The FreeRADIUS server $Id: 15bac2a4c627c01d1aa2047687b3418955ac7f00 $
Loading...
Searching...
No Matches
master.c
Go to the documentation of this file.
1/*
2 * This program is free software; you can redistribute it and/or modify
3 * it under the terms of the GNU General Public License as published by
4 * the Free Software Foundation; either version 2 of the License, or
5 * (at your option) any later version.
6 *
7 * This program is distributed in the hope that it will be useful,
8 * but WITHOUT ANY WARRANTY; without even the implied warranty of
9 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10 * GNU General Public License for more details.
11 *
12 * You should have received a copy of the GNU General Public License
13 * along with this program; if not, write to the Free Software
14 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
15 */
16
17/**
18 * $Id: 1dd7bfc6c7fe91bcc6ede60215db585d87b40181 $
19 * @file io/master.c
20 * @brief Master IO handler
21 *
22 * @copyright 2018 Alan DeKok (aland@freeradius.org)
23 */
24#include <freeradius-devel/io/listen.h>
25#include <freeradius-devel/io/master.h>
26
27#include <freeradius-devel/server/base.h>
28#include <freeradius-devel/server/module.h>
29#include <freeradius-devel/util/debug.h>
30
31#include <freeradius-devel/util/misc.h>
32#include <freeradius-devel/util/syserror.h>
33
34typedef struct {
35 fr_event_list_t *el; //!< event list, for the master socket.
36 fr_network_t *nr; //!< network for the master socket
37
38 fr_trie_t *trie; //!< trie of clients
39 fr_heap_t *pending_clients; //!< heap of pending clients
40 fr_heap_t *alive_clients; //!< heap of active clients
41
42 fr_listen_t *listen; //!< The master IO path
43 fr_listen_t *child; //!< The child (app_io) IO path
44 fr_schedule_t *sc; //!< the scheduler
45
46 // @todo - count num_nak_clients, and num_nak_connections, too
47 uint32_t num_connections; //!< number of dynamic connections
48 uint32_t num_pending_packets; //!< number of pending packets
49 uint64_t client_id; //!< Unique client identifier.
50} fr_io_thread_t;
51
52/** A saved packet
53 *
54 */
63
64
65/** Client states
66 *
67 */
68typedef enum {
69 PR_CLIENT_INVALID = 0,
70 PR_CLIENT_STATIC, //!< static / global clients
71 PR_CLIENT_NAK, //!< negative cache entry
72 PR_CLIENT_DYNAMIC, //!< dynamically defined client
73 PR_CLIENT_CONNECTED, //!< dynamically defined client in a connected socket
74 PR_CLIENT_PENDING, //!< dynamic client pending definition
75} fr_io_client_state_t;
76
77/*
78 * Dynamic clients are run through the normal src/process/foo state machine.
79 *
80 * request->async->packet_ctx is an fr_io_track_t
81 *
82 * track->dynamic is set to a non-zero value.
83 *
84 * The dynamic client code returns a buffer of 1 byte for a NAK.
85 *
86 * If the client creation is successful, then it does talloc(NULL, fr_client_t),
87 * fills out the structure, and sends the pointer in the buffer (8 bytes).
88 *
89 * This code will take over ownership of the structure, and
90 * create the dynamic client.
91 */
92
93typedef struct fr_io_connection_s fr_io_connection_t;
94
95/** Client definitions for master IO
96 *
97 */
98struct fr_io_client_s {
99 fr_io_connection_t *connection; //!< parent connection
100 fr_io_client_state_t state; //!< state of this client
101 fr_ipaddr_t src_ipaddr; //!< packets come from this address
102 fr_ipaddr_t network; //!< network for dynamic clients
103 fr_client_t *radclient; //!< old-style definition of this client
104
105 int packets; //!< number of packets using this client
106 fr_heap_index_t pending_id; //!< for pending clients
107 fr_heap_index_t alive_id; //!< for all clients
108
109 bool use_connected; //!< does this client allow connected sub-sockets?
110 bool ready_to_delete; //!< are we ready to delete this client?
111 bool in_trie; //!< is the client in the trie?
112
113 fr_io_instance_t const *inst; //!< parent instance for master IO handler
114 fr_io_thread_t *thread;
115 fr_event_timer_t const *ev; //!< when we clean up the client
116 fr_rb_tree_t *table; //!< tracking table for packets
117
118 fr_heap_t *pending; //!< pending packets for this client
119 fr_hash_table_t *addresses; //!< list of src/dst addresses used by this client
120
121 pthread_mutex_t mutex; //!< for parent / child signaling
122 fr_hash_table_t *ht; //!< for tracking connected sockets
123};
124
125/** Track a connection
126 *
127 * This structure contains information about the connection,
128 * a pointer to the library instance so that we can clean up on exit,
129 * and the listener.
130 *
131 * It also points to a client structure which is for this connection,
132 * and only this connection.
133 *
134 * Finally, a pointer to the parent client, so that the child can
135 * tell the parent it's alive, and the parent can push packets to the
136 * child.
137 */
138struct fr_io_connection_s {
139 char const *name; //!< taken from proto_FOO_TRANSPORT
140 int packets; //!< number of packets using this connection
141 fr_io_address_t *address; //!< full information about the connection.
142 fr_listen_t *listen; //!< master listener for this socket
143 fr_listen_t *child; //!< child listener (app_io) for this socket
144 fr_io_client_t *client; //!< our local client (pending or connected).
145 fr_io_client_t *parent; //!< points to the parent client.
146 module_instance_t *mi; //!< for submodule
147
148 bool dead; //!< roundabout way to get the network side to close a socket
149 bool paused; //!< event filter doesn't like resuming something that isn't paused
150 bool in_parent_hash; //!< for tracking thread issues
151 fr_event_list_t *el; //!< event list for this connection
152 fr_network_t *nr; //!< network for this connection
153};
154
155static fr_event_update_t pause_read[] = {
156 FR_EVENT_SUSPEND(fr_event_io_func_t, read),
157 { 0 }
158};
159
160static fr_event_update_t resume_read[] = {
161 FR_EVENT_RESUME(fr_event_io_func_t, read),
162 { 0 }
163};
164
165static int track_free(fr_io_track_t *track)
166{
167 if (track->ev) (void) fr_event_timer_delete(&track->ev);
168
169 talloc_free_children(track);
170
171 fr_assert(track->client->packets > 0);
172 track->client->packets--;
173
174 return 0;
175}
176
177static int track_dedup_free(fr_io_track_t *track)
178{
179 fr_assert(track->client->table != NULL);
180 fr_assert(fr_rb_find(track->client->table, track) != NULL);
181
182 if (!fr_rb_delete(track->client->table, track)) {
183 fr_assert(0);
184 }
185
186 return track_free(track);
187}
188
189/*
190 * Return negative numbers to put 'one' at the top of the heap.
191 * Return positive numbers to put 'two' at the top of the heap.
192 */
193static int8_t pending_packet_cmp(void const *one, void const *two)
194{
195 fr_io_pending_packet_t const *a = talloc_get_type_abort_const(one, fr_io_pending_packet_t);
196 fr_io_pending_packet_t const *b = talloc_get_type_abort_const(two, fr_io_pending_packet_t);
197 int ret;
198
199 /*
200 * Higher priority elements are larger than lower
201 * priority elements. So if "a" is larger than "b", we
202 * wish to prefer "a".
203 */
204 ret = CMP_PREFER_LARGER(a->priority, b->priority);
205 if (ret != 0) return ret;
206
207 /*
208 * Smaller numbers mean packets were received earlier.
209 * We want to process packets in time order. So if "a"
210 * is smaller than "b", we wish to prefer "a".
211 *
212 * After that, it doesn't really matter what order the
213 * packets go in. Since we'll never have two identical
214 * "recv_time" values, the code should never get here.
215 */
216 return CMP_PREFER_SMALLER(fr_time_unwrap(a->recv_time), fr_time_unwrap(b->recv_time));
217}
218
219/*
220 * Order clients in the pending_clients heap, based on the
221 * packets that they contain.
222 */
223static int8_t pending_client_cmp(void const *one, void const *two)
224{
225 fr_io_pending_packet_t const *a;
226 fr_io_pending_packet_t const *b;
227
228 fr_io_client_t const *c1 = talloc_get_type_abort_const(one, fr_io_client_t);
229 fr_io_client_t const *c2 = talloc_get_type_abort_const(two, fr_io_client_t);
230
231 a = fr_heap_peek(c1->pending);
232 b = fr_heap_peek(c2->pending);
233
234 fr_assert(a != NULL);
235 fr_assert(b != NULL);
236
237 return pending_packet_cmp(a, b);
238}
239
240
241static int8_t address_cmp(void const *one, void const *two)
242{
243 fr_io_address_t const *a = talloc_get_type_abort_const(one, fr_io_address_t);
244 fr_io_address_t const *b = talloc_get_type_abort_const(two, fr_io_address_t);
245 int8_t ret;
246
247 CMP_RETURN(a, b, socket.inet.src_port);
248 CMP_RETURN(a, b, socket.inet.dst_port);
249 CMP_RETURN(a, b, socket.inet.ifindex);
250
251 ret = fr_ipaddr_cmp(&a->socket.inet.src_ipaddr, &b->socket.inet.src_ipaddr);
252 if (ret != 0) return ret;
253
254 return fr_ipaddr_cmp(&a->socket.inet.dst_ipaddr, &b->socket.inet.dst_ipaddr);
255}
256
257static uint32_t connection_hash(void const *ctx)
258{
259 uint32_t hash;
260 fr_io_connection_t const *c = talloc_get_type_abort_const(ctx, fr_io_connection_t);
261
262 hash = fr_hash(&c->address->socket.inet.src_ipaddr, sizeof(c->address->socket.inet.src_ipaddr));
263 hash = fr_hash_update(&c->address->socket.inet.src_port, sizeof(c->address->socket.inet.src_port), hash);
264
265 hash = fr_hash_update(&c->address->socket.inet.ifindex, sizeof(c->address->socket.inet.ifindex), hash);
266
267 hash = fr_hash_update(&c->address->socket.inet.dst_ipaddr, sizeof(c->address->socket.inet.dst_ipaddr), hash);
268 return fr_hash_update(&c->address->socket.inet.dst_port, sizeof(c->address->socket.inet.dst_port), hash);
269}
270
271static int8_t connection_cmp(void const *one, void const *two)
272{
273 fr_io_connection_t const *a = talloc_get_type_abort_const(one, fr_io_connection_t);
274 fr_io_connection_t const *b = talloc_get_type_abort_const(two, fr_io_connection_t);
275
276 return address_cmp(a->address, b->address);
277}
278
279
280static int8_t track_cmp(void const *one, void const *two)
281{
282 fr_io_track_t const *a = talloc_get_type_abort_const(one, fr_io_track_t);
283 fr_io_track_t const *b = talloc_get_type_abort_const(two, fr_io_track_t);
284 int ret;
285
286 fr_assert(a->client != NULL);
287 fr_assert(b->client != NULL);
288 fr_assert(a->client == b->client); /* tables are per-client */
289
290 fr_assert(!a->client->connection);
291 fr_assert(!b->client->connection);
292
293 /*
294 * Unconnected sockets must check src/dst ip/port.
295 */
296 ret = address_cmp(a->address, b->address);
297 if (ret != 0) return ret;
298
299 /*
300 * Call the per-protocol comparison function.
301 */
302 ret = a->client->inst->app_io->track_compare(a->client->inst->app_io_instance,
303 a->client->thread->child->thread_instance,
304 a->client->radclient,
305 a->packet, b->packet);
306 return CMP(ret, 0);
307}
308
309
310static int8_t track_connected_cmp(void const *one, void const *two)
311{
312 fr_io_track_t const *a = talloc_get_type_abort_const(one, fr_io_track_t);
313 fr_io_track_t const *b = talloc_get_type_abort_const(two, fr_io_track_t);
314 int ret;
315
316 fr_assert(a->client != NULL);
317 fr_assert(b->client != NULL);
318
319 fr_assert(a->client->connection);
320 fr_assert(b->client->connection);
321 fr_assert(a->client == b->client);
322 fr_assert(a->client->connection == b->client->connection);
323
324 /*
325 * Note that we pass the connection "client", as
326 * we may do negotiation specific to this connection.
327 */
328 ret = a->client->inst->app_io->track_compare(a->client->inst->app_io_instance,
329 a->client->connection->child->thread_instance,
330 a->client->connection->client->radclient,
331 a->packet, b->packet);
332 return CMP(ret, 0);
333}
334
335
336static fr_io_pending_packet_t *pending_packet_pop(fr_io_thread_t *thread)
337{
338 fr_io_client_t *client;
339 fr_io_pending_packet_t *pending;
340
341 client = fr_heap_pop(&thread->pending_clients);
342 if (!client) {
343 /*
344 * 99% of the time we don't have pending clients.
345 * So we might as well free this, so that the
346 * caller doesn't keep checking us for every packet.
347 */
348 talloc_free(thread->pending_clients);
349 thread->pending_clients = NULL;
350 return NULL;
351 }
352
353 pending = fr_heap_pop(&client->pending);
354 fr_assert(pending != NULL);
355
356 /*
357 * If the client has more packets pending, add it back to
358 * the heap.
359 */
360 if (fr_heap_num_elements(client->pending) > 0) {
361 if (fr_heap_insert(&thread->pending_clients, client) < 0) {
362 fr_assert(0 == 1);
363 }
364 }
365
366 fr_assert(thread->num_pending_packets > 0);
367 thread->num_pending_packets--;
368
369 return pending;
370}
371
372static fr_client_t *radclient_clone(TALLOC_CTX *ctx, fr_client_t const *parent)
373{
374 fr_client_t *c;
375
376 if (!parent) return NULL;
377
378 c = talloc_zero(ctx, fr_client_t);
379 if (!c) return NULL;
380
381 /*
382 * Do NOT set ipaddr or src_ipaddr. The caller MUST do this!
383 */
384
385#define DUP_FIELD(_x) do { if (parent->_x) {c->_x = talloc_strdup(c, parent->_x); if (!c->_x) {goto error;}}} while (0)
386#define COPY_FIELD(_x) c->_x = parent->_x
387
388 DUP_FIELD(longname);
389 DUP_FIELD(shortname);
390 DUP_FIELD(secret);
391 DUP_FIELD(nas_type);
392 DUP_FIELD(server);
393 DUP_FIELD(nas_type);
394
395 COPY_FIELD(require_message_authenticator);
396 COPY_FIELD(require_message_authenticator_is_set);
397 COPY_FIELD(limit_proxy_state);
398 COPY_FIELD(limit_proxy_state_is_set);
399 COPY_FIELD(received_message_authenticator);
400 COPY_FIELD(first_packet_no_proxy_state);
401 /* dynamic MUST be false */
402 COPY_FIELD(server_cs);
403 COPY_FIELD(cs);
404 COPY_FIELD(proto);
405 COPY_FIELD(active);
406
407 COPY_FIELD(use_connected);
408
409#ifdef WITH_TLS
410 COPY_FIELD(tls_required);
411#endif
412
413 c->ipaddr = parent->ipaddr;
414 c->src_ipaddr = parent->src_ipaddr;
415
416 return c;
417
418 /*
419 * @todo - fill in other fields, too!
420 */
421
422error:
423 talloc_free(c);
424 return NULL;
425}
426#undef COPY_FIELD
427#undef DUP_FIELD
428
429
430/** Count the number of connections used by active clients.
431 *
432 * Unfortunately, we also count NAK'd connections, too, even if they
433 * are closed. The alternative is to walk through all connections
434 * for each client, which would be a long time.
435 */
436static int count_connections(UNUSED uint8_t const *key, UNUSED size_t keylen, void *data, void *ctx)
437{
438 fr_io_client_t *client = talloc_get_type_abort(data, fr_io_client_t);
439 int connections;
440
441 pthread_mutex_lock(&client->mutex);
442
443 if (!client->ht) {
444 pthread_mutex_unlock(&client->mutex);
445 return 0;
446 }
447
448 connections = fr_hash_table_num_elements(client->ht);
449 pthread_mutex_unlock(&client->mutex);
450
451 fr_assert(client->use_connected);
452 *((uint32_t *) ctx) += connections;
453
454 return 0;
455}
456
457
458static int _client_free(fr_io_client_t *client)
459{
460 TALLOC_FREE(client->pending);
461
462 return 0;
463}
464
465static int connection_free(fr_io_connection_t *connection)
466{
467 /*
468 * This is it's own talloc context, as there are
469 * thousands of packets associated with it.
470 */
471 TALLOC_FREE(connection->client);
472
473 return 0;
474}
475
476/** Create a new connection.
477 *
478 * Called ONLY from the master socket.
479 */
480static fr_io_connection_t *fr_io_connection_alloc(fr_io_instance_t const *inst,
481 fr_io_thread_t *thread,
482 fr_io_client_t *client, int fd,
483 fr_io_address_t *address,
484 fr_io_connection_t *nak)
485{
486 int ret;
487 fr_io_connection_t *connection;
488 module_instance_t *mi = NULL;
489 fr_listen_t *li;
490 fr_client_t *radclient;
491
492 /*
493 * Reload the app_io module as a "new" library. This
494 * causes the link count for the library to be correct.
495 * It also allocates a new instance data for it, too.
496 * Passing CONF_SECTION of NULL ensures that there's no
497 * config for it, as we'll just clone it's contents from
498 * the original. It also means that detach should be
499 * called when the instance data is freed.
500 */
501 if (!nak) {
502 CONF_SECTION *cs;
503 char *inst_name;
504
505 if (inst->max_connections || client->radclient->limit.max_connections) {
506 uint32_t max_connections = inst->max_connections ? inst->max_connections : client->radclient->limit.max_connections;
507
508 /*
509 * We've hit the connection limit. Walk
510 * over all clients with connections, and
511 * count the number of connections used.
512 */
513 if (thread->num_connections >= max_connections) {
514 thread->num_connections = 0;
515
516 (void) fr_trie_walk(thread->trie, &thread->num_connections, count_connections);
517
518 if ((thread->num_connections + 1) >= max_connections) {
519 DEBUG("proto_%s - Ignoring connection from client %s - 'max_connections' limit reached.",
520 inst->app->common.name, client->radclient->shortname);
521 if (fd >= 0) close(fd);
522 return NULL;
523 }
524 }
525 }
526
527 /*
528 * Add a client module into a sublist
529 */
530 inst_name = talloc_asprintf(NULL, "%"PRIu64, thread->client_id++);
531 mi = module_instance_copy(inst->clients, inst->submodule, inst_name);
532
533 cs = cf_section_dup(mi, NULL, inst->submodule->conf,
534 cf_section_name1(inst->submodule->conf),
535 cf_section_name2(inst->submodule->conf), false);
536 if (module_instance_conf_parse(mi, cs) < 0) {
537 cf_log_err(inst->server_cs, "Failed parsing module config");
538 goto cleanup;
539 }
540
541 /* Thread local module lists never run bootstrap */
542 if (module_instantiate(mi) < 0) {
543 cf_log_err(inst->server_cs, "Failed instantiating module");
544 goto cleanup;
545 }
546
547 if (module_thread_instantiate(mi, mi, thread->el) < 0) {
548 cf_log_err(inst->server_cs, "Failed instantiating module");
549 goto cleanup;
550 }
551
552 /*
553 * FIXME - Instantiate the new module?!
554 */
555 talloc_free(inst_name);
556 fr_assert(mi != NULL);
557 } else {
558 mi = talloc_init_const("nak");
559 }
560
561 MEM(connection = talloc_zero(mi, fr_io_connection_t));
562 MEM(connection->address = talloc_memdup(connection, address, sizeof(*address)));
563 (void) talloc_set_name_const(connection->address, "fr_io_address_t");
564
565 connection->parent = client;
566 connection->mi = mi;
567
568 MEM(connection->client = talloc_named(NULL, sizeof(fr_io_client_t), "fr_io_client_t"));
569 memset(connection->client, 0, sizeof(*connection->client));
570
571 MEM(connection->client->radclient = radclient = radclient_clone(connection->client, client->radclient));
572
573 talloc_set_destructor(connection->client, _client_free);
574 talloc_set_destructor(connection, connection_free);
575
576 connection->client->pending_id = FR_HEAP_INDEX_INVALID;
577 connection->client->alive_id = FR_HEAP_INDEX_INVALID;
578 connection->client->connection = connection;
579
580 /*
581 * Create the packet tracking table for this client.
582 *
583 * #todo - unify the code with static clients?
584 */
585 if (inst->app_io->track_duplicates) {
586 MEM(connection->client->table = fr_rb_inline_talloc_alloc(client, fr_io_track_t, node,
587 track_connected_cmp, NULL));
588 }
589
590 /*
591 * Set this radclient to be dynamic, and active.
592 */
593 radclient->dynamic = true;
594 radclient->active = true;
595
596 /*
597 * address->socket.inet.client points to a "static" client. We want
598 * to clean up everything associated with the connection
599 * when it closes. So we need to point to our own copy
600 * of the client here.
601 */
602 connection->address->radclient = connection->client->radclient;
603 connection->client->inst = inst;
604 connection->client->thread = thread;
605
606 /*
607 * Create a heap for packets which are pending for this
608 * client.
609 */
610 MEM(connection->client->pending = fr_heap_alloc(connection->client, pending_packet_cmp,
611 fr_io_pending_packet_t, heap_id, 0));
612
613 /*
614 * Clients for connected sockets are always a /32 or /128.
615 */
616 connection->client->src_ipaddr = address->socket.inet.src_ipaddr;
617 connection->client->network = address->socket.inet.src_ipaddr;
618
619 /*
620 * Don't initialize mutex or hash table.
621 * Connections cannot spawn other connections.
622 */
623
624 /*
625 * If this client state is pending, then the connection
626 * state is pending, too. That allows NAT gateways to be
627 * defined dynamically, AND for them to have multiple
628 * connections, each with a different client. This
629 * allows for different shared secrets to be used for
630 * different connections. Once the client gets defined
631 * for this connection, it will be either "connected" or
632 * not. If connected, then the parent client remains
633 * PENDING. Otherwise, the parent client is moved to
634 * DYNAMIC
635 *
636 * If this client state is static or dynamic,
637 * then we're just using connected sockets behind
638 * that client. The connections here all use the
639 * same shared secret, but they use different
640 * sockets, so they allow for sharing of IO
641 * across CPUs / threads.
642 */
643 switch (client->state) {
644 case PR_CLIENT_PENDING:
645 connection->client->state = PR_CLIENT_PENDING;
646
647 /*
648 * Needed for rlm_radius, which refuses to proxy packets
649 * that define a dynamic client.
650 */
651 radclient->active = false;
652 break;
653
654 case PR_CLIENT_STATIC:
655 case PR_CLIENT_DYNAMIC:
656 connection->client->state = PR_CLIENT_CONNECTED;
657 break;
658
659 case PR_CLIENT_INVALID:
660 case PR_CLIENT_NAK:
661 case PR_CLIENT_CONNECTED:
662 fr_assert(0 == 1);
663 goto cleanup;
664 }
665
666 if (!nak) {
667 /*
668 * Get the child listener.
669 */
670 MEM(li = connection->child = talloc(connection, fr_listen_t));
671 memcpy(li, thread->listen, sizeof(*li));
672
673 /*
674 * Glue in the actual app_io
675 */
676 li->connected = true;
677 li->app_io = thread->child->app_io;
678 li->thread_instance = connection;
679 li->app_io_instance = mi->data;
680 li->track_duplicates = thread->child->app_io->track_duplicates;
681
682 /*
683 * Create writable thread instance data.
684 */
685 connection->child->thread_instance = talloc_zero_array(NULL, uint8_t,
686 inst->app_io->common.thread_inst_size);
687 talloc_set_destructor(connection->child, fr_io_listen_free);
688 talloc_set_name(connection->child->thread_instance, "proto_%s_thread_t",
689 inst->app_io->common.name);
690
691 /*
692 * This is "const", and the user can't
693 * touch it. So we just reuse the same
694 * configuration everywhere.
695 */
696 connection->child->app_io_instance = inst->app_io_instance;
697
698 /*
699 * Create the listener, based on our listener.
700 */
701 MEM(li = connection->listen = talloc(connection, fr_listen_t));
702
703 /*
704 * Note that our instance is effectively 'const'.
705 *
706 * i.e. we can't add things to it. Instead, we have to
707 * put all variable data into the connection.
708 */
709 memcpy(li, thread->listen, sizeof(*li));
710
711 /*
712 * Glue in the connection to the listener.
713 */
714 fr_assert(li->app_io == &fr_master_app_io);
715
716 li->connected = true;
717 li->thread_instance = connection;
718 li->app_io_instance = li->thread_instance;
719 li->track_duplicates = thread->child->app_io->track_duplicates;
720
721 /*
722 * Instantiate the child, and open the socket.
723 */
724 fr_assert(inst->app_io->connection_set != NULL);
725
726 if (inst->app_io->connection_set(connection->child, connection->address) < 0) {
727 DEBUG("proto_%s - Failed setting connection for socket.", inst->app->common.name);
728 goto cleanup;
729 }
730
731 /*
732 * UDP sockets: open a new socket, and then
733 * connect it to the client. This emulates the
734 * behavior of accept().
735 *
736 * Note that there is a small window between the
737 * bind() and connect() where UDP packets for the
738 * wildcard socket can get received by this
739 * socket. We hope that this time frame is as
740 * small as possible.
741 *
742 * i.e. we ignore the problem, and don't
743 * currently check dst ip/port for UDP packets
744 * received on connected sockets.
745 */
746 if (fd < 0) {
747 socklen_t salen;
748 struct sockaddr_storage src;
749
750 if (fr_ipaddr_to_sockaddr(&src, &salen,
751 &connection->address->socket.inet.src_ipaddr,
752 connection->address->socket.inet.src_port) < 0) {
753 DEBUG("proto_%s - Failed getting IP address", inst->app->common.name);
754 talloc_free(mi);
755 return NULL;
756 }
757
758 if (inst->app_io->open(connection->child) < 0) {
759 DEBUG("proto_%s - Failed opening connected socket.", inst->app->common.name);
760 talloc_free(mi);
761 return NULL;
762 }
763
764 fd = connection->child->fd;
765
766 if (connect(fd, (struct sockaddr *) &src, salen) < 0) {
767 ERROR("proto_%s - Failed in connect: %s", inst->app->common.name, fr_syserror(errno));
768 goto cleanup;
769 }
770 } else {
771 connection->child->fd = fd;
772 }
773
774 /*
775 * Set the new FD, and get the module to set it's connection name.
776 */
777 if (inst->app_io->fd_set(connection->child, fd) < 0) {
778 DEBUG3("Failed setting FD to %s", inst->app_io->common.name);
779 goto cleanup;
780 }
781
782 li->fd = fd;
783
784 if (!inst->app_io->get_name) {
785 connection->name = fr_asprintf(connection, "proto_%s from client %pV port "
786 "%u to server %pV port %u",
787 inst->app->common.name,
788 fr_box_ipaddr(connection->address->socket.inet.src_ipaddr),
789 connection->address->socket.inet.src_port,
790 fr_box_ipaddr(connection->address->socket.inet.dst_ipaddr),
791 connection->address->socket.inet.dst_port);
792 } else {
793 connection->name = inst->app_io->get_name(connection->child);
794 }
795
796 /*
797 * Set the names for the listeners.
798 */
799 connection->listen->name = connection->name;
800 connection->child->name = connection->name;
801 }
802
803 /*
804 * Add the connection to the set of connections for this
805 * client.
806 */
807 pthread_mutex_lock(&client->mutex);
808 if (client->ht) {
809 if (nak) (void) fr_hash_table_delete(client->ht, nak);
810 ret = fr_hash_table_insert(client->ht, connection);
811 client->ready_to_delete = false;
812 connection->in_parent_hash = true;
813
814 if (!ret) {
815 pthread_mutex_unlock(&client->mutex);
816 ERROR("proto_%s - Failed inserting connection into tracking table. "
817 "Closing it, and discarding all packets for connection %s.",
818 inst->app_io->common.name, connection->name);
819 goto cleanup;
820 }
821 }
822 pthread_mutex_unlock(&client->mutex);
823
824 /*
825 * It's a NAK client. Set the state to NAK, and don't
826 * add it to the scheduler.
827 */
828 if (nak) {
829 connection->name = talloc_strdup(connection, nak->name);
830 connection->client->state = PR_CLIENT_NAK;
831 connection->el = nak->el;
832 return connection;
833 }
834
835 DEBUG("proto_%s - starting connection %s", inst->app_io->common.name, connection->name);
836 connection->nr = fr_schedule_listen_add(thread->sc, connection->listen);
837 if (!connection->nr) {
838 ERROR("proto_%s - Failed inserting connection into scheduler. "
839 "Closing it, and diuscarding all packets for connection %s.",
840 inst->app_io->common.name, connection->name);
841 pthread_mutex_lock(&client->mutex);
842 if (client->ht) (void) fr_hash_table_delete(client->ht, connection);
843 pthread_mutex_unlock(&client->mutex);
844
845 cleanup:
846 if (fd >= 0) close(fd);
847 talloc_free(mi);
848 return NULL;
849 }
850
851 /*
852 * We have one more connection. Note that we do
853 * NOT decrement this counter when a connection
854 * closes, as the close is done in a child
855 * thread. Instead, we just let counter hit the
856 * limit, and then walk over the clients to reset
857 * the count.
858 */
859 thread->num_connections++;
860
861 return connection;
862}
863
864
865/*
866 * And here we go into the rabbit hole...
867 *
868 * @todo future - have a similar structure
869 * fr_io_connection_io, which will duplicate some code,
870 * but may make things simpler?
871 */
872static void get_inst(fr_listen_t *li, fr_io_instance_t const **inst, fr_io_thread_t **thread,
873 fr_io_connection_t **connection, fr_listen_t **child)
874{
875 if (!li->connected) {
876 *inst = li->app_io_instance;
877 if (thread) *thread = li->thread_instance;
878 *connection = NULL;
879 if (child) *child = ((fr_io_thread_t *)li->thread_instance)->child;
880
881 } else {
882 fr_assert(connection != NULL);
883
884 *connection = li->thread_instance;
885 *inst = (*connection)->client->inst;
886 if (thread) *thread = NULL;
887 if (child) *child = (*connection)->child;
888 }
889}
890
891
892static fr_client_t *radclient_alloc(TALLOC_CTX *ctx, int ipproto, fr_io_address_t *address)
893{
894 fr_client_t *radclient;
895 char *shortname;
896
897 MEM(radclient = talloc_zero(ctx, fr_client_t));
898
899 fr_value_box_aprint(radclient, &shortname, fr_box_ipaddr(address->socket.inet.src_ipaddr), NULL);
900 radclient->longname = radclient->shortname = shortname;
901
902 radclient->secret = radclient->nas_type = talloc_strdup(radclient, "");
903
904 radclient->ipaddr = address->socket.inet.src_ipaddr;
905
906 radclient->src_ipaddr = address->socket.inet.dst_ipaddr;
907
908 radclient->proto = ipproto;
909 radclient->dynamic = true;
910
911 return radclient;
912}
913
914/*
915 * Remove a client from the list of "live" clients.
916 *
917 * This function is only used for the "main" socket. Clients
918 * from connections do not use it.
919 */
920static int _client_live_free(fr_io_client_t *client)
921{
922 fr_assert(client->in_trie);
923 fr_assert(!client->connection);
924 fr_assert(fr_heap_num_elements(client->thread->alive_clients) > 0);
925
926 if (client->pending) TALLOC_FREE(client->pending);
927
928 (void) fr_trie_remove_by_key(client->thread->trie, &client->src_ipaddr.addr, client->src_ipaddr.prefix);
929 (void) fr_heap_extract(&client->thread->alive_clients, client);
930
931 return 0;
932}
933
934static fr_io_client_t *client_alloc(TALLOC_CTX *ctx, fr_io_client_state_t state,
935 fr_io_instance_t const *inst, fr_io_thread_t *thread, fr_client_t *radclient,
936 fr_ipaddr_t const *network)
937{
938 fr_io_client_t *client;
939
940 /*
941 * Create our own local client. This client
942 * holds our state which really shouldn't go into
943 * fr_client_t.
944 *
945 * Note that we create a new top-level talloc
946 * context for this client, as there may be tens
947 * of thousands of packets associated with this
948 * client. And we want to avoid problems with
949 * O(N) issues in talloc.
950 */
951 MEM(client = talloc_named(ctx, sizeof(fr_io_client_t), "fr_io_client_t"));
952 memset(client, 0, sizeof(*client));
953
954 client->state = state;
955 client->src_ipaddr = radclient->ipaddr;
956 client->radclient = radclient;
957 client->inst = inst;
958 client->thread = thread;
959
960 if (network) {
961 client->network = *network;
962 } else {
963 client->network = client->src_ipaddr;
964 }
965
966 /*
967 * At this point, this variable can only be true
968 * for STATIC clients. PENDING clients may set
969 * it to true later, after they've been defined.
970 */
971 client->use_connected = radclient->use_connected;
972
973 /*
974 * Create the pending heap for pending clients.
975 */
976 if (state == PR_CLIENT_PENDING) {
977 MEM(client->pending = fr_heap_alloc(client, pending_packet_cmp,
978 fr_io_pending_packet_t, heap_id, 0));
979 }
980
981 /*
982 * Create the packet tracking table for this client.
983 */
984 if (inst->app_io->track_duplicates) {
985 fr_assert(inst->app_io->track_compare != NULL);
986 MEM(client->table = fr_rb_inline_talloc_alloc(client, fr_io_track_t, node, track_cmp, NULL));
987 }
988
989 /*
990 * Allow connected sockets to be set on a
991 * per-client basis.
992 */
993 if (client->use_connected) {
994 fr_assert(client->state == PR_CLIENT_STATIC);
995
996 (void) pthread_mutex_init(&client->mutex, NULL);
997 MEM(client->ht = fr_hash_table_alloc(client, connection_hash, connection_cmp, NULL));
998 }
999
1000 /*
1001 * Add the newly defined client to the trie of
1002 * allowed clients.
1003 */
1004 if (fr_trie_insert_by_key(thread->trie, &client->src_ipaddr.addr, client->src_ipaddr.prefix, client)) {
1005 ERROR("proto_%s - Failed inserting client %s into tracking table. Discarding client, and all packets for it.",
1006 inst->app_io->common.name, client->radclient->shortname);
1007 talloc_free(client);
1008 return NULL;
1009 }
1010
1011 client->in_trie = true;
1012
1013 /*
1014 * Track the live clients so that we can clean
1015 * them up.
1016 */
1017 (void) fr_heap_insert(&thread->alive_clients, client);
1018 client->pending_id = FR_HEAP_INDEX_INVALID;
1019
1020 /*
1021 * Now that we've inserted it into the heap and
1022 * incremented the numbers, set the destructor
1023 * function.
1024 */
1025 talloc_set_destructor(client, _client_live_free);
1026
1027 return client;
1028}
1029
1030
1031static fr_io_track_t *fr_io_track_add(fr_io_client_t *client,
1032 fr_io_address_t *address,
1033 uint8_t const *packet, size_t packet_len,
1034 fr_time_t recv_time, bool *is_dup)
1035{
1036 size_t len;
1037 fr_io_track_t *track, *old;
1038 fr_io_address_t *my_address;
1039
1040 *is_dup = false;
1041
1042 /*
1043 * Allocate a new tracking structure. Most of the time
1044 * there are no duplicates, so this is fine.
1045 */
1046 MEM(track = talloc_zero_pooled_object(client, fr_io_track_t, 1, sizeof(*track) + sizeof(track->address) + 64));
1047 MEM(track->address = my_address = talloc_zero(track, fr_io_address_t));
1048
1049 memcpy(my_address, address, sizeof(*address));
1050 my_address->radclient = client->radclient;
1051
1052 track->client = client;
1053 if (client->connection) {
1054 track->address = client->connection->address;
1055 }
1056
1057 track->timestamp = recv_time;
1058 track->packets = 1;
1059
1060 /*
1061 * We're not tracking duplicates, so just return the
1062 * tracking entry. This tracks src/dst IP/port, client,
1063 * receive time, etc.
1064 */
1065 if (!client->inst->app_io->track_duplicates) {
1066 client->packets++;
1067 talloc_set_destructor(track, track_free);
1068 return track;
1069 }
1070
1071 /*
1072 * We are checking for duplicates, see if there is a dup
1073 * already in the tree.
1074 */
1075 track->packet = client->inst->app_io->track_create(client->inst->app_io_instance,
1076 client->thread->child->thread_instance,
1077 client->radclient,
1078 track, packet, packet_len);
1079 if (!track->packet) {
1080 talloc_free(track);
1081 return NULL;
1082 }
1083
1084 /*
1085 * No existing duplicate. Return the new tracking entry.
1086 */
1087 old = fr_rb_find(client->table, track);
1088 if (!old) goto do_insert;
1089
1090 fr_assert(old->client == client);
1091
1092 /*
1093 * It cannot be both in the free list and in the tracking table.
1094 *
1095 * 2020-08-17, this assertion fails randomly in travis.
1096 * Which means that "track" was in the free list, *and*
1097 * in the rbtree.
1098 */
1099 fr_assert(old != track);
1100
1101 /*
1102 * The new packet has the same dedup fields as the old
1103 * one, BUT it may be a conflicting packet. Check for
1104 * that via a simple memcmp().
1105 *
1106 * It's an exact duplicate. Drop the new one and
1107 * use the old one.
1108 *
1109 * If there's a cached reply, the caller will take care
1110 * of sending it to the network layer.
1111 */
1112 len = talloc_array_length(old->packet);
1113 if ((len == talloc_array_length(track->packet)) &&
1114 (memcmp(old->packet, track->packet, len) == 0)) {
1115 fr_assert(old != track);
1116
1117 /*
1118 * Ignore duplicates while the client is
1119 * still pending.
1120 */
1121 if (client->state == PR_CLIENT_PENDING) {
1122 DEBUG("Ignoring duplicate packet while client %s is still pending dynamic definition",
1123 client->radclient->shortname);
1124 return NULL;
1125 }
1126
1127 *is_dup = true;
1128 old->packets++;
1129 talloc_free(track);
1130
1131 /*
1132 * Retransmits can sit in the outbound queue for
1133 * a while. We don't want to time out this
1134 * struct while the packet is in the outbound
1135 * queue.
1136 */
1137 if (old->ev) (void) fr_event_timer_delete(&old->ev);
1138 return old;
1139 }
1140
1141 /*
1142 * Else it's a conflicting packet. Which is OK if we
1143 * already have a reply. We just delete the old entry,
1144 * and insert the new one.
1145 *
1146 * If there's no reply, then the old request is still
1147 * "live". Delete the old one from the tracking tree,
1148 * and return the new one.
1149 */
1150 if (old->reply_len || old->do_not_respond) {
1151 talloc_free(old);
1152
1153 } else {
1154 fr_assert(client == old->client);
1155
1156 if (!fr_rb_delete(client->table, old)) {
1157 fr_assert(0);
1158 }
1159 if (old->ev) (void) fr_event_timer_delete(&old->ev);
1160
1161 talloc_set_destructor(old, track_free);
1162
1163 old->discard = true; /* don't send any reply, there's nowhere for it to go */
1164 }
1165
1166do_insert:
1167 if (!fr_rb_insert(client->table, track)) {
1168 fr_assert(0);
1169 }
1170
1171 client->packets++;
1172 talloc_set_destructor(track, track_dedup_free);
1173 return track;
1174}
1175
1176
1177static int pending_free(fr_io_pending_packet_t *pending)
1178{
1179 fr_io_track_t *track = pending->track;
1180
1181 /*
1182 * Note that we don't check timestamps, replies, etc. If
1183 * a packet is pending, then any conflicting packet gets
1184 * the "pending" entry marked as such, and a new entry
1185 * added. Any duplicate packet gets suppressed. And
1186 * because the packets are pending, track->reply MUST be
1187 * NULL.
1188 */
1189 fr_assert(track->packets > 0);
1190 track->packets--;
1191
1192 /*
1193 * No more packets using this tracking entry,
1194 * delete it.
1195 */
1196 if (track->packets == 0) talloc_free(track);
1197
1198 return 0;
1199}
1200
1201static fr_io_pending_packet_t *fr_io_pending_alloc(fr_io_client_t *client,
1202 uint8_t const *buffer, size_t packet_len,
1203 fr_io_track_t *track,
1204 int priority)
1205{
1206 fr_io_pending_packet_t *pending;
1207
1208 MEM(pending = talloc_zero(client->pending, fr_io_pending_packet_t));
1209
1210 MEM(pending->buffer = talloc_memdup(pending, buffer, packet_len));
1211 pending->buffer_len = packet_len;
1212 pending->priority = priority;
1213 pending->track = track;
1214 pending->recv_time = track->timestamp; /* there can only be one */
1215
1216 talloc_set_destructor(pending, pending_free);
1217
1218 /*
1219 * Insert the pending packet for this client. If it
1220 * fails, silently discard the packet.
1221 */
1222 if (fr_heap_insert(&client->pending, pending) < 0) {
1223 talloc_free(pending);
1224 return NULL;
1225 }
1226
1227 /*
1228 * We only track pending packets for the
1229 * main socket. For connected sockets,
1230 * we pause the FD, so the number of
1231 * pending packets will always be small.
1232 */
1233 if (!client->connection) client->thread->num_pending_packets++;
1234
1235 return pending;
1236}
1237
1238
1239/*
1240 * Order clients in the alive_clients heap, based on their IP
1241 * address.
1242 *
1243 * This function is only used for the "main" socket. Clients
1244 * from connections do not use it.
1245 */
1246static int8_t alive_client_cmp(void const *one, void const *two)
1247{
1248 fr_io_client_t const *a = talloc_get_type_abort_const(one, fr_io_client_t);
1249 fr_io_client_t const *b = talloc_get_type_abort_const(two, fr_io_client_t);
1250
1251 return fr_ipaddr_cmp(&a->src_ipaddr, &b->src_ipaddr);
1252}
1253
1254/** Implement 99% of the read routines.
1255 *
1256 * The app_io->read does the transport-specific data read.
1257 */
1258static ssize_t mod_read(fr_listen_t *li, void **packet_ctx, fr_time_t *recv_time_p,
1259 uint8_t *buffer, size_t buffer_len, size_t *leftover)
1260{
1261 fr_io_instance_t const *inst;
1262 fr_io_thread_t *thread;
1263 ssize_t packet_len = -1;
1264 fr_time_t recv_time = fr_time_wrap(0);
1265 fr_io_client_t *client;
1266 fr_io_address_t address;
1267 fr_io_connection_t my_connection, *connection;
1268 fr_io_pending_packet_t *pending;
1269 fr_io_track_t *track;
1270 fr_listen_t *child;
1271 int value, accept_fd = -1;
1272 uint32_t priority = PRIORITY_NORMAL;
1273
1274 get_inst(li, &inst, &thread, &connection, &child);
1275
1276 track = NULL;
1277
1278 /*
1279 * There was data left over from the previous read, go
1280 * get the rest of it now. We MUST do this instead of
1281 * popping a pending packet, because the leftover bytes
1282 * are already in the output buffer.
1283 */
1284 if (*leftover) goto do_read;
1285
1286redo:
1287 /*
1288 * Read one pending packet. The packet may be pending
1289 * because of dynamic client definitions, or because it's
1290 * for a connected UDP socket, and was sent over by the
1291 * "master" UDP socket.
1292 */
1293 if (connection) {
1294 /*
1295 * The connection is dead. Tell the network side
1296 * to close it.
1297 */
1298 if (connection->dead) {
1299 DEBUG("Dead connection %s", connection->name);
1300 return -1;
1301 }
1302
1303 pending = fr_heap_pop(&connection->client->pending);
1304
1305 } else if (thread->pending_clients) {
1306 pending = pending_packet_pop(thread);
1307
1308 } else {
1309 pending = NULL;
1310 }
1311
1312 if (pending) {
1313 fr_assert(buffer_len >= pending->buffer_len);
1314 track = pending->track;
1315
1316 /*
1317 * Clear the destructor as we now own the
1318 * tracking entry.
1319 */
1320 talloc_set_destructor(pending, NULL);
1321
1322 /*
1323 * We received a conflicting packet while this
1324 * packet was pending. Discard this entry and
1325 * try to get another one.
1326 *
1327 * Note that the pending heap is *simple*. We
1328 * just track priority and recv_time. This means
1329 * it's fast, but also that it's hard to look up
1330 * random packets in the pending heap.
1331 */
1332 if (fr_time_neq(pending->recv_time, track->timestamp)) {
1333 DEBUG3("Discarding old packet");
1334 talloc_free(pending);
1335 goto redo;
1336 }
1337
1338 /*
1339 * We have a valid packet. Copy it over to the
1340 * caller, and return.
1341 */
1342 *packet_ctx = track;
1343 *leftover = 0;
1344 recv_time = *recv_time_p = pending->recv_time;
1345 client = track->client;
1346
1347 memcpy(buffer, pending->buffer, pending->buffer_len);
1348 packet_len = pending->buffer_len;
1349
1350 /*
1351 * Shouldn't be necessary, but what the heck...
1352 */
1353 memcpy(&address, track->address, sizeof(address));
1354 talloc_free(pending);
1355
1356 /*
1357 * Skip over all kinds of logic to find /
1358 * allocate the client, when we don't need to do
1359 * it any more.
1360 */
1361 goto have_client;
1362
1363 } else if (!connection && (inst->ipproto == IPPROTO_TCP)) {
1364 struct sockaddr_storage saremote;
1365 socklen_t salen;
1366
1367 salen = sizeof(saremote);
1368
1369 /*
1370 * We're a TCP socket but are NOT connected. We
1371 * must be the master socket. Accept the new
1372 * connection, and figure out src/dst IP/port.
1373 */
1374 accept_fd = accept(child->fd,
1375 (struct sockaddr *) &saremote, &salen);
1376
1377 /*
1378 * Couldn't open a NEW socket, but THIS ONE is
1379 * OK. So don't return -1.
1380 */
1381 if (accept_fd < 0) {
1382 DEBUG("proto_%s - failed to accept new socket: %s",
1383 inst->app->common.name, fr_syserror(errno));
1384 return 0;
1385 }
1386
1387 /*
1388 * Set the new descriptor to be non-blocking.
1389 */
1390 (void) fr_nonblock(accept_fd);
1391
1392#ifdef STATIC_ANALYZER
1393 saremote.ss_family = AF_INET; /* static analyzer doesn't know that accept() initializes this */
1394#endif
1395
1396 /*
1397 * Get IP addresses only if we have IP addresses.
1398 */
1399 if ((saremote.ss_family == AF_INET) || (saremote.ss_family == AF_INET6)) {
1400 memset(&address.socket, 0, sizeof(address.socket));
1401 (void) fr_ipaddr_from_sockaddr(&address.socket.inet.src_ipaddr, &address.socket.inet.src_port,
1402 &saremote, salen);
1403 salen = sizeof(saremote);
1404
1405 /*
1406 * @todo - only if the local listen address is "*".
1407 */
1408 (void) getsockname(accept_fd, (struct sockaddr *) &saremote, &salen);
1409 (void) fr_ipaddr_from_sockaddr(&address.socket.inet.dst_ipaddr, &address.socket.inet.dst_port,
1410 &saremote, salen);
1411 address.socket.type = (inst->ipproto == IPPROTO_TCP) ? SOCK_STREAM : SOCK_DGRAM;
1412 address.socket.fd = accept_fd;
1413 }
1414
1415 } else {
1416 fr_io_address_t *local_address;
1417
1418 /*
1419 * We're either not a TCP socket, or we are a
1420 * connected TCP socket. Just read it.
1421 */
1422do_read:
1423 local_address = &address;
1424
1425 /*
1426 * @todo - For connected TCP sockets which are
1427 * dynamically defined, the app_io read()
1428 * function should stop reading the socket if the
1429 * server is busy. That change puts TCP
1430 * backpressure on the client.
1431 *
1432 * @todo TLS - for TLS and dynamic sockets, do
1433 * the SSL setup here, but have a structure which
1434 * describes the TLS data and run THAT through
1435 * the dynamic client definition, instead of
1436 * using normal packets. Or, rely on the app_io
1437 * read() function to do all TLS work? Given
1438 * that some protocols have "starttls" beginning
1439 * after a clear-text exchange, it's likely best
1440 * to have yet another layer of trampoline
1441 * functions which do all of the TLS work.
1442 */
1443 packet_len = inst->app_io->read(child, (void **) &local_address, &recv_time,
1444 buffer, buffer_len, leftover);
1445 if (packet_len <= 0) {
1446 return packet_len;
1447 }
1448
1449 /*
1450 * Not allowed? Discard it. The priority()
1451 * function has done any complaining, if
1452 * necessary.
1453 */
1454 if (inst->app->priority) {
1455 value = inst->app->priority(inst->app_instance, buffer, packet_len);
1456 if (value <= 0) {
1457
1458 /*
1459 * @todo - unix sockets. We need to use
1460 * the "name" of the socket, in the
1461 * listener?
1462 */
1463 DEBUG2("proto_%s - ignoring packet from IP %pV. It is not configured as 'type = ...'",
1464 inst->app_io->common.name, fr_box_ipaddr(address.socket.inet.src_ipaddr));
1465 return 0;
1466 }
1467 priority = value;
1468 }
1469
1470 /*
1471 * If the connection is pending, pause reading of
1472 * more packets. If mod_write() accepts the
1473 * connection, it will resume reading.
1474 * Otherwise, it will close the socket without
1475 * resuming it.
1476 */
1477 if (connection &&
1478 (connection->client->state == PR_CLIENT_PENDING)) {
1479 fr_assert(!connection->paused);
1480
1481 connection->paused = true;
1482 (void) fr_event_filter_update(connection->el,
1483 child->fd,
1484 FR_EVENT_FILTER_IO, pause_read);
1485 }
1486 }
1487
1488 /*
1489 * Look up the client, unless we already have one (for a
1490 * connected socket).
1491 */
1492 if (!connection) {
1493 client = fr_trie_lookup_by_key(thread->trie,
1494 &address.socket.inet.src_ipaddr.addr, address.socket.inet.src_ipaddr.prefix);
1495 fr_assert(!client || !client->connection);
1496
1497 } else {
1498 client = connection->client;
1499
1500 /*
1501 * We don't care what the read function says
1502 * about address. We have it already.
1503 */
1504 address = *connection->address;
1505 }
1506
1507 /*
1508 * Negative cache entry. Drop the packet.
1509 */
1510 if (client && client->state == PR_CLIENT_NAK) {
1511 if (accept_fd >= 0) close(accept_fd);
1512 return 0;
1513 }
1514
1515 /*
1516 * If there's no client, try to pull one from the global
1517 * / static client list. Or if dynamic clients are
1518 * allowed, try to define a dynamic client.
1519 */
1520 if (!client) {
1521 fr_client_t *radclient = NULL;
1522 fr_io_client_state_t state;
1523 fr_ipaddr_t const *network = NULL;
1524
1525 /*
1526 * We MUST be the master socket.
1527 */
1528 fr_assert(!connection);
1529
1530 radclient = inst->app_io->client_find(thread->child, &address.socket.inet.src_ipaddr, inst->ipproto);
1531 if (radclient) {
1532 state = PR_CLIENT_STATIC;
1533
1534 /*
1535 * Make our own copy that we can modify it.
1536 */
1537 MEM(radclient = radclient_clone(thread, radclient));
1538 radclient->active = true;
1539
1540 } else if (inst->dynamic_clients) {
1541 if (inst->max_clients && (fr_heap_num_elements(thread->alive_clients) >= inst->max_clients)) {
1542 if (accept_fd < 0) {
1543 DEBUG("proto_%s - ignoring packet from client IP address %pV - "
1544 "too many dynamic clients are defined",
1545 inst->app_io->common.name, fr_box_ipaddr(address.socket.inet.src_ipaddr));
1546 } else {
1547 DEBUG("proto_%s - ignoring connection attempt from client IP address %pV "
1548 "- too many dynamic clients are defined",
1549 inst->app_io->common.name, fr_box_ipaddr(address.socket.inet.src_ipaddr));
1550 close(accept_fd);
1551 }
1552 return 0;
1553 }
1554
1555 /*
1556 * Look up the allowed networks.
1557 */
1558 network = fr_trie_lookup_by_key(inst->networks, &address.socket.inet.src_ipaddr.addr,
1559 address.socket.inet.src_ipaddr.prefix);
1560 if (!network) {
1561 DEBUG3("Source IP %pV is outside of 'allowed' network range",
1562 fr_box_ipaddr(address.socket.inet.src_ipaddr));
1563 goto ignore;
1564 }
1565
1566 /*
1567 * It exists, but it's a "deny" rule, ignore it.
1568 */
1569 if (network->af == AF_UNSPEC) {
1570 DEBUG3("Source IP %pV is forbidden by the 'deny' network range",
1571 fr_box_ipaddr(address.socket.inet.src_ipaddr));
1572 goto ignore;
1573 }
1574
1575 /*
1576 * Allocate our local radclient as a
1577 * placeholder for the dynamic client.
1578 */
1579 radclient = radclient_alloc(thread, inst->ipproto, &address);
1580 state = PR_CLIENT_PENDING;
1581
1582 } else {
1583 ignore:
1584 if (accept_fd < 0) {
1585 DEBUG("proto_%s - ignoring packet from unknown client IP address %pV",
1586 inst->app_io->common.name, fr_box_ipaddr(address.socket.inet.src_ipaddr));
1587 } else {
1588 DEBUG("proto_%s - ignoring connection attempt from unknown client IP address %pV",
1589 inst->app_io->common.name, fr_box_ipaddr(address.socket.inet.src_ipaddr));
1590 close(accept_fd);
1591 }
1592 return 0;
1593 }
1594
1595 MEM(client = client_alloc(thread, state, inst, thread, radclient, network));
1596 }
1597
1598have_client:
1599 fr_assert(client->state != PR_CLIENT_INVALID);
1600 fr_assert(client->state != PR_CLIENT_NAK);
1601
1602 /*
1603 * We've accepted a new connection. Go allocate it, and
1604 * let it read from the socket.
1605 */
1606 if (accept_fd >= 0) {
1607 if (!fr_io_connection_alloc(inst, thread, client, accept_fd, &address, NULL)) {
1608 DEBUG("Failed to allocate connection from client %s.", client->radclient->shortname);
1609 }
1610
1611 return 0;
1612 }
1613
1614 /*
1615 * No connected sockets, OR we are the connected socket.
1616 *
1617 * Track this packet and return it if necessary.
1618 */
1619 if (connection || !client->use_connected) {
1620 fr_io_track_t *to_free = NULL;
1621
1622 /*
1623 * Add the packet to the tracking table, if it's
1624 * not already there. Pending packets will be in
1625 * the tracking table, but won't be counted as
1626 * "live" packets.
1627 */
1628 if (!track) {
1629 bool is_dup = false;
1630
1631 track = fr_io_track_add(client, &address, buffer, packet_len, recv_time, &is_dup);
1632 if (!track) {
1633 DEBUG("Failed tracking packet from client %s - discarding it",
1634 client->radclient->shortname);
1635 return 0;
1636 }
1637
1638 /*
1639 * If there's a cached reply, just send that and don't do anything else.
1640 */
1641 if (is_dup) {
1642 fr_network_t *nr;
1643
1644 if (track->do_not_respond) {
1645 DEBUG("Ignoring retransmit from client %s - we are not responding to this request", client->radclient->shortname);
1646 return 0;
1647 }
1648
1649 if (!track->reply) {
1650 fr_assert(!track->finished);
1651 DEBUG("Ignoring retransmit from client %s - we are still processing the request", client->radclient->shortname);
1652 return 0;
1653 }
1654
1655 if (connection) {
1656 nr = connection->nr;
1657 } else {
1658 nr = thread->nr;
1659 }
1660
1661 /*
1662 * @todo - mark things up so that we know to keep 'track' around
1663 * until the packet is actually written to the network. OR, add
1664 * a network API so that the talloc_free() function can remove
1665 * the packet from the queue of packets to be retransmitted.
1666 *
1667 * Perhaps via having fr_network_listen_write() return a pointer
1668 * to the localized message, and then caching that in the tracking
1669 * structure.
1670 */
1671 DEBUG("Sending duplicate reply to client %s", client->radclient->shortname);
1672 fr_network_listen_write(nr, li, track->reply, track->reply_len,
1673 track, track->timestamp);
1674 return 0;
1675 }
1676
1677 /*
1678 * Got to free this if we don't process the packet.
1679 */
1680 to_free = track;
1681 }
1682
1683 /*
1684 * This is a pending dynamic client. See if we
1685 * have to either run the dynamic client code to
1686 * define the client, OR to push the packet onto
1687 * the pending queue for this client.
1688 */
1689 if (client->state == PR_CLIENT_PENDING) {
1690 /*
1691 * Track pending packets for the master
1692 * socket. Connected sockets are paused
1693 * as soon as they are defined, so we
1694 * won't be reading any more packets from
1695 * them.
1696 *
1697 * Since we don't have pending packets
1698 * for connected sockets, we don't need
1699 * to track pending packets.
1700 */
1701 if (!connection && inst->max_pending_packets && (thread->num_pending_packets >= inst->max_pending_packets)) {
1702 DEBUG("Too many pending packets for client %pV - discarding packet",
1703 fr_box_ipaddr(client->src_ipaddr));
1704
1705 done:
1706 talloc_free(to_free);
1707 return 0;
1708 }
1709
1710 /*
1711 * Allocate the pending packet structure.
1712 */
1713 pending = fr_io_pending_alloc(client, buffer, packet_len,
1714 track, priority);
1715 if (!pending) {
1716 DEBUG("Failed tracking packet from client %pV - discarding packet", fr_box_ipaddr(client->src_ipaddr));
1717 goto done;
1718 }
1719
1720 if (fr_heap_num_elements(client->pending) > 1) {
1721 DEBUG("Client %pV is still being dynamically defined. "
1722 "Caching this packet until the client has been defined",
1723 fr_box_ipaddr(client->src_ipaddr));
1724 return 0;
1725 }
1726
1727 /*
1728 * Tell this packet that it's defining a
1729 * dynamic client.
1730 */
1731 track->dynamic = recv_time;
1732 }
1733
1734 /*
1735 * Remove all cleanup timers for the client /
1736 * connection. It's still in use, so we don't
1737 * want to clean it up.
1738 */
1739 if (client->ev) {
1740 talloc_const_free(client->ev);
1741 client->ready_to_delete = false;
1742 }
1743
1744 /*
1745 * Return the packet.
1746 */
1747 *recv_time_p = track->timestamp;
1748 *packet_ctx = track;
1749 return packet_len;
1750 }
1751
1752 /*
1753 * This must be the main UDP socket which creates
1754 * connections.
1755 */
1756 fr_assert(inst->ipproto == IPPROTO_UDP);
1757
1758 /*
1759 * We're using connected sockets, but this socket isn't
1760 * connected. It must be the master socket. The master
1761 * can either be STATIC, DYNAMIC, or PENDING. Whatever
1762 * the state, the child socket will take care of handling
1763 * the packet. e.g. dynamic clients, etc.
1764 */
1765 {
1766 bool nak = false;
1767
1768 my_connection.address = &address;
1769
1770 pthread_mutex_lock(&client->mutex);
1771 connection = fr_hash_table_find(client->ht, &my_connection);
1772 if (connection) nak = (connection->client->state == PR_CLIENT_NAK);
1773 pthread_mutex_unlock(&client->mutex);
1774
1775 /*
1776 * The connection is in NAK state, ignore packets
1777 * for it.
1778 */
1779 if (nak) {
1780 DEBUG("Discarding packet to NAKed connection %s", connection->name);
1781 return 0;
1782 }
1783 }
1784
1785 /*
1786 * No existing connection, create one.
1787 */
1788 if (!connection) {
1789 connection = fr_io_connection_alloc(inst, thread, client, -1, &address, NULL);
1790 if (!connection) {
1791 DEBUG("Failed to allocate connection from client %s. Discarding packet.", client->radclient->shortname);
1792 return 0;
1793 }
1794 }
1795
1796 DEBUG("Sending packet to connection %s", connection->name);
1797
1798 /*
1799 * Inject the packet into the connected socket. It will
1800 * process the packet as if it came in from the network.
1801 *
1802 * @todo future - after creating the connection, put the
1803 * current packet into connection->pending, instead of
1804 * inject?, and then call fr_network_listen_read() from
1805 * the child's instantiation routine???
1806 *
1807 * @todo TCP - for ACCEPT sockets, we don't have a
1808 * packet, so don't do this. Instead, the connection
1809 * will take care of figuring out what to do.
1810 *
1811 * We don't need "to_free" after this, as it will be
1812 * tracked in the connected socket.
1813 */
1814 (void) fr_network_listen_inject(connection->nr, connection->listen,
1815 buffer, packet_len, recv_time);
1816 return 0;
1817}
1818
1819/** Inject a packet to a connection.
1820 *
1821 * Always called in the context of the network.
1822 */
1823static int mod_inject(fr_listen_t *li, uint8_t const *buffer, size_t buffer_len, fr_time_t recv_time)
1824{
1825 fr_io_instance_t const *inst;
1826 int priority;
1827 bool is_dup = false;
1828 fr_io_connection_t *connection;
1829 fr_io_pending_packet_t *pending;
1830 fr_io_track_t *track;
1831
1832 get_inst(li, &inst, NULL, &connection, NULL);
1833
1834 if (!connection) {
1835 DEBUG2("Received injected packet for an unconnected socket.");
1836 return -1;
1837 }
1838
1839 priority = inst->app->priority(inst, buffer, buffer_len);
1840 if (priority <= 0) {
1841 return -1;
1842 }
1843
1844 /*
1845 * Track this packet, because that's what mod_read expects.
1846 */
1847 track = fr_io_track_add(connection->client, connection->address,
1848 buffer, buffer_len, recv_time, &is_dup);
1849 if (!track) {
1850 DEBUG2("Failed injecting packet to tracking table");
1851 return -1;
1852 }
1853
1854 talloc_get_type_abort(track, fr_io_track_t);
1855
1856 /*
1857 * @todo future - what to do with duplicates?
1858 */
1859 fr_assert(!is_dup);
1860
1861 /*
1862 * Remember to restore this packet later.
1863 */
1864 pending = fr_io_pending_alloc(connection->client, buffer, buffer_len,
1865 track, priority);
1866 if (!pending) {
1867 DEBUG2("Failed injecting packet due to allocation error");
1868 return -1;
1869 }
1870
1871 return 0;
1872}
1873
1874/** Open a new listener
1875 *
1876 */
1877static int mod_open(fr_listen_t *li)
1878{
1879 fr_io_thread_t *thread;
1880 fr_io_instance_t const *inst;
1881
1882 thread = li->thread_instance;
1883 inst = li->app_io_instance;
1884
1885 if (inst->app_io->open(thread->child) < 0) return -1;
1886
1887 li->fd = thread->child->fd; /* copy this back up */
1888
1889 /*
1890 * Set the name of the socket.
1891 */
1892 if (!li->app_io->get_name) {
1893 li->name = li->app_io->common.name;
1894 } else {
1895 li->name = li->app_io->get_name(li);
1896 }
1897
1898 /*
1899 * Note that we're opening a child socket, so we don't
1900 * put it into the list of global listeners.
1901 */
1902
1903 return 0;
1904}
1905
1906
1907/** Set the event list for a new socket
1908 *
1909 * @param[in] li the listener
1910 * @param[in] el the event list
1911 * @param[in] nr context from the network side
1912 */
1913static void mod_event_list_set(fr_listen_t *li, fr_event_list_t *el, void *nr)
1914{
1915 fr_io_instance_t const *inst;
1916 fr_io_connection_t *connection;
1917 fr_io_thread_t *thread;
1918 fr_listen_t *child;
1919
1920 get_inst(li, &inst, &thread, &connection, &child);
1921
1922 /*
1923 * We're not doing IO, so there are no timers for
1924 * cleaning up packets, dynamic clients, or connections.
1925 */
1926 if (!inst->submodule) return;
1927
1928 if (inst->app_io->event_list_set) {
1929 inst->app_io->event_list_set(child, el, nr);
1930 }
1931
1932 /*
1933 * Set event list and network side for this socket.
1934 */
1935 if (!connection) {
1936 thread->el = el;
1937 thread->nr = nr;
1938
1939 } else {
1940 connection->el = el;
1941 connection->nr = nr;
1942 }
1943}
1944
1945
1946static void client_expiry_timer(fr_event_list_t *el, fr_time_t now, void *uctx)
1947{
1948 fr_io_client_t *client = talloc_get_type_abort(uctx, fr_io_client_t);
1949 fr_io_instance_t const *inst;
1950 fr_io_connection_t *connection;
1951 fr_time_delta_t delay;
1952 int connections;
1953
1954 /*
1955 * No event list? We don't need to expire the client.
1956 */
1957 if (!el) return;
1958
1959 // @todo - print out what we plan on doing next
1960 connection = client->connection;
1961 inst = client->inst;
1962
1963 fr_assert(client->state != PR_CLIENT_STATIC);
1964
1965 /*
1966 * Called from the read or write functions with
1967 * now==0, to signal that we have to *set* the timer.
1968 */
1969 if (fr_time_eq(now, fr_time_wrap(0))) {
1970 /*
1971 * The timer is already set, don't do anything.
1972 */
1973 if (client->ev) return;
1974
1975 switch (client->state) {
1976 case PR_CLIENT_CONNECTED:
1977 fr_assert(connection != NULL);
1978 FALL_THROUGH;
1979
1980 case PR_CLIENT_DYNAMIC:
1981 delay = inst->idle_timeout;
1982 if (fr_time_delta_ispos(client->radclient->limit.idle_timeout) &&
1983 (fr_time_delta_lt(client->radclient->limit.idle_timeout, inst->idle_timeout))) {
1984 delay = client->radclient->limit.idle_timeout;
1985 }
1986 break;
1987
1988 case PR_CLIENT_NAK:
1989 delay = inst->nak_lifetime;
1990 break;
1991
1992 default:
1993 fr_assert(0 == 1);
1994 return;
1995 }
1996
1997 DEBUG("TIMER - setting idle timeout to %pVs for connection from client %s", fr_box_time_delta(delay), client->radclient->shortname);
1998
1999 goto reset_timer;
2000 }
2001
2002 DEBUG("TIMER - checking status of client %s", client->radclient->shortname);
2003
2004 /*
2005 * It's a negative cache entry. Just delete it.
2006 */
2007 if (client->state == PR_CLIENT_NAK) {
2008 DEBUG("proto_%s - deleting NAK client %pV", inst->app_io->common.name, fr_box_ipaddr(client->src_ipaddr));
2009
2010 delete_client:
2011 fr_assert(client->packets == 0);
2012
2013 /*
2014 * It's a connected socket. Remove it from the
2015 * parents list of connections, and delete it.
2016 */
2017 if (connection) {
2018 pthread_mutex_lock(&connection->parent->mutex);
2019 if (connection->in_parent_hash) {
2020 connection->in_parent_hash = false;
2021 (void) fr_hash_table_delete(connection->parent->ht, connection);
2022 }
2023 pthread_mutex_unlock(&connection->parent->mutex);
2024
2025 /*
2026 * Mark the connection as dead, and tell
2027 * the network side to stop reading from
2028 * it.
2029 */
2030 connection->dead = true;
2031 fr_network_listen_read(connection->nr, connection->listen);
2032 return;
2033 }
2034
2035 talloc_free(client);
2036 return;
2037 }
2038
2039 /*
2040 * It's a dynamically defined client. If no one is using
2041 * it, clean it up after an idle timeout.
2042 */
2043 if ((client->state == PR_CLIENT_DYNAMIC) ||
2044 (client->state == PR_CLIENT_CONNECTED)) {
2045 if (client->packets > 0) {
2046 client->ready_to_delete = false;
2047 return;
2048 }
2049
2050 /*
2051 * No packets, check / set idle timeout.
2052 */
2053 goto idle_timeout;
2054 }
2055
2056 /*
2057 * The client is pending definition. It's either a
2058 * dynamic client which has timed out, OR it's a
2059 * "place-holder" client for connected sockets.
2060 */
2061 fr_assert(client->state == PR_CLIENT_PENDING);
2062
2063 /*
2064 * This is a dynamic client pending definition.
2065 * But it's taken too long to define, so we just
2066 * delete the client, and all packets for it. A
2067 * new packet will cause the dynamic definition
2068 * to be run again.
2069 */
2070 if (!client->use_connected) {
2071 if (!client->packets) {
2072 DEBUG("proto_%s - No packets are using unconnected socket %s", inst->app_io->common.name, connection->name);
2073 goto delete_client;
2074 }
2075
2076 /*
2077 * Tell the writer to NOT dynamically define the
2078 * client. We've run into a problem. Then,
2079 * return. The writer will take care of calling
2080 * us again when it notices that a PENDING client
2081 * is ready to delete.
2082 *
2083 * TBH... that shouldn't happen? We should rely
2084 * on the write to do this all of the time...
2085 */
2086 client->ready_to_delete = true;
2087 return;
2088 }
2089
2090 fr_assert(!connection);
2091
2092 /*
2093 * Find out how many connections are using this
2094 * client.
2095 */
2096 pthread_mutex_lock(&client->mutex);
2097 fr_assert(client->ht != NULL);
2098 connections = fr_hash_table_num_elements(client->ht);
2099 pthread_mutex_unlock(&client->mutex);
2100
2101 /*
2102 * No connections are using this client. If
2103 * we've passed the idle timeout, then just
2104 * delete it. Otherwise, set an idle timeout (as
2105 * above);
2106 */
2107 if (!connections) {
2108idle_timeout:
2109 /*
2110 * We didn't receive any packets during the
2111 * idle_timeout, just delete it.
2112 */
2113 if (client->ready_to_delete) {
2114 if (connection) {
2115 DEBUG("proto_%s - idle timeout for connection %s", inst->app_io->common.name, connection->name);
2116 } else {
2117 DEBUG("proto_%s - idle timeout for client %s", inst->app_io->common.name, client->radclient->shortname);
2118 }
2119 goto delete_client;
2120 }
2121
2122 /*
2123 * No packets and no idle timeout set, go set
2124 * idle timeut.
2125 */
2126 client->ready_to_delete = true;
2127 delay = inst->idle_timeout;
2128 goto reset_timer;
2129 }
2130
2131 /*
2132 * There are live sub-connections. Poll again after a
2133 * long period of time. Once all of the connections are
2134 * closed, we can then delete this client.
2135 *
2136 * @todo - maybe just leave it? we want to be able to
2137 * clean up this client after a while tho... especially
2138 * if the total number of clients is limited.
2139 */
2140 client->ready_to_delete = false;
2141 delay = inst->check_interval;
2142
2143reset_timer:
2144 if (fr_event_timer_in(client, el, &client->ev,
2145 delay, client_expiry_timer, client) < 0) {
2146 ERROR("proto_%s - Failed adding timeout for dynamic client %s. It will be permanent!",
2147 inst->app_io->common.name, client->radclient->shortname);
2148 return;
2149 }
2150
2151 return;
2152}
2153
2154
2155/*
2156 * Expire cached packets after cleanup_delay time
2157 */
2158static void packet_expiry_timer(fr_event_list_t *el, fr_time_t now, void *uctx)
2159{
2160 fr_io_track_t *track = talloc_get_type_abort(uctx, fr_io_track_t);
2161 fr_io_client_t *client = track->client;
2162 fr_io_instance_t const *inst = client->inst;
2163
2164 /*
2165 * Insert the timer if requested.
2166 *
2167 * On duplicates this also extends the expiry timer.
2168 */
2169 if (fr_time_eq(now, fr_time_wrap(0)) && !track->discard && inst->app_io->track_duplicates) {
2170 fr_assert(fr_time_delta_ispos(inst->cleanup_delay));
2171 fr_assert(track->do_not_respond || track->reply_len);
2172
2173 track->expires = fr_time_add(fr_time(), inst->cleanup_delay);
2174
2175 /*
2176 * if the timer succeeds, then "track"
2177 * will be cleaned up when the timer
2178 * fires.
2179 */
2180 if (fr_event_timer_at(track, el, &track->ev,
2181 track->expires, packet_expiry_timer, track) == 0) {
2182 DEBUG("proto_%s - cleaning up request in %.6fs", inst->app_io->common.name,
2183 fr_time_delta_unwrap(inst->cleanup_delay) / (double)NSEC);
2184 return;
2185 }
2186
2187 DEBUG("proto_%s - Failed adding cleanup_delay for packet. Discarding packet immediately",
2188 inst->app_io->common.name);
2189 }
2190
2191 /*
2192 * So that all cleanup paths can come here, not just the
2193 * timeout ones.
2194 */
2195 if (fr_time_neq(now, fr_time_wrap(0))) {
2196 DEBUG2("TIMER - proto_%s - cleanup delay", inst->app_io->common.name);
2197 } else {
2198 DEBUG2("proto_%s - cleaning up", inst->app_io->common.name);
2199 }
2200
2201 /*
2202 * Delete the tracking entry.
2203 */
2204 talloc_free(track);
2205
2206 /*
2207 * The client isn't dynamic, stop here.
2208 */
2209 if (client->state == PR_CLIENT_STATIC) return;
2210
2211 fr_assert(client->state != PR_CLIENT_NAK);
2212 fr_assert(client->state != PR_CLIENT_PENDING);
2213
2214 /*
2215 * If necessary, call the client expiry timer to clean up
2216 * the client.
2217 */
2218 if (client->packets == 0) {
2219 client_expiry_timer(el, now, client);
2220 }
2221}
2222
2223static ssize_t mod_write(fr_listen_t *li, void *packet_ctx, fr_time_t request_time,
2224 uint8_t *buffer, size_t buffer_len, size_t written)
2225{
2226 fr_io_instance_t const *inst;
2227 fr_io_thread_t *thread;
2228 fr_io_connection_t *connection;
2229 fr_io_track_t *track = talloc_get_type_abort(packet_ctx, fr_io_track_t);
2230 fr_io_client_t *client;
2231 fr_client_t *radclient;
2232 fr_listen_t *child;
2233 fr_event_list_t *el;
2234
2235 get_inst(li, &inst, &thread, &connection, &child);
2236
2237 client = track->client;
2238 if (connection) {
2239 el = connection->el;
2240 } else {
2241 el = thread->el;
2242 }
2243
2244 /*
2245 * A fully defined client means that we just send the reply.
2246 */
2247 if (client->state != PR_CLIENT_PENDING) {
2248 ssize_t packet_len;
2249
2250 track->finished = true;
2251
2252 /*
2253 * The request later received a conflicting
2254 * packet, so we discard this one.
2255 */
2256 if (fr_time_neq(track->timestamp, request_time) || track->discard) {
2257 fr_assert(track->packets > 0);
2258 track->packets--;
2259
2260 DEBUG3("Suppressing reply as we have a newer packet");
2261
2262 track->discard = true;
2263 goto setup_timer;
2264 }
2265
2266 /*
2267 * We have a NAK packet, or the request has timed
2268 * out, or it was discarded due to a conflicting
2269 * packet. We don't respond, but we do cache the
2270 * "do not respond" reply for a period of time.
2271 */
2272 if ((buffer_len == 1) || track->do_not_respond) {
2273 track->do_not_respond = true;
2274 goto setup_timer;
2275 }
2276
2277 /*
2278 * We have a real packet, write it to the network
2279 * via the underlying transport write.
2280 */
2281 packet_len = inst->app_io->write(child, track, request_time,
2282 buffer, buffer_len, written);
2283 if (packet_len <= 0) {
2284 track->discard = true;
2285 packet_expiry_timer(el, fr_time_wrap(0), track);
2286 return packet_len;
2287 }
2288
2289 /*
2290 * Only a partial write. The network code will
2291 * take care of calling us again, and we will set
2292 * the expiry timer at that point.
2293 */
2294 if ((size_t) packet_len < buffer_len) {
2295 return packet_len;
2296 }
2297
2298 /*
2299 * We're not tracking duplicates, so just expire
2300 * the packet now.
2301 */
2302 if (!inst->app_io->track_duplicates) goto setup_timer;
2303
2304 /*
2305 * Cache the reply packet if we're doing dedup.
2306 *
2307 * On resend duplicate reply, the reply is
2308 * already filled out. So we don't do that twice.
2309 */
2310 if (!track->reply) {
2311 MEM(track->reply = talloc_memdup(track, buffer, buffer_len));
2312 track->reply_len = buffer_len;
2313 }
2314
2315 /*
2316 * Set the timer to expire the packet.
2317 *
2318 * On dedup this also extends the timer.
2319 */
2320 setup_timer:
2321 packet_expiry_timer(el, fr_time_wrap(0), track);
2322 return buffer_len;
2323 }
2324
2325 /*
2326 * The client is pending, so we MUST have dynamic clients.
2327 *
2328 * If there's a connected socket and no dynamic clients, then the
2329 * client state is set to CONNECTED when the client is created.
2330 */
2331 fr_assert(inst->dynamic_clients);
2332 fr_assert(client->pending != NULL);
2333
2334 /*
2335 * The request has timed out trying to define the dynamic
2336 * client. Oops... try again.
2337 */
2338 if ((buffer_len == 1) && (*buffer == true)) {
2339 DEBUG("Request has timed out trying to define a new client. Trying again.");
2340 goto reread;
2341 }
2342
2343 /*
2344 * The dynamic client was NOT defined. Set it's state to
2345 * NAK, delete all pending packets, and close the
2346 * tracking table.
2347 */
2348 if (buffer_len == 1) {
2349 client->state = PR_CLIENT_NAK;
2350 TALLOC_FREE(client->pending);
2351 if (client->table) TALLOC_FREE(client->table);
2352 fr_assert(client->packets == 0);
2353
2354 /*
2355 * If we're a connected UDP socket, allocate a
2356 * new connection which is the place-holder for
2357 * the NAK. We will reject packets from from the
2358 * src/dst IP/port.
2359 *
2360 * The timer will take care of deleting the NAK
2361 * connection (which doesn't have any FDs
2362 * associated with it). The network side will
2363 * call mod_close() when the original connection
2364 * is done, which will then free that connection,
2365 * too.
2366 */
2367 if (connection && (inst->ipproto == IPPROTO_UDP)) {
2368 connection = fr_io_connection_alloc(inst, thread, client, -1, connection->address, connection);
2369 client_expiry_timer(el, fr_time_wrap(0), connection->client);
2370
2371 errno = ECONNREFUSED;
2372 return -1;
2373 }
2374
2375 /*
2376 * For connected TCP sockets, we just call the
2377 * expiry timer, which will close and free the
2378 * connection.
2379 */
2380 client_expiry_timer(el, fr_time_wrap(0), client);
2381 return buffer_len;
2382 }
2383
2384 fr_assert(buffer_len == sizeof(radclient));
2385
2386 memcpy(&radclient, buffer, sizeof(radclient));
2387
2388 if (!connection) {
2389 fr_ipaddr_t ipaddr;
2390
2391 /*
2392 * Check the encapsulating network against the
2393 * address that the user wants to use, but only
2394 * for unconnected sockets.
2395 */
2396 if (client->network.af != radclient->ipaddr.af) {
2397 DEBUG("Client IP address %pV IP version does not match the source network %pV of the packet.",
2398 fr_box_ipaddr(radclient->ipaddr), fr_box_ipaddr(client->network));
2399 goto error;
2400 }
2401
2402 /*
2403 * Network prefix is more restrictive than the one given
2404 * by the client... that's bad.
2405 */
2406 if (client->network.prefix > radclient->ipaddr.prefix) {
2407 DEBUG("Client IP address %pV is not within the prefix with the defined network %pV",
2408 fr_box_ipaddr(radclient->ipaddr), fr_box_ipaddr(client->network));
2409 goto error;
2410 }
2411
2412 ipaddr = radclient->ipaddr;
2413 fr_ipaddr_mask(&ipaddr, client->network.prefix);
2414 if (fr_ipaddr_cmp(&ipaddr, &client->network) != 0) {
2415 DEBUG("Client IP address %pV is not within the defined network %pV.",
2416 fr_box_ipaddr(radclient->ipaddr), fr_box_ipaddr(client->network));
2417 goto error;
2418 }
2419
2420 /*
2421 * We can't define dynamic clients as networks (for now).
2422 *
2423 * @todo - If we did allow it, we would have to remove
2424 * this client from the trie, update it's IP address, and
2425 * re-add it. We can PROBABLY do this if this client
2426 * isn't already connected, AND radclient->use_connected
2427 * is true. But that's for later...
2428 */
2429 if (((radclient->ipaddr.af == AF_INET) &&
2430 (radclient->ipaddr.prefix != 32)) ||
2431 ((radclient->ipaddr.af == AF_INET6) &&
2432 (radclient->ipaddr.prefix != 128))) {
2433 ERROR("Cannot define a dynamic client as a network");
2434
2435 error:
2436 talloc_free(radclient);
2437
2438 /*
2439 * Remove the pending client from the trie.
2440 */
2441 fr_assert(!connection);
2442 talloc_free(client);
2443 return buffer_len;
2444 }
2445 }
2446
2447 /*
2448 * The new client is mostly OK. Copy the various fields
2449 * over.
2450 */
2451#define COPY_FIELD(_x) client->radclient->_x = radclient->_x
2452#define DUP_FIELD(_x) client->radclient->_x = talloc_strdup(client->radclient, radclient->_x)
2453
2454 /*
2455 * Only these two fields are set. Other strings in
2456 * radclient are copies of these ones.
2457 */
2458 talloc_const_free(client->radclient->shortname);
2459 talloc_const_free(client->radclient->secret);
2460
2461 DUP_FIELD(longname);
2462 DUP_FIELD(shortname);
2463 DUP_FIELD(secret);
2464 DUP_FIELD(nas_type);
2465
2466 COPY_FIELD(ipaddr);
2467 COPY_FIELD(src_ipaddr);
2468 COPY_FIELD(require_message_authenticator);
2469 COPY_FIELD(require_message_authenticator_is_set);
2470 COPY_FIELD(limit_proxy_state);
2471 COPY_FIELD(limit_proxy_state_is_set);
2472 COPY_FIELD(use_connected);
2473 COPY_FIELD(cs);
2474
2475 // @todo - fill in other fields?
2476
2477 talloc_free(radclient);
2478
2479 radclient = client->radclient; /* laziness */
2480 radclient->server_cs = inst->server_cs;
2481 radclient->server = cf_section_name2(inst->server_cs);
2482
2483 /*
2484 * Re-parent the conf section used to build this client
2485 * so its lifetime is linked to the client
2486 */
2487 talloc_steal(radclient, radclient->cs);
2488
2489 /*
2490 * This is a connected socket, and it's just been
2491 * allowed. Go poke the network side to read from the
2492 * socket.
2493 */
2494 if (connection) {
2495 fr_assert(connection != NULL);
2496 fr_assert(connection->client == client);
2497 fr_assert(client->connection != NULL);
2498
2499 client->state = PR_CLIENT_CONNECTED;
2500
2501 /*
2502 * Connections can't spawn new connections.
2503 */
2504 client->use_connected = radclient->use_connected = false;
2505
2506 /*
2507 * If we were paused. resume reading from the
2508 * connection.
2509 *
2510 * Note that the event list doesn't like resuming
2511 * a connection that isn't paused. It just sets
2512 * the read function to NULL.
2513 */
2514 if (connection->paused) {
2515 (void) fr_event_filter_update(el, child->fd,
2516 FR_EVENT_FILTER_IO, resume_read);
2517 }
2518
2519 connection->parent->radclient->active = true;
2520 fr_assert(connection->parent->state == PR_CLIENT_PENDING);
2521 connection->parent->state = PR_CLIENT_DYNAMIC;
2522
2523 connection->parent->radclient->secret = talloc_strdup(connection->parent->radclient,
2524 radclient->secret);
2525 connection->parent->radclient->shortname = talloc_strdup(connection->parent->radclient,
2526 radclient->shortname);
2527
2528 /*
2529 * The client has been allowed.
2530 */
2531 client->state = PR_CLIENT_DYNAMIC;
2532 client->radclient->active = true;
2533 goto finish;
2534 }
2535
2536 fr_assert(connection == NULL);
2537 fr_assert(client->use_connected == false); /* we weren't sure until now */
2538
2539 /*
2540 * Disallow unsupported configurations.
2541 */
2542 if (radclient->use_connected && !inst->app_io->connection_set) {
2543 DEBUG("proto_%s - cannot use connected sockets as underlying 'transport = %s' does not support it.",
2544 inst->app_io->common.name, inst->submodule->module->exported->name);
2545 goto error;
2546 }
2547
2548
2549 /*
2550 * Dynamic clients can spawn new connections.
2551 */
2552 client->use_connected = radclient->use_connected;
2553
2554 /*
2555 * The admin has defined a client which uses connected
2556 * sockets. Go spawn it
2557 */
2558 if (client->use_connected) {
2559 fr_assert(connection == NULL);
2560
2561
2562 /*
2563 * Leave the state as PENDING. Each connection
2564 * will then cause a dynamic client to be
2565 * defined.
2566 */
2567 (void) pthread_mutex_init(&client->mutex, NULL);
2568 MEM(client->ht = fr_hash_table_alloc(client, connection_hash, connection_cmp, NULL));
2569
2570 } else {
2571 /*
2572 * The client has been allowed.
2573 */
2574 client->state = PR_CLIENT_DYNAMIC;
2575 client->radclient->active = true;
2576 }
2577
2578 /*
2579 * Add this client to the master socket, so that
2580 * mod_read() will see the pending client, pop the
2581 * pending packet, and process it.
2582 *
2583 */
2584 if (!thread->pending_clients) {
2585 MEM(thread->pending_clients = fr_heap_alloc(thread, pending_client_cmp,
2586 fr_io_client_t, pending_id, 0));
2587 }
2588
2589 fr_assert(!fr_heap_entry_inserted((client->pending_id)));
2590 (void) fr_heap_insert(&thread->pending_clients, client);
2591
2592finish:
2593 /*
2594 * Maybe we defined the client, but the original packet
2595 * timed out, so there's nothing more to do. In that case, set up the expiry timers.
2596 */
2597 if (client->packets == 0) {
2598 client_expiry_timer(el, fr_time_wrap(0), client);
2599 }
2600
2601reread:
2602 /*
2603 * If there are pending packets (and there should be at
2604 * least one), tell the network socket to call our read()
2605 * function again.
2606 */
2607 if (fr_heap_num_elements(client->pending) > 0) {
2608 if (connection) {
2609 fr_network_listen_read(connection->nr, connection->listen);
2610 } else {
2611 fr_network_listen_read(thread->nr, thread->listen);
2612 }
2613 }
2614
2615 return buffer_len;
2616}
2617
2618/** Close the socket.
2619 *
2620 */
2621static int mod_close(fr_listen_t *li)
2622{
2623 fr_io_instance_t const *inst;
2624 fr_io_connection_t *connection;
2625 fr_listen_t *child;
2626
2627 get_inst(li, &inst, NULL, &connection, &child);
2628
2629 if (inst->app_io->close) {
2630 int ret;
2631
2632 ret = inst->app_io->close(child);
2633 if (ret < 0) return ret;
2634 } else {
2635 close(child->fd);
2636// child->fd = -1;
2637 }
2638
2639 if (!connection) return 0;
2640
2641 /*
2642 * We allocated this, so we're responsible for closing
2643 * it.
2644 */
2645 DEBUG("Closing connection %s", connection->name);
2646 if (connection->client->pending) {
2647 TALLOC_FREE(connection->client->pending); /* for any pending packets */
2648 }
2649
2650 /*
2651 * Remove connection from parent hash table
2652 */
2653 pthread_mutex_lock(&connection->parent->mutex);
2654 if (connection->in_parent_hash) {
2655 connection->in_parent_hash = false;
2656 (void) fr_hash_table_delete(connection->parent->ht, connection);
2657 }
2658 pthread_mutex_unlock(&connection->parent->mutex);
2659
2660 /*
2661 * Clean up listener
2662 */
2663 fr_network_listen_delete(connection->nr, child);
2664
2665 talloc_free(connection->mi);
2666
2667 return 0;
2668}
2669
2670static int mod_instantiate(module_inst_ctx_t const *mctx)
2671{
2672 fr_io_instance_t *inst = mctx->mi->data;
2673 CONF_SECTION *conf = mctx->mi->conf;
2674
2675 inst->app_io = (fr_app_io_t const *) inst->submodule->exported;
2676 inst->app_io_conf = inst->submodule->conf;
2677 inst->app_io_instance = inst->submodule->data;
2678
2679 /*
2680 * If we're not tracking duplicates then we don't need a
2681 * cleanup delay.
2682 *
2683 * If we are tracking duplicates, then we must have a non-zero cleanup delay.
2684 */
2685 if (!inst->app_io->track_duplicates) {
2686 inst->cleanup_delay = fr_time_delta_wrap(0);
2687
2688 } else {
2689 FR_TIME_DELTA_BOUND_CHECK("cleanup_delay", inst->cleanup_delay, >=, fr_time_delta_from_sec(1));
2690
2691 if (!inst->app_io->track_create) {
2692 cf_log_err(inst->app_io_conf, "Internal error: 'track_duplicates' is set, but there is no 'track create' function");
2693 return -1;
2694 }
2695 }
2696
2697 /*
2698 * Get various information after bootstrapping the
2699 * application IO module.
2700 */
2701 if (inst->app_io->network_get) {
2702 inst->app_io->network_get(&inst->ipproto, &inst->dynamic_clients, &inst->networks, inst->app_io_instance);
2703 }
2704
2705 if ((inst->ipproto == IPPROTO_TCP) && !inst->app_io->connection_set) {
2706 cf_log_err(inst->app_io_conf, "Missing 'connection set' API for proto_%s", inst->app_io->common.name);
2707 return -1;
2708 }
2709
2710 /*
2711 * Ensure that the dynamic client sections exist
2712 */
2713 if (inst->dynamic_clients) {
2714 CONF_SECTION *server = cf_item_to_section(cf_parent(conf));
2715
2716 if (!cf_section_find(server, "new", "client")) {
2717 cf_log_err(conf, "Cannot use 'dynamic_clients = yes' as the virtual server has no 'new client { ... }' section defined.");
2718 return -1;
2719 }
2720
2721 if (!cf_section_find(server, "add", "client")) {
2722 cf_log_warn(conf, "No 'add client { ... }' section was defined.");
2723 }
2724
2725 if (!cf_section_find(server, "deny", "client")) {
2726 cf_log_warn(conf, "No 'deny client { ... }' section was defined.");
2727 }
2728 }
2729
2730 /*
2731 * Create a list of client modules.
2732 *
2733 * FIXME - Probably only want to do this for connected sockets?
2734 *
2735 * FIXME - We probably want write protect enabled?
2736 */
2737 inst->clients = module_list_alloc(inst, &module_list_type_thread_local, "clients", false);
2738 module_list_mask_set(inst->clients, MODULE_INSTANCE_BOOTSTRAPPED);
2739
2740 return 0;
2741}
2742
2743
2744static char const *mod_name(fr_listen_t *li)
2745{
2746 fr_io_thread_t *thread;
2747 fr_io_connection_t *connection;
2748 fr_listen_t *child;
2749 fr_io_instance_t const *inst;
2750
2751 get_inst(li, &inst, &thread, &connection, &child);
2752
2753 fr_assert(child != NULL);
2754 return child->app_io->get_name(child);
2755}
2756
2757/** Create a trie from arrays of allow / deny IP addresses
2758 *
2759 * @param ctx the talloc ctx
2760 * @param af the address family to allow
2761 * @param allow the array of IPs / networks to allow. MUST be talloc'd
2762 * @param deny the array of IPs / networks to deny. MAY be NULL, MUST be talloc'd
2763 * @return
2764 * - fr_trie_t on success
2765 * - NULL on error
2766 */
2767fr_trie_t *fr_master_io_network(TALLOC_CTX *ctx, int af, fr_ipaddr_t *allow, fr_ipaddr_t *deny)
2768{
2769 fr_trie_t *trie;
2770 size_t i, num;
2771
2772 MEM(trie = fr_trie_alloc(ctx, NULL, NULL));
2773
2774 num = talloc_array_length(allow);
2775 fr_assert(num > 0);
2776
2777 for (i = 0; i < num; i++) {
2778 fr_ipaddr_t *network;
2779
2780 /*
2781 * Can't add v4 networks to a v6 socket, or vice versa.
2782 */
2783 if (allow[i].af != af) {
2784 fr_strerror_printf("Address family in entry %zd - 'allow = %pV' "
2785 "does not match 'ipaddr'", i + 1, fr_box_ipaddr(allow[i]));
2786 talloc_free(trie);
2787 return NULL;
2788 }
2789
2790 /*
2791 * Duplicates are bad.
2792 */
2793 network = fr_trie_match_by_key(trie,
2794 &allow[i].addr, allow[i].prefix);
2795 if (network) {
2796 fr_strerror_printf("Cannot add duplicate entry 'allow = %pV'",
2797 fr_box_ipaddr(allow[i]));
2798 talloc_free(trie);
2799 return NULL;
2800 }
2801
2802 /*
2803 * Look for overlapping entries.
2804 * i.e. the networks MUST be disjoint.
2805 *
2806 * Note that this catches 192.168.1/24
2807 * followed by 192.168/16, but NOT the
2808 * other way around. The best fix is
2809 * likely to add a flag to
2810 * fr_trie_alloc() saying "we can only
2811 * have terminal fr_trie_user_t nodes"
2812 */
2813 network = fr_trie_lookup_by_key(trie,
2814 &allow[i].addr, allow[i].prefix);
2815 if (network && (network->prefix <= allow[i].prefix)) {
2816 fr_strerror_printf("Cannot add overlapping entry 'allow = %pV'", fr_box_ipaddr(allow[i]));
2817 fr_strerror_const("Entry is completely enclosed inside of a previously defined network.");
2818 talloc_free(trie);
2819 return NULL;
2820 }
2821
2822 /*
2823 * Insert the network into the trie.
2824 * Lookups will return the fr_ipaddr_t of
2825 * the network.
2826 */
2827 if (fr_trie_insert_by_key(trie,
2828 &allow[i].addr, allow[i].prefix,
2829 &allow[i]) < 0) {
2830 fr_strerror_printf("Failed adding 'allow = %pV' to tracking table", fr_box_ipaddr(allow[i]));
2831 talloc_free(trie);
2832 return NULL;
2833 }
2834 }
2835
2836 /*
2837 * And now check denied networks.
2838 */
2839 num = talloc_array_length(deny);
2840 if (!num) return trie;
2841
2842 /*
2843 * Since the default is to deny, you can only add
2844 * a "deny" inside of a previous "allow".
2845 */
2846 for (i = 0; i < num; i++) {
2847 fr_ipaddr_t *network;
2848
2849 /*
2850 * Can't add v4 networks to a v6 socket, or vice versa.
2851 */
2852 if (deny[i].af != af) {
2853 fr_strerror_printf("Address family in entry %zd - 'deny = %pV' "
2854 "does not match 'ipaddr'", i + 1, fr_box_ipaddr(deny[i]));
2855 talloc_free(trie);
2856 return NULL;
2857 }
2858
2859 /*
2860 * Duplicates are bad.
2861 */
2862 network = fr_trie_match_by_key(trie,
2863 &deny[i].addr, deny[i].prefix);
2864 if (network) {
2865 fr_strerror_printf("Cannot add duplicate entry 'deny = %pV'", fr_box_ipaddr(deny[i]));
2866 talloc_free(trie);
2867 return NULL;
2868 }
2869
2870 /*
2871 * A "deny" can only be within a previous "allow".
2872 */
2873 network = fr_trie_lookup_by_key(trie,
2874 &deny[i].addr, deny[i].prefix);
2875 if (!network) {
2876 fr_strerror_printf("The network in entry %zd - 'deny = %pV' is not "
2877 "contained within a previous 'allow'", i + 1, fr_box_ipaddr(deny[i]));
2878 talloc_free(trie);
2879 return NULL;
2880 }
2881
2882 /*
2883 * We hack the AF in "deny" rules. If
2884 * the lookup gets AF_UNSPEC, then we're
2885 * adding a "deny" inside of a "deny".
2886 */
2887 if (network->af != af) {
2888 fr_strerror_printf("The network in entry %zd - 'deny = %pV' is overlaps "
2889 "with another 'deny' rule", i + 1, fr_box_ipaddr(deny[i]));
2890 talloc_free(trie);
2891 return NULL;
2892 }
2893
2894 /*
2895 * Insert the network into the trie.
2896 * Lookups will return the fr_ipaddr_t of
2897 * the network.
2898 */
2899 if (fr_trie_insert_by_key(trie,
2900 &deny[i].addr, deny[i].prefix,
2901 &deny[i]) < 0) {
2902 fr_strerror_printf("Failed adding 'deny = %pV' to tracking table", fr_box_ipaddr(deny[i]));
2903 talloc_free(trie);
2904 return NULL;
2905 }
2906
2907 /*
2908 * Hack it to make it a deny rule.
2909 */
2910 deny[i].af = AF_UNSPEC;
2911 }
2912
2913 return trie;
2914}
2915
2916
2917int fr_io_listen_free(fr_listen_t *li)
2918{
2919 if (!li->thread_instance) return 0;
2920
2921 talloc_free(li->thread_instance);
2922 return 0;
2923}
2924
2925int fr_master_io_listen(fr_io_instance_t *inst, fr_schedule_t *sc,
2926 size_t default_message_size, size_t num_messages)
2927{
2928 fr_listen_t *li, *child;
2929 fr_io_thread_t *thread;
2930
2931 /*
2932 * No IO paths, so we don't initialize them.
2933 */
2934 if (!inst->app_io) {
2935 fr_assert(!inst->dynamic_clients);
2936 return 0;
2937 }
2938
2939 if (!inst->app_io->common.thread_inst_size) {
2940 fr_strerror_const("IO modules MUST set 'thread_inst_size' when using the master IO handler.");
2941 return -1;
2942 }
2943
2944 /*
2945 * Build the #fr_listen_t. This describes the complete
2946 * path data takes from the socket to the decoder and
2947 * back again.
2948 */
2949 MEM(li = talloc_zero(NULL, fr_listen_t));
2950 talloc_set_destructor(li, fr_io_listen_free);
2951
2952 /*
2953 * The first listener is the one for the application
2954 * (e.g. RADIUS). However, we mangle the IO path to
2955 * point to the master IO handler. That allows all of
2956 * the high-level work (dynamic client checking,
2957 * connected sockets, etc.) to be handled by the master
2958 * IO handler.
2959 *
2960 * This listener is then passed to the network code,
2961 * which calls our trampoline functions to do the actual
2962 * work.
2963 */
2964 li->app = inst->app;
2965 li->app_instance = inst->app_instance;
2966 li->server_cs = inst->server_cs;
2967
2968 /*
2969 * Set configurable parameters for message ring buffer.
2970 */
2971 li->default_message_size = default_message_size;
2972 li->num_messages = num_messages;
2973
2974 /*
2975 * Per-socket data lives here.
2976 */
2977 thread = talloc_zero(NULL, fr_io_thread_t);
2978 thread->listen = li;
2979 thread->sc = sc;
2980
2981 /*
2982 * Create the trie of clients for this socket.
2983 */
2984 MEM(thread->trie = fr_trie_alloc(thread, NULL, NULL));
2985
2986 if (inst->dynamic_clients) {
2987 MEM(thread->alive_clients = fr_heap_alloc(thread, alive_client_cmp,
2988 fr_io_client_t, alive_id, 0));
2989 }
2990
2991 /*
2992 * Set the listener to call our master trampoline function.
2993 */
2994 li->app_io = &fr_master_app_io;
2995 li->thread_instance = thread;
2996 li->app_io_instance = inst;
2997 li->track_duplicates = inst->app_io->track_duplicates;
2998
2999 /*
3000 * The child listener points to the *actual* IO path.
3001 *
3002 * We need to create a complete listener here (e.g.
3003 * RADIUS + RADIUS_UDP), because the underlying IO
3004 * functions expect to get passed a full listener.
3005 *
3006 * Once the network side calls us, we will call the child
3007 * listener to do the actual IO.
3008 */
3009 child = thread->child = talloc_zero(li, fr_listen_t);
3010 memcpy(child, li, sizeof(*child));
3011
3012 /*
3013 * Reset these fields to point to the IO instance data.
3014 */
3015 child->app_io = inst->app_io;
3016 child->track_duplicates = inst->app_io->track_duplicates;
3017
3018 if (child->app_io->common.thread_inst_size > 0) {
3019 child->thread_instance = talloc_zero_array(NULL, uint8_t,
3020 inst->app_io->common.thread_inst_size);
3021 talloc_set_destructor(child, fr_io_listen_free);
3022
3023 talloc_set_name(child->thread_instance, "proto_%s_thread_t",
3024 inst->app_io->common.name);
3025
3026 /*
3027 * This is "const", and the user can't
3028 * touch it. So we just reuse the same
3029 * configuration everywhere.
3030 */
3031 child->app_io_instance = inst->app_io_instance;
3032
3033 } else {
3034 child->thread_instance = inst->app_io_instance;
3035 child->app_io_instance = child->thread_instance;
3036 }
3037
3038 /*
3039 * Don't call connection_set() for the main socket. It's
3040 * not connected. Instead, tell the IO path to open the
3041 * socket for us.
3042 */
3043 if (inst->app_io->open(child) < 0) {
3044 cf_log_err(inst->app_io_conf, "Failed opening %s interface", inst->app_io->common.name);
3045 talloc_free(li);
3046 return -1;
3047 }
3048
3049 li->fd = child->fd; /* copy this back up */
3050
3051 if (!child->app_io->get_name) {
3052 child->name = child->app_io->common.name;
3053 } else {
3054 child->name = child->app_io->get_name(child);
3055 }
3056 li->name = child->name;
3057
3058 /*
3059 * Record which socket we opened.
3060 */
3061 if (child->app_io_addr) {
3062 fr_listen_t *other;
3063
3064 other = listen_find_any(thread->child);
3065 if (other) {
3066 ERROR("Failed opening %s - that port is already in use by another listener in server %s { ... } - %s",
3067 child->name, cf_section_name2(other->server_cs), other->name);
3068
3069 ERROR("got socket %d %d\n", child->app_io_addr->inet.src_port, other->app_io_addr->inet.src_port);
3070
3071 talloc_free(li);
3072 return -1;
3073 }
3074
3075 (void) listen_record(child);
3076 }
3077
3078 /*
3079 * Add the socket to the scheduler, where it might end up
3080 * in a different thread.
3081 */
3082 if (!fr_schedule_listen_add(sc, li)) {
3083 talloc_free(li);
3084 return -1;
3085 }
3086
3087 return 0;
3088}
3089
3090/*
3091 * Used to create a tracking structure for fr_network_sendto_worker()
3092 */
3093fr_io_track_t *fr_master_io_track_alloc(fr_listen_t *li, fr_client_t *radclient, fr_ipaddr_t const *src_ipaddr, int src_port,
3094 fr_ipaddr_t const *dst_ipaddr, int dst_port)
3095{
3096 fr_io_instance_t const *inst;
3097 fr_io_thread_t *thread;
3098 fr_io_connection_t *connection;
3099 fr_listen_t *child;
3100 fr_io_track_t *track;
3101 fr_io_client_t *client;
3102 fr_io_address_t *address;
3103 fr_listen_t *parent = talloc_parent(li);
3104
3105 (void) talloc_get_type_abort(parent, fr_listen_t);
3106
3107 get_inst(parent, &inst, &thread, &connection, &child);
3108
3109 fr_assert(child == li);
3110
3111 if (unlikely(!thread)) return NULL;
3112 fr_assert(thread->trie != NULL);
3113
3114 client = fr_trie_lookup_by_key(thread->trie, &src_ipaddr->addr, src_ipaddr->prefix);
3115 if (!client) {
3116 MEM(client = client_alloc(thread, PR_CLIENT_STATIC, inst, thread, radclient, NULL));
3117 }
3118
3119 MEM(track = talloc_zero_pooled_object(client, fr_io_track_t, 1, sizeof(*track) + sizeof(track->address) + 64));
3120 MEM(track->address = address = talloc_zero(track, fr_io_address_t));
3121 track->client = client;
3122
3123 address->socket.inet.src_port = src_port;
3124 address->socket.inet.dst_port = dst_port;
3125
3126 address->socket.inet.src_ipaddr = *src_ipaddr;
3127 address->socket.inet.dst_ipaddr = *dst_ipaddr;
3128 address->radclient = radclient;
3129
3130 return track;
3131}
3132
3133
3134fr_app_io_t fr_master_app_io = {
3135 .common = {
3136 .magic = MODULE_MAGIC_INIT,
3137 .name = "radius_master_io",
3138
3139 .instantiate = mod_instantiate,
3140 },
3141 .default_message_size = 4096,
3142 .track_duplicates = true,
3143
3144 .read = mod_read,
3145 .write = mod_write,
3146 .inject = mod_inject,
3147
3148 .open = mod_open,
3149 .close = mod_close,
3150 .event_list_set = mod_event_list_set,
3151 .get_name = mod_name,
3152};
buffer
static int const char char buffer[256]
Definition acutest.h:576
fr_app_io_t::common
module_t common
Common fields to all loadable modules.
Definition app_io.h:34
fr_app_io_t::track_create
fr_io_track_create_t track_create
create a tracking structure
Definition app_io.h:64
fr_app_io_t::track_duplicates
bool track_duplicates
track duplicate packets
Definition app_io.h:41
fr_app_io_t::get_name
fr_io_name_t get_name
get the socket name
Definition app_io.h:70
fr_app_io_t::track_compare
fr_io_track_cmp_t track_compare
compare two tracking structures
Definition app_io.h:65
fr_app_io_t
Public structure describing an I/O path for a protocol.
Definition app_io.h:33
FALL_THROUGH
#define FALL_THROUGH
clang 10 doesn't recognised the FALL-THROUGH comment anymore
Definition build.h:322
CMP_PREFER_SMALLER
#define CMP_PREFER_SMALLER(_a, _b)
Evaluates to +1 for a > b, and -1 for a < b.
Definition build.h:104
CMP_PREFER_LARGER
#define CMP_PREFER_LARGER(_a, _b)
Evaluates to -1 for a > b, and +1 for a < b.
Definition build.h:108
CMP_RETURN
#define CMP_RETURN(_a, _b, _field)
Return if the comparison is not 0 (is unequal)
Definition build.h:121
CMP
#define CMP(_a, _b)
Same as CMP_PREFER_SMALLER use when you don't really care about ordering, you just want an ordering.
Definition build.h:112
unlikely
#define unlikely(_x)
Definition build.h:381
UNUSED
#define UNUSED
Definition build.h:315
FR_TIME_DELTA_BOUND_CHECK
#define FR_TIME_DELTA_BOUND_CHECK(_name, _var, _op, _bound)
Definition cf_parse.h:513
cf_section
A section grouping multiple CONF_PAIR.
Definition cf_priv.h:101
cf_section_name2
char const * cf_section_name2(CONF_SECTION const *cs)
Return the second identifier of a CONF_SECTION.
Definition cf_util.c:1185
cf_section_name1
char const * cf_section_name1(CONF_SECTION const *cs)
Return the second identifier of a CONF_SECTION.
Definition cf_util.c:1171
cf_section_find
CONF_SECTION * cf_section_find(CONF_SECTION const *cs, char const *name1, char const *name2)
Find a CONF_SECTION with name1 and optionally name2.
Definition cf_util.c:1028
cf_item_to_section
CONF_SECTION * cf_item_to_section(CONF_ITEM const *ci)
Cast a CONF_ITEM to a CONF_SECTION.
Definition cf_util.c:684
cf_section_dup
CONF_SECTION * cf_section_dup(TALLOC_CTX *ctx, CONF_SECTION *parent, CONF_SECTION const *cs, char const *name1, char const *name2, bool copy_meta)
Duplicate a configuration section.
Definition cf_util.c:928
cf_log_err
#define cf_log_err(_cf, _fmt,...)
Definition cf_util.h:289
cf_parent
#define cf_parent(_cf)
Definition cf_util.h:101
cf_log_warn
#define cf_log_warn(_cf, _fmt,...)
Definition cf_util.h:290
PRIORITY_NORMAL
#define PRIORITY_NORMAL
Definition channel.h:151
MEM
#define MEM(x)
Definition debug.h:36
ERROR
#define ERROR(fmt,...)
Definition dhcpclient.c:41
DEBUG
#define DEBUG(fmt,...)
Definition dhcpclient.c:39
value
Test enumeration values.
Definition dict_test.h:92
MODULE_MAGIC_INIT
#define MODULE_MAGIC_INIT
Stop people using different module/library/server versions together.
Definition dl_module.h:63
FR_EVENT_FILTER_IO
@ FR_EVENT_FILTER_IO
Combined filter for read/write functions/.
Definition event.h:62
fr_event_filter_update
#define fr_event_filter_update(...)
Definition event.h:224
FR_EVENT_RESUME
#define FR_EVENT_RESUME(_s, _f)
Re-add the filter for a func from kevent.
Definition event.h:110
FR_EVENT_SUSPEND
#define FR_EVENT_SUSPEND(_s, _f)
Temporarily remove the filter for a func from kevent.
Definition event.h:94
fr_event_timer_at
#define fr_event_timer_at(...)
Definition event.h:250
fr_event_timer_in
#define fr_event_timer_in(...)
Definition event.h:255
fr_event_io_func_t
Callbacks for the FR_EVENT_FILTER_IO filter.
Definition event.h:173
fr_event_update_t
Structure describing a modification to a filter's state.
Definition event.h:75
fr_hash_table_find
void * fr_hash_table_find(fr_hash_table_t *ht, void const *data)
Find data in a hash table.
Definition hash.c:429
fr_hash_update
uint32_t fr_hash_update(void const *data, size_t size, uint32_t hash)
Definition hash.c:846
fr_hash
uint32_t fr_hash(void const *data, size_t size)
Definition hash.c:812
fr_hash_table_insert
bool fr_hash_table_insert(fr_hash_table_t *ht, void const *data)
Insert data into a hash table.
Definition hash.c:468
fr_hash_table_delete
bool fr_hash_table_delete(fr_hash_table_t *ht, void const *data)
Remove and free data (if a free function was specified)
Definition hash.c:594
fr_hash_table_num_elements
uint32_t fr_hash_table_num_elements(fr_hash_table_t *ht)
Definition hash.c:610
fr_hash_table_s
Definition hash.c:50
fr_hash_table_alloc
#define fr_hash_table_alloc(_ctx, _hash_node, _cmp_node, _free_node)
Definition hash.h:58
fr_heap_insert
int fr_heap_insert(fr_heap_t **hp, void *data)
Insert a new element into the heap.
Definition heap.c:146
fr_heap_pop
void * fr_heap_pop(fr_heap_t **hp)
Remove a node from the heap.
Definition heap.c:322
fr_heap_extract
int fr_heap_extract(fr_heap_t **hp, void *data)
Remove a node from the heap.
Definition heap.c:239
fr_heap_index_t
unsigned int fr_heap_index_t
Definition heap.h:80
fr_heap_peek
static void * fr_heap_peek(fr_heap_t *h)
Return the item from the top of the heap but don't pop it.
Definition heap.h:136
fr_heap_alloc
#define fr_heap_alloc(_ctx, _cmp, _type, _field, _init)
Creates a heap that can be used with non-talloced elements.
Definition heap.h:100
fr_heap_entry_inserted
static bool fr_heap_entry_inserted(fr_heap_index_t heap_idx)
Check if an entry is inserted into a heap.
Definition heap.h:124
fr_heap_num_elements
static unsigned int fr_heap_num_elements(fr_heap_t *h)
Return the number of elements in the heap.
Definition heap.h:179
FR_HEAP_INDEX_INVALID
#define FR_HEAP_INDEX_INVALID
Definition heap.h:83
fr_heap_t
The main heap structure.
Definition heap.h:66
fr_ipaddr_from_sockaddr
int fr_ipaddr_from_sockaddr(fr_ipaddr_t *ipaddr, uint16_t *port, struct sockaddr_storage const *sa, socklen_t salen)
Convert sockaddr to our internal ip address representation.
Definition inet.c:1441
fr_ipaddr_to_sockaddr
int fr_ipaddr_to_sockaddr(struct sockaddr_storage *sa, socklen_t *salen, fr_ipaddr_t const *ipaddr, uint16_t port)
Convert our internal ip address representation to a sockaddr.
Definition inet.c:1392
fr_ipaddr_cmp
int8_t fr_ipaddr_cmp(fr_ipaddr_t const *a, fr_ipaddr_t const *b)
Compare two ip addresses.
Definition inet.c:1346
fr_ipaddr_mask
void fr_ipaddr_mask(fr_ipaddr_t *addr, uint8_t prefix)
Zeroes out the host portion of an fr_ipaddr_t.
Definition inet.c:217
fr_ipaddr_t::prefix
uint8_t prefix
Prefix length - Between 0-32 for IPv4 and 0-128 for IPv6.
Definition inet.h:69
fr_ipaddr_t::af
int af
Address family.
Definition inet.h:64
fr_ipaddr_t::addr
union fr_ipaddr_t::@130 addr
fr_ipaddr_t
IPv4/6 prefix.
Definition merged_model.c:272
fr_io_address_t::socket
fr_socket_t socket
src/dst ip and port.
Definition base.h:336
fr_io_address_t::radclient
fr_client_t const * radclient
old-style client definition
Definition base.h:338
fr_io_address_t
Definition base.h:335
fr_listen::num_messages
size_t num_messages
for the message ring buffer
Definition listen.h:52
fr_listen::name
char const * name
printable name for this socket - set by open
Definition listen.h:29
fr_listen::track_duplicates
bool track_duplicates
do we track duplicate packets?
Definition listen.h:43
fr_listen::app_io_addr
fr_socket_t * app_io_addr
for tracking duplicate sockets
Definition listen.h:35
fr_listen::app_instance
void const * app_instance
Definition listen.h:38
fr_listen::default_message_size
size_t default_message_size
copied from app_io, but may be changed
Definition listen.h:51
fr_listen::connected
bool connected
is this for a connected socket?
Definition listen.h:42
fr_listen::app
fr_app_t const * app
Definition listen.h:37
fr_listen::app_io_instance
void const * app_io_instance
I/O path configuration context.
Definition listen.h:32
fr_listen::server_cs
CONF_SECTION * server_cs
CONF_SECTION of the server.
Definition listen.h:40
fr_listen::thread_instance
void * thread_instance
thread / socket context
Definition listen.h:33
fr_listen::fd
int fd
file descriptor for this socket - set by open
Definition listen.h:28
fr_listen::app_io
fr_app_io_t const * app_io
I/O path functions.
Definition listen.h:31
fr_listen
Definition listen.h:25
fr_network_listen_delete
int fr_network_listen_delete(fr_network_t *nr, fr_listen_t *li)
Delete a socket from a network.
Definition network.c:259
fr_network_listen_inject
int fr_network_listen_inject(fr_network_t *nr, fr_listen_t *li, uint8_t const *packet, size_t packet_len, fr_time_t recv_time)
Inject a packet for a listener to read.
Definition network.c:398
fr_network_listen_read
void fr_network_listen_read(fr_network_t *nr, fr_listen_t *li)
Signal the network to read from a listener.
Definition network.c:324
fr_network_listen_write
void fr_network_listen_write(fr_network_t *nr, fr_listen_t *li, uint8_t const *packet, size_t packet_len, void *packet_ctx, fr_time_t request_time)
Inject a packet for a listener to write.
Definition network.c:350
fr_network_s
Definition network.c:112
fr_client_s::server
char const * server
Name of the virtual server client is associated with.
Definition client.h:129
fr_client_s::ipaddr
fr_ipaddr_t ipaddr
IPv4/IPv6 address of the host.
Definition client.h:83
fr_client_s::secret
char const * secret
Secret PSK.
Definition client.h:90
fr_client_s::active
bool active
for dynamic clients
Definition client.h:119
fr_client_s::src_ipaddr
fr_ipaddr_t src_ipaddr
IPv4/IPv6 address to send responses from (family must match ipaddr).
Definition client.h:84
fr_client_s::nas_type
char const * nas_type
Type of client (arbitrary).
Definition client.h:127
fr_client_s::proto
int proto
Protocol number.
Definition client.h:143
fr_client_s::cs
CONF_SECTION * cs
CONF_SECTION that was parsed to generate the client.
Definition client.h:134
fr_client_s::dynamic
bool dynamic
Whether the client was dynamically defined.
Definition client.h:118
fr_client_s::longname
char const * longname
Client identifier.
Definition client.h:87
fr_client_s::limit
fr_socket_limit_t limit
Connections per client (TCP clients only).
Definition client.h:144
fr_client_s::shortname
char const * shortname
Client nickname.
Definition client.h:88
fr_client_s::use_connected
bool use_connected
do we use connected sockets for this client
Definition client.h:120
fr_client_s::server_cs
CONF_SECTION * server_cs
Virtual server that the client is associated with.
Definition client.h:130
fr_client_s
Describes a host allowed to send packets to the server.
Definition client.h:80
DEBUG3
#define DEBUG3(_fmt,...)
Definition log.h:266
talloc_free
talloc_free(reap)
fr_event_timer_delete
int fr_event_timer_delete(fr_event_timer_t const **ev_p)
Delete a timer event from the event list.
Definition event.c:1611
fr_event_list
Stores all information relating to an event list.
Definition event.c:411
fr_event_timer
A timer event.
Definition event.c:102
fr_io_thread_t::child
fr_listen_t * child
The child (app_io) IO path.
Definition master.c:43
fr_io_connection_s::nr
fr_network_t * nr
network for this connection
Definition master.c:152
alive_client_cmp
static int8_t alive_client_cmp(void const *one, void const *two)
Definition master.c:1246
fr_io_client_s::in_trie
bool in_trie
is the client in the trie?
Definition master.c:111
fr_io_connection_s::paused
bool paused
event filter doesn't like resuming something that isn't paused
Definition master.c:149
fr_io_connection_s::in_parent_hash
bool in_parent_hash
for tracking thread issues
Definition master.c:150
radclient_clone
static fr_client_t * radclient_clone(TALLOC_CTX *ctx, fr_client_t const *parent)
Definition master.c:372
mod_read
static ssize_t mod_read(fr_listen_t *li, void **packet_ctx, fr_time_t *recv_time_p, uint8_t *buffer, size_t buffer_len, size_t *leftover)
Implement 99% of the read routines.
Definition master.c:1258
fr_io_connection_s::packets
int packets
number of packets using this connection
Definition master.c:140
client_expiry_timer
static void client_expiry_timer(fr_event_list_t *el, fr_time_t now, void *uctx)
Definition master.c:1946
fr_io_thread_t::num_pending_packets
uint32_t num_pending_packets
number of pending packets
Definition master.c:48
DUP_FIELD
#define DUP_FIELD(_x)
track_dedup_free
static int track_dedup_free(fr_io_track_t *track)
Definition master.c:177
fr_io_client_s::table
fr_rb_tree_t * table
tracking table for packets
Definition master.c:116
fr_io_pending_packet_t::recv_time
fr_time_t recv_time
Definition master.c:58
pending_packet_cmp
static int8_t pending_packet_cmp(void const *one, void const *two)
Definition master.c:193
fr_io_thread_t::pending_clients
fr_heap_t * pending_clients
heap of pending clients
Definition master.c:39
fr_io_track_add
static fr_io_track_t * fr_io_track_add(fr_io_client_t *client, fr_io_address_t *address, uint8_t const *packet, size_t packet_len, fr_time_t recv_time, bool *is_dup)
Definition master.c:1031
fr_io_client_s::ready_to_delete
bool ready_to_delete
are we ready to delete this client?
Definition master.c:110
fr_io_pending_alloc
static fr_io_pending_packet_t * fr_io_pending_alloc(fr_io_client_t *client, uint8_t const *buffer, size_t packet_len, fr_io_track_t *track, int priority)
Definition master.c:1201
_client_live_free
static int _client_live_free(fr_io_client_t *client)
Definition master.c:920
fr_io_client_s::pending_id
fr_heap_index_t pending_id
for pending clients
Definition master.c:106
pending_free
static int pending_free(fr_io_pending_packet_t *pending)
Definition master.c:1177
fr_io_client_s::use_connected
bool use_connected
does this client allow connected sub-sockets?
Definition master.c:109
fr_io_connection_s::client
fr_io_client_t * client
our local client (pending or connected).
Definition master.c:144
track_free
static int track_free(fr_io_track_t *track)
Definition master.c:165
fr_master_app_io
fr_app_io_t fr_master_app_io
Definition master.c:3134
fr_io_thread_t::listen
fr_listen_t * listen
The master IO path.
Definition master.c:42
pending_client_cmp
static int8_t pending_client_cmp(void const *one, void const *two)
Definition master.c:223
fr_master_io_track_alloc
fr_io_track_t * fr_master_io_track_alloc(fr_listen_t *li, fr_client_t *radclient, fr_ipaddr_t const *src_ipaddr, int src_port, fr_ipaddr_t const *dst_ipaddr, int dst_port)
Definition master.c:3093
fr_io_connection_s::address
fr_io_address_t * address
full information about the connection.
Definition master.c:141
address_cmp
static int8_t address_cmp(void const *one, void const *two)
Definition master.c:241
fr_io_client_s::ev
fr_event_timer_t const * ev
when we clean up the client
Definition master.c:115
fr_io_connection_s::child
fr_listen_t * child
child listener (app_io) for this socket
Definition master.c:143
fr_io_connection_s::listen
fr_listen_t * listen
master listener for this socket
Definition master.c:142
packet_expiry_timer
static void packet_expiry_timer(fr_event_list_t *el, fr_time_t now, void *uctx)
Definition master.c:2158
fr_io_thread_t::nr
fr_network_t * nr
network for the master socket
Definition master.c:36
fr_master_io_network
fr_trie_t * fr_master_io_network(TALLOC_CTX *ctx, int af, fr_ipaddr_t *allow, fr_ipaddr_t *deny)
Create a trie from arrays of allow / deny IP addresses.
Definition master.c:2767
pending_packet_pop
static fr_io_pending_packet_t * pending_packet_pop(fr_io_thread_t *thread)
Definition master.c:336
fr_io_client_s::network
fr_ipaddr_t network
network for dynamic clients
Definition master.c:102
mod_event_list_set
static void mod_event_list_set(fr_listen_t *li, fr_event_list_t *el, void *nr)
Set the event list for a new socket.
Definition master.c:1913
mod_open
static int mod_open(fr_listen_t *li)
Open a new listener.
Definition master.c:1877
fr_io_client_s::mutex
pthread_mutex_t mutex
for parent / child signaling
Definition master.c:121
fr_io_pending_packet_t::heap_id
fr_heap_index_t heap_id
Definition master.c:56
client_alloc
static fr_io_client_t * client_alloc(TALLOC_CTX *ctx, fr_io_client_state_t state, fr_io_instance_t const *inst, fr_io_thread_t *thread, fr_client_t *radclient, fr_ipaddr_t const *network)
Definition master.c:934
fr_io_client_s::inst
fr_io_instance_t const * inst
parent instance for master IO handler
Definition master.c:113
COPY_FIELD
#define COPY_FIELD(_x)
fr_io_thread_t::trie
fr_trie_t * trie
trie of clients
Definition master.c:38
fr_io_client_state_t
fr_io_client_state_t
Client states.
Definition master.c:68
PR_CLIENT_DYNAMIC
@ PR_CLIENT_DYNAMIC
dynamically defined client
Definition master.c:72
PR_CLIENT_CONNECTED
@ PR_CLIENT_CONNECTED
dynamically defined client in a connected socket
Definition master.c:73
PR_CLIENT_PENDING
@ PR_CLIENT_PENDING
dynamic client pending definition
Definition master.c:74
PR_CLIENT_INVALID
@ PR_CLIENT_INVALID
Definition master.c:69
PR_CLIENT_NAK
@ PR_CLIENT_NAK
negative cache entry
Definition master.c:71
PR_CLIENT_STATIC
@ PR_CLIENT_STATIC
static / global clients
Definition master.c:70
get_inst
static void get_inst(fr_listen_t *li, fr_io_instance_t const **inst, fr_io_thread_t **thread, fr_io_connection_t **connection, fr_listen_t **child)
Definition master.c:872
pause_read
static fr_event_update_t pause_read[]
Definition master.c:155
track_connected_cmp
static int8_t track_connected_cmp(void const *one, void const *two)
Definition master.c:310
fr_io_thread_t::alive_clients
fr_heap_t * alive_clients
heap of active clients
Definition master.c:40
fr_io_thread_t::sc
fr_schedule_t * sc
the scheduler
Definition master.c:44
fr_io_connection_alloc
static fr_io_connection_t * fr_io_connection_alloc(fr_io_instance_t const *inst, fr_io_thread_t *thread, fr_io_client_t *client, int fd, fr_io_address_t *address, fr_io_connection_t *nak)
Create a new connection.
Definition master.c:480
fr_io_client_s::addresses
fr_hash_table_t * addresses
list of src/dst addresses used by this client
Definition master.c:119
fr_master_io_listen
int fr_master_io_listen(fr_io_instance_t *inst, fr_schedule_t *sc, size_t default_message_size, size_t num_messages)
Definition master.c:2925
connection_free
static int connection_free(fr_io_connection_t *connection)
Definition master.c:465
fr_io_listen_free
int fr_io_listen_free(fr_listen_t *li)
Definition master.c:2917
fr_io_connection_s::name
char const * name
taken from proto_FOO_TRANSPORT
Definition master.c:139
fr_io_client_s::alive_id
fr_heap_index_t alive_id
for all clients
Definition master.c:107
fr_io_connection_s::el
fr_event_list_t * el
event list for this connection
Definition master.c:151
fr_io_client_s::state
fr_io_client_state_t state
state of this client
Definition master.c:100
fr_io_client_s::packets
int packets
number of packets using this client
Definition master.c:105
mod_write
static ssize_t mod_write(fr_listen_t *li, void *packet_ctx, fr_time_t request_time, uint8_t *buffer, size_t buffer_len, size_t written)
Definition master.c:2223
fr_io_connection_s::dead
bool dead
roundabout way to get the network side to close a socket
Definition master.c:148
fr_io_thread_t::el
fr_event_list_t * el
event list, for the master socket.
Definition master.c:35
fr_io_thread_t::client_id
uint64_t client_id
Unique client identifier.
Definition master.c:49
fr_io_client_s::thread
fr_io_thread_t * thread
Definition master.c:114
mod_name
static char const * mod_name(fr_listen_t *li)
Definition master.c:2744
fr_io_connection_s::mi
module_instance_t * mi
for submodule
Definition master.c:146
_client_free
static int _client_free(fr_io_client_t *client)
Definition master.c:458
mod_close
static int mod_close(fr_listen_t *li)
Close the socket.
Definition master.c:2621
connection_hash
static uint32_t connection_hash(void const *ctx)
Definition master.c:257
fr_io_client_s::connection
fr_io_connection_t * connection
parent connection
Definition master.c:99
fr_io_client_s::pending
fr_heap_t * pending
pending packets for this client
Definition master.c:118
count_connections
static int count_connections(UNUSED uint8_t const *key, UNUSED size_t keylen, void *data, void *ctx)
Count the number of connections used by active clients.
Definition master.c:436
connection_cmp
static int8_t connection_cmp(void const *one, void const *two)
Definition master.c:271
track_cmp
static int8_t track_cmp(void const *one, void const *two)
Definition master.c:280
fr_io_client_s::ht
fr_hash_table_t * ht
for tracking connected sockets
Definition master.c:122
mod_instantiate
static int mod_instantiate(module_inst_ctx_t const *mctx)
Definition master.c:2670
fr_io_pending_packet_t::track
fr_io_track_t * track
Definition master.c:59
fr_io_client_s::radclient
fr_client_t * radclient
old-style definition of this client
Definition master.c:103
fr_io_client_s::src_ipaddr
fr_ipaddr_t src_ipaddr
packets come from this address
Definition master.c:101
resume_read
static fr_event_update_t resume_read[]
Definition master.c:160
fr_io_thread_t::num_connections
uint32_t num_connections
number of dynamic connections
Definition master.c:47
fr_io_connection_s::parent
fr_io_client_t * parent
points to the parent client.
Definition master.c:145
radclient_alloc
static fr_client_t * radclient_alloc(TALLOC_CTX *ctx, int ipproto, fr_io_address_t *address)
Definition master.c:892
mod_inject
static int mod_inject(fr_listen_t *li, uint8_t const *buffer, size_t buffer_len, fr_time_t recv_time)
Inject a packet to a connection.
Definition master.c:1823
fr_io_client_s
Client definitions for master IO.
Definition master.c:98
fr_io_connection_s
Track a connection.
Definition master.c:138
fr_io_pending_packet_t
A saved packet.
Definition master.c:55
fr_io_thread_t
Definition master.c:34
fr_io_track_s::reply
uint8_t * reply
reply packet (if any)
Definition master.h:46
fr_io_track_s::ev
fr_event_timer_t const * ev
when we clean up this tracking entry
Definition master.h:42
fr_io_track_s::packets
int packets
number of packets using this entry
Definition master.h:45
fr_io_track_s::dynamic
fr_time_t dynamic
timestamp for packet doing dynamic client definition
Definition master.h:53
fr_io_instance_t::app_io_instance
void * app_io_instance
Easy access to the app_io instance.
Definition master.h:98
fr_io_instance_t::app_io
fr_app_io_t const * app_io
Easy access to the app_io handle.
Definition master.h:97
fr_io_track_s::address
fr_io_address_t const * address
of this packet.. shared between multiple packets
Definition master.h:54
fr_io_track_s::do_not_respond
bool do_not_respond
don't respond
Definition master.h:50
fr_io_track_s::discard
bool discard
whether or not we discard the packet
Definition master.h:49
fr_io_track_s::timestamp
fr_time_t timestamp
when this packet was received
Definition master.h:43
fr_io_track_s::finished
bool finished
are we finished the request?
Definition master.h:51
fr_io_track_s::packet
uint8_t * packet
really a tracking structure, not a packet
Definition master.h:56
fr_io_track_s::reply_len
size_t reply_len
length of reply, or 1 for "do not reply"
Definition master.h:47
fr_io_track_s::client
fr_io_client_t * client
client handling this packet.
Definition master.h:55
fr_io_track_s::expires
fr_time_t expires
when this packet expires
Definition master.h:44
fr_io_instance_t
The master IO instance.
Definition master.h:72
fr_io_track_s
Definition master.h:40
uint32_t
unsigned int uint32_t
Definition merged_model.c:33
ssize_t
long int ssize_t
Definition merged_model.c:24
uint8_t
unsigned char uint8_t
Definition merged_model.c:30
pthread_mutex_t
Definition merged_model.c:27
fr_nonblock
int fr_nonblock(UNUSED int fd)
Definition misc.c:293
module_inst_ctx_t::mi
module_instance_t * mi
Instance of the module being instantiated.
Definition module_ctx.h:51
module_inst_ctx_t
Temporary structure to hold arguments for instantiation calls.
Definition module_ctx.h:50
fr_asprintf
char * fr_asprintf(TALLOC_CTX *ctx, char const *fmt,...)
Special version of asprintf which implements custom format specifiers.
Definition print.c:874
fr_assert
#define fr_assert(_expr)
Definition rad_assert.h:38
ipproto
static int ipproto
Definition radclient-ng.c:92
secret
static char * secret
Definition radclient-ng.c:69
done
static bool done
Definition radclient.c:80
DEBUG2
#define DEBUG2(fmt,...)
Definition radclient.h:43
cleanup
static bool cleanup
Definition radsniff.c:60
conf
static rs_t * conf
Definition radsniff.c:53
proto
static char const * proto(int id, int porttype)
Definition radwho.c:85
fr_rb_find
void * fr_rb_find(fr_rb_tree_t const *tree, void const *data)
Find an element in the tree, returning the data, not the node.
Definition rb.c:577
fr_rb_insert
bool fr_rb_insert(fr_rb_tree_t *tree, void const *data)
Insert data into a tree.
Definition rb.c:626
fr_rb_delete
bool fr_rb_delete(fr_rb_tree_t *tree, void const *data)
Remove node and free data (if a free function was specified)
Definition rb.c:741
fr_rb_inline_talloc_alloc
#define fr_rb_inline_talloc_alloc(_ctx, _type, _field, _data_cmp, _data_free)
Allocs a red black that verifies elements are of a specific talloc type.
Definition rb.h:246
fr_rb_tree_s
The main red black tree structure.
Definition rb.h:73
hash
static unsigned int hash(char const *username, unsigned int tablesize)
Definition rlm_passwd.c:132
fr_schedule_listen_add
fr_network_t * fr_schedule_listen_add(fr_schedule_t *sc, fr_listen_t *li)
Add a fr_listen_t to a scheduler.
Definition schedule.c:881
fr_schedule_s
The scheduler.
Definition schedule.c:125
module_instance_s::conf
CONF_SECTION * conf
Module's instance configuration.
Definition module.h:329
module_instance_s::data
void * data
Module's instance data.
Definition module.h:271
module_s::instantiate
module_instantiate_t instantiate
Callback to allow the module to register any per-instance resources like sockets and file handles.
Definition module.h:218
MODULE_INSTANCE_BOOTSTRAPPED
@ MODULE_INSTANCE_BOOTSTRAPPED
Module instance has been bootstrapped, but not yet instantiated.
Definition module.h:244
module_s::thread_inst_size
size_t thread_inst_size
Size of the module's thread-specific instance data.
Definition module.h:235
module_instance_s
Module instance data.
Definition module.h:265
fr_socket_limit_t::idle_timeout
fr_time_delta_t idle_timeout
Definition socket.h:38
fr_socket_limit_t::max_connections
uint32_t max_connections
Definition socket.h:33
sc
static const uchar sc[16]
Definition smbdes.c:115
module_list_type_thread_local
module_list_type_t const module_list_type_thread_local
Callbacks for a thread local list.
Definition module.c:590
module_list_mask_set
void module_list_mask_set(module_list_t *ml, module_instance_state_t mask)
Set a new bootstrap/instantiate state for a list.
Definition module.c:1835
module_instance_copy
module_instance_t * module_instance_copy(module_list_t *dst, module_instance_t const *src, char const *inst_name)
Duplicate a module instance, placing it in a new module list.
Definition module.c:1534
module_list_alloc
module_list_t * module_list_alloc(TALLOC_CTX *ctx, module_list_type_t const *type, char const *name, bool write_protect)
Allocate a new module list.
Definition module.c:1857
module_thread_instantiate
int module_thread_instantiate(TALLOC_CTX *ctx, module_instance_t *mi, fr_event_list_t *el)
Allocate thread-local instance data for a module.
Definition module.c:1083
module_instantiate
int module_instantiate(module_instance_t *instance)
Manually complete module setup by calling its instantiate function.
Definition module.c:1195
module_instance_conf_parse
int module_instance_conf_parse(module_instance_t *mi, CONF_SECTION *conf)
Covert a CONF_SECTION into parsed module instance data.
Definition module.c:764
inst
eap_aka_sim_process_conf_t * inst
Definition state_machine.c:3620
fr_time
#define fr_time()
Allow us to arbitrarily manipulate time.
Definition state_test.c:8
fr_syserror
char const * fr_syserror(int num)
Guaranteed to be thread-safe version of strerror.
Definition syserror.c:243
talloc_get_type_abort_const
#define talloc_get_type_abort_const
Definition talloc.h:282
talloc_zero_pooled_object
#define talloc_zero_pooled_object(_ctx, _type, _num_subobjects, _total_subobjects_size)
Definition talloc.h:177
talloc_const_free
static int talloc_const_free(void const *ptr)
Free const'd memory.
Definition talloc.h:224
talloc_init_const
static TALLOC_CTX * talloc_init_const(char const *name)
Allocate a top level chunk with a constant name.
Definition talloc.h:112
fr_time_delta_unwrap
static int64_t fr_time_delta_unwrap(fr_time_delta_t time)
Definition time.h:154
fr_time_delta_lt
#define fr_time_delta_lt(_a, _b)
Definition time.h:285
fr_time_unwrap
static int64_t fr_time_unwrap(fr_time_t time)
Definition time.h:146
fr_time_delta_from_sec
static fr_time_delta_t fr_time_delta_from_sec(int64_t sec)
Definition time.h:590
fr_time_delta_wrap
#define fr_time_delta_wrap(_time)
Definition time.h:152
fr_time_wrap
#define fr_time_wrap(_time)
Definition time.h:145
fr_time_delta_ispos
#define fr_time_delta_ispos(_a)
Definition time.h:290
fr_time_eq
#define fr_time_eq(_a, _b)
Definition time.h:241
NSEC
#define NSEC
Definition time.h:379
fr_time_add
#define fr_time_add(_a, _b)
Add a time/time delta together.
Definition time.h:196
fr_time_neq
#define fr_time_neq(_a, _b)
Definition time.h:242
fr_time_delta_s
A time delta, a difference in time measured in nanoseconds.
Definition time.h:80
fr_time_s
"server local" time.
Definition time.h:69
fr_trie_remove_by_key
void * fr_trie_remove_by_key(fr_trie_t *ft, void const *key, size_t keylen)
Remove a key and return the associated user ctx.
Definition trie.c:2154
fr_trie_alloc
fr_trie_t * fr_trie_alloc(TALLOC_CTX *ctx, fr_trie_key_t get_key, fr_free_t free_data)
Allocate a trie.
Definition trie.c:741
fr_trie_walk
int fr_trie_walk(fr_trie_t *ft, void *ctx, fr_trie_walk_t callback)
Definition trie.c:2607
fr_trie_lookup_by_key
void * fr_trie_lookup_by_key(fr_trie_t const *ft, void const *key, size_t keylen)
Lookup a key in a trie and return user ctx, if any.
Definition trie.c:1262
fr_trie_match_by_key
void * fr_trie_match_by_key(fr_trie_t const *ft, void const *key, size_t keylen)
Match a key and length in a trie and return user ctx, if any.
Definition trie.c:1286
fr_trie_insert_by_key
int fr_trie_insert_by_key(fr_trie_t *ft, void const *key, size_t keylen, void const *data)
Insert a key and user ctx into a trie.
Definition trie.c:1875
fr_trie_s
Definition trie.c:484
close
close(uq->fd)
el
static fr_event_list_t * el
Definition unit_test_attribute.c:270
parent
static fr_slen_t parent
Definition pair.h:851
fr_socket_t::fd
int fd
File descriptor if this is a live socket.
Definition socket.h:81
fr_socket_t::type
int type
SOCK_STREAM, SOCK_DGRAM, etc.
Definition socket.h:79
fr_strerror_printf
#define fr_strerror_printf(_fmt,...)
Log to thread local error buffer.
Definition strerror.h:64
fr_strerror_const
#define fr_strerror_const(_msg)
Definition strerror.h:223
fr_value_box_aprint
static fr_slen_t fr_value_box_aprint(TALLOC_CTX *ctx, char **out, fr_value_box_t const *data, fr_sbuff_escape_rules_t const *e_rules) 1(fr_value_box_print
fr_box_ipaddr
#define fr_box_ipaddr(_val)
Definition value.h:294
data
static fr_slen_t data
Definition value.h:1265
fr_box_time_delta
#define fr_box_time_delta(_val)
Definition value.h:343
listen_record
bool listen_record(fr_listen_t *li)
Record that we're listening on a particular IP / port.
Definition virtual_servers.c:872
listen_find_any
fr_listen_t * listen_find_any(fr_listen_t *li)
See if another global listener is using a particular IP / port.
Definition virtual_servers.c:861
Generated by   doxygen 1.9.8