The FreeRADIUS server $Id: 15bac2a4c627c01d1aa2047687b3418955ac7f00 $
Loading...
Searching...
No Matches
bio.c
Go to the documentation of this file.
1/*
2 * This program is is free software; you can redistribute it and/or modify
3 * it under the terms of the GNU General Public License as published by
4 * the Free Software Foundation; either version 2 of the License, or (at
5 * your option) any later version.
6 *
7 * This program is distributed in the hope that it will be useful,
8 * but WITHOUT ANY WARRANTY; without even the implied warranty of
9 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10 * GNU General Public License for more details.
11 *
12 * You should have received a copy of the GNU General Public License
13 * along with this program; if not, write to the Free Software
14 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
15 */
16
17/**
18 * $Id: f6e056f7ebc531bce375791050e2d7faf2b72278 $
19 * @file src/modules/rlm_radius/bio.c
20 * @brief RADIUS BIO transport
21 *
22 * @copyright 2017 Network RADIUS SAS
23 * @copyright 2020 Arran Cudbard-Bell (a.cudbardb@freeradius.org)
24 */
25
26#include <freeradius-devel/io/application.h>
27#include <freeradius-devel/io/listen.h>
28#include <freeradius-devel/io/pair.h>
29#include <freeradius-devel/missing.h>
30#include <freeradius-devel/server/connection.h>
31#include <freeradius-devel/util/debug.h>
32#include <freeradius-devel/util/heap.h>
33#include <freeradius-devel/util/rb_expire.h>
34
35#include <sys/socket.h>
36
37//#include "rlm_radius.h"
38#include "track.h"
39
40typedef struct {
41 char const *module_name; //!< the module that opened the connection
42 rlm_radius_t const *inst; //!< our instance
43 fr_event_list_t *el; //!< Event list.
44 trunk_t *trunk; //!< trunk handler
45 fr_bio_fd_config_t fd_config; //!< for threads or sockets
46 fr_bio_fd_info_t const *fd_info; //!< status of the FD.
49
50typedef struct {
51 bio_handle_ctx_t ctx; //!< common struct for home servers and BIO handles
52
53 struct {
54 fr_bio_t *fd; //!< writing
55 uint32_t id; //!< for replication
56 fr_rb_expire_t expires; //!< for proxying / client sending
57 } bio;
59
61
62/** Track the handle, which is tightly correlated with the FD
63 *
64 */
65typedef struct {
66 bio_handle_ctx_t ctx; //!< common struct for home servers and BIO handles
67
68 int fd; //!< File descriptor.
69
70 struct {
71 fr_bio_t *read; //!< what we use for input
72 fr_bio_t *write; //!< what we use for output
73 fr_bio_t *fd; //!< raw FD
74 fr_bio_t *mem; //!< memory wrappers for stream sockets
75 } bio;
76
78
79 uint8_t last_id; //!< Used when replicating to ensure IDs are distributed
80 ///< evenly.
81
82 uint32_t max_packet_size; //!< Our max packet size. may be different from the parent.
83
84 uint8_t *buffer; //!< Receive buffer.
85 size_t buflen; //!< Receive buffer length.
86
87 radius_track_t *tt; //!< RADIUS ID tracking structure.
88
89 fr_time_t mrs_time; //!< Most recent sent time which had a reply.
90 fr_time_t last_reply; //!< When we last received a reply.
91 fr_time_t first_sent; //!< first time we sent a packet since going idle
92 fr_time_t last_sent; //!< last time we sent a packet.
93 fr_time_t last_idle; //!< last time we had nothing to do
94
95 fr_timer_t *zombie_ev; //!< Zombie timeout.
96
97 bool status_checking; //!< whether we're doing status checks
98 bio_request_t *status_u; //!< for sending status check packets
101
102
103/** Connect request_t to local tracking structure
104 *
105 */
108 rlm_rcode_t rcode; //!< from the transport
110
111 uint32_t priority; //!< copied from request->async->priority
112 fr_time_t recv_time; //!< copied from request->async->recv_time
113
114 uint32_t num_replies; //!< number of reply packets, sent is in retry.count
115
116 bool status_check; //!< is this packet a status check?
117 bool proxied; //!< is this request being proxied
118
119 fr_pair_list_t extra; //!< VPs for debugging, like Proxy-State.
120
121 uint8_t code; //!< Packet code.
122 uint8_t id; //!< Last ID assigned to this packet.
123 uint8_t *packet; //!< Packet we write to the network.
124 size_t packet_len; //!< Length of the packet.
125 size_t partial; //!< partially sent data
126
127 radius_track_entry_t *rr; //!< ID tracking, resend count, etc.
128 fr_timer_t *ev; //!< timer for retransmissions
129 fr_retry_t retry; //!< retransmission timers
130};
131
132typedef struct {
133 bio_handle_ctx_t ctx; //!< for copying to bio_handle_t
134
137
138/** Turn a reply code into a module rcode;
139 *
140 */
156
158 UNUSED int flags, void *uctx);
159
160static int encode(bio_handle_t *h, request_t *request, bio_request_t *u, uint8_t id);
161
162static fr_radius_decode_fail_t decode(TALLOC_CTX *ctx, fr_pair_list_t *reply, uint8_t *response_code,
163 bio_handle_t *h, request_t *request, bio_request_t *u,
164 uint8_t const request_authenticator[static RADIUS_AUTH_VECTOR_LENGTH],
165 uint8_t *data, size_t data_len);
166
168
169static void mod_write(request_t *request, trunk_request_t *treq, bio_handle_t *h);
170
171static int _bio_request_free(bio_request_t *u);
172
173static int8_t home_server_cmp(void const *one, void const *two);
174
175#ifndef NDEBUG
176/** Log additional information about a tracking entry
177 *
178 * @param[in] te Tracking entry we're logging information for.
179 * @param[in] log destination.
180 * @param[in] log_type Type of log message.
181 * @param[in] file the logging request was made in.
182 * @param[in] line logging request was made on.
183 */
184static void bio_tracking_entry_log(fr_log_t const *log, fr_log_type_t log_type, char const *file, int line,
186{
187 request_t *request;
188
189 if (!te->request) return; /* Free entry */
190
191 request = talloc_get_type_abort(te->request, request_t);
192
193 fr_log(log, log_type, file, line, "request %s, allocated %s:%d", request->name,
194 request->alloc_file, request->alloc_line);
195
196 trunk_request_state_log(log, log_type, file, line, talloc_get_type_abort(te->uctx, trunk_request_t));
197}
198#endif
199
200/** Clear out any connection specific resources from a udp request
201 *
202 */
204{
205 TALLOC_FREE(u->packet);
207
208 /*
209 * Can have packet put no u->rr
210 * if this is part of a pre-trunk status check.
211 */
212 if (u->rr) radius_track_entry_release(&u->rr);
213
215}
216
217/** Reset a status_check packet, ready to reuse
218 *
219 */
221{
222 fr_assert(u->status_check == true);
223
224 h->status_checking = false;
225 u->num_replies = 0; /* Reset */
226 u->retry.start = fr_time_wrap(0);
227
229
231}
232
233/*
234 * Status-Server checks. Manually build the packet, and
235 * all of its associated glue.
236 */
238{
239 bio_request_t *u;
240 request_t *request;
241 rlm_radius_t const *inst = h->ctx.inst;
242 map_t *map = NULL;
243
245
246 MEM(request = request_local_alloc_external(h, (&(request_init_args_t){ .namespace = dict_radius })));
247 MEM(u = talloc_zero(request, bio_request_t));
248 talloc_set_destructor(u, _bio_request_free);
249
250 h->status_u = u;
251
252 h->status_request = request;
254
255 /*
256 * Status checks are prioritized over any other packet
257 */
258 u->priority = ~(uint32_t) 0;
259 u->status_check = true;
260
261 /*
262 * Allocate outside of the free list.
263 * There appears to be an issue where
264 * the thread destructor runs too
265 * early, and frees the freelist's
266 * head before the module destructor
267 * runs.
268 */
269 request->async = talloc_zero(request, fr_async_t);
270 talloc_const_free(request->name);
271 request->name = talloc_strdup(request, h->ctx.module_name);
272
273 request->packet = fr_packet_alloc(request, false);
274 request->reply = fr_packet_alloc(request, false);
275
276 /*
277 * Create the VPs, and ignore any errors
278 * creating them.
279 */
280 while ((map = map_list_next(&inst->status_check_map, map))) {
281 (void) map_to_request(request, map, map_to_vp, NULL);
282 }
283
284 /*
285 * Ensure that there's a NAS-Identifier, if one wasn't
286 * already added.
287 */
288 if (!fr_pair_find_by_da(&request->request_pairs, NULL, attr_nas_identifier)) {
289 fr_pair_t *vp;
290
292 fr_pair_value_strdup(vp, "status check - are you alive?", false);
293 }
294
295 /*
296 * Always add an Event-Timestamp, which will be the time
297 * at which the first packet is sent. Or for
298 * Status-Server, the time of the current packet.
299 */
300 if (!fr_pair_find_by_da(&request->request_pairs, NULL, attr_event_timestamp)) {
302 }
303
304 /*
305 * Initialize the request IO ctx. Note that we don't set
306 * destructors.
307 */
308 u->code = inst->status_check;
309 request->packet->code = u->code;
310
311 DEBUG3("%s - Status check packet type will be %s", h->ctx.module_name, fr_radius_packet_name[u->code]);
312 log_request_pair_list(L_DBG_LVL_3, request, NULL, &request->request_pairs, NULL);
313}
314
315/** Connection errored
316 *
317 * We were signalled by the event loop that a fatal error occurred on this connection.
318 *
319 * @param[in] el The event list signalling.
320 * @param[in] fd that errored.
321 * @param[in] flags El flags.
322 * @param[in] fd_errno The nature of the error.
323 * @param[in] uctx The trunk connection handle (tconn).
324 */
325static void conn_init_error(UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, int fd_errno, void *uctx)
326{
327 connection_t *conn = talloc_get_type_abort(uctx, connection_t);
328 bio_handle_t *h;
329
330 /*
331 * Connection must be in the connecting state when this fires
332 */
334
335 h = talloc_get_type_abort(conn->h, bio_handle_t);
336
337 ERROR("%s - Connection %s failed: %s", h->ctx.module_name, h->ctx.fd_info->name, fr_syserror(fd_errno));
338
340}
341
342/** Status check timer when opening the connection for the first time.
343 *
344 * Setup retries, or fail the connection.
345 */
346static void conn_init_timeout(UNUSED fr_timer_list_t *tl, fr_time_t now, void *uctx)
347{
348 connection_t *conn = talloc_get_type_abort(uctx, connection_t);
349 bio_handle_t *h;
350 bio_request_t *u;
351
352 /*
353 * Connection must be in the connecting state when this fires
354 */
356
357 h = talloc_get_type_abort(conn->h, bio_handle_t);
358 u = h->status_u;
359
360 /*
361 * We're only interested in contiguous, good, replies.
362 */
363 u->num_replies = 0;
364
365 switch (fr_retry_next(&u->retry, now)) {
366 case FR_RETRY_MRD:
367 DEBUG("%s - Reached maximum_retransmit_duration (%pVs > %pVs), failing status checks",
370 goto fail;
371
372 case FR_RETRY_MRC:
373 DEBUG("%s - Reached maximum_retransmit_count (%u > %u), failing status checks",
375 fail:
377 return;
378
380 if (fr_event_fd_insert(h, NULL, conn->el, h->fd, conn_init_writable, NULL,
381 conn_init_error, conn) < 0) {
382 PERROR("%s - Failed inserting FD event", h->ctx.module_name);
384 }
385 return;
386 }
387
388 fr_assert(0);
389}
390
391/** Perform the next step of init and negotiation.
392 *
393 */
394static void conn_init_next(UNUSED fr_timer_list_t *tl, UNUSED fr_time_t now, void *uctx)
395{
396 connection_t *conn = talloc_get_type_abort(uctx, connection_t);
397 bio_handle_t *h = talloc_get_type_abort(conn->h, bio_handle_t);
398
399 if (fr_event_fd_insert(h, NULL, conn->el, h->fd, conn_init_writable, NULL, conn_init_error, conn) < 0) {
400 PERROR("%s - Failed inserting FD event", h->ctx.module_name);
402 }
403}
404
405/** Read the connection during the init and negotiation stage.
406 *
407 */
408static void conn_init_readable(fr_event_list_t *el, UNUSED int fd, UNUSED int flags, void *uctx)
409{
410 connection_t *conn = talloc_get_type_abort(uctx, connection_t);
411 bio_handle_t *h = talloc_get_type_abort(conn->h, bio_handle_t);
412 trunk_t *trunk = h->ctx.trunk;
413 rlm_radius_t const *inst = h->ctx.inst;
414 bio_request_t *u = h->status_u;
415 ssize_t slen;
416 fr_pair_list_t reply;
417 uint8_t code = 0;
418
419 fr_pair_list_init(&reply);
420 slen = fr_bio_read(h->bio.read, NULL, h->buffer, h->buflen);
421 if (slen == 0) {
422 /*
423 * @todo - set BIO FD EOF callback, so that we don't have to check it here.
424 */
425 if (h->ctx.fd_info->eof) goto failed;
426 return;
427 }
428
429 /*
430 * We're done reading, return.
431 */
432 if (slen == fr_bio_error(IO_WOULD_BLOCK)) return;
433
434 if (slen < 0) {
435 switch (errno) {
436 case ECONNREFUSED:
437 ERROR("%s - Failed reading response from socket: there is no server listening on outgoing connection %s",
438 h->ctx.module_name, h->ctx.fd_info->name);
439 break;
440
441 default:
442 ERROR("%s - Failed reading response from socket: %s",
443 h->ctx.module_name, fr_syserror(errno));
444 break;
445 }
446
447 failed:
449 return;
450 }
451
452 /*
453 * Where we just return in this function, we're letting
454 * the response timer take care of progressing the
455 * connection attempt.
456 */
457 fr_assert(slen >= RADIUS_HEADER_LENGTH); /* checked in verify */
458
459 if (u->id != h->buffer[1]) {
460 ERROR("%s - Received response with incorrect or expired ID. Expected %u, got %u",
461 h->ctx.module_name, u->id, h->buffer[1]);
462 return;
463 }
464
465 if (decode(h, &reply, &code,
467 h->buffer, slen) != DECODE_FAIL_NONE) return;
468
469 fr_pair_list_free(&reply); /* FIXME - Do something with these... */
470
471 /*
472 * Process the error, and count this as a success.
473 * This is usually used for dynamic configuration
474 * on startup.
475 */
477
478 /*
479 * Last trunk event was a failure, be more careful about
480 * bringing up the connection (require multiple responses).
481 */
482 if ((fr_time_gt(trunk->last_failed, fr_time_wrap(0)) && (fr_time_gt(trunk->last_failed, trunk->last_connected))) &&
483 (u->num_replies < inst->num_answers_to_alive)) {
484 /*
485 * Leave the timer in place. This timer is BOTH when we
486 * give up on the current status check, AND when we send
487 * the next status check.
488 */
489 DEBUG("%s - Received %u / %u replies for status check, on connection - %s",
490 h->ctx.module_name, u->num_replies, inst->num_answers_to_alive, h->ctx.fd_info->name);
491 DEBUG("%s - Next status check packet will be in %pVs",
493
494 /*
495 * Set the timer for the next retransmit.
496 */
497 if (fr_timer_at(h, el->tl, &u->ev, u->retry.next, false, conn_init_next, conn) < 0) {
499 }
500 return;
501 }
502
503 /*
504 * It's alive!
505 */
506 status_check_reset(h, u);
507
508 DEBUG("%s - Connection open - %s", h->ctx.module_name, h->ctx.fd_info->name);
509
511}
512
513/** Send initial negotiation.
514 *
515 */
516static void conn_init_writable(fr_event_list_t *el, UNUSED int fd, UNUSED int flags, void *uctx)
517{
518 connection_t *conn = talloc_get_type_abort(uctx, connection_t);
519 bio_handle_t *h = talloc_get_type_abort(conn->h, bio_handle_t);
520 bio_request_t *u = h->status_u;
521 ssize_t slen;
522
523 if (fr_time_eq(u->retry.start, fr_time_wrap(0))) {
524 u->id = fr_rand() & 0xff; /* We don't care what the value is here */
525 h->status_checking = true; /* Ensure this is valid */
526 fr_retry_init(&u->retry, fr_time(), &h->ctx.inst->retry[u->code]);
527
528 /*
529 * Status checks can never be retransmitted
530 * So increment the ID here.
531 */
532 } else {
534 u->id++;
535 }
536
537 DEBUG("%s - Sending %s ID %d over connection %s",
539
540 if (encode(h, h->status_request, u, u->id) < 0) {
541 fail:
543 return;
544 }
545 DEBUG3("Encoded packet");
546 HEXDUMP3(u->packet, u->packet_len, NULL);
547
548 fr_assert(u->packet != NULL);
550
551 slen = fr_bio_write(h->bio.write, NULL, u->packet, u->packet_len);
552
553 if (slen == fr_bio_error(IO_WOULD_BLOCK)) goto blocked;
554
555 if (slen < 0) {
556 ERROR("%s - Failed sending %s ID %d length %zu over connection %s: %s",
558
559
560 goto fail;
561 }
562
563 /*
564 * @todo - handle partial packets and blocked writes.
565 */
566 if ((size_t)slen < u->packet_len) {
567 blocked:
568 ERROR("%s - Failed sending %s ID %d length %zu over connection %s: writing is blocked",
570 goto fail;
571 }
572
573 /*
574 * Switch to waiting on read and insert the event
575 * for the response timeout.
576 */
577 if (fr_event_fd_insert(h, NULL, conn->el, h->fd, conn_init_readable, NULL, conn_init_error, conn) < 0) {
578 PERROR("%s - Failed inserting FD event", h->ctx.module_name);
579 goto fail;
580 }
581
582 DEBUG("%s - %s request. Expecting response within %pVs",
583 h->ctx.module_name, (u->retry.count == 1) ? "Originated" : "Retransmitted",
585
586 if (fr_timer_at(h, el->tl, &u->ev, u->retry.next, false, conn_init_timeout, conn) < 0) {
587 PERROR("%s - Failed inserting timer event", h->ctx.module_name);
588 goto fail;
589 }
590
591 /*
592 * Save a copy of the header + Authentication Vector for checking the response.
593 */
594 MEM(u->packet = talloc_memdup(u, u->packet, RADIUS_HEADER_LENGTH));
595}
596
597/** Free a connection handle, closing associated resources
598 *
599 */
601{
602 fr_assert(h != NULL);
603
604 fr_assert(h->fd >= 0);
605
607
608 /*
609 * The connection code will take care of deleting the FD from the event loop.
610 */
611
612 DEBUG("%s - Connection closed - %s", h->ctx.module_name, h->ctx.fd_info->name);
613
614 return 0;
615}
616
617static void bio_connected(fr_bio_t *bio)
618{
619 bio_handle_t *h = bio->uctx;
620
621 DEBUG("%s - Connection open - %s", h->ctx.module_name, h->ctx.fd_info->name);
622
624}
625
626static void bio_error(fr_bio_t *bio)
627{
628 bio_handle_t *h = bio->uctx;
629
630 DEBUG("%s - Connection failed - %s - %s", h->ctx.module_name, h->ctx.fd_info->name,
632
634}
635
636static fr_bio_verify_action_t rlm_radius_verify(UNUSED fr_bio_t *bio, void *verify_ctx, UNUSED void *packet_ctx, const void *data, size_t *size)
637{
639 size_t in_buffer = *size;
640 bio_handle_t *h = verify_ctx;
641 uint8_t const *hdr = data;
642 size_t want;
643
644 if (in_buffer < 20) {
645 *size = RADIUS_HEADER_LENGTH;
647 }
648
649 /*
650 * Packet is too large, discard it.
651 */
652 want = fr_nbo_to_uint16(hdr + 2);
653 if (want > h->ctx.inst->max_packet_size) {
654 ERROR("%s - Connection %s received too long packet", h->ctx.module_name, h->ctx.fd_info->name);
656 }
657
658 /*
659 * Not a full packet, we want more data.
660 */
661 if (want < *size) {
662 *size = want;
664 }
665
666#define REQUIRE_MA(_h) (((_h)->ctx.inst->require_message_authenticator == FR_RADIUS_REQUIRE_MA_YES) || *(_h)->ctx.inst->received_message_authenticator)
667
668 /*
669 * See if we need to discard the packet.
670 *
671 * @todo - rate limit these messages, and find a way to associate them with a request, or even
672 * the logging destination of the module.
673 */
674 if (!fr_radius_ok(data, size, h->ctx.inst->max_attributes, REQUIRE_MA(h), &failure)) {
676
677 PERROR("%s - Connection %s received bad packet", h->ctx.module_name, h->ctx.fd_info->name);
678
679 if (failure == DECODE_FAIL_MA_MISSING) {
681 ERROR("We are configured with 'require_message_authenticator = true'");
682 } else {
683 ERROR("We previously received a packet from this client which included a Message-Authenticator attribute");
684 }
685 }
686
687 if (h->ctx.fd_config.socket_type == SOCK_DGRAM) return FR_BIO_VERIFY_DISCARD;
688
690 }
691
692 /*
693 * @todo - check if the reply is allowed. Bad replies are discarded later, but it might be worth
694 * checking them here.
695 */
696
697 /*
698 * On input, *size is how much data we have. On output, *size is how much data we want.
699 */
700 return (in_buffer >= *size) ? FR_BIO_VERIFY_OK : FR_BIO_VERIFY_WANT_MORE;
701}
702
703
704/** Initialise a new outbound connection
705 *
706 * @param[out] h_out Where to write the new file descriptor.
707 * @param[in] conn to initialise.
708 * @param[in] uctx A #bio_thread_t
709 */
710CC_NO_UBSAN(function) /* UBSAN: false positive - public vs private connection_t trips --fsanitize=function*/
711static connection_state_t conn_init(void **h_out, connection_t *conn, void *uctx)
712{
713 int fd;
714 bio_handle_t *h;
715 bio_handle_ctx_t *ctx = uctx; /* thread or home server */
716
717 MEM(h = talloc_zero(conn, bio_handle_t));
718 h->ctx = *ctx;
719 h->conn = conn;
721 h->last_idle = fr_time();
722
723 MEM(h->buffer = talloc_array(h, uint8_t, h->max_packet_size));
724 h->buflen = h->max_packet_size;
725
726 MEM(h->tt = radius_track_alloc(h));
727
728 h->bio.fd = fr_bio_fd_alloc(h, &h->ctx.fd_config, 0);
729 if (!h->bio.fd) {
730 PERROR("%s - failed opening socket", h->ctx.module_name);
731 fail:
732 talloc_free(h);
734 }
735
736 h->bio.fd->uctx = h;
738
739 fd = h->ctx.fd_info->socket.fd;
740 fr_assert(fd >= 0);
741
742 /*
743 * Create a memory BIO for stream sockets. We want to return only complete packets, and not
744 * partial packets.
745 *
746 * @todo - maybe we want to have a fr_bio_verify_t which is independent of fr_bio_mem_t. That
747 * way we don't need a memory BIO for UDP sockets, but we can still add a verification layer for
748 * UDP sockets?
749 */
750 h->bio.mem = fr_bio_mem_alloc(h, (h->ctx.fd_config.socket_type == SOCK_DGRAM) ? 0 : h->ctx.inst->max_packet_size * 4,
751 0, h->bio.fd);
752 if (!h->bio.mem) {
753 PERROR("%s - Failed allocating memory buffer - ", h->ctx.module_name);
754 goto fail;
755 }
756
757 if (fr_bio_mem_set_verify(h->bio.mem, rlm_radius_verify, h, (h->ctx.fd_config.socket_type == SOCK_DGRAM)) < 0) {
758 PERROR("%s - Failed setting validation callback - ", h->ctx.module_name);
759 goto fail;
760 }
761
762 /*
763 * Set the BIO read function to be the memory BIO, which will then call the packet verification
764 * routine.
765 */
766 h->bio.read = h->bio.write = h->bio.mem;
767 h->bio.mem->uctx = h;
768
769 h->fd = fd;
770
771 talloc_set_destructor(h, _bio_handle_free);
772
773 /*
774 * If the socket isn't connected, then do that first.
775 */
777 int rcode;
778
780
781 /*
782 * We don't pass timeouts here because the trunk has it's own connection timeouts.
783 */
784 rcode = fr_bio_fd_connect_full(h->bio.fd, conn->el, bio_connected, bio_error, NULL, NULL);
785 if (rcode < 0) goto fail;
786
787 *h_out = h;
788
789 if (rcode == 0) return CONNECTION_STATE_CONNECTING;
790
791 fr_assert(rcode == 1);
793
794 /*
795 * If we're doing status checks, then we want at least
796 * one positive response before signalling that the
797 * connection is open.
798 *
799 * To do this we install special I/O handlers that
800 * only signal the connection as open once we get a
801 * status-check response.
802 */
803 } if (h->ctx.inst->status_check) {
805
806 /*
807 * Start status checking.
808 *
809 * If we've had no recent failures we need exactly
810 * one response to bring the connection online,
811 * otherwise we need inst->num_answers_to_alive
812 */
813 if (fr_event_fd_insert(h, NULL, conn->el, h->fd, NULL,
814 conn_init_writable, conn_init_error, conn) < 0) goto fail;
815
816 /*
817 * If we're not doing status-checks, signal the connection
818 * as open as soon as it becomes writable.
819 */
820 } else {
821 connection_signal_on_fd(conn, fd);
822 }
823
824 *h_out = h;
825
827}
828
829/** Shutdown/close a file descriptor
830 *
831 */
832static void conn_close(UNUSED fr_event_list_t *el, void *handle, UNUSED void *uctx)
833{
834 bio_handle_t *h = talloc_get_type_abort(handle, bio_handle_t);
835
836 /*
837 * There's tracking entries still allocated
838 * this is bad, they should have all been
839 * released.
840 */
841 if (h->tt && (h->tt->num_requests != 0)) {
842#ifndef NDEBUG
844#endif
845 fr_assert_fail("%u tracking entries still allocated at conn close", h->tt->num_requests);
846 }
847
848 DEBUG4("Freeing handle %p", handle);
849
850 talloc_free(h);
851}
852
853/** Connection failed
854 *
855 * @param[in] handle of connection that failed.
856 * @param[in] state the connection was in when it failed.
857 * @param[in] uctx UNUSED.
858 */
859static connection_state_t conn_failed(void *handle, connection_state_t state, UNUSED void *uctx)
860{
861 switch (state) {
862 /*
863 * If the connection was connected when it failed,
864 * we need to handle any outstanding packets and
865 * timer events before reconnecting.
866 */
868 {
869 bio_handle_t *h = talloc_get_type_abort(handle, bio_handle_t); /* h only available if connected */
870
871 /*
872 * Reset the Status-Server checks.
873 */
874 if (h->status_u) FR_TIMER_DISARM(h->status_u->ev);
875 break;
876
877 default:
878 break;
879 }
880 }
881
883}
884
885CC_NO_UBSAN(function) /* UBSAN: false positive - public vs private connection_t trips --fsanitize=function*/
887 connection_conf_t const *conf,
888 char const *log_prefix, void *uctx)
889{
890 connection_t *conn;
891 bio_handle_ctx_t *ctx = uctx; /* thread or home server */
892
893 conn = connection_alloc(tconn, el,
895 .init = conn_init,
896 .close = conn_close,
897 .failed = conn_failed
898 },
899 conf,
900 log_prefix,
901 uctx);
902 if (!conn) {
903 PERROR("%s - Failed allocating state handler for new connection", ctx->inst->name);
904 return NULL;
905 }
906 ctx->trunk = tconn->trunk;
907 ctx->module_name = log_prefix;
908
909 return conn;
910}
911
912/** Read and discard data
913 *
914 */
915static void conn_discard(UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, void *uctx)
916{
917 trunk_connection_t *tconn = talloc_get_type_abort(uctx, trunk_connection_t);
918 bio_handle_t *h = talloc_get_type_abort(tconn->conn->h, bio_handle_t);
919 uint8_t buffer[4096];
920 ssize_t slen;
921
922 while ((slen = fr_bio_read(h->bio.read, NULL, buffer, sizeof(buffer))) > 0);
923
924 if (slen < 0) {
925 switch (errno) {
926 case EBADF:
927 case ECONNRESET:
928 case ENOTCONN:
929 case ETIMEDOUT:
930 ERROR("%s - Failed draining socket: %s", h->ctx.module_name, fr_syserror(errno));
932 break;
933
934 default:
935 break;
936 }
937 }
938}
939
940/** Connection errored
941 *
942 * We were signalled by the event loop that a fatal error occurred on this connection.
943 *
944 * @param[in] el The event list signalling.
945 * @param[in] fd that errored.
946 * @param[in] flags El flags.
947 * @param[in] fd_errno The nature of the error.
948 * @param[in] uctx The trunk connection handle (tconn).
949 */
950static void conn_error(UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, int fd_errno, void *uctx)
951{
952 trunk_connection_t *tconn = talloc_get_type_abort(uctx, trunk_connection_t);
953 connection_t *conn = tconn->conn;
954 bio_handle_t *h = talloc_get_type_abort(conn->h, bio_handle_t);
955
956 ERROR("%s - Connection %s failed: %s", h->ctx.module_name, h->ctx.fd_info->name, fr_syserror(fd_errno));
957
959}
960
961CC_NO_UBSAN(function) /* UBSAN: false positive - public vs private connection_t trips --fsanitize=function*/
964 trunk_connection_event_t notify_on, UNUSED void *uctx)
965{
966 bio_handle_t *h = talloc_get_type_abort(conn->h, bio_handle_t);
967 fr_event_fd_cb_t read_fn = NULL;
968 fr_event_fd_cb_t write_fn = NULL;
969
970 switch (notify_on) {
971 /*
972 * We may have sent multiple requests to the
973 * other end, so it might be sending us multiple
974 * replies. We want to drain the socket, instead
975 * of letting the packets sit in the UDP receive
976 * queue.
977 */
979 read_fn = conn_discard;
980 break;
981
984 break;
985
988 break;
989
993 break;
994
995 }
996
997 /*
998 * Over-ride read for replication.
999 */
1001 read_fn = conn_discard;
1002
1003 if (fr_bio_fd_write_only(h->bio.fd) < 0) {
1004 PERROR("%s - Failed setting socket to write-only", h->ctx.module_name);
1006 return;
1007 }
1008 }
1009
1010 if (fr_event_fd_insert(h, NULL, el, h->fd,
1011 read_fn,
1012 write_fn,
1013 conn_error,
1014 tconn) < 0) {
1015 PERROR("%s - Failed inserting FD event", h->ctx.module_name);
1016
1017 /*
1018 * May free the connection!
1019 */
1021 }
1022}
1023
1024/*
1025 * Return negative numbers to put 'a' at the top of the heap.
1026 * Return positive numbers to put 'b' at the top of the heap.
1027 *
1028 * We want the value with the lowest timestamp to be prioritized at
1029 * the top of the heap.
1030 */
1031static int8_t request_prioritise(void const *one, void const *two)
1032{
1033 bio_request_t const *a = one;
1034 bio_request_t const *b = two;
1035 int8_t ret;
1036
1037 /*
1038 * Prioritise status check packets
1039 */
1040 ret = (b->status_check - a->status_check);
1041 if (ret != 0) return ret;
1042
1043 /*
1044 * Larger priority is more important.
1045 */
1046 ret = CMP(a->priority, b->priority);
1047 if (ret != 0) return ret;
1048
1049 /*
1050 * Smaller timestamp (i.e. earlier) is more important.
1051 */
1053}
1054
1055/** Decode response packet data, extracting relevant information and validating the packet
1056 *
1057 * @param[in] ctx to allocate pairs in.
1058 * @param[out] reply Pointer to head of pair list to add reply attributes to.
1059 * @param[out] response_code The type of response packet.
1060 * @param[in] h connection handle.
1061 * @param[in] request the request.
1062 * @param[in] u UDP request.
1063 * @param[in] request_authenticator from the original request.
1064 * @param[in] data to decode.
1065 * @param[in] data_len Length of input data.
1066 * @return
1067 * - DECODE_FAIL_NONE on success.
1068 * - DECODE_FAIL_* on failure.
1069 */
1070static fr_radius_decode_fail_t decode(TALLOC_CTX *ctx, fr_pair_list_t *reply, uint8_t *response_code,
1071 bio_handle_t *h, request_t *request, bio_request_t *u,
1072 uint8_t const request_authenticator[static RADIUS_AUTH_VECTOR_LENGTH],
1073 uint8_t *data, size_t data_len)
1074{
1076 uint8_t code;
1077 fr_radius_decode_ctx_t decode_ctx;
1078
1079 *response_code = 0; /* Initialise to keep the rest of the code happy */
1080
1081 RHEXDUMP3(data, data_len, "Read packet");
1082
1083 decode_ctx = (fr_radius_decode_ctx_t) {
1084 .common = &h->ctx.radius_ctx,
1085 .request_code = u->code,
1086 .request_authenticator = request_authenticator,
1087 .tmp_ctx = talloc(ctx, uint8_t),
1088 .end = data + data_len,
1089 .verify = true,
1090 .require_message_authenticator = REQUIRE_MA(h),
1091 };
1092
1093 if (fr_radius_decode(ctx, reply, data, data_len, &decode_ctx) < 0) {
1094 talloc_free(decode_ctx.tmp_ctx);
1095 RPEDEBUG("Failed reading packet");
1096 return DECODE_FAIL_UNKNOWN;
1097 }
1098 talloc_free(decode_ctx.tmp_ctx);
1099
1100 code = data[0];
1101
1102 RDEBUG("Received %s ID %d length %zu reply packet on connection %s",
1103 fr_radius_packet_name[code], data[1], data_len, h->ctx.fd_info->name);
1104 log_request_pair_list(L_DBG_LVL_2, request, NULL, reply, NULL);
1105
1106 /*
1107 * This code is for BlastRADIUS mitigation.
1108 *
1109 * The scenario where this applies is where we send Message-Authenticator
1110 * but the home server doesn't support it or require it, in which case
1111 * the response can be manipulated by an attacker.
1112 */
1113 if ((u->code == FR_RADIUS_CODE_ACCESS_REQUEST) &&
1114 (inst->require_message_authenticator == FR_RADIUS_REQUIRE_MA_AUTO) &&
1115 !*(inst->received_message_authenticator) &&
1116 fr_pair_find_by_da(&request->request_pairs, NULL, attr_message_authenticator) &&
1117 !fr_pair_find_by_da(&request->request_pairs, NULL, attr_eap_message)) {
1118 RINFO("Packet contained a valid Message-Authenticator. Setting \"require_message_authenticator = yes\"");
1119 *(inst->received_message_authenticator) = true;
1120 }
1121
1122 *response_code = code;
1123
1124 /*
1125 * Record the fact we've seen a response
1126 */
1127 u->num_replies++;
1128
1129 /*
1130 * Fixup retry times
1131 */
1132 if (fr_time_gt(u->retry.start, h->mrs_time)) h->mrs_time = u->retry.start;
1133
1134 return DECODE_FAIL_NONE;
1135}
1136
1137static int encode(bio_handle_t *h, request_t *request, bio_request_t *u, uint8_t id)
1138{
1139 ssize_t packet_len;
1141 rlm_radius_t const *inst = h->ctx.inst;
1142
1143 fr_assert(inst->allowed[u->code]);
1144 fr_assert(!u->packet);
1145
1146 u->packet_len = inst->max_packet_size;
1147 u->packet = h->buffer;
1148
1149 /*
1150 * We should have at minimum 64-byte packets, so don't
1151 * bother doing run-time checks here.
1152 */
1154
1156 .common = &h->ctx.radius_ctx,
1157 .rand_ctx = (fr_fast_rand_t) {
1158 .a = fr_rand(),
1159 .b = fr_rand(),
1160 },
1161 .code = u->code,
1162 .id = id,
1163 .add_proxy_state = u->proxied,
1164 };
1165
1166 /*
1167 * If we're sending a status check packet, update any
1168 * necessary timestamps. Also, don't add Proxy-State, as
1169 * we're originating the packet.
1170 */
1171 if (u->status_check) {
1172 fr_pair_t *vp;
1173
1174 vp = fr_pair_find_by_da(&request->request_pairs, NULL, attr_event_timestamp);
1175 if (vp) vp->vp_date = fr_time_to_unix_time(u->retry.updated);
1176
1177 encode_ctx.add_proxy_state = false;
1178 }
1179
1180 /*
1181 * Encode it, leaving room for Proxy-State if necessary.
1182 */
1183 packet_len = fr_radius_encode(&FR_DBUFF_TMP(u->packet, u->packet_len),
1184 &request->request_pairs, &encode_ctx);
1185 if (fr_pair_encode_is_error(packet_len)) {
1186 RPERROR("Failed encoding packet");
1187
1188 error:
1189 TALLOC_FREE(u->packet);
1190 return -1;
1191 }
1192
1193 if (packet_len < 0) {
1194 size_t have;
1195 size_t need;
1196
1197 have = u->packet_len;
1198 need = have - packet_len;
1199
1200 if (need > RADIUS_MAX_PACKET_SIZE) {
1201 RERROR("Failed encoding packet. Have %zu bytes of buffer, need %zu bytes",
1202 have, need);
1203 } else {
1204 RERROR("Failed encoding packet. Have %zu bytes of buffer, need %zu bytes. "
1205 "Increase 'max_packet_size'", have, need);
1206 }
1207
1208 goto error;
1209 }
1210 /*
1211 * The encoded packet should NOT over-run the input buffer.
1212 */
1213 fr_assert((size_t) packet_len <= u->packet_len);
1214
1215 /*
1216 * Add Proxy-State to the tail end of the packet.
1217 *
1218 * We need to add it here, and NOT in
1219 * request->request_pairs, because multiple modules
1220 * may be sending the packets at the same time.
1221 */
1222 if (encode_ctx.add_proxy_state) {
1223 fr_pair_t *vp;
1224
1226 fr_pair_value_memdup(vp, (uint8_t const *) &inst->common_ctx.proxy_state, sizeof(inst->common_ctx.proxy_state), false);
1227 fr_pair_append(&u->extra, vp);
1228 packet_len += 2 + sizeof(inst->common_ctx.proxy_state);
1229 }
1230
1231 /*
1232 * Update our version of the packet length.
1233 */
1234 u->packet_len = packet_len;
1235
1236 /*
1237 * Now that we're done mangling the packet, sign it.
1238 */
1239 if (fr_radius_sign(u->packet, NULL, (uint8_t const *) h->ctx.radius_ctx.secret,
1240 h->ctx.radius_ctx.secret_length) < 0) {
1241 RPERROR("Failed signing packet");
1242 goto error;
1243 }
1244
1245 return 0;
1246}
1247
1248
1249/** Revive a connection after "revive_interval"
1250 *
1251 */
1252static void revive_timeout(UNUSED fr_timer_list_t *tl, UNUSED fr_time_t now, void *uctx)
1253{
1254 trunk_connection_t *tconn = talloc_get_type_abort(uctx, trunk_connection_t);
1255 bio_handle_t *h = talloc_get_type_abort(tconn->conn->h, bio_handle_t);
1256
1257 INFO("%s - Reviving connection %s", h->ctx.module_name, h->ctx.fd_info->name);
1259}
1260
1261/** Mark a connection dead after "zombie_interval"
1262 *
1263 */
1264static void zombie_timeout(fr_timer_list_t *tl, fr_time_t now, void *uctx)
1265{
1266 trunk_connection_t *tconn = talloc_get_type_abort(uctx, trunk_connection_t);
1267 bio_handle_t *h = talloc_get_type_abort(tconn->conn->h, bio_handle_t);
1268
1269 INFO("%s - No replies during 'zombie_period', marking connection %s as dead", h->ctx.module_name, h->ctx.fd_info->name);
1270
1271 /*
1272 * Don't use this connection, and re-queue all of its
1273 * requests onto other connections.
1274 */
1276
1277 /*
1278 * We do have status checks. Try to reconnect the
1279 * connection immediately. If the status checks pass,
1280 * then the connection will be marked "alive"
1281 */
1282 if (h->ctx.inst->status_check) {
1284 return;
1285 }
1286
1287 /*
1288 * Revive the connection after a time.
1289 */
1290 if (fr_timer_at(h, tl, &h->zombie_ev,
1291 fr_time_add(now, h->ctx.inst->revive_interval), false,
1292 revive_timeout, tconn) < 0) {
1293 ERROR("Failed inserting revive timeout for connection");
1295 }
1296}
1297
1298
1299/** See if the connection is zombied.
1300 *
1301 * We check for zombie when major events happen:
1302 *
1303 * 1) request hits its final timeout
1304 * 2) request timer hits, and it needs to be retransmitted
1305 * 3) a DUP packet comes in, and the request needs to be retransmitted
1306 * 4) we're sending a packet.
1307 *
1308 * There MIGHT not be retries configured, so we MUST check for zombie
1309 * when any new packet comes in. Similarly, there MIGHT not be new
1310 * packets, but retries are configured, so we have to check there,
1311 * too.
1312 *
1313 * Also, the socket might not be writable for a while. There MIGHT
1314 * be a long time between getting the timer / DUP signal, and the
1315 * request finally being written to the socket. So we need to check
1316 * for zombie at BOTH the timeout and the mux / write function.
1317 *
1318 * @return
1319 * - true if the connection is zombie.
1320 * - false if the connection is not zombie.
1321 */
1323{
1324 bio_handle_t *h = talloc_get_type_abort(tconn->conn->h, bio_handle_t);
1325
1326 /*
1327 * We're replicating, and don't care about the health of
1328 * the home server, and this function should not be called.
1329 */
1331
1332 /*
1333 * If we're status checking OR already zombie, don't go to zombie
1334 */
1335 if (h->status_checking || fr_timer_armed(h->zombie_ev)) return true;
1336
1337 if (fr_time_eq(now, fr_time_wrap(0))) now = fr_time();
1338
1339 /*
1340 * We received a reply since this packet was sent, the connection isn't zombie.
1341 */
1342 if (fr_time_gteq(h->last_reply, last_sent)) return false;
1343
1344 /*
1345 * If we've seen ANY response in the allowed window, then the connection is still alive.
1346 */
1347 if ((h->ctx.inst->mode == RLM_RADIUS_MODE_PROXY) && fr_time_gt(last_sent, fr_time_wrap(0)) &&
1348 (fr_time_lt(fr_time_add(last_sent, h->ctx.inst->response_window), now))) return false;
1349
1350 /*
1351 * Stop using it for new requests.
1352 */
1353 WARN("%s - Entering Zombie state - connection %s", h->ctx.module_name, h->ctx.fd_info->name);
1355
1356 if (h->ctx.inst->status_check) {
1357 h->status_checking = true;
1358
1359 /*
1360 * Queue up the status check packet. It will be sent
1361 * when the connection is writable.
1362 */
1364 h->status_u->treq = NULL;
1365
1367 h->status_u, h->status_u, true) != TRUNK_ENQUEUE_OK) {
1369 }
1370 } else {
1371 if (fr_timer_at(h, el->tl, &h->zombie_ev, fr_time_add(now, h->ctx.inst->zombie_period),
1372 false, zombie_timeout, tconn) < 0) {
1373 ERROR("Failed inserting zombie timeout for connection");
1375 }
1376 }
1377
1378 return true;
1379}
1380
1381static void mod_dup(request_t *request, bio_request_t *u)
1382{
1383 bio_handle_t *h;
1384
1385 h = talloc_get_type_abort(u->treq->tconn->conn->h, bio_handle_t);
1386
1387 if (h->ctx.fd_config.socket_type != SOCK_DGRAM) {
1388 RDEBUG("Using stream sockets - suppressing retransmission");
1389 return;
1390 }
1391
1392 /*
1393 * Arguably this should never happen for UDP sockets.
1394 */
1395 if (h->ctx.fd_info->write_blocked) {
1396 RDEBUG("IO is blocked - suppressing retransmission");
1397 return;
1398 }
1399 u->is_retry = true;
1400
1401 /*
1402 * We are doing synchronous proxying, retransmit
1403 * the current request on the same connection.
1404 *
1405 * If it's zombie, we still resend it. If the
1406 * connection is dead, then a callback will move
1407 * this request to a new connection.
1408 */
1409 mod_write(request, u->treq, h);
1410}
1411
1412static void do_retry(rlm_radius_t const *inst, bio_request_t *u, request_t *request, fr_retry_t const *retry);
1413
1414/** Handle module retries.
1415 *
1416 */
1417static void mod_retry(module_ctx_t const *mctx, request_t *request, fr_retry_t const *retry)
1418{
1419 bio_request_t *u = talloc_get_type_abort(mctx->rctx, bio_request_t);
1420 rlm_radius_t const *inst = talloc_get_type_abort(mctx->mi->data, rlm_radius_t);
1421
1422 do_retry(inst, u, request, retry);
1423}
1424
1425static void do_retry(rlm_radius_t const *inst, bio_request_t *u, request_t *request, fr_retry_t const *retry)
1426{
1427 trunk_request_t *treq = talloc_get_type_abort(u->treq, trunk_request_t);
1428 trunk_connection_t *tconn = treq->tconn;
1429 fr_time_t now = retry->updated;
1430
1431 fr_assert(request == treq->request);
1432 fr_assert(treq->preq); /* Must still have a protocol request */
1433 fr_assert(treq->preq == u);
1434
1435 switch (retry->state) {
1436 case FR_RETRY_CONTINUE:
1437 u->retry = *retry;
1438
1439 switch (treq->state) {
1442 fr_assert(0);
1443 break;
1444
1446 RDEBUG("Packet is still in the backlog queue to be sent - suppressing retransmission");
1447 return;
1448
1450 RDEBUG("Packet is still in the pending queue to be sent - suppressing retransmission");
1451 return;
1452
1454 RDEBUG("Packet was partially written, as IO is blocked - suppressing retransmission");
1455 return;
1456
1458 fr_assert(tconn);
1459
1460 mod_dup(request, u);
1461 return;
1462
1470 fr_assert(0);
1471 break;
1472 }
1473 break;
1474
1475 case FR_RETRY_MRD:
1476 REDEBUG("Reached maximum_retransmit_duration (%pVs > %pVs), failing request",
1478 break;
1479
1480 case FR_RETRY_MRC:
1481 REDEBUG("Reached maximum_retransmit_count (%u > %u), failing request",
1482 retry->count, retry->config->mrc);
1483 break;
1484 }
1485
1488
1489 /*
1490 * We don't do zombie stuff!
1491 */
1492 if (!tconn || (inst->mode == RLM_RADIUS_MODE_REPLICATE)) return;
1493
1494 check_for_zombie(unlang_interpret_event_list(request), tconn, now, retry->start);
1495}
1496
1497CC_NO_UBSAN(function) /* UBSAN: false positive - public vs private connection_t trips --fsanitize=function*/
1499 trunk_connection_t *tconn, connection_t *conn, UNUSED void *uctx)
1500{
1501 bio_handle_t *h = talloc_get_type_abort(conn->h, bio_handle_t);
1502 trunk_request_t *treq;
1503 request_t *request;
1504
1505 if (unlikely(trunk_connection_pop_request(&treq, tconn) < 0)) return;
1506
1507 /*
1508 * No more requests to send
1509 */
1510 if (!treq) return;
1511
1512 request = treq->request;
1513
1514 mod_write(request, treq, h);
1515}
1516
1517static void mod_write(request_t *request, trunk_request_t *treq, bio_handle_t *h)
1518{
1519 rlm_radius_t const *inst = h->ctx.inst;
1520 bio_request_t *u;
1521 char const *action;
1522 uint8_t const *packet;
1523 size_t packet_len;
1524 ssize_t slen;
1525
1526 fr_assert((treq->state == TRUNK_REQUEST_STATE_PENDING) ||
1527 (treq->state == TRUNK_REQUEST_STATE_PARTIAL));
1528
1529 u = treq->preq;
1530
1532
1533 /*
1534 * If it's a partial packet, then write the partial bit.
1535 */
1536 if (u->partial) {
1537 fr_assert(u->partial < u->packet_len);
1538 packet = u->packet + u->partial;
1539 packet_len = u->packet_len - u->partial;
1540 goto do_write;
1541 }
1542
1543 /*
1544 * No previous packet, OR can't retransmit the
1545 * existing one. Oh well.
1546 *
1547 * Note that if we can't retransmit the previous
1548 * packet, then u->rr MUST already have been
1549 * deleted in the request_cancel() function
1550 * or request_release_conn() function when
1551 * the REQUEUE signal was received.
1552 */
1553 if (!u->packet) {
1554 fr_assert(!u->rr);
1555
1556 if (unlikely(radius_track_entry_reserve(&u->rr, treq, h->tt, request, u->code, treq) < 0)) {
1557#ifndef NDEBUG
1558 radius_track_state_log(&default_log, L_ERR, __FILE__, __LINE__,
1560#endif
1561 fr_assert_fail("Tracking entry allocation failed: %s", fr_strerror());
1563 return;
1564 }
1565 fr_assert(u->rr);
1566 u->id = u->rr->id;
1567
1568 RDEBUG("Sending %s ID %d length %zu over connection %s",
1570
1571 if (encode(h, request, u, u->id) < 0) {
1572 /*
1573 * Need to do this because request_conn_release
1574 * may not be called.
1575 */
1578 return;
1579 }
1580 RHEXDUMP3(u->packet, u->packet_len, "Encoded packet");
1581
1582 /*
1583 * Remember the authentication vector, which now has the
1584 * packet signature.
1585 */
1587 } else {
1588 RDEBUG("Retransmitting %s ID %d length %zu over connection %s",
1590 }
1591
1592 /*
1593 * @todo - When logging Message-Authenticator, don't print its' value.
1594 */
1595 log_request_pair_list(L_DBG_LVL_2, request, NULL, &request->request_pairs, NULL);
1596 if (!fr_pair_list_empty(&u->extra)) log_request_pair_list(L_DBG_LVL_2, request, NULL, &u->extra, NULL);
1597
1598 packet = u->packet;
1599 packet_len = u->packet_len;
1600
1601do_write:
1602 fr_assert(packet != NULL);
1603 fr_assert(packet_len >= RADIUS_HEADER_LENGTH);
1604
1605 slen = fr_bio_write(h->bio.write, NULL, packet, packet_len);
1606
1607 /*
1608 * Can't write anything, requeue it on a different socket.
1609 */
1610 if (slen == fr_bio_error(IO_WOULD_BLOCK)) goto requeue;
1611
1612 if (slen < 0) {
1613 switch (errno) {
1614 /*
1615 * There is an error in the request.
1616 */
1617 case EMSGSIZE: /* Packet size exceeds max size allowed on socket */
1618 ERROR("%s - Failed sending data over connection %s: %s",
1619 h->ctx.module_name, h->ctx.fd_info->name, fr_syserror(errno));
1621 break;
1622
1623 /*
1624 * There is an error in the connection. The reconnection will re-queue any pending or
1625 * sent requests, so we don't have to do any cleanup.
1626 */
1627 default:
1628 ERROR("%s - Failed sending data over connection %s: %s",
1629 h->ctx.module_name, h->ctx.fd_info->name, fr_syserror(errno));
1631 break;
1632 }
1633
1634 return;
1635 }
1636
1637 /*
1638 * No data to send, ignore the write for partials, but otherwise requeue it.
1639 */
1640 if (slen == 0) {
1641 if (u->partial) return;
1642
1643 requeue:
1644 RWARN("%s - Failed sending data over connection %s: sent zero bytes",
1645 h->ctx.module_name, h->ctx.fd_info->name);
1647 return;
1648 }
1649
1650 packet_len += slen;
1651 if (packet_len < u->packet_len) {
1652 /*
1653 * The first time around, save a copy of the packet for later writing.
1654 */
1655 if (!u->partial) MEM(u->packet = talloc_memdup(u, u->packet, u->packet_len));
1656
1657 u->partial = packet_len;
1659 return;
1660 }
1661
1662 /*
1663 * For retransmissions.
1664 */
1665 u->partial = 0;
1666
1667 /*
1668 * Don't print anything extra for replication.
1669 */
1670 if (inst->mode == RLM_RADIUS_MODE_REPLICATE) {
1671 u->rcode = RLM_MODULE_OK;
1673 return;
1674 }
1675
1676 /*
1677 * On first packet, signal it as sent, and update stats.
1678 *
1679 * Later packets are just retransmissions to the BIO, and don't need to involve
1680 * the trunk code.
1681 */
1682 if (u->retry.count == 1) {
1683 h->last_sent = u->retry.start;
1685
1687
1688 action = u->proxied ? "Proxied" : "Originated";
1689
1690 } else {
1691 /*
1692 * We don't signal the trunk that it's been sent, it was already senty
1693 */
1694 action = "Retransmitted";
1695 }
1696
1698
1699 if (!u->proxied) {
1700 RDEBUG("%s request. Expecting response within %pVs", action,
1702
1703 } else {
1704 /*
1705 * If the packet doesn't get a response,
1706 * then bio_request_free() will notice, and run conn_zombie()
1707 */
1708 RDEBUG("%s request. Relying on NAS to perform more retransmissions", action);
1709 }
1710
1711 /*
1712 * We don't retransmit over TCP.
1713 */
1714 if (h->ctx.fd_config.socket_type != SOCK_DGRAM) return;
1715
1716 /*
1717 * If we only send one datagram packet, then don't bother saving it.
1718 */
1719 if (u->retry.config && u->retry.config->mrc == 1) {
1720 u->packet = NULL;
1721 return;
1722 }
1723
1724 MEM(u->packet = talloc_memdup(u, u->packet, u->packet_len));
1725}
1726
1727/** Deal with Protocol-Error replies, and possible negotiation
1728 *
1729 */
1731{
1732 bool error_601 = false;
1733 uint32_t response_length = 0;
1734 uint8_t const *attr, *end;
1735
1736 end = h->buffer + fr_nbo_to_uint16(h->buffer + 2);
1737
1738 for (attr = h->buffer + RADIUS_HEADER_LENGTH;
1739 attr < end;
1740 attr += attr[1]) {
1741 /*
1742 * Error-Cause = Response-Too-Big
1743 */
1744 if ((attr[0] == attr_error_cause->attr) && (attr[1] == 6)) {
1745 uint32_t error;
1746
1747 memcpy(&error, attr + 2, 4);
1748 error = ntohl(error);
1749 if (error == 601) error_601 = true;
1750 continue;
1751 }
1752
1753 /*
1754 * The other end wants us to increase our Response-Length
1755 */
1756 if ((attr[0] == attr_response_length->attr) && (attr[1] == 6)) {
1757 memcpy(&response_length, attr + 2, 4);
1758 continue;
1759 }
1760
1761 /*
1762 * Protocol-Error packets MUST contain an
1763 * Original-Packet-Code attribute.
1764 *
1765 * The attribute containing the
1766 * Original-Packet-Code is an extended
1767 * attribute.
1768 */
1769 if (attr[0] != attr_extended_attribute_1->attr) continue;
1770
1771 /*
1772 * ATTR + LEN + EXT-Attr + uint32
1773 */
1774 if (attr[1] != 7) continue;
1775
1776 /*
1777 * See if there's an Original-Packet-Code.
1778 */
1779 if (attr[2] != (uint8_t)attr_original_packet_code->attr) continue;
1780
1781 /*
1782 * Has to be an 8-bit number.
1783 */
1784 if ((attr[3] != 0) ||
1785 (attr[4] != 0) ||
1786 (attr[5] != 0)) {
1788 return;
1789 }
1790
1791 /*
1792 * The value has to match. We don't
1793 * currently multiplex different codes
1794 * with the same IDs on connections. So
1795 * this check is just for RFC compliance,
1796 * and for sanity.
1797 */
1798 if (attr[6] != u->code) {
1800 return;
1801 }
1802 }
1803
1804 /*
1805 * Error-Cause = Response-Too-Big
1806 *
1807 * The other end says it needs more room to send it's response
1808 *
1809 * Limit it to reasonable values.
1810 */
1811 if (error_601 && response_length && (response_length > h->buflen)) {
1812 if (response_length < 4096) response_length = 4096;
1813 if (response_length > 65535) response_length = 65535;
1814
1815 DEBUG("%s - Increasing buffer size to %u for connection %s", h->ctx.module_name, response_length, h->ctx.fd_info->name);
1816
1817 /*
1818 * Make sure to copy the packet over!
1819 */
1820 attr = h->buffer;
1821 h->buflen = response_length;
1822 MEM(h->buffer = talloc_array(h, uint8_t, h->buflen));
1823
1824 memcpy(h->buffer, attr, end - attr);
1825 }
1826
1827 /*
1828 * fail - something went wrong internally, or with the connection.
1829 * invalid - wrong response to packet
1830 * handled - best remaining alternative :(
1831 *
1832 * i.e. if the response is NOT accept, reject, whatever,
1833 * then we shouldn't allow the caller to do any more
1834 * processing of this packet. There was a protocol
1835 * error, and the response is valid, but not useful for
1836 * anything.
1837 */
1839}
1840
1841
1842/** Handle retries for a status check
1843 *
1844 */
1846{
1847 trunk_connection_t *tconn = talloc_get_type_abort(uctx, trunk_connection_t);
1848 bio_handle_t *h = talloc_get_type_abort(tconn->conn->h, bio_handle_t);
1849
1851 h->status_u, h->status_u, true) != TRUNK_ENQUEUE_OK) {
1853 }
1854}
1855
1856
1857/** Deal with replies replies to status checks and possible negotiation
1858 *
1859 */
1861{
1862 bio_handle_t *h = talloc_get_type_abort(treq->tconn->conn->h, bio_handle_t);
1863 rlm_radius_t const *inst = h->ctx.inst;
1864 bio_request_t *u = talloc_get_type_abort(treq->rctx, bio_request_t);
1865
1866 fr_assert(treq->preq == h->status_u);
1867 fr_assert(treq->rctx == h->status_u);
1868
1869 u->treq = NULL;
1870
1871 /*
1872 * @todo - do other negotiation and signaling.
1873 */
1875
1876 if (u->num_replies < inst->num_answers_to_alive) {
1877 DEBUG("Received %u / %u replies for status check, on connection - %s",
1878 u->num_replies, inst->num_answers_to_alive, h->ctx.fd_info->name);
1879 DEBUG("Next status check packet will be in %pVs", fr_box_time_delta(fr_time_sub(u->retry.next, now)));
1880
1881 /*
1882 * Set the timer for the next retransmit.
1883 */
1884 if (fr_timer_at(h, h->ctx.el->tl, &u->ev, u->retry.next, false, status_check_next, treq->tconn) < 0) {
1886 }
1887 return;
1888 }
1889
1890 DEBUG("Received enough replies to status check, marking connection as active - %s", h->ctx.fd_info->name);
1891
1892 /*
1893 * Set the "last idle" time to now, so that we don't
1894 * restart zombie_period until sufficient time has
1895 * passed.
1896 */
1897 h->last_idle = fr_time();
1898
1899 /*
1900 * Reset retry interval and retransmission counters
1901 * also frees u->ev.
1902 */
1903 status_check_reset(h, u);
1904 trunk_connection_signal_active(treq->tconn);
1905}
1906
1907CC_NO_UBSAN(function) /* UBSAN: false positive - public vs private connection_t trips --fsanitize=function*/
1909{
1910 bio_handle_t *h = talloc_get_type_abort(conn->h, bio_handle_t);
1911
1912 DEBUG3("%s - Reading data for connection %s", h->ctx.module_name, h->ctx.fd_info->name);
1913
1914 while (true) {
1915 ssize_t slen;
1916
1917 trunk_request_t *treq;
1918 request_t *request;
1919 bio_request_t *u;
1922 uint8_t code = 0;
1923 fr_pair_list_t reply;
1924 fr_pair_t *vp;
1925
1926 fr_time_t now;
1927
1928 fr_pair_list_init(&reply);
1929
1930 /*
1931 * Drain the socket of all packets. If we're busy, this
1932 * saves a round through the event loop. If we're not
1933 * busy, a few extra system calls don't matter.
1934 */
1935 slen = fr_bio_read(h->bio.read, NULL, h->buffer, h->buflen);
1936 if (slen == 0) {
1937 /*
1938 * @todo - set BIO FD EOF callback, so that we don't have to check it here.
1939 */
1941 return;
1942 }
1943
1944 /*
1945 * We're done reading, return.
1946 */
1947 if (slen == fr_bio_error(IO_WOULD_BLOCK)) return;
1948
1949 if (slen < 0) {
1950 ERROR("%s - Failed reading response from socket: %s",
1951 h->ctx.module_name, fr_syserror(errno));
1953 return;
1954 }
1955
1956 fr_assert(slen >= RADIUS_HEADER_LENGTH); /* checked in verify */
1957
1958 /*
1959 * Note that we don't care about packet codes. All
1960 * packet codes share the same ID space.
1961 */
1962 rr = radius_track_entry_find(h->tt, h->buffer[1], NULL);
1963 if (!rr) {
1964 WARN("%s - Ignoring reply with ID %i that arrived too late",
1965 h->ctx.module_name, h->buffer[1]);
1966 continue;
1967 }
1968
1969 treq = talloc_get_type_abort(rr->uctx, trunk_request_t);
1970 request = treq->request;
1971 fr_assert(request != NULL);
1972 u = talloc_get_type_abort(treq->rctx, bio_request_t);
1973 fr_assert(u == treq->preq);
1974
1975 /*
1976 * Decode the incoming packet.
1977 */
1978 reason = decode(request->reply_ctx, &reply, &code, h, request, u, rr->vector, h->buffer, (size_t)slen);
1979 if (reason != DECODE_FAIL_NONE) continue;
1980
1981 /*
1982 * Only valid packets are processed
1983 * Otherwise an attacker could perform
1984 * a DoS attack against the proxying servers
1985 * by sending fake responses for upstream
1986 * servers.
1987 */
1988 h->last_reply = now = fr_time();
1989
1990 /*
1991 * Status-Server can have any reply code, we don't care
1992 * what it is. So long as it's signed properly, we
1993 * accept it. This flexibility is because we don't
1994 * expose Status-Server to the admins. It's only used by
1995 * this module for internal signalling.
1996 */
1997 if (u == h->status_u) {
1998 fr_pair_list_free(&reply); /* Probably want to pass this to status_check_reply? */
1999 status_check_reply(treq, now);
2001 continue;
2002 }
2003
2004 /*
2005 * Handle any state changes, etc. needed by receiving a
2006 * Protocol-Error reply packet.
2007 *
2008 * Protocol-Error is permitted as a reply to any
2009 * packet.
2010 */
2011 switch (code) {
2014 break;
2015
2016 default:
2017 break;
2018 }
2019
2020 /*
2021 * Mark up the request as being an Access-Challenge, if
2022 * required.
2023 *
2024 * We don't do this for other packet types, because the
2025 * ok/fail nature of the module return code will
2026 * automatically result in it the parent request
2027 * returning an ok/fail packet code.
2028 */
2030 vp = fr_pair_find_by_da(&request->reply_pairs, NULL, attr_packet_type);
2031 if (!vp) {
2032 MEM(vp = fr_pair_afrom_da(request->reply_ctx, attr_packet_type));
2034 fr_pair_append(&request->reply_pairs, vp);
2035 }
2036 }
2037
2038 /*
2039 * Delete Proxy-State attributes from the reply.
2040 */
2042
2043 /*
2044 * If the reply has Message-Authenticator, then over-ride its value with all zeros, so
2045 * that we don't confuse anyone reading the debug output.
2046 */
2047 if ((vp = fr_pair_find_by_da(&reply, NULL, attr_message_authenticator)) != NULL) {
2048 (void) fr_pair_value_memdup(vp, (uint8_t const *) "", 1, false);
2049 }
2050
2051 treq->request->reply->code = code;
2052 u->rcode = radius_code_to_rcode[code];
2053 fr_pair_list_append(&request->reply_pairs, &reply);
2055 }
2056}
2057
2058/*
2059 * This is the same as request_mux(), except that we immediately mark the request as complete.
2060 */
2061CC_NO_UBSAN(function) /* UBSAN: false positive - public vs private connection_t trips --fsanitize=function*/
2063 trunk_connection_t *tconn, connection_t *conn, UNUSED void *uctx)
2064{
2065 bio_handle_t *h = talloc_get_type_abort(conn->h, bio_handle_t);
2066 trunk_request_t *treq;
2067
2068 if (unlikely(trunk_connection_pop_request(&treq, tconn) < 0)) return;
2069
2070 /*
2071 * No more requests to send
2072 */
2073 if (!treq) return;
2074
2075 mod_write(treq->request, treq, h);
2076}
2077
2078CC_NO_UBSAN(function) /* UBSAN: false positive - public vs private connection_t trips --fsanitize=function*/
2080{
2081 bio_handle_t *h = talloc_get_type_abort(conn->h, bio_handle_t);
2082
2083 DEBUG3("%s - Reading data for connection %s", h->ctx.module_name, h->ctx.fd_info->name);
2084
2085 while (true) {
2086 ssize_t slen;
2087
2088 trunk_request_t *treq;
2089 request_t *request;
2090 bio_request_t *u;
2093 uint8_t code = 0;
2094 fr_pair_list_t reply;
2095
2096 fr_time_t now;
2097
2098 fr_pair_list_init(&reply);
2099
2100 /*
2101 * Drain the socket of all packets. If we're busy, this
2102 * saves a round through the event loop. If we're not
2103 * busy, a few extra system calls don't matter.
2104 */
2105 slen = fr_bio_read(h->bio.read, NULL, h->buffer, h->buflen);
2106 if (slen == 0) {
2107 /*
2108 * @todo - set BIO FD EOF callback, so that we don't have to check it here.
2109 */
2111 return;
2112 }
2113
2114 /*
2115 * We're done reading, return.
2116 */
2117 if (slen == fr_bio_error(IO_WOULD_BLOCK)) return;
2118
2119 if (slen < 0) {
2120 ERROR("%s - Failed reading response from socket: %s",
2121 h->ctx.module_name, fr_syserror(errno));
2123 return;
2124 }
2125
2126 fr_assert(slen >= RADIUS_HEADER_LENGTH); /* checked in verify */
2127
2128 /*
2129 * We only pay attention to Protocol-Error replies.
2130 *
2131 * All other packets are discarded.
2132 */
2134 continue;
2135 }
2136
2137 /*
2138 * Note that we don't care about packet codes. All
2139 * packet codes share the same ID space.
2140 */
2141 rr = radius_track_entry_find(h->tt, h->buffer[1], NULL);
2142 if (!rr) {
2143 WARN("%s - Ignoring reply with ID %i that arrived too late",
2144 h->ctx.module_name, h->buffer[1]);
2145 continue;
2146 }
2147
2148 treq = talloc_get_type_abort(rr->uctx, trunk_request_t);
2149 request = treq->request;
2150 fr_assert(request != NULL);
2151 u = talloc_get_type_abort(treq->rctx, bio_request_t);
2152 fr_assert(u == treq->preq);
2153
2154 /*
2155 * Decode the incoming packet
2156 */
2157 reason = decode(request->reply_ctx, &reply, &code, h, request, u, rr->vector, h->buffer, (size_t)slen);
2158 if (reason != DECODE_FAIL_NONE) continue;
2159
2160 /*
2161 * Only valid packets are processed
2162 * Otherwise an attacker could perform
2163 * a DoS attack against the proxying servers
2164 * by sending fake responses for upstream
2165 * servers.
2166 */
2167 h->last_reply = now = fr_time();
2168
2169 /*
2170 * Status-Server can have any reply code, we don't care
2171 * what it is. So long as it's signed properly, we
2172 * accept it. This flexibility is because we don't
2173 * expose Status-Server to the admins. It's only used by
2174 * this module for internal signalling.
2175 */
2176 if (u == h->status_u) {
2177 fr_pair_list_free(&reply); /* Probably want to pass this to status_check_reply? */
2178 status_check_reply(treq, now);
2180 continue;
2181 }
2182
2183 /*
2184 * Handle any state changes, etc. needed by receiving a
2185 * Protocol-Error reply packet.
2186 *
2187 * Protocol-Error is also permitted as a reply to any
2188 * packet.
2189 */
2191 }
2192}
2193
2194
2195/** Remove the request from any tracking structures
2196 *
2197 * Frees encoded packets if the request is being moved to a new connection
2198 */
2199static void request_cancel(UNUSED connection_t *conn, void *preq_to_reset,
2200 trunk_cancel_reason_t reason, UNUSED void *uctx)
2201{
2202 bio_request_t *u = preq_to_reset;
2203
2204 /*
2205 * Request has been requeued on the same
2206 * connection due to timeout or DUP signal. We
2207 * keep the same packet to avoid re-encoding it.
2208 */
2209 if (reason == TRUNK_CANCEL_REASON_REQUEUE) {
2210 /*
2211 * Delete the request_timeout
2212 *
2213 * Note: There might not be a request timeout
2214 * set in the case where the request was
2215 * queued for sendmmsg but never actually
2216 * sent.
2217 */
2218 FR_TIMER_DISARM(u->ev);
2219 }
2220
2221 /*
2222 * Other cancellations are dealt with by
2223 * request_conn_release as the request is removed
2224 * from the trunk.
2225 */
2226}
2227
2228/** Clear out anything associated with the handle from the request
2229 *
2230 */
2231static void request_conn_release(connection_t *conn, void *preq_to_reset, UNUSED void *uctx)
2232{
2233 bio_request_t *u = preq_to_reset;
2234 bio_handle_t *h = talloc_get_type_abort(conn->h, bio_handle_t);
2235
2236 FR_TIMER_DISARM(u->ev);
2238
2239 if (h->ctx.inst->mode == RLM_RADIUS_MODE_REPLICATE) return;
2240
2241 u->num_replies = 0;
2242
2243 /*
2244 * If there are no outstanding tracking entries
2245 * allocated then the connection is "idle".
2246 */
2247 if (!h->tt || (h->tt->num_requests == 0)) h->last_idle = fr_time();
2248}
2249
2250/** Write out a canned failure
2251 *
2252 */
2253static void request_fail(request_t *request, NDEBUG_UNUSED void *preq, void *rctx,
2254 NDEBUG_UNUSED trunk_request_state_t state, UNUSED void *uctx)
2255{
2256 bio_request_t *u = talloc_get_type_abort(rctx, bio_request_t);
2257
2258 fr_assert(u == preq);
2259
2260 fr_assert(!u->rr && !u->packet && fr_pair_list_empty(&u->extra) && !u->ev); /* Dealt with by request_conn_release */
2261
2263
2264 if (u->status_check) return;
2265
2267 u->treq = NULL;
2268
2270}
2271
2272/** Response has already been written to the rctx at this point
2273 *
2274 */
2275static void request_complete(request_t *request, NDEBUG_UNUSED void *preq, void *rctx, UNUSED void *uctx)
2276{
2277 bio_request_t *u = talloc_get_type_abort(rctx, bio_request_t);
2278
2279 fr_assert(u == preq);
2280
2281 fr_assert(!u->rr && !u->packet && fr_pair_list_empty(&u->extra) && !u->ev); /* Dealt with by request_conn_release */
2282
2283 if (u->status_check) return;
2284
2285 u->treq = NULL;
2286
2288}
2289
2290/** Resume execution of the request, returning the rcode set during trunk execution
2291 *
2292 */
2294{
2295 bio_request_t *u = talloc_get_type_abort(mctx->rctx, bio_request_t);
2296 rlm_rcode_t rcode = u->rcode;
2297
2298 talloc_free(u);
2299
2300 RETURN_UNLANG_RCODE(rcode);
2301}
2302
2303static void do_signal(rlm_radius_t const *inst, bio_request_t *u, request_t *request, fr_signal_t action);
2304
2305static void mod_signal(module_ctx_t const *mctx, UNUSED request_t *request, fr_signal_t action)
2306{
2308
2309 bio_request_t *u = talloc_get_type_abort(mctx->rctx, bio_request_t);
2310
2311 do_signal(inst, u, request, action);
2312}
2313
2314static void do_signal(rlm_radius_t const *inst, bio_request_t *u, UNUSED request_t *request, fr_signal_t action)
2315{
2316 /*
2317 * We received a duplicate packet, but we're not doing
2318 * synchronous proxying. Ignore the dup, and rely on the
2319 * IO submodule to time it's own retransmissions.
2320 */
2321 if ((action == FR_SIGNAL_DUP) && (inst->mode != RLM_RADIUS_MODE_PROXY)) return;
2322
2323 /*
2324 * If we don't have a treq associated with the
2325 * rctx it's likely because the request was
2326 * scheduled, but hasn't yet been resumed, and
2327 * has received a signal, OR has been resumed
2328 * and immediately cancelled as the event loop
2329 * is exiting, in which case
2330 * unlang_request_is_scheduled will return false
2331 * (don't use it).
2332 */
2333 if (!u->treq) return;
2334
2335 switch (action) {
2336 /*
2337 * The request is being cancelled, tell the
2338 * trunk so it can clean up the treq.
2339 */
2340 case FR_SIGNAL_CANCEL:
2342 u->treq = NULL;
2343 return;
2344
2345 /*
2346 * Requeue the request on the same connection
2347 * causing a "retransmission" if the request
2348 * has already been sent out.
2349 */
2350 case FR_SIGNAL_DUP:
2351 mod_dup(request, u);
2352 return;
2353
2354 default:
2355 return;
2356 }
2357}
2358
2359/** Free a bio_request_t
2360 *
2361 * Allows us to set break points for debugging.
2362 */
2364{
2365 if (!u->treq) return 0;
2366
2367#ifndef NDEBUG
2368 {
2369 trunk_request_t *treq;
2370 treq = talloc_get_type_abort(u->treq, trunk_request_t);
2371 fr_assert(treq->preq == u);
2372 }
2373#endif
2374
2375 fr_assert_msg(!fr_timer_armed(u->ev), "bio_request_t freed with active timer");
2376
2378
2379 fr_assert(u->rr == NULL);
2380
2381 return 0;
2382}
2383
2384static int mod_enqueue(bio_request_t **p_u, fr_retry_config_t const **p_retry_config,
2385 rlm_radius_t const *inst, trunk_t *trunk, request_t *request)
2386{
2387 bio_request_t *u;
2388 trunk_request_t *treq;
2390
2391 fr_assert(request->packet->code > 0);
2392 fr_assert(request->packet->code < FR_RADIUS_CODE_MAX);
2393
2394 /*
2395 * Do any necessary RADIUS level fixups
2396 * - check Proxy-State
2397 * - do CHAP-Challenge fixups
2398 */
2399 if (radius_fixups(inst, request) < 0) return 0;
2400
2401 treq = trunk_request_alloc(trunk, request);
2402 if (!treq) {
2403 REDEBUG("Failed allocating handler for request");
2404 return -1;
2405 }
2406
2407 MEM(u = talloc_zero(request, bio_request_t));
2408 talloc_set_destructor(u, _bio_request_free);
2409
2410 /*
2411 * Can't use compound literal - const issues.
2412 */
2413 u->code = request->packet->code;
2414 u->priority = request->async->priority;
2415 u->recv_time = request->async->recv_time;
2417
2418 u->retry.count = 1;
2419
2421
2422 switch(trunk_request_enqueue(&treq, trunk, request, u, u)) {
2423 case TRUNK_ENQUEUE_OK:
2425 break;
2426
2428 REDEBUG("Unable to queue packet - connections at maximum capacity");
2429 fail:
2430 fr_assert(!u->rr && !u->packet); /* Should not have been fed to the muxer */
2431 trunk_request_free(&treq); /* Return to the free list */
2432 talloc_free(u);
2433 return -1;
2434
2436 REDEBUG("All destinations are down - cannot send packet");
2437 goto fail;
2438
2439 case TRUNK_ENQUEUE_FAIL:
2440 REDEBUG("Unable to queue packet");
2441 goto fail;
2442 }
2443
2444 u->treq = treq; /* Remember for signalling purposes */
2445 fr_assert(treq->rctx == u);
2446
2447 /*
2448 * Figure out if we're originating the packet or proxying it. And also figure out if we have to
2449 * retry.
2450 */
2451 switch (inst->mode) {
2453 case RLM_RADIUS_MODE_UNCONNECTED_REPLICATE: /* unconnected sockets are UDP, and bypass the trunk */
2454 REDEBUG("Internal sanity check failed - connection trunking cannot be used for replication");
2455 return -1;
2456
2457 /*
2458 * We originate this packet if it was taken from the detail module, which doesn't have a
2459 * real client. @todo - do a better check here.
2460 *
2461 * We originate this packet if the parent request is not compatible with this one
2462 * (i.e. it's from a different protocol).
2463 *
2464 * We originate the packet if the parent is from the same dictionary, but has a different
2465 * packet code. This lets us receive Accounting-Request, and originate
2466 * Disconnect-Request.
2467 */
2470 if (!request->parent) {
2471 u->proxied = (request->client && request->client->cs != NULL);
2472
2473 } else if (!fr_dict_compatible(request->parent->proto_dict, request->proto_dict)) {
2474 u->proxied = false;
2475
2476 } else {
2477 u->proxied = (request->parent->packet->code == request->packet->code);
2478 }
2479
2480 /*
2481 * Proxied packets get a final timeout, as we retry only on DUP packets.
2482 */
2483 if (u->proxied) goto timeout_retry;
2484
2486
2487 /*
2488 * Client packets (i.e. packets we originate) get retries for UDP. And no retries for TCP.
2489 */
2491 if (inst->fd_config.socket_type == SOCK_DGRAM) {
2492 retry_config = &inst->retry[u->code];
2493 break;
2494 }
2496
2497 /*
2498 * Replicated packets are never retried, but they have a timeout if the socket isn't
2499 * ready for writing.
2500 */
2502 timeout_retry:
2503 retry_config = &inst->timeout_retry;
2504 break;
2505 }
2506
2507 /*
2508 * The event loop will take care of demux && sending the
2509 * packet, along with any retransmissions.
2510 */
2511 *p_u = u;
2512 *p_retry_config = retry_config;
2513
2514 return 1;
2515}
2516
2517static void home_server_free(void *data)
2518{
2519 home_server_t *home = data;
2520
2521 talloc_free(home);
2522}
2523
2526 .connection_notify = thread_conn_notify,
2527 .request_prioritise = request_prioritise,
2528 .request_mux = request_mux,
2529 .request_demux = request_demux,
2530 .request_conn_release = request_conn_release,
2531 .request_complete = request_complete,
2532 .request_fail = request_fail,
2533 .request_cancel = request_cancel,
2534};
2535
2538 .connection_notify = thread_conn_notify,
2539 .request_prioritise = request_prioritise,
2540 .request_mux = request_replicate_mux,
2541 .request_demux = request_replicate_demux,
2542 .request_conn_release = request_conn_release,
2543 .request_complete = request_complete,
2544 .request_fail = request_fail,
2545 .request_cancel = request_cancel,
2546};
2547
2548/** Instantiate thread data for the submodule.
2549 *
2550 */
2552{
2553 rlm_radius_t *inst = talloc_get_type_abort(mctx->mi->data, rlm_radius_t);
2554 bio_thread_t *thread = talloc_get_type_abort(mctx->thread, bio_thread_t);
2555
2556 thread->ctx.el = mctx->el;
2557 thread->ctx.inst = inst;
2558 thread->ctx.fd_config = inst->fd_config;
2559 thread->ctx.radius_ctx = inst->common_ctx;
2560
2561 switch (inst->mode) {
2564 inst->home_server_lifetime);
2566
2567 default:
2568 thread->ctx.trunk = trunk_alloc(thread, mctx->el, &io_funcs,
2569 &inst->trunk_conf, inst->name, thread, false);
2570 if (!thread->ctx.trunk) return -1;
2571 return 0;
2572
2574 /*
2575 * We can replicate over TCP, but that uses trunks.
2576 */
2577 if (inst->fd_config.socket_type == SOCK_DGRAM) break;
2578
2579 thread->ctx.trunk = trunk_alloc(thread, mctx->el, &io_replicate_funcs,
2580 &inst->trunk_conf, inst->name, thread, false);
2581 if (!thread->ctx.trunk) return -1;
2582 return 0;
2583
2585 break;
2586 }
2587
2588 /*
2589 * If we have a port range, allocate the source IP based
2590 * on the range start, plus the thread ID. This means
2591 * that we can avoid "hunt and peck" attempts to open up
2592 * the source port.
2593 */
2594 if (thread->ctx.fd_config.src_port_start) {
2596 }
2597
2598 /*
2599 * Allocate an unconnected socket for replication.
2600 */
2601 thread->bio.fd = fr_bio_fd_alloc(thread, &thread->ctx.fd_config, 0);
2602 if (!thread->bio.fd) {
2603 PERROR("%s - failed opening socket", inst->name);
2605 }
2606
2607 thread->bio.fd->uctx = thread;
2608 thread->ctx.fd_info = fr_bio_fd_info(thread->bio.fd);
2609 fr_assert(thread->ctx.fd_info != NULL);
2610
2611 (void) fr_bio_fd_write_only(thread->bio.fd);
2612
2613 DEBUG("%s - Opened unconnected replication socket %s", inst->name, thread->ctx.fd_info->name);
2614 return 0;
2615}
2616
2618 { .required = true, .single = true, .type = FR_TYPE_COMBO_IP_ADDR },
2619 { .required = true, .single = true, .type = FR_TYPE_UINT16 },
2620 { .required = true, .single = true, .type = FR_TYPE_STRING },
2622};
2623
2624/*
2625 * %replicate.sendto.ipaddr(ipaddr, port, secret)
2626 */
2628 xlat_ctx_t const *xctx,
2629 request_t *request, fr_value_box_list_t *args)
2630{
2631 bio_thread_t *thread = talloc_get_type_abort(xctx->mctx->thread, bio_thread_t);
2632 fr_value_box_t *ipaddr, *port, *secret;
2633 ssize_t packet_len;
2634 uint8_t buffer[4096];
2635 fr_radius_ctx_t radius_ctx;
2638
2639 XLAT_ARGS(args, &ipaddr, &port, &secret);
2640
2641 /*
2642 * Can't change IP address families.
2643 */
2644 if (ipaddr->vb_ip.af != thread->ctx.fd_info->socket.af) {
2645 RPERROR("Invalid destination IP address family in %pV", ipaddr);
2646 return XLAT_ACTION_FAIL;
2647 }
2648
2649 /*
2650 * Warn if we're not replicating accounting data. It likely won't wokr/
2651 */
2652 if (request->packet->code != FR_RADIUS_CODE_ACCOUNTING_REQUEST) {
2653 RWDEBUG("Replication of packets other then Accounting-Request will likely not do what you want.");
2654 }
2655
2656 /*
2657 * Set up various context things.
2658 */
2659 radius_ctx = (fr_radius_ctx_t) {
2660 .secret = secret->vb_strvalue,
2661 .secret_length = secret->vb_length,
2662 .proxy_state = 0,
2663 };
2664
2666 .common = &radius_ctx,
2667 .rand_ctx = (fr_fast_rand_t) {
2668 .a = fr_rand(),
2669 .b = fr_rand(),
2670 },
2671 .code = request->packet->code,
2672 .id = thread->bio.id++ & 0xff,
2673 .add_proxy_state = false,
2674 };
2675
2676 /*
2677 * Encode the entire packet.
2678 */
2679 packet_len = fr_radius_encode(&FR_DBUFF_TMP(buffer, sizeof(buffer)),
2680 &request->request_pairs, &encode_ctx);
2681 if (fr_pair_encode_is_error(packet_len)) {
2682 RPERROR("Failed encoding packet");
2683 return XLAT_ACTION_FAIL;
2684 }
2685
2686 /*
2687 * Sign it.
2688 */
2689 if (fr_radius_sign(buffer, NULL, (uint8_t const *) radius_ctx.secret, radius_ctx.secret_length) < 0) {
2690 RPERROR("Failed signing packet");
2691 return XLAT_ACTION_FAIL;
2692 }
2693
2694 /*
2695 * Prepare destination address.
2696 */
2697 addr = (fr_bio_fd_packet_ctx_t) {
2698 .socket = thread->ctx.fd_info->socket,
2699 };
2700 addr.socket.inet.dst_ipaddr = ipaddr->vb_ip;
2701 addr.socket.inet.dst_port = port->vb_uint16;
2702
2703 RDEBUG("Replicating packet to %pV:%u", ipaddr, port->vb_uint16);
2704
2705 /*
2706 * We either send it, or fail.
2707 */
2708 packet_len = fr_bio_write(thread->bio.fd, &addr, buffer, packet_len);
2709 if (packet_len < 0) {
2710 RPERROR("Failed sending packet to %pV:%u", ipaddr, port->vb_uint16);
2711 return XLAT_ACTION_FAIL;
2712 }
2713
2714 /*
2715 * No return value.
2716 */
2717 return XLAT_ACTION_DONE;
2718}
2719
2720// **********************************************************************
2721
2722/** Dynamic home server code
2723 *
2724 */
2725
2726static int8_t home_server_cmp(void const *one, void const *two)
2727{
2728 home_server_t const *a = one;
2729 home_server_t const *b = two;
2730 int8_t rcode;
2731
2733 if (rcode != 0) return rcode;
2734
2736}
2737
2739 xlat_ctx_t const *xctx,
2740 request_t *request, UNUSED fr_value_box_list_t *in)
2741{
2742 bio_request_t *u = talloc_get_type_abort(xctx->rctx, bio_request_t);
2743 fr_value_box_t *dst;
2744
2745 if (u->rcode == RLM_MODULE_FAIL) return XLAT_ACTION_FAIL;
2746
2748 dst->vb_uint32 = request->reply->code;
2749
2750 fr_dcursor_append(out, dst);
2751
2752 return XLAT_ACTION_DONE;
2753}
2754
2755static void xlat_sendto_signal(xlat_ctx_t const *xctx, request_t *request, fr_signal_t action)
2756{
2757 rlm_radius_t const *inst = talloc_get_type_abort(xctx->mctx->mi->data, rlm_radius_t);
2758 bio_request_t *u = talloc_get_type_abort(xctx->rctx, bio_request_t);
2759
2760 do_signal(inst, u, request, action);
2761}
2762
2763/*
2764 * @todo - change this to mod_retry
2765 */
2766static void xlat_sendto_retry(xlat_ctx_t const *xctx, request_t *request, fr_retry_t const *retry)
2767{
2768 rlm_radius_t const *inst = talloc_get_type_abort(xctx->mctx->mi->data, rlm_radius_t);
2769 bio_request_t *u = talloc_get_type_abort(xctx->rctx, bio_request_t);
2770
2771 do_retry(inst, u, request, retry);
2772}
2773
2774/*
2775 * %proxy.sendto.ipaddr(ipaddr, port, secret)
2776 */
2778 xlat_ctx_t const *xctx,
2779 request_t *request, fr_value_box_list_t *args)
2780{
2781 rlm_radius_t const *inst = talloc_get_type_abort(xctx->mctx->mi->data, rlm_radius_t);
2782 bio_thread_t *thread = talloc_get_type_abort(xctx->mctx->thread, bio_thread_t);
2783 fr_value_box_t *ipaddr, *port, *secret;
2784 home_server_t *home;
2785 bio_request_t *u = NULL;
2786 fr_retry_config_t const *retry_config = NULL;
2787 int rcode;
2788
2789 XLAT_ARGS(args, &ipaddr, &port, &secret);
2790
2791 /*
2792 * Can't change IP address families.
2793 */
2794 if (ipaddr->vb_ip.af != thread->ctx.fd_config.src_ipaddr.af) {
2795 RDEBUG("Invalid destination IP address family in %pV", ipaddr);
2796 return XLAT_ACTION_DONE;
2797 }
2798
2799 home = fr_rb_find(&thread->bio.expires.tree, &(home_server_t) {
2800 .ctx = {
2801 .fd_config = (fr_bio_fd_config_t) {
2802 .dst_ipaddr = ipaddr->vb_ip,
2803 .dst_port = port->vb_uint16,
2804 },
2805 },
2806 });
2807 if (!home) {
2808 MEM(home = talloc(thread, home_server_t));
2809
2810 *home = (home_server_t) {
2811 .ctx = (bio_handle_ctx_t) {
2812 .el = unlang_interpret_event_list(request),
2813 .module_name = inst->name,
2814 .inst = inst,
2815 },
2816 };
2817
2818 /*
2819 * Copy the home server configuration from the root configuration. Then update it with
2820 * the needs of the home server.
2821 */
2822 home->ctx.fd_config = inst->fd_config;
2823 home->ctx.fd_config.type = FR_BIO_FD_CONNECTED;
2824 home->ctx.fd_config.dst_ipaddr = ipaddr->vb_ip;
2825 home->ctx.fd_config.dst_port = port->vb_uint32;
2826
2827 home->ctx.radius_ctx = (fr_radius_ctx_t) {
2828 .secret = talloc_strdup(home, secret->vb_strvalue),
2829 .secret_length = secret->vb_length,
2830 .proxy_state = inst->common_ctx.proxy_state,
2831 };
2832
2833 /*
2834 * Allocate the trunk and start it up.
2835 */
2836 home->ctx.trunk = trunk_alloc(home, unlang_interpret_event_list(request), &io_funcs,
2837 &inst->trunk_conf, inst->name, home, false);
2838 if (!home->ctx.trunk) {
2839 fail:
2840 talloc_free(home);
2841 return XLAT_ACTION_FAIL;
2842 }
2843
2844 if (!fr_rb_expire_insert(&thread->bio.expires, home, fr_time())) goto fail;
2845 } else {
2846 fr_rb_expire_t *expire = &thread->bio.expires;
2847 fr_time_t now = fr_time();
2848 home_server_t *old;
2849
2850 /*
2851 * We can't change secrets on the fly. The home
2852 * server has to expire first, and then the
2853 * secret can be changed.
2854 */
2855 if ((home->ctx.radius_ctx.secret_length != secret->vb_length) ||
2856 (strcmp(home->ctx.radius_ctx.secret, secret->vb_strvalue) != 0)) {
2857 RWDEBUG("The new secret is not the same as the old secret: Ignoring the new one");
2858 }
2859
2860 fr_rb_expire_update(expire, home, now);
2861
2862 while ((old = fr_dlist_head(&expire->head)) != NULL) {
2863 (void) talloc_get_type_abort(old, home_server_t);
2864
2865 fr_assert(old->ctx.trunk);
2866
2867 /*
2868 * Don't delete the home server we're about to use.
2869 */
2870 if (old == home) break;
2871
2872 /*
2873 * It still has a request allocated, do nothing.
2874 */
2875 if (old->ctx.trunk->req_alloc) break;
2876
2877 /*
2878 * Not yet time to expire.
2879 */
2880 if (fr_time_gt(old->expire.when, now)) break;
2881
2882 fr_dlist_remove(&expire->head, old);
2883 fr_rb_delete(&expire->tree, old);
2884 }
2885 }
2886
2887 /*
2888 * Enqueue the packet on the per-home-server trunk.
2889 */
2890 rcode = mod_enqueue(&u, &retry_config, inst, home->ctx.trunk, request);
2891 if (rcode == 0) return XLAT_ACTION_DONE;
2892
2893 if (rcode < 0) {
2894 REDEBUG("Failed enqueuing packet");
2895 return XLAT_ACTION_FAIL;
2896 }
2897 fr_assert(u != NULL);
2898 fr_assert(retry_config != NULL);
2899
2900 /*
2901 * Start the retry.
2902 *
2903 * @todo - change unlang_xlat_timeout_add() to unlang_xlat_retry_add().
2904 */
2905 fr_retry_init(&u->retry, fr_time(), retry_config);
2906
2909 u, retry_config);
2910}
unlang_action_t
Returned by unlang_op_t calls, determine the next action of the interpreter.
Definition action.h:35
static int const char char buffer[256]
Definition acutest.h:576
int const char * file
Definition acutest.h:702
va_list args
Definition acutest.h:770
int const char int line
Definition acutest.h:702
static ssize_t fr_bio_write(fr_bio_t *bio, void *packet_ctx, void const *buffer, size_t size)
Write raw data to a bio.
Definition base.h:173
static ssize_t fr_bio_read(fr_bio_t *bio, void *packet_ctx, void *buffer, size_t size)
Read raw data from a bio.
Definition base.h:150
void * uctx
user ctx, caller can manually set it.
Definition base.h:114
#define fr_bio_error(_x)
Definition base.h:193
#define NDEBUG_UNUSED
Definition build.h:328
#define FALL_THROUGH
clang 10 doesn't recognised the FALL-THROUGH comment anymore
Definition build.h:324
#define CMP_PREFER_SMALLER(_a, _b)
Evaluates to +1 for a > b, and -1 for a < b.
Definition build.h:104
#define CC_NO_UBSAN(_sanitize)
Definition build.h:428
#define CMP(_a, _b)
Same as CMP_PREFER_SMALLER use when you don't really care about ordering, you just want an ordering.
Definition build.h:112
#define unlikely(_x)
Definition build.h:383
#define UNUSED
Definition build.h:317
connection_state_t
Definition connection.h:45
@ CONNECTION_STATE_FAILED
Connection has failed.
Definition connection.h:54
@ CONNECTION_STATE_CONNECTED
File descriptor is open (ready for writing).
Definition connection.h:52
@ CONNECTION_STATE_INIT
Init state, sets up connection.
Definition connection.h:49
@ CONNECTION_STATE_CONNECTING
Waiting for connection to establish.
Definition connection.h:50
@ CONNECTION_FAILED
Connection is being reconnected because it failed.
Definition connection.h:84
Holds a complete set of functions for a connection.
Definition connection.h:186
#define FR_DBUFF_TMP(_start, _len_or_end)
Creates a compound literal to pass into functions which accept a dbuff.
Definition dbuff.h:514
static int fr_dcursor_append(fr_dcursor_t *cursor, void *v)
Insert a single item at the end of the list.
Definition dcursor.h:408
#define fr_assert_msg(_x, _msg,...)
Calls panic_action ifndef NDEBUG, else logs error and causes the server to exit immediately with code...
Definition debug.h:210
#define fr_assert_fail(_msg,...)
Calls panic_action ifndef NDEBUG, else logs error.
Definition debug.h:216
#define MEM(x)
Definition debug.h:36
@ FR_RADIUS_CODE_ACCESS_CHALLENGE
RFC2865 - Access-Challenge.
Definition defs.h:43
@ FR_RADIUS_CODE_ACCESS_REQUEST
RFC2865 - Access-Request.
Definition defs.h:33
@ FR_RADIUS_CODE_MAX
Maximum possible protocol code.
Definition defs.h:53
@ FR_RADIUS_CODE_DISCONNECT_ACK
RFC3575/RFC5176 - Disconnect-Ack (positive)
Definition defs.h:47
@ FR_RADIUS_CODE_ACCESS_ACCEPT
RFC2865 - Access-Accept.
Definition defs.h:34
@ FR_RADIUS_CODE_ACCOUNTING_RESPONSE
RFC2866 - Accounting-Response.
Definition defs.h:37
@ FR_RADIUS_CODE_COA_NAK
RFC3575/RFC5176 - CoA-Nak (not willing to perform)
Definition defs.h:51
@ FR_RADIUS_CODE_COA_ACK
RFC3575/RFC5176 - CoA-Ack (positive)
Definition defs.h:50
@ FR_RADIUS_CODE_DISCONNECT_NAK
RFC3575/RFC5176 - Disconnect-Nak (not willing to perform)
Definition defs.h:48
@ FR_RADIUS_CODE_PROTOCOL_ERROR
RFC7930 - Protocol-Error (generic NAK)
Definition defs.h:52
@ FR_RADIUS_CODE_ACCOUNTING_REQUEST
RFC2866 - Accounting-Request.
Definition defs.h:36
@ FR_RADIUS_CODE_ACCESS_REJECT
RFC2865 - Access-Reject.
Definition defs.h:35
static fr_dict_attr_t const * attr_packet_type
Definition dhcpclient.c:89
#define ERROR(fmt,...)
Definition dhcpclient.c:41
#define DEBUG(fmt,...)
Definition dhcpclient.c:39
bool fr_dict_compatible(fr_dict_t const *dict1, fr_dict_t const *dict2)
See if two dictionaries have the same end parent.
Definition dict_util.c:2622
static fr_slen_t in
Definition dict.h:841
static void * fr_dlist_head(fr_dlist_head_t const *list_head)
Return the HEAD item of a list or NULL if the list is empty.
Definition dlist.h:486
static void * fr_dlist_remove(fr_dlist_head_t *list_head, void *ptr)
Remove an item from the list.
Definition dlist.h:638
#define fr_event_fd_insert(...)
Definition event.h:248
void(* fr_event_fd_cb_t)(fr_event_list_t *el, int fd, int flags, void *uctx)
Called when an IO event occurs on a file descriptor.
Definition event.h:151
int fr_bio_fd_connect_full(fr_bio_t *bio, fr_event_list_t *el, fr_bio_callback_t connected_cb, fr_bio_callback_t error_cb, fr_time_delta_t *timeout, fr_bio_callback_t timeout_cb)
Finalize a connect()
Definition fd.c:1177
fr_bio_t * fr_bio_fd_alloc(TALLOC_CTX *ctx, fr_bio_fd_config_t const *cfg, size_t offset)
Allocate a FD bio.
Definition fd.c:957
fr_bio_fd_info_t const * fr_bio_fd_info(fr_bio_t *bio)
Returns a pointer to the bio-specific information.
Definition fd.c:1274
int fr_bio_fd_write_only(fr_bio_t *bio)
Mark up a bio as write-only.
Definition fd.c:1327
fr_socket_t socket
as connected socket
Definition fd.h:130
char const * name
printable name of this BIO
Definition fd.h:135
uint16_t src_port
our port
Definition fd.h:92
bool eof
are we at EOF?
Definition fd.h:139
@ FR_BIO_FD_CONNECTED
connected client sockets (UDP or TCP)
Definition fd.h:68
fr_bio_fd_state_t state
connecting, open, closed, etc.
Definition fd.h:133
uint16_t src_port_start
limit source port ranges for client BIOs
Definition fd.h:95
@ FR_BIO_FD_STATE_CONNECTING
Definition fd.h:60
@ FR_BIO_FD_STATE_OPEN
error states must be before this
Definition fd.h:59
int connect_errno
from connect() or other APIs
Definition fd.h:141
fr_ipaddr_t dst_ipaddr
their IP address
Definition fd.h:90
int socket_type
SOCK_STREAM or SOCK_DGRAM.
Definition fd.h:84
uint16_t dst_port
their port
Definition fd.h:93
fr_socket_t socket
socket information, including FD.
Definition fd.h:52
bool write_blocked
did we block on write?
Definition fd.h:138
fr_ipaddr_t src_ipaddr
our IP address
Definition fd.h:89
Configuration for sockets.
Definition fd.h:81
Run-time status of the socket.
Definition fd.h:129
Per-packet context.
Definition fd.h:51
int8_t fr_ipaddr_cmp(fr_ipaddr_t const *a, fr_ipaddr_t const *b)
Compare two ip addresses.
Definition inet.c:1347
int af
Address family.
Definition inet.h:64
void unlang_interpret_mark_runnable(request_t *request)
Mark a request as resumable.
Definition interpret.c:1616
fr_event_list_t * unlang_interpret_event_list(request_t *request)
Get the event list for the current interpreter.
Definition interpret.c:2013
Minimal data structure to use the new code.
Definition listen.h:59
static bool fr_pair_encode_is_error(ssize_t slen)
Determine if the return code for an encoding function is a fatal error.
Definition pair.h:74
fr_bio_t * fr_bio_mem_alloc(TALLOC_CTX *ctx, size_t read_size, size_t write_size, fr_bio_t *next)
Allocate a memory buffer bio.
Definition mem.c:732
int fr_bio_mem_set_verify(fr_bio_t *bio, fr_bio_verify_t verify, void *verify_ctx, bool datagram)
Set the verification function for memory bios.
Definition mem.c:912
HIDDEN fr_dict_attr_t const * attr_eap_message
Definition base.c:96
void log_request_pair_list(fr_log_lvl_t lvl, request_t *request, fr_pair_t const *parent, fr_pair_list_t const *vps, char const *prefix)
Print a fr_pair_list_t.
Definition log.c:828
#define PERROR(_fmt,...)
Definition log.h:228
#define DEBUG3(_fmt,...)
Definition log.h:266
#define RWDEBUG(fmt,...)
Definition log.h:361
#define RWARN(fmt,...)
Definition log.h:297
#define RERROR(fmt,...)
Definition log.h:298
#define DEBUG4(_fmt,...)
Definition log.h:267
#define RPERROR(fmt,...)
Definition log.h:302
#define RINFO(fmt,...)
Definition log.h:296
#define RPEDEBUG(fmt,...)
Definition log.h:376
#define HEXDUMP3(_data, _len, _fmt,...)
Definition log.h:723
#define RHEXDUMP3(_data, _len, _fmt,...)
Definition log.h:705
int map_to_vp(TALLOC_CTX *ctx, fr_pair_list_t *out, request_t *request, map_t const *map, UNUSED void *uctx)
Convert a map to a fr_pair_t.
Definition map.c:1590
int map_to_request(request_t *request, map_t const *map, radius_map_getvalue_t func, void *ctx)
Convert map_t to fr_pair_t (s) and add them to a request_t.
Definition map.c:1869
talloc_free(reap)
Stores all information relating to an event list.
Definition event.c:377
fr_log_t default_log
Definition log.c:292
void fr_log(fr_log_t const *log, fr_log_type_t type, char const *file, int line, char const *fmt,...)
Send a server log message to its destination.
Definition log.c:581
@ L_DBG_LVL_3
3rd highest priority debug messages (-xxx | -Xx).
Definition log.h:72
@ L_DBG_LVL_2
2nd highest priority debug messages (-xx | -X).
Definition log.h:71
fr_log_type_t
Definition log.h:54
@ L_ERR
Error message.
Definition log.h:56
fr_packet_t * fr_packet_alloc(TALLOC_CTX *ctx, bool new_vector)
Allocate a new fr_packet_t.
Definition packet.c:38
fr_bio_verify_action_t
Status returned by the verification callback.
Definition mem.h:32
@ FR_BIO_VERIFY_ERROR_CLOSE
fatal error, the bio should be closed.
Definition mem.h:36
@ FR_BIO_VERIFY_DISCARD
the packet should be discarded
Definition mem.h:34
@ FR_BIO_VERIFY_OK
packet is OK
Definition mem.h:33
@ FR_BIO_VERIFY_WANT_MORE
not enough data for one packet
Definition mem.h:35
bool fr_radius_ok(uint8_t const *packet, size_t *packet_len_p, uint32_t max_attributes, bool require_message_authenticator, decode_fail_t *reason)
@ FR_TYPE_STRING
String of printable characters.
@ FR_TYPE_UINT16
16 Bit unsigned integer.
@ FR_TYPE_UINT32
32 Bit unsigned integer.
@ FR_TYPE_COMBO_IP_ADDR
IPv4 or IPv6 address depending on length.
unsigned int uint32_t
long int ssize_t
unsigned char uint8_t
module_instance_t const * mi
Instance of the module being instantiated.
Definition module_ctx.h:42
void * thread
Thread specific instance data.
Definition module_ctx.h:43
void * rctx
Resume ctx that a module previously set.
Definition module_ctx.h:45
fr_event_list_t * el
Event list to register any IO handlers and timers against.
Definition module_ctx.h:68
void * thread
Thread instance data.
Definition module_ctx.h:67
module_instance_t const * mi
Instance of the module being instantiated.
Definition module_ctx.h:64
Temporary structure to hold arguments for module calls.
Definition module_ctx.h:41
Temporary structure to hold arguments for thread_instantiation calls.
Definition module_ctx.h:63
struct bio_thread_t::@184 bio
static int mod_enqueue(bio_request_t **p_u, fr_retry_config_t const **p_retry_config, rlm_radius_t const *inst, trunk_t *trunk, request_t *request)
Definition bio.c:2384
fr_bio_fd_config_t fd_config
for threads or sockets
Definition bio.c:45
static int8_t request_prioritise(void const *one, void const *two)
Definition bio.c:1031
static void do_retry(rlm_radius_t const *inst, bio_request_t *u, request_t *request, fr_retry_t const *retry)
Definition bio.c:1425
fr_timer_t * ev
timer for retransmissions
Definition bio.c:128
static bool check_for_zombie(fr_event_list_t *el, trunk_connection_t *tconn, fr_time_t now, fr_time_t last_sent)
See if the connection is zombied.
Definition bio.c:1322
static void request_replicate_mux(UNUSED fr_event_list_t *el, trunk_connection_t *tconn, connection_t *conn, UNUSED void *uctx)
Definition bio.c:2062
static void conn_init_error(UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, int fd_errno, void *uctx)
Connection errored.
Definition bio.c:325
static void request_demux(UNUSED fr_event_list_t *el, trunk_connection_t *tconn, connection_t *conn, UNUSED void *uctx)
Definition bio.c:1908
static void conn_discard(UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, void *uctx)
Read and discard data.
Definition bio.c:915
uint8_t id
Last ID assigned to this packet.
Definition bio.c:122
static void request_replicate_demux(UNUSED fr_event_list_t *el, trunk_connection_t *tconn, connection_t *conn, UNUSED void *uctx)
Definition bio.c:2079
uint32_t max_packet_size
Our max packet size. may be different from the parent.
Definition bio.c:82
static void do_signal(rlm_radius_t const *inst, bio_request_t *u, request_t *request, fr_signal_t action)
static void bio_connected(fr_bio_t *bio)
Definition bio.c:617
uint32_t num_replies
number of reply packets, sent is in retry.count
Definition bio.c:114
static const trunk_io_funcs_t io_funcs
Definition bio.c:2524
uint32_t priority
copied from request->async->priority
Definition bio.c:111
static rlm_rcode_t radius_code_to_rcode[FR_RADIUS_CODE_MAX]
Turn a reply code into a module rcode;.
Definition bio.c:141
static void conn_error(UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, int fd_errno, void *uctx)
Connection errored.
Definition bio.c:950
char const * module_name
the module that opened the connection
Definition bio.c:41
fr_bio_fd_info_t const * fd_info
status of the FD.
Definition bio.c:46
struct bio_handle_t::@185 bio
static void mod_signal(module_ctx_t const *mctx, UNUSED request_t *request, fr_signal_t action)
Definition bio.c:2305
uint8_t last_id
Used when replicating to ensure IDs are distributed evenly.
Definition bio.c:79
static void mod_retry(module_ctx_t const *mctx, request_t *request, fr_retry_t const *retry)
Handle module retries.
Definition bio.c:1417
static fr_radius_decode_fail_t decode(TALLOC_CTX *ctx, fr_pair_list_t *reply, uint8_t *response_code, bio_handle_t *h, request_t *request, bio_request_t *u, uint8_t const request_authenticator[static RADIUS_AUTH_VECTOR_LENGTH], uint8_t *data, size_t data_len)
Decode response packet data, extracting relevant information and validating the packet.
Definition bio.c:1070
static void conn_close(UNUSED fr_event_list_t *el, void *handle, UNUSED void *uctx)
Shutdown/close a file descriptor.
Definition bio.c:832
static void thread_conn_notify(trunk_connection_t *tconn, connection_t *conn, fr_event_list_t *el, trunk_connection_event_t notify_on, UNUSED void *uctx)
Definition bio.c:962
static int encode(bio_handle_t *h, request_t *request, bio_request_t *u, uint8_t id)
Definition bio.c:1137
fr_time_t last_reply
When we last received a reply.
Definition bio.c:90
static void request_conn_release(connection_t *conn, void *preq_to_reset, UNUSED void *uctx)
Clear out anything associated with the handle from the request.
Definition bio.c:2231
int fd
File descriptor.
Definition bio.c:68
bio_request_t * status_u
for sending status check packets
Definition bio.c:98
bio_handle_ctx_t ctx
common struct for home servers and BIO handles
Definition bio.c:51
static fr_bio_verify_action_t rlm_radius_verify(UNUSED fr_bio_t *bio, void *verify_ctx, UNUSED void *packet_ctx, const void *data, size_t *size)
Definition bio.c:636
static void mod_write(request_t *request, trunk_request_t *treq, bio_handle_t *h)
Definition bio.c:1517
#define REQUIRE_MA(_h)
fr_pair_list_t extra
VPs for debugging, like Proxy-State.
Definition bio.c:119
bool proxied
is this request being proxied
Definition bio.c:117
size_t buflen
Receive buffer length.
Definition bio.c:85
static void conn_init_readable(fr_event_list_t *el, UNUSED int fd, UNUSED int flags, void *uctx)
Read the connection during the init and negotiation stage.
Definition bio.c:408
fr_time_t last_idle
last time we had nothing to do
Definition bio.c:93
static void bio_tracking_entry_log(fr_log_t const *log, fr_log_type_t log_type, char const *file, int line, radius_track_entry_t *te)
Log additional information about a tracking entry.
Definition bio.c:184
static xlat_action_t xlat_radius_replicate(UNUSED TALLOC_CTX *ctx, UNUSED fr_dcursor_t *out, xlat_ctx_t const *xctx, request_t *request, fr_value_box_list_t *args)
Definition bio.c:2627
radius_track_entry_t * rr
ID tracking, resend count, etc.
Definition bio.c:127
size_t packet_len
Length of the packet.
Definition bio.c:124
static int _bio_handle_free(bio_handle_t *h)
Free a connection handle, closing associated resources.
Definition bio.c:600
size_t partial
partially sent data
Definition bio.c:125
fr_event_list_t * el
Event list.
Definition bio.c:43
static void request_cancel(UNUSED connection_t *conn, void *preq_to_reset, trunk_cancel_reason_t reason, UNUSED void *uctx)
Remove the request from any tracking structures.
Definition bio.c:2199
static void home_server_free(void *data)
Definition bio.c:2517
static void protocol_error_reply(bio_request_t *u, bio_handle_t *h)
Deal with Protocol-Error replies, and possible negotiation.
Definition bio.c:1730
static void status_check_reset(bio_handle_t *h, bio_request_t *u)
Reset a status_check packet, ready to reuse.
Definition bio.c:220
static const trunk_io_funcs_t io_replicate_funcs
Definition bio.c:2536
static void request_fail(request_t *request, NDEBUG_UNUSED void *preq, void *rctx, NDEBUG_UNUSED trunk_request_state_t state, UNUSED void *uctx)
Write out a canned failure.
Definition bio.c:2253
fr_time_t recv_time
copied from request->async->recv_time
Definition bio.c:112
fr_retry_t retry
retransmission timers
Definition bio.c:129
static void conn_init_writable(UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, void *uctx)
static xlat_action_t xlat_radius_client(UNUSED TALLOC_CTX *ctx, UNUSED fr_dcursor_t *out, xlat_ctx_t const *xctx, request_t *request, fr_value_box_list_t *args)
Definition bio.c:2777
rlm_rcode_t rcode
from the transport
Definition bio.c:108
static void status_check_alloc(bio_handle_t *h)
Definition bio.c:237
fr_time_t mrs_time
Most recent sent time which had a reply.
Definition bio.c:89
bool status_checking
whether we're doing status checks
Definition bio.c:97
trunk_t * trunk
trunk handler
Definition bio.c:44
fr_time_t last_sent
last time we sent a packet.
Definition bio.c:92
static void zombie_timeout(fr_timer_list_t *tl, fr_time_t now, void *uctx)
Mark a connection dead after "zombie_interval".
Definition bio.c:1264
bio_handle_ctx_t ctx
for copying to bio_handle_t
Definition bio.c:133
static int mod_thread_instantiate(module_thread_inst_ctx_t const *mctx)
Instantiate thread data for the submodule.
Definition bio.c:2551
static void bio_error(fr_bio_t *bio)
Definition bio.c:626
static void status_check_reply(trunk_request_t *treq, fr_time_t now)
Deal with replies replies to status checks and possible negotiation.
Definition bio.c:1860
static void conn_init_next(UNUSED fr_timer_list_t *tl, UNUSED fr_time_t now, void *uctx)
Perform the next step of init and negotiation.
Definition bio.c:394
bool is_retry
Definition bio.c:109
static int _bio_request_free(bio_request_t *u)
Free a bio_request_t.
Definition bio.c:2363
connection_t * conn
Definition bio.c:77
fr_time_t first_sent
first time we sent a packet since going idle
Definition bio.c:91
static unlang_action_t mod_resume(unlang_result_t *p_result, module_ctx_t const *mctx, UNUSED request_t *request)
Resume execution of the request, returning the rcode set during trunk execution.
Definition bio.c:2293
fr_timer_t * zombie_ev
Zombie timeout.
Definition bio.c:95
static connection_t * thread_conn_alloc(trunk_connection_t *tconn, fr_event_list_t *el, connection_conf_t const *conf, char const *log_prefix, void *uctx)
Definition bio.c:886
static void xlat_sendto_retry(xlat_ctx_t const *xctx, request_t *request, fr_retry_t const *retry)
Definition bio.c:2766
static void bio_request_reset(bio_request_t *u)
Clear out any connection specific resources from a udp request.
Definition bio.c:203
trunk_request_t * treq
Definition bio.c:107
static xlat_action_t xlat_sendto_resume(TALLOC_CTX *ctx, fr_dcursor_t *out, xlat_ctx_t const *xctx, request_t *request, UNUSED fr_value_box_list_t *in)
Definition bio.c:2738
static void status_check_next(UNUSED fr_timer_list_t *tl, UNUSED fr_time_t now, void *uctx)
Handle retries for a status check.
Definition bio.c:1845
rlm_radius_t const * inst
our instance
Definition bio.c:42
static connection_state_t conn_init(void **h_out, connection_t *conn, void *uctx)
Initialise a new outbound connection.
Definition bio.c:711
fr_rb_expire_node_t expire
Definition bio.c:135
static void revive_timeout(UNUSED fr_timer_list_t *tl, UNUSED fr_time_t now, void *uctx)
Revive a connection after "revive_interval".
Definition bio.c:1252
uint8_t * packet
Packet we write to the network.
Definition bio.c:123
static void conn_init_timeout(UNUSED fr_timer_list_t *tl, fr_time_t now, void *uctx)
Status check timer when opening the connection for the first time.
Definition bio.c:346
static connection_state_t conn_failed(void *handle, connection_state_t state, UNUSED void *uctx)
Connection failed.
Definition bio.c:859
fr_radius_ctx_t radius_ctx
Definition bio.c:47
radius_track_t * tt
RADIUS ID tracking structure.
Definition bio.c:87
static void mod_dup(request_t *request, bio_request_t *u)
Definition bio.c:1381
bio_handle_ctx_t ctx
common struct for home servers and BIO handles
Definition bio.c:66
static int8_t home_server_cmp(void const *one, void const *two)
Dynamic home server code.
Definition bio.c:2726
uint8_t code
Packet code.
Definition bio.c:121
static void request_mux(UNUSED fr_event_list_t *el, trunk_connection_t *tconn, connection_t *conn, UNUSED void *uctx)
Definition bio.c:1498
uint8_t * buffer
Receive buffer.
Definition bio.c:84
request_t * status_request
Definition bio.c:99
static void request_complete(request_t *request, NDEBUG_UNUSED void *preq, void *rctx, UNUSED void *uctx)
Response has already been written to the rctx at this point.
Definition bio.c:2275
bool status_check
is this packet a status check?
Definition bio.c:116
static xlat_arg_parser_t const xlat_radius_send_args[]
Definition bio.c:2617
static void xlat_sendto_signal(xlat_ctx_t const *xctx, request_t *request, fr_signal_t action)
Definition bio.c:2755
Track the handle, which is tightly correlated with the FD.
Definition bio.c:65
Connect request_t to local tracking structure.
Definition bio.c:106
static uint16_t fr_nbo_to_uint16(uint8_t const data[static sizeof(uint16_t)])
Read an unsigned 16bit integer from wire format (big endian)
Definition nbo.h:146
#define RADIUS_HEADER_LENGTH
Definition net.h:80
#define RADIUS_AUTH_VECTOR_LENGTH
Definition net.h:89
int fr_pair_value_memdup(fr_pair_t *vp, uint8_t const *src, size_t len, bool tainted)
Copy data into an "octets" data type.
Definition pair.c:2936
int fr_pair_value_strdup(fr_pair_t *vp, char const *src, bool tainted)
Copy data into an "string" data type.
Definition pair.c:2636
fr_pair_t * fr_pair_find_by_da(fr_pair_list_t const *list, fr_pair_t const *prev, fr_dict_attr_t const *da)
Find the first pair with a matching da.
Definition pair.c:697
int fr_pair_append(fr_pair_list_t *list, fr_pair_t *to_add)
Add a VP to the end of the list.
Definition pair.c:1342
int fr_pair_delete_by_da(fr_pair_list_t *list, fr_dict_attr_t const *da)
Delete matching pairs from the specified list.
Definition pair.c:1686
fr_pair_t * fr_pair_afrom_da(TALLOC_CTX *ctx, fr_dict_attr_t const *da)
Dynamically allocate a new attribute and assign a fr_dict_attr_t.
Definition pair.c:287
void fr_pair_list_init(fr_pair_list_t *list)
Initialise a pair list header.
Definition pair.c:46
static fr_internal_encode_ctx_t encode_ctx
ssize_t fr_radius_decode(TALLOC_CTX *ctx, fr_pair_list_t *out, uint8_t *packet, size_t packet_len, fr_radius_decode_ctx_t *decode_ctx)
Definition base.c:1108
int fr_radius_sign(uint8_t *packet, uint8_t const *vector, uint8_t const *secret, size_t secret_len)
Sign a previously encoded packet.
Definition base.c:359
ssize_t fr_radius_encode(fr_dbuff_t *dbuff, fr_pair_list_t *vps, fr_radius_encode_ctx_t *packet_ctx)
Definition base.c:973
char const * fr_radius_packet_name[FR_RADIUS_CODE_MAX]
Definition base.c:113
#define fr_assert(_expr)
Definition rad_assert.h:38
static fr_dict_t const * dict_radius
static char * secret
static fr_dict_attr_t const * attr_proxy_state
Definition radclient.c:128
#define REDEBUG(fmt,...)
Definition radclient.h:52
#define RDEBUG(fmt,...)
Definition radclient.h:53
#define WARN(fmt,...)
Definition radclient.h:47
#define INFO(fmt,...)
Definition radict.c:54
@ FR_RADIUS_REQUIRE_MA_YES
Require Message-Authenticator.
Definition radius.h:64
@ FR_RADIUS_REQUIRE_MA_AUTO
Only require Message-Authenticator if we've previously received a packet from this client with Messag...
Definition radius.h:65
#define RADIUS_AUTH_VECTOR_OFFSET
Definition radius.h:33
fr_radius_decode_fail_t
Failure reasons.
Definition radius.h:162
@ DECODE_FAIL_UNKNOWN
Definition radius.h:179
@ DECODE_FAIL_NONE
Definition radius.h:163
@ DECODE_FAIL_MA_MISSING
Definition radius.h:176
@ DECODE_FAIL_UNKNOWN_PACKET_CODE
Definition radius.h:169
char const * secret
Definition radius.h:95
#define RADIUS_MAX_PACKET_SIZE
Definition radius.h:41
size_t secret_length
Definition radius.h:96
fr_radius_ctx_t const * common
Definition radius.h:125
TALLOC_CTX * tmp_ctx
for temporary things cleaned up during decoding
Definition radius.h:129
static rs_t * conf
Definition radsniff.c:53
static fr_dict_attr_t const * attr_extended_attribute_1
Definition radsnmp.c:108
static fr_dict_attr_t const * attr_message_authenticator
Definition radsnmp.c:112
uint32_t fr_rand(void)
Return a 32-bit random number.
Definition rand.c:105
Smaller fast random number generator.
Definition rand.h:54
void * fr_rb_find(fr_rb_tree_t const *tree, void const *data)
Find an element in the tree, returning the data, not the node.
Definition rb.c:577
bool fr_rb_delete(fr_rb_tree_t *tree, void const *data)
Remove node and free data (if a free function was specified)
Definition rb.c:741
bool fr_rb_expire_insert(fr_rb_expire_t *expire, void *data, fr_time_t now)
Attempt to find current data in the tree, if it does not exist insert it.
Definition rb_expire.c:39
void fr_rb_expire_update(fr_rb_expire_t *expire, void *data, fr_time_t now)
Definition rb_expire.c:55
#define fr_rb_expire_inline_talloc_init(_expire, _type, _field, _data_cmp, _data_free, _lifetime)
Definition rb_expire.h:50
fr_dlist_head_t head
Definition rb_expire.h:35
fr_rb_tree_t tree
Definition rb_expire.h:34
dlist for expiring old entries
Definition rb_expire.h:44
#define RETURN_UNLANG_RCODE(_rcode)
Definition rcode.h:66
rlm_rcode_t
Return codes indicating the result of the module call.
Definition rcode.h:40
@ RLM_MODULE_OK
The module is OK, continue.
Definition rcode.h:43
@ RLM_MODULE_FAIL
Module failed, don't reply.
Definition rcode.h:42
@ RLM_MODULE_REJECT
Immediately reject the request.
Definition rcode.h:41
@ RLM_MODULE_UPDATED
OK (pairs modified).
Definition rcode.h:49
@ RLM_MODULE_HANDLED
The module handled the request, so stop.
Definition rcode.h:44
#define request_local_alloc_external(_ctx, _args)
Allocate a new external request outside of the request pool.
Definition request.h:331
Optional arguments for initialising requests.
Definition request.h:283
static fr_dict_attr_t const * attr_error_cause
Definition rlm_radius.c:192
static int radius_fixups(rlm_radius_t const *inst, request_t *request)
Do any RADIUS-layer fixups for proxying.
Definition rlm_radius.c:523
static fr_dict_attr_t const * attr_nas_identifier
Definition rlm_radius.c:197
static fr_dict_attr_t const * attr_original_packet_code
Definition rlm_radius.c:198
static fr_dict_attr_t const * attr_event_timestamp
Definition rlm_radius.c:193
static fr_dict_attr_t const * attr_response_length
Definition rlm_radius.c:199
fr_radius_require_ma_t require_message_authenticator
Require Message-Authenticator in responses.
Definition rlm_radius.h:80
fr_time_delta_t revive_interval
Definition rlm_radius.h:60
fr_retry_config_t retry[FR_RADIUS_CODE_MAX]
Definition rlm_radius.h:92
char const * name
Definition rlm_radius.h:56
uint32_t status_check
code of status-check type
Definition rlm_radius.h:84
rlm_radius_mode_t mode
proxy, client, etc.
Definition rlm_radius.h:76
@ RLM_RADIUS_MODE_XLAT_PROXY
Definition rlm_radius.h:47
@ RLM_RADIUS_MODE_INVALID
Definition rlm_radius.h:42
@ RLM_RADIUS_MODE_PROXY
Definition rlm_radius.h:43
@ RLM_RADIUS_MODE_REPLICATE
Definition rlm_radius.h:45
@ RLM_RADIUS_MODE_UNCONNECTED_REPLICATE
Definition rlm_radius.h:46
@ RLM_RADIUS_MODE_CLIENT
Definition rlm_radius.h:44
uint32_t max_packet_size
Maximum packet size.
Definition rlm_radius.h:66
fr_time_delta_t response_window
Definition rlm_radius.h:58
uint32_t max_attributes
Maximum number of attributes to decode in response.
Definition rlm_radius.h:78
fr_time_delta_t zombie_period
Definition rlm_radius.h:59
static conf_parser_t retry_config[]
Definition rlm_tacacs.c:39
int fr_schedule_worker_id(void)
Return the worker id for the current thread.
Definition schedule.c:157
void connection_signal_reconnect(connection_t *conn, connection_reason_t reason)
Asynchronously signal the connection should be reconnected.
int connection_signal_on_fd(connection_t *conn, int fd)
Setup the connection to change states to connected or failed based on I/O events.
connection_t * connection_alloc(TALLOC_CTX *ctx, fr_event_list_t *el, connection_funcs_t const *funcs, connection_conf_t const *conf, char const *log_prefix, void const *uctx)
Allocate a new connection.
void connection_signal_connected(connection_t *conn)
Asynchronously signal that the connection is open.
void * data
Module's instance data.
Definition module.h:291
#define pair_append_request(_attr, _da)
Allocate and append a fr_pair_t to the request list.
Definition pair.h:37
fr_signal_t
Signals that can be generated/processed by request signal handlers.
Definition signal.h:38
@ FR_SIGNAL_DUP
A duplicate request was received.
Definition signal.h:44
@ FR_SIGNAL_CANCEL
Request has been cancelled.
Definition signal.h:40
eap_aka_sim_process_conf_t * inst
fr_pair_t * vp
eap_type_t type
The preferred EAP-Type of this instance of the EAP-SIM/AKA/AKA' state machine.
#define fr_time()
Allow us to arbitrarily manipulate time.
Definition state_test.c:8
Definition log.h:96
Value pair map.
Definition map.h:77
Stores an attribute, a value and various bits of other data.
Definition pair.h:68
char const * fr_syserror(int num)
Guaranteed to be thread-safe version of strerror.
Definition syserror.c:243
#define talloc_get_type_abort_const
Definition talloc.h:287
static int talloc_const_free(void const *ptr)
Free const'd memory.
Definition talloc.h:229
#define fr_time_gteq(_a, _b)
Definition time.h:238
static int64_t fr_time_unwrap(fr_time_t time)
Definition time.h:146
#define fr_time_wrap(_time)
Definition time.h:145
#define fr_time_lteq(_a, _b)
Definition time.h:240
#define fr_time_eq(_a, _b)
Definition time.h:241
#define fr_time_add(_a, _b)
Add a time/time delta together.
Definition time.h:196
#define fr_time_gt(_a, _b)
Definition time.h:237
#define fr_time_sub(_a, _b)
Subtract one time from another.
Definition time.h:229
static fr_unix_time_t fr_time_to_unix_time(fr_time_t when)
Convert an fr_time_t (internal time) to our version of unix time (wallclock time)
Definition time.h:688
#define fr_time_lt(_a, _b)
Definition time.h:239
"server local" time.
Definition time.h:69
An event timer list.
Definition timer.c:50
A timer event.
Definition timer.c:84
#define FR_TIMER_DELETE_RETURN(_ev_p)
Definition timer.h:110
#define FR_TIMER_DISARM(_ev)
Definition timer.h:91
static bool fr_timer_armed(fr_timer_t *ev)
Definition timer.h:120
#define fr_timer_at(...)
Definition timer.h:81
void radius_track_state_log(fr_log_t const *log, fr_log_type_t log_type, char const *file, int line, radius_track_t *tt, radius_track_log_extra_t extra)
Print out the state of every tracking entry.
Definition track.c:294
int radius_track_entry_update(radius_track_entry_t *te, uint8_t const *vector)
Update a tracking entry with the authentication vector.
Definition track.c:219
radius_track_entry_t * radius_track_entry_find(radius_track_t *tt, uint8_t packet_id, uint8_t const *vector)
Find a tracking entry from a request authenticator.
Definition track.c:248
radius_track_t * radius_track_alloc(TALLOC_CTX *ctx)
Create an radius_track_t.
Definition track.c:41
#define radius_track_entry_release(_te)
Definition track.h:90
void * uctx
Result/resumption context.
Definition track.h:47
uint8_t id
our ID
Definition track.h:50
unsigned int num_requests
number of requests in the allocation
Definition track.h:65
#define radius_track_entry_reserve(_te_out, _ctx, _tt, _request, _code, _uctx)
Definition track.h:82
request_t * request
as always...
Definition track.h:45
Track one request to a response.
Definition track.h:36
void trunk_connection_callback_readable(UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, void *uctx)
Standard I/O read function.
Definition trunk.c:4013
void trunk_connection_callback_writable(UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, void *uctx)
Standard I/O write function.
Definition trunk.c:4030
void trunk_request_signal_partial(trunk_request_t *treq)
Signal a partial write.
Definition trunk.c:2028
void trunk_request_signal_fail(trunk_request_t *treq)
Signal that a trunk request failed.
Definition trunk.c:2131
trunk_request_t * trunk_request_alloc(trunk_t *trunk, request_t *request)
(Pre-)Allocate a new trunk request
Definition trunk.c:2473
trunk_t * trunk_alloc(TALLOC_CTX *ctx, fr_event_list_t *el, trunk_io_funcs_t const *funcs, trunk_conf_t const *conf, char const *log_prefix, void const *uctx, bool delay_start)
Allocate a new collection of connections.
Definition trunk.c:4945
uint64_t trunk_connection_requests_requeue(trunk_connection_t *tconn, int states, uint64_t max, bool fail_bound)
Move requests off of a connection and requeue elsewhere.
Definition trunk.c:2009
trunk_enqueue_t trunk_request_enqueue_on_conn(trunk_request_t **treq_out, trunk_connection_t *tconn, request_t *request, void *preq, void *rctx, bool ignore_limits)
Enqueue additional requests on a specific connection.
Definition trunk.c:2740
trunk_enqueue_t trunk_request_enqueue(trunk_request_t **treq_out, trunk_t *trunk, request_t *request, void *preq, void *rctx)
Enqueue a request that needs data written to the trunk.
Definition trunk.c:2586
trunk_enqueue_t trunk_request_requeue(trunk_request_t *treq)
Re-enqueue a request on the same connection.
Definition trunk.c:2675
int trunk_connection_pop_request(trunk_request_t **treq_out, trunk_connection_t *tconn)
Pop a request off a connection's pending queue.
Definition trunk.c:3882
void trunk_request_signal_cancel(trunk_request_t *treq)
Cancel a trunk request.
Definition trunk.c:2151
void trunk_request_free(trunk_request_t **treq_to_free)
If the trunk request is freed then update the target requests.
Definition trunk.c:2321
void trunk_connection_signal_active(trunk_connection_t *tconn)
Signal a trunk connection is no longer full.
Definition trunk.c:3959
void trunk_connection_signal_inactive(trunk_connection_t *tconn)
Signal a trunk connection cannot accept more requests.
Definition trunk.c:3936
void trunk_request_signal_sent(trunk_request_t *treq)
Signal that the request was written to a connection successfully.
Definition trunk.c:2049
void trunk_request_signal_complete(trunk_request_t *treq)
Signal that a trunk request is complete.
Definition trunk.c:2093
void trunk_connection_signal_reconnect(trunk_connection_t *tconn, connection_reason_t reason)
Signal a trunk connection is no longer viable.
Definition trunk.c:3998
void trunk_request_state_log(fr_log_t const *log, fr_log_type_t log_type, char const *file, int line, trunk_request_t const *treq)
Definition trunk.c:2827
Associates request queues with a connection.
Definition trunk.c:133
Wraps a normal request.
Definition trunk.c:99
Main trunk management handle.
Definition trunk.c:197
#define TRUNK_REQUEST_STATE_ALL
All request states.
Definition trunk.h:195
trunk_connection_alloc_t connection_alloc
Allocate a new connection_t.
Definition trunk.h:733
trunk_connection_event_t
What type of I/O events the trunk connection is currently interested in receiving.
Definition trunk.h:72
@ TRUNK_CONN_EVENT_BOTH
Trunk should be notified if a connection is readable or writable.
Definition trunk.h:79
@ TRUNK_CONN_EVENT_WRITE
Trunk should be notified if a connection is writable.
Definition trunk.h:77
@ TRUNK_CONN_EVENT_NONE
Don't notify the trunk on connection state changes.
Definition trunk.h:73
@ TRUNK_CONN_EVENT_READ
Trunk should be notified if a connection is readable.
Definition trunk.h:75
trunk_cancel_reason_t
Reasons for a request being cancelled.
Definition trunk.h:55
@ TRUNK_CANCEL_REASON_REQUEUE
A previously sent request is being requeued.
Definition trunk.h:59
@ TRUNK_ENQUEUE_DST_UNAVAILABLE
Destination is down.
Definition trunk.h:153
@ TRUNK_ENQUEUE_FAIL
General failure.
Definition trunk.h:154
@ TRUNK_ENQUEUE_OK
Operation was successful.
Definition trunk.h:150
@ TRUNK_ENQUEUE_NO_CAPACITY
At maximum number of connections, and no connection has capacity.
Definition trunk.h:151
@ TRUNK_ENQUEUE_IN_BACKLOG
Request should be enqueued in backlog.
Definition trunk.h:149
trunk_request_state_t
Used for sanity checks and to simplify freeing.
Definition trunk.h:161
@ TRUNK_REQUEST_STATE_PARTIAL
Some of the request was written to the socket, more of it should be written later.
Definition trunk.h:170
@ TRUNK_REQUEST_STATE_REAPABLE
Request has been written, needs to persist, but we are not currently waiting for any response.
Definition trunk.h:173
@ TRUNK_REQUEST_STATE_UNASSIGNED
Transition state - Request currently not assigned to any connection.
Definition trunk.h:165
@ TRUNK_REQUEST_STATE_INIT
Initial state.
Definition trunk.h:162
@ TRUNK_REQUEST_STATE_CANCEL_SENT
We've informed the remote server that the request has been cancelled.
Definition trunk.h:185
@ TRUNK_REQUEST_STATE_COMPLETE
The request is complete.
Definition trunk.h:182
@ TRUNK_REQUEST_STATE_FAILED
The request failed.
Definition trunk.h:183
@ TRUNK_REQUEST_STATE_CANCEL
A request on a particular socket was cancel.
Definition trunk.h:184
@ TRUNK_REQUEST_STATE_CANCEL_PARTIAL
We partially wrote a cancellation request.
Definition trunk.h:187
@ TRUNK_REQUEST_STATE_BACKLOG
In the backlog.
Definition trunk.h:167
@ TRUNK_REQUEST_STATE_CANCEL_COMPLETE
Remote server has acknowledged our cancellation.
Definition trunk.h:188
@ TRUNK_REQUEST_STATE_PENDING
In the queue of a connection and is pending writing.
Definition trunk.h:168
@ TRUNK_REQUEST_STATE_SENT
Was written to a socket. Waiting for a response.
Definition trunk.h:172
I/O functions to pass to trunk_alloc.
Definition trunk.h:732
static fr_event_list_t * el
xlat_action_t unlang_xlat_yield_to_retry(request_t *request, xlat_func_t resume, fr_unlang_xlat_retry_t retry, xlat_func_signal_t signal, fr_signal_t sigmask, void *rctx, fr_retry_config_t const *retry_cfg)
Yield a request back to the interpreter, with retries.
Definition xlat.c:680
uint8_t required
Argument must be present, and non-empty.
Definition xlat.h:146
#define XLAT_ARGS(_list,...)
Populate local variables with value boxes from the input list.
Definition xlat.h:383
#define XLAT_ARG_PARSER_TERMINATOR
Definition xlat.h:170
xlat_action_t
Definition xlat.h:37
@ XLAT_ACTION_FAIL
An xlat function failed.
Definition xlat.h:44
@ XLAT_ACTION_DONE
We're done evaluating this level of nesting.
Definition xlat.h:43
Definition for a single argument consumend by an xlat function.
Definition xlat.h:145
bool fr_pair_list_empty(fr_pair_list_t const *list)
Is a valuepair list empty.
void fr_pair_list_free(fr_pair_list_t *list)
Free memory used by a valuepair list.
void fr_pair_list_append(fr_pair_list_t *dst, fr_pair_list_t *src)
Appends a list of fr_pair_t from a temporary list to a destination list.
fr_retry_state_t fr_retry_next(fr_retry_t *r, fr_time_t now)
Initialize a retransmission counter.
Definition retry.c:108
void fr_retry_init(fr_retry_t *r, fr_time_t now, fr_retry_config_t const *config)
Initialize a retransmission counter.
Definition retry.c:36
fr_time_t start
when we started the retransmission
Definition retry.h:53
fr_time_delta_t rt
retransmit interval
Definition retry.h:57
uint32_t mrc
Maximum retransmission count.
Definition retry.h:36
fr_retry_config_t const * config
master configuration
Definition retry.h:52
fr_retry_state_t state
so callers can see what state it's in.
Definition retry.h:60
@ FR_RETRY_MRC
reached maximum retransmission count
Definition retry.h:47
@ FR_RETRY_CONTINUE
Definition retry.h:46
@ FR_RETRY_MRD
reached maximum retransmission duration
Definition retry.h:48
uint32_t count
number of sent packets
Definition retry.h:58
fr_time_delta_t mrd
Maximum retransmission duration.
Definition retry.h:35
fr_time_t updated
last update, really a cached "now".
Definition retry.h:56
fr_time_t next
when the next timer should be set
Definition retry.h:55
int af
AF_INET, AF_INET6, or AF_UNIX.
Definition socket.h:78
int fd
File descriptor if this is a live socket.
Definition socket.h:81
char const * fr_strerror(void)
Get the last library error.
Definition strerror.c:553
#define fr_value_box_alloc(_ctx, _type, _enumv)
Allocate a value box of a specific type.
Definition value.h:640
static fr_slen_t data
Definition value.h:1288
#define fr_box_time_delta(_val)
Definition value.h:362
int nonnull(2, 5))
static size_t char ** out
Definition value.h:1020
void * rctx
Resume context.
Definition xlat_ctx.h:54
module_ctx_t const * mctx
Synthesised module calling ctx.
Definition xlat_ctx.h:52
An xlat calling ctx.
Definition xlat_ctx.h:49