The FreeRADIUS server $Id: 15bac2a4c627c01d1aa2047687b3418955ac7f00 $
Loading...
Searching...
No Matches
master.c
Go to the documentation of this file.
1/*
2 * This program is free software; you can redistribute it and/or modify
3 * it under the terms of the GNU General Public License as published by
4 * the Free Software Foundation; either version 2 of the License, or
5 * (at your option) any later version.
6 *
7 * This program is distributed in the hope that it will be useful,
8 * but WITHOUT ANY WARRANTY; without even the implied warranty of
9 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10 * GNU General Public License for more details.
11 *
12 * You should have received a copy of the GNU General Public License
13 * along with this program; if not, write to the Free Software
14 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
15 */
16
17/**
18 * $Id: 3c371937c8882838aaac26cd76292eedb9088657 $
19 * @file io/master.c
20 * @brief Master IO handler
21 *
22 * @copyright 2018 Alan DeKok (aland@freeradius.org)
23 */
24#include <freeradius-devel/io/listen.h>
25#include <freeradius-devel/io/master.h>
26
27#include <freeradius-devel/server/base.h>
28#include <freeradius-devel/server/module.h>
29#include <freeradius-devel/server/log.h>
30
31#include <freeradius-devel/util/debug.h>
32
33#include <freeradius-devel/util/misc.h>
34#include <freeradius-devel/util/syserror.h>
35
36typedef struct {
37 fr_event_list_t *el; //!< event list, for the master socket.
38 fr_network_t *nr; //!< network for the master socket
39
40 fr_trie_t *trie; //!< trie of clients
41 fr_heap_t *pending_clients; //!< heap of pending clients
42 fr_heap_t *alive_clients; //!< heap of active dynamic clients
43
44 fr_listen_t *listen; //!< The master IO path
45 fr_listen_t *child; //!< The child (app_io) IO path
46 fr_schedule_t *sc; //!< the scheduler
47
48 // @todo - count num_nak_clients, and num_nak_connections, too
49 uint32_t num_connections; //!< number of dynamic connections
50 uint32_t num_pending_packets; //!< number of pending packets
51 uint64_t client_id; //!< Unique client identifier.
52
53 struct {
54 fr_rate_limit_t accept_failed;
55 fr_rate_limit_t alloc_failed;
56 fr_rate_limit_t bad_type;
57 fr_rate_limit_t conn_alloc_failed;
58 fr_rate_limit_t max_connections;
59 fr_rate_limit_t queue_full;
60 fr_rate_limit_t repeat_nak;
61 fr_rate_limit_t too_many_pending;
62 fr_rate_limit_t tracking_failed;
63 fr_rate_limit_t unknown_client;
64 } rate_limit;
65} fr_io_thread_t;
66
67/** A saved packet
68 *
69 */
78
79
80/** Client states
81 *
82 */
83typedef enum {
84 PR_CLIENT_INVALID = 0,
85 PR_CLIENT_STATIC, //!< static / global clients
86 PR_CLIENT_NAK, //!< negative cache entry
87 PR_CLIENT_DYNAMIC, //!< dynamically defined client
88 PR_CLIENT_CONNECTED, //!< dynamically defined client in a connected socket
89 PR_CLIENT_PENDING, //!< dynamic client pending definition
90} fr_io_client_state_t;
91
92/*
93 * Dynamic clients are run through the normal src/process/foo state machine.
94 *
95 * request->async->packet_ctx is an fr_io_track_t
96 *
97 * track->dynamic is set to a non-zero value.
98 *
99 * The dynamic client code returns a buffer of 1 byte for a NAK.
100 *
101 * If the client creation is successful, then it does talloc(NULL, fr_client_t),
102 * fills out the structure, and sends the pointer in the buffer (8 bytes).
103 *
104 * This code will take over ownership of the structure, and
105 * create the dynamic client.
106 */
107
108typedef struct fr_io_connection_s fr_io_connection_t;
109
110/** Client definitions for master IO
111 *
112 */
113struct fr_io_client_s {
114 fr_io_connection_t *connection; //!< parent connection
115 fr_io_client_state_t state; //!< state of this client
116 fr_ipaddr_t src_ipaddr; //!< packets come from this address
117 fr_ipaddr_t network; //!< network for dynamic clients
118 fr_client_t *radclient; //!< old-style definition of this client
119
120 int packets; //!< number of packets using this client
121 fr_heap_index_t pending_id; //!< for pending clients
122 fr_heap_index_t alive_id; //!< for all clients
123
124 bool use_connected; //!< does this client allow connected sub-sockets?
125 bool ready_to_delete; //!< are we ready to delete this client?
126 bool in_trie; //!< is the client in the trie?
127
128 fr_io_instance_t const *inst; //!< parent instance for master IO handler
129 fr_io_thread_t *thread;
130 fr_timer_t *ev; //!< when we clean up the client
131 fr_rb_tree_t *table; //!< tracking table for packets
132
133 fr_heap_t *pending; //!< pending packets for this client
134 fr_hash_table_t *addresses; //!< list of src/dst addresses used by this client
135
136 pthread_mutex_t mutex; //!< for parent / child signaling
137 fr_hash_table_t *ht; //!< for tracking connected sockets
138};
139
140/** Track a connection
141 *
142 * This structure contains information about the connection,
143 * a pointer to the library instance so that we can clean up on exit,
144 * and the listener.
145 *
146 * It also points to a client structure which is for this connection,
147 * and only this connection.
148 *
149 * Finally, a pointer to the parent client, so that the child can
150 * tell the parent it's alive, and the parent can push packets to the
151 * child.
152 */
153struct fr_io_connection_s {
154 char const *name; //!< taken from proto_FOO_TRANSPORT
155 int packets; //!< number of packets using this connection
156 fr_io_address_t *address; //!< full information about the connection.
157 fr_listen_t *listen; //!< master listener for this socket
158 fr_listen_t *child; //!< child listener (app_io) for this socket
159 fr_io_client_t *client; //!< our local client (pending or connected).
160 fr_io_client_t *parent; //!< points to the parent client.
161 module_instance_t *mi; //!< for submodule
162
163 bool dead; //!< roundabout way to get the network side to close a socket
164 bool paused; //!< event filter doesn't like resuming something that isn't paused
165 bool in_parent_hash; //!< for tracking thread issues
166 fr_event_list_t *el; //!< event list for this connection
167 fr_network_t *nr; //!< network for this connection
168};
169
170static fr_event_update_t pause_read[] = {
171 FR_EVENT_SUSPEND(fr_event_io_func_t, read),
172 { 0 }
173};
174
175static fr_event_update_t resume_read[] = {
176 FR_EVENT_RESUME(fr_event_io_func_t, read),
177 { 0 }
178};
179
180static int track_free(fr_io_track_t *track)
181{
182 FR_TIMER_DELETE_RETURN(&track->ev);
183 talloc_free_children(track);
184
185 fr_assert(track->client->packets > 0);
186 track->client->packets--;
187
188 return 0;
189}
190
191static int track_dedup_free(fr_io_track_t *track)
192{
193 fr_assert(track->client->table != NULL);
194 fr_assert(fr_rb_find(track->client->table, track) != NULL);
195
196 if (!fr_rb_delete(track->client->table, track)) {
197 fr_assert(0);
198 }
199
200 return track_free(track);
201}
202
203/*
204 * Return negative numbers to put 'one' at the top of the heap.
205 * Return positive numbers to put 'two' at the top of the heap.
206 */
207static int8_t pending_packet_cmp(void const *one, void const *two)
208{
209 fr_io_pending_packet_t const *a = talloc_get_type_abort_const(one, fr_io_pending_packet_t);
210 fr_io_pending_packet_t const *b = talloc_get_type_abort_const(two, fr_io_pending_packet_t);
211 int ret;
212
213 /*
214 * Higher priority elements are larger than lower
215 * priority elements. So if "a" is larger than "b", we
216 * wish to prefer "a".
217 */
218 ret = CMP_PREFER_LARGER(a->priority, b->priority);
219 if (ret != 0) return ret;
220
221 /*
222 * Smaller numbers mean packets were received earlier.
223 * We want to process packets in time order. So if "a"
224 * is smaller than "b", we wish to prefer "a".
225 *
226 * After that, it doesn't really matter what order the
227 * packets go in. Since we'll never have two identical
228 * "recv_time" values, the code should never get here.
229 */
230 return CMP_PREFER_SMALLER(fr_time_unwrap(a->recv_time), fr_time_unwrap(b->recv_time));
231}
232
233/*
234 * Order clients in the pending_clients heap, based on the
235 * packets that they contain.
236 */
237static int8_t pending_client_cmp(void const *one, void const *two)
238{
239 fr_io_pending_packet_t const *a;
240 fr_io_pending_packet_t const *b;
241
242 fr_io_client_t const *c1 = talloc_get_type_abort_const(one, fr_io_client_t);
243 fr_io_client_t const *c2 = talloc_get_type_abort_const(two, fr_io_client_t);
244
245 a = fr_heap_peek(c1->pending);
246 b = fr_heap_peek(c2->pending);
247
248 fr_assert(a != NULL);
249 fr_assert(b != NULL);
250
251 return pending_packet_cmp(a, b);
252}
253
254
255static int8_t address_cmp(void const *one, void const *two)
256{
257 fr_io_address_t const *a = talloc_get_type_abort_const(one, fr_io_address_t);
258 fr_io_address_t const *b = talloc_get_type_abort_const(two, fr_io_address_t);
259 int8_t ret;
260
261 CMP_RETURN(a, b, socket.inet.src_port);
262 CMP_RETURN(a, b, socket.inet.dst_port);
263 CMP_RETURN(a, b, socket.inet.ifindex);
264
265 ret = fr_ipaddr_cmp(&a->socket.inet.src_ipaddr, &b->socket.inet.src_ipaddr);
266 if (ret != 0) return ret;
267
268 return fr_ipaddr_cmp(&a->socket.inet.dst_ipaddr, &b->socket.inet.dst_ipaddr);
269}
270
271static uint32_t connection_hash(void const *ctx)
272{
273 uint32_t hash;
274 fr_io_connection_t const *c = talloc_get_type_abort_const(ctx, fr_io_connection_t);
275
276 hash = fr_hash(&c->address->socket.inet.src_ipaddr, sizeof(c->address->socket.inet.src_ipaddr));
277 hash = fr_hash_update(&c->address->socket.inet.src_port, sizeof(c->address->socket.inet.src_port), hash);
278
279 hash = fr_hash_update(&c->address->socket.inet.ifindex, sizeof(c->address->socket.inet.ifindex), hash);
280
281 hash = fr_hash_update(&c->address->socket.inet.dst_ipaddr, sizeof(c->address->socket.inet.dst_ipaddr), hash);
282 return fr_hash_update(&c->address->socket.inet.dst_port, sizeof(c->address->socket.inet.dst_port), hash);
283}
284
285static int8_t connection_cmp(void const *one, void const *two)
286{
287 fr_io_connection_t const *a = talloc_get_type_abort_const(one, fr_io_connection_t);
288 fr_io_connection_t const *b = talloc_get_type_abort_const(two, fr_io_connection_t);
289
290 return address_cmp(a->address, b->address);
291}
292
293
294static int8_t track_cmp(void const *one, void const *two)
295{
296 fr_io_track_t const *a = talloc_get_type_abort_const(one, fr_io_track_t);
297 fr_io_track_t const *b = talloc_get_type_abort_const(two, fr_io_track_t);
298 int ret;
299
300 fr_assert(a->client != NULL);
301 fr_assert(b->client != NULL);
302 fr_assert(a->client == b->client); /* tables are per-client */
303
304 fr_assert(!a->client->connection);
305 fr_assert(!b->client->connection);
306
307 /*
308 * Unconnected sockets must check src/dst ip/port.
309 */
310 ret = address_cmp(a->address, b->address);
311 if (ret != 0) return ret;
312
313 /*
314 * Call the per-protocol comparison function.
315 */
316 ret = a->client->inst->app_io->track_compare(a->client->inst->app_io_instance,
317 a->client->thread->child->thread_instance,
318 a->client->radclient,
319 a->packet, b->packet);
320 return CMP(ret, 0);
321}
322
323
324static int8_t track_connected_cmp(void const *one, void const *two)
325{
326 fr_io_track_t const *a = talloc_get_type_abort_const(one, fr_io_track_t);
327 fr_io_track_t const *b = talloc_get_type_abort_const(two, fr_io_track_t);
328 int ret;
329
330 fr_assert(a->client != NULL);
331 fr_assert(b->client != NULL);
332
333 fr_assert(a->client->connection);
334 fr_assert(b->client->connection);
335 fr_assert(a->client == b->client);
336 fr_assert(a->client->connection == b->client->connection);
337
338 /*
339 * Note that we pass the connection "client", as
340 * we may do negotiation specific to this connection.
341 */
342 ret = a->client->inst->app_io->track_compare(a->client->inst->app_io_instance,
343 a->client->connection->child->thread_instance,
344 a->client->connection->client->radclient,
345 a->packet, b->packet);
346 return CMP(ret, 0);
347}
348
349
350static fr_io_pending_packet_t *pending_packet_pop(fr_io_thread_t *thread)
351{
352 fr_io_client_t *client;
353 fr_io_pending_packet_t *pending;
354
355 client = fr_heap_pop(&thread->pending_clients);
356 if (!client) {
357 fr_assert(thread->num_pending_packets == 0);
358
359 /*
360 * 99% of the time we don't have pending clients.
361 * So we might as well free this, so that the
362 * caller doesn't keep checking us for every packet.
363 */
364 talloc_free(thread->pending_clients);
365 thread->pending_clients = NULL;
366 return NULL;
367 }
368
369 pending = fr_heap_pop(&client->pending);
370 fr_assert(pending != NULL);
371
372 /*
373 * If the client has more packets pending, add it back to
374 * the heap.
375 */
376 if (fr_heap_num_elements(client->pending) > 0) {
377 if (fr_heap_insert(&thread->pending_clients, client) < 0) {
378 fr_assert(0 == 1);
379 }
380 }
381
382 fr_assert(thread->num_pending_packets > 0);
383 thread->num_pending_packets--;
384
385 return pending;
386}
387
388static fr_client_t *radclient_clone(TALLOC_CTX *ctx, fr_client_t const *parent)
389{
390 fr_client_t *c;
391
392 if (!parent) return NULL;
393
394 c = talloc_zero(ctx, fr_client_t);
395 if (!c) return NULL;
396
397 /*
398 * Do NOT set ipaddr or src_ipaddr. The caller MUST do this!
399 */
400
401#define DUP_FIELD(_x) do { if (parent->_x) {c->_x = talloc_strdup(c, parent->_x); if (!c->_x) {goto error;}}} while (0)
402#define COPY_FIELD(_x) c->_x = parent->_x
403
404 DUP_FIELD(longname);
405 DUP_FIELD(shortname);
406 DUP_FIELD(secret);
407 DUP_FIELD(nas_type);
408 DUP_FIELD(server);
409 DUP_FIELD(nas_type);
410
411 COPY_FIELD(require_message_authenticator);
412 COPY_FIELD(require_message_authenticator_is_set);
413 COPY_FIELD(limit_proxy_state);
414 COPY_FIELD(limit_proxy_state_is_set);
415 COPY_FIELD(received_message_authenticator);
416 COPY_FIELD(first_packet_no_proxy_state);
417 /* dynamic MUST be false */
418 COPY_FIELD(server_cs);
419 COPY_FIELD(cs);
420 COPY_FIELD(proto);
421 COPY_FIELD(active);
422
423 COPY_FIELD(use_connected);
424
425#ifdef WITH_TLS
426 COPY_FIELD(tls_required);
427#endif
428
429 c->ipaddr = parent->ipaddr;
430 c->src_ipaddr = parent->src_ipaddr;
431
432 return c;
433
434 /*
435 * @todo - fill in other fields, too!
436 */
437
438error:
439 talloc_free(c);
440 return NULL;
441}
442#undef COPY_FIELD
443#undef DUP_FIELD
444
445
446/** Count the number of connections used by active clients.
447 *
448 * Unfortunately, we also count NAK'd connections, too, even if they
449 * are closed. The alternative is to walk through all connections
450 * for each client, which would be a long time.
451 */
452static int count_connections(UNUSED uint8_t const *key, UNUSED size_t keylen, void *data, void *ctx)
453{
454 fr_io_client_t *client = talloc_get_type_abort(data, fr_io_client_t);
455 int connections;
456
457 pthread_mutex_lock(&client->mutex);
458
459 if (!client->ht) {
460 pthread_mutex_unlock(&client->mutex);
461 return 0;
462 }
463
464 connections = fr_hash_table_num_elements(client->ht);
465 pthread_mutex_unlock(&client->mutex);
466
467 fr_assert(client->use_connected);
468 *((uint32_t *) ctx) += connections;
469
470 return 0;
471}
472
473
474static int _client_free(fr_io_client_t *client)
475{
476 TALLOC_FREE(client->pending);
477
478 return 0;
479}
480
481static void client_pending_free(fr_io_client_t *client)
482{
483 size_t num;
484
485 fr_assert(!client->connection);
486
487 if (!client->pending) return;
488
489 num = fr_heap_num_elements(client->pending);
490
491 fr_assert(client->thread->num_pending_packets >= num);
492 client->thread->num_pending_packets -= num;
493
494 TALLOC_FREE(client->pending);
495}
496
497
498static int connection_free(fr_io_connection_t *connection)
499{
500 /*
501 * This is it's own talloc context, as there are
502 * thousands of packets associated with it.
503 */
504 TALLOC_FREE(connection->client);
505
506 return 0;
507}
508
509/** Create a new connection.
510 *
511 * Called ONLY from the master socket.
512 */
513static fr_io_connection_t *fr_io_connection_alloc(fr_io_instance_t const *inst,
514 fr_io_thread_t *thread,
515 fr_io_client_t *client, int fd,
516 fr_io_address_t *address,
517 fr_io_connection_t *nak)
518{
519 int ret;
520 fr_io_connection_t *connection;
521 module_instance_t *mi = NULL;
522 fr_listen_t *li;
523 fr_client_t *radclient;
524
525 /*
526 * Reload the app_io module as a "new" library. This
527 * causes the link count for the library to be correct.
528 * It also allocates a new instance data for it, too.
529 * Passing CONF_SECTION of NULL ensures that there's no
530 * config for it, as we'll just clone it's contents from
531 * the original. It also means that detach should be
532 * called when the instance data is freed.
533 */
534 if (!nak) {
535 CONF_SECTION *cs;
536 char *inst_name;
537
538 if (inst->max_connections || client->radclient->limit.max_connections) {
539 uint32_t max_connections = inst->max_connections ? inst->max_connections : client->radclient->limit.max_connections;
540
541 /*
542 * We've hit the connection limit. Walk
543 * over all clients with connections, and
544 * count the number of connections used.
545 */
546 if (thread->num_connections >= max_connections) {
547 thread->num_connections = 0;
548
549 (void) fr_trie_walk(thread->trie, &thread->num_connections, count_connections);
550
551 if ((thread->num_connections + 1) >= max_connections) {
552 RATE_LIMIT_LOCAL(&thread->rate_limit.max_connections, INFO,
553 "proto_%s - Ignoring connection from client %s - 'max_connections' limit reached.",
554 inst->app->common.name, client->radclient->shortname);
555 if (fd >= 0) close(fd);
556 return NULL;
557 }
558 }
559 }
560
561 /*
562 * Add a client module into a sublist
563 */
564 inst_name = talloc_asprintf(NULL, "%"PRIu64, thread->client_id++);
565 mi = module_instance_copy(inst->clients, inst->submodule, inst_name);
566
567 cs = cf_section_dup(mi, NULL, inst->submodule->conf,
568 cf_section_name1(inst->submodule->conf),
569 cf_section_name2(inst->submodule->conf), false);
570 if (module_instance_conf_parse(mi, cs) < 0) {
571 cf_log_err(inst->server_cs, "Failed parsing module config");
572 goto cleanup;
573 }
574
575 /* Thread local module lists never run bootstrap */
576 if (module_instantiate(mi) < 0) {
577 cf_log_err(inst->server_cs, "Failed instantiating module");
578 goto cleanup;
579 }
580
581 if (module_thread_instantiate(mi, mi, thread->el) < 0) {
582 cf_log_err(inst->server_cs, "Failed instantiating module");
583 goto cleanup;
584 }
585
586 /*
587 * FIXME - Instantiate the new module?!
588 */
589 talloc_free(inst_name);
590 fr_assert(mi != NULL);
591 } else {
592 mi = talloc_init_const("nak");
593 }
594
595 MEM(connection = talloc_zero(mi, fr_io_connection_t));
596 MEM(connection->address = talloc_memdup(connection, address, sizeof(*address)));
597 (void) talloc_set_name_const(connection->address, "fr_io_address_t");
598
599 connection->parent = client;
600 connection->mi = mi;
601
602 MEM(connection->client = talloc_named(NULL, sizeof(fr_io_client_t), "fr_io_client_t"));
603 memset(connection->client, 0, sizeof(*connection->client));
604
605 MEM(connection->client->radclient = radclient = radclient_clone(connection->client, client->radclient));
606
607 talloc_set_destructor(connection->client, _client_free);
608 talloc_set_destructor(connection, connection_free);
609
610 connection->client->pending_id = FR_HEAP_INDEX_INVALID;
611 connection->client->alive_id = FR_HEAP_INDEX_INVALID;
612 connection->client->connection = connection;
613
614 /*
615 * Create the packet tracking table for this client.
616 *
617 * #todo - unify the code with static clients?
618 */
619 if (inst->app_io->track_duplicates) {
620 MEM(connection->client->table = fr_rb_inline_talloc_alloc(client, fr_io_track_t, node,
621 track_connected_cmp, NULL));
622 }
623
624 /*
625 * Set this radclient to be dynamic, and active.
626 */
627 radclient->dynamic = true;
628 radclient->active = true;
629
630 /*
631 * address->socket.inet.client points to a "static" client. We want
632 * to clean up everything associated with the connection
633 * when it closes. So we need to point to our own copy
634 * of the client here.
635 */
636 connection->address->radclient = connection->client->radclient;
637 connection->client->inst = inst;
638 connection->client->thread = thread;
639
640 /*
641 * Create a heap for packets which are pending for this
642 * client.
643 */
644 MEM(connection->client->pending = fr_heap_alloc(connection->client, pending_packet_cmp,
645 fr_io_pending_packet_t, heap_id, 0));
646
647 /*
648 * Clients for connected sockets are always a /32 or /128.
649 */
650 connection->client->src_ipaddr = address->socket.inet.src_ipaddr;
651 connection->client->network = address->socket.inet.src_ipaddr;
652
653 /*
654 * Don't initialize mutex or hash table.
655 * Connections cannot spawn other connections.
656 */
657
658 /*
659 * If this client state is pending, then the connection
660 * state is pending, too. That allows NAT gateways to be
661 * defined dynamically, AND for them to have multiple
662 * connections, each with a different client. This
663 * allows for different shared secrets to be used for
664 * different connections. Once the client gets defined
665 * for this connection, it will be either "connected" or
666 * not. If connected, then the parent client remains
667 * PENDING. Otherwise, the parent client is moved to
668 * DYNAMIC
669 *
670 * If this client state is static or dynamic,
671 * then we're just using connected sockets behind
672 * that client. The connections here all use the
673 * same shared secret, but they use different
674 * sockets, so they allow for sharing of IO
675 * across CPUs / threads.
676 */
677 switch (client->state) {
678 case PR_CLIENT_PENDING:
679 connection->client->state = PR_CLIENT_PENDING;
680
681 /*
682 * Needed for rlm_radius, which refuses to proxy packets
683 * that define a dynamic client.
684 */
685 radclient->active = false;
686 break;
687
688 case PR_CLIENT_STATIC:
689 case PR_CLIENT_DYNAMIC:
690 connection->client->state = PR_CLIENT_CONNECTED;
691 break;
692
693 case PR_CLIENT_INVALID:
694 case PR_CLIENT_NAK:
695 case PR_CLIENT_CONNECTED:
696 fr_assert(0 == 1);
697 goto cleanup;
698 }
699
700 if (!nak) {
701 /*
702 * Get the child listener.
703 */
704 MEM(li = connection->child = talloc(connection, fr_listen_t));
705 memcpy(li, thread->listen, sizeof(*li));
706
707 /*
708 * Glue in the actual app_io
709 */
710 li->connected = true;
711 li->app_io = thread->child->app_io;
712 li->thread_instance = connection;
713 li->app_io_instance = mi->data;
714 li->track_duplicates = thread->child->app_io->track_duplicates;
715
716 /*
717 * Create writable thread instance data.
718 */
719 connection->child->thread_instance = talloc_zero_array(NULL, uint8_t,
720 inst->app_io->common.thread_inst_size);
721 talloc_set_destructor(connection->child, fr_io_listen_free);
722 talloc_set_name(connection->child->thread_instance, "proto_%s_thread_t",
723 inst->app_io->common.name);
724
725 /*
726 * This is "const", and the user can't
727 * touch it. So we just reuse the same
728 * configuration everywhere.
729 */
730 connection->child->app_io_instance = inst->app_io_instance;
731
732 /*
733 * Create the listener, based on our listener.
734 */
735 MEM(li = connection->listen = talloc(connection, fr_listen_t));
736
737 /*
738 * Note that our instance is effectively 'const'.
739 *
740 * i.e. we can't add things to it. Instead, we have to
741 * put all variable data into the connection.
742 */
743 memcpy(li, thread->listen, sizeof(*li));
744
745 /*
746 * Glue in the connection to the listener.
747 */
748 fr_assert(li->app_io == &fr_master_app_io);
749
750 li->connected = true;
751 li->thread_instance = connection;
752 li->app_io_instance = li->thread_instance;
753 li->track_duplicates = thread->child->app_io->track_duplicates;
754
755 /*
756 * Instantiate the child, and open the socket.
757 */
758 fr_assert(inst->app_io->connection_set != NULL);
759
760 if (inst->app_io->connection_set(connection->child, connection->address) < 0) {
761 DEBUG("proto_%s - Failed setting connection for socket.", inst->app->common.name);
762 goto cleanup;
763 }
764
765 /*
766 * UDP sockets: open a new socket, and then
767 * connect it to the client. This emulates the
768 * behavior of accept().
769 *
770 * Note that there is a small window between the
771 * bind() and connect() where UDP packets for the
772 * wildcard socket can get received by this
773 * socket. We hope that this time frame is as
774 * small as possible.
775 *
776 * i.e. we ignore the problem, and don't
777 * currently check dst ip/port for UDP packets
778 * received on connected sockets.
779 */
780 if (fd < 0) {
781 socklen_t salen;
782 struct sockaddr_storage src;
783
784 if (fr_ipaddr_to_sockaddr(&src, &salen,
785 &connection->address->socket.inet.src_ipaddr,
786 connection->address->socket.inet.src_port) < 0) {
787 DEBUG("proto_%s - Failed getting IP address", inst->app->common.name);
788 talloc_free(mi);
789 return NULL;
790 }
791
792 if (inst->app_io->open(connection->child) < 0) {
793 DEBUG("proto_%s - Failed opening connected socket.", inst->app->common.name);
794 talloc_free(mi);
795 return NULL;
796 }
797
798 fd = connection->child->fd;
799
800 if (connect(fd, (struct sockaddr *) &src, salen) < 0) {
801 ERROR("proto_%s - Failed in connect: %s", inst->app->common.name, fr_syserror(errno));
802 goto cleanup;
803 }
804 } else {
805 connection->child->fd = fd;
806 }
807
808 /*
809 * Set the new FD, and get the module to set it's connection name.
810 */
811 if (inst->app_io->fd_set(connection->child, fd) < 0) {
812 DEBUG3("Failed setting FD to %s", inst->app_io->common.name);
813 goto cleanup;
814 }
815
816 li->fd = fd;
817
818 if (!inst->app_io->get_name) {
819 connection->name = fr_asprintf(connection, "proto_%s from client %pV port "
820 "%u to server %pV port %u",
821 inst->app->common.name,
822 fr_box_ipaddr(connection->address->socket.inet.src_ipaddr),
823 connection->address->socket.inet.src_port,
824 fr_box_ipaddr(connection->address->socket.inet.dst_ipaddr),
825 connection->address->socket.inet.dst_port);
826 } else {
827 connection->name = inst->app_io->get_name(connection->child);
828 }
829
830 /*
831 * Set the names for the listeners.
832 */
833 connection->listen->name = connection->name;
834 connection->child->name = connection->name;
835 }
836
837 /*
838 * Add the connection to the set of connections for this
839 * client.
840 */
841 pthread_mutex_lock(&client->mutex);
842 if (client->ht) {
843 if (nak) (void) fr_hash_table_delete(client->ht, nak);
844 ret = fr_hash_table_insert(client->ht, connection);
845 client->ready_to_delete = false;
846 connection->in_parent_hash = true;
847
848 if (!ret) {
849 pthread_mutex_unlock(&client->mutex);
850 ERROR("proto_%s - Failed inserting connection into tracking table. "
851 "Closing it, and discarding all packets for connection %s.",
852 inst->app_io->common.name, connection->name);
853 goto cleanup;
854 }
855 }
856 pthread_mutex_unlock(&client->mutex);
857
858 /*
859 * It's a NAK client. Set the state to NAK, and don't
860 * add it to the scheduler.
861 */
862 if (nak) {
863 INFO("proto_%s - Verification failed for packet from dynamic client %pV - adding IP address to the NAK cache",
864 inst->app_io->common.name, fr_box_ipaddr(client->src_ipaddr));
865
866 connection->name = talloc_strdup(connection, nak->name);
867 connection->client->state = PR_CLIENT_NAK;
868 connection->el = nak->el;
869 return connection;
870 }
871
872 DEBUG("proto_%s - starting connection %s", inst->app_io->common.name, connection->name);
873 connection->nr = fr_schedule_listen_add(thread->sc, connection->listen);
874 if (!connection->nr) {
875 ERROR("proto_%s - Failed inserting connection into scheduler. "
876 "Closing it, and diuscarding all packets for connection %s.",
877 inst->app_io->common.name, connection->name);
878 pthread_mutex_lock(&client->mutex);
879 if (client->ht) (void) fr_hash_table_delete(client->ht, connection);
880 pthread_mutex_unlock(&client->mutex);
881
882 cleanup:
883 if (fd >= 0) close(fd);
884 talloc_free(mi);
885 return NULL;
886 }
887
888 /*
889 * We have one more connection. Note that we do
890 * NOT decrement this counter when a connection
891 * closes, as the close is done in a child
892 * thread. Instead, we just let counter hit the
893 * limit, and then walk over the clients to reset
894 * the count.
895 */
896 thread->num_connections++;
897
898 return connection;
899}
900
901
902/*
903 * And here we go into the rabbit hole...
904 *
905 * @todo future - have a similar structure
906 * fr_io_connection_io, which will duplicate some code,
907 * but may make things simpler?
908 */
909static void get_inst(fr_listen_t *li, fr_io_instance_t const **inst, fr_io_thread_t **thread,
910 fr_io_connection_t **connection, fr_listen_t **child)
911{
912 if (!li->connected) {
913 *inst = li->app_io_instance;
914 if (thread) *thread = li->thread_instance;
915 *connection = NULL;
916 if (child) *child = ((fr_io_thread_t *)li->thread_instance)->child;
917
918 } else {
919 fr_assert(connection != NULL);
920
921 *connection = li->thread_instance;
922 *inst = (*connection)->client->inst;
923 if (thread) *thread = NULL;
924 if (child) *child = (*connection)->child;
925 }
926}
927
928
929static fr_client_t *radclient_alloc(TALLOC_CTX *ctx, int ipproto, fr_io_address_t *address)
930{
931 fr_client_t *radclient;
932 char *shortname;
933
934 MEM(radclient = talloc_zero(ctx, fr_client_t));
935
936 fr_value_box_aprint(radclient, &shortname, fr_box_ipaddr(address->socket.inet.src_ipaddr), NULL);
937 radclient->longname = radclient->shortname = shortname;
938
939 radclient->secret = radclient->nas_type = talloc_strdup(radclient, "");
940
941 radclient->ipaddr = address->socket.inet.src_ipaddr;
942
943 radclient->src_ipaddr = address->socket.inet.dst_ipaddr;
944
945 radclient->proto = ipproto;
946 radclient->dynamic = true;
947
948 return radclient;
949}
950
951/*
952 * Remove a client from the list of "live" clients.
953 *
954 * This function is only used for the "main" socket. Clients
955 * from connections do not use it.
956 */
957static int _client_live_free(fr_io_client_t *client)
958{
959 talloc_get_type_abort(client, fr_io_client_t);
960
961 fr_assert(client->in_trie);
962 fr_assert(!client->connection);
963 fr_assert(client->thread);
964
965 if (client->pending) client_pending_free(client);
966
967 (void) fr_trie_remove_by_key(client->thread->trie, &client->src_ipaddr.addr, client->src_ipaddr.prefix);
968
969 if (client->thread->alive_clients) {
970 fr_assert(fr_heap_num_elements(client->thread->alive_clients) > 0);
971 (void) fr_heap_extract(&client->thread->alive_clients, client);
972 }
973
974 return 0;
975}
976
977/** Allocate a dynamic client.
978 *
979 */
980static fr_io_client_t *client_alloc(TALLOC_CTX *ctx, fr_io_client_state_t state,
981 fr_io_instance_t const *inst, fr_io_thread_t *thread, fr_client_t *radclient,
982 fr_ipaddr_t const *network)
983{
984 fr_io_client_t *client;
985
986 /*
987 * Create our own local client. This client
988 * holds our state which really shouldn't go into
989 * fr_client_t.
990 *
991 * Note that we create a new top-level talloc
992 * context for this client, as there may be tens
993 * of thousands of packets associated with this
994 * client. And we want to avoid problems with
995 * O(N) issues in talloc.
996 */
997 MEM(client = talloc_named(ctx, sizeof(fr_io_client_t), "fr_io_client_t"));
998 memset(client, 0, sizeof(*client));
999
1000 client->state = state;
1001 client->src_ipaddr = radclient->ipaddr;
1002 client->radclient = radclient;
1003 client->inst = inst;
1004 client->thread = thread;
1005
1006 if (network) {
1007 client->network = *network;
1008 } else {
1009 client->network = client->src_ipaddr;
1010 }
1011
1012 /*
1013 * At this point, this variable can only be true
1014 * for STATIC clients. PENDING clients may set
1015 * it to true later, after they've been defined.
1016 */
1017 client->use_connected = radclient->use_connected;
1018
1019 /*
1020 * Create the pending heap for pending clients.
1021 */
1022 if (state == PR_CLIENT_PENDING) {
1023 MEM(client->pending = fr_heap_alloc(client, pending_packet_cmp,
1024 fr_io_pending_packet_t, heap_id, 0));
1025 }
1026
1027 /*
1028 * Create the packet tracking table for this client.
1029 */
1030 if (inst->app_io->track_duplicates) {
1031 fr_assert(inst->app_io->track_compare != NULL);
1032 MEM(client->table = fr_rb_inline_talloc_alloc(client, fr_io_track_t, node, track_cmp, NULL));
1033 }
1034
1035 /*
1036 * Allow connected sockets to be set on a
1037 * per-client basis.
1038 */
1039 if (client->use_connected) {
1040 fr_assert(client->state == PR_CLIENT_STATIC);
1041
1042 (void) pthread_mutex_init(&client->mutex, NULL);
1043 MEM(client->ht = fr_hash_table_alloc(client, connection_hash, connection_cmp, NULL));
1044 }
1045
1046 /*
1047 * Add the newly defined client to the trie of
1048 * allowed clients.
1049 */
1050 if (fr_trie_insert_by_key(thread->trie, &client->src_ipaddr.addr, client->src_ipaddr.prefix, client)) {
1051 ERROR("proto_%s - Failed inserting client %s into tracking table. Discarding client, and all packets for it.",
1052 inst->app_io->common.name, client->radclient->shortname);
1053 talloc_free(client);
1054 return NULL;
1055 }
1056
1057 client->in_trie = true;
1058
1059 /*
1060 * It's a static client. Don't insert it into the list of alive clients, as those are only for
1061 * dynamic clients.
1062 */
1063 if (state == PR_CLIENT_STATIC) return client;
1064
1065 fr_assert(thread->alive_clients != NULL);
1066
1067 /*
1068 * Track the live clients so that we can clean
1069 * them up.
1070 */
1071 (void) fr_heap_insert(&thread->alive_clients, client);
1072 client->pending_id = FR_HEAP_INDEX_INVALID;
1073
1074 /*
1075 * Now that we've inserted it into the heap and
1076 * incremented the numbers, set the destructor
1077 * function.
1078 */
1079 talloc_set_destructor(client, _client_live_free);
1080
1081 return client;
1082}
1083
1084
1085static fr_io_track_t *fr_io_track_add(fr_io_client_t *client,
1086 fr_io_address_t *address,
1087 uint8_t const *packet, size_t packet_len,
1088 fr_time_t recv_time, bool *is_dup)
1089{
1090 size_t len;
1091 fr_io_track_t *track, *old;
1092
1093 *is_dup = false;
1094
1095 /*
1096 * Allocate a new tracking structure. Most of the time
1097 * there are no duplicates, so this is fine.
1098 */
1099 if (client->connection) {
1100 MEM(track = talloc_zero_pooled_object(client, fr_io_track_t, 1, sizeof(*track) + 64));
1101 track->address = client->connection->address;
1102 } else {
1103 fr_io_address_t *my_address;
1104
1105 MEM(track = talloc_zero_pooled_object(client, fr_io_track_t, 1, sizeof(*track) + sizeof(*track->address) + 64));
1106 MEM(track->address = my_address = talloc(track, fr_io_address_t));
1107
1108 *my_address = *address;
1109 my_address->radclient = client->radclient;
1110 }
1111
1112 track->client = client;
1113
1114 track->timestamp = recv_time;
1115 track->packets = 1;
1116
1117 /*
1118 * We're not tracking duplicates, so just return the
1119 * tracking entry. This tracks src/dst IP/port, client,
1120 * receive time, etc.
1121 */
1122 if (!client->inst->app_io->track_duplicates) {
1123 client->packets++;
1124 talloc_set_destructor(track, track_free);
1125 return track;
1126 }
1127
1128 /*
1129 * We are checking for duplicates, see if there is a dup
1130 * already in the tree.
1131 */
1132 track->packet = client->inst->app_io->track_create(client->inst->app_io_instance,
1133 client->thread->child->thread_instance,
1134 client->radclient,
1135 track, packet, packet_len);
1136 if (!track->packet) {
1137 talloc_free(track);
1138 return NULL;
1139 }
1140
1141 /*
1142 * No existing duplicate. Return the new tracking entry.
1143 */
1144 old = fr_rb_find(client->table, track);
1145 if (!old) goto do_insert;
1146
1147 fr_assert(old->client == client);
1148
1149 /*
1150 * It cannot be both in the free list and in the tracking table.
1151 *
1152 * 2020-08-17, this assertion fails randomly in travis.
1153 * Which means that "track" was in the free list, *and*
1154 * in the rbtree.
1155 */
1156 fr_assert(old != track);
1157
1158 /*
1159 * The new packet has the same dedup fields as the old
1160 * one, BUT it may be a conflicting packet. Check for
1161 * that via a simple memcmp().
1162 *
1163 * It's an exact duplicate. Drop the new one and
1164 * use the old one.
1165 *
1166 * If there's a cached reply, the caller will take care
1167 * of sending it to the network layer.
1168 */
1169 len = talloc_array_length(old->packet);
1170 if ((len == talloc_array_length(track->packet)) &&
1171 (memcmp(old->packet, track->packet, len) == 0)) {
1172 fr_assert(old != track);
1173
1174 /*
1175 * Ignore duplicates while the client is
1176 * still pending.
1177 */
1178 if (client->state == PR_CLIENT_PENDING) {
1179 DEBUG("Ignoring duplicate packet while client %s is still pending dynamic definition",
1180 client->radclient->shortname);
1181 talloc_free(track);
1182 return NULL;
1183 }
1184
1185 *is_dup = true;
1186 old->packets++;
1187 talloc_free(track);
1188
1189 /*
1190 * Retransmits can sit in the outbound queue for
1191 * a while. We don't want to time out this
1192 * struct while the packet is in the outbound
1193 * queue.
1194 */
1195 FR_TIMER_DISARM(old->ev);
1196 return old;
1197 }
1198
1199 /*
1200 * Else it's a conflicting packet. Which is OK if we
1201 * already have a reply. We just delete the old entry,
1202 * and insert the new one.
1203 *
1204 * If there's no reply, then the old request is still
1205 * "live". Delete the old one from the tracking tree,
1206 * and return the new one.
1207 */
1208 if (old->reply_len || old->do_not_respond) {
1209 talloc_free(old);
1210
1211 } else {
1212 fr_assert(client == old->client);
1213
1214 if (!fr_rb_delete(client->table, old)) {
1215 fr_assert(0);
1216 }
1217 FR_TIMER_DELETE(&old->ev);
1218
1219 talloc_set_destructor(old, track_free);
1220
1221 old->discard = true; /* don't send any reply, there's nowhere for it to go */
1222 }
1223
1224do_insert:
1225 if (!fr_rb_insert(client->table, track)) {
1226 fr_assert(0);
1227 }
1228
1229 client->packets++;
1230 talloc_set_destructor(track, track_dedup_free);
1231 return track;
1232}
1233
1234
1235static int pending_free(fr_io_pending_packet_t *pending)
1236{
1237 fr_io_track_t *track = pending->track;
1238
1239 /*
1240 * Note that we don't check timestamps, replies, etc. If
1241 * a packet is pending, then any conflicting packet gets
1242 * the "pending" entry marked as such, and a new entry
1243 * added. Any duplicate packet gets suppressed. And
1244 * because the packets are pending, track->reply MUST be
1245 * NULL.
1246 */
1247 fr_assert(track->packets > 0);
1248 track->packets--;
1249
1250 /*
1251 * No more packets using this tracking entry,
1252 * delete it.
1253 */
1254 if (track->packets == 0) talloc_free(track);
1255
1256 return 0;
1257}
1258
1259static fr_io_pending_packet_t *fr_io_pending_alloc(fr_io_connection_t *connection, fr_io_client_t *client,
1260 uint8_t const *buffer, size_t packet_len,
1261 fr_io_track_t *track,
1262 int priority)
1263{
1264 fr_io_pending_packet_t *pending;
1265
1266 MEM(pending = talloc_zero(client->pending, fr_io_pending_packet_t));
1267
1268 MEM(pending->buffer = talloc_memdup(pending, buffer, packet_len));
1269 pending->buffer_len = packet_len;
1270 pending->priority = priority;
1271 pending->track = track;
1272 pending->recv_time = track->timestamp; /* there can only be one */
1273
1274 talloc_set_destructor(pending, pending_free);
1275
1276 /*
1277 * Insert the pending packet for this client. If it
1278 * fails, silently discard the packet.
1279 */
1280 if (fr_heap_insert(&client->pending, pending) < 0) {
1281 talloc_free(pending);
1282 return NULL;
1283 }
1284
1285 /*
1286 * We only track pending packets for the
1287 * main socket. For connected sockets,
1288 * we pause the FD, so the number of
1289 * pending packets will always be small.
1290 */
1291 if (!connection) client->thread->num_pending_packets++;
1292
1293 return pending;
1294}
1295
1296
1297/*
1298 * Order clients in the alive_clients heap, based on their IP
1299 * address.
1300 *
1301 * This function is only used for the "main" socket. Clients
1302 * from connections do not use it.
1303 */
1304static int8_t alive_client_cmp(void const *one, void const *two)
1305{
1306 fr_io_client_t const *a = talloc_get_type_abort_const(one, fr_io_client_t);
1307 fr_io_client_t const *b = talloc_get_type_abort_const(two, fr_io_client_t);
1308
1309 return fr_ipaddr_cmp(&a->src_ipaddr, &b->src_ipaddr);
1310}
1311
1312/** Implement 99% of the read routines.
1313 *
1314 * The app_io->read does the transport-specific data read.
1315 */
1316static ssize_t mod_read(fr_listen_t *li, void **packet_ctx, fr_time_t *recv_time_p,
1317 uint8_t *buffer, size_t buffer_len, size_t *leftover)
1318{
1319 fr_io_instance_t const *inst;
1320 fr_io_thread_t *thread;
1321 ssize_t packet_len = -1;
1322 fr_time_t recv_time = fr_time_wrap(0);
1323 fr_io_client_t *client;
1324 fr_io_address_t address;
1325 fr_io_connection_t my_connection, *connection;
1326 fr_io_pending_packet_t *pending = NULL;
1327 fr_io_track_t *track;
1328 fr_listen_t *child;
1329 int value, accept_fd = -1;
1330 uint32_t priority = PRIORITY_NORMAL;
1331
1332/** Log that we ignore clients in debug mode, or when it's enabled for a listener
1333 */
1334#define LOG_IGNORED_CLIENTS(_inst) ((_inst)->log_ignored_clients || fr_debug_lvl >= 1)
1335
1336 get_inst(li, &inst, &thread, &connection, &child);
1337
1338 track = NULL;
1339
1340 /*
1341 * There was data left over from the previous read, go
1342 * get the rest of it now. We MUST do this instead of
1343 * popping a pending packet, because the leftover bytes
1344 * are already in the output buffer.
1345 */
1346 if (*leftover) goto do_read;
1347
1348redo:
1349 /*
1350 * Read one pending packet. The packet may be pending
1351 * because of dynamic client definitions, or because it's
1352 * for a connected UDP socket, and was sent over by the
1353 * "master" UDP socket.
1354 */
1355 if (connection) {
1356 /*
1357 * The connection is dead. Tell the network side
1358 * to close it.
1359 */
1360 if (connection->dead) {
1361 DEBUG("Dead connection %s", connection->name);
1362 return -1;
1363 }
1364
1365 pending = fr_heap_pop(&connection->client->pending);
1366
1367 } else if (thread->pending_clients) {
1368 pending = pending_packet_pop(thread);
1369
1370 } else {
1371 pending = NULL;
1372 }
1373
1374 if (pending) {
1375 fr_assert(buffer_len >= pending->buffer_len);
1376 track = pending->track;
1377
1378 /*
1379 * Clear the destructor as we now own the
1380 * tracking entry.
1381 */
1382 talloc_set_destructor(pending, NULL);
1383
1384 /*
1385 * We received a conflicting packet while this
1386 * packet was pending. Discard this entry and
1387 * try to get another one.
1388 *
1389 * Note that the pending heap is *simple*. We
1390 * just track priority and recv_time. This means
1391 * it's fast, but also that it's hard to look up
1392 * random packets in the pending heap.
1393 */
1394 if (fr_time_neq(pending->recv_time, track->timestamp)) {
1395 DEBUG3("Discarding old packet");
1396 TALLOC_FREE(pending);
1397 goto redo;
1398 }
1399
1400 /*
1401 * We have a valid packet. Copy it over to the
1402 * caller, and return.
1403 */
1404 *packet_ctx = track;
1405 *leftover = 0;
1406 recv_time = *recv_time_p = pending->recv_time;
1407 client = track->client;
1408
1409 memcpy(buffer, pending->buffer, pending->buffer_len);
1410 packet_len = pending->buffer_len;
1411
1412 /*
1413 * Shouldn't be necessary, but what the heck...
1414 */
1415 memcpy(&address, track->address, sizeof(address));
1416 TALLOC_FREE(pending);
1417
1418 /*
1419 * Skip over all kinds of logic to find /
1420 * allocate the client, when we don't need to do
1421 * it any more.
1422 */
1423 goto have_client;
1424
1425 } else if (!connection && (inst->ipproto == IPPROTO_TCP)) {
1426 struct sockaddr_storage saremote;
1427 socklen_t salen;
1428
1429 salen = sizeof(saremote);
1430
1431 /*
1432 * We're a TCP socket but are NOT connected. We
1433 * must be the master socket. Accept the new
1434 * connection, and figure out src/dst IP/port.
1435 */
1436 accept_fd = accept(child->fd,
1437 (struct sockaddr *) &saremote, &salen);
1438
1439 /*
1440 * Couldn't open a NEW socket, but THIS ONE is
1441 * OK. So don't return -1.
1442 */
1443 if (accept_fd < 0) {
1444 RATE_LIMIT_LOCAL(&thread->rate_limit.accept_failed,
1445 INFO, "proto_%s - failed to accept new socket: %s",
1446 inst->app->common.name, fr_syserror(errno));
1447 return 0;
1448 }
1449
1450 /*
1451 * Set the new descriptor to be non-blocking.
1452 */
1453 (void) fr_nonblock(accept_fd);
1454
1455#ifdef STATIC_ANALYZER
1456 saremote.ss_family = AF_INET; /* static analyzer doesn't know that accept() initializes this */
1457#endif
1458
1459 /*
1460 * Get IP addresses only if we have IP addresses.
1461 */
1462 if ((saremote.ss_family == AF_INET) || (saremote.ss_family == AF_INET6)) {
1463 memset(&address.socket, 0, sizeof(address.socket));
1464 (void) fr_ipaddr_from_sockaddr(&address.socket.inet.src_ipaddr, &address.socket.inet.src_port,
1465 &saremote, salen);
1466 salen = sizeof(saremote);
1467
1468 /*
1469 * @todo - only if the local listen address is "*".
1470 */
1471 (void) getsockname(accept_fd, (struct sockaddr *) &saremote, &salen);
1472 (void) fr_ipaddr_from_sockaddr(&address.socket.inet.dst_ipaddr, &address.socket.inet.dst_port,
1473 &saremote, salen);
1474 address.socket.type = (inst->ipproto == IPPROTO_TCP) ? SOCK_STREAM : SOCK_DGRAM;
1475 address.socket.fd = accept_fd;
1476 }
1477
1478 } else {
1479 fr_io_address_t *local_address;
1480
1481 /*
1482 * We're either not a TCP socket, or we are a
1483 * connected TCP socket. Just read it.
1484 */
1485do_read:
1486 local_address = &address;
1487
1488 /*
1489 * @todo - For connected TCP sockets which are
1490 * dynamically defined, the app_io read()
1491 * function should stop reading the socket if the
1492 * server is busy. That change puts TCP
1493 * backpressure on the client.
1494 *
1495 * @todo TLS - for TLS and dynamic sockets, do
1496 * the SSL setup here, but have a structure which
1497 * describes the TLS data and run THAT through
1498 * the dynamic client definition, instead of
1499 * using normal packets. Or, rely on the app_io
1500 * read() function to do all TLS work? Given
1501 * that some protocols have "starttls" beginning
1502 * after a clear-text exchange, it's likely best
1503 * to have yet another layer of trampoline
1504 * functions which do all of the TLS work.
1505 */
1506 packet_len = inst->app_io->read(child, (void **) &local_address, &recv_time,
1507 buffer, buffer_len, leftover);
1508 if (packet_len <= 0) {
1509 return packet_len;
1510 }
1511
1512 /*
1513 * Not allowed? Discard it. The priority()
1514 * function has done any complaining, if
1515 * necessary.
1516 */
1517 if (inst->app->priority) {
1518 value = inst->app->priority(inst->app_instance, buffer, packet_len);
1519 if (value <= 0) {
1520 static fr_rate_limit_t bad_type;
1521
1522 /*
1523 * @todo - unix sockets. We need to use
1524 * the "name" of the socket, in the
1525 * listener?
1526 */
1527 if (LOG_IGNORED_CLIENTS(inst)) {
1528 RATE_LIMIT_LOCAL(thread ? &thread->rate_limit.bad_type : &bad_type, INFO,
1529 "proto_%s - ignoring packet from IP %pV. It is not configured as 'type = ...'",
1530 inst->app_io->common.name, fr_box_ipaddr(address.socket.inet.src_ipaddr));
1531 }
1532 return 0;
1533 }
1534 priority = value;
1535 }
1536
1537 /*
1538 * If the connection is pending, pause reading of
1539 * more packets. If mod_write() accepts the
1540 * connection, it will resume reading.
1541 * Otherwise, it will close the socket without
1542 * resuming it.
1543 */
1544 if (connection &&
1545 (connection->client->state == PR_CLIENT_PENDING)) {
1546 fr_assert(!connection->paused);
1547
1548 connection->paused = true;
1549 (void) fr_event_filter_update(connection->el,
1550 child->fd,
1551 FR_EVENT_FILTER_IO, pause_read);
1552 }
1553 }
1554
1555 /*
1556 * Look up the client, unless we already have one (for a
1557 * connected socket).
1558 */
1559 if (!connection) {
1560 client = fr_trie_lookup_by_key(thread->trie,
1561 &address.socket.inet.src_ipaddr.addr, address.socket.inet.src_ipaddr.prefix);
1562 fr_assert(!client || !client->connection);
1563
1564 } else {
1565 client = connection->client;
1566
1567 /*
1568 * We don't care what the read function says
1569 * about address. We have it already.
1570 */
1571 address = *connection->address;
1572 }
1573
1574 /*
1575 * Negative cache entry. Drop the packet.
1576 */
1577 if (client && client->state == PR_CLIENT_NAK) {
1578 if (accept_fd >= 0) close(accept_fd);
1579 return 0;
1580 }
1581
1582 /*
1583 * If there's no client, try to pull one from the global
1584 * / static client list. Or if dynamic clients are
1585 * allowed, try to define a dynamic client.
1586 */
1587 if (!client) {
1588 fr_client_t *radclient = NULL;
1589 fr_io_client_state_t state;
1590 fr_ipaddr_t const *network = NULL;
1591 char const *error;
1592
1593 /*
1594 * We MUST be the master socket.
1595 */
1596 fr_assert(!connection);
1597
1598 radclient = inst->app_io->client_find(thread->child, &address.socket.inet.src_ipaddr, inst->ipproto);
1599 if (radclient) {
1600 state = PR_CLIENT_STATIC;
1601
1602 /*
1603 * Make our own copy that we can modify it.
1604 */
1605 MEM(radclient = radclient_clone(thread, radclient));
1606 radclient->active = true;
1607
1608 } else if (inst->dynamic_clients) {
1609 if (inst->max_clients && (fr_heap_num_elements(thread->alive_clients) >= inst->max_clients)) {
1610 error = "Too many dynamic clients have been defined";
1611 goto ignore;
1612 }
1613
1614 /*
1615 * Look up the allowed networks.
1616 */
1617 network = fr_trie_lookup_by_key(inst->networks, &address.socket.inet.src_ipaddr.addr,
1618 address.socket.inet.src_ipaddr.prefix);
1619 if (!network) {
1620 error = "Address is outside of the the 'allow' network range";
1621 goto ignore;
1622 }
1623
1624 /*
1625 * It exists, but it's a "deny" rule, ignore it.
1626 */
1627 if (network->af == AF_UNSPEC) {
1628 error = "Address is forbidden by the 'deny' network range";
1629 goto ignore;
1630 }
1631
1632 /*
1633 * Allocate our local radclient as a
1634 * placeholder for the dynamic client.
1635 */
1636 radclient = radclient_alloc(thread, inst->ipproto, &address);
1637 state = PR_CLIENT_PENDING;
1638
1639 } else {
1640 char const *msg;
1641
1642 error = "No matching 'client' definition was found";
1643
1644 ignore:
1645 if (accept_fd < 0) {
1646 msg = "packet";
1647 } else {
1648 msg = "connection attempt";
1649 close(accept_fd);
1650 }
1651
1652 if (LOG_IGNORED_CLIENTS(inst)) {
1653 static fr_rate_limit_t unknown_client;
1654 RATE_LIMIT_LOCAL(thread ? &thread->rate_limit.unknown_client : &unknown_client,
1655 ERROR, "proto_%s - Ignoring %s from IP address %pV - %s",
1656 inst->app_io->common.name, msg, fr_box_ipaddr(address.socket.inet.src_ipaddr),
1657 error);
1658 }
1659
1660 return 0;
1661 }
1662
1663 MEM(client = client_alloc(thread, state, inst, thread, radclient, network));
1664 }
1665
1666have_client:
1667 fr_assert(client->state != PR_CLIENT_INVALID);
1668 fr_assert(client->state != PR_CLIENT_NAK);
1669
1670 /*
1671 * We've accepted a new connection. Go allocate it, and
1672 * let it read from the socket.
1673 */
1674 if (accept_fd >= 0) {
1675 if (!fr_io_connection_alloc(inst, thread, client, accept_fd, &address, NULL)) {
1676 static fr_rate_limit_t alloc_failed;
1677
1678 RATE_LIMIT_LOCAL(thread ? &thread->rate_limit.conn_alloc_failed : &alloc_failed,
1679 ERROR, "Failed to allocate connection from client %s", client->radclient->shortname);
1680 }
1681
1682 return 0;
1683 }
1684
1685 /*
1686 * No connected sockets, OR we are the connected socket.
1687 *
1688 * Track this packet and return it if necessary.
1689 */
1690 if (connection || !client->use_connected) {
1691 fr_io_track_t *to_free = NULL;
1692
1693 /*
1694 * Add the packet to the tracking table, if it's
1695 * not already there. Pending packets will be in
1696 * the tracking table, but won't be counted as
1697 * "live" packets.
1698 */
1699 if (!track) {
1700 static fr_rate_limit_t tracking_failed;
1701 bool is_dup = false;
1702
1703 track = fr_io_track_add(client, &address, buffer, packet_len, recv_time, &is_dup);
1704 if (!track) {
1705 RATE_LIMIT_LOCAL(thread ? &thread->rate_limit.tracking_failed : &tracking_failed,
1706 ERROR, "Failed tracking packet from client %s - discarding it",
1707 client->radclient->shortname);
1708 return 0;
1709 }
1710
1711 /*
1712 * If there's a cached reply, just send that and don't do anything else.
1713 */
1714 if (is_dup) {
1715 fr_network_t *nr;
1716
1717 if (track->do_not_respond) {
1718 DEBUG("Ignoring retransmit from client %s - we are not responding to this request", client->radclient->shortname);
1719 return 0;
1720 }
1721
1722 if (track->discard) {
1723 DEBUG("Ignoring transmit from client %s - we previously received a newer / conflicting packet", client->radclient->shortname);
1724 return 0;
1725 }
1726
1727 if (!track->reply) {
1728 fr_assert(!track->finished);
1729 DEBUG("Ignoring retransmit from client %s - we are still processing the request", client->radclient->shortname);
1730 return 0;
1731 }
1732
1733 if (connection) {
1734 nr = connection->nr;
1735 } else {
1736 nr = thread->nr;
1737 }
1738
1739 /*
1740 * @todo - mark things up so that we know to keep 'track' around
1741 * until the packet is actually written to the network. OR, add
1742 * a network API so that the talloc_free() function can remove
1743 * the packet from the queue of packets to be retransmitted.
1744 *
1745 * Perhaps via having fr_network_listen_write() return a pointer
1746 * to the localized message, and then caching that in the tracking
1747 * structure.
1748 */
1749 DEBUG("Sending duplicate reply to client %s", client->radclient->shortname);
1750 fr_network_listen_write(nr, li, track->reply, track->reply_len,
1751 track, track->timestamp);
1752 return 0;
1753 }
1754
1755 /*
1756 * Got to free this if we don't process the packet.
1757 */
1758 to_free = track;
1759 }
1760
1761 /*
1762 * This is a pending dynamic client. See if we
1763 * have to either run the dynamic client code to
1764 * define the client, OR to push the packet onto
1765 * the pending queue for this client.
1766 */
1767 if (client->state == PR_CLIENT_PENDING) {
1768 /*
1769 * Track pending packets for the master
1770 * socket. Connected sockets are paused
1771 * as soon as they are defined, so we
1772 * won't be reading any more packets from
1773 * them.
1774 *
1775 * Since we don't have pending packets
1776 * for connected sockets, we don't need
1777 * to track pending packets.
1778 */
1779 if (!connection && inst->max_pending_packets && (thread->num_pending_packets >= inst->max_pending_packets)) {
1780 RATE_LIMIT_LOCAL(&thread->rate_limit.too_many_pending,
1781 ERROR, "Too many pending dynamic client packets for listener - discarding packet from %pV",
1782 fr_box_ipaddr(client->src_ipaddr));
1783
1784 discard:
1785 talloc_free(to_free);
1786 return 0;
1787 }
1788
1789 /*
1790 * Allocate the pending packet structure.
1791 */
1792 pending = fr_io_pending_alloc(connection, client, buffer, packet_len,
1793 track, priority);
1794 if (!pending) {
1795 static fr_rate_limit_t alloc_failed;
1796 RATE_LIMIT_LOCAL(thread ? &thread->rate_limit.alloc_failed : &alloc_failed,
1797 ERROR, "proto_%s - Failed allocating space for dynamic client %pV - discarding packet",
1798 inst->app_io->common.name, fr_box_ipaddr(client->src_ipaddr));
1799 goto discard;
1800 }
1801
1802 if (fr_heap_num_elements(client->pending) > 1) {
1803 DEBUG("Verification is still pending for dynamic client %pV - queuing additional packet(s)",
1804 fr_box_ipaddr(client->src_ipaddr));
1805 return 0;
1806 }
1807
1808 /*
1809 * Tell this packet that it's defining a
1810 * dynamic client.
1811 */
1812 track->dynamic = recv_time;
1813
1814 INFO("proto_%s - Verification started for packet from dynamic client %pV - queuing new packets",
1815 inst->app_io->common.name, fr_box_ipaddr(client->src_ipaddr));
1816 }
1817
1818 /*
1819 * Remove all cleanup timers for the client /
1820 * connection. It's still in use, so we don't
1821 * want to clean it up.
1822 */
1823 if (fr_timer_armed(client->ev)) {
1824 FR_TIMER_DELETE_RETURN(&client->ev);
1825 client->ready_to_delete = false;
1826 }
1827
1828 /*
1829 * Return the packet.
1830 */
1831 *recv_time_p = track->timestamp;
1832 *packet_ctx = track;
1833 return packet_len;
1834 }
1835
1836 /*
1837 *
1838 */
1839 fr_assert(!pending);
1840
1841 /*
1842 * This must be the main UDP socket which creates
1843 * connections.
1844 */
1845 fr_assert(inst->ipproto == IPPROTO_UDP);
1846
1847 /*
1848 * We're using connected sockets, but this socket isn't
1849 * connected. It must be the master socket. The master
1850 * can either be STATIC, DYNAMIC, or PENDING. Whatever
1851 * the state, the child socket will take care of handling
1852 * the packet. e.g. dynamic clients, etc.
1853 */
1854 {
1855 bool nak = false;
1856
1857 my_connection.address = &address;
1858
1859 pthread_mutex_lock(&client->mutex);
1860 connection = fr_hash_table_find(client->ht, &my_connection);
1861 if (connection) nak = (connection->client->state == PR_CLIENT_NAK);
1862 pthread_mutex_unlock(&client->mutex);
1863
1864 /*
1865 * The connection is in NAK state, ignore packets
1866 * for it.
1867 */
1868 if (nak) {
1869 RATE_LIMIT_LOCAL(&thread->rate_limit.repeat_nak, ERROR, "proto_%s - Discarding repeated packet from NAK'd dynamic client %pV",
1870 inst->app_io->common.name, fr_box_ipaddr(address.socket.inet.src_ipaddr));
1871
1872 DEBUG("Discarding packet to NAKed connection %s", connection->name);
1873 return 0;
1874 }
1875 }
1876
1877 /*
1878 * No existing connection, create one.
1879 */
1880 if (!connection) {
1881 connection = fr_io_connection_alloc(inst, thread, client, -1, &address, NULL);
1882 if (!connection) {
1883 RATE_LIMIT_LOCAL(&thread->rate_limit.conn_alloc_failed,
1884 ERROR, "Failed to allocate connection from client %s. Discarding packet.", client->radclient->shortname);
1885 return 0;
1886 }
1887 }
1888
1889 DEBUG("Sending packet to connection %s", connection->name);
1890
1891 /*
1892 * Inject the packet into the connected socket. It will
1893 * process the packet as if it came in from the network.
1894 *
1895 * @todo future - after creating the connection, put the
1896 * current packet into connection->pending, instead of
1897 * inject?, and then call fr_network_listen_read() from
1898 * the child's instantiation routine???
1899 *
1900 * @todo TCP - for ACCEPT sockets, we don't have a
1901 * packet, so don't do this. Instead, the connection
1902 * will take care of figuring out what to do.
1903 *
1904 * We don't need "to_free" after this, as it will be
1905 * tracked in the connected socket.
1906 */
1907 if (fr_network_listen_inject(connection->nr, connection->listen,
1908 buffer, packet_len, recv_time) < 0) {
1909 RATE_LIMIT_LOCAL(&thread->rate_limit.queue_full, PERROR,
1910 "proto_%s - Discarding packet from dynamic client %pV - cannot push packet to connected socket",
1911 inst->app_io->common.name, fr_box_ipaddr(address.socket.inet.src_ipaddr));
1912 /*
1913 * Don't return an error, because that will cause the listener to close its socket.
1914 */
1915 }
1916
1917 return 0;
1918}
1919
1920/** Inject a packet to a connection.
1921 *
1922 * Always called in the context of the network.
1923 */
1924static int mod_inject(fr_listen_t *li, uint8_t const *buffer, size_t buffer_len, fr_time_t recv_time)
1925{
1926 fr_io_instance_t const *inst;
1927 int priority;
1928 bool is_dup = false;
1929 fr_io_connection_t *connection;
1930 fr_io_pending_packet_t *pending;
1931 fr_io_track_t *track;
1932
1933 get_inst(li, &inst, NULL, &connection, NULL);
1934
1935 if (!connection) {
1936 DEBUG2("Received injected packet for an unconnected socket.");
1937 return -1;
1938 }
1939
1940 priority = inst->app->priority(inst, buffer, buffer_len);
1941 if (priority <= 0) {
1942 return -1;
1943 }
1944
1945 /*
1946 * Track this packet, because that's what mod_read expects.
1947 */
1948 track = fr_io_track_add(connection->client, connection->address,
1949 buffer, buffer_len, recv_time, &is_dup);
1950 if (!track) {
1951 DEBUG2("Failed injecting packet to tracking table");
1952 return -1;
1953 }
1954
1955 talloc_get_type_abort(track, fr_io_track_t);
1956
1957 /*
1958 * @todo future - what to do with duplicates?
1959 */
1960 fr_assert(!is_dup);
1961
1962 /*
1963 * Remember to restore this packet later.
1964 */
1965 pending = fr_io_pending_alloc(connection, connection->client, buffer, buffer_len,
1966 track, priority);
1967 if (!pending) {
1968 DEBUG2("Failed injecting packet due to allocation error");
1969 return -1;
1970 }
1971
1972 return 0;
1973}
1974
1975/** Open a new listener
1976 *
1977 */
1978static int mod_open(fr_listen_t *li)
1979{
1980 fr_io_thread_t *thread;
1981 fr_io_instance_t const *inst;
1982
1983 thread = li->thread_instance;
1984 inst = li->app_io_instance;
1985
1986 if (inst->app_io->open(thread->child) < 0) return -1;
1987
1988 li->fd = thread->child->fd; /* copy this back up */
1989
1990 /*
1991 * Set the name of the socket.
1992 */
1993 if (!li->app_io->get_name) {
1994 li->name = li->app_io->common.name;
1995 } else {
1996 li->name = li->app_io->get_name(li);
1997 }
1998
1999 /*
2000 * Note that we're opening a child socket, so we don't
2001 * put it into the list of global listeners.
2002 */
2003
2004 return 0;
2005}
2006
2007
2008/** Set the event list for a new socket
2009 *
2010 * @param[in] li the listener
2011 * @param[in] el the event list
2012 * @param[in] nr context from the network side
2013 */
2014static void mod_event_list_set(fr_listen_t *li, fr_event_list_t *el, void *nr)
2015{
2016 fr_io_instance_t const *inst;
2017 fr_io_connection_t *connection;
2018 fr_io_thread_t *thread;
2019 fr_listen_t *child;
2020
2021 get_inst(li, &inst, &thread, &connection, &child);
2022
2023 /*
2024 * We're not doing IO, so there are no timers for
2025 * cleaning up packets, dynamic clients, or connections.
2026 */
2027 if (!inst->submodule) return;
2028
2029 if (inst->app_io->event_list_set) {
2030 inst->app_io->event_list_set(child, el, nr);
2031 }
2032
2033 /*
2034 * Set event list and network side for this socket.
2035 */
2036 if (!connection) {
2037 thread->el = el;
2038 thread->nr = nr;
2039
2040 } else {
2041 connection->el = el;
2042 connection->nr = nr;
2043 }
2044}
2045
2046
2047static void client_expiry_timer(fr_timer_list_t *tl, fr_time_t now, void *uctx)
2048{
2049 fr_io_client_t *client = talloc_get_type_abort(uctx, fr_io_client_t);
2050 fr_io_instance_t const *inst;
2051 fr_io_connection_t *connection;
2052 fr_time_delta_t delay;
2053 int connections;
2054
2055 /*
2056 * No event list? We don't need to expire the client.
2057 */
2058 if (!tl) return;
2059
2060 // @todo - print out what we plan on doing next
2061 connection = client->connection;
2062 inst = client->inst;
2063
2064 fr_assert(client->state != PR_CLIENT_STATIC);
2065
2066 /*
2067 * Called from the read or write functions with
2068 * now==0, to signal that we have to *set* the timer.
2069 */
2070 if (fr_time_eq(now, fr_time_wrap(0))) {
2071 /*
2072 * The timer is already set, don't do anything.
2073 */
2074 if (fr_timer_armed(client->ev)) return;
2075
2076 switch (client->state) {
2077 case PR_CLIENT_CONNECTED:
2078 fr_assert(connection != NULL);
2079 delay = inst->idle_timeout;
2080 if (fr_time_delta_ispos(client->radclient->limit.idle_timeout) &&
2081 (fr_time_delta_lt(client->radclient->limit.idle_timeout, inst->idle_timeout))) {
2082 delay = client->radclient->limit.idle_timeout;
2083 }
2084 break;
2085
2086 case PR_CLIENT_DYNAMIC:
2087 delay = inst->dynamic_timeout;
2088 break;
2089
2090 case PR_CLIENT_NAK:
2091 delay = inst->nak_lifetime;
2092 break;
2093
2094 default:
2095 fr_assert(0 == 1);
2096 return;
2097 }
2098
2099 DEBUG("TIMER - setting idle timeout to %pVs for connection from client %s", fr_box_time_delta(delay), client->radclient->shortname);
2100
2101 goto reset_timer;
2102 }
2103
2104 /*
2105 * It's a negative cache entry. Just delete it.
2106 */
2107 if (client->state == PR_CLIENT_NAK) {
2108 INFO("proto_%s - Expiring NAK'd dynamic client %pV - permitting new packets to be verified",
2109 inst->app_io->common.name, fr_box_ipaddr(client->src_ipaddr));
2110
2111 delete_client:
2112 fr_assert(client->packets == 0);
2113
2114 /*
2115 * It's a connected socket. Remove it from the
2116 * parents list of connections, and delete it.
2117 */
2118 if (connection) {
2119 pthread_mutex_lock(&connection->parent->mutex);
2120 if (connection->in_parent_hash) {
2121 connection->in_parent_hash = false;
2122 (void) fr_hash_table_delete(connection->parent->ht, connection);
2123 }
2124 pthread_mutex_unlock(&connection->parent->mutex);
2125
2126 /*
2127 * Mark the connection as dead, and tell
2128 * the network side to stop reading from
2129 * it.
2130 */
2131 connection->dead = true;
2132 fr_network_listen_read(connection->nr, connection->listen);
2133 return;
2134 }
2135
2136 talloc_free(client);
2137 return;
2138 }
2139
2140 DEBUG("TIMER - checking status of dynamic client %s %pV", client->radclient->shortname, fr_box_ipaddr(client->src_ipaddr));
2141
2142 /*
2143 * It's a dynamically defined client. If no one is using
2144 * it, clean it up after an idle timeout.
2145 */
2146 if ((client->state == PR_CLIENT_DYNAMIC) ||
2147 (client->state == PR_CLIENT_CONNECTED)) {
2148 if (client->packets > 0) {
2149 client->ready_to_delete = false;
2150 return;
2151 }
2152
2153 /*
2154 * No packets, check / set idle timeout.
2155 */
2156 goto idle_timeout;
2157 }
2158
2159 /*
2160 * The client is pending definition. It's either a
2161 * dynamic client which has timed out, OR it's a
2162 * "place-holder" client for connected sockets.
2163 */
2164 fr_assert(client->state == PR_CLIENT_PENDING);
2165
2166 /*
2167 * This is a dynamic client pending definition.
2168 * But it's taken too long to define, so we just
2169 * delete the client, and all packets for it. A
2170 * new packet will cause the dynamic definition
2171 * to be run again.
2172 */
2173 if (!client->use_connected) {
2174 if (!client->packets) {
2175 DEBUG("proto_%s - No packets are using unconnected socket %s", inst->app_io->common.name, connection->name);
2176 goto delete_client;
2177 }
2178
2179 /*
2180 * Tell the writer to NOT dynamically define the
2181 * client. We've run into a problem. Then,
2182 * return. The writer will take care of calling
2183 * us again when it notices that a PENDING client
2184 * is ready to delete.
2185 *
2186 * TBH... that shouldn't happen? We should rely
2187 * on the write to do this all of the time...
2188 */
2189 client->ready_to_delete = true;
2190 return;
2191 }
2192
2193 fr_assert(!connection);
2194
2195 /*
2196 * Find out how many connections are using this
2197 * client.
2198 */
2199 pthread_mutex_lock(&client->mutex);
2200 fr_assert(client->ht != NULL);
2201 connections = fr_hash_table_num_elements(client->ht);
2202 pthread_mutex_unlock(&client->mutex);
2203
2204 /*
2205 * No connections are using this client. If
2206 * we've passed the idle timeout, then just
2207 * delete it. Otherwise, set an idle timeout (as
2208 * above);
2209 */
2210 if (!connections) {
2211idle_timeout:
2212 /*
2213 * We didn't receive any packets during the
2214 * idle_timeout, just delete it.
2215 */
2216 if (client->ready_to_delete) {
2217 if (connection) {
2218 DEBUG("proto_%s - idle timeout for connection %s", inst->app_io->common.name, connection->name);
2219 } else {
2220 DEBUG("proto_%s - idle timeout for client %s", inst->app_io->common.name, client->radclient->shortname);
2221 }
2222 goto delete_client;
2223 }
2224
2225 /*
2226 * No packets and no idle timeout set, go set
2227 * idle timeut.
2228 */
2229 client->ready_to_delete = true;
2230 delay = client->state == PR_CLIENT_DYNAMIC ? inst->dynamic_timeout : inst->idle_timeout;
2231 goto reset_timer;
2232 }
2233
2234 /*
2235 * There are live sub-connections. Poll again after a
2236 * long period of time. Once all of the connections are
2237 * closed, we can then delete this client.
2238 *
2239 * @todo - maybe just leave it? we want to be able to
2240 * clean up this client after a while tho... especially
2241 * if the total number of clients is limited.
2242 */
2243 client->ready_to_delete = false;
2244 delay = inst->check_interval;
2245
2246reset_timer:
2247 if (fr_timer_in(client, tl, &client->ev,
2248 delay, false, client_expiry_timer, client) < 0) {
2249 ERROR("proto_%s - Failed adding timeout for dynamic client %s. It will be permanent!",
2250 inst->app_io->common.name, client->radclient->shortname);
2251 return;
2252 }
2253
2254 return;
2255}
2256
2257
2258/*
2259 * Expire cached packets after cleanup_delay time
2260 */
2261static void packet_expiry_timer(fr_timer_list_t *tl, fr_time_t now, void *uctx)
2262{
2263 fr_io_track_t *track = talloc_get_type_abort(uctx, fr_io_track_t);
2264 fr_io_client_t *client = track->client;
2265 fr_io_instance_t const *inst = client->inst;
2266
2267 /*
2268 * Insert the timer if requested.
2269 *
2270 * On duplicates this also extends the expiry timer.
2271 */
2272 if (fr_time_eq(now, fr_time_wrap(0)) && !track->discard && inst->app_io->track_duplicates) {
2273 fr_assert(fr_time_delta_ispos(inst->cleanup_delay));
2274 fr_assert(track->do_not_respond || track->reply_len);
2275
2276 track->expires = fr_time_add(fr_time(), inst->cleanup_delay);
2277
2278 /*
2279 * if the timer succeeds, then "track"
2280 * will be cleaned up when the timer
2281 * fires.
2282 */
2283 if (fr_timer_at(track, tl, &track->ev,
2284 track->expires,
2285 false, packet_expiry_timer, track) == 0) {
2286 DEBUG("proto_%s - cleaning up request in %.6fs", inst->app_io->common.name,
2287 fr_time_delta_unwrap(inst->cleanup_delay) / (double)NSEC);
2288 return;
2289 }
2290
2291 DEBUG("proto_%s - Failed adding cleanup_delay for packet. Discarding packet immediately",
2292 inst->app_io->common.name);
2293 }
2294
2295 /*
2296 * So that all cleanup paths can come here, not just the
2297 * timeout ones.
2298 */
2299 if (fr_time_neq(now, fr_time_wrap(0))) {
2300 DEBUG2("TIMER - proto_%s - cleanup delay", inst->app_io->common.name);
2301 } else {
2302 DEBUG2("proto_%s - cleaning up", inst->app_io->common.name);
2303 }
2304
2305 /*
2306 * Delete the tracking entry.
2307 */
2308 talloc_free(track);
2309
2310 /*
2311 * The client isn't dynamic, stop here.
2312 */
2313 if (client->state == PR_CLIENT_STATIC) return;
2314
2315 fr_assert(client->state != PR_CLIENT_NAK);
2316 fr_assert(client->state != PR_CLIENT_PENDING);
2317
2318 /*
2319 * If necessary, call the client expiry timer to clean up
2320 * the client.
2321 */
2322 if (client->packets == 0) {
2323 client_expiry_timer(tl, now, client);
2324 }
2325}
2326
2327static ssize_t mod_write(fr_listen_t *li, void *packet_ctx, fr_time_t request_time,
2328 uint8_t *buffer, size_t buffer_len, size_t written)
2329{
2330 fr_io_instance_t const *inst;
2331 fr_io_thread_t *thread;
2332 fr_io_connection_t *connection;
2333 fr_io_track_t *track = talloc_get_type_abort(packet_ctx, fr_io_track_t);
2334 fr_io_client_t *client;
2335 fr_client_t *radclient;
2336 fr_listen_t *child;
2337 fr_event_list_t *el;
2338 char const *name;
2339
2340 get_inst(li, &inst, &thread, &connection, &child);
2341
2342 client = track->client;
2343 if (connection) {
2344 el = connection->el;
2345 name = connection->name;
2346 } else {
2347 el = thread->el;
2348 name = li->name;
2349 }
2350
2351 DEBUG3("Processing reply for %s", name);
2352
2353 /*
2354 * A fully defined client means that we just send the reply.
2355 */
2356 if (client->state != PR_CLIENT_PENDING) {
2357 ssize_t packet_len;
2358
2359 track->finished = true;
2360
2361 /*
2362 * The request received a conflicting packet, so we
2363 * discard this one.
2364 */
2365 if (fr_time_neq(track->timestamp, request_time) || track->discard) {
2366 fr_assert(track->packets > 0);
2367 track->packets--;
2368 DEBUG3("Suppressing reply as we have a newer / conflicing packet from the same source");
2369 track->discard = true;
2370 goto setup_timer;
2371 }
2372
2373 /*
2374 * We have a NAK packet, or the request has timed
2375 * out, or it was discarded due to a conflicting
2376 * packet. We don't respond, but we do cache the
2377 * "do not respond" reply for a period of time.
2378 */
2379 if ((buffer_len == 1) || track->do_not_respond) {
2380 DEBUG3("Not sending response to request - it is marked as 'do not respond'");
2381 track->do_not_respond = true;
2382 goto setup_timer;
2383 }
2384
2385 /*
2386 * We have a real packet, write it to the network
2387 * via the underlying transport write.
2388 */
2389 packet_len = inst->app_io->write(child, track, request_time,
2390 buffer, buffer_len, written);
2391 if (packet_len <= 0) {
2392 ERROR("Failed writing the reply - not sending any response on %s", name);
2393 track->discard = true;
2394 packet_expiry_timer(el->tl, fr_time_wrap(0), track);
2395 return packet_len;
2396 }
2397
2398 /*
2399 * Only a partial write. The network code will
2400 * take care of calling us again, and we will set
2401 * the expiry timer at that point.
2402 */
2403 if ((size_t) packet_len < buffer_len) {
2404 DEBUG3("Partial write (%zd < %zu)", packet_len, buffer_len);
2405 return packet_len;
2406 }
2407
2408 /*
2409 * We're not tracking duplicates, so just expire
2410 * the packet now.
2411 */
2412 if (!inst->app_io->track_duplicates) {
2413 DEBUG3("Not tracking duplicates - expiring the request");
2414 goto setup_timer;
2415 }
2416
2417 /*
2418 * Cache the reply packet if we're doing dedup.
2419 *
2420 * On resend duplicate reply, the reply is
2421 * already filled out. So we don't do that twice.
2422 */
2423 if (!track->reply) {
2424 DEBUG3("Caching reply");
2425 MEM(track->reply = talloc_memdup(track, buffer, buffer_len));
2426 track->reply_len = buffer_len;
2427 }
2428
2429 /*
2430 * Set the timer to expire the packet.
2431 *
2432 * On dedup this also extends the timer.
2433 */
2434 setup_timer:
2435 packet_expiry_timer(el->tl, fr_time_wrap(0), track);
2436 return buffer_len;
2437 }
2438
2439 /*
2440 * The client is pending, so we MUST have dynamic clients.
2441 *
2442 * If there's a connected socket and no dynamic clients, then the
2443 * client state is set to CONNECTED when the client is created.
2444 */
2445 fr_assert(inst->dynamic_clients);
2446 fr_assert(client->pending != NULL);
2447
2448 /*
2449 * The request has timed out trying to define the dynamic
2450 * client. Oops... try again.
2451 */
2452 if ((buffer_len == 1) && (*buffer == true)) {
2453 DEBUG("Request has timed out trying to define a new client. Trying again.");
2454 goto reread;
2455 }
2456
2457 /*
2458 * The dynamic client was NOT defined. Set it's state to
2459 * NAK, delete all pending packets, and close the
2460 * tracking table.
2461 */
2462 if (buffer_len == 1) {
2463 INFO("proto_%s - Verification failed for packet from dynamic client %pV - adding IP address to the NAK cache",
2464 inst->app_io->common.name, fr_box_ipaddr(client->src_ipaddr));
2465
2466 client->state = PR_CLIENT_NAK;
2467 if (!connection) {
2468 client_pending_free(client);
2469 } else {
2470 TALLOC_FREE(client->pending);
2471 }
2472 if (client->table) TALLOC_FREE(client->table);
2473 fr_assert(client->packets == 0);
2474
2475 /*
2476 * If we're a connected UDP socket, allocate a
2477 * new connection which is the place-holder for
2478 * the NAK. We will reject packets from from the
2479 * src/dst IP/port.
2480 *
2481 * The timer will take care of deleting the NAK
2482 * connection (which doesn't have any FDs
2483 * associated with it). The network side will
2484 * call mod_close() when the original connection
2485 * is done, which will then free that connection,
2486 * too.
2487 */
2488 if (connection && (inst->ipproto == IPPROTO_UDP)) {
2489 connection = fr_io_connection_alloc(inst, thread, client, -1, connection->address, connection);
2490 client_expiry_timer(el->tl, fr_time_wrap(0), connection->client);
2491
2492 errno = ECONNREFUSED;
2493 return -1;
2494 }
2495
2496 /*
2497 * For connected TCP sockets, we just call the
2498 * expiry timer, which will close and free the
2499 * connection.
2500 */
2501 client_expiry_timer(el->tl, fr_time_wrap(0), client);
2502 return buffer_len;
2503 }
2504
2505 fr_assert(buffer_len == sizeof(radclient));
2506
2507 memcpy(&radclient, buffer, sizeof(radclient));
2508
2509 if (!connection) {
2510 fr_ipaddr_t ipaddr;
2511
2512 /*
2513 * Check the encapsulating network against the
2514 * address that the user wants to use, but only
2515 * for unconnected sockets.
2516 */
2517 if (client->network.af != radclient->ipaddr.af) {
2518 DEBUG("Client IP address %pV IP family does not match the source network %pV of the packet.",
2519 fr_box_ipaddr(radclient->ipaddr), fr_box_ipaddr(client->network));
2520 goto error;
2521 }
2522
2523 /*
2524 * Network prefix is more restrictive than the one given
2525 * by the client... that's bad.
2526 */
2527 if (client->network.prefix > radclient->ipaddr.prefix) {
2528 DEBUG("Client IP address %pV is not within the prefix with the defined network %pV",
2529 fr_box_ipaddr(radclient->ipaddr), fr_box_ipaddr(client->network));
2530 goto error;
2531 }
2532
2533 ipaddr = radclient->ipaddr;
2534 fr_ipaddr_mask(&ipaddr, client->network.prefix);
2535 if (fr_ipaddr_cmp(&ipaddr, &client->network) != 0) {
2536 DEBUG("Client IP address %pV is not within the defined network %pV.",
2537 fr_box_ipaddr(radclient->ipaddr), fr_box_ipaddr(client->network));
2538 goto error;
2539 }
2540
2541 /*
2542 * We can't define dynamic clients as networks (for now).
2543 *
2544 * @todo - If we did allow it, we would have to remove
2545 * this client from the trie, update it's IP address, and
2546 * re-add it. We can PROBABLY do this if this client
2547 * isn't already connected, AND radclient->use_connected
2548 * is true. But that's for later...
2549 */
2550 if (((radclient->ipaddr.af == AF_INET) &&
2551 (radclient->ipaddr.prefix != 32)) ||
2552 ((radclient->ipaddr.af == AF_INET6) &&
2553 (radclient->ipaddr.prefix != 128))) {
2554 ERROR("Cannot define a dynamic client as a network");
2555
2556 error:
2557 talloc_free(radclient);
2558
2559 /*
2560 * Remove the pending client from the trie.
2561 */
2562 fr_assert(!connection);
2563 talloc_free(client);
2564 return buffer_len;
2565 }
2566 }
2567
2568 /*
2569 * The new client is mostly OK. Copy the various fields
2570 * over.
2571 */
2572#define COPY_FIELD(_dest, _x) _dest->radclient->_x = radclient->_x
2573#define DUP_FIELD(_dest, _x) _dest->radclient->_x = talloc_strdup(_dest->radclient, radclient->_x)
2574
2575 /*
2576 * Only these two fields are set. Other strings in
2577 * radclient are copies of these ones.
2578 */
2579 talloc_const_free(client->radclient->shortname);
2580 talloc_const_free(client->radclient->secret);
2581
2582 DUP_FIELD(client, longname);
2583 DUP_FIELD(client, shortname);
2584 DUP_FIELD(client, secret);
2585 DUP_FIELD(client, nas_type);
2586
2587 COPY_FIELD(client, ipaddr);
2588 COPY_FIELD(client, src_ipaddr);
2589 COPY_FIELD(client, require_message_authenticator);
2590 COPY_FIELD(client, require_message_authenticator_is_set);
2591 COPY_FIELD(client, limit_proxy_state);
2592 COPY_FIELD(client, limit_proxy_state_is_set);
2593 COPY_FIELD(client, use_connected);
2594 COPY_FIELD(client, cs);
2595
2596 // @todo - fill in other fields?
2597
2598 talloc_free(radclient);
2599
2600 radclient = client->radclient; /* laziness */
2601 radclient->server_cs = inst->server_cs;
2602 radclient->server = cf_section_name2(inst->server_cs);
2603
2604 /*
2605 * This is a connected socket, and it's just been
2606 * allowed. Go poke the network side to read from the
2607 * socket.
2608 */
2609 if (connection) {
2610 fr_assert(connection != NULL);
2611 fr_assert(connection->client == client);
2612 fr_assert(client->connection != NULL);
2613
2614 client->state = PR_CLIENT_CONNECTED;
2615
2616 /*
2617 * Connections can't spawn new connections.
2618 */
2619 client->use_connected = radclient->use_connected = false;
2620
2621 /*
2622 * If we were paused. resume reading from the
2623 * connection.
2624 *
2625 * Note that the event list doesn't like resuming
2626 * a connection that isn't paused. It just sets
2627 * the read function to NULL.
2628 */
2629 if (connection->paused) {
2630 (void) fr_event_filter_update(el, child->fd,
2631 FR_EVENT_FILTER_IO, resume_read);
2632 }
2633
2634 connection->parent->radclient->active = true;
2635 fr_assert(connection->parent->state == PR_CLIENT_PENDING);
2636 connection->parent->state = PR_CLIENT_DYNAMIC;
2637
2638 DUP_FIELD(connection->parent, longname);
2639 DUP_FIELD(connection->parent, shortname);
2640 DUP_FIELD(connection->parent, secret);
2641 DUP_FIELD(connection->parent, nas_type);
2642
2643 COPY_FIELD(connection->parent, ipaddr);
2644 COPY_FIELD(connection->parent, src_ipaddr);
2645 COPY_FIELD(connection->parent, require_message_authenticator);
2646 COPY_FIELD(connection->parent, require_message_authenticator_is_set);
2647 COPY_FIELD(connection->parent, limit_proxy_state);
2648 COPY_FIELD(connection->parent, limit_proxy_state_is_set);
2649 COPY_FIELD(connection->parent, use_connected);
2650 COPY_FIELD(connection->parent, cs);
2651
2652 /*
2653 * Re-parent the conf section used to build this client
2654 * so its lifetime is linked to parent client
2655 */
2656 talloc_steal(connection->parent->radclient, connection->parent->radclient->cs);
2657
2658 /*
2659 * The client has been allowed.
2660 */
2661 client->state = PR_CLIENT_DYNAMIC;
2662 client->radclient->active = true;
2663
2664 INFO("proto_%s - Verification succeeded for packet from dynamic client %pV - processing queued packets",
2665 inst->app_io->common.name, fr_box_ipaddr(client->src_ipaddr));
2666 goto finish;
2667 } else {
2668 /*
2669 * Re-parent the conf section used to build this client
2670 * so its lifetime is linked to the client
2671 */
2672 talloc_steal(radclient, radclient->cs);
2673 }
2674
2675 fr_assert(connection == NULL);
2676 fr_assert(client->use_connected == false); /* we weren't sure until now */
2677
2678 /*
2679 * Disallow unsupported configurations.
2680 */
2681 if (radclient->use_connected && !inst->app_io->connection_set) {
2682 DEBUG("proto_%s - cannot use connected sockets as underlying 'transport = %s' does not support it.",
2683 inst->app_io->common.name, inst->submodule->module->exported->name);
2684 goto error;
2685 }
2686
2687
2688 /*
2689 * Dynamic clients can spawn new connections.
2690 */
2691 client->use_connected = radclient->use_connected;
2692
2693 /*
2694 * The admin has defined a client which uses connected
2695 * sockets. Go spawn it
2696 */
2697 if (client->use_connected) {
2698 fr_assert(connection == NULL);
2699
2700
2701 /*
2702 * Leave the state as PENDING. Each connection
2703 * will then cause a dynamic client to be
2704 * defined.
2705 */
2706 (void) pthread_mutex_init(&client->mutex, NULL);
2707 MEM(client->ht = fr_hash_table_alloc(client, connection_hash, connection_cmp, NULL));
2708
2709 } else {
2710 /*
2711 * The client has been allowed.
2712 */
2713 client->state = PR_CLIENT_DYNAMIC;
2714 client->radclient->active = true;
2715
2716 INFO("proto_%s - Verification succeeded for packet from dynamic client %pV - processing %d queued packets",
2717 inst->app_io->common.name, fr_box_ipaddr(client->src_ipaddr),
2718 fr_heap_num_elements(client->pending));
2719 }
2720
2721 /*
2722 * Add this client to the master socket, so that
2723 * mod_read() will see the pending client, pop the
2724 * pending packet, and process it.
2725 *
2726 */
2727 if (!thread->pending_clients) {
2728 MEM(thread->pending_clients = fr_heap_alloc(thread, pending_client_cmp,
2729 fr_io_client_t, pending_id, 0));
2730 }
2731
2732 fr_assert(!fr_heap_entry_inserted((client->pending_id)));
2733 (void) fr_heap_insert(&thread->pending_clients, client);
2734
2735finish:
2736 /*
2737 * Maybe we defined the client, but the original packet
2738 * timed out, so there's nothing more to do. In that case, set up the expiry timers.
2739 */
2740 if (client->packets == 0) {
2741 client_expiry_timer(el->tl, fr_time_wrap(0), client);
2742 }
2743
2744reread:
2745 /*
2746 * If there are pending packets (and there should be at
2747 * least one), tell the network socket to call our read()
2748 * function again.
2749 */
2750 if (fr_heap_num_elements(client->pending) > 0) {
2751 if (connection) {
2752 fr_network_listen_read(connection->nr, connection->listen);
2753 } else {
2754 fr_network_listen_read(thread->nr, thread->listen);
2755 }
2756 }
2757
2758 return buffer_len;
2759}
2760
2761/** Close the socket.
2762 *
2763 */
2764static int mod_close(fr_listen_t *li)
2765{
2766 fr_io_instance_t const *inst;
2767 fr_io_connection_t *connection;
2768 fr_listen_t *child;
2769
2770 get_inst(li, &inst, NULL, &connection, &child);
2771
2772 if (inst->app_io->close) {
2773 int ret;
2774
2775 ret = inst->app_io->close(child);
2776 if (ret < 0) return ret;
2777 } else {
2778 close(child->fd);
2779// child->fd = -1;
2780 }
2781
2782 if (!connection) return 0;
2783
2784 /*
2785 * We allocated this, so we're responsible for closing
2786 * it.
2787 */
2788 DEBUG("Closing connection %s", connection->name);
2789 if (connection->client->pending) {
2790 TALLOC_FREE(connection->client->pending); /* for any pending packets */
2791 }
2792
2793 /*
2794 * Remove connection from parent hash table
2795 */
2796 pthread_mutex_lock(&connection->parent->mutex);
2797 if (connection->in_parent_hash) {
2798 connection->in_parent_hash = false;
2799 (void) fr_hash_table_delete(connection->parent->ht, connection);
2800 }
2801 pthread_mutex_unlock(&connection->parent->mutex);
2802
2803 talloc_free(connection->mi);
2804
2805 return 0;
2806}
2807
2808static int mod_instantiate(module_inst_ctx_t const *mctx)
2809{
2810 fr_io_instance_t *inst = mctx->mi->data;
2811 CONF_SECTION *conf = mctx->mi->conf;
2812
2813 inst->mi = mctx->mi;
2814 inst->app_io = (fr_app_io_t const *) inst->submodule->exported;
2815 inst->app_io_conf = inst->submodule->conf;
2816 inst->app_io_instance = inst->submodule->data;
2817
2818 /*
2819 * If we're not tracking duplicates then we don't need a
2820 * cleanup delay.
2821 *
2822 * If we are tracking duplicates, then we must have a non-zero cleanup delay.
2823 */
2824 if (!inst->app_io->track_duplicates) {
2825 inst->cleanup_delay = fr_time_delta_wrap(0);
2826
2827 } else {
2828 FR_TIME_DELTA_BOUND_CHECK("cleanup_delay", inst->cleanup_delay, >=, fr_time_delta_from_sec(1));
2829
2830 if (!inst->app_io->track_create) {
2831 cf_log_err(inst->app_io_conf, "Internal error: 'track_duplicates' is set, but there is no 'track create' function");
2832 return -1;
2833 }
2834 }
2835
2836 /*
2837 * Get various information after bootstrapping the
2838 * application IO module.
2839 */
2840 if (inst->app_io->network_get) {
2841 inst->app_io->network_get(&inst->ipproto, &inst->dynamic_clients, &inst->networks, inst->app_io_instance);
2842 }
2843
2844 if ((inst->ipproto == IPPROTO_TCP) && !inst->app_io->connection_set) {
2845 cf_log_err(inst->app_io_conf, "Missing 'connection set' API for proto_%s", inst->app_io->common.name);
2846 return -1;
2847 }
2848
2849 /*
2850 * Ensure that the dynamic client sections exist
2851 */
2852 if (inst->dynamic_clients) {
2853 CONF_SECTION *server = cf_item_to_section(cf_parent(conf));
2854
2855 if (!cf_section_find(server, "new", "client")) {
2856 cf_log_err(conf, "Cannot use 'dynamic_clients = yes' as the virtual server has no 'new client { ... }' section defined.");
2857 return -1;
2858 }
2859
2860 if (!cf_section_find(server, "add", "client")) {
2861 cf_log_warn(conf, "No 'add client { ... }' section was defined.");
2862 }
2863
2864 if (!cf_section_find(server, "deny", "client")) {
2865 cf_log_warn(conf, "No 'deny client { ... }' section was defined.");
2866 }
2867 }
2868
2869 /*
2870 * Create a list of client modules.
2871 *
2872 * FIXME - Probably only want to do this for connected sockets?
2873 *
2874 * FIXME - We probably want write protect enabled?
2875 */
2876 inst->clients = module_list_alloc(inst, &module_list_type_thread_local, "clients", false);
2877 module_list_mask_set(inst->clients, MODULE_INSTANCE_BOOTSTRAPPED);
2878
2879 return 0;
2880}
2881
2882
2883static char const *mod_name(fr_listen_t *li)
2884{
2885 fr_io_thread_t *thread;
2886 fr_io_connection_t *connection;
2887 fr_listen_t *child;
2888 fr_io_instance_t const *inst;
2889
2890 get_inst(li, &inst, &thread, &connection, &child);
2891
2892 fr_assert(child != NULL);
2893 return child->app_io->get_name(child);
2894}
2895
2896/** Create a trie from arrays of allow / deny IP addresses
2897 *
2898 * @param ctx the talloc ctx
2899 * @param af the address family to allow
2900 * @param allow the array of IPs / networks to allow. MUST be talloc'd
2901 * @param deny the array of IPs / networks to deny. MAY be NULL, MUST be talloc'd
2902 * @return
2903 * - fr_trie_t on success
2904 * - NULL on error
2905 */
2906fr_trie_t *fr_master_io_network(TALLOC_CTX *ctx, int af, fr_ipaddr_t *allow, fr_ipaddr_t *deny)
2907{
2908 fr_trie_t *trie;
2909 size_t i, num;
2910
2911 MEM(trie = fr_trie_alloc(ctx, NULL, NULL));
2912
2913 num = talloc_array_length(allow);
2914 fr_assert(num > 0);
2915
2916 for (i = 0; i < num; i++) {
2917 fr_ipaddr_t *network;
2918
2919 /*
2920 * Can't add v4 networks to a v6 socket, or vice versa.
2921 */
2922 if (allow[i].af != af) {
2923 fr_strerror_printf("Address family in entry %zd - 'allow = %pV' "
2924 "does not match 'ipaddr'", i + 1, fr_box_ipaddr(allow[i]));
2925 talloc_free(trie);
2926 return NULL;
2927 }
2928
2929 /*
2930 * Duplicates are bad.
2931 */
2932 network = fr_trie_match_by_key(trie,
2933 &allow[i].addr, allow[i].prefix);
2934 if (network) {
2935 fr_strerror_printf("Cannot add duplicate entry 'allow = %pV'",
2936 fr_box_ipaddr(allow[i]));
2937 talloc_free(trie);
2938 return NULL;
2939 }
2940
2941 /*
2942 * Look for overlapping entries.
2943 * i.e. the networks MUST be disjoint.
2944 *
2945 * Note that this catches 192.168.1/24
2946 * followed by 192.168/16, but NOT the
2947 * other way around. The best fix is
2948 * likely to add a flag to
2949 * fr_trie_alloc() saying "we can only
2950 * have terminal fr_trie_user_t nodes"
2951 */
2952 network = fr_trie_lookup_by_key(trie,
2953 &allow[i].addr, allow[i].prefix);
2954 if (network && (network->prefix <= allow[i].prefix)) {
2955 fr_strerror_printf("Cannot add overlapping entry 'allow = %pV'", fr_box_ipaddr(allow[i]));
2956 fr_strerror_const("Entry is completely enclosed inside of a previously defined network.");
2957 talloc_free(trie);
2958 return NULL;
2959 }
2960
2961 /*
2962 * Insert the network into the trie.
2963 * Lookups will return the fr_ipaddr_t of
2964 * the network.
2965 */
2966 if (fr_trie_insert_by_key(trie,
2967 &allow[i].addr, allow[i].prefix,
2968 &allow[i]) < 0) {
2969 fr_strerror_printf("Failed adding 'allow = %pV' to tracking table", fr_box_ipaddr(allow[i]));
2970 talloc_free(trie);
2971 return NULL;
2972 }
2973 }
2974
2975 /*
2976 * And now check denied networks.
2977 */
2978 num = talloc_array_length(deny);
2979 if (!num) return trie;
2980
2981 /*
2982 * Since the default is to deny, you can only add
2983 * a "deny" inside of a previous "allow".
2984 */
2985 for (i = 0; i < num; i++) {
2986 fr_ipaddr_t *network;
2987
2988 /*
2989 * Can't add v4 networks to a v6 socket, or vice versa.
2990 */
2991 if (deny[i].af != af) {
2992 fr_strerror_printf("Address family in entry %zd - 'deny = %pV' "
2993 "does not match 'ipaddr'", i + 1, fr_box_ipaddr(deny[i]));
2994 talloc_free(trie);
2995 return NULL;
2996 }
2997
2998 /*
2999 * Duplicates are bad.
3000 */
3001 network = fr_trie_match_by_key(trie,
3002 &deny[i].addr, deny[i].prefix);
3003 if (network) {
3004 fr_strerror_printf("Cannot add duplicate entry 'deny = %pV'", fr_box_ipaddr(deny[i]));
3005 talloc_free(trie);
3006 return NULL;
3007 }
3008
3009 /*
3010 * A "deny" can only be within a previous "allow".
3011 */
3012 network = fr_trie_lookup_by_key(trie,
3013 &deny[i].addr, deny[i].prefix);
3014 if (!network) {
3015 fr_strerror_printf("The network in entry %zd - 'deny = %pV' is not "
3016 "contained within a previous 'allow'", i + 1, fr_box_ipaddr(deny[i]));
3017 talloc_free(trie);
3018 return NULL;
3019 }
3020
3021 /*
3022 * We hack the AF in "deny" rules. If
3023 * the lookup gets AF_UNSPEC, then we're
3024 * adding a "deny" inside of a "deny".
3025 */
3026 if (network->af != af) {
3027 fr_strerror_printf("The network in entry %zd - 'deny = %pV' is overlaps "
3028 "with another 'deny' rule", i + 1, fr_box_ipaddr(deny[i]));
3029 talloc_free(trie);
3030 return NULL;
3031 }
3032
3033 /*
3034 * Insert the network into the trie.
3035 * Lookups will return the fr_ipaddr_t of
3036 * the network.
3037 */
3038 if (fr_trie_insert_by_key(trie,
3039 &deny[i].addr, deny[i].prefix,
3040 &deny[i]) < 0) {
3041 fr_strerror_printf("Failed adding 'deny = %pV' to tracking table", fr_box_ipaddr(deny[i]));
3042 talloc_free(trie);
3043 return NULL;
3044 }
3045
3046 /*
3047 * Hack it to make it a deny rule.
3048 */
3049 deny[i].af = AF_UNSPEC;
3050 }
3051
3052 return trie;
3053}
3054
3055
3056int fr_io_listen_free(fr_listen_t *li)
3057{
3058 if (!li->thread_instance) return 0;
3059
3060 talloc_free(li->thread_instance);
3061 return 0;
3062}
3063
3064int fr_master_io_listen(fr_io_instance_t *inst, fr_schedule_t *sc,
3065 size_t default_message_size, size_t num_messages)
3066{
3067 fr_listen_t *li, *child;
3068 fr_io_thread_t *thread;
3069
3070 /*
3071 * No IO paths, so we don't initialize them.
3072 */
3073 if (!inst->app_io) {
3074 fr_assert(!inst->dynamic_clients);
3075 return 0;
3076 }
3077
3078 if (!inst->app_io->common.thread_inst_size) {
3079 fr_strerror_const("IO modules MUST set 'thread_inst_size' when using the master IO handler.");
3080 return -1;
3081 }
3082
3083 /*
3084 * Build the #fr_listen_t. This describes the complete
3085 * path data takes from the socket to the decoder and
3086 * back again.
3087 */
3088 MEM(li = talloc_zero(NULL, fr_listen_t));
3089 talloc_set_destructor(li, fr_io_listen_free);
3090
3091 /*
3092 * The first listener is the one for the application
3093 * (e.g. RADIUS). However, we mangle the IO path to
3094 * point to the master IO handler. That allows all of
3095 * the high-level work (dynamic client checking,
3096 * connected sockets, etc.) to be handled by the master
3097 * IO handler.
3098 *
3099 * This listener is then passed to the network code,
3100 * which calls our trampoline functions to do the actual
3101 * work.
3102 */
3103 li->app = inst->app;
3104 li->app_instance = inst->app_instance;
3105 li->server_cs = inst->server_cs;
3106
3107 /*
3108 * Set configurable parameters for message ring buffer.
3109 */
3110 li->default_message_size = default_message_size;
3111 li->num_messages = num_messages;
3112
3113 /*
3114 * Per-socket data lives here.
3115 */
3116 thread = talloc_zero(NULL, fr_io_thread_t);
3117 thread->listen = li;
3118 thread->sc = sc;
3119
3120 /*
3121 * Create the trie of clients for this socket.
3122 */
3123 MEM(thread->trie = fr_trie_alloc(thread, NULL, NULL));
3124
3125 if (inst->dynamic_clients) {
3126 MEM(thread->alive_clients = fr_heap_alloc(thread, alive_client_cmp,
3127 fr_io_client_t, alive_id, 0));
3128 }
3129
3130 /*
3131 * Set the listener to call our master trampoline function.
3132 */
3133 li->app_io = &fr_master_app_io;
3134 li->thread_instance = thread;
3135 li->app_io_instance = inst;
3136 li->track_duplicates = inst->app_io->track_duplicates;
3137
3138 /*
3139 * The child listener points to the *actual* IO path.
3140 *
3141 * We need to create a complete listener here (e.g.
3142 * RADIUS + RADIUS_UDP), because the underlying IO
3143 * functions expect to get passed a full listener.
3144 *
3145 * Once the network side calls us, we will call the child
3146 * listener to do the actual IO.
3147 */
3148 child = thread->child = talloc_zero(li, fr_listen_t);
3149 memcpy(child, li, sizeof(*child));
3150
3151 /*
3152 * Reset these fields to point to the IO instance data.
3153 */
3154 child->app_io = inst->app_io;
3155 child->track_duplicates = inst->app_io->track_duplicates;
3156
3157 if (child->app_io->common.thread_inst_size > 0) {
3158 child->thread_instance = talloc_zero_array(NULL, uint8_t,
3159 inst->app_io->common.thread_inst_size);
3160 talloc_set_destructor(child, fr_io_listen_free);
3161
3162 talloc_set_name(child->thread_instance, "proto_%s_thread_t",
3163 inst->app_io->common.name);
3164
3165 /*
3166 * This is "const", and the user can't
3167 * touch it. So we just reuse the same
3168 * configuration everywhere.
3169 */
3170 child->app_io_instance = inst->app_io_instance;
3171
3172 } else {
3173 child->thread_instance = inst->app_io_instance;
3174 child->app_io_instance = child->thread_instance;
3175 }
3176
3177 /*
3178 * Don't call connection_set() for the main socket. It's
3179 * not connected. Instead, tell the IO path to open the
3180 * socket for us.
3181 */
3182 if (inst->app_io->open(child) < 0) {
3183 cf_log_err(inst->app_io_conf, "Failed opening %s interface", inst->app_io->common.name);
3184 talloc_free(li);
3185 return -1;
3186 }
3187
3188 li->fd = child->fd; /* copy this back up */
3189
3190 if (!child->app_io->get_name) {
3191 child->name = child->app_io->common.name;
3192 } else {
3193 child->name = child->app_io->get_name(child);
3194 }
3195 li->name = child->name;
3196
3197 /*
3198 * Record which socket we opened.
3199 */
3200 if (child->app_io_addr) {
3201 fr_listen_t *other;
3202
3203 other = listen_find_any(thread->child);
3204 if (other) {
3205 ERROR("Failed opening %s - that port is already in use by another listener in server %s { ... } - %s",
3206 child->name, cf_section_name2(other->server_cs), other->name);
3207
3208 ERROR("got socket %d %d\n", child->app_io_addr->inet.src_port, other->app_io_addr->inet.src_port);
3209
3210 talloc_free(li);
3211 return -1;
3212 }
3213
3214 (void) listen_record(child);
3215 }
3216
3217 /*
3218 * Add the socket to the scheduler, where it might end up
3219 * in a different thread.
3220 */
3221 if (!fr_schedule_listen_add(sc, li)) {
3222 talloc_free(li);
3223 return -1;
3224 }
3225
3226 return 0;
3227}
3228
3229/*
3230 * Used to create a tracking structure for fr_network_sendto_worker()
3231 */
3232fr_io_track_t *fr_master_io_track_alloc(fr_listen_t *li, fr_client_t *radclient, fr_ipaddr_t const *src_ipaddr, int src_port,
3233 fr_ipaddr_t const *dst_ipaddr, int dst_port)
3234{
3235 fr_io_instance_t const *inst;
3236 fr_io_thread_t *thread;
3237 fr_io_connection_t *connection;
3238 fr_listen_t *child;
3239 fr_io_track_t *track;
3240 fr_io_client_t *client;
3241 fr_io_address_t *address;
3242 fr_listen_t *parent = talloc_parent(li);
3243
3244 (void) talloc_get_type_abort(parent, fr_listen_t);
3245
3246 get_inst(parent, &inst, &thread, &connection, &child);
3247
3248 fr_assert(child == li);
3249
3250 if (unlikely(!thread)) return NULL;
3251 fr_assert(thread->trie != NULL);
3252
3253 client = fr_trie_lookup_by_key(thread->trie, &src_ipaddr->addr, src_ipaddr->prefix);
3254 if (!client) {
3255 MEM(client = client_alloc(thread, PR_CLIENT_STATIC, inst, thread, radclient, NULL));
3256 }
3257
3258 MEM(track = talloc_zero_pooled_object(client, fr_io_track_t, 1, sizeof(*track) + sizeof(track->address) + 64));
3259 MEM(track->address = address = talloc_zero(track, fr_io_address_t));
3260 track->client = client;
3261
3262 address->socket.inet.src_port = src_port;
3263 address->socket.inet.dst_port = dst_port;
3264
3265 address->socket.inet.src_ipaddr = *src_ipaddr;
3266 address->socket.inet.dst_ipaddr = *dst_ipaddr;
3267 address->radclient = radclient;
3268
3269 return track;
3270}
3271
3272
3273fr_app_io_t fr_master_app_io = {
3274 .common = {
3275 .magic = MODULE_MAGIC_INIT,
3276 .name = "radius_master_io",
3277
3278 .instantiate = mod_instantiate,
3279 },
3280 .default_message_size = 4096,
3281 .track_duplicates = true,
3282
3283 .read = mod_read,
3284 .write = mod_write,
3285 .inject = mod_inject,
3286
3287 .open = mod_open,
3288 .close = mod_close,
3289 .event_list_set = mod_event_list_set,
3290 .get_name = mod_name,
3291};
buffer
static int const char char buffer[256]
Definition acutest.h:576
msg
log_entry msg
Definition acutest.h:794
fr_app_io_t::common
module_t common
Common fields to all loadable modules.
Definition app_io.h:34
fr_app_io_t::track_create
fr_io_track_create_t track_create
create a tracking structure
Definition app_io.h:64
fr_app_io_t::track_duplicates
bool track_duplicates
track duplicate packets
Definition app_io.h:41
fr_app_io_t::get_name
fr_io_name_t get_name
get the socket name
Definition app_io.h:70
fr_app_io_t::track_compare
fr_io_track_cmp_t track_compare
compare two tracking structures
Definition app_io.h:65
fr_app_io_t
Public structure describing an I/O path for a protocol.
Definition app_io.h:33
CMP_PREFER_SMALLER
#define CMP_PREFER_SMALLER(_a, _b)
Evaluates to +1 for a > b, and -1 for a < b.
Definition build.h:104
CMP_PREFER_LARGER
#define CMP_PREFER_LARGER(_a, _b)
Evaluates to -1 for a > b, and +1 for a < b.
Definition build.h:108
CMP_RETURN
#define CMP_RETURN(_a, _b, _field)
Return if the comparison is not 0 (is unequal)
Definition build.h:121
CMP
#define CMP(_a, _b)
Same as CMP_PREFER_SMALLER use when you don't really care about ordering, you just want an ordering.
Definition build.h:112
unlikely
#define unlikely(_x)
Definition build.h:383
UNUSED
#define UNUSED
Definition build.h:317
FR_TIME_DELTA_BOUND_CHECK
#define FR_TIME_DELTA_BOUND_CHECK(_name, _var, _op, _bound)
Definition cf_parse.h:533
cf_section
A section grouping multiple CONF_PAIR.
Definition cf_priv.h:101
cf_section_name2
char const * cf_section_name2(CONF_SECTION const *cs)
Return the second identifier of a CONF_SECTION.
Definition cf_util.c:1184
cf_section_name1
char const * cf_section_name1(CONF_SECTION const *cs)
Return the second identifier of a CONF_SECTION.
Definition cf_util.c:1170
cf_section_find
CONF_SECTION * cf_section_find(CONF_SECTION const *cs, char const *name1, char const *name2)
Find a CONF_SECTION with name1 and optionally name2.
Definition cf_util.c:1027
cf_item_to_section
CONF_SECTION * cf_item_to_section(CONF_ITEM const *ci)
Cast a CONF_ITEM to a CONF_SECTION.
Definition cf_util.c:683
cf_section_dup
CONF_SECTION * cf_section_dup(TALLOC_CTX *ctx, CONF_SECTION *parent, CONF_SECTION const *cs, char const *name1, char const *name2, bool copy_meta)
Duplicate a configuration section.
Definition cf_util.c:927
cf_log_err
#define cf_log_err(_cf, _fmt,...)
Definition cf_util.h:289
cf_parent
#define cf_parent(_cf)
Definition cf_util.h:101
cf_log_warn
#define cf_log_warn(_cf, _fmt,...)
Definition cf_util.h:290
PRIORITY_NORMAL
#define PRIORITY_NORMAL
Definition channel.h:151
MEM
#define MEM(x)
Definition debug.h:36
ERROR
#define ERROR(fmt,...)
Definition dhcpclient.c:41
DEBUG
#define DEBUG(fmt,...)
Definition dhcpclient.c:39
value
Test enumeration values.
Definition dict_test.h:92
MODULE_MAGIC_INIT
#define MODULE_MAGIC_INIT
Stop people using different module/library/server versions together.
Definition dl_module.h:63
FR_EVENT_FILTER_IO
@ FR_EVENT_FILTER_IO
Combined filter for read/write functions/.
Definition event.h:84
fr_event_filter_update
#define fr_event_filter_update(...)
Definition event.h:240
FR_EVENT_RESUME
#define FR_EVENT_RESUME(_s, _f)
Re-add the filter for a func from kevent.
Definition event.h:132
FR_EVENT_SUSPEND
#define FR_EVENT_SUSPEND(_s, _f)
Temporarily remove the filter for a func from kevent.
Definition event.h:116
fr_event_io_func_t
Callbacks for the FR_EVENT_FILTER_IO filter.
Definition event.h:189
fr_event_update_t
Structure describing a modification to a filter's state.
Definition event.h:97
fr_hash_table_find
void * fr_hash_table_find(fr_hash_table_t *ht, void const *data)
Find data in a hash table.
Definition hash.c:429
fr_hash_update
uint32_t fr_hash_update(void const *data, size_t size, uint32_t hash)
Definition hash.c:846
fr_hash
uint32_t fr_hash(void const *data, size_t size)
Definition hash.c:812
fr_hash_table_insert
bool fr_hash_table_insert(fr_hash_table_t *ht, void const *data)
Insert data into a hash table.
Definition hash.c:468
fr_hash_table_delete
bool fr_hash_table_delete(fr_hash_table_t *ht, void const *data)
Remove and free data (if a free function was specified)
Definition hash.c:594
fr_hash_table_num_elements
uint32_t fr_hash_table_num_elements(fr_hash_table_t *ht)
Definition hash.c:610
fr_hash_table_s
Definition hash.c:50
fr_hash_table_alloc
#define fr_hash_table_alloc(_ctx, _hash_node, _cmp_node, _free_node)
Definition hash.h:58
fr_heap_insert
int fr_heap_insert(fr_heap_t **hp, void *data)
Insert a new element into the heap.
Definition heap.c:146
fr_heap_pop
void * fr_heap_pop(fr_heap_t **hp)
Remove a node from the heap.
Definition heap.c:322
fr_heap_extract
int fr_heap_extract(fr_heap_t **hp, void *data)
Remove a node from the heap.
Definition heap.c:239
fr_heap_index_t
unsigned int fr_heap_index_t
Definition heap.h:80
fr_heap_peek
static void * fr_heap_peek(fr_heap_t *h)
Return the item from the top of the heap but don't pop it.
Definition heap.h:136
fr_heap_alloc
#define fr_heap_alloc(_ctx, _cmp, _type, _field, _init)
Creates a heap that can be used with non-talloced elements.
Definition heap.h:100
fr_heap_entry_inserted
static bool fr_heap_entry_inserted(fr_heap_index_t heap_idx)
Check if an entry is inserted into a heap.
Definition heap.h:124
fr_heap_num_elements
static unsigned int fr_heap_num_elements(fr_heap_t *h)
Return the number of elements in the heap.
Definition heap.h:179
FR_HEAP_INDEX_INVALID
#define FR_HEAP_INDEX_INVALID
Definition heap.h:83
fr_heap_t
The main heap structure.
Definition heap.h:66
fr_ipaddr_from_sockaddr
int fr_ipaddr_from_sockaddr(fr_ipaddr_t *ipaddr, uint16_t *port, struct sockaddr_storage const *sa, socklen_t salen)
Convert sockaddr to our internal ip address representation.
Definition inet.c:1442
fr_ipaddr_to_sockaddr
int fr_ipaddr_to_sockaddr(struct sockaddr_storage *sa, socklen_t *salen, fr_ipaddr_t const *ipaddr, uint16_t port)
Convert our internal ip address representation to a sockaddr.
Definition inet.c:1393
fr_ipaddr_cmp
int8_t fr_ipaddr_cmp(fr_ipaddr_t const *a, fr_ipaddr_t const *b)
Compare two ip addresses.
Definition inet.c:1347
fr_ipaddr_mask
void fr_ipaddr_mask(fr_ipaddr_t *addr, uint8_t prefix)
Zeroes out the host portion of an fr_ipaddr_t.
Definition inet.c:218
fr_ipaddr_t::prefix
uint8_t prefix
Prefix length - Between 0-32 for IPv4 and 0-128 for IPv6.
Definition inet.h:69
fr_ipaddr_t::af
int af
Address family.
Definition inet.h:64
fr_ipaddr_t::addr
union fr_ipaddr_t::@136 addr
fr_ipaddr_t
IPv4/6 prefix.
Definition merged_model.c:266
fr_io_address_t::socket
fr_socket_t socket
src/dst ip and port.
Definition base.h:336
fr_io_address_t::radclient
fr_client_t const * radclient
old-style client definition
Definition base.h:338
fr_io_address_t
Definition base.h:335
fr_listen::num_messages
size_t num_messages
for the message ring buffer
Definition listen.h:53
fr_listen::name
char const * name
printable name for this socket - set by open
Definition listen.h:29
fr_listen::track_duplicates
bool track_duplicates
do we track duplicate packets?
Definition listen.h:44
fr_listen::app_io_addr
fr_socket_t * app_io_addr
for tracking duplicate sockets
Definition listen.h:36
fr_listen::app_instance
void const * app_instance
Definition listen.h:39
fr_listen::default_message_size
size_t default_message_size
copied from app_io, but may be changed
Definition listen.h:52
fr_listen::connected
bool connected
is this for a connected socket?
Definition listen.h:43
fr_listen::app
fr_app_t const * app
Definition listen.h:38
fr_listen::app_io_instance
void const * app_io_instance
I/O path configuration context.
Definition listen.h:33
fr_listen::server_cs
CONF_SECTION * server_cs
CONF_SECTION of the server.
Definition listen.h:41
fr_listen::thread_instance
void * thread_instance
thread / socket context
Definition listen.h:34
fr_listen::fd
int fd
file descriptor for this socket - set by open
Definition listen.h:28
fr_listen::app_io
fr_app_io_t const * app_io
I/O path functions.
Definition listen.h:32
fr_listen
Definition listen.h:25
fr_network_listen_inject
int fr_network_listen_inject(fr_network_t *nr, fr_listen_t *li, uint8_t const *packet, size_t packet_len, fr_time_t recv_time)
Inject a packet for a listener to read.
Definition network.c:410
fr_network_listen_read
void fr_network_listen_read(fr_network_t *nr, fr_listen_t *li)
Signal the network to read from a listener.
Definition network.c:336
fr_network_listen_write
void fr_network_listen_write(fr_network_t *nr, fr_listen_t *li, uint8_t const *packet, size_t packet_len, void *packet_ctx, fr_time_t request_time)
Inject a packet for a listener to write.
Definition network.c:362
fr_network_s
Definition network.c:112
fr_client_s::server
char const * server
Name of the virtual server client is associated with.
Definition client.h:128
fr_client_s::ipaddr
fr_ipaddr_t ipaddr
IPv4/IPv6 address of the host.
Definition client.h:83
fr_client_s::secret
char const * secret
Secret PSK.
Definition client.h:90
fr_client_s::active
bool active
for dynamic clients
Definition client.h:119
fr_client_s::src_ipaddr
fr_ipaddr_t src_ipaddr
IPv4/IPv6 address to send responses from (family must match ipaddr).
Definition client.h:84
fr_client_s::nas_type
char const * nas_type
Type of client (arbitrary).
Definition client.h:126
fr_client_s::proto
int proto
Protocol number.
Definition client.h:142
fr_client_s::cs
CONF_SECTION * cs
CONF_SECTION that was parsed to generate the client.
Definition client.h:133
fr_client_s::dynamic
bool dynamic
Whether the client was dynamically defined.
Definition client.h:118
fr_client_s::longname
char const * longname
Client identifier.
Definition client.h:87
fr_client_s::limit
fr_socket_limit_t limit
Connections per client (TCP clients only).
Definition client.h:143
fr_client_s::shortname
char const * shortname
Client nickname.
Definition client.h:88
fr_client_s::use_connected
bool use_connected
do we use connected sockets for this client
Definition client.h:120
fr_client_s::server_cs
CONF_SECTION * server_cs
Virtual server that the client is associated with.
Definition client.h:129
fr_client_s
Describes a host allowed to send packets to the server.
Definition client.h:80
PERROR
#define PERROR(_fmt,...)
Definition log.h:228
DEBUG3
#define DEBUG3(_fmt,...)
Definition log.h:266
RATE_LIMIT_LOCAL
#define RATE_LIMIT_LOCAL(_entry, _log, _fmt,...)
Rate limit messages using a local limiting entry.
Definition log.h:569
fr_rate_limit_t
Track when a log message was last repeated.
Definition log.h:547
talloc_free
talloc_free(reap)
fr_event_list_s
Stores all information relating to an event list.
Definition event.c:377
fr_io_thread_t::child
fr_listen_t * child
The child (app_io) IO path.
Definition master.c:45
fr_io_connection_s::nr
fr_network_t * nr
network for this connection
Definition master.c:167
alive_client_cmp
static int8_t alive_client_cmp(void const *one, void const *two)
Definition master.c:1304
fr_io_client_s::in_trie
bool in_trie
is the client in the trie?
Definition master.c:126
fr_io_pending_alloc
static fr_io_pending_packet_t * fr_io_pending_alloc(fr_io_connection_t *connection, fr_io_client_t *client, uint8_t const *buffer, size_t packet_len, fr_io_track_t *track, int priority)
Definition master.c:1259
fr_io_connection_s::paused
bool paused
event filter doesn't like resuming something that isn't paused
Definition master.c:164
fr_io_connection_s::in_parent_hash
bool in_parent_hash
for tracking thread issues
Definition master.c:165
radclient_clone
static fr_client_t * radclient_clone(TALLOC_CTX *ctx, fr_client_t const *parent)
Definition master.c:388
mod_read
static ssize_t mod_read(fr_listen_t *li, void **packet_ctx, fr_time_t *recv_time_p, uint8_t *buffer, size_t buffer_len, size_t *leftover)
Implement 99% of the read routines.
Definition master.c:1316
fr_io_connection_s::packets
int packets
number of packets using this connection
Definition master.c:155
fr_io_thread_t::num_pending_packets
uint32_t num_pending_packets
number of pending packets
Definition master.c:50
DUP_FIELD
#define DUP_FIELD(_x)
track_dedup_free
static int track_dedup_free(fr_io_track_t *track)
Definition master.c:191
fr_io_client_s::table
fr_rb_tree_t * table
tracking table for packets
Definition master.c:131
fr_io_pending_packet_t::recv_time
fr_time_t recv_time
Definition master.c:73
pending_packet_cmp
static int8_t pending_packet_cmp(void const *one, void const *two)
Definition master.c:207
fr_io_thread_t::pending_clients
fr_heap_t * pending_clients
heap of pending clients
Definition master.c:41
fr_io_track_add
static fr_io_track_t * fr_io_track_add(fr_io_client_t *client, fr_io_address_t *address, uint8_t const *packet, size_t packet_len, fr_time_t recv_time, bool *is_dup)
Definition master.c:1085
fr_io_client_s::ready_to_delete
bool ready_to_delete
are we ready to delete this client?
Definition master.c:125
_client_live_free
static int _client_live_free(fr_io_client_t *client)
Definition master.c:957
fr_io_client_s::pending_id
fr_heap_index_t pending_id
for pending clients
Definition master.c:121
pending_free
static int pending_free(fr_io_pending_packet_t *pending)
Definition master.c:1235
fr_io_client_s::use_connected
bool use_connected
does this client allow connected sub-sockets?
Definition master.c:124
fr_io_connection_s::client
fr_io_client_t * client
our local client (pending or connected).
Definition master.c:159
track_free
static int track_free(fr_io_track_t *track)
Definition master.c:180
fr_master_app_io
fr_app_io_t fr_master_app_io
Definition master.c:3273
packet_expiry_timer
static void packet_expiry_timer(fr_timer_list_t *tl, fr_time_t now, void *uctx)
Definition master.c:2261
fr_io_thread_t::listen
fr_listen_t * listen
The master IO path.
Definition master.c:44
pending_client_cmp
static int8_t pending_client_cmp(void const *one, void const *two)
Definition master.c:237
fr_master_io_track_alloc
fr_io_track_t * fr_master_io_track_alloc(fr_listen_t *li, fr_client_t *radclient, fr_ipaddr_t const *src_ipaddr, int src_port, fr_ipaddr_t const *dst_ipaddr, int dst_port)
Definition master.c:3232
fr_io_connection_s::address
fr_io_address_t * address
full information about the connection.
Definition master.c:156
address_cmp
static int8_t address_cmp(void const *one, void const *two)
Definition master.c:255
fr_io_connection_s::child
fr_listen_t * child
child listener (app_io) for this socket
Definition master.c:158
fr_io_connection_s::listen
fr_listen_t * listen
master listener for this socket
Definition master.c:157
fr_io_client_s::ev
fr_timer_t * ev
when we clean up the client
Definition master.c:130
fr_io_thread_t::nr
fr_network_t * nr
network for the master socket
Definition master.c:38
fr_master_io_network
fr_trie_t * fr_master_io_network(TALLOC_CTX *ctx, int af, fr_ipaddr_t *allow, fr_ipaddr_t *deny)
Create a trie from arrays of allow / deny IP addresses.
Definition master.c:2906
pending_packet_pop
static fr_io_pending_packet_t * pending_packet_pop(fr_io_thread_t *thread)
Definition master.c:350
fr_io_client_s::network
fr_ipaddr_t network
network for dynamic clients
Definition master.c:117
mod_event_list_set
static void mod_event_list_set(fr_listen_t *li, fr_event_list_t *el, void *nr)
Set the event list for a new socket.
Definition master.c:2014
mod_open
static int mod_open(fr_listen_t *li)
Open a new listener.
Definition master.c:1978
fr_io_client_s::mutex
pthread_mutex_t mutex
for parent / child signaling
Definition master.c:136
fr_io_pending_packet_t::heap_id
fr_heap_index_t heap_id
Definition master.c:71
client_alloc
static fr_io_client_t * client_alloc(TALLOC_CTX *ctx, fr_io_client_state_t state, fr_io_instance_t const *inst, fr_io_thread_t *thread, fr_client_t *radclient, fr_ipaddr_t const *network)
Allocate a dynamic client.
Definition master.c:980
fr_io_client_s::inst
fr_io_instance_t const * inst
parent instance for master IO handler
Definition master.c:128
LOG_IGNORED_CLIENTS
#define LOG_IGNORED_CLIENTS(_inst)
COPY_FIELD
#define COPY_FIELD(_x)
fr_io_thread_t::trie
fr_trie_t * trie
trie of clients
Definition master.c:40
client_expiry_timer
static void client_expiry_timer(fr_timer_list_t *tl, fr_time_t now, void *uctx)
Definition master.c:2047
fr_io_client_state_t
fr_io_client_state_t
Client states.
Definition master.c:83
PR_CLIENT_DYNAMIC
@ PR_CLIENT_DYNAMIC
dynamically defined client
Definition master.c:87
PR_CLIENT_CONNECTED
@ PR_CLIENT_CONNECTED
dynamically defined client in a connected socket
Definition master.c:88
PR_CLIENT_PENDING
@ PR_CLIENT_PENDING
dynamic client pending definition
Definition master.c:89
PR_CLIENT_INVALID
@ PR_CLIENT_INVALID
Definition master.c:84
PR_CLIENT_NAK
@ PR_CLIENT_NAK
negative cache entry
Definition master.c:86
PR_CLIENT_STATIC
@ PR_CLIENT_STATIC
static / global clients
Definition master.c:85
get_inst
static void get_inst(fr_listen_t *li, fr_io_instance_t const **inst, fr_io_thread_t **thread, fr_io_connection_t **connection, fr_listen_t **child)
Definition master.c:909
pause_read
static fr_event_update_t pause_read[]
Definition master.c:170
track_connected_cmp
static int8_t track_connected_cmp(void const *one, void const *two)
Definition master.c:324
fr_io_thread_t::alive_clients
fr_heap_t * alive_clients
heap of active dynamic clients
Definition master.c:42
fr_io_thread_t::sc
fr_schedule_t * sc
the scheduler
Definition master.c:46
fr_io_connection_alloc
static fr_io_connection_t * fr_io_connection_alloc(fr_io_instance_t const *inst, fr_io_thread_t *thread, fr_io_client_t *client, int fd, fr_io_address_t *address, fr_io_connection_t *nak)
Create a new connection.
Definition master.c:513
fr_io_client_s::addresses
fr_hash_table_t * addresses
list of src/dst addresses used by this client
Definition master.c:134
fr_master_io_listen
int fr_master_io_listen(fr_io_instance_t *inst, fr_schedule_t *sc, size_t default_message_size, size_t num_messages)
Definition master.c:3064
connection_free
static int connection_free(fr_io_connection_t *connection)
Definition master.c:498
fr_io_thread_t::rate_limit
struct fr_io_thread_t::@38 rate_limit
fr_io_listen_free
int fr_io_listen_free(fr_listen_t *li)
Definition master.c:3056
fr_io_connection_s::name
char const * name
taken from proto_FOO_TRANSPORT
Definition master.c:154
fr_io_client_s::alive_id
fr_heap_index_t alive_id
for all clients
Definition master.c:122
fr_io_connection_s::el
fr_event_list_t * el
event list for this connection
Definition master.c:166
fr_io_client_s::state
fr_io_client_state_t state
state of this client
Definition master.c:115
fr_io_client_s::packets
int packets
number of packets using this client
Definition master.c:120
mod_write
static ssize_t mod_write(fr_listen_t *li, void *packet_ctx, fr_time_t request_time, uint8_t *buffer, size_t buffer_len, size_t written)
Definition master.c:2327
fr_io_connection_s::dead
bool dead
roundabout way to get the network side to close a socket
Definition master.c:163
fr_io_thread_t::el
fr_event_list_t * el
event list, for the master socket.
Definition master.c:37
fr_io_thread_t::client_id
uint64_t client_id
Unique client identifier.
Definition master.c:51
fr_io_client_s::thread
fr_io_thread_t * thread
Definition master.c:129
mod_name
static char const * mod_name(fr_listen_t *li)
Definition master.c:2883
fr_io_connection_s::mi
module_instance_t * mi
for submodule
Definition master.c:161
_client_free
static int _client_free(fr_io_client_t *client)
Definition master.c:474
mod_close
static int mod_close(fr_listen_t *li)
Close the socket.
Definition master.c:2764
connection_hash
static uint32_t connection_hash(void const *ctx)
Definition master.c:271
fr_io_client_s::connection
fr_io_connection_t * connection
parent connection
Definition master.c:114
fr_io_client_s::pending
fr_heap_t * pending
pending packets for this client
Definition master.c:133
count_connections
static int count_connections(UNUSED uint8_t const *key, UNUSED size_t keylen, void *data, void *ctx)
Count the number of connections used by active clients.
Definition master.c:452
connection_cmp
static int8_t connection_cmp(void const *one, void const *two)
Definition master.c:285
track_cmp
static int8_t track_cmp(void const *one, void const *two)
Definition master.c:294
fr_io_client_s::ht
fr_hash_table_t * ht
for tracking connected sockets
Definition master.c:137
mod_instantiate
static int mod_instantiate(module_inst_ctx_t const *mctx)
Definition master.c:2808
fr_io_pending_packet_t::track
fr_io_track_t * track
Definition master.c:74
fr_io_client_s::radclient
fr_client_t * radclient
old-style definition of this client
Definition master.c:118
fr_io_client_s::src_ipaddr
fr_ipaddr_t src_ipaddr
packets come from this address
Definition master.c:116
resume_read
static fr_event_update_t resume_read[]
Definition master.c:175
client_pending_free
static void client_pending_free(fr_io_client_t *client)
Definition master.c:481
fr_io_thread_t::num_connections
uint32_t num_connections
number of dynamic connections
Definition master.c:49
fr_io_connection_s::parent
fr_io_client_t * parent
points to the parent client.
Definition master.c:160
radclient_alloc
static fr_client_t * radclient_alloc(TALLOC_CTX *ctx, int ipproto, fr_io_address_t *address)
Definition master.c:929
mod_inject
static int mod_inject(fr_listen_t *li, uint8_t const *buffer, size_t buffer_len, fr_time_t recv_time)
Inject a packet to a connection.
Definition master.c:1924
fr_io_client_s
Client definitions for master IO.
Definition master.c:113
fr_io_connection_s
Track a connection.
Definition master.c:153
fr_io_pending_packet_t
A saved packet.
Definition master.c:70
fr_io_thread_t
Definition master.c:36
fr_io_track_s::ev
fr_timer_t * ev
when we clean up this tracking entry
Definition master.h:42
fr_io_track_s::reply
uint8_t * reply
reply packet (if any)
Definition master.h:46
fr_io_track_s::packets
int packets
number of packets using this entry
Definition master.h:45
fr_io_track_s::dynamic
fr_time_t dynamic
timestamp for packet doing dynamic client definition
Definition master.h:53
fr_io_instance_t::app_io_instance
void * app_io_instance
Easy access to the app_io instance.
Definition master.h:105
fr_io_instance_t::app_io
fr_app_io_t const * app_io
Easy access to the app_io handle.
Definition master.h:104
fr_io_track_s::address
fr_io_address_t const * address
of this packet.. shared between multiple packets
Definition master.h:54
fr_io_track_s::do_not_respond
bool do_not_respond
don't respond
Definition master.h:50
fr_io_track_s::discard
bool discard
whether or not we discard the packet
Definition master.h:49
fr_io_track_s::timestamp
fr_time_t timestamp
when this packet was received
Definition master.h:43
fr_io_track_s::finished
bool finished
are we finished the request?
Definition master.h:51
fr_io_track_s::packet
uint8_t * packet
really a tracking structure, not a packet
Definition master.h:56
fr_io_track_s::reply_len
size_t reply_len
length of reply, or 1 for "do not reply"
Definition master.h:47
fr_io_track_s::client
fr_io_client_t * client
client handling this packet.
Definition master.h:55
fr_io_track_s::expires
fr_time_t expires
when this packet expires
Definition master.h:44
fr_io_instance_t
The master IO instance.
Definition master.h:72
fr_io_track_s
Definition master.h:40
uint32_t
unsigned int uint32_t
Definition merged_model.c:33
ssize_t
long int ssize_t
Definition merged_model.c:24
uint8_t
unsigned char uint8_t
Definition merged_model.c:30
pthread_mutex_t
Definition merged_model.c:27
fr_nonblock
int fr_nonblock(UNUSED int fd)
Definition misc.c:294
module_inst_ctx_t::mi
module_instance_t * mi
Instance of the module being instantiated.
Definition module_ctx.h:51
module_inst_ctx_t
Temporary structure to hold arguments for instantiation calls.
Definition module_ctx.h:50
fr_asprintf
char * fr_asprintf(TALLOC_CTX *ctx, char const *fmt,...)
Special version of asprintf which implements custom format specifiers.
Definition print.c:874
fr_assert
#define fr_assert(_expr)
Definition rad_assert.h:38
ipproto
static int ipproto
Definition radclient-ng.c:92
secret
static char * secret
Definition radclient-ng.c:69
DEBUG2
#define DEBUG2(fmt,...)
Definition radclient.h:43
INFO
#define INFO(fmt,...)
Definition radict.c:54
cleanup
static bool cleanup
Definition radsniff.c:60
conf
static rs_t * conf
Definition radsniff.c:53
fr_rb_find
void * fr_rb_find(fr_rb_tree_t const *tree, void const *data)
Find an element in the tree, returning the data, not the node.
Definition rb.c:577
fr_rb_insert
bool fr_rb_insert(fr_rb_tree_t *tree, void const *data)
Insert data into a tree.
Definition rb.c:626
fr_rb_delete
bool fr_rb_delete(fr_rb_tree_t *tree, void const *data)
Remove node and free data (if a free function was specified)
Definition rb.c:741
fr_rb_inline_talloc_alloc
#define fr_rb_inline_talloc_alloc(_ctx, _type, _field, _data_cmp, _data_free)
Allocs a red black that verifies elements are of a specific talloc type.
Definition rb.h:246
fr_rb_tree_s
The main red black tree structure.
Definition rb.h:73
hash
static unsigned int hash(char const *username, unsigned int tablesize)
Definition rlm_passwd.c:132
name
static char const * name
Definition rlm_redis_ippool_tool.c:156
fr_schedule_listen_add
fr_network_t * fr_schedule_listen_add(fr_schedule_t *sc, fr_listen_t *li)
Add a fr_listen_t to a scheduler.
Definition schedule.c:892
fr_schedule_s
The scheduler.
Definition schedule.c:125
module_instance_s::conf
CONF_SECTION * conf
Module's instance configuration.
Definition module.h:349
module_instance_s::data
void * data
Module's instance data.
Definition module.h:291
module_s::instantiate
module_instantiate_t instantiate
Callback to allow the module to register any per-instance resources like sockets and file handles.
Definition module.h:227
MODULE_INSTANCE_BOOTSTRAPPED
@ MODULE_INSTANCE_BOOTSTRAPPED
Module instance has been bootstrapped, but not yet instantiated.
Definition module.h:264
module_s::thread_inst_size
size_t thread_inst_size
Size of the module's thread-specific instance data.
Definition module.h:244
module_instance_s
Module instance data.
Definition module.h:285
fr_socket_limit_t::idle_timeout
fr_time_delta_t idle_timeout
Definition socket.h:38
fr_socket_limit_t::max_connections
uint32_t max_connections
Definition socket.h:33
sc
static const uchar sc[16]
Definition smbdes.c:115
module_list_type_thread_local
module_list_type_t const module_list_type_thread_local
Callbacks for a thread local list.
Definition module.c:582
module_list_mask_set
void module_list_mask_set(module_list_t *ml, module_instance_state_t mask)
Set a new bootstrap/instantiate state for a list.
Definition module.c:1829
module_instance_copy
module_instance_t * module_instance_copy(module_list_t *dst, module_instance_t const *src, char const *inst_name)
Duplicate a module instance, placing it in a new module list.
Definition module.c:1528
module_list_alloc
module_list_t * module_list_alloc(TALLOC_CTX *ctx, module_list_type_t const *type, char const *name, bool write_protect)
Allocate a new module list.
Definition module.c:1851
module_thread_instantiate
int module_thread_instantiate(TALLOC_CTX *ctx, module_instance_t *mi, fr_event_list_t *el)
Allocate thread-local instance data for a module.
Definition module.c:1077
module_instantiate
int module_instantiate(module_instance_t *instance)
Manually complete module setup by calling its instantiate function.
Definition module.c:1189
module_instance_conf_parse
int module_instance_conf_parse(module_instance_t *mi, CONF_SECTION *conf)
Covert a CONF_SECTION into parsed module instance data.
Definition module.c:758
inst
eap_aka_sim_process_conf_t * inst
Definition state_machine.c:3651
fr_time
#define fr_time()
Allow us to arbitrarily manipulate time.
Definition state_test.c:8
fr_syserror
char const * fr_syserror(int num)
Guaranteed to be thread-safe version of strerror.
Definition syserror.c:243
talloc_get_type_abort_const
#define talloc_get_type_abort_const
Definition talloc.h:287
talloc_zero_pooled_object
#define talloc_zero_pooled_object(_ctx, _type, _num_subobjects, _total_subobjects_size)
Definition talloc.h:177
talloc_const_free
static int talloc_const_free(void const *ptr)
Free const'd memory.
Definition talloc.h:229
talloc_init_const
static TALLOC_CTX * talloc_init_const(char const *name)
Allocate a top level chunk with a constant name.
Definition talloc.h:112
fr_time_delta_unwrap
static int64_t fr_time_delta_unwrap(fr_time_delta_t time)
Definition time.h:154
fr_time_delta_lt
#define fr_time_delta_lt(_a, _b)
Definition time.h:285
fr_time_unwrap
static int64_t fr_time_unwrap(fr_time_t time)
Definition time.h:146
fr_time_delta_from_sec
static fr_time_delta_t fr_time_delta_from_sec(int64_t sec)
Definition time.h:590
fr_time_delta_wrap
#define fr_time_delta_wrap(_time)
Definition time.h:152
fr_time_wrap
#define fr_time_wrap(_time)
Definition time.h:145
fr_time_delta_ispos
#define fr_time_delta_ispos(_a)
Definition time.h:290
fr_time_eq
#define fr_time_eq(_a, _b)
Definition time.h:241
NSEC
#define NSEC
Definition time.h:379
fr_time_add
#define fr_time_add(_a, _b)
Add a time/time delta together.
Definition time.h:196
fr_time_neq
#define fr_time_neq(_a, _b)
Definition time.h:242
fr_time_delta_s
A time delta, a difference in time measured in nanoseconds.
Definition time.h:80
fr_time_s
"server local" time.
Definition time.h:69
fr_timer_list_s
An event timer list.
Definition timer.c:50
fr_timer_s
A timer event.
Definition timer.c:84
FR_TIMER_DELETE
#define FR_TIMER_DELETE(_ev_p)
Definition timer.h:103
FR_TIMER_DELETE_RETURN
#define FR_TIMER_DELETE_RETURN(_ev_p)
Definition timer.h:110
fr_timer_in
#define fr_timer_in(...)
Definition timer.h:87
FR_TIMER_DISARM
#define FR_TIMER_DISARM(_ev)
Definition timer.h:91
fr_timer_armed
static bool fr_timer_armed(fr_timer_t *ev)
Definition timer.h:120
fr_timer_at
#define fr_timer_at(...)
Definition timer.h:81
fr_trie_remove_by_key
void * fr_trie_remove_by_key(fr_trie_t *ft, void const *key, size_t keylen)
Remove a key and return the associated user ctx.
Definition trie.c:2154
fr_trie_alloc
fr_trie_t * fr_trie_alloc(TALLOC_CTX *ctx, fr_trie_key_t get_key, fr_free_t free_data)
Allocate a trie.
Definition trie.c:741
fr_trie_walk
int fr_trie_walk(fr_trie_t *ft, void *ctx, fr_trie_walk_t callback)
Definition trie.c:2607
fr_trie_lookup_by_key
void * fr_trie_lookup_by_key(fr_trie_t const *ft, void const *key, size_t keylen)
Lookup a key in a trie and return user ctx, if any.
Definition trie.c:1262
fr_trie_match_by_key
void * fr_trie_match_by_key(fr_trie_t const *ft, void const *key, size_t keylen)
Match a key and length in a trie and return user ctx, if any.
Definition trie.c:1286
fr_trie_insert_by_key
int fr_trie_insert_by_key(fr_trie_t *ft, void const *key, size_t keylen, void const *data)
Insert a key and user ctx into a trie.
Definition trie.c:1875
fr_trie_s
Definition trie.c:484
close
close(uq->fd)
el
static fr_event_list_t * el
Definition unit_test_attribute.c:279
parent
static fr_slen_t parent
Definition pair.h:841
fr_socket_t::fd
int fd
File descriptor if this is a live socket.
Definition socket.h:81
fr_socket_t::type
int type
SOCK_STREAM, SOCK_DGRAM, etc.
Definition socket.h:79
fr_strerror_printf
#define fr_strerror_printf(_fmt,...)
Log to thread local error buffer.
Definition strerror.h:64
fr_strerror_const
#define fr_strerror_const(_msg)
Definition strerror.h:223
fr_value_box_aprint
static fr_slen_t fr_value_box_aprint(TALLOC_CTX *ctx, char **out, fr_value_box_t const *data, fr_sbuff_escape_rules_t const *e_rules) 1(fr_value_box_print
fr_box_ipaddr
#define fr_box_ipaddr(_val)
Definition value.h:315
data
static fr_slen_t data
Definition value.h:1290
fr_box_time_delta
#define fr_box_time_delta(_val)
Definition value.h:364
listen_record
bool listen_record(fr_listen_t *li)
Record that we're listening on a particular IP / port.
Definition virtual_servers.c:924
listen_find_any
fr_listen_t * listen_find_any(fr_listen_t *li)
See if another global listener is using a particular IP / port.
Definition virtual_servers.c:913
Generated by   doxygen 1.9.8