc_free(spaces); + talloc_free(text); + talloc_free(rr); + + return 0; + } + + last = &realms_regex; + while (*last) last = &((*last)->next); /* O(N^2)... sue me. */ + + rr->realm = r; + rr->next = NULL; + + *last = rr; + return 1; + } +#endif + + if (!rbtree_insert(realms_byname, r)) { + rad_assert("Internal sanity check failed" == NULL); + return 0; + } + + return 1; +} + +#ifdef WITH_COA + +static int pool_peek_type(CONF_SECTION *config, CONF_SECTION *cs) +{ + int home; + char const *name, *type; + CONF_PAIR *cp; + CONF_SECTION *server_cs; + + cp = cf_pair_find(cs, "home_server"); + if (!cp) { + cf_log_err_cs(cs, "Pool does not contain a \"home_server\" entry"); + return HOME_TYPE_INVALID; + } + + name = cf_pair_value(cp); + if (!name) { + cf_log_err_cp(cp, "home_server entry does not reference a home server"); + return HOME_TYPE_INVALID; + } + + server_cs = cf_section_sub_find_name2(config, "home_server", name); + if (!server_cs) { + cf_log_err_cp(cp, "home_server \"%s\" does not exist", name); + return HOME_TYPE_INVALID; + } + + cp = cf_pair_find(server_cs, "type"); + if (!cp) { + cf_log_err_cs(server_cs, "home_server %s does not contain a \"type\" entry", name); + return HOME_TYPE_INVALID; + } + + type = cf_pair_value(cp); + if (!type) { + cf_log_err_cs(server_cs, "home_server %s contains an empty \"type\" entry", name); + return HOME_TYPE_INVALID; + } + + home = fr_str2int(home_server_types, type, HOME_TYPE_INVALID); + if (home == HOME_TYPE_INVALID) { + cf_log_err_cs(server_cs, "home_server %s contains an invalid \"type\" entry of value \"%s\"", name, type); + return HOME_TYPE_INVALID; + } + + return home; /* 'cause we miss it so much */ +} +#endif + +int realms_init(CONF_SECTION *config) +{ + CONF_SECTION *cs; + int flags = 0; +#ifdef WITH_PROXY + CONF_SECTION *server_cs; +#endif + realm_config_t *rc; + + if (event_loop_started) return 1; + + rc = talloc_zero(NULL, realm_config_t); + rc->cs = config; + +#ifdef WITH_PROXY + cs = cf_subsection_find_next(config, NULL, "proxy"); + if (cs) { + if (cf_section_parse(cs, rc, proxy_config) < 0) { + ERROR("Failed parsing proxy section"); + goto error; + } + } else { + rc->dead_time = DEAD_TIME; + rc->retry_count = RETRY_COUNT; + rc->retry_delay = RETRY_DELAY; + rc->fallback = false; + rc->dynamic = false; + rc->wake_all_if_all_dead= 0; + } + + if (rc->dynamic) { + flags = RBTREE_FLAG_LOCK; + } + + home_servers_byaddr = rbtree_create(NULL, home_server_addr_cmp, home_server_free, flags); + if (!home_servers_byaddr) goto error; + + home_servers_byname = rbtree_create(NULL, home_server_name_cmp, NULL, flags); + if (!home_servers_byname) goto error; + +#ifdef WITH_STATS + home_servers_bynumber = rbtree_create(NULL, home_server_number_cmp, NULL, flags); + if (!home_servers_bynumber) goto error; +#endif + + home_pools_byname = rbtree_create(NULL, home_pool_name_cmp, NULL, flags); + if (!home_pools_byname) goto error; + + for (cs = cf_subsection_find_next(config, NULL, "home_server"); + cs != NULL; + cs = cf_subsection_find_next(config, cs, "home_server")) { + home_server_t *home; + + home = home_server_afrom_cs(rc, rc, cs); + if (!home) goto error; + if (!realm_home_server_add(home)) goto error; + } + + /* + * Loop over virtual servers to find home servers which + * are defined in them. + */ + for (server_cs = cf_subsection_find_next(config, NULL, "server"); + server_cs != NULL; + server_cs = cf_subsection_find_next(config, server_cs, "server")) { + for (cs = cf_subsection_find_next(server_cs, NULL, "home_server"); + cs != NULL; + cs = cf_subsection_find_next(server_cs, cs, "home_server")) { + home_server_t *home; + + home = home_server_afrom_cs(rc, rc, cs); + if (!home) goto error; + if (!realm_home_server_add(home)) goto error; + } + } +#endif + + /* + * Now create the realms, which point to the home servers + * and home server pools. + */ + realms_byname = rbtree_create(NULL, realm_name_cmp, NULL, flags); + if (!realms_byname) goto error; + + for (cs = cf_subsection_find_next(config, NULL, "realm"); + cs != NULL; + cs = cf_subsection_find_next(config, cs, "realm")) { + if (!realm_add(rc, cs)) { + error: + realms_free(); + /* + * Must be called after realms_free as home_servers + * parented by rc are in trees freed by realms_free() + */ + talloc_free(rc); + return 0; + } + } + +#ifdef WITH_COA + /* + * CoA pools aren't necessarily tied to realms. + */ + for (cs = cf_subsection_find_next(config, NULL, "home_server_pool"); + cs != NULL; + cs = cf_subsection_find_next(config, cs, "home_server_pool")) { + int type; + + /* + * Pool was already loaded. + */ + if (cf_data_find(cs, "home_server_pool")) continue; + + type = pool_peek_type(config, cs); + if (type == HOME_TYPE_INVALID) goto error; + if (!server_pool_add(rc, cs, type, true)) goto error; + } +#endif + +#ifdef WITH_PROXY + xlat_register("home_server", xlat_home_server, NULL, NULL); + xlat_register("home_server_pool", xlat_server_pool, NULL, NULL); + xlat_register("home_server_dynamic", xlat_home_server_dynamic, NULL, NULL); +#endif + + realm_config = rc; + +#ifdef HAVE_DIRENT_H + if (!rc->dynamic) { + if (rc->directory) { + WARN("Ignoring 'directory' as dynamic home servers were not configured."); + } + } else { + DIR *dir; + struct dirent *dp; + + if (!rc->directory) { + WARN("Ignoring \"dynamic = true\" due to not set \"directory\" in proxy.conf"); + return 1; + } + + DEBUG2("including files in directory %s", rc->directory); + + dir = opendir(rc->directory); + if (!dir) { + cf_log_err_cs(config, "Error reading directory %s: %s", + rc->directory, fr_syserror(errno)); + goto error; + } + + /* + * Read the directory, ignoring "." files. + */ + while ((dp = readdir(dir)) != NULL) { + char const *p; + char conf_file[PATH_MAX]; + + if (dp->d_name[0] == '.') continue; + + /* + * Skip the TLS configuration. + */ + if (strcmp(dp->d_name, "tls.conf") == 0) continue; + + /* + * Check for valid characters + */ + for (p = dp->d_name; *p != '\0'; p++) { + if (isalpha((uint8_t)*p) || + isdigit((uint8_t)*p) || + (*p == '-') || + (*p == '_') || + (*p == '.')) continue; + break; + } + if (*p != '\0') continue; + + snprintf(conf_file, sizeof(conf_file), "%s/%s", rc->directory, dp->d_name); + if (home_server_afrom_file(conf_file) < 0) { + ERROR("Failed reading home_server from %s - %s", + conf_file, fr_strerror()); + closedir(dir); + goto error; + } + } + closedir(dir); + } +#endif + + return 1; +} + +/* + * Find a realm where "name" might be the regex. + */ +REALM *realm_find2(char const *name) +{ + REALM myrealm; + REALM *realm; + + if (!name) name = "NULL"; + + myrealm.name = name; + realm = rbtree_finddata(realms_byname, &myrealm); + if (realm) return realm; + +#ifdef HAVE_REGEX + if (realms_regex) { + realm_regex_t *this; + + for (this = realms_regex; this != NULL; this = this->next) { + if (strcmp(this->realm->name, name) == 0) { + return this->realm; + } + } + } +#endif + + /* + * Couldn't find a realm. Look for DEFAULT. + */ + myrealm.name = "DEFAULT"; + return rbtree_finddata(realms_byname, &myrealm); +} + + +/* + * Find a realm in the REALM list. + */ +REALM *realm_find(char const *name) +{ + REALM myrealm; + REALM *realm; + + if (!name) name = "NULL"; + + myrealm.name = name; + realm = rbtree_finddata(realms_byname, &myrealm); + if (realm) return realm; + +#ifdef HAVE_REGEX + if (realms_regex) { + realm_regex_t *this; + + for (this = realms_regex; + this != NULL; + this = this->next) { + int compare; + + compare = regex_exec(this->preg, name, strlen(name), NULL, NULL); + if (compare < 0) { + ERROR("Failed performing realm comparison: %s", fr_strerror()); + return NULL; + } + if (compare == 1) return this->realm; + } + } +#endif + + /* + * Couldn't find a realm. Look for DEFAULT. + */ + myrealm.name = "DEFAULT"; + return rbtree_finddata(realms_byname, &myrealm); +} + + +#ifdef WITH_PROXY + +/* + * Allocate the proxy list if it doesn't already exist, and copy request + * VPs into it. Setup src/dst IP addresses based on home server, and + * calculate and add the message-authenticator. + * + * This is a distinct function from home_server_ldb, as not all home_server_t + * lookups result in the *CURRENT* request being proxied, + * as in rlm_replicate, and this may trigger asserts elsewhere in the + * server. + */ +void home_server_update_request(home_server_t *home, REQUEST *request) +{ + + /* + * Allocate the proxy packet, only if it wasn't + * already allocated by a module. This check is + * mainly to support the proxying of EAP-TTLS and + * EAP-PEAP tunneled requests. + * + * In those cases, the EAP module creates a + * "fake" request, and recursively passes it + * through the authentication stage of the + * server. The module then checks if the request + * was supposed to be proxied, and if so, creates + * a proxy packet from the TUNNELED request, and + * not from the EAP request outside of the + * tunnel. + * + * The proxy then works like normal, except that + * the response packet is "eaten" by the EAP + * module, and encapsulated into an EAP packet. + */ + if (!request->proxy) { + request->proxy = rad_alloc(request, true); + if (!request->proxy) { + ERROR("no memory"); + fr_exit(1); + } + + /* + * Copy the request, then look up name + * and plain-text password in the copy. + * + * Note that the User-Name attribute is + * the *original* as sent over by the + * client. The Stripped-User-Name + * attribute is the one hacked through + * the 'hints' file. + */ + request->proxy->vps = fr_pair_list_copy(request->proxy, + request->packet->vps); + } + + /* + * Update the various fields as appropriate. + */ + request->proxy->src_ipaddr = home->src_ipaddr; + request->proxy->src_port = 0; + request->proxy->dst_ipaddr = home->ipaddr; + request->proxy->dst_port = home->port; +#ifdef WITH_TCP + request->proxy->proto = home->proto; +#endif + request->home_server = home; + + /* + * Access-Requests have a Message-Authenticator added, + * unless one already exists. + */ + if ((request->packet->code == PW_CODE_ACCESS_REQUEST) && +#ifdef WITH_RADIUSV11 + !request->proxy->radiusv11 && +#endif + !fr_pair_find_by_num(request->proxy->vps, PW_MESSAGE_AUTHENTICATOR, 0, TAG_ANY)) { + fr_pair_make(request->proxy, &request->proxy->vps, + "Message-Authenticator", "0x00", + T_OP_SET); + } +} + +home_server_t *home_server_ldb(char const *realmname, + home_pool_t *pool, REQUEST *request) +{ + int start; + int count; + home_server_t *found = NULL; + home_server_t *zombie = NULL; + VALUE_PAIR *vp; + uint32_t hash; + + /* + * Determine how to pick choose the home server. + */ + switch (pool->type) { + + + /* + * For load-balancing by client IP address, we + * pick a home server by hashing the client IP. + * + * This isn't as even a load distribution as + * tracking the State attribute, but it's better + * than nothing. + */ + case HOME_POOL_CLIENT_BALANCE: + switch (request->packet->src_ipaddr.af) { + case AF_INET: + hash = fr_hash(&request->packet->src_ipaddr.ipaddr.ip4addr, + sizeof(request->packet->src_ipaddr.ipaddr.ip4addr)); + break; + + case AF_INET6: + hash = fr_hash(&request->packet->src_ipaddr.ipaddr.ip6addr, + sizeof(request->packet->src_ipaddr.ipaddr.ip6addr)); + break; + + default: + hash = 0; + break; + } + start = hash % pool->num_home_servers; + break; + + case HOME_POOL_CLIENT_PORT_BALANCE: + switch (request->packet->src_ipaddr.af) { + case AF_INET: + hash = fr_hash(&request->packet->src_ipaddr.ipaddr.ip4addr, + sizeof(request->packet->src_ipaddr.ipaddr.ip4addr)); + break; + + case AF_INET6: + hash = fr_hash(&request->packet->src_ipaddr.ipaddr.ip6addr, + sizeof(request->packet->src_ipaddr.ipaddr.ip6addr)); + break; + + default: + hash = 0; + break; + } + hash = fr_hash_update(&request->packet->src_port, + sizeof(request->packet->src_port), hash); + start = hash % pool->num_home_servers; + break; + + case HOME_POOL_KEYED_BALANCE: + if ((vp = fr_pair_find_by_num(request->config, PW_LOAD_BALANCE_KEY, 0, TAG_ANY)) != NULL) { + hash = fr_hash(vp->vp_strvalue, vp->vp_length); + start = hash % pool->num_home_servers; + break; + } + /* FALL-THROUGH */ + + case HOME_POOL_LOAD_BALANCE: + case HOME_POOL_FAIL_OVER: + start = 0; + break; + + default: /* this shouldn't happen... */ + start = 0; + break; + + } + + /* + * Starting with the home server we chose, loop through + * all home servers. If the current one is dead, skip + * it. If it is too busy, skip it. + * + * Otherwise, use it. + */ + for (count = 0; count < pool->num_home_servers; count++) { + home_server_t *home = pool->servers[(start + count) % pool->num_home_servers]; + + if (!home) continue; + + /* + * Skip dead home servers. + * + * Home servers that are unknown, alive, or zombie + * are used for proxying. + */ + if (HOME_SERVER_IS_DEAD(home)) { + continue; + } + + /* + * This home server is too busy. Choose another one. + */ + if (home->currently_outstanding >= home->max_outstanding) { + continue; + } + +#ifdef WITH_DETAIL + /* + * We read the packet from a detail file, AND it + * came from this server. Don't re-proxy it + * there. + */ + if (request->listener && + (request->listener->type == RAD_LISTEN_DETAIL) && + (request->packet->code == PW_CODE_ACCOUNTING_REQUEST) && + (fr_ipaddr_cmp(&home->ipaddr, &request->packet->src_ipaddr) == 0)) { + continue; + } +#endif + + /* + * Default virtual: ignore homes tied to a + * virtual. + */ + if (!request->server && home->parent_server) { + continue; + } + + /* + * A virtual AND home is tied to virtual, + * ignore ones which don't match. + */ + if (request->server && home->parent_server && + strcmp(request->server, home->parent_server) != 0) { + continue; + } + + /* + * Allow request->server && !home->parent_server + * + * i.e. virtuals can proxy to globally defined + * homes. + */ + + /* + * It's zombie, so we remember the first zombie + * we find, but we don't mark it as a "live" + * server. + */ + if (home->state == HOME_STATE_ZOMBIE) { + if (!zombie) zombie = home; + continue; + } + + /* + * We've found the first "live" one. Use that. + */ + if (pool->type != HOME_POOL_LOAD_BALANCE) { + found = home; + break; + } + + /* + * Otherwise we're doing some kind of load balancing. + * If we haven't found one yet, pick this one. + */ + if (!found) { + found = home; + continue; + } + + RDEBUG3("PROXY %s %d\t%s %d", + found->log_name, found->currently_outstanding, + home->log_name, home->currently_outstanding); + + /* + * Prefer this server if it's less busy than the + * one we had previously found. + */ + if (home->currently_outstanding < found->currently_outstanding) { + RDEBUG3("PROXY Choosing %s: It's less busy than %s", + home->log_name, found->log_name); + found = home; + continue; + } + + /* + * Ignore servers which are busier than the one + * we found. + */ + if (home->currently_outstanding > found->currently_outstanding) { + RDEBUG3("PROXY Skipping %s: It's busier than %s", + home->log_name, found->log_name); + continue; + } + + /* + * From the list of servers which have the same + * load, choose one at random. + */ + if (((count + 1) * (fr_rand() & 0xffff)) < (uint32_t) 0x10000) { + found = home; + } + } /* loop over the home servers */ + + /* + * We have no live servers, BUT we have a zombie. Use + * the zombie as a last resort. + */ + if (!found && zombie) { + found = zombie; + zombie = NULL; + } + + /* + * There's a fallback if they're all dead. + */ + if (!found && pool->fallback) { + found = pool->fallback; + + WARN("Home server pool %s failing over to fallback %s", + pool->name, found->virtual_server); + if (pool->in_fallback) goto update_and_return; + + pool->in_fallback = true; + + /* + * Run the trigger once an hour saying that + * they're all dead. + */ + if ((pool->time_all_dead + 3600) < request->timestamp) { + pool->time_all_dead = request->timestamp; + exec_trigger(request, pool->cs, "home_server_pool.fallback", false); + } + } + + if (found) { + update_and_return: + if ((found != pool->fallback) && pool->in_fallback) { + pool->in_fallback = false; + exec_trigger(request, pool->cs, "home_server_pool.normal", false); + } + + return found; + } + + /* + * No live match found, and no fallback to the "DEFAULT" + * realm. We fix this by blindly marking all servers as + * "live". But only do it for ones that don't support + * "pings", as they will be marked live when they + * actually are live. + */ + if (!realm_config->fallback && + realm_config->wake_all_if_all_dead) { + for (count = 0; count < pool->num_home_servers; count++) { + home_server_t *home = pool->servers[count]; + + if (!home) continue; + + if (HOME_SERVER_IS_DEAD(home) && + (home->ping_check == HOME_PING_CHECK_NONE)) { + home->state = HOME_STATE_ALIVE; + home->response_timeouts = 0; + if (!found) found = home; + } + } + + if (found) goto update_and_return; + } + + /* + * Still nothing. Look up the DEFAULT realm, but only + * if we weren't looking up the NULL or DEFAULT realms. + */ + if (realm_config->fallback && + realmname && + (strcmp(realmname, "NULL") != 0) && + (strcmp(realmname, "DEFAULT") != 0)) { + REALM *rd = realm_find("DEFAULT"); + + if (!rd) return NULL; + + pool = NULL; + if (request->packet->code == PW_CODE_ACCESS_REQUEST) { + pool = rd->auth_pool; + + } else if (request->packet->code == PW_CODE_ACCOUNTING_REQUEST) { + pool = rd->acct_pool; + } + if (!pool) return NULL; + + RDEBUG2("PROXY - realm %s has no live home servers. Falling back to the DEFAULT realm.", realmname); + return home_server_ldb(rd->name, pool, request); + } + + /* + * Still haven't found anything. Oh well. + */ + return NULL; +} + + +home_server_t *home_server_find(fr_ipaddr_t *ipaddr, uint16_t port, +#ifndef WITH_TCP + UNUSED +#endif + int proto) +{ + home_server_t myhome; + + memset(&myhome, 0, sizeof(myhome)); + myhome.ipaddr = *ipaddr; + myhome.src_ipaddr.af = ipaddr->af; + myhome.port = port; +#ifdef WITH_TCP + myhome.proto = proto; +#else + myhome.proto = IPPROTO_UDP; +#endif + myhome.virtual_server = NULL; /* we're not called for internal proxying */ + + return rbtree_finddata(home_servers_byaddr, &myhome); +} + +home_server_t *home_server_find_bysrc(fr_ipaddr_t *ipaddr, uint16_t port, + int proto, + fr_ipaddr_t *src_ipaddr) +{ + home_server_t myhome; + + if (!src_ipaddr) return home_server_find(ipaddr, port, proto); + + if (src_ipaddr->af != ipaddr->af) return NULL; + + memset(&myhome, 0, sizeof(myhome)); + myhome.ipaddr = *ipaddr; + myhome.src_ipaddr = *src_ipaddr; + myhome.port = port; +#ifdef WITH_TCP + myhome.proto = proto; +#else + myhome.proto = IPPROTO_UDP; +#endif + myhome.virtual_server = NULL; /* we're not called for internal proxying */ + + return rbtree_finddata(home_servers_byaddr, &myhome); +} + +#ifdef WITH_COA +home_server_t *home_server_byname(char const *name, int type) +{ + home_server_t myhome; + + memset(&myhome, 0, sizeof(myhome)); + myhome.type = type; + myhome.name = name; + + return rbtree_finddata(home_servers_byname, &myhome); +} +#endif + +#ifdef WITH_STATS +home_server_t *home_server_bynumber(int number) +{ + home_server_t myhome; + + memset(&myhome, 0, sizeof(myhome)); + myhome.number = number; + myhome.virtual_server = NULL; /* we're not called for internal proxying */ + + return rbtree_finddata(home_servers_bynumber, &myhome); +} +#endif + +home_pool_t *home_pool_byname(char const *name, int type) +{ + home_pool_t mypool; + + memset(&mypool, 0, sizeof(mypool)); + mypool.name = name; + mypool.server_type = type; + return rbtree_finddata(home_pools_byname, &mypool); +} + +int home_server_afrom_file(char const *filename) +{ + CONF_SECTION *cs, *subcs; + char const *p; + home_server_t *home; + + if (!realm_config->dynamic) { + fr_strerror_printf("Must set \"dynamic = true\" in proxy.conf for dynamic home servers to work"); + return -1; + } + + cs = cf_section_alloc(NULL, "home", filename); + if (!cs) { + fr_strerror_printf("Failed allocating memory"); + return -1; + } + + if (cf_file_read(cs, filename) < 0) { + fr_strerror_printf("Failed reading file %s", filename); + error: + talloc_free(cs); + return -1; + } + + p = strrchr(filename, '/'); + if (p) { + p++; + } else { + p = filename; + } + + subcs = cf_section_sub_find_name2(cs, "home_server", p); + if (!subcs) { + fr_strerror_printf("No 'home_server %s' definition in the file.", p); + goto error; + } + + home = home_server_afrom_cs(realm_config, realm_config, subcs); + if (!home) { + fr_strerror_printf("Failed parsing configuration to a home_server structure"); + goto error; + } + + home->dynamic = true; + + if (home->virtual_server) { + fr_strerror_printf("Dynamic home_server '%s' cannot have 'server = %s' configuration item", p, home->virtual_server); + talloc_free(home); + goto error; + } + + if (home->dual) { + fr_strerror_printf("Dynamic home_server '%s' is missing 'type', or it is set to 'auth+acct'. Please specify 'type = auth' or 'type = acct', etc.", p); + talloc_free(home); + goto error; + } + +#ifdef COA_TUNNEL + if (home->recv_coa) { + fr_strerror_printf("Dynamic home_server '%s' cannot receive CoA requests'", p); + talloc_free(home); + goto error; + } +#endif + + if (!realm_home_server_add(home)) { + fr_strerror_printf("Failed adding home_server to the internal data structures"); + talloc_free(home); + goto error; + } + + return 0; +} + +int home_server_delete(char const *name, char const *type_name) +{ + home_server_t *home; + int type; + char const *p; + + if (!realm_config->dynamic) { + fr_strerror_printf("Must set 'dynamic' in proxy.conf for dynamic home servers to work"); + return -1; + } + + type = fr_str2int(home_server_types, type_name, HOME_TYPE_INVALID); + if (type == HOME_TYPE_INVALID) { + fr_strerror_printf("Unknown home_server type '%s'", type_name); + return -1; + } + + p = strrchr(name, '/'); + if (p) { + p++; + } else { + p = name; + } + + home = home_server_byname(p, type); + if (!home) { + fr_strerror_printf("Failed to find home_server %s", p); + return -1; + } + + if (!home->dynamic) { + fr_strerror_printf("Cannot delete static home_server %s", p); + return -1; + } + + (void) rbtree_deletebydata(home_servers_byname, home); + (void) rbtree_deletebydata(home_servers_byaddr, home); +#ifdef WITH_STATS + (void) rbtree_deletebydata(home_servers_bynumber, home); +#endif + + /* + * Leak home, and home->cs. Oh well. + */ + return 0; +} +#endif |