The FreeRADIUS server $Id: 15bac2a4c627c01d1aa2047687b3418955ac7f00 $
Loading...
Searching...
No Matches
master.c
Go to the documentation of this file.
1/*
2 * This program is free software; you can redistribute it and/or modify
3 * it under the terms of the GNU General Public License as published by
4 * the Free Software Foundation; either version 2 of the License, or
5 * (at your option) any later version.
6 *
7 * This program is distributed in the hope that it will be useful,
8 * but WITHOUT ANY WARRANTY; without even the implied warranty of
9 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10 * GNU General Public License for more details.
11 *
12 * You should have received a copy of the GNU General Public License
13 * along with this program; if not, write to the Free Software
14 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
15 */
16
17/**
18 * $Id: 167849437b807ddb67cb46e340f872765c7e256f $
19 * @file io/master.c
20 * @brief Master IO handler
21 *
22 * @copyright 2018 Alan DeKok (aland@freeradius.org)
23 */
24#include <freeradius-devel/io/listen.h>
25#include <freeradius-devel/io/master.h>
26
27#include <freeradius-devel/server/base.h>
28#include <freeradius-devel/server/module.h>
29#include <freeradius-devel/server/log.h>
30
31#include <freeradius-devel/util/debug.h>
32
33#include <freeradius-devel/util/misc.h>
34#include <freeradius-devel/util/syserror.h>
35
36typedef struct {
37 fr_event_list_t *el; //!< event list, for the master socket.
38 fr_network_t *nr; //!< network for the master socket
39
40 fr_trie_t *trie; //!< trie of clients
41 fr_heap_t *pending_clients; //!< heap of pending clients
42 fr_heap_t *alive_clients; //!< heap of active dynamic clients
43
44 fr_listen_t *listen; //!< The master IO path
45 fr_listen_t *child; //!< The child (app_io) IO path
46 fr_schedule_t *sc; //!< the scheduler
47
48 // @todo - count num_nak_clients, and num_nak_connections, too
49 uint32_t num_connections; //!< number of dynamic connections
50 uint32_t num_pending_packets; //!< number of pending packets
51 uint64_t client_id; //!< Unique client identifier.
52
53 struct {
54 fr_rate_limit_t accept_failed;
55 fr_rate_limit_t alloc_failed;
56 fr_rate_limit_t bad_type;
57 fr_rate_limit_t conn_alloc_failed;
58 fr_rate_limit_t max_connections;
59 fr_rate_limit_t queue_full;
60 fr_rate_limit_t repeat_nak;
61 fr_rate_limit_t too_many_pending;
62 fr_rate_limit_t tracking_failed;
63 fr_rate_limit_t unknown_client;
64 } rate_limit;
65} fr_io_thread_t;
66
67/** A saved packet
68 *
69 */
78
79
80/** Client states
81 *
82 */
83typedef enum {
84 PR_CLIENT_INVALID = 0,
85 PR_CLIENT_STATIC, //!< static / global clients
86 PR_CLIENT_NAK, //!< negative cache entry
87 PR_CLIENT_DYNAMIC, //!< dynamically defined client
88 PR_CLIENT_CONNECTED, //!< dynamically defined client in a connected socket
89 PR_CLIENT_PENDING, //!< dynamic client pending definition
90} fr_io_client_state_t;
91
92/*
93 * Dynamic clients are run through the normal src/process/foo state machine.
94 *
95 * request->async->packet_ctx is an fr_io_track_t
96 *
97 * track->dynamic is set to a non-zero value.
98 *
99 * The dynamic client code returns a buffer of 1 byte for a NAK.
100 *
101 * If the client creation is successful, then it does talloc(NULL, fr_client_t),
102 * fills out the structure, and sends the pointer in the buffer (8 bytes).
103 *
104 * This code will take over ownership of the structure, and
105 * create the dynamic client.
106 */
107
108typedef struct fr_io_connection_s fr_io_connection_t;
109
110/** Client definitions for master IO
111 *
112 */
113struct fr_io_client_s {
114 fr_io_connection_t *connection; //!< parent connection
115 fr_io_client_state_t state; //!< state of this client
116 fr_ipaddr_t src_ipaddr; //!< packets come from this address
117 fr_ipaddr_t network; //!< network for dynamic clients
118 fr_client_t *radclient; //!< old-style definition of this client
119
120 int packets; //!< number of packets using this client
121 fr_heap_index_t pending_id; //!< for pending clients
122 fr_heap_index_t alive_id; //!< for all clients
123
124 bool use_connected; //!< does this client allow connected sub-sockets?
125 bool ready_to_delete; //!< are we ready to delete this client?
126 bool in_trie; //!< is the client in the trie?
127
128 fr_io_instance_t const *inst; //!< parent instance for master IO handler
129 fr_io_thread_t *thread;
130 fr_timer_t *ev; //!< when we clean up the client
131 fr_rb_tree_t *table; //!< tracking table for packets
132
133 fr_heap_t *pending; //!< pending packets for this client
134 fr_hash_table_t *addresses; //!< list of src/dst addresses used by this client
135
136 pthread_mutex_t mutex; //!< for parent / child signaling
137 fr_hash_table_t *ht; //!< for tracking connected sockets
138};
139
140/** Track a connection
141 *
142 * This structure contains information about the connection,
143 * a pointer to the library instance so that we can clean up on exit,
144 * and the listener.
145 *
146 * It also points to a client structure which is for this connection,
147 * and only this connection.
148 *
149 * Finally, a pointer to the parent client, so that the child can
150 * tell the parent it's alive, and the parent can push packets to the
151 * child.
152 */
153struct fr_io_connection_s {
154 char const *name; //!< taken from proto_FOO_TRANSPORT
155 int packets; //!< number of packets using this connection
156 fr_io_address_t *address; //!< full information about the connection.
157 fr_listen_t *listen; //!< master listener for this socket
158 fr_listen_t *child; //!< child listener (app_io) for this socket
159 fr_io_client_t *client; //!< our local client (pending or connected).
160 fr_io_client_t *parent; //!< points to the parent client.
161 module_instance_t *mi; //!< for submodule
162
163 bool dead; //!< roundabout way to get the network side to close a socket
164 bool paused; //!< event filter doesn't like resuming something that isn't paused
165 bool in_parent_hash; //!< for tracking thread issues
166 fr_event_list_t *el; //!< event list for this connection
167 fr_network_t *nr; //!< network for this connection
168};
169
170static fr_event_update_t pause_read[] = {
171 FR_EVENT_SUSPEND(fr_event_io_func_t, read),
172 { 0 }
173};
174
175static fr_event_update_t resume_read[] = {
176 FR_EVENT_RESUME(fr_event_io_func_t, read),
177 { 0 }
178};
179
180static int track_free(fr_io_track_t *track)
181{
182 FR_TIMER_DELETE_RETURN(&track->ev);
183 talloc_free_children(track);
184
185 fr_assert(track->client->packets > 0);
186 track->client->packets--;
187
188 return 0;
189}
190
191static int track_dedup_free(fr_io_track_t *track)
192{
193 fr_assert(track->client->table != NULL);
194 fr_assert(fr_rb_find(track->client->table, track) != NULL);
195
196 if (!fr_rb_delete(track->client->table, track)) {
197 fr_assert(0);
198 }
199
200 return track_free(track);
201}
202
203/*
204 * Return negative numbers to put 'one' at the top of the heap.
205 * Return positive numbers to put 'two' at the top of the heap.
206 */
207static int8_t pending_packet_cmp(void const *one, void const *two)
208{
209 fr_io_pending_packet_t const *a = talloc_get_type_abort_const(one, fr_io_pending_packet_t);
210 fr_io_pending_packet_t const *b = talloc_get_type_abort_const(two, fr_io_pending_packet_t);
211 int ret;
212
213 /*
214 * Higher priority elements are larger than lower
215 * priority elements. So if "a" is larger than "b", we
216 * wish to prefer "a".
217 */
218 ret = CMP_PREFER_LARGER(a->priority, b->priority);
219 if (ret != 0) return ret;
220
221 /*
222 * Smaller numbers mean packets were received earlier.
223 * We want to process packets in time order. So if "a"
224 * is smaller than "b", we wish to prefer "a".
225 *
226 * After that, it doesn't really matter what order the
227 * packets go in. Since we'll never have two identical
228 * "recv_time" values, the code should never get here.
229 */
230 return CMP_PREFER_SMALLER(fr_time_unwrap(a->recv_time), fr_time_unwrap(b->recv_time));
231}
232
233/*
234 * Order clients in the pending_clients heap, based on the
235 * packets that they contain.
236 */
237static int8_t pending_client_cmp(void const *one, void const *two)
238{
239 fr_io_pending_packet_t const *a;
240 fr_io_pending_packet_t const *b;
241
242 fr_io_client_t const *c1 = talloc_get_type_abort_const(one, fr_io_client_t);
243 fr_io_client_t const *c2 = talloc_get_type_abort_const(two, fr_io_client_t);
244
245 a = fr_heap_peek(c1->pending);
246 b = fr_heap_peek(c2->pending);
247
248 fr_assert(a != NULL);
249 fr_assert(b != NULL);
250
251 return pending_packet_cmp(a, b);
252}
253
254
255static int8_t address_cmp(void const *one, void const *two)
256{
257 fr_io_address_t const *a = talloc_get_type_abort_const(one, fr_io_address_t);
258 fr_io_address_t const *b = talloc_get_type_abort_const(two, fr_io_address_t);
259 int8_t ret;
260
261 CMP_RETURN(a, b, socket.inet.src_port);
262 CMP_RETURN(a, b, socket.inet.dst_port);
263 CMP_RETURN(a, b, socket.inet.ifindex);
264
265 ret = fr_ipaddr_cmp(&a->socket.inet.src_ipaddr, &b->socket.inet.src_ipaddr);
266 if (ret != 0) return ret;
267
268 return fr_ipaddr_cmp(&a->socket.inet.dst_ipaddr, &b->socket.inet.dst_ipaddr);
269}
270
271static uint32_t connection_hash(void const *ctx)
272{
273 uint32_t hash;
274 fr_io_connection_t const *c = talloc_get_type_abort_const(ctx, fr_io_connection_t);
275
276 hash = fr_hash(&c->address->socket.inet.src_ipaddr, sizeof(c->address->socket.inet.src_ipaddr));
277 hash = fr_hash_update(&c->address->socket.inet.src_port, sizeof(c->address->socket.inet.src_port), hash);
278
279 hash = fr_hash_update(&c->address->socket.inet.ifindex, sizeof(c->address->socket.inet.ifindex), hash);
280
281 hash = fr_hash_update(&c->address->socket.inet.dst_ipaddr, sizeof(c->address->socket.inet.dst_ipaddr), hash);
282 return fr_hash_update(&c->address->socket.inet.dst_port, sizeof(c->address->socket.inet.dst_port), hash);
283}
284
285static int8_t connection_cmp(void const *one, void const *two)
286{
287 fr_io_connection_t const *a = talloc_get_type_abort_const(one, fr_io_connection_t);
288 fr_io_connection_t const *b = talloc_get_type_abort_const(two, fr_io_connection_t);
289
290 return address_cmp(a->address, b->address);
291}
292
293
294static int8_t track_cmp(void const *one, void const *two)
295{
296 fr_io_track_t const *a = talloc_get_type_abort_const(one, fr_io_track_t);
297 fr_io_track_t const *b = talloc_get_type_abort_const(two, fr_io_track_t);
298 int ret;
299
300 fr_assert(a->client != NULL);
301 fr_assert(b->client != NULL);
302 fr_assert(a->client == b->client); /* tables are per-client */
303
304 fr_assert(!a->client->connection);
305 fr_assert(!b->client->connection);
306
307 /*
308 * Unconnected sockets must check src/dst ip/port.
309 */
310 ret = address_cmp(a->address, b->address);
311 if (ret != 0) return ret;
312
313 /*
314 * Call the per-protocol comparison function.
315 */
316 ret = a->client->inst->app_io->track_compare(a->client->inst->app_io_instance,
317 a->client->thread->child->thread_instance,
318 a->client->radclient,
319 a->packet, b->packet);
320 return CMP(ret, 0);
321}
322
323
324static int8_t track_connected_cmp(void const *one, void const *two)
325{
326 fr_io_track_t const *a = talloc_get_type_abort_const(one, fr_io_track_t);
327 fr_io_track_t const *b = talloc_get_type_abort_const(two, fr_io_track_t);
328 int ret;
329
330 fr_assert(a->client != NULL);
331 fr_assert(b->client != NULL);
332
333 fr_assert(a->client->connection);
334 fr_assert(b->client->connection);
335 fr_assert(a->client == b->client);
336 fr_assert(a->client->connection == b->client->connection);
337
338 /*
339 * Note that we pass the connection "client", as
340 * we may do negotiation specific to this connection.
341 */
342 ret = a->client->inst->app_io->track_compare(a->client->inst->app_io_instance,
343 a->client->connection->child->thread_instance,
344 a->client->connection->client->radclient,
345 a->packet, b->packet);
346 return CMP(ret, 0);
347}
348
349
350static fr_io_pending_packet_t *pending_packet_pop(fr_io_thread_t *thread)
351{
352 fr_io_client_t *client;
353 fr_io_pending_packet_t *pending;
354
355 client = fr_heap_pop(&thread->pending_clients);
356 if (!client) {
357 fr_assert(thread->num_pending_packets == 0);
358
359 /*
360 * 99% of the time we don't have pending clients.
361 * So we might as well free this, so that the
362 * caller doesn't keep checking us for every packet.
363 */
364 talloc_free(thread->pending_clients);
365 thread->pending_clients = NULL;
366 return NULL;
367 }
368
369 pending = fr_heap_pop(&client->pending);
370 fr_assert(pending != NULL);
371
372 /*
373 * If the client has more packets pending, add it back to
374 * the heap.
375 */
376 if (fr_heap_num_elements(client->pending) > 0) {
377 if (fr_heap_insert(&thread->pending_clients, client) < 0) {
378 fr_assert(0 == 1);
379 }
380 }
381
382 fr_assert(thread->num_pending_packets > 0);
383 thread->num_pending_packets--;
384
385 return pending;
386}
387
388static fr_client_t *radclient_clone(TALLOC_CTX *ctx, fr_client_t const *parent)
389{
390 fr_client_t *c;
391
392 if (!parent) return NULL;
393
394 c = talloc_zero(ctx, fr_client_t);
395 if (!c) return NULL;
396
397 /*
398 * Do NOT set ipaddr or src_ipaddr. The caller MUST do this!
399 */
400
401#define DUP_FIELD(_x) do { if (parent->_x) {c->_x = talloc_strdup(c, parent->_x); if (!c->_x) {goto error;}}} while (0)
402#define COPY_FIELD(_x) c->_x = parent->_x
403
404 DUP_FIELD(longname);
405 DUP_FIELD(shortname);
406 DUP_FIELD(secret);
407 DUP_FIELD(nas_type);
408 DUP_FIELD(server);
409 DUP_FIELD(nas_type);
410
411 COPY_FIELD(require_message_authenticator);
412 COPY_FIELD(require_message_authenticator_is_set);
413 COPY_FIELD(limit_proxy_state);
414 COPY_FIELD(limit_proxy_state_is_set);
415 COPY_FIELD(received_message_authenticator);
416 COPY_FIELD(first_packet_no_proxy_state);
417 /* dynamic MUST be false */
418 COPY_FIELD(server_cs);
419 COPY_FIELD(cs);
420 COPY_FIELD(proto);
421 COPY_FIELD(active);
422
423 COPY_FIELD(use_connected);
424
425#ifdef WITH_TLS
426 COPY_FIELD(tls_required);
427#endif
428
429 c->ipaddr = parent->ipaddr;
430 c->src_ipaddr = parent->src_ipaddr;
431
432 return c;
433
434 /*
435 * @todo - fill in other fields, too!
436 */
437
438error:
439 talloc_free(c);
440 return NULL;
441}
442#undef COPY_FIELD
443#undef DUP_FIELD
444
445
446/** Count the number of connections used by active clients.
447 *
448 * Unfortunately, we also count NAK'd connections, too, even if they
449 * are closed. The alternative is to walk through all connections
450 * for each client, which would be a long time.
451 */
452static int count_connections(UNUSED uint8_t const *key, UNUSED size_t keylen, void *data, void *ctx)
453{
454 fr_io_client_t *client = talloc_get_type_abort(data, fr_io_client_t);
455 int connections;
456
457 pthread_mutex_lock(&client->mutex);
458
459 if (!client->ht) {
460 pthread_mutex_unlock(&client->mutex);
461 return 0;
462 }
463
464 connections = fr_hash_table_num_elements(client->ht);
465 pthread_mutex_unlock(&client->mutex);
466
467 fr_assert(client->use_connected);
468 *((uint32_t *) ctx) += connections;
469
470 return 0;
471}
472
473
474static int _client_free(fr_io_client_t *client)
475{
476 TALLOC_FREE(client->pending);
477
478 return 0;
479}
480
481static void client_pending_free(fr_io_client_t *client)
482{
483 size_t num;
484
485 fr_assert(!client->connection);
486
487 if (!client->pending) return;
488
489 num = fr_heap_num_elements(client->pending);
490
491 fr_assert(client->thread->num_pending_packets >= num);
492 client->thread->num_pending_packets -= num;
493
494 TALLOC_FREE(client->pending);
495}
496
497
498static int connection_free(fr_io_connection_t *connection)
499{
500 /*
501 * This is it's own talloc context, as there are
502 * thousands of packets associated with it.
503 */
504 TALLOC_FREE(connection->client);
505
506 return 0;
507}
508
509/** Create a new connection.
510 *
511 * Called ONLY from the master socket.
512 */
513static fr_io_connection_t *fr_io_connection_alloc(fr_io_instance_t const *inst,
514 fr_io_thread_t *thread,
515 fr_io_client_t *client, int fd,
516 fr_io_address_t *address,
517 fr_io_connection_t *nak)
518{
519 int ret;
520 fr_io_connection_t *connection;
521 module_instance_t *mi = NULL;
522 fr_listen_t *li;
523 fr_client_t *radclient;
524
525 /*
526 * Reload the app_io module as a "new" library. This
527 * causes the link count for the library to be correct.
528 * It also allocates a new instance data for it, too.
529 * Passing CONF_SECTION of NULL ensures that there's no
530 * config for it, as we'll just clone it's contents from
531 * the original. It also means that detach should be
532 * called when the instance data is freed.
533 */
534 if (!nak) {
535 CONF_SECTION *cs;
536 char *inst_name;
537
538 if (inst->max_connections || client->radclient->limit.max_connections) {
539 uint32_t max_connections = inst->max_connections ? inst->max_connections : client->radclient->limit.max_connections;
540
541 /*
542 * We've hit the connection limit. Walk
543 * over all clients with connections, and
544 * count the number of connections used.
545 */
546 if (thread->num_connections >= max_connections) {
547 thread->num_connections = 0;
548
549 (void) fr_trie_walk(thread->trie, &thread->num_connections, count_connections);
550
551 if ((thread->num_connections + 1) >= max_connections) {
552 RATE_LIMIT_LOCAL(&thread->rate_limit.max_connections, INFO,
553 "proto_%s - Ignoring connection from client %s - 'max_connections' limit reached.",
554 inst->app->common.name, client->radclient->shortname);
555 if (fd >= 0) close(fd);
556 return NULL;
557 }
558 }
559 }
560
561 /*
562 * Add a client module into a sublist
563 */
564 inst_name = talloc_asprintf(NULL, "%"PRIu64, thread->client_id++);
565 mi = module_instance_copy(inst->clients, inst->submodule, inst_name);
566
567 cs = cf_section_dup(mi, NULL, inst->submodule->conf,
568 cf_section_name1(inst->submodule->conf),
569 cf_section_name2(inst->submodule->conf), false);
570 if (module_instance_conf_parse(mi, cs) < 0) {
571 cf_log_err(inst->server_cs, "Failed parsing module config");
572 goto cleanup;
573 }
574
575 /* Thread local module lists never run bootstrap */
576 if (module_instantiate(mi) < 0) {
577 cf_log_err(inst->server_cs, "Failed instantiating module");
578 goto cleanup;
579 }
580
581 if (module_thread_instantiate(mi, mi, thread->el) < 0) {
582 cf_log_err(inst->server_cs, "Failed instantiating module");
583 goto cleanup;
584 }
585
586 /*
587 * FIXME - Instantiate the new module?!
588 */
589 talloc_free(inst_name);
590 fr_assert(mi != NULL);
591 } else {
592 mi = talloc_init_const("nak");
593 }
594
595 MEM(connection = talloc_zero(mi, fr_io_connection_t));
596 MEM(connection->address = talloc_memdup(connection, address, sizeof(*address)));
597 (void) talloc_set_name_const(connection->address, "fr_io_address_t");
598
599 connection->parent = client;
600 connection->mi = mi;
601
602 MEM(connection->client = talloc_named(NULL, sizeof(fr_io_client_t), "fr_io_client_t"));
603 memset(connection->client, 0, sizeof(*connection->client));
604
605 MEM(connection->client->radclient = radclient = radclient_clone(connection->client, client->radclient));
606
607 talloc_set_destructor(connection->client, _client_free);
608 talloc_set_destructor(connection, connection_free);
609
610 connection->client->pending_id = FR_HEAP_INDEX_INVALID;
611 connection->client->alive_id = FR_HEAP_INDEX_INVALID;
612 connection->client->connection = connection;
613
614 /*
615 * Create the packet tracking table for this client.
616 *
617 * #todo - unify the code with static clients?
618 */
619 if (inst->app_io->track_duplicates) {
620 MEM(connection->client->table = fr_rb_inline_talloc_alloc(client, fr_io_track_t, node,
621 track_connected_cmp, NULL));
622 }
623
624 /*
625 * Set this radclient to be dynamic, and active.
626 */
627 radclient->dynamic = true;
628 radclient->active = true;
629
630 /*
631 * address->socket.inet.client points to a "static" client. We want
632 * to clean up everything associated with the connection
633 * when it closes. So we need to point to our own copy
634 * of the client here.
635 */
636 connection->address->radclient = connection->client->radclient;
637 connection->client->inst = inst;
638 connection->client->thread = thread;
639
640 /*
641 * Create a heap for packets which are pending for this
642 * client.
643 */
644 MEM(connection->client->pending = fr_heap_alloc(connection->client, pending_packet_cmp,
645 fr_io_pending_packet_t, heap_id, 0));
646
647 /*
648 * Clients for connected sockets are always a /32 or /128.
649 */
650 connection->client->src_ipaddr = address->socket.inet.src_ipaddr;
651 connection->client->network = address->socket.inet.src_ipaddr;
652
653 /*
654 * Don't initialize mutex or hash table.
655 * Connections cannot spawn other connections.
656 */
657
658 /*
659 * If this client state is pending, then the connection
660 * state is pending, too. That allows NAT gateways to be
661 * defined dynamically, AND for them to have multiple
662 * connections, each with a different client. This
663 * allows for different shared secrets to be used for
664 * different connections. Once the client gets defined
665 * for this connection, it will be either "connected" or
666 * not. If connected, then the parent client remains
667 * PENDING. Otherwise, the parent client is moved to
668 * DYNAMIC
669 *
670 * If this client state is static or dynamic,
671 * then we're just using connected sockets behind
672 * that client. The connections here all use the
673 * same shared secret, but they use different
674 * sockets, so they allow for sharing of IO
675 * across CPUs / threads.
676 */
677 switch (client->state) {
678 case PR_CLIENT_PENDING:
679 connection->client->state = PR_CLIENT_PENDING;
680
681 /*
682 * Needed for rlm_radius, which refuses to proxy packets
683 * that define a dynamic client.
684 */
685 radclient->active = false;
686 break;
687
688 case PR_CLIENT_STATIC:
689 case PR_CLIENT_DYNAMIC:
690 connection->client->state = PR_CLIENT_CONNECTED;
691 break;
692
693 case PR_CLIENT_INVALID:
694 case PR_CLIENT_NAK:
695 case PR_CLIENT_CONNECTED:
696 fr_assert(0 == 1);
697 goto cleanup;
698 }
699
700 if (!nak) {
701 /*
702 * Get the child listener.
703 */
704 MEM(li = connection->child = talloc(connection, fr_listen_t));
705 memcpy(li, thread->listen, sizeof(*li));
706
707 /*
708 * Glue in the actual app_io
709 */
710 li->connected = true;
711 li->app_io = thread->child->app_io;
712 li->thread_instance = connection;
713 li->app_io_instance = mi->data;
714 li->track_duplicates = thread->child->app_io->track_duplicates;
715
716 /*
717 * Create writable thread instance data.
718 */
719 connection->child->thread_instance = talloc_zero_array(NULL, uint8_t,
720 inst->app_io->common.thread_inst_size);
721 talloc_set_destructor(connection->child, fr_io_listen_free);
722 talloc_set_name(connection->child->thread_instance, "proto_%s_thread_t",
723 inst->app_io->common.name);
724
725 /*
726 * This is "const", and the user can't
727 * touch it. So we just reuse the same
728 * configuration everywhere.
729 */
730 connection->child->app_io_instance = inst->app_io_instance;
731
732 /*
733 * Create the listener, based on our listener.
734 */
735 MEM(li = connection->listen = talloc(connection, fr_listen_t));
736
737 /*
738 * Note that our instance is effectively 'const'.
739 *
740 * i.e. we can't add things to it. Instead, we have to
741 * put all variable data into the connection.
742 */
743 memcpy(li, thread->listen, sizeof(*li));
744
745 /*
746 * Glue in the connection to the listener.
747 */
748 fr_assert(li->app_io == &fr_master_app_io);
749
750 li->connected = true;
751 li->thread_instance = connection;
752 li->app_io_instance = li->thread_instance;
753 li->track_duplicates = thread->child->app_io->track_duplicates;
754
755 /*
756 * Instantiate the child, and open the socket.
757 */
758 fr_assert(inst->app_io->connection_set != NULL);
759
760 if (inst->app_io->connection_set(connection->child, connection->address) < 0) {
761 DEBUG("proto_%s - Failed setting connection for socket.", inst->app->common.name);
762 goto cleanup;
763 }
764
765 /*
766 * UDP sockets: open a new socket, and then
767 * connect it to the client. This emulates the
768 * behavior of accept().
769 *
770 * Note that there is a small window between the
771 * bind() and connect() where UDP packets for the
772 * wildcard socket can get received by this
773 * socket. We hope that this time frame is as
774 * small as possible.
775 *
776 * i.e. we ignore the problem, and don't
777 * currently check dst ip/port for UDP packets
778 * received on connected sockets.
779 */
780 if (fd < 0) {
781 socklen_t salen;
782 struct sockaddr_storage src;
783
784 if (fr_ipaddr_to_sockaddr(&src, &salen,
785 &connection->address->socket.inet.src_ipaddr,
786 connection->address->socket.inet.src_port) < 0) {
787 DEBUG("proto_%s - Failed getting IP address", inst->app->common.name);
788 talloc_free(mi);
789 return NULL;
790 }
791
792 if (inst->app_io->open(connection->child) < 0) {
793 DEBUG("proto_%s - Failed opening connected socket.", inst->app->common.name);
794 talloc_free(mi);
795 return NULL;
796 }
797
798 fd = connection->child->fd;
799
800 if (connect(fd, (struct sockaddr *) &src, salen) < 0) {
801 ERROR("proto_%s - Failed in connect: %s", inst->app->common.name, fr_syserror(errno));
802 goto cleanup;
803 }
804 } else {
805 connection->child->fd = fd;
806 }
807
808 /*
809 * Set the new FD, and get the module to set it's connection name.
810 */
811 if (inst->app_io->fd_set(connection->child, fd) < 0) {
812 DEBUG3("Failed setting FD to %s", inst->app_io->common.name);
813 goto cleanup;
814 }
815
816 li->fd = fd;
817
818 if (!inst->app_io->get_name) {
819 connection->name = fr_asprintf(connection, "proto_%s from client %pV port "
820 "%u to server %pV port %u",
821 inst->app->common.name,
822 fr_box_ipaddr(connection->address->socket.inet.src_ipaddr),
823 connection->address->socket.inet.src_port,
824 fr_box_ipaddr(connection->address->socket.inet.dst_ipaddr),
825 connection->address->socket.inet.dst_port);
826 } else {
827 connection->name = inst->app_io->get_name(connection->child);
828 }
829
830 /*
831 * Set the names for the listeners.
832 */
833 connection->listen->name = connection->name;
834 connection->child->name = connection->name;
835 }
836
837 /*
838 * Add the connection to the set of connections for this
839 * client.
840 */
841 pthread_mutex_lock(&client->mutex);
842 if (client->ht) {
843 if (nak) (void) fr_hash_table_delete(client->ht, nak);
844 ret = fr_hash_table_insert(client->ht, connection);
845 client->ready_to_delete = false;
846 connection->in_parent_hash = true;
847
848 if (!ret) {
849 pthread_mutex_unlock(&client->mutex);
850 ERROR("proto_%s - Failed inserting connection into tracking table. "
851 "Closing it, and discarding all packets for connection %s.",
852 inst->app_io->common.name, connection->name);
853 goto cleanup;
854 }
855 }
856 pthread_mutex_unlock(&client->mutex);
857
858 /*
859 * It's a NAK client. Set the state to NAK, and don't
860 * add it to the scheduler.
861 */
862 if (nak) {
863 INFO("proto_%s - Verification failed for packet from dynamic client %pV - adding IP address to the NAK cache",
864 inst->app_io->common.name, fr_box_ipaddr(client->src_ipaddr));
865
866 connection->name = talloc_strdup(connection, nak->name);
867 connection->client->state = PR_CLIENT_NAK;
868 connection->el = nak->el;
869 return connection;
870 }
871
872 DEBUG("proto_%s - starting connection %s", inst->app_io->common.name, connection->name);
873 connection->nr = fr_schedule_listen_add(thread->sc, connection->listen);
874 if (!connection->nr) {
875 ERROR("proto_%s - Failed inserting connection into scheduler. "
876 "Closing it, and diuscarding all packets for connection %s.",
877 inst->app_io->common.name, connection->name);
878 pthread_mutex_lock(&client->mutex);
879 if (client->ht) (void) fr_hash_table_delete(client->ht, connection);
880 pthread_mutex_unlock(&client->mutex);
881
882 cleanup:
883 if (fd >= 0) close(fd);
884 talloc_free(mi);
885 return NULL;
886 }
887
888 /*
889 * We have one more connection. Note that we do
890 * NOT decrement this counter when a connection
891 * closes, as the close is done in a child
892 * thread. Instead, we just let counter hit the
893 * limit, and then walk over the clients to reset
894 * the count.
895 */
896 thread->num_connections++;
897
898 return connection;
899}
900
901
902/*
903 * And here we go into the rabbit hole...
904 *
905 * @todo future - have a similar structure
906 * fr_io_connection_io, which will duplicate some code,
907 * but may make things simpler?
908 */
909static void get_inst(fr_listen_t *li, fr_io_instance_t const **inst, fr_io_thread_t **thread,
910 fr_io_connection_t **connection, fr_listen_t **child)
911{
912 if (!li->connected) {
913 *inst = li->app_io_instance;
914 if (thread) *thread = li->thread_instance;
915 *connection = NULL;
916 if (child) *child = ((fr_io_thread_t *)li->thread_instance)->child;
917
918 } else {
919 fr_assert(connection != NULL);
920
921 *connection = li->thread_instance;
922 *inst = (*connection)->client->inst;
923 if (thread) *thread = NULL;
924 if (child) *child = (*connection)->child;
925 }
926}
927
928
929static fr_client_t *radclient_alloc(TALLOC_CTX *ctx, int ipproto, fr_io_address_t *address)
930{
931 fr_client_t *radclient;
932 char *shortname;
933
934 MEM(radclient = talloc_zero(ctx, fr_client_t));
935
936 fr_value_box_aprint(radclient, &shortname, fr_box_ipaddr(address->socket.inet.src_ipaddr), NULL);
937 radclient->longname = radclient->shortname = shortname;
938
939 radclient->secret = radclient->nas_type = talloc_strdup(radclient, "");
940
941 radclient->ipaddr = address->socket.inet.src_ipaddr;
942
943 radclient->src_ipaddr = address->socket.inet.dst_ipaddr;
944
945 radclient->proto = ipproto;
946 radclient->dynamic = true;
947
948 return radclient;
949}
950
951/*
952 * Remove a client from the list of "live" clients.
953 *
954 * This function is only used for the "main" socket. Clients
955 * from connections do not use it.
956 */
957static int _client_live_free(fr_io_client_t *client)
958{
959 talloc_get_type_abort(client, fr_io_client_t);
960
961 fr_assert(client->in_trie);
962 fr_assert(!client->connection);
963 fr_assert(client->thread);
964
965 if (client->pending) client_pending_free(client);
966
967 (void) fr_trie_remove_by_key(client->thread->trie, &client->src_ipaddr.addr, client->src_ipaddr.prefix);
968
969 if (client->thread->alive_clients) {
970 fr_assert(fr_heap_num_elements(client->thread->alive_clients) > 0);
971 (void) fr_heap_extract(&client->thread->alive_clients, client);
972 }
973
974 return 0;
975}
976
977/** Allocate a dynamic client.
978 *
979 */
980static fr_io_client_t *client_alloc(TALLOC_CTX *ctx, fr_io_client_state_t state,
981 fr_io_instance_t const *inst, fr_io_thread_t *thread, fr_client_t *radclient,
982 fr_ipaddr_t const *network)
983{
984 fr_io_client_t *client;
985
986 /*
987 * Create our own local client. This client
988 * holds our state which really shouldn't go into
989 * fr_client_t.
990 *
991 * Note that we create a new top-level talloc
992 * context for this client, as there may be tens
993 * of thousands of packets associated with this
994 * client. And we want to avoid problems with
995 * O(N) issues in talloc.
996 */
997 MEM(client = talloc_named(ctx, sizeof(fr_io_client_t), "fr_io_client_t"));
998 memset(client, 0, sizeof(*client));
999
1000 client->state = state;
1001 client->src_ipaddr = radclient->ipaddr;
1002 client->radclient = radclient;
1003 client->inst = inst;
1004 client->thread = thread;
1005
1006 if (network) {
1007 client->network = *network;
1008 } else {
1009 client->network = client->src_ipaddr;
1010 }
1011
1012 /*
1013 * At this point, this variable can only be true
1014 * for STATIC clients. PENDING clients may set
1015 * it to true later, after they've been defined.
1016 */
1017 client->use_connected = radclient->use_connected;
1018
1019 /*
1020 * Create the pending heap for pending clients.
1021 */
1022 if (state == PR_CLIENT_PENDING) {
1023 MEM(client->pending = fr_heap_alloc(client, pending_packet_cmp,
1024 fr_io_pending_packet_t, heap_id, 0));
1025 }
1026
1027 /*
1028 * Create the packet tracking table for this client.
1029 */
1030 if (inst->app_io->track_duplicates) {
1031 fr_assert(inst->app_io->track_compare != NULL);
1032 MEM(client->table = fr_rb_inline_talloc_alloc(client, fr_io_track_t, node, track_cmp, NULL));
1033 }
1034
1035 /*
1036 * Allow connected sockets to be set on a
1037 * per-client basis.
1038 */
1039 if (client->use_connected) {
1040 fr_assert(client->state == PR_CLIENT_STATIC);
1041
1042 (void) pthread_mutex_init(&client->mutex, NULL);
1043 MEM(client->ht = fr_hash_table_alloc(client, connection_hash, connection_cmp, NULL));
1044 }
1045
1046 /*
1047 * Add the newly defined client to the trie of
1048 * allowed clients.
1049 */
1050 if (fr_trie_insert_by_key(thread->trie, &client->src_ipaddr.addr, client->src_ipaddr.prefix, client)) {
1051 ERROR("proto_%s - Failed inserting client %s into tracking table. Discarding client, and all packets for it.",
1052 inst->app_io->common.name, client->radclient->shortname);
1053 talloc_free(client);
1054 return NULL;
1055 }
1056
1057 client->in_trie = true;
1058
1059 /*
1060 * It's a static client. Don't insert it into the list of alive clients, as those are only for
1061 * dynamic clients.
1062 */
1063 if (state == PR_CLIENT_STATIC) return client;
1064
1065 fr_assert(thread->alive_clients != NULL);
1066
1067 /*
1068 * Track the live clients so that we can clean
1069 * them up.
1070 */
1071 (void) fr_heap_insert(&thread->alive_clients, client);
1072 client->pending_id = FR_HEAP_INDEX_INVALID;
1073
1074 /*
1075 * Now that we've inserted it into the heap and
1076 * incremented the numbers, set the destructor
1077 * function.
1078 */
1079 talloc_set_destructor(client, _client_live_free);
1080
1081 return client;
1082}
1083
1084
1085static fr_io_track_t *fr_io_track_add(fr_io_client_t *client,
1086 fr_io_address_t *address,
1087 uint8_t const *packet, size_t packet_len,
1088 fr_time_t recv_time, bool *is_dup)
1089{
1090 size_t len;
1091 fr_io_track_t *track, *old;
1092
1093 *is_dup = false;
1094
1095 /*
1096 * Allocate a new tracking structure. Most of the time
1097 * there are no duplicates, so this is fine.
1098 */
1099 if (client->connection) {
1100 MEM(track = talloc_zero_pooled_object(client, fr_io_track_t, 1, sizeof(*track) + 64));
1101 track->address = client->connection->address;
1102 } else {
1103 fr_io_address_t *my_address;
1104
1105 MEM(track = talloc_zero_pooled_object(client, fr_io_track_t, 1, sizeof(*track) + sizeof(*track->address) + 64));
1106 MEM(track->address = my_address = talloc(track, fr_io_address_t));
1107
1108 *my_address = *address;
1109 my_address->radclient = client->radclient;
1110 }
1111
1112 track->client = client;
1113
1114 track->timestamp = recv_time;
1115 track->packets = 1;
1116
1117 /*
1118 * We're not tracking duplicates, so just return the
1119 * tracking entry. This tracks src/dst IP/port, client,
1120 * receive time, etc.
1121 */
1122 if (!client->inst->app_io->track_duplicates) {
1123 client->packets++;
1124 talloc_set_destructor(track, track_free);
1125 return track;
1126 }
1127
1128 /*
1129 * We are checking for duplicates, see if there is a dup
1130 * already in the tree.
1131 */
1132 track->packet = client->inst->app_io->track_create(client->inst->app_io_instance,
1133 client->thread->child->thread_instance,
1134 client->radclient,
1135 track, packet, packet_len);
1136 if (!track->packet) {
1137 talloc_free(track);
1138 return NULL;
1139 }
1140
1141 /*
1142 * No existing duplicate. Return the new tracking entry.
1143 */
1144 old = fr_rb_find(client->table, track);
1145 if (!old) goto do_insert;
1146
1147 fr_assert(old->client == client);
1148
1149 /*
1150 * It cannot be both in the free list and in the tracking table.
1151 *
1152 * 2020-08-17, this assertion fails randomly in travis.
1153 * Which means that "track" was in the free list, *and*
1154 * in the rbtree.
1155 */
1156 fr_assert(old != track);
1157
1158 /*
1159 * The new packet has the same dedup fields as the old
1160 * one, BUT it may be a conflicting packet. Check for
1161 * that via a simple memcmp().
1162 *
1163 * It's an exact duplicate. Drop the new one and
1164 * use the old one.
1165 *
1166 * If there's a cached reply, the caller will take care
1167 * of sending it to the network layer.
1168 */
1169 len = talloc_array_length(old->packet);
1170 if ((len == talloc_array_length(track->packet)) &&
1171 (memcmp(old->packet, track->packet, len) == 0)) {
1172 fr_assert(old != track);
1173
1174 /*
1175 * Ignore duplicates while the client is
1176 * still pending.
1177 */
1178 if (client->state == PR_CLIENT_PENDING) {
1179 DEBUG("Ignoring duplicate packet while client %s is still pending dynamic definition",
1180 client->radclient->shortname);
1181 talloc_free(track);
1182 return NULL;
1183 }
1184
1185 *is_dup = true;
1186 old->packets++;
1187 talloc_free(track);
1188
1189 /*
1190 * Retransmits can sit in the outbound queue for
1191 * a while. We don't want to time out this
1192 * struct while the packet is in the outbound
1193 * queue.
1194 */
1195 FR_TIMER_DISARM(old->ev);
1196 return old;
1197 }
1198
1199 /*
1200 * Else it's a conflicting packet. Which is OK if we
1201 * already have a reply. We just delete the old entry,
1202 * and insert the new one.
1203 *
1204 * If there's no reply, then the old request is still
1205 * "live". Delete the old one from the tracking tree,
1206 * and return the new one.
1207 */
1208 if (old->reply_len || old->do_not_respond) {
1209 talloc_free(old);
1210
1211 } else {
1212 fr_assert(client == old->client);
1213
1214 if (!fr_rb_delete(client->table, old)) {
1215 fr_assert(0);
1216 }
1217 FR_TIMER_DELETE(&old->ev);
1218
1219 talloc_set_destructor(old, track_free);
1220
1221 old->discard = true; /* don't send any reply, there's nowhere for it to go */
1222 }
1223
1224do_insert:
1225 if (!fr_rb_insert(client->table, track)) {
1226 fr_assert(0);
1227 }
1228
1229 client->packets++;
1230 talloc_set_destructor(track, track_dedup_free);
1231 return track;
1232}
1233
1234
1235static int pending_free(fr_io_pending_packet_t *pending)
1236{
1237 fr_io_track_t *track = pending->track;
1238
1239 /*
1240 * Note that we don't check timestamps, replies, etc. If
1241 * a packet is pending, then any conflicting packet gets
1242 * the "pending" entry marked as such, and a new entry
1243 * added. Any duplicate packet gets suppressed. And
1244 * because the packets are pending, track->reply MUST be
1245 * NULL.
1246 */
1247 fr_assert(track->packets > 0);
1248 track->packets--;
1249
1250 /*
1251 * No more packets using this tracking entry,
1252 * delete it.
1253 */
1254 if (track->packets == 0) talloc_free(track);
1255
1256 return 0;
1257}
1258
1259static fr_io_pending_packet_t *fr_io_pending_alloc(fr_io_connection_t *connection, fr_io_client_t *client,
1260 uint8_t const *buffer, size_t packet_len,
1261 fr_io_track_t *track,
1262 int priority)
1263{
1264 fr_io_pending_packet_t *pending;
1265
1266 MEM(pending = talloc_zero(client->pending, fr_io_pending_packet_t));
1267
1268 MEM(pending->buffer = talloc_memdup(pending, buffer, packet_len));
1269 pending->buffer_len = packet_len;
1270 pending->priority = priority;
1271 pending->track = track;
1272 pending->recv_time = track->timestamp; /* there can only be one */
1273
1274 talloc_set_destructor(pending, pending_free);
1275
1276 /*
1277 * Insert the pending packet for this client. If it
1278 * fails, silently discard the packet.
1279 */
1280 if (fr_heap_insert(&client->pending, pending) < 0) {
1281 talloc_free(pending);
1282 return NULL;
1283 }
1284
1285 /*
1286 * We only track pending packets for the
1287 * main socket. For connected sockets,
1288 * we pause the FD, so the number of
1289 * pending packets will always be small.
1290 */
1291 if (!connection) client->thread->num_pending_packets++;
1292
1293 return pending;
1294}
1295
1296
1297/*
1298 * Order clients in the alive_clients heap, based on their IP
1299 * address.
1300 *
1301 * This function is only used for the "main" socket. Clients
1302 * from connections do not use it.
1303 */
1304static int8_t alive_client_cmp(void const *one, void const *two)
1305{
1306 fr_io_client_t const *a = talloc_get_type_abort_const(one, fr_io_client_t);
1307 fr_io_client_t const *b = talloc_get_type_abort_const(two, fr_io_client_t);
1308
1309 return fr_ipaddr_cmp(&a->src_ipaddr, &b->src_ipaddr);
1310}
1311
1312/** Implement 99% of the read routines.
1313 *
1314 * The app_io->read does the transport-specific data read.
1315 */
1316static ssize_t mod_read(fr_listen_t *li, void **packet_ctx, fr_time_t *recv_time_p,
1317 uint8_t *buffer, size_t buffer_len, size_t *leftover)
1318{
1319 fr_io_instance_t const *inst;
1320 fr_io_thread_t *thread;
1321 ssize_t packet_len = -1;
1322 fr_time_t recv_time = fr_time_wrap(0);
1323 fr_io_client_t *client;
1324 fr_io_address_t address;
1325 fr_io_connection_t my_connection, *connection;
1326 fr_io_pending_packet_t *pending = NULL;
1327 fr_io_track_t *track;
1328 fr_listen_t *child;
1329 int value, accept_fd = -1;
1330 uint32_t priority = PRIORITY_NORMAL;
1331
1332/** Log that we ignore clients in debug mode, or when it's enabled for a listener
1333 */
1334#define LOG_IGNORED_CLIENTS(_inst) ((_inst)->log_ignored_clients || fr_debug_lvl >= 1)
1335
1336 get_inst(li, &inst, &thread, &connection, &child);
1337
1338 track = NULL;
1339
1340 /*
1341 * There was data left over from the previous read, go
1342 * get the rest of it now. We MUST do this instead of
1343 * popping a pending packet, because the leftover bytes
1344 * are already in the output buffer.
1345 */
1346 if (*leftover) goto do_read;
1347
1348redo:
1349 /*
1350 * Read one pending packet. The packet may be pending
1351 * because of dynamic client definitions, or because it's
1352 * for a connected UDP socket, and was sent over by the
1353 * "master" UDP socket.
1354 */
1355 if (connection) {
1356 /*
1357 * The connection is dead. Tell the network side
1358 * to close it.
1359 */
1360 if (connection->dead) {
1361 DEBUG("Dead connection %s", connection->name);
1362 return -1;
1363 }
1364
1365 pending = fr_heap_pop(&connection->client->pending);
1366
1367 } else if (thread->pending_clients) {
1368 pending = pending_packet_pop(thread);
1369
1370 } else {
1371 pending = NULL;
1372 }
1373
1374 if (pending) {
1375 fr_assert(buffer_len >= pending->buffer_len);
1376 track = pending->track;
1377
1378 /*
1379 * Clear the destructor as we now own the
1380 * tracking entry.
1381 */
1382 talloc_set_destructor(pending, NULL);
1383
1384 /*
1385 * We received a conflicting packet while this
1386 * packet was pending. Discard this entry and
1387 * try to get another one.
1388 *
1389 * Note that the pending heap is *simple*. We
1390 * just track priority and recv_time. This means
1391 * it's fast, but also that it's hard to look up
1392 * random packets in the pending heap.
1393 */
1394 if (fr_time_neq(pending->recv_time, track->timestamp)) {
1395 DEBUG3("Discarding old packet");
1396 TALLOC_FREE(pending);
1397 goto redo;
1398 }
1399
1400 /*
1401 * We have a valid packet. Copy it over to the
1402 * caller, and return.
1403 */
1404 *packet_ctx = track;
1405 *leftover = 0;
1406 recv_time = *recv_time_p = pending->recv_time;
1407 client = track->client;
1408
1409 memcpy(buffer, pending->buffer, pending->buffer_len);
1410 packet_len = pending->buffer_len;
1411
1412 /*
1413 * Shouldn't be necessary, but what the heck...
1414 */
1415 memcpy(&address, track->address, sizeof(address));
1416 TALLOC_FREE(pending);
1417
1418 /*
1419 * Skip over all kinds of logic to find /
1420 * allocate the client, when we don't need to do
1421 * it any more.
1422 */
1423 goto have_client;
1424
1425 } else if (!connection && (inst->ipproto == IPPROTO_TCP)) {
1426 struct sockaddr_storage saremote;
1427 socklen_t salen;
1428
1429 salen = sizeof(saremote);
1430
1431 /*
1432 * We're a TCP socket but are NOT connected. We
1433 * must be the master socket. Accept the new
1434 * connection, and figure out src/dst IP/port.
1435 */
1436 accept_fd = accept(child->fd,
1437 (struct sockaddr *) &saremote, &salen);
1438
1439 /*
1440 * Couldn't open a NEW socket, but THIS ONE is
1441 * OK. So don't return -1.
1442 */
1443 if (accept_fd < 0) {
1444 RATE_LIMIT_LOCAL(&thread->rate_limit.accept_failed,
1445 INFO, "proto_%s - failed to accept new socket: %s",
1446 inst->app->common.name, fr_syserror(errno));
1447 return 0;
1448 }
1449
1450 /*
1451 * Set the new descriptor to be non-blocking.
1452 */
1453 (void) fr_nonblock(accept_fd);
1454
1455#ifdef STATIC_ANALYZER
1456 saremote.ss_family = AF_INET; /* static analyzer doesn't know that accept() initializes this */
1457#endif
1458
1459 /*
1460 * Get IP addresses only if we have IP addresses.
1461 */
1462 if ((saremote.ss_family == AF_INET) || (saremote.ss_family == AF_INET6)) {
1463 memset(&address.socket, 0, sizeof(address.socket));
1464 (void) fr_ipaddr_from_sockaddr(&address.socket.inet.src_ipaddr, &address.socket.inet.src_port,
1465 &saremote, salen);
1466 salen = sizeof(saremote);
1467
1468 /*
1469 * @todo - only if the local listen address is "*".
1470 */
1471 (void) getsockname(accept_fd, (struct sockaddr *) &saremote, &salen);
1472 (void) fr_ipaddr_from_sockaddr(&address.socket.inet.dst_ipaddr, &address.socket.inet.dst_port,
1473 &saremote, salen);
1474 address.socket.type = (inst->ipproto == IPPROTO_TCP) ? SOCK_STREAM : SOCK_DGRAM;
1475 address.socket.fd = accept_fd;
1476 }
1477
1478 } else {
1479 fr_io_address_t *local_address;
1480
1481 /*
1482 * We're either not a TCP socket, or we are a
1483 * connected TCP socket. Just read it.
1484 */
1485do_read:
1486 local_address = &address;
1487
1488 /*
1489 * @todo - For connected TCP sockets which are
1490 * dynamically defined, the app_io read()
1491 * function should stop reading the socket if the
1492 * server is busy. That change puts TCP
1493 * backpressure on the client.
1494 *
1495 * @todo TLS - for TLS and dynamic sockets, do
1496 * the SSL setup here, but have a structure which
1497 * describes the TLS data and run THAT through
1498 * the dynamic client definition, instead of
1499 * using normal packets. Or, rely on the app_io
1500 * read() function to do all TLS work? Given
1501 * that some protocols have "starttls" beginning
1502 * after a clear-text exchange, it's likely best
1503 * to have yet another layer of trampoline
1504 * functions which do all of the TLS work.
1505 */
1506 packet_len = inst->app_io->read(child, (void **) &local_address, &recv_time,
1507 buffer, buffer_len, leftover);
1508 if (packet_len <= 0) {
1509 return packet_len;
1510 }
1511
1512 /*
1513 * Not allowed? Discard it. The priority()
1514 * function has done any complaining, if
1515 * necessary.
1516 */
1517 if (inst->app->priority) {
1518 value = inst->app->priority(inst->app_instance, buffer, packet_len);
1519 if (value <= 0) {
1520 static fr_rate_limit_t bad_type;
1521
1522 /*
1523 * @todo - unix sockets. We need to use
1524 * the "name" of the socket, in the
1525 * listener?
1526 */
1527 if (LOG_IGNORED_CLIENTS(inst)) {
1528 RATE_LIMIT_LOCAL(thread ? &thread->rate_limit.bad_type : &bad_type, INFO,
1529 "proto_%s - ignoring packet from IP %pV. It is not configured as 'type = ...'",
1530 inst->app_io->common.name, fr_box_ipaddr(address.socket.inet.src_ipaddr));
1531 }
1532 return 0;
1533 }
1534 priority = value;
1535 }
1536
1537 /*
1538 * If the connection is pending, pause reading of
1539 * more packets. If mod_write() accepts the
1540 * connection, it will resume reading.
1541 * Otherwise, it will close the socket without
1542 * resuming it.
1543 */
1544 if (connection &&
1545 (connection->client->state == PR_CLIENT_PENDING)) {
1546 fr_assert(!connection->paused);
1547
1548 connection->paused = true;
1549 (void) fr_event_filter_update(connection->el,
1550 child->fd,
1551 FR_EVENT_FILTER_IO, pause_read);
1552 }
1553 }
1554
1555 /*
1556 * Look up the client, unless we already have one (for a
1557 * connected socket).
1558 */
1559 if (!connection) {
1560 client = fr_trie_lookup_by_key(thread->trie,
1561 &address.socket.inet.src_ipaddr.addr, address.socket.inet.src_ipaddr.prefix);
1562 fr_assert(!client || !client->connection);
1563
1564 } else {
1565 client = connection->client;
1566
1567 /*
1568 * We don't care what the read function says
1569 * about address. We have it already.
1570 */
1571 address = *connection->address;
1572 }
1573
1574 /*
1575 * Negative cache entry. Drop the packet.
1576 */
1577 if (client && client->state == PR_CLIENT_NAK) {
1578 if (accept_fd >= 0) close(accept_fd);
1579 return 0;
1580 }
1581
1582 /*
1583 * If there's no client, try to pull one from the global
1584 * / static client list. Or if dynamic clients are
1585 * allowed, try to define a dynamic client.
1586 */
1587 if (!client) {
1588 fr_client_t *radclient = NULL;
1589 fr_io_client_state_t state;
1590 fr_ipaddr_t const *network = NULL;
1591 char const *error;
1592
1593 /*
1594 * We MUST be the master socket.
1595 */
1596 fr_assert(!connection);
1597
1598 radclient = inst->app_io->client_find(thread->child, &address.socket.inet.src_ipaddr, inst->ipproto);
1599 if (radclient) {
1600 state = PR_CLIENT_STATIC;
1601
1602 /*
1603 * Make our own copy that we can modify it.
1604 */
1605 MEM(radclient = radclient_clone(thread, radclient));
1606 radclient->active = true;
1607
1608 } else if (inst->dynamic_clients) {
1609 if (inst->max_clients && (fr_heap_num_elements(thread->alive_clients) >= inst->max_clients)) {
1610 error = "Too many dynamic clients have been defined";
1611 goto ignore;
1612 }
1613
1614 /*
1615 * Look up the allowed networks.
1616 */
1617 network = fr_trie_lookup_by_key(inst->networks, &address.socket.inet.src_ipaddr.addr,
1618 address.socket.inet.src_ipaddr.prefix);
1619 if (!network) {
1620 error = "Address is outside of the the 'allow' network range";
1621 goto ignore;
1622 }
1623
1624 /*
1625 * It exists, but it's a "deny" rule, ignore it.
1626 */
1627 if (network->af == AF_UNSPEC) {
1628 error = "Address is forbidden by the 'deny' network range";
1629 goto ignore;
1630 }
1631
1632 /*
1633 * Allocate our local radclient as a
1634 * placeholder for the dynamic client.
1635 */
1636 radclient = radclient_alloc(thread, inst->ipproto, &address);
1637 state = PR_CLIENT_PENDING;
1638
1639 } else {
1640 char const *msg;
1641
1642 error = "No matching 'client' definition was found";
1643
1644 ignore:
1645 if (accept_fd < 0) {
1646 msg = "packet";
1647 } else {
1648 msg = "connection attempt";
1649 close(accept_fd);
1650 }
1651
1652 if (LOG_IGNORED_CLIENTS(inst)) {
1653 static fr_rate_limit_t unknown_client;
1654 RATE_LIMIT_LOCAL(thread ? &thread->rate_limit.unknown_client : &unknown_client,
1655 ERROR, "proto_%s - Ignoring %s from IP address %pV - %s",
1656 inst->app_io->common.name, msg, fr_box_ipaddr(address.socket.inet.src_ipaddr),
1657 error);
1658 }
1659
1660 return 0;
1661 }
1662
1663 MEM(client = client_alloc(thread, state, inst, thread, radclient, network));
1664 }
1665
1666have_client:
1667 fr_assert(client->state != PR_CLIENT_INVALID);
1668 fr_assert(client->state != PR_CLIENT_NAK);
1669
1670 /*
1671 * We've accepted a new connection. Go allocate it, and
1672 * let it read from the socket.
1673 */
1674 if (accept_fd >= 0) {
1675 if (!fr_io_connection_alloc(inst, thread, client, accept_fd, &address, NULL)) {
1676 static fr_rate_limit_t alloc_failed;
1677
1678 RATE_LIMIT_LOCAL(thread ? &thread->rate_limit.conn_alloc_failed : &alloc_failed,
1679 ERROR, "Failed to allocate connection from client %s", client->radclient->shortname);
1680 }
1681
1682 return 0;
1683 }
1684
1685 /*
1686 * No connected sockets, OR we are the connected socket.
1687 *
1688 * Track this packet and return it if necessary.
1689 */
1690 if (connection || !client->use_connected) {
1691 fr_io_track_t *to_free = NULL;
1692
1693 /*
1694 * Add the packet to the tracking table, if it's
1695 * not already there. Pending packets will be in
1696 * the tracking table, but won't be counted as
1697 * "live" packets.
1698 */
1699 if (!track) {
1700 static fr_rate_limit_t tracking_failed;
1701 bool is_dup = false;
1702
1703 track = fr_io_track_add(client, &address, buffer, packet_len, recv_time, &is_dup);
1704 if (!track) {
1705 RATE_LIMIT_LOCAL(thread ? &thread->rate_limit.tracking_failed : &tracking_failed,
1706 ERROR, "Failed tracking packet from client %s - discarding it",
1707 client->radclient->shortname);
1708 return 0;
1709 }
1710
1711 /*
1712 * If there's a cached reply, just send that and don't do anything else.
1713 */
1714 if (is_dup) {
1715 fr_network_t *nr;
1716
1717 if (track->do_not_respond) {
1718 DEBUG("Ignoring retransmit from client %s - we are not responding to this request", client->radclient->shortname);
1719 return 0;
1720 }
1721
1722 if (track->discard) {
1723 DEBUG("Ignoring transmit from client %s - we previously received a newer / conflicting packet", client->radclient->shortname);
1724 return 0;
1725 }
1726
1727 if (!track->reply) {
1728 fr_assert(!track->finished);
1729 DEBUG("Ignoring retransmit from client %s - we are still processing the request", client->radclient->shortname);
1730 return 0;
1731 }
1732
1733 if (connection) {
1734 nr = connection->nr;
1735 } else {
1736 nr = thread->nr;
1737 }
1738
1739 /*
1740 * @todo - mark things up so that we know to keep 'track' around
1741 * until the packet is actually written to the network. OR, add
1742 * a network API so that the talloc_free() function can remove
1743 * the packet from the queue of packets to be retransmitted.
1744 *
1745 * Perhaps via having fr_network_listen_write() return a pointer
1746 * to the localized message, and then caching that in the tracking
1747 * structure.
1748 */
1749 DEBUG("Sending duplicate reply to client %s", client->radclient->shortname);
1750 fr_network_listen_write(nr, li, track->reply, track->reply_len,
1751 track, track->timestamp);
1752 return 0;
1753 }
1754
1755 /*
1756 * Got to free this if we don't process the packet.
1757 */
1758 to_free = track;
1759 }
1760
1761 /*
1762 * This is a pending dynamic client. See if we
1763 * have to either run the dynamic client code to
1764 * define the client, OR to push the packet onto
1765 * the pending queue for this client.
1766 */
1767 if (client->state == PR_CLIENT_PENDING) {
1768 /*
1769 * Track pending packets for the master
1770 * socket. Connected sockets are paused
1771 * as soon as they are defined, so we
1772 * won't be reading any more packets from
1773 * them.
1774 *
1775 * Since we don't have pending packets
1776 * for connected sockets, we don't need
1777 * to track pending packets.
1778 */
1779 if (!connection && inst->max_pending_packets && (thread->num_pending_packets >= inst->max_pending_packets)) {
1780 RATE_LIMIT_LOCAL(&thread->rate_limit.too_many_pending,
1781 ERROR, "Too many pending dynamic client packets for listener - discarding packet from %pV",
1782 fr_box_ipaddr(client->src_ipaddr));
1783
1784 discard:
1785 talloc_free(to_free);
1786 return 0;
1787 }
1788
1789 /*
1790 * Allocate the pending packet structure.
1791 */
1792 pending = fr_io_pending_alloc(connection, client, buffer, packet_len,
1793 track, priority);
1794 if (!pending) {
1795 static fr_rate_limit_t alloc_failed;
1796 RATE_LIMIT_LOCAL(thread ? &thread->rate_limit.alloc_failed : &alloc_failed,
1797 ERROR, "proto_%s - Failed allocating space for dynamic client %pV - discarding packet",
1798 inst->app_io->common.name, fr_box_ipaddr(client->src_ipaddr));
1799 goto discard;
1800 }
1801
1802 if (fr_heap_num_elements(client->pending) > 1) {
1803 DEBUG("Verification is still pending for dynamic client %pV - queuing additional packet(s)",
1804 fr_box_ipaddr(client->src_ipaddr));
1805 return 0;
1806 }
1807
1808 /*
1809 * Tell this packet that it's defining a
1810 * dynamic client.
1811 */
1812 track->dynamic = recv_time;
1813
1814 INFO("proto_%s - Verification started for packet from dynamic client %pV - queuing new packets",
1815 inst->app_io->common.name, fr_box_ipaddr(client->src_ipaddr));
1816 }
1817
1818 /*
1819 * Remove all cleanup timers for the client /
1820 * connection. It's still in use, so we don't
1821 * want to clean it up.
1822 */
1823 if (fr_timer_armed(client->ev)) {
1824 FR_TIMER_DELETE_RETURN(&client->ev);
1825 client->ready_to_delete = false;
1826 }
1827
1828 /*
1829 * Return the packet.
1830 */
1831 *recv_time_p = track->timestamp;
1832 *packet_ctx = track;
1833 return packet_len;
1834 }
1835
1836 /*
1837 *
1838 */
1839 fr_assert(!pending);
1840
1841 /*
1842 * This must be the main UDP socket which creates
1843 * connections.
1844 */
1845 fr_assert(inst->ipproto == IPPROTO_UDP);
1846
1847 /*
1848 * We're using connected sockets, but this socket isn't
1849 * connected. It must be the master socket. The master
1850 * can either be STATIC, DYNAMIC, or PENDING. Whatever
1851 * the state, the child socket will take care of handling
1852 * the packet. e.g. dynamic clients, etc.
1853 */
1854 {
1855 bool nak = false;
1856
1857 my_connection.address = &address;
1858
1859 pthread_mutex_lock(&client->mutex);
1860 connection = fr_hash_table_find(client->ht, &my_connection);
1861 if (connection) nak = (connection->client->state == PR_CLIENT_NAK);
1862 pthread_mutex_unlock(&client->mutex);
1863
1864 /*
1865 * The connection is in NAK state, ignore packets
1866 * for it.
1867 */
1868 if (nak) {
1869 RATE_LIMIT_LOCAL(&thread->rate_limit.repeat_nak, ERROR, "proto_%s - Discarding repeated packet from NAK'd dynamic client %pV",
1870 inst->app_io->common.name, fr_box_ipaddr(address.socket.inet.src_ipaddr));
1871
1872 DEBUG("Discarding packet to NAKed connection %s", connection->name);
1873 return 0;
1874 }
1875 }
1876
1877 /*
1878 * No existing connection, create one.
1879 */
1880 if (!connection) {
1881 connection = fr_io_connection_alloc(inst, thread, client, -1, &address, NULL);
1882 if (!connection) {
1883 RATE_LIMIT_LOCAL(&thread->rate_limit.conn_alloc_failed,
1884 ERROR, "Failed to allocate connection from client %s. Discarding packet.", client->radclient->shortname);
1885 return 0;
1886 }
1887 }
1888
1889 DEBUG("Sending packet to connection %s", connection->name);
1890
1891 /*
1892 * Inject the packet into the connected socket. It will
1893 * process the packet as if it came in from the network.
1894 *
1895 * @todo future - after creating the connection, put the
1896 * current packet into connection->pending, instead of
1897 * inject?, and then call fr_network_listen_read() from
1898 * the child's instantiation routine???
1899 *
1900 * @todo TCP - for ACCEPT sockets, we don't have a
1901 * packet, so don't do this. Instead, the connection
1902 * will take care of figuring out what to do.
1903 *
1904 * We don't need "to_free" after this, as it will be
1905 * tracked in the connected socket.
1906 */
1907 if (fr_network_listen_inject(connection->nr, connection->listen,
1908 buffer, packet_len, recv_time) < 0) {
1909 RATE_LIMIT_LOCAL(&thread->rate_limit.queue_full, PERROR,
1910 "proto_%s - Discarding packet from dynamic client %pV - cannot push packet to connected socket",
1911 inst->app_io->common.name, fr_box_ipaddr(address.socket.inet.src_ipaddr));
1912 /*
1913 * Don't return an error, because that will cause the listener to close its socket.
1914 */
1915 }
1916
1917 return 0;
1918}
1919
1920/** Inject a packet to a connection.
1921 *
1922 * Always called in the context of the network.
1923 */
1924static int mod_inject(fr_listen_t *li, uint8_t const *buffer, size_t buffer_len, fr_time_t recv_time)
1925{
1926 fr_io_instance_t const *inst;
1927 int priority;
1928 bool is_dup = false;
1929 fr_io_connection_t *connection;
1930 fr_io_pending_packet_t *pending;
1931 fr_io_track_t *track;
1932
1933 get_inst(li, &inst, NULL, &connection, NULL);
1934
1935 if (!connection) {
1936 DEBUG2("Received injected packet for an unconnected socket.");
1937 return -1;
1938 }
1939
1940 priority = inst->app->priority(inst, buffer, buffer_len);
1941 if (priority <= 0) {
1942 return -1;
1943 }
1944
1945 /*
1946 * Track this packet, because that's what mod_read expects.
1947 */
1948 track = fr_io_track_add(connection->client, connection->address,
1949 buffer, buffer_len, recv_time, &is_dup);
1950 if (!track) {
1951 DEBUG2("Failed injecting packet to tracking table");
1952 return -1;
1953 }
1954
1955 talloc_get_type_abort(track, fr_io_track_t);
1956
1957 /*
1958 * @todo future - what to do with duplicates?
1959 */
1960 fr_assert(!is_dup);
1961
1962 /*
1963 * Remember to restore this packet later.
1964 */
1965 pending = fr_io_pending_alloc(connection, connection->client, buffer, buffer_len,
1966 track, priority);
1967 if (!pending) {
1968 DEBUG2("Failed injecting packet due to allocation error");
1969 return -1;
1970 }
1971
1972 return 0;
1973}
1974
1975/** Open a new listener
1976 *
1977 */
1978static int mod_open(fr_listen_t *li)
1979{
1980 fr_io_thread_t *thread;
1981 fr_io_instance_t const *inst;
1982
1983 thread = li->thread_instance;
1984 inst = li->app_io_instance;
1985
1986 if (inst->app_io->open(thread->child) < 0) return -1;
1987
1988 li->fd = thread->child->fd; /* copy this back up */
1989
1990 /*
1991 * Set the name of the socket.
1992 */
1993 if (!li->app_io->get_name) {
1994 li->name = li->app_io->common.name;
1995 } else {
1996 li->name = li->app_io->get_name(li);
1997 }
1998
1999 /*
2000 * Note that we're opening a child socket, so we don't
2001 * put it into the list of global listeners.
2002 */
2003
2004 return 0;
2005}
2006
2007
2008/** Set the event list for a new socket
2009 *
2010 * @param[in] li the listener
2011 * @param[in] el the event list
2012 * @param[in] nr context from the network side
2013 */
2014static void mod_event_list_set(fr_listen_t *li, fr_event_list_t *el, void *nr)
2015{
2016 fr_io_instance_t const *inst;
2017 fr_io_connection_t *connection;
2018 fr_io_thread_t *thread;
2019 fr_listen_t *child;
2020
2021 get_inst(li, &inst, &thread, &connection, &child);
2022
2023 /*
2024 * We're not doing IO, so there are no timers for
2025 * cleaning up packets, dynamic clients, or connections.
2026 */
2027 if (!inst->submodule) return;
2028
2029 if (inst->app_io->event_list_set) {
2030 inst->app_io->event_list_set(child, el, nr);
2031 }
2032
2033 /*
2034 * Set event list and network side for this socket.
2035 */
2036 if (!connection) {
2037 thread->el = el;
2038 thread->nr = nr;
2039
2040 } else {
2041 connection->el = el;
2042 connection->nr = nr;
2043 }
2044}
2045
2046
2047static void client_expiry_timer(fr_timer_list_t *tl, fr_time_t now, void *uctx)
2048{
2049 fr_io_client_t *client = talloc_get_type_abort(uctx, fr_io_client_t);
2050 fr_io_instance_t const *inst;
2051 fr_io_connection_t *connection;
2052 fr_time_delta_t delay;
2053 int connections;
2054
2055 /*
2056 * No event list? We don't need to expire the client.
2057 */
2058 if (!tl) return;
2059
2060 // @todo - print out what we plan on doing next
2061 connection = client->connection;
2062 inst = client->inst;
2063
2064 fr_assert(client->state != PR_CLIENT_STATIC);
2065
2066 /*
2067 * Called from the read or write functions with
2068 * now==0, to signal that we have to *set* the timer.
2069 */
2070 if (fr_time_eq(now, fr_time_wrap(0))) {
2071 /*
2072 * The timer is already set, don't do anything.
2073 */
2074 if (fr_timer_armed(client->ev)) return;
2075
2076 switch (client->state) {
2077 case PR_CLIENT_CONNECTED:
2078 fr_assert(connection != NULL);
2079 FALL_THROUGH;
2080
2081 case PR_CLIENT_DYNAMIC:
2082 delay = inst->idle_timeout;
2083 if (fr_time_delta_ispos(client->radclient->limit.idle_timeout) &&
2084 (fr_time_delta_lt(client->radclient->limit.idle_timeout, inst->idle_timeout))) {
2085 delay = client->radclient->limit.idle_timeout;
2086 }
2087 break;
2088
2089 case PR_CLIENT_NAK:
2090 delay = inst->nak_lifetime;
2091 break;
2092
2093 default:
2094 fr_assert(0 == 1);
2095 return;
2096 }
2097
2098 DEBUG("TIMER - setting idle timeout to %pVs for connection from client %s", fr_box_time_delta(delay), client->radclient->shortname);
2099
2100 goto reset_timer;
2101 }
2102
2103 /*
2104 * It's a negative cache entry. Just delete it.
2105 */
2106 if (client->state == PR_CLIENT_NAK) {
2107 INFO("proto_%s - Expiring NAK'd dynamic client %pV - permitting new packets to be verified",
2108 inst->app_io->common.name, fr_box_ipaddr(client->src_ipaddr));
2109
2110 delete_client:
2111 fr_assert(client->packets == 0);
2112
2113 /*
2114 * It's a connected socket. Remove it from the
2115 * parents list of connections, and delete it.
2116 */
2117 if (connection) {
2118 pthread_mutex_lock(&connection->parent->mutex);
2119 if (connection->in_parent_hash) {
2120 connection->in_parent_hash = false;
2121 (void) fr_hash_table_delete(connection->parent->ht, connection);
2122 }
2123 pthread_mutex_unlock(&connection->parent->mutex);
2124
2125 /*
2126 * Mark the connection as dead, and tell
2127 * the network side to stop reading from
2128 * it.
2129 */
2130 connection->dead = true;
2131 fr_network_listen_read(connection->nr, connection->listen);
2132 return;
2133 }
2134
2135 talloc_free(client);
2136 return;
2137 }
2138
2139 DEBUG("TIMER - checking status of dynamic client %s %pV", client->radclient->shortname, fr_box_ipaddr(client->src_ipaddr));
2140
2141 /*
2142 * It's a dynamically defined client. If no one is using
2143 * it, clean it up after an idle timeout.
2144 */
2145 if ((client->state == PR_CLIENT_DYNAMIC) ||
2146 (client->state == PR_CLIENT_CONNECTED)) {
2147 if (client->packets > 0) {
2148 client->ready_to_delete = false;
2149 return;
2150 }
2151
2152 /*
2153 * No packets, check / set idle timeout.
2154 */
2155 goto idle_timeout;
2156 }
2157
2158 /*
2159 * The client is pending definition. It's either a
2160 * dynamic client which has timed out, OR it's a
2161 * "place-holder" client for connected sockets.
2162 */
2163 fr_assert(client->state == PR_CLIENT_PENDING);
2164
2165 /*
2166 * This is a dynamic client pending definition.
2167 * But it's taken too long to define, so we just
2168 * delete the client, and all packets for it. A
2169 * new packet will cause the dynamic definition
2170 * to be run again.
2171 */
2172 if (!client->use_connected) {
2173 if (!client->packets) {
2174 DEBUG("proto_%s - No packets are using unconnected socket %s", inst->app_io->common.name, connection->name);
2175 goto delete_client;
2176 }
2177
2178 /*
2179 * Tell the writer to NOT dynamically define the
2180 * client. We've run into a problem. Then,
2181 * return. The writer will take care of calling
2182 * us again when it notices that a PENDING client
2183 * is ready to delete.
2184 *
2185 * TBH... that shouldn't happen? We should rely
2186 * on the write to do this all of the time...
2187 */
2188 client->ready_to_delete = true;
2189 return;
2190 }
2191
2192 fr_assert(!connection);
2193
2194 /*
2195 * Find out how many connections are using this
2196 * client.
2197 */
2198 pthread_mutex_lock(&client->mutex);
2199 fr_assert(client->ht != NULL);
2200 connections = fr_hash_table_num_elements(client->ht);
2201 pthread_mutex_unlock(&client->mutex);
2202
2203 /*
2204 * No connections are using this client. If
2205 * we've passed the idle timeout, then just
2206 * delete it. Otherwise, set an idle timeout (as
2207 * above);
2208 */
2209 if (!connections) {
2210idle_timeout:
2211 /*
2212 * We didn't receive any packets during the
2213 * idle_timeout, just delete it.
2214 */
2215 if (client->ready_to_delete) {
2216 if (connection) {
2217 DEBUG("proto_%s - idle timeout for connection %s", inst->app_io->common.name, connection->name);
2218 } else {
2219 DEBUG("proto_%s - idle timeout for client %s", inst->app_io->common.name, client->radclient->shortname);
2220 }
2221 goto delete_client;
2222 }
2223
2224 /*
2225 * No packets and no idle timeout set, go set
2226 * idle timeut.
2227 */
2228 client->ready_to_delete = true;
2229 delay = inst->idle_timeout;
2230 goto reset_timer;
2231 }
2232
2233 /*
2234 * There are live sub-connections. Poll again after a
2235 * long period of time. Once all of the connections are
2236 * closed, we can then delete this client.
2237 *
2238 * @todo - maybe just leave it? we want to be able to
2239 * clean up this client after a while tho... especially
2240 * if the total number of clients is limited.
2241 */
2242 client->ready_to_delete = false;
2243 delay = inst->check_interval;
2244
2245reset_timer:
2246 if (fr_timer_in(client, tl, &client->ev,
2247 delay, false, client_expiry_timer, client) < 0) {
2248 ERROR("proto_%s - Failed adding timeout for dynamic client %s. It will be permanent!",
2249 inst->app_io->common.name, client->radclient->shortname);
2250 return;
2251 }
2252
2253 return;
2254}
2255
2256
2257/*
2258 * Expire cached packets after cleanup_delay time
2259 */
2260static void packet_expiry_timer(fr_timer_list_t *tl, fr_time_t now, void *uctx)
2261{
2262 fr_io_track_t *track = talloc_get_type_abort(uctx, fr_io_track_t);
2263 fr_io_client_t *client = track->client;
2264 fr_io_instance_t const *inst = client->inst;
2265
2266 /*
2267 * Insert the timer if requested.
2268 *
2269 * On duplicates this also extends the expiry timer.
2270 */
2271 if (fr_time_eq(now, fr_time_wrap(0)) && !track->discard && inst->app_io->track_duplicates) {
2272 fr_assert(fr_time_delta_ispos(inst->cleanup_delay));
2273 fr_assert(track->do_not_respond || track->reply_len);
2274
2275 track->expires = fr_time_add(fr_time(), inst->cleanup_delay);
2276
2277 /*
2278 * if the timer succeeds, then "track"
2279 * will be cleaned up when the timer
2280 * fires.
2281 */
2282 if (fr_timer_at(track, tl, &track->ev,
2283 track->expires,
2284 false, packet_expiry_timer, track) == 0) {
2285 DEBUG("proto_%s - cleaning up request in %.6fs", inst->app_io->common.name,
2286 fr_time_delta_unwrap(inst->cleanup_delay) / (double)NSEC);
2287 return;
2288 }
2289
2290 DEBUG("proto_%s - Failed adding cleanup_delay for packet. Discarding packet immediately",
2291 inst->app_io->common.name);
2292 }
2293
2294 /*
2295 * So that all cleanup paths can come here, not just the
2296 * timeout ones.
2297 */
2298 if (fr_time_neq(now, fr_time_wrap(0))) {
2299 DEBUG2("TIMER - proto_%s - cleanup delay", inst->app_io->common.name);
2300 } else {
2301 DEBUG2("proto_%s - cleaning up", inst->app_io->common.name);
2302 }
2303
2304 /*
2305 * Delete the tracking entry.
2306 */
2307 talloc_free(track);
2308
2309 /*
2310 * The client isn't dynamic, stop here.
2311 */
2312 if (client->state == PR_CLIENT_STATIC) return;
2313
2314 fr_assert(client->state != PR_CLIENT_NAK);
2315 fr_assert(client->state != PR_CLIENT_PENDING);
2316
2317 /*
2318 * If necessary, call the client expiry timer to clean up
2319 * the client.
2320 */
2321 if (client->packets == 0) {
2322 client_expiry_timer(tl, now, client);
2323 }
2324}
2325
2326static ssize_t mod_write(fr_listen_t *li, void *packet_ctx, fr_time_t request_time,
2327 uint8_t *buffer, size_t buffer_len, size_t written)
2328{
2329 fr_io_instance_t const *inst;
2330 fr_io_thread_t *thread;
2331 fr_io_connection_t *connection;
2332 fr_io_track_t *track = talloc_get_type_abort(packet_ctx, fr_io_track_t);
2333 fr_io_client_t *client;
2334 fr_client_t *radclient;
2335 fr_listen_t *child;
2336 fr_event_list_t *el;
2337 char const *name;
2338
2339 get_inst(li, &inst, &thread, &connection, &child);
2340
2341 client = track->client;
2342 if (connection) {
2343 el = connection->el;
2344 name = connection->name;
2345 } else {
2346 el = thread->el;
2347 name = li->name;
2348 }
2349
2350 DEBUG3("Processing reply for %s", name);
2351
2352 /*
2353 * A fully defined client means that we just send the reply.
2354 */
2355 if (client->state != PR_CLIENT_PENDING) {
2356 ssize_t packet_len;
2357
2358 track->finished = true;
2359
2360 /*
2361 * The request received a conflicting packet, so we
2362 * discard this one.
2363 */
2364 if (fr_time_neq(track->timestamp, request_time) || track->discard) {
2365 fr_assert(track->packets > 0);
2366 track->packets--;
2367 DEBUG3("Suppressing reply as we have a newer / conflicing packet from the same source");
2368 track->discard = true;
2369 goto setup_timer;
2370 }
2371
2372 /*
2373 * We have a NAK packet, or the request has timed
2374 * out, or it was discarded due to a conflicting
2375 * packet. We don't respond, but we do cache the
2376 * "do not respond" reply for a period of time.
2377 */
2378 if ((buffer_len == 1) || track->do_not_respond) {
2379 DEBUG3("Not sending response to request - it is marked as 'do not respond'");
2380 track->do_not_respond = true;
2381 goto setup_timer;
2382 }
2383
2384 /*
2385 * We have a real packet, write it to the network
2386 * via the underlying transport write.
2387 */
2388 packet_len = inst->app_io->write(child, track, request_time,
2389 buffer, buffer_len, written);
2390 if (packet_len <= 0) {
2391 ERROR("Failed writing the reply - not sending any response on %s", name);
2392 track->discard = true;
2393 packet_expiry_timer(el->tl, fr_time_wrap(0), track);
2394 return packet_len;
2395 }
2396
2397 /*
2398 * Only a partial write. The network code will
2399 * take care of calling us again, and we will set
2400 * the expiry timer at that point.
2401 */
2402 if ((size_t) packet_len < buffer_len) {
2403 DEBUG3("Partial write (%zd < %zu)", packet_len, buffer_len);
2404 return packet_len;
2405 }
2406
2407 /*
2408 * We're not tracking duplicates, so just expire
2409 * the packet now.
2410 */
2411 if (!inst->app_io->track_duplicates) {
2412 DEBUG3("Not tracking duplicates - expiring the request");
2413 goto setup_timer;
2414 }
2415
2416 /*
2417 * Cache the reply packet if we're doing dedup.
2418 *
2419 * On resend duplicate reply, the reply is
2420 * already filled out. So we don't do that twice.
2421 */
2422 if (!track->reply) {
2423 DEBUG3("Caching reply");
2424 MEM(track->reply = talloc_memdup(track, buffer, buffer_len));
2425 track->reply_len = buffer_len;
2426 }
2427
2428 /*
2429 * Set the timer to expire the packet.
2430 *
2431 * On dedup this also extends the timer.
2432 */
2433 setup_timer:
2434 packet_expiry_timer(el->tl, fr_time_wrap(0), track);
2435 return buffer_len;
2436 }
2437
2438 /*
2439 * The client is pending, so we MUST have dynamic clients.
2440 *
2441 * If there's a connected socket and no dynamic clients, then the
2442 * client state is set to CONNECTED when the client is created.
2443 */
2444 fr_assert(inst->dynamic_clients);
2445 fr_assert(client->pending != NULL);
2446
2447 /*
2448 * The request has timed out trying to define the dynamic
2449 * client. Oops... try again.
2450 */
2451 if ((buffer_len == 1) && (*buffer == true)) {
2452 DEBUG("Request has timed out trying to define a new client. Trying again.");
2453 goto reread;
2454 }
2455
2456 /*
2457 * The dynamic client was NOT defined. Set it's state to
2458 * NAK, delete all pending packets, and close the
2459 * tracking table.
2460 */
2461 if (buffer_len == 1) {
2462 INFO("proto_%s - Verification failed for packet from dynamic client %pV - adding IP address to the NAK cache",
2463 inst->app_io->common.name, fr_box_ipaddr(client->src_ipaddr));
2464
2465 client->state = PR_CLIENT_NAK;
2466 if (!connection) {
2467 client_pending_free(client);
2468 } else {
2469 TALLOC_FREE(client->pending);
2470 }
2471 if (client->table) TALLOC_FREE(client->table);
2472 fr_assert(client->packets == 0);
2473
2474 /*
2475 * If we're a connected UDP socket, allocate a
2476 * new connection which is the place-holder for
2477 * the NAK. We will reject packets from from the
2478 * src/dst IP/port.
2479 *
2480 * The timer will take care of deleting the NAK
2481 * connection (which doesn't have any FDs
2482 * associated with it). The network side will
2483 * call mod_close() when the original connection
2484 * is done, which will then free that connection,
2485 * too.
2486 */
2487 if (connection && (inst->ipproto == IPPROTO_UDP)) {
2488 connection = fr_io_connection_alloc(inst, thread, client, -1, connection->address, connection);
2489 client_expiry_timer(el->tl, fr_time_wrap(0), connection->client);
2490
2491 errno = ECONNREFUSED;
2492 return -1;
2493 }
2494
2495 /*
2496 * For connected TCP sockets, we just call the
2497 * expiry timer, which will close and free the
2498 * connection.
2499 */
2500 client_expiry_timer(el->tl, fr_time_wrap(0), client);
2501 return buffer_len;
2502 }
2503
2504 fr_assert(buffer_len == sizeof(radclient));
2505
2506 memcpy(&radclient, buffer, sizeof(radclient));
2507
2508 if (!connection) {
2509 fr_ipaddr_t ipaddr;
2510
2511 /*
2512 * Check the encapsulating network against the
2513 * address that the user wants to use, but only
2514 * for unconnected sockets.
2515 */
2516 if (client->network.af != radclient->ipaddr.af) {
2517 DEBUG("Client IP address %pV IP family does not match the source network %pV of the packet.",
2518 fr_box_ipaddr(radclient->ipaddr), fr_box_ipaddr(client->network));
2519 goto error;
2520 }
2521
2522 /*
2523 * Network prefix is more restrictive than the one given
2524 * by the client... that's bad.
2525 */
2526 if (client->network.prefix > radclient->ipaddr.prefix) {
2527 DEBUG("Client IP address %pV is not within the prefix with the defined network %pV",
2528 fr_box_ipaddr(radclient->ipaddr), fr_box_ipaddr(client->network));
2529 goto error;
2530 }
2531
2532 ipaddr = radclient->ipaddr;
2533 fr_ipaddr_mask(&ipaddr, client->network.prefix);
2534 if (fr_ipaddr_cmp(&ipaddr, &client->network) != 0) {
2535 DEBUG("Client IP address %pV is not within the defined network %pV.",
2536 fr_box_ipaddr(radclient->ipaddr), fr_box_ipaddr(client->network));
2537 goto error;
2538 }
2539
2540 /*
2541 * We can't define dynamic clients as networks (for now).
2542 *
2543 * @todo - If we did allow it, we would have to remove
2544 * this client from the trie, update it's IP address, and
2545 * re-add it. We can PROBABLY do this if this client
2546 * isn't already connected, AND radclient->use_connected
2547 * is true. But that's for later...
2548 */
2549 if (((radclient->ipaddr.af == AF_INET) &&
2550 (radclient->ipaddr.prefix != 32)) ||
2551 ((radclient->ipaddr.af == AF_INET6) &&
2552 (radclient->ipaddr.prefix != 128))) {
2553 ERROR("Cannot define a dynamic client as a network");
2554
2555 error:
2556 talloc_free(radclient);
2557
2558 /*
2559 * Remove the pending client from the trie.
2560 */
2561 fr_assert(!connection);
2562 talloc_free(client);
2563 return buffer_len;
2564 }
2565 }
2566
2567 /*
2568 * The new client is mostly OK. Copy the various fields
2569 * over.
2570 */
2571#define COPY_FIELD(_dest, _x) _dest->radclient->_x = radclient->_x
2572#define DUP_FIELD(_dest, _x) _dest->radclient->_x = talloc_strdup(_dest->radclient, radclient->_x)
2573
2574 /*
2575 * Only these two fields are set. Other strings in
2576 * radclient are copies of these ones.
2577 */
2578 talloc_const_free(client->radclient->shortname);
2579 talloc_const_free(client->radclient->secret);
2580
2581 DUP_FIELD(client, longname);
2582 DUP_FIELD(client, shortname);
2583 DUP_FIELD(client, secret);
2584 DUP_FIELD(client, nas_type);
2585
2586 COPY_FIELD(client, ipaddr);
2587 COPY_FIELD(client, src_ipaddr);
2588 COPY_FIELD(client, require_message_authenticator);
2589 COPY_FIELD(client, require_message_authenticator_is_set);
2590 COPY_FIELD(client, limit_proxy_state);
2591 COPY_FIELD(client, limit_proxy_state_is_set);
2592 COPY_FIELD(client, use_connected);
2593 COPY_FIELD(client, cs);
2594
2595 // @todo - fill in other fields?
2596
2597 talloc_free(radclient);
2598
2599 radclient = client->radclient; /* laziness */
2600 radclient->server_cs = inst->server_cs;
2601 radclient->server = cf_section_name2(inst->server_cs);
2602
2603 /*
2604 * This is a connected socket, and it's just been
2605 * allowed. Go poke the network side to read from the
2606 * socket.
2607 */
2608 if (connection) {
2609 fr_assert(connection != NULL);
2610 fr_assert(connection->client == client);
2611 fr_assert(client->connection != NULL);
2612
2613 client->state = PR_CLIENT_CONNECTED;
2614
2615 /*
2616 * Connections can't spawn new connections.
2617 */
2618 client->use_connected = radclient->use_connected = false;
2619
2620 /*
2621 * If we were paused. resume reading from the
2622 * connection.
2623 *
2624 * Note that the event list doesn't like resuming
2625 * a connection that isn't paused. It just sets
2626 * the read function to NULL.
2627 */
2628 if (connection->paused) {
2629 (void) fr_event_filter_update(el, child->fd,
2630 FR_EVENT_FILTER_IO, resume_read);
2631 }
2632
2633 connection->parent->radclient->active = true;
2634 fr_assert(connection->parent->state == PR_CLIENT_PENDING);
2635 connection->parent->state = PR_CLIENT_DYNAMIC;
2636
2637 DUP_FIELD(connection->parent, longname);
2638 DUP_FIELD(connection->parent, shortname);
2639 DUP_FIELD(connection->parent, secret);
2640 DUP_FIELD(connection->parent, nas_type);
2641
2642 COPY_FIELD(connection->parent, ipaddr);
2643 COPY_FIELD(connection->parent, src_ipaddr);
2644 COPY_FIELD(connection->parent, require_message_authenticator);
2645 COPY_FIELD(connection->parent, require_message_authenticator_is_set);
2646 COPY_FIELD(connection->parent, limit_proxy_state);
2647 COPY_FIELD(connection->parent, limit_proxy_state_is_set);
2648 COPY_FIELD(connection->parent, use_connected);
2649 COPY_FIELD(connection->parent, cs);
2650
2651 /*
2652 * Re-parent the conf section used to build this client
2653 * so its lifetime is linked to parent client
2654 */
2655 talloc_steal(connection->parent->radclient, connection->parent->radclient->cs);
2656
2657 /*
2658 * The client has been allowed.
2659 */
2660 client->state = PR_CLIENT_DYNAMIC;
2661 client->radclient->active = true;
2662
2663 INFO("proto_%s - Verification succeeded for packet from dynamic client %pV - processing queued packets",
2664 inst->app_io->common.name, fr_box_ipaddr(client->src_ipaddr));
2665 goto finish;
2666 } else {
2667 /*
2668 * Re-parent the conf section used to build this client
2669 * so its lifetime is linked to the client
2670 */
2671 talloc_steal(radclient, radclient->cs);
2672 }
2673
2674 fr_assert(connection == NULL);
2675 fr_assert(client->use_connected == false); /* we weren't sure until now */
2676
2677 /*
2678 * Disallow unsupported configurations.
2679 */
2680 if (radclient->use_connected && !inst->app_io->connection_set) {
2681 DEBUG("proto_%s - cannot use connected sockets as underlying 'transport = %s' does not support it.",
2682 inst->app_io->common.name, inst->submodule->module->exported->name);
2683 goto error;
2684 }
2685
2686
2687 /*
2688 * Dynamic clients can spawn new connections.
2689 */
2690 client->use_connected = radclient->use_connected;
2691
2692 /*
2693 * The admin has defined a client which uses connected
2694 * sockets. Go spawn it
2695 */
2696 if (client->use_connected) {
2697 fr_assert(connection == NULL);
2698
2699
2700 /*
2701 * Leave the state as PENDING. Each connection
2702 * will then cause a dynamic client to be
2703 * defined.
2704 */
2705 (void) pthread_mutex_init(&client->mutex, NULL);
2706 MEM(client->ht = fr_hash_table_alloc(client, connection_hash, connection_cmp, NULL));
2707
2708 } else {
2709 /*
2710 * The client has been allowed.
2711 */
2712 client->state = PR_CLIENT_DYNAMIC;
2713 client->radclient->active = true;
2714
2715 INFO("proto_%s - Verification succeeded for packet from dynamic client %pV - processing %d queued packets",
2716 inst->app_io->common.name, fr_box_ipaddr(client->src_ipaddr),
2717 fr_heap_num_elements(client->pending));
2718 }
2719
2720 /*
2721 * Add this client to the master socket, so that
2722 * mod_read() will see the pending client, pop the
2723 * pending packet, and process it.
2724 *
2725 */
2726 if (!thread->pending_clients) {
2727 MEM(thread->pending_clients = fr_heap_alloc(thread, pending_client_cmp,
2728 fr_io_client_t, pending_id, 0));
2729 }
2730
2731 fr_assert(!fr_heap_entry_inserted((client->pending_id)));
2732 (void) fr_heap_insert(&thread->pending_clients, client);
2733
2734finish:
2735 /*
2736 * Maybe we defined the client, but the original packet
2737 * timed out, so there's nothing more to do. In that case, set up the expiry timers.
2738 */
2739 if (client->packets == 0) {
2740 client_expiry_timer(el->tl, fr_time_wrap(0), client);
2741 }
2742
2743reread:
2744 /*
2745 * If there are pending packets (and there should be at
2746 * least one), tell the network socket to call our read()
2747 * function again.
2748 */
2749 if (fr_heap_num_elements(client->pending) > 0) {
2750 if (connection) {
2751 fr_network_listen_read(connection->nr, connection->listen);
2752 } else {
2753 fr_network_listen_read(thread->nr, thread->listen);
2754 }
2755 }
2756
2757 return buffer_len;
2758}
2759
2760/** Close the socket.
2761 *
2762 */
2763static int mod_close(fr_listen_t *li)
2764{
2765 fr_io_instance_t const *inst;
2766 fr_io_connection_t *connection;
2767 fr_listen_t *child;
2768
2769 get_inst(li, &inst, NULL, &connection, &child);
2770
2771 if (inst->app_io->close) {
2772 int ret;
2773
2774 ret = inst->app_io->close(child);
2775 if (ret < 0) return ret;
2776 } else {
2777 close(child->fd);
2778// child->fd = -1;
2779 }
2780
2781 if (!connection) return 0;
2782
2783 /*
2784 * We allocated this, so we're responsible for closing
2785 * it.
2786 */
2787 DEBUG("Closing connection %s", connection->name);
2788 if (connection->client->pending) {
2789 TALLOC_FREE(connection->client->pending); /* for any pending packets */
2790 }
2791
2792 /*
2793 * Remove connection from parent hash table
2794 */
2795 pthread_mutex_lock(&connection->parent->mutex);
2796 if (connection->in_parent_hash) {
2797 connection->in_parent_hash = false;
2798 (void) fr_hash_table_delete(connection->parent->ht, connection);
2799 }
2800 pthread_mutex_unlock(&connection->parent->mutex);
2801
2802 /*
2803 * Clean up listener
2804 */
2805 if (unlikely(fr_network_listen_delete(connection->nr, child) < 0)) {
2806 PERROR("Failed to delete connection %s", connection->name);
2807 }
2808
2809 talloc_free(connection->mi);
2810
2811 return 0;
2812}
2813
2814static int mod_instantiate(module_inst_ctx_t const *mctx)
2815{
2816 fr_io_instance_t *inst = mctx->mi->data;
2817 CONF_SECTION *conf = mctx->mi->conf;
2818
2819 inst->mi = mctx->mi;
2820 inst->app_io = (fr_app_io_t const *) inst->submodule->exported;
2821 inst->app_io_conf = inst->submodule->conf;
2822 inst->app_io_instance = inst->submodule->data;
2823
2824 /*
2825 * If we're not tracking duplicates then we don't need a
2826 * cleanup delay.
2827 *
2828 * If we are tracking duplicates, then we must have a non-zero cleanup delay.
2829 */
2830 if (!inst->app_io->track_duplicates) {
2831 inst->cleanup_delay = fr_time_delta_wrap(0);
2832
2833 } else {
2834 FR_TIME_DELTA_BOUND_CHECK("cleanup_delay", inst->cleanup_delay, >=, fr_time_delta_from_sec(1));
2835
2836 if (!inst->app_io->track_create) {
2837 cf_log_err(inst->app_io_conf, "Internal error: 'track_duplicates' is set, but there is no 'track create' function");
2838 return -1;
2839 }
2840 }
2841
2842 /*
2843 * Get various information after bootstrapping the
2844 * application IO module.
2845 */
2846 if (inst->app_io->network_get) {
2847 inst->app_io->network_get(&inst->ipproto, &inst->dynamic_clients, &inst->networks, inst->app_io_instance);
2848 }
2849
2850 if ((inst->ipproto == IPPROTO_TCP) && !inst->app_io->connection_set) {
2851 cf_log_err(inst->app_io_conf, "Missing 'connection set' API for proto_%s", inst->app_io->common.name);
2852 return -1;
2853 }
2854
2855 /*
2856 * Ensure that the dynamic client sections exist
2857 */
2858 if (inst->dynamic_clients) {
2859 CONF_SECTION *server = cf_item_to_section(cf_parent(conf));
2860
2861 if (!cf_section_find(server, "new", "client")) {
2862 cf_log_err(conf, "Cannot use 'dynamic_clients = yes' as the virtual server has no 'new client { ... }' section defined.");
2863 return -1;
2864 }
2865
2866 if (!cf_section_find(server, "add", "client")) {
2867 cf_log_warn(conf, "No 'add client { ... }' section was defined.");
2868 }
2869
2870 if (!cf_section_find(server, "deny", "client")) {
2871 cf_log_warn(conf, "No 'deny client { ... }' section was defined.");
2872 }
2873 }
2874
2875 /*
2876 * Create a list of client modules.
2877 *
2878 * FIXME - Probably only want to do this for connected sockets?
2879 *
2880 * FIXME - We probably want write protect enabled?
2881 */
2882 inst->clients = module_list_alloc(inst, &module_list_type_thread_local, "clients", false);
2883 module_list_mask_set(inst->clients, MODULE_INSTANCE_BOOTSTRAPPED);
2884
2885 return 0;
2886}
2887
2888
2889static char const *mod_name(fr_listen_t *li)
2890{
2891 fr_io_thread_t *thread;
2892 fr_io_connection_t *connection;
2893 fr_listen_t *child;
2894 fr_io_instance_t const *inst;
2895
2896 get_inst(li, &inst, &thread, &connection, &child);
2897
2898 fr_assert(child != NULL);
2899 return child->app_io->get_name(child);
2900}
2901
2902/** Create a trie from arrays of allow / deny IP addresses
2903 *
2904 * @param ctx the talloc ctx
2905 * @param af the address family to allow
2906 * @param allow the array of IPs / networks to allow. MUST be talloc'd
2907 * @param deny the array of IPs / networks to deny. MAY be NULL, MUST be talloc'd
2908 * @return
2909 * - fr_trie_t on success
2910 * - NULL on error
2911 */
2912fr_trie_t *fr_master_io_network(TALLOC_CTX *ctx, int af, fr_ipaddr_t *allow, fr_ipaddr_t *deny)
2913{
2914 fr_trie_t *trie;
2915 size_t i, num;
2916
2917 MEM(trie = fr_trie_alloc(ctx, NULL, NULL));
2918
2919 num = talloc_array_length(allow);
2920 fr_assert(num > 0);
2921
2922 for (i = 0; i < num; i++) {
2923 fr_ipaddr_t *network;
2924
2925 /*
2926 * Can't add v4 networks to a v6 socket, or vice versa.
2927 */
2928 if (allow[i].af != af) {
2929 fr_strerror_printf("Address family in entry %zd - 'allow = %pV' "
2930 "does not match 'ipaddr'", i + 1, fr_box_ipaddr(allow[i]));
2931 talloc_free(trie);
2932 return NULL;
2933 }
2934
2935 /*
2936 * Duplicates are bad.
2937 */
2938 network = fr_trie_match_by_key(trie,
2939 &allow[i].addr, allow[i].prefix);
2940 if (network) {
2941 fr_strerror_printf("Cannot add duplicate entry 'allow = %pV'",
2942 fr_box_ipaddr(allow[i]));
2943 talloc_free(trie);
2944 return NULL;
2945 }
2946
2947 /*
2948 * Look for overlapping entries.
2949 * i.e. the networks MUST be disjoint.
2950 *
2951 * Note that this catches 192.168.1/24
2952 * followed by 192.168/16, but NOT the
2953 * other way around. The best fix is
2954 * likely to add a flag to
2955 * fr_trie_alloc() saying "we can only
2956 * have terminal fr_trie_user_t nodes"
2957 */
2958 network = fr_trie_lookup_by_key(trie,
2959 &allow[i].addr, allow[i].prefix);
2960 if (network && (network->prefix <= allow[i].prefix)) {
2961 fr_strerror_printf("Cannot add overlapping entry 'allow = %pV'", fr_box_ipaddr(allow[i]));
2962 fr_strerror_const("Entry is completely enclosed inside of a previously defined network.");
2963 talloc_free(trie);
2964 return NULL;
2965 }
2966
2967 /*
2968 * Insert the network into the trie.
2969 * Lookups will return the fr_ipaddr_t of
2970 * the network.
2971 */
2972 if (fr_trie_insert_by_key(trie,
2973 &allow[i].addr, allow[i].prefix,
2974 &allow[i]) < 0) {
2975 fr_strerror_printf("Failed adding 'allow = %pV' to tracking table", fr_box_ipaddr(allow[i]));
2976 talloc_free(trie);
2977 return NULL;
2978 }
2979 }
2980
2981 /*
2982 * And now check denied networks.
2983 */
2984 num = talloc_array_length(deny);
2985 if (!num) return trie;
2986
2987 /*
2988 * Since the default is to deny, you can only add
2989 * a "deny" inside of a previous "allow".
2990 */
2991 for (i = 0; i < num; i++) {
2992 fr_ipaddr_t *network;
2993
2994 /*
2995 * Can't add v4 networks to a v6 socket, or vice versa.
2996 */
2997 if (deny[i].af != af) {
2998 fr_strerror_printf("Address family in entry %zd - 'deny = %pV' "
2999 "does not match 'ipaddr'", i + 1, fr_box_ipaddr(deny[i]));
3000 talloc_free(trie);
3001 return NULL;
3002 }
3003
3004 /*
3005 * Duplicates are bad.
3006 */
3007 network = fr_trie_match_by_key(trie,
3008 &deny[i].addr, deny[i].prefix);
3009 if (network) {
3010 fr_strerror_printf("Cannot add duplicate entry 'deny = %pV'", fr_box_ipaddr(deny[i]));
3011 talloc_free(trie);
3012 return NULL;
3013 }
3014
3015 /*
3016 * A "deny" can only be within a previous "allow".
3017 */
3018 network = fr_trie_lookup_by_key(trie,
3019 &deny[i].addr, deny[i].prefix);
3020 if (!network) {
3021 fr_strerror_printf("The network in entry %zd - 'deny = %pV' is not "
3022 "contained within a previous 'allow'", i + 1, fr_box_ipaddr(deny[i]));
3023 talloc_free(trie);
3024 return NULL;
3025 }
3026
3027 /*
3028 * We hack the AF in "deny" rules. If
3029 * the lookup gets AF_UNSPEC, then we're
3030 * adding a "deny" inside of a "deny".
3031 */
3032 if (network->af != af) {
3033 fr_strerror_printf("The network in entry %zd - 'deny = %pV' is overlaps "
3034 "with another 'deny' rule", i + 1, fr_box_ipaddr(deny[i]));
3035 talloc_free(trie);
3036 return NULL;
3037 }
3038
3039 /*
3040 * Insert the network into the trie.
3041 * Lookups will return the fr_ipaddr_t of
3042 * the network.
3043 */
3044 if (fr_trie_insert_by_key(trie,
3045 &deny[i].addr, deny[i].prefix,
3046 &deny[i]) < 0) {
3047 fr_strerror_printf("Failed adding 'deny = %pV' to tracking table", fr_box_ipaddr(deny[i]));
3048 talloc_free(trie);
3049 return NULL;
3050 }
3051
3052 /*
3053 * Hack it to make it a deny rule.
3054 */
3055 deny[i].af = AF_UNSPEC;
3056 }
3057
3058 return trie;
3059}
3060
3061
3062int fr_io_listen_free(fr_listen_t *li)
3063{
3064 if (!li->thread_instance) return 0;
3065
3066 talloc_free(li->thread_instance);
3067 return 0;
3068}
3069
3070int fr_master_io_listen(fr_io_instance_t *inst, fr_schedule_t *sc,
3071 size_t default_message_size, size_t num_messages)
3072{
3073 fr_listen_t *li, *child;
3074 fr_io_thread_t *thread;
3075
3076 /*
3077 * No IO paths, so we don't initialize them.
3078 */
3079 if (!inst->app_io) {
3080 fr_assert(!inst->dynamic_clients);
3081 return 0;
3082 }
3083
3084 if (!inst->app_io->common.thread_inst_size) {
3085 fr_strerror_const("IO modules MUST set 'thread_inst_size' when using the master IO handler.");
3086 return -1;
3087 }
3088
3089 /*
3090 * Build the #fr_listen_t. This describes the complete
3091 * path data takes from the socket to the decoder and
3092 * back again.
3093 */
3094 MEM(li = talloc_zero(NULL, fr_listen_t));
3095 talloc_set_destructor(li, fr_io_listen_free);
3096
3097 /*
3098 * The first listener is the one for the application
3099 * (e.g. RADIUS). However, we mangle the IO path to
3100 * point to the master IO handler. That allows all of
3101 * the high-level work (dynamic client checking,
3102 * connected sockets, etc.) to be handled by the master
3103 * IO handler.
3104 *
3105 * This listener is then passed to the network code,
3106 * which calls our trampoline functions to do the actual
3107 * work.
3108 */
3109 li->app = inst->app;
3110 li->app_instance = inst->app_instance;
3111 li->server_cs = inst->server_cs;
3112
3113 /*
3114 * Set configurable parameters for message ring buffer.
3115 */
3116 li->default_message_size = default_message_size;
3117 li->num_messages = num_messages;
3118
3119 /*
3120 * Per-socket data lives here.
3121 */
3122 thread = talloc_zero(NULL, fr_io_thread_t);
3123 thread->listen = li;
3124 thread->sc = sc;
3125
3126 /*
3127 * Create the trie of clients for this socket.
3128 */
3129 MEM(thread->trie = fr_trie_alloc(thread, NULL, NULL));
3130
3131 if (inst->dynamic_clients) {
3132 MEM(thread->alive_clients = fr_heap_alloc(thread, alive_client_cmp,
3133 fr_io_client_t, alive_id, 0));
3134 }
3135
3136 /*
3137 * Set the listener to call our master trampoline function.
3138 */
3139 li->app_io = &fr_master_app_io;
3140 li->thread_instance = thread;
3141 li->app_io_instance = inst;
3142 li->track_duplicates = inst->app_io->track_duplicates;
3143
3144 /*
3145 * The child listener points to the *actual* IO path.
3146 *
3147 * We need to create a complete listener here (e.g.
3148 * RADIUS + RADIUS_UDP), because the underlying IO
3149 * functions expect to get passed a full listener.
3150 *
3151 * Once the network side calls us, we will call the child
3152 * listener to do the actual IO.
3153 */
3154 child = thread->child = talloc_zero(li, fr_listen_t);
3155 memcpy(child, li, sizeof(*child));
3156
3157 /*
3158 * Reset these fields to point to the IO instance data.
3159 */
3160 child->app_io = inst->app_io;
3161 child->track_duplicates = inst->app_io->track_duplicates;
3162
3163 if (child->app_io->common.thread_inst_size > 0) {
3164 child->thread_instance = talloc_zero_array(NULL, uint8_t,
3165 inst->app_io->common.thread_inst_size);
3166 talloc_set_destructor(child, fr_io_listen_free);
3167
3168 talloc_set_name(child->thread_instance, "proto_%s_thread_t",
3169 inst->app_io->common.name);
3170
3171 /*
3172 * This is "const", and the user can't
3173 * touch it. So we just reuse the same
3174 * configuration everywhere.
3175 */
3176 child->app_io_instance = inst->app_io_instance;
3177
3178 } else {
3179 child->thread_instance = inst->app_io_instance;
3180 child->app_io_instance = child->thread_instance;
3181 }
3182
3183 /*
3184 * Don't call connection_set() for the main socket. It's
3185 * not connected. Instead, tell the IO path to open the
3186 * socket for us.
3187 */
3188 if (inst->app_io->open(child) < 0) {
3189 cf_log_err(inst->app_io_conf, "Failed opening %s interface", inst->app_io->common.name);
3190 talloc_free(li);
3191 return -1;
3192 }
3193
3194 li->fd = child->fd; /* copy this back up */
3195
3196 if (!child->app_io->get_name) {
3197 child->name = child->app_io->common.name;
3198 } else {
3199 child->name = child->app_io->get_name(child);
3200 }
3201 li->name = child->name;
3202
3203 /*
3204 * Record which socket we opened.
3205 */
3206 if (child->app_io_addr) {
3207 fr_listen_t *other;
3208
3209 other = listen_find_any(thread->child);
3210 if (other) {
3211 ERROR("Failed opening %s - that port is already in use by another listener in server %s { ... } - %s",
3212 child->name, cf_section_name2(other->server_cs), other->name);
3213
3214 ERROR("got socket %d %d\n", child->app_io_addr->inet.src_port, other->app_io_addr->inet.src_port);
3215
3216 talloc_free(li);
3217 return -1;
3218 }
3219
3220 (void) listen_record(child);
3221 }
3222
3223 /*
3224 * Add the socket to the scheduler, where it might end up
3225 * in a different thread.
3226 */
3227 if (!fr_schedule_listen_add(sc, li)) {
3228 talloc_free(li);
3229 return -1;
3230 }
3231
3232 return 0;
3233}
3234
3235/*
3236 * Used to create a tracking structure for fr_network_sendto_worker()
3237 */
3238fr_io_track_t *fr_master_io_track_alloc(fr_listen_t *li, fr_client_t *radclient, fr_ipaddr_t const *src_ipaddr, int src_port,
3239 fr_ipaddr_t const *dst_ipaddr, int dst_port)
3240{
3241 fr_io_instance_t const *inst;
3242 fr_io_thread_t *thread;
3243 fr_io_connection_t *connection;
3244 fr_listen_t *child;
3245 fr_io_track_t *track;
3246 fr_io_client_t *client;
3247 fr_io_address_t *address;
3248 fr_listen_t *parent = talloc_parent(li);
3249
3250 (void) talloc_get_type_abort(parent, fr_listen_t);
3251
3252 get_inst(parent, &inst, &thread, &connection, &child);
3253
3254 fr_assert(child == li);
3255
3256 if (unlikely(!thread)) return NULL;
3257 fr_assert(thread->trie != NULL);
3258
3259 client = fr_trie_lookup_by_key(thread->trie, &src_ipaddr->addr, src_ipaddr->prefix);
3260 if (!client) {
3261 MEM(client = client_alloc(thread, PR_CLIENT_STATIC, inst, thread, radclient, NULL));
3262 }
3263
3264 MEM(track = talloc_zero_pooled_object(client, fr_io_track_t, 1, sizeof(*track) + sizeof(track->address) + 64));
3265 MEM(track->address = address = talloc_zero(track, fr_io_address_t));
3266 track->client = client;
3267
3268 address->socket.inet.src_port = src_port;
3269 address->socket.inet.dst_port = dst_port;
3270
3271 address->socket.inet.src_ipaddr = *src_ipaddr;
3272 address->socket.inet.dst_ipaddr = *dst_ipaddr;
3273 address->radclient = radclient;
3274
3275 return track;
3276}
3277
3278
3279fr_app_io_t fr_master_app_io = {
3280 .common = {
3281 .magic = MODULE_MAGIC_INIT,
3282 .name = "radius_master_io",
3283
3284 .instantiate = mod_instantiate,
3285 },
3286 .default_message_size = 4096,
3287 .track_duplicates = true,
3288
3289 .read = mod_read,
3290 .write = mod_write,
3291 .inject = mod_inject,
3292
3293 .open = mod_open,
3294 .close = mod_close,
3295 .event_list_set = mod_event_list_set,
3296 .get_name = mod_name,
3297};
buffer
static int const char char buffer[256]
Definition acutest.h:576
msg
log_entry msg
Definition acutest.h:794
fr_app_io_t::common
module_t common
Common fields to all loadable modules.
Definition app_io.h:34
fr_app_io_t::track_create
fr_io_track_create_t track_create
create a tracking structure
Definition app_io.h:64
fr_app_io_t::track_duplicates
bool track_duplicates
track duplicate packets
Definition app_io.h:41
fr_app_io_t::get_name
fr_io_name_t get_name
get the socket name
Definition app_io.h:70
fr_app_io_t::track_compare
fr_io_track_cmp_t track_compare
compare two tracking structures
Definition app_io.h:65
fr_app_io_t
Public structure describing an I/O path for a protocol.
Definition app_io.h:33
FALL_THROUGH
#define FALL_THROUGH
clang 10 doesn't recognised the FALL-THROUGH comment anymore
Definition build.h:324
CMP_PREFER_SMALLER
#define CMP_PREFER_SMALLER(_a, _b)
Evaluates to +1 for a > b, and -1 for a < b.
Definition build.h:104
CMP_PREFER_LARGER
#define CMP_PREFER_LARGER(_a, _b)
Evaluates to -1 for a > b, and +1 for a < b.
Definition build.h:108
CMP_RETURN
#define CMP_RETURN(_a, _b, _field)
Return if the comparison is not 0 (is unequal)
Definition build.h:121
CMP
#define CMP(_a, _b)
Same as CMP_PREFER_SMALLER use when you don't really care about ordering, you just want an ordering.
Definition build.h:112
unlikely
#define unlikely(_x)
Definition build.h:383
UNUSED
#define UNUSED
Definition build.h:317
FR_TIME_DELTA_BOUND_CHECK
#define FR_TIME_DELTA_BOUND_CHECK(_name, _var, _op, _bound)
Definition cf_parse.h:529
cf_section
A section grouping multiple CONF_PAIR.
Definition cf_priv.h:101
cf_section_name2
char const * cf_section_name2(CONF_SECTION const *cs)
Return the second identifier of a CONF_SECTION.
Definition cf_util.c:1184
cf_section_name1
char const * cf_section_name1(CONF_SECTION const *cs)
Return the second identifier of a CONF_SECTION.
Definition cf_util.c:1170
cf_section_find
CONF_SECTION * cf_section_find(CONF_SECTION const *cs, char const *name1, char const *name2)
Find a CONF_SECTION with name1 and optionally name2.
Definition cf_util.c:1027
cf_item_to_section
CONF_SECTION * cf_item_to_section(CONF_ITEM const *ci)
Cast a CONF_ITEM to a CONF_SECTION.
Definition cf_util.c:683
cf_section_dup
CONF_SECTION * cf_section_dup(TALLOC_CTX *ctx, CONF_SECTION *parent, CONF_SECTION const *cs, char const *name1, char const *name2, bool copy_meta)
Duplicate a configuration section.
Definition cf_util.c:927
cf_log_err
#define cf_log_err(_cf, _fmt,...)
Definition cf_util.h:289
cf_parent
#define cf_parent(_cf)
Definition cf_util.h:101
cf_log_warn
#define cf_log_warn(_cf, _fmt,...)
Definition cf_util.h:290
PRIORITY_NORMAL
#define PRIORITY_NORMAL
Definition channel.h:151
MEM
#define MEM(x)
Definition debug.h:36
ERROR
#define ERROR(fmt,...)
Definition dhcpclient.c:41
DEBUG
#define DEBUG(fmt,...)
Definition dhcpclient.c:39
value
Test enumeration values.
Definition dict_test.h:92
MODULE_MAGIC_INIT
#define MODULE_MAGIC_INIT
Stop people using different module/library/server versions together.
Definition dl_module.h:63
FR_EVENT_FILTER_IO
@ FR_EVENT_FILTER_IO
Combined filter for read/write functions/.
Definition event.h:84
fr_event_filter_update
#define fr_event_filter_update(...)
Definition event.h:240
FR_EVENT_RESUME
#define FR_EVENT_RESUME(_s, _f)
Re-add the filter for a func from kevent.
Definition event.h:132
FR_EVENT_SUSPEND
#define FR_EVENT_SUSPEND(_s, _f)
Temporarily remove the filter for a func from kevent.
Definition event.h:116
fr_event_io_func_t
Callbacks for the FR_EVENT_FILTER_IO filter.
Definition event.h:189
fr_event_update_t
Structure describing a modification to a filter's state.
Definition event.h:97
fr_hash_table_find
void * fr_hash_table_find(fr_hash_table_t *ht, void const *data)
Find data in a hash table.
Definition hash.c:429
fr_hash_update
uint32_t fr_hash_update(void const *data, size_t size, uint32_t hash)
Definition hash.c:846
fr_hash
uint32_t fr_hash(void const *data, size_t size)
Definition hash.c:812
fr_hash_table_insert
bool fr_hash_table_insert(fr_hash_table_t *ht, void const *data)
Insert data into a hash table.
Definition hash.c:468
fr_hash_table_delete
bool fr_hash_table_delete(fr_hash_table_t *ht, void const *data)
Remove and free data (if a free function was specified)
Definition hash.c:594
fr_hash_table_num_elements
uint32_t fr_hash_table_num_elements(fr_hash_table_t *ht)
Definition hash.c:610
fr_hash_table_s
Definition hash.c:50
fr_hash_table_alloc
#define fr_hash_table_alloc(_ctx, _hash_node, _cmp_node, _free_node)
Definition hash.h:58
fr_heap_insert
int fr_heap_insert(fr_heap_t **hp, void *data)
Insert a new element into the heap.
Definition heap.c:146
fr_heap_pop
void * fr_heap_pop(fr_heap_t **hp)
Remove a node from the heap.
Definition heap.c:322
fr_heap_extract
int fr_heap_extract(fr_heap_t **hp, void *data)
Remove a node from the heap.
Definition heap.c:239
fr_heap_index_t
unsigned int fr_heap_index_t
Definition heap.h:80
fr_heap_peek
static void * fr_heap_peek(fr_heap_t *h)
Return the item from the top of the heap but don't pop it.
Definition heap.h:136
fr_heap_alloc
#define fr_heap_alloc(_ctx, _cmp, _type, _field, _init)
Creates a heap that can be used with non-talloced elements.
Definition heap.h:100
fr_heap_entry_inserted
static bool fr_heap_entry_inserted(fr_heap_index_t heap_idx)
Check if an entry is inserted into a heap.
Definition heap.h:124
fr_heap_num_elements
static unsigned int fr_heap_num_elements(fr_heap_t *h)
Return the number of elements in the heap.
Definition heap.h:179
FR_HEAP_INDEX_INVALID
#define FR_HEAP_INDEX_INVALID
Definition heap.h:83
fr_heap_t
The main heap structure.
Definition heap.h:66
fr_ipaddr_from_sockaddr
int fr_ipaddr_from_sockaddr(fr_ipaddr_t *ipaddr, uint16_t *port, struct sockaddr_storage const *sa, socklen_t salen)
Convert sockaddr to our internal ip address representation.
Definition inet.c:1442
fr_ipaddr_to_sockaddr
int fr_ipaddr_to_sockaddr(struct sockaddr_storage *sa, socklen_t *salen, fr_ipaddr_t const *ipaddr, uint16_t port)
Convert our internal ip address representation to a sockaddr.
Definition inet.c:1393
fr_ipaddr_cmp
int8_t fr_ipaddr_cmp(fr_ipaddr_t const *a, fr_ipaddr_t const *b)
Compare two ip addresses.
Definition inet.c:1347
fr_ipaddr_mask
void fr_ipaddr_mask(fr_ipaddr_t *addr, uint8_t prefix)
Zeroes out the host portion of an fr_ipaddr_t.
Definition inet.c:218
fr_ipaddr_t::prefix
uint8_t prefix
Prefix length - Between 0-32 for IPv4 and 0-128 for IPv6.
Definition inet.h:69
fr_ipaddr_t::af
int af
Address family.
Definition inet.h:64
fr_ipaddr_t::addr
union fr_ipaddr_t::@135 addr
fr_ipaddr_t
IPv4/6 prefix.
Definition merged_model.c:266
fr_io_address_t::socket
fr_socket_t socket
src/dst ip and port.
Definition base.h:336
fr_io_address_t::radclient
fr_client_t const * radclient
old-style client definition
Definition base.h:338
fr_io_address_t
Definition base.h:335
fr_listen::num_messages
size_t num_messages
for the message ring buffer
Definition listen.h:53
fr_listen::name
char const * name
printable name for this socket - set by open
Definition listen.h:29
fr_listen::track_duplicates
bool track_duplicates
do we track duplicate packets?
Definition listen.h:44
fr_listen::app_io_addr
fr_socket_t * app_io_addr
for tracking duplicate sockets
Definition listen.h:36
fr_listen::app_instance
void const * app_instance
Definition listen.h:39
fr_listen::default_message_size
size_t default_message_size
copied from app_io, but may be changed
Definition listen.h:52
fr_listen::connected
bool connected
is this for a connected socket?
Definition listen.h:43
fr_listen::app
fr_app_t const * app
Definition listen.h:38
fr_listen::app_io_instance
void const * app_io_instance
I/O path configuration context.
Definition listen.h:33
fr_listen::server_cs
CONF_SECTION * server_cs
CONF_SECTION of the server.
Definition listen.h:41
fr_listen::thread_instance
void * thread_instance
thread / socket context
Definition listen.h:34
fr_listen::fd
int fd
file descriptor for this socket - set by open
Definition listen.h:28
fr_listen::app_io
fr_app_io_t const * app_io
I/O path functions.
Definition listen.h:32
fr_listen
Definition listen.h:25
fr_network_listen_delete
int fr_network_listen_delete(fr_network_t *nr, fr_listen_t *li)
Delete a socket from a network.
Definition network.c:271
fr_network_listen_inject
int fr_network_listen_inject(fr_network_t *nr, fr_listen_t *li, uint8_t const *packet, size_t packet_len, fr_time_t recv_time)
Inject a packet for a listener to read.
Definition network.c:410
fr_network_listen_read
void fr_network_listen_read(fr_network_t *nr, fr_listen_t *li)
Signal the network to read from a listener.
Definition network.c:336
fr_network_listen_write
void fr_network_listen_write(fr_network_t *nr, fr_listen_t *li, uint8_t const *packet, size_t packet_len, void *packet_ctx, fr_time_t request_time)
Inject a packet for a listener to write.
Definition network.c:362
fr_network_s
Definition network.c:112
fr_client_s::server
char const * server
Name of the virtual server client is associated with.
Definition client.h:128
fr_client_s::ipaddr
fr_ipaddr_t ipaddr
IPv4/IPv6 address of the host.
Definition client.h:83
fr_client_s::secret
char const * secret
Secret PSK.
Definition client.h:90
fr_client_s::active
bool active
for dynamic clients
Definition client.h:119
fr_client_s::src_ipaddr
fr_ipaddr_t src_ipaddr
IPv4/IPv6 address to send responses from (family must match ipaddr).
Definition client.h:84
fr_client_s::nas_type
char const * nas_type
Type of client (arbitrary).
Definition client.h:126
fr_client_s::proto
int proto
Protocol number.
Definition client.h:142
fr_client_s::cs
CONF_SECTION * cs
CONF_SECTION that was parsed to generate the client.
Definition client.h:133
fr_client_s::dynamic
bool dynamic
Whether the client was dynamically defined.
Definition client.h:118
fr_client_s::longname
char const * longname
Client identifier.
Definition client.h:87
fr_client_s::limit
fr_socket_limit_t limit
Connections per client (TCP clients only).
Definition client.h:143
fr_client_s::shortname
char const * shortname
Client nickname.
Definition client.h:88
fr_client_s::use_connected
bool use_connected
do we use connected sockets for this client
Definition client.h:120
fr_client_s::server_cs
CONF_SECTION * server_cs
Virtual server that the client is associated with.
Definition client.h:129
fr_client_s
Describes a host allowed to send packets to the server.
Definition client.h:80
PERROR
#define PERROR(_fmt,...)
Definition log.h:228
DEBUG3
#define DEBUG3(_fmt,...)
Definition log.h:266
RATE_LIMIT_LOCAL
#define RATE_LIMIT_LOCAL(_entry, _log, _fmt,...)
Rate limit messages using a local limiting entry.
Definition log.h:569
fr_rate_limit_t
Track when a log message was last repeated.
Definition log.h:547
talloc_free
talloc_free(reap)
fr_event_list_s
Stores all information relating to an event list.
Definition event.c:377
fr_io_thread_t::child
fr_listen_t * child
The child (app_io) IO path.
Definition master.c:45
fr_io_connection_s::nr
fr_network_t * nr
network for this connection
Definition master.c:167
alive_client_cmp
static int8_t alive_client_cmp(void const *one, void const *two)
Definition master.c:1304
fr_io_client_s::in_trie
bool in_trie
is the client in the trie?
Definition master.c:126
fr_io_pending_alloc
static fr_io_pending_packet_t * fr_io_pending_alloc(fr_io_connection_t *connection, fr_io_client_t *client, uint8_t const *buffer, size_t packet_len, fr_io_track_t *track, int priority)
Definition master.c:1259
fr_io_connection_s::paused
bool paused
event filter doesn't like resuming something that isn't paused
Definition master.c:164
fr_io_connection_s::in_parent_hash
bool in_parent_hash
for tracking thread issues
Definition master.c:165
radclient_clone
static fr_client_t * radclient_clone(TALLOC_CTX *ctx, fr_client_t const *parent)
Definition master.c:388
mod_read
static ssize_t mod_read(fr_listen_t *li, void **packet_ctx, fr_time_t *recv_time_p, uint8_t *buffer, size_t buffer_len, size_t *leftover)
Implement 99% of the read routines.
Definition master.c:1316
fr_io_connection_s::packets
int packets
number of packets using this connection
Definition master.c:155
fr_io_thread_t::num_pending_packets
uint32_t num_pending_packets
number of pending packets
Definition master.c:50
DUP_FIELD
#define DUP_FIELD(_x)
track_dedup_free
static int track_dedup_free(fr_io_track_t *track)
Definition master.c:191
fr_io_client_s::table
fr_rb_tree_t * table
tracking table for packets
Definition master.c:131
fr_io_pending_packet_t::recv_time
fr_time_t recv_time
Definition master.c:73
pending_packet_cmp
static int8_t pending_packet_cmp(void const *one, void const *two)
Definition master.c:207
fr_io_thread_t::pending_clients
fr_heap_t * pending_clients
heap of pending clients
Definition master.c:41
fr_io_track_add
static fr_io_track_t * fr_io_track_add(fr_io_client_t *client, fr_io_address_t *address, uint8_t const *packet, size_t packet_len, fr_time_t recv_time, bool *is_dup)
Definition master.c:1085
fr_io_client_s::ready_to_delete
bool ready_to_delete
are we ready to delete this client?
Definition master.c:125
_client_live_free
static int _client_live_free(fr_io_client_t *client)
Definition master.c:957
fr_io_client_s::pending_id
fr_heap_index_t pending_id
for pending clients
Definition master.c:121
pending_free
static int pending_free(fr_io_pending_packet_t *pending)
Definition master.c:1235
fr_io_client_s::use_connected
bool use_connected
does this client allow connected sub-sockets?
Definition master.c:124
fr_io_connection_s::client
fr_io_client_t * client
our local client (pending or connected).
Definition master.c:159
track_free
static int track_free(fr_io_track_t *track)
Definition master.c:180
fr_master_app_io
fr_app_io_t fr_master_app_io
Definition master.c:3279
packet_expiry_timer
static void packet_expiry_timer(fr_timer_list_t *tl, fr_time_t now, void *uctx)
Definition master.c:2260
fr_io_thread_t::listen
fr_listen_t * listen
The master IO path.
Definition master.c:44
pending_client_cmp
static int8_t pending_client_cmp(void const *one, void const *two)
Definition master.c:237
fr_master_io_track_alloc
fr_io_track_t * fr_master_io_track_alloc(fr_listen_t *li, fr_client_t *radclient, fr_ipaddr_t const *src_ipaddr, int src_port, fr_ipaddr_t const *dst_ipaddr, int dst_port)
Definition master.c:3238
fr_io_connection_s::address
fr_io_address_t * address
full information about the connection.
Definition master.c:156
address_cmp
static int8_t address_cmp(void const *one, void const *two)
Definition master.c:255
fr_io_connection_s::child
fr_listen_t * child
child listener (app_io) for this socket
Definition master.c:158
fr_io_connection_s::listen
fr_listen_t * listen
master listener for this socket
Definition master.c:157
fr_io_client_s::ev
fr_timer_t * ev
when we clean up the client
Definition master.c:130
fr_io_thread_t::nr
fr_network_t * nr
network for the master socket
Definition master.c:38
fr_master_io_network
fr_trie_t * fr_master_io_network(TALLOC_CTX *ctx, int af, fr_ipaddr_t *allow, fr_ipaddr_t *deny)
Create a trie from arrays of allow / deny IP addresses.
Definition master.c:2912
pending_packet_pop
static fr_io_pending_packet_t * pending_packet_pop(fr_io_thread_t *thread)
Definition master.c:350
fr_io_client_s::network
fr_ipaddr_t network
network for dynamic clients
Definition master.c:117
mod_event_list_set
static void mod_event_list_set(fr_listen_t *li, fr_event_list_t *el, void *nr)
Set the event list for a new socket.
Definition master.c:2014
mod_open
static int mod_open(fr_listen_t *li)
Open a new listener.
Definition master.c:1978
fr_io_client_s::mutex
pthread_mutex_t mutex
for parent / child signaling
Definition master.c:136
fr_io_pending_packet_t::heap_id
fr_heap_index_t heap_id
Definition master.c:71
client_alloc
static fr_io_client_t * client_alloc(TALLOC_CTX *ctx, fr_io_client_state_t state, fr_io_instance_t const *inst, fr_io_thread_t *thread, fr_client_t *radclient, fr_ipaddr_t const *network)
Allocate a dynamic client.
Definition master.c:980
fr_io_client_s::inst
fr_io_instance_t const * inst
parent instance for master IO handler
Definition master.c:128
LOG_IGNORED_CLIENTS
#define LOG_IGNORED_CLIENTS(_inst)
COPY_FIELD
#define COPY_FIELD(_x)
fr_io_thread_t::trie
fr_trie_t * trie
trie of clients
Definition master.c:40
client_expiry_timer
static void client_expiry_timer(fr_timer_list_t *tl, fr_time_t now, void *uctx)
Definition master.c:2047
fr_io_client_state_t
fr_io_client_state_t
Client states.
Definition master.c:83
PR_CLIENT_DYNAMIC
@ PR_CLIENT_DYNAMIC
dynamically defined client
Definition master.c:87
PR_CLIENT_CONNECTED
@ PR_CLIENT_CONNECTED
dynamically defined client in a connected socket
Definition master.c:88
PR_CLIENT_PENDING
@ PR_CLIENT_PENDING
dynamic client pending definition
Definition master.c:89
PR_CLIENT_INVALID
@ PR_CLIENT_INVALID
Definition master.c:84
PR_CLIENT_NAK
@ PR_CLIENT_NAK
negative cache entry
Definition master.c:86
PR_CLIENT_STATIC
@ PR_CLIENT_STATIC
static / global clients
Definition master.c:85
get_inst
static void get_inst(fr_listen_t *li, fr_io_instance_t const **inst, fr_io_thread_t **thread, fr_io_connection_t **connection, fr_listen_t **child)
Definition master.c:909
pause_read
static fr_event_update_t pause_read[]
Definition master.c:170
track_connected_cmp
static int8_t track_connected_cmp(void const *one, void const *two)
Definition master.c:324
fr_io_thread_t::alive_clients
fr_heap_t * alive_clients
heap of active dynamic clients
Definition master.c:42
fr_io_thread_t::sc
fr_schedule_t * sc
the scheduler
Definition master.c:46
fr_io_connection_alloc
static fr_io_connection_t * fr_io_connection_alloc(fr_io_instance_t const *inst, fr_io_thread_t *thread, fr_io_client_t *client, int fd, fr_io_address_t *address, fr_io_connection_t *nak)
Create a new connection.
Definition master.c:513
fr_io_client_s::addresses
fr_hash_table_t * addresses
list of src/dst addresses used by this client
Definition master.c:134
fr_master_io_listen
int fr_master_io_listen(fr_io_instance_t *inst, fr_schedule_t *sc, size_t default_message_size, size_t num_messages)
Definition master.c:3070
connection_free
static int connection_free(fr_io_connection_t *connection)
Definition master.c:498
fr_io_thread_t::rate_limit
struct fr_io_thread_t::@38 rate_limit
fr_io_listen_free
int fr_io_listen_free(fr_listen_t *li)
Definition master.c:3062
fr_io_connection_s::name
char const * name
taken from proto_FOO_TRANSPORT
Definition master.c:154
fr_io_client_s::alive_id
fr_heap_index_t alive_id
for all clients
Definition master.c:122
fr_io_connection_s::el
fr_event_list_t * el
event list for this connection
Definition master.c:166
fr_io_client_s::state
fr_io_client_state_t state
state of this client
Definition master.c:115
fr_io_client_s::packets
int packets
number of packets using this client
Definition master.c:120
mod_write
static ssize_t mod_write(fr_listen_t *li, void *packet_ctx, fr_time_t request_time, uint8_t *buffer, size_t buffer_len, size_t written)
Definition master.c:2326
fr_io_connection_s::dead
bool dead
roundabout way to get the network side to close a socket
Definition master.c:163
fr_io_thread_t::el
fr_event_list_t * el
event list, for the master socket.
Definition master.c:37
fr_io_thread_t::client_id
uint64_t client_id
Unique client identifier.
Definition master.c:51
fr_io_client_s::thread
fr_io_thread_t * thread
Definition master.c:129
mod_name
static char const * mod_name(fr_listen_t *li)
Definition master.c:2889
fr_io_connection_s::mi
module_instance_t * mi
for submodule
Definition master.c:161
_client_free
static int _client_free(fr_io_client_t *client)
Definition master.c:474
mod_close
static int mod_close(fr_listen_t *li)
Close the socket.
Definition master.c:2763
connection_hash
static uint32_t connection_hash(void const *ctx)
Definition master.c:271
fr_io_client_s::connection
fr_io_connection_t * connection
parent connection
Definition master.c:114
fr_io_client_s::pending
fr_heap_t * pending
pending packets for this client
Definition master.c:133
count_connections
static int count_connections(UNUSED uint8_t const *key, UNUSED size_t keylen, void *data, void *ctx)
Count the number of connections used by active clients.
Definition master.c:452
connection_cmp
static int8_t connection_cmp(void const *one, void const *two)
Definition master.c:285
track_cmp
static int8_t track_cmp(void const *one, void const *two)
Definition master.c:294
fr_io_client_s::ht
fr_hash_table_t * ht
for tracking connected sockets
Definition master.c:137
mod_instantiate
static int mod_instantiate(module_inst_ctx_t const *mctx)
Definition master.c:2814
fr_io_pending_packet_t::track
fr_io_track_t * track
Definition master.c:74
fr_io_client_s::radclient
fr_client_t * radclient
old-style definition of this client
Definition master.c:118
fr_io_client_s::src_ipaddr
fr_ipaddr_t src_ipaddr
packets come from this address
Definition master.c:116
resume_read
static fr_event_update_t resume_read[]
Definition master.c:175
client_pending_free
static void client_pending_free(fr_io_client_t *client)
Definition master.c:481
fr_io_thread_t::num_connections
uint32_t num_connections
number of dynamic connections
Definition master.c:49
fr_io_connection_s::parent
fr_io_client_t * parent
points to the parent client.
Definition master.c:160
radclient_alloc
static fr_client_t * radclient_alloc(TALLOC_CTX *ctx, int ipproto, fr_io_address_t *address)
Definition master.c:929
mod_inject
static int mod_inject(fr_listen_t *li, uint8_t const *buffer, size_t buffer_len, fr_time_t recv_time)
Inject a packet to a connection.
Definition master.c:1924
fr_io_client_s
Client definitions for master IO.
Definition master.c:113
fr_io_connection_s
Track a connection.
Definition master.c:153
fr_io_pending_packet_t
A saved packet.
Definition master.c:70
fr_io_thread_t
Definition master.c:36
fr_io_track_s::ev
fr_timer_t * ev
when we clean up this tracking entry
Definition master.h:42
fr_io_track_s::reply
uint8_t * reply
reply packet (if any)
Definition master.h:46
fr_io_track_s::packets
int packets
number of packets using this entry
Definition master.h:45
fr_io_track_s::dynamic
fr_time_t dynamic
timestamp for packet doing dynamic client definition
Definition master.h:53
fr_io_instance_t::app_io_instance
void * app_io_instance
Easy access to the app_io instance.
Definition master.h:104
fr_io_instance_t::app_io
fr_app_io_t const * app_io
Easy access to the app_io handle.
Definition master.h:103
fr_io_track_s::address
fr_io_address_t const * address
of this packet.. shared between multiple packets
Definition master.h:54
fr_io_track_s::do_not_respond
bool do_not_respond
don't respond
Definition master.h:50
fr_io_track_s::discard
bool discard
whether or not we discard the packet
Definition master.h:49
fr_io_track_s::timestamp
fr_time_t timestamp
when this packet was received
Definition master.h:43
fr_io_track_s::finished
bool finished
are we finished the request?
Definition master.h:51
fr_io_track_s::packet
uint8_t * packet
really a tracking structure, not a packet
Definition master.h:56
fr_io_track_s::reply_len
size_t reply_len
length of reply, or 1 for "do not reply"
Definition master.h:47
fr_io_track_s::client
fr_io_client_t * client
client handling this packet.
Definition master.h:55
fr_io_track_s::expires
fr_time_t expires
when this packet expires
Definition master.h:44
fr_io_instance_t
The master IO instance.
Definition master.h:72
fr_io_track_s
Definition master.h:40
uint32_t
unsigned int uint32_t
Definition merged_model.c:33
ssize_t
long int ssize_t
Definition merged_model.c:24
uint8_t
unsigned char uint8_t
Definition merged_model.c:30
pthread_mutex_t
Definition merged_model.c:27
fr_nonblock
int fr_nonblock(UNUSED int fd)
Definition misc.c:293
module_inst_ctx_t::mi
module_instance_t * mi
Instance of the module being instantiated.
Definition module_ctx.h:51
module_inst_ctx_t
Temporary structure to hold arguments for instantiation calls.
Definition module_ctx.h:50
fr_asprintf
char * fr_asprintf(TALLOC_CTX *ctx, char const *fmt,...)
Special version of asprintf which implements custom format specifiers.
Definition print.c:874
fr_assert
#define fr_assert(_expr)
Definition rad_assert.h:38
ipproto
static int ipproto
Definition radclient-ng.c:92
secret
static char * secret
Definition radclient-ng.c:69
DEBUG2
#define DEBUG2(fmt,...)
Definition radclient.h:43
INFO
#define INFO(fmt,...)
Definition radict.c:54
cleanup
static bool cleanup
Definition radsniff.c:60
conf
static rs_t * conf
Definition radsniff.c:53
fr_rb_find
void * fr_rb_find(fr_rb_tree_t const *tree, void const *data)
Find an element in the tree, returning the data, not the node.
Definition rb.c:577
fr_rb_insert
bool fr_rb_insert(fr_rb_tree_t *tree, void const *data)
Insert data into a tree.
Definition rb.c:626
fr_rb_delete
bool fr_rb_delete(fr_rb_tree_t *tree, void const *data)
Remove node and free data (if a free function was specified)
Definition rb.c:741
fr_rb_inline_talloc_alloc
#define fr_rb_inline_talloc_alloc(_ctx, _type, _field, _data_cmp, _data_free)
Allocs a red black that verifies elements are of a specific talloc type.
Definition rb.h:246
fr_rb_tree_s
The main red black tree structure.
Definition rb.h:73
hash
static unsigned int hash(char const *username, unsigned int tablesize)
Definition rlm_passwd.c:132
name
static char const * name
Definition rlm_redis_ippool_tool.c:156
fr_schedule_listen_add
fr_network_t * fr_schedule_listen_add(fr_schedule_t *sc, fr_listen_t *li)
Add a fr_listen_t to a scheduler.
Definition schedule.c:892
fr_schedule_s
The scheduler.
Definition schedule.c:125
module_instance_s::conf
CONF_SECTION * conf
Module's instance configuration.
Definition module.h:330
module_instance_s::data
void * data
Module's instance data.
Definition module.h:272
module_s::instantiate
module_instantiate_t instantiate
Callback to allow the module to register any per-instance resources like sockets and file handles.
Definition module.h:219
MODULE_INSTANCE_BOOTSTRAPPED
@ MODULE_INSTANCE_BOOTSTRAPPED
Module instance has been bootstrapped, but not yet instantiated.
Definition module.h:245
module_s::thread_inst_size
size_t thread_inst_size
Size of the module's thread-specific instance data.
Definition module.h:236
module_instance_s
Module instance data.
Definition module.h:266
fr_socket_limit_t::idle_timeout
fr_time_delta_t idle_timeout
Definition socket.h:38
fr_socket_limit_t::max_connections
uint32_t max_connections
Definition socket.h:33
sc
static const uchar sc[16]
Definition smbdes.c:115
module_list_type_thread_local
module_list_type_t const module_list_type_thread_local
Callbacks for a thread local list.
Definition module.c:582
module_list_mask_set
void module_list_mask_set(module_list_t *ml, module_instance_state_t mask)
Set a new bootstrap/instantiate state for a list.
Definition module.c:1829
module_instance_copy
module_instance_t * module_instance_copy(module_list_t *dst, module_instance_t const *src, char const *inst_name)
Duplicate a module instance, placing it in a new module list.
Definition module.c:1528
module_list_alloc
module_list_t * module_list_alloc(TALLOC_CTX *ctx, module_list_type_t const *type, char const *name, bool write_protect)
Allocate a new module list.
Definition module.c:1851
module_thread_instantiate
int module_thread_instantiate(TALLOC_CTX *ctx, module_instance_t *mi, fr_event_list_t *el)
Allocate thread-local instance data for a module.
Definition module.c:1077
module_instantiate
int module_instantiate(module_instance_t *instance)
Manually complete module setup by calling its instantiate function.
Definition module.c:1189
module_instance_conf_parse
int module_instance_conf_parse(module_instance_t *mi, CONF_SECTION *conf)
Covert a CONF_SECTION into parsed module instance data.
Definition module.c:758
inst
eap_aka_sim_process_conf_t * inst
Definition state_machine.c:3620
fr_time
#define fr_time()
Allow us to arbitrarily manipulate time.
Definition state_test.c:8
fr_syserror
char const * fr_syserror(int num)
Guaranteed to be thread-safe version of strerror.
Definition syserror.c:243
talloc_get_type_abort_const
#define talloc_get_type_abort_const
Definition talloc.h:287
talloc_zero_pooled_object
#define talloc_zero_pooled_object(_ctx, _type, _num_subobjects, _total_subobjects_size)
Definition talloc.h:177
talloc_const_free
static int talloc_const_free(void const *ptr)
Free const'd memory.
Definition talloc.h:229
talloc_init_const
static TALLOC_CTX * talloc_init_const(char const *name)
Allocate a top level chunk with a constant name.
Definition talloc.h:112
fr_time_delta_unwrap
static int64_t fr_time_delta_unwrap(fr_time_delta_t time)
Definition time.h:154
fr_time_delta_lt
#define fr_time_delta_lt(_a, _b)
Definition time.h:285
fr_time_unwrap
static int64_t fr_time_unwrap(fr_time_t time)
Definition time.h:146
fr_time_delta_from_sec
static fr_time_delta_t fr_time_delta_from_sec(int64_t sec)
Definition time.h:590
fr_time_delta_wrap
#define fr_time_delta_wrap(_time)
Definition time.h:152
fr_time_wrap
#define fr_time_wrap(_time)
Definition time.h:145
fr_time_delta_ispos
#define fr_time_delta_ispos(_a)
Definition time.h:290
fr_time_eq
#define fr_time_eq(_a, _b)
Definition time.h:241
NSEC
#define NSEC
Definition time.h:379
fr_time_add
#define fr_time_add(_a, _b)
Add a time/time delta together.
Definition time.h:196
fr_time_neq
#define fr_time_neq(_a, _b)
Definition time.h:242
fr_time_delta_s
A time delta, a difference in time measured in nanoseconds.
Definition time.h:80
fr_time_s
"server local" time.
Definition time.h:69
fr_timer_list_s
An event timer list.
Definition timer.c:50
fr_timer_s
A timer event.
Definition timer.c:84
FR_TIMER_DELETE
#define FR_TIMER_DELETE(_ev_p)
Definition timer.h:103
FR_TIMER_DELETE_RETURN
#define FR_TIMER_DELETE_RETURN(_ev_p)
Definition timer.h:110
fr_timer_in
#define fr_timer_in(...)
Definition timer.h:87
FR_TIMER_DISARM
#define FR_TIMER_DISARM(_ev)
Definition timer.h:91
fr_timer_armed
static bool fr_timer_armed(fr_timer_t *ev)
Definition timer.h:120
fr_timer_at
#define fr_timer_at(...)
Definition timer.h:81
fr_trie_remove_by_key
void * fr_trie_remove_by_key(fr_trie_t *ft, void const *key, size_t keylen)
Remove a key and return the associated user ctx.
Definition trie.c:2154
fr_trie_alloc
fr_trie_t * fr_trie_alloc(TALLOC_CTX *ctx, fr_trie_key_t get_key, fr_free_t free_data)
Allocate a trie.
Definition trie.c:741
fr_trie_walk
int fr_trie_walk(fr_trie_t *ft, void *ctx, fr_trie_walk_t callback)
Definition trie.c:2607
fr_trie_lookup_by_key
void * fr_trie_lookup_by_key(fr_trie_t const *ft, void const *key, size_t keylen)
Lookup a key in a trie and return user ctx, if any.
Definition trie.c:1262
fr_trie_match_by_key
void * fr_trie_match_by_key(fr_trie_t const *ft, void const *key, size_t keylen)
Match a key and length in a trie and return user ctx, if any.
Definition trie.c:1286
fr_trie_insert_by_key
int fr_trie_insert_by_key(fr_trie_t *ft, void const *key, size_t keylen, void const *data)
Insert a key and user ctx into a trie.
Definition trie.c:1875
fr_trie_s
Definition trie.c:484
close
close(uq->fd)
el
static fr_event_list_t * el
Definition unit_test_attribute.c:279
parent
static fr_slen_t parent
Definition pair.h:845
fr_socket_t::fd
int fd
File descriptor if this is a live socket.
Definition socket.h:81
fr_socket_t::type
int type
SOCK_STREAM, SOCK_DGRAM, etc.
Definition socket.h:79
fr_strerror_printf
#define fr_strerror_printf(_fmt,...)
Log to thread local error buffer.
Definition strerror.h:64
fr_strerror_const
#define fr_strerror_const(_msg)
Definition strerror.h:223
fr_value_box_aprint
static fr_slen_t fr_value_box_aprint(TALLOC_CTX *ctx, char **out, fr_value_box_t const *data, fr_sbuff_escape_rules_t const *e_rules) 1(fr_value_box_print
fr_box_ipaddr
#define fr_box_ipaddr(_val)
Definition value.h:313
data
static fr_slen_t data
Definition value.h:1288
fr_box_time_delta
#define fr_box_time_delta(_val)
Definition value.h:362
listen_record
bool listen_record(fr_listen_t *li)
Record that we're listening on a particular IP / port.
Definition virtual_servers.c:929
listen_find_any
fr_listen_t * listen_find_any(fr_listen_t *li)
See if another global listener is using a particular IP / port.
Definition virtual_servers.c:918
Generated by   doxygen 1.9.8