The FreeRADIUS server $Id: 15bac2a4c627c01d1aa2047687b3418955ac7f00 $
Loading...
Searching...
No Matches
master.c
Go to the documentation of this file.
1/*
2 * This program is free software; you can redistribute it and/or modify
3 * it under the terms of the GNU General Public License as published by
4 * the Free Software Foundation; either version 2 of the License, or
5 * (at your option) any later version.
6 *
7 * This program is distributed in the hope that it will be useful,
8 * but WITHOUT ANY WARRANTY; without even the implied warranty of
9 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10 * GNU General Public License for more details.
11 *
12 * You should have received a copy of the GNU General Public License
13 * along with this program; if not, write to the Free Software
14 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
15 */
16
17/**
18 * $Id: 2dd8281586235821fe7000e87c29d2781922ca65 $
19 * @file io/master.c
20 * @brief Master IO handler
21 *
22 * @copyright 2018 Alan DeKok (aland@freeradius.org)
23 */
24#include <freeradius-devel/io/listen.h>
25#include <freeradius-devel/io/master.h>
26
27#include <freeradius-devel/server/base.h>
28#include <freeradius-devel/server/module.h>
29#include <freeradius-devel/server/log.h>
30
31#include <freeradius-devel/util/debug.h>
32
33#include <freeradius-devel/util/misc.h>
34#include <freeradius-devel/util/syserror.h>
35
36typedef struct {
37 fr_event_list_t *el; //!< event list, for the master socket.
38 fr_network_t *nr; //!< network for the master socket
39
40 fr_trie_t *trie; //!< trie of clients
41 fr_heap_t *pending_clients; //!< heap of pending clients
42 fr_heap_t *alive_clients; //!< heap of active dynamic clients
43
44 fr_listen_t *listen; //!< The master IO path
45 fr_listen_t *child; //!< The child (app_io) IO path
46 fr_schedule_t *sc; //!< the scheduler
47
48 // @todo - count num_nak_clients, and num_nak_connections, too
49 uint32_t num_connections; //!< number of dynamic connections
50 uint32_t num_pending_packets; //!< number of pending packets
51 uint64_t client_id; //!< Unique client identifier.
52
53 struct {
54 fr_rate_limit_t accept_failed;
55 fr_rate_limit_t alloc_failed;
56 fr_rate_limit_t bad_type;
57 fr_rate_limit_t conn_alloc_failed;
58 fr_rate_limit_t max_connections;
59 fr_rate_limit_t queue_full;
60 fr_rate_limit_t repeat_nak;
61 fr_rate_limit_t too_many_pending;
62 fr_rate_limit_t tracking_failed;
63 fr_rate_limit_t unknown_client;
64 } rate_limit;
66
67/** A saved packet
68 *
69 */
78
79
80/** Client states
81 *
82 */
83typedef enum {
85 PR_CLIENT_STATIC, //!< static / global clients
86 PR_CLIENT_NAK, //!< negative cache entry
87 PR_CLIENT_DYNAMIC, //!< dynamically defined client
88 PR_CLIENT_CONNECTED, //!< dynamically defined client in a connected socket
89 PR_CLIENT_PENDING, //!< dynamic client pending definition
91
92/*
93 * Dynamic clients are run through the normal src/process/foo state machine.
94 *
95 * request->async->packet_ctx is an fr_io_track_t
96 *
97 * track->dynamic is set to a non-zero value.
98 *
99 * The dynamic client code returns a buffer of 1 byte for a NAK.
100 *
101 * If the client creation is successful, then it does talloc(NULL, fr_client_t),
102 * fills out the structure, and sends the pointer in the buffer (8 bytes).
103 *
104 * This code will take over ownership of the structure, and
105 * create the dynamic client.
106 */
107
109
110/** Client definitions for master IO
111 *
112 */
114 fr_io_connection_t *connection; //!< parent connection
115 fr_io_client_state_t state; //!< state of this client
116 fr_ipaddr_t src_ipaddr; //!< packets come from this address
117 fr_ipaddr_t network; //!< network for dynamic clients
118 fr_client_t *radclient; //!< old-style definition of this client
119
120 int packets; //!< number of packets using this client
121 fr_heap_index_t pending_id; //!< for pending clients
122 fr_heap_index_t alive_id; //!< for all clients
123
124 bool use_connected; //!< does this client allow connected sub-sockets?
125 bool ready_to_delete; //!< are we ready to delete this client?
126 bool in_trie; //!< is the client in the trie?
127
128 fr_io_instance_t const *inst; //!< parent instance for master IO handler
130 fr_timer_t *ev; //!< when we clean up the client
131 fr_rb_tree_t *table; //!< tracking table for packets
132
133 fr_heap_t *pending; //!< pending packets for this client
134 fr_hash_table_t *addresses; //!< list of src/dst addresses used by this client
135
136 pthread_mutex_t mutex; //!< for parent / child signaling
137 fr_hash_table_t *ht; //!< for tracking connected sockets
138};
139
140/** Track a connection
141 *
142 * This structure contains information about the connection,
143 * a pointer to the library instance so that we can clean up on exit,
144 * and the listener.
145 *
146 * It also points to a client structure which is for this connection,
147 * and only this connection.
148 *
149 * Finally, a pointer to the parent client, so that the child can
150 * tell the parent it's alive, and the parent can push packets to the
151 * child.
152 */
154 char const *name; //!< taken from proto_FOO_TRANSPORT
155 int packets; //!< number of packets using this connection
156 fr_io_address_t *address; //!< full information about the connection.
157 fr_listen_t *listen; //!< master listener for this socket
158 fr_listen_t *child; //!< child listener (app_io) for this socket
159 fr_io_client_t *client; //!< our local client (pending or connected).
160 fr_io_client_t *parent; //!< points to the parent client.
161 module_instance_t *mi; //!< for submodule
162
163 bool dead; //!< roundabout way to get the network side to close a socket
164 bool paused; //!< event filter doesn't like resuming something that isn't paused
165 bool in_parent_hash; //!< for tracking thread issues
166 fr_event_list_t *el; //!< event list for this connection
167 fr_network_t *nr; //!< network for this connection
168};
169
172 { 0 }
173};
174
177 { 0 }
178};
179
180static int track_free(fr_io_track_t *track)
181{
182 FR_TIMER_DELETE_RETURN(&track->ev);
183 talloc_free_children(track);
184
185 fr_assert(track->client->packets > 0);
186 track->client->packets--;
187
188 return 0;
189}
190
192{
193 fr_assert(track->client->table != NULL);
194 fr_assert(fr_rb_find(track->client->table, track) != NULL);
195
196 if (!fr_rb_delete(track->client->table, track)) {
197 fr_assert(0);
198 }
199
200 return track_free(track);
201}
202
203/*
204 * Return negative numbers to put 'one' at the top of the heap.
205 * Return positive numbers to put 'two' at the top of the heap.
206 */
207static int8_t pending_packet_cmp(void const *one, void const *two)
208{
211 int ret;
212
213 /*
214 * Higher priority elements are larger than lower
215 * priority elements. So if "a" is larger than "b", we
216 * wish to prefer "a".
217 */
218 ret = CMP_PREFER_LARGER(a->priority, b->priority);
219 if (ret != 0) return ret;
220
221 /*
222 * Smaller numbers mean packets were received earlier.
223 * We want to process packets in time order. So if "a"
224 * is smaller than "b", we wish to prefer "a".
225 *
226 * After that, it doesn't really matter what order the
227 * packets go in. Since we'll never have two identical
228 * "recv_time" values, the code should never get here.
229 */
231}
232
233/*
234 * Order clients in the pending_clients heap, based on the
235 * packets that they contain.
236 */
237static int8_t pending_client_cmp(void const *one, void const *two)
238{
239 fr_io_pending_packet_t const *a;
240 fr_io_pending_packet_t const *b;
241
244
245 a = fr_heap_peek(c1->pending);
246 b = fr_heap_peek(c2->pending);
247
248 fr_assert(a != NULL);
249 fr_assert(b != NULL);
250
251 return pending_packet_cmp(a, b);
252}
253
254
255static int8_t address_cmp(void const *one, void const *two)
256{
259 int8_t ret;
260
261 CMP_RETURN(a, b, socket.inet.src_port);
262 CMP_RETURN(a, b, socket.inet.dst_port);
263 CMP_RETURN(a, b, socket.inet.ifindex);
264
265 ret = fr_ipaddr_cmp(&a->socket.inet.src_ipaddr, &b->socket.inet.src_ipaddr);
266 if (ret != 0) return ret;
267
268 return fr_ipaddr_cmp(&a->socket.inet.dst_ipaddr, &b->socket.inet.dst_ipaddr);
269}
270
271static uint32_t connection_hash(void const *ctx)
272{
275
276 hash = fr_hash(&c->address->socket.inet.src_ipaddr, sizeof(c->address->socket.inet.src_ipaddr));
277 hash = fr_hash_update(&c->address->socket.inet.src_port, sizeof(c->address->socket.inet.src_port), hash);
278
279 hash = fr_hash_update(&c->address->socket.inet.ifindex, sizeof(c->address->socket.inet.ifindex), hash);
280
281 hash = fr_hash_update(&c->address->socket.inet.dst_ipaddr, sizeof(c->address->socket.inet.dst_ipaddr), hash);
282 return fr_hash_update(&c->address->socket.inet.dst_port, sizeof(c->address->socket.inet.dst_port), hash);
283}
284
285static int8_t connection_cmp(void const *one, void const *two)
286{
289
290 return address_cmp(a->address, b->address);
291}
292
293
294static int8_t track_cmp(void const *one, void const *two)
295{
298 int ret;
299
300 fr_assert(a->client != NULL);
301 fr_assert(b->client != NULL);
302 fr_assert(a->client == b->client); /* tables are per-client */
303
306
307 /*
308 * Unconnected sockets must check src/dst ip/port.
309 */
310 ret = address_cmp(a->address, b->address);
311 if (ret != 0) return ret;
312
313 /*
314 * Call the per-protocol comparison function.
315 */
318 a->client->radclient,
319 a->packet, b->packet);
320 return CMP(ret, 0);
321}
322
323
324static int8_t track_connected_cmp(void const *one, void const *two)
325{
328 int ret;
329
330 fr_assert(a->client != NULL);
331 fr_assert(b->client != NULL);
332
335 fr_assert(a->client == b->client);
337
338 /*
339 * Note that we pass the connection "client", as
340 * we may do negotiation specific to this connection.
341 */
345 a->packet, b->packet);
346 return CMP(ret, 0);
347}
348
349
351{
352 fr_io_client_t *client;
353 fr_io_pending_packet_t *pending;
354
355 client = fr_heap_pop(&thread->pending_clients);
356 if (!client) {
357 fr_assert(thread->num_pending_packets == 0);
358
359 /*
360 * 99% of the time we don't have pending clients.
361 * So we might as well free this, so that the
362 * caller doesn't keep checking us for every packet.
363 */
365 thread->pending_clients = NULL;
366 return NULL;
367 }
368
369 pending = fr_heap_pop(&client->pending);
370 fr_assert(pending != NULL);
371
372 /*
373 * If the client has more packets pending, add it back to
374 * the heap.
375 */
376 if (fr_heap_num_elements(client->pending) > 0) {
377 if (fr_heap_insert(&thread->pending_clients, client) < 0) {
378 fr_assert(0 == 1);
379 }
380 }
381
382 fr_assert(thread->num_pending_packets > 0);
383 thread->num_pending_packets--;
384
385 return pending;
386}
387
388static fr_client_t *radclient_clone(TALLOC_CTX *ctx, fr_client_t const *parent)
389{
390 fr_client_t *c;
391
392 if (!parent) return NULL;
393
394 c = talloc_zero(ctx, fr_client_t);
395 if (!c) return NULL;
396
397 /*
398 * Do NOT set ipaddr or src_ipaddr. The caller MUST do this!
399 */
400
401#define DUP_FIELD(_x) do { if (parent->_x) {c->_x = talloc_strdup(c, parent->_x); if (!c->_x) {goto error;}}} while (0)
402#define COPY_FIELD(_x) c->_x = parent->_x
403
404 DUP_FIELD(longname);
405 DUP_FIELD(shortname);
407 DUP_FIELD(nas_type);
408 DUP_FIELD(server);
409 DUP_FIELD(nas_type);
410
411 COPY_FIELD(require_message_authenticator);
412 COPY_FIELD(require_message_authenticator_is_set);
413 COPY_FIELD(limit_proxy_state);
414 COPY_FIELD(limit_proxy_state_is_set);
415 COPY_FIELD(received_message_authenticator);
416 COPY_FIELD(first_packet_no_proxy_state);
417 /* dynamic MUST be false */
418 COPY_FIELD(server_cs);
419 COPY_FIELD(cs);
420 COPY_FIELD(proto);
421 COPY_FIELD(active);
422 COPY_FIELD(dedup_authenticator);
423
424 COPY_FIELD(use_connected);
425
426#ifdef WITH_TLS
427 COPY_FIELD(tls_required);
428#endif
429
430 c->ipaddr = parent->ipaddr;
431 c->src_ipaddr = parent->src_ipaddr;
432
433 return c;
434
435 /*
436 * @todo - fill in other fields, too!
437 */
438
439error:
440 talloc_free(c);
441 return NULL;
442}
443#undef COPY_FIELD
444#undef DUP_FIELD
445
446
447/** Count the number of connections used by active clients.
448 *
449 * Unfortunately, we also count NAK'd connections, too, even if they
450 * are closed. The alternative is to walk through all connections
451 * for each client, which would be a long time.
452 */
453static int count_connections(UNUSED uint8_t const *key, UNUSED size_t keylen, void *data, void *ctx)
454{
455 fr_io_client_t *client = talloc_get_type_abort(data, fr_io_client_t);
456 int connections;
457
458 pthread_mutex_lock(&client->mutex);
459
460 if (!client->ht) {
461 pthread_mutex_unlock(&client->mutex);
462 return 0;
463 }
464
465 connections = fr_hash_table_num_elements(client->ht);
466 pthread_mutex_unlock(&client->mutex);
467
468 fr_assert(client->use_connected);
469 *((uint32_t *) ctx) += connections;
470
471 return 0;
472}
473
474
475static int _client_free(fr_io_client_t *client)
476{
477 TALLOC_FREE(client->pending);
478
479 return 0;
480}
481
483{
484 size_t num;
485
486 fr_assert(!client->connection);
487
488 if (!client->pending) return;
489
490 num = fr_heap_num_elements(client->pending);
491
492 fr_assert(client->thread->num_pending_packets >= num);
493 client->thread->num_pending_packets -= num;
494
495 TALLOC_FREE(client->pending);
496}
497
498
499static int connection_free(fr_io_connection_t *connection)
500{
501 /*
502 * This is it's own talloc context, as there are
503 * thousands of packets associated with it.
504 */
505 TALLOC_FREE(connection->client);
506
507 return 0;
508}
509
510/** Create a new connection.
511 *
512 * Called ONLY from the master socket.
513 */
515 fr_io_thread_t *thread,
516 fr_io_client_t *client, int fd,
517 fr_io_address_t *address,
519{
520 int ret;
521 fr_io_connection_t *connection;
522 module_instance_t *mi = NULL;
523 fr_listen_t *li;
524 fr_client_t *radclient;
525
526 /*
527 * Reload the app_io module as a "new" library. This
528 * causes the link count for the library to be correct.
529 * It also allocates a new instance data for it, too.
530 * Passing CONF_SECTION of NULL ensures that there's no
531 * config for it, as we'll just clone it's contents from
532 * the original. It also means that detach should be
533 * called when the instance data is freed.
534 */
535 if (!nak) {
536 CONF_SECTION *cs;
537 char *inst_name;
538
539 if (inst->max_connections || client->radclient->limit.max_connections) {
540 uint32_t max_connections = inst->max_connections ? inst->max_connections : client->radclient->limit.max_connections;
541
542 /*
543 * We've hit the connection limit. Walk
544 * over all clients with connections, and
545 * count the number of connections used.
546 */
547 if (thread->num_connections >= max_connections) {
548 thread->num_connections = 0;
549
550 (void) fr_trie_walk(thread->trie, &thread->num_connections, count_connections);
551
552 if ((thread->num_connections + 1) >= max_connections) {
553 RATE_LIMIT_LOCAL(&thread->rate_limit.max_connections, INFO,
554 "proto_%s - Ignoring connection from client %s - 'max_connections' limit reached.",
555 inst->app->common.name, client->radclient->shortname);
556 if (fd >= 0) close(fd);
557 return NULL;
558 }
559 }
560 }
561
562 /*
563 * Add a client module into a sublist
564 */
565 inst_name = talloc_asprintf(NULL, "%"PRIu64, thread->client_id++);
566 mi = module_instance_copy(inst->clients, inst->submodule, inst_name);
567
568 cs = cf_section_dup(mi, NULL, inst->submodule->conf,
569 cf_section_name1(inst->submodule->conf),
570 cf_section_name2(inst->submodule->conf), false);
571 if (module_instance_conf_parse(mi, cs) < 0) {
572 cf_log_err(inst->server_cs, "Failed parsing module config");
573 goto cleanup;
574 }
575
576 /* Thread local module lists never run bootstrap */
577 if (module_instantiate(mi) < 0) {
578 cf_log_err(inst->server_cs, "Failed instantiating module");
579 goto cleanup;
580 }
581
582 if (module_thread_instantiate(mi, mi, thread->el) < 0) {
583 cf_log_err(inst->server_cs, "Failed instantiating module");
584 goto cleanup;
585 }
586
587 /*
588 * FIXME - Instantiate the new module?!
589 */
590 talloc_free(inst_name);
591 fr_assert(mi != NULL);
592 } else {
593 mi = talloc_init_const("nak");
594 }
595
596 MEM(connection = talloc_zero(mi, fr_io_connection_t));
597 MEM(connection->address = talloc_memdup(connection, address, sizeof(*address)));
598 (void) talloc_set_name_const(connection->address, "fr_io_address_t");
599
600 connection->parent = client;
601 connection->mi = mi;
602
603 MEM(connection->client = talloc_named(NULL, sizeof(fr_io_client_t), "fr_io_client_t"));
604 memset(connection->client, 0, sizeof(*connection->client));
605
606 MEM(connection->client->radclient = radclient = radclient_clone(connection->client, client->radclient));
607
608 talloc_set_destructor(connection->client, _client_free);
609 talloc_set_destructor(connection, connection_free);
610
613 connection->client->connection = connection;
614
615 /*
616 * Create the packet tracking table for this client.
617 *
618 * #todo - unify the code with static clients?
619 */
620 if (inst->app_io->track_duplicates) {
621 MEM(connection->client->table = fr_rb_inline_talloc_alloc(client, fr_io_track_t, node,
622 track_connected_cmp, NULL));
623 }
624
625 /*
626 * Set this radclient to be dynamic, and active.
627 */
628 radclient->dynamic = true;
629 radclient->active = true;
630
631 /*
632 * address->socket.inet.client points to a "static" client. We want
633 * to clean up everything associated with the connection
634 * when it closes. So we need to point to our own copy
635 * of the client here.
636 */
637 connection->address->radclient = connection->client->radclient;
638 connection->client->inst = inst;
639 connection->client->thread = thread;
640
641 /*
642 * Create a heap for packets which are pending for this
643 * client.
644 */
645 MEM(connection->client->pending = fr_heap_alloc(connection->client, pending_packet_cmp,
646 fr_io_pending_packet_t, heap_id, 0));
647
648 /*
649 * Clients for connected sockets are always a /32 or /128.
650 */
651 connection->client->src_ipaddr = address->socket.inet.src_ipaddr;
652 connection->client->network = address->socket.inet.src_ipaddr;
653
654 /*
655 * Don't initialize mutex or hash table.
656 * Connections cannot spawn other connections.
657 */
658
659 /*
660 * If this client state is pending, then the connection
661 * state is pending, too. That allows NAT gateways to be
662 * defined dynamically, AND for them to have multiple
663 * connections, each with a different client. This
664 * allows for different shared secrets to be used for
665 * different connections. Once the client gets defined
666 * for this connection, it will be either "connected" or
667 * not. If connected, then the parent client remains
668 * PENDING. Otherwise, the parent client is moved to
669 * DYNAMIC
670 *
671 * If this client state is static or dynamic,
672 * then we're just using connected sockets behind
673 * that client. The connections here all use the
674 * same shared secret, but they use different
675 * sockets, so they allow for sharing of IO
676 * across CPUs / threads.
677 */
678 switch (client->state) {
680 connection->client->state = PR_CLIENT_PENDING;
681
682 /*
683 * Needed for rlm_radius, which refuses to proxy packets
684 * that define a dynamic client.
685 */
686 radclient->active = false;
687 break;
688
689 case PR_CLIENT_STATIC:
691 connection->client->state = PR_CLIENT_CONNECTED;
692 break;
693
695 case PR_CLIENT_NAK:
697 fr_assert(0 == 1);
698 goto cleanup;
699 }
700
701 if (!nak) {
702 /*
703 * Get the child listener.
704 */
705 MEM(li = connection->child = talloc(connection, fr_listen_t));
706 memcpy(li, thread->listen, sizeof(*li));
707
708 /*
709 * Glue in the actual app_io
710 */
711 li->connected = true;
712 li->app_io = thread->child->app_io;
713 li->thread_instance = connection;
714 li->app_io_instance = mi->data;
716
717 /*
718 * Create writable thread instance data.
719 */
720 connection->child->thread_instance = talloc_zero_array(NULL, uint8_t,
721 inst->app_io->common.thread_inst_size);
722 talloc_set_destructor(connection->child, fr_io_listen_free);
723 talloc_set_name(connection->child->thread_instance, "proto_%s_thread_t",
724 inst->app_io->common.name);
725
726 /*
727 * This is "const", and the user can't
728 * touch it. So we just reuse the same
729 * configuration everywhere.
730 */
731 connection->child->app_io_instance = inst->app_io_instance;
732
733 /*
734 * Create the listener, based on our listener.
735 */
736 MEM(li = connection->listen = talloc(connection, fr_listen_t));
737
738 /*
739 * Note that our instance is effectively 'const'.
740 *
741 * i.e. we can't add things to it. Instead, we have to
742 * put all variable data into the connection.
743 */
744 memcpy(li, thread->listen, sizeof(*li));
745
746 /*
747 * Glue in the connection to the listener.
748 */
750
751 li->connected = true;
752 li->thread_instance = connection;
755
756 /*
757 * Instantiate the child, and open the socket.
758 */
759 fr_assert(inst->app_io->connection_set != NULL);
760
761 if (inst->app_io->connection_set(connection->child, connection->address) < 0) {
762 DEBUG("proto_%s - Failed setting connection for socket.", inst->app->common.name);
763 goto cleanup;
764 }
765
766 /*
767 * UDP sockets: open a new socket, and then
768 * connect it to the client. This emulates the
769 * behavior of accept().
770 *
771 * Note that there is a small window between the
772 * bind() and connect() where UDP packets for the
773 * wildcard socket can get received by this
774 * socket. We hope that this time frame is as
775 * small as possible.
776 *
777 * i.e. we ignore the problem, and don't
778 * currently check dst ip/port for UDP packets
779 * received on connected sockets.
780 */
781 if (fd < 0) {
782 socklen_t salen;
783 struct sockaddr_storage src;
784
785 if (fr_ipaddr_to_sockaddr(&src, &salen,
786 &connection->address->socket.inet.src_ipaddr,
787 connection->address->socket.inet.src_port) < 0) {
788 DEBUG("proto_%s - Failed getting IP address", inst->app->common.name);
789 talloc_free(mi);
790 return NULL;
791 }
792
793 if (inst->app_io->open(connection->child) < 0) {
794 DEBUG("proto_%s - Failed opening connected socket.", inst->app->common.name);
795 talloc_free(mi);
796 return NULL;
797 }
798
799 fd = connection->child->fd;
800
801 if (connect(fd, (struct sockaddr *) &src, salen) < 0) {
802 ERROR("proto_%s - Failed in connect: %s", inst->app->common.name, fr_syserror(errno));
803 goto cleanup;
804 }
805 } else {
806 connection->child->fd = fd;
807 }
808
809 /*
810 * Set the new FD, and get the module to set it's connection name.
811 */
812 if (inst->app_io->fd_set(connection->child, fd) < 0) {
813 DEBUG3("Failed setting FD to %s", inst->app_io->common.name);
814 goto cleanup;
815 }
816
817 li->fd = fd;
818
819 if (!inst->app_io->get_name) {
820 connection->name = fr_asprintf(connection, "proto_%s from client %pV port "
821 "%u to server %pV port %u",
822 inst->app->common.name,
823 fr_box_ipaddr(connection->address->socket.inet.src_ipaddr),
824 connection->address->socket.inet.src_port,
825 fr_box_ipaddr(connection->address->socket.inet.dst_ipaddr),
826 connection->address->socket.inet.dst_port);
827 } else {
828 connection->name = inst->app_io->get_name(connection->child);
829 }
830
831 /*
832 * Set the names for the listeners.
833 */
834 connection->listen->name = connection->name;
835 connection->child->name = connection->name;
836 }
837
838 /*
839 * Add the connection to the set of connections for this
840 * client.
841 */
842 pthread_mutex_lock(&client->mutex);
843 if (client->ht) {
844 if (nak) (void) fr_hash_table_delete(client->ht, nak);
845 ret = fr_hash_table_insert(client->ht, connection);
846 client->ready_to_delete = false;
847 connection->in_parent_hash = true;
848
849 if (!ret) {
850 pthread_mutex_unlock(&client->mutex);
851 ERROR("proto_%s - Failed inserting connection into tracking table. "
852 "Closing it, and discarding all packets for connection %s.",
853 inst->app_io->common.name, connection->name);
854 goto cleanup;
855 }
856 }
857 pthread_mutex_unlock(&client->mutex);
858
859 /*
860 * It's a NAK client. Set the state to NAK, and don't
861 * add it to the scheduler.
862 */
863 if (nak) {
864 INFO("proto_%s - Verification failed for packet from dynamic client %pV - adding IP address to the NAK cache",
865 inst->app_io->common.name, fr_box_ipaddr(client->src_ipaddr));
866
867 connection->name = talloc_strdup(connection, nak->name);
868 connection->client->state = PR_CLIENT_NAK;
869 connection->el = nak->el;
870 return connection;
871 }
872
873 DEBUG("proto_%s - starting connection %s", inst->app_io->common.name, connection->name);
874 connection->nr = fr_schedule_listen_add(thread->sc, connection->listen);
875 if (!connection->nr) {
876 ERROR("proto_%s - Failed inserting connection into scheduler. "
877 "Closing it, and diuscarding all packets for connection %s.",
878 inst->app_io->common.name, connection->name);
879 pthread_mutex_lock(&client->mutex);
880 if (client->ht) (void) fr_hash_table_delete(client->ht, connection);
881 pthread_mutex_unlock(&client->mutex);
882
883 cleanup:
884 if (fd >= 0) close(fd);
885 talloc_free(mi);
886 return NULL;
887 }
888
889 /*
890 * We have one more connection. Note that we do
891 * NOT decrement this counter when a connection
892 * closes, as the close is done in a child
893 * thread. Instead, we just let counter hit the
894 * limit, and then walk over the clients to reset
895 * the count.
896 */
897 thread->num_connections++;
898
899 return connection;
900}
901
902
903/*
904 * And here we go into the rabbit hole...
905 *
906 * @todo future - have a similar structure
907 * fr_io_connection_io, which will duplicate some code,
908 * but may make things simpler?
909 */
910static void get_inst(fr_listen_t *li, fr_io_instance_t const **inst, fr_io_thread_t **thread,
911 fr_io_connection_t **connection, fr_listen_t **child)
912{
913 if (!li->connected) {
914 *inst = li->app_io_instance;
915 if (thread) *thread = li->thread_instance;
916 *connection = NULL;
917 if (child) *child = ((fr_io_thread_t *)li->thread_instance)->child;
918
919 } else {
920 fr_assert(connection != NULL);
921
922 *connection = li->thread_instance;
923 *inst = (*connection)->client->inst;
924 if (thread) *thread = NULL;
925 if (child) *child = (*connection)->child;
926 }
927}
928
929
930static fr_client_t *radclient_alloc(TALLOC_CTX *ctx, int ipproto, fr_io_address_t *address)
931{
932 fr_client_t *radclient;
933 char *shortname;
934
935 MEM(radclient = talloc_zero(ctx, fr_client_t));
936
937 fr_value_box_aprint(radclient, &shortname, fr_box_ipaddr(address->socket.inet.src_ipaddr), NULL);
938 radclient->longname = radclient->shortname = shortname;
939
940 radclient->secret = radclient->nas_type = talloc_strdup(radclient, "");
941
942 radclient->ipaddr = address->socket.inet.src_ipaddr;
943
944 radclient->src_ipaddr = address->socket.inet.dst_ipaddr;
945
946 radclient->proto = ipproto;
947 radclient->dynamic = true;
948
949 return radclient;
950}
951
952/*
953 * Remove a client from the list of "live" clients.
954 *
955 * This function is only used for the "main" socket. Clients
956 * from connections do not use it.
957 */
959{
960 talloc_get_type_abort(client, fr_io_client_t);
961
962 fr_assert(client->in_trie);
963 fr_assert(!client->connection);
964 fr_assert(client->thread);
965
966 if (client->pending) client_pending_free(client);
967
968 (void) fr_trie_remove_by_key(client->thread->trie, &client->src_ipaddr.addr, client->src_ipaddr.prefix);
969
970 if (client->thread->alive_clients) {
972 (void) fr_heap_extract(&client->thread->alive_clients, client);
973 }
974
975 return 0;
976}
977
978/** Allocate a dynamic client.
979 *
980 */
981static fr_io_client_t *client_alloc(TALLOC_CTX *ctx, fr_io_client_state_t state,
982 fr_io_instance_t const *inst, fr_io_thread_t *thread, fr_client_t *radclient,
983 fr_ipaddr_t const *network)
984{
985 fr_io_client_t *client;
986
987 /*
988 * Create our own local client. This client
989 * holds our state which really shouldn't go into
990 * fr_client_t.
991 *
992 * Note that we create a new top-level talloc
993 * context for this client, as there may be tens
994 * of thousands of packets associated with this
995 * client. And we want to avoid problems with
996 * O(N) issues in talloc.
997 */
998 MEM(client = talloc_named(ctx, sizeof(fr_io_client_t), "fr_io_client_t"));
999 memset(client, 0, sizeof(*client));
1000
1001 client->state = state;
1002 client->src_ipaddr = radclient->ipaddr;
1003 client->radclient = radclient;
1004 client->inst = inst;
1005 client->thread = thread;
1006
1007 if (network) {
1008 client->network = *network;
1009 } else {
1010 client->network = client->src_ipaddr;
1011 }
1012
1013 /*
1014 * At this point, this variable can only be true
1015 * for STATIC clients. PENDING clients may set
1016 * it to true later, after they've been defined.
1017 */
1018 client->use_connected = radclient->use_connected;
1019
1020 /*
1021 * Create the pending heap for pending clients.
1022 */
1023 if (state == PR_CLIENT_PENDING) {
1024 MEM(client->pending = fr_heap_alloc(client, pending_packet_cmp,
1025 fr_io_pending_packet_t, heap_id, 0));
1026 }
1027
1028 /*
1029 * Create the packet tracking table for this client.
1030 */
1031 if (inst->app_io->track_duplicates) {
1032 fr_assert(inst->app_io->track_compare != NULL);
1033 MEM(client->table = fr_rb_inline_talloc_alloc(client, fr_io_track_t, node, track_cmp, NULL));
1034 }
1035
1036 /*
1037 * Allow connected sockets to be set on a
1038 * per-client basis.
1039 */
1040 if (client->use_connected) {
1041 fr_assert(client->state == PR_CLIENT_STATIC);
1042
1043 (void) pthread_mutex_init(&client->mutex, NULL);
1044 MEM(client->ht = fr_hash_table_alloc(client, connection_hash, connection_cmp, NULL));
1045 }
1046
1047 /*
1048 * Add the newly defined client to the trie of
1049 * allowed clients.
1050 */
1051 if (fr_trie_insert_by_key(thread->trie, &client->src_ipaddr.addr, client->src_ipaddr.prefix, client)) {
1052 ERROR("proto_%s - Failed inserting client %s into tracking table. Discarding client, and all packets for it.",
1053 inst->app_io->common.name, client->radclient->shortname);
1054 talloc_free(client);
1055 return NULL;
1056 }
1057
1058 client->in_trie = true;
1059
1060 /*
1061 * It's a static client. Don't insert it into the list of alive clients, as those are only for
1062 * dynamic clients.
1063 */
1064 if (state == PR_CLIENT_STATIC) return client;
1065
1066 fr_assert(thread->alive_clients != NULL);
1067
1068 /*
1069 * Track the live clients so that we can clean
1070 * them up.
1071 */
1072 (void) fr_heap_insert(&thread->alive_clients, client);
1074
1075 /*
1076 * Now that we've inserted it into the heap and
1077 * incremented the numbers, set the destructor
1078 * function.
1079 */
1080 talloc_set_destructor(client, _client_live_free);
1081
1082 return client;
1083}
1084
1085
1087 fr_io_address_t *address,
1088 uint8_t const *packet, size_t packet_len,
1089 fr_time_t recv_time, bool *is_dup)
1090{
1091 size_t len;
1092 fr_io_track_t *track, *old;
1093 fr_io_address_t *my_address;
1094
1095 *is_dup = false;
1096
1097 /*
1098 * Allocate a new tracking structure. Most of the time
1099 * there are no duplicates, so this is fine.
1100 */
1101 MEM(track = talloc_zero_pooled_object(client, fr_io_track_t, 1, sizeof(*track) + sizeof(track->address) + 64));
1102 MEM(track->address = my_address = talloc_zero(track, fr_io_address_t));
1103
1104 memcpy(my_address, address, sizeof(*address));
1105 my_address->radclient = client->radclient;
1106
1107 track->client = client;
1108 if (client->connection) {
1109 track->address = client->connection->address;
1110 }
1111
1112 track->timestamp = recv_time;
1113 track->packets = 1;
1114
1115 /*
1116 * We're not tracking duplicates, so just return the
1117 * tracking entry. This tracks src/dst IP/port, client,
1118 * receive time, etc.
1119 */
1120 if (!client->inst->app_io->track_duplicates) {
1121 client->packets++;
1122 talloc_set_destructor(track, track_free);
1123 return track;
1124 }
1125
1126 /*
1127 * We are checking for duplicates, see if there is a dup
1128 * already in the tree.
1129 */
1130 track->packet = client->inst->app_io->track_create(client->inst->app_io_instance,
1131 client->thread->child->thread_instance,
1132 client->radclient,
1133 track, packet, packet_len);
1134 if (!track->packet) {
1135 talloc_free(track);
1136 return NULL;
1137 }
1138
1139 /*
1140 * No existing duplicate. Return the new tracking entry.
1141 */
1142 old = fr_rb_find(client->table, track);
1143 if (!old) goto do_insert;
1144
1145 fr_assert(old->client == client);
1146
1147 /*
1148 * It cannot be both in the free list and in the tracking table.
1149 *
1150 * 2020-08-17, this assertion fails randomly in travis.
1151 * Which means that "track" was in the free list, *and*
1152 * in the rbtree.
1153 */
1154 fr_assert(old != track);
1155
1156 /*
1157 * The new packet has the same dedup fields as the old
1158 * one, BUT it may be a conflicting packet. Check for
1159 * that via a simple memcmp().
1160 *
1161 * It's an exact duplicate. Drop the new one and
1162 * use the old one.
1163 *
1164 * If there's a cached reply, the caller will take care
1165 * of sending it to the network layer.
1166 */
1167 len = talloc_array_length(old->packet);
1168 if ((len == talloc_array_length(track->packet)) &&
1169 (memcmp(old->packet, track->packet, len) == 0)) {
1170 fr_assert(old != track);
1171
1172 /*
1173 * Ignore duplicates while the client is
1174 * still pending.
1175 */
1176 if (client->state == PR_CLIENT_PENDING) {
1177 DEBUG("Ignoring duplicate packet while client %s is still pending dynamic definition",
1178 client->radclient->shortname);
1179 return NULL;
1180 }
1181
1182 *is_dup = true;
1183 old->packets++;
1184 talloc_free(track);
1185
1186 /*
1187 * Retransmits can sit in the outbound queue for
1188 * a while. We don't want to time out this
1189 * struct while the packet is in the outbound
1190 * queue.
1191 */
1192 FR_TIMER_DISARM(old->ev);
1193 return old;
1194 }
1195
1196 /*
1197 * Else it's a conflicting packet. Which is OK if we
1198 * already have a reply. We just delete the old entry,
1199 * and insert the new one.
1200 *
1201 * If there's no reply, then the old request is still
1202 * "live". Delete the old one from the tracking tree,
1203 * and return the new one.
1204 */
1205 if (old->reply_len || old->do_not_respond) {
1206 talloc_free(old);
1207
1208 } else {
1209 fr_assert(client == old->client);
1210
1211 if (!fr_rb_delete(client->table, old)) {
1212 fr_assert(0);
1213 }
1214 FR_TIMER_DELETE(&old->ev);
1215
1216 talloc_set_destructor(old, track_free);
1217
1218 old->discard = true; /* don't send any reply, there's nowhere for it to go */
1219 }
1220
1221do_insert:
1222 if (!fr_rb_insert(client->table, track)) {
1223 fr_assert(0);
1224 }
1225
1226 client->packets++;
1227 talloc_set_destructor(track, track_dedup_free);
1228 return track;
1229}
1230
1231
1233{
1234 fr_io_track_t *track = pending->track;
1235
1236 /*
1237 * Note that we don't check timestamps, replies, etc. If
1238 * a packet is pending, then any conflicting packet gets
1239 * the "pending" entry marked as such, and a new entry
1240 * added. Any duplicate packet gets suppressed. And
1241 * because the packets are pending, track->reply MUST be
1242 * NULL.
1243 */
1244 fr_assert(track->packets > 0);
1245 track->packets--;
1246
1247 /*
1248 * No more packets using this tracking entry,
1249 * delete it.
1250 */
1251 if (track->packets == 0) talloc_free(track);
1252
1253 return 0;
1254}
1255
1257 uint8_t const *buffer, size_t packet_len,
1258 fr_io_track_t *track,
1259 int priority)
1260{
1261 fr_io_pending_packet_t *pending;
1262
1263 MEM(pending = talloc_zero(client->pending, fr_io_pending_packet_t));
1264
1265 MEM(pending->buffer = talloc_memdup(pending, buffer, packet_len));
1266 pending->buffer_len = packet_len;
1267 pending->priority = priority;
1268 pending->track = track;
1269 pending->recv_time = track->timestamp; /* there can only be one */
1270
1271 talloc_set_destructor(pending, pending_free);
1272
1273 /*
1274 * Insert the pending packet for this client. If it
1275 * fails, silently discard the packet.
1276 */
1277 if (fr_heap_insert(&client->pending, pending) < 0) {
1278 talloc_free(pending);
1279 return NULL;
1280 }
1281
1282 /*
1283 * We only track pending packets for the
1284 * main socket. For connected sockets,
1285 * we pause the FD, so the number of
1286 * pending packets will always be small.
1287 */
1288 if (!connection) client->thread->num_pending_packets++;
1289
1290 return pending;
1291}
1292
1293
1294/*
1295 * Order clients in the alive_clients heap, based on their IP
1296 * address.
1297 *
1298 * This function is only used for the "main" socket. Clients
1299 * from connections do not use it.
1300 */
1301static int8_t alive_client_cmp(void const *one, void const *two)
1302{
1305
1306 return fr_ipaddr_cmp(&a->src_ipaddr, &b->src_ipaddr);
1307}
1308
1309/** Implement 99% of the read routines.
1310 *
1311 * The app_io->read does the transport-specific data read.
1312 */
1313static ssize_t mod_read(fr_listen_t *li, void **packet_ctx, fr_time_t *recv_time_p,
1314 uint8_t *buffer, size_t buffer_len, size_t *leftover)
1315{
1316 fr_io_instance_t const *inst;
1317 fr_io_thread_t *thread;
1318 ssize_t packet_len = -1;
1319 fr_time_t recv_time = fr_time_wrap(0);
1320 fr_io_client_t *client;
1321 fr_io_address_t address;
1322 fr_io_connection_t my_connection, *connection;
1323 fr_io_pending_packet_t *pending = NULL;
1324 fr_io_track_t *track;
1325 fr_listen_t *child;
1326 int value, accept_fd = -1;
1327 uint32_t priority = PRIORITY_NORMAL;
1328
1329/** Log that we ignore clients in debug mode, or when it's enabled for a listener
1330 */
1331#define LOG_IGNORED_CLIENTS(_inst) ((_inst)->log_ignored_clients || fr_debug_lvl >= 1)
1332
1333 get_inst(li, &inst, &thread, &connection, &child);
1334
1335 track = NULL;
1336
1337 /*
1338 * There was data left over from the previous read, go
1339 * get the rest of it now. We MUST do this instead of
1340 * popping a pending packet, because the leftover bytes
1341 * are already in the output buffer.
1342 */
1343 if (*leftover) goto do_read;
1344
1345redo:
1346 /*
1347 * Read one pending packet. The packet may be pending
1348 * because of dynamic client definitions, or because it's
1349 * for a connected UDP socket, and was sent over by the
1350 * "master" UDP socket.
1351 */
1352 if (connection) {
1353 /*
1354 * The connection is dead. Tell the network side
1355 * to close it.
1356 */
1357 if (connection->dead) {
1358 DEBUG("Dead connection %s", connection->name);
1359 return -1;
1360 }
1361
1362 pending = fr_heap_pop(&connection->client->pending);
1363
1364 } else if (thread->pending_clients) {
1365 pending = pending_packet_pop(thread);
1366
1367 } else {
1368 pending = NULL;
1369 }
1370
1371 if (pending) {
1372 fr_assert(buffer_len >= pending->buffer_len);
1373 track = pending->track;
1374
1375 /*
1376 * Clear the destructor as we now own the
1377 * tracking entry.
1378 */
1379 talloc_set_destructor(pending, NULL);
1380
1381 /*
1382 * We received a conflicting packet while this
1383 * packet was pending. Discard this entry and
1384 * try to get another one.
1385 *
1386 * Note that the pending heap is *simple*. We
1387 * just track priority and recv_time. This means
1388 * it's fast, but also that it's hard to look up
1389 * random packets in the pending heap.
1390 */
1391 if (fr_time_neq(pending->recv_time, track->timestamp)) {
1392 DEBUG3("Discarding old packet");
1393 TALLOC_FREE(pending);
1394 goto redo;
1395 }
1396
1397 /*
1398 * We have a valid packet. Copy it over to the
1399 * caller, and return.
1400 */
1401 *packet_ctx = track;
1402 *leftover = 0;
1403 recv_time = *recv_time_p = pending->recv_time;
1404 client = track->client;
1405
1406 memcpy(buffer, pending->buffer, pending->buffer_len);
1407 packet_len = pending->buffer_len;
1408
1409 /*
1410 * Shouldn't be necessary, but what the heck...
1411 */
1412 memcpy(&address, track->address, sizeof(address));
1413 TALLOC_FREE(pending);
1414
1415 /*
1416 * Skip over all kinds of logic to find /
1417 * allocate the client, when we don't need to do
1418 * it any more.
1419 */
1420 goto have_client;
1421
1422 } else if (!connection && (inst->ipproto == IPPROTO_TCP)) {
1423 struct sockaddr_storage saremote;
1424 socklen_t salen;
1425
1426 salen = sizeof(saremote);
1427
1428 /*
1429 * We're a TCP socket but are NOT connected. We
1430 * must be the master socket. Accept the new
1431 * connection, and figure out src/dst IP/port.
1432 */
1433 accept_fd = accept(child->fd,
1434 (struct sockaddr *) &saremote, &salen);
1435
1436 /*
1437 * Couldn't open a NEW socket, but THIS ONE is
1438 * OK. So don't return -1.
1439 */
1440 if (accept_fd < 0) {
1441 RATE_LIMIT_LOCAL(&thread->rate_limit.accept_failed,
1442 INFO, "proto_%s - failed to accept new socket: %s",
1443 inst->app->common.name, fr_syserror(errno));
1444 return 0;
1445 }
1446
1447 /*
1448 * Set the new descriptor to be non-blocking.
1449 */
1450 (void) fr_nonblock(accept_fd);
1451
1452#ifdef STATIC_ANALYZER
1453 saremote.ss_family = AF_INET; /* static analyzer doesn't know that accept() initializes this */
1454#endif
1455
1456 /*
1457 * Get IP addresses only if we have IP addresses.
1458 */
1459 if ((saremote.ss_family == AF_INET) || (saremote.ss_family == AF_INET6)) {
1460 memset(&address.socket, 0, sizeof(address.socket));
1461 (void) fr_ipaddr_from_sockaddr(&address.socket.inet.src_ipaddr, &address.socket.inet.src_port,
1462 &saremote, salen);
1463 salen = sizeof(saremote);
1464
1465 /*
1466 * @todo - only if the local listen address is "*".
1467 */
1468 (void) getsockname(accept_fd, (struct sockaddr *) &saremote, &salen);
1469 (void) fr_ipaddr_from_sockaddr(&address.socket.inet.dst_ipaddr, &address.socket.inet.dst_port,
1470 &saremote, salen);
1471 address.socket.type = (inst->ipproto == IPPROTO_TCP) ? SOCK_STREAM : SOCK_DGRAM;
1472 address.socket.fd = accept_fd;
1473 }
1474
1475 } else {
1476 fr_io_address_t *local_address;
1477
1478 /*
1479 * We're either not a TCP socket, or we are a
1480 * connected TCP socket. Just read it.
1481 */
1482do_read:
1483 local_address = &address;
1484
1485 /*
1486 * @todo - For connected TCP sockets which are
1487 * dynamically defined, the app_io read()
1488 * function should stop reading the socket if the
1489 * server is busy. That change puts TCP
1490 * backpressure on the client.
1491 *
1492 * @todo TLS - for TLS and dynamic sockets, do
1493 * the SSL setup here, but have a structure which
1494 * describes the TLS data and run THAT through
1495 * the dynamic client definition, instead of
1496 * using normal packets. Or, rely on the app_io
1497 * read() function to do all TLS work? Given
1498 * that some protocols have "starttls" beginning
1499 * after a clear-text exchange, it's likely best
1500 * to have yet another layer of trampoline
1501 * functions which do all of the TLS work.
1502 */
1503 packet_len = inst->app_io->read(child, (void **) &local_address, &recv_time,
1504 buffer, buffer_len, leftover);
1505 if (packet_len <= 0) {
1506 return packet_len;
1507 }
1508
1509 /*
1510 * Not allowed? Discard it. The priority()
1511 * function has done any complaining, if
1512 * necessary.
1513 */
1514 if (inst->app->priority) {
1515 value = inst->app->priority(inst->app_instance, buffer, packet_len);
1516 if (value <= 0) {
1517 static fr_rate_limit_t bad_type;
1518
1519 /*
1520 * @todo - unix sockets. We need to use
1521 * the "name" of the socket, in the
1522 * listener?
1523 */
1525 RATE_LIMIT_LOCAL(thread ? &thread->rate_limit.bad_type : &bad_type, INFO,
1526 "proto_%s - ignoring packet from IP %pV. It is not configured as 'type = ...'",
1527 inst->app_io->common.name, fr_box_ipaddr(address.socket.inet.src_ipaddr));
1528 }
1529 return 0;
1530 }
1531 priority = value;
1532 }
1533
1534 /*
1535 * If the connection is pending, pause reading of
1536 * more packets. If mod_write() accepts the
1537 * connection, it will resume reading.
1538 * Otherwise, it will close the socket without
1539 * resuming it.
1540 */
1541 if (connection &&
1542 (connection->client->state == PR_CLIENT_PENDING)) {
1543 fr_assert(!connection->paused);
1544
1545 connection->paused = true;
1546 (void) fr_event_filter_update(connection->el,
1547 child->fd,
1549 }
1550 }
1551
1552 /*
1553 * Look up the client, unless we already have one (for a
1554 * connected socket).
1555 */
1556 if (!connection) {
1557 client = fr_trie_lookup_by_key(thread->trie,
1558 &address.socket.inet.src_ipaddr.addr, address.socket.inet.src_ipaddr.prefix);
1559 fr_assert(!client || !client->connection);
1560
1561 } else {
1562 client = connection->client;
1563
1564 /*
1565 * We don't care what the read function says
1566 * about address. We have it already.
1567 */
1568 address = *connection->address;
1569 }
1570
1571 /*
1572 * Negative cache entry. Drop the packet.
1573 */
1574 if (client && client->state == PR_CLIENT_NAK) {
1575 if (accept_fd >= 0) close(accept_fd);
1576 return 0;
1577 }
1578
1579 /*
1580 * If there's no client, try to pull one from the global
1581 * / static client list. Or if dynamic clients are
1582 * allowed, try to define a dynamic client.
1583 */
1584 if (!client) {
1585 fr_client_t *radclient = NULL;
1587 fr_ipaddr_t const *network = NULL;
1588 char const *error;
1589
1590 /*
1591 * We MUST be the master socket.
1592 */
1593 fr_assert(!connection);
1594
1595 radclient = inst->app_io->client_find(thread->child, &address.socket.inet.src_ipaddr, inst->ipproto);
1596 if (radclient) {
1597 state = PR_CLIENT_STATIC;
1598
1599 /*
1600 * Make our own copy that we can modify it.
1601 */
1602 MEM(radclient = radclient_clone(thread, radclient));
1603 radclient->active = true;
1604
1605 } else if (inst->dynamic_clients) {
1606 if (inst->max_clients && (fr_heap_num_elements(thread->alive_clients) >= inst->max_clients)) {
1607 error = "Too many dynamic clients have been defined";
1608 goto ignore;
1609 }
1610
1611 /*
1612 * Look up the allowed networks.
1613 */
1614 network = fr_trie_lookup_by_key(inst->networks, &address.socket.inet.src_ipaddr.addr,
1615 address.socket.inet.src_ipaddr.prefix);
1616 if (!network) {
1617 error = "Address is outside of the the 'allow' network range";
1618 goto ignore;
1619 }
1620
1621 /*
1622 * It exists, but it's a "deny" rule, ignore it.
1623 */
1624 if (network->af == AF_UNSPEC) {
1625 error = "Address is forbidden by the 'deny' network range";
1626 goto ignore;
1627 }
1628
1629 /*
1630 * Allocate our local radclient as a
1631 * placeholder for the dynamic client.
1632 */
1633 radclient = radclient_alloc(thread, inst->ipproto, &address);
1634 state = PR_CLIENT_PENDING;
1635
1636 } else {
1637 char const *msg;
1638
1639 error = "No matching 'client' definition was found";
1640
1641 ignore:
1642 if (accept_fd < 0) {
1643 msg = "packet";
1644 } else {
1645 msg = "connection attempt";
1646 close(accept_fd);
1647 }
1648
1650 static fr_rate_limit_t unknown_client;
1651 RATE_LIMIT_LOCAL(thread ? &thread->rate_limit.unknown_client : &unknown_client,
1652 ERROR, "proto_%s - Ignoring %s from IP address %pV - %s",
1653 inst->app_io->common.name, msg, fr_box_ipaddr(address.socket.inet.src_ipaddr),
1654 error);
1655 }
1656
1657 return 0;
1658 }
1659
1660 MEM(client = client_alloc(thread, state, inst, thread, radclient, network));
1661 }
1662
1663have_client:
1664 fr_assert(client->state != PR_CLIENT_INVALID);
1665 fr_assert(client->state != PR_CLIENT_NAK);
1666
1667 /*
1668 * We've accepted a new connection. Go allocate it, and
1669 * let it read from the socket.
1670 */
1671 if (accept_fd >= 0) {
1672 if (!fr_io_connection_alloc(inst, thread, client, accept_fd, &address, NULL)) {
1673 static fr_rate_limit_t alloc_failed;
1674
1675 RATE_LIMIT_LOCAL(thread ? &thread->rate_limit.conn_alloc_failed : &alloc_failed,
1676 ERROR, "Failed to allocate connection from client %s", client->radclient->shortname);
1677 }
1678
1679 return 0;
1680 }
1681
1682 /*
1683 * No connected sockets, OR we are the connected socket.
1684 *
1685 * Track this packet and return it if necessary.
1686 */
1687 if (connection || !client->use_connected) {
1688 fr_io_track_t *to_free = NULL;
1689
1690 /*
1691 * Add the packet to the tracking table, if it's
1692 * not already there. Pending packets will be in
1693 * the tracking table, but won't be counted as
1694 * "live" packets.
1695 */
1696 if (!track) {
1697 static fr_rate_limit_t tracking_failed;
1698 bool is_dup = false;
1699
1700 track = fr_io_track_add(client, &address, buffer, packet_len, recv_time, &is_dup);
1701 if (!track) {
1702 RATE_LIMIT_LOCAL(thread ? &thread->rate_limit.tracking_failed : &tracking_failed,
1703 ERROR, "Failed tracking packet from client %s - discarding it",
1704 client->radclient->shortname);
1705 return 0;
1706 }
1707
1708 /*
1709 * If there's a cached reply, just send that and don't do anything else.
1710 */
1711 if (is_dup) {
1712 fr_network_t *nr;
1713
1714 if (track->do_not_respond) {
1715 DEBUG("Ignoring retransmit from client %s - we are not responding to this request", client->radclient->shortname);
1716 return 0;
1717 }
1718
1719 if (track->discard) {
1720 DEBUG("Ignoring transmit from client %s - we previously received a newer / conflicting packet", client->radclient->shortname);
1721 return 0;
1722 }
1723
1724 if (!track->reply) {
1725 fr_assert(!track->finished);
1726 DEBUG("Ignoring retransmit from client %s - we are still processing the request", client->radclient->shortname);
1727 return 0;
1728 }
1729
1730 if (connection) {
1731 nr = connection->nr;
1732 } else {
1733 nr = thread->nr;
1734 }
1735
1736 /*
1737 * @todo - mark things up so that we know to keep 'track' around
1738 * until the packet is actually written to the network. OR, add
1739 * a network API so that the talloc_free() function can remove
1740 * the packet from the queue of packets to be retransmitted.
1741 *
1742 * Perhaps via having fr_network_listen_write() return a pointer
1743 * to the localized message, and then caching that in the tracking
1744 * structure.
1745 */
1746 DEBUG("Sending duplicate reply to client %s", client->radclient->shortname);
1747 fr_network_listen_write(nr, li, track->reply, track->reply_len,
1748 track, track->timestamp);
1749 return 0;
1750 }
1751
1752 /*
1753 * Got to free this if we don't process the packet.
1754 */
1755 to_free = track;
1756 }
1757
1758 /*
1759 * This is a pending dynamic client. See if we
1760 * have to either run the dynamic client code to
1761 * define the client, OR to push the packet onto
1762 * the pending queue for this client.
1763 */
1764 if (client->state == PR_CLIENT_PENDING) {
1765 /*
1766 * Track pending packets for the master
1767 * socket. Connected sockets are paused
1768 * as soon as they are defined, so we
1769 * won't be reading any more packets from
1770 * them.
1771 *
1772 * Since we don't have pending packets
1773 * for connected sockets, we don't need
1774 * to track pending packets.
1775 */
1776 if (!connection && inst->max_pending_packets && (thread->num_pending_packets >= inst->max_pending_packets)) {
1777 RATE_LIMIT_LOCAL(&thread->rate_limit.too_many_pending,
1778 ERROR, "Too many pending dynamic client packets for listener - discarding packet from %pV",
1779 fr_box_ipaddr(client->src_ipaddr));
1780
1781 discard:
1782 talloc_free(to_free);
1783 return 0;
1784 }
1785
1786 /*
1787 * Allocate the pending packet structure.
1788 */
1789 pending = fr_io_pending_alloc(connection, client, buffer, packet_len,
1790 track, priority);
1791 if (!pending) {
1792 static fr_rate_limit_t alloc_failed;
1793 RATE_LIMIT_LOCAL(thread ? &thread->rate_limit.alloc_failed : &alloc_failed,
1794 ERROR, "proto_%s - Failed allocating space for dynamic client %pV - discarding packet",
1795 inst->app_io->common.name, fr_box_ipaddr(client->src_ipaddr));
1796 goto discard;
1797 }
1798
1799 if (fr_heap_num_elements(client->pending) > 1) {
1800 DEBUG("Verification is still pending for dynamic client %pV - queuing additional packet(s)",
1801 fr_box_ipaddr(client->src_ipaddr));
1802 return 0;
1803 }
1804
1805 /*
1806 * Tell this packet that it's defining a
1807 * dynamic client.
1808 */
1809 track->dynamic = recv_time;
1810
1811 INFO("proto_%s - Verification started for packet from dynamic client %pV - queuing new packets",
1812 inst->app_io->common.name, fr_box_ipaddr(client->src_ipaddr));
1813 }
1814
1815 /*
1816 * Remove all cleanup timers for the client /
1817 * connection. It's still in use, so we don't
1818 * want to clean it up.
1819 */
1820 if (fr_timer_armed(client->ev)) {
1821 FR_TIMER_DELETE_RETURN(&client->ev);
1822 client->ready_to_delete = false;
1823 }
1824
1825 /*
1826 * Return the packet.
1827 */
1828 *recv_time_p = track->timestamp;
1829 *packet_ctx = track;
1830 return packet_len;
1831 }
1832
1833 /*
1834 *
1835 */
1836 fr_assert(!pending);
1837
1838 /*
1839 * This must be the main UDP socket which creates
1840 * connections.
1841 */
1842 fr_assert(inst->ipproto == IPPROTO_UDP);
1843
1844 /*
1845 * We're using connected sockets, but this socket isn't
1846 * connected. It must be the master socket. The master
1847 * can either be STATIC, DYNAMIC, or PENDING. Whatever
1848 * the state, the child socket will take care of handling
1849 * the packet. e.g. dynamic clients, etc.
1850 */
1851 {
1852 bool nak = false;
1853
1854 my_connection.address = &address;
1855
1856 pthread_mutex_lock(&client->mutex);
1857 connection = fr_hash_table_find(client->ht, &my_connection);
1858 if (connection) nak = (connection->client->state == PR_CLIENT_NAK);
1859 pthread_mutex_unlock(&client->mutex);
1860
1861 /*
1862 * The connection is in NAK state, ignore packets
1863 * for it.
1864 */
1865 if (nak) {
1866 RATE_LIMIT_LOCAL(&thread->rate_limit.repeat_nak, ERROR, "proto_%s - Discarding repeated packet from NAK'd dynamic client %pV",
1867 inst->app_io->common.name, fr_box_ipaddr(address.socket.inet.src_ipaddr));
1868
1869 DEBUG("Discarding packet to NAKed connection %s", connection->name);
1870 return 0;
1871 }
1872 }
1873
1874 /*
1875 * No existing connection, create one.
1876 */
1877 if (!connection) {
1878 connection = fr_io_connection_alloc(inst, thread, client, -1, &address, NULL);
1879 if (!connection) {
1880 RATE_LIMIT_LOCAL(&thread->rate_limit.conn_alloc_failed,
1881 ERROR, "Failed to allocate connection from client %s. Discarding packet.", client->radclient->shortname);
1882 return 0;
1883 }
1884 }
1885
1886 DEBUG("Sending packet to connection %s", connection->name);
1887
1888 /*
1889 * Inject the packet into the connected socket. It will
1890 * process the packet as if it came in from the network.
1891 *
1892 * @todo future - after creating the connection, put the
1893 * current packet into connection->pending, instead of
1894 * inject?, and then call fr_network_listen_read() from
1895 * the child's instantiation routine???
1896 *
1897 * @todo TCP - for ACCEPT sockets, we don't have a
1898 * packet, so don't do this. Instead, the connection
1899 * will take care of figuring out what to do.
1900 *
1901 * We don't need "to_free" after this, as it will be
1902 * tracked in the connected socket.
1903 */
1904 if (fr_network_listen_inject(connection->nr, connection->listen,
1905 buffer, packet_len, recv_time) < 0) {
1906 RATE_LIMIT_LOCAL(&thread->rate_limit.queue_full, PERROR,
1907 "proto_%s - Discarding packet from dynamic client %pV - cannot push packet to connected socket",
1908 inst->app_io->common.name, fr_box_ipaddr(address.socket.inet.src_ipaddr));
1909 /*
1910 * Don't return an error, because that will cause the listener to close its socket.
1911 */
1912 }
1913
1914 return 0;
1915}
1916
1917/** Inject a packet to a connection.
1918 *
1919 * Always called in the context of the network.
1920 */
1921static int mod_inject(fr_listen_t *li, uint8_t const *buffer, size_t buffer_len, fr_time_t recv_time)
1922{
1923 fr_io_instance_t const *inst;
1924 int priority;
1925 bool is_dup = false;
1926 fr_io_connection_t *connection;
1927 fr_io_pending_packet_t *pending;
1928 fr_io_track_t *track;
1929
1930 get_inst(li, &inst, NULL, &connection, NULL);
1931
1932 if (!connection) {
1933 DEBUG2("Received injected packet for an unconnected socket.");
1934 return -1;
1935 }
1936
1937 priority = inst->app->priority(inst, buffer, buffer_len);
1938 if (priority <= 0) {
1939 return -1;
1940 }
1941
1942 /*
1943 * Track this packet, because that's what mod_read expects.
1944 */
1945 track = fr_io_track_add(connection->client, connection->address,
1946 buffer, buffer_len, recv_time, &is_dup);
1947 if (!track) {
1948 DEBUG2("Failed injecting packet to tracking table");
1949 return -1;
1950 }
1951
1952 talloc_get_type_abort(track, fr_io_track_t);
1953
1954 /*
1955 * @todo future - what to do with duplicates?
1956 */
1957 fr_assert(!is_dup);
1958
1959 /*
1960 * Remember to restore this packet later.
1961 */
1962 pending = fr_io_pending_alloc(connection, connection->client, buffer, buffer_len,
1963 track, priority);
1964 if (!pending) {
1965 DEBUG2("Failed injecting packet due to allocation error");
1966 return -1;
1967 }
1968
1969 return 0;
1970}
1971
1972/** Open a new listener
1973 *
1974 */
1975static int mod_open(fr_listen_t *li)
1976{
1977 fr_io_thread_t *thread;
1978 fr_io_instance_t const *inst;
1979
1980 thread = li->thread_instance;
1981 inst = li->app_io_instance;
1982
1983 if (inst->app_io->open(thread->child) < 0) return -1;
1984
1985 li->fd = thread->child->fd; /* copy this back up */
1986
1987 /*
1988 * Set the name of the socket.
1989 */
1990 if (!li->app_io->get_name) {
1991 li->name = li->app_io->common.name;
1992 } else {
1993 li->name = li->app_io->get_name(li);
1994 }
1995
1996 /*
1997 * Note that we're opening a child socket, so we don't
1998 * put it into the list of global listeners.
1999 */
2000
2001 return 0;
2002}
2003
2004
2005/** Set the event list for a new socket
2006 *
2007 * @param[in] li the listener
2008 * @param[in] el the event list
2009 * @param[in] nr context from the network side
2010 */
2012{
2013 fr_io_instance_t const *inst;
2014 fr_io_connection_t *connection;
2015 fr_io_thread_t *thread;
2016 fr_listen_t *child;
2017
2018 get_inst(li, &inst, &thread, &connection, &child);
2019
2020 /*
2021 * We're not doing IO, so there are no timers for
2022 * cleaning up packets, dynamic clients, or connections.
2023 */
2024 if (!inst->submodule) return;
2025
2026 if (inst->app_io->event_list_set) {
2027 inst->app_io->event_list_set(child, el, nr);
2028 }
2029
2030 /*
2031 * Set event list and network side for this socket.
2032 */
2033 if (!connection) {
2034 thread->el = el;
2035 thread->nr = nr;
2036
2037 } else {
2038 connection->el = el;
2039 connection->nr = nr;
2040 }
2041}
2042
2043
2044static void client_expiry_timer(fr_timer_list_t *tl, fr_time_t now, void *uctx)
2045{
2046 fr_io_client_t *client = talloc_get_type_abort(uctx, fr_io_client_t);
2047 fr_io_instance_t const *inst;
2048 fr_io_connection_t *connection;
2049 fr_time_delta_t delay;
2050 int connections;
2051
2052 /*
2053 * No event list? We don't need to expire the client.
2054 */
2055 if (!tl) return;
2056
2057 // @todo - print out what we plan on doing next
2058 connection = client->connection;
2059 inst = client->inst;
2060
2061 fr_assert(client->state != PR_CLIENT_STATIC);
2062
2063 /*
2064 * Called from the read or write functions with
2065 * now==0, to signal that we have to *set* the timer.
2066 */
2067 if (fr_time_eq(now, fr_time_wrap(0))) {
2068 /*
2069 * The timer is already set, don't do anything.
2070 */
2071 if (fr_timer_armed(client->ev)) return;
2072
2073 switch (client->state) {
2075 fr_assert(connection != NULL);
2077
2078 case PR_CLIENT_DYNAMIC:
2079 delay = inst->idle_timeout;
2081 (fr_time_delta_lt(client->radclient->limit.idle_timeout, inst->idle_timeout))) {
2082 delay = client->radclient->limit.idle_timeout;
2083 }
2084 break;
2085
2086 case PR_CLIENT_NAK:
2087 delay = inst->nak_lifetime;
2088 break;
2089
2090 default:
2091 fr_assert(0 == 1);
2092 return;
2093 }
2094
2095 DEBUG("TIMER - setting idle timeout to %pVs for connection from client %s", fr_box_time_delta(delay), client->radclient->shortname);
2096
2097 goto reset_timer;
2098 }
2099
2100 /*
2101 * It's a negative cache entry. Just delete it.
2102 */
2103 if (client->state == PR_CLIENT_NAK) {
2104 INFO("proto_%s - Expiring NAK'd dynamic client %pV - permitting new packets to be verified",
2105 inst->app_io->common.name, fr_box_ipaddr(client->src_ipaddr));
2106
2107 delete_client:
2108 fr_assert(client->packets == 0);
2109
2110 /*
2111 * It's a connected socket. Remove it from the
2112 * parents list of connections, and delete it.
2113 */
2114 if (connection) {
2115 pthread_mutex_lock(&connection->parent->mutex);
2116 if (connection->in_parent_hash) {
2117 connection->in_parent_hash = false;
2118 (void) fr_hash_table_delete(connection->parent->ht, connection);
2119 }
2120 pthread_mutex_unlock(&connection->parent->mutex);
2121
2122 /*
2123 * Mark the connection as dead, and tell
2124 * the network side to stop reading from
2125 * it.
2126 */
2127 connection->dead = true;
2128 fr_network_listen_read(connection->nr, connection->listen);
2129 return;
2130 }
2131
2132 talloc_free(client);
2133 return;
2134 }
2135
2136 DEBUG("TIMER - checking status of dynamic client %s %pV", client->radclient->shortname, fr_box_ipaddr(client->src_ipaddr));
2137
2138 /*
2139 * It's a dynamically defined client. If no one is using
2140 * it, clean it up after an idle timeout.
2141 */
2142 if ((client->state == PR_CLIENT_DYNAMIC) ||
2143 (client->state == PR_CLIENT_CONNECTED)) {
2144 if (client->packets > 0) {
2145 client->ready_to_delete = false;
2146 return;
2147 }
2148
2149 /*
2150 * No packets, check / set idle timeout.
2151 */
2152 goto idle_timeout;
2153 }
2154
2155 /*
2156 * The client is pending definition. It's either a
2157 * dynamic client which has timed out, OR it's a
2158 * "place-holder" client for connected sockets.
2159 */
2160 fr_assert(client->state == PR_CLIENT_PENDING);
2161
2162 /*
2163 * This is a dynamic client pending definition.
2164 * But it's taken too long to define, so we just
2165 * delete the client, and all packets for it. A
2166 * new packet will cause the dynamic definition
2167 * to be run again.
2168 */
2169 if (!client->use_connected) {
2170 if (!client->packets) {
2171 DEBUG("proto_%s - No packets are using unconnected socket %s", inst->app_io->common.name, connection->name);
2172 goto delete_client;
2173 }
2174
2175 /*
2176 * Tell the writer to NOT dynamically define the
2177 * client. We've run into a problem. Then,
2178 * return. The writer will take care of calling
2179 * us again when it notices that a PENDING client
2180 * is ready to delete.
2181 *
2182 * TBH... that shouldn't happen? We should rely
2183 * on the write to do this all of the time...
2184 */
2185 client->ready_to_delete = true;
2186 return;
2187 }
2188
2189 fr_assert(!connection);
2190
2191 /*
2192 * Find out how many connections are using this
2193 * client.
2194 */
2195 pthread_mutex_lock(&client->mutex);
2196 fr_assert(client->ht != NULL);
2197 connections = fr_hash_table_num_elements(client->ht);
2198 pthread_mutex_unlock(&client->mutex);
2199
2200 /*
2201 * No connections are using this client. If
2202 * we've passed the idle timeout, then just
2203 * delete it. Otherwise, set an idle timeout (as
2204 * above);
2205 */
2206 if (!connections) {
2207idle_timeout:
2208 /*
2209 * We didn't receive any packets during the
2210 * idle_timeout, just delete it.
2211 */
2212 if (client->ready_to_delete) {
2213 if (connection) {
2214 DEBUG("proto_%s - idle timeout for connection %s", inst->app_io->common.name, connection->name);
2215 } else {
2216 DEBUG("proto_%s - idle timeout for client %s", inst->app_io->common.name, client->radclient->shortname);
2217 }
2218 goto delete_client;
2219 }
2220
2221 /*
2222 * No packets and no idle timeout set, go set
2223 * idle timeut.
2224 */
2225 client->ready_to_delete = true;
2226 delay = inst->idle_timeout;
2227 goto reset_timer;
2228 }
2229
2230 /*
2231 * There are live sub-connections. Poll again after a
2232 * long period of time. Once all of the connections are
2233 * closed, we can then delete this client.
2234 *
2235 * @todo - maybe just leave it? we want to be able to
2236 * clean up this client after a while tho... especially
2237 * if the total number of clients is limited.
2238 */
2239 client->ready_to_delete = false;
2240 delay = inst->check_interval;
2241
2242reset_timer:
2243 if (fr_timer_in(client, tl, &client->ev,
2244 delay, false, client_expiry_timer, client) < 0) {
2245 ERROR("proto_%s - Failed adding timeout for dynamic client %s. It will be permanent!",
2246 inst->app_io->common.name, client->radclient->shortname);
2247 return;
2248 }
2249
2250 return;
2251}
2252
2253
2254/*
2255 * Expire cached packets after cleanup_delay time
2256 */
2257static void packet_expiry_timer(fr_timer_list_t *tl, fr_time_t now, void *uctx)
2258{
2259 fr_io_track_t *track = talloc_get_type_abort(uctx, fr_io_track_t);
2260 fr_io_client_t *client = track->client;
2261 fr_io_instance_t const *inst = client->inst;
2262
2263 /*
2264 * Insert the timer if requested.
2265 *
2266 * On duplicates this also extends the expiry timer.
2267 */
2268 if (fr_time_eq(now, fr_time_wrap(0)) && !track->discard && inst->app_io->track_duplicates) {
2269 fr_assert(fr_time_delta_ispos(inst->cleanup_delay));
2270 fr_assert(track->do_not_respond || track->reply_len);
2271
2272 track->expires = fr_time_add(fr_time(), inst->cleanup_delay);
2273
2274 /*
2275 * if the timer succeeds, then "track"
2276 * will be cleaned up when the timer
2277 * fires.
2278 */
2279 if (fr_timer_at(track, tl, &track->ev,
2280 track->expires,
2281 false, packet_expiry_timer, track) == 0) {
2282 DEBUG("proto_%s - cleaning up request in %.6fs", inst->app_io->common.name,
2283 fr_time_delta_unwrap(inst->cleanup_delay) / (double)NSEC);
2284 return;
2285 }
2286
2287 DEBUG("proto_%s - Failed adding cleanup_delay for packet. Discarding packet immediately",
2288 inst->app_io->common.name);
2289 }
2290
2291 /*
2292 * So that all cleanup paths can come here, not just the
2293 * timeout ones.
2294 */
2295 if (fr_time_neq(now, fr_time_wrap(0))) {
2296 DEBUG2("TIMER - proto_%s - cleanup delay", inst->app_io->common.name);
2297 } else {
2298 DEBUG2("proto_%s - cleaning up", inst->app_io->common.name);
2299 }
2300
2301 /*
2302 * Delete the tracking entry.
2303 */
2304 talloc_free(track);
2305
2306 /*
2307 * The client isn't dynamic, stop here.
2308 */
2309 if (client->state == PR_CLIENT_STATIC) return;
2310
2311 fr_assert(client->state != PR_CLIENT_NAK);
2312 fr_assert(client->state != PR_CLIENT_PENDING);
2313
2314 /*
2315 * If necessary, call the client expiry timer to clean up
2316 * the client.
2317 */
2318 if (client->packets == 0) {
2319 client_expiry_timer(tl, now, client);
2320 }
2321}
2322
2323static ssize_t mod_write(fr_listen_t *li, void *packet_ctx, fr_time_t request_time,
2324 uint8_t *buffer, size_t buffer_len, size_t written)
2325{
2326 fr_io_instance_t const *inst;
2327 fr_io_thread_t *thread;
2328 fr_io_connection_t *connection;
2329 fr_io_track_t *track = talloc_get_type_abort(packet_ctx, fr_io_track_t);
2330 fr_io_client_t *client;
2331 fr_client_t *radclient;
2332 fr_listen_t *child;
2334 char const *name;
2335
2336 get_inst(li, &inst, &thread, &connection, &child);
2337
2338 client = track->client;
2339 if (connection) {
2340 el = connection->el;
2341 name = connection->name;
2342 } else {
2343 el = thread->el;
2344 name = li->name;
2345 }
2346
2347 DEBUG3("Processing reply for %s", name);
2348
2349 /*
2350 * A fully defined client means that we just send the reply.
2351 */
2352 if (client->state != PR_CLIENT_PENDING) {
2353 ssize_t packet_len;
2354
2355 track->finished = true;
2356
2357 /*
2358 * The request received a conflicting packet, so we
2359 * discard this one.
2360 */
2361 if (fr_time_neq(track->timestamp, request_time) || track->discard) {
2362 fr_assert(track->packets > 0);
2363 track->packets--;
2364 DEBUG3("Suppressing reply as we have a newer / conflicing packet from the same source");
2365 track->discard = true;
2366 goto setup_timer;
2367 }
2368
2369 /*
2370 * We have a NAK packet, or the request has timed
2371 * out, or it was discarded due to a conflicting
2372 * packet. We don't respond, but we do cache the
2373 * "do not respond" reply for a period of time.
2374 */
2375 if ((buffer_len == 1) || track->do_not_respond) {
2376 DEBUG3("Not sending response to request - it is marked as 'do not respond'");
2377 track->do_not_respond = true;
2378 goto setup_timer;
2379 }
2380
2381 /*
2382 * We have a real packet, write it to the network
2383 * via the underlying transport write.
2384 */
2385 packet_len = inst->app_io->write(child, track, request_time,
2386 buffer, buffer_len, written);
2387 if (packet_len <= 0) {
2388 ERROR("Failed writing the reply - not sending any response on %s", name);
2389 track->discard = true;
2390 packet_expiry_timer(el->tl, fr_time_wrap(0), track);
2391 return packet_len;
2392 }
2393
2394 /*
2395 * Only a partial write. The network code will
2396 * take care of calling us again, and we will set
2397 * the expiry timer at that point.
2398 */
2399 if ((size_t) packet_len < buffer_len) {
2400 DEBUG3("Partial write (%zd < %zu)", packet_len, buffer_len);
2401 return packet_len;
2402 }
2403
2404 /*
2405 * We're not tracking duplicates, so just expire
2406 * the packet now.
2407 */
2408 if (!inst->app_io->track_duplicates) {
2409 DEBUG3("Not tracking duplicates - expiring the request");
2410 goto setup_timer;
2411 }
2412
2413 /*
2414 * Cache the reply packet if we're doing dedup.
2415 *
2416 * On resend duplicate reply, the reply is
2417 * already filled out. So we don't do that twice.
2418 */
2419 if (!track->reply) {
2420 DEBUG3("Caching reply");
2421 MEM(track->reply = talloc_memdup(track, buffer, buffer_len));
2422 track->reply_len = buffer_len;
2423 }
2424
2425 /*
2426 * Set the timer to expire the packet.
2427 *
2428 * On dedup this also extends the timer.
2429 */
2430 setup_timer:
2431 packet_expiry_timer(el->tl, fr_time_wrap(0), track);
2432 return buffer_len;
2433 }
2434
2435 /*
2436 * The client is pending, so we MUST have dynamic clients.
2437 *
2438 * If there's a connected socket and no dynamic clients, then the
2439 * client state is set to CONNECTED when the client is created.
2440 */
2441 fr_assert(inst->dynamic_clients);
2442 fr_assert(client->pending != NULL);
2443
2444 /*
2445 * The request has timed out trying to define the dynamic
2446 * client. Oops... try again.
2447 */
2448 if ((buffer_len == 1) && (*buffer == true)) {
2449 DEBUG("Request has timed out trying to define a new client. Trying again.");
2450 goto reread;
2451 }
2452
2453 /*
2454 * The dynamic client was NOT defined. Set it's state to
2455 * NAK, delete all pending packets, and close the
2456 * tracking table.
2457 */
2458 if (buffer_len == 1) {
2459 INFO("proto_%s - Verification failed for packet from dynamic client %pV - adding IP address to the NAK cache",
2460 inst->app_io->common.name, fr_box_ipaddr(client->src_ipaddr));
2461
2462 client->state = PR_CLIENT_NAK;
2463 if (!connection) {
2464 client_pending_free(client);
2465 } else {
2466 TALLOC_FREE(client->pending);
2467 }
2468 if (client->table) TALLOC_FREE(client->table);
2469 fr_assert(client->packets == 0);
2470
2471 /*
2472 * If we're a connected UDP socket, allocate a
2473 * new connection which is the place-holder for
2474 * the NAK. We will reject packets from from the
2475 * src/dst IP/port.
2476 *
2477 * The timer will take care of deleting the NAK
2478 * connection (which doesn't have any FDs
2479 * associated with it). The network side will
2480 * call mod_close() when the original connection
2481 * is done, which will then free that connection,
2482 * too.
2483 */
2484 if (connection && (inst->ipproto == IPPROTO_UDP)) {
2485 connection = fr_io_connection_alloc(inst, thread, client, -1, connection->address, connection);
2486 client_expiry_timer(el->tl, fr_time_wrap(0), connection->client);
2487
2488 errno = ECONNREFUSED;
2489 return -1;
2490 }
2491
2492 /*
2493 * For connected TCP sockets, we just call the
2494 * expiry timer, which will close and free the
2495 * connection.
2496 */
2497 client_expiry_timer(el->tl, fr_time_wrap(0), client);
2498 return buffer_len;
2499 }
2500
2501 fr_assert(buffer_len == sizeof(radclient));
2502
2503 memcpy(&radclient, buffer, sizeof(radclient));
2504
2505 if (!connection) {
2506 fr_ipaddr_t ipaddr;
2507
2508 /*
2509 * Check the encapsulating network against the
2510 * address that the user wants to use, but only
2511 * for unconnected sockets.
2512 */
2513 if (client->network.af != radclient->ipaddr.af) {
2514 DEBUG("Client IP address %pV IP family does not match the source network %pV of the packet.",
2515 fr_box_ipaddr(radclient->ipaddr), fr_box_ipaddr(client->network));
2516 goto error;
2517 }
2518
2519 /*
2520 * Network prefix is more restrictive than the one given
2521 * by the client... that's bad.
2522 */
2523 if (client->network.prefix > radclient->ipaddr.prefix) {
2524 DEBUG("Client IP address %pV is not within the prefix with the defined network %pV",
2525 fr_box_ipaddr(radclient->ipaddr), fr_box_ipaddr(client->network));
2526 goto error;
2527 }
2528
2529 ipaddr = radclient->ipaddr;
2530 fr_ipaddr_mask(&ipaddr, client->network.prefix);
2531 if (fr_ipaddr_cmp(&ipaddr, &client->network) != 0) {
2532 DEBUG("Client IP address %pV is not within the defined network %pV.",
2533 fr_box_ipaddr(radclient->ipaddr), fr_box_ipaddr(client->network));
2534 goto error;
2535 }
2536
2537 /*
2538 * We can't define dynamic clients as networks (for now).
2539 *
2540 * @todo - If we did allow it, we would have to remove
2541 * this client from the trie, update it's IP address, and
2542 * re-add it. We can PROBABLY do this if this client
2543 * isn't already connected, AND radclient->use_connected
2544 * is true. But that's for later...
2545 */
2546 if (((radclient->ipaddr.af == AF_INET) &&
2547 (radclient->ipaddr.prefix != 32)) ||
2548 ((radclient->ipaddr.af == AF_INET6) &&
2549 (radclient->ipaddr.prefix != 128))) {
2550 ERROR("Cannot define a dynamic client as a network");
2551
2552 error:
2553 talloc_free(radclient);
2554
2555 /*
2556 * Remove the pending client from the trie.
2557 */
2558 fr_assert(!connection);
2559 talloc_free(client);
2560 return buffer_len;
2561 }
2562 }
2563
2564 /*
2565 * The new client is mostly OK. Copy the various fields
2566 * over.
2567 */
2568#define COPY_FIELD(_dest, _x) _dest->radclient->_x = radclient->_x
2569#define DUP_FIELD(_dest, _x) _dest->radclient->_x = talloc_strdup(_dest->radclient, radclient->_x)
2570
2571 /*
2572 * Only these two fields are set. Other strings in
2573 * radclient are copies of these ones.
2574 */
2577
2578 DUP_FIELD(client, longname);
2579 DUP_FIELD(client, shortname);
2580 DUP_FIELD(client, secret);
2581 DUP_FIELD(client, nas_type);
2582
2583 COPY_FIELD(client, ipaddr);
2584 COPY_FIELD(client, src_ipaddr);
2585 COPY_FIELD(client, require_message_authenticator);
2586 COPY_FIELD(client, require_message_authenticator_is_set);
2587 COPY_FIELD(client, limit_proxy_state);
2588 COPY_FIELD(client, limit_proxy_state_is_set);
2589 COPY_FIELD(client, use_connected);
2590 COPY_FIELD(client, dedup_authenticator);
2591 COPY_FIELD(client, cs);
2592
2593 // @todo - fill in other fields?
2594
2595 talloc_free(radclient);
2596
2597 radclient = client->radclient; /* laziness */
2598 radclient->server_cs = inst->server_cs;
2599 radclient->server = cf_section_name2(inst->server_cs);
2600
2601 /*
2602 * This is a connected socket, and it's just been
2603 * allowed. Go poke the network side to read from the
2604 * socket.
2605 */
2606 if (connection) {
2607 fr_assert(connection != NULL);
2608 fr_assert(connection->client == client);
2609 fr_assert(client->connection != NULL);
2610
2611 client->state = PR_CLIENT_CONNECTED;
2612
2613 /*
2614 * Connections can't spawn new connections.
2615 */
2616 client->use_connected = radclient->use_connected = false;
2617
2618 /*
2619 * If we were paused. resume reading from the
2620 * connection.
2621 *
2622 * Note that the event list doesn't like resuming
2623 * a connection that isn't paused. It just sets
2624 * the read function to NULL.
2625 */
2626 if (connection->paused) {
2627 (void) fr_event_filter_update(el, child->fd,
2629 }
2630
2631 connection->parent->radclient->active = true;
2632 fr_assert(connection->parent->state == PR_CLIENT_PENDING);
2633 connection->parent->state = PR_CLIENT_DYNAMIC;
2634
2635 DUP_FIELD(connection->parent, longname);
2636 DUP_FIELD(connection->parent, shortname);
2637 DUP_FIELD(connection->parent, secret);
2638 DUP_FIELD(connection->parent, nas_type);
2639
2640 COPY_FIELD(connection->parent, ipaddr);
2641 COPY_FIELD(connection->parent, src_ipaddr);
2642 COPY_FIELD(connection->parent, require_message_authenticator);
2643 COPY_FIELD(connection->parent, require_message_authenticator_is_set);
2644 COPY_FIELD(connection->parent, limit_proxy_state);
2645 COPY_FIELD(connection->parent, limit_proxy_state_is_set);
2646 COPY_FIELD(connection->parent, use_connected);
2647 COPY_FIELD(connection->parent, cs);
2648
2649 /*
2650 * Re-parent the conf section used to build this client
2651 * so its lifetime is linked to parent client
2652 */
2653 talloc_steal(connection->parent->radclient, connection->parent->radclient->cs);
2654
2655 /*
2656 * The client has been allowed.
2657 */
2658 client->state = PR_CLIENT_DYNAMIC;
2659 client->radclient->active = true;
2660
2661 INFO("proto_%s - Verification succeeded for packet from dynamic client %pV - processing queued packets",
2662 inst->app_io->common.name, fr_box_ipaddr(client->src_ipaddr));
2663 goto finish;
2664 } else {
2665 /*
2666 * Re-parent the conf section used to build this client
2667 * so its lifetime is linked to the client
2668 */
2669 talloc_steal(radclient, radclient->cs);
2670 }
2671
2672 fr_assert(connection == NULL);
2673 fr_assert(client->use_connected == false); /* we weren't sure until now */
2674
2675 /*
2676 * Disallow unsupported configurations.
2677 */
2678 if (radclient->use_connected && !inst->app_io->connection_set) {
2679 DEBUG("proto_%s - cannot use connected sockets as underlying 'transport = %s' does not support it.",
2680 inst->app_io->common.name, inst->submodule->module->exported->name);
2681 goto error;
2682 }
2683
2684
2685 /*
2686 * Dynamic clients can spawn new connections.
2687 */
2688 client->use_connected = radclient->use_connected;
2689
2690 /*
2691 * The admin has defined a client which uses connected
2692 * sockets. Go spawn it
2693 */
2694 if (client->use_connected) {
2695 fr_assert(connection == NULL);
2696
2697
2698 /*
2699 * Leave the state as PENDING. Each connection
2700 * will then cause a dynamic client to be
2701 * defined.
2702 */
2703 (void) pthread_mutex_init(&client->mutex, NULL);
2704 MEM(client->ht = fr_hash_table_alloc(client, connection_hash, connection_cmp, NULL));
2705
2706 } else {
2707 /*
2708 * The client has been allowed.
2709 */
2710 client->state = PR_CLIENT_DYNAMIC;
2711 client->radclient->active = true;
2712
2713 INFO("proto_%s - Verification succeeded for packet from dynamic client %pV - processing %d queued packets",
2714 inst->app_io->common.name, fr_box_ipaddr(client->src_ipaddr),
2715 fr_heap_num_elements(client->pending));
2716 }
2717
2718 /*
2719 * Add this client to the master socket, so that
2720 * mod_read() will see the pending client, pop the
2721 * pending packet, and process it.
2722 *
2723 */
2724 if (!thread->pending_clients) {
2726 fr_io_client_t, pending_id, 0));
2727 }
2728
2730 (void) fr_heap_insert(&thread->pending_clients, client);
2731
2732finish:
2733 /*
2734 * Maybe we defined the client, but the original packet
2735 * timed out, so there's nothing more to do. In that case, set up the expiry timers.
2736 */
2737 if (client->packets == 0) {
2738 client_expiry_timer(el->tl, fr_time_wrap(0), client);
2739 }
2740
2741reread:
2742 /*
2743 * If there are pending packets (and there should be at
2744 * least one), tell the network socket to call our read()
2745 * function again.
2746 */
2747 if (fr_heap_num_elements(client->pending) > 0) {
2748 if (connection) {
2749 fr_network_listen_read(connection->nr, connection->listen);
2750 } else {
2751 fr_network_listen_read(thread->nr, thread->listen);
2752 }
2753 }
2754
2755 return buffer_len;
2756}
2757
2758/** Close the socket.
2759 *
2760 */
2761static int mod_close(fr_listen_t *li)
2762{
2763 fr_io_instance_t const *inst;
2764 fr_io_connection_t *connection;
2765 fr_listen_t *child;
2766
2767 get_inst(li, &inst, NULL, &connection, &child);
2768
2769 if (inst->app_io->close) {
2770 int ret;
2771
2772 ret = inst->app_io->close(child);
2773 if (ret < 0) return ret;
2774 } else {
2775 close(child->fd);
2776// child->fd = -1;
2777 }
2778
2779 if (!connection) return 0;
2780
2781 /*
2782 * We allocated this, so we're responsible for closing
2783 * it.
2784 */
2785 DEBUG("Closing connection %s", connection->name);
2786 if (connection->client->pending) {
2787 TALLOC_FREE(connection->client->pending); /* for any pending packets */
2788 }
2789
2790 /*
2791 * Remove connection from parent hash table
2792 */
2793 pthread_mutex_lock(&connection->parent->mutex);
2794 if (connection->in_parent_hash) {
2795 connection->in_parent_hash = false;
2796 (void) fr_hash_table_delete(connection->parent->ht, connection);
2797 }
2798 pthread_mutex_unlock(&connection->parent->mutex);
2799
2800 /*
2801 * Clean up listener
2802 */
2803 if (unlikely(fr_network_listen_delete(connection->nr, child) < 0)) {
2804 PERROR("Failed to delete connection %s", connection->name);
2805 }
2806
2807 talloc_free(connection->mi);
2808
2809 return 0;
2810}
2811
2812static int mod_instantiate(module_inst_ctx_t const *mctx)
2813{
2814 fr_io_instance_t *inst = mctx->mi->data;
2815 CONF_SECTION *conf = mctx->mi->conf;
2816
2817 inst->mi = mctx->mi;
2818 inst->app_io = (fr_app_io_t const *) inst->submodule->exported;
2819 inst->app_io_conf = inst->submodule->conf;
2820 inst->app_io_instance = inst->submodule->data;
2821
2822 /*
2823 * If we're not tracking duplicates then we don't need a
2824 * cleanup delay.
2825 *
2826 * If we are tracking duplicates, then we must have a non-zero cleanup delay.
2827 */
2828 if (!inst->app_io->track_duplicates) {
2829 inst->cleanup_delay = fr_time_delta_wrap(0);
2830
2831 } else {
2832 FR_TIME_DELTA_BOUND_CHECK("cleanup_delay", inst->cleanup_delay, >=, fr_time_delta_from_sec(1));
2833
2834 if (!inst->app_io->track_create) {
2835 cf_log_err(inst->app_io_conf, "Internal error: 'track_duplicates' is set, but there is no 'track create' function");
2836 return -1;
2837 }
2838 }
2839
2840 /*
2841 * Get various information after bootstrapping the
2842 * application IO module.
2843 */
2844 if (inst->app_io->network_get) {
2845 inst->app_io->network_get(&inst->ipproto, &inst->dynamic_clients, &inst->networks, inst->app_io_instance);
2846 }
2847
2848 if ((inst->ipproto == IPPROTO_TCP) && !inst->app_io->connection_set) {
2849 cf_log_err(inst->app_io_conf, "Missing 'connection set' API for proto_%s", inst->app_io->common.name);
2850 return -1;
2851 }
2852
2853 /*
2854 * Ensure that the dynamic client sections exist
2855 */
2856 if (inst->dynamic_clients) {
2858
2859 if (!cf_section_find(server, "new", "client")) {
2860 cf_log_err(conf, "Cannot use 'dynamic_clients = yes' as the virtual server has no 'new client { ... }' section defined.");
2861 return -1;
2862 }
2863
2864 if (!cf_section_find(server, "add", "client")) {
2865 cf_log_warn(conf, "No 'add client { ... }' section was defined.");
2866 }
2867
2868 if (!cf_section_find(server, "deny", "client")) {
2869 cf_log_warn(conf, "No 'deny client { ... }' section was defined.");
2870 }
2871 }
2872
2873 /*
2874 * Create a list of client modules.
2875 *
2876 * FIXME - Probably only want to do this for connected sockets?
2877 *
2878 * FIXME - We probably want write protect enabled?
2879 */
2880 inst->clients = module_list_alloc(inst, &module_list_type_thread_local, "clients", false);
2882
2883 return 0;
2884}
2885
2886
2887static char const *mod_name(fr_listen_t *li)
2888{
2889 fr_io_thread_t *thread;
2890 fr_io_connection_t *connection;
2891 fr_listen_t *child;
2892 fr_io_instance_t const *inst;
2893
2894 get_inst(li, &inst, &thread, &connection, &child);
2895
2896 fr_assert(child != NULL);
2897 return child->app_io->get_name(child);
2898}
2899
2900/** Create a trie from arrays of allow / deny IP addresses
2901 *
2902 * @param ctx the talloc ctx
2903 * @param af the address family to allow
2904 * @param allow the array of IPs / networks to allow. MUST be talloc'd
2905 * @param deny the array of IPs / networks to deny. MAY be NULL, MUST be talloc'd
2906 * @return
2907 * - fr_trie_t on success
2908 * - NULL on error
2909 */
2910fr_trie_t *fr_master_io_network(TALLOC_CTX *ctx, int af, fr_ipaddr_t *allow, fr_ipaddr_t *deny)
2911{
2912 fr_trie_t *trie;
2913 size_t i, num;
2914
2915 MEM(trie = fr_trie_alloc(ctx, NULL, NULL));
2916
2917 num = talloc_array_length(allow);
2918 fr_assert(num > 0);
2919
2920 for (i = 0; i < num; i++) {
2921 fr_ipaddr_t *network;
2922
2923 /*
2924 * Can't add v4 networks to a v6 socket, or vice versa.
2925 */
2926 if (allow[i].af != af) {
2927 fr_strerror_printf("Address family in entry %zd - 'allow = %pV' "
2928 "does not match 'ipaddr'", i + 1, fr_box_ipaddr(allow[i]));
2929 talloc_free(trie);
2930 return NULL;
2931 }
2932
2933 /*
2934 * Duplicates are bad.
2935 */
2936 network = fr_trie_match_by_key(trie,
2937 &allow[i].addr, allow[i].prefix);
2938 if (network) {
2939 fr_strerror_printf("Cannot add duplicate entry 'allow = %pV'",
2940 fr_box_ipaddr(allow[i]));
2941 talloc_free(trie);
2942 return NULL;
2943 }
2944
2945 /*
2946 * Look for overlapping entries.
2947 * i.e. the networks MUST be disjoint.
2948 *
2949 * Note that this catches 192.168.1/24
2950 * followed by 192.168/16, but NOT the
2951 * other way around. The best fix is
2952 * likely to add a flag to
2953 * fr_trie_alloc() saying "we can only
2954 * have terminal fr_trie_user_t nodes"
2955 */
2956 network = fr_trie_lookup_by_key(trie,
2957 &allow[i].addr, allow[i].prefix);
2958 if (network && (network->prefix <= allow[i].prefix)) {
2959 fr_strerror_printf("Cannot add overlapping entry 'allow = %pV'", fr_box_ipaddr(allow[i]));
2960 fr_strerror_const("Entry is completely enclosed inside of a previously defined network.");
2961 talloc_free(trie);
2962 return NULL;
2963 }
2964
2965 /*
2966 * Insert the network into the trie.
2967 * Lookups will return the fr_ipaddr_t of
2968 * the network.
2969 */
2970 if (fr_trie_insert_by_key(trie,
2971 &allow[i].addr, allow[i].prefix,
2972 &allow[i]) < 0) {
2973 fr_strerror_printf("Failed adding 'allow = %pV' to tracking table", fr_box_ipaddr(allow[i]));
2974 talloc_free(trie);
2975 return NULL;
2976 }
2977 }
2978
2979 /*
2980 * And now check denied networks.
2981 */
2982 num = talloc_array_length(deny);
2983 if (!num) return trie;
2984
2985 /*
2986 * Since the default is to deny, you can only add
2987 * a "deny" inside of a previous "allow".
2988 */
2989 for (i = 0; i < num; i++) {
2990 fr_ipaddr_t *network;
2991
2992 /*
2993 * Can't add v4 networks to a v6 socket, or vice versa.
2994 */
2995 if (deny[i].af != af) {
2996 fr_strerror_printf("Address family in entry %zd - 'deny = %pV' "
2997 "does not match 'ipaddr'", i + 1, fr_box_ipaddr(deny[i]));
2998 talloc_free(trie);
2999 return NULL;
3000 }
3001
3002 /*
3003 * Duplicates are bad.
3004 */
3005 network = fr_trie_match_by_key(trie,
3006 &deny[i].addr, deny[i].prefix);
3007 if (network) {
3008 fr_strerror_printf("Cannot add duplicate entry 'deny = %pV'", fr_box_ipaddr(deny[i]));
3009 talloc_free(trie);
3010 return NULL;
3011 }
3012
3013 /*
3014 * A "deny" can only be within a previous "allow".
3015 */
3016 network = fr_trie_lookup_by_key(trie,
3017 &deny[i].addr, deny[i].prefix);
3018 if (!network) {
3019 fr_strerror_printf("The network in entry %zd - 'deny = %pV' is not "
3020 "contained within a previous 'allow'", i + 1, fr_box_ipaddr(deny[i]));
3021 talloc_free(trie);
3022 return NULL;
3023 }
3024
3025 /*
3026 * We hack the AF in "deny" rules. If
3027 * the lookup gets AF_UNSPEC, then we're
3028 * adding a "deny" inside of a "deny".
3029 */
3030 if (network->af != af) {
3031 fr_strerror_printf("The network in entry %zd - 'deny = %pV' is overlaps "
3032 "with another 'deny' rule", i + 1, fr_box_ipaddr(deny[i]));
3033 talloc_free(trie);
3034 return NULL;
3035 }
3036
3037 /*
3038 * Insert the network into the trie.
3039 * Lookups will return the fr_ipaddr_t of
3040 * the network.
3041 */
3042 if (fr_trie_insert_by_key(trie,
3043 &deny[i].addr, deny[i].prefix,
3044 &deny[i]) < 0) {
3045 fr_strerror_printf("Failed adding 'deny = %pV' to tracking table", fr_box_ipaddr(deny[i]));
3046 talloc_free(trie);
3047 return NULL;
3048 }
3049
3050 /*
3051 * Hack it to make it a deny rule.
3052 */
3053 deny[i].af = AF_UNSPEC;
3054 }
3055
3056 return trie;
3057}
3058
3059
3061{
3062 if (!li->thread_instance) return 0;
3063
3065 return 0;
3066}
3067
3069 size_t default_message_size, size_t num_messages)
3070{
3071 fr_listen_t *li, *child;
3072 fr_io_thread_t *thread;
3073
3074 /*
3075 * No IO paths, so we don't initialize them.
3076 */
3077 if (!inst->app_io) {
3078 fr_assert(!inst->dynamic_clients);
3079 return 0;
3080 }
3081
3082 if (!inst->app_io->common.thread_inst_size) {
3083 fr_strerror_const("IO modules MUST set 'thread_inst_size' when using the master IO handler.");
3084 return -1;
3085 }
3086
3087 /*
3088 * Build the #fr_listen_t. This describes the complete
3089 * path data takes from the socket to the decoder and
3090 * back again.
3091 */
3092 MEM(li = talloc_zero(NULL, fr_listen_t));
3093 talloc_set_destructor(li, fr_io_listen_free);
3094
3095 /*
3096 * The first listener is the one for the application
3097 * (e.g. RADIUS). However, we mangle the IO path to
3098 * point to the master IO handler. That allows all of
3099 * the high-level work (dynamic client checking,
3100 * connected sockets, etc.) to be handled by the master
3101 * IO handler.
3102 *
3103 * This listener is then passed to the network code,
3104 * which calls our trampoline functions to do the actual
3105 * work.
3106 */
3107 li->app = inst->app;
3108 li->app_instance = inst->app_instance;
3109 li->server_cs = inst->server_cs;
3110
3111 /*
3112 * Set configurable parameters for message ring buffer.
3113 */
3114 li->default_message_size = default_message_size;
3115 li->num_messages = num_messages;
3116
3117 /*
3118 * Per-socket data lives here.
3119 */
3120 thread = talloc_zero(NULL, fr_io_thread_t);
3121 thread->listen = li;
3122 thread->sc = sc;
3123
3124 /*
3125 * Create the trie of clients for this socket.
3126 */
3127 MEM(thread->trie = fr_trie_alloc(thread, NULL, NULL));
3128
3129 if (inst->dynamic_clients) {
3131 fr_io_client_t, alive_id, 0));
3132 }
3133
3134 /*
3135 * Set the listener to call our master trampoline function.
3136 */
3137 li->app_io = &fr_master_app_io;
3138 li->thread_instance = thread;
3139 li->app_io_instance = inst;
3140 li->track_duplicates = inst->app_io->track_duplicates;
3141
3142 /*
3143 * The child listener points to the *actual* IO path.
3144 *
3145 * We need to create a complete listener here (e.g.
3146 * RADIUS + RADIUS_UDP), because the underlying IO
3147 * functions expect to get passed a full listener.
3148 *
3149 * Once the network side calls us, we will call the child
3150 * listener to do the actual IO.
3151 */
3152 child = thread->child = talloc_zero(li, fr_listen_t);
3153 memcpy(child, li, sizeof(*child));
3154
3155 /*
3156 * Reset these fields to point to the IO instance data.
3157 */
3158 child->app_io = inst->app_io;
3159 child->track_duplicates = inst->app_io->track_duplicates;
3160
3161 if (child->app_io->common.thread_inst_size > 0) {
3162 child->thread_instance = talloc_zero_array(NULL, uint8_t,
3163 inst->app_io->common.thread_inst_size);
3164 talloc_set_destructor(child, fr_io_listen_free);
3165
3166 talloc_set_name(child->thread_instance, "proto_%s_thread_t",
3167 inst->app_io->common.name);
3168
3169 /*
3170 * This is "const", and the user can't
3171 * touch it. So we just reuse the same
3172 * configuration everywhere.
3173 */
3174 child->app_io_instance = inst->app_io_instance;
3175
3176 } else {
3177 child->thread_instance = inst->app_io_instance;
3178 child->app_io_instance = child->thread_instance;
3179 }
3180
3181 /*
3182 * Don't call connection_set() for the main socket. It's
3183 * not connected. Instead, tell the IO path to open the
3184 * socket for us.
3185 */
3186 if (inst->app_io->open(child) < 0) {
3187 cf_log_err(inst->app_io_conf, "Failed opening %s interface", inst->app_io->common.name);
3188 talloc_free(li);
3189 return -1;
3190 }
3191
3192 li->fd = child->fd; /* copy this back up */
3193
3194 if (!child->app_io->get_name) {
3195 child->name = child->app_io->common.name;
3196 } else {
3197 child->name = child->app_io->get_name(child);
3198 }
3199 li->name = child->name;
3200
3201 /*
3202 * Record which socket we opened.
3203 */
3204 if (child->app_io_addr) {
3205 fr_listen_t *other;
3206
3207 other = listen_find_any(thread->child);
3208 if (other) {
3209 ERROR("Failed opening %s - that port is already in use by another listener in server %s { ... } - %s",
3210 child->name, cf_section_name2(other->server_cs), other->name);
3211
3212 ERROR("got socket %d %d\n", child->app_io_addr->inet.src_port, other->app_io_addr->inet.src_port);
3213
3214 talloc_free(li);
3215 return -1;
3216 }
3217
3218 (void) listen_record(child);
3219 }
3220
3221 /*
3222 * Add the socket to the scheduler, where it might end up
3223 * in a different thread.
3224 */
3225 if (!fr_schedule_listen_add(sc, li)) {
3226 talloc_free(li);
3227 return -1;
3228 }
3229
3230 return 0;
3231}
3232
3233/*
3234 * Used to create a tracking structure for fr_network_sendto_worker()
3235 */
3236fr_io_track_t *fr_master_io_track_alloc(fr_listen_t *li, fr_client_t *radclient, fr_ipaddr_t const *src_ipaddr, int src_port,
3237 fr_ipaddr_t const *dst_ipaddr, int dst_port)
3238{
3239 fr_io_instance_t const *inst;
3240 fr_io_thread_t *thread;
3241 fr_io_connection_t *connection;
3242 fr_listen_t *child;
3243 fr_io_track_t *track;
3244 fr_io_client_t *client;
3245 fr_io_address_t *address;
3246 fr_listen_t *parent = talloc_parent(li);
3247
3248 (void) talloc_get_type_abort(parent, fr_listen_t);
3249
3250 get_inst(parent, &inst, &thread, &connection, &child);
3251
3252 fr_assert(child == li);
3253
3254 if (unlikely(!thread)) return NULL;
3255 fr_assert(thread->trie != NULL);
3256
3257 client = fr_trie_lookup_by_key(thread->trie, &src_ipaddr->addr, src_ipaddr->prefix);
3258 if (!client) {
3259 MEM(client = client_alloc(thread, PR_CLIENT_STATIC, inst, thread, radclient, NULL));
3260 }
3261
3262 MEM(track = talloc_zero_pooled_object(client, fr_io_track_t, 1, sizeof(*track) + sizeof(track->address) + 64));
3263 MEM(track->address = address = talloc_zero(track, fr_io_address_t));
3264 track->client = client;
3265
3266 address->socket.inet.src_port = src_port;
3267 address->socket.inet.dst_port = dst_port;
3268
3269 address->socket.inet.src_ipaddr = *src_ipaddr;
3270 address->socket.inet.dst_ipaddr = *dst_ipaddr;
3271 address->radclient = radclient;
3272
3273 return track;
3274}
3275
3276
3278 .common = {
3279 .magic = MODULE_MAGIC_INIT,
3280 .name = "radius_master_io",
3281
3283 },
3284 .default_message_size = 4096,
3285 .track_duplicates = true,
3286
3287 .read = mod_read,
3288 .write = mod_write,
3289 .inject = mod_inject,
3290
3291 .open = mod_open,
3292 .close = mod_close,
3293 .event_list_set = mod_event_list_set,
3294 .get_name = mod_name,
3295};
static int const char char buffer[256]
Definition acutest.h:576
log_entry msg
Definition acutest.h:794
module_t common
Common fields to all loadable modules.
Definition app_io.h:34
fr_io_track_create_t track_create
create a tracking structure
Definition app_io.h:64
bool track_duplicates
track duplicate packets
Definition app_io.h:41
fr_io_name_t get_name
get the socket name
Definition app_io.h:70
fr_io_track_cmp_t track_compare
compare two tracking structures
Definition app_io.h:65
Public structure describing an I/O path for a protocol.
Definition app_io.h:33
#define FALL_THROUGH
clang 10 doesn't recognised the FALL-THROUGH comment anymore
Definition build.h:324
#define CMP_PREFER_SMALLER(_a, _b)
Evaluates to +1 for a > b, and -1 for a < b.
Definition build.h:104
#define CMP_PREFER_LARGER(_a, _b)
Evaluates to -1 for a > b, and +1 for a < b.
Definition build.h:108
#define CMP_RETURN(_a, _b, _field)
Return if the comparison is not 0 (is unequal)
Definition build.h:121
#define CMP(_a, _b)
Same as CMP_PREFER_SMALLER use when you don't really care about ordering, you just want an ordering.
Definition build.h:112
#define unlikely(_x)
Definition build.h:383
#define UNUSED
Definition build.h:317
#define FR_TIME_DELTA_BOUND_CHECK(_name, _var, _op, _bound)
Definition cf_parse.h:529
A section grouping multiple CONF_PAIR.
Definition cf_priv.h:101
char const * cf_section_name2(CONF_SECTION const *cs)
Return the second identifier of a CONF_SECTION.
Definition cf_util.c:1184
char const * cf_section_name1(CONF_SECTION const *cs)
Return the second identifier of a CONF_SECTION.
Definition cf_util.c:1170
CONF_SECTION * cf_section_find(CONF_SECTION const *cs, char const *name1, char const *name2)
Find a CONF_SECTION with name1 and optionally name2.
Definition cf_util.c:1027
CONF_SECTION * cf_item_to_section(CONF_ITEM const *ci)
Cast a CONF_ITEM to a CONF_SECTION.
Definition cf_util.c:683
CONF_SECTION * cf_section_dup(TALLOC_CTX *ctx, CONF_SECTION *parent, CONF_SECTION const *cs, char const *name1, char const *name2, bool copy_meta)
Duplicate a configuration section.
Definition cf_util.c:927
#define cf_log_err(_cf, _fmt,...)
Definition cf_util.h:289
#define cf_parent(_cf)
Definition cf_util.h:101
#define cf_log_warn(_cf, _fmt,...)
Definition cf_util.h:290
#define PRIORITY_NORMAL
Definition channel.h:151
#define MEM(x)
Definition debug.h:36
#define ERROR(fmt,...)
Definition dhcpclient.c:41
#define DEBUG(fmt,...)
Definition dhcpclient.c:39
Test enumeration values.
Definition dict_test.h:92
#define MODULE_MAGIC_INIT
Stop people using different module/library/server versions together.
Definition dl_module.h:63
@ FR_EVENT_FILTER_IO
Combined filter for read/write functions/.
Definition event.h:84
#define fr_event_filter_update(...)
Definition event.h:240
#define FR_EVENT_RESUME(_s, _f)
Re-add the filter for a func from kevent.
Definition event.h:132
#define FR_EVENT_SUSPEND(_s, _f)
Temporarily remove the filter for a func from kevent.
Definition event.h:116
Callbacks for the FR_EVENT_FILTER_IO filter.
Definition event.h:189
Structure describing a modification to a filter's state.
Definition event.h:97
void * fr_hash_table_find(fr_hash_table_t *ht, void const *data)
Find data in a hash table.
Definition hash.c:429
uint32_t fr_hash_update(void const *data, size_t size, uint32_t hash)
Definition hash.c:846
uint32_t fr_hash(void const *data, size_t size)
Definition hash.c:812
bool fr_hash_table_insert(fr_hash_table_t *ht, void const *data)
Insert data into a hash table.
Definition hash.c:468
bool fr_hash_table_delete(fr_hash_table_t *ht, void const *data)
Remove and free data (if a free function was specified)
Definition hash.c:594
uint32_t fr_hash_table_num_elements(fr_hash_table_t *ht)
Definition hash.c:610
#define fr_hash_table_alloc(_ctx, _hash_node, _cmp_node, _free_node)
Definition hash.h:58
int fr_heap_insert(fr_heap_t **hp, void *data)
Insert a new element into the heap.
Definition heap.c:146
void * fr_heap_pop(fr_heap_t **hp)
Remove a node from the heap.
Definition heap.c:322
int fr_heap_extract(fr_heap_t **hp, void *data)
Remove a node from the heap.
Definition heap.c:239
unsigned int fr_heap_index_t
Definition heap.h:80
static void * fr_heap_peek(fr_heap_t *h)
Return the item from the top of the heap but don't pop it.
Definition heap.h:136
#define fr_heap_alloc(_ctx, _cmp, _type, _field, _init)
Creates a heap that can be used with non-talloced elements.
Definition heap.h:100
static bool fr_heap_entry_inserted(fr_heap_index_t heap_idx)
Check if an entry is inserted into a heap.
Definition heap.h:124
static unsigned int fr_heap_num_elements(fr_heap_t *h)
Return the number of elements in the heap.
Definition heap.h:179
#define FR_HEAP_INDEX_INVALID
Definition heap.h:83
The main heap structure.
Definition heap.h:66
int fr_ipaddr_from_sockaddr(fr_ipaddr_t *ipaddr, uint16_t *port, struct sockaddr_storage const *sa, socklen_t salen)
Convert sockaddr to our internal ip address representation.
Definition inet.c:1441
int fr_ipaddr_to_sockaddr(struct sockaddr_storage *sa, socklen_t *salen, fr_ipaddr_t const *ipaddr, uint16_t port)
Convert our internal ip address representation to a sockaddr.
Definition inet.c:1392
int8_t fr_ipaddr_cmp(fr_ipaddr_t const *a, fr_ipaddr_t const *b)
Compare two ip addresses.
Definition inet.c:1346
void fr_ipaddr_mask(fr_ipaddr_t *addr, uint8_t prefix)
Zeroes out the host portion of an fr_ipaddr_t.
Definition inet.c:217
uint8_t prefix
Prefix length - Between 0-32 for IPv4 and 0-128 for IPv6.
Definition inet.h:69
union fr_ipaddr_t::@133 addr
int af
Address family.
Definition inet.h:64
IPv4/6 prefix.
fr_socket_t socket
src/dst ip and port.
Definition base.h:336
fr_client_t const * radclient
old-style client definition
Definition base.h:338
size_t num_messages
for the message ring buffer
Definition listen.h:53
char const * name
printable name for this socket - set by open
Definition listen.h:29
bool track_duplicates
do we track duplicate packets?
Definition listen.h:44
fr_socket_t * app_io_addr
for tracking duplicate sockets
Definition listen.h:36
void const * app_instance
Definition listen.h:39
size_t default_message_size
copied from app_io, but may be changed
Definition listen.h:52
bool connected
is this for a connected socket?
Definition listen.h:43
fr_app_t const * app
Definition listen.h:38
void const * app_io_instance
I/O path configuration context.
Definition listen.h:33
CONF_SECTION * server_cs
CONF_SECTION of the server.
Definition listen.h:41
void * thread_instance
thread / socket context
Definition listen.h:34
int fd
file descriptor for this socket - set by open
Definition listen.h:28
fr_app_io_t const * app_io
I/O path functions.
Definition listen.h:32
int fr_network_listen_delete(fr_network_t *nr, fr_listen_t *li)
Delete a socket from a network.
Definition network.c:271
int fr_network_listen_inject(fr_network_t *nr, fr_listen_t *li, uint8_t const *packet, size_t packet_len, fr_time_t recv_time)
Inject a packet for a listener to read.
Definition network.c:410
void fr_network_listen_read(fr_network_t *nr, fr_listen_t *li)
Signal the network to read from a listener.
Definition network.c:336
void fr_network_listen_write(fr_network_t *nr, fr_listen_t *li, uint8_t const *packet, size_t packet_len, void *packet_ctx, fr_time_t request_time)
Inject a packet for a listener to write.
Definition network.c:362
char const * server
Name of the virtual server client is associated with.
Definition client.h:129
fr_ipaddr_t ipaddr
IPv4/IPv6 address of the host.
Definition client.h:83
char const * secret
Secret PSK.
Definition client.h:90
bool active
for dynamic clients
Definition client.h:119
fr_ipaddr_t src_ipaddr
IPv4/IPv6 address to send responses from (family must match ipaddr).
Definition client.h:84
char const * nas_type
Type of client (arbitrary).
Definition client.h:127
int proto
Protocol number.
Definition client.h:143
CONF_SECTION * cs
CONF_SECTION that was parsed to generate the client.
Definition client.h:134
bool dynamic
Whether the client was dynamically defined.
Definition client.h:118
char const * longname
Client identifier.
Definition client.h:87
fr_socket_limit_t limit
Connections per client (TCP clients only).
Definition client.h:144
char const * shortname
Client nickname.
Definition client.h:88
bool use_connected
do we use connected sockets for this client
Definition client.h:120
CONF_SECTION * server_cs
Virtual server that the client is associated with.
Definition client.h:130
Describes a host allowed to send packets to the server.
Definition client.h:80
#define PERROR(_fmt,...)
Definition log.h:228
#define DEBUG3(_fmt,...)
Definition log.h:266
#define RATE_LIMIT_LOCAL(_entry, _log, _fmt,...)
Rate limit messages using a local limiting entry.
Definition log.h:569
Track when a log message was last repeated.
Definition log.h:547
talloc_free(reap)
Stores all information relating to an event list.
Definition event.c:377
fr_listen_t * child
The child (app_io) IO path.
Definition master.c:45
fr_network_t * nr
network for this connection
Definition master.c:167
static int8_t alive_client_cmp(void const *one, void const *two)
Definition master.c:1301
bool in_trie
is the client in the trie?
Definition master.c:126
static fr_io_pending_packet_t * fr_io_pending_alloc(fr_io_connection_t *connection, fr_io_client_t *client, uint8_t const *buffer, size_t packet_len, fr_io_track_t *track, int priority)
Definition master.c:1256
bool paused
event filter doesn't like resuming something that isn't paused
Definition master.c:164
bool in_parent_hash
for tracking thread issues
Definition master.c:165
static fr_client_t * radclient_clone(TALLOC_CTX *ctx, fr_client_t const *parent)
Definition master.c:388
static ssize_t mod_read(fr_listen_t *li, void **packet_ctx, fr_time_t *recv_time_p, uint8_t *buffer, size_t buffer_len, size_t *leftover)
Implement 99% of the read routines.
Definition master.c:1313
int packets
number of packets using this connection
Definition master.c:155
uint32_t num_pending_packets
number of pending packets
Definition master.c:50
#define DUP_FIELD(_x)
static int track_dedup_free(fr_io_track_t *track)
Definition master.c:191
fr_rb_tree_t * table
tracking table for packets
Definition master.c:131
fr_time_t recv_time
Definition master.c:73
static int8_t pending_packet_cmp(void const *one, void const *two)
Definition master.c:207
fr_heap_t * pending_clients
heap of pending clients
Definition master.c:41
static fr_io_track_t * fr_io_track_add(fr_io_client_t *client, fr_io_address_t *address, uint8_t const *packet, size_t packet_len, fr_time_t recv_time, bool *is_dup)
Definition master.c:1086
bool ready_to_delete
are we ready to delete this client?
Definition master.c:125
static int _client_live_free(fr_io_client_t *client)
Definition master.c:958
fr_heap_index_t pending_id
for pending clients
Definition master.c:121
static int pending_free(fr_io_pending_packet_t *pending)
Definition master.c:1232
bool use_connected
does this client allow connected sub-sockets?
Definition master.c:124
fr_io_client_t * client
our local client (pending or connected).
Definition master.c:159
static int track_free(fr_io_track_t *track)
Definition master.c:180
fr_app_io_t fr_master_app_io
Definition master.c:3277
static void packet_expiry_timer(fr_timer_list_t *tl, fr_time_t now, void *uctx)
Definition master.c:2257
fr_listen_t * listen
The master IO path.
Definition master.c:44
static int8_t pending_client_cmp(void const *one, void const *two)
Definition master.c:237
fr_io_track_t * fr_master_io_track_alloc(fr_listen_t *li, fr_client_t *radclient, fr_ipaddr_t const *src_ipaddr, int src_port, fr_ipaddr_t const *dst_ipaddr, int dst_port)
Definition master.c:3236
fr_io_address_t * address
full information about the connection.
Definition master.c:156
static int8_t address_cmp(void const *one, void const *two)
Definition master.c:255
fr_listen_t * child
child listener (app_io) for this socket
Definition master.c:158
fr_listen_t * listen
master listener for this socket
Definition master.c:157
fr_timer_t * ev
when we clean up the client
Definition master.c:130
fr_network_t * nr
network for the master socket
Definition master.c:38
fr_trie_t * fr_master_io_network(TALLOC_CTX *ctx, int af, fr_ipaddr_t *allow, fr_ipaddr_t *deny)
Create a trie from arrays of allow / deny IP addresses.
Definition master.c:2910
static fr_io_pending_packet_t * pending_packet_pop(fr_io_thread_t *thread)
Definition master.c:350
fr_ipaddr_t network
network for dynamic clients
Definition master.c:117
static void mod_event_list_set(fr_listen_t *li, fr_event_list_t *el, void *nr)
Set the event list for a new socket.
Definition master.c:2011
static int mod_open(fr_listen_t *li)
Open a new listener.
Definition master.c:1975
pthread_mutex_t mutex
for parent / child signaling
Definition master.c:136
fr_heap_index_t heap_id
Definition master.c:71
static fr_io_client_t * client_alloc(TALLOC_CTX *ctx, fr_io_client_state_t state, fr_io_instance_t const *inst, fr_io_thread_t *thread, fr_client_t *radclient, fr_ipaddr_t const *network)
Allocate a dynamic client.
Definition master.c:981
fr_io_instance_t const * inst
parent instance for master IO handler
Definition master.c:128
#define LOG_IGNORED_CLIENTS(_inst)
#define COPY_FIELD(_x)
fr_trie_t * trie
trie of clients
Definition master.c:40
static void client_expiry_timer(fr_timer_list_t *tl, fr_time_t now, void *uctx)
Definition master.c:2044
fr_io_client_state_t
Client states.
Definition master.c:83
@ PR_CLIENT_DYNAMIC
dynamically defined client
Definition master.c:87
@ PR_CLIENT_CONNECTED
dynamically defined client in a connected socket
Definition master.c:88
@ PR_CLIENT_PENDING
dynamic client pending definition
Definition master.c:89
@ PR_CLIENT_INVALID
Definition master.c:84
@ PR_CLIENT_NAK
negative cache entry
Definition master.c:86
@ PR_CLIENT_STATIC
static / global clients
Definition master.c:85
static void get_inst(fr_listen_t *li, fr_io_instance_t const **inst, fr_io_thread_t **thread, fr_io_connection_t **connection, fr_listen_t **child)
Definition master.c:910
static fr_event_update_t pause_read[]
Definition master.c:170
static int8_t track_connected_cmp(void const *one, void const *two)
Definition master.c:324
fr_heap_t * alive_clients
heap of active dynamic clients
Definition master.c:42
fr_schedule_t * sc
the scheduler
Definition master.c:46
static fr_io_connection_t * fr_io_connection_alloc(fr_io_instance_t const *inst, fr_io_thread_t *thread, fr_io_client_t *client, int fd, fr_io_address_t *address, fr_io_connection_t *nak)
Create a new connection.
Definition master.c:514
fr_hash_table_t * addresses
list of src/dst addresses used by this client
Definition master.c:134
int fr_master_io_listen(fr_io_instance_t *inst, fr_schedule_t *sc, size_t default_message_size, size_t num_messages)
Definition master.c:3068
static int connection_free(fr_io_connection_t *connection)
Definition master.c:499
struct fr_io_thread_t::@38 rate_limit
int fr_io_listen_free(fr_listen_t *li)
Definition master.c:3060
char const * name
taken from proto_FOO_TRANSPORT
Definition master.c:154
fr_heap_index_t alive_id
for all clients
Definition master.c:122
fr_event_list_t * el
event list for this connection
Definition master.c:166
fr_io_client_state_t state
state of this client
Definition master.c:115
int packets
number of packets using this client
Definition master.c:120
static ssize_t mod_write(fr_listen_t *li, void *packet_ctx, fr_time_t request_time, uint8_t *buffer, size_t buffer_len, size_t written)
Definition master.c:2323
bool dead
roundabout way to get the network side to close a socket
Definition master.c:163
fr_event_list_t * el
event list, for the master socket.
Definition master.c:37
uint64_t client_id
Unique client identifier.
Definition master.c:51
fr_io_thread_t * thread
Definition master.c:129
static char const * mod_name(fr_listen_t *li)
Definition master.c:2887
module_instance_t * mi
for submodule
Definition master.c:161
static int _client_free(fr_io_client_t *client)
Definition master.c:475
static int mod_close(fr_listen_t *li)
Close the socket.
Definition master.c:2761
static uint32_t connection_hash(void const *ctx)
Definition master.c:271
fr_io_connection_t * connection
parent connection
Definition master.c:114
fr_heap_t * pending
pending packets for this client
Definition master.c:133
static int count_connections(UNUSED uint8_t const *key, UNUSED size_t keylen, void *data, void *ctx)
Count the number of connections used by active clients.
Definition master.c:453
static int8_t connection_cmp(void const *one, void const *two)
Definition master.c:285
static int8_t track_cmp(void const *one, void const *two)
Definition master.c:294
fr_hash_table_t * ht
for tracking connected sockets
Definition master.c:137
static int mod_instantiate(module_inst_ctx_t const *mctx)
Definition master.c:2812
fr_io_track_t * track
Definition master.c:74
fr_client_t * radclient
old-style definition of this client
Definition master.c:118
fr_ipaddr_t src_ipaddr
packets come from this address
Definition master.c:116
static fr_event_update_t resume_read[]
Definition master.c:175
static void client_pending_free(fr_io_client_t *client)
Definition master.c:482
uint32_t num_connections
number of dynamic connections
Definition master.c:49
fr_io_client_t * parent
points to the parent client.
Definition master.c:160
static fr_client_t * radclient_alloc(TALLOC_CTX *ctx, int ipproto, fr_io_address_t *address)
Definition master.c:930
static int mod_inject(fr_listen_t *li, uint8_t const *buffer, size_t buffer_len, fr_time_t recv_time)
Inject a packet to a connection.
Definition master.c:1921
Client definitions for master IO.
Definition master.c:113
Track a connection.
Definition master.c:153
A saved packet.
Definition master.c:70
fr_timer_t * ev
when we clean up this tracking entry
Definition master.h:42
uint8_t * reply
reply packet (if any)
Definition master.h:46
int packets
number of packets using this entry
Definition master.h:45
fr_time_t dynamic
timestamp for packet doing dynamic client definition
Definition master.h:53
void * app_io_instance
Easy access to the app_io instance.
Definition master.h:104
fr_app_io_t const * app_io
Easy access to the app_io handle.
Definition master.h:103
fr_io_address_t const * address
of this packet.. shared between multiple packets
Definition master.h:54
bool do_not_respond
don't respond
Definition master.h:50
bool discard
whether or not we discard the packet
Definition master.h:49
fr_time_t timestamp
when this packet was received
Definition master.h:43
bool finished
are we finished the request?
Definition master.h:51
uint8_t * packet
really a tracking structure, not a packet
Definition master.h:56
size_t reply_len
length of reply, or 1 for "do not reply"
Definition master.h:47
fr_io_client_t * client
client handling this packet.
Definition master.h:55
fr_time_t expires
when this packet expires
Definition master.h:44
The master IO instance.
Definition master.h:72
unsigned int uint32_t
long int ssize_t
unsigned char uint8_t
int fr_nonblock(UNUSED int fd)
Definition misc.c:293
module_instance_t * mi
Instance of the module being instantiated.
Definition module_ctx.h:51
Temporary structure to hold arguments for instantiation calls.
Definition module_ctx.h:50
char * fr_asprintf(TALLOC_CTX *ctx, char const *fmt,...)
Special version of asprintf which implements custom format specifiers.
Definition print.c:874
#define fr_assert(_expr)
Definition rad_assert.h:38
static int ipproto
static char * secret
#define DEBUG2(fmt,...)
Definition radclient.h:43
#define INFO(fmt,...)
Definition radict.c:54
static bool cleanup
Definition radsniff.c:60
static rs_t * conf
Definition radsniff.c:53
void * fr_rb_find(fr_rb_tree_t const *tree, void const *data)
Find an element in the tree, returning the data, not the node.
Definition rb.c:577
bool fr_rb_insert(fr_rb_tree_t *tree, void const *data)
Insert data into a tree.
Definition rb.c:626
bool fr_rb_delete(fr_rb_tree_t *tree, void const *data)
Remove node and free data (if a free function was specified)
Definition rb.c:741
#define fr_rb_inline_talloc_alloc(_ctx, _type, _field, _data_cmp, _data_free)
Allocs a red black that verifies elements are of a specific talloc type.
Definition rb.h:246
The main red black tree structure.
Definition rb.h:73
static unsigned int hash(char const *username, unsigned int tablesize)
Definition rlm_passwd.c:132
static char const * name
fr_network_t * fr_schedule_listen_add(fr_schedule_t *sc, fr_listen_t *li)
Add a fr_listen_t to a scheduler.
Definition schedule.c:892
The scheduler.
Definition schedule.c:125
CONF_SECTION * conf
Module's instance configuration.
Definition module.h:330
void * data
Module's instance data.
Definition module.h:272
module_instantiate_t instantiate
Callback to allow the module to register any per-instance resources like sockets and file handles.
Definition module.h:219
@ MODULE_INSTANCE_BOOTSTRAPPED
Module instance has been bootstrapped, but not yet instantiated.
Definition module.h:245
size_t thread_inst_size
Size of the module's thread-specific instance data.
Definition module.h:236
Module instance data.
Definition module.h:266
fr_time_delta_t idle_timeout
Definition socket.h:38
uint32_t max_connections
Definition socket.h:33
static const uchar sc[16]
Definition smbdes.c:115
module_list_type_t const module_list_type_thread_local
Callbacks for a thread local list.
Definition module.c:582
void module_list_mask_set(module_list_t *ml, module_instance_state_t mask)
Set a new bootstrap/instantiate state for a list.
Definition module.c:1829
module_instance_t * module_instance_copy(module_list_t *dst, module_instance_t const *src, char const *inst_name)
Duplicate a module instance, placing it in a new module list.
Definition module.c:1528
module_list_t * module_list_alloc(TALLOC_CTX *ctx, module_list_type_t const *type, char const *name, bool write_protect)
Allocate a new module list.
Definition module.c:1851
int module_thread_instantiate(TALLOC_CTX *ctx, module_instance_t *mi, fr_event_list_t *el)
Allocate thread-local instance data for a module.
Definition module.c:1077
int module_instantiate(module_instance_t *instance)
Manually complete module setup by calling its instantiate function.
Definition module.c:1189
int module_instance_conf_parse(module_instance_t *mi, CONF_SECTION *conf)
Covert a CONF_SECTION into parsed module instance data.
Definition module.c:758
eap_aka_sim_process_conf_t * inst
#define fr_time()
Allow us to arbitrarily manipulate time.
Definition state_test.c:8
char const * fr_syserror(int num)
Guaranteed to be thread-safe version of strerror.
Definition syserror.c:243
#define talloc_get_type_abort_const
Definition talloc.h:282
#define talloc_zero_pooled_object(_ctx, _type, _num_subobjects, _total_subobjects_size)
Definition talloc.h:177
static int talloc_const_free(void const *ptr)
Free const'd memory.
Definition talloc.h:224
static TALLOC_CTX * talloc_init_const(char const *name)
Allocate a top level chunk with a constant name.
Definition talloc.h:112
static int64_t fr_time_delta_unwrap(fr_time_delta_t time)
Definition time.h:154
#define fr_time_delta_lt(_a, _b)
Definition time.h:285
static int64_t fr_time_unwrap(fr_time_t time)
Definition time.h:146
static fr_time_delta_t fr_time_delta_from_sec(int64_t sec)
Definition time.h:590
#define fr_time_delta_wrap(_time)
Definition time.h:152
#define fr_time_wrap(_time)
Definition time.h:145
#define fr_time_delta_ispos(_a)
Definition time.h:290
#define fr_time_eq(_a, _b)
Definition time.h:241
#define NSEC
Definition time.h:379
#define fr_time_add(_a, _b)
Add a time/time delta together.
Definition time.h:196
#define fr_time_neq(_a, _b)
Definition time.h:242
A time delta, a difference in time measured in nanoseconds.
Definition time.h:80
"server local" time.
Definition time.h:69
An event timer list.
Definition timer.c:49
A timer event.
Definition timer.c:75
#define fr_timer_armed(_ev)
Definition timer.h:117
#define FR_TIMER_DELETE(_ev_p)
Definition timer.h:102
#define FR_TIMER_DELETE_RETURN(_ev_p)
Definition timer.h:109
#define fr_timer_in(...)
Definition timer.h:86
#define FR_TIMER_DISARM(_ev)
Definition timer.h:90
#define fr_timer_at(...)
Definition timer.h:80
void * fr_trie_remove_by_key(fr_trie_t *ft, void const *key, size_t keylen)
Remove a key and return the associated user ctx.
Definition trie.c:2153
fr_trie_t * fr_trie_alloc(TALLOC_CTX *ctx, fr_trie_key_t get_key, fr_free_t free_data)
Allocate a trie.
Definition trie.c:740
int fr_trie_walk(fr_trie_t *ft, void *ctx, fr_trie_walk_t callback)
Definition trie.c:2606
void * fr_trie_lookup_by_key(fr_trie_t const *ft, void const *key, size_t keylen)
Lookup a key in a trie and return user ctx, if any.
Definition trie.c:1261
void * fr_trie_match_by_key(fr_trie_t const *ft, void const *key, size_t keylen)
Match a key and length in a trie and return user ctx, if any.
Definition trie.c:1285
int fr_trie_insert_by_key(fr_trie_t *ft, void const *key, size_t keylen, void const *data)
Insert a key and user ctx into a trie.
Definition trie.c:1874
close(uq->fd)
static fr_event_list_t * el
static fr_slen_t parent
Definition pair.h:845
int fd
File descriptor if this is a live socket.
Definition socket.h:81
int type
SOCK_STREAM, SOCK_DGRAM, etc.
Definition socket.h:79
#define fr_strerror_printf(_fmt,...)
Log to thread local error buffer.
Definition strerror.h:64
#define fr_strerror_const(_msg)
Definition strerror.h:223
static fr_slen_t fr_value_box_aprint(TALLOC_CTX *ctx, char **out, fr_value_box_t const *data, fr_sbuff_escape_rules_t const *e_rules) 1(fr_value_box_print
#define fr_box_ipaddr(_val)
Definition value.h:305
static fr_slen_t data
Definition value.h:1274
#define fr_box_time_delta(_val)
Definition value.h:354
bool listen_record(fr_listen_t *li)
Record that we're listening on a particular IP / port.
fr_listen_t * listen_find_any(fr_listen_t *li)
See if another global listener is using a particular IP / port.